From 54dc19ecad2ed06694a4b6269c2833d9533a26f5 Mon Sep 17 00:00:00 2001
From: Mahito OGURA <m.ogura@ntt.com>
Date: Tue, 14 Jul 2015 17:16:42 +0900
Subject: [PATCH 0001/2409] Add export_proxy_variables() tests to
 test_functions.sh

In test_functions.sh, There aren't export_proxy_variables() tests.
This patch add test of export_proxy_variables to test_funstions.sh.

Change-Id: I76f2bab84f4019961e612b0bff0ab66646b6e160
---
 tests/test_functions.sh | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/tests/test_functions.sh b/tests/test_functions.sh
index f555de8dff..be8dc5e287 100755
--- a/tests/test_functions.sh
+++ b/tests/test_functions.sh
@@ -245,4 +245,33 @@ else
     passed "OK"
 fi
 
+function test_export_proxy_variables {
+    echo "Testing export_proxy_variables()"
+
+    local expected results
+
+    http_proxy=http_proxy_test
+    https_proxy=https_proxy_test
+    no_proxy=no_proxy_test
+
+    export_proxy_variables
+    expected=$(echo -e "http_proxy=$http_proxy\nhttps_proxy=$https_proxy\nno_proxy=$no_proxy")
+    results=$(env | egrep '(http(s)?|no)_proxy=')
+    if [[ $expected = $results ]]; then
+        passed "OK: Proxy variables are exported when proxy variables are set"
+    else
+        failed "Expected: $expected, Failed: $results"
+    fi
+
+    unset http_proxy https_proxy no_proxy
+    export_proxy_variables
+    results=$(env | egrep '(http(s)?|no)_proxy=')
+    if [[ "" = $results ]]; then
+        passed "OK: Proxy variables aren't exported when proxy variables aren't set"
+    else
+        failed "Expected: '', Failed: $results"
+    fi
+}
+test_export_proxy_variables
+
 report_results

From ff70dad892a89cc4cb09aebfcf72e2de5ab7d556 Mon Sep 17 00:00:00 2001
From: Jens Rosenboom <j.rosenboom@x-ion.de>
Date: Wed, 1 Jul 2015 15:22:53 +0200
Subject: [PATCH 0002/2409] Make image_list.sh independent of host IP address

We do not need the HOST_IP to be detected in order to be able to list
our images. So just set that to some dummy value before sourcing
functions.

This will allow tools like disk-image-builder to work regardless of
whether get_default_host_ip succeeds or not.

Change-Id: I9c22d2066e34309e70e56076e3d17c5db6ecee06
---
 tools/image_list.sh | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/tools/image_list.sh b/tools/image_list.sh
index a27635effd..27b3d4612d 100755
--- a/tools/image_list.sh
+++ b/tools/image_list.sh
@@ -3,6 +3,12 @@
 # Keep track of the DevStack directory
 TOP_DIR=$(cd $(dirname "$0")/.. && pwd)
 
+# The following "source" implicitly calls get_default_host_ip() in
+# stackrc and will die if the selected default IP happens to lie
+# in the default ranges for FIXED_RANGE or FLOATING_RANGE. Since we
+# do not really need HOST_IP to be properly set in the remainder of
+# this script, just set it to some dummy value and make stackrc happy.
+HOST_IP=SKIP
 source $TOP_DIR/functions
 
 # Possible virt drivers, if we have more, add them here. Always keep

From 961643e404919e0fa3b90f7620a4daccc962e6a3 Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@midokura.com>
Date: Fri, 31 Jul 2015 13:45:27 +0900
Subject: [PATCH 0003/2409] configuration.rst: Document post-extra meta section
 phase

Change-Id: I81d121424057fd79c1a0a65d420df3ee1badb6f3
---
 doc/source/configuration.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 6052576e98..96f91ec774 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -56,6 +56,7 @@ The defined phases are:
    before they are started
 -  **extra** - runs after services are started and before any files in
    ``extra.d`` are executed
+-  **post-extra** - runs after files in ``extra.d`` are executed
 
 The file is processed strictly in sequence; meta-sections may be
 specified more than once but if any settings are duplicated the last to

From 05076fb7ea45b7f1f7d9f232afb56dbb1d6e2f08 Mon Sep 17 00:00:00 2001
From: Jamie Lennox <jamielennox@redhat.com>
Date: Sat, 15 Aug 2015 19:01:59 +1000
Subject: [PATCH 0004/2409] Configure horizon with identity v3

Currently horizon configures keystone using v3 only if v2 is not
available. Really we should just always be using v3.

Change-Id: Icac4d90b617209da75abf33f8e25ffc021c45fdb
---
 lib/horizon | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/lib/horizon b/lib/horizon
index b0f306b675..108a7f0a8f 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -98,13 +98,8 @@ function init_horizon {
 
     _horizon_config_set $local_settings "" OPENSTACK_HOST \"${KEYSTONE_SERVICE_HOST}\"
 
-    if [ "$ENABLE_IDENTITY_V2" == "False" ]; then
-        # Only Identity v3 API is available; then use it with v3 auth tokens
-        _horizon_config_set $local_settings "" OPENSTACK_API_VERSIONS {\"identity\":3}
-        _horizon_config_set $local_settings "" OPENSTACK_KEYSTONE_URL "\"${KEYSTONE_SERVICE_PROTOCOL}://${KEYSTONE_SERVICE_HOST}:${KEYSTONE_SERVICE_PORT}/v3\""
-    else
-        _horizon_config_set $local_settings "" OPENSTACK_KEYSTONE_URL "\"${KEYSTONE_SERVICE_PROTOCOL}://${KEYSTONE_SERVICE_HOST}:${KEYSTONE_SERVICE_PORT}/v2.0\""
-    fi
+    _horizon_config_set $local_settings "" OPENSTACK_API_VERSIONS {\"identity\":3}
+    _horizon_config_set $local_settings "" OPENSTACK_KEYSTONE_URL "\"${KEYSTONE_SERVICE_PROTOCOL}://${KEYSTONE_SERVICE_HOST}:${KEYSTONE_SERVICE_PORT}/v3\""
 
     if [ -f $SSL_BUNDLE_FILE ]; then
         _horizon_config_set $local_settings "" OPENSTACK_SSL_CACERT \"${SSL_BUNDLE_FILE}\"

From 382f982e51d6117cf8d478b94f975455dabe4ce9 Mon Sep 17 00:00:00 2001
From: Julien Danjou <julien@danjou.info>
Date: Mon, 21 Sep 2015 14:19:52 +0000
Subject: [PATCH 0005/2409] keystone: fix prefixed URL

Commit 2ad1a42ca667ff21e6f7d2ae906be23a20430036 broke entirely the
Apache configuration for Keystone when used without a port on the
/identity URL. This patch fixes that.

Change-Id: I47805138c66456c9c5fa9af1f4ac33b03d0ce5b9
---
 files/apache-keystone.template | 34 ++++++++++++----------------------
 1 file changed, 12 insertions(+), 22 deletions(-)

diff --git a/files/apache-keystone.template b/files/apache-keystone.template
index 4d3d2d6623..f9fa265db5 100644
--- a/files/apache-keystone.template
+++ b/files/apache-keystone.template
@@ -2,6 +2,16 @@ Listen %PUBLICPORT%
 Listen %ADMINPORT%
 LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\" %D(us)" keystone_combined
 
+<Directory %KEYSTONE_BIN%>
+    <IfVersion >= 2.4>
+        Require all granted
+    </IfVersion>
+    <IfVersion < 2.4>
+        Order allow,deny
+        Allow from all
+    </IfVersion>
+</Directory>
+
 <VirtualHost *:%PUBLICPORT%>
     WSGIDaemonProcess keystone-public processes=5 threads=1 user=%USER% display-name=%{GROUP} %VIRTUALENV%
     WSGIProcessGroup keystone-public
@@ -16,16 +26,6 @@ LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\" %D(us)"
     %SSLENGINE%
     %SSLCERTFILE%
     %SSLKEYFILE%
-
-    <Directory %KEYSTONE_BIN%>
-        <IfVersion >= 2.4>
-            Require all granted
-        </IfVersion>
-        <IfVersion < 2.4>
-            Order allow,deny
-            Allow from all
-        </IfVersion>
-    </Directory>
 </VirtualHost>
 
 <VirtualHost *:%ADMINPORT%>
@@ -42,19 +42,9 @@ LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\" %D(us)"
     %SSLENGINE%
     %SSLCERTFILE%
     %SSLKEYFILE%
-
-    <Directory %KEYSTONE_BIN%>
-        <IfVersion >= 2.4>
-            Require all granted
-        </IfVersion>
-        <IfVersion < 2.4>
-            Order allow,deny
-            Allow from all
-        </IfVersion>
-    </Directory>
 </VirtualHost>
 
-Alias /identity %PUBLICWSGI%
+Alias /identity %KEYSTONE_BIN%/keystone-wsgi-public
 <Location /identity>
     SetHandler wsgi-script
     Options +ExecCGI
@@ -64,7 +54,7 @@ Alias /identity %PUBLICWSGI%
     WSGIPassAuthorization On
 </Location>
 
-Alias /identity_admin %ADMINWSGI%
+Alias /identity_admin %KEYSTONE_BIN%/keystone-wsgi-admin
 <Location /identity_admin>
     SetHandler wsgi-script
     Options +ExecCGI

From 59c6377ae51c024c28a6fba72de567bc97edda10 Mon Sep 17 00:00:00 2001
From: Roxana Gherle <roxana.gherle@hp.com>
Date: Wed, 9 Sep 2015 18:22:31 -0700
Subject: [PATCH 0006/2409] Assign admin role for admin user on default domain

This patch adds an admin role assignment for the admin user on
the default domain as part of the Keystone configuration stage.

Closes-Bug: #1494081
Change-Id: I91c88917bd51be4572e4970c94e65d866798df26
---
 functions-common | 32 ++++++++++++++++++++++++++++++++
 lib/keystone     |  1 +
 2 files changed, 33 insertions(+)

diff --git a/functions-common b/functions-common
index 446de5374f..c38a77243e 100644
--- a/functions-common
+++ b/functions-common
@@ -803,6 +803,38 @@ function get_or_add_user_project_role {
     echo $user_role_id
 }
 
+# Gets or adds user role to domain
+# Usage: get_or_add_user_domain_role <role> <user> <domain>
+function get_or_add_user_domain_role {
+    local user_role_id
+    # Gets user role id
+    user_role_id=$(openstack role list \
+        --user $2 \
+        --os-url=$KEYSTONE_SERVICE_URI_V3 \
+        --os-identity-api-version=3 \
+        --column "ID" \
+        --domain $3 \
+        --column "Name" \
+        | grep " $1 " | get_field 1)
+    if [[ -z "$user_role_id" ]]; then
+        # Adds role to user and get it
+        openstack role add $1 \
+            --user $2 \
+            --domain $3 \
+            --os-url=$KEYSTONE_SERVICE_URI_V3 \
+            --os-identity-api-version=3
+        user_role_id=$(openstack role list \
+            --user $2 \
+            --os-url=$KEYSTONE_SERVICE_URI_V3 \
+            --os-identity-api-version=3 \
+            --column "ID" \
+            --domain $3 \
+            --column "Name" \
+            | grep " $1 " | get_field 1)
+    fi
+    echo $user_role_id
+}
+
 # Gets or adds group role to project
 # Usage: get_or_add_group_project_role <role> <group> <project>
 function get_or_add_group_project_role {
diff --git a/lib/keystone b/lib/keystone
index e2448c9068..b15abe1cb5 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -364,6 +364,7 @@ function create_keystone_accounts {
     local admin_user=$(get_or_create_user "admin" "$ADMIN_PASSWORD" default)
     local admin_role=$(get_or_create_role "admin")
     get_or_add_user_project_role $admin_role $admin_user $admin_tenant
+    get_or_add_user_domain_role $admin_role $admin_user default
 
     # Create service project/role
     get_or_create_project "$SERVICE_TENANT_NAME" default

From 8872545a0f98c5681147a08541e119813f0bdc01 Mon Sep 17 00:00:00 2001
From: Kashyap Chamarthy <kchamart@redhat.com>
Date: Mon, 14 Sep 2015 13:17:56 +0200
Subject: [PATCH 0007/2409] worlddump: Use SIGUSR2 instead of SIGUSR1

The function guru_meditation_report() currently uses the User-defined
signal SIGUSR1 to kill a Nova Compute process so that a Guru Meditation
Report is generated.

Testing locally, in a DevStack instance, manually attempting to kill a
Nova compute process [kill -s USR1 `pgrep nova-compute`] does not result
in process being terminated, and no error report generated.

It turns out[1] that SIGUSR1 is used by Apache 'mod_wsgi'.

Using the signal SIGUSR2 resolves this issue (i.e. 'nova-compute'
process is terminated, and the Guru Meditation Report is generated).

So, use USR2, instead of USR1.

Corresponding oslo.reports related commit[2].

[1] https://code.google.com/p/modwsgi/wiki/ConfigurationDirectives#WSGIRestrictSignal
[2] 45b1c02d113051d147e54ef921ce8e94135542d8 -- guru_meditation_report:
    Use SIGUSR2 instead of SIGUSR1
[3] Original DevStack commit that brought in this change --
    2ebe993b25462919e8aeeb896c9f91b6be7aa573

Change-Id: I8a7eaf71b83edca3c80074d6bf2d471e3db6142b
---
 tools/worlddump.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/worlddump.py b/tools/worlddump.py
index 1b337a9a83..33d5b8f620 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -131,7 +131,7 @@ def guru_meditation_report():
         print "Skipping as nova-compute does not appear to be running"
         return
 
-    _dump_cmd("kill -s USR1 `pgrep nova-compute`")
+    _dump_cmd("kill -s USR2 `pgrep nova-compute`")
     print "guru meditation report in nova-compute log"
 
 

From bb4654b869722feb400d65869350465d8ff5439c Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Tue, 6 Oct 2015 18:09:07 +0200
Subject: [PATCH 0008/2409] Don't configure neutron metadata agent for neutron
 API access

Metadata agent now talks to neutron-server thru AMQP, so there is no use
for API access configuration.

Change-Id: I8f81eea91fe3448d5098e77312f64f2eaba68a68
Depends-On: I254c575c66214f50fb93a94c46c4c9caebfc2937
Closes-Bug: #1502947
---
 lib/neutron-legacy | 14 +-------------
 1 file changed, 1 insertion(+), 13 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index e67bd4ae32..8b964a72c8 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -1050,11 +1050,6 @@ function _configure_neutron_metadata_agent {
     if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
         iniset $Q_META_CONF_FILE AGENT root_helper_daemon "$Q_RR_DAEMON_COMMAND"
     fi
-
-    # Configures keystone for metadata_agent
-    # The third argument "True" sets auth_url needed to communicate with keystone
-    _neutron_setup_keystone $Q_META_CONF_FILE DEFAULT True
-
 }
 
 function _configure_neutron_ceilometer_notifications {
@@ -1212,17 +1207,10 @@ function _neutron_setup_rootwrap {
     fi
 }
 
-# Configures keystone integration for neutron service and agents
+# Configures keystone integration for neutron service
 function _neutron_setup_keystone {
     local conf_file=$1
     local section=$2
-    local use_auth_url=$3
-
-    # Configures keystone for metadata_agent
-    # metadata_agent needs auth_url to communicate with keystone
-    if [[ "$use_auth_url" == "True" ]]; then
-        iniset $conf_file $section auth_url $KEYSTONE_SERVICE_URI/v2.0
-    fi
 
     create_neutron_cache_dir
     configure_auth_token_middleware $conf_file $Q_ADMIN_USERNAME $NEUTRON_AUTH_CACHE_DIR $section

From 797668ba77d781bf65cbf0832c69c8337603b9a4 Mon Sep 17 00:00:00 2001
From: jianghua wang <jianghua.wang@citrix.com>
Date: Thu, 8 Oct 2015 06:40:21 +0100
Subject: [PATCH 0009/2409] XenServer: the cron job shouldn't print debug text
 into stderr

one cron job attempts to print debug text into stderr; so the file
of /root/dead.letter gets created and its size grows continuously.
It could eventually threaten dom0 disk space. Maybe there are two
solutions: one is to redirect the output to a specific log file;
and rotate log files in the script. And the other one is simply
to redirect the output /dev/null. By considering the function of
this cron job and the printed contents are straight and simple,
this patch set goes with the later solution.

Change-Id: I4875e5e3837e6f0249e314c6c5f408c79145c6c1
Closes-Bug: 1503966
---
 lib/nova_plugins/hypervisor-xenserver | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova_plugins/hypervisor-xenserver b/lib/nova_plugins/hypervisor-xenserver
index efce383222..e097990bd3 100644
--- a/lib/nova_plugins/hypervisor-xenserver
+++ b/lib/nova_plugins/hypervisor-xenserver
@@ -79,7 +79,7 @@ function configure_nova_hypervisor {
 
     # Create a cron job that will rotate guest logs
     $ssh_dom0 crontab - << CRONTAB
-* * * * * /root/rotate_xen_guest_logs.sh
+* * * * * /root/rotate_xen_guest_logs.sh >/dev/null 2>&1
 CRONTAB
 
     # Create directories for kernels and images

From 085855479f5a56e9ce21fdb83e2691c8aad56aa0 Mon Sep 17 00:00:00 2001
From: Marian Horban <mhorban@mirantis.com>
Date: Mon, 12 Oct 2015 11:36:51 -0400
Subject: [PATCH 0010/2409] Added processing /ec2 URL

With config option NOVA_USE_MOD_WSGI=True nova-ec2-api handles
requests on /ec2 URL.

Change-Id: I0c2e99bf8b5e5cf53cd176685b206038a4b0f78b
---
 files/apache-nova-ec2-api.template |  9 +++++++++
 lib/nova                           | 13 +++++++++----
 2 files changed, 18 insertions(+), 4 deletions(-)

diff --git a/files/apache-nova-ec2-api.template b/files/apache-nova-ec2-api.template
index 235d958d1a..6443567740 100644
--- a/files/apache-nova-ec2-api.template
+++ b/files/apache-nova-ec2-api.template
@@ -14,3 +14,12 @@ Listen %PUBLICPORT%
     %SSLCERTFILE%
     %SSLKEYFILE%
 </VirtualHost>
+
+Alias /ec2 %PUBLICWSGI%
+<Location /ec2>
+    SetHandler wsgi-script
+    Options +ExecCGI
+    WSGIProcessGroup nova-ec2-api
+    WSGIApplicationGroup %{GLOBAL}
+    WSGIPassAuthorization On
+</Location>
diff --git a/lib/nova b/lib/nova
index 9830276232..eb1ae1cfaa 100644
--- a/lib/nova
+++ b/lib/nova
@@ -440,13 +440,18 @@ function create_nova_accounts {
 
         # EC2
         if [[ "$KEYSTONE_CATALOG_BACKEND" = "sql" ]]; then
-
+            local nova_ec2_api_url
+            if [[ "$NOVA_USE_MOD_WSGI" == "False" ]]; then
+                nova_ec2_api_url="$EC2_SERVICE_PROTOCOL://$SERVICE_HOST:$EC2_SERVICE_PORT/"
+            else
+                nova_ec2_api_url="$EC2_SERVICE_PROTOCOL://$SERVICE_HOST/ec2"
+            fi
             get_or_create_service "ec2" "ec2" "EC2 Compatibility Layer"
             get_or_create_endpoint "ec2" \
                 "$REGION_NAME" \
-                "$EC2_SERVICE_PROTOCOL://$SERVICE_HOST:8773/" \
-                "$EC2_SERVICE_PROTOCOL://$SERVICE_HOST:8773/" \
-                "$EC2_SERVICE_PROTOCOL://$SERVICE_HOST:8773/"
+                "$nova_ec2_api_url" \
+                "$nova_ec2_api_url" \
+                "$nova_ec2_api_url"
         fi
     fi
 

From 8043bfaf5ec6059e7245ff397672b1da0e563013 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Wed, 14 Oct 2015 14:53:18 +1100
Subject: [PATCH 0011/2409] Turn off tracing for service functions

These functions commonly externally called (as part of stackrc
inclusion, even) and do a fair bit of iteration over long
service-lists, which really fills up the logs of devstack and grenade
with unnecessary details.

The functions are well tested by unit-tests, so we are very unlikely
to need to debug internal issues with them in a hurry.  Thus turn
logging down for them.

Change-Id: I63b9a05a0678c7e0c7012f6d768c29fd67f090d2
---
 functions-common | 35 ++++++++++++++++++++++++++++++++++-
 1 file changed, 34 insertions(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index be3f81c412..c8f551de3c 100644
--- a/functions-common
+++ b/functions-common
@@ -1147,7 +1147,7 @@ function update_package_repo {
 
     if is_ubuntu; then
         local xtrace
-    xtrace=$(set +o | grep xtrace)
+        xtrace=$(set +o | grep xtrace)
         set +o xtrace
         if [[ "$REPOS_UPDATED" != "True" || "$RETRY_UPDATE" = "True" ]]; then
             # if there are transient errors pulling the updates, that's fine.
@@ -1758,11 +1758,17 @@ function run_phase {
 # remove extra commas from the input string (i.e. ``ENABLED_SERVICES``)
 # _cleanup_service_list service-list
 function _cleanup_service_list {
+    local xtrace
+    xtrace=$(set +o | grep xtrace)
+    set +o xtrace
+
     echo "$1" | sed -e '
         s/,,/,/g;
         s/^,//;
         s/,$//
     '
+
+    $xtrace
 }
 
 # disable_all_services() removes all current services
@@ -1780,6 +1786,10 @@ function disable_all_services {
 # Uses global ``ENABLED_SERVICES``
 # disable_negated_services
 function disable_negated_services {
+    local xtrace
+    xtrace=$(set +o | grep xtrace)
+    set +o xtrace
+
     local to_remove=""
     local remaining=""
     local service
@@ -1797,6 +1807,8 @@ function disable_negated_services {
     # go through the service list.  if this service appears in the "to
     # be removed" list, drop it
     ENABLED_SERVICES=$(remove_disabled_services "$remaining" "$to_remove")
+
+    $xtrace
 }
 
 # disable_service() prepares the services passed as argument to be
@@ -1808,6 +1820,10 @@ function disable_negated_services {
 # Uses global ``DISABLED_SERVICES``
 # disable_service service [service ...]
 function disable_service {
+    local xtrace
+    xtrace=$(set +o | grep xtrace)
+    set +o xtrace
+
     local disabled_svcs="${DISABLED_SERVICES}"
     local enabled_svcs=",${ENABLED_SERVICES},"
     local service
@@ -1819,6 +1835,8 @@ function disable_service {
     done
     DISABLED_SERVICES=$(_cleanup_service_list "$disabled_svcs")
     ENABLED_SERVICES=$(_cleanup_service_list "$enabled_svcs")
+
+    $xtrace
 }
 
 # enable_service() adds the services passed as argument to the
@@ -1832,6 +1850,10 @@ function disable_service {
 # Uses global ``ENABLED_SERVICES``
 # enable_service service [service ...]
 function enable_service {
+    local xtrace
+    xtrace=$(set +o | grep xtrace)
+    set +o xtrace
+
     local tmpsvcs="${ENABLED_SERVICES}"
     local service
     for service in $@; do
@@ -1845,6 +1867,8 @@ function enable_service {
     done
     ENABLED_SERVICES=$(_cleanup_service_list "$tmpsvcs")
     disable_negated_services
+
+    $xtrace
 }
 
 # is_service_enabled() checks if the service(s) specified as arguments are
@@ -1873,6 +1897,7 @@ function is_service_enabled {
     local xtrace
     xtrace=$(set +o | grep xtrace)
     set +o xtrace
+
     local enabled=1
     local services=$@
     local service
@@ -1898,6 +1923,7 @@ function is_service_enabled {
         [[ ${service} == "swift" && ${ENABLED_SERVICES} =~ "s-" ]] && enabled=0
         [[ ${service} == s-* && ${ENABLED_SERVICES} =~ "swift" ]] && enabled=0
     done
+
     $xtrace
     return $enabled
 }
@@ -1905,6 +1931,10 @@ function is_service_enabled {
 # remove specified list from the input string
 # remove_disabled_services service-list remove-list
 function remove_disabled_services {
+    local xtrace
+    xtrace=$(set +o | grep xtrace)
+    set +o xtrace
+
     local service_list=$1
     local remove_list=$2
     local service
@@ -1923,6 +1953,9 @@ function remove_disabled_services {
             enabled="${enabled},$service"
         fi
     done
+
+    $xtrace
+
     _cleanup_service_list "$enabled"
 }
 

From c49917250f2dc5243d652e59d8c70c1437975dea Mon Sep 17 00:00:00 2001
From: Marian Horban <mhorban@mirantis.com>
Date: Thu, 22 Oct 2015 04:21:34 -0400
Subject: [PATCH 0012/2409] Removed starting of nova-ec2-api service

Since nova-ec2-api service was removed from nova it is not
needed in devstack.

Change-Id: I91d4be02a1a9c2ca4d18256d9a37a5c2559f53b7
Closes-Bug: #1530798
---
 files/apache-nova-ec2-api.template | 25 -----------------
 lib/nova                           | 44 ------------------------------
 2 files changed, 69 deletions(-)
 delete mode 100644 files/apache-nova-ec2-api.template

diff --git a/files/apache-nova-ec2-api.template b/files/apache-nova-ec2-api.template
deleted file mode 100644
index 7b1d68b106..0000000000
--- a/files/apache-nova-ec2-api.template
+++ /dev/null
@@ -1,25 +0,0 @@
-Listen %PUBLICPORT%
-
-<VirtualHost *:%PUBLICPORT%>
-    WSGIDaemonProcess nova-ec2-api processes=%APIWORKERS% threads=1 user=%USER% display-name=%{GROUP} %VIRTUALENV%
-    WSGIProcessGroup nova-ec2-api
-    WSGIScriptAlias / %PUBLICWSGI%
-    WSGIApplicationGroup %{GLOBAL}
-    WSGIPassAuthorization On
-    <IfVersion >= 2.4>
-      ErrorLogFormat "%M"
-    </IfVersion>
-    ErrorLog /var/log/%APACHE_NAME%/nova-ec2-api.log
-    %SSLENGINE%
-    %SSLCERTFILE%
-    %SSLKEYFILE%
-</VirtualHost>
-
-Alias /ec2 %PUBLICWSGI%
-<Location /ec2>
-    SetHandler wsgi-script
-    Options +ExecCGI
-    WSGIProcessGroup nova-ec2-api
-    WSGIApplicationGroup %{GLOBAL}
-    WSGIPassAuthorization On
-</Location>
diff --git a/lib/nova b/lib/nova
index 6337f875ef..c75623f7d6 100644
--- a/lib/nova
+++ b/lib/nova
@@ -242,7 +242,6 @@ function cleanup_nova {
 function _cleanup_nova_apache_wsgi {
     sudo rm -f $NOVA_WSGI_DIR/*
     sudo rm -f $(apache_site_config_for nova-api)
-    sudo rm -f $(apache_site_config_for nova-ec2-api)
     sudo rm -f $(apache_site_config_for nova-metadata)
 }
 
@@ -252,15 +251,12 @@ function _config_nova_apache_wsgi {
 
     local nova_apache_conf
     nova_apache_conf=$(apache_site_config_for nova-api)
-    local nova_ec2_apache_conf
-    nova_ec2_apache_conf=$(apache_site_config_for nova-ec2-api)
     local nova_metadata_apache_conf
     nova_metadata_apache_conf=$(apache_site_config_for nova-metadata)
     local nova_ssl=""
     local nova_certfile=""
     local nova_keyfile=""
     local nova_api_port=$NOVA_SERVICE_PORT
-    local nova_ec2_api_port=$EC2_SERVICE_PORT
     local nova_metadata_port=$METADATA_SERVICE_PORT
     local venv_path=""
 
@@ -275,7 +271,6 @@ function _config_nova_apache_wsgi {
 
     # copy proxy vhost and wsgi helper files
     sudo cp $NOVA_DIR/nova/wsgi/nova-api.py $NOVA_WSGI_DIR/nova-api
-    sudo cp $NOVA_DIR/nova/wsgi/nova-ec2-api.py $NOVA_WSGI_DIR/nova-ec2-api
     sudo cp $NOVA_DIR/nova/wsgi/nova-metadata.py $NOVA_WSGI_DIR/nova-metadata
 
     sudo cp $FILES/apache-nova-api.template $nova_apache_conf
@@ -291,19 +286,6 @@ function _config_nova_apache_wsgi {
         s|%APIWORKERS%|$API_WORKERS|g
     " -i $nova_apache_conf
 
-    sudo cp $FILES/apache-nova-ec2-api.template $nova_ec2_apache_conf
-    sudo sed -e "
-        s|%PUBLICPORT%|$nova_ec2_api_port|g;
-        s|%APACHE_NAME%|$APACHE_NAME|g;
-        s|%PUBLICWSGI%|$NOVA_WSGI_DIR/nova-ec2-api|g;
-        s|%SSLENGINE%|$nova_ssl|g;
-        s|%SSLCERTFILE%|$nova_certfile|g;
-        s|%SSLKEYFILE%|$nova_keyfile|g;
-        s|%USER%|$STACK_USER|g;
-        s|%VIRTUALENV%|$venv_path|g
-        s|%APIWORKERS%|$API_WORKERS|g
-    " -i $nova_ec2_apache_conf
-
     sudo cp $FILES/apache-nova-metadata.template $nova_metadata_apache_conf
     sudo sed -e "
         s|%PUBLICPORT%|$nova_metadata_port|g;
@@ -461,22 +443,6 @@ function create_nova_accounts {
             # swift through the s3 api.
             get_or_add_user_project_role ResellerAdmin nova $SERVICE_TENANT_NAME
         fi
-
-        # EC2
-        if [[ "$KEYSTONE_CATALOG_BACKEND" = "sql" ]]; then
-            local nova_ec2_api_url
-            if [[ "$NOVA_USE_MOD_WSGI" == "False" ]]; then
-                nova_ec2_api_url="$EC2_SERVICE_PROTOCOL://$SERVICE_HOST:$EC2_SERVICE_PORT/"
-            else
-                nova_ec2_api_url="$EC2_SERVICE_PROTOCOL://$SERVICE_HOST/ec2"
-            fi
-            get_or_create_service "ec2" "ec2" "EC2 Compatibility Layer"
-            get_or_create_endpoint "ec2" \
-                "$REGION_NAME" \
-                "$nova_ec2_api_url" \
-                "$nova_ec2_api_url" \
-                "$nova_ec2_api_url"
-        fi
     fi
 
     # S3
@@ -522,7 +488,6 @@ function create_nova_conf {
     iniset $NOVA_CONF api_database connection `database_connection_url nova_api`
     iniset $NOVA_CONF DEFAULT instance_name_template "${INSTANCE_NAME_PREFIX}%08x"
     iniset $NOVA_CONF DEFAULT osapi_compute_listen "$NOVA_SERVICE_LISTEN_ADDRESS"
-    iniset $NOVA_CONF DEFAULT ec2_listen "$NOVA_SERVICE_LISTEN_ADDRESS"
     iniset $NOVA_CONF DEFAULT metadata_listen "$NOVA_SERVICE_LISTEN_ADDRESS"
     iniset $NOVA_CONF DEFAULT s3_listen "$NOVA_SERVICE_LISTEN_ADDRESS"
 
@@ -629,12 +594,10 @@ function create_nova_conf {
     fi
 
     iniset $NOVA_CONF DEFAULT ec2_dmz_host "$EC2_DMZ_HOST"
-    iniset $NOVA_CONF DEFAULT keystone_ec2_url $KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v2.0/ec2tokens
     iniset_rpc_backend nova $NOVA_CONF
     iniset $NOVA_CONF glance api_servers "${GLANCE_SERVICE_PROTOCOL}://${GLANCE_HOSTPORT}"
 
     iniset $NOVA_CONF DEFAULT osapi_compute_workers "$API_WORKERS"
-    iniset $NOVA_CONF DEFAULT ec2_workers "$API_WORKERS"
     iniset $NOVA_CONF DEFAULT metadata_workers "$API_WORKERS"
     # don't let the conductor get out of control now that we're using a pure python db driver
     iniset $NOVA_CONF conductor workers "$API_WORKERS"
@@ -660,10 +623,6 @@ function create_nova_conf {
         iniset $NOVA_CONF DEFAULT enabled_ssl_apis "$NOVA_ENABLED_APIS"
     fi
 
-    if is_service_enabled tls-proxy; then
-        iniset $NOVA_CONF DEFAULT ec2_listen_port $EC2_SERVICE_PORT_INT
-    fi
-
     if is_service_enabled n-sproxy; then
         iniset $NOVA_CONF serial_console serialproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
         iniset $NOVA_CONF serial_console enabled True
@@ -817,11 +776,9 @@ function start_nova_api {
     enabled_site_file=$(apache_site_config_for nova-api)
     if [ -f ${enabled_site_file} ] && [ "$NOVA_USE_MOD_WSGI" == "True" ]; then
         enable_apache_site nova-api
-        enable_apache_site nova-ec2-api
         enable_apache_site nova-metadata
         restart_apache_server
         tail_log nova-api /var/log/$APACHE_NAME/nova-api.log
-        tail_log nova-ec2-api /var/log/$APACHE_NAME/nova-ec2-api.log
         tail_log nova-metadata /var/log/$APACHE_NAME/nova-metadata.log
     else
         run_process n-api "$NOVA_BIN_DIR/nova-api"
@@ -937,7 +894,6 @@ function stop_nova_compute {
 function stop_nova_rest {
     if [ "$NOVA_USE_MOD_WSGI" == "True" ]; then
         disable_apache_site nova-api
-        disable_apache_site nova-ec2-api
         disable_apache_site nova-metadata
         restart_apache_server
     else

From c148b13c60525be637d23a1330cf56376f11432f Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Thu, 22 Oct 2015 10:05:00 -0400
Subject: [PATCH 0013/2409] Ensure we disable tenant isolation without admin

This commit fixes an issue with the tempest configuration when
TEMPEST_HAS_ADMIN is disabled. Without admin credentials tempest
is unable to create credentials at all so enabling tenant isolation
is not going to work. Previously devstack wasn't setting it one way
or the other when TEMPEST_HAS_ADMIN was set, which results in the
default of being enabled. So jobs that try to run tempest without
admin were failing.

Change-Id: Iff496cb5cbf29f17c130cfad746b48d8547ca965
---
 lib/tempest | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index 10dd652750..bd76be570d 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -564,9 +564,13 @@ function configure_tempest {
         fi
         iniset $TEMPEST_CONFIG auth allow_tenant_isolation False
         iniset $TEMPEST_CONFIG auth test_accounts_file "etc/accounts.yaml"
+    elif [[ $TEMPEST_HAS_ADMIN == "False" ]]; then
+        iniset $TEMPEST_CONFIG auth allow_tenant_isolation ${TEMPEST_ALLOW_TENANT_ISOLATION:-False}
+
     else
         iniset $TEMPEST_CONFIG auth allow_tenant_isolation ${TEMPEST_ALLOW_TENANT_ISOLATION:-True}
     fi
+
     # Restore IFS
     IFS=$ifs
 }

From 22f747b8df023dd74808df097f5fa5a92168f620 Mon Sep 17 00:00:00 2001
From: Falk Reimann <falk.reimann@sap.com>
Date: Fri, 28 Aug 2015 12:40:19 +0200
Subject: [PATCH 0014/2409] Use swift port variable in keystone and cinder

This patch alows specifiying a deviation of the swift default port 8080 with
variable SWIFT_DEFAULT_BIND_PORT. The created endpoints in keystone for
object-store and the backup_swift_url in cinder.conf will use variable
SWIFT_DEFAULT_BIND_PORT instead of the fixed port 8080.

Change-Id: I47bbcf77368c430718fb8f29b7de1ff305e64422
Closes-Bug: #1489767
---
 lib/cinder   |  2 +-
 lib/keystone |  6 +++---
 lib/swift    | 17 +++++++++--------
 3 files changed, 13 insertions(+), 12 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index e5ed2db1a3..2ed02e8b33 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -256,7 +256,7 @@ function configure_cinder {
     fi
 
     if is_service_enabled swift; then
-        iniset $CINDER_CONF DEFAULT backup_swift_url "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:8080/v1/AUTH_"
+        iniset $CINDER_CONF DEFAULT backup_swift_url "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$SWIFT_DEFAULT_BIND_PORT/v1/AUTH_"
     fi
 
     if is_service_enabled ceilometer; then
diff --git a/lib/keystone b/lib/keystone
index e2448c9068..31d5448499 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -266,9 +266,9 @@ function configure_keystone {
 
         # Add swift endpoints to service catalog if swift is enabled
         if is_service_enabled s-proxy; then
-            echo "catalog.RegionOne.object_store.publicURL = http://%SERVICE_HOST%:8080/v1/AUTH_\$(tenant_id)s" >> $KEYSTONE_CATALOG
-            echo "catalog.RegionOne.object_store.adminURL = http://%SERVICE_HOST%:8080/" >> $KEYSTONE_CATALOG
-            echo "catalog.RegionOne.object_store.internalURL = http://%SERVICE_HOST%:8080/v1/AUTH_\$(tenant_id)s" >> $KEYSTONE_CATALOG
+            echo "catalog.RegionOne.object_store.publicURL = http://%SERVICE_HOST%:$SWIFT_DEFAULT_BIND_PORT/v1/AUTH_\$(tenant_id)s" >> $KEYSTONE_CATALOG
+            echo "catalog.RegionOne.object_store.adminURL = http://%SERVICE_HOST%:$SWIFT_DEFAULT_BIND_PORT/" >> $KEYSTONE_CATALOG
+            echo "catalog.RegionOne.object_store.internalURL = http://%SERVICE_HOST%:$SWIFT_DEFAULT_BIND_PORT/v1/AUTH_\$(tenant_id)s" >> $KEYSTONE_CATALOG
             echo "catalog.RegionOne.object_store.name = Swift Service" >> $KEYSTONE_CATALOG
         fi
 
diff --git a/lib/swift b/lib/swift
index fc736a60bc..4c2b292bd7 100644
--- a/lib/swift
+++ b/lib/swift
@@ -44,6 +44,7 @@ SWIFT_APACHE_WSGI_DIR=${SWIFT_APACHE_WSGI_DIR:-/var/www/swift}
 SWIFT3_DIR=$DEST/swift3
 
 SWIFT_SERVICE_PROTOCOL=${SWIFT_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
+SWIFT_DEFAULT_BIND_PORT=${SWIFT_DEFAULT_BIND_PORT:-8080}
 SWIFT_DEFAULT_BIND_PORT_INT=${SWIFT_DEFAULT_BIND_PORT_INT:-8081}
 SWIFT_SERVICE_LOCAL_HOST=${SWIFT_SERVICE_LOCAL_HOST:-$SERVICE_LOCAL_HOST}
 SWIFT_SERVICE_LISTEN_ADDRESS=${SWIFT_SERVICE_LISTEN_ADDRESS:-$SERVICE_LISTEN_ADDRESS}
@@ -62,7 +63,7 @@ SWIFT_CONF_DIR=${SWIFT_CONF_DIR:-/etc/swift}
 if is_service_enabled s-proxy && is_service_enabled swift3; then
     # If we are using ``swift3``, we can default the S3 port to swift instead
     # of nova-objectstore
-    S3_SERVICE_PORT=${S3_SERVICE_PORT:-8080}
+    S3_SERVICE_PORT=${S3_SERVICE_PORT:-$SWIFT_DEFAULT_BIND_PORT}
 fi
 
 if is_service_enabled g-api; then
@@ -187,7 +188,7 @@ function _cleanup_swift_apache_wsgi {
 # _config_swift_apache_wsgi() - Set WSGI config files of Swift
 function _config_swift_apache_wsgi {
     sudo mkdir -p ${SWIFT_APACHE_WSGI_DIR}
-    local proxy_port=${SWIFT_DEFAULT_BIND_PORT:-8080}
+    local proxy_port=${SWIFT_DEFAULT_BIND_PORT}
 
     # copy proxy vhost and wsgi file
     sudo cp ${SWIFT_DIR}/examples/apache2/proxy-server.template $(apache_site_config_for proxy-server)
@@ -348,7 +349,7 @@ function configure_swift {
     local csyncfile=${SWIFT_CONF_DIR}/container-sync-realms.conf
     cp ${SWIFT_DIR}/etc/container-sync-realms.conf-sample ${csyncfile}
     iniset ${csyncfile} realm1 key realm1key
-    iniset ${csyncfile} realm1 cluster_name1 "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:8080/v1/"
+    iniset ${csyncfile} realm1 cluster_name1 "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$SWIFT_DEFAULT_BIND_PORT/v1/"
 
     iniuncomment ${SWIFT_CONFIG_PROXY_SERVER} DEFAULT user
     iniset ${SWIFT_CONFIG_PROXY_SERVER} DEFAULT user ${STACK_USER}
@@ -369,7 +370,7 @@ function configure_swift {
     if is_service_enabled tls-proxy; then
         iniset ${SWIFT_CONFIG_PROXY_SERVER} DEFAULT bind_port ${SWIFT_DEFAULT_BIND_PORT_INT}
     else
-        iniset ${SWIFT_CONFIG_PROXY_SERVER} DEFAULT bind_port ${SWIFT_DEFAULT_BIND_PORT:-8080}
+        iniset ${SWIFT_CONFIG_PROXY_SERVER} DEFAULT bind_port ${SWIFT_DEFAULT_BIND_PORT}
     fi
 
     if is_ssl_enabled_service s-proxy; then
@@ -621,9 +622,9 @@ function create_swift_accounts {
         get_or_create_service "swift" "object-store" "Swift Service"
         get_or_create_endpoint "object-store" \
             "$REGION_NAME" \
-            "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:8080/v1/AUTH_\$(tenant_id)s" \
-            "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:8080" \
-            "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:8080/v1/AUTH_\$(tenant_id)s"
+            "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$SWIFT_DEFAULT_BIND_PORT/v1/AUTH_\$(tenant_id)s" \
+            "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$SWIFT_DEFAULT_BIND_PORT" \
+            "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$SWIFT_DEFAULT_BIND_PORT/v1/AUTH_\$(tenant_id)s"
     fi
 
     local swift_tenant_test1=$(get_or_create_project swifttenanttest1 default)
@@ -764,7 +765,7 @@ function start_swift {
         swift-init --run-dir=${SWIFT_DATA_DIR}/run ${type} stop || true
     done
     if is_service_enabled tls-proxy; then
-        local proxy_port=${SWIFT_DEFAULT_BIND_PORT:-8080}
+        local proxy_port=${SWIFT_DEFAULT_BIND_PORT}
         start_tls_proxy '*' $proxy_port $SERVICE_HOST $SWIFT_DEFAULT_BIND_PORT_INT &
     fi
     run_process s-proxy "$SWIFT_DIR/bin/swift-proxy-server ${SWIFT_CONF_DIR}/proxy-server.conf -v"

From 7792bc39d4f9f7ec7fd1b81ddbb30c30988f03e6 Mon Sep 17 00:00:00 2001
From: Tony Breeds <tony@bakeyournoodle.com>
Date: Fri, 23 Oct 2015 13:57:14 +1100
Subject: [PATCH 0015/2409] Add new oslo.privsep library to oslo repos

A new project olos.privsep has been created but failes sdvm testing as
even though the library is added ro PROJECTS and LIBS_FROM_GIT it isn't
installed by devstack.

Add oslo.privsep to the install_oslo function

Change-Id: Ia4d56747d56dcfe50889ebbdf9d553df13e1b950
---
 lib/oslo                     | 2 ++
 stackrc                      | 4 ++++
 tests/test_libs_from_pypi.sh | 2 +-
 3 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/lib/oslo b/lib/oslo
index f64f327ccd..56615faaa3 100644
--- a/lib/oslo
+++ b/lib/oslo
@@ -36,6 +36,7 @@ GITDIR["oslo.log"]=$DEST/oslo.log
 GITDIR["oslo.messaging"]=$DEST/oslo.messaging
 GITDIR["oslo.middleware"]=$DEST/oslo.middleware
 GITDIR["oslo.policy"]=$DEST/oslo.policy
+GITDIR["oslo.privsep"]=$DEST/oslo.privsep
 GITDIR["oslo.reports"]=$DEST/oslo.reports
 GITDIR["oslo.rootwrap"]=$DEST/oslo.rootwrap
 GITDIR["oslo.serialization"]=$DEST/oslo.serialization
@@ -79,6 +80,7 @@ function install_oslo {
     _do_install_oslo_lib "oslo.messaging"
     _do_install_oslo_lib "oslo.middleware"
     _do_install_oslo_lib "oslo.policy"
+    _do_install_oslo_lib "oslo.privsep"
     _do_install_oslo_lib "oslo.reports"
     _do_install_oslo_lib "oslo.rootwrap"
     _do_install_oslo_lib "oslo.serialization"
diff --git a/stackrc b/stackrc
index 4026ff8feb..819aa0125c 100644
--- a/stackrc
+++ b/stackrc
@@ -371,6 +371,10 @@ GITBRANCH["oslo.middleware"]=${OSLOMID_BRANCH:-master}
 GITREPO["oslo.policy"]=${OSLOPOLICY_REPO:-${GIT_BASE}/openstack/oslo.policy.git}
 GITBRANCH["oslo.policy"]=${OSLOPOLICY_BRANCH:-master}
 
+# oslo.privsep
+GITREPO["oslo.privsep"]=${OSLOPRIVSEP_REPO:-${GIT_BASE}/openstack/oslo.privsep.git}
+GITBRANCH["oslo.privsep"]=${OSLOPRIVSEP_BRANCH:-master}
+
 # oslo.reports
 GITREPO["oslo.reports"]=${OSLOREPORTS_REPO:-${GIT_BASE}/openstack/oslo.reports.git}
 GITBRANCH["oslo.reports"]=${OSLOREPORTS_BRANCH:-master}
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index 8e8c0227a9..f31560a1fe 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -41,7 +41,7 @@ ALL_LIBS+=" oslo.utils python-swiftclient"
 ALL_LIBS+=" python-neutronclient tooz ceilometermiddleware oslo.policy"
 ALL_LIBS+=" debtcollector os-brick automaton futurist oslo.service"
 ALL_LIBS+=" oslo.cache oslo.reports"
-ALL_LIBS+=" keystoneauth ironic-lib"
+ALL_LIBS+=" keystoneauth ironic-lib oslo.privsep"
 
 # Generate the above list with
 # echo ${!GITREPO[@]}

From b814b536c54f4ed840cf3eb436c4841d2ed575c4 Mon Sep 17 00:00:00 2001
From: Cedric Brandily <zzelle@gmail.com>
Date: Thu, 22 Oct 2015 22:25:45 +0200
Subject: [PATCH 0016/2409] Prepare neutron "use_namespaces" option removal

The neutron use_namespaces option is deprecated since Kilo, it's time
remove it from neutron and devstack.

Related-bug: #1508188
Change-Id: I4feb2a15c7e1e4bfdbed2531b18b8e7d798ab3cc
---
 lib/ironic         |  9 ++-------
 lib/neutron-legacy | 15 ++++-----------
 lib/tempest        | 19 +++----------------
 3 files changed, 9 insertions(+), 34 deletions(-)

diff --git a/lib/ironic b/lib/ironic
index 74e2f931ff..de07b49667 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -516,13 +516,8 @@ function create_ovs_taps {
     # intentional sleep to make sure the tag has been set to port
     sleep 10
 
-    if  [[ "$Q_USE_NAMESPACE" = "True" ]]; then
-        local tapdev
-        tapdev=$(sudo ip netns exec qdhcp-${ironic_net_id} ip link list | grep " tap" | cut -d':' -f2 | cut -d'@' -f1 | cut -b2-)
-    else
-        local tapdev
-        tapdev=$(sudo ip link list | grep " tap" | cut -d':' -f2 | cut -d'@' -f1 | cut -b2-)
-    fi
+    local tapdev
+    tapdev=$(sudo ip netns exec qdhcp-${ironic_net_id} ip link list | grep " tap" | cut -d':' -f2 | cut -d'@' -f1 | cut -b2-)
     local tag_id
     tag_id=$(sudo ovs-vsctl show |grep ${tapdev} -A1 -m1 | grep tag | cut -d':' -f2 | cut -b2-)
 
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 4e51425ffc..3c3c96b7bd 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -144,8 +144,6 @@ Q_LISTEN_ADDRESS=${Q_LISTEN_ADDRESS:-$SERVICE_LISTEN_ADDRESS}
 Q_ADMIN_USERNAME=${Q_ADMIN_USERNAME:-neutron}
 # Default auth strategy
 Q_AUTH_STRATEGY=${Q_AUTH_STRATEGY:-keystone}
-# Use namespace or not
-Q_USE_NAMESPACE=${Q_USE_NAMESPACE:-True}
 # RHEL's support for namespaces requires using veths with ovs
 Q_OVS_USE_VETH=${Q_OVS_USE_VETH:-False}
 Q_USE_ROOTWRAP=${Q_USE_ROOTWRAP:-True}
@@ -208,7 +206,7 @@ Q_PUBLIC_VETH_INT=${Q_PUBLIC_VETH_INT:-veth-pub-int}
 # The plugin supports L3.
 Q_L3_ENABLED=${Q_L3_ENABLED:-False}
 # L3 routers exist per tenant
-Q_L3_ROUTER_PER_TENANT=${Q_L3_ROUTER_PER_TENANT:-False}
+Q_L3_ROUTER_PER_TENANT=${Q_L3_ROUTER_PER_TENANT:-True}
 
 # List of config file names in addition to the main plugin config file
 # See _configure_neutron_common() for details about setting it up
@@ -968,7 +966,6 @@ function _configure_neutron_debug_command {
 
     iniset $NEUTRON_TEST_CONFIG_FILE DEFAULT verbose False
     iniset $NEUTRON_TEST_CONFIG_FILE DEFAULT debug False
-    iniset $NEUTRON_TEST_CONFIG_FILE DEFAULT use_namespaces $Q_USE_NAMESPACE
     iniset $NEUTRON_TEST_CONFIG_FILE AGENT root_helper "$Q_RR_COMMAND"
     if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
         iniset $NEUTRON_TEST_CONFIG_FILE AGENT root_helper_daemon "$Q_RR_DAEMON_COMMAND"
@@ -985,7 +982,6 @@ function _configure_neutron_dhcp_agent {
 
     iniset $Q_DHCP_CONF_FILE DEFAULT verbose True
     iniset $Q_DHCP_CONF_FILE DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-    iniset $Q_DHCP_CONF_FILE DEFAULT use_namespaces $Q_USE_NAMESPACE
     iniset $Q_DHCP_CONF_FILE AGENT root_helper "$Q_RR_COMMAND"
     if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
         iniset $Q_DHCP_CONF_FILE AGENT root_helper_daemon "$Q_RR_DAEMON_COMMAND"
@@ -1009,8 +1005,6 @@ function _configure_neutron_dhcp_agent {
 
 function _configure_neutron_l3_agent {
     Q_L3_ENABLED=True
-    # for l3-agent, only use per tenant router if we have namespaces
-    Q_L3_ROUTER_PER_TENANT=$Q_USE_NAMESPACE
 
     if is_service_enabled q-vpn; then
         neutron_vpn_configure_agent
@@ -1020,7 +1014,6 @@ function _configure_neutron_l3_agent {
 
     iniset $Q_L3_CONF_FILE DEFAULT verbose True
     iniset $Q_L3_CONF_FILE DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-    iniset $Q_L3_CONF_FILE DEFAULT use_namespaces $Q_USE_NAMESPACE
     iniset $Q_L3_CONF_FILE AGENT root_helper "$Q_RR_COMMAND"
     if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
         iniset $Q_L3_CONF_FILE AGENT root_helper_daemon "$Q_RR_DAEMON_COMMAND"
@@ -1309,7 +1302,7 @@ function _neutron_configure_router_v4 {
     if is_service_enabled q-l3; then
         # Configure and enable public bridge
         local ext_gw_interface="none"
-        if is_neutron_ovs_base_plugin && [[ "$Q_USE_NAMESPACE" = "True" ]]; then
+        if is_neutron_ovs_base_plugin; then
             ext_gw_interface=$(_neutron_get_ext_gw_interface)
         elif [[ "$Q_AGENT" = "linuxbridge" ]]; then
             # Search for the brq device the neutron router and network for $FIXED_RANGE
@@ -1359,7 +1352,7 @@ function _neutron_configure_router_v6 {
         IPV6_ROUTER_GW_IP=`neutron port-list -c fixed_ips | grep $ipv6_pub_subnet_id | awk -F '"' -v subnet_id=$ipv6_pub_subnet_id '$4 == subnet_id { print $8; }'`
         die_if_not_set $LINENO IPV6_ROUTER_GW_IP "Failure retrieving IPV6_ROUTER_GW_IP"
 
-        if is_neutron_ovs_base_plugin && [[ "$Q_USE_NAMESPACE" = "True" ]]; then
+        if is_neutron_ovs_base_plugin; then
             local ext_gw_interface
             ext_gw_interface=$(_neutron_get_ext_gw_interface)
             local ipv6_cidr_len=${IPV6_PUBLIC_RANGE#*/}
@@ -1374,7 +1367,7 @@ function _neutron_configure_router_v6 {
 
 # Explicitly set router id in l3 agent configuration
 function _neutron_set_router_id {
-    if [[ "$Q_USE_NAMESPACE" == "False" ]]; then
+    if [[ "$Q_L3_ROUTER_PER_TENANT" == "False" ]]; then
         iniset $Q_L3_CONF_FILE DEFAULT router_id $ROUTER_ID
     fi
 }
diff --git a/lib/tempest b/lib/tempest
index 10dd652750..1d10da4c86 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -15,7 +15,6 @@
 #   - ``SERVICE_HOST``
 #   - ``BASE_SQL_CONN`` ``lib/database`` declares
 #   - ``PUBLIC_NETWORK_NAME``
-#   - ``Q_USE_NAMESPACE``
 #   - ``Q_ROUTER_NAME``
 #   - ``Q_L3_ENABLED``
 #   - ``VIRT_DRIVER``
@@ -132,7 +131,6 @@ function configure_tempest {
     local flavor_lines
     local public_network_id
     local public_router_id
-    local tenant_networks_reachable
     local boto_instance_type="m1.tiny"
     local ssh_connect_method="fixed"
 
@@ -246,13 +244,8 @@ function configure_tempest {
         fi
     fi
 
-    if [ "$Q_USE_NAMESPACE" != "False" ]; then
-        tenant_networks_reachable=false
-        if ! is_service_enabled n-net; then
-            ssh_connect_method="floating"
-        fi
-    else
-        tenant_networks_reachable=true
+    if ! is_service_enabled n-net; then
+        ssh_connect_method="floating"
     fi
 
     ssh_connect_method=${TEMPEST_SSH_CONNECT_METHOD:-$ssh_connect_method}
@@ -260,12 +253,6 @@ function configure_tempest {
     if [ "$Q_L3_ENABLED" = "True" ]; then
         public_network_id=$(neutron net-list | grep $PUBLIC_NETWORK_NAME | \
             awk '{print $2}')
-        if [ "$Q_USE_NAMESPACE" == "False" ]; then
-            # If namespaces are disabled, DevStack will create a single
-            # public router that tempest should be configured to use.
-            public_router_id=$(neutron router-list | awk "/ $Q_ROUTER_NAME / \
-                { print \$2 }")
-        fi
     fi
 
     EC2_URL=$(get_endpoint_url ec2 public || true)
@@ -394,7 +381,7 @@ function configure_tempest {
 
     # Network
     iniset $TEMPEST_CONFIG network api_version 2.0
-    iniset $TEMPEST_CONFIG network tenant_networks_reachable "$tenant_networks_reachable"
+    iniset $TEMPEST_CONFIG network tenant_networks_reachable false
     iniset $TEMPEST_CONFIG network public_network_id "$public_network_id"
     iniset $TEMPEST_CONFIG network public_router_id "$public_router_id"
     iniset $TEMPEST_CONFIG network default_network "$FIXED_RANGE"

From 4abb31d9d86bee139a0bc3e9f7dfc5041e8b875f Mon Sep 17 00:00:00 2001
From: Marian Horban <mhorban@mirantis.com>
Date: Mon, 26 Oct 2015 12:35:45 -0400
Subject: [PATCH 0017/2409] Format of nova-api log files was corrected

When nova-api and nova-ec2-api services are started by Apache
(it can be done with devstack config option NOVA_USE_MOD_WSGI=True)
log files contained duplication of timestamp value.

Change-Id: I5439ea8f89ca3073600456f67220e9d3f5257d97
Closes-Bug: #1510517
---
 files/apache-nova-api.template     | 2 +-
 files/apache-nova-ec2-api.template | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/files/apache-nova-api.template b/files/apache-nova-api.template
index 49081528ff..bcf406edf3 100644
--- a/files/apache-nova-api.template
+++ b/files/apache-nova-api.template
@@ -7,7 +7,7 @@ Listen %PUBLICPORT%
     WSGIApplicationGroup %{GLOBAL}
     WSGIPassAuthorization On
     <IfVersion >= 2.4>
-      ErrorLogFormat "%{cu}t %M"
+      ErrorLogFormat "%M"
     </IfVersion>
     ErrorLog /var/log/%APACHE_NAME%/nova-api.log
     %SSLENGINE%
diff --git a/files/apache-nova-ec2-api.template b/files/apache-nova-ec2-api.template
index 235d958d1a..a9be15b73a 100644
--- a/files/apache-nova-ec2-api.template
+++ b/files/apache-nova-ec2-api.template
@@ -7,7 +7,7 @@ Listen %PUBLICPORT%
     WSGIApplicationGroup %{GLOBAL}
     WSGIPassAuthorization On
     <IfVersion >= 2.4>
-      ErrorLogFormat "%{cu}t %M"
+      ErrorLogFormat "%M"
     </IfVersion>
     ErrorLog /var/log/%APACHE_NAME%/nova-ec2-api.log
     %SSLENGINE%

From 313ddaee6102fc03a3885bec3bf5e0d1e0214878 Mon Sep 17 00:00:00 2001
From: Lenny Verkhovsky <lennyb@mellanox.com>
Date: Tue, 20 Oct 2015 11:26:34 +0300
Subject: [PATCH 0018/2409] Remove sudo from mkdir in $STACK_USER folder

This fails in the environment where sudo does not have permissions to
write in /home/$USER folder, e.g. [1]

Also clean-up the comment/variable usage a bit; the location isn't
actually variable at all (and that's fine, but we don't need a global
here)

[1] http://144.76.193.39/ci-artifacts/228979/10/Nova-ML2-Sriov/console.html.gz

Change-Id: I6807eae9d1c27219aa7c19de29f24fa851aa787c
---
 functions-common | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/functions-common b/functions-common
index 42555a95f5..6607d0be70 100644
--- a/functions-common
+++ b/functions-common
@@ -73,21 +73,23 @@ function save_stackenv {
 # - A `devstack-admin` entry for the `admin` user for the `admin` project.
 # write_clouds_yaml
 function write_clouds_yaml {
-    # The location is a variable to allow for easier refactoring later to make it
-    # overridable. There is currently no usecase where doing so makes sense, so
-    # it's not currently configurable.
-    for clouds_path in /etc/openstack ~/.config/openstack ; do
-        CLOUDS_YAML=$clouds_path/clouds.yaml
+    local clouds_yaml
+
+    sudo mkdir -p /etc/openstack
+    sudo chown -R $STACK_USER /etc/openstack
+    # XXX: to be removed, see https://review.openstack.org/237149/
+    # careful not to sudo this, incase ~ is NFS mounted
+    mkdir -p ~/.config/openstack
 
-        sudo mkdir -p $(dirname $CLOUDS_YAML)
-        sudo chown -R $STACK_USER $(dirname $CLOUDS_YAML)
+    for clouds_path in /etc/openstack ~/.config/openstack ; do
+        clouds_yaml=$clouds_path/clouds.yaml
 
         CA_CERT_ARG=''
         if [ -f "$SSL_BUNDLE_FILE" ]; then
             CA_CERT_ARG="--os-cacert $SSL_BUNDLE_FILE"
         fi
         $TOP_DIR/tools/update_clouds_yaml.py \
-            --file $CLOUDS_YAML \
+            --file $clouds_yaml \
             --os-cloud devstack \
             --os-region-name $REGION_NAME \
             --os-identity-api-version 3 \
@@ -97,7 +99,7 @@ function write_clouds_yaml {
             --os-password $ADMIN_PASSWORD \
             --os-project-name demo
         $TOP_DIR/tools/update_clouds_yaml.py \
-            --file $CLOUDS_YAML \
+            --file $clouds_yaml \
             --os-cloud devstack-admin \
             --os-region-name $REGION_NAME \
             --os-identity-api-version 3 \

From ee9bb76647e1424e0dc84d32df6ab8607dc4ec96 Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Mon, 19 Oct 2015 15:16:18 -0400
Subject: [PATCH 0019/2409] Write clouds.yaml to only /etc

After having migrated the copies of clouds.yaml to just consume from
/etc, remove the duplicate copy.

Change-Id: I036704734785958c95d2234917d7b40bd797a375
---
 functions-common | 63 +++++++++++++++++++++++-------------------------
 1 file changed, 30 insertions(+), 33 deletions(-)

diff --git a/functions-common b/functions-common
index 6607d0be70..922938f95d 100644
--- a/functions-common
+++ b/functions-common
@@ -73,42 +73,39 @@ function save_stackenv {
 # - A `devstack-admin` entry for the `admin` user for the `admin` project.
 # write_clouds_yaml
 function write_clouds_yaml {
-    local clouds_yaml
+    # The location is a variable to allow for easier refactoring later to make it
+    # overridable. There is currently no usecase where doing so makes sense, so
+    # it's not currently configurable.
 
-    sudo mkdir -p /etc/openstack
-    sudo chown -R $STACK_USER /etc/openstack
-    # XXX: to be removed, see https://review.openstack.org/237149/
-    # careful not to sudo this, incase ~ is NFS mounted
-    mkdir -p ~/.config/openstack
+    CLOUDS_YAML=/etc/openstack/clouds.yaml
 
-    for clouds_path in /etc/openstack ~/.config/openstack ; do
-        clouds_yaml=$clouds_path/clouds.yaml
+    sudo mkdir -p $(dirname $CLOUDS_YAML)
+    sudo chown -R $STACK_USER /etc/openstack
 
-        CA_CERT_ARG=''
-        if [ -f "$SSL_BUNDLE_FILE" ]; then
-            CA_CERT_ARG="--os-cacert $SSL_BUNDLE_FILE"
-        fi
-        $TOP_DIR/tools/update_clouds_yaml.py \
-            --file $clouds_yaml \
-            --os-cloud devstack \
-            --os-region-name $REGION_NAME \
-            --os-identity-api-version 3 \
-            $CA_CERT_ARG \
-            --os-auth-url $KEYSTONE_AUTH_URI \
-            --os-username demo \
-            --os-password $ADMIN_PASSWORD \
-            --os-project-name demo
-        $TOP_DIR/tools/update_clouds_yaml.py \
-            --file $clouds_yaml \
-            --os-cloud devstack-admin \
-            --os-region-name $REGION_NAME \
-            --os-identity-api-version 3 \
-            $CA_CERT_ARG \
-            --os-auth-url $KEYSTONE_AUTH_URI \
-            --os-username admin \
-            --os-password $ADMIN_PASSWORD \
-            --os-project-name admin
-    done
+    CA_CERT_ARG=''
+    if [ -f "$SSL_BUNDLE_FILE" ]; then
+        CA_CERT_ARG="--os-cacert $SSL_BUNDLE_FILE"
+    fi
+    $TOP_DIR/tools/update_clouds_yaml.py \
+        --file $CLOUDS_YAML \
+        --os-cloud devstack \
+        --os-region-name $REGION_NAME \
+        --os-identity-api-version 3 \
+        $CA_CERT_ARG \
+        --os-auth-url $KEYSTONE_AUTH_URI \
+        --os-username demo \
+        --os-password $ADMIN_PASSWORD \
+        --os-project-name demo
+    $TOP_DIR/tools/update_clouds_yaml.py \
+        --file $CLOUDS_YAML \
+        --os-cloud devstack-admin \
+        --os-region-name $REGION_NAME \
+        --os-identity-api-version 3 \
+        $CA_CERT_ARG \
+        --os-auth-url $KEYSTONE_AUTH_URI \
+        --os-username admin \
+        --os-password $ADMIN_PASSWORD \
+        --os-project-name admin
 }
 
 # trueorfalse <True|False> <VAR>

From a692810ef05304856e5fd12ec786f3445ecca576 Mon Sep 17 00:00:00 2001
From: Oleksii Chuprykov <ochuprykov@mirantis.com>
Date: Thu, 11 Jun 2015 08:56:58 -0400
Subject: [PATCH 0020/2409] Add toggle to run Heat API services via Apache2

Add templates for running Heat API services via
apache mod_wsgi. Also add appropriate functions to
lib/heat for configuring Heat.

Change-Id: I1bdd678c44ddfa616a9db7db85ff6f490ff08947
---
 doc/source/configuration.rst              |   6 ++
 files/apache-heat-api-cfn.template        |  27 ++++++
 files/apache-heat-api-cloudwatch.template |  27 ++++++
 files/apache-heat-api.template            |  27 ++++++
 lib/heat                                  | 109 ++++++++++++++++++++--
 5 files changed, 188 insertions(+), 8 deletions(-)
 create mode 100644 files/apache-heat-api-cfn.template
 create mode 100644 files/apache-heat-api-cloudwatch.template
 create mode 100644 files/apache-heat-api.template

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index aae4f33562..d70d3dae17 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -297,6 +297,12 @@ Example (Swift):
 
     SWIFT_USE_MOD_WSGI="True"
 
+Example (Heat):
+
+::
+
+    HEAT_USE_MOD_WSGI="True"
+
 
 Example (Cinder):
 
diff --git a/files/apache-heat-api-cfn.template b/files/apache-heat-api-cfn.template
new file mode 100644
index 0000000000..ab33c66f7e
--- /dev/null
+++ b/files/apache-heat-api-cfn.template
@@ -0,0 +1,27 @@
+Listen %PUBLICPORT%
+
+<VirtualHost *:%PUBLICPORT%>
+    WSGIDaemonProcess heat-api-cfn processes=2 threads=1 user=%USER% display-name=%{GROUP} %VIRTUALENV%
+    WSGIProcessGroup heat-api-cfn
+    WSGIScriptAlias / %HEAT_BIN_DIR%/heat-wsgi-api-cfn
+    WSGIApplicationGroup %{GLOBAL}
+    WSGIPassAuthorization On
+    AllowEncodedSlashes On
+    <IfVersion >= 2.4>
+      ErrorLogFormat "%{cu}t %M"
+    </IfVersion>
+    ErrorLog /var/log/%APACHE_NAME%/heat-api-cfn.log
+    %SSLENGINE%
+    %SSLCERTFILE%
+    %SSLKEYFILE%
+
+    <Directory %HEAT_BIN_DIR%>
+        <IfVersion >= 2.4>
+            Require all granted
+        </IfVersion>
+        <IfVersion < 2.4>
+            Order allow,deny
+            Allow from all
+        </IfVersion>
+    </Directory>
+</VirtualHost>
diff --git a/files/apache-heat-api-cloudwatch.template b/files/apache-heat-api-cloudwatch.template
new file mode 100644
index 0000000000..06c91bbdb1
--- /dev/null
+++ b/files/apache-heat-api-cloudwatch.template
@@ -0,0 +1,27 @@
+Listen %PUBLICPORT%
+
+<VirtualHost *:%PUBLICPORT%>
+    WSGIDaemonProcess heat-api-cloudwatch processes=2 threads=1 user=%USER% display-name=%{GROUP} %VIRTUALENV%
+    WSGIProcessGroup heat-api-cloudwatch
+    WSGIScriptAlias / %HEAT_BIN_DIR%/heat-wsgi-api-cloudwatch
+    WSGIApplicationGroup %{GLOBAL}
+    WSGIPassAuthorization On
+    AllowEncodedSlashes On
+    <IfVersion >= 2.4>
+      ErrorLogFormat "%{cu}t %M"
+    </IfVersion>
+    ErrorLog /var/log/%APACHE_NAME%/heat-api-cloudwatch.log
+    %SSLENGINE%
+    %SSLCERTFILE%
+    %SSLKEYFILE%
+
+    <Directory %HEAT_BIN_DIR%>
+        <IfVersion >= 2.4>
+            Require all granted
+        </IfVersion>
+        <IfVersion < 2.4>
+            Order allow,deny
+            Allow from all
+        </IfVersion>
+    </Directory>
+</VirtualHost>
diff --git a/files/apache-heat-api.template b/files/apache-heat-api.template
new file mode 100644
index 0000000000..4924b3978b
--- /dev/null
+++ b/files/apache-heat-api.template
@@ -0,0 +1,27 @@
+Listen %PUBLICPORT%
+
+<VirtualHost *:%PUBLICPORT%>
+    WSGIDaemonProcess heat-api processes=3 threads=1 user=%USER% display-name=%{GROUP} %VIRTUALENV%
+    WSGIProcessGroup heat-api
+    WSGIScriptAlias / %HEAT_BIN_DIR%/heat-wsgi-api
+    WSGIApplicationGroup %{GLOBAL}
+    WSGIPassAuthorization On
+    AllowEncodedSlashes On
+    <IfVersion >= 2.4>
+      ErrorLogFormat "%{cu}t %M"
+    </IfVersion>
+    ErrorLog /var/log/%APACHE_NAME%/heat-api.log
+    %SSLENGINE%
+    %SSLCERTFILE%
+    %SSLKEYFILE%
+
+    <Directory %HEAT_BIN_DIR%>
+        <IfVersion >= 2.4>
+            Require all granted
+        </IfVersion>
+        <IfVersion < 2.4>
+            Order allow,deny
+            Allow from all
+        </IfVersion>
+    </Directory>
+</VirtualHost>
diff --git a/lib/heat b/lib/heat
index 615198cc7d..85fdaa1eb2 100644
--- a/lib/heat
+++ b/lib/heat
@@ -16,6 +16,7 @@
 # - install_heat
 # - configure_heatclient
 # - configure_heat
+# - _config_heat_apache_wsgi
 # - init_heat
 # - start_heat
 # - stop_heat
@@ -32,6 +33,9 @@ set +o xtrace
 # set up default directories
 GITDIR["python-heatclient"]=$DEST/python-heatclient
 
+# Toggle for deploying Heat-API under HTTPD + mod_wsgi
+HEAT_USE_MOD_WSGI=${HEAT_USE_MOD_WSGI:-False}
+
 HEAT_DIR=$DEST/heat
 HEAT_CFNTOOLS_DIR=$DEST/heat-cfntools
 HEAT_TEMPLATES_REPO_DIR=$DEST/heat-templates
@@ -117,13 +121,17 @@ function configure_heat {
     # logging
     iniset $HEAT_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
     iniset $HEAT_CONF DEFAULT use_syslog $SYSLOG
-    if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ]; then
+    if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ] && [ "$HEAT_USE_MOD_WSGI" == "False" ]  ; then
         # Add color to logging output
         setup_colorized_logging $HEAT_CONF DEFAULT tenant user
     fi
 
     iniset $HEAT_CONF DEFAULT deferred_auth_method $HEAT_DEFERRED_AUTH
 
+    if [ "$HEAT_USE_MOD_WSGI" == "True" ]; then
+        _config_heat_apache_wsgi
+    fi
+
     # NOTE(jamielennox): heat re-uses specific values from the
     # keystone_authtoken middleware group and so currently fails when using the
     # auth plugin setup. This should be fixed in heat.  Heat is also the only
@@ -211,6 +219,9 @@ function install_heatclient {
 function install_heat {
     git_clone $HEAT_REPO $HEAT_DIR $HEAT_BRANCH
     setup_develop $HEAT_DIR
+    if [ "$HEAT_USE_MOD_WSGI" == "True" ]; then
+        install_apache_wsgi
+    fi
 }
 
 # install_heat_other() - Collect source and prepare
@@ -226,20 +237,102 @@ function install_heat_other {
 # start_heat() - Start running processes, including screen
 function start_heat {
     run_process h-eng "$HEAT_BIN_DIR/heat-engine --config-file=$HEAT_CONF"
-    run_process h-api "$HEAT_BIN_DIR/heat-api --config-file=$HEAT_CONF"
-    run_process h-api-cfn "$HEAT_BIN_DIR/heat-api-cfn --config-file=$HEAT_CONF"
-    run_process h-api-cw "$HEAT_BIN_DIR/heat-api-cloudwatch --config-file=$HEAT_CONF"
+
+    # If the site is not enabled then we are in a grenade scenario
+    local enabled_site_file=$(apache_site_config_for heat-api)
+    if [ -f ${enabled_site_file} ] && [ "$HEAT_USE_MOD_WSGI" == "True" ]; then
+        enable_apache_site heat-api
+        enable_apache_site heat-api-cfn
+        enable_apache_site heat-api-cloudwatch
+        restart_apache_server
+        tail_log heat-api /var/log/$APACHE_NAME/heat-api.log
+        tail_log heat-api-cfn /var/log/$APACHE_NAME/heat-api-cfn.log
+        tail_log heat-api-cloudwatch /var/log/$APACHE_NAME/heat-api-cloudwatch.log
+    else
+        run_process h-api "$HEAT_BIN_DIR/heat-api --config-file=$HEAT_CONF"
+        run_process h-api-cfn "$HEAT_BIN_DIR/heat-api-cfn --config-file=$HEAT_CONF"
+        run_process h-api-cw "$HEAT_BIN_DIR/heat-api-cloudwatch --config-file=$HEAT_CONF"
+    fi
 }
 
 # stop_heat() - Stop running processes
 function stop_heat {
     # Kill the screen windows
-    local serv
-    for serv in h-eng h-api h-api-cfn h-api-cw; do
-        stop_process $serv
-    done
+    stop_process h-eng
+
+    if [ "$HEAT_USE_MOD_WSGI" == "True" ]; then
+        disable_apache_site heat-api
+        disable_apache_site heat-api-cfn
+        disable_apache_site heat-api-cloudwatch
+        restart_apache_server
+    else
+        local serv
+        for serv in h-api h-api-cfn h-api-cw; do
+            stop_process $serv
+        done
+    fi
+
 }
 
+# _cleanup_heat_apache_wsgi() - Remove wsgi files, disable and remove apache vhost file
+function _cleanup_heat_apache_wsgi {
+    sudo rm -f $(apache_site_config_for heat-api)
+    sudo rm -f $(apache_site_config_for heat-api-cfn)
+    sudo rm -f $(apache_site_config_for heat-api-cloudwatch)
+}
+
+# _config_heat_apache_wsgi() - Set WSGI config files of Heat
+function _config_heat_apache_wsgi {
+
+    local heat_apache_conf=$(apache_site_config_for heat-api)
+    local heat_cfn_apache_conf=$(apache_site_config_for heat-api-cfn)
+    local heat_cloudwatch_apache_conf=$(apache_site_config_for heat-api-cloudwatch)
+    local heat_ssl=""
+    local heat_certfile=""
+    local heat_keyfile=""
+    local heat_api_port=$HEAT_API_PORT
+    local heat_cfn_api_port=$HEAT_API_CFN_PORT
+    local heat_cw_api_port=$HEAT_API_CW_PORT
+    local venv_path=""
+
+    sudo cp $FILES/apache-heat-api.template $heat_apache_conf
+    sudo sed -e "
+        s|%PUBLICPORT%|$heat_api_port|g;
+        s|%APACHE_NAME%|$APACHE_NAME|g;
+        s|%HEAT_BIN_DIR%|$HEAT_BIN_DIR|g;
+        s|%SSLENGINE%|$heat_ssl|g;
+        s|%SSLCERTFILE%|$heat_certfile|g;
+        s|%SSLKEYFILE%|$heat_keyfile|g;
+        s|%USER%|$STACK_USER|g;
+        s|%VIRTUALENV%|$venv_path|g
+    " -i $heat_apache_conf
+
+    sudo cp $FILES/apache-heat-api-cfn.template $heat_cfn_apache_conf
+    sudo sed -e "
+        s|%PUBLICPORT%|$heat_cfn_api_port|g;
+        s|%APACHE_NAME%|$APACHE_NAME|g;
+        s|%HEAT_BIN_DIR%|$HEAT_BIN_DIR|g;
+        s|%SSLENGINE%|$heat_ssl|g;
+        s|%SSLCERTFILE%|$heat_certfile|g;
+        s|%SSLKEYFILE%|$heat_keyfile|g;
+        s|%USER%|$STACK_USER|g;
+        s|%VIRTUALENV%|$venv_path|g
+    " -i $heat_cfn_apache_conf
+
+    sudo cp $FILES/apache-heat-api-cloudwatch.template $heat_cloudwatch_apache_conf
+    sudo sed -e "
+        s|%PUBLICPORT%|$heat_cw_api_port|g;
+        s|%APACHE_NAME%|$APACHE_NAME|g;
+        s|%HEAT_BIN_DIR%|$HEAT_BIN_DIR|g;
+        s|%SSLENGINE%|$heat_ssl|g;
+        s|%SSLCERTFILE%|$heat_certfile|g;
+        s|%SSLKEYFILE%|$heat_keyfile|g;
+        s|%USER%|$STACK_USER|g;
+        s|%VIRTUALENV%|$venv_path|g
+    " -i $heat_cloudwatch_apache_conf
+}
+
+
 # create_heat_accounts() - Set up common required heat accounts
 function create_heat_accounts {
     if [[ "$HEAT_STANDALONE" != "True" ]]; then

From cf94edcbbdde75de3ce627d7e092936bc014d5f6 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Wed, 28 Oct 2015 09:50:01 -0700
Subject: [PATCH 0021/2409] Disable shelve/snapshot/cinder when running Tempest
 with libvirt+lxc

The libvirt+lxc backend in nova does not support shelve, image snapshot
or any volume-related actions (so pretty much anything to do with
cinder), so we need to configure tempest to not run tests that hit those
operations/service when using libvirt/lxc.

This is part of an overall effort to get a CI job running for nova with
the libvirt+lxc configuration per:

Ic07c39e219121ba6b8b20de2b83a193bb735133d

Change-Id: I4decfcc5a5dfbabdecb3eb9fc93f1d1d6c2af805
---
 lib/tempest | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index 10dd652750..565e965836 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -531,6 +531,8 @@ function configure_tempest {
     if [ "$VIRT_DRIVER" = "libvirt" ] && [ "$LIBVIRT_TYPE" = "lxc" ]; then
         iniset $TEMPEST_CONFIG compute-feature-enabled rescue False
         iniset $TEMPEST_CONFIG compute-feature-enabled resize False
+        iniset $TEMPEST_CONFIG compute-feature-enabled shelve False
+        iniset $TEMPEST_CONFIG compute-feature-enabled snapshot False
         iniset $TEMPEST_CONFIG compute-feature-enabled suspend False
     fi
 
@@ -548,6 +550,12 @@ function configure_tempest {
         fi
     done
 
+    if [ "$VIRT_DRIVER" = "libvirt" ] && [ "$LIBVIRT_TYPE" = "lxc" ]; then
+        # libvirt-lxc does not support boot from volume or attaching volumes
+        # so basically anything with cinder is out of the question.
+        iniset $TEMPEST_CONFIG service_available cinder "False"
+    fi
+
     if is_ssl_enabled_service "key" || is_service_enabled tls-proxy; then
         # Use the ``BOTO_CONFIG`` environment variable to point to this file
         iniset -sudo $BOTO_CONF Boto ca_certificates_file $SSL_BUNDLE_FILE

From 5cdee8dd3311e501302993cd8c81b39cb6b45090 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 19 Oct 2015 14:17:18 +1100
Subject: [PATCH 0022/2409] Update to bashate 0.3.2

Bashate 0.3.2 has a few new checks -- firstly make sure some of the
plugins have #!/bin/bash, and fix up a couple of "local" changes that
were missed by I9c8912a8fd596535589b207d7fc553b9d951d3fe

Change-Id: I9e4b1c0dc9e0f709d8e76f9c9bf1c9478b2605ed
---
 functions-common                          | 20 ++++++++++++++------
 lib/heat                                  | 12 ++++++++----
 lib/neutron_plugins/services/firewall     |  2 ++
 lib/neutron_plugins/services/loadbalancer |  2 ++
 lib/neutron_plugins/services/metering     |  2 ++
 lib/neutron_plugins/services/vpn          |  2 ++
 lib/neutron_thirdparty/vmware_nsx         |  2 ++
 tox.ini                                   |  7 ++++---
 8 files changed, 36 insertions(+), 13 deletions(-)

diff --git a/functions-common b/functions-common
index 42555a95f5..ceefd443b1 100644
--- a/functions-common
+++ b/functions-common
@@ -1746,7 +1746,8 @@ function run_phase {
             # extras.d in an unsupported way which will let us track
             # unsupported usage in the gate.
             local exceptions="50-ironic.sh 60-ceph.sh 80-tempest.sh"
-            local extra=$(basename $extra_plugin_file_name)
+            local extra
+            extra=$(basename $extra_plugin_file_name)
             if [[ ! ( $exceptions =~ "$extra" ) ]]; then
                 deprecated "extras.d support is being removed in Mitaka-1"
                 deprecated "jobs for project $extra will break after that point"
@@ -2184,14 +2185,21 @@ function time_start {
 # global counter for that name. Errors if that clock had not
 # previously been started.
 function time_stop {
-    local name=$1
-    local start_time=${START_TIME[$name]}
+    local name
+    local end_time
+    local elpased_time
+    local total
+    local start_time
+
+    name=$1
+    start_time=${START_TIME[$name]}
+
     if [[ -z "$start_time" ]]; then
         die $LINENO "Trying to stop the clock on $name, but it was never started"
     fi
-    local end_time=$(date +%s)
-    local elapsed_time=$(($end_time - $start_time))
-    local total=${TOTAL_TIME[$name]:-0}
+    end_time=$(date +%s)
+    elapsed_time=$(($end_time - $start_time))
+    total=${TOTAL_TIME[$name]:-0}
     # reset the clock so we can start it in the future
     START_TIME[$name]=""
     TOTAL_TIME[$name]=$(($total + $elapsed_time))
diff --git a/lib/heat b/lib/heat
index 85fdaa1eb2..f3f0548947 100644
--- a/lib/heat
+++ b/lib/heat
@@ -239,7 +239,8 @@ function start_heat {
     run_process h-eng "$HEAT_BIN_DIR/heat-engine --config-file=$HEAT_CONF"
 
     # If the site is not enabled then we are in a grenade scenario
-    local enabled_site_file=$(apache_site_config_for heat-api)
+    local enabled_site_file
+    enabled_site_file=$(apache_site_config_for heat-api)
     if [ -f ${enabled_site_file} ] && [ "$HEAT_USE_MOD_WSGI" == "True" ]; then
         enable_apache_site heat-api
         enable_apache_site heat-api-cfn
@@ -284,9 +285,12 @@ function _cleanup_heat_apache_wsgi {
 # _config_heat_apache_wsgi() - Set WSGI config files of Heat
 function _config_heat_apache_wsgi {
 
-    local heat_apache_conf=$(apache_site_config_for heat-api)
-    local heat_cfn_apache_conf=$(apache_site_config_for heat-api-cfn)
-    local heat_cloudwatch_apache_conf=$(apache_site_config_for heat-api-cloudwatch)
+    local heat_apache_conf
+    heat_apache_conf=$(apache_site_config_for heat-api)
+    local heat_cfn_apache_conf
+    heat_cfn_apache_conf=$(apache_site_config_for heat-api-cfn)
+    local heat_cloudwatch_apache_conf
+    heat_cloudwatch_apache_conf=$(apache_site_config_for heat-api-cloudwatch)
     local heat_ssl=""
     local heat_certfile=""
     local heat_keyfile=""
diff --git a/lib/neutron_plugins/services/firewall b/lib/neutron_plugins/services/firewall
index 61a148e596..3496da82f8 100644
--- a/lib/neutron_plugins/services/firewall
+++ b/lib/neutron_plugins/services/firewall
@@ -1,3 +1,5 @@
+#!/bin/bash
+
 # Neutron firewall plugin
 # ---------------------------
 
diff --git a/lib/neutron_plugins/services/loadbalancer b/lib/neutron_plugins/services/loadbalancer
index 34190f9a56..7865f6fd6e 100644
--- a/lib/neutron_plugins/services/loadbalancer
+++ b/lib/neutron_plugins/services/loadbalancer
@@ -1,3 +1,5 @@
+#!/bin/bash
+
 # Neutron loadbalancer plugin
 # ---------------------------
 
diff --git a/lib/neutron_plugins/services/metering b/lib/neutron_plugins/services/metering
index 37ba019b98..c75ab19d4e 100644
--- a/lib/neutron_plugins/services/metering
+++ b/lib/neutron_plugins/services/metering
@@ -1,3 +1,5 @@
+#!/bin/bash
+
 # Neutron metering plugin
 # ---------------------------
 
diff --git a/lib/neutron_plugins/services/vpn b/lib/neutron_plugins/services/vpn
index 4d6a2bf9a0..c0e7457413 100644
--- a/lib/neutron_plugins/services/vpn
+++ b/lib/neutron_plugins/services/vpn
@@ -1,3 +1,5 @@
+#!/bin/bash
+
 # Neutron VPN plugin
 # ---------------------------
 
diff --git a/lib/neutron_thirdparty/vmware_nsx b/lib/neutron_thirdparty/vmware_nsx
index 03853a9bf4..e182fca1ae 100644
--- a/lib/neutron_thirdparty/vmware_nsx
+++ b/lib/neutron_thirdparty/vmware_nsx
@@ -1,2 +1,4 @@
+#!/bin/bash
+
 # REVISIT(roeyc): this file left empty so that 'enable_service vmware_nsx'
 # continues to work.
diff --git a/tox.ini b/tox.ini
index 0df9877ba8..9279455bb8 100644
--- a/tox.ini
+++ b/tox.ini
@@ -9,7 +9,7 @@ install_command = pip install {opts} {packages}
 
 [testenv:bashate]
 deps =
-   {env:BASHATE_INSTALL_PATH:bashate==0.3.1}
+   {env:BASHATE_INSTALL_PATH:bashate==0.3.2}
 whitelist_externals = bash
 commands = bash -c "find {toxinidir}             \
          -not \( -type d -name .?\* -prune \)    \ # prune all 'dot' dirs
@@ -20,12 +20,13 @@ commands = bash -c "find {toxinidir}             \
          -not -name \*.md                        \
          \(                                      \
           -name \*.sh -or                        \
-          -name \*rc -or                         \
+          -name \*.orig -or                      \
+          -name \*rc -or                         \ # openrc files, etc
           -name functions\* -or                  \
           -wholename \*/inc/\* -or               \ # /inc files and
           -wholename \*/lib/\*                   \ # /lib files are shell, but
          \)                                      \ #   have no extension
-         -print0 | xargs -0 bashate -v -iE006"
+         -print0 | xargs -0 bashate -v -iE006 -eE005,E042"
 
 [testenv:docs]
 deps =

From 347dbac04e8988a01e3330e34b57f1e5b3c6aa2a Mon Sep 17 00:00:00 2001
From: Nicolas Simonds <nic@metacloud.com>
Date: Wed, 21 Jan 2015 13:40:42 -0800
Subject: [PATCH 0023/2409] Add the ability to install/enable Heat plugins

Adds the $ENABLE_HEAT_PLUGINS variable, which should be a list of
the names of the plugins the user wishes to install.

Change-Id: I2ba90002a8fad1cdce6543c89dc37c5912fe133e
---
 lib/heat | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/lib/heat b/lib/heat
index f3f0548947..e42bdf0b9e 100644
--- a/lib/heat
+++ b/lib/heat
@@ -69,6 +69,8 @@ else
     HEAT_STACK_DOMAIN=$(trueorfalse True HEAT_STACK_DOMAIN)
     HEAT_DEFERRED_AUTH=${HEAT_DEFERRED_AUTH:-trusts}
 fi
+HEAT_PLUGIN_DIR=${HEAT_PLUGIN_DIR:-$DATA_DIR/heat/plugins}
+ENABLE_HEAT_PLUGINS=${ENABLE_HEAT_PLUGINS:-}
 
 # Functions
 # ---------
@@ -188,6 +190,35 @@ function configure_heat {
     # copy the default templates
     cp $HEAT_DIR/etc/heat/templates/* $HEAT_TEMPLATES_DIR/
 
+    # Enable heat plugins.
+    # NOTE(nic): The symlink nonsense is necessary because when
+    # plugins are installed in "developer mode", the final component
+    # of their target directory is always "resources", which confuses
+    # Heat's plugin loader into believing that all plugins are named
+    # "resources", and therefore are all the same plugin; so it
+    # will only load one of them.  Linking them all to a common
+    # location with unique names avoids that type of collision,
+    # while still allowing the plugins to be edited in-tree.
+    local err_count=0
+
+    if [ -n "$ENABLE_HEAT_PLUGINS" ]; then
+        mkdir -p $HEAT_PLUGIN_DIR
+        # Clean up cruft from any previous runs
+        rm -f $HEAT_PLUGIN_DIR/*
+        iniset $HEAT_CONF DEFAULT plugin_dirs $HEAT_PLUGIN_DIR
+    fi
+
+    for heat_plugin in $ENABLE_HEAT_PLUGINS; do
+        if [ -d $HEAT_DIR/contrib/$heat_plugin ]; then
+            setup_package $HEAT_DIR/contrib/$heat_plugin -e
+            ln -s $HEAT_DIR/contrib/$heat_plugin/$heat_plugin/resources $HEAT_PLUGIN_DIR/$heat_plugin
+        else
+            : # clear retval on the test so that we can roll up errors
+            err $LINENO "Requested Heat plugin(${heat_plugin}) not found."
+            err_count=$(($err_count + 1))
+        fi
+    done
+    [ $err_count -eq 0 ] || die $LINENO "$err_count of the requested Heat plugins could not be installed."
 }
 
 # init_heat() - Initialize database

From abb40f61939355f471c1a37c671774923e12b660 Mon Sep 17 00:00:00 2001
From: Thiago Paiva <thiagop@lsd.ufcg.edu.br>
Date: Thu, 29 Oct 2015 11:38:24 -0300
Subject: [PATCH 0024/2409] Correct Cinder protocol for connections on Ironic

The protocol for connections with Cinder is wrong for the Ironic script. This
patch changes the script to use $GLANCE_SERVICE_PROTOCOL, which is https when
USE_SSL=true or tls-proxy is on ENABLED_SERVICES.

Change-Id: I4d4c6f9dc6f6ee53166db109848dca64334b8748
---
 lib/ironic | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/ironic b/lib/ironic
index de07b49667..d786870165 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -795,7 +795,7 @@ function upload_baremetal_ironic_deploy {
     # load them into glance
     IRONIC_DEPLOY_KERNEL_ID=$(openstack \
         --os-token $token \
-        --os-url http://$GLANCE_HOSTPORT \
+        --os-url $GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT \
         image create \
         $(basename $IRONIC_DEPLOY_KERNEL_PATH) \
         --public --disk-format=aki \
@@ -803,7 +803,7 @@ function upload_baremetal_ironic_deploy {
         < $IRONIC_DEPLOY_KERNEL_PATH  | grep ' id ' | get_field 2)
     IRONIC_DEPLOY_RAMDISK_ID=$(openstack \
         --os-token $token \
-        --os-url http://$GLANCE_HOSTPORT \
+        --os-url $GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT \
         image create \
         $(basename $IRONIC_DEPLOY_RAMDISK_PATH) \
         --public --disk-format=ari \

From 7159b4ba5956c0fd3141fe13ac40057364683c9c Mon Sep 17 00:00:00 2001
From: Marian Horban <mhorban@mirantis.com>
Date: Thu, 22 Oct 2015 15:47:49 -0400
Subject: [PATCH 0025/2409] Config graceful_shutdown_timeout option for
 services

To avoid hanging services during gracefull shutdown option
graceful_shutdown_timeout should be configured.

Closes-Bug: #1446583

Change-Id: I2b7f0df831d65c55ae8cae241478f49c9641d99f
---
 lib/cinder | 2 +-
 lib/glance | 2 ++
 lib/nova   | 1 +
 stackrc    | 3 +++
 4 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/lib/cinder b/lib/cinder
index ed9a1038d6..a916c6540f 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -357,7 +357,7 @@ function configure_cinder {
     iniset $CINDER_CONF DEFAULT os_privileged_user_name nova
     iniset $CINDER_CONF DEFAULT os_privileged_user_password "$SERVICE_PASSWORD"
     iniset $CINDER_CONF DEFAULT os_privileged_user_tenant "$SERVICE_TENANT_NAME"
-
+    iniset $CINDER_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
 }
 
 # create_cinder_accounts() - Set up common required cinder accounts
diff --git a/lib/glance b/lib/glance
index 2eb93a46e6..5a1b2834d0 100644
--- a/lib/glance
+++ b/lib/glance
@@ -115,6 +115,7 @@ function configure_glance {
     configure_auth_token_middleware $GLANCE_REGISTRY_CONF glance $GLANCE_AUTH_CACHE_DIR/registry
     iniset $GLANCE_REGISTRY_CONF DEFAULT notification_driver messaging
     iniset_rpc_backend glance $GLANCE_REGISTRY_CONF
+    iniset $GLANCE_REGISTRY_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
 
     cp $GLANCE_DIR/etc/glance-api.conf $GLANCE_API_CONF
     iniset $GLANCE_API_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
@@ -149,6 +150,7 @@ function configure_glance {
         iniset $GLANCE_API_CONF glance_store swift_store_config_file $GLANCE_SWIFT_STORE_CONF
         iniset $GLANCE_API_CONF glance_store default_swift_reference ref1
         iniset $GLANCE_API_CONF glance_store stores "file, http, swift"
+        iniset $GLANCE_API_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
 
         iniset $GLANCE_SWIFT_STORE_CONF ref1 user $SERVICE_TENANT_NAME:glance-swift
         iniset $GLANCE_SWIFT_STORE_CONF ref1 key $SERVICE_PASSWORD
diff --git a/lib/nova b/lib/nova
index 6c414030ae..cce598d853 100644
--- a/lib/nova
+++ b/lib/nova
@@ -649,6 +649,7 @@ function create_nova_conf {
         iniset $NOVA_CONF serial_console serialproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
         iniset $NOVA_CONF serial_console enabled True
     fi
+    iniset $NOVA_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
 }
 
 function init_nova_cells {
diff --git a/stackrc b/stackrc
index 819aa0125c..1a95e2b7ed 100644
--- a/stackrc
+++ b/stackrc
@@ -669,6 +669,9 @@ fi
 # Service startup timeout
 SERVICE_TIMEOUT=${SERVICE_TIMEOUT:-60}
 
+# Service graceful shutdown timeout
+SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT=${SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT:-5}
+
 # Support alternative yum -- in future Fedora 'dnf' will become the
 # only supported installer, but for now 'yum' and 'dnf' are both
 # available in parallel with compatible CLIs.  Allow manual switching

From cdcdeb64602ea271bedf20f58a9f1ca1c0075c84 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Thu, 29 Oct 2015 09:48:17 -0700
Subject: [PATCH 0026/2409] Remove CINDER_VOLUME_CLEAR value validation

132fbcd38ebae52bdd20da54905131b75581520f in cinder changed the
volume_clear StrOpt to use the choices kwarg which enforces the value
specified and raises a ValueError if an invalid value is set for the
option in cinder.conf.

This lets us remove the validation that devstack was doing.

Change-Id: Ia7eead6297ed0f3a972de2021170fe9c7225e856
---
 lib/cinder | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index ed9a1038d6..1307c11f7a 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -317,9 +317,7 @@ function configure_cinder {
 
     iniset_rpc_backend cinder $CINDER_CONF
 
-    if [[ "$CINDER_VOLUME_CLEAR" == "none" ]] || [[ "$CINDER_VOLUME_CLEAR" == "zero" ]] || [[ "$CINDER_VOLUME_CLEAR" == "shred" ]]; then
-        iniset $CINDER_CONF DEFAULT volume_clear $CINDER_VOLUME_CLEAR
-    fi
+    iniset $CINDER_CONF DEFAULT volume_clear $CINDER_VOLUME_CLEAR
 
     # Format logging
     if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ] && [ "$CINDER_USE_MOD_WSGI" == "False" ]; then

From 5ea1e16d83d6312fb17976ded0ab1a6a3773ca4d Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephen.finucane@intel.com>
Date: Thu, 29 Oct 2015 20:12:26 +0000
Subject: [PATCH 0027/2409] lib/nova: Remove 'DEFAULT/verbose'

The 'verbose' option has been deprecated by oslo_log. Using it
results in a warning for the 'nova-manage' command and likely
many other OpenStack commands.

Change-Id: Icc11b25f56ebc62443c6afa90b9572d5c63b3882
Partial-bug: #1511505
---
 lib/nova | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index 6c414030ae..47c43bd193 100644
--- a/lib/nova
+++ b/lib/nova
@@ -480,7 +480,6 @@ function create_nova_conf {
 
     # (Re)create ``nova.conf``
     rm -f $NOVA_CONF
-    iniset $NOVA_CONF DEFAULT verbose "True"
     iniset $NOVA_CONF DEFAULT debug "$ENABLE_DEBUG_LOG_LEVEL"
     if [ "$NOVA_ALLOW_MOVE_TO_SAME_HOST" == "True" ]; then
         iniset $NOVA_CONF DEFAULT allow_resize_to_same_host "True"

From 0ec80802735163fdbdb4ceaa339aa73f93bbd87a Mon Sep 17 00:00:00 2001
From: Daniel Gonzalez <daniel@gonzalez-nothnagel.de>
Date: Fri, 30 Oct 2015 14:25:41 +0100
Subject: [PATCH 0028/2409] Remove multi-region workaround

When keystone API v3 was introduced, filtering regions when listing
endpoints was not supported (see [1]). This caused multi-region devstack
deployments to fail (see [2]). A workaround was introduced to devstack
to enable for multi-region deployments until region filtering would work
in keystone API v3.
Now that the bug related to region filtering in keystone is resolved,
the workaround should be removed.

[1]: https://bugs.launchpad.net/keystone/+bug/1482772
[2]: https://bugs.launchpad.net/devstack/+bug/1483784

Closes-Bug: #1511745
Related-Bug: #1483784
Related-Bug: #1482772
Change-Id: I52d13c3f5e7b77a7f8fb1be4dcea437988ebddfe
---
 functions-common | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/functions-common b/functions-common
index d36d323820..d282203d45 100644
--- a/functions-common
+++ b/functions-common
@@ -913,16 +913,11 @@ function get_or_create_service {
 # Usage: _get_or_create_endpoint_with_interface <service> <interface> <url> <region>
 function _get_or_create_endpoint_with_interface {
     local endpoint_id
-    # TODO(dgonzalez): The check of the region name, as done in the grep
-    # statement below, exists only because keystone does currently
-    # not allow filtering the region name when listing endpoints. If keystone
-    # gets support for this, the check for the region name can be removed.
-    # Related bug in keystone: https://bugs.launchpad.net/keystone/+bug/1482772
     endpoint_id=$(openstack endpoint list \
         --service $1 \
         --interface $2 \
         --region $4 \
-        -c ID -c Region -f value | grep $4 | cut -f 1 -d " ")
+        -c ID -f value)
     if [[ -z "$endpoint_id" ]]; then
         # Creates new endpoint
         endpoint_id=$(openstack endpoint create \

From 55a1bca28215a7623c9bd067a663e176d4b3e672 Mon Sep 17 00:00:00 2001
From: Andrey Kurilin <akurilin@mirantis.com>
Date: Fri, 30 Oct 2015 16:24:19 +0200
Subject: [PATCH 0029/2409] Remove wrong paramter COMPUTE_API_VERSION

Since:
 - novaclient doesn't require specify the *compute api* version
  (default is 2.latest now)
 - novaclient doesn't use COMPUTE_API_VERSION, since it's wrong name(
   OS_COMPUTE_API_VERSION is a correct name)

we can remove COMPUTE_API_VERSION and NOVA_VERSION vars

Change-Id: I47856863e9403870b8d60c778b97d3de1a212ae1
---
 exercises/client-args.sh | 1 -
 exercises/client-env.sh  | 4 ----
 openrc                   | 6 ------
 3 files changed, 11 deletions(-)

diff --git a/exercises/client-args.sh b/exercises/client-args.sh
index c33ef44e9a..7cfef1c807 100755
--- a/exercises/client-args.sh
+++ b/exercises/client-args.sh
@@ -41,7 +41,6 @@ unset NOVA_PROJECT_ID
 unset NOVA_REGION_NAME
 unset NOVA_URL
 unset NOVA_USERNAME
-unset NOVA_VERSION
 
 # Save the known variables for later
 export x_TENANT_NAME=$OS_TENANT_NAME
diff --git a/exercises/client-env.sh b/exercises/client-env.sh
index 4a0609a944..1d2f4f5689 100755
--- a/exercises/client-env.sh
+++ b/exercises/client-env.sh
@@ -41,7 +41,6 @@ unset NOVA_PROJECT_ID
 unset NOVA_REGION_NAME
 unset NOVA_URL
 unset NOVA_USERNAME
-unset NOVA_VERSION
 
 for i in OS_TENANT_NAME OS_USERNAME OS_PASSWORD OS_AUTH_URL; do
     is_set $i
@@ -101,9 +100,6 @@ if [[ "$ENABLED_SERVICES" =~ "n-api" ]]; then
             STATUS_EC2="Failed"
             RETURN=1
         fi
-
-        # Clean up side effects
-        unset NOVA_VERSION
     fi
 fi
 
diff --git a/openrc b/openrc
index 71ba5a6ea5..9bc0fd77f4 100644
--- a/openrc
+++ b/openrc
@@ -95,12 +95,6 @@ if [[ ! -v OS_CACERT ]] ; then
     fi
 fi
 
-# Currently novaclient needs you to specify the *compute api* version.  This
-# needs to match the config of your catalog returned by Keystone.
-export NOVA_VERSION=${NOVA_VERSION:-1.1}
-# In the future this will change names:
-export COMPUTE_API_VERSION=${COMPUTE_API_VERSION:-$NOVA_VERSION}
-
 # Currently cinderclient needs you to specify the *volume api* version. This
 # needs to match the config of your catalog returned by Keystone.
 export CINDER_VERSION=${CINDER_VERSION:-2}

From f54f60a63ea146e54d430e343f666638bf7947d2 Mon Sep 17 00:00:00 2001
From: Einst Crazy <yu.changcai@99cloud.net>
Date: Fri, 30 Oct 2015 23:00:57 +0800
Subject: [PATCH 0030/2409] Delete some comment or messages of
 keystone_data.sh(removed)

As files/keystone_data.sh has been removed in the commit
https://review.openstack.org/#/c/79366/, we should remove some
related documations and comments.

Change-Id: I7802d0052fa28d8debb7f361d36a4f108869554c
---
 HACKING.rst                  | 3 +--
 doc/source/configuration.rst | 2 +-
 lib/tempest                  | 2 +-
 3 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/HACKING.rst b/HACKING.rst
index 6bd24b0174..d66687e351 100644
--- a/HACKING.rst
+++ b/HACKING.rst
@@ -250,8 +250,7 @@ These scripts are executed serially by ``exercise.sh`` in testing situations.
   database access from the exercise itself.
 
 * If specific configuration needs to be present for the exercise to complete,
-  it should be staged in ``stack.sh``, or called from ``stack.sh`` (see
-  ``files/keystone_data.sh`` for an example of this).
+  it should be staged in ``stack.sh``, or called from ``stack.sh``.
 
 * The ``OS_*`` environment variables should be the only ones used for all
   authentication to OpenStack clients as documented in the CLIAuth_ wiki page.
diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index d70d3dae17..9ba657a50d 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -393,7 +393,7 @@ with ``KEYSTONE_CATALOG_BACKEND``:
         KEYSTONE_CATALOG_BACKEND=template
 
 DevStack's default configuration in ``sql`` mode is set in
-``files/keystone_data.sh``
+``lib/keystone``
 
 
 Guest Images
diff --git a/lib/tempest b/lib/tempest
index 32630dbf59..03e2aacf97 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -23,7 +23,7 @@
 #
 # Optional Dependencies:
 #
-# - ``ALT_*`` (similar vars exists in keystone_data.sh)
+# - ``ALT_*``
 # - ``LIVE_MIGRATION_AVAILABLE``
 # - ``USE_BLOCK_MIGRATION_FOR_LIVE_MIGRATION``
 # - ``DEFAULT_INSTANCE_TYPE``

From 08abba008e735d333f9180180c6a28e7cd5a1171 Mon Sep 17 00:00:00 2001
From: Marian Horban <mhorban@mirantis.com>
Date: Thu, 11 Jun 2015 13:01:41 -0400
Subject: [PATCH 0031/2409] Add ability to run Nova metadata under Apache2

This patch allows to run Nova metadata service using Apache
on port 80 under /metadata URL.

Change-Id: I18f3399738c31166eac884a9b0d5c4045d3f445c
---
 files/apache-nova-metadata.template | 25 +++++++++++++++++++++++++
 lib/nova                            | 23 +++++++++++++++++++++++
 2 files changed, 48 insertions(+)
 create mode 100644 files/apache-nova-metadata.template

diff --git a/files/apache-nova-metadata.template b/files/apache-nova-metadata.template
new file mode 100644
index 0000000000..6231c1ced8
--- /dev/null
+++ b/files/apache-nova-metadata.template
@@ -0,0 +1,25 @@
+Listen %PUBLICPORT%
+
+<VirtualHost *:%PUBLICPORT%>
+    WSGIDaemonProcess nova-metadata processes=%APIWORKERS% threads=1 user=%USER% display-name=%{GROUP} %VIRTUALENV%
+    WSGIProcessGroup nova-metadata
+    WSGIScriptAlias / %PUBLICWSGI%
+    WSGIApplicationGroup %{GLOBAL}
+    WSGIPassAuthorization On
+    <IfVersion >= 2.4>
+      ErrorLogFormat "%M"
+    </IfVersion>
+    ErrorLog /var/log/%APACHE_NAME%/nova-metadata.log
+    %SSLENGINE%
+    %SSLCERTFILE%
+    %SSLKEYFILE%
+</VirtualHost>
+
+Alias /metadata %PUBLICWSGI%
+<Location /metadata>
+    SetHandler wsgi-script
+    Options +ExecCGI
+    WSGIProcessGroup nova-metadata
+    WSGIApplicationGroup %{GLOBAL}
+    WSGIPassAuthorization On
+</Location>
diff --git a/lib/nova b/lib/nova
index 6c414030ae..e82c28be4d 100644
--- a/lib/nova
+++ b/lib/nova
@@ -7,6 +7,7 @@
 #
 # - ``functions`` file
 # - ``DEST``, ``DATA_DIR``, ``STACK_USER`` must be defined
+# - ``FILES``
 # - ``SERVICE_{TENANT_NAME|PASSWORD}`` must be defined
 # - ``LIBVIRT_TYPE`` must be defined
 # - ``INSTANCE_NAME_PREFIX``, ``VOLUME_NAME_PREFIX`` must be defined
@@ -87,6 +88,7 @@ NOVA_SERVICE_LOCAL_HOST=${NOVA_SERVICE_LOCAL_HOST:-$SERVICE_LOCAL_HOST}
 NOVA_SERVICE_LISTEN_ADDRESS=${NOVA_SERVICE_LISTEN_ADDRESS:-$SERVICE_LISTEN_ADDRESS}
 EC2_SERVICE_PORT=${EC2_SERVICE_PORT:-8773}
 EC2_SERVICE_PORT_INT=${EC2_SERVICE_PORT_INT:-18773}
+METADATA_SERVICE_PORT=${METADATA_SERVICE_PORT:-8775}
 
 # Option to enable/disable config drive
 # NOTE: Set ``FORCE_CONFIG_DRIVE="False"`` to turn OFF config drive
@@ -241,6 +243,7 @@ function _cleanup_nova_apache_wsgi {
     sudo rm -f $NOVA_WSGI_DIR/*
     sudo rm -f $(apache_site_config_for nova-api)
     sudo rm -f $(apache_site_config_for nova-ec2-api)
+    sudo rm -f $(apache_site_config_for nova-metadata)
 }
 
 # _config_nova_apache_wsgi() - Set WSGI config files of Keystone
@@ -251,11 +254,14 @@ function _config_nova_apache_wsgi {
     nova_apache_conf=$(apache_site_config_for nova-api)
     local nova_ec2_apache_conf
     nova_ec2_apache_conf=$(apache_site_config_for nova-ec2-api)
+    local nova_metadata_apache_conf
+    nova_metadata_apache_conf=$(apache_site_config_for nova-metadata)
     local nova_ssl=""
     local nova_certfile=""
     local nova_keyfile=""
     local nova_api_port=$NOVA_SERVICE_PORT
     local nova_ec2_api_port=$EC2_SERVICE_PORT
+    local nova_metadata_port=$METADATA_SERVICE_PORT
     local venv_path=""
 
     if is_ssl_enabled_service nova-api; then
@@ -270,6 +276,7 @@ function _config_nova_apache_wsgi {
     # copy proxy vhost and wsgi helper files
     sudo cp $NOVA_DIR/nova/wsgi/nova-api.py $NOVA_WSGI_DIR/nova-api
     sudo cp $NOVA_DIR/nova/wsgi/nova-ec2-api.py $NOVA_WSGI_DIR/nova-ec2-api
+    sudo cp $NOVA_DIR/nova/wsgi/nova-metadata.py $NOVA_WSGI_DIR/nova-metadata
 
     sudo cp $FILES/apache-nova-api.template $nova_apache_conf
     sudo sed -e "
@@ -296,6 +303,19 @@ function _config_nova_apache_wsgi {
         s|%VIRTUALENV%|$venv_path|g
         s|%APIWORKERS%|$API_WORKERS|g
     " -i $nova_ec2_apache_conf
+
+    sudo cp $FILES/apache-nova-metadata.template $nova_metadata_apache_conf
+    sudo sed -e "
+        s|%PUBLICPORT%|$nova_metadata_port|g;
+        s|%APACHE_NAME%|$APACHE_NAME|g;
+        s|%PUBLICWSGI%|$NOVA_WSGI_DIR/nova-metadata|g;
+        s|%SSLENGINE%|$nova_ssl|g;
+        s|%SSLCERTFILE%|$nova_certfile|g;
+        s|%SSLKEYFILE%|$nova_keyfile|g;
+        s|%USER%|$STACK_USER|g;
+        s|%VIRTUALENV%|$venv_path|g
+        s|%APIWORKERS%|$API_WORKERS|g
+    " -i $nova_metadata_apache_conf
 }
 
 # configure_nova() - Set config files, create data dirs, etc
@@ -798,9 +818,11 @@ function start_nova_api {
     if [ -f ${enabled_site_file} ] && [ "$NOVA_USE_MOD_WSGI" == "True" ]; then
         enable_apache_site nova-api
         enable_apache_site nova-ec2-api
+        enable_apache_site nova-metadata
         restart_apache_server
         tail_log nova-api /var/log/$APACHE_NAME/nova-api.log
         tail_log nova-ec2-api /var/log/$APACHE_NAME/nova-ec2-api.log
+        tail_log nova-metadata /var/log/$APACHE_NAME/nova-metadata.log
     else
         run_process n-api "$NOVA_BIN_DIR/nova-api"
     fi
@@ -916,6 +938,7 @@ function stop_nova_rest {
     if [ "$NOVA_USE_MOD_WSGI" == "True" ]; then
         disable_apache_site nova-api
         disable_apache_site nova-ec2-api
+        disable_apache_site nova-metadata
         restart_apache_server
     else
         stop_process n-api

From 463a0e6d980690d00b17b9ebcfaf83c2f12d7615 Mon Sep 17 00:00:00 2001
From: keiji niwa <niwa-kj@njk.co.jp>
Date: Sat, 11 Jul 2015 22:09:49 +0900
Subject: [PATCH 0032/2409] Replace hard-coded --ipv6-address-mode

Looks like this was just a typo in the original
d1498d74db816b3edbb8376ca5acb7cc5792ea5c ; replace with
environment variable

Change-Id: I877c1a570a68e926c91fc8a393217e6b18245f82
---
 lib/neutron-legacy | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 3c3c96b7bd..c244e5470a 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -547,7 +547,7 @@ function create_neutron_initial_network {
         fi
 
         if [[ "$IP_VERSION" =~ .*6 ]]; then
-            SUBNET_V6_ID=$(neutron subnet-create --tenant_id $TENANT_ID --ip_version 6 --ipv6-address-mode slaac --gateway $V6_NETWORK_GATEWAY --name $PROVIDER_SUBNET_NAME_V6 $NET_ID $FIXED_RANGE_V6 | grep 'id' | get_field 2)
+            SUBNET_V6_ID=$(neutron subnet-create --tenant_id $TENANT_ID --ip_version 6 --ipv6-address-mode $IPV6_ADDRESS_MODE --gateway $V6_NETWORK_GATEWAY --name $PROVIDER_SUBNET_NAME_V6 $NET_ID $FIXED_RANGE_V6 | grep 'id' | get_field 2)
             die_if_not_set $LINENO SUBNET_V6_ID "Failure creating SUBNET_V6_ID for $PROVIDER_SUBNET_NAME_V6 $TENANT_ID"
         fi
 

From 508931ff367df646d1fa6068008fe550c5572d02 Mon Sep 17 00:00:00 2001
From: Hirofumi Ichihara <ichihara.hirofumi@lab.ntt.co.jp>
Date: Mon, 2 Nov 2015 17:39:48 +0900
Subject: [PATCH 0033/2409] Remove Ubuntu 14.10 as supported distribution

Ubuntu 14.10(utopic) reached end of life[1].

[1]: https://lists.ubuntu.com/archives/ubuntu-announce/2015-July/000197.html

Change-Id: Iab13ca797bda56462d9d117aa500d3ba0d9bebcb
---
 lib/nova_plugins/functions-libvirt | 2 +-
 stack.sh                           | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index 5525cfd951..78c59786d8 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -23,7 +23,7 @@ DEBUG_LIBVIRT=$(trueorfalse True DEBUG_LIBVIRT)
 # Installs required distro-specific libvirt packages.
 function install_libvirt {
     if is_ubuntu; then
-        if is_arch "aarch64" && [[ ${DISTRO} =~ (trusty|utopic) ]]; then
+        if is_arch "aarch64" && [[ ${DISTRO} == "trusty" ]]; then
             install_package qemu-system
         else
             install_package qemu-kvm
diff --git a/stack.sh b/stack.sh
index 80247317cf..bdbb025a0b 100755
--- a/stack.sh
+++ b/stack.sh
@@ -178,7 +178,7 @@ source $TOP_DIR/stackrc
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (precise|trusty|utopic|vivid|7.0|wheezy|sid|testing|jessie|f21|f22|rhel7) ]]; then
+if [[ ! ${DISTRO} =~ (precise|trusty|vivid|7.0|wheezy|sid|testing|jessie|f21|f22|rhel7) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From c30657d7de1a253ffd541d07a0b449d395cb8eab Mon Sep 17 00:00:00 2001
From: Markus Zoeller <mzoeller@de.ibm.com>
Date: Mon, 2 Nov 2015 11:27:46 +0100
Subject: [PATCH 0034/2409] Cleanup ReST format issues

* ReST doesn't allow monospace in italic sections.
      bash$ grep -R \`\` doc/build/html/ --include "*.html"
* The code-block section "::" needed an empty line before the code,
  otherwise it gets shown in the HTML output.
      bash$ egrep -R "<dt>::" doc/build/html/ --include "*.html"
* Monospaced font incorrectly marked with a single back tick
      bash$ egrep -nR '\w`(\s|[\.,;:])' doc/source/ --include "*.rst"

Change-Id: I66c3f685f33851c3f3f0f859996037fc24930246
---
 doc/source/configuration.rst                  | 33 ++++++++++---------
 doc/source/guides/devstack-with-lbaas-v2.rst  |  2 +-
 .../guides/devstack-with-nested-kvm.rst       | 12 +++----
 doc/source/guides/neutron.rst                 | 18 +++++-----
 4 files changed, 33 insertions(+), 32 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index d70d3dae17..e9921f049c 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -202,8 +202,8 @@ process to a file in ``LOGDIR``.
 
         LOGDIR=$DEST/logs
 
-*Note the use of ``DEST`` to locate the main install directory; this
-is why we suggest setting it in ``local.conf``.*
+Note the use of ``DEST`` to locate the main install directory; this
+is why we suggest setting it in ``local.conf``.
 
 Enabling Syslog
 ~~~~~~~~~~~~~~~
@@ -239,15 +239,15 @@ Database Backend
 
 Multiple database backends are available. The available databases are defined
 in the lib/databases directory.
-`mysql` is the default database, choose a different one by putting the
-following in the `localrc` section:
+``mysql`` is the default database, choose a different one by putting the
+following in the ``localrc`` section:
 
    ::
 
       disable_service mysql
       enable_service postgresql
 
-`mysql` is the default database.
+``mysql`` is the default database.
 
 RPC Backend
 -----------
@@ -260,6 +260,7 @@ RabbitMQ is handled via the usual service functions and
 Example disabling RabbitMQ in ``local.conf``:
 
 ::
+
     disable_service rabbit
 
 
@@ -511,7 +512,7 @@ VM. When running with only one replica the account, container and
 object services will run directly in screen. The others services like
 replicator, updaters or auditor runs in background.
 
-If you would like to enable Swift you can add this to your `localrc`
+If you would like to enable Swift you can add this to your ``localrc``
 section:
 
 ::
@@ -519,7 +520,7 @@ section:
     enable_service s-proxy s-object s-container s-account
 
 If you want a minimal Swift install with only Swift and Keystone you
-can have this instead in your `localrc` section:
+can have this instead in your ``localrc`` section:
 
 ::
 
@@ -528,24 +529,24 @@ can have this instead in your `localrc` section:
 
 If you only want to do some testing of a real normal swift cluster
 with multiple replicas you can do so by customizing the variable
-`SWIFT_REPLICAS` in your `localrc` section (usually to 3).
+``SWIFT_REPLICAS`` in your ``localrc`` section (usually to 3).
 
 Swift S3
 ++++++++
 
-If you are enabling `swift3` in `ENABLED_SERVICES` DevStack will
+If you are enabling ``swift3`` in ``ENABLED_SERVICES`` DevStack will
 install the swift3 middleware emulation. Swift will be configured to
 act as a S3 endpoint for Keystone so effectively replacing the
-`nova-objectstore`.
+``nova-objectstore``.
 
 Only Swift proxy server is launched in the screen session all other
-services are started in background and managed by `swift-init` tool.
+services are started in background and managed by ``swift-init`` tool.
 
 Heat
 ~~~~
 
-Heat is disabled by default (see `stackrc` file). To enable it
-explicitly you'll need the following settings in your `localrc`
+Heat is disabled by default (see ``stackrc`` file). To enable it
+explicitly you'll need the following settings in your ``localrc``
 section
 
 ::
@@ -554,7 +555,7 @@ section
 
 Heat can also run in standalone mode, and be configured to orchestrate
 on an external OpenStack cloud. To launch only Heat in standalone mode
-you'll need the following settings in your `localrc` section
+you'll need the following settings in your ``localrc`` section
 
 ::
 
@@ -590,14 +591,14 @@ Xenserver
 ~~~~~~~~~
 
 If you would like to use Xenserver as the hypervisor, please refer to
-the instructions in `./tools/xen/README.md`.
+the instructions in ``./tools/xen/README.md``.
 
 Cells
 ~~~~~
 
 `Cells <http://wiki.openstack.org/blueprint-nova-compute-cells>`__ is
 an alternative scaling option.  To setup a cells environment add the
-following to your `localrc` section:
+following to your ``localrc`` section:
 
 ::
 
diff --git a/doc/source/guides/devstack-with-lbaas-v2.rst b/doc/source/guides/devstack-with-lbaas-v2.rst
index f67978310d..4e5f874787 100644
--- a/doc/source/guides/devstack-with-lbaas-v2.rst
+++ b/doc/source/guides/devstack-with-lbaas-v2.rst
@@ -17,7 +17,7 @@ Install devstack
     cd devstack
 
 
-Edit your `local.conf` to look like
+Edit your ``local.conf`` to look like
 
   ::
 
diff --git a/doc/source/guides/devstack-with-nested-kvm.rst b/doc/source/guides/devstack-with-nested-kvm.rst
index c652bacced..85a5656198 100644
--- a/doc/source/guides/devstack-with-nested-kvm.rst
+++ b/doc/source/guides/devstack-with-nested-kvm.rst
@@ -50,7 +50,7 @@ the host:
     parm:           nested:bool
 
 Start your VM, now it should have KVM capabilities -- you can verify
-that by ensuring `/dev/kvm` character device is present.
+that by ensuring ``/dev/kvm`` character device is present.
 
 
 Configure Nested KVM for AMD-based Machines
@@ -97,7 +97,7 @@ To make the above value persistent across reboots, add an entry in
 Expose Virtualization Extensions to DevStack VM
 -----------------------------------------------
 
-Edit the VM's libvirt XML configuration via `virsh` utility:
+Edit the VM's libvirt XML configuration via ``virsh`` utility:
 
 ::
 
@@ -115,10 +115,10 @@ Ensure DevStack VM is Using KVM
 -------------------------------
 
 Before invoking ``stack.sh`` in the VM, ensure that KVM is enabled. This
-can be verified by checking for the presence of the file `/dev/kvm` in
+can be verified by checking for the presence of the file ``/dev/kvm`` in
 your VM. If it is present, DevStack will default to using the config
-attribute `virt_type = kvm` in `/etc/nova.conf`; otherwise, it'll fall
-back to `virt_type=qemu`, i.e. plain QEMU emulation.
+attribute ``virt_type = kvm`` in ``/etc/nova.conf``; otherwise, it'll fall
+back to ``virt_type=qemu``, i.e. plain QEMU emulation.
 
 Optionally, to explicitly set the type of virtualization, to KVM, by the
 libvirt driver in nova, the below config attribute can be used in
@@ -131,7 +131,7 @@ DevStack's ``local.conf``:
 
 Once DevStack is configured successfully, verify if the Nova instances
 are using KVM by noticing the QEMU CLI invoked by Nova is using the
-parameter `accel=kvm`, e.g.:
+parameter ``accel=kvm``, e.g.:
 
 ::
 
diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index 5891f68033..5e231315f7 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -170,8 +170,8 @@ nova, neutron)
 **Compute Nodes**
 
 In this example, the nodes that will host guest instances will run
-the `neutron-openvswitch-agent` for network connectivity, as well as
-the compute service `nova-compute`.
+the ``neutron-openvswitch-agent`` for network connectivity, as well as
+the compute service ``nova-compute``.
 
 DevStack Configuration
 ----------------------
@@ -256,16 +256,16 @@ compute node 1.
         Q_L3_ENABLED=False
 
 Compute node 2's configuration will be exactly the same, except
-`HOST_IP` will be `10.0.0.4`
+``HOST_IP`` will be ``10.0.0.4``
 
 When DevStack is configured to use provider networking (via
-`Q_USE_PROVIDER_NETWORKING` is True and `Q_L3_ENABLED` is False) -
+``Q_USE_PROVIDER_NETWORKING`` is True and ``Q_L3_ENABLED`` is False) -
 DevStack will automatically add the network interface defined in
-`PUBLIC_INTERFACE` to the `OVS_PHYSICAL_BRIDGE`
+``PUBLIC_INTERFACE`` to the ``OVS_PHYSICAL_BRIDGE``
 
 For example, with the above  configuration, a bridge is
-created, named `br-ex` which is managed by Open vSwitch, and the
-second interface on the compute node, `eth1` is attached to the
+created, named ``br-ex`` which is managed by Open vSwitch, and the
+second interface on the compute node, ``eth1`` is attached to the
 bridge, to forward traffic sent by guest VMs.
 
 Miscellaneous Tips
@@ -307,7 +307,7 @@ Configuring Extension Drivers for the ML2 Plugin
 ------------------------------------------------
 
 Extension drivers for the ML2 plugin are set with the variable
-`Q_ML2_PLUGIN_EXT_DRIVERS`, and includes the 'port_security' extension
+``Q_ML2_PLUGIN_EXT_DRIVERS``, and includes the 'port_security' extension
 by default. If you want to remove all the extension drivers (even
-'port_security'), set `Q_ML2_PLUGIN_EXT_DRIVERS` to blank.
+'port_security'), set ``Q_ML2_PLUGIN_EXT_DRIVERS`` to blank.
 

From 85f42f698c7bd74d53309da486fbf44ed860c348 Mon Sep 17 00:00:00 2001
From: Thomas Morin <thomas.morin@orange.com>
Date: Tue, 1 Sep 2015 10:33:10 +0200
Subject: [PATCH 0035/2409] Provide an error message on bogus config file spec

If local.conf specifies a config file addition in the following way...

[[post-config|$MY_CONF_FILE]]
[xyz]
foo=bar

...and $MY_CONF_FILE points to a file whose directory is not writable by
the user running the script, then stack.sh aborts with the following
obscure message:

  2015-09-01 08:20:08.113 | touch: setting times of '/': Permission denied

This patch modifies inc/meta-config to provide a useful error message,
such as:

  2015-09-01 08:20:08.114 | could not create config file / ($MY_CONF_FILE)

This patch also modifies inc/meta-config so that it provides an error
message if $MY_CONF_FILE is empty (instead of silently ignoring this local.conf
statement):

  2015-09-01 09:38:53.406 | bogus config file specification: $MY_CONF_FILE
  is undefined

Change-Id: I9b78407420318548561012a8672762bc7fdd6db6
Closes-Bug: 1490881
---
 inc/meta-config           | 17 ++++++++++++---
 tests/test_meta_config.sh | 45 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 59 insertions(+), 3 deletions(-)

diff --git a/inc/meta-config b/inc/meta-config
index e5f902d1dd..b9ab6b207f 100644
--- a/inc/meta-config
+++ b/inc/meta-config
@@ -89,9 +89,10 @@ function merge_config_file {
     # note, configfile might be a variable (note the iniset, etc
     # created in the mega-awk below is "eval"ed too, so we just leave
     # it alone.
-    local real_configfile=$(eval echo $configfile)
+    local real_configfile
+    real_configfile=$(eval echo $configfile)
     if [ ! -f $real_configfile ]; then
-        touch $real_configfile
+        touch $real_configfile || die $LINENO "could not create config file $real_configfile ($configfile)"
     fi
 
     get_meta_section $file $matchgroup $configfile | \
@@ -177,8 +178,18 @@ function merge_config_group {
     local configfile group
     for group in $matchgroups; do
         for configfile in $(get_meta_section_files $localfile $group); do
-            if [[ -d $(dirname $(eval "echo $configfile")) ]]; then
+            local realconfigfile
+            local dir
+
+            realconfigfile=$(eval "echo $configfile")
+            if [[ -z $realconfigfile ]]; then
+                die $LINENO "bogus config file specification: $configfile is undefined"
+            fi
+            dir=$(dirname $realconfigfile)
+            if [[ -d $dir ]]; then
                 merge_config_file $localfile $group $configfile
+            else
+                die $LINENO "bogus config file specification $configfile ($configfile=$realconfigfile, $dir is not a directory)"
             fi
         done
     done
diff --git a/tests/test_meta_config.sh b/tests/test_meta_config.sh
index a04c081854..f3e94af8f8 100755
--- a/tests/test_meta_config.sh
+++ b/tests/test_meta_config.sh
@@ -23,6 +23,12 @@ function check_result {
     fi
 }
 
+# mock function-common:die so that it does not
+# interupt our test script
+function die {
+    exit -1
+}
+
 TEST_1C_ADD="[eee]
 type=new
 multi = foo2"
@@ -110,6 +116,15 @@ attr = strip_trailing_space
 [DEFAULT]
 servers=10.11.12.13:80
 
+[[test8|/permission-denied.conf]]
+foo=bar
+
+[[test9|\$UNDEF]]
+foo=bar
+
+[[test10|does-not-exist-dir/test.conf]]
+foo=bar
+
 [[test-multi-sections|test-multi-sections.conf]]
 [sec-1]
 cfg_item1 = abcd
@@ -340,6 +355,36 @@ EXPECT_VAL="
 servers = 10.11.12.13:80"
 check_result "$VAL" "$EXPECT_VAL"
 
+echo "merge_config_file test8 non-touchable conf file: "
+set +e
+# function is expected to fail and exit, running it
+# in a subprocess to let this script proceed
+(merge_config_file test.conf test8 /permission-denied.conf)
+VAL=$?
+EXPECT_VAL=255
+check_result "$VAL" "$EXPECT_VAL"
+set -e
+
+echo -n "merge_config_group test9 undefined conf file: "
+set +e
+# function is expected to fail and exit, running it
+# in a subprocess to let this script proceed
+(merge_config_group test.conf test9)
+VAL=$?
+EXPECT_VAL=255
+check_result "$VAL" "$EXPECT_VAL"
+set -e
+
+echo -n "merge_config_group test10 not directory: "
+set +e
+# function is expected to fail and exit, running it
+# in a subprocess to let this script proceed
+(merge_config_group test.conf test10)
+VAL=$?
+EXPECT_VAL=255
+check_result "$VAL" "$EXPECT_VAL"
+set -e
+
 rm -f test.conf test1c.conf test2a.conf \
     test-space.conf test-equals.conf test-strip.conf \
     test-colon.conf test-env.conf test-multiline.conf \

From dca49de22f57f3b2f502380b2cbfedb0dcdba209 Mon Sep 17 00:00:00 2001
From: Martin Hickey <martin.hickey@ie.ibm.com>
Date: Tue, 20 Oct 2015 12:13:19 +0100
Subject: [PATCH 0036/2409] Use stevedore aliases for interface_driver
 configuration

interface_driver configuration was updated to use stevedore aliases.
This patch is to change devstack scripts to now use the aliases
instead of the previous class imports.

Closes-Bug: #1504536

Change-Id: Ic56bfcc1f9da05a999e6fd328e4dd6617e9470ff
---
 lib/neutron_plugins/bigswitch_floodlight | 4 ++--
 lib/neutron_plugins/brocade              | 2 +-
 lib/neutron_plugins/cisco                | 2 +-
 lib/neutron_plugins/linuxbridge_agent    | 2 +-
 lib/neutron_plugins/openvswitch_agent    | 2 +-
 5 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/lib/neutron_plugins/bigswitch_floodlight b/lib/neutron_plugins/bigswitch_floodlight
index 4166131534..f52105e658 100644
--- a/lib/neutron_plugins/bigswitch_floodlight
+++ b/lib/neutron_plugins/bigswitch_floodlight
@@ -58,9 +58,9 @@ function neutron_plugin_configure_service {
 function neutron_plugin_setup_interface_driver {
     local conf_file=$1
     if [ "$BS_FL_VIF_DRIVER" = "ivs" ]; then
-        iniset $conf_file DEFAULT interface_driver neutron.agent.linux.interface.IVSInterfaceDriver
+        iniset $conf_file DEFAULT interface_driver ivs
     else
-        iniset $conf_file DEFAULT interface_driver neutron.agent.linux.interface.OVSInterfaceDriver
+        iniset $conf_file DEFAULT interface_driver openvswitch
     fi
 }
 
diff --git a/lib/neutron_plugins/brocade b/lib/neutron_plugins/brocade
index 557b94dec0..953360e070 100644
--- a/lib/neutron_plugins/brocade
+++ b/lib/neutron_plugins/brocade
@@ -68,7 +68,7 @@ function neutron_plugin_configure_plugin_agent {
 
 function neutron_plugin_setup_interface_driver {
     local conf_file=$1
-    iniset $conf_file DEFAULT interface_driver neutron.agent.linux.interface.BridgeInterfaceDriver
+    iniset $conf_file DEFAULT interface_driver linuxbridge
 }
 
 function has_neutron_plugin_security_group {
diff --git a/lib/neutron_plugins/cisco b/lib/neutron_plugins/cisco
index 90dcd574c0..7d0cf1af39 100644
--- a/lib/neutron_plugins/cisco
+++ b/lib/neutron_plugins/cisco
@@ -150,7 +150,7 @@ function neutron_plugin_create_initial_network_profile {
 
 function neutron_plugin_setup_interface_driver {
     local conf_file=$1
-    iniset $conf_file DEFAULT interface_driver neutron.agent.linux.interface.OVSInterfaceDriver
+    iniset $conf_file DEFAULT interface_driver openvswitch
 }
 
 # Restore xtrace
diff --git a/lib/neutron_plugins/linuxbridge_agent b/lib/neutron_plugins/linuxbridge_agent
index bd4438db04..f28bcfeadd 100644
--- a/lib/neutron_plugins/linuxbridge_agent
+++ b/lib/neutron_plugins/linuxbridge_agent
@@ -85,7 +85,7 @@ function neutron_plugin_configure_plugin_agent {
 
 function neutron_plugin_setup_interface_driver {
     local conf_file=$1
-    iniset $conf_file DEFAULT interface_driver neutron.agent.linux.interface.BridgeInterfaceDriver
+    iniset $conf_file DEFAULT interface_driver linuxbridge
 }
 
 function neutron_plugin_check_adv_test_requirements {
diff --git a/lib/neutron_plugins/openvswitch_agent b/lib/neutron_plugins/openvswitch_agent
index 48e47b3dab..5a843ffba7 100644
--- a/lib/neutron_plugins/openvswitch_agent
+++ b/lib/neutron_plugins/openvswitch_agent
@@ -110,7 +110,7 @@ function neutron_plugin_configure_plugin_agent {
 
 function neutron_plugin_setup_interface_driver {
     local conf_file=$1
-    iniset $conf_file DEFAULT interface_driver neutron.agent.linux.interface.OVSInterfaceDriver
+    iniset $conf_file DEFAULT interface_driver openvswitch
 }
 
 function neutron_plugin_check_adv_test_requirements {

From a91d455e23f68613db0e67fea339a13fd9eae7d4 Mon Sep 17 00:00:00 2001
From: Steve Martinelli <stevemar@ca.ibm.com>
Date: Tue, 20 Oct 2015 23:15:38 -0400
Subject: [PATCH 0037/2409] change `swift post` to openstackclient cli command

with the release of osc 1.8.0, modifying object store account
properties is now available. use this mechanism and avoid setting
environment variable that are only helpful for swift CLI.

Change-Id: Ie51e3e2bb86162763f23d0a6bed36208811f89fc
---
 lib/swift | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/lib/swift b/lib/swift
index 3a8e80dd44..ee0238d975 100644
--- a/lib/swift
+++ b/lib/swift
@@ -813,11 +813,13 @@ function stop_swift {
 }
 
 function swift_configure_tempurls {
+    # note we are using swift credentials!
     OS_USERNAME=swift \
-        OS_PROJECT_NAME=$SERVICE_TENANT_NAME \
-        OS_PASSWORD=$SERVICE_PASSWORD \
-        OS_AUTH_URL=$SERVICE_ENDPOINT \
-        swift post --auth-version 3 -m "Temp-URL-Key: $SWIFT_TEMPURL_KEY"
+    OS_PASSWORD=$SERVICE_PASSWORD \
+    OS_PROJECT_NAME=$SERVICE_TENANT_NAME \
+    OS_AUTH_URL=$SERVICE_ENDPOINT \
+    openstack object store account \
+        set --property "Temp-URL-Key=$SWIFT_TEMPURL_KEY"
 }
 
 # Restore xtrace

From 0c96c37b5d9775a5c0ad257f210112f76f7987e7 Mon Sep 17 00:00:00 2001
From: Davanum Srinivas <davanum@gmail.com>
Date: Sun, 1 Nov 2015 21:45:29 -0500
Subject: [PATCH 0038/2409] Enable devstack for Ubuntu 15.10 Wily

Change-Id: I2056fd26d42f29ececc4c38fdd791589ec7037a0
---
 stack.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index bdbb025a0b..72253f81d7 100755
--- a/stack.sh
+++ b/stack.sh
@@ -178,7 +178,7 @@ source $TOP_DIR/stackrc
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (precise|trusty|vivid|7.0|wheezy|sid|testing|jessie|f21|f22|rhel7) ]]; then
+if [[ ! ${DISTRO} =~ (precise|trusty|vivid|wily|7.0|wheezy|sid|testing|jessie|f21|f22|rhel7) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From 33a96ffc2609d8477542002e56515a5026c2c48d Mon Sep 17 00:00:00 2001
From: Davanum Srinivas <davanum@gmail.com>
Date: Mon, 2 Nov 2015 17:23:39 -0500
Subject: [PATCH 0039/2409] Zookeeper for DLM scenarios

In Tokyo, there was a cross project session on distributed
key locking:
https://etherpad.openstack.org/p/mitaka-cross-project-dlm

In support of the discussion there, we'll need support for
a zookeeper service in Devstack and ability to use libraries
like Tooz for DLM functionality.

In this review, we pick up some configuration files from
monasca-api and copy the lib/template to implement the
zookeeper lifecycle. Those services that need zookeeper
need to add "zookeeper" in ENABLED_SERVICES.

Change-Id: Icef26e5cdaa930a581e27d330e47706776a7f98f
---
 files/debs/zookeeper             |  1 +
 files/rpms/zookeeper             |  1 +
 files/zookeeper/environment      | 36 +++++++++++++
 files/zookeeper/log4j.properties | 69 +++++++++++++++++++++++++
 files/zookeeper/myid             |  1 +
 files/zookeeper/zoo.cfg          | 74 +++++++++++++++++++++++++++
 lib/zookeeper                    | 86 ++++++++++++++++++++++++++++++++
 stack.sh                         | 15 ++++++
 stackrc                          |  2 +-
 unstack.sh                       |  5 ++
 10 files changed, 289 insertions(+), 1 deletion(-)
 create mode 100644 files/debs/zookeeper
 create mode 100644 files/rpms/zookeeper
 create mode 100644 files/zookeeper/environment
 create mode 100644 files/zookeeper/log4j.properties
 create mode 100644 files/zookeeper/myid
 create mode 100644 files/zookeeper/zoo.cfg
 create mode 100644 lib/zookeeper

diff --git a/files/debs/zookeeper b/files/debs/zookeeper
new file mode 100644
index 0000000000..66227f7e31
--- /dev/null
+++ b/files/debs/zookeeper
@@ -0,0 +1 @@
+zookeeperd
\ No newline at end of file
diff --git a/files/rpms/zookeeper b/files/rpms/zookeeper
new file mode 100644
index 0000000000..c0d1c3066d
--- /dev/null
+++ b/files/rpms/zookeeper
@@ -0,0 +1 @@
+zookeeper
\ No newline at end of file
diff --git a/files/zookeeper/environment b/files/zookeeper/environment
new file mode 100644
index 0000000000..afa2d2f89f
--- /dev/null
+++ b/files/zookeeper/environment
@@ -0,0 +1,36 @@
+#
+# (C) Copyright 2015 Hewlett Packard Enterprise Development Company LP
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+# Modified from http://packages.ubuntu.com/saucy/zookeeperd
+NAME=zookeeper
+ZOOCFGDIR=/etc/zookeeper/conf
+
+# seems, that log4j requires the log4j.properties file to be in the classpath
+CLASSPATH="$ZOOCFGDIR:/usr/share/java/jline.jar:/usr/share/java/log4j-1.2.jar:/usr/share/java/xercesImpl.jar:/usr/share/java/xmlParserAPIs.jar:/usr/share/java/netty.jar:/usr/share/java/slf4j-api.jar:/usr/share/java/slf4j-log4j12.jar:/usr/share/java/zookeeper.jar"
+
+ZOOCFG="$ZOOCFGDIR/zoo.cfg"
+ZOO_LOG_DIR=/var/log/zookeeper
+USER=$NAME
+GROUP=$NAME
+PIDDIR=/var/run/$NAME
+PIDFILE=$PIDDIR/$NAME.pid
+SCRIPTNAME=/etc/init.d/$NAME
+JAVA=/usr/bin/java
+ZOOMAIN="org.apache.zookeeper.server.quorum.QuorumPeerMain"
+ZOO_LOG4J_PROP="INFO,ROLLINGFILE"
+JMXLOCALONLY=false
+JAVA_OPTS=""
diff --git a/files/zookeeper/log4j.properties b/files/zookeeper/log4j.properties
new file mode 100644
index 0000000000..6c45a4aad9
--- /dev/null
+++ b/files/zookeeper/log4j.properties
@@ -0,0 +1,69 @@
+#
+# (C) Copyright 2015 Hewlett Packard Enterprise Development Company LP
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+# From http://packages.ubuntu.com/saucy/zookeeperd
+
+# ZooKeeper Logging Configuration
+#
+
+# Format is "<default threshold> (, <appender>)+
+
+log4j.rootLogger=${zookeeper.root.logger}
+
+# Example: console appender only
+# log4j.rootLogger=INFO, CONSOLE
+
+# Example with rolling log file
+#log4j.rootLogger=DEBUG, CONSOLE, ROLLINGFILE
+
+# Example with rolling log file and tracing
+#log4j.rootLogger=TRACE, CONSOLE, ROLLINGFILE, TRACEFILE
+
+#
+# Log INFO level and above messages to the console
+#
+log4j.appender.CONSOLE=org.apache.log4j.ConsoleAppender
+log4j.appender.CONSOLE.Threshold=INFO
+log4j.appender.CONSOLE.layout=org.apache.log4j.PatternLayout
+log4j.appender.CONSOLE.layout.ConversionPattern=%d{ISO8601} - %-5p [%t:%C{1}@%L] - %m%n
+
+#
+# Add ROLLINGFILE to rootLogger to get log file output
+#    Log DEBUG level and above messages to a log file
+log4j.appender.ROLLINGFILE=org.apache.log4j.RollingFileAppender
+log4j.appender.ROLLINGFILE.Threshold=WARN
+log4j.appender.ROLLINGFILE.File=${zookeeper.log.dir}/zookeeper.log
+
+# Max log file size of 10MB
+log4j.appender.ROLLINGFILE.MaxFileSize=10MB
+# uncomment the next line to limit number of backup files
+#log4j.appender.ROLLINGFILE.MaxBackupIndex=10
+
+log4j.appender.ROLLINGFILE.layout=org.apache.log4j.PatternLayout
+log4j.appender.ROLLINGFILE.layout.ConversionPattern=%d{ISO8601} - %-5p [%t:%C{1}@%L] - %m%n
+
+
+#
+# Add TRACEFILE to rootLogger to get log file output
+#    Log DEBUG level and above messages to a log file
+log4j.appender.TRACEFILE=org.apache.log4j.FileAppender
+log4j.appender.TRACEFILE.Threshold=TRACE
+log4j.appender.TRACEFILE.File=${zookeeper.log.dir}/zookeeper_trace.log
+
+log4j.appender.TRACEFILE.layout=org.apache.log4j.PatternLayout
+### Notice we are including log4j's NDC here (%x)
+log4j.appender.TRACEFILE.layout.ConversionPattern=%d{ISO8601} - %-5p [%t:%C{1}@%L][%x] - %m%n
diff --git a/files/zookeeper/myid b/files/zookeeper/myid
new file mode 100644
index 0000000000..c227083464
--- /dev/null
+++ b/files/zookeeper/myid
@@ -0,0 +1 @@
+0
\ No newline at end of file
diff --git a/files/zookeeper/zoo.cfg b/files/zookeeper/zoo.cfg
new file mode 100644
index 0000000000..b8f55827e3
--- /dev/null
+++ b/files/zookeeper/zoo.cfg
@@ -0,0 +1,74 @@
+#
+# (C) Copyright 2015 Hewlett Packard Enterprise Development Company LP
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# http://hadoop.apache.org/zookeeper/docs/current/zookeeperAdmin.html
+
+# The number of milliseconds of each tick
+tickTime=2000
+# The number of ticks that the initial
+# synchronization phase can take
+initLimit=10
+# The number of ticks that can pass between
+# sending a request and getting an acknowledgement
+syncLimit=5
+# the directory where the snapshot is stored.
+dataDir=/var/lib/zookeeper
+# Place the dataLogDir to a separate physical disc for better performance
+# dataLogDir=/disk2/zookeeper
+
+# the port at which the clients will connect
+clientPort=2181
+
+# Maximum number of clients that can connect from one client
+maxClientCnxns=60
+
+# specify all zookeeper servers
+# The fist port is used by followers to connect to the leader
+# The second one is used for leader election
+
+server.0=127.0.0.1:2888:3888
+
+# To avoid seeks ZooKeeper allocates space in the transaction log file in
+# blocks of preAllocSize kilobytes. The default block size is 64M. One reason
+# for changing the size of the blocks is to reduce the block size if snapshots
+# are taken more often. (Also, see snapCount).
+#preAllocSize=65536
+
+# Clients can submit requests faster than ZooKeeper can process them,
+# especially if there are a lot of clients. To prevent ZooKeeper from running
+# out of memory due to queued requests, ZooKeeper will throttle clients so that
+# there is no more than globalOutstandingLimit outstanding requests in the
+# system. The default limit is 1,000.ZooKeeper logs transactions to a
+# transaction log. After snapCount transactions are written to a log file a
+# snapshot is started and a new transaction log file is started. The default
+# snapCount is 10,000.
+#snapCount=1000
+
+# If this option is defined, requests will be will logged to a trace file named
+# traceFile.year.month.day.
+#traceFile=
+
+# Leader accepts client connections. Default value is "yes". The leader machine
+# coordinates updates. For higher update throughput at thes slight expense of
+# read throughput the leader can be configured to not accept clients and focus
+# on coordination.
+#leaderServes=yes
+
+# Autopurge every hour to avoid using lots of disk in bursts
+# Order of the next 2 properties matters.
+# autopurge.snapRetainCount must be before autopurge.purgeInterval.
+autopurge.snapRetainCount=3
+autopurge.purgeInterval=1
\ No newline at end of file
diff --git a/lib/zookeeper b/lib/zookeeper
new file mode 100644
index 0000000000..e62ba8ada8
--- /dev/null
+++ b/lib/zookeeper
@@ -0,0 +1,86 @@
+#!/bin/bash
+#
+# lib/zookeeper
+# Functions to control the installation and configuration of **zookeeper**
+
+# Dependencies:
+#
+# - ``functions`` file
+
+# ``stack.sh`` calls the entry points in this order:
+#
+# - is_zookeeper_enabled
+# - install_zookeeper
+# - configure_zookeeper
+# - init_zookeeper
+# - start_zookeeper
+# - stop_zookeeper
+# - cleanup_zookeeper
+
+# Save trace setting
+XTRACE=$(set +o | grep xtrace)
+set +o xtrace
+
+
+# Defaults
+# --------
+
+# <define global variables here that belong to this project>
+
+# Set up default directories
+ZOOKEEPER_DATA_DIR=$DEST/data/zookeeper
+ZOOKEEPER_CONF_DIR=/etc/zookeeper
+
+
+# Entry Points
+# ------------
+
+# Test if any zookeeper service us enabled
+# is_zookeeper_enabled
+function is_zookeeper_enabled {
+    [[ ,${ENABLED_SERVICES}, =~ ,"zookeeper", ]] && return 0
+    return 1
+}
+
+# cleanup_zookeeper() - Remove residual data files, anything left over from previous
+# runs that a clean run would need to clean up
+function cleanup_zookeeper {
+    sudo rm -rf $ZOOKEEPER_DATA_DIR
+}
+
+# configure_zookeeper() - Set config files, create data dirs, etc
+function configure_zookeeper {
+    sudo cp $FILES/zookeeper/* $ZOOKEEPER_CONF_DIR
+    sudo sed -i -e 's|.*dataDir.*|dataDir='$ZOOKEEPER_DATA_DIR'|' $ZOOKEEPER_CONF_DIR/zoo.cfg
+}
+
+# init_zookeeper() - Initialize databases, etc.
+function init_zookeeper {
+    # clean up from previous (possibly aborted) runs
+    # create required data files
+    sudo rm -rf $ZOOKEEPER_DATA_DIR
+    sudo mkdir -p $ZOOKEEPER_DATA_DIR
+}
+
+# install_zookeeper() - Collect source and prepare
+function install_zookeeper {
+    install_package zookeeperd
+}
+
+# start_zookeeper() - Start running processes, including screen
+function start_zookeeper {
+    start_service zookeeper
+}
+
+# stop_zookeeper() - Stop running processes (non-screen)
+function stop_zookeeper {
+    stop_service zookeeper
+}
+
+# Restore xtrace
+$XTRACE
+
+# Tell emacs to use shell-script-mode
+## Local variables:
+## mode: shell-script
+## End:
diff --git a/stack.sh b/stack.sh
index bdbb025a0b..118785150a 100755
--- a/stack.sh
+++ b/stack.sh
@@ -539,6 +539,7 @@ source $TOP_DIR/lib/heat
 source $TOP_DIR/lib/neutron-legacy
 source $TOP_DIR/lib/ldap
 source $TOP_DIR/lib/dstat
+source $TOP_DIR/lib/zookeeper
 
 # Extras Source
 # --------------
@@ -729,6 +730,11 @@ run_phase stack pre-install
 
 install_rpc_backend
 
+if is_service_enabled zookeeper; then
+    cleanup_zookeeper
+    configure_zookeeper
+    init_zookeeper
+fi
 if is_service_enabled $DATABASE_BACKENDS; then
     install_database
 fi
@@ -968,6 +974,15 @@ save_stackenv $LINENO
 start_dstat
 
 
+# Zookeeper
+# -----
+
+# zookeeper for use with tooz for Distributed Lock Management capabilities etc.,
+if is_service_enabled zookeeper; then
+    start_zookeeper
+fi
+
+
 # Keystone
 # --------
 
diff --git a/stackrc b/stackrc
index 819aa0125c..19538c0679 100644
--- a/stackrc
+++ b/stackrc
@@ -69,7 +69,7 @@ if ! isset ENABLED_SERVICES ; then
     # Dashboard
     ENABLED_SERVICES+=,horizon
     # Additional services
-    ENABLED_SERVICES+=,rabbit,tempest,mysql,dstat
+    ENABLED_SERVICES+=,rabbit,tempest,mysql,dstat,zookeeper
 fi
 
 # SQLAlchemy supports multiple database drivers for each database server
diff --git a/unstack.sh b/unstack.sh
index 30447a7005..0cace3254a 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -69,6 +69,7 @@ source $TOP_DIR/lib/heat
 source $TOP_DIR/lib/neutron-legacy
 source $TOP_DIR/lib/ldap
 source $TOP_DIR/lib/dstat
+source $TOP_DIR/lib/zookeeper
 
 # Extras Source
 # --------------
@@ -172,6 +173,10 @@ if is_service_enabled dstat; then
     stop_dstat
 fi
 
+if is_service_enabled zookeeper; then
+    stop_zookeeper
+fi
+
 # Clean up the remainder of the screen processes
 SCREEN=$(which screen)
 if [[ -n "$SCREEN" ]]; then

From 9013bb0c24623ce8d064b561d4fd331e370762e1 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 4 Nov 2015 12:31:39 -0500
Subject: [PATCH 0040/2409] remove wheel cache code

Thanks to lifeless, pip now implicitly has a wheel cache so that it
builds a wheel before every install, and uses that cache. All our
clever attempts at manually doing wheelhouse things is actually
bypassing the existing cache and making things take longer.

We should remove all of this code and just let pip do this thing,
which is does very well, and get out of the way.

Change-Id: Ia140dc34638d893b92f66d1ba20efd9522c5923b
---
 Makefile                    |  6 +--
 doc/source/index.rst        |  1 -
 files/venv-requirements.txt | 11 -----
 stack.sh                    |  6 ---
 stackrc                     |  5 ---
 tools/build_wheels.sh       | 86 -------------------------------------
 6 files changed, 1 insertion(+), 114 deletions(-)
 delete mode 100644 files/venv-requirements.txt
 delete mode 100755 tools/build_wheels.sh

diff --git a/Makefile b/Makefile
index a6bb230708..a94d60a0ef 100644
--- a/Makefile
+++ b/Makefile
@@ -13,7 +13,6 @@
 
 # Duplicated from stackrc for now
 DEST=/opt/stack
-WHEELHOUSE=$(DEST)/.wheelhouse
 
 all:
 	echo "This just saved you from a terrible mistake!"
@@ -25,9 +24,6 @@ stack:
 unstack:
 	./unstack.sh
 
-wheels:
-	WHEELHOUSE=$(WHEELHOUSE) tools/build_wheels.sh
-
 docs:
 	tox -edocs
 
@@ -57,7 +53,7 @@ clean:
 
 # Clean out the cache too
 realclean: clean
-	rm -rf files/cirros*.tar.gz files/Fedora*.qcow2 $(WHEELHOUSE)
+	rm -rf files/cirros*.tar.gz files/Fedora*.qcow2
 
 # Repo stuffs
 
diff --git a/doc/source/index.rst b/doc/source/index.rst
index 99e96b1d1a..b65730ffe8 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -206,7 +206,6 @@ Tools
 
 * `tools/build\_docs.sh <tools/build_docs.sh.html>`__
 * `tools/build\_venv.sh <tools/build_venv.sh.html>`__
-* `tools/build\_wheels.sh <tools/build_wheels.sh.html>`__
 * `tools/create-stack-user.sh <tools/create-stack-user.sh.html>`__
 * `tools/create\_userrc.sh <tools/create_userrc.sh.html>`__
 * `tools/fixup\_stuff.sh <tools/fixup_stuff.sh.html>`__
diff --git a/files/venv-requirements.txt b/files/venv-requirements.txt
deleted file mode 100644
index b9a55b423d..0000000000
--- a/files/venv-requirements.txt
+++ /dev/null
@@ -1,11 +0,0 @@
-# Once we can prebuild wheels before a devstack run, uncomment the skipped libraries
-cryptography
-# lxml # still install from from packages
-# netifaces # still install from packages
-#numpy    # slowest wheel by far, stop building until we are actually using the output
-posix-ipc
-# psycopg # still install from packages
-pycrypto
-pyOpenSSL
-PyYAML
-xattr
diff --git a/stack.sh b/stack.sh
index bdbb025a0b..aedc5d4006 100755
--- a/stack.sh
+++ b/stack.sh
@@ -716,12 +716,6 @@ source $TOP_DIR/tools/fixup_stuff.sh
 # Install required infra support libraries
 install_infra
 
-# Pre-build some problematic wheels
-if [[ -n ${WHEELHOUSE:-} && ! -d ${WHEELHOUSE:-} ]]; then
-    source $TOP_DIR/tools/build_wheels.sh
-fi
-
-
 # Extras Pre-install
 # ------------------
 # Phase: pre-install
diff --git a/stackrc b/stackrc
index 819aa0125c..d9f477e8ce 100644
--- a/stackrc
+++ b/stackrc
@@ -143,11 +143,6 @@ USE_VENV=$(trueorfalse False USE_VENV)
 # requirmenets files here, in a comma-separated list
 ADDITIONAL_VENV_PACKAGES=${ADITIONAL_VENV_PACKAGES:-""}
 
-# Configure wheel cache location
-export WHEELHOUSE=${WHEELHOUSE:-$DEST/.wheelhouse}
-export PIP_WHEEL_DIR=${PIP_WHEEL_DIR:-$WHEELHOUSE}
-export PIP_FIND_LINKS=${PIP_FIND_LINKS:-file://$WHEELHOUSE}
-
 # This can be used to turn database query logging on and off
 # (currently only implemented for MySQL backend)
 DATABASE_QUERY_LOGGING=$(trueorfalse False DATABASE_QUERY_LOGGING)
diff --git a/tools/build_wheels.sh b/tools/build_wheels.sh
deleted file mode 100755
index 14c2999c8f..0000000000
--- a/tools/build_wheels.sh
+++ /dev/null
@@ -1,86 +0,0 @@
-#!/usr/bin/env bash
-#
-# **tools/build_wheels.sh** - Build a cache of Python wheels
-#
-# build_wheels.sh [package [...]]
-#
-# System package prerequisites listed in ``files/*/devlibs`` will be installed
-#
-# Builds wheels for all virtual env requirements listed in
-# ``venv-requirements.txt`` plus any supplied on the command line.
-#
-# Assumes:
-# - ``tools/install_pip.sh`` has been run and a suitable ``pip/setuptools`` is available.
-
-# If ``TOP_DIR`` is set we're being sourced rather than running stand-alone
-# or in a sub-shell
-if [[ -z "$TOP_DIR" ]]; then
-
-    set -o errexit
-    set -o nounset
-
-    # Keep track of the DevStack directory
-    TOP_DIR=$(cd $(dirname "$0")/.. && pwd)
-    FILES=$TOP_DIR/files
-
-    # Import common functions
-    source $TOP_DIR/functions
-
-    GetDistro
-
-    source $TOP_DIR/stackrc
-
-    trap err_trap ERR
-
-fi
-
-# Get additional packages to build
-MORE_PACKAGES="$@"
-
-# Exit on any errors so that errors don't compound
-function err_trap {
-    local r=$?
-    set +o xtrace
-
-    rm -rf $TMP_VENV_PATH
-
-    exit $r
-}
-
-# Get system prereqs
-install_package $(get_packages devlibs)
-
-# Get a modern ``virtualenv``
-pip_install virtualenv
-
-# Prepare the workspace
-TMP_VENV_PATH=$(mktemp -d tmp-venv-XXXX)
-virtualenv $TMP_VENV_PATH
-
-# Install modern pip and wheel
-PIP_VIRTUAL_ENV=$TMP_VENV_PATH pip_install -U pip wheel
-
-# BUG: cffi has a lot of issues. It has no stable ABI, if installed
-# code is built with a different ABI than the one that's detected at
-# load time, it tries to compile on the fly for the new ABI in the
-# install location (which will probably be /usr and not
-# writable). Also cffi is often included via setup_requires by
-# packages, which have different install rules (allowing betas) than
-# pip has.
-#
-# Because of this we must pip install cffi into the venv to build
-# wheels.
-PIP_VIRTUAL_ENV=$TMP_VENV_PATH pip_install_gr cffi
-
-# ``VENV_PACKAGES`` is a list of packages we want to pre-install
-VENV_PACKAGE_FILE=$FILES/venv-requirements.txt
-if [[ -r $VENV_PACKAGE_FILE ]]; then
-    VENV_PACKAGES=$(grep -v '^#' $VENV_PACKAGE_FILE)
-fi
-
-for pkg in ${VENV_PACKAGES,/ } ${MORE_PACKAGES}; do
-    $TMP_VENV_PATH/bin/pip wheel $pkg
-done
-
-# Clean up wheel workspace
-rm -rf $TMP_VENV_PATH

From 9127c1a56bc1504ae77df25b0da7a6d0a5f0bfe8 Mon Sep 17 00:00:00 2001
From: Attila Fazekas <afazekas@redhat.com>
Date: Thu, 5 Nov 2015 10:09:02 +0100
Subject: [PATCH 0041/2409] Do not remove python-pip package on Fedora-23

python on fedora 23 compiled with rewheel support,
in this case the python-pip is a required package, and cannot be
removed.

[1] http://pkgs.fedoraproject.org/cgit/python.git/tree/python.spec?id=3b6fac0339bab69ca5fbf2881568f0565ab0e252#n174

Change-Id: I499b7bec97c4360b32d156079f2b7f3923e3888a
---
 tools/install_pip.sh | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index 13c1786fb9..ab5efb2e77 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -110,7 +110,11 @@ get_versions
 # Do pip
 
 # Eradicate any and all system packages
-uninstall_package python-pip
+
+# python in f23 depends on the python-pip package
+if ! { is_fedora && [[ $DISTRO == "f23" ]]; }; then
+    uninstall_package python-pip
+fi
 
 install_get_pip
 

From e3c2673ae447d8b3cc4649f5efde5b84e26f6cd9 Mon Sep 17 00:00:00 2001
From: Atsushi SAKAI <sakaia@jp.fujitsu.com>
Date: Fri, 6 Nov 2015 13:23:47 +0900
Subject: [PATCH 0042/2409] Fix two typos on faq.rst

guarunteed => guaranteed
Centos     => CentOS

Change-Id: Id356443fcdc4128ff20d7a89158265aa16c105b2
---
 doc/source/faq.rst | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/source/faq.rst b/doc/source/faq.rst
index 3562bfacee..7aca8d0b4a 100644
--- a/doc/source/faq.rst
+++ b/doc/source/faq.rst
@@ -54,7 +54,7 @@ combinations listed in ``README.md``. DevStack is only supported on
 releases other than those documented in ``README.md`` on a best-effort
 basis.
 
-Are there any differences between Ubuntu and Centos/Fedora support?
+Are there any differences between Ubuntu and CentOS/Fedora support?
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 Both should work well and are tested by DevStack CI.
@@ -146,7 +146,7 @@ your ``local.conf``
 
 
 Upstream DevStack is only tested with master and stable
-branches. Setting custom BRANCH definitions is not guarunteed to
+branches. Setting custom BRANCH definitions is not guaranteed to
 produce working results.
 
 What can I do about RabbitMQ not wanting to start on my fresh new VM?

From ec7f490a687ab01f520835341c09cef9f697f05d Mon Sep 17 00:00:00 2001
From: Atsushi SAKAI <sakaia@jp.fujitsu.com>
Date: Fri, 6 Nov 2015 13:35:24 +0900
Subject: [PATCH 0043/2409] Remove 'enable_service tempest' from
 sample/local.conf

tempest is already defined in stackrc as default.
Without this definition in local.conf,
tempest is installed successfully.

If it still needs "enable_service tempest" definition
on local.conf,
devstack itself has some problem.
In my environment, tempest installation works
without this definition on local.conf.

Change-Id: I25cda0142538d21bb9656b471e65ca5b018e8378
---
 samples/local.conf | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/samples/local.conf b/samples/local.conf
index cb293b6c15..b92097dd8d 100644
--- a/samples/local.conf
+++ b/samples/local.conf
@@ -93,9 +93,3 @@ SWIFT_REPLICAS=1
 # moved by setting ``SWIFT_DATA_DIR``. The directory will be created
 # if it does not exist.
 SWIFT_DATA_DIR=$DEST/data
-
-# Tempest
-# -------
-
-# Install the tempest test suite
-enable_service tempest

From e9ef0fefa52a2d30079eba1dead1a4df61a6ad7d Mon Sep 17 00:00:00 2001
From: Atsushi SAKAI <sakaia@jp.fujitsu.com>
Date: Fri, 6 Nov 2015 14:25:46 +0900
Subject: [PATCH 0044/2409] Remove lib/neutron_plugins/ibm

SDN-VE on neutron is already removed.
This patch removes SDN-VE from devstack.

Ref.
  Removing the SDN-VE monolithic plugin
  https://review.openstack.org/#/c/217703/
  Remove IBM SDN-VE left-overs
  https://review.openstack.org/#/c/237716/

Change-Id: Ie1b531153d1632798235b1100cdf9b068edcce26
---
 lib/neutron_plugins/ibm | 133 ----------------------------------------
 1 file changed, 133 deletions(-)
 delete mode 100644 lib/neutron_plugins/ibm

diff --git a/lib/neutron_plugins/ibm b/lib/neutron_plugins/ibm
deleted file mode 100644
index dd5cfa6694..0000000000
--- a/lib/neutron_plugins/ibm
+++ /dev/null
@@ -1,133 +0,0 @@
-#!/bin/bash
-#
-# Neutron IBM SDN-VE plugin
-# ---------------------------
-
-# Save trace setting
-IBM_XTRACE=$(set +o | grep xtrace)
-set +o xtrace
-
-source $TOP_DIR/lib/neutron_plugins/ovs_base
-
-function neutron_plugin_install_agent_packages {
-    _neutron_ovs_base_install_agent_packages
-}
-
-function _neutron_interface_setup {
-    # Setup one interface on the integration bridge if needed
-    # The plugin agent to be used if more than one interface is used
-    local bridge=$1
-    local interface=$2
-    sudo ovs-vsctl --no-wait -- --may-exist add-port $bridge $interface
-}
-
-function neutron_setup_integration_bridge {
-    # Setup integration bridge if needed
-    if [[ "$SDNVE_INTEGRATION_BRIDGE" != "" ]]; then
-        neutron_ovs_base_cleanup
-        _neutron_ovs_base_setup_bridge $SDNVE_INTEGRATION_BRIDGE
-        if [[ "$SDNVE_INTERFACE_MAPPINGS" != "" ]]; then
-            interfaces=(${SDNVE_INTERFACE_MAPPINGS//[,:]/ })
-            _neutron_interface_setup $SDNVE_INTEGRATION_BRIDGE ${interfaces[1]}
-        fi
-    fi
-
-    # Set controller to SDNVE controller (1st of list) if exists
-    if [[ "$SDNVE_CONTROLLER_IPS" != "" ]]; then
-        # Get the first controller
-        controllers=(${SDNVE_CONTROLLER_IPS//[\[,\]]/ })
-        SDNVE_IP=${controllers[0]}
-        sudo ovs-vsctl set-controller $SDNVE_INTEGRATION_BRIDGE tcp:$SDNVE_IP
-    fi
-}
-
-function neutron_plugin_create_nova_conf {
-    # if n-cpu is enabled, then setup integration bridge
-    if is_service_enabled n-cpu; then
-        neutron_setup_integration_bridge
-    fi
-}
-
-function is_neutron_ovs_base_plugin {
-    if [[ "$SDNVE_INTEGRATION_BRIDGE" != "" ]]; then
-        # Yes, we use OVS.
-        return 0
-    else
-        # No, we do not use OVS.
-        return 1
-    fi
-}
-
-function neutron_plugin_configure_common {
-    Q_PLUGIN_CONF_PATH=etc/neutron/plugins/ibm
-    Q_PLUGIN_CONF_FILENAME=sdnve_neutron_plugin.ini
-    Q_PLUGIN_CLASS="neutron.plugins.ibm.sdnve_neutron_plugin.SdnvePluginV2"
-}
-
-function neutron_plugin_configure_service {
-    # Define extra "SDNVE" configuration options when q-svc is configured
-
-    iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver neutron.agent.firewall.NoopFirewallDriver
-
-    if [[ "$SDNVE_CONTROLLER_IPS" != "" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE sdnve controller_ips $SDNVE_CONTROLLER_IPS
-    fi
-
-    if [[ "$SDNVE_INTEGRATION_BRIDGE" != "" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE sdnve integration_bridge $SDNVE_INTEGRATION_BRIDGE
-    fi
-
-    if [[ "$SDNVE_RESET_BRIDGE" != "" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE sdnve reset_bridge $SDNVE_RESET_BRIDGE
-    fi
-
-    if [[ "$SDNVE_OUT_OF_BAND" != "" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE sdnve out_of_band $SDNVE_OUT_OF_BAND
-    fi
-
-    if [[ "$SDNVE_INTERFACE_MAPPINGS" != "" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE sdnve interface_mappings $SDNVE_INTERFACE_MAPPINGS
-    fi
-
-    if [[ "$SDNVE_FAKE_CONTROLLER" != "" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE sdnve use_fake_controller $SDNVE_FAKE_CONTROLLER
-    fi
-
-
-    iniset $NEUTRON_CONF DEFAULT notification_driver neutron.openstack.common.notifier.no_op_notifier
-
-}
-
-function neutron_plugin_configure_plugin_agent {
-    AGENT_BINARY="$NEUTRON_BIN_DIR/neutron-ibm-agent"
-}
-
-function neutron_plugin_configure_debug_command {
-    :
-}
-
-function neutron_plugin_setup_interface_driver {
-    return 0
-}
-
-function has_neutron_plugin_security_group {
-    # Does not support Security Groups
-    return 1
-}
-
-function neutron_ovs_base_cleanup {
-    if [[ "$SDNVE_RESET_BRIDGE" != False ]]; then
-        # remove all OVS ports that look like Neutron created ports
-        for port in $(sudo ovs-vsctl list port | grep -o -e tap[0-9a-f\-]* -e q[rg]-[0-9a-f\-]*); do
-            sudo ovs-vsctl del-port ${port}
-        done
-
-        # remove integration bridge created by Neutron
-        for bridge in $(sudo ovs-vsctl list-br | grep -o -e ${SDNVE_INTEGRATION_BRIDGE}); do
-            sudo ovs-vsctl del-br ${bridge}
-        done
-    fi
-}
-
-# Restore xtrace
-$IBM_XTRACE

From 5f8133caac097235ed4fe73d878df0ee907eb51c Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Fri, 6 Nov 2015 11:48:19 -0500
Subject: [PATCH 0045/2409] remove gratuitous python packages

With pip + upper-constraints we're nearly always over installing all
python packages because we no longer support a range, we support
*exactly* one version.

This removes a bunch of the gratuitous package installs which we're
going to install over, lxml, numpy, libvirt. All of these we had
coming from packages in the past for speed concerns, but upper
constraints removes that.

It also ensures that all the headers to build all those are in
general, so they are guarunteed available at all times.

Change-Id: Ia76de730d65c84d81c4fb2c980ae1b4d595f9f5b
---
 files/debs/general  | 4 +++-
 files/debs/keystone | 1 -
 files/debs/n-novnc  | 1 -
 files/debs/nova     | 7 ++-----
 4 files changed, 5 insertions(+), 8 deletions(-)
 delete mode 100644 files/debs/n-novnc

diff --git a/files/debs/general b/files/debs/general
index 146052643c..80e81f5841 100644
--- a/files/debs/general
+++ b/files/debs/general
@@ -20,8 +20,10 @@ python2.7
 python-gdbm # needed for testr
 bc
 libyaml-dev
-libffi-dev
+libffi-dev # for pyOpenSSL
 libssl-dev # for pyOpenSSL
+libxml2-dev  # lxml
+libxslt1-dev  # lxml
 gettext  # used for compiling message catalogs
 openjdk-7-jre-headless  # NOPRIME
 pkg-config
diff --git a/files/debs/keystone b/files/debs/keystone
index 70a56499e9..f5816b59de 100644
--- a/files/debs/keystone
+++ b/files/debs/keystone
@@ -1,4 +1,3 @@
-python-lxml
 sqlite3
 python-mysqldb
 python-mysql.connector
diff --git a/files/debs/n-novnc b/files/debs/n-novnc
deleted file mode 100644
index c8722b9f66..0000000000
--- a/files/debs/n-novnc
+++ /dev/null
@@ -1 +0,0 @@
-python-numpy
diff --git a/files/debs/nova b/files/debs/nova
index 346b8b337a..d1678a7a6f 100644
--- a/files/debs/nova
+++ b/files/debs/nova
@@ -8,7 +8,8 @@ libmysqlclient-dev
 mysql-server # NOPRIME
 python-mysqldb
 python-mysql.connector
-python-lxml # needed for glance which is needed for nova --- this shouldn't be here
+libxml2-dev # needed for building lxml
+libxslt1-dev
 gawk
 iptables
 ebtables
@@ -25,7 +26,3 @@ curl
 genisoimage # required for config_drive
 rabbitmq-server # NOPRIME
 socat # used by ajaxterm
-python-libvirt # NOPRIME
-python-libxml2
-python-numpy # used by websockify for spice console
-python-m2crypto

From 6cd616a9edf6561ebc802f3083eb24f2713d4e96 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Fri, 6 Nov 2015 10:26:14 -0800
Subject: [PATCH 0046/2409] Disable resize tests in Tempest if using cells with
 custom flavors

By default, devstack creates it's own test flavors for Tempest runs.

These are not in the cells API database since they are non-default
for nova so any resize tests in Tempest with cells and these custom
flavors fail.

Configure Tempest to not run resize tests if using cells and custom
flavors.

This allows us to also clean up a bunch of the resize skips found
in nova/devstack/tempest-dsvm-cells-rc.

Change-Id: I20f46024e45e32c60275703a193a56ae8cfe7eca
Closes-Bug: #1513925
---
 lib/tempest | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index 32630dbf59..691ad86a2d 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -377,6 +377,15 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG compute-feature-enabled shelve False
         # Cells doesn't support hot-plugging virtual interfaces.
         iniset $TEMPEST_CONFIG compute-feature-enabled interface_attach False
+
+        if  [[ -z "$DEFAULT_INSTANCE_TYPE" ]]; then
+            # Cells supports resize but does not currently work with devstack
+            # because of the custom flavors created for Tempest runs which are
+            # not in the cells database.
+            # TODO(mriedem): work on adding a nova-manage command to sync
+            # flavors into the cells database.
+            iniset $TEMPEST_CONFIG compute-feature-enabled resize False
+        fi
     fi
 
     # Network

From 63cac536efa3474af40ea24603fca5e1d0a74e13 Mon Sep 17 00:00:00 2001
From: Jim Rollenhagen <jim@jimrollenhagen.com>
Date: Fri, 6 Nov 2015 12:37:32 -0800
Subject: [PATCH 0047/2409] Ironic: Explicitly allow DHCP ports

This adds an iptables rule to allow ports 67 and 68. We see
occassionally dropped DHCP packets, which may be causing PXE failures in
ironic jobs.

I'm not 100% confident this fixes the issue, however I don't think it
can break anything and it rules out one theory.

Change-Id: I4630afb6f010a4c2cb146a79264c480c64c6e4b7
Related-Bug: #1393099
---
 lib/ironic | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/ironic b/lib/ironic
index d786870165..016e639d03 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -672,6 +672,8 @@ function configure_iptables {
     # enable tftp natting for allowing connections to HOST_IP's tftp server
     sudo modprobe nf_conntrack_tftp
     sudo modprobe nf_nat_tftp
+    # explicitly allow DHCP - packets are occassionally being dropped here
+    sudo iptables -I INPUT -p udp --dport 67:68 --sport 67:68 -j ACCEPT || true
     # nodes boot from TFTP and callback to the API server listening on $HOST_IP
     sudo iptables -I INPUT -d $HOST_IP -p udp --dport 69 -j ACCEPT || true
     sudo iptables -I INPUT -d $HOST_IP -p tcp --dport $IRONIC_SERVICE_PORT -j ACCEPT || true

From b8509f09d670460aa3e9e2b09cf60dbf8cdbb03b Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 9 Nov 2015 11:55:56 +1100
Subject: [PATCH 0048/2409] Really get the "general" packages

We are specifying the argument to get_packages incorrectly, so we are
not actually adding the packages in "general" to the list of packages.

In most cases, this is hidden as other more specific plugins/services
request their packages.  However, as
I2dafd32f211fcbc9fff53030d736d97a5f1bb2df shows, not always.  I think
this was uncovered by 5f8133caac097235ed4fe73d878df0ee907eb51c

Change-Id: Ie1b8d09369281059d21da61b2725a457f708ae9e
---
 tools/install_prereqs.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/install_prereqs.sh b/tools/install_prereqs.sh
index a07e58d3e6..38452cd90f 100755
--- a/tools/install_prereqs.sh
+++ b/tools/install_prereqs.sh
@@ -61,7 +61,7 @@ export_proxy_variables
 # ================
 
 # Install package requirements
-PACKAGES=$(get_packages general $ENABLED_SERVICES)
+PACKAGES=$(get_packages general,$ENABLED_SERVICES)
 PACKAGES="$PACKAGES $(get_plugin_packages)"
 
 if is_ubuntu && echo $PACKAGES | grep -q dkms ; then

From a7e0b39a64f53f77f970c90d17f621be74f95215 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 9 Nov 2015 12:02:51 +1100
Subject: [PATCH 0049/2409] Move devlib packages into "general"

The removal of the wheel caching code
(Ia140dc34638d893b92f66d1ba20efd9522c5923b) removed the install of the
"devlib" packages, which was being done with a call in
tools/build_wheels.sh

The idea of "devlibs" and "general" seems to be pretty much the same
thing -- global build requirements.  I have removed the unused devlibs
files, and moved any missing packages into the "general" package
install file.

Change-Id: I8f34a164d6785a122394b42387d4221a7b447ae1
---
 files/debs/devlibs      | 7 -------
 files/debs/general      | 2 ++
 files/rpms-suse/devlibs | 6 ------
 files/rpms-suse/general | 5 +++++
 files/rpms/devlibs      | 8 --------
 files/rpms/general      | 7 +++++--
 6 files changed, 12 insertions(+), 23 deletions(-)
 delete mode 100644 files/debs/devlibs
 delete mode 100644 files/rpms-suse/devlibs
 delete mode 100644 files/rpms/devlibs

diff --git a/files/debs/devlibs b/files/debs/devlibs
deleted file mode 100644
index 0446ceb6b6..0000000000
--- a/files/debs/devlibs
+++ /dev/null
@@ -1,7 +0,0 @@
-libffi-dev  # pyOpenSSL
-libmysqlclient-dev  # MySQL-python
-libpq-dev  # psycopg2
-libssl-dev  # pyOpenSSL
-libxml2-dev  # lxml
-libxslt1-dev  # lxml
-python-dev  # pyOpenSSL
diff --git a/files/debs/general b/files/debs/general
index 80e81f5841..7bc90a6864 100644
--- a/files/debs/general
+++ b/files/debs/general
@@ -27,3 +27,5 @@ libxslt1-dev  # lxml
 gettext  # used for compiling message catalogs
 openjdk-7-jre-headless  # NOPRIME
 pkg-config
+libmysqlclient-dev  # MySQL-python
+libpq-dev  # psycopg2
diff --git a/files/rpms-suse/devlibs b/files/rpms-suse/devlibs
deleted file mode 100644
index 54d13a33e9..0000000000
--- a/files/rpms-suse/devlibs
+++ /dev/null
@@ -1,6 +0,0 @@
-libffi-devel  # pyOpenSSL
-libopenssl-devel  # pyOpenSSL
-libxslt-devel  # lxml
-postgresql-devel  # psycopg2
-libmysqlclient-devel # MySQL-python
-python-devel  # pyOpenSSL
diff --git a/files/rpms-suse/general b/files/rpms-suse/general
index 42756d8fcc..3a7c4b56fd 100644
--- a/files/rpms-suse/general
+++ b/files/rpms-suse/general
@@ -21,3 +21,8 @@ tcpdump
 unzip
 wget
 net-tools
+libffi-devel  # pyOpenSSL
+libxslt-devel  # lxml
+postgresql-devel  # psycopg2
+libmysqlclient-devel # MySQL-python
+python-devel  # pyOpenSSL
diff --git a/files/rpms/devlibs b/files/rpms/devlibs
deleted file mode 100644
index 385ed3b84c..0000000000
--- a/files/rpms/devlibs
+++ /dev/null
@@ -1,8 +0,0 @@
-libffi-devel  # pyOpenSSL
-libxml2-devel  # lxml
-libxslt-devel  # lxml
-mariadb-devel  # MySQL-python
-openssl-devel  # pyOpenSSL
-postgresql-devel  # psycopg2
-python-devel  # pyOpenSSL
-redhat-rpm-config # MySQL-python rhbz-1195207 f21
diff --git a/files/rpms/general b/files/rpms/general
index c3f3de893a..2a45227e0f 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -10,8 +10,8 @@ openssh-server
 openssl
 openssl-devel # to rebuild pyOpenSSL if needed
 libffi-devel
-libxml2-devel
-libxslt-devel
+libxml2-devel # lxml
+libxslt-devel # lxml
 pkgconfig
 psmisc
 python-devel
@@ -29,3 +29,6 @@ java-1.7.0-openjdk-headless  # NOPRIME rhel7
 java-1.8.0-openjdk-headless  # NOPRIME f21,f22
 pyOpenSSL # version in pip uses too much memory
 iptables-services  # NOPRIME f21,f22
+mariadb-devel  # MySQL-python
+postgresql-devel  # psycopg2
+redhat-rpm-config # MySQL-python rhbz-1195207 f21

From a5e4c0f279b6101436820dbb6b3da3d06131c12d Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 9 Nov 2015 12:21:10 +1100
Subject: [PATCH 0050/2409] Clear out some duplicate package dependencies

I think these duplicate dependencies came in because we were not
correctly always installing "general" packages (see
Ie1b8d09369281059d21da61b2725a457f708ae9e)

Most of these are just extras for the lxml dependencies; I added zlib
devel to general for glance (seems pretty generic), and then that can
go too, as all other packages are specified.

Change-Id: I44b14ca15c64fad9daf1ac8d851704b02ea2eae0
---
 files/debs/ceilometer-collector | 3 ---
 files/debs/general              | 1 +
 files/debs/glance               | 6 ------
 files/debs/nova                 | 2 --
 files/debs/tempest              | 2 --
 files/debs/trove                | 1 -
 files/rpms/general              | 1 +
 files/rpms/glance               | 6 ------
 files/rpms/keystone             | 1 -
 files/rpms/tempest              | 1 -
 files/rpms/trove                | 1 -
 11 files changed, 2 insertions(+), 23 deletions(-)
 delete mode 100644 files/debs/glance
 delete mode 100644 files/debs/tempest
 delete mode 100644 files/debs/trove
 delete mode 100644 files/rpms/glance
 delete mode 100644 files/rpms/tempest
 delete mode 100644 files/rpms/trove

diff --git a/files/debs/ceilometer-collector b/files/debs/ceilometer-collector
index f1b692ac71..94c82e0843 100644
--- a/files/debs/ceilometer-collector
+++ b/files/debs/ceilometer-collector
@@ -1,6 +1,3 @@
 python-pymongo #NOPRIME
 mongodb-server #NOPRIME
 libnspr4-dev
-pkg-config
-libxml2-dev
-libxslt-dev
\ No newline at end of file
diff --git a/files/debs/general b/files/debs/general
index 7bc90a6864..58d1e8b3f5 100644
--- a/files/debs/general
+++ b/files/debs/general
@@ -29,3 +29,4 @@ openjdk-7-jre-headless  # NOPRIME
 pkg-config
 libmysqlclient-dev  # MySQL-python
 libpq-dev  # psycopg2
+zlib1g-dev
diff --git a/files/debs/glance b/files/debs/glance
deleted file mode 100644
index 37877a85c2..0000000000
--- a/files/debs/glance
+++ /dev/null
@@ -1,6 +0,0 @@
-libmysqlclient-dev
-libpq-dev
-libssl-dev
-libxml2-dev
-libxslt1-dev
-zlib1g-dev
diff --git a/files/debs/nova b/files/debs/nova
index d1678a7a6f..fa394e734b 100644
--- a/files/debs/nova
+++ b/files/debs/nova
@@ -8,8 +8,6 @@ libmysqlclient-dev
 mysql-server # NOPRIME
 python-mysqldb
 python-mysql.connector
-libxml2-dev # needed for building lxml
-libxslt1-dev
 gawk
 iptables
 ebtables
diff --git a/files/debs/tempest b/files/debs/tempest
deleted file mode 100644
index bb095297e0..0000000000
--- a/files/debs/tempest
+++ /dev/null
@@ -1,2 +0,0 @@
-libxml2-dev
-libxslt1-dev
diff --git a/files/debs/trove b/files/debs/trove
deleted file mode 100644
index 96f8f29277..0000000000
--- a/files/debs/trove
+++ /dev/null
@@ -1 +0,0 @@
-libxslt1-dev
diff --git a/files/rpms/general b/files/rpms/general
index 2a45227e0f..eb479d2050 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -32,3 +32,4 @@ iptables-services  # NOPRIME f21,f22
 mariadb-devel  # MySQL-python
 postgresql-devel  # psycopg2
 redhat-rpm-config # MySQL-python rhbz-1195207 f21
+zlib-devel
diff --git a/files/rpms/glance b/files/rpms/glance
deleted file mode 100644
index 479194f918..0000000000
--- a/files/rpms/glance
+++ /dev/null
@@ -1,6 +0,0 @@
-libxml2-devel
-libxslt-devel
-mysql-devel
-openssl-devel
-postgresql-devel
-zlib-devel
diff --git a/files/rpms/keystone b/files/rpms/keystone
index 8074119fdb..7384150a4a 100644
--- a/files/rpms/keystone
+++ b/files/rpms/keystone
@@ -1,4 +1,3 @@
 MySQL-python
-libxslt-devel
 sqlite
 mod_ssl
diff --git a/files/rpms/tempest b/files/rpms/tempest
deleted file mode 100644
index e7bbd43cd6..0000000000
--- a/files/rpms/tempest
+++ /dev/null
@@ -1 +0,0 @@
-libxslt-devel
diff --git a/files/rpms/trove b/files/rpms/trove
deleted file mode 100644
index e7bbd43cd6..0000000000
--- a/files/rpms/trove
+++ /dev/null
@@ -1 +0,0 @@
-libxslt-devel

From c00df207eed1d4dec808824d8e9dcd238e7d4e08 Mon Sep 17 00:00:00 2001
From: Sirushti Murugesan <sirushti.murugesan@hp.com>
Date: Wed, 7 Oct 2015 15:06:51 +0530
Subject: [PATCH 0051/2409] Add a more accurate expression for obtaining
 (IPV6_)ROUTER_GW_IP

neutron port-list returns a dictionary that's of random order in python 3.
This expression sometimes returns a NULL value thus failing devstack.
Add an expression that always returns a consistent ROUTER_GW_IP.

Change-Id: Id23d9afda275051ca68bcba2dfd1b6e30f02c628
---
 lib/neutron-legacy | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index c244e5470a..a74da2ccb7 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -1318,7 +1318,7 @@ function _neutron_configure_router_v4 {
                 sudo ip addr add $ext_gw_ip/$cidr_len dev $ext_gw_interface
                 sudo ip link set $ext_gw_interface up
             fi
-            ROUTER_GW_IP=`neutron port-list -c fixed_ips -c device_owner | grep router_gateway | awk -F '"' -v subnet_id=$PUB_SUBNET_ID '$4 == subnet_id { print $8; }'`
+            ROUTER_GW_IP=`neutron port-list -c fixed_ips -c device_owner | grep router_gateway | awk -F'ip_address'  '{ print $2 }' | cut -f3 -d\" | tr '\n' ' '`
             die_if_not_set $LINENO ROUTER_GW_IP "Failure retrieving ROUTER_GW_IP"
             sudo ip route replace  $FIXED_RANGE via $ROUTER_GW_IP
         fi
@@ -1349,7 +1349,7 @@ function _neutron_configure_router_v6 {
         sudo sysctl -w net.ipv6.conf.all.forwarding=1
         # Configure and enable public bridge
         # Override global IPV6_ROUTER_GW_IP with the true value from neutron
-        IPV6_ROUTER_GW_IP=`neutron port-list -c fixed_ips | grep $ipv6_pub_subnet_id | awk -F '"' -v subnet_id=$ipv6_pub_subnet_id '$4 == subnet_id { print $8; }'`
+        IPV6_ROUTER_GW_IP=`neutron port-list -c fixed_ips | grep $ipv6_pub_subnet_id | awk -F'ip_address' '{ print $2 }' | cut -f3 -d\" | tr '\n' ' '`
         die_if_not_set $LINENO IPV6_ROUTER_GW_IP "Failure retrieving IPV6_ROUTER_GW_IP"
 
         if is_neutron_ovs_base_plugin; then

From 7d515b5db8e98a54ff9c8c5211383f9f2c33b2db Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 9 Nov 2015 15:04:32 +1100
Subject: [PATCH 0052/2409] Add check for get_packages argument

Add a quick check so we don't reintroduce bad arguments as in
Ie1b8d09369281059d21da61b2725a457f708ae9e

Change-Id: Ibebc71791f2743eef64d6f7c2596d54a73ea92aa
---
 functions-common | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/functions-common b/functions-common
index 497bed26e6..e252139e78 100644
--- a/functions-common
+++ b/functions-common
@@ -1075,6 +1075,10 @@ function get_packages {
     local file_to_parse=""
     local service=""
 
+    if [ $# -ne 1 ]; then
+        die $LINENO "get_packages takes a single, comma-separated argument"
+    fi
+
     if [[ -z "$package_dir" ]]; then
         echo "No package directory supplied"
         return 1

From c416d8b94f473908a82f4e842c768927b62fc20a Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 9 Nov 2015 15:20:22 +1100
Subject: [PATCH 0053/2409] Sort rpm/deb files alphabetically

This is rather trivial, but it makes comparing the files much easier

Change-Id: I01e42defbf778626afd8dd457f93f0b02dd1a19d
---
 files/debs/ceilometer-collector      |  4 +--
 files/debs/cinder                    |  6 ++---
 files/debs/general                   | 40 ++++++++++++++--------------
 files/debs/ironic                    |  2 +-
 files/debs/keystone                  |  8 +++---
 files/debs/ldap                      |  2 +-
 files/debs/n-cpu                     | 10 +++----
 files/debs/neutron                   | 14 +++++-----
 files/debs/nova                      | 34 +++++++++++------------
 files/debs/zookeeper                 |  2 +-
 files/rpms-suse/ceilometer-collector |  2 +-
 files/rpms-suse/ceph                 |  2 +-
 files/rpms-suse/cinder               |  8 +++---
 files/rpms-suse/general              | 12 ++++-----
 files/rpms-suse/horizon              |  2 +-
 files/rpms-suse/n-api                |  2 +-
 files/rpms-suse/n-cpu                |  6 ++---
 files/rpms-suse/neutron              |  2 +-
 files/rpms-suse/nova                 |  6 ++---
 files/rpms-suse/openvswitch          |  2 +-
 files/rpms/ceilometer-collector      |  4 +--
 files/rpms/ceph                      |  2 +-
 files/rpms/cinder                    |  6 ++---
 files/rpms/dstat                     |  2 +-
 files/rpms/general                   | 28 +++++++++----------
 files/rpms/horizon                   |  2 +-
 files/rpms/keystone                  |  2 +-
 files/rpms/ldap                      |  2 +-
 files/rpms/n-cpu                     |  8 +++---
 files/rpms/neutron                   |  4 +--
 files/rpms/nova                      |  8 +++---
 files/rpms/swift                     |  2 +-
 files/rpms/zookeeper                 |  2 +-
 33 files changed, 119 insertions(+), 119 deletions(-)

diff --git a/files/debs/ceilometer-collector b/files/debs/ceilometer-collector
index 94c82e0843..d1e9eef3bb 100644
--- a/files/debs/ceilometer-collector
+++ b/files/debs/ceilometer-collector
@@ -1,3 +1,3 @@
-python-pymongo #NOPRIME
-mongodb-server #NOPRIME
 libnspr4-dev
+mongodb-server #NOPRIME
+python-pymongo #NOPRIME
diff --git a/files/debs/cinder b/files/debs/cinder
index 51908eb27b..48b8d0f7d3 100644
--- a/files/debs/cinder
+++ b/files/debs/cinder
@@ -1,6 +1,6 @@
-tgt # NOPRIME
-lvm2
-qemu-utils
 libpq-dev
+lvm2
 open-iscsi
 open-iscsi-utils # Deprecated since quantal dist:precise
+qemu-utils
+tgt # NOPRIME
diff --git a/files/debs/general b/files/debs/general
index 58d1e8b3f5..9b2715685e 100644
--- a/files/debs/general
+++ b/files/debs/general
@@ -1,32 +1,32 @@
+bc
 bridge-utils
-screen
-unzip
-wget
-psmisc
-gcc
+curl
 g++
+gcc
+gettext  # used for compiling message catalogs
 git
 graphviz # needed for docs
-lsof # useful when debugging
-openssh-server
-openssl
 iputils-ping
-wget
-curl
-tcpdump
-tar
-python-dev
-python2.7
-python-gdbm # needed for testr
-bc
-libyaml-dev
 libffi-dev # for pyOpenSSL
+libmysqlclient-dev  # MySQL-python
+libpq-dev  # psycopg2
 libssl-dev # for pyOpenSSL
 libxml2-dev  # lxml
 libxslt1-dev  # lxml
-gettext  # used for compiling message catalogs
+libyaml-dev
+lsof # useful when debugging
 openjdk-7-jre-headless  # NOPRIME
+openssh-server
+openssl
 pkg-config
-libmysqlclient-dev  # MySQL-python
-libpq-dev  # psycopg2
+psmisc
+python2.7
+python-dev
+python-gdbm # needed for testr
+screen
+tar
+tcpdump
+unzip
+wget
+wget
 zlib1g-dev
diff --git a/files/debs/ironic b/files/debs/ironic
index 0a906dbffc..4d5a6aa6b7 100644
--- a/files/debs/ironic
+++ b/files/debs/ironic
@@ -6,8 +6,8 @@ libguestfs0
 libvirt-bin
 open-iscsi
 openssh-client
-openvswitch-switch
 openvswitch-datapath-dkms
+openvswitch-switch
 python-libguestfs
 python-libvirt
 qemu
diff --git a/files/debs/keystone b/files/debs/keystone
index f5816b59de..0795167047 100644
--- a/files/debs/keystone
+++ b/files/debs/keystone
@@ -1,6 +1,6 @@
-sqlite3
-python-mysqldb
-python-mysql.connector
+libkrb5-dev
 libldap2-dev
 libsasl2-dev
-libkrb5-dev
+python-mysql.connector
+python-mysqldb
+sqlite3
diff --git a/files/debs/ldap b/files/debs/ldap
index 26f7aeffe3..aa3a934d95 100644
--- a/files/debs/ldap
+++ b/files/debs/ldap
@@ -1,3 +1,3 @@
 ldap-utils
-slapd
 python-ldap
+slapd
diff --git a/files/debs/n-cpu b/files/debs/n-cpu
index ffc947a36d..0da57ee047 100644
--- a/files/debs/n-cpu
+++ b/files/debs/n-cpu
@@ -1,8 +1,8 @@
-qemu-utils
+cryptsetup
+genisoimage
 lvm2 # NOPRIME
 open-iscsi
-genisoimage
-sysfsutils
-sg3-utils
 python-guestfs # NOPRIME
-cryptsetup
+qemu-utils
+sg3-utils
+sysfsutils
diff --git a/files/debs/neutron b/files/debs/neutron
index b5a457e482..85145d3654 100644
--- a/files/debs/neutron
+++ b/files/debs/neutron
@@ -1,18 +1,18 @@
 acl
+dnsmasq-base
+dnsmasq-utils # for dhcp_release only available in dist:precise
 ebtables
 iptables
-iputils-ping
 iputils-arping
+iputils-ping
 libmysqlclient-dev
 mysql-server #NOPRIME
-sudo
 postgresql-server-dev-all
-python-mysqldb
 python-mysql.connector
-dnsmasq-base
-dnsmasq-utils # for dhcp_release only available in dist:precise
+python-mysqldb
 rabbitmq-server # NOPRIME
-sqlite3
-vlan
 radvd # NOPRIME
+sqlite3
+sudo
 uuid-runtime
+vlan
diff --git a/files/debs/nova b/files/debs/nova
index fa394e734b..fe57fc4b2a 100644
--- a/files/debs/nova
+++ b/files/debs/nova
@@ -1,26 +1,26 @@
+conntrack
+curl
 dnsmasq-base
 dnsmasq-utils # for dhcp_release
-conntrack
-kpartx
-parted
-iputils-arping
-libmysqlclient-dev
-mysql-server # NOPRIME
-python-mysqldb
-python-mysql.connector
+ebtables
 gawk
+genisoimage # required for config_drive
 iptables
-ebtables
-sqlite3
-sudo
-qemu-kvm # NOPRIME
-qemu # dist:wheezy,jessie NOPRIME
+iputils-arping
+kpartx
+libjs-jquery-tablesorter # Needed for coverage html reports
+libmysqlclient-dev
 libvirt-bin # NOPRIME
 libvirt-dev # NOPRIME
+mysql-server # NOPRIME
+parted
 pm-utils
-libjs-jquery-tablesorter # Needed for coverage html reports
-vlan
-curl
-genisoimage # required for config_drive
+python-mysql.connector
+python-mysqldb
+qemu # dist:wheezy,jessie NOPRIME
+qemu-kvm # NOPRIME
 rabbitmq-server # NOPRIME
 socat # used by ajaxterm
+sqlite3
+sudo
+vlan
diff --git a/files/debs/zookeeper b/files/debs/zookeeper
index 66227f7e31..f41b559007 100644
--- a/files/debs/zookeeper
+++ b/files/debs/zookeeper
@@ -1 +1 @@
-zookeeperd
\ No newline at end of file
+zookeeperd
diff --git a/files/rpms-suse/ceilometer-collector b/files/rpms-suse/ceilometer-collector
index 5e4dfcc35e..fc75ffad63 100644
--- a/files/rpms-suse/ceilometer-collector
+++ b/files/rpms-suse/ceilometer-collector
@@ -1,3 +1,3 @@
-# Not available in openSUSE main repositories, but can be fetched from OBS
 # (devel:languages:python and server:database projects)
 mongodb
+# Not available in openSUSE main repositories, but can be fetched from OBS
diff --git a/files/rpms-suse/ceph b/files/rpms-suse/ceph
index 8d465000e1..8c4955df90 100644
--- a/files/rpms-suse/ceph
+++ b/files/rpms-suse/ceph
@@ -1,3 +1,3 @@
 ceph    # NOPRIME
-xfsprogs
 lsb
+xfsprogs
diff --git a/files/rpms-suse/cinder b/files/rpms-suse/cinder
index 3fd03cc9be..56b1bb536a 100644
--- a/files/rpms-suse/cinder
+++ b/files/rpms-suse/cinder
@@ -1,6 +1,6 @@
 lvm2
-tgt # NOPRIME
-qemu-tools
-python-devel
-postgresql-devel
 open-iscsi
+postgresql-devel
+python-devel
+qemu-tools
+tgt # NOPRIME
diff --git a/files/rpms-suse/general b/files/rpms-suse/general
index 3a7c4b56fd..651243d274 100644
--- a/files/rpms-suse/general
+++ b/files/rpms-suse/general
@@ -8,21 +8,21 @@ gcc-c++
 git-core
 graphviz # docs
 iputils
+libffi-devel  # pyOpenSSL
+libmysqlclient-devel # MySQL-python
 libopenssl-devel # to rebuild pyOpenSSL if needed
+libxslt-devel  # lxml
 lsof # useful when debugging
 make
+net-tools
 openssh
 openssl
+postgresql-devel  # psycopg2
 psmisc
 python-cmd2 # dist:opensuse-12.3
+python-devel  # pyOpenSSL
 screen
 tar
 tcpdump
 unzip
 wget
-net-tools
-libffi-devel  # pyOpenSSL
-libxslt-devel  # lxml
-postgresql-devel  # psycopg2
-libmysqlclient-devel # MySQL-python
-python-devel  # pyOpenSSL
diff --git a/files/rpms-suse/horizon b/files/rpms-suse/horizon
index 77f7c34b31..753ea76e04 100644
--- a/files/rpms-suse/horizon
+++ b/files/rpms-suse/horizon
@@ -1,2 +1,2 @@
-apache2  # NOPRIME
 apache2-mod_wsgi  # NOPRIME
+apache2  # NOPRIME
diff --git a/files/rpms-suse/n-api b/files/rpms-suse/n-api
index 6f59e603b2..af5ac2fc54 100644
--- a/files/rpms-suse/n-api
+++ b/files/rpms-suse/n-api
@@ -1,2 +1,2 @@
-python-dateutil
 fping
+python-dateutil
diff --git a/files/rpms-suse/n-cpu b/files/rpms-suse/n-cpu
index b3a468d2d8..29bd31b365 100644
--- a/files/rpms-suse/n-cpu
+++ b/files/rpms-suse/n-cpu
@@ -1,7 +1,7 @@
-# Stuff for diablo volumes
+cryptsetup
 genisoimage
 lvm2
 open-iscsi
-sysfsutils
 sg3_utils
-cryptsetup
+# Stuff for diablo volumes
+sysfsutils
diff --git a/files/rpms-suse/neutron b/files/rpms-suse/neutron
index 133979911e..4b0eefaaa5 100644
--- a/files/rpms-suse/neutron
+++ b/files/rpms-suse/neutron
@@ -7,7 +7,7 @@ iputils
 mariadb # NOPRIME
 postgresql-devel
 rabbitmq-server # NOPRIME
+radvd # NOPRIME
 sqlite3
 sudo
 vlan
-radvd # NOPRIME
diff --git a/files/rpms-suse/nova b/files/rpms-suse/nova
index 039456fc1b..2f3ad21a63 100644
--- a/files/rpms-suse/nova
+++ b/files/rpms-suse/nova
@@ -1,7 +1,7 @@
+conntrack-tools
 curl
 dnsmasq
 dnsmasq-utils # dist:opensuse-12.3,opensuse-13.1
-conntrack-tools
 ebtables
 gawk
 genisoimage # required for config_drive
@@ -9,14 +9,14 @@ iptables
 iputils
 kpartx
 kvm # NOPRIME
-# qemu as fallback if kvm cannot be used
-qemu # NOPRIME
 libvirt # NOPRIME
 libvirt-python # NOPRIME
 mariadb # NOPRIME
 parted
 polkit
 python-devel
+# qemu as fallback if kvm cannot be used
+qemu # NOPRIME
 rabbitmq-server # NOPRIME
 socat
 sqlite3
diff --git a/files/rpms-suse/openvswitch b/files/rpms-suse/openvswitch
index edfb4d21aa..53f8bb22cf 100644
--- a/files/rpms-suse/openvswitch
+++ b/files/rpms-suse/openvswitch
@@ -1,3 +1,3 @@
+
 openvswitch
 openvswitch-switch
-
diff --git a/files/rpms/ceilometer-collector b/files/rpms/ceilometer-collector
index b139ed2b6b..a8b81187ed 100644
--- a/files/rpms/ceilometer-collector
+++ b/files/rpms/ceilometer-collector
@@ -1,3 +1,3 @@
-selinux-policy-targeted
-mongodb-server #NOPRIME
 mongodb # NOPRIME
+mongodb-server #NOPRIME
+selinux-policy-targeted
diff --git a/files/rpms/ceph b/files/rpms/ceph
index 5483735741..64befc5f00 100644
--- a/files/rpms/ceph
+++ b/files/rpms/ceph
@@ -1,3 +1,3 @@
 ceph    # NOPRIME
-xfsprogs
 redhat-lsb-core
+xfsprogs
diff --git a/files/rpms/cinder b/files/rpms/cinder
index a88503b8bc..f28f04d8ba 100644
--- a/files/rpms/cinder
+++ b/files/rpms/cinder
@@ -1,5 +1,5 @@
+iscsi-initiator-utils
 lvm2
-scsi-target-utils # NOPRIME
-qemu-img
 postgresql-devel
-iscsi-initiator-utils
+qemu-img
+scsi-target-utils # NOPRIME
diff --git a/files/rpms/dstat b/files/rpms/dstat
index 8a8f8fe737..2b643b8b1b 100644
--- a/files/rpms/dstat
+++ b/files/rpms/dstat
@@ -1 +1 @@
-dstat
\ No newline at end of file
+dstat
diff --git a/files/rpms/general b/files/rpms/general
index eb479d2050..cfd9479600 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -1,35 +1,35 @@
+bc
 bridge-utils
 curl
 dbus
 euca2ools # only for testing client
 gcc
 gcc-c++
+gettext  # used for compiling message catalogs
 git-core
 graphviz # needed only for docs
-openssh-server
-openssl
-openssl-devel # to rebuild pyOpenSSL if needed
+iptables-services  # NOPRIME f21,f22
+java-1.7.0-openjdk-headless  # NOPRIME rhel7
+java-1.8.0-openjdk-headless  # NOPRIME f21,f22
 libffi-devel
 libxml2-devel # lxml
 libxslt-devel # lxml
+libyaml-devel
+mariadb-devel  # MySQL-python
+net-tools
+openssh-server
+openssl
+openssl-devel # to rebuild pyOpenSSL if needed
 pkgconfig
+postgresql-devel  # psycopg2
 psmisc
+pyOpenSSL # version in pip uses too much memory
 python-devel
+redhat-rpm-config # MySQL-python rhbz-1195207 f21
 screen
 tar
 tcpdump
 unzip
 wget
 which
-bc
-libyaml-devel
-gettext  # used for compiling message catalogs
-net-tools
-java-1.7.0-openjdk-headless  # NOPRIME rhel7
-java-1.8.0-openjdk-headless  # NOPRIME f21,f22
-pyOpenSSL # version in pip uses too much memory
-iptables-services  # NOPRIME f21,f22
-mariadb-devel  # MySQL-python
-postgresql-devel  # psycopg2
-redhat-rpm-config # MySQL-python rhbz-1195207 f21
 zlib-devel
diff --git a/files/rpms/horizon b/files/rpms/horizon
index b2cf0ded6f..aeb2cb5c96 100644
--- a/files/rpms/horizon
+++ b/files/rpms/horizon
@@ -1,5 +1,5 @@
 Django
 httpd # NOPRIME
 mod_wsgi  # NOPRIME
-pyxattr
 pcre-devel  # pyScss
+pyxattr
diff --git a/files/rpms/keystone b/files/rpms/keystone
index 7384150a4a..c01c261e19 100644
--- a/files/rpms/keystone
+++ b/files/rpms/keystone
@@ -1,3 +1,3 @@
+mod_ssl
 MySQL-python
 sqlite
-mod_ssl
diff --git a/files/rpms/ldap b/files/rpms/ldap
index d89c4cf8c1..d5b8fa4374 100644
--- a/files/rpms/ldap
+++ b/files/rpms/ldap
@@ -1,2 +1,2 @@
-openldap-servers
 openldap-clients
+openldap-servers
diff --git a/files/rpms/n-cpu b/files/rpms/n-cpu
index 81278b30bb..7773b0402d 100644
--- a/files/rpms/n-cpu
+++ b/files/rpms/n-cpu
@@ -1,7 +1,7 @@
-# Stuff for diablo volumes
+cryptsetup
+genisoimage
 iscsi-initiator-utils
 lvm2
-genisoimage
-sysfsutils
 sg3_utils
-cryptsetup
+# Stuff for diablo volumes
+sysfsutils
diff --git a/files/rpms/neutron b/files/rpms/neutron
index 29851bea9b..b3f79ed146 100644
--- a/files/rpms/neutron
+++ b/files/rpms/neutron
@@ -1,4 +1,3 @@
-MySQL-python
 acl
 dnsmasq # for q-dhcp
 dnsmasq-utils # for dhcp_release
@@ -7,10 +6,11 @@ iptables
 iputils
 mysql-connector-python
 mysql-devel
+MySQL-python
 mysql-server # NOPRIME
 openvswitch # NOPRIME
 postgresql-devel
 rabbitmq-server # NOPRIME
+radvd # NOPRIME
 sqlite
 sudo
-radvd # NOPRIME
diff --git a/files/rpms/nova b/files/rpms/nova
index 6eeb6230a9..e70f138a3c 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -1,8 +1,7 @@
-MySQL-python
+conntrack-tools
 curl
 dnsmasq # for nova-network
 dnsmasq-utils # for dhcp_release
-conntrack-tools
 ebtables
 gawk
 genisoimage # required for config_drive
@@ -10,18 +9,19 @@ iptables
 iputils
 kpartx
 kvm # NOPRIME
-qemu-kvm # NOPRIME
 libvirt-bin # NOPRIME
 libvirt-devel # NOPRIME
 libvirt-python # NOPRIME
 libxml2-python
-numpy # needed by websockify for spice console
 m2crypto
 mysql-connector-python
 mysql-devel
+MySQL-python
 mysql-server # NOPRIME
+numpy # needed by websockify for spice console
 parted
 polkit
+qemu-kvm # NOPRIME
 rabbitmq-server # NOPRIME
 sqlite
 sudo
diff --git a/files/rpms/swift b/files/rpms/swift
index 1bf57cc3a2..f56a81b0d1 100644
--- a/files/rpms/swift
+++ b/files/rpms/swift
@@ -1,7 +1,7 @@
 curl
 memcached
 pyxattr
+rsync-daemon # dist:f22,f23
 sqlite
 xfsprogs
 xinetd
-rsync-daemon # dist:f22,f23
diff --git a/files/rpms/zookeeper b/files/rpms/zookeeper
index c0d1c3066d..1bfac538a2 100644
--- a/files/rpms/zookeeper
+++ b/files/rpms/zookeeper
@@ -1 +1 @@
-zookeeper
\ No newline at end of file
+zookeeper

From 3dac869f80e90795efc2127b713cc5282f4eabb5 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 9 Nov 2015 17:26:24 +1100
Subject: [PATCH 0054/2409] Cleanup some of the deb/rpm installs

python-devel and the mysql/postgresql client dev-libs should all be
installed globally via the "general" installs; no need to installs
them separately

Change-Id: I91a9ace2e62a891634dbb4635ab2ad8c8dc59f91
---
 files/debs/cinder        | 1 -
 files/rpms-suse/cinder   | 2 --
 files/rpms-suse/glance   | 1 -
 files/rpms-suse/keystone | 1 -
 files/rpms-suse/neutron  | 1 -
 files/rpms-suse/nova     | 1 -
 files/rpms-suse/swift    | 1 -
 files/rpms/cinder        | 1 -
 files/rpms/neutron       | 1 -
 9 files changed, 10 deletions(-)
 delete mode 100644 files/rpms-suse/glance

diff --git a/files/debs/cinder b/files/debs/cinder
index 48b8d0f7d3..3595e011da 100644
--- a/files/debs/cinder
+++ b/files/debs/cinder
@@ -1,4 +1,3 @@
-libpq-dev
 lvm2
 open-iscsi
 open-iscsi-utils # Deprecated since quantal dist:precise
diff --git a/files/rpms-suse/cinder b/files/rpms-suse/cinder
index 56b1bb536a..189a232fa7 100644
--- a/files/rpms-suse/cinder
+++ b/files/rpms-suse/cinder
@@ -1,6 +1,4 @@
 lvm2
 open-iscsi
-postgresql-devel
-python-devel
 qemu-tools
 tgt # NOPRIME
diff --git a/files/rpms-suse/glance b/files/rpms-suse/glance
deleted file mode 100644
index bf512de575..0000000000
--- a/files/rpms-suse/glance
+++ /dev/null
@@ -1 +0,0 @@
-python-devel
diff --git a/files/rpms-suse/keystone b/files/rpms-suse/keystone
index c838b413c3..46832c786d 100644
--- a/files/rpms-suse/keystone
+++ b/files/rpms-suse/keystone
@@ -1,4 +1,3 @@
 cyrus-sasl-devel
 openldap2-devel
-python-devel
 sqlite3
diff --git a/files/rpms-suse/neutron b/files/rpms-suse/neutron
index 4b0eefaaa5..e9abc6eca6 100644
--- a/files/rpms-suse/neutron
+++ b/files/rpms-suse/neutron
@@ -5,7 +5,6 @@ ebtables
 iptables
 iputils
 mariadb # NOPRIME
-postgresql-devel
 rabbitmq-server # NOPRIME
 radvd # NOPRIME
 sqlite3
diff --git a/files/rpms-suse/nova b/files/rpms-suse/nova
index 2f3ad21a63..ae115d2138 100644
--- a/files/rpms-suse/nova
+++ b/files/rpms-suse/nova
@@ -14,7 +14,6 @@ libvirt-python # NOPRIME
 mariadb # NOPRIME
 parted
 polkit
-python-devel
 # qemu as fallback if kvm cannot be used
 qemu # NOPRIME
 rabbitmq-server # NOPRIME
diff --git a/files/rpms-suse/swift b/files/rpms-suse/swift
index 6a824f944f..52e0a990e7 100644
--- a/files/rpms-suse/swift
+++ b/files/rpms-suse/swift
@@ -1,6 +1,5 @@
 curl
 memcached
-python-devel
 sqlite3
 xfsprogs
 xinetd
diff --git a/files/rpms/cinder b/files/rpms/cinder
index f28f04d8ba..0274642fd6 100644
--- a/files/rpms/cinder
+++ b/files/rpms/cinder
@@ -1,5 +1,4 @@
 iscsi-initiator-utils
 lvm2
-postgresql-devel
 qemu-img
 scsi-target-utils # NOPRIME
diff --git a/files/rpms/neutron b/files/rpms/neutron
index b3f79ed146..9683475d29 100644
--- a/files/rpms/neutron
+++ b/files/rpms/neutron
@@ -9,7 +9,6 @@ mysql-devel
 MySQL-python
 mysql-server # NOPRIME
 openvswitch # NOPRIME
-postgresql-devel
 rabbitmq-server # NOPRIME
 radvd # NOPRIME
 sqlite

From 7ddf6741d24485aa40de122f4bfdf4cd55e7cfad Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Mon, 9 Nov 2015 08:08:53 -0500
Subject: [PATCH 0055/2409] Neutron-legacy: Remove LINUXNET_VIF_DRIVER option

A value is never assigned, and it ends up in the nova.conf file as:

linuxnet_interface_driver =

So, let's delete it.

Change-Id: Ibc270ce6ee622eee871df1f8c11f21e8be8280ee
---
 lib/neutron-legacy | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 4e51425ffc..096869929b 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -488,7 +488,6 @@ function create_nova_conf_neutron {
     # optionally set options in nova_conf
     neutron_plugin_create_nova_conf
 
-    iniset $NOVA_CONF DEFAULT linuxnet_interface_driver "$LINUXNET_VIF_DRIVER"
     if is_service_enabled q-meta; then
         iniset $NOVA_CONF neutron service_metadata_proxy "True"
     fi

From 5c5e08669cb7539886cb3477fc7c4c7deb701f50 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 9 Nov 2015 14:08:15 -0500
Subject: [PATCH 0056/2409] loop all ebtables tables

ebtables has 3 built in tables, if we don't call them out we only get
'filter' (per man page).

Change-Id: I52360cbb3b910cb492b61e2314848cc29dcd8266
---
 tools/worlddump.py | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/tools/worlddump.py b/tools/worlddump.py
index 1b337a9a83..97e4d949c7 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -86,8 +86,10 @@ def disk_space():
 
 
 def ebtables_dump():
+    tables = ['filter', 'nat', 'broute']
     _header("EB Tables Dump")
-    _dump_cmd("sudo ebtables -L")
+    for table in tables:
+        _dump_cmd("sudo ebtables -t %s -L" % table)
 
 
 def iptables_dump():

From 8a3b7d424d8edf53d0560db48247e6bca11176ee Mon Sep 17 00:00:00 2001
From: John Davidge <jodavidg@cisco.com>
Date: Tue, 7 Jul 2015 11:10:54 +0100
Subject: [PATCH 0057/2409] Fix stack failure when default subnetpool is set

Currently stack.sh will fail if a value is set for
default_ipv4_subnet_pool and/or default_ipv6_subnet_pool in
neutron.conf. This is because setting either of these values
overrides the default behaviour of using the implicit (none)
subnetpool for subnet creation, and the subnetpools
specified in neutron.conf have not been created at the time
of the devstack calls to subnet-create.

This patch fixes the failure by specifying subnetpool = None
in calls to subnet-create, so that neutron will behave as
devstack expects. This parameter will no longer be required
once these configuration options are removed in the OpenStack
N release, but will be required for compatibility with Kilo,
Liberty, and Mitaka.

Change-Id: I29b2d62a022b43f6623b127af2ca303f9de847b0
Closes-Bug: #1472200
---
 exercises/neutron-adv-test.sh | 2 +-
 lib/neutron-legacy            | 8 ++++++--
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/exercises/neutron-adv-test.sh b/exercises/neutron-adv-test.sh
index a8fbd86473..9bcb7669b7 100755
--- a/exercises/neutron-adv-test.sh
+++ b/exercises/neutron-adv-test.sh
@@ -235,7 +235,7 @@ function create_network {
     local NET_ID
     NET_ID=$(neutron net-create --tenant-id $TENANT_ID $NET_NAME $EXTRA| grep ' id ' | awk '{print $4}' )
     die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $TENANT_ID $NET_NAME $EXTRA"
-    neutron subnet-create --ip-version 4 --tenant-id $TENANT_ID --gateway $GATEWAY $NET_ID $CIDR
+    neutron subnet-create --ip-version 4 --tenant-id $TENANT_ID --gateway $GATEWAY --subnetpool None $NET_ID $CIDR
     neutron_debug_admin probe-create --device-owner compute $NET_ID
     source $TOP_DIR/openrc demo demo
 }
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index c244e5470a..0e7ce26674 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -542,12 +542,12 @@ function create_neutron_initial_network {
         die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PHYSICAL_NETWORK $TENANT_ID"
 
         if [[ "$IP_VERSION" =~ 4.* ]]; then
-            SUBNET_ID=$(neutron subnet-create --tenant_id $TENANT_ID --ip_version 4 ${ALLOCATION_POOL:+--allocation-pool $ALLOCATION_POOL} --name $PROVIDER_SUBNET_NAME --gateway $NETWORK_GATEWAY $NET_ID $FIXED_RANGE | grep ' id ' | get_field 2)
+            SUBNET_ID=$(neutron subnet-create --tenant_id $TENANT_ID --ip_version 4 ${ALLOCATION_POOL:+--allocation-pool $ALLOCATION_POOL} --name $PROVIDER_SUBNET_NAME --gateway $NETWORK_GATEWAY --subnetpool None $NET_ID $FIXED_RANGE | grep ' id ' | get_field 2)
             die_if_not_set $LINENO SUBNET_ID "Failure creating SUBNET_ID for $PROVIDER_SUBNET_NAME $TENANT_ID"
         fi
 
         if [[ "$IP_VERSION" =~ .*6 ]]; then
-            SUBNET_V6_ID=$(neutron subnet-create --tenant_id $TENANT_ID --ip_version 6 --ipv6-address-mode $IPV6_ADDRESS_MODE --gateway $V6_NETWORK_GATEWAY --name $PROVIDER_SUBNET_NAME_V6 $NET_ID $FIXED_RANGE_V6 | grep 'id' | get_field 2)
+            SUBNET_V6_ID=$(neutron subnet-create --tenant_id $TENANT_ID --ip_version 6 --ipv6-address-mode $IPV6_ADDRESS_MODE --gateway $V6_NETWORK_GATEWAY --name $PROVIDER_SUBNET_NAME_V6 --subnetpool_id None $NET_ID $FIXED_RANGE_V6 | grep 'id' | get_field 2)
             die_if_not_set $LINENO SUBNET_V6_ID "Failure creating SUBNET_V6_ID for $PROVIDER_SUBNET_NAME_V6 $TENANT_ID"
         fi
 
@@ -1236,6 +1236,7 @@ function _neutron_create_private_subnet_v4 {
     subnet_params+="--ip_version 4 "
     subnet_params+="--gateway $NETWORK_GATEWAY "
     subnet_params+="--name $PRIVATE_SUBNET_NAME "
+    subnet_params+="--subnetpool None "
     subnet_params+="$NET_ID $FIXED_RANGE"
     local subnet_id
     subnet_id=$(neutron subnet-create $subnet_params | grep ' id ' | get_field 2)
@@ -1252,6 +1253,7 @@ function _neutron_create_private_subnet_v6 {
     subnet_params+="--ip_version 6 "
     subnet_params+="--gateway $IPV6_PRIVATE_NETWORK_GATEWAY "
     subnet_params+="--name $IPV6_PRIVATE_SUBNET_NAME "
+    subnet_params+="--subnetpool None "
     subnet_params+="$NET_ID $FIXED_RANGE_V6 $ipv6_modes"
     local ipv6_subnet_id
     ipv6_subnet_id=$(neutron subnet-create $subnet_params | grep ' id ' | get_field 2)
@@ -1265,6 +1267,7 @@ function _neutron_create_public_subnet_v4 {
     subnet_params+="${Q_FLOATING_ALLOCATION_POOL:+--allocation-pool $Q_FLOATING_ALLOCATION_POOL} "
     subnet_params+="--gateway $PUBLIC_NETWORK_GATEWAY "
     subnet_params+="--name $PUBLIC_SUBNET_NAME "
+    subnet_params+="--subnetpool None "
     subnet_params+="$EXT_NET_ID $FLOATING_RANGE "
     subnet_params+="-- --enable_dhcp=False"
     local id_and_ext_gw_ip
@@ -1278,6 +1281,7 @@ function _neutron_create_public_subnet_v6 {
     local subnet_params="--ip_version 6 "
     subnet_params+="--gateway $IPV6_PUBLIC_NETWORK_GATEWAY "
     subnet_params+="--name $IPV6_PUBLIC_SUBNET_NAME "
+    subnet_params+="--subnetpool None "
     subnet_params+="$EXT_NET_ID $IPV6_PUBLIC_RANGE "
     subnet_params+="-- --enable_dhcp=False"
     local ipv6_id_and_ext_gw_ip

From 04e73e17e8c536abb1ea86e7b0d037aef543da37 Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Tue, 10 Nov 2015 18:58:11 +0100
Subject: [PATCH 0058/2409] On Ubuntu: don't start Zookeeper twice

On Ubuntu, if the Zookeeper service is already running, attempting
to start it again fails with non-zero exit code. This patch detects
whether ZK is already started before trying to start it.

Change-Id: If1257152de01fe5fe0351fdbb538bce083edbec0
Closes-Bug: #1513741
---
 lib/zookeeper | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/lib/zookeeper b/lib/zookeeper
index e62ba8ada8..6637d52bca 100644
--- a/lib/zookeeper
+++ b/lib/zookeeper
@@ -69,7 +69,12 @@ function install_zookeeper {
 
 # start_zookeeper() - Start running processes, including screen
 function start_zookeeper {
-    start_service zookeeper
+    # Starting twice Zookeeper on Ubuntu exits with error code 1. See LP#1513741
+    # Match both systemd and sysvinit output
+    local running="(active \(running\)|start/running)"
+    if ! is_ubuntu || ! sudo /usr/sbin/service zookeeper status | egrep -q "$running"; then
+        start_service zookeeper
+    fi
 }
 
 # stop_zookeeper() - Stop running processes (non-screen)

From 536b8c1d2cf9d2523dc60f74190ef566a8c3fc4b Mon Sep 17 00:00:00 2001
From: Tony Breeds <tony@bakeyournoodle.com>
Date: Mon, 9 Nov 2015 10:05:37 +1100
Subject: [PATCH 0059/2409] Allow screen without logging to disk

In some niche setups it is desirable to run OpenStack services under
screen, but undesirable to automatically keep a persistent log from
each service.

Add a new variable SCREEN_IS_LOGGING that controls if screen logs each
window to disk automatically.

Ideally screen itself would be configured to log but just not activate.
This isn't possible with the screerc syntax.  Temporary logging can still
be used by a developer with:
    C-a : logfile foo
    C-a : log on

Change-Id: I2a3abf15dea95ae99ddbdfe1309382df601b7d93
---
 functions-common | 14 +++++++++-----
 stackrc          | 10 ++++++++++
 2 files changed, 19 insertions(+), 5 deletions(-)

diff --git a/functions-common b/functions-common
index ca0543da7d..ba3c79126d 100644
--- a/functions-common
+++ b/functions-common
@@ -1366,7 +1366,7 @@ function run_process {
 
 # Helper to launch a process in a named screen
 # Uses globals ``CURRENT_LOG_TIME``, ```LOGDIR``, ``SCREEN_LOGDIR``, `SCREEN_NAME``,
-# ``SERVICE_DIR``, ``USE_SCREEN``
+# ``SERVICE_DIR``, ``USE_SCREEN``, ``SCREEN_IS_LOGGING``
 # screen_process name "command-line" [group]
 # Run a command in a shell in a screen window, if an optional group
 # is provided, use sg to set the group of the command.
@@ -1386,8 +1386,12 @@ function screen_process {
     echo "SCREEN_LOGDIR: $SCREEN_LOGDIR"
     echo "log: $real_logfile"
     if [[ -n ${LOGDIR} ]]; then
-        screen -S $SCREEN_NAME -p $name -X logfile "$real_logfile"
-        screen -S $SCREEN_NAME -p $name -X log on
+        if [[ "$SCREEN_IS_LOGGING" == "True" ]]; then
+            screen -S $SCREEN_NAME -p $name -X logfile "$real_logfile"
+            screen -S $SCREEN_NAME -p $name -X log on
+        fi
+        # If logging isn't active then avoid a broken symlink
+        touch "$real_logfile"
         ln -sf "$real_logfile" ${LOGDIR}/${name}.log
         if [[ -n ${SCREEN_LOGDIR} ]]; then
             # Drop the backward-compat symlink
@@ -1426,7 +1430,7 @@ function screen_process {
 }
 
 # Screen rc file builder
-# Uses globals ``SCREEN_NAME``, ``SCREENRC``
+# Uses globals ``SCREEN_NAME``, ``SCREENRC``, ``SCREEN_IS_LOGGING``
 # screen_rc service "command-line"
 function screen_rc {
     SCREEN_NAME=${SCREEN_NAME:-stack}
@@ -1446,7 +1450,7 @@ function screen_rc {
         echo "screen -t $1 bash" >> $SCREENRC
         echo "stuff \"$2$NL\"" >> $SCREENRC
 
-        if [[ -n ${LOGDIR} ]]; then
+        if [[ -n ${LOGDIR} ]] && [[ "$SCREEN_IS_LOGGING" == "True" ]]; then
             echo "logfile ${LOGDIR}/${1}.log.${CURRENT_LOG_TIME}" >>$SCREENRC
             echo "log on" >>$SCREENRC
         fi
diff --git a/stackrc b/stackrc
index 3033b27580..76a5756dde 100644
--- a/stackrc
+++ b/stackrc
@@ -103,6 +103,16 @@ HORIZON_APACHE_ROOT="/dashboard"
 # be disabled for automated testing by setting this value to False.
 USE_SCREEN=True
 
+# When using screen, should we keep a log file on disk?  You might
+# want this False if you have a long-running setup where verbose logs
+# can fill-up the host.
+# XXX: Ideally screen itself would be configured to log but just not
+# activate.  This isn't possible with the screerc syntax.  Temporary
+# logging can still be used by a developer with:
+#    C-a : logfile foo
+#    C-a : log on
+SCREEN_IS_LOGGING=$(trueorfalse True SCREEN_IS_LOGGING)
+
 # Passwords generated by interactive devstack runs
 if [[ -r $RC_DIR/.localrc.password ]]; then
     source $RC_DIR/.localrc.password

From f6cee0fa2041a9188ad5e3e24e87ebd513729da8 Mon Sep 17 00:00:00 2001
From: Attila Fazekas <afazekas@redhat.com>
Date: Fri, 6 Nov 2015 18:18:57 +0100
Subject: [PATCH 0060/2409] Install kernel-modules package on fedora

Since f21 the kernel modules are split to multiple packages
and by default just the core modules gets installed.

nova requires iscsi_tcp module for attaching a volume
from any iscsi source (default cinder lvm setup).

On el7 it is not required.

Change-Id: I31705720ade5defd1b6d4b95bc51c2a11a5f0364
Related-Bug: #1429504
---
 files/rpms/nova | 1 +
 1 file changed, 1 insertion(+)

diff --git a/files/rpms/nova b/files/rpms/nova
index e70f138a3c..00e759636e 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -7,6 +7,7 @@ gawk
 genisoimage # required for config_drive
 iptables
 iputils
+kernel-modules # dist:f21,f22,f23
 kpartx
 kvm # NOPRIME
 libvirt-bin # NOPRIME

From 59e86a3aae3ca49ae3a400c1fcc49c53c9328fd2 Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Mon, 9 Nov 2015 11:06:39 -0500
Subject: [PATCH 0061/2409] Replace default route for inet6

When taking the IPv6 addresses from an interface, also update any routing
table entries.

Change-Id: I0424de6c5c1b0fcb7a9bc3fc1475036668cab09d
Closes-Bug: 1514494
---
 lib/neutron-legacy | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index c244e5470a..2c0c9cfb3b 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -799,7 +799,7 @@ function _move_neutron_addresses_route {
         local IP_ADD=""
         local IP_DEL=""
         local DEFAULT_ROUTE_GW
-        DEFAULT_ROUTE_GW=$(ip r | awk "/default.+$from_intf/ { print \$3; exit }")
+        DEFAULT_ROUTE_GW=$(ip -f $af r | awk "/default.+$from_intf/ { print \$3; exit }")
         local ADD_OVS_PORT=""
 
         if [[ $af == "inet" ]]; then
@@ -811,7 +811,7 @@ function _move_neutron_addresses_route {
         fi
 
         if [ "$DEFAULT_ROUTE_GW" != "" ]; then
-            ADD_DEFAULT_ROUTE="sudo ip r replace default via $DEFAULT_ROUTE_GW dev $to_intf"
+            ADD_DEFAULT_ROUTE="sudo ip -f $af r replace default via $DEFAULT_ROUTE_GW dev $to_intf"
         fi
 
         if [[ "$add_ovs_port" == "True" ]]; then

From 9af81997b543f7634c180b73a036c59456118b50 Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Tue, 10 Nov 2015 13:30:20 -0500
Subject: [PATCH 0062/2409] Only take the first global, non temporary ipv6
 address

Taking a temporary IPv6 address created through the OS' support for
Privacy Extensions (RFC 4941) is not very useful. It would occur because
it happened to be the first in the list returned from ip(8). Instead,
grab the first IPv6 address that is not a temporary address.

Related-Bug: #1488691

Change-Id: I7f455572241e7d0c7406f173239a2270a4d8926a
---
 lib/neutron-legacy | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 2c0c9cfb3b..eed477a550 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -807,7 +807,7 @@ function _move_neutron_addresses_route {
         fi
 
         if [[ $af == "inet6" ]]; then
-            IP_BRD=$(ip -f $af a s dev $from_intf | grep inet6 | awk '{ print $2, $3, $4; exit }')
+            IP_BRD=$(ip -f $af a s dev $from_intf | grep 'scope global' | sed '/temporary/d' | awk '{ print $2, $3, $4; exit }')
         fi
 
         if [ "$DEFAULT_ROUTE_GW" != "" ]; then

From 1650166c2594905ca16c02b58430f4f5bd9ed24c Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Mon, 12 Oct 2015 11:01:44 -0400
Subject: [PATCH 0063/2409] docs: Add more networking details to single
 interface section

Add complete localrcs, and also add a section for additional compute
nodes, to help demonstrate the OVS layout and how traffic flows over
VXLAN tunnels from compute nodes, to the L3 node, and out onto the
wire.

Closes-Bug: #1506733

Change-Id: Ibb5fd454bdcb8c13400c1e11f640c2aafc0f73ca
---
 doc/source/guides/neutron.rst | 172 +++++++++++++++++++++++++++++++++-
 1 file changed, 171 insertions(+), 1 deletion(-)

diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index 5891f68033..ee29087267 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -35,7 +35,7 @@ network and is on a shared subnet with other machines.
                 network hardware_network {
                         address = "172.18.161.0/24"
                         router [ address = "172.18.161.1" ];
-                        devstack_laptop [ address = "172.18.161.6" ];
+                        devstack-1 [ address = "172.18.161.6" ];
                 }
         }
 
@@ -43,9 +43,13 @@ network and is on a shared subnet with other machines.
 DevStack Configuration
 ----------------------
 
+The following is a complete `local.conf` for the host named
+`devstack-1`. It will run all the API and services, as well as
+serving as a hypervisor for guest instances.
 
 ::
 
+        [[local|localrc]]
         HOST_IP=172.18.161.6
         SERVICE_HOST=172.18.161.6
         MYSQL_HOST=172.18.161.6
@@ -57,6 +61,12 @@ DevStack Configuration
         SERVICE_PASSWORD=secrete
         SERVICE_TOKEN=secrete
 
+        # Do not use Nova-Network
+        disable_service n-net
+        # Enable Neutron
+        ENABLED_SERVICES+=,q-svc,q-dhcp,q-meta,q-agt,q-l3
+
+
         ## Neutron options
         Q_USE_SECGROUP=True
         FLOATING_RANGE="172.18.161.0/24"
@@ -71,6 +81,166 @@ DevStack Configuration
         OVS_BRIDGE_MAPPINGS=public:br-ex
 
 
+Adding Additional Compute Nodes
+-------------------------------
+
+Let's suppose that after installing DevStack on the first host, you
+also want to do multinode testing and networking.
+
+Physical Network Setup
+~~~~~~~~~~~~~~~~~~~~~~
+
+.. nwdiag::
+
+        nwdiag {
+                inet [ shape = cloud ];
+                router;
+                inet -- router;
+
+                network hardware_network {
+                        address = "172.18.161.0/24"
+                        router [ address = "172.18.161.1" ];
+                        devstack-1 [ address = "172.18.161.6" ];
+                        devstack-2 [ address = "172.18.161.7" ];
+                }
+        }
+
+
+After DevStack installs and configures Neutron, traffic from guest VMs
+flows out of `devstack-2` (the compute node) and is encapsulated in a
+VXLAN tunnel back to `devstack-1` (the control node) where the L3
+agent is running.
+
+::
+
+    stack@devstack-2:~/devstack$ sudo ovs-vsctl show
+    8992d965-0ba0-42fd-90e9-20ecc528bc29
+        Bridge br-int
+            fail_mode: secure
+            Port br-int
+                Interface br-int
+                    type: internal
+            Port patch-tun
+                Interface patch-tun
+                    type: patch
+                    options: {peer=patch-int}
+        Bridge br-tun
+            fail_mode: secure
+            Port "vxlan-c0a801f6"
+                Interface "vxlan-c0a801f6"
+                    type: vxlan
+                    options: {df_default="true", in_key=flow, local_ip="172.18.161.7", out_key=flow, remote_ip="172.18.161.6"}
+            Port patch-int
+                Interface patch-int
+                    type: patch
+                    options: {peer=patch-tun}
+            Port br-tun
+                Interface br-tun
+                    type: internal
+        ovs_version: "2.0.2"
+
+Open vSwitch on the control node, where the L3 agent runs, is
+configured to de-encapsulate traffic from compute nodes, then forward
+it over the `br-ex` bridge, where `eth0` is attached.
+
+::
+
+    stack@devstack-1:~/devstack$ sudo ovs-vsctl show
+    422adeea-48d1-4a1f-98b1-8e7239077964
+        Bridge br-tun
+            fail_mode: secure
+            Port br-tun
+                Interface br-tun
+                    type: internal
+            Port patch-int
+                Interface patch-int
+                    type: patch
+                    options: {peer=patch-tun}
+            Port "vxlan-c0a801d8"
+                Interface "vxlan-c0a801d8"
+                    type: vxlan
+                    options: {df_default="true", in_key=flow, local_ip="172.18.161.6", out_key=flow, remote_ip="172.18.161.7"}
+        Bridge br-ex
+            Port phy-br-ex
+                Interface phy-br-ex
+                    type: patch
+                    options: {peer=int-br-ex}
+            Port "eth0"
+                Interface "eth0"
+            Port br-ex
+                Interface br-ex
+                    type: internal
+        Bridge br-int
+            fail_mode: secure
+            Port "tapce66332d-ea"
+                tag: 1
+                Interface "tapce66332d-ea"
+                    type: internal
+            Port "qg-65e5a4b9-15"
+                tag: 2
+                Interface "qg-65e5a4b9-15"
+                    type: internal
+            Port "qr-33e5e471-88"
+                tag: 1
+                Interface "qr-33e5e471-88"
+                    type: internal
+            Port "qr-acbe9951-70"
+                tag: 1
+                Interface "qr-acbe9951-70"
+                    type: internal
+            Port br-int
+                Interface br-int
+                    type: internal
+            Port patch-tun
+                Interface patch-tun
+                    type: patch
+                    options: {peer=patch-int}
+            Port int-br-ex
+                Interface int-br-ex
+                    type: patch
+                    options: {peer=phy-br-ex}
+        ovs_version: "2.0.2"
+
+`br-int` is a bridge that the Open vSwitch mechanism driver creates,
+which is used as the "integration bridge" where ports are created, and
+plugged into the virtual switching fabric. `br-ex` is an OVS bridge
+that is used to connect physical ports (like `eth0`), so that floating
+IP traffic for tenants can be received from the physical network
+infrastructure (and the internet), and routed to tenant network ports.
+`br-tun` is a tunnel bridge that is used to connect OpenStack nodes
+(like `devstack-2`) together. This bridge is used so that tenant
+network traffic, using the VXLAN tunneling protocol, flows between
+each compute node where tenant instances run.
+
+
+
+DevStack Compute Configuration
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+The host `devstack-2` has a very minimal `local.conf`.
+
+::
+
+    [[local|localrc]]
+    HOST_IP=172.18.161.7
+    SERVICE_HOST=172.18.161.6
+    MYSQL_HOST=172.18.161.6
+    RABBIT_HOST=172.18.161.6
+    GLANCE_HOSTPORT=172.18.161.6:9292
+    ADMIN_PASSWORD=secrete
+    MYSQL_PASSWORD=secrete
+    RABBIT_PASSWORD=secrete
+    SERVICE_PASSWORD=secrete
+    SERVICE_TOKEN=secrete
+
+    ## Neutron options
+    PUBLIC_INTERFACE=eth0
+    ENABLED_SERVICES=n-cpu,rabbit,q-agt
+
+Network traffic from `eth0` on the compute nodes is then NAT'd by the
+controller node that runs Neutron's `neutron-l3-agent` and provides L3
+connectivity.
+
 
 Neutron Networking with Open vSwitch and Provider Networks
 ==========================================================

From 90dd262c19d7387ef6b438aea5e6eb13f3fd609d Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 10 Nov 2015 12:22:03 -0500
Subject: [PATCH 0064/2409] fail if devstack attempts to be run under
 virtualenv

This has come up on the mailing list recently, we should just fail
early and explicitly so that people don't get way down this path and
not realize it's never going to work.

Change-Id: I8a7f001adf3a5244b8655858ebd5fc7014a4af55
---
 stack.sh | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/stack.sh b/stack.sh
index 68b932e4b1..825ed968f3 100755
--- a/stack.sh
+++ b/stack.sh
@@ -93,6 +93,20 @@ if [[ $EUID -eq 0 ]]; then
     exit 1
 fi
 
+# OpenStack is designed to run at a system level, with system level
+# installation of python packages. It does not support running under a
+# virtual env, and will fail in really odd ways if you do this. Make
+# this explicit as it has come up on the mailing list.
+if [[ -n "$VIRTUAL_ENV" ]]; then
+    echo "You appear to be running under a python virtualenv."
+    echo "DevStack does not support this, as we my break the"
+    echo "virtualenv you are currently in by modifying "
+    echo "external system-level components the virtualenv relies on."
+    echo "We reccommend you use a separate virtual-machine if "
+    echo "you are worried about DevStack taking over your system."
+    exit 1
+fi
+
 # Provide a safety switch for devstack. If you do a lot of devstack,
 # on a lot of different environments, you sometimes run it on the
 # wrong box. This makes there be a way to prevent that.

From 7e550682977b0c3a6a667af6691760d8a7506e9b Mon Sep 17 00:00:00 2001
From: Richard Theis <rtheis@us.ibm.com>
Date: Tue, 13 Oct 2015 07:51:05 -0500
Subject: [PATCH 0065/2409] doc: Update LBaaS v2 setup for Liberty

- Updated LBaaS v2 setup to use Octavia.
- Removed the old cirros image URL, the default should be sufficient.
- Fixed nova boot commands based on Liberty DevStack.
- Added sleeps to LBaaS v2 commands since most commands
  can take a few seconds to complete.
- Added wait to load balancer creation since it can take
  a few minutes to complete.
- Wrapped long lines in the descriptions.

Change-Id: Ib4a3f02ebc2606e3e16591ae3a23676cb0a6cd64
---
 doc/source/guides/devstack-with-lbaas-v2.rst | 30 ++++++++++++++------
 1 file changed, 21 insertions(+), 9 deletions(-)

diff --git a/doc/source/guides/devstack-with-lbaas-v2.rst b/doc/source/guides/devstack-with-lbaas-v2.rst
index f67978310d..747a9384d0 100644
--- a/doc/source/guides/devstack-with-lbaas-v2.rst
+++ b/doc/source/guides/devstack-with-lbaas-v2.rst
@@ -1,13 +1,17 @@
-Configure Load-Balancer in Kilo
+Configure Load-Balancer Version 2
 =================================
 
-The Kilo release of OpenStack will support Version 2 of the neutron load balancer. Until now, using OpenStack `LBaaS V2 <http://docs.openstack.org/api/openstack-network/2.0/content/lbaas_ext.html>`_ has required a good understanding of neutron and LBaaS architecture and several manual steps.
+Starting in the OpenStack Liberty release, the
+`neutron LBaaS v2 API <http://developer.openstack.org/api-ref-networking-v2-ext.html>`_
+is now stable while the LBaaS v1 API has been deprecated.  The LBaaS v2 reference
+driver is based on Octavia.
 
 
 Phase 1: Create DevStack + 2 nova instances
 --------------------------------------------
 
-First, set up a vm of your choice with at least 8 GB RAM and 16 GB disk space, make sure it is updated. Install git and any other developer tools you find useful.
+First, set up a vm of your choice with at least 8 GB RAM and 16 GB disk space,
+make sure it is updated. Install git and any other developer tools you find useful.
 
 Install devstack
 
@@ -24,6 +28,7 @@ Edit your `local.conf` to look like
     [[local|localrc]]
     # Load the external LBaaS plugin.
     enable_plugin neutron-lbaas https://git.openstack.org/openstack/neutron-lbaas
+    enable_plugin octavia https://git.openstack.org/openstack/octavia
 
     # ===== BEGIN localrc =====
     DATABASE_PASSWORD=password
@@ -42,13 +47,13 @@ Edit your `local.conf` to look like
     ENABLED_SERVICES+=,horizon
     # Nova
     ENABLED_SERVICES+=,n-api,n-crt,n-obj,n-cpu,n-cond,n-sch
-    IMAGE_URLS+=",https://launchpad.net/cirros/trunk/0.3.0/+download/cirros-0.3.0-x86_64-disk.img"
     # Glance
     ENABLED_SERVICES+=,g-api,g-reg
     # Neutron
     ENABLED_SERVICES+=,q-svc,q-agt,q-dhcp,q-l3,q-meta
-    # Enable LBaaS V2
+    # Enable LBaaS v2
     ENABLED_SERVICES+=,q-lbaasv2
+    ENABLED_SERVICES+=,octavia,o-cw,o-hk,o-hm,o-api
     # Cinder
     ENABLED_SERVICES+=,c-api,c-vol,c-sch
     # Tempest
@@ -69,11 +74,11 @@ Create two nova instances that we can use as test http servers:
   ::
 
     #create nova instances on private network
-    nova boot --image $(nova image-list | awk '/ cirros-0.3.0-x86_64-disk / {print $2}') --flavor 1 --nic net-id=$(neutron net-list | awk '/ private / {print $2}') node1
-    nova boot --image $(nova image-list | awk '/ cirros-0.3.0-x86_64-disk / {print $2}') --flavor 1 --nic net-id=$(neutron net-list | awk '/ private / {print $2}') node2
+    nova boot --image $(nova image-list | awk '/ cirros-.*-x86_64-uec / {print $2}') --flavor 1 --nic net-id=$(neutron net-list | awk '/ private / {print $2}') node1
+    nova boot --image $(nova image-list | awk '/ cirros-.*-x86_64-uec / {print $2}') --flavor 1 --nic net-id=$(neutron net-list | awk '/ private / {print $2}') node2
     nova list # should show the nova instances just created
 
-    #add secgroup rule to allow ssh etc..
+    #add secgroup rules to allow ssh etc..
     neutron security-group-rule-create default --protocol icmp
     neutron security-group-rule-create default --protocol tcp --port-range-min 22 --port-range-max 22
     neutron security-group-rule-create default --protocol tcp --port-range-min 80 --port-range-max 80
@@ -91,9 +96,16 @@ Phase 2: Create your load balancers
  ::
 
     neutron lbaas-loadbalancer-create --name lb1 private-subnet
+    neutron lbaas-loadbalancer-show lb1  # Wait for the provisioning_status to be ACTIVE.
     neutron lbaas-listener-create --loadbalancer lb1 --protocol HTTP --protocol-port 80 --name listener1
+    sleep 10  # Sleep since LBaaS actions can take a few seconds depending on the environment.
     neutron lbaas-pool-create --lb-algorithm ROUND_ROBIN --listener listener1 --protocol HTTP --name pool1
+    sleep 10
     neutron lbaas-member-create  --subnet private-subnet --address 10.0.0.3 --protocol-port 80 pool1
+    sleep 10
     neutron lbaas-member-create  --subnet private-subnet --address 10.0.0.5 --protocol-port 80 pool1
 
-Please note here that the "10.0.0.3" and "10.0.0.5" in the above commands are the IPs of the nodes (in my test run-thru, they were actually 10.2 and 10.4), and the address of the created LB will be reported as "vip_address" from the lbaas-loadbalancer-create, and a quick test of that LB is "curl that-lb-ip", which should alternate between showing the IPs of the two nodes.
+Please note here that the "10.0.0.3" and "10.0.0.5" in the above commands are the IPs of the nodes
+(in my test run-thru, they were actually 10.2 and 10.4), and the address of the created LB will be
+reported as "vip_address" from the lbaas-loadbalancer-create, and a quick test of that LB is
+"curl that-lb-ip", which should alternate between showing the IPs of the two nodes.

From 2e8695b0756969d89cd4152e7496df9bf540eaa3 Mon Sep 17 00:00:00 2001
From: Tony Breeds <tony@bakeyournoodle.com>
Date: Tue, 20 Oct 2015 11:21:57 +1100
Subject: [PATCH 0066/2409] Add development libraries needed by Pillow

Change I8da7dd95ae24cf06dc7bdc300fcf39947a6df093 added Pillow build deps
to nodepool thick slaves.  This means that Pillow 3 will work in unit
tests.

Make the matching change to allow Pillow 3.0.0 to work under devstack.

The longer term aim is to remove temporary upper cap.

Change-Id: I2bec8cf1bfeaaa6ae329704229fdeb86d26e55c7
---
 files/debs/general      | 1 +
 files/rpms-suse/general | 2 ++
 files/rpms/general      | 1 +
 3 files changed, 4 insertions(+)

diff --git a/files/debs/general b/files/debs/general
index 9b2715685e..1215147a16 100644
--- a/files/debs/general
+++ b/files/debs/general
@@ -8,6 +8,7 @@ git
 graphviz # needed for docs
 iputils-ping
 libffi-dev # for pyOpenSSL
+libjpeg-dev # Pillow 3.0.0
 libmysqlclient-dev  # MySQL-python
 libpq-dev  # psycopg2
 libssl-dev # for pyOpenSSL
diff --git a/files/rpms-suse/general b/files/rpms-suse/general
index 651243d274..34a29554f7 100644
--- a/files/rpms-suse/general
+++ b/files/rpms-suse/general
@@ -9,6 +9,7 @@ git-core
 graphviz # docs
 iputils
 libffi-devel  # pyOpenSSL
+libjpeg8-devel # Pillow 3.0.0
 libmysqlclient-devel # MySQL-python
 libopenssl-devel # to rebuild pyOpenSSL if needed
 libxslt-devel  # lxml
@@ -26,3 +27,4 @@ tar
 tcpdump
 unzip
 wget
+zlib-devel
diff --git a/files/rpms/general b/files/rpms/general
index cfd9479600..40b06f489b 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -12,6 +12,7 @@ iptables-services  # NOPRIME f21,f22
 java-1.7.0-openjdk-headless  # NOPRIME rhel7
 java-1.8.0-openjdk-headless  # NOPRIME f21,f22
 libffi-devel
+libjpeg-turbo-devel # Pillow 3.0.0
 libxml2-devel # lxml
 libxslt-devel # lxml
 libyaml-devel

From 5cad4d3fe94f2e3823a8d9a2588b3a580d69605c Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 10 Nov 2015 14:39:07 -0500
Subject: [PATCH 0067/2409] refactor zookeeper into a slightly more generic dlm
 module

This attempts to make the zookeeper installation a bit more modular
(assuming that other folks will want to add other dlms as plugins),
and addresses the service start issues with zookeeper under
ubuntu/upstart.

Zookeeper is not going to be installed by default. Services need to
ask for it with use_dlm.

Change-Id: I33525e2b83a4497a57ec95f62880e0308c88b34f
---
 lib/dlm       | 108 ++++++++++++++++++++++++++++++++++++++++++++++++++
 lib/zookeeper |  91 ------------------------------------------
 stack.sh      |  20 +++-------
 stackrc       |   2 +-
 unstack.sh    |   2 +-
 5 files changed, 115 insertions(+), 108 deletions(-)
 create mode 100644 lib/dlm
 delete mode 100644 lib/zookeeper

diff --git a/lib/dlm b/lib/dlm
new file mode 100644
index 0000000000..f68ee26b4b
--- /dev/null
+++ b/lib/dlm
@@ -0,0 +1,108 @@
+#!/bin/bash
+#
+# lib/dlm
+#
+# Functions to control the installation and configuration of software
+# that provides a dlm (and possibly other functions). The default is
+# **zookeeper**, and is going to be the only backend supported in the
+# devstack tree.
+
+# Dependencies:
+#
+# - ``functions`` file
+
+# ``stack.sh`` calls the entry points in this order:
+#
+# - is_dlm_enabled
+# - install_dlm
+# - configure_dlm
+# - cleanup_dlm
+
+# Save trace setting
+XTRACE=$(set +o | grep xtrace)
+set +o xtrace
+
+
+# Defaults
+# --------
+
+# <define global variables here that belong to this project>
+
+# Set up default directories
+ZOOKEEPER_DATA_DIR=$DEST/data/zookeeper
+ZOOKEEPER_CONF_DIR=/etc/zookeeper
+
+
+# Entry Points
+# ------------
+#
+# NOTE(sdague): it is expected that when someone wants to implement
+# another one of these out of tree, they'll implement the following
+# functions:
+#
+# - dlm_backend
+# - install_dlm
+# - configure_dlm
+# - cleanup_dlm
+
+# This should be declared in the settings file of any plugin or
+# service that needs to have a dlm in their enviroment.
+function use_dlm {
+    enable_service $(dlm_backend)
+}
+
+# A function to return the name of the backend in question, some users
+# are going to need to know this.
+function dlm_backend {
+    echo "zookeeper"
+}
+
+# Test if a dlm is enabled (defaults to a zookeeper specific check)
+function is_dlm_enabled {
+    [[ ,${ENABLED_SERVICES}, =~ ,"$(dlm_backend)", ]] && return 0
+    return 1
+}
+
+# cleanup_dlm() - Remove residual data files, anything left over from previous
+# runs that a clean run would need to clean up
+function cleanup_dlm {
+    # NOTE(sdague): we don't check for is_enabled here because we
+    # should just delete this regardless. Some times users updated
+    # their service list before they run cleanup.
+    sudo rm -rf $ZOOKEEPER_DATA_DIR
+}
+
+# configure_dlm() - Set config files, create data dirs, etc
+function configure_dlm {
+    if is_dlm_enabled; then
+        sudo cp $FILES/zookeeper/* $ZOOKEEPER_CONF_DIR
+        sudo sed -i -e 's|.*dataDir.*|dataDir='$ZOOKEEPER_DATA_DIR'|' $ZOOKEEPER_CONF_DIR/zoo.cfg
+        # clean up from previous (possibly aborted) runs
+        # create required data files
+        sudo rm -rf $ZOOKEEPER_DATA_DIR
+        sudo mkdir -p $ZOOKEEPER_DATA_DIR
+        # restart after configuration, there is no reason to make this
+        # another step, because having data files that don't match the
+        # zookeeper running is just going to cause tears.
+        restart_service zookeeper
+    fi
+}
+
+# install_dlm() - Collect source and prepare
+function install_dlm {
+    if is_dlm_enabled; then
+        if is_ubuntu; then
+            install_package zookeeperd
+        else
+            die $LINENO "Don't know how to install zookeeper on this platform"
+        fi
+    fi
+}
+
+# Restore xtrace
+$XTRACE
+
+# Tell emacs to use shell-script-mode
+## Local variables:
+## mode: shell-script
+## End:
diff --git a/lib/zookeeper b/lib/zookeeper
deleted file mode 100644
index 6637d52bca..0000000000
--- a/lib/zookeeper
+++ /dev/null
@@ -1,91 +0,0 @@
-#!/bin/bash
-#
-# lib/zookeeper
-# Functions to control the installation and configuration of **zookeeper**
-
-# Dependencies:
-#
-# - ``functions`` file
-
-# ``stack.sh`` calls the entry points in this order:
-#
-# - is_zookeeper_enabled
-# - install_zookeeper
-# - configure_zookeeper
-# - init_zookeeper
-# - start_zookeeper
-# - stop_zookeeper
-# - cleanup_zookeeper
-
-# Save trace setting
-XTRACE=$(set +o | grep xtrace)
-set +o xtrace
-
-
-# Defaults
-# --------
-
-# <define global variables here that belong to this project>
-
-# Set up default directories
-ZOOKEEPER_DATA_DIR=$DEST/data/zookeeper
-ZOOKEEPER_CONF_DIR=/etc/zookeeper
-
-
-# Entry Points
-# ------------
-
-# Test if any zookeeper service us enabled
-# is_zookeeper_enabled
-function is_zookeeper_enabled {
-    [[ ,${ENABLED_SERVICES}, =~ ,"zookeeper", ]] && return 0
-    return 1
-}
-
-# cleanup_zookeeper() - Remove residual data files, anything left over from previous
-# runs that a clean run would need to clean up
-function cleanup_zookeeper {
-    sudo rm -rf $ZOOKEEPER_DATA_DIR
-}
-
-# configure_zookeeper() - Set config files, create data dirs, etc
-function configure_zookeeper {
-    sudo cp $FILES/zookeeper/* $ZOOKEEPER_CONF_DIR
-    sudo sed -i -e 's|.*dataDir.*|dataDir='$ZOOKEEPER_DATA_DIR'|' $ZOOKEEPER_CONF_DIR/zoo.cfg
-}
-
-# init_zookeeper() - Initialize databases, etc.
-function init_zookeeper {
-    # clean up from previous (possibly aborted) runs
-    # create required data files
-    sudo rm -rf $ZOOKEEPER_DATA_DIR
-    sudo mkdir -p $ZOOKEEPER_DATA_DIR
-}
-
-# install_zookeeper() - Collect source and prepare
-function install_zookeeper {
-    install_package zookeeperd
-}
-
-# start_zookeeper() - Start running processes, including screen
-function start_zookeeper {
-    # Starting twice Zookeeper on Ubuntu exits with error code 1. See LP#1513741
-    # Match both systemd and sysvinit output
-    local running="(active \(running\)|start/running)"
-    if ! is_ubuntu || ! sudo /usr/sbin/service zookeeper status | egrep -q "$running"; then
-        start_service zookeeper
-    fi
-}
-
-# stop_zookeeper() - Stop running processes (non-screen)
-function stop_zookeeper {
-    stop_service zookeeper
-}
-
-# Restore xtrace
-$XTRACE
-
-# Tell emacs to use shell-script-mode
-## Local variables:
-## mode: shell-script
-## End:
diff --git a/stack.sh b/stack.sh
index 68b932e4b1..3cc21586d7 100755
--- a/stack.sh
+++ b/stack.sh
@@ -539,7 +539,7 @@ source $TOP_DIR/lib/heat
 source $TOP_DIR/lib/neutron-legacy
 source $TOP_DIR/lib/ldap
 source $TOP_DIR/lib/dstat
-source $TOP_DIR/lib/zookeeper
+source $TOP_DIR/lib/dlm
 
 # Extras Source
 # --------------
@@ -724,11 +724,10 @@ run_phase stack pre-install
 
 install_rpc_backend
 
-if is_service_enabled zookeeper; then
-    cleanup_zookeeper
-    configure_zookeeper
-    init_zookeeper
-fi
+# NOTE(sdague): dlm install is conditional on one being enabled by configuration
+install_dlm
+configure_dlm
+
 if is_service_enabled $DATABASE_BACKENDS; then
     install_database
 fi
@@ -968,15 +967,6 @@ save_stackenv $LINENO
 start_dstat
 
 
-# Zookeeper
-# -----
-
-# zookeeper for use with tooz for Distributed Lock Management capabilities etc.,
-if is_service_enabled zookeeper; then
-    start_zookeeper
-fi
-
-
 # Keystone
 # --------
 
diff --git a/stackrc b/stackrc
index 76a5756dde..f4a162b50c 100644
--- a/stackrc
+++ b/stackrc
@@ -69,7 +69,7 @@ if ! isset ENABLED_SERVICES ; then
     # Dashboard
     ENABLED_SERVICES+=,horizon
     # Additional services
-    ENABLED_SERVICES+=,rabbit,tempest,mysql,dstat,zookeeper
+    ENABLED_SERVICES+=,rabbit,tempest,mysql,dstat
 fi
 
 # SQLAlchemy supports multiple database drivers for each database server
diff --git a/unstack.sh b/unstack.sh
index 0cace3254a..8eded837fd 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -69,7 +69,7 @@ source $TOP_DIR/lib/heat
 source $TOP_DIR/lib/neutron-legacy
 source $TOP_DIR/lib/ldap
 source $TOP_DIR/lib/dstat
-source $TOP_DIR/lib/zookeeper
+source $TOP_DIR/lib/dlm
 
 # Extras Source
 # --------------

From 9329290183c96be45363325a244861065413562d Mon Sep 17 00:00:00 2001
From: Tony Breeds <tony@bakeyournoodle.com>
Date: Mon, 9 Nov 2015 15:45:04 +1100
Subject: [PATCH 0068/2409] Update comments to reflect current USE_SCREEN usage

In a couple of places the tracking of USE_SCREEN has drifted from the
comments.

Correct that.

Change-Id: I63bdd5ca4de49bf653f5bc8f8e0e5efe67ef605c
---
 functions-common | 10 ++++------
 stackrc          |  2 +-
 2 files changed, 5 insertions(+), 7 deletions(-)

diff --git a/functions-common b/functions-common
index 5c97aee9a3..3eeab09889 100644
--- a/functions-common
+++ b/functions-common
@@ -1352,6 +1352,7 @@ function is_running {
 # If the command includes shell metachatacters (;<>*) it must be run using a shell
 # If an optional group is provided sg will be used to run the
 # command as that group.
+# Uses globals ``USE_SCREEN``
 # run_process service "command-line" [group]
 function run_process {
     local service=$1
@@ -1370,7 +1371,7 @@ function run_process {
 
 # Helper to launch a process in a named screen
 # Uses globals ``CURRENT_LOG_TIME``, ```LOGDIR``, ``SCREEN_LOGDIR``, `SCREEN_NAME``,
-# ``SERVICE_DIR``, ``USE_SCREEN``, ``SCREEN_IS_LOGGING``
+# ``SERVICE_DIR``, ``SCREEN_IS_LOGGING``
 # screen_process name "command-line" [group]
 # Run a command in a shell in a screen window, if an optional group
 # is provided, use sg to set the group of the command.
@@ -1381,7 +1382,6 @@ function screen_process {
 
     SCREEN_NAME=${SCREEN_NAME:-stack}
     SERVICE_DIR=${SERVICE_DIR:-${DEST}/status}
-    USE_SCREEN=$(trueorfalse True USE_SCREEN)
 
     screen -S $SCREEN_NAME -X screen -t $name
 
@@ -1465,14 +1465,13 @@ function screen_rc {
 # If a PID is available use it, kill the whole process group via TERM
 # If screen is being used kill the screen window; this will catch processes
 # that did not leave a PID behind
-# Uses globals ``SCREEN_NAME``, ``SERVICE_DIR``, ``USE_SCREEN``
+# Uses globals ``SCREEN_NAME``, ``SERVICE_DIR``
 # screen_stop_service service
 function screen_stop_service {
     local service=$1
 
     SCREEN_NAME=${SCREEN_NAME:-stack}
     SERVICE_DIR=${SERVICE_DIR:-${DEST}/status}
-    USE_SCREEN=$(trueorfalse True USE_SCREEN)
 
     if is_service_enabled $service; then
         # Clean up the screen window
@@ -1490,7 +1489,6 @@ function stop_process {
     local service=$1
 
     SERVICE_DIR=${SERVICE_DIR:-${DEST}/status}
-    USE_SCREEN=$(trueorfalse True USE_SCREEN)
 
     if is_service_enabled $service; then
         # Kill via pid if we have one available
@@ -1552,11 +1550,11 @@ function service_check {
 }
 
 # Tail a log file in a screen if USE_SCREEN is true.
+# Uses globals ``USE_SCREEN``
 function tail_log {
     local name=$1
     local logfile=$2
 
-    USE_SCREEN=$(trueorfalse True USE_SCREEN)
     if [[ "$USE_SCREEN" = "True" ]]; then
         screen_process "$name" "sudo tail -f $logfile"
     fi
diff --git a/stackrc b/stackrc
index 76a5756dde..4f459397a0 100644
--- a/stackrc
+++ b/stackrc
@@ -101,7 +101,7 @@ HORIZON_APACHE_ROOT="/dashboard"
 # ctrl-c, up-arrow, enter to restart the service. Starting services
 # this way is slightly unreliable, and a bit slower, so this can
 # be disabled for automated testing by setting this value to False.
-USE_SCREEN=True
+USE_SCREEN=$(trueorfalse True USE_SCREEN)
 
 # When using screen, should we keep a log file on disk?  You might
 # want this False if you have a long-running setup where verbose logs

From 34a5aa5110c9651e2cf33d694d71b1e450495495 Mon Sep 17 00:00:00 2001
From: Tony Breeds <tony@bakeyournoodle.com>
Date: Tue, 10 Nov 2015 15:23:30 +1100
Subject: [PATCH 0069/2409] Remove unused compat variable SCREEN_DEV

Currently we set USE_SCREEN to SCREEN_DEV if it's set.  There is a
comment to remove it once it's eracticated from CI.

AFAICT this pre-condition has been met.

Change-Id: I1423c8b9c18d1b3e34dbfe1c03be735c646a12b4
---
 stackrc | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/stackrc b/stackrc
index 4f459397a0..075236890b 100644
--- a/stackrc
+++ b/stackrc
@@ -651,9 +651,6 @@ S3_SERVICE_PORT=${S3_SERVICE_PORT:-3333}
 PRIVATE_NETWORK_NAME=${PRIVATE_NETWORK_NAME:-"private"}
 PUBLIC_NETWORK_NAME=${PUBLIC_NETWORK_NAME:-"public"}
 
-# Compatibility until it's eradicated from CI
-USE_SCREEN=${SCREEN_DEV:-$USE_SCREEN}
-
 # Set default screen name
 SCREEN_NAME=${SCREEN_NAME:-stack}
 

From 201e3c133e28acb6dcdeb017389718db0775a748 Mon Sep 17 00:00:00 2001
From: Huan Xie <huan.xie@citrix.com>
Date: Thu, 27 Aug 2015 12:34:24 +0100
Subject: [PATCH 0070/2409] XenAPI:Fix problems to support xenserver+neutron

The lack of a CI for XenAPI + Neutron has meant this support has been
broken over time. This is set of one-off fixes that are needed to
reintroduce support while we work towards getting a CI functional

Related-Bug: #1495423
Change-Id: Id41fdc77c155756bda9e2e9ac0446a49f06f0603
---
 lib/neutron-legacy                    |  2 +-
 lib/neutron_plugins/openvswitch_agent | 18 ++++++++++++++++--
 2 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index c244e5470a..ac99678e66 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -639,7 +639,7 @@ function install_neutron {
         plugin_dir=$($ssh_dom0 "$xen_functions; set -eux; xapi_plugin_location")
 
         # install neutron plugins to dom0
-        tar -czf - -C $NEUTRON_DIR/neutron/plugins/openvswitch/agent/xenapi/etc/xapi.d/plugins/ ./ |
+        tar -czf - -C $NEUTRON_DIR/neutron/plugins/ml2/drivers/openvswitch/agent/xenapi/etc/xapi.d/plugins/ ./ |
             $ssh_dom0 "tar -xzf - -C $plugin_dir && chmod a+x $plugin_dir/*"
     fi
 }
diff --git a/lib/neutron_plugins/openvswitch_agent b/lib/neutron_plugins/openvswitch_agent
index 5a843ffba7..6a333939d0 100644
--- a/lib/neutron_plugins/openvswitch_agent
+++ b/lib/neutron_plugins/openvswitch_agent
@@ -71,6 +71,9 @@ function neutron_plugin_configure_plugin_agent {
         # Make a copy of our config for domU
         sudo cp /$Q_PLUGIN_CONF_FILE "/$Q_PLUGIN_CONF_FILE.domU"
 
+        # change domU's config file to STACK_USER
+        sudo chown $STACK_USER:$STACK_USER /$Q_PLUGIN_CONF_FILE.domU
+
         # Deal with Dom0's L2 Agent:
         Q_RR_DOM0_COMMAND="$NEUTRON_BIN_DIR/neutron-rootwrap-xen-dom0 $Q_RR_CONF_FILE"
 
@@ -82,7 +85,14 @@ function neutron_plugin_configure_plugin_agent {
         # Under XS/XCP, the ovs agent needs to target the dom0
         # integration bridge.  This is enabled by using a root wrapper
         # that executes commands on dom0 via a XenAPI plugin.
+        # XenAPI does not support daemon rootwrap now, so set root_helper_daemon empty
         iniset /$Q_PLUGIN_CONF_FILE agent root_helper "$Q_RR_DOM0_COMMAND"
+        iniset /$Q_PLUGIN_CONF_FILE agent root_helper_daemon ""
+
+        # Disable minimize polling, so that it can always detect OVS and Port changes
+        # This is a problem of xenserver + neutron, bug has been reported
+        # https://bugs.launchpad.net/neutron/+bug/1495423
+        iniset /$Q_PLUGIN_CONF_FILE agent minimize_polling False
 
         # Set "physical" mapping
         iniset /$Q_PLUGIN_CONF_FILE ovs bridge_mappings "physnet1:$FLAT_NETWORK_BRIDGE"
@@ -95,10 +105,14 @@ function neutron_plugin_configure_plugin_agent {
         # Create a bridge "br-$GUEST_INTERFACE_DEFAULT"
         _neutron_ovs_base_add_bridge "br-$GUEST_INTERFACE_DEFAULT"
         # Add $GUEST_INTERFACE_DEFAULT to that bridge
-        sudo ovs-vsctl add-port "br-$GUEST_INTERFACE_DEFAULT" $GUEST_INTERFACE_DEFAULT
+        sudo ovs-vsctl -- --may-exist add-port "br-$GUEST_INTERFACE_DEFAULT" $GUEST_INTERFACE_DEFAULT
+
+        # Create external bridge and add port
+        _neutron_ovs_base_add_bridge $PUBLIC_BRIDGE
+        sudo ovs-vsctl -- --may-exist add-port $PUBLIC_BRIDGE $PUBLIC_INTERFACE_DEFAULT
 
         # Set bridge mappings to "physnet1:br-$GUEST_INTERFACE_DEFAULT"
-        iniset "/$Q_PLUGIN_CONF_FILE.domU" ovs bridge_mappings "physnet1:br-$GUEST_INTERFACE_DEFAULT"
+        iniset "/$Q_PLUGIN_CONF_FILE.domU" ovs bridge_mappings "physnet1:br-$GUEST_INTERFACE_DEFAULT,physnet-ex:$PUBLIC_BRIDGE"
         # Set integration bridge to domU's
         iniset "/$Q_PLUGIN_CONF_FILE.domU" ovs integration_bridge $OVS_BRIDGE
         # Set root wrap

From c175040103b6a903c286a253f0df0ddc468feae3 Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Thu, 12 Nov 2015 11:03:20 +0100
Subject: [PATCH 0071/2409] Fix typo in error message printed if ran under
 virtualenv

Commit title says it all. I don't know how you feel about these kind
of commits, I feel like it's a waste of resources but I also feel bad
when I see big/obvious typo.

Change-Id: If048bb2dbad1a0b5a13e56b5fa1e6ea7c01eb05e
---
 stack.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/stack.sh b/stack.sh
index 825ed968f3..36bf2afd48 100755
--- a/stack.sh
+++ b/stack.sh
@@ -99,10 +99,10 @@ fi
 # this explicit as it has come up on the mailing list.
 if [[ -n "$VIRTUAL_ENV" ]]; then
     echo "You appear to be running under a python virtualenv."
-    echo "DevStack does not support this, as we my break the"
+    echo "DevStack does not support this, as we may break the"
     echo "virtualenv you are currently in by modifying "
     echo "external system-level components the virtualenv relies on."
-    echo "We reccommend you use a separate virtual-machine if "
+    echo "We recommend you use a separate virtual-machine if "
     echo "you are worried about DevStack taking over your system."
     exit 1
 fi

From 33c9a67ead4b61a9eb423f71ca4f8e062c3b5ebd Mon Sep 17 00:00:00 2001
From: Atsushi SAKAI <sakaia@jp.fujitsu.com>
Date: Thu, 12 Nov 2015 19:50:00 +0900
Subject: [PATCH 0072/2409] Fix typos on three comments and one message

Fixes typos on three comments and one message
in functions/functions-common

Change-Id: I2c926ca29b284afd4534b92860fa46f248676a83
---
 functions        | 2 +-
 functions-common | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/functions b/functions
index ca5955e974..34da1ba733 100644
--- a/functions
+++ b/functions
@@ -410,7 +410,7 @@ function get_instance_ip {
     ip=$(echo "$nova_result" | grep "$network_name" | get_field 2)
     if [[ $ip = "" ]];then
         echo "$nova_result"
-        die $LINENO "[Fail] Coudn't get ipaddress of VM"
+        die $LINENO "[Fail] Couldn't get ipaddress of VM"
     fi
     echo $ip
 }
diff --git a/functions-common b/functions-common
index 5c97aee9a3..98ecfb26ae 100644
--- a/functions-common
+++ b/functions-common
@@ -1036,7 +1036,7 @@ function _parse_package_files {
                 # We are using BASH regexp matching feature.
                 package=${BASH_REMATCH[1]}
                 distros=${BASH_REMATCH[2]}
-                # In bash ${VAR,,} will lowecase VAR
+                # In bash ${VAR,,} will lowercase VAR
                 # Look for a match in the distro list
                 if [[ ! ${distros,,} =~ ${DISTRO,,} ]]; then
                     # If no match then skip this package
@@ -1509,7 +1509,7 @@ function stop_process {
                 # this fixed in all services:
                 # https://bugs.launchpad.net/oslo-incubator/+bug/1446583
                 sleep 1
-                # /bin/true becakse pkill on a non existant process returns an error
+                # /bin/true because pkill on a non existent process returns an error
                 pkill -g $(cat $SERVICE_DIR/$SCREEN_NAME/$service.pid) || /bin/true
             fi
             rm $SERVICE_DIR/$SCREEN_NAME/$service.pid
@@ -1717,7 +1717,7 @@ function plugin_override_defaults {
         if [[ -f $dir/devstack/override-defaults ]]; then
             # be really verbose that an override is happening, as it
             # may not be obvious if things fail later.
-            echo "$plugin has overriden the following defaults"
+            echo "$plugin has overridden the following defaults"
             cat $dir/devstack/override-defaults
             source $dir/devstack/override-defaults
         fi

From adcf40d5f8ec0509fe9230e04bf0bd3f269a3f53 Mon Sep 17 00:00:00 2001
From: Attila Fazekas <afazekas@redhat.com>
Date: Thu, 5 Nov 2015 09:47:38 +0100
Subject: [PATCH 0073/2409] Ensure python is installed

devstack can call python before parsing the
package requirements, so the python installation
needs to be done eralier.

Closes-Bug: #1488625
Change-Id: I85cca899aeedd741cf7dc695435d61390e260f22
---
 stack.sh | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/stack.sh b/stack.sh
index 825ed968f3..afb695836b 100755
--- a/stack.sh
+++ b/stack.sh
@@ -335,6 +335,10 @@ if [ -z "`grep ^127.0.0.1 /etc/hosts | grep $LOCAL_HOSTNAME`" ]; then
     sudo sed -i "s/\(^127.0.0.1.*\)/\1 $LOCAL_HOSTNAME/" /etc/hosts
 fi
 
+# Ensure python is installed
+# --------------------------
+is_package_installed python || install_package python
+
 
 # Configure Logging
 # -----------------

From 790266f0d2b752627a8ac641c8f1c9ba1e8e85e8 Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Wed, 11 Nov 2015 13:36:35 -0500
Subject: [PATCH 0074/2409] Delete $IPV6_PUBLIC_NETWORK_GATEWAY IP during
 cleanup

So that it does not end up being the IP address that is picked to move
back to $PUBLIC_INTERFACE when we call _move_neutron_address_route

Change-Id: I3d29d4f11feff308f6ad5d950ef004b48ec11b67
Closes-Bug: 1514984
---
 lib/neutron-legacy | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index eed477a550..35029a2031 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -835,6 +835,10 @@ function cleanup_neutron {
         _move_neutron_addresses_route "$OVS_PHYSICAL_BRIDGE" "$PUBLIC_INTERFACE" False "inet"
 
         if [[ $(ip -f inet6 a s dev "$OVS_PHYSICAL_BRIDGE" | grep -c 'global') != 0 ]]; then
+            # ip(8) wants the prefix length when deleting
+            local v6_gateway
+            v6_gateway=$(ip -6 a s dev $OVS_PHYSICAL_BRIDGE | grep $IPV6_PUBLIC_NETWORK_GATEWAY | awk '{ print $2 }')
+            sudo ip -6 addr del $v6_gateway dev $OVS_PHYSICAL_BRIDGE
             _move_neutron_addresses_route "$OVS_PHYSICAL_BRIDGE" "$PUBLIC_INTERFACE" False "inet6"
         fi
 

From fe7b56cdefa4d5cb99b868e5659128601edf3600 Mon Sep 17 00:00:00 2001
From: Atsushi SAKAI <sakaia@jp.fujitsu.com>
Date: Fri, 13 Nov 2015 17:06:16 +0900
Subject: [PATCH 0075/2409] Fix typos for stack.sh and lib of comments and
 message

Fix 10 comments and 1 message

stack.sh
  Certicate => Certificate (comment)
lib/stack
  Sentinal => Sentinel (comment)
lib/neutron-legacy
  overriden => overridden (comment)
  necesssary => necessary (comment)
  notifiy => notify (message)
  notifations => notifications (comment)
lib/rpc_backend
  orginal => original (comment)
  cofiguration => configuration (comment)
lib/stack
  confgured => configured (comment)
lib/swift
  additinal => additional (comment)
  calclution => calculation (comment)
  maximun => maximum (comment)

Change-Id: I3637388b67decb007cd49af9addecc654009559b
---
 lib/neutron-legacy | 6 +++---
 lib/rpc_backend    | 4 ++--
 lib/stack          | 2 +-
 lib/swift          | 6 +++---
 stack.sh           | 4 ++--
 5 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index c244e5470a..a38b1c1d7e 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -256,7 +256,7 @@ ENABLE_TENANT_TUNNELS=${ENABLE_TENANT_TUNNELS:-True}
 
 # If using GRE tunnels for tenant networks, specify the range of
 # tunnel IDs from which tenant networks are allocated. Can be
-# overriden in ``localrc`` in necesssary.
+# overridden in ``localrc`` in necessary.
 TENANT_TUNNEL_RANGES=${TENANT_TUNNEL_RANGES:-1:1000}
 
 # To use VLANs for tenant networks, set to True in localrc. VLANs
@@ -537,7 +537,7 @@ function create_neutron_initial_network {
 
     if is_provider_network; then
         die_if_not_set $LINENO PHYSICAL_NETWORK "You must specify the PHYSICAL_NETWORK"
-        die_if_not_set $LINENO PROVIDER_NETWORK_TYPE "You must specifiy the PROVIDER_NETWORK_TYPE"
+        die_if_not_set $LINENO PROVIDER_NETWORK_TYPE "You must specify the PROVIDER_NETWORK_TYPE"
         NET_ID=$(neutron net-create $PHYSICAL_NETWORK --tenant_id $TENANT_ID --provider:network_type $PROVIDER_NETWORK_TYPE --provider:physical_network "$PHYSICAL_NETWORK" ${SEGMENTATION_ID:+--provider:segmentation_id $SEGMENTATION_ID} --shared | grep ' id ' | get_field 2)
         die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PHYSICAL_NETWORK $TENANT_ID"
 
@@ -1123,7 +1123,7 @@ function _configure_neutron_service {
     iniset $NEUTRON_CONF DEFAULT auth_strategy $Q_AUTH_STRATEGY
     _neutron_setup_keystone $NEUTRON_CONF keystone_authtoken
 
-    # Configuration for neutron notifations to nova.
+    # Configuration for neutron notifications to nova.
     iniset $NEUTRON_CONF DEFAULT notify_nova_on_port_status_changes $Q_NOTIFY_NOVA_PORT_STATUS_CHANGES
     iniset $NEUTRON_CONF DEFAULT notify_nova_on_port_data_changes $Q_NOTIFY_NOVA_PORT_DATA_CHANGES
 
diff --git a/lib/rpc_backend b/lib/rpc_backend
index 03eacd8674..298dcb6e5f 100644
--- a/lib/rpc_backend
+++ b/lib/rpc_backend
@@ -58,7 +58,7 @@ function restart_rpc_backend {
         # NOTE(bnemec): Retry initial rabbitmq configuration to deal with
         # the fact that sometimes it fails to start properly.
         # Reference: https://bugzilla.redhat.com/show_bug.cgi?id=1144100
-        # NOTE(tonyb): Extend the orginal retry logic to only restart rabbitmq
+        # NOTE(tonyb): Extend the original retry logic to only restart rabbitmq
         # every second time around the loop.
         # See: https://bugs.launchpad.net/devstack/+bug/1449056 for details on
         # why this is needed.  This can bee seen on vivid and Debian unstable
@@ -106,7 +106,7 @@ function get_transport_url {
     fi
 }
 
-# iniset cofiguration
+# iniset configuration
 function iniset_rpc_backend {
     local package=$1
     local file=$2
diff --git a/lib/stack b/lib/stack
index 47e8ce2a22..7d98604b82 100644
--- a/lib/stack
+++ b/lib/stack
@@ -14,7 +14,7 @@
 # Functions
 # ---------
 
-# Generic service install handles venv creation if confgured for service
+# Generic service install handles venv creation if configured for service
 # stack_install_service service
 function stack_install_service {
     local service=$1
diff --git a/lib/swift b/lib/swift
index 3a8e80dd44..634d6ccb35 100644
--- a/lib/swift
+++ b/lib/swift
@@ -123,13 +123,13 @@ SWIFT_REPLICAS_SEQ=$(seq ${SWIFT_REPLICAS})
 # trace through the logs when looking for its use.
 SWIFT_LOG_TOKEN_LENGTH=${SWIFT_LOG_TOKEN_LENGTH:-12}
 
-# Set ``SWIFT_MAX_HEADER_SIZE`` to configure the maximun length of headers in
+# Set ``SWIFT_MAX_HEADER_SIZE`` to configure the maximum length of headers in
 # Swift API
 SWIFT_MAX_HEADER_SIZE=${SWIFT_MAX_HEADER_SIZE:-16384}
 
 # Set ``OBJECT_PORT_BASE``, ``CONTAINER_PORT_BASE``, ``ACCOUNT_PORT_BASE``
-# Port bases used in port number calclution for the service "nodes"
-# The specified port number will be used, the additinal ports calculated by
+# Port bases used in port number calculation for the service "nodes"
+# The specified port number will be used, the additional ports calculated by
 # base_port + node_num * 10
 OBJECT_PORT_BASE=${OBJECT_PORT_BASE:-6613}
 CONTAINER_PORT_BASE=${CONTAINER_PORT_BASE:-6611}
diff --git a/stack.sh b/stack.sh
index 25c49c5709..d3d3fb2f60 100755
--- a/stack.sh
+++ b/stack.sh
@@ -926,8 +926,8 @@ fi
 restart_rpc_backend
 
 
-# Export Certicate Authority Bundle
-# ---------------------------------
+# Export Certificate Authority Bundle
+# -----------------------------------
 
 # If certificates were used and written to the SSL bundle file then these
 # should be exported so clients can validate their connections.

From 65a028bf1c3685e16fafbc7c44adaeeeb6e9cf58 Mon Sep 17 00:00:00 2001
From: "Chung Chih, Hung" <lyan.h@inwinstack.com>
Date: Fri, 13 Nov 2015 11:10:48 +0000
Subject: [PATCH 0076/2409] [ceph] Deploy ceph failed at controller node for
 multiple node

Controller node wouldn't install libvirt package. The package will only
been installed at nodes which had enable nova-compute.
We only need to configure libvirt secret if it had enable nova-compute.

Change-Id: I9cd6baf1820ce9f71c276d7e8b670307833578a5
Closes-Bug: 1515960
---
 extras.d/60-ceph.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/extras.d/60-ceph.sh b/extras.d/60-ceph.sh
index 38b901b767..cc90128176 100644
--- a/extras.d/60-ceph.sh
+++ b/extras.d/60-ceph.sh
@@ -32,7 +32,7 @@ if is_service_enabled ceph; then
             echo_summary "Configuring Cinder for Ceph"
             configure_ceph_cinder
         fi
-        if is_service_enabled cinder || is_service_enabled nova; then
+        if is_service_enabled n-cpu; then
             # NOTE (leseb): the part below is a requirement to attach Ceph block devices
             echo_summary "Configuring libvirt secret"
             import_libvirt_secret_ceph

From bbe59edb6f4a5828362c59a200f6ede00f97a4c3 Mon Sep 17 00:00:00 2001
From: Steve Martinelli <stevemar@ca.ibm.com>
Date: Wed, 21 Oct 2015 00:47:43 -0400
Subject: [PATCH 0077/2409] Use openstackclient in swift exercises

With the release of osc 1.8.0, swift support has been expanded and
we can now remove references to the swift CLI from this exercise
file. Also made minor improvements to comments.

Change-Id: I04069eb6251f8cbf8266183441b2cfdb64defd7d
---
 exercises/swift.sh | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/exercises/swift.sh b/exercises/swift.sh
index afcede81cd..4a41e0f1ed 100755
--- a/exercises/swift.sh
+++ b/exercises/swift.sh
@@ -2,7 +2,7 @@
 
 # **swift.sh**
 
-# Test swift via the ``swift`` command line from ``python-swiftclient``
+# Test swift via the ``python-openstackclient`` command line
 
 echo "*********************************************************************"
 echo "Begin DevStack Exercise: $0"
@@ -39,26 +39,29 @@ is_service_enabled s-proxy || exit 55
 
 # Container name
 CONTAINER=ex-swift
+OBJECT=/etc/issue
 
 
 # Testing Swift
 # =============
 
 # Check if we have to swift via keystone
-swift stat || die $LINENO "Failure getting status"
+openstack object store account show || die $LINENO "Failure getting account status"
 
 # We start by creating a test container
 openstack container create $CONTAINER || die $LINENO "Failure creating container $CONTAINER"
 
-# add some files into it.
-openstack object create $CONTAINER /etc/issue || die $LINENO "Failure uploading file to container $CONTAINER"
+# add a file into it.
+openstack object create $CONTAINER $OBJECT || die $LINENO "Failure uploading file to container $CONTAINER"
 
-# list them
+# list the objects
 openstack object list $CONTAINER || die $LINENO "Failure listing contents of container $CONTAINER"
 
-# And we may want to delete them now that we have tested that
-# everything works.
-swift delete $CONTAINER || die $LINENO "Failure deleting container $CONTAINER"
+# delete the object first
+openstack object delete $CONTAINER $OBJECT || die $LINENO "Failure deleting object $OBJECT in container $CONTAINER"
+
+# delete the container
+openstack container delete $CONTAINER || die $LINENO "Failure deleting container $CONTAINER"
 
 set +o xtrace
 echo "*********************************************************************"

From 01cf55a69259a52a9e5e8614347f238826c6a7ca Mon Sep 17 00:00:00 2001
From: yangyapeng <yang.yapeng@99cloud.net>
Date: Thu, 29 Oct 2015 13:21:29 -0400
Subject: [PATCH 0078/2409] Fix RST in configuration.rst

Fix minor RST issue from before file was converted.

Change-Id: Ie16ceace9c17e98010e068641ce60ba9a365ede0
---
 doc/source/configuration.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index e9921f049c..22841f6c13 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -211,7 +211,7 @@ Enabling Syslog
 Logging all services to a single syslog can be convenient. Enable
 syslogging by setting ``SYSLOG`` to ``True``. If the destination log
 host is not localhost ``SYSLOG_HOST`` and ``SYSLOG_PORT`` can be used
-to direct the message stream to the log host.  |
+to direct the message stream to the log host.
 
     ::
 

From ca7e4f285cfb68bae13e8df770dc2b5856559ecd Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 13 Nov 2015 11:15:15 +1100
Subject: [PATCH 0079/2409] Fix error detection & exit in report_results

We wish to fail if we have >0 zero errors, not >1 errors (i.e. exactly
one error did not trigger a failure!)

This change also brings consistency to the pass & failure paths by
ensuring report_results exits in both cases, since report_results is
supposed to be the last thing run in a test file.

Change-Id: Id4721dffe13721e6c3cd71bca40c3395627e98bf
---
 tests/unittest.sh | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/tests/unittest.sh b/tests/unittest.sh
index df7a8b4534..2570319fbf 100644
--- a/tests/unittest.sh
+++ b/tests/unittest.sh
@@ -92,16 +92,17 @@ function assert_empty {
     fi
 }
 
-# print a summary of passing and failing tests, exiting
-# with an error if we have failed tests
+# Print a summary of passing and failing tests and exit
+# (with an error if we have failed tests)
 #  usage: report_results
 function report_results {
     echo "$PASS Tests PASSED"
-    if [[ $ERROR -gt 1 ]]; then
+    if [[ $ERROR -gt 0 ]]; then
         echo
         echo "The following $ERROR tests FAILED"
         echo -e "$FAILED_FUNCS"
         echo "---"
         exit 1
     fi
+    exit 0
 }

From ecf06dbadb7c4cafb7a2fab13e58c1b05dd8a3f2 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 9 Nov 2015 17:42:23 +1100
Subject: [PATCH 0080/2409] Add test for package file ordering

Add a simple test to ensure package install files remain sorted
alphabetically (follow-on from the sorting of the files done in
I01e42defbf778626afd8dd457f93f0b02dd1a19d)

Change-Id: I75568871e92afcd81dac2c3ce18b84aa34cdd289
---
 tests/test_package_ordering.sh | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)
 create mode 100755 tests/test_package_ordering.sh

diff --git a/tests/test_package_ordering.sh b/tests/test_package_ordering.sh
new file mode 100755
index 0000000000..a568abf928
--- /dev/null
+++ b/tests/test_package_ordering.sh
@@ -0,0 +1,32 @@
+#!/bin/bash
+
+# basic test to ensure that package-install files remain sorted
+# alphabetically.
+
+TOP=$(cd $(dirname "$0")/.. && pwd)
+
+source $TOP/tests/unittest.sh
+
+PKG_FILES=$(find $TOP/files/debs $TOP/files/rpms $TOP/files/rpms-suse -type f)
+
+TMPDIR=$(mktemp -d)
+
+SORTED=${TMPDIR}/sorted
+UNSORTED=${TMPDIR}/unsorted
+
+for p in $PKG_FILES; do
+    grep -v '^#' $p > ${UNSORTED}
+    sort ${UNSORTED} > ${SORTED}
+
+    if [ -n "$(diff -c ${UNSORTED} ${SORTED})" ]; then
+        failed "$p is unsorted"
+        # output this, it's helpful to see what exactly is unsorted
+        diff -c ${UNSORTED} ${SORTED}
+    else
+        passed "$p is sorted"
+    fi
+done
+
+rm -rf ${TMPDIR}
+
+report_results

From 199d857442108326959d391c337e3b02b98a1b1e Mon Sep 17 00:00:00 2001
From: Johan Pas <j20012@outlook.com>
Date: Tue, 17 Nov 2015 00:56:25 +0100
Subject: [PATCH 0081/2409] Remove brackets from IPv6 address in mysql cfgfile

stack.sh creates a user-specific configuration file ~/.my.cnf for mysql.
If devstack is installed with SERVICE_IP_VERSION=6 option in local.conf,
the IPv6 host address was stored in the ~/.my.cnf file with square
brackets. However mysql does not use bracketing for IPv6 addresses,
resulting in 'Unknown MySQL server host' error when 'mysql' command is
run. With this patch IPv6 host address is written to ~/.my.cnf without
brackets.

Closes-Bug: #1516776
Change-Id: I27a7be8c75cf6b09b4a75dc4c9d09cd36bc5ac81
---
 lib/databases/mysql | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/databases/mysql b/lib/databases/mysql
index c2ab32e5b2..cc74b33327 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -143,7 +143,7 @@ MYSQL_PRESEED
 [client]
 user=$DATABASE_USER
 password=$DATABASE_PASSWORD
-host=$DATABASE_HOST
+host=$MYSQL_HOST
 EOF
         chmod 0600 $HOME/.my.cnf
     fi

From 95a9ff0587adece32817b4f432588b1ab76a5972 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Thu, 12 Nov 2015 14:49:20 +1100
Subject: [PATCH 0082/2409] Add option to skip EPEL & other repo installs

Add an option to skip the EPEL & other repo installs for rhel7 based
platforms.

This option can serve two purposes; firstly as described in
I834f20e9ceae151788cec3649385da1274d7ba46 during platform bringup, a
publically available EPEL might not be available.  This will allow you
to pre-configure a hand-built repo, etc. so you can continue testing.

The other thing is that in a CI system you might be frequently
building images and pre-installing EPEL/RDO etc.  In that case this is
just extra work.

Change-Id: I9809449f4a43fa9b547c6e3ca92722c7f6e66d6a
---
 stack.sh | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/stack.sh b/stack.sh
index 9b811b7b67..e31cd604c5 100755
--- a/stack.sh
+++ b/stack.sh
@@ -263,9 +263,7 @@ fi
 # Some distros need to add repos beyond the defaults provided by the vendor
 # to pick up required packages.
 
-if is_fedora && [[ $DISTRO == "rhel7" ]]; then
-    # RHEL requires EPEL for many Open Stack dependencies
-
+function _install_epel_and_rdo {
     # NOTE: We always remove and install latest -- some environments
     # use snapshot images, and if EPEL version updates they break
     # unless we update them to latest version.
@@ -295,18 +293,27 @@ EOF
     sudo yum-config-manager --enable epel-bootstrap
     yum_install epel-release || \
         die $LINENO "Error installing EPEL repo, cannot continue"
-    # EPEL rpm has installed it's version
     sudo rm -f /etc/yum.repos.d/epel-bootstrap.repo
 
     # ... and also optional to be enabled
     sudo yum-config-manager --enable rhel-7-server-optional-rpms
 
+    # install the lastest RDO
     sudo yum install -y https://rdoproject.org/repos/rdo-release.rpm
 
     if is_oraclelinux; then
         sudo yum-config-manager --enable ol7_optional_latest ol7_addons ol7_MySQL56
     fi
+}
+
+# If you have all the repos installed above already setup (e.g. a CI
+# situation where they are on your image) you may choose to skip this
+# to speed things up
+SKIP_EPEL_INSTALL=$(trueorfalse False SKIP_EPEL_INSTALL)
 
+if is_fedora && [[ $DISTRO == "rhel7" ]] && \
+        [[ ${SKIP_EPEL_INSTALL} != True ]]; then
+    _install_epel_and_rdo
 fi
 
 

From cdba7b0e533b07d9ea896ced5085c5ce98ee2aaa Mon Sep 17 00:00:00 2001
From: Rob Crittenden <rcritten@redhat.com>
Date: Tue, 26 May 2015 15:33:45 -0400
Subject: [PATCH 0083/2409] Specify HTTPS URLs to fix tls-proxy mode

A number of new settings are required for glance, cinder
and keystone to be installable when the tls-proxy
service is enabled.

For cinder a new public_endpoint option was added and this
needs to be set to the secure port.

Keystone needs the admin_endpoint and public_endpoints
defined otherwise during discovery the default,
non-secure versions, will be returned.

The keystone authtoken identity_uri was set at its default value
in the glance registry and API configuration files.

Change-Id: Ibb944ad7eb000edc6bccfcded765d1976d4d46d0
Closes-Bug: #1460807
---
 lib/cinder   | 2 ++
 lib/glance   | 3 +++
 lib/keystone | 3 +++
 3 files changed, 8 insertions(+)

diff --git a/lib/cinder b/lib/cinder
index 1307c11f7a..cc203ad414 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -309,6 +309,8 @@ function configure_cinder {
     if is_service_enabled tls-proxy; then
         # Set the service port for a proxy to take the original
         iniset $CINDER_CONF DEFAULT osapi_volume_listen_port $CINDER_SERVICE_PORT_INT
+
+        iniset $CINDER_CONF DEFAULT public_endpoint $CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT
     fi
 
     if [ "$SYSLOG" != "False" ]; then
diff --git a/lib/glance b/lib/glance
index 2eb93a46e6..5712943bca 100644
--- a/lib/glance
+++ b/lib/glance
@@ -167,6 +167,9 @@ function configure_glance {
         iniset $GLANCE_API_CONF DEFAULT bind_port $GLANCE_SERVICE_PORT_INT
         iniset $GLANCE_API_CONF DEFAULT public_endpoint $GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT
         iniset $GLANCE_REGISTRY_CONF DEFAULT bind_port $GLANCE_REGISTRY_PORT_INT
+
+        iniset $GLANCE_API_CONF keystone_authtoken identity_uri $KEYSTONE_AUTH_URI
+        iniset $GLANCE_REGISTRY_CONF keystone_authtoken identity_uri $KEYSTONE_AUTH_URI
     fi
 
     # Register SSL certificates if provided
diff --git a/lib/keystone b/lib/keystone
index 5a2afbfe02..c484795c7e 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -233,6 +233,9 @@ function configure_keystone {
         # Set the service ports for a proxy to take the originals
         iniset $KEYSTONE_CONF eventlet_server public_port $KEYSTONE_SERVICE_PORT_INT
         iniset $KEYSTONE_CONF eventlet_server admin_port $KEYSTONE_AUTH_PORT_INT
+
+        iniset $KEYSTONE_CONF DEFAULT public_endpoint $KEYSTONE_SERVICE_URI
+        iniset $KEYSTONE_CONF DEFAULT admin_endpoint $KEYSTONE_AUTH_URI
     fi
 
     iniset $KEYSTONE_CONF DEFAULT admin_token "$SERVICE_TOKEN"

From bd4048a3c50e3cd215785e187e9e40b78bd064ae Mon Sep 17 00:00:00 2001
From: Steve Baker <sbaker@redhat.com>
Date: Wed, 18 Nov 2015 10:55:22 +1300
Subject: [PATCH 0084/2409] Never uninstall python-pip on fedora

Python in f23 and f22 depends on the python-pip package so removing it
results in a nonfunctional system. pip on fedora installs to /usr so pip
can safely override the system pip for all versions of Fedora.

Change-Id: I336c7ffdf00784ca8deba7d6612a08b96a0ad098
Closes-Bug: #1467569
---
 tools/install_pip.sh | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index ab5efb2e77..1728816890 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -111,8 +111,10 @@ get_versions
 
 # Eradicate any and all system packages
 
-# python in f23 depends on the python-pip package
-if ! { is_fedora && [[ $DISTRO == "f23" ]]; }; then
+# Python in f23 and f22 depends on the python-pip package so removing it
+# results in a nonfunctional system. pip on fedora installs to /usr so pip
+# can safely override the system pip for all versions of fedora
+if ! is_fedora ; then
     uninstall_package python-pip
 fi
 

From bb9caeae00bb9e4654838f782d2e07331f4ecae4 Mon Sep 17 00:00:00 2001
From: Brian Haley <brian.haley@hpe.com>
Date: Mon, 16 Nov 2015 17:18:42 -0500
Subject: [PATCH 0085/2409] Consolidate two /sbin/ip commands into a single one

When determining the primary IP/IPv6 addresses on a system,
we can use the /sbin/ip command to filter them for us.  The
resulting address is parsed the same way for both address
families, so we can use just a single command.

Change-Id: I0471ff5a258a16a23061941ac38063dbf3d7c233
---
 lib/neutron-legacy | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 85f7fc0a7c..978943dae2 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -801,13 +801,7 @@ function _move_neutron_addresses_route {
         DEFAULT_ROUTE_GW=$(ip -f $af r | awk "/default.+$from_intf/ { print \$3; exit }")
         local ADD_OVS_PORT=""
 
-        if [[ $af == "inet" ]]; then
-            IP_BRD=$(ip -f $af a s dev $from_intf | grep inet | awk '{ print $2, $3, $4; exit }')
-        fi
-
-        if [[ $af == "inet6" ]]; then
-            IP_BRD=$(ip -f $af a s dev $from_intf | grep 'scope global' | sed '/temporary/d' | awk '{ print $2, $3, $4; exit }')
-        fi
+        IP_BRD=$(ip -f $af a s dev $from_intf scope global primary | grep inet | awk '{ print $2, $3, $4; exit }')
 
         if [ "$DEFAULT_ROUTE_GW" != "" ]; then
             ADD_DEFAULT_ROUTE="sudo ip -f $af r replace default via $DEFAULT_ROUTE_GW dev $to_intf"

From 2960bfa7f63c26d94c8aed2c3e1a6ff039b530f0 Mon Sep 17 00:00:00 2001
From: Tushar Gohad <tushar.gohad@intel.com>
Date: Tue, 17 Nov 2015 14:06:28 -0700
Subject: [PATCH 0086/2409] Add liberasurecode-dev as a swift dependency

Swift requirement PyECLib won't bundle liberasurecode
going forward given the package is available in common
distros now.  This patch adds liberasurecode-dev(el)
package to the devstack debs/rpms list for Swift as a
PyECLib build/install dependency.

Change-Id: Idbc2ca3f677f1b8153ebf3a5912f4354525a55c7
---
 files/debs/swift      | 1 +
 files/rpms-suse/swift | 1 +
 files/rpms/swift      | 1 +
 3 files changed, 3 insertions(+)

diff --git a/files/debs/swift b/files/debs/swift
index 726786ee18..4b8ac3d793 100644
--- a/files/debs/swift
+++ b/files/debs/swift
@@ -1,4 +1,5 @@
 curl
+liberasurecode-dev
 make
 memcached
 sqlite3
diff --git a/files/rpms-suse/swift b/files/rpms-suse/swift
index 52e0a990e7..3663b98545 100644
--- a/files/rpms-suse/swift
+++ b/files/rpms-suse/swift
@@ -1,4 +1,5 @@
 curl
+liberasurecode-devel
 memcached
 sqlite3
 xfsprogs
diff --git a/files/rpms/swift b/files/rpms/swift
index f56a81b0d1..46dc59d74d 100644
--- a/files/rpms/swift
+++ b/files/rpms/swift
@@ -1,4 +1,5 @@
 curl
+liberasurecode-devel
 memcached
 pyxattr
 rsync-daemon # dist:f22,f23

From 93e2499ee1abfd2f9ed1ebda7a7d4d0deab04f80 Mon Sep 17 00:00:00 2001
From: Deepak C Shetty <deepakcs@redhat.com>
Date: Wed, 18 Nov 2015 12:29:33 +0530
Subject: [PATCH 0087/2409] doc: document override_defaults phase

override_defaults phase was added to devstack in [1]
but documentation was pending. This patch adds the
same. For history around override_defaults, one can
refer to the mail thread [2]

Also fixes a small typo

[1]: https://review.openstack.org/#/c/167933/
[2]: http://lists.openstack.org/pipermail/openstack-dev/2015-March/059621.html

Change-Id: I1b58ca0ce0e4b85a1dbd710b4c426606fd4dcf45
---
 doc/source/plugins.rst | 13 +++++++++++--
 extras.d/README.md     |  9 ++++++---
 2 files changed, 17 insertions(+), 5 deletions(-)

diff --git a/doc/source/plugins.rst b/doc/source/plugins.rst
index 8bd3797cd2..b8da7e1237 100644
--- a/doc/source/plugins.rst
+++ b/doc/source/plugins.rst
@@ -19,7 +19,16 @@ DevStack supports a standard mechanism for including plugins from
 external repositories. The plugin interface assumes the following:
 
 An external git repository that includes a ``devstack/`` top level
-directory. Inside this directory there can be 2 files.
+directory. Inside this directory there can be 3 files.
+
+- ``override_defaults`` - a file containing global variables that
+  will be sourced before the lib/* files. This allows the plugin
+  to override the defaults that are otherwise set in the lib/*
+  files.
+
+  For example, override_defaults may export CINDER_ENABLED_BACKENDS
+  to include the plugin-specific storage backend and thus be able
+  to override the default lvm only storage backend for Cinder.
 
 - ``settings`` - a file containing global variables that will be
   sourced very early in the process. This is helpful if other plugins
@@ -38,7 +47,7 @@ directory. Inside this directory there can be 2 files.
 
 - ``plugin.sh`` - the actual plugin. It is executed by devstack at
   well defined points during a ``stack.sh`` run. The plugin.sh
-  internal structure is discussed bellow.
+  internal structure is discussed below.
 
 
 Plugins are registered by adding the following to the localrc section
diff --git a/extras.d/README.md b/extras.d/README.md
index 7c2e4fe970..4cec14b4e7 100644
--- a/extras.d/README.md
+++ b/extras.d/README.md
@@ -14,10 +14,13 @@ The scripts are sourced at the beginning of each script that calls them. The
 entire `stack.sh` variable space is available.  The scripts are
 sourced with one or more arguments, the first of which defines the hook phase:
 
-    source | stack | unstack | clean
+    override_defaults | source | stack | unstack | clean
 
-    source: always called first in any of the scripts, used to set the
-        initial defaults in a lib/* script or similar
+    override_defaults: always called first in any of the scripts, used to
+        override defaults (if need be) that are otherwise set in lib/* scripts
+
+    source: called by stack.sh. Used to set the initial defaults in a lib/*
+        script or similar
 
     stack: called by stack.sh.  There are four possible values for
         the second arg to distinguish the phase stack.sh is in:

From 7860f2ba3189b0361693c8ee9c65d8d03fb115d6 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 17 Nov 2015 11:59:07 -0500
Subject: [PATCH 0088/2409] install ebtables locking workaround

ebtables is racing with itself when nova and libvirt attempt to create
rules at the same time in the nat table. ebtables now has an explicit
--concurrent flag, that all tools must opt into to prevent ebtables
from inherently being unsafe to run.

libvirt gained this support in 1.2.11, which is too new for our ubuntu
primary testing environment. Nova still hasn't added this support,
though even if it did, we'd run into the issue with libvirt.

We can do the most ghetto thing possible and create a wrapper for
ebtables that does explicit locking on it's own. It's pretty terrible,
but it should work. And it is the kind of work around that people
unable to upgrade libvirt will probably need to do.

This is an opt in value which we should set in the gate to True.

Related-Bug: #1501558

Change-Id: Ic6fa847eba34c21593b9df86a1c2c179534d0ba5
---
 files/ebtables.workaround            | 23 +++++++++++++++++++++
 lib/nova_plugins/functions-libvirt   |  5 +++++
 stackrc                              | 10 +++++++++
 tools/install_ebtables_workaround.sh | 31 ++++++++++++++++++++++++++++
 4 files changed, 69 insertions(+)
 create mode 100644 files/ebtables.workaround
 create mode 100755 tools/install_ebtables_workaround.sh

diff --git a/files/ebtables.workaround b/files/ebtables.workaround
new file mode 100644
index 0000000000..c8af51fad5
--- /dev/null
+++ b/files/ebtables.workaround
@@ -0,0 +1,23 @@
+#!/bin/bash
+#
+# Copyright 2015 Hewlett-Packard Development Company, L.P.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+#
+# This is a terrible, terrible, truly terrible work around for
+# environments that have libvirt < 1.2.11. ebtables requires that you
+# specifically tell it you would like to not race and get punched in
+# the face when 2 run at the same time with a --concurrent flag.
+
+flock -w 300 /var/lock/ebtables.nova /sbin/ebtables.real $@
diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index 78c59786d8..045fc8b919 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -31,6 +31,11 @@ function install_libvirt {
         fi
         install_package libvirt-bin libvirt-dev
         pip_install_gr libvirt-python
+        if [[ "$EBTABLES_RACE_FIX" == "True" ]]; then
+            # Work around for bug #1501558. We can remove this once we
+            # get to a version of Ubuntu that has new enough libvirt.
+            TOP_DIR=$TOP_DIR $TOP_DIR/tools/install_ebtables_workaround.sh
+        fi
         #pip_install_gr <there-si-no-guestfs-in-pypi>
     elif is_fedora || is_suse; then
         install_package kvm
diff --git a/stackrc b/stackrc
index 76a5756dde..53ed25d83e 100644
--- a/stackrc
+++ b/stackrc
@@ -769,6 +769,16 @@ GIT_DEPTH=${GIT_DEPTH:-0}
 # Use native SSL for servers in ``SSL_ENABLED_SERVICES``
 USE_SSL=$(trueorfalse False USE_SSL)
 
+# ebtables is inherently racey. If you run it by two or more processes
+# simultaneously it will collide, badly, in the kernel and produce
+# failures or corruption of ebtables. The only way around it is for
+# all tools running ebtables to only ever do so with the --concurrent
+# flag. This requires libvirt >= 1.2.11.
+#
+# If you don't have this then the following work around will replace
+# ebtables with a wrapper script so that it is safe to run without
+# that flag.
+EBTABLES_RACE_FIX=$(trueorfalse False EBTABLES_RACE_FIX)
 
 # Following entries need to be last items in file
 
diff --git a/tools/install_ebtables_workaround.sh b/tools/install_ebtables_workaround.sh
new file mode 100755
index 0000000000..45ced87f13
--- /dev/null
+++ b/tools/install_ebtables_workaround.sh
@@ -0,0 +1,31 @@
+#!/bin/bash -eu
+#
+# Copyright 2015 Hewlett-Packard Development Company, L.P.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+#
+# This replaces the ebtables on your system with a wrapper script that
+# does implicit locking. This is needed if libvirt < 1.2.11 on your platform.
+
+EBTABLES=/sbin/ebtables
+EBTABLESREAL=/sbin/ebtables.real
+FILES=$TOP_DIR/files
+
+if [[ -f "$EBTABLES" ]]; then
+    if file $EBTABLES | grep ELF; then
+        sudo mv $EBTABLES $EBTABLESREAL
+        sudo install -m 0755 $FILES/ebtables.workaround $EBTABLES
+        echo "Replaced ebtables with locking workaround"
+    fi
+fi

From 2ba36cda7940d630514a7864132837191d8c561f Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Thu, 12 Nov 2015 13:52:36 +1100
Subject: [PATCH 0089/2409] Add vercmp function

The existing vercmp_numbers function only handles, as the name says,
numbers.  I noticed that "sort" has had a version sort for a long time
[1] and, rather than re-implement it badly, use this as a version of
vercmp that works a bit more naturally.

This is intended to be used in an "if" statement as in

  prog_ver=$(prog_ver --version | grep ...)
  if vercmp $prog_ver "<" 2.0; then
     ...
  fi

A test-case is added to test the basic features and some edge-cases.

[1] http://git.savannah.gnu.org/gitweb/?p=coreutils.git;a=commitdiff;h=4c9fae4e97d95a9f89d1399a8aeb03051f0fec96

Change-Id: Ie55283acdc40a095b80b2631a55310072883ad0d
---
 functions            | 46 +++++++++++++++++++++++++++++++++++++++++++
 tests/test_vercmp.sh | 47 ++++++++++++++++++++++++++++++++++++++++++++
 tests/unittest.sh    | 45 ++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 138 insertions(+)
 create mode 100755 tests/test_vercmp.sh

diff --git a/functions b/functions
index 34da1ba733..e5e3400ff8 100644
--- a/functions
+++ b/functions
@@ -527,12 +527,58 @@ function vercmp_numbers {
     typeset v1=$1 v2=$2 sep
     typeset -a ver1 ver2
 
+    deprecated "vercmp_numbers is deprecated for more generic vercmp"
+
     IFS=. read -ra ver1 <<< "$v1"
     IFS=. read -ra ver2 <<< "$v2"
 
     _vercmp_r "${#ver1[@]}" "${ver1[@]}" "${ver2[@]}"
 }
 
+# vercmp ver1 op ver2
+#  Compare VER1 to VER2
+#   - op is one of < <= == >= >
+#   - returns true if satisified
+#  e.g.
+#  if vercmp 1.0 "<" 2.0; then
+#    ...
+#  fi
+function vercmp {
+    local v1=$1
+    local op=$2
+    local v2=$3
+    local result
+
+    # sort the two numbers with sort's "-V" argument.  Based on if v2
+    # swapped places with v1, we can determine ordering.
+    result=$(echo -e "$v1\n$v2" | sort -V | head -1)
+
+    case $op in
+        "==")
+            [ "$v1" = "$v2" ]
+            return
+            ;;
+        ">")
+            [ "$v1" != "$v2" ] && [ "$result" = "$v2" ]
+            return
+            ;;
+        "<")
+            [ "$v1" != "$v2" ] && [ "$result" = "$v1" ]
+            return
+            ;;
+        ">=")
+            [ "$result" = "$v2" ]
+            return
+            ;;
+        "<=")
+            [ "$result" = "$v1" ]
+            return
+            ;;
+        *)
+            die $LINENO "unrecognised op: $op"
+            ;;
+    esac
+}
 
 # This function sets log formatting options for colorizing log
 # output to stdout. It is meant to be called by lib modules.
diff --git a/tests/test_vercmp.sh b/tests/test_vercmp.sh
new file mode 100755
index 0000000000..c88bf86d7e
--- /dev/null
+++ b/tests/test_vercmp.sh
@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+
+# Tests for DevStack vercmp functionality
+
+TOP=$(cd $(dirname "$0")/.. && pwd)
+
+# Import common functions
+source $TOP/functions
+source $TOP/tests/unittest.sh
+
+assert_true "numeric gt"  vercmp 2.0 ">" 1.0
+assert_true "numeric gte" vercmp 2.0 ">=" 1.0
+assert_true "numeric gt"  vercmp 1.0.1 ">" 1.0
+assert_true "numeric gte" vercmp 1.0.1 ">=" 1.0
+assert_true "alpha gt"    vercmp 1.0.1b ">" 1.0.1a
+assert_true "alpha gte"   vercmp 1.0.1b ">=" 1.0.1a
+assert_true "alpha gt"    vercmp b ">" a
+assert_true "alpha gte"   vercmp b ">=" a
+assert_true "alpha gt"    vercmp 2.0-rc3 ">" 2.0-rc1
+assert_true "alpha gte"   vercmp 2.0-rc3 ">=" 2.0-rc1
+
+assert_false "numeric gt fail"  vercmp 1.0 ">" 1.0
+assert_true  "numeric gte"      vercmp 1.0 ">=" 1.0
+assert_false "numeric gt fail"  vercmp 0.9 ">" 1.0
+assert_false "numeric gte fail" vercmp 0.9 ">=" 1.0
+assert_false "numeric gt fail"  vercmp 0.9.9 ">" 1.0
+assert_false "numeric gte fail" vercmp 0.9.9 ">=" 1.0
+assert_false "numeric gt fail"  vercmp 0.9a.9 ">" 1.0.1
+assert_false "numeric gte fail" vercmp 0.9a.9 ">=" 1.0.1
+
+assert_false "numeric lt"  vercmp 1.0 "<" 1.0
+assert_true  "numeric lte" vercmp 1.0 "<=" 1.0
+assert_true "numeric lt"   vercmp 1.0 "<" 1.0.1
+assert_true "numeric lte"  vercmp 1.0 "<=" 1.0.1
+assert_true "alpha lt"     vercmp 1.0.1a "<" 1.0.1b
+assert_true "alpha lte"    vercmp 1.0.1a "<=" 1.0.1b
+assert_true "alpha lt"     vercmp a "<" b
+assert_true "alpha lte"    vercmp a "<=" b
+assert_true "alpha lt"     vercmp 2.0-rc1 "<" 2.0-rc3
+assert_true "alpha lte"    vercmp 2.0-rc1 "<=" 2.0-rc3
+
+assert_true "eq"       vercmp 1.0 "==" 1.0
+assert_true "eq"       vercmp 1.0.1 "==" 1.0.1
+assert_false "eq fail" vercmp 1.0.1 "==" 1.0.2
+assert_false "eq fail" vercmp 2.0-rc1 "==" 2.0-rc2
+
+report_results
diff --git a/tests/unittest.sh b/tests/unittest.sh
index 2570319fbf..6c697d7925 100644
--- a/tests/unittest.sh
+++ b/tests/unittest.sh
@@ -92,6 +92,51 @@ function assert_empty {
     fi
 }
 
+# assert the arguments evaluate to true
+#  assert_true "message" arg1 arg2
+function assert_true {
+    local lineno
+    lineno=`caller 0 | awk '{print $1}'`
+    local function
+    function=`caller 0 | awk '{print $2}'`
+    local msg=$1
+    shift
+
+    $@
+    if [ $? -eq 0 ]; then
+        PASS=$((PASS+1))
+        echo "PASS: $function:L$lineno - $msg"
+    else
+        FAILED_FUNCS+="$function:L$lineno\n"
+        echo "ERROR: test failed in $function:L$lineno!"
+        echo "  $msg"
+        ERROR=$((ERROR+1))
+    fi
+}
+
+# assert the arguments evaluate to false
+#  assert_false "message" arg1 arg2
+function assert_false {
+    local lineno
+    lineno=`caller 0 | awk '{print $1}'`
+    local function
+    function=`caller 0 | awk '{print $2}'`
+    local msg=$1
+    shift
+
+    $@
+    if [ $? -eq 0 ]; then
+        FAILED_FUNCS+="$function:L$lineno\n"
+        echo "ERROR: test failed in $function:L$lineno!"
+        echo "  $msg"
+        ERROR=$((ERROR+1))
+    else
+        PASS=$((PASS+1))
+        echo "PASS: $function:L$lineno - $msg"
+    fi
+}
+
+
 # Print a summary of passing and failing tests and exit
 # (with an error if we have failed tests)
 #  usage: report_results

From e0129f3c248d8f246b470e21982cfefb919482b6 Mon Sep 17 00:00:00 2001
From: Attila Fazekas <afazekas@redhat.com>
Date: Thu, 19 Nov 2015 10:47:58 +0100
Subject: [PATCH 0090/2409] Fedora 23 supported

This change allows to use f23 without the FORCE=yes option.

Make sure you have latest kernel, or you have kernel-modules
installed for the running kernel.

f21 support will be removed when the gate jobs are upgraded
to use newer fedora version.

Change-Id: I6e3e64088187a7f6da745e3cfb07524fd31782ab
---
 files/rpms/general | 4 ++--
 lib/ceph           | 2 +-
 stack.sh           | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/files/rpms/general b/files/rpms/general
index 40b06f489b..280468283b 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -8,9 +8,9 @@ gcc-c++
 gettext  # used for compiling message catalogs
 git-core
 graphviz # needed only for docs
-iptables-services  # NOPRIME f21,f22
+iptables-services  # NOPRIME f21,f22,f23
 java-1.7.0-openjdk-headless  # NOPRIME rhel7
-java-1.8.0-openjdk-headless  # NOPRIME f21,f22
+java-1.8.0-openjdk-headless  # NOPRIME f21,f22,f23
 libffi-devel
 libjpeg-turbo-devel # Pillow 3.0.0
 libxml2-devel # lxml
diff --git a/lib/ceph b/lib/ceph
index 29d2aca54f..f573136a4e 100644
--- a/lib/ceph
+++ b/lib/ceph
@@ -116,7 +116,7 @@ function undefine_virsh_secret {
 
 # check_os_support_ceph() - Check if the operating system provides a decent version of Ceph
 function check_os_support_ceph {
-    if [[ ! ${DISTRO} =~ (trusty|f21|f22) ]]; then
+    if [[ ! ${DISTRO} =~ (trusty|f21|f22|f23) ]]; then
         echo "WARNING: your distro $DISTRO does not provide (at least) the Firefly release. Please use Ubuntu Trusty or Fedora 20 (and higher)"
         if [[ "$FORCE_CEPH_INSTALL" != "yes" ]]; then
             die $LINENO "If you wish to install Ceph on this distribution anyway run with FORCE_CEPH_INSTALL=yes"
diff --git a/stack.sh b/stack.sh
index a3d943a4df..537f81e253 100755
--- a/stack.sh
+++ b/stack.sh
@@ -192,7 +192,7 @@ source $TOP_DIR/stackrc
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (precise|trusty|vivid|wily|7.0|wheezy|sid|testing|jessie|f21|f22|rhel7) ]]; then
+if [[ ! ${DISTRO} =~ (precise|trusty|vivid|wily|7.0|wheezy|sid|testing|jessie|f21|f22|f23|rhel7) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From 7f0be4fc5f5bd8f45087e53c94fae3b9146f486e Mon Sep 17 00:00:00 2001
From: "Swapnil Kulkarni (coolsvap)" <me@coolsvap.net>
Date: Fri, 20 Nov 2015 10:52:59 +0530
Subject: [PATCH 0091/2409] Updated Typos in devstack

(1/5) Updated HACKING.rst for typos
(2/5) Updated typos in lib/dlm
(3/5) Updated typos in lib/ironic
(4/5) Updated typos in unittest.sh
(5/5) Updated typos in test_meta_config.sh

Change-Id: I7aafa3af69df9dc6a5923a8557f380d48b73433a
---
 HACKING.rst               | 2 +-
 lib/dlm                   | 2 +-
 lib/ironic                | 4 ++--
 tests/test_meta_config.sh | 2 +-
 tests/unittest.sh         | 2 +-
 5 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/HACKING.rst b/HACKING.rst
index d66687e351..d763c75b8b 100644
--- a/HACKING.rst
+++ b/HACKING.rst
@@ -328,7 +328,7 @@ There are some broad criteria that will be followed when reviewing
 your change
 
 * **Is it passing tests** -- your change will not be reviewed
-  throughly unless the official CI has run successfully against it.
+  thoroughly unless the official CI has run successfully against it.
 
 * **Does this belong in DevStack** -- DevStack reviewers have a
   default position of "no" but are ready to be convinced by your
diff --git a/lib/dlm b/lib/dlm
index f68ee26b4b..95e9b0ac3d 100644
--- a/lib/dlm
+++ b/lib/dlm
@@ -46,7 +46,7 @@ ZOOKEEPER_CONF_DIR=/etc/zookeeper
 # - cleanup_dlm
 
 # This should be declared in the settings file of any plugin or
-# service that needs to have a dlm in their enviroment.
+# service that needs to have a dlm in their environment.
 function use_dlm {
     enable_service $(dlm_backend)
 }
diff --git a/lib/ironic b/lib/ironic
index 016e639d03..6a32983b24 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -92,7 +92,7 @@ IRONIC_VM_LOG_DIR=${IRONIC_VM_LOG_DIR:-$IRONIC_DATA_DIR/logs/}
 # Use DIB to create deploy ramdisk and kernel.
 IRONIC_BUILD_DEPLOY_RAMDISK=$(trueorfalse True IRONIC_BUILD_DEPLOY_RAMDISK)
 # If not use DIB, these files are used as deploy ramdisk/kernel.
-# (The value must be a absolute path)
+# (The value must be an absolute path)
 IRONIC_DEPLOY_RAMDISK=${IRONIC_DEPLOY_RAMDISK:-}
 IRONIC_DEPLOY_KERNEL=${IRONIC_DEPLOY_KERNEL:-}
 IRONIC_DEPLOY_ELEMENT=${IRONIC_DEPLOY_ELEMENT:-deploy-ironic}
@@ -672,7 +672,7 @@ function configure_iptables {
     # enable tftp natting for allowing connections to HOST_IP's tftp server
     sudo modprobe nf_conntrack_tftp
     sudo modprobe nf_nat_tftp
-    # explicitly allow DHCP - packets are occassionally being dropped here
+    # explicitly allow DHCP - packets are occasionally being dropped here
     sudo iptables -I INPUT -p udp --dport 67:68 --sport 67:68 -j ACCEPT || true
     # nodes boot from TFTP and callback to the API server listening on $HOST_IP
     sudo iptables -I INPUT -d $HOST_IP -p udp --dport 69 -j ACCEPT || true
diff --git a/tests/test_meta_config.sh b/tests/test_meta_config.sh
index f3e94af8f8..327fb56185 100755
--- a/tests/test_meta_config.sh
+++ b/tests/test_meta_config.sh
@@ -24,7 +24,7 @@ function check_result {
 }
 
 # mock function-common:die so that it does not
-# interupt our test script
+# interrupt our test script
 function die {
     exit -1
 }
diff --git a/tests/unittest.sh b/tests/unittest.sh
index 2570319fbf..26b5b8e592 100644
--- a/tests/unittest.sh
+++ b/tests/unittest.sh
@@ -46,7 +46,7 @@ function failed {
     ERROR=$((ERROR+1))
 }
 
-# assert string comparision of val1 equal val2, printing out msg
+# assert string comparison of val1 equal val2, printing out msg
 #  usage: assert_equal val1 val2 msg
 function assert_equal {
     local lineno

From 255a58fec613b1304c8396cd969c72043073be30 Mon Sep 17 00:00:00 2001
From: Komei Shimamura <komei.t.f@gmail.com>
Date: Fri, 20 Nov 2015 18:36:05 +0900
Subject: [PATCH 0092/2409] Add existing devstack plugins to the devstack
 plugin list

Change-Id: I336a4c652a78e778e39652f1f16ff69be10ab065
---
 doc/source/plugin-registry.rst | 34 ++++++++++++++++++++++++----------
 1 file changed, 24 insertions(+), 10 deletions(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 49b3a7fc02..429f31af2d 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -76,16 +76,30 @@ Alternate Configs
 Additional Services
 ===================
 
-+----------------+--------------------------------------------------+------------+
-| Plugin Name    | URL                                              | Comments   |
-|                |                                                  |            |
-+----------------+--------------------------------------------------+------------+
-|ec2-api         |git://git.openstack.org/openstack/ec2-api         |[as1]_      |
-+----------------+--------------------------------------------------+------------+
-|ironic-inspector|git://git.openstack.org/openstack/ironic-inspector|            |
-+----------------+--------------------------------------------------+------------+
-|                |                                                  |            |
-+----------------+--------------------------------------------------+------------+
++-----------------+------------------------------------------------------------+------------+
+| Plugin Name     | URL                                                        | Comments   |
+|                 |                                                            |            |
++-----------------+------------------------------------------------------------+------------+
+|amqp1            |git://git.openstack.org/openstack/devstack-plugin-amqp1     |            |
++-----------------+------------------------------------------------------------+------------+
+|bdd              |git://git.openstack.org/openstack/devstack-plugin-bdd       |            |
++-----------------+------------------------------------------------------------+------------+
+|ec2-api          |git://git.openstack.org/openstack/ec2-api                   |[as1]_      |
++-----------------+------------------------------------------------------------+------------+
+|glusterfs        |git://git.openstack.org/openstack/devstack-plugin-glusterfs |            |
++-----------------+------------------------------------------------------------+------------+
+|hdfs             |git://git.openstack.org/openstack/devstack-plugin-hdfs      |            |
++-----------------+------------------------------------------------------------+------------+
+|ironic-inspector |git://git.openstack.org/openstack/ironic-inspector          |            |
++-----------------+------------------------------------------------------------+------------+
+|pika             |git://git.openstack.org/openstack/devstack-plugin-pika      |            |
++-----------------+------------------------------------------------------------+------------+
+|sheepdog         |git://git.openstack.org/openstack/devstack-plugin-sheepdog  |            |
++-----------------+------------------------------------------------------------+------------+
+|zmq              |git://git.openstack.org/openstack/devstack-plugin-zmq       |            |
++-----------------+------------------------------------------------------------+------------+
+|                 |                                                            |            |
++-----------------+------------------------------------------------------------+------------+
 
 .. [as1] first functional devstack plugin, hence why used in most of
          the examples.

From c18b4a4e5c4ffa25fba1da0ec99c3ff061d1472e Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 18 Nov 2015 10:02:31 -0500
Subject: [PATCH 0093/2409] remove precise from the supported list

We haven't been testing master on precise for a long time, and changes
are coming that won't work on precise. If people want to keep running
on precise they should realize they are on their own with it. And that
we won't block any changes that use it.

Change-Id: I3697f1c2409ad08f49793dabb37011606188e6f6
---
 stack.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index 537f81e253..8625b5aaeb 100755
--- a/stack.sh
+++ b/stack.sh
@@ -192,7 +192,7 @@ source $TOP_DIR/stackrc
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (precise|trusty|vivid|wily|7.0|wheezy|sid|testing|jessie|f21|f22|f23|rhel7) ]]; then
+if [[ ! ${DISTRO} =~ (trusty|vivid|wily|7.0|wheezy|sid|testing|jessie|f21|f22|f23|rhel7) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From f0dd6894af777d53c6d158d0720ea1b189f065a7 Mon Sep 17 00:00:00 2001
From: vsaienko <vsaienko@mirantis.com>
Date: Wed, 18 Nov 2015 10:12:34 +0200
Subject: [PATCH 0094/2409] Use autogenerated flavor id

Fix to trove has been merged, and autogenerated flavor ID
is available since Kilo.

Related-Bug: #1333852

Change-Id: Ie4b3dd11a23fa5f91cf9ff22dd05f1afd0532cb4
---
 lib/ironic | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/lib/ironic b/lib/ironic
index 016e639d03..294115cafe 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -652,13 +652,9 @@ function enroll_nodes {
         total_cpus=$((total_cpus+$ironic_node_cpu))
     done < $ironic_hwinfo_file
 
-    # create the nova flavor
-    # NOTE(adam_g): Attempting to use an autogenerated UUID for flavor id here uncovered
-    # bug (LP: #1333852) in Trove.  This can be changed to use an auto flavor id when the
-    # bug is fixed in Juno.
     local adjusted_disk
     adjusted_disk=$(($ironic_node_disk - $ironic_ephemeral_disk))
-    nova flavor-create --ephemeral $ironic_ephemeral_disk baremetal 551 $ironic_node_ram $adjusted_disk $ironic_node_cpu
+    nova flavor-create --ephemeral $ironic_ephemeral_disk baremetal auto $ironic_node_ram $adjusted_disk $ironic_node_cpu
 
     nova flavor-key baremetal set "cpu_arch"="x86_64"
 

From a366b97c0a76304bf0ddf7eb78e0efb4493df221 Mon Sep 17 00:00:00 2001
From: obutenko <obutenko@mirantis.com>
Date: Tue, 20 Oct 2015 19:07:04 +0300
Subject: [PATCH 0095/2409] Add flag for test_incremental_backup

Forced creation of incremental backup is not
implemented in old release (Juno and Kilo).
The test is skipped by default for Juno and Kilo gates.
Need to add flag to unskip this test in new release.

New test: Idde2c14aba78382b1063ce20269f4832f9fdd583
Change-Id: I565b5941d6067644fc9ca6cb0891d97f4946e031
Partial-Bug: #1506394
---
 lib/tempest | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index 76fd6cac74..202f6d93e7 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -463,6 +463,8 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG volume-feature-enabled bootable True
     # TODO(jordanP): Remove the extend_with_snapshot flag when Juno is end of life.
     iniset $TEMPEST_CONFIG volume-feature-enabled extend_with_snapshot True
+    # TODO(obutenko): Remove the incremental_backup_force flag when Kilo and Juno is end of life.
+    iniset $TEMPEST_CONFIG volume-feature-enabled incremental_backup_force True
 
     local volume_api_extensions=${VOLUME_API_EXTENSIONS:-"all"}
     if [[ ! -z "$DISABLE_VOLUME_API_EXTENSIONS" ]]; then

From bdc0fa8ab13ec5c75f1c793ca33f5a773fac1abc Mon Sep 17 00:00:00 2001
From: John Kasperski <jckasper@us.ibm.com>
Date: Mon, 23 Nov 2015 11:56:33 -0600
Subject: [PATCH 0096/2409] Neutron: Clean up documentation typo

Remove duplicate SERVICE_HOST and MYSQL_HOST settings in the
examples.

Change-Id: I0e102b671f03ccb183d30ec6a762d00ebcf1e4b5
---
 doc/source/guides/neutron.rst | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index 996c7d1f59..9dcb654a27 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -354,8 +354,6 @@ controller node.
         HOST_IP=10.0.0.2
         SERVICE_HOST=10.0.0.2
         MYSQL_HOST=10.0.0.2
-        SERVICE_HOST=10.0.0.2
-        MYSQL_HOST=10.0.0.2
         RABBIT_HOST=10.0.0.2
         GLANCE_HOSTPORT=10.0.0.2:9292
         PUBLIC_INTERFACE=eth1
@@ -397,7 +395,7 @@ would be a public IP address range that you or your organization has
 allocated to you, so that you could access your instances from the
 public internet.
 
-The following is the DevStack configuration on 
+The following is the DevStack configuration on
 compute node 1.
 
 ::
@@ -405,8 +403,6 @@ compute node 1.
         HOST_IP=10.0.0.3
         SERVICE_HOST=10.0.0.2
         MYSQL_HOST=10.0.0.2
-        SERVICE_HOST=10.0.0.2
-        MYSQL_HOST=10.0.0.2
         RABBIT_HOST=10.0.0.2
         GLANCE_HOSTPORT=10.0.0.2:9292
         ADMIN_PASSWORD=secrete

From 2ed28132e03066edb52fab6e640a96ee2d3424ac Mon Sep 17 00:00:00 2001
From: Einst Crazy <yu.changcai@99cloud.net>
Date: Thu, 5 Nov 2015 16:38:00 +0800
Subject: [PATCH 0097/2409] Add create stack user to quickstart document

Add instructions on creating a user to the documentation, and call out
that the standard cloud-users are probably ok too

Change-Id: I1119a43f1d5ae7c0c208bf0cc16e2f7bee29a69d
---
 doc/source/index.rst | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/doc/source/index.rst b/doc/source/index.rst
index b65730ffe8..ec345c9f64 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -44,6 +44,18 @@ Quick Start
 
    We recommend at least a :ref:`minimal-configuration` be set up.
 
+#. Add Stack User
+
+   Devstack should be run as a non-root user with sudo enabled
+   (standard logins to cloud images such as "ubuntu" or "cloud-user"
+   are usually fine).
+
+   You can quickly create a separate `stack` user to run DevStack with
+
+   ::
+
+       devstack/tools/create-stack-user.sh; su stack
+
 #. Start the install
 
    ::

From d663e29d40b04017c515c19891bb846ea984acde Mon Sep 17 00:00:00 2001
From: Kahou Lei <kahou82@gmail.com>
Date: Sat, 24 Oct 2015 12:18:57 -0700
Subject: [PATCH 0098/2409] Ensure the Linux Bridge agent can be used with
 provider networking

The root cause is that when provider network is used, devstack
is trying to build ovs related interface.

We need to make a condition such that if linux bridge is used, don't
build any ovs related interface.

Change-Id: I7f26ce7893a0ecce55b3467cd5621abf25745b8e
Closes-bug: #1509705
---
 lib/neutron-legacy | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 4e51425ffc..ecc45edbf7 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -553,9 +553,11 @@ function create_neutron_initial_network {
             die_if_not_set $LINENO SUBNET_V6_ID "Failure creating SUBNET_V6_ID for $PROVIDER_SUBNET_NAME_V6 $TENANT_ID"
         fi
 
-        sudo ip link set $OVS_PHYSICAL_BRIDGE up
-        sudo ip link set br-int up
-        sudo ip link set $PUBLIC_INTERFACE up
+        if [[ $Q_AGENT == "openvswitch" ]]; then
+            sudo ip link set $OVS_PHYSICAL_BRIDGE up
+            sudo ip link set br-int up
+            sudo ip link set $PUBLIC_INTERFACE up
+        fi
     else
         NET_ID=$(neutron net-create --tenant-id $TENANT_ID "$PRIVATE_NETWORK_NAME" | grep ' id ' | get_field 2)
         die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PRIVATE_NETWORK_NAME $TENANT_ID"
@@ -701,7 +703,7 @@ function start_neutron_service_and_check {
 function start_neutron_l2_agent {
     run_process q-agt "$AGENT_BINARY --config-file $NEUTRON_CONF --config-file /$Q_PLUGIN_CONF_FILE"
 
-    if is_provider_network; then
+    if is_provider_network && [[ $Q_AGENT == "openvswitch" ]]; then
         sudo ovs-vsctl --no-wait -- --may-exist add-port $OVS_PHYSICAL_BRIDGE $PUBLIC_INTERFACE
         sudo ip link set $OVS_PHYSICAL_BRIDGE up
         sudo ip link set br-int up

From ad69e69e3f278bd28319224035997e11477617c4 Mon Sep 17 00:00:00 2001
From: Arun S A G <saga@yahoo-inc.com>
Date: Fri, 20 Nov 2015 20:01:24 -0800
Subject: [PATCH 0099/2409] Set unprovision and active timeout to match
 build_timeout

The build_timeout for the ironic baremetal build is at
340s. Modify the unprovision_timeout and active_timeout
to match BUILD_TIMEOUT to avoid frequent failures during
IPA gate jobs.

Change-Id: Idfdc54210e33c71719c7fd0c905d0b802809e173
Related-Bug: #1393099
---
 lib/tempest | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index 76fd6cac74..0c54f9737a 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -508,7 +508,8 @@ function configure_tempest {
     # Baremetal
     if [ "$VIRT_DRIVER" = "ironic" ] ; then
         iniset $TEMPEST_CONFIG baremetal driver_enabled True
-        iniset $TEMPEST_CONFIG baremetal unprovision_timeout 300
+        iniset $TEMPEST_CONFIG baremetal unprovision_timeout $BUILD_TIMEOUT
+        iniset $TEMPEST_CONFIG baremetal active_timeout $BUILD_TIMEOUT
         iniset $TEMPEST_CONFIG baremetal deploy_img_dir $FILES
         iniset $TEMPEST_CONFIG baremetal node_uuid $IRONIC_NODE_UUID
         iniset $TEMPEST_CONFIG compute-feature-enabled change_password False

From 0b4c83a07e09eead9dad88f5b8349574e53b1c45 Mon Sep 17 00:00:00 2001
From: Rafael Folco <rfolco@br.ibm.com>
Date: Thu, 26 Nov 2015 10:08:36 -0600
Subject: [PATCH 0100/2409] Single call for 'nova flavor-list'

Code simplification only, no functional changes.

Change-Id: I0b836bc77c0553528e3bc9e0cea98d59856ccdf5
---
 lib/tempest | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 76fd6cac74..c3276d8a51 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -196,8 +196,8 @@ function configure_tempest {
     if is_service_enabled nova; then
         # If ``DEFAULT_INSTANCE_TYPE`` is not declared, use the new behavior
         # Tempest creates its own instance types
+        available_flavors=$(nova flavor-list)
         if  [[ -z "$DEFAULT_INSTANCE_TYPE" ]]; then
-            available_flavors=$(nova flavor-list)
             if [[ ! ( $available_flavors =~ 'm1.nano' ) ]]; then
                 nova flavor-create m1.nano 42 64 0 1
             fi
@@ -210,15 +210,14 @@ function configure_tempest {
         else
             # Check Nova for existing flavors, if ``DEFAULT_INSTANCE_TYPE`` is set use it.
             boto_instance_type=$DEFAULT_INSTANCE_TYPE
-            flavor_lines=`nova flavor-list`
             IFS=$'\r\n'
             flavors=""
-            for line in $flavor_lines; do
+            for line in $available_flavors; do
                 f=$(echo $line | awk "/ $DEFAULT_INSTANCE_TYPE / { print \$2 }")
                 flavors="$flavors $f"
             done
 
-            for line in $flavor_lines; do
+            for line in $available_flavors; do
                 flavors="$flavors `echo $line | grep -v "^\(|\s*ID\|+--\)" | cut -d' ' -f2`"
             done
 

From be3e553556a1a89f5046db79d3bc88fcad1d982a Mon Sep 17 00:00:00 2001
From: vsaienko <vsaienko@mirantis.com>
Date: Mon, 23 Nov 2015 16:07:21 +0200
Subject: [PATCH 0101/2409] Add discussion of LIBS_FROM_GIT

Add a pointer to installing clients via LIBS_FROM_GIT to local.conf
sample.  Mention in the git tree setup that the projects within are
usually installed via released pip versions.

Change-Id: I245094e51ea4a8ce983f6a1e48b6ab7ca5d309d0
---
 samples/local.conf | 10 +++++++++-
 stackrc            |  2 ++
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/samples/local.conf b/samples/local.conf
index b92097dd8d..34c9e8b48e 100644
--- a/samples/local.conf
+++ b/samples/local.conf
@@ -63,7 +63,8 @@ LOGDAYS=2
 # Using milestone-proposed branches
 # ---------------------------------
 
-# Uncomment these to grab the milestone-proposed branches from the repos:
+# Uncomment these to grab the milestone-proposed branches from the
+# repos:
 #CINDER_BRANCH=milestone-proposed
 #GLANCE_BRANCH=milestone-proposed
 #HORIZON_BRANCH=milestone-proposed
@@ -74,6 +75,13 @@ LOGDAYS=2
 #NEUTRON_BRANCH=milestone-proposed
 #SWIFT_BRANCH=milestone-proposed
 
+# Using git versions of clients
+# -----------------------------
+# By default clients are installed from pip.  See LIBS_FROM_GIT in
+# stackrc for details on getting clients from specific branches or
+# revisions.  e.g.
+# LIBS_FROM_GIT="python-ironicclient"
+# IRONICCLIENT_BRANCH=refs/changes/44/2.../1
 
 # Swift
 # -----
diff --git a/stackrc b/stackrc
index 23a4a7c4c4..cfdcd4d6b2 100644
--- a/stackrc
+++ b/stackrc
@@ -268,6 +268,7 @@ GITBRANCH["tempest-lib"]=${TEMPEST_LIB_BRANCH:-master}
 ##############
 #
 #  OpenStack Client Library Components
+#   Note default install is from pip, see LIBS_FROM_GIT
 #
 ##############
 
@@ -317,6 +318,7 @@ GITDIR["python-openstackclient"]=$DEST/python-openstackclient
 ###################
 #
 #  Oslo Libraries
+#   Note default install is from pip, see LIBS_FROM_GIT
 #
 ###################
 

From 523f48803609b35350b624244fa73b1030c1d5fa Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 13 Oct 2015 11:03:03 +1100
Subject: [PATCH 0102/2409] Namespace XTRACE commands

I noticed this when debugging some grenade issues failures.

An include of grenade/functions stores the current value of XTRACE
(on) and disables xtrace for the rest of the import.

We then include devstack's "functions" library, which now overwrites
the stored value of XTRACE the current state; i.e. disabled.

When it finishes it restores the prior state (disabled), and then
grenade restores the same value of XTRACE (disabled).

The result is that xtrace is incorrectly disabled until the next time
it just happens to be turned on.

The solution is to name-space the store of the current-value of xtrace
so when we finish sourcing a file, we always restore the tracing value
to what it was when we entered.

Some files had already discovered this.  In general there is
inconsistency around the setting of the variable, and a lot of obvious
copy-paste.  This brings consistency across all files by using
_XTRACE_* prefixes for the sotre/restore of tracing values.

Change-Id: Iba7739eada5711d9c269cb4127fa712e9f961695
---
 functions                                   | 4 ++--
 functions-common                            | 4 ++--
 inc/meta-config                             | 4 ++--
 lib/apache                                  | 4 ++--
 lib/ceph                                    | 4 ++--
 lib/cinder                                  | 4 ++--
 lib/cinder_backends/ceph                    | 4 ++--
 lib/cinder_backends/glusterfs               | 4 ++--
 lib/cinder_backends/lvm                     | 4 ++--
 lib/cinder_backends/netapp_iscsi            | 4 ++--
 lib/cinder_backends/netapp_nfs              | 4 ++--
 lib/cinder_backends/nfs                     | 4 ++--
 lib/cinder_backends/solidfire               | 4 ++--
 lib/cinder_backends/vmdk                    | 4 ++--
 lib/cinder_backends/xiv                     | 4 ++--
 lib/cinder_plugins/XenAPINFS                | 4 ++--
 lib/cinder_plugins/glusterfs                | 4 ++--
 lib/cinder_plugins/nfs                      | 4 ++--
 lib/cinder_plugins/sheepdog                 | 4 ++--
 lib/cinder_plugins/vsphere                  | 4 ++--
 lib/database                                | 4 ++--
 lib/databases/mysql                         | 4 ++--
 lib/databases/postgresql                    | 4 ++--
 lib/dlm                                     | 4 ++--
 lib/dstat                                   | 4 ++--
 lib/glance                                  | 4 ++--
 lib/heat                                    | 4 ++--
 lib/horizon                                 | 4 ++--
 lib/infra                                   | 4 ++--
 lib/ironic                                  | 8 ++++----
 lib/keystone                                | 4 ++--
 lib/ldap                                    | 4 ++--
 lib/lvm                                     | 4 ++--
 lib/neutron-legacy                          | 4 ++--
 lib/neutron_plugins/bigswitch_floodlight    | 4 ++--
 lib/neutron_plugins/brocade                 | 4 ++--
 lib/neutron_plugins/cisco                   | 4 ++--
 lib/neutron_plugins/embrane                 | 5 +++--
 lib/neutron_plugins/linuxbridge_agent       | 4 ++--
 lib/neutron_plugins/ml2                     | 4 ++--
 lib/neutron_plugins/nuage                   | 4 ++--
 lib/neutron_plugins/openvswitch             | 5 +++--
 lib/neutron_plugins/openvswitch_agent       | 4 ++--
 lib/neutron_plugins/ovs_base                | 4 ++--
 lib/neutron_plugins/services/firewall       | 4 ++--
 lib/neutron_plugins/services/loadbalancer   | 4 ++--
 lib/neutron_plugins/services/metering       | 5 +++--
 lib/neutron_plugins/services/vpn            | 4 ++--
 lib/neutron_thirdparty/bigswitch_floodlight | 4 ++--
 lib/nova                                    | 4 ++--
 lib/nova_plugins/functions-libvirt          | 4 ++--
 lib/nova_plugins/hypervisor-fake            | 4 ++--
 lib/nova_plugins/hypervisor-ironic          | 4 ++--
 lib/nova_plugins/hypervisor-libvirt         | 4 ++--
 lib/nova_plugins/hypervisor-openvz          | 4 ++--
 lib/nova_plugins/hypervisor-vsphere         | 4 ++--
 lib/nova_plugins/hypervisor-xenserver       | 4 ++--
 lib/oslo                                    | 4 ++--
 lib/rpc_backend                             | 4 ++--
 lib/swift                                   | 4 ++--
 lib/tempest                                 | 4 ++--
 lib/template                                | 4 ++--
 stack.sh                                    | 7 +++++--
 63 files changed, 134 insertions(+), 128 deletions(-)

diff --git a/functions b/functions
index 34da1ba733..762fc472c2 100644
--- a/functions
+++ b/functions
@@ -22,7 +22,7 @@ source ${FUNC_DIR}/inc/python
 source ${FUNC_DIR}/inc/rootwrap
 
 # Save trace setting
-XTRACE=$(set +o | grep xtrace)
+_XTRACE_FUNCTIONS=$(set +o | grep xtrace)
 set +o xtrace
 
 # Check if a function already exists
@@ -603,7 +603,7 @@ function create_disk {
 }
 
 # Restore xtrace
-$XTRACE
+$_XTRACE_FUNCTIONS
 
 # Local variables:
 # mode: shell-script
diff --git a/functions-common b/functions-common
index 6a065ba83c..d68ae77971 100644
--- a/functions-common
+++ b/functions-common
@@ -32,7 +32,7 @@
 #
 
 # Save trace setting
-XTRACE=$(set +o | grep xtrace)
+_XTRACE_FUNCTIONS_COMMON=$(set +o | grep xtrace)
 set +o xtrace
 
 # ensure we don't re-source this in the same environment
@@ -2254,7 +2254,7 @@ function time_totals {
 }
 
 # Restore xtrace
-$XTRACE
+$_XTRACE_FUNCTIONS_COMMON
 
 # Local variables:
 # mode: shell-script
diff --git a/inc/meta-config b/inc/meta-config
index b9ab6b207f..b6fe437802 100644
--- a/inc/meta-config
+++ b/inc/meta-config
@@ -20,7 +20,7 @@
 # file-name is the destination of the config file
 
 # Save trace setting
-INC_META_XTRACE=$(set +o | grep xtrace)
+_XTRACE_INC_META=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -197,7 +197,7 @@ function merge_config_group {
 
 
 # Restore xtrace
-$INC_META_XTRACE
+$_XTRACE_INC_META
 
 # Local variables:
 # mode: shell-script
diff --git a/lib/apache b/lib/apache
index 17526c74d0..c9e02a2b58 100644
--- a/lib/apache
+++ b/lib/apache
@@ -19,7 +19,7 @@
 # - restart_apache_server
 
 # Save trace setting
-XTRACE=$(set +o | grep xtrace)
+_XTRACE_LIB_APACHE=$(set +o | grep xtrace)
 set +o xtrace
 
 # Allow overriding the default Apache user and group, default to
@@ -191,7 +191,7 @@ function restart_apache_server {
 }
 
 # Restore xtrace
-$XTRACE
+$_XTRACE_LIB_APACHE
 
 # Tell emacs to use shell-script-mode
 ## Local variables:
diff --git a/lib/ceph b/lib/ceph
index f573136a4e..4ac498ab97 100644
--- a/lib/ceph
+++ b/lib/ceph
@@ -18,7 +18,7 @@
 # - cleanup_ceph
 
 # Save trace setting
-XTRACE=$(set +o | grep xtrace)
+_XTRACE_LIB_CEPH=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -375,7 +375,7 @@ function stop_ceph {
 
 
 # Restore xtrace
-$XTRACE
+$_XTRACE_LIB_CEPH
 
 ## Local variables:
 ## mode: shell-script
diff --git a/lib/cinder b/lib/cinder
index 1307c11f7a..70b198c2e9 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -20,7 +20,7 @@
 # - cleanup_cinder
 
 # Save trace setting
-XTRACE=$(set +o | grep xtrace)
+_XTRACE_CINDER=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -567,7 +567,7 @@ function create_cinder_volume_group {
 
 
 # Restore xtrace
-$XTRACE
+$_XTRACE_CINDER
 
 # Tell emacs to use shell-script-mode
 ## Local variables:
diff --git a/lib/cinder_backends/ceph b/lib/cinder_backends/ceph
index 7e9d2d334e..c21350ba01 100644
--- a/lib/cinder_backends/ceph
+++ b/lib/cinder_backends/ceph
@@ -22,7 +22,7 @@
 
 
 # Save trace setting
-MY_XTRACE=$(set +o | grep xtrace)
+_XTRACE_CINDER_CEPH=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -76,7 +76,7 @@ function configure_cinder_backend_ceph {
 }
 
 # Restore xtrace
-$MY_XTRACE
+$_XTRACE_CINDER_CEPH
 
 # Local variables:
 # mode: shell-script
diff --git a/lib/cinder_backends/glusterfs b/lib/cinder_backends/glusterfs
index 00c62e04cd..4e34f8ef6c 100644
--- a/lib/cinder_backends/glusterfs
+++ b/lib/cinder_backends/glusterfs
@@ -19,7 +19,7 @@
 # configure_cinder_backend_glusterfs - Configure Cinder for GlusterFS backends
 
 # Save trace setting
-GLUSTERFS_XTRACE=$(set +o | grep xtrace)
+_XTRACE_CINDER_GLUSTERFS=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -41,7 +41,7 @@ function configure_cinder_backend_glusterfs {
 
 
 # Restore xtrace
-$GLUSTERFS_XTRACE
+$_XTRACE_CINDER_GLUSTERFS
 
 # Local variables:
 # mode: shell-script
diff --git a/lib/cinder_backends/lvm b/lib/cinder_backends/lvm
index 411b82c190..d927f9cd6b 100644
--- a/lib/cinder_backends/lvm
+++ b/lib/cinder_backends/lvm
@@ -22,7 +22,7 @@
 
 
 # Save trace setting
-MY_XTRACE=$(set +o | grep xtrace)
+_XTRACE_CINDER_LVM=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -68,7 +68,7 @@ function init_cinder_backend_lvm {
 }
 
 # Restore xtrace
-$MY_XTRACE
+$_XTRACE_CINDER_LVM
 
 # mode: shell-script
 # End:
diff --git a/lib/cinder_backends/netapp_iscsi b/lib/cinder_backends/netapp_iscsi
index be9442eb83..5cce30a6d3 100644
--- a/lib/cinder_backends/netapp_iscsi
+++ b/lib/cinder_backends/netapp_iscsi
@@ -20,7 +20,7 @@
 # configure_cinder_backend_netapp_iscsi - configure iSCSI
 
 # Save trace setting
-MY_XTRACE=$(set +o | grep xtrace)
+_XTRACE_CINDER_NETAPP=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -59,7 +59,7 @@ function configure_cinder_backend_netapp_iscsi {
 
 
 # Restore xtrace
-$MY_XTRACE
+$_XTRACE_CINDER_NETAPP
 
 # Local variables:
 # mode: shell-script
diff --git a/lib/cinder_backends/netapp_nfs b/lib/cinder_backends/netapp_nfs
index dc919ad86b..7ba36d2a3b 100644
--- a/lib/cinder_backends/netapp_nfs
+++ b/lib/cinder_backends/netapp_nfs
@@ -20,7 +20,7 @@
 # configure_cinder_backend_netapp_nfs - configure NFS
 
 # Save trace setting
-MY_XTRACE=$(set +o | grep xtrace)
+_XTRACE_CINDER_NETAPP=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -70,7 +70,7 @@ function cleanup_cinder_backend_netapp_nfs {
 
 
 # Restore xtrace
-$MY_XTRACE
+$_XTRACE_CINDER_NETAPP
 
 # Local variables:
 # mode: shell-script
diff --git a/lib/cinder_backends/nfs b/lib/cinder_backends/nfs
index fc51b2b440..89a37a1f02 100644
--- a/lib/cinder_backends/nfs
+++ b/lib/cinder_backends/nfs
@@ -19,7 +19,7 @@
 # configure_cinder_backend_nfs - Configure Cinder for NFS backends
 
 # Save trace setting
-NFS_XTRACE=$(set +o | grep xtrace)
+_XTRACE_CINDER_NFS=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -38,7 +38,7 @@ function configure_cinder_backend_nfs {
 
 
 # Restore xtrace
-$NFS_XTRACE
+$_XTRACE_CINDER_NFS
 
 # Local variables:
 # mode: shell-script
diff --git a/lib/cinder_backends/solidfire b/lib/cinder_backends/solidfire
index 7cc70fc86d..16bc527863 100644
--- a/lib/cinder_backends/solidfire
+++ b/lib/cinder_backends/solidfire
@@ -17,7 +17,7 @@
 # configure_cinder_driver - make configuration changes, including those to other services
 
 # Save trace setting
-MY_XTRACE=$(set +o | grep xtrace)
+_XTRACE_CINDER_SOLIDFIRE=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -42,7 +42,7 @@ function configure_cinder_backend_solidfire {
 
 
 # Restore xtrace
-$MY_XTRACE
+$_XTRACE_CINDER_SOLIDFIRE
 
 # Local variables:
 # mode: shell-script
diff --git a/lib/cinder_backends/vmdk b/lib/cinder_backends/vmdk
index d5b945354b..3a6a5cf2ff 100644
--- a/lib/cinder_backends/vmdk
+++ b/lib/cinder_backends/vmdk
@@ -15,7 +15,7 @@
 # configure_cinder_backend_vmdk - Configure Cinder for VMware vmdk backends
 
 # Save trace setting
-VMDK_XTRACE=$(set +o | grep xtrace)
+_XTRACE_CINDER_VMDK=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -40,7 +40,7 @@ function configure_cinder_backend_vmdk {
 
 
 # Restore xtrace
-$VMDK_XTRACE
+$_XTRACE_CINDER_VMDK
 
 # Local variables:
 # mode: shell-script
diff --git a/lib/cinder_backends/xiv b/lib/cinder_backends/xiv
index 6eadaae93b..e8b5da05d5 100644
--- a/lib/cinder_backends/xiv
+++ b/lib/cinder_backends/xiv
@@ -42,7 +42,7 @@
 # configure_cinder_backend_xiv - Configure Cinder for xiv backends
 
 # Save trace setting
-XIV_XTRACE=$(set +o | grep xtrace)
+_XTRACE_CINDER_XIV=$(set +o | grep xtrace)
 set +o xtrace
 
 # Defaults
@@ -79,7 +79,7 @@ function configure_cinder_backend_xiv {
 }
 
 # Restore xtrace
-$XIV_XTRACE
+$_XTRACE_CINDER_XIV
 
 # Local variables:
 # mode: shell-script
diff --git a/lib/cinder_plugins/XenAPINFS b/lib/cinder_plugins/XenAPINFS
index f7306955cb..92135e7c4f 100644
--- a/lib/cinder_plugins/XenAPINFS
+++ b/lib/cinder_plugins/XenAPINFS
@@ -15,7 +15,7 @@
 # configure_cinder_driver - make configuration changes, including those to other services
 
 # Save trace setting
-MY_XTRACE=$(set +o | grep xtrace)
+_XTRACE_CINDER_XENAPINFS=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -39,7 +39,7 @@ function configure_cinder_driver {
 }
 
 # Restore xtrace
-$MY_XTRACE
+$_XTRACE_CINDER_XENAPINFS
 
 # Local variables:
 # mode: shell-script
diff --git a/lib/cinder_plugins/glusterfs b/lib/cinder_plugins/glusterfs
index 35ceb27ce1..329dd6c649 100644
--- a/lib/cinder_plugins/glusterfs
+++ b/lib/cinder_plugins/glusterfs
@@ -15,7 +15,7 @@
 # configure_cinder_driver - make configuration changes, including those to other services
 
 # Save trace setting
-MY_XTRACE=$(set +o | grep xtrace)
+_XTRACE_CINDER_GLUSTERFS=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -45,7 +45,7 @@ function configure_cinder_driver {
 }
 
 # Restore xtrace
-$MY_XTRACE
+$_XTRACE_CINDER_GLUSTERFS
 
 # Local variables:
 # mode: shell-script
diff --git a/lib/cinder_plugins/nfs b/lib/cinder_plugins/nfs
index 83b39932cf..6e4ffe068e 100644
--- a/lib/cinder_plugins/nfs
+++ b/lib/cinder_plugins/nfs
@@ -15,7 +15,7 @@
 # configure_cinder_driver - make configuration changes, including those to other services
 
 # Save trace setting
-MY_XTRACE=$(set +o | grep xtrace)
+_XTRACE_CINDER_NFS=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -36,7 +36,7 @@ function configure_cinder_driver {
 }
 
 # Restore xtrace
-$MY_XTRACE
+$_XTRACE_CINDER_NFS
 
 # Local variables:
 # mode: shell-script
diff --git a/lib/cinder_plugins/sheepdog b/lib/cinder_plugins/sheepdog
index ca343f708b..558de46c6d 100644
--- a/lib/cinder_plugins/sheepdog
+++ b/lib/cinder_plugins/sheepdog
@@ -15,7 +15,7 @@
 # configure_cinder_driver - make configuration changes, including those to other services
 
 # Save trace setting
-MY_XTRACE=$(set +o | grep xtrace)
+_XTRACE_CINDER_SHEEPDOG=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -34,7 +34,7 @@ function configure_cinder_driver {
 }
 
 # Restore xtrace
-$MY_XTRACE
+$_XTRACE_CINDER_SHEEPDOG
 
 # Local variables:
 # mode: shell-script
diff --git a/lib/cinder_plugins/vsphere b/lib/cinder_plugins/vsphere
index f14ddf0998..1b28ffe602 100644
--- a/lib/cinder_plugins/vsphere
+++ b/lib/cinder_plugins/vsphere
@@ -15,7 +15,7 @@
 # configure_cinder_driver - make configuration changes, including those to other services
 
 # Save trace setting
-MY_XTRACE=$(set +o | grep xtrace)
+_XTRACE_CINDER_VSPHERE=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -37,7 +37,7 @@ function configure_cinder_driver {
 }
 
 # Restore xtrace
-$MY_XTRACE
+$_XTRACE_CINDER_VSPHERE
 
 # Local variables:
 # mode: shell-script
diff --git a/lib/database b/lib/database
index 13740b90e6..0d720527df 100644
--- a/lib/database
+++ b/lib/database
@@ -20,7 +20,7 @@
 # and call register_database $DATABASE_TYPE
 
 # Save trace setting
-XTRACE=$(set +o | grep xtrace)
+_XTRACE_LIB_DB=$(set +o | grep xtrace)
 set +o xtrace
 
 DATABASE_BACKENDS=""
@@ -137,7 +137,7 @@ function database_connection_url {
 
 
 # Restore xtrace
-$XTRACE
+$_XTRACE_LIB_DB
 
 # Tell emacs to use shell-script-mode
 ## Local variables:
diff --git a/lib/databases/mysql b/lib/databases/mysql
index cc74b33327..1bbbd62cc3 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -8,7 +8,7 @@
 # - DATABASE_{HOST,USER,PASSWORD} must be defined
 
 # Save trace setting
-MY_XTRACE=$(set +o | grep xtrace)
+_XTRACE_DB_MYSQL=$(set +o | grep xtrace)
 set +o xtrace
 
 MYSQL_DRIVER=${MYSQL_DRIVER:-PyMySQL}
@@ -178,7 +178,7 @@ function database_connection_url_mysql {
 
 
 # Restore xtrace
-$MY_XTRACE
+$_XTRACE_DB_MYSQL
 
 # Local variables:
 # mode: shell-script
diff --git a/lib/databases/postgresql b/lib/databases/postgresql
index 78c7bedc90..913e8ffacd 100644
--- a/lib/databases/postgresql
+++ b/lib/databases/postgresql
@@ -8,7 +8,7 @@
 # - DATABASE_{HOST,USER,PASSWORD} must be defined
 
 # Save trace setting
-PG_XTRACE=$(set +o | grep xtrace)
+_XTRACE_PG=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -119,7 +119,7 @@ function database_connection_url_postgresql {
 
 
 # Restore xtrace
-$PG_XTRACE
+$_XTRACE_PG
 
 # Local variables:
 # mode: shell-script
diff --git a/lib/dlm b/lib/dlm
index 95e9b0ac3d..74eb67ee8f 100644
--- a/lib/dlm
+++ b/lib/dlm
@@ -19,7 +19,7 @@
 # - cleanup_dlm
 
 # Save trace setting
-XTRACE=$(set +o | grep xtrace)
+_XTRACE_DLM=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -100,7 +100,7 @@ function install_dlm {
 }
 
 # Restore xtrace
-$XTRACE
+$_XTRACE_DLM
 
 # Tell emacs to use shell-script-mode
 ## Local variables:
diff --git a/lib/dstat b/lib/dstat
index fe4790b12d..b705948094 100644
--- a/lib/dstat
+++ b/lib/dstat
@@ -13,7 +13,7 @@
 # - stop_dstat
 
 # Save trace setting
-XTRACE=$(set +o | grep xtrace)
+_XTRACE_DSTAT=$(set +o | grep xtrace)
 set +o xtrace
 
 # start_dstat() - Start running processes, including screen
@@ -34,4 +34,4 @@ function stop_dstat {
 }
 
 # Restore xtrace
-$XTRACE
+$_XTRACE_DSTAT
diff --git a/lib/glance b/lib/glance
index 2eb93a46e6..eb5832e910 100644
--- a/lib/glance
+++ b/lib/glance
@@ -21,7 +21,7 @@
 # - cleanup_glance
 
 # Save trace setting
-XTRACE=$(set +o | grep xtrace)
+_XTRACE_GLANCE=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -403,7 +403,7 @@ function stop_glance {
 }
 
 # Restore xtrace
-$XTRACE
+$_XTRACE_GLANCE
 
 # Tell emacs to use shell-script-mode
 ## Local variables:
diff --git a/lib/heat b/lib/heat
index e42bdf0b9e..54666a5212 100644
--- a/lib/heat
+++ b/lib/heat
@@ -23,7 +23,7 @@
 # - cleanup_heat
 
 # Save trace setting
-XTRACE=$(set +o | grep xtrace)
+_XTRACE_HEAT=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -464,7 +464,7 @@ function build_heat_pip_mirror {
 }
 
 # Restore xtrace
-$XTRACE
+$_XTRACE_HEAT
 
 # Tell emacs to use shell-script-mode
 ## Local variables:
diff --git a/lib/horizon b/lib/horizon
index ff63b06ab2..67181fcf29 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -19,7 +19,7 @@
 # - cleanup_horizon
 
 # Save trace setting
-XTRACE=$(set +o | grep xtrace)
+_XTRACE_HORIZON=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -193,7 +193,7 @@ function _prepare_message_catalog_compilation {
 
 
 # Restore xtrace
-$XTRACE
+$_XTRACE_HORIZON
 
 # Tell emacs to use shell-script-mode
 ## Local variables:
diff --git a/lib/infra b/lib/infra
index ab32efecd9..cf003cce01 100644
--- a/lib/infra
+++ b/lib/infra
@@ -15,7 +15,7 @@
 # - install_infra
 
 # Save trace setting
-XTRACE=$(set +o | grep xtrace)
+_XTRACE_INFRA=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -50,7 +50,7 @@ function install_infra {
 }
 
 # Restore xtrace
-$XTRACE
+$_XTRACE_INFRA
 
 # Tell emacs to use shell-script-mode
 ## Local variables:
diff --git a/lib/ironic b/lib/ironic
index 6a32983b24..23d8dda3ff 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -21,8 +21,8 @@
 # - cleanup_ironic
 
 # Save trace and pipefail settings
-XTRACE=$(set +o | grep xtrace)
-PIPEFAIL=$(set +o | grep pipefail)
+_XTRACE_IRONIC=$(set +o | grep xtrace)
+_PIPEFAIL_IRONIC=$(set +o | grep pipefail)
 set +o xtrace
 set +o pipefail
 
@@ -855,8 +855,8 @@ function cleanup_baremetal_basic_ops {
 }
 
 # Restore xtrace + pipefail
-$XTRACE
-$PIPEFAIL
+$_XTRACE_IRONIC
+$_PIPEFAIL_IRONIC
 
 # Tell emacs to use shell-script-mode
 ## Local variables:
diff --git a/lib/keystone b/lib/keystone
index 5a2afbfe02..b19202b0f7 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -28,7 +28,7 @@
 # - _cleanup_keystone_apache_wsgi
 
 # Save trace setting
-XTRACE=$(set +o | grep xtrace)
+_XTRACE_KEYSTONE=$(set +o | grep xtrace)
 set +o xtrace
 
 # Defaults
@@ -592,7 +592,7 @@ function stop_keystone {
 
 
 # Restore xtrace
-$XTRACE
+$_XTRACE_KEYSTONE
 
 # Tell emacs to use shell-script-mode
 ## Local variables:
diff --git a/lib/ldap b/lib/ldap
index 0414fea639..65056aea2f 100644
--- a/lib/ldap
+++ b/lib/ldap
@@ -8,7 +8,7 @@
 # - install_ldap()
 
 # Save trace setting
-XTRACE=$(set +o | grep xtrace)
+_XTRACE_LDAP=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -166,7 +166,7 @@ function clear_ldap_state {
 }
 
 # Restore xtrace
-$XTRACE
+$_XTRACE_LDAP
 
 # Tell emacs to use shell-script-mode
 ## Local variables:
diff --git a/lib/lvm b/lib/lvm
index 468a99aecc..ae6023a836 100644
--- a/lib/lvm
+++ b/lib/lvm
@@ -16,7 +16,7 @@
 
 
 # Save trace setting
-MY_XTRACE=$(set +o | grep xtrace)
+_XTRACE_LVM=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -182,7 +182,7 @@ function set_lvm_filter {
 }
 
 # Restore xtrace
-$MY_XTRACE
+$_XTRACE_LVM
 
 # mode: shell-script
 # End:
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 978943dae2..d00630af70 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -357,7 +357,7 @@ else
 fi
 
 # Save trace setting
-XTRACE=$(set +o | grep xtrace)
+_XTRACE_NEUTRON=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -1492,7 +1492,7 @@ function is_provider_network {
 
 
 # Restore xtrace
-$XTRACE
+$_XTRACE_NEUTRON
 
 # Tell emacs to use shell-script-mode
 ## Local variables:
diff --git a/lib/neutron_plugins/bigswitch_floodlight b/lib/neutron_plugins/bigswitch_floodlight
index f52105e658..586ded79b4 100644
--- a/lib/neutron_plugins/bigswitch_floodlight
+++ b/lib/neutron_plugins/bigswitch_floodlight
@@ -4,7 +4,7 @@
 # ------------------------------------
 
 # Save trace setting
-BS_XTRACE=$(set +o | grep xtrace)
+_XTRACE_NEUTRON_BIGSWITCH=$(set +o | grep xtrace)
 set +o xtrace
 
 source $TOP_DIR/lib/neutron_plugins/ovs_base
@@ -75,4 +75,4 @@ function neutron_plugin_check_adv_test_requirements {
 }
 
 # Restore xtrace
-$BS_XTRACE
+$_XTRACE_NEUTRON_BIGSWITCH
diff --git a/lib/neutron_plugins/brocade b/lib/neutron_plugins/brocade
index 953360e070..6ba0a66c3f 100644
--- a/lib/neutron_plugins/brocade
+++ b/lib/neutron_plugins/brocade
@@ -4,7 +4,7 @@
 # ----------------------
 
 # Save trace setting
-BRCD_XTRACE=$(set +o | grep xtrace)
+_XTRACE_NEUTRON_BROCADE=$(set +o | grep xtrace)
 set +o xtrace
 
 function is_neutron_ovs_base_plugin {
@@ -81,4 +81,4 @@ function neutron_plugin_check_adv_test_requirements {
 }
 
 # Restore xtrace
-$BRCD_XTRACE
+$_XTRACE_NEUTRON_BROCADE
diff --git a/lib/neutron_plugins/cisco b/lib/neutron_plugins/cisco
index 7d0cf1af39..fc2cb8ad17 100644
--- a/lib/neutron_plugins/cisco
+++ b/lib/neutron_plugins/cisco
@@ -4,7 +4,7 @@
 # ---------------------------
 
 # Save trace setting
-CISCO_XTRACE=$(set +o | grep xtrace)
+_XTRACE_NEUTRON_CISCO=$(set +o | grep xtrace)
 set +o xtrace
 
 # Scecify the VSM parameters
@@ -154,4 +154,4 @@ function neutron_plugin_setup_interface_driver {
 }
 
 # Restore xtrace
-$CISCO_XTRACE
+$_XTRACE_NEUTRON_CISCO
diff --git a/lib/neutron_plugins/embrane b/lib/neutron_plugins/embrane
index 2028496ca1..385dab8354 100644
--- a/lib/neutron_plugins/embrane
+++ b/lib/neutron_plugins/embrane
@@ -4,7 +4,7 @@
 # ---------------------------
 
 # Save trace setting
-EMBR_XTRACE=$(set +o | grep xtrace)
+_XTRACE_NEUTRON_EMBR=$(set +o | grep xtrace)
 set +o xtrace
 
 source $TOP_DIR/lib/neutron_plugins/openvswitch
@@ -39,4 +39,5 @@ function neutron_plugin_configure_service {
 }
 
 # Restore xtrace
-$EMBR_XTRACE
+$_XTRACE_NEUTRON_EMBR
+
diff --git a/lib/neutron_plugins/linuxbridge_agent b/lib/neutron_plugins/linuxbridge_agent
index f28bcfeadd..096722b096 100644
--- a/lib/neutron_plugins/linuxbridge_agent
+++ b/lib/neutron_plugins/linuxbridge_agent
@@ -4,7 +4,7 @@
 # -----------------------------
 
 # Save trace setting
-PLUGIN_XTRACE=$(set +o | grep xtrace)
+_XTRACE_NEUTRON_LB=$(set +o | grep xtrace)
 set +o xtrace
 
 function neutron_lb_cleanup {
@@ -93,4 +93,4 @@ function neutron_plugin_check_adv_test_requirements {
 }
 
 # Restore xtrace
-$PLUGIN_XTRACE
+$_XTRACE_NEUTRON_LB
diff --git a/lib/neutron_plugins/ml2 b/lib/neutron_plugins/ml2
index ace5335a78..30e1b036f3 100644
--- a/lib/neutron_plugins/ml2
+++ b/lib/neutron_plugins/ml2
@@ -4,7 +4,7 @@
 # ------------------------------
 
 # Save trace setting
-ML2_XTRACE=$(set +o | grep xtrace)
+_XTRACE_NEUTRON_ML2=$(set +o | grep xtrace)
 set +o xtrace
 
 # Enable this to simply and quickly enable tunneling with ML2.
@@ -137,4 +137,4 @@ function has_neutron_plugin_security_group {
 }
 
 # Restore xtrace
-$ML2_XTRACE
+$_XTRACE_NEUTRON_ML2
diff --git a/lib/neutron_plugins/nuage b/lib/neutron_plugins/nuage
index 9e5307ba53..61e634e453 100644
--- a/lib/neutron_plugins/nuage
+++ b/lib/neutron_plugins/nuage
@@ -4,7 +4,7 @@
 # ----------------------
 
 # Save trace setting
-NU_XTRACE=$(set +o | grep xtrace)
+_XTRACE_NEUTRON_NU=$(set +o | grep xtrace)
 set +o xtrace
 
 function neutron_plugin_create_nova_conf {
@@ -66,4 +66,4 @@ function has_neutron_plugin_security_group {
 }
 
 # Restore xtrace
-$NU_XTRACE
+$_XTRACE_NEUTRON_NU
diff --git a/lib/neutron_plugins/openvswitch b/lib/neutron_plugins/openvswitch
index 891ab4982b..130eaacab3 100644
--- a/lib/neutron_plugins/openvswitch
+++ b/lib/neutron_plugins/openvswitch
@@ -7,7 +7,7 @@
 # which has been removed in Juno.
 
 # Save trace setting
-OVS_XTRACE=$(set +o | grep xtrace)
+_XTRACE_NEUTRON_OVS=$(set +o | grep xtrace)
 set +o xtrace
 
 source $TOP_DIR/lib/neutron_plugins/openvswitch_agent
@@ -56,4 +56,5 @@ function has_neutron_plugin_security_group {
 }
 
 # Restore xtrace
-$OVS_XTRACE
+$_XTRACE_NEUTRON_OVS
+
diff --git a/lib/neutron_plugins/openvswitch_agent b/lib/neutron_plugins/openvswitch_agent
index 6a333939d0..b1acacd4f3 100644
--- a/lib/neutron_plugins/openvswitch_agent
+++ b/lib/neutron_plugins/openvswitch_agent
@@ -4,7 +4,7 @@
 # -----------------------------
 
 # Save trace setting
-OVSA_XTRACE=$(set +o | grep xtrace)
+_XTRACE_NEUTRON_OVSL2=$(set +o | grep xtrace)
 set +o xtrace
 
 source $TOP_DIR/lib/neutron_plugins/ovs_base
@@ -132,4 +132,4 @@ function neutron_plugin_check_adv_test_requirements {
 }
 
 # Restore xtrace
-$OVSA_XTRACE
+$_XTRACE_NEUTRON_OVSL2
diff --git a/lib/neutron_plugins/ovs_base b/lib/neutron_plugins/ovs_base
index d3fd198b08..91aff336fe 100644
--- a/lib/neutron_plugins/ovs_base
+++ b/lib/neutron_plugins/ovs_base
@@ -4,7 +4,7 @@
 # -------------------------------------
 
 # Save trace setting
-OVSB_XTRACE=$(set +o | grep xtrace)
+_XTRACE_NEUTRON_OVS_BASE=$(set +o | grep xtrace)
 set +o xtrace
 
 OVS_BRIDGE=${OVS_BRIDGE:-br-int}
@@ -114,4 +114,4 @@ function _neutron_ovs_base_configure_nova_vif_driver {
 }
 
 # Restore xtrace
-$OVSB_XTRACE
+$_XTRACE_NEUTRON_OVS_BASE
diff --git a/lib/neutron_plugins/services/firewall b/lib/neutron_plugins/services/firewall
index 3496da82f8..1d81a21825 100644
--- a/lib/neutron_plugins/services/firewall
+++ b/lib/neutron_plugins/services/firewall
@@ -4,7 +4,7 @@
 # ---------------------------
 
 # Save trace setting
-FW_XTRACE=$(set +o | grep xtrace)
+_XTRACE_NEUTRON_FIREWALL=$(set +o | grep xtrace)
 set +o xtrace
 
 FWAAS_PLUGIN=neutron_fwaas.services.firewall.fwaas_plugin.FirewallPlugin
@@ -26,4 +26,4 @@ function neutron_fwaas_stop {
 }
 
 # Restore xtrace
-$FW_XTRACE
+$_XTRACE_NEUTRON_FIREWALL
diff --git a/lib/neutron_plugins/services/loadbalancer b/lib/neutron_plugins/services/loadbalancer
index 7865f6fd6e..b07d06c32b 100644
--- a/lib/neutron_plugins/services/loadbalancer
+++ b/lib/neutron_plugins/services/loadbalancer
@@ -4,7 +4,7 @@
 # ---------------------------
 
 # Save trace setting
-LB_XTRACE=$(set +o | grep xtrace)
+_XTRACE_NEUTRON_LB=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -48,4 +48,4 @@ function neutron_lbaas_stop {
 }
 
 # Restore xtrace
-$LB_XTRACE
+$_XTRACE_NEUTRON_LB
diff --git a/lib/neutron_plugins/services/metering b/lib/neutron_plugins/services/metering
index c75ab19d4e..5fd2fdce44 100644
--- a/lib/neutron_plugins/services/metering
+++ b/lib/neutron_plugins/services/metering
@@ -4,7 +4,7 @@
 # ---------------------------
 
 # Save trace setting
-METER_XTRACE=$(set +o | grep xtrace)
+_XTRACE_NETURON_METER=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -29,4 +29,5 @@ function neutron_metering_stop {
 }
 
 # Restore xtrace
-$METER_XTRACE
+$_XTRACE_NETURON_METER
+
diff --git a/lib/neutron_plugins/services/vpn b/lib/neutron_plugins/services/vpn
index c0e7457413..8a379f588c 100644
--- a/lib/neutron_plugins/services/vpn
+++ b/lib/neutron_plugins/services/vpn
@@ -4,7 +4,7 @@
 # ---------------------------
 
 # Save trace setting
-VPN_XTRACE=$(set +o | grep xtrace)
+_XTRACE_NEUTRON_VPN=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -53,4 +53,4 @@ function neutron_vpn_stop {
 }
 
 # Restore xtrace
-$VPN_XTRACE
+$_XTRACE_NEUTRON_VPN
diff --git a/lib/neutron_thirdparty/bigswitch_floodlight b/lib/neutron_thirdparty/bigswitch_floodlight
index e3f4689fd7..45a4f2e263 100644
--- a/lib/neutron_thirdparty/bigswitch_floodlight
+++ b/lib/neutron_thirdparty/bigswitch_floodlight
@@ -4,7 +4,7 @@
 # ------------------------------------------
 
 # Save trace setting
-BS3_XTRACE=$(set +o | grep xtrace)
+_XTRACE_NEUTRON_BIGSWITCH=$(set +o | grep xtrace)
 set +o xtrace
 
 BS_FL_CONTROLLERS_PORT=${BS_FL_CONTROLLERS_PORT:-localhost:80}
@@ -51,4 +51,4 @@ function check_bigswitch_floodlight {
 }
 
 # Restore xtrace
-$BS3_XTRACE
+$_XTRACE_NEUTRON_BIGSWITCH
diff --git a/lib/nova b/lib/nova
index ba05f53b87..e5712939fe 100644
--- a/lib/nova
+++ b/lib/nova
@@ -25,7 +25,7 @@
 # - cleanup_nova
 
 # Save trace setting
-XTRACE=$(set +o | grep xtrace)
+_XTRACE_LIB_NOVA=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -958,7 +958,7 @@ function stop_nova {
 
 
 # Restore xtrace
-$XTRACE
+$_XTRACE_LIB_NOVA
 
 # Tell emacs to use shell-script-mode
 ## Local variables:
diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index 045fc8b919..dae55c6eba 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -8,7 +8,7 @@
 # ``STACK_USER`` has to be defined
 
 # Save trace setting
-LV_XTRACE=$(set +o | grep xtrace)
+_XTRACE_NOVA_FN_LIBVIRT=$(set +o | grep xtrace)
 set +o xtrace
 
 # Defaults
@@ -134,7 +134,7 @@ EOF
 
 
 # Restore xtrace
-$LV_XTRACE
+$_XTRACE_NOVA_FN_LIBVIRT
 
 # Local variables:
 # mode: shell-script
diff --git a/lib/nova_plugins/hypervisor-fake b/lib/nova_plugins/hypervisor-fake
index 3180d91f0a..2434dce884 100644
--- a/lib/nova_plugins/hypervisor-fake
+++ b/lib/nova_plugins/hypervisor-fake
@@ -17,7 +17,7 @@
 # cleanup_nova_hypervisor - remove transient data and cache
 
 # Save trace setting
-MY_XTRACE=$(set +o | grep xtrace)
+_XTRACE_VIRTFAKE=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -72,7 +72,7 @@ function stop_nova_hypervisor {
 
 
 # Restore xtrace
-$MY_XTRACE
+$_XTRACE_VIRTFAKE
 
 # Local variables:
 # mode: shell-script
diff --git a/lib/nova_plugins/hypervisor-ironic b/lib/nova_plugins/hypervisor-ironic
index b9e286d5b6..c6ed85d63e 100644
--- a/lib/nova_plugins/hypervisor-ironic
+++ b/lib/nova_plugins/hypervisor-ironic
@@ -17,7 +17,7 @@
 # cleanup_nova_hypervisor - remove transient data and cache
 
 # Save trace setting
-MY_XTRACE=$(set +o | grep xtrace)
+_XTRACE_HYP_IRONIC=$(set +o | grep xtrace)
 set +o xtrace
 
 source $TOP_DIR/lib/nova_plugins/functions-libvirt
@@ -81,7 +81,7 @@ function stop_nova_hypervisor {
 
 
 # Restore xtrace
-$MY_XTRACE
+$_XTRACE_HYP_IRONIC
 
 # Local variables:
 # mode: shell-script
diff --git a/lib/nova_plugins/hypervisor-libvirt b/lib/nova_plugins/hypervisor-libvirt
index c54a7166a0..8bbaa2133d 100644
--- a/lib/nova_plugins/hypervisor-libvirt
+++ b/lib/nova_plugins/hypervisor-libvirt
@@ -17,7 +17,7 @@
 # cleanup_nova_hypervisor - remove transient data and cache
 
 # Save trace setting
-MY_XTRACE=$(set +o | grep xtrace)
+_XTRACE_NOVA_LIBVIRT=$(set +o | grep xtrace)
 set +o xtrace
 
 source $TOP_DIR/lib/nova_plugins/functions-libvirt
@@ -105,7 +105,7 @@ function stop_nova_hypervisor {
 
 
 # Restore xtrace
-$MY_XTRACE
+$_XTRACE_NOVA_LIBVIRT
 
 # Local variables:
 # mode: shell-script
diff --git a/lib/nova_plugins/hypervisor-openvz b/lib/nova_plugins/hypervisor-openvz
index cce36b8d3f..58ab5c11ac 100644
--- a/lib/nova_plugins/hypervisor-openvz
+++ b/lib/nova_plugins/hypervisor-openvz
@@ -17,7 +17,7 @@
 # cleanup_nova_hypervisor - remove transient data and cache
 
 # Save trace setting
-MY_XTRACE=$(set +o | grep xtrace)
+_XTRACE_OPENVZ=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -62,7 +62,7 @@ function stop_nova_hypervisor {
 
 
 # Restore xtrace
-$MY_XTRACE
+$_XTRACE_OPENVZ
 
 # Local variables:
 # mode: shell-script
diff --git a/lib/nova_plugins/hypervisor-vsphere b/lib/nova_plugins/hypervisor-vsphere
index 698f836bad..7c08bc945b 100644
--- a/lib/nova_plugins/hypervisor-vsphere
+++ b/lib/nova_plugins/hypervisor-vsphere
@@ -17,7 +17,7 @@
 # cleanup_nova_hypervisor - remove transient data and cache
 
 # Save trace setting
-MY_XTRACE=$(set +o | grep xtrace)
+_XTRACE_NOVA_VSPHERE=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -64,7 +64,7 @@ function stop_nova_hypervisor {
 
 
 # Restore xtrace
-$MY_XTRACE
+$_XTRACE_NOVA_VSPHERE
 
 # Local variables:
 # mode: shell-script
diff --git a/lib/nova_plugins/hypervisor-xenserver b/lib/nova_plugins/hypervisor-xenserver
index e097990bd3..3eb9149bb4 100644
--- a/lib/nova_plugins/hypervisor-xenserver
+++ b/lib/nova_plugins/hypervisor-xenserver
@@ -17,7 +17,7 @@
 # cleanup_nova_hypervisor - remove transient data and cache
 
 # Save trace setting
-MY_XTRACE=$(set +o | grep xtrace)
+_XTRACE_XENSERVER=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -111,7 +111,7 @@ function stop_nova_hypervisor {
 
 
 # Restore xtrace
-$MY_XTRACE
+$_XTRACE_XENSERVER
 
 # Local variables:
 # mode: shell-script
diff --git a/lib/oslo b/lib/oslo
index 56615faaa3..3d6fbb38c6 100644
--- a/lib/oslo
+++ b/lib/oslo
@@ -16,7 +16,7 @@
 # - install_oslo
 
 # Save trace setting
-XTRACE=$(set +o | grep xtrace)
+_XTRACE_LIB_OSLO=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -95,7 +95,7 @@ function install_oslo {
 }
 
 # Restore xtrace
-$XTRACE
+$_XTRACE_LIB_OSLO
 
 # Tell emacs to use shell-script-mode
 ## Local variables:
diff --git a/lib/rpc_backend b/lib/rpc_backend
index 298dcb6e5f..3864adec32 100644
--- a/lib/rpc_backend
+++ b/lib/rpc_backend
@@ -21,7 +21,7 @@
 # of this file which is a standard interface.
 
 # Save trace setting
-XTRACE=$(set +o | grep xtrace)
+_XTRACE_RPC_BACKEND=$(set +o | grep xtrace)
 set +o xtrace
 
 # Functions
@@ -141,7 +141,7 @@ function rabbit_setuser {
 }
 
 # Restore xtrace
-$XTRACE
+$_XTRACE_RPC_BACKEND
 
 # Tell emacs to use shell-script-mode
 ## Local variables:
diff --git a/lib/swift b/lib/swift
index d7ccc24111..b596142ad2 100644
--- a/lib/swift
+++ b/lib/swift
@@ -24,7 +24,7 @@
 # - _cleanup_swift_apache_wsgi
 
 # Save trace setting
-XTRACE=$(set +o | grep xtrace)
+_XTRACE_LIB_SWIFT=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -823,7 +823,7 @@ function swift_configure_tempurls {
 }
 
 # Restore xtrace
-$XTRACE
+$_XTRACE_LIB_SWIFT
 
 # Tell emacs to use shell-script-mode
 ## Local variables:
diff --git a/lib/tempest b/lib/tempest
index 76fd6cac74..85e0e7fa35 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -38,7 +38,7 @@
 # - init_tempest
 
 # Save trace setting
-XTRACE=$(set +o | grep xtrace)
+_XTRACE_TEMPEST=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -649,7 +649,7 @@ function init_tempest {
 }
 
 # Restore xtrace
-$XTRACE
+$_XTRACE_TEMPEST
 
 # Tell emacs to use shell-script-mode
 ## Local variables:
diff --git a/lib/template b/lib/template
index 2703788af4..08d10bbf71 100644
--- a/lib/template
+++ b/lib/template
@@ -21,7 +21,7 @@
 # - cleanup_XXXX
 
 # Save trace setting
-XTRACE=$(set +o | grep xtrace)
+_XTRACE_TEMPLATE=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -92,7 +92,7 @@ function stop_XXXX {
 }
 
 # Restore xtrace
-$XTRACE
+$_XTRACE_TEMPLATE
 
 # Tell emacs to use shell-script-mode
 ## Local variables:
diff --git a/stack.sh b/stack.sh
index 8625b5aaeb..19d05c904a 100755
--- a/stack.sh
+++ b/stack.sh
@@ -573,7 +573,8 @@ run_phase source
 
 # Generic helper to configure passwords
 function read_password {
-    XTRACE=$(set +o | grep xtrace)
+    local xtrace
+    xtrace=$(set +o | grep xtrace)
     set +o xtrace
     var=$1; msg=$2
     pw=${!var}
@@ -616,7 +617,9 @@ function read_password {
         eval "$var=$pw"
         echo "$var=$pw" >> $localrc
     fi
-    $XTRACE
+
+    # restore previous xtrace value
+    $xtrace
 }
 
 

From f95315b6ea56b3f2cb18caeac734dd15e6704b93 Mon Sep 17 00:00:00 2001
From: Shinobu KINJO <shinobu@linux.com>
Date: Sat, 7 Nov 2015 10:21:08 +0900
Subject: [PATCH 0103/2409] Ensure link is set to up, when moving IP addresses
 across interfaces.

 - To add, initialize and set up a valiable named IP_UP
 - To bring up interface after moving IP to OVS bridge

Change-Id: I70f5974c115be6f7e7422a9a325f36cf3b71455a
Closes-Bug: #1469596
---
 lib/neutron-legacy | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index c244e5470a..ecff3e5774 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -798,6 +798,7 @@ function _move_neutron_addresses_route {
 
         local IP_ADD=""
         local IP_DEL=""
+        local IP_UP=""
         local DEFAULT_ROUTE_GW
         DEFAULT_ROUTE_GW=$(ip r | awk "/default.+$from_intf/ { print \$3; exit }")
         local ADD_OVS_PORT=""
@@ -821,9 +822,10 @@ function _move_neutron_addresses_route {
         if [[ "$IP_BRD" != "" ]]; then
             IP_DEL="sudo ip addr del $IP_BRD dev $from_intf"
             IP_ADD="sudo ip addr add $IP_BRD dev $to_intf"
+            IP_UP="sudo ip link set $to_intf up"
         fi
 
-        $IP_DEL; $IP_ADD; $ADD_OVS_PORT; $ADD_DEFAULT_ROUTE
+        $IP_DEL; $IP_ADD; $IP_UP; $ADD_OVS_PORT; $ADD_DEFAULT_ROUTE
     fi
 }
 

From 5509ed579773bf1a69bc5fb406a206a6da010c56 Mon Sep 17 00:00:00 2001
From: Atsushi SAKAI <sakaia@jp.fujitsu.com>
Date: Mon, 30 Nov 2015 20:20:21 +0900
Subject: [PATCH 0104/2409] Fix comment typos in inc/ and tests/ directories

valu3 => value3
enviromnet => environment
direcotry => directory
virualenv => virtualenv
editiable => editable
envirnment => environment

Change-Id: I97fb2d44a37b16d02d4fbdb08bfa33414349f651
---
 inc/ini-config       | 2 +-
 inc/python           | 8 ++++----
 tests/run-process.sh | 2 +-
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/inc/ini-config b/inc/ini-config
index 42a66c63b6..d2830d79cd 100644
--- a/inc/ini-config
+++ b/inc/ini-config
@@ -205,7 +205,7 @@ $option = $value
 }
 
 # Set a multiple line option in an INI file
-# iniset_multiline [-sudo] config-file section option value1 value2 valu3 ...
+# iniset_multiline [-sudo] config-file section option value1 value2 value3 ...
 function iniset_multiline {
     local xtrace
     xtrace=$(set +o | grep xtrace)
diff --git a/inc/python b/inc/python
index 91ceb44499..59668a2c6a 100644
--- a/inc/python
+++ b/inc/python
@@ -17,7 +17,7 @@ set +o xtrace
 
 # Global Config Variables
 
-# PROJECT_VENV contains the name of the virtual enviromnet for each
+# PROJECT_VENV contains the name of the virtual environment for each
 # project.  A null value installs to the system Python directories.
 declare -A PROJECT_VENV
 
@@ -35,7 +35,7 @@ function get_pip_command {
     fi
 }
 
-# Get the path to the direcotry where python executables are installed.
+# Get the path to the directory where python executables are installed.
 # get_python_exec_prefix
 function get_python_exec_prefix {
     local xtrace
@@ -93,7 +93,7 @@ function pip_install {
     fi
     if [[ $TRACK_DEPENDS = True && ! "$@" =~ virtualenv ]]; then
         # TRACK_DEPENDS=True installation creates a circular dependency when
-        # we attempt to install virtualenv into a virualenv, so we must global
+        # we attempt to install virtualenv into a virtualenv, so we must global
         # that installation.
         source $DEST/.venv/bin/activate
         local cmd_pip=$DEST/.venv/bin/pip
@@ -199,7 +199,7 @@ function setup_lib {
     setup_install $dir
 }
 
-# setup a library by name in editiable mode. If we are trying to use
+# setup a library by name in editable mode. If we are trying to use
 # the library from git, we'll do a git based install, otherwise we'll
 # punt and the library should be installed by a requirements pull from
 # another project.
diff --git a/tests/run-process.sh b/tests/run-process.sh
index bdf1395d07..301b9a032b 100755
--- a/tests/run-process.sh
+++ b/tests/run-process.sh
@@ -5,7 +5,7 @@
 #
 # Set USE_SCREEN True|False to change use of screen.
 #
-# This script emulates the basic exec envirnment in ``stack.sh`` to test
+# This script emulates the basic exec environment in ``stack.sh`` to test
 # the process spawn and kill operations.
 
 if [[ -z $1 ]]; then

From 779d8670287952b8865a1d506ba2d68406139430 Mon Sep 17 00:00:00 2001
From: Joe D'Andrea <jdandrea@research.att.com>
Date: Mon, 30 Nov 2015 15:35:13 +0000
Subject: [PATCH 0105/2409] Force heat deferred_auth_method to password in
 standalone mode

Heat does not support Keystone Trusts when deployed in standalone
mode. This change forces an error when HEAT_DEFERRED_AUTH is set
to anything other than "password" if HEAT_STANDALONE is True and
advises of the acceptable setting.

Change-Id: Ib4ee9d9af396093137a2a0f99f1b18ae153ccdb3
Closes-Bug: #1463837
---
 lib/heat | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lib/heat b/lib/heat
index 54666a5212..fdcf5bcaad 100644
--- a/lib/heat
+++ b/lib/heat
@@ -65,6 +65,12 @@ if [[ "$HEAT_STANDALONE" = "True" ]]; then
     # for standalone, use defaults which require no service user
     HEAT_STACK_DOMAIN=$(trueorfalse False HEAT_STACK_DOMAIN)
     HEAT_DEFERRED_AUTH=${HEAT_DEFERRED_AUTH:-password}
+    if [[ ${HEAT_DEFERRED_AUTH} != "password" ]]; then
+        # Heat does not support keystone trusts when deployed in
+        # standalone mode
+        die $LINENO \
+            'HEAT_DEFERRED_AUTH can only be set to "password" when HEAT_STANDALONE is True.'
+    fi
 else
     HEAT_STACK_DOMAIN=$(trueorfalse True HEAT_STACK_DOMAIN)
     HEAT_DEFERRED_AUTH=${HEAT_DEFERRED_AUTH:-trusts}

From 30d5fae31548ed998e4c053ba957f95e068eaebc Mon Sep 17 00:00:00 2001
From: Martin Hickey <martin.hickey@ie.ibm.com>
Date: Tue, 10 Nov 2015 13:44:15 +0000
Subject: [PATCH 0106/2409] Neutron: Use generated configuration files if
 available

Generate the neutron core sample config files by using the oslo
generator. The files are generated with a .sample extension and
replace the static example configuration files.

Once the generation code is delivered, the static config files
will be removed.

Change-Id: Ic37a16b6cf8eb92030649f1fc8b198738a8cc104
Related-blueprint: autogen-neutron-conf-file
Partial-bug: #1199963
Depends-On: I1c6dc4e7d479f1b7c755597caded24a0f018c712
Co-Authored-By: Louis Taylor <louis@kragniz.eu>
---
 lib/neutron-legacy                    | 19 +++++++++++++------
 lib/neutron_plugins/services/metering |  2 +-
 2 files changed, 14 insertions(+), 7 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index d00630af70..a60714f43b 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -870,7 +870,10 @@ function _create_neutron_conf_dir {
 function _configure_neutron_common {
     _create_neutron_conf_dir
 
-    cp $NEUTRON_DIR/etc/neutron.conf $NEUTRON_CONF
+    # Uses oslo config generator to generate core sample configuration files
+    (cd $NEUTRON_DIR && exec ./tools/generate_config_file_samples.sh)
+
+    cp $NEUTRON_DIR/etc/neutron.conf.sample $NEUTRON_CONF
 
     Q_POLICY_FILE=$NEUTRON_CONF_DIR/policy.json
     cp $NEUTRON_DIR/etc/policy.json $Q_POLICY_FILE
@@ -895,7 +898,9 @@ function _configure_neutron_common {
     Q_PLUGIN_CONF_FILE=$Q_PLUGIN_CONF_PATH/$Q_PLUGIN_CONF_FILENAME
     # NOTE(hichihara): Some neutron vendor plugins were already decomposed and
     # there is no config file in Neutron tree. They should prepare the file in each plugin.
-    if [ -f $NEUTRON_DIR/$Q_PLUGIN_CONF_FILE ]; then
+    if [ -f "$NEUTRON_DIR/$Q_PLUGIN_CONF_FILE.sample" ]; then
+        cp "$NEUTRON_DIR/$Q_PLUGIN_CONF_FILE.sample" /$Q_PLUGIN_CONF_FILE
+    elif [ -f $NEUTRON_DIR/$Q_PLUGIN_CONF_FILE ]; then
         cp $NEUTRON_DIR/$Q_PLUGIN_CONF_FILE /$Q_PLUGIN_CONF_FILE
     fi
 
@@ -903,6 +908,8 @@ function _configure_neutron_common {
     iniset $NEUTRON_CONF DEFAULT state_path $DATA_DIR/neutron
     iniset $NEUTRON_CONF DEFAULT use_syslog $SYSLOG
     iniset $NEUTRON_CONF DEFAULT bind_host $Q_LISTEN_ADDRESS
+    iniset $NEUTRON_CONF oslo_concurrency lock_path $DATA_DIR/neutron/lock
+
     # If addition config files are set, make sure their path name is set as well
     if [[ ${#Q_PLUGIN_EXTRA_CONF_FILES[@]} > 0 && $Q_PLUGIN_EXTRA_CONF_PATH == '' ]]; then
         die $LINENO "Neutron additional plugin config not set.. exiting"
@@ -959,7 +966,7 @@ function _configure_neutron_debug_command {
         return
     fi
 
-    cp $NEUTRON_DIR/etc/l3_agent.ini $NEUTRON_TEST_CONFIG_FILE
+    cp $NEUTRON_DIR/etc/l3_agent.ini.sample $NEUTRON_TEST_CONFIG_FILE
 
     iniset $NEUTRON_TEST_CONFIG_FILE DEFAULT verbose False
     iniset $NEUTRON_TEST_CONFIG_FILE DEFAULT debug False
@@ -975,7 +982,7 @@ function _configure_neutron_debug_command {
 
 function _configure_neutron_dhcp_agent {
 
-    cp $NEUTRON_DIR/etc/dhcp_agent.ini $Q_DHCP_CONF_FILE
+    cp $NEUTRON_DIR/etc/dhcp_agent.ini.sample $Q_DHCP_CONF_FILE
 
     iniset $Q_DHCP_CONF_FILE DEFAULT verbose True
     iniset $Q_DHCP_CONF_FILE DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
@@ -1007,7 +1014,7 @@ function _configure_neutron_l3_agent {
         neutron_vpn_configure_agent
     fi
 
-    cp $NEUTRON_DIR/etc/l3_agent.ini $Q_L3_CONF_FILE
+    cp $NEUTRON_DIR/etc/l3_agent.ini.sample $Q_L3_CONF_FILE
 
     iniset $Q_L3_CONF_FILE DEFAULT verbose True
     iniset $Q_L3_CONF_FILE DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
@@ -1028,7 +1035,7 @@ function _configure_neutron_l3_agent {
 }
 
 function _configure_neutron_metadata_agent {
-    cp $NEUTRON_DIR/etc/metadata_agent.ini $Q_META_CONF_FILE
+    cp $NEUTRON_DIR/etc/metadata_agent.ini.sample $Q_META_CONF_FILE
 
     iniset $Q_META_CONF_FILE DEFAULT verbose True
     iniset $Q_META_CONF_FILE DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
diff --git a/lib/neutron_plugins/services/metering b/lib/neutron_plugins/services/metering
index 5fd2fdce44..5b32468d21 100644
--- a/lib/neutron_plugins/services/metering
+++ b/lib/neutron_plugins/services/metering
@@ -21,7 +21,7 @@ function neutron_agent_metering_configure_agent {
 
     METERING_AGENT_CONF_FILENAME="$METERING_AGENT_CONF_PATH/metering_agent.ini"
 
-    cp $NEUTRON_DIR/etc/metering_agent.ini $METERING_AGENT_CONF_FILENAME
+    cp $NEUTRON_DIR/etc/metering_agent.ini.sample $METERING_AGENT_CONF_FILENAME
 }
 
 function neutron_metering_stop {

From e0ac37c257bf08db8d220d13773859d9202305d2 Mon Sep 17 00:00:00 2001
From: Dmitry Guryanov <dguryanov@parallels.com>
Date: Mon, 30 Nov 2015 18:48:23 +0300
Subject: [PATCH 0107/2409] Fix path setup in add_sudo_secure_path

There are two bugs in add_sudo_secure_path.

Firstly we don't properly check if the file exists, so always append
the new line.  This will overwrite any existing changes.

Secondly the logic for checking if the path exists is inverted, so we
miss adding paths when we should.  This particularly causes failures
when installing with virtualenv's since the paths are inside the
virtualenv, rather than the standard system locations.

Change-Id: I646fe0c68958470d464fe4f3d81d5c17dd6f2ab6
Closes-bug: #1521241
---
 inc/rootwrap | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/inc/rootwrap b/inc/rootwrap
index 63ab59adc7..2a6e4b648f 100644
--- a/inc/rootwrap
+++ b/inc/rootwrap
@@ -22,14 +22,14 @@ function add_sudo_secure_path {
     local line
 
     # This is pretty simplistic for now - assume only the first line is used
-    if [[ -r SUDO_SECURE_PATH_FILE ]]; then
+    if [[ -r $SUDO_SECURE_PATH_FILE ]]; then
         line=$(head -1 $SUDO_SECURE_PATH_FILE)
     else
         line="Defaults:$STACK_USER secure_path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/sbin:/usr/bin:/bin"
     fi
 
     # Only add ``dir`` if it is not already present
-    if [[ $line =~ $dir ]]; then
+    if [[ ! $line =~ $dir ]]; then
         echo "${line}:$dir" | sudo tee $SUDO_SECURE_PATH_FILE
         sudo chmod 400 $SUDO_SECURE_PATH_FILE
         sudo chown root:root $SUDO_SECURE_PATH_FILE

From 1afc28bf6c33c792eb9d2fd1992534e82af29291 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 27 Nov 2015 14:15:56 +1100
Subject: [PATCH 0108/2409] Turn off tracing when outputting errors

When outputting these error strings, turn off the tracing so the user
can actually read it.  Also reword the "not root" user message so it
fits into a standard terminal window length.

Change-Id: I466c60865bc1128f4edd219f831a9c6cffa67829
Parital-Bug: #1517199
---
 stack.sh | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/stack.sh b/stack.sh
index 8625b5aaeb..083c488fc1 100755
--- a/stack.sh
+++ b/stack.sh
@@ -75,6 +75,7 @@ fi
 
 # Check if run in POSIX shell
 if [[ "${POSIXLY_CORRECT}" == "y" ]]; then
+    set +o xtrace
     echo "You are running POSIX compatibility mode, DevStack requires bash 4.2 or newer."
     exit 1
 fi
@@ -85,11 +86,11 @@ fi
 # action to create a suitable user account.
 
 if [[ $EUID -eq 0 ]]; then
-    echo "You are running this script as root."
-    echo "Cut it out."
-    echo "Really."
-    echo "If you need an account to run DevStack, do this (as root, heh) to create a non-root account:"
-    echo "$TOP_DIR/tools/create-stack-user.sh"
+    set +o xtrace
+    echo "DevStack should be run as a user with sudo permissions, "
+    echo "not root."
+    echo "A \"stack\" user configured correctly can be created with:"
+    echo " $TOP_DIR/tools/create-stack-user.sh"
     exit 1
 fi
 
@@ -98,6 +99,7 @@ fi
 # virtual env, and will fail in really odd ways if you do this. Make
 # this explicit as it has come up on the mailing list.
 if [[ -n "$VIRTUAL_ENV" ]]; then
+    set +o xtrace
     echo "You appear to be running under a python virtualenv."
     echo "DevStack does not support this, as we may break the"
     echo "virtualenv you are currently in by modifying "
@@ -111,6 +113,7 @@ fi
 # on a lot of different environments, you sometimes run it on the
 # wrong box. This makes there be a way to prevent that.
 if [[ -e $HOME/.no-devstack ]]; then
+    set +o xtrace
     echo "You've marked this host as a no-devstack host, to save yourself from"
     echo "running devstack accidentally. If this is in error, please remove the"
     echo "~/.no-devstack file"

From ddc3839bdc7ff73f6224273605db10fd88cd60df Mon Sep 17 00:00:00 2001
From: Doug Hellmann <doug@doughellmann.com>
Date: Thu, 7 May 2015 21:06:24 +0000
Subject: [PATCH 0109/2409] Enable optional Python 3 support

Add USE_PYTHON3 and PYTHON3_VERSION variables to allow services to use
python 3 if they indicate support in their python package metadata.

Tested in Heat here -> I837c2fba682ab430d50e9f43913f2fed20325a7a.
Project config change to add a dedicated job to Heat is here -> I0837e62d6ccc66397a5e409f0961edd4be31f467

Change-Id: I079e18b58b214bf8362945c253d6d894ca8b1a6b
---
 inc/python               | 47 +++++++++++++++++++++++++++++++++++++---
 lib/stack                |  1 +
 stackrc                  | 11 ++++++++++
 tools/install_pip.sh     |  8 +++++++
 tools/install_prereqs.sh |  3 +++
 5 files changed, 67 insertions(+), 3 deletions(-)

diff --git a/inc/python b/inc/python
index 59668a2c6a..c157604699 100644
--- a/inc/python
+++ b/inc/python
@@ -28,10 +28,13 @@ declare -A PROJECT_VENV
 # Get the path to the pip command.
 # get_pip_command
 function get_pip_command {
-    which pip || which pip-python
+    local version="$1"
+    # NOTE(dhellmann): I don't know if we actually get a pip3.4-python
+    # under any circumstances.
+    which pip${version} || which pip${version}-python
 
     if [ $? -ne 0 ]; then
-        die $LINENO "Unable to find pip; cannot continue"
+        die $LINENO "Unable to find pip${version}; cannot continue"
     fi
 }
 
@@ -66,6 +69,13 @@ function pip_install_gr {
     pip_install $clean_name
 }
 
+# Determine the python versions supported by a package
+function get_python_versions_for_package {
+    local name=$1
+    cd $name && python setup.py --classifiers \
+        | grep 'Language' | cut -f5 -d: | grep '\.' | tr '\n' ' '
+}
+
 # Wrapper for ``pip install`` to set cache and proxy environment variables
 # Uses globals ``OFFLINE``, ``PIP_VIRTUAL_ENV``,
 # ``PIP_UPGRADE``, ``TRACK_DEPENDS``, ``*_proxy``,
@@ -104,8 +114,22 @@ function pip_install {
             local sudo_pip="env"
         else
             local cmd_pip
-            cmd_pip=$(get_pip_command)
+            cmd_pip=$(get_pip_command $PYTHON2_VERSION)
             local sudo_pip="sudo -H"
+            if python3_enabled; then
+                # Look at the package classifiers to find the python
+                # versions supported, and if we find the version of
+                # python3 we've been told to use, use that instead of the
+                # default pip
+                local package_dir=${!#}
+                local python_versions
+                if [[ -d "$package_dir" ]]; then
+                    python_versions=$(get_python_versions_for_package $package_dir)
+                    if [[ $python_versions =~ $PYTHON3_VERSION ]]; then
+                        cmd_pip=$(get_pip_command $PYTHON3_VERSION)
+                    fi
+                fi
+            fi
         fi
     fi
 
@@ -113,6 +137,8 @@ function pip_install {
     # Always apply constraints
     cmd_pip="$cmd_pip -c $REQUIREMENTS_DIR/upper-constraints.txt"
 
+    # FIXME(dhellmann): Need to force multiple versions of pip for
+    # packages like setuptools?
     local pip_version
     pip_version=$(python -c "import pip; \
                         print(pip.__version__.strip('.')[0])")
@@ -276,6 +302,21 @@ function setup_package {
     fi
 }
 
+# Report whether python 3 should be used
+function python3_enabled {
+    if [[ $USE_PYTHON3 == "True" ]]; then
+        return 0
+    else
+        return 1
+    fi
+}
+
+# Install python3 packages
+function install_python3 {
+    if is_ubuntu; then
+        apt_get install python3.4 python3.4-dev
+    fi
+}
 
 # Restore xtrace
 $INC_PY_TRACE
diff --git a/lib/stack b/lib/stack
index 7d98604b82..f09ddcee85 100644
--- a/lib/stack
+++ b/lib/stack
@@ -19,6 +19,7 @@
 function stack_install_service {
     local service=$1
     if type install_${service} >/dev/null 2>&1; then
+        # FIXME(dhellmann): Needs to be python3-aware at some point.
         if [[ ${USE_VENV} = True && -n ${PROJECT_VENV[$service]:-} ]]; then
             rm -rf ${PROJECT_VENV[$service]}
             source $TOP_DIR/tools/build_venv.sh ${PROJECT_VENV[$service]} ${ADDITIONAL_VENV_PACKAGES//,/ }
diff --git a/stackrc b/stackrc
index 5dd109c0a4..f949ccbad9 100644
--- a/stackrc
+++ b/stackrc
@@ -118,6 +118,17 @@ if [[ -r $RC_DIR/.localrc.password ]]; then
     source $RC_DIR/.localrc.password
 fi
 
+# Control whether Python 3 should be used.
+export USE_PYTHON3=${USE_PYTHON3:-False}
+
+# When Python 3 is supported by an application, adding the specific
+# version of Python 3 to this variable will install the app using that
+# version of the interpreter instead of 2.7.
+export PYTHON3_VERSION=${PYTHON3_VERSION:-3.4}
+
+# Just to be more explicit on the Python 2 version to use.
+export PYTHON2_VERSION=${PYTHON2_VERSION:-2.7}
+
 # allow local overrides of env variables, including repo config
 if [[ -f $RC_DIR/localrc ]]; then
     # Old-style user-supplied config
diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index ab5efb2e77..f239c7bb16 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -8,6 +8,7 @@
 
 # Assumptions:
 # - update pip to $INSTALL_PIP_VERSION
+# - if USE_PYTHON3=True, PYTHON3_VERSION refers to a version already installed
 
 set -o errexit
 set -o xtrace
@@ -31,6 +32,8 @@ GetDistro
 echo "Distro: $DISTRO"
 
 function get_versions {
+    # FIXME(dhellmann): Deal with multiple python versions here? This
+    # is just used for reporting, so maybe not?
     PIP=$(which pip 2>/dev/null || which pip-python 2>/dev/null || true)
     if [[ -n $PIP ]]; then
         PIP_VERSION=$($PIP --version | awk '{ print $2}')
@@ -75,6 +78,9 @@ function install_get_pip {
         touch $LOCAL_PIP.downloaded
     fi
     sudo -H -E python $LOCAL_PIP
+    if python3_enabled; then
+        sudo -H -E python${PYTHON3_VERSION} $LOCAL_PIP
+    fi
 }
 
 
@@ -114,6 +120,7 @@ get_versions
 # python in f23 depends on the python-pip package
 if ! { is_fedora && [[ $DISTRO == "f23" ]]; }; then
     uninstall_package python-pip
+    uninstall_package python3-pip
 fi
 
 install_get_pip
@@ -122,6 +129,7 @@ if [[ -n $PYPI_ALTERNATIVE_URL ]]; then
     configure_pypi_alternative_url
 fi
 
+set -x
 pip_install -U setuptools
 
 get_versions
diff --git a/tools/install_prereqs.sh b/tools/install_prereqs.sh
index 38452cd90f..031f8a8eca 100755
--- a/tools/install_prereqs.sh
+++ b/tools/install_prereqs.sh
@@ -81,6 +81,9 @@ if [[ -n "$SYSLOG" && "$SYSLOG" != "False" ]]; then
     fi
 fi
 
+if python3_enabled; then
+    install_python3
+fi
 
 # Mark end of run
 # ---------------

From 88ee8ce4684e13865123636dd5d2baa5d6a44ef7 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 2 Dec 2015 07:47:31 -0500
Subject: [PATCH 0110/2409] create apt_get_update to try to work around broken
 mirrors

Ubuntu's apt mirroring mechanism produces inconsistent mirrors pretty
regularly. The devstack-gate apt-get update model seems to have been
more effective getting past this than what we did in devstack. Adopt
that method for our updates.

Change-Id: I97c7896ef38b275aacb4f933fc849acee1bab858
---
 functions-common | 39 +++++++++++++++++++++++++++++----------
 1 file changed, 29 insertions(+), 10 deletions(-)

diff --git a/functions-common b/functions-common
index d68ae77971..d4099ffcfa 100644
--- a/functions-common
+++ b/functions-common
@@ -978,6 +978,34 @@ function _get_package_dir {
     echo "$pkg_dir"
 }
 
+# Wrapper for ``apt-get update`` to try multiple times on the update
+# to address bad package mirrors (which happen all the time).
+function apt_get_update {
+    # only do this once per run
+    if [[ "$REPOS_UPDATED" == "True" && "$RETRY_UPDATE" != "True" ]]; then
+        return
+    fi
+
+    # bail if we are offline
+    [[ "$OFFLINE" = "True" ]] && return
+
+    local sudo="sudo"
+    [[ "$(id -u)" = "0" ]] && sudo="env"
+
+    # time all the apt operations
+    time_start "apt-get-update"
+
+    local proxies="http_proxy=${http_proxy:-} https_proxy=${https_proxy:-} no_proxy=${no_proxy:-} "
+    local update_cmd="$sudo $proxies apt-get update"
+    if ! timeout 300 sh -c "while ! $update_cmd; do sleep 30; done"; then
+        die $LINENO "Failed to update apt repos, we're dead now"
+    fi
+
+    REPOS_UPDATED=True
+    # stop the clock
+    time_stop "apt-get-update"
+}
+
 # Wrapper for ``apt-get`` to set cache and proxy environment variables
 # Uses globals ``OFFLINE``, ``*_proxy``
 # apt_get operation package [package ...]
@@ -1158,16 +1186,7 @@ function update_package_repo {
     fi
 
     if is_ubuntu; then
-        local xtrace
-        xtrace=$(set +o | grep xtrace)
-        set +o xtrace
-        if [[ "$REPOS_UPDATED" != "True" || "$RETRY_UPDATE" = "True" ]]; then
-            # if there are transient errors pulling the updates, that's fine.
-            # It may be secondary repositories that we don't really care about.
-            apt_get update  || /bin/true
-            REPOS_UPDATED=True
-        fi
-        $xtrace
+        apt_get_update
     fi
 }
 

From 41d01104b16bf5d0d6d4d7d2a1e5883d34bff810 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 3 Dec 2015 08:12:23 -0500
Subject: [PATCH 0111/2409] remove generic extras.d support

This removes the generic extras.d support, which we said we'd do at
Mitaka-1. In tree extras.d continues to function as before, though we
need stories to get ceph and ironic into plugins, and a better
solution for Tempest.

Change-Id: I8b134446dc08a2c3852423ca71af2f469f85496e
---
 functions-common | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/functions-common b/functions-common
index d68ae77971..91a148603b 100644
--- a/functions-common
+++ b/functions-common
@@ -1741,17 +1741,18 @@ function run_phase {
     if [[ -d $TOP_DIR/extras.d ]]; then
         local extra_plugin_file_name
         for extra_plugin_file_name in $TOP_DIR/extras.d/*.sh; do
-            [[ -r $extra_plugin_file_name ]] && source $extra_plugin_file_name $mode $phase
-            # NOTE(sdague): generate a big warning about using
-            # extras.d in an unsupported way which will let us track
-            # unsupported usage in the gate.
+            # NOTE(sdague): only process extras.d for the 3 explicitly
+            # white listed elements in tree. We want these to move out
+            # over time as well, but they are in tree, so we need to
+            # manage that.
             local exceptions="50-ironic.sh 60-ceph.sh 80-tempest.sh"
             local extra
             extra=$(basename $extra_plugin_file_name)
             if [[ ! ( $exceptions =~ "$extra" ) ]]; then
-                deprecated "extras.d support is being removed in Mitaka-1"
-                deprecated "jobs for project $extra will break after that point"
-                deprecated "please move project to a supported devstack plugin model"
+                warn "use of extras.d is no longer supported"
+                warn "processing of project $extra is skipped"
+            else
+                [[ -r $extra_plugin_file_name ]] && source $extra_plugin_file_name $mode $phase
             fi
         done
     fi

From 2391d4321ffe3a0a482e01d133038dfd38c76bac Mon Sep 17 00:00:00 2001
From: Devananda van der Veen <devananda.vdv@gmail.com>
Date: Thu, 3 Dec 2015 09:16:18 -0800
Subject: [PATCH 0112/2409] Update lib/ironic to always skip cleaning

Previously, devstack would disable ironic's cleaning phase if a driver
with "agent" in the name was used. However, we have begun using the IPA
ramdisk for all tests in the gate, which caused cleaning to be run for
the "pxe_ssh" job which therefore fails due to timeouts.

As a result, for now, we need to always disable cleaning.

As a point of record, we should actually be testing cleaning in the
gate. However, running 'shred' on the disks of a nested VM is too slow
and causes the gate to timeout // take too long. Some options have been
discussed for ways to test the callback mechanism but avoid actually
running 'shred' on the disks.

This needs to be revisited.

Change-Id: Id15cf6cc49122b08e557e44871b31a8c0d20b55d
Related-to-Bug: #1517277
---
 lib/ironic | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/lib/ironic b/lib/ironic
index 27b0c8d4ff..2fb2004d71 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -365,6 +365,9 @@ function configure_ironic_conductor {
         iniset $IRONIC_CONF_FILE pxe pxe_append_params "$pxe_params"
     fi
 
+    # Set these options for scenarios in which the agent fetches the image
+    # directly from glance, and don't set them where the image is pushed
+    # over iSCSI.
     if is_deployed_by_agent; then
         if [[ "$SWIFT_ENABLE_TEMPURLS" == "True" ]] ; then
             iniset $IRONIC_CONF_FILE glance swift_temp_url_key $SWIFT_TEMPURL_KEY
@@ -379,9 +382,13 @@ function configure_ironic_conductor {
         iniset $IRONIC_CONF_FILE glance swift_container glance
         iniset $IRONIC_CONF_FILE glance swift_temp_url_duration 3600
         iniset $IRONIC_CONF_FILE agent heartbeat_timeout 30
-        iniset $IRONIC_CONF_FILE agent agent_erase_devices_priority 0
     fi
 
+    # FIXME: this really needs to be tested in the gate.
+    # For now, any test using the agent ramdisk should skip cleaning
+    # because it is too slow to run in the gate.
+    iniset $IRONIC_CONF_FILE agent agent_erase_devices_priority 0
+
     if [[ "$IRONIC_IPXE_ENABLED" == "True" ]] ; then
         local pxebin
         pxebin=`basename $IRONIC_PXE_BOOT_IMAGE`

From 7b7101f1c5ccd4d0722245613df8c8f7a67e79b9 Mon Sep 17 00:00:00 2001
From: Martin Hickey <martin.hickey@ie.ibm.com>
Date: Tue, 1 Dec 2015 22:17:42 +0000
Subject: [PATCH 0113/2409] Neutron FWaaS: Use generated configuration files if
 available

Generate the Neutron FWaaS sample config files by using the oslo
generator. The files are generated with a .sample extension and
replace the static example configuration files.

Once the generation code is delivered, the static config files
will be removed.

Change-Id: Ic8208850a27408c8fbeed80ecdb43345aa7dfaa4
Related-blueprint: autogen-neutron-conf-file
Partial-bug: #1199963
Depends-On: I8e9113dfb88e5290f6eedd012d1a52fc35c3c88c
---
 lib/neutron_plugins/services/firewall | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/services/firewall b/lib/neutron_plugins/services/firewall
index 1d81a21825..2b7f32d233 100644
--- a/lib/neutron_plugins/services/firewall
+++ b/lib/neutron_plugins/services/firewall
@@ -14,8 +14,11 @@ function neutron_fwaas_configure_common {
 }
 
 function neutron_fwaas_configure_driver {
+    # Uses oslo config generator to generate FWaaS sample configuration files
+    (cd $NEUTRON_FWAAS_DIR && exec ./tools/generate_config_file_samples.sh)
+
     FWAAS_DRIVER_CONF_FILENAME=/etc/neutron/fwaas_driver.ini
-    cp $NEUTRON_FWAAS_DIR/etc/fwaas_driver.ini $FWAAS_DRIVER_CONF_FILENAME
+    cp $NEUTRON_FWAAS_DIR/etc/fwaas_driver.ini.sample $FWAAS_DRIVER_CONF_FILENAME
 
     iniset_multiline $FWAAS_DRIVER_CONF_FILENAME fwaas enabled True
     iniset_multiline $FWAAS_DRIVER_CONF_FILENAME fwaas driver "neutron_fwaas.services.firewall.drivers.linux.iptables_fwaas.IptablesFwaasDriver"

From 2a688440132173d493dff7c7c3760681d41e11be Mon Sep 17 00:00:00 2001
From: Steven Hardy <shardy@redhat.com>
Date: Tue, 8 Dec 2015 13:26:29 +0000
Subject: [PATCH 0114/2409] Heat - revise keystone/trusts config to avoid
 deprecated options

There are some inter-related changes required to avoid using legacy
fallback/deprecated paths in heat, which result in warnings in the
log, e.g because we fall-back to reusing keystone auth_token
configuration instead of heat specific sections.

To fix this:
- Don't explicitly set deferred_auth_method=trusts, as this is now
  the default (since kilo)
- Create a new "trustee" section containing configuration used for
  the password auth-plugin associated with deferred authentication
  via trusts (support for this was added during liberty to enable
  us to stop incorrectly using the keystone auth_token config)
- Create a "clients_keystone" section to avoid falling back to the
  legacy behavior of stealing the uri from auth_token.

This also means we can remove the FIXME and auth_token auth_uri
mentioned by jamielennox.

Change-Id: Ie34332a7aec3b9b271df0759dd6ab66b45302832
Related-Bug: #1300246
---
 lib/heat | 31 ++++++++++++++++++++++---------
 1 file changed, 22 insertions(+), 9 deletions(-)

diff --git a/lib/heat b/lib/heat
index fdcf5bcaad..3666776317 100644
--- a/lib/heat
+++ b/lib/heat
@@ -56,6 +56,10 @@ HEAT_ENV_DIR=$HEAT_CONF_DIR/environment.d
 HEAT_TEMPLATES_DIR=$HEAT_CONF_DIR/templates
 HEAT_API_HOST=${HEAT_API_HOST:-$HOST_IP}
 HEAT_API_PORT=${HEAT_API_PORT:-8004}
+HEAT_SERVICE_USER=${HEAT_SERVICE_USER:-heat}
+HEAT_TRUSTEE_USER=${HEAT_TRUSTEE_USER:-$HEAT_SERVICE_USER}
+HEAT_TRUSTEE_PASSWORD=${HEAT_TRUSTEE_PASSWORD:-$SERVICE_PASSWORD}
+HEAT_TRUSTEE_DOMAIN=${HEAT_TRUSTEE_DOMAIN:-default}
 
 # Support entry points installation of console scripts
 HEAT_BIN_DIR=$(get_python_exec_prefix)
@@ -73,7 +77,7 @@ if [[ "$HEAT_STANDALONE" = "True" ]]; then
     fi
 else
     HEAT_STACK_DOMAIN=$(trueorfalse True HEAT_STACK_DOMAIN)
-    HEAT_DEFERRED_AUTH=${HEAT_DEFERRED_AUTH:-trusts}
+    HEAT_DEFERRED_AUTH=${HEAT_DEFERRED_AUTH:-}
 fi
 HEAT_PLUGIN_DIR=${HEAT_PLUGIN_DIR:-$DATA_DIR/heat/plugins}
 ENABLE_HEAT_PLUGINS=${ENABLE_HEAT_PLUGINS:-}
@@ -134,30 +138,39 @@ function configure_heat {
         setup_colorized_logging $HEAT_CONF DEFAULT tenant user
     fi
 
-    iniset $HEAT_CONF DEFAULT deferred_auth_method $HEAT_DEFERRED_AUTH
+    if [ ! -z "$HEAT_DEFERRED_AUTH" ]; then
+        iniset $HEAT_CONF DEFAULT deferred_auth_method $HEAT_DEFERRED_AUTH
+    fi
 
     if [ "$HEAT_USE_MOD_WSGI" == "True" ]; then
         _config_heat_apache_wsgi
     fi
 
-    # NOTE(jamielennox): heat re-uses specific values from the
-    # keystone_authtoken middleware group and so currently fails when using the
-    # auth plugin setup. This should be fixed in heat.  Heat is also the only
-    # service that requires the auth_uri to include a /v2.0. Remove this custom
-    # setup when bug #1300246 is resolved.
-    iniset $HEAT_CONF keystone_authtoken auth_uri $KEYSTONE_SERVICE_URI/v2.0
     if [[ "$HEAT_STANDALONE" = "True" ]]; then
         iniset $HEAT_CONF paste_deploy flavor standalone
         iniset $HEAT_CONF clients_heat url "http://$HEAT_API_HOST:$HEAT_API_PORT/v1/%(tenant_id)s"
     else
         iniset $HEAT_CONF keystone_authtoken identity_uri $KEYSTONE_AUTH_URI
-        iniset $HEAT_CONF keystone_authtoken admin_user heat
+        iniset $HEAT_CONF keystone_authtoken admin_user $HEAT_SERVICE_USER
         iniset $HEAT_CONF keystone_authtoken admin_password $SERVICE_PASSWORD
         iniset $HEAT_CONF keystone_authtoken admin_tenant_name $SERVICE_TENANT_NAME
         iniset $HEAT_CONF keystone_authtoken cafile $SSL_BUNDLE_FILE
         iniset $HEAT_CONF keystone_authtoken signing_dir $HEAT_AUTH_CACHE_DIR
     fi
 
+    # If HEAT_DEFERRED_AUTH is unset or explicitly set to trusts, configure
+    # the section for the client plugin associated with the trustee
+    if [ -z "$HEAT_DEFERRED_AUTH" -o "trusts" == "$HEAT_DEFERRED_AUTH" ]; then
+        iniset $HEAT_CONF trustee auth_plugin password
+        iniset $HEAT_CONF trustee auth_url $KEYSTONE_AUTH_URI
+        iniset $HEAT_CONF trustee username $HEAT_TRUSTEE_USER
+        iniset $HEAT_CONF trustee password $HEAT_TRUSTEE_PASSWORD
+        iniset $HEAT_CONF trustee user_domain_id $HEAT_TRUSTEE_DOMAIN
+    fi
+
+    # clients_keystone
+    iniset $HEAT_CONF clients_keystone auth_uri $KEYSTONE_AUTH_URI
+
     # ec2authtoken
     iniset $HEAT_CONF ec2authtoken auth_uri $KEYSTONE_SERVICE_URI/v2.0
 

From 642b07b930cf5f49d1ed9aa220021d45ca631b1a Mon Sep 17 00:00:00 2001
From: ghanshyam <ghanshyam.mann@nectechnologies.in>
Date: Thu, 19 Nov 2015 10:01:14 +0900
Subject: [PATCH 0115/2409] Add compute microversions configuration on tempest

Many projects like Nova, Ironic etc have implemented the
microversions for versioning their APIs.

Tempest is going to tests those microversions -
I57b78b4c0543b6fb0533b556886a19a03297555e.

For testing microversion in Tempest on gate, we need to set
a valid range of microversion in Tempest config and based on that
Tempest will run appropriate tests.

This commit adds the below range options for compute microversion testing-
- [None, 'latest'] - for master branch as default
- [None, None] - for tests running on v2.0
- option to set the range.

Depends-On: I81e86faca6f8c0ffb7da22154a62236ac25cf0c0

Partially implements blueprint api-microversions-testing-support

Change-Id: I171b862d1bba1af467f5b9a76288216c39e2adda
---
 lib/tempest | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index 6adc449ad0..61351c0628 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -357,6 +357,30 @@ function configure_tempest {
         compute_api_extensions=$(remove_disabled_extensions $compute_api_extensions $DISABLE_COMPUTE_API_EXTENSIONS)
     fi
 
+    # Set the microversion range for compute tests.
+    # This is used to run the Nova microversions tests.
+    # Setting [None, latest] range of microversion which allow Tempest to run all microversions tests.
+    # NOTE- To avoid microversion tests failure on stable branch, we need to change "tempest_compute_max_microversion"
+    #       for stable branch on each release which should be changed from "latest" to max supported version of that release.
+    local tempest_compute_min_microversion=${TEMPEST_COMPUTE_MIN_MICROVERSION:-None}
+    local tempest_compute_max_microversion=${TEMPEST_COMPUTE_MAX_MICROVERSION:-"latest"}
+    # Reset microversions to None where v2.0 is running which does not support microversion.
+    # Both "None" means no microversion testing.
+    if [[ "$TEMPEST_COMPUTE_TYPE" == "compute_legacy" ]]; then
+        tempest_compute_min_microversion=None
+        tempest_compute_max_microversion=None
+    fi
+    if [ "$tempest_compute_min_microversion" == "None" ]; then
+        inicomment $TEMPEST_CONFIG compute-feature-enabled min_microversion
+    else
+        iniset $TEMPEST_CONFIG compute-feature-enabled min_microversion $tempest_compute_min_microversion
+    fi
+    if [ "$tempest_compute_max_microversion" == "None" ]; then
+        inicomment $TEMPEST_CONFIG compute-feature-enabled max_microversion
+    else
+        iniset $TEMPEST_CONFIG compute-feature-enabled max_microversion $tempest_compute_max_microversion
+    fi
+
     iniset $TEMPEST_CONFIG compute-feature-enabled resize True
     iniset $TEMPEST_CONFIG compute-feature-enabled live_migration ${LIVE_MIGRATION_AVAILABLE:-False}
     iniset $TEMPEST_CONFIG compute-feature-enabled change_password False

From af0801de3c1b1c51cf1a995c2939e182d2ef4926 Mon Sep 17 00:00:00 2001
From: Philipp Marek <philipp.marek@linbit.com>
Date: Wed, 9 Dec 2015 13:51:56 +0100
Subject: [PATCH 0116/2409] Make logfile symlinks with relative names.

Using absolute names for the symlink breaks in quite a few ways;
 * when creating a tar file of the logs,
 * when serving via NFS,

or any other case where the directory gets transferred to
a different machine.

So just create the symlink with relative names, then they'll work
in any location.

Change-Id: I432a69754985fc71feb0068b7adca01066d7bc1b
---
 functions-common | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/functions-common b/functions-common
index d4099ffcfa..0c5e48cadf 100644
--- a/functions-common
+++ b/functions-common
@@ -1309,10 +1309,11 @@ function _run_process {
     exec 3>&-
     exec 6>&-
 
-    local real_logfile="${LOGDIR}/${service}.log.${CURRENT_LOG_TIME}"
+    local logfile="${service}.log.${CURRENT_LOG_TIME}"
+    local real_logfile="${LOGDIR}/${logfile}"
     if [[ -n ${LOGDIR} ]]; then
         exec 1>&"$real_logfile" 2>&1
-        ln -sf "$real_logfile" ${LOGDIR}/${service}.log
+        bash -c "cd '$LOGDIR' && ln -sf '$logfile' ${service}.log"
         if [[ -n ${SCREEN_LOGDIR} ]]; then
             # Drop the backward-compat symlink
             ln -sf "$real_logfile" ${SCREEN_LOGDIR}/screen-${service}.log
@@ -1399,7 +1400,8 @@ function screen_process {
 
     screen -S $SCREEN_NAME -X screen -t $name
 
-    local real_logfile="${LOGDIR}/${name}.log.${CURRENT_LOG_TIME}"
+    local logfile="${name}.log.${CURRENT_LOG_TIME}"
+    local real_logfile="${LOGDIR}/${logfile}"
     echo "LOGDIR: $LOGDIR"
     echo "SCREEN_LOGDIR: $SCREEN_LOGDIR"
     echo "log: $real_logfile"
@@ -1410,7 +1412,7 @@ function screen_process {
         fi
         # If logging isn't active then avoid a broken symlink
         touch "$real_logfile"
-        ln -sf "$real_logfile" ${LOGDIR}/${name}.log
+        bash -c "cd '$LOGDIR' && ln -sf '$logfile' ${name}.log"
         if [[ -n ${SCREEN_LOGDIR} ]]; then
             # Drop the backward-compat symlink
             ln -sf "$real_logfile" ${SCREEN_LOGDIR}/screen-${1}.log

From 56632fc75ddd4af3239c44e27673854dd65f4628 Mon Sep 17 00:00:00 2001
From: Jim Rollenhagen <jim@jimrollenhagen.com>
Date: Thu, 10 Dec 2015 05:57:19 -0800
Subject: [PATCH 0117/2409] Fix override-defaults in plugin docs

Docs specify that this file should be override_defaults, when really
devstack looks for override-defaults.

Change-Id: I3900ec4d16ffb48c6969dac5081ea2817536c246
---
 doc/source/plugins.rst | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/source/plugins.rst b/doc/source/plugins.rst
index b8da7e1237..83e5609efa 100644
--- a/doc/source/plugins.rst
+++ b/doc/source/plugins.rst
@@ -21,12 +21,12 @@ external repositories. The plugin interface assumes the following:
 An external git repository that includes a ``devstack/`` top level
 directory. Inside this directory there can be 3 files.
 
-- ``override_defaults`` - a file containing global variables that
+- ``override-defaults`` - a file containing global variables that
   will be sourced before the lib/* files. This allows the plugin
   to override the defaults that are otherwise set in the lib/*
   files.
 
-  For example, override_defaults may export CINDER_ENABLED_BACKENDS
+  For example, override-defaults may export CINDER_ENABLED_BACKENDS
   to include the plugin-specific storage backend and thus be able
   to override the default lvm only storage backend for Cinder.
 

From 9fc3ba408a97d0dd39ce26dd8dbcdb3b110cde71 Mon Sep 17 00:00:00 2001
From: Jim Rollenhagen <jim@jimrollenhagen.com>
Date: Thu, 10 Dec 2015 13:33:28 +0000
Subject: [PATCH 0118/2409] Ironic: add flag for using plugin

This adds a flag to skip ironic code if the ironic devstack plugin is in
use. This flag will be set to true in ironic's devstack plugin to
indicate that the plugin should be in control, rather than devstack.

This is for the transition period only, and will be removed with the
rest of the ironic code in the devstack tree, once the gate
is configured to use the ironic plugin.

Change-Id: Id01d97fd13fa9f866d645ec5077834ddb78b2b89
---
 extras.d/50-ironic.sh | 7 +++++++
 lib/ironic            | 7 +++++++
 2 files changed, 14 insertions(+)

diff --git a/extras.d/50-ironic.sh b/extras.d/50-ironic.sh
index 3b8e3d5045..0ee6a94758 100644
--- a/extras.d/50-ironic.sh
+++ b/extras.d/50-ironic.sh
@@ -1,5 +1,12 @@
 # ironic.sh - Devstack extras script to install ironic
 
+# NOTE(jroll) this is used for the transition to a devstack plugin in
+# the ironic tree.
+IRONIC_USING_PLUGIN=$(trueorfalse False IRONIC_USING_PLUGIN)
+if [[ "$IRONIC_USING_PLUGIN" == "True" ]] ; then
+    return 0
+fi
+
 if is_service_enabled ir-api ir-cond; then
     if [[ "$1" == "source" ]]; then
         # Initial source
diff --git a/lib/ironic b/lib/ironic
index 2fb2004d71..dd4f8bf65f 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -26,6 +26,13 @@ _PIPEFAIL_IRONIC=$(set +o | grep pipefail)
 set +o xtrace
 set +o pipefail
 
+# NOTE(jroll) this is used for the transition to a devstack plugin in
+# the ironic tree.
+IRONIC_USING_PLUGIN=$(trueorfalse False IRONIC_USING_PLUGIN)
+if [[ "$IRONIC_USING_PLUGIN" == "True" ]] ; then
+    return 0
+fi
+
 # Defaults
 # --------
 

From 10bff0e9968d7a9c59ea7f09f49775973f8b5008 Mon Sep 17 00:00:00 2001
From: Martin Hickey <martin.hickey@ie.ibm.com>
Date: Thu, 3 Dec 2015 15:18:10 +0000
Subject: [PATCH 0119/2409] Neutron LBaaS: Use generated configuration files if
 available

Generate the Neutron LBaaS sample config files by using the oslo
generator. The files are generated with a .sample extension and
replace the static example configuration files.

Once the generation code is delivered, the static config files
will be removed.

Change-Id: Iae1e581ec2bea9c0ced700229effcc716d53fe4e
Related-blueprint: autogen-neutron-conf-file
Partial-bug: #1199963
Depends-On: I25507f3bc6e995580aa91a912c2cf4110757df15
---
 lib/neutron-legacy                        | 11 +++++++++--
 lib/neutron_plugins/services/loadbalancer |  2 +-
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index caf89e3d8c..628f6463d1 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -112,6 +112,9 @@ NEUTRON_CONF_DIR=/etc/neutron
 NEUTRON_CONF=$NEUTRON_CONF_DIR/neutron.conf
 export NEUTRON_TEST_CONFIG_FILE=${NEUTRON_TEST_CONFIG_FILE:-"$NEUTRON_CONF_DIR/debug.ini"}
 
+# Default provider for load balancer service
+DEFAULT_LB_PROVIDER=LOADBALANCER:Haproxy:neutron_lbaas.services.loadbalancer.drivers.haproxy.plugin_driver.HaproxyOnHostPluginDriver:default
+
 # Agent binaries.  Note, binary paths for other agents are set in per-service
 # scripts in lib/neutron_plugins/services/
 AGENT_DHCP_BINARY="$NEUTRON_BIN_DIR/neutron-dhcp-agent"
@@ -1058,8 +1061,12 @@ function _configure_neutron_ceilometer_notifications {
 }
 
 function _configure_neutron_lbaas {
-    if [ -f $NEUTRON_LBAAS_DIR/etc/neutron_lbaas.conf ]; then
-        cp $NEUTRON_LBAAS_DIR/etc/neutron_lbaas.conf $NEUTRON_CONF_DIR
+    # Uses oslo config generator to generate LBaaS sample configuration files
+    (cd $NEUTRON_LBAAS_DIR && exec ./tools/generate_config_file_samples.sh)
+
+    if [ -f $NEUTRON_LBAAS_DIR/etc/neutron_lbaas.conf.sample ]; then
+        cp $NEUTRON_LBAAS_DIR/etc/neutron_lbaas.conf.sample $NEUTRON_CONF_DIR/neutron_lbaas.conf
+        iniset $NEUTRON_CONF_DIR/neutron_lbaas.conf service_providers service_provider $DEFAULT_LB_PROVIDER
     fi
     neutron_agent_lbaas_configure_common
     neutron_agent_lbaas_configure_agent
diff --git a/lib/neutron_plugins/services/loadbalancer b/lib/neutron_plugins/services/loadbalancer
index b07d06c32b..30e9480f2e 100644
--- a/lib/neutron_plugins/services/loadbalancer
+++ b/lib/neutron_plugins/services/loadbalancer
@@ -28,7 +28,7 @@ function neutron_agent_lbaas_configure_agent {
 
     LBAAS_AGENT_CONF_FILENAME="$LBAAS_AGENT_CONF_PATH/lbaas_agent.ini"
 
-    cp $NEUTRON_LBAAS_DIR/etc/lbaas_agent.ini $LBAAS_AGENT_CONF_FILENAME
+    cp $NEUTRON_LBAAS_DIR/etc/lbaas_agent.ini.sample $LBAAS_AGENT_CONF_FILENAME
 
     # ovs_use_veth needs to be set before the plugin configuration
     # occurs to allow plugins to override the setting.

From e42306d9db86a6cbb7cf1c062d8a5bdcd8479654 Mon Sep 17 00:00:00 2001
From: gordon chung <gord@live.ca>
Date: Thu, 10 Dec 2015 14:54:01 -0500
Subject: [PATCH 0120/2409] only set admin_* options for eventlet

keystone+apache don't need these values set.

Change-Id: Iebdb31b5f0888613e0454f09a426933d6fcd71b3
see: http://lists.openstack.org/pipermail/openstack-dev/2015-December/081984.html
---
 lib/keystone | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index b19202b0f7..6b4118de0b 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -218,8 +218,6 @@ function configure_keystone {
 
     iniset_rpc_backend keystone $KEYSTONE_CONF
 
-    iniset $KEYSTONE_CONF eventlet_server admin_bind_host "$KEYSTONE_ADMIN_BIND_HOST"
-
     # Register SSL certificates if provided
     if is_ssl_enabled_service key; then
         ensure_certificates KEYSTONE
@@ -296,13 +294,14 @@ function configure_keystone {
         iniset $KEYSTONE_CONF DEFAULT logging_debug_format_suffix "%(funcName)s %(pathname)s:%(lineno)d"
         iniset $KEYSTONE_CONF DEFAULT logging_exception_prefix "%(process)d TRACE %(name)s %(instance)s"
         _config_keystone_apache_wsgi
+    else
+        iniset $KEYSTONE_CONF eventlet_server admin_bind_host "$KEYSTONE_ADMIN_BIND_HOST"
+        iniset $KEYSTONE_CONF eventlet_server admin_workers "$API_WORKERS"
+        # Public workers will use the server default, typically number of CPU.
     fi
 
     iniset $KEYSTONE_CONF DEFAULT max_token_size 16384
 
-    iniset $KEYSTONE_CONF eventlet_server admin_workers "$API_WORKERS"
-    # Public workers will use the server default, typically number of CPU.
-
     iniset $KEYSTONE_CONF fernet_tokens key_repository "$KEYSTONE_CONF_DIR/fernet-keys/"
 }
 

From 69431725eb526d9daf320d7a05cccf22d10eaafd Mon Sep 17 00:00:00 2001
From: Anusha Ramineni <anusha.ramineni@nectechnologies.in>
Date: Tue, 8 Dec 2015 12:04:27 +0530
Subject: [PATCH 0121/2409] Add congress to plugin registry

Now congress supports devstack plugin model, hence including the
same in plugin registry

Change-Id: I1ac83c529a466e6a75a9b46ed9b56085140a63ed
---
 doc/source/plugin-registry.rst | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 49b3a7fc02..c68d926822 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -26,6 +26,8 @@ The following are plugins that exist for official OpenStack projects.
 +------------------+---------------------------------------------+--------------------+
 |ceilometer        |git://git.openstack.org/openstack/ceilometer | metering           |
 +------------------+---------------------------------------------+--------------------+
+|congress          |git://git.openstack.org/openstack/congress   | governance         |
++------------------+---------------------------------------------+--------------------+
 |gnocchi           |git://git.openstack.org/openstack/gnocchi    | metric             |
 +------------------+---------------------------------------------+--------------------+
 |magnum            |git://git.openstack.org/openstack/magnum     |                    |

From 357dff588ef63935a2a36e89b1aa96419ef09ece Mon Sep 17 00:00:00 2001
From: Sean McGinnis <sean_mcginnis@dell.com>
Date: Fri, 11 Dec 2015 13:51:24 -0600
Subject: [PATCH 0122/2409] Remove Cinder API version cap

Cinder API was pinned to v1 due to openstackclient missing some of the
v2 commands, as reported in osc bug 1475060. That bug has since been
marked invalid, but its intent was covered by the blueprint:

https://blueprints.launchpad.net/python-openstackclient/+spec/volume-v2

This removes the pinning to the v1 API now that osc supports v2. Also
removing the enablement of v1 as it was deprecated three releases ago
and we would like to get more coverage on v2.

Change-Id: Ia4d97734738d026c8721791669110778ff5eb6e5
---
 lib/cinder | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 2119858253..569f3ab0a3 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -270,10 +270,6 @@ function configure_cinder {
     iniset $CINDER_CONF DEFAULT state_path $CINDER_STATE_PATH
     iniset $CINDER_CONF oslo_concurrency lock_path $CINDER_STATE_PATH
     iniset $CINDER_CONF DEFAULT periodic_interval $CINDER_PERIODIC_INTERVAL
-    # NOTE(thingee): Cinder V1 API is deprecated and defaults to off as of
-    # Juno. Keep it enabled so we can continue testing while it's still
-    # supported.
-    iniset $CINDER_CONF DEFAULT enable_v1_api true
 
     iniset $CINDER_CONF DEFAULT os_region_name "$REGION_NAME"
 
@@ -550,9 +546,7 @@ function create_volume_types {
         local be be_name
         for be in ${CINDER_ENABLED_BACKENDS//,/ }; do
             be_name=${be##*:}
-            # FIXME(jamielennox): Remove --os-volume-api-version pinning when
-            # osc supports volume type create on v2 api. bug #1475060
-            openstack volume type create --os-volume-api-version 1 --property volume_backend_name="${be_name}" ${be_name}
+            openstack volume type create --property volume_backend_name="${be_name}" ${be_name}
         done
     fi
 }

From cf4f76299f84135a03fe29e5eddc97490eba806a Mon Sep 17 00:00:00 2001
From: Mahito OGURA <m.ogura@ntt.com>
Date: Wed, 12 Aug 2015 10:21:27 +0900
Subject: [PATCH 0123/2409] Update the vnc config options group 'DEFAULT' to
 'vnc'

n-api log output WARNINGs that vnc config options group 'DEFAULT'
is deprecated. New vnc config options group is 'vnc'.
This is change of Nova.[1]
This patch changes the vnc config options group 'DEFAULT' to 'vnc'.

[1] https://bugs.launchpad.net/nova/+bug/1447528

Change-Id: If54f750bac83298e90bdca27b5992fe2e5fbb712
Closes-Bug: 1483583
---
 lib/nova                            | 12 ++++++------
 lib/nova_plugins/hypervisor-libvirt | 10 +++++-----
 2 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/lib/nova b/lib/nova
index 6337f875ef..3e3f0f49ac 100644
--- a/lib/nova
+++ b/lib/nova
@@ -594,9 +594,9 @@ function create_nova_conf {
     # These settings don't hurt anything if n-xvnc and n-novnc are disabled
     if is_service_enabled n-cpu; then
         NOVNCPROXY_URL=${NOVNCPROXY_URL:-"http://$SERVICE_HOST:6080/vnc_auto.html"}
-        iniset $NOVA_CONF DEFAULT novncproxy_base_url "$NOVNCPROXY_URL"
+        iniset $NOVA_CONF vnc novncproxy_base_url "$NOVNCPROXY_URL"
         XVPVNCPROXY_URL=${XVPVNCPROXY_URL:-"http://$SERVICE_HOST:6081/console"}
-        iniset $NOVA_CONF DEFAULT xvpvncproxy_base_url "$XVPVNCPROXY_URL"
+        iniset $NOVA_CONF vnc xvpvncproxy_base_url "$XVPVNCPROXY_URL"
         SPICEHTML5PROXY_URL=${SPICEHTML5PROXY_URL:-"http://$SERVICE_HOST:6082/spice_auto.html"}
         iniset $NOVA_CONF spice html5proxy_base_url "$SPICEHTML5PROXY_URL"
     fi
@@ -606,13 +606,13 @@ function create_nova_conf {
         # For multi-host, this should be the management ip of the compute host.
         VNCSERVER_LISTEN=${VNCSERVER_LISTEN=$NOVA_SERVICE_LOCAL_HOST}
         VNCSERVER_PROXYCLIENT_ADDRESS=${VNCSERVER_PROXYCLIENT_ADDRESS=$NOVA_SERVICE_LOCAL_HOST}
-        iniset $NOVA_CONF DEFAULT vnc_enabled true
-        iniset $NOVA_CONF DEFAULT vncserver_listen "$VNCSERVER_LISTEN"
-        iniset $NOVA_CONF DEFAULT vncserver_proxyclient_address "$VNCSERVER_PROXYCLIENT_ADDRESS"
+        iniset $NOVA_CONF vnc enabled true
+        iniset $NOVA_CONF vnc vncserver_listen "$VNCSERVER_LISTEN"
+        iniset $NOVA_CONF vnc vncserver_proxyclient_address "$VNCSERVER_PROXYCLIENT_ADDRESS"
         iniset $NOVA_CONF DEFAULT novncproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
         iniset $NOVA_CONF DEFAULT xvpvncproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
     else
-        iniset $NOVA_CONF DEFAULT vnc_enabled false
+        iniset $NOVA_CONF vnc enabled false
     fi
 
     if is_service_enabled n-spice; then
diff --git a/lib/nova_plugins/hypervisor-libvirt b/lib/nova_plugins/hypervisor-libvirt
index 8bbaa2133d..1b4f7ae80a 100644
--- a/lib/nova_plugins/hypervisor-libvirt
+++ b/lib/nova_plugins/hypervisor-libvirt
@@ -48,13 +48,13 @@ function configure_nova_hypervisor {
     iniset $NOVA_CONF DEFAULT firewall_driver "$LIBVIRT_FIREWALL_DRIVER"
     # Power architecture currently does not support graphical consoles.
     if is_arch "ppc64"; then
-        iniset $NOVA_CONF DEFAULT vnc_enabled "false"
+        iniset $NOVA_CONF vnc enabled "false"
     fi
 
     # arm64-specific configuration
     if is_arch "aarch64"; then
         # arm64 architecture currently does not support graphical consoles.
-        iniset $NOVA_CONF DEFAULT vnc_enabled "false"
+        iniset $NOVA_CONF vnc enabled "false"
     fi
 
     # File injection is being disabled by default in the near future -
@@ -65,9 +65,9 @@ function configure_nova_hypervisor {
         iniset $NOVA_CONF libvirt connection_uri "parallels+unix:///system"
         iniset $NOVA_CONF libvirt images_type "ploop"
         iniset $NOVA_CONF DEFAULT force_raw_images  "False"
-        iniset $NOVA_CONF DEFAULT vncserver_proxyclient_address  $HOST_IP
-        iniset $NOVA_CONF DEFAULT vncserver_listen $HOST_IP
-        iniset $NOVA_CONF DEFAULT vnc_keymap
+        iniset $NOVA_CONF vnc vncserver_proxyclient_address  $HOST_IP
+        iniset $NOVA_CONF vnc vncserver_listen $HOST_IP
+        iniset $NOVA_CONF vnc keymap
     fi
 }
 

From 76cbbe37aae5d54542d62a5c6deec428a8cdc75e Mon Sep 17 00:00:00 2001
From: Mark McLoughlin <markmc@redhat.com>
Date: Mon, 7 Dec 2015 05:05:04 -0500
Subject: [PATCH 0124/2409] libvirt: don't repeatedly configure libvirtd
 logging

/etc/libvirt is not world-readable (at least on Fedora and RHEL) so
use sudo with the grep that checks whether we have already configured
libvirtd logging. Also, change the regex so we don't count commented
out logging config.

Change-Id: I67484b28aafd0fa828385321fa96d9141cb4cb59
Signed-off-by: Mark McLoughlin <markmc@redhat.com>
---
 lib/nova_plugins/functions-libvirt | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index dae55c6eba..4f9b239a1e 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -110,10 +110,10 @@ EOF
             local log_filters="1:libvirt 1:qemu 1:conf 1:security 3:object 3:event 3:json 3:file 1:util 1:qemu_monitor"
         fi
         local log_outputs="1:file:/var/log/libvirt/libvirtd.log"
-        if ! grep -q "log_filters=\"$log_filters\"" /etc/libvirt/libvirtd.conf; then
+        if ! sudo grep -q "^log_filters=\"$log_filters\"" /etc/libvirt/libvirtd.conf; then
             echo "log_filters=\"$log_filters\"" | sudo tee -a /etc/libvirt/libvirtd.conf
         fi
-        if ! grep -q "log_outputs=\"$log_outputs\"" /etc/libvirt/libvirtd.conf; then
+        if ! sudo grep -q "^log_outputs=\"$log_outputs\"" /etc/libvirt/libvirtd.conf; then
             echo "log_outputs=\"$log_outputs\"" | sudo tee -a /etc/libvirt/libvirtd.conf
         fi
     fi

From 239a9788b3f73495efbdf586425a83d714be4412 Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@midokura.com>
Date: Mon, 7 Dec 2015 17:09:59 +0900
Subject: [PATCH 0125/2409] Remove a stale comment about
 SQLALCHEMY_DATABASE_DRIVER

SQLALCHEMY_DATABASE_DRIVER is no longer used
after If6d8d08e5b7b7c48ca012677b536d71058def6fd .

Also, remove mysql connector packages from the install list.

Closes-Bug: #1523377
Related-Bug: #1493304
Change-Id: I5ecbc3b0bac989faa5c46d3c2866558a505414d8
---
 files/debs/keystone |  1 -
 files/debs/neutron  |  1 -
 files/debs/nova     |  1 -
 files/rpms/neutron  |  1 -
 files/rpms/nova     |  1 -
 stackrc             | 12 ------------
 6 files changed, 17 deletions(-)

diff --git a/files/debs/keystone b/files/debs/keystone
index 0795167047..370e4aac51 100644
--- a/files/debs/keystone
+++ b/files/debs/keystone
@@ -1,6 +1,5 @@
 libkrb5-dev
 libldap2-dev
 libsasl2-dev
-python-mysql.connector
 python-mysqldb
 sqlite3
diff --git a/files/debs/neutron b/files/debs/neutron
index 85145d3654..e53cc68ccf 100644
--- a/files/debs/neutron
+++ b/files/debs/neutron
@@ -8,7 +8,6 @@ iputils-ping
 libmysqlclient-dev
 mysql-server #NOPRIME
 postgresql-server-dev-all
-python-mysql.connector
 python-mysqldb
 rabbitmq-server # NOPRIME
 radvd # NOPRIME
diff --git a/files/debs/nova b/files/debs/nova
index fe57fc4b2a..58dad411a8 100644
--- a/files/debs/nova
+++ b/files/debs/nova
@@ -15,7 +15,6 @@ libvirt-dev # NOPRIME
 mysql-server # NOPRIME
 parted
 pm-utils
-python-mysql.connector
 python-mysqldb
 qemu # dist:wheezy,jessie NOPRIME
 qemu-kvm # NOPRIME
diff --git a/files/rpms/neutron b/files/rpms/neutron
index 9683475d29..2e49a0cf93 100644
--- a/files/rpms/neutron
+++ b/files/rpms/neutron
@@ -4,7 +4,6 @@ dnsmasq-utils # for dhcp_release
 ebtables
 iptables
 iputils
-mysql-connector-python
 mysql-devel
 MySQL-python
 mysql-server # NOPRIME
diff --git a/files/rpms/nova b/files/rpms/nova
index 00e759636e..4db9a06d95 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -15,7 +15,6 @@ libvirt-devel # NOPRIME
 libvirt-python # NOPRIME
 libxml2-python
 m2crypto
-mysql-connector-python
 mysql-devel
 MySQL-python
 mysql-server # NOPRIME
diff --git a/stackrc b/stackrc
index 5dd109c0a4..0c311ad65b 100644
--- a/stackrc
+++ b/stackrc
@@ -72,18 +72,6 @@ if ! isset ENABLED_SERVICES ; then
     ENABLED_SERVICES+=,rabbit,tempest,mysql,dstat
 fi
 
-# SQLAlchemy supports multiple database drivers for each database server
-# type. For example, deployer may use MySQLdb, MySQLConnector, or oursql
-# to access MySQL database.
-#
-# When defined, the variable controls which database driver is used to
-# connect to database server. Otherwise using default driver defined for
-# each database type.
-#
-# You can find the list of currently supported drivers for each database
-# type at: http://docs.sqlalchemy.org/en/rel_0_9/core/engines.html
-# SQLALCHEMY_DATABASE_DRIVER="mysqldb"
-
 # Global toggle for enabling services under mod_wsgi. If this is set to
 # ``True`` all services that use HTTPD + mod_wsgi as the preferred method of
 # deployment, will be deployed under Apache. If this is set to ``False`` all

From 2b4d6d16211cc55794b7d96594394f5e8c40fa4b Mon Sep 17 00:00:00 2001
From: Martin Hickey <martin.hickey@ie.ibm.com>
Date: Fri, 4 Dec 2015 14:40:03 +0000
Subject: [PATCH 0126/2409] Neutron VPNaaS: Use generated configuration files
 if available

Generate the Neutron VPNaaS sample config files by using the oslo
generator. The files are generated with a .sample extension and
replace the static example configuration files.

Once the generation code is delivered, the static config files
will be removed.

Change-Id: Icef8f7e8f0e8e78bfffa7a5af3f9f2300376b115
Related-blueprint: autogen-neutron-conf-file
Partial-bug: #1199963
Depends-On: I4a6094b8218dfd320d05bfb1e3bc121e8930c551
---
 lib/neutron-legacy               | 6 ++++--
 lib/neutron_plugins/services/vpn | 4 +++-
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index caf89e3d8c..0089a0d4cf 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -1079,8 +1079,10 @@ function _configure_neutron_fwaas {
 }
 
 function _configure_neutron_vpn {
-    if [ -f $NEUTRON_VPNAAS_DIR/etc/neutron_vpnaas.conf ]; then
-        cp $NEUTRON_VPNAAS_DIR/etc/neutron_vpnaas.conf $NEUTRON_CONF_DIR
+    # Uses oslo config generator to generate VPNaaS sample configuration files
+    (cd $NEUTRON_VPNAAS_DIR && exec ./tools/generate_config_file_samples.sh)
+    if [ -f $NEUTRON_VPNAAS_DIR/etc/neutron_vpnaas.conf.sample ]; then
+        cp $NEUTRON_VPNAAS_DIR/etc/neutron_vpnaas.conf.sample $NEUTRON_CONF_DIR/neutron_vpnaas.conf
     fi
     neutron_vpn_install_agent_packages
     neutron_vpn_configure_common
diff --git a/lib/neutron_plugins/services/vpn b/lib/neutron_plugins/services/vpn
index 8a379f588c..e790913847 100644
--- a/lib/neutron_plugins/services/vpn
+++ b/lib/neutron_plugins/services/vpn
@@ -29,7 +29,9 @@ function neutron_vpn_configure_common {
 }
 
 function neutron_vpn_configure_agent {
-    cp $NEUTRON_VPNAAS_DIR/etc/vpn_agent.ini $Q_VPN_CONF_FILE
+    # Uses oslo config generator to generate LBaaS sample configuration files
+    (cd $NEUTRON_VPNAAS_DIR && exec ./tools/generate_config_file_samples.sh)
+    cp $NEUTRON_VPNAAS_DIR/etc/vpn_agent.ini.sample $Q_VPN_CONF_FILE
     if [[ "$IPSEC_PACKAGE" == "strongswan" ]]; then
         iniset_multiline $Q_VPN_CONF_FILE vpnagent vpn_device_driver neutron_vpnaas.services.vpn.device_drivers.strongswan_ipsec.StrongSwanDriver
         if is_fedora; then

From 97b9e970b27f2303b8404aaa31a9f2e7d51ee787 Mon Sep 17 00:00:00 2001
From: Dave Chen <wei.d.chen@intel.com>
Date: Tue, 15 Dec 2015 03:33:48 +0800
Subject: [PATCH 0127/2409] Remove the support for keystone extensions

All keystone extensions have been moved into cores and are
enabled by default, there is no need to configure the extension
in devstack but configure it in devstack will block the
install process.

Change-Id: I7d21b122c641f601295ee7ece3583404b3874dbd
Closes-Bug: #1526033
---
 lib/keystone | 33 ---------------------------------
 1 file changed, 33 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 6b4118de0b..336ad12cbb 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -52,10 +52,6 @@ KEYSTONE_CONF_DIR=${KEYSTONE_CONF_DIR:-/etc/keystone}
 KEYSTONE_CONF=$KEYSTONE_CONF_DIR/keystone.conf
 KEYSTONE_PASTE_INI=${KEYSTONE_PASTE_INI:-$KEYSTONE_CONF_DIR/keystone-paste.ini}
 
-# Set up additional extensions, such as oauth1, federation
-# Example of KEYSTONE_EXTENSIONS=oauth1,federation
-KEYSTONE_EXTENSIONS=${KEYSTONE_EXTENSIONS:-}
-
 # Toggle for deploying Keystone under HTTPD + mod_wsgi
 KEYSTONE_USE_MOD_WSGI=${KEYSTONE_USE_MOD_WSGI:-${ENABLE_HTTPD_MOD_WSGI_SERVICES}}
 
@@ -192,8 +188,6 @@ function configure_keystone {
         inidelete $KEYSTONE_PASTE_INI composite:admin \\/v2.0
     fi
 
-    configure_keystone_extensions
-
     # Rewrite stock ``keystone.conf``
 
     if is_service_enabled ldap; then
@@ -305,25 +299,6 @@ function configure_keystone {
     iniset $KEYSTONE_CONF fernet_tokens key_repository "$KEYSTONE_CONF_DIR/fernet-keys/"
 }
 
-function configure_keystone_extensions {
-    # Add keystone extension into keystone v3 application pipeline
-    local extension_value
-    local api_v3
-    local extension
-    local api_v3_extension
-    for extension_value in ${KEYSTONE_EXTENSIONS//,/ }; do
-        if [[ -z "${extension_value}" ]]; then
-            continue
-        fi
-        api_v3=$(iniget $KEYSTONE_PASTE_INI pipeline:api_v3 pipeline)
-        extension=$(echo $api_v3 | sed -ne "/${extension_value}/ p;" )
-        if [[ -z $extension ]]; then
-            api_v3_extension=$(echo $api_v3 | sed -ne "s/service_v3/${extension_value}_extension service_v3/p;" )
-            iniset $KEYSTONE_PASTE_INI pipeline:api_v3 pipeline "$api_v3_extension"
-        fi
-    done
-}
-
 # create_keystone_accounts() - Sets up common required keystone accounts
 
 # Tenant               User       Roles
@@ -468,14 +443,6 @@ function init_keystone {
     # Initialize keystone database
     $KEYSTONE_BIN_DIR/keystone-manage db_sync
 
-    local extension_value
-    for extension_value in ${KEYSTONE_EXTENSIONS//,/ }; do
-        if [[ -z "${extension_value}" ]]; then
-            continue
-        fi
-        $KEYSTONE_BIN_DIR/keystone-manage db_sync --extension "${extension_value}"
-    done
-
     if [[ "$KEYSTONE_TOKEN_FORMAT" == "pki" || "$KEYSTONE_TOKEN_FORMAT" == "pkiz" ]]; then
         # Set up certificates
         rm -rf $KEYSTONE_CONF_DIR/ssl

From 43f62c08499de004a964c3a2f90ce400a0f932ad Mon Sep 17 00:00:00 2001
From: Akihiro Motoki <motoki@da.jp.nec.com>
Date: Tue, 15 Dec 2015 16:44:41 +0900
Subject: [PATCH 0128/2409] Move horizon config and start to appropriate phase
 in stack.sh

Previously horizon configuration and start are done too early
and as a result horizon init and start need to be run twice
after horizon plugins are enabled.
- horizon config was done before "run_phase stack install"
- horizon init and start were done before "run_phase stack post-config"

This commit rearrange horizon setup to the appropriate phases
defined in the devstack plugin interface.

- Configuration of horizon settings is moved to configure_horizon.
- horizon config is now called between run_phase stack install
  and post-config.
- horizon init and start are now called between run_phase stack
  post-config and extra.

Change-Id: I8bf2ceaf7734c4f7cec68bc05d7cdbae81ef311e
---
 lib/horizon |  8 +++++---
 stack.sh    | 14 ++++++++------
 2 files changed, 13 insertions(+), 9 deletions(-)

diff --git a/lib/horizon b/lib/horizon
index 67181fcf29..dca31116e2 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -83,10 +83,7 @@ function configure_horizon {
     # Message catalog compilation is handled by Django admin script,
     # so compiling them after the installation avoids Django installation twice.
     (cd $HORIZON_DIR; ./run_tests.sh -N --compilemessages)
-}
 
-# init_horizon() - Initialize databases, etc.
-function init_horizon {
     # ``local_settings.py`` is used to override horizon default settings.
     local local_settings=$HORIZON_DIR/openstack_dashboard/local/local_settings.py
     cp $HORIZON_SETTINGS $local_settings
@@ -113,6 +110,7 @@ function init_horizon {
     horizon_conf=$(apache_site_config_for horizon)
 
     # Configure apache to run horizon
+    # Set up the django horizon application to serve via apache/wsgi
     sudo sh -c "sed -e \"
         s,%USER%,$APACHE_USER,g;
         s,%GROUP%,$APACHE_GROUP,g;
@@ -133,7 +131,10 @@ function init_horizon {
         exit_distro_not_supported "horizon apache configuration"
     fi
     enable_apache_site horizon
+}
 
+# init_horizon() - Initialize databases, etc.
+function init_horizon {
     # Remove old log files that could mess with how DevStack detects whether Horizon
     # has been successfully started (see start_horizon() and functions::screen_it())
     # and run_process
@@ -147,6 +148,7 @@ function init_horizon {
         django_admin=django-admin.py
     fi
 
+    # These need to be run after horizon plugins are configured.
     DJANGO_SETTINGS_MODULE=openstack_dashboard.settings $django_admin collectstatic --noinput
     DJANGO_SETTINGS_MODULE=openstack_dashboard.settings $django_admin compress --force
 
diff --git a/stack.sh b/stack.sh
index 19d05c904a..e65d22f114 100755
--- a/stack.sh
+++ b/stack.sh
@@ -840,7 +840,6 @@ if is_service_enabled horizon; then
     install_django_openstack_auth
     # dashboard
     stack_install_service horizon
-    configure_horizon
 fi
 
 if is_service_enabled heat; then
@@ -1060,12 +1059,9 @@ write_clouds_yaml
 # Horizon
 # -------
 
-# Set up the django horizon application to serve via apache/wsgi
-
 if is_service_enabled horizon; then
-    echo_summary "Configuring and starting Horizon"
-    init_horizon
-    start_horizon
+    echo_summary "Configuring Horizon"
+    configure_horizon
 fi
 
 
@@ -1290,6 +1286,12 @@ if is_service_enabled heat; then
     fi
 fi
 
+if is_service_enabled horizon; then
+    echo_summary "Starting Horizon"
+    init_horizon
+    start_horizon
+fi
+
 
 # Create account rc files
 # =======================

From 563a7e75b7d26275a7416eb4d6641fcfe867b45a Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 15 Dec 2015 17:16:19 -0500
Subject: [PATCH 0129/2409] set the validation path to fixed for n-net

See if using fixed IPs for connectivity to hosts is more reliable than
floating ips, which really were not intended for these purposes (at
least in nova-net).

Change-Id: I251710ee9186a68bb3ddc58ca803c33b81c8ac49
---
 lib/tempest | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index 6adc449ad0..e651dc30ed 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -329,6 +329,9 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG compute flavor_ref $flavor_ref
     iniset $TEMPEST_CONFIG compute flavor_ref_alt $flavor_ref_alt
     iniset $TEMPEST_CONFIG compute ssh_connect_method $ssh_connect_method
+    # set the equiv validation option here as well to ensure they are
+    # in sync. They shouldn't be separate options.
+    iniset $TEMPEST_CONFIG validation connect_method $ssh_connect_method
     if [[ ! $(is_service_enabled n-cell) && ! $(is_service_enabled neutron) ]]; then
         iniset $TEMPEST_CONFIG compute fixed_network_name $PRIVATE_NETWORK_NAME
     fi

From 2ca8af45a78226f29c3251cbef6449a0a51a4c1f Mon Sep 17 00:00:00 2001
From: Atsushi SAKAI <sakaia@jp.fujitsu.com>
Date: Tue, 8 Dec 2015 15:36:13 +0900
Subject: [PATCH 0130/2409] Add 5 time measurement points

run_process           process starting time
test_with_retry       process starting time (for neutron legacy)
restart_apache_server Apache HTTPD restart time
wait_for_service      HTTP server waiting time
git_timed             git command execution time

example

========================
DevStack Components Timed
========================

run_process - 52 secs
test_with_retry - 3 secs
apt-get-update - 8 secs
pip_install - 76 secs
restart_apache_server - 9 secs
wait_for_service - 11 secs
git_timed - 127 secs
apt-get - 15 secs

Change-Id: I66140726617450cd9fe9b702092cacf053a20065
---
 functions        | 2 ++
 functions-common | 6 ++++++
 lib/apache       | 2 ++
 3 files changed, 10 insertions(+)

diff --git a/functions b/functions
index 762fc472c2..9495710e92 100644
--- a/functions
+++ b/functions
@@ -357,7 +357,9 @@ CURL_GET="${CURL_GET:-curl -g}"
 function wait_for_service {
     local timeout=$1
     local url=$2
+    time_start "wait_for_service"
     timeout $timeout sh -c "while ! $CURL_GET -k --noproxy '*' -s $url >/dev/null; do sleep 1; done"
+    time_stop "wait_for_service"
 }
 
 
diff --git a/functions-common b/functions-common
index 1b01eefaf9..023203d1fc 100644
--- a/functions-common
+++ b/functions-common
@@ -597,6 +597,7 @@ function git_timed {
         timeout=${GIT_TIMEOUT}
     fi
 
+    time_start "git_timed"
     until timeout -s SIGINT ${timeout} git "$@"; do
         # 124 is timeout(1)'s special return code when it reached the
         # timeout; otherwise assume fatal failure
@@ -611,6 +612,7 @@ function git_timed {
         fi
         sleep 5
     done
+    time_stop "git_timed"
 }
 
 # git update using reference as a branch.
@@ -1373,6 +1375,7 @@ function run_process {
     local command="$2"
     local group=$3
 
+    time_start "run_process"
     if is_service_enabled $service; then
         if [[ "$USE_SCREEN" = "True" ]]; then
             screen_process "$service" "$command" "$group"
@@ -1381,6 +1384,7 @@ function run_process {
             _run_process "$service" "$command" "$group" &
         fi
     fi
+    time_stop "run_process"
 }
 
 # Helper to launch a process in a named screen
@@ -2196,9 +2200,11 @@ function test_with_retry {
     local until=${3:-10}
     local sleep=${4:-0.5}
 
+    time_start "test_with_retry"
     if ! timeout $until sh -c "while ! $testcmd; do sleep $sleep; done"; then
         die $LINENO "$failmsg"
     fi
+    time_stop "test_with_retry"
 }
 
 # Timing infrastructure - figure out where large blocks of time are
diff --git a/lib/apache b/lib/apache
index c9e02a2b58..2c84c7a481 100644
--- a/lib/apache
+++ b/lib/apache
@@ -185,9 +185,11 @@ function restart_apache_server {
     # Apache can be slow to stop, doing an explicit stop, sleep, start helps
     # to mitigate issues where apache will claim a port it's listening on is
     # still in use and fail to start.
+    time_start "restart_apache_server"
     stop_service $APACHE_NAME
     sleep 3
     start_service $APACHE_NAME
+    time_stop "restart_apache_server"
 }
 
 # Restore xtrace

From 00b5f4af92a640a2507046cf76ee57caa166310b Mon Sep 17 00:00:00 2001
From: Mike Turek <mjturek@linux.vnet.ibm.com>
Date: Tue, 15 Dec 2015 18:16:35 +0000
Subject: [PATCH 0131/2409] Replace deprecated baremetal timeouts with new
 deploy_timeout

See review 258670 for more information. The preceeding patch
consolidates Ironic timeouts into one blanket timeout. This
patch sets the new timeout via the BUILD_TIMEOUT variable and
removes the deprecated timeouts.

Change-Id: I320461b2b40aa2b68afc38a901a5933e39aac1b6
Related-Bug: #1526863
---
 lib/tempest | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 61351c0628..b9d9e80fc2 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -533,8 +533,7 @@ function configure_tempest {
     # Baremetal
     if [ "$VIRT_DRIVER" = "ironic" ] ; then
         iniset $TEMPEST_CONFIG baremetal driver_enabled True
-        iniset $TEMPEST_CONFIG baremetal unprovision_timeout $BUILD_TIMEOUT
-        iniset $TEMPEST_CONFIG baremetal active_timeout $BUILD_TIMEOUT
+        iniset $TEMPEST_CONFIG baremetal deploy_timeout $BUILD_TIMEOUT
         iniset $TEMPEST_CONFIG baremetal deploy_img_dir $FILES
         iniset $TEMPEST_CONFIG baremetal node_uuid $IRONIC_NODE_UUID
         iniset $TEMPEST_CONFIG compute-feature-enabled change_password False

From 168be83597dcfc38b6d552ecbf20b5093580e2cb Mon Sep 17 00:00:00 2001
From: Davanum Srinivas <davanum@gmail.com>
Date: Thu, 8 Oct 2015 07:57:44 -0700
Subject: [PATCH 0132/2409] Nuke EC2 API service in defaults

Tempest does not test EC2 by default anymore:
Ib5e24e19bcba9808a9f49fe7f328668df77fe4f9

So we don't need to run nova ec2 API service by default.

Change-Id: Ieec0ca1361baf0978d96e69e1134f699c1af3bb9
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index f949ccbad9..edf23ce997 100644
--- a/stackrc
+++ b/stackrc
@@ -91,7 +91,7 @@ fi
 ENABLE_HTTPD_MOD_WSGI_SERVICES=True
 
 # Set the default Nova APIs to enable
-NOVA_ENABLED_APIS=ec2,osapi_compute,metadata
+NOVA_ENABLED_APIS=osapi_compute,metadata
 
 # Set the root URL for Horizon
 HORIZON_APACHE_ROOT="/dashboard"

From 47115b0314bcb9006d674fb0c7da6ac6eb94de29 Mon Sep 17 00:00:00 2001
From: Martin Hickey <martin.hickey@ie.ibm.com>
Date: Fri, 18 Dec 2015 11:08:38 +0000
Subject: [PATCH 0133/2409] Neutron VPNaaS: Set default service provider

Default value needs to be set for service_provider config item in
neutron_vpnaas.conf. This is to support backward compatability
for using the enable_service q-vpn. It should be noted that the
recommended way to use VPN is the devstack plugin.

Change-Id: I0d5960c81c47a138087d480527eff2a8eef59445
Closes-bug: #1527483
---
 lib/neutron-legacy | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index e0c4676297..6af44e6ab8 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -115,6 +115,9 @@ export NEUTRON_TEST_CONFIG_FILE=${NEUTRON_TEST_CONFIG_FILE:-"$NEUTRON_CONF_DIR/d
 # Default provider for load balancer service
 DEFAULT_LB_PROVIDER=LOADBALANCER:Haproxy:neutron_lbaas.services.loadbalancer.drivers.haproxy.plugin_driver.HaproxyOnHostPluginDriver:default
 
+# Default provider for VPN service
+DEFAULT_VPN_PROVIDER=VPN:openswan:neutron_vpnaas.services.vpn.service_drivers.ipsec.IPsecVPNDriver:default
+
 # Agent binaries.  Note, binary paths for other agents are set in per-service
 # scripts in lib/neutron_plugins/services/
 AGENT_DHCP_BINARY="$NEUTRON_BIN_DIR/neutron-dhcp-agent"
@@ -1092,6 +1095,7 @@ function _configure_neutron_vpn {
     (cd $NEUTRON_VPNAAS_DIR && exec ./tools/generate_config_file_samples.sh)
     if [ -f $NEUTRON_VPNAAS_DIR/etc/neutron_vpnaas.conf.sample ]; then
         cp $NEUTRON_VPNAAS_DIR/etc/neutron_vpnaas.conf.sample $NEUTRON_CONF_DIR/neutron_vpnaas.conf
+        iniset $NEUTRON_CONF_DIR/neutron_vpnaas.conf service_providers service_provider $DEFAULT_VPN_PROVIDER
     fi
     neutron_vpn_install_agent_packages
     neutron_vpn_configure_common

From 47367071cdc110c40ec5c92d12f4dbe50cc553d4 Mon Sep 17 00:00:00 2001
From: Jim Rollenhagen <jim@jimrollenhagen.com>
Date: Thu, 10 Dec 2015 14:24:00 +0000
Subject: [PATCH 0134/2409] Remove ironic code from tree

This removes all of the ironic code from the devstack tree, in favor of
the devstack plugin in Ironic's tree.

Depends-On: I659e3de5c64df798441798ff48ba5c9c0506585a
Depends-On: I2c52bc014f1b0dbc6b0ae22a4deb4132b4c28621
Change-Id: I5125fce295c79600781469c2f48bea80e7600081
---
 clean.sh                                     |   1 -
 doc/source/index.rst                         |   2 -
 doc/source/plugin-registry.rst               |   2 +
 extras.d/50-ironic.sh                        |  50 --
 files/apache-ironic.template                 |  12 -
 files/debs/ironic                            |  19 -
 files/rpms/ironic                            |  14 -
 functions-common                             |  12 +-
 lib/ironic                                   | 874 -------------------
 stackrc                                      |   8 +-
 tools/ironic/scripts/cleanup-node            |  25 -
 tools/ironic/scripts/configure-vm            |  93 --
 tools/ironic/scripts/create-node             |  79 --
 tools/ironic/scripts/setup-network           |  28 -
 tools/ironic/templates/brbm.xml              |   6 -
 tools/ironic/templates/tftpd-xinetd.template |  14 -
 tools/ironic/templates/vm.xml                |  49 --
 17 files changed, 16 insertions(+), 1272 deletions(-)
 delete mode 100644 extras.d/50-ironic.sh
 delete mode 100644 files/apache-ironic.template
 delete mode 100644 files/debs/ironic
 delete mode 100644 files/rpms/ironic
 delete mode 100644 lib/ironic
 delete mode 100755 tools/ironic/scripts/cleanup-node
 delete mode 100755 tools/ironic/scripts/configure-vm
 delete mode 100755 tools/ironic/scripts/create-node
 delete mode 100755 tools/ironic/scripts/setup-network
 delete mode 100644 tools/ironic/templates/brbm.xml
 delete mode 100644 tools/ironic/templates/tftpd-xinetd.template
 delete mode 100644 tools/ironic/templates/vm.xml

diff --git a/clean.sh b/clean.sh
index ae28aa9ab7..fc6f80dad4 100755
--- a/clean.sh
+++ b/clean.sh
@@ -50,7 +50,6 @@ source $TOP_DIR/lib/cinder
 source $TOP_DIR/lib/swift
 source $TOP_DIR/lib/heat
 source $TOP_DIR/lib/neutron-legacy
-source $TOP_DIR/lib/ironic
 
 
 # Extras Source
diff --git a/doc/source/index.rst b/doc/source/index.rst
index ec345c9f64..2622436820 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -174,7 +174,6 @@ Scripts
 * `lib/heat <lib/heat.html>`__
 * `lib/horizon <lib/horizon.html>`__
 * `lib/infra <lib/infra.html>`__
-* `lib/ironic <lib/ironic.html>`__
 * `lib/keystone <lib/keystone.html>`__
 * `lib/ldap <lib/ldap.html>`__
 * `lib/neutron-legacy <lib/neutron-legacy.html>`__
@@ -189,7 +188,6 @@ Scripts
 * `clean.sh <clean.sh.html>`__
 * `run\_tests.sh <run_tests.sh.html>`__
 
-* `extras.d/50-ironic.sh <extras.d/50-ironic.sh.html>`__
 * `extras.d/60-ceph.sh <extras.d/60-ceph.sh.html>`__
 * `extras.d/70-tuskar.sh <extras.d/70-tuskar.sh.html>`__
 * `extras.d/80-tempest.sh <extras.d/80-tempest.sh.html>`__
diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index c68d926822..7682defbed 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -30,6 +30,8 @@ The following are plugins that exist for official OpenStack projects.
 +------------------+---------------------------------------------+--------------------+
 |gnocchi           |git://git.openstack.org/openstack/gnocchi    | metric             |
 +------------------+---------------------------------------------+--------------------+
+|ironic            |git://git.openstack.org/openstack/ironic     | baremetal          |
++------------------+---------------------------------------------+--------------------+
 |magnum            |git://git.openstack.org/openstack/magnum     |                    |
 +------------------+---------------------------------------------+--------------------+
 |manila            |git://git.openstack.org/openstack/manila     | file shares        |
diff --git a/extras.d/50-ironic.sh b/extras.d/50-ironic.sh
deleted file mode 100644
index 0ee6a94758..0000000000
--- a/extras.d/50-ironic.sh
+++ /dev/null
@@ -1,50 +0,0 @@
-# ironic.sh - Devstack extras script to install ironic
-
-# NOTE(jroll) this is used for the transition to a devstack plugin in
-# the ironic tree.
-IRONIC_USING_PLUGIN=$(trueorfalse False IRONIC_USING_PLUGIN)
-if [[ "$IRONIC_USING_PLUGIN" == "True" ]] ; then
-    return 0
-fi
-
-if is_service_enabled ir-api ir-cond; then
-    if [[ "$1" == "source" ]]; then
-        # Initial source
-        source $TOP_DIR/lib/ironic
-    elif [[ "$1" == "stack" && "$2" == "install" ]]; then
-        echo_summary "Installing Ironic"
-        install_ironic
-        install_ironicclient
-        cleanup_ironic
-    elif [[ "$1" == "stack" && "$2" == "post-config" ]]; then
-        echo_summary "Configuring Ironic"
-        configure_ironic
-
-        if is_service_enabled key; then
-            create_ironic_accounts
-        fi
-
-    elif [[ "$1" == "stack" && "$2" == "extra" ]]; then
-        # Initialize ironic
-        init_ironic
-
-        # Start the ironic API and ironic taskmgr components
-        echo_summary "Starting Ironic"
-        start_ironic
-
-        if [[ "$IRONIC_BAREMETAL_BASIC_OPS" = "True" ]]; then
-            prepare_baremetal_basic_ops
-        fi
-    fi
-
-    if [[ "$1" == "unstack" ]]; then
-        stop_ironic
-        if [[ "$IRONIC_BAREMETAL_BASIC_OPS" = "True" ]]; then
-            cleanup_baremetal_basic_ops
-        fi
-    fi
-
-    if [[ "$1" == "clean" ]]; then
-        cleanup_ironic
-    fi
-fi
diff --git a/files/apache-ironic.template b/files/apache-ironic.template
deleted file mode 100644
index 88641946f6..0000000000
--- a/files/apache-ironic.template
+++ /dev/null
@@ -1,12 +0,0 @@
-Listen %PUBLICPORT%
-
-<VirtualHost *:%PUBLICPORT%>
-    DocumentRoot "%HTTPROOT%"
-    <Directory "%HTTPROOT%">
-        Options Indexes FollowSymLinks
-        AllowOverride None
-        Order allow,deny
-        Allow from all
-        Require all granted
-    </Directory>
-</VirtualHost>
diff --git a/files/debs/ironic b/files/debs/ironic
deleted file mode 100644
index 4d5a6aa6b7..0000000000
--- a/files/debs/ironic
+++ /dev/null
@@ -1,19 +0,0 @@
-docker.io
-ipmitool
-iptables
-ipxe
-libguestfs0
-libvirt-bin
-open-iscsi
-openssh-client
-openvswitch-datapath-dkms
-openvswitch-switch
-python-libguestfs
-python-libvirt
-qemu
-qemu-kvm
-qemu-utils
-sgabios
-syslinux
-tftpd-hpa
-xinetd
diff --git a/files/rpms/ironic b/files/rpms/ironic
deleted file mode 100644
index 2bf8bb370e..0000000000
--- a/files/rpms/ironic
+++ /dev/null
@@ -1,14 +0,0 @@
-docker-io
-ipmitool
-iptables
-ipxe-bootimgs
-libguestfs
-libvirt
-libvirt-python
-net-tools
-openssh-clients
-openvswitch
-sgabios
-syslinux
-tftp-server
-xinetd
diff --git a/functions-common b/functions-common
index 1b01eefaf9..c3eef469d3 100644
--- a/functions-common
+++ b/functions-common
@@ -954,6 +954,15 @@ function get_endpoint_url {
             -c URL -f value)
 }
 
+# check if we are using ironic with hardware
+# TODO(jroll) this is a kludge left behind when ripping ironic code
+# out of tree, as it is used by nova and neutron.
+# figure out a way to refactor nova/neutron code to eliminate this
+function is_ironic_hardware {
+    is_service_enabled ironic && [[ -n "${IRONIC_DEPLOY_DRIVER##*_ssh}" ]] && return 0
+    return 1
+}
+
 
 # Package Functions
 # =================
@@ -1764,7 +1773,7 @@ function run_phase {
             # white listed elements in tree. We want these to move out
             # over time as well, but they are in tree, so we need to
             # manage that.
-            local exceptions="50-ironic.sh 60-ceph.sh 80-tempest.sh"
+            local exceptions="60-ceph.sh 80-tempest.sh"
             local extra
             extra=$(basename $extra_plugin_file_name)
             if [[ ! ( $exceptions =~ "$extra" ) ]]; then
@@ -1952,7 +1961,6 @@ function is_service_enabled {
         [[ ${service} == n-cpu-* && ${ENABLED_SERVICES} =~ "n-cpu" ]] && enabled=0
         [[ ${service} == "nova" && ${ENABLED_SERVICES} =~ "n-" ]] && enabled=0
         [[ ${service} == "glance" && ${ENABLED_SERVICES} =~ "g-" ]] && enabled=0
-        [[ ${service} == "ironic" && ${ENABLED_SERVICES} =~ "ir-" ]] && enabled=0
         [[ ${service} == "neutron" && ${ENABLED_SERVICES} =~ "q-" ]] && enabled=0
         [[ ${service} == "trove" && ${ENABLED_SERVICES} =~ "tr-" ]] && enabled=0
         [[ ${service} == "swift" && ${ENABLED_SERVICES} =~ "s-" ]] && enabled=0
diff --git a/lib/ironic b/lib/ironic
deleted file mode 100644
index dd4f8bf65f..0000000000
--- a/lib/ironic
+++ /dev/null
@@ -1,874 +0,0 @@
-#!/bin/bash
-#
-# lib/ironic
-# Functions to control the configuration and operation of the **Ironic** service
-
-# Dependencies:
-#
-# - ``functions`` file
-# - ``DEST``, ``DATA_DIR``, ``STACK_USER`` must be defined
-# - ``SERVICE_{TENANT_NAME|PASSWORD}`` must be defined
-# - ``SERVICE_HOST``
-# - ``KEYSTONE_TOKEN_FORMAT`` must be defined
-
-# ``stack.sh`` calls the entry points in this order:
-#
-# - install_ironic
-# - install_ironicclient
-# - init_ironic
-# - start_ironic
-# - stop_ironic
-# - cleanup_ironic
-
-# Save trace and pipefail settings
-_XTRACE_IRONIC=$(set +o | grep xtrace)
-_PIPEFAIL_IRONIC=$(set +o | grep pipefail)
-set +o xtrace
-set +o pipefail
-
-# NOTE(jroll) this is used for the transition to a devstack plugin in
-# the ironic tree.
-IRONIC_USING_PLUGIN=$(trueorfalse False IRONIC_USING_PLUGIN)
-if [[ "$IRONIC_USING_PLUGIN" == "True" ]] ; then
-    return 0
-fi
-
-# Defaults
-# --------
-
-# Set up default directories
-GITDIR["python-ironicclient"]=$DEST/python-ironicclient
-GITDIR["ironic-lib"]=$DEST/ironic-lib
-
-IRONIC_DIR=$DEST/ironic
-IRONIC_PYTHON_AGENT_DIR=$DEST/ironic-python-agent
-IRONIC_DATA_DIR=$DATA_DIR/ironic
-IRONIC_STATE_PATH=/var/lib/ironic
-IRONIC_AUTH_CACHE_DIR=${IRONIC_AUTH_CACHE_DIR:-/var/cache/ironic}
-IRONIC_CONF_DIR=${IRONIC_CONF_DIR:-/etc/ironic}
-IRONIC_CONF_FILE=$IRONIC_CONF_DIR/ironic.conf
-IRONIC_ROOTWRAP_CONF=$IRONIC_CONF_DIR/rootwrap.conf
-IRONIC_POLICY_JSON=$IRONIC_CONF_DIR/policy.json
-
-# Deploy callback timeout can be changed from its default (1800), if required.
-IRONIC_CALLBACK_TIMEOUT=${IRONIC_CALLBACK_TIMEOUT:-}
-
-# Deploy to hardware platform
-IRONIC_HW_NODE_CPU=${IRONIC_HW_NODE_CPU:-1}
-IRONIC_HW_NODE_RAM=${IRONIC_HW_NODE_RAM:-512}
-IRONIC_HW_NODE_DISK=${IRONIC_HW_NODE_DISK:-10}
-IRONIC_HW_EPHEMERAL_DISK=${IRONIC_HW_EPHEMERAL_DISK:-0}
-# The file is composed of multiple lines, each line includes four field
-# separated by white space: IPMI address, MAC address, IPMI username
-# and IPMI password.
-#
-#   192.168.110.107 00:1e:67:57:50:4c root otc123
-IRONIC_IPMIINFO_FILE=${IRONIC_IPMIINFO_FILE:-$IRONIC_DATA_DIR/hardware_info}
-
-# Set up defaults for functional / integration testing
-IRONIC_NODE_UUID=${IRONIC_NODE_UUID:-`uuidgen`}
-IRONIC_SCRIPTS_DIR=${IRONIC_SCRIPTS_DIR:-$TOP_DIR/tools/ironic/scripts}
-IRONIC_TEMPLATES_DIR=${IRONIC_TEMPLATES_DIR:-$TOP_DIR/tools/ironic/templates}
-IRONIC_BAREMETAL_BASIC_OPS=$(trueorfalse False IRONIC_BAREMETAL_BASIC_OPS)
-IRONIC_ENABLED_DRIVERS=${IRONIC_ENABLED_DRIVERS:-fake,pxe_ssh,pxe_ipmitool}
-IRONIC_SSH_USERNAME=${IRONIC_SSH_USERNAME:-`whoami`}
-IRONIC_SSH_TIMEOUT=${IRONIC_SSH_TIMEOUT:-15}
-IRONIC_SSH_KEY_DIR=${IRONIC_SSH_KEY_DIR:-$IRONIC_DATA_DIR/ssh_keys}
-IRONIC_SSH_KEY_FILENAME=${IRONIC_SSH_KEY_FILENAME:-ironic_key}
-IRONIC_KEY_FILE=${IRONIC_KEY_FILE:-$IRONIC_SSH_KEY_DIR/$IRONIC_SSH_KEY_FILENAME}
-IRONIC_SSH_VIRT_TYPE=${IRONIC_SSH_VIRT_TYPE:-virsh}
-IRONIC_TFTPBOOT_DIR=${IRONIC_TFTPBOOT_DIR:-$IRONIC_DATA_DIR/tftpboot}
-IRONIC_TFTPSERVER_IP=${IRONIC_TFTPSERVER_IP:-$HOST_IP}
-IRONIC_VM_SSH_PORT=${IRONIC_VM_SSH_PORT:-22}
-IRONIC_VM_SSH_ADDRESS=${IRONIC_VM_SSH_ADDRESS:-$HOST_IP}
-IRONIC_VM_COUNT=${IRONIC_VM_COUNT:-1}
-IRONIC_VM_SPECS_CPU=${IRONIC_VM_SPECS_CPU:-1}
-IRONIC_VM_SPECS_RAM=${IRONIC_VM_SPECS_RAM:-512}
-IRONIC_VM_SPECS_DISK=${IRONIC_VM_SPECS_DISK:-10}
-IRONIC_VM_EPHEMERAL_DISK=${IRONIC_VM_EPHEMERAL_DISK:-0}
-IRONIC_VM_EMULATOR=${IRONIC_VM_EMULATOR:-/usr/bin/qemu-system-x86_64}
-IRONIC_VM_NETWORK_BRIDGE=${IRONIC_VM_NETWORK_BRIDGE:-brbm}
-IRONIC_VM_NETWORK_RANGE=${IRONIC_VM_NETWORK_RANGE:-192.0.2.0/24}
-IRONIC_VM_MACS_CSV_FILE=${IRONIC_VM_MACS_CSV_FILE:-$IRONIC_DATA_DIR/ironic_macs.csv}
-IRONIC_AUTHORIZED_KEYS_FILE=${IRONIC_AUTHORIZED_KEYS_FILE:-$HOME/.ssh/authorized_keys}
-
-# By default, baremetal VMs will console output to file.
-IRONIC_VM_LOG_CONSOLE=${IRONIC_VM_LOG_CONSOLE:-True}
-IRONIC_VM_LOG_DIR=${IRONIC_VM_LOG_DIR:-$IRONIC_DATA_DIR/logs/}
-
-# Use DIB to create deploy ramdisk and kernel.
-IRONIC_BUILD_DEPLOY_RAMDISK=$(trueorfalse True IRONIC_BUILD_DEPLOY_RAMDISK)
-# If not use DIB, these files are used as deploy ramdisk/kernel.
-# (The value must be an absolute path)
-IRONIC_DEPLOY_RAMDISK=${IRONIC_DEPLOY_RAMDISK:-}
-IRONIC_DEPLOY_KERNEL=${IRONIC_DEPLOY_KERNEL:-}
-IRONIC_DEPLOY_ELEMENT=${IRONIC_DEPLOY_ELEMENT:-deploy-ironic}
-
-IRONIC_AGENT_KERNEL_URL=${IRONIC_AGENT_KERNEL_URL:-http://tarballs.openstack.org/ironic-python-agent/coreos/files/coreos_production_pxe.vmlinuz}
-IRONIC_AGENT_RAMDISK_URL=${IRONIC_AGENT_RAMDISK_URL:-http://tarballs.openstack.org/ironic-python-agent/coreos/files/coreos_production_pxe_image-oem.cpio.gz}
-
-# Which deploy driver to use - valid choices right now
-# are ``pxe_ssh``, ``pxe_ipmitool``, ``agent_ssh`` and ``agent_ipmitool``.
-IRONIC_DEPLOY_DRIVER=${IRONIC_DEPLOY_DRIVER:-pxe_ssh}
-
-# TODO(agordeev): replace 'ubuntu' with host distro name getting
-IRONIC_DEPLOY_FLAVOR=${IRONIC_DEPLOY_FLAVOR:-ubuntu $IRONIC_DEPLOY_ELEMENT}
-
-# Support entry points installation of console scripts
-IRONIC_BIN_DIR=$(get_python_exec_prefix)
-
-# Ironic connection info.  Note the port must be specified.
-IRONIC_SERVICE_PROTOCOL=http
-IRONIC_SERVICE_PORT=${IRONIC_SERVICE_PORT:-6385}
-IRONIC_HOSTPORT=${IRONIC_HOSTPORT:-$SERVICE_HOST:$IRONIC_SERVICE_PORT}
-
-# Enable iPXE
-IRONIC_IPXE_ENABLED=$(trueorfalse False IRONIC_IPXE_ENABLED)
-IRONIC_HTTP_DIR=${IRONIC_HTTP_DIR:-$IRONIC_DATA_DIR/httpboot}
-IRONIC_HTTP_SERVER=${IRONIC_HTTP_SERVER:-$HOST_IP}
-IRONIC_HTTP_PORT=${IRONIC_HTTP_PORT:-8088}
-
-# NOTE(lucasagomes): This flag is used to differentiate the nodes that
-# uses IPA as their deploy ramdisk from nodes that uses the agent_* drivers
-# (which also uses IPA but depends on Swift Temp URLs to work). At present,
-# all drivers that uses the iSCSI approach for their deployment supports
-# using both, IPA or bash ramdisks for the deployment. In the future we
-# want to remove the support for the bash ramdisk in favor of IPA, once
-# we get there this flag can be removed, and all conditionals that uses
-# it should just run by default.
-IRONIC_DEPLOY_DRIVER_ISCSI_WITH_IPA=$(trueorfalse False IRONIC_DEPLOY_DRIVER_ISCSI_WITH_IPA)
-
-# get_pxe_boot_file() - Get the PXE/iPXE boot file path
-function get_pxe_boot_file {
-    local relpath=syslinux/pxelinux.0
-    if [[ "$IRONIC_IPXE_ENABLED" == "True" ]] ; then
-        relpath=ipxe/undionly.kpxe
-    fi
-
-    local pxe_boot_file
-    if is_ubuntu; then
-        pxe_boot_file=/usr/lib/$relpath
-    elif is_fedora || is_suse; then
-        pxe_boot_file=/usr/share/$relpath
-    fi
-
-    echo $pxe_boot_file
-}
-
-# PXE boot image
-IRONIC_PXE_BOOT_IMAGE=${IRONIC_PXE_BOOT_IMAGE:-$(get_pxe_boot_file)}
-
-
-# Functions
-# ---------
-
-# Test if any Ironic services are enabled
-# is_ironic_enabled
-function is_ironic_enabled {
-    [[ ,${ENABLED_SERVICES} =~ ,"ir-" ]] && return 0
-    return 1
-}
-
-function is_ironic_hardware {
-    is_ironic_enabled && [[ -n "${IRONIC_DEPLOY_DRIVER##*_ssh}" ]] && return 0
-    return 1
-}
-
-function is_deployed_by_agent {
-    [[ -z "${IRONIC_DEPLOY_DRIVER%%agent*}" ]] && return 0
-    return 1
-}
-
-function is_deployed_with_ipa_ramdisk {
-    is_deployed_by_agent || [[ "$IRONIC_DEPLOY_DRIVER_ISCSI_WITH_IPA" == "True" ]] && return 0
-    return 1
-}
-
-# install_ironic() - Collect source and prepare
-function install_ironic {
-    # make sure all needed service were enabled
-    local req_services="key"
-    if [[ "$VIRT_DRIVER" == "ironic" ]]; then
-        req_services+=" nova glance neutron"
-    fi
-    for srv in $req_services; do
-        if ! is_service_enabled "$srv"; then
-            die $LINENO "$srv should be enabled for Ironic."
-        fi
-    done
-
-    if use_library_from_git "ironic-lib"; then
-        git_clone_by_name "ironic-lib"
-        setup_dev_lib "ironic-lib"
-    fi
-
-    git_clone $IRONIC_REPO $IRONIC_DIR $IRONIC_BRANCH
-    setup_develop $IRONIC_DIR
-
-    if [[ "$IRONIC_IPXE_ENABLED" == "True" ]] ; then
-        install_apache_wsgi
-    fi
-}
-
-# install_ironicclient() - Collect sources and prepare
-function install_ironicclient {
-    if use_library_from_git "python-ironicclient"; then
-        git_clone_by_name "python-ironicclient"
-        setup_dev_lib "python-ironicclient"
-        sudo install -D -m 0644 -o $STACK_USER {${GITDIR["python-ironicclient"]}/tools/,/etc/bash_completion.d/}ironic.bash_completion
-    else
-        # nothing actually "requires" ironicclient, so force instally from pypi
-        pip_install_gr python-ironicclient
-    fi
-}
-
-# _cleanup_ironic_apache_wsgi() - Remove wsgi files, disable and remove apache vhost file
-function _cleanup_ironic_apache_wsgi {
-    sudo rm -rf $IRONIC_HTTP_DIR
-    disable_apache_site ironic
-    sudo rm -f $(apache_site_config_for ironic)
-    restart_apache_server
-}
-
-# _config_ironic_apache_wsgi() - Set WSGI config files of Ironic
-function _config_ironic_apache_wsgi {
-    local ironic_apache_conf
-    ironic_apache_conf=$(apache_site_config_for ironic)
-    sudo cp $FILES/apache-ironic.template $ironic_apache_conf
-    sudo sed -e "
-        s|%PUBLICPORT%|$IRONIC_HTTP_PORT|g;
-        s|%HTTPROOT%|$IRONIC_HTTP_DIR|g;
-    " -i $ironic_apache_conf
-    enable_apache_site ironic
-}
-
-# cleanup_ironic() - Remove residual data files, anything left over from previous
-# runs that would need to clean up.
-function cleanup_ironic {
-    sudo rm -rf $IRONIC_AUTH_CACHE_DIR $IRONIC_CONF_DIR
-}
-
-# configure_ironic_dirs() - Create all directories required by Ironic and
-# associated services.
-function configure_ironic_dirs {
-    sudo install -d -o $STACK_USER $IRONIC_CONF_DIR $STACK_USER $IRONIC_DATA_DIR \
-        $IRONIC_STATE_PATH $IRONIC_TFTPBOOT_DIR $IRONIC_TFTPBOOT_DIR/pxelinux.cfg
-    sudo chown -R $STACK_USER:$LIBVIRT_GROUP $IRONIC_TFTPBOOT_DIR
-
-    if [[ "$IRONIC_IPXE_ENABLED" == "True" ]] ; then
-        sudo install -d -o $STACK_USER -g $LIBVIRT_GROUP $IRONIC_HTTP_DIR
-    fi
-
-    if [ ! -f $IRONIC_PXE_BOOT_IMAGE ]; then
-        die $LINENO "PXE boot file $IRONIC_PXE_BOOT_IMAGE not found."
-    fi
-
-    # Copy PXE binary
-    if [[ "$IRONIC_IPXE_ENABLED" == "True" ]] ; then
-        cp $IRONIC_PXE_BOOT_IMAGE $IRONIC_TFTPBOOT_DIR
-    else
-        # Syslinux >= 5.00 pxelinux.0 binary is not "stand-alone" anymore,
-        # it depends on some c32 modules to work correctly.
-        # More info: http://www.syslinux.org/wiki/index.php/Library_modules
-        cp -aR $(dirname $IRONIC_PXE_BOOT_IMAGE)/*.{c32,0} $IRONIC_TFTPBOOT_DIR
-    fi
-}
-
-# configure_ironic() - Set config files, create data dirs, etc
-function configure_ironic {
-    configure_ironic_dirs
-
-    # Copy over ironic configuration file and configure common parameters.
-    cp $IRONIC_DIR/etc/ironic/ironic.conf.sample $IRONIC_CONF_FILE
-    iniset $IRONIC_CONF_FILE DEFAULT debug True
-    inicomment $IRONIC_CONF_FILE DEFAULT log_file
-    iniset $IRONIC_CONF_FILE database connection `database_connection_url ironic`
-    iniset $IRONIC_CONF_FILE DEFAULT state_path $IRONIC_STATE_PATH
-    iniset $IRONIC_CONF_FILE DEFAULT use_syslog $SYSLOG
-    # Configure Ironic conductor, if it was enabled.
-    if is_service_enabled ir-cond; then
-        configure_ironic_conductor
-    fi
-
-    # Configure Ironic API, if it was enabled.
-    if is_service_enabled ir-api; then
-        configure_ironic_api
-    fi
-
-    # Format logging
-    if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ]; then
-        setup_colorized_logging $IRONIC_CONF_FILE DEFAULT tenant user
-    fi
-
-    if [[ "$IRONIC_IPXE_ENABLED" == "True" ]]; then
-        _config_ironic_apache_wsgi
-    fi
-}
-
-# configure_ironic_api() - Is used by configure_ironic(). Performs
-# API specific configuration.
-function configure_ironic_api {
-    iniset $IRONIC_CONF_FILE DEFAULT auth_strategy keystone
-    iniset $IRONIC_CONF_FILE oslo_policy policy_file $IRONIC_POLICY_JSON
-
-    # TODO(Yuki Nishiwaki): This is a temporary work-around until Ironic is fixed(bug#1422632).
-    # These codes need to be changed to use the function of configure_auth_token_middleware
-    # after Ironic conforms to the new auth plugin.
-    iniset $IRONIC_CONF_FILE keystone_authtoken identity_uri $KEYSTONE_AUTH_URI
-    iniset $IRONIC_CONF_FILE keystone_authtoken auth_uri $KEYSTONE_SERVICE_URI/v2.0
-    iniset $IRONIC_CONF_FILE keystone_authtoken admin_user ironic
-    iniset $IRONIC_CONF_FILE keystone_authtoken admin_password $SERVICE_PASSWORD
-    iniset $IRONIC_CONF_FILE keystone_authtoken admin_tenant_name $SERVICE_TENANT_NAME
-    iniset $IRONIC_CONF_FILE keystone_authtoken cafile $SSL_BUNDLE_FILE
-    iniset $IRONIC_CONF_FILE keystone_authtoken signing_dir $IRONIC_AUTH_CACHE_DIR/api
-
-    iniset_rpc_backend ironic $IRONIC_CONF_FILE
-    iniset $IRONIC_CONF_FILE api port $IRONIC_SERVICE_PORT
-
-    cp -p $IRONIC_DIR/etc/ironic/policy.json $IRONIC_POLICY_JSON
-}
-
-# configure_ironic_conductor() - Is used by configure_ironic().
-# Sets conductor specific settings.
-function configure_ironic_conductor {
-    cp $IRONIC_DIR/etc/ironic/rootwrap.conf $IRONIC_ROOTWRAP_CONF
-    cp -r $IRONIC_DIR/etc/ironic/rootwrap.d $IRONIC_CONF_DIR
-    local ironic_rootwrap
-    ironic_rootwrap=$(get_rootwrap_location ironic)
-    local rootwrap_isudoer_cmd="$ironic_rootwrap $IRONIC_CONF_DIR/rootwrap.conf *"
-
-    # Set up the rootwrap sudoers for ironic
-    local tempfile
-    tempfile=`mktemp`
-    echo "$STACK_USER ALL=(root) NOPASSWD: $rootwrap_isudoer_cmd" >$tempfile
-    chmod 0440 $tempfile
-    sudo chown root:root $tempfile
-    sudo mv $tempfile /etc/sudoers.d/ironic-rootwrap
-
-    iniset $IRONIC_CONF_FILE DEFAULT rootwrap_config $IRONIC_ROOTWRAP_CONF
-    iniset $IRONIC_CONF_FILE DEFAULT enabled_drivers $IRONIC_ENABLED_DRIVERS
-    iniset $IRONIC_CONF_FILE conductor api_url $IRONIC_SERVICE_PROTOCOL://$HOST_IP:$IRONIC_SERVICE_PORT
-    if [[ -n "$IRONIC_CALLBACK_TIMEOUT" ]]; then
-        iniset $IRONIC_CONF_FILE conductor deploy_callback_timeout $IRONIC_CALLBACK_TIMEOUT
-    fi
-    iniset $IRONIC_CONF_FILE pxe tftp_server $IRONIC_TFTPSERVER_IP
-    iniset $IRONIC_CONF_FILE pxe tftp_root $IRONIC_TFTPBOOT_DIR
-    iniset $IRONIC_CONF_FILE pxe tftp_master_path $IRONIC_TFTPBOOT_DIR/master_images
-
-    local pxe_params=""
-    if [[ "$IRONIC_VM_LOG_CONSOLE" == "True" ]] ; then
-        pxe_params+="nofb nomodeset vga=normal console=ttyS0"
-        if is_deployed_with_ipa_ramdisk; then
-            pxe_params+=" systemd.journald.forward_to_console=yes"
-        fi
-    fi
-    # When booting with less than 1GB, we need to switch from default tmpfs
-    # to ramfs for ramdisks to decompress successfully.
-    if (is_ironic_hardware && [[ "$IRONIC_HW_NODE_RAM" -lt 1024 ]]) ||
-        (! is_ironic_hardware && [[ "$IRONIC_VM_SPECS_RAM" -lt 1024 ]]); then
-        pxe_params+=" rootfstype=ramfs"
-    fi
-    if [[ -n "$pxe_params" ]]; then
-        iniset $IRONIC_CONF_FILE pxe pxe_append_params "$pxe_params"
-    fi
-
-    # Set these options for scenarios in which the agent fetches the image
-    # directly from glance, and don't set them where the image is pushed
-    # over iSCSI.
-    if is_deployed_by_agent; then
-        if [[ "$SWIFT_ENABLE_TEMPURLS" == "True" ]] ; then
-            iniset $IRONIC_CONF_FILE glance swift_temp_url_key $SWIFT_TEMPURL_KEY
-        else
-            die $LINENO "SWIFT_ENABLE_TEMPURLS must be True to use agent_ssh driver in Ironic."
-        fi
-        iniset $IRONIC_CONF_FILE glance swift_endpoint_url http://${HOST_IP}:${SWIFT_DEFAULT_BIND_PORT:-8080}
-        iniset $IRONIC_CONF_FILE glance swift_api_version v1
-        local tenant_id
-        tenant_id=$(get_or_create_project $SERVICE_TENANT_NAME default)
-        iniset $IRONIC_CONF_FILE glance swift_account AUTH_${tenant_id}
-        iniset $IRONIC_CONF_FILE glance swift_container glance
-        iniset $IRONIC_CONF_FILE glance swift_temp_url_duration 3600
-        iniset $IRONIC_CONF_FILE agent heartbeat_timeout 30
-    fi
-
-    # FIXME: this really needs to be tested in the gate.
-    # For now, any test using the agent ramdisk should skip cleaning
-    # because it is too slow to run in the gate.
-    iniset $IRONIC_CONF_FILE agent agent_erase_devices_priority 0
-
-    if [[ "$IRONIC_IPXE_ENABLED" == "True" ]] ; then
-        local pxebin
-        pxebin=`basename $IRONIC_PXE_BOOT_IMAGE`
-        iniset $IRONIC_CONF_FILE pxe ipxe_enabled True
-        iniset $IRONIC_CONF_FILE pxe pxe_config_template '\$pybasedir/drivers/modules/ipxe_config.template'
-        iniset $IRONIC_CONF_FILE pxe pxe_bootfile_name $pxebin
-        iniset $IRONIC_CONF_FILE pxe http_root $IRONIC_HTTP_DIR
-        iniset $IRONIC_CONF_FILE pxe http_url "http://$IRONIC_HTTP_SERVER:$IRONIC_HTTP_PORT"
-    fi
-}
-
-# create_ironic_cache_dir() - Part of the init_ironic() process
-function create_ironic_cache_dir {
-    # Create cache dir
-    sudo mkdir -p $IRONIC_AUTH_CACHE_DIR/api
-    sudo chown $STACK_USER $IRONIC_AUTH_CACHE_DIR/api
-    rm -f $IRONIC_AUTH_CACHE_DIR/api/*
-    sudo mkdir -p $IRONIC_AUTH_CACHE_DIR/registry
-    sudo chown $STACK_USER $IRONIC_AUTH_CACHE_DIR/registry
-    rm -f $IRONIC_AUTH_CACHE_DIR/registry/*
-}
-
-# create_ironic_accounts() - Set up common required ironic accounts
-
-# Tenant               User       Roles
-# ------------------------------------------------------------------
-# service              ironic     admin        # if enabled
-function create_ironic_accounts {
-
-    # Ironic
-    if [[ "$ENABLED_SERVICES" =~ "ir-api" ]]; then
-        # Get ironic user if exists
-
-        # NOTE(Shrews): This user MUST have admin level privileges!
-        create_service_user "ironic" "admin"
-
-        if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
-
-            get_or_create_service "ironic" "baremetal" "Ironic baremetal provisioning service"
-            get_or_create_endpoint "baremetal" \
-                "$REGION_NAME" \
-                "$IRONIC_SERVICE_PROTOCOL://$IRONIC_HOSTPORT" \
-                "$IRONIC_SERVICE_PROTOCOL://$IRONIC_HOSTPORT" \
-                "$IRONIC_SERVICE_PROTOCOL://$IRONIC_HOSTPORT"
-        fi
-    fi
-}
-
-
-# init_ironic() - Initialize databases, etc.
-function init_ironic {
-    # Save private network as cleaning network
-    local cleaning_network_uuid
-    cleaning_network_uuid=$(neutron net-list | grep private | get_field 1)
-    iniset $IRONIC_CONF_FILE neutron cleaning_network_uuid ${cleaning_network_uuid}
-
-    # (Re)create  ironic database
-    recreate_database ironic
-
-    # Migrate ironic database
-    $IRONIC_BIN_DIR/ironic-dbsync --config-file=$IRONIC_CONF_FILE
-
-    create_ironic_cache_dir
-}
-
-# _ironic_bm_vm_names() - Generates list of names for baremetal VMs.
-function _ironic_bm_vm_names {
-    local idx
-    local num_vms
-    num_vms=$(($IRONIC_VM_COUNT - 1))
-    for idx in $(seq 0 $num_vms); do
-        echo "baremetal${IRONIC_VM_NETWORK_BRIDGE}_${idx}"
-    done
-}
-
-# start_ironic() - Start running processes, including screen
-function start_ironic {
-    # Start Ironic API server, if enabled.
-    if is_service_enabled ir-api; then
-        start_ironic_api
-    fi
-
-    # Start Ironic conductor, if enabled.
-    if is_service_enabled ir-cond; then
-        start_ironic_conductor
-    fi
-
-    # Start Apache if iPXE is enabled
-    if [[ "$IRONIC_IPXE_ENABLED" == "True" ]] ; then
-        restart_apache_server
-    fi
-}
-
-# start_ironic_api() - Used by start_ironic().
-# Starts Ironic API server.
-function start_ironic_api {
-    run_process ir-api "$IRONIC_BIN_DIR/ironic-api --config-file=$IRONIC_CONF_FILE"
-    echo "Waiting for ir-api ($IRONIC_HOSTPORT) to start..."
-    if ! timeout $SERVICE_TIMEOUT sh -c "while ! wget --no-proxy -q -O- $IRONIC_SERVICE_PROTOCOL://$IRONIC_HOSTPORT; do sleep 1; done"; then
-        die $LINENO "ir-api did not start"
-    fi
-}
-
-# start_ironic_conductor() - Used by start_ironic().
-# Starts Ironic conductor.
-function start_ironic_conductor {
-    run_process ir-cond "$IRONIC_BIN_DIR/ironic-conductor --config-file=$IRONIC_CONF_FILE"
-    # TODO(romcheg): Find a way to check whether the conductor has started.
-}
-
-# stop_ironic() - Stop running processes
-function stop_ironic {
-    stop_process ir-api
-    stop_process ir-cond
-
-    # Cleanup the WSGI files
-    if [[ "$IRONIC_IPXE_ENABLED" == "True" ]] ; then
-        _cleanup_ironic_apache_wsgi
-    fi
-}
-
-function create_ovs_taps {
-    local ironic_net_id
-    ironic_net_id=$(neutron net-list | grep private | get_field 1)
-
-    # Work around: No netns exists on host until a Neutron port is created.  We
-    # need to create one in Neutron to know what netns to tap into prior to the
-    # first node booting.
-    local port_id
-    port_id=$(neutron port-create private | grep " id " | get_field 2)
-
-    # intentional sleep to make sure the tag has been set to port
-    sleep 10
-
-    local tapdev
-    tapdev=$(sudo ip netns exec qdhcp-${ironic_net_id} ip link list | grep " tap" | cut -d':' -f2 | cut -d'@' -f1 | cut -b2-)
-    local tag_id
-    tag_id=$(sudo ovs-vsctl show |grep ${tapdev} -A1 -m1 | grep tag | cut -d':' -f2 | cut -b2-)
-
-    # make sure veth pair is not existing, otherwise delete its links
-    sudo ip link show ovs-tap1 && sudo ip link delete ovs-tap1
-    sudo ip link show brbm-tap1 && sudo ip link delete brbm-tap1
-    # create veth pair for future interconnection between br-int and brbm
-    sudo ip link add brbm-tap1 type veth peer name ovs-tap1
-    sudo ip link set dev brbm-tap1 up
-    sudo ip link set dev ovs-tap1 up
-
-    sudo ovs-vsctl -- --if-exists del-port ovs-tap1 -- add-port br-int ovs-tap1 tag=$tag_id
-    sudo ovs-vsctl -- --if-exists del-port brbm-tap1 -- add-port $IRONIC_VM_NETWORK_BRIDGE brbm-tap1
-
-    # Remove the port needed only for workaround.
-    neutron port-delete $port_id
-
-    # Finally, share the fixed tenant network across all tenants.  This allows the host
-    # to serve TFTP to a single network namespace via the tap device created above.
-    neutron net-update $ironic_net_id --shared true
-}
-
-function create_bridge_and_vms {
-    # Call libvirt setup scripts in a new shell to ensure any new group membership
-    sudo su $STACK_USER -c "$IRONIC_SCRIPTS_DIR/setup-network"
-    if [[ "$IRONIC_VM_LOG_CONSOLE" == "True" ]] ; then
-        local log_arg="$IRONIC_VM_LOG_DIR"
-    else
-        local log_arg=""
-    fi
-    local vm_name
-    for vm_name in $(_ironic_bm_vm_names); do
-        sudo su $STACK_USER -c "$IRONIC_SCRIPTS_DIR/create-node $vm_name \
-            $IRONIC_VM_SPECS_CPU $IRONIC_VM_SPECS_RAM $IRONIC_VM_SPECS_DISK \
-            amd64 $IRONIC_VM_NETWORK_BRIDGE $IRONIC_VM_EMULATOR \
-            $log_arg" >> $IRONIC_VM_MACS_CSV_FILE
-    done
-    create_ovs_taps
-}
-
-function wait_for_nova_resources {
-    # After nodes have been enrolled, we need to wait for both ironic and
-    # nova's periodic tasks to populate the resource tracker with available
-    # nodes and resources. Wait up to 2 minutes for a given resource before
-    # timing out.
-    local resource=$1
-    local expected_count=$2
-    local i
-    echo_summary "Waiting 2 minutes for Nova resource tracker to pick up $resource >= $expected_count"
-    for i in $(seq 1 120); do
-        if [ $(nova hypervisor-stats | grep " $resource " | get_field 2) -ge $expected_count ]; then
-            return 0
-        fi
-        sleep 1
-    done
-    die $LINENO "Timed out waiting for Nova hypervisor-stats $resource >= $expected_count"
-}
-
-function enroll_nodes {
-    local chassis_id
-    chassis_id=$(ironic chassis-create -d "ironic test chassis" | grep " uuid " | get_field 2)
-
-    if ! is_ironic_hardware; then
-        local ironic_node_cpu=$IRONIC_VM_SPECS_CPU
-        local ironic_node_ram=$IRONIC_VM_SPECS_RAM
-        local ironic_node_disk=$IRONIC_VM_SPECS_DISK
-        local ironic_ephemeral_disk=$IRONIC_VM_EPHEMERAL_DISK
-        local ironic_hwinfo_file=$IRONIC_VM_MACS_CSV_FILE
-        local node_options="\
-            -i deploy_kernel=$IRONIC_DEPLOY_KERNEL_ID \
-            -i deploy_ramdisk=$IRONIC_DEPLOY_RAMDISK_ID \
-            -i ssh_virt_type=$IRONIC_SSH_VIRT_TYPE \
-            -i ssh_address=$IRONIC_VM_SSH_ADDRESS \
-            -i ssh_port=$IRONIC_VM_SSH_PORT \
-            -i ssh_username=$IRONIC_SSH_USERNAME \
-            -i ssh_key_filename=$IRONIC_KEY_FILE"
-    else
-        local ironic_node_cpu=$IRONIC_HW_NODE_CPU
-        local ironic_node_ram=$IRONIC_HW_NODE_RAM
-        local ironic_node_disk=$IRONIC_HW_NODE_DISK
-        local ironic_ephemeral_disk=$IRONIC_HW_EPHEMERAL_DISK
-        if [[ -z "${IRONIC_DEPLOY_DRIVER##*_ipmitool}" ]]; then
-            local ironic_hwinfo_file=$IRONIC_IPMIINFO_FILE
-        fi
-    fi
-
-    local total_nodes=0
-    local total_cpus=0
-    while read hardware_info; do
-        if ! is_ironic_hardware; then
-            local mac_address=$hardware_info
-        elif [[ -z "${IRONIC_DEPLOY_DRIVER##*_ipmitool}" ]]; then
-            local ipmi_address
-            ipmi_address=$(echo $hardware_info |awk  '{print $1}')
-            local mac_address
-            mac_address=$(echo $hardware_info |awk '{print $2}')
-            local ironic_ipmi_username
-            ironic_ipmi_username=$(echo $hardware_info |awk '{print $3}')
-            local ironic_ipmi_passwd
-            ironic_ipmi_passwd=$(echo $hardware_info |awk '{print $4}')
-            # Currently we require all hardware platform have same CPU/RAM/DISK info
-            # in future, this can be enhanced to support different type, and then
-            # we create the bare metal flavor with minimum value
-            local node_options="-i ipmi_address=$ipmi_address -i ipmi_password=$ironic_ipmi_passwd\
-                -i ipmi_username=$ironic_ipmi_username"
-            node_options+=" -i deploy_kernel=$IRONIC_DEPLOY_KERNEL_ID"
-            node_options+=" -i deploy_ramdisk=$IRONIC_DEPLOY_RAMDISK_ID"
-        fi
-
-        # First node created will be used for testing in ironic w/o glance
-        # scenario, so we need to know its UUID.
-        local standalone_node_uuid=""
-        if [ $total_nodes -eq 0 ]; then
-            standalone_node_uuid="--uuid $IRONIC_NODE_UUID"
-        fi
-
-        local node_id
-        node_id=$(ironic node-create $standalone_node_uuid\
-            --chassis_uuid $chassis_id \
-            --driver $IRONIC_DEPLOY_DRIVER \
-            --name node-$total_nodes \
-            -p cpus=$ironic_node_cpu\
-            -p memory_mb=$ironic_node_ram\
-            -p local_gb=$ironic_node_disk\
-            -p cpu_arch=x86_64 \
-            $node_options \
-            | grep " uuid " | get_field 2)
-
-        ironic port-create --address $mac_address --node $node_id
-
-        total_nodes=$((total_nodes+1))
-        total_cpus=$((total_cpus+$ironic_node_cpu))
-    done < $ironic_hwinfo_file
-
-    local adjusted_disk
-    adjusted_disk=$(($ironic_node_disk - $ironic_ephemeral_disk))
-    nova flavor-create --ephemeral $ironic_ephemeral_disk baremetal auto $ironic_node_ram $adjusted_disk $ironic_node_cpu
-
-    nova flavor-key baremetal set "cpu_arch"="x86_64"
-
-    if [ "$VIRT_DRIVER" == "ironic" ]; then
-        wait_for_nova_resources "count" $total_nodes
-        wait_for_nova_resources "vcpus" $total_cpus
-    fi
-}
-
-function configure_iptables {
-    # enable tftp natting for allowing connections to HOST_IP's tftp server
-    sudo modprobe nf_conntrack_tftp
-    sudo modprobe nf_nat_tftp
-    # explicitly allow DHCP - packets are occasionally being dropped here
-    sudo iptables -I INPUT -p udp --dport 67:68 --sport 67:68 -j ACCEPT || true
-    # nodes boot from TFTP and callback to the API server listening on $HOST_IP
-    sudo iptables -I INPUT -d $HOST_IP -p udp --dport 69 -j ACCEPT || true
-    sudo iptables -I INPUT -d $HOST_IP -p tcp --dport $IRONIC_SERVICE_PORT -j ACCEPT || true
-    if is_deployed_by_agent; then
-        # agent ramdisk gets instance image from swift
-        sudo iptables -I INPUT -d $HOST_IP -p tcp --dport ${SWIFT_DEFAULT_BIND_PORT:-8080} -j ACCEPT || true
-    fi
-
-    if [[ "$IRONIC_IPXE_ENABLED" == "True" ]] ; then
-        sudo iptables -I INPUT -d $HOST_IP -p tcp --dport $IRONIC_HTTP_PORT -j ACCEPT || true
-    fi
-}
-
-function configure_tftpd {
-    # stop tftpd and setup serving via xinetd
-    stop_service tftpd-hpa || true
-    [ -f /etc/init/tftpd-hpa.conf ] && echo "manual" | sudo tee /etc/init/tftpd-hpa.override
-    sudo cp $IRONIC_TEMPLATES_DIR/tftpd-xinetd.template /etc/xinetd.d/tftp
-    sudo sed -e "s|%TFTPBOOT_DIR%|$IRONIC_TFTPBOOT_DIR|g" -i /etc/xinetd.d/tftp
-
-    # setup tftp file mapping to satisfy requests at the root (booting) and
-    # /tftpboot/ sub-dir (as per deploy-ironic elements)
-    echo "r ^([^/]) $IRONIC_TFTPBOOT_DIR/\1" >$IRONIC_TFTPBOOT_DIR/map-file
-    echo "r ^(/tftpboot/) $IRONIC_TFTPBOOT_DIR/\2" >>$IRONIC_TFTPBOOT_DIR/map-file
-
-    chmod -R 0755 $IRONIC_TFTPBOOT_DIR
-    restart_service xinetd
-}
-
-function configure_ironic_ssh_keypair {
-    if [[ ! -d $HOME/.ssh ]]; then
-        mkdir -p $HOME/.ssh
-        chmod 700 $HOME/.ssh
-    fi
-    if [[ ! -e $IRONIC_KEY_FILE ]]; then
-        if [[ ! -d $(dirname $IRONIC_KEY_FILE) ]]; then
-            mkdir -p $(dirname $IRONIC_KEY_FILE)
-        fi
-        echo -e 'n\n' | ssh-keygen -q -t rsa -P '' -f $IRONIC_KEY_FILE
-    fi
-    cat $IRONIC_KEY_FILE.pub | tee -a $IRONIC_AUTHORIZED_KEYS_FILE
-}
-
-function ironic_ssh_check {
-    local key_file=$1
-    local floating_ip=$2
-    local port=$3
-    local default_instance_user=$4
-    local active_timeout=$5
-    if ! timeout $active_timeout sh -c "while ! ssh -p $port -o StrictHostKeyChecking=no -i $key_file ${default_instance_user}@$floating_ip echo success; do sleep 1; done"; then
-        die $LINENO "server didn't become ssh-able!"
-    fi
-}
-
-function configure_ironic_auxiliary {
-    configure_ironic_ssh_keypair
-    ironic_ssh_check $IRONIC_KEY_FILE $IRONIC_VM_SSH_ADDRESS $IRONIC_VM_SSH_PORT $IRONIC_SSH_USERNAME $IRONIC_SSH_TIMEOUT
-}
-
-function build_ipa_coreos_ramdisk {
-    echo "Building ironic-python-agent deploy ramdisk"
-    local kernel_path=$1
-    local ramdisk_path=$2
-    git_clone $IRONIC_PYTHON_AGENT_REPO $IRONIC_PYTHON_AGENT_DIR $IRONIC_PYTHON_AGENT_BRANCH
-    cd $IRONIC_PYTHON_AGENT_DIR
-    imagebuild/coreos/build_coreos_image.sh
-    cp imagebuild/coreos/UPLOAD/coreos_production_pxe_image-oem.cpio.gz $ramdisk_path
-    cp imagebuild/coreos/UPLOAD/coreos_production_pxe.vmlinuz $kernel_path
-    sudo rm -rf UPLOAD
-    cd -
-}
-
-# build deploy kernel+ramdisk, then upload them to glance
-# this function sets ``IRONIC_DEPLOY_KERNEL_ID``, ``IRONIC_DEPLOY_RAMDISK_ID``
-function upload_baremetal_ironic_deploy {
-    declare -g IRONIC_DEPLOY_KERNEL_ID IRONIC_DEPLOY_RAMDISK_ID
-    echo_summary "Creating and uploading baremetal images for ironic"
-
-    # install diskimage-builder
-    if [[ $(type -P ramdisk-image-create) == "" ]]; then
-        pip_install_gr "diskimage-builder"
-    fi
-
-    if [ -z "$IRONIC_DEPLOY_KERNEL" -o -z "$IRONIC_DEPLOY_RAMDISK" ]; then
-        local IRONIC_DEPLOY_KERNEL_PATH=$TOP_DIR/files/ir-deploy-$IRONIC_DEPLOY_DRIVER.kernel
-        local IRONIC_DEPLOY_RAMDISK_PATH=$TOP_DIR/files/ir-deploy-$IRONIC_DEPLOY_DRIVER.initramfs
-    else
-        local IRONIC_DEPLOY_KERNEL_PATH=$IRONIC_DEPLOY_KERNEL
-        local IRONIC_DEPLOY_RAMDISK_PATH=$IRONIC_DEPLOY_RAMDISK
-    fi
-
-    if [ ! -e "$IRONIC_DEPLOY_RAMDISK_PATH" -o ! -e "$IRONIC_DEPLOY_KERNEL_PATH" ]; then
-        # files don't exist, need to build them
-        if [ "$IRONIC_BUILD_DEPLOY_RAMDISK" = "True" ]; then
-            # we can build them only if we're not offline
-            if [ "$OFFLINE" != "True" ]; then
-                if is_deployed_with_ipa_ramdisk; then
-                    build_ipa_coreos_ramdisk $IRONIC_DEPLOY_KERNEL_PATH $IRONIC_DEPLOY_RAMDISK_PATH
-                else
-                    ramdisk-image-create $IRONIC_DEPLOY_FLAVOR \
-                        -o $TOP_DIR/files/ir-deploy-$IRONIC_DEPLOY_DRIVER
-                fi
-            else
-                die $LINENO "Deploy kernel+ramdisk files don't exist and cannot be build in OFFLINE mode"
-            fi
-        else
-            if is_deployed_with_ipa_ramdisk; then
-                # download the agent image tarball
-                wget "$IRONIC_AGENT_KERNEL_URL" -O $IRONIC_DEPLOY_KERNEL_PATH
-                wget "$IRONIC_AGENT_RAMDISK_URL" -O $IRONIC_DEPLOY_RAMDISK_PATH
-            else
-                die $LINENO "Deploy kernel+ramdisk files don't exist and their building was disabled explicitly by IRONIC_BUILD_DEPLOY_RAMDISK"
-            fi
-        fi
-    fi
-
-    local token
-    token=$(openstack token issue -c id -f value)
-    die_if_not_set $LINENO token "Keystone fail to get token"
-
-    # load them into glance
-    IRONIC_DEPLOY_KERNEL_ID=$(openstack \
-        --os-token $token \
-        --os-url $GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT \
-        image create \
-        $(basename $IRONIC_DEPLOY_KERNEL_PATH) \
-        --public --disk-format=aki \
-        --container-format=aki \
-        < $IRONIC_DEPLOY_KERNEL_PATH  | grep ' id ' | get_field 2)
-    IRONIC_DEPLOY_RAMDISK_ID=$(openstack \
-        --os-token $token \
-        --os-url $GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT \
-        image create \
-        $(basename $IRONIC_DEPLOY_RAMDISK_PATH) \
-        --public --disk-format=ari \
-        --container-format=ari \
-        < $IRONIC_DEPLOY_RAMDISK_PATH  | grep ' id ' | get_field 2)
-}
-
-function prepare_baremetal_basic_ops {
-    if ! is_ironic_hardware; then
-        configure_ironic_auxiliary
-    fi
-    upload_baremetal_ironic_deploy
-    if ! is_ironic_hardware; then
-        create_bridge_and_vms
-    fi
-    enroll_nodes
-    configure_tftpd
-    configure_iptables
-}
-
-function cleanup_baremetal_basic_ops {
-    rm -f $IRONIC_VM_MACS_CSV_FILE
-    if [ -f $IRONIC_KEY_FILE ]; then
-        local key
-        key=$(cat $IRONIC_KEY_FILE.pub)
-        # remove public key from authorized_keys
-        grep -v "$key" $IRONIC_AUTHORIZED_KEYS_FILE > temp && mv temp $IRONIC_AUTHORIZED_KEYS_FILE
-        chmod 0600 $IRONIC_AUTHORIZED_KEYS_FILE
-    fi
-    sudo rm -rf $IRONIC_DATA_DIR $IRONIC_STATE_PATH
-
-    local vm_name
-    for vm_name in $(_ironic_bm_vm_names); do
-        sudo su $STACK_USER -c "$IRONIC_SCRIPTS_DIR/cleanup-node $vm_name $IRONIC_VM_NETWORK_BRIDGE"
-    done
-
-    sudo rm -rf /etc/xinetd.d/tftp /etc/init/tftpd-hpa.override
-    restart_service xinetd
-    sudo iptables -D INPUT -d $HOST_IP -p udp --dport 69 -j ACCEPT || true
-    sudo iptables -D INPUT -d $HOST_IP -p tcp --dport $IRONIC_SERVICE_PORT -j ACCEPT || true
-    if is_deployed_by_agent; then
-        # agent ramdisk gets instance image from swift
-        sudo iptables -D INPUT -d $HOST_IP -p tcp --dport ${SWIFT_DEFAULT_BIND_PORT:-8080} -j ACCEPT || true
-    fi
-    sudo rmmod nf_conntrack_tftp || true
-    sudo rmmod nf_nat_tftp || true
-}
-
-# Restore xtrace + pipefail
-$_XTRACE_IRONIC
-$_PIPEFAIL_IRONIC
-
-# Tell emacs to use shell-script-mode
-## Local variables:
-## mode: shell-script
-## End:
diff --git a/stackrc b/stackrc
index f949ccbad9..8e6ea42a00 100644
--- a/stackrc
+++ b/stackrc
@@ -225,10 +225,6 @@ HEAT_BRANCH=${HEAT_BRANCH:-master}
 HORIZON_REPO=${HORIZON_REPO:-${GIT_BASE}/openstack/horizon.git}
 HORIZON_BRANCH=${HORIZON_BRANCH:-master}
 
-# baremetal provisioning service
-IRONIC_REPO=${IRONIC_REPO:-${GIT_BASE}/openstack/ironic.git}
-IRONIC_BRANCH=${IRONIC_BRANCH:-master}
-
 # unified auth system (manages accounts/tokens)
 KEYSTONE_REPO=${KEYSTONE_REPO:-${GIT_BASE}/openstack/keystone.git}
 KEYSTONE_BRANCH=${KEYSTONE_BRANCH:-master}
@@ -298,6 +294,8 @@ GITBRANCH["python-heatclient"]=${HEATCLIENT_BRANCH:-master}
 # ironic client
 GITREPO["python-ironicclient"]=${IRONICCLIENT_REPO:-${GIT_BASE}/openstack/python-ironicclient.git}
 GITBRANCH["python-ironicclient"]=${IRONICCLIENT_BRANCH:-master}
+# ironic plugin is out of tree, but nova uses it. set GITDIR here.
+GITDIR["python-ironicclient"]=$DEST/python-ironicclient
 
 # the base authentication plugins that clients use to authenticate
 GITREPO["keystoneauth"]=${KEYSTONEAUTH_REPO:-${GIT_BASE}/openstack/keystoneauth.git}
@@ -484,6 +482,8 @@ GITBRANCH["os-brick"]=${OS_BRICK_BRANCH:-master}
 # ironic common lib
 GITREPO["ironic-lib"]=${IRONIC_LIB_REPO:-${GIT_BASE}/openstack/ironic-lib.git}
 GITBRANCH["ironic-lib"]=${IRONIC_LIB_BRANCH:-master}
+# this doesn't exist in a lib file, so set it here
+GITDIR["ironic-lib"]=$DEST/ironic-lib
 
 
 ##################
diff --git a/tools/ironic/scripts/cleanup-node b/tools/ironic/scripts/cleanup-node
deleted file mode 100755
index c4e4e706f4..0000000000
--- a/tools/ironic/scripts/cleanup-node
+++ /dev/null
@@ -1,25 +0,0 @@
-#!/usr/bin/env bash
-
-# **cleanup-nodes**
-
-# Cleans up baremetal poseur nodes and volumes created during ironic setup
-# Assumes calling user has proper libvirt group membership and access.
-
-set -exu
-
-LIBVIRT_STORAGE_POOL=${LIBVIRT_STORAGE_POOL:-"default"}
-LIBVIRT_CONNECT_URI=${LIBVIRT_CONNECT_URI:-"qemu:///system"}
-
-NAME=$1
-NETWORK_BRIDGE=$2
-
-export VIRSH_DEFAULT_CONNECT_URI=$LIBVIRT_CONNECT_URI
-
-VOL_NAME="$NAME.qcow2"
-virsh list | grep -q $NAME && virsh destroy $NAME
-virsh list --inactive | grep -q $NAME && virsh undefine $NAME
-
-if virsh pool-list | grep -q $LIBVIRT_STORAGE_POOL ; then
-  virsh vol-list $LIBVIRT_STORAGE_POOL | grep -q $VOL_NAME &&
-      virsh vol-delete $VOL_NAME --pool $LIBVIRT_STORAGE_POOL
-fi
diff --git a/tools/ironic/scripts/configure-vm b/tools/ironic/scripts/configure-vm
deleted file mode 100755
index 378fcb85ad..0000000000
--- a/tools/ironic/scripts/configure-vm
+++ /dev/null
@@ -1,93 +0,0 @@
-#!/usr/bin/env python
-
-import argparse
-import os.path
-
-import libvirt
-
-templatedir = os.path.join(os.path.dirname(os.path.dirname(__file__)),
-                           'templates')
-
-
-CONSOLE_LOG = """
-    <serial type='file'>
-      <source path='%(console_log)s'/>
-      <target port='0'/>
-      <alias name='serial0'/>
-    </serial>
-    <serial type='pty'>
-      <source path='/dev/pts/49'/>
-      <target port='1'/>
-      <alias name='serial1'/>
-    </serial>
-    <console type='file'>
-      <source path='%(console_log)s'/>
-      <target type='serial' port='0'/>
-      <alias name='serial0'/>
-    </console>
-"""
-
-
-def main():
-    parser = argparse.ArgumentParser(
-        description="Configure a kvm virtual machine for the seed image.")
-    parser.add_argument('--name', default='seed',
-                        help='the name to give the machine in libvirt.')
-    parser.add_argument('--image',
-                        help='Use a custom image file (must be qcow2).')
-    parser.add_argument('--engine', default='qemu',
-                        help='The virtualization engine to use')
-    parser.add_argument('--arch', default='i686',
-                        help='The architecture to use')
-    parser.add_argument('--memory', default='2097152',
-                        help="Maximum memory for the VM in KB.")
-    parser.add_argument('--cpus', default='1',
-                        help="CPU count for the VM.")
-    parser.add_argument('--bootdev', default='hd',
-                        help="What boot device to use (hd/network).")
-    parser.add_argument('--network', default="brbm",
-                        help='The libvirt network name to use')
-    parser.add_argument('--libvirt-nic-driver', default='e1000',
-                        help='The libvirt network driver to use')
-    parser.add_argument('--console-log',
-                        help='File to log console')
-    parser.add_argument('--emulator', default=None,
-                        help='Path to emulator bin for vm template')
-    args = parser.parse_args()
-    with file(templatedir + '/vm.xml', 'rb') as f:
-        source_template = f.read()
-    params = {
-        'name': args.name,
-        'imagefile': args.image,
-        'engine': args.engine,
-        'arch': args.arch,
-        'memory': args.memory,
-        'cpus': args.cpus,
-        'bootdev': args.bootdev,
-        'network': args.network,
-        'nicdriver': args.libvirt_nic_driver,
-        'emulator': args.emulator,
-    }
-
-    if args.emulator:
-        params['emulator'] = args.emulator
-    else:
-        if os.path.exists("/usr/bin/kvm"):  # Debian
-            params['emulator'] = "/usr/bin/kvm"
-        elif os.path.exists("/usr/bin/qemu-kvm"):  # Redhat
-            params['emulator'] = "/usr/bin/qemu-kvm"
-
-    if args.console_log:
-        params['bios_serial'] = "<bios useserial='yes'/>"
-        params['console_log'] = CONSOLE_LOG % {'console_log': args.console_log}
-    else:
-        params['bios_serial'] = ''
-        params['console_log'] = ''
-    libvirt_template = source_template % params
-    conn = libvirt.open("qemu:///system")
-
-    a = conn.defineXML(libvirt_template)
-    print ("Created machine %s with UUID %s" % (args.name, a.UUIDString()))
-
-if __name__ == '__main__':
-    main()
diff --git a/tools/ironic/scripts/create-node b/tools/ironic/scripts/create-node
deleted file mode 100755
index b018acddc9..0000000000
--- a/tools/ironic/scripts/create-node
+++ /dev/null
@@ -1,79 +0,0 @@
-#!/usr/bin/env bash
-
-# **create-nodes**
-
-# Creates baremetal poseur nodes for ironic testing purposes
-
-set -ex
-
-# Keep track of the DevStack directory
-TOP_DIR=$(cd $(dirname "$0")/.. && pwd)
-
-NAME=$1
-CPU=$2
-MEM=$(( 1024 * $3 ))
-# Extra G to allow fuzz for partition table : flavor size and registered size
-# need to be different to actual size.
-DISK=$(( $4 + 1))
-
-case $5 in
-    i386) ARCH='i686' ;;
-    amd64) ARCH='x86_64' ;;
-    *) echo "Unsupported arch $4!" ; exit 1 ;;
-esac
-
-BRIDGE=$6
-EMULATOR=$7
-LOGDIR=$8
-
-LIBVIRT_NIC_DRIVER=${LIBVIRT_NIC_DRIVER:-"e1000"}
-LIBVIRT_STORAGE_POOL=${LIBVIRT_STORAGE_POOL:-"default"}
-LIBVIRT_CONNECT_URI=${LIBVIRT_CONNECT_URI:-"qemu:///system"}
-
-export VIRSH_DEFAULT_CONNECT_URI=$LIBVIRT_CONNECT_URI
-
-if ! virsh pool-list --all | grep -q $LIBVIRT_STORAGE_POOL; then
-    virsh pool-define-as --name $LIBVIRT_STORAGE_POOL dir --target /var/lib/libvirt/images >&2
-    virsh pool-autostart $LIBVIRT_STORAGE_POOL >&2
-    virsh pool-start $LIBVIRT_STORAGE_POOL >&2
-fi
-
-pool_state=$(virsh pool-info $LIBVIRT_STORAGE_POOL | grep State | awk '{ print $2 }')
-if [ "$pool_state" != "running" ] ; then
-  [ ! -d /var/lib/libvirt/images ] && sudo mkdir /var/lib/libvirt/images
-  virsh pool-start $LIBVIRT_STORAGE_POOL >&2
-fi
-
-if [ -n "$LOGDIR" ] ; then
-  mkdir -p "$LOGDIR"
-fi
-
-PREALLOC=
-if [ -f /etc/debian_version ]; then
-    PREALLOC="--prealloc-metadata"
-fi
-
-if [ -n "$LOGDIR" ] ; then
-  VM_LOGGING="--console-log $LOGDIR/${NAME}_console.log"
-else
-  VM_LOGGING=""
-fi
-VOL_NAME="${NAME}.qcow2"
-
-if ! virsh list --all | grep -q $NAME; then
-  virsh vol-list --pool $LIBVIRT_STORAGE_POOL | grep -q $VOL_NAME &&
-      virsh vol-delete $VOL_NAME --pool $LIBVIRT_STORAGE_POOL >&2
-  virsh vol-create-as $LIBVIRT_STORAGE_POOL ${VOL_NAME} ${DISK}G --format qcow2 $PREALLOC >&2
-  volume_path=$(virsh vol-path --pool $LIBVIRT_STORAGE_POOL $VOL_NAME)
-  # Pre-touch the VM to set +C, as it can only be set on empty files.
-  sudo touch "$volume_path"
-  sudo chattr +C "$volume_path" || true
-  $TOP_DIR/scripts/configure-vm \
-    --bootdev network --name $NAME --image "$volume_path" \
-    --arch $ARCH --cpus $CPU --memory $MEM --libvirt-nic-driver $LIBVIRT_NIC_DRIVER \
-    --emulator $EMULATOR --network $BRIDGE $VM_LOGGING >&2
-
-fi
-
-# echo mac
-virsh dumpxml $NAME | grep "mac address" | head -1 | cut -d\' -f2
diff --git a/tools/ironic/scripts/setup-network b/tools/ironic/scripts/setup-network
deleted file mode 100755
index 83308ed416..0000000000
--- a/tools/ironic/scripts/setup-network
+++ /dev/null
@@ -1,28 +0,0 @@
-#!/usr/bin/env bash
-
-# **setup-network**
-
-# Setups openvswitch libvirt network suitable for
-# running baremetal poseur nodes for ironic testing purposes
-
-set -exu
-
-LIBVIRT_CONNECT_URI=${LIBVIRT_CONNECT_URI:-"qemu:///system"}
-
-# Keep track of the DevStack directory
-TOP_DIR=$(cd $(dirname "$0")/.. && pwd)
-BRIDGE_SUFFIX=${1:-''}
-BRIDGE_NAME=brbm$BRIDGE_SUFFIX
-
-export VIRSH_DEFAULT_CONNECT_URI="$LIBVIRT_CONNECT_URI"
-
-# Only add bridge if missing
-(sudo ovs-vsctl list-br | grep ${BRIDGE_NAME}$) || sudo ovs-vsctl add-br ${BRIDGE_NAME}
-
-# Remove bridge before replacing it.
-(virsh net-list | grep "${BRIDGE_NAME} ") && virsh net-destroy ${BRIDGE_NAME}
-(virsh net-list --inactive  | grep "${BRIDGE_NAME} ") && virsh net-undefine ${BRIDGE_NAME}
-
-virsh net-define <(sed s/brbm/$BRIDGE_NAME/ $TOP_DIR/templates/brbm.xml)
-virsh net-autostart ${BRIDGE_NAME}
-virsh net-start ${BRIDGE_NAME}
diff --git a/tools/ironic/templates/brbm.xml b/tools/ironic/templates/brbm.xml
deleted file mode 100644
index 0769d3f1d0..0000000000
--- a/tools/ironic/templates/brbm.xml
+++ /dev/null
@@ -1,6 +0,0 @@
-<network>
-  <name>brbm</name>
-  <forward mode='bridge'/>
-  <bridge name='brbm'/>
-  <virtualport type='openvswitch'/>
-</network>
diff --git a/tools/ironic/templates/tftpd-xinetd.template b/tools/ironic/templates/tftpd-xinetd.template
deleted file mode 100644
index 5f3d03f3bb..0000000000
--- a/tools/ironic/templates/tftpd-xinetd.template
+++ /dev/null
@@ -1,14 +0,0 @@
-service tftp
-{
-  protocol        = udp
-  port            = 69
-  socket_type     = dgram
-  wait            = yes
-  user            = root
-  server          = /usr/sbin/in.tftpd
-  server_args     = -v -v -v -v -v --map-file %TFTPBOOT_DIR%/map-file %TFTPBOOT_DIR%
-  disable         = no
-  # This is a workaround for Fedora, where TFTP will listen only on
-  # IPv6 endpoint, if IPv4 flag is not used.
-  flags           = IPv4
-}
diff --git a/tools/ironic/templates/vm.xml b/tools/ironic/templates/vm.xml
deleted file mode 100644
index ae7d685256..0000000000
--- a/tools/ironic/templates/vm.xml
+++ /dev/null
@@ -1,49 +0,0 @@
-<domain type='%(engine)s'>
-  <name>%(name)s</name>
-  <memory unit='KiB'>%(memory)s</memory>
-  <vcpu>%(cpus)s</vcpu>
-  <os>
-    <type arch='%(arch)s' machine='pc-1.0'>hvm</type>
-    <boot dev='%(bootdev)s'/>
-    <bootmenu enable='no'/>
-    %(bios_serial)s
-  </os>
-  <features>
-    <acpi/>
-    <apic/>
-    <pae/>
-  </features>
-  <clock offset='utc'/>
-  <on_poweroff>destroy</on_poweroff>
-  <on_reboot>restart</on_reboot>
-  <on_crash>restart</on_crash>
-  <devices>
-    <emulator>%(emulator)s</emulator>
-    <disk type='file' device='disk'>
-      <driver name='qemu' type='qcow2' cache='writeback'/>
-      <source file='%(imagefile)s'/>
-      <target dev='vda' bus='virtio'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/>
-    </disk>
-    <controller type='ide' index='0'>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x1'/>
-    </controller>
-    <interface type='network'>
-      <source network='%(network)s'/>
-      <virtualport type='openvswitch'/>
-      <model type='%(nicdriver)s'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/>
-    </interface>
-    <input type='mouse' bus='ps2'/>
-    <graphics type='vnc' port='-1' autoport='yes'/>
-    <video>
-      <model type='cirrus' vram='9216' heads='1'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/>
-    </video>
-    %(console_log)s
-    <memballoon model='virtio'>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/>
-    </memballoon>
-  </devices>
-</domain>
-

From 50ce626db752d5b20dc79b9118a877db2c5b1c1c Mon Sep 17 00:00:00 2001
From: John Kasperski <jckasper@us.ibm.com>
Date: Mon, 23 Nov 2015 15:47:45 -0600
Subject: [PATCH 0135/2409] Neutron: Fix IPv6 provider networks

The creation of the IPv6 subnet with provider networks does not
specifiy the correct parameters:
 . V6_NETWORK_GATEWAY is specified but never set
       - created new IPV6_PROVIDER_NETWORK_GATEWAY
 . PROVIDER_SUBNET_NAME_V6 is specified but never set
       - created new IPV6_PROVIDER_SUBNET_NAME
 . FIXED_RANGE_V6 is being used
       - created new IPV6_PROVIDER_FIXED_RANGE
 . subnetpool_id is incorrect
       - changed to subnetpool

Related-Bug: #1507870
Closes-Bug: #1417410
Change-Id: I9a1ad11bc54529080ec84d4677fa5633708890c7
---
 lib/neutron-legacy | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index caf89e3d8c..be11ee9deb 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -165,6 +165,9 @@ NEUTRON_CREATE_INITIAL_NETWORKS=${NEUTRON_CREATE_INITIAL_NETWORKS:-True}
 
 ## Provider Network Information
 PROVIDER_SUBNET_NAME=${PROVIDER_SUBNET_NAME:-"provider_net"}
+IPV6_PROVIDER_SUBNET_NAME=${IPV6_PROVIDER_SUBNET_NAME:-"provider_net_v6"}
+IPV6_PROVIDER_FIXED_RANGE=${IPV6_PROVIDER_FIXED_RANGE:-}
+IPV6_PROVIDER_NETWORK_GATEWAY=${IPV6_PROVIDER_NETWORK_GATEWAY:-}
 
 # Define the public bridge that will transmit traffic from VMs to the
 # physical network - used by both the OVS and Linux Bridge drivers.
@@ -545,9 +548,9 @@ function create_neutron_initial_network {
             die_if_not_set $LINENO SUBNET_ID "Failure creating SUBNET_ID for $PROVIDER_SUBNET_NAME $TENANT_ID"
         fi
 
-        if [[ "$IP_VERSION" =~ .*6 ]]; then
-            SUBNET_V6_ID=$(neutron subnet-create --tenant_id $TENANT_ID --ip_version 6 --ipv6-address-mode $IPV6_ADDRESS_MODE --gateway $V6_NETWORK_GATEWAY --name $PROVIDER_SUBNET_NAME_V6 --subnetpool_id None $NET_ID $FIXED_RANGE_V6 | grep 'id' | get_field 2)
-            die_if_not_set $LINENO SUBNET_V6_ID "Failure creating SUBNET_V6_ID for $PROVIDER_SUBNET_NAME_V6 $TENANT_ID"
+        if [[ "$IP_VERSION" =~ .*6 ]] && [[ -n "$IPV6_PROVIDER_FIXED_RANGE" ]] && [[ -n "$IPV6_PROVIDER_NETWORK_GATEWAY" ]]; then
+            SUBNET_V6_ID=$(neutron subnet-create --tenant_id $TENANT_ID --ip_version 6 --ipv6-address-mode $IPV6_ADDRESS_MODE --gateway $IPV6_PROVIDER_NETWORK_GATEWAY --name $IPV6_PROVIDER_SUBNET_NAME --subnetpool None $NET_ID $IPV6_PROVIDER_FIXED_RANGE | grep 'id' | get_field 2)
+            die_if_not_set $LINENO SUBNET_V6_ID "Failure creating SUBNET_V6_ID for $IPV6_PROVIDER_SUBNET_NAME $TENANT_ID"
         fi
 
         if [[ $Q_AGENT == "openvswitch" ]]; then

From fbe0a62785781f2a5764697dd4b3e60f44fbe4e4 Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Thu, 10 Dec 2015 19:36:50 -0500
Subject: [PATCH 0136/2409] Stop using deprecated tempest options

This commit updates lib/tempest to stop using deprecated config
options when tempest is configured.

Change-Id: I65b56ff681d6c27094380693c953fbc3664eceb0
---
 lib/tempest | 31 ++++++++++++-------------------
 1 file changed, 12 insertions(+), 19 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 61351c0628..f35d142af4 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -281,18 +281,12 @@ function configure_tempest {
     # Identity
     iniset $TEMPEST_CONFIG identity uri "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:5000/v2.0/"
     iniset $TEMPEST_CONFIG identity uri_v3 "$KEYSTONE_SERVICE_URI_V3"
-    iniset $TEMPEST_CONFIG identity username $TEMPEST_USERNAME
-    iniset $TEMPEST_CONFIG identity password "$password"
-    iniset $TEMPEST_CONFIG identity tenant_name $TEMPEST_TENANT_NAME
-    iniset $TEMPEST_CONFIG identity alt_username $ALT_USERNAME
-    iniset $TEMPEST_CONFIG identity alt_password "$password"
-    iniset $TEMPEST_CONFIG identity alt_tenant_name $ALT_TENANT_NAME
     if [[ "$TEMPEST_HAS_ADMIN" == "True" ]]; then
-        iniset $TEMPEST_CONFIG identity admin_username $ADMIN_USERNAME
-        iniset $TEMPEST_CONFIG identity admin_password "$password"
-        iniset $TEMPEST_CONFIG identity admin_tenant_name $ADMIN_TENANT_NAME
-        iniset $TEMPEST_CONFIG identity admin_tenant_id $ADMIN_TENANT_ID
-        iniset $TEMPEST_CONFIG identity admin_domain_name $ADMIN_DOMAIN_NAME
+        iniset $TEMPEST_CONFIG auth admin_username $ADMIN_USERNAME
+        iniset $TEMPEST_CONFIG auth admin_password "$password"
+        iniset $TEMPEST_CONFIG auth admin_tenant_name $ADMIN_TENANT_NAME
+        iniset $TEMPEST_CONFIG auth admin_tenant_id $ADMIN_TENANT_ID
+        iniset $TEMPEST_CONFIG auth admin_domain_name $ADMIN_DOMAIN_NAME
     fi
     if [ "$ENABLE_IDENTITY_V2" == "False" ]; then
         # Only Identity v3 is available; then skip Identity API v2 tests
@@ -319,11 +313,7 @@ function configure_tempest {
 
     # Compute
     iniset $TEMPEST_CONFIG compute ssh_user ${DEFAULT_INSTANCE_USER:-cirros} # DEPRECATED
-    iniset $TEMPEST_CONFIG compute network_for_ssh $PRIVATE_NETWORK_NAME
-    iniset $TEMPEST_CONFIG compute ip_version_for_ssh 4
-    iniset $TEMPEST_CONFIG compute ssh_timeout $BUILD_TIMEOUT
     iniset $TEMPEST_CONFIG compute image_ref $image_uuid
-    iniset $TEMPEST_CONFIG compute image_ssh_user ${DEFAULT_INSTANCE_USER:-cirros}
     iniset $TEMPEST_CONFIG compute image_ref_alt $image_uuid_alt
     iniset $TEMPEST_CONFIG compute image_alt_ssh_user ${ALT_INSTANCE_USER:-cirros}
     iniset $TEMPEST_CONFIG compute flavor_ref $flavor_ref
@@ -480,6 +470,10 @@ function configure_tempest {
 
     # Validation
     iniset $TEMPEST_CONFIG validation run_validation ${TEMPEST_RUN_VALIDATION:-False}
+    iniset $TEMPEST_CONFIG validation ip_version_for_ssh 4
+    iniset $TEMPEST_CONFIG validation ssh_timeout $BUILD_TIMEOUT
+    iniset $TEMPEST_CONFIG validation image_ssh_user ${DEFAULT_INSTANCE_USER:-cirros}
+    iniset $TEMPEST_CONFIG validation network_for_ssh $PRIVATE_NETWORK_NAME
 
     # Volume
     # TODO(dkranz): Remove the bootable flag when Juno is end of life.
@@ -525,7 +519,6 @@ function configure_tempest {
 
     # Dashboard
     iniset $TEMPEST_CONFIG dashboard dashboard_url "http://$SERVICE_HOST/"
-    iniset $TEMPEST_CONFIG dashboard login_url "http://$SERVICE_HOST/auth/login/"
 
     # CLI
     iniset $TEMPEST_CONFIG cli cli_dir $NOVA_BIN_DIR
@@ -592,13 +585,13 @@ function configure_tempest {
         else
             tempest-account-generator -c $TEMPEST_CONFIG --os-username $ADMIN_USERNAME --os-password $ADMIN_PASSWORD --os-tenant-name $ADMIN_TENANT_NAME -r $TEMPEST_CONCURRENCY etc/accounts.yaml
         fi
-        iniset $TEMPEST_CONFIG auth allow_tenant_isolation False
+        iniset $TEMPEST_CONFIG auth use_dynamic_credentials False
         iniset $TEMPEST_CONFIG auth test_accounts_file "etc/accounts.yaml"
     elif [[ $TEMPEST_HAS_ADMIN == "False" ]]; then
-        iniset $TEMPEST_CONFIG auth allow_tenant_isolation ${TEMPEST_ALLOW_TENANT_ISOLATION:-False}
+        iniset $TEMPEST_CONFIG auth use_dynamic_credentials ${TEMPEST_ALLOW_TENANT_ISOLATION:-False}
 
     else
-        iniset $TEMPEST_CONFIG auth allow_tenant_isolation ${TEMPEST_ALLOW_TENANT_ISOLATION:-True}
+        iniset $TEMPEST_CONFIG auth use_dynamic_credentials ${TEMPEST_ALLOW_TENANT_ISOLATION:-True}
     fi
 
     # Restore IFS

From 4ce859ab2b99e68ce937c9c9df83d9270c8ef9fb Mon Sep 17 00:00:00 2001
From: Steve Martinelli <stevemar@ca.ibm.com>
Date: Sun, 20 Dec 2015 01:27:30 -0500
Subject: [PATCH 0137/2409] update create_heat_accounts, don't use os_url and
 os_token

Currently, the function create_heat_accounts uses the OS_URL and
OS_TOKEN environment variables. This is a bad choice for several
reasons, most importantly we are sending the "ADMIN_TOKEN" value
as a header. There is also no reason to not use a standard admin
user to create these resources.

Change-Id: I70b41d69917b9e53ad09c2c61e022ef09a50acfd
---
 functions-common | 26 ++++++++++++++++++++++++++
 lib/heat         | 29 +++++++----------------------
 2 files changed, 33 insertions(+), 22 deletions(-)

diff --git a/functions-common b/functions-common
index 1b01eefaf9..b15c3d7653 100644
--- a/functions-common
+++ b/functions-common
@@ -866,6 +866,32 @@ function get_or_add_user_project_role {
     echo $user_role_id
 }
 
+# Gets or adds user role to domain
+# Usage: get_or_add_user_domain_role <role> <user> <domain>
+function get_or_add_user_domain_role {
+    local user_role_id
+    # Gets user role id
+    user_role_id=$(openstack role list \
+        --user $2 \
+        --column "ID" \
+        --domain $3 \
+        --column "Name" \
+        | grep " $1 " | get_field 1)
+    if [[ -z "$user_role_id" ]]; then
+        # Adds role to user and get it
+        openstack role add $1 \
+            --user $2 \
+            --domain $3
+        user_role_id=$(openstack role list \
+            --user $2 \
+            --column "ID" \
+            --domain $3 \
+            --column "Name" \
+            | grep " $1 " | get_field 1)
+    fi
+    echo $user_role_id
+}
+
 # Gets or adds group role to project
 # Usage: get_or_add_group_project_role <role> <group> <project>
 function get_or_add_group_project_role {
diff --git a/lib/heat b/lib/heat
index fdcf5bcaad..ff196f4a81 100644
--- a/lib/heat
+++ b/lib/heat
@@ -402,28 +402,13 @@ function create_heat_accounts {
     fi
 
     if [[ "$HEAT_STACK_DOMAIN" == "True" ]]; then
-        # Note we have to pass token/endpoint here because the current endpoint and
-        # version negotiation in OSC means just --os-identity-api-version=3 won't work
-        D_ID=$(openstack --os-token $OS_TOKEN --os-url=$KEYSTONE_SERVICE_URI_V3 \
-            --os-identity-api-version=3 domain list | grep ' heat ' | get_field 1)
-
-        if [[ -z "$D_ID" ]]; then
-            D_ID=$(openstack --os-token $OS_TOKEN --os-url=$KEYSTONE_SERVICE_URI_V3 \
-                --os-identity-api-version=3 domain create heat \
-                --description "Owns users and projects created by heat" \
-                | grep ' id ' | get_field 2)
-            iniset $HEAT_CONF DEFAULT stack_user_domain_id ${D_ID}
-
-            openstack --os-token $OS_TOKEN --os-url=$KEYSTONE_SERVICE_URI_V3 \
-                --os-identity-api-version=3 user create --password $SERVICE_PASSWORD \
-                --domain $D_ID heat_domain_admin \
-                --description "Manages users and projects created by heat"
-            openstack --os-token $OS_TOKEN --os-url=$KEYSTONE_SERVICE_URI_V3 \
-                --os-identity-api-version=3 role add \
-                --user heat_domain_admin --domain ${D_ID} admin
-            iniset $HEAT_CONF DEFAULT stack_domain_admin heat_domain_admin
-            iniset $HEAT_CONF DEFAULT stack_domain_admin_password $SERVICE_PASSWORD
-        fi
+        # domain -> heat and user -> heat_domain_admin
+        domain_id=$(get_or_create_domain heat 'Owns users and projects created by heat')
+        iniset $HEAT_CONF DEFAULT stack_user_domain_id ${domain_id}
+        get_or_create_user heat_domain_admin $SERVICE_PASSWORD heat
+        get_or_add_user_domain_role admin heat_domain_admin heat
+        iniset $HEAT_CONF DEFAULT stack_domain_admin heat_domain_admin
+        iniset $HEAT_CONF DEFAULT stack_domain_admin_password $SERVICE_PASSWORD
     fi
 }
 

From bfdd47c8538260db26ead098cbafa62afb637a60 Mon Sep 17 00:00:00 2001
From: Hongbin Lu <hongbin.lu@huawei.com>
Date: Sun, 20 Dec 2015 16:30:36 -0500
Subject: [PATCH 0138/2409] Enable swap stats in dstat

Swap stats could be useful for trouble-shooting. It is better to
have it enabled in dstat.

Change-Id: I44e0735a95cd6ca3def9b04510551df16a1337a4
---
 tools/dstat.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/dstat.sh b/tools/dstat.sh
index 6ba4515acf..3c0b3be089 100755
--- a/tools/dstat.sh
+++ b/tools/dstat.sh
@@ -13,7 +13,7 @@
 LOGDIR=$1
 
 # Command line arguments for primary DStat process.
-DSTAT_OPTS="-tcmndrylpg --top-cpu-adv --top-io-adv"
+DSTAT_OPTS="-tcmndrylpg --top-cpu-adv --top-io-adv --swap"
 
 # Command-line arguments for secondary background DStat process.
 DSTAT_CSV_OPTS="-tcmndrylpg --output $LOGDIR/dstat-csv.log"

From f59e6df23a430f0622215fec5bbbe18cfe7fee9c Mon Sep 17 00:00:00 2001
From: Davanum Srinivas <davanum@gmail.com>
Date: Mon, 21 Dec 2015 08:36:40 -0500
Subject: [PATCH 0139/2409] Do not fail with Tox 2.3.1

Latest tox causes failures:
   File "/usr/local/lib/python2.7/dist-packages/tox/config.py", line 1140, in processcommand
     argv = list(shlexer)
   File "/usr/lib/python2.7/shlex.py", line 269, in next
     token = self.get_token()
   File "/usr/lib/python2.7/shlex.py", line 96, in get_token
     raw = self.read_token()
   File "/usr/lib/python2.7/shlex.py", line 172, in read_token
     raise ValueError, "No closing quotation"
 ValueError: No closing quotation

This is caused by a backwards incompatible change in tox:
https://bitbucket.org/hpk42/tox/issues/181

Change-Id: Ic28c634cf806394cfa82b61cb45be60b8f40a61a
---
 tox.ini | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/tox.ini b/tox.ini
index 9279455bb8..f9d04f2dcd 100644
--- a/tox.ini
+++ b/tox.ini
@@ -12,20 +12,20 @@ deps =
    {env:BASHATE_INSTALL_PATH:bashate==0.3.2}
 whitelist_externals = bash
 commands = bash -c "find {toxinidir}             \
-         -not \( -type d -name .?\* -prune \)    \ # prune all 'dot' dirs
-         -not \( -type d -name doc -prune \)     \ # skip documentation
-         -not \( -type d -name shocco -prune \)  \ # skip shocco
-         -type f                                 \ # only files
-         -not -name \*~                          \ # skip editors, readme, etc
+         -not \( -type d -name .?\* -prune \)    \
+         -not \( -type d -name doc -prune \)     \
+         -not \( -type d -name shocco -prune \)  \
+         -type f                                 \
+         -not -name \*~                          \
          -not -name \*.md                        \
          \(                                      \
           -name \*.sh -or                        \
           -name \*.orig -or                      \
-          -name \*rc -or                         \ # openrc files, etc
+          -name \*rc -or                         \
           -name functions\* -or                  \
-          -wholename \*/inc/\* -or               \ # /inc files and
-          -wholename \*/lib/\*                   \ # /lib files are shell, but
-         \)                                      \ #   have no extension
+          -wholename \*/inc/\* -or               \
+          -wholename \*/lib/\*                   \
+         \)                                      \
          -print0 | xargs -0 bashate -v -iE006 -eE005,E042"
 
 [testenv:docs]

From 512be7de181b1ede95e1d31dd67cd87b7d2d41e8 Mon Sep 17 00:00:00 2001
From: syed ahsan shamim zaidi <ahsanmohsin04@yahoo.com>
Date: Tue, 20 Oct 2015 21:20:27 +0000
Subject: [PATCH 0140/2409] docs: Add additional configuration in Neutron guide

Adding NETWORK_GATEWAY to the docs

Change-Id: I67be468d9fbe5f323e21c81b673248d4b629c8ef
Closes-Bug:#1508195
---
 doc/source/guides/neutron.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index 5891f68033..c7a1153608 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -215,6 +215,7 @@ controller node.
         ## Neutron Networking options used to create Neutron Subnets
 
         FIXED_RANGE="203.0.113.0/24"
+        NETWORK_GATEWAY=203.0.113.1
         PROVIDER_SUBNET_NAME="provider_net"
         PROVIDER_NETWORK_TYPE="vlan"
         SEGMENTATION_ID=2010

From 79e65304708605979589568ad3b2909482ee4496 Mon Sep 17 00:00:00 2001
From: Min Pae <sputnik13@gmail.com>
Date: Tue, 22 Dec 2015 10:31:03 -0800
Subject: [PATCH 0141/2409] Adding cue to plugin registry

Adding cue to the plugin registry under "Official OpenStack Projects"

Change-Id: I24fc76eb6aadb653c0db5a0fa1d8e22cd166dbe9
---
 doc/source/plugin-registry.rst | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index c68d926822..0740ba0eff 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -28,6 +28,8 @@ The following are plugins that exist for official OpenStack projects.
 +------------------+---------------------------------------------+--------------------+
 |congress          |git://git.openstack.org/openstack/congress   | governance         |
 +------------------+---------------------------------------------+--------------------+
+|cue               |git://git.openstack.org/openstack/cue        | message-broker     |
++------------------+---------------------------------------------+--------------------+
 |gnocchi           |git://git.openstack.org/openstack/gnocchi    | metric             |
 +------------------+---------------------------------------------+--------------------+
 |magnum            |git://git.openstack.org/openstack/magnum     |                    |

From ba23ba317abd6a65979b3006410eb4ba6429cf09 Mon Sep 17 00:00:00 2001
From: Andrey Pavlov <andrey-mp@yandex.ru>
Date: Tue, 22 Dec 2015 23:33:30 +0300
Subject: [PATCH 0142/2409] remove configuration for boto section

thirdparty.boto tests was removed from tempest and this section
is no needed more

Change-Id: Ibec0534d118423be7a51c2e2b82f1c61531503a0
---
 extras.d/80-tempest.sh |  1 -
 lib/tempest            | 63 ------------------------------------------
 2 files changed, 64 deletions(-)

diff --git a/extras.d/80-tempest.sh b/extras.d/80-tempest.sh
index 74f4c60d10..5e8da99a92 100644
--- a/extras.d/80-tempest.sh
+++ b/extras.d/80-tempest.sh
@@ -13,7 +13,6 @@ if is_service_enabled tempest; then
     elif [[ "$1" == "stack" && "$2" == "extra" ]]; then
         echo_summary "Initializing Tempest"
         configure_tempest
-        init_tempest
     elif [[ "$1" == "stack" && "$2" == "post-extra" ]]; then
         # local.conf Tempest option overrides
         :
diff --git a/lib/tempest b/lib/tempest
index 61351c0628..b2c4798af9 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -35,7 +35,6 @@
 #
 # - install_tempest
 # - configure_tempest
-# - init_tempest
 
 # Save trace setting
 _XTRACE_TEMPEST=$(set +o | grep xtrace)
@@ -67,9 +66,6 @@ BUILD_TIMEOUT=${BUILD_TIMEOUT:-196}
 # have tempest installed in DevStack by default.
 INSTALL_TEMPEST=${INSTALL_TEMPEST:-"True"}
 
-BOTO_MATERIALS_PATH="$FILES/images/s3-materials/cirros-${CIRROS_VERSION}"
-BOTO_CONF=/etc/boto.cfg
-
 # Cinder/Volume variables
 TEMPEST_VOLUME_DRIVER=${TEMPEST_VOLUME_DRIVER:-default}
 TEMPEST_DEFAULT_VOLUME_VENDOR="Open Source"
@@ -131,7 +127,6 @@ function configure_tempest {
     local flavor_lines
     local public_network_id
     local public_router_id
-    local boto_instance_type="m1.tiny"
     local ssh_connect_method="fixed"
 
     # Save IFS
@@ -202,14 +197,12 @@ function configure_tempest {
                 nova flavor-create m1.nano 42 64 0 1
             fi
             flavor_ref=42
-            boto_instance_type=m1.nano
             if [[ ! ( $available_flavors =~ 'm1.micro' ) ]]; then
                 nova flavor-create m1.micro 84 128 0 1
             fi
             flavor_ref_alt=84
         else
             # Check Nova for existing flavors, if ``DEFAULT_INSTANCE_TYPE`` is set use it.
-            boto_instance_type=$DEFAULT_INSTANCE_TYPE
             IFS=$'\r\n'
             flavors=""
             for line in $available_flavors; do
@@ -254,15 +247,6 @@ function configure_tempest {
             awk '{print $2}')
     fi
 
-    EC2_URL=$(get_endpoint_url ec2 public || true)
-    if [[ -z $EC2_URL ]]; then
-        EC2_URL="$EC2_SERVICE_PROTOCOL://$SERVICE_HOST:8773/"
-    fi
-    S3_URL=$(get_endpoint_url s3 public || true)
-    if [[ -z $S3_URL ]]; then
-        S3_URL="http://$SERVICE_HOST:${S3_SERVICE_PORT:-3333}"
-    fi
-
     iniset $TEMPEST_CONFIG DEFAULT use_syslog $SYSLOG
 
     # Oslo
@@ -275,8 +259,6 @@ function configure_tempest {
     # Timeouts
     iniset $TEMPEST_CONFIG compute build_timeout $BUILD_TIMEOUT
     iniset $TEMPEST_CONFIG volume build_timeout $BUILD_TIMEOUT
-    iniset $TEMPEST_CONFIG boto build_timeout $BUILD_TIMEOUT
-    iniset $TEMPEST_CONFIG boto http_socket_timeout 5
 
     # Identity
     iniset $TEMPEST_CONFIG identity uri "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:5000/v2.0/"
@@ -429,16 +411,6 @@ function configure_tempest {
     fi
     iniset $TEMPEST_CONFIG network-feature-enabled api_extensions $network_api_extensions
 
-    # boto
-    iniset $TEMPEST_CONFIG boto ec2_url "$EC2_URL"
-    iniset $TEMPEST_CONFIG boto s3_url "$S3_URL"
-    iniset $TEMPEST_CONFIG boto s3_materials_path "$BOTO_MATERIALS_PATH"
-    iniset $TEMPEST_CONFIG boto ari_manifest cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-initrd.manifest.xml
-    iniset $TEMPEST_CONFIG boto ami_manifest cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-blank.img.manifest.xml
-    iniset $TEMPEST_CONFIG boto aki_manifest cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-vmlinuz.manifest.xml
-    iniset $TEMPEST_CONFIG boto instance_type "$boto_instance_type"
-    iniset $TEMPEST_CONFIG boto http_socket_timeout 30
-
     # Orchestration Tests
     if is_service_enabled heat; then
         if [[ ! -z "$HEAT_CFN_IMAGE_URL" ]]; then
@@ -578,12 +550,6 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG service_available cinder "False"
     fi
 
-    if is_ssl_enabled_service "key" || is_service_enabled tls-proxy; then
-        # Use the ``BOTO_CONFIG`` environment variable to point to this file
-        iniset -sudo $BOTO_CONF Boto ca_certificates_file $SSL_BUNDLE_FILE
-        sudo chown $STACK_USER $BOTO_CONF
-    fi
-
     # Auth
     iniset $TEMPEST_CONFIG auth tempest_roles "Member"
     if [[ $TEMPEST_USE_TEST_ACCOUNTS == "True" ]]; then
@@ -645,35 +611,6 @@ function install_tempest {
     popd
 }
 
-# init_tempest() - Initialize EC2 images
-function init_tempest {
-    local base_image_name=cirros-${CIRROS_VERSION}-${CIRROS_ARCH}
-    # /opt/stack/devstack/files/images/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-uec
-    local image_dir="$FILES/images/${base_image_name}-uec"
-    local kernel="$image_dir/${base_image_name}-vmlinuz"
-    local ramdisk="$image_dir/${base_image_name}-initrd"
-    local disk_image="$image_dir/${base_image_name}-blank.img"
-    if is_service_enabled nova; then
-        # If the CirrOS uec downloaded and the system is UEC capable
-        if [ -f "$kernel" -a -f "$ramdisk" -a -f "$disk_image" -a  "$VIRT_DRIVER" != "openvz" \
-            -a \( "$LIBVIRT_TYPE" != "lxc" -o "$VIRT_DRIVER" != "libvirt" \) ]; then
-            echo "Prepare aki/ari/ami Images"
-            mkdir -p $BOTO_MATERIALS_PATH
-            ( #new namespace
-                # euca2ools should be installed to call euca-* commands
-                is_package_installed euca2ools || install_package euca2ools
-                # tenant:demo ; user: demo
-                source $TOP_DIR/accrc/demo/demo
-                euca-bundle-image -r ${CIRROS_ARCH} -i "$kernel" --kernel true -d "$BOTO_MATERIALS_PATH"
-                euca-bundle-image -r ${CIRROS_ARCH} -i "$ramdisk" --ramdisk true -d "$BOTO_MATERIALS_PATH"
-                euca-bundle-image -r ${CIRROS_ARCH} -i "$disk_image" -d "$BOTO_MATERIALS_PATH"
-            ) 2>&1 </dev/null | cat
-        else
-            echo "Boto materials are not prepared"
-        fi
-    fi
-}
-
 # Restore xtrace
 $_XTRACE_TEMPEST
 

From 50120fa047726c8ff9b76ef8bd9294bab0c7bb5d Mon Sep 17 00:00:00 2001
From: Li Ma <skywalker.nick@gmail.com>
Date: Sun, 13 Dec 2015 10:41:34 +0800
Subject: [PATCH 0143/2409] Kill neutron-rootwrap-daemon when stop neutron
 service

Neutron-rootwrap-daemon cannot be killed when you stop
neutron services, so here we add the right command in
the neutron stop-service scripts.

Change-Id: I91fefb277427e0e16ff59760b7255e4c7eee1792
Closes-Bug: #1525601
---
 lib/neutron-legacy | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 6af44e6ab8..47fa650953 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -780,6 +780,10 @@ function stop_neutron_other {
     if is_service_enabled q-metering; then
         neutron_metering_stop
     fi
+
+    if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
+        sudo pkill -9 -f $NEUTRON_ROOTWRAP-daemon || :
+    fi
 }
 
 # stop_neutron() - Stop running processes (non-screen)

From f7dc06cb892ca9d2918ae9bafba13bfa72a7da98 Mon Sep 17 00:00:00 2001
From: Hua Wang <wanghua.humble@gmail.com>
Date: Wed, 23 Dec 2015 12:15:59 +0800
Subject: [PATCH 0144/2409] Option "auth_plugin" is deprecated.

Option "auth_plugin" from group "keystone_authtoken" is deprecated.
Use option "auth_type" from group "keystone_authtoken".

Change-Id: I01371bd924114d6470e960a91a3045fe7dc22339
Closes-Bug: #1528746
---
 lib/keystone | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/keystone b/lib/keystone
index 6b4118de0b..60f86fe112 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -443,7 +443,7 @@ function configure_auth_token_middleware {
     local signing_dir=$3
     local section=${4:-keystone_authtoken}
 
-    iniset $conf_file $section auth_plugin password
+    iniset $conf_file $section auth_type password
     iniset $conf_file $section auth_url $KEYSTONE_AUTH_URI
     iniset $conf_file $section username $admin_user
     iniset $conf_file $section password $SERVICE_PASSWORD

From a6bbe031f17d82e2a4ef7338de65acb762e9527a Mon Sep 17 00:00:00 2001
From: Yuriy Nesenenko <ynesenenko@mirantis.com>
Date: Wed, 23 Dec 2015 16:00:02 +0200
Subject: [PATCH 0145/2409] Fix restoring a backup volume to a larger volume

We cannot restore a backup to a larger volume on ceph because it
fails with status "error_restoring". This patch adds read/write
permissions to volumes pool for backup user. We need such permissions
to change volume size during restoring backup when the backup is
smaller than a volume.

Change-Id: I794c1126bcee4e07baf5a9dcfee779fd61da5636
Closes-Bug: 1519749
---
 lib/cinder_backends/ceph | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/cinder_backends/ceph b/lib/cinder_backends/ceph
index c21350ba01..9bff5bef4f 100644
--- a/lib/cinder_backends/ceph
+++ b/lib/cinder_backends/ceph
@@ -62,7 +62,7 @@ function configure_cinder_backend_ceph {
                 sudo ceph -c ${CEPH_CONF_FILE} osd pool set ${CINDER_BAK_CEPH_POOL} crush_ruleset ${RULE_ID}
             fi
         fi
-        sudo ceph -c ${CEPH_CONF_FILE} auth get-or-create client.${CINDER_BAK_CEPH_USER} mon "allow r" osd "allow class-read object_prefix rbd_children, allow rwx pool=${CINDER_BAK_CEPH_POOL}" | sudo tee ${CEPH_CONF_DIR}/ceph.client.${CINDER_BAK_CEPH_USER}.keyring
+        sudo ceph -c ${CEPH_CONF_FILE} auth get-or-create client.${CINDER_BAK_CEPH_USER} mon "allow r" osd "allow class-read object_prefix rbd_children, allow rwx pool=${CINDER_BAK_CEPH_POOL}, allow rwx pool=${CINDER_CEPH_POOL}" | sudo tee ${CEPH_CONF_DIR}/ceph.client.${CINDER_BAK_CEPH_USER}.keyring
         sudo chown $(whoami):$(whoami) ${CEPH_CONF_DIR}/ceph.client.${CINDER_BAK_CEPH_USER}.keyring
 
         iniset $CINDER_CONF DEFAULT backup_driver "cinder.backup.drivers.ceph"

From 44ee7e307b49c5ee9e30ba380e36576189efdc34 Mon Sep 17 00:00:00 2001
From: liyingjun <liyingjun1988@gmail.com>
Date: Fri, 25 Dec 2015 10:32:14 +0800
Subject: [PATCH 0146/2409] Fix heat config when using keystone v3

Use configure_auth_token_middleware to generate keystone_authtoken
section configration.

Change-Id: I87e0e60afb958683add2aff2552d26cbf8c9e374
Closes-bug: #1300246
---
 lib/heat | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/lib/heat b/lib/heat
index 3666776317..c15bbe2b0b 100644
--- a/lib/heat
+++ b/lib/heat
@@ -150,12 +150,7 @@ function configure_heat {
         iniset $HEAT_CONF paste_deploy flavor standalone
         iniset $HEAT_CONF clients_heat url "http://$HEAT_API_HOST:$HEAT_API_PORT/v1/%(tenant_id)s"
     else
-        iniset $HEAT_CONF keystone_authtoken identity_uri $KEYSTONE_AUTH_URI
-        iniset $HEAT_CONF keystone_authtoken admin_user $HEAT_SERVICE_USER
-        iniset $HEAT_CONF keystone_authtoken admin_password $SERVICE_PASSWORD
-        iniset $HEAT_CONF keystone_authtoken admin_tenant_name $SERVICE_TENANT_NAME
-        iniset $HEAT_CONF keystone_authtoken cafile $SSL_BUNDLE_FILE
-        iniset $HEAT_CONF keystone_authtoken signing_dir $HEAT_AUTH_CACHE_DIR
+        configure_auth_token_middleware $HEAT_CONF heat $HEAT_AUTH_CACHE_DIR
     fi
 
     # If HEAT_DEFERRED_AUTH is unset or explicitly set to trusts, configure

From cc6af3fc94ea56b0f081eabcb65404b0fa3716fe Mon Sep 17 00:00:00 2001
From: Huan Xie <huan.xie@citrix.com>
Date: Wed, 23 Dec 2015 02:17:01 +0000
Subject: [PATCH 0147/2409] XenAPI: add support to use local.conf

XenServer install with devstack doesn't support local.conf, this fix
is to add support for using local.conf and backward-compatibility of
localrc

Change-Id: Ie494e01f8f1ecb8720e14392ef3f12d5a5a01dcd
Closes-Bug: #1528520
---
 inc/meta-config              | 19 +++++++++++++++++++
 stack.sh                     | 14 +-------------
 tools/xen/install_os_domU.sh | 11 ++++-------
 3 files changed, 24 insertions(+), 20 deletions(-)

diff --git a/inc/meta-config b/inc/meta-config
index b6fe437802..6eb7a00f69 100644
--- a/inc/meta-config
+++ b/inc/meta-config
@@ -195,6 +195,25 @@ function merge_config_group {
     done
 }
 
+function extract_localrc_section {
+    local configfile=$1    # top_dir/local.conf
+    local localrcfile=$2   # top_dir/localrc
+    local localautofile=$3 # top_dir/.localrc.auto
+
+    if [[ -r $configfile ]]; then
+        LRC=$(get_meta_section_files $configfile local)
+        for lfile in $LRC; do
+            if [[ "$lfile" == "localrc" ]]; then
+                if [[ -r $localrcfile ]]; then
+                    echo "localrc and local.conf:[[local]] both exist, using localrc"
+                else
+                    echo "# Generated file, do not edit" >$localautofile
+                    get_meta_section $configfile local $lfile >>$localautofile
+                fi
+            fi
+        done
+    fi
+}
 
 # Restore xtrace
 $_XTRACE_INC_META
diff --git a/stack.sh b/stack.sh
index 09ab4747f1..df893da57a 100755
--- a/stack.sh
+++ b/stack.sh
@@ -149,19 +149,7 @@ GetDistro
 
 # Phase: local
 rm -f $TOP_DIR/.localrc.auto
-if [[ -r $TOP_DIR/local.conf ]]; then
-    LRC=$(get_meta_section_files $TOP_DIR/local.conf local)
-    for lfile in $LRC; do
-        if [[ "$lfile" == "localrc" ]]; then
-            if [[ -r $TOP_DIR/localrc ]]; then
-                warn $LINENO "localrc and local.conf:[[local]] both exist, using localrc"
-            else
-                echo "# Generated file, do not edit" >$TOP_DIR/.localrc.auto
-                get_meta_section $TOP_DIR/local.conf local $lfile >>$TOP_DIR/.localrc.auto
-            fi
-        fi
-    done
-fi
+extract_localrc_section $TOP_DIR/local.conf $TOP_DIR/localrc $TOP_DIR/.localrc.auto
 
 # ``stack.sh`` is customizable by setting environment variables.  Override a
 # default setting via export::
diff --git a/tools/xen/install_os_domU.sh b/tools/xen/install_os_domU.sh
index e24d9ed0b9..46ff0b6fda 100755
--- a/tools/xen/install_os_domU.sh
+++ b/tools/xen/install_os_domU.sh
@@ -12,13 +12,6 @@ set -o xtrace
 
 export LC_ALL=C
 
-# Abort if localrc is not set
-if [ ! -e ../../localrc ]; then
-    echo "You must have a localrc with ALL necessary passwords defined before proceeding."
-    echo "See the xen README for required passwords."
-    exit 1
-fi
-
 # This directory
 THIS_DIR=$(cd $(dirname "$0") && pwd)
 
@@ -31,6 +24,10 @@ THIS_DIR=$(cd $(dirname "$0") && pwd)
 #
 # Get Settings
 #
+TOP_DIR=$(cd $THIS_DIR/../../ && pwd)
+source $TOP_DIR/inc/meta-config
+rm -f $TOP_DIR/.localrc.auto
+extract_localrc_section $TOP_DIR/local.conf $TOP_DIR/localrc $TOP_DIR/.localrc.auto
 
 # Source params - override xenrc params in your localrc to suit your taste
 source $THIS_DIR/xenrc

From 135bd484a9f83099e33e18dd97274ad550a392bb Mon Sep 17 00:00:00 2001
From: vsaienko <vsaienko@mirantis.com>
Date: Fri, 11 Dec 2015 11:03:52 +0200
Subject: [PATCH 0148/2409] Introduce iniget_sections function

This function returns list of sections from specified INI file.
It is needed for I7938f26015d953efdf720774b5ad2cee4068ac90.
'iniget_sections' is needed for automatic node enrollment to
Ironic from INI syntax file.

Change-Id: I52a69ad3bc8fc528e7f20e6b03a98f327acaaa74
Implements: blueprint ironic-ml2-integration
---
 inc/ini-config           | 12 ++++++++++++
 tests/test_ini_config.sh |  5 +++++
 2 files changed, 17 insertions(+)

diff --git a/inc/ini-config b/inc/ini-config
index d2830d79cd..e99b088994 100644
--- a/inc/ini-config
+++ b/inc/ini-config
@@ -261,6 +261,18 @@ function iniuncomment {
     $xtrace
 }
 
+# Get list of sections from an INI file
+# iniget_sections config-file
+function iniget_sections {
+    local xtrace
+    xtrace=$(set +o | grep xtrace)
+    set +o xtrace
+    local file=$1
+
+    echo $(sed -ne "s/^\[\(.*\)\]/\1/p" "$file")
+    $xtrace
+}
+
 # Restore xtrace
 $INC_CONF_TRACE
 
diff --git a/tests/test_ini_config.sh b/tests/test_ini_config.sh
index d9cb8d8a99..a5e110736e 100755
--- a/tests/test_ini_config.sh
+++ b/tests/test_ini_config.sh
@@ -80,6 +80,11 @@ if [ -n "$TEST_SUDO" ]; then
     sudo chown -R root:root ${INI_TMP_ETC_DIR}
 fi
 
+# test iniget_sections
+VAL=$(iniget_sections "${TEST_INI}")
+assert_equal "$VAL" "default aaa bbb ccc ddd eee del_separate_options \
+del_same_option del_missing_option del_missing_option_multi del_no_options"
+
 # Test with missing arguments
 BEFORE=$(cat ${TEST_INI})
 

From 5979f47a3df4e7662c70236e7ddf0bedcbe5ea25 Mon Sep 17 00:00:00 2001
From: Dmitry Tantsur <dtantsur@redhat.com>
Date: Sun, 3 Jan 2016 18:08:14 +0100
Subject: [PATCH 0149/2409] Fix get_plugin_packages when multiple plugins are
 in use

Due to missing space no plugin packages are installed in this case.

Change-Id: I56b105510e4d31a411f2531fdb20c4ddf1ebff20
Closes-Bug: #1530675
---
 functions-common | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index c3eef469d3..93c94896ef 100644
--- a/functions-common
+++ b/functions-common
@@ -1176,7 +1176,7 @@ function get_plugin_packages {
     local package_dir=""
     for plugin in ${DEVSTACK_PLUGINS//,/ }; do
         local package_dir="$(_get_package_dir ${GITDIR[$plugin]}/devstack/files)"
-        files_to_parse+="$package_dir/$plugin"
+        files_to_parse+=" $package_dir/$plugin"
     done
     echo "$(_parse_package_files $files_to_parse)"
     $xtrace

From 5bf6a9489c52600ab0fe5a68e554398531894051 Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Thu, 31 Dec 2015 16:22:04 -0600
Subject: [PATCH 0150/2409] Write volume API version into clouds.yaml

We're trying to get things to use volume v2 by default. devstack already
deploys a v2 endpoint. Tell clouds.yaml that this devstack cloud is a v2
enabled cloud.

Change-Id: I6f792ce65153389aa1ee133e9bd363c394b28534
Closes-Bug: 1467589
---
 tools/update_clouds_yaml.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/tools/update_clouds_yaml.py b/tools/update_clouds_yaml.py
index 3a364fe982..eb7265f76c 100755
--- a/tools/update_clouds_yaml.py
+++ b/tools/update_clouds_yaml.py
@@ -36,6 +36,7 @@ def __init__(self, args):
         self._cloud_data = {
             'region_name': args.os_region_name,
             'identity_api_version': args.os_identity_api_version,
+            'volume_api_version': args.os_volume_api_version,
             'auth': {
                 'auth_url': args.os_auth_url,
                 'username': args.os_username,
@@ -82,6 +83,7 @@ def main():
     parser.add_argument('--os-cloud', required=True)
     parser.add_argument('--os-region-name', default='RegionOne')
     parser.add_argument('--os-identity-api-version', default='3')
+    parser.add_argument('--os-volume-api-version', default='2')
     parser.add_argument('--os-cacert')
     parser.add_argument('--os-auth-url', required=True)
     parser.add_argument('--os-username', required=True)

From f73263d47a85f1fe6d1b80d10e85fe35a46aa8ef Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Fri, 25 Dec 2015 08:29:32 -0600
Subject: [PATCH 0151/2409] Remove uses of --os-url and --os-token

Those were originally used to bootstrap with admin-token from keystone,
but the openstack client is fully configured now, leaving no reason to
not just use the actual users that are there.

Change-Id: I80bdee33a78a97f5d3910aa36dc331f19780d2f1
---
 functions-common | 2 --
 1 file changed, 2 deletions(-)

diff --git a/functions-common b/functions-common
index e8f8b10f79..8a087317ec 100644
--- a/functions-common
+++ b/functions-common
@@ -975,8 +975,6 @@ function get_or_create_endpoint {
 function get_endpoint_url {
     echo $(openstack endpoint list \
             --service $1 --interface $2 \
-            --os-url $KEYSTONE_SERVICE_URI_V3 \
-            --os-identity-api-version=3 \
             -c URL -f value)
 }
 

From e208d060e17e2ad622c7b06cd90baed0eeed89f8 Mon Sep 17 00:00:00 2001
From: Federico Ressi <federico.ressi@intel.com>
Date: Sat, 21 Nov 2015 11:15:39 +0000
Subject: [PATCH 0152/2409] Preserve result returned by apt-get and pip

Change I855ffe9c7a75e9943106af0f70cf715c34ae25c5 and
I368fec44858bd97fc6a314fb20eed2b10932cbb1 added timing
infrastructure which hides the return value of
the main commands.  Restore the prior behaviour.

Change-Id: I4a536abefa7824ac6d42e7bbbf1079d9cc055984
Closes-Bug: #1518545
---
 functions-common | 4 +++-
 inc/python       | 7 +++++--
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/functions-common b/functions-common
index 4a9db34119..486dcc5d59 100644
--- a/functions-common
+++ b/functions-common
@@ -1045,7 +1045,7 @@ function apt_get_update {
 # Uses globals ``OFFLINE``, ``*_proxy``
 # apt_get operation package [package ...]
 function apt_get {
-    local xtrace
+    local xtrace result
     xtrace=$(set +o | grep xtrace)
     set +o xtrace
 
@@ -1062,9 +1062,11 @@ function apt_get {
         http_proxy=${http_proxy:-} https_proxy=${https_proxy:-} \
         no_proxy=${no_proxy:-} \
         apt-get --option "Dpkg::Options::=--force-confold" --assume-yes "$@"
+    result=$?
 
     # stop the clock
     time_stop "apt-get"
+    return $result
 }
 
 function _parse_package_files {
diff --git a/inc/python b/inc/python
index c157604699..f4f65fd2e8 100644
--- a/inc/python
+++ b/inc/python
@@ -81,7 +81,7 @@ function get_python_versions_for_package {
 # ``PIP_UPGRADE``, ``TRACK_DEPENDS``, ``*_proxy``,
 # pip_install package [package ...]
 function pip_install {
-    local xtrace
+    local xtrace result
     xtrace=$(set +o | grep xtrace)
     set +o xtrace
     local upgrade=""
@@ -155,10 +155,11 @@ function pip_install {
         PIP_FIND_LINKS=$PIP_FIND_LINKS \
         $cmd_pip $upgrade \
         $@
+    result=$?
 
     # Also install test requirements
     local test_req="${!#}/test-requirements.txt"
-    if [[ -e "$test_req" ]]; then
+    if [[ $result == 0 ]] && [[ -e "$test_req" ]]; then
         echo "Installing test-requirements for $test_req"
         $sudo_pip \
             http_proxy=${http_proxy:-} \
@@ -167,9 +168,11 @@ function pip_install {
             PIP_FIND_LINKS=$PIP_FIND_LINKS \
             $cmd_pip $upgrade \
             -r $test_req
+        result=$?
     fi
 
     time_stop "pip_install"
+    return $result
 }
 
 # get version of a package from global requirements file

From 90bc5867728aafb66b374ae6e6a93318303dcff0 Mon Sep 17 00:00:00 2001
From: Kashyap Chamarthy <kchamart@redhat.com>
Date: Tue, 1 Dec 2015 18:04:40 +0100
Subject: [PATCH 0153/2409] Remove support for Fedora 21 (EOL); add F22 where
 appropriate

Fedora 21 reached its End Of Life (EOL) on 1-DEC-2015[1]; remove it as
supported distribution.

    - stack.sh: Remove Fedora 21 from list of supported distributions.
    - tools/fixup_stuff.sh: Make the minimum Fedora version to be F22 in
      from a conditional check in 'Python packages' section
    - files/rpms/general: Remove 'f21' from NOPRIME.
    - lib/ceph: Remove 'f21' from the check_os_support_ceph() function.
    - doc/source/index.rst: s/Fedora 21/Fedora 22/
    - pkg/elasticsearch.sh: Remove the 'if' conditional in the
      install_elasticsearch() function.

[1] https://fedoramagazine.org/fedora-21-end-life-december-1st/

Change-Id: Ifbcc3dd783ff2f362a464fbf4ca22f20cc2c658e
---
 doc/source/index.rst | 2 +-
 files/rpms/general   | 6 +++---
 files/rpms/nova      | 2 +-
 lib/ceph             | 2 +-
 pkg/elasticsearch.sh | 1 -
 stack.sh             | 2 +-
 tools/fixup_stuff.sh | 2 +-
 7 files changed, 8 insertions(+), 9 deletions(-)

diff --git a/doc/source/index.rst b/doc/source/index.rst
index 2622436820..4a1d93d817 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -20,7 +20,7 @@ Quick Start
 
 #. Select a Linux Distribution
 
-   Only Ubuntu 14.04 (Trusty), Fedora 21 (or Fedora 22) and CentOS/RHEL
+   Only Ubuntu 14.04 (Trusty), Fedora 22 (or Fedora 23) and CentOS/RHEL
    7 are documented here. OpenStack also runs and is packaged on other
    flavors of Linux such as OpenSUSE and Debian.
 
diff --git a/files/rpms/general b/files/rpms/general
index 280468283b..5bc87b6172 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -8,9 +8,9 @@ gcc-c++
 gettext  # used for compiling message catalogs
 git-core
 graphviz # needed only for docs
-iptables-services  # NOPRIME f21,f22,f23
+iptables-services  # NOPRIME f22,f23
 java-1.7.0-openjdk-headless  # NOPRIME rhel7
-java-1.8.0-openjdk-headless  # NOPRIME f21,f22,f23
+java-1.8.0-openjdk-headless  # NOPRIME f22,f23
 libffi-devel
 libjpeg-turbo-devel # Pillow 3.0.0
 libxml2-devel # lxml
@@ -26,7 +26,7 @@ postgresql-devel  # psycopg2
 psmisc
 pyOpenSSL # version in pip uses too much memory
 python-devel
-redhat-rpm-config # MySQL-python rhbz-1195207 f21
+redhat-rpm-config # MySQL-python rhbz-1195207
 screen
 tar
 tcpdump
diff --git a/files/rpms/nova b/files/rpms/nova
index 4db9a06d95..0312e856dd 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -7,7 +7,7 @@ gawk
 genisoimage # required for config_drive
 iptables
 iputils
-kernel-modules # dist:f21,f22,f23
+kernel-modules # dist:f22,f23
 kpartx
 kvm # NOPRIME
 libvirt-bin # NOPRIME
diff --git a/lib/ceph b/lib/ceph
index 4ac498ab97..3e0839aaa2 100644
--- a/lib/ceph
+++ b/lib/ceph
@@ -116,7 +116,7 @@ function undefine_virsh_secret {
 
 # check_os_support_ceph() - Check if the operating system provides a decent version of Ceph
 function check_os_support_ceph {
-    if [[ ! ${DISTRO} =~ (trusty|f21|f22|f23) ]]; then
+    if [[ ! ${DISTRO} =~ (trusty|f22|f23) ]]; then
         echo "WARNING: your distro $DISTRO does not provide (at least) the Firefly release. Please use Ubuntu Trusty or Fedora 20 (and higher)"
         if [[ "$FORCE_CEPH_INSTALL" != "yes" ]]; then
             die $LINENO "If you wish to install Ceph on this distribution anyway run with FORCE_CEPH_INSTALL=yes"
diff --git a/pkg/elasticsearch.sh b/pkg/elasticsearch.sh
index 14d13cf733..7488306845 100755
--- a/pkg/elasticsearch.sh
+++ b/pkg/elasticsearch.sh
@@ -88,7 +88,6 @@ function install_elasticsearch {
         sudo dpkg -i ${FILES}/elasticsearch-${ELASTICSEARCH_VERSION}.deb
         sudo update-rc.d elasticsearch defaults 95 10
     elif is_fedora; then
-        if [[ "$os_RELEASE" -ge "21" ]]; then
             is_package_installed java-1.8.0-openjdk-headless || install_package java-1.8.0-openjdk-headless
         else
             is_package_installed java-1.7.0-openjdk-headless || install_package java-1.7.0-openjdk-headless
diff --git a/stack.sh b/stack.sh
index bc67ce069c..b5dc51c6ec 100755
--- a/stack.sh
+++ b/stack.sh
@@ -195,7 +195,7 @@ source $TOP_DIR/stackrc
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (trusty|vivid|wily|7.0|wheezy|sid|testing|jessie|f21|f22|f23|rhel7) ]]; then
+if [[ ! ${DISTRO} =~ (trusty|vivid|wily|7.0|wheezy|sid|testing|jessie|f22|f23|rhel7) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"
diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index 9ae2ae7d90..193a1f7aba 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -135,7 +135,7 @@ if is_fedora; then
         fi
     fi
 
-    if  [[ "$os_VENDOR" == "Fedora" ]] && [[ "$os_RELEASE" -ge "21" ]]; then
+    if  [[ "$os_VENDOR" == "Fedora" ]] && [[ "$os_RELEASE" -ge "22" ]]; then
         # requests ships vendored version of chardet/urllib3, but on
         # fedora these are symlinked back to the primary versions to
         # avoid duplication of code on disk.  This is fine when

From 0842b8147f098106b679cf652edbcb5ea4330f04 Mon Sep 17 00:00:00 2001
From: Brant Knudson <bknudson@us.ibm.com>
Date: Mon, 3 Aug 2015 13:31:25 -0500
Subject: [PATCH 0154/2409] Support extra dependencies when setup_develop

Recent pip supports using [extras] to install extra dependencies
from the project setup.cfg. Add support so that projects can take
advantage of it.

For example, if devstack is configured to use ldap, install the
extra ldap dependencies using:

 setup_develop $KEYSTONE_DIR ldap

Partial-Bug: 1479962
Change-Id: Ic13d95b99aaa4d3854b2723343e90f5de6b98aa2
---
 inc/python | 56 +++++++++++++++++++++++++++++++++++++++++++++++-------
 1 file changed, 49 insertions(+), 7 deletions(-)

diff --git a/inc/python b/inc/python
index c157604699..2bf426489d 100644
--- a/inc/python
+++ b/inc/python
@@ -239,15 +239,31 @@ function setup_dev_lib {
 
 # this should be used if you want to install globally, all libraries should
 # use this, especially *oslo* ones
+#
+# setup_install project_dir [extras]
+# project_dir: directory of project repo (e.g., /opt/stack/keystone)
+# extras: comma-separated list of optional dependencies to install
+#         (e.g., ldap,memcache).
+#         See http://docs.openstack.org/developer/pbr/#extra-requirements
+# The command is like "pip install <project_dir>[<extras>]"
 function setup_install {
     local project_dir=$1
-    setup_package_with_constraints_edit $project_dir
+    local extras=$2
+    _setup_package_with_constraints_edit $project_dir "" $extras
 }
 
 # this should be used for projects which run services, like all services
+#
+# setup_develop project_dir [extras]
+# project_dir: directory of project repo (e.g., /opt/stack/keystone)
+# extras: comma-separated list of optional dependencies to install
+#         (e.g., ldap,memcache).
+#         See http://docs.openstack.org/developer/pbr/#extra-requirements
+# The command is like "pip install -e <project_dir>[<extras>]"
 function setup_develop {
     local project_dir=$1
-    setup_package_with_constraints_edit $project_dir -e
+    local extras=$2
+    _setup_package_with_constraints_edit $project_dir -e $extras
 }
 
 # determine if a project as specified by directory is in
@@ -269,10 +285,17 @@ function is_in_projects_txt {
 # install this package we get the from source version.
 #
 # Uses globals ``REQUIREMENTS_DIR``
-# setup_develop directory
-function setup_package_with_constraints_edit {
+# _setup_package_with_constraints_edit project_dir flags [extras]
+# project_dir: directory of project repo (e.g., /opt/stack/keystone)
+# flags: pip CLI options/flags
+# extras: comma-separated list of optional dependencies to install
+#         (e.g., ldap,memcache).
+#         See http://docs.openstack.org/developer/pbr/#extra-requirements
+# The command is like "pip install <flags> <project_dir>[<extras>]"
+function _setup_package_with_constraints_edit {
     local project_dir=$1
     local flags=$2
+    local extras=$3
 
     if [ -n "$REQUIREMENTS_DIR" ]; then
         # Constrain this package to this project directory from here on out.
@@ -283,19 +306,38 @@ function setup_package_with_constraints_edit {
             "$flags file://$project_dir#egg=$name"
     fi
 
-    setup_package $project_dir $flags
+    setup_package $project_dir "$flags" $extras
 
 }
 
 # ``pip install -e`` the package, which processes the dependencies
 # using pip before running `setup.py develop`
+#
 # Uses globals ``STACK_USER``
-# setup_develop_no_requirements_update directory
+# setup_package project_dir [flags] [extras]
+# project_dir: directory of project repo (e.g., /opt/stack/keystone)
+# flags: pip CLI options/flags
+# extras: comma-separated list of optional dependencies to install
+#         (e.g., ldap,memcache).
+#         See http://docs.openstack.org/developer/pbr/#extra-requirements
+# The command is like "pip install <flags> <project_dir>[<extras>]"
 function setup_package {
     local project_dir=$1
     local flags=$2
+    local extras=$3
+
+    # if the flags variable exists, and it doesn't look like a flag,
+    # assume it's actually the extras list.
+    if [[ -n "$flags" && -z "$extras" && ! "$flags" =~ ^-.* ]]; then
+        extras=$flags
+        flags=""
+    fi
+
+    if [[ ! -z "$extras" ]]; then
+        extras="[$extras]"
+    fi
 
-    pip_install $flags $project_dir
+    pip_install $flags "$project_dir$extras"
     # ensure that further actions can do things like setup.py sdist
     if [[ "$flags" == "-e" ]]; then
         safe_chown -R $STACK_USER $1/*.egg-info

From 6a4d3eb55fb377a0ddef3d8978a85d2137430834 Mon Sep 17 00:00:00 2001
From: Brant Knudson <bknudson@us.ibm.com>
Date: Sat, 1 Aug 2015 09:19:18 -0500
Subject: [PATCH 0155/2409] Use keystone[ldap] for ldap packages

Keystone now provides an "ldap" in extras to install its ldap
dependencies so devstack doesn't have to track the python
dependencies itself.

Installation of the extras is done in an extra install line. This is
slightly redundant, however this pattern works much better from an
install stand point as it supports an arbitrarily large number of
extras.

Partial-Bug: 1479962
Change-Id: If0f0ff48f3d6b3c414f2d6fcd747ecf45a397658
---
 lib/keystone | 5 +++++
 lib/ldap     | 2 --
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index b4b7df9a30..f7736147a7 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -506,6 +506,11 @@ function install_keystone {
     fi
     git_clone $KEYSTONE_REPO $KEYSTONE_DIR $KEYSTONE_BRANCH
     setup_develop $KEYSTONE_DIR
+
+    if is_service_enabled ldap; then
+        setup_develop $KEYSTONE_DIR ldap
+    fi
+
     if [ "$KEYSTONE_USE_MOD_WSGI" == "True" ]; then
         install_apache_wsgi
         if is_ssl_enabled_service "key"; then
diff --git a/lib/ldap b/lib/ldap
index 65056aea2f..4cea812d3c 100644
--- a/lib/ldap
+++ b/lib/ldap
@@ -145,8 +145,6 @@ function install_ldap {
         sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif
     fi
 
-    pip_install_gr ldappool
-
     rm -rf $tmp_ldap_dir
 }
 

From f212622cbd8165caba640625159d35dd2fcde38f Mon Sep 17 00:00:00 2001
From: henriquetruta <henrique@lsd.ufcg.edu.br>
Date: Tue, 5 Jan 2016 13:43:18 -0300
Subject: [PATCH 0156/2409] Adding ENABLE_IDENTITY_V2 on docs

Adds the documentation of ENABLE_IDENTITY_V2 property on keystone
section.

Change-Id: If72325751c3bfd7f11f46c518c9fbf59f10a894f
---
 doc/source/configuration.rst | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 386fbbbf71..48c08dd557 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -644,8 +644,18 @@ In RegionOne:
 In RegionTwo:
 
 ::
-   
+
     disable_service horizon
     KEYSTONE_SERVICE_HOST=<KEYSTONE_IP_ADDRESS_FROM_REGION_ONE>
     KEYSTONE_AUTH_HOST=<KEYSTONE_IP_ADDRESS_FROM_REGION_ONE>
     REGION_NAME=RegionTwo
+
+Disabling Identity API v2
++++++++++++++++++++++++++
+
+The Identity API v2 is deprecated as of Mitaka and it is recommended to only
+use the v3 API. It is possible to setup keystone without v2 API, by doing:
+
+::
+
+    ENABLE_IDENTITY_V2=False

From a0d1b0151a9d9e169e6342f36a073e8154119924 Mon Sep 17 00:00:00 2001
From: Brian Haley <brian.haley@hpe.com>
Date: Mon, 16 Nov 2015 17:30:48 -0500
Subject: [PATCH 0157/2409] Delete OVS port on unstack to retain system
 connectivity

If you configure devstack with the following three values,
for example:

PHYSICAL_NETWORK=eth0
PUBLIC_INTERFACE=eth0
OVS_PHYSICAL_BRIDGE=br-eth0

This will cause devstack to create an OVS bridge, create a port for
eth0, and add it to the bridge (along with it's IP address).

The problem is that on unstack the port is never deleted from OVS,
so eth0 gets "trapped", not showing up in any of the OVS commands,
but not usable by the system.  The only workaround is to unload the
OVS kernel module.

There needs to be an 'ovs-vsctl del-port ...' call at the end of
_move_neutron_addresses_route() on unstack - the antidote to the
'ovs-vsctl add-port ...', that happened on stack.

Closes-Bug: #1516801

Change-Id: Id2ff60f1f8e8fffff1eaffd68d9de4f6aa772943
---
 lib/neutron-legacy | 20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index cc5b75e2b9..b8fce2833a 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -802,7 +802,8 @@ function _move_neutron_addresses_route {
     local from_intf=$1
     local to_intf=$2
     local add_ovs_port=$3
-    local af=$4
+    local del_ovs_port=$4
+    local af=$5
 
     if [[ -n "$from_intf" && -n "$to_intf" ]]; then
         # Remove the primary IP address from $from_intf and add it to $to_intf,
@@ -816,6 +817,7 @@ function _move_neutron_addresses_route {
         local DEFAULT_ROUTE_GW
         DEFAULT_ROUTE_GW=$(ip -f $af r | awk "/default.+$from_intf/ { print \$3; exit }")
         local ADD_OVS_PORT=""
+        local DEL_OVS_PORT=""
 
         IP_BRD=$(ip -f $af a s dev $from_intf scope global primary | grep inet | awk '{ print $2, $3, $4; exit }')
 
@@ -827,13 +829,19 @@ function _move_neutron_addresses_route {
             ADD_OVS_PORT="sudo ovs-vsctl --may-exist add-port $to_intf $from_intf"
         fi
 
+        if [[ "$del_ovs_port" == "True" ]]; then
+            DEL_OVS_PORT="sudo ovs-vsctl --if-exists del-port $from_intf $to_intf"
+        fi
+
         if [[ "$IP_BRD" != "" ]]; then
             IP_DEL="sudo ip addr del $IP_BRD dev $from_intf"
             IP_ADD="sudo ip addr add $IP_BRD dev $to_intf"
             IP_UP="sudo ip link set $to_intf up"
         fi
 
-        $IP_DEL; $IP_ADD; $IP_UP; $ADD_OVS_PORT; $ADD_DEFAULT_ROUTE
+        # The add/del OVS port calls have to happen either before or
+        # after the address is moved in order to not leave it orphaned.
+        $DEL_OVS_PORT; $IP_DEL; $IP_ADD; $IP_UP; $ADD_OVS_PORT; $ADD_DEFAULT_ROUTE
     fi
 }
 
@@ -842,14 +850,14 @@ function _move_neutron_addresses_route {
 function cleanup_neutron {
 
     if [[ -n "$OVS_PHYSICAL_BRIDGE" ]]; then
-        _move_neutron_addresses_route "$OVS_PHYSICAL_BRIDGE" "$PUBLIC_INTERFACE" False "inet"
+        _move_neutron_addresses_route "$OVS_PHYSICAL_BRIDGE" "$PUBLIC_INTERFACE" False True "inet"
 
         if [[ $(ip -f inet6 a s dev "$OVS_PHYSICAL_BRIDGE" | grep -c 'global') != 0 ]]; then
             # ip(8) wants the prefix length when deleting
             local v6_gateway
             v6_gateway=$(ip -6 a s dev $OVS_PHYSICAL_BRIDGE | grep $IPV6_PUBLIC_NETWORK_GATEWAY | awk '{ print $2 }')
             sudo ip -6 addr del $v6_gateway dev $OVS_PHYSICAL_BRIDGE
-            _move_neutron_addresses_route "$OVS_PHYSICAL_BRIDGE" "$PUBLIC_INTERFACE" False "inet6"
+            _move_neutron_addresses_route "$OVS_PHYSICAL_BRIDGE" "$PUBLIC_INTERFACE" False False "inet6"
         fi
 
         if is_provider_network && is_ironic_hardware; then
@@ -1044,10 +1052,10 @@ function _configure_neutron_l3_agent {
 
     neutron_plugin_configure_l3_agent
 
-    _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" True "inet"
+    _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" True False "inet"
 
     if [[ $(ip -f inet6 a s dev "$PUBLIC_INTERFACE" | grep -c 'global') != 0 ]]; then
-        _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" False "inet6"
+        _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" False False "inet6"
     fi
 }
 

From e0d61118f198e6a46af0956902485098f78e8d26 Mon Sep 17 00:00:00 2001
From: Ken'ichi Ohmichi <ken-oomichi@wx.jp.nec.com>
Date: Thu, 17 Dec 2015 08:47:46 +0000
Subject: [PATCH 0158/2409] Enable SameHostFilter and DifferentHostFilter

The default filters of nova don't contain SameHostFilter and
DifferentHostFilter, so we cannot test them on the gate.
This patch makes these filters available for the development.

Change-Id: Ia6b4847e9bb21048d254d0a460ae4c5be896b17b
Closes-Bug: #1526620
---
 lib/nova | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/lib/nova b/lib/nova
index 6337f875ef..bb4b4a1cd2 100644
--- a/lib/nova
+++ b/lib/nova
@@ -98,6 +98,10 @@ FORCE_CONFIG_DRIVE=${FORCE_CONFIG_DRIVE:-"True"}
 # should work in most cases.
 SCHEDULER=${SCHEDULER:-nova.scheduler.filter_scheduler.FilterScheduler}
 
+# The following FILTERS contains SameHostFilter and DifferentHostFilter with
+# the default filters.
+FILTERS="RetryFilter,AvailabilityZoneFilter,RamFilter,DiskFilter,ComputeFilter,ComputeCapabilitiesFilter,ImagePropertiesFilter,ServerGroupAntiAffinityFilter,ServerGroupAffinityFilter,SameHostFilter,DifferentHostFilter"
+
 QEMU_CONF=/etc/libvirt/qemu.conf
 
 # Set default defaults here as some hypervisor drivers override these
@@ -507,6 +511,7 @@ function create_nova_conf {
     iniset $NOVA_CONF DEFAULT api_paste_config "$NOVA_API_PASTE_INI"
     iniset $NOVA_CONF DEFAULT rootwrap_config "$NOVA_CONF_DIR/rootwrap.conf"
     iniset $NOVA_CONF DEFAULT scheduler_driver "$SCHEDULER"
+    iniset $NOVA_CONF DEFAULT scheduler_default_filters "$FILTERS"
     iniset $NOVA_CONF DEFAULT dhcpbridge_flagfile "$NOVA_CONF"
     iniset $NOVA_CONF DEFAULT force_dhcp_release "True"
     iniset $NOVA_CONF DEFAULT default_floating_pool "$PUBLIC_NETWORK_NAME"

From 3526276a0827afb5a598c046e410b88bcb8f2e65 Mon Sep 17 00:00:00 2001
From: Steve Martinelli <stevemar@ca.ibm.com>
Date: Tue, 5 Jan 2016 23:56:40 -0500
Subject: [PATCH 0159/2409] Add support for role and resource keystone backends

Keystone further broken apart the assignment backend into: role,
resource, and assignment. We should define the backends in the
config file and allow users to override the default by passing in
their own value.

Change-Id: Ieb22c428609d3db852814c7eceb77efa6bbde633
---
 lib/keystone | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/lib/keystone b/lib/keystone
index b4b7df9a30..0c2722c526 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -68,6 +68,12 @@ KEYSTONE_IDENTITY_BACKEND=${KEYSTONE_IDENTITY_BACKEND:-sql}
 # Select the Assignment backend driver
 KEYSTONE_ASSIGNMENT_BACKEND=${KEYSTONE_ASSIGNMENT_BACKEND:-sql}
 
+# Select the Role backend driver
+KEYSTONE_ROLE_BACKEND=${KEYSTONE_ROLE_BACKEND:-sql}
+
+# Select the Resource backend driver
+KEYSTONE_RESOURCE_BACKEND=${KEYSTONE_RESOURCE_BACKEND:-sql}
+
 # Select Keystone's token provider (and format)
 # Choose from 'uuid', 'pki', 'pkiz', or 'fernet'
 KEYSTONE_TOKEN_FORMAT=${KEYSTONE_TOKEN_FORMAT:-}
@@ -209,6 +215,8 @@ function configure_keystone {
 
     iniset $KEYSTONE_CONF identity driver "$KEYSTONE_IDENTITY_BACKEND"
     iniset $KEYSTONE_CONF assignment driver "$KEYSTONE_ASSIGNMENT_BACKEND"
+    iniset $KEYSTONE_CONF role driver "$KEYSTONE_ROLE_BACKEND"
+    iniset $KEYSTONE_CONF resource driver "$KEYSTONE_RESOURCE_BACKEND"
 
     iniset_rpc_backend keystone $KEYSTONE_CONF
 

From 3809defb2e3e66b7b9ad1cd9a827c14ba16f8ce7 Mon Sep 17 00:00:00 2001
From: Federico Ressi <federico.ressi@intel.com>
Date: Wed, 6 Jan 2016 08:19:24 +0000
Subject: [PATCH 0160/2409] Fix elastic search support for Fedora.

Change Ifbcc3dd783ff2f362a464fbf4ca22f20cc2c658e broken it [1]

[1] https://review.openstack.org/#/c/251980/2/pkg/elasticsearch.sh

Change-Id: I330498cd490f3af2e9a569d86e8639a03b48dd17
Closes-Bug: #1531424
---
 pkg/elasticsearch.sh | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/pkg/elasticsearch.sh b/pkg/elasticsearch.sh
index 7488306845..9c4f6f7801 100755
--- a/pkg/elasticsearch.sh
+++ b/pkg/elasticsearch.sh
@@ -88,10 +88,7 @@ function install_elasticsearch {
         sudo dpkg -i ${FILES}/elasticsearch-${ELASTICSEARCH_VERSION}.deb
         sudo update-rc.d elasticsearch defaults 95 10
     elif is_fedora; then
-            is_package_installed java-1.8.0-openjdk-headless || install_package java-1.8.0-openjdk-headless
-        else
-            is_package_installed java-1.7.0-openjdk-headless || install_package java-1.7.0-openjdk-headless
-        fi
+        is_package_installed java-1.8.0-openjdk-headless || install_package java-1.8.0-openjdk-headless
         yum_install ${FILES}/elasticsearch-${ELASTICSEARCH_VERSION}.noarch.rpm
         sudo /bin/systemctl daemon-reload
         sudo /bin/systemctl enable elasticsearch.service

From 4d8c03a377dbb819f28d199fe9fca7e4b576e7e3 Mon Sep 17 00:00:00 2001
From: Zhang Jinnan <zhang.jinnan@99cloud.net>
Date: Thu, 20 Aug 2015 10:00:20 -0400
Subject: [PATCH 0161/2409] Enable some serivce when on boot

Solve the devstack ./rejoin-stack.sh when is reboot-safe in RHEL 7.
Enable mysql, postgresql, rabbitmq-server, openvswitch service when on boot.

Change-Id: I3ce9fc58ccc76092ad08314de1c3c9339ebfb3b5
Related-Bug: #1486833
---
 lib/databases/mysql          | 1 +
 lib/databases/postgresql     | 3 +++
 lib/neutron_plugins/ovs_base | 1 +
 lib/rpc_backend              | 3 +++
 4 files changed, 8 insertions(+)

diff --git a/lib/databases/mysql b/lib/databases/mysql
index c2ab32e5b2..510da7541a 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -154,6 +154,7 @@ EOF
         fi
     elif is_fedora; then
         install_package mariadb-server
+        sudo systemctl enable mariadb
     elif is_ubuntu; then
         install_package mysql-server
     else
diff --git a/lib/databases/postgresql b/lib/databases/postgresql
index 78c7bedc90..261574f256 100644
--- a/lib/databases/postgresql
+++ b/lib/databases/postgresql
@@ -101,6 +101,9 @@ EOF
         install_package postgresql
     elif is_fedora || is_suse; then
         install_package postgresql-server
+        if is_fedora; then
+            sudo systemctl enable postgresql-server
+        fi
     else
         exit_distro_not_supported "postgresql installation"
     fi
diff --git a/lib/neutron_plugins/ovs_base b/lib/neutron_plugins/ovs_base
index b012683a6f..849d0b744b 100644
--- a/lib/neutron_plugins/ovs_base
+++ b/lib/neutron_plugins/ovs_base
@@ -65,6 +65,7 @@ function _neutron_ovs_base_install_agent_packages {
         restart_service openvswitch-switch
     elif is_fedora; then
         restart_service openvswitch
+        sudo systemctl enable openvswitch
     elif is_suse; then
         restart_service openvswitch-switch
     fi
diff --git a/lib/rpc_backend b/lib/rpc_backend
index 03eacd8674..2e1c89713c 100644
--- a/lib/rpc_backend
+++ b/lib/rpc_backend
@@ -48,6 +48,9 @@ function install_rpc_backend {
         # Install rabbitmq-server
         install_package rabbitmq-server
     fi
+    if is_fedora; then
+        sudo systemctl enable rabbitmq-server
+    fi
 }
 
 # restart the rpc backend

From a5ea08b7526bee0d9cab51000a477654726de8fe Mon Sep 17 00:00:00 2001
From: Alexander Schmidt <alexs@linux.vnet.ibm.com>
Date: Wed, 2 Dec 2015 15:30:44 +0000
Subject: [PATCH 0162/2409] Add distro support for KVM for IBM z Systems

Add "KVM for IBM z Systems" to the list of Fedora-like distros.

As the distribution does not have a dedicated kvm package,
prevent the installation of the kvm package during the libvirt
setup.

Change-Id: Ibb5c60797d6867264f9dea7fea85cdf1d7c72ded
---
 functions-common                   | 4 +++-
 lib/nova_plugins/functions-libvirt | 5 ++++-
 stack.sh                           | 2 +-
 3 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/functions-common b/functions-common
index a150dc5841..e2ebd53839 100644
--- a/functions-common
+++ b/functions-common
@@ -410,6 +410,8 @@ function GetDistro {
         DISTRO="rhel${os_RELEASE::1}"
     elif [[ "$os_VENDOR" =~ (XenServer) ]]; then
         DISTRO="xs$os_RELEASE"
+    elif [[ "$os_VENDOR" =~ (kvmibm) ]]; then
+        DISTRO="${os_VENDOR}${os_RELEASE::1}"
     else
         # Catch-all for now is Vendor + Release + Update
         DISTRO="$os_VENDOR-$os_RELEASE.$os_UPDATE"
@@ -444,7 +446,7 @@ function is_fedora {
 
     [ "$os_VENDOR" = "Fedora" ] || [ "$os_VENDOR" = "Red Hat" ] || \
         [ "$os_VENDOR" = "CentOS" ] || [ "$os_VENDOR" = "OracleLinux" ] || \
-        [ "$os_VENDOR" = "CloudLinux" ]
+        [ "$os_VENDOR" = "CloudLinux" ] || [ "$os_VENDOR" = "kvmibm" ]
 }
 
 
diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index dae55c6eba..0afdad821f 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -38,7 +38,10 @@ function install_libvirt {
         fi
         #pip_install_gr <there-si-no-guestfs-in-pypi>
     elif is_fedora || is_suse; then
-        install_package kvm
+        # On "KVM for IBM z Systems", kvm does not have its own package
+        if [[ ! ${DISTRO} =~ "kvmibm1" ]]; then
+            install_package kvm
+        fi
         # there is a dependency issue with kvm (which is really just a
         # wrapper to qemu-system-x86) that leaves some bios files out,
         # so install qemu-kvm (which shouldn't strictly be needed, as
diff --git a/stack.sh b/stack.sh
index 90481e09a6..1fa506c52d 100755
--- a/stack.sh
+++ b/stack.sh
@@ -183,7 +183,7 @@ source $TOP_DIR/stackrc
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (trusty|vivid|wily|7.0|wheezy|sid|testing|jessie|f22|f23|rhel7) ]]; then
+if [[ ! ${DISTRO} =~ (trusty|vivid|wily|7.0|wheezy|sid|testing|jessie|f22|f23|rhel7|kvmibm1) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From a263e7dd52f65e92e6fc0a09ec89509904f83d6b Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Thu, 7 Jan 2016 19:40:44 +0100
Subject: [PATCH 0163/2409] lib/cinder:configure tgt even if the package was
 purged

On Ubuntu, after a successful ./stack.sh and ./unstack.sh, if one
"apt-get purge tgt", then the directory /etc/tgt/stack.d/ still
exist (i.e it is not purged) but /etc/tgt/targets.conf is removed.
Thus any subsequent ./stack.sh would fail to configure
/etc/tgt/targets.conf properly.

Change-Id: I252789f3f39bd64b5a1e7d9abb923386d2a158dd
---
 lib/cinder | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/cinder b/lib/cinder
index 5bd940bc20..9ca8109023 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -467,6 +467,8 @@ function install_cinderclient {
 function _configure_tgt_for_config_d {
     if [[ ! -d /etc/tgt/stack.d/ ]]; then
         sudo ln -sf $CINDER_STATE_PATH/volumes /etc/tgt/stack.d
+    fi
+    if ! grep -q "include /etc/tgt/stack.d/*" /etc/tgt/targets.conf; then
         echo "include /etc/tgt/stack.d/*" | sudo tee -a /etc/tgt/targets.conf
     fi
 }

From 75633266c851856b32056b8b5eb1b6ed4f29b84e Mon Sep 17 00:00:00 2001
From: Kyle Mestery <mestery@mestery.com>
Date: Thu, 7 Jan 2016 16:46:37 -0600
Subject: [PATCH 0164/2409] rpc_backend: Conditionally enable rabbit on fedora

Change 4d8c03a3 added logic to enable rabbit on Fedora/CentOS systems
whether or not rabbit is enabled. This corrects that to only enable
rabbit when it is configured as such.

Change-Id: I270e79ff989176770d65df1ac0ac4e2c4382bb9a
Signed-off-by: Kyle Mestery <mestery@mestery.com>
---
 lib/rpc_backend | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/rpc_backend b/lib/rpc_backend
index a44287c1b8..05e303e3e7 100644
--- a/lib/rpc_backend
+++ b/lib/rpc_backend
@@ -47,9 +47,9 @@ function install_rpc_backend {
     if is_service_enabled rabbit; then
         # Install rabbitmq-server
         install_package rabbitmq-server
-    fi
-    if is_fedora; then
-        sudo systemctl enable rabbitmq-server
+        if is_fedora; then
+            sudo systemctl enable rabbitmq-server
+        fi
     fi
 }
 

From ecc1f41d5053807a70b51bcf2247b51d0ac81ae1 Mon Sep 17 00:00:00 2001
From: Federico Ressi <federico.ressi@intel.com>
Date: Mon, 28 Dec 2015 15:14:13 +0100
Subject: [PATCH 0165/2409] Don't reinstall package just after installing.

Boolean logic used in install_package was wrong:
on nominal flow packages were actually installed twice.
This should fix it.

Change-Id: Ia465414936b272d04523a11f83d6ded378fe1daf
Closes-Bug: #1518544
---
 functions-common | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index cb2998bfcd..361d27c854 100644
--- a/functions-common
+++ b/functions-common
@@ -1245,7 +1245,9 @@ function real_install_package {
 # install_package package [package ...]
 function install_package {
     update_package_repo
-    real_install_package $@ || RETRY_UPDATE=True update_package_repo && real_install_package $@
+    if ! real_install_package "$@"; then
+        RETRY_UPDATE=True update_package_repo && real_install_package "$@"
+    fi
 }
 
 # Distro-agnostic function to tell if a package is installed

From 2babf3963f4eea8558b0c287c51e6faeb7069c70 Mon Sep 17 00:00:00 2001
From: Federico Ressi <federico.ressi@intel.com>
Date: Sun, 3 Jan 2016 20:20:12 +0000
Subject: [PATCH 0166/2409] Don't die when yum fails.

Not all yum failures has to be considered
catastrofic failures also because install_package
function should implement the same behavior in Fedora,
CentOS and Ubuntu. Let return the error to be solved at higher
level.

Change-Id: Ia33bb98f47017f6ec00eb3b7261ed42d72efc573
Closes-Bug: #1522590
---
 functions-common | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/functions-common b/functions-common
index cb2998bfcd..d7d8299ad0 100644
--- a/functions-common
+++ b/functions-common
@@ -1300,13 +1300,17 @@ function yum_install {
             BEGIN { fail=0 }
             /No package/ { fail=1 }
             { print }
-            END { exit fail }' || \
-                die $LINENO "Missing packages detected"
+            END { exit fail }'
+        result=$?
 
-    # also ensure we catch a yum failure
-    if [[ ${PIPESTATUS[0]} != 0 ]]; then
-        die $LINENO "${YUM:-yum} install failure"
+    if [ $result != 0 ]; then
+        echo $LINENO "Missing packages detected"
+    elif [[ ${PIPESTATUS[0]} != 0 ]]; then
+        # also ensure we catch a yum failure
+        echo $LINENO "${YUM:-yum} install failure"
+        result=1
     fi
+    return $result
 }
 
 # zypper wrapper to set arguments correctly

From f568c3a141f04c86ba2d971eb0fa908b4a060731 Mon Sep 17 00:00:00 2001
From: "John L. Villalovos" <john.l.villalovos@intel.com>
Date: Thu, 7 Jan 2016 19:10:50 -0800
Subject: [PATCH 0167/2409] Fix SIGITIN hang with apt-get

Fix an issue where apt-get consistently hangs due to a SIGTTIN being
received. This occurs on a 'vanilla' devstack-gate VM, when running an
ironic-grenade job.

Upstream has a bug related to this:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=555632

http://www.gnu.org/software/libc/manual/html_node/Job-Control-Signals.html
Macro: int SIGTTIN

    A process cannot read from the user's terminal while it is running
    as a background job. When any process in a background job tries to
    read from the terminal, all of the processes in the job are sent a
    SIGTTIN signal. The default action for this signal is to stop the
    process. For more information about how this interacts with the
    terminal driver, see Access to the Terminal.

Change-Id: I8b1f3dccf329bb88e017eff7492da5e701b4892c
Closes-Bug: #1532080
---
 functions-common | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index e2ebd53839..e4d92cb532 100644
--- a/functions-common
+++ b/functions-common
@@ -1065,7 +1065,7 @@ function apt_get {
     $sudo DEBIAN_FRONTEND=noninteractive \
         http_proxy=${http_proxy:-} https_proxy=${https_proxy:-} \
         no_proxy=${no_proxy:-} \
-        apt-get --option "Dpkg::Options::=--force-confold" --assume-yes "$@"
+        apt-get --option "Dpkg::Options::=--force-confold" --assume-yes "$@" < /dev/null
     result=$?
 
     # stop the clock

From af8b6e10a3470808b54c2a2f5031a68ce1a151df Mon Sep 17 00:00:00 2001
From: Yuriy Nesenenko <ynesenenko@mirantis.com>
Date: Wed, 6 Jan 2016 17:14:45 +0200
Subject: [PATCH 0168/2409] Add flag for test_volume_services

test_volume_services works incorrect with host info if it includes
backend name (host@backend). The test is skipped by default for
Liberty and Kilo gates. Need to add flag to unskip this test in new release.
This fix related with bug #1530144 in service-list filter.

Change-Id: Ifdc0bab819c05a00cd0c20316bd81961cf6aeb88
---
 lib/tempest | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index c510984382..63df4f9f80 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -485,6 +485,8 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG volume-feature-enabled extend_with_snapshot True
     # TODO(obutenko): Remove the incremental_backup_force flag when Kilo and Juno is end of life.
     iniset $TEMPEST_CONFIG volume-feature-enabled incremental_backup_force True
+    # TODO(ynesenenko): Remove the volume_services flag when Liberty and Kilo will correct work with host info.
+    iniset $TEMPEST_CONFIG volume-feature-enabled volume_services True
 
     local volume_api_extensions=${VOLUME_API_EXTENSIONS:-"all"}
     if [[ ! -z "$DISABLE_VOLUME_API_EXTENSIONS" ]]; then

From 923be5f791c78fa9f21b2e217a6b61328c493a38 Mon Sep 17 00:00:00 2001
From: Steve Martinelli <stevemar@ca.ibm.com>
Date: Sun, 20 Dec 2015 00:24:19 -0500
Subject: [PATCH 0169/2409] bootstrap keystone using new bootstrap command

Be gone ADMIN_TOKEN, long live keystone-manage bootstrap.

This patch reworks the initial setup for keystone by using
the new bootstrap command. After a minimal service catalog
has been created, using this process, we simply authenticate
as usual.

implements bp: bootstrap
Depends-On: I113c6934b6b83ceff23a94101967a6df1126873f
Change-Id: Ia1475d461eab60b68c6a0356714b21c7f92e0194
---
 lib/keystone       | 76 ++++++++++++++++++++++++++++++++++------------
 samples/local.conf |  6 ++--
 stack.sh           | 47 ++++++++++------------------
 3 files changed, 75 insertions(+), 54 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 057bb47188..6f13ec655d 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -12,7 +12,6 @@
 # - ``IDENTITY_API_VERSION``
 # - ``BASE_SQL_CONN``
 # - ``SERVICE_HOST``, ``SERVICE_PROTOCOL``
-# - ``SERVICE_TOKEN``
 # - ``S3_SERVICE_PORT`` (template backend only)
 
 # ``stack.sh`` calls the entry points in this order:
@@ -22,6 +21,7 @@
 # - _config_keystone_apache_wsgi
 # - init_keystone
 # - start_keystone
+# - bootstrap_keystone
 # - create_keystone_accounts
 # - stop_keystone
 # - cleanup_keystone
@@ -230,8 +230,6 @@ function configure_keystone {
         iniset $KEYSTONE_CONF DEFAULT admin_endpoint $KEYSTONE_AUTH_URI
     fi
 
-    iniset $KEYSTONE_CONF DEFAULT admin_token "$SERVICE_TOKEN"
-
     if [[ "$KEYSTONE_TOKEN_FORMAT" != "" ]]; then
         iniset $KEYSTONE_CONF token provider $KEYSTONE_TOKEN_FORMAT
     fi
@@ -324,14 +322,16 @@ function configure_keystone {
 # Migrated from keystone_data.sh
 function create_keystone_accounts {
 
-    # admin
+    # The keystone bootstrapping process (performed via keystone-manage bootstrap)
+    # creates an admin user, admin role and admin project. As a sanity check
+    # we exercise the CLI to retrieve the IDs for these values.
     local admin_tenant
-    admin_tenant=$(get_or_create_project "admin" default)
+    admin_tenant=$(openstack project show "admin" -f value -c id)
     local admin_user
-    admin_user=$(get_or_create_user "admin" "$ADMIN_PASSWORD" default)
+    admin_user=$(openstack user show "admin" -f value -c id)
     local admin_role
-    admin_role=$(get_or_create_role "admin")
-    get_or_add_user_project_role $admin_role $admin_user $admin_tenant
+    admin_role=$(openstack role show "admin" -f value -c id)
+
     get_or_add_user_domain_role $admin_role $admin_user default
 
     # Create service project/role
@@ -381,17 +381,6 @@ function create_keystone_accounts {
     get_or_add_group_project_role $member_role $non_admin_group $demo_tenant
     get_or_add_group_project_role $another_role $non_admin_group $demo_tenant
     get_or_add_group_project_role $admin_role $admin_group $admin_tenant
-
-    # Keystone
-    if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
-
-        get_or_create_service "keystone" "identity" "Keystone Identity Service"
-        get_or_create_endpoint "identity" \
-            "$REGION_NAME" \
-            "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v$IDENTITY_API_VERSION" \
-            "$KEYSTONE_AUTH_PROTOCOL://$KEYSTONE_AUTH_HOST:$KEYSTONE_AUTH_PORT/v$IDENTITY_API_VERSION" \
-            "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v$IDENTITY_API_VERSION"
-    fi
 }
 
 # Create a user that is capable of verifying keystone tokens for use with auth_token middleware.
@@ -565,6 +554,55 @@ function stop_keystone {
     stop_process key
 }
 
+# bootstrap_keystone() - Initialize user, role and project
+# This function uses the following GLOBAL variables:
+# - ``KEYSTONE_BIN_DIR``
+# - ``ADMIN_PASSWORD``
+# - ``IDENTITY_API_VERSION``
+# - ``KEYSTONE_CATALOG_BACKEND``
+# - ``KEYSTONE_AUTH_URI``
+# - ``REGION_NAME``
+# - ``KEYSTONE_SERVICE_PROTOCOL``
+# - ``KEYSTONE_SERVICE_HOST``
+# - ``KEYSTONE_SERVICE_PORT``
+function bootstrap_keystone {
+
+    # Initialize keystone, this will create an 'admin' user, 'admin' project,
+    # 'admin' role, and assign the user the role on the project. These resources
+    # are created only if they do not already exist.
+    $KEYSTONE_BIN_DIR/keystone-manage bootstrap --bootstrap-password $ADMIN_PASSWORD
+
+    # Create the keystone service and endpoints. To do this with the new
+    # bootstrapping process, we need to get a token and use that token to
+    # interact with the new APIs. The token will only be used to create services
+    # and endpoints, thus creating a minimal service catalog.
+    # They are unset immediately after.
+    # TODO(stevemar): OpenStackClient and KeystoneClient do not have support to
+    # handle interactions that not return service catalogs. Eventually remove
+    # this section when the support is in place. Use token based auth for now.
+    local token_id
+    token_id=$(openstack token issue -c id -f value \
+        --os-username admin --os-project-name admin \
+        --os-user-domain-id default --os-project-domain-id default \
+        --os-identity-api-version 3 --os-auth-url $KEYSTONE_AUTH_URI \
+        --os-password $ADMIN_PASSWORD)
+
+    if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
+
+        export OS_TOKEN=$token_id
+        export OS_URL=$KEYSTONE_AUTH_URI/v3
+        export OS_IDENTITY_API_VERSION=3
+
+        get_or_create_service "keystone" "identity" "Keystone Identity Service"
+        get_or_create_endpoint "identity" \
+            "$REGION_NAME" \
+            "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v$IDENTITY_API_VERSION" \
+            "$KEYSTONE_AUTH_URI/v$IDENTITY_API_VERSION" \
+            "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v$IDENTITY_API_VERSION"
+    fi
+
+    unset OS_TOKEN OS_URL OS_IDENTITY_API_VERSION
+}
 
 # Restore xtrace
 $_XTRACE_KEYSTONE
diff --git a/samples/local.conf b/samples/local.conf
index 34c9e8b48e..f77e1726d4 100644
--- a/samples/local.conf
+++ b/samples/local.conf
@@ -23,10 +23,8 @@
 # While ``stack.sh`` is happy to run without ``localrc``, devlife is better when
 # there are a few minimal variables set:
 
-# If the ``SERVICE_TOKEN`` and ``*_PASSWORD`` variables are not set
-# here you will be prompted to enter values for them by ``stack.sh``
-# and they will be added to ``local.conf``.
-SERVICE_TOKEN=azertytoken
+# If the ``*_PASSWORD`` variables are not set here you will be prompted to enter
+# values for them by ``stack.sh``and they will be added to ``local.conf``.
 ADMIN_PASSWORD=nomoresecrete
 DATABASE_PASSWORD=stackdb
 RABBIT_PASSWORD=stackqueue
diff --git a/stack.sh b/stack.sh
index 5e4a4f8310..e9831d5039 100755
--- a/stack.sh
+++ b/stack.sh
@@ -652,9 +652,6 @@ fi
 # --------
 
 if is_service_enabled keystone; then
-    # The ``SERVICE_TOKEN`` is used to bootstrap the Keystone database.  It is
-    # just a string and is not a 'real' Keystone token.
-    read_password SERVICE_TOKEN "ENTER A SERVICE_TOKEN TO USE FOR THE SERVICE ADMIN TOKEN."
     # Services authenticate to Identity with servicename/``SERVICE_PASSWORD``
     read_password SERVICE_PASSWORD "ENTER A SERVICE_PASSWORD TO USE FOR THE SERVICE AUTHENTICATION."
     # Horizon currently truncates usernames and passwords at 20 characters
@@ -994,40 +991,13 @@ if is_service_enabled keystone; then
     if [ "$KEYSTONE_AUTH_HOST" == "$SERVICE_HOST" ]; then
         init_keystone
         start_keystone
+        bootstrap_keystone
     fi
 
-    export OS_IDENTITY_API_VERSION=3
-
-    # Set up a temporary admin URI for Keystone
-    SERVICE_ENDPOINT=$KEYSTONE_AUTH_URI/v3
-
     if is_service_enabled tls-proxy; then
         export OS_CACERT=$INT_CA_DIR/ca-chain.pem
-        # Until the client support is fixed, just use the internal endpoint
-        SERVICE_ENDPOINT=http://$KEYSTONE_AUTH_HOST:$KEYSTONE_AUTH_PORT_INT/v3
-    fi
-
-    # Setup OpenStackClient token-endpoint auth
-    export OS_TOKEN=$SERVICE_TOKEN
-    export OS_URL=$SERVICE_ENDPOINT
-
-    create_keystone_accounts
-    create_nova_accounts
-    create_glance_accounts
-    create_cinder_accounts
-    create_neutron_accounts
-
-    if is_service_enabled swift; then
-        create_swift_accounts
-    fi
-
-    if is_service_enabled heat; then
-        create_heat_accounts
     fi
 
-    # Begone token auth
-    unset OS_TOKEN OS_URL
-
     # Rather than just export these, we write them out to a
     # intermediate userrc file that can also be used to debug if
     # something goes wrong between here and running
@@ -1037,6 +1007,7 @@ if is_service_enabled keystone; then
 # Use this for debugging issues before files in accrc are created
 
 # Set up password auth credentials now that Keystone is bootstrapped
+export OS_IDENTITY_API_VERSION=3
 export OS_AUTH_URL=$KEYSTONE_AUTH_URI
 export OS_USERNAME=admin
 export OS_USER_DOMAIN_ID=default
@@ -1049,6 +1020,20 @@ EOF
 
     source $TOP_DIR/userrc_early
 
+    create_keystone_accounts
+    create_nova_accounts
+    create_glance_accounts
+    create_cinder_accounts
+    create_neutron_accounts
+
+    if is_service_enabled swift; then
+        create_swift_accounts
+    fi
+
+    if is_service_enabled heat; then
+        create_heat_accounts
+    fi
+
 fi
 
 # Write a clouds.yaml file

From 3567d6103abab8484c40f1a46f2465d0931dfbb0 Mon Sep 17 00:00:00 2001
From: Steve Martinelli <stevemar@ca.ibm.com>
Date: Tue, 5 Jan 2016 21:36:23 -0500
Subject: [PATCH 0170/2409] remove SERVICE_TOKEN from the docs

there are a few lingering instances of SERVICE_TOKEN in the docs
and some of the scripts in tools.

Change-Id: I9d2147eea6639db1f4ea15a259c147eecfc339ff
---
 doc/source/configuration.rst                 | 1 -
 doc/source/guides/devstack-with-lbaas-v2.rst | 1 -
 doc/source/guides/multinode-lab.rst          | 2 --
 doc/source/guides/neutron.rst                | 4 ----
 doc/source/guides/single-machine.rst         | 1 -
 doc/source/guides/single-vm.rst              | 1 -
 tools/create_userrc.sh                       | 2 +-
 tools/xen/README.md                          | 1 -
 8 files changed, 1 insertion(+), 12 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 386fbbbf71..a7d3b7d9be 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -108,7 +108,6 @@ values that most often need to be set.
     DATABASE_PASSWORD=$ADMIN_PASSWORD
     RABBIT_PASSWORD=$ADMIN_PASSWORD
     SERVICE_PASSWORD=$ADMIN_PASSWORD
-    SERVICE_TOKEN=a682f596-76f3-11e3-b3b2-e716f9080d50
     #FIXED_RANGE=172.31.1.0/24
     #FLOATING_RANGE=192.168.20.0/25
     #HOST_IP=10.3.4.5
diff --git a/doc/source/guides/devstack-with-lbaas-v2.rst b/doc/source/guides/devstack-with-lbaas-v2.rst
index f3bd2feb45..f6379fe43a 100644
--- a/doc/source/guides/devstack-with-lbaas-v2.rst
+++ b/doc/source/guides/devstack-with-lbaas-v2.rst
@@ -34,7 +34,6 @@ Edit your ``local.conf`` to look like
     DATABASE_PASSWORD=password
     ADMIN_PASSWORD=password
     SERVICE_PASSWORD=password
-    SERVICE_TOKEN=password
     RABBIT_PASSWORD=password
     # Enable Logging
     LOGFILE=$DEST/logs/stack.sh.log
diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
index 5660bc5222..37c8515e86 100644
--- a/doc/source/guides/multinode-lab.rst
+++ b/doc/source/guides/multinode-lab.rst
@@ -131,7 +131,6 @@ cluster controller's DevStack in ``local.conf``:
     DATABASE_PASSWORD=supersecret
     RABBIT_PASSWORD=supersecrete
     SERVICE_PASSWORD=supersecrete
-    SERVICE_TOKEN=xyzpdqlazydog
 
 In the multi-node configuration the first 10 or so IPs in the private
 subnet are usually reserved. Add this to ``local.sh`` to have it run
@@ -172,7 +171,6 @@ machines, create a ``local.conf`` with:
     DATABASE_PASSWORD=supersecret
     RABBIT_PASSWORD=supersecrete
     SERVICE_PASSWORD=supersecrete
-    SERVICE_TOKEN=xyzpdqlazydog
     DATABASE_TYPE=mysql
     SERVICE_HOST=192.168.42.11
     MYSQL_HOST=$SERVICE_HOST
diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index a72b6f94cb..84295a50ce 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -59,7 +59,6 @@ serving as a hypervisor for guest instances.
         DATABASE_PASSWORD=secrete
         RABBIT_PASSWORD=secrete
         SERVICE_PASSWORD=secrete
-        SERVICE_TOKEN=secrete
 
         # Do not use Nova-Network
         disable_service n-net
@@ -231,7 +230,6 @@ The host `devstack-2` has a very minimal `local.conf`.
     MYSQL_PASSWORD=secrete
     RABBIT_PASSWORD=secrete
     SERVICE_PASSWORD=secrete
-    SERVICE_TOKEN=secrete
 
     ## Neutron options
     PUBLIC_INTERFACE=eth0
@@ -362,7 +360,6 @@ controller node.
         MYSQL_PASSWORD=secrete
         RABBIT_PASSWORD=secrete
         SERVICE_PASSWORD=secrete
-        SERVICE_TOKEN=secrete
 
         ## Neutron options
         Q_USE_SECGROUP=True
@@ -410,7 +407,6 @@ compute node 1.
         MYSQL_PASSWORD=secrete
         RABBIT_PASSWORD=secrete
         SERVICE_PASSWORD=secrete
-        SERVICE_TOKEN=secrete
 
         # Services that a compute node runs
         ENABLED_SERVICES=n-cpu,rabbit,q-agt
diff --git a/doc/source/guides/single-machine.rst b/doc/source/guides/single-machine.rst
index a01c368213..011c41fbce 100644
--- a/doc/source/guides/single-machine.rst
+++ b/doc/source/guides/single-machine.rst
@@ -108,7 +108,6 @@ do the following:
     DATABASE_PASSWORD=iheartdatabases
     RABBIT_PASSWORD=flopsymopsy
     SERVICE_PASSWORD=iheartksl
-    SERVICE_TOKEN=xyzpdqlazydog
 
 Run DevStack:
 
diff --git a/doc/source/guides/single-vm.rst b/doc/source/guides/single-vm.rst
index 53c3fa973f..45b8f2dd89 100644
--- a/doc/source/guides/single-vm.rst
+++ b/doc/source/guides/single-vm.rst
@@ -67,7 +67,6 @@ passed as the user-data file when booting the VM.
             echo DATABASE_PASSWORD=password >> local.conf
             echo RABBIT_PASSWORD=password >> local.conf
             echo SERVICE_PASSWORD=password >> local.conf
-            echo SERVICE_TOKEN=tokentoken >> local.conf
             ./stack.sh
         path: /home/stack/start.sh
         permissions: 0755
diff --git a/tools/create_userrc.sh b/tools/create_userrc.sh
index 25f713ca93..93d5d69342 100755
--- a/tools/create_userrc.sh
+++ b/tools/create_userrc.sh
@@ -156,7 +156,7 @@ if [ -z "$MODE" ]; then
     exit 3
 fi
 
-export -n SERVICE_TOKEN SERVICE_ENDPOINT OS_SERVICE_TOKEN OS_SERVICE_ENDPOINT
+export -n SERVICE_ENDPOINT OS_SERVICE_ENDPOINT
 
 EC2_URL=$(openstack endpoint list --service ec2 --interface public --os-identity-api-version=3 -c URL -f value || true)
 if [[ -z $EC2_URL ]]; then
diff --git a/tools/xen/README.md b/tools/xen/README.md
index a1adf590a6..21090e56aa 100644
--- a/tools/xen/README.md
+++ b/tools/xen/README.md
@@ -78,7 +78,6 @@ Of course, use real passwords if this machine is exposed.
     # to prompt for these passwords, blocking the install process.
 
     DATABASE_PASSWORD=my_super_secret
-    SERVICE_TOKEN=my_super_secret
     ADMIN_PASSWORD=my_super_secret
     SERVICE_PASSWORD=my_super_secret
     RABBIT_PASSWORD=my_super_secret

From d091a2dd5467f42491e85208b236956b78c1c837 Mon Sep 17 00:00:00 2001
From: Michael Turek <mjturek@linux.vnet.ibm.com>
Date: Mon, 11 Jan 2016 18:17:50 +0000
Subject: [PATCH 0171/2409] Revert "Replace deprecated baremetal timeouts with
 new deploy_timeout"

This reverts commit 00b5f4af92a640a2507046cf76ee57caa166310b.

This patch was merged before the timeout was merged to
tempest. This means that devstack is currently referencing
a non-existent config option. As such I think it needs to be reverted.

Change-Id: I947261dc330ef35efce1ecd805ba6e649e81a6aa
---
 lib/tempest | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index b9d9e80fc2..61351c0628 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -533,7 +533,8 @@ function configure_tempest {
     # Baremetal
     if [ "$VIRT_DRIVER" = "ironic" ] ; then
         iniset $TEMPEST_CONFIG baremetal driver_enabled True
-        iniset $TEMPEST_CONFIG baremetal deploy_timeout $BUILD_TIMEOUT
+        iniset $TEMPEST_CONFIG baremetal unprovision_timeout $BUILD_TIMEOUT
+        iniset $TEMPEST_CONFIG baremetal active_timeout $BUILD_TIMEOUT
         iniset $TEMPEST_CONFIG baremetal deploy_img_dir $FILES
         iniset $TEMPEST_CONFIG baremetal node_uuid $IRONIC_NODE_UUID
         iniset $TEMPEST_CONFIG compute-feature-enabled change_password False

From 3919d4c822a38d324adf47697f4b9bedbc906a36 Mon Sep 17 00:00:00 2001
From: Lucas Alvares Gomes <lucasagomes@gmail.com>
Date: Mon, 14 Dec 2015 12:02:55 +0000
Subject: [PATCH 0172/2409] Add diskimage-builder to the list of libraries

Add diskimage-builder to the list of libraries so it can be installed
from source to be tested in gate.

Change-Id: I6cefac1eb4ebf0196a6b4d4bfc038c00921f0d70
---
 stackrc                      | 4 ++++
 tests/test_libs_from_pypi.sh | 1 +
 2 files changed, 5 insertions(+)

diff --git a/stackrc b/stackrc
index 16621f1660..a42638c675 100644
--- a/stackrc
+++ b/stackrc
@@ -473,6 +473,10 @@ GITBRANCH["ironic-lib"]=${IRONIC_LIB_BRANCH:-master}
 # this doesn't exist in a lib file, so set it here
 GITDIR["ironic-lib"]=$DEST/ironic-lib
 
+# diskimage-builder tool
+GITREPO["diskimage-builder"]=${DIB_REPO:-${GIT_BASE}/openstack/diskimage-builder.git}
+GITBRANCH["diskimage-builder"]=${DIB_BRANCH:-master}
+GITDIR["diskimage-builder"]=$DEST/diskimage-builder
 
 ##################
 #
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index f31560a1fe..52d7426f00 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -42,6 +42,7 @@ ALL_LIBS+=" python-neutronclient tooz ceilometermiddleware oslo.policy"
 ALL_LIBS+=" debtcollector os-brick automaton futurist oslo.service"
 ALL_LIBS+=" oslo.cache oslo.reports"
 ALL_LIBS+=" keystoneauth ironic-lib oslo.privsep"
+ALL_LIBS+=" diskimage-builder"
 
 # Generate the above list with
 # echo ${!GITREPO[@]}

From 7710e7fc273dd9af6799ea565bbd21ce03745a44 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Wed, 27 Aug 2014 16:15:32 +1000
Subject: [PATCH 0173/2409] Only use lsb_release for distro tags

The existing GetOSVersion has a lot of unused code which is wrong in
several ways

 - the only path tested in upstream CI is with lsb_release, because
   it's pre-installed on all nodes

 - the /etc/redhat-release checking probably still works, but is
   unnecessary

 - If using lsb_release, os_UPDATE has never actually been set.

 - the /etc/SuSE-release branch checking is broken if the lsb package
   is actually installed.  lsb checking does not set os_UPDATE but yet
   the SuSE DISTRO setting relies on this to set a patch level (and so
   does some of the rpm tags).  SuSE 11 is up to update 3, but the rpm
   matching is stuck hard-coded to update 2.  I'm guessing
   installation is actually broken there.

 - the debian checking branch is broken.  The VERSION tags have been
   removed and were not supposed to be relied on anyway (see notes in
   [1])

This simplifies things:

 - remove OSX checking (moved here after discussions in
   I31d0fdd30928ecc8d959a95838b1d3affd28ac6f)

 - only use the output of lsb_release.

 - A small best-effort check to pre-install lsb packages if not
   detected (that avoids chicken-egg-problem of package-install
   wrappers relying on os_* flags).

 - The unset os_UPDATE is removed.  It's only previous use was for
   setting separate suse versions in the DISTRO element for matching
   during package installs (since removed)

 - DISTRO setting is modified to use the parts of os_RELEASE it wants.
   Per-above, this is the correct place to parse out specifics.

 - Call out the is_* functions, which are a better way to detect
   platforms

 - Export the variables as read-only, since they shouldn't be reset

[1] http://sources.debian.net/src/base-files/7.5/debian/changelog/

Change-Id: I46a2c36d95327087085df07cb797eb91249a893c
---
 clean.sh                   |   2 +-
 functions-common           | 172 ++++++++++++++-----------------------
 stack.sh                   |   2 +-
 tools/create-stack-user.sh |   2 +-
 tools/info.sh              |   4 -
 tools/install_prereqs.sh   |   2 +-
 unstack.sh                 |   2 +-
 7 files changed, 69 insertions(+), 117 deletions(-)

diff --git a/clean.sh b/clean.sh
index fc6f80dad4..57e3b5edf8 100755
--- a/clean.sh
+++ b/clean.sh
@@ -26,7 +26,7 @@ if [[ -r $TOP_DIR/.stackenv ]]; then
 fi
 
 # Determine what system we are running on.  This provides ``os_VENDOR``,
-# ``os_RELEASE``, ``os_UPDATE``, ``os_PACKAGE``, ``os_CODENAME``
+# ``os_RELEASE``, ``os_PACKAGE``, ``os_CODENAME``
 # and ``DISTRO``
 GetDistro
 
diff --git a/functions-common b/functions-common
index dbf605cdd8..e6f081ce0a 100644
--- a/functions-common
+++ b/functions-common
@@ -274,112 +274,71 @@ function warn {
 # ================
 
 # Determine OS Vendor, Release and Update
-# Tested with OS/X, Ubuntu, RedHat, CentOS, Fedora
-# Returns results in global variables:
+
+#
+# NOTE : For portability, you almost certainly do not want to use
+# these variables directly!  The "is_*" functions defined below this
+# bundle up compatible platforms under larger umbrellas that we have
+# determinted are compatible enough (e.g. is_ubuntu covers Ubuntu &
+# Debian, is_fedora covers RPM-based distros).  Higher-level functions
+# such as "install_package" further abstract things in better ways.
+#
 # ``os_VENDOR`` - vendor name: ``Ubuntu``, ``Fedora``, etc
 # ``os_RELEASE`` - major release: ``14.04`` (Ubuntu), ``20`` (Fedora)
-# ``os_UPDATE`` - update: ex. the ``5`` in ``RHEL6.5``
 # ``os_PACKAGE`` - package type: ``deb`` or ``rpm``
-# ``os_CODENAME`` - vendor's codename for release: ``snow leopard``, ``trusty``
-os_VENDOR=""
-os_RELEASE=""
-os_UPDATE=""
-os_PACKAGE=""
-os_CODENAME=""
+# ``os_CODENAME`` - vendor's codename for release: ``trusty``
+
+declare os_VENDOR os_RELEASE os_PACKAGE os_CODENAME
+
+# Make a *best effort* attempt to install lsb_release packages for the
+# user if not available.  Note can't use generic install_package*
+# because they depend on this!
+function _ensure_lsb_release {
+    if [[ -x $(which lsb_release 2>/dev/null) ]]; then
+        return
+    fi
+
+    if [[ -x $(which apt-get 2>/dev/null) ]]; then
+        sudo apt-get install -y lsb-release
+    elif [[ -x $(which zypper 2>/dev/null) ]]; then
+        # XXX: old code paths seem to have assumed SUSE platforms also
+        # had "yum".  Keep this ordered above yum so we don't try to
+        # install the rh package.  suse calls it just "lsb"
+        sudo zypper -y install lsb
+    elif [[ -x $(which dnf 2>/dev/null) ]]; then
+        sudo dnf install -y redhat-lsb-core
+    elif [[ -x $(which yum 2>/dev/null) ]]; then
+        # all rh patforms (fedora, centos, rhel) have this pkg
+        sudo yum install -y redhat-lsb-core
+    else
+        die $LINENO "Unable to find or auto-install lsb_release"
+    fi
+}
 
 # GetOSVersion
+#  Set the following variables:
+#  - os_RELEASE
+#  - os_CODENAME
+#  - os_VENDOR
+#  - os_PACKAGE
 function GetOSVersion {
+    # We only support distros that provide a sane lsb_release
+    _ensure_lsb_release
 
-    # Figure out which vendor we are
-    if [[ -x "`which sw_vers 2>/dev/null`" ]]; then
-        # OS/X
-        os_VENDOR=`sw_vers -productName`
-        os_RELEASE=`sw_vers -productVersion`
-        os_UPDATE=${os_RELEASE##*.}
-        os_RELEASE=${os_RELEASE%.*}
-        os_PACKAGE=""
-        if [[ "$os_RELEASE" =~ "10.7" ]]; then
-            os_CODENAME="lion"
-        elif [[ "$os_RELEASE" =~ "10.6" ]]; then
-            os_CODENAME="snow leopard"
-        elif [[ "$os_RELEASE" =~ "10.5" ]]; then
-            os_CODENAME="leopard"
-        elif [[ "$os_RELEASE" =~ "10.4" ]]; then
-            os_CODENAME="tiger"
-        elif [[ "$os_RELEASE" =~ "10.3" ]]; then
-            os_CODENAME="panther"
-        else
-            os_CODENAME=""
-        fi
-    elif [[ -x $(which lsb_release 2>/dev/null) ]]; then
-        os_VENDOR=$(lsb_release -i -s)
-        os_RELEASE=$(lsb_release -r -s)
-        os_UPDATE=""
-        os_PACKAGE="rpm"
-        if [[ "Debian,Ubuntu,LinuxMint" =~ $os_VENDOR ]]; then
-            os_PACKAGE="deb"
-        elif [[ "SUSE LINUX" =~ $os_VENDOR ]]; then
-            lsb_release -d -s | grep -q openSUSE
-            if [[ $? -eq 0 ]]; then
-                os_VENDOR="openSUSE"
-            fi
-        elif [[ $os_VENDOR == "openSUSE project" ]]; then
-            os_VENDOR="openSUSE"
-        elif [[ $os_VENDOR =~ Red.*Hat ]]; then
-            os_VENDOR="Red Hat"
-        fi
-        os_CODENAME=$(lsb_release -c -s)
-    elif [[ -r /etc/redhat-release ]]; then
-        # Red Hat Enterprise Linux Server release 5.5 (Tikanga)
-        # Red Hat Enterprise Linux Server release 7.0 Beta (Maipo)
-        # CentOS release 5.5 (Final)
-        # CentOS Linux release 6.0 (Final)
-        # Fedora release 16 (Verne)
-        # XenServer release 6.2.0-70446c (xenenterprise)
-        # Oracle Linux release 7
-        # CloudLinux release 7.1
-        os_CODENAME=""
-        for r in "Red Hat" CentOS Fedora XenServer CloudLinux; do
-            os_VENDOR=$r
-            if [[ -n "`grep \"$r\" /etc/redhat-release`" ]]; then
-                ver=`sed -e 's/^.* \([0-9].*\) (\(.*\)).*$/\1\|\2/' /etc/redhat-release`
-                os_CODENAME=${ver#*|}
-                os_RELEASE=${ver%|*}
-                os_UPDATE=${os_RELEASE##*.}
-                os_RELEASE=${os_RELEASE%.*}
-                break
-            fi
-            os_VENDOR=""
-        done
-        if [ "$os_VENDOR" = "Red Hat" ] && [[ -r /etc/oracle-release ]]; then
-            os_VENDOR=OracleLinux
-        fi
-        os_PACKAGE="rpm"
-    elif [[ -r /etc/SuSE-release ]]; then
-        for r in openSUSE "SUSE Linux"; do
-            if [[ "$r" = "SUSE Linux" ]]; then
-                os_VENDOR="SUSE LINUX"
-            else
-                os_VENDOR=$r
-            fi
+    os_RELEASE=$(lsb_release -r -s)
+    os_CODENAME=$(lsb_release -c -s)
+    os_VENDOR=$(lsb_release -i -s)
 
-            if [[ -n "`grep \"$r\" /etc/SuSE-release`" ]]; then
-                os_CODENAME=`grep "CODENAME = " /etc/SuSE-release | sed 's:.* = ::g'`
-                os_RELEASE=`grep "VERSION = " /etc/SuSE-release | sed 's:.* = ::g'`
-                os_UPDATE=`grep "PATCHLEVEL = " /etc/SuSE-release | sed 's:.* = ::g'`
-                break
-            fi
-            os_VENDOR=""
-        done
-        os_PACKAGE="rpm"
-    # If lsb_release is not installed, we should be able to detect Debian OS
-    elif [[ -f /etc/debian_version ]] && [[ $(cat /proc/version) =~ "Debian" ]]; then
-        os_VENDOR="Debian"
+    if [[ $os_VENDOR =~ (Debian|Ubuntu|LinuxMint) ]]; then
         os_PACKAGE="deb"
-        os_CODENAME=$(awk '/VERSION=/' /etc/os-release | sed 's/VERSION=//' | sed -r 's/\"|\(|\)//g' | awk '{print $2}')
-        os_RELEASE=$(awk '/VERSION_ID=/' /etc/os-release | sed 's/VERSION_ID=//' | sed 's/\"//g')
+    else
+        os_PACKAGE="rpm"
     fi
-    export os_VENDOR os_RELEASE os_UPDATE os_PACKAGE os_CODENAME
+
+    typeset -xr os_VENDOR
+    typeset -xr os_RELEASE
+    typeset -xr os_PACKAGE
+    typeset -xr os_CODENAME
 }
 
 # Translate the OS version values into common nomenclature
@@ -389,7 +348,8 @@ declare DISTRO
 function GetDistro {
     GetOSVersion
     if [[ "$os_VENDOR" =~ (Ubuntu) || "$os_VENDOR" =~ (Debian) ]]; then
-        # 'Everyone' refers to Ubuntu / Debian releases by the code name adjective
+        # 'Everyone' refers to Ubuntu / Debian releases by
+        # the code name adjective
         DISTRO=$os_CODENAME
     elif [[ "$os_VENDOR" =~ (Fedora) ]]; then
         # For Fedora, just use 'f' and the release
@@ -397,26 +357,22 @@ function GetDistro {
     elif [[ "$os_VENDOR" =~ (openSUSE) ]]; then
         DISTRO="opensuse-$os_RELEASE"
     elif [[ "$os_VENDOR" =~ (SUSE LINUX) ]]; then
-        # For SLE, also use the service pack
-        if [[ -z "$os_UPDATE" ]]; then
-            DISTRO="sle${os_RELEASE}"
-        else
-            DISTRO="sle${os_RELEASE}sp${os_UPDATE}"
-        fi
-    elif [[ "$os_VENDOR" =~ (Red Hat) || \
+        # just use major release
+        DISTRO="sle${os_RELEASE%.*}"
+    elif [[ "$os_VENDOR" =~ (Red.*Hat) || \
         "$os_VENDOR" =~ (CentOS) || \
         "$os_VENDOR" =~ (OracleLinux) ]]; then
         # Drop the . release as we assume it's compatible
+        # XXX re-evaluate when we get RHEL10
         DISTRO="rhel${os_RELEASE::1}"
     elif [[ "$os_VENDOR" =~ (XenServer) ]]; then
-        DISTRO="xs$os_RELEASE"
+        DISTRO="xs${os_RELEASE%.*}"
     elif [[ "$os_VENDOR" =~ (kvmibm) ]]; then
         DISTRO="${os_VENDOR}${os_RELEASE::1}"
     else
-        # Catch-all for now is Vendor + Release + Update
-        DISTRO="$os_VENDOR-$os_RELEASE.$os_UPDATE"
+        die $LINENO "Unable to determine DISTRO"
     fi
-    export DISTRO
+    typeset -xr DISTRO
 }
 
 # Utility function for checking machine architecture
diff --git a/stack.sh b/stack.sh
index 5e4a4f8310..697dce156f 100755
--- a/stack.sh
+++ b/stack.sh
@@ -136,7 +136,7 @@ source $TOP_DIR/inc/meta-config
 source $TOP_DIR/lib/stack
 
 # Determine what system we are running on.  This provides ``os_VENDOR``,
-# ``os_RELEASE``, ``os_UPDATE``, ``os_PACKAGE``, ``os_CODENAME``
+# ``os_RELEASE``, ``os_PACKAGE``, ``os_CODENAME``
 # and ``DISTRO``
 GetDistro
 
diff --git a/tools/create-stack-user.sh b/tools/create-stack-user.sh
index b49164b22a..c0b7ac70aa 100755
--- a/tools/create-stack-user.sh
+++ b/tools/create-stack-user.sh
@@ -24,7 +24,7 @@ TOP_DIR=$(cd $(dirname "$0")/.. && pwd)
 source $TOP_DIR/functions
 
 # Determine what system we are running on.  This provides ``os_VENDOR``,
-# ``os_RELEASE``, ``os_UPDATE``, ``os_PACKAGE``, ``os_CODENAME``
+# ``os_RELEASE``, ``os_PACKAGE``, ``os_CODENAME``
 # and ``DISTRO``
 GetDistro
 
diff --git a/tools/info.sh b/tools/info.sh
index 433206e8ae..c056fa73f8 100755
--- a/tools/info.sh
+++ b/tools/info.sh
@@ -52,10 +52,6 @@ GetDistro
 echo "os|distro=$DISTRO"
 echo "os|vendor=$os_VENDOR"
 echo "os|release=$os_RELEASE"
-if [ -n "$os_UPDATE" ]; then
-    echo "os|version=$os_UPDATE"
-fi
-
 
 # Repos
 # -----
diff --git a/tools/install_prereqs.sh b/tools/install_prereqs.sh
index 031f8a8eca..8895e1e77c 100755
--- a/tools/install_prereqs.sh
+++ b/tools/install_prereqs.sh
@@ -28,7 +28,7 @@ if [[ -z "$TOP_DIR" ]]; then
     source $TOP_DIR/functions
 
     # Determine what system we are running on.  This provides ``os_VENDOR``,
-    # ``os_RELEASE``, ``os_UPDATE``, ``os_PACKAGE``, ``os_CODENAME``
+    # ``os_RELEASE``, ``os_PACKAGE``, ``os_CODENAME``
     # and ``DISTRO``
     GetDistro
 
diff --git a/unstack.sh b/unstack.sh
index 8eded837fd..c4dfdc8d9e 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -84,7 +84,7 @@ fi
 load_plugin_settings
 
 # Determine what system we are running on.  This provides ``os_VENDOR``,
-# ``os_RELEASE``, ``os_UPDATE``, ``os_PACKAGE``, ``os_CODENAME``
+# ``os_RELEASE``, ``os_PACKAGE``, ``os_CODENAME``
 GetOSVersion
 
 # Run extras

From 4a974e61c8c53c692d0e2d0dc85b3ce9b2eff446 Mon Sep 17 00:00:00 2001
From: Davanum Srinivas <davanum@gmail.com>
Date: Mon, 11 Jan 2016 22:10:43 -0500
Subject: [PATCH 0174/2409] Remove Nova object store service

As of I8bf7cbaa7015bb61656ab90ccc8f944aaeebb095, Nova
removed the n-obj service, so we should cleanup

Change-Id: I7db3796a6448decb4ac5e66d980f487c7d1f394e
---
 doc/source/guides/devstack-with-lbaas-v2.rst | 2 +-
 doc/source/stackrc.rst                       | 2 +-
 lib/nova                                     | 9 ++-------
 samples/local.conf                           | 7 +++----
 4 files changed, 7 insertions(+), 13 deletions(-)

diff --git a/doc/source/guides/devstack-with-lbaas-v2.rst b/doc/source/guides/devstack-with-lbaas-v2.rst
index f3bd2feb45..d79e0f8885 100644
--- a/doc/source/guides/devstack-with-lbaas-v2.rst
+++ b/doc/source/guides/devstack-with-lbaas-v2.rst
@@ -46,7 +46,7 @@ Edit your ``local.conf`` to look like
     # Horizon
     ENABLED_SERVICES+=,horizon
     # Nova
-    ENABLED_SERVICES+=,n-api,n-crt,n-obj,n-cpu,n-cond,n-sch
+    ENABLED_SERVICES+=,n-api,n-crt,n-cpu,n-cond,n-sch
     # Glance
     ENABLED_SERVICES+=,g-api,g-reg
     # Neutron
diff --git a/doc/source/stackrc.rst b/doc/source/stackrc.rst
index b21f74f761..81d4b80b8a 100644
--- a/doc/source/stackrc.rst
+++ b/doc/source/stackrc.rst
@@ -20,7 +20,7 @@ ENABLED\_SERVICES
 
     ::
 
-        ENABLED_SERVICES=g-api,g-reg,key,n-api,n-crt,n-obj,n-cpu,n-net,n-cond,c-sch,c-api,c-vol,n-sch,n-cauth,horizon,rabbit,tempest,$DATABASE_TYPE
+        ENABLED_SERVICES=g-api,g-reg,key,n-api,n-crt,n-cpu,n-net,n-cond,c-sch,c-api,c-vol,n-sch,n-cauth,horizon,rabbit,tempest,$DATABASE_TYPE
 
     Other services that are not enabled by default can be enabled in
     ``localrc``. For example, to add Swift, use the following service
diff --git a/lib/nova b/lib/nova
index c97f5174b6..cbf7c5f2bd 100644
--- a/lib/nova
+++ b/lib/nova
@@ -450,7 +450,7 @@ function create_nova_accounts {
     fi
 
     # S3
-    if is_service_enabled n-obj swift3; then
+    if is_service_enabled swift3; then
         if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
 
             get_or_create_service "s3" "s3" "S3"
@@ -869,11 +869,6 @@ function start_nova_rest {
     run_process n-cauth "$NOVA_BIN_DIR/nova-consoleauth --config-file $api_cell_conf"
     run_process n-sproxy "$NOVA_BIN_DIR/nova-serialproxy --config-file $api_cell_conf"
 
-    # Starting the nova-objectstore only if swift3 service is not enabled.
-    # Swift will act as s3 objectstore.
-    is_service_enabled swift3 || \
-        run_process n-obj "$NOVA_BIN_DIR/nova-objectstore --config-file $api_cell_conf"
-
     export PATH=$old_path
 }
 
@@ -907,7 +902,7 @@ function stop_nova_rest {
     # Kill the nova screen windows
     # Some services are listed here twice since more than one instance
     # of a service may be running in certain configs.
-    for serv in n-api n-crt n-net n-sch n-novnc n-xvnc n-cauth n-spice n-cond n-cell n-cell n-api-meta n-obj n-sproxy; do
+    for serv in n-api n-crt n-net n-sch n-novnc n-xvnc n-cauth n-spice n-cond n-cell n-cell n-api-meta n-sproxy; do
         stop_process $serv
     done
 }
diff --git a/samples/local.conf b/samples/local.conf
index 34c9e8b48e..92231bbe87 100644
--- a/samples/local.conf
+++ b/samples/local.conf
@@ -86,10 +86,9 @@ LOGDAYS=2
 # Swift
 # -----
 
-# Swift is now used as the back-end for the S3-like object store. If Nova's
-# objectstore (``n-obj`` in ``ENABLED_SERVICES``) is enabled, it will NOT
-# run if Swift is enabled. Setting the hash value is required and you will
-# be prompted for it if Swift is enabled so just set it to something already:
+# Swift is now used as the back-end for the S3-like object store. Setting the
+# hash value is required and you will be prompted for it if Swift is enabled
+# so just set it to something already:
 SWIFT_HASH=66a3d6b56c1f479c8b4e70ab5c2000f5
 
 # For development purposes the default of 3 replicas is usually not required.

From ed9487a885caf81b9283f39702261d91c94ac393 Mon Sep 17 00:00:00 2001
From: "Davanum Srinivas (dims)" <davanum@gmail.com>
Date: Mon, 11 Jan 2016 21:20:34 +0000
Subject: [PATCH 0175/2409] Revert "Don't die when yum fails."

This reverts commit 2babf3963f4eea8558b0c287c51e6faeb7069c70.

This breaks oslo.messaging jobs:
http://logs.openstack.org/32/265932/1/check/gate-oslo.messaging-dsvm-functional-amqp1-centos7/f5f3eb9/console.html#_2016-01-11_20_03_33_162

@kgiusti reports that PIPESTATUS[0] is always 1 on his centos7 box

Change-Id: I013c22a3545f22c79a0616b4a98622d41bb17d77
---
 functions-common | 14 +++++---------
 1 file changed, 5 insertions(+), 9 deletions(-)

diff --git a/functions-common b/functions-common
index dbf605cdd8..c6bf648511 100644
--- a/functions-common
+++ b/functions-common
@@ -1334,17 +1334,13 @@ function yum_install {
             BEGIN { fail=0 }
             /No package/ { fail=1 }
             { print }
-            END { exit fail }'
-        result=$?
+            END { exit fail }' || \
+                die $LINENO "Missing packages detected"
 
-    if [ $result != 0 ]; then
-        echo $LINENO "Missing packages detected"
-    elif [[ ${PIPESTATUS[0]} != 0 ]]; then
-        # also ensure we catch a yum failure
-        echo $LINENO "${YUM:-yum} install failure"
-        result=1
+    # also ensure we catch a yum failure
+    if [[ ${PIPESTATUS[0]} != 0 ]]; then
+        die $LINENO "${YUM:-yum} install failure"
     fi
-    return $result
 }
 
 # zypper wrapper to set arguments correctly

From 09a3e715ec708a214eef1bed9aef01a593f96673 Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Wed, 13 Jan 2016 11:35:12 +0100
Subject: [PATCH 0176/2409] Create LOGDIR earlier in the process

Specifically, before _install_epel_and_rdo is called, that may need to log an
error.

Change-Id: I4979eb9530e6ea366c99d168587b87ea358dc908
---
 stack.sh | 29 +++++++++++++++--------------
 1 file changed, 15 insertions(+), 14 deletions(-)

diff --git a/stack.sh b/stack.sh
index 5e4a4f8310..21a805170f 100755
--- a/stack.sh
+++ b/stack.sh
@@ -297,16 +297,6 @@ EOF
     fi
 }
 
-# If you have all the repos installed above already setup (e.g. a CI
-# situation where they are on your image) you may choose to skip this
-# to speed things up
-SKIP_EPEL_INSTALL=$(trueorfalse False SKIP_EPEL_INSTALL)
-
-if is_fedora && [[ $DISTRO == "rhel7" ]] && \
-        [[ ${SKIP_EPEL_INSTALL} != True ]]; then
-    _install_epel_and_rdo
-fi
-
 
 # Configure Target Directories
 # ----------------------------
@@ -320,6 +310,11 @@ sudo mkdir -p $DEST
 safe_chown -R $STACK_USER $DEST
 safe_chmod 0755 $DEST
 
+# Destination path for devstack logs
+if [[ -n ${LOGDIR:-} ]]; then
+    mkdir -p $LOGDIR
+fi
+
 # Destination path for service data
 DATA_DIR=${DATA_DIR:-${DEST}/data}
 sudo mkdir -p $DATA_DIR
@@ -333,6 +328,16 @@ if [ -z "`grep ^127.0.0.1 /etc/hosts | grep $LOCAL_HOSTNAME`" ]; then
     sudo sed -i "s/\(^127.0.0.1.*\)/\1 $LOCAL_HOSTNAME/" /etc/hosts
 fi
 
+# If you have all the repos installed above already setup (e.g. a CI
+# situation where they are on your image) you may choose to skip this
+# to speed things up
+SKIP_EPEL_INSTALL=$(trueorfalse False SKIP_EPEL_INSTALL)
+
+if is_fedora && [[ $DISTRO == "rhel7" ]] && \
+        [[ ${SKIP_EPEL_INSTALL} != True ]]; then
+    _install_epel_and_rdo
+fi
+
 # Ensure python is installed
 # --------------------------
 is_package_installed python || install_package python
@@ -392,10 +397,6 @@ TIMESTAMP_FORMAT=${TIMESTAMP_FORMAT:-"%F-%H%M%S"}
 LOGDAYS=${LOGDAYS:-7}
 CURRENT_LOG_TIME=$(date "+$TIMESTAMP_FORMAT")
 
-if [[ -n ${LOGDIR:-} ]]; then
-    mkdir -p $LOGDIR
-fi
-
 if [[ -n "$LOGFILE" ]]; then
     # Clean up old log files.  Append '.*' to the user-specified
     # ``LOGFILE`` to match the date in the search template.

From 5aa2014e67f329f1751052643161b2e0e98ef621 Mon Sep 17 00:00:00 2001
From: Akihiro Motoki <motoki@da.jp.nec.com>
Date: Wed, 13 Jan 2016 22:54:37 +0900
Subject: [PATCH 0177/2409] Remove Neutron NEC plugin completely

override-defaults mechanism allows us to define
s_neutron_plugin_security_group before loading lib/neutron,
and we no longer need to have a plugin-specific file in
the master DevStack repository.

Change-Id: I78a4e05fa72b1dd545b8d9e97a8fd8fdbf23739c
Depends-On: Id6765245459c1aff3aab27dbc60d320ce2951b38
---
 lib/neutron_plugins/nec | 10 ----------
 1 file changed, 10 deletions(-)
 delete mode 100644 lib/neutron_plugins/nec

diff --git a/lib/neutron_plugins/nec b/lib/neutron_plugins/nec
deleted file mode 100644
index 9ea7338696..0000000000
--- a/lib/neutron_plugins/nec
+++ /dev/null
@@ -1,10 +0,0 @@
-#!/bin/bash
-
-# This file is needed so Q_PLUGIN=nec will work.
-
-# FIXME(amotoki): This function should not be here, but unfortunately
-# devstack calls it before the external plugins are fetched
-function has_neutron_plugin_security_group {
-    # 0 means True here
-    return 0
-}

From 7e843edca791224eea1d53fc963267dded0c220b Mon Sep 17 00:00:00 2001
From: Akihiro Motoki <motoki@da.jp.nec.com>
Date: Wed, 13 Jan 2016 23:11:09 +0900
Subject: [PATCH 0178/2409] Remove Neutron Midonet plugin file completely

override-defaults mechanism allows us to define
s_neutron_plugin_security_group before loading lib/neutron,
and we no longer need to have a plugin-specific file in
the master DevStack repository.

Change-Id: I37d5012e89cb3650e4f325b6d77d70f28f87d3e7
Depends-On: I5e02acd288e53dd06a369d348ec77ead57d476fd
---
 lib/neutron_plugins/midonet | 10 ----------
 1 file changed, 10 deletions(-)
 delete mode 100644 lib/neutron_plugins/midonet

diff --git a/lib/neutron_plugins/midonet b/lib/neutron_plugins/midonet
deleted file mode 100644
index ca0b70c76c..0000000000
--- a/lib/neutron_plugins/midonet
+++ /dev/null
@@ -1,10 +0,0 @@
-#!/bin/bash
-
-# REVISIT(devvesa): This file is needed so Q_PLUGIN=midonet will work.
-
-# FIXME(yamamoto): This function should not be here, but unfortunately
-# devstack calls it before the external plugins are fetched
-function has_neutron_plugin_security_group {
-    # 0 means True here
-    return 0
-}

From ac8ff0f1e9e5116c390bf8a711c950bcaca71d32 Mon Sep 17 00:00:00 2001
From: Davanum Srinivas <davanum@gmail.com>
Date: Wed, 13 Jan 2016 17:28:43 -0500
Subject: [PATCH 0179/2409] Support for logging the nova-dhcpbridge command
 line

We are seeing a lot of gate failures as vm(s) are unable to acquire
DHCP leases:
https://bugs.launchpad.net/nova/+bug/1532809

we need to set log_file for nova-dhcpbridge configuration, so clone
the nova.conf and set the log_file properly to a path where the
CI can pick up from for analysis.

Change-Id: Iec4fe3f2235da9d1f5bd399d4ffc45af516c58ce
---
 lib/nova | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index cbf7c5f2bd..094eed87ad 100644
--- a/lib/nova
+++ b/lib/nova
@@ -478,7 +478,6 @@ function create_nova_conf {
     iniset $NOVA_CONF DEFAULT rootwrap_config "$NOVA_CONF_DIR/rootwrap.conf"
     iniset $NOVA_CONF DEFAULT scheduler_driver "$SCHEDULER"
     iniset $NOVA_CONF DEFAULT scheduler_default_filters "$FILTERS"
-    iniset $NOVA_CONF DEFAULT dhcpbridge_flagfile "$NOVA_CONF"
     iniset $NOVA_CONF DEFAULT force_dhcp_release "True"
     iniset $NOVA_CONF DEFAULT default_floating_pool "$PUBLIC_NETWORK_NAME"
     iniset $NOVA_CONF DEFAULT s3_host "$SERVICE_HOST"
@@ -633,6 +632,11 @@ function create_nova_conf {
         iniset $NOVA_CONF serial_console enabled True
     fi
     iniset $NOVA_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
+
+    # Setup logging for nova-dhcpbridge command line
+    sudo cp "$NOVA_CONF" "$NOVA_CONF_DIR/nova-dhcpbridge.conf"
+    iniset "$NOVA_CONF_DIR/nova-dhcpbridge.conf" DEFAULT log_file "/opt/stack/logs/nova-dhcpbridge.log"
+    iniset $NOVA_CONF DEFAULT dhcpbridge_flagfile "$NOVA_CONF_DIR/nova-dhcpbridge.conf"
 }
 
 function init_nova_cells {

From ba0a659c762e07951cd4f3e305aa5bd09a1a2918 Mon Sep 17 00:00:00 2001
From: Boris Pavlovic <boris@pavlovic.me>
Date: Thu, 14 Jan 2016 17:31:40 -0800
Subject: [PATCH 0180/2409] Make OSprofiler repo and branch configurable

OSprofiler is now under Oslo:
https://review.openstack.org/#/c/103825/

And we really need this patch to make proper dsvm job for
OSprofiler

Change-Id: I20f59c52c147303de01544dc975a82b4a741a1b9
---
 lib/oslo                     | 1 +
 stackrc                      | 4 ++++
 tests/test_libs_from_pypi.sh | 2 +-
 3 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/lib/oslo b/lib/oslo
index 3d6fbb38c6..6f5c7d17c4 100644
--- a/lib/oslo
+++ b/lib/oslo
@@ -44,6 +44,7 @@ GITDIR["oslo.service"]=$DEST/oslo.service
 GITDIR["oslo.utils"]=$DEST/oslo.utils
 GITDIR["oslo.versionedobjects"]=$DEST/oslo.versionedobjects
 GITDIR["oslo.vmware"]=$DEST/oslo.vmware
+GITDIR["osprofiler"]=$DEST/osprofiler
 GITDIR["pycadf"]=$DEST/pycadf
 GITDIR["stevedore"]=$DEST/stevedore
 GITDIR["taskflow"]=$DEST/taskflow
diff --git a/stackrc b/stackrc
index 16621f1660..1786a44ff3 100644
--- a/stackrc
+++ b/stackrc
@@ -407,6 +407,10 @@ GITBRANCH["oslo.versionedobjects"]=${OSLOVERSIONEDOBJECTS_BRANCH:-master}
 GITREPO["oslo.vmware"]=${OSLOVMWARE_REPO:-${GIT_BASE}/openstack/oslo.vmware.git}
 GITBRANCH["oslo.vmware"]=${OSLOVMWARE_BRANCH:-master}
 
+# osprofiler
+GITREPO["osprofiler"]=${OSPROFILER_REPO:-${GIT_BASE}/openstack/osprofiler.git}
+GITBRANCH["osprofiler"]=${OSPROFILER_BRANCH:-master}
+
 # pycadf auditing library
 GITREPO["pycadf"]=${PYCADF_REPO:-${GIT_BASE}/openstack/pycadf.git}
 GITBRANCH["pycadf"]=${PYCADF_BRANCH:-master}
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index f31560a1fe..326241df82 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -40,7 +40,7 @@ ALL_LIBS+=" python-openstackclient oslo.rootwrap oslo.i18n"
 ALL_LIBS+=" oslo.utils python-swiftclient"
 ALL_LIBS+=" python-neutronclient tooz ceilometermiddleware oslo.policy"
 ALL_LIBS+=" debtcollector os-brick automaton futurist oslo.service"
-ALL_LIBS+=" oslo.cache oslo.reports"
+ALL_LIBS+=" oslo.cache oslo.reports osprofiler"
 ALL_LIBS+=" keystoneauth ironic-lib oslo.privsep"
 
 # Generate the above list with

From bd7a51200f3a3c11ca5f18f0b7f95ee9049e1e40 Mon Sep 17 00:00:00 2001
From: Davanum Srinivas <davanum@gmail.com>
Date: Thu, 14 Jan 2016 12:11:23 -0500
Subject: [PATCH 0181/2409] Better location for the nova dhcp logs

Use LOGDIR to compute the location of the dhcp logs
instead of hardcoding to /opt/stack/logs/

Change-Id: I97ca2d8c8b7901e0895fe89a57675caf8effea53
---
 lib/nova | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index 094eed87ad..62481edfce 100644
--- a/lib/nova
+++ b/lib/nova
@@ -635,7 +635,19 @@ function create_nova_conf {
 
     # Setup logging for nova-dhcpbridge command line
     sudo cp "$NOVA_CONF" "$NOVA_CONF_DIR/nova-dhcpbridge.conf"
-    iniset "$NOVA_CONF_DIR/nova-dhcpbridge.conf" DEFAULT log_file "/opt/stack/logs/nova-dhcpbridge.log"
+
+    local service="n-dhcp"
+    local logfile="${service}.log.${CURRENT_LOG_TIME}"
+    local real_logfile="${LOGDIR}/${logfile}"
+    if [[ -n ${LOGDIR} ]]; then
+        bash -c "cd '$LOGDIR' && ln -sf '$logfile' ${service}.log"
+        iniset "$NOVA_CONF_DIR/nova-dhcpbridge.conf" DEFAULT log_file "$real_logfile"
+        if [[ -n ${SCREEN_LOGDIR} ]]; then
+            # Drop the backward-compat symlink
+            ln -sf "$real_logfile" ${SCREEN_LOGDIR}/screen-${service}.log
+        fi
+    fi
+
     iniset $NOVA_CONF DEFAULT dhcpbridge_flagfile "$NOVA_CONF_DIR/nova-dhcpbridge.conf"
 }
 

From 2dd761b16950603555409e33ac63a196eefd2607 Mon Sep 17 00:00:00 2001
From: Bob Ball <bob.ball@citrix.com>
Date: Fri, 15 Jan 2016 13:56:37 +0000
Subject: [PATCH 0182/2409] XenAPI: Fix disk_formats verified by tempest

lib/glance restricts the disk_formats to those supported by XenAPI, so
tempest needs a similar restriction for the disk_formats tested.

Confirmed as passing internal Citrix CI (affected tempest jobs are
currently disabled in voting XenServer CI until this change lands)

Change-Id: Iefa5b16a3fa1789ed583426ea47ebb22e6cb571e
---
 lib/tempest | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index 76fd6cac74..a824b52aae 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -314,6 +314,9 @@ function configure_tempest {
     if [[ ! -z "$TEMPEST_HTTP_IMAGE" ]]; then
         iniset $TEMPEST_CONFIG image http_image $TEMPEST_HTTP_IMAGE
     fi
+    if [ "$VIRT_DRIVER" = "xenserver" ]; then
+        iniset $TEMPEST_CONFIG image disk_formats "ami,ari,aki,vhd,raw,iso"
+    fi
 
     # Image Features
     iniset $TEMPEST_CONFIG image-feature-enabled deactivate_image True

From 16246acb4c3d81e2907ba938b9404a0fc9d30ff6 Mon Sep 17 00:00:00 2001
From: Steve Martinelli <stevemar@ca.ibm.com>
Date: Mon, 18 Jan 2016 01:20:53 -0500
Subject: [PATCH 0183/2409] remove clouds.yaml files when running clean.sh

There have been a few reported errors of folks running into
issues with old clouds.yaml files that linger around. Remove
these if the user runs clean.sh.

1. http://lists.openstack.org/pipermail/openstack-dev/2016-January/084283.html
2. https://ask.openstack.org/en/question/84825/glance-upload_image-fails-in-latest-devstack/
3. https://ask.openstack.org/en/question/86071/devstack-installation-failure/

Change-Id: I618ea8e27b49af360c905df85af06d9b1eef8407
---
 clean.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/clean.sh b/clean.sh
index fc6f80dad4..5da78519ba 100755
--- a/clean.sh
+++ b/clean.sh
@@ -137,6 +137,7 @@ FILES_TO_CLEAN=".localrc.auto .localrc.password "
 FILES_TO_CLEAN+="docs/files docs/html shocco/ "
 FILES_TO_CLEAN+="stack-screenrc test*.conf* test.ini* "
 FILES_TO_CLEAN+=".stackenv .prereqs"
+FILES_TO_CLEAN+="/etc/openstack/ ~/.config/openstack"
 
 for file in $FILES_TO_CLEAN; do
     rm -rf $TOP_DIR/$file

From f90c0b7d29abe58d7d10608599e6399cf6adc509 Mon Sep 17 00:00:00 2001
From: Dmitry Tantsur <dtantsur@redhat.com>
Date: Mon, 18 Jan 2016 10:52:59 +0100
Subject: [PATCH 0184/2409] Stop referencing no longer existing
 SERVICE_ENDPOINT variable

It was probably finally removed by one of recent refactoring changes.
Now ironic gate fails due to Swift trying to access it to override OS_AUTH_URL.
This change drops this override and just uses OS_AUTH_URL.

Closes-Bug: #1535245
Change-Id: I145bec110c4299e61f2bce49df41dcd82e5d462d
---
 lib/swift              | 1 -
 tools/create_userrc.sh | 2 --
 2 files changed, 3 deletions(-)

diff --git a/lib/swift b/lib/swift
index b596142ad2..9edeb0ab79 100644
--- a/lib/swift
+++ b/lib/swift
@@ -817,7 +817,6 @@ function swift_configure_tempurls {
     OS_USERNAME=swift \
     OS_PASSWORD=$SERVICE_PASSWORD \
     OS_PROJECT_NAME=$SERVICE_TENANT_NAME \
-    OS_AUTH_URL=$SERVICE_ENDPOINT \
     openstack object store account \
         set --property "Temp-URL-Key=$SWIFT_TEMPURL_KEY"
 }
diff --git a/tools/create_userrc.sh b/tools/create_userrc.sh
index 93d5d69342..74d5428382 100755
--- a/tools/create_userrc.sh
+++ b/tools/create_userrc.sh
@@ -156,8 +156,6 @@ if [ -z "$MODE" ]; then
     exit 3
 fi
 
-export -n SERVICE_ENDPOINT OS_SERVICE_ENDPOINT
-
 EC2_URL=$(openstack endpoint list --service ec2 --interface public --os-identity-api-version=3 -c URL -f value || true)
 if [[ -z $EC2_URL ]]; then
     EC2_URL=http://localhost:8773/

From 8e3df96cec11ae32fba6a6031ee60850251789f9 Mon Sep 17 00:00:00 2001
From: Steve Martinelli <stevemar@ca.ibm.com>
Date: Mon, 18 Jan 2016 14:00:41 -0500
Subject: [PATCH 0185/2409] use sudo to remove /etc/openstack directory

the /etc/openstack directory needs to be removed with sudo privs,
the loop at the end will not suffice.

Change-Id: Icc0ac45f9216d538ca214176d90241f973a4687b
---
 clean.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/clean.sh b/clean.sh
index 5da78519ba..c8b822317d 100755
--- a/clean.sh
+++ b/clean.sh
@@ -104,7 +104,7 @@ if is_service_enabled nova && [[ -r $NOVA_PLUGINS/hypervisor-$VIRT_DRIVER ]]; th
 fi
 
 # Clean out /etc
-sudo rm -rf /etc/keystone /etc/glance /etc/nova /etc/cinder /etc/swift /etc/heat /etc/neutron
+sudo rm -rf /etc/keystone /etc/glance /etc/nova /etc/cinder /etc/swift /etc/heat /etc/neutron /etc/openstack/
 
 # Clean out tgt
 sudo rm -f /etc/tgt/conf.d/*
@@ -136,8 +136,8 @@ rm -rf $DIRS_TO_CLEAN
 FILES_TO_CLEAN=".localrc.auto .localrc.password "
 FILES_TO_CLEAN+="docs/files docs/html shocco/ "
 FILES_TO_CLEAN+="stack-screenrc test*.conf* test.ini* "
-FILES_TO_CLEAN+=".stackenv .prereqs"
-FILES_TO_CLEAN+="/etc/openstack/ ~/.config/openstack"
+FILES_TO_CLEAN+=".stackenv .prereqs "
+FILES_TO_CLEAN+="~/.config/openstack"
 
 for file in $FILES_TO_CLEAN; do
     rm -rf $TOP_DIR/$file

From cf04a9acb395cd31b231da17cba779ff61b6e8eb Mon Sep 17 00:00:00 2001
From: Wanlong Gao <wanlong.gao@easystack.cn>
Date: Sat, 16 Jan 2016 17:46:35 +0800
Subject: [PATCH 0186/2409] notification_driver is deprecated to driver

TrivialFix
https://review.openstack.org/#/c/249508/

Change-Id: I18599c7221272279dfc2e9f5b297af09faff5c3b
---
 lib/cinder         | 2 +-
 lib/glance         | 4 ++--
 lib/neutron-legacy | 2 +-
 lib/nova           | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 9ca8109023..144f41beea 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -299,7 +299,7 @@ function configure_cinder {
     fi
 
     if is_service_enabled ceilometer; then
-        iniset $CINDER_CONF DEFAULT notification_driver "messaging"
+        iniset $CINDER_CONF oslo_messaging_notifications driver "messaging"
     fi
 
     if is_service_enabled tls-proxy; then
diff --git a/lib/glance b/lib/glance
index 19e7937ad3..0431bba024 100644
--- a/lib/glance
+++ b/lib/glance
@@ -113,7 +113,7 @@ function configure_glance {
     iniset $GLANCE_REGISTRY_CONF DEFAULT workers "$API_WORKERS"
     iniset $GLANCE_REGISTRY_CONF paste_deploy flavor keystone
     configure_auth_token_middleware $GLANCE_REGISTRY_CONF glance $GLANCE_AUTH_CACHE_DIR/registry
-    iniset $GLANCE_REGISTRY_CONF DEFAULT notification_driver messaging
+    iniset $GLANCE_REGISTRY_CONF oslo_messaging_notifications driver messaging
     iniset_rpc_backend glance $GLANCE_REGISTRY_CONF
     iniset $GLANCE_REGISTRY_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
 
@@ -126,7 +126,7 @@ function configure_glance {
     iniset $GLANCE_API_CONF DEFAULT image_cache_dir $GLANCE_CACHE_DIR/
     iniset $GLANCE_API_CONF paste_deploy flavor keystone+cachemanagement
     configure_auth_token_middleware $GLANCE_API_CONF glance $GLANCE_AUTH_CACHE_DIR/api
-    iniset $GLANCE_API_CONF DEFAULT notification_driver messaging
+    iniset $GLANCE_API_CONF oslo_messaging_notifications driver messaging
     iniset_rpc_backend glance $GLANCE_API_CONF
     if [ "$VIRT_DRIVER" = 'xenserver' ]; then
         iniset $GLANCE_API_CONF DEFAULT container_formats "ami,ari,aki,bare,ovf,tgz"
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 692d5eae16..9497a23595 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -1072,7 +1072,7 @@ function _configure_neutron_metadata_agent {
 }
 
 function _configure_neutron_ceilometer_notifications {
-    iniset $NEUTRON_CONF DEFAULT notification_driver messaging
+    iniset $NEUTRON_CONF oslo_messaging_notifications driver messaging
 }
 
 function _configure_neutron_lbaas {
diff --git a/lib/nova b/lib/nova
index cbf7c5f2bd..0110ad7303 100644
--- a/lib/nova
+++ b/lib/nova
@@ -557,7 +557,7 @@ function create_nova_conf {
         iniset $NOVA_CONF DEFAULT instance_usage_audit "True"
         iniset $NOVA_CONF DEFAULT instance_usage_audit_period "hour"
         iniset $NOVA_CONF DEFAULT notify_on_state_change "vm_and_task_state"
-        iniset $NOVA_CONF DEFAULT notification_driver "messaging"
+        iniset $NOVA_CONF oslo_messaging_notifications driver "messaging"
     fi
 
     # All nova-compute workers need to know the vnc configuration options

From ba6fb27bc874b940a2a8a34e24a6c34ecabb3ba8 Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Tue, 19 Jan 2016 08:15:36 -0800
Subject: [PATCH 0187/2409] Remove vme and ssse3 from gate64 cpu mapping

It turns out that we need to be even more restrictive on the cpu flags
we expose as some clouds don't expose vme or ssse3.

Fixes-Bug: 1535799
Change-Id: I6c8c1101771d1c5496884be7a405285472ae803a
---
 tools/cpu_map_update.py | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/tools/cpu_map_update.py b/tools/cpu_map_update.py
index 1938793114..92b7b8f9a3 100755
--- a/tools/cpu_map_update.py
+++ b/tools/cpu_map_update.py
@@ -30,7 +30,8 @@ def update_cpu_map(tree):
             x86 = arch
             break
     if x86 is not None:
-        # Create a gate64 cpu model that is core2duo less monitor and pse36
+        # Create a gate64 cpu model that is core2duo less monitor, pse36,
+        # vme, and ssse3.
         gate64 = ET.SubElement(x86, "model")
         gate64.set("name", "gate64")
         ET.SubElement(gate64, "vendor").set("name", "Intel")
@@ -51,13 +52,11 @@ def update_cpu_map(tree):
         ET.SubElement(gate64, "feature").set("name", "fxsr")
         ET.SubElement(gate64, "feature").set("name", "sse")
         ET.SubElement(gate64, "feature").set("name", "sse2")
-        ET.SubElement(gate64, "feature").set("name", "vme")
         ET.SubElement(gate64, "feature").set("name", "mtrr")
         ET.SubElement(gate64, "feature").set("name", "mca")
         ET.SubElement(gate64, "feature").set("name", "clflush")
         ET.SubElement(gate64, "feature").set("name", "pni")
         ET.SubElement(gate64, "feature").set("name", "nx")
-        ET.SubElement(gate64, "feature").set("name", "ssse3")
         ET.SubElement(gate64, "feature").set("name", "syscall")
         ET.SubElement(gate64, "feature").set("name", "lm")
 

From 4af2afcd52db5b278cf2660ef4e1d502c20cd5ff Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Tue, 13 Oct 2015 09:51:17 -0400
Subject: [PATCH 0188/2409] Add subunit output for total elapsed time

This commit adds a success output for the entire devstack run to the
subunit output. Ideally we wouldn't need this, but because we don't
have timing data for every single operation performed by devstack we
need to do this to track the total duration of the devstack run.

To capture failures this commit adds saving a devstack event when we
trip the exit_trap. This will save a similar result to the stream in
the successful case, but instead mark it as a failure.

Depends-On: Icc7df33e4d73ba6322af38fbdf3aea230f2fcf4d
Change-Id: I07112dde996c3e2c73f5aafc9b73d33d26374633
---
 stack.sh | 8 ++++++++
 stackrc  | 3 +++
 2 files changed, 11 insertions(+)

diff --git a/stack.sh b/stack.sh
index e9831d5039..abd6a4d11e 100755
--- a/stack.sh
+++ b/stack.sh
@@ -42,6 +42,8 @@ if [[ -n "$NOUNSET" ]]; then
     set -o nounset
 fi
 
+# Set start of devstack timestamp
+DEVSTACK_START_TIME=$(date +%s)
 
 # Configuration
 # =============
@@ -481,11 +483,14 @@ function exit_trap {
 
     if [[ $r -ne 0 ]]; then
         echo "Error on exit"
+        generate-subunit $DEVSTACK_START_TIME $SECONDS 'fail' >> ${SUBUNIT_OUTPUT}
         if [[ -z $LOGDIR ]]; then
             $TOP_DIR/tools/worlddump.py
         else
             $TOP_DIR/tools/worlddump.py -d $LOGDIR
         fi
+    else
+        generate-subunit $DEVSTACK_START_TIME $SECONDS >> ${SUBUNIT_OUTPUT}
     fi
 
     exit $r
@@ -710,6 +715,9 @@ if [[ "$OFFLINE" != "True" ]]; then
     PYPI_ALTERNATIVE_URL=${PYPI_ALTERNATIVE_URL:-""} $TOP_DIR/tools/install_pip.sh
 fi
 
+# Install subunit for the subunit output stream
+pip_install -U os-testr
+
 TRACK_DEPENDS=${TRACK_DEPENDS:-False}
 
 # Install Python packages into a virtualenv so that we can track them
diff --git a/stackrc b/stackrc
index 16621f1660..c521ecfbaf 100644
--- a/stackrc
+++ b/stackrc
@@ -29,6 +29,9 @@ DATA_DIR=${DEST}/data
 # Destination for status files
 SERVICE_DIR=${DEST}/status
 
+# Path for subunit output file
+SUBUNIT_OUTPUT=${DEST}/devstack.subunit
+
 # Determine stack user
 if [[ $EUID -eq 0 ]]; then
     STACK_USER=stack

From 1d27155f650e9b8e4053a201f1f08c494b820de2 Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Tue, 19 Jan 2016 20:29:46 -0500
Subject: [PATCH 0189/2409] Cap installed pip to be < 8

Pip 8 just release which made uninstalling distutils installed packages
fatal. This was previously a deprecation warning and is now causing all
dsvm jobs to fail.

Depends-On: I511d216d9d8619c7cf919c482aaead4e833cdaac
Change-Id: I22f5c3af1adf96cfbd5747122f915a82e947843a
---
 tools/cap-pip.txt    | 1 +
 tools/install_pip.sh | 4 ++--
 2 files changed, 3 insertions(+), 2 deletions(-)
 create mode 100644 tools/cap-pip.txt

diff --git a/tools/cap-pip.txt b/tools/cap-pip.txt
new file mode 100644
index 0000000000..1a6f80c506
--- /dev/null
+++ b/tools/cap-pip.txt
@@ -0,0 +1 @@
+pip<8
diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index f239c7bb16..542a28454d 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -77,9 +77,9 @@ function install_get_pip {
             die $LINENO "Download of get-pip.py failed"
         touch $LOCAL_PIP.downloaded
     fi
-    sudo -H -E python $LOCAL_PIP
+    sudo -H -E python $LOCAL_PIP -c $TOOLS_DIR/cap-pip.txt
     if python3_enabled; then
-        sudo -H -E python${PYTHON3_VERSION} $LOCAL_PIP
+        sudo -H -E python${PYTHON3_VERSION} $LOCAL_PIP -c $TOOLS_DIR/cap-pip.txt
     fi
 }
 

From 5dcbf7aeffb6c98f723f3045c22de23ed38f4510 Mon Sep 17 00:00:00 2001
From: Federico Ressi <federico.ressi@intel.com>
Date: Wed, 13 Jan 2016 12:17:32 +0000
Subject: [PATCH 0190/2409] Don't die when yum fails.

Not all yum failures has to be considered
catastrofic failures also because install_package
function should implement the same behavior in Fedora,
CentOS and Ubuntu. Let return the error to be solved at higher
level.

Change-Id: I93e9f312a94aeb086925e069a83ec1d3d3419423
Closes-Bug: #1522590
---
 functions-common | 52 +++++++++++++++++++++++++++++++++---------------
 1 file changed, 36 insertions(+), 16 deletions(-)

diff --git a/functions-common b/functions-common
index 47276f0c34..b6350cebd7 100644
--- a/functions-common
+++ b/functions-common
@@ -1320,27 +1320,35 @@ function uninstall_package {
 # Uses globals ``OFFLINE``, ``*_proxy``, ``YUM``
 # yum_install package [package ...]
 function yum_install {
+    local result parse_yum_result
+
     [[ "$OFFLINE" = "True" ]] && return
-    local sudo="sudo"
-    [[ "$(id -u)" = "0" ]] && sudo="env"
+
+    time_start "yum_install"
+
+    # Warning: this would not work if yum output message
+    # have been translated to another language
+    parse_yum_result='\
+        BEGIN { result=0 }\
+        /^YUM_FAILED/ { exit $2 }\
+        /^No package/ { result=1 }\
+        //{ print }\
+        END { exit result }'
 
     # The manual check for missing packages is because yum -y assumes
-    # missing packages are OK.  See
-    # https://bugzilla.redhat.com/show_bug.cgi?id=965567
-    $sudo http_proxy="${http_proxy:-}" https_proxy="${https_proxy:-}" \
-        no_proxy="${no_proxy:-}" \
-        ${YUM:-yum} install -y "$@" 2>&1 | \
-        awk '
-            BEGIN { fail=0 }
-            /No package/ { fail=1 }
-            { print }
-            END { exit fail }' || \
-                die $LINENO "Missing packages detected"
+    # missing packages are OK.
+    # See https://bugzilla.redhat.com/show_bug.cgi?id=965567
+    (sudo_with_proxies "${YUM:-yum}" install -y "$@" 2>&1 || echo YUM_FAILED $?) \
+        | awk "$parse_yum_result"
+    result=$?
 
-    # also ensure we catch a yum failure
-    if [[ ${PIPESTATUS[0]} != 0 ]]; then
-        die $LINENO "${YUM:-yum} install failure"
+    if [ "$result" != 0 ]; then
+        echo $LINENO "${YUM:-yum}" install failure: $result
     fi
+
+    time_stop "yum_install"
+
+    return "$result"
 }
 
 # zypper wrapper to set arguments correctly
@@ -2279,6 +2287,18 @@ function test_with_retry {
     time_stop "test_with_retry"
 }
 
+# Like sudo but forwarding http_proxy https_proxy no_proxy environment vars.
+# If it is run as superuser then sudo is replaced by env.
+#
+function sudo_with_proxies {
+    local sudo
+
+    [[ "$(id -u)" = "0" ]] && sudo="env" || sudo="sudo"
+
+    $sudo http_proxy="${http_proxy:-}" https_proxy="${https_proxy:-}"\
+        no_proxy="${no_proxy:-}" "$@"
+}
+
 # Timing infrastructure - figure out where large blocks of time are
 # used in DevStack
 #

From 06cfce37560243d22cd05b2c620be6702528a0b1 Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Thu, 14 Jan 2016 15:31:31 +0100
Subject: [PATCH 0191/2409] neutron: enable ml2 mtu calculation mechanism

Setting path_mtu to reflect mtu for physical devices that handle traffic
issued from br-tun makes ml2 plugin to calculate mtu for tenant networks
properly, considering encapsulation headers. After that, calculated mtu
values can be propagated into instances (currently, only DHCP approach
is implemented; RA support for IPv6 subnets is under review).

This change allows to run tunnelled tenant networks in multinode when
underlying physical devices don't support jumbo frames.

Note: changing the default value in neutron would not be backwards
compatible, since it could slow down east-west tunnelled traffic in
clouds that run on jumbo-aware networks.

Change-Id: I8287677c7ad0f13fa9f5cb194f9372d04b78cb61
Related-Bug: #1527675
---
 lib/neutron_plugins/ml2 | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/lib/neutron_plugins/ml2 b/lib/neutron_plugins/ml2
index 30e1b036f3..0483ef1fac 100644
--- a/lib/neutron_plugins/ml2
+++ b/lib/neutron_plugins/ml2
@@ -40,6 +40,12 @@ Q_ML2_PLUGIN_EXT_DRIVERS=${Q_ML2_PLUGIN_EXT_DRIVERS-port_security}
 # L3 Plugin to load for ML2
 ML2_L3_PLUGIN=${ML2_L3_PLUGIN:-neutron.services.l3_router.l3_router_plugin.L3RouterPlugin}
 
+# Underlying path MTU for physical network managing br-tun; use '-' instead of
+# ':-' to allow people to explicitly override this to blank, to disable
+# automatic MTU calculation for tunnelled tenant networks
+Q_ML2_PLUGIN_PATH_MTU=${Q_ML2_PLUGIN_PATH_MTU-1500}
+
+
 function populate_ml2_config {
     CONF=$1
     SECTION=$2
@@ -77,6 +83,12 @@ function neutron_plugin_configure_service {
         echo "WARNING - The ml2 plugin is using local tenant networks, with no connectivity between hosts."
     fi
 
+    # Enable ml2 mtu calculation mechanism for networks by providing path mtu
+    # value for physical devices that are used for br-tun traffic
+    if [[ "$ENABLE_TENANT_TUNNELS" == "True" ]] && [[ "$Q_ML2_PLUGIN_PATH_MTU" != "" ]]; then
+        iniset /$Q_PLUGIN_CONF_FILE ml2 path_mtu "$Q_ML2_PLUGIN_PATH_MTU"
+    fi
+
     # Allow for overrding VLAN configuration (for example, to configure provider
     # VLANs) by first checking if Q_ML2_PLUGIN_VLAN_TYPE_OPTIONS is set.
     if [ "$Q_ML2_PLUGIN_VLAN_TYPE_OPTIONS" == "" ]; then

From 74379df11f6ce2e76d1448f4ffd6db9528768727 Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Thu, 21 Jan 2016 10:20:08 -0500
Subject: [PATCH 0192/2409] Remove leftover homedir clouds.yaml files

We don't write files here anymore, but it's higher in the precedence
order than the /etc/openstack/clouds.yaml file we do write. Some
developers who have long-lived devstacks who update infrequently have
been bitten by the leftover file.

Change-Id: I8af6bd465f74099c560dddba6b5221dd79cbc965
---
 functions-common | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/functions-common b/functions-common
index 47276f0c34..12c925b0ff 100644
--- a/functions-common
+++ b/functions-common
@@ -106,6 +106,9 @@ function write_clouds_yaml {
         --os-username admin \
         --os-password $ADMIN_PASSWORD \
         --os-project-name admin
+
+    # CLean up any old clouds.yaml files we had laying around
+    rm -f ~$STACK_USER/.config/openstack/clouds.yaml
 }
 
 # trueorfalse <True|False> <VAR>

From 6e187218820afaa4f05f34ce0483c21170369db1 Mon Sep 17 00:00:00 2001
From: Yusuke Hayashi <hayashi-yusuke@jp.fujitsu.com>
Date: Fri, 22 Jan 2016 00:08:31 +0900
Subject: [PATCH 0193/2409] Rdo-release install failure under proxy

In RHEL under proxy, installation by stack.sh failed
because of rdo-release.rpm install failure.

This patch fixes install command for rdo-release.rpm
because it is caused by lack of http(s)_proxy.

Change-Id: I176d1e140f52e1bb0343170ba4d90c06b98d5a99
Closes-Bug: #1536478
---
 stack.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index e9831d5039..6f43785254 100755
--- a/stack.sh
+++ b/stack.sh
@@ -290,7 +290,7 @@ EOF
     sudo yum-config-manager --enable rhel-7-server-optional-rpms
 
     # install the lastest RDO
-    sudo yum install -y https://rdoproject.org/repos/rdo-release.rpm
+    is_package_installed rdo-release || yum_install https://rdoproject.org/repos/rdo-release.rpm
 
     if is_oraclelinux; then
         sudo yum-config-manager --enable ol7_optional_latest ol7_addons ol7_MySQL56

From 5997ce3ab657293bda11c69b6078e9290676e54b Mon Sep 17 00:00:00 2001
From: Morgan Fainberg <morgan.fainberg@gmail.com>
Date: Wed, 20 Jan 2016 12:43:22 -0800
Subject: [PATCH 0194/2409] Always cache tokens in a shared memcache

Instead of using in-process caching for tokens per service per
worker (disabled by default now), use a shared memcache to cache
token validation(s). This should both offload/speedup validations
and avoid the issues surrounding inconsistent validation responses
when using in-process caching [since each worker caches separately].

Change-Id: Ifc17c27744dac5ad55e84752ca6f68169c2f5a86
---
 files/debs/keystone      |  1 +
 files/rpms-suse/keystone |  1 +
 files/rpms/keystone      |  1 +
 lib/keystone             | 19 ++++++++-----------
 4 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/files/debs/keystone b/files/debs/keystone
index 370e4aac51..fd0317b9b6 100644
--- a/files/debs/keystone
+++ b/files/debs/keystone
@@ -1,5 +1,6 @@
 libkrb5-dev
 libldap2-dev
 libsasl2-dev
+memcached
 python-mysqldb
 sqlite3
diff --git a/files/rpms-suse/keystone b/files/rpms-suse/keystone
index 46832c786d..66cfc23423 100644
--- a/files/rpms-suse/keystone
+++ b/files/rpms-suse/keystone
@@ -1,3 +1,4 @@
 cyrus-sasl-devel
+memcached
 openldap2-devel
 sqlite3
diff --git a/files/rpms/keystone b/files/rpms/keystone
index c01c261e19..170308373a 100644
--- a/files/rpms/keystone
+++ b/files/rpms/keystone
@@ -1,3 +1,4 @@
+memcached
 mod_ssl
 MySQL-python
 sqlite
diff --git a/lib/keystone b/lib/keystone
index 78904de5ab..7592804efa 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -430,6 +430,7 @@ function configure_auth_token_middleware {
     iniset $conf_file $section auth_uri $KEYSTONE_SERVICE_URI
     iniset $conf_file $section cafile $SSL_BUNDLE_FILE
     iniset $conf_file $section signing_dir $signing_dir
+    iniset $conf_file $section memcache_servers $SERVICE_HOST:11211
 }
 
 # init_keystone() - Initialize databases, etc.
@@ -483,6 +484,9 @@ function install_keystonemiddleware {
         # When not installing from repo, keystonemiddleware is still needed...
         pip_install_gr keystonemiddleware
     fi
+    # Install the memcache library so keystonemiddleware can cache tokens in a
+    # shared location.
+    pip_install_gr python-memcached
 }
 
 # install_keystone() - Collect source and prepare
@@ -491,17 +495,7 @@ function install_keystone {
     if is_service_enabled ldap; then
         install_ldap
     fi
-    if [[ "$KEYSTONE_TOKEN_BACKEND" = "memcache" ]]; then
-        # Install memcached and the memcache Python library that keystone uses.
-        # Unfortunately the Python library goes by different names in the .deb
-        # and .rpm circles.
-        install_package memcached
-        if is_ubuntu; then
-            install_package python-memcache
-        else
-            install_package python-memcached
-        fi
-    fi
+
     git_clone $KEYSTONE_REPO $KEYSTONE_DIR $KEYSTONE_BRANCH
     setup_develop $KEYSTONE_DIR
 
@@ -550,6 +544,9 @@ function start_keystone {
         start_tls_proxy '*' $KEYSTONE_SERVICE_PORT $KEYSTONE_SERVICE_HOST $KEYSTONE_SERVICE_PORT_INT &
         start_tls_proxy '*' $KEYSTONE_AUTH_PORT $KEYSTONE_AUTH_HOST $KEYSTONE_AUTH_PORT_INT &
     fi
+
+    # (re)start memcached to make sure we have a clean memcache.
+    restart_service memcached
 }
 
 # stop_keystone() - Stop running processes

From 61aa0e9f1968c9991dee7bb5aec9a2a63ac0339d Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Fri, 22 Jan 2016 07:48:49 -0500
Subject: [PATCH 0195/2409] reduce default lease time to 5 minutes

Devstack used in development is about things coming and going
quickly. The long dhcp leases mean that we might miss a release, and
keep a stale lease around for way too long. See if this helps.

Change-Id: I9a58a4e64777f56ad7ec66242a319f985469469e
---
 lib/nova | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/nova b/lib/nova
index 6521cd7eba..df2b977274 100644
--- a/lib/nova
+++ b/lib/nova
@@ -689,6 +689,8 @@ function create_nova_conf_nova_network {
     iniset $NOVA_CONF DEFAULT public_interface "$PUBLIC_INTERFACE"
     iniset $NOVA_CONF DEFAULT vlan_interface "$VLAN_INTERFACE"
     iniset $NOVA_CONF DEFAULT flat_network_bridge "$FLAT_NETWORK_BRIDGE"
+    # force down dhcp leases to 5 minutes, which lets us expire faster
+    iniset $NOVA_CONF DEFAULT dhcp_lease_time 300
     if [ -n "$FLAT_INTERFACE" ]; then
         iniset $NOVA_CONF DEFAULT flat_interface "$FLAT_INTERFACE"
     fi

From 19363fc1e79e70d390da0f4d0a19a5ef476b11d4 Mon Sep 17 00:00:00 2001
From: Markus Zoeller <mzoeller@de.ibm.com>
Date: Fri, 22 Jan 2016 16:35:28 +0100
Subject: [PATCH 0196/2409] remove "redhat-rpm-config" (F21 dependency)

Commit d5004a380294e05963d4de39007f3336e975fb0f introduced the package
"redhat-rpm-config" to make the Fedora 21 gate job running again.

As we dropped the F21 support in December 2015 with
commit 90bc5867728aafb66b374ae6e6a93318303dcff0 we don't need
this package anymore.

Change-Id: I71b969b7fd6651082451f6c4fd1e01d205771a11
---
 files/rpms/general | 1 -
 1 file changed, 1 deletion(-)

diff --git a/files/rpms/general b/files/rpms/general
index 5bc87b6172..e0ef54cf9a 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -26,7 +26,6 @@ postgresql-devel  # psycopg2
 psmisc
 pyOpenSSL # version in pip uses too much memory
 python-devel
-redhat-rpm-config # MySQL-python rhbz-1195207
 screen
 tar
 tcpdump

From c2bd0d5b7d07a73c84273003041f00bf6a780e2a Mon Sep 17 00:00:00 2001
From: Gang Wei <gang.wei@intel.com>
Date: Mon, 25 Jan 2016 00:39:51 +0000
Subject: [PATCH 0197/2409] Remove call to deprecated method in tempest

Fix below warning:
"Use of: 'verify-tempest-config' is deprecated, please use: 'tempest verify-config'"

Change-Id: If66096cde31fedda407e1e6ac6899b196569a454
---
 lib/tempest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index 7fe63dd498..457252b7c8 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -325,7 +325,7 @@ function configure_tempest {
     local tmp_cfg_file
     tmp_cfg_file=$(mktemp)
     cd $TEMPEST_DIR
-    tox -revenv -- verify-tempest-config -uro $tmp_cfg_file
+    tox -revenv -- tempest verify-config -uro $tmp_cfg_file
 
     local compute_api_extensions=${COMPUTE_API_EXTENSIONS:-"all"}
     if [[ ! -z "$DISABLE_COMPUTE_API_EXTENSIONS" ]]; then

From 40e2f508e42a793379c3bd1184bf1b7f36faa4d4 Mon Sep 17 00:00:00 2001
From: Allen Gao <wanlong.gao@easystack.cn>
Date: Tue, 19 Jan 2016 08:53:37 +0800
Subject: [PATCH 0198/2409] Remove option 'DEFAULT/verbose'

Option "verbose" from group "DEFAULT" is deprecated for removal.
Its value may be silently ignored in the future.

If this option is not set explicitly, there is no such warning.
Furthermore, the default value of verbose is true, so there is
no need to set this value in config files.

TrivialFix

Change-Id: I581238e661c2eb0c29dd915d1b1e4773dcdeb4c8
---
 lib/cinder         | 1 -
 lib/neutron-legacy | 6 ------
 2 files changed, 7 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 144f41beea..3aea05023f 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -259,7 +259,6 @@ function configure_cinder {
 
     iniset $CINDER_CONF DEFAULT auth_strategy keystone
     iniset $CINDER_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-    iniset $CINDER_CONF DEFAULT verbose True
 
     iniset $CINDER_CONF DEFAULT iscsi_helper "$CINDER_ISCSI_HELPER"
     iniset $CINDER_CONF database connection `database_connection_url cinder`
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 9497a23595..8bddcd9b3f 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -993,7 +993,6 @@ function _configure_neutron_debug_command {
 
     cp $NEUTRON_DIR/etc/l3_agent.ini.sample $NEUTRON_TEST_CONFIG_FILE
 
-    iniset $NEUTRON_TEST_CONFIG_FILE DEFAULT verbose False
     iniset $NEUTRON_TEST_CONFIG_FILE DEFAULT debug False
     iniset $NEUTRON_TEST_CONFIG_FILE AGENT root_helper "$Q_RR_COMMAND"
     if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
@@ -1009,7 +1008,6 @@ function _configure_neutron_dhcp_agent {
 
     cp $NEUTRON_DIR/etc/dhcp_agent.ini.sample $Q_DHCP_CONF_FILE
 
-    iniset $Q_DHCP_CONF_FILE DEFAULT verbose True
     iniset $Q_DHCP_CONF_FILE DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
     iniset $Q_DHCP_CONF_FILE AGENT root_helper "$Q_RR_COMMAND"
     if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
@@ -1041,7 +1039,6 @@ function _configure_neutron_l3_agent {
 
     cp $NEUTRON_DIR/etc/l3_agent.ini.sample $Q_L3_CONF_FILE
 
-    iniset $Q_L3_CONF_FILE DEFAULT verbose True
     iniset $Q_L3_CONF_FILE DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
     iniset $Q_L3_CONF_FILE AGENT root_helper "$Q_RR_COMMAND"
     if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
@@ -1062,7 +1059,6 @@ function _configure_neutron_l3_agent {
 function _configure_neutron_metadata_agent {
     cp $NEUTRON_DIR/etc/metadata_agent.ini.sample $Q_META_CONF_FILE
 
-    iniset $Q_META_CONF_FILE DEFAULT verbose True
     iniset $Q_META_CONF_FILE DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
     iniset $Q_META_CONF_FILE DEFAULT nova_metadata_ip $Q_META_DATA_IP
     iniset $Q_META_CONF_FILE AGENT root_helper "$Q_RR_COMMAND"
@@ -1126,7 +1122,6 @@ function _configure_neutron_plugin_agent {
     if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
         iniset /$Q_PLUGIN_CONF_FILE  agent root_helper_daemon "$Q_RR_DAEMON_COMMAND"
     fi
-    iniset $NEUTRON_CONF DEFAULT verbose True
     iniset $NEUTRON_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
 
     # Configure agent for plugin
@@ -1146,7 +1141,6 @@ function _configure_neutron_service {
         iniset $NEUTRON_CONF DEFAULT service_plugins $Q_SERVICE_PLUGIN_CLASSES
     fi
 
-    iniset $NEUTRON_CONF DEFAULT verbose True
     iniset $NEUTRON_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
     iniset $NEUTRON_CONF oslo_policy policy_file $Q_POLICY_FILE
     iniset $NEUTRON_CONF DEFAULT allow_overlapping_ips $Q_ALLOW_OVERLAPPING_IP

From 5544c4a74fb985d10bc3f27fa7778a5824248979 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 25 Jan 2016 08:27:06 -0500
Subject: [PATCH 0199/2409] always default to floating ips for validation

fixed ips are not cross host accessible in our current config. So
always configure tempest to use floating ips.

Change-Id: I1cf605229070024c9d5d29c7a08967aa505fda7b
---
 lib/tempest | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 7fe63dd498..3c34aad539 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -127,7 +127,7 @@ function configure_tempest {
     local flavor_lines
     local public_network_id
     local public_router_id
-    local ssh_connect_method="fixed"
+    local ssh_connect_method="floating"
 
     # Save IFS
     ifs=$IFS
@@ -236,10 +236,6 @@ function configure_tempest {
         fi
     fi
 
-    if ! is_service_enabled n-net; then
-        ssh_connect_method="floating"
-    fi
-
     ssh_connect_method=${TEMPEST_SSH_CONNECT_METHOD:-$ssh_connect_method}
 
     if [ "$Q_L3_ENABLED" = "True" ]; then

From 75446deea06107fa63a7f08990f0de26e5761833 Mon Sep 17 00:00:00 2001
From: Allen Gao <wanlong.gao@easystack.cn>
Date: Mon, 25 Jan 2016 17:59:31 +0800
Subject: [PATCH 0200/2409] Remove the pip version pinning to < 8

The pip issue pypa/pip#3384 has already been fixed after pip 8.0.1
released. But leave the facility to easy flip this on in the future.

TrivialFix

Change-Id: I49658ce4056c773943321270defd461bbf3e9fb9
---
 tools/cap-pip.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/cap-pip.txt b/tools/cap-pip.txt
index 1a6f80c506..c280267641 100644
--- a/tools/cap-pip.txt
+++ b/tools/cap-pip.txt
@@ -1 +1 @@
-pip<8
+pip!=8

From fadebe1be337e076109860f28b213f327fc95283 Mon Sep 17 00:00:00 2001
From: Boris Pavlovic <boris@pavlovic.me>
Date: Mon, 25 Jan 2016 12:32:32 -0800
Subject: [PATCH 0201/2409] Fix OSprofiler installation from Git

Without this line DevStack fails to install OSprofiler from git

Change-Id: I0fe0e10bcece51759fbf4fd4a533b01501414d6d
---
 lib/oslo | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/oslo b/lib/oslo
index 6f5c7d17c4..1773da2975 100644
--- a/lib/oslo
+++ b/lib/oslo
@@ -89,6 +89,7 @@ function install_oslo {
     _do_install_oslo_lib "oslo.utils"
     _do_install_oslo_lib "oslo.versionedobjects"
     _do_install_oslo_lib "oslo.vmware"
+    _do_install_oslo_lib "osprofiler"
     _do_install_oslo_lib "pycadf"
     _do_install_oslo_lib "stevedore"
     _do_install_oslo_lib "taskflow"

From e826490a437e13a493f53b7751bea58dff2b30f5 Mon Sep 17 00:00:00 2001
From: Ronald Bradford <ronald.bradford@gmail.com>
Date: Wed, 20 Jan 2016 21:16:33 +0000
Subject: [PATCH 0202/2409] Simplify oslo.log configuration options

Use the preferred logging_user_identity_format option to specify an alternative context format
in log files.  The removal of defining logging_context_format_string brings this more inline
with optimal production configuration of using the defined default.  logging_user_identity_format
is set in devstack to maintain current compatibility of names instead of ids.

Change-Id: I3807d76b91b6cc1614b4a9a203509f8e1ad7146d
---
 lib/neutron-legacy | 2 +-
 lib/nova           | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 692d5eae16..978cbdb89c 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -963,7 +963,7 @@ function _configure_neutron_common {
         setup_colorized_logging $NEUTRON_CONF DEFAULT project_id
     else
         # Show user_name and project_name by default like in nova
-        iniset $NEUTRON_CONF DEFAULT logging_context_format_string "%(asctime)s.%(msecs)03d %(levelname)s %(name)s [%(request_id)s %(user_name)s %(project_name)s] %(instance)s%(message)s"
+        iniset $NEUTRON_CONF DEFAULT logging_user_identity_format "%(user_name)s %(project_name)s"
     fi
 
     if is_service_enabled tls-proxy; then
diff --git a/lib/nova b/lib/nova
index 62481edfce..b9769a739d 100644
--- a/lib/nova
+++ b/lib/nova
@@ -546,7 +546,7 @@ function create_nova_conf {
         setup_colorized_logging $NOVA_CONF DEFAULT
     else
         # Show user_name and project_name instead of user_id and project_id
-        iniset $NOVA_CONF DEFAULT logging_context_format_string "%(asctime)s.%(msecs)03d %(levelname)s %(name)s [%(request_id)s %(user_name)s %(project_name)s] %(instance)s%(message)s"
+        iniset $NOVA_CONF DEFAULT logging_user_identity_format "%(user_name)s %(project_name)s"
     fi
     if [ "$NOVA_USE_MOD_WSGI" == "True" ]; then
         _config_nova_apache_wsgi

From b162a1d58cdecfb32847b59bd341e06c26efb1ed Mon Sep 17 00:00:00 2001
From: Paulo Ewerton <pauloewerton@lsd.ufcg.edu.br>
Date: Fri, 22 Jan 2016 19:13:31 +0000
Subject: [PATCH 0203/2409] Move default Keystone API version to v3

This patch sets Keystone v3 as default in services
configuration files and in the openrc and stackrc scripts.

Change-Id: I24546f02067ea23d088d383b85e3a78d7b43f165
Partially-Implements: bp keystonev3
---
 lib/glance                         |  2 +-
 lib/heat                           |  2 +-
 lib/nova_plugins/hypervisor-ironic |  2 +-
 lib/tempest                        |  5 +----
 openrc                             | 11 +++++++++--
 stackrc                            |  2 +-
 tools/create_userrc.sh             |  4 ++--
 7 files changed, 16 insertions(+), 12 deletions(-)

diff --git a/lib/glance b/lib/glance
index 0431bba024..bf0643bf53 100644
--- a/lib/glance
+++ b/lib/glance
@@ -205,7 +205,7 @@ function configure_glance {
     iniset $GLANCE_CACHE_CONF DEFAULT use_syslog $SYSLOG
     iniset $GLANCE_CACHE_CONF DEFAULT image_cache_dir $GLANCE_CACHE_DIR/
     iniuncomment $GLANCE_CACHE_CONF DEFAULT auth_url
-    iniset $GLANCE_CACHE_CONF DEFAULT auth_url $KEYSTONE_AUTH_URI/v2.0
+    iniset $GLANCE_CACHE_CONF DEFAULT auth_url $KEYSTONE_AUTH_URI/v3
     iniuncomment $GLANCE_CACHE_CONF DEFAULT auth_tenant_name
     iniset $GLANCE_CACHE_CONF DEFAULT admin_tenant_name $SERVICE_TENANT_NAME
     iniuncomment $GLANCE_CACHE_CONF DEFAULT auth_user
diff --git a/lib/heat b/lib/heat
index df44b7689c..3c3be79ad7 100644
--- a/lib/heat
+++ b/lib/heat
@@ -167,7 +167,7 @@ function configure_heat {
     iniset $HEAT_CONF clients_keystone auth_uri $KEYSTONE_AUTH_URI
 
     # ec2authtoken
-    iniset $HEAT_CONF ec2authtoken auth_uri $KEYSTONE_SERVICE_URI/v2.0
+    iniset $HEAT_CONF ec2authtoken auth_uri $KEYSTONE_SERVICE_URI/v3
 
     # OpenStack API
     iniset $HEAT_CONF heat_api bind_port $HEAT_API_PORT
diff --git a/lib/nova_plugins/hypervisor-ironic b/lib/nova_plugins/hypervisor-ironic
index c6ed85d63e..2aa9b12ae3 100644
--- a/lib/nova_plugins/hypervisor-ironic
+++ b/lib/nova_plugins/hypervisor-ironic
@@ -47,7 +47,7 @@ function configure_nova_hypervisor {
     # ironic section
     iniset $NOVA_CONF ironic admin_username admin
     iniset $NOVA_CONF ironic admin_password $ADMIN_PASSWORD
-    iniset $NOVA_CONF ironic admin_url $KEYSTONE_AUTH_URI/v2.0
+    iniset $NOVA_CONF ironic admin_url $KEYSTONE_AUTH_URI/v3
     iniset $NOVA_CONF ironic admin_tenant_name demo
     iniset $NOVA_CONF ironic api_endpoint $IRONIC_SERVICE_PROTOCOL://$IRONIC_HOSTPORT/v1
 }
diff --git a/lib/tempest b/lib/tempest
index 3c34aad539..4a289fa859 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -259,6 +259,7 @@ function configure_tempest {
     # Identity
     iniset $TEMPEST_CONFIG identity uri "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:5000/v2.0/"
     iniset $TEMPEST_CONFIG identity uri_v3 "$KEYSTONE_SERVICE_URI_V3"
+    iniset $TEMPEST_CONFIG identity auth_version ${TEMPEST_AUTH_VERSION:-v3}
     if [[ "$TEMPEST_HAS_ADMIN" == "True" ]]; then
         iniset $TEMPEST_CONFIG auth admin_username $ADMIN_USERNAME
         iniset $TEMPEST_CONFIG auth admin_password "$password"
@@ -269,10 +270,6 @@ function configure_tempest {
     if [ "$ENABLE_IDENTITY_V2" == "False" ]; then
         # Only Identity v3 is available; then skip Identity API v2 tests
         iniset $TEMPEST_CONFIG identity-feature-enabled api_v2 False
-        # In addition, use v3 auth tokens for running all Tempest tests
-        iniset $TEMPEST_CONFIG identity auth_version v3
-    else
-        iniset $TEMPEST_CONFIG identity auth_version ${TEMPEST_AUTH_VERSION:-v2}
     fi
 
     if is_ssl_enabled_service "key" || is_service_enabled tls-proxy; then
diff --git a/openrc b/openrc
index 9bc0fd77f4..f81345f9fa 100644
--- a/openrc
+++ b/openrc
@@ -77,15 +77,22 @@ KEYSTONE_AUTH_PROTOCOL=${KEYSTONE_AUTH_PROTOCOL:-$SERVICE_PROTOCOL}
 KEYSTONE_AUTH_HOST=${KEYSTONE_AUTH_HOST:-$SERVICE_HOST}
 
 # Identity API version
-export OS_IDENTITY_API_VERSION=${IDENTITY_API_VERSION:-2.0}
+export OS_IDENTITY_API_VERSION=${IDENTITY_API_VERSION:-3}
 
 # Authenticating against an OpenStack cloud using Keystone returns a **Token**
 # and **Service Catalog**.  The catalog contains the endpoints for all services
 # the user/tenant has access to - including nova, glance, keystone, swift, ...
-# We currently recommend using the 2.0 *identity api*.
+# We currently recommend using the version 3 *identity api*.
 #
 export OS_AUTH_URL=$KEYSTONE_AUTH_PROTOCOL://$KEYSTONE_AUTH_HOST:5000/v${OS_IDENTITY_API_VERSION}
 
+# Currently, in order to use openstackclient with Identity API v3,
+# we need to set the domain which the user and project belong to.
+if [ "$OS_IDENTITY_API_VERSION" = "3" ]; then
+    export OS_USER_DOMAIN_ID=${OS_USER_DOMAIN_ID:-"default"}
+    export OS_PROJECT_DOMAIN_ID=${OS_PROJECT_DOMAIN_ID:-"default"}
+fi
+
 # Set OS_CACERT to a default CA certificate chain if it exists.
 if [[ ! -v OS_CACERT ]] ; then
     DEFAULT_OS_CACERT=$INT_CA_DIR/ca-chain.pem
diff --git a/stackrc b/stackrc
index 58146a4a1c..903da80dec 100644
--- a/stackrc
+++ b/stackrc
@@ -130,7 +130,7 @@ elif [[ -f $RC_DIR/.localrc.auto ]]; then
 fi
 
 # Configure Identity API version: 2.0, 3
-IDENTITY_API_VERSION=${IDENTITY_API_VERSION:-2.0}
+IDENTITY_API_VERSION=${IDENTITY_API_VERSION:-3}
 
 # Set the option ENABLE_IDENTITY_V2 to True. It defines whether the DevStack
 # deployment will be deploying the Identity v2 pipelines. If this option is set
diff --git a/tools/create_userrc.sh b/tools/create_userrc.sh
index 74d5428382..00a208c21e 100755
--- a/tools/create_userrc.sh
+++ b/tools/create_userrc.sh
@@ -133,7 +133,7 @@ if [ -z "$OS_USERNAME" ]; then
 fi
 
 if [ -z "$OS_AUTH_URL" ]; then
-    export OS_AUTH_URL=http://localhost:5000/v2.0/
+    export OS_AUTH_URL=http://localhost:5000/v3/
 fi
 
 if [ -z "$OS_USER_DOMAIN_ID" -a -z "$OS_USER_DOMAIN_NAME" ]; then
@@ -236,7 +236,7 @@ export EC2_PRIVATE_KEY="$ec2_private_key"
 export EC2_USER_ID=42 #not checked by nova (can be a 12-digit id)
 export EUCALYPTUS_CERT="$ACCOUNT_DIR/cacert.pem"
 export NOVA_CERT="$ACCOUNT_DIR/cacert.pem"
-export OS_AUTH_TYPE=v2password
+export OS_AUTH_TYPE=v3password
 EOF
     if [ -n "$ADDPASS" ]; then
         echo "export OS_PASSWORD=\"$user_passwd\"" >>"$rcfile"

From 4baa4ce2b3ad5450b9eb3f59b61da80ffc990113 Mon Sep 17 00:00:00 2001
From: Mike Spreitzer <mspreitz@us.ibm.com>
Date: Tue, 26 Jan 2016 14:06:17 -0500
Subject: [PATCH 0204/2409] Document using Q_ML2_PLUGIN_PATH_MTU

I tested it, and it works!

Change-Id: Ic345ededc37b2e0b7b5dbeb397aa55540d5c3bd8
Related-Bug: #1527675
---
 doc/source/guides/neutron.rst | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index 84295a50ce..7f93bad4c5 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -23,7 +23,9 @@ Physical Network Setup
 In most cases where DevStack is being deployed with a single
 interface, there is a hardware router that is being used for external
 connectivity and DHCP. The developer machine is connected to this
-network and is on a shared subnet with other machines.
+network and is on a shared subnet with other machines.  The
+`local.conf` exhibited here assumes that 1500 is a reasonable MTU to
+use on that network.
 
 .. nwdiag::
 
@@ -434,6 +436,16 @@ bridge, to forward traffic sent by guest VMs.
 Miscellaneous Tips
 ==================
 
+Non-Standard MTU on the Physical Network
+----------------------------------------
+
+DevStack defaults to assume that the MTU on the physical network
+is 1500.  A different MTU can be specified by adding the following to
+the `localrc` part of `local.conf` on each machine.
+
+::
+    Q_ML2_PLUGIN_PATH_MTU=1500
+
 
 Disabling Next Generation Firewall Tools
 ----------------------------------------

From e1f87963b142f494eb692e424c67512767d29f0f Mon Sep 17 00:00:00 2001
From: Zhenzan Zhou <zhenzan.zhou@intel.com>
Date: Tue, 8 Sep 2015 16:49:52 +0800
Subject: [PATCH 0205/2409] Add notes on live migration configuration

Live migration will not currently work with a multi-node DevStack
environment due to the libvirtd process running as root and the compute
process trying to use the stack user's SSH keys with the default live
migration URI.

The multi-node documentation is updated to outline how to configure the
SSH keys between the source and destination stack and root users so that
live migration will work as expected.

Co-Authored-By: Taylor Peoples <tpeoples@us.ibm.com>
Change-Id: Ifed7e95cd5ba43a05a4099a3664cbefde3e0a749
Closes-Bug: #1487262
---
 doc/source/guides/multinode-lab.rst | 40 +++++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)

diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
index 37c8515e86..392bb1b807 100644
--- a/doc/source/guides/multinode-lab.rst
+++ b/doc/source/guides/multinode-lab.rst
@@ -373,3 +373,43 @@ If you forgot to set the root password you can do this:
 ::
 
     mysqladmin -u root -pnova password 'supersecret'
+
+Live Migration
+--------------
+
+In order for live migration to work with the default live migration URI::
+
+    [libvirt]
+    live_migration_uri = qemu+ssh://stack@%s/system
+
+SSH keys need to be exchanged between each compute node:
+
+1. The SOURCE root user's public RSA key (likely in /root/.ssh/id_rsa.pub)
+   needs to be in the DESTINATION stack user's authorized_keys file
+   (~stack/.ssh/authorized_keys).  This can be accomplished by manually
+   copying the contents from the file on the SOURCE to the DESTINATION.  If
+   you have a password configured for the stack user, then you can use the
+   following command to accomplish the same thing::
+
+        ssh-copy-id -i /root/.ssh/id_rsa.pub stack@DESTINATION
+
+2. The DESTINATION host's public ECDSA key (/etc/ssh/ssh_host_ecdsa_key.pub)
+   needs to be in the SOURCE root user's known_hosts file
+   (/root/.ssh/known_hosts).  This can be accomplished by running the
+   following on the SOURCE machine (hostname must be used)::
+
+        ssh-keyscan -H DEST_HOSTNAME | sudo tee -a /root/.ssh/known_hosts
+
+In essence, this means that every compute node's root user's public RSA key
+must exist in every other compute node's stack user's authorized_keys file and
+every compute node's public ECDSA key needs to be in every other compute
+node's root user's known_hosts file.  Please note that if the root or stack
+user does not have a SSH key, one can be generated using::
+
+    ssh-keygen -t rsa
+
+The above steps are necessary because libvirtd runs as root when the
+live_migration_uri uses the "qemu:///system" family of URIs.  For more
+information, see the `libvirt documentation`_.
+
+.. _libvirt documentation: https://libvirt.org/drvqemu.html#securitydriver

From a8ffe8a4734ceb7dc82ae50addcda96b84e934b7 Mon Sep 17 00:00:00 2001
From: Morgan Fainberg <morgan.fainberg@gmail.com>
Date: Sun, 24 Jan 2016 20:36:35 -0800
Subject: [PATCH 0206/2409] Enable keystone caching

Enable keystone caching since there is now a memcache server available
for the middlewares to cache validation. Offload queries to the
keystone backend to memcache as well.

Change-Id: I6d1d28f5b974e79d44d1e86ea53c666e3f5771df
---
 lib/keystone | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/lib/keystone b/lib/keystone
index 7592804efa..d60a4ba4c9 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -218,6 +218,14 @@ function configure_keystone {
     iniset $KEYSTONE_CONF role driver "$KEYSTONE_ROLE_BACKEND"
     iniset $KEYSTONE_CONF resource driver "$KEYSTONE_RESOURCE_BACKEND"
 
+    # Enable caching
+    iniset $KEYSTONE_CONF cache enabled "True"
+    iniset $KEYSTONE_CONF cache backend "oslo_cache.memcache_pool"
+    iniset $KEYSTONE_CONF cache memcache_servers $SERVICE_HOST:11211
+
+    # Do not cache the catalog backend due to https://bugs.launchpad.net/keystone/+bug/1537617
+    iniset $KEYSTONE_CONF catalog caching "False"
+
     iniset_rpc_backend keystone $KEYSTONE_CONF
 
     # Register SSL certificates if provided

From 2d57f2f88d647dc7433e873f10546242c7fad0f6 Mon Sep 17 00:00:00 2001
From: John Griffith <john.griffith8@gmail.com>
Date: Wed, 27 Jan 2016 13:30:22 -0500
Subject: [PATCH 0207/2409] Remove lib/cinder_backends/solidfire

This was something we used a while back, but since support
for sections was added to devstack local.conf parsing we
don't need this, and actually prefer just using the
sections in local.conf.

Here's an example of how to achieve the same thing via
local.conf sections:

CINDER_ENABLED_BACKENDS=solidfire
TEMPEST_VOLUME_DRIVER=SolidFireDriver
TEMPEST_VOLUME_VENDOR="SolidFire Inc"
TEMPEST_STORAGE_PROTOCOL=iSCSI

[[post-config|$CINDER_CONF]]
[DEFAULT]
CINDER_ENABLED_BACKENDS=solidfire
[solidfire]
volume_driver=cinder.volume.drivers.solidfire.SolidFireDriver
san_ip=192.168.160.3
san_login=admin
san_password=admin
volume_backend_name=solidfire

Change-Id: I8068fd4fb14510b15c31edf490283454f167f6c6
---
 lib/cinder_backends/solidfire | 49 -----------------------------------
 1 file changed, 49 deletions(-)
 delete mode 100644 lib/cinder_backends/solidfire

diff --git a/lib/cinder_backends/solidfire b/lib/cinder_backends/solidfire
deleted file mode 100644
index 16bc527863..0000000000
--- a/lib/cinder_backends/solidfire
+++ /dev/null
@@ -1,49 +0,0 @@
-#!/bin/bash
-#
-# lib/cinder_backends/solidfire
-# Configure the solidfire driver
-
-# Enable with:
-#
-#   CINDER_ENABLED_BACKENDS+=,solidfire:<volume-type-name>
-
-# Dependencies:
-#
-# - ``functions`` file
-# - ``cinder`` configurations
-
-# CINDER_CONF
-
-# configure_cinder_driver - make configuration changes, including those to other services
-
-# Save trace setting
-_XTRACE_CINDER_SOLIDFIRE=$(set +o | grep xtrace)
-set +o xtrace
-
-
-# Entry Points
-# ------------
-
-# configure_cinder_backend_solidfire - Set config files, create data dirs, etc
-function configure_cinder_backend_solidfire {
-    # To use SolidFire, set the following in local.conf:
-    # CINDER_ENABLED_BACKENDS+=,solidfire:<volume-type-name>
-    # SAN_IP=<mvip>
-    # SAN_LOGIN=<cluster-admin-account>
-    # SAN_PASSWORD=<cluster-admin-password>
-
-    local be_name=$1
-    iniset $CINDER_CONF $be_name volume_backend_name $be_name
-    iniset $CINDER_CONF $be_name volume_driver "cinder.volume.drivers.solidfire.SolidFireDriver"
-    iniset $CINDER_CONF $be_name san_ip $SAN_IP
-    iniset $CINDER_CONF $be_name san_login $SAN_LOGIN
-    iniset $CINDER_CONF $be_name san_password $SAN_PASSWORD
-}
-
-
-# Restore xtrace
-$_XTRACE_CINDER_SOLIDFIRE
-
-# Local variables:
-# mode: shell-script
-# End:

From 2977b300132b1006c30d851f5d1a259c009e10ec Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Mon, 25 Jan 2016 09:10:52 -0500
Subject: [PATCH 0208/2409] docs: Linux Bridge configuration for Neutron

Add a section for single interface networking with Linux Bridge.
Change-Id: I595bc539297bf02182db5a33eeb44360e9eef9a3
---
 doc/source/guides/neutron.rst | 51 ++++++++++++++++++++++++++++++++++-
 1 file changed, 50 insertions(+), 1 deletion(-)

diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index 84295a50ce..81f737ff41 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -6,6 +6,8 @@ This guide will walk you through using OpenStack neutron with the ML2
 plugin and the Open vSwitch mechanism driver.
 
 
+.. _single-interface-ovs:
+
 Using Neutron with a Single Interface
 =====================================
 
@@ -74,6 +76,8 @@ serving as a hypervisor for guest instances.
         PUBLIC_NETWORK_GATEWAY="172.18.161.1"
         Q_L3_ENABLED=True
         PUBLIC_INTERFACE=eth0
+
+        # Open vSwitch provider networking configuration
         Q_USE_PROVIDERNET_FOR_PUBLIC=True
         OVS_PHYSICAL_BRIDGE=br-ex
         PUBLIC_BRIDGE=br-ex
@@ -411,7 +415,7 @@ compute node 1.
         # Services that a compute node runs
         ENABLED_SERVICES=n-cpu,rabbit,q-agt
 
-        ## Neutron options
+        ## Open vSwitch provider networking options
         PHYSICAL_NETWORK=default
         OVS_PHYSICAL_BRIDGE=br-ex
         PUBLIC_INTERFACE=eth1
@@ -474,3 +478,48 @@ Extension drivers for the ML2 plugin are set with the variable
 by default. If you want to remove all the extension drivers (even
 'port_security'), set ``Q_ML2_PLUGIN_EXT_DRIVERS`` to blank.
 
+
+Using Linux Bridge instead of Open vSwitch
+------------------------------------------
+
+The configuration for using the Linux Bridge ML2 driver is fairly
+straight forward. The Linux Bridge configuration for DevStack is similar
+to the :ref:`Open vSwitch based single interface <single-interface-ovs>`
+setup, with small modifications for the interface mappings.
+
+
+::
+
+    [[local|localrc]]
+    HOST_IP=172.18.161.6
+    SERVICE_HOST=172.18.161.6
+    MYSQL_HOST=172.18.161.6
+    RABBIT_HOST=172.18.161.6
+    GLANCE_HOSTPORT=172.18.161.6:9292
+    ADMIN_PASSWORD=secrete
+    DATABASE_PASSWORD=secrete
+    RABBIT_PASSWORD=secrete
+    SERVICE_PASSWORD=secrete
+
+    # Do not use Nova-Network
+    disable_service n-net
+    # Enable Neutron
+    ENABLED_SERVICES+=,q-svc,q-dhcp,q-meta,q-agt,q-l3
+
+
+    ## Neutron options
+    Q_USE_SECGROUP=True
+    FLOATING_RANGE="172.18.161.0/24"
+    FIXED_RANGE="10.0.0.0/24"
+    Q_FLOATING_ALLOCATION_POOL=start=172.18.161.250,end=172.18.161.254
+    PUBLIC_NETWORK_GATEWAY="172.18.161.1"
+    Q_L3_ENABLED=True
+    PUBLIC_INTERFACE=eth0
+
+    Q_USE_PROVIDERNET_FOR_PUBLIC=True
+
+    # Linuxbridge Settings
+    Q_AGENT=linuxbridge
+    LB_PHYSICAL_INTERFACE=eth0
+    PUBLIC_PHYSICAL_NETWORK=default
+    LB_INTERFACE_MAPPINGS=default:eth0

From 09883c0a1801daaacd26a7a38d1b72a1b2dbb4e9 Mon Sep 17 00:00:00 2001
From: "John L. Villalovos" <john.l.villalovos@intel.com>
Date: Thu, 21 Jan 2016 18:35:43 -0800
Subject: [PATCH 0209/2409] Set PS4 in stack.sh to provide additional debug
 info

Add:
export PS4='+(${BASH_SOURCE}:${LINENO}): ${FUNCNAME[0]:+${FUNCNAME[0]}(): }'

To stack.sh to provide additional debug info. This will show the
filename, line number, function name, and the content of the line.

An example output line:
+++(/opt/stack/old/devstack/functions-common:675): get_field(): local data field

Info on this PS4 variable found at:
http://wiki.bash-hackers.org/scripting/debuggingtips

Change-Id: I272df6c79f6ff7afa8f102da24706558d9169eda
---
 stack.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/stack.sh b/stack.sh
index e9831d5039..91e7204aae 100755
--- a/stack.sh
+++ b/stack.sh
@@ -23,6 +23,7 @@
 # Print the commands being run so that we can see the command that triggers
 # an error.  It is also useful for following along as the install occurs.
 set -o xtrace
+export PS4='+(${BASH_SOURCE}:${LINENO}): ${FUNCNAME[0]:+${FUNCNAME[0]}(): }'
 
 # Make sure custom grep options don't get in the way
 unset GREP_OPTIONS
@@ -238,6 +239,7 @@ echo "$STACK_USER ALL=(root) NOPASSWD:ALL" >$TEMPFILE
 # see them by forcing ``PATH``
 echo "Defaults:$STACK_USER secure_path=/sbin:/usr/sbin:/usr/bin:/bin:/usr/local/sbin:/usr/local/bin" >> $TEMPFILE
 echo "Defaults:$STACK_USER !requiretty" >> $TEMPFILE
+echo "Defaults env_keep += PS4" >> $TEMPFILE
 chmod 0440 $TEMPFILE
 sudo chown root:root $TEMPFILE
 sudo mv $TEMPFILE /etc/sudoers.d/50_stack_sh

From b298e57c9f44081767c726a36d60caca66f604aa Mon Sep 17 00:00:00 2001
From: Yingxin <yingxin.cheng@intel.com>
Date: Fri, 29 Jan 2016 05:11:27 +0000
Subject: [PATCH 0210/2409] Change scheduler configurations to use entrypoints

Full class path style configuration of options scheduler_host_manager
and scheduler_driver are deprecated because of dependent changes. This
commit changes the related configurations to use entrypoints in setting
up nova scheduler in devstack.

Related to blueprint scheduler-driver-use-stevedore
Depends-On: I8c169e12d9bfacdbdb1dadf68b8a1fa98c5ea5bc
Depends-On: I3fd42ead44487a21eb5cfaf5a91209277ce30ad0

Change-Id: Iad96c270073b63719237cf9a9aa1c2dc4daa213a
---
 lib/nova                           | 2 +-
 lib/nova_plugins/hypervisor-ironic | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/nova b/lib/nova
index 79bef9bd0b..807fdf6dc0 100644
--- a/lib/nova
+++ b/lib/nova
@@ -96,7 +96,7 @@ FORCE_CONFIG_DRIVE=${FORCE_CONFIG_DRIVE:-"True"}
 
 # Nova supports pluggable schedulers.  The default ``FilterScheduler``
 # should work in most cases.
-SCHEDULER=${SCHEDULER:-nova.scheduler.filter_scheduler.FilterScheduler}
+SCHEDULER=${SCHEDULER:-filter_scheduler}
 
 # The following FILTERS contains SameHostFilter and DifferentHostFilter with
 # the default filters.
diff --git a/lib/nova_plugins/hypervisor-ironic b/lib/nova_plugins/hypervisor-ironic
index c6ed85d63e..43e7797371 100644
--- a/lib/nova_plugins/hypervisor-ironic
+++ b/lib/nova_plugins/hypervisor-ironic
@@ -41,7 +41,7 @@ function configure_nova_hypervisor {
 
     iniset $NOVA_CONF DEFAULT compute_driver nova.virt.ironic.IronicDriver
     iniset $NOVA_CONF DEFAULT firewall_driver $LIBVIRT_FIREWALL_DRIVER
-    iniset $NOVA_CONF DEFAULT scheduler_host_manager nova.scheduler.ironic_host_manager.IronicHostManager
+    iniset $NOVA_CONF DEFAULT scheduler_host_manager ironic_host_manager
     iniset $NOVA_CONF DEFAULT ram_allocation_ratio 1.0
     iniset $NOVA_CONF DEFAULT reserved_host_memory_mb 0
     # ironic section

From 4fd874b4f1323ac024d263077e443d7361dd1c0e Mon Sep 17 00:00:00 2001
From: Clint Adams <clint@gcfm.net>
Date: Tue, 19 Jan 2016 18:17:49 -0500
Subject: [PATCH 0211/2409] Add script to autogenerate
 doc/source/plugin-registry.rst

This generates the plugin-registry document from a static header,
a scan of openstack/ git repositories, and a static footer.  It
is intended to be run by a periodic job proposal bot to keep the
list of plugins current.

Change-Id: Ia04ab72900c8efd5d5289fbd7632201dcaa3e5d9
---
 data/devstack-plugins-registry.footer   | 28 ++++++++++++
 data/devstack-plugins-registry.header   | 19 ++++++++
 tools/generate-devstack-plugins-list.sh | 59 +++++++++++++++++++++++++
 3 files changed, 106 insertions(+)
 create mode 100644 data/devstack-plugins-registry.footer
 create mode 100644 data/devstack-plugins-registry.header
 create mode 100644 tools/generate-devstack-plugins-list.sh

diff --git a/data/devstack-plugins-registry.footer b/data/devstack-plugins-registry.footer
new file mode 100644
index 0000000000..669cb8d574
--- /dev/null
+++ b/data/devstack-plugins-registry.footer
@@ -0,0 +1,28 @@
+
+Drivers
+=======
+
++--------------------+-------------------------------------------------+------------------+
+|Plugin Name         |URL                                              |Comments          |
++--------------------+-------------------------------------------------+------------------+
+|dragonflow          |git://git.openstack.org/openstack/dragonflow     |[d1]_             |
++--------------------+-------------------------------------------------+------------------+
+|odl                 |git://git.openstack.org/openstack/networking-odl |[d2]_             |
++--------------------+-------------------------------------------------+------------------+
+
+.. [d1] demonstrates example of installing 3rd party SDN controller
+.. [d2] demonstrates a pretty advanced set of modes that that allow
+        one to run OpenDayLight either from a pre-existing install, or
+        also from source
+
+Alternate Configs
+=================
+
++-------------+------------------------------------------------------------+------------+
+| Plugin Name | URL                                                        | Comments   |
+|             |                                                            |            |
++-------------+------------------------------------------------------------+------------+
+|glusterfs    |git://git.openstack.org/openstack/devstack-plugin-glusterfs |            |
++-------------+------------------------------------------------------------+------------+
+|             |                                                            |            |
++-------------+------------------------------------------------------------+------------+
diff --git a/data/devstack-plugins-registry.header b/data/devstack-plugins-registry.header
new file mode 100644
index 0000000000..9f8a99471c
--- /dev/null
+++ b/data/devstack-plugins-registry.header
@@ -0,0 +1,19 @@
+==========================
+ DevStack Plugin Registry
+==========================
+
+Since we've created the external plugin mechanism, it's gotten used by
+a lot of projects. The following is a list of plugins that currently
+exist. Any project that wishes to list their plugin here is welcomed
+to.
+
+Detected Plugins
+================
+
+The following are plugins that a script has found in the openstack/
+namespace, which includes but is not limited to official OpenStack
+projects.
+
++------------------+------------------------------------------------------------+------------+
+|Plugin Name       |URL                                                         |Date        |
++------------------+------------------------------------------------------------+------------+
diff --git a/tools/generate-devstack-plugins-list.sh b/tools/generate-devstack-plugins-list.sh
new file mode 100644
index 0000000000..6e9e828978
--- /dev/null
+++ b/tools/generate-devstack-plugins-list.sh
@@ -0,0 +1,59 @@
+#!/bin/bash -ex
+
+# Copyright 2016 Hewlett Packard Enterprise Development Company, L.P.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+# This script is intended to be run as a periodic proposal bot job
+# in OpenStack infrastructure, though you can run it as a one-off.
+#
+# In order to function correctly, the environment in which the
+# script runs must have
+#   * git
+#   * all git repos meant to be searched for plugins cloned and
+#     at the desired level of up-to-datedness
+#   * a writable doc/source directory relative to the current
+#     working directory
+#
+# If a file named data/devstack-plugins-registry.header or
+# data/devstack-plugins-registry.footer is found relative to the
+# current working directory, it will be prepended or appended to
+# the generated reStructuredText plugins table respectively.
+
+(
+declare -A plugins
+
+test -r data/devstack-plugins-registry.header && cat data/devstack-plugins-registry.header
+
+pushd ${git_dir:-/opt/openstack} >/dev/null
+for i in *; do
+    pushd ${i} >/dev/null
+    if output="$(git log --diff-filter=A --format='%cd' --date=short -1 -- devstack/plugin.sh)"; then
+        test -n "$output" && plugins[$i]=${output}
+    fi
+    popd >/dev/null
+done
+popd >/dev/null
+
+sorted_plugins=( $(for k in "${!plugins[@]}"; do echo "$k"; done | sort))
+
+for k in "${sorted_plugins[@]}"; do
+    project=${k:0:18}
+    giturl="git://git.openstack.org/openstack/${k:0:26}"
+    pdate="${plugins[$k]}"
+    printf "|%-18s|%-60s|%-12s|\n" "${project}" "${giturl}" "${pdate}"
+    printf "+------------------+------------------------------------------------------------+------------+\n"
+done
+
+test -r data/devstack-plugins-registry.footer && cat data/devstack-plugins-registry.footer
+) > doc/source/plugin-registry.rst

From 74b91c3eaf150eb40a5d5ab2df1533ae192ee26d Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 1 Feb 2016 14:58:20 +0000
Subject: [PATCH 0212/2409] Revert "Move default Keystone API version to v3"

It seems like the fallout from this was not well sorted.
A lot of things aren't working, and there is still vestigial
v2 bits left behind.

This should have come with a much greater warning and some
spot checking of additional services working with this.

This reverts commit b162a1d58cdecfb32847b59bd341e06c26efb1ed.

Change-Id: Ia792b23119c00089542ba08879dca1c29dc80945
---
 lib/glance                         |  2 +-
 lib/heat                           |  2 +-
 lib/nova_plugins/hypervisor-ironic |  2 +-
 lib/tempest                        |  5 ++++-
 openrc                             | 11 ++---------
 stackrc                            |  2 +-
 tools/create_userrc.sh             |  4 ++--
 7 files changed, 12 insertions(+), 16 deletions(-)

diff --git a/lib/glance b/lib/glance
index bf0643bf53..0431bba024 100644
--- a/lib/glance
+++ b/lib/glance
@@ -205,7 +205,7 @@ function configure_glance {
     iniset $GLANCE_CACHE_CONF DEFAULT use_syslog $SYSLOG
     iniset $GLANCE_CACHE_CONF DEFAULT image_cache_dir $GLANCE_CACHE_DIR/
     iniuncomment $GLANCE_CACHE_CONF DEFAULT auth_url
-    iniset $GLANCE_CACHE_CONF DEFAULT auth_url $KEYSTONE_AUTH_URI/v3
+    iniset $GLANCE_CACHE_CONF DEFAULT auth_url $KEYSTONE_AUTH_URI/v2.0
     iniuncomment $GLANCE_CACHE_CONF DEFAULT auth_tenant_name
     iniset $GLANCE_CACHE_CONF DEFAULT admin_tenant_name $SERVICE_TENANT_NAME
     iniuncomment $GLANCE_CACHE_CONF DEFAULT auth_user
diff --git a/lib/heat b/lib/heat
index 3c3be79ad7..df44b7689c 100644
--- a/lib/heat
+++ b/lib/heat
@@ -167,7 +167,7 @@ function configure_heat {
     iniset $HEAT_CONF clients_keystone auth_uri $KEYSTONE_AUTH_URI
 
     # ec2authtoken
-    iniset $HEAT_CONF ec2authtoken auth_uri $KEYSTONE_SERVICE_URI/v3
+    iniset $HEAT_CONF ec2authtoken auth_uri $KEYSTONE_SERVICE_URI/v2.0
 
     # OpenStack API
     iniset $HEAT_CONF heat_api bind_port $HEAT_API_PORT
diff --git a/lib/nova_plugins/hypervisor-ironic b/lib/nova_plugins/hypervisor-ironic
index 2aa9b12ae3..c6ed85d63e 100644
--- a/lib/nova_plugins/hypervisor-ironic
+++ b/lib/nova_plugins/hypervisor-ironic
@@ -47,7 +47,7 @@ function configure_nova_hypervisor {
     # ironic section
     iniset $NOVA_CONF ironic admin_username admin
     iniset $NOVA_CONF ironic admin_password $ADMIN_PASSWORD
-    iniset $NOVA_CONF ironic admin_url $KEYSTONE_AUTH_URI/v3
+    iniset $NOVA_CONF ironic admin_url $KEYSTONE_AUTH_URI/v2.0
     iniset $NOVA_CONF ironic admin_tenant_name demo
     iniset $NOVA_CONF ironic api_endpoint $IRONIC_SERVICE_PROTOCOL://$IRONIC_HOSTPORT/v1
 }
diff --git a/lib/tempest b/lib/tempest
index 4a289fa859..3c34aad539 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -259,7 +259,6 @@ function configure_tempest {
     # Identity
     iniset $TEMPEST_CONFIG identity uri "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:5000/v2.0/"
     iniset $TEMPEST_CONFIG identity uri_v3 "$KEYSTONE_SERVICE_URI_V3"
-    iniset $TEMPEST_CONFIG identity auth_version ${TEMPEST_AUTH_VERSION:-v3}
     if [[ "$TEMPEST_HAS_ADMIN" == "True" ]]; then
         iniset $TEMPEST_CONFIG auth admin_username $ADMIN_USERNAME
         iniset $TEMPEST_CONFIG auth admin_password "$password"
@@ -270,6 +269,10 @@ function configure_tempest {
     if [ "$ENABLE_IDENTITY_V2" == "False" ]; then
         # Only Identity v3 is available; then skip Identity API v2 tests
         iniset $TEMPEST_CONFIG identity-feature-enabled api_v2 False
+        # In addition, use v3 auth tokens for running all Tempest tests
+        iniset $TEMPEST_CONFIG identity auth_version v3
+    else
+        iniset $TEMPEST_CONFIG identity auth_version ${TEMPEST_AUTH_VERSION:-v2}
     fi
 
     if is_ssl_enabled_service "key" || is_service_enabled tls-proxy; then
diff --git a/openrc b/openrc
index f81345f9fa..9bc0fd77f4 100644
--- a/openrc
+++ b/openrc
@@ -77,22 +77,15 @@ KEYSTONE_AUTH_PROTOCOL=${KEYSTONE_AUTH_PROTOCOL:-$SERVICE_PROTOCOL}
 KEYSTONE_AUTH_HOST=${KEYSTONE_AUTH_HOST:-$SERVICE_HOST}
 
 # Identity API version
-export OS_IDENTITY_API_VERSION=${IDENTITY_API_VERSION:-3}
+export OS_IDENTITY_API_VERSION=${IDENTITY_API_VERSION:-2.0}
 
 # Authenticating against an OpenStack cloud using Keystone returns a **Token**
 # and **Service Catalog**.  The catalog contains the endpoints for all services
 # the user/tenant has access to - including nova, glance, keystone, swift, ...
-# We currently recommend using the version 3 *identity api*.
+# We currently recommend using the 2.0 *identity api*.
 #
 export OS_AUTH_URL=$KEYSTONE_AUTH_PROTOCOL://$KEYSTONE_AUTH_HOST:5000/v${OS_IDENTITY_API_VERSION}
 
-# Currently, in order to use openstackclient with Identity API v3,
-# we need to set the domain which the user and project belong to.
-if [ "$OS_IDENTITY_API_VERSION" = "3" ]; then
-    export OS_USER_DOMAIN_ID=${OS_USER_DOMAIN_ID:-"default"}
-    export OS_PROJECT_DOMAIN_ID=${OS_PROJECT_DOMAIN_ID:-"default"}
-fi
-
 # Set OS_CACERT to a default CA certificate chain if it exists.
 if [[ ! -v OS_CACERT ]] ; then
     DEFAULT_OS_CACERT=$INT_CA_DIR/ca-chain.pem
diff --git a/stackrc b/stackrc
index 903da80dec..58146a4a1c 100644
--- a/stackrc
+++ b/stackrc
@@ -130,7 +130,7 @@ elif [[ -f $RC_DIR/.localrc.auto ]]; then
 fi
 
 # Configure Identity API version: 2.0, 3
-IDENTITY_API_VERSION=${IDENTITY_API_VERSION:-3}
+IDENTITY_API_VERSION=${IDENTITY_API_VERSION:-2.0}
 
 # Set the option ENABLE_IDENTITY_V2 to True. It defines whether the DevStack
 # deployment will be deploying the Identity v2 pipelines. If this option is set
diff --git a/tools/create_userrc.sh b/tools/create_userrc.sh
index 00a208c21e..74d5428382 100755
--- a/tools/create_userrc.sh
+++ b/tools/create_userrc.sh
@@ -133,7 +133,7 @@ if [ -z "$OS_USERNAME" ]; then
 fi
 
 if [ -z "$OS_AUTH_URL" ]; then
-    export OS_AUTH_URL=http://localhost:5000/v3/
+    export OS_AUTH_URL=http://localhost:5000/v2.0/
 fi
 
 if [ -z "$OS_USER_DOMAIN_ID" -a -z "$OS_USER_DOMAIN_NAME" ]; then
@@ -236,7 +236,7 @@ export EC2_PRIVATE_KEY="$ec2_private_key"
 export EC2_USER_ID=42 #not checked by nova (can be a 12-digit id)
 export EUCALYPTUS_CERT="$ACCOUNT_DIR/cacert.pem"
 export NOVA_CERT="$ACCOUNT_DIR/cacert.pem"
-export OS_AUTH_TYPE=v3password
+export OS_AUTH_TYPE=v2password
 EOF
     if [ -n "$ADDPASS" ]; then
         echo "export OS_PASSWORD=\"$user_passwd\"" >>"$rcfile"

From f81ae88c55739bbdfee7db711cc6b2e910794e05 Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Mon, 1 Feb 2016 14:00:20 -0500
Subject: [PATCH 0213/2409] docs: Neutron - add required newline for code
 formatting

Otherwise it doesn't render it as the correct HTML tag.

Change-Id: Ibc5c846824c7248c64473512e9dcfe5dd4205924
---
 doc/source/guides/neutron.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index 1e20d7fcbe..c6af953f22 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -448,6 +448,7 @@ is 1500.  A different MTU can be specified by adding the following to
 the `localrc` part of `local.conf` on each machine.
 
 ::
+
     Q_ML2_PLUGIN_PATH_MTU=1500
 
 

From 557cc8159eaeb67587f9bb2724a6b04830688d27 Mon Sep 17 00:00:00 2001
From: Shih-Hao Li <shihli@vmware.com>
Date: Mon, 1 Feb 2016 13:19:12 -0800
Subject: [PATCH 0214/2409] Fix xvpvncproxy_host config path

Fix xvpvncproxy_host config path due to Change
I1e34a0f98de125c8b8b145377835d95035e2b472.

Change-Id: I835950e75509ad54e5dc1c4a740d2e5cfed9f5a9
---
 lib/nova | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index 79bef9bd0b..dc425a19bd 100644
--- a/lib/nova
+++ b/lib/nova
@@ -579,7 +579,7 @@ function create_nova_conf {
         iniset $NOVA_CONF vnc vncserver_listen "$VNCSERVER_LISTEN"
         iniset $NOVA_CONF vnc vncserver_proxyclient_address "$VNCSERVER_PROXYCLIENT_ADDRESS"
         iniset $NOVA_CONF DEFAULT novncproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
-        iniset $NOVA_CONF DEFAULT xvpvncproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
+        iniset $NOVA_CONF vnc xvpvncproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
     else
         iniset $NOVA_CONF vnc enabled false
     fi

From 8eab6ad31b7d34f26c912e7c1e60d39bf596124a Mon Sep 17 00:00:00 2001
From: Jerry Zhao <xyzjerry@gmail.com>
Date: Mon, 1 Feb 2016 18:22:21 -0800
Subject: [PATCH 0215/2409] make fwaas plugin and driver configurable

user can pass fwaas plugin and driver from localrc

Change-Id: Id956d4d7e62ba81f77319c199c9cb9f354b13d12
---
 lib/neutron_plugins/services/firewall | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/lib/neutron_plugins/services/firewall b/lib/neutron_plugins/services/firewall
index 2b7f32d233..40968fa04c 100644
--- a/lib/neutron_plugins/services/firewall
+++ b/lib/neutron_plugins/services/firewall
@@ -7,7 +7,8 @@
 _XTRACE_NEUTRON_FIREWALL=$(set +o | grep xtrace)
 set +o xtrace
 
-FWAAS_PLUGIN=neutron_fwaas.services.firewall.fwaas_plugin.FirewallPlugin
+FWAAS_PLUGIN=${FWAAS_PLUGIN:-neutron_fwaas.services.firewall.fwaas_plugin.FirewallPlugin}
+FWAAS_DRIVER=${FWAAS_DRIVER:-neutron_fwaas.services.firewall.drivers.linux.iptables_fwaas.IptablesFwaasDriver}
 
 function neutron_fwaas_configure_common {
     _neutron_service_plugin_class_add $FWAAS_PLUGIN
@@ -21,7 +22,7 @@ function neutron_fwaas_configure_driver {
     cp $NEUTRON_FWAAS_DIR/etc/fwaas_driver.ini.sample $FWAAS_DRIVER_CONF_FILENAME
 
     iniset_multiline $FWAAS_DRIVER_CONF_FILENAME fwaas enabled True
-    iniset_multiline $FWAAS_DRIVER_CONF_FILENAME fwaas driver "neutron_fwaas.services.firewall.drivers.linux.iptables_fwaas.IptablesFwaasDriver"
+    iniset_multiline $FWAAS_DRIVER_CONF_FILENAME fwaas driver "$FWAAS_DRIVER"
 }
 
 function neutron_fwaas_stop {

From c67d22e2ed0eb3fa0786f4314752ab7b26758ea3 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 2 Feb 2016 05:51:14 -0500
Subject: [PATCH 0216/2409] make the alt_demo user during normal install

For testing reasons it's typically very useful to have a second non
admin user to cross check that it can't do a thing to the first
user. It was useful enough we always created it with tempest (though
we didn't always use it).

This makes devstack always create an alt_demo user, which is available
in occ as devstack-alt. This will help us unwind some of the keystone
v3 breaks with functional tests using keystone cli to build this
second user.

Change-Id: Iaaf02469180563e2d8c413fee0ee66ada2296cfa
---
 extras.d/80-tempest.sh |  3 +--
 functions-common       | 15 +++++++++++++++
 lib/keystone           | 16 ++++++++++++++++
 lib/tempest            | 15 ---------------
 4 files changed, 32 insertions(+), 17 deletions(-)

diff --git a/extras.d/80-tempest.sh b/extras.d/80-tempest.sh
index 5e8da99a92..fcf79bd4d9 100644
--- a/extras.d/80-tempest.sh
+++ b/extras.d/80-tempest.sh
@@ -9,7 +9,7 @@ if is_service_enabled tempest; then
         install_tempest
     elif [[ "$1" == "stack" && "$2" == "post-config" ]]; then
         # Tempest config must come after layer 2 services are running
-        create_tempest_accounts
+        :
     elif [[ "$1" == "stack" && "$2" == "extra" ]]; then
         echo_summary "Initializing Tempest"
         configure_tempest
@@ -28,4 +28,3 @@ if is_service_enabled tempest; then
         :
     fi
 fi
-
diff --git a/functions-common b/functions-common
index 12c925b0ff..2a08f5f112 100644
--- a/functions-common
+++ b/functions-common
@@ -86,6 +86,7 @@ function write_clouds_yaml {
     if [ -f "$SSL_BUNDLE_FILE" ]; then
         CA_CERT_ARG="--os-cacert $SSL_BUNDLE_FILE"
     fi
+    # demo -> devstack
     $TOP_DIR/tools/update_clouds_yaml.py \
         --file $CLOUDS_YAML \
         --os-cloud devstack \
@@ -96,6 +97,20 @@ function write_clouds_yaml {
         --os-username demo \
         --os-password $ADMIN_PASSWORD \
         --os-project-name demo
+
+    # alt_demo -> devstack-alt
+    $TOP_DIR/tools/update_clouds_yaml.py \
+        --file $CLOUDS_YAML \
+        --os-cloud devstack \
+        --os-region-name $REGION_NAME \
+        --os-identity-api-version 3 \
+        $CA_CERT_ARG \
+        --os-auth-url $KEYSTONE_AUTH_URI \
+        --os-username alt_demo \
+        --os-password $ADMIN_PASSWORD \
+        --os-project-name alt_demo
+
+    # admin -> devstack-admin
     $TOP_DIR/tools/update_clouds_yaml.py \
         --file $CLOUDS_YAML \
         --os-cloud devstack-admin \
diff --git a/lib/keystone b/lib/keystone
index d60a4ba4c9..507ee555c2 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -327,6 +327,8 @@ function configure_keystone {
 # --                   --         Member
 # demo                 admin      admin
 # demo                 demo       Member, anotherrole
+# alt_demo             admin      admin
+# alt_demo             alt_demo   Member, anotherrole
 # invisible_to_admin   demo       Member
 
 # Group                Users      Roles                 Tenant
@@ -387,6 +389,18 @@ function create_keystone_accounts {
     get_or_add_user_project_role $another_role $demo_user $demo_tenant
     get_or_add_user_project_role $member_role $demo_user $invis_tenant
 
+    # alt_demo
+    local alt_demo_tenant
+    alt_demo_tenant=$(get_or_create_project "alt_demo" default)
+    local alt_demo_user
+    alt_demo_user=$(get_or_create_user "alt_demo" \
+        "$ADMIN_PASSWORD" "default" "alt_demo@example.com")
+
+    get_or_add_user_project_role $member_role $alt_demo_user $alt_demo_tenant
+    get_or_add_user_project_role $admin_role $admin_user $alt_demo_tenant
+    get_or_add_user_project_role $another_role $alt_demo_user $alt_demo_tenant
+
+    # groups
     local admin_group
     admin_group=$(get_or_create_group "admins" \
         "default" "openstack admin group")
@@ -396,6 +410,8 @@ function create_keystone_accounts {
 
     get_or_add_group_project_role $member_role $non_admin_group $demo_tenant
     get_or_add_group_project_role $another_role $non_admin_group $demo_tenant
+    get_or_add_group_project_role $member_role $non_admin_group $alt_demo_tenant
+    get_or_add_group_project_role $another_role $non_admin_group $alt_demo_tenant
     get_or_add_group_project_role $admin_role $admin_group $admin_tenant
 }
 
diff --git a/lib/tempest b/lib/tempest
index 5c771f9d47..add1b0e4c6 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -568,21 +568,6 @@ function configure_tempest {
     IFS=$ifs
 }
 
-# create_tempest_accounts() - Set up common required tempest accounts
-
-# Project              User         Roles
-# ------------------------------------------------------------------
-# alt_demo             alt_demo     Member
-
-function create_tempest_accounts {
-    if is_service_enabled tempest; then
-        # Tempest has some tests that validate various authorization checks
-        # between two regular users in separate tenants
-        get_or_create_project alt_demo default
-        get_or_create_user alt_demo "$ADMIN_PASSWORD" "default" "alt_demo@example.com"
-        get_or_add_user_project_role Member alt_demo alt_demo
-    fi
-}
 
 # install_tempest_lib() - Collect source, prepare, and install ``tempest-lib``
 function install_tempest_lib {

From 020586fab4173ea860789e459cb941c85179c739 Mon Sep 17 00:00:00 2001
From: Flavio Percoco <flaper87@gmail.com>
Date: Fri, 18 Dec 2015 07:44:45 -0430
Subject: [PATCH 0217/2409] Remove g-search from devstack

The g-search service was promoted to its own project and it's now called
Searchlight. This patch removes that code from devstack.

Change-Id: I9dd7ce62f0339911e025329b8a841792219ea02b
---
 lib/glance | 70 ------------------------------------------------------
 1 file changed, 70 deletions(-)

diff --git a/lib/glance b/lib/glance
index 0431bba024..fa93e6e658 100644
--- a/lib/glance
+++ b/lib/glance
@@ -49,10 +49,8 @@ GLANCE_CONF_DIR=${GLANCE_CONF_DIR:-/etc/glance}
 GLANCE_METADEF_DIR=$GLANCE_CONF_DIR/metadefs
 GLANCE_REGISTRY_CONF=$GLANCE_CONF_DIR/glance-registry.conf
 GLANCE_API_CONF=$GLANCE_CONF_DIR/glance-api.conf
-GLANCE_SEARCH_CONF=$GLANCE_CONF_DIR/glance-search.conf
 GLANCE_REGISTRY_PASTE_INI=$GLANCE_CONF_DIR/glance-registry-paste.ini
 GLANCE_API_PASTE_INI=$GLANCE_CONF_DIR/glance-api-paste.ini
-GLANCE_SEARCH_PASTE_INI=$GLANCE_CONF_DIR/glance-search-paste.ini
 GLANCE_CACHE_CONF=$GLANCE_CONF_DIR/glance-cache.conf
 GLANCE_POLICY_JSON=$GLANCE_CONF_DIR/policy.json
 GLANCE_SCHEMA_JSON=$GLANCE_CONF_DIR/schema-image.json
@@ -71,9 +69,6 @@ GLANCE_HOSTPORT=${GLANCE_HOSTPORT:-$GLANCE_SERVICE_HOST:$GLANCE_SERVICE_PORT}
 GLANCE_SERVICE_PROTOCOL=${GLANCE_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 GLANCE_REGISTRY_PORT=${GLANCE_REGISTRY_PORT:-9191}
 GLANCE_REGISTRY_PORT_INT=${GLANCE_REGISTRY_PORT_INT:-19191}
-GLANCE_SEARCH_PORT=${GLANCE_SEARCH_PORT:-9393}
-GLANCE_SEARCH_PORT_INT=${GLANCE_SEARCH_PORT_INT:-19393}
-GLANCE_SEARCH_HOSTPORT=${GLANCE_SEARCH_HOSTPORT:-$GLANCE_SERVICE_HOST:$GLANCE_SEARCH_PORT}
 
 # Functions
 # ---------
@@ -91,10 +86,6 @@ function cleanup_glance {
     # kill instances (nova)
     # delete image files (glance)
     sudo rm -rf $GLANCE_CACHE_DIR $GLANCE_IMAGE_DIR $GLANCE_AUTH_CACHE_DIR
-
-    if is_service_enabled g-search; then
-        ${TOP_DIR}/pkg/elasticsearch.sh stop
-    fi
 }
 
 # configure_glance() - Set config files, create data dirs, etc
@@ -229,30 +220,6 @@ function configure_glance {
         iniset $GLANCE_API_CONF DEFAULT cinder_endpoint_template "https://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/%(project_id)s"
         iniset $GLANCE_CACHE_CONF DEFAULT cinder_endpoint_template "https://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/%(project_id)s"
     fi
-
-    # Configure search
-    if is_service_enabled g-search; then
-        cp $GLANCE_DIR/etc/glance-search.conf $GLANCE_SEARCH_CONF
-        iniset $GLANCE_SEARCH_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-        iniset $GLANCE_SEARCH_CONF DEFAULT bind_host $GLANCE_SERVICE_LISTEN_ADDRESS
-        inicomment $GLANCE_SEARCH_CONF DEFAULT log_file
-        iniset $GLANCE_SEARCH_CONF DEFAULT use_syslog $SYSLOG
-        iniset $GLANCE_SEARCH_CONF database connection $dburl
-        iniset $GLANCE_SEARCH_CONF paste_deploy flavor keystone
-        configure_auth_token_middleware $GLANCE_SEARCH_CONF glance $GLANCE_AUTH_CACHE_DIR/search
-
-        if is_service_enabled tls-proxy; then
-            iniset $GLANCE_SEARCH_CONF DEFAULT bind_port $GLANCE_SEARCH_PORT_INT
-        fi
-        # Register SSL certificates if provided
-        if is_ssl_enabled_service glance; then
-            ensure_certificates GLANCE
-            iniset $GLANCE_SEARCH_CONF DEFAULT cert_file "$GLANCE_SSL_CERT"
-            iniset $GLANCE_SEARCH_CONF DEFAULT key_file "$GLANCE_SSL_KEY"
-        fi
-
-        cp $GLANCE_DIR/etc/glance-search-paste.ini $GLANCE_SEARCH_PASTE_INI
-    fi
 }
 
 # create_glance_accounts() - Set up common required glance accounts
@@ -287,19 +254,6 @@ function create_glance_accounts {
                 "$GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT"
         fi
     fi
-
-    # Add glance-search service and endpoints
-    if is_service_enabled g-search; then
-        if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
-            get_or_create_service "glance-search" "search" "EXPERIMENTAL - Glance Graffiti Search Service"
-
-            get_or_create_endpoint "search" \
-                "$REGION_NAME" \
-                "$GLANCE_SERVICE_PROTOCOL://$GLANCE_SEARCH_HOSTPORT" \
-                "$GLANCE_SERVICE_PROTOCOL://$GLANCE_SEARCH_HOSTPORT" \
-                "$GLANCE_SERVICE_PROTOCOL://$GLANCE_SEARCH_HOSTPORT"
-        fi
-    fi
 }
 
 # create_glance_cache_dir() - Part of the init_glance() process
@@ -329,12 +283,6 @@ function init_glance {
     $GLANCE_BIN_DIR/glance-manage db_load_metadefs
 
     create_glance_cache_dir
-
-    # Init glance search by exporting found metadefs/images to elasticsearch
-    if is_service_enabled g-search; then
-        ${TOP_DIR}/pkg/elasticsearch.sh start
-        $GLANCE_BIN_DIR/glance-index
-    fi
 }
 
 # install_glanceclient() - Collect source and prepare
@@ -371,11 +319,6 @@ function start_glance {
     if is_service_enabled tls-proxy; then
         start_tls_proxy '*' $GLANCE_SERVICE_PORT $GLANCE_SERVICE_HOST $GLANCE_SERVICE_PORT_INT &
         start_tls_proxy '*' $GLANCE_REGISTRY_PORT $GLANCE_SERVICE_HOST $GLANCE_REGISTRY_PORT_INT &
-
-        # Handle g-search
-        if is_service_enabled g-search; then
-            start_tls_proxy '*' $GLANCE_SEARCH_PORT $GLANCE_SERVICE_HOST $GLANCE_SEARCH_PORT_INT &
-        fi
     fi
 
     run_process g-reg "$GLANCE_BIN_DIR/glance-registry --config-file=$GLANCE_CONF_DIR/glance-registry.conf"
@@ -385,15 +328,6 @@ function start_glance {
     if ! wait_for_service $SERVICE_TIMEOUT $GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT; then
         die $LINENO "g-api did not start"
     fi
-
-    # Start g-search after g-reg/g-api
-    if is_service_enabled g-search; then
-        run_process g-search "$GLANCE_BIN_DIR/glance-search --config-file=$GLANCE_CONF_DIR/glance-search.conf"
-        echo "Waiting for g-search ($GLANCE_SEARCH_HOSTPORT) to start..."
-        if ! wait_for_service $SERVICE_TIMEOUT $GLANCE_SERVICE_PROTOCOL://$GLANCE_SEARCH_HOSTPORT; then
-            die $LINENO "g-search did not start"
-        fi
-    fi
 }
 
 # stop_glance() - Stop running processes
@@ -401,10 +335,6 @@ function stop_glance {
     # Kill the Glance screen windows
     stop_process g-api
     stop_process g-reg
-
-    if is_service_enabled g-search; then
-        stop_process g-search
-    fi
 }
 
 # Restore xtrace

From 3095ff51320291b3622cacc3bf2fb1043bff8d31 Mon Sep 17 00:00:00 2001
From: Igor Duarte Cardoso <igor.duarte.cardoso@intel.com>
Date: Tue, 19 Jan 2016 18:07:47 +0000
Subject: [PATCH 0218/2409] Automate OVS bridge creation for multiple mappings

Allows the definition of the global variable OVS_BRIDGE_MAPPINGS (e.g.
in local.conf) to automatically trigger the creation of multiple OVS
bridges. For example:

OVS_BRIDGE_MAPPINGS=physnet1:br-br-enp0s20f1,physnet2:br-enp0s20f2

should automatically yield the creation of two bridges, respectively
associated to the two physical networks declared,
by simply running DevStack with the OVS agent enabled.

Documentation has also been added to doc/source/guides/neutron.rst.

Change-Id: I79dc0213c9d70ba628621c4c0f65481783590085
Closes-Bug: #1535835
---
 doc/source/guides/neutron.rst         | 16 ++++++++++++++++
 lib/neutron_plugins/openvswitch_agent | 11 +++++++++--
 2 files changed, 25 insertions(+), 2 deletions(-)

diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index 1e20d7fcbe..be85b63580 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -535,3 +535,19 @@ setup, with small modifications for the interface mappings.
     LB_PHYSICAL_INTERFACE=eth0
     PUBLIC_PHYSICAL_NETWORK=default
     LB_INTERFACE_MAPPINGS=default:eth0
+
+Creating specific OVS bridges for physical networks
+---------------------------------------------------
+
+When using the Open vSwitch ML2 mechanism driver, it is possible to
+have multiple Open vSwitch bridges meant for physical networking be
+automatically created by setting the ``OVS_BRIDGE_MAPPINGS`` to a list of
+physical network to bridge name associations with the following syntax:
+
+::
+    OVS_BRIDGE_MAPPINGS=net1name:bridge1name,net2name:bridge2name,<...>
+
+Also, ``OVS_BRIDGE_MAPPINGS`` has precedence over ``PHYSICAL_NETWORK`` and
+``OVS_PHYSICAL_BRIDGE``, meaning that if the former is set, the latter
+ones will be ignored. When ``OVS_BRIDGE_MAPPINGS`` is not set, the other
+variables will still be evaluated.
diff --git a/lib/neutron_plugins/openvswitch_agent b/lib/neutron_plugins/openvswitch_agent
index b1acacd4f3..94a26898ad 100644
--- a/lib/neutron_plugins/openvswitch_agent
+++ b/lib/neutron_plugins/openvswitch_agent
@@ -37,6 +37,7 @@ function neutron_plugin_configure_l3_agent {
 }
 
 function neutron_plugin_configure_plugin_agent {
+    local mappings_array mapping phys_bridge
     # Setup integration bridge
     _neutron_ovs_base_setup_bridge $OVS_BRIDGE
     _neutron_ovs_base_configure_firewall_driver
@@ -58,9 +59,15 @@ function neutron_plugin_configure_plugin_agent {
     # complex physical network configurations.
     if [[ "$OVS_BRIDGE_MAPPINGS" == "" ]] && [[ "$PHYSICAL_NETWORK" != "" ]] && [[ "$OVS_PHYSICAL_BRIDGE" != "" ]]; then
         OVS_BRIDGE_MAPPINGS=$PHYSICAL_NETWORK:$OVS_PHYSICAL_BRIDGE
+    fi
 
-        # Configure bridge manually with physical interface as port for multi-node
-        _neutron_ovs_base_add_bridge $OVS_PHYSICAL_BRIDGE
+    if [[ "$OVS_BRIDGE_MAPPINGS" != "" ]]; then
+        IFS=',' read -a mappings_array <<< "$OVS_BRIDGE_MAPPINGS"
+        for mapping in "${mappings_array[@]}"; do
+            phys_bridge=`echo $mapping | cut -f 2 -d ":"`
+            # Configure bridge manually with physical interface as port for multi-node
+            _neutron_ovs_base_add_bridge $phys_bridge
+        done
     fi
     if [[ "$OVS_BRIDGE_MAPPINGS" != "" ]]; then
         iniset /$Q_PLUGIN_CONF_FILE ovs bridge_mappings $OVS_BRIDGE_MAPPINGS

From 50f75a9f64efc00e17028c780b6df261fc2c27ec Mon Sep 17 00:00:00 2001
From: Dean Troyer <dtroyer@gmail.com>
Date: Wed, 3 Feb 2016 17:40:17 -0600
Subject: [PATCH 0219/2409] Followup comment fix from alt_demo user creation

Tweak a code comment based on a review comment from Steve Martinelli in
https://review.openstack.org/#/c/275121/ where the alt_demo user is now
always created.

Change-Id: I9e9a769f601e52c030e9f6953f1746788c24a185
---
 lib/keystone | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 507ee555c2..6bad6b9405 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -331,10 +331,10 @@ function configure_keystone {
 # alt_demo             alt_demo   Member, anotherrole
 # invisible_to_admin   demo       Member
 
-# Group                Users      Roles                 Tenant
+# Group                Users            Roles                 Tenant
 # ------------------------------------------------------------------
-# admins               admin      admin                 admin
-# nonadmins            demo       Member, anotherrole   demo
+# admins               admin            admin                 admin
+# nonadmins            demo, alt_demo   Member, anotherrole   demo, alt_demo
 
 
 # Migrated from keystone_data.sh

From e73f88e70b9f547bb8306f1f5715c898426f87b8 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 3 Feb 2016 06:58:39 -0500
Subject: [PATCH 0220/2409] tweak ps4 for readability

After staring at a bunch of logs, try to crisp up the ps4 output for
maximum readability.

This also adds PS4 to all calling scripts by having a common PS4 in
stackrc. It should make understanding when clean fails a bit more
straight forward.

Change-Id: Ia1f8dff5c1102c32c146a020a9f033c65d2c50de
---
 clean.sh   | 1 +
 stack.sh   | 1 -
 stackrc    | 3 +++
 unstack.sh | 2 ++
 4 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/clean.sh b/clean.sh
index c8b822317d..3db48585ec 100755
--- a/clean.sh
+++ b/clean.sh
@@ -51,6 +51,7 @@ source $TOP_DIR/lib/swift
 source $TOP_DIR/lib/heat
 source $TOP_DIR/lib/neutron-legacy
 
+set -o xtrace
 
 # Extras Source
 # --------------
diff --git a/stack.sh b/stack.sh
index d261787278..c21ff77742 100755
--- a/stack.sh
+++ b/stack.sh
@@ -23,7 +23,6 @@
 # Print the commands being run so that we can see the command that triggers
 # an error.  It is also useful for following along as the install occurs.
 set -o xtrace
-export PS4='+(${BASH_SOURCE}:${LINENO}): ${FUNCNAME[0]:+${FUNCNAME[0]}(): }'
 
 # Make sure custom grep options don't get in the way
 unset GREP_OPTIONS
diff --git a/stackrc b/stackrc
index 58146a4a1c..887d4b31ff 100644
--- a/stackrc
+++ b/stackrc
@@ -14,6 +14,9 @@ unset LANGUAGE
 LC_ALL=C
 export LC_ALL
 
+# Make tracing more educational
+export PS4='+ ${BASH_SOURCE}:${FUNCNAME[0]}:L${LINENO}:   '
+
 # Find the other rc files
 RC_DIR=$(cd $(dirname "${BASH_SOURCE:-$0}") && pwd)
 
diff --git a/unstack.sh b/unstack.sh
index 8eded837fd..47beb04263 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -87,6 +87,8 @@ load_plugin_settings
 # ``os_RELEASE``, ``os_UPDATE``, ``os_PACKAGE``, ``os_CODENAME``
 GetOSVersion
 
+set -o xtrace
+
 # Run extras
 # ==========
 

From e20cb43fd691c77919d77618bce46bc8c3e4de11 Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Fri, 5 Feb 2016 12:00:18 -0800
Subject: [PATCH 0221/2409] Set different cloud name for alt_demu user

Having multiple clouds with the same name in clouds.yaml confuses
openstack client config and it may not choose the intended cloud.
Unfortunately the new alt_demo user's clouds.yaml config used a
duplicate name creating confusion for clouds.yaml consumers.

Correct this by using a unique cloud name, devstack-alt, for use by the
alt_demo user.

Change-Id: I2cb8f10ab5abfedf76ead309f237730ce8ce2ad4
---
 functions-common | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index 2a08f5f112..b1f0a383e1 100644
--- a/functions-common
+++ b/functions-common
@@ -101,7 +101,7 @@ function write_clouds_yaml {
     # alt_demo -> devstack-alt
     $TOP_DIR/tools/update_clouds_yaml.py \
         --file $CLOUDS_YAML \
-        --os-cloud devstack \
+        --os-cloud devstack-alt \
         --os-region-name $REGION_NAME \
         --os-identity-api-version 3 \
         $CA_CERT_ARG \

From da1cc5780d9501f5705a5e9844e819067514217f Mon Sep 17 00:00:00 2001
From: Morgan Fainberg <morgan.fainberg@gmail.com>
Date: Tue, 2 Feb 2016 09:09:28 -0800
Subject: [PATCH 0222/2409] Remove microseconds from apache log(s)

Remove the microseconds from the apache logs and move back to using
milliseconds. There is no longer any 2.2 workarounds in the keystone
setup process.

Change-Id: I8787eee41fbde1f9794aeffe1e862af0d5117bc3
---
 files/apache-keystone.template | 16 +++-------------
 lib/keystone                   |  9 ++++-----
 2 files changed, 7 insertions(+), 18 deletions(-)

diff --git a/files/apache-keystone.template b/files/apache-keystone.template
index f9fa265db5..428544f25c 100644
--- a/files/apache-keystone.template
+++ b/files/apache-keystone.template
@@ -3,13 +3,7 @@ Listen %ADMINPORT%
 LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\" %D(us)" keystone_combined
 
 <Directory %KEYSTONE_BIN%>
-    <IfVersion >= 2.4>
-        Require all granted
-    </IfVersion>
-    <IfVersion < 2.4>
-        Order allow,deny
-        Allow from all
-    </IfVersion>
+    Require all granted
 </Directory>
 
 <VirtualHost *:%PUBLICPORT%>
@@ -18,9 +12,7 @@ LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\" %D(us)"
     WSGIScriptAlias / %KEYSTONE_BIN%/keystone-wsgi-public
     WSGIApplicationGroup %{GLOBAL}
     WSGIPassAuthorization On
-    <IfVersion >= 2.4>
-      ErrorLogFormat "%{cu}t %M"
-    </IfVersion>
+    ErrorLogFormat "%M"
     ErrorLog /var/log/%APACHE_NAME%/keystone.log
     CustomLog /var/log/%APACHE_NAME%/keystone_access.log keystone_combined
     %SSLENGINE%
@@ -34,9 +26,7 @@ LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\" %D(us)"
     WSGIScriptAlias / %KEYSTONE_BIN%/keystone-wsgi-admin
     WSGIApplicationGroup %{GLOBAL}
     WSGIPassAuthorization On
-    <IfVersion >= 2.4>
-      ErrorLogFormat "%{cu}t %M"
-    </IfVersion>
+    ErrorLogFormat "%M"
     ErrorLog /var/log/%APACHE_NAME%/keystone.log
     CustomLog /var/log/%APACHE_NAME%/keystone_access.log keystone_combined
     %SSLENGINE%
diff --git a/lib/keystone b/lib/keystone
index 507ee555c2..73332221c7 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -299,11 +299,10 @@ function configure_keystone {
     iniset $KEYSTONE_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
 
     if [ "$KEYSTONE_USE_MOD_WSGI" == "True" ]; then
-        # Eliminate the %(asctime)s.%(msecs)03d from the log format strings
-        iniset $KEYSTONE_CONF DEFAULT logging_context_format_string "%(process)d %(levelname)s %(name)s [%(request_id)s %(user_identity)s] %(instance)s%(message)s"
-        iniset $KEYSTONE_CONF DEFAULT logging_default_format_string "%(process)d %(levelname)s %(name)s [-] %(instance)s%(message)s"
-        iniset $KEYSTONE_CONF DEFAULT logging_debug_format_suffix "%(funcName)s %(pathname)s:%(lineno)d"
-        iniset $KEYSTONE_CONF DEFAULT logging_exception_prefix "%(process)d TRACE %(name)s %(instance)s"
+        iniset $KEYSTONE_CONF DEFAULT logging_context_format_string "%(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [%(request_id)s %(user_identity)s] %(instance)s%(message)s"
+        iniset $KEYSTONE_CONF DEFAULT logging_default_format_string "%(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [-] %(instance)s%(message)s"
+        iniset $KEYSTONE_CONF DEFAULT logging_debug_format_suffix "%(asctime)s.%(msecs)03d %(funcName)s %(pathname)s:%(lineno)d"
+        iniset $KEYSTONE_CONF DEFAULT logging_exception_prefix "%(asctime)s.%(msecs)03d %(process)d TRACE %(name)s %(instance)s"
         _config_keystone_apache_wsgi
     else
         iniset $KEYSTONE_CONF eventlet_server admin_bind_host "$KEYSTONE_ADMIN_BIND_HOST"

From d6f922364e3e8a500602f65691d395ef64a077b4 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 9 Feb 2016 06:34:36 -0500
Subject: [PATCH 0223/2409] push out some deprecations to figure out what's
 using these bits

There are some parts of devstack we should really delete, but we have
no idea who is using them. Push out some deprecations so we can look
at this through logstash.

Change-Id: Id5c8748606cce16f64e978ad7ac9309bebac0eb7
---
 lib/keystone       | 1 +
 lib/neutron-legacy | 3 +++
 2 files changed, 4 insertions(+)

diff --git a/lib/keystone b/lib/keystone
index 73332221c7..38a0acf4ea 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -259,6 +259,7 @@ function configure_keystone {
         # Configure ``keystone.conf`` to use sql
         inicomment $KEYSTONE_CONF catalog template_file
     else
+        deprecated "Using templated service catalog in devstack is deprecated"
         cp -p $FILES/default_catalog.templates $KEYSTONE_CATALOG
 
         # Add swift endpoints to service catalog if swift is enabled
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 78eb55d397..73a1bcd0a3 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -433,15 +433,18 @@ function configure_neutron {
 
     # goes before q-svc to init Q_SERVICE_PLUGIN_CLASSES
     if is_service_enabled q-lbaas; then
+        deprecated "Configuring q-lbaas through devstack is deprecated"
         _configure_neutron_lbaas
     fi
     if is_service_enabled q-metering; then
         _configure_neutron_metering
     fi
     if is_service_enabled q-vpn; then
+        deprecated "Configuring q-vpn through devstack is deprecated"
         _configure_neutron_vpn
     fi
     if is_service_enabled q-fwaas; then
+        deprecated "Configuring q-fwaas through devstack is deprecated"
         _configure_neutron_fwaas
     fi
     if is_service_enabled q-agt q-svc; then

From 6f013631a27a726ae45e27b209fa769d96d5f069 Mon Sep 17 00:00:00 2001
From: "John L. Villalovos" <john.l.villalovos@intel.com>
Date: Tue, 9 Feb 2016 13:30:58 -0800
Subject: [PATCH 0224/2409] Handle case where FUNCNAME[0] is undefined

If FUNCNAME[0] is undefined and 'set -u' has been used it will cause the
devstack run to fail.

Handle undefined values in PS4.

Closes-Bug: #1543749
Change-Id: I06a013a5e7683e3a3461ff06361d867f61d48e6a
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 887d4b31ff..8638a900e9 100644
--- a/stackrc
+++ b/stackrc
@@ -15,7 +15,7 @@ LC_ALL=C
 export LC_ALL
 
 # Make tracing more educational
-export PS4='+ ${BASH_SOURCE}:${FUNCNAME[0]}:L${LINENO}:   '
+export PS4='+ ${BASH_SOURCE:-}:${FUNCNAME[0]:-}:L${LINENO:-}:   '
 
 # Find the other rc files
 RC_DIR=$(cd $(dirname "${BASH_SOURCE:-$0}") && pwd)

From 1a9e294ff398e5f3c3a0a62621b8872273aeb0f9 Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Tue, 9 Feb 2016 18:51:02 -0500
Subject: [PATCH 0225/2409] Switch tempest verify-config usage to avoid bug

This commit will unblock the world breakage caused by the recent
cliff release. This exposes a hole in our constraints usage in
devstack. We need to fix this bug for real in devstack and cliff,
but that will take a few minutes to an hour or so. So let's just
change the usage in the meantime, we can revert this when things
are fixed for real.

Related-Bug: #1543841

Depends-On: Ic63612dc50e064a3a69b88618e394ba17e083c22
Change-Id: I19e477fa5068474bc3471307732f89adaafb2952
---
 lib/tempest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index add1b0e4c6..e90ff93c8a 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -321,7 +321,7 @@ function configure_tempest {
     local tmp_cfg_file
     tmp_cfg_file=$(mktemp)
     cd $TEMPEST_DIR
-    tox -revenv -- tempest verify-config -uro $tmp_cfg_file
+    tox -revenv -- tempest verify-config -u -r -o $tmp_cfg_file
 
     local compute_api_extensions=${COMPUTE_API_EXTENSIONS:-"all"}
     if [[ ! -z "$DISABLE_COMPUTE_API_EXTENSIONS" ]]; then

From 1e31e68557205fa61929ff579e427b7ef86aa2ea Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Tue, 9 Feb 2016 23:50:54 -0500
Subject: [PATCH 0226/2409] Respect constraints in tempest tox venvs

This commit is a workaround for respecting upper-constraints. Since
we're using tox to handle setting up a venv and running tempest
commands we need to manually install the constrained packages inside
the tox venvs. This patch does that for all the venvs being created by
devstack via tox. However, since tempest has additional tox jobs
defined if those are run via devstack those will default to the
default pip install -U -r requirements.txt defined in tempest's
tox.ini.

Change-Id: I7f84dfb67a3c97003947aefd8a7e3c6454106db4
Closes-Bug: #1543841
---
 lib/tempest | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index e90ff93c8a..cf4c0d6dde 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -321,7 +321,10 @@ function configure_tempest {
     local tmp_cfg_file
     tmp_cfg_file=$(mktemp)
     cd $TEMPEST_DIR
-    tox -revenv -- tempest verify-config -u -r -o $tmp_cfg_file
+    tox -revenv --notest
+    # NOTE(mtreinish): Respect constraints on tempest verify-config venv
+    tox -evenv -- pip install -c $REQUIREMENTS_DIR/upper-constraints.txt -r requirements.txt
+    tox -evenv -- tempest verify-config -uro $tmp_cfg_file
 
     local compute_api_extensions=${COMPUTE_API_EXTENSIONS:-"all"}
     if [[ ! -z "$DISABLE_COMPUTE_API_EXTENSIONS" ]]; then
@@ -588,6 +591,10 @@ function install_tempest {
     pip_install tox
     pushd $TEMPEST_DIR
     tox --notest -efull
+    # NOTE(mtreinish) Respect constraints in the tempest full venv, things that
+    # are using a tox job other than full will not be respecting constraints but
+    # running pip install -U on tempest requirements
+    $TEMPEST_DIR/.tox/full/bin/pip install -c $REQUIREMENTS_DIR/upper-constraints.txt -r requirements.txt
     PROJECT_VENV["tempest"]=${TEMPEST_DIR}/.tox/full
     install_tempest_lib
     popd

From 8d6d116530634cdaca5ab6d3af9ca0ae1960c025 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Tue, 9 Feb 2016 15:13:25 -0800
Subject: [PATCH 0227/2409] Install libosinfo on n-cpu nodes

As of 9de8f7230d069e4da9736f09ad5d17773315b476 nova is now attempting
to import libosinfo packages, so install them for goodness sake.

Change-Id: Ib481dda475dd2975a513052478be0007aa1cf4a8
Related-Bug: #1543288
---
 files/debs/n-cpu      | 1 +
 files/rpms-suse/n-cpu | 1 +
 files/rpms/n-cpu      | 1 +
 3 files changed, 3 insertions(+)

diff --git a/files/debs/n-cpu b/files/debs/n-cpu
index 0da57ee047..69ac430290 100644
--- a/files/debs/n-cpu
+++ b/files/debs/n-cpu
@@ -1,5 +1,6 @@
 cryptsetup
 genisoimage
+gir1.2-libosinfo-1.0
 lvm2 # NOPRIME
 open-iscsi
 python-guestfs # NOPRIME
diff --git a/files/rpms-suse/n-cpu b/files/rpms-suse/n-cpu
index 29bd31b365..9ece11534d 100644
--- a/files/rpms-suse/n-cpu
+++ b/files/rpms-suse/n-cpu
@@ -1,5 +1,6 @@
 cryptsetup
 genisoimage
+libosinfo
 lvm2
 open-iscsi
 sg3_utils
diff --git a/files/rpms/n-cpu b/files/rpms/n-cpu
index 7773b0402d..26c5ced196 100644
--- a/files/rpms/n-cpu
+++ b/files/rpms/n-cpu
@@ -1,6 +1,7 @@
 cryptsetup
 genisoimage
 iscsi-initiator-utils
+libosinfo
 lvm2
 sg3_utils
 # Stuff for diablo volumes

From 28af7962e99a844675e175ec23bba15378231d5f Mon Sep 17 00:00:00 2001
From: Matthew Kassawara <mkassawara@gmail.com>
Date: Wed, 10 Feb 2016 19:04:08 +0000
Subject: [PATCH 0228/2409] Neutron: Change auth_plugin to auth_type

The keystoneauth1 library replaces the auth_plugin option
with auth_type. In neutron.conf, change [nova] auth_plugin
to auth_type. In nova.conf, change [neutron] auth_plugin to
auth_type.

Change-Id: Ifbd26b8999e453f4cd875e1be3ae1211bdd8fb2a
---
 lib/neutron-legacy | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 73a1bcd0a3..da3c189ef8 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -478,7 +478,7 @@ function configure_neutron {
 function create_nova_conf_neutron {
     iniset $NOVA_CONF DEFAULT network_api_class "nova.network.neutronv2.api.API"
 
-    iniset $NOVA_CONF neutron auth_plugin "v3password"
+    iniset $NOVA_CONF neutron auth_type "password"
     iniset $NOVA_CONF neutron auth_url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_AUTH_PORT/v3"
     iniset $NOVA_CONF neutron username "$Q_ADMIN_USERNAME"
     iniset $NOVA_CONF neutron password "$SERVICE_PASSWORD"
@@ -1155,7 +1155,7 @@ function _configure_neutron_service {
     iniset $NEUTRON_CONF DEFAULT notify_nova_on_port_status_changes $Q_NOTIFY_NOVA_PORT_STATUS_CHANGES
     iniset $NEUTRON_CONF DEFAULT notify_nova_on_port_data_changes $Q_NOTIFY_NOVA_PORT_DATA_CHANGES
 
-    iniset $NEUTRON_CONF nova auth_plugin password
+    iniset $NEUTRON_CONF nova auth_type password
     iniset $NEUTRON_CONF nova auth_url $KEYSTONE_AUTH_URI
     iniset $NEUTRON_CONF nova username nova
     iniset $NEUTRON_CONF nova password $SERVICE_PASSWORD

From 985e958dda3e843442f76199caf63fa8b93680cc Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 10 Feb 2016 07:25:24 -0500
Subject: [PATCH 0229/2409] remove keystone templated catalog

This is just another code path for little benefit in devstack which is
going to rot out. We should be opinionated here and only support the
dynamic catalog.

Change-Id: I4e5c7e86aefe72fc21c77d423033e9b169318fec
---
 doc/source/configuration.rst    | 18 ---------
 files/default_catalog.templates | 63 --------------------------------
 lib/cinder                      | 29 ++++++++-------
 lib/glance                      | 16 ++++----
 lib/heat                        | 32 ++++++++--------
 lib/keystone                    | 65 +++++++--------------------------
 lib/neutron-legacy              | 16 ++++----
 lib/nova                        | 59 ++++++++++++++----------------
 lib/swift                       | 18 ++++-----
 9 files changed, 93 insertions(+), 223 deletions(-)
 delete mode 100644 files/default_catalog.templates

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 6f45c1cbb4..e985bdceb0 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -379,24 +379,6 @@ that matches requirements.
 
         PIP_UPGRADE=True
 
-
-Service Catalog Backend
------------------------
-
-By default DevStack uses Keystone's ``sql`` service catalog backend.
-An alternate ``template`` backend is also available, however, it does
-not support the ``service-*`` and ``endpoint-*`` commands of the
-``keystone`` CLI.  To do so requires the ``sql`` backend be enabled
-with ``KEYSTONE_CATALOG_BACKEND``:
-
-    ::
-
-        KEYSTONE_CATALOG_BACKEND=template
-
-DevStack's default configuration in ``sql`` mode is set in
-``lib/keystone``
-
-
 Guest Images
 ------------
 
diff --git a/files/default_catalog.templates b/files/default_catalog.templates
deleted file mode 100644
index 4aab4160c1..0000000000
--- a/files/default_catalog.templates
+++ /dev/null
@@ -1,63 +0,0 @@
-# config for TemplatedCatalog, using camelCase because I don't want to do
-# translations for legacy compat
-catalog.RegionOne.identity.publicURL = http://%SERVICE_HOST%:$(public_port)s/v2.0
-catalog.RegionOne.identity.adminURL = http://%SERVICE_HOST%:$(admin_port)s/v2.0
-catalog.RegionOne.identity.internalURL = http://%SERVICE_HOST%:$(public_port)s/v2.0
-catalog.RegionOne.identity.name = Identity Service
-
-
-catalog.RegionOne.compute.publicURL = http://%SERVICE_HOST%:8774/v2/$(tenant_id)s
-catalog.RegionOne.compute.adminURL = http://%SERVICE_HOST%:8774/v2/$(tenant_id)s
-catalog.RegionOne.compute.internalURL = http://%SERVICE_HOST%:8774/v2/$(tenant_id)s
-catalog.RegionOne.compute.name = Compute Service
-
-
-catalog.RegionOne.computev21.publicURL = http://%SERVICE_HOST%:8774/v2.1/$(tenant_id)s
-catalog.RegionOne.computev21.adminURL = http://%SERVICE_HOST%:8774/v2.1/$(tenant_id)s
-catalog.RegionOne.computev21.internalURL = http://%SERVICE_HOST%:8774/v2.1/$(tenant_id)s
-catalog.RegionOne.computev21.name = Compute Service V2.1
-
-
-catalog.RegionOne.volume.publicURL = http://%SERVICE_HOST%:8776/v1/$(tenant_id)s
-catalog.RegionOne.volume.adminURL = http://%SERVICE_HOST%:8776/v1/$(tenant_id)s
-catalog.RegionOne.volume.internalURL = http://%SERVICE_HOST%:8776/v1/$(tenant_id)s
-catalog.RegionOne.volume.name = Volume Service
-
-
-catalog.RegionOne.volumev2.publicURL = http://%SERVICE_HOST%:8776/v2/$(tenant_id)s
-catalog.RegionOne.volumev2.adminURL = http://%SERVICE_HOST%:8776/v2/$(tenant_id)s
-catalog.RegionOne.volumev2.internalURL = http://%SERVICE_HOST%:8776/v2/$(tenant_id)s
-catalog.RegionOne.volumev2.name = Volume Service V2
-
-
-catalog.RegionOne.ec2.publicURL = http://%SERVICE_HOST%:8773/
-catalog.RegionOne.ec2.adminURL = http://%SERVICE_HOST%:8773/
-catalog.RegionOne.ec2.internalURL = http://%SERVICE_HOST%:8773/
-catalog.RegionOne.ec2.name = EC2 Service
-
-
-catalog.RegionOne.s3.publicURL = http://%SERVICE_HOST%:%S3_SERVICE_PORT%
-catalog.RegionOne.s3.adminURL = http://%SERVICE_HOST%:%S3_SERVICE_PORT%
-catalog.RegionOne.s3.internalURL = http://%SERVICE_HOST%:%S3_SERVICE_PORT%
-catalog.RegionOne.s3.name = S3 Service
-
-
-catalog.RegionOne.image.publicURL = http://%SERVICE_HOST%:9292
-catalog.RegionOne.image.adminURL = http://%SERVICE_HOST%:9292
-catalog.RegionOne.image.internalURL = http://%SERVICE_HOST%:9292
-catalog.RegionOne.image.name = Image Service
-
-catalog.RegionOne.cloudformation.publicURL = http://%SERVICE_HOST%:8000/v1
-catalog.RegionOne.cloudformation.adminURL = http://%SERVICE_HOST%:8000/v1
-catalog.RegionOne.cloudformation.internalURL = http://%SERVICE_HOST%:8000/v1
-catalog.RegionOne.cloudformation.name = CloudFormation service
-
-catalog.RegionOne.orchestration.publicURL = http://%SERVICE_HOST%:8004/v1/$(tenant_id)s
-catalog.RegionOne.orchestration.adminURL = http://%SERVICE_HOST%:8004/v1/$(tenant_id)s
-catalog.RegionOne.orchestration.internalURL = http://%SERVICE_HOST%:8004/v1/$(tenant_id)s
-catalog.RegionOne.orchestration.name = Orchestration Service
-
-catalog.RegionOne.metering.publicURL = http://%SERVICE_HOST%:8777/v1
-catalog.RegionOne.metering.adminURL = http://%SERVICE_HOST%:8777/v1
-catalog.RegionOne.metering.internalURL = http://%SERVICE_HOST%:8777/v1
-catalog.RegionOne.metering.name = Telemetry Service
diff --git a/lib/cinder b/lib/cinder
index 3aea05023f..e1e1f2a893 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -369,20 +369,21 @@ function create_cinder_accounts {
 
         create_service_user "cinder"
 
-        if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
-
-            get_or_create_service "cinder" "volume" "Cinder Volume Service"
-            get_or_create_endpoint "volume" "$REGION_NAME" \
-                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/\$(tenant_id)s" \
-                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/\$(tenant_id)s" \
-                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/\$(tenant_id)s"
-
-            get_or_create_service "cinderv2" "volumev2" "Cinder Volume Service V2"
-            get_or_create_endpoint "volumev2" "$REGION_NAME" \
-                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v2/\$(tenant_id)s" \
-                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v2/\$(tenant_id)s" \
-                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v2/\$(tenant_id)s"
-        fi
+        get_or_create_service "cinder" "volume" "Cinder Volume Service"
+        get_or_create_endpoint \
+            "volume" \
+            "$REGION_NAME" \
+            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/\$(tenant_id)s" \
+            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/\$(tenant_id)s" \
+            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/\$(tenant_id)s"
+
+        get_or_create_service "cinderv2" "volumev2" "Cinder Volume Service V2"
+        get_or_create_endpoint \
+            "volumev2" \
+            "$REGION_NAME" \
+            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v2/\$(tenant_id)s" \
+            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v2/\$(tenant_id)s" \
+            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v2/\$(tenant_id)s"
     fi
 }
 
diff --git a/lib/glance b/lib/glance
index fa93e6e658..c248611aef 100644
--- a/lib/glance
+++ b/lib/glance
@@ -244,15 +244,13 @@ function create_glance_accounts {
             get_or_add_user_project_role "ResellerAdmin" $glance_swift_user $SERVICE_TENANT_NAME
         fi
 
-        if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
-
-            get_or_create_service "glance" "image" "Glance Image Service"
-            get_or_create_endpoint "image" \
-                "$REGION_NAME" \
-                "$GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT" \
-                "$GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT" \
-                "$GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT"
-        fi
+        get_or_create_service "glance" "image" "Glance Image Service"
+        get_or_create_endpoint \
+            "image" \
+            "$REGION_NAME" \
+            "$GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT" \
+            "$GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT" \
+            "$GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT"
     fi
 }
 
diff --git a/lib/heat b/lib/heat
index df44b7689c..1bb753d788 100644
--- a/lib/heat
+++ b/lib/heat
@@ -387,23 +387,21 @@ function create_heat_accounts {
     if [[ "$HEAT_STANDALONE" != "True" ]]; then
 
         create_service_user "heat" "admin"
-
-        if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
-
-            get_or_create_service "heat" "orchestration" "Heat Orchestration Service"
-            get_or_create_endpoint "orchestration" \
-                "$REGION_NAME" \
-                "$SERVICE_PROTOCOL://$HEAT_API_HOST:$HEAT_API_PORT/v1/\$(tenant_id)s" \
-                "$SERVICE_PROTOCOL://$HEAT_API_HOST:$HEAT_API_PORT/v1/\$(tenant_id)s" \
-                "$SERVICE_PROTOCOL://$HEAT_API_HOST:$HEAT_API_PORT/v1/\$(tenant_id)s"
-
-            get_or_create_service "heat-cfn" "cloudformation" "Heat CloudFormation Service"
-            get_or_create_endpoint "cloudformation"  \
-                "$REGION_NAME" \
-                "$SERVICE_PROTOCOL://$HEAT_API_CFN_HOST:$HEAT_API_CFN_PORT/v1" \
-                "$SERVICE_PROTOCOL://$HEAT_API_CFN_HOST:$HEAT_API_CFN_PORT/v1" \
-                "$SERVICE_PROTOCOL://$HEAT_API_CFN_HOST:$HEAT_API_CFN_PORT/v1"
-        fi
+        get_or_create_service "heat" "orchestration" "Heat Orchestration Service"
+        get_or_create_endpoint \
+            "orchestration" \
+            "$REGION_NAME" \
+            "$SERVICE_PROTOCOL://$HEAT_API_HOST:$HEAT_API_PORT/v1/\$(tenant_id)s" \
+            "$SERVICE_PROTOCOL://$HEAT_API_HOST:$HEAT_API_PORT/v1/\$(tenant_id)s" \
+            "$SERVICE_PROTOCOL://$HEAT_API_HOST:$HEAT_API_PORT/v1/\$(tenant_id)s"
+
+        get_or_create_service "heat-cfn" "cloudformation" "Heat CloudFormation Service"
+        get_or_create_endpoint \
+            "cloudformation"  \
+            "$REGION_NAME" \
+            "$SERVICE_PROTOCOL://$HEAT_API_CFN_HOST:$HEAT_API_CFN_PORT/v1" \
+            "$SERVICE_PROTOCOL://$HEAT_API_CFN_HOST:$HEAT_API_CFN_PORT/v1" \
+            "$SERVICE_PROTOCOL://$HEAT_API_CFN_HOST:$HEAT_API_CFN_PORT/v1"
 
         # heat_stack_user role is for users created by Heat
         get_or_create_role "heat_stack_user"
diff --git a/lib/keystone b/lib/keystone
index 38a0acf4ea..3c67693d96 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -52,13 +52,12 @@ KEYSTONE_CONF_DIR=${KEYSTONE_CONF_DIR:-/etc/keystone}
 KEYSTONE_CONF=$KEYSTONE_CONF_DIR/keystone.conf
 KEYSTONE_PASTE_INI=${KEYSTONE_PASTE_INI:-$KEYSTONE_CONF_DIR/keystone-paste.ini}
 
+# NOTE(sdague): remove in Newton
+KEYSTONE_CATALOG_BACKEND="sql"
+
 # Toggle for deploying Keystone under HTTPD + mod_wsgi
 KEYSTONE_USE_MOD_WSGI=${KEYSTONE_USE_MOD_WSGI:-${ENABLE_HTTPD_MOD_WSGI_SERVICES}}
 
-# Select the Catalog backend driver
-KEYSTONE_CATALOG_BACKEND=${KEYSTONE_CATALOG_BACKEND:-sql}
-KEYSTONE_CATALOG=$KEYSTONE_CONF_DIR/default_catalog.templates
-
 # Select the token persistence backend driver
 KEYSTONE_TOKEN_BACKEND=${KEYSTONE_TOKEN_BACKEND:-sql}
 
@@ -254,39 +253,6 @@ function configure_keystone {
 
     iniset $KEYSTONE_CONF token driver "$KEYSTONE_TOKEN_BACKEND"
 
-    iniset $KEYSTONE_CONF catalog driver "$KEYSTONE_CATALOG_BACKEND"
-    if [[ "$KEYSTONE_CATALOG_BACKEND" = "sql" ]]; then
-        # Configure ``keystone.conf`` to use sql
-        inicomment $KEYSTONE_CONF catalog template_file
-    else
-        deprecated "Using templated service catalog in devstack is deprecated"
-        cp -p $FILES/default_catalog.templates $KEYSTONE_CATALOG
-
-        # Add swift endpoints to service catalog if swift is enabled
-        if is_service_enabled s-proxy; then
-            echo "catalog.RegionOne.object_store.publicURL = http://%SERVICE_HOST%:$SWIFT_DEFAULT_BIND_PORT/v1/AUTH_\$(tenant_id)s" >> $KEYSTONE_CATALOG
-            echo "catalog.RegionOne.object_store.adminURL = http://%SERVICE_HOST%:$SWIFT_DEFAULT_BIND_PORT/" >> $KEYSTONE_CATALOG
-            echo "catalog.RegionOne.object_store.internalURL = http://%SERVICE_HOST%:$SWIFT_DEFAULT_BIND_PORT/v1/AUTH_\$(tenant_id)s" >> $KEYSTONE_CATALOG
-            echo "catalog.RegionOne.object_store.name = Swift Service" >> $KEYSTONE_CATALOG
-        fi
-
-        # Add neutron endpoints to service catalog if neutron is enabled
-        if is_service_enabled neutron; then
-            echo "catalog.RegionOne.network.publicURL = http://%SERVICE_HOST%:$Q_PORT/" >> $KEYSTONE_CATALOG
-            echo "catalog.RegionOne.network.adminURL = http://%SERVICE_HOST%:$Q_PORT/" >> $KEYSTONE_CATALOG
-            echo "catalog.RegionOne.network.internalURL = http://%SERVICE_HOST%:$Q_PORT/" >> $KEYSTONE_CATALOG
-            echo "catalog.RegionOne.network.name = Neutron Service" >> $KEYSTONE_CATALOG
-        fi
-
-        sed -e "
-            s,%SERVICE_HOST%,$SERVICE_HOST,g;
-            s,%S3_SERVICE_PORT%,$S3_SERVICE_PORT,g;
-        " -i $KEYSTONE_CATALOG
-
-        # Configure ``keystone.conf`` to use templates
-        iniset $KEYSTONE_CONF catalog template_file "$KEYSTONE_CATALOG"
-    fi
-
     # Set up logging
     if [ "$SYSLOG" != "False" ]; then
         iniset $KEYSTONE_CONF DEFAULT use_syslog "True"
@@ -588,7 +554,6 @@ function stop_keystone {
 # - ``KEYSTONE_BIN_DIR``
 # - ``ADMIN_PASSWORD``
 # - ``IDENTITY_API_VERSION``
-# - ``KEYSTONE_CATALOG_BACKEND``
 # - ``KEYSTONE_AUTH_URI``
 # - ``REGION_NAME``
 # - ``KEYSTONE_SERVICE_PROTOCOL``
@@ -616,19 +581,17 @@ function bootstrap_keystone {
         --os-identity-api-version 3 --os-auth-url $KEYSTONE_AUTH_URI \
         --os-password $ADMIN_PASSWORD)
 
-    if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
-
-        export OS_TOKEN=$token_id
-        export OS_URL=$KEYSTONE_AUTH_URI/v3
-        export OS_IDENTITY_API_VERSION=3
-
-        get_or_create_service "keystone" "identity" "Keystone Identity Service"
-        get_or_create_endpoint "identity" \
-            "$REGION_NAME" \
-            "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v$IDENTITY_API_VERSION" \
-            "$KEYSTONE_AUTH_URI/v$IDENTITY_API_VERSION" \
-            "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v$IDENTITY_API_VERSION"
-    fi
+    export OS_TOKEN=$token_id
+    export OS_URL=$KEYSTONE_AUTH_URI/v3
+    export OS_IDENTITY_API_VERSION=3
+
+    get_or_create_service "keystone" "identity" "Keystone Identity Service"
+    get_or_create_endpoint \
+        "identity" \
+        "$REGION_NAME" \
+        "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v$IDENTITY_API_VERSION" \
+        "$KEYSTONE_AUTH_URI/v$IDENTITY_API_VERSION" \
+        "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v$IDENTITY_API_VERSION"
 
     unset OS_TOKEN OS_URL OS_IDENTITY_API_VERSION
 }
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 73a1bcd0a3..9acc2203af 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -525,15 +525,13 @@ function create_neutron_accounts {
 
         create_service_user "neutron"
 
-        if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
-
-            get_or_create_service "neutron" "network" "Neutron Service"
-            get_or_create_endpoint "network" \
-                "$REGION_NAME" \
-                "$Q_PROTOCOL://$SERVICE_HOST:$Q_PORT/" \
-                "$Q_PROTOCOL://$SERVICE_HOST:$Q_PORT/" \
-                "$Q_PROTOCOL://$SERVICE_HOST:$Q_PORT/"
-        fi
+        get_or_create_service "neutron" "network" "Neutron Service"
+        get_or_create_endpoint \
+            "network" \
+            "$REGION_NAME" \
+            "$Q_PROTOCOL://$SERVICE_HOST:$Q_PORT/" \
+            "$Q_PROTOCOL://$SERVICE_HOST:$Q_PORT/" \
+            "$Q_PROTOCOL://$SERVICE_HOST:$Q_PORT/"
     fi
 }
 
diff --git a/lib/nova b/lib/nova
index dc425a19bd..17f64a7624 100644
--- a/lib/nova
+++ b/lib/nova
@@ -415,29 +415,28 @@ function create_nova_accounts {
         # this service user when notifying nova of changes and that requires the admin role.
         create_service_user "nova" "admin"
 
-        if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
-            local nova_api_url
-            if [[ "$NOVA_USE_MOD_WSGI" == "False" ]]; then
-                nova_api_url="$NOVA_SERVICE_PROTOCOL://$NOVA_SERVICE_HOST:$NOVA_SERVICE_PORT"
-            else
-                nova_api_url="$NOVA_SERVICE_PROTOCOL://$NOVA_SERVICE_HOST/compute"
-            fi
-
-            get_or_create_service "nova_legacy" "compute_legacy" \
-                "Nova Compute Service (Legacy 2.0)"
-            get_or_create_endpoint "compute_legacy" \
-                "$REGION_NAME" \
-                "$nova_api_url/v2/\$(tenant_id)s" \
-                "$nova_api_url/v2/\$(tenant_id)s" \
-                "$nova_api_url/v2/\$(tenant_id)s"
-
-            get_or_create_service "nova" "compute" "Nova Compute Service"
-            get_or_create_endpoint "compute" \
-                "$REGION_NAME" \
-                "$nova_api_url/v2.1/\$(tenant_id)s" \
-                "$nova_api_url/v2.1/\$(tenant_id)s" \
-                "$nova_api_url/v2.1/\$(tenant_id)s"
+        local nova_api_url
+        if [[ "$NOVA_USE_MOD_WSGI" == "False" ]]; then
+            nova_api_url="$NOVA_SERVICE_PROTOCOL://$NOVA_SERVICE_HOST:$NOVA_SERVICE_PORT"
+        else
+            nova_api_url="$NOVA_SERVICE_PROTOCOL://$NOVA_SERVICE_HOST/compute"
         fi
+
+        get_or_create_service "nova_legacy" "compute_legacy" "Nova Compute Service (Legacy 2.0)"
+        get_or_create_endpoint \
+            "compute_legacy" \
+            "$REGION_NAME" \
+            "$nova_api_url/v2/\$(tenant_id)s" \
+            "$nova_api_url/v2/\$(tenant_id)s" \
+            "$nova_api_url/v2/\$(tenant_id)s"
+
+        get_or_create_service "nova" "compute" "Nova Compute Service"
+        get_or_create_endpoint \
+            "compute" \
+            "$REGION_NAME" \
+            "$nova_api_url/v2.1/\$(tenant_id)s" \
+            "$nova_api_url/v2.1/\$(tenant_id)s" \
+            "$nova_api_url/v2.1/\$(tenant_id)s"
     fi
 
     if is_service_enabled n-api; then
@@ -451,15 +450,13 @@ function create_nova_accounts {
 
     # S3
     if is_service_enabled swift3; then
-        if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
-
-            get_or_create_service "s3" "s3" "S3"
-            get_or_create_endpoint "s3" \
-                "$REGION_NAME" \
-                "http://$SERVICE_HOST:$S3_SERVICE_PORT" \
-                "http://$SERVICE_HOST:$S3_SERVICE_PORT" \
-                "http://$SERVICE_HOST:$S3_SERVICE_PORT"
-        fi
+        get_or_create_service "s3" "s3" "S3"
+        get_or_create_endpoint \
+            "s3" \
+            "$REGION_NAME" \
+            "http://$SERVICE_HOST:$S3_SERVICE_PORT" \
+            "http://$SERVICE_HOST:$S3_SERVICE_PORT" \
+            "http://$SERVICE_HOST:$S3_SERVICE_PORT"
     fi
 }
 
diff --git a/lib/swift b/lib/swift
index 9edeb0ab79..947d2abdc0 100644
--- a/lib/swift
+++ b/lib/swift
@@ -612,8 +612,6 @@ function create_swift_accounts {
     export swiftusertest3_password=testing3
     export swiftusertest4_password=testing4
 
-    KEYSTONE_CATALOG_BACKEND=${KEYSTONE_CATALOG_BACKEND:-sql}
-
     local another_role
     another_role=$(get_or_create_role "anotherrole")
 
@@ -621,15 +619,13 @@ function create_swift_accounts {
     # temp urls, which break when uploaded by a non-admin role
     create_service_user "swift" "admin"
 
-    if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
-
-        get_or_create_service "swift" "object-store" "Swift Service"
-        get_or_create_endpoint "object-store" \
-            "$REGION_NAME" \
-            "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$SWIFT_DEFAULT_BIND_PORT/v1/AUTH_\$(tenant_id)s" \
-            "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$SWIFT_DEFAULT_BIND_PORT" \
-            "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$SWIFT_DEFAULT_BIND_PORT/v1/AUTH_\$(tenant_id)s"
-    fi
+    get_or_create_service "swift" "object-store" "Swift Service"
+    get_or_create_endpoint \
+        "object-store" \
+        "$REGION_NAME" \
+        "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$SWIFT_DEFAULT_BIND_PORT/v1/AUTH_\$(tenant_id)s" \
+        "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$SWIFT_DEFAULT_BIND_PORT" \
+        "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$SWIFT_DEFAULT_BIND_PORT/v1/AUTH_\$(tenant_id)s"
 
     local swift_tenant_test1
     swift_tenant_test1=$(get_or_create_project swifttenanttest1 default)

From a6f3229eb02c409b2d875c9692e9d3b62e859f71 Mon Sep 17 00:00:00 2001
From: John Eckersberg <jeckersb@redhat.com>
Date: Fri, 5 Feb 2016 15:39:11 -0500
Subject: [PATCH 0230/2409] Re-add "redhat-rpm-config" dependency

This was removed in commit 19363fc1e79e70d390da0f4d0a19a5ef476b11d4 as
an unneeded F21 dependency, but due to missing dependencies as
described in the bug, /usr/lib/rpm/redhat/redhat-hardened-cc1 is
required and is provided by this package.

Change-Id: I2c0c3b0198d795d947fd77005fd7528de561dfcb
---
 files/rpms/general | 1 +
 1 file changed, 1 insertion(+)

diff --git a/files/rpms/general b/files/rpms/general
index e0ef54cf9a..a0906e2587 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -26,6 +26,7 @@ postgresql-devel  # psycopg2
 psmisc
 pyOpenSSL # version in pip uses too much memory
 python-devel
+redhat-rpm-config # missing dep for gcc hardening flags, see rhbz#1217376
 screen
 tar
 tcpdump

From 076ef7f0fbf43fd10cb30abbfdf93bb9402968a9 Mon Sep 17 00:00:00 2001
From: David Lyle <david.lyle@intel.com>
Date: Tue, 9 Feb 2016 11:01:04 -0700
Subject: [PATCH 0231/2409] Remove CUSTOM_THEME_PATH setting

Horizon now uses the WEBROOT to populate the value of $webroot in
the CSS code. The CUSTOM_THEME_PATH pointing to the webroot theme
to explicitly set the same value is no longer necessary.

Closes-Bug: 1540801
Change-Id: Ic212796ee0905751ac3fd619bbbc902d25ea10d5
---
 lib/horizon | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/horizon b/lib/horizon
index dca31116e2..abc1f6d16d 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -89,7 +89,6 @@ function configure_horizon {
     cp $HORIZON_SETTINGS $local_settings
 
     _horizon_config_set $local_settings "" WEBROOT \"$HORIZON_APACHE_ROOT/\"
-    _horizon_config_set $local_settings "" CUSTOM_THEME_PATH \"themes/webroot\"
 
     _horizon_config_set $local_settings "" COMPRESS_OFFLINE True
     _horizon_config_set $local_settings "" OPENSTACK_KEYSTONE_DEFAULT_ROLE \"Member\"

From baa35d06e106a74365051bf26c56faf92ec92f88 Mon Sep 17 00:00:00 2001
From: "Cody A.W. Somerville" <cody.somerville@gmail.com>
Date: Thu, 11 Feb 2016 01:23:14 -0500
Subject: [PATCH 0232/2409] Add guide on running devstack in lxc container

Running OpenStack in a container can be a useful workflow for developers.
The primary benefits are faster performance and lower memory overhead
while still providing a suitable level of isolation.

The guide walks the user through procedure for configuring an LXC container
and deploying OpenStack in it using devstack. It also discusses the limitations
of this setup - particularly related to cinder.

Change-Id: I2e0921fd118cfe98cef86ba110a94b3edccf9a29
---
 doc/source/guides/lxc.rst | 164 ++++++++++++++++++++++++++++++++++++++
 doc/source/index.rst      |   8 ++
 2 files changed, 172 insertions(+)
 create mode 100644 doc/source/guides/lxc.rst

diff --git a/doc/source/guides/lxc.rst b/doc/source/guides/lxc.rst
new file mode 100644
index 0000000000..a719d605aa
--- /dev/null
+++ b/doc/source/guides/lxc.rst
@@ -0,0 +1,164 @@
+================================
+All-In-One Single LXC Container
+================================
+
+This guide walks you through the process of deploying OpenStack using devstack
+in an LXC container instead of a VM.
+
+The primary benefits to running devstack inside a container instead of a VM is
+faster performance and lower memory overhead while still providing a suitable
+level of isolation. This can be particularly useful when you want to simulate
+running OpenStack on multiple nodes.
+
+.. Warning:: Containers do not provide the same level of isolation as a virtual
+   machine.
+
+.. Note:: Not all OpenStack features support running inside of a container. See
+   `Limitations`_ section below for details. :doc:`OpenStack in a VM <single-vm>`
+   is recommended for beginners.
+
+Prerequisites
+==============
+
+This guide is written for Ubuntu 14.04 but should be adaptable for any modern
+Linux distribution.
+
+Install the LXC package::
+
+   sudo apt-get install lxc
+
+You can verify support for containerization features in your currently running
+kernel using the ``lxc-checkconfig`` command.
+
+Container Setup
+===============
+
+Configuration
+---------------
+
+For a successful run of ``stack.sh`` and to permit use of KVM to run the VMs you
+launch inside your container, we need to use the following additional
+configuration options. Place the following in a file called
+``devstack-lxc.conf``::
+
+  # Permit access to /dev/loop*
+  lxc.cgroup.devices.allow = b 7:* rwm
+  
+  # Setup access to /dev/net/tun and /dev/kvm
+  lxc.mount.entry = /dev/net/tun dev/net/tun none bind,create=file 0 0
+  lxc.mount.entry = /dev/kvm dev/kvm none bind,create=file 0 0
+  
+  # Networking
+  lxc.network.type = veth
+  lxc.network.flags = up
+  lxc.network.link = lxcbr0
+
+
+Create Container
+-------------------
+
+The configuration and rootfs for LXC containers are created using the
+``lxc-create`` command.
+
+We will name our container ``devstack`` and use the ``ubuntu`` template which
+will use ``debootstrap`` to build a Ubuntu rootfs. It will default to the same
+release and architecture as the host system. We also install the additional
+packages ``bsdmainutils`` and ``git`` as we'll need them to run devstack::
+
+  sudo lxc-create -n devstack -t ubuntu -f devstack-lxc.conf -- --packages=bsdmainutils,git
+
+The first time it builds the rootfs will take a few minutes to download, unpack,
+and configure all the necessary packages for a minimal installation of Ubuntu.
+LXC will cache this and subsequent containers will only take seconds to create.
+
+.. Note:: To speed up the initial rootfs creation, you can specify a mirror to
+   download the Ubuntu packages from by appending ``--mirror=`` and then the URL
+   of a Ubuntu mirror. To see other other template options, you can run
+   ``lxc-create -t ubuntu -h``.
+
+Start Container
+----------------
+
+To start the container, run::
+
+  sudo lxc-start -n devstack
+
+A moment later you should be presented with the login prompt for your container.
+You can login using the username ``ubuntu`` and password ``ubuntu``.
+
+You can also ssh into your container. On your host, run
+``sudo lxc-info -n devstack`` to get the IP address (e.g. 
+``ssh ubuntu@$(sudo lxc-info -n p2 | awk '/IP/ { print $2 }')``).
+
+Run Devstack
+-------------
+
+You should now be logged into your container and almost ready to run devstack.
+The commands in this section should all be run inside your container.
+
+.. Tip:: You can greatly reduce the runtime of your initial devstack setup by
+   ensuring you have your apt sources.list configured to use a fast mirror.
+   Check and update ``/etc/apt/sources.list`` if necessary and then run 
+   ``apt-get update``.
+
+#. Download DevStack
+
+   ::
+
+       git clone https://git.openstack.org/openstack-dev/devstack
+
+#. Configure
+
+   Refer to :ref:`minimal-configuration` if you wish to configure the behaviour
+   of devstack.
+
+#. Start the install
+
+   ::
+
+       cd devstack
+       ./stack.sh
+
+Cleanup
+-------
+
+To stop the container::
+
+  lxc-stop -n devstack
+
+To delete the container::
+
+  lxc-destroy -n devstack
+
+Limitations
+============
+
+Not all OpenStack features may function correctly or at all when ran from within
+a container.
+
+Cinder
+-------
+
+Unable to create LVM backed volume
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+  In our configuration, we have not whitelisted access to device-mapper or LVM
+  devices. Doing so will permit your container to have access and control of LVM
+  on the host system. To enable, add the following to your
+  ``devstack-lxc.conf`` before running ``lxc-create``::
+
+    lxc.cgroup.devices.allow = c 10:236 rwm
+    lxc.cgroup.devices.allow = b 252:* rwm
+
+  Additionally you'll need to set ``udev_rules = 0`` in the ``activation``
+  section of ``/etc/lvm/lvm.conf`` unless you mount devtmpfs in your container.
+
+Unable to attach volume to instance
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+  It is not possible to attach cinder volumes to nova instances due to parts of
+  the Linux iSCSI implementation not being network namespace aware. This can be
+  worked around by using network pass-through instead of a separate network
+  namespace but such a setup significantly reduces the isolation of the
+  container (e.g. a ``halt`` command issued in the container will cause the host
+  system to shutdown).
diff --git a/doc/source/index.rst b/doc/source/index.rst
index 4a1d93d817..3e324adefc 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -76,6 +76,7 @@ Walk through various setups used by stackers
 
    guides/single-vm
    guides/single-machine
+   guides/lxc
    guides/multinode-lab
    guides/neutron
    guides/devstack-with-nested-kvm
@@ -96,6 +97,13 @@ Run :doc:`OpenStack on dedicated hardware <guides/single-machine>`  This can inc
 server-class machine or a laptop at home.
 :doc:`[Read] <guides/single-machine>`
 
+All-In-One LXC Container
+-------------------------
+
+Run :doc:`OpenStack in a LXC container <guides/lxc>`. Beneficial for intermediate
+and advanced users. The VMs launched in this cloud will be fully accelerated but
+not all OpenStack features are supported. :doc:`[Read] <guides/lxc>`
+
 Multi-Node Lab
 --------------
 

From 629e56540f3dec14465bc88ef51c6974bac67f12 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 11 Feb 2016 11:31:56 +0000
Subject: [PATCH 0233/2409] Revert "reduce default lease time to 5 minutes"

We have a fix in Nova which should make this unessessary,
revert to see if that's true.

This reverts commit 61aa0e9f1968c9991dee7bb5aec9a2a63ac0339d.

Change-Id: If109af452ad583417e3a3a3ef1c9b545f1ec9b89
---
 lib/nova | 2 --
 1 file changed, 2 deletions(-)

diff --git a/lib/nova b/lib/nova
index df2b977274..6521cd7eba 100644
--- a/lib/nova
+++ b/lib/nova
@@ -689,8 +689,6 @@ function create_nova_conf_nova_network {
     iniset $NOVA_CONF DEFAULT public_interface "$PUBLIC_INTERFACE"
     iniset $NOVA_CONF DEFAULT vlan_interface "$VLAN_INTERFACE"
     iniset $NOVA_CONF DEFAULT flat_network_bridge "$FLAT_NETWORK_BRIDGE"
-    # force down dhcp leases to 5 minutes, which lets us expire faster
-    iniset $NOVA_CONF DEFAULT dhcp_lease_time 300
     if [ -n "$FLAT_INTERFACE" ]; then
         iniset $NOVA_CONF DEFAULT flat_interface "$FLAT_INTERFACE"
     fi

From 72f530fd7aa9b2029ad141ecfe9c2d62f87f72f3 Mon Sep 17 00:00:00 2001
From: Rafael Folco <rfolco@br.ibm.com>
Date: Tue, 9 Feb 2016 07:08:38 -0600
Subject: [PATCH 0234/2409] Set default properties for Power: virtual console
 and scsi driver

This patch enables the virtual console for Power systems /dev/hvc0
and sets scsi bus and virtio-scsi model as default.
The virtual console hvc0 enables full console including dmesg.
High performance virtio-scsi driver keeps the efficient design of
virtio-blk with effective SCSI passthrough.

Change-Id: I0b5cd4a15d30f06fc7993555d91d6907bd1acbd7
---
 functions | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/functions b/functions
index 29d05187dd..8e9820cc4b 100644
--- a/functions
+++ b/functions
@@ -301,8 +301,8 @@ function upload_image {
         *) echo "Do not know what to do with $image_fname"; false;;
     esac
 
-    if is_arch "ppc64"; then
-        img_property="--property hw_cdrom_bus=scsi"
+    if is_arch "ppc64le" || is_arch "ppc64" || is_arch "ppc"; then
+        img_property="--property hw_disk_bus=scsi --property hw_scsi_model=virtio-scsi --property hw_cdrom_bus=scsi --property os_command_line=console=hvc0"
     fi
 
     if is_arch "aarch64"; then

From 72c34ee1aaddefe23b68ce2ae2d373356c283121 Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Sat, 30 Jan 2016 16:18:01 +0100
Subject: [PATCH 0235/2409] worlddump: collect networking stack info from
 namespaces

Neutron hugely relies on namespaces, so we should try to dump
internal IP stack state for non-root network namespaces.

Change-Id: Ib980d22fbf3c6b680473754fa2b1684c2ef91b72
---
 tools/worlddump.py | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/tools/worlddump.py b/tools/worlddump.py
index 9d2b082f18..7f97931352 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -100,14 +100,24 @@ def iptables_dump():
         _dump_cmd("sudo iptables --line-numbers -L -nv -t %s" % table)
 
 
+def _netns_list():
+    process = subprocess.Popen(['ip', 'netns'], stdout=subprocess.PIPE)
+    stdout, _ = process.communicate()
+    return stdout.split()
+
+
 def network_dump():
     _header("Network Dump")
 
     _dump_cmd("brctl show")
     _dump_cmd("arp -n")
-    _dump_cmd("ip addr")
-    _dump_cmd("ip link")
-    _dump_cmd("ip route")
+    ip_cmds = ["addr", "link", "route"]
+    for cmd in ip_cmds + ['netns']:
+        _dump_cmd("ip %s" % cmd)
+    for netns_ in _netns_list():
+        for cmd in ip_cmds:
+            args = {'netns': netns_, 'cmd': cmd}
+            _dump_cmd('sudo ip netns exec %(netns)s ip %(cmd)s' % args)
 
 
 def process_list():

From 190b29d45e15fd7a0fddb89dbb304fb35554814e Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Thu, 11 Feb 2016 13:42:21 +0100
Subject: [PATCH 0236/2409] worlddump: add empty newline after every command
 output

It makes it a bit easier to read the output since each new command is
now visually separated from the output of the previous one.

Change-Id: If441c61bb6f13f85f771dd31609b10d3dd1ee93c
---
 tools/worlddump.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tools/worlddump.py b/tools/worlddump.py
index 9d2b082f18..d67f226464 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -56,6 +56,7 @@ def _dump_cmd(cmd):
     print
     try:
         subprocess.check_call(cmd, shell=True)
+        print
     except subprocess.CalledProcessError:
         print "*** Failed to run: %s" % cmd
 

From c1b7cb11171a55ba21ab4597977dea0ba6bc7b2d Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Thu, 11 Feb 2016 13:50:46 +0100
Subject: [PATCH 0237/2409] worlddump: include Open vSwitch info

This may be useful when debugging neutron gate failures.

Change-Id: Iea3589456d2b05d233ba88523a5bd4ac114a0c86
---
 tools/worlddump.py | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/tools/worlddump.py b/tools/worlddump.py
index 9d2b082f18..83080110e2 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -110,6 +110,20 @@ def network_dump():
     _dump_cmd("ip route")
 
 
+def ovs_dump():
+    _header("Open vSwitch Dump")
+
+    # NOTE(ihrachys): worlddump is used outside of devstack context (f.e. in
+    # grenade), so there is no single place to determine the bridge names from.
+    # Hardcode for now.
+    bridges = ('br-int', 'br-tun', 'br-ex')
+    _dump_cmd("sudo ovs-vsctl show")
+    for bridge in bridges:
+        _dump_cmd("sudo ovs-ofctl show %s" % bridge)
+    for bridge in bridges:
+        _dump_cmd("sudo ovs-ofctl dump-flows %s" % bridge)
+
+
 def process_list():
     _header("Process Listing")
     _dump_cmd("ps axo "
@@ -147,6 +161,7 @@ def main():
         disk_space()
         process_list()
         network_dump()
+        ovs_dump()
         iptables_dump()
         ebtables_dump()
         compute_consoles()

From 86561c347d70c5124c139eb80fe1c0466e5a62f2 Mon Sep 17 00:00:00 2001
From: Doug Wiegley <dougw@a10networks.com>
Date: Wed, 10 Feb 2016 18:37:21 -0700
Subject: [PATCH 0238/2409] Enable neutron-lib for LIBS_FROM_GIT for backwards
 compat jobs

Change-Id: I8dd84c59d2ec3a7c01ff4f1aaf7fa61d7466cfd5
---
 lib/neutron-legacy           | 7 +++++++
 stackrc                      | 5 +++++
 tests/test_libs_from_pypi.sh | 2 +-
 3 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 73a1bcd0a3..bd876e29a9 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -623,6 +623,13 @@ function init_neutron {
 
 # install_neutron() - Collect source and prepare
 function install_neutron {
+    # Install neutron-lib from git so we make sure we're testing
+    # the latest code.
+    if use_library_from_git "neutron-lib"; then
+        git_clone_by_name "neutron-lib"
+        setup_dev_lib "neutron-lib"
+    fi
+
     git_clone $NEUTRON_REPO $NEUTRON_DIR $NEUTRON_BRANCH
     setup_develop $NEUTRON_DIR
     if is_service_enabled q-fwaas; then
diff --git a/stackrc b/stackrc
index 2ba8398fce..7294f7b716 100644
--- a/stackrc
+++ b/stackrc
@@ -488,6 +488,11 @@ GITREPO["diskimage-builder"]=${DIB_REPO:-${GIT_BASE}/openstack/diskimage-builder
 GITBRANCH["diskimage-builder"]=${DIB_BRANCH:-master}
 GITDIR["diskimage-builder"]=$DEST/diskimage-builder
 
+# neutron-lib library containing neutron stable non-REST interfaces
+GITREPO["neutron-lib"]=${NEUTRON_LIB_REPO:-${GIT_BASE}/openstack/neutron-lib.git}
+GITBRANCH["neutron-lib"]=${NEUTRON_LIB_BRANCH:-master}
+GITDIR["neutron-lib"]=$DEST/neutron-lib
+
 ##################
 #
 #  TripleO / Heat Agent Components
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index d2a543ade0..ee11fd29a0 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -41,7 +41,7 @@ ALL_LIBS+=" oslo.utils python-swiftclient"
 ALL_LIBS+=" python-neutronclient tooz ceilometermiddleware oslo.policy"
 ALL_LIBS+=" debtcollector os-brick automaton futurist oslo.service"
 ALL_LIBS+=" oslo.cache oslo.reports osprofiler"
-ALL_LIBS+=" keystoneauth ironic-lib oslo.privsep"
+ALL_LIBS+=" keystoneauth ironic-lib neutron-lib oslo.privsep"
 ALL_LIBS+=" diskimage-builder"
 
 # Generate the above list with

From 728730aee3c03cfbe08678f95c851c60d523e52c Mon Sep 17 00:00:00 2001
From: Thomas Herve <therve@redhat.com>
Date: Fri, 12 Feb 2016 08:31:23 +0100
Subject: [PATCH 0239/2409] Enable heat caching

Enable use of memory cache by default for Heat. It will provide a boost
for various test builds and will help test this configuration.

Change-Id: I06183138d54c1cb971a58a158a15f3f5b25cba4d
---
 lib/heat | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/heat b/lib/heat
index 1bb753d788..41318787b3 100644
--- a/lib/heat
+++ b/lib/heat
@@ -196,6 +196,9 @@ function configure_heat {
         iniset $HEAT_CONF DEFAULT enable_stack_abandon true
     fi
 
+    iniset $HEAT_CONF cache enabled "True"
+    iniset $HEAT_CONF cache backend "dogpile.cache.memory"
+
     sudo install -d -o $STACK_USER $HEAT_ENV_DIR $HEAT_TEMPLATES_DIR
 
     # copy the default environment

From 326e480d2972191c89b9bae88c987ef12f648f93 Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Fri, 12 Feb 2016 15:23:43 +0100
Subject: [PATCH 0240/2409] Documentation: nova-volume (n-vol) is long gone.

Long live cinder-volume (c-vol) !

Change-Id: I78257c0ef314e97e4abddf82b709fc496401cf14
---
 doc/source/faq.rst | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/source/faq.rst b/doc/source/faq.rst
index 7aca8d0b4a..cd4891519b 100644
--- a/doc/source/faq.rst
+++ b/doc/source/faq.rst
@@ -110,11 +110,11 @@ How do I turn off a service that is enabled by default?
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 Services can be turned off by adding ``disable_service xxx`` to
-``local.conf`` (using ``n-vol`` in this example):
+``local.conf`` (using ``c-vol`` in this example):
 
     ::
 
-        disable_service n-vol
+        disable_service c-vol
 
 Is enabling a service that defaults to off done with the reverse of the above?
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

From 9bdd611dd25ccbc5ea0fcfd20157c2b7ef86b636 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephen.finucane@intel.com>
Date: Mon, 15 Feb 2016 14:12:06 +0000
Subject: [PATCH 0241/2409] lib/nova: Move 'novncproxy_host' to 'vnc' group

This option was moved in '11a42d4'. Move it, fixing the deprecation
warning in the process.

Change-Id: I567a04f6201695f1ca0d0919b1d1f769bad05964
---
 lib/nova | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index cce538d3d7..1ed84495a3 100644
--- a/lib/nova
+++ b/lib/nova
@@ -575,7 +575,7 @@ function create_nova_conf {
         iniset $NOVA_CONF vnc enabled true
         iniset $NOVA_CONF vnc vncserver_listen "$VNCSERVER_LISTEN"
         iniset $NOVA_CONF vnc vncserver_proxyclient_address "$VNCSERVER_PROXYCLIENT_ADDRESS"
-        iniset $NOVA_CONF DEFAULT novncproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
+        iniset $NOVA_CONF vnc novncproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
         iniset $NOVA_CONF vnc xvpvncproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
     else
         iniset $NOVA_CONF vnc enabled false

From a03053660a3867b4f7622303c0499a6b79292cca Mon Sep 17 00:00:00 2001
From: Brant Knudson <bknudson@us.ibm.com>
Date: Mon, 25 Jan 2016 13:38:27 -0600
Subject: [PATCH 0242/2409] Keystone deploy switch

Currently there's a boolean KEYSTONE_USE_MOD_WSGI to switch between
running keystone in mod_wsgi and eventlet. We've got a need to
support more/different deployment options (e.g., uwsgi), so a
boolean is inadequate.

A new input variable KEYSTONE_DEPLOY is introduced that can be
set to mod_wsgi or eventlet (and other values in future) to
control how keystone is deployed. KEYSTONE_USE_MOD_WSGI is
deprecated.

Change-Id: I9b2815e6f007309f088346df9ac48e6a24ae3656
---
 lib/keystone | 24 +++++++++++++++++++-----
 1 file changed, 19 insertions(+), 5 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 3c67693d96..238a192932 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -56,8 +56,22 @@ KEYSTONE_PASTE_INI=${KEYSTONE_PASTE_INI:-$KEYSTONE_CONF_DIR/keystone-paste.ini}
 KEYSTONE_CATALOG_BACKEND="sql"
 
 # Toggle for deploying Keystone under HTTPD + mod_wsgi
+# Deprecated in Mitaka, use KEYSTONE_DEPLOY instead.
 KEYSTONE_USE_MOD_WSGI=${KEYSTONE_USE_MOD_WSGI:-${ENABLE_HTTPD_MOD_WSGI_SERVICES}}
 
+# KEYSTONE_DEPLOY defines how keystone is deployed, allowed values:
+# - mod_wsgi : Run keystone under Apache HTTPd mod_wsgi
+# - eventlet : Run keystone-all
+if [ -z "$KEYSTONE_DEPLOY" ]; then
+    if [ -z "$KEYSTONE_USE_MOD_WSGI" ]; then
+        KEYSTONE_DEPLOY=mod_wsgi
+    elif [ "$KEYSTONE_USE_MOD_WSGI" == True ]; then
+        KEYSTONE_DEPLOY=mod_wsgi
+    else
+        KEYSTONE_DEPLOY=eventlet
+    fi
+fi
+
 # Select the token persistence backend driver
 KEYSTONE_TOKEN_BACKEND=${KEYSTONE_TOKEN_BACKEND:-sql}
 
@@ -259,13 +273,13 @@ function configure_keystone {
     fi
 
     # Format logging
-    if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ] && [ "$KEYSTONE_USE_MOD_WSGI" == "False" ]  ; then
+    if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ] && [ "$KEYSTONE_DEPLOY" == "eventlet" ]  ; then
         setup_colorized_logging $KEYSTONE_CONF DEFAULT
     fi
 
     iniset $KEYSTONE_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
 
-    if [ "$KEYSTONE_USE_MOD_WSGI" == "True" ]; then
+    if [ "$KEYSTONE_DEPLOY" == "mod_wsgi" ]; then
         iniset $KEYSTONE_CONF DEFAULT logging_context_format_string "%(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [%(request_id)s %(user_identity)s] %(instance)s%(message)s"
         iniset $KEYSTONE_CONF DEFAULT logging_default_format_string "%(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [-] %(instance)s%(message)s"
         iniset $KEYSTONE_CONF DEFAULT logging_debug_format_suffix "%(asctime)s.%(msecs)03d %(funcName)s %(pathname)s:%(lineno)d"
@@ -493,7 +507,7 @@ function install_keystone {
         setup_develop $KEYSTONE_DIR ldap
     fi
 
-    if [ "$KEYSTONE_USE_MOD_WSGI" == "True" ]; then
+    if [ "$KEYSTONE_DEPLOY" == "mod_wsgi" ]; then
         install_apache_wsgi
         if is_ssl_enabled_service "key"; then
             enable_mod_ssl
@@ -511,7 +525,7 @@ function start_keystone {
         auth_protocol="http"
     fi
 
-    if [ "$KEYSTONE_USE_MOD_WSGI" == "True" ]; then
+    if [ "$KEYSTONE_DEPLOY" == "mod_wsgi" ]; then
         enable_apache_site keystone
         restart_apache_server
         tail_log key /var/log/$APACHE_NAME/keystone.log
@@ -541,7 +555,7 @@ function start_keystone {
 
 # stop_keystone() - Stop running processes
 function stop_keystone {
-    if [ "$KEYSTONE_USE_MOD_WSGI" == "True" ]; then
+    if [ "$KEYSTONE_DEPLOY" == "mod_wsgi" ]; then
         disable_apache_site keystone
         restart_apache_server
     fi

From edc11c2f834e45dea9c9c0fcda21369d2afa30e2 Mon Sep 17 00:00:00 2001
From: Brant Knudson <bknudson@us.ibm.com>
Date: Mon, 14 Dec 2015 15:32:05 -0600
Subject: [PATCH 0243/2409] Keystone support deploy in uwsgi

Keystone is going to remove support for eventlet. Rather than only
have one way to run keystone (in Apache Httpd with mod_wsgi), we
should continue to gate on multiple wsgi containers to ensure that
keystone remains container-agnostic. The suggested alternative
container is uwsgi.

To run keystone in uwsgi rather than httpd or eventlet, set the
following env var in local.conf:

 KEYSTONE_DEPLOY=uwsgi

There's a lot of options to uwsgi. Here's some protips:
http://uwsgi-docs.readthedocs.org/en/latest/ThingsToKnow.html

Change-Id: If3b49879ce5181c16f0f0ab0db12fa55fe810a41
---
 functions-common |  7 +++--
 lib/keystone     | 72 ++++++++++++++++++++++++++++++++++++++++++------
 2 files changed, 68 insertions(+), 11 deletions(-)

diff --git a/functions-common b/functions-common
index ff9bc0f77f..d6c3bddc11 100644
--- a/functions-common
+++ b/functions-common
@@ -1428,14 +1428,17 @@ function run_process {
     local service=$1
     local command="$2"
     local group=$3
+    local subservice=$4
+
+    local name=${subservice:-$service}
 
     time_start "run_process"
     if is_service_enabled $service; then
         if [[ "$USE_SCREEN" = "True" ]]; then
-            screen_process "$service" "$command" "$group"
+            screen_process "$name" "$command" "$group"
         else
             # Spawn directly without screen
-            _run_process "$service" "$command" "$group" &
+            _run_process "$name" "$command" "$group" &
         fi
     fi
     time_stop "run_process"
diff --git a/lib/keystone b/lib/keystone
index 238a192932..7d5fd41f89 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -62,6 +62,7 @@ KEYSTONE_USE_MOD_WSGI=${KEYSTONE_USE_MOD_WSGI:-${ENABLE_HTTPD_MOD_WSGI_SERVICES}
 # KEYSTONE_DEPLOY defines how keystone is deployed, allowed values:
 # - mod_wsgi : Run keystone under Apache HTTPd mod_wsgi
 # - eventlet : Run keystone-all
+# - uwsgi : Run keystone under uwsgi
 if [ -z "$KEYSTONE_DEPLOY" ]; then
     if [ -z "$KEYSTONE_USE_MOD_WSGI" ]; then
         KEYSTONE_DEPLOY=mod_wsgi
@@ -244,16 +245,15 @@ function configure_keystone {
     # Register SSL certificates if provided
     if is_ssl_enabled_service key; then
         ensure_certificates KEYSTONE
-
-        iniset $KEYSTONE_CONF eventlet_server_ssl enable True
-        iniset $KEYSTONE_CONF eventlet_server_ssl certfile $KEYSTONE_SSL_CERT
-        iniset $KEYSTONE_CONF eventlet_server_ssl keyfile $KEYSTONE_SSL_KEY
     fi
 
+    local service_port=$KEYSTONE_SERVICE_PORT
+    local auth_port=$KEYSTONE_AUTH_PORT
+
     if is_service_enabled tls-proxy; then
         # Set the service ports for a proxy to take the originals
-        iniset $KEYSTONE_CONF eventlet_server public_port $KEYSTONE_SERVICE_PORT_INT
-        iniset $KEYSTONE_CONF eventlet_server admin_port $KEYSTONE_AUTH_PORT_INT
+        service_port=$KEYSTONE_SERVICE_PORT_INT
+        auth_port=$KEYSTONE_AUTH_PORT_INT
 
         iniset $KEYSTONE_CONF DEFAULT public_endpoint $KEYSTONE_SERVICE_URI
         iniset $KEYSTONE_CONF DEFAULT admin_endpoint $KEYSTONE_AUTH_URI
@@ -273,7 +273,7 @@ function configure_keystone {
     fi
 
     # Format logging
-    if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ] && [ "$KEYSTONE_DEPLOY" == "eventlet" ]  ; then
+    if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ] && [ "$KEYSTONE_DEPLOY" != "mod_wsgi" ] ; then
         setup_colorized_logging $KEYSTONE_CONF DEFAULT
     fi
 
@@ -285,7 +285,58 @@ function configure_keystone {
         iniset $KEYSTONE_CONF DEFAULT logging_debug_format_suffix "%(asctime)s.%(msecs)03d %(funcName)s %(pathname)s:%(lineno)d"
         iniset $KEYSTONE_CONF DEFAULT logging_exception_prefix "%(asctime)s.%(msecs)03d %(process)d TRACE %(name)s %(instance)s"
         _config_keystone_apache_wsgi
-    else
+    elif [ "$KEYSTONE_DEPLOY" == "uwsgi" ]; then
+        # iniset creates these files when it's called if they don't exist.
+        KEYSTONE_PUBLIC_UWSGI_FILE=$KEYSTONE_CONF_DIR/keystone-uwsgi-public.ini
+        KEYSTONE_ADMIN_UWSGI_FILE=$KEYSTONE_CONF_DIR/keystone-uwsgi-admin.ini
+
+        rm -f "$KEYSTONE_PUBLIC_UWSGI_FILE"
+        rm -f "$KEYSTONE_ADMIN_UWSGI_FILE"
+
+        if is_ssl_enabled_service key; then
+            iniset "$KEYSTONE_PUBLIC_UWSGI_FILE" uwsgi https $KEYSTONE_SERVICE_HOST:$service_port,$KEYSTONE_SSL_CERT,$KEYSTONE_SSL_KEY
+            iniset "$KEYSTONE_ADMIN_UWSGI_FILE" uwsgi https $KEYSTONE_ADMIN_BIND_HOST:$auth_port,$KEYSTONE_SSL_CERT,$KEYSTONE_SSL_KEY
+        else
+            iniset "$KEYSTONE_PUBLIC_UWSGI_FILE" uwsgi http $KEYSTONE_SERVICE_HOST:$service_port
+            iniset "$KEYSTONE_ADMIN_UWSGI_FILE" uwsgi http $KEYSTONE_ADMIN_BIND_HOST:$auth_port
+        fi
+
+        iniset "$KEYSTONE_PUBLIC_UWSGI_FILE" uwsgi wsgi-file "$KEYSTONE_BIN_DIR/keystone-wsgi-public"
+        # This is running standalone
+        iniset "$KEYSTONE_PUBLIC_UWSGI_FILE" uwsgi master true
+        iniset "$KEYSTONE_PUBLIC_UWSGI_FILE" uwsgi threads $(nproc)
+        iniset "$KEYSTONE_PUBLIC_UWSGI_FILE" uwsgi enable-threads true
+        iniset "$KEYSTONE_PUBLIC_UWSGI_FILE" uwsgi plugins python
+        # uwsgi recommends this to prevent thundering herd on accept.
+        iniset "$KEYSTONE_PUBLIC_UWSGI_FILE" uwsgi thunder-lock true
+        # Override the default size for headers from the 4k default.
+        iniset "$KEYSTONE_PUBLIC_UWSGI_FILE" uwsgi buffer-size 65535
+        # Make sure the client doesn't try to re-use the connection.
+        iniset "$KEYSTONE_PUBLIC_UWSGI_FILE" uwsgi add-header "Connection: close"
+
+        iniset "$KEYSTONE_ADMIN_UWSGI_FILE" uwsgi wsgi-file "$KEYSTONE_BIN_DIR/keystone-wsgi-admin"
+        # This is running standalone
+        iniset "$KEYSTONE_ADMIN_UWSGI_FILE" uwsgi master true
+        iniset "$KEYSTONE_ADMIN_UWSGI_FILE" uwsgi threads $API_WORKERS
+        iniset "$KEYSTONE_ADMIN_UWSGI_FILE" uwsgi enable-threads true
+        iniset "$KEYSTONE_ADMIN_UWSGI_FILE" uwsgi plugins python
+        # uwsgi recommends this to prevent thundering herd on accept.
+        iniset "$KEYSTONE_ADMIN_UWSGI_FILE" uwsgi thunder-lock true
+        # Override the default size for headers from the 4k default.
+        iniset "$KEYSTONE_ADMIN_UWSGI_FILE" uwsgi buffer-size 65535
+        # Make sure the client doesn't try to re-use the connection.
+        iniset "$KEYSTONE_ADMIN_UWSGI_FILE" uwsgi add-header "Connection: close"
+
+    else # eventlet
+        if is_ssl_enabled_service key; then
+            iniset $KEYSTONE_CONF eventlet_server_ssl enable True
+            iniset $KEYSTONE_CONF eventlet_server_ssl certfile $KEYSTONE_SSL_CERT
+            iniset $KEYSTONE_CONF eventlet_server_ssl keyfile $KEYSTONE_SSL_KEY
+        fi
+
+        iniset $KEYSTONE_CONF eventlet_server public_port $service_port
+        iniset $KEYSTONE_CONF eventlet_server admin_port $auth_port
+
         iniset $KEYSTONE_CONF eventlet_server admin_bind_host "$KEYSTONE_ADMIN_BIND_HOST"
         iniset $KEYSTONE_CONF eventlet_server admin_workers "$API_WORKERS"
         # Public workers will use the server default, typically number of CPU.
@@ -530,7 +581,10 @@ function start_keystone {
         restart_apache_server
         tail_log key /var/log/$APACHE_NAME/keystone.log
         tail_log key-access /var/log/$APACHE_NAME/keystone_access.log
-    else
+    elif [ "$KEYSTONE_DEPLOY" == "uwsgi" ]; then
+        run_process key "uwsgi $KEYSTONE_PUBLIC_UWSGI_FILE" "" "key-p"
+        run_process key "uwsgi $KEYSTONE_ADMIN_UWSGI_FILE" "" "key-a"
+    else # eventlet
         # Start Keystone in a screen window
         run_process key "$KEYSTONE_BIN_DIR/keystone-all --config-file $KEYSTONE_CONF"
     fi

From ed92e43178b4f910adc038d1b0b6788e21513f32 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 16 Feb 2016 10:56:56 +1100
Subject: [PATCH 0244/2409] Add some notes on DISTRO setting

It was pointed out in I42599c1bd851d2b61a56a3960f42ad051aab1727 that
after I46a2c36d95327087085df07cb797eb91249a893c we now die if we can't
determine DISTRO, rather than take a guess.

After some consideration, I don't consider this a regression.  This
default matching was basically only working for LinuxMint, because we
already have some matching there for setting os_PACKAGE that makes us
know the platform is Ubuntu-ish.

However, I would certainly agree it is not particularly clear as to
why.  This just adds some comments explaining why we can not just add
a default DISTRO fall-through and directs implementors on how to add
support for their platform.

Change-Id: I4b07259be1427d86a7154906646073d08dd07294
---
 functions-common | 21 ++++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index ff9bc0f77f..c11ba33183 100644
--- a/functions-common
+++ b/functions-common
@@ -388,7 +388,26 @@ function GetDistro {
     elif [[ "$os_VENDOR" =~ (kvmibm) ]]; then
         DISTRO="${os_VENDOR}${os_RELEASE::1}"
     else
-        die $LINENO "Unable to determine DISTRO"
+        # We can't make a good choice here.  Setting a sensible DISTRO
+        # is part of the problem, but not the major issue -- we really
+        # only use DISTRO in the code as a fine-filter.
+        #
+        # The bigger problem is categorising the system into one of
+        # our two big categories as Ubuntu/Debian-ish or
+        # Fedora/CentOS-ish.
+        #
+        # The setting of os_PACKAGE above is only set to "deb" based
+        # on a hard-coded list of vendor names ... thus we will
+        # default to thinking unknown distros are RPM based
+        # (ie. is_ubuntu does not match).  But the platform will then
+        # also not match in is_fedora, because that also has a list of
+        # names.
+        #
+        # So, if you are reading this, getting your distro supported
+        # is really about making sure it matches correctly in these
+        # functions.  Then you can choose a sensible way to construct
+        # DISTRO based on your distros release approach.
+        die $LINENO "Unable to determine DISTRO, can not continue."
     fi
     typeset -xr DISTRO
 }

From 96006658bedbdfa98e4d0685852f057aeb2ae1a6 Mon Sep 17 00:00:00 2001
From: ptoohill1 <phillip.toohill@rackspace.com>
Date: Mon, 15 Feb 2016 16:07:50 -0600
Subject: [PATCH 0245/2409] Add LinuxMint to distro check

Adds LinuxMint to the distro checking. This allows linux mint with
the FORCE option to run. This will not fix for other distros that
do not pass the checks.

Change-Id: I42599c1bd851d2b61a56a3960f42ad051aab1727
Closes-Bug: #1545864
---
 functions-common | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/functions-common b/functions-common
index ff9bc0f77f..80bdbeaa57 100644
--- a/functions-common
+++ b/functions-common
@@ -365,8 +365,9 @@ declare DISTRO
 
 function GetDistro {
     GetOSVersion
-    if [[ "$os_VENDOR" =~ (Ubuntu) || "$os_VENDOR" =~ (Debian) ]]; then
-        # 'Everyone' refers to Ubuntu / Debian releases by
+    if [[ "$os_VENDOR" =~ (Ubuntu) || "$os_VENDOR" =~ (Debian) || \
+            "$os_VENDOR" =~ (LinuxMint) ]]; then
+        # 'Everyone' refers to Ubuntu / Debian / Mint releases by
         # the code name adjective
         DISTRO=$os_CODENAME
     elif [[ "$os_VENDOR" =~ (Fedora) ]]; then

From 76d05400ec64fc4f177f9dc9ad8d821fceae5e05 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 16 Feb 2016 14:35:51 +1100
Subject: [PATCH 0246/2409] Update to bashate 0.4.0

Update to bashate 0.4.0.  The biggest change in this is that bashate
does a syntax check with "bash -n" which can be useful

Change-Id: Iff625ef2181dfaba28349dc17de0749faddec539
---
 tox.ini | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tox.ini b/tox.ini
index f9d04f2dcd..efffbd5d99 100644
--- a/tox.ini
+++ b/tox.ini
@@ -9,7 +9,7 @@ install_command = pip install {opts} {packages}
 
 [testenv:bashate]
 deps =
-   {env:BASHATE_INSTALL_PATH:bashate==0.3.2}
+   {env:BASHATE_INSTALL_PATH:bashate==0.4.0}
 whitelist_externals = bash
 commands = bash -c "find {toxinidir}             \
          -not \( -type d -name .?\* -prune \)    \

From 7ae97298c55d9ba21d2dc037cc7d9fae54afa183 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 16 Feb 2016 14:50:53 +1100
Subject: [PATCH 0247/2409] Minor fixes for bashate trunk

We don't have a new bashate release yet, but this fixes some minor
issues when used with bashate trunk.

The only two things triggered are stricter checking of assignment in
local declartions (catches quotes) and one instance of evaluating
arithmetic result in tools/xen/functions.

Therefore, hopefully, this change has no effect!

Change-Id: I3fd5d55236e90c2f2c25243af87adaf0c1b763e2
---
 functions           | 13 +++++++++----
 functions-common    |  2 +-
 inc/ini-config      |  3 ++-
 lib/neutron-legacy  |  5 ++++-
 tools/xen/functions | 16 +++++++++-------
 tox.ini             |  3 +++
 6 files changed, 28 insertions(+), 14 deletions(-)

diff --git a/functions b/functions
index 29d05187dd..42c5c1dacb 100644
--- a/functions
+++ b/functions
@@ -94,12 +94,14 @@ function upload_image {
         local path_len
 
         # vmdk adapter type
-        local vmdk_adapter_type="$(head -25 $image | { grep -a -F -m 1 'ddb.adapterType =' $image || true; })"
+        local vmdk_adapter_type
+        vmdk_adapter_type="$(head -25 $image | { grep -a -F -m 1 'ddb.adapterType =' $image || true; })"
         vmdk_adapter_type="${vmdk_adapter_type#*\"}"
         vmdk_adapter_type="${vmdk_adapter_type%?}"
 
         # vmdk disk type
-        local vmdk_create_type="$(head -25 $image | { grep -a -F -m 1 'createType=' $image || true; })"
+        local vmdk_create_type
+        vmdk_create_type="$(head -25 $image | { grep -a -F -m 1 'createType=' $image || true; })"
         vmdk_create_type="${vmdk_create_type#*\"}"
         vmdk_create_type="${vmdk_create_type%\"*}"
 
@@ -109,7 +111,8 @@ function upload_image {
             vmdk_disktype="sparse"
         elif [[ "$vmdk_create_type" = "monolithicFlat" || "$vmdk_create_type" = "vmfs" ]]; then
             # Attempt to retrieve the ``*-flat.vmdk``
-            local flat_fname="$(head -25 $image | { grep -G 'RW\|RDONLY [0-9]+ FLAT\|VMFS' $image || true; })"
+            local flat_fname
+            flat_fname="$(head -25 $image | { grep -G 'RW\|RDONLY [0-9]+ FLAT\|VMFS' $image || true; })"
             flat_fname="${flat_fname#*\"}"
             flat_fname="${flat_fname%?}"
             if [[ -z "$flat_fname" ]]; then
@@ -407,8 +410,10 @@ function ping_check {
 function get_instance_ip {
     local vm_id=$1
     local network_name=$2
-    local nova_result="$(nova show $vm_id)"
+    local nova_result
     local ip
+
+    nova_result="$(nova show $vm_id)"
     ip=$(echo "$nova_result" | grep "$network_name" | get_field 2)
     if [[ $ip = "" ]];then
         echo "$nova_result"
diff --git a/functions-common b/functions-common
index ff9bc0f77f..f84301f4b1 100644
--- a/functions-common
+++ b/functions-common
@@ -1211,7 +1211,7 @@ function get_plugin_packages {
     local files_to_parse=""
     local package_dir=""
     for plugin in ${DEVSTACK_PLUGINS//,/ }; do
-        local package_dir="$(_get_package_dir ${GITDIR[$plugin]}/devstack/files)"
+        package_dir="$(_get_package_dir ${GITDIR[$plugin]}/devstack/files)"
         files_to_parse+=" $package_dir/$plugin"
     done
     echo "$(_parse_package_files $files_to_parse)"
diff --git a/inc/ini-config b/inc/ini-config
index e99b088994..1f12343ae0 100644
--- a/inc/ini-config
+++ b/inc/ini-config
@@ -30,7 +30,8 @@ function iniadd {
     local option=$3
     shift 3
 
-    local values="$(iniget_multiline $file $section $option) $@"
+    local values
+    values="$(iniget_multiline $file $section $option) $@"
     iniset_multiline $sudo $file $section $option $values
     $xtrace
 }
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index d0523f4f0a..7975570691 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -689,9 +689,12 @@ function install_neutron_agent_packages {
 
 # Start running processes, including screen
 function start_neutron_service_and_check {
-    local cfg_file_options="$(determine_config_files neutron-server)"
     local service_port=$Q_PORT
     local service_protocol=$Q_PROTOCOL
+    local cfg_file_options
+
+    cfg_file_options="$(determine_config_files neutron-server)"
+
     if is_service_enabled tls-proxy; then
         service_port=$Q_PORT_INT
         service_protocol="http"
diff --git a/tools/xen/functions b/tools/xen/functions
index 8c674dcce3..cf145686b5 100644
--- a/tools/xen/functions
+++ b/tools/xen/functions
@@ -23,9 +23,10 @@ function create_directory_for_kernels {
     if [ -d "/boot/guest" ]; then
         echo "INFO: /boot/guest directory already exists, using that" >&2
     else
-        local LOCALPATH="$(get_local_sr_path)/os-guest-kernels"
-        mkdir -p $LOCALPATH
-        ln -s $LOCALPATH /boot/guest
+        local local_path
+        local_path="$(get_local_sr_path)/os-guest-kernels"
+        mkdir -p $local_path
+        ln -s $local_path /boot/guest
     fi
 }
 
@@ -33,9 +34,10 @@ function create_directory_for_images {
     if [ -d "/images" ]; then
         echo "INFO: /images directory already exists, using that" >&2
     else
-        local LOCALPATH="$(get_local_sr_path)/os-images"
-        mkdir -p $LOCALPATH
-        ln -s $LOCALPATH /images
+        local local_path
+        local_path="$(get_local_sr_path)/os-images"
+        mkdir -p $local_path
+        ln -s $local_path /images
     fi
 }
 
@@ -73,7 +75,7 @@ function find_ip_by_name {
 
         if [ -z "$ipaddress" ]; then
             sleep $period
-            ((i++))
+            i=$((i+1))
         else
             echo $ipaddress
             break
diff --git a/tox.ini b/tox.ini
index f9d04f2dcd..bdfd29dd14 100644
--- a/tox.ini
+++ b/tox.ini
@@ -8,6 +8,9 @@ usedevelop = False
 install_command = pip install {opts} {packages}
 
 [testenv:bashate]
+# if you want to test out some changes you have made to bashate
+# against devstack, just set BASHATE_INSTALL_PATH=/path/... to your
+# modified bashate tree
 deps =
    {env:BASHATE_INSTALL_PATH:bashate==0.3.2}
 whitelist_externals = bash

From a15d9de92f724baebea0c202b14c2220df68e2a9 Mon Sep 17 00:00:00 2001
From: Li Ma <skywalker.nick@gmail.com>
Date: Tue, 19 Jan 2016 19:11:51 +0800
Subject: [PATCH 0248/2409] Kill radvd when stopping neutron-l3 service

When stopping neutron-l3 service, radvd should be
stopped.

Change-Id: I46416c1df3a4da66e863a16baeb73886e110d447
Closes-Bug: #1535661
---
 lib/neutron-legacy | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 9497a23595..a1489714a0 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -764,7 +764,11 @@ function stop_neutron_other {
     fi
 
     stop_process q-svc
-    stop_process q-l3
+
+    if is_service_enabled q-l3; then
+        sudo pkill -f "radvd -C $DATA_DIR/neutron/ra"
+        stop_process q-l3
+    fi
 
     if is_service_enabled q-meta; then
         sudo pkill -9 -f neutron-ns-metadata-proxy || :

From bae609ef6fe46e70ae48a7647861123cbb16661f Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Tue, 24 Nov 2015 17:02:12 +0100
Subject: [PATCH 0249/2409] lib/tempest: Post juno-eol cleanup

There's no need to change these Tempest's default anymore.
The feature flags are left in Tempest so that downstream distros can
continue to use Tempest to test Juno.

Change-Id: I99f286d0febb1675b8feb91b6801ad0b159da332
---
 lib/tempest | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index e90ff93c8a..b7094ab8b2 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -450,10 +450,6 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG validation network_for_ssh $PRIVATE_NETWORK_NAME
 
     # Volume
-    # TODO(dkranz): Remove the bootable flag when Juno is end of life.
-    iniset $TEMPEST_CONFIG volume-feature-enabled bootable True
-    # TODO(jordanP): Remove the extend_with_snapshot flag when Juno is end of life.
-    iniset $TEMPEST_CONFIG volume-feature-enabled extend_with_snapshot True
     # TODO(obutenko): Remove the incremental_backup_force flag when Kilo and Juno is end of life.
     iniset $TEMPEST_CONFIG volume-feature-enabled incremental_backup_force True
     # TODO(ynesenenko): Remove the volume_services flag when Liberty and Kilo will correct work with host info.

From 14a7148f41f859c0b42641596d7d9f2c0fa295ef Mon Sep 17 00:00:00 2001
From: Armando Migliaccio <armamig@gmail.com>
Date: Wed, 17 Feb 2016 02:23:47 +0000
Subject: [PATCH 0250/2409] Revert "Fix stack failure when default subnetpool
 is set"

This reverts commit 8a3b7d424d8edf53d0560db48247e6bca11176ee.

This change masked a non-backward compatible change made to the
Neutron core API. This is being cleaned up and thus this workaround
is no longer required.

Depends-on: Idf516ed9db24d779742cdff0584b48182a8502d6

Change-Id: I6695a6e17df1a395ada4ecf2b063b2c20870d99d
---
 exercises/neutron-adv-test.sh | 2 +-
 lib/neutron-legacy            | 8 ++------
 2 files changed, 3 insertions(+), 7 deletions(-)

diff --git a/exercises/neutron-adv-test.sh b/exercises/neutron-adv-test.sh
index 9bcb7669b7..a8fbd86473 100755
--- a/exercises/neutron-adv-test.sh
+++ b/exercises/neutron-adv-test.sh
@@ -235,7 +235,7 @@ function create_network {
     local NET_ID
     NET_ID=$(neutron net-create --tenant-id $TENANT_ID $NET_NAME $EXTRA| grep ' id ' | awk '{print $4}' )
     die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $TENANT_ID $NET_NAME $EXTRA"
-    neutron subnet-create --ip-version 4 --tenant-id $TENANT_ID --gateway $GATEWAY --subnetpool None $NET_ID $CIDR
+    neutron subnet-create --ip-version 4 --tenant-id $TENANT_ID --gateway $GATEWAY $NET_ID $CIDR
     neutron_debug_admin probe-create --device-owner compute $NET_ID
     source $TOP_DIR/openrc demo demo
 }
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index d0523f4f0a..3ed5754de7 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -551,12 +551,12 @@ function create_neutron_initial_network {
         die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PHYSICAL_NETWORK $TENANT_ID"
 
         if [[ "$IP_VERSION" =~ 4.* ]]; then
-            SUBNET_ID=$(neutron subnet-create --tenant_id $TENANT_ID --ip_version 4 ${ALLOCATION_POOL:+--allocation-pool $ALLOCATION_POOL} --name $PROVIDER_SUBNET_NAME --gateway $NETWORK_GATEWAY --subnetpool None $NET_ID $FIXED_RANGE | grep ' id ' | get_field 2)
+            SUBNET_ID=$(neutron subnet-create --tenant_id $TENANT_ID --ip_version 4 ${ALLOCATION_POOL:+--allocation-pool $ALLOCATION_POOL} --name $PROVIDER_SUBNET_NAME --gateway $NETWORK_GATEWAY $NET_ID $FIXED_RANGE | grep ' id ' | get_field 2)
             die_if_not_set $LINENO SUBNET_ID "Failure creating SUBNET_ID for $PROVIDER_SUBNET_NAME $TENANT_ID"
         fi
 
         if [[ "$IP_VERSION" =~ .*6 ]] && [[ -n "$IPV6_PROVIDER_FIXED_RANGE" ]] && [[ -n "$IPV6_PROVIDER_NETWORK_GATEWAY" ]]; then
-            SUBNET_V6_ID=$(neutron subnet-create --tenant_id $TENANT_ID --ip_version 6 --ipv6-address-mode $IPV6_ADDRESS_MODE --gateway $IPV6_PROVIDER_NETWORK_GATEWAY --name $IPV6_PROVIDER_SUBNET_NAME --subnetpool None $NET_ID $IPV6_PROVIDER_FIXED_RANGE | grep 'id' | get_field 2)
+            SUBNET_V6_ID=$(neutron subnet-create --tenant_id $TENANT_ID --ip_version 6 --ipv6-address-mode $IPV6_ADDRESS_MODE --gateway $IPV6_PROVIDER_NETWORK_GATEWAY --name $IPV6_PROVIDER_SUBNET_NAME $NET_ID $IPV6_PROVIDER_FIXED_RANGE | grep 'id' | get_field 2)
             die_if_not_set $LINENO SUBNET_V6_ID "Failure creating SUBNET_V6_ID for $IPV6_PROVIDER_SUBNET_NAME $TENANT_ID"
         fi
 
@@ -1262,7 +1262,6 @@ function _neutron_create_private_subnet_v4 {
     subnet_params+="--ip_version 4 "
     subnet_params+="--gateway $NETWORK_GATEWAY "
     subnet_params+="--name $PRIVATE_SUBNET_NAME "
-    subnet_params+="--subnetpool None "
     subnet_params+="$NET_ID $FIXED_RANGE"
     local subnet_id
     subnet_id=$(neutron subnet-create $subnet_params | grep ' id ' | get_field 2)
@@ -1279,7 +1278,6 @@ function _neutron_create_private_subnet_v6 {
     subnet_params+="--ip_version 6 "
     subnet_params+="--gateway $IPV6_PRIVATE_NETWORK_GATEWAY "
     subnet_params+="--name $IPV6_PRIVATE_SUBNET_NAME "
-    subnet_params+="--subnetpool None "
     subnet_params+="$NET_ID $FIXED_RANGE_V6 $ipv6_modes"
     local ipv6_subnet_id
     ipv6_subnet_id=$(neutron subnet-create $subnet_params | grep ' id ' | get_field 2)
@@ -1293,7 +1291,6 @@ function _neutron_create_public_subnet_v4 {
     subnet_params+="${Q_FLOATING_ALLOCATION_POOL:+--allocation-pool $Q_FLOATING_ALLOCATION_POOL} "
     subnet_params+="--gateway $PUBLIC_NETWORK_GATEWAY "
     subnet_params+="--name $PUBLIC_SUBNET_NAME "
-    subnet_params+="--subnetpool None "
     subnet_params+="$EXT_NET_ID $FLOATING_RANGE "
     subnet_params+="-- --enable_dhcp=False"
     local id_and_ext_gw_ip
@@ -1307,7 +1304,6 @@ function _neutron_create_public_subnet_v6 {
     local subnet_params="--ip_version 6 "
     subnet_params+="--gateway $IPV6_PUBLIC_NETWORK_GATEWAY "
     subnet_params+="--name $IPV6_PUBLIC_SUBNET_NAME "
-    subnet_params+="--subnetpool None "
     subnet_params+="$EXT_NET_ID $IPV6_PUBLIC_RANGE "
     subnet_params+="-- --enable_dhcp=False"
     local ipv6_id_and_ext_gw_ip

From 33df895ffb042832057222432234172d6db18810 Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Wed, 17 Feb 2016 15:26:33 +0100
Subject: [PATCH 0251/2409] Tox: don't check stack-screenrc with bashate

Change-Id: I8f04de2cde8a123c3825e7ba22aef1f5b311f61c
Closes-Bug: #1531885
---
 tox.ini | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tox.ini b/tox.ini
index f9d04f2dcd..07e8a8faab 100644
--- a/tox.ini
+++ b/tox.ini
@@ -18,6 +18,7 @@ commands = bash -c "find {toxinidir}             \
          -type f                                 \
          -not -name \*~                          \
          -not -name \*.md                        \
+         -not -name stack-screenrc               \
          \(                                      \
           -name \*.sh -or                        \
           -name \*.orig -or                      \

From 8040e69a049731216efcdc3497b78391f7bc2a31 Mon Sep 17 00:00:00 2001
From: Mike Chester <mchester@siaras.com>
Date: Wed, 17 Feb 2016 10:52:33 -0800
Subject: [PATCH 0252/2409] Check UNSTACK_ALL or -a flag set on unstack

These flags were not functioning as described. Check if UNSTACK_ALL is
set in env or -a flag is set when calling script.

Change-Id: I128d32b1e74ee46e24a9eb2e81560e58137b1553
Closes-Bug: #1546687
---
 unstack.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/unstack.sh b/unstack.sh
index d69e3f5213..d7670e38a5 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -9,12 +9,12 @@
 # Stop all processes by setting ``UNSTACK_ALL`` or specifying ``-a``
 # on the command line
 
-UNSTACK_ALL=""
+UNSTACK_ALL=${UNSTACK_ALL:-""}
 
 while getopts ":a" opt; do
     case $opt in
         a)
-            UNSTACK_ALL=""
+            UNSTACK_ALL="-1"
             ;;
     esac
 done

From 8a4dea24faa51e79507aa3f1655cea46a382e95d Mon Sep 17 00:00:00 2001
From: Lucas Alvares Gomes <lucasagomes@gmail.com>
Date: Thu, 18 Feb 2016 15:52:22 +0000
Subject: [PATCH 0253/2409] Ironic: Update is_ironic_hardware function

The DevStack module of Ironic added a new configuration variable called
IRONIC_IS_HARDWARE that can be set to True/False to indicate that we are
setting up devstack to deploy physical or virtual machines (see the
depends flag). Prior to that, the devstack code assumed that if the
driver name loaded is != *_ssh then it's a physical hardware but now we
need to kill this assumption because we have means (see the virtualbmc
utility) to test drivers such as pxe_ipmitool and agent_ipmitool using
virtual machines.

Depends-On: I5edc51c7fc8b6f0bb7fe4ca129596709a32eb93e
Related-Bug: #1544642
Change-Id: I8b6363bbe280ddd2720c570851bc40e2804a40e2
---
 functions-common | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index 8e5285394c..ba697f8ad0 100644
--- a/functions-common
+++ b/functions-common
@@ -994,7 +994,7 @@ function get_endpoint_url {
 # out of tree, as it is used by nova and neutron.
 # figure out a way to refactor nova/neutron code to eliminate this
 function is_ironic_hardware {
-    is_service_enabled ironic && [[ -n "${IRONIC_DEPLOY_DRIVER##*_ssh}" ]] && return 0
+    is_service_enabled ironic && [[ "$IRONIC_IS_HARDWARE" == "True" ]] && return 0
     return 1
 }
 

From b9201ccbbff301fea18fae56696b59bb7f68189d Mon Sep 17 00:00:00 2001
From: gordon chung <gord@live.ca>
Date: Thu, 18 Feb 2016 15:50:01 -0500
Subject: [PATCH 0254/2409] fix postgres service name

in fedora postgresql is the service name and postgresql-server is
the package.[1]

os: Fedora release 23 (Twenty Three)
psql: psql (PostgreSQL) 9.4.5

i'm not entirely sure when this changed, but it's devstack is broken
in above environment.

[1]https://fedoraproject.org/wiki/PostgreSQL

Change-Id: Id940fed2a777ca469ce77402e1136251ba572359
---
 lib/databases/postgresql | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/databases/postgresql b/lib/databases/postgresql
index 204c257a67..852bac4906 100644
--- a/lib/databases/postgresql
+++ b/lib/databases/postgresql
@@ -102,7 +102,7 @@ EOF
     elif is_fedora || is_suse; then
         install_package postgresql-server
         if is_fedora; then
-            sudo systemctl enable postgresql-server
+            sudo systemctl enable postgresql
         fi
     else
         exit_distro_not_supported "postgresql installation"

From e3e805186476018b988f68f3ef3dfaccbf3c0f20 Mon Sep 17 00:00:00 2001
From: Clint Adams <clint@gcfm.net>
Date: Thu, 18 Feb 2016 14:46:35 -0500
Subject: [PATCH 0255/2409] Generate plugins list through https requests

The devstack plugins list can be generated through web requests in
environments (such as the proposal slave) that lack copies of all
the relevant git repositories.

One downside to this is that there is no way of getting the last
modification time of the plugin.

Change-Id: I2c5c9282a8ad80014cad171a4dfbdc8f26044cd1
---
 data/devstack-plugins-registry.header   |  6 +--
 tools/generate-devstack-plugins-list.py | 59 +++++++++++++++++++++++++
 tools/generate-devstack-plugins-list.sh | 59 +++++++++++++++++--------
 3 files changed, 102 insertions(+), 22 deletions(-)
 create mode 100644 tools/generate-devstack-plugins-list.py

diff --git a/data/devstack-plugins-registry.header b/data/devstack-plugins-registry.header
index 9f8a99471c..687db0441c 100644
--- a/data/devstack-plugins-registry.header
+++ b/data/devstack-plugins-registry.header
@@ -14,6 +14,6 @@ The following are plugins that a script has found in the openstack/
 namespace, which includes but is not limited to official OpenStack
 projects.
 
-+------------------+------------------------------------------------------------+------------+
-|Plugin Name       |URL                                                         |Date        |
-+------------------+------------------------------------------------------------+------------+
++------------------+-------------------------------------------------------------------------+
+|Plugin Name       |URL                                                                      |
++------------------+-------------------------------------------------------------------------+
diff --git a/tools/generate-devstack-plugins-list.py b/tools/generate-devstack-plugins-list.py
new file mode 100644
index 0000000000..1fa550192e
--- /dev/null
+++ b/tools/generate-devstack-plugins-list.py
@@ -0,0 +1,59 @@
+#! /usr/bin/env python
+
+# Copyright 2016 Hewlett Packard Enterprise Development Company, L.P.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+# This script is intended to be run as part of a periodic proposal bot
+# job in OpenStack infrastructure.
+#
+# In order to function correctly, the environment in which the
+# script runs must have
+#   * network access to the review.openstack.org Gerrit API
+#     working directory
+#   * network access to https://git.openstack.org/cgit
+
+import json
+import requests
+
+url = 'https://review.openstack.org/projects/'
+
+# This is what a project looks like
+'''
+  "openstack-attic/akanda": {
+    "id": "openstack-attic%2Fakanda",
+    "state": "READ_ONLY"
+  },
+'''
+
+def is_in_openstack_namespace(proj):
+    return proj.startswith('openstack/')
+
+# Rather than returning a 404 for a nonexistent file, cgit delivers a
+# 0-byte response to a GET request.  It also does not provide a
+# Content-Length in a HEAD response, so the way we tell if a file exists
+# is to check the length of the entire GET response body.
+def has_devstack_plugin(proj):
+    r = requests.get("https://git.openstack.org/cgit/%s/plain/devstack/plugin.sh" % proj)
+    if len(r.text) > 0:
+        return True
+    else:
+        False
+
+r = requests.get(url)
+projects = sorted(filter(is_in_openstack_namespace, json.loads(r.text[4:])))
+
+found_plugins = filter(has_devstack_plugin, projects)
+
+for project in found_plugins:
+    print project[10:]
diff --git a/tools/generate-devstack-plugins-list.sh b/tools/generate-devstack-plugins-list.sh
index 6e9e828978..01767854d7 100644
--- a/tools/generate-devstack-plugins-list.sh
+++ b/tools/generate-devstack-plugins-list.sh
@@ -19,11 +19,19 @@
 #
 # In order to function correctly, the environment in which the
 # script runs must have
+#   * a writable doc/source directory relative to the current
+#     working directory
+#   AND ( (
 #   * git
 #   * all git repos meant to be searched for plugins cloned and
 #     at the desired level of up-to-datedness
-#   * a writable doc/source directory relative to the current
+#   * the environment variable git_dir pointing to the location
+#   * of said git repositories
+#   ) OR (
+#   * network access to the review.openstack.org Gerrit API
 #     working directory
+#   * network access to https://git.openstack.org/cgit
+#   ))
 #
 # If a file named data/devstack-plugins-registry.header or
 # data/devstack-plugins-registry.footer is found relative to the
@@ -35,25 +43,38 @@ declare -A plugins
 
 test -r data/devstack-plugins-registry.header && cat data/devstack-plugins-registry.header
 
-pushd ${git_dir:-/opt/openstack} >/dev/null
-for i in *; do
-    pushd ${i} >/dev/null
-    if output="$(git log --diff-filter=A --format='%cd' --date=short -1 -- devstack/plugin.sh)"; then
-        test -n "$output" && plugins[$i]=${output}
-    fi
+if test -n "$git_dir"; then
+    pushd ${git_dir} >/dev/null
+    for i in *; do
+        pushd ${i} >/dev/null
+        if output="$(git log --diff-filter=A --format='%cd' --date=short -1 -- devstack/plugin.sh)"; then
+            test -n "$output" && plugins[$i]=${output}
+        fi
+        popd >/dev/null
+    done
     popd >/dev/null
-done
-popd >/dev/null
-
-sorted_plugins=( $(for k in "${!plugins[@]}"; do echo "$k"; done | sort))
-
-for k in "${sorted_plugins[@]}"; do
-    project=${k:0:18}
-    giturl="git://git.openstack.org/openstack/${k:0:26}"
-    pdate="${plugins[$k]}"
-    printf "|%-18s|%-60s|%-12s|\n" "${project}" "${giturl}" "${pdate}"
-    printf "+------------------+------------------------------------------------------------+------------+\n"
-done
+
+    sorted_plugins=( $(for k in "${!plugins[@]}"; do echo "$k"; done | sort))
+
+    for k in "${sorted_plugins[@]}"; do
+        project=${k:0:18}
+        giturl="git://git.openstack.org/openstack/${k:0:26}"
+        pdate="${plugins[$k]}"
+        printf "|%-18s|%-60s (%-10s)|\n" "${project}" "${giturl}" "${pdate}"
+        printf "+------------------+-------------------------------------------------------------------------+\n"
+    done
+
+else
+    sorted_plugins=$(python tools/generate-devstack-plugins-list.py)
+
+    for k in ${sorted_plugins}; do
+        project=${k:0:18}
+        giturl="git://git.openstack.org/openstack/${k:0:26}"
+        printf "|%-18s|%-73s|\n" "${project}" "${giturl}"
+        printf "+------------------+-------------------------------------------------------------------------+\n"
+    done
+
+fi
 
 test -r data/devstack-plugins-registry.footer && cat data/devstack-plugins-registry.footer
 ) > doc/source/plugin-registry.rst

From 1ff75ff87fc2a46d1f88918d94be48e5d59e3aab Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 19 Feb 2016 14:28:37 +1100
Subject: [PATCH 0256/2409] Always strip package comments

In the "I can't believe I missed this" category -- the existing strip
method removes shortest match (%); which fails when you put another #
in the comment (like "refer to bug#1234").  Change to the longest
match which should strip everything from the first "#" to the end
(since that's going to be the longest).

Change-Id: I47f5e710ebd87b0f54549732e7d64cf42c7a6b65
---
 functions-common | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/functions-common b/functions-common
index 8e5285394c..ed444bbd41 100644
--- a/functions-common
+++ b/functions-common
@@ -1096,8 +1096,9 @@ function _parse_package_files {
                 continue
             fi
 
-            # Assume we want this package
-            package=${line%#*}
+            # Assume we want this package; free-form
+            # comments allowed after a #
+            package=${line%%#*}
             inst_pkg=1
 
             # Look for # dist:xxx in comment

From 7dbcfae7033a244e0ebeaa8e116f1c9364c23d48 Mon Sep 17 00:00:00 2001
From: Armando Migliaccio <armamig@gmail.com>
Date: Fri, 19 Feb 2016 14:43:42 -0800
Subject: [PATCH 0257/2409] Provision deployment requirements for
 get-me-a-network

Neutron implemented an extension to allow users to automatically
provision a basic network topology to connect their instances.

One of the requirements for this feature is to be able to mark
an external network to be the one to be used for external
connectivity. Another requirement is subnetpools, which are
used to determine the IP space to allocate for private tenant
networks.

This patch codifies these requirements. The provisioning
needs to be  made conditional  based on the extensions
needed for this to work correctly.

Partially-implements: blueprint get-me-a-network

Change-Id: I43ce5d65e754f131f7ca1ce2088a397d266cf821
---
 lib/neutron-legacy | 28 ++++++++++++++++++++++++++--
 1 file changed, 26 insertions(+), 2 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 539b9ff551..56a9bdf229 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -73,6 +73,16 @@ PUBLIC_NETWORK_GATEWAY=${PUBLIC_NETWORK_GATEWAY:-172.24.4.1}
 PRIVATE_SUBNET_NAME=${PRIVATE_SUBNET_NAME:-"private-subnet"}
 PUBLIC_SUBNET_NAME=${PUBLIC_SUBNET_NAME:-"public-subnet"}
 
+# Subnetpool defaults
+SUBNETPOOL_NAME=${SUBNETPOOL_NAME:-"shared-default-subnetpool"}
+
+SUBNETPOOL_PREFIX_V4=${SUBNETPOOL_PREFIX_V4:-10.0.0.0/24}
+SUBNETPOOL_PREFIX_V6=${SUBNETPOOL_PREFIX_V6:-2001:db8:8000::/48}
+
+SUBNETPOOL_SIZE_V4=${SUBNETPOOL_SIZE_V4:-26}
+SUBNETPOOL_SIZE_V6=${SUBNETPOOL_SIZE_V6:-64}
+
+
 if is_ssl_enabled_service "neutron" || is_service_enabled tls-proxy; then
     Q_PROTOCOL="https"
 fi
@@ -580,6 +590,8 @@ function create_neutron_initial_network {
         fi
     fi
 
+    AUTO_ALLOCATE_EXT=$(neutron ext-list | grep 'auto-allocated-topology' | get_field 1)
+    SUBNETPOOL_EXT=$(neutron ext-list | grep 'subnet_allocation' | get_field 1)
     if [[ "$Q_L3_ENABLED" == "True" ]]; then
         # Create a router, and add the private subnet as one of its interfaces
         if [[ "$Q_L3_ROUTER_PER_TENANT" == "True" ]]; then
@@ -592,11 +604,23 @@ function create_neutron_initial_network {
             die_if_not_set $LINENO ROUTER_ID "Failure creating ROUTER_ID for $Q_ROUTER_NAME"
         fi
 
+        # if the extension is available, then mark the external
+        # network as default, and provision default subnetpools
+        EXTERNAL_NETWORK_FLAGS="--router:external"
+        if [[ -n $AUTO_ALLOCATE_EXT && -n $SUBNETPOOL_EXT ]]; then
+            EXTERNAL_NETWORK_FLAGS="$EXTERNAL_NETWORK_FLAGS --is-default"
+            if [[ "$IP_VERSION" =~ 4.* ]]; then
+                SUBNETPOOL_V4_ID=$(neutron subnetpool-create $SUBNETPOOL_NAME --default-prefixlen $SUBNETPOOL_SIZE_V4 --pool-prefix $SUBNETPOOL_PREFIX_V4 --shared --is-default=True | grep ' id ' | get_field 2)
+            fi
+            if [[ "$IP_VERSION" =~ .*6 ]]; then
+                SUBNETPOOL_V6_ID=$(neutron subnetpool-create $SUBNETPOOL_NAME --default-prefixlen $SUBNETPOOL_SIZE_V6 --pool-prefix $SUBNETPOOL_PREFIX_V6 --shared --is-default=True | grep ' id ' | get_field 2)
+            fi
+        fi
         # Create an external network, and a subnet. Configure the external network as router gw
         if [ "$Q_USE_PROVIDERNET_FOR_PUBLIC" = "True" ]; then
-            EXT_NET_ID=$(neutron net-create "$PUBLIC_NETWORK_NAME" -- --router:external=True --provider:network_type=flat --provider:physical_network=${PUBLIC_PHYSICAL_NETWORK} | grep ' id ' | get_field 2)
+            EXT_NET_ID=$(neutron net-create "$PUBLIC_NETWORK_NAME" -- $EXTERNAL_NETWORK_FLAGS --provider:network_type=flat --provider:physical_network=${PUBLIC_PHYSICAL_NETWORK} | grep ' id ' | get_field 2)
         else
-            EXT_NET_ID=$(neutron net-create "$PUBLIC_NETWORK_NAME" -- --router:external=True | grep ' id ' | get_field 2)
+            EXT_NET_ID=$(neutron net-create "$PUBLIC_NETWORK_NAME" -- $EXTERNAL_NETWORK_FLAGS | grep ' id ' | get_field 2)
         fi
         die_if_not_set $LINENO EXT_NET_ID "Failure creating EXT_NET_ID for $PUBLIC_NETWORK_NAME"
 

From 2688eedc51fc7b4ef0a5332c1aafce8a557928da Mon Sep 17 00:00:00 2001
From: Akihiro Motoki <motoki@da.jp.nec.com>
Date: Wed, 13 Jan 2016 23:01:39 +0900
Subject: [PATCH 0258/2409] Remove Neutron VMware NSX plugin files completely

override-defaults mechanism allows us to define
s_neutron_plugin_security_group before loading lib/neutron,
and we no longer need to have a plugin-specific file in
the master DevStack repository.

Change-Id: Ib0f6e3d9463357d2dd66a2d61b8c722fa1f0bfba
Depends-On: I8b19b8f1b0694a96132f158146848aee7d14e8ff
---
 lib/neutron_plugins/vmware_dvs    | 10 ----------
 lib/neutron_plugins/vmware_nsx    | 10 ----------
 lib/neutron_plugins/vmware_nsx_v  | 10 ----------
 lib/neutron_plugins/vmware_nsx_v3 | 10 ----------
 4 files changed, 40 deletions(-)
 delete mode 100644 lib/neutron_plugins/vmware_dvs
 delete mode 100644 lib/neutron_plugins/vmware_nsx
 delete mode 100644 lib/neutron_plugins/vmware_nsx_v
 delete mode 100644 lib/neutron_plugins/vmware_nsx_v3

diff --git a/lib/neutron_plugins/vmware_dvs b/lib/neutron_plugins/vmware_dvs
deleted file mode 100644
index 587d5a6b11..0000000000
--- a/lib/neutron_plugins/vmware_dvs
+++ /dev/null
@@ -1,10 +0,0 @@
-#!/bin/bash
-
-# This file is needed so Q_PLUGIN=vmware_dvs will work.
-
-# FIXME(salv-orlando): This function should not be here, but unfortunately
-# devstack calls it before the external plugins are fetched
-function has_neutron_plugin_security_group {
-    # 0 means True here
-    return 0
-}
diff --git a/lib/neutron_plugins/vmware_nsx b/lib/neutron_plugins/vmware_nsx
deleted file mode 100644
index b6c1c9c13f..0000000000
--- a/lib/neutron_plugins/vmware_nsx
+++ /dev/null
@@ -1,10 +0,0 @@
-#!/bin/bash
-
-# This file is needed so Q_PLUGIN=vmware_nsx will work.
-
-# FIXME(salv-orlando): This function should not be here, but unfortunately
-# devstack calls it before the external plugins are fetched
-function has_neutron_plugin_security_group {
-    # 0 means True here
-    return 0
-}
diff --git a/lib/neutron_plugins/vmware_nsx_v b/lib/neutron_plugins/vmware_nsx_v
deleted file mode 100644
index 3d33c652d1..0000000000
--- a/lib/neutron_plugins/vmware_nsx_v
+++ /dev/null
@@ -1,10 +0,0 @@
-#!/bin/bash
-#
-# This file is needed so Q_PLUGIN=vmware_nsx_v will work.
-
-# FIXME(salv-orlando): This function should not be here, but unfortunately
-# devstack calls it before the external plugins are fetched
-function has_neutron_plugin_security_group {
-    # 0 means True here
-    return 0
-}
diff --git a/lib/neutron_plugins/vmware_nsx_v3 b/lib/neutron_plugins/vmware_nsx_v3
deleted file mode 100644
index 6d8a6e6b70..0000000000
--- a/lib/neutron_plugins/vmware_nsx_v3
+++ /dev/null
@@ -1,10 +0,0 @@
-#!/bin/bash
-
-# This file is needed so Q_PLUGIN=vmware_nsx_v3 will work.
-
-# FIXME(salv-orlando): This function should not be here, but unfortunately
-# devstack calls it before the external plugins are fetched
-function has_neutron_plugin_security_group {
-    # 0 means True here
-    return 0
-}

From 7580a0c3e37932a8fc03750d35ccd4e13e18f8c4 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 17 Feb 2016 06:23:36 -0500
Subject: [PATCH 0259/2409] Replace TENANT => PROJECT phase 1

This replaces the use of TENANT variables with PROJECT ones during the
initial setup. The openrc will still export a OS_TENANT_NAME because
many tools (cinderclient, glanceclient amoung them) will not function
without it. We warn when we do that.

Change-Id: I824b1121842eb5821034071874bf1bb2d7c3631e
---
 exercises/boot_from_volume.sh |   2 +-
 exercises/client-args.sh      |  16 ++--
 exercises/neutron-adv-test.sh | 142 +++++++++++++++++-----------------
 lib/cinder                    |   2 +-
 lib/glance                    |  12 +--
 lib/keystone                  |   8 +-
 lib/neutron-legacy            |   4 +-
 lib/nova                      |   6 +-
 lib/swift                     |   4 +-
 openrc                        |  26 ++++---
 stack.sh                      |   2 +-
 11 files changed, 114 insertions(+), 110 deletions(-)

diff --git a/exercises/boot_from_volume.sh b/exercises/boot_from_volume.sh
index d520b9bbbf..54098594ff 100755
--- a/exercises/boot_from_volume.sh
+++ b/exercises/boot_from_volume.sh
@@ -64,7 +64,7 @@ VOL_NAME=${VOL_NAME:-ex-vol-bfv}
 # Launching a server
 # ==================
 
-# List servers for tenant:
+# List servers for project:
 nova list
 
 # Images
diff --git a/exercises/client-args.sh b/exercises/client-args.sh
index 7cfef1c807..07ce5284e8 100755
--- a/exercises/client-args.sh
+++ b/exercises/client-args.sh
@@ -43,19 +43,19 @@ unset NOVA_URL
 unset NOVA_USERNAME
 
 # Save the known variables for later
-export x_TENANT_NAME=$OS_TENANT_NAME
+export x_PROJECT_NAME=$OS_PROJECT_NAME
 export x_USERNAME=$OS_USERNAME
 export x_PASSWORD=$OS_PASSWORD
 export x_AUTH_URL=$OS_AUTH_URL
 
 # Unset the usual variables to force argument processing
-unset OS_TENANT_NAME
+unset OS_PROJECT_NAME
 unset OS_USERNAME
 unset OS_PASSWORD
 unset OS_AUTH_URL
 
 # Common authentication args
-TENANT_ARG="--os-tenant-name=$x_TENANT_NAME"
+PROJECT_ARG="--os-project-name=$x_PROJECT_NAME"
 ARGS="--os-username=$x_USERNAME --os-password=$x_PASSWORD --os-auth-url=$x_AUTH_URL"
 
 # Set global return
@@ -68,7 +68,7 @@ if [[ "$ENABLED_SERVICES" =~ "key" ]]; then
         STATUS_KEYSTONE="Skipped"
     else
         echo -e "\nTest Keystone"
-        if openstack $TENANT_ARG $ARGS catalog show identity; then
+        if openstack $PROJECT_ARG $ARGS catalog show identity; then
             STATUS_KEYSTONE="Succeeded"
         else
             STATUS_KEYSTONE="Failed"
@@ -87,7 +87,7 @@ if [[ "$ENABLED_SERVICES" =~ "n-api" ]]; then
     else
         # Test OSAPI
         echo -e "\nTest Nova"
-        if nova $TENANT_ARG $ARGS flavor-list; then
+        if nova $PROJECT_ARG $ARGS flavor-list; then
             STATUS_NOVA="Succeeded"
         else
             STATUS_NOVA="Failed"
@@ -104,7 +104,7 @@ if [[ "$ENABLED_SERVICES" =~ "c-api" ]]; then
         STATUS_CINDER="Skipped"
     else
         echo -e "\nTest Cinder"
-        if cinder $TENANT_ARG $ARGS list; then
+        if cinder $PROJECT_ARG $ARGS list; then
             STATUS_CINDER="Succeeded"
         else
             STATUS_CINDER="Failed"
@@ -121,7 +121,7 @@ if [[ "$ENABLED_SERVICES" =~ "g-api" ]]; then
         STATUS_GLANCE="Skipped"
     else
         echo -e "\nTest Glance"
-        if openstack $TENANT_ARG $ARGS image list; then
+        if openstack $PROJECT_ARG $ARGS image list; then
             STATUS_GLANCE="Succeeded"
         else
             STATUS_GLANCE="Failed"
@@ -138,7 +138,7 @@ if [[ "$ENABLED_SERVICES" =~ "swift" || "$ENABLED_SERVICES" =~ "s-proxy" ]]; the
         STATUS_SWIFT="Skipped"
     else
         echo -e "\nTest Swift"
-        if swift $TENANT_ARG $ARGS stat; then
+        if swift $PROJECT_ARG $ARGS stat; then
             STATUS_SWIFT="Succeeded"
         else
             STATUS_SWIFT="Failed"
diff --git a/exercises/neutron-adv-test.sh b/exercises/neutron-adv-test.sh
index a8fbd86473..a3128a8d71 100755
--- a/exercises/neutron-adv-test.sh
+++ b/exercises/neutron-adv-test.sh
@@ -48,9 +48,9 @@ source $TOP_DIR/exerciserc
 # Neutron Settings
 # ----------------
 
-TENANTS="DEMO1"
+PROJECTS="DEMO1"
 # TODO (nati)_Test public network
-#TENANTS="DEMO1,DEMO2"
+#PROJECTS="DEMO1,DEMO2"
 
 PUBLIC_NAME="admin"
 DEMO1_NAME="demo1"
@@ -91,34 +91,34 @@ DEMO2_ROUTER1_NET="demo2-net1"
 # Various functions
 # -----------------
 
-function foreach_tenant {
+function foreach_project {
     COMMAND=$1
-    for TENANT in ${TENANTS//,/ };do
-        eval ${COMMAND//%TENANT%/$TENANT}
+    for PROJECT in ${PROJECTS//,/ };do
+        eval ${COMMAND//%PROJECT%/$PROJECT}
     done
 }
 
-function foreach_tenant_resource {
+function foreach_project_resource {
     COMMAND=$1
     RESOURCE=$2
-    for TENANT in ${TENANTS//,/ };do
-        eval 'NUM=$'"${TENANT}_NUM_$RESOURCE"
+    for PROJECT in ${PROJECTS//,/ };do
+        eval 'NUM=$'"${PROJECT}_NUM_$RESOURCE"
         for i in `seq $NUM`;do
-            local COMMAND_LOCAL=${COMMAND//%TENANT%/$TENANT}
+            local COMMAND_LOCAL=${COMMAND//%PROJECT%/$PROJECT}
             COMMAND_LOCAL=${COMMAND_LOCAL//%NUM%/$i}
             eval $COMMAND_LOCAL
         done
     done
 }
 
-function foreach_tenant_vm {
+function foreach_project_vm {
     COMMAND=$1
-    foreach_tenant_resource "$COMMAND" 'VM'
+    foreach_project_resource "$COMMAND" 'VM'
 }
 
-function foreach_tenant_net {
+function foreach_project_net {
     COMMAND=$1
-    foreach_tenant_resource "$COMMAND" 'NET'
+    foreach_project_resource "$COMMAND" 'NET'
 }
 
 function get_image_id {
@@ -128,12 +128,12 @@ function get_image_id {
     echo "$IMAGE_ID"
 }
 
-function get_tenant_id {
-    local TENANT_NAME=$1
-    local TENANT_ID
-    TENANT_ID=`openstack project list | grep " $TENANT_NAME " | head -n 1 | get_field 1`
-    die_if_not_set $LINENO TENANT_ID "Failure retrieving TENANT_ID for $TENANT_NAME"
-    echo "$TENANT_ID"
+function get_project_id {
+    local PROJECT_NAME=$1
+    local PROJECT_ID
+    PROJECT_ID=`openstack project list | grep " $PROJECT_NAME " | head -n 1 | get_field 1`
+    die_if_not_set $LINENO PROJECT_ID "Failure retrieving PROJECT_ID for $PROJECT_NAME"
+    echo "$PROJECT_ID"
 }
 
 function get_user_id {
@@ -177,23 +177,23 @@ function confirm_server_active {
 
 function neutron_debug_admin {
     local os_username=$OS_USERNAME
-    local os_tenant_id=$OS_TENANT_ID
+    local os_project_id=$OS_PROJECT_ID
     source $TOP_DIR/openrc admin admin
     neutron-debug $@
-    source $TOP_DIR/openrc $os_username $os_tenant_id
+    source $TOP_DIR/openrc $os_username $os_project_id
 }
 
-function add_tenant {
+function add_project {
     openstack project create $1
     openstack user create $2 --password ${ADMIN_PASSWORD} --project $1
     openstack role add Member --project $1 --user $2
 }
 
-function remove_tenant {
-    local TENANT=$1
-    local TENANT_ID
-    TENANT_ID=$(get_tenant_id $TENANT)
-    openstack project delete $TENANT_ID
+function remove_project {
+    local PROJECT=$1
+    local PROJECT_ID
+    PROJECT_ID=$(get_project_id $PROJECT)
+    openstack project delete $PROJECT_ID
 }
 
 function remove_user {
@@ -203,47 +203,47 @@ function remove_user {
     openstack user delete $USER_ID
 }
 
-function create_tenants {
+function create_projects {
     source $TOP_DIR/openrc admin admin
-    add_tenant demo1 demo1 demo1
-    add_tenant demo2 demo2 demo2
+    add_project demo1 demo1 demo1
+    add_project demo2 demo2 demo2
     source $TOP_DIR/openrc demo demo
 }
 
-function delete_tenants_and_users {
+function delete_projects_and_users {
     source $TOP_DIR/openrc admin admin
     remove_user demo1
-    remove_tenant demo1
+    remove_project demo1
     remove_user demo2
-    remove_tenant demo2
-    echo "removed all tenants"
+    remove_project demo2
+    echo "removed all projects"
     source $TOP_DIR/openrc demo demo
 }
 
 function create_network {
-    local TENANT=$1
+    local PROJECT=$1
     local GATEWAY=$2
     local CIDR=$3
     local NUM=$4
     local EXTRA=$5
-    local NET_NAME="${TENANT}-net$NUM"
-    local ROUTER_NAME="${TENANT}-router${NUM}"
+    local NET_NAME="${PROJECT}-net$NUM"
+    local ROUTER_NAME="${PROJECT}-router${NUM}"
     source $TOP_DIR/openrc admin admin
-    local TENANT_ID
-    TENANT_ID=$(get_tenant_id $TENANT)
-    source $TOP_DIR/openrc $TENANT $TENANT
+    local PROJECT_ID
+    PROJECT_ID=$(get_project_id $PROJECT)
+    source $TOP_DIR/openrc $PROJECT $PROJECT
     local NET_ID
-    NET_ID=$(neutron net-create --tenant-id $TENANT_ID $NET_NAME $EXTRA| grep ' id ' | awk '{print $4}' )
-    die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $TENANT_ID $NET_NAME $EXTRA"
-    neutron subnet-create --ip-version 4 --tenant-id $TENANT_ID --gateway $GATEWAY $NET_ID $CIDR
+    NET_ID=$(neutron net-create --project-id $PROJECT_ID $NET_NAME $EXTRA| grep ' id ' | awk '{print $4}' )
+    die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PROJECT_ID $NET_NAME $EXTRA"
+    neutron subnet-create --ip-version 4 --project-id $PROJECT_ID --gateway $GATEWAY --subnetpool None $NET_ID $CIDR
     neutron_debug_admin probe-create --device-owner compute $NET_ID
     source $TOP_DIR/openrc demo demo
 }
 
 function create_networks {
-    foreach_tenant_net 'create_network ${%TENANT%_NAME} ${%TENANT%_NET%NUM%_GATEWAY} ${%TENANT%_NET%NUM%_CIDR} %NUM% ${%TENANT%_NET%NUM%_EXTRA}'
+    foreach_project_net 'create_network ${%PROJECT%_NAME} ${%PROJECT%_NET%NUM%_GATEWAY} ${%PROJECT%_NET%NUM%_CIDR} %NUM% ${%PROJECT%_NET%NUM%_EXTRA}'
     #TODO(nati) test security group function
-    # allow ICMP for both tenant's security groups
+    # allow ICMP for both project's security groups
     #source $TOP_DIR/openrc demo1 demo1
     #$NOVA secgroup-add-rule default icmp -1 -1 0.0.0.0/0
     #source $TOP_DIR/openrc demo2 demo2
@@ -251,10 +251,10 @@ function create_networks {
 }
 
 function create_vm {
-    local TENANT=$1
+    local PROJECT=$1
     local NUM=$2
     local NET_NAMES=$3
-    source $TOP_DIR/openrc $TENANT $TENANT
+    source $TOP_DIR/openrc $PROJECT $PROJECT
     local NIC=""
     for NET_NAME in ${NET_NAMES//,/ };do
         NIC="$NIC --nic net-id="`get_network_id $NET_NAME`
@@ -265,13 +265,13 @@ function create_vm {
     VM_UUID=`nova boot --flavor $(get_flavor_id m1.tiny) \
         --image $(get_image_id) \
         $NIC \
-        $TENANT-server$NUM | grep ' id ' | cut -d"|" -f3 | sed 's/ //g'`
-    die_if_not_set $LINENO VM_UUID "Failure launching $TENANT-server$NUM"
+        $PROJECT-server$NUM | grep ' id ' | cut -d"|" -f3 | sed 's/ //g'`
+    die_if_not_set $LINENO VM_UUID "Failure launching $PROJECT-server$NUM"
     confirm_server_active $VM_UUID
 }
 
 function create_vms {
-    foreach_tenant_vm 'create_vm ${%TENANT%_NAME} %NUM% ${%TENANT%_VM%NUM%_NET}'
+    foreach_project_vm 'create_vm ${%PROJECT%_NAME} %NUM% ${%PROJECT%_VM%NUM%_NET}'
 }
 
 function ping_ip {
@@ -284,11 +284,11 @@ function ping_ip {
 }
 
 function check_vm {
-    local TENANT=$1
+    local PROJECT=$1
     local NUM=$2
-    local VM_NAME="$TENANT-server$NUM"
+    local VM_NAME="$PROJECT-server$NUM"
     local NET_NAME=$3
-    source $TOP_DIR/openrc $TENANT $TENANT
+    source $TOP_DIR/openrc $PROJECT $PROJECT
     ping_ip $VM_NAME $NET_NAME
     # TODO (nati) test ssh connection
     # TODO (nati) test inter connection between vm
@@ -297,31 +297,31 @@ function check_vm {
 }
 
 function check_vms {
-    foreach_tenant_vm 'check_vm ${%TENANT%_NAME} %NUM% ${%TENANT%_VM%NUM%_NET}'
+    foreach_project_vm 'check_vm ${%PROJECT%_NAME} %NUM% ${%PROJECT%_VM%NUM%_NET}'
 }
 
 function shutdown_vm {
-    local TENANT=$1
+    local PROJECT=$1
     local NUM=$2
-    source $TOP_DIR/openrc $TENANT $TENANT
-    VM_NAME=${TENANT}-server$NUM
+    source $TOP_DIR/openrc $PROJECT $PROJECT
+    VM_NAME=${PROJECT}-server$NUM
     nova delete $VM_NAME
 }
 
 function shutdown_vms {
-    foreach_tenant_vm 'shutdown_vm ${%TENANT%_NAME} %NUM%'
+    foreach_project_vm 'shutdown_vm ${%PROJECT%_NAME} %NUM%'
     if ! timeout $TERMINATE_TIMEOUT sh -c "while nova list | grep -q ACTIVE; do sleep 1; done"; then
         die $LINENO "Some VMs failed to shutdown"
     fi
 }
 
 function delete_network {
-    local TENANT=$1
+    local PROJECT=$1
     local NUM=$2
-    local NET_NAME="${TENANT}-net$NUM"
+    local NET_NAME="${PROJECT}-net$NUM"
     source $TOP_DIR/openrc admin admin
-    local TENANT_ID
-    TENANT_ID=$(get_tenant_id $TENANT)
+    local PROJECT_ID
+    PROJECT_ID=$(get_project_id $PROJECT)
     #TODO(nati) comment out until l3-agent merged
     #for res in port subnet net router;do
     for net_id in `neutron net-list -c id -c name | grep $NET_NAME | awk '{print $2}'`;do
@@ -333,7 +333,7 @@ function delete_network {
 }
 
 function delete_networks {
-    foreach_tenant_net 'delete_network ${%TENANT%_NAME} %NUM%'
+    foreach_project_net 'delete_network ${%PROJECT%_NAME} %NUM%'
     # TODO(nati) add secuirty group check after it is implemented
     # source $TOP_DIR/openrc demo1 demo1
     # nova secgroup-delete-rule default icmp -1 -1 0.0.0.0/0
@@ -342,7 +342,7 @@ function delete_networks {
 }
 
 function create_all {
-    create_tenants
+    create_projects
     create_networks
     create_vms
 }
@@ -350,7 +350,7 @@ function create_all {
 function delete_all {
     shutdown_vms
     delete_networks
-    delete_tenants_and_users
+    delete_projects_and_users
 }
 
 function all {
@@ -366,8 +366,8 @@ function test_functions {
     IMAGE=$(get_image_id)
     echo $IMAGE
 
-    TENANT_ID=$(get_tenant_id demo)
-    echo $TENANT_ID
+    PROJECT_ID=$(get_project_id demo)
+    echo $PROJECT_ID
 
     FLAVOR_ID=$(get_flavor_id m1.tiny)
     echo $FLAVOR_ID
@@ -382,11 +382,11 @@ function test_functions {
 function usage {
     echo "$0: [-h]"
     echo "  -h, --help              Display help message"
-    echo "  -t, --tenant            Create tenants"
+    echo "  -t, --project            Create projects"
     echo "  -n, --net               Create networks"
     echo "  -v, --vm                Create vms"
     echo "  -c, --check             Check connection"
-    echo "  -x, --delete-tenants    Delete tenants"
+    echo "  -x, --delete-projects    Delete projects"
     echo "  -y, --delete-nets       Delete networks"
     echo "  -z, --delete-vms        Delete vms"
     echo "  -T, --test              Test functions"
@@ -412,7 +412,7 @@ function main {
                 -v | --vm )     create_vms
                                 exit
                                 ;;
-                -t | --tenant ) create_tenants
+                -t | --project ) create_projects
                                 exit
                                 ;;
                 -c | --check )   check_vms
@@ -421,7 +421,7 @@ function main {
                 -T | --test )   test_functions
                                 exit
                                 ;;
-                -x | --delete-tenants ) delete_tenants_and_users
+                -x | --delete-projects ) delete_projects_and_users
                                 exit
                                 ;;
                 -y | --delete-nets ) delete_networks
diff --git a/lib/cinder b/lib/cinder
index e1e1f2a893..6401f2d59a 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -351,7 +351,7 @@ function configure_cinder {
     # Set os_privileged_user credentials (used for os-assisted-snapshots)
     iniset $CINDER_CONF DEFAULT os_privileged_user_name nova
     iniset $CINDER_CONF DEFAULT os_privileged_user_password "$SERVICE_PASSWORD"
-    iniset $CINDER_CONF DEFAULT os_privileged_user_tenant "$SERVICE_TENANT_NAME"
+    iniset $CINDER_CONF DEFAULT os_privileged_user_tenant "$SERVICE_PROJECT_NAME"
     iniset $CINDER_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
 }
 
diff --git a/lib/glance b/lib/glance
index c248611aef..4df231009a 100644
--- a/lib/glance
+++ b/lib/glance
@@ -143,7 +143,7 @@ function configure_glance {
         iniset $GLANCE_API_CONF glance_store stores "file, http, swift"
         iniset $GLANCE_API_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
 
-        iniset $GLANCE_SWIFT_STORE_CONF ref1 user $SERVICE_TENANT_NAME:glance-swift
+        iniset $GLANCE_SWIFT_STORE_CONF ref1 user $SERVICE_PROJECT_NAME:glance-swift
         iniset $GLANCE_SWIFT_STORE_CONF ref1 key $SERVICE_PASSWORD
         iniset $GLANCE_SWIFT_STORE_CONF ref1 auth_address $KEYSTONE_SERVICE_URI/v3
         iniset $GLANCE_SWIFT_STORE_CONF ref1 user_domain_id default
@@ -198,7 +198,7 @@ function configure_glance {
     iniuncomment $GLANCE_CACHE_CONF DEFAULT auth_url
     iniset $GLANCE_CACHE_CONF DEFAULT auth_url $KEYSTONE_AUTH_URI/v2.0
     iniuncomment $GLANCE_CACHE_CONF DEFAULT auth_tenant_name
-    iniset $GLANCE_CACHE_CONF DEFAULT admin_tenant_name $SERVICE_TENANT_NAME
+    iniset $GLANCE_CACHE_CONF DEFAULT admin_tenant_name $SERVICE_PROJECT_NAME
     iniuncomment $GLANCE_CACHE_CONF DEFAULT auth_user
     iniset $GLANCE_CACHE_CONF DEFAULT admin_user glance
     iniuncomment $GLANCE_CACHE_CONF DEFAULT auth_password
@@ -226,9 +226,9 @@ function configure_glance {
 
 # Project              User            Roles
 # ---------------------------------------------------------------------
-# SERVICE_TENANT_NAME  glance          service
-# SERVICE_TENANT_NAME  glance-swift    ResellerAdmin (if Swift is enabled)
-# SERVICE_TENANT_NAME  glance-search   search (if Search is enabled)
+# SERVICE_PROJECT_NAME  glance          service
+# SERVICE_PROJECT_NAME  glance-swift    ResellerAdmin (if Swift is enabled)
+# SERVICE_PROJECT_NAME  glance-search   search (if Search is enabled)
 
 function create_glance_accounts {
     if is_service_enabled g-api; then
@@ -241,7 +241,7 @@ function create_glance_accounts {
             local glance_swift_user
             glance_swift_user=$(get_or_create_user "glance-swift" \
                 "$SERVICE_PASSWORD" "default" "glance-swift@example.com")
-            get_or_add_user_project_role "ResellerAdmin" $glance_swift_user $SERVICE_TENANT_NAME
+            get_or_add_user_project_role "ResellerAdmin" $glance_swift_user $SERVICE_PROJECT_NAME
         fi
 
         get_or_create_service "glance" "image" "Glance Image Service"
diff --git a/lib/keystone b/lib/keystone
index 7d5fd41f89..e33081cd9f 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -108,7 +108,7 @@ KEYSTONE_SERVICE_PROTOCOL=${KEYSTONE_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 # Bind hosts
 KEYSTONE_ADMIN_BIND_HOST=${KEYSTONE_ADMIN_BIND_HOST:-$KEYSTONE_SERVICE_HOST}
 # Set the tenant for service accounts in Keystone
-SERVICE_TENANT_NAME=${SERVICE_TENANT_NAME:-service}
+SERVICE_PROJECT_NAME=${SERVICE_TENANT_NAME:-service}
 
 # if we are running with SSL use https protocols
 if is_ssl_enabled_service "key" || is_service_enabled tls-proxy; then
@@ -384,7 +384,7 @@ function create_keystone_accounts {
     get_or_add_user_domain_role $admin_role $admin_user default
 
     # Create service project/role
-    get_or_create_project "$SERVICE_TENANT_NAME" default
+    get_or_create_project "$SERVICE_PROJECT_NAME" default
 
     # Service role, so service users do not have to be admins
     get_or_create_role service
@@ -458,7 +458,7 @@ function create_service_user {
 
     local user
     user=$(get_or_create_user "$1" "$SERVICE_PASSWORD" default)
-    get_or_add_user_project_role "$role" "$user" "$SERVICE_TENANT_NAME"
+    get_or_add_user_project_role "$role" "$user" "$SERVICE_PROJECT_NAME"
 }
 
 # Configure the service to use the auth token middleware.
@@ -479,7 +479,7 @@ function configure_auth_token_middleware {
     iniset $conf_file $section username $admin_user
     iniset $conf_file $section password $SERVICE_PASSWORD
     iniset $conf_file $section user_domain_id default
-    iniset $conf_file $section project_name $SERVICE_TENANT_NAME
+    iniset $conf_file $section project_name $SERVICE_PROJECT_NAME
     iniset $conf_file $section project_domain_id default
 
     iniset $conf_file $section auth_uri $KEYSTONE_SERVICE_URI
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 539b9ff551..ebf9825a27 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -483,7 +483,7 @@ function create_nova_conf_neutron {
     iniset $NOVA_CONF neutron username "$Q_ADMIN_USERNAME"
     iniset $NOVA_CONF neutron password "$SERVICE_PASSWORD"
     iniset $NOVA_CONF neutron user_domain_name "Default"
-    iniset $NOVA_CONF neutron project_name "$SERVICE_TENANT_NAME"
+    iniset $NOVA_CONF neutron project_name "$SERVICE_PROJECT_NAME"
     iniset $NOVA_CONF neutron project_domain_name "Default"
     iniset $NOVA_CONF neutron auth_strategy "$Q_AUTH_STRATEGY"
     iniset $NOVA_CONF neutron region_name "$REGION_NAME"
@@ -1169,7 +1169,7 @@ function _configure_neutron_service {
     iniset $NEUTRON_CONF nova username nova
     iniset $NEUTRON_CONF nova password $SERVICE_PASSWORD
     iniset $NEUTRON_CONF nova user_domain_id default
-    iniset $NEUTRON_CONF nova project_name $SERVICE_TENANT_NAME
+    iniset $NEUTRON_CONF nova project_name $SERVICE_PROJECT_NAME
     iniset $NEUTRON_CONF nova project_domain_id default
     iniset $NEUTRON_CONF nova region_name $REGION_NAME
 
diff --git a/lib/nova b/lib/nova
index cce538d3d7..fd458c5701 100644
--- a/lib/nova
+++ b/lib/nova
@@ -404,8 +404,8 @@ function configure_nova {
 #
 # Project              User         Roles
 # ------------------------------------------------------------------
-# SERVICE_TENANT_NAME  nova         admin
-# SERVICE_TENANT_NAME  nova         ResellerAdmin (if Swift is enabled)
+# SERVICE_PROJECT_NAME  nova         admin
+# SERVICE_PROJECT_NAME  nova         ResellerAdmin (if Swift is enabled)
 function create_nova_accounts {
 
     # Nova
@@ -444,7 +444,7 @@ function create_nova_accounts {
         if is_service_enabled swift; then
             # Nova needs ResellerAdmin role to download images when accessing
             # swift through the s3 api.
-            get_or_add_user_project_role ResellerAdmin nova $SERVICE_TENANT_NAME
+            get_or_add_user_project_role ResellerAdmin nova $SERVICE_PROJECT_NAME
         fi
     fi
 
diff --git a/lib/swift b/lib/swift
index 947d2abdc0..b6c3ca49a3 100644
--- a/lib/swift
+++ b/lib/swift
@@ -450,7 +450,7 @@ auth_host = ${KEYSTONE_AUTH_HOST}
 auth_protocol = ${KEYSTONE_AUTH_PROTOCOL}
 cafile = ${SSL_BUNDLE_FILE}
 admin_user = swift
-admin_tenant_name = ${SERVICE_TENANT_NAME}
+admin_tenant_name = ${SERVICE_PROJECT_NAME}
 admin_password = ${SERVICE_PASSWORD}
 
 [filter:swift3]
@@ -812,7 +812,7 @@ function swift_configure_tempurls {
     # note we are using swift credentials!
     OS_USERNAME=swift \
     OS_PASSWORD=$SERVICE_PASSWORD \
-    OS_PROJECT_NAME=$SERVICE_TENANT_NAME \
+    OS_PROJECT_NAME=$SERVICE_PROJECT_NAME \
     openstack object store account \
         set --property "Temp-URL-Key=$SWIFT_TEMPURL_KEY"
 }
diff --git a/openrc b/openrc
index 9bc0fd77f4..460cf14756 100644
--- a/openrc
+++ b/openrc
@@ -1,9 +1,9 @@
 #!/usr/bin/env bash
 #
-# source openrc [username] [tenantname]
+# source openrc [username] [projectname]
 #
-# Configure a set of credentials for $TENANT/$USERNAME:
-#   Set OS_TENANT_NAME to override the default tenant 'demo'
+# Configure a set of credentials for $PROJECT/$USERNAME:
+#   Set OS_PROJECT_NAME to override the default project 'demo'
 #   Set OS_USERNAME to override the default user name 'demo'
 #   Set ADMIN_PASSWORD to set the password for 'admin' and 'demo'
 
@@ -14,7 +14,7 @@ if [[ -n "$1" ]]; then
     OS_USERNAME=$1
 fi
 if [[ -n "$2" ]]; then
-    OS_TENANT_NAME=$2
+    OS_PROJECT_NAME=$2
 fi
 
 # Find the other rc files
@@ -34,13 +34,17 @@ fi
 # Get some necessary configuration
 source $RC_DIR/lib/tls
 
-# The introduction of Keystone to the OpenStack ecosystem has standardized the
-# term **tenant** as the entity that owns resources.  In some places references
-# still exist to the original Nova term **project** for this use.  Also,
-# **tenant_name** is preferred to **tenant_id**.
-export OS_TENANT_NAME=${OS_TENANT_NAME:-demo}
+# The OpenStack ecosystem has standardized the term **project** as the
+# entity that owns resources.  In some places **tenant** remains
+# referenced, but in all cases this just means **project**.  We will
+# warn if we need to turn on legacy **tenant** support to have a
+# working environment.
+export OS_PROJECT_NAME=${OS_PROJECT_NAME:-demo}
 
-# In addition to the owning entity (tenant), nova stores the entity performing
+echo "WARNING: setting legacy OS_TENANT_NAME to support cli tools."
+export OS_TENANT_NAME=$OS_PROJECT_NAME
+
+# In addition to the owning entity (project), nova stores the entity performing
 # the action as the **user**.
 export OS_USERNAME=${OS_USERNAME:-demo}
 
@@ -81,7 +85,7 @@ export OS_IDENTITY_API_VERSION=${IDENTITY_API_VERSION:-2.0}
 
 # Authenticating against an OpenStack cloud using Keystone returns a **Token**
 # and **Service Catalog**.  The catalog contains the endpoints for all services
-# the user/tenant has access to - including nova, glance, keystone, swift, ...
+# the user/project has access to - including nova, glance, keystone, swift, ...
 # We currently recommend using the 2.0 *identity api*.
 #
 export OS_AUTH_URL=$KEYSTONE_AUTH_PROTOCOL://$KEYSTONE_AUTH_HOST:5000/v${OS_IDENTITY_API_VERSION}
diff --git a/stack.sh b/stack.sh
index 6dddea4e67..0be3585020 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1210,7 +1210,7 @@ fi
 
 # Create an access key and secret key for Nova EC2 register image
 if is_service_enabled keystone && is_service_enabled swift3 && is_service_enabled nova; then
-    eval $(openstack ec2 credentials create --user nova --project $SERVICE_TENANT_NAME -f shell -c access -c secret)
+    eval $(openstack ec2 credentials create --user nova --project $SERVICE_PROJECT_NAME -f shell -c access -c secret)
     iniset $NOVA_CONF DEFAULT s3_access_key "$access"
     iniset $NOVA_CONF DEFAULT s3_secret_key "$secret"
     iniset $NOVA_CONF DEFAULT s3_affix_tenant "True"

From 0f7653587ecf22d3461775ad9da77a7090334b74 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 18 Feb 2016 06:53:08 -0500
Subject: [PATCH 0260/2409] localize user/project variables in tempest

lib/tempest is using / setting a ton of globals, a lot which don't
look used. As a first step to converting over to s/tenant/project/
make all of these local which means they can not be impacting anything
outside of this function. That will make them safe to change names
later.

Change-Id: I380dd20e5ed716a0bdf92aa02c3730359b8136e4
---
 lib/tempest | 36 +++++++++++++++++++-----------------
 1 file changed, 19 insertions(+), 17 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index f75d755066..caf8f117d1 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -176,17 +176,18 @@ function configure_tempest {
     sudo install -d -o $STACK_USER $TEMPEST_CONFIG_DIR
     rm -f $TEMPEST_CONFIG
 
-    password=${ADMIN_PASSWORD:-secrete}
+    local password=${ADMIN_PASSWORD:-secrete}
 
     # See ``lib/keystone`` where these users and tenants are set up
-    ADMIN_USERNAME=${ADMIN_USERNAME:-admin}
-    ADMIN_TENANT_NAME=${ADMIN_TENANT_NAME:-admin}
-    ADMIN_DOMAIN_NAME=${ADMIN_DOMAIN_NAME:-Default}
-    TEMPEST_USERNAME=${TEMPEST_USERNAME:-demo}
-    TEMPEST_TENANT_NAME=${TEMPEST_TENANT_NAME:-demo}
-    ALT_USERNAME=${ALT_USERNAME:-alt_demo}
-    ALT_TENANT_NAME=${ALT_TENANT_NAME:-alt_demo}
-    ADMIN_TENANT_ID=$(openstack project list | awk "/ admin / { print \$2 }")
+    local admin_username=${ADMIN_USERNAME:-admin}
+    local admin_tenant_name=${ADMIN_TENANT_NAME:-admin}
+    local admin_domain_name=${ADMIN_DOMAIN_NAME:-Default}
+    local tempest_username=${TEMPEST_USERNAME:-demo}
+    local tempest_tenant_name=${TEMPEST_TENANT_NAME:-demo}
+    local alt_username=${ALT_USERNAME:-alt_demo}
+    local alt_tenant_name=${ALT_TENANT_NAME:-alt_demo}
+    local admin_tenant_id
+    admin_tenant_id=$(openstack project list | awk "/ admin / { print \$2 }")
 
     if is_service_enabled nova; then
         # If ``DEFAULT_INSTANCE_TYPE`` is not declared, use the new behavior
@@ -260,11 +261,11 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG identity uri "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:5000/v2.0/"
     iniset $TEMPEST_CONFIG identity uri_v3 "$KEYSTONE_SERVICE_URI_V3"
     if [[ "$TEMPEST_HAS_ADMIN" == "True" ]]; then
-        iniset $TEMPEST_CONFIG auth admin_username $ADMIN_USERNAME
+        iniset $TEMPEST_CONFIG auth admin_username $admin_username
         iniset $TEMPEST_CONFIG auth admin_password "$password"
-        iniset $TEMPEST_CONFIG auth admin_tenant_name $ADMIN_TENANT_NAME
-        iniset $TEMPEST_CONFIG auth admin_tenant_id $ADMIN_TENANT_ID
-        iniset $TEMPEST_CONFIG auth admin_domain_name $ADMIN_DOMAIN_NAME
+        iniset $TEMPEST_CONFIG auth admin_tenant_name $admin_tenant_name
+        iniset $TEMPEST_CONFIG auth admin_tenant_id $admin_tenant_id
+        iniset $TEMPEST_CONFIG auth admin_domain_name $admin_domain_name
     fi
     if [ "$ENABLE_IDENTITY_V2" == "False" ]; then
         # Only Identity v3 is available; then skip Identity API v2 tests
@@ -531,8 +532,9 @@ function configure_tempest {
     # this tempest service list needs to be all the services that
     # tempest supports, otherwise we can have an erroneous set of
     # defaults (something defaulting true in Tempest, but not listed here).
-    TEMPEST_SERVICES="key,glance,nova,neutron,cinder,swift,heat,ceilometer,horizon,sahara,ironic,trove"
-    for service in ${TEMPEST_SERVICES//,/ }; do
+    local service
+    local tempest_services="key,glance,nova,neutron,cinder,swift,heat,ceilometer,horizon,sahara,ironic,trove"
+    for service in ${tempest_services//,/ }; do
         if is_service_enabled $service ; then
             iniset $TEMPEST_CONFIG service_available $service "True"
         else
@@ -550,9 +552,9 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG auth tempest_roles "Member"
     if [[ $TEMPEST_USE_TEST_ACCOUNTS == "True" ]]; then
         if [[ $TEMPEST_HAS_ADMIN == "True" ]]; then
-            tempest-account-generator -c $TEMPEST_CONFIG --os-username $ADMIN_USERNAME --os-password $ADMIN_PASSWORD --os-tenant-name $ADMIN_TENANT_NAME -r $TEMPEST_CONCURRENCY --with-admin etc/accounts.yaml
+            tempest-account-generator -c $TEMPEST_CONFIG --os-username $admin_username --os-password $admin_password --os-tenant-name $admin_tenant_name -r $TEMPEST_CONCURRENCY --with-admin etc/accounts.yaml
         else
-            tempest-account-generator -c $TEMPEST_CONFIG --os-username $ADMIN_USERNAME --os-password $ADMIN_PASSWORD --os-tenant-name $ADMIN_TENANT_NAME -r $TEMPEST_CONCURRENCY etc/accounts.yaml
+            tempest-account-generator -c $TEMPEST_CONFIG --os-username $admin_username --os-password $admin_password --os-tenant-name $admin_tenant_name -r $TEMPEST_CONCURRENCY etc/accounts.yaml
         fi
         iniset $TEMPEST_CONFIG auth use_dynamic_credentials False
         iniset $TEMPEST_CONFIG auth test_accounts_file "etc/accounts.yaml"

From d8589fa01a57feccc2d20a72307098b7e3eeb1d3 Mon Sep 17 00:00:00 2001
From: Brant Knudson <bknudson@us.ibm.com>
Date: Mon, 22 Feb 2016 13:49:52 -0600
Subject: [PATCH 0261/2409] Fix uwsgi keystone

The uwsgi keystone jobs are failing with an error like

 + devstack/functions-common:_run_process:L1391:   setsid uwsgi /etc/keystone/keystone-uwsgi-admin.ini
 + devstack/functions-common:_run_process:L1395:   exit 0
 execvp: No such file or directory

I think this is because uwsgi isn't installed on the images. The fix
is to pip install it.

Also, use the full path to the uwsgi executable (even though execvp
is used) because eventlet (calling keystone-all) does.

Also, the uwsgi process wasn't shutting down on ./unstack.sh. This
is worked around by not running master process.

Change-Id: Id02e16c5149ba3dfa13051e87cfccd8e505b7362
---
 lib/keystone | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 7d5fd41f89..1cb3737037 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -303,7 +303,6 @@ function configure_keystone {
 
         iniset "$KEYSTONE_PUBLIC_UWSGI_FILE" uwsgi wsgi-file "$KEYSTONE_BIN_DIR/keystone-wsgi-public"
         # This is running standalone
-        iniset "$KEYSTONE_PUBLIC_UWSGI_FILE" uwsgi master true
         iniset "$KEYSTONE_PUBLIC_UWSGI_FILE" uwsgi threads $(nproc)
         iniset "$KEYSTONE_PUBLIC_UWSGI_FILE" uwsgi enable-threads true
         iniset "$KEYSTONE_PUBLIC_UWSGI_FILE" uwsgi plugins python
@@ -316,7 +315,6 @@ function configure_keystone {
 
         iniset "$KEYSTONE_ADMIN_UWSGI_FILE" uwsgi wsgi-file "$KEYSTONE_BIN_DIR/keystone-wsgi-admin"
         # This is running standalone
-        iniset "$KEYSTONE_ADMIN_UWSGI_FILE" uwsgi master true
         iniset "$KEYSTONE_ADMIN_UWSGI_FILE" uwsgi threads $API_WORKERS
         iniset "$KEYSTONE_ADMIN_UWSGI_FILE" uwsgi enable-threads true
         iniset "$KEYSTONE_ADMIN_UWSGI_FILE" uwsgi plugins python
@@ -563,6 +561,8 @@ function install_keystone {
         if is_ssl_enabled_service "key"; then
             enable_mod_ssl
         fi
+    elif [ "$KEYSTONE_DEPLOY" == "uwsgi" ]; then
+        pip_install uwsgi
     fi
 }
 
@@ -582,8 +582,8 @@ function start_keystone {
         tail_log key /var/log/$APACHE_NAME/keystone.log
         tail_log key-access /var/log/$APACHE_NAME/keystone_access.log
     elif [ "$KEYSTONE_DEPLOY" == "uwsgi" ]; then
-        run_process key "uwsgi $KEYSTONE_PUBLIC_UWSGI_FILE" "" "key-p"
-        run_process key "uwsgi $KEYSTONE_ADMIN_UWSGI_FILE" "" "key-a"
+        run_process key "$KEYSTONE_BIN_DIR/uwsgi $KEYSTONE_PUBLIC_UWSGI_FILE" "" "key-p"
+        run_process key "$KEYSTONE_BIN_DIR/uwsgi $KEYSTONE_ADMIN_UWSGI_FILE" "" "key-a"
     else # eventlet
         # Start Keystone in a screen window
         run_process key "$KEYSTONE_BIN_DIR/keystone-all --config-file $KEYSTONE_CONF"

From f5515409d5253b9063f421cf37f45ddfc062aa90 Mon Sep 17 00:00:00 2001
From: Assaf Muller <amuller@redhat.com>
Date: Mon, 22 Feb 2016 17:38:17 -0500
Subject: [PATCH 0262/2409] Change default subnetpool size

Commit 7dbcfae introduced a subnetpool needed for the
auto-configured-topology Neutron extension. However, it allows
only up to 4 tenants, then you'd hit an error about no more
available IPs. This patch changes the size of the subnetpool
and the subnets it creates.

Change-Id: I4f43bebc52fb20e39853a1632fe31506958f5071
---
 lib/neutron-legacy | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 56a9bdf229..61328bf11f 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -76,10 +76,10 @@ PUBLIC_SUBNET_NAME=${PUBLIC_SUBNET_NAME:-"public-subnet"}
 # Subnetpool defaults
 SUBNETPOOL_NAME=${SUBNETPOOL_NAME:-"shared-default-subnetpool"}
 
-SUBNETPOOL_PREFIX_V4=${SUBNETPOOL_PREFIX_V4:-10.0.0.0/24}
+SUBNETPOOL_PREFIX_V4=${SUBNETPOOL_PREFIX_V4:-10.0.0.0/8}
 SUBNETPOOL_PREFIX_V6=${SUBNETPOOL_PREFIX_V6:-2001:db8:8000::/48}
 
-SUBNETPOOL_SIZE_V4=${SUBNETPOOL_SIZE_V4:-26}
+SUBNETPOOL_SIZE_V4=${SUBNETPOOL_SIZE_V4:-24}
 SUBNETPOOL_SIZE_V6=${SUBNETPOOL_SIZE_V6:-64}
 
 

From 13fe6f59d1b6d209bf770b0959d408ee1a8fb659 Mon Sep 17 00:00:00 2001
From: Mehdi Abaakouk <sileht@redhat.com>
Date: Tue, 23 Feb 2016 12:57:02 +0100
Subject: [PATCH 0263/2409] Fix telemetry integration gate jobs

Since https://review.openstack.org/#/c/281779/2 have been
merged the telemetry integration job is broken.

Unfortunatly, it can't be fixed on our side, because we have to
rename SERVICE_TENANT_NAME in many devstack plugin, we can't merge thing
until all plugins have been fixed.

So this change restores SERVICE_TENANT_NAME, to be able to switch to SERVICE_PROJECT_NAME.

Related-bug: #1548634
Change-Id: I14ebf23aa63f0f153b934ad213a6209d22e73e9d
---
 lib/keystone | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/keystone b/lib/keystone
index e33081cd9f..ff9714fe4d 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -108,6 +108,7 @@ KEYSTONE_SERVICE_PROTOCOL=${KEYSTONE_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 # Bind hosts
 KEYSTONE_ADMIN_BIND_HOST=${KEYSTONE_ADMIN_BIND_HOST:-$KEYSTONE_SERVICE_HOST}
 # Set the tenant for service accounts in Keystone
+SERVICE_TENANT_NAME=${SERVICE_TENANT_NAME:-service}
 SERVICE_PROJECT_NAME=${SERVICE_TENANT_NAME:-service}
 
 # if we are running with SSL use https protocols

From bb16c87a2164dcea36bcb3836793d99265dca01e Mon Sep 17 00:00:00 2001
From: Jin Nan Zhang <zhang.jinnan@99cloud.net>
Date: Mon, 22 Feb 2016 10:01:47 -0500
Subject: [PATCH 0264/2409] Ignore files created by pkg/elasticsearch.sh

When running pkg/elasticsearch.sh the following files are created:

.localrc.password
files/elasticsearch-1.4.2.noarch.rpm
files/elasticsearch-1.4.2.noarch.rpm.sha1.gen
files/elasticsearch-1.4.2.noarch.rpm.sha1.txt


Change-Id: Ie2ab8b7fe72f51cb350e1f46ca97570b84047ac4
Closes-Bug: #1548201
---
 .gitignore | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.gitignore b/.gitignore
index 8870bb362c..a5a17c2b75 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,6 +4,7 @@
 *.log.[1-9]
 *.pem
 .localrc.auto
+.localrc.password
 .prereqs
 .tox
 .stackenv
@@ -11,6 +12,8 @@ accrc
 doc/files
 doc/build
 files/*.gz
+files/*.rpm
+files/*.rpm.*
 files/*.qcow2
 files/*.img
 files/images

From 57d79673d9f80b96e4bddc99bd8cfe95abea0103 Mon Sep 17 00:00:00 2001
From: Chris Dent <cdent@anticdent.org>
Date: Tue, 23 Feb 2016 15:38:43 +0000
Subject: [PATCH 0265/2409] Skip ovs_ and ebtables_dump if needed commands not
 present

Skip with a notification that a command was not found when trying
to run a dump that relies on optional external command.

Otherwise we produce noise in the error output that is misleading.

Change-Id: I0e3d99da8c54d2912463ecba7c1783864a7c7fc7
Closes-Bug: #1548833
Closes-Bug: #1506873
---
 tools/worlddump.py | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/tools/worlddump.py b/tools/worlddump.py
index d129374253..01f601cea8 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -18,6 +18,7 @@
 
 import argparse
 import datetime
+from distutils import spawn
 import fnmatch
 import os
 import os.path
@@ -61,6 +62,13 @@ def _dump_cmd(cmd):
         print "*** Failed to run: %s" % cmd
 
 
+def _find_cmd(cmd):
+    if not spawn.find_executable(cmd):
+        print "*** %s not found: skipping" % cmd
+        return False
+    return True
+
+
 def _header(name):
     print
     print name
@@ -89,6 +97,8 @@ def disk_space():
 def ebtables_dump():
     tables = ['filter', 'nat', 'broute']
     _header("EB Tables Dump")
+    if not _find_cmd('ebtables'):
+        return
     for table in tables:
         _dump_cmd("sudo ebtables -t %s -L" % table)
 
@@ -124,6 +134,11 @@ def network_dump():
 def ovs_dump():
     _header("Open vSwitch Dump")
 
+    # NOTE(cdent): If we're not using neutron + ovs these commands
+    # will not be present so
+    if not _find_cmd('ovs-vsctl'):
+        return
+
     # NOTE(ihrachys): worlddump is used outside of devstack context (f.e. in
     # grenade), so there is no single place to determine the bridge names from.
     # Hardcode for now.

From 8a6d7678b58c3dc834fec343332020d624e4006a Mon Sep 17 00:00:00 2001
From: Angus Lees <gus@inodes.org>
Date: Mon, 15 Feb 2016 10:53:20 +1100
Subject: [PATCH 0266/2409] cinder.conf: Set privsep_osbrick.helper_command

When os-brick starts using privsep, it will need to know how to invoke
its privileged half.  Amazingly the name of the rootwrap executable
isn't anywhere else in the config, so the privsep default uses just
"sudo" (no rootwrap).

We need to either:

1. set the privsep command line to use cinder-rootwrap in
   cinder.conf (and similar in other configs), or

2. add the privsep-helper line to sudoers and bypass rootwrap entirely.

This change implements (1) for devstack/cinder and is similar to the
corresponding nova change in I90dc41bc77993bd83b80c92286e015e14f290b45

Change-Id: I8a0b1728cc66c4861f69623b1b16b1f759b57b25
---
 lib/cinder | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/cinder b/lib/cinder
index 3aea05023f..081e2f7860 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -272,6 +272,8 @@ function configure_cinder {
 
     iniset $CINDER_CONF DEFAULT os_region_name "$REGION_NAME"
 
+    iniset $CINDER_CONF privsep_osbrick helper_command "sudo cinder-rootwrap \$rootwrap_config privsep-helper --config-file $CINDER_CONF"
+
     if is_service_enabled c-vol && [[ -n "$CINDER_ENABLED_BACKENDS" ]]; then
         local enabled_backends=""
         local default_name=""

From 58467e2102824e92655f448fd6cb55f8820a4cf7 Mon Sep 17 00:00:00 2001
From: Angus Lees <gus@inodes.org>
Date: Tue, 9 Feb 2016 16:56:55 +1100
Subject: [PATCH 0267/2409] nova.conf: Set privsep_osbrick.helper_command

When os-brick starts using privsep, it will need to know how to invoke
its privileged half.  Amazingly the name of the rootwrap executable
isn't anywhere else in the config, so the privsep default uses just
"sudo" (no rootwrap).

We need to either:

1. set the privsep command line to use nova-rootwrap in nova.conf (and
   similar in other configs), or

2. add the privsep-helper line to sudoers and bypass rootwrap entirely.

This change implements (1) for devstack (nova only for now, cinder to
follow shortly).

Change-Id: I90dc41bc77993bd83b80c92286e015e14f290b45
---
 lib/nova | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/nova b/lib/nova
index dc425a19bd..e0bccc570b 100644
--- a/lib/nova
+++ b/lib/nova
@@ -501,6 +501,8 @@ function create_nova_conf {
         iniset $NOVA_CONF DEFAULT bindir "/usr/bin"
     fi
 
+    iniset $NOVA_CONF privsep_osbrick helper_command "sudo nova-rootwrap \$rootwrap_config privsep-helper --config-file $NOVA_CONF"
+
     if is_service_enabled n-api; then
         if is_service_enabled n-api-meta; then
             # If running n-api-meta as a separate service

From 7f66503de0dcfce6884f2dbe08fa5fd4ee9b05e3 Mon Sep 17 00:00:00 2001
From: Nikolay Fedotov <nfedotov@cisco.com>
Date: Wed, 24 Feb 2016 16:07:18 +0000
Subject: [PATCH 0268/2409] Use SCREEN_NAME variable instead of hardcode in
 unstack and rejoin scripts

Change-Id: I7382eccf96d14df223777cd43344d554b8452a77
---
 rejoin-stack.sh | 11 ++++++-----
 unstack.sh      |  2 +-
 2 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/rejoin-stack.sh b/rejoin-stack.sh
index 30b7bab1cc..7048865fc9 100755
--- a/rejoin-stack.sh
+++ b/rejoin-stack.sh
@@ -11,14 +11,15 @@ source $TOP_DIR/functions
 
 source $TOP_DIR/stackrc
 
+SCREENRC=$TOP_DIR/$SCREEN_NAME-screenrc
 # if screenrc exists, run screen
-if [[ -e $TOP_DIR/stack-screenrc ]]; then
-    if screen -ls | egrep -q "[0-9].stack"; then
+if [[ -e $SCREENRC ]]; then
+    if screen -ls | egrep -q "[0-9]+.${SCREEN_NAME}"; then
         echo "Attaching to already started screen session.."
-        exec screen -r stack
+        exec screen -r $SCREEN_NAME
     fi
-    exec screen -c $TOP_DIR/stack-screenrc
+    exec screen -c $SCREENRC
 fi
 
-echo "Couldn't find $TOP_DIR/stack-screenrc file; have you run stack.sh yet?"
+echo "Couldn't find $SCREENRC file; have you run stack.sh yet?"
 exit 1
diff --git a/unstack.sh b/unstack.sh
index d7670e38a5..7a7c945c8a 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -182,7 +182,7 @@ fi
 # Clean up the remainder of the screen processes
 SCREEN=$(which screen)
 if [[ -n "$SCREEN" ]]; then
-    SESSION=$(screen -ls | awk '/[0-9].stack/ { print $1 }')
+    SESSION=$(screen -ls | awk "/[0-9]+.${SCREEN_NAME}/"'{ print $1 }')
     if [[ -n "$SESSION" ]]; then
         screen -X -S $SESSION quit
     fi

From 8ce3faf4e73297397cc84e9b64c38eb876d6c7d1 Mon Sep 17 00:00:00 2001
From: Clint Adams <clint@gcfm.net>
Date: Fri, 26 Feb 2016 08:18:13 -0700
Subject: [PATCH 0269/2409] Remove filesystem-based code path

This removes the fs-based git code path for detecting devstack plugins
as requested in I2c5c9282a8ad80014cad171a4dfbdc8f26044cd1

Change-Id: I6d1567c2545b866c433381d19587beb08c281c53
---
 tools/generate-devstack-plugins-list.sh | 40 +++++--------------------
 1 file changed, 8 insertions(+), 32 deletions(-)

diff --git a/tools/generate-devstack-plugins-list.sh b/tools/generate-devstack-plugins-list.sh
index 01767854d7..37105224dc 100644
--- a/tools/generate-devstack-plugins-list.sh
+++ b/tools/generate-devstack-plugins-list.sh
@@ -43,38 +43,14 @@ declare -A plugins
 
 test -r data/devstack-plugins-registry.header && cat data/devstack-plugins-registry.header
 
-if test -n "$git_dir"; then
-    pushd ${git_dir} >/dev/null
-    for i in *; do
-        pushd ${i} >/dev/null
-        if output="$(git log --diff-filter=A --format='%cd' --date=short -1 -- devstack/plugin.sh)"; then
-            test -n "$output" && plugins[$i]=${output}
-        fi
-        popd >/dev/null
-    done
-    popd >/dev/null
-
-    sorted_plugins=( $(for k in "${!plugins[@]}"; do echo "$k"; done | sort))
-
-    for k in "${sorted_plugins[@]}"; do
-        project=${k:0:18}
-        giturl="git://git.openstack.org/openstack/${k:0:26}"
-        pdate="${plugins[$k]}"
-        printf "|%-18s|%-60s (%-10s)|\n" "${project}" "${giturl}" "${pdate}"
-        printf "+------------------+-------------------------------------------------------------------------+\n"
-    done
-
-else
-    sorted_plugins=$(python tools/generate-devstack-plugins-list.py)
-
-    for k in ${sorted_plugins}; do
-        project=${k:0:18}
-        giturl="git://git.openstack.org/openstack/${k:0:26}"
-        printf "|%-18s|%-73s|\n" "${project}" "${giturl}"
-        printf "+------------------+-------------------------------------------------------------------------+\n"
-    done
-
-fi
+sorted_plugins=$(python tools/generate-devstack-plugins-list.py)
+
+for k in ${sorted_plugins}; do
+    project=${k:0:18}
+    giturl="git://git.openstack.org/openstack/${k:0:26}"
+    printf "|%-18s|%-73s|\n" "${project}" "${giturl}"
+    printf "+------------------+-------------------------------------------------------------------------+\n"
+done
 
 test -r data/devstack-plugins-registry.footer && cat data/devstack-plugins-registry.footer
 ) > doc/source/plugin-registry.rst

From e6f0d8cb40f65b7969eef8434898bf7c1d4b05d8 Mon Sep 17 00:00:00 2001
From: Clint Adams <clint@gcfm.net>
Date: Fri, 26 Feb 2016 08:25:32 -0700
Subject: [PATCH 0270/2409] Place the generated list in the correct location
 for the proposal job

If tools/generate-devstack-plugins-list.sh is invoked with a parameter,
as is the case with the proposal job, copy the generated list thither
so that git will actually generate a diff.

Change-Id: I874a521bba7f402f5c07e28d6ebb086e77873795
---
 tools/generate-devstack-plugins-list.sh | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/tools/generate-devstack-plugins-list.sh b/tools/generate-devstack-plugins-list.sh
index 37105224dc..b7817a0096 100644
--- a/tools/generate-devstack-plugins-list.sh
+++ b/tools/generate-devstack-plugins-list.sh
@@ -54,3 +54,7 @@ done
 
 test -r data/devstack-plugins-registry.footer && cat data/devstack-plugins-registry.footer
 ) > doc/source/plugin-registry.rst
+
+if [[ -n ${1} ]]; then
+    cp doc/source/plugin-registry.rst ${1}/doc/source/plugin-registry.rst
+fi

From 3c60168532b9202baa6d163d3501d8323239eb5b Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 29 Feb 2016 15:15:39 +1100
Subject: [PATCH 0271/2409] Also detected failed packages in dnf/yum wrapper

As seen in [1]; dnf can output a "Failed:" section when installation
issues with a package are detected.  This does not, however, trigger
an exit failure code when running with "-y".  So add this to our
checking wrapper.

[1] http://logs.openstack.org/49/280449/1/check/gate-tempest-dsvm-platform-fedora23-nv/dc70ca8/logs/devstacklog.txt.gz#_2016-02-28_22_42_45_145

Change-Id: I12f7b3bc9e9cf5a97114082d3a634a42742843d5
---
 functions-common | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/functions-common b/functions-common
index ed444bbd41..2b23402b54 100644
--- a/functions-common
+++ b/functions-common
@@ -1304,15 +1304,16 @@ function yum_install {
 
     # Warning: this would not work if yum output message
     # have been translated to another language
-    parse_yum_result='\
-        BEGIN { result=0 }\
-        /^YUM_FAILED/ { exit $2 }\
-        /^No package/ { result=1 }\
-        //{ print }\
+    parse_yum_result='             \
+        BEGIN { result=0 }         \
+        /^YUM_FAILED/ { exit $2 }  \
+        /^No package/ { result=1 } \
+        /^Failed:/    { result=1 } \
+        //{ print }                \
         END { exit result }'
 
     # The manual check for missing packages is because yum -y assumes
-    # missing packages are OK.
+    # missing or failed packages are OK.
     # See https://bugzilla.redhat.com/show_bug.cgi?id=965567
     (sudo_with_proxies "${YUM:-yum}" install -y "$@" 2>&1 || echo YUM_FAILED $?) \
         | awk "$parse_yum_result"

From b65cf0aae40a69d5935a248b690187770ad366e3 Mon Sep 17 00:00:00 2001
From: Alexey Galkin <agalkin@mirantis.com>
Date: Tue, 15 Dec 2015 16:14:26 +0300
Subject: [PATCH 0272/2409] Add Glance Artifact API in devstack installation

Since EXPERIMENTAL Glance v3 API has been removed in favor of
standalone API implementation was added we need to add some
changes in devstack to support it.

Implements blueprint: move-v3-to-glare
Depends-On: I5b7bd4cdcc5f2a40fc4a5f74bcc422fd700c4fb0

Change-Id: Iced3c68010eb6bcd2a6a1ec8f1c6883f84cbe77f
---
 lib/glance | 80 ++++++++++++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 78 insertions(+), 2 deletions(-)

diff --git a/lib/glance b/lib/glance
index 4df231009a..3743e161c4 100644
--- a/lib/glance
+++ b/lib/glance
@@ -55,6 +55,8 @@ GLANCE_CACHE_CONF=$GLANCE_CONF_DIR/glance-cache.conf
 GLANCE_POLICY_JSON=$GLANCE_CONF_DIR/policy.json
 GLANCE_SCHEMA_JSON=$GLANCE_CONF_DIR/schema-image.json
 GLANCE_SWIFT_STORE_CONF=$GLANCE_CONF_DIR/glance-swift-store.conf
+GLANCE_GLARE_CONF=$GLANCE_CONF_DIR/glance-glare.conf
+GLANCE_GLARE_PASTE_INI=$GLANCE_CONF_DIR/glance-glare-paste.ini
 
 if is_ssl_enabled_service "glance" || is_service_enabled tls-proxy; then
     GLANCE_SERVICE_PROTOCOL="https"
@@ -69,6 +71,8 @@ GLANCE_HOSTPORT=${GLANCE_HOSTPORT:-$GLANCE_SERVICE_HOST:$GLANCE_SERVICE_PORT}
 GLANCE_SERVICE_PROTOCOL=${GLANCE_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 GLANCE_REGISTRY_PORT=${GLANCE_REGISTRY_PORT:-9191}
 GLANCE_REGISTRY_PORT_INT=${GLANCE_REGISTRY_PORT_INT:-19191}
+GLANCE_GLARE_PORT=${GLANCE_GLARE_PORT:-9494}
+GLANCE_GLARE_HOSTPORT=${GLANCE_GLARE_HOSTPORT:-$GLANCE_SERVICE_HOST:$GLANCE_GLARE_PORT}
 
 # Functions
 # ---------
@@ -93,6 +97,9 @@ function configure_glance {
     sudo install -d -o $STACK_USER $GLANCE_CONF_DIR $GLANCE_METADEF_DIR
 
     # Copy over our glance configurations and update them
+    if is_service_enabled g-glare; then
+        cp $GLANCE_DIR/etc/glance-glare.conf $GLANCE_GLARE_CONF
+    fi
     cp $GLANCE_DIR/etc/glance-registry.conf $GLANCE_REGISTRY_CONF
     iniset $GLANCE_REGISTRY_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
     iniset $GLANCE_REGISTRY_CONF DEFAULT bind_host $GLANCE_SERVICE_LISTEN_ADDRESS
@@ -129,6 +136,9 @@ function configure_glance {
 
     # Store specific configs
     iniset $GLANCE_API_CONF glance_store filesystem_store_datadir $GLANCE_IMAGE_DIR/
+    if is_service_enabled g-glare; then
+        iniset $GLANCE_GLARE_CONF glance_store filesystem_store_datadir $GLANCE_IMAGE_DIR/
+    fi
     iniset $GLANCE_API_CONF DEFAULT registry_host $GLANCE_SERVICE_HOST
 
     iniset $GLANCE_API_CONF DEFAULT workers "$API_WORKERS"
@@ -144,6 +154,23 @@ function configure_glance {
         iniset $GLANCE_API_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
 
         iniset $GLANCE_SWIFT_STORE_CONF ref1 user $SERVICE_PROJECT_NAME:glance-swift
+
+        # Store the glare in swift if enabled.
+        if is_service_enabled g-glare; then
+            iniset $GLANCE_GLARE_CONF glance_store default_store swift
+            iniset $GLANCE_GLARE_CONF glance_store swift_store_create_container_on_put True
+
+            iniset $GLANCE_GLARE_CONF glance_store swift_store_config_file $GLANCE_SWIFT_STORE_CONF
+            iniset $GLANCE_GLARE_CONF glance_store default_swift_reference ref1
+            iniset $GLANCE_GLARE_CONF glance_store stores "file, http, swift"
+            iniset $GLANCE_GLARE_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
+
+            # commenting is not strictly necessary but it's confusing to have bad values in conf
+            inicomment $GLANCE_GLARE_CONF glance_store swift_store_user
+            inicomment $GLANCE_GLARE_CONF glance_store swift_store_key
+            inicomment $GLANCE_GLARE_CONF glance_store swift_store_auth_address
+        fi
+
         iniset $GLANCE_SWIFT_STORE_CONF ref1 key $SERVICE_PASSWORD
         iniset $GLANCE_SWIFT_STORE_CONF ref1 auth_address $KEYSTONE_SERVICE_URI/v3
         iniset $GLANCE_SWIFT_STORE_CONF ref1 user_domain_id default
@@ -220,6 +247,29 @@ function configure_glance {
         iniset $GLANCE_API_CONF DEFAULT cinder_endpoint_template "https://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/%(project_id)s"
         iniset $GLANCE_CACHE_CONF DEFAULT cinder_endpoint_template "https://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/%(project_id)s"
     fi
+
+    # Configure GLANCE_GLARE (Glance Glare)
+    if is_service_enabled g-glare; then
+        local dburl
+        dburl=`database_connection_url glance`
+        setup_colorized_logging $GLANCE_GLARE_CONF DEFAULT tenant user
+        iniset $GLANCE_GLARE_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
+        iniset $GLANCE_GLARE_CONF DEFAULT bind_host $GLANCE_SERVICE_LISTEN_ADDRESS
+        iniset $GLANCE_GLARE_CONF DEFAULT bind_port $GLANCE_GLARE_PORT
+        inicomment $GLANCE_GLARE_CONF DEFAULT log_file
+        iniset $GLANCE_GLARE_CONF DEFAULT workers "$API_WORKERS"
+
+        iniset $GLANCE_GLARE_CONF database connection $dburl
+        iniset $GLANCE_GLARE_CONF paste_deploy flavor keystone
+        configure_auth_token_middleware $GLANCE_GLARE_CONF glare $GLANCE_AUTH_CACHE_DIR/artifact
+        # Register SSL certificates if provided
+        if is_ssl_enabled_service glance; then
+            ensure_certificates GLANCE
+            iniset $GLANCE_GLARE_CONF DEFAULT cert_file "$GLANCE_SSL_CERT"
+            iniset $GLANCE_GLARE_CONF DEFAULT key_file "$GLANCE_SSL_KEY"
+        fi
+        cp $GLANCE_DIR/etc/glance-glare-paste.ini $GLANCE_GLARE_PASTE_INI
+    fi
 }
 
 # create_glance_accounts() - Set up common required glance accounts
@@ -229,6 +279,7 @@ function configure_glance {
 # SERVICE_PROJECT_NAME  glance          service
 # SERVICE_PROJECT_NAME  glance-swift    ResellerAdmin (if Swift is enabled)
 # SERVICE_PROJECT_NAME  glance-search   search (if Search is enabled)
+# SERVICE_PROJECT_NAME  glare           service (if enabled)
 
 function create_glance_accounts {
     if is_service_enabled g-api; then
@@ -252,13 +303,25 @@ function create_glance_accounts {
             "$GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT" \
             "$GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT"
     fi
+
+    # Add glance-glare service and endpoints
+    if is_service_enabled g-glare; then
+        create_service_user "glare"
+        get_or_create_service "glare" "artifact" "Glance Artifact Service"
+
+        get_or_create_endpoint "artifact" \
+            "$REGION_NAME" \
+            "$GLANCE_SERVICE_PROTOCOL://$GLANCE_GLARE_HOSTPORT" \
+            "$GLANCE_SERVICE_PROTOCOL://$GLANCE_GLARE_HOSTPORT" \
+            "$GLANCE_SERVICE_PROTOCOL://$GLANCE_GLARE_HOSTPORT"
+    fi
 }
 
 # create_glance_cache_dir() - Part of the init_glance() process
 function create_glance_cache_dir {
     # Create cache dir
-    sudo install -d -o $STACK_USER $GLANCE_AUTH_CACHE_DIR/api $GLANCE_AUTH_CACHE_DIR/registry $GLANCE_AUTH_CACHE_DIR/search
-    rm -f $GLANCE_AUTH_CACHE_DIR/api/* $GLANCE_AUTH_CACHE_DIR/registry/* $GLANCE_AUTH_CACHE_DIR/search/*
+    sudo install -d -o $STACK_USER $GLANCE_AUTH_CACHE_DIR/api $GLANCE_AUTH_CACHE_DIR/registry $GLANCE_AUTH_CACHE_DIR/search $GLANCE_AUTH_CACHE_DIR/artifact
+    rm -f $GLANCE_AUTH_CACHE_DIR/api/* $GLANCE_AUTH_CACHE_DIR/registry/* $GLANCE_AUTH_CACHE_DIR/search/* $GLANCE_AUTH_CACHE_DIR/artifact/*
 }
 
 # init_glance() - Initialize databases, etc.
@@ -326,6 +389,15 @@ function start_glance {
     if ! wait_for_service $SERVICE_TIMEOUT $GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT; then
         die $LINENO "g-api did not start"
     fi
+
+    #Start g-glare after g-reg/g-api/g-search
+    if is_service_enabled g-glare; then
+        run_process g-glare "$GLANCE_BIN_DIR/glance-glare --config-file=$GLANCE_CONF_DIR/glance-glare.conf"
+        echo "Waiting for Glare [g-glare] ($GLANCE_GLARE_HOSTPORT) to start..."
+        if ! wait_for_service $SERVICE_TIMEOUT $GLANCE_SERVICE_PROTOCOL://$GLANCE_GLARE_HOSTPORT; then
+            die $LINENO " Glare [g-glare] did not start"
+        fi
+    fi
 }
 
 # stop_glance() - Stop running processes
@@ -333,6 +405,10 @@ function stop_glance {
     # Kill the Glance screen windows
     stop_process g-api
     stop_process g-reg
+
+    if is_service_enabled g-glare; then
+        stop_process g-glare
+    fi
 }
 
 # Restore xtrace

From 3ded0dbba567e81f49c1b82c1b03853486d1da74 Mon Sep 17 00:00:00 2001
From: Jacek Tomasiak <jacek.tomasiak@gmail.com>
Date: Fri, 26 Feb 2016 23:14:54 +0100
Subject: [PATCH 0273/2409] Disable tempest tox venv recreation in OFFLINE mode

Setting OFFLINE=True in local.conf should enable stack.sh to run multiple
times without an internet connection. This was broken for some cases
when recreation of tox venv for tempest was forced in lib/tempest.

This change makes recreation of tox venv enabled only when OFFLINE mode is
disabled.

Change-Id: I2bf6caf60038a3690378eead905b35e9175ac356
Closes-Bug: #1550537
---
 lib/tempest | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index caf8f117d1..8d3bf7cd6b 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -322,7 +322,9 @@ function configure_tempest {
     local tmp_cfg_file
     tmp_cfg_file=$(mktemp)
     cd $TEMPEST_DIR
-    tox -revenv --notest
+    if [[ "$OFFLINE" != "True" ]]; then
+        tox -revenv --notest
+    fi
     # NOTE(mtreinish): Respect constraints on tempest verify-config venv
     tox -evenv -- pip install -c $REQUIREMENTS_DIR/upper-constraints.txt -r requirements.txt
     tox -evenv -- tempest verify-config -uro $tmp_cfg_file

From 1b1cc8c1d491b1469c7082d28d3e4a3a8a4a4fd9 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 1 Mar 2016 13:14:39 +1100
Subject: [PATCH 0274/2409] yum_install_package: fix errexit and retry

Since I93e9f312a94aeb086925e069a83ec1d3d3419423 yum_install isn't safe
under errexit.  This means it really only works when called by
tools/install_prereqs.sh because for some reason, we don't set that
there.

However, there is a problem with the retry logic when detecting failed
installs.  A failed package install should stop further progress, but
with the current retry logic it just goes ahead and retries the
installation, which then incorrectly passes.  You can see this
happening in a test like [1].

In our detection scripts, make a failed package or missing packages
exit with error-code 2, and "die" when we see this to correctly stop.

[1] http://logs.openstack.org/81/285881/1/check/gate-tempest-dsvm-platform-fedora23-nv/a83be30/logs/devstacklog.txt.gz

Change-Id: I4ea5515fa8e82a66aefa3ec3a48b823b645274f7
---
 functions-common | 27 +++++++++++++++++----------
 1 file changed, 17 insertions(+), 10 deletions(-)

diff --git a/functions-common b/functions-common
index 2b23402b54..72ac3fd96a 100644
--- a/functions-common
+++ b/functions-common
@@ -1302,13 +1302,14 @@ function yum_install {
 
     time_start "yum_install"
 
-    # Warning: this would not work if yum output message
-    # have been translated to another language
+    # - We run with LC_ALL=C so string matching *should* be OK
+    # - Exit 1 if the failure might get better with a retry.
+    # - Exit 2 if it is fatal.
     parse_yum_result='             \
         BEGIN { result=0 }         \
         /^YUM_FAILED/ { exit $2 }  \
-        /^No package/ { result=1 } \
-        /^Failed:/    { result=1 } \
+        /^No package/ { result=2 } \
+        /^Failed:/    { result=2 } \
         //{ print }                \
         END { exit result }'
 
@@ -1316,15 +1317,21 @@ function yum_install {
     # missing or failed packages are OK.
     # See https://bugzilla.redhat.com/show_bug.cgi?id=965567
     (sudo_with_proxies "${YUM:-yum}" install -y "$@" 2>&1 || echo YUM_FAILED $?) \
-        | awk "$parse_yum_result"
-    result=$?
-
-    if [ "$result" != 0 ]; then
-        echo $LINENO "${YUM:-yum}" install failure: $result
-    fi
+        | awk "$parse_yum_result" && result=$? || result=$?
 
     time_stop "yum_install"
 
+    # if we return 1, then the wrapper functions will run an update
+    # and try installing the package again as a defense against bad
+    # mirrors.  This can hide failures, especially when we have
+    # packages that are in the "Failed:" section because their rpm
+    # install scripts failed to run correctly (in this case, the
+    # package looks installed, so when the retry happens we just think
+    # the package is OK, and incorrectly continue on).
+    if [ "$result" == 2 ]; then
+        die "Detected fatal package install failure"
+    fi
+
     return "$result"
 }
 

From 0c985c8627da3db8c9766724e07295c726ac63df Mon Sep 17 00:00:00 2001
From: Mathieu Rohon <mathieu.rohon@gmail.com>
Date: Thu, 25 Feb 2016 10:00:36 +0000
Subject: [PATCH 0275/2409] Disable nova calls from tempest when heat is
 enabled

This patch ensures that lib/tempest doesn't call nova when heat is
enabled and nova is disabled.

Change-Id: I2debbae1bb82ecace1058e99ab172272393fb5ea
Closes-bug: #1549708
---
 lib/tempest | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index caf8f117d1..4cd94cd584 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -412,12 +412,15 @@ function configure_tempest {
         if [[ ! -z "$HEAT_CFN_IMAGE_URL" ]]; then
             iniset $TEMPEST_CONFIG orchestration image_ref $(basename "${HEAT_CFN_IMAGE_URL%.*}")
         fi
-        # build a specialized heat flavor
-        available_flavors=$(nova flavor-list)
-        if [[ ! ( $available_flavors =~ 'm1.heat' ) ]]; then
-            nova flavor-create m1.heat 451 512 0 1
+        # Nova might not be enabled, especially when we want to test tempest scenario/API that only create Neutron resources
+        if is_service_enabled nova; then
+            # build a specialized heat flavor
+            available_flavors=$(nova flavor-list)
+            if [[ ! ( $available_flavors =~ 'm1.heat' ) ]]; then
+                nova flavor-create m1.heat 451 512 0 1
+            fi
+            iniset $TEMPEST_CONFIG orchestration instance_type "m1.heat"
         fi
-        iniset $TEMPEST_CONFIG orchestration instance_type "m1.heat"
         iniset $TEMPEST_CONFIG orchestration build_timeout 900
         iniset $TEMPEST_CONFIG orchestration stack_owner_role "_member_"
     fi

From 304f4ce87c4708a35424c629e5ebd18fef90076c Mon Sep 17 00:00:00 2001
From: Clint Adams <clint@gcfm.net>
Date: Tue, 1 Mar 2016 10:44:05 -0500
Subject: [PATCH 0276/2409] Add note about the periodic proposal job to the
 header

Now that the devstack pluging periodic proposal job is in place,
add a note to the header to try to head off confusion.

Change-Id: I1c740ff768f831548970142a8bd024abe1763fdf
---
 data/devstack-plugins-registry.header | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/data/devstack-plugins-registry.header b/data/devstack-plugins-registry.header
index 687db0441c..c46ed97ab5 100644
--- a/data/devstack-plugins-registry.header
+++ b/data/devstack-plugins-registry.header
@@ -1,3 +1,8 @@
+..
+  Note to patch submitters: this file is covered by a periodic proposal
+  job.  You should edit the files data/devstack-plugins-registry.footer
+  data/devstack-plugins-registry.header instead of this one.
+
 ==========================
  DevStack Plugin Registry
 ==========================

From bb40df57145d35be1199cb816f702702f6cd38b3 Mon Sep 17 00:00:00 2001
From: Clint Adams <clint@gcfm.net>
Date: Tue, 1 Mar 2016 18:12:48 -0500
Subject: [PATCH 0277/2409] Increase Plugin Name column width by 10 in devstack
 plugins list

Change-Id: I62b1dca87ca8df4335a062caaf5e6a3e76e9101a
---
 data/devstack-plugins-registry.header   | 6 +++---
 tools/generate-devstack-plugins-list.sh | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/data/devstack-plugins-registry.header b/data/devstack-plugins-registry.header
index 687db0441c..82737bc59e 100644
--- a/data/devstack-plugins-registry.header
+++ b/data/devstack-plugins-registry.header
@@ -14,6 +14,6 @@ The following are plugins that a script has found in the openstack/
 namespace, which includes but is not limited to official OpenStack
 projects.
 
-+------------------+-------------------------------------------------------------------------+
-|Plugin Name       |URL                                                                      |
-+------------------+-------------------------------------------------------------------------+
++----------------------------+-------------------------------------------------------------------------+
+|Plugin Name                 |URL                                                                      |
++----------------------------+-------------------------------------------------------------------------+
diff --git a/tools/generate-devstack-plugins-list.sh b/tools/generate-devstack-plugins-list.sh
index b7817a0096..8a1f743b27 100644
--- a/tools/generate-devstack-plugins-list.sh
+++ b/tools/generate-devstack-plugins-list.sh
@@ -46,10 +46,10 @@ test -r data/devstack-plugins-registry.header && cat data/devstack-plugins-regis
 sorted_plugins=$(python tools/generate-devstack-plugins-list.py)
 
 for k in ${sorted_plugins}; do
-    project=${k:0:18}
+    project=${k:0:28}
     giturl="git://git.openstack.org/openstack/${k:0:26}"
-    printf "|%-18s|%-73s|\n" "${project}" "${giturl}"
-    printf "+------------------+-------------------------------------------------------------------------+\n"
+    printf "|%-28s|%-73s|\n" "${project}" "${giturl}"
+    printf "+----------------------------+-------------------------------------------------------------------------+\n"
 done
 
 test -r data/devstack-plugins-registry.footer && cat data/devstack-plugins-registry.footer

From 37dddb73fd17308fa3fbb127f6e49c1bb06f89e7 Mon Sep 17 00:00:00 2001
From: Ralf Haferkamp <rhafer@suse.de>
Date: Wed, 2 Mar 2016 15:25:57 +0100
Subject: [PATCH 0278/2409] Fix is_suse() check for openSUSE distros

We need to do a substring match on the vendor here. As most releases return
"openSUSE project" for the vendor.

Change-Id: Ia05db8d93b5e3f42cb6a9c8d77616ca9f7c32039
---
 functions-common | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index a26cc50db6..1452e2366b 100644
--- a/functions-common
+++ b/functions-common
@@ -433,7 +433,7 @@ function is_suse {
         GetOSVersion
     fi
 
-    [ "$os_VENDOR" = "openSUSE" ] || [ "$os_VENDOR" = "SUSE LINUX" ]
+    [[ "$os_VENDOR" =~ (openSUSE) || "$os_VENDOR" == "SUSE LINUX" ]]
 }
 
 

From 174986db21ebf3c20ba28c873e855629737a5b86 Mon Sep 17 00:00:00 2001
From: Yalei Wang <yalei.wang@intel.com>
Date: Wed, 2 Mar 2016 03:28:06 +0000
Subject: [PATCH 0279/2409] Add pg_createcluster creating process for psql
 version after 9.3

postgresql 9.3 don't create /etc/postgresql and related conf file by
default. So we need start the pg_createcluster in devstack if has not
started after package installed.

Change-Id: I2b348658d79b23b5f21871b33d8023499b2fb956
Close-bug: #1552051
---
 lib/databases/postgresql | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/lib/databases/postgresql b/lib/databases/postgresql
index 852bac4906..14425a53b7 100644
--- a/lib/databases/postgresql
+++ b/lib/databases/postgresql
@@ -47,7 +47,7 @@ function recreate_database_postgresql {
 }
 
 function configure_database_postgresql {
-    local pg_conf pg_dir pg_hba root_roles
+    local pg_conf pg_dir pg_hba root_roles version
     echo_summary "Configuring and starting PostgreSQL"
     if is_fedora; then
         pg_hba=/var/lib/pgsql/data/pg_hba.conf
@@ -56,6 +56,13 @@ function configure_database_postgresql {
             sudo postgresql-setup initdb
         fi
     elif is_ubuntu; then
+        version=`psql --version | cut -d ' ' -f3 | cut -d. -f1-2`
+        if vercmp $version '>=' 9.3; then
+            if [ -z "`pg_lsclusters -h`" ]; then
+                echo 'No PostgreSQL clusters exist; will create one'
+                sudo pg_createcluster $version main --start
+            fi
+        fi
         pg_dir=`find /etc/postgresql -name pg_hba.conf|xargs dirname`
         pg_hba=$pg_dir/pg_hba.conf
         pg_conf=$pg_dir/postgresql.conf

From 899dfeef466914c6695e6f3baa1c6576e784da8f Mon Sep 17 00:00:00 2001
From: Thomas Bechtold <tbechtold@suse.com>
Date: Thu, 3 Mar 2016 11:27:53 +0100
Subject: [PATCH 0280/2409] Fix lsb installation for SUSE

zypper has a "-n" (non-interactive) switch. "-y" is not known
as a global option.

Change-Id: I6537529e91c12c5f0d15a9faa2cca8aedaf7d956
---
 functions-common | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index a26cc50db6..d6e466357a 100644
--- a/functions-common
+++ b/functions-common
@@ -322,7 +322,7 @@ function _ensure_lsb_release {
         # XXX: old code paths seem to have assumed SUSE platforms also
         # had "yum".  Keep this ordered above yum so we don't try to
         # install the rh package.  suse calls it just "lsb"
-        sudo zypper -y install lsb
+        sudo zypper -n install lsb
     elif [[ -x $(which dnf 2>/dev/null) ]]; then
         sudo dnf install -y redhat-lsb-core
     elif [[ -x $(which yum 2>/dev/null) ]]; then

From f85a7e90f02ca691545cba2d2ce03aef671c9f15 Mon Sep 17 00:00:00 2001
From: Lucas Alvares Gomes <lucasagomes@gmail.com>
Date: Thu, 3 Mar 2016 10:33:17 +0000
Subject: [PATCH 0281/2409] Ironic: Set DEFAULT_IMAGE_NAME to full disk image
 for agent

The agent_* drivers in Ironic are not yet capable of deploying partition
images. The code in DevStack was aware of that but it was looking at the
agent_ssh driver specifically.

This patch is fixing this assumption and extending that conditional for
all agent drivers.

Change-Id: I416faa9ef6fba9621cd664d5a0747b1e80e281d1
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 7294f7b716..8f595eff68 100644
--- a/stackrc
+++ b/stackrc
@@ -625,7 +625,7 @@ if [[ "$DOWNLOAD_DEFAULT_IMAGES" == "True" ]]; then
             IMAGE_URLS+=",http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-x86_64-uec.tar.gz";;
         ironic)
             # Ironic can do both partition and full disk images, depending on the driver
-            if [[ "$IRONIC_DEPLOY_DRIVER" == "agent_ssh" ]]; then
+            if [[ -z "${IRONIC_DEPLOY_DRIVER%%agent*}" ]]; then
                 DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-x86_64-disk}
             else
                 DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-x86_64-uec}

From 7976aacdf6827558d01fffa0320fcc9354e32094 Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Thu, 3 Mar 2016 15:30:49 +0100
Subject: [PATCH 0282/2409] worlddump: log command failure details

If a command we trigger fails for some reason, it's worth logging
details about the failure (like return code).

Change-Id: Ib19aa474eccdd11e138a4f55e125935b621bca05
---
 tools/worlddump.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/worlddump.py b/tools/worlddump.py
index 01f601cea8..72a257fa8c 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -58,8 +58,8 @@ def _dump_cmd(cmd):
     try:
         subprocess.check_call(cmd, shell=True)
         print
-    except subprocess.CalledProcessError:
-        print "*** Failed to run: %s" % cmd
+    except subprocess.CalledProcessError as e:
+        print "*** Failed to run '%(cmd)s': %(err)s" % {'cmd': cmd, 'err': e}
 
 
 def _find_cmd(cmd):

From 718512c4d247682372b7e159c6adfb1514ab25b8 Mon Sep 17 00:00:00 2001
From: Evgeny Antyshev <eantyshev@virtuozzo.com>
Date: Thu, 3 Mar 2016 14:47:58 +0000
Subject: [PATCH 0283/2409] Introduce Virtuozzo distribution

Virtuozzo is a RHEL-based distribution serving as a platform OS
to host proprietary container virtualization
(formerly, Parallels Cloud Server).

We moved away from CloudLinux distribution, which has actually
no support in Devstack (no such clause in is_fedora).
As it was us who introduced CloudLinux, by this patch
we replace it with Virtuozzo distribution.

More info on Virtuozzo company here: http://virtuozzo.com

Change-Id: Ib8a77e4611ebc05bc0aa50bb83ab79c412e21c74
---
 functions-common | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/functions-common b/functions-common
index a26cc50db6..90217c955f 100644
--- a/functions-common
+++ b/functions-common
@@ -380,7 +380,8 @@ function GetDistro {
         DISTRO="sle${os_RELEASE%.*}"
     elif [[ "$os_VENDOR" =~ (Red.*Hat) || \
         "$os_VENDOR" =~ (CentOS) || \
-        "$os_VENDOR" =~ (OracleLinux) ]]; then
+        "$os_VENDOR" =~ (OracleLinux) || \
+        "$os_VENDOR" =~ (Virtuozzo) ]]; then
         # Drop the . release as we assume it's compatible
         # XXX re-evaluate when we get RHEL10
         DISTRO="rhel${os_RELEASE::1}"
@@ -421,7 +422,7 @@ function is_fedora {
 
     [ "$os_VENDOR" = "Fedora" ] || [ "$os_VENDOR" = "Red Hat" ] || \
         [ "$os_VENDOR" = "CentOS" ] || [ "$os_VENDOR" = "OracleLinux" ] || \
-        [ "$os_VENDOR" = "CloudLinux" ] || [ "$os_VENDOR" = "kvmibm" ]
+        [ "$os_VENDOR" = "Virtuozzo" ] || [ "$os_VENDOR" = "kvmibm" ]
 }
 
 

From 5fe81c50a2606b9763676e40b4a1083c5a72e58a Mon Sep 17 00:00:00 2001
From: twm2016 <TM2086@att.com>
Date: Fri, 26 Feb 2016 11:44:57 -0600
Subject: [PATCH 0284/2409] Add error handling for euch.sh volume creation

Error handling for volume creation calls die with the appropriate
 message.

Change-Id: Ib095992384edf895aaf78cb4115702d6a0675a3f
Closes-Bug: #1206180
---
 exercises/euca.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/exercises/euca.sh b/exercises/euca.sh
index c2957e222b..60e7d8ca29 100755
--- a/exercises/euca.sh
+++ b/exercises/euca.sh
@@ -17,7 +17,6 @@ set -o errexit
 # an error.  It is also useful for following allowing as the install occurs.
 set -o xtrace
 
-
 # Settings
 # ========
 
@@ -89,7 +88,8 @@ if is_service_enabled c-vol && ! is_service_enabled n-cell && [ "$VIRT_DRIVER" !
     VOLUME_ZONE=`euca-describe-availability-zones | head -n1 | cut -f2`
     die_if_not_set $LINENO VOLUME_ZONE "Failure to find zone for volume"
 
-    VOLUME=`euca-create-volume -s 1 -z $VOLUME_ZONE | cut -f2`
+    VOLUME=`euca-create-volume -s 1 -z $VOLUME_ZONE` || die $LINENO "Failure to create volume"
+    VOLUME=`echo "$VOLUME" | cut -f2`
     die_if_not_set $LINENO VOLUME "Failure to create volume"
 
     # Test that volume has been created

From 96d895d8717a476b5ad2f5278762951e1a89bdd7 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Fri, 4 Mar 2016 06:26:51 +0000
Subject: [PATCH 0285/2409] Updated from generate-devstack-plugins-list

Change-Id: I01587633625087d190e879c88c53730efa01cd16
---
 doc/source/plugin-registry.rst | 251 ++++++++++++++++++++++++---------
 1 file changed, 181 insertions(+), 70 deletions(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index b96883ad9c..29b743ff2b 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -1,7 +1,7 @@
 ..
-  Note to reviewers: the intent of this file is to be easy for
-  community members to update. As such fast approving (single core +2)
-  is fine as long as you've identified that the plugin listed actually exists.
+  Note to patch submitters: this file is covered by a periodic proposal
+  job.  You should edit the files data/devstack-plugins-registry.footer
+  data/devstack-plugins-registry.header instead of this one.
 
 ==========================
  DevStack Plugin Registry
@@ -12,44 +12,186 @@ a lot of projects. The following is a list of plugins that currently
 exist. Any project that wishes to list their plugin here is welcomed
 to.
 
-Official OpenStack Projects
-===========================
-
-The following are plugins that exist for official OpenStack projects.
-
-+------------------+---------------------------------------------+--------------------+
-|Plugin Name       |URL                                          |Comments            |
-+------------------+---------------------------------------------+--------------------+
-|aodh              |git://git.openstack.org/openstack/aodh       | alarming           |
-+------------------+---------------------------------------------+--------------------+
-|barbican          |git://git.openstack.org/openstack/barbican   | key management     |
-+------------------+---------------------------------------------+--------------------+
-|ceilometer        |git://git.openstack.org/openstack/ceilometer | metering           |
-+------------------+---------------------------------------------+--------------------+
-|congress          |git://git.openstack.org/openstack/congress   | governance         |
-+------------------+---------------------------------------------+--------------------+
-|cue               |git://git.openstack.org/openstack/cue        | message-broker     |
-+------------------+---------------------------------------------+--------------------+
-|gnocchi           |git://git.openstack.org/openstack/gnocchi    | metric             |
-+------------------+---------------------------------------------+--------------------+
-|ironic            |git://git.openstack.org/openstack/ironic     | baremetal          |
-+------------------+---------------------------------------------+--------------------+
-|magnum            |git://git.openstack.org/openstack/magnum     |                    |
-+------------------+---------------------------------------------+--------------------+
-|manila            |git://git.openstack.org/openstack/manila     | file shares        |
-+------------------+---------------------------------------------+--------------------+
-|mistral           |git://git.openstack.org/openstack/mistral    |                    |
-+------------------+---------------------------------------------+--------------------+
-|rally             |git://git.openstack.org/openstack/rally      |                    |
-+------------------+---------------------------------------------+--------------------+
-|sahara            |git://git.openstack.org/openstack/sahara     |                    |
-+------------------+---------------------------------------------+--------------------+
-|trove             |git://git.openstack.org/openstack/trove      |                    |
-+------------------+---------------------------------------------+--------------------+
-|zaqar             |git://git.openstack.org/openstack/zaqar      |                    |
-+------------------+---------------------------------------------+--------------------+
+Detected Plugins
+================
 
+The following are plugins that a script has found in the openstack/
+namespace, which includes but is not limited to official OpenStack
+projects.
 
++----------------------------+-------------------------------------------------------------------------+
+|Plugin Name                 |URL                                                                      |
++----------------------------+-------------------------------------------------------------------------+
+|aodh                        |git://git.openstack.org/openstack/aodh                                   |
++----------------------------+-------------------------------------------------------------------------+
+|app-catalog-ui              |git://git.openstack.org/openstack/app-catalog-ui                         |
++----------------------------+-------------------------------------------------------------------------+
+|astara                      |git://git.openstack.org/openstack/astara                                 |
++----------------------------+-------------------------------------------------------------------------+
+|barbican                    |git://git.openstack.org/openstack/barbican                               |
++----------------------------+-------------------------------------------------------------------------+
+|blazar                      |git://git.openstack.org/openstack/blazar                                 |
++----------------------------+-------------------------------------------------------------------------+
+|ceilometer                  |git://git.openstack.org/openstack/ceilometer                             |
++----------------------------+-------------------------------------------------------------------------+
+|ceilometer-powervm          |git://git.openstack.org/openstack/ceilometer-powervm                     |
++----------------------------+-------------------------------------------------------------------------+
+|cerberus                    |git://git.openstack.org/openstack/cerberus                               |
++----------------------------+-------------------------------------------------------------------------+
+|cloudkitty                  |git://git.openstack.org/openstack/cloudkitty                             |
++----------------------------+-------------------------------------------------------------------------+
+|collectd-ceilometer-plugin  |git://git.openstack.org/openstack/collectd-ceilometer-plugin             |
++----------------------------+-------------------------------------------------------------------------+
+|congress                    |git://git.openstack.org/openstack/congress                               |
++----------------------------+-------------------------------------------------------------------------+
+|cue                         |git://git.openstack.org/openstack/cue                                    |
++----------------------------+-------------------------------------------------------------------------+
+|designate                   |git://git.openstack.org/openstack/designate                              |
++----------------------------+-------------------------------------------------------------------------+
+|devstack-plugin-amqp1       |git://git.openstack.org/openstack/devstack-plugin-amqp1                  |
++----------------------------+-------------------------------------------------------------------------+
+|devstack-plugin-bdd         |git://git.openstack.org/openstack/devstack-plugin-bdd                    |
++----------------------------+-------------------------------------------------------------------------+
+|devstack-plugin-ceph        |git://git.openstack.org/openstack/devstack-plugin-ceph                   |
++----------------------------+-------------------------------------------------------------------------+
+|devstack-plugin-glusterfs   |git://git.openstack.org/openstack/devstack-plugin-glusterfs              |
++----------------------------+-------------------------------------------------------------------------+
+|devstack-plugin-hdfs        |git://git.openstack.org/openstack/devstack-plugin-hdfs                   |
++----------------------------+-------------------------------------------------------------------------+
+|devstack-plugin-pika        |git://git.openstack.org/openstack/devstack-plugin-pika                   |
++----------------------------+-------------------------------------------------------------------------+
+|devstack-plugin-sheepdog    |git://git.openstack.org/openstack/devstack-plugin-sheepdog               |
++----------------------------+-------------------------------------------------------------------------+
+|devstack-plugin-zmq         |git://git.openstack.org/openstack/devstack-plugin-zmq                    |
++----------------------------+-------------------------------------------------------------------------+
+|dragonflow                  |git://git.openstack.org/openstack/dragonflow                             |
++----------------------------+-------------------------------------------------------------------------+
+|drbd-devstack               |git://git.openstack.org/openstack/drbd-devstack                          |
++----------------------------+-------------------------------------------------------------------------+
+|ec2-api                     |git://git.openstack.org/openstack/ec2-api                                |
++----------------------------+-------------------------------------------------------------------------+
+|freezer                     |git://git.openstack.org/openstack/freezer                                |
++----------------------------+-------------------------------------------------------------------------+
+|freezer-api                 |git://git.openstack.org/openstack/freezer-api                            |
++----------------------------+-------------------------------------------------------------------------+
+|freezer-web-ui              |git://git.openstack.org/openstack/freezer-web-ui                         |
++----------------------------+-------------------------------------------------------------------------+
+|gce-api                     |git://git.openstack.org/openstack/gce-api                                |
++----------------------------+-------------------------------------------------------------------------+
+|gnocchi                     |git://git.openstack.org/openstack/gnocchi                                |
++----------------------------+-------------------------------------------------------------------------+
+|ironic                      |git://git.openstack.org/openstack/ironic                                 |
++----------------------------+-------------------------------------------------------------------------+
+|ironic-inspector            |git://git.openstack.org/openstack/ironic-inspector                       |
++----------------------------+-------------------------------------------------------------------------+
+|kingbird                    |git://git.openstack.org/openstack/kingbird                               |
++----------------------------+-------------------------------------------------------------------------+
+|kuryr                       |git://git.openstack.org/openstack/kuryr                                  |
++----------------------------+-------------------------------------------------------------------------+
+|magnum                      |git://git.openstack.org/openstack/magnum                                 |
++----------------------------+-------------------------------------------------------------------------+
+|manila                      |git://git.openstack.org/openstack/manila                                 |
++----------------------------+-------------------------------------------------------------------------+
+|mistral                     |git://git.openstack.org/openstack/mistral                                |
++----------------------------+-------------------------------------------------------------------------+
+|monasca-api                 |git://git.openstack.org/openstack/monasca-api                            |
++----------------------------+-------------------------------------------------------------------------+
+|murano                      |git://git.openstack.org/openstack/murano                                 |
++----------------------------+-------------------------------------------------------------------------+
+|networking-6wind            |git://git.openstack.org/openstack/networking-6wind                       |
++----------------------------+-------------------------------------------------------------------------+
+|networking-bagpipe          |git://git.openstack.org/openstack/networking-bagpipe                     |
++----------------------------+-------------------------------------------------------------------------+
+|networking-bgpvpn           |git://git.openstack.org/openstack/networking-bgpvpn                      |
++----------------------------+-------------------------------------------------------------------------+
+|networking-calico           |git://git.openstack.org/openstack/networking-calico                      |
++----------------------------+-------------------------------------------------------------------------+
+|networking-cisco            |git://git.openstack.org/openstack/networking-cisco                       |
++----------------------------+-------------------------------------------------------------------------+
+|networking-fortinet         |git://git.openstack.org/openstack/networking-fortinet                    |
++----------------------------+-------------------------------------------------------------------------+
+|networking-generic-switch   |git://git.openstack.org/openstack/networking-generic-switch              |
++----------------------------+-------------------------------------------------------------------------+
+|networking-infoblox         |git://git.openstack.org/openstack/networking-infoblox                    |
++----------------------------+-------------------------------------------------------------------------+
+|networking-l2gw             |git://git.openstack.org/openstack/networking-l2gw                        |
++----------------------------+-------------------------------------------------------------------------+
+|networking-midonet          |git://git.openstack.org/openstack/networking-midonet                     |
++----------------------------+-------------------------------------------------------------------------+
+|networking-mlnx             |git://git.openstack.org/openstack/networking-mlnx                        |
++----------------------------+-------------------------------------------------------------------------+
+|networking-nec              |git://git.openstack.org/openstack/networking-nec                         |
++----------------------------+-------------------------------------------------------------------------+
+|networking-odl              |git://git.openstack.org/openstack/networking-odl                         |
++----------------------------+-------------------------------------------------------------------------+
+|networking-ofagent          |git://git.openstack.org/openstack/networking-ofagent                     |
++----------------------------+-------------------------------------------------------------------------+
+|networking-ovn              |git://git.openstack.org/openstack/networking-ovn                         |
++----------------------------+-------------------------------------------------------------------------+
+|networking-ovs-dpdk         |git://git.openstack.org/openstack/networking-ovs-dpdk                    |
++----------------------------+-------------------------------------------------------------------------+
+|networking-plumgrid         |git://git.openstack.org/openstack/networking-plumgrid                    |
++----------------------------+-------------------------------------------------------------------------+
+|networking-powervm          |git://git.openstack.org/openstack/networking-powervm                     |
++----------------------------+-------------------------------------------------------------------------+
+|networking-sfc              |git://git.openstack.org/openstack/networking-sfc                         |
++----------------------------+-------------------------------------------------------------------------+
+|networking-vsphere          |git://git.openstack.org/openstack/networking-vsphere                     |
++----------------------------+-------------------------------------------------------------------------+
+|neutron                     |git://git.openstack.org/openstack/neutron                                |
++----------------------------+-------------------------------------------------------------------------+
+|neutron-lbaas               |git://git.openstack.org/openstack/neutron-lbaas                          |
++----------------------------+-------------------------------------------------------------------------+
+|neutron-lbaas-dashboard     |git://git.openstack.org/openstack/neutron-lbaas-dashboard                |
++----------------------------+-------------------------------------------------------------------------+
+|neutron-vpnaas              |git://git.openstack.org/openstack/neutron-vpnaas                         |
++----------------------------+-------------------------------------------------------------------------+
+|nova-docker                 |git://git.openstack.org/openstack/nova-docker                            |
++----------------------------+-------------------------------------------------------------------------+
+|nova-powervm                |git://git.openstack.org/openstack/nova-powervm                           |
++----------------------------+-------------------------------------------------------------------------+
+|octavia                     |git://git.openstack.org/openstack/octavia                                |
++----------------------------+-------------------------------------------------------------------------+
+|osprofiler                  |git://git.openstack.org/openstack/osprofiler                             |
++----------------------------+-------------------------------------------------------------------------+
+|rally                       |git://git.openstack.org/openstack/rally                                  |
++----------------------------+-------------------------------------------------------------------------+
+|sahara                      |git://git.openstack.org/openstack/sahara                                 |
++----------------------------+-------------------------------------------------------------------------+
+|sahara-dashboard            |git://git.openstack.org/openstack/sahara-dashboard                       |
++----------------------------+-------------------------------------------------------------------------+
+|scalpels                    |git://git.openstack.org/openstack/scalpels                               |
++----------------------------+-------------------------------------------------------------------------+
+|searchlight                 |git://git.openstack.org/openstack/searchlight                            |
++----------------------------+-------------------------------------------------------------------------+
+|senlin                      |git://git.openstack.org/openstack/senlin                                 |
++----------------------------+-------------------------------------------------------------------------+
+|smaug                       |git://git.openstack.org/openstack/smaug                                  |
++----------------------------+-------------------------------------------------------------------------+
+|solum                       |git://git.openstack.org/openstack/solum                                  |
++----------------------------+-------------------------------------------------------------------------+
+|tacker                      |git://git.openstack.org/openstack/tacker                                 |
++----------------------------+-------------------------------------------------------------------------+
+|tap-as-a-service            |git://git.openstack.org/openstack/tap-as-a-service                       |
++----------------------------+-------------------------------------------------------------------------+
+|tricircle                   |git://git.openstack.org/openstack/tricircle                              |
++----------------------------+-------------------------------------------------------------------------+
+|trove                       |git://git.openstack.org/openstack/trove                                  |
++----------------------------+-------------------------------------------------------------------------+
+|trove-dashboard             |git://git.openstack.org/openstack/trove-dashboard                        |
++----------------------------+-------------------------------------------------------------------------+
+|vitrage                     |git://git.openstack.org/openstack/vitrage                                |
++----------------------------+-------------------------------------------------------------------------+
+|vitrage-dashboard           |git://git.openstack.org/openstack/vitrage-dashboard                      |
++----------------------------+-------------------------------------------------------------------------+
+|vmware-nsx                  |git://git.openstack.org/openstack/vmware-nsx                             |
++----------------------------+-------------------------------------------------------------------------+
+|watcher                     |git://git.openstack.org/openstack/watcher                                |
++----------------------------+-------------------------------------------------------------------------+
+|watcher-dashboard           |git://git.openstack.org/openstack/watcher-dashboard                      |
++----------------------------+-------------------------------------------------------------------------+
+|zaqar                       |git://git.openstack.org/openstack/zaqar                                  |
++----------------------------+-------------------------------------------------------------------------+
 
 Drivers
 =======
@@ -78,34 +220,3 @@ Alternate Configs
 +-------------+------------------------------------------------------------+------------+
 |             |                                                            |            |
 +-------------+------------------------------------------------------------+------------+
-
-Additional Services
-===================
-
-+-----------------+------------------------------------------------------------+------------+
-| Plugin Name     | URL                                                        | Comments   |
-|                 |                                                            |            |
-+-----------------+------------------------------------------------------------+------------+
-|amqp1            |git://git.openstack.org/openstack/devstack-plugin-amqp1     |            |
-+-----------------+------------------------------------------------------------+------------+
-|bdd              |git://git.openstack.org/openstack/devstack-plugin-bdd       |            |
-+-----------------+------------------------------------------------------------+------------+
-|ec2-api          |git://git.openstack.org/openstack/ec2-api                   |[as1]_      |
-+-----------------+------------------------------------------------------------+------------+
-|glusterfs        |git://git.openstack.org/openstack/devstack-plugin-glusterfs |            |
-+-----------------+------------------------------------------------------------+------------+
-|hdfs             |git://git.openstack.org/openstack/devstack-plugin-hdfs      |            |
-+-----------------+------------------------------------------------------------+------------+
-|ironic-inspector |git://git.openstack.org/openstack/ironic-inspector          |            |
-+-----------------+------------------------------------------------------------+------------+
-|pika             |git://git.openstack.org/openstack/devstack-plugin-pika      |            |
-+-----------------+------------------------------------------------------------+------------+
-|sheepdog         |git://git.openstack.org/openstack/devstack-plugin-sheepdog  |            |
-+-----------------+------------------------------------------------------------+------------+
-|zmq              |git://git.openstack.org/openstack/devstack-plugin-zmq       |            |
-+-----------------+------------------------------------------------------------+------------+
-|                 |                                                            |            |
-+-----------------+------------------------------------------------------------+------------+
-
-.. [as1] first functional devstack plugin, hence why used in most of
-         the examples.

From dab3901d9aa9d4485495d066c58a3e82c76e2261 Mon Sep 17 00:00:00 2001
From: Thomas Bechtold <tbechtold@suse.com>
Date: Thu, 3 Mar 2016 12:11:15 +0100
Subject: [PATCH 0286/2409] Use "command -v" instead of "which" to find path

If /usr/bin/which is not available, the current code
doesn't detect i.e. /usr/bin/zypper . Using "command -v" solved
the problem.

Change-Id: I1c281c3184d69cd9dc2418295b6a392d8e5693e0
---
 functions-common | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/functions-common b/functions-common
index d6e466357a..0614b78aff 100644
--- a/functions-common
+++ b/functions-common
@@ -312,20 +312,20 @@ declare os_VENDOR os_RELEASE os_PACKAGE os_CODENAME
 # user if not available.  Note can't use generic install_package*
 # because they depend on this!
 function _ensure_lsb_release {
-    if [[ -x $(which lsb_release 2>/dev/null) ]]; then
+    if [[ -x $(command -v lsb_release 2>/dev/null) ]]; then
         return
     fi
 
-    if [[ -x $(which apt-get 2>/dev/null) ]]; then
+    if [[ -x $(command -v apt-get 2>/dev/null) ]]; then
         sudo apt-get install -y lsb-release
-    elif [[ -x $(which zypper 2>/dev/null) ]]; then
+    elif [[ -x $(command -v zypper 2>/dev/null) ]]; then
         # XXX: old code paths seem to have assumed SUSE platforms also
         # had "yum".  Keep this ordered above yum so we don't try to
         # install the rh package.  suse calls it just "lsb"
         sudo zypper -n install lsb
-    elif [[ -x $(which dnf 2>/dev/null) ]]; then
+    elif [[ -x $(command -v dnf 2>/dev/null) ]]; then
         sudo dnf install -y redhat-lsb-core
-    elif [[ -x $(which yum 2>/dev/null) ]]; then
+    elif [[ -x $(command -v yum 2>/dev/null) ]]; then
         # all rh patforms (fedora, centos, rhel) have this pkg
         sudo yum install -y redhat-lsb-core
     else

From c15d59157c4aab0147ab5d388642c6c08cae875a Mon Sep 17 00:00:00 2001
From: Thomas Bechtold <tbechtold@suse.com>
Date: Fri, 4 Mar 2016 16:06:24 +0100
Subject: [PATCH 0287/2409] Ignore errors when uninstalling a pkg with zypper

I.e. when trying to uninstall python-pip and it's not installed,
don't exit.

Change-Id: I21ac715a0090ad01811af47f23c61823dfa65629
---
 functions-common | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index 2c498a0b1f..371c4f9e35 100644
--- a/functions-common
+++ b/functions-common
@@ -1286,7 +1286,7 @@ function uninstall_package {
     elif is_fedora; then
         sudo ${YUM:-yum} remove -y "$@" ||:
     elif is_suse; then
-        sudo zypper rm "$@"
+        sudo zypper rm "$@" ||:
     else
         exit_distro_not_supported "uninstalling packages"
     fi

From 6cf412bb7ee2f667c38cf113440018b1ffcc7546 Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Fri, 4 Mar 2016 10:36:10 -0500
Subject: [PATCH 0288/2409] Update account generator calls with correct
 password

Change I380dd20e5ed716a0bdf92aa02c3730359b8136e4 updated the tempest
configuration to stop creating a bunch of globals. But as part of
that refactor it started using $admin_password as the password
argument for tempest-account generator, which is never defined.
This commit rectifies the situation by using the correct variable
$password.

Change-Id: Ieeed58751e5784020e04bcc2911ac74791662110
---
 lib/tempest | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 8d3bf7cd6b..4fb3e5edca 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -554,9 +554,9 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG auth tempest_roles "Member"
     if [[ $TEMPEST_USE_TEST_ACCOUNTS == "True" ]]; then
         if [[ $TEMPEST_HAS_ADMIN == "True" ]]; then
-            tempest-account-generator -c $TEMPEST_CONFIG --os-username $admin_username --os-password $admin_password --os-tenant-name $admin_tenant_name -r $TEMPEST_CONCURRENCY --with-admin etc/accounts.yaml
+            tempest-account-generator -c $TEMPEST_CONFIG --os-username $admin_username --os-password "$password" --os-tenant-name $admin_tenant_name -r $TEMPEST_CONCURRENCY --with-admin etc/accounts.yaml
         else
-            tempest-account-generator -c $TEMPEST_CONFIG --os-username $admin_username --os-password $admin_password --os-tenant-name $admin_tenant_name -r $TEMPEST_CONCURRENCY etc/accounts.yaml
+            tempest-account-generator -c $TEMPEST_CONFIG --os-username $admin_username --os-password "$password" --os-tenant-name $admin_tenant_name -r $TEMPEST_CONCURRENCY etc/accounts.yaml
         fi
         iniset $TEMPEST_CONFIG auth use_dynamic_credentials False
         iniset $TEMPEST_CONFIG auth test_accounts_file "etc/accounts.yaml"

From f21cc1fd9664575dbc9c31cff1b09ac16fdef985 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Fri, 4 Mar 2016 11:08:32 -0500
Subject: [PATCH 0289/2409] Use new use_neutron variable

This uses the new use_neutron variable instead of the crazy class
path. This helps us test the use of this in our jobs.

Change-Id: Ic6d0cc4b7a0df6b3f5336ee58886f7edff26e846
Depends-On: I1c2eb51d10ba6370492a911f59370b9870646a38
---
 lib/neutron-legacy | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 7d6e881881..e06a020f43 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -486,8 +486,7 @@ function configure_neutron {
 }
 
 function create_nova_conf_neutron {
-    iniset $NOVA_CONF DEFAULT network_api_class "nova.network.neutronv2.api.API"
-
+    iniset $NOVA_CONF DEFAULT use_neutron True
     iniset $NOVA_CONF neutron auth_type "password"
     iniset $NOVA_CONF neutron auth_url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_AUTH_PORT/v3"
     iniset $NOVA_CONF neutron username "$Q_ADMIN_USERNAME"
@@ -502,7 +501,6 @@ function create_nova_conf_neutron {
     if [[ "$Q_USE_SECGROUP" == "True" ]]; then
         LIBVIRT_FIREWALL_DRIVER=nova.virt.firewall.NoopFirewallDriver
         iniset $NOVA_CONF DEFAULT firewall_driver $LIBVIRT_FIREWALL_DRIVER
-        iniset $NOVA_CONF DEFAULT security_group_api neutron
     fi
 
     # optionally set options in nova_conf

From 4b186badaadc07fc4478c77988489d31d9375de7 Mon Sep 17 00:00:00 2001
From: Clint Adams <clint@gcfm.net>
Date: Tue, 1 Mar 2016 10:33:23 -0500
Subject: [PATCH 0290/2409] Remove devstack plugins proposal job footer

Aside from notes, the content of the footer is entirely redundant
with the detected plugins list, so let's remove it.

Change-Id: I346b59705c5b0716a18087f6800f568fb1f4c9a8
---
 data/devstack-plugins-registry.footer | 28 ---------------------------
 1 file changed, 28 deletions(-)
 delete mode 100644 data/devstack-plugins-registry.footer

diff --git a/data/devstack-plugins-registry.footer b/data/devstack-plugins-registry.footer
deleted file mode 100644
index 669cb8d574..0000000000
--- a/data/devstack-plugins-registry.footer
+++ /dev/null
@@ -1,28 +0,0 @@
-
-Drivers
-=======
-
-+--------------------+-------------------------------------------------+------------------+
-|Plugin Name         |URL                                              |Comments          |
-+--------------------+-------------------------------------------------+------------------+
-|dragonflow          |git://git.openstack.org/openstack/dragonflow     |[d1]_             |
-+--------------------+-------------------------------------------------+------------------+
-|odl                 |git://git.openstack.org/openstack/networking-odl |[d2]_             |
-+--------------------+-------------------------------------------------+------------------+
-
-.. [d1] demonstrates example of installing 3rd party SDN controller
-.. [d2] demonstrates a pretty advanced set of modes that that allow
-        one to run OpenDayLight either from a pre-existing install, or
-        also from source
-
-Alternate Configs
-=================
-
-+-------------+------------------------------------------------------------+------------+
-| Plugin Name | URL                                                        | Comments   |
-|             |                                                            |            |
-+-------------+------------------------------------------------------------+------------+
-|glusterfs    |git://git.openstack.org/openstack/devstack-plugin-glusterfs |            |
-+-------------+------------------------------------------------------------+------------+
-|             |                                                            |            |
-+-------------+------------------------------------------------------------+------------+

From c21194875e8dc4dd7a2c4150c6b5ae017e65c35d Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 7 Mar 2016 10:25:41 +1100
Subject: [PATCH 0291/2409] Add some notes on trove image

The trove image is one of the larger ones we cache, and after
double-checking it is still used as part of the
gate-tempest-dsvm-trove tests (although integration tests seem use
their own dib-built version)

Add some notes to clarify the situation with this image.

Change-Id: I2319dd5811d6bd215d1e8778eca5b4c9399f0efb
---
 stackrc | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/stackrc b/stackrc
index 7294f7b716..27f53616c4 100644
--- a/stackrc
+++ b/stackrc
@@ -639,11 +639,17 @@ if [[ "$DOWNLOAD_DEFAULT_IMAGES" == "True" ]]; then
     DOWNLOAD_DEFAULT_IMAGES=False
 fi
 
-# Staging Area for New Images, have them here for at least 24hrs for nodepool
-# to cache them otherwise the failure rates in the gate are too high
+# Staging area for new images.  These images are cached by a run of
+# ./tools/image_list.sh during CI image build (see
+# project-config:nodepool/elements/cache-devstack/extra-data.d/55-cache-devstack-repos).
+#
+# To avoid CI failures grabbing the images, new images should be here
+# for at least 24hrs (nodepool builds images at 14:00UTC) so the they
+# are in the cache.
 PRECACHE_IMAGES=$(trueorfalse False PRECACHE_IMAGES)
 if [[ "$PRECACHE_IMAGES" == "True" ]]; then
-
+    # required for trove devstack tests; see
+    #  git.openstack.org/cgit/openstack/trove/tree/devstack/plugin.sh
     IMAGE_URL="http://tarballs.openstack.org/trove/images/ubuntu/mysql.qcow2"
     if ! [[ "$IMAGE_URLS"  =~ "$IMAGE_URL" ]]; then
         IMAGE_URLS+=",$IMAGE_URL"

From c709d50afed14308c3cef4a823f440ca7972ba6f Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 7 Mar 2016 14:00:58 +1100
Subject: [PATCH 0292/2409] Update bashate to 0.5.0

Update bashate to 0.5.0 release.  We got things ready for this with
I3fd5d55236e90c2f2c25243af87adaf0c1b763e2.

I'm not sure what I was thinking in
I9e4b1c0dc9e0f709d8e76f9c9bf1c9478b2605ed when I added ".orig" files
to the list of files to check.  Ignore diff/merge files.

Change-Id: I8bb0c8b39972abb775b4e5556e79d2e17005bc8c
---
 tox.ini | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/tox.ini b/tox.ini
index ef557fbffe..3dfc37711c 100644
--- a/tox.ini
+++ b/tox.ini
@@ -12,7 +12,7 @@ install_command = pip install {opts} {packages}
 # against devstack, just set BASHATE_INSTALL_PATH=/path/... to your
 # modified bashate tree
 deps =
-   {env:BASHATE_INSTALL_PATH:bashate==0.4.0}
+   {env:BASHATE_INSTALL_PATH:bashate==0.5.0}
 whitelist_externals = bash
 commands = bash -c "find {toxinidir}             \
          -not \( -type d -name .?\* -prune \)    \
@@ -22,9 +22,10 @@ commands = bash -c "find {toxinidir}             \
          -not -name \*~                          \
          -not -name \*.md                        \
          -not -name stack-screenrc               \
+         -not -name \*.orig                      \
+         -not -name \*.rej                       \
          \(                                      \
           -name \*.sh -or                        \
-          -name \*.orig -or                      \
           -name \*rc -or                         \
           -name functions\* -or                  \
           -wholename \*/inc/\* -or               \

From a440bf8629ac4103244ab090a471f68852412a1c Mon Sep 17 00:00:00 2001
From: Tracy Jones <tjones@vmware.com>
Date: Mon, 7 Mar 2016 10:49:51 -0800
Subject: [PATCH 0293/2409] Ignore vmdk files as well as other image types

Change-Id: I012b21181f1e54a1e4a3707b0fdf8c0afa6222c2
---
 .gitignore | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.gitignore b/.gitignore
index a5a17c2b75..e813cffff7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -12,6 +12,7 @@ accrc
 doc/files
 doc/build
 files/*.gz
+files/*.vmdk
 files/*.rpm
 files/*.rpm.*
 files/*.qcow2

From 7b85723c0421affdb82a201bf4231c4d00c18599 Mon Sep 17 00:00:00 2001
From: Matthew Oliver <matt@oliver.net.au>
Date: Mon, 7 Mar 2016 18:21:29 +1100
Subject: [PATCH 0294/2409] Set the Swift max_file_size to 1/2 the loopback

Currently Devstack (and devstack gate) uses the default
max_file_size of for Swift (5GB). However the loopback file
is only 1 or 2 GB is size.

We are looking at setting a default FALLOCATE_RESERVE in swift
https://review.openstack.org/#/c/288011.
Because of this our max file size test fails due to the max_file_size
and devstacks loopback size being too small.

This patch sets this to a more sane size by default inside DevStack.
See the gerrit link above for more details.

Tempest uses a loopback of 6GB, so in this case the swift default of 5GB
should be fine.

Change-Id: If09eab7d16ae67bd252020e00e8812ff252f065b
---
 lib/swift | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/lib/swift b/lib/swift
index b6c3ca49a3..8c5aa5e4e8 100644
--- a/lib/swift
+++ b/lib/swift
@@ -71,17 +71,20 @@ if is_service_enabled g-api; then
     # only 1G we can not upload volume to image.
     # Increase Swift disk size up to 2G
     SWIFT_LOOPBACK_DISK_SIZE_DEFAULT=2G
+    SWIFT_MAX_FILE_SIZE_DEFAULT=1073741824 # 1G
 else
     # DevStack will create a loop-back disk formatted as XFS to store the
     # swift data. Set ``SWIFT_LOOPBACK_DISK_SIZE`` to the disk size in
     # kilobytes.
     # Default is 1 gigabyte.
     SWIFT_LOOPBACK_DISK_SIZE_DEFAULT=1G
+    SWIFT_MAX_FILE_SIZE_DEFAULT=536870912 # 512M
 fi
 
 # if tempest enabled the default size is 6 Gigabyte.
 if is_service_enabled tempest; then
     SWIFT_LOOPBACK_DISK_SIZE_DEFAULT=${SWIFT_LOOPBACK_DISK_SIZE:-6G}
+    SWIFT_MAX_FILE_SIZE_DEFAULT=5368709122 # Swift default 5G
 fi
 
 SWIFT_LOOPBACK_DISK_SIZE=${SWIFT_LOOPBACK_DISK_SIZE:-$SWIFT_LOOPBACK_DISK_SIZE_DEFAULT}
@@ -127,6 +130,10 @@ SWIFT_LOG_TOKEN_LENGTH=${SWIFT_LOG_TOKEN_LENGTH:-12}
 # Swift API
 SWIFT_MAX_HEADER_SIZE=${SWIFT_MAX_HEADER_SIZE:-16384}
 
+# Set ``SWIFT_MAX_FILE_SIZE`` to configure the maximum file size in Swift API
+# Default 500MB because the loopback file used for swift could be 1 or 2 GB
+SWIFT_MAX_FILE_SIZE=${SWIFT_MAX_FILE_SIZE:-$SWIFT_MAX_FILE_SIZE_DEFAULT}
+
 # Set ``OBJECT_PORT_BASE``, ``CONTAINER_PORT_BASE``, ``ACCOUNT_PORT_BASE``
 # Port bases used in port number calculation for the service "nodes"
 # The specified port number will be used, the additional ports calculated by
@@ -462,6 +469,7 @@ EOF
     cp ${SWIFT_DIR}/etc/swift.conf-sample ${SWIFT_CONF_DIR}/swift.conf
     iniset ${SWIFT_CONF_DIR}/swift.conf swift-hash swift_hash_path_suffix ${SWIFT_HASH}
     iniset ${SWIFT_CONF_DIR}/swift.conf swift-constraints max_header_size ${SWIFT_MAX_HEADER_SIZE}
+    iniset ${SWIFT_CONF_DIR}/swift.conf swift-constraints max_file_size ${SWIFT_MAX_FILE_SIZE}
 
     local node_number
     for node_number in ${SWIFT_REPLICAS_SEQ}; do

From 32bf2c4f6f36dbe6e0b68143810b0f4e5b5ae3b8 Mon Sep 17 00:00:00 2001
From: Jamie Lennox <jamielennox@gmail.com>
Date: Tue, 8 Mar 2016 12:24:52 +1100
Subject: [PATCH 0295/2409] Use extended keystone-manage bootstrap parameters

Use the additional keystone-manage parameters to setup the identity
endpoint in the service catalog rather than manually fetching a token
for this.

Change-Id: I6f5be1df205dee8f3251b4eb413e00ae64f00f07
---
 lib/keystone | 44 ++++++++++----------------------------------
 1 file changed, 10 insertions(+), 34 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 5ed7de9966..0b9cebc8f4 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -629,40 +629,16 @@ function stop_keystone {
 # - ``KEYSTONE_SERVICE_HOST``
 # - ``KEYSTONE_SERVICE_PORT``
 function bootstrap_keystone {
-
-    # Initialize keystone, this will create an 'admin' user, 'admin' project,
-    # 'admin' role, and assign the user the role on the project. These resources
-    # are created only if they do not already exist.
-    $KEYSTONE_BIN_DIR/keystone-manage bootstrap --bootstrap-password $ADMIN_PASSWORD
-
-    # Create the keystone service and endpoints. To do this with the new
-    # bootstrapping process, we need to get a token and use that token to
-    # interact with the new APIs. The token will only be used to create services
-    # and endpoints, thus creating a minimal service catalog.
-    # They are unset immediately after.
-    # TODO(stevemar): OpenStackClient and KeystoneClient do not have support to
-    # handle interactions that not return service catalogs. Eventually remove
-    # this section when the support is in place. Use token based auth for now.
-    local token_id
-    token_id=$(openstack token issue -c id -f value \
-        --os-username admin --os-project-name admin \
-        --os-user-domain-id default --os-project-domain-id default \
-        --os-identity-api-version 3 --os-auth-url $KEYSTONE_AUTH_URI \
-        --os-password $ADMIN_PASSWORD)
-
-    export OS_TOKEN=$token_id
-    export OS_URL=$KEYSTONE_AUTH_URI/v3
-    export OS_IDENTITY_API_VERSION=3
-
-    get_or_create_service "keystone" "identity" "Keystone Identity Service"
-    get_or_create_endpoint \
-        "identity" \
-        "$REGION_NAME" \
-        "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v$IDENTITY_API_VERSION" \
-        "$KEYSTONE_AUTH_URI/v$IDENTITY_API_VERSION" \
-        "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v$IDENTITY_API_VERSION"
-
-    unset OS_TOKEN OS_URL OS_IDENTITY_API_VERSION
+    $KEYSTONE_BIN_DIR/keystone-manage bootstrap \
+        --bootstrap-username admin \
+        --bootstrap-password "$ADMIN_PASSWORD" \
+        --bootstrap-project-name admin \
+        --bootstrap-role-name admin \
+        --bootstrap-service-name keystone \
+        --bootstrap-region-id "$REGION_NAME" \
+        --bootstrap-admin-url "$KEYSTONE_AUTH_URI/v$IDENTITY_API_VERSION" \
+        --bootstrap-public-url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v$IDENTITY_API_VERSION" \
+        --bootstrap-internal-url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v$IDENTITY_API_VERSION"
 }
 
 # Restore xtrace

From f3b6feb712bf14b3e91c98e00ea021af47771231 Mon Sep 17 00:00:00 2001
From: Clint Adams <clint@gcfm.net>
Date: Mon, 7 Mar 2016 01:52:35 -0500
Subject: [PATCH 0296/2409] Don't abort devstack plugins proposal job due to
 absence of header/footer

Not having a header or footer should not be a fatal error
especially now that we have removed the footer entirely.

Change-Id: Ibbf3e513b8faa016dc2dac8d11ab4f499b3fc51c
---
 tools/generate-devstack-plugins-list.sh | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/tools/generate-devstack-plugins-list.sh b/tools/generate-devstack-plugins-list.sh
index 8a1f743b27..be3f60a136 100644
--- a/tools/generate-devstack-plugins-list.sh
+++ b/tools/generate-devstack-plugins-list.sh
@@ -41,7 +41,9 @@
 (
 declare -A plugins
 
-test -r data/devstack-plugins-registry.header && cat data/devstack-plugins-registry.header
+if [[ -r data/devstack-plugins-registry.header ]]; then
+    cat data/devstack-plugins-registry.header
+fi
 
 sorted_plugins=$(python tools/generate-devstack-plugins-list.py)
 
@@ -52,7 +54,9 @@ for k in ${sorted_plugins}; do
     printf "+----------------------------+-------------------------------------------------------------------------+\n"
 done
 
-test -r data/devstack-plugins-registry.footer && cat data/devstack-plugins-registry.footer
+if [[ -r data/devstack-plugins-registry.footer ]]; then
+    cat data/devstack-plugins-registry.footer
+fi
 ) > doc/source/plugin-registry.rst
 
 if [[ -n ${1} ]]; then

From 6fff3cc03589cb0fdf02b4bedf1c35bcb000f28d Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 8 Mar 2016 12:00:15 -0500
Subject: [PATCH 0297/2409] Fix sorting on LC_ALL=C platforms

We made assumptions on the platform for sorting purposes, which turned
out to break with new images being deployed. Explicitly setting LC_ALL
should make this work.

Change-Id: Id65f1bff8e38c777fa406d88ac6a2355d6033d94
---
 tests/test_package_ordering.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tests/test_package_ordering.sh b/tests/test_package_ordering.sh
index a568abf928..bfc2a1954f 100755
--- a/tests/test_package_ordering.sh
+++ b/tests/test_package_ordering.sh
@@ -7,6 +7,7 @@ TOP=$(cd $(dirname "$0")/.. && pwd)
 
 source $TOP/tests/unittest.sh
 
+export LC_ALL=en_US.UTF-8
 PKG_FILES=$(find $TOP/files/debs $TOP/files/rpms $TOP/files/rpms-suse -type f)
 
 TMPDIR=$(mktemp -d)

From 8ff298a8715d39d8ac260afba1593b6ecf95b0ce Mon Sep 17 00:00:00 2001
From: Ronald Bradford <ronald.bradford@gmail.com>
Date: Tue, 8 Mar 2016 15:19:48 +0000
Subject: [PATCH 0298/2409] Updated deprecated keystone_authtoken option

* memcache_servers is a deprecated name for memcached_servers.
  See: keystonemiddleware/auth_token/__init__.py#n287

NOTE: memcache_serves in the cache section is valid option for
    oslo.cache.  See oslo_cache/_opts.py#n65

Depends-on: Id65f1bff8e38c777fa406d88ac6a2355d6033d94
Change-Id: I3e1230b139e710a0433e71ce118ca246d7c6a0e6
---
 lib/keystone | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/keystone b/lib/keystone
index 5ed7de9966..47de2b7819 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -484,7 +484,7 @@ function configure_auth_token_middleware {
     iniset $conf_file $section auth_uri $KEYSTONE_SERVICE_URI
     iniset $conf_file $section cafile $SSL_BUNDLE_FILE
     iniset $conf_file $section signing_dir $signing_dir
-    iniset $conf_file $section memcache_servers $SERVICE_HOST:11211
+    iniset $conf_file $section memcached_servers $SERVICE_HOST:11211
 }
 
 # init_keystone() - Initialize databases, etc.

From d1ee4cfdf935bc62a7752592624991f0646c501a Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Tue, 8 Mar 2016 15:25:16 -0500
Subject: [PATCH 0299/2409] Remove check for OVS_VERSION < 1.4

1.4 was released in 2012. I think we can assume everyone is running
something newer.

http://openvswitch.org/releases/NEWS-1.4.0

Change-Id: I3cfe99d2647800ae3ffb32c9e6749d03224c2967
---
 lib/neutron_plugins/openvswitch_agent | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/lib/neutron_plugins/openvswitch_agent b/lib/neutron_plugins/openvswitch_agent
index 94a26898ad..e1c5a504a5 100644
--- a/lib/neutron_plugins/openvswitch_agent
+++ b/lib/neutron_plugins/openvswitch_agent
@@ -44,12 +44,6 @@ function neutron_plugin_configure_plugin_agent {
 
     # Setup agent for tunneling
     if [[ "$OVS_ENABLE_TUNNELING" == "True" ]]; then
-        # Verify tunnels are supported
-        # REVISIT - also check kernel module support for GRE and patch ports
-        OVS_VERSION=`ovs-vsctl --version | head -n 1 | grep -E -o "[0-9]+\.[0-9]+"`
-        if [ `vercmp_numbers "$OVS_VERSION" "1.4"` -lt "0" ] && ! is_service_enabled q-svc ; then
-            die $LINENO "You are running OVS version $OVS_VERSION. OVS 1.4+ is required for tunneling between multiple hosts."
-        fi
         iniset /$Q_PLUGIN_CONF_FILE ovs local_ip $TUNNEL_ENDPOINT_IP
         iniset /$Q_PLUGIN_CONF_FILE ovs tunnel_bridge $OVS_TUNNEL_BRIDGE
     fi

From f0e5d230437c643b868d78c04dbc8a02df83c1e8 Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Wed, 9 Mar 2016 13:02:25 -0500
Subject: [PATCH 0300/2409] Neutron guide: Add missing newline for code block

Change-Id: I4eb5ec05d9db525158d47c7b16bef04fb3965f1a
---
 doc/source/guides/neutron.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index c8b5c4495f..cac7bb0152 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -546,6 +546,7 @@ automatically created by setting the ``OVS_BRIDGE_MAPPINGS`` to a list of
 physical network to bridge name associations with the following syntax:
 
 ::
+
     OVS_BRIDGE_MAPPINGS=net1name:bridge1name,net2name:bridge2name,<...>
 
 Also, ``OVS_BRIDGE_MAPPINGS`` has precedence over ``PHYSICAL_NETWORK`` and

From 084efc7158f60530205e5ccad2947ec3948b7f26 Mon Sep 17 00:00:00 2001
From: Waldemar Znoinski <waldemar.znoinski@intel.com>
Date: Wed, 9 Mar 2016 12:18:51 +0000
Subject: [PATCH 0301/2409] run tgt-admin --delete only if input not empty

This change provides better handling of tgtadm --op show
output as input of tgt-admin --delete command. In situation
where no output of the first command is present no tgt-admin
command is run.

Change-Id: Ief5e1d50dd679f4d47cffef29ff07e54cc37f80a
Closes-bug: 1554997
---
 lib/lvm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/lvm b/lib/lvm
index ae6023a836..b9d7c390a2 100644
--- a/lib/lvm
+++ b/lib/lvm
@@ -124,7 +124,7 @@ function init_lvm_volume_group {
     if [ "$CINDER_ISCSI_HELPER" = "lioadm" ]; then
         sudo cinder-rtstool get-targets | sudo xargs -rn 1 cinder-rtstool delete
     else
-        sudo tgtadm --op show --mode target | grep Target | cut -f3 -d ' ' | sudo xargs -n1 tgt-admin --delete || true
+        sudo tgtadm --op show --mode target | awk '/Target/ {print $3}' | sudo xargs -r -n1 tgt-admin --delete
     fi
     _clean_lvm_volume_group $vg
 }

From 5c417a0133bde77e5dbe61072bd572415acf7fd8 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Thu, 10 Mar 2016 06:27:24 +0000
Subject: [PATCH 0302/2409] Updated from generate-devstack-plugins-list

Change-Id: I683b8208aedc71ce63012e470b2afbdef8856308
---
 doc/source/plugin-registry.rst | 28 ----------------------------
 1 file changed, 28 deletions(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 29b743ff2b..f31db5185c 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -192,31 +192,3 @@ projects.
 +----------------------------+-------------------------------------------------------------------------+
 |zaqar                       |git://git.openstack.org/openstack/zaqar                                  |
 +----------------------------+-------------------------------------------------------------------------+
-
-Drivers
-=======
-
-+--------------------+-------------------------------------------------+------------------+
-|Plugin Name         |URL                                              |Comments          |
-+--------------------+-------------------------------------------------+------------------+
-|dragonflow          |git://git.openstack.org/openstack/dragonflow     |[d1]_             |
-+--------------------+-------------------------------------------------+------------------+
-|odl                 |git://git.openstack.org/openstack/networking-odl |[d2]_             |
-+--------------------+-------------------------------------------------+------------------+
-
-.. [d1] demonstrates example of installing 3rd party SDN controller
-.. [d2] demonstrates a pretty advanced set of modes that that allow
-        one to run OpenDayLight either from a pre-existing install, or
-        also from source
-
-Alternate Configs
-=================
-
-+-------------+------------------------------------------------------------+------------+
-| Plugin Name | URL                                                        | Comments   |
-|             |                                                            |            |
-+-------------+------------------------------------------------------------+------------+
-|glusterfs    |git://git.openstack.org/openstack/devstack-plugin-glusterfs |            |
-+-------------+------------------------------------------------------------+------------+
-|             |                                                            |            |
-+-------------+------------------------------------------------------------+------------+

From 6b1f49910e1c55bd7a3fbc8d23ad97aa96225361 Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Thu, 10 Mar 2016 12:23:09 -0500
Subject: [PATCH 0303/2409] Tip for single interface runs that are started
 remotely

Change-Id: I6e2870b5c409dd81a34cd9934f540d9558642f91
---
 doc/source/guides/neutron.rst | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index c8b5c4495f..67cf017f4c 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -19,6 +19,18 @@ physical interface can be used to transmit tenant network traffic,
 the OpenStack API traffic, and management traffic.
 
 
+.. warning::
+
+    When using a single interface networking setup, there will be a
+    temporary network outage as your IP address is moved from the
+    physical NIC of your machine, to the OVS bridge. If you are SSH'd
+    into the machine from another computer, there is a risk of being
+    disconnected from your ssh session (due to arp cache
+    invalidation), which would stop the stack.sh or leave it in an
+    unfinished state. In these cases, start stack.sh inside its own
+    screen session so it can continue to run.
+
+
 Physical Network Setup
 ----------------------
 

From 9ba49cd82631ada84b8458b370ac535985d57725 Mon Sep 17 00:00:00 2001
From: Dean Troyer <dtroyer@gmail.com>
Date: Thu, 10 Mar 2016 15:45:40 -0600
Subject: [PATCH 0304/2409] Remove rejoin-stack.sh

This command has never completely worked to restart DevStack.
It periodically prompts attempts to work around this brokenness
in ways that harm other functions.  Let's finally remove it.

Requiring a complete re-run of DevStack after a reboot has always
been intentional.

TODO: follow-up cleaning all of the screen hackage if this merges.

Change-Id: I2f61bb69cc110468a91dcaa4ee7653ede7048467
---
 functions-common |  2 +-
 rejoin-stack.sh  | 25 -------------------------
 2 files changed, 1 insertion(+), 26 deletions(-)
 delete mode 100755 rejoin-stack.sh

diff --git a/functions-common b/functions-common
index 9e6fef22fb..ed1ff5ae12 100644
--- a/functions-common
+++ b/functions-common
@@ -1643,7 +1643,7 @@ function service_check {
     done
 
     if [ -n "$failures" ]; then
-        die $LINENO "More details about the above errors can be found with screen, with ./rejoin-stack.sh"
+        die $LINENO "More details about the above errors can be found with screen"
     fi
 }
 
diff --git a/rejoin-stack.sh b/rejoin-stack.sh
deleted file mode 100755
index 7048865fc9..0000000000
--- a/rejoin-stack.sh
+++ /dev/null
@@ -1,25 +0,0 @@
-#! /usr/bin/env bash
-
-# This script rejoins an existing screen, or re-creates a
-# screen session from a previous run of stack.sh.
-
-TOP_DIR=`dirname $0`
-
-# Import common functions in case the localrc (loaded via stackrc)
-# uses them.
-source $TOP_DIR/functions
-
-source $TOP_DIR/stackrc
-
-SCREENRC=$TOP_DIR/$SCREEN_NAME-screenrc
-# if screenrc exists, run screen
-if [[ -e $SCREENRC ]]; then
-    if screen -ls | egrep -q "[0-9]+.${SCREEN_NAME}"; then
-        echo "Attaching to already started screen session.."
-        exec screen -r $SCREEN_NAME
-    fi
-    exec screen -c $SCREENRC
-fi
-
-echo "Couldn't find $SCREENRC file; have you run stack.sh yet?"
-exit 1

From 84f6c0fa6838ffa06aafb17c460a3990c10f4443 Mon Sep 17 00:00:00 2001
From: Steve Martinelli <stevemar@ca.ibm.com>
Date: Fri, 11 Mar 2016 22:37:27 -0500
Subject: [PATCH 0305/2409] remove the keystone bash completion install step

keytone has removed it's CLI and will release a new version
when Newton begins. As part of the removal process we also
need to remove the bash completion script, which is currently
failing devstack gates.

Change-Id: I132b862bde5b4173bf34beae12a7a882f5a96314
---
 lib/keystone | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/keystone b/lib/keystone
index 5ed7de9966..840f2c9c72 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -523,7 +523,6 @@ function install_keystoneclient {
     if use_library_from_git "python-keystoneclient"; then
         git_clone_by_name "python-keystoneclient"
         setup_dev_lib "python-keystoneclient"
-        sudo install -D -m 0644 -o $STACK_USER {${GITDIR["python-keystoneclient"]}/tools/,/etc/bash_completion.d/}keystone.bash_completion
     fi
 }
 

From 1df1e18da28ffd33d294f485709a9388b6f0fa30 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Sat, 12 Mar 2016 06:24:11 +0000
Subject: [PATCH 0306/2409] Updated from generate-devstack-plugins-list

Change-Id: Ic4f4015eb9446c62b793897fced7b5721427f09a
---
 doc/source/plugin-registry.rst | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index f31db5185c..a52eba8bd6 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -32,6 +32,8 @@ projects.
 +----------------------------+-------------------------------------------------------------------------+
 |blazar                      |git://git.openstack.org/openstack/blazar                                 |
 +----------------------------+-------------------------------------------------------------------------+
+|broadview-collector         |git://git.openstack.org/openstack/broadview-collector                    |
++----------------------------+-------------------------------------------------------------------------+
 |ceilometer                  |git://git.openstack.org/openstack/ceilometer                             |
 +----------------------------+-------------------------------------------------------------------------+
 |ceilometer-powervm          |git://git.openstack.org/openstack/ceilometer-powervm                     |

From 0d38e2d5d87e98552692f4c177df3a216bfac9dd Mon Sep 17 00:00:00 2001
From: Brant Knudson <bknudson@us.ibm.com>
Date: Mon, 14 Mar 2016 13:57:01 -0500
Subject: [PATCH 0307/2409] Cleanup duplication in keystone uwsgi options

There was a lot of duplication in the uwsgi options between the
admin and public config files. The options common to both are
moved into their own section.

Change-Id: I5519c7d4d8b8446a7a5fdb8033852655d8a2c67b
---
 lib/keystone | 30 ++++++++++++------------------
 1 file changed, 12 insertions(+), 18 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 840f2c9c72..12bcee8eee 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -303,28 +303,22 @@ function configure_keystone {
         fi
 
         iniset "$KEYSTONE_PUBLIC_UWSGI_FILE" uwsgi wsgi-file "$KEYSTONE_BIN_DIR/keystone-wsgi-public"
-        # This is running standalone
         iniset "$KEYSTONE_PUBLIC_UWSGI_FILE" uwsgi threads $(nproc)
-        iniset "$KEYSTONE_PUBLIC_UWSGI_FILE" uwsgi enable-threads true
-        iniset "$KEYSTONE_PUBLIC_UWSGI_FILE" uwsgi plugins python
-        # uwsgi recommends this to prevent thundering herd on accept.
-        iniset "$KEYSTONE_PUBLIC_UWSGI_FILE" uwsgi thunder-lock true
-        # Override the default size for headers from the 4k default.
-        iniset "$KEYSTONE_PUBLIC_UWSGI_FILE" uwsgi buffer-size 65535
-        # Make sure the client doesn't try to re-use the connection.
-        iniset "$KEYSTONE_PUBLIC_UWSGI_FILE" uwsgi add-header "Connection: close"
 
         iniset "$KEYSTONE_ADMIN_UWSGI_FILE" uwsgi wsgi-file "$KEYSTONE_BIN_DIR/keystone-wsgi-admin"
-        # This is running standalone
         iniset "$KEYSTONE_ADMIN_UWSGI_FILE" uwsgi threads $API_WORKERS
-        iniset "$KEYSTONE_ADMIN_UWSGI_FILE" uwsgi enable-threads true
-        iniset "$KEYSTONE_ADMIN_UWSGI_FILE" uwsgi plugins python
-        # uwsgi recommends this to prevent thundering herd on accept.
-        iniset "$KEYSTONE_ADMIN_UWSGI_FILE" uwsgi thunder-lock true
-        # Override the default size for headers from the 4k default.
-        iniset "$KEYSTONE_ADMIN_UWSGI_FILE" uwsgi buffer-size 65535
-        # Make sure the client doesn't try to re-use the connection.
-        iniset "$KEYSTONE_ADMIN_UWSGI_FILE" uwsgi add-header "Connection: close"
+
+        # Common settings
+        for file in "$KEYSTONE_PUBLIC_UWSGI_FILE" "$KEYSTONE_ADMIN_UWSGI_FILE"; do
+            iniset "$file" uwsgi enable-threads true
+            iniset "$file" uwsgi plugins python
+            # uwsgi recommends this to prevent thundering herd on accept.
+            iniset "$file" uwsgi thunder-lock true
+            # Override the default size for headers from the 4k default.
+            iniset "$file" uwsgi buffer-size 65535
+            # Make sure the client doesn't try to re-use the connection.
+            iniset "$file" uwsgi add-header "Connection: close"
+        done
 
     else # eventlet
         if is_ssl_enabled_service key; then

From 4abcfaa86e7bb8827bc1b8b0e48352a0b748446f Mon Sep 17 00:00:00 2001
From: Brant Knudson <bknudson@us.ibm.com>
Date: Fri, 11 Mar 2016 08:30:05 -0600
Subject: [PATCH 0308/2409] uwsgi keystone under master process

Normally a standalone uwsgi server would run in "master" mode -- it
handles signals to reload the processes. I tried this originally
with keystone but found that the server didn't shut down when
unstacking. The reason it didn't shut down is because (by default)
uwsgi does a reload on SIGTERM & SIGHUP rather than shutting down by
default, see [1].

Setting "die-on-term = true" & "exit-on-reload = true" changes the
uwsgi server to shut down when unstacking.

[1] http://uwsgi-docs.readthedocs.org/en/latest/Management.html#reloading-the-server

Change-Id: I145fef185d4a31078295941779e175b7452a5760
---
 lib/keystone | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/lib/keystone b/lib/keystone
index 12bcee8eee..7743a64201 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -310,6 +310,11 @@ function configure_keystone {
 
         # Common settings
         for file in "$KEYSTONE_PUBLIC_UWSGI_FILE" "$KEYSTONE_ADMIN_UWSGI_FILE"; do
+            # This is running standalone
+            iniset "$file" uwsgi master true
+            # Set die-on-term & exit-on-reload so that uwsgi shuts down
+            iniset "$file" uwsgi die-on-term true
+            iniset "$file" uwsgi exit-on-reload true
             iniset "$file" uwsgi enable-threads true
             iniset "$file" uwsgi plugins python
             # uwsgi recommends this to prevent thundering herd on accept.

From 9f5e7ba1004dcc4b9f1f0cbe94f61d0120baff0c Mon Sep 17 00:00:00 2001
From: Brant Knudson <bknudson@us.ibm.com>
Date: Mon, 14 Mar 2016 14:54:18 -0500
Subject: [PATCH 0309/2409] Update gitignore for docs

These files are created when generating docs and should not be
checked in.

Change-Id: I1dc4ca05ab522237328f79f3a855750b8202f5da
---
 .gitignore | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.gitignore b/.gitignore
index a5a17c2b75..c72b0c4ccd 100644
--- a/.gitignore
+++ b/.gitignore
@@ -28,3 +28,5 @@ shocco
 src
 stack-screenrc
 userrc_early
+AUTHORS
+ChangeLog

From 3bf69e835a043e7deecbbe3568426042961116a3 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 15 Mar 2016 12:21:34 +1100
Subject: [PATCH 0310/2409] Remove EC2 API from devstack

This all started with an investigation into Fedora's use of ecua2ools
package.  This package is a bit of a nightmare because it pulls in a
lot of other system-python packages.

For Ubuntu, this package was removed in
I47b7e787771683c2fc4404e586f11c1a19aac15c.  However, it is not
actually a "pure python" package as described in that change, in that
it is not installable from pypi.  I can't see how you could actually
run exercises/euca.sh on Ubuntu unless you installed euca2ools by hand
-- ergo I suggest it is totally unused, because nobody seems to have
reported problems.

In the mean time, ec2 api has moved to a plugin [1] anyway where the
recommendation in their README is to use the aws cli from amazon.

Thus remove all the parts related to EC2 and ecua2ools from base
devstack.

[1] https://git.openstack.org/cgit/openstack/ec2-api

Change-Id: I8a07320b59ea6cd7d1fe8bce61af84b5a28fb39e
---
 README.md                |   7 --
 doc/source/eucarc.rst    |  45 ---------
 doc/source/index.rst     |   1 -
 eucarc                   |  40 --------
 exercise.sh              |   4 +-
 exerciserc               |   6 --
 exercises/bundle.sh      |  74 ---------------
 exercises/client-args.sh |   1 -
 exercises/client-env.sh  |  13 ---
 exercises/euca.sh        | 192 ---------------------------------------
 files/rpms-suse/general  |   1 -
 files/rpms/general       |   1 -
 lib/heat                 |   3 -
 lib/nova                 |   8 --
 stack.sh                 |   8 --
 tools/create_userrc.sh   |  64 +------------
 16 files changed, 3 insertions(+), 465 deletions(-)
 delete mode 100644 doc/source/eucarc.rst
 delete mode 100644 eucarc
 delete mode 100755 exercises/bundle.sh
 delete mode 100755 exercises/euca.sh

diff --git a/README.md b/README.md
index dd394c2e07..4ba4619c6d 100644
--- a/README.md
+++ b/README.md
@@ -61,13 +61,6 @@ cloud via CLI:
     # list instances
     nova list
 
-If the EC2 API is your cup-o-tea, you can create credentials and use euca2ools:
-
-    # source eucarc to generate EC2 credentials and set up the environment
-    . eucarc
-    # list instances using ec2 api
-    euca-describe-instances
-
 # DevStack Execution Environment
 
 DevStack runs rampant over the system it runs on, installing things and
diff --git a/doc/source/eucarc.rst b/doc/source/eucarc.rst
deleted file mode 100644
index c2ecbc6732..0000000000
--- a/doc/source/eucarc.rst
+++ /dev/null
@@ -1,45 +0,0 @@
-=====================
-eucarc - EC2 Settings
-=====================
-
-``eucarc`` creates EC2 credentials for the current user as defined by
-``OS_TENANT_NAME:OS_USERNAME``. ``eucarc`` sources ``openrc`` at the
-beginning (which in turn sources ``stackrc`` and ``localrc``) in order
-to set credentials to create EC2 credentials in Keystone.
-
-EC2\_URL
-    Set the EC2 url for euca2ools. The endpoint is extracted from the
-    service catalog for ``OS_TENANT_NAME:OS_USERNAME``.
-
-    ::
-
-        EC2_URL=$(openstack catalog show ec2 | awk '/ publicURL: / { print $4 }')
-
-S3\_URL
-    Set the S3 endpoint for euca2ools. The endpoint is extracted from
-    the service catalog for ``OS_TENANT_NAME:OS_USERNAME``.
-
-    ::
-
-        export S3_URL=$(openstack catalog show s3 | awk '/ publicURL: / { print $4 }')
-
-EC2\_ACCESS\_KEY, EC2\_SECRET\_KEY
-    Create EC2 credentials for the current tenant:user in Keystone.
-
-    ::
-
-        CREDS=$(openstack ec2 credentials create)
-        export EC2_ACCESS_KEY=$(echo "$CREDS" | awk '/ access / { print $4 }')
-        export EC2_SECRET_KEY=$(echo "$CREDS" | awk '/ secret / { print $4 }')
-
-Certificates for Bundling
-    Euca2ools requires certificate files to enable bundle uploading. The
-    exercise script ``exercises/bundle.sh`` demonstrated retrieving
-    certificates using the Nova CLI.
-
-    ::
-
-        EC2_PRIVATE_KEY=pk.pem
-        EC2_CERT=cert.pem
-        NOVA_CERT=cacert.pem
-        EUCALYPTUS_CERT=${NOVA_CERT}
diff --git a/doc/source/index.rst b/doc/source/index.rst
index 3e324adefc..c79b2ce0c7 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -217,7 +217,6 @@ Configuration
    stackrc
    openrc
    exerciserc
-   eucarc
 
 Tools
 -----
diff --git a/eucarc b/eucarc
deleted file mode 100644
index 1e672bd932..0000000000
--- a/eucarc
+++ /dev/null
@@ -1,40 +0,0 @@
-#!/usr/bin/env bash
-#
-# source eucarc [username] [tenantname]
-#
-# Create EC2 credentials for the current user as defined by OS_TENANT_NAME:OS_USERNAME
-# Optionally set the tenant/username via openrc
-
-if [[ -n "$1" ]]; then
-    USERNAME=$1
-fi
-if [[ -n "$2" ]]; then
-    TENANT=$2
-fi
-
-# Find the other rc files
-RC_DIR=$(cd $(dirname "${BASH_SOURCE:-$0}") && pwd)
-
-# Get user configuration
-source $RC_DIR/openrc
-
-# Set the ec2 url so euca2ools works
-export EC2_URL=$(openstack catalog show ec2 | awk '/ publicURL: / { print $4 }')
-
-# Create EC2 credentials for the current user
-CREDS=$(openstack ec2 credentials create)
-export EC2_ACCESS_KEY=$(echo "$CREDS" | awk '/ access / { print $4 }')
-export EC2_SECRET_KEY=$(echo "$CREDS" | awk '/ secret / { print $4 }')
-
-# Euca2ools Certificate stuff for uploading bundles
-# See exercises/bundle.sh to see how to get certs using nova cli
-NOVA_KEY_DIR=${NOVA_KEY_DIR:-$RC_DIR}
-export S3_URL=$(openstack catalog show s3 | awk '/ publicURL: / { print $4 }')
-export EC2_USER_ID=42 # nova does not use user id, but bundling requires it
-export EC2_PRIVATE_KEY=${NOVA_KEY_DIR}/pk.pem
-export EC2_CERT=${NOVA_KEY_DIR}/cert.pem
-export NOVA_CERT=${NOVA_KEY_DIR}/cacert.pem
-export EUCALYPTUS_CERT=${NOVA_CERT} # euca-bundle-image seems to require this set
-alias ec2-bundle-image="ec2-bundle-image --cert ${EC2_CERT} --privatekey ${EC2_PRIVATE_KEY} --user ${EC2_USER_ID} --ec2cert ${NOVA_CERT}"
-alias ec2-upload-bundle="ec2-upload-bundle -a ${EC2_ACCESS_KEY} -s ${EC2_SECRET_KEY} --url ${S3_URL} --ec2cert ${NOVA_CERT}"
-
diff --git a/exercise.sh b/exercise.sh
index 19c9d80451..90670333a1 100755
--- a/exercise.sh
+++ b/exercise.sh
@@ -14,11 +14,11 @@ source $TOP_DIR/stackrc
 # Run everything in the exercises/ directory that isn't explicitly disabled
 
 # comma separated list of script basenames to skip
-# to refrain from exercising euca.sh use ``SKIP_EXERCISES=euca``
+# to refrain from exercising foo.sh use ``SKIP_EXERCISES=foo``
 SKIP_EXERCISES=${SKIP_EXERCISES:-""}
 
 # comma separated list of script basenames to run
-# to run only euca.sh use ``RUN_EXERCISES=euca``
+# to run only foo.sh use ``RUN_EXERCISES=foo``
 basenames=${RUN_EXERCISES:-""}
 
 EXERCISE_DIR=$TOP_DIR/exercises
diff --git a/exerciserc b/exerciserc
index 9105fe3331..978e0b3791 100644
--- a/exerciserc
+++ b/exerciserc
@@ -21,12 +21,6 @@ export RUNNING_TIMEOUT=${RUNNING_TIMEOUT:-$(($BOOT_TIMEOUT + $ACTIVE_TIMEOUT))}
 # Max time to wait for a vm to terminate
 export TERMINATE_TIMEOUT=${TERMINATE_TIMEOUT:-30}
 
-# Max time to wait for a euca-volume command to propagate
-export VOLUME_TIMEOUT=${VOLUME_TIMEOUT:-30}
-
-# Max time to wait for a euca-delete command to propagate
-export VOLUME_DELETE_TIMEOUT=${SNAPSHOT_DELETE_TIMEOUT:-60}
-
 # The size of the volume we want to boot from; some storage back-ends
 # do not allow a disk resize, so it's important that this can be tuned
 export DEFAULT_VOLUME_SIZE=${DEFAULT_VOLUME_SIZE:-1}
diff --git a/exercises/bundle.sh b/exercises/bundle.sh
deleted file mode 100755
index 5470960b91..0000000000
--- a/exercises/bundle.sh
+++ /dev/null
@@ -1,74 +0,0 @@
-#!/usr/bin/env bash
-
-# **bundle.sh**
-
-# we will use the ``euca2ools`` cli tool that wraps the python boto
-# library to test ec2 bundle upload compatibility
-
-echo "*********************************************************************"
-echo "Begin DevStack Exercise: $0"
-echo "*********************************************************************"
-
-# This script exits on an error so that errors don't compound and you see
-# only the first error that occurred.
-set -o errexit
-
-# Print the commands being run so that we can see the command that triggers
-# an error.  It is also useful for following allowing as the install occurs.
-set -o xtrace
-
-
-# Settings
-# ========
-
-# Keep track of the current directory
-EXERCISE_DIR=$(cd $(dirname "$0") && pwd)
-TOP_DIR=$(cd $EXERCISE_DIR/..; pwd)
-
-# Import common functions
-source $TOP_DIR/functions
-
-# Import EC2 configuration
-source $TOP_DIR/eucarc
-
-# Import exercise configuration
-source $TOP_DIR/exerciserc
-
-# Remove old certificates
-rm -f $TOP_DIR/cacert.pem
-rm -f $TOP_DIR/cert.pem
-rm -f $TOP_DIR/pk.pem
-
-# If nova api is not enabled we exit with exitcode 55 so that
-# the exercise is skipped
-is_service_enabled n-api || exit 55
-
-# Get Certificates
-nova x509-get-root-cert $TOP_DIR/cacert.pem
-nova x509-create-cert $TOP_DIR/pk.pem $TOP_DIR/cert.pem
-
-# Max time to wait for image to be registered
-REGISTER_TIMEOUT=${REGISTER_TIMEOUT:-15}
-
-BUCKET=testbucket
-IMAGE=bundle.img
-truncate -s 5M /tmp/$IMAGE
-euca-bundle-image -i /tmp/$IMAGE || die $LINENO "Failure bundling image $IMAGE"
-
-euca-upload-bundle --debug -b $BUCKET -m /tmp/$IMAGE.manifest.xml || die $LINENO "Failure uploading bundle $IMAGE to $BUCKET"
-
-AMI=`euca-register $BUCKET/$IMAGE.manifest.xml | cut -f2`
-die_if_not_set $LINENO AMI "Failure registering $BUCKET/$IMAGE"
-
-# Wait for the image to become available
-if ! timeout $REGISTER_TIMEOUT sh -c "while euca-describe-images | grep $AMI | grep -q available; do sleep 1; done"; then
-    die $LINENO "Image $AMI not available within $REGISTER_TIMEOUT seconds"
-fi
-
-# Clean up
-euca-deregister $AMI || die $LINENO "Failure deregistering $AMI"
-
-set +o xtrace
-echo "*********************************************************************"
-echo "SUCCESS: End DevStack Exercise: $0"
-echo "*********************************************************************"
diff --git a/exercises/client-args.sh b/exercises/client-args.sh
index 07ce5284e8..2c8fe81390 100755
--- a/exercises/client-args.sh
+++ b/exercises/client-args.sh
@@ -83,7 +83,6 @@ fi
 if [[ "$ENABLED_SERVICES" =~ "n-api" ]]; then
     if [[ "$SKIP_EXERCISES" =~ "n-api" ]]; then
         STATUS_NOVA="Skipped"
-        STATUS_EC2="Skipped"
     else
         # Test OSAPI
         echo -e "\nTest Nova"
diff --git a/exercises/client-env.sh b/exercises/client-env.sh
index 1d2f4f5689..6ab4d08715 100755
--- a/exercises/client-env.sh
+++ b/exercises/client-env.sh
@@ -78,7 +78,6 @@ fi
 if [[ "$ENABLED_SERVICES" =~ "n-api" ]]; then
     if [[ "$SKIP_EXERCISES" =~ "n-api" ]]; then
         STATUS_NOVA="Skipped"
-        STATUS_EC2="Skipped"
     else
         # Test OSAPI
         echo -e "\nTest Nova"
@@ -89,17 +88,6 @@ if [[ "$ENABLED_SERVICES" =~ "n-api" ]]; then
             RETURN=1
         fi
 
-        # Test EC2 API
-        echo -e "\nTest EC2"
-        # Get EC2 creds
-        source $TOP_DIR/eucarc
-
-        if euca-describe-images; then
-            STATUS_EC2="Succeeded"
-        else
-            STATUS_EC2="Failed"
-            RETURN=1
-        fi
     fi
 fi
 
@@ -170,7 +158,6 @@ function report {
 echo -e "\n"
 report "Keystone" $STATUS_KEYSTONE
 report "Nova" $STATUS_NOVA
-report "EC2" $STATUS_EC2
 report "Cinder" $STATUS_CINDER
 report "Glance" $STATUS_GLANCE
 report "Swift" $STATUS_SWIFT
diff --git a/exercises/euca.sh b/exercises/euca.sh
deleted file mode 100755
index 60e7d8ca29..0000000000
--- a/exercises/euca.sh
+++ /dev/null
@@ -1,192 +0,0 @@
-#!/usr/bin/env bash
-
-# **euca.sh**
-
-# we will use the ``euca2ools`` cli tool that wraps the python boto
-# library to test ec2 compatibility
-
-echo "*********************************************************************"
-echo "Begin DevStack Exercise: $0"
-echo "*********************************************************************"
-
-# This script exits on an error so that errors don't compound and you see
-# only the first error that occurred.
-set -o errexit
-
-# Print the commands being run so that we can see the command that triggers
-# an error.  It is also useful for following allowing as the install occurs.
-set -o xtrace
-
-# Settings
-# ========
-
-# Keep track of the current directory
-EXERCISE_DIR=$(cd $(dirname "$0") && pwd)
-TOP_DIR=$(cd $EXERCISE_DIR/..; pwd)
-VOLUME_SIZE=1
-ATTACH_DEVICE=/dev/vdc
-
-# Import common functions
-source $TOP_DIR/functions
-
-# Import EC2 configuration
-source $TOP_DIR/eucarc
-
-# Import exercise configuration
-source $TOP_DIR/exerciserc
-
-# Import project functions
-source $TOP_DIR/lib/neutron-legacy
-
-# If nova api is not enabled we exit with exitcode 55 so that
-# the exercise is skipped
-is_service_enabled n-api || exit 55
-
-# Instance type to create
-DEFAULT_INSTANCE_TYPE=${DEFAULT_INSTANCE_TYPE:-m1.tiny}
-
-# Boot this image, use first AMI image if unset
-DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-ami}
-
-# Security group name
-SECGROUP=${SECGROUP:-euca_secgroup}
-
-
-# Launching a server
-# ==================
-
-# Find a machine image to boot
-IMAGE=`euca-describe-images | grep machine | grep ${DEFAULT_IMAGE_NAME} | cut -f2 | head -n1`
-die_if_not_set $LINENO IMAGE "Failure getting image $DEFAULT_IMAGE_NAME"
-
-if is_service_enabled n-cell; then
-    # Cells does not support security groups, so force the use of "default"
-    SECGROUP="default"
-    echo "Using the default security group because of Cells."
-else
-    # Add a secgroup
-    if ! euca-describe-groups | grep -q $SECGROUP; then
-        euca-add-group -d "$SECGROUP description" $SECGROUP
-        if ! timeout $ASSOCIATE_TIMEOUT sh -c "while ! euca-describe-groups | grep -q $SECGROUP; do sleep 1; done"; then
-            die $LINENO "Security group not created"
-        fi
-    fi
-fi
-
-# Launch it
-INSTANCE=`euca-run-instances -g $SECGROUP -t $DEFAULT_INSTANCE_TYPE $IMAGE | grep INSTANCE | cut -f2`
-die_if_not_set $LINENO INSTANCE "Failure launching instance"
-
-# Assure it has booted within a reasonable time
-if ! timeout $RUNNING_TIMEOUT sh -c "while ! euca-describe-instances $INSTANCE | grep -q running; do sleep 1; done"; then
-    die $LINENO "server didn't become active within $RUNNING_TIMEOUT seconds"
-fi
-
-# Volumes
-# -------
-if is_service_enabled c-vol && ! is_service_enabled n-cell && [ "$VIRT_DRIVER" != "ironic" ]; then
-    VOLUME_ZONE=`euca-describe-availability-zones | head -n1 | cut -f2`
-    die_if_not_set $LINENO VOLUME_ZONE "Failure to find zone for volume"
-
-    VOLUME=`euca-create-volume -s 1 -z $VOLUME_ZONE` || die $LINENO "Failure to create volume"
-    VOLUME=`echo "$VOLUME" | cut -f2`
-    die_if_not_set $LINENO VOLUME "Failure to create volume"
-
-    # Test that volume has been created
-    VOLUME=`euca-describe-volumes $VOLUME | cut -f2`
-    die_if_not_set $LINENO VOLUME "Failure to get volume"
-
-    # Test volume has become available
-    if ! timeout $RUNNING_TIMEOUT sh -c "while ! euca-describe-volumes $VOLUME | grep -q available; do sleep 1; done"; then
-        die $LINENO "volume didn't become available within $RUNNING_TIMEOUT seconds"
-    fi
-
-    # Attach volume to an instance
-    euca-attach-volume -i $INSTANCE -d $ATTACH_DEVICE $VOLUME || \
-        die $LINENO "Failure attaching volume $VOLUME to $INSTANCE"
-    if ! timeout $ACTIVE_TIMEOUT sh -c "while ! euca-describe-volumes $VOLUME | grep -A 1 in-use | grep -q attach; do sleep 1; done"; then
-        die $LINENO "Could not attach $VOLUME to $INSTANCE"
-    fi
-
-    # Detach volume from an instance
-    euca-detach-volume $VOLUME || \
-        die $LINENO "Failure detaching volume $VOLUME to $INSTANCE"
-    if ! timeout $ACTIVE_TIMEOUT sh -c "while ! euca-describe-volumes $VOLUME | grep -q available; do sleep 1; done"; then
-        die $LINENO "Could not detach $VOLUME to $INSTANCE"
-    fi
-
-    # Remove volume
-    euca-delete-volume $VOLUME || \
-        die $LINENO "Failure to delete volume"
-    if ! timeout $ACTIVE_TIMEOUT sh -c "while euca-describe-volumes | grep $VOLUME; do sleep 1; done"; then
-        die $LINENO "Could not delete $VOLUME"
-    fi
-else
-    echo "Volume Tests Skipped"
-fi
-
-if is_service_enabled n-cell; then
-    echo "Floating IP Tests Skipped because of Cells."
-else
-    # Allocate floating address
-    FLOATING_IP=`euca-allocate-address | cut -f2`
-    die_if_not_set $LINENO FLOATING_IP "Failure allocating floating IP"
-    # describe all instances at this moment
-    euca-describe-instances
-    # Associate floating address
-    euca-associate-address -i $INSTANCE $FLOATING_IP || \
-        die $LINENO "Failure associating address $FLOATING_IP to $INSTANCE"
-
-    # Authorize pinging
-    euca-authorize -P icmp -s 0.0.0.0/0 -t -1:-1 $SECGROUP || \
-        die $LINENO "Failure authorizing rule in $SECGROUP"
-
-    # Test we can ping our floating ip within ASSOCIATE_TIMEOUT seconds
-    ping_check $FLOATING_IP $ASSOCIATE_TIMEOUT "$PUBLIC_NETWORK_NAME"
-
-    # Revoke pinging
-    euca-revoke -P icmp -s 0.0.0.0/0 -t -1:-1 $SECGROUP || \
-        die $LINENO "Failure revoking rule in $SECGROUP"
-
-    # Release floating address
-    euca-disassociate-address $FLOATING_IP || \
-        die $LINENO "Failure disassociating address $FLOATING_IP"
-
-    # Wait just a tick for everything above to complete so release doesn't fail
-    if ! timeout $ASSOCIATE_TIMEOUT sh -c "while euca-describe-addresses | grep $INSTANCE | grep -q $FLOATING_IP; do sleep 1; done"; then
-        die $LINENO "Floating ip $FLOATING_IP not disassociated within $ASSOCIATE_TIMEOUT seconds"
-    fi
-
-    # Release floating address
-    euca-release-address $FLOATING_IP || \
-        die $LINENO "Failure releasing address $FLOATING_IP"
-
-    # Wait just a tick for everything above to complete so terminate doesn't fail
-    if ! timeout $ASSOCIATE_TIMEOUT sh -c "while euca-describe-addresses | grep -q $FLOATING_IP; do sleep 1; done"; then
-        die $LINENO "Floating ip $FLOATING_IP not released within $ASSOCIATE_TIMEOUT seconds"
-    fi
-fi
-
-# Terminate instance
-euca-terminate-instances $INSTANCE || \
-    die $LINENO "Failure terminating instance $INSTANCE"
-
-# Assure it has terminated within a reasonable time. The behaviour of this
-# case changed with bug/836978. Requesting the status of an invalid instance
-# will now return an error message including the instance id, so we need to
-# filter that out.
-if ! timeout $TERMINATE_TIMEOUT sh -c "while euca-describe-instances $INSTANCE | grep -ve '\(InstanceNotFound\|InvalidInstanceID\.NotFound\)' | grep -q $INSTANCE; do sleep 1; done"; then
-    die $LINENO "server didn't terminate within $TERMINATE_TIMEOUT seconds"
-fi
-
-if [[ "$SECGROUP" = "default" ]] ; then
-    echo "Skipping deleting default security group"
-else
-    # Delete secgroup
-    euca-delete-group $SECGROUP || die $LINENO "Failure deleting security group $SECGROUP"
-fi
-
-set +o xtrace
-echo "*********************************************************************"
-echo "SUCCESS: End DevStack Exercise: $0"
-echo "*********************************************************************"
diff --git a/files/rpms-suse/general b/files/rpms-suse/general
index 34a29554f7..e3dfec1047 100644
--- a/files/rpms-suse/general
+++ b/files/rpms-suse/general
@@ -2,7 +2,6 @@ bc
 bridge-utils
 ca-certificates-mozilla
 curl
-euca2ools
 gcc
 gcc-c++
 git-core
diff --git a/files/rpms/general b/files/rpms/general
index a0906e2587..6d5fd1565c 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -2,7 +2,6 @@ bc
 bridge-utils
 curl
 dbus
-euca2ools # only for testing client
 gcc
 gcc-c++
 gettext  # used for compiling message catalogs
diff --git a/lib/heat b/lib/heat
index 41318787b3..2cf7a19d40 100644
--- a/lib/heat
+++ b/lib/heat
@@ -166,9 +166,6 @@ function configure_heat {
     # clients_keystone
     iniset $HEAT_CONF clients_keystone auth_uri $KEYSTONE_AUTH_URI
 
-    # ec2authtoken
-    iniset $HEAT_CONF ec2authtoken auth_uri $KEYSTONE_SERVICE_URI/v2.0
-
     # OpenStack API
     iniset $HEAT_CONF heat_api bind_port $HEAT_API_PORT
     iniset $HEAT_CONF heat_api workers "$API_WORKERS"
diff --git a/lib/nova b/lib/nova
index fd458c5701..3a5a47fa27 100644
--- a/lib/nova
+++ b/lib/nova
@@ -74,9 +74,6 @@ NOVA_USE_MOD_WSGI=${NOVA_USE_MOD_WSGI:-False}
 
 if is_ssl_enabled_service "nova" || is_service_enabled tls-proxy; then
     NOVA_SERVICE_PROTOCOL="https"
-    EC2_SERVICE_PROTOCOL="https"
-else
-    EC2_SERVICE_PROTOCOL="http"
 fi
 
 # Public facing bits
@@ -86,8 +83,6 @@ NOVA_SERVICE_PORT_INT=${NOVA_SERVICE_PORT_INT:-18774}
 NOVA_SERVICE_PROTOCOL=${NOVA_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 NOVA_SERVICE_LOCAL_HOST=${NOVA_SERVICE_LOCAL_HOST:-$SERVICE_LOCAL_HOST}
 NOVA_SERVICE_LISTEN_ADDRESS=${NOVA_SERVICE_LISTEN_ADDRESS:-$SERVICE_LISTEN_ADDRESS}
-EC2_SERVICE_PORT=${EC2_SERVICE_PORT:-8773}
-EC2_SERVICE_PORT_INT=${EC2_SERVICE_PORT_INT:-18773}
 METADATA_SERVICE_PORT=${METADATA_SERVICE_PORT:-8775}
 
 # Option to enable/disable config drive
@@ -140,7 +135,6 @@ NETWORK_MANAGER=${NETWORK_MANAGER:-${NET_MAN:-FlatDHCPManager}}
 PUBLIC_INTERFACE=${PUBLIC_INTERFACE:-$PUBLIC_INTERFACE_DEFAULT}
 VLAN_INTERFACE=${VLAN_INTERFACE:-$GUEST_INTERFACE_DEFAULT}
 FLAT_NETWORK_BRIDGE=${FLAT_NETWORK_BRIDGE:-$FLAT_NETWORK_BRIDGE_DEFAULT}
-EC2_DMZ_HOST=${EC2_DMZ_HOST:-$SERVICE_HOST}
 
 # If you are using the FlatDHCP network mode on multiple hosts, set the
 # ``FLAT_INTERFACE`` variable but make sure that the interface doesn't already
@@ -594,7 +588,6 @@ function create_nova_conf {
         iniset $NOVA_CONF spice enabled false
     fi
 
-    iniset $NOVA_CONF DEFAULT ec2_dmz_host "$EC2_DMZ_HOST"
     iniset_rpc_backend nova $NOVA_CONF
     iniset $NOVA_CONF glance api_servers "${GLANCE_SERVICE_PROTOCOL}://${GLANCE_HOSTPORT}"
 
@@ -810,7 +803,6 @@ function start_nova_api {
     # Start proxies if enabled
     if is_service_enabled tls-proxy; then
         start_tls_proxy '*' $NOVA_SERVICE_PORT $NOVA_SERVICE_HOST $NOVA_SERVICE_PORT_INT &
-        start_tls_proxy '*' $EC2_SERVICE_PORT $NOVA_SERVICE_HOST $EC2_SERVICE_PORT_INT &
     fi
 
     export PATH=$old_path
diff --git a/stack.sh b/stack.sh
index 0be3585020..5c16f042d8 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1208,14 +1208,6 @@ if is_service_enabled g-reg; then
     done
 fi
 
-# Create an access key and secret key for Nova EC2 register image
-if is_service_enabled keystone && is_service_enabled swift3 && is_service_enabled nova; then
-    eval $(openstack ec2 credentials create --user nova --project $SERVICE_PROJECT_NAME -f shell -c access -c secret)
-    iniset $NOVA_CONF DEFAULT s3_access_key "$access"
-    iniset $NOVA_CONF DEFAULT s3_secret_key "$secret"
-    iniset $NOVA_CONF DEFAULT s3_affix_tenant "True"
-fi
-
 # Create a randomized default value for the keymgr's fixed_key
 if is_service_enabled nova; then
     iniset $NOVA_CONF keymgr fixed_key $(generate_hex_string 32)
diff --git a/tools/create_userrc.sh b/tools/create_userrc.sh
index 74d5428382..3325c5e586 100755
--- a/tools/create_userrc.sh
+++ b/tools/create_userrc.sh
@@ -156,30 +156,6 @@ if [ -z "$MODE" ]; then
     exit 3
 fi
 
-EC2_URL=$(openstack endpoint list --service ec2 --interface public --os-identity-api-version=3 -c URL -f value || true)
-if [[ -z $EC2_URL ]]; then
-    EC2_URL=http://localhost:8773/
-fi
-
-S3_URL=$(openstack endpoint list --service s3 --interface public --os-identity-api-version=3 -c URL -f value || true)
-if [[ -z $S3_URL ]]; then
-    S3_URL=http://localhost:3333
-fi
-
-mkdir -p "$ACCOUNT_DIR"
-ACCOUNT_DIR=`readlink -f "$ACCOUNT_DIR"`
-EUCALYPTUS_CERT=$ACCOUNT_DIR/cacert.pem
-if [ -e "$EUCALYPTUS_CERT" ]; then
-    mv "$EUCALYPTUS_CERT" "$EUCALYPTUS_CERT.old"
-fi
-if ! nova x509-get-root-cert "$EUCALYPTUS_CERT"; then
-    echo "Failed to update the root certificate: $EUCALYPTUS_CERT" >&2
-    if [ -e "$EUCALYPTUS_CERT.old" ]; then
-        mv "$EUCALYPTUS_CERT.old" "$EUCALYPTUS_CERT"
-    fi
-fi
-
-
 function add_entry {
     local user_id=$1
     local user_name=$2
@@ -187,54 +163,16 @@ function add_entry {
     local project_name=$4
     local user_passwd=$5
 
-    # The admin user can see all user's secret AWS keys, it does not looks good
-    local line
-    line=$(openstack ec2 credentials list --user $user_id | grep " $project_id " || true)
-    if [ -z "$line" ]; then
-        openstack ec2 credentials create --user $user_id --project $project_id 1>&2
-        line=`openstack ec2 credentials list --user $user_id | grep " $project_id "`
-    fi
-    local ec2_access_key ec2_secret_key
-    read ec2_access_key ec2_secret_key <<<  `echo $line | awk '{print $2 " " $4 }'`
     mkdir -p "$ACCOUNT_DIR/$project_name"
     local rcfile="$ACCOUNT_DIR/$project_name/$user_name"
-    # The certs subject part are the project ID "dash" user ID, but the CN should be the first part of the DN
-    # Generally the subject DN parts should be in reverse order like the Issuer
-    # The Serial does not seams correctly marked either
-    local ec2_cert="$rcfile-cert.pem"
-    local ec2_private_key="$rcfile-pk.pem"
-    # Try to preserve the original file on fail (best effort)
-    if [ -e "$ec2_private_key" ]; then
-        mv -f "$ec2_private_key" "$ec2_private_key.old"
-    fi
-    if [ -e "$ec2_cert" ]; then
-        mv -f "$ec2_cert" "$ec2_cert.old"
-    fi
-    # It will not create certs when the password is incorrect
-    if ! nova --os-password "$user_passwd" --os-username "$user_name" --os-project-name "$project_name" x509-create-cert "$ec2_private_key" "$ec2_cert"; then
-        if [ -e "$ec2_private_key.old" ]; then
-            mv -f "$ec2_private_key.old" "$ec2_private_key"
-        fi
-        if [ -e "$ec2_cert.old" ]; then
-            mv -f "$ec2_cert.old" "$ec2_cert"
-        fi
-    fi
+
     cat >"$rcfile" <<EOF
-# you can source this file
-export EC2_ACCESS_KEY="$ec2_access_key"
-export EC2_SECRET_KEY="$ec2_secret_key"
-export EC2_URL="$EC2_URL"
-export S3_URL="$S3_URL"
 # OpenStack USER ID = $user_id
 export OS_USERNAME="$user_name"
 # OpenStack project ID = $project_id
 export OS_PROJECT_NAME="$project_name"
 export OS_AUTH_URL="$OS_AUTH_URL"
 export OS_CACERT="$OS_CACERT"
-export EC2_CERT="$ec2_cert"
-export EC2_PRIVATE_KEY="$ec2_private_key"
-export EC2_USER_ID=42 #not checked by nova (can be a 12-digit id)
-export EUCALYPTUS_CERT="$ACCOUNT_DIR/cacert.pem"
 export NOVA_CERT="$ACCOUNT_DIR/cacert.pem"
 export OS_AUTH_TYPE=v2password
 EOF

From 04ed38b5d77276578f95184a9a9d009b12b57d43 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Tue, 15 Mar 2016 06:26:37 +0000
Subject: [PATCH 0311/2409] Updated from generate-devstack-plugins-list

Change-Id: I40f4ce322028698011931f3b72fc39e95e6813b0
---
 doc/source/plugin-registry.rst | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index a52eba8bd6..136a9e4e92 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -106,6 +106,8 @@ projects.
 +----------------------------+-------------------------------------------------------------------------+
 |networking-bgpvpn           |git://git.openstack.org/openstack/networking-bgpvpn                      |
 +----------------------------+-------------------------------------------------------------------------+
+|networking-brocade          |git://git.openstack.org/openstack/networking-brocade                     |
++----------------------------+-------------------------------------------------------------------------+
 |networking-calico           |git://git.openstack.org/openstack/networking-calico                      |
 +----------------------------+-------------------------------------------------------------------------+
 |networking-cisco            |git://git.openstack.org/openstack/networking-cisco                       |

From 54d16f706a4c9886a5de93fc8b3cd08cd324de33 Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Tue, 15 Mar 2016 15:18:14 -0400
Subject: [PATCH 0312/2409] Revert "Automate OVS bridge creation for multiple
 mappings"

After reviewing I5b1d49be8d9e3e331826e30182fba70f099b5e7f and
I161a157895b4ed0c9ea5a7a00302e30f4ad75ed3 - I have come to the
determination that this really should be in a DevStack plugin.

If both of the patches under review were to merge, we would be blessed
with at least the following variables:

OVS_NICS_FROM_BRIDGES
OVS_NIC_MAPPINGS
OVS_BRIDGE_MAPPINGS
OVS_PHYSICAL_BRIDGE
PHYSICAL_NETWORK
PUBLIC_PHYSICAL_NETWORK

Which really is not good. Let's just push this into a plugin, I don't
want to deal with it.

This reverts commit 3095ff51320291b3622cacc3bf2fb1043bff8d31.

Change-Id: I746022f5db93d3333101a014692fbdcd790a0004
---
 doc/source/guides/neutron.rst         | 16 ----------------
 lib/neutron_plugins/openvswitch_agent | 11 ++---------
 2 files changed, 2 insertions(+), 25 deletions(-)

diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index cac7bb0152..c24cbb90fc 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -537,19 +537,3 @@ setup, with small modifications for the interface mappings.
     PUBLIC_PHYSICAL_NETWORK=default
     LB_INTERFACE_MAPPINGS=default:eth0
 
-Creating specific OVS bridges for physical networks
----------------------------------------------------
-
-When using the Open vSwitch ML2 mechanism driver, it is possible to
-have multiple Open vSwitch bridges meant for physical networking be
-automatically created by setting the ``OVS_BRIDGE_MAPPINGS`` to a list of
-physical network to bridge name associations with the following syntax:
-
-::
-
-    OVS_BRIDGE_MAPPINGS=net1name:bridge1name,net2name:bridge2name,<...>
-
-Also, ``OVS_BRIDGE_MAPPINGS`` has precedence over ``PHYSICAL_NETWORK`` and
-``OVS_PHYSICAL_BRIDGE``, meaning that if the former is set, the latter
-ones will be ignored. When ``OVS_BRIDGE_MAPPINGS`` is not set, the other
-variables will still be evaluated.
diff --git a/lib/neutron_plugins/openvswitch_agent b/lib/neutron_plugins/openvswitch_agent
index e1c5a504a5..339d5fd96a 100644
--- a/lib/neutron_plugins/openvswitch_agent
+++ b/lib/neutron_plugins/openvswitch_agent
@@ -37,7 +37,6 @@ function neutron_plugin_configure_l3_agent {
 }
 
 function neutron_plugin_configure_plugin_agent {
-    local mappings_array mapping phys_bridge
     # Setup integration bridge
     _neutron_ovs_base_setup_bridge $OVS_BRIDGE
     _neutron_ovs_base_configure_firewall_driver
@@ -53,15 +52,9 @@ function neutron_plugin_configure_plugin_agent {
     # complex physical network configurations.
     if [[ "$OVS_BRIDGE_MAPPINGS" == "" ]] && [[ "$PHYSICAL_NETWORK" != "" ]] && [[ "$OVS_PHYSICAL_BRIDGE" != "" ]]; then
         OVS_BRIDGE_MAPPINGS=$PHYSICAL_NETWORK:$OVS_PHYSICAL_BRIDGE
-    fi
 
-    if [[ "$OVS_BRIDGE_MAPPINGS" != "" ]]; then
-        IFS=',' read -a mappings_array <<< "$OVS_BRIDGE_MAPPINGS"
-        for mapping in "${mappings_array[@]}"; do
-            phys_bridge=`echo $mapping | cut -f 2 -d ":"`
-            # Configure bridge manually with physical interface as port for multi-node
-            _neutron_ovs_base_add_bridge $phys_bridge
-        done
+        # Configure bridge manually with physical interface as port for multi-node
+        _neutron_ovs_base_add_bridge $OVS_PHYSICAL_BRIDGE
     fi
     if [[ "$OVS_BRIDGE_MAPPINGS" != "" ]]; then
         iniset /$Q_PLUGIN_CONF_FILE ovs bridge_mappings $OVS_BRIDGE_MAPPINGS

From 78d3739dbec518bc81e635d5a9c19eb68530454c Mon Sep 17 00:00:00 2001
From: tengqm <tengqim@cn.ibm.com>
Date: Tue, 15 Mar 2016 23:08:00 -0400
Subject: [PATCH 0313/2409] Fix RHEL7 vendor detection

When detecting os_VENDOR, the lsb_release output may be different
from what is expected today. This patch fixes the detection.

Change-Id: I850ad1acbc2397c73e7cc85c1765cba6ba2f98d4
---
 functions-common | 1 +
 1 file changed, 1 insertion(+)

diff --git a/functions-common b/functions-common
index 98768cdd50..366415b91e 100644
--- a/functions-common
+++ b/functions-common
@@ -440,6 +440,7 @@ function is_fedora {
     fi
 
     [ "$os_VENDOR" = "Fedora" ] || [ "$os_VENDOR" = "Red Hat" ] || \
+        [ "$os_VENDOR" = "RedHatEnterpriseServer" ] || \
         [ "$os_VENDOR" = "CentOS" ] || [ "$os_VENDOR" = "OracleLinux" ] || \
         [ "$os_VENDOR" = "Virtuozzo" ] || [ "$os_VENDOR" = "kvmibm" ]
 }

From d014002d034ecfebf9f3b3e10296de15b7a9edb0 Mon Sep 17 00:00:00 2001
From: Dean Troyer <dtroyer@gmail.com>
Date: Wed, 16 Mar 2016 08:13:49 -0500
Subject: [PATCH 0314/2409] Remove n-crt from default services

Depends-on: I8a07320b59ea6cd7d1fe8bce61af84b5a28fb39e
Change-Id: I3441317911c8e940ef038c79f97554c1c669e120
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 088cfeed26..74d507cfa2 100644
--- a/stackrc
+++ b/stackrc
@@ -67,7 +67,7 @@ if ! isset ENABLED_SERVICES ; then
     # Keystone - nothing works without keystone
     ENABLED_SERVICES=key
     # Nova - services to support libvirt based openstack clouds
-    ENABLED_SERVICES+=,n-api,n-cpu,n-net,n-cond,n-sch,n-novnc,n-crt,n-cauth
+    ENABLED_SERVICES+=,n-api,n-cpu,n-net,n-cond,n-sch,n-novnc,n-cauth
     # Glance services needed for Nova
     ENABLED_SERVICES+=,g-api,g-reg
     # Cinder

From 4921d4dbb937b8a9ca26379a33252f0bebcfb53f Mon Sep 17 00:00:00 2001
From: Jamie Lennox <jamielennox@gmail.com>
Date: Tue, 23 Feb 2016 22:51:04 -0600
Subject: [PATCH 0315/2409] Use unversioned keystone endpoints

Insert the unversioned keystone URLs into the service catalog. Services
should be able to determine the correct URL for their work from this.

Depends-On: I931f0c558aafc8dfaa5519744c6e4e7fcffc3205
Change-Id: I6171f782a1dd397720a9b2a3393b30ae5aca0cc2
---
 lib/keystone | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 9f23e73381..802b38082e 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -634,9 +634,9 @@ function bootstrap_keystone {
         --bootstrap-role-name admin \
         --bootstrap-service-name keystone \
         --bootstrap-region-id "$REGION_NAME" \
-        --bootstrap-admin-url "$KEYSTONE_AUTH_URI/v$IDENTITY_API_VERSION" \
-        --bootstrap-public-url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v$IDENTITY_API_VERSION" \
-        --bootstrap-internal-url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v$IDENTITY_API_VERSION"
+        --bootstrap-admin-url "$KEYSTONE_AUTH_URI" \
+        --bootstrap-public-url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT" \
+        --bootstrap-internal-url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT"
 }
 
 # Restore xtrace

From f21b86fefbcebd1430909b1db89ef2cf3154c705 Mon Sep 17 00:00:00 2001
From: gordon chung <gord@live.ca>
Date: Wed, 16 Mar 2016 17:58:07 -0400
Subject: [PATCH 0316/2409] Install uuid-runtime on Ubuntu

It seems uuidgen doesn't exist by default on the new trusty nodes [1].
There are quite a few projects that use uuidgen [2] so we need to
ensure it's on the node.

On Trusty, this is provided by the uuid-runtime package.  Note that on
Centos & Fedora this is provided by util-linux which is already tehre.

[1] http://logs.openstack.org/75/292475/1/check/gate-telemetry-dsvm-integration-ceilometer/2e85d1f/logs/devstacklog.txt.gz#_2016-03-16_19_20_30_116
[2] http://codesearch.openstack.org/?q=uuidgen&i=nope&files=&repos=

Change-Id: I230836d8b644698473d0611931334c232cf00734
---
 files/debs/general | 1 +
 files/debs/neutron | 1 -
 2 files changed, 1 insertion(+), 1 deletion(-)

diff --git a/files/debs/general b/files/debs/general
index 1215147a16..307cd7b113 100644
--- a/files/debs/general
+++ b/files/debs/general
@@ -28,6 +28,7 @@ screen
 tar
 tcpdump
 unzip
+uuid-runtime
 wget
 wget
 zlib1g-dev
diff --git a/files/debs/neutron b/files/debs/neutron
index e53cc68ccf..2307fa54d5 100644
--- a/files/debs/neutron
+++ b/files/debs/neutron
@@ -13,5 +13,4 @@ rabbitmq-server # NOPRIME
 radvd # NOPRIME
 sqlite3
 sudo
-uuid-runtime
 vlan

From 7ed812c6cdb4814be2f40f4331aec43c62d13179 Mon Sep 17 00:00:00 2001
From: Balagopal <bala@aptira.com>
Date: Tue, 1 Mar 2016 04:43:31 +0000
Subject: [PATCH 0317/2409] Change "secrete" to "secret"

Apparently this is intentional as a joke on devstack leaking
passwords, but the dual meaning of the word confuses people.  Let's
change it before we get yet another review fixing it.

Change-Id: I3bee03612f6ea197362aab04a37f81043f77f235
---
 doc/source/configuration.rst        |  2 +-
 doc/source/guides/multinode-lab.rst | 10 ++++----
 doc/source/guides/neutron.rst       | 40 ++++++++++++++---------------
 doc/source/openrc.rst               |  2 +-
 lib/tempest                         |  2 +-
 openrc                              |  2 +-
 samples/local.conf                  |  2 +-
 tools/xen/xenrc                     |  2 +-
 8 files changed, 31 insertions(+), 31 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index e985bdceb0..0493f8fa25 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -104,7 +104,7 @@ values that most often need to be set.
 ::
 
     [[local|localrc]]
-    ADMIN_PASSWORD=secrete
+    ADMIN_PASSWORD=secret
     DATABASE_PASSWORD=$ADMIN_PASSWORD
     RABBIT_PASSWORD=$ADMIN_PASSWORD
     SERVICE_PASSWORD=$ADMIN_PASSWORD
diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
index 392bb1b807..c996f95743 100644
--- a/doc/source/guides/multinode-lab.rst
+++ b/doc/source/guides/multinode-lab.rst
@@ -129,8 +129,8 @@ cluster controller's DevStack in ``local.conf``:
     LOGFILE=/opt/stack/logs/stack.sh.log
     ADMIN_PASSWORD=labstack
     DATABASE_PASSWORD=supersecret
-    RABBIT_PASSWORD=supersecrete
-    SERVICE_PASSWORD=supersecrete
+    RABBIT_PASSWORD=supersecret
+    SERVICE_PASSWORD=supersecret
 
 In the multi-node configuration the first 10 or so IPs in the private
 subnet are usually reserved. Add this to ``local.sh`` to have it run
@@ -169,8 +169,8 @@ machines, create a ``local.conf`` with:
     LOGFILE=/opt/stack/logs/stack.sh.log
     ADMIN_PASSWORD=labstack
     DATABASE_PASSWORD=supersecret
-    RABBIT_PASSWORD=supersecrete
-    SERVICE_PASSWORD=supersecrete
+    RABBIT_PASSWORD=supersecret
+    SERVICE_PASSWORD=supersecret
     DATABASE_TYPE=mysql
     SERVICE_HOST=192.168.42.11
     MYSQL_HOST=$SERVICE_HOST
@@ -254,7 +254,7 @@ for scripting:
 
     # Add a user and project
     NAME=bob
-    PASSWORD=BigSecrete
+    PASSWORD=BigSecret
     PROJECT=$NAME
     openstack project create $PROJECT
     openstack user create $NAME --password=$PASSWORD --project $PROJECT
diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index c24cbb90fc..4406aa04e9 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -59,10 +59,10 @@ serving as a hypervisor for guest instances.
         MYSQL_HOST=172.18.161.6
         RABBIT_HOST=172.18.161.6
         GLANCE_HOSTPORT=172.18.161.6:9292
-        ADMIN_PASSWORD=secrete
-        DATABASE_PASSWORD=secrete
-        RABBIT_PASSWORD=secrete
-        SERVICE_PASSWORD=secrete
+        ADMIN_PASSWORD=secret
+        DATABASE_PASSWORD=secret
+        RABBIT_PASSWORD=secret
+        SERVICE_PASSWORD=secret
 
         # Do not use Nova-Network
         disable_service n-net
@@ -232,10 +232,10 @@ The host `devstack-2` has a very minimal `local.conf`.
     MYSQL_HOST=172.18.161.6
     RABBIT_HOST=172.18.161.6
     GLANCE_HOSTPORT=172.18.161.6:9292
-    ADMIN_PASSWORD=secrete
-    MYSQL_PASSWORD=secrete
-    RABBIT_PASSWORD=secrete
-    SERVICE_PASSWORD=secrete
+    ADMIN_PASSWORD=secret
+    MYSQL_PASSWORD=secret
+    RABBIT_PASSWORD=secret
+    SERVICE_PASSWORD=secret
 
     ## Neutron options
     PUBLIC_INTERFACE=eth0
@@ -362,10 +362,10 @@ controller node.
         GLANCE_HOSTPORT=10.0.0.2:9292
         PUBLIC_INTERFACE=eth1
 
-        ADMIN_PASSWORD=secrete
-        MYSQL_PASSWORD=secrete
-        RABBIT_PASSWORD=secrete
-        SERVICE_PASSWORD=secrete
+        ADMIN_PASSWORD=secret
+        MYSQL_PASSWORD=secret
+        RABBIT_PASSWORD=secret
+        SERVICE_PASSWORD=secret
 
         ## Neutron options
         Q_USE_SECGROUP=True
@@ -409,10 +409,10 @@ compute node 1.
         MYSQL_HOST=10.0.0.2
         RABBIT_HOST=10.0.0.2
         GLANCE_HOSTPORT=10.0.0.2:9292
-        ADMIN_PASSWORD=secrete
-        MYSQL_PASSWORD=secrete
-        RABBIT_PASSWORD=secrete
-        SERVICE_PASSWORD=secrete
+        ADMIN_PASSWORD=secret
+        MYSQL_PASSWORD=secret
+        RABBIT_PASSWORD=secret
+        SERVICE_PASSWORD=secret
 
         # Services that a compute node runs
         ENABLED_SERVICES=n-cpu,rabbit,q-agt
@@ -509,10 +509,10 @@ setup, with small modifications for the interface mappings.
     MYSQL_HOST=172.18.161.6
     RABBIT_HOST=172.18.161.6
     GLANCE_HOSTPORT=172.18.161.6:9292
-    ADMIN_PASSWORD=secrete
-    DATABASE_PASSWORD=secrete
-    RABBIT_PASSWORD=secrete
-    SERVICE_PASSWORD=secrete
+    ADMIN_PASSWORD=secret
+    DATABASE_PASSWORD=secret
+    RABBIT_PASSWORD=secret
+    SERVICE_PASSWORD=secret
 
     # Do not use Nova-Network
     disable_service n-net
diff --git a/doc/source/openrc.rst b/doc/source/openrc.rst
index 0b090c77b7..4e7f0754a3 100644
--- a/doc/source/openrc.rst
+++ b/doc/source/openrc.rst
@@ -35,7 +35,7 @@ OS\_PASSWORD
 
     ::
 
-        OS_PASSWORD=secrete
+        OS_PASSWORD=secret
 
 HOST\_IP, SERVICE\_HOST
     Set API endpoint host using ``HOST_IP``. ``SERVICE_HOST`` may also
diff --git a/lib/tempest b/lib/tempest
index 3b8a8889af..19b63d18da 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -176,7 +176,7 @@ function configure_tempest {
     sudo install -d -o $STACK_USER $TEMPEST_CONFIG_DIR
     rm -f $TEMPEST_CONFIG
 
-    local password=${ADMIN_PASSWORD:-secrete}
+    local password=${ADMIN_PASSWORD:-secret}
 
     # See ``lib/keystone`` where these users and tenants are set up
     local admin_username=${ADMIN_USERNAME:-admin}
diff --git a/openrc b/openrc
index 460cf14756..db2e97d3b1 100644
--- a/openrc
+++ b/openrc
@@ -51,7 +51,7 @@ export OS_USERNAME=${OS_USERNAME:-demo}
 # With Keystone you pass the keystone password instead of an api key.
 # Recent versions of novaclient use OS_PASSWORD instead of NOVA_API_KEYs
 # or NOVA_PASSWORD.
-export OS_PASSWORD=${ADMIN_PASSWORD:-secrete}
+export OS_PASSWORD=${ADMIN_PASSWORD:-secret}
 
 # Don't put the key into a keyring by default. Testing for development is much
 # easier with this off.
diff --git a/samples/local.conf b/samples/local.conf
index ea68dc0d8d..06ac18572d 100644
--- a/samples/local.conf
+++ b/samples/local.conf
@@ -25,7 +25,7 @@
 
 # If the ``*_PASSWORD`` variables are not set here you will be prompted to enter
 # values for them by ``stack.sh``and they will be added to ``local.conf``.
-ADMIN_PASSWORD=nomoresecrete
+ADMIN_PASSWORD=nomoresecret
 DATABASE_PASSWORD=stackdb
 RABBIT_PASSWORD=stackqueue
 SERVICE_PASSWORD=$ADMIN_PASSWORD
diff --git a/tools/xen/xenrc b/tools/xen/xenrc
index be6c5ca037..bb27454e30 100644
--- a/tools/xen/xenrc
+++ b/tools/xen/xenrc
@@ -32,7 +32,7 @@ PUB_BRIDGE_OR_NET_NAME="OpenStack Public Network"
 XEN_INT_BRIDGE_OR_NET_NAME="OpenStack VM Integration Network"
 
 # VM Password
-GUEST_PASSWORD=${GUEST_PASSWORD:-secrete}
+GUEST_PASSWORD=${GUEST_PASSWORD:-secret}
 
 # Extracted variables for OpenStack VM network device numbers.
 # Make sure they form a continuous sequence starting from 0

From 198887e8903696ea9fcbec0f8a91c2f6ca5a34c7 Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Fri, 10 Apr 2015 18:45:35 +0200
Subject: [PATCH 0318/2409] logging: don't set logging format strings for
 keystone

Don't override those format strings since the overridden
values are identical to those used by oslo.log by default [1].

logging_exception_prefix is still set since it changes the logging
format to use TRACE label for exceptions instead of default ERROR.

[1]: https://git.openstack.org/cgit/openstack/oslo.log/tree/oslo_log/_options.py?id=c47a91dbbb586c27d8521b1016bf7901c47b1c90#n110

Closes-Bug: #1433687
Change-Id: Ibd11cd6b0defb6dc709dbd3e718a49fd71cce6b6
---
 lib/keystone | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 9f23e73381..66d4988b02 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -281,9 +281,6 @@ function configure_keystone {
     iniset $KEYSTONE_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
 
     if [ "$KEYSTONE_DEPLOY" == "mod_wsgi" ]; then
-        iniset $KEYSTONE_CONF DEFAULT logging_context_format_string "%(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [%(request_id)s %(user_identity)s] %(instance)s%(message)s"
-        iniset $KEYSTONE_CONF DEFAULT logging_default_format_string "%(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [-] %(instance)s%(message)s"
-        iniset $KEYSTONE_CONF DEFAULT logging_debug_format_suffix "%(asctime)s.%(msecs)03d %(funcName)s %(pathname)s:%(lineno)d"
         iniset $KEYSTONE_CONF DEFAULT logging_exception_prefix "%(asctime)s.%(msecs)03d %(process)d TRACE %(name)s %(instance)s"
         _config_keystone_apache_wsgi
     elif [ "$KEYSTONE_DEPLOY" == "uwsgi" ]; then

From 7c98cfb56e73e326446a812be19b3ac9d6e2f240 Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@midokura.com>
Date: Fri, 18 Mar 2016 21:24:46 +0900
Subject: [PATCH 0319/2409] install_pip.sh: Remove stale comments

Change-Id: Id91c8e579977bedae1410095d9b4cef9d9ae2178
---
 tools/install_pip.sh | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index 2a9d813eac..17c7b619d1 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -2,12 +2,9 @@
 
 # **install_pip.sh**
 
-# install_pip.sh [--pip-version <version>] [--use-get-pip] [--force]
-#
 # Update pip and friends to a known common version
 
 # Assumptions:
-# - update pip to $INSTALL_PIP_VERSION
 # - if USE_PYTHON3=True, PYTHON3_VERSION refers to a version already installed
 
 set -o errexit

From c10989bf189c42a99e56f0017705d1b7a8c71499 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 21 Mar 2016 13:03:34 +1100
Subject: [PATCH 0320/2409] Plugin autogen list: handle variable-width plugin
 names

We've had a couple of cases where plugin names are longer than our
table width.

Take the fixed-with table-header out of the header file, and generate
it dynamically based on first-column width.  To simplify, take
advantage that RST allows a variable-length last column and so don't
specify it's width.

Add a link to the cgit URL for each project you can click on to browse
the source (link text remains the git:// URL).

Add some logging so you can see what the python generator is doing,
should you run it.

Change-Id: I5d5e692039bbb30b2508119412472dac1d105c08
---
 data/devstack-plugins-registry.header   |  4 ---
 tools/generate-devstack-plugins-list.py |  8 ++++++
 tools/generate-devstack-plugins-list.sh | 34 +++++++++++++++++++++----
 3 files changed, 37 insertions(+), 9 deletions(-)

diff --git a/data/devstack-plugins-registry.header b/data/devstack-plugins-registry.header
index 46d5e60749..f105fe9d35 100644
--- a/data/devstack-plugins-registry.header
+++ b/data/devstack-plugins-registry.header
@@ -18,7 +18,3 @@ Detected Plugins
 The following are plugins that a script has found in the openstack/
 namespace, which includes but is not limited to official OpenStack
 projects.
-
-+----------------------------+-------------------------------------------------------------------------+
-|Plugin Name                 |URL                                                                      |
-+----------------------------+-------------------------------------------------------------------------+
diff --git a/tools/generate-devstack-plugins-list.py b/tools/generate-devstack-plugins-list.py
index 1fa550192e..aeec4dd27d 100644
--- a/tools/generate-devstack-plugins-list.py
+++ b/tools/generate-devstack-plugins-list.py
@@ -23,9 +23,12 @@
 #     working directory
 #   * network access to https://git.openstack.org/cgit
 
+import logging
 import json
 import requests
 
+logging.basicConfig(level=logging.DEBUG)
+
 url = 'https://review.openstack.org/projects/'
 
 # This is what a project looks like
@@ -37,6 +40,8 @@
 '''
 
 def is_in_openstack_namespace(proj):
+    # only interested in openstack namespace (e.g. not retired
+    # stackforge, etc)
     return proj.startswith('openstack/')
 
 # Rather than returning a 404 for a nonexistent file, cgit delivers a
@@ -50,10 +55,13 @@ def has_devstack_plugin(proj):
     else:
         False
 
+logging.debug("Getting project list from %s" % url)
 r = requests.get(url)
 projects = sorted(filter(is_in_openstack_namespace, json.loads(r.text[4:])))
+logging.debug("Found %d projects" % len(projects))
 
 found_plugins = filter(has_devstack_plugin, projects)
 
 for project in found_plugins:
+    # strip of openstack/
     print project[10:]
diff --git a/tools/generate-devstack-plugins-list.sh b/tools/generate-devstack-plugins-list.sh
index be3f60a136..82486f5b2d 100644
--- a/tools/generate-devstack-plugins-list.sh
+++ b/tools/generate-devstack-plugins-list.sh
@@ -38,6 +38,17 @@
 # current working directory, it will be prepended or appended to
 # the generated reStructuredText plugins table respectively.
 
+# Print the title underline for a RST table.  Argument is the length
+# of the first column, second column is assumed to be "URL"
+function title_underline {
+    local len=$1
+    while [[ $len -gt 0 ]]; do
+        printf "="
+        len=$(( len - 1))
+    done
+    printf " ===\n"
+}
+
 (
 declare -A plugins
 
@@ -47,11 +58,24 @@ fi
 
 sorted_plugins=$(python tools/generate-devstack-plugins-list.py)
 
-for k in ${sorted_plugins}; do
-    project=${k:0:28}
-    giturl="git://git.openstack.org/openstack/${k:0:26}"
-    printf "|%-28s|%-73s|\n" "${project}" "${giturl}"
-    printf "+----------------------------+-------------------------------------------------------------------------+\n"
+# find the length of the name column & pad
+name_col_len=$(echo "${sorted_plugins}" | wc -L)
+name_col_len=$(( name_col_len + 2 ))
+
+# ====================== ===
+# Plugin Name            URL
+# ====================== ===
+# foobar                 `git://... <http://...>`__
+# ...
+
+title_underline ${name_col_len}
+printf "%-${name_col_len}s %s\n" "Plugin Name" "URL"
+title_underline ${name_col_len}
+
+for plugin in ${sorted_plugins}; do
+    giturl="git://git.openstack.org/openstack/${plugin}"
+    gitlink="https://git.openstack.org/cgit/openstack/${plugin}"
+    printf "%-${name_col_len}s %s\n" "${p}" "\`${giturl} <${gitlink}>\`__"
 done
 
 if [[ -r data/devstack-plugins-registry.footer ]]; then

From 1258da64085cef851be09923e37d1ed59348b43d Mon Sep 17 00:00:00 2001
From: Sergey Belous <sbelous@mirantis.com>
Date: Mon, 21 Mar 2016 12:32:06 +0300
Subject: [PATCH 0321/2409] Allow install os-vif library used by Nova

In future Nova will use os-vif library for some communication with Neutron.
This patch add ability to install os-vif library that requires for run
tempest-jobs for new patches, that used os-vif.

Change-Id: I28e48afd3c740b1aa50c994d99f660f095e7deda
---
 lib/nova                     | 8 ++++++++
 stackrc                      | 4 ++++
 tests/test_libs_from_pypi.sh | 2 +-
 3 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index 3a5a47fa27..2b8fefaf00 100644
--- a/lib/nova
+++ b/lib/nova
@@ -34,6 +34,7 @@ set +o xtrace
 
 # Set up default directories
 GITDIR["python-novaclient"]=$DEST/python-novaclient
+GITDIR["os-vif"]=$DEST/os-vif
 NOVA_DIR=$DEST/nova
 
 # Nova virtual environment
@@ -728,6 +729,13 @@ function install_novaclient {
 
 # install_nova() - Collect source and prepare
 function install_nova {
+
+    # Install os-vif
+    if use_library_from_git "os-vif"; then
+        git_clone_by_name "os-vif"
+        setup_dev_lib "os-vif"
+    fi
+
     if is_service_enabled n-cpu && [[ -r $NOVA_PLUGINS/hypervisor-$VIRT_DRIVER ]]; then
         install_nova_hypervisor
     fi
diff --git a/stackrc b/stackrc
index 74d507cfa2..9bd132a74a 100644
--- a/stackrc
+++ b/stackrc
@@ -477,6 +477,10 @@ GITDIR["ceilometermiddleware"]=$DEST/ceilometermiddleware
 GITREPO["os-brick"]=${OS_BRICK_REPO:-${GIT_BASE}/openstack/os-brick.git}
 GITBRANCH["os-brick"]=${OS_BRICK_BRANCH:-master}
 
+# os-vif library to communicate between Neutron to Nova
+GITREPO["os-vif"]=${OS_VIF_REPO:-${GIT_BASE}/openstack/os-vif.git}
+GITBRANCH["os-vif"]=${OS_VIF_BRANCH:-master}
+
 # ironic common lib
 GITREPO["ironic-lib"]=${IRONIC_LIB_REPO:-${GIT_BASE}/openstack/ironic-lib.git}
 GITBRANCH["ironic-lib"]=${IRONIC_LIB_BRANCH:-master}
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index ee11fd29a0..f01db6df1d 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -42,7 +42,7 @@ ALL_LIBS+=" python-neutronclient tooz ceilometermiddleware oslo.policy"
 ALL_LIBS+=" debtcollector os-brick automaton futurist oslo.service"
 ALL_LIBS+=" oslo.cache oslo.reports osprofiler"
 ALL_LIBS+=" keystoneauth ironic-lib neutron-lib oslo.privsep"
-ALL_LIBS+=" diskimage-builder"
+ALL_LIBS+=" diskimage-builder os-vif"
 
 # Generate the above list with
 # echo ${!GITREPO[@]}

From d99c29032bb0cc89ffe6874c7b879b84897ff0b0 Mon Sep 17 00:00:00 2001
From: Mark Vanderwiel <vanderwl@us.ibm.com>
Date: Thu, 17 Mar 2016 12:19:16 -0500
Subject: [PATCH 0322/2409] Add dependency for hexdump

hexdump is used in common function generate_hex_string which is
used by nova and heat.  The current general dependencies do not
have this dependency covered, instead it is usually pulled in by
other implicit dependencies when a full devstack is built. In
cases where only a subset is built (like just Heat and keystone)
hexdump is missing.

Added unit tests for the generate_hex_string function.

Depends-On: Ib47d802a31a0f4c2a49daa7e6698e37c70a2365a
Change-Id: I77c8c2019fb8b8174cdfaed3e56ebf728f0732b7
Closes-Bug: #1558672
---
 files/debs/general      |  1 +
 files/rpms-suse/general |  1 +
 files/rpms/general      |  1 +
 tests/test_functions.sh | 16 ++++++++++++++++
 4 files changed, 19 insertions(+)

diff --git a/files/debs/general b/files/debs/general
index 307cd7b113..a1f2a4b159 100644
--- a/files/debs/general
+++ b/files/debs/general
@@ -1,5 +1,6 @@
 bc
 bridge-utils
+bsdmainutils
 curl
 g++
 gcc
diff --git a/files/rpms-suse/general b/files/rpms-suse/general
index e3dfec1047..3b19071770 100644
--- a/files/rpms-suse/general
+++ b/files/rpms-suse/general
@@ -25,5 +25,6 @@ screen
 tar
 tcpdump
 unzip
+util-linux
 wget
 zlib-devel
diff --git a/files/rpms/general b/files/rpms/general
index 6d5fd1565c..2d4a97a743 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -30,6 +30,7 @@ screen
 tar
 tcpdump
 unzip
+util-linux
 wget
 which
 zlib-devel
diff --git a/tests/test_functions.sh b/tests/test_functions.sh
index be8dc5e287..8aae23dcb8 100755
--- a/tests/test_functions.sh
+++ b/tests/test_functions.sh
@@ -9,6 +9,22 @@ source $TOP/functions
 
 source $TOP/tests/unittest.sh
 
+echo "Testing generate_hex_string()"
+
+VAL=$(generate_hex_string 16)
+if [[ ${#VAL} -eq 32 ]]; then
+    passed "OK"
+else
+    failed "generate_hex_string 16 failed ${#VAL}"
+fi
+
+VAL=$(generate_hex_string 32)
+if [[ ${#VAL} -eq 64 ]]; then
+    passed "OK"
+else
+    failed "generate_hex_string 32 failed ${#VAL}"
+fi
+
 echo "Testing die_if_not_set()"
 
 bash -c "source $TOP/functions; X=`echo Y && true`; die_if_not_set $LINENO X 'not OK'"

From c8c1c615f2bf63e6a1ad9be70a340058bd813919 Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@midokura.com>
Date: Tue, 22 Mar 2016 14:29:47 +0900
Subject: [PATCH 0323/2409] Normalize path for upper-constraints

It seems pip distinguishes paths with .. or extra / for constraints.
For example, the following directories are considered different.

    /path/to/dir
    /path/to//dir
    /path/to/dir/subdir/..

This commit tries to normalize the given directory name to avoid
"Could not satisfy constraints for 'xxxx': installation from path
or url cannot be constrained to a version" error due to directory
name mismatch.

Reference: https://github.com/pypa/pip/pull/3582
Closes-Bug: #1542545
Change-Id: Iae9d58c27d3b10bca16e4a471507c4d5c16439a0
---
 inc/python | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/inc/python b/inc/python
index 35bab6f1e0..495150d4b8 100644
--- a/inc/python
+++ b/inc/python
@@ -300,6 +300,13 @@ function _setup_package_with_constraints_edit {
     local flags=$2
     local extras=$3
 
+    # Normalize the directory name to avoid
+    # "installation from path or url cannot be constrained to a version"
+    # error.
+    # REVISIT(yamamoto): Remove this when fixed in pip.
+    # https://github.com/pypa/pip/pull/3582
+    project_dir=$(cd $project_dir && pwd)
+
     if [ -n "$REQUIREMENTS_DIR" ]; then
         # Constrain this package to this project directory from here on out.
         local name

From 629917a5dd0f5b56349294e0edc8b5bdd766aa46 Mon Sep 17 00:00:00 2001
From: Brad Behle <behle@us.ibm.com>
Date: Tue, 22 Mar 2016 14:27:32 -0500
Subject: [PATCH 0324/2409] Check for valid network before probe-create call

Check that a public and/or private network exists before calling
probe-create for it, to avoid an error in the case where that
network hasn't been created

Change-Id: If01cec47dc4ab02b5d78074b1354df10dc23b384
Closes-bug: #1560629
---
 lib/neutron-legacy | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index e06a020f43..34f9840791 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -1453,9 +1453,13 @@ function delete_probe {
 function setup_neutron_debug {
     if [[ "$Q_USE_DEBUG_COMMAND" == "True" ]]; then
         public_net_id=`_get_net_id $PUBLIC_NETWORK_NAME`
-        neutron-debug --os-tenant-name admin --os-username admin --os-password $ADMIN_PASSWORD probe-create --device-owner compute $public_net_id
+        if [[ -n $public_net_id ]]; then
+            neutron-debug --os-tenant-name admin --os-username admin --os-password $ADMIN_PASSWORD probe-create --device-owner compute $public_net_id
+        fi
         private_net_id=`_get_net_id $PRIVATE_NETWORK_NAME`
-        neutron-debug --os-tenant-name admin --os-username admin --os-password $ADMIN_PASSWORD probe-create --device-owner compute $private_net_id
+        if [[ -n $private_net_id ]]; then
+            neutron-debug --os-tenant-name admin --os-username admin --os-password $ADMIN_PASSWORD probe-create --device-owner compute $private_net_id
+        fi
     fi
 }
 

From 646085d701049004f9b2bcdc38610f3e87579cda Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 21 Mar 2016 17:00:51 -0400
Subject: [PATCH 0325/2409] Add colorful PS4

PS4 can include functions, so when running in the LOG_COLORS=True mode
provide a grey function line so that it's easier to visually
distinguish the content from the location.

Also make it so the main prompt chunks off all the common path, which
means we can printf to 40 characters and have a pretty reasonable and
readable PS4.

Change-Id: I4a10a49db97d413349bcfceeb8c4164936fbcc40
---
 functions              | 13 +++++++++++++
 stackrc                | 16 ++++++++++------
 tools/create_userrc.sh | 16 ++++++++++++++++
 tools/install_pip.sh   |  4 +++-
 4 files changed, 42 insertions(+), 7 deletions(-)

diff --git a/functions b/functions
index 5730b6c894..1bfb8a5078 100644
--- a/functions
+++ b/functions
@@ -30,6 +30,19 @@ function function_exists {
     declare -f -F $1 > /dev/null
 }
 
+# short_source prints out the current location of the caller in a way
+# that strips redundant directories. This is useful for PS4 usage.
+function short_source {
+    saveIFS=$IFS
+    IFS=" "
+    called=($(caller 0))
+    IFS=$saveIFS
+    file=${called[2]}
+    file=${file#$RC_DIR/}
+    printf "%-40s " "$file:${called[1]}:${called[0]}"
+}
+
+
 # Retrieve an image from a URL and upload into Glance.
 # Uses the following variables:
 #
diff --git a/stackrc b/stackrc
index 74d507cfa2..f606bbbd8f 100644
--- a/stackrc
+++ b/stackrc
@@ -14,9 +14,6 @@ unset LANGUAGE
 LC_ALL=C
 export LC_ALL
 
-# Make tracing more educational
-export PS4='+ ${BASH_SOURCE:-}:${FUNCNAME[0]:-}:L${LINENO:-}:   '
-
 # Find the other rc files
 RC_DIR=$(cd $(dirname "${BASH_SOURCE:-$0}") && pwd)
 
@@ -132,6 +129,16 @@ elif [[ -f $RC_DIR/.localrc.auto ]]; then
     source $RC_DIR/.localrc.auto
 fi
 
+# Use color for logging output (only available if syslog is not used)
+LOG_COLOR=$(trueorfalse True LOG_COLOR)
+
+# Make tracing more educational
+if [[ "$LOG_COLOR" == "True" ]]; then
+    export PS4='+\[$(tput setaf 242)\]$(short_source)\[$(tput sgr0)\] '
+else
+    export PS4='+ $(short_source):   '
+fi
+
 # Configure Identity API version: 2.0, 3
 IDENTITY_API_VERSION=${IDENTITY_API_VERSION:-2.0}
 
@@ -785,9 +792,6 @@ SYSLOG=$(trueorfalse False SYSLOG)
 SYSLOG_HOST=${SYSLOG_HOST:-$HOST_IP}
 SYSLOG_PORT=${SYSLOG_PORT:-516}
 
-# Use color for logging output (only available if syslog is not used)
-LOG_COLOR=$(trueorfalse True LOG_COLOR)
-
 # Set global ``GIT_DEPTH=<number>`` to limit the history depth of the git clone
 # Set to 0 to disable shallow cloning
 GIT_DEPTH=${GIT_DEPTH:-0}
diff --git a/tools/create_userrc.sh b/tools/create_userrc.sh
index 3325c5e586..a7278e47b3 100755
--- a/tools/create_userrc.sh
+++ b/tools/create_userrc.sh
@@ -7,6 +7,22 @@
 # Warning: This script just for development purposes
 
 set -o errexit
+
+# short_source prints out the current location of the caller in a way
+# that strips redundant directories. This is useful for PS4
+# usage. Needed before we start tracing due to how we set
+# PS4. Normally we'd pick this up from stackrc, but that's not sourced
+# here.
+function short_source {
+    saveIFS=$IFS
+    IFS=" "
+    called=($(caller 0))
+    IFS=$saveIFS
+    file=${called[2]}
+    file=${file#$RC_DIR/}
+    printf "%-40s " "$file:${called[1]}:${called[0]}"
+}
+
 set -o xtrace
 
 ACCOUNT_DIR=./accrc
diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index 2a9d813eac..87660a677c 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -11,7 +11,6 @@
 # - if USE_PYTHON3=True, PYTHON3_VERSION refers to a version already installed
 
 set -o errexit
-set -o xtrace
 
 # Keep track of the current directory
 TOOLS_DIR=$(cd $(dirname "$0") && pwd)
@@ -23,6 +22,9 @@ cd $TOP_DIR
 # Import common functions
 source $TOP_DIR/stackrc
 
+# don't start tracing until after we've sourced the world
+set -o xtrace
+
 FILES=$TOP_DIR/files
 
 PIP_GET_PIP_URL=https://bootstrap.pypa.io/get-pip.py

From 9ea497539bb1e20fc2d247719f98401d5f7cd67c Mon Sep 17 00:00:00 2001
From: Attila Fazekas <afazekas@redhat.com>
Date: Tue, 22 Mar 2016 15:22:03 +0100
Subject: [PATCH 0326/2409] Configure the admin as admin

Make our usual admin user to be a real admin,
and open the way for improving the per project
policy.json files.

Change-Id: I133a5953d209bc1edbd03ecfae750f77e3eaa64d
Related-Change: https://review.openstack.org/#/c/242232
---
 lib/keystone | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lib/keystone b/lib/keystone
index acdd7e40a9..71f20ac0b0 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -340,6 +340,12 @@ function configure_keystone {
     iniset $KEYSTONE_CONF DEFAULT max_token_size 16384
 
     iniset $KEYSTONE_CONF fernet_tokens key_repository "$KEYSTONE_CONF_DIR/fernet-keys/"
+
+    # Configure the project created by the 'keystone-manage bootstrap' as the cloud-admin project.
+    # The users from this project are globally admin as before, but it also
+    # allows policy changes in order to clarify the adminess scope.
+    iniset $KEYSTONE_CONF resource admin_project_domain_name default
+    iniset $KEYSTONE_CONF resource admin_project_name admin
 }
 
 # create_keystone_accounts() - Sets up common required keystone accounts

From 130c3adb0e88044c9cf3789e79f6e669fa30d7d2 Mon Sep 17 00:00:00 2001
From: Doug Wiegley <dougw@a10networks.com>
Date: Wed, 24 Jun 2015 15:40:32 -0600
Subject: [PATCH 0327/2409] WIP - Remove lbaas from devstack proper

Lbaas devstack support is now in the neutron-lbaas repo, so we can move
towards removing it here. This will explode hard, but let's start peeling
the onion.

This can't merge until p-c no longer references lbaas jobs.

Change-Id: I1c49877bab53f6b25385302420086b25e3eeeebf
---
 lib/neutron-legacy                        | 40 +-----------------
 lib/neutron_plugins/services/loadbalancer | 51 -----------------------
 stackrc                                   |  4 --
 3 files changed, 1 insertion(+), 94 deletions(-)
 delete mode 100644 lib/neutron_plugins/services/loadbalancer

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index e06a020f43..573b061a4a 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -107,7 +107,6 @@ GITDIR["python-neutronclient"]=$DEST/python-neutronclient
 
 NEUTRON_DIR=$DEST/neutron
 NEUTRON_FWAAS_DIR=$DEST/neutron-fwaas
-NEUTRON_LBAAS_DIR=$DEST/neutron-lbaas
 NEUTRON_VPNAAS_DIR=$DEST/neutron-vpnaas
 NEUTRON_AUTH_CACHE_DIR=${NEUTRON_AUTH_CACHE_DIR:-/var/cache/neutron}
 
@@ -122,9 +121,6 @@ NEUTRON_CONF_DIR=/etc/neutron
 NEUTRON_CONF=$NEUTRON_CONF_DIR/neutron.conf
 export NEUTRON_TEST_CONFIG_FILE=${NEUTRON_TEST_CONFIG_FILE:-"$NEUTRON_CONF_DIR/debug.ini"}
 
-# Default provider for load balancer service
-DEFAULT_LB_PROVIDER=LOADBALANCER:Haproxy:neutron_lbaas.services.loadbalancer.drivers.haproxy.plugin_driver.HaproxyOnHostPluginDriver:default
-
 # Default provider for VPN service
 DEFAULT_VPN_PROVIDER=VPN:openswan:neutron_vpnaas.services.vpn.service_drivers.ipsec.IPsecVPNDriver:default
 
@@ -347,12 +343,6 @@ if [ -f $TOP_DIR/lib/neutron_plugins/$Q_PLUGIN ]; then
     source $TOP_DIR/lib/neutron_plugins/$Q_PLUGIN
 fi
 
-# Agent loadbalancer service plugin functions
-# -------------------------------------------
-
-# Hardcoding for 1 service plugin for now
-source $TOP_DIR/lib/neutron_plugins/services/loadbalancer
-
 # Agent metering service plugin functions
 # -------------------------------------------
 
@@ -442,10 +432,6 @@ function configure_neutron {
     iniset_rpc_backend neutron $NEUTRON_CONF
 
     # goes before q-svc to init Q_SERVICE_PLUGIN_CLASSES
-    if is_service_enabled q-lbaas; then
-        deprecated "Configuring q-lbaas through devstack is deprecated"
-        _configure_neutron_lbaas
-    fi
     if is_service_enabled q-metering; then
         _configure_neutron_metering
     fi
@@ -656,10 +642,6 @@ function install_neutron {
         git_clone $NEUTRON_FWAAS_REPO $NEUTRON_FWAAS_DIR $NEUTRON_FWAAS_BRANCH
         setup_develop $NEUTRON_FWAAS_DIR
     fi
-    if is_service_enabled q-lbaas; then
-        git_clone $NEUTRON_LBAAS_REPO $NEUTRON_LBAAS_DIR $NEUTRON_LBAAS_BRANCH
-        setup_develop $NEUTRON_LBAAS_DIR
-    fi
     if is_service_enabled q-vpn; then
         git_clone $NEUTRON_VPNAAS_REPO $NEUTRON_VPNAAS_DIR $NEUTRON_VPNAAS_BRANCH
         setup_develop $NEUTRON_VPNAAS_DIR
@@ -703,10 +685,6 @@ function install_neutron_agent_packages {
     if is_service_enabled q-agt q-dhcp q-l3; then
         neutron_plugin_install_agent_packages
     fi
-
-    if is_service_enabled q-lbaas; then
-        neutron_agent_lbaas_install_agent_packages
-    fi
 }
 
 # Start running processes, including screen
@@ -769,7 +747,6 @@ function start_neutron_other_agents {
     fi
 
     run_process q-meta "$AGENT_META_BINARY --config-file $NEUTRON_CONF --config-file=$Q_META_CONF_FILE"
-    run_process q-lbaas "$AGENT_LBAAS_BINARY --config-file $NEUTRON_CONF --config-file=$LBAAS_AGENT_CONF_FILENAME"
     run_process q-metering "$AGENT_METERING_BINARY --config-file $NEUTRON_CONF --config-file $METERING_AGENT_CONF_FILENAME"
 
     if [ "$VIRT_DRIVER" = 'xenserver' ]; then
@@ -808,9 +785,6 @@ function stop_neutron_other {
         stop_process q-meta
     fi
 
-    if is_service_enabled q-lbaas; then
-        neutron_lbaas_stop
-    fi
     if is_service_enabled q-fwaas; then
         neutron_fwaas_stop
     fi
@@ -915,7 +889,7 @@ function cleanup_neutron {
     fi
 
     # delete all namespaces created by neutron
-    for ns in $(sudo ip netns list | grep -o -E '(qdhcp|qrouter|qlbaas|fip|snat)-[0-9a-f-]*'); do
+    for ns in $(sudo ip netns list | grep -o -E '(qdhcp|qrouter|fip|snat)-[0-9a-f-]*'); do
         sudo ip netns delete ${ns}
     done
 }
@@ -1108,18 +1082,6 @@ function _configure_neutron_ceilometer_notifications {
     iniset $NEUTRON_CONF oslo_messaging_notifications driver messaging
 }
 
-function _configure_neutron_lbaas {
-    # Uses oslo config generator to generate LBaaS sample configuration files
-    (cd $NEUTRON_LBAAS_DIR && exec ./tools/generate_config_file_samples.sh)
-
-    if [ -f $NEUTRON_LBAAS_DIR/etc/neutron_lbaas.conf.sample ]; then
-        cp $NEUTRON_LBAAS_DIR/etc/neutron_lbaas.conf.sample $NEUTRON_CONF_DIR/neutron_lbaas.conf
-        iniset $NEUTRON_CONF_DIR/neutron_lbaas.conf service_providers service_provider $DEFAULT_LB_PROVIDER
-    fi
-    neutron_agent_lbaas_configure_common
-    neutron_agent_lbaas_configure_agent
-}
-
 function _configure_neutron_metering {
     neutron_agent_metering_configure_common
     neutron_agent_metering_configure_agent
diff --git a/lib/neutron_plugins/services/loadbalancer b/lib/neutron_plugins/services/loadbalancer
deleted file mode 100644
index 30e9480f2e..0000000000
--- a/lib/neutron_plugins/services/loadbalancer
+++ /dev/null
@@ -1,51 +0,0 @@
-#!/bin/bash
-
-# Neutron loadbalancer plugin
-# ---------------------------
-
-# Save trace setting
-_XTRACE_NEUTRON_LB=$(set +o | grep xtrace)
-set +o xtrace
-
-
-AGENT_LBAAS_BINARY="$NEUTRON_BIN_DIR/neutron-lbaas-agent"
-LBAAS_PLUGIN=neutron_lbaas.services.loadbalancer.plugin.LoadBalancerPlugin
-
-function neutron_agent_lbaas_install_agent_packages {
-    if is_ubuntu || is_fedora || is_suse; then
-        install_package haproxy
-    fi
-}
-
-function neutron_agent_lbaas_configure_common {
-    _neutron_service_plugin_class_add $LBAAS_PLUGIN
-    _neutron_deploy_rootwrap_filters $NEUTRON_LBAAS_DIR
-}
-
-function neutron_agent_lbaas_configure_agent {
-    LBAAS_AGENT_CONF_PATH=/etc/neutron/services/loadbalancer/haproxy
-    mkdir -p $LBAAS_AGENT_CONF_PATH
-
-    LBAAS_AGENT_CONF_FILENAME="$LBAAS_AGENT_CONF_PATH/lbaas_agent.ini"
-
-    cp $NEUTRON_LBAAS_DIR/etc/lbaas_agent.ini.sample $LBAAS_AGENT_CONF_FILENAME
-
-    # ovs_use_veth needs to be set before the plugin configuration
-    # occurs to allow plugins to override the setting.
-    iniset $LBAAS_AGENT_CONF_FILENAME DEFAULT ovs_use_veth $Q_OVS_USE_VETH
-
-    neutron_plugin_setup_interface_driver $LBAAS_AGENT_CONF_FILENAME
-
-    if is_fedora; then
-        iniset $LBAAS_AGENT_CONF_FILENAME DEFAULT user_group "nobody"
-        iniset $LBAAS_AGENT_CONF_FILENAME haproxy user_group "nobody"
-    fi
-}
-
-function neutron_lbaas_stop {
-    pids=$(ps aux | awk '/haproxy/ { print $2 }')
-    [ ! -z "$pids" ] && sudo kill $pids || true
-}
-
-# Restore xtrace
-$_XTRACE_NEUTRON_LB
diff --git a/stackrc b/stackrc
index 74d507cfa2..ffb3596be6 100644
--- a/stackrc
+++ b/stackrc
@@ -231,10 +231,6 @@ NEUTRON_BRANCH=${NEUTRON_BRANCH:-master}
 NEUTRON_FWAAS_REPO=${NEUTRON_FWAAS_REPO:-${GIT_BASE}/openstack/neutron-fwaas.git}
 NEUTRON_FWAAS_BRANCH=${NEUTRON_FWAAS_BRANCH:-master}
 
-# neutron lbaas service
-NEUTRON_LBAAS_REPO=${NEUTRON_LBAAS_REPO:-${GIT_BASE}/openstack/neutron-lbaas.git}
-NEUTRON_LBAAS_BRANCH=${NEUTRON_LBAAS_BRANCH:-master}
-
 # neutron vpnaas service
 NEUTRON_VPNAAS_REPO=${NEUTRON_VPNAAS_REPO:-${GIT_BASE}/openstack/neutron-vpnaas.git}
 NEUTRON_VPNAAS_BRANCH=${NEUTRON_VPNAAS_BRANCH:-master}

From 84d2298d3b97e43df8ec80f53bec15e8e61f8cdf Mon Sep 17 00:00:00 2001
From: Waldemar Znoinski <waldemar.znoinski@intel.com>
Date: Thu, 24 Mar 2016 12:27:53 +0000
Subject: [PATCH 0328/2409] Tox: don't check localrc with bashate

Change-Id: I9fc5f9f106184c92e555e25ab09883cbed054ca4
Closes-Bug: #1561500
---
 tox.ini | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tox.ini b/tox.ini
index 3dfc37711c..4ec293939e 100644
--- a/tox.ini
+++ b/tox.ini
@@ -18,6 +18,7 @@ commands = bash -c "find {toxinidir}             \
          -not \( -type d -name .?\* -prune \)    \
          -not \( -type d -name doc -prune \)     \
          -not \( -type d -name shocco -prune \)  \
+         -not \( -type f -name localrc -prune \) \
          -type f                                 \
          -not -name \*~                          \
          -not -name \*.md                        \

From 556eeb0d358746ed4587440093c2739fb0a57c2b Mon Sep 17 00:00:00 2001
From: Brant Knudson <bknudson@us.ibm.com>
Date: Thu, 24 Mar 2016 14:01:57 -0500
Subject: [PATCH 0329/2409] Drop keystone eventlet support

Keystone has dropped support for running under eventlet (using
keystone-all).

Change-Id: Ib38c0b1a54633a6b6dfa3a0a605cd2b02ca48989
---
 lib/keystone | 24 +++---------------------
 1 file changed, 3 insertions(+), 21 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 71f20ac0b0..d83092405b 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -61,7 +61,6 @@ KEYSTONE_USE_MOD_WSGI=${KEYSTONE_USE_MOD_WSGI:-${ENABLE_HTTPD_MOD_WSGI_SERVICES}
 
 # KEYSTONE_DEPLOY defines how keystone is deployed, allowed values:
 # - mod_wsgi : Run keystone under Apache HTTPd mod_wsgi
-# - eventlet : Run keystone-all
 # - uwsgi : Run keystone under uwsgi
 if [ -z "$KEYSTONE_DEPLOY" ]; then
     if [ -z "$KEYSTONE_USE_MOD_WSGI" ]; then
@@ -69,7 +68,7 @@ if [ -z "$KEYSTONE_DEPLOY" ]; then
     elif [ "$KEYSTONE_USE_MOD_WSGI" == True ]; then
         KEYSTONE_DEPLOY=mod_wsgi
     else
-        KEYSTONE_DEPLOY=eventlet
+        KEYSTONE_DEPLOY=uwsgi
     fi
 fi
 
@@ -283,7 +282,7 @@ function configure_keystone {
     if [ "$KEYSTONE_DEPLOY" == "mod_wsgi" ]; then
         iniset $KEYSTONE_CONF DEFAULT logging_exception_prefix "%(asctime)s.%(msecs)03d %(process)d TRACE %(name)s %(instance)s"
         _config_keystone_apache_wsgi
-    elif [ "$KEYSTONE_DEPLOY" == "uwsgi" ]; then
+    else # uwsgi
         # iniset creates these files when it's called if they don't exist.
         KEYSTONE_PUBLIC_UWSGI_FILE=$KEYSTONE_CONF_DIR/keystone-uwsgi-public.ini
         KEYSTONE_ADMIN_UWSGI_FILE=$KEYSTONE_CONF_DIR/keystone-uwsgi-admin.ini
@@ -321,20 +320,6 @@ function configure_keystone {
             # Make sure the client doesn't try to re-use the connection.
             iniset "$file" uwsgi add-header "Connection: close"
         done
-
-    else # eventlet
-        if is_ssl_enabled_service key; then
-            iniset $KEYSTONE_CONF eventlet_server_ssl enable True
-            iniset $KEYSTONE_CONF eventlet_server_ssl certfile $KEYSTONE_SSL_CERT
-            iniset $KEYSTONE_CONF eventlet_server_ssl keyfile $KEYSTONE_SSL_KEY
-        fi
-
-        iniset $KEYSTONE_CONF eventlet_server public_port $service_port
-        iniset $KEYSTONE_CONF eventlet_server admin_port $auth_port
-
-        iniset $KEYSTONE_CONF eventlet_server admin_bind_host "$KEYSTONE_ADMIN_BIND_HOST"
-        iniset $KEYSTONE_CONF eventlet_server admin_workers "$API_WORKERS"
-        # Public workers will use the server default, typically number of CPU.
     fi
 
     iniset $KEYSTONE_CONF DEFAULT max_token_size 16384
@@ -583,12 +568,9 @@ function start_keystone {
         restart_apache_server
         tail_log key /var/log/$APACHE_NAME/keystone.log
         tail_log key-access /var/log/$APACHE_NAME/keystone_access.log
-    elif [ "$KEYSTONE_DEPLOY" == "uwsgi" ]; then
+    else # uwsgi
         run_process key "$KEYSTONE_BIN_DIR/uwsgi $KEYSTONE_PUBLIC_UWSGI_FILE" "" "key-p"
         run_process key "$KEYSTONE_BIN_DIR/uwsgi $KEYSTONE_ADMIN_UWSGI_FILE" "" "key-a"
-    else # eventlet
-        # Start Keystone in a screen window
-        run_process key "$KEYSTONE_BIN_DIR/keystone-all --config-file $KEYSTONE_CONF"
     fi
 
     echo "Waiting for keystone to start..."

From 8b416ae821d8487f22d3d564c30da44d6cb2826a Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Fri, 25 Mar 2016 08:58:54 -0400
Subject: [PATCH 0330/2409] run swift blocks if any services are enabled

Previously the swift blocks only ran if s-proxy is enabled, which
prevents a multinode configuration. We should run these blocks if any
swift services are enabled, and push proxy specific conditionals one
step lower.

Change-Id: I540a97615b3c19f882c8673b1a4a29cd47e36aa8
---
 stack.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/stack.sh b/stack.sh
index 5c16f042d8..84eefd2304 100755
--- a/stack.sh
+++ b/stack.sh
@@ -799,7 +799,7 @@ if is_service_enabled keystone; then
     fi
 fi
 
-if is_service_enabled s-proxy; then
+if is_service_enabled swift; then
     if is_service_enabled ceilometer; then
         install_ceilometermiddleware
     fi
@@ -1118,7 +1118,7 @@ fi
 # Storage Service
 # ---------------
 
-if is_service_enabled s-proxy; then
+if is_service_enabled swift; then
     echo_summary "Configuring Swift"
     init_swift
 fi
@@ -1172,7 +1172,7 @@ merge_config_group $TOP_DIR/local.conf post-config
 # Only run the services specified in ``ENABLED_SERVICES``
 
 # Launch Swift Services
-if is_service_enabled s-proxy; then
+if is_service_enabled swift; then
     echo_summary "Starting Swift"
     start_swift
 fi

From 0948ab90ae2097da2d9e4f401cda3698e32621f4 Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Fri, 25 Mar 2016 19:39:43 -0400
Subject: [PATCH 0331/2409] Move auth setup earlier in tempest config

This commit moves the auth setup for tempest config to occur before
we run tempest verify-config. The API requests that command runs
require auth and in the case we run tempest without admin creds set
the config file will not have any credentials to run the query with.
By moving the auth setup to occur before this it will ensure tempest
is always configured with credentials before we run the command.

Change-Id: I6d11b24e4492f1fde3aa3a7a239c40d63111bfa1
---
 lib/tempest | 35 ++++++++++++++++++-----------------
 1 file changed, 18 insertions(+), 17 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 19b63d18da..ed26cafe2c 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -325,6 +325,24 @@ function configure_tempest {
     if [[ "$OFFLINE" != "True" ]]; then
         tox -revenv --notest
     fi
+
+    # Auth
+    iniset $TEMPEST_CONFIG auth tempest_roles "Member"
+    if [[ $TEMPEST_USE_TEST_ACCOUNTS == "True" ]]; then
+        if [[ $TEMPEST_HAS_ADMIN == "True" ]]; then
+            tempest-account-generator -c $TEMPEST_CONFIG --os-username $admin_username --os-password "$password" --os-tenant-name $admin_tenant_name -r $TEMPEST_CONCURRENCY --with-admin etc/accounts.yaml
+        else
+            tempest-account-generator -c $TEMPEST_CONFIG --os-username $admin_username --os-password "$password" --os-tenant-name $admin_tenant_name -r $TEMPEST_CONCURRENCY etc/accounts.yaml
+        fi
+        iniset $TEMPEST_CONFIG auth use_dynamic_credentials False
+        iniset $TEMPEST_CONFIG auth test_accounts_file "etc/accounts.yaml"
+    elif [[ $TEMPEST_HAS_ADMIN == "False" ]]; then
+        iniset $TEMPEST_CONFIG auth use_dynamic_credentials ${TEMPEST_ALLOW_TENANT_ISOLATION:-False}
+
+    else
+        iniset $TEMPEST_CONFIG auth use_dynamic_credentials ${TEMPEST_ALLOW_TENANT_ISOLATION:-True}
+    fi
+
     # NOTE(mtreinish): Respect constraints on tempest verify-config venv
     tox -evenv -- pip install -c $REQUIREMENTS_DIR/upper-constraints.txt -r requirements.txt
     tox -evenv -- tempest verify-config -uro $tmp_cfg_file
@@ -553,23 +571,6 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG service_available cinder "False"
     fi
 
-    # Auth
-    iniset $TEMPEST_CONFIG auth tempest_roles "Member"
-    if [[ $TEMPEST_USE_TEST_ACCOUNTS == "True" ]]; then
-        if [[ $TEMPEST_HAS_ADMIN == "True" ]]; then
-            tempest-account-generator -c $TEMPEST_CONFIG --os-username $admin_username --os-password "$password" --os-tenant-name $admin_tenant_name -r $TEMPEST_CONCURRENCY --with-admin etc/accounts.yaml
-        else
-            tempest-account-generator -c $TEMPEST_CONFIG --os-username $admin_username --os-password "$password" --os-tenant-name $admin_tenant_name -r $TEMPEST_CONCURRENCY etc/accounts.yaml
-        fi
-        iniset $TEMPEST_CONFIG auth use_dynamic_credentials False
-        iniset $TEMPEST_CONFIG auth test_accounts_file "etc/accounts.yaml"
-    elif [[ $TEMPEST_HAS_ADMIN == "False" ]]; then
-        iniset $TEMPEST_CONFIG auth use_dynamic_credentials ${TEMPEST_ALLOW_TENANT_ISOLATION:-False}
-
-    else
-        iniset $TEMPEST_CONFIG auth use_dynamic_credentials ${TEMPEST_ALLOW_TENANT_ISOLATION:-True}
-    fi
-
     # Restore IFS
     IFS=$ifs
 }

From fb94891b80e5bfa19acf8b261d68db108a147042 Mon Sep 17 00:00:00 2001
From: Thomas Bechtold <tbechtold@suse.com>
Date: Sun, 27 Mar 2016 08:59:42 +0200
Subject: [PATCH 0332/2409] Use configure_auth_token_middleware for neutron

auch configuration in the nova section in neutron.conf was
still setup manually. Just reuse the function
configure_auth_token_middleware() for configuration to simplify
the code.

Change-Id: Ib5a7e9212e2d1242bdbec75cf3fac13d5c42a2e2
---
 lib/neutron-legacy | 9 +--------
 1 file changed, 1 insertion(+), 8 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index e06a020f43..f38f14223b 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -1189,14 +1189,7 @@ function _configure_neutron_service {
     iniset $NEUTRON_CONF DEFAULT notify_nova_on_port_status_changes $Q_NOTIFY_NOVA_PORT_STATUS_CHANGES
     iniset $NEUTRON_CONF DEFAULT notify_nova_on_port_data_changes $Q_NOTIFY_NOVA_PORT_DATA_CHANGES
 
-    iniset $NEUTRON_CONF nova auth_type password
-    iniset $NEUTRON_CONF nova auth_url $KEYSTONE_AUTH_URI
-    iniset $NEUTRON_CONF nova username nova
-    iniset $NEUTRON_CONF nova password $SERVICE_PASSWORD
-    iniset $NEUTRON_CONF nova user_domain_id default
-    iniset $NEUTRON_CONF nova project_name $SERVICE_PROJECT_NAME
-    iniset $NEUTRON_CONF nova project_domain_id default
-    iniset $NEUTRON_CONF nova region_name $REGION_NAME
+    configure_auth_token_middleware $NEUTRON_CONF nova $NEUTRON_AUTH_CACHE_DIR nova
 
     # Configure plugin
     neutron_plugin_configure_service

From be00e95da5ae57c6aaa547ee01a5cab9a13862ca Mon Sep 17 00:00:00 2001
From: Rob Crittenden <rcritten@redhat.com>
Date: Thu, 24 Mar 2016 18:09:22 -0400
Subject: [PATCH 0333/2409] Add OS_CACERT to userrc_early and ensure
 SERVICE_HOST is SAN

OS_CACERT was being added directly to the environment rather
than usercc_early. This caused an untrusted CA error to be
thrown.

Ensure that SERVICE_HOST is in the Subject Alt. Names of the
issued TLS server cert. The gate sets it to 127.0.0.1 which
wasn't being handled. Only the FQDN of the host and actual
IP address of the machine were being added.

Change-Id: I8a91dffe1a5263d2bcc99ea406a8556045b52be2
---
 lib/tls  | 8 ++++++++
 stack.sh | 8 ++++----
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/lib/tls b/lib/tls
index f4740b88be..ca57ed44e0 100644
--- a/lib/tls
+++ b/lib/tls
@@ -257,6 +257,14 @@ function make_cert {
     local common_name=$3
     local alt_names=$4
 
+    if [ "$common_name" != "$SERVICE_HOST" ]; then
+        if [[ -z "$alt_names" ]]; then
+            alt_names="DNS:$SERVICE_HOST"
+        else
+            alt_names="$alt_names,DNS:$SERVICE_HOST"
+        fi
+    fi
+
     # Only generate the certificate if it doesn't exist yet on the disk
     if [ ! -r "$ca_dir/$cert_name.crt" ]; then
         # Generate a signing request
diff --git a/stack.sh b/stack.sh
index 5c16f042d8..b91c106ed8 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1004,10 +1004,6 @@ if is_service_enabled keystone; then
         bootstrap_keystone
     fi
 
-    if is_service_enabled tls-proxy; then
-        export OS_CACERT=$INT_CA_DIR/ca-chain.pem
-    fi
-
     # Rather than just export these, we write them out to a
     # intermediate userrc file that can also be used to debug if
     # something goes wrong between here and running
@@ -1028,6 +1024,10 @@ export OS_REGION_NAME=$REGION_NAME
 
 EOF
 
+    if is_service_enabled tls-proxy; then
+        echo "export OS_CACERT=$INT_CA_DIR/ca-chain.pem" >> $TOP_DIR/userrc_early
+    fi
+
     source $TOP_DIR/userrc_early
 
     create_keystone_accounts

From 70dcc17592c647600ec566686a1f63f2e802225e Mon Sep 17 00:00:00 2001
From: Andreas Jaeger <aj@suse.com>
Date: Mon, 28 Mar 2016 18:40:05 +0200
Subject: [PATCH 0334/2409] Remove libnspr4-dev for ceilometer-collector

Since change Ie38deadf190db33863c99d4610157349484ac10f ceilometer does
not use spidermonkey which needed libnspr4-dev to be installed. Thus the
requirement can be removed now.

Change-Id: Ib0685181f1cc4c9b58411a1679ac9dec1812f683
---
 files/debs/ceilometer-collector | 1 -
 1 file changed, 1 deletion(-)

diff --git a/files/debs/ceilometer-collector b/files/debs/ceilometer-collector
index d1e9eef3bb..c41f159c7a 100644
--- a/files/debs/ceilometer-collector
+++ b/files/debs/ceilometer-collector
@@ -1,3 +1,2 @@
-libnspr4-dev
 mongodb-server #NOPRIME
 python-pymongo #NOPRIME

From bb49d35739b6375202a4ff23d49fdced6693472c Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Mon, 28 Mar 2016 11:03:35 -0700
Subject: [PATCH 0335/2409] Run online_data_migrations during nova setup

This is a normal step in the process for upgrade and is now
required for migration of flavors from the main DB to the API DB.
Since we previously made a bad decision to encode those flavors into
the first database migration, that means that even on new installs we
need to run these.

Deployment tools are going to be running this command any time they
do anything to the database post-deployment, which means adding this
to devstack is putting it in line with what normal deployments will
be doing.

Change-Id: I8ab03af9d2f4974f26a7f8487ec978caea957e45
---
 lib/nova | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/nova b/lib/nova
index 2b8fefaf00..602a6ef8cf 100644
--- a/lib/nova
+++ b/lib/nova
@@ -708,6 +708,10 @@ function init_nova {
 
         recreate_database $NOVA_API_DB
         $NOVA_BIN_DIR/nova-manage api_db sync
+
+        # Run online migrations on the new databases
+        # Needed for flavor conversion
+        $NOVA_BIN_DIR/nova-manage db online_data_migrations
     fi
 
     create_nova_cache_dir

From de40d9234b2436c6279ca1f913d9a2c69c11976d Mon Sep 17 00:00:00 2001
From: Julien Danjou <julien@danjou.info>
Date: Tue, 29 Mar 2016 12:04:24 +0200
Subject: [PATCH 0336/2409] Remove Ceilometer leftover

Ceilometer uses a devstack plugin for a while now, so there should not
be any need for this file in the main devstack repository.

Change-Id: I3577c52b106c63c465a40ea3740eb5b8384e900e
---
 files/debs/ceilometer-collector      | 2 --
 files/rpms-suse/ceilometer-collector | 3 ---
 files/rpms/ceilometer-collector      | 3 ---
 3 files changed, 8 deletions(-)
 delete mode 100644 files/debs/ceilometer-collector
 delete mode 100644 files/rpms-suse/ceilometer-collector
 delete mode 100644 files/rpms/ceilometer-collector

diff --git a/files/debs/ceilometer-collector b/files/debs/ceilometer-collector
deleted file mode 100644
index c41f159c7a..0000000000
--- a/files/debs/ceilometer-collector
+++ /dev/null
@@ -1,2 +0,0 @@
-mongodb-server #NOPRIME
-python-pymongo #NOPRIME
diff --git a/files/rpms-suse/ceilometer-collector b/files/rpms-suse/ceilometer-collector
deleted file mode 100644
index fc75ffad63..0000000000
--- a/files/rpms-suse/ceilometer-collector
+++ /dev/null
@@ -1,3 +0,0 @@
-# (devel:languages:python and server:database projects)
-mongodb
-# Not available in openSUSE main repositories, but can be fetched from OBS
diff --git a/files/rpms/ceilometer-collector b/files/rpms/ceilometer-collector
deleted file mode 100644
index a8b81187ed..0000000000
--- a/files/rpms/ceilometer-collector
+++ /dev/null
@@ -1,3 +0,0 @@
-mongodb # NOPRIME
-mongodb-server #NOPRIME
-selinux-policy-targeted

From 908a3a952300ae5ff8a00392ee2b5577ea5c6e7d Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 29 Mar 2016 14:47:09 +1100
Subject: [PATCH 0337/2409] Add total timings

Printing the total makes it easier to compare runs at a glance.  Clean
up the output a little, and use some consistent, name-spaced globals
while we're there.

Note the total runtime is at the top to avoid giving the impression
that it is the sum of the components below, since you can nest/overlap
timers (I made that mistake in a prior change :).  It might be a fun
exercise in tree building to one day track the overlaps and present a
nice nested breakdown.

Change-Id: I878ce03813d21138df493b82bceff3aaa7f83064
---
 functions-common | 54 ++++++++++++++++++++++++++++++++++--------------
 1 file changed, 38 insertions(+), 16 deletions(-)

diff --git a/functions-common b/functions-common
index 5ae974558a..b0352d38c6 100644
--- a/functions-common
+++ b/functions-common
@@ -2322,8 +2322,9 @@ function sudo_with_proxies {
 # Resolution is only in whole seconds, so should be used for long
 # running activities.
 
-declare -A TOTAL_TIME
-declare -A START_TIME
+declare -A _TIME_TOTAL
+declare -A _TIME_START
+declare -r _TIME_BEGIN=$(date +%s)
 
 # time_start $name
 #
@@ -2331,11 +2332,11 @@ declare -A START_TIME
 # already started.
 function time_start {
     local name=$1
-    local start_time=${START_TIME[$name]}
+    local start_time=${_TIME_START[$name]}
     if [[ -n "$start_time" ]]; then
         die $LINENO "Trying to start the clock on $name, but it's already been started"
     fi
-    START_TIME[$name]=$(date +%s)
+    _TIME_START[$name]=$(date +%s)
 }
 
 # time_stop $name
@@ -2351,32 +2352,53 @@ function time_stop {
     local start_time
 
     name=$1
-    start_time=${START_TIME[$name]}
+    start_time=${_TIME_START[$name]}
 
     if [[ -z "$start_time" ]]; then
         die $LINENO "Trying to stop the clock on $name, but it was never started"
     fi
     end_time=$(date +%s)
     elapsed_time=$(($end_time - $start_time))
-    total=${TOTAL_TIME[$name]:-0}
+    total=${_TIME_TOTAL[$name]:-0}
     # reset the clock so we can start it in the future
-    START_TIME[$name]=""
-    TOTAL_TIME[$name]=$(($total + $elapsed_time))
+    _TIME_START[$name]=""
+    _TIME_TOTAL[$name]=$(($total + $elapsed_time))
 }
 
 # time_totals
-#
-# prints out total time
+#  Print out total time summary
 function time_totals {
+    local elapsed_time
+    local end_time
+    local len=15
+    local xtrace
+
+    end_time=$(date +%s)
+    elapsed_time=$(($end_time - $_TIME_BEGIN))
+
+    # pad 1st column this far
+    for t in ${!_TIME_TOTAL[*]}; do
+        if [[ ${#t} -gt $len ]]; then
+            len=${#t}
+        fi
+    done
+
+    xtrace=$(set +o | grep xtrace)
+    set +o xtrace
+
     echo
-    echo "========================"
-    echo "DevStack Components Timed"
-    echo "========================"
+    echo "========================="
+    echo "DevStack Component Timing"
+    echo "========================="
+    printf "%-${len}s %3d\n" "Total runtime" "$elapsed_time"
     echo
-    for t in ${!TOTAL_TIME[*]}; do
-        local v=${TOTAL_TIME[$t]}
-        echo "$t - $v secs"
+    for t in ${!_TIME_TOTAL[*]}; do
+        local v=${_TIME_TOTAL[$t]}
+        printf "%-${len}s %3d\n" "$t" "$v"
     done
+    echo "========================="
+
+    $xtrace
 }
 
 # Restore xtrace

From e256174d9ada372555f1cd6fbbf0680c5c945c60 Mon Sep 17 00:00:00 2001
From: Ethan Lynn <xjunlin@cn.ibm.com>
Date: Wed, 30 Mar 2016 23:40:56 +0800
Subject: [PATCH 0338/2409] Correct openrc script for zsh

Since commit 7580a0c3e37932a8fc03750d35ccd4e13e18f8c4, openrc
print a WARNING message to stdout, it will break the zsh script
in faq.rst. This patch redirect openrc output to /dev/null.

Change-Id: Iaba03634d7a234cd4d120477f91ef56d0595cdf6
Closes-Bug: #1563940
---
 doc/source/faq.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/faq.rst b/doc/source/faq.rst
index cd4891519b..7793d8eb68 100644
--- a/doc/source/faq.rst
+++ b/doc/source/faq.rst
@@ -85,7 +85,7 @@ through bash for this
 
    function sourceopenrc {
        pushd ~/devstack >/dev/null
-       eval $(bash -c ". openrc $1 $2;env|sed -n '/OS_/ { s/^/export /;p}'")
+       eval $(bash -c ". openrc $1 $2 >/dev/null;env|sed -n '/OS_/ { s/^/export /;p}'")
        popd >/dev/null
    }
 

From 7a9d78a59e7a1b7bcba390c18d6f5ca3a07bf4b4 Mon Sep 17 00:00:00 2001
From: Davanum Srinivas <davanum@gmail.com>
Date: Thu, 31 Mar 2016 09:54:42 -0400
Subject: [PATCH 0339/2409] Cleanup from zookeeper->dlm change

In I33525e2b83a4497a57ec95f62880e0308c88b34f, we switched
from zookeeper to dlm. Somehow this got left behind.

Change-Id: I41d13d33c9a81271d4a9752cbe98c0028a17ab1e
---
 unstack.sh | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/unstack.sh b/unstack.sh
index 7a7c945c8a..83703ec28a 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -175,10 +175,6 @@ if is_service_enabled dstat; then
     stop_dstat
 fi
 
-if is_service_enabled zookeeper; then
-    stop_zookeeper
-fi
-
 # Clean up the remainder of the screen processes
 SCREEN=$(which screen)
 if [[ -n "$SCREEN" ]]; then

From 087ed52cb523956ccace89ba11483207f663abf1 Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Wed, 16 Mar 2016 11:53:09 -0400
Subject: [PATCH 0340/2409] Neutron: MTU settings are now sane, so remove from
 DevStack

Neutron had a lot of work done during the Mitaka cycle to fix MTU
issues, so let's see if Neutron can stand on its own.

This commit reverts 06cfce37560243d22cd05b2c620be6702528a0b1

Neutron patches:
I6ffc8973c9b8f46cc19922ff04fdd2d23646b878
I4096a3e7704032fa4aa5c3aa8bcaec4e38d0d06d
I6a10c4dfc1f2198667f3d02528e2ca8020cb5bb8
Ic091fa78dfd133179c71cbc847bf955a06cb248a
Idf6221fee2c7da86123b330ad3c235ecc6868242
I6859ebdde1f7e3a8163b49d705620e522ada606a

Change-Id: Ie88c7ebb29adadde530217c95e2f38aacb119dc8
---
 doc/source/guides/neutron.rst | 13 +++++++++----
 lib/neutron_plugins/ml2       | 12 ------------
 2 files changed, 9 insertions(+), 16 deletions(-)

diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index cac7bb0152..1c43c119f6 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -443,13 +443,18 @@ Miscellaneous Tips
 Non-Standard MTU on the Physical Network
 ----------------------------------------
 
-DevStack defaults to assume that the MTU on the physical network
-is 1500.  A different MTU can be specified by adding the following to
-the `localrc` part of `local.conf` on each machine.
+Neutron by default uses a MTU of 1500 bytes, which is
+the standard MTU for Ethernet.
+
+A different MTU can be specified by adding the following to
+the Neutron section of `local.conf`. For example,
+if you have network equipment that supports jumbo frames, you could
+set the MTU to 9000 bytes by adding the following
 
 ::
 
-    Q_ML2_PLUGIN_PATH_MTU=1500
+    [[post-config|/$Q_PLUGIN_CONF_FILE]]
+    global_physnet_mtu = 9000
 
 
 Disabling Next Generation Firewall Tools
diff --git a/lib/neutron_plugins/ml2 b/lib/neutron_plugins/ml2
index 0483ef1fac..30e1b036f3 100644
--- a/lib/neutron_plugins/ml2
+++ b/lib/neutron_plugins/ml2
@@ -40,12 +40,6 @@ Q_ML2_PLUGIN_EXT_DRIVERS=${Q_ML2_PLUGIN_EXT_DRIVERS-port_security}
 # L3 Plugin to load for ML2
 ML2_L3_PLUGIN=${ML2_L3_PLUGIN:-neutron.services.l3_router.l3_router_plugin.L3RouterPlugin}
 
-# Underlying path MTU for physical network managing br-tun; use '-' instead of
-# ':-' to allow people to explicitly override this to blank, to disable
-# automatic MTU calculation for tunnelled tenant networks
-Q_ML2_PLUGIN_PATH_MTU=${Q_ML2_PLUGIN_PATH_MTU-1500}
-
-
 function populate_ml2_config {
     CONF=$1
     SECTION=$2
@@ -83,12 +77,6 @@ function neutron_plugin_configure_service {
         echo "WARNING - The ml2 plugin is using local tenant networks, with no connectivity between hosts."
     fi
 
-    # Enable ml2 mtu calculation mechanism for networks by providing path mtu
-    # value for physical devices that are used for br-tun traffic
-    if [[ "$ENABLE_TENANT_TUNNELS" == "True" ]] && [[ "$Q_ML2_PLUGIN_PATH_MTU" != "" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE ml2 path_mtu "$Q_ML2_PLUGIN_PATH_MTU"
-    fi
-
     # Allow for overrding VLAN configuration (for example, to configure provider
     # VLANs) by first checking if Q_ML2_PLUGIN_VLAN_TYPE_OPTIONS is set.
     if [ "$Q_ML2_PLUGIN_VLAN_TYPE_OPTIONS" == "" ]; then

From 6099401e002f228daf5110e1dd0a530dc1c737fc Mon Sep 17 00:00:00 2001
From: fumihiko kakuma <kakuma@valinux.co.jp>
Date: Tue, 8 Mar 2016 20:55:01 +0900
Subject: [PATCH 0341/2409] In worlddump, cover all supported version of
 OpenFlow protocol by ovs-ofctl

Currently ovs-ofctl command is executed for only default ofp version
(OpenFlow10).
Some Neutron's plugin uses OpenFlow13 and in that case ovs-ofctl fails.
This chage allows us to get ovs info for all ofp versions supported by ovs.
And adds dump by dump-ports and dump-ports-desc.

Change-Id: I2d3c42835a5ad0f5ebf540e8127762f466347c9c
---
 tools/worlddump.py | 31 +++++++++++++++++++++++++++----
 1 file changed, 27 insertions(+), 4 deletions(-)

diff --git a/tools/worlddump.py b/tools/worlddump.py
index 72a257fa8c..345c2a3d94 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -76,6 +76,24 @@ def _header(name):
     print
 
 
+# This method gets a max openflow version supported by openvswitch.
+# For example 'ovs-ofctl --version' displays the following:
+#
+#     ovs-ofctl (Open vSwitch) 2.0.2
+#     Compiled Dec  9 2015 14:08:08
+#     OpenFlow versions 0x1:0x4
+#
+# The above shows that openvswitch supports from OpenFlow11 to OpenFlow13.
+# This method gets max version searching 'OpenFlow versions 0x1:0x'.
+# And return a version value converted to an integer type.
+def _get_ofp_version():
+    process = subprocess.Popen(['ovs-ofctl', '--version'], stdout=subprocess.PIPE)
+    stdout, _ = process.communicate()
+    find_str = 'OpenFlow versions 0x1:0x'
+    offset = stdout.find(find_str)
+    return int(stdout[offset + len(find_str):-1]) - 1
+
+
 def disk_space():
     # the df output
     _header("File System Summary")
@@ -143,11 +161,16 @@ def ovs_dump():
     # grenade), so there is no single place to determine the bridge names from.
     # Hardcode for now.
     bridges = ('br-int', 'br-tun', 'br-ex')
+    ofctl_cmds = ('show', 'dump-ports-desc', 'dump-ports', 'dump-flows')
+    ofp_max = _get_ofp_version()
+    vers = 'OpenFlow10'
+    for i in range(ofp_max + 1):
+        vers += ',OpenFlow1' + str(i)
     _dump_cmd("sudo ovs-vsctl show")
-    for bridge in bridges:
-        _dump_cmd("sudo ovs-ofctl show %s" % bridge)
-    for bridge in bridges:
-        _dump_cmd("sudo ovs-ofctl dump-flows %s" % bridge)
+    for ofctl_cmd in ofctl_cmds:
+        for bridge in bridges:
+            args = {'vers': vers, 'cmd': ofctl_cmd, 'bridge': bridge}
+            _dump_cmd("sudo ovs-ofctl --protocols=%(vers)s %(cmd)s %(bridge)s" % args)
 
 
 def process_list():

From 1c7333c40ece0199761fa6e2ab93a9ed143240ad Mon Sep 17 00:00:00 2001
From: Komei Shimamura <komei.t.f@gmail.com>
Date: Sun, 3 Apr 2016 01:08:38 +0900
Subject: [PATCH 0342/2409] Add kafka-devstack-plugin to plugin-registry.rst

kafka-devstack-plugin is available now:

  Iceb054f0dfab2fff1920cc7dc36a4be256c6f161

Change-Id: I518bd079296a110a018f77b9b107883f3933e38a
---
 doc/source/plugin-registry.rst | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 136a9e4e92..b4671234ed 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -60,6 +60,8 @@ projects.
 +----------------------------+-------------------------------------------------------------------------+
 |devstack-plugin-hdfs        |git://git.openstack.org/openstack/devstack-plugin-hdfs                   |
 +----------------------------+-------------------------------------------------------------------------+
+|devstack-plugin-kafka       |git://git.openstack.org/openstack/devstack-plugin-kafka                  |
++----------------------------+-------------------------------------------------------------------------+
 |devstack-plugin-pika        |git://git.openstack.org/openstack/devstack-plugin-pika                   |
 +----------------------------+-------------------------------------------------------------------------+
 |devstack-plugin-sheepdog    |git://git.openstack.org/openstack/devstack-plugin-sheepdog               |

From 930bc437affea40ba0876770f902ff5483b423b9 Mon Sep 17 00:00:00 2001
From: Clint Adams <clint@gcfm.net>
Date: Sat, 2 Apr 2016 15:11:45 -0400
Subject: [PATCH 0343/2409] Plugin autogen list: put plugin names in the plugin
 names column

Change-Id: I1f2c66fa1bf8fd73ee6693d4919e33e3f14487c5
---
 tools/generate-devstack-plugins-list.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/generate-devstack-plugins-list.sh b/tools/generate-devstack-plugins-list.sh
index 82486f5b2d..c3c8f24dbd 100644
--- a/tools/generate-devstack-plugins-list.sh
+++ b/tools/generate-devstack-plugins-list.sh
@@ -75,7 +75,7 @@ title_underline ${name_col_len}
 for plugin in ${sorted_plugins}; do
     giturl="git://git.openstack.org/openstack/${plugin}"
     gitlink="https://git.openstack.org/cgit/openstack/${plugin}"
-    printf "%-${name_col_len}s %s\n" "${p}" "\`${giturl} <${gitlink}>\`__"
+    printf "%-${name_col_len}s %s\n" "${plugin}" "\`${giturl} <${gitlink}>\`__"
 done
 
 if [[ -r data/devstack-plugins-registry.footer ]]; then

From 76392b5b44103c1ed061f4e2f1bae8ca6767c6a6 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 4 Apr 2016 09:07:08 -0400
Subject: [PATCH 0344/2409] change internal variables from tenant_id ->
 project_id

As part of the "reduce confusion on tenant_id" we need to change as
many references as possible over to project_id.

Change-Id: Ia665312f24672b106e12fde93b60f142620c3a45
---
 lib/tempest | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index ed26cafe2c..d8790f8345 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -180,14 +180,14 @@ function configure_tempest {
 
     # See ``lib/keystone`` where these users and tenants are set up
     local admin_username=${ADMIN_USERNAME:-admin}
-    local admin_tenant_name=${ADMIN_TENANT_NAME:-admin}
+    local admin_project_name=${ADMIN_TENANT_NAME:-admin}
     local admin_domain_name=${ADMIN_DOMAIN_NAME:-Default}
     local tempest_username=${TEMPEST_USERNAME:-demo}
-    local tempest_tenant_name=${TEMPEST_TENANT_NAME:-demo}
+    local tempest_project_name=${TEMPEST_TENANT_NAME:-demo}
     local alt_username=${ALT_USERNAME:-alt_demo}
-    local alt_tenant_name=${ALT_TENANT_NAME:-alt_demo}
-    local admin_tenant_id
-    admin_tenant_id=$(openstack project list | awk "/ admin / { print \$2 }")
+    local alt_project_name=${ALT_TENANT_NAME:-alt_demo}
+    local admin_project_id
+    admin_project_id=$(openstack project list | awk "/ admin / { print \$2 }")
 
     if is_service_enabled nova; then
         # If ``DEFAULT_INSTANCE_TYPE`` is not declared, use the new behavior
@@ -263,8 +263,8 @@ function configure_tempest {
     if [[ "$TEMPEST_HAS_ADMIN" == "True" ]]; then
         iniset $TEMPEST_CONFIG auth admin_username $admin_username
         iniset $TEMPEST_CONFIG auth admin_password "$password"
-        iniset $TEMPEST_CONFIG auth admin_tenant_name $admin_tenant_name
-        iniset $TEMPEST_CONFIG auth admin_tenant_id $admin_tenant_id
+        iniset $TEMPEST_CONFIG auth admin_tenant_name $admin_project_name
+        iniset $TEMPEST_CONFIG auth admin_tenant_id $admin_project_id
         iniset $TEMPEST_CONFIG auth admin_domain_name $admin_domain_name
     fi
     if [ "$ENABLE_IDENTITY_V2" == "False" ]; then
@@ -330,9 +330,9 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG auth tempest_roles "Member"
     if [[ $TEMPEST_USE_TEST_ACCOUNTS == "True" ]]; then
         if [[ $TEMPEST_HAS_ADMIN == "True" ]]; then
-            tempest-account-generator -c $TEMPEST_CONFIG --os-username $admin_username --os-password "$password" --os-tenant-name $admin_tenant_name -r $TEMPEST_CONCURRENCY --with-admin etc/accounts.yaml
+            tempest-account-generator -c $TEMPEST_CONFIG --os-username $admin_username --os-password "$password" --os-tenant-name $admin_project_name -r $TEMPEST_CONCURRENCY --with-admin etc/accounts.yaml
         else
-            tempest-account-generator -c $TEMPEST_CONFIG --os-username $admin_username --os-password "$password" --os-tenant-name $admin_tenant_name -r $TEMPEST_CONCURRENCY etc/accounts.yaml
+            tempest-account-generator -c $TEMPEST_CONFIG --os-username $admin_username --os-password "$password" --os-tenant-name $admin_project_name -r $TEMPEST_CONCURRENCY etc/accounts.yaml
         fi
         iniset $TEMPEST_CONFIG auth use_dynamic_credentials False
         iniset $TEMPEST_CONFIG auth test_accounts_file "etc/accounts.yaml"

From ab0a1b881225f83cfe6454091881d5ffd6626a65 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 4 Apr 2016 09:09:27 -0400
Subject: [PATCH 0345/2409] change cinder SC to use $(project_id)

This removes another place where we reference tenant_id

Change-Id: I88fa1c5475105c301b27672b028bddb289f9c108
---
 lib/cinder | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 1b6a956f8f..4df7de8959 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -375,17 +375,17 @@ function create_cinder_accounts {
         get_or_create_endpoint \
             "volume" \
             "$REGION_NAME" \
-            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/\$(tenant_id)s" \
-            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/\$(tenant_id)s" \
-            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/\$(tenant_id)s"
+            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/\$(project_id)s" \
+            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/\$(project_id)s" \
+            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/\$(project_id)s"
 
         get_or_create_service "cinderv2" "volumev2" "Cinder Volume Service V2"
         get_or_create_endpoint \
             "volumev2" \
             "$REGION_NAME" \
-            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v2/\$(tenant_id)s" \
-            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v2/\$(tenant_id)s" \
-            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v2/\$(tenant_id)s"
+            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v2/\$(project_id)s" \
+            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v2/\$(project_id)s" \
+            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v2/\$(project_id)s"
     fi
 }
 

From cbdc5d9e48d9d91fcc7a667839d592ff85ed1f09 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 4 Apr 2016 09:10:44 -0400
Subject: [PATCH 0346/2409] switch over heat to using $(project_id) in service
 catalog

This removes one more place where we reference tenant_id

Change-Id: I721269c3397bd5e5d9cea5faf3fc691f296a517b
---
 lib/heat | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/heat b/lib/heat
index 2cf7a19d40..4326321bd1 100644
--- a/lib/heat
+++ b/lib/heat
@@ -391,9 +391,9 @@ function create_heat_accounts {
         get_or_create_endpoint \
             "orchestration" \
             "$REGION_NAME" \
-            "$SERVICE_PROTOCOL://$HEAT_API_HOST:$HEAT_API_PORT/v1/\$(tenant_id)s" \
-            "$SERVICE_PROTOCOL://$HEAT_API_HOST:$HEAT_API_PORT/v1/\$(tenant_id)s" \
-            "$SERVICE_PROTOCOL://$HEAT_API_HOST:$HEAT_API_PORT/v1/\$(tenant_id)s"
+            "$SERVICE_PROTOCOL://$HEAT_API_HOST:$HEAT_API_PORT/v1/\$(project_id)s" \
+            "$SERVICE_PROTOCOL://$HEAT_API_HOST:$HEAT_API_PORT/v1/\$(project_id)s" \
+            "$SERVICE_PROTOCOL://$HEAT_API_HOST:$HEAT_API_PORT/v1/\$(project_id)s"
 
         get_or_create_service "heat-cfn" "cloudformation" "Heat CloudFormation Service"
         get_or_create_endpoint \

From 2a9a9df942d68431b893fdfd83eec24fb7999391 Mon Sep 17 00:00:00 2001
From: Sean McGinnis <sean_mcginnis@dell.com>
Date: Mon, 4 Apr 2016 13:58:59 -0500
Subject: [PATCH 0347/2409] Remove driver certs directory

Cinder was the only project with a script in driver_certs. That cert is
no longer required for Cinder as we now just require that third party CI
is run for all drivers before acceptance.

This removes the cinder cert test script and the now empty driver_certs
directory.

Change-Id: I8d0867c4720f324b8dbf3c64ddf66ff267996d10
---
 driver_certs/cinder_driver_cert.sh | 106 -----------------------------
 1 file changed, 106 deletions(-)
 delete mode 100755 driver_certs/cinder_driver_cert.sh

diff --git a/driver_certs/cinder_driver_cert.sh b/driver_certs/cinder_driver_cert.sh
deleted file mode 100755
index d066e0667f..0000000000
--- a/driver_certs/cinder_driver_cert.sh
+++ /dev/null
@@ -1,106 +0,0 @@
-#!/usr/bin/env bash
-
-# **cinder_cert.sh**
-
-# This script is a simple wrapper around the tempest volume api tests
-# It requires that you have a working and functional devstack install
-# and that you've enabled your device driver by making the necessary
-# modifications to /etc/cinder/cinder.conf
-
-# This script will refresh your openstack repo's and restart the cinder
-# services to pick up your driver changes.
-# please NOTE; this script assumes your devstack install is functional
-# and includes tempest. A good first step is to make sure you can
-# create volumes on your device before you even try and run this script.
-
-# It also assumes default install location (/opt/stack/xxx)
-# to aid in debug, you should also verify that you've added
-# an output directory for screen logs:
-#
-#     SCREEN_LOGDIR=/opt/stack/screen-logs
-
-set -o pipefail
-
-CERT_DIR=$(cd $(dirname "$0") && pwd)
-TOP_DIR=$(cd $CERT_DIR/..; pwd)
-
-source $TOP_DIR/functions
-source $TOP_DIR/stackrc
-source $TOP_DIR/openrc
-source $TOP_DIR/lib/infra
-source $TOP_DIR/lib/tempest
-source $TOP_DIR/lib/cinder
-
-TEMPFILE=`mktemp`
-RECLONE=True
-
-function log_message {
-    MESSAGE=$1
-    STEP_HEADER=$2
-    if [[ "$STEP_HEADER" = "True" ]]; then
-        echo -e "\n========================================================" | tee -a $TEMPFILE
-    fi
-    echo -e `date +%m/%d/%y/%T:`"${MESSAGE}" | tee -a $TEMPFILE
-    if [[ "$STEP_HEADER" = "True" ]]; then
-        echo -e "========================================================" | tee -a $TEMPFILE
-    fi
-}
-
-if [[ "$OFFLINE" = "True" ]]; then
-    echo "ERROR: Driver cert requires fresh clone/pull from ${CINDER_BRANCH}"
-    echo "       Please set OFFLINE=False and retry."
-    exit 1
-fi
-
-log_message "RUNNING CINDER DRIVER CERTIFICATION CHECK", True
-log_message "Output is being logged to: $TEMPFILE"
-
-cd $CINDER_DIR
-log_message "Cloning to ${CINDER_REPO}...", True
-install_cinder
-
-log_message "Pull a fresh Clone of cinder repo...", True
-git status | tee -a $TEMPFILE
-git log --pretty=oneline -n 1 | tee -a $TEMPFILE
-
-log_message "Gathering copy of cinder.conf file (passwords will be scrubbed)...", True
-cat /etc/cinder/cinder.conf | egrep -v "(^#.*|^$)" | tee -a $TEMPFILE
-sed -i "s/\(.*password.*=\).*$/\1 xxx/i" $TEMPFILE
-log_message "End of cinder.conf.", True
-
-cd $TOP_DIR
-# Verify tempest is installed/enabled
-if ! is_service_enabled tempest; then
-    log_message "ERROR!!! Cert requires tempest in enabled_services!", True
-    log_message"       Please add tempest to enabled_services and retry."
-    exit 1
-fi
-
-cd $TEMPEST_DIR
-install_tempest
-
-log_message "Verify tempest is current....", True
-git status | tee -a $TEMPFILE
-log_message "Check status and get latest commit..."
-git log --pretty=oneline -n 1 | tee -a $TEMPFILE
-
-
-#stop and restart cinder services
-log_message "Restart Cinder services...", True
-stop_cinder
-sleep 1
-start_cinder
-sleep 5
-
-# run tempest api/volume/test_*
-log_message "Run the actual tempest volume tests (./tools/pretty_tox.sh volume)...", True
-./tools/pretty_tox.sh volume 2>&1 | tee -a $TEMPFILE
-if [[ $? = 0 ]]; then
-    log_message "CONGRATULATIONS!!!  Device driver PASSED!", True
-    log_message "Submit output: ($TEMPFILE)"
-    exit 0
-else
-    log_message "SORRY!!!  Device driver FAILED!", True
-    log_message "Check output in $TEMPFILE"
-    exit 1
-fi

From 2bd2568bd186162f44814d149030368cfa2db006 Mon Sep 17 00:00:00 2001
From: fumihiko kakuma <kakuma@valinux.co.jp>
Date: Tue, 5 Apr 2016 10:33:50 +0900
Subject: [PATCH 0348/2409] Fix a typo in comment for _get_ofp_version

OpenFlow11 -> OpenFlow10

Change-Id: I2a501ccd32f5f7a39fd4bc746f00ca3f67bd98c1
---
 tools/worlddump.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/worlddump.py b/tools/worlddump.py
index 345c2a3d94..3ff22a9dfd 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -83,7 +83,7 @@ def _header(name):
 #     Compiled Dec  9 2015 14:08:08
 #     OpenFlow versions 0x1:0x4
 #
-# The above shows that openvswitch supports from OpenFlow11 to OpenFlow13.
+# The above shows that openvswitch supports from OpenFlow10 to OpenFlow13.
 # This method gets max version searching 'OpenFlow versions 0x1:0x'.
 # And return a version value converted to an integer type.
 def _get_ofp_version():

From 260583e25eabffd70942c7d97df09a5dd2ed55d6 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 4 Apr 2016 09:11:25 -0400
Subject: [PATCH 0349/2409] Switch over swift to using $(project_id) in service
 catalog

This removes one more place where we use tenant_id in our code.

Change-Id: I628fb7c1dd6f22ce499fc5cbe97b79458cce966f
---
 lib/swift | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/swift b/lib/swift
index 8c5aa5e4e8..b2fe755cef 100644
--- a/lib/swift
+++ b/lib/swift
@@ -631,9 +631,9 @@ function create_swift_accounts {
     get_or_create_endpoint \
         "object-store" \
         "$REGION_NAME" \
-        "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$SWIFT_DEFAULT_BIND_PORT/v1/AUTH_\$(tenant_id)s" \
+        "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$SWIFT_DEFAULT_BIND_PORT/v1/AUTH_\$(project_id)s" \
         "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$SWIFT_DEFAULT_BIND_PORT" \
-        "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$SWIFT_DEFAULT_BIND_PORT/v1/AUTH_\$(tenant_id)s"
+        "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$SWIFT_DEFAULT_BIND_PORT/v1/AUTH_\$(project_id)s"
 
     local swift_tenant_test1
     swift_tenant_test1=$(get_or_create_project swifttenanttest1 default)

From 4b205db45b34e698734740b50752e11b75035e72 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Mon, 4 Apr 2016 10:37:11 -0700
Subject: [PATCH 0350/2409] Create default flavors in nova

This makes devstack create default flavors in nova, like cinder, now
that nova no longer hard-codes them into its database.

The flavors created here match the legacy default flavors that nova
kept for so long, and also creates a new devstack-namespaces set of
flavors which are likely more useful for people.

Change-Id: Ic275887e97221d9ce5ce6f12cdcfb5ac94e300b0
---
 lib/nova | 19 +++++++++++++++++++
 stack.sh |  1 +
 2 files changed, 20 insertions(+)

diff --git a/lib/nova b/lib/nova
index ab2bef8ae0..40d7a9b0fd 100644
--- a/lib/nova
+++ b/lib/nova
@@ -932,6 +932,25 @@ function stop_nova {
     stop_nova_compute
 }
 
+# create_instance_types(): Create default flavors
+function create_flavors {
+    if ! openstack flavor list | grep -q ds512M; then
+    # Note that danms hates these flavors and apologizes for sdague
+        openstack flavor create --id c1 --ram 256 --disk 0 --vcpus 1 cirros256
+        openstack flavor create --id d1 --ram 512 --disk 5 --vcpus 1 ds512M
+        openstack flavor create --id d2 --ram 1024 --disk 10 --vcpus 1 ds1G
+        openstack flavor create --id d3 --ram 2048 --disk 10 --vcpus 2 ds2G
+        openstack flavor create --id d4 --ram 4096 --disk 20 --vcpus 4 ds4G
+    fi
+
+    if ! openstack flavor list | grep -q m1.tiny; then
+        openstack flavor create --id 1 --ram 512 --disk 1 --vcpus 1 m1.tiny
+        openstack flavor create --id 2 --ram 2048 --disk 20 --vcpus 1 m1.small
+        openstack flavor create --id 3 --ram 4096 --disk 40 --vcpus 2 m1.medium
+        openstack flavor create --id 4 --ram 8192 --disk 80 --vcpus 4 m1.large
+        openstack flavor create --id 5 --ram 16384 --disk 160 --vcpus 8 m1.xlarge
+    fi
+}
 
 # Restore xtrace
 $_XTRACE_LIB_NOVA
diff --git a/stack.sh b/stack.sh
index 793b7dc389..6e1fe37f2a 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1251,6 +1251,7 @@ fi
 if is_service_enabled nova; then
     echo_summary "Starting Nova"
     start_nova
+    create_flavors
 fi
 if is_service_enabled cinder; then
     echo_summary "Starting Cinder"

From 2bebf2d8d8c249d25c44a4d4cc6a9fecf8fcd454 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Tue, 5 Apr 2016 10:34:42 -0400
Subject: [PATCH 0351/2409] Skip rescue tests for cells v1

The rescue tests in Tempest don't work with cells v1 so
let's skip them.

Change-Id: I234f778c9d264ee2e5fe6050ca6b33283be464f7
---
 lib/tempest | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index d8790f8345..67b631e596 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -398,6 +398,8 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG compute-feature-enabled shelve False
         # Cells doesn't support hot-plugging virtual interfaces.
         iniset $TEMPEST_CONFIG compute-feature-enabled interface_attach False
+        # Cells v1 doesn't support the rescue/unrescue tests in Tempest
+        iniset $TEMPEST_CONFIG compute-feature-enabled rescue False
 
         if  [[ -z "$DEFAULT_INSTANCE_TYPE" ]]; then
             # Cells supports resize but does not currently work with devstack

From bd27cc2e675ad5d0e21065ea3029d02ea5a2716a Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 4 Apr 2016 09:12:24 -0400
Subject: [PATCH 0352/2409] switch over nova to using $(project_id) in service
 catalog

This makes one less place we reference tenant_id

Change-Id: I53dfeb4d23a9babf7bb46fd3736b4ac005e45993
---
 lib/nova | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/lib/nova b/lib/nova
index ab2bef8ae0..1b3d08651b 100644
--- a/lib/nova
+++ b/lib/nova
@@ -421,17 +421,17 @@ function create_nova_accounts {
         get_or_create_endpoint \
             "compute_legacy" \
             "$REGION_NAME" \
-            "$nova_api_url/v2/\$(tenant_id)s" \
-            "$nova_api_url/v2/\$(tenant_id)s" \
-            "$nova_api_url/v2/\$(tenant_id)s"
+            "$nova_api_url/v2/\$(project_id)s" \
+            "$nova_api_url/v2/\$(project_id)s" \
+            "$nova_api_url/v2/\$(project_id)s"
 
         get_or_create_service "nova" "compute" "Nova Compute Service"
         get_or_create_endpoint \
             "compute" \
             "$REGION_NAME" \
-            "$nova_api_url/v2.1/\$(tenant_id)s" \
-            "$nova_api_url/v2.1/\$(tenant_id)s" \
-            "$nova_api_url/v2.1/\$(tenant_id)s"
+            "$nova_api_url/v2.1/\$(project_id)s" \
+            "$nova_api_url/v2.1/\$(project_id)s" \
+            "$nova_api_url/v2.1/\$(project_id)s"
     fi
 
     if is_service_enabled n-api; then

From 0486a3659e9a24fbcc34e266ecc56f25d1e5cf99 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 4 Apr 2016 09:17:01 -0400
Subject: [PATCH 0353/2409] use project_id instead of TENANT_ID in neutron
 internal functions

This converts the create initial network to using project_id instead
of TENANT_ID.

Change-Id: Idf09b629cd13d842fceed5609b42fd1593552953
---
 lib/neutron-legacy | 39 +++++++++++++++++++++------------------
 1 file changed, 21 insertions(+), 18 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 34f9840791..3ed690c883 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -544,8 +544,9 @@ function create_neutron_accounts {
 }
 
 function create_neutron_initial_network {
-    TENANT_ID=$(openstack project list | grep " demo " | get_field 1)
-    die_if_not_set $LINENO TENANT_ID "Failure retrieving TENANT_ID for demo"
+    local project_id
+    project_id=$(openstack project list | grep " demo " | get_field 1)
+    die_if_not_set $LINENO project_id "Failure retrieving project_id for demo"
 
     # Allow drivers that need to create an initial network to do so here
     if type -p neutron_plugin_create_initial_network_profile > /dev/null; then
@@ -555,17 +556,17 @@ function create_neutron_initial_network {
     if is_provider_network; then
         die_if_not_set $LINENO PHYSICAL_NETWORK "You must specify the PHYSICAL_NETWORK"
         die_if_not_set $LINENO PROVIDER_NETWORK_TYPE "You must specify the PROVIDER_NETWORK_TYPE"
-        NET_ID=$(neutron net-create $PHYSICAL_NETWORK --tenant_id $TENANT_ID --provider:network_type $PROVIDER_NETWORK_TYPE --provider:physical_network "$PHYSICAL_NETWORK" ${SEGMENTATION_ID:+--provider:segmentation_id $SEGMENTATION_ID} --shared | grep ' id ' | get_field 2)
-        die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PHYSICAL_NETWORK $TENANT_ID"
+        NET_ID=$(neutron net-create $PHYSICAL_NETWORK --tenant_id $project_id --provider:network_type $PROVIDER_NETWORK_TYPE --provider:physical_network "$PHYSICAL_NETWORK" ${SEGMENTATION_ID:+--provider:segmentation_id $SEGMENTATION_ID} --shared | grep ' id ' | get_field 2)
+        die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PHYSICAL_NETWORK $project_id"
 
         if [[ "$IP_VERSION" =~ 4.* ]]; then
-            SUBNET_ID=$(neutron subnet-create --tenant_id $TENANT_ID --ip_version 4 ${ALLOCATION_POOL:+--allocation-pool $ALLOCATION_POOL} --name $PROVIDER_SUBNET_NAME --gateway $NETWORK_GATEWAY $NET_ID $FIXED_RANGE | grep ' id ' | get_field 2)
-            die_if_not_set $LINENO SUBNET_ID "Failure creating SUBNET_ID for $PROVIDER_SUBNET_NAME $TENANT_ID"
+            SUBNET_ID=$(neutron subnet-create --tenant_id $project_id --ip_version 4 ${ALLOCATION_POOL:+--allocation-pool $ALLOCATION_POOL} --name $PROVIDER_SUBNET_NAME --gateway $NETWORK_GATEWAY $NET_ID $FIXED_RANGE | grep ' id ' | get_field 2)
+            die_if_not_set $LINENO SUBNET_ID "Failure creating SUBNET_ID for $PROVIDER_SUBNET_NAME $project_id"
         fi
 
         if [[ "$IP_VERSION" =~ .*6 ]] && [[ -n "$IPV6_PROVIDER_FIXED_RANGE" ]] && [[ -n "$IPV6_PROVIDER_NETWORK_GATEWAY" ]]; then
-            SUBNET_V6_ID=$(neutron subnet-create --tenant_id $TENANT_ID --ip_version 6 --ipv6-address-mode $IPV6_ADDRESS_MODE --gateway $IPV6_PROVIDER_NETWORK_GATEWAY --name $IPV6_PROVIDER_SUBNET_NAME $NET_ID $IPV6_PROVIDER_FIXED_RANGE | grep 'id' | get_field 2)
-            die_if_not_set $LINENO SUBNET_V6_ID "Failure creating SUBNET_V6_ID for $IPV6_PROVIDER_SUBNET_NAME $TENANT_ID"
+            SUBNET_V6_ID=$(neutron subnet-create --tenant_id $project_id --ip_version 6 --ipv6-address-mode $IPV6_ADDRESS_MODE --gateway $IPV6_PROVIDER_NETWORK_GATEWAY --name $IPV6_PROVIDER_SUBNET_NAME $NET_ID $IPV6_PROVIDER_FIXED_RANGE | grep 'id' | get_field 2)
+            die_if_not_set $LINENO SUBNET_V6_ID "Failure creating SUBNET_V6_ID for $IPV6_PROVIDER_SUBNET_NAME $project_id"
         fi
 
         if [[ $Q_AGENT == "openvswitch" ]]; then
@@ -574,17 +575,17 @@ function create_neutron_initial_network {
             sudo ip link set $PUBLIC_INTERFACE up
         fi
     else
-        NET_ID=$(neutron net-create --tenant-id $TENANT_ID "$PRIVATE_NETWORK_NAME" | grep ' id ' | get_field 2)
-        die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PRIVATE_NETWORK_NAME $TENANT_ID"
+        NET_ID=$(neutron net-create --tenant-id $project_id "$PRIVATE_NETWORK_NAME" | grep ' id ' | get_field 2)
+        die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PRIVATE_NETWORK_NAME $project_id"
 
         if [[ "$IP_VERSION" =~ 4.* ]]; then
             # Create IPv4 private subnet
-            SUBNET_ID=$(_neutron_create_private_subnet_v4)
+            SUBNET_ID=$(_neutron_create_private_subnet_v4 $project_id)
         fi
 
         if [[ "$IP_VERSION" =~ .*6 ]]; then
             # Create IPv6 private subnet
-            IPV6_SUBNET_ID=$(_neutron_create_private_subnet_v6)
+            IPV6_SUBNET_ID=$(_neutron_create_private_subnet_v6 $project_id)
         fi
     fi
 
@@ -594,8 +595,8 @@ function create_neutron_initial_network {
         # Create a router, and add the private subnet as one of its interfaces
         if [[ "$Q_L3_ROUTER_PER_TENANT" == "True" ]]; then
             # create a tenant-owned router.
-            ROUTER_ID=$(neutron router-create --tenant-id $TENANT_ID $Q_ROUTER_NAME | grep ' id ' | get_field 2)
-            die_if_not_set $LINENO ROUTER_ID "Failure creating ROUTER_ID for $TENANT_ID $Q_ROUTER_NAME"
+            ROUTER_ID=$(neutron router-create --tenant-id $project_id $Q_ROUTER_NAME | grep ' id ' | get_field 2)
+            die_if_not_set $LINENO ROUTER_ID "Failure creating ROUTER_ID for $project_id $Q_ROUTER_NAME"
         else
             # Plugin only supports creating a single router, which should be admin owned.
             ROUTER_ID=$(neutron router-create $Q_ROUTER_NAME | grep ' id ' | get_field 2)
@@ -1287,30 +1288,32 @@ function _neutron_setup_interface_driver {
 
 # Create private IPv4 subnet
 function _neutron_create_private_subnet_v4 {
-    local subnet_params="--tenant-id $TENANT_ID "
+    local project_id=$1
+    local subnet_params="--tenant-id $project_id "
     subnet_params+="--ip_version 4 "
     subnet_params+="--gateway $NETWORK_GATEWAY "
     subnet_params+="--name $PRIVATE_SUBNET_NAME "
     subnet_params+="$NET_ID $FIXED_RANGE"
     local subnet_id
     subnet_id=$(neutron subnet-create $subnet_params | grep ' id ' | get_field 2)
-    die_if_not_set $LINENO subnet_id "Failure creating private IPv4 subnet for $TENANT_ID"
+    die_if_not_set $LINENO subnet_id "Failure creating private IPv4 subnet for $project_id"
     echo $subnet_id
 }
 
 # Create private IPv6 subnet
 function _neutron_create_private_subnet_v6 {
+    local project_id=$1
     die_if_not_set $LINENO IPV6_RA_MODE "IPV6 RA Mode not set"
     die_if_not_set $LINENO IPV6_ADDRESS_MODE "IPV6 Address Mode not set"
     local ipv6_modes="--ipv6-ra-mode $IPV6_RA_MODE --ipv6-address-mode $IPV6_ADDRESS_MODE"
-    local subnet_params="--tenant-id $TENANT_ID "
+    local subnet_params="--tenant-id $project_id "
     subnet_params+="--ip_version 6 "
     subnet_params+="--gateway $IPV6_PRIVATE_NETWORK_GATEWAY "
     subnet_params+="--name $IPV6_PRIVATE_SUBNET_NAME "
     subnet_params+="$NET_ID $FIXED_RANGE_V6 $ipv6_modes"
     local ipv6_subnet_id
     ipv6_subnet_id=$(neutron subnet-create $subnet_params | grep ' id ' | get_field 2)
-    die_if_not_set $LINENO ipv6_subnet_id "Failure creating private IPv6 subnet for $TENANT_ID"
+    die_if_not_set $LINENO ipv6_subnet_id "Failure creating private IPv6 subnet for $project_id"
     echo $ipv6_subnet_id
 }
 

From 19dfa2af3286a6fbd8ea74dbc41a6affd2123e3f Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 4 Apr 2016 10:11:54 -0400
Subject: [PATCH 0354/2409] convert tenant -> project for internal variables

This sets all the internal variables and service users that are set to
use project instead of tenant for clarity.

Change-Id: I4aa833bac2ee2281c5f2881f7ae1fd8e7c759f74
---
 lib/swift | 54 +++++++++++++++++++++++++++---------------------------
 1 file changed, 27 insertions(+), 27 deletions(-)

diff --git a/lib/swift b/lib/swift
index b2fe755cef..82144f71c6 100644
--- a/lib/swift
+++ b/lib/swift
@@ -495,21 +495,21 @@ EOF
         iniset ${swift_node_config} DEFAULT bind_ip ${SWIFT_SERVICE_LISTEN_ADDRESS}
     done
 
-    # Set new accounts in tempauth to match keystone tenant/user (to make testing easier)
-    iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:tempauth user_swifttenanttest1_swiftusertest1 "testing .admin"
-    iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:tempauth user_swifttenanttest2_swiftusertest2 "testing2 .admin"
-    iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:tempauth user_swifttenanttest1_swiftusertest3 "testing3 .admin"
+    # Set new accounts in tempauth to match keystone project/user (to make testing easier)
+    iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:tempauth user_swiftprojecttest1_swiftusertest1 "testing .admin"
+    iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:tempauth user_swiftprojecttest2_swiftusertest2 "testing2 .admin"
+    iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:tempauth user_swiftprojecttest1_swiftusertest3 "testing3 .admin"
 
     testfile=${SWIFT_CONF_DIR}/test.conf
     cp ${SWIFT_DIR}/test/sample.conf ${testfile}
 
     # Set accounts for functional tests
-    iniset ${testfile} func_test account swifttenanttest1
+    iniset ${testfile} func_test account swiftprojecttest1
     iniset ${testfile} func_test username swiftusertest1
     iniset ${testfile} func_test username3 swiftusertest3
-    iniset ${testfile} func_test account2 swifttenanttest2
+    iniset ${testfile} func_test account2 swiftprojecttest2
     iniset ${testfile} func_test username2 swiftusertest2
-    iniset ${testfile} func_test account4 swifttenanttest4
+    iniset ${testfile} func_test account4 swiftprojecttest4
     iniset ${testfile} func_test username4 swiftusertest4
     iniset ${testfile} func_test password4 testing4
     iniset ${testfile} func_test domain4 swift_test
@@ -603,13 +603,13 @@ function create_swift_disk {
 # since we want to make it compatible with tempauth which use
 # underscores for separators.
 
-# Tenant             User               Roles          Domain
-# ------------------------------------------------------------------
-# service            swift              service        default
-# swifttenanttest1   swiftusertest1     admin          default
-# swifttenanttest1   swiftusertest3     anotherrole    default
-# swifttenanttest2   swiftusertest2     admin          default
-# swifttenanttest4   swiftusertest4     admin          swift_test
+# Project             User               Roles          Domain
+# -------------------------------------------------------------------
+# service             swift              service        default
+# swiftprojecttest1   swiftusertest1     admin          default
+# swiftprojecttest1   swiftusertest3     anotherrole    default
+# swiftprojecttest2   swiftusertest2     admin          default
+# swiftprojecttest4   swiftusertest4     admin          swift_test
 
 function create_swift_accounts {
     # Defines specific passwords used by ``tools/create_userrc.sh``
@@ -635,43 +635,43 @@ function create_swift_accounts {
         "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$SWIFT_DEFAULT_BIND_PORT" \
         "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$SWIFT_DEFAULT_BIND_PORT/v1/AUTH_\$(project_id)s"
 
-    local swift_tenant_test1
-    swift_tenant_test1=$(get_or_create_project swifttenanttest1 default)
-    die_if_not_set $LINENO swift_tenant_test1 "Failure creating swift_tenant_test1"
+    local swift_project_test1
+    swift_project_test1=$(get_or_create_project swiftprojecttest1 default)
+    die_if_not_set $LINENO swift_project_test1 "Failure creating swift_project_test1"
     SWIFT_USER_TEST1=$(get_or_create_user swiftusertest1 $swiftusertest1_password \
                         "default" "test@example.com")
     die_if_not_set $LINENO SWIFT_USER_TEST1 "Failure creating SWIFT_USER_TEST1"
-    get_or_add_user_project_role admin $SWIFT_USER_TEST1 $swift_tenant_test1
+    get_or_add_user_project_role admin $SWIFT_USER_TEST1 $swift_project_test1
 
     local swift_user_test3
     swift_user_test3=$(get_or_create_user swiftusertest3 $swiftusertest3_password \
                                 "default" "test3@example.com")
     die_if_not_set $LINENO swift_user_test3 "Failure creating swift_user_test3"
-    get_or_add_user_project_role $another_role $swift_user_test3 $swift_tenant_test1
+    get_or_add_user_project_role $another_role $swift_user_test3 $swift_project_test1
 
-    local swift_tenant_test2
-    swift_tenant_test2=$(get_or_create_project swifttenanttest2 default)
-    die_if_not_set $LINENO swift_tenant_test2 "Failure creating swift_tenant_test2"
+    local swift_project_test2
+    swift_project_test2=$(get_or_create_project swiftprojecttest2 default)
+    die_if_not_set $LINENO swift_project_test2 "Failure creating swift_project_test2"
 
     local swift_user_test2
     swift_user_test2=$(get_or_create_user swiftusertest2 $swiftusertest2_password \
                                 "default" "test2@example.com")
     die_if_not_set $LINENO swift_user_test2 "Failure creating swift_user_test2"
-    get_or_add_user_project_role admin $swift_user_test2 $swift_tenant_test2
+    get_or_add_user_project_role admin $swift_user_test2 $swift_project_test2
 
     local swift_domain
     swift_domain=$(get_or_create_domain swift_test 'Used for swift functional testing')
     die_if_not_set $LINENO swift_domain "Failure creating swift_test domain"
 
-    local swift_tenant_test4
-    swift_tenant_test4=$(get_or_create_project swifttenanttest4 $swift_domain)
-    die_if_not_set $LINENO swift_tenant_test4 "Failure creating swift_tenant_test4"
+    local swift_project_test4
+    swift_project_test4=$(get_or_create_project swiftprojecttest4 $swift_domain)
+    die_if_not_set $LINENO swift_project_test4 "Failure creating swift_project_test4"
 
     local swift_user_test4
     swift_user_test4=$(get_or_create_user swiftusertest4 $swiftusertest4_password \
                                 $swift_domain "test4@example.com")
     die_if_not_set $LINENO swift_user_test4 "Failure creating swift_user_test4"
-    get_or_add_user_project_role admin $swift_user_test4 $swift_tenant_test4
+    get_or_add_user_project_role admin $swift_user_test4 $swift_project_test4
 }
 
 # init_swift() - Initialize rings

From 0b1465b6f699a974e3900fff2a810aec6a6bf43c Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 4 Apr 2016 10:15:47 -0400
Subject: [PATCH 0355/2409] change tenant to project in keystone bootstrapping

Change-Id: I6f392d3c16726f6dd734184dcf3014fb4f388207
---
 lib/keystone | 56 ++++++++++++++++++++++++++--------------------------
 1 file changed, 28 insertions(+), 28 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index d83092405b..4361fe0b7f 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -106,9 +106,9 @@ KEYSTONE_SERVICE_PROTOCOL=${KEYSTONE_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 
 # Bind hosts
 KEYSTONE_ADMIN_BIND_HOST=${KEYSTONE_ADMIN_BIND_HOST:-$KEYSTONE_SERVICE_HOST}
-# Set the tenant for service accounts in Keystone
-SERVICE_TENANT_NAME=${SERVICE_TENANT_NAME:-service}
-SERVICE_PROJECT_NAME=${SERVICE_TENANT_NAME:-service}
+# Set the project for service accounts in Keystone
+SERVICE_PROJECT_NAME=${SERVICE_PROJECT_NAME:-service}
+SERVICE_TENANT_NAME=${SERVICE_PROJECT_NAME:-service}
 
 # if we are running with SSL use https protocols
 if is_ssl_enabled_service "key" || is_service_enabled tls-proxy; then
@@ -335,7 +335,7 @@ function configure_keystone {
 
 # create_keystone_accounts() - Sets up common required keystone accounts
 
-# Tenant               User       Roles
+# Project              User       Roles
 # ------------------------------------------------------------------
 # admin                admin      admin
 # service              --         --
@@ -348,7 +348,7 @@ function configure_keystone {
 # alt_demo             alt_demo   Member, anotherrole
 # invisible_to_admin   demo       Member
 
-# Group                Users            Roles                 Tenant
+# Group                Users            Roles                 Project
 # ------------------------------------------------------------------
 # admins               admin            admin                 admin
 # nonadmins            demo, alt_demo   Member, anotherrole   demo, alt_demo
@@ -360,8 +360,8 @@ function create_keystone_accounts {
     # The keystone bootstrapping process (performed via keystone-manage bootstrap)
     # creates an admin user, admin role and admin project. As a sanity check
     # we exercise the CLI to retrieve the IDs for these values.
-    local admin_tenant
-    admin_tenant=$(openstack project show "admin" -f value -c id)
+    local admin_project
+    admin_project=$(openstack project show "admin" -f value -c id)
     local admin_user
     admin_user=$(openstack user show "admin" -f value -c id)
     local admin_role
@@ -376,8 +376,8 @@ function create_keystone_accounts {
     get_or_create_role service
 
     # The ResellerAdmin role is used by Nova and Ceilometer so we need to keep it.
-    # The admin role in swift allows a user to act as an admin for their tenant,
-    # but ResellerAdmin is needed for a user to act as any tenant. The name of this
+    # The admin role in swift allows a user to act as an admin for their project,
+    # but ResellerAdmin is needed for a user to act as any project. The name of this
     # role is also configurable in swift-proxy.conf
     get_or_create_role ResellerAdmin
 
@@ -390,32 +390,32 @@ function create_keystone_accounts {
     local another_role
     another_role=$(get_or_create_role "anotherrole")
 
-    # invisible tenant - admin can't see this one
-    local invis_tenant
-    invis_tenant=$(get_or_create_project "invisible_to_admin" default)
+    # invisible project - admin can't see this one
+    local invis_project
+    invis_project=$(get_or_create_project "invisible_to_admin" default)
 
     # demo
-    local demo_tenant
-    demo_tenant=$(get_or_create_project "demo" default)
+    local demo_project
+    demo_project=$(get_or_create_project "demo" default)
     local demo_user
     demo_user=$(get_or_create_user "demo" \
         "$ADMIN_PASSWORD" "default" "demo@example.com")
 
-    get_or_add_user_project_role $member_role $demo_user $demo_tenant
-    get_or_add_user_project_role $admin_role $admin_user $demo_tenant
-    get_or_add_user_project_role $another_role $demo_user $demo_tenant
-    get_or_add_user_project_role $member_role $demo_user $invis_tenant
+    get_or_add_user_project_role $member_role $demo_user $demo_project
+    get_or_add_user_project_role $admin_role $admin_user $demo_project
+    get_or_add_user_project_role $another_role $demo_user $demo_project
+    get_or_add_user_project_role $member_role $demo_user $invis_project
 
     # alt_demo
-    local alt_demo_tenant
-    alt_demo_tenant=$(get_or_create_project "alt_demo" default)
+    local alt_demo_project
+    alt_demo_project=$(get_or_create_project "alt_demo" default)
     local alt_demo_user
     alt_demo_user=$(get_or_create_user "alt_demo" \
         "$ADMIN_PASSWORD" "default" "alt_demo@example.com")
 
-    get_or_add_user_project_role $member_role $alt_demo_user $alt_demo_tenant
-    get_or_add_user_project_role $admin_role $admin_user $alt_demo_tenant
-    get_or_add_user_project_role $another_role $alt_demo_user $alt_demo_tenant
+    get_or_add_user_project_role $member_role $alt_demo_user $alt_demo_project
+    get_or_add_user_project_role $admin_role $admin_user $alt_demo_project
+    get_or_add_user_project_role $another_role $alt_demo_user $alt_demo_project
 
     # groups
     local admin_group
@@ -425,11 +425,11 @@ function create_keystone_accounts {
     non_admin_group=$(get_or_create_group "nonadmins" \
         "default" "non-admin group")
 
-    get_or_add_group_project_role $member_role $non_admin_group $demo_tenant
-    get_or_add_group_project_role $another_role $non_admin_group $demo_tenant
-    get_or_add_group_project_role $member_role $non_admin_group $alt_demo_tenant
-    get_or_add_group_project_role $another_role $non_admin_group $alt_demo_tenant
-    get_or_add_group_project_role $admin_role $admin_group $admin_tenant
+    get_or_add_group_project_role $member_role $non_admin_group $demo_project
+    get_or_add_group_project_role $another_role $non_admin_group $demo_project
+    get_or_add_group_project_role $member_role $non_admin_group $alt_demo_project
+    get_or_add_group_project_role $another_role $non_admin_group $alt_demo_project
+    get_or_add_group_project_role $admin_role $admin_group $admin_project
 }
 
 # Create a user that is capable of verifying keystone tokens for use with auth_token middleware.

From 17e450131cc5f6508bea99172b6200bd6fce5584 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Wed, 6 Apr 2016 09:27:56 +1000
Subject: [PATCH 0356/2409] Pad around table in plugin list

Make sure the table is separated out from header and footer content so
it actually gets picked up as a table.

Change-Id: I60a24b2476a55cfbf5c864a1c27ce5b98e699886
---
 tools/generate-devstack-plugins-list.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/tools/generate-devstack-plugins-list.sh b/tools/generate-devstack-plugins-list.sh
index c3c8f24dbd..ea30cd5568 100644
--- a/tools/generate-devstack-plugins-list.sh
+++ b/tools/generate-devstack-plugins-list.sh
@@ -68,6 +68,7 @@ name_col_len=$(( name_col_len + 2 ))
 # foobar                 `git://... <http://...>`__
 # ...
 
+printf "\n\n"
 title_underline ${name_col_len}
 printf "%-${name_col_len}s %s\n" "Plugin Name" "URL"
 title_underline ${name_col_len}
@@ -77,6 +78,7 @@ for plugin in ${sorted_plugins}; do
     gitlink="https://git.openstack.org/cgit/openstack/${plugin}"
     printf "%-${name_col_len}s %s\n" "${plugin}" "\`${giturl} <${gitlink}>\`__"
 done
+printf "\n\n"
 
 if [[ -r data/devstack-plugins-registry.footer ]]; then
     cat data/devstack-plugins-registry.footer

From 7f87efdd21e92721fe2bf8bb493deb4822e32f1b Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Fri, 9 Oct 2015 10:07:11 -0400
Subject: [PATCH 0357/2409] Remove project_id from nova service urls

Nova API itself supports both URL modes:
  with project-id and without project-id
However, we are changing service catalogs for removing project-id
based on the discussion.
We have agreement on https://review.openstack.org/#/c/181393 like the
following:

 - Standard required naming for endpoints (versioned vs. unversioned,
   contains project ID vs. no project ID).
    * We want unversioned endpoints so that the user can get
      information about multiple available versions in a given cloud.
    * We do not want project ID, account ID, or tenant ID as part of
      the resource URI for an OpenStack API endpoint.

So this patch removes project-id from Nova service catalog for this
direction.

Change-Id: Ifd74152727b5c0c75924419a7a52e024a69ce72c
---
 lib/nova | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/nova b/lib/nova
index 1b3d08651b..9449cfa98d 100644
--- a/lib/nova
+++ b/lib/nova
@@ -429,9 +429,9 @@ function create_nova_accounts {
         get_or_create_endpoint \
             "compute" \
             "$REGION_NAME" \
-            "$nova_api_url/v2.1/\$(project_id)s" \
-            "$nova_api_url/v2.1/\$(project_id)s" \
-            "$nova_api_url/v2.1/\$(project_id)s"
+            "$nova_api_url/v2.1" \
+            "$nova_api_url/v2.1" \
+            "$nova_api_url/v2.1"
     fi
 
     if is_service_enabled n-api; then

From 616957d5981310e465e9fb3fd0c040751d8b0b63 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Wed, 6 Apr 2016 16:50:45 +1000
Subject: [PATCH 0358/2409] Work around broken rabbitmq 3.6.1 packages on
 Fedora 23

Downgrade this package until we have a fix for the bug in the
comments.

Change-Id: I980d625fec7b11aff74814ee2d24fe9650e9f0a6
---
 tools/fixup_stuff.sh | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index 193a1f7aba..15cb5a1180 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -159,6 +159,14 @@ if is_fedora; then
             pip_install --upgrade --force-reinstall requests
         fi
     fi
+
+    if [[ "$os_VENDOR" == "Fedora" ]] && [[ "$os_RELEASE" -ge "23" ]]; then
+        # work-around broken rabbitmq-server 3.6.1 packages
+        #  https://bugzilla.redhat.com/show_bug.cgi?id=1323610
+        # Will be removed when this bug is fixed.
+        sudo dnf -y install \
+             https://kojipkgs.fedoraproject.org/packages/rabbitmq-server/3.5.7/4.fc23/noarch/rabbitmq-server-3.5.7-4.fc23.noarch.rpm
+    fi
 fi
 
 # The version of pip(1.5.4) supported by python-virtualenv(1.11.4) has

From db48db1cf0b9c36890439a161424842d07d94f60 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 6 Apr 2016 08:09:31 -0400
Subject: [PATCH 0359/2409] update docs to reference project not tenant

Change-Id: Iad66e14fa33609ea6d2a115469e054762051b964
---
 doc/source/configuration.rst  |  4 ++--
 doc/source/guides/neutron.rst | 21 ++++++++++-----------
 doc/source/openrc.rst         |  2 +-
 3 files changed, 13 insertions(+), 14 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 0493f8fa25..f3e4896296 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -423,8 +423,8 @@ IP Version
 ----------
 
 ``IP_VERSION`` can be used to configure DevStack to create either an
-IPv4, IPv6, or dual-stack tenant data-network by with either
-``IP_VERSION=4``, ``IP_VERSION=6``, or ``IP_VERSION=4+6``
+IPv4, IPv6, or dual-stack self service project data-network by with
+either ``IP_VERSION=4``, ``IP_VERSION=6``, or ``IP_VERSION=4+6``
 respectively.  This functionality requires that the Neutron networking
 service is enabled by setting the following options:
 
diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index 6ac3993e17..a834314bcc 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -15,8 +15,8 @@ In some instances, like on a developer laptop, there is only one
 network interface that is available. In this scenario, the physical
 interface is added to the Open vSwitch bridge, and the IP address of
 the laptop is migrated onto the bridge interface. That way, the
-physical interface can be used to transmit tenant network traffic,
-the OpenStack API traffic, and management traffic.
+physical interface can be used to transmit self service project
+network traffic, the OpenStack API traffic, and management traffic.
 
 
 .. warning::
@@ -222,12 +222,12 @@ it over the `br-ex` bridge, where `eth0` is attached.
 which is used as the "integration bridge" where ports are created, and
 plugged into the virtual switching fabric. `br-ex` is an OVS bridge
 that is used to connect physical ports (like `eth0`), so that floating
-IP traffic for tenants can be received from the physical network
-infrastructure (and the internet), and routed to tenant network ports.
-`br-tun` is a tunnel bridge that is used to connect OpenStack nodes
-(like `devstack-2`) together. This bridge is used so that tenant
-network traffic, using the VXLAN tunneling protocol, flows between
-each compute node where tenant instances run.
+IP traffic for project networks can be received from the physical
+network infrastructure (and the internet), and routed to self service
+project network ports.  `br-tun` is a tunnel bridge that is used to
+connect OpenStack nodes (like `devstack-2`) together. This bridge is
+used so that project network traffic, using the VXLAN tunneling
+protocol, flows between each compute node where project instances run.
 
 
 
@@ -381,8 +381,8 @@ controller node.
 
         ## Neutron options
         Q_USE_SECGROUP=True
-        ENABLE_TENANT_VLANS=True
-        TENANT_VLAN_RANGE=3001:4000
+        ENABLE_PROJECT_VLANS=True
+        PROJECT_VLAN_RANGE=3001:4000
         PHYSICAL_NETWORK=default
         OVS_PHYSICAL_BRIDGE=br-ex
 
@@ -553,4 +553,3 @@ setup, with small modifications for the interface mappings.
     LB_PHYSICAL_INTERFACE=eth0
     PUBLIC_PHYSICAL_NETWORK=default
     LB_INTERFACE_MAPPINGS=default:eth0
-
diff --git a/doc/source/openrc.rst b/doc/source/openrc.rst
index 4e7f0754a3..d28b5680c6 100644
--- a/doc/source/openrc.rst
+++ b/doc/source/openrc.rst
@@ -51,7 +51,7 @@ HOST\_IP, SERVICE\_HOST
 OS\_AUTH\_URL
     Authenticating against an OpenStack cloud using Keystone returns a
     *Token* and *Service Catalog*. The catalog contains the endpoints
-    for all services the user/tenant has access to - including Nova,
+    for all services the user/project has access to - including Nova,
     Glance, Keystone and Swift.
 
     ::

From d3d21394db4a958bed55d856f780c127324a71b8 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Wed, 6 Apr 2016 14:06:00 -0700
Subject: [PATCH 0360/2409] Fix create_flavors on subnodes

This makes us depend on n-api being enabled, which should avoid running
this on subnodes, where it fails because of no credentials.

Change-Id: I209bd59cd57be27c3375f5a2074361307abcafe9
Closes-Bug: #1567065
---
 lib/nova | 32 +++++++++++++++++---------------
 1 file changed, 17 insertions(+), 15 deletions(-)

diff --git a/lib/nova b/lib/nova
index 8aca1a6cec..77bc3c8742 100644
--- a/lib/nova
+++ b/lib/nova
@@ -934,21 +934,23 @@ function stop_nova {
 
 # create_instance_types(): Create default flavors
 function create_flavors {
-    if ! openstack flavor list | grep -q ds512M; then
-    # Note that danms hates these flavors and apologizes for sdague
-        openstack flavor create --id c1 --ram 256 --disk 0 --vcpus 1 cirros256
-        openstack flavor create --id d1 --ram 512 --disk 5 --vcpus 1 ds512M
-        openstack flavor create --id d2 --ram 1024 --disk 10 --vcpus 1 ds1G
-        openstack flavor create --id d3 --ram 2048 --disk 10 --vcpus 2 ds2G
-        openstack flavor create --id d4 --ram 4096 --disk 20 --vcpus 4 ds4G
-    fi
-
-    if ! openstack flavor list | grep -q m1.tiny; then
-        openstack flavor create --id 1 --ram 512 --disk 1 --vcpus 1 m1.tiny
-        openstack flavor create --id 2 --ram 2048 --disk 20 --vcpus 1 m1.small
-        openstack flavor create --id 3 --ram 4096 --disk 40 --vcpus 2 m1.medium
-        openstack flavor create --id 4 --ram 8192 --disk 80 --vcpus 4 m1.large
-        openstack flavor create --id 5 --ram 16384 --disk 160 --vcpus 8 m1.xlarge
+    if is_service_enabled n-api; then
+        if ! openstack flavor list | grep -q ds512M; then
+            # Note that danms hates these flavors and apologizes for sdague
+            openstack flavor create --id c1 --ram 256 --disk 0 --vcpus 1 cirros256
+            openstack flavor create --id d1 --ram 512 --disk 5 --vcpus 1 ds512M
+            openstack flavor create --id d2 --ram 1024 --disk 10 --vcpus 1 ds1G
+            openstack flavor create --id d3 --ram 2048 --disk 10 --vcpus 2 ds2G
+            openstack flavor create --id d4 --ram 4096 --disk 20 --vcpus 4 ds4G
+        fi
+
+        if ! openstack flavor list | grep -q m1.tiny; then
+            openstack flavor create --id 1 --ram 512 --disk 1 --vcpus 1 m1.tiny
+            openstack flavor create --id 2 --ram 2048 --disk 20 --vcpus 1 m1.small
+            openstack flavor create --id 3 --ram 4096 --disk 40 --vcpus 2 m1.medium
+            openstack flavor create --id 4 --ram 8192 --disk 80 --vcpus 4 m1.large
+            openstack flavor create --id 5 --ram 16384 --disk 160 --vcpus 8 m1.xlarge
+        fi
     fi
 }
 

From da1ca6e07c0d54d0ec5b94ebd78da81c6a46e780 Mon Sep 17 00:00:00 2001
From: Armando Migliaccio <armamig@gmail.com>
Date: Wed, 6 Apr 2016 21:57:28 +0000
Subject: [PATCH 0361/2409] Revert "Use unversioned keystone endpoints"

This reverts commit 4921d4dbb937b8a9ca26379a33252f0bebcfb53f.

Change-Id: Ic8888fca5d25ca6caa3f29f712db319f1d3869ba
---
 lib/keystone | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 802b38082e..9f23e73381 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -634,9 +634,9 @@ function bootstrap_keystone {
         --bootstrap-role-name admin \
         --bootstrap-service-name keystone \
         --bootstrap-region-id "$REGION_NAME" \
-        --bootstrap-admin-url "$KEYSTONE_AUTH_URI" \
-        --bootstrap-public-url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT" \
-        --bootstrap-internal-url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT"
+        --bootstrap-admin-url "$KEYSTONE_AUTH_URI/v$IDENTITY_API_VERSION" \
+        --bootstrap-public-url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v$IDENTITY_API_VERSION" \
+        --bootstrap-internal-url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v$IDENTITY_API_VERSION"
 }
 
 # Restore xtrace

From 8dda061a1fc3b06675cc873681d3bdaaad98f734 Mon Sep 17 00:00:00 2001
From: Armando Migliaccio <armamig@gmail.com>
Date: Thu, 7 Apr 2016 00:12:51 +0000
Subject: [PATCH 0362/2409] Revert "Revert "Use unversioned keystone
 endpoints""

This reverts commit da1ca6e07c0d54d0ec5b94ebd78da81c6a46e780.

Depends-on: Id2c7e09611c1f8b06e6d272589b4ea3435b8de86
Change-Id: I1b2a65179b5863d8bcbc5dd02b615f4e6e564213
---
 lib/keystone | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 9f23e73381..802b38082e 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -634,9 +634,9 @@ function bootstrap_keystone {
         --bootstrap-role-name admin \
         --bootstrap-service-name keystone \
         --bootstrap-region-id "$REGION_NAME" \
-        --bootstrap-admin-url "$KEYSTONE_AUTH_URI/v$IDENTITY_API_VERSION" \
-        --bootstrap-public-url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v$IDENTITY_API_VERSION" \
-        --bootstrap-internal-url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v$IDENTITY_API_VERSION"
+        --bootstrap-admin-url "$KEYSTONE_AUTH_URI" \
+        --bootstrap-public-url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT" \
+        --bootstrap-internal-url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT"
 }
 
 # Restore xtrace

From e9820732f16386facc526d14a5150ba68da68161 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 8 Apr 2016 09:10:55 +1000
Subject: [PATCH 0363/2409] Fix table in generated plugins list

Fix the table with a bottom border.  Regenerate the plugin list using
the script to make sure it works this time.

Change-Id: Iab3eb3879fd6017c55259e470477e4a9e34514e2
---
 doc/source/plugin-registry.rst          | 281 +++++++++---------------
 tools/generate-devstack-plugins-list.sh |   3 +
 2 files changed, 105 insertions(+), 179 deletions(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index b4671234ed..999350fe6a 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -19,182 +19,105 @@ The following are plugins that a script has found in the openstack/
 namespace, which includes but is not limited to official OpenStack
 projects.
 
-+----------------------------+-------------------------------------------------------------------------+
-|Plugin Name                 |URL                                                                      |
-+----------------------------+-------------------------------------------------------------------------+
-|aodh                        |git://git.openstack.org/openstack/aodh                                   |
-+----------------------------+-------------------------------------------------------------------------+
-|app-catalog-ui              |git://git.openstack.org/openstack/app-catalog-ui                         |
-+----------------------------+-------------------------------------------------------------------------+
-|astara                      |git://git.openstack.org/openstack/astara                                 |
-+----------------------------+-------------------------------------------------------------------------+
-|barbican                    |git://git.openstack.org/openstack/barbican                               |
-+----------------------------+-------------------------------------------------------------------------+
-|blazar                      |git://git.openstack.org/openstack/blazar                                 |
-+----------------------------+-------------------------------------------------------------------------+
-|broadview-collector         |git://git.openstack.org/openstack/broadview-collector                    |
-+----------------------------+-------------------------------------------------------------------------+
-|ceilometer                  |git://git.openstack.org/openstack/ceilometer                             |
-+----------------------------+-------------------------------------------------------------------------+
-|ceilometer-powervm          |git://git.openstack.org/openstack/ceilometer-powervm                     |
-+----------------------------+-------------------------------------------------------------------------+
-|cerberus                    |git://git.openstack.org/openstack/cerberus                               |
-+----------------------------+-------------------------------------------------------------------------+
-|cloudkitty                  |git://git.openstack.org/openstack/cloudkitty                             |
-+----------------------------+-------------------------------------------------------------------------+
-|collectd-ceilometer-plugin  |git://git.openstack.org/openstack/collectd-ceilometer-plugin             |
-+----------------------------+-------------------------------------------------------------------------+
-|congress                    |git://git.openstack.org/openstack/congress                               |
-+----------------------------+-------------------------------------------------------------------------+
-|cue                         |git://git.openstack.org/openstack/cue                                    |
-+----------------------------+-------------------------------------------------------------------------+
-|designate                   |git://git.openstack.org/openstack/designate                              |
-+----------------------------+-------------------------------------------------------------------------+
-|devstack-plugin-amqp1       |git://git.openstack.org/openstack/devstack-plugin-amqp1                  |
-+----------------------------+-------------------------------------------------------------------------+
-|devstack-plugin-bdd         |git://git.openstack.org/openstack/devstack-plugin-bdd                    |
-+----------------------------+-------------------------------------------------------------------------+
-|devstack-plugin-ceph        |git://git.openstack.org/openstack/devstack-plugin-ceph                   |
-+----------------------------+-------------------------------------------------------------------------+
-|devstack-plugin-glusterfs   |git://git.openstack.org/openstack/devstack-plugin-glusterfs              |
-+----------------------------+-------------------------------------------------------------------------+
-|devstack-plugin-hdfs        |git://git.openstack.org/openstack/devstack-plugin-hdfs                   |
-+----------------------------+-------------------------------------------------------------------------+
-|devstack-plugin-kafka       |git://git.openstack.org/openstack/devstack-plugin-kafka                  |
-+----------------------------+-------------------------------------------------------------------------+
-|devstack-plugin-pika        |git://git.openstack.org/openstack/devstack-plugin-pika                   |
-+----------------------------+-------------------------------------------------------------------------+
-|devstack-plugin-sheepdog    |git://git.openstack.org/openstack/devstack-plugin-sheepdog               |
-+----------------------------+-------------------------------------------------------------------------+
-|devstack-plugin-zmq         |git://git.openstack.org/openstack/devstack-plugin-zmq                    |
-+----------------------------+-------------------------------------------------------------------------+
-|dragonflow                  |git://git.openstack.org/openstack/dragonflow                             |
-+----------------------------+-------------------------------------------------------------------------+
-|drbd-devstack               |git://git.openstack.org/openstack/drbd-devstack                          |
-+----------------------------+-------------------------------------------------------------------------+
-|ec2-api                     |git://git.openstack.org/openstack/ec2-api                                |
-+----------------------------+-------------------------------------------------------------------------+
-|freezer                     |git://git.openstack.org/openstack/freezer                                |
-+----------------------------+-------------------------------------------------------------------------+
-|freezer-api                 |git://git.openstack.org/openstack/freezer-api                            |
-+----------------------------+-------------------------------------------------------------------------+
-|freezer-web-ui              |git://git.openstack.org/openstack/freezer-web-ui                         |
-+----------------------------+-------------------------------------------------------------------------+
-|gce-api                     |git://git.openstack.org/openstack/gce-api                                |
-+----------------------------+-------------------------------------------------------------------------+
-|gnocchi                     |git://git.openstack.org/openstack/gnocchi                                |
-+----------------------------+-------------------------------------------------------------------------+
-|ironic                      |git://git.openstack.org/openstack/ironic                                 |
-+----------------------------+-------------------------------------------------------------------------+
-|ironic-inspector            |git://git.openstack.org/openstack/ironic-inspector                       |
-+----------------------------+-------------------------------------------------------------------------+
-|kingbird                    |git://git.openstack.org/openstack/kingbird                               |
-+----------------------------+-------------------------------------------------------------------------+
-|kuryr                       |git://git.openstack.org/openstack/kuryr                                  |
-+----------------------------+-------------------------------------------------------------------------+
-|magnum                      |git://git.openstack.org/openstack/magnum                                 |
-+----------------------------+-------------------------------------------------------------------------+
-|manila                      |git://git.openstack.org/openstack/manila                                 |
-+----------------------------+-------------------------------------------------------------------------+
-|mistral                     |git://git.openstack.org/openstack/mistral                                |
-+----------------------------+-------------------------------------------------------------------------+
-|monasca-api                 |git://git.openstack.org/openstack/monasca-api                            |
-+----------------------------+-------------------------------------------------------------------------+
-|murano                      |git://git.openstack.org/openstack/murano                                 |
-+----------------------------+-------------------------------------------------------------------------+
-|networking-6wind            |git://git.openstack.org/openstack/networking-6wind                       |
-+----------------------------+-------------------------------------------------------------------------+
-|networking-bagpipe          |git://git.openstack.org/openstack/networking-bagpipe                     |
-+----------------------------+-------------------------------------------------------------------------+
-|networking-bgpvpn           |git://git.openstack.org/openstack/networking-bgpvpn                      |
-+----------------------------+-------------------------------------------------------------------------+
-|networking-brocade          |git://git.openstack.org/openstack/networking-brocade                     |
-+----------------------------+-------------------------------------------------------------------------+
-|networking-calico           |git://git.openstack.org/openstack/networking-calico                      |
-+----------------------------+-------------------------------------------------------------------------+
-|networking-cisco            |git://git.openstack.org/openstack/networking-cisco                       |
-+----------------------------+-------------------------------------------------------------------------+
-|networking-fortinet         |git://git.openstack.org/openstack/networking-fortinet                    |
-+----------------------------+-------------------------------------------------------------------------+
-|networking-generic-switch   |git://git.openstack.org/openstack/networking-generic-switch              |
-+----------------------------+-------------------------------------------------------------------------+
-|networking-infoblox         |git://git.openstack.org/openstack/networking-infoblox                    |
-+----------------------------+-------------------------------------------------------------------------+
-|networking-l2gw             |git://git.openstack.org/openstack/networking-l2gw                        |
-+----------------------------+-------------------------------------------------------------------------+
-|networking-midonet          |git://git.openstack.org/openstack/networking-midonet                     |
-+----------------------------+-------------------------------------------------------------------------+
-|networking-mlnx             |git://git.openstack.org/openstack/networking-mlnx                        |
-+----------------------------+-------------------------------------------------------------------------+
-|networking-nec              |git://git.openstack.org/openstack/networking-nec                         |
-+----------------------------+-------------------------------------------------------------------------+
-|networking-odl              |git://git.openstack.org/openstack/networking-odl                         |
-+----------------------------+-------------------------------------------------------------------------+
-|networking-ofagent          |git://git.openstack.org/openstack/networking-ofagent                     |
-+----------------------------+-------------------------------------------------------------------------+
-|networking-ovn              |git://git.openstack.org/openstack/networking-ovn                         |
-+----------------------------+-------------------------------------------------------------------------+
-|networking-ovs-dpdk         |git://git.openstack.org/openstack/networking-ovs-dpdk                    |
-+----------------------------+-------------------------------------------------------------------------+
-|networking-plumgrid         |git://git.openstack.org/openstack/networking-plumgrid                    |
-+----------------------------+-------------------------------------------------------------------------+
-|networking-powervm          |git://git.openstack.org/openstack/networking-powervm                     |
-+----------------------------+-------------------------------------------------------------------------+
-|networking-sfc              |git://git.openstack.org/openstack/networking-sfc                         |
-+----------------------------+-------------------------------------------------------------------------+
-|networking-vsphere          |git://git.openstack.org/openstack/networking-vsphere                     |
-+----------------------------+-------------------------------------------------------------------------+
-|neutron                     |git://git.openstack.org/openstack/neutron                                |
-+----------------------------+-------------------------------------------------------------------------+
-|neutron-lbaas               |git://git.openstack.org/openstack/neutron-lbaas                          |
-+----------------------------+-------------------------------------------------------------------------+
-|neutron-lbaas-dashboard     |git://git.openstack.org/openstack/neutron-lbaas-dashboard                |
-+----------------------------+-------------------------------------------------------------------------+
-|neutron-vpnaas              |git://git.openstack.org/openstack/neutron-vpnaas                         |
-+----------------------------+-------------------------------------------------------------------------+
-|nova-docker                 |git://git.openstack.org/openstack/nova-docker                            |
-+----------------------------+-------------------------------------------------------------------------+
-|nova-powervm                |git://git.openstack.org/openstack/nova-powervm                           |
-+----------------------------+-------------------------------------------------------------------------+
-|octavia                     |git://git.openstack.org/openstack/octavia                                |
-+----------------------------+-------------------------------------------------------------------------+
-|osprofiler                  |git://git.openstack.org/openstack/osprofiler                             |
-+----------------------------+-------------------------------------------------------------------------+
-|rally                       |git://git.openstack.org/openstack/rally                                  |
-+----------------------------+-------------------------------------------------------------------------+
-|sahara                      |git://git.openstack.org/openstack/sahara                                 |
-+----------------------------+-------------------------------------------------------------------------+
-|sahara-dashboard            |git://git.openstack.org/openstack/sahara-dashboard                       |
-+----------------------------+-------------------------------------------------------------------------+
-|scalpels                    |git://git.openstack.org/openstack/scalpels                               |
-+----------------------------+-------------------------------------------------------------------------+
-|searchlight                 |git://git.openstack.org/openstack/searchlight                            |
-+----------------------------+-------------------------------------------------------------------------+
-|senlin                      |git://git.openstack.org/openstack/senlin                                 |
-+----------------------------+-------------------------------------------------------------------------+
-|smaug                       |git://git.openstack.org/openstack/smaug                                  |
-+----------------------------+-------------------------------------------------------------------------+
-|solum                       |git://git.openstack.org/openstack/solum                                  |
-+----------------------------+-------------------------------------------------------------------------+
-|tacker                      |git://git.openstack.org/openstack/tacker                                 |
-+----------------------------+-------------------------------------------------------------------------+
-|tap-as-a-service            |git://git.openstack.org/openstack/tap-as-a-service                       |
-+----------------------------+-------------------------------------------------------------------------+
-|tricircle                   |git://git.openstack.org/openstack/tricircle                              |
-+----------------------------+-------------------------------------------------------------------------+
-|trove                       |git://git.openstack.org/openstack/trove                                  |
-+----------------------------+-------------------------------------------------------------------------+
-|trove-dashboard             |git://git.openstack.org/openstack/trove-dashboard                        |
-+----------------------------+-------------------------------------------------------------------------+
-|vitrage                     |git://git.openstack.org/openstack/vitrage                                |
-+----------------------------+-------------------------------------------------------------------------+
-|vitrage-dashboard           |git://git.openstack.org/openstack/vitrage-dashboard                      |
-+----------------------------+-------------------------------------------------------------------------+
-|vmware-nsx                  |git://git.openstack.org/openstack/vmware-nsx                             |
-+----------------------------+-------------------------------------------------------------------------+
-|watcher                     |git://git.openstack.org/openstack/watcher                                |
-+----------------------------+-------------------------------------------------------------------------+
-|watcher-dashboard           |git://git.openstack.org/openstack/watcher-dashboard                      |
-+----------------------------+-------------------------------------------------------------------------+
-|zaqar                       |git://git.openstack.org/openstack/zaqar                                  |
-+----------------------------+-------------------------------------------------------------------------+
+
+====================================== ===
+Plugin Name                            URL
+====================================== ===
+aodh                                   `git://git.openstack.org/openstack/aodh <https://git.openstack.org/cgit/openstack/aodh>`__
+app-catalog-ui                         `git://git.openstack.org/openstack/app-catalog-ui <https://git.openstack.org/cgit/openstack/app-catalog-ui>`__
+astara                                 `git://git.openstack.org/openstack/astara <https://git.openstack.org/cgit/openstack/astara>`__
+barbican                               `git://git.openstack.org/openstack/barbican <https://git.openstack.org/cgit/openstack/barbican>`__
+blazar                                 `git://git.openstack.org/openstack/blazar <https://git.openstack.org/cgit/openstack/blazar>`__
+broadview-collector                    `git://git.openstack.org/openstack/broadview-collector <https://git.openstack.org/cgit/openstack/broadview-collector>`__
+ceilometer                             `git://git.openstack.org/openstack/ceilometer <https://git.openstack.org/cgit/openstack/ceilometer>`__
+ceilometer-powervm                     `git://git.openstack.org/openstack/ceilometer-powervm <https://git.openstack.org/cgit/openstack/ceilometer-powervm>`__
+cerberus                               `git://git.openstack.org/openstack/cerberus <https://git.openstack.org/cgit/openstack/cerberus>`__
+cloudkitty                             `git://git.openstack.org/openstack/cloudkitty <https://git.openstack.org/cgit/openstack/cloudkitty>`__
+collectd-ceilometer-plugin             `git://git.openstack.org/openstack/collectd-ceilometer-plugin <https://git.openstack.org/cgit/openstack/collectd-ceilometer-plugin>`__
+congress                               `git://git.openstack.org/openstack/congress <https://git.openstack.org/cgit/openstack/congress>`__
+cue                                    `git://git.openstack.org/openstack/cue <https://git.openstack.org/cgit/openstack/cue>`__
+designate                              `git://git.openstack.org/openstack/designate <https://git.openstack.org/cgit/openstack/designate>`__
+devstack-plugin-additional-pkg-repos   `git://git.openstack.org/openstack/devstack-plugin-additional-pkg-repos <https://git.openstack.org/cgit/openstack/devstack-plugin-additional-pkg-repos>`__
+devstack-plugin-amqp1                  `git://git.openstack.org/openstack/devstack-plugin-amqp1 <https://git.openstack.org/cgit/openstack/devstack-plugin-amqp1>`__
+devstack-plugin-bdd                    `git://git.openstack.org/openstack/devstack-plugin-bdd <https://git.openstack.org/cgit/openstack/devstack-plugin-bdd>`__
+devstack-plugin-ceph                   `git://git.openstack.org/openstack/devstack-plugin-ceph <https://git.openstack.org/cgit/openstack/devstack-plugin-ceph>`__
+devstack-plugin-glusterfs              `git://git.openstack.org/openstack/devstack-plugin-glusterfs <https://git.openstack.org/cgit/openstack/devstack-plugin-glusterfs>`__
+devstack-plugin-hdfs                   `git://git.openstack.org/openstack/devstack-plugin-hdfs <https://git.openstack.org/cgit/openstack/devstack-plugin-hdfs>`__
+devstack-plugin-kafka                  `git://git.openstack.org/openstack/devstack-plugin-kafka <https://git.openstack.org/cgit/openstack/devstack-plugin-kafka>`__
+devstack-plugin-nfs                    `git://git.openstack.org/openstack/devstack-plugin-nfs <https://git.openstack.org/cgit/openstack/devstack-plugin-nfs>`__
+devstack-plugin-pika                   `git://git.openstack.org/openstack/devstack-plugin-pika <https://git.openstack.org/cgit/openstack/devstack-plugin-pika>`__
+devstack-plugin-sheepdog               `git://git.openstack.org/openstack/devstack-plugin-sheepdog <https://git.openstack.org/cgit/openstack/devstack-plugin-sheepdog>`__
+devstack-plugin-zmq                    `git://git.openstack.org/openstack/devstack-plugin-zmq <https://git.openstack.org/cgit/openstack/devstack-plugin-zmq>`__
+dragonflow                             `git://git.openstack.org/openstack/dragonflow <https://git.openstack.org/cgit/openstack/dragonflow>`__
+drbd-devstack                          `git://git.openstack.org/openstack/drbd-devstack <https://git.openstack.org/cgit/openstack/drbd-devstack>`__
+ec2-api                                `git://git.openstack.org/openstack/ec2-api <https://git.openstack.org/cgit/openstack/ec2-api>`__
+freezer                                `git://git.openstack.org/openstack/freezer <https://git.openstack.org/cgit/openstack/freezer>`__
+freezer-api                            `git://git.openstack.org/openstack/freezer-api <https://git.openstack.org/cgit/openstack/freezer-api>`__
+freezer-web-ui                         `git://git.openstack.org/openstack/freezer-web-ui <https://git.openstack.org/cgit/openstack/freezer-web-ui>`__
+gce-api                                `git://git.openstack.org/openstack/gce-api <https://git.openstack.org/cgit/openstack/gce-api>`__
+gnocchi                                `git://git.openstack.org/openstack/gnocchi <https://git.openstack.org/cgit/openstack/gnocchi>`__
+ironic                                 `git://git.openstack.org/openstack/ironic <https://git.openstack.org/cgit/openstack/ironic>`__
+ironic-inspector                       `git://git.openstack.org/openstack/ironic-inspector <https://git.openstack.org/cgit/openstack/ironic-inspector>`__
+kingbird                               `git://git.openstack.org/openstack/kingbird <https://git.openstack.org/cgit/openstack/kingbird>`__
+kuryr                                  `git://git.openstack.org/openstack/kuryr <https://git.openstack.org/cgit/openstack/kuryr>`__
+magnum                                 `git://git.openstack.org/openstack/magnum <https://git.openstack.org/cgit/openstack/magnum>`__
+magnum-ui                              `git://git.openstack.org/openstack/magnum-ui <https://git.openstack.org/cgit/openstack/magnum-ui>`__
+manila                                 `git://git.openstack.org/openstack/manila <https://git.openstack.org/cgit/openstack/manila>`__
+mistral                                `git://git.openstack.org/openstack/mistral <https://git.openstack.org/cgit/openstack/mistral>`__
+monasca-api                            `git://git.openstack.org/openstack/monasca-api <https://git.openstack.org/cgit/openstack/monasca-api>`__
+murano                                 `git://git.openstack.org/openstack/murano <https://git.openstack.org/cgit/openstack/murano>`__
+networking-6wind                       `git://git.openstack.org/openstack/networking-6wind <https://git.openstack.org/cgit/openstack/networking-6wind>`__
+networking-bagpipe                     `git://git.openstack.org/openstack/networking-bagpipe <https://git.openstack.org/cgit/openstack/networking-bagpipe>`__
+networking-bgpvpn                      `git://git.openstack.org/openstack/networking-bgpvpn <https://git.openstack.org/cgit/openstack/networking-bgpvpn>`__
+networking-brocade                     `git://git.openstack.org/openstack/networking-brocade <https://git.openstack.org/cgit/openstack/networking-brocade>`__
+networking-calico                      `git://git.openstack.org/openstack/networking-calico <https://git.openstack.org/cgit/openstack/networking-calico>`__
+networking-cisco                       `git://git.openstack.org/openstack/networking-cisco <https://git.openstack.org/cgit/openstack/networking-cisco>`__
+networking-fortinet                    `git://git.openstack.org/openstack/networking-fortinet <https://git.openstack.org/cgit/openstack/networking-fortinet>`__
+networking-generic-switch              `git://git.openstack.org/openstack/networking-generic-switch <https://git.openstack.org/cgit/openstack/networking-generic-switch>`__
+networking-infoblox                    `git://git.openstack.org/openstack/networking-infoblox <https://git.openstack.org/cgit/openstack/networking-infoblox>`__
+networking-l2gw                        `git://git.openstack.org/openstack/networking-l2gw <https://git.openstack.org/cgit/openstack/networking-l2gw>`__
+networking-midonet                     `git://git.openstack.org/openstack/networking-midonet <https://git.openstack.org/cgit/openstack/networking-midonet>`__
+networking-mlnx                        `git://git.openstack.org/openstack/networking-mlnx <https://git.openstack.org/cgit/openstack/networking-mlnx>`__
+networking-nec                         `git://git.openstack.org/openstack/networking-nec <https://git.openstack.org/cgit/openstack/networking-nec>`__
+networking-odl                         `git://git.openstack.org/openstack/networking-odl <https://git.openstack.org/cgit/openstack/networking-odl>`__
+networking-ofagent                     `git://git.openstack.org/openstack/networking-ofagent <https://git.openstack.org/cgit/openstack/networking-ofagent>`__
+networking-ovn                         `git://git.openstack.org/openstack/networking-ovn <https://git.openstack.org/cgit/openstack/networking-ovn>`__
+networking-ovs-dpdk                    `git://git.openstack.org/openstack/networking-ovs-dpdk <https://git.openstack.org/cgit/openstack/networking-ovs-dpdk>`__
+networking-plumgrid                    `git://git.openstack.org/openstack/networking-plumgrid <https://git.openstack.org/cgit/openstack/networking-plumgrid>`__
+networking-powervm                     `git://git.openstack.org/openstack/networking-powervm <https://git.openstack.org/cgit/openstack/networking-powervm>`__
+networking-sfc                         `git://git.openstack.org/openstack/networking-sfc <https://git.openstack.org/cgit/openstack/networking-sfc>`__
+networking-vsphere                     `git://git.openstack.org/openstack/networking-vsphere <https://git.openstack.org/cgit/openstack/networking-vsphere>`__
+neutron                                `git://git.openstack.org/openstack/neutron <https://git.openstack.org/cgit/openstack/neutron>`__
+neutron-lbaas                          `git://git.openstack.org/openstack/neutron-lbaas <https://git.openstack.org/cgit/openstack/neutron-lbaas>`__
+neutron-lbaas-dashboard                `git://git.openstack.org/openstack/neutron-lbaas-dashboard <https://git.openstack.org/cgit/openstack/neutron-lbaas-dashboard>`__
+neutron-vpnaas                         `git://git.openstack.org/openstack/neutron-vpnaas <https://git.openstack.org/cgit/openstack/neutron-vpnaas>`__
+nova-docker                            `git://git.openstack.org/openstack/nova-docker <https://git.openstack.org/cgit/openstack/nova-docker>`__
+nova-powervm                           `git://git.openstack.org/openstack/nova-powervm <https://git.openstack.org/cgit/openstack/nova-powervm>`__
+octavia                                `git://git.openstack.org/openstack/octavia <https://git.openstack.org/cgit/openstack/octavia>`__
+osprofiler                             `git://git.openstack.org/openstack/osprofiler <https://git.openstack.org/cgit/openstack/osprofiler>`__
+python-freezerclient                   `git://git.openstack.org/openstack/python-freezerclient <https://git.openstack.org/cgit/openstack/python-freezerclient>`__
+rally                                  `git://git.openstack.org/openstack/rally <https://git.openstack.org/cgit/openstack/rally>`__
+sahara                                 `git://git.openstack.org/openstack/sahara <https://git.openstack.org/cgit/openstack/sahara>`__
+sahara-dashboard                       `git://git.openstack.org/openstack/sahara-dashboard <https://git.openstack.org/cgit/openstack/sahara-dashboard>`__
+scalpels                               `git://git.openstack.org/openstack/scalpels <https://git.openstack.org/cgit/openstack/scalpels>`__
+searchlight                            `git://git.openstack.org/openstack/searchlight <https://git.openstack.org/cgit/openstack/searchlight>`__
+searchlight-ui                         `git://git.openstack.org/openstack/searchlight-ui <https://git.openstack.org/cgit/openstack/searchlight-ui>`__
+senlin                                 `git://git.openstack.org/openstack/senlin <https://git.openstack.org/cgit/openstack/senlin>`__
+smaug                                  `git://git.openstack.org/openstack/smaug <https://git.openstack.org/cgit/openstack/smaug>`__
+smaug-dashboard                        `git://git.openstack.org/openstack/smaug-dashboard <https://git.openstack.org/cgit/openstack/smaug-dashboard>`__
+solum                                  `git://git.openstack.org/openstack/solum <https://git.openstack.org/cgit/openstack/solum>`__
+tacker                                 `git://git.openstack.org/openstack/tacker <https://git.openstack.org/cgit/openstack/tacker>`__
+tap-as-a-service                       `git://git.openstack.org/openstack/tap-as-a-service <https://git.openstack.org/cgit/openstack/tap-as-a-service>`__
+tricircle                              `git://git.openstack.org/openstack/tricircle <https://git.openstack.org/cgit/openstack/tricircle>`__
+trove                                  `git://git.openstack.org/openstack/trove <https://git.openstack.org/cgit/openstack/trove>`__
+trove-dashboard                        `git://git.openstack.org/openstack/trove-dashboard <https://git.openstack.org/cgit/openstack/trove-dashboard>`__
+vitrage                                `git://git.openstack.org/openstack/vitrage <https://git.openstack.org/cgit/openstack/vitrage>`__
+vitrage-dashboard                      `git://git.openstack.org/openstack/vitrage-dashboard <https://git.openstack.org/cgit/openstack/vitrage-dashboard>`__
+vmware-nsx                             `git://git.openstack.org/openstack/vmware-nsx <https://git.openstack.org/cgit/openstack/vmware-nsx>`__
+watcher                                `git://git.openstack.org/openstack/watcher <https://git.openstack.org/cgit/openstack/watcher>`__
+watcher-dashboard                      `git://git.openstack.org/openstack/watcher-dashboard <https://git.openstack.org/cgit/openstack/watcher-dashboard>`__
+zaqar                                  `git://git.openstack.org/openstack/zaqar <https://git.openstack.org/cgit/openstack/zaqar>`__
+zaqar-ui                               `git://git.openstack.org/openstack/zaqar-ui <https://git.openstack.org/cgit/openstack/zaqar-ui>`__
+====================================== ===
+
+
diff --git a/tools/generate-devstack-plugins-list.sh b/tools/generate-devstack-plugins-list.sh
index ea30cd5568..95f13318b8 100644
--- a/tools/generate-devstack-plugins-list.sh
+++ b/tools/generate-devstack-plugins-list.sh
@@ -78,6 +78,9 @@ for plugin in ${sorted_plugins}; do
     gitlink="https://git.openstack.org/cgit/openstack/${plugin}"
     printf "%-${name_col_len}s %s\n" "${plugin}" "\`${giturl} <${gitlink}>\`__"
 done
+
+title_underline ${name_col_len}
+
 printf "\n\n"
 
 if [[ -r data/devstack-plugins-registry.footer ]]; then

From cdf9c0f73b7a8d332852d43dacad8cd0c8993a1e Mon Sep 17 00:00:00 2001
From: Paul Belanger <pabelanger@redhat.com>
Date: Thu, 7 Apr 2016 14:41:58 -0400
Subject: [PATCH 0364/2409] Replace vivid support with xenial

Ubuntu vivid support is EOL lets make room for xenial.

Change-Id: I21c4966c80e0b5fc2b1a7448020dd1c75e0070ad
Signed-off-by: Paul Belanger <pabelanger@redhat.com>
---
 stack.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index 6e1fe37f2a..739d939ff1 100755
--- a/stack.sh
+++ b/stack.sh
@@ -185,7 +185,7 @@ source $TOP_DIR/stackrc
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (trusty|vivid|wily|7.0|wheezy|sid|testing|jessie|f22|f23|rhel7|kvmibm1) ]]; then
+if [[ ! ${DISTRO} =~ (trusty|wily|xenial|7.0|wheezy|sid|testing|jessie|f22|f23|rhel7|kvmibm1) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From 3888098245a8d1c9c48f9af717d3991e7acf99d9 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Sat, 9 Apr 2016 21:42:24 -0400
Subject: [PATCH 0365/2409] Move nova's api_paste_config into wsgi group

Change 0b9e378cca2be4e034ad401d71fbe4470907f93a moved the
api_paste_config from the DEFAULT group to the wsgi group
and deprecated it's usage in DEFAULT.

Change-Id: I283db638e76b986d3e728c6caf34a0b3f37fc9b6
---
 lib/nova | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index ad72fc3ca1..acf55cc075 100644
--- a/lib/nova
+++ b/lib/nova
@@ -466,7 +466,7 @@ function create_nova_conf {
     if [ "$NOVA_ALLOW_MOVE_TO_SAME_HOST" == "True" ]; then
         iniset $NOVA_CONF DEFAULT allow_resize_to_same_host "True"
     fi
-    iniset $NOVA_CONF DEFAULT api_paste_config "$NOVA_API_PASTE_INI"
+    iniset $NOVA_CONF wsgi api_paste_config "$NOVA_API_PASTE_INI"
     iniset $NOVA_CONF DEFAULT rootwrap_config "$NOVA_CONF_DIR/rootwrap.conf"
     iniset $NOVA_CONF DEFAULT scheduler_driver "$SCHEDULER"
     iniset $NOVA_CONF DEFAULT scheduler_default_filters "$FILTERS"

From e7361775c112e32ea517eddc344641897d273d25 Mon Sep 17 00:00:00 2001
From: Eyal <eyal.bar-ilan@nokia.com>
Date: Tue, 5 Apr 2016 16:18:56 +0300
Subject: [PATCH 0366/2409] print statment has become a function in py3

Change-Id: Ia616e1fdd4c3fc8e1a36b026e0c3e2a568dc6517
---
 tools/generate-devstack-plugins-list.py |  4 ++--
 tools/worlddump.py                      | 31 +++++++++++++------------
 2 files changed, 18 insertions(+), 17 deletions(-)

diff --git a/tools/generate-devstack-plugins-list.py b/tools/generate-devstack-plugins-list.py
index aeec4dd27d..089a6ef93e 100644
--- a/tools/generate-devstack-plugins-list.py
+++ b/tools/generate-devstack-plugins-list.py
@@ -53,7 +53,7 @@ def has_devstack_plugin(proj):
     if len(r.text) > 0:
         return True
     else:
-        False
+        return False
 
 logging.debug("Getting project list from %s" % url)
 r = requests.get(url)
@@ -64,4 +64,4 @@ def has_devstack_plugin(proj):
 
 for project in found_plugins:
     # strip of openstack/
-    print project[10:]
+    print(project[10:])
diff --git a/tools/worlddump.py b/tools/worlddump.py
index 345c2a3d94..3d7912a2ec 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -14,6 +14,7 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
+
 """Dump the state of the world for post mortem."""
 
 import argparse
@@ -48,32 +49,32 @@ def filename(dirname, name=""):
 
 
 def warn(msg):
-    print "WARN: %s" % msg
+    print("WARN: %s" % msg)
 
 
 def _dump_cmd(cmd):
-    print cmd
-    print "-" * len(cmd)
-    print
+    print(cmd)
+    print("-" * len(cmd))
+    print()
     try:
         subprocess.check_call(cmd, shell=True)
-        print
+        print()
     except subprocess.CalledProcessError as e:
-        print "*** Failed to run '%(cmd)s': %(err)s" % {'cmd': cmd, 'err': e}
+        print("*** Failed to run '%(cmd)s': %(err)s" % {'cmd': cmd, 'err': e})
 
 
 def _find_cmd(cmd):
     if not spawn.find_executable(cmd):
-        print "*** %s not found: skipping" % cmd
+        print("*** %s not found: skipping" % cmd)
         return False
     return True
 
 
 def _header(name):
-    print
-    print name
-    print "=" * len(name)
-    print
+    print()
+    print(name)
+    print("=" * len(name))
+    print()
 
 
 # This method gets a max openflow version supported by openvswitch.
@@ -109,7 +110,7 @@ def disk_space():
             # if it doesn't look like an int, that's fine
             pass
 
-    print dfraw
+    print(dfraw)
 
 
 def ebtables_dump():
@@ -193,17 +194,17 @@ def guru_meditation_report():
     try:
         subprocess.check_call(["pgrep","nova-compute"])
     except subprocess.CalledProcessError:
-        print "Skipping as nova-compute does not appear to be running"
+        print("Skipping as nova-compute does not appear to be running")
         return
 
     _dump_cmd("kill -s USR2 `pgrep nova-compute`")
-    print "guru meditation report in nova-compute log"
+    print("guru meditation report in nova-compute log")
 
 
 def main():
     opts = get_options()
     fname = filename(opts.dir, opts.name)
-    print "World dumping... see %s for details" % fname
+    print("World dumping... see %s for details" % fname)
     sys.stdout = os.fdopen(sys.stdout.fileno(), 'w', 0)
     with open(fname, 'w') as f:
         os.dup2(f.fileno(), sys.stdout.fileno())

From e8177a5412da6b190825dc1944fe3f93e208b890 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 5 Apr 2016 09:21:24 +1000
Subject: [PATCH 0367/2409] Be a bit more explicit about the plugin generation

Make the warning in the auto-generated file stand-out a bit more, so
people don't waste time trying to add entries that appear
automatically.

Change-Id: Icf4290e1fad21ce72af54c178bafcce0b287cdf6
---
 data/devstack-plugins-registry.header | 31 +++++++++++++++------------
 1 file changed, 17 insertions(+), 14 deletions(-)

diff --git a/data/devstack-plugins-registry.header b/data/devstack-plugins-registry.header
index f105fe9d35..6119ab5284 100644
--- a/data/devstack-plugins-registry.header
+++ b/data/devstack-plugins-registry.header
@@ -1,20 +1,23 @@
 ..
-  Note to patch submitters: this file is covered by a periodic proposal
-  job.  You should edit the files data/devstack-plugins-registry.footer
-  data/devstack-plugins-registry.header instead of this one.
+
+  Note to patch submitters:
+
+  # ============================= #
+  # THIS FILE IS AUTOGENERATED !  #
+  # ============================= #
+
+  ** Plugins are found automatically and added to this list **
+
+  This file is created by a periodic proposal job.  You should not
+  edit this file.
+
+  You should edit the files data/devstack-plugins-registry.footer
+  data/devstack-plugins-registry.header to modify this text.
 
 ==========================
  DevStack Plugin Registry
 ==========================
 
-Since we've created the external plugin mechanism, it's gotten used by
-a lot of projects. The following is a list of plugins that currently
-exist. Any project that wishes to list their plugin here is welcomed
-to.
-
-Detected Plugins
-================
-
-The following are plugins that a script has found in the openstack/
-namespace, which includes but is not limited to official OpenStack
-projects.
+The following list is an automatically-generated collection of
+available DevStack plugins.  This includes, but is not limited to,
+official OpenStack projects.

From 2f5596e59051ab23dfc0dd85b083e9328600fbb1 Mon Sep 17 00:00:00 2001
From: Huan Xie <huan.xie@citrix.com>
Date: Tue, 5 Apr 2016 22:22:48 -0700
Subject: [PATCH 0368/2409] Use configured values instead of default value

Variables PUBLIC_INTERFACE_DEFAULT and GUEST_INTERFACE_DEFAULT
are only use to provide default value, deployment script should
not use such values directly

Closes-Bug: #1566768

Change-Id: Ib543b416df861086fa2edbe7df769b224d0b0add
---
 lib/neutron_plugins/openvswitch_agent | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/lib/neutron_plugins/openvswitch_agent b/lib/neutron_plugins/openvswitch_agent
index 339d5fd96a..aba2587ea4 100644
--- a/lib/neutron_plugins/openvswitch_agent
+++ b/lib/neutron_plugins/openvswitch_agent
@@ -96,17 +96,17 @@ function neutron_plugin_configure_plugin_agent {
 
         # Set up domU's L2 agent:
 
-        # Create a bridge "br-$GUEST_INTERFACE_DEFAULT"
-        _neutron_ovs_base_add_bridge "br-$GUEST_INTERFACE_DEFAULT"
-        # Add $GUEST_INTERFACE_DEFAULT to that bridge
-        sudo ovs-vsctl -- --may-exist add-port "br-$GUEST_INTERFACE_DEFAULT" $GUEST_INTERFACE_DEFAULT
+        # Create a bridge "br-$VLAN_INTERFACE"
+        _neutron_ovs_base_add_bridge "br-$VLAN_INTERFACE"
+        # Add $VLAN_INTERFACE to that bridge
+        sudo ovs-vsctl -- --may-exist add-port "br-$VLAN_INTERFACE" $VLAN_INTERFACE
 
         # Create external bridge and add port
         _neutron_ovs_base_add_bridge $PUBLIC_BRIDGE
-        sudo ovs-vsctl -- --may-exist add-port $PUBLIC_BRIDGE $PUBLIC_INTERFACE_DEFAULT
+        sudo ovs-vsctl -- --may-exist add-port $PUBLIC_BRIDGE $PUBLIC_INTERFACE
 
         # Set bridge mappings to "physnet1:br-$GUEST_INTERFACE_DEFAULT"
-        iniset "/$Q_PLUGIN_CONF_FILE.domU" ovs bridge_mappings "physnet1:br-$GUEST_INTERFACE_DEFAULT,physnet-ex:$PUBLIC_BRIDGE"
+        iniset "/$Q_PLUGIN_CONF_FILE.domU" ovs bridge_mappings "physnet1:br-$VLAN_INTERFACE,physnet-ex:$PUBLIC_BRIDGE"
         # Set integration bridge to domU's
         iniset "/$Q_PLUGIN_CONF_FILE.domU" ovs integration_bridge $OVS_BRIDGE
         # Set root wrap

From b6259586bf241b4589965642ac76d250a0774e6f Mon Sep 17 00:00:00 2001
From: Markus Zoeller <mzoeller@de.ibm.com>
Date: Mon, 11 Apr 2016 10:17:55 +0200
Subject: [PATCH 0369/2409] Replace deprecated config option
 [DEFAULT].rabbit_vritual_host

The test job "gate-tempest-dsvm-cells" uses the Nova cells concept.
This triggered a deprecation warning:

    WARNING oslo_config.cfg [...]
    Option "rabbit_virtual_host" from group "DEFAULT" is deprecated.
    Use option "rabbit_virtual_host" from group "oslo_messaging_rabbit".

This change removes that warning.

Change-Id: Ieaf437ecbf58edb8994f6afcb0ac2afcd5585a1e
---
 lib/nova | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index ad72fc3ca1..8823e1ddb4 100644
--- a/lib/nova
+++ b/lib/nova
@@ -648,7 +648,7 @@ function init_nova_cells {
     if is_service_enabled n-cell; then
         cp $NOVA_CONF $NOVA_CELLS_CONF
         iniset $NOVA_CELLS_CONF database connection `database_connection_url $NOVA_CELLS_DB`
-        iniset $NOVA_CELLS_CONF DEFAULT rabbit_virtual_host child_cell
+        iniset $NOVA_CELLS_CONF oslo_messaging_rabbit rabbit_virtual_host child_cell
         iniset $NOVA_CELLS_CONF DEFAULT dhcpbridge_flagfile $NOVA_CELLS_CONF
         iniset $NOVA_CELLS_CONF cells enable True
         iniset $NOVA_CELLS_CONF cells cell_type compute

From e8f3f7aa0d650da49325ab5ccd072232a6ab088c Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Mon, 11 Apr 2016 12:52:39 -0400
Subject: [PATCH 0370/2409] Fix usage of tempest utils during config

Most of the tempest utilities need at least a partially setup
configuration file to work properly. This is because most of them
make api requests in order to perform the expected operations.
This causes a bit of a chicken and egg problem when we rely on
these utilities for configuration purposes since we don't know if
we have enough of a configuration file to run things. This previously
wasn't an issue because all we needed to run was verify-tempest config
and it wasn't in a critical path just for api extension discovery and
it wasn't relied on. But, with the addition of tempest preprovisioned
credentials we rely on a tempest util to create the credentials we
use for running things. We need to ensure the util has as complete of
a config file when it's run to ensure that everything is in the
correct state.

This commit moves the running of all tempest utils and the associated
iniset calls to the end of the configure_tempest function to ensure
that the utils have as complete a config file as possible.
Additionally, it makes all tempest util calls are venv isolated. (which
is mostly future proofing for when things are branched on stable)

Change-Id: I5844aed4e134fbc7210aa0eca83500e260915b7b
---
 lib/tempest | 137 +++++++++++++++++++++++++++-------------------------
 1 file changed, 70 insertions(+), 67 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 67b631e596..fd98c948f2 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -317,44 +317,6 @@ function configure_tempest {
     fi
 
     # Compute Features
-    # Run ``verify_tempest_config -ur`` to retrieve enabled extensions on API endpoints
-    # NOTE(mtreinish): This must be done after auth settings are added to the tempest config
-    local tmp_cfg_file
-    tmp_cfg_file=$(mktemp)
-    cd $TEMPEST_DIR
-    if [[ "$OFFLINE" != "True" ]]; then
-        tox -revenv --notest
-    fi
-
-    # Auth
-    iniset $TEMPEST_CONFIG auth tempest_roles "Member"
-    if [[ $TEMPEST_USE_TEST_ACCOUNTS == "True" ]]; then
-        if [[ $TEMPEST_HAS_ADMIN == "True" ]]; then
-            tempest-account-generator -c $TEMPEST_CONFIG --os-username $admin_username --os-password "$password" --os-tenant-name $admin_project_name -r $TEMPEST_CONCURRENCY --with-admin etc/accounts.yaml
-        else
-            tempest-account-generator -c $TEMPEST_CONFIG --os-username $admin_username --os-password "$password" --os-tenant-name $admin_project_name -r $TEMPEST_CONCURRENCY etc/accounts.yaml
-        fi
-        iniset $TEMPEST_CONFIG auth use_dynamic_credentials False
-        iniset $TEMPEST_CONFIG auth test_accounts_file "etc/accounts.yaml"
-    elif [[ $TEMPEST_HAS_ADMIN == "False" ]]; then
-        iniset $TEMPEST_CONFIG auth use_dynamic_credentials ${TEMPEST_ALLOW_TENANT_ISOLATION:-False}
-
-    else
-        iniset $TEMPEST_CONFIG auth use_dynamic_credentials ${TEMPEST_ALLOW_TENANT_ISOLATION:-True}
-    fi
-
-    # NOTE(mtreinish): Respect constraints on tempest verify-config venv
-    tox -evenv -- pip install -c $REQUIREMENTS_DIR/upper-constraints.txt -r requirements.txt
-    tox -evenv -- tempest verify-config -uro $tmp_cfg_file
-
-    local compute_api_extensions=${COMPUTE_API_EXTENSIONS:-"all"}
-    if [[ ! -z "$DISABLE_COMPUTE_API_EXTENSIONS" ]]; then
-        # Enabled extensions are either the ones explicitly specified or those available on the API endpoint
-        compute_api_extensions=${COMPUTE_API_EXTENSIONS:-$(iniget $tmp_cfg_file compute-feature-enabled api_extensions | tr -d " ")}
-        # Remove disabled extensions
-        compute_api_extensions=$(remove_disabled_extensions $compute_api_extensions $DISABLE_COMPUTE_API_EXTENSIONS)
-    fi
-
     # Set the microversion range for compute tests.
     # This is used to run the Nova microversions tests.
     # Setting [None, latest] range of microversion which allow Tempest to run all microversions tests.
@@ -383,7 +345,6 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG compute-feature-enabled live_migration ${LIVE_MIGRATION_AVAILABLE:-False}
     iniset $TEMPEST_CONFIG compute-feature-enabled change_password False
     iniset $TEMPEST_CONFIG compute-feature-enabled block_migration_for_live_migration ${USE_BLOCK_MIGRATION_FOR_LIVE_MIGRATION:-False}
-    iniset $TEMPEST_CONFIG compute-feature-enabled api_extensions $compute_api_extensions
     # TODO(mriedem): Remove the preserve_ports flag when Juno is end of life.
     iniset $TEMPEST_CONFIG compute-feature-enabled preserve_ports True
     # TODO(gilliard): Remove the live_migrate_paused_instances flag when Juno is end of life.
@@ -420,15 +381,6 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG network-feature-enabled ipv6 "$IPV6_ENABLED"
     iniset $TEMPEST_CONFIG network-feature-enabled ipv6_subnet_attributes "$IPV6_SUBNET_ATTRIBUTES_ENABLED"
 
-    local network_api_extensions=${NETWORK_API_EXTENSIONS:-"all"}
-    if [[ ! -z "$DISABLE_NETWORK_API_EXTENSIONS" ]]; then
-        # Enabled extensions are either the ones explicitly specified or those available on the API endpoint
-        network_api_extensions=${NETWORK_API_EXTENSIONS:-$(iniget $tmp_cfg_file network-feature-enabled api_extensions | tr -d " ")}
-        # Remove disabled extensions
-        network_api_extensions=$(remove_disabled_extensions $network_api_extensions $DISABLE_NETWORK_API_EXTENSIONS)
-    fi
-    iniset $TEMPEST_CONFIG network-feature-enabled api_extensions $network_api_extensions
-
     # Orchestration Tests
     if is_service_enabled heat; then
         if [[ ! -z "$HEAT_CFN_IMAGE_URL" ]]; then
@@ -461,16 +413,6 @@ function configure_tempest {
     # Telemetry
     iniset $TEMPEST_CONFIG telemetry-feature-enabled events "True"
 
-    # Object Store
-    local object_storage_api_extensions=${OBJECT_STORAGE_API_EXTENSIONS:-"all"}
-    if [[ ! -z "$DISABLE_OBJECT_STORAGE_API_EXTENSIONS" ]]; then
-        # Enabled extensions are either the ones explicitly specified or those available on the API endpoint
-        object_storage_api_extensions=${OBJECT_STORAGE_API_EXTENSIONS:-$(iniget $tmp_cfg_file object-storage-feature-enabled discoverable_apis | tr -d " ")}
-        # Remove disabled extensions
-        object_storage_api_extensions=$(remove_disabled_extensions $object_storage_api_extensions $DISABLE_STORAGE_API_EXTENSIONS)
-    fi
-    iniset $TEMPEST_CONFIG object-storage-feature-enabled discoverable_apis $object_storage_api_extensions
-
     # Validation
     iniset $TEMPEST_CONFIG validation run_validation ${TEMPEST_RUN_VALIDATION:-False}
     iniset $TEMPEST_CONFIG validation ip_version_for_ssh 4
@@ -484,15 +426,6 @@ function configure_tempest {
     # TODO(ynesenenko): Remove the volume_services flag when Liberty and Kilo will correct work with host info.
     iniset $TEMPEST_CONFIG volume-feature-enabled volume_services True
 
-    local volume_api_extensions=${VOLUME_API_EXTENSIONS:-"all"}
-    if [[ ! -z "$DISABLE_VOLUME_API_EXTENSIONS" ]]; then
-        # Enabled extensions are either the ones explicitly specified or those available on the API endpoint
-        volume_api_extensions=${VOLUME_API_EXTENSIONS:-$(iniget $tmp_cfg_file volume-feature-enabled api_extensions | tr -d " ")}
-        # Remove disabled extensions
-        volume_api_extensions=$(remove_disabled_extensions $volume_api_extensions $DISABLE_VOLUME_API_EXTENSIONS)
-    fi
-    iniset $TEMPEST_CONFIG volume-feature-enabled api_extensions $volume_api_extensions
-
     if ! is_service_enabled c-bak; then
         iniset $TEMPEST_CONFIG volume-feature-enabled backup False
     fi
@@ -573,6 +506,76 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG service_available cinder "False"
     fi
 
+    # Run tempest configuration utilities. This must be done last during configuration to
+    # ensure as complete a config as possible already exists
+
+    # NOTE(mtreinish): Respect constraints on tempest verify-config venv
+    local tmp_cfg_file
+    tmp_cfg_file=$(mktemp)
+    cd $TEMPEST_DIR
+    if [[ "$OFFLINE" != "True" ]]; then
+        tox -revenv --notest
+    fi
+    tox -evenv -- pip install -c $REQUIREMENTS_DIR/upper-constraints.txt -r requirements.txt
+
+    # Auth:
+    iniset $TEMPEST_CONFIG auth tempest_roles "Member"
+    if [[ $TEMPEST_USE_TEST_ACCOUNTS == "True" ]]; then
+        if [[ $TEMPEST_HAS_ADMIN == "True" ]]; then
+            tox -evenv -- tempest-account-generator -c $TEMPEST_CONFIG --os-username $admin_username --os-password "$password" --os-tenant-name $admin_project_name -r $TEMPEST_CONCURRENCY --with-admin etc/accounts.yaml
+        else
+            tox -evenv -- tempest-account-generator -c $TEMPEST_CONFIG --os-username $admin_username --os-password "$password" --os-tenant-name $admin_project_name -r $TEMPEST_CONCURRENCY etc/accounts.yaml
+        fi
+        iniset $TEMPEST_CONFIG auth use_dynamic_credentials False
+        iniset $TEMPEST_CONFIG auth test_accounts_file "etc/accounts.yaml"
+    elif [[ $TEMPEST_HAS_ADMIN == "False" ]]; then
+        iniset $TEMPEST_CONFIG auth use_dynamic_credentials ${TEMPEST_ALLOW_TENANT_ISOLATION:-False}
+
+    else
+        iniset $TEMPEST_CONFIG auth use_dynamic_credentials ${TEMPEST_ALLOW_TENANT_ISOLATION:-True}
+    fi
+
+    # API Extensions
+    # Run ``verify_tempest_config -ur`` to retrieve enabled extensions on API endpoints
+    # NOTE(mtreinish): This must be done after auth settings are added to the tempest config
+    tox -evenv -- tempest verify-config -uro $tmp_cfg_file
+    # Nova API extensions
+    local compute_api_extensions=${COMPUTE_API_EXTENSIONS:-"all"}
+    if [[ ! -z "$DISABLE_COMPUTE_API_EXTENSIONS" ]]; then
+        # Enabled extensions are either the ones explicitly specified or those available on the API endpoint
+        compute_api_extensions=${COMPUTE_API_EXTENSIONS:-$(iniget $tmp_cfg_file compute-feature-enabled api_extensions | tr -d " ")}
+        # Remove disabled extensions
+        compute_api_extensions=$(remove_disabled_extensions $compute_api_extensions $DISABLE_COMPUTE_API_EXTENSIONS)
+    fi
+    iniset $TEMPEST_CONFIG compute-feature-enabled api_extensions $compute_api_extensions
+    # Neutron API Extensions
+    local network_api_extensions=${NETWORK_API_EXTENSIONS:-"all"}
+    if [[ ! -z "$DISABLE_NETWORK_API_EXTENSIONS" ]]; then
+        # Enabled extensions are either the ones explicitly specified or those available on the API endpoint
+        network_api_extensions=${NETWORK_API_EXTENSIONS:-$(iniget $tmp_cfg_file network-feature-enabled api_extensions | tr -d " ")}
+        # Remove disabled extensions
+        network_api_extensions=$(remove_disabled_extensions $network_api_extensions $DISABLE_NETWORK_API_EXTENSIONS)
+    fi
+    iniset $TEMPEST_CONFIG network-feature-enabled api_extensions $network_api_extensions
+    # Swift API Extensions
+    local object_storage_api_extensions=${OBJECT_STORAGE_API_EXTENSIONS:-"all"}
+    if [[ ! -z "$DISABLE_OBJECT_STORAGE_API_EXTENSIONS" ]]; then
+        # Enabled extensions are either the ones explicitly specified or those available on the API endpoint
+        object_storage_api_extensions=${OBJECT_STORAGE_API_EXTENSIONS:-$(iniget $tmp_cfg_file object-storage-feature-enabled discoverable_apis | tr -d " ")}
+        # Remove disabled extensions
+        object_storage_api_extensions=$(remove_disabled_extensions $object_storage_api_extensions $DISABLE_STORAGE_API_EXTENSIONS)
+    fi
+    iniset $TEMPEST_CONFIG object-storage-feature-enabled discoverable_apis $object_storage_api_extensions
+    # Cinder API Extensions
+    local volume_api_extensions=${VOLUME_API_EXTENSIONS:-"all"}
+    if [[ ! -z "$DISABLE_VOLUME_API_EXTENSIONS" ]]; then
+        # Enabled extensions are either the ones explicitly specified or those available on the API endpoint
+        volume_api_extensions=${VOLUME_API_EXTENSIONS:-$(iniget $tmp_cfg_file volume-feature-enabled api_extensions | tr -d " ")}
+        # Remove disabled extensions
+        volume_api_extensions=$(remove_disabled_extensions $volume_api_extensions $DISABLE_VOLUME_API_EXTENSIONS)
+    fi
+    iniset $TEMPEST_CONFIG volume-feature-enabled api_extensions $volume_api_extensions
+
     # Restore IFS
     IFS=$ifs
 }

From cb32230e528414f6280a2ceaaf2d77f895b3587d Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 12 Apr 2016 10:30:52 +1000
Subject: [PATCH 0371/2409] Revert "Work around broken rabbitmq 3.6.1 packages
 on Fedora 23"

This reverts commit 616957d5981310e465e9fb3fd0c040751d8b0b63.

Fixed packages are released to F23 stable

Change-Id: I6c1ecaf9afb78afa3051922eb8347a2610e57416
---
 tools/fixup_stuff.sh | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index 15cb5a1180..193a1f7aba 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -159,14 +159,6 @@ if is_fedora; then
             pip_install --upgrade --force-reinstall requests
         fi
     fi
-
-    if [[ "$os_VENDOR" == "Fedora" ]] && [[ "$os_RELEASE" -ge "23" ]]; then
-        # work-around broken rabbitmq-server 3.6.1 packages
-        #  https://bugzilla.redhat.com/show_bug.cgi?id=1323610
-        # Will be removed when this bug is fixed.
-        sudo dnf -y install \
-             https://kojipkgs.fedoraproject.org/packages/rabbitmq-server/3.5.7/4.fc23/noarch/rabbitmq-server-3.5.7-4.fc23.noarch.rpm
-    fi
 fi
 
 # The version of pip(1.5.4) supported by python-virtualenv(1.11.4) has

From 6f1781f9684d803e1168c20c382ec6fa95fe161f Mon Sep 17 00:00:00 2001
From: zhiyuan_cai <luckyvega.g@gmail.com>
Date: Thu, 7 Apr 2016 18:36:46 +0800
Subject: [PATCH 0372/2409] Fix DevStack failure in multi-region setting

In stack.sh, REGION_NAME is used to set environment variable
OS_REGION_NAME before using OpenStack client to configure accounts
for services. OpenStack client will try to find Keystone endpoint
in REGION_NAME to send the requests.

However, in the case of deploying multiple DevStack instances in
different regions with shared Keystone, Keystone is only running
in one the of region. When installing DevStack for the region that
does not host Keystone, OpenStack client will fail to find the
Keystone endpoint and thus DevStack fails to start.

This patch fixes this bug by introducing KEYSTONE_REGION_NAME for
user to specify which region Keystone is running in. Document of
multi-region setup is also updated.

Change-Id: I3e82c7ff69326d4171623299ffecea103d40c80d
Closes-Bug: #1540802
---
 doc/source/configuration.rst | 10 ++++++++++
 stack.sh                     |  2 +-
 stackrc                      |  6 ++++++
 3 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 0493f8fa25..9d580f0c46 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -630,6 +630,16 @@ In RegionTwo:
     KEYSTONE_SERVICE_HOST=<KEYSTONE_IP_ADDRESS_FROM_REGION_ONE>
     KEYSTONE_AUTH_HOST=<KEYSTONE_IP_ADDRESS_FROM_REGION_ONE>
     REGION_NAME=RegionTwo
+    KEYSTONE_REGION_NAME=RegionOne
+
+In the devstack for RegionOne, we set REGION_NAME as RegionOne, so region of
+the services started in this devstack are registered as RegionOne. In devstack
+for RegionTwo, similarly, we set REGION_NAME as RegionTwo since we want
+services started in this devstack to be registered in RegionTwo. But Keystone
+service is started and registered in RegionOne, not RegionTwo, so we use
+KEYSTONE_REGION_NAME to specify the region of Keystone service.
+KEYSTONE_REGION_NAME has a default value the same as REGION_NAME thus we omit
+it in the configuration of RegionOne.
 
 Disabling Identity API v2
 +++++++++++++++++++++++++
diff --git a/stack.sh b/stack.sh
index 739d939ff1..3de9af2725 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1020,7 +1020,7 @@ export OS_USER_DOMAIN_ID=default
 export OS_PASSWORD=$ADMIN_PASSWORD
 export OS_PROJECT_NAME=admin
 export OS_PROJECT_DOMAIN_ID=default
-export OS_REGION_NAME=$REGION_NAME
+export OS_REGION_NAME=$KEYSTONE_REGION_NAME
 
 EOF
 
diff --git a/stackrc b/stackrc
index 17d6047e20..8858788840 100644
--- a/stackrc
+++ b/stackrc
@@ -42,6 +42,12 @@ fi
 # Specify region name Region
 REGION_NAME=${REGION_NAME:-RegionOne}
 
+# Specify name of region where identity service endpoint is registered.
+# When deploying multiple DevStack instances in different regions with shared
+# Keystone, set KEYSTONE_REGION_NAME to the region where Keystone is running
+# for DevStack instances which do not host Keystone.
+KEYSTONE_REGION_NAME=${KEYSTONE_REGION_NAME:-$REGION_NAME}
+
 # Specify which services to launch.  These generally correspond to
 # screen tabs. To change the default list, use the ``enable_service`` and
 # ``disable_service`` functions in ``local.conf``.

From d0931db1e89bee66ced796552d9db172f9f43639 Mon Sep 17 00:00:00 2001
From: Masayuki Igawa <masayuki.igawa@gmail.com>
Date: Wed, 13 Apr 2016 19:02:40 +0900
Subject: [PATCH 0373/2409] Add execution bit to
 generate-devstack-plugins-list.sh

This commit adds an execution bit to generate-devstack-plugins-list.sh.
This should be useful for users.

Change-Id: I12d0a257eb1d487979d044c2e52e824a6ea4c02d
---
 tools/generate-devstack-plugins-list.sh | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 mode change 100644 => 100755 tools/generate-devstack-plugins-list.sh

diff --git a/tools/generate-devstack-plugins-list.sh b/tools/generate-devstack-plugins-list.sh
old mode 100644
new mode 100755

From 4e6f8ca67047aef99ff1573bddc21b18aae1ce0b Mon Sep 17 00:00:00 2001
From: Fernando Ribeiro <fernando.ribeiro@oracle.com>
Date: Tue, 12 Apr 2016 23:34:03 -0300
Subject: [PATCH 0374/2409] Add installation support for Oracle Linux 7

This removes Oracle Linux 6 support ("OracleLinux") which, like RHEL6,
is now unsupported.  "OracleServer" matches Oracle Linux 7.

Change-Id: I35b1c7d0b103c509283dba0f6551453e7d8ac4cc
Closes-Bug: #1568634
---
 functions-common | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/functions-common b/functions-common
index b0352d38c6..0806681c3b 100644
--- a/functions-common
+++ b/functions-common
@@ -380,7 +380,7 @@ function GetDistro {
         DISTRO="sle${os_RELEASE%.*}"
     elif [[ "$os_VENDOR" =~ (Red.*Hat) || \
         "$os_VENDOR" =~ (CentOS) || \
-        "$os_VENDOR" =~ (OracleLinux) || \
+        "$os_VENDOR" =~ (OracleServer) || \
         "$os_VENDOR" =~ (Virtuozzo) ]]; then
         # Drop the . release as we assume it's compatible
         # XXX re-evaluate when we get RHEL10
@@ -427,7 +427,7 @@ function is_oraclelinux {
         GetOSVersion
     fi
 
-    [ "$os_VENDOR" = "OracleLinux" ]
+    [ "$os_VENDOR" = "OracleServer" ]
 }
 
 
@@ -441,7 +441,7 @@ function is_fedora {
 
     [ "$os_VENDOR" = "Fedora" ] || [ "$os_VENDOR" = "Red Hat" ] || \
         [ "$os_VENDOR" = "RedHatEnterpriseServer" ] || \
-        [ "$os_VENDOR" = "CentOS" ] || [ "$os_VENDOR" = "OracleLinux" ] || \
+        [ "$os_VENDOR" = "CentOS" ] || [ "$os_VENDOR" = "OracleServer" ] || \
         [ "$os_VENDOR" = "Virtuozzo" ] || [ "$os_VENDOR" = "kvmibm" ]
 }
 

From 578459f8088474f8b1d1d29e4ca6f3aa3a5f42c5 Mon Sep 17 00:00:00 2001
From: fumihiko kakuma <kakuma@valinux.co.jp>
Date: Thu, 7 Apr 2016 08:15:45 +0900
Subject: [PATCH 0375/2409] In worlddump, execute ovs-ofctl for an only
 existing bridge

When devstack fails, some or all bridges may not exist.
This change allows an only existing bridge to executes ovs-ofctl command.
And fix duplicate ofp version specified in protocol option of ovs-ofctl.

Change-Id: Ied01de727ca9b867ce87db358f72ae44838b63af
---
 tools/worlddump.py | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/tools/worlddump.py b/tools/worlddump.py
index 3ff22a9dfd..f931f11b2e 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -76,6 +76,12 @@ def _header(name):
     print
 
 
+def _bridge_list():
+    process = subprocess.Popen(['ovs-vsctl', 'list-br'], stdout=subprocess.PIPE)
+    stdout, _ = process.communicate()
+    return stdout.split()
+
+
 # This method gets a max openflow version supported by openvswitch.
 # For example 'ovs-ofctl --version' displays the following:
 #
@@ -157,14 +163,11 @@ def ovs_dump():
     if not _find_cmd('ovs-vsctl'):
         return
 
-    # NOTE(ihrachys): worlddump is used outside of devstack context (f.e. in
-    # grenade), so there is no single place to determine the bridge names from.
-    # Hardcode for now.
-    bridges = ('br-int', 'br-tun', 'br-ex')
+    bridges = _bridge_list()
     ofctl_cmds = ('show', 'dump-ports-desc', 'dump-ports', 'dump-flows')
     ofp_max = _get_ofp_version()
     vers = 'OpenFlow10'
-    for i in range(ofp_max + 1):
+    for i in range(1, ofp_max + 1):
         vers += ',OpenFlow1' + str(i)
     _dump_cmd("sudo ovs-vsctl show")
     for ofctl_cmd in ofctl_cmds:

From 7cd16ce48a9e8986a3ae1427fc8f916f5aa67f3a Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 8 Apr 2016 09:40:56 +1000
Subject: [PATCH 0376/2409] Remove shocco docs and other cleanups

This is a fairly opinionated change to do some spring cleaning on the
documentation.

The current output of shocco as rendered at [1] is completely broken.
I can not see that it is worth us maintaining this.  Honestly, the
github page does a better job at showing the scripts with a bit of
formatting.  The "changes" page is similarly useless today.  cgit or
github show allow browsing of changes in the repo better.  Both are
removed along with support scripts.

When you currently hit the first page, it gives no clue as to what
DevStack actually is.  Add a paragraph explaining that, and link to
the cgit for easy source browsing.

stackrc.rst is not necessary; the stuff about database backends is
already discussed in configuration.rst; move the things about service
repos into a section of configuration.rst.

The discussion in openrc.rst is moved into the configuration.rst file.

localrc.conf.rst was just a paragraph pointing back to
configuration.rst; this is removed.

The variables described in exercise.rst are moved into a separate
section of configuration.rst

[1] http://docs.openstack.org/developer/devstack/#scripts

Change-Id: Ie7f4b265368f1d10a8908d75e11d625b2cc39e7c
---
 doc/source/changes.rst       |  12 ---
 doc/source/configuration.rst | 141 ++++++++++++++++++++++++++++++++++-
 doc/source/exerciserc.rst    |  42 -----------
 doc/source/index.rst         | 109 +++------------------------
 doc/source/local.conf.rst    |   9 ---
 doc/source/openrc.rst        |  68 -----------------
 doc/source/stackrc.rst       |  66 ----------------
 tools/build_docs.sh          | 100 -------------------------
 tox.ini                      |   7 +-
 9 files changed, 151 insertions(+), 403 deletions(-)
 delete mode 100644 doc/source/changes.rst
 delete mode 100644 doc/source/exerciserc.rst
 delete mode 100644 doc/source/local.conf.rst
 delete mode 100644 doc/source/openrc.rst
 delete mode 100644 doc/source/stackrc.rst
 delete mode 100755 tools/build_docs.sh

diff --git a/doc/source/changes.rst b/doc/source/changes.rst
deleted file mode 100644
index 19fce0fd52..0000000000
--- a/doc/source/changes.rst
+++ /dev/null
@@ -1,12 +0,0 @@
-=======
-Changes
-=======
-
-Recent Changes What's been happening?
-=====================================
-
-These are the commits to DevStack for the last six months. For the
-complete list see `the DevStack project in
-Gerrit <https://review.openstack.org/#/q/status:merged+project:openstack-dev/devstack,n,z>`__.
-
-%GIT_LOG%
diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index f3e4896296..3c77f4d793 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -62,8 +62,7 @@ appear in the file will be used.
 A specific meta-section ``local|localrc`` is used to provide a default
 ``localrc`` file (actually ``.localrc.auto``). This allows all custom
 settings for DevStack to be contained in a single file. If ``localrc``
-exists it will be used instead to preserve backward-compatibility. More
-details on the :doc:`contents of local.conf <local.conf>` are available.
+exists it will be used instead to preserve backward-compatibility.
 
 ::
 
@@ -84,6 +83,76 @@ Also note that the ``localrc`` section is sourced as a shell script
 fragment and MUST conform to the shell requirements, specifically no
 whitespace around ``=`` (equals).
 
+openrc
+======
+
+``openrc`` configures login credentials suitable for use with the
+OpenStack command-line tools. ``openrc`` sources ``stackrc`` at the
+beginning (which in turn sources the ``localrc`` section of
+``local.conf``) in order to pick up ``HOST_IP`` and/or ``SERVICE_HOST``
+to use in the endpoints. The values shown below are the default values.
+
+OS\_PROJECT\_NAME (OS\_TENANT\_NAME)
+    Keystone has
+    standardized the term *project* as the entity that owns resources. In
+    some places references still exist to the previous term
+    *tenant* for this use. Also, *project\_name* is preferred to
+    *project\_id*.  OS\_TENANT\_NAME remains supported for compatibility
+    with older tools.
+
+    ::
+
+        OS_PROJECT_NAME=demo
+
+OS\_USERNAME
+    In addition to the owning entity (project), OpenStack calls the entity
+    performing the action *user*.
+
+    ::
+
+        OS_USERNAME=demo
+
+OS\_PASSWORD
+    Keystone's default authentication requires a password be provided.
+    The usual cautions about putting passwords in environment variables
+    apply, for most DevStack uses this may be an acceptable tradeoff.
+
+    ::
+
+        OS_PASSWORD=secret
+
+HOST\_IP, SERVICE\_HOST
+    Set API endpoint host using ``HOST_IP``. ``SERVICE_HOST`` may also
+    be used to specify the endpoint, which is convenient for some
+    ``local.conf`` configurations. Typically, ``HOST_IP`` is set in the
+    ``localrc`` section.
+
+    ::
+
+        HOST_IP=127.0.0.1
+        SERVICE_HOST=$HOST_IP
+
+OS\_AUTH\_URL
+    Authenticating against an OpenStack cloud using Keystone returns a
+    *Token* and *Service Catalog*. The catalog contains the endpoints
+    for all services the user/tenant has access to - including Nova,
+    Glance, Keystone and Swift.
+
+    ::
+
+        OS_AUTH_URL=http://$SERVICE_HOST:5000/v2.0
+
+KEYSTONECLIENT\_DEBUG, NOVACLIENT\_DEBUG
+    Set command-line client log level to ``DEBUG``. These are commented
+    out by default.
+
+    ::
+
+        # export KEYSTONECLIENT_DEBUG=1
+        # export NOVACLIENT_DEBUG=1
+
+
+
 .. _minimal-configuration:
 
 Minimal Configuration
@@ -145,6 +214,37 @@ Configuration Notes
 .. contents::
    :local:
 
+Service Repos
+-------------
+
+The Git repositories used to check out the source for each service are
+controlled by a pair of variables set for each service.  ``*_REPO``
+points to the repository and ``*_BRANCH`` selects which branch to
+check out. These may be overridden in ``local.conf`` to pull source
+from a different repo for testing, such as a Gerrit branch
+proposal. ``GIT_BASE`` points to the primary repository server.
+
+    ::
+
+        NOVA_REPO=$GIT_BASE/openstack/nova.git
+        NOVA_BRANCH=master
+
+To pull a branch directly from Gerrit, get the repo and branch from
+the Gerrit review page:
+
+    ::
+
+        git fetch https://review.openstack.org/p/openstack/nova refs/changes/50/5050/1 && git checkout FETCH_HEAD
+
+    The repo is the stanza following ``fetch`` and the branch is the
+    stanza following that:
+
+    ::
+
+        NOVA_REPO=https://review.openstack.org/p/openstack/nova
+        NOVA_BRANCH=refs/changes/50/5050/1
+
+
 Installation Directory
 ----------------------
 
@@ -640,3 +740,40 @@ use the v3 API. It is possible to setup keystone without v2 API, by doing:
 ::
 
     ENABLE_IDENTITY_V2=False
+
+Exercises
+~~~~~~~~~
+
+``exerciserc`` is used to configure settings for the exercise scripts.
+The values shown below are the default values. These can all be
+overridden by setting them in the ``localrc`` section.
+
+* Max time to wait while vm goes from build to active state
+
+    ::
+
+        ACTIVE_TIMEOUT==30
+
+* Max time to wait for proper IP association and dis-association.
+
+    ::
+
+        ASSOCIATE_TIMEOUT=15
+
+* Max time till the vm is bootable
+
+    ::
+
+        BOOT_TIMEOUT=30
+
+* Max time from run instance command until it is running
+
+    ::
+
+        RUNNING_TIMEOUT=$(($BOOT_TIMEOUT + $ACTIVE_TIMEOUT))
+
+* Max time to wait for a vm to terminate
+
+    ::
+
+        TERMINATE_TIMEOUT=30
diff --git a/doc/source/exerciserc.rst b/doc/source/exerciserc.rst
deleted file mode 100644
index dacae2ecf2..0000000000
--- a/doc/source/exerciserc.rst
+++ /dev/null
@@ -1,42 +0,0 @@
-==============================
-exerciserc - Exercise Settings
-==============================
-
-``exerciserc`` is used to configure settings for the exercise scripts.
-The values shown below are the default values. These can all be
-overridden by setting them in the ``localrc`` section.
-
-ACTIVE\_TIMEOUT
-    Max time to wait while vm goes from build to active state
-
-    ::
-
-        ACTIVE_TIMEOUT==30
-
-ASSOCIATE\_TIMEOUT
-    Max time to wait for proper IP association and dis-association.
-
-    ::
-
-        ASSOCIATE_TIMEOUT=15
-
-BOOT\_TIMEOUT
-    Max time till the vm is bootable
-
-    ::
-
-        BOOT_TIMEOUT=30
-
-RUNNING\_TIMEOUT
-    Max time from run instance command until it is running
-
-    ::
-
-        RUNNING_TIMEOUT=$(($BOOT_TIMEOUT + $ACTIVE_TIMEOUT))
-
-TERMINATE\_TIMEOUT
-    Max time to wait for a vm to terminate
-
-    ::
-
-        TERMINATE_TIMEOUT=30
diff --git a/doc/source/index.rst b/doc/source/index.rst
index c79b2ce0c7..c4a7c59fe5 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -1,8 +1,16 @@
-DevStack - an OpenStack Community Production
-============================================
+DevStack
+========
 
 .. image:: assets/images/logo-blue.png
 
+DevStack is a series of extensible scripts used to quickly bring up a
+complete OpenStack environment.  It is used interactively as a
+development environment and as the basis for much of the OpenStack
+project's functional testing.
+
+The source is available at
+`<https://git.openstack.org/cgit/openstack-dev/devstack>`__.
+
 .. toctree::
    :glob:
    :maxdepth: 1
@@ -12,7 +20,6 @@ DevStack - an OpenStack Community Production
    plugins
    plugin-registry
    faq
-   changes
    hacking
 
 Quick Start
@@ -147,11 +154,6 @@ Plugins
 
 :doc:`Extending DevStack with new features <plugins>`
 
-Recent Changes
---------------
-
-:doc:`An incomplete summary of recent changes <changes>`
-
 FAQ
 ---
 
@@ -162,94 +164,3 @@ Contributing
 
 :doc:`Pitching in to make DevStack a better place <hacking>`
 
-Code
-====
-
-*A look at the bits that make it all go*
-
-Scripts
--------
-
-* `stack.sh <stack.sh.html>`__ - The main script
-* `functions <functions.html>`__ - DevStack-specific functions
-* `functions-common <functions-common.html>`__ - Functions shared with other projects
-* `lib/apache <lib/apache.html>`__
-* `lib/ceph <lib/ceph.html>`__
-* `lib/cinder <lib/cinder.html>`__
-* `lib/database <lib/database.html>`__
-* `lib/dstat <lib/dstat.html>`__
-* `lib/glance <lib/glance.html>`__
-* `lib/heat <lib/heat.html>`__
-* `lib/horizon <lib/horizon.html>`__
-* `lib/infra <lib/infra.html>`__
-* `lib/keystone <lib/keystone.html>`__
-* `lib/ldap <lib/ldap.html>`__
-* `lib/neutron-legacy <lib/neutron-legacy.html>`__
-* `lib/nova <lib/nova.html>`__
-* `lib/oslo <lib/oslo.html>`__
-* `lib/rpc\_backend <lib/rpc_backend.html>`__
-* `lib/swift <lib/swift.html>`__
-* `lib/tempest <lib/tempest.html>`__
-* `lib/tls <lib/tls.html>`__
-* `lib/trove <lib/trove.html>`__
-* `unstack.sh <unstack.sh.html>`__
-* `clean.sh <clean.sh.html>`__
-* `run\_tests.sh <run_tests.sh.html>`__
-
-* `extras.d/60-ceph.sh <extras.d/60-ceph.sh.html>`__
-* `extras.d/70-tuskar.sh <extras.d/70-tuskar.sh.html>`__
-* `extras.d/80-tempest.sh <extras.d/80-tempest.sh.html>`__
-
-* `inc/ini-config <inc/ini-config.html>`__
-* `inc/meta-config <inc/meta-config.html>`__
-* `inc/python <inc/python.html>`__
-
-* `pkg/elasticsearch.sh <pkg/elasticsearch.sh.html>`_
-
-Configuration
--------------
-
-.. toctree::
-   :glob:
-   :maxdepth: 1
-
-   local.conf
-   stackrc
-   openrc
-   exerciserc
-
-Tools
------
-
-* `tools/build\_docs.sh <tools/build_docs.sh.html>`__
-* `tools/build\_venv.sh <tools/build_venv.sh.html>`__
-* `tools/create-stack-user.sh <tools/create-stack-user.sh.html>`__
-* `tools/create\_userrc.sh <tools/create_userrc.sh.html>`__
-* `tools/fixup\_stuff.sh <tools/fixup_stuff.sh.html>`__
-* `tools/info.sh <tools/info.sh.html>`__
-* `tools/install\_pip.sh <tools/install_pip.sh.html>`__
-* `tools/install\_prereqs.sh <tools/install_prereqs.sh.html>`__
-* `tools/make\_cert.sh <tools/make_cert.sh.html>`__
-* `tools/upload\_image.sh <tools/upload_image.sh.html>`__
-
-Samples
--------
-
-* `local.sh <samples/local.sh.html>`__
-
-Exercises
----------
-
-* `exercise.sh <exercise.sh.html>`__
-* `exercises/aggregates.sh <exercises/aggregates.sh.html>`__
-* `exercises/boot\_from\_volume.sh <exercises/boot_from_volume.sh.html>`__
-* `exercises/bundle.sh <exercises/bundle.sh.html>`__
-* `exercises/client-args.sh <exercises/client-args.sh.html>`__
-* `exercises/client-env.sh <exercises/client-env.sh.html>`__
-* `exercises/euca.sh <exercises/euca.sh.html>`__
-* `exercises/floating\_ips.sh <exercises/floating_ips.sh.html>`__
-* `exercises/horizon.sh <exercises/horizon.sh.html>`__
-* `exercises/neutron-adv-test.sh <exercises/neutron-adv-test.sh.html>`__
-* `exercises/sec\_groups.sh <exercises/sec_groups.sh.html>`__
-* `exercises/swift.sh <exercises/swift.sh.html>`__
-* `exercises/volumes.sh <exercises/volumes.sh.html>`__
diff --git a/doc/source/local.conf.rst b/doc/source/local.conf.rst
deleted file mode 100644
index a1ca60a75d..0000000000
--- a/doc/source/local.conf.rst
+++ /dev/null
@@ -1,9 +0,0 @@
-==========================
-local.conf - User Settings
-==========================
-
-``local.conf`` is a user-maintained settings file that is sourced in
-``stackrc``. It contains a section that replaces the historical
-``localrc`` file. See the description of
-:doc:`local.conf <configuration>` for more details about the mechanics
-of the file.
diff --git a/doc/source/openrc.rst b/doc/source/openrc.rst
deleted file mode 100644
index d28b5680c6..0000000000
--- a/doc/source/openrc.rst
+++ /dev/null
@@ -1,68 +0,0 @@
-=====================================
-openrc - User Authentication Settings
-=====================================
-
-``openrc`` configures login credentials suitable for use with the
-OpenStack command-line tools. ``openrc`` sources ``stackrc`` at the
-beginning (which in turn sources the ``localrc`` section of
-``local.conf``) in order to pick up ``HOST_IP`` and/or ``SERVICE_HOST``
-to use in the endpoints. The values shown below are the default values.
-
-OS\_PROJECT\_NAME (OS\_TENANT\_NAME)
-    Keystone has
-    standardized the term *project* as the entity that owns resources. In
-    some places references still exist to the previous term
-    *tenant* for this use. Also, *project\_name* is preferred to
-    *project\_id*.  OS\_TENANT\_NAME remains supported for compatibility
-    with older tools.
-
-    ::
-
-        OS_PROJECT_NAME=demo
-
-OS\_USERNAME
-    In addition to the owning entity (project), OpenStack calls the entity
-    performing the action *user*.
-
-    ::
-
-        OS_USERNAME=demo
-
-OS\_PASSWORD
-    Keystone's default authentication requires a password be provided.
-    The usual cautions about putting passwords in environment variables
-    apply, for most DevStack uses this may be an acceptable tradeoff.
-
-    ::
-
-        OS_PASSWORD=secret
-
-HOST\_IP, SERVICE\_HOST
-    Set API endpoint host using ``HOST_IP``. ``SERVICE_HOST`` may also
-    be used to specify the endpoint, which is convenient for some
-    ``local.conf`` configurations. Typically, ``HOST_IP`` is set in the
-    ``localrc`` section.
-
-    ::
-
-        HOST_IP=127.0.0.1
-        SERVICE_HOST=$HOST_IP
-
-OS\_AUTH\_URL
-    Authenticating against an OpenStack cloud using Keystone returns a
-    *Token* and *Service Catalog*. The catalog contains the endpoints
-    for all services the user/project has access to - including Nova,
-    Glance, Keystone and Swift.
-
-    ::
-
-        OS_AUTH_URL=http://$SERVICE_HOST:5000/v2.0
-
-KEYSTONECLIENT\_DEBUG, NOVACLIENT\_DEBUG
-    Set command-line client log level to ``DEBUG``. These are commented
-    out by default.
-
-    ::
-
-        # export KEYSTONECLIENT_DEBUG=1
-        # export NOVACLIENT_DEBUG=1
diff --git a/doc/source/stackrc.rst b/doc/source/stackrc.rst
deleted file mode 100644
index 81d4b80b8a..0000000000
--- a/doc/source/stackrc.rst
+++ /dev/null
@@ -1,66 +0,0 @@
-===========================
-stackrc - DevStack Settings
-===========================
-
-``stackrc`` is the primary configuration file for DevStack. It contains
-all of the settings that control the services started and the
-repositories used to download the source for those services. ``stackrc``
-sources the ``localrc`` section of ``local.conf`` to perform the default
-overrides.
-
-DATABASE\_TYPE
-    Select the database backend to use. The default is ``mysql``,
-    ``postgresql`` is also available.
-ENABLED\_SERVICES
-    Specify which services to launch. These generally correspond to
-    screen tabs. The default includes: Glance (API and Registry),
-    Keystone, Nova (API, Certificate, Object Store, Compute, Network,
-    Scheduler, Certificate Authentication), Cinder
-    (Scheduler, API, Volume), Horizon, MySQL, RabbitMQ, Tempest.
-
-    ::
-
-        ENABLED_SERVICES=g-api,g-reg,key,n-api,n-crt,n-cpu,n-net,n-cond,c-sch,c-api,c-vol,n-sch,n-cauth,horizon,rabbit,tempest,$DATABASE_TYPE
-
-    Other services that are not enabled by default can be enabled in
-    ``localrc``. For example, to add Swift, use the following service
-    names:
-
-    ::
-
-        enable_service s-proxy s-object s-container s-account
-
-    A service can similarly be disabled:
-
-    ::
-
-        disable_service horizon
-
-Service Repos
-    The Git repositories used to check out the source for each service
-    are controlled by a pair of variables set for each service.
-    ``*_REPO`` points to the repository and ``*_BRANCH`` selects which
-    branch to check out. These may be overridden in ``local.conf`` to
-    pull source from a different repo for testing, such as a Gerrit
-    branch proposal. ``GIT_BASE`` points to the primary repository
-    server.
-
-    ::
-
-        NOVA_REPO=$GIT_BASE/openstack/nova.git
-        NOVA_BRANCH=master
-
-    To pull a branch directly from Gerrit, get the repo and branch from
-    the Gerrit review page:
-
-    ::
-
-        git fetch https://review.openstack.org/p/openstack/nova refs/changes/50/5050/1 && git checkout FETCH_HEAD
-
-    The repo is the stanza following ``fetch`` and the branch is the
-    stanza following that:
-
-    ::
-
-        NOVA_REPO=https://review.openstack.org/p/openstack/nova
-        NOVA_BRANCH=refs/changes/50/5050/1
diff --git a/tools/build_docs.sh b/tools/build_docs.sh
deleted file mode 100755
index 7dc492e2a4..0000000000
--- a/tools/build_docs.sh
+++ /dev/null
@@ -1,100 +0,0 @@
-#!/usr/bin/env bash
-
-# **build_docs.sh** - Build the docs for DevStack
-#
-# - Install shocco if not found on ``PATH`` and ``INSTALL_SHOCCO`` is set
-# - Clone ``MASTER_REPO`` branch ``MASTER_BRANCH``
-# - Re-creates ``doc/build/html`` directory from existing repo + new generated script docs
-
-# Usage:
-## build_docs.sh [-o <out-dir>]
-## -o <out-dir>     Write the static HTML output to <out-dir>
-##                  (Note that <out-dir> will be deleted and re-created to ensure it is clean)
-
-# Defaults
-# --------
-
-HTML_BUILD=doc/build/html
-
-# Keep track of the DevStack directory
-TOP_DIR=$(cd $(dirname "$0")/.. && pwd)
-
-# Uses this shocco branch: https://github.com/dtroyer/shocco/tree/rst_support
-SHOCCO=${SHOCCO:-shocco}
-if ! which shocco; then
-    if [[ ! -x $TOP_DIR/shocco/shocco ]]; then
-        if [[ -z "$INSTALL_SHOCCO" ]]; then
-            echo "shocco not found in \$PATH, please set environment variable SHOCCO"
-            exit 1
-        fi
-        echo "Installing local copy of shocco"
-        if ! which pygmentize; then
-            sudo pip install Pygments
-        fi
-        if ! which rst2html.py; then
-            sudo pip install docutils
-        fi
-        git clone -b rst_support https://github.com/dtroyer/shocco shocco
-        cd shocco
-        ./configure
-        make || exit
-        cd ..
-    fi
-    SHOCCO=$TOP_DIR/shocco/shocco
-fi
-
-# Process command-line args
-while getopts o: c; do
-    case $c in
-        o)  HTML_BUILD=$OPTARG
-            ;;
-    esac
-done
-shift `expr $OPTIND - 1`
-
-
-# Processing
-# ----------
-
-# Ensure build dir exists
-mkdir -p $HTML_BUILD
-
-# Get fully qualified dirs
-FQ_HTML_BUILD=$(cd $HTML_BUILD && pwd)
-
-# Insert automated bits
-GLOG=$(mktemp gitlogXXXX)
-echo "<ul>" >$GLOG
-git log \
-    --pretty=format:'            <li>%s - <em>Commit <a href="https://review.openstack.org/#q,%h,n,z">%h</a> %cd</em></li>' \
-    --date=short \
-    --since '6 months ago' | grep -v Merge >>$GLOG
-echo "</ul>" >>$GLOG
-sed -i~ -e $"/^.*%GIT_LOG%.*$/r $GLOG" -e $"/^.*%GIT_LOG%.*$/s/^.*%GIT_LOG%.*$//" $FQ_HTML_BUILD/changes.html
-rm -f $GLOG
-
-# Build list of scripts to process
-FILES=""
-for f in $(find . \( -name .git -o -name .tox \) -prune -o \( -type f -name \*.sh -not -path \*shocco/\* -print \)); do
-    echo $f
-    FILES+="$f "
-    mkdir -p $FQ_HTML_BUILD/`dirname $f`;
-    $SHOCCO $f > $FQ_HTML_BUILD/$f.html
-done
-for f in $(find functions functions-common inc lib pkg samples -type f -name \* ! -name *.md ! -name *.conf); do
-    echo $f
-    FILES+="$f "
-    mkdir -p $FQ_HTML_BUILD/`dirname $f`;
-    $SHOCCO $f > $FQ_HTML_BUILD/$f.html
-done
-echo "$FILES" >doc/files
-
-# Clean up or report the temp workspace
-if [[ -n REPO && -n $PUSH_REPO ]]; then
-    echo rm -rf $TMP_ROOT
-else
-    if [[ -z "$TMP_ROOT" ]]; then
-        TMP_ROOT="$(pwd)"
-    fi
-    echo "Built docs in $HTML_BUILD"
-fi
diff --git a/tox.ini b/tox.ini
index 4ec293939e..e8e7d7ebb8 100644
--- a/tox.ini
+++ b/tox.ini
@@ -17,7 +17,6 @@ whitelist_externals = bash
 commands = bash -c "find {toxinidir}             \
          -not \( -type d -name .?\* -prune \)    \
          -not \( -type d -name doc -prune \)     \
-         -not \( -type d -name shocco -prune \)  \
          -not \( -type f -name localrc -prune \) \
          -type f                                 \
          -not -name \*~                          \
@@ -48,7 +47,5 @@ deps =
 whitelist_externals = bash
 setenv =
   TOP_DIR={toxinidir}
-  INSTALL_SHOCCO=true
-commands = 
-	python setup.py build_sphinx
-	bash tools/build_docs.sh
+commands =
+  python setup.py build_sphinx

From b3f26cb66c70b599c4d77945f2bdadd9537c7c35 Mon Sep 17 00:00:00 2001
From: Armando Migliaccio <armamig@gmail.com>
Date: Wed, 13 Apr 2016 23:28:06 +0000
Subject: [PATCH 0377/2409] Revert "WIP - Remove lbaas from devstack proper"

The WIP prefix and the statement

"This can't merge until p-c no longer references lbaas jobs."

Should have been an indication that this patch is not quite ready to
go in as is.

This reverts commit 130c3adb0e88044c9cf3789e79f6e669fa30d7d2.

Change-Id: I57d5f9f2e66b1bdf6fca70074bc1d5678de65f38
---
 lib/neutron-legacy                        | 40 +++++++++++++++++-
 lib/neutron_plugins/services/loadbalancer | 51 +++++++++++++++++++++++
 stackrc                                   |  4 ++
 3 files changed, 94 insertions(+), 1 deletion(-)
 create mode 100644 lib/neutron_plugins/services/loadbalancer

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 573b061a4a..e06a020f43 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -107,6 +107,7 @@ GITDIR["python-neutronclient"]=$DEST/python-neutronclient
 
 NEUTRON_DIR=$DEST/neutron
 NEUTRON_FWAAS_DIR=$DEST/neutron-fwaas
+NEUTRON_LBAAS_DIR=$DEST/neutron-lbaas
 NEUTRON_VPNAAS_DIR=$DEST/neutron-vpnaas
 NEUTRON_AUTH_CACHE_DIR=${NEUTRON_AUTH_CACHE_DIR:-/var/cache/neutron}
 
@@ -121,6 +122,9 @@ NEUTRON_CONF_DIR=/etc/neutron
 NEUTRON_CONF=$NEUTRON_CONF_DIR/neutron.conf
 export NEUTRON_TEST_CONFIG_FILE=${NEUTRON_TEST_CONFIG_FILE:-"$NEUTRON_CONF_DIR/debug.ini"}
 
+# Default provider for load balancer service
+DEFAULT_LB_PROVIDER=LOADBALANCER:Haproxy:neutron_lbaas.services.loadbalancer.drivers.haproxy.plugin_driver.HaproxyOnHostPluginDriver:default
+
 # Default provider for VPN service
 DEFAULT_VPN_PROVIDER=VPN:openswan:neutron_vpnaas.services.vpn.service_drivers.ipsec.IPsecVPNDriver:default
 
@@ -343,6 +347,12 @@ if [ -f $TOP_DIR/lib/neutron_plugins/$Q_PLUGIN ]; then
     source $TOP_DIR/lib/neutron_plugins/$Q_PLUGIN
 fi
 
+# Agent loadbalancer service plugin functions
+# -------------------------------------------
+
+# Hardcoding for 1 service plugin for now
+source $TOP_DIR/lib/neutron_plugins/services/loadbalancer
+
 # Agent metering service plugin functions
 # -------------------------------------------
 
@@ -432,6 +442,10 @@ function configure_neutron {
     iniset_rpc_backend neutron $NEUTRON_CONF
 
     # goes before q-svc to init Q_SERVICE_PLUGIN_CLASSES
+    if is_service_enabled q-lbaas; then
+        deprecated "Configuring q-lbaas through devstack is deprecated"
+        _configure_neutron_lbaas
+    fi
     if is_service_enabled q-metering; then
         _configure_neutron_metering
     fi
@@ -642,6 +656,10 @@ function install_neutron {
         git_clone $NEUTRON_FWAAS_REPO $NEUTRON_FWAAS_DIR $NEUTRON_FWAAS_BRANCH
         setup_develop $NEUTRON_FWAAS_DIR
     fi
+    if is_service_enabled q-lbaas; then
+        git_clone $NEUTRON_LBAAS_REPO $NEUTRON_LBAAS_DIR $NEUTRON_LBAAS_BRANCH
+        setup_develop $NEUTRON_LBAAS_DIR
+    fi
     if is_service_enabled q-vpn; then
         git_clone $NEUTRON_VPNAAS_REPO $NEUTRON_VPNAAS_DIR $NEUTRON_VPNAAS_BRANCH
         setup_develop $NEUTRON_VPNAAS_DIR
@@ -685,6 +703,10 @@ function install_neutron_agent_packages {
     if is_service_enabled q-agt q-dhcp q-l3; then
         neutron_plugin_install_agent_packages
     fi
+
+    if is_service_enabled q-lbaas; then
+        neutron_agent_lbaas_install_agent_packages
+    fi
 }
 
 # Start running processes, including screen
@@ -747,6 +769,7 @@ function start_neutron_other_agents {
     fi
 
     run_process q-meta "$AGENT_META_BINARY --config-file $NEUTRON_CONF --config-file=$Q_META_CONF_FILE"
+    run_process q-lbaas "$AGENT_LBAAS_BINARY --config-file $NEUTRON_CONF --config-file=$LBAAS_AGENT_CONF_FILENAME"
     run_process q-metering "$AGENT_METERING_BINARY --config-file $NEUTRON_CONF --config-file $METERING_AGENT_CONF_FILENAME"
 
     if [ "$VIRT_DRIVER" = 'xenserver' ]; then
@@ -785,6 +808,9 @@ function stop_neutron_other {
         stop_process q-meta
     fi
 
+    if is_service_enabled q-lbaas; then
+        neutron_lbaas_stop
+    fi
     if is_service_enabled q-fwaas; then
         neutron_fwaas_stop
     fi
@@ -889,7 +915,7 @@ function cleanup_neutron {
     fi
 
     # delete all namespaces created by neutron
-    for ns in $(sudo ip netns list | grep -o -E '(qdhcp|qrouter|fip|snat)-[0-9a-f-]*'); do
+    for ns in $(sudo ip netns list | grep -o -E '(qdhcp|qrouter|qlbaas|fip|snat)-[0-9a-f-]*'); do
         sudo ip netns delete ${ns}
     done
 }
@@ -1082,6 +1108,18 @@ function _configure_neutron_ceilometer_notifications {
     iniset $NEUTRON_CONF oslo_messaging_notifications driver messaging
 }
 
+function _configure_neutron_lbaas {
+    # Uses oslo config generator to generate LBaaS sample configuration files
+    (cd $NEUTRON_LBAAS_DIR && exec ./tools/generate_config_file_samples.sh)
+
+    if [ -f $NEUTRON_LBAAS_DIR/etc/neutron_lbaas.conf.sample ]; then
+        cp $NEUTRON_LBAAS_DIR/etc/neutron_lbaas.conf.sample $NEUTRON_CONF_DIR/neutron_lbaas.conf
+        iniset $NEUTRON_CONF_DIR/neutron_lbaas.conf service_providers service_provider $DEFAULT_LB_PROVIDER
+    fi
+    neutron_agent_lbaas_configure_common
+    neutron_agent_lbaas_configure_agent
+}
+
 function _configure_neutron_metering {
     neutron_agent_metering_configure_common
     neutron_agent_metering_configure_agent
diff --git a/lib/neutron_plugins/services/loadbalancer b/lib/neutron_plugins/services/loadbalancer
new file mode 100644
index 0000000000..30e9480f2e
--- /dev/null
+++ b/lib/neutron_plugins/services/loadbalancer
@@ -0,0 +1,51 @@
+#!/bin/bash
+
+# Neutron loadbalancer plugin
+# ---------------------------
+
+# Save trace setting
+_XTRACE_NEUTRON_LB=$(set +o | grep xtrace)
+set +o xtrace
+
+
+AGENT_LBAAS_BINARY="$NEUTRON_BIN_DIR/neutron-lbaas-agent"
+LBAAS_PLUGIN=neutron_lbaas.services.loadbalancer.plugin.LoadBalancerPlugin
+
+function neutron_agent_lbaas_install_agent_packages {
+    if is_ubuntu || is_fedora || is_suse; then
+        install_package haproxy
+    fi
+}
+
+function neutron_agent_lbaas_configure_common {
+    _neutron_service_plugin_class_add $LBAAS_PLUGIN
+    _neutron_deploy_rootwrap_filters $NEUTRON_LBAAS_DIR
+}
+
+function neutron_agent_lbaas_configure_agent {
+    LBAAS_AGENT_CONF_PATH=/etc/neutron/services/loadbalancer/haproxy
+    mkdir -p $LBAAS_AGENT_CONF_PATH
+
+    LBAAS_AGENT_CONF_FILENAME="$LBAAS_AGENT_CONF_PATH/lbaas_agent.ini"
+
+    cp $NEUTRON_LBAAS_DIR/etc/lbaas_agent.ini.sample $LBAAS_AGENT_CONF_FILENAME
+
+    # ovs_use_veth needs to be set before the plugin configuration
+    # occurs to allow plugins to override the setting.
+    iniset $LBAAS_AGENT_CONF_FILENAME DEFAULT ovs_use_veth $Q_OVS_USE_VETH
+
+    neutron_plugin_setup_interface_driver $LBAAS_AGENT_CONF_FILENAME
+
+    if is_fedora; then
+        iniset $LBAAS_AGENT_CONF_FILENAME DEFAULT user_group "nobody"
+        iniset $LBAAS_AGENT_CONF_FILENAME haproxy user_group "nobody"
+    fi
+}
+
+function neutron_lbaas_stop {
+    pids=$(ps aux | awk '/haproxy/ { print $2 }')
+    [ ! -z "$pids" ] && sudo kill $pids || true
+}
+
+# Restore xtrace
+$_XTRACE_NEUTRON_LB
diff --git a/stackrc b/stackrc
index ffb3596be6..74d507cfa2 100644
--- a/stackrc
+++ b/stackrc
@@ -231,6 +231,10 @@ NEUTRON_BRANCH=${NEUTRON_BRANCH:-master}
 NEUTRON_FWAAS_REPO=${NEUTRON_FWAAS_REPO:-${GIT_BASE}/openstack/neutron-fwaas.git}
 NEUTRON_FWAAS_BRANCH=${NEUTRON_FWAAS_BRANCH:-master}
 
+# neutron lbaas service
+NEUTRON_LBAAS_REPO=${NEUTRON_LBAAS_REPO:-${GIT_BASE}/openstack/neutron-lbaas.git}
+NEUTRON_LBAAS_BRANCH=${NEUTRON_LBAAS_BRANCH:-master}
+
 # neutron vpnaas service
 NEUTRON_VPNAAS_REPO=${NEUTRON_VPNAAS_REPO:-${GIT_BASE}/openstack/neutron-vpnaas.git}
 NEUTRON_VPNAAS_BRANCH=${NEUTRON_VPNAAS_BRANCH:-master}

From 982b9911fb66d8c098442f0785972b3a3fcb1414 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Thu, 14 Apr 2016 07:48:24 +1000
Subject: [PATCH 0378/2409] Deprecate SERVICE_TENANT

This is a follow-on to I6f392d3c16726f6dd734184dcf3014fb4f388207 to
note the variable is kept for backwards compatibility.

Change-Id: I1008b2d4e2baf82e1aa531d9eaf96a084beb69aa
---
 lib/keystone | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/keystone b/lib/keystone
index b5c107c138..c6208aec4c 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -108,6 +108,9 @@ KEYSTONE_SERVICE_PROTOCOL=${KEYSTONE_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 KEYSTONE_ADMIN_BIND_HOST=${KEYSTONE_ADMIN_BIND_HOST:-$KEYSTONE_SERVICE_HOST}
 # Set the project for service accounts in Keystone
 SERVICE_PROJECT_NAME=${SERVICE_PROJECT_NAME:-service}
+
+# Note 2016-03 : SERVICE_TENANT_NAME is kept for backwards
+# compatibility; we should be using SERVICE_PROJECT_NAME now
 SERVICE_TENANT_NAME=${SERVICE_PROJECT_NAME:-service}
 
 # if we are running with SSL use https protocols

From 91d2245d6ebe5f2b1627771adfe1f0fe45570c43 Mon Sep 17 00:00:00 2001
From: Christian Schwede <cschwede@redhat.com>
Date: Tue, 12 Apr 2016 10:53:46 +0200
Subject: [PATCH 0379/2409] Add variable SWIFT_STORAGE_IPS

If the variable SWIFT_STORAGE_IPS contains a space-separated list of
IPs, we can use this to create consistent rings across all proxy and
storage nodes.

Change-Id: If9307196dc7e74e4a842c95503958ae2d7f7acc7
---
 doc/source/configuration.rst | 12 +++++++++++
 lib/swift                    | 42 +++++++++++++++++++++++++++++-------
 2 files changed, 46 insertions(+), 8 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 0493f8fa25..f3eda01dcc 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -513,6 +513,18 @@ If you only want to do some testing of a real normal swift cluster
 with multiple replicas you can do so by customizing the variable
 ``SWIFT_REPLICAS`` in your ``localrc`` section (usually to 3).
 
+You can manually override the ring building to use specific storage
+nodes, for example when you want to test a multinode environment. In
+this case you have to set a space-separated list of IPs in
+``SWIFT_STORAGE_IPS`` in your ``localrc`` section that should be used
+as Swift storage nodes.
+Please note that this does not create a multinode setup, it is only
+used when adding nodes to the Swift rings.
+
+::
+
+    SWIFT_STORAGE_IPS="192.168.1.10 192.168.1.11 192.168.1.12"
+
 Swift S3
 ++++++++
 
diff --git a/lib/swift b/lib/swift
index b2fe755cef..bef55b9b67 100644
--- a/lib/swift
+++ b/lib/swift
@@ -149,6 +149,11 @@ SWIFT_TEMPURL_KEY=${SWIFT_TEMPURL_KEY:-}
 # Toggle for deploying Swift under HTTPD + mod_wsgi
 SWIFT_USE_MOD_WSGI=${SWIFT_USE_MOD_WSGI:-False}
 
+# A space-separated list of storage node IPs that
+# should be used to create the Swift rings
+SWIFT_STORAGE_IPS=${SWIFT_STORAGE_IPS:-}
+
+
 # Functions
 # ---------
 
@@ -693,14 +698,35 @@ function init_swift {
         swift-ring-builder container.builder create ${SWIFT_PARTITION_POWER_SIZE} ${SWIFT_REPLICAS} 1
         swift-ring-builder account.builder create ${SWIFT_PARTITION_POWER_SIZE} ${SWIFT_REPLICAS} 1
 
-        for node_number in ${SWIFT_REPLICAS_SEQ}; do
-            swift-ring-builder object.builder add z${node_number}-${SWIFT_SERVICE_LOCAL_HOST}:$(( OBJECT_PORT_BASE + 10 * (node_number - 1) ))/sdb1 1
-            swift-ring-builder container.builder add z${node_number}-${SWIFT_SERVICE_LOCAL_HOST}:$(( CONTAINER_PORT_BASE + 10 * (node_number - 1) ))/sdb1 1
-            swift-ring-builder account.builder add z${node_number}-${SWIFT_SERVICE_LOCAL_HOST}:$(( ACCOUNT_PORT_BASE + 10 * (node_number - 1) ))/sdb1 1
-        done
-        swift-ring-builder object.builder rebalance
-        swift-ring-builder container.builder rebalance
-        swift-ring-builder account.builder rebalance
+        # The ring will be created on each node, and because the order of
+        # nodes is identical we can use a seed for rebalancing, making it
+        # possible to get a ring on each node that uses the same partition
+        # assignment.
+        if [[ -n $SWIFT_STORAGE_IPS ]]; then
+            local node_number
+            node_number=1
+
+            for node in ${SWIFT_STORAGE_IPS}; do
+                swift-ring-builder object.builder add z${node_number}-${node}:${OBJECT_PORT_BASE}/sdb1 1
+                swift-ring-builder container.builder add z${node_number}-${node}:${CONTAINER_PORT_BASE}/sdb1 1
+                swift-ring-builder account.builder add z${node_number}-${node}:${ACCOUNT_PORT_BASE}/sdb1 1
+                let "node_number=node_number+1"
+            done
+
+        else
+
+            for node_number in ${SWIFT_REPLICAS_SEQ}; do
+                swift-ring-builder object.builder add z${node_number}-${SWIFT_SERVICE_LOCAL_HOST}:$(( OBJECT_PORT_BASE + 10 * (node_number - 1) ))/sdb1 1
+                swift-ring-builder container.builder add z${node_number}-${SWIFT_SERVICE_LOCAL_HOST}:$(( CONTAINER_PORT_BASE + 10 * (node_number - 1) ))/sdb1 1
+                swift-ring-builder account.builder add z${node_number}-${SWIFT_SERVICE_LOCAL_HOST}:$(( ACCOUNT_PORT_BASE + 10 * (node_number - 1) ))/sdb1 1
+            done
+        fi
+
+        # We use a seed for rebalancing. Doing this allows us to create
+        # identical rings on multiple nodes if SWIFT_STORAGE_IPS is the same
+        swift-ring-builder object.builder rebalance 42
+        swift-ring-builder container.builder rebalance 42
+        swift-ring-builder account.builder rebalance 42
     } && popd >/dev/null
 
     # Create cache dir

From 0b4a009e56d29e4fe51ae06132c5766d0da9be7d Mon Sep 17 00:00:00 2001
From: ZhiQiang Fan <aji.zqfan@gmail.com>
Date: Tue, 12 Apr 2016 20:26:33 +0800
Subject: [PATCH 0380/2409] remove clouds.yaml in clean.sh

devstack failed to install because glance:
Could not determine a suitable URL for the plugin

patch I618ea8e27b49af360c905df85af06d9b1eef8407 tries
to fix this problem, but with a wrong way because path is not
correct, the clouds.yaml is not under /path/to/devstack/~/.config/openstack/
but ~/.config/openstack.

patch I8af6bd465f74099c560dddba6b5221dd79cbc965 tries to
fix this problem, but with a worng way to specify the path,
~$STACK_USER/.config/openstack/clouds.yaml will not expand with
a variable, only const string can.

$ whoami
zqfan
$ touch ~/.config/openstack/clouds.yaml
$ export STACK_USER=zqfan
$ rm -rf ~$STACK_USER/.config/openstack/clouds.yaml
$ ls ~/.config/openstack/
clouds.yaml

Change-Id: I549817d2f4638be615991c1726b39d270ba71357
ref: I618ea8e27b49af360c905df85af06d9b1eef8407
---
 clean.sh         | 5 +++--
 functions-common | 2 +-
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/clean.sh b/clean.sh
index b18f28ec28..1176134da6 100755
--- a/clean.sh
+++ b/clean.sh
@@ -137,9 +137,10 @@ rm -rf $DIRS_TO_CLEAN
 FILES_TO_CLEAN=".localrc.auto .localrc.password "
 FILES_TO_CLEAN+="docs/files docs/html shocco/ "
 FILES_TO_CLEAN+="stack-screenrc test*.conf* test.ini* "
-FILES_TO_CLEAN+=".stackenv .prereqs "
-FILES_TO_CLEAN+="~/.config/openstack"
+FILES_TO_CLEAN+=".stackenv .prereqs"
 
 for file in $FILES_TO_CLEAN; do
     rm -rf $TOP_DIR/$file
 done
+
+rm -rf ~/.config/openstack
diff --git a/functions-common b/functions-common
index 0806681c3b..a4711ddc58 100644
--- a/functions-common
+++ b/functions-common
@@ -123,7 +123,7 @@ function write_clouds_yaml {
         --os-project-name admin
 
     # CLean up any old clouds.yaml files we had laying around
-    rm -f ~$STACK_USER/.config/openstack/clouds.yaml
+    rm -f $(eval echo ~"$STACK_USER")/.config/openstack/clouds.yaml
 }
 
 # trueorfalse <True|False> <VAR>

From 955609356a1586b3b39892bd8433de7d75cb05f3 Mon Sep 17 00:00:00 2001
From: Rabi Mishra <ramishra@redhat.com>
Date: Mon, 1 Feb 2016 13:20:18 +0530
Subject: [PATCH 0381/2409] Add heat_stack_owner role required by tempest

Create specific heat_stack_owner role to be used by
tempest tests, rather than using _member_ which is not
automatically created in keystone v3.

Change-Id: Iff13a47e360b628bc48a8cb897d9368af49db01b
Partial-Bug: #1539692
---
 lib/tempest | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index fd98c948f2..1678c4f225 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -383,6 +383,11 @@ function configure_tempest {
 
     # Orchestration Tests
     if is_service_enabled heat; then
+        # Though this is not needed by heat, some tempest tests explicitly
+        # try to set this role. Removing them from the tempest tests breaks
+        # some non-devstack CIs.
+        get_or_create_role "heat_stack_owner"
+
         if [[ ! -z "$HEAT_CFN_IMAGE_URL" ]]; then
             iniset $TEMPEST_CONFIG orchestration image_ref $(basename "${HEAT_CFN_IMAGE_URL%.*}")
         fi
@@ -396,7 +401,7 @@ function configure_tempest {
             iniset $TEMPEST_CONFIG orchestration instance_type "m1.heat"
         fi
         iniset $TEMPEST_CONFIG orchestration build_timeout 900
-        iniset $TEMPEST_CONFIG orchestration stack_owner_role "_member_"
+        iniset $TEMPEST_CONFIG orchestration stack_owner_role "heat_stack_owner"
     fi
 
     # Scenario

From fb44bc30fdc958c576290959e273185eef1f8fd9 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Fri, 15 Apr 2016 06:10:04 +0000
Subject: [PATCH 0382/2409] Updated from generate-devstack-plugins-list

Change-Id: Ifd1fbd0a9e8c433119e30299ef417d70c9b967a0
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 999350fe6a..950cf04d33 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -56,6 +56,7 @@ freezer-api                            `git://git.openstack.org/openstack/freeze
 freezer-web-ui                         `git://git.openstack.org/openstack/freezer-web-ui <https://git.openstack.org/cgit/openstack/freezer-web-ui>`__
 gce-api                                `git://git.openstack.org/openstack/gce-api <https://git.openstack.org/cgit/openstack/gce-api>`__
 gnocchi                                `git://git.openstack.org/openstack/gnocchi <https://git.openstack.org/cgit/openstack/gnocchi>`__
+group-based-policy                     `git://git.openstack.org/openstack/group-based-policy <https://git.openstack.org/cgit/openstack/group-based-policy>`__
 ironic                                 `git://git.openstack.org/openstack/ironic <https://git.openstack.org/cgit/openstack/ironic>`__
 ironic-inspector                       `git://git.openstack.org/openstack/ironic-inspector <https://git.openstack.org/cgit/openstack/ironic-inspector>`__
 kingbird                               `git://git.openstack.org/openstack/kingbird <https://git.openstack.org/cgit/openstack/kingbird>`__

From ef219bfcafb69970b83db8b503d5947ced9eca16 Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Thu, 11 Feb 2016 13:54:48 +0100
Subject: [PATCH 0383/2409] worlddump: request Guru Mediation reports for
 neutron agents

Those reports may be helpful when debugging neutron gate issues.

pgrep is backwards compatible with old Solaris tools, which means it
does not match with commands that are longer than 15 characters. To
avoid that for neutron agent names which are longer than that, we need
to pass -f argument to match against the full cmdline.

Also killall instead of kill + pgrep in a subshell.

Change-Id: I9b3801e927c0e80443ed76e38cd8e3618e888e49
---
 tools/worlddump.py | 31 +++++++++++++++++++++----------
 1 file changed, 21 insertions(+), 10 deletions(-)

diff --git a/tools/worlddump.py b/tools/worlddump.py
index 8c053e038f..238a23dab8 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -27,6 +27,16 @@
 import sys
 
 
+GMR_PROCESSES = (
+    'nova-compute',
+    'neutron-dhcp-agent',
+    'neutron-l3-agent',
+    'neutron-linuxbridge-agent',
+    'neutron-metadata-agent',
+    'neutron-openvswitch-agent',
+)
+
+
 def get_options():
     parser = argparse.ArgumentParser(
         description='Dump world state for debugging')
@@ -191,17 +201,18 @@ def compute_consoles():
             _dump_cmd("sudo cat %s" % fullpath)
 
 
-def guru_meditation_report():
-    _header("nova-compute Guru Meditation Report")
+def guru_meditation_reports():
+    for service in GMR_PROCESSES:
+        _header("%s Guru Meditation Report" % service)
 
-    try:
-        subprocess.check_call(["pgrep","nova-compute"])
-    except subprocess.CalledProcessError:
-        print("Skipping as nova-compute does not appear to be running")
-        return
+        try:
+            subprocess.check_call(['pgrep', '-f', service])
+        except subprocess.CalledProcessError:
+            print("Skipping as %s does not appear to be running" % service)
+            continue
 
-    _dump_cmd("kill -s USR2 `pgrep nova-compute`")
-    print("guru meditation report in nova-compute log")
+        _dump_cmd("killall -e -USR2 %s" % service)
+        print("guru meditation report in %s log" % service)
 
 
 def main():
@@ -218,7 +229,7 @@ def main():
         iptables_dump()
         ebtables_dump()
         compute_consoles()
-        guru_meditation_report()
+        guru_meditation_reports()
 
 
 if __name__ == '__main__':

From 82bca44845b8dd25d34d5ee4b7c75d95c8ccf82c Mon Sep 17 00:00:00 2001
From: Boden R <bodenvmw@gmail.com>
Date: Fri, 15 Apr 2016 10:56:09 -0600
Subject: [PATCH 0384/2409] Fix Q_PLUGIN_EXTRA_CONF_FILES usage comment

Related bug #1469434 fixed the usage comments for
Q_PLUGIN_EXTRA_CONF_FILES. However that change didn't
make it into neutron-legacy. This patch updates the comments
in neutron-legacy to reflect proper assignment of
Q_PLUGIN_EXTRA_CONF_FILES as well indicate
Q_PLUGIN_CONF_PATH is required when using extra conf files.

Change-Id: I447f1158d333ac4a35c4903a509146a62d93b272
Related-Bug: #1469434
Closes-Bug: #1542282
---
 lib/neutron-legacy | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 084a3569ba..c2729cb5d2 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -946,10 +946,11 @@ function _configure_neutron_common {
 
     # Set plugin-specific variables ``Q_DB_NAME``, ``Q_PLUGIN_CLASS``.
     # For main plugin config file, set ``Q_PLUGIN_CONF_PATH``, ``Q_PLUGIN_CONF_FILENAME``.
-    # For addition plugin config files, set ``Q_PLUGIN_EXTRA_CONF_PATH``,
+    # For addition plugin config files, set ``Q_PLUGIN_EXTRA_CONF_PATH`` and
     # ``Q_PLUGIN_EXTRA_CONF_FILES``.  For example:
     #
-    #    ``Q_PLUGIN_EXTRA_CONF_FILES=(file1, file2)``
+    #    ``Q_PLUGIN_CONF_PATH=/path/to/plugins``
+    #    ``Q_PLUGIN_EXTRA_CONF_FILES=(file1 file2)``
     neutron_plugin_configure_common
 
     if [[ "$Q_PLUGIN_CONF_PATH" == '' || "$Q_PLUGIN_CONF_FILENAME" == '' || "$Q_PLUGIN_CLASS" == '' ]]; then

From fdb388314679b19493cef1861318190d017f7724 Mon Sep 17 00:00:00 2001
From: Andreas Jaeger <aj@suse.com>
Date: Fri, 15 Apr 2016 20:54:11 +0200
Subject: [PATCH 0385/2409] Add venv tox environment

This environment is used by the normal docs job, add it.
Manually add requirements needed for doc building.

Change-Id: I1be193d113683966f6a76e862713f3a550543168
---
 tox.ini | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/tox.ini b/tox.ini
index e8e7d7ebb8..dbd1652d10 100644
--- a/tox.ini
+++ b/tox.ini
@@ -49,3 +49,13 @@ setenv =
   TOP_DIR={toxinidir}
 commands =
   python setup.py build_sphinx
+
+[testenv:venv]
+deps =
+   pbr>=0.6,!=0.7,<1.0
+   sphinx>=1.1.2,<1.2
+   oslosphinx
+   blockdiag
+   sphinxcontrib-blockdiag
+   sphinxcontrib-nwdiag
+commands = {posargs}

From 4b267082a29d24154cb3bd841a910b24adb40cf8 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Sat, 16 Apr 2016 06:52:53 +0000
Subject: [PATCH 0386/2409] Updated from generate-devstack-plugins-list

Change-Id: I6a32144d4d210ebef8d770baf840fa90e345b3d1
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 950cf04d33..4e191d3076 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -66,6 +66,7 @@ magnum-ui                              `git://git.openstack.org/openstack/magnum
 manila                                 `git://git.openstack.org/openstack/manila <https://git.openstack.org/cgit/openstack/manila>`__
 mistral                                `git://git.openstack.org/openstack/mistral <https://git.openstack.org/cgit/openstack/mistral>`__
 monasca-api                            `git://git.openstack.org/openstack/monasca-api <https://git.openstack.org/cgit/openstack/monasca-api>`__
+monasca-log-api                        `git://git.openstack.org/openstack/monasca-log-api <https://git.openstack.org/cgit/openstack/monasca-log-api>`__
 murano                                 `git://git.openstack.org/openstack/murano <https://git.openstack.org/cgit/openstack/murano>`__
 networking-6wind                       `git://git.openstack.org/openstack/networking-6wind <https://git.openstack.org/cgit/openstack/networking-6wind>`__
 networking-bagpipe                     `git://git.openstack.org/openstack/networking-bagpipe <https://git.openstack.org/cgit/openstack/networking-bagpipe>`__

From cbcbd8f33c87904b2293e68ec9868be0b6e4393e Mon Sep 17 00:00:00 2001
From: Jamie Lennox <jamielennox@gmail.com>
Date: Thu, 21 Jan 2016 16:08:14 -0600
Subject: [PATCH 0387/2409] Allow putting service users in a seperate domain

Make it possible to construct the service users in their own seperate
domain. Changing this away from Default will not work for everyone yet,
though it does work for basic service interaction however enabling it
will allow us to start testing and hopefully gating that services aren't
relying on v2 only concepts.

Change-Id: I7e73df5dd1caabf355783da2bc0f3007ade92fba
---
 functions-common   | 26 ++++++++++++++++++++++++--
 lib/glance         | 10 +++-------
 lib/keystone       | 12 +++++++-----
 lib/neutron-legacy |  4 ++--
 lib/nova           |  2 +-
 lib/swift          |  2 ++
 6 files changed, 39 insertions(+), 17 deletions(-)

diff --git a/functions-common b/functions-common
index 0806681c3b..71dda76727 100644
--- a/functions-common
+++ b/functions-common
@@ -840,27 +840,49 @@ function get_or_create_role {
     echo $role_id
 }
 
+# Returns the domain parts of a function call if present
+# Usage: _get_domain_args [<user_domain> <project_domain>]
+function _get_domain_args {
+    local domain
+    domain=""
+
+    if [[ -n "$1" ]]; then
+        domain="$domain --user-domain $1"
+    fi
+    if [[ -n "$2" ]]; then
+        domain="$domain --project-domain $2"
+    fi
+
+    echo $domain
+}
+
 # Gets or adds user role to project
-# Usage: get_or_add_user_project_role <role> <user> <project>
+# Usage: get_or_add_user_project_role <role> <user> <project> [<user_domain> <project_domain>]
 function get_or_add_user_project_role {
     local user_role_id
+
+    domain_args=$(_get_domain_args $4 $5)
+
     # Gets user role id
     user_role_id=$(openstack role list \
         --user $2 \
         --column "ID" \
         --project $3 \
         --column "Name" \
+        $domain_args \
         | grep " $1 " | get_field 1)
     if [[ -z "$user_role_id" ]]; then
         # Adds role to user and get it
         openstack role add $1 \
             --user $2 \
-            --project $3
+            --project $3 \
+            $domain_args
         user_role_id=$(openstack role list \
             --user $2 \
             --column "ID" \
             --project $3 \
             --column "Name" \
+            $domain_args \
             | grep " $1 " | get_field 1)
     fi
     echo $user_role_id
diff --git a/lib/glance b/lib/glance
index 3743e161c4..f2a6db6edc 100644
--- a/lib/glance
+++ b/lib/glance
@@ -173,8 +173,8 @@ function configure_glance {
 
         iniset $GLANCE_SWIFT_STORE_CONF ref1 key $SERVICE_PASSWORD
         iniset $GLANCE_SWIFT_STORE_CONF ref1 auth_address $KEYSTONE_SERVICE_URI/v3
-        iniset $GLANCE_SWIFT_STORE_CONF ref1 user_domain_id default
-        iniset $GLANCE_SWIFT_STORE_CONF ref1 project_domain_id default
+        iniset $GLANCE_SWIFT_STORE_CONF ref1 user_domain_name $SERVICE_DOMAIN_NAME
+        iniset $GLANCE_SWIFT_STORE_CONF ref1 project_domain_name $SERVICE_DOMAIN_NAME
         iniset $GLANCE_SWIFT_STORE_CONF ref1 auth_version 3
 
         # commenting is not strictly necessary but it's confusing to have bad values in conf
@@ -288,11 +288,7 @@ function create_glance_accounts {
 
         # required for swift access
         if is_service_enabled s-proxy; then
-
-            local glance_swift_user
-            glance_swift_user=$(get_or_create_user "glance-swift" \
-                "$SERVICE_PASSWORD" "default" "glance-swift@example.com")
-            get_or_add_user_project_role "ResellerAdmin" $glance_swift_user $SERVICE_PROJECT_NAME
+            create_service_user "glance-swift" "ResellerAdmin"
         fi
 
         get_or_create_service "glance" "image" "Glance Image Service"
diff --git a/lib/keystone b/lib/keystone
index b5c107c138..cd07b78172 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -106,7 +106,9 @@ KEYSTONE_SERVICE_PROTOCOL=${KEYSTONE_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 
 # Bind hosts
 KEYSTONE_ADMIN_BIND_HOST=${KEYSTONE_ADMIN_BIND_HOST:-$KEYSTONE_SERVICE_HOST}
+
 # Set the project for service accounts in Keystone
+SERVICE_DOMAIN_NAME=${SERVICE_DOMAIN_NAME:-Default}
 SERVICE_PROJECT_NAME=${SERVICE_PROJECT_NAME:-service}
 SERVICE_TENANT_NAME=${SERVICE_PROJECT_NAME:-service}
 
@@ -370,6 +372,7 @@ function create_keystone_accounts {
     get_or_add_user_domain_role $admin_role $admin_user default
 
     # Create service project/role
+    get_or_create_domain "$SERVICE_DOMAIN_NAME"
     get_or_create_project "$SERVICE_PROJECT_NAME" default
 
     # Service role, so service users do not have to be admins
@@ -442,9 +445,8 @@ function create_keystone_accounts {
 function create_service_user {
     local role=${2:-service}
 
-    local user
-    user=$(get_or_create_user "$1" "$SERVICE_PASSWORD" default)
-    get_or_add_user_project_role "$role" "$user" "$SERVICE_PROJECT_NAME"
+    get_or_create_user "$1" "$SERVICE_PASSWORD" "$SERVICE_DOMAIN_NAME"
+    get_or_add_user_project_role "$role" "$1" "$SERVICE_PROJECT_NAME" "$SERVICE_DOMAIN_NAME" "$SERVICE_DOMAIN_NAME"
 }
 
 # Configure the service to use the auth token middleware.
@@ -464,9 +466,9 @@ function configure_auth_token_middleware {
     iniset $conf_file $section auth_url $KEYSTONE_AUTH_URI
     iniset $conf_file $section username $admin_user
     iniset $conf_file $section password $SERVICE_PASSWORD
-    iniset $conf_file $section user_domain_id default
+    iniset $conf_file $section user_domain_name "$SERVICE_DOMAIN_NAME"
     iniset $conf_file $section project_name $SERVICE_PROJECT_NAME
-    iniset $conf_file $section project_domain_id default
+    iniset $conf_file $section project_domain_name "$SERVICE_DOMAIN_NAME"
 
     iniset $conf_file $section auth_uri $KEYSTONE_SERVICE_URI
     iniset $conf_file $section cafile $SSL_BUNDLE_FILE
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 084a3569ba..aaba8945cd 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -491,9 +491,9 @@ function create_nova_conf_neutron {
     iniset $NOVA_CONF neutron auth_url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_AUTH_PORT/v3"
     iniset $NOVA_CONF neutron username "$Q_ADMIN_USERNAME"
     iniset $NOVA_CONF neutron password "$SERVICE_PASSWORD"
-    iniset $NOVA_CONF neutron user_domain_name "Default"
+    iniset $NOVA_CONF neutron user_domain_name "$SERVICE_DOMAIN_NAME"
     iniset $NOVA_CONF neutron project_name "$SERVICE_PROJECT_NAME"
-    iniset $NOVA_CONF neutron project_domain_name "Default"
+    iniset $NOVA_CONF neutron project_domain_name "$SERVICE_DOMAIN_NAME"
     iniset $NOVA_CONF neutron auth_strategy "$Q_AUTH_STRATEGY"
     iniset $NOVA_CONF neutron region_name "$REGION_NAME"
     iniset $NOVA_CONF neutron url "${Q_PROTOCOL}://$Q_HOST:$Q_PORT"
diff --git a/lib/nova b/lib/nova
index 8823e1ddb4..15dae6837e 100644
--- a/lib/nova
+++ b/lib/nova
@@ -439,7 +439,7 @@ function create_nova_accounts {
         if is_service_enabled swift; then
             # Nova needs ResellerAdmin role to download images when accessing
             # swift through the s3 api.
-            get_or_add_user_project_role ResellerAdmin nova $SERVICE_PROJECT_NAME
+            get_or_add_user_project_role ResellerAdmin nova $SERVICE_PROJECT_NAME $SERVICE_DOMAIN_NAME $SERVICE_DOMAIN_NAME
         fi
     fi
 
diff --git a/lib/swift b/lib/swift
index f47608cd6e..8cb94efa66 100644
--- a/lib/swift
+++ b/lib/swift
@@ -846,7 +846,9 @@ function swift_configure_tempurls {
     # note we are using swift credentials!
     OS_USERNAME=swift \
     OS_PASSWORD=$SERVICE_PASSWORD \
+    OS_USER_DOMAIN_NAME=$SERVICE_DOMAIN_NAME \
     OS_PROJECT_NAME=$SERVICE_PROJECT_NAME \
+    OS_PROJECT_DOMAIN_NAME=$SERVICE_DOMAIN_NAME \
     openstack object store account \
         set --property "Temp-URL-Key=$SWIFT_TEMPURL_KEY"
 }

From 262ecba8991f2061af2464f1966cecb3b62e4405 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Mon, 18 Apr 2016 06:53:45 +0000
Subject: [PATCH 0388/2409] Updated from generate-devstack-plugins-list

Change-Id: I9078900f98721336daf1aab4a812eed96f8b1588
---
 doc/source/plugin-registry.rst | 31 +++++++++++++++++--------------
 1 file changed, 17 insertions(+), 14 deletions(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 4e191d3076..9c207658fa 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -1,23 +1,26 @@
 ..
-  Note to patch submitters: this file is covered by a periodic proposal
-  job.  You should edit the files data/devstack-plugins-registry.footer
-  data/devstack-plugins-registry.header instead of this one.
+
+  Note to patch submitters:
+
+  # ============================= #
+  # THIS FILE IS AUTOGENERATED !  #
+  # ============================= #
+
+  ** Plugins are found automatically and added to this list **
+
+  This file is created by a periodic proposal job.  You should not
+  edit this file.
+
+  You should edit the files data/devstack-plugins-registry.footer
+  data/devstack-plugins-registry.header to modify this text.
 
 ==========================
  DevStack Plugin Registry
 ==========================
 
-Since we've created the external plugin mechanism, it's gotten used by
-a lot of projects. The following is a list of plugins that currently
-exist. Any project that wishes to list their plugin here is welcomed
-to.
-
-Detected Plugins
-================
-
-The following are plugins that a script has found in the openstack/
-namespace, which includes but is not limited to official OpenStack
-projects.
+The following list is an automatically-generated collection of
+available DevStack plugins.  This includes, but is not limited to,
+official OpenStack projects.
 
 
 ====================================== ===

From 06c7a4404edf25b9a4d913e77d12a2f61a608053 Mon Sep 17 00:00:00 2001
From: Alex Meade <mr.alex.meade@gmail.com>
Date: Fri, 1 Apr 2016 13:18:32 -0400
Subject: [PATCH 0389/2409] Add volumev3 endpoint for Cinder

Change-Id: I97caa6bfababf7d1cc714296ae66f77d22bf24ab
---
 lib/cinder  | 8 ++++++++
 lib/tempest | 2 ++
 2 files changed, 10 insertions(+)

diff --git a/lib/cinder b/lib/cinder
index 4df7de8959..607a6f83c6 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -386,6 +386,14 @@ function create_cinder_accounts {
             "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v2/\$(project_id)s" \
             "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v2/\$(project_id)s" \
             "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v2/\$(project_id)s"
+
+        get_or_create_service "cinderv3" "volumev3" "Cinder Volume Service V3"
+        get_or_create_endpoint \
+            "volumev3" \
+            "$REGION_NAME" \
+            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v3/\$(project_id)s" \
+            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v3/\$(project_id)s" \
+            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v3/\$(project_id)s"
     fi
 }
 
diff --git a/lib/tempest b/lib/tempest
index fd98c948f2..0fc58153f4 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -425,6 +425,8 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG volume-feature-enabled incremental_backup_force True
     # TODO(ynesenenko): Remove the volume_services flag when Liberty and Kilo will correct work with host info.
     iniset $TEMPEST_CONFIG volume-feature-enabled volume_services True
+    # TODO(ameade): Remove the api_v3 flag when Mitaka and Liberty are end of life.
+    iniset $TEMPEST_CONFIG volume-feature-enabled api_v3 True
 
     if ! is_service_enabled c-bak; then
         iniset $TEMPEST_CONFIG volume-feature-enabled backup False

From f9d10ebdf1f6776a9b878e0eef314acd176a7aa2 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Tue, 19 Apr 2016 06:46:31 +0000
Subject: [PATCH 0390/2409] Updated from generate-devstack-plugins-list

Change-Id: Id0201da590a6af83b2b6dd26da811cd67975f6eb
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 9c207658fa..5f38168006 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -99,6 +99,7 @@ neutron-vpnaas                         `git://git.openstack.org/openstack/neutro
 nova-docker                            `git://git.openstack.org/openstack/nova-docker <https://git.openstack.org/cgit/openstack/nova-docker>`__
 nova-powervm                           `git://git.openstack.org/openstack/nova-powervm <https://git.openstack.org/cgit/openstack/nova-powervm>`__
 octavia                                `git://git.openstack.org/openstack/octavia <https://git.openstack.org/cgit/openstack/octavia>`__
+openstack-ansible-os_swift_sync        `git://git.openstack.org/openstack/openstack-ansible-os_swift_sync <https://git.openstack.org/cgit/openstack/openstack-ansible-os_swift_sync>`__
 osprofiler                             `git://git.openstack.org/openstack/osprofiler <https://git.openstack.org/cgit/openstack/osprofiler>`__
 python-freezerclient                   `git://git.openstack.org/openstack/python-freezerclient <https://git.openstack.org/cgit/openstack/python-freezerclient>`__
 rally                                  `git://git.openstack.org/openstack/rally <https://git.openstack.org/cgit/openstack/rally>`__

From 73467041b6853ee99b5f973f52a0be092de9c48a Mon Sep 17 00:00:00 2001
From: Tom Patzig <tom.patzig@sap.com>
Date: Tue, 19 Apr 2016 17:02:34 +0200
Subject: [PATCH 0391/2409] Remove additional '/' in Q_PLUGIN_EXTRA_CONF_FILES

Currently there is added an obsolote/wrong '/' when passing
Q_PLUGIN_EXTRA_CONF_FILES to the service start arguments.
Thats not a problem when using absolute paths, but wrong for
relative paths. This patch removes that extra '/'.

Change-Id: I2136d39889eaf83ecfcc711c733e95e261f455e0
Closes-Bug: #1572192
---
 lib/neutron-legacy | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index c2729cb5d2..2d55abf2a9 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -387,7 +387,7 @@ function _determine_config_server {
     local cfg_file
     local opts="--config-file $NEUTRON_CONF --config-file /$Q_PLUGIN_CONF_FILE"
     for cfg_file in ${Q_PLUGIN_EXTRA_CONF_FILES[@]}; do
-        opts+=" --config-file /$cfg_file"
+        opts+=" --config-file $cfg_file"
     done
     echo "$opts"
 }

From 181588b9ba50fefea12617a9a5e774daddfed20c Mon Sep 17 00:00:00 2001
From: Brant Knudson <bknudson@us.ibm.com>
Date: Thu, 25 Jun 2015 17:58:51 -0500
Subject: [PATCH 0392/2409] Switch fernet to be the default token provider

Use the fernet token provider as the default for keystone.

 The Keystone token provider of choice is changing from UUID to Fernet.
 However, due the the need for multi-site keystone deploys to have keys
 kept in sync, we cannot change the default in upstream Keystone
 without  breaking existing deployments.  Fernet requires a deliberate
 setup step like what is done in devstack.  Making the change in
 devstack documents the expected setup.

Change-Id: I8c0db244634b0861b0eb3c48fe6ede153f7f04f2
---
 lib/keystone | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/keystone b/lib/keystone
index d83092405b..49d819e500 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -89,7 +89,7 @@ KEYSTONE_RESOURCE_BACKEND=${KEYSTONE_RESOURCE_BACKEND:-sql}
 
 # Select Keystone's token provider (and format)
 # Choose from 'uuid', 'pki', 'pkiz', or 'fernet'
-KEYSTONE_TOKEN_FORMAT=${KEYSTONE_TOKEN_FORMAT:-}
+KEYSTONE_TOKEN_FORMAT=${KEYSTONE_TOKEN_FORMAT:-fernet}
 KEYSTONE_TOKEN_FORMAT=$(echo ${KEYSTONE_TOKEN_FORMAT} | tr '[:upper:]' '[:lower:]')
 
 # Set Keystone interface configuration

From 67223b0265501c17357f91a956ff4b1f76a67523 Mon Sep 17 00:00:00 2001
From: Tom Patzig <tom.patzig@sap.com>
Date: Tue, 19 Apr 2016 16:43:05 +0200
Subject: [PATCH 0393/2409] Fix Q_PLUGIN_EXTRA_CONF_PATH usage comment

The bug #1542282 added Q_PLUGIN_CONF_PATH to the comment on how to use
Q_PLUGIN_EXTRA_CONF_FILES. But the right variable name is
Q_PLUGIN_EXTRA_CONF_PATH; this patch fixes this comment.

Change-Id: I6b6b39068fe54509b1bb8af47ae0b21dd77c444a
Related-Bug: #1469434
Closes-Bug: #1542282
---
 lib/neutron-legacy | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index c2729cb5d2..76adb28196 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -946,10 +946,10 @@ function _configure_neutron_common {
 
     # Set plugin-specific variables ``Q_DB_NAME``, ``Q_PLUGIN_CLASS``.
     # For main plugin config file, set ``Q_PLUGIN_CONF_PATH``, ``Q_PLUGIN_CONF_FILENAME``.
-    # For addition plugin config files, set ``Q_PLUGIN_EXTRA_CONF_PATH`` and
+    # For additional plugin config files, set ``Q_PLUGIN_EXTRA_CONF_PATH`` and
     # ``Q_PLUGIN_EXTRA_CONF_FILES``.  For example:
     #
-    #    ``Q_PLUGIN_CONF_PATH=/path/to/plugins``
+    #    ``Q_PLUGIN_EXTRA_CONF_PATH=/path/to/plugins``
     #    ``Q_PLUGIN_EXTRA_CONF_FILES=(file1 file2)``
     neutron_plugin_configure_common
 

From c527ded91bef5d4c56cbdb2402a4d68015364b37 Mon Sep 17 00:00:00 2001
From: Clenimar Filemon <clenimar.filemon@gmail.com>
Date: Thu, 31 Mar 2016 15:43:51 -0300
Subject: [PATCH 0394/2409] Update auth params in Nova Hypervisor-Ironic

As Nova hypervisor uses deprecated parameters when trying to
authenticate to Ironic, as well as a hardcoded /v2.0 endpoint, a fatal
error occurs when creating a keystone v3-only devstack.

This patch updates auth parameters (ironic section in nova.conf) that Nova
uses when trying to connect to Ironic to v3 parameters.

Change-Id: I2d7ebf750115613aa917448f20daaece614633ef
---
 lib/nova_plugins/hypervisor-ironic | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/lib/nova_plugins/hypervisor-ironic b/lib/nova_plugins/hypervisor-ironic
index 43e7797371..7224fe3f42 100644
--- a/lib/nova_plugins/hypervisor-ironic
+++ b/lib/nova_plugins/hypervisor-ironic
@@ -45,10 +45,12 @@ function configure_nova_hypervisor {
     iniset $NOVA_CONF DEFAULT ram_allocation_ratio 1.0
     iniset $NOVA_CONF DEFAULT reserved_host_memory_mb 0
     # ironic section
-    iniset $NOVA_CONF ironic admin_username admin
-    iniset $NOVA_CONF ironic admin_password $ADMIN_PASSWORD
-    iniset $NOVA_CONF ironic admin_url $KEYSTONE_AUTH_URI/v2.0
-    iniset $NOVA_CONF ironic admin_tenant_name demo
+    iniset $NOVA_CONF ironic username admin
+    iniset $NOVA_CONF ironic password $ADMIN_PASSWORD
+    iniset $NOVA_CONF ironic auth_url $KEYSTONE_AUTH_URI/v3
+    iniset $NOVA_CONF ironic project_domain_id default
+    iniset $NOVA_CONF ironic user_domain_id default
+    iniset $NOVA_CONF ironic project_name demo
     iniset $NOVA_CONF ironic api_endpoint $IRONIC_SERVICE_PROTOCOL://$IRONIC_HOSTPORT/v1
 }
 

From 648c4c25f7a11c4cb6f0d881d6fd4083dc957c61 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Thu, 21 Apr 2016 06:58:55 +0000
Subject: [PATCH 0395/2409] Updated from generate-devstack-plugins-list

Change-Id: I6f0a481f95055ed9334a57d50a68b077eace1e07
---
 doc/source/plugin-registry.rst | 1 -
 1 file changed, 1 deletion(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 5f38168006..9c207658fa 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -99,7 +99,6 @@ neutron-vpnaas                         `git://git.openstack.org/openstack/neutro
 nova-docker                            `git://git.openstack.org/openstack/nova-docker <https://git.openstack.org/cgit/openstack/nova-docker>`__
 nova-powervm                           `git://git.openstack.org/openstack/nova-powervm <https://git.openstack.org/cgit/openstack/nova-powervm>`__
 octavia                                `git://git.openstack.org/openstack/octavia <https://git.openstack.org/cgit/openstack/octavia>`__
-openstack-ansible-os_swift_sync        `git://git.openstack.org/openstack/openstack-ansible-os_swift_sync <https://git.openstack.org/cgit/openstack/openstack-ansible-os_swift_sync>`__
 osprofiler                             `git://git.openstack.org/openstack/osprofiler <https://git.openstack.org/cgit/openstack/osprofiler>`__
 python-freezerclient                   `git://git.openstack.org/openstack/python-freezerclient <https://git.openstack.org/cgit/openstack/python-freezerclient>`__
 rally                                  `git://git.openstack.org/openstack/rally <https://git.openstack.org/cgit/openstack/rally>`__

From bea1e1954ad793f528876c030bc0ffecb83b0787 Mon Sep 17 00:00:00 2001
From: Huan Xie <huan.xie@citrix.com>
Date: Tue, 19 Apr 2016 07:01:30 +0100
Subject: [PATCH 0396/2409] Set default value and configurable value for
 integration bridge

When using XenServer as hypervisor, install_os_domU.sh will create
integration bridge for compute node when neutron network is used.
But it should provide a way to allow moving of the VM to another
host (with a different XEN_INTEGRATION_BRIDGE) for easier install.
This patch is to provide the way to let user have the chance to
configure integration bridge themselves

Change-Id: If923a5e978e77fc091d24b6e1fe7a83a3375da09
---
 lib/nova_plugins/hypervisor-xenserver | 3 ++-
 tools/xen/README.md                   | 6 ++++++
 tools/xen/install_os_domU.sh          | 4 ++--
 3 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/lib/nova_plugins/hypervisor-xenserver b/lib/nova_plugins/hypervisor-xenserver
index 3eb9149bb4..e7f1e87b61 100644
--- a/lib/nova_plugins/hypervisor-xenserver
+++ b/lib/nova_plugins/hypervisor-xenserver
@@ -29,7 +29,8 @@ GUEST_INTERFACE_DEFAULT=eth1
 # Allow ``build_domU.sh`` to specify the flat network bridge via kernel args
 FLAT_NETWORK_BRIDGE_DEFAULT=$(sed -e 's/.* flat_network_bridge=\([[:alnum:]]*\).*$/\1/g' /proc/cmdline)
 if is_service_enabled neutron; then
-    XEN_INTEGRATION_BRIDGE=$(sed -e 's/.* xen_integration_bridge=\([[:alnum:]]*\).*$/\1/g' /proc/cmdline)
+    XEN_INTEGRATION_BRIDGE_DEFAULT=$(sed -e 's/.* xen_integration_bridge=\([[:alnum:]]*\).*$/\1/g' /proc/cmdline)
+    XEN_INTEGRATION_BRIDGE=${XEN_INTEGRATION_BRIDGE:-$XEN_INTEGRATION_BRIDGE_DEFAULT}
 fi
 
 VNCSERVER_PROXYCLIENT_ADDRESS=${VNCSERVER_PROXYCLIENT_ADDRESS=169.254.0.1}
diff --git a/tools/xen/README.md b/tools/xen/README.md
index 21090e56aa..7062ecb48c 100644
--- a/tools/xen/README.md
+++ b/tools/xen/README.md
@@ -170,3 +170,9 @@ VM as `TEMPLATE_FILENAME`:
     xe vm-import filename="$mountdir/$TEMPLATE_FILENAME"
     umount "$mountdir"
     rm -rf "$mountdir"
+
+### Migrate OpenStack DomU to another host
+
+Given you need to migrate your DomU with OpenStack installed to another host,
+you need to set `XEN_INTEGRATION_BRIDGE` in localrc if neutron network is used.
+It is the bridge for `XEN_INT_BRIDGE_OR_NET_NAME` network created in Dom0
diff --git a/tools/xen/install_os_domU.sh b/tools/xen/install_os_domU.sh
index 46ff0b6fda..8b97265e21 100755
--- a/tools/xen/install_os_domU.sh
+++ b/tools/xen/install_os_domU.sh
@@ -299,10 +299,10 @@ $THIS_DIR/build_xva.sh "$GUEST_NAME"
 # kernel parameter for DomU
 attach_network "$XEN_INT_BRIDGE_OR_NET_NAME"
 
-XEN_INTEGRATION_BRIDGE=$(bridge_for "$XEN_INT_BRIDGE_OR_NET_NAME")
+XEN_INTEGRATION_BRIDGE_DEFAULT=$(bridge_for "$XEN_INT_BRIDGE_OR_NET_NAME")
 append_kernel_cmdline \
     "$GUEST_NAME" \
-    "xen_integration_bridge=${XEN_INTEGRATION_BRIDGE}"
+    "xen_integration_bridge=${XEN_INTEGRATION_BRIDGE_DEFAULT}"
 
 FLAT_NETWORK_BRIDGE="${FLAT_NETWORK_BRIDGE:-$(bridge_for "$VM_BRIDGE_OR_NET_NAME")}"
 append_kernel_cmdline "$GUEST_NAME" "flat_network_bridge=${FLAT_NETWORK_BRIDGE}"

From 7d1ec430046256ac3f536f4920a43936e28ef0c4 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Fri, 22 Apr 2016 09:19:10 -0400
Subject: [PATCH 0397/2409] Don't check for existing endpoints

We really should only have code that create endpoints once, making all
osc calls get_or_set adds 3 seconds per call for no really good
reason.

This also stops creating the internal endpoints in the service
catalog. It's a pattern that we're trying not to propogate, so lets
not have it in devstack any more.

Change-Id: Ia8cefe43753900d62117beae330db46deb6a9fc9
---
 functions-common   | 35 ++++++++++++++++-------------------
 lib/cinder         |  6 +++---
 lib/glance         |  4 ++--
 lib/heat           |  4 ++--
 lib/neutron-legacy |  2 +-
 lib/nova           |  6 +++---
 lib/swift          |  2 +-
 7 files changed, 28 insertions(+), 31 deletions(-)

diff --git a/functions-common b/functions-common
index e44fea112d..7f670716bd 100644
--- a/functions-common
+++ b/functions-common
@@ -987,38 +987,35 @@ function get_or_create_service {
 }
 
 # Create an endpoint with a specific interface
-# Usage: _get_or_create_endpoint_with_interface <service> <interface> <url> <region>
-function _get_or_create_endpoint_with_interface {
+# Usage: _create_endpoint_with_interface <service> <interface> <url> <region>
+function _create_endpoint_with_interface {
+    # Creates new endpoint
     local endpoint_id
-    endpoint_id=$(openstack endpoint list \
-        --service $1 \
-        --interface $2 \
-        --region $4 \
-        -c ID -f value)
-    if [[ -z "$endpoint_id" ]]; then
-        # Creates new endpoint
-        endpoint_id=$(openstack endpoint create \
-            $1 $2 $3 --region $4 -f value -c id)
-    fi
-
+    endpoint_id=$(openstack endpoint create \
+                            $1 $2 $3 --region $4 -f value -c id)
     echo $endpoint_id
 }
 
-# Gets or creates endpoint
-# Usage: get_or_create_endpoint <service> <region> <publicurl> <adminurl> <internalurl>
+# TODO(sdague): remove in O
 function get_or_create_endpoint {
+    deprecated "get_or_create_endpoint is deprecated. Use create_endpoint instead"
+    create_endpoint $@
+}
+
+# Gets or creates endpoint
+# Usage: create_endpoint <service> <region> <publicurl> <adminurl>
+function create_endpoint {
     # NOTE(jamielennnox): when converting to v3 endpoint creation we go from
     # creating one endpoint with multiple urls to multiple endpoints each with
     # a different interface.  To maintain the existing function interface we
-    # create 3 endpoints and return the id of the public one. In reality
+    # create 2 endpoints and return the id of the public one. In reality
     # returning the public id will not make a lot of difference as there are no
     # scenarios currently that use the returned id. Ideally this behaviour
     # should be pushed out to the service setups and let them create the
     # endpoints they need.
     local public_id
-    public_id=$(_get_or_create_endpoint_with_interface $1 public $3 $2)
-    _get_or_create_endpoint_with_interface $1 admin $4 $2
-    _get_or_create_endpoint_with_interface $1 internal $5 $2
+    public_id=$(_create_endpoint_with_interface $1 public $3 $2)
+    _create_endpoint_with_interface $1 admin $4 $2
 
     # return the public id to indicate success, and this is the endpoint most likely wanted
     echo $public_id
diff --git a/lib/cinder b/lib/cinder
index 607a6f83c6..037456adef 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -372,7 +372,7 @@ function create_cinder_accounts {
         create_service_user "cinder"
 
         get_or_create_service "cinder" "volume" "Cinder Volume Service"
-        get_or_create_endpoint \
+        create_endpoint \
             "volume" \
             "$REGION_NAME" \
             "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/\$(project_id)s" \
@@ -380,7 +380,7 @@ function create_cinder_accounts {
             "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/\$(project_id)s"
 
         get_or_create_service "cinderv2" "volumev2" "Cinder Volume Service V2"
-        get_or_create_endpoint \
+        create_endpoint \
             "volumev2" \
             "$REGION_NAME" \
             "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v2/\$(project_id)s" \
@@ -388,7 +388,7 @@ function create_cinder_accounts {
             "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v2/\$(project_id)s"
 
         get_or_create_service "cinderv3" "volumev3" "Cinder Volume Service V3"
-        get_or_create_endpoint \
+        create_endpoint \
             "volumev3" \
             "$REGION_NAME" \
             "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v3/\$(project_id)s" \
diff --git a/lib/glance b/lib/glance
index f2a6db6edc..5d532eac5e 100644
--- a/lib/glance
+++ b/lib/glance
@@ -292,7 +292,7 @@ function create_glance_accounts {
         fi
 
         get_or_create_service "glance" "image" "Glance Image Service"
-        get_or_create_endpoint \
+        create_endpoint \
             "image" \
             "$REGION_NAME" \
             "$GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT" \
@@ -305,7 +305,7 @@ function create_glance_accounts {
         create_service_user "glare"
         get_or_create_service "glare" "artifact" "Glance Artifact Service"
 
-        get_or_create_endpoint "artifact" \
+        create_endpoint "artifact" \
             "$REGION_NAME" \
             "$GLANCE_SERVICE_PROTOCOL://$GLANCE_GLARE_HOSTPORT" \
             "$GLANCE_SERVICE_PROTOCOL://$GLANCE_GLARE_HOSTPORT" \
diff --git a/lib/heat b/lib/heat
index 4326321bd1..6a654b5ade 100644
--- a/lib/heat
+++ b/lib/heat
@@ -388,7 +388,7 @@ function create_heat_accounts {
 
         create_service_user "heat" "admin"
         get_or_create_service "heat" "orchestration" "Heat Orchestration Service"
-        get_or_create_endpoint \
+        create_endpoint \
             "orchestration" \
             "$REGION_NAME" \
             "$SERVICE_PROTOCOL://$HEAT_API_HOST:$HEAT_API_PORT/v1/\$(project_id)s" \
@@ -396,7 +396,7 @@ function create_heat_accounts {
             "$SERVICE_PROTOCOL://$HEAT_API_HOST:$HEAT_API_PORT/v1/\$(project_id)s"
 
         get_or_create_service "heat-cfn" "cloudformation" "Heat CloudFormation Service"
-        get_or_create_endpoint \
+        create_endpoint \
             "cloudformation"  \
             "$REGION_NAME" \
             "$SERVICE_PROTOCOL://$HEAT_API_CFN_HOST:$HEAT_API_CFN_PORT/v1" \
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index f0592e2f37..9da6a26e7b 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -534,7 +534,7 @@ function create_neutron_accounts {
         create_service_user "neutron"
 
         get_or_create_service "neutron" "network" "Neutron Service"
-        get_or_create_endpoint \
+        create_endpoint \
             "network" \
             "$REGION_NAME" \
             "$Q_PROTOCOL://$SERVICE_HOST:$Q_PORT/" \
diff --git a/lib/nova b/lib/nova
index 818ecc4f1b..33dbc428ee 100644
--- a/lib/nova
+++ b/lib/nova
@@ -418,7 +418,7 @@ function create_nova_accounts {
         fi
 
         get_or_create_service "nova_legacy" "compute_legacy" "Nova Compute Service (Legacy 2.0)"
-        get_or_create_endpoint \
+        create_endpoint \
             "compute_legacy" \
             "$REGION_NAME" \
             "$nova_api_url/v2/\$(project_id)s" \
@@ -426,7 +426,7 @@ function create_nova_accounts {
             "$nova_api_url/v2/\$(project_id)s"
 
         get_or_create_service "nova" "compute" "Nova Compute Service"
-        get_or_create_endpoint \
+        create_endpoint \
             "compute" \
             "$REGION_NAME" \
             "$nova_api_url/v2.1" \
@@ -446,7 +446,7 @@ function create_nova_accounts {
     # S3
     if is_service_enabled swift3; then
         get_or_create_service "s3" "s3" "S3"
-        get_or_create_endpoint \
+        create_endpoint \
             "s3" \
             "$REGION_NAME" \
             "http://$SERVICE_HOST:$S3_SERVICE_PORT" \
diff --git a/lib/swift b/lib/swift
index 8cb94efa66..b74b4da840 100644
--- a/lib/swift
+++ b/lib/swift
@@ -633,7 +633,7 @@ function create_swift_accounts {
     create_service_user "swift" "admin"
 
     get_or_create_service "swift" "object-store" "Swift Service"
-    get_or_create_endpoint \
+    create_endpoint \
         "object-store" \
         "$REGION_NAME" \
         "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$SWIFT_DEFAULT_BIND_PORT/v1/AUTH_\$(project_id)s" \

From ae4578bed986ebaaf3e09e1ecc9d4d7ae9f022ab Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Sat, 23 Apr 2016 01:45:40 +0000
Subject: [PATCH 0398/2409] Revert "Don't check for existing endpoints"

This reverts commit 7d1ec430046256ac3f536f4920a43936e28ef0c4.

This broke the sahara and layer4 dsvm jobs. The layer4 job
is voting on tempest changes so tempest is also broken.

Change-Id: Ide69f10cd85bf7ff0d86bc8cba56dedd26850362
Partial-Bug: #1573868
---
 functions-common   | 35 +++++++++++++++++++----------------
 lib/cinder         |  6 +++---
 lib/glance         |  4 ++--
 lib/heat           |  4 ++--
 lib/neutron-legacy |  2 +-
 lib/nova           |  6 +++---
 lib/swift          |  2 +-
 7 files changed, 31 insertions(+), 28 deletions(-)

diff --git a/functions-common b/functions-common
index 7f670716bd..e44fea112d 100644
--- a/functions-common
+++ b/functions-common
@@ -987,35 +987,38 @@ function get_or_create_service {
 }
 
 # Create an endpoint with a specific interface
-# Usage: _create_endpoint_with_interface <service> <interface> <url> <region>
-function _create_endpoint_with_interface {
-    # Creates new endpoint
+# Usage: _get_or_create_endpoint_with_interface <service> <interface> <url> <region>
+function _get_or_create_endpoint_with_interface {
     local endpoint_id
-    endpoint_id=$(openstack endpoint create \
-                            $1 $2 $3 --region $4 -f value -c id)
-    echo $endpoint_id
-}
+    endpoint_id=$(openstack endpoint list \
+        --service $1 \
+        --interface $2 \
+        --region $4 \
+        -c ID -f value)
+    if [[ -z "$endpoint_id" ]]; then
+        # Creates new endpoint
+        endpoint_id=$(openstack endpoint create \
+            $1 $2 $3 --region $4 -f value -c id)
+    fi
 
-# TODO(sdague): remove in O
-function get_or_create_endpoint {
-    deprecated "get_or_create_endpoint is deprecated. Use create_endpoint instead"
-    create_endpoint $@
+    echo $endpoint_id
 }
 
 # Gets or creates endpoint
-# Usage: create_endpoint <service> <region> <publicurl> <adminurl>
-function create_endpoint {
+# Usage: get_or_create_endpoint <service> <region> <publicurl> <adminurl> <internalurl>
+function get_or_create_endpoint {
     # NOTE(jamielennnox): when converting to v3 endpoint creation we go from
     # creating one endpoint with multiple urls to multiple endpoints each with
     # a different interface.  To maintain the existing function interface we
-    # create 2 endpoints and return the id of the public one. In reality
+    # create 3 endpoints and return the id of the public one. In reality
     # returning the public id will not make a lot of difference as there are no
     # scenarios currently that use the returned id. Ideally this behaviour
     # should be pushed out to the service setups and let them create the
     # endpoints they need.
     local public_id
-    public_id=$(_create_endpoint_with_interface $1 public $3 $2)
-    _create_endpoint_with_interface $1 admin $4 $2
+    public_id=$(_get_or_create_endpoint_with_interface $1 public $3 $2)
+    _get_or_create_endpoint_with_interface $1 admin $4 $2
+    _get_or_create_endpoint_with_interface $1 internal $5 $2
 
     # return the public id to indicate success, and this is the endpoint most likely wanted
     echo $public_id
diff --git a/lib/cinder b/lib/cinder
index 037456adef..607a6f83c6 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -372,7 +372,7 @@ function create_cinder_accounts {
         create_service_user "cinder"
 
         get_or_create_service "cinder" "volume" "Cinder Volume Service"
-        create_endpoint \
+        get_or_create_endpoint \
             "volume" \
             "$REGION_NAME" \
             "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/\$(project_id)s" \
@@ -380,7 +380,7 @@ function create_cinder_accounts {
             "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/\$(project_id)s"
 
         get_or_create_service "cinderv2" "volumev2" "Cinder Volume Service V2"
-        create_endpoint \
+        get_or_create_endpoint \
             "volumev2" \
             "$REGION_NAME" \
             "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v2/\$(project_id)s" \
@@ -388,7 +388,7 @@ function create_cinder_accounts {
             "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v2/\$(project_id)s"
 
         get_or_create_service "cinderv3" "volumev3" "Cinder Volume Service V3"
-        create_endpoint \
+        get_or_create_endpoint \
             "volumev3" \
             "$REGION_NAME" \
             "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v3/\$(project_id)s" \
diff --git a/lib/glance b/lib/glance
index 5d532eac5e..f2a6db6edc 100644
--- a/lib/glance
+++ b/lib/glance
@@ -292,7 +292,7 @@ function create_glance_accounts {
         fi
 
         get_or_create_service "glance" "image" "Glance Image Service"
-        create_endpoint \
+        get_or_create_endpoint \
             "image" \
             "$REGION_NAME" \
             "$GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT" \
@@ -305,7 +305,7 @@ function create_glance_accounts {
         create_service_user "glare"
         get_or_create_service "glare" "artifact" "Glance Artifact Service"
 
-        create_endpoint "artifact" \
+        get_or_create_endpoint "artifact" \
             "$REGION_NAME" \
             "$GLANCE_SERVICE_PROTOCOL://$GLANCE_GLARE_HOSTPORT" \
             "$GLANCE_SERVICE_PROTOCOL://$GLANCE_GLARE_HOSTPORT" \
diff --git a/lib/heat b/lib/heat
index 6a654b5ade..4326321bd1 100644
--- a/lib/heat
+++ b/lib/heat
@@ -388,7 +388,7 @@ function create_heat_accounts {
 
         create_service_user "heat" "admin"
         get_or_create_service "heat" "orchestration" "Heat Orchestration Service"
-        create_endpoint \
+        get_or_create_endpoint \
             "orchestration" \
             "$REGION_NAME" \
             "$SERVICE_PROTOCOL://$HEAT_API_HOST:$HEAT_API_PORT/v1/\$(project_id)s" \
@@ -396,7 +396,7 @@ function create_heat_accounts {
             "$SERVICE_PROTOCOL://$HEAT_API_HOST:$HEAT_API_PORT/v1/\$(project_id)s"
 
         get_or_create_service "heat-cfn" "cloudformation" "Heat CloudFormation Service"
-        create_endpoint \
+        get_or_create_endpoint \
             "cloudformation"  \
             "$REGION_NAME" \
             "$SERVICE_PROTOCOL://$HEAT_API_CFN_HOST:$HEAT_API_CFN_PORT/v1" \
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 9da6a26e7b..f0592e2f37 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -534,7 +534,7 @@ function create_neutron_accounts {
         create_service_user "neutron"
 
         get_or_create_service "neutron" "network" "Neutron Service"
-        create_endpoint \
+        get_or_create_endpoint \
             "network" \
             "$REGION_NAME" \
             "$Q_PROTOCOL://$SERVICE_HOST:$Q_PORT/" \
diff --git a/lib/nova b/lib/nova
index 33dbc428ee..818ecc4f1b 100644
--- a/lib/nova
+++ b/lib/nova
@@ -418,7 +418,7 @@ function create_nova_accounts {
         fi
 
         get_or_create_service "nova_legacy" "compute_legacy" "Nova Compute Service (Legacy 2.0)"
-        create_endpoint \
+        get_or_create_endpoint \
             "compute_legacy" \
             "$REGION_NAME" \
             "$nova_api_url/v2/\$(project_id)s" \
@@ -426,7 +426,7 @@ function create_nova_accounts {
             "$nova_api_url/v2/\$(project_id)s"
 
         get_or_create_service "nova" "compute" "Nova Compute Service"
-        create_endpoint \
+        get_or_create_endpoint \
             "compute" \
             "$REGION_NAME" \
             "$nova_api_url/v2.1" \
@@ -446,7 +446,7 @@ function create_nova_accounts {
     # S3
     if is_service_enabled swift3; then
         get_or_create_service "s3" "s3" "S3"
-        create_endpoint \
+        get_or_create_endpoint \
             "s3" \
             "$REGION_NAME" \
             "http://$SERVICE_HOST:$S3_SERVICE_PORT" \
diff --git a/lib/swift b/lib/swift
index b74b4da840..8cb94efa66 100644
--- a/lib/swift
+++ b/lib/swift
@@ -633,7 +633,7 @@ function create_swift_accounts {
     create_service_user "swift" "admin"
 
     get_or_create_service "swift" "object-store" "Swift Service"
-    create_endpoint \
+    get_or_create_endpoint \
         "object-store" \
         "$REGION_NAME" \
         "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$SWIFT_DEFAULT_BIND_PORT/v1/AUTH_\$(project_id)s" \

From 229685112d0de969e19e834be728d9c95c845abe Mon Sep 17 00:00:00 2001
From: Ken'ichi Ohmichi <ken-oomichi@wx.jp.nec.com>
Date: Fri, 22 Apr 2016 20:14:15 -0700
Subject: [PATCH 0399/2409] Remove unused tempest options

Since I380dd20e5ed716a0bdf92aa02c3730359b8136e4 , tempest options
tempest_username and tempest_tenant_name have been added.
However, they are never used at all.
So this patch removes them for the cleanup.

Change-Id: Ic40047c5903d664e4a2d5eea88ff788e39d1e416
---
 lib/tempest | 2 --
 1 file changed, 2 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 46dc1f8d42..3d004c47d6 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -182,8 +182,6 @@ function configure_tempest {
     local admin_username=${ADMIN_USERNAME:-admin}
     local admin_project_name=${ADMIN_TENANT_NAME:-admin}
     local admin_domain_name=${ADMIN_DOMAIN_NAME:-Default}
-    local tempest_username=${TEMPEST_USERNAME:-demo}
-    local tempest_project_name=${TEMPEST_TENANT_NAME:-demo}
     local alt_username=${ALT_USERNAME:-alt_demo}
     local alt_project_name=${ALT_TENANT_NAME:-alt_demo}
     local admin_project_id

From c4a0d21436c125b1caa3bd38b9d50f8130d9c413 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Sat, 23 Apr 2016 06:55:18 +0000
Subject: [PATCH 0400/2409] Updated from generate-devstack-plugins-list

Change-Id: I376abd75e0d0ce77c35b106a4e9c8c3e23247eb4
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 9c207658fa..835d043af1 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -93,6 +93,7 @@ networking-powervm                     `git://git.openstack.org/openstack/networ
 networking-sfc                         `git://git.openstack.org/openstack/networking-sfc <https://git.openstack.org/cgit/openstack/networking-sfc>`__
 networking-vsphere                     `git://git.openstack.org/openstack/networking-vsphere <https://git.openstack.org/cgit/openstack/networking-vsphere>`__
 neutron                                `git://git.openstack.org/openstack/neutron <https://git.openstack.org/cgit/openstack/neutron>`__
+neutron-dynamic-routing                `git://git.openstack.org/openstack/neutron-dynamic-routing <https://git.openstack.org/cgit/openstack/neutron-dynamic-routing>`__
 neutron-lbaas                          `git://git.openstack.org/openstack/neutron-lbaas <https://git.openstack.org/cgit/openstack/neutron-lbaas>`__
 neutron-lbaas-dashboard                `git://git.openstack.org/openstack/neutron-lbaas-dashboard <https://git.openstack.org/cgit/openstack/neutron-lbaas-dashboard>`__
 neutron-vpnaas                         `git://git.openstack.org/openstack/neutron-vpnaas <https://git.openstack.org/cgit/openstack/neutron-vpnaas>`__

From 336390f9b3691914f8aaf7a87867036fae35d8ba Mon Sep 17 00:00:00 2001
From: Daniel Gonzalez <daniel@gonzalez-nothnagel.de>
Date: Fri, 1 Apr 2016 10:53:13 +0200
Subject: [PATCH 0401/2409] Set user/project domain ID when using keystone v3

Change I24546f02067ea23d088d383b85e3a78d7b43f165 aimed to use
keystone v3 as default in devstack. The change was later reverted in
Ia792b23119c00089542ba08879dca1c29dc80945 because it broke some
projects.
This patch contains a small portion of the first change to set the
environment variables $OS_USER_DOMAIN_ID and $OS_PROJECT_DOMAIN_ID in
openrc, so that users don't have to set them manually when using
keystone v3.

Change-Id: Ie4c316d60590d55830d417f13817298dac70864f
Partially-Implements: bp keystonev3
Closes-Bug: 1387814
---
 openrc | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/openrc b/openrc
index db2e97d3b1..8d8ae8b030 100644
--- a/openrc
+++ b/openrc
@@ -90,6 +90,13 @@ export OS_IDENTITY_API_VERSION=${IDENTITY_API_VERSION:-2.0}
 #
 export OS_AUTH_URL=$KEYSTONE_AUTH_PROTOCOL://$KEYSTONE_AUTH_HOST:5000/v${OS_IDENTITY_API_VERSION}
 
+# Currently, in order to use openstackclient with Identity API v3,
+# we need to set the domain which the user and project belong to.
+if [ "$OS_IDENTITY_API_VERSION" = "3" ]; then
+    export OS_USER_DOMAIN_ID=${OS_USER_DOMAIN_ID:-"default"}
+    export OS_PROJECT_DOMAIN_ID=${OS_PROJECT_DOMAIN_ID:-"default"}
+fi
+
 # Set OS_CACERT to a default CA certificate chain if it exists.
 if [[ ! -v OS_CACERT ]] ; then
     DEFAULT_OS_CACERT=$INT_CA_DIR/ca-chain.pem

From e3a04dd857d8e6f8afc83a20673fedd79936d19b Mon Sep 17 00:00:00 2001
From: vsaienko <vsaienko@mirantis.com>
Date: Tue, 26 Apr 2016 10:26:25 +0300
Subject: [PATCH 0402/2409] Fix ironic compute_driver name

This commit fixes breaking change [0].
Long driver names like 'nova.virt.libvirt.libvirtDriver' are
no longer available and 'libvirt.libvirtDriver' should be used
instead.

Reference:
[0] https://review.openstack.org/309504

Change-Id: I27a1b75b921c7401bc8614caadfd1e09e7dd5d65
Closes-Bug: 1574990
---
 lib/nova_plugins/hypervisor-ironic | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova_plugins/hypervisor-ironic b/lib/nova_plugins/hypervisor-ironic
index 43e7797371..c40427c089 100644
--- a/lib/nova_plugins/hypervisor-ironic
+++ b/lib/nova_plugins/hypervisor-ironic
@@ -39,7 +39,7 @@ function configure_nova_hypervisor {
     configure_libvirt
     LIBVIRT_FIREWALL_DRIVER=${LIBVIRT_FIREWALL_DRIVER:-"nova.virt.firewall.NoopFirewallDriver"}
 
-    iniset $NOVA_CONF DEFAULT compute_driver nova.virt.ironic.IronicDriver
+    iniset $NOVA_CONF DEFAULT compute_driver ironic.IronicDriver
     iniset $NOVA_CONF DEFAULT firewall_driver $LIBVIRT_FIREWALL_DRIVER
     iniset $NOVA_CONF DEFAULT scheduler_host_manager ironic_host_manager
     iniset $NOVA_CONF DEFAULT ram_allocation_ratio 1.0

From c8af407eb2fd2634eeb61fc5c60ef9d965ac1da6 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 26 Apr 2016 17:53:45 +1000
Subject: [PATCH 0403/2409] Update to bashate 0.5.1

This minor release of bashate just fixes one small issue with python3
compatability.  This is an alternative to
Ic91b5ce8cb85e376573f9bf3659d2a86cc437179.

Change-Id: Ie5ad29003cf80a332b9a9258749757a15de79966
---
 tox.ini | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tox.ini b/tox.ini
index dbd1652d10..55a06d0cae 100644
--- a/tox.ini
+++ b/tox.ini
@@ -12,7 +12,7 @@ install_command = pip install {opts} {packages}
 # against devstack, just set BASHATE_INSTALL_PATH=/path/... to your
 # modified bashate tree
 deps =
-   {env:BASHATE_INSTALL_PATH:bashate==0.5.0}
+   {env:BASHATE_INSTALL_PATH:bashate==0.5.1}
 whitelist_externals = bash
 commands = bash -c "find {toxinidir}             \
          -not \( -type d -name .?\* -prune \)    \

From 7fa0efffab3662c0e0d4ba001d10d35e1eab87a6 Mon Sep 17 00:00:00 2001
From: Sylvain Baubeau <sbaubeau@redhat.com>
Date: Tue, 26 Apr 2016 20:39:18 +0200
Subject: [PATCH 0404/2409] Remove deprecated references to g-search

Commit 020586fab4173ea860789e459cb941c85179c739 removed support
for g-search as it was promoted to its own project. The devstack
plugin for Searchlight triggers the installation of elasticsearch,
so it can be removed from upstream devstack.

Change-Id: Iada75fc59c66b776c506431f93deb668ab0a84b9
---
 lib/glance | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/lib/glance b/lib/glance
index f2a6db6edc..cda357fa66 100644
--- a/lib/glance
+++ b/lib/glance
@@ -362,11 +362,6 @@ function install_glance {
 
     git_clone $GLANCE_REPO $GLANCE_DIR $GLANCE_BRANCH
 
-    if is_service_enabled g-search; then
-        ${TOP_DIR}/pkg/elasticsearch.sh download
-        ${TOP_DIR}/pkg/elasticsearch.sh install
-    fi
-
     setup_develop $GLANCE_DIR
 }
 
@@ -386,7 +381,7 @@ function start_glance {
         die $LINENO "g-api did not start"
     fi
 
-    #Start g-glare after g-reg/g-api/g-search
+    #Start g-glare after g-reg/g-api
     if is_service_enabled g-glare; then
         run_process g-glare "$GLANCE_BIN_DIR/glance-glare --config-file=$GLANCE_CONF_DIR/glance-glare.conf"
         echo "Waiting for Glare [g-glare] ($GLANCE_GLARE_HOSTPORT) to start..."

From 1da4e790eb26d1333d57c7673ba491ca9b6dbde8 Mon Sep 17 00:00:00 2001
From: Mike Trimm <mitrimm@cisco.com>
Date: Wed, 27 Apr 2016 11:40:19 -0500
Subject: [PATCH 0405/2409] Added RHEL rebuild ScientificLinux to supported
 distributions

Change-Id: I8b3844bf28b11254e7cc9a96126bd66efbd1212e
---
 functions-common | 1 +
 1 file changed, 1 insertion(+)

diff --git a/functions-common b/functions-common
index e44fea112d..4daa686dba 100644
--- a/functions-common
+++ b/functions-common
@@ -380,6 +380,7 @@ function GetDistro {
         DISTRO="sle${os_RELEASE%.*}"
     elif [[ "$os_VENDOR" =~ (Red.*Hat) || \
         "$os_VENDOR" =~ (CentOS) || \
+        "$os_VENDOR" =~ (Scientific) || \
         "$os_VENDOR" =~ (OracleServer) || \
         "$os_VENDOR" =~ (Virtuozzo) ]]; then
         # Drop the . release as we assume it's compatible

From 7b3ae5332813c79b734c99fbba3ab876224aa73c Mon Sep 17 00:00:00 2001
From: John Kasperski <jckasper@us.ibm.com>
Date: Sun, 24 Apr 2016 22:56:04 -0500
Subject: [PATCH 0406/2409] Update is_service_enabled

The nova check in is_service_enabled() is loading the nova repo
when ENABLED_SERVICES=ovn-northd.  Add a comma before each of the
checks to prevent this error with any of the other services.

Change-Id: I9deee735812cde44ea5140b1ad76848f02576609
Closes-Bug: #1574431
---
 functions-common | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/functions-common b/functions-common
index e44fea112d..a56a0abe9c 100644
--- a/functions-common
+++ b/functions-common
@@ -2063,14 +2063,14 @@ function is_service_enabled {
         # TODO(dtroyer): Remove these legacy special-cases after the is_XXX_enabled()
         #                are implemented
 
-        [[ ${service} == n-cell-* && ${ENABLED_SERVICES} =~ "n-cell" ]] && enabled=0
-        [[ ${service} == n-cpu-* && ${ENABLED_SERVICES} =~ "n-cpu" ]] && enabled=0
-        [[ ${service} == "nova" && ${ENABLED_SERVICES} =~ "n-" ]] && enabled=0
-        [[ ${service} == "glance" && ${ENABLED_SERVICES} =~ "g-" ]] && enabled=0
-        [[ ${service} == "neutron" && ${ENABLED_SERVICES} =~ "q-" ]] && enabled=0
-        [[ ${service} == "trove" && ${ENABLED_SERVICES} =~ "tr-" ]] && enabled=0
-        [[ ${service} == "swift" && ${ENABLED_SERVICES} =~ "s-" ]] && enabled=0
-        [[ ${service} == s-* && ${ENABLED_SERVICES} =~ "swift" ]] && enabled=0
+        [[ ${service} == n-cell-* && ,${ENABLED_SERVICES} =~ ,"n-cell" ]] && enabled=0
+        [[ ${service} == n-cpu-* && ,${ENABLED_SERVICES} =~ ,"n-cpu" ]] && enabled=0
+        [[ ${service} == "nova" && ,${ENABLED_SERVICES} =~ ,"n-" ]] && enabled=0
+        [[ ${service} == "glance" && ,${ENABLED_SERVICES} =~ ,"g-" ]] && enabled=0
+        [[ ${service} == "neutron" && ,${ENABLED_SERVICES} =~ ,"q-" ]] && enabled=0
+        [[ ${service} == "trove" && ,${ENABLED_SERVICES} =~ ,"tr-" ]] && enabled=0
+        [[ ${service} == "swift" && ,${ENABLED_SERVICES} =~ ,"s-" ]] && enabled=0
+        [[ ${service} == s-* && ,${ENABLED_SERVICES} =~ ,"swift" ]] && enabled=0
     done
 
     $xtrace

From 878d7d8f13592bf254cb5f647bd3db87c191d2d3 Mon Sep 17 00:00:00 2001
From: Victor Ryzhenkin <vryzhenkin@mirantis.com>
Date: Wed, 27 Apr 2016 15:15:52 +0300
Subject: [PATCH 0407/2409] Adjust region name for images, networks and volumes
 during deployment

In a multiregion installation of devstack, conflicts occur in the
creation of images, networks, or volume types, when the region is not
set.

This patch adjusts commands to include the region, and
also adjusts the region_name in the nova configuration section of
neutron.conf to include the region.

Change-Id: Ifedff6a124fa49d57cc7b2f35916d8d96f5e5f7a
---
 functions          | 20 +++++++++----------
 lib/cinder         |  2 +-
 lib/neutron-legacy | 49 ++++++++++++++++++++++++----------------------
 lib/nova           | 24 +++++++++++------------
 4 files changed, 49 insertions(+), 46 deletions(-)

diff --git a/functions b/functions
index 1bfb8a5078..0942f17009 100644
--- a/functions
+++ b/functions
@@ -83,7 +83,7 @@ function upload_image {
     # OpenVZ-format images are provided as .tar.gz, but not decompressed prior to loading
     if [[ "$image_url" =~ 'openvz' ]]; then
         image_name="${image_fname%.tar.gz}"
-        openstack --os-cloud=devstack-admin image create "$image_name" --public --container-format ami --disk-format ami < "${image}"
+        openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name" --public --container-format ami --disk-format ami < "${image}"
         return
     fi
 
@@ -197,7 +197,7 @@ function upload_image {
         vmdk_adapter_type="${props[1]:-$vmdk_adapter_type}"
         vmdk_net_adapter="${props[2]:-$vmdk_net_adapter}"
 
-        openstack --os-cloud=devstack-admin image create "$image_name" --public --container-format bare --disk-format vmdk --property vmware_disktype="$vmdk_disktype" --property vmware_adaptertype="$vmdk_adapter_type" --property hw_vif_model="$vmdk_net_adapter" < "${image}"
+        openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name" --public --container-format bare --disk-format vmdk --property vmware_disktype="$vmdk_disktype" --property vmware_adaptertype="$vmdk_adapter_type" --property hw_vif_model="$vmdk_net_adapter" < "${image}"
         return
     fi
 
@@ -214,7 +214,7 @@ function upload_image {
             force_vm_mode="--property vm_mode=xen"
         fi
         openstack \
-            --os-cloud=devstack-admin \
+            --os-cloud=devstack-admin --os-region-name="$REGION_NAME" \
             image create \
             "$image_name" --public \
             --container-format=ovf --disk-format=vhd \
@@ -228,7 +228,7 @@ function upload_image {
     if [[ "$image_url" =~ '.xen-raw.tgz' ]]; then
         image_name="${image_fname%.xen-raw.tgz}"
         openstack \
-            --os-cloud=devstack-admin \
+            --os-cloud=devstack-admin --os-region-name="$REGION_NAME" \
             image create \
             "$image_name" --public \
             --container-format=tgz --disk-format=raw \
@@ -244,7 +244,7 @@ function upload_image {
         fi
 
         openstack \
-            --os-cloud=devstack-admin \
+            --os-cloud=devstack-admin --os-region-name="$REGION_NAME" \
             image create \
             "$image_name" --public \
             --container-format=bare --disk-format=ploop \
@@ -327,9 +327,9 @@ function upload_image {
 
     if [ "$container_format" = "bare" ]; then
         if [ "$unpack" = "zcat" ]; then
-            openstack --os-cloud=devstack-admin image create "$image_name" $img_property --public --container-format=$container_format --disk-format $disk_format < <(zcat --force "${image}")
+            openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name" $img_property --public --container-format=$container_format --disk-format $disk_format < <(zcat --force "${image}")
         else
-            openstack --os-cloud=devstack-admin image create "$image_name" $img_property --public --container-format=$container_format --disk-format $disk_format < "${image}"
+            openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name" $img_property --public --container-format=$container_format --disk-format $disk_format < "${image}"
         fi
     else
         # Use glance client to add the kernel the root filesystem.
@@ -337,12 +337,12 @@ function upload_image {
         # kernel for use when uploading the root filesystem.
         local kernel_id="" ramdisk_id="";
         if [ -n "$kernel" ]; then
-            kernel_id=$(openstack --os-cloud=devstack-admin image create "$image_name-kernel" $img_property --public --container-format aki --disk-format aki < "$kernel" | grep ' id ' | get_field 2)
+            kernel_id=$(openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name-kernel" $img_property --public --container-format aki --disk-format aki < "$kernel" | grep ' id ' | get_field 2)
         fi
         if [ -n "$ramdisk" ]; then
-            ramdisk_id=$(openstack --os-cloud=devstack-admin image create "$image_name-ramdisk" $img_property --public --container-format ari --disk-format ari < "$ramdisk" | grep ' id ' | get_field 2)
+            ramdisk_id=$(openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name-ramdisk" $img_property --public --container-format ari --disk-format ari < "$ramdisk" | grep ' id ' | get_field 2)
         fi
-        openstack --os-cloud=devstack-admin image create "${image_name%.img}" $img_property --public --container-format ami --disk-format ami ${kernel_id:+--property kernel_id=$kernel_id} ${ramdisk_id:+--property ramdisk_id=$ramdisk_id} < "${image}"
+        openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "${image_name%.img}" $img_property --public --container-format ami --disk-format ami ${kernel_id:+--property kernel_id=$kernel_id} ${ramdisk_id:+--property ramdisk_id=$ramdisk_id} < "${image}"
     fi
 }
 
diff --git a/lib/cinder b/lib/cinder
index 607a6f83c6..17862327c4 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -560,7 +560,7 @@ function create_volume_types {
         local be be_name
         for be in ${CINDER_ENABLED_BACKENDS//,/ }; do
             be_name=${be##*:}
-            openstack volume type create --property volume_backend_name="${be_name}" ${be_name}
+            openstack --os-region-name="$REGION_NAME" volume type create --property volume_backend_name="${be_name}" ${be_name}
         done
     fi
 }
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index f0592e2f37..39f8dec9f9 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -556,16 +556,16 @@ function create_neutron_initial_network {
     if is_provider_network; then
         die_if_not_set $LINENO PHYSICAL_NETWORK "You must specify the PHYSICAL_NETWORK"
         die_if_not_set $LINENO PROVIDER_NETWORK_TYPE "You must specify the PROVIDER_NETWORK_TYPE"
-        NET_ID=$(neutron net-create $PHYSICAL_NETWORK --tenant_id $project_id --provider:network_type $PROVIDER_NETWORK_TYPE --provider:physical_network "$PHYSICAL_NETWORK" ${SEGMENTATION_ID:+--provider:segmentation_id $SEGMENTATION_ID} --shared | grep ' id ' | get_field 2)
+        NET_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" net-create $PHYSICAL_NETWORK --tenant_id $project_id --provider:network_type $PROVIDER_NETWORK_TYPE --provider:physical_network "$PHYSICAL_NETWORK" ${SEGMENTATION_ID:+--provider:segmentation_id $SEGMENTATION_ID} --shared | grep ' id ' | get_field 2)
         die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PHYSICAL_NETWORK $project_id"
 
         if [[ "$IP_VERSION" =~ 4.* ]]; then
-            SUBNET_ID=$(neutron subnet-create --tenant_id $project_id --ip_version 4 ${ALLOCATION_POOL:+--allocation-pool $ALLOCATION_POOL} --name $PROVIDER_SUBNET_NAME --gateway $NETWORK_GATEWAY $NET_ID $FIXED_RANGE | grep ' id ' | get_field 2)
+            SUBNET_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create --tenant_id $project_id --ip_version 4 ${ALLOCATION_POOL:+--allocation-pool $ALLOCATION_POOL} --name $PROVIDER_SUBNET_NAME --gateway $NETWORK_GATEWAY $NET_ID $FIXED_RANGE | grep ' id ' | get_field 2)
             die_if_not_set $LINENO SUBNET_ID "Failure creating SUBNET_ID for $PROVIDER_SUBNET_NAME $project_id"
         fi
 
         if [[ "$IP_VERSION" =~ .*6 ]] && [[ -n "$IPV6_PROVIDER_FIXED_RANGE" ]] && [[ -n "$IPV6_PROVIDER_NETWORK_GATEWAY" ]]; then
-            SUBNET_V6_ID=$(neutron subnet-create --tenant_id $project_id --ip_version 6 --ipv6-address-mode $IPV6_ADDRESS_MODE --gateway $IPV6_PROVIDER_NETWORK_GATEWAY --name $IPV6_PROVIDER_SUBNET_NAME $NET_ID $IPV6_PROVIDER_FIXED_RANGE | grep 'id' | get_field 2)
+            SUBNET_V6_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create --tenant_id $project_id --ip_version 6 --ipv6-address-mode $IPV6_ADDRESS_MODE --gateway $IPV6_PROVIDER_NETWORK_GATEWAY --name $IPV6_PROVIDER_SUBNET_NAME $NET_ID $IPV6_PROVIDER_FIXED_RANGE | grep 'id' | get_field 2)
             die_if_not_set $LINENO SUBNET_V6_ID "Failure creating SUBNET_V6_ID for $IPV6_PROVIDER_SUBNET_NAME $project_id"
         fi
 
@@ -575,7 +575,7 @@ function create_neutron_initial_network {
             sudo ip link set $PUBLIC_INTERFACE up
         fi
     else
-        NET_ID=$(neutron net-create --tenant-id $project_id "$PRIVATE_NETWORK_NAME" | grep ' id ' | get_field 2)
+        NET_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" net-create --tenant-id $project_id "$PRIVATE_NETWORK_NAME" | grep ' id ' | get_field 2)
         die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PRIVATE_NETWORK_NAME $project_id"
 
         if [[ "$IP_VERSION" =~ 4.* ]]; then
@@ -589,17 +589,17 @@ function create_neutron_initial_network {
         fi
     fi
 
-    AUTO_ALLOCATE_EXT=$(neutron ext-list | grep 'auto-allocated-topology' | get_field 1)
-    SUBNETPOOL_EXT=$(neutron ext-list | grep 'subnet_allocation' | get_field 1)
+    AUTO_ALLOCATE_EXT=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" ext-list | grep 'auto-allocated-topology' | get_field 1)
+    SUBNETPOOL_EXT=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" ext-list | grep 'subnet_allocation' | get_field 1)
     if [[ "$Q_L3_ENABLED" == "True" ]]; then
         # Create a router, and add the private subnet as one of its interfaces
         if [[ "$Q_L3_ROUTER_PER_TENANT" == "True" ]]; then
             # create a tenant-owned router.
-            ROUTER_ID=$(neutron router-create --tenant-id $project_id $Q_ROUTER_NAME | grep ' id ' | get_field 2)
+            ROUTER_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" router-create --tenant-id $project_id $Q_ROUTER_NAME | grep ' id ' | get_field 2)
             die_if_not_set $LINENO ROUTER_ID "Failure creating ROUTER_ID for $project_id $Q_ROUTER_NAME"
         else
             # Plugin only supports creating a single router, which should be admin owned.
-            ROUTER_ID=$(neutron router-create $Q_ROUTER_NAME | grep ' id ' | get_field 2)
+            ROUTER_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" router-create $Q_ROUTER_NAME | grep ' id ' | get_field 2)
             die_if_not_set $LINENO ROUTER_ID "Failure creating ROUTER_ID for $Q_ROUTER_NAME"
         fi
 
@@ -609,17 +609,17 @@ function create_neutron_initial_network {
         if [[ -n $AUTO_ALLOCATE_EXT && -n $SUBNETPOOL_EXT ]]; then
             EXTERNAL_NETWORK_FLAGS="$EXTERNAL_NETWORK_FLAGS --is-default"
             if [[ "$IP_VERSION" =~ 4.* ]]; then
-                SUBNETPOOL_V4_ID=$(neutron subnetpool-create $SUBNETPOOL_NAME --default-prefixlen $SUBNETPOOL_SIZE_V4 --pool-prefix $SUBNETPOOL_PREFIX_V4 --shared --is-default=True | grep ' id ' | get_field 2)
+                SUBNETPOOL_V4_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnetpool-create $SUBNETPOOL_NAME --default-prefixlen $SUBNETPOOL_SIZE_V4 --pool-prefix $SUBNETPOOL_PREFIX_V4 --shared --is-default=True | grep ' id ' | get_field 2)
             fi
             if [[ "$IP_VERSION" =~ .*6 ]]; then
-                SUBNETPOOL_V6_ID=$(neutron subnetpool-create $SUBNETPOOL_NAME --default-prefixlen $SUBNETPOOL_SIZE_V6 --pool-prefix $SUBNETPOOL_PREFIX_V6 --shared --is-default=True | grep ' id ' | get_field 2)
+                SUBNETPOOL_V6_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnetpool-create $SUBNETPOOL_NAME --default-prefixlen $SUBNETPOOL_SIZE_V6 --pool-prefix $SUBNETPOOL_PREFIX_V6 --shared --is-default=True | grep ' id ' | get_field 2)
             fi
         fi
         # Create an external network, and a subnet. Configure the external network as router gw
         if [ "$Q_USE_PROVIDERNET_FOR_PUBLIC" = "True" ]; then
-            EXT_NET_ID=$(neutron net-create "$PUBLIC_NETWORK_NAME" -- $EXTERNAL_NETWORK_FLAGS --provider:network_type=flat --provider:physical_network=${PUBLIC_PHYSICAL_NETWORK} | grep ' id ' | get_field 2)
+            EXT_NET_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" net-create "$PUBLIC_NETWORK_NAME" -- $EXTERNAL_NETWORK_FLAGS --provider:network_type=flat --provider:physical_network=${PUBLIC_PHYSICAL_NETWORK} | grep ' id ' | get_field 2)
         else
-            EXT_NET_ID=$(neutron net-create "$PUBLIC_NETWORK_NAME" -- $EXTERNAL_NETWORK_FLAGS | grep ' id ' | get_field 2)
+            EXT_NET_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" net-create "$PUBLIC_NETWORK_NAME" -- $EXTERNAL_NETWORK_FLAGS | grep ' id ' | get_field 2)
         fi
         die_if_not_set $LINENO EXT_NET_ID "Failure creating EXT_NET_ID for $PUBLIC_NETWORK_NAME"
 
@@ -974,6 +974,9 @@ function _configure_neutron_common {
     iniset $NEUTRON_CONF DEFAULT bind_host $Q_LISTEN_ADDRESS
     iniset $NEUTRON_CONF oslo_concurrency lock_path $DATA_DIR/neutron/lock
 
+    # NOTE(freerunner): Need to adjust Region Name for nova in multiregion installation
+    iniset $NEUTRON_CONF nova region_name $REGION_NAME
+
     # If addition config files are set, make sure their path name is set as well
     if [[ ${#Q_PLUGIN_EXTRA_CONF_FILES[@]} > 0 && $Q_PLUGIN_EXTRA_CONF_PATH == '' ]]; then
         die $LINENO "Neutron additional plugin config not set.. exiting"
@@ -1289,7 +1292,7 @@ function _neutron_create_private_subnet_v4 {
     subnet_params+="--name $PRIVATE_SUBNET_NAME "
     subnet_params+="$NET_ID $FIXED_RANGE"
     local subnet_id
-    subnet_id=$(neutron subnet-create $subnet_params | grep ' id ' | get_field 2)
+    subnet_id=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create $subnet_params | grep ' id ' | get_field 2)
     die_if_not_set $LINENO subnet_id "Failure creating private IPv4 subnet for $project_id"
     echo $subnet_id
 }
@@ -1306,7 +1309,7 @@ function _neutron_create_private_subnet_v6 {
     subnet_params+="--name $IPV6_PRIVATE_SUBNET_NAME "
     subnet_params+="$NET_ID $FIXED_RANGE_V6 $ipv6_modes"
     local ipv6_subnet_id
-    ipv6_subnet_id=$(neutron subnet-create $subnet_params | grep ' id ' | get_field 2)
+    ipv6_subnet_id=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create $subnet_params | grep ' id ' | get_field 2)
     die_if_not_set $LINENO ipv6_subnet_id "Failure creating private IPv6 subnet for $project_id"
     echo $ipv6_subnet_id
 }
@@ -1320,7 +1323,7 @@ function _neutron_create_public_subnet_v4 {
     subnet_params+="$EXT_NET_ID $FLOATING_RANGE "
     subnet_params+="-- --enable_dhcp=False"
     local id_and_ext_gw_ip
-    id_and_ext_gw_ip=$(neutron subnet-create $subnet_params | grep -e 'gateway_ip' -e ' id ')
+    id_and_ext_gw_ip=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create $subnet_params | grep -e 'gateway_ip' -e ' id ')
     die_if_not_set $LINENO id_and_ext_gw_ip "Failure creating public IPv4 subnet"
     echo $id_and_ext_gw_ip
 }
@@ -1333,14 +1336,14 @@ function _neutron_create_public_subnet_v6 {
     subnet_params+="$EXT_NET_ID $IPV6_PUBLIC_RANGE "
     subnet_params+="-- --enable_dhcp=False"
     local ipv6_id_and_ext_gw_ip
-    ipv6_id_and_ext_gw_ip=$(neutron subnet-create $subnet_params | grep -e 'gateway_ip' -e ' id ')
+    ipv6_id_and_ext_gw_ip=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create $subnet_params | grep -e 'gateway_ip' -e ' id ')
     die_if_not_set $LINENO ipv6_id_and_ext_gw_ip "Failure creating an IPv6 public subnet"
     echo $ipv6_id_and_ext_gw_ip
 }
 
 # Configure neutron router for IPv4 public access
 function _neutron_configure_router_v4 {
-    neutron router-interface-add $ROUTER_ID $SUBNET_ID
+    neutron --os-cloud devstack-admin --os-region "$REGION_NAME" router-interface-add $ROUTER_ID $SUBNET_ID
     # Create a public subnet on the external network
     local id_and_ext_gw_ip
     id_and_ext_gw_ip=$(_neutron_create_public_subnet_v4 $EXT_NET_ID)
@@ -1348,7 +1351,7 @@ function _neutron_configure_router_v4 {
     ext_gw_ip=$(echo $id_and_ext_gw_ip  | get_field 2)
     PUB_SUBNET_ID=$(echo $id_and_ext_gw_ip | get_field 5)
     # Configure the external network as the default router gateway
-    neutron router-gateway-set $ROUTER_ID $EXT_NET_ID
+    neutron --os-cloud devstack-admin --os-region "$REGION_NAME" router-gateway-set $ROUTER_ID $EXT_NET_ID
 
     # This logic is specific to using the l3-agent for layer 3
     if is_service_enabled q-l3; then
@@ -1370,7 +1373,7 @@ function _neutron_configure_router_v4 {
                 sudo ip addr add $ext_gw_ip/$cidr_len dev $ext_gw_interface
                 sudo ip link set $ext_gw_interface up
             fi
-            ROUTER_GW_IP=`neutron port-list -c fixed_ips -c device_owner | grep router_gateway | awk -F'ip_address'  '{ print $2 }' | cut -f3 -d\" | tr '\n' ' '`
+            ROUTER_GW_IP=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" port-list -c fixed_ips -c device_owner | grep router_gateway | awk -F'ip_address'  '{ print $2 }' | cut -f3 -d\" | tr '\n' ' ')
             die_if_not_set $LINENO ROUTER_GW_IP "Failure retrieving ROUTER_GW_IP"
             sudo ip route replace  $FIXED_RANGE via $ROUTER_GW_IP
         fi
@@ -1380,7 +1383,7 @@ function _neutron_configure_router_v4 {
 
 # Configure neutron router for IPv6 public access
 function _neutron_configure_router_v6 {
-    neutron router-interface-add $ROUTER_ID $IPV6_SUBNET_ID
+    neutron --os-cloud devstack-admin --os-region "$REGION_NAME" router-interface-add $ROUTER_ID $IPV6_SUBNET_ID
     # Create a public subnet on the external network
     local ipv6_id_and_ext_gw_ip
     ipv6_id_and_ext_gw_ip=$(_neutron_create_public_subnet_v6 $EXT_NET_ID)
@@ -1392,7 +1395,7 @@ function _neutron_configure_router_v6 {
     # If the external network has not already been set as the default router
     # gateway when configuring an IPv4 public subnet, do so now
     if [[ "$IP_VERSION" == "6" ]]; then
-        neutron router-gateway-set $ROUTER_ID $EXT_NET_ID
+        neutron --os-cloud devstack-admin --os-region "$REGION_NAME" router-gateway-set $ROUTER_ID $EXT_NET_ID
     fi
 
     # This logic is specific to using the l3-agent for layer 3
@@ -1401,7 +1404,7 @@ function _neutron_configure_router_v6 {
         sudo sysctl -w net.ipv6.conf.all.forwarding=1
         # Configure and enable public bridge
         # Override global IPV6_ROUTER_GW_IP with the true value from neutron
-        IPV6_ROUTER_GW_IP=`neutron port-list -c fixed_ips | grep $ipv6_pub_subnet_id | awk -F'ip_address' '{ print $2 }' | cut -f3 -d\" | tr '\n' ' '`
+        IPV6_ROUTER_GW_IP=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" port-list -c fixed_ips | grep $ipv6_pub_subnet_id | awk -F'ip_address' '{ print $2 }' | cut -f3 -d\" | tr '\n' ' ')
         die_if_not_set $LINENO IPV6_ROUTER_GW_IP "Failure retrieving IPV6_ROUTER_GW_IP"
 
         if is_neutron_ovs_base_plugin; then
@@ -1466,7 +1469,7 @@ function teardown_neutron_debug {
 }
 
 function _get_net_id {
-    neutron --os-tenant-name admin --os-username admin --os-password $ADMIN_PASSWORD net-list | grep $1 | awk '{print $2}'
+    neutron --os-cloud devstack-admin --os-region "$REGION_NAME" --os-tenant-name admin --os-username admin --os-password $ADMIN_PASSWORD net-list | grep $1 | awk '{print $2}'
 }
 
 function _get_probe_cmd_prefix {
diff --git a/lib/nova b/lib/nova
index 818ecc4f1b..3a1fd339f5 100644
--- a/lib/nova
+++ b/lib/nova
@@ -935,21 +935,21 @@ function stop_nova {
 # create_instance_types(): Create default flavors
 function create_flavors {
     if is_service_enabled n-api; then
-        if ! openstack flavor list | grep -q ds512M; then
+        if ! openstack --os-region-name="$REGION_NAME" flavor list | grep -q ds512M; then
             # Note that danms hates these flavors and apologizes for sdague
-            openstack flavor create --id c1 --ram 256 --disk 0 --vcpus 1 cirros256
-            openstack flavor create --id d1 --ram 512 --disk 5 --vcpus 1 ds512M
-            openstack flavor create --id d2 --ram 1024 --disk 10 --vcpus 1 ds1G
-            openstack flavor create --id d3 --ram 2048 --disk 10 --vcpus 2 ds2G
-            openstack flavor create --id d4 --ram 4096 --disk 20 --vcpus 4 ds4G
+            openstack --os-region-name="$REGION_NAME" flavor create --id c1 --ram 256 --disk 0 --vcpus 1 cirros256
+            openstack --os-region-name="$REGION_NAME" flavor create --id d1 --ram 512 --disk 5 --vcpus 1 ds512M
+            openstack --os-region-name="$REGION_NAME" flavor create --id d2 --ram 1024 --disk 10 --vcpus 1 ds1G
+            openstack --os-region-name="$REGION_NAME" flavor create --id d3 --ram 2048 --disk 10 --vcpus 2 ds2G
+            openstack --os-region-name="$REGION_NAME" flavor create --id d4 --ram 4096 --disk 20 --vcpus 4 ds4G
         fi
 
-        if ! openstack flavor list | grep -q m1.tiny; then
-            openstack flavor create --id 1 --ram 512 --disk 1 --vcpus 1 m1.tiny
-            openstack flavor create --id 2 --ram 2048 --disk 20 --vcpus 1 m1.small
-            openstack flavor create --id 3 --ram 4096 --disk 40 --vcpus 2 m1.medium
-            openstack flavor create --id 4 --ram 8192 --disk 80 --vcpus 4 m1.large
-            openstack flavor create --id 5 --ram 16384 --disk 160 --vcpus 8 m1.xlarge
+        if ! openstack --os-region-name="$REGION_NAME" flavor list | grep -q m1.tiny; then
+            openstack --os-region-name="$REGION_NAME" flavor create --id 1 --ram 512 --disk 1 --vcpus 1 m1.tiny
+            openstack --os-region-name="$REGION_NAME" flavor create --id 2 --ram 2048 --disk 20 --vcpus 1 m1.small
+            openstack --os-region-name="$REGION_NAME" flavor create --id 3 --ram 4096 --disk 40 --vcpus 2 m1.medium
+            openstack --os-region-name="$REGION_NAME" flavor create --id 4 --ram 8192 --disk 80 --vcpus 4 m1.large
+            openstack --os-region-name="$REGION_NAME" flavor create --id 5 --ram 16384 --disk 160 --vcpus 8 m1.xlarge
         fi
     fi
 }

From 1a791cbc449a3cfdbc3d3b94c6cda3ddefa17af4 Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Thu, 28 Apr 2016 12:39:26 -0700
Subject: [PATCH 0408/2409] Remove vpnaas code from devstack

This service is now configured by devstack plugin in master.

Change-Id: Ie5fc0d2a45c1b564f98c69ec9ea6fbdeeb465d32
---
 lib/neutron-legacy               | 56 ------------------------------
 lib/neutron_plugins/services/vpn | 58 --------------------------------
 stackrc                          |  4 ---
 3 files changed, 118 deletions(-)
 delete mode 100644 lib/neutron_plugins/services/vpn

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index f0592e2f37..0d6141680e 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -108,7 +108,6 @@ GITDIR["python-neutronclient"]=$DEST/python-neutronclient
 NEUTRON_DIR=$DEST/neutron
 NEUTRON_FWAAS_DIR=$DEST/neutron-fwaas
 NEUTRON_LBAAS_DIR=$DEST/neutron-lbaas
-NEUTRON_VPNAAS_DIR=$DEST/neutron-vpnaas
 NEUTRON_AUTH_CACHE_DIR=${NEUTRON_AUTH_CACHE_DIR:-/var/cache/neutron}
 
 # Support entry points installation of console scripts
@@ -125,9 +124,6 @@ export NEUTRON_TEST_CONFIG_FILE=${NEUTRON_TEST_CONFIG_FILE:-"$NEUTRON_CONF_DIR/d
 # Default provider for load balancer service
 DEFAULT_LB_PROVIDER=LOADBALANCER:Haproxy:neutron_lbaas.services.loadbalancer.drivers.haproxy.plugin_driver.HaproxyOnHostPluginDriver:default
 
-# Default provider for VPN service
-DEFAULT_VPN_PROVIDER=VPN:openswan:neutron_vpnaas.services.vpn.service_drivers.ipsec.IPsecVPNDriver:default
-
 # Agent binaries.  Note, binary paths for other agents are set in per-service
 # scripts in lib/neutron_plugins/services/
 AGENT_DHCP_BINARY="$NEUTRON_BIN_DIR/neutron-dhcp-agent"
@@ -139,7 +135,6 @@ AGENT_META_BINARY="$NEUTRON_BIN_DIR/neutron-metadata-agent"
 Q_DHCP_CONF_FILE=$NEUTRON_CONF_DIR/dhcp_agent.ini
 Q_L3_CONF_FILE=$NEUTRON_CONF_DIR/l3_agent.ini
 Q_FWAAS_CONF_FILE=$NEUTRON_CONF_DIR/fwaas_driver.ini
-Q_VPN_CONF_FILE=$NEUTRON_CONF_DIR/vpn_agent.ini
 Q_META_CONF_FILE=$NEUTRON_CONF_DIR/metadata_agent.ini
 
 # Default name for Neutron database
@@ -231,10 +226,6 @@ Q_L3_ROUTER_PER_TENANT=${Q_L3_ROUTER_PER_TENANT:-True}
 # See _configure_neutron_common() for details about setting it up
 declare -a Q_PLUGIN_EXTRA_CONF_FILES
 
-# List of (optional) config files for VPN device drivers to use with
-# the neutron-q-vpn agent
-declare -a Q_VPN_EXTRA_CONF_FILES
-
 
 Q_RR_CONF_FILE=$NEUTRON_CONF_DIR/rootwrap.conf
 if [[ "$Q_USE_ROOTWRAP" == "False" ]]; then
@@ -359,11 +350,6 @@ source $TOP_DIR/lib/neutron_plugins/services/loadbalancer
 # Hardcoding for 1 service plugin for now
 source $TOP_DIR/lib/neutron_plugins/services/metering
 
-# VPN service plugin functions
-# -------------------------------------------
-# Hardcoding for 1 service plugin for now
-source $TOP_DIR/lib/neutron_plugins/services/vpn
-
 # Firewall Service Plugin functions
 # ---------------------------------
 source $TOP_DIR/lib/neutron_plugins/services/firewall
@@ -392,19 +378,6 @@ function _determine_config_server {
     echo "$opts"
 }
 
-function _determine_config_vpn {
-    local cfg_file
-    local opts="--config-file $NEUTRON_CONF --config-file=$Q_L3_CONF_FILE --config-file=$Q_VPN_CONF_FILE"
-    if is_service_enabled q-fwaas; then
-        opts+=" --config-file $Q_FWAAS_CONF_FILE"
-    fi
-    for cfg_file in ${Q_VPN_EXTRA_CONF_FILES[@]}; do
-        opts+=" --config-file $cfg_file"
-    done
-    echo "$opts"
-
-}
-
 function _determine_config_l3 {
     local opts="--config-file $NEUTRON_CONF --config-file=$Q_L3_CONF_FILE"
     if is_service_enabled q-fwaas; then
@@ -419,7 +392,6 @@ function determine_config_files {
     local opts=""
     case "$1" in
         "neutron-server") opts="$(_determine_config_server)" ;;
-        "neutron-vpn-agent") opts="$(_determine_config_vpn)" ;;
         "neutron-l3-agent") opts="$(_determine_config_l3)" ;;
     esac
     if [ -z "$opts" ] ; then
@@ -449,10 +421,6 @@ function configure_neutron {
     if is_service_enabled q-metering; then
         _configure_neutron_metering
     fi
-    if is_service_enabled q-vpn; then
-        deprecated "Configuring q-vpn through devstack is deprecated"
-        _configure_neutron_vpn
-    fi
     if is_service_enabled q-fwaas; then
         deprecated "Configuring q-fwaas through devstack is deprecated"
         _configure_neutron_fwaas
@@ -661,10 +629,6 @@ function install_neutron {
         git_clone $NEUTRON_LBAAS_REPO $NEUTRON_LBAAS_DIR $NEUTRON_LBAAS_BRANCH
         setup_develop $NEUTRON_LBAAS_DIR
     fi
-    if is_service_enabled q-vpn; then
-        git_clone $NEUTRON_VPNAAS_REPO $NEUTRON_VPNAAS_DIR $NEUTRON_VPNAAS_BRANCH
-        setup_develop $NEUTRON_VPNAAS_DIR
-    fi
 
     if [ "$VIRT_DRIVER" == 'xenserver' ]; then
         local dom0_ip
@@ -763,8 +727,6 @@ function start_neutron_other_agents {
 
     if is_service_enabled neutron-vpnaas; then
         :  # Started by plugin
-    elif is_service_enabled q-vpn; then
-        run_process q-vpn "$AGENT_VPN_BINARY $(determine_config_files neutron-vpn-agent)"
     else
         run_process q-l3 "$AGENT_L3_BINARY $(determine_config_files neutron-l3-agent)"
     fi
@@ -815,9 +777,6 @@ function stop_neutron_other {
     if is_service_enabled q-fwaas; then
         neutron_fwaas_stop
     fi
-    if is_service_enabled q-vpn; then
-        neutron_vpn_stop
-    fi
     if is_service_enabled q-metering; then
         neutron_metering_stop
     fi
@@ -1072,10 +1031,6 @@ function _configure_neutron_dhcp_agent {
 function _configure_neutron_l3_agent {
     Q_L3_ENABLED=True
 
-    if is_service_enabled q-vpn; then
-        neutron_vpn_configure_agent
-    fi
-
     cp $NEUTRON_DIR/etc/l3_agent.ini.sample $Q_L3_CONF_FILE
 
     iniset $Q_L3_CONF_FILE DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
@@ -1135,17 +1090,6 @@ function _configure_neutron_fwaas {
     neutron_fwaas_configure_driver
 }
 
-function _configure_neutron_vpn {
-    # Uses oslo config generator to generate VPNaaS sample configuration files
-    (cd $NEUTRON_VPNAAS_DIR && exec ./tools/generate_config_file_samples.sh)
-    if [ -f $NEUTRON_VPNAAS_DIR/etc/neutron_vpnaas.conf.sample ]; then
-        cp $NEUTRON_VPNAAS_DIR/etc/neutron_vpnaas.conf.sample $NEUTRON_CONF_DIR/neutron_vpnaas.conf
-        iniset $NEUTRON_CONF_DIR/neutron_vpnaas.conf service_providers service_provider $DEFAULT_VPN_PROVIDER
-    fi
-    neutron_vpn_install_agent_packages
-    neutron_vpn_configure_common
-}
-
 function _configure_dvr {
     iniset $NEUTRON_CONF DEFAULT router_distributed True
     iniset $Q_L3_CONF_FILE DEFAULT agent_mode $Q_DVR_MODE
diff --git a/lib/neutron_plugins/services/vpn b/lib/neutron_plugins/services/vpn
deleted file mode 100644
index e790913847..0000000000
--- a/lib/neutron_plugins/services/vpn
+++ /dev/null
@@ -1,58 +0,0 @@
-#!/bin/bash
-
-# Neutron VPN plugin
-# ---------------------------
-
-# Save trace setting
-_XTRACE_NEUTRON_VPN=$(set +o | grep xtrace)
-set +o xtrace
-
-
-AGENT_VPN_BINARY="$NEUTRON_BIN_DIR/neutron-vpn-agent"
-VPN_PLUGIN=${VPN_PLUGIN:-"neutron_vpnaas.services.vpn.plugin.VPNDriverPlugin"}
-IPSEC_PACKAGE=${IPSEC_PACKAGE:-"openswan"}
-
-function neutron_vpn_install_agent_packages {
-    install_package $IPSEC_PACKAGE
-    if is_ubuntu && [[ "$IPSEC_PACKAGE" == "strongswan" ]]; then
-        sudo ln -sf /etc/apparmor.d/usr.lib.ipsec.charon /etc/apparmor.d/disable/
-        sudo ln -sf /etc/apparmor.d/usr.lib.ipsec.stroke /etc/apparmor.d/disable/
-        # NOTE: Due to https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1387220
-        # one must use 'sudo start apparmor ACTION=reload' for Ubuntu 14.10
-        restart_service apparmor
-    fi
-}
-
-function neutron_vpn_configure_common {
-    _neutron_service_plugin_class_add $VPN_PLUGIN
-    _neutron_deploy_rootwrap_filters $NEUTRON_VPNAAS_DIR
-}
-
-function neutron_vpn_configure_agent {
-    # Uses oslo config generator to generate LBaaS sample configuration files
-    (cd $NEUTRON_VPNAAS_DIR && exec ./tools/generate_config_file_samples.sh)
-    cp $NEUTRON_VPNAAS_DIR/etc/vpn_agent.ini.sample $Q_VPN_CONF_FILE
-    if [[ "$IPSEC_PACKAGE" == "strongswan" ]]; then
-        iniset_multiline $Q_VPN_CONF_FILE vpnagent vpn_device_driver neutron_vpnaas.services.vpn.device_drivers.strongswan_ipsec.StrongSwanDriver
-        if is_fedora; then
-            iniset $Q_VPN_CONF_FILE strongswan default_config_area /usr/share/strongswan/templates/config/strongswan.d
-        fi
-    else
-        iniset_multiline $Q_VPN_CONF_FILE vpnagent vpn_device_driver neutron_vpnaas.services.vpn.device_drivers.ipsec.OpenSwanDriver
-    fi
-}
-
-function neutron_vpn_stop {
-    local ipsec_data_dir=$DATA_DIR/neutron/ipsec
-    local pids
-    if [ -d $ipsec_data_dir ]; then
-        pids=$(find $ipsec_data_dir -name 'pluto.pid' -exec cat {} \;)
-    fi
-    if [ -n "$pids" ]; then
-        sudo kill $pids
-    fi
-    stop_process q-vpn
-}
-
-# Restore xtrace
-$_XTRACE_NEUTRON_VPN
diff --git a/stackrc b/stackrc
index 8858788840..44aa79fbe6 100644
--- a/stackrc
+++ b/stackrc
@@ -248,10 +248,6 @@ NEUTRON_FWAAS_BRANCH=${NEUTRON_FWAAS_BRANCH:-master}
 NEUTRON_LBAAS_REPO=${NEUTRON_LBAAS_REPO:-${GIT_BASE}/openstack/neutron-lbaas.git}
 NEUTRON_LBAAS_BRANCH=${NEUTRON_LBAAS_BRANCH:-master}
 
-# neutron vpnaas service
-NEUTRON_VPNAAS_REPO=${NEUTRON_VPNAAS_REPO:-${GIT_BASE}/openstack/neutron-vpnaas.git}
-NEUTRON_VPNAAS_BRANCH=${NEUTRON_VPNAAS_BRANCH:-master}
-
 # compute service
 NOVA_REPO=${NOVA_REPO:-${GIT_BASE}/openstack/nova.git}
 NOVA_BRANCH=${NOVA_BRANCH:-master}

From 13b3be10a754c0e0f9fb31ce824d5f2d9cc905de Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Sat, 30 Apr 2016 06:51:53 +0000
Subject: [PATCH 0409/2409] Updated from generate-devstack-plugins-list

Change-Id: I5fdf1e4a7bb0fbb9fa9b3ca96f42b87bd7f38d0d
---
 doc/source/plugin-registry.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 835d043af1..a2721b4172 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -86,6 +86,7 @@ networking-mlnx                        `git://git.openstack.org/openstack/networ
 networking-nec                         `git://git.openstack.org/openstack/networking-nec <https://git.openstack.org/cgit/openstack/networking-nec>`__
 networking-odl                         `git://git.openstack.org/openstack/networking-odl <https://git.openstack.org/cgit/openstack/networking-odl>`__
 networking-ofagent                     `git://git.openstack.org/openstack/networking-ofagent <https://git.openstack.org/cgit/openstack/networking-ofagent>`__
+networking-onos                        `git://git.openstack.org/openstack/networking-onos <https://git.openstack.org/cgit/openstack/networking-onos>`__
 networking-ovn                         `git://git.openstack.org/openstack/networking-ovn <https://git.openstack.org/cgit/openstack/networking-ovn>`__
 networking-ovs-dpdk                    `git://git.openstack.org/openstack/networking-ovs-dpdk <https://git.openstack.org/cgit/openstack/networking-ovs-dpdk>`__
 networking-plumgrid                    `git://git.openstack.org/openstack/networking-plumgrid <https://git.openstack.org/cgit/openstack/networking-plumgrid>`__
@@ -93,7 +94,6 @@ networking-powervm                     `git://git.openstack.org/openstack/networ
 networking-sfc                         `git://git.openstack.org/openstack/networking-sfc <https://git.openstack.org/cgit/openstack/networking-sfc>`__
 networking-vsphere                     `git://git.openstack.org/openstack/networking-vsphere <https://git.openstack.org/cgit/openstack/networking-vsphere>`__
 neutron                                `git://git.openstack.org/openstack/neutron <https://git.openstack.org/cgit/openstack/neutron>`__
-neutron-dynamic-routing                `git://git.openstack.org/openstack/neutron-dynamic-routing <https://git.openstack.org/cgit/openstack/neutron-dynamic-routing>`__
 neutron-lbaas                          `git://git.openstack.org/openstack/neutron-lbaas <https://git.openstack.org/cgit/openstack/neutron-lbaas>`__
 neutron-lbaas-dashboard                `git://git.openstack.org/openstack/neutron-lbaas-dashboard <https://git.openstack.org/cgit/openstack/neutron-lbaas-dashboard>`__
 neutron-vpnaas                         `git://git.openstack.org/openstack/neutron-vpnaas <https://git.openstack.org/cgit/openstack/neutron-vpnaas>`__

From aac43e1e71dd27fa7955f0385a67a91916676fee Mon Sep 17 00:00:00 2001
From: Sachin Patil <psachin@redhat.com>
Date: Sat, 30 Apr 2016 14:01:38 +0530
Subject: [PATCH 0410/2409] Suppressed echoing of the line.

I think the objective of the line is to display message, but it was
also echoing entire line before printing the message.

Change-Id: I758759638003deec3205983863f4b7e23ba94e89
Signed-off-by: Sachin Patil <psachin@redhat.com>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index a94d60a0ef..970d8009eb 100644
--- a/Makefile
+++ b/Makefile
@@ -15,7 +15,7 @@
 DEST=/opt/stack
 
 all:
-	echo "This just saved you from a terrible mistake!"
+	@echo "This just saved you from a terrible mistake!"
 
 # Do Some Work
 stack:

From 269704c119940fbbc18e275396770e1e591350f0 Mon Sep 17 00:00:00 2001
From: Ken'ichi Ohmichi <ken-oomichi@wx.jp.nec.com>
Date: Sun, 1 May 2016 07:22:34 -0700
Subject: [PATCH 0411/2409] Remove NOVA_V2_LEGACY option

There are two implementation code for similar API in Nova repository.
One is newer: v2.1 API, another is legacy: v2 API. v2.1 API has been
used as the default API since Liberty and legacy v2 API has been marked
as deprecated. We have used and tested v2.1 API so well and now is
nice time to remove legacy API code based on the consensus of the
design summit of Austin.
This patch removes NOVA_V2_LEGACY which set up legacy API code.

NOTE: The gate job which uses this NOVA_V2_LEGACY option has been
      removed already since Iac81b7d569b76b99e9d86eaa5001ae7f9b78cdfe.

Partially implements blueprint remove-legacy-v2-api-code

Change-Id: I0e16b7ce608d7eeb3a35fd77e66531dfc8c142ef
---
 lib/nova | 12 ------------
 1 file changed, 12 deletions(-)

diff --git a/lib/nova b/lib/nova
index 818ecc4f1b..7c145f8be5 100644
--- a/lib/nova
+++ b/lib/nova
@@ -59,11 +59,6 @@ NOVA_API_DB=${NOVA_API_DB:-nova_api}
 
 NOVA_API_PASTE_INI=${NOVA_API_PASTE_INI:-$NOVA_CONF_DIR/api-paste.ini}
 
-# NOVA_V2_LEGACY defines whether we force the Nova v2.0 enpoint onto
-# the Nova v2.0 legacy code base. Remove this option once the Nova
-# v2.0 legacy codebase is removed.
-NOVA_V2_LEGACY=$(trueorfalse False NOVA_V2_LEGACY)
-
 if is_suse; then
     NOVA_WSGI_DIR=${NOVA_WSGI_DIR:-/srv/www/htdocs/nova}
 else
@@ -311,13 +306,6 @@ function configure_nova {
     if [[ "$ENABLED_SERVICES" =~ "n-api" ]]; then
         # Get the sample configuration file in place
         cp $NOVA_DIR/etc/nova/api-paste.ini $NOVA_CONF_DIR
-
-        # For setting up an environment where v2.0 is running on the
-        # v2.0 legacy code base.
-        if [[ "$NOVA_V2_LEGACY" == "True" ]]; then
-            sed -i s@"^/v2: openstack_compute_api_v21_legacy_v2_compatible$"@"/v2: openstack_compute_api_legacy_v2"@ \
-                "$NOVA_API_PASTE_INI"
-        fi
     fi
 
     if is_service_enabled n-cpu; then

From a046b6052a340b24063be3dc851fa4bbb51d6c00 Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Mon, 2 May 2016 11:59:52 +0200
Subject: [PATCH 0412/2409] Remove tempest-lib setup

Tempest-lib, as a standalone project, is deprecated in favor of a
"lib/" directory inside Tempest's repo. So remove the installation
of tempest-lib in DevStack.

Change-Id: I507bfe875777fd25bbe5d67c861f3fca99faa22d
---
 lib/tempest                  | 17 -----------------
 stackrc                      |  4 ----
 tests/test_libs_from_pypi.sh |  2 +-
 3 files changed, 1 insertion(+), 22 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 46dc1f8d42..6ba04f1680 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -45,8 +45,6 @@ set +o xtrace
 # --------
 
 # Set up default directories
-GITDIR["tempest-lib"]=$DEST/tempest-lib
-
 TEMPEST_DIR=$DEST/tempest
 TEMPEST_CONFIG_DIR=${TEMPEST_CONFIG_DIR:-$TEMPEST_DIR/etc}
 TEMPEST_CONFIG=$TEMPEST_CONFIG_DIR/tempest.conf
@@ -587,20 +585,6 @@ function configure_tempest {
     IFS=$ifs
 }
 
-
-# install_tempest_lib() - Collect source, prepare, and install ``tempest-lib``
-function install_tempest_lib {
-    if use_library_from_git "tempest-lib"; then
-        git_clone_by_name "tempest-lib"
-        setup_dev_lib "tempest-lib"
-        # NOTE(mtreinish) For testing ``tempest-lib`` from git with Tempest we need to
-        # put the git version of ``tempest-lib`` in the Tempest job's tox venv
-        export PIP_VIRTUAL_ENV=${PROJECT_VENV["tempest"]}
-        setup_dev_lib "tempest-lib"
-        unset PIP_VIRTUAL_ENV
-    fi
-}
-
 # install_tempest() - Collect source and prepare
 function install_tempest {
     git_clone $TEMPEST_REPO $TEMPEST_DIR $TEMPEST_BRANCH
@@ -612,7 +596,6 @@ function install_tempest {
     # running pip install -U on tempest requirements
     $TEMPEST_DIR/.tox/full/bin/pip install -c $REQUIREMENTS_DIR/upper-constraints.txt -r requirements.txt
     PROJECT_VENV["tempest"]=${TEMPEST_DIR}/.tox/full
-    install_tempest_lib
     popd
 }
 
diff --git a/stackrc b/stackrc
index 44aa79fbe6..4ba57c9cb6 100644
--- a/stackrc
+++ b/stackrc
@@ -270,10 +270,6 @@ REQUIREMENTS_BRANCH=${REQUIREMENTS_BRANCH:-master}
 TEMPEST_REPO=${TEMPEST_REPO:-${GIT_BASE}/openstack/tempest.git}
 TEMPEST_BRANCH=${TEMPEST_BRANCH:-master}
 
-# TODO(sdague): this should end up as a library component like below
-GITREPO["tempest-lib"]=${TEMPEST_LIB_REPO:-${GIT_BASE}/openstack/tempest-lib.git}
-GITBRANCH["tempest-lib"]=${TEMPEST_LIB_BRANCH:-master}
-
 
 ##############
 #
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index f01db6df1d..a979c346b8 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -31,7 +31,7 @@ done
 
 ALL_LIBS="python-novaclient oslo.config pbr oslo.context"
 ALL_LIBS+=" python-keystoneclient taskflow oslo.middleware pycadf"
-ALL_LIBS+=" python-glanceclient python-ironicclient tempest-lib"
+ALL_LIBS+=" python-glanceclient python-ironicclient"
 ALL_LIBS+=" oslo.messaging oslo.log cliff python-heatclient stevedore"
 ALL_LIBS+=" python-cinderclient glance_store oslo.concurrency oslo.db"
 ALL_LIBS+=" oslo.versionedobjects oslo.vmware keystonemiddleware"

From 841fdafa0bc542b595b267428c5d929bf0726205 Mon Sep 17 00:00:00 2001
From: Brant Knudson <bknudson@us.ibm.com>
Date: Sun, 21 Jun 2015 10:08:22 -0500
Subject: [PATCH 0413/2409] Use path-mounted keystone when running in httpd

When running in httpd, keystone accepts requests on /identity and
/identity_v2_admin.

The path endpoints should be preferred over the ports so keystone
is configured to point applications to the path endpoints by
setting admin_endpoint and public_endpoint.

Change-Id: I34569b9e03c3f36748c92d803349e22a7ee1a633
---
 files/apache-keystone.template |  4 ++--
 lib/keystone                   | 31 ++++++++++++++++++++++++++-----
 2 files changed, 28 insertions(+), 7 deletions(-)

diff --git a/files/apache-keystone.template b/files/apache-keystone.template
index 428544f25c..8a4b0f0c43 100644
--- a/files/apache-keystone.template
+++ b/files/apache-keystone.template
@@ -44,8 +44,8 @@ Alias /identity %KEYSTONE_BIN%/keystone-wsgi-public
     WSGIPassAuthorization On
 </Location>
 
-Alias /identity_admin %KEYSTONE_BIN%/keystone-wsgi-admin
-<Location /identity_admin>
+Alias /identity_v2_admin %KEYSTONE_BIN%/keystone-wsgi-admin
+<Location /identity_v2_admin>
     SetHandler wsgi-script
     Options +ExecCGI
 
diff --git a/lib/keystone b/lib/keystone
index bcd5fab40c..1305623cb9 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -122,8 +122,14 @@ if is_ssl_enabled_service "key" || is_service_enabled tls-proxy; then
 fi
 
 # complete URIs
-KEYSTONE_AUTH_URI=${KEYSTONE_AUTH_PROTOCOL}://${KEYSTONE_AUTH_HOST}:${KEYSTONE_AUTH_PORT}
-KEYSTONE_SERVICE_URI=${KEYSTONE_SERVICE_PROTOCOL}://${KEYSTONE_SERVICE_HOST}:${KEYSTONE_SERVICE_PORT}
+if [ "$KEYSTONE_DEPLOY" == "mod_wsgi" ]; then
+    # If running in Apache, use path access rather than port.
+    KEYSTONE_AUTH_URI=${KEYSTONE_AUTH_PROTOCOL}://${KEYSTONE_AUTH_HOST}/identity_v2_admin
+    KEYSTONE_SERVICE_URI=${KEYSTONE_SERVICE_PROTOCOL}://${KEYSTONE_SERVICE_HOST}/identity
+else
+    KEYSTONE_AUTH_URI=${KEYSTONE_AUTH_PROTOCOL}://${KEYSTONE_AUTH_HOST}:${KEYSTONE_AUTH_PORT}
+    KEYSTONE_SERVICE_URI=${KEYSTONE_SERVICE_PROTOCOL}://${KEYSTONE_SERVICE_HOST}:${KEYSTONE_SERVICE_PORT}
+fi
 
 # V3 URIs
 KEYSTONE_AUTH_URI_V3=$KEYSTONE_AUTH_URI/v3
@@ -259,7 +265,15 @@ function configure_keystone {
         # Set the service ports for a proxy to take the originals
         service_port=$KEYSTONE_SERVICE_PORT_INT
         auth_port=$KEYSTONE_AUTH_PORT_INT
+    fi
 
+    # Override the endpoints advertised by keystone (the public_endpoint and
+    # admin_endpoint) so that clients use the correct endpoint. By default, the
+    # keystone server uses the public_port and admin_port which isn't going to
+    # work when you want to use a different port (in the case of proxy), or you
+    # don't want the port (in the case of putting keystone on a path in
+    # apache).
+    if is_service_enabled tls-proxy || [ "$KEYSTONE_DEPLOY" == "mod_wsgi" ]; then
         iniset $KEYSTONE_CONF DEFAULT public_endpoint $KEYSTONE_SERVICE_URI
         iniset $KEYSTONE_CONF DEFAULT admin_endpoint $KEYSTONE_AUTH_URI
     fi
@@ -582,7 +596,14 @@ function start_keystone {
     # Check that the keystone service is running. Even if the tls tunnel
     # should be enabled, make sure the internal port is checked using
     # unencryted traffic at this point.
-    if ! wait_for_service $SERVICE_TIMEOUT $auth_protocol://$KEYSTONE_SERVICE_HOST:$service_port/v$IDENTITY_API_VERSION/; then
+    # If running in Apache, use the path rather than port.
+
+    local service_uri=$auth_protocol://$KEYSTONE_SERVICE_HOST:$service_port/v$IDENTITY_API_VERSION/
+    if [ "$KEYSTONE_DEPLOY" == "mod_wsgi" ]; then
+        service_uri=$auth_protocol://$KEYSTONE_SERVICE_HOST/identity/v$IDENTITY_API_VERSION/
+    fi
+
+    if ! wait_for_service $SERVICE_TIMEOUT $service_uri; then
         die $LINENO "keystone did not start"
     fi
 
@@ -625,8 +646,8 @@ function bootstrap_keystone {
         --bootstrap-service-name keystone \
         --bootstrap-region-id "$REGION_NAME" \
         --bootstrap-admin-url "$KEYSTONE_AUTH_URI" \
-        --bootstrap-public-url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT" \
-        --bootstrap-internal-url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT"
+        --bootstrap-public-url "$KEYSTONE_SERVICE_URI" \
+        --bootstrap-internal-url "$KEYSTONE_SERVICE_URI"
 }
 
 # Restore xtrace

From d1c9198bbe0e90717a9e70c662b806841bc82564 Mon Sep 17 00:00:00 2001
From: Rabi Mishra <ramishra@redhat.com>
Date: Wed, 4 May 2016 16:09:47 +0530
Subject: [PATCH 0414/2409] Change the domain name in keystone.conf

As we are creating a domain with id 'default' and name
'Default', we should iniset the correct name.

Change-Id: If67338fbbd255b8aa1b91e18e4cf8213baebab95
---
 lib/keystone | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/keystone b/lib/keystone
index bcd5fab40c..3c003483f7 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -334,7 +334,7 @@ function configure_keystone {
     # Configure the project created by the 'keystone-manage bootstrap' as the cloud-admin project.
     # The users from this project are globally admin as before, but it also
     # allows policy changes in order to clarify the adminess scope.
-    iniset $KEYSTONE_CONF resource admin_project_domain_name default
+    iniset $KEYSTONE_CONF resource admin_project_domain_name Default
     iniset $KEYSTONE_CONF resource admin_project_name admin
 }
 

From 5069b8d8942ddd591d80586acd71bc6ee6de1262 Mon Sep 17 00:00:00 2001
From: pratik-gadiya <pgadiya@redhat.com>
Date: Wed, 4 May 2016 07:33:21 -0400
Subject: [PATCH 0415/2409] Added fix to install zookeeper for fedora

Partially Implements: #1513855

Change-Id: Ic302461f38d76183b75cc8de0a25fa84a8a8ff69
---
 lib/dlm | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/dlm b/lib/dlm
index 74eb67ee8f..e391535910 100644
--- a/lib/dlm
+++ b/lib/dlm
@@ -93,6 +93,8 @@ function install_dlm {
     if is_dlm_enabled; then
         if is_ubuntu; then
             install_package zookeeperd
+        elif is_fedora; then
+            install_package zookeeper
         else
             die $LINENO "Don't know how to install zookeeper on this platform"
         fi

From b31640af5ef46e00e9cb0d2cffb22a043998eb31 Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Mon, 2 May 2016 16:33:29 -0400
Subject: [PATCH 0416/2409] Handle common and seperate tempest tox venvs

In order to support the effort to unify the tox venvs being created
by tempest this commit temporarily cases the path of the venv being
created. Once tempest is updated to only use .tox/tempest we can
remove the if blocks and just use it unconditionally.

Change-Id: I34a69020eee07156e64026781a3c0bffdb5ab415
---
 lib/tempest | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 6ba04f1680..3164de6638 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -594,8 +594,13 @@ function install_tempest {
     # NOTE(mtreinish) Respect constraints in the tempest full venv, things that
     # are using a tox job other than full will not be respecting constraints but
     # running pip install -U on tempest requirements
-    $TEMPEST_DIR/.tox/full/bin/pip install -c $REQUIREMENTS_DIR/upper-constraints.txt -r requirements.txt
-    PROJECT_VENV["tempest"]=${TEMPEST_DIR}/.tox/full
+    if [[ -d .tox/tempest ]] ; then
+        $TEMPEST_DIR/.tox/tempest/bin/pip install -c $REQUIREMENTS_DIR/upper-constraints.txt -r requirements.txt
+        PROJECT_VENV["tempest"]=${TEMPEST_DIR}/.tox/tempest
+    else
+        $TEMPEST_DIR/.tox/full/bin/pip install -c $REQUIREMENTS_DIR/upper-constraints.txt -r requirements.txt
+        PROJECT_VENV["tempest"]=${TEMPEST_DIR}/.tox/full
+    fi
     popd
 }
 

From 440464ccbbaf33e4687bd9fece5e1de64542f263 Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Wed, 4 May 2016 11:55:12 -0400
Subject: [PATCH 0417/2409] Use common tempest tox venv and add plugin install
 variable

This commit adds a new variable to lib/tempest to provide the plugins
that should be installed into common tox venv that gets created. In
order to make this work the workarounds to handle migrating to a common
tox venv have to be removed otherwise the plugins could be installed in
a venv that isn't used.

Change-Id: I63658b8d8dfa999e0feb79f8f2968f2b32e3ff57
Depends-On: Iab2e6e04b6c5795a4d0c8214564106525b942308
---
 lib/tempest | 22 ++++++++++++----------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 3164de6638..2a99a13eef 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -64,6 +64,10 @@ BUILD_TIMEOUT=${BUILD_TIMEOUT:-196}
 # have tempest installed in DevStack by default.
 INSTALL_TEMPEST=${INSTALL_TEMPEST:-"True"}
 
+# This variable is passed directly to pip install inside the common tox venv
+# that is created
+TEMPEST_PLUGINS=${TEMPEST_PLUGINS:-0}
+
 # Cinder/Volume variables
 TEMPEST_VOLUME_DRIVER=${TEMPEST_VOLUME_DRIVER:-default}
 TEMPEST_DEFAULT_VOLUME_VENDOR="Open Source"
@@ -519,17 +523,17 @@ function configure_tempest {
     tmp_cfg_file=$(mktemp)
     cd $TEMPEST_DIR
     if [[ "$OFFLINE" != "True" ]]; then
-        tox -revenv --notest
+        tox -revenv-tempest --notest
     fi
-    tox -evenv -- pip install -c $REQUIREMENTS_DIR/upper-constraints.txt -r requirements.txt
+    tox -evenv-tempest -- pip install -c $REQUIREMENTS_DIR/upper-constraints.txt -r requirements.txt
 
     # Auth:
     iniset $TEMPEST_CONFIG auth tempest_roles "Member"
     if [[ $TEMPEST_USE_TEST_ACCOUNTS == "True" ]]; then
         if [[ $TEMPEST_HAS_ADMIN == "True" ]]; then
-            tox -evenv -- tempest-account-generator -c $TEMPEST_CONFIG --os-username $admin_username --os-password "$password" --os-tenant-name $admin_project_name -r $TEMPEST_CONCURRENCY --with-admin etc/accounts.yaml
+            tox -evenv-tempest -- tempest-account-generator -c $TEMPEST_CONFIG --os-username $admin_username --os-password "$password" --os-tenant-name $admin_project_name -r $TEMPEST_CONCURRENCY --with-admin etc/accounts.yaml
         else
-            tox -evenv -- tempest-account-generator -c $TEMPEST_CONFIG --os-username $admin_username --os-password "$password" --os-tenant-name $admin_project_name -r $TEMPEST_CONCURRENCY etc/accounts.yaml
+            tox -evenv-tempest -- tempest-account-generator -c $TEMPEST_CONFIG --os-username $admin_username --os-password "$password" --os-tenant-name $admin_project_name -r $TEMPEST_CONCURRENCY etc/accounts.yaml
         fi
         iniset $TEMPEST_CONFIG auth use_dynamic_credentials False
         iniset $TEMPEST_CONFIG auth test_accounts_file "etc/accounts.yaml"
@@ -594,12 +598,10 @@ function install_tempest {
     # NOTE(mtreinish) Respect constraints in the tempest full venv, things that
     # are using a tox job other than full will not be respecting constraints but
     # running pip install -U on tempest requirements
-    if [[ -d .tox/tempest ]] ; then
-        $TEMPEST_DIR/.tox/tempest/bin/pip install -c $REQUIREMENTS_DIR/upper-constraints.txt -r requirements.txt
-        PROJECT_VENV["tempest"]=${TEMPEST_DIR}/.tox/tempest
-    else
-        $TEMPEST_DIR/.tox/full/bin/pip install -c $REQUIREMENTS_DIR/upper-constraints.txt -r requirements.txt
-        PROJECT_VENV["tempest"]=${TEMPEST_DIR}/.tox/full
+    $TEMPEST_DIR/.tox/tempest/bin/pip install -c $REQUIREMENTS_DIR/upper-constraints.txt -r requirements.txt
+    PROJECT_VENV["tempest"]=${TEMPEST_DIR}/.tox/tempest
+    if [[ $TEMPEST_PLUGINS != 0 ]] ; then
+        tox -evenv-tempest -- pip install $TEMPEST_PLUGINS
     fi
     popd
 }

From b1518427c63e1c8da87f87b8be4a0d517c574283 Mon Sep 17 00:00:00 2001
From: Bernd Mueller <mueller@b1-systems.de>
Date: Wed, 4 May 2016 22:30:08 +0200
Subject: [PATCH 0418/2409] removed dead link to stack.sh.html

the referenced file was removed with the following change
Ie7f4b265368f1d10a8908d75e11d625b2cc39e7c

Change-Id: I0e25b1f38e0969037d1c8af367432da56bb12e92
---
 doc/source/index.rst | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/doc/source/index.rst b/doc/source/index.rst
index c4a7c59fe5..68ec174f3a 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -63,15 +63,12 @@ Quick Start
 
        devstack/tools/create-stack-user.sh; su stack
 
-#. Start the install
+#. Start the install, this will take a few minutes.
 
    ::
 
        cd devstack; ./stack.sh
 
-   It takes a few minutes, we recommend `reading the
-   script <stack.sh.html>`__ while it is building.
-
 Guides
 ======
 

From 655c22c77f21b360ba00b8c41b42fd0d0feec974 Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Mon, 2 May 2016 13:29:10 -0400
Subject: [PATCH 0419/2409] Add an explicit test-config phase to devstack
 plugins

This commit adds a new phase to the devstack plugin interface for
configuring test environments. It runs after everything in devstack
(except for the final output commands) to ensure that tempest or
any other dependency is installed prior to running it.

Change-Id: I52128756f18d3857963a0687de77f7cdfd11fb3e
---
 doc/source/plugins.rst | 2 ++
 stack.sh               | 6 ++++++
 2 files changed, 8 insertions(+)

diff --git a/doc/source/plugins.rst b/doc/source/plugins.rst
index 83e5609efa..70469d6876 100644
--- a/doc/source/plugins.rst
+++ b/doc/source/plugins.rst
@@ -99,6 +99,8 @@ The current full list of ``mode`` and ``phase`` are:
       should exist at this point.
    -  **extra** - Called near the end after layer 1 and 2 services have
       been started.
+   - **test-config** Called at the end of devstack used to configure tempest
+      or any other test environments
 
 -  **unstack** - Called by ``unstack.sh`` before other services are shut
    down.
diff --git a/stack.sh b/stack.sh
index 3de9af2725..0d5f16990f 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1367,6 +1367,12 @@ if is_service_enabled cinder; then
     fi
 fi
 
+# Run test-config
+# ---------------
+
+# Phase: test-config
+run_phase stack test-config
+
 
 # Fin
 # ===

From b523f3108f3fccd5b728e4dfe6e3c044b11b7c18 Mon Sep 17 00:00:00 2001
From: Travis Tripp <travis.tripp@hpe.com>
Date: Thu, 5 May 2016 10:19:53 -0600
Subject: [PATCH 0420/2409] Update ElasticSearch version default to 1.7.5

Devstack installs elasticsearch version 1.4.2 by default.
This version is really out of date and you can't run kibana
4.x against it.  We are working towards 2.x support [0],
but in the meantime would like our example to install a more
recent version of ES.

[0] http://lists.openstack.org/pipermail/openstack-dev/2016-April/092583.html

Change-Id: I9ca244f8b817dd9c5f6d7435e347df28282db0a9
---
 pkg/elasticsearch.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkg/elasticsearch.sh b/pkg/elasticsearch.sh
index 9c4f6f7801..856eaff36f 100755
--- a/pkg/elasticsearch.sh
+++ b/pkg/elasticsearch.sh
@@ -10,7 +10,7 @@ source $TOP_DIR/stackrc
 
 # Package source and version, all pkg files are expected to have
 # something like this, as well as a way to override them.
-ELASTICSEARCH_VERSION=${ELASTICSEARCH_VERSION:-1.4.2}
+ELASTICSEARCH_VERSION=${ELASTICSEARCH_VERSION:-1.7.5}
 ELASTICSEARCH_BASEURL=${ELASTICSEARCH_BASEURL:-https://download.elasticsearch.org/elasticsearch/elasticsearch}
 
 # Elastic search actual implementation

From daa7a41e219f435006f412e4ff45d93cf4c4827d Mon Sep 17 00:00:00 2001
From: "John L. Villalovos" <john.l.villalovos@intel.com>
Date: Thu, 5 May 2016 12:50:52 -0700
Subject: [PATCH 0421/2409] Export the 'short_source' function & don't keep PS4
 in sudo

Export the 'short_source' function so that it will be present in the
environment for child shell scripts. Do this because we are passing PS4
to the child shell scripts and it is using 'short_source'

Don't do an 'env_keep' in the sudoers file for PS4, since it is
difficult to also pass along the 'short_source' function.

Change-Id: I9781010d6eb336d02939c7fd47f18bedeae5ccc6
Closes-Bug: #1563443
---
 functions              | 3 +++
 stack.sh               | 1 -
 tools/create_userrc.sh | 3 +++
 3 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/functions b/functions
index 1bfb8a5078..d2609622b2 100644
--- a/functions
+++ b/functions
@@ -41,6 +41,9 @@ function short_source {
     file=${file#$RC_DIR/}
     printf "%-40s " "$file:${called[1]}:${called[0]}"
 }
+# PS4 is exported to child shells and uses the 'short_source' function, so
+# export it so child shells have access to the 'short_source' function also.
+export -f short_source
 
 
 # Retrieve an image from a URL and upload into Glance.
diff --git a/stack.sh b/stack.sh
index 3de9af2725..87f85dbb1b 100755
--- a/stack.sh
+++ b/stack.sh
@@ -240,7 +240,6 @@ echo "$STACK_USER ALL=(root) NOPASSWD:ALL" >$TEMPFILE
 # see them by forcing ``PATH``
 echo "Defaults:$STACK_USER secure_path=/sbin:/usr/sbin:/usr/bin:/bin:/usr/local/sbin:/usr/local/bin" >> $TEMPFILE
 echo "Defaults:$STACK_USER !requiretty" >> $TEMPFILE
-echo "Defaults env_keep += PS4" >> $TEMPFILE
 chmod 0440 $TEMPFILE
 sudo chown root:root $TEMPFILE
 sudo mv $TEMPFILE /etc/sudoers.d/50_stack_sh
diff --git a/tools/create_userrc.sh b/tools/create_userrc.sh
index a7278e47b3..b6db5d11aa 100755
--- a/tools/create_userrc.sh
+++ b/tools/create_userrc.sh
@@ -22,6 +22,9 @@ function short_source {
     file=${file#$RC_DIR/}
     printf "%-40s " "$file:${called[1]}:${called[0]}"
 }
+# PS4 is exported to child shells and uses the 'short_source' function, so
+# export it so child shells have access to the 'short_source' function also.
+export -f short_source
 
 set -o xtrace
 

From 3feceb0e4a2e9527be0d5e51ff317851417654d4 Mon Sep 17 00:00:00 2001
From: Hongbin Lu <hongbin.lu@huawei.com>
Date: Sun, 17 Apr 2016 11:11:58 -0400
Subject: [PATCH 0422/2409] Support decompressing bz2 image

CoreOS cloud image is compressed with bz2 extension [1]. In such
case, we need to decompress the image before uploading it to glance.

[1] https://coreos.com/os/docs/latest/booting-on-openstack.html

Change-Id: I705d0813d180aefaa2507c00d1ae40af07d12fcf
---
 functions | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/functions b/functions
index 0942f17009..ea737deee8 100644
--- a/functions
+++ b/functions
@@ -295,6 +295,12 @@ function upload_image {
             container_format=bare
             unpack=zcat
             ;;
+        *.img.bz2)
+            image_name=$(basename "$image" ".img.bz2")
+            disk_format=qcow2
+            container_format=bare
+            unpack=bunzip2
+            ;;
         *.qcow2)
             image_name=$(basename "$image" ".qcow2")
             disk_format=qcow2
@@ -328,6 +334,8 @@ function upload_image {
     if [ "$container_format" = "bare" ]; then
         if [ "$unpack" = "zcat" ]; then
             openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name" $img_property --public --container-format=$container_format --disk-format $disk_format < <(zcat --force "${image}")
+        elif [ "$unpack" = "bunzip2" ]; then
+            openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name" $img_property --public --container-format=$container_format --disk-format $disk_format < <(bunzip2 -cdk "${image}")
         else
             openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name" $img_property --public --container-format=$container_format --disk-format $disk_format < "${image}"
         fi

From 4f55c2d5c384f576e45f4310595e262039fd8175 Mon Sep 17 00:00:00 2001
From: Einst Crazy <yu.changcai@99cloud.net>
Date: Wed, 4 May 2016 08:14:01 +0000
Subject: [PATCH 0423/2409] Set config file to db sync and other manage
 operation

Currently, the db sync operation does not specify the config dir or
config file.
If there is a config file in the home path, it will use this one,
but not the right one devstack write.

Set config file to these operations.

Change-Id: Id1fbc3d85280c19596f5ebd301c46bcf018fa2f6
Closes-Bug: #1578098
---
 lib/cinder   | 2 +-
 lib/glance   | 4 ++--
 lib/heat     | 2 +-
 lib/keystone | 6 +++---
 lib/nova     | 6 +++---
 5 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 607a6f83c6..daeb94a839 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -415,7 +415,7 @@ function init_cinder {
         recreate_database cinder
 
         # Migrate cinder database
-        $CINDER_BIN_DIR/cinder-manage db sync
+        $CINDER_BIN_DIR/cinder-manage --config-file $CINDER_CONF db sync
     fi
 
     if is_service_enabled c-vol && [[ -n "$CINDER_ENABLED_BACKENDS" ]]; then
diff --git a/lib/glance b/lib/glance
index cda357fa66..887a14d7ed 100644
--- a/lib/glance
+++ b/lib/glance
@@ -334,10 +334,10 @@ function init_glance {
     recreate_database glance
 
     # Migrate glance database
-    $GLANCE_BIN_DIR/glance-manage db_sync
+    $GLANCE_BIN_DIR/glance-manage --config-file $GLANCE_CONF_DIR/glance-api.conf db_sync
 
     # Load metadata definitions
-    $GLANCE_BIN_DIR/glance-manage db_load_metadefs
+    $GLANCE_BIN_DIR/glance-manage --config-file $GLANCE_CONF_DIR/glance-api.conf db_load_metadefs
 
     create_glance_cache_dir
 }
diff --git a/lib/heat b/lib/heat
index 4326321bd1..730adada26 100644
--- a/lib/heat
+++ b/lib/heat
@@ -241,7 +241,7 @@ function init_heat {
     # (re)create heat database
     recreate_database heat
 
-    $HEAT_BIN_DIR/heat-manage db_sync
+    $HEAT_BIN_DIR/heat-manage --config-file $HEAT_CONF db_sync
     create_heat_cache_dir
 }
 
diff --git a/lib/keystone b/lib/keystone
index bcd5fab40c..6a202e518c 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -489,16 +489,16 @@ function init_keystone {
     recreate_database keystone
 
     # Initialize keystone database
-    $KEYSTONE_BIN_DIR/keystone-manage db_sync
+    $KEYSTONE_BIN_DIR/keystone-manage --config-file $KEYSTONE_CONF db_sync
 
     if [[ "$KEYSTONE_TOKEN_FORMAT" == "pki" || "$KEYSTONE_TOKEN_FORMAT" == "pkiz" ]]; then
         # Set up certificates
         rm -rf $KEYSTONE_CONF_DIR/ssl
-        $KEYSTONE_BIN_DIR/keystone-manage pki_setup
+        $KEYSTONE_BIN_DIR/keystone-manage --config-file $KEYSTONE_CONF pki_setup
     fi
     if [[ "$KEYSTONE_TOKEN_FORMAT" == "fernet" ]]; then
         rm -rf "$KEYSTONE_CONF_DIR/fernet-keys/"
-        $KEYSTONE_BIN_DIR/keystone-manage fernet_setup
+        $KEYSTONE_BIN_DIR/keystone-manage --config-file $KEYSTONE_CONF fernet_setup
     fi
 }
 
diff --git a/lib/nova b/lib/nova
index 818ecc4f1b..7f64016dca 100644
--- a/lib/nova
+++ b/lib/nova
@@ -702,18 +702,18 @@ function init_nova {
         recreate_database nova
 
         # Migrate nova database
-        $NOVA_BIN_DIR/nova-manage db sync
+        $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF db sync
 
         if is_service_enabled n-cell; then
             recreate_database $NOVA_CELLS_DB
         fi
 
         recreate_database $NOVA_API_DB
-        $NOVA_BIN_DIR/nova-manage api_db sync
+        $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF api_db sync
 
         # Run online migrations on the new databases
         # Needed for flavor conversion
-        $NOVA_BIN_DIR/nova-manage db online_data_migrations
+        $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF db online_data_migrations
     fi
 
     create_nova_cache_dir

From 6ba17f7d014aa50643a8920ee092424051d78c08 Mon Sep 17 00:00:00 2001
From: "yan.haifeng" <yanheven@qq.com>
Date: Fri, 29 Apr 2016 15:59:56 +0800
Subject: [PATCH 0424/2409] Fix ovs-vsctl executed in worlddump.py failed issue

add sudo before ovs-vsctl command.

Change-Id: I1a7dd9504da766beb452bd749e325931678de64e
Closes-Bug: #1576560
---
 tools/worlddump.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tools/worlddump.py b/tools/worlddump.py
index 238a23dab8..e1ef544a55 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -88,7 +88,8 @@ def _header(name):
 
 
 def _bridge_list():
-    process = subprocess.Popen(['ovs-vsctl', 'list-br'], stdout=subprocess.PIPE)
+    process = subprocess.Popen(['sudo', 'ovs-vsctl', 'list-br'],
+                               stdout=subprocess.PIPE)
     stdout, _ = process.communicate()
     return stdout.split()
 

From db01ca6d163f01ad9622da9ab0a60203fee51acc Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 9 May 2016 13:19:09 +1000
Subject: [PATCH 0425/2409] Fix return code detection in plugin list generation

As can be seen in logs of the periodic generation job, our cgit does a
weird thing where sometimes it returns a 404 page with content, and
sometimes a zero response (see [1] for example, the last number is
response size).  This appears to be an openstack CI issue; possibly
due to cgit caching or similar (see [2] for manual test).  It will
have to be investigated with the host apache logs.

This is resulting in a lot of projects incorrectly being picked up as
having plugins (I7116571d2a2b1fc3a61e5f1ed46ac2cbc244775a).  I'm not
sure if this problem is also releated to the original status-code
issues mentioned in the code, but testing shows that cgit is correctly
returning 404's for missing files (you can see in the logs [1]).  Thus
switch the logic to examine the return code which avoids this issue.

[1] http://logs.openstack.org/periodic/propose-devstack-plugins-list/e55790c/console.html.gz#_2016-05-04_06_46_51_660
[2] http://paste.openstack.org/show/496434/

Change-Id: I6a06347d91d091441f6f7b70f99aba6d8e9add4b
---
 tools/generate-devstack-plugins-list.py | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/tools/generate-devstack-plugins-list.py b/tools/generate-devstack-plugins-list.py
index 089a6ef93e..bbad1bf502 100644
--- a/tools/generate-devstack-plugins-list.py
+++ b/tools/generate-devstack-plugins-list.py
@@ -44,16 +44,10 @@ def is_in_openstack_namespace(proj):
     # stackforge, etc)
     return proj.startswith('openstack/')
 
-# Rather than returning a 404 for a nonexistent file, cgit delivers a
-# 0-byte response to a GET request.  It also does not provide a
-# Content-Length in a HEAD response, so the way we tell if a file exists
-# is to check the length of the entire GET response body.
+# Check if this project has a plugin file
 def has_devstack_plugin(proj):
     r = requests.get("https://git.openstack.org/cgit/%s/plain/devstack/plugin.sh" % proj)
-    if len(r.text) > 0:
-        return True
-    else:
-        return False
+    return r.status_code == 200
 
 logging.debug("Getting project list from %s" % url)
 r = requests.get(url)

From 3b79e5f9f76fb1b86731e1053c3749a84f43ebd7 Mon Sep 17 00:00:00 2001
From: Dmitry Tantsur <divius.inside@gmail.com>
Date: Mon, 9 May 2016 09:36:04 +0000
Subject: [PATCH 0426/2409] Revert "Update auth params in Nova
 Hypervisor-Ironic"

This seems to break Ironic gate with n-cpu not starting
any more.

This reverts commit c527ded91bef5d4c56cbdb2402a4d68015364b37.

Change-Id: Idfb01448e8ecf53fbd2e1df61c8f08f3107981ac
Closes-Bug: #1579683
---
 lib/nova_plugins/hypervisor-ironic | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/lib/nova_plugins/hypervisor-ironic b/lib/nova_plugins/hypervisor-ironic
index 7224fe3f42..43e7797371 100644
--- a/lib/nova_plugins/hypervisor-ironic
+++ b/lib/nova_plugins/hypervisor-ironic
@@ -45,12 +45,10 @@ function configure_nova_hypervisor {
     iniset $NOVA_CONF DEFAULT ram_allocation_ratio 1.0
     iniset $NOVA_CONF DEFAULT reserved_host_memory_mb 0
     # ironic section
-    iniset $NOVA_CONF ironic username admin
-    iniset $NOVA_CONF ironic password $ADMIN_PASSWORD
-    iniset $NOVA_CONF ironic auth_url $KEYSTONE_AUTH_URI/v3
-    iniset $NOVA_CONF ironic project_domain_id default
-    iniset $NOVA_CONF ironic user_domain_id default
-    iniset $NOVA_CONF ironic project_name demo
+    iniset $NOVA_CONF ironic admin_username admin
+    iniset $NOVA_CONF ironic admin_password $ADMIN_PASSWORD
+    iniset $NOVA_CONF ironic admin_url $KEYSTONE_AUTH_URI/v2.0
+    iniset $NOVA_CONF ironic admin_tenant_name demo
     iniset $NOVA_CONF ironic api_endpoint $IRONIC_SERVICE_PROTOCOL://$IRONIC_HOSTPORT/v1
 }
 

From 2a242519f71e86416e78541826cac2b54fcd04a5 Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Tue, 3 May 2016 09:03:09 -0400
Subject: [PATCH 0427/2409] Begin new lib/neutron

Background for this work can be read on the mailing list:

http://lists.openstack.org/pipermail/openstack-dev/2016-May/094063.html

Usage of the new Neutron is by setting the following in
ENABLED_SERVICES:

* neutron-api
* neutron-l3
* neutron-agent
* neutron-dhcp
* neutron-metadata-agent

For now, the new neutron library supports just the ML2 plugin, with the
Open vSwitch and Linux Bridge agents supported. All other Neutron
plugins should be creating their own DevStack plugin if they wish for
DevStack to support them. Many of them already do.

Other notable changes compared to neutron-legacy:

* Rely on the Neutron defaults, and force Neutron to make
  sane defaults instead of all kinds of knobs in DevStack.

* Default to rootwrap daemon support

* Use the security group driver by default

* interface_driver can now use NEUTRON_AGENT (linuxbridge, openvswitch), since
  they are entrypoints in neutron's setup.cfg

* Use NEUTRON_AGENT variable to determine which agent to run
  Works with NEUTRON_AGENT set to either "linuxbridge" or "openvswitch"
  Default is openvswitch for the time being.

* Set ML2 configuration for VXLAN support

* Remove Xen hypervisor stuff - it should be a plugin

* Move L3 crud into separate service file:

  There's a lot of L3 configuration that was in the main neutron file, but
  a lot of it is self contained and can be moved into its own file.

  The new l3 service file will contain all the previous L3 plumbing and
  configuration that the OpenStack Gate expects, while also eventually
  moving the whole l3 network creation step into a single hook that can be
  overridden by plugins.

* Introduce a check for a function "neutron_plugin_create_initial_networks" which
  will become the mechanism through which different topologies, and
  networking plugins can create and wire the initial networks that are
  created during a stack.sh run.

The new lib/neutron is considered experimental, and followup patches
will build upon this one. Existing users of lib/neutron-legacy should
remain unharmed.

Co-Authored-By: Hirofumi Ichihara <ichihara.hirofumi@lab.ntt.co.jp>
Co-Authored-By: Dean Troyer <dtroyer@gmail.com>
Change-Id: I31b6362c6d9992f425f2dedbbeff2568390a93da
---
 clean.sh                              |   1 +
 exercises/boot_from_volume.sh         |   1 +
 exercises/floating_ips.sh             |   1 +
 exercises/neutron-adv-test.sh         |   1 +
 exercises/volumes.sh                  |   1 +
 lib/neutron                           | 556 ++++++++++++++++++++++++++
 lib/neutron-legacy                    | 427 ++------------------
 lib/neutron_plugins/linuxbridge_agent |   8 +-
 lib/neutron_plugins/openvswitch_agent |   6 +-
 lib/neutron_plugins/services/l3       | 366 +++++++++++++++++
 lib/template                          |   9 +-
 stack.sh                              |  14 +-
 unstack.sh                            |   1 +
 13 files changed, 977 insertions(+), 415 deletions(-)
 create mode 100644 lib/neutron
 create mode 100644 lib/neutron_plugins/services/l3

diff --git a/clean.sh b/clean.sh
index 1176134da6..0641bffcf8 100755
--- a/clean.sh
+++ b/clean.sh
@@ -49,6 +49,7 @@ source $TOP_DIR/lib/nova
 source $TOP_DIR/lib/cinder
 source $TOP_DIR/lib/swift
 source $TOP_DIR/lib/heat
+source $TOP_DIR/lib/neutron
 source $TOP_DIR/lib/neutron-legacy
 
 set -o xtrace
diff --git a/exercises/boot_from_volume.sh b/exercises/boot_from_volume.sh
index 54098594ff..84ac08f017 100755
--- a/exercises/boot_from_volume.sh
+++ b/exercises/boot_from_volume.sh
@@ -32,6 +32,7 @@ source $TOP_DIR/functions
 
 # Import project functions
 source $TOP_DIR/lib/cinder
+source $TOP_DIR/lib/neutron
 source $TOP_DIR/lib/neutron-legacy
 
 # Import configuration
diff --git a/exercises/floating_ips.sh b/exercises/floating_ips.sh
index 4b72a0073f..485208ba30 100755
--- a/exercises/floating_ips.sh
+++ b/exercises/floating_ips.sh
@@ -31,6 +31,7 @@ source $TOP_DIR/functions
 source $TOP_DIR/openrc
 
 # Import project functions
+source $TOP_DIR/lib/neutron
 source $TOP_DIR/lib/neutron-legacy
 
 # Import exercise configuration
diff --git a/exercises/neutron-adv-test.sh b/exercises/neutron-adv-test.sh
index a3128a8d71..81150061ca 100755
--- a/exercises/neutron-adv-test.sh
+++ b/exercises/neutron-adv-test.sh
@@ -37,6 +37,7 @@ source $TOP_DIR/functions
 source $TOP_DIR/openrc
 
 # Import neutron functions
+source $TOP_DIR/lib/neutron
 source $TOP_DIR/lib/neutron-legacy
 
 # If neutron is not enabled we exit with exitcode 55, which means exercise is skipped.
diff --git a/exercises/volumes.sh b/exercises/volumes.sh
index f95c81fdf1..0de1226fee 100755
--- a/exercises/volumes.sh
+++ b/exercises/volumes.sh
@@ -32,6 +32,7 @@ source $TOP_DIR/openrc
 
 # Import project functions
 source $TOP_DIR/lib/cinder
+source $TOP_DIR/lib/neutron
 source $TOP_DIR/lib/neutron-legacy
 
 # Import exercise configuration
diff --git a/lib/neutron b/lib/neutron
new file mode 100644
index 0000000000..51c3a006c7
--- /dev/null
+++ b/lib/neutron
@@ -0,0 +1,556 @@
+#!/bin/bash
+#
+# lib/neutron
+# Install and start **Neutron** network services
+
+# Dependencies:
+#
+# ``functions`` file
+# ``DEST`` must be defined
+
+# ``stack.sh`` calls the entry points in this order:
+#
+# - is_XXXX_enabled
+# - install_XXXX
+# - configure_XXXX
+# - init_XXXX
+# - start_XXXX
+# - stop_XXXX
+# - cleanup_XXXX
+
+# Save trace setting
+XTRACE=$(set +o | grep xtrace)
+set +o xtrace
+
+# Defaults
+# --------
+
+# Set up default directories
+GITDIR["python-neutronclient"]=$DEST/python-neutronclient
+
+NEUTRON_AGENT=${NEUTRON_AGENT:-openvswitch}
+NEUTRON_DIR=$DEST/neutron
+NEUTRON_AUTH_CACHE_DIR=${NEUTRON_AUTH_CACHE_DIR:-/var/cache/neutron}
+
+NEUTRON_BIN_DIR=$(get_python_exec_prefix)
+NEUTRON_DHCP_BINARY="neutron-dhcp-agent"
+
+NEUTRON_CONF_DIR=/etc/neutron
+NEUTRON_CONF=$NEUTRON_CONF_DIR/neutron.conf
+NEUTRON_META_CONF=$NEUTRON_CONF_DIR/metadata_agent.ini
+
+NEUTRON_DHCP_CONF=$NEUTRON_CONF_DIR/dhcp_agent.ini
+NEUTRON_L3_CONF=$NEUTRON_CONF_DIR/l3_agent.ini
+NEUTRON_AGENT_CONF=$NEUTRON_CONF_DIR/
+
+NEUTRON_STATE_PATH=${NEUTRON_STATE_PATH:=$DATA_DIR/neutron}
+NEUTRON_AUTH_CACHE_DIR=${NEUTRON_AUTH_CACHE_DIR:-/var/cache/neutron}
+
+# By default, use the ML2 plugin
+NEUTRON_PLUGIN=${NEUTRON_PLUGIN:-ml2}
+NEUTRON_PLUGIN_CONF_FILENAME=${NEUTRON_PLUGIN_CONF_FILENAME:-ml2_conf.ini}
+NEUTRON_PLUGIN_CONF_PATH=$NEUTRON_CONF_DIR/plugins/$NEUTRON_PLUGIN
+NEUTRON_PLUGIN_CONF=$NEUTRON_PLUGIN_CONF_PATH/$NEUTRON_PLUGIN_CONF_FILENAME
+
+NEUTRON_AGENT_BINARY=${NEUTRON_AGENT_BINARY:-neutron-$NEUTRON_AGENT-agent}
+NEUTRON_L3_BINARY=${NEUTRON_L3_BINARY:-neutron-l3-agent}
+NEUTRON_META_BINARY=${NEUTRON_META_BINARY:-neutron-metadata-agent}
+
+# Public facing bits
+if is_ssl_enabled_service "neutron" || is_service_enabled tls-proxy; then
+    NEUTRON_SERVICE_PROTOCOL="https"
+fi
+NEUTRON_SERVICE_HOST=${NEUTRON_SERVICE_HOST:-$SERVICE_HOST}
+NEUTRON_SERVICE_PORT=${NEUTRON_SERVICE_PORT:-9696}
+NEUTRON_SERVICE_PORT_INT=${NEUTRON_SERVICE_PORT_INT:-19696}
+NEUTRON_SERVICE_PROTOCOL=${NEUTRON_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
+
+NEUTRON_AUTH_STRATEGY=${NEUTRON_AUTH_STRATEGY:-keystone}
+NEUTRON_ROOTWRAP=$(get_rootwrap_location neutron)
+NEUTRON_ROOTWRAP_CONF_FILE=$NEUTRON_CONF_DIR/rootwrap.conf
+NEUTRON_ROOTWRAP_DAEMON_CMD="sudo $NEUTRON_ROOTWRAP-daemon $NEUTRON_ROOTWRAP_CONF_FILE"
+
+# Add all enabled config files to a single config arg
+NEUTRON_CONFIG_ARG=${NEUTRON_CONFIG_ARG:-""}
+
+# Functions
+# ---------
+
+# Test if any Neutron services are enabled
+# is_neutron_enabled
+function is_neutron_enabled {
+    [[ ,${ENABLED_SERVICES} =~ ,"neutron-" || ,${ENABLED_SERVICES} =~ ,"q-" ]] && return 0
+    return 1
+}
+
+# Test if any Neutron services are enabled
+# is_neutron_enabled
+function is_neutron_legacy_enabled {
+    [[ ,${ENABLED_SERVICES} =~ ,"q-" ]] && return 0
+    return 1
+}
+
+# cleanup_neutron() - Remove residual data files, anything left over from previous
+# runs that a clean run would need to clean up
+function cleanup_neutron_new {
+    source $TOP_DIR/lib/neutron_plugins/${NEUTRON_AGENT}_agent
+    if is_neutron_ovs_base_plugin; then
+        neutron_ovs_base_cleanup
+    fi
+
+    if [[ $NEUTRON_AGENT == "linuxbridge" ]]; then
+        neutron_lb_cleanup
+    fi
+    # delete all namespaces created by neutron
+    for ns in $(sudo ip netns list | grep -o -E '(qdhcp|qrouter|qlbaas|fip|snat)-[0-9a-f-]*'); do
+        sudo ip netns delete ${ns}
+    done
+}
+
+# configure_neutron() - Set config files, create data dirs, etc
+function configure_neutron_new {
+    sudo install -d -o $STACK_USER $NEUTRON_CONF_DIR
+
+    (cd $NEUTRON_DIR && exec ./tools/generate_config_file_samples.sh)
+
+    cp $NEUTRON_DIR/etc/neutron.conf.sample $NEUTRON_CONF
+
+    configure_neutron_rootwrap
+
+    mkdir -p $NEUTRON_PLUGIN_CONF_PATH
+
+    cp $NEUTRON_DIR/etc/neutron/plugins/$NEUTRON_PLUGIN/$NEUTRON_PLUGIN_CONF_FILENAME.sample $NEUTRON_PLUGIN_CONF
+
+    iniset $NEUTRON_CONF database connection `database_connection_url neutron`
+    iniset $NEUTRON_CONF DEFAULT state_path $NEUTRON_STATE_PATH
+    iniset $NEUTRON_CONF oslo_concurrency lock_path $NEUTRON_STATE_PATH/lock
+    iniset $NEUTRON_CONF DEFAULT use_syslog $SYSLOG
+
+    # Neutron API server & Neutron plugin
+    if is_service_enabled neutron-api; then
+        local policy_file=$NEUTRON_CONF_DIR/policy.json
+        cp $NEUTRON_DIR/etc/policy.json $policy_file
+        # Allow neutron user to administer neutron to match neutron account
+        sed -i 's/"context_is_admin":  "role:admin"/"context_is_admin":  "role:admin or user_name:neutron"/g' $policy_file
+
+        cp $NEUTRON_DIR/etc/api-paste.ini $NEUTRON_CONF_DIR/api-paste.ini
+
+        iniset $NEUTRON_CONF DEFAULT core_plugin ml2
+
+        iniset $NEUTRON_CONF DEFAULT verbose True
+        iniset $NEUTRON_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
+        iniset $NEUTRON_CONF DEFAULT policy_file $policy_file
+        iniset $NEUTRON_CONF DEFAULT allow_overlapping_ips True
+
+        iniset $NEUTRON_CONF DEFAULT auth_strategy $NEUTRON_AUTH_STRATEGY
+        configure_auth_token_middleware $NEUTRON_CONF neutron $NEUTRON_AUTH_CACHE_DIR keystone_authtoken
+
+        # Configuration for neutron notifations to nova.
+        iniset $NEUTRON_CONF DEFAULT notify_nova_on_port_status_changes $Q_NOTIFY_NOVA_PORT_STATUS_CHANGES
+        iniset $NEUTRON_CONF DEFAULT notify_nova_on_port_data_changes $Q_NOTIFY_NOVA_PORT_DATA_CHANGES
+
+        iniset $NEUTRON_CONF nova auth_type password
+        iniset $NEUTRON_CONF nova auth_url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_AUTH_PORT/v3"
+        iniset $NEUTRON_CONF nova username nova
+        iniset $NEUTRON_CONF nova password $SERVICE_PASSWORD
+        iniset $NEUTRON_CONF nova user_domain_id default
+        iniset $NEUTRON_CONF nova project_name $SERVICE_TENANT_NAME
+        iniset $NEUTRON_CONF nova project_domain_id default
+        iniset $NEUTRON_CONF nova region_name $REGION_NAME
+
+        # Configure VXLAN
+        # TODO(sc68cal) not hardcode?
+        iniset $NEUTRON_PLUGIN_CONF ml2 tenant_network_types vxlan
+        iniset $NEUTRON_PLUGIN_CONF ml2 type_drivers vxlan
+        iniset $NEUTRON_PLUGIN_CONF ml2 mechanism_drivers openvswitch,linuxbridge
+        iniset $NEUTRON_PLUGIN_CONF ml2_type_vxlan vni_ranges 1001:2000
+    fi
+
+    # Neutron OVS or LB agent
+    if is_service_enabled neutron-agent; then
+        iniset $NEUTRON_PLUGIN_CONF agent tunnel_types vxlan
+
+        # Configure the neutron agent
+        if [[ $NEUTRON_AGENT == "linuxbridge" ]]; then
+            iniset $NEUTRON_PLUGIN_CONF securitygroup iptables
+            iniset $NEUTRON_PLUGIN_CONF vxlan local_ip $HOST_IP
+        else
+            iniset $NEUTRON_PLUGIN_CONF securitygroup iptables_hybrid
+            iniset $NEUTRON_PLUGIN_CONF ovs local_ip $HOST_IP
+        fi
+    fi
+
+    # DHCP Agent
+    if is_service_enabled neutron-dhcp; then
+        cp $NEUTRON_DIR/etc/dhcp_agent.ini.sample $NEUTRON_DHCP_CONF
+
+        iniset $NEUTRON_DHCP_CONF DEFAULT verbose True
+        iniset $NEUTRON_DHCP_CONF DEFAULT debug True
+        iniset $NEUTRON_DHCP_CONF agent root_helper_daemon "$NEUTRON_ROOTWRAP_DAEMON_CMD"
+        iniset $NEUTRON_DHCP_CONF DEFAULT interface_driver $NEUTRON_AGENT
+        neutron_plugin_configure_dhcp_agent $NEUTRON_DHCP_CONF
+    fi
+
+    if is_service_enabled neutron-l3; then
+        cp $NEUTRON_DIR/etc/l3_agent.ini.sample $NEUTRON_L3_CONF
+        iniset $NEUTRON_L3_CONF DEFAULT interface_driver $NEUTRON_AGENT
+        iniset $NEUTRON_CONF DEFAULT service_plugins router
+        iniset $NEUTRON_L3_CONF agent root_helper_daemon "$NEUTRON_ROOTWRAP_DAEMON_CMD"
+        iniset $NEUTRON_L3_CONF DEFAULT debug True
+        iniset $NEUTRON_L3_CONF DEFAULT verbose True
+        neutron_plugin_configure_l3_agent $NEUTRON_L3_CONF
+    fi
+
+    # Metadata
+    if is_service_enabled neutron-meta; then
+        cp $NEUTRON_DIR/etc/metadata_agent.ini.sample $NEUTRON_META_CONF
+
+        iniset $NEUTRON_META_CONF DEFAULT verbose True
+        iniset $NEUTRON_META_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
+        iniset $NEUTRON_META_CONF DEFAULT nova_metadata_ip $SERVICE_HOST
+        iniset $NEUTRON_META_CONF agent root_helper_daemon "$NEUTRON_ROOTWRAP_DAEMON_CMD"
+
+        # TODO(dtroyer): remove the v2.0 hard code below
+        iniset $NEUTRON_META_CONF DEFAULT auth_url $KEYSTONE_SERVICE_URI/v2.0
+        configure_auth_token_middleware $NEUTRON_META_CONF neutron $NEUTRON_AUTH_CACHE_DIR DEFAULT
+    fi
+
+    # Format logging
+    if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ]; then
+        setup_colorized_logging $NEUTRON_CONF DEFAULT project_id
+    else
+        # Show user_name and project_name by default
+        iniset $NEUTRON_CONF DEFAULT logging_context_format_string "%(asctime)s.%(msecs)03d %(levelname)s %(name)s [%(request_id)s %(user_name)s %(project_name)s] %(instance)s%(message)s"
+    fi
+
+    if is_service_enabled tls-proxy; then
+        # Set the service port for a proxy to take the original
+        iniset $NEUTRON_CONF DEFAULT bind_port "$NEUTRON_SERVICE_PORT_INT"
+    fi
+
+    if is_ssl_enabled_service "nova"; then
+        iniset $NEUTRON_CONF nova cafile $SSL_BUNDLE_FILE
+    fi
+
+    if is_ssl_enabled_service "neutron"; then
+        ensure_certificates NEUTRON
+
+        iniset $NEUTRON_CONF DEFAULT use_ssl True
+        iniset $NEUTRON_CONF DEFAULT ssl_cert_file "$NEUTRON_SSL_CERT"
+        iniset $NEUTRON_CONF DEFAULT ssl_key_file "$NEUTRON_SSL_KEY"
+    fi
+
+}
+
+# configure_neutron_rootwrap() - configure Neutron's rootwrap
+function configure_neutron_rootwrap {
+    # Set the paths of certain binaries
+    neutron_rootwrap=$(get_rootwrap_location neutron)
+
+    # Specify ``rootwrap.conf`` as first parameter to neutron-rootwrap
+    local rootwrap_sudoer_cmd="${neutron_rootwrap} $NEUTRON_CONF_DIR/rootwrap.conf"
+
+    # Deploy new rootwrap filters files (owned by root).
+    # Wipe any existing rootwrap.d files first
+    if [[ -d $NEUTRON_CONF_DIR/rootwrap.d ]]; then
+        sudo rm -rf $NEUTRON_CONF_DIR/rootwrap.d
+    fi
+
+    # Deploy filters to /etc/neutron/rootwrap.d
+    sudo install -d -o root -g root -m 755 $NEUTRON_CONF_DIR/rootwrap.d
+    sudo install -o root -g root -m 644 $NEUTRON_DIR/etc/neutron/rootwrap.d/*.filters $NEUTRON_CONF_DIR/rootwrap.d
+
+    # Set up ``rootwrap.conf``, pointing to ``$NEUTRON_CONF_DIR/rootwrap.d``
+    sudo install -o root -g root -m 644 $NEUTRON_DIR/etc/rootwrap.conf $NEUTRON_CONF_DIR
+    sudo sed -e "s:^filters_path=.*$:filters_path=$NEUTRON_CONF_DIR/rootwrap.d:" -i $NEUTRON_CONF_DIR/rootwrap.conf
+
+    # Set up the rootwrap sudoers for Neutron
+    tempfile=`mktemp`
+    echo "$STACK_USER ALL=(root) NOPASSWD: $rootwrap_sudoer_cmd *" >$tempfile
+    chmod 0440 $tempfile
+    sudo chown root:root $tempfile
+    sudo mv $tempfile /etc/sudoers.d/neutron-rootwrap
+}
+
+# Make Neutron-required changes to nova.conf
+function configure_neutron_nova_new {
+    iniset $NOVA_CONF DEFAULT use_neutron True
+    iniset $NOVA_CONF neutron auth_type "password"
+    iniset $NOVA_CONF neutron auth_url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_AUTH_PORT/v3"
+    iniset $NOVA_CONF neutron username neutron
+    iniset $NOVA_CONF neutron password "$SERVICE_PASSWORD"
+    iniset $NOVA_CONF neutron user_domain_name "Default"
+    iniset $NOVA_CONF neutron project_name "$SERVICE_TENANT_NAME"
+    iniset $NOVA_CONF neutron project_domain_name "Default"
+    iniset $NOVA_CONF neutron auth_strategy $NEUTRON_AUTH_STRATEGY
+    iniset $NOVA_CONF neutron region_name "$REGION_NAME"
+    iniset $NOVA_CONF neutron url $NEUTRON_SERVICE_PROTOCOL://$NEUTRON_SERVICE_HOST:$NEUTRON_SERVICE_PORT
+
+    iniset $NOVA_CONF DEFAULT firewall_driver nova.virt.firewall.NoopFirewallDriver
+
+    if is_service_enabled neutron-meta; then
+        iniset $NOVA_CONF neutron service_metadata_proxy "True"
+    fi
+
+}
+
+# Tenant               User       Roles
+# ------------------------------------------------------------------
+# service              neutron    admin        # if enabled
+
+# create_neutron_accounts() - Create required service accounts
+function create_neutron_accounts_new {
+    if [[ "$ENABLED_SERVICES" =~ "neutron-api" ]]; then
+
+        create_service_user "neutron"
+
+        neutron_service=$(get_or_create_service "neutron" \
+            "network" "Neutron Service")
+        get_or_create_endpoint $neutron_service \
+            "$REGION_NAME" \
+            "$NEUTRON_SERVICE_PROTOCOL://$NEUTRON_SERVICE_HOST:$NEUTRON_SERVICE_PORT/" \
+            "$NEUTRON_SERVICE_PROTOCOL://$NEUTRON_SERVICE_HOST:$NEUTRON_SERVICE_PORT/" \
+            "$NEUTRON_SERVICE_PROTOCOL://$NEUTRON_SERVICE_HOST:$NEUTRON_SERVICE_PORT/"
+    fi
+}
+
+# create_neutron_cache_dir() - Part of the init_neutron() process
+function create_neutron_cache_dir {
+    # Create cache dir
+    sudo install -d -o $STACK_USER $NEUTRON_AUTH_CACHE_DIR
+    rm -f $NEUTRON_AUTH_CACHE_DIR/*
+}
+
+# init_neutron() - Initialize databases, etc.
+function init_neutron_new {
+
+    recreate_database neutron
+
+    # Run Neutron db migrations
+    $NEUTRON_BIN_DIR/neutron-db-manage $NEUTRON_CONFIG_ARG upgrade heads
+
+    create_neutron_cache_dir
+}
+
+# install_neutron() - Collect source and prepare
+function install_neutron_new {
+    git_clone $NEUTRON_REPO $NEUTRON_DIR $NEUTRON_BRANCH
+    setup_develop $NEUTRON_DIR
+
+    # Install neutron-lib from git so we make sure we're testing
+    # the latest code.
+    if use_library_from_git "neutron-lib"; then
+        git_clone_by_name "neutron-lib"
+        setup_dev_lib "neutron-lib"
+    fi
+
+    # L3 service requires radvd
+    if is_service_enabled neutron-l3; then
+        install_package radvd
+    fi
+
+    if is_service_enabled neutron-agent neutron-dhcp neutron-l3; then
+        #TODO(sc68cal) - kind of ugly
+        source $TOP_DIR/lib/neutron_plugins/${NEUTRON_AGENT}_agent
+        neutron_plugin_install_agent_packages
+    fi
+
+}
+
+# install_neutronclient() - Collect source and prepare
+function install_neutronclient {
+    if use_library_from_git "python-neutronclient"; then
+        git_clone_by_name "python-neutronclient"
+        setup_dev_lib "python-neutronclient"
+        sudo install -D -m 0644 -o $STACK_USER {${GITDIR["python-neutronclient"]}/tools/,/etc/bash_completion.d/}neutron.bash_completion
+    fi
+}
+
+# start_neutron_api() - Start the API process ahead of other things
+function start_neutron_api {
+    local service_port=$NEUTRON_SERVICE_PORT
+    local service_protocol=$NEUTRON_SERVICE_PROTOCOL
+    if is_service_enabled tls-proxy; then
+        service_port=$NEUTRON_SERVICE_PORT_INT
+        service_protocol="http"
+    fi
+
+    # Start the Neutron service
+    # TODO(sc68cal) Stop hard coding this
+    run_process neutron-api "$NEUTRON_BIN_DIR/neutron-server --config-file $NEUTRON_CONF --config-file $NEUTRON_PLUGIN_CONF"
+
+    if is_ssl_enabled_service "neutron"; then
+        ssl_ca="--ca-certificate=${SSL_BUNDLE_FILE}"
+        local testcmd="wget ${ssl_ca} --no-proxy -q -O- $service_protocol://$NEUTRON_SERVICE_HOST:$service_port"
+        test_with_retry "$testcmd" "Neutron did not start" $SERVICE_TIMEOUT
+    else
+        if ! wait_for_service $SERVICE_TIMEOUT $service_protocol://$NEUTRON_SERVICE_HOST:$service_port; then
+            die $LINENO "neutron-api did not start"
+        fi
+    fi
+
+
+    # Start proxy if enabled
+    if is_service_enabled tls-proxy; then
+        start_tls_proxy '*' $NEUTRON_SERVICE_PORT $NEUTRON_SERVICE_HOST $NEUTRON_SERVICE_PORT_INT &
+    fi
+}
+
+# start_neutron() - Start running processes, including screen
+function start_neutron_new {
+    _set_config_files
+
+    # Start up the neutron agents if enabled
+    # TODO(sc68cal) Make this pluggable so different DevStack plugins for different Neutron plugins
+    # can resolve the $NEUTRON_AGENT_BINARY
+    if is_service_enabled neutron-agent; then
+        run_process neutron-agent "$NEUTRON_BIN_DIR/$NEUTRON_AGENT_BINARY $NEUTRON_CONFIG_ARG"
+    fi
+    if is_service_enabled neutron-dhcp; then
+        neutron_plugin_configure_dhcp_agent $NEUTRON_DHCP_CONF
+        run_process neutron-dhcp "$NEUTRON_BIN_DIR/$NEUTRON_DHCP_BINARY $NEUTRON_CONFIG_ARG"
+    fi
+    if is_service_enabled neutron-l3; then
+        run_process neutron-l3 "$NEUTRON_BIN_DIR/$NEUTRON_L3_BINARY $NEUTRON_CONFIG_ARG"
+        # XXX(sc68cal) - Here's where plugins can wire up their own networks instead
+        # of the code in lib/neutron_plugins/services/l3
+        if type -p neutron_plugin_create_initial_networks > /dev/null; then
+            neutron_plugin_create_initial_networks
+        else
+            # XXX(sc68cal) Load up the built in Neutron networking code and build a topology
+            source $TOP_DIR/lib/neutron_plugins/services/l3
+            # Create the networks using servic
+            create_neutron_initial_network
+        fi
+    fi
+    if is_service_enabled neutron-meta; then
+        run_process neutron-meta "$NEUTRON_BIN_DIR/$NEUTRON_META_BINARY $NEUTRON_CONFIG_ARG"
+    fi
+}
+
+# stop_neutron() - Stop running processes (non-screen)
+function stop_neutron_new {
+    for serv in neutron-api neutron-agent neutron-l3; do
+        stop_process $serv
+    done
+
+    if is_service_enabled neutron-dhcp; then
+        stop_process neutron-dhcp
+        pid=$(ps aux | awk '/[d]nsmasq.+interface=(tap|ns-)/ { print $2 }')
+        [ ! -z "$pid" ] && sudo kill -9 $pid
+    fi
+
+    if is_service_enabled neutron-meta; then
+        sudo pkill -9 -f neutron-ns-metadata-proxy || :
+        stop_process neutron-meta
+    fi
+}
+
+# Compile the lost of enabled config files
+function _set_config_files {
+
+    #TODO(sc68cal) - see if we can clean up this and only
+    # pass in config files that make sense for certain agents
+    if is_service_enabled neutron-api; then
+        NEUTRON_CONFIG_ARG+=" --config-file $NEUTRON_CONF"
+    fi
+
+    #TODO(sc68cal) OVS and LB agent uses settings in NEUTRON_PLUGIN_CONF (ml2_conf.ini) but others may not
+    if is_service_enabled neutron-agent; then
+        NEUTRON_CONFIG_ARG+=" --config-file $NEUTRON_PLUGIN_CONF"
+    fi
+
+    if is_service_enabled neutron-dhcp; then
+        NEUTRON_CONFIG_ARG+=" --config-file $NEUTRON_DHCP_CONF"
+    fi
+
+    if is_service_enabled neutron-l3; then
+        NEUTRON_CONFIG_ARG+=" --config-file $NEUTRON_L3_CONF"
+    fi
+
+    if is_service_enabled neutron-meta; then
+        NEUTRON_CONFIG_ARG+=" --config-file $NEUTRON_META_CONF"
+    fi
+
+}
+
+# Dispatch functions
+# These are needed for compatibility between the old and new implementations
+# where there are function name overlaps.  These will be removed when
+# neutron-legacy is removed.
+# TODO(sc68cal) Remove when neutron-legacy is no more.
+function cleanup_neutron {
+    if is_neutron_legacy_enabled; then
+        # Call back to old function
+        cleanup_mutnauq "$@"
+    else
+        cleanup_neutron_new "$@"
+    fi
+}
+
+function configure_neutron {
+    if is_neutron_legacy_enabled; then
+        # Call back to old function
+        configure_mutnauq "$@"
+    else
+        configure_neutron_new "$@"
+    fi
+}
+
+function configure_neutron_nova {
+    if is_neutron_legacy_enabled; then
+        # Call back to old function
+        create_nova_conf_neutron "$@"
+    else
+        configure_neutron_nova_new "$@"
+    fi
+}
+
+function create_neutron_accounts {
+    if is_neutron_legacy_enabled; then
+        # Call back to old function
+        create_mutnauq_accounts "$@"
+    else
+        create_neutron_accounts_new "$@"
+    fi
+}
+
+function init_neutron {
+    if is_neutron_legacy_enabled; then
+        # Call back to old function
+        init_mutnauq "$@"
+    else
+        init_neutron_new "$@"
+    fi
+}
+
+function install_neutron {
+    if is_neutron_legacy_enabled; then
+        # Call back to old function
+        install_mutnauq "$@"
+    else
+        install_neutron_new "$@"
+    fi
+}
+
+function start_neutron {
+    if is_neutron_legacy_enabled; then
+        # Call back to old function
+        start_mutnauq_l2_agent "$@"
+        start_mutnauq_other_agents "$@"
+    else
+        start_neutron_new "$@"
+    fi
+}
+
+function stop_neutron {
+    if is_neutron_legacy_enabled; then
+        # Call back to old function
+        stop_mutnauq "$@"
+    else
+        stop_neutron_new "$@"
+    fi
+}
+
+# Restore xtrace
+$XTRACE
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 4aa63890bd..7ebc2e2b3c 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -61,45 +61,12 @@
 # Neutron Network Configuration
 # -----------------------------
 
-# Subnet IP version
-IP_VERSION=${IP_VERSION:-"4+6"}
-# Validate IP_VERSION
-if [[ $IP_VERSION != "4" ]] && [[ $IP_VERSION != "6" ]] && [[ $IP_VERSION != "4+6" ]]; then
-    die $LINENO "IP_VERSION must be either 4, 6, or 4+6"
-fi
-# Gateway and subnet defaults, in case they are not customized in localrc
-NETWORK_GATEWAY=${NETWORK_GATEWAY:-10.0.0.1}
-PUBLIC_NETWORK_GATEWAY=${PUBLIC_NETWORK_GATEWAY:-172.24.4.1}
-PRIVATE_SUBNET_NAME=${PRIVATE_SUBNET_NAME:-"private-subnet"}
-PUBLIC_SUBNET_NAME=${PUBLIC_SUBNET_NAME:-"public-subnet"}
-
-# Subnetpool defaults
-SUBNETPOOL_NAME=${SUBNETPOOL_NAME:-"shared-default-subnetpool"}
-
-SUBNETPOOL_PREFIX_V4=${SUBNETPOOL_PREFIX_V4:-10.0.0.0/8}
-SUBNETPOOL_PREFIX_V6=${SUBNETPOOL_PREFIX_V6:-2001:db8:8000::/48}
-
-SUBNETPOOL_SIZE_V4=${SUBNETPOOL_SIZE_V4:-24}
-SUBNETPOOL_SIZE_V6=${SUBNETPOOL_SIZE_V6:-64}
 
 
 if is_ssl_enabled_service "neutron" || is_service_enabled tls-proxy; then
     Q_PROTOCOL="https"
 fi
 
-# Generate 40-bit IPv6 Global ID to comply with RFC 4193
-IPV6_GLOBAL_ID=`uuidgen | sed s/-//g | cut -c 23- | sed -e "s/\(..\)\(....\)\(....\)/\1:\2:\3/"`
-
-# IPv6 gateway and subnet defaults, in case they are not customized in localrc
-IPV6_RA_MODE=${IPV6_RA_MODE:-slaac}
-IPV6_ADDRESS_MODE=${IPV6_ADDRESS_MODE:-slaac}
-IPV6_PUBLIC_SUBNET_NAME=${IPV6_PUBLIC_SUBNET_NAME:-ipv6-public-subnet}
-IPV6_PRIVATE_SUBNET_NAME=${IPV6_PRIVATE_SUBNET_NAME:-ipv6-private-subnet}
-FIXED_RANGE_V6=${FIXED_RANGE_V6:-fd$IPV6_GLOBAL_ID::/64}
-IPV6_PRIVATE_NETWORK_GATEWAY=${IPV6_PRIVATE_NETWORK_GATEWAY:-fd$IPV6_GLOBAL_ID::1}
-IPV6_PUBLIC_RANGE=${IPV6_PUBLIC_RANGE:-2001:db8::/64}
-IPV6_PUBLIC_NETWORK_GATEWAY=${IPV6_PUBLIC_NETWORK_GATEWAY:-2001:db8::2}
-IPV6_ROUTER_GW_IP=${IPV6_ROUTER_GW_IP:-2001:db8::1}
 
 # Set up default directories
 GITDIR["python-neutronclient"]=$DEST/python-neutronclient
@@ -171,56 +138,6 @@ Q_NOTIFY_NOVA_PORT_STATUS_CHANGES=${Q_NOTIFY_NOVA_PORT_STATUS_CHANGES:-True}
 Q_NOTIFY_NOVA_PORT_DATA_CHANGES=${Q_NOTIFY_NOVA_PORT_DATA_CHANGES:-True}
 VIF_PLUGGING_IS_FATAL=${VIF_PLUGGING_IS_FATAL:-True}
 VIF_PLUGGING_TIMEOUT=${VIF_PLUGGING_TIMEOUT:-300}
-# Specify if the initial private and external networks should be created
-NEUTRON_CREATE_INITIAL_NETWORKS=${NEUTRON_CREATE_INITIAL_NETWORKS:-True}
-
-## Provider Network Information
-PROVIDER_SUBNET_NAME=${PROVIDER_SUBNET_NAME:-"provider_net"}
-IPV6_PROVIDER_SUBNET_NAME=${IPV6_PROVIDER_SUBNET_NAME:-"provider_net_v6"}
-IPV6_PROVIDER_FIXED_RANGE=${IPV6_PROVIDER_FIXED_RANGE:-}
-IPV6_PROVIDER_NETWORK_GATEWAY=${IPV6_PROVIDER_NETWORK_GATEWAY:-}
-
-# Define the public bridge that will transmit traffic from VMs to the
-# physical network - used by both the OVS and Linux Bridge drivers.
-PUBLIC_BRIDGE=${PUBLIC_BRIDGE:-br-ex}
-
-# Use flat providernet for public network
-#
-# If Q_USE_PROVIDERNET_FOR_PUBLIC=True, use a flat provider network
-# for external interface of neutron l3-agent.  In that case,
-# PUBLIC_PHYSICAL_NETWORK specifies provider:physical_network value
-# used for the network.  In case of ofagent, you should add the
-# corresponding entry to your OFAGENT_PHYSICAL_INTERFACE_MAPPINGS.
-# For openvswitch agent, you should add the corresponding entry to
-# your OVS_BRIDGE_MAPPINGS.
-#
-# eg.  (ofagent)
-#    Q_USE_PROVIDERNET_FOR_PUBLIC=True
-#    Q_USE_PUBLIC_VETH=True
-#    PUBLIC_PHYSICAL_NETWORK=public
-#    OFAGENT_PHYSICAL_INTERFACE_MAPPINGS=public:veth-pub-int
-#
-# eg.  (openvswitch agent)
-#    Q_USE_PROVIDERNET_FOR_PUBLIC=True
-#    PUBLIC_PHYSICAL_NETWORK=public
-#    OVS_BRIDGE_MAPPINGS=public:br-ex
-Q_USE_PROVIDERNET_FOR_PUBLIC=${Q_USE_PROVIDERNET_FOR_PUBLIC:-False}
-PUBLIC_PHYSICAL_NETWORK=${PUBLIC_PHYSICAL_NETWORK:-public}
-
-# If Q_USE_PUBLIC_VETH=True, create and use a veth pair instead of
-# PUBLIC_BRIDGE.  This is intended to be used with
-# Q_USE_PROVIDERNET_FOR_PUBLIC=True.
-Q_USE_PUBLIC_VETH=${Q_USE_PUBLIC_VETH:-False}
-Q_PUBLIC_VETH_EX=${Q_PUBLIC_VETH_EX:-veth-pub-ex}
-Q_PUBLIC_VETH_INT=${Q_PUBLIC_VETH_INT:-veth-pub-int}
-
-# The next two variables are configured by plugin
-# e.g.  _configure_neutron_l3_agent or lib/neutron_plugins/*
-#
-# The plugin supports L3.
-Q_L3_ENABLED=${Q_L3_ENABLED:-False}
-# L3 routers exist per tenant
-Q_L3_ROUTER_PER_TENANT=${Q_L3_ROUTER_PER_TENANT:-True}
 
 # List of config file names in addition to the main plugin config file
 # See _configure_neutron_common() for details about setting it up
@@ -354,6 +271,9 @@ source $TOP_DIR/lib/neutron_plugins/services/metering
 # ---------------------------------
 source $TOP_DIR/lib/neutron_plugins/services/firewall
 
+# L3 Service functions
+source $TOP_DIR/lib/neutron_plugins/services/l3
+
 # Use security group or not
 if has_neutron_plugin_security_group; then
     Q_USE_SECGROUP=${Q_USE_SECGROUP:-True}
@@ -400,16 +320,9 @@ function determine_config_files {
     echo "$opts"
 }
 
-# Test if any Neutron services are enabled
-# is_neutron_enabled
-function is_neutron_enabled {
-    [[ ,${ENABLED_SERVICES} =~ ,"q-" ]] && return 0
-    return 1
-}
-
-# configure_neutron()
+# configure_mutnauq()
 # Set common config for all neutron server and agents.
-function configure_neutron {
+function configure_mutnauq {
     _configure_neutron_common
     iniset_rpc_backend neutron $NEUTRON_CONF
 
@@ -482,21 +395,14 @@ function create_nova_conf_neutron {
     iniset $NOVA_CONF DEFAULT vif_plugging_timeout "$VIF_PLUGGING_TIMEOUT"
 }
 
-# create_neutron_cache_dir() - Part of the _neutron_setup_keystone() process
-function create_neutron_cache_dir {
-    # Create cache dir
-    sudo install -d -o $STACK_USER $NEUTRON_AUTH_CACHE_DIR
-    rm -f $NEUTRON_AUTH_CACHE_DIR/*
-}
-
-# create_neutron_accounts() - Set up common required neutron accounts
+# create_mutnauq_accounts() - Set up common required neutron accounts
 
 # Tenant               User       Roles
 # ------------------------------------------------------------------
 # service              neutron    admin        # if enabled
 
 # Migrated from keystone_data.sh
-function create_neutron_accounts {
+function create_mutnauq_accounts {
     if [[ "$ENABLED_SERVICES" =~ "q-svc" ]]; then
 
         create_service_user "neutron"
@@ -511,107 +417,15 @@ function create_neutron_accounts {
     fi
 }
 
-function create_neutron_initial_network {
-    local project_id
-    project_id=$(openstack project list | grep " demo " | get_field 1)
-    die_if_not_set $LINENO project_id "Failure retrieving project_id for demo"
-
-    # Allow drivers that need to create an initial network to do so here
-    if type -p neutron_plugin_create_initial_network_profile > /dev/null; then
-        neutron_plugin_create_initial_network_profile $PHYSICAL_NETWORK
-    fi
-
-    if is_provider_network; then
-        die_if_not_set $LINENO PHYSICAL_NETWORK "You must specify the PHYSICAL_NETWORK"
-        die_if_not_set $LINENO PROVIDER_NETWORK_TYPE "You must specify the PROVIDER_NETWORK_TYPE"
-        NET_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" net-create $PHYSICAL_NETWORK --tenant_id $project_id --provider:network_type $PROVIDER_NETWORK_TYPE --provider:physical_network "$PHYSICAL_NETWORK" ${SEGMENTATION_ID:+--provider:segmentation_id $SEGMENTATION_ID} --shared | grep ' id ' | get_field 2)
-        die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PHYSICAL_NETWORK $project_id"
-
-        if [[ "$IP_VERSION" =~ 4.* ]]; then
-            SUBNET_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create --tenant_id $project_id --ip_version 4 ${ALLOCATION_POOL:+--allocation-pool $ALLOCATION_POOL} --name $PROVIDER_SUBNET_NAME --gateway $NETWORK_GATEWAY $NET_ID $FIXED_RANGE | grep ' id ' | get_field 2)
-            die_if_not_set $LINENO SUBNET_ID "Failure creating SUBNET_ID for $PROVIDER_SUBNET_NAME $project_id"
-        fi
-
-        if [[ "$IP_VERSION" =~ .*6 ]] && [[ -n "$IPV6_PROVIDER_FIXED_RANGE" ]] && [[ -n "$IPV6_PROVIDER_NETWORK_GATEWAY" ]]; then
-            SUBNET_V6_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create --tenant_id $project_id --ip_version 6 --ipv6-address-mode $IPV6_ADDRESS_MODE --gateway $IPV6_PROVIDER_NETWORK_GATEWAY --name $IPV6_PROVIDER_SUBNET_NAME $NET_ID $IPV6_PROVIDER_FIXED_RANGE | grep 'id' | get_field 2)
-            die_if_not_set $LINENO SUBNET_V6_ID "Failure creating SUBNET_V6_ID for $IPV6_PROVIDER_SUBNET_NAME $project_id"
-        fi
-
-        if [[ $Q_AGENT == "openvswitch" ]]; then
-            sudo ip link set $OVS_PHYSICAL_BRIDGE up
-            sudo ip link set br-int up
-            sudo ip link set $PUBLIC_INTERFACE up
-        fi
-    else
-        NET_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" net-create --tenant-id $project_id "$PRIVATE_NETWORK_NAME" | grep ' id ' | get_field 2)
-        die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PRIVATE_NETWORK_NAME $project_id"
-
-        if [[ "$IP_VERSION" =~ 4.* ]]; then
-            # Create IPv4 private subnet
-            SUBNET_ID=$(_neutron_create_private_subnet_v4 $project_id)
-        fi
-
-        if [[ "$IP_VERSION" =~ .*6 ]]; then
-            # Create IPv6 private subnet
-            IPV6_SUBNET_ID=$(_neutron_create_private_subnet_v6 $project_id)
-        fi
-    fi
-
-    AUTO_ALLOCATE_EXT=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" ext-list | grep 'auto-allocated-topology' | get_field 1)
-    SUBNETPOOL_EXT=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" ext-list | grep 'subnet_allocation' | get_field 1)
-    if [[ "$Q_L3_ENABLED" == "True" ]]; then
-        # Create a router, and add the private subnet as one of its interfaces
-        if [[ "$Q_L3_ROUTER_PER_TENANT" == "True" ]]; then
-            # create a tenant-owned router.
-            ROUTER_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" router-create --tenant-id $project_id $Q_ROUTER_NAME | grep ' id ' | get_field 2)
-            die_if_not_set $LINENO ROUTER_ID "Failure creating ROUTER_ID for $project_id $Q_ROUTER_NAME"
-        else
-            # Plugin only supports creating a single router, which should be admin owned.
-            ROUTER_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" router-create $Q_ROUTER_NAME | grep ' id ' | get_field 2)
-            die_if_not_set $LINENO ROUTER_ID "Failure creating ROUTER_ID for $Q_ROUTER_NAME"
-        fi
-
-        # if the extension is available, then mark the external
-        # network as default, and provision default subnetpools
-        EXTERNAL_NETWORK_FLAGS="--router:external"
-        if [[ -n $AUTO_ALLOCATE_EXT && -n $SUBNETPOOL_EXT ]]; then
-            EXTERNAL_NETWORK_FLAGS="$EXTERNAL_NETWORK_FLAGS --is-default"
-            if [[ "$IP_VERSION" =~ 4.* ]]; then
-                SUBNETPOOL_V4_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnetpool-create $SUBNETPOOL_NAME --default-prefixlen $SUBNETPOOL_SIZE_V4 --pool-prefix $SUBNETPOOL_PREFIX_V4 --shared --is-default=True | grep ' id ' | get_field 2)
-            fi
-            if [[ "$IP_VERSION" =~ .*6 ]]; then
-                SUBNETPOOL_V6_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnetpool-create $SUBNETPOOL_NAME --default-prefixlen $SUBNETPOOL_SIZE_V6 --pool-prefix $SUBNETPOOL_PREFIX_V6 --shared --is-default=True | grep ' id ' | get_field 2)
-            fi
-        fi
-        # Create an external network, and a subnet. Configure the external network as router gw
-        if [ "$Q_USE_PROVIDERNET_FOR_PUBLIC" = "True" ]; then
-            EXT_NET_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" net-create "$PUBLIC_NETWORK_NAME" -- $EXTERNAL_NETWORK_FLAGS --provider:network_type=flat --provider:physical_network=${PUBLIC_PHYSICAL_NETWORK} | grep ' id ' | get_field 2)
-        else
-            EXT_NET_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" net-create "$PUBLIC_NETWORK_NAME" -- $EXTERNAL_NETWORK_FLAGS | grep ' id ' | get_field 2)
-        fi
-        die_if_not_set $LINENO EXT_NET_ID "Failure creating EXT_NET_ID for $PUBLIC_NETWORK_NAME"
-
-        if [[ "$IP_VERSION" =~ 4.* ]]; then
-            # Configure router for IPv4 public access
-            _neutron_configure_router_v4
-        fi
-
-        if [[ "$IP_VERSION" =~ .*6 ]]; then
-            # Configure router for IPv6 public access
-            _neutron_configure_router_v6
-        fi
-    fi
-}
-
-# init_neutron() - Initialize databases, etc.
-function init_neutron {
+# init_mutnauq() - Initialize databases, etc.
+function init_mutnauq {
     recreate_database $Q_DB_NAME
     # Run Neutron db migrations
     $NEUTRON_BIN_DIR/neutron-db-manage --config-file $NEUTRON_CONF --config-file /$Q_PLUGIN_CONF_FILE upgrade head
 }
 
-# install_neutron() - Collect source and prepare
-function install_neutron {
+# install_mutnauq() - Collect source and prepare
+function install_mutnauq {
     # Install neutron-lib from git so we make sure we're testing
     # the latest code.
     if use_library_from_git "neutron-lib"; then
@@ -649,15 +463,6 @@ function install_neutron {
     fi
 }
 
-# install_neutronclient() - Collect source and prepare
-function install_neutronclient {
-    if use_library_from_git "python-neutronclient"; then
-        git_clone_by_name "python-neutronclient"
-        setup_dev_lib "python-neutronclient"
-        sudo install -D -m 0644 -o $STACK_USER {${GITDIR["python-neutronclient"]}/tools/,/etc/bash_completion.d/}neutron.bash_completion
-    fi
-}
-
 # install_neutron_agent_packages() - Collect source and prepare
 function install_neutron_agent_packages {
     # radvd doesn't come with the OS. Install it if the l3 service is enabled.
@@ -704,7 +509,7 @@ function start_neutron_service_and_check {
 
 # Control of the l2 agent is separated out to make it easier to test partial
 # upgrades (everything upgraded except the L2 agent)
-function start_neutron_l2_agent {
+function start_mutnauq_l2_agent {
     run_process q-agt "$AGENT_BINARY --config-file $NEUTRON_CONF --config-file /$Q_PLUGIN_CONF_FILE"
 
     if is_provider_network && [[ $Q_AGENT == "openvswitch" ]]; then
@@ -722,7 +527,7 @@ function start_neutron_l2_agent {
     fi
 }
 
-function start_neutron_other_agents {
+function start_mutnauq_other_agents {
     run_process q-dhcp "$AGENT_DHCP_BINARY --config-file $NEUTRON_CONF --config-file=$Q_DHCP_CONF_FILE"
 
     if is_service_enabled neutron-vpnaas; then
@@ -744,15 +549,16 @@ function start_neutron_other_agents {
 # Start running processes, including screen
 function start_neutron_agents {
     # Start up the neutron agents if enabled
-    start_neutron_l2_agent
-    start_neutron_other_agents
+    start_mutnauq_l2_agent
+    start_mutnauq_other_agents
 }
 
-function stop_neutron_l2_agent {
+function stop_mutnauq_l2_agent {
     stop_process q-agt
 }
 
-function stop_neutron_other {
+# stop_mutnauq_other() - Stop running processes (non-screen)
+function stop_mutnauq_other {
     if is_service_enabled q-dhcp; then
         stop_process q-dhcp
         pid=$(ps aux | awk '/[d]nsmasq.+interface=(tap|ns-)/ { print $2 }')
@@ -787,9 +593,9 @@ function stop_neutron_other {
 }
 
 # stop_neutron() - Stop running processes (non-screen)
-function stop_neutron {
-    stop_neutron_other
-    stop_neutron_l2_agent
+function stop_mutnauq {
+    stop_mutnauq_other
+    stop_mutnauq_l2_agent
 }
 
 # _move_neutron_addresses_route() - Move the primary IP to the OVS bridge
@@ -842,9 +648,9 @@ function _move_neutron_addresses_route {
     fi
 }
 
-# cleanup_neutron() - Remove residual data files, anything left over from previous
+# cleanup_mutnauq() - Remove residual data files, anything left over from previous
 # runs that a clean run would need to clean up
-function cleanup_neutron {
+function cleanup_mutnauq {
 
     if [[ -n "$OVS_PHYSICAL_BRIDGE" ]]; then
         _move_neutron_addresses_route "$OVS_PHYSICAL_BRIDGE" "$PUBLIC_INTERFACE" False True "inet"
@@ -1031,27 +837,6 @@ function _configure_neutron_dhcp_agent {
     neutron_plugin_configure_dhcp_agent
 }
 
-function _configure_neutron_l3_agent {
-    Q_L3_ENABLED=True
-
-    cp $NEUTRON_DIR/etc/l3_agent.ini.sample $Q_L3_CONF_FILE
-
-    iniset $Q_L3_CONF_FILE DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-    iniset $Q_L3_CONF_FILE AGENT root_helper "$Q_RR_COMMAND"
-    if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
-        iniset $Q_L3_CONF_FILE AGENT root_helper_daemon "$Q_RR_DAEMON_COMMAND"
-    fi
-
-    _neutron_setup_interface_driver $Q_L3_CONF_FILE
-
-    neutron_plugin_configure_l3_agent
-
-    _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" True False "inet"
-
-    if [[ $(ip -f inet6 a s dev "$PUBLIC_INTERFACE" | grep -c 'global') != 0 ]]; then
-        _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" False False "inet6"
-    fi
-}
 
 function _configure_neutron_metadata_agent {
     cp $NEUTRON_DIR/etc/metadata_agent.ini.sample $Q_META_CONF_FILE
@@ -1226,164 +1011,6 @@ function _neutron_setup_interface_driver {
 
     neutron_plugin_setup_interface_driver $1
 }
-
-# Create private IPv4 subnet
-function _neutron_create_private_subnet_v4 {
-    local project_id=$1
-    local subnet_params="--tenant-id $project_id "
-    subnet_params+="--ip_version 4 "
-    subnet_params+="--gateway $NETWORK_GATEWAY "
-    subnet_params+="--name $PRIVATE_SUBNET_NAME "
-    subnet_params+="$NET_ID $FIXED_RANGE"
-    local subnet_id
-    subnet_id=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create $subnet_params | grep ' id ' | get_field 2)
-    die_if_not_set $LINENO subnet_id "Failure creating private IPv4 subnet for $project_id"
-    echo $subnet_id
-}
-
-# Create private IPv6 subnet
-function _neutron_create_private_subnet_v6 {
-    local project_id=$1
-    die_if_not_set $LINENO IPV6_RA_MODE "IPV6 RA Mode not set"
-    die_if_not_set $LINENO IPV6_ADDRESS_MODE "IPV6 Address Mode not set"
-    local ipv6_modes="--ipv6-ra-mode $IPV6_RA_MODE --ipv6-address-mode $IPV6_ADDRESS_MODE"
-    local subnet_params="--tenant-id $project_id "
-    subnet_params+="--ip_version 6 "
-    subnet_params+="--gateway $IPV6_PRIVATE_NETWORK_GATEWAY "
-    subnet_params+="--name $IPV6_PRIVATE_SUBNET_NAME "
-    subnet_params+="$NET_ID $FIXED_RANGE_V6 $ipv6_modes"
-    local ipv6_subnet_id
-    ipv6_subnet_id=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create $subnet_params | grep ' id ' | get_field 2)
-    die_if_not_set $LINENO ipv6_subnet_id "Failure creating private IPv6 subnet for $project_id"
-    echo $ipv6_subnet_id
-}
-
-# Create public IPv4 subnet
-function _neutron_create_public_subnet_v4 {
-    local subnet_params+="--ip_version 4 "
-    subnet_params+="${Q_FLOATING_ALLOCATION_POOL:+--allocation-pool $Q_FLOATING_ALLOCATION_POOL} "
-    subnet_params+="--gateway $PUBLIC_NETWORK_GATEWAY "
-    subnet_params+="--name $PUBLIC_SUBNET_NAME "
-    subnet_params+="$EXT_NET_ID $FLOATING_RANGE "
-    subnet_params+="-- --enable_dhcp=False"
-    local id_and_ext_gw_ip
-    id_and_ext_gw_ip=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create $subnet_params | grep -e 'gateway_ip' -e ' id ')
-    die_if_not_set $LINENO id_and_ext_gw_ip "Failure creating public IPv4 subnet"
-    echo $id_and_ext_gw_ip
-}
-
-# Create public IPv6 subnet
-function _neutron_create_public_subnet_v6 {
-    local subnet_params="--ip_version 6 "
-    subnet_params+="--gateway $IPV6_PUBLIC_NETWORK_GATEWAY "
-    subnet_params+="--name $IPV6_PUBLIC_SUBNET_NAME "
-    subnet_params+="$EXT_NET_ID $IPV6_PUBLIC_RANGE "
-    subnet_params+="-- --enable_dhcp=False"
-    local ipv6_id_and_ext_gw_ip
-    ipv6_id_and_ext_gw_ip=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create $subnet_params | grep -e 'gateway_ip' -e ' id ')
-    die_if_not_set $LINENO ipv6_id_and_ext_gw_ip "Failure creating an IPv6 public subnet"
-    echo $ipv6_id_and_ext_gw_ip
-}
-
-# Configure neutron router for IPv4 public access
-function _neutron_configure_router_v4 {
-    neutron --os-cloud devstack-admin --os-region "$REGION_NAME" router-interface-add $ROUTER_ID $SUBNET_ID
-    # Create a public subnet on the external network
-    local id_and_ext_gw_ip
-    id_and_ext_gw_ip=$(_neutron_create_public_subnet_v4 $EXT_NET_ID)
-    local ext_gw_ip
-    ext_gw_ip=$(echo $id_and_ext_gw_ip  | get_field 2)
-    PUB_SUBNET_ID=$(echo $id_and_ext_gw_ip | get_field 5)
-    # Configure the external network as the default router gateway
-    neutron --os-cloud devstack-admin --os-region "$REGION_NAME" router-gateway-set $ROUTER_ID $EXT_NET_ID
-
-    # This logic is specific to using the l3-agent for layer 3
-    if is_service_enabled q-l3; then
-        # Configure and enable public bridge
-        local ext_gw_interface="none"
-        if is_neutron_ovs_base_plugin; then
-            ext_gw_interface=$(_neutron_get_ext_gw_interface)
-        elif [[ "$Q_AGENT" = "linuxbridge" ]]; then
-            # Search for the brq device the neutron router and network for $FIXED_RANGE
-            # will be using.
-            # e.x. brq3592e767-da for NET_ID 3592e767-da66-4bcb-9bec-cdb03cd96102
-            ext_gw_interface=brq${EXT_NET_ID:0:11}
-        fi
-        if [[ "$ext_gw_interface" != "none" ]]; then
-            local cidr_len=${FLOATING_RANGE#*/}
-            local testcmd="ip -o link | grep -q $ext_gw_interface"
-            test_with_retry "$testcmd" "$ext_gw_interface creation failed"
-            if [[ $(ip addr show dev $ext_gw_interface | grep -c $ext_gw_ip) == 0 && ( $Q_USE_PROVIDERNET_FOR_PUBLIC == "False" || $Q_USE_PUBLIC_VETH == "True" ) ]]; then
-                sudo ip addr add $ext_gw_ip/$cidr_len dev $ext_gw_interface
-                sudo ip link set $ext_gw_interface up
-            fi
-            ROUTER_GW_IP=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" port-list -c fixed_ips -c device_owner | grep router_gateway | awk -F'ip_address'  '{ print $2 }' | cut -f3 -d\" | tr '\n' ' ')
-            die_if_not_set $LINENO ROUTER_GW_IP "Failure retrieving ROUTER_GW_IP"
-            sudo ip route replace  $FIXED_RANGE via $ROUTER_GW_IP
-        fi
-        _neutron_set_router_id
-    fi
-}
-
-# Configure neutron router for IPv6 public access
-function _neutron_configure_router_v6 {
-    neutron --os-cloud devstack-admin --os-region "$REGION_NAME" router-interface-add $ROUTER_ID $IPV6_SUBNET_ID
-    # Create a public subnet on the external network
-    local ipv6_id_and_ext_gw_ip
-    ipv6_id_and_ext_gw_ip=$(_neutron_create_public_subnet_v6 $EXT_NET_ID)
-    local ipv6_ext_gw_ip
-    ipv6_ext_gw_ip=$(echo $ipv6_id_and_ext_gw_ip | get_field 2)
-    local ipv6_pub_subnet_id
-    ipv6_pub_subnet_id=$(echo $ipv6_id_and_ext_gw_ip | get_field 5)
-
-    # If the external network has not already been set as the default router
-    # gateway when configuring an IPv4 public subnet, do so now
-    if [[ "$IP_VERSION" == "6" ]]; then
-        neutron --os-cloud devstack-admin --os-region "$REGION_NAME" router-gateway-set $ROUTER_ID $EXT_NET_ID
-    fi
-
-    # This logic is specific to using the l3-agent for layer 3
-    if is_service_enabled q-l3; then
-        # Ensure IPv6 forwarding is enabled on the host
-        sudo sysctl -w net.ipv6.conf.all.forwarding=1
-        # Configure and enable public bridge
-        # Override global IPV6_ROUTER_GW_IP with the true value from neutron
-        IPV6_ROUTER_GW_IP=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" port-list -c fixed_ips | grep $ipv6_pub_subnet_id | awk -F'ip_address' '{ print $2 }' | cut -f3 -d\" | tr '\n' ' ')
-        die_if_not_set $LINENO IPV6_ROUTER_GW_IP "Failure retrieving IPV6_ROUTER_GW_IP"
-
-        if is_neutron_ovs_base_plugin; then
-            local ext_gw_interface
-            ext_gw_interface=$(_neutron_get_ext_gw_interface)
-            local ipv6_cidr_len=${IPV6_PUBLIC_RANGE#*/}
-
-            # Configure interface for public bridge
-            sudo ip -6 addr add $ipv6_ext_gw_ip/$ipv6_cidr_len dev $ext_gw_interface
-            sudo ip -6 route replace $FIXED_RANGE_V6 via $IPV6_ROUTER_GW_IP dev $ext_gw_interface
-        fi
-        _neutron_set_router_id
-    fi
-}
-
-# Explicitly set router id in l3 agent configuration
-function _neutron_set_router_id {
-    if [[ "$Q_L3_ROUTER_PER_TENANT" == "False" ]]; then
-        iniset $Q_L3_CONF_FILE DEFAULT router_id $ROUTER_ID
-    fi
-}
-
-# Get ext_gw_interface depending on value of Q_USE_PUBLIC_VETH
-function _neutron_get_ext_gw_interface {
-    if [[ "$Q_USE_PUBLIC_VETH" == "True" ]]; then
-        echo $Q_PUBLIC_VETH_EX
-    else
-        # Disable in-band as we are going to use local port
-        # to communicate with VMs
-        sudo ovs-vsctl set Bridge $PUBLIC_BRIDGE \
-            other_config:disable-in-band=true
-        echo $PUBLIC_BRIDGE
-    fi
-}
-
 # Functions for Neutron Exercises
 #--------------------------------
 
@@ -1485,14 +1112,6 @@ function check_neutron_third_party_integration {
     _neutron_third_party_do check
 }
 
-function is_provider_network {
-    if [ "$Q_USE_PROVIDER_NETWORKING" == "True" ] && [ "$Q_L3_ENABLED" == "False" ]; then
-        return 0
-    fi
-    return 1
-}
-
-
 # Restore xtrace
 $_XTRACE_NEUTRON
 
diff --git a/lib/neutron_plugins/linuxbridge_agent b/lib/neutron_plugins/linuxbridge_agent
index 096722b096..0a066354ca 100644
--- a/lib/neutron_plugins/linuxbridge_agent
+++ b/lib/neutron_plugins/linuxbridge_agent
@@ -43,13 +43,15 @@ function neutron_plugin_configure_debug_command {
 }
 
 function neutron_plugin_configure_dhcp_agent {
-    iniset $Q_DHCP_CONF_FILE DEFAULT dhcp_agent_manager neutron.agent.dhcp_agent.DhcpAgentWithStateReport
+    local conf_file=$1
+    iniset $conf_file DEFAULT dhcp_agent_manager neutron.agent.dhcp_agent.DhcpAgentWithStateReport
 }
 
 function neutron_plugin_configure_l3_agent {
+    local conf_file=$1
     sudo brctl addbr $PUBLIC_BRIDGE
-    iniset $Q_L3_CONF_FILE DEFAULT external_network_bridge
-    iniset $Q_L3_CONF_FILE DEFAULT l3_agent_manager neutron.agent.l3_agent.L3NATAgentWithStateReport
+    iniset $conf_file DEFAULT external_network_bridge
+    iniset $conf_file DEFAULT l3_agent_manager neutron.agent.l3_agent.L3NATAgentWithStateReport
 }
 
 function neutron_plugin_configure_plugin_agent {
diff --git a/lib/neutron_plugins/openvswitch_agent b/lib/neutron_plugins/openvswitch_agent
index aba2587ea4..69e38f4df1 100644
--- a/lib/neutron_plugins/openvswitch_agent
+++ b/lib/neutron_plugins/openvswitch_agent
@@ -28,12 +28,14 @@ function neutron_plugin_configure_debug_command {
 }
 
 function neutron_plugin_configure_dhcp_agent {
-    iniset $Q_DHCP_CONF_FILE DEFAULT dhcp_agent_manager neutron.agent.dhcp_agent.DhcpAgentWithStateReport
+    local conf_file=$1
+    iniset $conf_file DEFAULT dhcp_agent_manager neutron.agent.dhcp_agent.DhcpAgentWithStateReport
 }
 
 function neutron_plugin_configure_l3_agent {
+    local conf_file=$1
     _neutron_ovs_base_configure_l3_agent
-    iniset $Q_L3_CONF_FILE DEFAULT l3_agent_manager neutron.agent.l3_agent.L3NATAgentWithStateReport
+    iniset $conf_file DEFAULT l3_agent_manager neutron.agent.l3_agent.L3NATAgentWithStateReport
 }
 
 function neutron_plugin_configure_plugin_agent {
diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
new file mode 100644
index 0000000000..177dc1f028
--- /dev/null
+++ b/lib/neutron_plugins/services/l3
@@ -0,0 +1,366 @@
+#!/bin/bash
+# Subnet IP version
+IP_VERSION=${IP_VERSION:-"4+6"}
+# Validate IP_VERSION
+if [[ $IP_VERSION != "4" ]] && [[ $IP_VERSION != "6" ]] && [[ $IP_VERSION != "4+6" ]]; then
+    die $LINENO "IP_VERSION must be either 4, 6, or 4+6"
+fi
+# Specify if the initial private and external networks should be created
+NEUTRON_CREATE_INITIAL_NETWORKS=${NEUTRON_CREATE_INITIAL_NETWORKS:-True}
+
+## Provider Network Information
+PROVIDER_SUBNET_NAME=${PROVIDER_SUBNET_NAME:-"provider_net"}
+IPV6_PROVIDER_SUBNET_NAME=${IPV6_PROVIDER_SUBNET_NAME:-"provider_net_v6"}
+IPV6_PROVIDER_FIXED_RANGE=${IPV6_PROVIDER_FIXED_RANGE:-}
+IPV6_PROVIDER_NETWORK_GATEWAY=${IPV6_PROVIDER_NETWORK_GATEWAY:-}
+
+PUBLIC_BRIDGE=${PUBLIC_BRIDGE:-br-ex}
+
+# If Q_USE_PUBLIC_VETH=True, create and use a veth pair instead of
+# PUBLIC_BRIDGE.  This is intended to be used with
+# Q_USE_PROVIDERNET_FOR_PUBLIC=True.
+Q_USE_PUBLIC_VETH=${Q_USE_PUBLIC_VETH:-False}
+Q_PUBLIC_VETH_EX=${Q_PUBLIC_VETH_EX:-veth-pub-ex}
+Q_PUBLIC_VETH_INT=${Q_PUBLIC_VETH_INT:-veth-pub-int}
+
+# The next two variables are configured by plugin
+# e.g.  _configure_neutron_l3_agent or lib/neutron_plugins/*
+#
+# The plugin supports L3.
+Q_L3_ENABLED=${Q_L3_ENABLED:-True}
+# L3 routers exist per tenant
+Q_L3_ROUTER_PER_TENANT=${Q_L3_ROUTER_PER_TENANT:-True}
+
+
+# Use flat providernet for public network
+#
+# If Q_USE_PROVIDERNET_FOR_PUBLIC=True, use a flat provider network
+# for external interface of neutron l3-agent.  In that case,
+# PUBLIC_PHYSICAL_NETWORK specifies provider:physical_network value
+# used for the network.  In case of ofagent, you should add the
+# corresponding entry to your OFAGENT_PHYSICAL_INTERFACE_MAPPINGS.
+# For openvswitch agent, you should add the corresponding entry to
+# your OVS_BRIDGE_MAPPINGS.
+#
+# eg.  (ofagent)
+#    Q_USE_PROVIDERNET_FOR_PUBLIC=True
+#    Q_USE_PUBLIC_VETH=True
+#    PUBLIC_PHYSICAL_NETWORK=public
+#    OFAGENT_PHYSICAL_INTERFACE_MAPPINGS=public:veth-pub-int
+#
+# eg.  (openvswitch agent)
+#    Q_USE_PROVIDERNET_FOR_PUBLIC=True
+#    PUBLIC_PHYSICAL_NETWORK=public
+#    OVS_BRIDGE_MAPPINGS=public:br-ex
+Q_USE_PROVIDERNET_FOR_PUBLIC=${Q_USE_PROVIDERNET_FOR_PUBLIC:-False}
+PUBLIC_PHYSICAL_NETWORK=${PUBLIC_PHYSICAL_NETWORK:-public}
+
+# Generate 40-bit IPv6 Global ID to comply with RFC 4193
+IPV6_GLOBAL_ID=`uuidgen | sed s/-//g | cut -c 23- | sed -e "s/\(..\)\(....\)\(....\)/\1:\2:\3/"`
+
+# IPv6 gateway and subnet defaults, in case they are not customized in localrc
+IPV6_RA_MODE=${IPV6_RA_MODE:-slaac}
+IPV6_ADDRESS_MODE=${IPV6_ADDRESS_MODE:-slaac}
+IPV6_PUBLIC_SUBNET_NAME=${IPV6_PUBLIC_SUBNET_NAME:-ipv6-public-subnet}
+IPV6_PRIVATE_SUBNET_NAME=${IPV6_PRIVATE_SUBNET_NAME:-ipv6-private-subnet}
+FIXED_RANGE_V6=${FIXED_RANGE_V6:-fd$IPV6_GLOBAL_ID::/64}
+IPV6_PRIVATE_NETWORK_GATEWAY=${IPV6_PRIVATE_NETWORK_GATEWAY:-fd$IPV6_GLOBAL_ID::1}
+IPV6_PUBLIC_RANGE=${IPV6_PUBLIC_RANGE:-2001:db8::/64}
+IPV6_PUBLIC_NETWORK_GATEWAY=${IPV6_PUBLIC_NETWORK_GATEWAY:-2001:db8::2}
+IPV6_ROUTER_GW_IP=${IPV6_ROUTER_GW_IP:-2001:db8::1}
+
+# Gateway and subnet defaults, in case they are not customized in localrc
+NETWORK_GATEWAY=${NETWORK_GATEWAY:-10.0.0.1}
+PUBLIC_NETWORK_GATEWAY=${PUBLIC_NETWORK_GATEWAY:-172.24.4.1}
+PRIVATE_SUBNET_NAME=${PRIVATE_SUBNET_NAME:-"private-subnet"}
+PUBLIC_SUBNET_NAME=${PUBLIC_SUBNET_NAME:-"public-subnet"}
+
+# Subnetpool defaults
+SUBNETPOOL_NAME=${SUBNETPOOL_NAME:-"shared-default-subnetpool"}
+
+SUBNETPOOL_PREFIX_V4=${SUBNETPOOL_PREFIX_V4:-10.0.0.0/8}
+SUBNETPOOL_PREFIX_V6=${SUBNETPOOL_PREFIX_V6:-2001:db8:8000::/48}
+
+SUBNETPOOL_SIZE_V4=${SUBNETPOOL_SIZE_V4:-24}
+SUBNETPOOL_SIZE_V6=${SUBNETPOOL_SIZE_V6:-64}
+
+function _determine_config_l3 {
+    local opts="--config-file $NEUTRON_CONF --config-file=$Q_L3_CONF_FILE"
+    echo "$opts"
+}
+
+function _configure_neutron_l3_agent {
+    local cfg_file
+    Q_L3_ENABLED=True
+
+    cp $NEUTRON_DIR/etc/l3_agent.ini.sample $Q_L3_CONF_FILE
+
+    iniset $Q_L3_CONF_FILE DEFAULT verbose True
+    iniset $Q_L3_CONF_FILE DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
+    iniset $Q_L3_CONF_FILE DEFAULT use_namespaces $Q_USE_NAMESPACE
+    iniset $Q_L3_CONF_FILE DEFAULT root_helper "$Q_RR_COMMAND"
+    if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
+        iniset $Q_L3_CONF_FILE agent root_helper_daemon "$Q_RR_DAEMON_COMMAND"
+    fi
+
+    _neutron_setup_interface_driver $Q_L3_CONF_FILE
+
+    neutron_plugin_configure_l3_agent
+
+    if [[ $(ip -f inet a s dev "$PUBLIC_INTERFACE" | grep -c 'global') != 0 ]]; then
+        _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" True "inet"
+    fi
+
+    if [[ $(ip -f inet6 a s dev "$PUBLIC_INTERFACE" | grep -c 'global') != 0 ]]; then
+        _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" False "inet6"
+    fi
+}
+
+# Explicitly set router id in l3 agent configuration
+function _neutron_set_router_id {
+    if [[ "$Q_L3_ROUTER_PER_TENANT" == "False" ]]; then
+        iniset $Q_L3_CONF_FILE DEFAULT router_id $ROUTER_ID
+    fi
+}
+
+# Get ext_gw_interface depending on value of Q_USE_PUBLIC_VETH
+function _neutron_get_ext_gw_interface {
+    if [[ "$Q_USE_PUBLIC_VETH" == "True" ]]; then
+        echo $Q_PUBLIC_VETH_EX
+    else
+        # Disable in-band as we are going to use local port
+        # to communicate with VMs
+        sudo ovs-vsctl set Bridge $PUBLIC_BRIDGE \
+            other_config:disable-in-band=true
+        echo $PUBLIC_BRIDGE
+    fi
+}
+
+function create_neutron_initial_network {
+    local project_id
+    project_id=$(openstack project list | grep " demo " | get_field 1)
+    die_if_not_set $LINENO project_id "Failure retrieving project_id for demo"
+
+    # Allow drivers that need to create an initial network to do so here
+    if type -p neutron_plugin_create_initial_network_profile > /dev/null; then
+        neutron_plugin_create_initial_network_profile $PHYSICAL_NETWORK
+    fi
+
+    if is_provider_network; then
+        die_if_not_set $LINENO PHYSICAL_NETWORK "You must specify the PHYSICAL_NETWORK"
+        die_if_not_set $LINENO PROVIDER_NETWORK_TYPE "You must specify the PROVIDER_NETWORK_TYPE"
+        NET_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" net-create $PHYSICAL_NETWORK --tenant_id $project_id --provider:network_type $PROVIDER_NETWORK_TYPE --provider:physical_network "$PHYSICAL_NETWORK" ${SEGMENTATION_ID:+--provider:segmentation_id $SEGMENTATION_ID} --shared | grep ' id ' | get_field 2)
+        die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PHYSICAL_NETWORK $project_id"
+
+        if [[ "$IP_VERSION" =~ 4.* ]]; then
+            SUBNET_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create --tenant_id $project_id --ip_version 4 ${ALLOCATION_POOL:+--allocation-pool $ALLOCATION_POOL} --name $PROVIDER_SUBNET_NAME --gateway $NETWORK_GATEWAY $NET_ID $FIXED_RANGE | grep ' id ' | get_field 2)
+            die_if_not_set $LINENO SUBNET_ID "Failure creating SUBNET_ID for $PROVIDER_SUBNET_NAME $project_id"
+        fi
+
+        if [[ "$IP_VERSION" =~ .*6 ]] && [[ -n "$IPV6_PROVIDER_FIXED_RANGE" ]] && [[ -n "$IPV6_PROVIDER_NETWORK_GATEWAY" ]]; then
+            SUBNET_V6_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create --tenant_id $project_id --ip_version 6 --ipv6-address-mode $IPV6_ADDRESS_MODE --gateway $IPV6_PROVIDER_NETWORK_GATEWAY --name $IPV6_PROVIDER_SUBNET_NAME $NET_ID $IPV6_PROVIDER_FIXED_RANGE | grep 'id' | get_field 2)
+            die_if_not_set $LINENO SUBNET_V6_ID "Failure creating SUBNET_V6_ID for $IPV6_PROVIDER_SUBNET_NAME $project_id"
+        fi
+
+        if [[ $Q_AGENT == "openvswitch" ]]; then
+            sudo ip link set $OVS_PHYSICAL_BRIDGE up
+            sudo ip link set br-int up
+            sudo ip link set $PUBLIC_INTERFACE up
+        fi
+    else
+        NET_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" net-create --tenant-id $project_id "$PRIVATE_NETWORK_NAME" | grep ' id ' | get_field 2)
+        die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PRIVATE_NETWORK_NAME $project_id"
+
+        if [[ "$IP_VERSION" =~ 4.* ]]; then
+            # Create IPv4 private subnet
+            SUBNET_ID=$(_neutron_create_private_subnet_v4 $project_id)
+        fi
+
+        if [[ "$IP_VERSION" =~ .*6 ]]; then
+            # Create IPv6 private subnet
+            IPV6_SUBNET_ID=$(_neutron_create_private_subnet_v6 $project_id)
+        fi
+    fi
+
+    AUTO_ALLOCATE_EXT=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" ext-list | grep 'auto-allocated-topology' | get_field 1)
+    SUBNETPOOL_EXT=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" ext-list | grep 'subnet_allocation' | get_field 1)
+    if [[ "$Q_L3_ENABLED" == "True" ]]; then
+        # Create a router, and add the private subnet as one of its interfaces
+        if [[ "$Q_L3_ROUTER_PER_TENANT" == "True" ]]; then
+            # create a tenant-owned router.
+            ROUTER_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" router-create --tenant-id $project_id $Q_ROUTER_NAME | grep ' id ' | get_field 2)
+            die_if_not_set $LINENO ROUTER_ID "Failure creating ROUTER_ID for $project_id $Q_ROUTER_NAME"
+        else
+            # Plugin only supports creating a single router, which should be admin owned.
+            ROUTER_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" router-create $Q_ROUTER_NAME | grep ' id ' | get_field 2)
+            die_if_not_set $LINENO ROUTER_ID "Failure creating ROUTER_ID for $Q_ROUTER_NAME"
+        fi
+
+        # if the extension is available, then mark the external
+        # network as default, and provision default subnetpools
+        EXTERNAL_NETWORK_FLAGS="--router:external"
+        if [[ -n $AUTO_ALLOCATE_EXT && -n $SUBNETPOOL_EXT ]]; then
+            EXTERNAL_NETWORK_FLAGS="$EXTERNAL_NETWORK_FLAGS --is-default"
+            if [[ "$IP_VERSION" =~ 4.* ]]; then
+                SUBNETPOOL_V4_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnetpool-create $SUBNETPOOL_NAME --default-prefixlen $SUBNETPOOL_SIZE_V4 --pool-prefix $SUBNETPOOL_PREFIX_V4 --shared --is-default=True | grep ' id ' | get_field 2)
+            fi
+            if [[ "$IP_VERSION" =~ .*6 ]]; then
+                SUBNETPOOL_V6_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnetpool-create $SUBNETPOOL_NAME --default-prefixlen $SUBNETPOOL_SIZE_V6 --pool-prefix $SUBNETPOOL_PREFIX_V6 --shared --is-default=True | grep ' id ' | get_field 2)
+            fi
+        fi
+        # Create an external network, and a subnet. Configure the external network as router gw
+        if [ "$Q_USE_PROVIDERNET_FOR_PUBLIC" = "True" ]; then
+            EXT_NET_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" net-create "$PUBLIC_NETWORK_NAME" -- $EXTERNAL_NETWORK_FLAGS --provider:network_type=flat --provider:physical_network=${PUBLIC_PHYSICAL_NETWORK} | grep ' id ' | get_field 2)
+        else
+            EXT_NET_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" net-create "$PUBLIC_NETWORK_NAME" -- $EXTERNAL_NETWORK_FLAGS | grep ' id ' | get_field 2)
+        fi
+        die_if_not_set $LINENO EXT_NET_ID "Failure creating EXT_NET_ID for $PUBLIC_NETWORK_NAME"
+
+        if [[ "$IP_VERSION" =~ 4.* ]]; then
+            # Configure router for IPv4 public access
+            _neutron_configure_router_v4
+        fi
+
+        if [[ "$IP_VERSION" =~ .*6 ]]; then
+            # Configure router for IPv6 public access
+            _neutron_configure_router_v6
+        fi
+    fi
+}
+
+# Create private IPv4 subnet
+function _neutron_create_private_subnet_v4 {
+    local project_id=$1
+    local subnet_params="--tenant-id $project_id "
+    subnet_params+="--ip_version 4 "
+    subnet_params+="--gateway $NETWORK_GATEWAY "
+    subnet_params+="--name $PRIVATE_SUBNET_NAME "
+    subnet_params+="$NET_ID $FIXED_RANGE"
+    local subnet_id
+    subnet_id=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create $subnet_params | grep ' id ' | get_field 2)
+    die_if_not_set $LINENO subnet_id "Failure creating private IPv4 subnet for $project_id"
+    echo $subnet_id
+}
+
+# Create private IPv6 subnet
+function _neutron_create_private_subnet_v6 {
+    local project_id=$1
+    die_if_not_set $LINENO IPV6_RA_MODE "IPV6 RA Mode not set"
+    die_if_not_set $LINENO IPV6_ADDRESS_MODE "IPV6 Address Mode not set"
+    local ipv6_modes="--ipv6-ra-mode $IPV6_RA_MODE --ipv6-address-mode $IPV6_ADDRESS_MODE"
+    local subnet_params="--tenant-id $project_id "
+    subnet_params+="--ip_version 6 "
+    subnet_params+="--gateway $IPV6_PRIVATE_NETWORK_GATEWAY "
+    subnet_params+="--name $IPV6_PRIVATE_SUBNET_NAME "
+    subnet_params+="$NET_ID $FIXED_RANGE_V6 $ipv6_modes"
+    local ipv6_subnet_id
+    ipv6_subnet_id=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create $subnet_params | grep ' id ' | get_field 2)
+    die_if_not_set $LINENO ipv6_subnet_id "Failure creating private IPv6 subnet for $project_id"
+    echo $ipv6_subnet_id
+}
+
+# Create public IPv4 subnet
+function _neutron_create_public_subnet_v4 {
+    local subnet_params+="--ip_version 4 "
+    subnet_params+="${Q_FLOATING_ALLOCATION_POOL:+--allocation-pool $Q_FLOATING_ALLOCATION_POOL} "
+    subnet_params+="--gateway $PUBLIC_NETWORK_GATEWAY "
+    subnet_params+="--name $PUBLIC_SUBNET_NAME "
+    subnet_params+="$EXT_NET_ID $FLOATING_RANGE "
+    subnet_params+="-- --enable_dhcp=False"
+    local id_and_ext_gw_ip
+    id_and_ext_gw_ip=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create $subnet_params | grep -e 'gateway_ip' -e ' id ')
+    die_if_not_set $LINENO id_and_ext_gw_ip "Failure creating public IPv4 subnet"
+    echo $id_and_ext_gw_ip
+}
+
+# Create public IPv6 subnet
+function _neutron_create_public_subnet_v6 {
+    local subnet_params="--ip_version 6 "
+    subnet_params+="--gateway $IPV6_PUBLIC_NETWORK_GATEWAY "
+    subnet_params+="--name $IPV6_PUBLIC_SUBNET_NAME "
+    subnet_params+="$EXT_NET_ID $IPV6_PUBLIC_RANGE "
+    subnet_params+="-- --enable_dhcp=False"
+    local ipv6_id_and_ext_gw_ip
+    ipv6_id_and_ext_gw_ip=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create $subnet_params | grep -e 'gateway_ip' -e ' id ')
+    die_if_not_set $LINENO ipv6_id_and_ext_gw_ip "Failure creating an IPv6 public subnet"
+    echo $ipv6_id_and_ext_gw_ip
+}
+
+# Configure neutron router for IPv4 public access
+function _neutron_configure_router_v4 {
+    neutron --os-cloud devstack-admin --os-region "$REGION_NAME" router-interface-add $ROUTER_ID $SUBNET_ID
+    # Create a public subnet on the external network
+    local id_and_ext_gw_ip
+    id_and_ext_gw_ip=$(_neutron_create_public_subnet_v4 $EXT_NET_ID)
+    local ext_gw_ip
+    ext_gw_ip=$(echo $id_and_ext_gw_ip  | get_field 2)
+    PUB_SUBNET_ID=$(echo $id_and_ext_gw_ip | get_field 5)
+    # Configure the external network as the default router gateway
+    neutron --os-cloud devstack-admin --os-region "$REGION_NAME" router-gateway-set $ROUTER_ID $EXT_NET_ID
+
+    # This logic is specific to using the l3-agent for layer 3
+    if is_service_enabled q-l3; then
+        # Configure and enable public bridge
+        local ext_gw_interface="none"
+        if is_neutron_ovs_base_plugin; then
+            ext_gw_interface=$(_neutron_get_ext_gw_interface)
+        elif [[ "$Q_AGENT" = "linuxbridge" ]]; then
+            # Search for the brq device the neutron router and network for $FIXED_RANGE
+            # will be using.
+            # e.x. brq3592e767-da for NET_ID 3592e767-da66-4bcb-9bec-cdb03cd96102
+            ext_gw_interface=brq${EXT_NET_ID:0:11}
+        fi
+        if [[ "$ext_gw_interface" != "none" ]]; then
+            local cidr_len=${FLOATING_RANGE#*/}
+            local testcmd="ip -o link | grep -q $ext_gw_interface"
+            test_with_retry "$testcmd" "$ext_gw_interface creation failed"
+            if [[ $(ip addr show dev $ext_gw_interface | grep -c $ext_gw_ip) == 0 && ( $Q_USE_PROVIDERNET_FOR_PUBLIC == "False" || $Q_USE_PUBLIC_VETH == "True" ) ]]; then
+                sudo ip addr add $ext_gw_ip/$cidr_len dev $ext_gw_interface
+                sudo ip link set $ext_gw_interface up
+            fi
+            ROUTER_GW_IP=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" port-list -c fixed_ips -c device_owner | grep router_gateway | awk -F'ip_address'  '{ print $2 }' | cut -f3 -d\" | tr '\n' ' ')
+            die_if_not_set $LINENO ROUTER_GW_IP "Failure retrieving ROUTER_GW_IP"
+            sudo ip route replace  $FIXED_RANGE via $ROUTER_GW_IP
+        fi
+        _neutron_set_router_id
+    fi
+}
+
+# Configure neutron router for IPv6 public access
+function _neutron_configure_router_v6 {
+    neutron --os-cloud devstack-admin --os-region "$REGION_NAME" router-interface-add $ROUTER_ID $IPV6_SUBNET_ID
+    # Create a public subnet on the external network
+    local ipv6_id_and_ext_gw_ip
+    ipv6_id_and_ext_gw_ip=$(_neutron_create_public_subnet_v6 $EXT_NET_ID)
+    local ipv6_ext_gw_ip
+    ipv6_ext_gw_ip=$(echo $ipv6_id_and_ext_gw_ip | get_field 2)
+    local ipv6_pub_subnet_id
+    ipv6_pub_subnet_id=$(echo $ipv6_id_and_ext_gw_ip | get_field 5)
+
+    # If the external network has not already been set as the default router
+    # gateway when configuring an IPv4 public subnet, do so now
+    if [[ "$IP_VERSION" == "6" ]]; then
+        neutron --os-cloud devstack-admin --os-region "$REGION_NAME" router-gateway-set $ROUTER_ID $EXT_NET_ID
+    fi
+
+    # This logic is specific to using the l3-agent for layer 3
+    if is_service_enabled q-l3; then
+        # Ensure IPv6 forwarding is enabled on the host
+        sudo sysctl -w net.ipv6.conf.all.forwarding=1
+        # Configure and enable public bridge
+        # Override global IPV6_ROUTER_GW_IP with the true value from neutron
+        IPV6_ROUTER_GW_IP=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" port-list -c fixed_ips | grep $ipv6_pub_subnet_id | awk -F'ip_address' '{ print $2 }' | cut -f3 -d\" | tr '\n' ' ')
+        die_if_not_set $LINENO IPV6_ROUTER_GW_IP "Failure retrieving IPV6_ROUTER_GW_IP"
+
+        if is_neutron_ovs_base_plugin; then
+            local ext_gw_interface
+            ext_gw_interface=$(_neutron_get_ext_gw_interface)
+            local ipv6_cidr_len=${IPV6_PUBLIC_RANGE#*/}
+
+            # Configure interface for public bridge
+            sudo ip -6 addr add $ipv6_ext_gw_ip/$ipv6_cidr_len dev $ext_gw_interface
+            sudo ip -6 route replace $FIXED_RANGE_V6 via $IPV6_ROUTER_GW_IP dev $ext_gw_interface
+        fi
+        _neutron_set_router_id
+    fi
+}
diff --git a/lib/template b/lib/template
index 08d10bbf71..b92fb40483 100644
--- a/lib/template
+++ b/lib/template
@@ -35,8 +35,8 @@ XXXX_DIR=$DEST/XXXX
 XXX_CONF_DIR=/etc/XXXX
 
 
-# Entry Points
-# ------------
+# Functions
+# ---------
 
 # Test if any XXXX services are enabled
 # is_XXXX_enabled
@@ -62,6 +62,11 @@ function configure_XXXX {
     :
 }
 
+# create_XXXX_accounts() - Create required service accounts
+function create_XXXX_accounts {
+    :
+}
+
 # init_XXXX() - Initialize databases, etc.
 function init_XXXX {
     # clean up from previous (possibly aborted) runs
diff --git a/stack.sh b/stack.sh
index 3de9af2725..760f4f273d 100755
--- a/stack.sh
+++ b/stack.sh
@@ -559,6 +559,7 @@ source $TOP_DIR/lib/nova
 source $TOP_DIR/lib/cinder
 source $TOP_DIR/lib/swift
 source $TOP_DIR/lib/heat
+source $TOP_DIR/lib/neutron
 source $TOP_DIR/lib/neutron-legacy
 source $TOP_DIR/lib/ldap
 source $TOP_DIR/lib/dstat
@@ -1075,7 +1076,7 @@ if is_service_enabled neutron; then
 
     configure_neutron
     # Run init_neutron only on the node hosting the Neutron API server
-    if is_service_enabled $DATABASE_BACKENDS && is_service_enabled q-svc; then
+    if is_service_enabled $DATABASE_BACKENDS && is_service_enabled neutron; then
         init_neutron
     fi
 fi
@@ -1142,7 +1143,7 @@ if is_service_enabled nova; then
 
     # Additional Nova configuration that is dependent on other services
     if is_service_enabled neutron; then
-        create_nova_conf_neutron
+        configure_neutron_nova
     elif is_service_enabled n-net; then
         create_nova_conf_nova_network
     fi
@@ -1219,7 +1220,11 @@ if is_service_enabled n-api; then
     start_nova_api
 fi
 
-if is_service_enabled q-svc; then
+if is_service_enabled neutron-api; then
+    echo_summary "Starting Neutron"
+    start_neutron_api
+    # check_neutron_third_party_integration
+elif is_service_enabled q-svc; then
     echo_summary "Starting Neutron"
     start_neutron_service_and_check
     check_neutron_third_party_integration
@@ -1240,7 +1245,7 @@ elif is_service_enabled $DATABASE_BACKENDS && is_service_enabled n-net; then
 fi
 
 if is_service_enabled neutron; then
-    start_neutron_agents
+    start_neutron
 fi
 # Once neutron agents are started setup initial network elements
 if is_service_enabled q-svc && [[ "$NEUTRON_CREATE_INITIAL_NETWORKS" == "True" ]]; then
@@ -1248,6 +1253,7 @@ if is_service_enabled q-svc && [[ "$NEUTRON_CREATE_INITIAL_NETWORKS" == "True" ]
     create_neutron_initial_network
     setup_neutron_debug
 fi
+
 if is_service_enabled nova; then
     echo_summary "Starting Nova"
     start_nova
diff --git a/unstack.sh b/unstack.sh
index 83703ec28a..a69b2187ce 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -66,6 +66,7 @@ source $TOP_DIR/lib/nova
 source $TOP_DIR/lib/cinder
 source $TOP_DIR/lib/swift
 source $TOP_DIR/lib/heat
+source $TOP_DIR/lib/neutron
 source $TOP_DIR/lib/neutron-legacy
 source $TOP_DIR/lib/ldap
 source $TOP_DIR/lib/dstat

From f5a50a0fa6235c0e18984244a501292806704a16 Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Tue, 10 May 2016 14:56:12 +0200
Subject: [PATCH 0428/2409] lib/tempest: stop using deprecated config option.

Use the new name instead.

Change-Id: I31f83ec70b8803a29a7be765661517d890ffd6f1
---
 lib/tempest | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index e556935cb5..2d924fe1fe 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -331,14 +331,14 @@ function configure_tempest {
         tempest_compute_max_microversion=None
     fi
     if [ "$tempest_compute_min_microversion" == "None" ]; then
-        inicomment $TEMPEST_CONFIG compute-feature-enabled min_microversion
+        inicomment $TEMPEST_CONFIG compute min_microversion
     else
-        iniset $TEMPEST_CONFIG compute-feature-enabled min_microversion $tempest_compute_min_microversion
+        iniset $TEMPEST_CONFIG compute min_microversion $tempest_compute_min_microversion
     fi
     if [ "$tempest_compute_max_microversion" == "None" ]; then
-        inicomment $TEMPEST_CONFIG compute-feature-enabled max_microversion
+        inicomment $TEMPEST_CONFIG compute max_microversion
     else
-        iniset $TEMPEST_CONFIG compute-feature-enabled max_microversion $tempest_compute_max_microversion
+        iniset $TEMPEST_CONFIG compute max_microversion $tempest_compute_max_microversion
     fi
 
     iniset $TEMPEST_CONFIG compute-feature-enabled resize True
@@ -374,7 +374,7 @@ function configure_tempest {
 
     # Network
     iniset $TEMPEST_CONFIG network api_version 2.0
-    iniset $TEMPEST_CONFIG network tenant_networks_reachable false
+    iniset $TEMPEST_CONFIG network project_networks_reachable false
     iniset $TEMPEST_CONFIG network public_network_id "$public_network_id"
     iniset $TEMPEST_CONFIG network public_router_id "$public_router_id"
     iniset $TEMPEST_CONFIG network default_network "$FIXED_RANGE"

From 50f22da8958af08a5b1f4ec7e905f3c67d9b69bb Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Tue, 10 May 2016 15:04:44 +0200
Subject: [PATCH 0429/2409] Nova conf:don't use deprecated option "fixed_key"
 from group "keymgr"

That option now lives in the "key_manager" group.

Change-Id: I35c2914eaf2a190d6494107260483a6835de3e47
---
 stack.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/stack.sh b/stack.sh
index 3de9af2725..1ca66b09ba 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1208,9 +1208,9 @@ if is_service_enabled g-reg; then
     done
 fi
 
-# Create a randomized default value for the keymgr's fixed_key
+# Create a randomized default value for the key manager's fixed_key
 if is_service_enabled nova; then
-    iniset $NOVA_CONF keymgr fixed_key $(generate_hex_string 32)
+    iniset $NOVA_CONF key_manager fixed_key $(generate_hex_string 32)
 fi
 
 # Launch the nova-api and wait for it to answer before continuing

From 53b63cc97f84ac3d63f20e7f3ba524cf95c684be Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Thu, 28 Apr 2016 13:33:38 -0500
Subject: [PATCH 0430/2409] Use arping when moving an IP address

This helps fix an issue where an IPv4 address is moved from an interface
and you lose your SSH session.

Change-Id: Idf37ccbaa6f615fcc714d49c3f0c00c893f56021
---
 lib/neutron-legacy | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index f0592e2f37..d2a222117f 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -859,6 +859,13 @@ function _move_neutron_addresses_route {
 
         IP_BRD=$(ip -f $af a s dev $from_intf scope global primary | grep inet | awk '{ print $2, $3, $4; exit }')
 
+        if [[ "$af" == "inet" ]]; then
+            IP=$(echo $IP_BRD | awk '{ print $1; exit }' | grep -o -E '(.*)/' | cut -d "/" -f1)
+            ARP_CMD="arping -A -c 3 -w 4.5 -I $to_intf $IP "
+        else
+            ARP_CMD=""
+        fi
+
         if [ "$DEFAULT_ROUTE_GW" != "" ]; then
             ADD_DEFAULT_ROUTE="sudo ip -f $af r replace default via $DEFAULT_ROUTE_GW dev $to_intf"
         fi
@@ -879,7 +886,7 @@ function _move_neutron_addresses_route {
 
         # The add/del OVS port calls have to happen either before or
         # after the address is moved in order to not leave it orphaned.
-        $DEL_OVS_PORT; $IP_DEL; $IP_ADD; $IP_UP; $ADD_OVS_PORT; $ADD_DEFAULT_ROUTE
+        $DEL_OVS_PORT; $IP_DEL; $IP_ADD; $IP_UP; $ADD_OVS_PORT; $ADD_DEFAULT_ROUTE; $ARP_CMD
     fi
 }
 

From ea76f319a21edc524efeb4de9f49515c9019e8ef Mon Sep 17 00:00:00 2001
From: Chuck Carmack <carmack@us.ibm.com>
Date: Sat, 22 Aug 2015 15:03:27 +0000
Subject: [PATCH 0431/2409] Use LVM_VOLUME_CLEAR if set

There are a few CI efforts going on related to jobs that use the lvm
image backend for the libvirt driver in Nova. We don't want to waste
time zero'ing out volumes during CI runs, so we need a way to configure
nova to not clear the volumes in these jobs.

This change adds a variable used to set the CONF.libvirt.volume_clear
value in nova.conf. If the variable isn't set, Nova just uses the default.

This will be set to 'none' in the jobs that are going to use LVM.

Co-Authored-By: Matt Riedemann <mriedem@us.ibm.com>

Change-Id: I1e97ba6ab4772a87192ae2689a25050d432358ab
---
 lib/nova | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/nova b/lib/nova
index ab2bef8ae0..101288903d 100644
--- a/lib/nova
+++ b/lib/nova
@@ -604,6 +604,9 @@ function create_nova_conf {
     if [[ "$NOVA_BACKEND" == "LVM" ]]; then
         iniset $NOVA_CONF libvirt images_type "lvm"
         iniset $NOVA_CONF libvirt images_volume_group $DEFAULT_VOLUME_GROUP_NAME
+        if isset LVM_VOLUME_CLEAR; then
+            iniset $NOVA_CONF libvirt volume_clear "$LVM_VOLUME_CLEAR"
+        fi
     fi
 
     if is_ssl_enabled_service glance || is_service_enabled tls-proxy; then

From a2ed055810bc3ef22b91faffb7f6308908527be3 Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Wed, 11 May 2016 15:35:10 -0400
Subject: [PATCH 0432/2409] Fix _configure_neutron_l3_agent

I goofed when moving it over, and it looks like the calls
to _move_neutron_addresses_route got clobbered.

Changes like a0d1b0151a9d9e169e6342f36a073e8154119924 ended up getting
dropped on the floor, so let's reintroduce them.

Change-Id: I3bbfbc56e2c663c47a03659a1dff96443c13af47
---
 lib/neutron_plugins/services/l3 | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 177dc1f028..4c4730e125 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -90,29 +90,25 @@ function _determine_config_l3 {
 }
 
 function _configure_neutron_l3_agent {
-    local cfg_file
     Q_L3_ENABLED=True
 
     cp $NEUTRON_DIR/etc/l3_agent.ini.sample $Q_L3_CONF_FILE
 
     iniset $Q_L3_CONF_FILE DEFAULT verbose True
     iniset $Q_L3_CONF_FILE DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-    iniset $Q_L3_CONF_FILE DEFAULT use_namespaces $Q_USE_NAMESPACE
-    iniset $Q_L3_CONF_FILE DEFAULT root_helper "$Q_RR_COMMAND"
+    iniset $Q_L3_CONF_FILE AGENT root_helper "$Q_RR_COMMAND"
     if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
-        iniset $Q_L3_CONF_FILE agent root_helper_daemon "$Q_RR_DAEMON_COMMAND"
+        iniset $Q_L3_CONF_FILE AGENT root_helper_daemon "$Q_RR_DAEMON_COMMAND"
     fi
 
     _neutron_setup_interface_driver $Q_L3_CONF_FILE
 
     neutron_plugin_configure_l3_agent
 
-    if [[ $(ip -f inet a s dev "$PUBLIC_INTERFACE" | grep -c 'global') != 0 ]]; then
-        _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" True "inet"
-    fi
+    _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" True False "inet"
 
     if [[ $(ip -f inet6 a s dev "$PUBLIC_INTERFACE" | grep -c 'global') != 0 ]]; then
-        _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" False "inet6"
+        _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" False False "inet6"
     fi
 }
 

From 5394cc101d06bbd3795a1a7ee0e86298418e6dc2 Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Wed, 11 May 2016 15:03:38 -0400
Subject: [PATCH 0433/2409] Neutron refactor: Fix missing call to init RPC
 backend

Change-Id: I2c7f116230f53d3a2460192bc7b513b2e230c736
---
 lib/neutron | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/neutron b/lib/neutron
index 51c3a006c7..e0f71f585a 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -126,6 +126,8 @@ function configure_neutron_new {
     iniset $NEUTRON_CONF oslo_concurrency lock_path $NEUTRON_STATE_PATH/lock
     iniset $NEUTRON_CONF DEFAULT use_syslog $SYSLOG
 
+    iniset_rpc_backend neutron $NEUTRON_CONF
+
     # Neutron API server & Neutron plugin
     if is_service_enabled neutron-api; then
         local policy_file=$NEUTRON_CONF_DIR/policy.json

From a464ea767a027b3d3c658b8f997f43f91af0349f Mon Sep 17 00:00:00 2001
From: Yi Zhao <zhaoyi@cmss.chinamobile.com>
Date: Thu, 12 May 2016 10:32:58 +0800
Subject: [PATCH 0434/2409] Fix error reported due to re-add ipv6 address

This commit fixes devstack fails when re-stack due to re-add ipv6
address.

Change-Id: I9ff62023dbc29a88aec3c48af331c0a49a1270bb
Closes-Bug: #1579985
---
 lib/neutron_plugins/services/l3 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 177dc1f028..80af0bb190 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -358,7 +358,7 @@ function _neutron_configure_router_v6 {
             local ipv6_cidr_len=${IPV6_PUBLIC_RANGE#*/}
 
             # Configure interface for public bridge
-            sudo ip -6 addr add $ipv6_ext_gw_ip/$ipv6_cidr_len dev $ext_gw_interface
+            sudo ip -6 addr replace $ipv6_ext_gw_ip/$ipv6_cidr_len dev $ext_gw_interface
             sudo ip -6 route replace $FIXED_RANGE_V6 via $IPV6_ROUTER_GW_IP dev $ext_gw_interface
         fi
         _neutron_set_router_id

From 4f4d95a12c5b9de0ea09864c67dcad6a19fb0145 Mon Sep 17 00:00:00 2001
From: "watanabe.isao" <watanabe_isao@jp.fujitsu.com>
Date: Thu, 12 May 2016 20:35:20 +0900
Subject: [PATCH 0435/2409] Add lost function of is_provider_network

This is a follow up patch of [1].
In [1], source has been moved from lib/neutron-legacy to lib/neutron_plugins/services/l3.
However, one necessary function of is_provider_network is lost.
And this cause devstack install fail.

[1]https://review.openstack.org/168438/

Change-Id: I413b3577ec5b11ee0ee01f2368364117962494bb
---
 lib/neutron_plugins/services/l3 | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 4c4730e125..5ff8ea5f69 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -360,3 +360,10 @@ function _neutron_configure_router_v6 {
         _neutron_set_router_id
     fi
 }
+
+function is_provider_network {
+    if [ "$Q_USE_PROVIDER_NETWORKING" == "True" ] && [ "$Q_L3_ENABLED" == "False" ]; then
+        return 0
+    fi
+    return 1
+}

From 0afe207cb346fe7468d073e2358abd2ad9b9d9e8 Mon Sep 17 00:00:00 2001
From: Jens Rosenboom <j.rosenboom@x-ion.de>
Date: Thu, 12 May 2016 14:09:03 +0200
Subject: [PATCH 0436/2409] Create service project in service domain

When creating service users, the assumption is that the service
project lies within the service domain, so create it there.

Change-Id: I4880e789f5eaf340634ceb792397eef12a5a6b51
Closes-Bug: 1580998
---
 lib/keystone | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/keystone b/lib/keystone
index bcd5fab40c..4a0222f970 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -376,7 +376,7 @@ function create_keystone_accounts {
 
     # Create service project/role
     get_or_create_domain "$SERVICE_DOMAIN_NAME"
-    get_or_create_project "$SERVICE_PROJECT_NAME" default
+    get_or_create_project "$SERVICE_PROJECT_NAME" "$SERVICE_DOMAIN_NAME"
 
     # Service role, so service users do not have to be admins
     get_or_create_role service

From 1cd2828da4829649d6af98b4d1eef2d5d5286005 Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Wed, 11 May 2016 15:07:19 -0400
Subject: [PATCH 0437/2409] Neutron refactor: Clarify use of
 neutron-metadata-agent

The commit message of 2a242519f71e86416e78541826cac2b54fcd04a5 indicated
that neutron-metadata-agent was the correct name for the metadata
proxy, but parts of the code were not consistent.

Change-Id: I52f08266a169aeb9005c0f84296fc814d05b90d4
---
 lib/neutron | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index e0f71f585a..e14158383d 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -204,7 +204,7 @@ function configure_neutron_new {
     fi
 
     # Metadata
-    if is_service_enabled neutron-meta; then
+    if is_service_enabled neutron-metadata-agent; then
         cp $NEUTRON_DIR/etc/metadata_agent.ini.sample $NEUTRON_META_CONF
 
         iniset $NEUTRON_META_CONF DEFAULT verbose True
@@ -290,7 +290,7 @@ function configure_neutron_nova_new {
 
     iniset $NOVA_CONF DEFAULT firewall_driver nova.virt.firewall.NoopFirewallDriver
 
-    if is_service_enabled neutron-meta; then
+    if is_service_enabled neutron-metadata-agent; then
         iniset $NOVA_CONF neutron service_metadata_proxy "True"
     fi
 
@@ -425,8 +425,8 @@ function start_neutron_new {
             create_neutron_initial_network
         fi
     fi
-    if is_service_enabled neutron-meta; then
-        run_process neutron-meta "$NEUTRON_BIN_DIR/$NEUTRON_META_BINARY $NEUTRON_CONFIG_ARG"
+    if is_service_enabled neutron-metadata-agent; then
+        run_process neutron-metadata-agent "$NEUTRON_BIN_DIR/$NEUTRON_META_BINARY $NEUTRON_CONFIG_ARG"
     fi
 }
 
@@ -442,9 +442,9 @@ function stop_neutron_new {
         [ ! -z "$pid" ] && sudo kill -9 $pid
     fi
 
-    if is_service_enabled neutron-meta; then
+    if is_service_enabled neutron-metadata-agent; then
         sudo pkill -9 -f neutron-ns-metadata-proxy || :
-        stop_process neutron-meta
+        stop_process neutron-metadata-agent
     fi
 }
 
@@ -470,7 +470,7 @@ function _set_config_files {
         NEUTRON_CONFIG_ARG+=" --config-file $NEUTRON_L3_CONF"
     fi
 
-    if is_service_enabled neutron-meta; then
+    if is_service_enabled neutron-metadata-agent; then
         NEUTRON_CONFIG_ARG+=" --config-file $NEUTRON_META_CONF"
     fi
 

From abde96acd275c71f1ea99fdb1be48db46bc65d93 Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Thu, 12 May 2016 19:26:20 -0400
Subject: [PATCH 0438/2409] Add a deprecation warning for lib/neutron-legacy

This commit adds a deprecation warning for lib/neutron-legacy. Right
now lib/neutron isn't quite in a place where we can use it by default
but we're getting close. As soon as it's passing in the gate we plan
to make a switch over and a hard delete of lib/neutron-legacy. To give
any users which have a hard dependency on it (which is not actually
a supported use case) a heads up this adds the deprecation warning
in front of that change.

Change-Id: Idf1faf2e9dd497f9b97abfcc6e796ca72d60d955
---
 lib/neutron-legacy | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 7eb8637634..a3a0dcc20d 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -61,7 +61,7 @@
 # Neutron Network Configuration
 # -----------------------------
 
-
+deprecated "Using lib/neutron-legacy is deprecated, and it will be removed in the future"
 
 if is_ssl_enabled_service "neutron" || is_service_enabled tls-proxy; then
     Q_PROTOCOL="https"

From d894221457efa3a2a0bf3db76a4c5e8ffba36e29 Mon Sep 17 00:00:00 2001
From: vsaienko <vsaienko@mirantis.com>
Date: Fri, 13 May 2016 12:51:30 +0300
Subject: [PATCH 0439/2409] Replace Q_L3_ENABLED by is_service_enabled q-l3

This patch replaces Q_L3_ENABLED with is_service_enabled q-l3.
Both of them idicates wherever Neutron L3 agent is enabled or not.

Change-Id: I33f0f5a6174d1d170bc2ac1c2e3a096d88d17cc1
---
 doc/source/guides/neutron.rst   | 6 +-----
 lib/neutron_plugins/services/l3 | 9 +++------
 lib/tempest                     | 3 +--
 3 files changed, 5 insertions(+), 13 deletions(-)

diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index a834314bcc..fe6f629235 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -88,7 +88,6 @@ serving as a hypervisor for guest instances.
         FIXED_RANGE="10.0.0.0/24"
         Q_FLOATING_ALLOCATION_POOL=start=172.18.161.250,end=172.18.161.254
         PUBLIC_NETWORK_GATEWAY="172.18.161.1"
-        Q_L3_ENABLED=True
         PUBLIC_INTERFACE=eth0
 
         # Open vSwitch provider networking configuration
@@ -387,7 +386,6 @@ controller node.
         OVS_PHYSICAL_BRIDGE=br-ex
 
         Q_USE_PROVIDER_NETWORKING=True
-        Q_L3_ENABLED=False
 
         # Do not use Nova-Network
         disable_service n-net
@@ -434,13 +432,12 @@ compute node 1.
         OVS_PHYSICAL_BRIDGE=br-ex
         PUBLIC_INTERFACE=eth1
         Q_USE_PROVIDER_NETWORKING=True
-        Q_L3_ENABLED=False
 
 Compute node 2's configuration will be exactly the same, except
 ``HOST_IP`` will be ``10.0.0.4``
 
 When DevStack is configured to use provider networking (via
-``Q_USE_PROVIDER_NETWORKING`` is True and ``Q_L3_ENABLED`` is False) -
+``Q_USE_PROVIDER_NETWORKING`` is True) -
 DevStack will automatically add the network interface defined in
 ``PUBLIC_INTERFACE`` to the ``OVS_PHYSICAL_BRIDGE``
 
@@ -543,7 +540,6 @@ setup, with small modifications for the interface mappings.
     FIXED_RANGE="10.0.0.0/24"
     Q_FLOATING_ALLOCATION_POOL=start=172.18.161.250,end=172.18.161.254
     PUBLIC_NETWORK_GATEWAY="172.18.161.1"
-    Q_L3_ENABLED=True
     PUBLIC_INTERFACE=eth0
 
     Q_USE_PROVIDERNET_FOR_PUBLIC=True
diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 5ff8ea5f69..a5a6c81ea4 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -23,11 +23,9 @@ Q_USE_PUBLIC_VETH=${Q_USE_PUBLIC_VETH:-False}
 Q_PUBLIC_VETH_EX=${Q_PUBLIC_VETH_EX:-veth-pub-ex}
 Q_PUBLIC_VETH_INT=${Q_PUBLIC_VETH_INT:-veth-pub-int}
 
-# The next two variables are configured by plugin
+# The next variable is configured by plugin
 # e.g.  _configure_neutron_l3_agent or lib/neutron_plugins/*
 #
-# The plugin supports L3.
-Q_L3_ENABLED=${Q_L3_ENABLED:-True}
 # L3 routers exist per tenant
 Q_L3_ROUTER_PER_TENANT=${Q_L3_ROUTER_PER_TENANT:-True}
 
@@ -90,7 +88,6 @@ function _determine_config_l3 {
 }
 
 function _configure_neutron_l3_agent {
-    Q_L3_ENABLED=True
 
     cp $NEUTRON_DIR/etc/l3_agent.ini.sample $Q_L3_CONF_FILE
 
@@ -180,7 +177,7 @@ function create_neutron_initial_network {
 
     AUTO_ALLOCATE_EXT=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" ext-list | grep 'auto-allocated-topology' | get_field 1)
     SUBNETPOOL_EXT=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" ext-list | grep 'subnet_allocation' | get_field 1)
-    if [[ "$Q_L3_ENABLED" == "True" ]]; then
+    if is_service_enabled q-l3; then
         # Create a router, and add the private subnet as one of its interfaces
         if [[ "$Q_L3_ROUTER_PER_TENANT" == "True" ]]; then
             # create a tenant-owned router.
@@ -362,7 +359,7 @@ function _neutron_configure_router_v6 {
 }
 
 function is_provider_network {
-    if [ "$Q_USE_PROVIDER_NETWORKING" == "True" ] && [ "$Q_L3_ENABLED" == "False" ]; then
+    if [ "$Q_USE_PROVIDER_NETWORKING" == "True" ]; then
         return 0
     fi
     return 1
diff --git a/lib/tempest b/lib/tempest
index e556935cb5..298d030e68 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -16,7 +16,6 @@
 #   - ``BASE_SQL_CONN`` ``lib/database`` declares
 #   - ``PUBLIC_NETWORK_NAME``
 #   - ``Q_ROUTER_NAME``
-#   - ``Q_L3_ENABLED``
 #   - ``VIRT_DRIVER``
 #   - ``LIBVIRT_TYPE``
 #   - ``KEYSTONE_SERVICE_PROTOCOL``, ``KEYSTONE_SERVICE_HOST`` from lib/keystone
@@ -239,7 +238,7 @@ function configure_tempest {
 
     ssh_connect_method=${TEMPEST_SSH_CONNECT_METHOD:-$ssh_connect_method}
 
-    if [ "$Q_L3_ENABLED" = "True" ]; then
+    if is_service_enabled q-l3; then
         public_network_id=$(neutron net-list | grep $PUBLIC_NETWORK_NAME | \
             awk '{print $2}')
     fi

From 958c169d796ab82521b69b35a13ee27037e68e97 Mon Sep 17 00:00:00 2001
From: Brian Ober <bober@us.ibm.com>
Date: Wed, 11 May 2016 19:11:31 -0500
Subject: [PATCH 0440/2409] Enable Swift Account Management

This patch enables account management by default in Swift.  This will be
leveraged by Tempest test cases validating account management APIs.

Depends-On: Id29f5ca48f92cd139535be7064107b8a61b02856
Change-Id: Ic01432939ed9b4cf0cbf20e3244d4d76847f539f
---
 lib/swift | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/swift b/lib/swift
index 8cb94efa66..950b3f20c0 100644
--- a/lib/swift
+++ b/lib/swift
@@ -428,6 +428,7 @@ function configure_swift {
     sed -i "/^pipeline/ { s/proxy-server/${SWIFT_EXTRAS_MIDDLEWARE_LAST} proxy-server/ ; }" ${SWIFT_CONFIG_PROXY_SERVER}
 
     iniset ${SWIFT_CONFIG_PROXY_SERVER} app:proxy-server account_autocreate true
+    iniset ${SWIFT_CONFIG_PROXY_SERVER} app:proxy-server allow_account_management true
 
     # Configure Crossdomain
     iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:crossdomain use "egg:swift#crossdomain"

From 46f8cb7f208d00f89863cf57f2400309cf8f6bd4 Mon Sep 17 00:00:00 2001
From: Marc Koderer <marc@koderer.com>
Date: Fri, 13 May 2016 09:08:16 +0200
Subject: [PATCH 0441/2409] Add option to download all libs from git

For client debugging that invokes multiple libs it can be useful
to have all libs directly in git and not listing all of them
in LIBS_FROM_GIT.

TrivialFix

Change-Id: Ie631cc4045231ebbe8177d2d113e47e4bf83f61c
---
 doc/source/configuration.rst | 3 +++
 inc/python                   | 2 +-
 stackrc                      | 3 +++
 3 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 1f5797c22d..384ceee41a 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -427,6 +427,9 @@ can be specified as a comma separated list.
 
       LIBS_FROM_GIT=python-keystoneclient,oslo.config
 
+Setting the variable to ``ALL`` will activate the download for all
+libraries.
+
 Virtual Environments
 --------------------
 
diff --git a/inc/python b/inc/python
index 495150d4b8..e013dfab36 100644
--- a/inc/python
+++ b/inc/python
@@ -192,7 +192,7 @@ function get_from_global_requirements {
 function use_library_from_git {
     local name=$1
     local enabled=1
-    [[ ,${LIBS_FROM_GIT}, =~ ,${name}, ]] && enabled=0
+    [[ ${LIBS_FROM_GIT} = 'ALL' ]] || [[ ,${LIBS_FROM_GIT}, =~ ,${name}, ]] && enabled=0
     return $enabled
 }
 
diff --git a/stackrc b/stackrc
index 4ba57c9cb6..8e1900dd94 100644
--- a/stackrc
+++ b/stackrc
@@ -208,6 +208,9 @@ REQUIREMENTS_DIR=$DEST/requirements
 # ex: LIBS_FROM_GIT=python-keystoneclient,oslo.config
 #
 # Will install those 2 libraries from git, the rest from pypi.
+#
+# Setting the variable to 'ALL' will activate the download for all
+# libraries.
 
 
 ##############

From 69d3b79e03e0ba4c9679bcb5279b226b9606e1ff Mon Sep 17 00:00:00 2001
From: bhargavaregalla <br983u@att.com>
Date: Tue, 17 May 2016 09:34:26 +0100
Subject: [PATCH 0442/2409] Wrong container name in devstack "All-In-One Single
 LXC Container" manual.

Wrong container name in devstack "All-In-One Single LXC Container" manual.

Link: http://docs.openstack.org/developer/devstack/guides/lxc.html

After creating "devstack" container with below command
sudo lxc-create -n devstack -t ubuntu -f devstack-lxc.conf -- --packages=bsdmainutils,git

The name should be 'devstack' instead of 'p2' in the below command
ssh ubuntu@$(sudo lxc-info -n p2 | awk '/IP/ { print $2 }')).

Change-Id: I7a84b97b03b2dd4338f1d946b7eafb8ec6e3767d
Closes-bug: #1582248
---
 doc/source/guides/lxc.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/guides/lxc.rst b/doc/source/guides/lxc.rst
index a719d605aa..9549ed2974 100644
--- a/doc/source/guides/lxc.rst
+++ b/doc/source/guides/lxc.rst
@@ -88,7 +88,7 @@ You can login using the username ``ubuntu`` and password ``ubuntu``.
 
 You can also ssh into your container. On your host, run
 ``sudo lxc-info -n devstack`` to get the IP address (e.g. 
-``ssh ubuntu@$(sudo lxc-info -n p2 | awk '/IP/ { print $2 }')``).
+``ssh ubuntu@$(sudo lxc-info -n devstack | awk '/IP/ { print $2 }')``).
 
 Run Devstack
 -------------

From 53f59d802f9cc76bf898509344463d8ff3a32143 Mon Sep 17 00:00:00 2001
From: Armando Migliaccio <armamig@gmail.com>
Date: Tue, 17 May 2016 15:12:24 -0700
Subject: [PATCH 0443/2409] Use Neutron extension information to configure
 Tempest's public network

Neutron L3 may implement a variety of extensions: router, external-net,
dvr, ext-gw-mode, extraroute, l3-ha, etc. The public network uuid is
only going to be made available if and only if the external-net extension
is available, because that's the one that provides Floating IP support.

Rather than making Tempest aware of q-l3 service (when q-* services
are supposed to be legacy), it is better to tune this configuration
based on the extension availability. This decouples Tempest from
Neutron setup internals.

Change-Id: I4889fc3d21bd221785b507995f1b3da0e8f52b46
Related-bug: 1582119
---
 lib/tempest | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index cce541cdf0..d4d8cf25df 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -238,7 +238,10 @@ function configure_tempest {
 
     ssh_connect_method=${TEMPEST_SSH_CONNECT_METHOD:-$ssh_connect_method}
 
-    if is_service_enabled q-l3; then
+    # the public network (for floating ip access) is only available
+    # if the extension is enabled.
+    EXTERNAL_NETWORK_EXT=$(neutron ext-list | grep 'external-net' | get_field 1)
+    if [[ -n $EXTERNAL_NETWORK_EXT ]]; then
         public_network_id=$(neutron net-list | grep $PUBLIC_NETWORK_NAME | \
             awk '{print $2}')
     fi

From bda194adb97ba2bc9b45e91b35ff393378095ea6 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Wed, 18 May 2016 10:42:56 +1000
Subject: [PATCH 0444/2409] Skip EPEL & RDO install for CI nodes

If the nodepool info file is around, assume we're on a OpenStack CI
node and skip re-installing EPEL & RDO

Change-Id: Ife80af015b26514098e0633f568e3da35b9eea8c
---
 stack.sh | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/stack.sh b/stack.sh
index 21f7f35f35..9944d6de9e 100755
--- a/stack.sh
+++ b/stack.sh
@@ -335,6 +335,13 @@ fi
 # to speed things up
 SKIP_EPEL_INSTALL=$(trueorfalse False SKIP_EPEL_INSTALL)
 
+# If we have /etc/nodepool/provider assume we're on a OpenStack CI
+# node, where EPEL is already pointing at our internal mirror and RDO
+# is pre-installed.
+if [[ -f /etc/nodepool/provider ]]; then
+    SKIP_EPEL_INSTALL=True
+fi
+
 if is_fedora && [[ $DISTRO == "rhel7" ]] && \
         [[ ${SKIP_EPEL_INSTALL} != True ]]; then
     _install_epel_and_rdo

From bcfaa0730e2103c65fe5409db8cc5220d3170523 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Wed, 18 May 2016 06:50:13 +0000
Subject: [PATCH 0445/2409] Updated from generate-devstack-plugins-list

Change-Id: Ia1ed75b563ee9aabf6b70e0506d8965ca3df6c0a
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index a2721b4172..cf9c8735f8 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -30,6 +30,7 @@ aodh                                   `git://git.openstack.org/openstack/aodh <
 app-catalog-ui                         `git://git.openstack.org/openstack/app-catalog-ui <https://git.openstack.org/cgit/openstack/app-catalog-ui>`__
 astara                                 `git://git.openstack.org/openstack/astara <https://git.openstack.org/cgit/openstack/astara>`__
 barbican                               `git://git.openstack.org/openstack/barbican <https://git.openstack.org/cgit/openstack/barbican>`__
+bilean                                 `git://git.openstack.org/openstack/bilean <https://git.openstack.org/cgit/openstack/bilean>`__
 blazar                                 `git://git.openstack.org/openstack/blazar <https://git.openstack.org/cgit/openstack/blazar>`__
 broadview-collector                    `git://git.openstack.org/openstack/broadview-collector <https://git.openstack.org/cgit/openstack/broadview-collector>`__
 ceilometer                             `git://git.openstack.org/openstack/ceilometer <https://git.openstack.org/cgit/openstack/ceilometer>`__

From e7d2b563918c9fdb06bd1635cb391d1888336839 Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Thu, 12 May 2016 12:04:03 -0400
Subject: [PATCH 0446/2409] Always pass $NEUTRON_CONF

When running a compute node that only runs n-cpu and neutron-agent,
there are still configuration items that are needed by the agent that
reside in $NEUTRON_CONF - such as the rabbit rpc information.

Change-Id: Ib7f5dde3afb0c19dc88f351c99bc669217952a14
---
 lib/neutron | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index e14158383d..fa2e926995 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -451,11 +451,7 @@ function stop_neutron_new {
 # Compile the lost of enabled config files
 function _set_config_files {
 
-    #TODO(sc68cal) - see if we can clean up this and only
-    # pass in config files that make sense for certain agents
-    if is_service_enabled neutron-api; then
-        NEUTRON_CONFIG_ARG+=" --config-file $NEUTRON_CONF"
-    fi
+    NEUTRON_CONFIG_ARG+=" --config-file $NEUTRON_CONF"
 
     #TODO(sc68cal) OVS and LB agent uses settings in NEUTRON_PLUGIN_CONF (ml2_conf.ini) but others may not
     if is_service_enabled neutron-agent; then

From 17398a3de3fc993b47f8a8fe8af669dbbfa21625 Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Wed, 11 May 2016 18:24:46 +0000
Subject: [PATCH 0447/2409] Make ARP_CMD local

Change-Id: Iaa540f7685197a17f1db4c3351373a6d77a80105
---
 lib/neutron-legacy | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 7eb8637634..af0e743fb3 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -621,14 +621,13 @@ function _move_neutron_addresses_route {
         DEFAULT_ROUTE_GW=$(ip -f $af r | awk "/default.+$from_intf/ { print \$3; exit }")
         local ADD_OVS_PORT=""
         local DEL_OVS_PORT=""
+        local ARP_CMD=""
 
         IP_BRD=$(ip -f $af a s dev $from_intf scope global primary | grep inet | awk '{ print $2, $3, $4; exit }')
 
         if [[ "$af" == "inet" ]]; then
             IP=$(echo $IP_BRD | awk '{ print $1; exit }' | grep -o -E '(.*)/' | cut -d "/" -f1)
             ARP_CMD="arping -A -c 3 -w 4.5 -I $to_intf $IP "
-        else
-            ARP_CMD=""
         fi
 
         if [ "$DEFAULT_ROUTE_GW" != "" ]; then

From 153db269705f37d4144ad3fcf26dc67269755d7d Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Wed, 18 May 2016 14:05:14 +0000
Subject: [PATCH 0448/2409] Revert "Switch fernet to be the default token
 provider"

This reverts commit 181588b9ba50fefea12617a9a5e774daddfed20c.

Since this change landed on 4/29 it's been the cause of the
top two gate failures (besides known latent infra issues) and
hasn't had good progress on landing a fix, so until it's a
priority for the keystone team we need to revert this change
to get the integrated gate jobs moving again.

Change-Id: I588a84c5179eab072d21bc1394aea2df00929650
Related-Bug: #1577558
Related-Bug: #1578866
---
 lib/keystone | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/keystone b/lib/keystone
index 49d819e500..d83092405b 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -89,7 +89,7 @@ KEYSTONE_RESOURCE_BACKEND=${KEYSTONE_RESOURCE_BACKEND:-sql}
 
 # Select Keystone's token provider (and format)
 # Choose from 'uuid', 'pki', 'pkiz', or 'fernet'
-KEYSTONE_TOKEN_FORMAT=${KEYSTONE_TOKEN_FORMAT:-fernet}
+KEYSTONE_TOKEN_FORMAT=${KEYSTONE_TOKEN_FORMAT:-}
 KEYSTONE_TOKEN_FORMAT=$(echo ${KEYSTONE_TOKEN_FORMAT} | tr '[:upper:]' '[:lower:]')
 
 # Set Keystone interface configuration

From 9278eb78dfc47e3b48e2b72faf90efc6bb44e18f Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Wed, 18 May 2016 13:38:38 -0400
Subject: [PATCH 0449/2409] Move setting lvm libvirt configs to
 hypervisor-libvirt

When the nova backend is LVM we set some libvirt configs
in nova.conf. Those should happen in the libvirt plugin
file rather than the generic nova file since it's specific
to running nova-compute with libvirt.

Change-Id: I37a63a5fba2e9eea4daafe4ec390b2e7aac236f3
---
 lib/nova                            | 8 --------
 lib/nova_plugins/hypervisor-libvirt | 6 ++++++
 2 files changed, 6 insertions(+), 8 deletions(-)

diff --git a/lib/nova b/lib/nova
index de898b23fd..af5d1222a0 100644
--- a/lib/nova
+++ b/lib/nova
@@ -589,14 +589,6 @@ function create_nova_conf {
 
     iniset $NOVA_CONF cinder os_region_name "$REGION_NAME"
 
-    if [[ "$NOVA_BACKEND" == "LVM" ]]; then
-        iniset $NOVA_CONF libvirt images_type "lvm"
-        iniset $NOVA_CONF libvirt images_volume_group $DEFAULT_VOLUME_GROUP_NAME
-        if isset LVM_VOLUME_CLEAR; then
-            iniset $NOVA_CONF libvirt volume_clear "$LVM_VOLUME_CLEAR"
-        fi
-    fi
-
     if is_ssl_enabled_service glance || is_service_enabled tls-proxy; then
         iniset $NOVA_CONF DEFAULT glance_protocol https
     fi
diff --git a/lib/nova_plugins/hypervisor-libvirt b/lib/nova_plugins/hypervisor-libvirt
index 1b4f7ae80a..d0e364efc3 100644
--- a/lib/nova_plugins/hypervisor-libvirt
+++ b/lib/nova_plugins/hypervisor-libvirt
@@ -68,6 +68,12 @@ function configure_nova_hypervisor {
         iniset $NOVA_CONF vnc vncserver_proxyclient_address  $HOST_IP
         iniset $NOVA_CONF vnc vncserver_listen $HOST_IP
         iniset $NOVA_CONF vnc keymap
+    elif [[ "$NOVA_BACKEND" == "LVM" ]]; then
+        iniset $NOVA_CONF libvirt images_type "lvm"
+        iniset $NOVA_CONF libvirt images_volume_group $DEFAULT_VOLUME_GROUP_NAME
+        if isset LVM_VOLUME_CLEAR; then
+            iniset $NOVA_CONF libvirt volume_clear "$LVM_VOLUME_CLEAR"
+        fi
     fi
 }
 

From 6d4843ed96fed4ed7ca6a18394fd2a64439d3707 Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Thu, 12 May 2016 16:14:26 -0400
Subject: [PATCH 0450/2409] Neutron: only do ARP_CMD if IP_BRD is not an empty
 string

Some third party CI systems leave PUBLIC_INTERFACE as the default,
but do not actually create the device. ip would set errno to 1 when
this happens[1], and that's fine - however arping would exit with errno
set to 2, which triggers the exit_trap and stops stacking.[2]

[1]: http://openstack.fit-tecnologia.org.br:10000/36/295836/6/check/hitachi-hnas-ssc/3362683/logs/devstacklog.txt.gz#_2016-05-12_17_24_40_458

[2]: http://openstack.fit-tecnologia.org.br:10000/36/295836/6/check/hitachi-hnas-ssc/3362683/logs/devstacklog.txt.gz#_2016-05-12_17_24_40_545

Change-Id: Iaf08b475eeec5e179a11a42d35fe532b2a15aa41
---
 lib/neutron-legacy | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 9144ca4b1e..383944f686 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -625,11 +625,6 @@ function _move_neutron_addresses_route {
 
         IP_BRD=$(ip -f $af a s dev $from_intf scope global primary | grep inet | awk '{ print $2, $3, $4; exit }')
 
-        if [[ "$af" == "inet" ]]; then
-            IP=$(echo $IP_BRD | awk '{ print $1; exit }' | grep -o -E '(.*)/' | cut -d "/" -f1)
-            ARP_CMD="arping -A -c 3 -w 4.5 -I $to_intf $IP "
-        fi
-
         if [ "$DEFAULT_ROUTE_GW" != "" ]; then
             ADD_DEFAULT_ROUTE="sudo ip -f $af r replace default via $DEFAULT_ROUTE_GW dev $to_intf"
         fi
@@ -646,6 +641,10 @@ function _move_neutron_addresses_route {
             IP_DEL="sudo ip addr del $IP_BRD dev $from_intf"
             IP_ADD="sudo ip addr add $IP_BRD dev $to_intf"
             IP_UP="sudo ip link set $to_intf up"
+            if [[ "$af" == "inet" ]]; then
+                IP=$(echo $IP_BRD | awk '{ print $1; exit }' | grep -o -E '(.*)/' | cut -d "/" -f1)
+                ARP_CMD="arping -A -c 3 -w 4.5 -I $to_intf $IP "
+            fi
         fi
 
         # The add/del OVS port calls have to happen either before or

From e86b91ba784994285de78ae06a490fc6cac50502 Mon Sep 17 00:00:00 2001
From: Brant Knudson <bknudson@us.ibm.com>
Date: Tue, 3 May 2016 15:21:47 -0500
Subject: [PATCH 0451/2409] Reference keystone URIs rather than building URI

lib/keystone sets KEYSTONE_AUTH_URI and KEYSTONE_SERVICE_URI that
other projects should use rather than building the URL themselves.
This will allow us to more easily drop the port altogether.

Change-Id: I7467aae680215f3045d32a088af2187e1eba8169
---
 lib/horizon        | 2 +-
 lib/neutron-legacy | 2 +-
 lib/swift          | 4 +---
 3 files changed, 3 insertions(+), 5 deletions(-)

diff --git a/lib/horizon b/lib/horizon
index abc1f6d16d..0517e32197 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -96,7 +96,7 @@ function configure_horizon {
     _horizon_config_set $local_settings "" OPENSTACK_HOST \"${KEYSTONE_SERVICE_HOST}\"
 
     _horizon_config_set $local_settings "" OPENSTACK_API_VERSIONS {\"identity\":3}
-    _horizon_config_set $local_settings "" OPENSTACK_KEYSTONE_URL "\"${KEYSTONE_SERVICE_PROTOCOL}://${KEYSTONE_SERVICE_HOST}:${KEYSTONE_SERVICE_PORT}/v3\""
+    _horizon_config_set $local_settings "" OPENSTACK_KEYSTONE_URL "\"${KEYSTONE_SERVICE_URI}/v3\""
 
     if [ -f $SSL_BUNDLE_FILE ]; then
         _horizon_config_set $local_settings "" OPENSTACK_SSL_CACERT \"${SSL_BUNDLE_FILE}\"
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 0d6141680e..faf17be50a 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -456,7 +456,7 @@ function configure_neutron {
 function create_nova_conf_neutron {
     iniset $NOVA_CONF DEFAULT use_neutron True
     iniset $NOVA_CONF neutron auth_type "password"
-    iniset $NOVA_CONF neutron auth_url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_AUTH_PORT/v3"
+    iniset $NOVA_CONF neutron auth_url "$KEYSTONE_AUTH_URI/v3"
     iniset $NOVA_CONF neutron username "$Q_ADMIN_USERNAME"
     iniset $NOVA_CONF neutron password "$SERVICE_PASSWORD"
     iniset $NOVA_CONF neutron user_domain_name "$SERVICE_DOMAIN_NAME"
diff --git a/lib/swift b/lib/swift
index 8cb94efa66..4330e3bd87 100644
--- a/lib/swift
+++ b/lib/swift
@@ -457,9 +457,7 @@ function configure_swift {
         cat <<EOF >>${SWIFT_CONFIG_PROXY_SERVER}
 [filter:s3token]
 paste.filter_factory = keystonemiddleware.s3_token:filter_factory
-auth_port = ${KEYSTONE_AUTH_PORT}
-auth_host = ${KEYSTONE_AUTH_HOST}
-auth_protocol = ${KEYSTONE_AUTH_PROTOCOL}
+auth_uri = ${KEYSTONE_AUTH_URI}
 cafile = ${SSL_BUNDLE_FILE}
 admin_user = swift
 admin_tenant_name = ${SERVICE_PROJECT_NAME}

From d04cc4043487ed33c7f78419610ae2c25cb3331d Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Fri, 20 May 2016 07:08:34 +0000
Subject: [PATCH 0452/2409] Updated from generate-devstack-plugins-list

Change-Id: I60f6c75f2b12a0541d25cf291f18dcce30f2d42d
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index cf9c8735f8..e58643fcea 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -95,6 +95,7 @@ networking-powervm                     `git://git.openstack.org/openstack/networ
 networking-sfc                         `git://git.openstack.org/openstack/networking-sfc <https://git.openstack.org/cgit/openstack/networking-sfc>`__
 networking-vsphere                     `git://git.openstack.org/openstack/networking-vsphere <https://git.openstack.org/cgit/openstack/networking-vsphere>`__
 neutron                                `git://git.openstack.org/openstack/neutron <https://git.openstack.org/cgit/openstack/neutron>`__
+neutron-dynamic-routing                `git://git.openstack.org/openstack/neutron-dynamic-routing <https://git.openstack.org/cgit/openstack/neutron-dynamic-routing>`__
 neutron-lbaas                          `git://git.openstack.org/openstack/neutron-lbaas <https://git.openstack.org/cgit/openstack/neutron-lbaas>`__
 neutron-lbaas-dashboard                `git://git.openstack.org/openstack/neutron-lbaas-dashboard <https://git.openstack.org/cgit/openstack/neutron-lbaas-dashboard>`__
 neutron-vpnaas                         `git://git.openstack.org/openstack/neutron-vpnaas <https://git.openstack.org/cgit/openstack/neutron-vpnaas>`__

From c35110e7c5c35dd1edc310dc3d0bb8693e58d336 Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Wed, 18 May 2016 10:38:51 -0400
Subject: [PATCH 0453/2409] Neutron: check if a plugin has the l3 API extension

If a plugin has the L3 API extension available, issue the L3 API
extension calls that creates routers and networks

Change-Id: I77e269ce0025054bcf2a2f4156124f2921ba2d59
---
 lib/neutron_plugins/services/l3 | 15 +++++++++------
 lib/tempest                     |  3 +--
 2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index a5a6c81ea4..55597a695d 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -175,9 +175,7 @@ function create_neutron_initial_network {
         fi
     fi
 
-    AUTO_ALLOCATE_EXT=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" ext-list | grep 'auto-allocated-topology' | get_field 1)
-    SUBNETPOOL_EXT=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" ext-list | grep 'subnet_allocation' | get_field 1)
-    if is_service_enabled q-l3; then
+    if is_networking_extension_supported "router" && is_networking_extension_supported "external-net"; then
         # Create a router, and add the private subnet as one of its interfaces
         if [[ "$Q_L3_ROUTER_PER_TENANT" == "True" ]]; then
             # create a tenant-owned router.
@@ -189,10 +187,8 @@ function create_neutron_initial_network {
             die_if_not_set $LINENO ROUTER_ID "Failure creating ROUTER_ID for $Q_ROUTER_NAME"
         fi
 
-        # if the extension is available, then mark the external
-        # network as default, and provision default subnetpools
         EXTERNAL_NETWORK_FLAGS="--router:external"
-        if [[ -n $AUTO_ALLOCATE_EXT && -n $SUBNETPOOL_EXT ]]; then
+        if is_networking_extension_supported "auto-allocated-topology" && is_networking_extension_supported "subnet_allocation"; then
             EXTERNAL_NETWORK_FLAGS="$EXTERNAL_NETWORK_FLAGS --is-default"
             if [[ "$IP_VERSION" =~ 4.* ]]; then
                 SUBNETPOOL_V4_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnetpool-create $SUBNETPOOL_NAME --default-prefixlen $SUBNETPOOL_SIZE_V4 --pool-prefix $SUBNETPOOL_PREFIX_V4 --shared --is-default=True | grep ' id ' | get_field 2)
@@ -364,3 +360,10 @@ function is_provider_network {
     fi
     return 1
 }
+
+function is_networking_extension_supported {
+    local extension=$1
+    # TODO(sc68cal) cache this instead of calling every time
+    EXT_LIST=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" ext-list -c alias -f value)
+    [[ $EXT_LIST =~ $extension ]] && return 0
+}
diff --git a/lib/tempest b/lib/tempest
index d4d8cf25df..8cae4d987e 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -240,8 +240,7 @@ function configure_tempest {
 
     # the public network (for floating ip access) is only available
     # if the extension is enabled.
-    EXTERNAL_NETWORK_EXT=$(neutron ext-list | grep 'external-net' | get_field 1)
-    if [[ -n $EXTERNAL_NETWORK_EXT ]]; then
+    if is_networking_extension_supported 'external-net'; then
         public_network_id=$(neutron net-list | grep $PUBLIC_NETWORK_NAME | \
             awk '{print $2}')
     fi

From b65586739098d9c13ff93b3588a25343f82dc7fa Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Fri, 20 May 2016 17:30:17 -0400
Subject: [PATCH 0454/2409] Add printing the plugin list after the plugin
 install

This commit just adds a sanity check output to lib/tempest. It will
use tempest list-plugins to print a table of installed plugins after
the pip install phase is run for any provided plugins. This will
enable users to check that the plugins they think they're running are
detected by tempest.

Change-Id: Icff286da6c68ec9a57f2288458976341bc095875
---
 lib/tempest | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index e556935cb5..8ff7d91b04 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -600,6 +600,8 @@ function install_tempest {
     PROJECT_VENV["tempest"]=${TEMPEST_DIR}/.tox/tempest
     if [[ $TEMPEST_PLUGINS != 0 ]] ; then
         tox -evenv-tempest -- pip install $TEMPEST_PLUGINS
+        echo "Checking installed Tempest plugins:"
+        tox -evenv-tempest -- tempest list-plugins
     fi
     popd
 }

From 247e44625cdd3b4bf251dabfeca0ca241d9109a8 Mon Sep 17 00:00:00 2001
From: Kashyap Chamarthy <kchamart@redhat.com>
Date: Fri, 20 May 2016 13:34:41 +0200
Subject: [PATCH 0455/2409] functions-common: Use `systemctl` when applicable

We live in a new systemd world, use the native commands to talk to it
if available.

Change-Id: Iccdc35f0c9da2997f9e672bc1d24ca15d3403d98
---
 functions-common | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/functions-common b/functions-common
index d473077c3e..9973d8ff03 100644
--- a/functions-common
+++ b/functions-common
@@ -2264,11 +2264,12 @@ function python_version {
 # Service wrapper to restart services
 # restart_service service-name
 function restart_service {
-    if is_ubuntu; then
-        sudo /usr/sbin/service $1 restart
+    if [ -x /bin/systemctl ]; then
+        sudo /bin/systemctl restart $1
     else
-        sudo /sbin/service $1 restart
+        sudo service $1 restart
     fi
+
 }
 
 # Only change permissions of a file or directory if it is not on an
@@ -2286,20 +2287,20 @@ function safe_chown {
 # Service wrapper to start services
 # start_service service-name
 function start_service {
-    if is_ubuntu; then
-        sudo /usr/sbin/service $1 start
+    if [ -x /bin/systemctl ]; then
+        sudo /bin/systemctl start $1
     else
-        sudo /sbin/service $1 start
+        sudo service $1 start
     fi
 }
 
 # Service wrapper to stop services
 # stop_service service-name
 function stop_service {
-    if is_ubuntu; then
-        sudo /usr/sbin/service $1 stop
+    if [ -x /bin/systemctl ]; then
+        sudo /bin/systemctl stop $1
     else
-        sudo /sbin/service $1 stop
+        sudo service $1 stop
     fi
 }
 

From 0578e42fdbb6c626a3b07465ef0df3b5211efb9e Mon Sep 17 00:00:00 2001
From: Rodrigo Duarte <rduartes@redhat.com>
Date: Wed, 16 Mar 2016 12:15:07 -0300
Subject: [PATCH 0456/2409] Tempest: add a Keystone reseller feature flag

A new tempest test is being added in https://review.openstack.org/#/c/285541/
but it is not supported in the Kilo and Liberty branches. This patch
turns on this feature flag at Devstacks's side.

According to tempest policies, this patch must be merged first so the
test can actually run.

Change-Id: I52458a0b36e1dba233667311b35f6c3931e2e66c
Depends-On: Ie69dae09c2b42e825e9d51abf158fc14788387d1
---
 lib/tempest | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index d4d8cf25df..ee4550155e 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -282,6 +282,10 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG identity ca_certificates_file $SSL_BUNDLE_FILE
     fi
 
+    # Identity Features
+    # TODO(rodrigods): Remove the reseller flag when Kilo and Liberty are end of life.
+    iniset $TEMPEST_CONFIG identity-feature-enabled reseller True
+
     # Image
     # We want to be able to override this variable in the gate to avoid
     # doing an external HTTP fetch for this test.

From fbba3b9d8b4094b20f55fcf6860d8e5e303a39bc Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Thu, 12 May 2016 11:17:53 -0400
Subject: [PATCH 0457/2409] Neutron: Remove verbose and always set debug to
 true

http://lists.openstack.org/pipermail/openstack-dev/2016-May/095166.html

Change-Id: I7c51518c10d96eb84a6ddd2514011bfd42623d5d
---
 lib/neutron | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index fa2e926995..c0db20d4b9 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -126,6 +126,8 @@ function configure_neutron_new {
     iniset $NEUTRON_CONF oslo_concurrency lock_path $NEUTRON_STATE_PATH/lock
     iniset $NEUTRON_CONF DEFAULT use_syslog $SYSLOG
 
+    iniset $NEUTRON_CONF DEFAULT debug True
+
     iniset_rpc_backend neutron $NEUTRON_CONF
 
     # Neutron API server & Neutron plugin
@@ -139,8 +141,6 @@ function configure_neutron_new {
 
         iniset $NEUTRON_CONF DEFAULT core_plugin ml2
 
-        iniset $NEUTRON_CONF DEFAULT verbose True
-        iniset $NEUTRON_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
         iniset $NEUTRON_CONF DEFAULT policy_file $policy_file
         iniset $NEUTRON_CONF DEFAULT allow_overlapping_ips True
 
@@ -171,6 +171,7 @@ function configure_neutron_new {
     # Neutron OVS or LB agent
     if is_service_enabled neutron-agent; then
         iniset $NEUTRON_PLUGIN_CONF agent tunnel_types vxlan
+        iniset $NEUTRON_PLUGIN_CONF DEFAULT debug True
 
         # Configure the neutron agent
         if [[ $NEUTRON_AGENT == "linuxbridge" ]]; then
@@ -186,7 +187,6 @@ function configure_neutron_new {
     if is_service_enabled neutron-dhcp; then
         cp $NEUTRON_DIR/etc/dhcp_agent.ini.sample $NEUTRON_DHCP_CONF
 
-        iniset $NEUTRON_DHCP_CONF DEFAULT verbose True
         iniset $NEUTRON_DHCP_CONF DEFAULT debug True
         iniset $NEUTRON_DHCP_CONF agent root_helper_daemon "$NEUTRON_ROOTWRAP_DAEMON_CMD"
         iniset $NEUTRON_DHCP_CONF DEFAULT interface_driver $NEUTRON_AGENT
@@ -199,7 +199,6 @@ function configure_neutron_new {
         iniset $NEUTRON_CONF DEFAULT service_plugins router
         iniset $NEUTRON_L3_CONF agent root_helper_daemon "$NEUTRON_ROOTWRAP_DAEMON_CMD"
         iniset $NEUTRON_L3_CONF DEFAULT debug True
-        iniset $NEUTRON_L3_CONF DEFAULT verbose True
         neutron_plugin_configure_l3_agent $NEUTRON_L3_CONF
     fi
 
@@ -207,8 +206,7 @@ function configure_neutron_new {
     if is_service_enabled neutron-metadata-agent; then
         cp $NEUTRON_DIR/etc/metadata_agent.ini.sample $NEUTRON_META_CONF
 
-        iniset $NEUTRON_META_CONF DEFAULT verbose True
-        iniset $NEUTRON_META_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
+        iniset $NEUTRON_META_CONF DEFAULT debug True
         iniset $NEUTRON_META_CONF DEFAULT nova_metadata_ip $SERVICE_HOST
         iniset $NEUTRON_META_CONF agent root_helper_daemon "$NEUTRON_ROOTWRAP_DAEMON_CMD"
 

From 5e01c47e4d671166b9396c507a7105a5ac8256dc Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Thu, 19 May 2016 11:36:57 -0400
Subject: [PATCH 0458/2409] Neutron: stop creating neutron debug probes

They seem to be more trouble than they are worth.

http://lists.openstack.org/pipermail/openstack-dev/2016-May/095476.html

Neutron has already deprecated the utility in
https://review.openstack.org/#/c/318786/

Change-Id: I470ed5bc1cbe754c4bfae41f411150331bc4335d
---
 lib/neutron-legacy | 40 ----------------------------------------
 stack.sh           |  1 -
 2 files changed, 41 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 9144ca4b1e..02be83ac35 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -130,8 +130,6 @@ Q_USE_ROOTWRAP_DAEMON=$(trueorfalse True Q_USE_ROOTWRAP_DAEMON)
 Q_META_DATA_IP=${Q_META_DATA_IP:-$SERVICE_HOST}
 # Allow Overlapping IP among subnets
 Q_ALLOW_OVERLAPPING_IP=${Q_ALLOW_OVERLAPPING_IP:-True}
-# Use neutron-debug command
-Q_USE_DEBUG_COMMAND=${Q_USE_DEBUG_COMMAND:-False}
 # The name of the default q-l3 router
 Q_ROUTER_NAME=${Q_ROUTER_NAME:-router1}
 Q_NOTIFY_NOVA_PORT_STATUS_CHANGES=${Q_NOTIFY_NOVA_PORT_STATUS_CHANGES:-True}
@@ -361,8 +359,6 @@ function configure_mutnauq {
         _configure_neutron_ceilometer_notifications
     fi
 
-    _configure_neutron_debug_command
-
     iniset $NEUTRON_CONF DEFAULT api_workers "$API_WORKERS"
 }
 
@@ -799,24 +795,6 @@ function _configure_neutron_common {
     _neutron_setup_rootwrap
 }
 
-function _configure_neutron_debug_command {
-    if [[ "$Q_USE_DEBUG_COMMAND" != "True" ]]; then
-        return
-    fi
-
-    cp $NEUTRON_DIR/etc/l3_agent.ini.sample $NEUTRON_TEST_CONFIG_FILE
-
-    iniset $NEUTRON_TEST_CONFIG_FILE DEFAULT debug False
-    iniset $NEUTRON_TEST_CONFIG_FILE AGENT root_helper "$Q_RR_COMMAND"
-    if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
-        iniset $NEUTRON_TEST_CONFIG_FILE AGENT root_helper_daemon "$Q_RR_DAEMON_COMMAND"
-    fi
-
-    _neutron_setup_interface_driver $NEUTRON_TEST_CONFIG_FILE
-
-    neutron_plugin_configure_debug_command
-}
-
 function _configure_neutron_dhcp_agent {
 
     cp $NEUTRON_DIR/etc/dhcp_agent.ini.sample $Q_DHCP_CONF_FILE
@@ -1027,24 +1005,6 @@ function delete_probe {
     neutron-debug --os-tenant-name admin --os-username admin probe-delete $probe_id
 }
 
-function setup_neutron_debug {
-    if [[ "$Q_USE_DEBUG_COMMAND" == "True" ]]; then
-        public_net_id=`_get_net_id $PUBLIC_NETWORK_NAME`
-        if [[ -n $public_net_id ]]; then
-            neutron-debug --os-tenant-name admin --os-username admin --os-password $ADMIN_PASSWORD probe-create --device-owner compute $public_net_id
-        fi
-        private_net_id=`_get_net_id $PRIVATE_NETWORK_NAME`
-        if [[ -n $private_net_id ]]; then
-            neutron-debug --os-tenant-name admin --os-username admin --os-password $ADMIN_PASSWORD probe-create --device-owner compute $private_net_id
-        fi
-    fi
-}
-
-function teardown_neutron_debug {
-    delete_probe $PUBLIC_NETWORK_NAME
-    delete_probe $PRIVATE_NETWORK_NAME
-}
-
 function _get_net_id {
     neutron --os-cloud devstack-admin --os-region "$REGION_NAME" --os-tenant-name admin --os-username admin --os-password $ADMIN_PASSWORD net-list | grep $1 | awk '{print $2}'
 }
diff --git a/stack.sh b/stack.sh
index 21f7f35f35..381e94cf26 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1250,7 +1250,6 @@ fi
 if is_service_enabled q-svc && [[ "$NEUTRON_CREATE_INITIAL_NETWORKS" == "True" ]]; then
     echo_summary "Creating initial neutron network elements"
     create_neutron_initial_network
-    setup_neutron_debug
 fi
 
 if is_service_enabled nova; then

From 8d0d3115ccf528ff5ae1533a670fc3bd475d0bcc Mon Sep 17 00:00:00 2001
From: Ivan Kolodyazhny <e0ne@e0ne.info>
Date: Thu, 26 May 2016 23:41:49 +0300
Subject: [PATCH 0459/2409] Allow override of python-brick-cinderclient-ext
 library used by cinder

Added to requirements:
https://review.openstack.org/309084

Functional tests were added
https://review.openstack.org/265811

But they still use the version of python-brick-cinderclient-ext from pip.

This change updates devstack to pull in the changes from
python-brick-cinderclient-ext patch sets instead, when configured to do so.

Change-Id: I6d0f09950ea1200d3367a53aa4a3eea9be7abc66
Needed-by: I34f3b5ceaad7a50b1e9cadcc764f61c0aabe086d
---
 lib/cinder                   | 6 ++++++
 stackrc                      | 4 ++++
 tests/test_libs_from_pypi.sh | 2 +-
 3 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/lib/cinder b/lib/cinder
index 9c818c6eb2..de67593f72 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -40,6 +40,7 @@ fi
 # set up default directories
 GITDIR["python-cinderclient"]=$DEST/python-cinderclient
 GITDIR["os-brick"]=$DEST/os-brick
+GITDIR["python-brick-cinderclient-ext"]=$DEST/python-brick-cinderclient-ext
 CINDER_DIR=$DEST/cinder
 
 # Cinder virtual environment
@@ -466,6 +467,11 @@ function install_cinder {
 
 # install_cinderclient() - Collect source and prepare
 function install_cinderclient {
+    if use_library_from_git "python-brick-cinderclient-ext"; then
+        git_clone_by_name "python-brick-cinderclient-ext"
+        setup_dev_lib "python-brick-cinderclient-ext"
+    fi
+
     if use_library_from_git "python-cinderclient"; then
         git_clone_by_name "python-cinderclient"
         setup_dev_lib "python-cinderclient"
diff --git a/stackrc b/stackrc
index 8e1900dd94..969d77d95c 100644
--- a/stackrc
+++ b/stackrc
@@ -285,6 +285,10 @@ TEMPEST_BRANCH=${TEMPEST_BRANCH:-master}
 GITREPO["python-cinderclient"]=${CINDERCLIENT_REPO:-${GIT_BASE}/openstack/python-cinderclient.git}
 GITBRANCH["python-cinderclient"]=${CINDERCLIENT_BRANCH:-master}
 
+# os-brick client for local volume attachement
+GITREPO["python-brick-cinderclient-ext"]=${CINDERCLIENT_REPO:-${GIT_BASE}/openstack/python-brick-cinderclient-ext.git}
+GITBRANCH["python-brick-cinderclient-ext"]=${CINDERCLIENT_BRANCH:-master}
+
 # python glance client library
 GITREPO["python-glanceclient"]=${GLANCECLIENT_REPO:-${GIT_BASE}/openstack/python-glanceclient.git}
 GITBRANCH["python-glanceclient"]=${GLANCECLIENT_BRANCH:-master}
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index a979c346b8..bb58088ef3 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -42,7 +42,7 @@ ALL_LIBS+=" python-neutronclient tooz ceilometermiddleware oslo.policy"
 ALL_LIBS+=" debtcollector os-brick automaton futurist oslo.service"
 ALL_LIBS+=" oslo.cache oslo.reports osprofiler"
 ALL_LIBS+=" keystoneauth ironic-lib neutron-lib oslo.privsep"
-ALL_LIBS+=" diskimage-builder os-vif"
+ALL_LIBS+=" diskimage-builder os-vif python-brick-cinderclient-ext"
 
 # Generate the above list with
 # echo ${!GITREPO[@]}

From 38245da0b8ab1a08ae192ef2c0d5755a8f88841a Mon Sep 17 00:00:00 2001
From: Rob Crittenden <rcritten@redhat.com>
Date: Thu, 26 May 2016 17:55:14 -0400
Subject: [PATCH 0460/2409] Fix typo in local variable name in time_stop

This didn't break functionality but it would use a global instead
of a local variable so nested calls to time_* might have issues.

Change-Id: If61ef07c4ce15f1a356975a0b0611fdf5e49109a
---
 functions-common | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index 9973d8ff03..3fdd71bffc 100644
--- a/functions-common
+++ b/functions-common
@@ -2371,7 +2371,7 @@ function time_start {
 function time_stop {
     local name
     local end_time
-    local elpased_time
+    local elapsed_time
     local total
     local start_time
 

From 35f0f09f005e9879d73ba6242cbf8e5409ff70a6 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Sat, 28 May 2016 07:05:56 +0000
Subject: [PATCH 0461/2409] Updated from generate-devstack-plugins-list

Change-Id: Ifc10b6f4281f40749f917e7707eab816c3c11876
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index e58643fcea..5f796aec15 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -71,6 +71,7 @@ manila                                 `git://git.openstack.org/openstack/manila
 mistral                                `git://git.openstack.org/openstack/mistral <https://git.openstack.org/cgit/openstack/mistral>`__
 monasca-api                            `git://git.openstack.org/openstack/monasca-api <https://git.openstack.org/cgit/openstack/monasca-api>`__
 monasca-log-api                        `git://git.openstack.org/openstack/monasca-log-api <https://git.openstack.org/cgit/openstack/monasca-log-api>`__
+monasca-transform                      `git://git.openstack.org/openstack/monasca-transform <https://git.openstack.org/cgit/openstack/monasca-transform>`__
 murano                                 `git://git.openstack.org/openstack/murano <https://git.openstack.org/cgit/openstack/murano>`__
 networking-6wind                       `git://git.openstack.org/openstack/networking-6wind <https://git.openstack.org/cgit/openstack/networking-6wind>`__
 networking-bagpipe                     `git://git.openstack.org/openstack/networking-bagpipe <https://git.openstack.org/cgit/openstack/networking-bagpipe>`__

From c47bd1df65d6c327a34d1a9cd771940595bf8c87 Mon Sep 17 00:00:00 2001
From: Gary Kotton <gkotton@vmware.com>
Date: Sun, 29 May 2016 00:01:01 -0700
Subject: [PATCH 0462/2409] Remove verbose setting from l3 service plugin

This is following the nail:
http://lists.openstack.org/pipermail/openstack-dev/2016-May/095166.html

Change-Id: I4380279992e53ec9926bbcba5524e98f5c96ce8b
---
 lib/neutron_plugins/services/l3 | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index a5a6c81ea4..a53995ef25 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -91,7 +91,6 @@ function _configure_neutron_l3_agent {
 
     cp $NEUTRON_DIR/etc/l3_agent.ini.sample $Q_L3_CONF_FILE
 
-    iniset $Q_L3_CONF_FILE DEFAULT verbose True
     iniset $Q_L3_CONF_FILE DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
     iniset $Q_L3_CONF_FILE AGENT root_helper "$Q_RR_COMMAND"
     if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then

From 47bf3f931c60237f50f717e4885c2b64590e3160 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Wed, 1 Jun 2016 07:01:00 +0000
Subject: [PATCH 0463/2409] Updated from generate-devstack-plugins-list

Change-Id: If7c8f6162d3e846a360cc7f34ce2ebf52054f45f
---
 doc/source/plugin-registry.rst | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 5f796aec15..2760f854a4 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -61,6 +61,7 @@ freezer-web-ui                         `git://git.openstack.org/openstack/freeze
 gce-api                                `git://git.openstack.org/openstack/gce-api <https://git.openstack.org/cgit/openstack/gce-api>`__
 gnocchi                                `git://git.openstack.org/openstack/gnocchi <https://git.openstack.org/cgit/openstack/gnocchi>`__
 group-based-policy                     `git://git.openstack.org/openstack/group-based-policy <https://git.openstack.org/cgit/openstack/group-based-policy>`__
+higgins                                `git://git.openstack.org/openstack/higgins <https://git.openstack.org/cgit/openstack/higgins>`__
 ironic                                 `git://git.openstack.org/openstack/ironic <https://git.openstack.org/cgit/openstack/ironic>`__
 ironic-inspector                       `git://git.openstack.org/openstack/ironic-inspector <https://git.openstack.org/cgit/openstack/ironic-inspector>`__
 kingbird                               `git://git.openstack.org/openstack/kingbird <https://git.openstack.org/cgit/openstack/kingbird>`__
@@ -70,6 +71,7 @@ magnum-ui                              `git://git.openstack.org/openstack/magnum
 manila                                 `git://git.openstack.org/openstack/manila <https://git.openstack.org/cgit/openstack/manila>`__
 mistral                                `git://git.openstack.org/openstack/mistral <https://git.openstack.org/cgit/openstack/mistral>`__
 monasca-api                            `git://git.openstack.org/openstack/monasca-api <https://git.openstack.org/cgit/openstack/monasca-api>`__
+monasca-ceilometer                     `git://git.openstack.org/openstack/monasca-ceilometer <https://git.openstack.org/cgit/openstack/monasca-ceilometer>`__
 monasca-log-api                        `git://git.openstack.org/openstack/monasca-log-api <https://git.openstack.org/cgit/openstack/monasca-log-api>`__
 monasca-transform                      `git://git.openstack.org/openstack/monasca-transform <https://git.openstack.org/cgit/openstack/monasca-transform>`__
 murano                                 `git://git.openstack.org/openstack/murano <https://git.openstack.org/cgit/openstack/murano>`__

From 72b233c1e042dd55cc7e7785f2e1ecd6ae4fc1aa Mon Sep 17 00:00:00 2001
From: Attila Fazekas <afazekas@redhat.com>
Date: Wed, 1 Jun 2016 16:43:07 +0200
Subject: [PATCH 0464/2409] Allow to use Fedora 24 with devstack

Looks like f24 does not have any special change compared to the
previous release, we just need to add f24 where f23 present.

Change-Id: Ia4a58de4973ef228735c48b33453a0562dc65258
---
 files/rpms/general   | 4 ++--
 files/rpms/nova      | 2 +-
 files/rpms/swift     | 2 +-
 lib/ceph             | 2 +-
 stack.sh             | 2 +-
 tools/install_pip.sh | 2 +-
 6 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/files/rpms/general b/files/rpms/general
index 2d4a97a743..ee2e8a058b 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -7,9 +7,9 @@ gcc-c++
 gettext  # used for compiling message catalogs
 git-core
 graphviz # needed only for docs
-iptables-services  # NOPRIME f22,f23
+iptables-services  # NOPRIME f22,f23,f24
 java-1.7.0-openjdk-headless  # NOPRIME rhel7
-java-1.8.0-openjdk-headless  # NOPRIME f22,f23
+java-1.8.0-openjdk-headless  # NOPRIME f22,f23,f24
 libffi-devel
 libjpeg-turbo-devel # Pillow 3.0.0
 libxml2-devel # lxml
diff --git a/files/rpms/nova b/files/rpms/nova
index 0312e856dd..594393e733 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -7,7 +7,7 @@ gawk
 genisoimage # required for config_drive
 iptables
 iputils
-kernel-modules # dist:f22,f23
+kernel-modules # dist:f22,f23,f24
 kpartx
 kvm # NOPRIME
 libvirt-bin # NOPRIME
diff --git a/files/rpms/swift b/files/rpms/swift
index 46dc59d74d..1e05167bcf 100644
--- a/files/rpms/swift
+++ b/files/rpms/swift
@@ -2,7 +2,7 @@ curl
 liberasurecode-devel
 memcached
 pyxattr
-rsync-daemon # dist:f22,f23
+rsync-daemon # dist:f22,f23,f24
 sqlite
 xfsprogs
 xinetd
diff --git a/lib/ceph b/lib/ceph
index 3e0839aaa2..e999647ed8 100644
--- a/lib/ceph
+++ b/lib/ceph
@@ -116,7 +116,7 @@ function undefine_virsh_secret {
 
 # check_os_support_ceph() - Check if the operating system provides a decent version of Ceph
 function check_os_support_ceph {
-    if [[ ! ${DISTRO} =~ (trusty|f22|f23) ]]; then
+    if [[ ! ${DISTRO} =~ (trusty|f22|f23|f24) ]]; then
         echo "WARNING: your distro $DISTRO does not provide (at least) the Firefly release. Please use Ubuntu Trusty or Fedora 20 (and higher)"
         if [[ "$FORCE_CEPH_INSTALL" != "yes" ]]; then
             die $LINENO "If you wish to install Ceph on this distribution anyway run with FORCE_CEPH_INSTALL=yes"
diff --git a/stack.sh b/stack.sh
index 68e3d936b8..173628ebba 100755
--- a/stack.sh
+++ b/stack.sh
@@ -185,7 +185,7 @@ source $TOP_DIR/stackrc
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (trusty|wily|xenial|7.0|wheezy|sid|testing|jessie|f22|f23|rhel7|kvmibm1) ]]; then
+if [[ ! ${DISTRO} =~ (trusty|wily|xenial|7.0|wheezy|sid|testing|jessie|f22|f23|f24|rhel7|kvmibm1) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"
diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index dfa4f42573..12676998d2 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -116,7 +116,7 @@ get_versions
 
 # Eradicate any and all system packages
 
-# Python in f23 and f22 depends on the python-pip package so removing it
+# Python in fedora depends on the python-pip package so removing it
 # results in a nonfunctional system. pip on fedora installs to /usr so pip
 # can safely override the system pip for all versions of fedora
 if ! is_fedora ; then

From 07dc2bf7760fa1c5b28d2dd71fb4eebd7a8921f2 Mon Sep 17 00:00:00 2001
From: Kashyap Chamarthy <kchamart@redhat.com>
Date: Wed, 1 Jun 2016 12:21:00 +0200
Subject: [PATCH 0465/2409] functions-libvirt: Add log filter to capture CPU
 driver errors

Two things:

  (a) Add the log filter to capture libvirt CPU manipulation driver
      related error messages when things fallout (e.g. CPU model
      comparision failures during live migration).

  (b) While we're at it, remove the "1:qemu_monitor" log filter, because
      the existing filter "1:qemu" should take care of logging the
      interactions with QEMU monitor console.  This is the case since
      the introduction of VIR_LOG_INIT() macro in upstream libvirt,
      which performs a substring match on a given file name.  (Available
      from libvirt version v1.2.10 onwards).

Change-Id: I75befd52d9f892eb5a6236eee9a397fab7602ecc
---
 lib/nova_plugins/functions-libvirt | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index dbb4d4fb4b..09723db166 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -108,9 +108,9 @@ EOF
             # source file paths, not relative paths. This screws with the matching
             # of '1:libvirt' making everything turn on. So use libvirt.c for now.
             # This will have to be re-visited when Ubuntu ships libvirt >= 1.2.3
-            local log_filters="1:libvirt.c 1:qemu 1:conf 1:security 3:object 3:event 3:json 3:file 1:util 1:qemu_monitor"
+            local log_filters="1:libvirt.c 1:qemu 1:conf 1:security 3:object 3:event 3:json 3:file 1:util 1:cpu"
         else
-            local log_filters="1:libvirt 1:qemu 1:conf 1:security 3:object 3:event 3:json 3:file 1:util 1:qemu_monitor"
+            local log_filters="1:libvirt 1:qemu 1:conf 1:security 3:object 3:event 3:json 3:file 1:util 1:cpu"
         fi
         local log_outputs="1:file:/var/log/libvirt/libvirtd.log"
         if ! sudo grep -q "^log_filters=\"$log_filters\"" /etc/libvirt/libvirtd.conf; then

From 09604349f89f59ee2ac07b4daa93bd1ae52d1b79 Mon Sep 17 00:00:00 2001
From: Brian Haley <brian.haley@hpe.com>
Date: Thu, 2 Jun 2016 10:29:43 -0400
Subject: [PATCH 0466/2409] Change ovs_base neutron plugin to use vercmp

This plugin was using a deprecated function, vercmp_numbers(),
that wasn't actually working properly because the call to
'deprecated' at the beginning was causing garbage to be
returned to the caller.  For example, this was always in
stack.sh.log when using OVS:

.../lib/neutron_plugins/ovs_base: line 57: [: too many arguments

Update to use vercmp() like all other users in devstack, and
remove all the old code.

Change-Id: I352362cf59e492fa9f7725190f0243f2436ac347
---
 functions                    | 55 ------------------------------------
 lib/neutron_plugins/ovs_base |  2 +-
 2 files changed, 1 insertion(+), 56 deletions(-)

diff --git a/functions b/functions
index 8cdd6d8171..aa12e1e826 100644
--- a/functions
+++ b/functions
@@ -511,61 +511,6 @@ function check_path_perm_sanity {
 }
 
 
-# This function recursively compares versions, and is not meant to be
-# called by anything other than vercmp_numbers below. This function does
-# not work with alphabetic versions.
-#
-# _vercmp_r sep ver1 ver2
-function _vercmp_r {
-    typeset sep
-    typeset -a ver1=() ver2=()
-    sep=$1; shift
-    ver1=("${@:1:sep}")
-    ver2=("${@:sep+1}")
-
-    if ((ver1 > ver2)); then
-        echo 1; return 0
-    elif ((ver2 > ver1)); then
-        echo -1; return 0
-    fi
-
-    if ((sep <= 1)); then
-        echo 0; return 0
-    fi
-
-    _vercmp_r $((sep-1)) "${ver1[@]:1}" "${ver2[@]:1}"
-}
-
-
-# This function compares two versions and is meant to be called by
-# external callers. Please note the function assumes non-alphabetic
-# versions. For example, this will work:
-#
-#   vercmp_numbers 1.10 1.4
-#
-# The above will return "1", as 1.10 is greater than 1.4.
-#
-#   vercmp_numbers 5.2 6.4
-#
-# The above will return "-1", as 5.2 is less than 6.4.
-#
-#   vercmp_numbers 4.0 4.0
-#
-# The above will return "0", as the versions are equal.
-#
-# vercmp_numbers ver1 ver2
-function vercmp_numbers {
-    typeset v1=$1 v2=$2 sep
-    typeset -a ver1 ver2
-
-    deprecated "vercmp_numbers is deprecated for more generic vercmp"
-
-    IFS=. read -ra ver1 <<< "$v1"
-    IFS=. read -ra ver2 <<< "$v2"
-
-    _vercmp_r "${#ver1[@]}" "${ver1[@]}" "${ver2[@]}"
-}
-
 # vercmp ver1 op ver2
 #  Compare VER1 to VER2
 #   - op is one of < <= == >= >
diff --git a/lib/neutron_plugins/ovs_base b/lib/neutron_plugins/ovs_base
index 59c7737181..95f4663a52 100644
--- a/lib/neutron_plugins/ovs_base
+++ b/lib/neutron_plugins/ovs_base
@@ -54,7 +54,7 @@ function _neutron_ovs_base_install_ubuntu_dkms {
     local kernel_major_minor
     kernel_major_minor=`echo $kernel_version | cut -d. -f1-2`
     # From kernel 3.13 on, openvswitch-datapath-dkms is not needed
-    if [ `vercmp_numbers "$kernel_major_minor" "3.13"` -lt "0" ]; then
+    if vercmp '$kernel_major_minor' '<' '3.13'; then
         install_package "dkms openvswitch-datapath-dkms linux-headers-$kernel_version"
     fi
 }

From 7e603d1bf8689a50ffa3dd93c901a71ea5f5ae36 Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Wed, 1 Jun 2016 18:16:14 -0400
Subject: [PATCH 0467/2409] Move tempest plugin install to the end

For the tempest plugin install inside the tox venv to hold we need to
ensure that it's the last thing run that touches the tox venv before
devstack ends. Otherwise there is a chance we'll recreate the venv in
a later step of installing and configuring tempest. This commit
moves the plugin installation into it's own function and calls that
function as last phase of the tempest setup to make sure it runs last.

Change-Id: Ie253171537e8c5a9887cc30aba1cad4b31e57663
---
 extras.d/80-tempest.sh | 2 ++
 lib/tempest            | 6 ++++++
 2 files changed, 8 insertions(+)

diff --git a/extras.d/80-tempest.sh b/extras.d/80-tempest.sh
index fcf79bd4d9..6a3d121497 100644
--- a/extras.d/80-tempest.sh
+++ b/extras.d/80-tempest.sh
@@ -13,6 +13,8 @@ if is_service_enabled tempest; then
     elif [[ "$1" == "stack" && "$2" == "extra" ]]; then
         echo_summary "Initializing Tempest"
         configure_tempest
+        echo_summary "Installing Tempest Plugins"
+        install_tempest_plugins
     elif [[ "$1" == "stack" && "$2" == "post-extra" ]]; then
         # local.conf Tempest option overrides
         :
diff --git a/lib/tempest b/lib/tempest
index 6f8e29395c..c492182fee 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -600,6 +600,12 @@ function install_tempest {
     # running pip install -U on tempest requirements
     $TEMPEST_DIR/.tox/tempest/bin/pip install -c $REQUIREMENTS_DIR/upper-constraints.txt -r requirements.txt
     PROJECT_VENV["tempest"]=${TEMPEST_DIR}/.tox/tempest
+    popd
+}
+
+# install_tempest_plugins() - Install any specified plugins into the tempest venv
+function install_tempest_plugins {
+    pushd $TEMPEST_DIR
     if [[ $TEMPEST_PLUGINS != 0 ]] ; then
         tox -evenv-tempest -- pip install $TEMPEST_PLUGINS
         echo "Checking installed Tempest plugins:"

From 6176ae6895c3c62e9406ebca0055fed9a58f35d1 Mon Sep 17 00:00:00 2001
From: Mehdi Abaakouk <sileht@redhat.com>
Date: Wed, 18 May 2016 12:10:08 +0200
Subject: [PATCH 0468/2409] Use transport_url instead of driver-specif options

Future oslo.messaging is going to deprecate usage of driver-specific
options for hosts/port/user/password options.

This change uses transport_url that exists since a while now and
works with all drivers (even devstack handles only the rabbit one).

Change-Id: I3006b96ff93a3468249177c31c359c2f9ddc5db6
---
 lib/nova        | 2 +-
 lib/rpc_backend | 9 ++++-----
 2 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/lib/nova b/lib/nova
index de898b23fd..e928cf264c 100644
--- a/lib/nova
+++ b/lib/nova
@@ -639,7 +639,7 @@ function init_nova_cells {
     if is_service_enabled n-cell; then
         cp $NOVA_CONF $NOVA_CELLS_CONF
         iniset $NOVA_CELLS_CONF database connection `database_connection_url $NOVA_CELLS_DB`
-        iniset $NOVA_CELLS_CONF oslo_messaging_rabbit rabbit_virtual_host child_cell
+        iniset_rpc_backend nova $NOVA_CELLS_CONF DEFAULT child_cell
         iniset $NOVA_CELLS_CONF DEFAULT dhcpbridge_flagfile $NOVA_CELLS_CONF
         iniset $NOVA_CELLS_CONF cells enable True
         iniset $NOVA_CELLS_CONF cells cell_type compute
diff --git a/lib/rpc_backend b/lib/rpc_backend
index 05e303e3e7..0ee46dca6f 100644
--- a/lib/rpc_backend
+++ b/lib/rpc_backend
@@ -104,8 +104,9 @@ function restart_rpc_backend {
 
 # builds transport url string
 function get_transport_url {
+    local virtual_host=$1
     if is_service_enabled rabbit || { [ -n "$RABBIT_HOST" ] && [ -n "$RABBIT_PASSWORD" ]; }; then
-        echo "rabbit://$RABBIT_USERID:$RABBIT_PASSWORD@$RABBIT_HOST:5672/"
+        echo "rabbit://$RABBIT_USERID:$RABBIT_PASSWORD@$RABBIT_HOST:5672/$virtual_host"
     fi
 }
 
@@ -114,11 +115,9 @@ function iniset_rpc_backend {
     local package=$1
     local file=$2
     local section=${3:-DEFAULT}
+    local virtual_host=$4
     if is_service_enabled rabbit || { [ -n "$RABBIT_HOST" ] && [ -n "$RABBIT_PASSWORD" ]; }; then
-        iniset $file $section rpc_backend "rabbit"
-        iniset $file oslo_messaging_rabbit rabbit_hosts $RABBIT_HOST
-        iniset $file oslo_messaging_rabbit rabbit_password $RABBIT_PASSWORD
-        iniset $file oslo_messaging_rabbit rabbit_userid $RABBIT_USERID
+        iniset $file $section transport_url $(get_transport_url "$virtual_host")
         if [ -n "$RABBIT_HEARTBEAT_TIMEOUT_THRESHOLD" ]; then
             iniset $file oslo_messaging_rabbit heartbeat_timeout_threshold $RABBIT_HEARTBEAT_TIMEOUT_THRESHOLD
         fi

From 214459cdf776a77dacd70a9205c5b8a6ceaff31a Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 2 Jun 2016 10:29:59 -0400
Subject: [PATCH 0469/2409] remove addition of gate64 cpu

Nova has been fixed to not need this work around. We shouldn't keep it
in devstack.

Change-Id: Ie2b1c6b8ddce4a2fd94af06745d59455208f0633
---
 lib/nova_plugins/functions-libvirt | 15 +----
 tools/cpu_map_update.py            | 88 ------------------------------
 2 files changed, 3 insertions(+), 100 deletions(-)
 delete mode 100755 tools/cpu_map_update.py

diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index dbb4d4fb4b..b4a7a7b28f 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -121,18 +121,9 @@ EOF
         fi
     fi
 
-    # Update the libvirt cpu map with a gate64 cpu model. This enables nova
-    # live migration for 64bit guest OSes on heterogenous cloud "hardware".
-    if [[ -f /usr/share/libvirt/cpu_map.xml ]] ; then
-        sudo $TOP_DIR/tools/cpu_map_update.py /usr/share/libvirt/cpu_map.xml
-    fi
-
-    # libvirt detects various settings on startup, as we potentially changed
-    # the system configuration (modules, filesystems), we need to restart
-    # libvirt to detect those changes. Use a stop start as otherwise the new
-    # cpu_map is not loaded properly on some systems (Ubuntu).
-    stop_service $LIBVIRT_DAEMON
-    start_service $LIBVIRT_DAEMON
+    # Service needs to be started on redhat/fedora -- do a restart for
+    # sanity after fiddling the config.
+    restart_service $LIBVIRT_DAEMON
 }
 
 
diff --git a/tools/cpu_map_update.py b/tools/cpu_map_update.py
deleted file mode 100755
index 92b7b8f9a3..0000000000
--- a/tools/cpu_map_update.py
+++ /dev/null
@@ -1,88 +0,0 @@
-#!/usr/bin/env python
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-
-# This small script updates the libvirt CPU map to add a gate64 cpu model
-# that can be used to enable a common 64bit capable feature set across
-# devstack nodes so that features like nova live migration work.
-
-import sys
-import xml.etree.ElementTree as ET
-from xml.dom import minidom
-
-
-def update_cpu_map(tree):
-    root = tree.getroot()
-    cpus = root#.find("cpus")
-    x86 = None
-    for arch in cpus.findall("arch"):
-        if arch.get("name") == "x86":
-            x86 = arch
-            break
-    if x86 is not None:
-        # Create a gate64 cpu model that is core2duo less monitor, pse36,
-        # vme, and ssse3.
-        gate64 = ET.SubElement(x86, "model")
-        gate64.set("name", "gate64")
-        ET.SubElement(gate64, "vendor").set("name", "Intel")
-        ET.SubElement(gate64, "feature").set("name", "fpu")
-        ET.SubElement(gate64, "feature").set("name", "de")
-        ET.SubElement(gate64, "feature").set("name", "pse")
-        ET.SubElement(gate64, "feature").set("name", "tsc")
-        ET.SubElement(gate64, "feature").set("name", "msr")
-        ET.SubElement(gate64, "feature").set("name", "pae")
-        ET.SubElement(gate64, "feature").set("name", "mce")
-        ET.SubElement(gate64, "feature").set("name", "cx8")
-        ET.SubElement(gate64, "feature").set("name", "apic")
-        ET.SubElement(gate64, "feature").set("name", "sep")
-        ET.SubElement(gate64, "feature").set("name", "pge")
-        ET.SubElement(gate64, "feature").set("name", "cmov")
-        ET.SubElement(gate64, "feature").set("name", "pat")
-        ET.SubElement(gate64, "feature").set("name", "mmx")
-        ET.SubElement(gate64, "feature").set("name", "fxsr")
-        ET.SubElement(gate64, "feature").set("name", "sse")
-        ET.SubElement(gate64, "feature").set("name", "sse2")
-        ET.SubElement(gate64, "feature").set("name", "mtrr")
-        ET.SubElement(gate64, "feature").set("name", "mca")
-        ET.SubElement(gate64, "feature").set("name", "clflush")
-        ET.SubElement(gate64, "feature").set("name", "pni")
-        ET.SubElement(gate64, "feature").set("name", "nx")
-        ET.SubElement(gate64, "feature").set("name", "syscall")
-        ET.SubElement(gate64, "feature").set("name", "lm")
-
-
-def format_xml(root):
-    # Adapted from http://pymotw.com/2/xml/etree/ElementTree/create.html
-    # thank you dhellmann
-    rough_string = ET.tostring(root, encoding="UTF-8")
-    dom_parsed = minidom.parseString(rough_string)
-    return dom_parsed.toprettyxml("  ", encoding="UTF-8")
-
-
-def main():
-    if len(sys.argv) != 2:
-        raise Exception("Must pass path to cpu_map.xml to update")
-    cpu_map = sys.argv[1]
-    tree = ET.parse(cpu_map)
-    for model in tree.getroot().iter("model"):
-        if model.get("name") == "gate64":
-            # gate64 model is already present
-            return
-    update_cpu_map(tree)
-    pretty_xml = format_xml(tree.getroot())
-    with open(cpu_map, 'w') as f:
-        f.write(pretty_xml)
-
-
-if __name__ == "__main__":
-    main()

From 9ee1426847569637346610512fb8c9cd7bbefbb6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20Dulko?= <michal.dulko@intel.com>
Date: Fri, 3 Jun 2016 15:34:50 +0200
Subject: [PATCH 0470/2409] Set my_ip in cinder.conf

Cinder uses my_ip config option to provide iscsi_targets. It gets
defaulted to the IP of the first interface in the system, which is fine
for some cases, but for example with Vagrant first interface can be used
only to contact with host machine.

To get over it we should set my_ip to HOST_IP from local.conf and this
commit implements that.

Change-Id: I4d2960d92f388ac689dfa6b436dc8bfc1e129fbf
Closes-Bug: 1588825
---
 lib/cinder | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/cinder b/lib/cinder
index de67593f72..bcf240953b 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -270,6 +270,7 @@ function configure_cinder {
     iniset $CINDER_CONF DEFAULT state_path $CINDER_STATE_PATH
     iniset $CINDER_CONF oslo_concurrency lock_path $CINDER_STATE_PATH
     iniset $CINDER_CONF DEFAULT periodic_interval $CINDER_PERIODIC_INTERVAL
+    iniset $CINDER_CONF DEFAULT my_ip "$HOST_IP"
 
     iniset $CINDER_CONF DEFAULT os_region_name "$REGION_NAME"
 

From 22c695f08a82d527668ef906e11089e6b0046a50 Mon Sep 17 00:00:00 2001
From: Flavio Percoco <flaper87@gmail.com>
Date: Wed, 11 May 2016 12:49:07 -0500
Subject: [PATCH 0471/2409] Have a way to disable Glance v1 in devstack

As part of the process of deprecating Glance's V1, the glance team would
like to start testing V2-only environments. Therefore, this change
provides a way to force other services to use V2.

Change-Id: I87e77d07964eac01e9a796817cbc88bd6e59c721
---
 lib/cinder  | 4 ++++
 lib/glance  | 7 +++++++
 lib/tempest | 3 +++
 3 files changed, 14 insertions(+)

diff --git a/lib/cinder b/lib/cinder
index 17862327c4..7763599bae 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -342,6 +342,10 @@ function configure_cinder {
         iniset $CINDER_CONF DEFAULT glance_ca_certificates_file $SSL_BUNDLE_FILE
     fi
 
+    if [ "$GLANCE_V1_ENABLED" != "True" ]; then
+        iniset $CINDER_CONF DEFAULT glance_api_version 2
+    fi
+
     # Register SSL certificates if provided
     if is_ssl_enabled_service cinder; then
         ensure_certificates CINDER
diff --git a/lib/glance b/lib/glance
index cda357fa66..2ad971fed7 100644
--- a/lib/glance
+++ b/lib/glance
@@ -57,6 +57,7 @@ GLANCE_SCHEMA_JSON=$GLANCE_CONF_DIR/schema-image.json
 GLANCE_SWIFT_STORE_CONF=$GLANCE_CONF_DIR/glance-swift-store.conf
 GLANCE_GLARE_CONF=$GLANCE_CONF_DIR/glance-glare.conf
 GLANCE_GLARE_PASTE_INI=$GLANCE_CONF_DIR/glance-glare-paste.ini
+GLANCE_V1_ENABLED=${GLANCE_V1_ENABLED:-True}
 
 if is_ssl_enabled_service "glance" || is_service_enabled tls-proxy; then
     GLANCE_SERVICE_PROTOCOL="https"
@@ -134,6 +135,12 @@ function configure_glance {
         iniset $GLANCE_API_CONF DEFAULT disk_formats "ami,ari,aki,vhd,vmdk,raw,qcow2,vdi,iso,ploop"
     fi
 
+    # NOTE(flaper87): To uncomment as soon as all services consuming Glance are
+    # able to consume V2 entirely.
+    if [ "$GLANCE_V1_ENABLED" != "True" ]; then
+        iniset $GLANCE_API_CONF DEFAULT enable_v1_api False
+    fi
+
     # Store specific configs
     iniset $GLANCE_API_CONF glance_store filesystem_store_datadir $GLANCE_IMAGE_DIR/
     if is_service_enabled g-glare; then
diff --git a/lib/tempest b/lib/tempest
index e556935cb5..19042ef0c2 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -292,6 +292,9 @@ function configure_tempest {
 
     # Image Features
     iniset $TEMPEST_CONFIG image-feature-enabled deactivate_image True
+    if [ "$GLANCE_V1_ENABLED" != "True" ]; then
+        iniset $TEMPEST_CONFIG image-feature-enabled api_v1 False
+    fi
 
     # Compute
     iniset $TEMPEST_CONFIG compute ssh_user ${DEFAULT_INSTANCE_USER:-cirros} # DEPRECATED

From b97a60e90c46c101b6c2c9a5dbf42140bd8bb8d1 Mon Sep 17 00:00:00 2001
From: Brant Knudson <bknudson@us.ibm.com>
Date: Fri, 3 Jun 2016 15:59:11 -0500
Subject: [PATCH 0472/2409] Keystone uwsgi performance tuning

I ran some tests locally that showed that when using the uwsgi
deploy the keystone server wasn't using all the processes
available. When I switched from "threads" to "processes" the
concurrent performance improved considerably. So I'm proposing
that devstack switch to processes to improve performance.

Change-Id: I8cfe9272e098e636441b7cfb51bff08d62c3336e
---
 lib/keystone | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index c94bcd3a71..26fa1d43da 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -318,10 +318,10 @@ function configure_keystone {
         fi
 
         iniset "$KEYSTONE_PUBLIC_UWSGI_FILE" uwsgi wsgi-file "$KEYSTONE_BIN_DIR/keystone-wsgi-public"
-        iniset "$KEYSTONE_PUBLIC_UWSGI_FILE" uwsgi threads $(nproc)
+        iniset "$KEYSTONE_PUBLIC_UWSGI_FILE" uwsgi processes $(nproc)
 
         iniset "$KEYSTONE_ADMIN_UWSGI_FILE" uwsgi wsgi-file "$KEYSTONE_BIN_DIR/keystone-wsgi-admin"
-        iniset "$KEYSTONE_ADMIN_UWSGI_FILE" uwsgi threads $API_WORKERS
+        iniset "$KEYSTONE_ADMIN_UWSGI_FILE" uwsgi processes $API_WORKERS
 
         # Common settings
         for file in "$KEYSTONE_PUBLIC_UWSGI_FILE" "$KEYSTONE_ADMIN_UWSGI_FILE"; do

From a1c70f2a7519bd7482b2834f380f2a9f5f61fb5a Mon Sep 17 00:00:00 2001
From: Angus Lees <gus@inodes.org>
Date: Tue, 31 May 2016 14:43:14 +1000
Subject: [PATCH 0473/2409] neutron-legacy: Consistently use `--config-file
 foo`

This change adjusts a few instances of `--config-file=foo` to
`--config-file foo` (no `=`) in order to make neutron command
lines more consistent and easier to match in sudoers/rootwrap
filters.

This is particularly useful for oslo.privsep, which needs to start a
helper command with the same `--config-file` arguments (see
Ia9675dff9232e0e987a836ecaf9e842eb5c3cb18).

Change-Id: I91fe18f66f3c3bc2ccd1ca8be91be2915ed3e3ec
---
 lib/neutron-legacy              | 8 ++++----
 lib/neutron_plugins/services/l3 | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 5e5207bc63..73123ef1d5 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -297,7 +297,7 @@ function _determine_config_server {
 }
 
 function _determine_config_l3 {
-    local opts="--config-file $NEUTRON_CONF --config-file=$Q_L3_CONF_FILE"
+    local opts="--config-file $NEUTRON_CONF --config-file $Q_L3_CONF_FILE"
     if is_service_enabled q-fwaas; then
         opts+=" --config-file $Q_FWAAS_CONF_FILE"
     fi
@@ -524,7 +524,7 @@ function start_mutnauq_l2_agent {
 }
 
 function start_mutnauq_other_agents {
-    run_process q-dhcp "$AGENT_DHCP_BINARY --config-file $NEUTRON_CONF --config-file=$Q_DHCP_CONF_FILE"
+    run_process q-dhcp "$AGENT_DHCP_BINARY --config-file $NEUTRON_CONF --config-file $Q_DHCP_CONF_FILE"
 
     if is_service_enabled neutron-vpnaas; then
         :  # Started by plugin
@@ -532,8 +532,8 @@ function start_mutnauq_other_agents {
         run_process q-l3 "$AGENT_L3_BINARY $(determine_config_files neutron-l3-agent)"
     fi
 
-    run_process q-meta "$AGENT_META_BINARY --config-file $NEUTRON_CONF --config-file=$Q_META_CONF_FILE"
-    run_process q-lbaas "$AGENT_LBAAS_BINARY --config-file $NEUTRON_CONF --config-file=$LBAAS_AGENT_CONF_FILENAME"
+    run_process q-meta "$AGENT_META_BINARY --config-file $NEUTRON_CONF --config-file $Q_META_CONF_FILE"
+    run_process q-lbaas "$AGENT_LBAAS_BINARY --config-file $NEUTRON_CONF --config-file $LBAAS_AGENT_CONF_FILENAME"
     run_process q-metering "$AGENT_METERING_BINARY --config-file $NEUTRON_CONF --config-file $METERING_AGENT_CONF_FILENAME"
 
     if [ "$VIRT_DRIVER" = 'xenserver' ]; then
diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index a5a6c81ea4..3a6f6eb53f 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -83,7 +83,7 @@ SUBNETPOOL_SIZE_V4=${SUBNETPOOL_SIZE_V4:-24}
 SUBNETPOOL_SIZE_V6=${SUBNETPOOL_SIZE_V6:-64}
 
 function _determine_config_l3 {
-    local opts="--config-file $NEUTRON_CONF --config-file=$Q_L3_CONF_FILE"
+    local opts="--config-file $NEUTRON_CONF --config-file $Q_L3_CONF_FILE"
     echo "$opts"
 }
 

From f179eb7c4798d5058ebbfd1c7b851070f86fd5ac Mon Sep 17 00:00:00 2001
From: Huan Xie <huan.xie@citrix.com>
Date: Thu, 2 Jun 2016 01:24:22 -0700
Subject: [PATCH 0474/2409] Support installing OpenStack on XenServer 7.0

XenServer 7.0 has changed some iso files' name, this made devstack script
install_os_domU.sh failed to install VM before installing OpenStack. This
patch is to fix the problem, make install_os_domU.sh support 7.0 and other
prior versions of XenServer

Change-Id: I49459bfff2b101fc6927eb4578c5eb47cc8c3ad6
---
 tools/xen/install_os_domU.sh | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/tools/xen/install_os_domU.sh b/tools/xen/install_os_domU.sh
index 8b97265e21..3a61215b5b 100755
--- a/tools/xen/install_os_domU.sh
+++ b/tools/xen/install_os_domU.sh
@@ -183,10 +183,8 @@ if [ -z "$templateuuid" ]; then
         # Copy the tools DEB to the XS web server
         XS_TOOLS_URL="https://github.com/downloads/citrix-openstack/warehouse/xe-guest-utilities_5.6.100-651_amd64.deb"
         ISO_DIR="/opt/xensource/packages/iso"
-        XS_TOOLS_FILE_NAME="xs-tools.deb"
-        XS_TOOLS_PATH="/root/$XS_TOOLS_FILE_NAME"
         if [ -e "$ISO_DIR" ]; then
-            TOOLS_ISO=$(ls -1 $ISO_DIR/xs-tools-*.iso | head -1)
+            TOOLS_ISO=$(ls -1 $ISO_DIR/*-tools-*.iso | head -1)
             TMP_DIR=/tmp/temp.$RANDOM
             mkdir -p $TMP_DIR
             mount -o loop $TOOLS_ISO $TMP_DIR

From 84409516d56417464dfe0c4e6904a1a76f9fa254 Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Tue, 18 Aug 2015 17:24:44 -0400
Subject: [PATCH 0475/2409] Remove fwaas from DevStack

Depends-On: Iadcee07e873fcb4f099ebccc2e33780e74438140
Change-Id: Ic60cd1fa90c19dfac00be583e2ddc5633dbb68a3
---
 lib/neutron-legacy                    | 25 --------------------
 lib/neutron_plugins/services/firewall | 33 ---------------------------
 2 files changed, 58 deletions(-)
 delete mode 100644 lib/neutron_plugins/services/firewall

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 7eb8637634..5f117631cf 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -101,7 +101,6 @@ AGENT_META_BINARY="$NEUTRON_BIN_DIR/neutron-metadata-agent"
 # loaded from per-plugin  scripts in lib/neutron_plugins/
 Q_DHCP_CONF_FILE=$NEUTRON_CONF_DIR/dhcp_agent.ini
 Q_L3_CONF_FILE=$NEUTRON_CONF_DIR/l3_agent.ini
-Q_FWAAS_CONF_FILE=$NEUTRON_CONF_DIR/fwaas_driver.ini
 Q_META_CONF_FILE=$NEUTRON_CONF_DIR/metadata_agent.ini
 
 # Default name for Neutron database
@@ -267,13 +266,8 @@ source $TOP_DIR/lib/neutron_plugins/services/loadbalancer
 # Hardcoding for 1 service plugin for now
 source $TOP_DIR/lib/neutron_plugins/services/metering
 
-# Firewall Service Plugin functions
-# ---------------------------------
-source $TOP_DIR/lib/neutron_plugins/services/firewall
-
 # L3 Service functions
 source $TOP_DIR/lib/neutron_plugins/services/l3
-
 # Use security group or not
 if has_neutron_plugin_security_group; then
     Q_USE_SECGROUP=${Q_USE_SECGROUP:-True}
@@ -334,10 +328,6 @@ function configure_mutnauq {
     if is_service_enabled q-metering; then
         _configure_neutron_metering
     fi
-    if is_service_enabled q-fwaas; then
-        deprecated "Configuring q-fwaas through devstack is deprecated"
-        _configure_neutron_fwaas
-    fi
     if is_service_enabled q-agt q-svc; then
         _configure_neutron_service
     fi
@@ -435,10 +425,6 @@ function install_mutnauq {
 
     git_clone $NEUTRON_REPO $NEUTRON_DIR $NEUTRON_BRANCH
     setup_develop $NEUTRON_DIR
-    if is_service_enabled q-fwaas; then
-        git_clone $NEUTRON_FWAAS_REPO $NEUTRON_FWAAS_DIR $NEUTRON_FWAAS_BRANCH
-        setup_develop $NEUTRON_FWAAS_DIR
-    fi
     if is_service_enabled q-lbaas; then
         git_clone $NEUTRON_LBAAS_REPO $NEUTRON_LBAAS_DIR $NEUTRON_LBAAS_BRANCH
         setup_develop $NEUTRON_LBAAS_DIR
@@ -580,9 +566,6 @@ function stop_mutnauq_other {
     if is_service_enabled q-lbaas; then
         neutron_lbaas_stop
     fi
-    if is_service_enabled q-fwaas; then
-        neutron_fwaas_stop
-    fi
     if is_service_enabled q-metering; then
         neutron_metering_stop
     fi
@@ -877,14 +860,6 @@ function _configure_neutron_metering {
     neutron_agent_metering_configure_agent
 }
 
-function _configure_neutron_fwaas {
-    if [ -f $NEUTRON_FWAAS_DIR/etc/neutron_fwaas.conf ]; then
-        cp $NEUTRON_FWAAS_DIR/etc/neutron_fwaas.conf $NEUTRON_CONF_DIR
-    fi
-    neutron_fwaas_configure_common
-    neutron_fwaas_configure_driver
-}
-
 function _configure_dvr {
     iniset $NEUTRON_CONF DEFAULT router_distributed True
     iniset $Q_L3_CONF_FILE DEFAULT agent_mode $Q_DVR_MODE
diff --git a/lib/neutron_plugins/services/firewall b/lib/neutron_plugins/services/firewall
deleted file mode 100644
index 40968fa04c..0000000000
--- a/lib/neutron_plugins/services/firewall
+++ /dev/null
@@ -1,33 +0,0 @@
-#!/bin/bash
-
-# Neutron firewall plugin
-# ---------------------------
-
-# Save trace setting
-_XTRACE_NEUTRON_FIREWALL=$(set +o | grep xtrace)
-set +o xtrace
-
-FWAAS_PLUGIN=${FWAAS_PLUGIN:-neutron_fwaas.services.firewall.fwaas_plugin.FirewallPlugin}
-FWAAS_DRIVER=${FWAAS_DRIVER:-neutron_fwaas.services.firewall.drivers.linux.iptables_fwaas.IptablesFwaasDriver}
-
-function neutron_fwaas_configure_common {
-    _neutron_service_plugin_class_add $FWAAS_PLUGIN
-}
-
-function neutron_fwaas_configure_driver {
-    # Uses oslo config generator to generate FWaaS sample configuration files
-    (cd $NEUTRON_FWAAS_DIR && exec ./tools/generate_config_file_samples.sh)
-
-    FWAAS_DRIVER_CONF_FILENAME=/etc/neutron/fwaas_driver.ini
-    cp $NEUTRON_FWAAS_DIR/etc/fwaas_driver.ini.sample $FWAAS_DRIVER_CONF_FILENAME
-
-    iniset_multiline $FWAAS_DRIVER_CONF_FILENAME fwaas enabled True
-    iniset_multiline $FWAAS_DRIVER_CONF_FILENAME fwaas driver "$FWAAS_DRIVER"
-}
-
-function neutron_fwaas_stop {
-    :
-}
-
-# Restore xtrace
-$_XTRACE_NEUTRON_FIREWALL

From 8063fee829d1e22bb7958599d8b0359846cde462 Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Tue, 24 May 2016 11:27:36 -0700
Subject: [PATCH 0476/2409] Add neutron-metering agent and configuration

This is the equivalent of the q-metering from neutron-legacy

Change-Id: Ie2ad6e18cfd6f5cd9af0da30bc36a1cd27e39189
---
 lib/neutron | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/lib/neutron b/lib/neutron
index fa2e926995..966bb54b81 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -242,6 +242,13 @@ function configure_neutron_new {
         iniset $NEUTRON_CONF DEFAULT ssl_key_file "$NEUTRON_SSL_KEY"
     fi
 
+    # Metering
+    if is_service_enabled neutron-metering; then
+        source $TOP_DIR/neutron_plugins/services/metering
+        neutron_agent_metering_configure_common
+        neutron_agent_metering_configure_agent
+    fi
+
 }
 
 # configure_neutron_rootwrap() - configure Neutron's rootwrap
@@ -428,6 +435,10 @@ function start_neutron_new {
     if is_service_enabled neutron-metadata-agent; then
         run_process neutron-metadata-agent "$NEUTRON_BIN_DIR/$NEUTRON_META_BINARY $NEUTRON_CONFIG_ARG"
     fi
+
+    if is_service_enabled neutron-metering; then
+        run_process neutron-metering "$AGENT_METERING_BINARY --config-file $NEUTRON_CONF --config-file $METERING_AGENT_CONF_FILENAME"
+    fi
 }
 
 # stop_neutron() - Stop running processes (non-screen)

From f90c8e105ba71fb8ac019b61d2a0bb94d9164169 Mon Sep 17 00:00:00 2001
From: Mike Turek <mjturek@linux.vnet.ibm.com>
Date: Tue, 19 Jan 2016 19:28:51 +0000
Subject: [PATCH 0477/2409] Set deploywait_timeout via localrc option

Currently a hardcoded value is used for the DEPLOYWAIT timeout in
tempest. The patch in review 269249 adds a config option to use
instead of this hardcoded value. This patch allows the value to be
set via the BUILD_TIMEOUT variable.

Change-Id: Id79014fd6e07f93029111f6c28e3537e2e39be9f
Related-Bug: 1526466
---
 lib/tempest | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/tempest b/lib/tempest
index fd98c948f2..621bd625f0 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -462,6 +462,7 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG baremetal driver_enabled True
         iniset $TEMPEST_CONFIG baremetal unprovision_timeout $BUILD_TIMEOUT
         iniset $TEMPEST_CONFIG baremetal active_timeout $BUILD_TIMEOUT
+        iniset $TEMPEST_CONFIG baremetal deploywait_timeout $BUILD_TIMEOUT
         iniset $TEMPEST_CONFIG baremetal deploy_img_dir $FILES
         iniset $TEMPEST_CONFIG baremetal node_uuid $IRONIC_NODE_UUID
         iniset $TEMPEST_CONFIG compute-feature-enabled change_password False

From 36afed43534e5f50e0598ff69c7ea8249c24b5c2 Mon Sep 17 00:00:00 2001
From: Huan Xie <huan.xie@citrix.com>
Date: Mon, 6 Jun 2016 20:17:48 -0700
Subject: [PATCH 0478/2409] Set ima_disk_format to vhd when hypervisor is
 XenServer

When running tempest testcase test_minimum_basic_scenario will always fail
due to lack of configuration [scenario] img_disk_format=vhd in tempest.conf
This patchset is to add this configuration when XenServer is used.

Change-Id: I4b916200e6eefb62f148ec8b644fb23ffc7e00a6
Closes-Bug: #1589787
---
 lib/tempest | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/tempest b/lib/tempest
index c492182fee..1bb70c16ae 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -290,6 +290,7 @@ function configure_tempest {
     fi
     if [ "$VIRT_DRIVER" = "xenserver" ]; then
         iniset $TEMPEST_CONFIG image disk_formats "ami,ari,aki,vhd,raw,iso"
+        iniset $TEMPEST_CONFIG scenario img_disk_format vhd
     fi
 
     # Image Features

From a44dd9a741a08d9f586ae8fe1d2543bcf32f6593 Mon Sep 17 00:00:00 2001
From: Timur Sufiev <tsufiev@mirantis.com>
Date: Fri, 29 Apr 2016 14:08:51 +0300
Subject: [PATCH 0479/2409] Support Glance CORS options in devstack
 configuration

To properly test the integration between Glance CORS feature and
Horizon Javascript environment uploading image files directly to Glance
(using this feature), we need to enable CORS support for Glance in
integration tests. Adding corresponding Devstack variable to configure
Glance in such a way that it accepts direct requests from Horizon
Javascript is the prerequisite step for the integration testing of this
feature.

By default Horizon and Glance are located on the same host, hence
default value cors.allowed_origin = http://$SERVICE_HOST should work.
If a more complicated setup is desired, where Horizon is located on a
different host, GLANCE_CORS_ALLOWED_ORIGIN environment variable should
be exported to Devstack.

Partially implements blueprint: horizon-glance-large-image-upload
Change-Id: I4881fb6631c2daa2ad8946210eff4bb021957374
---
 lib/glance | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/lib/glance b/lib/glance
index f2a6db6edc..ce5f867430 100644
--- a/lib/glance
+++ b/lib/glance
@@ -143,6 +143,13 @@ function configure_glance {
 
     iniset $GLANCE_API_CONF DEFAULT workers "$API_WORKERS"
 
+    # CORS feature support - to allow calls from Horizon by default
+    if [ -n "$GLANCE_CORS_ALLOWED_ORIGIN" ]; then
+        iniset $GLANCE_API_CONF cors allowed_origin "$GLANCE_CORS_ALLOWED_ORIGIN"
+    else
+        iniset $GLANCE_API_CONF cors allowed_origin "http://$SERVICE_HOST"
+    fi
+
     # Store the images in swift if enabled.
     if is_service_enabled s-proxy; then
         iniset $GLANCE_API_CONF glance_store default_store swift

From 026cad84a34ff914707538470ec3ae6e2015e54b Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 7 Jun 2016 10:55:54 -0400
Subject: [PATCH 0480/2409] remove local.conf documentation for phases we don't
 implement

The local.conf docs talk about phases which don't exist for config
file processing, which makes it more confusing then it needs to be.

Change-Id: If7f9255eab0535c3d57a2fd5f1bc18ba4d0801aa
---
 doc/source/configuration.rst | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 384ceee41a..1161b344e2 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -36,10 +36,6 @@ The defined phases are:
 
 -  **local** - extracts ``localrc`` from ``local.conf`` before
    ``stackrc`` is sourced
--  **pre-install** - runs after the system packages are installed but
-   before any of the source repositories are installed
--  **install** - runs immediately after the repo installations are
-   complete
 -  **post-config** - runs after the layer 2 services are configured and
    before they are started
 -  **extra** - runs after services are started and before any files in

From e34ec9901ea04b4fab81742f9556e486849dfb4e Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Tue, 7 Jun 2016 12:36:50 -0400
Subject: [PATCH 0481/2409] Neutron/l3 - die if provider settings for v6 are
 not set

If you are using provider networking, and have IP_VERSION set to include
IPv6 (which we do by default) - you must set the required variables.

If you do not want this behavior, set IP_VERSION=4

This arose from a third party CI system which was configured[1] to have
provider networking, but would explode when hitting the router IPv6
setup step[2] since there was no IPv6 subnet created, and IPV6_SUBNET_ID
would be empty, causing a python-neutronclient error and causing
stack.sh to exit.

[1]: http://paste.openstack.org/show/508710/
[2]: https://github.com/openstack-dev/devstack/blob/c35110e7c5c35dd1edc310dc3d0bb8693e58d336/lib/neutron_plugins/services/l3#L320

Change-Id: I267799b62284c3086ed7c3e2d8a9cbadb9ddcd60
---
 lib/neutron_plugins/services/l3 | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index a5a6c81ea4..dbd2b45d15 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -150,7 +150,9 @@ function create_neutron_initial_network {
             die_if_not_set $LINENO SUBNET_ID "Failure creating SUBNET_ID for $PROVIDER_SUBNET_NAME $project_id"
         fi
 
-        if [[ "$IP_VERSION" =~ .*6 ]] && [[ -n "$IPV6_PROVIDER_FIXED_RANGE" ]] && [[ -n "$IPV6_PROVIDER_NETWORK_GATEWAY" ]]; then
+        if [[ "$IP_VERSION" =~ .*6 ]]; then
+            die_if_not_set $LINENO IPV6_PROVIDER_FIXED_RANGE "IPV6_PROVIDER_FIXED_RANGE has not been set, but Q_USE_PROVIDERNET_FOR_PUBLIC is true and IP_VERSION includes 6"
+            die_if_not_set $LINENO IPV6_PROVIDER_NETWORK_GATEWAY "IPV6_PROVIDER_NETWORK_GATEWAY has not been set, but Q_USE_PROVIDERNET_FOR_PUBLIC is true and IP_VERSION includes 6"
             SUBNET_V6_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create --tenant_id $project_id --ip_version 6 --ipv6-address-mode $IPV6_ADDRESS_MODE --gateway $IPV6_PROVIDER_NETWORK_GATEWAY --name $IPV6_PROVIDER_SUBNET_NAME $NET_ID $IPV6_PROVIDER_FIXED_RANGE | grep 'id' | get_field 2)
             die_if_not_set $LINENO SUBNET_V6_ID "Failure creating SUBNET_V6_ID for $IPV6_PROVIDER_SUBNET_NAME $project_id"
         fi

From 75ace7a5edbb6496633b97dc1d6b60e000ff3e5f Mon Sep 17 00:00:00 2001
From: Brant Knudson <bknudson@us.ibm.com>
Date: Tue, 7 Jun 2016 17:44:06 -0500
Subject: [PATCH 0482/2409] Correct keystone memcached host setting

keystone was configured to connect to memcached on the host IP
address. Unfortunately, memcached is only listening on localhost,
so this setting actually hurts performance as keystone fails to
connect to the memcached server. There's no indication of this in
the keystone logs since this is just how memcache client works
(ignoring errors).

You can verify this by
1) in /etc/memcached.conf, set -vv
2) restart memcached: service memcached restart
3) watch /var/log/memcached.log
4) There will be no output

with this change, there will be output in /var/log/memcached.log

Also the performance should be a lot better.

Change-Id: I95d798d122e2a95e27eb1d2c4e786c3cd844440b
---
 lib/keystone | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/keystone b/lib/keystone
index c94bcd3a71..5695004c4a 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -246,7 +246,7 @@ function configure_keystone {
     # Enable caching
     iniset $KEYSTONE_CONF cache enabled "True"
     iniset $KEYSTONE_CONF cache backend "oslo_cache.memcache_pool"
-    iniset $KEYSTONE_CONF cache memcache_servers $SERVICE_HOST:11211
+    iniset $KEYSTONE_CONF cache memcache_servers localhost:11211
 
     # Do not cache the catalog backend due to https://bugs.launchpad.net/keystone/+bug/1537617
     iniset $KEYSTONE_CONF catalog caching "False"

From febd55a230982bd5a5de9bbf2444b1aa5c459ba3 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Wed, 8 Jun 2016 07:11:03 +0000
Subject: [PATCH 0483/2409] Updated from generate-devstack-plugins-list

Change-Id: I4ffb619ccdd4928d0772246a7c76353f21be6bb4
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 2760f854a4..585c91c29c 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -103,6 +103,7 @@ neutron-lbaas                          `git://git.openstack.org/openstack/neutro
 neutron-lbaas-dashboard                `git://git.openstack.org/openstack/neutron-lbaas-dashboard <https://git.openstack.org/cgit/openstack/neutron-lbaas-dashboard>`__
 neutron-vpnaas                         `git://git.openstack.org/openstack/neutron-vpnaas <https://git.openstack.org/cgit/openstack/neutron-vpnaas>`__
 nova-docker                            `git://git.openstack.org/openstack/nova-docker <https://git.openstack.org/cgit/openstack/nova-docker>`__
+nova-lxd                               `git://git.openstack.org/openstack/nova-lxd <https://git.openstack.org/cgit/openstack/nova-lxd>`__
 nova-powervm                           `git://git.openstack.org/openstack/nova-powervm <https://git.openstack.org/cgit/openstack/nova-powervm>`__
 octavia                                `git://git.openstack.org/openstack/octavia <https://git.openstack.org/cgit/openstack/octavia>`__
 osprofiler                             `git://git.openstack.org/openstack/osprofiler <https://git.openstack.org/cgit/openstack/osprofiler>`__

From c425977a55dde6b99b07c716dc3cf82990bd4fa2 Mon Sep 17 00:00:00 2001
From: "Daniel P. Berrange" <berrange@redhat.com>
Date: Wed, 8 Jun 2016 16:53:06 +0100
Subject: [PATCH 0484/2409] nova.conf: set privsep helper command for os-vif
 plugins

privsep will default to invoking privsep-helper directly
via sudo, which won't work for people with a locked down
sudo config. To deal with this we should explicitly
configure the os-vif plugins to use nova-rootwrap for
running privsep-helper. This change makes such a change
for the two official in-tree os-vif plugins.

Change-Id: I3d26251206a57599385f2b9f3e0ef7d91daafe35
---
 lib/nova | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/nova b/lib/nova
index af5d1222a0..65609369a9 100644
--- a/lib/nova
+++ b/lib/nova
@@ -483,6 +483,9 @@ function create_nova_conf {
 
     iniset $NOVA_CONF privsep_osbrick helper_command "sudo nova-rootwrap \$rootwrap_config privsep-helper --config-file $NOVA_CONF"
 
+    iniset $NOVA_CONF vif_plug_ovs_privileged helper_command "sudo nova-rootwrap \$rootwrap_config privsep-helper --config-file $NOVA_CONF"
+    iniset $NOVA_CONF vif_plug_linux_bridge_privileged helper_command "sudo nova-rootwrap \$rootwrap_config privsep-helper --config-file $NOVA_CONF"
+
     if is_service_enabled n-api; then
         if is_service_enabled n-api-meta; then
             # If running n-api-meta as a separate service

From 2ae8b09b6182d2927c684adb14c84800e460c2e2 Mon Sep 17 00:00:00 2001
From: Yi Zhao <zhaoyi@cmss.chinamobile.com>
Date: Thu, 12 May 2016 12:11:24 +0800
Subject: [PATCH 0485/2409] Fix quoting in vercmp check for kernel version

I352362cf59e492fa9f7725190f0243f2436ac347 switched this to vercmp, but
using single-quote (') will mean that the kernel version isn't
actually expanded for the comparision.

I guess, like the original change, the fact it isn't working is
hidden.  Trusty seems to have 3.13 ... I can't imagine we support
anything before this ... so I'd also be happy if someone with some OVS
knowledge wants to just delete it.

(This change was originally an alternative to
I352362cf59e492fa9f7725190f0243f2436ac347 but got the quoting right)

Change-Id: I9fa514885c20b1135fb0680cf61fc04628fbecbe
Closes-Bug: #1580850
---
 lib/neutron_plugins/ovs_base | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/ovs_base b/lib/neutron_plugins/ovs_base
index 95f4663a52..ecf252f88b 100644
--- a/lib/neutron_plugins/ovs_base
+++ b/lib/neutron_plugins/ovs_base
@@ -54,7 +54,7 @@ function _neutron_ovs_base_install_ubuntu_dkms {
     local kernel_major_minor
     kernel_major_minor=`echo $kernel_version | cut -d. -f1-2`
     # From kernel 3.13 on, openvswitch-datapath-dkms is not needed
-    if vercmp '$kernel_major_minor' '<' '3.13'; then
+    if vercmp "$kernel_major_minor" "<" "3.13" ; then
         install_package "dkms openvswitch-datapath-dkms linux-headers-$kernel_version"
     fi
 }

From 90356d82709fd5fa50d496faea978488f351ba3e Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Fri, 10 Jun 2016 07:59:45 +0000
Subject: [PATCH 0486/2409] Updated from generate-devstack-plugins-list

Change-Id: I121cf87e3c4e26b4a223a3e9b8a028763994ad89
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 585c91c29c..bae2afdb39 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -64,6 +64,7 @@ group-based-policy                     `git://git.openstack.org/openstack/group-
 higgins                                `git://git.openstack.org/openstack/higgins <https://git.openstack.org/cgit/openstack/higgins>`__
 ironic                                 `git://git.openstack.org/openstack/ironic <https://git.openstack.org/cgit/openstack/ironic>`__
 ironic-inspector                       `git://git.openstack.org/openstack/ironic-inspector <https://git.openstack.org/cgit/openstack/ironic-inspector>`__
+ironic-staging-drivers                 `git://git.openstack.org/openstack/ironic-staging-drivers <https://git.openstack.org/cgit/openstack/ironic-staging-drivers>`__
 kingbird                               `git://git.openstack.org/openstack/kingbird <https://git.openstack.org/cgit/openstack/kingbird>`__
 kuryr                                  `git://git.openstack.org/openstack/kuryr <https://git.openstack.org/cgit/openstack/kuryr>`__
 magnum                                 `git://git.openstack.org/openstack/magnum <https://git.openstack.org/cgit/openstack/magnum>`__

From 5cda4911adde3e8d6b20d90e52520d0587cf4399 Mon Sep 17 00:00:00 2001
From: "Andrea Frittoli (andreaf)" <andrea.frittoli@hpe.com>
Date: Thu, 9 Jun 2016 00:33:30 +0100
Subject: [PATCH 0487/2409] Enable admin_domain_scope by default in Tempest

Tempest introduced a new ability to use domain scoped tokens for
identity v3 admin APIs. Since domain scoped tokens can be used
with the base keystone policy used in the gate, and the
pre-provisioned admin user is assigned a role on the domain, turn
the option alway on.

Change-Id: Ib1bb958eee076364b407fc03e77e6882d92147d2
Depends-on: I91ca907992428a5a14fb8d48a4fad105d2906e27
---
 lib/tempest | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index 3cd300cca1..4ddff57135 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -261,6 +261,8 @@ function configure_tempest {
     # Identity
     iniset $TEMPEST_CONFIG identity uri "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:5000/v2.0/"
     iniset $TEMPEST_CONFIG identity uri_v3 "$KEYSTONE_SERVICE_URI_V3"
+    # Use domain scoped tokens for admin v3 tests, v3 dynamic credentials of v3 account generation
+    iniset $TEMPEST_CONFIG identity admin_domain_scope True
     if [[ "$TEMPEST_HAS_ADMIN" == "True" ]]; then
         iniset $TEMPEST_CONFIG auth admin_username $admin_username
         iniset $TEMPEST_CONFIG auth admin_password "$password"

From 0c0c09af3b14b74b035b50956e545832b26cb6af Mon Sep 17 00:00:00 2001
From: Alex Meade <mr.alex.meade@gmail.com>
Date: Fri, 13 May 2016 10:57:29 -0400
Subject: [PATCH 0488/2409] Set volume service min and max microversions

Implements Blueprint: configure-tempest-volume-microversion
Related to: I3d9b3fe288333721bf3b2c6c988949f2f253bfcc

Change-Id: I80c6a0c46c667291c6f7fe2a036717504c110314
---
 lib/tempest | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index 3cd300cca1..4f065c998e 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -433,6 +433,19 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG volume-feature-enabled volume_services True
     # TODO(ameade): Remove the api_v3 flag when Mitaka and Liberty are end of life.
     iniset $TEMPEST_CONFIG volume-feature-enabled api_v3 True
+    local tempest_volume_min_microversion=${TEMPEST_VOLUME_MIN_MICROVERSION:-None}
+    local tempest_volume_max_microversion=${TEMPEST_VOLUME_MAX_MICROVERSION:-"latest"}
+    if [ "$tempest_volume_min_microversion" == "None" ]; then
+        inicomment $TEMPEST_CONFIG volume min_microversion
+    else
+        iniset $TEMPEST_CONFIG volume min_microversion $tempest_volume_min_microversion
+    fi
+
+    if [ "$tempest_volume_max_microversion" == "None" ]; then
+        inicomment $TEMPEST_CONFIG volume max_microversion
+    else
+        iniset $TEMPEST_CONFIG volume max_microversion $tempest_volume_max_microversion
+    fi
 
     if ! is_service_enabled c-bak; then
         iniset $TEMPEST_CONFIG volume-feature-enabled backup False

From fd1f7ba066081eb1e2580a241f816a195c9621d3 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Sun, 12 Jun 2016 08:01:13 +0000
Subject: [PATCH 0489/2409] Updated from generate-devstack-plugins-list

Change-Id: Ia42329d01758cafa5d59ca79eebd5f31515bef47
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index bae2afdb39..520181e2a9 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -84,6 +84,7 @@ networking-calico                      `git://git.openstack.org/openstack/networ
 networking-cisco                       `git://git.openstack.org/openstack/networking-cisco <https://git.openstack.org/cgit/openstack/networking-cisco>`__
 networking-fortinet                    `git://git.openstack.org/openstack/networking-fortinet <https://git.openstack.org/cgit/openstack/networking-fortinet>`__
 networking-generic-switch              `git://git.openstack.org/openstack/networking-generic-switch <https://git.openstack.org/cgit/openstack/networking-generic-switch>`__
+networking-huawei                      `git://git.openstack.org/openstack/networking-huawei <https://git.openstack.org/cgit/openstack/networking-huawei>`__
 networking-infoblox                    `git://git.openstack.org/openstack/networking-infoblox <https://git.openstack.org/cgit/openstack/networking-infoblox>`__
 networking-l2gw                        `git://git.openstack.org/openstack/networking-l2gw <https://git.openstack.org/cgit/openstack/networking-l2gw>`__
 networking-midonet                     `git://git.openstack.org/openstack/networking-midonet <https://git.openstack.org/cgit/openstack/networking-midonet>`__

From a9a2f7199441d80e8d29ae9909e9b82f75f98d2e Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Tue, 14 Jun 2016 08:08:37 +0000
Subject: [PATCH 0490/2409] Updated from generate-devstack-plugins-list

Change-Id: Ied84c5f38a8002228e01797d56c39315ff997142
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 520181e2a9..0ceb829d96 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -71,6 +71,7 @@ magnum                                 `git://git.openstack.org/openstack/magnum
 magnum-ui                              `git://git.openstack.org/openstack/magnum-ui <https://git.openstack.org/cgit/openstack/magnum-ui>`__
 manila                                 `git://git.openstack.org/openstack/manila <https://git.openstack.org/cgit/openstack/manila>`__
 mistral                                `git://git.openstack.org/openstack/mistral <https://git.openstack.org/cgit/openstack/mistral>`__
+monasca-analytics                      `git://git.openstack.org/openstack/monasca-analytics <https://git.openstack.org/cgit/openstack/monasca-analytics>`__
 monasca-api                            `git://git.openstack.org/openstack/monasca-api <https://git.openstack.org/cgit/openstack/monasca-api>`__
 monasca-ceilometer                     `git://git.openstack.org/openstack/monasca-ceilometer <https://git.openstack.org/cgit/openstack/monasca-ceilometer>`__
 monasca-log-api                        `git://git.openstack.org/openstack/monasca-log-api <https://git.openstack.org/cgit/openstack/monasca-log-api>`__

From 1d23b93568e113169da54cff31ff8a2908648c02 Mon Sep 17 00:00:00 2001
From: Bob Ball <bob.ball@citrix.com>
Date: Mon, 13 Jun 2016 09:09:44 +0100
Subject: [PATCH 0491/2409] Fix brick cinderclient override

CINDERCLIENT_REPO cannot refer to both python-cinderclient.git
and python-brick-cinderclient-ext.git so make sure
the overrides have different names.

Bug introduced by: I6d0f09950ea1200d3367a53aa4a3eea9be7abc66

Change-Id: I9cbbf71ba08ef5394537d7b294846faa3c5be5bd
---
 stackrc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/stackrc b/stackrc
index 969d77d95c..7a5b821d4e 100644
--- a/stackrc
+++ b/stackrc
@@ -286,8 +286,8 @@ GITREPO["python-cinderclient"]=${CINDERCLIENT_REPO:-${GIT_BASE}/openstack/python
 GITBRANCH["python-cinderclient"]=${CINDERCLIENT_BRANCH:-master}
 
 # os-brick client for local volume attachement
-GITREPO["python-brick-cinderclient-ext"]=${CINDERCLIENT_REPO:-${GIT_BASE}/openstack/python-brick-cinderclient-ext.git}
-GITBRANCH["python-brick-cinderclient-ext"]=${CINDERCLIENT_BRANCH:-master}
+GITREPO["python-brick-cinderclient-ext"]=${BRICK_CINDERCLIENT_REPO:-${GIT_BASE}/openstack/python-brick-cinderclient-ext.git}
+GITBRANCH["python-brick-cinderclient-ext"]=${BRICK_CINDERCLIENT_BRANCH:-master}
 
 # python glance client library
 GITREPO["python-glanceclient"]=${GLANCECLIENT_REPO:-${GIT_BASE}/openstack/python-glanceclient.git}

From 9a0d1f90b8f0b412ebe3fa8a154f1c9222b2dde8 Mon Sep 17 00:00:00 2001
From: ricolin <rico.l@inwinstack.com>
Date: Wed, 15 Jun 2016 01:13:45 +0800
Subject: [PATCH 0492/2409] Remove deprecated auth_plugin config

Config auth_plugin in trustee group is deprecated.
Change to use auth_type in trustee group instead.
Closes-Bug: 1592482

Change-Id: Ib90d9c0299887201b37d26254693dc6b007a41dc
---
 lib/heat | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/heat b/lib/heat
index 730adada26..c841e0a499 100644
--- a/lib/heat
+++ b/lib/heat
@@ -156,7 +156,7 @@ function configure_heat {
     # If HEAT_DEFERRED_AUTH is unset or explicitly set to trusts, configure
     # the section for the client plugin associated with the trustee
     if [ -z "$HEAT_DEFERRED_AUTH" -o "trusts" == "$HEAT_DEFERRED_AUTH" ]; then
-        iniset $HEAT_CONF trustee auth_plugin password
+        iniset $HEAT_CONF trustee auth_type password
         iniset $HEAT_CONF trustee auth_url $KEYSTONE_AUTH_URI
         iniset $HEAT_CONF trustee username $HEAT_TRUSTEE_USER
         iniset $HEAT_CONF trustee password $HEAT_TRUSTEE_PASSWORD

From 1c4c16ce539b73f3e198cc4f2cc74de1bb9deb13 Mon Sep 17 00:00:00 2001
From: "watanabe.isao" <watanabe_isao@jp.fujitsu.com>
Date: Wed, 8 Jun 2016 14:18:10 +0900
Subject: [PATCH 0493/2409] Don't configure router in flat network

Due to the fix [1] of neutron-refactor, some flat network usages of devstack
installation start fale.

This fix enables ML2_L3_PLUGIN to be set to empty to solve the problem.

By default l3_router_plugin.L3RouterPlugin will be set to ML2_L3_PLUGIN,
and for neutron, in such of configuration, router (ASA some others) will be
set into supported_extension_aliases,
then devstack will create a router that we do not want in a flat network.

Before fix [1], we can disable q-l3 to aviod the issue.
But now we don't, and we need this fix to disable the whole L3 plugin.

[1] https://review.openstack.org/318145

Change-Id: I61a2142d5121e0af4cc6cdf50e6bceafaf791fb0
---
 lib/neutron_plugins/ml2 | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/ml2 b/lib/neutron_plugins/ml2
index 30e1b036f3..b353145c7e 100644
--- a/lib/neutron_plugins/ml2
+++ b/lib/neutron_plugins/ml2
@@ -38,7 +38,9 @@ Q_ML2_PLUGIN_VLAN_TYPE_OPTIONS=${Q_ML2_PLUGIN_VLAN_TYPE_OPTIONS:-}
 Q_ML2_PLUGIN_EXT_DRIVERS=${Q_ML2_PLUGIN_EXT_DRIVERS-port_security}
 
 # L3 Plugin to load for ML2
-ML2_L3_PLUGIN=${ML2_L3_PLUGIN:-neutron.services.l3_router.l3_router_plugin.L3RouterPlugin}
+# For some flat network environment, they not want to extend L3 plugin.
+# Make sure it is able to set empty to ML2_L3_PLUGIN.
+ML2_L3_PLUGIN=${ML2_L3_PLUGIN-neutron.services.l3_router.l3_router_plugin.L3RouterPlugin}
 
 function populate_ml2_config {
     CONF=$1

From 28128e2f7a509510fe4139bd1905ccf51bd0ceb8 Mon Sep 17 00:00:00 2001
From: Andreas Scheuring <andreas.scheuring@de.ibm.com>
Date: Thu, 14 Apr 2016 14:23:53 +0200
Subject: [PATCH 0494/2409] Docs for devstack MacVTap agent setup

MacVTap mechanism driver and agent have been added during
Mitaka [1][2]. Now adding the related doc to run a
multinode devstack with MacVTap compute nodes.

[1] https://review.openstack.org/209538
[2] https://review.openstack.org/275306

Depends-On: I0dd4c0d34d5f1c35b397e5e392ce107fb984b0ba
Change-Id: Ie743a207a5faeab2e2a7274fda503699f3072e98
---
 doc/source/guides/neutron.rst | 100 ++++++++++++++++++++++++++++++++++
 1 file changed, 100 insertions(+)

diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index a834314bcc..1e207970ae 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -362,6 +362,8 @@ the compute service ``nova-compute``.
 DevStack Configuration
 ----------------------
 
+.. _ovs-provider-network-controller:
+
 The following is a snippet of the DevStack configuration on the
 controller node.
 
@@ -553,3 +555,101 @@ setup, with small modifications for the interface mappings.
     LB_PHYSICAL_INTERFACE=eth0
     PUBLIC_PHYSICAL_NETWORK=default
     LB_INTERFACE_MAPPINGS=default:eth0
+
+Using MacVTap instead of Open vSwitch
+------------------------------------------
+
+Security groups are not supported by the MacVTap agent. Due to that, devstack
+configures the NoopFirewall driver on the compute node.
+
+MacVTap agent does not support l3, dhcp and metadata agent. Due to that you can
+chose between the following deployment scenarios:
+
+Single node with provider networks using config drive and external l3, dhcp
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+This scenario applies, if l3 and dhcp services are provided externally, or if
+you do not require them.
+
+
+::
+
+    [[local|localrc]]
+    HOST_IP=10.0.0.2
+    SERVICE_HOST=10.0.0.2
+    MYSQL_HOST=10.0.0.2
+    RABBIT_HOST=10.0.0.2
+    ADMIN_PASSWORD=secret
+    MYSQL_PASSWORD=secret
+    RABBIT_PASSWORD=secret
+    SERVICE_PASSWORD=secret
+
+    Q_ML2_PLUGIN_MECHANISM_DRIVERS=macvtap
+    Q_USE_PROVIDER_NETWORKING=True
+
+    #Enable Neutron services
+    disable_service n-net
+    enable_plugin neutron git://git.openstack.org/openstack/neutron
+    ENABLED_SERVICES+=,q-agt,q-svc
+
+    ## MacVTap agent options
+    Q_AGENT=macvtap
+    PHYSICAL_NETWORK=default
+
+    FIXED_RANGE="203.0.113.0/24"
+    NETWORK_GATEWAY=203.0.113.1
+    PROVIDER_SUBNET_NAME="provider_net"
+    PROVIDER_NETWORK_TYPE="vlan"
+    SEGMENTATION_ID=2010
+
+    [[post-config|/$Q_PLUGIN_CONF_FILE]]
+    [macvtap]
+    physical_interface_mappings = $PHYSICAL_NETWORK:eth1
+
+    [[post-config|$NOVA_CONF]]
+    force_config_drive = True
+
+
+Multi node with MacVTap compute node
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+This scenario applies, if you require OpenStack provided l3, dhcp or metadata
+services. Those are hosted on a separate controller and network node, running
+some other l2 agent technology (in this example Open vSwitch). This node needs
+to be configured for VLAN tenant networks.
+
+For OVS, a similar configuration like described in the
+:ref:`OVS Provider Network <ovs-provider-network-controller>` section can be
+used. Just add the the following line to this local.conf, which also loads
+the MacVTap mechanism driver:
+
+::
+
+    [[local|localrc]]
+    ...
+    Q_ML2_PLUGIN_MECHANISM_DRIVERS=openvswitch,linuxbridge,macvtap
+    ...
+
+For the MacVTap compute node, use this local.conf:
+
+::
+
+    HOST_IP=10.0.0.3
+    SERVICE_HOST=10.0.0.2
+    MYSQL_HOST=10.0.0.2
+    RABBIT_HOST=10.0.0.2
+    ADMIN_PASSWORD=secret
+    MYSQL_PASSWORD=secret
+    RABBIT_PASSWORD=secret
+    SERVICE_PASSWORD=secret
+
+    # Services that a compute node runs
+    disable_all_services
+    enable_plugin neutron git://git.openstack.org/openstack/neutron
+    ENABLED_SERVICES+=n-cpu,q-agt
+
+    ## MacVTap agent options
+    Q_AGENT=macvtap
+    PHYSICAL_NETWORK=default
+
+    [[post-config|/$Q_PLUGIN_CONF_FILE]]
+    [macvtap]
+    physical_interface_mappings = $PHYSICAL_NETWORK:eth1

From 24e29f2265e6fd496addf00adfcc13ba8533b912 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephen.finucane@intel.com>
Date: Wed, 15 Jun 2016 14:31:51 +0100
Subject: [PATCH 0495/2409] lib/neutron-plugins: Pass conf file parameter

The 'neutron_plugin_configure_l3_agent' function expects a path to a
configuration file as a parameter. This was not done for one call,
resulting in the generation of a 'DEFAULT' file in the DevStack
directory along with an invalid L3 configuration file. Resolve this.

Change-Id: I5781cb1ec4cfc1699e61dbc324d0bdb824b56be1
---
 lib/neutron_plugins/services/l3 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 350aed8e37..0f0ed216d0 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -99,7 +99,7 @@ function _configure_neutron_l3_agent {
 
     _neutron_setup_interface_driver $Q_L3_CONF_FILE
 
-    neutron_plugin_configure_l3_agent
+    neutron_plugin_configure_l3_agent $Q_L3_CONF_FILE
 
     _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" True False "inet"
 

From dbc6a3736ddd1ed7f453898c26c1f7c550f8f8c1 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Thu, 16 Jun 2016 08:08:45 +0000
Subject: [PATCH 0496/2409] Updated from generate-devstack-plugins-list

Change-Id: I5cd5f2bafb7ace88c28c52994c339b95904ab03b
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 0ceb829d96..99681b335c 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -110,6 +110,7 @@ nova-lxd                               `git://git.openstack.org/openstack/nova-l
 nova-powervm                           `git://git.openstack.org/openstack/nova-powervm <https://git.openstack.org/cgit/openstack/nova-powervm>`__
 octavia                                `git://git.openstack.org/openstack/octavia <https://git.openstack.org/cgit/openstack/octavia>`__
 osprofiler                             `git://git.openstack.org/openstack/osprofiler <https://git.openstack.org/cgit/openstack/osprofiler>`__
+panko                                  `git://git.openstack.org/openstack/panko <https://git.openstack.org/cgit/openstack/panko>`__
 python-freezerclient                   `git://git.openstack.org/openstack/python-freezerclient <https://git.openstack.org/cgit/openstack/python-freezerclient>`__
 rally                                  `git://git.openstack.org/openstack/rally <https://git.openstack.org/cgit/openstack/rally>`__
 sahara                                 `git://git.openstack.org/openstack/sahara <https://git.openstack.org/cgit/openstack/sahara>`__

From 8906b481e0d34ae1bf64a623ce5e734f50c5f2ec Mon Sep 17 00:00:00 2001
From: Richard Theis <rtheis@us.ibm.com>
Date: Wed, 8 Jun 2016 10:28:37 -0500
Subject: [PATCH 0497/2409] Support "geneve" ML2 plugin type driver

Add support for the "geneve" ML2 plugin type driver. The
networking-ovn ML2 mechanism driver uses geneve for its
project network type. Geneve is part of core neutron but
didn't have any DevStack configuration for it. This patch
set adds the necessary options. It also removes the default
for ML2 type drivers to rely on the neutron default and
consolidates the tunnel ranges default for gre, vxlan and
geneve by using TENANT_TUNNEL_RANGES.

Change-Id: Id75651dfe57a07045a6932a0369668f33c7eef09
Partial-Bug: #1588966
---
 lib/neutron-legacy      |  6 +++---
 lib/neutron_plugins/ml2 | 12 ++++++++----
 2 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 73123ef1d5..dca2e98a0c 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -179,9 +179,9 @@ fi
 # GRE tunnels are only supported by the openvswitch.
 ENABLE_TENANT_TUNNELS=${ENABLE_TENANT_TUNNELS:-True}
 
-# If using GRE tunnels for tenant networks, specify the range of
-# tunnel IDs from which tenant networks are allocated. Can be
-# overridden in ``localrc`` in necessary.
+# If using GRE, VXLAN or GENEVE tunnels for tenant networks,
+# specify the range of IDs from which tenant networks are
+# allocated. Can be overridden in ``localrc`` if necessary.
 TENANT_TUNNEL_RANGES=${TENANT_TUNNEL_RANGES:-1:1000}
 
 # To use VLANs for tenant networks, set to True in localrc. VLANs
diff --git a/lib/neutron_plugins/ml2 b/lib/neutron_plugins/ml2
index 30e1b036f3..dcdf6789c8 100644
--- a/lib/neutron_plugins/ml2
+++ b/lib/neutron_plugins/ml2
@@ -25,14 +25,14 @@ fi
 
 # List of MechanismDrivers to load
 Q_ML2_PLUGIN_MECHANISM_DRIVERS=${Q_ML2_PLUGIN_MECHANISM_DRIVERS:-openvswitch,linuxbridge}
-# List of Type Drivers to load
-Q_ML2_PLUGIN_TYPE_DRIVERS=${Q_ML2_PLUGIN_TYPE_DRIVERS:-local,flat,vlan,gre,vxlan}
 # Default GRE TypeDriver options
 Q_ML2_PLUGIN_GRE_TYPE_OPTIONS=${Q_ML2_PLUGIN_GRE_TYPE_OPTIONS:-tunnel_id_ranges=$TENANT_TUNNEL_RANGES}
 # Default VXLAN TypeDriver options
-Q_ML2_PLUGIN_VXLAN_TYPE_OPTIONS=${Q_ML2_PLUGIN_VXLAN_TYPE_OPTIONS:-vni_ranges=1001:2000}
+Q_ML2_PLUGIN_VXLAN_TYPE_OPTIONS=${Q_ML2_PLUGIN_VXLAN_TYPE_OPTIONS:-vni_ranges=$TENANT_TUNNEL_RANGES}
 # Default VLAN TypeDriver options
 Q_ML2_PLUGIN_VLAN_TYPE_OPTIONS=${Q_ML2_PLUGIN_VLAN_TYPE_OPTIONS:-}
+# Default GENEVE TypeDriver options
+Q_ML2_PLUGIN_GENEVE_TYPE_OPTIONS=${Q_ML2_PLUGIN_GENEVE_TYPE_OPTIONS:-vni_ranges=$TENANT_TUNNEL_RANGES}
 # List of extension drivers to load, use '-' instead of ':-' to allow people to
 # explicitly override this to blank
 Q_ML2_PLUGIN_EXT_DRIVERS=${Q_ML2_PLUGIN_EXT_DRIVERS-port_security}
@@ -111,7 +111,9 @@ function neutron_plugin_configure_service {
 
     populate_ml2_config /$Q_PLUGIN_CONF_FILE ml2 mechanism_drivers=$Q_ML2_PLUGIN_MECHANISM_DRIVERS
 
-    populate_ml2_config /$Q_PLUGIN_CONF_FILE ml2 type_drivers=$Q_ML2_PLUGIN_TYPE_DRIVERS
+    if [[ -n "$Q_ML2_PLUGIN_TYPE_DRIVERS" ]]; then
+        populate_ml2_config /$Q_PLUGIN_CONF_FILE ml2 type_drivers=$Q_ML2_PLUGIN_TYPE_DRIVERS
+    fi
 
     populate_ml2_config /$Q_PLUGIN_CONF_FILE ml2 extension_drivers=$Q_ML2_PLUGIN_EXT_DRIVERS
 
@@ -125,6 +127,8 @@ function neutron_plugin_configure_service {
 
     populate_ml2_config /$Q_PLUGIN_CONF_FILE ml2_type_vlan $Q_ML2_PLUGIN_VLAN_TYPE_OPTIONS
 
+    populate_ml2_config /$Q_PLUGIN_CONF_FILE ml2_type_geneve $Q_ML2_PLUGIN_GENEVE_TYPE_OPTIONS
+
     if [[ "$Q_DVR_MODE" != "legacy" ]]; then
         populate_ml2_config /$Q_PLUGIN_CONF_FILE agent l2_population=True
         populate_ml2_config /$Q_PLUGIN_CONF_FILE agent tunnel_types=vxlan

From 21e3d1e55b3140e8b14105df05c1e5253a3d04ec Mon Sep 17 00:00:00 2001
From: Rob Crittenden <rcritten@redhat.com>
Date: Fri, 6 May 2016 12:35:22 -0400
Subject: [PATCH 0498/2409] Make wait_for_service more robust by checking HTTP
 response

wait_for_service just checked to see if the remote service
was started, not that it was returning data. This caused
problems when the service was behind a proxy because the
proxy would respond quickly but the service may not have
fully started.

Wait for a non-503 HTTP response code and non-7 exit code
(connection error) from curl

Return an error if a successful connection cannot be made.

Change-Id: I059a12b1b920f703f28aca0e2f352714118dee97
---
 functions | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/functions b/functions
index aa12e1e826..46a7d414a1 100644
--- a/functions
+++ b/functions
@@ -381,12 +381,24 @@ CURL_GET="${CURL_GET:-curl -g}"
 
 # Wait for an HTTP server to start answering requests
 # wait_for_service timeout url
+#
+# If the service we want is behind a proxy, the proxy may be available
+# before the service. Compliant proxies will return a 503 in this case
+# Loop until we get something else.
+# Also check for the case where there is no proxy and the service just
+# hasn't started yet. curl returns 7 for Failed to connect to host.
 function wait_for_service {
     local timeout=$1
     local url=$2
+    local rval=0
     time_start "wait_for_service"
-    timeout $timeout sh -c "while ! $CURL_GET -k --noproxy '*' -s $url >/dev/null; do sleep 1; done"
+    timeout $timeout bash -x <<EOF || rval=$?
+        while [[ \$( ${CURL_GET} -k --noproxy '*' -s -o /dev/null -w '%{http_code}' ${url} ) == 503 || \$? -eq 7 ]]; do
+            sleep 1
+        done
+EOF
     time_stop "wait_for_service"
+    return $rval
 }
 
 

From 9a0c2bd5316853855b6f2f2940b15d13289a2030 Mon Sep 17 00:00:00 2001
From: Eric Fried <efried@us.ibm.com>
Date: Thu, 28 Apr 2016 15:45:25 -0500
Subject: [PATCH 0499/2409] Default LOG_COLOR based on interactive execution

Change I4a10a49db97d413349bcfceeb8c4164936fbcc40 added colorful PS4 via
tput.  However, if TERM is not set (as is the case when stacking
noninteractively), tput errors with the following:

tput: No value for $TERM and no -T specified

...twice for every log message, thus flooding the logs.

This change set turns LOG_COLOR off by default for noninteractive
execution.  If LOG_COLOR is set to True when noninteractive (TERM is
unset), obviate the above errors by passing tput a simple -T.

Change-Id: I0f8ad82375cde463160bad5bd9918f1e4b19326d
Closes-Bug: 1576405
---
 stackrc | 21 +++++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

diff --git a/stackrc b/stackrc
index 7a5b821d4e..acb7d3f650 100644
--- a/stackrc
+++ b/stackrc
@@ -135,12 +135,29 @@ elif [[ -f $RC_DIR/.localrc.auto ]]; then
     source $RC_DIR/.localrc.auto
 fi
 
+# Default for log coloring is based on interactive-or-not.
+# Baseline assumption is that non-interactive invocations are for CI,
+# where logs are to be presented as browsable text files; hence color
+# codes should be omitted.
+# Simply override LOG_COLOR if your environment is different.
+if [ -t 1 ]; then
+    _LOG_COLOR_DEFAULT=True
+else
+    _LOG_COLOR_DEFAULT=False
+fi
+
 # Use color for logging output (only available if syslog is not used)
-LOG_COLOR=$(trueorfalse True LOG_COLOR)
+LOG_COLOR=$(trueorfalse $_LOG_COLOR_DEFAULT LOG_COLOR)
 
 # Make tracing more educational
 if [[ "$LOG_COLOR" == "True" ]]; then
-    export PS4='+\[$(tput setaf 242)\]$(short_source)\[$(tput sgr0)\] '
+    # tput requires TERM or -T.  If neither is present, use vt100, a
+    # no-frills least common denominator supported everywhere.
+    TPUT_T=
+    if ! [ $TERM ]; then
+        TPUT_T='-T vt100'
+    fi
+    export PS4='+\[$(tput '$TPUT_T' setaf 242)\]$(short_source)\[$(tput '$TPUT_T' sgr0)\] '
 else
     export PS4='+ $(short_source):   '
 fi

From 60f394aee25cfd22c6c5e13622697c27acbb402d Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Fri, 17 Jun 2016 16:15:30 -0400
Subject: [PATCH 0500/2409] Fix amateur level mistake.

Happy Friday!

Change-Id: I2b1112ce74577d6e3d50c5ea2131d46c77307571
---
 lib/neutron | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron b/lib/neutron
index ba26c5f34d..ad68d8e62f 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -242,7 +242,7 @@ function configure_neutron_new {
 
     # Metering
     if is_service_enabled neutron-metering; then
-        source $TOP_DIR/neutron_plugins/services/metering
+        source $TOP_DIR/lib/neutron_plugins/services/metering
         neutron_agent_metering_configure_common
         neutron_agent_metering_configure_agent
     fi

From d00cbb77b166e222fdb5adf2aa5ff7dff6294ca4 Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Mon, 20 Jun 2016 13:53:44 -0400
Subject: [PATCH 0501/2409] Neutron: check if q-l3 or neutron-l3 is enabled

Change-Id: I7aff59fdf0fd75e134d2ae3ba8b7d63db98cc5ed
---
 lib/neutron_plugins/services/l3 | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 0f0ed216d0..61f0d6c099 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -289,7 +289,7 @@ function _neutron_configure_router_v4 {
     neutron --os-cloud devstack-admin --os-region "$REGION_NAME" router-gateway-set $ROUTER_ID $EXT_NET_ID
 
     # This logic is specific to using the l3-agent for layer 3
-    if is_service_enabled q-l3; then
+    if is_service_enabled q-l3 || is_service_enabled neutron-l3;  then
         # Configure and enable public bridge
         local ext_gw_interface="none"
         if is_neutron_ovs_base_plugin; then
@@ -334,7 +334,7 @@ function _neutron_configure_router_v6 {
     fi
 
     # This logic is specific to using the l3-agent for layer 3
-    if is_service_enabled q-l3; then
+    if is_service_enabled q-l3 || is_service_enabled neutron-l3; then
         # Ensure IPv6 forwarding is enabled on the host
         sudo sysctl -w net.ipv6.conf.all.forwarding=1
         # Configure and enable public bridge

From 66f4524cf491db78caaa93eca848ad897a2e6576 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Wed, 22 Jun 2016 08:08:16 +0000
Subject: [PATCH 0502/2409] Updated from generate-devstack-plugins-list

Change-Id: Ie6363f08ac54b62d29096befd733eca0642379d8
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 99681b335c..eed88edbb7 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -48,6 +48,7 @@ devstack-plugin-ceph                   `git://git.openstack.org/openstack/devsta
 devstack-plugin-glusterfs              `git://git.openstack.org/openstack/devstack-plugin-glusterfs <https://git.openstack.org/cgit/openstack/devstack-plugin-glusterfs>`__
 devstack-plugin-hdfs                   `git://git.openstack.org/openstack/devstack-plugin-hdfs <https://git.openstack.org/cgit/openstack/devstack-plugin-hdfs>`__
 devstack-plugin-kafka                  `git://git.openstack.org/openstack/devstack-plugin-kafka <https://git.openstack.org/cgit/openstack/devstack-plugin-kafka>`__
+devstack-plugin-mariadb                `git://git.openstack.org/openstack/devstack-plugin-mariadb <https://git.openstack.org/cgit/openstack/devstack-plugin-mariadb>`__
 devstack-plugin-nfs                    `git://git.openstack.org/openstack/devstack-plugin-nfs <https://git.openstack.org/cgit/openstack/devstack-plugin-nfs>`__
 devstack-plugin-pika                   `git://git.openstack.org/openstack/devstack-plugin-pika <https://git.openstack.org/cgit/openstack/devstack-plugin-pika>`__
 devstack-plugin-sheepdog               `git://git.openstack.org/openstack/devstack-plugin-sheepdog <https://git.openstack.org/cgit/openstack/devstack-plugin-sheepdog>`__

From a9cc38a1986a7c5f78f2d1e331fcc6ac8bd1023c Mon Sep 17 00:00:00 2001
From: Kevin Zhao <kevin.zhao@linaro.org>
Date: Fri, 24 Jun 2016 04:30:12 -0400
Subject: [PATCH 0503/2409] Modify the image property for aarch64

In Aarch64, the default cdrom bus is scsi, and the default scsi
controller is virtio-scsi. The cdrom with virtio bus will not be
recognized by the instance.

Change-Id: Ib8cec79f9e9083239092fa7348793ee3b64a9c94
Signed-off-by: Kevin Zhao <kevin.zhao@linaro.org>
---
 functions | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions b/functions
index aa12e1e826..dfe3d8bd60 100644
--- a/functions
+++ b/functions
@@ -331,7 +331,7 @@ function upload_image {
     fi
 
     if is_arch "aarch64"; then
-        img_property="--property hw_machine_type=virt --property hw_cdrom_bus=virtio --property os_command_line='console=ttyAMA0'"
+        img_property="--property hw_machine_type=virt --property hw_cdrom_bus=scsi --property hw_scsi_model=virtio-scsi --property os_command_line='console=ttyAMA0'"
     fi
 
     if [ "$container_format" = "bare" ]; then

From dddb2c7b5f85688de9c9b92f025df25d2f2d3016 Mon Sep 17 00:00:00 2001
From: Patrick East <patrick.east@purestorage.com>
Date: Tue, 3 May 2016 17:34:00 -0700
Subject: [PATCH 0504/2409] Setup the Cinder image-volume cache by default

This will have devstack setup the Cinder internal tenant and generic
image-volume cache by default. If left alone it will use reasonable
defaults.

More information about configuration options and the cache can be found
here: http://docs.openstack.org/admin-guide/blockstorage_image_volume_cache.html

As part of this we switch the default lvm type to thin so it will
work more efficiently with the image cache.

Change-Id: I0b2cc261736f32d38d43c60254f0dc7225b24c01
Implements: blueprint cinder-image-volume-cache
---
 lib/cinder | 44 +++++++++++++++++++++++++++++++++++++++++---
 1 file changed, 41 insertions(+), 3 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 607a6f83c6..fe49416e76 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -68,9 +68,8 @@ CINDER_SERVICE_PROTOCOL=${CINDER_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 CINDER_SERVICE_LISTEN_ADDRESS=${CINDER_SERVICE_LISTEN_ADDRESS:-$SERVICE_LISTEN_ADDRESS}
 
 # What type of LVM device should Cinder use for LVM backend
-# Defaults to default, which is thick, the other valid choice
-# is thin, which as the name implies utilizes lvm thin provisioning.
-CINDER_LVM_TYPE=${CINDER_LVM_TYPE:-default}
+# Defaults to thin. For thick provisioning change to 'default'
+CINDER_LVM_TYPE=${CINDER_LVM_TYPE:-thin}
 
 # Default backends
 # The backend format is type:name where type is one of the supported backend
@@ -128,6 +127,17 @@ fi
 CINDER_NOVA_CATALOG_INFO=${CINDER_NOVA_CATALOG_INFO:-compute:nova:publicURL}
 CINDER_NOVA_CATALOG_ADMIN_INFO=${CINDER_NOVA_CATALOG_ADMIN_INFO:-compute:nova:adminURL}
 
+# Environment variables to configure the image-volume cache
+CINDER_IMG_CACHE_ENABLED=${CINDER_IMG_CACHE_ENABLED:-True}
+
+# For limits, if left unset, it will use cinder defaults of 0 for unlimited
+CINDER_IMG_CACHE_SIZE_GB=${CINDER_IMG_CACHE_SIZE_GB:-}
+CINDER_IMG_CACHE_SIZE_COUNT=${CINDER_IMG_CACHE_SIZE_COUNT:-}
+
+# Configure which cinder backends will have the image-volume cache, this takes the same
+# form as the CINDER_ENABLED_BACKENDS config option. By default it will
+# enable the cache for all cinder backends.
+CINDER_CACHE_ENABLED_FOR_BACKENDS=${CINDER_CACHE_ENABLED_FOR_BACKENDS:-$CINDER_ENABLED_BACKENDS}
 
 # Functions
 # ---------
@@ -293,6 +303,7 @@ function configure_cinder {
         if [[ -n "$default_name" ]]; then
             iniset $CINDER_CONF DEFAULT default_volume_type ${default_name}
         fi
+        configure_cinder_image_volume_cache
     fi
 
     if is_service_enabled swift; then
@@ -394,6 +405,8 @@ function create_cinder_accounts {
             "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v3/\$(project_id)s" \
             "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v3/\$(project_id)s" \
             "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v3/\$(project_id)s"
+
+        configure_cinder_internal_tenant
     fi
 }
 
@@ -573,6 +586,31 @@ function create_cinder_volume_group {
     :
 }
 
+function configure_cinder_internal_tenant {
+    # Re-use the Cinder service account for simplicity.
+    iniset $CINDER_CONF DEFAULT cinder_internal_tenant_project_id $(get_or_create_project $SERVICE_PROJECT_NAME)
+    iniset $CINDER_CONF DEFAULT cinder_internal_tenant_user_id $(get_or_create_user "cinder")
+}
+
+function configure_cinder_image_volume_cache {
+    # Expect CINDER_CACHE_ENABLED_FOR_BACKENDS to be a list of backends
+    # similar to CINDER_ENABLED_BACKENDS with NAME:TYPE where NAME will
+    # be the backend specific configuration stanza in cinder.conf.
+    for be in ${CINDER_CACHE_ENABLED_FOR_BACKENDS//,/ }; do
+        local be_name=${be##*:}
+
+        iniset $CINDER_CONF $be_name image_volume_cache_enabled $CINDER_IMG_CACHE_ENABLED
+
+        if [[ -n $CINDER_IMG_CACHE_SIZE_GB ]]; then
+            iniset $CINDER_CONF $be_name image_volume_cache_max_size_gb $CINDER_IMG_CACHE_SIZE_GB
+        fi
+
+        if [[ -n $CINDER_IMG_CACHE_SIZE_COUNT ]]; then
+            iniset $CINDER_CONF $be_name image_volume_cache_max_count $CINDER_IMG_CACHE_SIZE_COUNT
+        fi
+    done
+}
+
 
 # Restore xtrace
 $_XTRACE_CINDER

From 68747349359822780e00833bca124558d835b05b Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Wed, 29 Jun 2016 08:06:00 +0000
Subject: [PATCH 0505/2409] Updated from generate-devstack-plugins-list

Change-Id: If8d8b223f6764990c305274047c811dffb7d9840
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index eed88edbb7..5b6622e75c 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -103,6 +103,7 @@ networking-sfc                         `git://git.openstack.org/openstack/networ
 networking-vsphere                     `git://git.openstack.org/openstack/networking-vsphere <https://git.openstack.org/cgit/openstack/networking-vsphere>`__
 neutron                                `git://git.openstack.org/openstack/neutron <https://git.openstack.org/cgit/openstack/neutron>`__
 neutron-dynamic-routing                `git://git.openstack.org/openstack/neutron-dynamic-routing <https://git.openstack.org/cgit/openstack/neutron-dynamic-routing>`__
+neutron-fwaas                          `git://git.openstack.org/openstack/neutron-fwaas <https://git.openstack.org/cgit/openstack/neutron-fwaas>`__
 neutron-lbaas                          `git://git.openstack.org/openstack/neutron-lbaas <https://git.openstack.org/cgit/openstack/neutron-lbaas>`__
 neutron-lbaas-dashboard                `git://git.openstack.org/openstack/neutron-lbaas-dashboard <https://git.openstack.org/cgit/openstack/neutron-lbaas-dashboard>`__
 neutron-vpnaas                         `git://git.openstack.org/openstack/neutron-vpnaas <https://git.openstack.org/cgit/openstack/neutron-vpnaas>`__

From bb35715cfe68ad8d1d2ccb2b2e7eb4143e87d678 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 7 Jun 2016 11:20:55 -0400
Subject: [PATCH 0506/2409] add local.conf modifying functions

This adds a set of local.conf modifying functions which make it easier
for consuming projects like devstack-gate to programatically add
elements to local.conf structured files.

Change-Id: I3427968c2bd43aba12b3619acc27f73c74f0dabb
Co-Authored-By: fumihiko kakuma <kakuma@valinux.co.jp>
---
 inc/ini-config          | 164 ++++++++++++++
 tests/test_localconf.sh | 475 ++++++++++++++++++++++++++++++++++++++++
 2 files changed, 639 insertions(+)
 create mode 100755 tests/test_localconf.sh

diff --git a/inc/ini-config b/inc/ini-config
index 1f12343ae0..68d48d197b 100644
--- a/inc/ini-config
+++ b/inc/ini-config
@@ -274,6 +274,170 @@ function iniget_sections {
     $xtrace
 }
 
+# Set a localrc var
+function localrc_set {
+    local file=$1
+    local group="local"
+    local conf="localrc"
+    local section=""
+    local option=$2
+    local value=$3
+    localconf_set "$file" "$group" "$conf" "$section" "$option" "$value"
+}
+
+# Check if local.conf has section.
+function localconf_has_section {
+    local file=$1
+    local group=$2
+    local conf=$3
+    local section=$4
+    local sep
+    sep=$(echo -ne "\x01")
+    local line
+    line=$(sed -ne "\\${sep}^\[\[${group}|${conf}\]\]${sep},\\${sep}\[\[.*\]\]${sep}{
+        /\[${section}\]/p
+    }" "$file")
+    [ -n "$line" ]
+}
+
+# Check if local.conf has option.
+function localconf_has_option {
+    local file=$1
+    local group=$2
+    local conf=$3
+    local section=$4
+    local option=$5
+    local sep
+    sep=$(echo -ne "\x01")
+    local line
+    if [[ -z "$section" ]]; then
+        line=$(sed -ne "\\${sep}^\[\[${group}|${conf}\]\]${sep},\\${sep}\[\[.*\]\]${sep}{
+            /${option}[ \t]*=.*$/p
+        }" "$file")
+    else
+        line=$(sed -ne "\\${sep}^\[\[${group}|${conf}\]\]${sep},\\${sep}\[\[.*\]\]${sep}{
+            /\[${section}\]/,/\[\[.*\]\]\|\[.*\]/{
+                /${option}[ \t]*=.*$/p}
+        }" "$file")
+    fi
+    [ -n "$line" ]
+}
+
+# Update option in local.conf.
+function localconf_update_option {
+    local sudo=$1
+    local file=$2
+    local group=$3
+    local conf=$4
+    local section=$5
+    local option=$6
+    local value=$7
+    local sep
+    sep=$(echo -ne "\x01")
+    if [[ -z "$section" ]]; then
+        $sudo sed -i -e "\\${sep}^\[\[${group}|${conf}\]\]${sep},\\${sep}\[\[.*\]\]${sep}{
+            s${sep}^\(${option}[ \t]*=[ \t]*\).*\$${sep}\1${value}${sep}
+        }" "$file"
+    else
+        $sudo sed -i -e "\\${sep}^\[\[${group}|${conf}\]\]${sep},\\${sep}\[\[.*\]\]${sep}{
+            /\[${section}\]/,/\[\[.*\]\]\|\[.*\]/s${sep}^\(${option}[ \t]*=[ \t]*\).*\$${sep}\1${value}${sep}
+        }" "$file"
+    fi
+}
+
+# Add option in local.conf.
+function localconf_add_option {
+    local sudo=$1
+    local file=$2
+    local group=$3
+    local conf=$4
+    local section=$5
+    local option=$6
+    local value=$7
+    local sep
+    sep=$(echo -ne "\x01")
+    if [[ -z "$section" ]]; then
+        $sudo sed -i -e "\\${sep}^\[\[${group}|${conf}\]\]${sep} a $option=$value" "$file"
+    else
+        $sudo sed -i -e "\\${sep}^\[\[${group}|${conf}\]\]${sep},\\${sep}\[\[.*\]\]${sep}{
+            /\[${section}\]/ a $option=$value
+        }" "$file"
+    fi
+}
+
+# Add section and option in local.conf.
+function localconf_add_section_and_option {
+    local sudo=$1
+    local file=$2
+    local group=$3
+    local conf=$4
+    local section=$5
+    local option=$6
+    local value=$7
+    local sep
+    sep=$(echo -ne "\x01")
+    $sudo sed -i -e "\\${sep}^\[\[${group}|${conf}\]\]${sep} {
+        a [$section]
+        a $option=$value
+    }" "$file"
+}
+
+# Set an option in a local.conf file.
+# localconf_set [-sudo] config-file group conf-name section option value
+#  - if the file does not exist, it is created
+function localconf_set {
+    local xtrace
+    xtrace=$(set +o | grep xtrace)
+    set +o xtrace
+    local sep
+    sep=$(echo -ne "\x01")
+    local sudo=""
+    if [ $1 == "-sudo" ]; then
+        sudo="sudo "
+        shift
+    fi
+    local file=$1
+    local group=$2
+    local conf=$3
+    local section=$4
+    local option=$5
+    local value=$6
+
+    if [[ -z $group || -z $conf || -z $option || -z $value ]]; then
+        $xtrace
+        return
+    fi
+
+    if ! grep -q "^\[\[${group}|${conf}\]\]" "$file" 2>/dev/null; then
+        # Add meta section at the end if it does not exist
+        echo -e "\n[[${group}|${conf}]]" | $sudo tee --append "$file" > /dev/null
+        # Add section at the end
+        if [[ -n "$section" ]]; then
+            echo -e "[$section]" | $sudo tee --append "$file" > /dev/null
+        fi
+        # Add option at the end
+        echo -e "$option=$value" | $sudo tee --append "$file" > /dev/null
+    elif [[ -z "$section" ]]; then
+        if ! localconf_has_option "$file" "$group" "$conf" "$section" "$option"; then
+            # Add option
+            localconf_add_option "$sudo" "$file" "$group" "$conf" "$section" "$option" "$value"
+        else
+            # Replace it
+            localconf_update_option "$sudo" "$file" "$group" "$conf" "$section" "$option" "$value"
+        fi
+    elif ! localconf_has_section "$file" "$group" "$conf" "$section"; then
+        # Add section and option in specified meta section
+        localconf_add_section_and_option "$sudo" "$file" "$group" "$conf" "$section" "$option" "$value"
+    elif ! localconf_has_option "$file" "$group" "$conf" "$section" "$option"; then
+        # Add option
+        localconf_add_option "$sudo" "$file" "$group" "$conf" "$section" "$option" "$value"
+    else
+        # Replace it
+        localconf_update_option "$sudo" "$file" "$group" "$conf" "$section" "$option" "$value"
+    fi
+    $xtrace
+}
+
 # Restore xtrace
 $INC_CONF_TRACE
 
diff --git a/tests/test_localconf.sh b/tests/test_localconf.sh
new file mode 100755
index 0000000000..d8075df442
--- /dev/null
+++ b/tests/test_localconf.sh
@@ -0,0 +1,475 @@
+#!/usr/bin/env bash
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied. See the License for the specific language governing
+# permissions and limitations under the License.
+
+# Tests for DevStack INI functions
+
+TOP=$(cd $(dirname "$0")/.. && pwd)
+
+# Import config functions
+source $TOP/inc/ini-config
+
+source $TOP/tests/unittest.sh
+
+echo "Testing INI local.conf functions"
+
+# test that can determine if file has section in specified meta-section
+
+function test_localconf_has_section {
+    local file_localconf
+    local file_conf1
+    local file_conf2
+    file_localconf=`mktemp`
+    file_conf1=`mktemp`
+    file_conf2=`mktemp`
+
+    cat <<- EOF > $file_localconf
+[[local|localrc]]
+LOCALRC_VAR1=localrc_val1
+LOCALRC_VAR2=localrc_val2
+LOCALRC_VAR3=localrc_val3
+
+[[post-config|$file_conf1]]
+[conf1_t1]
+conf1_t1_opt1=conf1_t1_val1
+conf1_t1_opt2=conf1_t1_val2
+conf1_t1_opt3=conf1_t1_val3
+[conf1_t2]
+conf1_t2_opt1=conf1_t2_val1
+conf1_t2_opt2=conf1_t2_val2
+conf1_t2_opt3=conf1_t2_val3
+[conf1_t3]
+conf1_t3_opt1=conf1_t3_val1
+conf1_t3_opt2=conf1_t3_val2
+conf1_t3_opt3=conf1_t3_val3
+
+[[post-extra|$file_conf2]]
+[conf2_t1]
+conf2_t1_opt1=conf2_t1_val1
+conf2_t1_opt2=conf2_t1_val2
+conf2_t1_opt3=conf2_t1_val3
+EOF
+
+    localconf_has_section $file_localconf post-config $file_conf1 conf1_t1
+    assert_equal $? 0
+    localconf_has_section $file_localconf post-config $file_conf1 conf1_t2
+    assert_equal $? 0
+    localconf_has_section $file_localconf post-config $file_conf1 conf1_t3
+    assert_equal $? 0
+    localconf_has_section $file_localconf post-extra $file_conf2 conf2_t1
+    assert_equal $? 0
+    localconf_has_section $file_localconf post-config $file_conf1 conf1_t4
+    assert_equal $? 1
+    localconf_has_section $file_localconf post-install $file_conf1 conf1_t1
+    assert_equal $? 1
+    localconf_has_section $file_localconf local localrc conf1_t2
+    assert_equal $? 1
+    rm -f $file_localconf $file_conf1 $file_conf2
+}
+
+# test that can determine if file has option in specified meta-section and section
+function test_localconf_has_option {
+    local file_localconf
+    local file_conf1
+    local file_conf2
+    file_localconf=`mktemp`
+    file_conf1=`mktemp`
+    file_conf2=`mktemp`
+    cat <<- EOF > $file_localconf
+[[post-config|$file_conf1]]
+[conf1_t1]
+conf1_t1_opt1 = conf1_t1_val1
+conf1_t1_opt2 = conf1_t1_val2
+conf1_t1_opt3 = conf1_t1_val3
+[conf1_t2]
+conf1_t2_opt1=conf1_t2_val1
+conf1_t2_opt2=conf1_t2_val2
+conf1_t2_opt3=conf1_t2_val3
+[conf1_t3]
+conf1_t3_opt1=conf1_t3_val1
+conf1_t3_opt2=conf1_t3_val2
+conf1_t3_opt3=conf1_t3_val3
+
+[[local|localrc]]
+LOCALRC_VAR1=localrc_val1
+LOCALRC_VAR2=localrc_val2
+LOCALRC_VAR3=localrc_val3
+
+[[post-extra|$file_conf2]]
+[conf2_t1]
+conf2_t1_opt1=conf2_t1_val1
+conf2_t1_opt2=conf2_t1_val2
+conf2_t1_opt3=conf2_t1_val3
+EOF
+
+    localconf_has_option $file_localconf local localrc "" LOCALRC_VAR1
+    assert_equal $? 0
+    localconf_has_option $file_localconf local localrc "" LOCALRC_VAR2
+    assert_equal $? 0
+    localconf_has_option $file_localconf local localrc "" LOCALRC_VAR3
+    assert_equal $? 0
+    localconf_has_option $file_localconf post-config $file_conf1 conf1_t1 conf1_t1_opt1
+    assert_equal $? 0
+    localconf_has_option $file_localconf post-config $file_conf1 conf1_t2 conf1_t2_opt2
+    assert_equal $? 0
+    localconf_has_option $file_localconf post-config $file_conf1 conf1_t3 conf1_t3_opt3
+    assert_equal $? 0
+    localconf_has_option $file_localconf post-extra $file_conf2 conf2_t1 conf2_t1_opt2
+    assert_equal $? 0
+    localconf_has_option $file_localconf post-config $file_conf1 conf1_t1_opt4
+    assert_equal $? 1
+    localconf_has_option $file_localconf post-install $file_conf1 conf1_t1_opt1
+    assert_equal $? 1
+    localconf_has_option $file_localconf local localrc conf1_t2 conf1_t2_opt1
+    assert_equal $? 1
+    rm -f $file_localconf $file_conf1 $file_conf2
+}
+
+# test that update option in specified meta-section and section
+function test_localconf_update_option {
+    local file_localconf
+    local file_localconf_expected
+    local file_conf1
+    local file_conf2
+    file_localconf=`mktemp`
+    file_localconf_expected=`mktemp`
+    file_conf1=`mktemp`
+    file_conf2=`mktemp`
+    cat <<- EOF > $file_localconf
+[[local|localrc]]
+LOCALRC_VAR1 = localrc_val1
+LOCALRC_VAR2 = localrc_val2
+LOCALRC_VAR3 = localrc_val3
+
+[[post-config|$file_conf1]]
+[conf1_t1]
+conf1_t1_opt1=conf1_t1_val1
+conf1_t1_opt2=conf1_t1_val2
+conf1_t1_opt3=conf1_t1_val3
+[conf1_t2]
+conf1_t2_opt1=conf1_t2_val1
+conf1_t2_opt2=conf1_t2_val2
+conf1_t2_opt3=conf1_t2_val3
+[conf1_t3]
+conf1_t3_opt1=conf1_t3_val1
+conf1_t3_opt2=conf1_t3_val2
+conf1_t3_opt3=conf1_t3_val3
+
+[[post-extra|$file_conf2]]
+[conf2_t1]
+conf2_t1_opt1=conf2_t1_val1
+conf2_t1_opt2=conf2_t1_val2
+conf2_t1_opt3=conf2_t1_val3
+EOF
+    cat <<- EOF > $file_localconf_expected
+[[local|localrc]]
+LOCALRC_VAR1 = localrc_val1
+LOCALRC_VAR2 = localrc_val2_update
+LOCALRC_VAR3 = localrc_val3
+
+[[post-config|$file_conf1]]
+[conf1_t1]
+conf1_t1_opt1=conf1_t1_val1_update
+conf1_t1_opt2=conf1_t1_val2
+conf1_t1_opt3=conf1_t1_val3
+[conf1_t2]
+conf1_t2_opt1=conf1_t2_val1
+conf1_t2_opt2=conf1_t2_val2_update
+conf1_t2_opt3=conf1_t2_val3
+[conf1_t3]
+conf1_t3_opt1=conf1_t3_val1
+conf1_t3_opt2=conf1_t3_val2
+conf1_t3_opt3=conf1_t3_val3_update
+
+[[post-extra|$file_conf2]]
+[conf2_t1]
+conf2_t1_opt1=conf2_t1_val1
+conf2_t1_opt2=conf2_t1_val2
+conf2_t1_opt3=conf2_t1_val3_update
+EOF
+
+    localconf_update_option "$SUDO" $file_localconf local localrc "" LOCALRC_VAR2 localrc_val2_update
+    localconf_update_option "$SUDO" $file_localconf post-config $file_conf1 conf1_t1 conf1_t1_opt1 conf1_t1_val1_update
+    localconf_update_option "$SUDO" $file_localconf post-config $file_conf1 conf1_t2 conf1_t2_opt2 conf1_t2_val2_update
+    localconf_update_option "$SUDO" $file_localconf post-config $file_conf1 conf1_t3 conf1_t3_opt3 conf1_t3_val3_update
+    localconf_update_option "$SUDO" $file_localconf post-extra $file_conf2 conf2_t1 conf2_t1_opt3 conf2_t1_val3_update
+    result=`cat $file_localconf`
+    result_expected=`cat $file_localconf_expected`
+    assert_equal "$result" "$result_expected"
+    localconf_update_option "$SUDO" $file_localconf post-config $file_conf1 conf1_t2 conf1_t3_opt1 conf1_t3_val1_update
+    localconf_update_option "$SUDO" $file_localconf post-extra $file_conf2 conf2_t1 conf2_t1_opt4 conf2_t1_val4_update
+    localconf_update_option "$SUDO" $file_localconf post-install $file_conf2 conf2_t1 conf2_t1_opt1 conf2_t1_val1_update
+    localconf_update_option "$SUDO" $file_localconf local localrc "" LOCALRC_VAR4 localrc_val4_update
+    result=`cat $file_localconf`
+    result_expected=`cat $file_localconf_expected`
+    assert_equal "$result" "$result_expected"
+    rm -f $file_localconf $file_localconf_expected $file_conf1 $file_conf2
+}
+
+# test that add option in specified meta-section and section
+function test_localconf_add_option {
+    local file_localconf
+    local file_localconf_expected
+    local file_conf1
+    local file_conf2
+    file_localconf=`mktemp`
+    file_localconf_expected=`mktemp`
+    file_conf1=`mktemp`
+    file_conf2=`mktemp`
+    cat <<- EOF > $file_localconf
+[[post-config|$file_conf1]]
+[conf1_t1]
+conf1_t1_opt1=conf1_t1_val1
+conf1_t1_opt2=conf1_t1_val2
+conf1_t1_opt3=conf1_t1_val3
+[conf1_t2]
+conf1_t2_opt1=conf1_t2_val1
+conf1_t2_opt2=conf1_t2_val2
+conf1_t2_opt3=conf1_t2_val3
+[conf1_t3]
+conf1_t3_opt1=conf1_t3_val1
+conf1_t3_opt2=conf1_t3_val2
+conf1_t3_opt3=conf1_t3_val3
+
+[[local|localrc]]
+LOCALRC_VAR1=localrc_val1
+LOCALRC_VAR2=localrc_val2
+LOCALRC_VAR3=localrc_val3
+
+[[post-extra|$file_conf2]]
+[conf2_t1]
+conf2_t1_opt1 = conf2_t1_val1
+conf2_t1_opt2 = conf2_t1_val2
+conf2_t1_opt3 = conf2_t1_val3
+EOF
+    cat <<- EOF > $file_localconf_expected
+[[post-config|$file_conf1]]
+[conf1_t1]
+conf1_t1_opt4 = conf1_t1_val4
+conf1_t1_opt1=conf1_t1_val1
+conf1_t1_opt2=conf1_t1_val2
+conf1_t1_opt3=conf1_t1_val3
+[conf1_t2]
+conf1_t2_opt4 = conf1_t2_val4
+conf1_t2_opt1=conf1_t2_val1
+conf1_t2_opt2=conf1_t2_val2
+conf1_t2_opt3=conf1_t2_val3
+[conf1_t3]
+conf1_t3_opt4 = conf1_t3_val4
+conf1_t3_opt1=conf1_t3_val1
+conf1_t3_opt2=conf1_t3_val2
+conf1_t3_opt3=conf1_t3_val3
+
+[[local|localrc]]
+LOCALRC_VAR4 = localrc_val4
+LOCALRC_VAR1=localrc_val1
+LOCALRC_VAR2=localrc_val2
+LOCALRC_VAR3=localrc_val3
+
+[[post-extra|$file_conf2]]
+[conf2_t1]
+conf2_t1_opt4 = conf2_t1_val4
+conf2_t1_opt1 = conf2_t1_val1
+conf2_t1_opt2 = conf2_t1_val2
+conf2_t1_opt3 = conf2_t1_val3
+EOF
+
+    localconf_add_option "$SUDO" $file_localconf local localrc "" LOCALRC_VAR4 localrc_val4
+    localconf_add_option "$SUDO" $file_localconf post-config $file_conf1 conf1_t1 conf1_t1_opt4 conf1_t1_val4
+    localconf_add_option "$SUDO" $file_localconf post-config $file_conf1 conf1_t2 conf1_t2_opt4 conf1_t2_val4
+    localconf_add_option "$SUDO" $file_localconf post-config $file_conf1 conf1_t3 conf1_t3_opt4 conf1_t3_val4
+    localconf_add_option "$SUDO" $file_localconf post-extra $file_conf2 conf2_t1 conf2_t1_opt4 conf2_t1_val4
+    result=`cat $file_localconf`
+    result_expected=`cat $file_localconf_expected`
+    assert_equal "$result" "$result_expected"
+    localconf_add_option "$SUDO" $file_localconf local localrc.conf "" LOCALRC_VAR4 localrc_val4_update
+    localconf_add_option "$SUDO" $file_localconf post-config $file_conf1 conf1_t4 conf1_t4_opt1 conf1_t4_val1
+    localconf_add_option "$SUDO" $file_localconf post-extra $file_conf2 conf2_t2 conf2_t2_opt4 conf2_t2_val4
+    localconf_add_option "$SUDO" $file_localconf post-install $file_conf2 conf2_t1 conf2_t1_opt4 conf2_t2_val4
+    result=`cat $file_localconf`
+    result_expected=`cat $file_localconf_expected`
+    assert_equal "$result" "$result_expected"
+    rm -f $file_localconf $file_localconf_expected $file_conf1 $file_conf2
+}
+
+# test that add section and option in specified meta-section
+function test_localconf_add_section_and_option {
+    local file_localconf
+    local file_localconf_expected
+    local file_conf1
+    local file_conf2
+    file_localconf=`mktemp`
+    file_localconf_expected=`mktemp`
+    file_conf1=`mktemp`
+    file_conf2=`mktemp`
+    cat <<- EOF > $file_localconf
+[[post-config|$file_conf1]]
+[conf1_t1]
+conf1_t1_opt1=conf1_t1_val1
+conf1_t1_opt2=conf1_t1_val2
+conf1_t1_opt3=conf1_t1_val3
+[conf1_t2]
+conf1_t2_opt1=conf1_t2_val1
+conf1_t2_opt2=conf1_t2_val2
+conf1_t2_opt3=conf1_t2_val3
+[conf1_t3]
+conf1_t3_opt1=conf1_t3_val1
+conf1_t3_opt2=conf1_t3_val2
+conf1_t3_opt3=conf1_t3_val3
+
+[[local|localrc]]
+LOCALRC_VAR1=localrc_val1
+LOCALRC_VAR2=localrc_val2
+LOCALRC_VAR3=localrc_val3
+
+[[post-extra|$file_conf2]]
+[conf2_t1]
+conf2_t1_opt1=conf2_t1_val1
+conf2_t1_opt2=conf2_t1_val2
+conf2_t1_opt3=conf2_t1_val3
+EOF
+    cat <<- EOF > $file_localconf_expected
+[[post-config|$file_conf1]]
+[conf1_t4]
+conf1_t4_opt1 = conf1_t4_val1
+[conf1_t1]
+conf1_t1_opt1=conf1_t1_val1
+conf1_t1_opt2=conf1_t1_val2
+conf1_t1_opt3=conf1_t1_val3
+[conf1_t2]
+conf1_t2_opt1=conf1_t2_val1
+conf1_t2_opt2=conf1_t2_val2
+conf1_t2_opt3=conf1_t2_val3
+[conf1_t3]
+conf1_t3_opt1=conf1_t3_val1
+conf1_t3_opt2=conf1_t3_val2
+conf1_t3_opt3=conf1_t3_val3
+
+[[local|localrc]]
+LOCALRC_VAR1=localrc_val1
+LOCALRC_VAR2=localrc_val2
+LOCALRC_VAR3=localrc_val3
+
+[[post-extra|$file_conf2]]
+[conf2_t2]
+conf2_t2_opt1 = conf2_t2_val1
+[conf2_t1]
+conf2_t1_opt1=conf2_t1_val1
+conf2_t1_opt2=conf2_t1_val2
+conf2_t1_opt3=conf2_t1_val3
+EOF
+
+    localconf_add_section_and_option "$SUDO" $file_localconf post-config $file_conf1 conf1_t4 conf1_t4_opt1 conf1_t4_val1
+    localconf_add_section_and_option "$SUDO" $file_localconf post-extra $file_conf2 conf2_t2 conf2_t2_opt1 conf2_t2_val1
+    result=`cat $file_localconf`
+    result_expected=`cat $file_localconf_expected`
+    assert_equal "$result" "$result_expected"
+    localconf_add_section_and_option "$SUDO" $file_localconf post-install $file_conf2 conf2_t2 conf2_t2_opt1 conf2_t2_val1
+    result=`cat $file_localconf`
+    result_expected=`cat $file_localconf_expected`
+    assert_equal "$result" "$result_expected"
+    rm -f $file_localconf $file_localconf_expected $file_conf1 $file_conf2
+}
+
+# test that add section and option in specified meta-section
+function test_localconf_set {
+    local file_localconf
+    local file_localconf_expected
+    local file_conf1
+    local file_conf2
+    file_localconf=`mktemp`
+    file_localconf_expected=`mktemp`
+    file_conf1=`mktemp`
+    file_conf2=`mktemp`
+    cat <<- EOF > $file_localconf
+[[local|localrc]]
+LOCALRC_VAR1=localrc_val1
+LOCALRC_VAR2=localrc_val2
+LOCALRC_VAR3=localrc_val3
+
+[[post-config|$file_conf1]]
+[conf1_t1]
+conf1_t1_opt1=conf1_t1_val1
+conf1_t1_opt2=conf1_t1_val2
+conf1_t1_opt3=conf1_t1_val3
+[conf1_t2]
+conf1_t2_opt1=conf1_t2_val1
+conf1_t2_opt2=conf1_t2_val2
+conf1_t2_opt3=conf1_t2_val3
+[conf1_t3]
+conf1_t3_opt1=conf1_t3_val1
+conf1_t3_opt2=conf1_t3_val2
+conf1_t3_opt3=conf1_t3_val3
+
+[[post-extra|$file_conf2]]
+[conf2_t1]
+conf2_t1_opt1=conf2_t1_val1
+conf2_t1_opt2=conf2_t1_val2
+conf2_t1_opt3=conf2_t1_val3
+EOF
+    cat <<- EOF > $file_localconf_expected
+[[local|localrc]]
+LOCALRC_VAR1=localrc_val1
+LOCALRC_VAR2=localrc_val2_update
+LOCALRC_VAR3=localrc_val3
+
+[[post-config|$file_conf1]]
+[conf1_t4]
+conf1_t4_opt1 = conf1_t4_val1
+[conf1_t1]
+conf1_t1_opt1=conf1_t1_val1
+conf1_t1_opt2=conf1_t1_val2
+conf1_t1_opt3=conf1_t1_val3
+[conf1_t2]
+conf1_t2_opt1=conf1_t2_val1
+conf1_t2_opt2=conf1_t2_val2
+conf1_t2_opt3=conf1_t2_val3
+[conf1_t3]
+conf1_t3_opt1=conf1_t3_val1
+conf1_t3_opt2=conf1_t3_val2
+conf1_t3_opt3=conf1_t3_val3
+
+[[post-extra|$file_conf2]]
+[conf2_t1]
+conf2_t1_opt4 = conf2_t1_val4
+conf2_t1_opt1=conf2_t1_val1
+conf2_t1_opt2=conf2_t1_val2
+conf2_t1_opt3=conf2_t1_val3
+
+[[post-install|/etc/neutron/plugin/ml2/ml2_conf.ini]]
+[ml2]
+ml2_opt1 = ml2_val1
+EOF
+
+    if [[ -n "$SUDO" ]]; then
+        SUDO_ARG="-sudo"
+    else
+        SUDO_ARG=""
+    fi
+    localconf_set $SUDO_ARG $file_localconf post-install /etc/neutron/plugin/ml2/ml2_conf.ini ml2 ml2_opt1 ml2_val1
+    localconf_set $SUDO_ARG $file_localconf local localrc "" LOCALRC_VAR2 localrc_val2_update
+    localconf_set $SUDO_ARG $file_localconf post-config $file_conf1 conf1_t4 conf1_t4_opt1 conf1_t4_val1
+    localconf_set $SUDO_ARG $file_localconf post-extra $file_conf2 conf2_t1 conf2_t1_opt4 conf2_t1_val4
+    result=`cat $file_localconf`
+    result_expected=`cat $file_localconf_expected`
+    assert_equal "$result" "$result_expected"
+    rm -f $file_localconf $file_localconf_expected $file_conf1 $file_conf2
+}
+
+
+test_localconf_has_section
+test_localconf_has_option
+test_localconf_update_option
+test_localconf_add_option
+test_localconf_add_section_and_option
+test_localconf_set

From 9079a40e9ebf6c20d754b8221a55b183de1a0766 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Sun, 3 Jul 2016 19:20:27 -0400
Subject: [PATCH 0507/2409] nova: remove explicit file injection being disabled

Change 9ce99a44cf85e431227536e2251ef05b52e61524 disabled file
injection with the libvirt driver by default back in Icehouse,
so devstack doesn't need to do this explicitly anymore.

Change-Id: Id0c521f6f624367bd497463c8c2d99488548fcff
---
 lib/ceph                            | 1 -
 lib/nova_plugins/hypervisor-libvirt | 4 ----
 2 files changed, 5 deletions(-)

diff --git a/lib/ceph b/lib/ceph
index e999647ed8..2353de1758 100644
--- a/lib/ceph
+++ b/lib/ceph
@@ -301,7 +301,6 @@ function configure_ceph_nova {
     iniset $NOVA_CONF libvirt rbd_user ${CINDER_CEPH_USER}
     iniset $NOVA_CONF libvirt rbd_secret_uuid ${CINDER_CEPH_UUID}
     iniset $NOVA_CONF libvirt inject_key false
-    iniset $NOVA_CONF libvirt inject_partition -2
     iniset $NOVA_CONF libvirt disk_cachemodes "network=writeback"
     iniset $NOVA_CONF libvirt images_type rbd
     iniset $NOVA_CONF libvirt images_rbd_pool ${NOVA_CEPH_POOL}
diff --git a/lib/nova_plugins/hypervisor-libvirt b/lib/nova_plugins/hypervisor-libvirt
index d0e364efc3..503d4b6c89 100644
--- a/lib/nova_plugins/hypervisor-libvirt
+++ b/lib/nova_plugins/hypervisor-libvirt
@@ -57,10 +57,6 @@ function configure_nova_hypervisor {
         iniset $NOVA_CONF vnc enabled "false"
     fi
 
-    # File injection is being disabled by default in the near future -
-    # disable it here for now to avoid surprises later.
-    iniset $NOVA_CONF libvirt inject_partition '-2'
-
     if [[ "$LIBVIRT_TYPE" = "parallels" ]]; then
         iniset $NOVA_CONF libvirt connection_uri "parallels+unix:///system"
         iniset $NOVA_CONF libvirt images_type "ploop"

From 6d3670a65280d71529f8aad8ca5a0422abffebd0 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Sun, 3 Jul 2016 19:40:25 -0400
Subject: [PATCH 0508/2409] Add a way to enable file injection for nova/tempest

File injection is disabled by default for the libvirt
driver in nova. This adds a variable to enable file
injection for the libvirt driver and is also used
to configure tempest.conf for running personality
tests.

Change-Id: I34790fadeffd6e3fdc65bd9feed3d6e62316896c
Related-Bug: #1598581
---
 lib/nova_plugins/hypervisor-libvirt | 8 ++++++++
 lib/tempest                         | 1 +
 2 files changed, 9 insertions(+)

diff --git a/lib/nova_plugins/hypervisor-libvirt b/lib/nova_plugins/hypervisor-libvirt
index 503d4b6c89..cdd078ca51 100644
--- a/lib/nova_plugins/hypervisor-libvirt
+++ b/lib/nova_plugins/hypervisor-libvirt
@@ -57,6 +57,14 @@ function configure_nova_hypervisor {
         iniset $NOVA_CONF vnc enabled "false"
     fi
 
+    if isset ENABLE_FILE_INJECTION; then
+        if [ "$ENABLE_FILE_INJECTION" == "True" ]; then
+            # -1 means use libguestfs to inspect the guest OS image for the
+            # root partition to use for file injection.
+            iniset $NOVA_CONF libvirt inject_partition '-1'
+        fi
+    fi
+
     if [[ "$LIBVIRT_TYPE" = "parallels" ]]; then
         iniset $NOVA_CONF libvirt connection_uri "parallels+unix:///system"
         iniset $NOVA_CONF libvirt images_type "ploop"
diff --git a/lib/tempest b/lib/tempest
index 347b2a7dc7..ebaf4bb1cc 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -348,6 +348,7 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG compute max_microversion $tempest_compute_max_microversion
     fi
 
+    iniset $TEMPEST_CONFIG compute-feature-enabled personality ${ENABLE_FILE_INJECTION:-False}
     iniset $TEMPEST_CONFIG compute-feature-enabled resize True
     iniset $TEMPEST_CONFIG compute-feature-enabled live_migration ${LIVE_MIGRATION_AVAILABLE:-False}
     iniset $TEMPEST_CONFIG compute-feature-enabled change_password False

From 67700ca5209c8d5605cfd94d6ac264f5247a2b8d Mon Sep 17 00:00:00 2001
From: Luz Cazares <luz.cazares@intel.com>
Date: Wed, 6 Jul 2016 12:13:18 -0700
Subject: [PATCH 0509/2409] Remove large_ops_number from devstack tempest

Option was deleted from Tempest config file. Also test scenario
was deleted. See commit I93b2fb33e97381f7c1e0cb1ef09ebc5c42c16ecc

Change-Id: I750e50ba7cf8fca1dde391c2620b4a815d6b02a1
Closes-Bug: #1599619
---
 lib/tempest | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index aa09e9a39f..bc3a2d897b 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -423,9 +423,6 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG scenario aki_img_file "cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-vmlinuz"
     iniset $TEMPEST_CONFIG scenario img_file "cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img"
 
-    # Large Ops Number
-    iniset $TEMPEST_CONFIG scenario large_ops_number ${TEMPEST_LARGE_OPS_NUMBER:-0}
-
     # Telemetry
     iniset $TEMPEST_CONFIG telemetry-feature-enabled events "True"
 

From 16edbe4356056daba18a7b912b4514fa11115e18 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Thu, 7 Jul 2016 14:43:39 -0400
Subject: [PATCH 0510/2409] Remove check for nova-volumes API

The osapi_volume API in Nova has been gone forever,
so we don't need to check for that anymore.

Change-Id: I7303d3f434fc27a4a1a127e455a7d3b88f588537
---
 lib/cinder | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 0ebf195422..6d56b65ef7 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -411,11 +411,7 @@ function create_cinder_cache_dir {
 }
 
 # init_cinder() - Initialize database and volume group
-# Uses global ``NOVA_ENABLED_APIS``
 function init_cinder {
-    # Force nova volumes off
-    NOVA_ENABLED_APIS=$(echo $NOVA_ENABLED_APIS | sed "s/osapi_volume,//")
-
     if is_service_enabled $DATABASE_BACKENDS; then
         # (Re)create cinder database
         recreate_database cinder

From 7ef31d0fe4d3b93dd08edcd511a32ae66c51fdba Mon Sep 17 00:00:00 2001
From: xurong00037997 <xu.rong@zte.com.cn>
Date: Tue, 5 Jul 2016 11:09:40 +0800
Subject: [PATCH 0511/2409] neutron_plugin_configure_dhcp_agent invalid config
 file

ADD dhcp config file name for neutron_plugin_configure_dhcp_agent

Change-Id: I6578bcb40c4df2231c0b54f231ac3b78ede5a71d
Closes-Bug: #1598745
---
 lib/neutron-legacy | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index dca2e98a0c..3a1bc64ec5 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -817,7 +817,7 @@ function _configure_neutron_dhcp_agent {
 
     _neutron_setup_interface_driver $Q_DHCP_CONF_FILE
 
-    neutron_plugin_configure_dhcp_agent
+    neutron_plugin_configure_dhcp_agent $Q_DHCP_CONF_FILE
 }
 
 

From d565d62efe9a4476367be58551f6412e8e85688a Mon Sep 17 00:00:00 2001
From: Maxim Nestratov <mnestratov@virtuozzo.com>
Date: Mon, 11 Jul 2016 22:33:39 +0300
Subject: [PATCH 0512/2409] ploop: specify hypervisor_type=vz property for
 ploop images

This is necessary to make it possible to filter out compute nodes,
which don't support such type of images.

Change-Id: I347953876e2057e6f3dca71c2f5e8b638b85aaf8
---
 functions | 1 +
 1 file changed, 1 insertion(+)

diff --git a/functions b/functions
index 46a7d414a1..50b72ebf2f 100644
--- a/functions
+++ b/functions
@@ -251,6 +251,7 @@ function upload_image {
             image create \
             "$image_name" --public \
             --container-format=bare --disk-format=ploop \
+            --property hypervisor_type=vz \
             --property vm_mode=$vm_mode < "${image}"
         return
     fi

From a9286886e413fbf055284dc167a7640a5a79b83c Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Mon, 20 Jun 2016 13:23:11 -0400
Subject: [PATCH 0513/2409] Neutron: include metering service plugin in conf

The common code for metering calls _neutron_service_plugin_class_add,
which despite the description only just appends a service plugin to
$Q_SERVICE_PLUGIN_CLASSES - it doesn't actually write it into a
configuration file.

So for now, read out the configuration, and append metering to it, then
write it back out.

Change-Id: Ice96cca8b43dcd54f2aa81461000a4597db8260d
---
 lib/neutron | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lib/neutron b/lib/neutron
index ad68d8e62f..5cab8e1716 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -245,6 +245,12 @@ function configure_neutron_new {
         source $TOP_DIR/lib/neutron_plugins/services/metering
         neutron_agent_metering_configure_common
         neutron_agent_metering_configure_agent
+        # TODO(sc68cal) hack because we don't pass around
+        # $Q_SERVICE_PLUGIN_CLASSES like -legacy does
+        local plugins=""
+        plugins=$(iniget $NEUTRON_CONF DEFAULT service_plugins)
+        plugins+=",metering"
+        iniset $NEUTRON_CONF DEFAULT service_plugins $plugins
     fi
 
 }

From 657cdcdbd18cbdbc185fbf6ef853382b357b3370 Mon Sep 17 00:00:00 2001
From: Patrick East <patrick.east@purestorage.com>
Date: Fri, 1 Jul 2016 16:08:15 -0700
Subject: [PATCH 0514/2409] Allow for Nova to use os-brick from git

This option to install os-brick from git was only added
into lib/cinder previously. When testing all-in-one nodes
this worked fine, but if you have multi-node setups with
compute nodes that don't install any c-* services we
only get packaged os-brick. With this change non-cinder
nodes can now test against unreleased os-bricks.

Change-Id: Ibb7423d243d57852dada0b6298463bbdfc6dc63c
---
 lib/cinder   |  8 --------
 lib/os_brick | 29 +++++++++++++++++++++++++++++
 stack.sh     |  6 ++++++
 3 files changed, 35 insertions(+), 8 deletions(-)
 create mode 100644 lib/os_brick

diff --git a/lib/cinder b/lib/cinder
index 0ebf195422..69ff4c4e36 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -39,7 +39,6 @@ fi
 
 # set up default directories
 GITDIR["python-cinderclient"]=$DEST/python-cinderclient
-GITDIR["os-brick"]=$DEST/os-brick
 GITDIR["python-brick-cinderclient-ext"]=$DEST/python-brick-cinderclient-ext
 CINDER_DIR=$DEST/cinder
 
@@ -445,13 +444,6 @@ function init_cinder {
 
 # install_cinder() - Collect source and prepare
 function install_cinder {
-    # Install os-brick from git so we make sure we're testing
-    # the latest code.
-    if use_library_from_git "os-brick"; then
-        git_clone_by_name "os-brick"
-        setup_dev_lib "os-brick"
-    fi
-
     git_clone $CINDER_REPO $CINDER_DIR $CINDER_BRANCH
     setup_develop $CINDER_DIR
     if [ "$CINDER_ISCSI_HELPER" = "tgtadm" ]; then
diff --git a/lib/os_brick b/lib/os_brick
new file mode 100644
index 0000000000..690e321809
--- /dev/null
+++ b/lib/os_brick
@@ -0,0 +1,29 @@
+#!/bin/bash
+#
+# lib/os_brick
+# Install **os-brick** python module from source
+
+# Dependencies:
+#
+# - functions
+# - DEST, DATA_DIR must be defined
+
+# stack.sh
+# ---------
+# - install_os_brick
+
+# Save trace setting
+_XTRACE_CINDER=$(set +o | grep xtrace)
+set +o xtrace
+
+
+GITDIR["os-brick"]=$DEST/os-brick
+
+# Install os_brick from git only if requested, otherwise it will be pulled from
+# pip repositories by requirements of projects that need it.
+function install_os_brick {
+    if use_library_from_git "os-brick"; then
+        git_clone_by_name "os-brick"
+        setup_dev_lib "os-brick"
+    fi
+}
diff --git a/stack.sh b/stack.sh
index 6fbb0bee3b..5a5a040b02 100755
--- a/stack.sh
+++ b/stack.sh
@@ -570,6 +570,7 @@ source $TOP_DIR/lib/neutron-legacy
 source $TOP_DIR/lib/ldap
 source $TOP_DIR/lib/dstat
 source $TOP_DIR/lib/dlm
+source $TOP_DIR/lib/os_brick
 
 # Extras Source
 # --------------
@@ -796,6 +797,11 @@ if is_service_enabled heat horizon; then
     install_heatclient
 fi
 
+# Install shared libraries
+if is_service_enabled cinder nova; then
+    install_os_brick
+fi
+
 # Install middleware
 install_keystonemiddleware
 

From 6267ec01d6b4c503bca21ca6cbf95b443eff3408 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Tue, 12 Jul 2016 19:12:30 -0400
Subject: [PATCH 0515/2409] Remove juno/kilo specific tempest config

This removes several config flags for Tempest
now that juno and kilo are end of life. Tempest
has already removed these flags too.

Change-Id: I748429e73073f4202f77dfe1002687f76ee9a451
---
 lib/tempest | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index bc3a2d897b..01ad4f4381 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -356,15 +356,7 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG compute-feature-enabled live_migration ${LIVE_MIGRATION_AVAILABLE:-False}
     iniset $TEMPEST_CONFIG compute-feature-enabled change_password False
     iniset $TEMPEST_CONFIG compute-feature-enabled block_migration_for_live_migration ${USE_BLOCK_MIGRATION_FOR_LIVE_MIGRATION:-False}
-    # TODO(mriedem): Remove the preserve_ports flag when Juno is end of life.
-    iniset $TEMPEST_CONFIG compute-feature-enabled preserve_ports True
-    # TODO(gilliard): Remove the live_migrate_paused_instances flag when Juno is end of life.
-    iniset $TEMPEST_CONFIG compute-feature-enabled live_migrate_paused_instances True
     iniset $TEMPEST_CONFIG compute-feature-enabled attach_encrypted_volume ${ATTACH_ENCRYPTED_VOLUME_AVAILABLE:-True}
-    # TODO(mriedem): Remove this when kilo-eol happens since the
-    # neutron.allow_duplicate_networks option was removed from nova in Liberty
-    # and is now the default behavior.
-    iniset $TEMPEST_CONFIG compute-feature-enabled allow_duplicate_networks ${NOVA_ALLOW_DUPLICATE_NETWORKS:-True}
     if is_service_enabled n-cell; then
         # Cells doesn't support shelving/unshelving
         iniset $TEMPEST_CONFIG compute-feature-enabled shelve False
@@ -434,8 +426,6 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG validation network_for_ssh $PRIVATE_NETWORK_NAME
 
     # Volume
-    # TODO(obutenko): Remove the incremental_backup_force flag when Kilo and Juno is end of life.
-    iniset $TEMPEST_CONFIG volume-feature-enabled incremental_backup_force True
     # TODO(ynesenenko): Remove the volume_services flag when Liberty and Kilo will correct work with host info.
     iniset $TEMPEST_CONFIG volume-feature-enabled volume_services True
     # TODO(ameade): Remove the api_v3 flag when Mitaka and Liberty are end of life.

From 7886f7eb9fcd0cfdee93e4480a9fdcee2b0a2b74 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Wed, 13 Jul 2016 08:19:48 +0000
Subject: [PATCH 0516/2409] Updated from generate-devstack-plugins-list

Change-Id: I4535ce00a7d15d14fdb9c3180b6b821352fe704f
---
 doc/source/plugin-registry.rst | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 5b6622e75c..104fca679c 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -62,12 +62,14 @@ freezer-web-ui                         `git://git.openstack.org/openstack/freeze
 gce-api                                `git://git.openstack.org/openstack/gce-api <https://git.openstack.org/cgit/openstack/gce-api>`__
 gnocchi                                `git://git.openstack.org/openstack/gnocchi <https://git.openstack.org/cgit/openstack/gnocchi>`__
 group-based-policy                     `git://git.openstack.org/openstack/group-based-policy <https://git.openstack.org/cgit/openstack/group-based-policy>`__
+heat                                   `git://git.openstack.org/openstack/heat <https://git.openstack.org/cgit/openstack/heat>`__
 higgins                                `git://git.openstack.org/openstack/higgins <https://git.openstack.org/cgit/openstack/higgins>`__
 ironic                                 `git://git.openstack.org/openstack/ironic <https://git.openstack.org/cgit/openstack/ironic>`__
 ironic-inspector                       `git://git.openstack.org/openstack/ironic-inspector <https://git.openstack.org/cgit/openstack/ironic-inspector>`__
 ironic-staging-drivers                 `git://git.openstack.org/openstack/ironic-staging-drivers <https://git.openstack.org/cgit/openstack/ironic-staging-drivers>`__
 kingbird                               `git://git.openstack.org/openstack/kingbird <https://git.openstack.org/cgit/openstack/kingbird>`__
 kuryr                                  `git://git.openstack.org/openstack/kuryr <https://git.openstack.org/cgit/openstack/kuryr>`__
+kuryr-libnetwork                       `git://git.openstack.org/openstack/kuryr-libnetwork <https://git.openstack.org/cgit/openstack/kuryr-libnetwork>`__
 magnum                                 `git://git.openstack.org/openstack/magnum <https://git.openstack.org/cgit/openstack/magnum>`__
 magnum-ui                              `git://git.openstack.org/openstack/magnum-ui <https://git.openstack.org/cgit/openstack/magnum-ui>`__
 manila                                 `git://git.openstack.org/openstack/manila <https://git.openstack.org/cgit/openstack/manila>`__

From eecb983529a9164a0dabf19ea4c3186a708fa0c3 Mon Sep 17 00:00:00 2001
From: Kashyap Chamarthy <kchamart@redhat.com>
Date: Wed, 13 Jul 2016 12:34:03 +0200
Subject: [PATCH 0517/2409] Remove support for End Of Life (EOL) Fedora 22

Fedora 22 reaches its EOL on 19-JUL-2016[1].  Remove it as
officially supported distribution.

The current two supported Fedora distributions are Fedora 23 and Fedora
24.  (Change Ia4a58de4973ef228735c48b33453a0562dc65258 already added
support for Fedora 24.)

[1] https://fedoramagazine.org/fedora-22-end-of-life-2016-july/

Change-Id: I5b4e1ddb6165a9065e80e84175246678a7356f18
---
 files/rpms/general | 4 ++--
 files/rpms/nova    | 2 +-
 files/rpms/swift   | 2 +-
 lib/ceph           | 2 +-
 stack.sh           | 2 +-
 5 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/files/rpms/general b/files/rpms/general
index ee2e8a058b..d0ceb56621 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -7,9 +7,9 @@ gcc-c++
 gettext  # used for compiling message catalogs
 git-core
 graphviz # needed only for docs
-iptables-services  # NOPRIME f22,f23,f24
+iptables-services  # NOPRIME f23,f24
 java-1.7.0-openjdk-headless  # NOPRIME rhel7
-java-1.8.0-openjdk-headless  # NOPRIME f22,f23,f24
+java-1.8.0-openjdk-headless  # NOPRIME f23,f24
 libffi-devel
 libjpeg-turbo-devel # Pillow 3.0.0
 libxml2-devel # lxml
diff --git a/files/rpms/nova b/files/rpms/nova
index 594393e733..a883ec4399 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -7,7 +7,7 @@ gawk
 genisoimage # required for config_drive
 iptables
 iputils
-kernel-modules # dist:f22,f23,f24
+kernel-modules # dist:f23,f24
 kpartx
 kvm # NOPRIME
 libvirt-bin # NOPRIME
diff --git a/files/rpms/swift b/files/rpms/swift
index 1e05167bcf..bd249ee71b 100644
--- a/files/rpms/swift
+++ b/files/rpms/swift
@@ -2,7 +2,7 @@ curl
 liberasurecode-devel
 memcached
 pyxattr
-rsync-daemon # dist:f22,f23,f24
+rsync-daemon # dist:f23,f24
 sqlite
 xfsprogs
 xinetd
diff --git a/lib/ceph b/lib/ceph
index e999647ed8..0c8d160766 100644
--- a/lib/ceph
+++ b/lib/ceph
@@ -116,7 +116,7 @@ function undefine_virsh_secret {
 
 # check_os_support_ceph() - Check if the operating system provides a decent version of Ceph
 function check_os_support_ceph {
-    if [[ ! ${DISTRO} =~ (trusty|f22|f23|f24) ]]; then
+    if [[ ! ${DISTRO} =~ (trusty|f23|f24) ]]; then
         echo "WARNING: your distro $DISTRO does not provide (at least) the Firefly release. Please use Ubuntu Trusty or Fedora 20 (and higher)"
         if [[ "$FORCE_CEPH_INSTALL" != "yes" ]]; then
             die $LINENO "If you wish to install Ceph on this distribution anyway run with FORCE_CEPH_INSTALL=yes"
diff --git a/stack.sh b/stack.sh
index 5a5a040b02..4cace9d0c2 100755
--- a/stack.sh
+++ b/stack.sh
@@ -185,7 +185,7 @@ source $TOP_DIR/stackrc
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (trusty|wily|xenial|7.0|wheezy|sid|testing|jessie|f22|f23|f24|rhel7|kvmibm1) ]]; then
+if [[ ! ${DISTRO} =~ (trusty|wily|xenial|7.0|wheezy|sid|testing|jessie|f23|f24|rhel7|kvmibm1) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From e24707bb594eece8a3172c6763ac8fc3a1a8681f Mon Sep 17 00:00:00 2001
From: Matt McEuen <mm9745@att.com>
Date: Mon, 11 Jul 2016 08:37:59 -0500
Subject: [PATCH 0518/2409] lib/neutron-legacy: replace ip when re-stacking

Replicated Yi Zhao's fix for re-adding ipv6 addresses to neutron-legacy
(review I9ff62023dbc29a88aec3c48af331c0a49a1270bb).
Previously, re-stacking failed with "File exists" for ipv6 addresses
on br-ex.  With this change, the existing address is replaced on
br-ex with the appropriate address.

Change-Id: I6e6235132a34469f4e68b5bb3cf51ebdf01c83a2
---
 lib/neutron-legacy | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 3a1bc64ec5..def1674e7c 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -610,7 +610,7 @@ function _move_neutron_addresses_route {
         # on configure we will also add $from_intf as a port on $to_intf,
         # assuming it is an OVS bridge.
 
-        local IP_ADD=""
+        local IP_REPLACE=""
         local IP_DEL=""
         local IP_UP=""
         local DEFAULT_ROUTE_GW
@@ -635,7 +635,7 @@ function _move_neutron_addresses_route {
 
         if [[ "$IP_BRD" != "" ]]; then
             IP_DEL="sudo ip addr del $IP_BRD dev $from_intf"
-            IP_ADD="sudo ip addr add $IP_BRD dev $to_intf"
+            IP_REPLACE="sudo ip addr replace $IP_BRD dev $to_intf"
             IP_UP="sudo ip link set $to_intf up"
             if [[ "$af" == "inet" ]]; then
                 IP=$(echo $IP_BRD | awk '{ print $1; exit }' | grep -o -E '(.*)/' | cut -d "/" -f1)
@@ -645,7 +645,7 @@ function _move_neutron_addresses_route {
 
         # The add/del OVS port calls have to happen either before or
         # after the address is moved in order to not leave it orphaned.
-        $DEL_OVS_PORT; $IP_DEL; $IP_ADD; $IP_UP; $ADD_OVS_PORT; $ADD_DEFAULT_ROUTE; $ARP_CMD
+        $DEL_OVS_PORT; $IP_DEL; $IP_REPLACE; $IP_UP; $ADD_OVS_PORT; $ADD_DEFAULT_ROUTE; $ARP_CMD
     fi
 }
 

From 5813265ce597dd5eb1105fad5922339a38ea9092 Mon Sep 17 00:00:00 2001
From: Attila Fazekas <afazekas@redhat.com>
Date: Thu, 14 Jul 2016 12:55:51 +0200
Subject: [PATCH 0519/2409] remove OS_AUTH_TYPE  from the userrc files

The openstack client just gets more confused when it is specified.

Change-Id: I8b498be835b63733cb38d33b02c3a8531a2da45b
---
 tools/create_userrc.sh | 1 -
 1 file changed, 1 deletion(-)

diff --git a/tools/create_userrc.sh b/tools/create_userrc.sh
index b6db5d11aa..30d1a01577 100755
--- a/tools/create_userrc.sh
+++ b/tools/create_userrc.sh
@@ -193,7 +193,6 @@ export OS_PROJECT_NAME="$project_name"
 export OS_AUTH_URL="$OS_AUTH_URL"
 export OS_CACERT="$OS_CACERT"
 export NOVA_CERT="$ACCOUNT_DIR/cacert.pem"
-export OS_AUTH_TYPE=v2password
 EOF
     if [ -n "$ADDPASS" ]; then
         echo "export OS_PASSWORD=\"$user_passwd\"" >>"$rcfile"

From 79fc935640aa4695c26b4bcc8b06c605e2256311 Mon Sep 17 00:00:00 2001
From: Thiago Paiva <thiagop@lsd.ufcg.edu.br>
Date: Thu, 14 Jul 2016 14:16:20 -0300
Subject: [PATCH 0520/2409] Restoring xtrace state for os-brick plugin

The change Ibb7423d243d57852dada0b6298463bbdfc6dc63c that introduced the
os-brick plugin introduced a flaw where the xtrace state wasn't restored
after the end of the plugin's execution. The end behavior is that devstack's
logs were with way less information, difficulting the debugging of the build.
This patch fixes the variable that was intended to hold the xtrace state (it
was using cinder's) and restoring the state at the end of the script.

Change-Id: I47c6c794a9704049b089142eca5603d1183f8a10
---
 lib/os_brick | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/lib/os_brick b/lib/os_brick
index 690e321809..d1cca4af44 100644
--- a/lib/os_brick
+++ b/lib/os_brick
@@ -13,7 +13,7 @@
 # - install_os_brick
 
 # Save trace setting
-_XTRACE_CINDER=$(set +o | grep xtrace)
+_XTRACE_OS_BRICK=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -27,3 +27,6 @@ function install_os_brick {
         setup_dev_lib "os-brick"
     fi
 }
+
+# Restore xtrace
+$_XTRACE_OS_BRICK
\ No newline at end of file

From 7b5c7dce53ab9e9778d1d72fcbbed565bfce65bd Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Fri, 15 Jul 2016 20:17:13 +0200
Subject: [PATCH 0521/2409] Introduce PUBLIC_BRIDGE_MTU variable to set br-ex
 MTU

This variable can be used to accommodate for underlying infrastructure
that does not provide full 1500-sized traffic, or maybe instead gives
access to Jumbo frames.

Change-Id: I38a80bac18673a30842a7b997d0669fed5aff976
Related-Bug: #1603268
---
 functions                             | 9 +++++++++
 lib/neutron_plugins/linuxbridge_agent | 1 +
 lib/neutron_plugins/openvswitch_agent | 2 +-
 lib/neutron_plugins/ovs_base          | 7 ++++++-
 lib/neutron_plugins/services/l3       | 1 +
 5 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/functions b/functions
index 4f5e10aaa6..58565788ff 100644
--- a/functions
+++ b/functions
@@ -637,6 +637,15 @@ function create_disk {
     fi
 }
 
+
+# set_mtu - Set MTU on a device
+function set_mtu {
+    local dev=$1
+    local mtu=$2
+    sudo ip link set mtu $mtu dev $dev
+}
+
+
 # Restore xtrace
 $_XTRACE_FUNCTIONS
 
diff --git a/lib/neutron_plugins/linuxbridge_agent b/lib/neutron_plugins/linuxbridge_agent
index 0a066354ca..e5a7b76187 100644
--- a/lib/neutron_plugins/linuxbridge_agent
+++ b/lib/neutron_plugins/linuxbridge_agent
@@ -50,6 +50,7 @@ function neutron_plugin_configure_dhcp_agent {
 function neutron_plugin_configure_l3_agent {
     local conf_file=$1
     sudo brctl addbr $PUBLIC_BRIDGE
+    set_mtu $PUBLIC_BRIDGE $PUBLIC_BRIDGE_MTU
     iniset $conf_file DEFAULT external_network_bridge
     iniset $conf_file DEFAULT l3_agent_manager neutron.agent.l3_agent.L3NATAgentWithStateReport
 }
diff --git a/lib/neutron_plugins/openvswitch_agent b/lib/neutron_plugins/openvswitch_agent
index 69e38f4df1..b4a53e4c38 100644
--- a/lib/neutron_plugins/openvswitch_agent
+++ b/lib/neutron_plugins/openvswitch_agent
@@ -104,7 +104,7 @@ function neutron_plugin_configure_plugin_agent {
         sudo ovs-vsctl -- --may-exist add-port "br-$VLAN_INTERFACE" $VLAN_INTERFACE
 
         # Create external bridge and add port
-        _neutron_ovs_base_add_bridge $PUBLIC_BRIDGE
+        _neutron_ovs_base_add_public_bridge
         sudo ovs-vsctl -- --may-exist add-port $PUBLIC_BRIDGE $PUBLIC_INTERFACE
 
         # Set bridge mappings to "physnet1:br-$GUEST_INTERFACE_DEFAULT"
diff --git a/lib/neutron_plugins/ovs_base b/lib/neutron_plugins/ovs_base
index ecf252f88b..9e1421f5e6 100644
--- a/lib/neutron_plugins/ovs_base
+++ b/lib/neutron_plugins/ovs_base
@@ -105,11 +105,16 @@ function _neutron_ovs_base_configure_l3_agent {
         sudo ip link set $Q_PUBLIC_VETH_EX up
         sudo ip addr flush dev $Q_PUBLIC_VETH_EX
     else
-        _neutron_ovs_base_add_bridge $PUBLIC_BRIDGE
+        _neutron_ovs_base_add_public_bridge
         sudo ovs-vsctl br-set-external-id $PUBLIC_BRIDGE bridge-id $PUBLIC_BRIDGE
     fi
 }
 
+function _neutron_ovs_base_add_public_bridge {
+    _neutron_ovs_base_add_bridge $PUBLIC_BRIDGE
+    set_mtu $PUBLIC_BRIDGE $PUBLIC_BRIDGE_MTU
+}
+
 function _neutron_ovs_base_configure_nova_vif_driver {
     :
 }
diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 4ce87bdf6f..2180099ee4 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -15,6 +15,7 @@ IPV6_PROVIDER_FIXED_RANGE=${IPV6_PROVIDER_FIXED_RANGE:-}
 IPV6_PROVIDER_NETWORK_GATEWAY=${IPV6_PROVIDER_NETWORK_GATEWAY:-}
 
 PUBLIC_BRIDGE=${PUBLIC_BRIDGE:-br-ex}
+PUBLIC_BRIDGE_MTU=${PUBLIC_BRIDGE_MTU:-1500}
 
 # If Q_USE_PUBLIC_VETH=True, create and use a veth pair instead of
 # PUBLIC_BRIDGE.  This is intended to be used with

From d55513a07c610da479a6e59ff50605f48caeabef Mon Sep 17 00:00:00 2001
From: venkatamahesh <Venkata.Kotha@infinite.com>
Date: Tue, 19 Jul 2016 17:34:20 +0530
Subject: [PATCH 0522/2409] Corrected the local.conf configuration file link

Change-Id: Id28a9f85ae5ba789f09269163c6e5b2c8c36a7c8
Closes-Bug: #1603848
---
 samples/local.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/samples/local.conf b/samples/local.conf
index 06ac18572d..6d5351f904 100644
--- a/samples/local.conf
+++ b/samples/local.conf
@@ -10,7 +10,7 @@
 
 # This is a collection of some of the settings we have found to be useful
 # in our DevStack development environments. Additional settings are described
-# in http://devstack.org/local.conf.html
+# in http://docs.openstack.org/developer/devstack/configuration.html#local-conf
 # These should be considered as samples and are unsupported DevStack code.
 
 # The ``localrc`` section replaces the old ``localrc`` configuration file.

From e2b75363699124cfd2c19de69286cfafa98aa9a0 Mon Sep 17 00:00:00 2001
From: Hironori Shiina <shiina.hironori@jp.fujitsu.com>
Date: Sat, 16 Jul 2016 01:02:49 +0900
Subject: [PATCH 0523/2409] Remove remaining fwaas code

Change-Id: I24fe7a559760b985bd53373523276a8f075e5974
---
 lib/neutron-legacy | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index f4e577d43b..7dce5f7f3e 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -292,9 +292,6 @@ function _determine_config_server {
 
 function _determine_config_l3 {
     local opts="--config-file $NEUTRON_CONF --config-file $Q_L3_CONF_FILE"
-    if is_service_enabled q-fwaas; then
-        opts+=" --config-file $Q_FWAAS_CONF_FILE"
-    fi
     echo "$opts"
 }
 

From 5d7992a0189d940c0ffbb01e93bf3a0e4eba4ec7 Mon Sep 17 00:00:00 2001
From: Kevin Zhao <kevin.zhao@linaro.org>
Date: Tue, 19 Jul 2016 15:52:12 +0000
Subject: [PATCH 0524/2409] Modify the default cpu-mode for aarh64 in Libvirt

For AArch64, KVM don't recognize the cpu-mode "none",
so change the default cpu-mode as host-passthrough for
generating nova.conf

Change-Id: I94a22e5a15a974b9c11e9f9fd996857453b6e2ca
Signed-off-by: Kevin Zhao <kevin.zhao@linaro.org>
---
 lib/nova_plugins/hypervisor-libvirt | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/nova_plugins/hypervisor-libvirt b/lib/nova_plugins/hypervisor-libvirt
index d0e364efc3..51d807a160 100644
--- a/lib/nova_plugins/hypervisor-libvirt
+++ b/lib/nova_plugins/hypervisor-libvirt
@@ -55,6 +55,7 @@ function configure_nova_hypervisor {
     if is_arch "aarch64"; then
         # arm64 architecture currently does not support graphical consoles.
         iniset $NOVA_CONF vnc enabled "false"
+        iniset $NOVA_CONF libvirt cpu_mode "host-passthrough"
     fi
 
     # File injection is being disabled by default in the near future -

From 881373c049eceefc4fd7f6c69543d42528830a0e Mon Sep 17 00:00:00 2001
From: Oleksii Butenko <obutenko@mirantis.com>
Date: Tue, 21 Jun 2016 17:29:54 +0300
Subject: [PATCH 0525/2409] Add flag for snapshot_backup

We have new feature in cinder and new test for it.
The test is skipped by default.
Need to add flag to unskip this test on master and
Mitaka.

new test: I1964ce6e1298041f8238d76fa4b7029d2d23bbfb

Change-Id: Ib695e60c2ed7edf30c8baef9e00f0307b1156551
---
 lib/tempest | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index 01ad4f4381..e4f80b835d 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -426,6 +426,8 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG validation network_for_ssh $PRIVATE_NETWORK_NAME
 
     # Volume
+    # TODO(obutenko): Remove snapshot_backup when liberty-eol happens.
+    iniset $TEMPEST_CONFIG volume-feature-enabled snapshot_backup True
     # TODO(ynesenenko): Remove the volume_services flag when Liberty and Kilo will correct work with host info.
     iniset $TEMPEST_CONFIG volume-feature-enabled volume_services True
     # TODO(ameade): Remove the api_v3 flag when Mitaka and Liberty are end of life.

From 130a11f8aaf08ea529b6ce60dd9052451cb7bb5c Mon Sep 17 00:00:00 2001
From: Kevin Benton <kevin@benton.pub>
Date: Sun, 17 Jul 2016 22:19:30 -0600
Subject: [PATCH 0526/2409] Use real Neutron network for L3 GW by default

Relying on 'external_network_bridge=br-ex' for the L3
agent has been deprecated in Neutron. This patch adjusts
the devstack defaults to setup Neutron in the preferred
manner (empty external_network_bridge value and
correct bridge_mappings for the L2 agent).

This will also help with correct MTU calculations now that
the external network will have the correct segmentation
type on it ('flat' now instead of 'vxlan' by default).

Related-Bug: #1511578
Related-Bug: #1603493
Change-Id: Id20e67aba5dfd2044b82c700f41c6e648b529430
---
 lib/neutron-legacy              | 4 ++--
 lib/neutron_plugins/services/l3 | 9 +++++++--
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index f4e577d43b..f83492b931 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -203,7 +203,7 @@ TENANT_VLAN_RANGE=${TENANT_VLAN_RANGE:-}
 # agent, as described below.
 #
 # Example: ``PHYSICAL_NETWORK=default``
-PHYSICAL_NETWORK=${PHYSICAL_NETWORK:-}
+PHYSICAL_NETWORK=${PHYSICAL_NETWORK:-public}
 
 # With the openvswitch agent, if using VLANs for tenant networks,
 # or if using flat or VLAN provider networks, set in ``localrc`` to
@@ -213,7 +213,7 @@ PHYSICAL_NETWORK=${PHYSICAL_NETWORK:-}
 # port for external connectivity.
 #
 # Example: ``OVS_PHYSICAL_BRIDGE=br-eth1``
-OVS_PHYSICAL_BRIDGE=${OVS_PHYSICAL_BRIDGE:-}
+OVS_PHYSICAL_BRIDGE=${OVS_PHYSICAL_BRIDGE:-br-ex}
 
 # With the linuxbridge agent, if using VLANs for tenant networks,
 # or if using flat or VLAN provider networks, set in ``localrc`` to
diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 2180099ee4..816679ec79 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -17,6 +17,11 @@ IPV6_PROVIDER_NETWORK_GATEWAY=${IPV6_PROVIDER_NETWORK_GATEWAY:-}
 PUBLIC_BRIDGE=${PUBLIC_BRIDGE:-br-ex}
 PUBLIC_BRIDGE_MTU=${PUBLIC_BRIDGE_MTU:-1500}
 
+# If Q_ASSIGN_GATEWAY_TO_PUBLIC_BRIDGE=True, assign the gateway IP of the public
+# subnet to the public bridge interface even if Q_USE_PROVIDERNET_FOR_PUBLIC is
+# used.
+Q_ASSIGN_GATEWAY_TO_PUBLIC_BRIDGE=${Q_ASSIGN_GATEWAY_TO_PUBLIC_BRIDGE:-True}
+
 # If Q_USE_PUBLIC_VETH=True, create and use a veth pair instead of
 # PUBLIC_BRIDGE.  This is intended to be used with
 # Q_USE_PROVIDERNET_FOR_PUBLIC=True.
@@ -51,7 +56,7 @@ Q_L3_ROUTER_PER_TENANT=${Q_L3_ROUTER_PER_TENANT:-True}
 #    Q_USE_PROVIDERNET_FOR_PUBLIC=True
 #    PUBLIC_PHYSICAL_NETWORK=public
 #    OVS_BRIDGE_MAPPINGS=public:br-ex
-Q_USE_PROVIDERNET_FOR_PUBLIC=${Q_USE_PROVIDERNET_FOR_PUBLIC:-False}
+Q_USE_PROVIDERNET_FOR_PUBLIC=${Q_USE_PROVIDERNET_FOR_PUBLIC:-True}
 PUBLIC_PHYSICAL_NETWORK=${PUBLIC_PHYSICAL_NETWORK:-public}
 
 # Generate 40-bit IPv6 Global ID to comply with RFC 4193
@@ -305,7 +310,7 @@ function _neutron_configure_router_v4 {
             local cidr_len=${FLOATING_RANGE#*/}
             local testcmd="ip -o link | grep -q $ext_gw_interface"
             test_with_retry "$testcmd" "$ext_gw_interface creation failed"
-            if [[ $(ip addr show dev $ext_gw_interface | grep -c $ext_gw_ip) == 0 && ( $Q_USE_PROVIDERNET_FOR_PUBLIC == "False" || $Q_USE_PUBLIC_VETH == "True" ) ]]; then
+            if [[ $(ip addr show dev $ext_gw_interface | grep -c $ext_gw_ip) == 0 && ( $Q_USE_PROVIDERNET_FOR_PUBLIC == "False" || $Q_USE_PUBLIC_VETH == "True" || $Q_ASSIGN_GATEWAY_TO_PUBLIC_BRIDGE == "True" ) ]]; then
                 sudo ip addr add $ext_gw_ip/$cidr_len dev $ext_gw_interface
                 sudo ip link set $ext_gw_interface up
             fi

From a1e1f5128a22a7d0cdc8136063d27d64c270021d Mon Sep 17 00:00:00 2001
From: Rob Crittenden <rcritten@redhat.com>
Date: Wed, 20 Jul 2016 18:12:09 -0400
Subject: [PATCH 0527/2409] Add keystone VirtualHost for port 443 when USE_SSL
 is True

Add a VirtualHost that defines the necessary options for
enabling SSL. The existing keystone Apache configuration already
does all the location handling.

Change-Id: I836a471a7258f14f051d3dd8bdb428286b5a11aa
---
 files/apache-keystone.template | 6 ++++++
 lib/keystone                   | 3 +++
 2 files changed, 9 insertions(+)

diff --git a/files/apache-keystone.template b/files/apache-keystone.template
index 8a4b0f0c43..249eaa5d0e 100644
--- a/files/apache-keystone.template
+++ b/files/apache-keystone.template
@@ -34,6 +34,12 @@ LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\" %D(us)"
     %SSLKEYFILE%
 </VirtualHost>
 
+%SSLLISTEN%<VirtualHost *:443>
+%SSLLISTEN%    %SSLENGINE%
+%SSLLISTEN%    %SSLCERTFILE%
+%SSLLISTEN%    %SSLKEYFILE%
+%SSLLISTEN%</VirtualHost>
+
 Alias /identity %KEYSTONE_BIN%/keystone-wsgi-public
 <Location /identity>
     SetHandler wsgi-script
diff --git a/lib/keystone b/lib/keystone
index 6198e43b58..810acac63f 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -161,6 +161,7 @@ function _cleanup_keystone_apache_wsgi {
 function _config_keystone_apache_wsgi {
     local keystone_apache_conf
     keystone_apache_conf=$(apache_site_config_for keystone)
+    keystone_ssl_listen="#"
     local keystone_ssl=""
     local keystone_certfile=""
     local keystone_keyfile=""
@@ -169,6 +170,7 @@ function _config_keystone_apache_wsgi {
     local venv_path=""
 
     if is_ssl_enabled_service key; then
+        keystone_ssl_listen=""
         keystone_ssl="SSLEngine On"
         keystone_certfile="SSLCertificateFile $KEYSTONE_SSL_CERT"
         keystone_keyfile="SSLCertificateKeyFile $KEYSTONE_SSL_KEY"
@@ -186,6 +188,7 @@ function _config_keystone_apache_wsgi {
         s|%PUBLICPORT%|$keystone_service_port|g;
         s|%ADMINPORT%|$keystone_auth_port|g;
         s|%APACHE_NAME%|$APACHE_NAME|g;
+        s|%SSLLISTEN%|$keystone_ssl_listen|g;
         s|%SSLENGINE%|$keystone_ssl|g;
         s|%SSLCERTFILE%|$keystone_certfile|g;
         s|%SSLKEYFILE%|$keystone_keyfile|g;

From 2381f336296c80834ca9ce5ed3f1c784acc4d157 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Thu, 21 Jul 2016 08:07:43 +0000
Subject: [PATCH 0528/2409] Updated from generate-devstack-plugins-list

Change-Id: Ieffddf42e1b5d77dea651208a18b3de320489745
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 104fca679c..38910b0785 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -64,6 +64,7 @@ gnocchi                                `git://git.openstack.org/openstack/gnocch
 group-based-policy                     `git://git.openstack.org/openstack/group-based-policy <https://git.openstack.org/cgit/openstack/group-based-policy>`__
 heat                                   `git://git.openstack.org/openstack/heat <https://git.openstack.org/cgit/openstack/heat>`__
 higgins                                `git://git.openstack.org/openstack/higgins <https://git.openstack.org/cgit/openstack/higgins>`__
+horizon-mellanox                       `git://git.openstack.org/openstack/horizon-mellanox <https://git.openstack.org/cgit/openstack/horizon-mellanox>`__
 ironic                                 `git://git.openstack.org/openstack/ironic <https://git.openstack.org/cgit/openstack/ironic>`__
 ironic-inspector                       `git://git.openstack.org/openstack/ironic-inspector <https://git.openstack.org/cgit/openstack/ironic-inspector>`__
 ironic-staging-drivers                 `git://git.openstack.org/openstack/ironic-staging-drivers <https://git.openstack.org/cgit/openstack/ironic-staging-drivers>`__

From df6c1ffbe110495d94f607a4344e0703be54c6ce Mon Sep 17 00:00:00 2001
From: Kenneth Giusti <kgiusti@gmail.com>
Date: Thu, 7 Jul 2016 09:28:58 -0400
Subject: [PATCH 0529/2409] Force reinstall of virtualenv to ensure
 installation is valid

On RHEL-based systems pip and yum share the same installation
directory for virtualenv.  If yum pulls in the python-virtualenv
package (e.g. due to a dependency) it will clobber what pip has
already installed. The file tools/fixup_stuff.sh tries to ensure that
the proper virtualenv package is installed via pip. If virtualenv has
already been installed via pip, then clobbered by yum, pip skips the
install since it appears as if virtualenv is already installed and at
the correct version.

The reinstall of virtualenv must use the --force-reinstall argument to
pip to fix up the damage done by yum.

Change-Id: Ib0edf6c4ee8a510e9d671213de35d787f56acfed
Closes-Bug: #1599863
---
 tools/fixup_stuff.sh | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index 193a1f7aba..4dec95eb4d 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -162,7 +162,11 @@ if is_fedora; then
 fi
 
 # The version of pip(1.5.4) supported by python-virtualenv(1.11.4) has
-# connection issues under proxy, hence uninstalling python-virtualenv package
-# and installing the latest version using pip.
-uninstall_package python-virtualenv
-pip_install -U virtualenv
+# connection issues under proxy so re-install the latest version using
+# pip. To avoid having pip's virtualenv overwritten by the distro's
+# package (e.g. due to installing a distro package with a dependency
+# on python-virtualenv), first install the distro python-virtualenv
+# to satisfy any dependencies then use pip to overwrite it.
+
+install_package python-virtualenv
+pip_install -U --force-reinstall virtualenv

From 7da968a8be03229cfa72b215b87f17e28e23a988 Mon Sep 17 00:00:00 2001
From: Kevin Benton <kevin@benton.pub>
Date: Fri, 22 Jul 2016 06:02:22 +0000
Subject: [PATCH 0530/2409] Revert "Use real Neutron network for L3 GW by
 default"

This reverts commit 130a11f8aaf08ea529b6ce60dd9052451cb7bb5c.
Linux bridge devstack logic needs some changes first.

Change-Id: I5885062ad128518c22f743db016e1a6db64f3313
Closes-Bug: #1605423
---
 lib/neutron-legacy              | 4 ++--
 lib/neutron_plugins/services/l3 | 9 ++-------
 2 files changed, 4 insertions(+), 9 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index f83492b931..f4e577d43b 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -203,7 +203,7 @@ TENANT_VLAN_RANGE=${TENANT_VLAN_RANGE:-}
 # agent, as described below.
 #
 # Example: ``PHYSICAL_NETWORK=default``
-PHYSICAL_NETWORK=${PHYSICAL_NETWORK:-public}
+PHYSICAL_NETWORK=${PHYSICAL_NETWORK:-}
 
 # With the openvswitch agent, if using VLANs for tenant networks,
 # or if using flat or VLAN provider networks, set in ``localrc`` to
@@ -213,7 +213,7 @@ PHYSICAL_NETWORK=${PHYSICAL_NETWORK:-public}
 # port for external connectivity.
 #
 # Example: ``OVS_PHYSICAL_BRIDGE=br-eth1``
-OVS_PHYSICAL_BRIDGE=${OVS_PHYSICAL_BRIDGE:-br-ex}
+OVS_PHYSICAL_BRIDGE=${OVS_PHYSICAL_BRIDGE:-}
 
 # With the linuxbridge agent, if using VLANs for tenant networks,
 # or if using flat or VLAN provider networks, set in ``localrc`` to
diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 816679ec79..2180099ee4 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -17,11 +17,6 @@ IPV6_PROVIDER_NETWORK_GATEWAY=${IPV6_PROVIDER_NETWORK_GATEWAY:-}
 PUBLIC_BRIDGE=${PUBLIC_BRIDGE:-br-ex}
 PUBLIC_BRIDGE_MTU=${PUBLIC_BRIDGE_MTU:-1500}
 
-# If Q_ASSIGN_GATEWAY_TO_PUBLIC_BRIDGE=True, assign the gateway IP of the public
-# subnet to the public bridge interface even if Q_USE_PROVIDERNET_FOR_PUBLIC is
-# used.
-Q_ASSIGN_GATEWAY_TO_PUBLIC_BRIDGE=${Q_ASSIGN_GATEWAY_TO_PUBLIC_BRIDGE:-True}
-
 # If Q_USE_PUBLIC_VETH=True, create and use a veth pair instead of
 # PUBLIC_BRIDGE.  This is intended to be used with
 # Q_USE_PROVIDERNET_FOR_PUBLIC=True.
@@ -56,7 +51,7 @@ Q_L3_ROUTER_PER_TENANT=${Q_L3_ROUTER_PER_TENANT:-True}
 #    Q_USE_PROVIDERNET_FOR_PUBLIC=True
 #    PUBLIC_PHYSICAL_NETWORK=public
 #    OVS_BRIDGE_MAPPINGS=public:br-ex
-Q_USE_PROVIDERNET_FOR_PUBLIC=${Q_USE_PROVIDERNET_FOR_PUBLIC:-True}
+Q_USE_PROVIDERNET_FOR_PUBLIC=${Q_USE_PROVIDERNET_FOR_PUBLIC:-False}
 PUBLIC_PHYSICAL_NETWORK=${PUBLIC_PHYSICAL_NETWORK:-public}
 
 # Generate 40-bit IPv6 Global ID to comply with RFC 4193
@@ -310,7 +305,7 @@ function _neutron_configure_router_v4 {
             local cidr_len=${FLOATING_RANGE#*/}
             local testcmd="ip -o link | grep -q $ext_gw_interface"
             test_with_retry "$testcmd" "$ext_gw_interface creation failed"
-            if [[ $(ip addr show dev $ext_gw_interface | grep -c $ext_gw_ip) == 0 && ( $Q_USE_PROVIDERNET_FOR_PUBLIC == "False" || $Q_USE_PUBLIC_VETH == "True" || $Q_ASSIGN_GATEWAY_TO_PUBLIC_BRIDGE == "True" ) ]]; then
+            if [[ $(ip addr show dev $ext_gw_interface | grep -c $ext_gw_ip) == 0 && ( $Q_USE_PROVIDERNET_FOR_PUBLIC == "False" || $Q_USE_PUBLIC_VETH == "True" ) ]]; then
                 sudo ip addr add $ext_gw_ip/$cidr_len dev $ext_gw_interface
                 sudo ip link set $ext_gw_interface up
             fi

From 7d89a798744c24ba82199fd42db995368a2e9322 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Sat, 23 Jul 2016 08:03:03 +0000
Subject: [PATCH 0531/2409] Updated from generate-devstack-plugins-list

Change-Id: I222ecc69427f1ddf4498f5af29664544efe43b46
---
 doc/source/plugin-registry.rst | 1 -
 1 file changed, 1 deletion(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 38910b0785..bdb8d8bc9c 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -69,7 +69,6 @@ ironic                                 `git://git.openstack.org/openstack/ironic
 ironic-inspector                       `git://git.openstack.org/openstack/ironic-inspector <https://git.openstack.org/cgit/openstack/ironic-inspector>`__
 ironic-staging-drivers                 `git://git.openstack.org/openstack/ironic-staging-drivers <https://git.openstack.org/cgit/openstack/ironic-staging-drivers>`__
 kingbird                               `git://git.openstack.org/openstack/kingbird <https://git.openstack.org/cgit/openstack/kingbird>`__
-kuryr                                  `git://git.openstack.org/openstack/kuryr <https://git.openstack.org/cgit/openstack/kuryr>`__
 kuryr-libnetwork                       `git://git.openstack.org/openstack/kuryr-libnetwork <https://git.openstack.org/cgit/openstack/kuryr-libnetwork>`__
 magnum                                 `git://git.openstack.org/openstack/magnum <https://git.openstack.org/cgit/openstack/magnum>`__
 magnum-ui                              `git://git.openstack.org/openstack/magnum-ui <https://git.openstack.org/cgit/openstack/magnum-ui>`__

From c07170abd7a382bda028c6ae14bfde5d912ab78f Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@midokura.com>
Date: Wed, 20 Jul 2016 19:44:05 +0900
Subject: [PATCH 0532/2409] lib/neutron: Create initial networks regardless of
 neutron-l3

Closes-Bug: #1604768
Change-Id: I699977930675512e9767a90f317fc0faa1ea9901
---
 lib/neutron | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 5cab8e1716..7bf31d0a85 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -425,16 +425,16 @@ function start_neutron_new {
     fi
     if is_service_enabled neutron-l3; then
         run_process neutron-l3 "$NEUTRON_BIN_DIR/$NEUTRON_L3_BINARY $NEUTRON_CONFIG_ARG"
-        # XXX(sc68cal) - Here's where plugins can wire up their own networks instead
-        # of the code in lib/neutron_plugins/services/l3
-        if type -p neutron_plugin_create_initial_networks > /dev/null; then
-            neutron_plugin_create_initial_networks
-        else
-            # XXX(sc68cal) Load up the built in Neutron networking code and build a topology
-            source $TOP_DIR/lib/neutron_plugins/services/l3
-            # Create the networks using servic
-            create_neutron_initial_network
-        fi
+    fi
+    # XXX(sc68cal) - Here's where plugins can wire up their own networks instead
+    # of the code in lib/neutron_plugins/services/l3
+    if type -p neutron_plugin_create_initial_networks > /dev/null; then
+        neutron_plugin_create_initial_networks
+    else
+        # XXX(sc68cal) Load up the built in Neutron networking code and build a topology
+        source $TOP_DIR/lib/neutron_plugins/services/l3
+        # Create the networks using servic
+        create_neutron_initial_network
     fi
     if is_service_enabled neutron-metadata-agent; then
         run_process neutron-metadata-agent "$NEUTRON_BIN_DIR/$NEUTRON_META_BINARY $NEUTRON_CONFIG_ARG"

From c6f857f49ca1459f0874e8dcc83be539829e6ee3 Mon Sep 17 00:00:00 2001
From: zhangyanxian <zhang.yanxian@zte.com.cn>
Date: Mon, 25 Jul 2016 08:44:28 +0000
Subject: [PATCH 0533/2409] Fix the typo in the file

Change-Id: I3a3976bdab6743f6d741d39708b01eacf6a01074
---
 tools/xen/install_os_domU.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/xen/install_os_domU.sh b/tools/xen/install_os_domU.sh
index 3a61215b5b..66b9eda474 100755
--- a/tools/xen/install_os_domU.sh
+++ b/tools/xen/install_os_domU.sh
@@ -247,7 +247,7 @@ else
 fi
 
 if [ -n "${EXIT_AFTER_JEOS_INSTALLATION:-}" ]; then
-    echo "User requested to quit after JEOS instalation"
+    echo "User requested to quit after JEOS installation"
     exit 0
 fi
 

From 88ccd47c88dc39b8d746afae89dea31d46558a68 Mon Sep 17 00:00:00 2001
From: Spyros Trigazis <strigazi@gmail.com>
Date: Sun, 24 Jul 2016 22:13:57 +0200
Subject: [PATCH 0534/2409] Keep old behavior of setuptools for editable
 installs

In the 25.0.0 release [1] of setuptools during any install
operation the package in not overwritten. If a package is
installed from another requirement via pip and then it is
installed again from git, it is not updated causing
check_libs_from_git to fail.

[1] https://setuptools.readthedocs.io/en/latest/history.html#v25-0-0

Change-Id: Ibaa1d4157816ea649f4452756fbde25951347001
Closes-Bug: #1605998
---
 inc/python | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/inc/python b/inc/python
index e013dfab36..9de2831537 100644
--- a/inc/python
+++ b/inc/python
@@ -148,11 +148,15 @@ function pip_install {
     fi
 
     $xtrace
+    # adding SETUPTOOLS_SYS_PATH_TECHNIQUE is a workaround to keep
+    # the same behaviour of setuptools before version 25.0.0.
+    # related issue: https://github.com/pypa/pip/issues/3874
     $sudo_pip \
         http_proxy="${http_proxy:-}" \
         https_proxy="${https_proxy:-}" \
         no_proxy="${no_proxy:-}" \
         PIP_FIND_LINKS=$PIP_FIND_LINKS \
+        SETUPTOOLS_SYS_PATH_TECHNIQUE=rewrite \
         $cmd_pip $upgrade \
         $@
     result=$?

From ba1a64d8eb7ce8611cf518df882845908c72bb0b Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Mon, 25 Jul 2016 11:32:42 -0400
Subject: [PATCH 0535/2409] lib/neutron: Add port_security ml2 extension driver

Tempest currently conducts tests for this extension driver by
default.

Change-Id: I5f9881d0713965b66358dc9cade8d623da98d75d
---
 lib/neutron | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/neutron b/lib/neutron
index ad68d8e62f..22584c6eb8 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -166,6 +166,7 @@ function configure_neutron_new {
         iniset $NEUTRON_PLUGIN_CONF ml2 type_drivers vxlan
         iniset $NEUTRON_PLUGIN_CONF ml2 mechanism_drivers openvswitch,linuxbridge
         iniset $NEUTRON_PLUGIN_CONF ml2_type_vxlan vni_ranges 1001:2000
+        iniset $NEUTRON_PLUGIN_CONF ml2 extension_drivers port_security
     fi
 
     # Neutron OVS or LB agent

From 8f0e97c1460f015f4eb03a8221b4b02b61559d9d Mon Sep 17 00:00:00 2001
From: WenyanZhang <zhang.wenyan3@zte.com.cn>
Date: Thu, 7 Jul 2016 18:57:32 +0800
Subject: [PATCH 0536/2409] Remove all *.pyc files in $DEST when executing
 clean.sh

Currentlly, the *.pyc files could not be removed in any scripts or
functions. But the redundant files would lead stack.sh not to find the
correct script for some versions after branch switched from master to
stable/mitaka in migration_helpers.sync_database_to_version.

So this commit adds the process of cleaning all the *.pyc files in
clean.sh.

It is needed to execute clean.sh before re-stack.sh to prevent the
exception.

Change-Id: I9ba0674d6b20b13c0a26b22cd5d1939daa121a94
Closes-Bug: #1599124
---
 clean.sh | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/clean.sh b/clean.sh
index 0641bffcf8..e0ec9f5315 100755
--- a/clean.sh
+++ b/clean.sh
@@ -145,3 +145,8 @@ for file in $FILES_TO_CLEAN; do
 done
 
 rm -rf ~/.config/openstack
+
+# Clean up all *.pyc files
+if [[ -n "$DEST" ]] && [[ -d "$DEST" ]]; then
+    sudo find $DEST -name "*.pyc" -print0 | xargs -0 rm
+fi

From c694e55ad9707426c05a2139edee037104b009f4 Mon Sep 17 00:00:00 2001
From: Bob Ball <bob.ball@citrix.com>
Date: Mon, 1 Aug 2016 12:52:44 +0100
Subject: [PATCH 0537/2409] XenAPI: Don't assume specific network interfaces

The default for GUEST_INTERFACE_DEFAULT now uses the ip command
to find an interface; so it will work on multiple distributions.

XenAPI should not be setting a specific interface here, as it will
almost always be wrong.  In most cases, the calculated value for
GUEST_INTERFACE_DEFAULT will be a better default.

PUBLIC_INTERFACE_DEFAULT makes even less sense as it's often an
internal bridge for devstack scenarios.

In both cases, the right way to override these is to set
GUEST_INTERFACE / PUBLIC_INTERFACE in the localrc rather than
changing the _DEFAULT values.

Change-Id: I0cf84438d778bf1a2481328165513c59167490e2
---
 lib/nova_plugins/hypervisor-xenserver | 2 --
 1 file changed, 2 deletions(-)

diff --git a/lib/nova_plugins/hypervisor-xenserver b/lib/nova_plugins/hypervisor-xenserver
index e7f1e87b61..e75226ae64 100644
--- a/lib/nova_plugins/hypervisor-xenserver
+++ b/lib/nova_plugins/hypervisor-xenserver
@@ -24,8 +24,6 @@ set +o xtrace
 # Defaults
 # --------
 
-PUBLIC_INTERFACE_DEFAULT=eth2
-GUEST_INTERFACE_DEFAULT=eth1
 # Allow ``build_domU.sh`` to specify the flat network bridge via kernel args
 FLAT_NETWORK_BRIDGE_DEFAULT=$(sed -e 's/.* flat_network_bridge=\([[:alnum:]]*\).*$/\1/g' /proc/cmdline)
 if is_service_enabled neutron; then

From e56318f9bc87b0ed0e1ce6fcd1216aebe3689fe8 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 1 Aug 2016 10:29:03 -0400
Subject: [PATCH 0538/2409] Remove manual setting of privsep helper

The privsep helper should have a sane default for all libraries,
pushing this into devstack means we cheat past a part of the upgrade
that we really shouldn't be.

Change-Id: I52259e2023e277e8fd62be5df4fd7f799e9b36d7
---
 lib/cinder | 2 --
 lib/nova   | 5 -----
 2 files changed, 7 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 69ff4c4e36..a87f395c8e 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -273,8 +273,6 @@ function configure_cinder {
 
     iniset $CINDER_CONF DEFAULT os_region_name "$REGION_NAME"
 
-    iniset $CINDER_CONF privsep_osbrick helper_command "sudo cinder-rootwrap \$rootwrap_config privsep-helper --config-file $CINDER_CONF"
-
     if is_service_enabled c-vol && [[ -n "$CINDER_ENABLED_BACKENDS" ]]; then
         local enabled_backends=""
         local default_name=""
diff --git a/lib/nova b/lib/nova
index 67a80b9b16..16f6e9b39f 100644
--- a/lib/nova
+++ b/lib/nova
@@ -481,11 +481,6 @@ function create_nova_conf {
         iniset $NOVA_CONF DEFAULT bindir "/usr/bin"
     fi
 
-    iniset $NOVA_CONF privsep_osbrick helper_command "sudo nova-rootwrap \$rootwrap_config privsep-helper --config-file $NOVA_CONF"
-
-    iniset $NOVA_CONF vif_plug_ovs_privileged helper_command "sudo nova-rootwrap \$rootwrap_config privsep-helper --config-file $NOVA_CONF"
-    iniset $NOVA_CONF vif_plug_linux_bridge_privileged helper_command "sudo nova-rootwrap \$rootwrap_config privsep-helper --config-file $NOVA_CONF"
-
     if is_service_enabled n-api; then
         if is_service_enabled n-api-meta; then
             # If running n-api-meta as a separate service

From 9124a84a968d00582bd8bada154db22b9544bfd0 Mon Sep 17 00:00:00 2001
From: Cao Xuan Hoang <hoangcx@vn.fujitsu.com>
Date: Mon, 1 Aug 2016 14:56:02 +0700
Subject: [PATCH 0539/2409] q-l3 failed to start in case q-fwaas enabled

In case q-fwaas is enabled. It will causes the q-l3 failed to start
because the DevStack gave a redundant --config-file option to start q-l3

This is a follow-up patch of 84409516d56417464dfe0c4e6904a1a76f9fa254
to remove fwaas from DevStack completely.

Change-Id: I630969b3556bcffba506cab02a09cc83f4430c88
Closes-Bug: #1608401
---
 lib/neutron-legacy | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 5d91cdabca..44db16a435 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -292,9 +292,6 @@ function _determine_config_server {
 
 function _determine_config_l3 {
     local opts="--config-file $NEUTRON_CONF --config-file $Q_L3_CONF_FILE"
-    if is_service_enabled q-fwaas; then
-        opts+=" --config-file $Q_FWAAS_CONF_FILE"
-    fi
     echo "$opts"
 }
 

From 75a6454097071523a8617fcbea0f650d42c03341 Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Mon, 1 Aug 2016 14:41:10 -0400
Subject: [PATCH 0540/2409] neutron: Wait until ovs-vswitchd creates the bridge

Seeing a race condition where lib/neutron code tries to
set the MTU on br-ex before it exists.

Thanks to some good grepping by sdague, it appears that the difference
between lib/neutron and lib/neutron-legacy is that the initial bridge
being created is br-int while in lib/neutron the initial bridge
created is br-ex, which means there must be some kind of warm-up that
occurs between the first bridge that is created by ovs-vswitchd and the
second, and the second one created is much faster.

So instead, let's just wait for the bridge to be created successfully.

Change-Id: I271dc8b6ae5487c80d2a22153b3fc45fb247707f
---
 lib/neutron_plugins/ovs_base | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/ovs_base b/lib/neutron_plugins/ovs_base
index 9e1421f5e6..f6d10ea4f9 100644
--- a/lib/neutron_plugins/ovs_base
+++ b/lib/neutron_plugins/ovs_base
@@ -19,7 +19,7 @@ function is_neutron_ovs_base_plugin {
 
 function _neutron_ovs_base_add_bridge {
     local bridge=$1
-    local addbr_cmd="sudo ovs-vsctl --no-wait -- --may-exist add-br $bridge"
+    local addbr_cmd="sudo ovs-vsctl -- --may-exist add-br $bridge"
 
     if [ "$OVS_DATAPATH_TYPE" != "system" ] ; then
         addbr_cmd="$addbr_cmd -- set Bridge $bridge datapath_type=${OVS_DATAPATH_TYPE}"

From 5631ca5e126ec2d4c6802d09e312fcb8c1ab4952 Mon Sep 17 00:00:00 2001
From: Rob Crittenden <rcritten@redhat.com>
Date: Tue, 2 Aug 2016 13:19:14 -0400
Subject: [PATCH 0541/2409] Clean up Horizon Apache configuration files in
 clean.sh

The horizon cleanup function wasn't being called at all during
cleanup which left the Apache configuration.

Change-Id: Iff5336d0c5e79cfc82f1c648afaabb869d86020e
---
 clean.sh    | 1 +
 lib/horizon | 5 ++---
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/clean.sh b/clean.sh
index 0641bffcf8..452df02d80 100755
--- a/clean.sh
+++ b/clean.sh
@@ -95,6 +95,7 @@ cleanup_keystone
 cleanup_nova
 cleanup_neutron
 cleanup_swift
+cleanup_horizon
 
 if is_service_enabled ldap; then
     cleanup_ldap
diff --git a/lib/horizon b/lib/horizon
index 0517e32197..78cbe8b58d 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -69,9 +69,8 @@ function _horizon_config_set {
 # cleanup_horizon() - Remove residual data files, anything left over from previous
 # runs that a clean run would need to clean up
 function cleanup_horizon {
-    local horizon_conf
-    horizon_conf=$(apache_site_config_for horizon)
-    sudo rm -f $horizon_conf
+    disable_apache_site horizon
+    sudo rm -f $(apache_site_config_for horizon)
 }
 
 # configure_horizon() - Set config files, create data dirs, etc

From 0a099763b022ce476f921c8a4bc2ea20ce5f67b4 Mon Sep 17 00:00:00 2001
From: "Lubosz \"diltram\" Kosnik" <diltram@gmail.com>
Date: Wed, 3 Aug 2016 10:21:41 -0500
Subject: [PATCH 0542/2409] Change python version to 3.5

On Ubuntu Xenial there is no way to install python3.4
Use value specified in PYTHON3_VERSION

Change-Id: Ibc69b1c8270bdd240c82cf2acfdfd0730ef0f182
---
 inc/python | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/inc/python b/inc/python
index 9de2831537..e4cfab803c 100644
--- a/inc/python
+++ b/inc/python
@@ -370,7 +370,7 @@ function python3_enabled {
 # Install python3 packages
 function install_python3 {
     if is_ubuntu; then
-        apt_get install python3.4 python3.4-dev
+        apt_get install python${PYTHON3_VERSION} python${PYTHON3_VERSION}-dev
     fi
 }
 

From b8286a3a06c48c10b9efc50c4f0487eba8cdf706 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 3 Aug 2016 08:09:54 -0400
Subject: [PATCH 0543/2409] remove neutron 3rd party infrastructure

This was used solely by bigswitch, and everyone else has moved over to
devstack plugins. Cleaning this out makes the core logic much simpler.

Depends-On: I8fd2ec6e651f858d0ce109fc335189796c3264b8
(grenade removal)

Change-Id: I47769fc7faae22d263ffd923165abd48f0791a2c
---
 lib/neutron-legacy                          | 49 -------------------
 lib/neutron_thirdparty/README.md            | 41 ----------------
 lib/neutron_thirdparty/bigswitch_floodlight | 54 ---------------------
 lib/neutron_thirdparty/vmware_nsx           |  4 --
 stack.sh                                    | 12 -----
 unstack.sh                                  |  1 -
 6 files changed, 161 deletions(-)
 delete mode 100644 lib/neutron_thirdparty/README.md
 delete mode 100644 lib/neutron_thirdparty/bigswitch_floodlight
 delete mode 100644 lib/neutron_thirdparty/vmware_nsx

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 5d91cdabca..cda919363a 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -1003,55 +1003,6 @@ function _ssh_check_neutron {
     test_with_retry "$testcmd" "server $ip didn't become ssh-able" $timeout_sec
 }
 
-# Neutron 3rd party programs
-#---------------------------
-
-# please refer to ``lib/neutron_thirdparty/README.md`` for details
-NEUTRON_THIRD_PARTIES=""
-for f in $TOP_DIR/lib/neutron_thirdparty/*; do
-    third_party=$(basename $f)
-    if is_service_enabled $third_party; then
-        source $TOP_DIR/lib/neutron_thirdparty/$third_party
-        NEUTRON_THIRD_PARTIES="$NEUTRON_THIRD_PARTIES,$third_party"
-    fi
-done
-
-function _neutron_third_party_do {
-    for third_party in ${NEUTRON_THIRD_PARTIES//,/ }; do
-        ${1}_${third_party}
-    done
-}
-
-# configure_neutron_third_party() - Set config files, create data dirs, etc
-function configure_neutron_third_party {
-    _neutron_third_party_do configure
-}
-
-# init_neutron_third_party() - Initialize databases, etc.
-function init_neutron_third_party {
-    _neutron_third_party_do init
-}
-
-# install_neutron_third_party() - Collect source and prepare
-function install_neutron_third_party {
-    _neutron_third_party_do install
-}
-
-# start_neutron_third_party() - Start running processes, including screen
-function start_neutron_third_party {
-    _neutron_third_party_do start
-}
-
-# stop_neutron_third_party - Stop running processes (non-screen)
-function stop_neutron_third_party {
-    _neutron_third_party_do stop
-}
-
-# check_neutron_third_party_integration() - Check that third party integration is sane
-function check_neutron_third_party_integration {
-    _neutron_third_party_do check
-}
-
 # Restore xtrace
 $_XTRACE_NEUTRON
 
diff --git a/lib/neutron_thirdparty/README.md b/lib/neutron_thirdparty/README.md
deleted file mode 100644
index 905ae776a8..0000000000
--- a/lib/neutron_thirdparty/README.md
+++ /dev/null
@@ -1,41 +0,0 @@
-Neutron third party specific files
-==================================
-Some Neutron plugins require third party programs to function.
-The files under the directory, ``lib/neutron_thirdparty/``, will be used
-when their service are enabled.
-Third party program specific configuration variables should be in this file.
-
-* filename: ``<third_party>``
-  * The corresponding file name should be same to service name, ``<third_party>``.
-
-functions
----------
-``lib/neutron-legacy`` calls the following functions when the ``<third_party>`` is enabled
-
-functions to be implemented
-* ``configure_<third_party>``:
-  set config files, create data dirs, etc
-  e.g.
-  sudo python setup.py deploy
-  iniset $XXXX_CONF...
-
-* ``init_<third_party>``:
-  initialize databases, etc
-
-* ``install_<third_party>``:
-  collect source and prepare
-  e.g.
-  git clone xxx
-
-* ``start_<third_party>``:
-  start running processes, including screen if USE_SCREEN=True
-  e.g.
-  run_process XXXX "$XXXX_DIR/bin/XXXX-bin"
-
-* ``stop_<third_party>``:
-  stop running processes (non-screen)
-  e.g.
-  stop_process XXXX
-
-* ``check_<third_party>``:
-  verify that the integration between neutron server and third-party components is sane
diff --git a/lib/neutron_thirdparty/bigswitch_floodlight b/lib/neutron_thirdparty/bigswitch_floodlight
deleted file mode 100644
index 45a4f2e263..0000000000
--- a/lib/neutron_thirdparty/bigswitch_floodlight
+++ /dev/null
@@ -1,54 +0,0 @@
-#!/bin/bash
-#
-# Big Switch/FloodLight  OpenFlow Controller
-# ------------------------------------------
-
-# Save trace setting
-_XTRACE_NEUTRON_BIGSWITCH=$(set +o | grep xtrace)
-set +o xtrace
-
-BS_FL_CONTROLLERS_PORT=${BS_FL_CONTROLLERS_PORT:-localhost:80}
-BS_FL_OF_PORT=${BS_FL_OF_PORT:-6633}
-
-function configure_bigswitch_floodlight {
-    :
-}
-
-function init_bigswitch_floodlight {
-    install_neutron_agent_packages
-
-    echo -n "Installing OVS managed by the openflow controllers:"
-    echo ${BS_FL_CONTROLLERS_PORT}
-
-    # Create local OVS bridge and configure it
-    sudo ovs-vsctl --no-wait -- --if-exists del-br ${OVS_BRIDGE}
-    sudo ovs-vsctl --no-wait add-br ${OVS_BRIDGE}
-    sudo ovs-vsctl --no-wait br-set-external-id ${OVS_BRIDGE} bridge-id ${OVS_BRIDGE}
-
-    ctrls=
-    for ctrl in `echo ${BS_FL_CONTROLLERS_PORT} | tr ',' ' '`; do
-        ctrl=${ctrl%:*}
-        ctrls="${ctrls} tcp:${ctrl}:${BS_FL_OF_PORT}"
-    done
-    echo "Adding Network conttrollers: " ${ctrls}
-    sudo ovs-vsctl --no-wait set-controller ${OVS_BRIDGE} ${ctrls}
-}
-
-function install_bigswitch_floodlight {
-    :
-}
-
-function start_bigswitch_floodlight {
-    :
-}
-
-function stop_bigswitch_floodlight {
-    :
-}
-
-function check_bigswitch_floodlight {
-    :
-}
-
-# Restore xtrace
-$_XTRACE_NEUTRON_BIGSWITCH
diff --git a/lib/neutron_thirdparty/vmware_nsx b/lib/neutron_thirdparty/vmware_nsx
deleted file mode 100644
index e182fca1ae..0000000000
--- a/lib/neutron_thirdparty/vmware_nsx
+++ /dev/null
@@ -1,4 +0,0 @@
-#!/bin/bash
-
-# REVISIT(roeyc): this file left empty so that 'enable_service vmware_nsx'
-# continues to work.
diff --git a/stack.sh b/stack.sh
index 4cace9d0c2..823b63ba24 100755
--- a/stack.sh
+++ b/stack.sh
@@ -843,7 +843,6 @@ fi
 if is_service_enabled neutron; then
     # Network service
     stack_install_service neutron
-    install_neutron_third_party
 fi
 
 if is_service_enabled nova; then
@@ -1093,15 +1092,6 @@ if is_service_enabled neutron; then
     fi
 fi
 
-# Some Neutron plugins require network controllers which are not
-# a part of the OpenStack project. Configure and start them.
-if is_service_enabled neutron; then
-    configure_neutron_third_party
-    init_neutron_third_party
-    start_neutron_third_party
-fi
-
-
 # Nova
 # ----
 
@@ -1235,11 +1225,9 @@ fi
 if is_service_enabled neutron-api; then
     echo_summary "Starting Neutron"
     start_neutron_api
-    # check_neutron_third_party_integration
 elif is_service_enabled q-svc; then
     echo_summary "Starting Neutron"
     start_neutron_service_and_check
-    check_neutron_third_party_integration
 elif is_service_enabled $DATABASE_BACKENDS && is_service_enabled n-net; then
     NM_CONF=${NOVA_CONF}
     if is_service_enabled n-cell; then
diff --git a/unstack.sh b/unstack.sh
index a69b2187ce..ece69acad8 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -168,7 +168,6 @@ fi
 
 if is_service_enabled neutron; then
     stop_neutron
-    stop_neutron_third_party
     cleanup_neutron
 fi
 

From 9162608d6e1d13a64dd387486faa221c694ba913 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Thu, 4 Aug 2016 15:17:38 +1000
Subject: [PATCH 0544/2409] Revert "stackrc set the LC_ALL to C"

This reverts commit f327b1e1196eacf25e7c4c9e3a7ad30c53bb961c.

The problem being addressed in the original commit was that
rejoin-stack.sh would run with the user's locale, instead of C that
was set in stack.sh

We overlooked that this gets pulled in by openrc, so it is overriding
the user's locale when using clients, etc.

rejoin-stack.sh was removed in
I2f61bb69cc110468a91dcaa4ee7653ede7048467 so we don't have to worry
about that part.  A revert to not touch the user's locale seems
appropriate.

Change-Id: I7c858bb92ce7ba5b5d323bf3ad6776100026c7a2
Closes-Bug: #1608687
---
 stack.sh | 7 +++++++
 stackrc  | 7 -------
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/stack.sh b/stack.sh
index 4cace9d0c2..4805c69418 100755
--- a/stack.sh
+++ b/stack.sh
@@ -27,6 +27,13 @@ set -o xtrace
 # Make sure custom grep options don't get in the way
 unset GREP_OPTIONS
 
+# Sanitize language settings to avoid commands bailing out
+# with "unsupported locale setting" errors.
+unset LANG
+unset LANGUAGE
+LC_ALL=C
+export LC_ALL
+
 # Make sure umask is sane
 umask 022
 
diff --git a/stackrc b/stackrc
index acb7d3f650..7e565e734d 100644
--- a/stackrc
+++ b/stackrc
@@ -7,13 +7,6 @@
 [[ -z "$_DEVSTACK_STACKRC" ]] || return 0
 declare -r _DEVSTACK_STACKRC=1
 
-# Sanitize language settings to avoid commands bailing out
-# with "unsupported locale setting" errors.
-unset LANG
-unset LANGUAGE
-LC_ALL=C
-export LC_ALL
-
 # Find the other rc files
 RC_DIR=$(cd $(dirname "${BASH_SOURCE:-$0}") && pwd)
 

From 6a008fa74bce0497b7902dd95300599a3026e2dd Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 3 Aug 2016 15:09:01 -0400
Subject: [PATCH 0545/2409] Change to neutron by default.

nova-net is deprecated, and it's long time to switch to neutron by
default. This patch does that, and has an auto configuration mode that
mostly just works for the basic case.

It does this by assuming that unless the user specifies an interface
for it to manage, that it will not automatically have access to a
physical interface. The floating range is put on br-ex (per normal),
fixed ranges stay on their OVS interfaces.

Because there is no dedicated interface managed by neutron, we add an
iptables rule which allows guests to route out. While somewhat
synthetic, it does provide a working out of the box developer
experience, and is not hugely more synthetic then all the other
interface / route setup we have to do for the system.

You should be able to run this with a local.conf of just

[[local|localrc]]
ADMIN_PASSWORD=pass
DATABASE_PASSWORD=pass
RABBIT_PASSWORD=pass
SERVICE_PASSWORD=pass

And get a working neutron on a single interface box

Documentation will come in subsequent patches, however getting the
code out there and getting feedback is going to help shape this
direction.

Change-Id: I185325a684372e8a2ff25eae974a9a2a2d6277e0
---
 lib/neutron_plugins/services/l3 | 18 ++++++++++++++----
 lib/nova                        |  5 +++--
 stackrc                         |  6 +++++-
 3 files changed, 22 insertions(+), 7 deletions(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 2180099ee4..61b8402818 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -102,10 +102,20 @@ function _configure_neutron_l3_agent {
 
     neutron_plugin_configure_l3_agent $Q_L3_CONF_FILE
 
-    _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" True False "inet"
-
-    if [[ $(ip -f inet6 a s dev "$PUBLIC_INTERFACE" | grep -c 'global') != 0 ]]; then
-        _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" False False "inet6"
+    # If we've given a PUBLIC_INTERFACE to take over, then we assume
+    # that we can own the whole thing, and privot it into the OVS
+    # bridge. If we are not, we're probably on a single interface
+    # machine, and we just setup NAT so that fixed guests can get out.
+    if [[ -n "$PUBLIC_INTERFACE" ]]; then
+        _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" True False "inet"
+
+        if [[ $(ip -f inet6 a s dev "$PUBLIC_INTERFACE" | grep -c 'global') != 0 ]]; then
+            _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" False False "inet6"
+        fi
+    else
+        local default_dev=""
+        default_dev=$(ip route | grep ^default | awk '{print $5}')
+        sudo iptables -t nat -A POSTROUTING -o $default_dev -s $FLOATING_RANGE -j MASQUERADE
     fi
 }
 
diff --git a/lib/nova b/lib/nova
index 16f6e9b39f..1369c409fc 100644
--- a/lib/nova
+++ b/lib/nova
@@ -128,7 +128,7 @@ fi
 # --------------------------
 
 NETWORK_MANAGER=${NETWORK_MANAGER:-${NET_MAN:-FlatDHCPManager}}
-PUBLIC_INTERFACE=${PUBLIC_INTERFACE:-$PUBLIC_INTERFACE_DEFAULT}
+
 VLAN_INTERFACE=${VLAN_INTERFACE:-$GUEST_INTERFACE_DEFAULT}
 FLAT_NETWORK_BRIDGE=${FLAT_NETWORK_BRIDGE:-$FLAT_NETWORK_BRIDGE_DEFAULT}
 
@@ -659,8 +659,9 @@ function create_nova_cache_dir {
 }
 
 function create_nova_conf_nova_network {
+    local public_interface=${PUBLIC_INTERFACE:-$PUBLIC_INTERFACE_DEFAULT}
     iniset $NOVA_CONF DEFAULT network_manager "nova.network.manager.$NETWORK_MANAGER"
-    iniset $NOVA_CONF DEFAULT public_interface "$PUBLIC_INTERFACE"
+    iniset $NOVA_CONF DEFAULT public_interface "$public_interface"
     iniset $NOVA_CONF DEFAULT vlan_interface "$VLAN_INTERFACE"
     iniset $NOVA_CONF DEFAULT flat_network_bridge "$FLAT_NETWORK_BRIDGE"
     if [ -n "$FLAT_INTERFACE" ]; then
diff --git a/stackrc b/stackrc
index acb7d3f650..f42bd944fa 100644
--- a/stackrc
+++ b/stackrc
@@ -70,11 +70,13 @@ if ! isset ENABLED_SERVICES ; then
     # Keystone - nothing works without keystone
     ENABLED_SERVICES=key
     # Nova - services to support libvirt based openstack clouds
-    ENABLED_SERVICES+=,n-api,n-cpu,n-net,n-cond,n-sch,n-novnc,n-cauth
+    ENABLED_SERVICES+=,n-api,n-cpu,n-cond,n-sch,n-novnc,n-cauth
     # Glance services needed for Nova
     ENABLED_SERVICES+=,g-api,g-reg
     # Cinder
     ENABLED_SERVICES+=,c-sch,c-api,c-vol
+    # Neutron
+    ENABLED_SERVICES+=,q-svc,q-dhcp,q-meta,q-agt,q-l3
     # Dashboard
     ENABLED_SERVICES+=,horizon
     # Additional services
@@ -710,6 +712,8 @@ S3_SERVICE_PORT=${S3_SERVICE_PORT:-3333}
 PRIVATE_NETWORK_NAME=${PRIVATE_NETWORK_NAME:-"private"}
 PUBLIC_NETWORK_NAME=${PUBLIC_NETWORK_NAME:-"public"}
 
+PUBLIC_INTERFACE=""
+
 # Set default screen name
 SCREEN_NAME=${SCREEN_NAME:-stack}
 

From 78801c10f023eba12910e92c16a49e2ba7bb1e2f Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 4 Aug 2016 14:10:07 -0400
Subject: [PATCH 0546/2409] enable dns resolution from guests in neutron

When running a default devstack environment, having guests that
actually can resolve DNS, so that they can do package updates from
well known hosts. This addresses a gap between nova-net and neutron
behavior in devstack.

Change-Id: I42fdc2716affd933e9158f1ef7ecb20bc664ef21
---
 lib/neutron        | 3 +++
 lib/neutron-legacy | 2 ++
 2 files changed, 5 insertions(+)

diff --git a/lib/neutron b/lib/neutron
index 5cab8e1716..b91e880d64 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -188,6 +188,9 @@ function configure_neutron_new {
         cp $NEUTRON_DIR/etc/dhcp_agent.ini.sample $NEUTRON_DHCP_CONF
 
         iniset $NEUTRON_DHCP_CONF DEFAULT debug True
+        # make it so we have working DNS from guests
+        iniset $NEUTRON_DHCP_CONF DEFAULT dnsmasq_local_resolv True
+
         iniset $NEUTRON_DHCP_CONF agent root_helper_daemon "$NEUTRON_ROOTWRAP_DAEMON_CMD"
         iniset $NEUTRON_DHCP_CONF DEFAULT interface_driver $NEUTRON_AGENT
         neutron_plugin_configure_dhcp_agent $NEUTRON_DHCP_CONF
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 44db16a435..2d85787252 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -779,6 +779,8 @@ function _configure_neutron_dhcp_agent {
     cp $NEUTRON_DIR/etc/dhcp_agent.ini.sample $Q_DHCP_CONF_FILE
 
     iniset $Q_DHCP_CONF_FILE DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
+    # make it so we have working DNS from guests
+    iniset $Q_DHCP_CONF_FILE DEFAULT dnsmasq_local_resolv True
     iniset $Q_DHCP_CONF_FILE AGENT root_helper "$Q_RR_COMMAND"
     if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
         iniset $Q_DHCP_CONF_FILE AGENT root_helper_daemon "$Q_RR_DAEMON_COMMAND"

From 3ac1ea85b16cfd5c0d88d3575fc5453cc5dea7c2 Mon Sep 17 00:00:00 2001
From: bkopilov <bkopilov@redhat.com>
Date: Mon, 6 Jun 2016 16:00:48 +0300
Subject: [PATCH 0547/2409] Add a multibackend list to tempest.conf

A change was made to tempest.conf for volume multibackend. Previously,
tempest used the following, with a limit of 2 backends:
 backend1_name = BACKEND1
 backend2_name = BACKEND2
That was changed to accomodate >2 backends. tempest.conf now uses a comma
separated list:
 backend_names=BACKEND1,BACKEND2,BACKEND3

devstack/lib/cinder uses a comma separated list with "type:backend_name":
 enabled_backends = lvm:BACKEND1,ceph:BACKEND2
This is in order to use scripts in devstack/lib/cinder_backends to setup
devstack basked on "type".

This patch allows parsing of the CINDER_ENABLED_BACKENDS to pass the proper
backend_name to tempest.

Change-Id: I76973c3fad4998a0f9e534fc9f6a271c1923f7b3
---
 lib/tempest | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index aa09e9a39f..501480c7d9 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -462,15 +462,26 @@ function configure_tempest {
     fi
 
     # Using ``CINDER_ENABLED_BACKENDS``
+    # Cinder uses a comma separated list with "type:backend_name":
+    #  CINDER_ENABLED_BACKENDS = ceph:cephBE1,lvm:lvmBE2,foo:my_foo
     if [[ -n "$CINDER_ENABLED_BACKENDS" ]] && [[ $CINDER_ENABLED_BACKENDS =~ .*,.* ]]; then
+        # We have at least 2 backends
         iniset $TEMPEST_CONFIG volume-feature-enabled multi_backend "True"
-        local i=1
+        local add_comma_seperator=0
+        local backends_list=''
         local be
+        # Tempest uses a comma separated list of backend_names:
+        #   backend_names = BACKEND_1,BACKEND_2
         for be in ${CINDER_ENABLED_BACKENDS//,/ }; do
-            local be_name=${be##*:}
-            iniset $TEMPEST_CONFIG volume "backend${i}_name" "$be_name"
-            i=$(( i + 1 ))
+            if [ "$add_comma_seperator" -eq "1" ]; then
+                backends_list+=,${be##*:}
+            else
+            # first element in the list
+                backends_list+=${be##*:}
+                add_comma_seperator=1
+            fi
         done
+        iniset $TEMPEST_CONFIG volume "backend_names" "$backends_list"
     fi
 
     if [ $TEMPEST_VOLUME_DRIVER != "default" -o \

From 04d51e4943fff897b7f81799d267e75897fbe672 Mon Sep 17 00:00:00 2001
From: Vasyl Saienko <vsaienko@mirantis.com>
Date: Fri, 5 Aug 2016 13:48:23 +0300
Subject: [PATCH 0548/2409] Fix doc formating issue

Change-Id: I9aa8c1fd114e4f4329e06ac263f337ea566d8355
---
 doc/source/plugins.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/plugins.rst b/doc/source/plugins.rst
index 70469d6876..31987bc62b 100644
--- a/doc/source/plugins.rst
+++ b/doc/source/plugins.rst
@@ -99,7 +99,7 @@ The current full list of ``mode`` and ``phase`` are:
       should exist at this point.
    -  **extra** - Called near the end after layer 1 and 2 services have
       been started.
-   - **test-config** Called at the end of devstack used to configure tempest
+   - **test-config** - Called at the end of devstack used to configure tempest
       or any other test environments
 
 -  **unstack** - Called by ``unstack.sh`` before other services are shut

From cea7ec8d4bd9f93568eb2e9e05c306535f0ec292 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Fri, 5 Aug 2016 08:29:54 -0400
Subject: [PATCH 0549/2409] update front page of devstack docs

The devstack docs have gotten a bit meandering so even the quick start
guide doesn't get you to a working setup without referencing other
pages. This attempts to pull this back in a bit.

Change-Id: I608331cbdae9cbe4f3e8bd3814415af0390a54d0
---
 doc/source/guides.rst   |  68 +++++++++++++
 doc/source/index.rst    | 206 +++++++++++++++++-----------------------
 doc/source/site-map.rst |  21 ++++
 3 files changed, 176 insertions(+), 119 deletions(-)
 create mode 100644 doc/source/guides.rst
 create mode 100644 doc/source/site-map.rst

diff --git a/doc/source/guides.rst b/doc/source/guides.rst
new file mode 100644
index 0000000000..c2c7b9163a
--- /dev/null
+++ b/doc/source/guides.rst
@@ -0,0 +1,68 @@
+Guides
+======
+
+.. warning::
+
+   The guides are point in time contributions, and may not always be
+   up to date with the latest work in devstack.
+
+Walk through various setups used by stackers
+
+.. toctree::
+   :glob:
+   :maxdepth: 1
+
+   guides/single-vm
+   guides/single-machine
+   guides/lxc
+   guides/multinode-lab
+   guides/neutron
+   guides/devstack-with-nested-kvm
+   guides/nova
+   guides/devstack-with-lbaas-v2
+
+All-In-One Single VM
+--------------------
+
+Run :doc:`OpenStack in a VM <guides/single-vm>`. The VMs launched in your cloud will be slow as
+they are running in QEMU (emulation), but it is useful if you don't have
+spare hardware laying around. :doc:`[Read] <guides/single-vm>`
+
+All-In-One Single Machine
+-------------------------
+
+Run :doc:`OpenStack on dedicated hardware <guides/single-machine>`  This can include a
+server-class machine or a laptop at home.
+:doc:`[Read] <guides/single-machine>`
+
+All-In-One LXC Container
+-------------------------
+
+Run :doc:`OpenStack in a LXC container <guides/lxc>`. Beneficial for intermediate
+and advanced users. The VMs launched in this cloud will be fully accelerated but
+not all OpenStack features are supported. :doc:`[Read] <guides/lxc>`
+
+Multi-Node Lab
+--------------
+
+Setup a :doc:`multi-node cluster <guides/multinode-lab>` with dedicated VLANs for VMs & Management.
+:doc:`[Read] <guides/multinode-lab>`
+
+DevStack with Neutron Networking
+--------------------------------
+
+Building a DevStack cluster with :doc:`Neutron Networking <guides/neutron>`.
+This guide is meant for building lab environments with a dedicated
+control node and multiple compute nodes.
+
+DevStack with KVM-based Nested Virtualization
+---------------------------------------------
+
+Procedure to setup :doc:`DevStack with KVM-based Nested Virtualization
+<guides/devstack-with-nested-kvm>`. With this setup, Nova instances
+will be more performant than with plain QEMU emulation.
+
+Nova and devstack
+--------------------------------
+
+Guide to working with nova features :doc:`Nova and devstack <guides/nova>`.
diff --git a/doc/source/index.rst b/doc/source/index.rst
index 68ec174f3a..c1302eb930 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -1,163 +1,131 @@
-DevStack
-========
+.. Documentation Architecture for the devstack docs.
+
+   It is really easy for online docs to meander over time as people
+   attempt to add the small bit of additional information they think
+   people need, into an existing information architecture. In order to
+   prevent that we need to be a bit strict as to what's on this front
+   page.
+
+   This should *only* be the quick start narrative. Which should end
+   with 2 sections: what you can do with devstack once it's set up,
+   and how to go beyond this setup. Both should be a set of quick
+   links to other documents to let people explore from there.
+
+==========
+ DevStack
+==========
 
 .. image:: assets/images/logo-blue.png
 
 DevStack is a series of extensible scripts used to quickly bring up a
-complete OpenStack environment.  It is used interactively as a
-development environment and as the basis for much of the OpenStack
-project's functional testing.
+complete OpenStack environment based on the latest versions of
+everything from git master.  It is used interactively as a development
+environment and as the basis for much of the OpenStack project's
+functional testing.
 
 The source is available at
 `<https://git.openstack.org/cgit/openstack-dev/devstack>`__.
 
-.. toctree::
-   :glob:
-   :maxdepth: 1
+.. warning::
 
-   overview
-   configuration
-   plugins
-   plugin-registry
-   faq
-   hacking
+   DevStack will make substantial changes to your system during
+   installation. Only run DevStack on servers or virtual machines that
+   are dedicated to this purpose.
 
 Quick Start
------------
-
-#. Select a Linux Distribution
-
-   Only Ubuntu 14.04 (Trusty), Fedora 22 (or Fedora 23) and CentOS/RHEL
-   7 are documented here. OpenStack also runs and is packaged on other
-   flavors of Linux such as OpenSUSE and Debian.
-
-#. Install Selected OS
-
-   In order to correctly install all the dependencies, we assume a
-   specific minimal version of the supported distributions to make it as
-   easy as possible. We recommend using a minimal install of Ubuntu or
-   Fedora server in a VM if this is your first time.
-
-#. Download DevStack
-
-   ::
-
-       git clone https://git.openstack.org/openstack-dev/devstack
-
-   The ``devstack`` repo contains a script that installs OpenStack and
-   templates for configuration files
-
-#. Configure
+===========
 
-   We recommend at least a :ref:`minimal-configuration` be set up.
-
-#. Add Stack User
-
-   Devstack should be run as a non-root user with sudo enabled
-   (standard logins to cloud images such as "ubuntu" or "cloud-user"
-   are usually fine).
-
-   You can quickly create a separate `stack` user to run DevStack with
-
-   ::
-
-       devstack/tools/create-stack-user.sh; su stack
-
-#. Start the install, this will take a few minutes.
-
-   ::
+Install Linux
+-------------
 
-       cd devstack; ./stack.sh
+Start with a clean and minimal install of a Linux system. Devstack
+attempts to support Ubuntu 14.04/16.04, Fedora 23/24, CentOS/RHEL 7,
+as well as Debian and OpenSUSE.
 
-Guides
-======
+If you do not have a preference, Ubuntu 16.04 is the most tested, and
+will probably go the smoothest.
 
-Walk through various setups used by stackers
+Download DevStack
+-----------------
 
-.. toctree::
-   :glob:
-   :maxdepth: 1
+::
 
-   guides/single-vm
-   guides/single-machine
-   guides/lxc
-   guides/multinode-lab
-   guides/neutron
-   guides/devstack-with-nested-kvm
-   guides/nova
-   guides/devstack-with-lbaas-v2
+   git clone https://git.openstack.org/openstack-dev/devstack
 
-All-In-One Single VM
---------------------
+The ``devstack`` repo contains a script that installs OpenStack and
+templates for configuration files
 
-Run :doc:`OpenStack in a VM <guides/single-vm>`. The VMs launched in your cloud will be slow as
-they are running in QEMU (emulation), but it is useful if you don't have
-spare hardware laying around. :doc:`[Read] <guides/single-vm>`
+Create a local.conf
+-------------------
 
-All-In-One Single Machine
--------------------------
+Create a ``local.conf`` file with 4 passwords preset
 
-Run :doc:`OpenStack on dedicated hardware <guides/single-machine>`  This can include a
-server-class machine or a laptop at home.
-:doc:`[Read] <guides/single-machine>`
+::
 
-All-In-One LXC Container
--------------------------
+   [[local|localrc]]
+   ADMIN_PASSWORD=secret
+   DATABASE_PASSWORD=$ADMIN_PASSWORD
+   RABBIT_PASSWORD=$ADMIN_PASSWORD
+   SERVICE_PASSWORD=$ADMIN_PASSWORD
 
-Run :doc:`OpenStack in a LXC container <guides/lxc>`. Beneficial for intermediate
-and advanced users. The VMs launched in this cloud will be fully accelerated but
-not all OpenStack features are supported. :doc:`[Read] <guides/lxc>`
+This is the minimum required config to get started with DevStack.
 
-Multi-Node Lab
+Add Stack User
 --------------
 
-Setup a :doc:`multi-node cluster <guides/multinode-lab>` with dedicated VLANs for VMs & Management.
-:doc:`[Read] <guides/multinode-lab>`
+Devstack should be run as a non-root user with sudo enabled
+(standard logins to cloud images such as "ubuntu" or "cloud-user"
+are usually fine).
 
-DevStack with Neutron Networking
---------------------------------
+You can quickly create a separate `stack` user to run DevStack with
 
-Building a DevStack cluster with :doc:`Neutron Networking <guides/neutron>`.
-This guide is meant for building lab environments with a dedicated
-control node and multiple compute nodes.
+::
 
-DevStack with KVM-based Nested Virtualization
----------------------------------------------
+   devstack/tools/create-stack-user.sh; su stack
 
-Procedure to setup :doc:`DevStack with KVM-based Nested Virtualization
-<guides/devstack-with-nested-kvm>`. With this setup, Nova instances
-will be more performant than with plain QEMU emulation.
+Start the install
+-----------------
 
-Nova and devstack
---------------------------------
+::
 
-Guide to working with nova features :doc:`Nova and devstack <guides/nova>`.
+   cd devstack; ./stack.sh
 
-DevStack Documentation
-======================
+This will take a 15 - 20 minutes, largely depending on the speed of
+your internet connection. Many git trees and packages will be
+installed during this process.
 
-Overview
---------
+Profit!
+-------
 
-:doc:`An overview of DevStack goals and priorities <overview>`
+You now have a working DevStack! Congrats!
 
-Configuration
--------------
+Your devstack will have installed ``keystone``, ``glance``, ``nova``,
+``cinder``, ``neutron``, and ``horizon``. Floating IPs will be
+available, guests have access to the external world.
 
-:doc:`Configuring and customizing the stack <configuration>`
+You can access horizon to experience the web interface to
+OpenStack, and manage vms, networks, volumes, and images from
+there.
 
-Plugins
--------
+You can ``source openrc`` in your shell, and then use the
+``openstack`` command line tool to manage your devstack.
 
-:doc:`Extending DevStack with new features <plugins>`
+You can ``cd /opt/stack/tempest`` and run tempest tests that have
+been configured to work with your devstack.
 
-FAQ
----
+Going further
+-------------
 
-:doc:`The DevStack FAQ <faq>`
+Learn more about our :doc:`configuration system <configuration>` to
+customize devstack for your needs.
 
-Contributing
-------------
+Read :doc:`guides <guides>` for specific setups people have (note:
+guides are point in time contributions, and may not always be kept
+up to date to the latest devstack).
 
-:doc:`Pitching in to make DevStack a better place <hacking>`
+Enable :doc:`devstack plugins <plugins>` to support additional
+services, features, and configuration not present in base devstack.
 
+Get :doc:`the big picture <overview>` of what we are trying to do
+with devstack, and help us by :doc:`contributing to the project
+<hacking>`.
diff --git a/doc/source/site-map.rst b/doc/source/site-map.rst
new file mode 100644
index 0000000000..480d6aaf5e
--- /dev/null
+++ b/doc/source/site-map.rst
@@ -0,0 +1,21 @@
+:orphan:
+
+.. the TOC on the front page actually makes the document a lot more
+   confusing. This lets us bury a toc which we can link in when
+   appropriate.
+
+==========
+ Site Map
+==========
+
+.. toctree::
+   :glob:
+   :maxdepth: 3
+
+   overview
+   configuration
+   plugins
+   plugin-registry
+   faq
+   hacking
+   guides

From 6a42a85b561c35157b14f63ab02536e18e5bb0d9 Mon Sep 17 00:00:00 2001
From: Kevin Benton <kevin@benton.pub>
Date: Thu, 21 Jul 2016 11:11:54 -0700
Subject: [PATCH 0550/2409] Fixes for linux bridge and Q_USE_PROVIDER_NET

===Set bridge_mappings for linux bridge===
The external network physnet needs a bridge_mapping to the public
bridge when the L2 agent is responsible for wiring.

===Add PUBLIC_PHYSICAL_NETWORK to flat_networks===
This network must be present in the ML2 flat_networks config if
flat_networks is specified.

===Set ext_gw_interface to PUBLIC_BRIDGE in provider net case===
ext_gw_interface must be a bridge in a bridge_mapping when
Q_USE_PROVIDERNET_FOR_PUBLIC is used.

Closes-Bug: #1605423
Change-Id: I95d63f8dfd21499c599d425678bf5327b599efcc
---
 lib/neutron_plugins/linuxbridge_agent |  3 +++
 lib/neutron_plugins/ml2               | 12 ++++++++++--
 lib/neutron_plugins/services/l3       | 11 ++++++++---
 3 files changed, 21 insertions(+), 5 deletions(-)

diff --git a/lib/neutron_plugins/linuxbridge_agent b/lib/neutron_plugins/linuxbridge_agent
index e5a7b76187..437aaeb896 100644
--- a/lib/neutron_plugins/linuxbridge_agent
+++ b/lib/neutron_plugins/linuxbridge_agent
@@ -62,6 +62,9 @@ function neutron_plugin_configure_plugin_agent {
     if [[ "$LB_INTERFACE_MAPPINGS" == "" ]] && [[ "$PHYSICAL_NETWORK" != "" ]] && [[ "$LB_PHYSICAL_INTERFACE" != "" ]]; then
         LB_INTERFACE_MAPPINGS=$PHYSICAL_NETWORK:$LB_PHYSICAL_INTERFACE
     fi
+    if [[ "$PUBLIC_BRIDGE" != "" ]] && [[ "$PUBLIC_PHYSICAL_NETWORK" != "" ]]; then
+        iniset /$Q_PLUGIN_CONF_FILE linux_bridge bridge_mappings "$PUBLIC_PHYSICAL_NETWORK:$PUBLIC_BRIDGE"
+    fi
     if [[ "$LB_INTERFACE_MAPPINGS" != "" ]]; then
         iniset /$Q_PLUGIN_CONF_FILE linux_bridge physical_interface_mappings $LB_INTERFACE_MAPPINGS
     fi
diff --git a/lib/neutron_plugins/ml2 b/lib/neutron_plugins/ml2
index 2ece210a0b..7e8020930f 100644
--- a/lib/neutron_plugins/ml2
+++ b/lib/neutron_plugins/ml2
@@ -95,8 +95,16 @@ function neutron_plugin_configure_service {
 
 
     # Allow for setup the flat type network
-    if [[ -z "$Q_ML2_PLUGIN_FLAT_TYPE_OPTIONS" && -n "$PHYSICAL_NETWORK" ]]; then
-            Q_ML2_PLUGIN_FLAT_TYPE_OPTIONS="flat_networks=$PHYSICAL_NETWORK"
+    if [[ -z "$Q_ML2_PLUGIN_FLAT_TYPE_OPTIONS" ]]; then
+        if [[ -n "$PHYSICAL_NETWORK" || -n "$PUBLIC_PHYSICAL_NETWORK" ]]; then
+            Q_ML2_PLUGIN_FLAT_TYPE_OPTIONS="flat_networks="
+            if [[ -n "$PHYSICAL_NETWORK" ]]; then
+                Q_ML2_PLUGIN_FLAT_TYPE_OPTIONS+="${PHYSICAL_NETWORK},"
+            fi
+            if [[ -n "$PUBLIC_PHYSICAL_NETWORK" ]]; then
+                Q_ML2_PLUGIN_FLAT_TYPE_OPTIONS+="${PUBLIC_PHYSICAL_NETWORK},"
+            fi
+        fi
     fi
     # REVISIT(rkukura): Setting firewall_driver here for
     # neutron.agent.securitygroups_rpc.is_firewall_enabled() which is
diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 61b8402818..a4e72483b4 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -306,10 +306,15 @@ function _neutron_configure_router_v4 {
         if is_neutron_ovs_base_plugin; then
             ext_gw_interface=$(_neutron_get_ext_gw_interface)
         elif [[ "$Q_AGENT" = "linuxbridge" ]]; then
-            # Search for the brq device the neutron router and network for $FIXED_RANGE
+            # Get the device the neutron router and network for $FIXED_RANGE
             # will be using.
-            # e.x. brq3592e767-da for NET_ID 3592e767-da66-4bcb-9bec-cdb03cd96102
-            ext_gw_interface=brq${EXT_NET_ID:0:11}
+            if [ "$Q_USE_PROVIDERNET_FOR_PUBLIC" = "True" ]; then
+                # in provider nets a bridge mapping uses the public bridge directly
+                ext_gw_interface=$PUBLIC_BRIDGE
+            else
+                # e.x. brq3592e767-da for NET_ID 3592e767-da66-4bcb-9bec-cdb03cd96102
+                ext_gw_interface=brq${EXT_NET_ID:0:11}
+            fi
         fi
         if [[ "$ext_gw_interface" != "none" ]]; then
             local cidr_len=${FLOATING_RANGE#*/}

From 894ccc90c0a0795c84ce69afd9a68863a9004f20 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 8 Aug 2016 16:19:05 -0400
Subject: [PATCH 0551/2409] disable metering extension in tempest if q-metering
 not running

We don't run q-metering in default single host configuration, so we
should make it so that tempest won't attempt to test for it either.

Change-Id: I928be70e3b10fc3753fd1081631e54fa839b671d
---
 lib/tempest | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index e4f80b835d..10c1a71805 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -569,6 +569,12 @@ function configure_tempest {
     fi
     iniset $TEMPEST_CONFIG compute-feature-enabled api_extensions $compute_api_extensions
     # Neutron API Extensions
+
+    # disable metering if we didn't enable the service
+    if ! is_service_enabled q-metering; then
+        DISABLE_NETWORK_API_EXTENSIONS+=", metering"
+    fi
+
     local network_api_extensions=${NETWORK_API_EXTENSIONS:-"all"}
     if [[ ! -z "$DISABLE_NETWORK_API_EXTENSIONS" ]]; then
         # Enabled extensions are either the ones explicitly specified or those available on the API endpoint

From ea270d50d091bad57ee0b21b405c41bf2d798631 Mon Sep 17 00:00:00 2001
From: "watanabe.isao" <watanabe_isao@jp.fujitsu.com>
Date: Tue, 9 Aug 2016 16:28:52 +0900
Subject: [PATCH 0552/2409] Give PUBLIC_INTERFACE a default value

Also means to make it changeable.

Closes-Bug: #1611247
Change-Id: I0dc253b7ecf44a49d152f97f4858f7f2cf2ca6b2
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index f42bd944fa..4fefe8da30 100644
--- a/stackrc
+++ b/stackrc
@@ -712,7 +712,7 @@ S3_SERVICE_PORT=${S3_SERVICE_PORT:-3333}
 PRIVATE_NETWORK_NAME=${PRIVATE_NETWORK_NAME:-"private"}
 PUBLIC_NETWORK_NAME=${PUBLIC_NETWORK_NAME:-"public"}
 
-PUBLIC_INTERFACE=""
+PUBLIC_INTERFACE=${PUBLIC_INTERFACE:-""}
 
 # Set default screen name
 SCREEN_NAME=${SCREEN_NAME:-stack}

From 0ffdfbdbd72ae447eb4b5e3d0f255c5498a07a36 Mon Sep 17 00:00:00 2001
From: "Lubosz \"diltram\" Kosnik" <diltram@gmail.com>
Date: Tue, 2 Aug 2016 16:35:22 -0500
Subject: [PATCH 0553/2409] Run n-cpu using LXD_GROUP when LXD virt driver

Enabling nova-lxd require to run n-cpu using lxd group

Change-Id: I0553dafcc797fcc1342501a558c7455261cf3daf
---
 lib/nova | 2 ++
 stackrc  | 3 +++
 2 files changed, 5 insertions(+)

diff --git a/lib/nova b/lib/nova
index 67a80b9b16..8fe4c29d86 100644
--- a/lib/nova
+++ b/lib/nova
@@ -825,6 +825,8 @@ function start_nova_compute {
         # ``sg`` is used in run_process to execute nova-compute as a member of the
         # **$LIBVIRT_GROUP** group.
         run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $compute_cell_conf" $LIBVIRT_GROUP
+    elif [[ "$VIRT_DRIVER" = 'lxd' ]]; then
+        run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $compute_cell_conf" $LXD_GROUP
     elif [[ "$VIRT_DRIVER" = 'fake' ]]; then
         local i
         for i in `seq 1 $NUMBER_FAKE_NOVA_COMPUTE`; do
diff --git a/stackrc b/stackrc
index acb7d3f650..b5d1bc0b6c 100644
--- a/stackrc
+++ b/stackrc
@@ -586,6 +586,9 @@ case "$VIRT_DRIVER" in
             LIBVIRT_GROUP=libvirtd
         fi
         ;;
+    lxd)
+        LXD_GROUP=${LXD_GROUP:-"lxd"}
+        ;;
     fake)
         NUMBER_FAKE_NOVA_COMPUTE=${NUMBER_FAKE_NOVA_COMPUTE:-1}
         ;;

From 7b229359671f23b73e8df9f6ef6dbbe443cc96ae Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 9 Aug 2016 13:29:11 -0400
Subject: [PATCH 0554/2409] delete compute api extension config for tempest

Compute API extensions are deprecated, we should never be setting this
in Tempest in master.

Change-Id: I6ad25fab48277abf8a000a275d3fea73a595cdf6
---
 lib/tempest | 10 +---------
 1 file changed, 1 insertion(+), 9 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 10c1a71805..e46fc149d7 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -559,15 +559,7 @@ function configure_tempest {
     # Run ``verify_tempest_config -ur`` to retrieve enabled extensions on API endpoints
     # NOTE(mtreinish): This must be done after auth settings are added to the tempest config
     tox -evenv -- tempest verify-config -uro $tmp_cfg_file
-    # Nova API extensions
-    local compute_api_extensions=${COMPUTE_API_EXTENSIONS:-"all"}
-    if [[ ! -z "$DISABLE_COMPUTE_API_EXTENSIONS" ]]; then
-        # Enabled extensions are either the ones explicitly specified or those available on the API endpoint
-        compute_api_extensions=${COMPUTE_API_EXTENSIONS:-$(iniget $tmp_cfg_file compute-feature-enabled api_extensions | tr -d " ")}
-        # Remove disabled extensions
-        compute_api_extensions=$(remove_disabled_extensions $compute_api_extensions $DISABLE_COMPUTE_API_EXTENSIONS)
-    fi
-    iniset $TEMPEST_CONFIG compute-feature-enabled api_extensions $compute_api_extensions
+
     # Neutron API Extensions
 
     # disable metering if we didn't enable the service

From 5068b291f427a55b40357cc0cb77875294963e39 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Tue, 9 Aug 2016 14:52:57 -0400
Subject: [PATCH 0555/2409] tempest: toggle allow_port_security_disabled=True

This enables a new test in Tempest to run on a per-branch
basis since by default it's disabled because it won't pass
on liberty given the bug fix isn't in liberty and won't be
backported there.

Depends-On: I20b8d5d2a300c83a59bdb33374fc20447ce2ede3

Change-Id: I18fd5e0978795fec39a763e1e0f07d758905b9b8
Related-Bug: #1175464
---
 lib/tempest | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index d1e56a4c4d..9182fea387 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -352,6 +352,8 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG compute max_microversion $tempest_compute_max_microversion
     fi
 
+    # TODO(mriedem): Remove allow_port_security_disabled after liberty-eol.
+    iniset $TEMPEST_CONFIG compute-feature-enabled allow_port_security_disabled True
     iniset $TEMPEST_CONFIG compute-feature-enabled personality ${ENABLE_FILE_INJECTION:-False}
     iniset $TEMPEST_CONFIG compute-feature-enabled resize True
     iniset $TEMPEST_CONFIG compute-feature-enabled live_migration ${LIVE_MIGRATION_AVAILABLE:-False}

From 5c39154c39cb23c78f3f130719614624681bd1f3 Mon Sep 17 00:00:00 2001
From: Sam Betts <sam@code-smash.net>
Date: Wed, 10 Aug 2016 15:58:27 +0100
Subject: [PATCH 0556/2409] Ensure testing configuration can run as late as
 possible

Before the code in the extra.d plugins was removed from the devstack
tree they could define the order they ran. When this code is decomposed
into a plugin, there is still a need to do some form of ordering. This
caused problems with the Ironic devstack plugin and Tempest because the
code is run in this order:

 1. The tempest configuration is run from extra.d, processing
    DEFAULT_INSTANCE_TYPE, and writing the flavor_ref to tempest.conf

 2. The Ironic devstack plugin is run, creating the flavor needed for
    DEFAULT_INSTANCE_TYPE

This leads to build failures as tempest can not find the required
flavor, so it writes which ever flavor it can find at the time into
flavor_ref. Ironic now has code it its devstack plugin duplicated from
the tempest plugin to work around this problem until this is merged.

This patch fixes this by using the test-config phase to move the tempest
plugin as late as possible in the devstack process.

Change-Id: I3d98692e69d94756e0034c83a247e05d85177f02
---
 extras.d/80-tempest.sh | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/extras.d/80-tempest.sh b/extras.d/80-tempest.sh
index 6a3d121497..15ecfe39eb 100644
--- a/extras.d/80-tempest.sh
+++ b/extras.d/80-tempest.sh
@@ -11,13 +11,16 @@ if is_service_enabled tempest; then
         # Tempest config must come after layer 2 services are running
         :
     elif [[ "$1" == "stack" && "$2" == "extra" ]]; then
+        # Tempest config must come after all other plugins are run
+        :
+    elif [[ "$1" == "stack" && "$2" == "post-extra" ]]; then
+        # local.conf Tempest option overrides
+        :
+    elif [[ "$1" == "stack" && "$2" == "test-config" ]]; then
         echo_summary "Initializing Tempest"
         configure_tempest
         echo_summary "Installing Tempest Plugins"
         install_tempest_plugins
-    elif [[ "$1" == "stack" && "$2" == "post-extra" ]]; then
-        # local.conf Tempest option overrides
-        :
     fi
 
     if [[ "$1" == "unstack" ]]; then

From a2ec7fdb48d5df464fec3fae1f93ae3ea1071c54 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Wed, 10 Aug 2016 11:14:00 -0700
Subject: [PATCH 0557/2409] Configure project_network_cidr for tempest

This value defaults to something not (necessarily) in our fixed range,
which will cause spurious test behavior. We know the value for this, so
just configure it properly.

Change-Id: I0ee3b71f509377dc7174ce97575e60ee2095f893
---
 lib/tempest | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index 6bfa8890b6..7a1d25f195 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -236,6 +236,8 @@ function configure_tempest {
         fi
     fi
 
+    iniset $TEMPEST_CONFIG network project_network_cidr $FIXED_RANGE
+
     ssh_connect_method=${TEMPEST_SSH_CONNECT_METHOD:-$ssh_connect_method}
 
     # the public network (for floating ip access) is only available

From 14d86e841c964ba12a57a652ece4239ca9283c92 Mon Sep 17 00:00:00 2001
From: Gregory Haynes <greg@greghaynes.net>
Date: Fri, 29 Jul 2016 03:45:37 +0000
Subject: [PATCH 0558/2409] Set oslo_messaging_notifications driver

This config option is requied in order for nova notificaions to
function, and enabling it doesn't cause any harm (there is another
option for turning notifications on).

Change-Id: I309af6cc43af485f795c368d304ebe71fceb1a03
---
 lib/nova | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index 67a80b9b16..c59a718b56 100644
--- a/lib/nova
+++ b/lib/nova
@@ -541,7 +541,6 @@ function create_nova_conf {
         iniset $NOVA_CONF DEFAULT instance_usage_audit "True"
         iniset $NOVA_CONF DEFAULT instance_usage_audit_period "hour"
         iniset $NOVA_CONF DEFAULT notify_on_state_change "vm_and_task_state"
-        iniset $NOVA_CONF oslo_messaging_notifications driver "messaging"
     fi
 
     # All nova-compute workers need to know the vnc configuration options
@@ -582,6 +581,9 @@ function create_nova_conf {
         iniset $NOVA_CONF spice enabled false
     fi
 
+    # Set the oslo messaging driver to the typical default. This does not
+    # enable notifications, but it will allow them to function when enabled.
+    iniset $NOVA_CONF oslo_messaging_notifications driver "messaging"
     iniset_rpc_backend nova $NOVA_CONF
     iniset $NOVA_CONF glance api_servers "${GLANCE_SERVICE_PROTOCOL}://${GLANCE_HOSTPORT}"
 

From bd6614a8e0040690aca5121cdf08a7ee17fe7984 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 11 Aug 2016 09:05:16 -0400
Subject: [PATCH 0559/2409] Add development page with devstack

It turns out we never really had a document on how to work with
devstack in the devstack docs. At one point this was just cultural
knowledge passed down, but with the size of our community, we can't
rely on that any more.

Change-Id: I28f896ea507ccbba5164ebfc5415d22207f52e98
---
 doc/source/assets/images/screen_session_1.png | Bin 0 -> 386703 bytes
 doc/source/development.rst                    | 140 ++++++++++++++++++
 doc/source/index.rst                          |   3 +
 doc/source/site-map.rst                       |   1 +
 4 files changed, 144 insertions(+)
 create mode 100644 doc/source/assets/images/screen_session_1.png
 create mode 100644 doc/source/development.rst

diff --git a/doc/source/assets/images/screen_session_1.png b/doc/source/assets/images/screen_session_1.png
new file mode 100644
index 0000000000000000000000000000000000000000..6ad6752bb10870da57b35c0fa3930419a4d0e445
GIT binary patch
literal 386703
zcma&Nb980V*Cl#mCl%YaZQHg{F)Ox>ifvTvq+;8)Z9D1I*Zuq68~t97(SMzD_SyH|
zJ=Wc8t-1D`D_lWN91a=_8UO&mNlJ()0RUiU004**B=Gl$2NLl1_XWgBNKyq75^`-v
z{@>#dXHgAjWjixxS3^frfU<>)v$LtAalkYb06+kc6cJQ$TRqox^+FNF_G!|QzRCjR
zJ)wDA$qFNj2mpccD=MNW3JlN@Q0W$iNvJBKfS$}+LDCi?B1sT;9KBvlK8YhGbeq~;
z(ILip`@E35vfJgPxo&2qfsshW5eNo=LLvQM+#GfX<dITKxOovc<!X*Ve}AMyCID2s
zo5QcT5cZTGMoQ1=GwFIOxPaNR`bvo=ah!M>orGOF?%HBPp3ZsA-8whEt7bW|vMDR(
zPg}*8$@*(QMg|#XV@MC1ImA@{72NjEEi57<e7F&m2cAPZSd2Nz6Efo9pR18wMeX$s
z967!;NOmvv+*-6ZQyBC7w2K4-%f1i@)MQq%)$?Q7GSe!<p>@gr2Vccb;`|5m>w9s`
z!=>GdGILc81;lP}lrcvIYz~~K>ACM=Jx8qWDPr#{Pcobyo|2mJf|MtdTXmhLs)|VU
z-55DH&mxVLwKodeAN=l1W<sBpY(}Eb!`T+T=N?kBBJki*0}YpujzNmiYwWeB5IS`3
zC}@fnFDRXOAxZcK`c=m>8>n~uBEHCnULn!}c=spa`g*;O2sL~UhEo!<xYXzl7R@o$
zHh)uX34%}t@HJTKs&;$O@H#r%t%;U4E9@=_;rABJ)*;TmIun#Erh~c=i5@v)8T3tu
zOX(lihYuhLL&mAO`Eiga>XoDg(}KIaA(<ktfdQjseW58bLH*v#GIYsxce%QjN?<AG
zpv<g>aE4cr^&yQ|BV}lJCVfkzeTyS~YNH+<qo7OWN(m+zb^iwbe7aaErw1t0@+a`?
ze(ux+*ToS39CFN~pf8@{a_`zf(RIK7lH;@XC?Zc`;d!mw;G-{K*w$?lEJ&veo6Sya
zCb!@p?HlM6lmR+9QLH2~&Nvxg8f2D^a*&J-6M>Jpx`1>qW9Dq)a=(0^ckyHy;Hf^M
zMxdR%y10t-nr@!-?pPZ!)zz_ZbS&!n*z{Kw2Ok{RDPuqVXy|frHhSw&Ml}VsC|+33
zeei7#mxq^?yR^TMC}<T%al{5mcC^pKI~P8D(F%f${?iCP(U7L|RUHODGLkn#jy;7<
zQ=K0##JIl^B3>0rMjlG0XZ!h)QRTCUkd#=^m+{6$Lf-6EPe`h!Z`j$(w8lyRrC5xk
zYRqTjNJhuP$$39mD|Q!3iJ~@G$lLU1F;K{hGN-CD(%06Vmht;F%dOj9tT-huh1I(i
zv#DWp5b@$69#vIJntlqKxq8)adUt=dq%Xad1l>kCw&f>7ct-?9Dxu3y3!b~in{jrs
zv*cr`zjK!E%j^{?f271_Tp>w+#h8_KD_XDhpcpGpZu3Q4F!&wX*|RsL=Of$%YuOk3
zvSQbIkXem6YY})_X7N~Oc^#+J#T5KZY9Zfj$REU$(T*3ylz0bM?gyWXzT2;rHnxt5
z4h0^Z3GgkC)<EQ|`*HF3(DQ|t&L0>H(c^|Y#%?$Pv_3Cn?nN@n9vx!5fU%!7FaT_I
zs+bM=5HOBVsY45v2fVv<SAjh!HxQ%B(E&xSZoC4jQlBsWn;~;O2-i?GjC*0|4S(mE
zEb|j@D{8=d1oCaFxg)*PF+U98SMk}fC0B8(?`*NMULC2`$?(*{FURp{dp9`JTjy7z
z;sVjxx;qqX2-NMujCj8J@xlN3+0ZP#dBES~`!=^wKIAlT@H4>c=aiw<)P;vX&b!B=
z`qKSF$fVZw$>-u9_=`jR#W2U>+;KD(4+<vjTcNZ);B3vVuQ_-%+dU%{I;r&yuCtD=
zdMSLIv^u)|>ql+j={KTE!wxZ)1C`MHgx2BTL63zWf0=EL=Jd8Qs&vSbWL4d|oy(Q-
zR9s7FVqNaRB=@U6gtsMHoAS>PjCng`zpS_6L{QHBD6K8frSQjw@D4c1M+;alPJ~GF
z!4K`|!rK~9^~gSdfs^p`60Dl=Jv|nX#Mk8wDf@?M*;_r5eSAn_h(bKxzuaf!`gaP9
z2Lj1*Q^&PZo9-|guMEc(OqR2FwS~M^Z{aKtj5zNJY`$)>C?3grajt|2Z=9JQ`aXqL
zElaXKyI-j<u@>h<yxw|DSWA>9S0B((mBz=hmU8W3pTCb6?VB9-HtPIl{A6BaSB;K-
zJq8vBOj~z}PAo<fk}r}~hZDNIK6i4qDJq-ZPY+;Kx>ahd)C@$MH|JMOF9GWdrd>#f
z22s@CDwb!^UJT{v<<v3xTQaVGC0%8BbpBvHatqD~GMdHHh8l8u@Ja(rv96spv?<rT
ztevZf%{;m1pr^1a7H_4x>Q(sK6k011?}RnBhOWXL;mK4BzxRk+vw2V`As#1$!vnyQ
zz!fy9nK$a#U2Xxj1I#oBTd|MPyLPE#j5PbOOjHbsLQJkZ;&R5MSD^{fHPOqL)w83p
ze1_yDYzpv%iFO3n6iZ@m39e}XdwV0TU+xuk7~DpCGa`+M)V<<p`5W1M&s%{wAlyKb
zZmuA+t>O}NLt+}wun|*+hiv;=$g{898Z}TCGRsMNPP5Y(w^W<feskir)aX5xjFvyt
zh8cIrOUuFI)hRkLy?sYg9|n)^e*EdH=FWrfFWk{6>Q1zwXkAL)w?047P&+$mC5((a
zyGy4A_&s{O9(f7TjhCux-5CaEucgUBQiea@S+Kd=$A(mVj)k%Y720~{g$KHj+6#6j
zPB{&6CN%xAN{f@pIyrJnXsY|2I-;y$CXL05lNQ{eu<44``AbOJ_Um;{w)}B>`crul
z+3}FmZd6NKla5>U%-dnHMwFOz<AwWWy6gbefpp=X*nL@QajR9QsQA3b<u+zQw4tbM
zoAb72p&}OPM=gZ-Og3(l9N)I4mY$^MDI#~m@w7ZzliVVU0#)O@P{c|mZl~PhpHE`4
zWaFo}<NZe~Pd){3(*xp8yWg2OSZ}U<xaz|A>-7R}ZWnU!AI6|oY#}RLn`?F<Wcsj}
zbKUDNcT)J2TA*37@Vwkpf`*ZbsLBXIWI6EGROmzMZWYMW63bXIa{9VZvV8kn67YbA
z(6v+Syb;g#K&hc$^0E3?K_R|}`wDF7BjoRx={R`nYClC~3pe-4Zbm8>X>8oL=wN}o
zX|GWeS32X6@@eeQ+_*UJ$9W)3Ut;-Nf24mWms@L98<|yOYUvxA;gqVig_-7e%9INK
zt(pC4EBzEqwJ2Yk0_&N#UhnBDJgVifAhYGe^HG=E1FM5Ev*}5cYl@2=_ZB5Zm1!OK
zW%8(k;TpP)z<MRTrhFd$+FuAU3Glj<_@5E7Pw14#)2K~N-Wb>EWC(9DaL!Fdm0N4K
zH3t<b`QZIEgn?8xv%^<6lBRgg%QahFO>e{hwI`8sd}4{2cdjjp4pZMb<><vjS5d}%
z0djV|_XG~S;}8=YRQ(yxq;l0l8GnFi?gsumEWcp+RQ-i0nTY%j#ZwT8q^ld|+xKKq
zw|^?CMs-!WLQB(Qu}`DJz}9x}0o_M9Z<kZ+=H&9nCykGC;0VgU`Zpi$d{$b`s&|sc
zh+jAO^I8!!THO4oKF4ZKGWJ;1Fojd;3vTU;3@H{9QD0hiqj*40!=;adP0>D^noP~S
zLaO<0-oDzWI@esE6C^4*MokxD#F*K9*H~{m;IB+8@!ta8K6+J!F#&t$XTY-7RWTY?
z)G#MeaZdvpeF0*-xx~#rhi4PT*o`GjazD=Smaj#$L9ci5?xt0`719@O5q(uxYKXH*
zFN79wC+BVC+ggDA2qWcJO(I%NUka<n2%1#UM+b5e82!RgM6TI=4sYjCrGKW_T9=nt
z$jb`|-`<tJWowUMGt!F90l`s(<nDu`cVvyVxQZp_c|lCOXw6*$CC(zE2(augDj7!=
z-3d0ZZ#??S2r!6ZOX_h{KNf*tD-42Ou0H9A8J=v5u=)hrEQcBW^b@~<qcal+(}%%=
zY68o(9BIIid;?Qv5nw5#h>u+xH$|Dx?<6XY11z0XyFHv;E|W+c7Uu&{HY9v)owW+9
z?yZ{U_H*6mc(_1k3ng5wtxh4f&<Z!(;)KYqJ{+gd(brdB=Kz#ab7Jq_PaDBtY01Cn
zhq0dVxzLsY00w96w*6W8Ii`?D$>>=SGUNUDOi|C<CLGe=k8Li#(~)u&%+J~{heoMJ
z9+PmVdGnPXH<MRThj>3#Ec;GmxCCtfh=?obk4m!I>RngVPWnrskd<D&f^g=)Ko1r9
zi3Kbwu-zV?g%8^~BEx;}8dMuT3y)XKDY?s)vK52G3TC*1bb9=WmI~kiF17Qul!YhF
zzulC-4DVAoA3|acMOHOat82!Sm7~x;GuWS9piMBk6H9n&i7)z!O!<(C&lRT1;9E9^
zT#EAG8qKB{=jNd<FV>l^_BA3TJ*`QP1*N@S3Y}0x*P}I8Rfq$0erg3}UF2B{{>vEE
zq0kRZV+2Q^M7n*cK7#L;i4YLne;(}3MDV$$5kqtw4ZBWal|_U{2QU4Vm+9ar_z@WV
z%KUWrtX~f(6xGkEg!+8WOM#q05PragbB$aq_Z_9<S(OFl@r{+WF;2WGr}?I@gzQa+
z{Nzlyfde%qXgz8z)%Ef(mdO}|F_D!<&%9VMJR9}NdF$92H<jiLd}-QWG#@-h5fBZf
zGXrsKA<jv;>ax#oqch~SO@*&KjQ(XtoNQ*E*P{*g!@m6iQw7ub?}oW!61D*mSjr1F
z_a6z;L{vx<1r*f#?1~O-*InVNX$>_<3<f-Q(Jf{RPd1^R4*E4Cf{Ps}Kzllh-Y%Ur
zdb9TWX$w^>oae1Zq~?}EldSycK&TNQpOEu=vHUMYS<4j&RDVvinU;P;5K?pwie7Cq
z-Hny!vu%l)Nb@5tL5PZE@qT)1s3x2gEgt&`XN>Y~HUX@pjzqvWz>O`i8z2Kxh%Nk<
z4A#^&JWJYvXW{Ll1fK||!F6~e7rKbVKmbhm<KA%IXF|3D`=W)<h6chYTfMug9K@GA
ziFJJ0P`!=OEw=)g`8y2lYuJRH3c&4Hh~~8(=(b68ajF`1NV;RxPF6=oW8Qd$)433v
zSm90C1ePL4s+ZvQj{Sk6yhcLtXrR;Pgnx;gdM<FfVIruWybbo98)OEgyLLNbN-1>4
zW~y23Awro(kuJu*a%-5u*#<9h5@TX2ZhG<ASpWj9ESC6w=iW<B+Zz`zj6mv5A8Gc7
zY{fy&uxi#L)4;D8{InXN0*lKs5!;J<3k>X;o=0s~SXyL(GZb8VP2Ee04zE|*sr+{t
z>OPo_@0Q_z9`0X2P@0qNB2XI5btTNCw-)Qh;VVnzEdKyrJD*jq>xMZBC`JL@iy41?
z6hp_Z8uieMyeH4YY?7G(!|Q<?J<kZ)JS(J^gTeLcO7mWD-_h@hR=Y1>%*aq`2ZnRC
z0Bj(W;K`9rOL7EfbVvwZ%sa^;O%-V|-qEJ7;nHuntCc4!^%eI(AHs_yr=(U?Vl@)p
zJLkbk#D~L`84Mh_2wh4l5*M7$HkvZrzYcEhZyV=QQz37l#3~<MHAV!NvxIAL1~up3
zsHI!L_H^V0Yy9Ew=Zqn!cFHeX)#RjGH0vw&pQdEKRuCnMGY{EDToZYdUPhw}$rI@h
zVho*Hd@n5enc^}yq^`m~*^o!vbDKRXJwS7~a2u8^dstJVw!$0cX}^qzccR;&0HFcY
zUe+9p7~LK-E}=|WW;@R%I`K1gV!bw~7t4Cg7MfhXp6JyF+w(DHO9{W6XvPq&B=r%U
zB#?7li(AmL$5w7i9&PFDlxjNb655JbVbU+|-0vok_rrZl=rzpjPmg)e7DBo>2jJdo
zT2cW~*4IlDi?InsxKppEo;Kk^oY$;doq@O;=;$U|upd$FFZ7n)S}*k8V>^R&Yvl!Q
z0IyoQvWmCg{adr0Al>O()I?56Z2`9@7cWu2=`JlL=XE=G+v6keU_dZM3aw*yekKQu
ztYZQq63Q{EUni0Ipe;%%)4$5ADny7Y=*v@EI#*IQ96p}zC)g3!N4%{AM*}M$JAos=
zPFazfLX^EB^iyL7Q@2l8JW6R!rveJ4J)%?_pbA}0?~2b8j9sr^6LTefNv)%H6DQjB
zuOv5K2-(%hnVuA*v~iZXm|Uj8D{cF|e@Dc1_Id@IHc_CY6!6u&Twdb*hL^EduU^u#
zYDtR4YZobKwt#Dtgjih*Ebc}I5P*%4`Bk3D5r%$8)ioQ^bHVawk6#baN%7PW4O)o5
znnLSH|5d0l|8P!!?lYHbVZF5g#>bRvd+ljK)O3o;92da_Q8P7^Uge42Z<B|ODCtik
z58xV=NChf}jITF#B^iYhkU5)*aZzI(hmdOkMMEk<#!BR9)V9xOWGNO?Uuex0MRd+3
zfz~aCG^vgY)vhtZTn9K)r?~8is<7Bf`~_>4nevNv7xHH0pQVfo)ZQ$eanxg=m_i$7
z)K;ZvJ(Kl>7V5V#M{Mu>u*@E7?SO>Yzg02v(c%Kqt9@y6D8K-0i8e-xFaol+dc>U-
zO$<?Vw<^?)UsO&G%qi+7vfwULvnenAGz|XEec3YV;*QRw)qAw&V7-`$yfx(5ioZ<S
zqDvmsTd?24{1v3|M-_!d@M0UesxAjYc-<=oDyqRQE`^o8c5kI}E5t+ZjXgu{$vY1t
zV3XI9;oW0+e9hVIoQqE%jkzF{&G}gmENH|lepnxi6TRh<UajqIg@V9~vlGt1P05ST
zk$5$sa{)j{R#1yV6$@rm1HH-PQekKj)Y(On)GOM#_ChfgiVW7O8QhGW^((CWe&!I%
zAq;|Lof6sNf6f~$YOqA~&F1`IL&T5jOLh5CzX^Q;><T|tz1!0;)J&TGw!59vq6l04
zBMLVx8jjJ05DC@~2wU9%0VeiW>f9XciXWc_Kjym4yEDqQ*p*aQ{ENW_(Y!YUTx-nE
z)@~<E{7-XO8&G9nB<c>)?k;k(`Mz`n`?k|^FbYzvw!CdDXn(bh?WCyRni3GeLIm8A
zv%xfP2W#9{j(~2C7Y-0nOwmzW{fiZz0p``lpE;#o@UmW6w00<}LH9okfU(AT^&1F>
zfdoDuvLd&>!4NVh+SHKdZh2Sdb(*G4ES<Iosqx^+nDr8#t*`7^9f8gr14s**2_4ke
zV|kxVv3rj8{g_RG#b~a#INiq|_1zSk#ePf!AN*YR(V_uZF5;q^7i?<w4miK{&yQ$D
zWi@^3TGxu2ZEu*xA9?Z5NboZj+ZWKu0cASWTk0mlS0CHSC*27Vt4$Te+%3j0beY`i
zE5ah<4sxshO4HLt$l8-WN{L%;i&OC=K2}i?-Ued`u>lfzeu3f--g43j@b;V@e!I6O
zw{%$;`09L=_zDWqeHL7i+>Jrh--+i|cg61pHI@}iE?+hHy;Zd6Y5(qo()ugSc`teX
z<vL>MZ?VSb;8ptr0*>SkDjzHEXW!2yZLd+Ne5(oPDsf89#8g1G$w!|lP%fa?9Ay~1
zL*UKbQ4}+oCBQ%%bKzQ3OR+mgQzhHS!MP*kE2fj^u%&+NH+pu5FPb9D-J4?okLS=t
z{9OdJn}NAcL)}6#)Tehc+E)^cs8g4`*odP~IR2xaAs+&RqjIX9yu;EiV&msJV#n`A
zWrT%|$Y2P0ZS>5BfYHBWtl3!a7tR2Q7jF00^9l=Az;Iwz2BrVs&$fcImvVqT<J&C1
z2mhUyUXeGOi`Qdz)f@^S%5ziVl{7qTW+^Z0>-_TmB5B4r#i9YQc(lI0c8XkbOCkWO
zzs7=enH!T0+ijXMjeE$h!<HQF+R1oHHst?E#|vgTUExDo^b*5`e_?m$)e>TJwePq;
z8D=+6MBj6RrE>H!`KlUNj~sQ~Nk4|Xs2)~LnnnwsktWJtMF}i0L(qk8!e-mymTEQ4
zBpWaTY$~gAIfC@mgFlby%6_2$Tn%l1yp|2tGHXNrYp~F-(((`ea6ku|@7^Vj=Tp76
zY04Pn+Y;SqG7D0SMuumpJv}lQF=uTkK1bHcX<tr7KJkYP#6B(~-HN0$=yRyNyEK~v
z#oT4#iPsC0u4gE}Ti6oFJSNdw!o_liBd_?a`|v3PvWKE*iLAcO&H^aMSjp%?^@EAl
zyXjw*cMfUOvP<X8F`Rz36EV~5QX1w3dm7rQ136#SM_5Wy(M3C?xprRPOB_PbQx3h#
z!oVo|5pqoRaygA&&Om$ZfcAQxt%$0*FsU{X$nE8X1ph+vA4cYEL_FNu0d(umn~`w1
zBlpkglpIq7_}fgE$>h?#m@2I*P`-(hs<{cSC*5wGH)W#9b-+8Yqj<|H(Htzr7;(!s
zI+pPdUN$k*-{3NA^fdv&fztz^W0_EK<yI`J{rNsH+g-n$9IK)CNcU%7r0I+0ucr9v
zJ(N(th_y>i2|iSF<G%OW$6Jj+99E<XDL5u#LMU^}#FE-PqsAlk<y6#uDhD22Yw8V{
zlxq>bMDHV|8!w7oHs#yM1SC#-WVWFNQtZc2+#J0ALMVEqNhFX|frBss410Mwf<^5U
zpz7GKfWsa_o7~9Ev)vnyCp7g8uzdx@qtT<d9Xu0fzB>@y@)O|K@pGB8tbOg!a0iKl
z&mL=0<=O9&CPYS5AC>L0yW`CKCwe<0yzA3$ENu5f=K~iGz=d!huJ+ipWpf}XnBoxe
zT**Nf{_SAltrbIQN_RA4{{FoY=lAhhvMJsJkAFoNf7hxb5gUY0R*Bc=N`7A_SoB+U
zhq9T=DkB3)jf`yml&sw30<xkP=8?w)_Fv0t8%_7b%TH?rHy+-z=+8H^i!loMC>o_I
z-enqQ0q7|ouF{zjHKkwY99L`cf1^K=H>UIcdft|o=r|gQwQXYp&X8s=R$SG6p1P7C
zV2sn{xU~#&I%wSWr?HG!>R?{lWNIa!96dKxUdF{?(K}<W9ZLg_J^E7d?#i5CMB5?b
zsIUj9qNP;I!Rq`-=4Kv}%>+qN=V3{*BV+5|jQ9fbDFWo|9l>t}J!i8g74Y{W;STXr
zpFM?~{HR&{RRMsUL3G5`BFbZXdsdbTCmsqkfE%$uN)C-7#Z`~YU1vi%H6Rrh5GG`*
zNxak4Kz?xsGyz1X{}y-OnCFGgGffNm%F1sQMYW0ukT^Gl!#|wv!23|AE1O$l1-z<a
zM}q1}pKq63Q+NH8%Bk+kkhe6cP|lIZS|x?b%?!xuH3RkKV|25st(s~R6$NEtZ{?0d
zPW$?(+SPWywmo7!%F4aa)2TkHQyvS<8XNXJ)71TV{f5SO*lqb~Qiyk>^d1GI-hmz*
zo<dJ^Ia>7x2#j7}6@<C*!%=j+LdpzM?wo@rM&-$F0f`TpFUPu?<`g9*+`Tq_SM!&_
zIq%A~3e{><5JOAoEhj$VYd?mxtE){r7sjl6)GDgSqGAKdo?NdLfyLygL6}S@VGSAt
z(xzxL-=sp0Tz#Z}dD4|(pgx=g8-Yx*X)i#U2xd#WE?|qGj;AH#71j54u_-kb#@qL=
zt_oA`=#e3bF0~-L*8zc)!X)WAY_A0T0$FhlNz58O96lg^ua7=~cd`HUk46)b&S##P
zNpduco9ZiPy?}DOMzKpMxEJ%Aw+eDDOn(*ds@$JRlyXa;+1-<i(*wb1hVeRB86AQ<
z?eG$GudyI%$-Jphhlt=6w|uyu3(??{mVa|DF+uDXP|T*KFtOKsVU3H19G^5QJ@~ZY
z@(O`IpJF*5b3X6gfBy-)B_Gv43LBA2kxqa@XDbjNT;T_4rtsK3X<f(>VBtA)aa30Y
z@my%%DPje-wHiSksrMu20f-d6C9}4|Ts)#xLPo7=VPo4#rok0Ef>#hP_=#X;+dJdq
zjYH@#nC?<yBigeqd9KgF9ck4ys1H*`j~COOfrg^n0ALaJXN2+E3G`Nx#Hdb=H!|$T
zVh!xioq~2kYbCQ%?0T1Yv2_&Vwpb$MiUw?Y%*%ztA%wML)pN^<^6}4pYzV_rpAV~X
z@d_*#WQAve)9y{=aOx2%@b`C}=e4sCw<-_;2stNng-pspECSHiNNRrV)-Ff@JboMM
z^v8J=rlE_EhC|ytb(L__(AQ%5`O=7fvmMh>gdC_onZ<6hzMh)TQu$nkaxkdV7G~Xk
z|0jF1Ph0b6f1qh_=qbe#-g(Lj+o();DZO5q)5TtrI;S`}`LvuAcrI#;9Q-YCw4hh9
z6_pfE>*oVQ(?`}-cGir;;!NM88M)9VdIPwwFji71bCDxJJ#5qzOP47JS9yY{(r>Cm
zk^{j0e4in+)hZKNH6Kp=g!j1qG@o}~jIAep4|>^&5`BAdilQMtETW?#JCYaIlPW61
zT6=wX4-jAm2vAa@P48#qC{RK~fT0MR2#2UN`oV}U+;ZdT^etBjm+juIA3)|a_mttz
z{Y{~W4q8)!PlTN|<8yq4cHbI^1zW~!TbnGUN{VF$>t4tKf|V5Vlu6~I*7n|NJ<n-q
zobm3QKDJU4QcBQi|LAioHa(-y{w8}QXUY<0c~W)O5<mAC;Q?}}<S$$wH|<XXUzzyI
z5-%iXQC#X6E>-qdS75G>jj7CAT^stYbe1&7XXnBoA@`?NRLRc~wIS}&pftIY2Y|F@
zWTmDp>keGNd$uvg^$IDV``MG`Yf`(G^zkHCIsyvK=km2@QjET;)Tu#xH=M{2U$Ijd
zm>kTabE9wv*Fsz&1{#pK?yoo^qg4Rr4fdiHw-Qj92w(5}^Ic2#qKdTnNsk>X3q_c(
zf?JVr6bmrIo5uCm#=}6kC?{ZQGI#KO^_`YnRwr+m&#bNT9Q5qybK&Zt4=0ijFYVdN
zF}Q)~-3r_E1`A5OqLDYT?z`TqydSywDEwlUx$Bo&V0Q%!S0;X7MdpEJW?oJtsXBsY
zK^ctJsX(v;=C|E%dsKZ7^1a@R>il|rTWFBioBpE(c>lESJAChW4^UEM68NqC(~JqJ
z60Lz51A0&^t9ssR7xmf2$V>M{MFGfv`uvEM?Lw+DAsTXW(#YyKn8Y-N(uE(DNqEtS
zWbHVFk!$4?Hev|?=nET$24$vbJM@05Lo|*$*;kjDQ*<6CY3d<C$vn#U-E$O)5^F?P
zN9!<9U4$V1hpm;GTsQwVk>$??{HplKR<hb`Ug?S@#(>}e#^g+bP7yP)By<W12<TYb
zfpP;@$gd(L5i_wMa1BZL`_-uMG*%G+5*M#7Te~pJ%TZKR)TvyX%S>l8Bwj+D9W`U?
z){1ZY;qL~Vgw%k<A~2Gh5XkJeBnaa6H^9XB(F!2Y)|VDiT)G>Dp?$I=;MK3|Y_+u-
z$(b<@<R=`6_aJE0t4vdk7{wXhs^Ip<HA}GzB;d<V1#%7PXsmdclyC<#C<jTgA>WI-
z*`hvC*S%EKSI8GJpQKHfbQm-k6$r!6|8#h0`*BJMueSj8FJaTy+azYK${iQ^S??^g
z2Pdtz<7ac5x(|uf(`l-=v6||4B}d16@=-w#{DSlD{r23Db~09AY?1FmHKy*s>o?_Z
z3jjI(G{BAkC)d6V1CoN%1eSx95YRxv4Wbuqp-!4(Wm*}BVaOtQC|a91Ex9y18mAgs
z6P}C#6wFTHRJ}ohWdz#dE2CcCX_<xc8*44DH$IcOoo%P{mKAk5T!;((6Is0%NPtkf
z`I1zQxu>aLfWyzl+wFCg!4_qc6=*%SdSgZZpn`KGdIt!_)DeKaEk#)WcY2%N_cy~_
z^El{$!>gA2sR`47NXE3-VG%&eV0`W<@b)_Yq^_J)a!{7I`?W2#zFp7vvJPr5$)8HV
zSa7Qs7TzF`cl?YxpxVMpWkCXiw3#){-f|(zln53FFzv!kCE&btc?-zYa{m>N&Gu16
ziOVFr5?rp9*xoW;rj7e5f<jM$x?vPlk2Ajxa&f3;#O`FbR*P-y;a!2YsQ&LXxwlD)
z<r)JsKpO^mQ?q~>2tb^p<7z~#xJbcHpMq8{2a?GJCSMwRUfEh}1YwJ9V|s*)HToSv
z55bMw7xZIgo*84RalHP^5vf_f(Y=+&KXf14F1?<lc%J*XzuBi?0|ap60zUB6Hknia
zA|*{`2mf;i6z99>q+X8p7NPtFqXabt?EXGMeaw-n#;kg1+iG6aDkD~=vMsF;Px9jj
zQ6lnk9CKpYHDt+2@4TJ7Df)~pN-L_*SFmxD32{Juz02Wj!djODAwI(<90gTc*my2g
z<w?I8SfT+qm=FgtK?z1r^lp)JS^A{deRGSIbc+P~Xf?zfNz}<=BG*$brMB^kbMoFO
zTM49R&uT?%Q6kl~rG5WvQxO)b`iumJ(Zs8Sigw0pF2>c`;nomhCb(ty01WKt*bk=X
zKL#{{Nd?SgI$Xg~+BKJye4!0S-Kco5x3p@38gAtVD(XAhr+IIBi7Hg}8S<oQ)DXD?
zp7s<hxc*ari9OH{@x>0FAj<+~lEJvq-iFjHUsygb{eNB&s)e=yH~fK7$0}NKqx9NF
zAR$$o_oGscX_(=DGN1A~SqPW)(ZQ&MxL9~vK+JAw`7ntwB|b%h&!S6ZHroYs(Q02h
z0xmWU6^JpWL<={lOEBi--kbV#v<*ASY-;f?30*RerHjxDM>>St{dOymCW#JK12>pJ
z8nmBcf7zrRdS3>{EBneYgymQ8v6tB83_N*>dBW@7y?IV%6t`b*jA(R_jy?&m<m$WH
znOt=ef8u3YQowkABj;TfBnU86rkLcjmos&1PEDd}ac+=wmTSOF!aHzFb1tr_=~Br^
z#x$LPAdwpYN0L`6T`pf6u2}A>){#9rrf@Sz-l^D7n2)P-bw7j}NPv?AB>!sm$mzKP
zn5>X{&wY7Zkby6BYSdgPU15;_SxDQ}W*CbJSHBQ7e0@N+ebwa9P~x__*z$-6TS>a7
z$%~G1nlP97!Y!4WZ84&gRli4)S1<K5#%>9GeYXQ^0%TI2S2gpa=_!>F-U_{p^-ws_
zBy(y@cg=_jWrMqJc%jGwAdsViqPNd(of!F4wJrmno3_}I$dDvrc5Sxycs!gh;Hyq8
zw6!OSS?`^lb>8mdqu2w|FLI4)6a5EE^EmIueaO*!uxlIh*2<$Ds3CL=CQw6Xq9YCg
zkQu}52M3>fa#o~1qLl5T={HvC7NMM_;?<Atu(znvU+1~?*UFrMd#khKC14S79q<Z$
zhnlRptQPbGFIVG^R|WLo)}+vXX_u9+b2Z;ptz5Jun{9P;5?C&<>|xWw^40jYa$)I8
z-zV(4+9t7b{(CD|p5*m*j7RiHPvG;&9wPkFfIAes0W*|Iv7OJ`3d;ttEHv>?-0s(f
zv9IiJZr_PB$a;-jO7~|AU&R)yBp)_rf@FSr4`Nc#WsE(a0~h<KuRai@R6_t%xmP1a
zKZ_#Jnf%DXaWN2vEmEJ;M=(brOKzKOnJXcf30qmR28v7<Mc9ZqxFe4xR3j)FB8&if
z=Az)LHZdyRY69Qc5wNNfFqoJEaXVYCFO&?(Rgr5<h`tuxzuYQr7h1_3arWb{L#FW%
z6wz4$H>B4{d!W>w)uVx~PSP#1R@EMgi9(NT52N~r2Q=}+Ev=OCQLenLKB$?Pn~&D8
zLKz{@VHk?Jv982Vpp3iVEvAU5aIggQ$^z=`+GvH(CNvB%v|5P>mwN3wv<h$|pUYKk
z%V*F60YH-i9;j(kN5<Cj4ZMEW5MtnwPus)qjQp@*M+~m?mtz5qP^qn@yM7oKVXkJq
zJ1l(M5hTO{_UByLC&7X~%Z})|)1CM_{(TNfkJ~&?>&xq7ZwNz4KN2&)cKdwEe7+9&
zeP1d$zS)c2wyD3Q)joD_9cO_iKpo=u@Nu<37rX#E7VCE>&DDlIPq|`j|9oYAnh1<8
zi@iMAo-u?Cm$QdgbHkYMF}_XuT~Ul)FKN1p^<+NF*BD`JeqERC<juCZLic)XOu6<t
z>2(;|Ad{whn~TwNjMv5U&Ieq@uMLMBTV0KtK?=fA9iRC$DfI0bp9g3F)y;0%^(c1i
zpMnbL53i^ESH+U5^^v2jGgs`VF2)HN^v#dQ1hK@*APN`{{bj6t79^TN@adinsC9}h
z+o)J}N$sH`^$p+S=|uPn7LDIT37G0??`B>nevd)F1yN;|um#2<U+S1z<JUQ*PGb%K
zc7|xDKwU{K;Yu+Nc)ds0t;Ri8P*SNZI<{2E>(WssV4yZ+1P)84u79M#_~iU#5WjQ}
zA8Usr_8<S9Z<lIRKt(2`Or;N7Jb71fi9&dZf@~AfYDlTcn4sNtE%;T?=F`2&Co6St
zZ>da)z?ATe>(yN@b0uH84^vnQNJN6C+kd?B3O`m{vjOZKfVnXOdAiqD|73~3r!Jfk
zDBe?9k0BAm8#T+f;_S6)e4hv;F#w(0qoulmCcI44Z^l||KFo_8eZF>$g|lPlU*$ZS
z`n@WHi{p*5S*EFPJBJClXpFL(bfZh3*=OGx?=lMa<$iLY_1{l7oOtCzI3@bcSf^$S
zIAUNJCssG-aV_N-1Es({djFwuWG1N+5$>ww>^ADDA?$cC7IjvHtRQ(ax{zMu{?O!2
zyyZ4~JiBs~<?nop;2L`X1UR^Cat>@}%-=WTf-o0t%iEM^C0If;)mhM3RCgu**z4ly
z%$a_+`>M#1Kb@yK$TisBeCq~%(HeyU`$w#3b=;oqD#C#Hz9=@`uq;^=Zq3n!<e(jH
zumbtLN-g4RULvcpetKvw-f;KVR~}i>Q%4{Dek{?_k&f%lAU&e~xWerRlIYa(s=QZ7
z&Fw^ch90GX?Yjv0p!}ro+ORL9xyx~jQ6KS`FTZbOFpYq}yj<)EuM<^oRt&_+Y$T;7
zBmYb``&wN}s0`w@AY{WK<Es|3^@%FDQ-0EeG-cZ0&`Zp18tUpzr2R>PQ~T>)0j6Ud
zt1xT(Hw0tP6A^j%7i~Zqo5EuZ40<-~l$!GunZ%maUz%MT;X#zoBd7Z)h86MXm&lpI
zZa@*Wj^m3id8M8XU%C<$Kb718aza`%D%0=hEU#_n;<YxFUeR7prH8j^XDW2nm%NT}
z6ViMiPc~<wlw|P5-w6Zh`NS7vn4?Y!4I5r_n$E(mC>JdC5%s}!*XPzdf`q6nzis+|
zw=uSh!KJa|viN<cL~KUWrS*uB+&^RSLH|w&p(*&r%HJ4ew@gfj!d4+mn#@?J8da}F
z)LfIhqw@=7YZVC|O^Gj!O)Ebn#89f~zz<|z5DE=;?;J%nlw@>PG-QzO15zvGMVoU*
zip7u%m{qI!C-(1Zi&D5EEv3N_%rYbMVDrvgi%U)DsPZGkdJ(NQ#f?^17a?ffw|;#^
zjE!HsG#wgtC*xvpfKVUq9XT<$8Or$9P-<YtV6|S;od7e1?xbBVH$#{u-%xq6z=Y;2
z>_#C5=8pIMg;AXp`<dW?jqyrU7aQml$^>my9msBQ_6ybvPMW{xiab7FSm8~oHKNGV
z9_wBZ(w+zNf?L%~!x>@+b9*5ys*>flH6Jv$&i><9+O?uDVLtUIJ33xy9#nVG<S<V}
zUy_;KueV2i<3qNe_0PqK44ZoV#m&|)rwIBVMg-+@9QO;yU$h*GwOR9ddqdpKPn2JF
zvvst;1wJu%Hhtv@0p9mZ!fy^^U1=Q#8zh|2MxU?F&rwrTVccG{{V6DTo&|5E=Lb1m
zw<{qdEDByn_k(E#M-^SPRW<Y!^}%*l>ShxU_|1cSAN)DY*iU5G14?MYrxbI8<18Ng
z&#lPsiGF;{x5u+(SH5+eV)T=00ZcINTXG1{lSHIt{pEObmP`f&!4B(<_$~YWZ{(^=
zgw~-{y6etvgfmF_lR@&3bC;-q?MTT@PC7?~6jdK$g%QI&&1@UKxSumP1Qg+iM8E7c
zPa~YE9Fi2d6MwD;{#--?IJ>^gm*;P~j+@&b@e>gm%GhHUOHu$*9VJ&Us6y{wWax|_
z77Rf*+-M{iC0l8!-eyEo<thx)V{^}9a(@CmlyJt-lgBE$EV({WH|{CP3>a`_K*$pN
z9Y+?eqba%iQW}a6puCD%>!o|}i|vu;3bE(@5(BQe@;hZC=2@qkEV@o;h8i#=*fC)&
zBn5%C{XFSc8uhod0OmX_<d*kI-Oa@<Uv}B(Fc^+5=4^+F3s<tQIVD302mxC-d;E4R
z(7V##IW<3oqkI+At82FPoqsAe#XSI}Yo6)So>Aa;Cak4>>Xw8Z76E6iD7IM%?T4=G
zRj$?h-;BMNZ3KOI4VHAF_{-tC=ND=zspiWWmYl?qC@lQz3T&|JG)2*~&A)Bu2$gzK
zotZaRnlr!m0?hcY9^~|~{K%wT4@--^O8kE4OGg3>qd_Zy66*FAH8ih}?A*H6e$SGi
zR=RVZWZao*Q%N}7h!@x%cq4I~WO+<Y3xxB%r|hS64a=4Jqh`l-CO<=uSOaN2sP7?1
z<$y+cw%VqG0F)96x;(VByTfy37_&CZx>{&+@Jjd^&L3m>4|S)$QZ9*p+~*RY+#dP>
z4)}c2JP&%D40B3Z!~5yJpp}}ajV_M!l0DK`3)JC#NkZIfH3vYweiqCm4n&<#L|wuf
z<8ik2J+C?BqqDo~zm2r)v%RV4drVtQ`<12k;~m&w<lxJe(G1JX!rx4ksPZ%~1ZT*l
zr>YUB4H^T8N4WcR*GEu~%X#!BS8e~683=hW(Mn&1m8GLDCo?A=WIE`0F>Mfq$wRXL
z?pqeqbo+&d2g$1L?t<{Qha(xxfJk&^{Xkd8(jOI5#pTB&bPzKIT^e^YnoW)&Rum8*
zzx?)scctpQaFth<ow9Kui%EOsceMRV|8jyYOLj5PwF3FABEOnOpOBmdW0mz}Cs+po
z(HXH8Dk@V#v44WZ<u2RhW**^AQ@TZGcO<-91Qc*C;mVNAjPGqQI5kld7rv&gl@&h9
zV<+z?>hH9*I~yB<BjDmR1}j)SH?%~c_!5RE^ZtctId@^IruBYqdE;x$bJh~YWRSsV
zAQ%$ezV(R~mBueD=9?2WFBUB2!9eO>|Ngp4gVr6l8|`*BX!+O>90HH^aKX$L)hKxe
zz`Z+~H<h=WIeGDUz1LMNCH574f5j1_2P_6J-Dfmuo5C$c*H68FO&!*LM=*6YtQB2z
zT|JRDlkocFR;pdU(kP1YAZ7V*msRLE)&EVyLsj@+!bak|9EBl&+m9r#YnX<L#cccc
zjQaW@aU37JvA*PbJ?If6Bul(og7;@)IiH|nRr=hkPdd43LGA-zDNVK8=6~NM&hcb?
z)`sZ9w?iSN8e6p$Je#xQIRAy^D}^fKISL7RU$)=%0Wa~d<HT)NP*5|}Q3V*~;2gkn
zI3+|0@h$Pq7jS<x3NZER$Lj>&I=rhfH~*f?6V6a*^og*{07t#me@6Y|DQ9xL2s-B9
z5005=UBX}C$?%E;wr?d4^_1^@KDWFI3b#ZS5dd+Im4rlUj^W=EN!~-raj6XcRG1pP
zd~3y8+4P+IZlYjdbb)<c!YM0r!6o_MS2VxvAx}0dzlRE~A1f5M%dgiH|Nm)_acl3X
z$t9uw|7o3Z%M_@!_rAAXFxfZ27b}z9flO1`^=!DQF%s@2hHs_TV)3W`z<_O)I^;Kf
z`N|gif3@B4q?fS^m24jq-9Neo1)V-)$yHY!`us#qw(dTWHT9i(OM8L3h(PEZtQCcH
zX^62qVt06L8@kf7%6Ra`Aw<FMT`Zj#b{A=%wuF}Z@)N9*hu(TKSm?N49Mw_&d^ia=
z&S2m@-tpY&DvAGRjQ_RxSmJTsz~bpg%x?*Q?WQU}d03YpiJjLC-(N0%D(GR{32Gn!
zxV2tjY}e3j{Q_HxJJCE06MsV;(}Ovx8_v}7O2yS4WZv?RrjU>LKBI2tRCbgI@i`c1
zSQ`XBJVa4e5d{VPw&#e#cZ!ui#qVPj1i!!K`8PCzCTa@V;w<MuPn&~PtQ@b1z*HBt
zr!4jPD0;8#qsn!~|Gh+BnCdqsL;0wzAobO>FBe1DO}!Af`kNE!)EeNG_kv2C&|yds
z;7>WX`iz&H<12$6vIb^D^;hJbD{@(V>`Fu5{hDK5fUcdv3-Jk<Dek>}&qGeUyrne(
z;`9<-=Pm`mQj<r&XIf!AXgNV9>U4~oAz3l2s3H<PzK9o71QjVbG^&E%K^IXDJ+@Xs
zBx$77fBL1C>#zTS=Flx)L-X8opay17jI&dO^}q8jV}zW@)-qtldiRd+y*lXlI^uj5
zo@je6x@p*00mHTR1sce*Jd+1rb<y4xY>bgalZ1tSQz<>l)ka#%IC`-I=6P-Ogt^-l
z07v_09O%N`^#9mGNH$jrjQk7!@w~s**Wg^;1`I;r9SG+<R#4v92G-Gvh}Mb&_UchA
zj6M-iE!MADu^FtrT8Cmk{id-UgMPGIj0kv#FgPN4zXw_@Np4o(IpDOI2S^3<Q)|?t
z9^H!As~V0-In%OtueL5HIQTxUd{@8tQOSC_fIzHfy4{V5Bql{vJ{?GW*Y2QYX^l>>
zcuNOp?fmmajOrNSuMmYFB%-@-6C6p(@r<t6QF%7gM38zhxj=e>Hu{DaxEzhW`1SEk
zaP+v~>aWI_W^{w~9x~5>5l87);0l;tF#{0@7JCrCUYYY1KbIR*7cRmwn!z-HDQ5Bb
zpi}gY1PG3;xY5QU^r%p+VOgbubt#Q@-{7zz<BO9FeFqmgN+?^Bx0eg5UKdG3bzBzh
zU?IjZV+-%ITaY@h<L=h~CS)Y;h3S3O+NaKq7adJ*r^lH>&7E;4>O6@pu)018zU?Ho
zD7U24zO@U?b1TQj0`Cq7k_m$v8ntQBQ!<PO=e=H(Xm|isB<7k*UoQ1A=|(P&ABS+#
z7vB0ChyBAHk<tfa`Nu$WjT`DDibf0$43=gDSI%N8Cphm}02l`xlC9yMSSDR5r*~zR
zu<Ell<*S+T`cTW*cVQG&G&X(9B}O;I+qk}FuprYiuoqn<!4Nh9ovFROfF|()6FDXD
zl&itAt~y=RN04OqA3sL2EC?_j?+)<>D2Ug<&1^s2VXQ+`X4zMe{StX=5^>VUc}HfC
z*g*}b1*xqiET*eS5Qip?8_H=@IFBlUFp|`5Zv`NtMN)!W>-h81@T?lj$un<x{u+!3
zACByf;H4nCz7@^ITK$uDTq*s`iag5YR>hvoW%RDJALa&4BeT+o>XQn01#7(#0gEaY
z-QD}*_TjCwkW8yC7A>X@_n0MMMAyKhv+*Md25`F8VkELOdCj5qt6TOkG8^xk`E#DE
z>#Shsd&A(xMf3*ZCoPBzO<_-f9!qXRD@1~45**z|ME1v@ESLsB*ztUzpmhdP;_oIa
zidaK7p+>+-FV^rna^P$PiLmqV<I4WNUfHY*mh}lJEk$msPfcxr{Pz1_qVsmc<tXKP
zSvP&KrAjpy>KN^ef9V%lyBnquOPcq=483V@P-lmUOa-sB!~TvQWZY=X;+OdJqdz6t
z{fXBMt0Vn-Z4_GL;;4gQkJwg2-}5kPrOy5U*TeyU-uJwYY}@XY6!@`wJT(xpfr^EY
z%M$+|Wn9x55jfvnVrw4G-63iAt&v&W@dJ5!5K$J<W^$&enOHMRr<^LG!Vbr4Se2O$
z%>Y26zeO(r9ZvdaQcHH}81TgO1PB!7ZXGam<y#Mw#sh*gibl7y{*}@85#%78uqOd0
zYP=+Z_3ZzXxeVmN#CZ~``<C%9yex|YKmc0jynfVN+Z6EYJ&WO~D|mJ}=*`r6k+EGp
zrnrD}*>3vkZQm@$y_`36V}z;(<0=rpE(il#Q>1AWXoEg89GZ&ctC%eZQ3!=F)t$4L
z<87UfSW%^9!(NkTwB5?7A64Lf$Rp1$v@$=Vo9R_FgmD8+yLLNwp%jgMasIN3zd14n
za1#QacZj0U9*U-&h&;HAj*Kdz+`G?r3z-lMM*$o<98oX;3I)&-nCl@G=cnFEXT(~<
z{K}W*ns1p2aVP;RTA36q6A=l5Ii0#DnWlx+$Yipy5-65)AVkk<sZ?j2@vd9TzR@6h
z*gR0TKZ$itz>@IIVcKnu>e2UK9sB}qWfEWK_e3kE`_p=q!33J`IH05aMwTPW$ONsJ
zhODY#`NMUk1(C9kU3Yo_)$<krriTINPNt_5mH`e}&Irl+ZE0ZQw#xzxSdZ%NX*<RY
zA-h@jh2^}sR`qtPm0%0UVjs66!Es@dNrjB{YX8*KR2<w2LX5W5&@Vqy2pFDYXzH0B
z<nTh|Q7B=}^xwNtr9txq?0lbw`4w=g6(U>&02$1Ft6YEp1C+~u;kb>)DCcsa6_Na!
zi-7<mgLSCONx)@M#Q*8ty|z=gj}oN-eYZT)9WFCRWW=*+6L7&JiY46`gLJCii-5|r
z$$Kp^@@=tcL5`{5d)@|NdBtv<A{M3Y=OctZ4*J2KJ54vrWOx54^vbuspQ{Ay#|Q=m
z3YRYI)3eU@@W)8!6XI_&#v*L!RG>LyE_GZ$pV1@)C1WAjGlz9JYyEnoG?n1D3_5p?
zp?wxVdIKO}3;-Y`wJiUbX<{=fNH&<6RO>f!i8Ho`hyx8mSJ^%LpPc`)qkeJd-YrSP
z6=W#0nYF1f0_zz1FH4eb??^=mftaIBu_XcPcccv4^tUw4v;l>XWy7;YxLlZkEPtNi
z_UT2;GI9Gg18M8!%iwQ3l~h872MYtufC0dYYBZKp{dTg^_UQ$XleZs5m8{-2>B2At
z4tlY4ygNuSz*sigKqoD!`bCl>wCxYsN!A$8+(4on5A0QiAXOM_;LL})`@H9Lv>+$f
z55Qh<3{(xLLCt#I+D`W7bVMvlr=<UF{3|v4QN2Q4?%3HdL`<yVth_>zYJ{tvAZuEa
z7zG82TKV=}iuQZ3V*Wsf-;6#?MpH%)Q!PppYnBg|00pK;B{Q6D$QFd5&K=cs3?0Id
zUy3x7KWEzLdFXNr=|Vh+Z-?sI5P}4$x9Nl(&{z(m%wkn~6M<Opg6(p8v+AGEi5xjV
z8;3GGcZ~uymYTqg|EIMF3N<NCbDOdAze*j~s}t?S<ce&p{)>}kvnzjVH(=K1W<|R0
z94MvM_5D?WP@2b>ia#<wN)u6Mf#D1wFb4Q3_5ckJGk3X9PsZ<r&kkn~BQ8p`(C$H+
z6EGK`Jv5ralM-0IqxpXe76wp5{W=9(+R$BPS$o2|Q^RD%N6k*hG%Y@W#2WiH`&6U4
ze>yyXZW>>&!C<K3BP#xH)-$2A2UC)^l%}vljj}w30vyZw;Yeu}np~^)Xy`0H>Lo+@
z75|wKEPrF;$J3|nS3<u(j!qFXGG%Um5L^L&ehb$qGjd7fgp&eX7}CU)rURjeud2(l
zJU{TfJ_@=b6g~!~;BD!3ezpG9^mYe{kg+(0gBTrG1$&ermBD1Xzk*&LXvdHHW>0Y<
zU0)+2;jGpcEvz-(lgST)<z{RKmNmU((nSNSu0egmDv(hB!>{qvH>ygaYO5{@4;))1
zS4%{XE2G_a2A5I?quq54PN%tj2y@W(4nDt`GE>)6j3yiP(MWY{A1aT)u+Br|utZZC
z^cE=(x2Qg7TMfa@*l_aR`vq##o?5NpKoi^&%(fX?Q_!L2Q3hY2k7r^wVBuUQ3#gSP
zd@ETL8X%7UqXnSb-UR|T8`S`#qyX^f3J7vZ{P(^zAhuXbU$6p6LsYM`6eX)(v=}1#
zwA9qgNP^}l$SNsq64agc7d2Vn#&RJAY#*sia8+S|LfTg)7uP}#efCz!`f<O$E)^Cd
zD6t)G>)-*W=RLDk4XVA1ZlZd26Fx#JQSh+iD02~B;q*ohoRs(FaZJlH=GCU9*8GbF
z1l#U@Xl+atNZ4vktk~GSo6WqAZYalj_kPGWqS`mVni$CrFi@aLc7=LAyy(#gO1ZJ9
z$M|l}{2poYdnfcQo%9hJE9_XkM1QK_ni^igh;Q)H7w+uE)>30DAMU<*sE&y&jL;<1
z6)A!pdaS&7f!>Q~i{EXnax(D<VyXVwK3|JzOfjf49!JFgAB??oa3)drHTnb-I}=+I
zYhq8#iEZ1qZQHhOCllMr6Weyayzjlg`&C_3-G5GXRd;n)_1Sx$z4lpaAE#m5K~uRF
z>eEqkQJvm0WM!JZLlvY^b;c0TZ&>L;oDMgz0upPqD;6A;SWzAraq~wjuszvpTNBaA
zH<62>qldf}Yr~g|L;gkNKX~~+Nmrk9Em%7tIl77@lP-kS`ap!AiWb0h4FN2i%1Z-b
z48(wwpCDiqn|rdlU$nuN0)}h~lM!l+yOP?6UTT-J5TW;e)t1+vndH=wVV>2J;uK?`
z17z6oM^>QHj*`8;6U-%GfSlxvc^g9b=aQ1UafSG>mF{uGC@;bk-WWw?7XrR1FaFi@
zo+GJzIFW<MG?6cKTpLSn1(Fe1v$b#!+x0-o^Bb-;ny)f(?~e{|;rQ0SSHq5$Q3IXc
zP@qfr%y*8<o!#8gR(-WH4Bq%_+Jk9AiAb%k{$Yc`V%Puiiq$|=WLIyf?$l^tO<rh-
zO9bSjh9U;e?i$R9h|^XJxxK_P>yeF~6a{ZaWC5kDTOS8DP^)EODL(5WQe2qOy@SZu
zWwm0AO85Vza;vtgy!a#=@v1zo5-GAMhyK`YyP!loji&oTOo6WZifc&I+ovhnj3TPW
zUOh43TeZ%3%|i15-jgE~j=+CW;cWpNy#_ZUg=5?cwz6t^HsgDZ8b0M%al`85a=)(>
z_X1(Yi+tSjWqbW_`?A=iy_ZD@anW1jN<H?|;3F9#O|REgwzWds<uv%jeZ~`r1{;p_
z`;Ehw2q`kp=sJY6oFFT;4MZXl=p)-sS(o4X-|i&(<7iI>sSejh8w4<VGiPC{^0~PU
zjTtEcOfHy3f^!_S@sO1*h?%R$Ww3@*B|O1Cv>q<HHTd~T+S!EdkTdjb0^+;8;|yn=
z?2~~N#BOts<>v>OCESJTe(O5#B2S9I)_IS765TGk*$%hec24r#ObwH1*)5n&m4CI;
zUu}7{{Mj^omp};COGFD&!MZK$4R1;%#c}n!*wZgXBp)aXX97Tt&##ktH>SiV{~WBi
z;<rQdnB3IU%<3M7n@EeXE4WtV>Rf;ZFt@SCLt$@UBuJ#%pWCF`^h@&GIGf1&%0(;)
zk(LS%1>0)K)yYM%oQL582wPi!@KG{Uv#A4y{UIq-=9O2boQDm?R9wL_CTTkz=ycPe
z8-}-oO!%>o++ZAh=sc2Ih3QonRD5fUqRLBX&b@X@1s92@S|n$mnL59y^wEh|4f%~3
z6NC23IroG2hHP%uD7bmB?R}5!$RX@b)3LC!zX@kV#uIf_R{h!&``5!ro$UBC#B>C<
zzJ4`%b$DXzL50n>F(a$o)Q2<jiG#Y5DB6hq(?^r%ab?NhldIbqu^Pc>!CfpB1lQ_-
z=HM-0_~HPjKy>_=y70rkS2a))vhGr5gYkdXZ$ke59?0e7l{RP(onRa#1LlsNh<S?{
zX-YK}|DQNb5FA^Y;qwFoIWI0<x{$z;S><?<c#)?WXR7Z)3-46Zl$aD^5iWxV<)=Hc
z^w0kbk&$v2*IxcIh*?tQgzctuwTeK)u}zF#+!C~$%irgF5|W;K>Z!UifccNJ>>ctN
z+R1<e$^ROQ7l?uofiaBXmATC*T*LMqTaR)Dg~o?aqFjXfW&HuOded#iCHT4t?GBUq
zpJ2rAkEyEAm$yBSbP1i>l&_!BXf%2~SK?Zo?h#s3-G7$ysezt!|6z0Xwvw-n@eEk6
z@$>lo%xm`hTT<>RYkTu&L>uz}9MI04xgN#xCi^Z+{i_n=my}SzSA$E|jU1ZJTUwio
zhWiyXQ69M1ao$rj8M7St;O$!N6CD-$xo;`Oa|<<9cz960;)xh}P;zW+>=x@kYv-q}
zv?oCnd9lkbN~mLAKHl22%`^p*sZ2BCTN(X6>J?cy@=V))=>KD&(}_Lw))L*;oqQ7)
z`zesVvZ<Bshidf28piqZ!FG2Rh$_v#^Z$1k<by>9b&}|#G$E(MccfEvl<52ZjP_w5
z>XfMvo)F@x=lwRya-0IVG`pQ!uh?4;ErhbD7`I#Yp3sy}_t$MMPtH$4Jj*8wdGDbj
zu{^U{>-#A77k?76GoAj~qA;J3%%SStXUOBWk*4~s<}1lIW(p>uSMEAOLv_A_l;{*=
zwI@%X!?+-$p>ul%cz&PF@K!c|hvBFxi8?Nx17JXeQ36J_R!PbS8^8EML;K21dd%u=
z@QZ!WJ1}Xah=bFjq`Yl*lnm;N>mID57B5Ef2WyFsb~}=RrntmVTLgNU%KL`!6%P{=
zub7In{pMTD*3E{@3H-gNS8&(;(J*;XNWm+OG}l!YQD4PKqsL{N*;-)Vre_Qv3fFa(
z;$InL$`*^r^xN}%jH}N23`D1Wy!V$)aspQ;tK<TXj{@S!u_6pVV|aDIpN&`U2Dhho
z-jYM7C=W)p_0$tyYo)1nN;;=c`|WDy8%d^pWl2G`x3RgIKS~8N3D$@aadAR~zELTp
z4f8$YCei`R*e&drdBGL}Kdx3?a6#cnAECA0W=?+=D~{f|jEncw!9W6#`1GEsK|faO
zUf8Bi4P`tL#m-V1%(E#xgCiIV%5(q#Rq6Uhf}#b~R^OE5wU@A%LMh~6RU&8KhAU9O
zspPvCKffopt=S=0D9Al<XqF87?jvG9^DfDeDkESZ*)2?VfA{q{yz~pU@$=bw_>y}U
z$2#12V)zt6?J}nN*pY1#*VE`St-T;PW2D|I>sRXOI~k+bw$h85)2nmefYI(>ka=?V
zK^Jrd9jVOsu)m;xzSRbOPn+jl#L6ZBdR}Yo8{^@13oF_*9F*N%{wbYG^G+=#)9q4m
zGugZmcx3v`qxpfH#2i+io7<C?rBw@#-<ZEP2tG$GYoxVfVQ9|y#@#==<}!^D`UV#d
zy06-~aZNld6nA$MG*NrTE~w@=%BM8SjCak`UtI?Um)k-zba|CtA8@d2KCBy9Mt*6K
zRQzHoU7&-;#Js-#_(Xlh>Jm;YPWMsGym^&LLa$c)-ZWH8BQc7wstYl{s~6Ebr|P}|
zRBim4eDhc10ALynv0ah$aG$BBc+7IPMTnstnef>qVuJ{P8i(O!T!>%eQw>KJd-D@I
zYbTG*`^3$i4(1R0wb!ws>g#c3$HGvZX*kFbvHC#-BEzu5xb^{WXLHh&thrqwd}&^$
zF^tB4NK<L27c@ARr{hGGk}4dYLOzz8(1qmKX408gj6!!OI0gJ7zM&K~=f^8?QCi*3
zi}<N;GB+b8K<&0={4!&1Ty=^rG-sAg_p5a0X;sebf=j9#*tm?=o|hmdyjiv+oU-_$
zSY|J@&HE>`L;d;=tmXQ>XP=~^;wau!i}Il`F2U50{`3&Wdglk%0SRB-E$3ct>&=B8
zql-1817N19=i!a^Dw?%M=YBBbaD_vL`*RO{d57n6U0r<>6-l9^?y2YQpMN0Iwk^ry
z1<&&dflm(KMuF*9j84zTYF|JGY}1KQoz|(xPzaaG<j&ca=k|kO^Jp02L`F|>N104b
z$)g6dnP8kTS~MNZq`7*jvgRnu`0~UR2{Y4>{w>4qc?u%;r^f?or~K9>=#sk`g}IIr
z_Lw3iv-n0o^uO2`%Y%g!2zYdNUf~bkScLN<Ct;;_Wll8{Vnw%h&MjMbaG4}Tt9@It
zY`ew}wEUW$#v2mj<@kU+(*0j`R{(uUJxZL^a}m#W1s%kAcOq1F-A+?J$nD+3iETwe
z>6EWe6mJyCaXb6{!5+b>jr2a4c{;N2NIcJK7~$Q{1VkVAt^KH(nLLm?APf!;6lo4n
zPTmE~UL{Md_MhBl3x?v)#glcOHwgMKZb#n?M@OsK+bi0z4pL<WtB|m*3x^2cS6%(Y
zB=aZ4S4Xl_z6x2leXG?W!r$hKtp{rRLQ;4XUK00%2>b&L2MkXNmuz%y7q>_=_g#k$
zBLv^@0_}@>OKjk+-te3uJ}>e0X9(9YX2P#-<Jr$ka-mJM8Yg%5XyyQ&Bxf`;>&-#_
zGGjTugDyH)(K@T~X&MgU_P_AmcLA6{j<6W(YNdquzs(}bV~-n-9Ri_Ob2S4VS#&S&
z7w=Mi47b6)8t5*p#spsWDas$swZ=-(iL}i__-p2^h{(ZJCTDbYpHKO+Lvm?-)F4Qy
zG`?kOact1(B#$^kR55jXK6a}?&-bK#{G=D)d{05WJAnY(ytr8ku}T9*yrDi9IRgZ)
zCi&`G)D#L7%<ytd<*E25dJ|9(#<|p0#T*)f)hVpr@wSV8zA9I<=qZc{sy^_<+JXvm
zl!f2n<LjlyI@m0N$8!O>X-pWWqI(2r@0B!8Xbyoh(Wrw&5F>{+tpQ-ar$7129V?iM
zqEOo5$qq`e4^1PxhCmXa+6E05p_I&V(_SM4ZHj5scwf0nb_7Olc9C4n=1mqI{w1f#
zqd13Pu4f-vCd**-(<X~VqeGtH;`Hp!aX8)h$Aq*imz;)pCyu=Akau90D>^=~4P{<s
z<ESNtpbb>(q)l?r1E1!DJ*N;if!da_uB{)4ut#Y+lPBkM+*uUOlAzT<n!8FDNM%&Y
zKwxviO(oe!qoe&8bA_FwovHGY0Lwkz<(B?|8PLl)^Uh$}dDg<IV>`pyuKUB?XHHYC
ztRyRap}U+pu~gofW$nxBV=zP9342^jKYN~>2038ULNy$@MzuKRs(hy<QHZ--##IK6
z0Tgh9Dnc_K(;h$b3hdc!J{5)*w7Cg4dSzUe^TJF2$LB;kYm`W*msV{M>wxWzl`Emf
zm?tgHeo(15cuJ++CWW#5i9#~&WUDAIa)lU@-J(l)O71m7LQ-Hec7>;md!A88$I$s%
z$`AJLJ$3xHM_M=AEeH4X_38?Y<dK`t$KkTkIg$ys*5ms9dg(ehG=q|dZLPh|W}smj
zsjbm5W>5+$IyPtP<ni$b82QkL_W=0g)w#vB#%9puqpCEqeRj8b((R$+Sg{pOb!_sv
zz-C}0BxAs2PaMbQ%o~T?;;3gSB69wL7mChN(O4noa3&>DX6%(RV}<3_!gr!y`Em=}
z@n&2J`^`OIF-xe5OG@XVZkAk!cZ6S96cU={$NBw=@7|zZtA4*;pRUwYa~@E2D=SQ|
z5WdkKE}49S;Zv%^oYIa8U>FX+qMMIG>@0OVmGq?&=+B-Z?<8zBXSML6|IhD~n-8lF
zQ%!t^9!NeR-yn(BEbh6jb|<O;R=oy34avG3B%<ThOYvDlAa4&2g^EBy`^e{9yYdV*
zK}&rM-i+TvOFDkw&ymy23%@K<!@G;+)T-WF==VNk709R-pJ8h9$U<%we_ux2TP;+H
zJuN>#PebFkL*T_QJo9{{at+SH7pr3^DW{j3_r{5}cUH={3SU?1&6os#Pc0p1?qZSe
zwoF&olv7>d0PJgEP`(XbQ7D63M)@eSQ<rl--{a)lX(~KGwXgWehpO{(I8E?_mpf~K
z@Zjpr=_LVJt@&E<G4+uk!jhQzl=`D4iZRQTY^QlTMlJnY)pP;#i$Dg(Bdy3?p+qxT
z!BDiYxmPmH_+Sq9Zv&F;H>KRWb--uDfTYHAFH}ima?#6qq%Eh1=X!L{3x8UJ*DLzT
zO>K180)ns=(!DocUiDuFH8om~+}wX{-5i1H<)4k}{y?LFO?*QTTg~s`Dq~+WNg)N4
z-*Mr}%~vVzIL?i1Cv$?KSv26m{wr=fbR2eQ)O8Ee8l9ryo5S)1Isjd?&U+iTr{y(g
z2+HNk-dMg1w-6*0{?Y)93nMf?X6AHu>3<=-u?`Xzph3|BEoIE4=}@=_q6dXF2bls^
z%+x8TVkK{b2zX&)Ai?zo_P61jEMUc|dFzJQKlv$oX*V**qP^&j5=((F`;5|&IDfeP
z!=wSE+VwGbA0l++GqMgAqR6grD0|iU-QB)H7#NE>KqRqkOzf>J_YkB4YN%e?_k96T
z`*s-7cI(}hx3UAAk>n_r;9`<Z?K$D~{V4j;gZlL7pKDe{i!4?Aw9ZE7zZ@lV`7gq3
zzt@T32%cb+7~j);e=Yl6nF&odj`237)hwjx^~-x4mX#)l)TwbHKx&M!4j;>zSdx%X
z9WY8yX6tmGJkj3apqQR1$E}0(ZX@q!miP089^&-PDV7w7^;G@k+sC;9tc3ldGyQRX
zz_JZY6a+x(y<A0PQK!NFSM;b<BS`$-XwHwCYPwf_u$-=8i|ZGjh>T+d=la&V?l>sH
z94H+9O3$a{dA>|@ORb(Mn|+Bglo?5<Q@Q<=*0gG`-@AS%mw6(I+2!mwa6e70RoZG4
zx5ebJhogB(yzKU?`W3kVwZwNvXN46tHy1})IcbP}6zvM^RH~B{lt)RnfoyyE0$Ojr
zL3bPS=%iipNNxwr`~{gw>q^CHXu;NfIX*uZ=oOIwWuxsz!b=UX6;6ek4U&Z#?E5)v
zD#~0QK}HY1P7c$yx;pJ;FiKYqEewlF`J0^8UZ>V}hT=>n9SJ8A<l*hD|4vfjQfgS9
zaV!2CU+8oB?1%gXRnWgOZ8CLrF7`wnBu-*lN_`&W`GkEk($iY>OCQrCft@fN{N)dz
z5T*MI@njvoGv8SSnKKflBr<Q7cN;ysRY|)p9Ze#IMG2<P^cYRCQdiXbAo`cSoC59x
zDBnYd=And#bKcgkWDQhQdDLE_mX|mRfqwkuhsXF9Zt4`yawcp8<89Z;E(VFZwBU98
zj7Y47H6^T$q<Rl?MM_Z;rA@s|c2~N^oOqW`l8h!GsDK`Wz!b>dWJI^3q}2(H7aCVb
zP~A>@ZmP&p8|fi`mdQ_K_A!Ki;?(;ayQk)Y`hJcaOfBxYbSo3*H_VkJ;`Ej)ajh{Z
zBwem+^{+G$q_^mOT#{R_U{|vtr`WdV{A*g2jc0#(xIuceN9OpF;$_S!z8kBkPmU?F
z{EPE@e(tMF$>DlcY)@Gio!x#UWr?|4N(8m%rLM-ya#bVR*0^#vo2`2rDL@Ah;^TRQ
z5Pr1`{J17?9B7OM)A?{T_rSIe507E+j5GLQIl`CmL<P_)5#e647}bK-UU?aP3!zag
z2^h$0Q;;=N8C!jP6X$li(s1$SGP>!rS9n^_#x`JYd!8pre?+IAtyFgRGjl%izB|VR
zW4KMOAV$aIIGj;r0))n~(fc$_e~xs}OEhW&k7>GR(?R|m;qAZ^xxPoSx#M!RdyM!o
zp;f{c=H+`SnNi3u(ukR;mPvWFBkRG|@Qm1ya;9L1B=6KNo{0*PU}%MzAm(`xB!19g
zD4G8Q#%<fyl2ne)p%6#i?AETArv8)u>`fyG!=*!rh;Qlsm9kPU2|1bD40byUY|TP7
z0N6FzMrkZ1St!fray`Tll35hZqhqrvU2_u=yue&kqq_gy^YNS@{R8}q>&?e<Sf4;`
z7!f9-O?K~*Xz9aG)mT1X*&i1f4@P4|-?C2hI_r!Y<c+9%_kKDxJ0pq9nsQpNwnk-~
zw6i1`8d;=WZ7&V2Yci57aRM626L=Yb;}D>FiZk5coe(jm3soW)5X7JDIY4Y|WX{rJ
z|6-KNZi#Mma{g?L;Df>)%8Y48LJsYxoLm=`gk~rH%botG3f{cZ{-|9#8mFl)H>2fY
zQl)vDFN8<Iu8MLJj?z+`d`DFS=MVVuwWPcf_IEmS3Vk!ay5H2A9#FGRjoWik?vU3L
zI{W$dm?UNk6n3tOod<tcEqgQ%HrmN{r$Ayh_SM=ObcbY?8iJ&Lhx)bOHYjnxQboI#
zogFbfl=YZQYZ$sjJo#)_BLF+_aNaD{upq%VpV>NSa`MO5GM`={m+S-V&Nux?MmpSk
zl=I!Y0umMO7igD!TepJ{+i|rLAGL|WddH~dD?-q+U%i&z0E5F%;m6z$*@PeiUNv?V
z+|IS!H#8MIHv2ogCY8QkCcHAnilnjFT#z!MTcpoTE;%onVvrFpWmi-c3e02g;lXO-
z9i6{1LwrU*-`R;@-DF~_xm>^Nr+T+Q=KthC7FQ@xW`gzLIxS_WPGNjWg<n<!j)F0=
z?NmA9F9#XYd)XQN#$WcQdqS%#Ltoi>`}bck3RF#TWZ2bSw2g0Z6Lth@)Z{Es%8AcP
z)+%Yn57~LS`WHtgK6J5EL_%=)9dDNiI`xG&Hma88bEUCV{2yKvWzj=!;=$md7oE^B
zt?7T8HI>J(EtNaE!9HG3pZ%JYD<C*pij7(Rg8|U+%a4uJWt~+&8+xpzKsTRx9TsFH
z??3o9tGr^HM75I;dM+JTEVVr7M{s&<aUg}}s_3C7O?rH$$JzVepaP1|xM`wYnjIi~
zbJwLdy9UHAd0#SgTFU}#55RAb3k*JCtPfHcmHv+8^Y6qWHlSD}P~v}qfDhR#|7x*1
zN);3wi1VmypXto_XV-W%*`GaqKzzs7DlAOIst|FOXaHeU8o3E08^xMb5LeDJ)VJ^#
zoOAw<&T8ccZZZG^14#yjH#RxvKp5)*jA`gutu67OKCua~y>vg(n^ZT?#}vY4#wKx0
z!0$Yf0z=~)=IY+(9k>pX1G3;6Y;?o~TPjI<Ot;X{y^!RLFSEjUVrcGV2anPra=rgz
zpVqa*`VB|kcxfTp@?C2@-{H=2Mfeg^%&ERZ;Ft|snf&*r$|lGxSmQ5?5$aZWhUWl4
zCri=M-}(N6zByI3ERW+s6?}C!We7kYZ7&|fQEF6xw$8`P-)`}2MiP_=BS!>B6(Fxk
zDE90CxDa36_`6&xtncmswNA%XHCxNi(yfx}rRs}oe+&HMHoe(?Fb;>73k*nvo7aOS
zkh@29TjW`E=9DY1w+BA=jnkgHMVootbPEXh%+Bivy|S8nRriVL;ptgsZ3m^_0f(8C
z7w*7#83NGWdGA)6vA<V%R5llN%4ioA;sx+!@vTFkJ~E-;M+h(wTV)xpm$2kTO*RXc
zG&4gHdwUknJDJHYl}GB;UnO+kg8H;cjay~kXvb9PhoIZ$<%$Mjlc{5oN%ZzdV=fna
zgjPplP}eaP`{K4J3uP@&DxTio4alBk58VHzEO(MNgFfR1De^O85gN+M5-&WPP9eOL
zy+m-m=r4XsI$tQ2s0EP>-?5Il0ib%-q{FN?aIqCx`cK3{&PwwFt$do?L!IKx3_~3F
zg#IBz^bVDreEu7oUmp9x>N_gT`Qhs=;7cw^uUyfl)cuE(Og5eT>mgXv9MU(kp`DRw
zs$u@8^F8E}Er@g)2`rZbs2}6Pbd-|#w@o{N@IA7bD6Oe1{3nFfaT<Mxuthj?h6XKq
z2{$x=u0C_Sg&@3fWeTh%V1L4Ka}-OUCHuR*&lJ53M+^RK^bi)TGjk?4PCIzlZ-tzm
z-RFJsNisN9wM@gvH%H^^&>*9ppZzl|$3c|s{x&k2H?C%kVBlSeNbC!O>+z03R!2Fk
zY!x-|#SI=3%T^ZJC8F@8SCtzlhoLPtV7^Q}CL52o+VVdD$0Qpan10TEeB{Cq8GzA$
zJw|*_j+fQ>oNt!>VBVYP_+WtO#it^ljH#yUvpMSLojztO@wt088fCyZZ1flQlfd89
z@}kXTyTVK|mj^TeM^EOXTlql#$u9I$!7_e|k?dFb{E+jwhfDTJJMnuP3y<}R1+qtn
z+q;|loCX^9cf%SSj88|O^^Uze8IEnB?o$3ljeLhWa|Oak+o4QyItUWXr=YlX$z_e!
z4p#H1{aBuS16iG|McdP}Nq-GbM$_j{rl8iyb6QaQ#pVR%wL<^OwJ{7wWbc};gNtnY
z$01-jeTv+YO@+Dgp4h6s#(CbDb}=+Uw-F1DM+O6fuT|9uNmnsq_@`rMUA&6DE(zCN
zuJw{o-m<cp$|UoqdwP||v?XA5%Bd#wW+3cHT6-cF7Q+~U<j`vFOs5tG;aoS({bN%w
z$ht?&Cq-*Ykp(LPo6_<-JPif}iuN}rC2{mdGctjHxf0`6e0m>fo2BHexYRT3|IIT@
z@zk%%bU?@WOvV{nk#cifG7H7}No)vj;DX8@O{}z*9~aNJ|ISb@lhgo{PC@~i+D0N2
z+JOa-?TzlFFETR!PSW(5l<?}jA}WCSV`6BcK#7jQ1S<`8I3aLcW2jmE9*t67jjiWj
zE)1=1Nb*2WDX%~z)ZgA!+H6&I;@BSWWvY8(;~?DFbgST#NCBE|r|Z#!iFZ<RZHj8j
z<~>UJ5@{qjTnT~O*#a&6+y{gy@PpLJm;gvCC$p|V4(JYkIK~?TV4Z|ATYy8YUZn2y
z#*54Bd8$?j3~AQkYJp54eQe8B$#Tz1yu5GjCtKJ3ZiNqcvLp7#&PjTSho)eGfK~<6
zUUPqBWIqIkKFebDHvVc;K*_@lh9v7u-!i=4^djO0+iMG?_juV!qoPH(ttsOqfPRzF
zM|0$5vT~K>^Ir?OiZ{3U?5qT{)4JO{ONvd}I<-C>p}P=#`(+*36|l}w%glbF3P(bn
zoSx+(jg(*Uf4Be@Vtb%+N&&k{@)ECYn33X6Plx2=9zJ_ghzgidodTG*KUdrS4D1Cd
zojkNJoQQ95Yl*ct>a~qEM!n7g=oR0`B+QqTY2Wt!vGR2Yh%fgMaxDp35DL0-ka(8s
z@4G5B?^u${Su9}XiI|X(0jXfQgn);FzV6z}BuTPR2!O8I#6+1W+_CoPx2fBbB7NNm
zEXOU(qXI~|0M-m3fQKSK-tT84s;XE)5gdp``C8k+hOE>bz-XW4bzBrJ%Ts>Y;Mo4O
zG`3g4Mi#7pw55xm`2<f}#8FdnDy+X;k*`o#$}QLW@!EUap_zM87k0a8-{&~XmJQ{>
z-obs~>Gy|t*gdGP`5q@?Ku8P3x8z+<51KB3<b*zm+q2LF%JRzFQrR_mg=`c_(IFtM
zYQ?!ZwMG0&qmJ5Z*VoavRk)RGBFfcFc`(H&i3Fc1gTqnV-6nTi>;|%8Od7qfCk0p#
z6X<n8j@ZG=*HDa_<PeVESzYhtkrKBI`PZi;;$N)iQ44Dbc8{LmhL_ySs?3teq^e{G
z%$)4Dm_a|2M^2GpxSdZuY1o4Tx8AUrOL8NX4VPU9C%(1;s13g6Yya?Cn0ta^Tk96n
zbj9tu0Rf)D<dI6(X0e%aToUFn<I_tmj%WusCP;|oB1jvj3y5v$!UT+DPAk*M(?>3w
z_oG*Vb7PZHin;cIO<d&~csm0ysDgMTE?(4TQo7PI*jq!j0b6toeO(@r>^oo}9}3<k
z6K|$68oFeaFnM;!(O(0b?@k>aegnVAJE~DHP@}butQxnKvlAm+Wp?RuQ~PST9)9RN
zVI<s_w$l>dAsyY2{sOEykfr?k#&V_p|AZ9i{VRLg;Br%qj-ay)$}*~7W0Bcmd{RDF
zqy<D_@kC&5zykeqa6Oh6xMH39<oH+>qU<x!n3$h0eqeX7h<HUS+)kOK1EZq|yl3q&
z2}O2M=?5qC?GQta?g~L8f{!I7EsNokMAiI+K0J`>rd}YFCnTs!J*Zm7qeO%A3ZTOG
z8((p3JAc9OBQ)>HOii`ukU*b-dJFK{Rn~z=*_YK<E_hc6CH)q~ZPO7W-yB3>JMFir
z#H*qa-mapl%II!WJ6}ZQ$Pp($CAj=KotCMYtpWl5!>zW_2-PzMBsZ_c9hPF8#e$J@
zN^iYke~8Rt0&qQ2oIn)dGLe;m^x5N5o>TakdHoP}6{6(BwKutyMZhClmZwEzxr71S
zvi9^*?ScHHI&j^MgSN3$bNEWJ`C9W{YCom)R$$R#Z_GYSUZe?>a(kJ&7M!N%py+6C
z^J~ZY;ft-gsd-O^-tibJ^t;4b%Ui~O<?a4$c{0jJcYwgC>LL)Wu|^Hs>Q9oG6kV*O
z9NS-ow7%Pf45(sB)g3!JF!r(f7+8`Vq;_~xjn7Iq_bBGkFXbFMV|44iYXs7tEbHOW
zLMq41_mP7_j=n{;(LS85i!i4Me!YD=V#&?jbc0fPat%Yrs}!qb<X-d`sq49i$&k==
zLf~+yj;OyDQnddLYkk+e<fp;ywuR)ICAWHFR3vQA$Q%ij*Q*g~51S|RV=ch|RE=Jf
z4~9mh#JZH-gs^Ildo(Ta5QyZ#T^q>K10S;YZV$8gN_b^7T+Iuoi7cf<`c*IKMhDyI
zu<tyCDC~4H96F_N(W0?Xp$<Nm94)*`AeZ32CbfW-`J~5GD3atsubG}#!KDy!67A-d
zwRi#TY`MpW2J*m_OM0CP;NFirodcyl7`}V6NAe6qz;gu+&&<UL&ie=ihNpdTx}voU
z=_SqI4Yk)ZM6wc}v&UnFzAkT$u95uy8V|sa^VPpciVJIt#8JZ>^09w}^Wcu(H*F8k
z_BMOIllrqCAT&L=fI!`xp{qBXZn3u4m)qabKj__f8|wFHuL5l_6WfO>D@jn;i5#6n
z4=!YACxY7jTd@I1T@ku-;>sZ~J>eJSGnK^D1>*xi=k|^)r$rpI9(-r^4LH<nE4J}m
zacltnMmk56iL)uBL9E}wQLGuz$!liPzEZIurb$z|DiCx3;}!7&RdaG$M*4%UAXy#$
z)k<x0jYGb9<<Ol%?%}tU7cH<eIHp_VSlvWoe-|DQ<aBr({aY1;t;K;+wQHq89yIXu
zK?;K&VECT!dh^h8px60cW=`YZWXly|vZ>nG*U6kM&o%z9VodGY-*C%~{oyH2@+>pQ
zsOWuyiqZi-EWP54Rqfn$AujPICR)eIpn)|SD;;%2J6%qvN?hr-zo&3hk<A(1iXhCN
z^x?Q-s7}owK}6f^hf~m>?OHo%26tbKS}nvi5G4BYg4l_Nci-3fYa~@~10$zbqFvz*
zIP$|qdCCA&KqMhxmVaSD5AvSjczbkD-XNbeylAXm{<G@0l4cwUpfi%J%bIUTa)X;F
z#SacCL?<e~VR6p%FC{=0#Xew#EBmMC*-A@6UdD2@hwWXMmkDF3iwmEgXfParZdPzD
zfc%Q50DqhVMjlr08qu+cfeBEX^>+fqv%ga)mnuM^+hXfJjY#QDe1ERM%-QO~{XUJS
zKelZ@qNifmT6C)Y2mM9o*ByTWG5i^VGS!kNh*#Mnb4#UhOEyyoR<4F^tto#Nkh`np
zx_IaYkKnn(ErLk?b4Tzc6cK>|IkBnyOm4~hu5gyBe30RkESIK^>?os9(;8$0^bd&f
z(Qn=B(#atd9!Jo9m?;odH*bV@PI(y;YD?qlSdBKYnYSg5gHn=TsHz-OSu2fMiHKc9
z1UH2If`L=e{kfR+cW#tGd3qh^&(nzHbe71XPF=2s>~fukATEGgfn)6_(?w^c^3)hJ
zn_4+Z-Un3uL066v5Ltt2?s7nE@;++Z_Za%11fin6(Rh=mrtUEL9!~kvboZwP6O~yw
z39RJiq+l>KKX0XHpl)Lw38Y0Z2t22}+KF64`>&<vMCMX`6=gaQPJ+pLl(1QFWso$T
zVf${vJ-HJ#=vcnCxBGPWr}5i<Lx|o?YB2p!a(-)tdi^&br<09t6UA8cDlUe<l(>X+
z{EXm{31Do8q8=^a`B_fgE9uuX$0cA;H)hz;yy0SlUN4w&0bEt_nRYS`gt5QG&YPvN
zLJj+YLtex!oeaa;PD@BnXEB`23d06a!|j+1VjFRXm)qj=8c<|DlW;2u^eTBz7Pb!P
zKS>rU7DKyW{ilU^JGiDTvtV|)rQ;#}#qPFphc@<3)lwnVP+ti*%bQSOYu{HUnyf4V
zAUw9QWUDCnWwsEiG9^(q3cB$sJYgC0P7kZl7|c$as6?&u8Cr1$mLn>2SL5n%TP72|
z*zs2(z*|Gvf$6`_>RMW#VkSBZy!E5pZQXj`0N+vv1$0;cncPCp;*$E~*7iEw``wtr
zbI<-o_rp*}?XbtM{7&xQ-QD(joIAGa&dVJ$81xDFvDv%D13nb&rI7RiYhk*E+uD=;
z0+YWFGZ9wRy8pj68W4Bl#@(Pi5mA$*RQ|e6R;-SU{PKs{(4~ES^p*h34d`B_eEO)m
zG!ezgUt@$0y<?J++o=5ai7I%%P~OX6WxcVTI(`enIYII{)oRc2LzVCnA1iJSmN|X8
z2U+(Mx}DA2hk+qLbMg_#i(KmM|DPU8r38b!D1si;*^0yve<=tpp=PYCk%;1|Mf->+
z7VhJGzPbW+;N)Dbo}gU)ujlFOGJWwS;fFY@Y)_oa-`k<=nilj@M24i2B^zot$F)jE
zejQIcWr$Lj96P+7l{We_P0pdXrh_-Ms1M~ft$*sq0WONII3FEj%J-jg-hb4z+bY%X
zf&?qfAWE0FkCeUaD!!&negWVAQFaukQ#<o=+7DVBIf{6Z(|zpNJ;~Ul-+eCq%ut_%
z*NenwSs{4g%USZ?lR{;ow$MpnRu@#dutjsCU0h$;0i(t8zK>hLt2Oik*%*tE+}@08
zKP{*Km~$z{|07O?2}m=s-eznt+i<P7YI5go)izWcy_F1n1S>n@Y+Hc<6l*WY2;BfX
z`);U>4^4bh!X=#ctP6?yMr)YflEy)h5;R~fl%*R@JYBY$h<?!2sD_?O;qukX4_Q`&
zPDZ8J+akmcqcT*+rYI5@@;QA7(pk7msFA^AxDbkVpffL4o)HcL1>nnWvt`tRSc&RE
zlU0a?;L$z5W^8e5UT~8v^$!Muj-maV=q<Sp94vO$oC*be=CLg`vBR+y>na42b*O|8
za`Dd=>DM82Ba6I=B@pePw^Q0O*VzLS+S-`k;(GmNZ!LP%X^tL5(|nQ+`1bj%(#Jz;
zlvS~>s$8e4cXQ~O(;x=6U6F&5OlSbQl5AHjkXnpG13pT6)o`+TZww@bw<H{uvp|F}
z3^{!+i^bk6V~42$kmb$e?srOue{M-;rYa50rw)ZEBv}+|ikJ)r(KZV%tK{doy!Z~o
zVeG1{9hiW9iB$wf;=s89C6#|DKxbk?3}suE@|EtC7_E-RrLRuW<~Q5w+S|OwX%~$P
zfWp2?o0d^}lF<-{2>==A3X6F`6JDVaXdwv(T6HM8RWalFrUz@ZI0i0#KN<HlB*wSp
zeA_huFKG4O#dUK38+>Q%eS`0%$f*kds`cR<Y!$9IS}8*^=zd>*!;hzpVGs%T=wjl%
zx9QSlW!FSB85B;)+nle%sy3;exx(@~KNbg)D^H%Nj2ST+39zyroH6f|Xwt>NL3eD2
zl<m!w<7PXL#a=Bo98+S@-nCuu0G5OT)SEkgIcJUNsdB~ufex$R&TP_2&8CGvZuVbn
zFQo4Os1d2ebTbbdW3NYHybJxj*h2w8@_GEc2!Yb`I~QX8v(4sz+Q%fbkmiQ$`aoJ+
z*ZEpQHd?ZeXEW9$xo6$@mgV0nxYm=FBI!H96ho3*F_Q--$!Vv}St(!ljiJMPl=39v
z3SQ^MQ0xLQPlDd3%T4sEXo~m+YN*4!S{hCM?lJwnc|9w^xYW5Dsk4v1)uQL?uv>zx
zv3w^x&f=TYGU0K~QW^G$@yU`K@S`()F5DsFWGrk!Bz*dtYUh>BVsUp`wTjUDzC2!Y
znQ?PEa>f^>+WA?zT<f7NW&2m_{v8`05uKt%qub-3%Bq63M&0M$%T+ax+1(Y}+rJR5
zwU&)GiS+?63Fe9<ZPj$GH{R##(Z_1jua%~|9!=Rd{Y3dmd%N97S|`qp+))(Y!pj#6
zo6RWEzl)ZqZ*$W%%`)$2y(jvITi!EGE>dU27vAR=J+$eDMc-##Jt`IEi6mhUB4IP8
z4n%+>pn$%+E&b-`_^dWe!NgW4U+tUZZaE}oBZ>{aKdeV6hQj6uJ{?zea^LEcvDv;T
zfd;!8{`ZmTHs_35COa&RTXmUN$yGSm-M&KYM6&kpM6`9_PnRZh@yttD63soU-i*Qi
z0{)bz_#1Mf@mLtkIOx{A(`JCHG;sw5m>qea0W_(y;#Zd-WkM2vXeycV<@Pl(v$%vf
zxJpIaf$cRawd$x=|22l#u(dVa_ewYvQ1a1R?#}jY@e*X&UcN54)PumtMv{#_-E(=9
z#=82wGuKg4z0m;D2f)!5si`bU1g_E?R1bgUdxV1xF{$`J(M3)dD;AF^<o9;~AJM*w
zGqGqzrL^~W|79*%4)T2SjXlnWJF|zLh#yJvfOIyJI|7DgU&2>qLWaV8-0wzJt-U$f
zrQCG-OwGxD8zcxm3F(W2jgr$JA+PnnXSbfh)5JG+q=`ip@=}Y=s~%^@<)$!TlEOHq
zKez8@1-01j>7UIiSXxl3K_I>+I#s&M8^M+YIc%(+yqv6$uD~38#CQ6-I%}eSteF;c
zVjlBa`%04^?{)%KjV%3T^ok6QUhBD`8QOVYduFcp4#G@G4~>r<lD^RJp8Ztp5mYV;
zDd;tBv&nY;jn-_<`E)Ms%<^r=)iLjVcYH?!0o**QKgabL=)BxmVqFGnqkhzcABJd8
za+t~;wcMIM-t|0tGBnIz^|=8pt120=MufkABA9}u3T;H`Xk0xr6;*Pl8mkfiaZAoI
z@76DuOkBsNkdKBR!X{*ZQuf#<gY2gX7p|^03Y$B#%k}xE%k`*etrLsiN>=G9`1C-f
zqXwT;IKn;M)x2^+z3}()Z^}nQxJyY=B?qeKn;;(gsXbeEY??S5X}xrv{bZmB+#~kJ
z>WWqF_mLKKmrJ)U)>0q56%P(NENYY%vO}zz#+$kVdUo{{Z%Rk_f$@a}8IvVc>IFIn
z>5J^&m_gaKG(3d`QcXj3n4M@h^PsTd>Iu3fdXZ<B=xWl}1{ZG&ORY!Zjir-ypM9Wv
zRs87JarW8ZBk2taS7i1zg<(ar{fQ3$qFb$HLcIG~yH**_qF)xr*ab1Se(AcM*&F@F
zLRxySf^&nv!wFpf@3|kq$Ay7jm~+x|?K+Y@lZ3P)P);9g*5FgCbJK65@>6aOP>Mv+
zzr=9La18>p=2<s&RF1$(T(gR(>#!?t6egh!BL}JZr?0}NoeBaOBFSvEoN>*}@zD5P
zG+<#x4YiTc|EU`Z0My_!H^L>2sP43_4@;5icW!G#82q#X=ETBr*y%J`{rsXsyT|C@
zrom>lr%ZJY4RK0HR9b!$-o*jkufKhDGqm0j9y!}D=4l1{!%NROi3OON_9hYKrWN8V
zfBMjv`Wp}+cqDl&M@fd9NtsMFF7eXxP2;l%|8rf!pB1J74t*)ZBSrB!S!W|!h1yiS
zU_jvnS<key+~Ta0#uIR`yb|;LunZ*Qn{6Ah7{T);v3hCTX&<`c@mL-=7z$T7)5&ok
z>7;F1|J2;g(Rq0YO_yoF@M6UA+#|i3t&jv+iQmd(m(YG+8n{cITq+=aNqJG3@-pja
z7Oa=JxSjj^1fLz>^IXKG^L{J>lbE&jc+;gopp{*0mD55zNmYcAY&^ar(=FBZ8tr>Q
z@RhzZqu$U=*A<ptM#2^$oqaPnK}e!I&Qq_qGbz(^?N<Lcqw=Sj@?3W~^Fpco8bj|m
zQ=3j9k_(CMQPIf0;8y~ZJdSf_HtHa+6JLp>56!mn6tz7v650JXsYn%zevOhqjrM49
zqf6m4!~hbtBO0yU=?D8*!oC;verNdF6yt+dh*SQIS?CNII)G}rej*@!tEg&&+A1lq
z^`AhAnQs7wRmxLkrIt+WT^mWVb0$9}AUIqx`8h08jZaLM<JK>!aCx!u&hh%U_o3s1
zX`ZHog)SF`m3P*#CRt!)3G&Za*=%AHq`%)Jm*jVfi=@D*fWXTeKrfY>FgDxr=xV3P
z8WHT~@Z8iq2sJ$=h-UApWZJ>ln{q5~f@ukrS)o}tTH}J{*3?*s!Utut#!BYuJ+Ij~
zm%y@k<0h#D$cn2P47Jr1FEUv)=JaQflUFEA$U)?W@v)eZk$Au&3mN?P{)tG=dMl<2
z+66Ow>9%m&AE5z`ltrQZUkWgZ1aVKEWI0?bP8?$|{`}6BKFoHfelw6Zx7~Z<e8{yJ
z%GO`4x$ZM5mcWhV{+zH@ANA`51v&eC?kdpDwNfL6m{`Q*)@9FIFYh>d*VV5f{I>$Q
z+)l!fNExW~a~TlrSpCoAoys6S#cZxWUizyySTwt<>w?-@61vsz4zpn;Ta-0xp5l~}
z(`dyLP;FBY02;R0&hx&82=B(V#%pRWZy&;wVFNux;P%s~7))=xN}E?ek#UKyd<T{6
z&Nr21+eA4tvpT}{g!gMC7)7$(?d0Ob<|5ugdLV^|?Z9vrHm`votTPz&pt%cZyzy!O
znZ`N_OLbGRRE;ueK7Nf>GtGYBO0>VWzE0K(*gp8t9I#$VRv(-mHggsC_}xr@b%bh(
zUgB*(A%9@#Ylc?gJ5def2eLpBZpqNzR&(LfV8*pFC$&iQgtN4a>1*udnQJd)ZdLex
zq|t256|vU7y%~fgl1t&!NnId{A_MFCZ$6BxDdY9tXH25m<_0T7=Ij*sLCPXaEOlv*
zbLjt;V{0&TK13Jj`_Gs`U9iIgsF+lZ5&nd_$oT(OmUZbo?0iNNWrl_k;D>0zHAE9M
zy>H5g`m=jT>h@J0yyp!ISqSHL6mskqg~S67a5c(^ni^vau<xiM_{LollFW1UuJLJp
z*^LH#0wBhRFFq2KJ+;5Z74C~rGET&gxP*GrW%QQA^#1gDJmQ4_dgBKr-c3i91TX=x
z(?C+Pk3orxruFE@Zpx9V!V7W*{k@m7LP5Ue9)N}nH#bpEa6#G!$atI!&qx7EU?{%8
zQ8$1P?Y6S<bi7zm0`0qkqv6Cn8CM-J<AD$t;daCC_9enW-L(Z*$Wl~n3rgtvtxIL&
zX&<XIqBZ%iVx!e_n@cpMRuRs*Bh%bjfJ;;41SR=IU!Z~yf~QbMmF5-eQxFBIBV2`U
zeyFLZHVX59h>u%l_W#v!q`*KydkExQ`)^aR8_mY2e(N(n6_B!sZTrJ~c)&5B{tkj~
zz=Sx4#b5ABSY8cLhqp<EQpPtE{IOiuxQ#W$S@KMim<t=H2xk+P)xm=dp-o89$O5(d
zkDBBe!{vn`7*&Pjn+pz0w^b251+|K`%wfmTm)2+Z{dz7(QsZp8wUV3ue#G<jC!Kt~
zs4bjN!9Xz;Kx~BTWsUqC_Te^0&EdFWytJk=R5}?12;jde54*8}|A<v~fv^Gs)=NX#
z>tgX2iJ?pa&i&A|3RwTWb9q2_QD%W!B6n`0YSyM8A}!AOzeOv1oF<w_{~r<-&2}Ur
z*(xBJyX=uSA$ewNthRF<VQXWSiw?rO_NA@UNKgVJvR>yzjTtF1_d^N~tjLj3S_&FC
z&!8l|$nRExr<&-E&&}-oC!v<9Ye$4KX?Cv}N|TbztWtlo+DocQw!k-Fo{Z`}(A{A$
z%%@cHHn$7?xF((cwL{x?>?06){2uiXX@^*Dk%qoQ6{@vkva<v09oy{d=>dAY{PTnp
zLQ7x`5`Z^6G01kMw_dVxkI&mp&_y3-QVXSDGrU&RI@f~5m!Iu=_}9`M&1><TLzjZp
zD}245?u_?`mrZ}L3ggC+{Xs5^dT0mq`e%q;_80Ty!y3y@R7~x~{HYHc_=kcJbHnE0
zT;;atjf=s$$FWgoqvOJtx21;;wNlEjL?fr}64R?QI#@Vwxb<Z1Q*28nk8ahEVX{b{
z;cSh9zQbtcl<pAiO2+%1Uq@e{gMmiw&Wh@92nh>lA|&LqquL9TXdC^o&SRq9`Ul@l
zt2G4&lr*&pk+>3qMNriL-LZ~`C^K37P4KT63*x5h3S1Ev(1i+}kVLHCw>jvH50-1X
zGTh7!6Z0I4Q_oF0TuNN>gvRd*dJHiA1DQXa#6}xSD}_4wz1JhB8p(c1w6+a;8b6Ke
zV^!ldzr`-g_Gm0XV>yB<&u?^**$mXsmnB=jiB#0BN;~MLZLh5M(%33WL1I&bf`YKS
z&fm1(eX3lM=TXD^4FBWfZ24Jrh~`dm@zs3n@khNUGmkMIKq&cnH>B=IVJ|FDgZ@r?
z8|S2Hy?*oWTlMMh|LjWGlV8;pVu#S^yW5<9>Pg@6QxIG*L#t&G&imqhP*lDcO0W`%
zYrCIeN&W)t*d0EbAfz!%)e~+IPp+@jQ4^&tELvrE(~P|X#6u!IA?8+Chws>zUFN;Y
zblM+;^CBPtqgbkMffvdJtfKexLiHJJ&MGQ)^TnJdC%jTAwE_DG{A3CLX}WLa5sA9a
z18nOVnL~bn;4w4UrMf>}wC;CLoH-8t0ec<JiQvucyz9N&IZemA$cM369zI;^3eGwB
zW7?NmI8LL*$dP27H00G~tIrIdm`KB#74IaBccDwrQg_Xy6RG}$;h@U)1&isnXa0_W
zR#EBV6HdY7aEk4^TY|$0L$xOk+GOJ5OLl%&jYTqP)-(C}i~a*n3WK`Q^j9cE2ABE=
zDy|msqo-Vfzoga_28|dm-<o60U?zBER6q_wC2mKv?oP~TaylP=lc6odn2g<n8Y`Ke
zOK9DN+m!K(BhiMw*}kb=>{Q(iHJzC&cJS-$v*-^#YDujjT%yK3aJ$gHx)+@412rtK
zOm;^);e1a=Jd<wbQ!2ebn9ZFODQgxq(<vg8NbUE8@H#sR#ceD_O6873cvo{nj{ZCW
zMjw3=(+k~31yT+cg>pf2O>_Sy)?%6!noe+JQP?w)zPqme#{LoZ;Bz8v5Ry=3fiv6s
zO((OYD=MQouo!+fTTrzVYwbL6TCHSlNo?5v7*G52Cz9Eib&-5r^qY%xZErn48Ykv2
zI@>Gc+*k#aOPoLG=?TmkoU>osN@;^fAyi?`IEIx-LRC6R%KyOijaUyF+ip~Sn=!ED
zBgBjG3bcGdiBGc-rD=sQ;<CF^p)j0$&bwef^a|HTQEu8H!TyPQ+5a)S(hO1ogFK6;
zFua4uW9%Iq{)+N+7SU47nz<GJ>3Sl5Up44LEr%Sws<NvEX8j6tz|zC=tp94cv04#E
zAz9bRjD<+sFN$dJ`K5QrHEQyOR`Wa9AQTe8CqUm@ZavA)kRTe+XZ>|9RmpMD?0d+1
zQ_#E|7rJA>a7}^!WnjN_{uXt5Tw^1<t^Eesg3#*1J}1+^g<fx-6#eNY&iR&^{CedB
zj$wG-U0N{A*E@T_9{jny@98&V+Gqwf9Qx<|0cWl%^fW4vdNz7@*hX%3;-*wMz#+NQ
zrz;o^VNWeb%m_hQvx&7MO)Y!T>4L<yIuVAY@|UX)(d&upt>j#orSE8we>YH!(XngK
zG0%KB;yI=y80Dn~abF(?kgQUU;{g^0l@wD5;#-!(ey(g@dz1MSe26*ZJH&t@i4Eel
zr%H3*p`Ogp(cKx(Y}lJE^v3ts$EPEuB3fbmc+)dJlLiY>@Iq-=E}Aq;5mWsiE&xOf
zbztv>ymLU20p1Bi!0FvSt&K`i+RCbw-NK|mi}p7yCn-BP<tDQW7qEfMkuhiK?2Oo>
zXj}{@tZ|SJtJoGeCJ{<DnKPgxTb}uBGNXT?@SHB27Ct9Q=>>+oJi#wZdHI#^c9KEm
z!P|)yvcBf<^$b<!Ose$IixbO4;P93|0E1i3w0jJC^L|l#DeUIirQ_0p?e*|{?dEBR
zPAG<ay@na76+r+CAk+o$wxja0z9&WIX<;{4YN`jtlen6*@JjbuF{;Lbe*zg^5CV1v
z>X@O=duA{B{yJzp&mK@zB)@p0?m)>S5<h6N8}<t-_(@IZfQ^t9kdS|BJbIeFtpzn7
z`KSk^G>3e8oWJxeqq3q|p`Q=lXR#2l_ICmr_K>?_$Z;oeV$@NZOT3g!5`v-~+hxvY
z;zEDwQgBg`*Tg!Q&%ykMshibxT`$nvGWDYf96w;NwW73!UUz3m*vWbDSWJv2md@l*
z8L{q1MjB6cuoLM?5KD%r)c=!N{P62fu%^LPd>T`%!{pkW+AEc_GpxaY6Fd{UIde;~
z;<E7Z+7GlI$q?u4lq%U`wFqW)kpDX;+M<lMYK2Gz4y8T%R~z4=<oc{G_Ac06%Y<eE
zW+T2X2b1ZjZ2tN<{WdgWoMU=PMA@3bl18V#+CvU3U#$&L=ffujU*O!3h~ekp6s*g?
zunJXicv1YlA$-9wQ2;XFTOZf4KbVu+cDkJ!_voVmSIN6ElyJl$o!PPz<R0s+0(0T6
zfG7i~J*vBxDcVm+4@+?i!V=&oQMaf!W+~?$4zmLb6=j%(_8pXbtSbPH3jZ&%zA-wo
zFZ!~=if!9Q$LOSEr(>HP+qP}n?%1|%+h$LG|C#wRv)-3lt8Uf1>(xEC_St8jebI3`
z-~hSTRE`;v!uer63f@YxZ*5CH#IZfhY#lt02*jeQNWPjcqe0OJj_{c%t}$rsQAPY+
z-$|J3>Gs`Kjb%arO+4GI4&#}O&VOIpP(XWTTPWQC+8r3kSABj-ZsVrH-~{j;r`k-#
z=KT6@(UnSg(x9y<ZmNkTFWXdD1)d93ech|x*RmCqYs2Bhgz?SL!+BTd0vdKImTz}Y
z&uk!{`@H6vIN=te19)z>T*UtZd>H_88&PqWxy}0{1ewr%D+p9PVar>C&Q`~Hk(YKd
zSO{K`V9ECe(X=-!w!a|yplV?**8QGUc8wM#q*1rj{QcO)s02Jgbr0AYGf#+JZCTvk
z{8fp{N_8m4C((~{x(-k#RBU^aLkhWH>l;CP5Fr)ivJ-5C|4@8g^Y9YHtT`d@i8=vg
z4ZUQY2-|%~CEpGIP=06uAklJ$&XQIdk)su&4$KmzrgsN4DsiLiRQLOh(EdumgygPc
zZLkv5c@z0|f>J*3)J-cW{%%#J+;E~7b@BBh{e<Fw!Sh+f!;a1l1p@Pgp*Fw;h3<6d
zUSUGU+0B0PJYa4A_urdtS%Lq|cI397Oli9T0_ZiYwg18I0XfdfZd+(_`Q5e$BI736
zwChTwk3#YIvk?=Jcx3P>rsfQa=ZnC>7kSRpn*_=-7p=FN(qwPlTB#Il#V!D<*LN9{
zZ^#yjR|c$okh-9oTd1!8*VTeVdT)1m&q)ggup90Z3FV6%jZn~O?mp98*Twh5eE!gu
zT5Nzt+JP4rf5naH?umnu(UAYE=Cr*W>}<$1h+DBWOdawApV~D%xT{*ia+yRTNIl0N
zl3lGbzG+!k<3s?~CTb|SD772+J97kU+ut(BT0<Zq(zHDz<Nv~1mt1(KUF?!wjY;g#
zG@PVA<4Dh3Gsp7LWPm@M!#Ee8%vK&kW4~<fcvc~(LKB4-iQd?|+3z2DgZcLiJir-l
zeP-7(?Vm7>C9XIXcWbnW;^X+QMdgq%q`gGX3=Pir&(AZ7j~Y=}n$Mv_s$-1jgfUWW
z8Tc)}o2$+nZohYoy~Ixahb`AeHywkD4TO^(SJvTzWSLyK;-##F+yj8r>iDH|sCVP$
zue@!r72fVR2eyH%V6lLrx_TT6?clI}6NTidXq%%O%HDu8xW5#8rx5SR)<924`F-r<
ztZBMjhPd2z3rD!Uv6a)DwEnC{T=It)BAz2D2n^rbK2khYsJi~uY<R7?IA>Jq$plsl
z3Uj)YqDlzBVus*!N$X(|co%6Y0`K>!n$T2dmfw9%GIR3#B67dL1e#CCvI^2r{y&lO
z)Wyhz;#Y3}5R4yg;RUw^I#?O>$aE<ye$(xTRv;vbDl&PCUaZ@aYW!+~V~5C%WC~*C
zu5t*_irvIK5;J5|bWqy)4mkB8eqd{-me}#g-Z}sYVAw2m0Zf00FwlfB$BRaxgour5
zZY54S_e@38C(S`%c|dIfIp$a%3%qhL0<;u5RQbIjoe>HM$D}fZI|gF9%_yUf7Ai%P
zr05>u_tm>cMU0sO=SzG0h~&ETksDap8NnVl2X>!-8#3^;3jIwrJ5Uzt78`xSEEKYI
zI%BerM=~?UURP5`PBF@V7OMN(n#rt##}=@LFe2u&?<^Y$GO(!Fek~n9*6Jo8H5q^;
z$peQD*>(pnrAGd{L_KYLDHq;oG4Kh!3LlqWq#V<_1)llT^;T60bZ2Cw27jkSdQcG7
zd)<FQNDZ5}Ggd7@_3k|8-(=7!T-O_dvyU`>nDK1OBRO8f&l|yRXU->F@A@6T(-T)X
zSOMWaI$j6*V)}q!Bs2xE9eTstUeV-WP{Ubvq;v1SS(X<O{Wmqw4G<2-9%>%F;o)n&
zCa4@8S4T6_#o)-EJ6z(D-3EAHfndZc%t!ARnzgKJ<)|#A;;YmZ<T>iXrPG{%5Cdzn
zWd4B0x2zw``3abk2zh9sxZvGze<p>0AfZ5PBCG(!5cuEV0e!frLH6cVGMYF243UI>
zSJo>F7|pvcPs2P7@{NesmBDHKj7WLtwM(vPrg&e^Odk$6hbbe>`eS5tt}xHMQ2{Cd
zsBqzF+mBWpvB?{Y5X%sQI?8GfShxCcjK+Sf=-q7b4+4=&t8Z@lX{oVdhZ^w9r{je;
zxQ)b|gMVC*Iv_`2PRf#^5pMMTrdyk;seh1ARW}GCW~bQHZqAO_xades8Or#@9DQuV
z?oq8{7U6lizYFHkIq9Pr<vd2;$Yr2){|__(OL$hjr>?V>ZBZ9wu;h&0{m#ZS1=f(W
znlL)3I<*c7LRuSk45Q-gJ-v^N<6|2=HvaaIx{6!z4vih3TD|>;#19B^_;U5i@TO&%
z?TH@Tg4<<ES2q_KqH?tcIYLiIM&2odL&<~D(2D?x&Dp^!_ovbg-LeO`aPDuD<tX;%
z+--T^vzK)o^HSRd1N^ephWZd1%Wn40<}tG(CJQQirMO@)1h@;t9QZ|Gj*}nOS-?b2
z1!4p3`TyR2XwBpot3BQKeV%(ukhcH%I?@V#7h~}0sh)9D3Nkgf<Y;0XkL#0#XJx_L
z^kNZZ7v;>pG11afF3AS(j3u}=T<_L&ECag@uZ2G3u*P(}>y{`NA^?PQoO(7YLpZ?G
z*g>}63ss*Zl$gT%qW#Pq3$E}tXp!5Uu8orJW4xUThlwcsCL{?c0&AdI-8Q{a4!w<M
z0uR;(FBBI?wAyOdprRi<fJJd|wt0@>)@U7L3gjN=)U1W!Nn`V6w<8gS5YyS#Pit<2
z)#!MBBV94>B^X3-nDUXY6Qn0@RMwL;i(6+h26QsLFfTZ_-BC63J(koalQBgKAjm83
zO7=%nJq_#vi&gk0hO)2Dy*+U3$9U`hz*K<vRkC{p8=zVJTvooN3KWWB55h|)x?m5h
zf@zKk$Q$l9)%(U_aV{Qms-#P0<Dtz^4(`ip>R4a`tL@Q{#bX&Sqmo^x!%zzn%R28w
zY6`XKUa#%JX-dV_2WWX=8v+pjWE~(<&3^k!%3O39LX=vS#!mZNxnJQ;qqPSTsa3p$
za7GU5#^`jAMhEg6jAx`vu1={IeZT<d-Xl5Rbk?YoFV-|OQWF$cW(iXlq<?60BZKfB
z(sIpjkVt5}mJwEP(J-F^ACNyb)QZ)kOpLuX1AfG#H?Xg-vHp%VAK(P$hu3=f?6)R`
z8_~TXEZwU_nojzP5g&C$k|qIaf8gtG2YS5ieO)f<a&;k|PZ^kja_97<%TS#JEwA^>
z{R)0#e>_<L8R@?*j^|VPXu|-~_`$1r;OI{Eb#~s)Ffd_{hJX;Q067I<*z~59P8{sU
zLGhZwdTP|wxY|WKMAU8|wWiy1lxg^4T#!+%hs06&brkrxzy<kix0^WMX}u>v&IHZ{
zqijKFB=fF)Rc%6!)hD!kS%RTressO^>@(pN%+lssv2YSIGXV&_qMeS9<D636NI|7;
zcOq6aK>(U8H<JM^Wjq9H+6j&gd&k>$xhO=O`Td$;Og*R-5lW4@__F~!{kQrCtbcuI
z?F#=~R++2L{>JK^QO7z9PpZ+Eus3uXTloY!gZ-P{atc;eaNKn<dH(ybh3a18=L@P>
z6b^}`0DfV>__A8-qM#sHN8${DHW*AoqRbtLfr0`GZC?1ik=)*X|0ynn(z3dlfy=hj
zCHF;^!RK)FK+OXN+E?3&C$QzO|C2M$h2NO`TI})7>x&+*7Nln_;pK^8!wvdsYr$x-
zWYsz2UN?B)()OXhuzIBy69s7#bE_wrO`K*w37yubw4n_Rbqg=hZ%a)#uMom5Lix@s
z2?{?@f#Tzf6^7i2JN_As9Dh{3y={as<cN*RrY?L*C!^mf)s;273(a!7U-KQu>N+K_
zvcGZ_imKm>aS^_=4?_Ah|A$Ul7~GUop^+*Lbvqu15|Y`Ee<;m`c{2syFh_gB?kevt
zaWgFNtUl?!l6aleWT;IE?lKHy%PBq*I}&Oqq0_c>qIS}>B6+<bJd)H@)d5L9EF`Bt
z+X4WE%-oRD)?%kW)_Q2C$UnbGdWd)t5xgz&=TF<YO7R+RgVRa+@vR^lAn~df*GJfv
znXm~?238{)T(>tyt2E}HIAOQ6fC&YN9#a-;mK`kNI^nA>l=<qT5~z7D$3%OUjh;Ey
zO`^o1iQ2q+)P)M_x<Z+nuZ=+8GJPq^HBu;-;t(<<{*DBXwk$k@^4^rI^EtH`Z-*~U
za<|S(!>^V5GPR4J9{h!tn64(sYH6lPbGG4ggn{@r+-Kg&QcLbIZL$k7xwZnRASx7x
z=zTL8?(BT}naYx7nrYK&Q#F&ipppS*p@b9dg?DebO?1!(b-uoSfi6$~7Ci<Gko^Lb
zv~K>8De(2o4Kyw+@%QJWQ?n{jFavb9#&kpj%v_1++6Q1jI=(N(YNgSgdF{*6B&<+V
zs#_RxoxFjDTVTAPGH8Q8T<Y{Q&d*M1>xYy)mNdVfVY%;_Dij$z9~M`Bxt;jimI>JZ
zB`w;*ynEX9_1y~Cv0K7GfyP4wU0491l~d?(1-gMQmMS4f*gKQ_{IxBmuh{G0V{>rf
z*k#dcVao>XfinFiF=C;yeS;-{DTmM#Eq9}=(x20=8@7u;r@`n#lvw~rZE}$FYw-2;
zWJ4hghNv>hdY-olF{o!=Zog|b)S5<1n@JRs*oG%Mf(cunr7tcj0WQm3=z3yY77xM~
z%f^_#lyFNL3(6VgeN3}N?6^i7LXO$MfKj~cg{CO&CqziE>h3)G$`|(67vA;+q%UCJ
zEhVWfP(CD{l#?n~>R&N`Y4v8qM>7d_`{fA-9zXcbOgCa|NT)Hq{*@7m;LPlFldDtp
zAk7>9!eHb0uz%uCNP>maL2*fo`Q?IdDbueIVs1DEzZv93WVIoKZ?NS{u>22E4zZ`C
zW-rQ1M$XhMyPg3`7&NvSRbnbwJ^WTOsWN>wu0y*?4YpdnQd*Id@?RS@d=NpCl32C-
zvpSau`XPqMwaSRfq~mT6#R^sR2?&hu@Cvcuj~@r^+4`DC?~@Y3+Cz30s={Eg&FH{#
zW$0YHjTXVf3lxpm({j0;ykWa>mP~7IkOD0$$rnp(0uMq$n~+-+x^7J54%*k!BD1+r
z8(sk;l(IE?0&%?`AUbtg+sLNm*eG^j0(wZ)UrTYd4ZB3>24uW?)DHZChRzfKQNmgS
z^JigpKq%p&0#wo@9x*Xf2KoXjo?k$0>H3Q^x7~1sK^VH4uu%0bV`t{IS0M$lgt39+
zR71NQb|D<K)9+0bFFRsvo}9neVk{iYqKB@|>Nrz+)5((2Jg@EBM3R<;A3`^ffXWxF
z^B?h$z)*AunXf8?1T|-_?bZ^<VsRuIkXVWar$8)T5L(nJ&*P=WLL%@BUcwy->0dxK
zNu1TB0QIWetsSULt<6I{3|N1!9@G)tIMM&Kx>QO|3F(%+%{0cd2!O=jPb_;sU3-`m
zIP47Od-C0FFt;PRKdRmFQ+{MJg7w%*uRK96d*NJihFr4&58DS1t_SzVk{?v-0f6DM
z9reH6)~6#@>Yw*JygSebm>e4RF1bB0SsZZS{uv9{WROV8s$i_ZJNg-qesQ$w;9cn(
zz@1daE2q*aUglaO#~TK(2lP`-kHb2yDCPp9OJr{tVcd`&i$Bg!ko*7%#5%}$cnqQ$
z%t|Q4ZCJnp;TBr**b+Z~EE~RBdq_Fi#uLnuPJpFN-$X`iJ?eE;U+);?<-6RFO+rS8
z;{Lg3aP<%*fLk^QW1$x*D$ZN{YqrS?iG`2b=W@&=d=TJ+Uk;;hE^4V=qCcC&*@Vh?
zDN+|&3gYVcAV5sJOq4qUlSK(vIQwXEw#GN^lZL%bsrN$OvViFWT2Nr?e!2Qsu~t6-
z2N0E2hh3DOG9W&Gw+Qj?O+^cv?<VTcQxUUv56@V-S_M{I@vw?4+x|_=hcu>3rcw8(
z$^<$ACTbTl@kfoQ9I|g9VeYcVC7E@~;*uQjsaKUFns&+u+tS-L>EK^W=$GOu%;JA9
zC|FB8SV#R?#H0CLJ02cafLse)ykw%r3d>o{3g5E`w(`5?pp3#W#hU`t5&W5_q0SzS
zyB9=lx?H}dGUf=gXyOH}ogS2>zS4@h4s)~UxUql?8(lFeR>d4pKpGbSeK+8x8@fmW
zP`dfH0iJ8ocx(@k!4(?wcD~qLICvsAF-GV?g4=6MZ>kTs2OmJ<Gj1ZZvg=&{E9GC5
z=BxTvI~US~!ZF2_R@Yj`k69kOi>S27(zRzIp2(WThtoEuAFo!Gkg#U_?8G&JDTFZr
zd-x&(u#Vkbl(T7-;z|5c6_f*ZZW;Yx?V#mSpE0TrN|GE#G?)RmsCL206Rh{Yk02(i
z`VxRA<3yv2NQ1}?4)g6T(f1X5n6X2etYQo4@4=eF=U-Y&;;)U<UR)Dp|5XBiKVar>
zWPR7TBss#>b%~S<OTw#9VtH7a7hM0l8jWh)9lL=ENMwzIfNxfQPSf=4A9mXJb?7wj
z`0c<eBb@OW=<1r6dLrD%u-`W5Al#myJq;^@kwQMIbT55S0ArXBIDw{Yw<=C%F#j(E
zkm#Af_<!!m6H+-svG*##^H{PpuK(k>lWW0}{&k=N(gn36PeDZ)rH6`lL~*$^7KcK~
z`yRx$*J_ul$_ot1eMjqHgB!KHIe=WjVK)u`=|k`VSD7(;GFfr+Zrt)|SGW?Z5zT+O
zBc<@ZSwRfGD`>*4@htD0h3M&*d8R_DmK@B1p;w2<fE%`6Y+#Pa`@r^;Myw$Zug0<S
z7)U{$qE^;1uciY_Giwe7>L-U{x5N^x4R~NuOz}8SX{V{I=8}uEkf+Y|VB!@=jVNEH
zVju*~974?@(ggQaB8Z7pS*+&at?*n+ot8(%Q<m|R@6yKpC!-b9k(Y`b@|koZTWc`A
zYE8nd+#23Qq{FV;%6|M#gS-NJ>1Tt;>Ec#WuXsw$!mZfoj4h!dx0i-^9?Tps;%qjn
z7Eq5-p?B#7zdy>seCoaN4A-I4Ut$jb7N1AArVr%($Q+lH=}=5eii|$El#H{7-3xvz
zTXeXud7m?TD#PWr=Q?6L(!w`xLN04+P<G%m!0>FwEfCXJ1K1A{jYNw8&ot~P``Zks
zX;@_)oQ**`z?8?!6*gLI4=?5(f-BOdsL{$N9sV936y<`NVXhb*kmST@7(yOTP_<#p
z73*tV7%4W0t+ZcVJUW-D(a;@pBkY56EM(Kpq9HiHQE_Vxi3CZSy8(XAP?ZD6B^>y_
zp791CZmDGSKmpMH057K9v*D11jFa=H$kJ3^%WTu;Y;Lt#Xh#CU0MDXK`)}VfQXN5a
zj8u|o21#K)Gb;Eep~Y(<1A9JdzDsY!V?r^<b#<9}#flfi*)OzX_yvL;qC<%isaDy7
zvgvIn)96$K^HgYZp40$8b#-;F4-W-7?ajKSH|qr;m7GlxyH(iYN)Lpf7%^KuRg$>K
zp;id-f{WK>=LOT?91(%>d)oZn&`Jj6Z7Ju*L75u7ud6FqRE$G?UFJU2>8R5c9eGL9
zSr@ERVwM9rBbhp5LU>UhOSK`#-itzcZL>J^;YH)z<gFq(&u6>5MjoyYY7~^%tVA;z
z^)zcj42>^)NFFUTjG+0wn9{=7>cQez{oC;_)zFr`G+}V{d8`qbZ>=9z52-mJomnG@
za*qwI21}4TFGLHdm#3ZL=}b#*SLk7!bE(8olZqb*@|K_uYPL&?{*dj%zy8r&?OQxN
zZO-gSu~&u(U5_W6`bV-WpDO*?VE4Va_uV>tMyp@NV0tT_;LDLcFSTv!1Hec>##-X0
zr01Q+YhV@_5LQ!jIcepC7G?Z)-U<sp+KY0BYN%RKYaL8^d%tDVcsy>_pXP*_A3=OL
z+u=t)<`G~M88?))MEg80<8o<m?HhOB+xPyqkYnp;#58dld_P_T3m^kg(&yc8)OK-A
zelBo8cA|#7<D7dz6D@K!{%EEE($3x9pr<OpX@h)m(~?V2HTPoy7-1q7xNjxhtQ+07
z1;A<;Tptl$vIbDc<7hMaKo;0BYW3y(V7b4;C!E`2Y0a3NI#K`LTDjgT|EF6-Qu7ll
z-`L>&bip5f>ukhfsh2ynR1{+|=4f?h6R7-uf^Geyzmsmu)z#T+NRyn&Q5`f;IFzP$
zGBbQMf8tE?ISGqZ58<UyS44|fWmXw^B;H}xi|xOSQsG3-;jgG3)<<hiZhjZkQ|!_k
zDn8Lux#6;wcT+c;T8MQ<?2{utu8i7DsA!ckj*03iJ^i$cqC|!7UQ3-!Y{8RVVx6#u
z;oBgv!zPG(R|>*pUg1i<e?kQRJ)H2Xbh<JsLfcx@ZAk@}Ibykc>~-}fe4Wp9y3CYM
z1~lEiXV+AYKL$dam%LC*lS0-B88{LX;8X1|L(z@><bg(E63~$#wNls~YA?3lBa;S0
z3KVV$r4pGXJ<)iT+rIsAJzoPOy;xuX?@u!$^gm^a5<w`_SA6uZGIWFkgH!u_KO}!3
zuIa-Zh7T<KQs$+VDiC3EDxj!M<Ws!Gb|Fzzp}<`6d&4Shs1`<dC`?e-x=sz|Dns3t
zn02ueCM2PBmQrN8<jkI<yEUuAz`IxwUDD^~IMB)D>><-#vqm{AFKjHRY6Obu1)ZKS
z`Nm|>A07E4lC_}`b0Jp-7gZ&b9NP;Ml2SgiP{%rAiI_*HF1Vfth9R`%OiP#`*vx&|
zk0nV^zo*-hABZdO<lF36`LG_zwHWQLC@_U(>5vcc4m!Cj5w_^kjra!q#1ubKASNH}
zgvS3bPK#pkj5;TJ=Tsz-pKVEXiPSyRjJZOQ3Ha&ufn{r(Hh*>mgqJxY4=E*%Xpn4B
z_@f15C8e}ZY#jLF_tmM(l`az}3|p=c@7g9OE__veC^MWa4)ItsnlFuRNZHiIB|v#{
z>bZ4GdsS(fudF-n$y6?dWRQw=5%_VXo|~pBe;pB^Y57?O?>6gZR-vTcZ18@h1zOlh
zV<Q?;CtsS^2O5kDK{B1Hpjr8yAR40ZbAy&a>elqMc+|Z>eAL3P{`duNrqs5uQ+kn7
zn<bh@T1yTK2FdYJcZc?LD9rNB?aUrDF_wcUhLU1CO;CP@2NJh9@Pq#7LGe>h$<-tM
zkr`Hp_l78l6q4%<nBl`Pq*ciD7e1uP&W5fgNae?RG8AuYj1Kmg8X(<W$qv1sIq6{b
zBq1WI`+5qg=^jc2-i%hfcwx#W2H+s?2C#2)wchP${kIX|V39D-Ar5<2w`=4x&;1jf
zQk(F?+VUY@_B-(__c+jLZ(=gtM`L=WK(hvZ=!y5${}R8;CegoFZP|mE@C5yQHW1@3
z$Myv6B{y&*Ap_AwweA1a!GbA(Ct4J^qa&N#nAv=eFn#B(bRBS;Fp~$<o5kb>Wk#`O
zb?^>zIrd%?3U6uqPMV7Ei&_!ul`O(l`wm__yjzq}%Zyu0<Vv~!Nh+y7-04cb|86Se
z`3#MP1P5+7A$P2GQ6>C`Ox~BSoz}T%>Ua8lTzylsbo?DoVzZi?rHvL+^8V$ro-2j}
zp~zQ*nr{BD)o{io{fR}_YlTXFz$jtLH|;6KuR}d1DJpj7TtsoyNM_xV(!LoNyz$$`
zv5?}3jmKHFxDpF``uE@X>o`(G-IBd9=1@?6jcqgZu`IarXugVZ&dJfU4E9t<*kt}N
zn`c2dTjy~j2fO{g#0L8V7s`2dVfDN<vX(y##o^);LD*2|q0|Ay#yc5~O|PX%CbqtJ
zgh5`Q%T`p&E=U0JA0|_JNsspq#b%&Hp4^06CrRb((N#W7(6!`Hn%leXvU!)q@-RJ9
z<%)$c4*mJhT^xg34Q3%_i7V=}?z=bB7ZY3*$wp<op`u!&A|SQ3`IAC-a*CI-NK9xo
zC{HSOe4_TBApqaQz{D57ST_?PA-T5AQDByOMq6|YX!v%;s@pez;gT)sws+M$V+wic
z4kqVU-oKY^b9N=Ac%ZI>Lk~{;^$A^GxHr@qemeBq^Z#lA>gxO9vc%P}!lzjr;|{;5
zA3Hkr?Z>?3U*1Wpr_rj1|G)rg*U2e7mu=%bA0dZj!>+la&lgekN@X!nRl<XgR9J+A
z`_TLBz?SVemvLih)SN{(%{KnZtx(u{729i<fFY=~32(HwUD4dKGHS{c?kh?9o&B=A
z<}gs02T4*QqNpSTE19Wg?J38hl6u{{I#wHYWhf?Grbhq-q9kX`!VJHc=564q-o-w%
zyc6q><2Jr0X$^qm2!ntuQX8mPYW2`#FpJr&8B-Ji$WrHv3a1A$?J?ih@ebUQuWM4t
zuil_OYj(M1fB+NAy9YQMplZTOg;}!(S5A4t{cFPFtMDzs27}&~<Ay7~I6TU~p%3LT
z%&c;HNc)>bJ6?Nqii;i%Q^N}(L@geC-dH!R`|g3SVtZ$_oxz&hjl~u>if^%HoQ`Tx
z;zfT|gzYt(mJ|EKw|roMxv)F}mzWvAbjBTN@i6?m!tUN??Dz{x#MJ`iXw$c%B%s0Y
z`dY1}cvc<KeZ!g2;M^yJ2^Q5iu=#f9C%WAEtTD-u+upmb{FbEV%Y{hkMFj4VAW-nv
zl|)B7p3hQFqpCZAquc)*Q%{gd9|1tpMqgw$N7t{+zFBc%D9A2Hm8Eso+Zm5kAAA!X
zRZUi+eXQsV<;RgMX9Zn~u6h_bnO>_Vl@tY2r@QREk>LWly*2X|7K~<iNPradmn0B^
zjOfsVmwM;#?#nhgk#B!^reh{sg~c*{_TgtK5p-EE7CXc~z~pD2uIs;$HlANfe`&9~
z7l&_@DXt>=$~TWWG5fb_Zh}CTqkl2>C~WmCzDB58c>X)s9=SmL$9BQ%@+cJ&?Okh{
zt7t!2z2GY8@LlD2N|sdA3An?cwYfCo4r?%DZtDsxx$3Qh7(qd!%F&8=7vW_>Zk__K
z6sHH{l_xC=R}HU^|Bt6B3*(}Xz`g3hHy;sj5)-?7qC*rJ3r9ZXHKq+BkXU&`y>i0~
z7FNr+_K)5e-MpKVPq0fD-ukft!OI50p$(fFmm1^HEoH-Ctrcpo68()HxXH&R;X3sh
z1CNn5xbg7x7>BzAYCn#Pk2gn-Na1n53ZUL|_`j_9M{*^E0w7)TV){&T^w%9uwjPq(
z^kekjfuZacC>FjpHkDs^me;<7ttXS9hzvtd$H-Hk9BZ8?MnywDVL$?%NL`zt6q9Ky
zM9g2{S3a<Ref$-+{wZ&FBh939$Cp%^-)z?&-_)&qaUF?%iqSUz(<|O*Kc36|82|~-
z&gFWCO4p4qML6JfO|)1ZHoyh?W^l_JXtKXmqqX8|`0(dxK({yi$NOtGF$(FY-N*O&
zd;h|m|NXAd&&J}wLOT(FNqBVq5^KKNn00)}5gM*bJ&MUxT!HT6-aE^q`ox7^#4L$s
zm^tzKawL;e7Y)EHC2LA`__=Q|>9__L4GE9KW(M%>xNM2onKTb&F=OSN^d%}}{g5-*
z;t^M3B*C}#KwbuN`?#KHZ!~vDIX8b6L4l~?1;1>YJqwW2@<TP46rjfBqpID|{7BaR
zxbh%gQ(lJ);0M8C1D)>x^r(bu3+xAM%MUV$;%n#5zJHvGhuJsabm-mZVmL5dq(w)t
z%_GY+ea~VhcNdP6ARbT*o&VZcMrtcw-H9@bj68X9T{R-4kwl^L-&D;aKy)Lv(#hDr
zhyVBd{^xW5&kHTQo!(j4RIfAPk9H)!MYPqS-22=$%7yQ-I>kQ&R7TB`B7<S)D!y-N
z`?E)!QGFm}sg;iBsgjibpTP;nZQf_j4k`Xz_HqzO!%_icYVavTH#DV=ZQ+4VX+2D<
zHb+ZV<2`d;i-=489p5YT{Ye@uo;~IwSz%*TH1-;BLKlhIt9Djyn8v=!qkG!h$WD0`
z!cLW}q}$p!CusL|pK)5IY_{)gFu-S=Vp_L7{eMj2hfN(jNzZ*IQ8~J(($_zTNi@g{
zlvy+;Yjz2v5;ys934??`AvfP&w>of!)Qr~%Yh<ikuJ|U|^ad(`;Lb0-2va6LoZa5b
z{GYeizy?|ix_5$;QfGhhE^WhM^O_I)#$QH}i)eUSpA!S(SrMIyhw5La-8~I3^Z+6q
zu$)y!rsOwi#7>Q|t^MUxbyU0-o?uIO^AStkAT|v>F88@}=*@$ehi@;}TPY{ft6hUN
z4z883>nYtjX~OLXQ?u^1x!4D9Ss&$3!Wy+)T(%_lB~}st7KQN#LkiS2&iJmHZUgHA
zboOxH*^il&bE-(M$m@keUP4;s{<&mW=<%R}cE)m2Ni!m71aNp#5PprA^tKj|2f_q&
zIg*mwPs-RIuJ5K_9DUIo_&gZgimdBUVg%VSH5aby<bUox)bDd9)Sn`XB;zj>_mQqX
zU)ucC&xH%7VT^S6#})VM>v29SVWa=h*iQ}bj{(<w>Z)z*-+Y^zvCg36tEVGNV|=bt
zlF?I=*l%uhwU6Z3PBhI_2KqxXaVs*LE1=N%EL3n3&s~0p=%PZJ7!Q)$oWBi#dnFKH
z!=VzMe=NtfR93b;fbj`<&TvdTew!2X5qwzbsi<57c~F}^lWbJK)AGJxJmWp{^e=;E
z{4zUrbvrQ*7q>f@fL@UdM=_O23;Ako6c)0FN99h$l40ZTTUejIeXtb(?L@lii|MvW
z-Tw1+FTZCw-fztQm@|G0;!ynk`489Q{@b=!2I`X|V555k-LOQ!;lg#kZlAuliMS&B
z!M!-II^!YSx`)i-tz@aJNm8`JXiDUy^X<jB&1}0^{T@d9gGD>0^snYUaH}##xA<J%
z=g6@q>c97=@@8g=du%k=^53;JX|Vw(+#6q?OD>Ex9}c4*9JC(Wod0eKo86-?o_qd=
zbMF%uJMR;C9ydVTBKIIuZe0mnlo9&)*cHm1`Vp$qz3t89(UYH@0au;PchCthH5^Da
z{~dL3Agr&;r9WRpoWG?*4)MG7<kL8g+*QsL_yn1f(=Sjn?4`#ncXG}Q5)Gz#Msj{W
zb`1N}v@gk0ZTzNdWrSD1{7$Tbl7+)m*@)E*_I`+hnXfQa|4U#y5#HSaSyEF%_kp6c
z$MJ5;DzB*F74DrI?9agB4YMI!+lAq0Qd?=%D%UShk8VkeX-{1FU6>dZe<A|<HYZ3J
z@2wN#lcaVE0@>3aaqe|Gh#D{;ZTD{(3Z*d8vr6n=cBLx{e{e8`gxLB9^3X&&d6H2h
zd30nJSasyDxduvtuMO{~%aTA*1Vp#ns#3eWo;n9G;Ny>6J((x}$>=sHtv?J_XcwOQ
zeF9%BcZ!U=Cxk_WJ~k3-^x}_3JaTu}^72n#F@I?o=L2#5uho~5bkZKq;+9rpXa2O0
z<;njQv!5fHW#y^z9xZX#?DdZsu%7R~{%UDA7oBtP_yy^EXQ*>t_lJA^O<@T*toBek
z10=kf+f3y>b&7yhExc``)wzDNCEOG8L0?NcT<!cBjc2SQaM?)^F)Y3=Fs0)j|Io($
zQH|IR+)8~oNrq$}T`lCPk8eIcT0bNK6;MOQ_bC4u7ZKsg)PH~{ZtmKgOm%q(+q8IG
z7a9xai*H`R@F-os>59a?EotnEGVb*WqJ`ANXaFH%QU@fwu_U?%`yGUfEwPUN@^qhz
zo`1<j(jQMbJL9g3pQTA#5*;KC_9o+mTSYfDpz-uTQY*~Q|6ZTC{(#t0or8rRLl0!-
zh=9FAcr>$l3afH%hA+n!)6K@6o5P?;e7F1(5P;c?a>W?dx`WI68ulOlv$sXJ$hxz@
zoF5o<4$o%a%ebz$Pi=~W!};FUiq`*6JK4b-J;}J2i#UFQ*29K2%D6VSnv8tPv3i-<
zzweAmqcouFzEiV`Zoi!|y1fw?61?4!QHQ?_L{&8|;=Np`d_pgpH5g}}liFIAYb)}u
z-V|>WD2dS>3-MTXDdX`OWckd^rr9bYJ5uoa@bC;pmahX2Gx>HKq<LRBDQ$=9-^poT
z95IVxc1tglOGoHna#^5n^4;a6CFR;lJtkaR96I3keU-%cWFWFMHe#KR%IOrJ&*w!^
z4>_m}A5?-6!V8#!W-ZIT*6OOLXpLQGsS<?qxJ-k>L%(s+UJX-!ld`>Hz#2}1l&0qW
z2ib*D0k*e<Jk^D%%9boS*T!G99lOZ_d-Z?CoR=#sRryOs9>jHUvUP0mBFEoYJ0b`G
zX1?1VV*B;p(9z|Sd43?<S>fx?@hM{3OEc4N)C`uo(mn;S4kVX0XUWNn#{q+#(`!M*
z^SVLK#%|8jg$GpU9>1)o!`E*EL+ZYAbXQPQn)n;-lxHes+DK{1J(8_b{^IUoYjoEr
zFH`?9RN2_&I0vr~?WQlNEcJ3DbQ~8p?v!SDdOAp9nD73K^B&z?$N*TGBTjXXqZ2FK
zKi)FhX46cri37V!y6?8$=tRW_KHpwq92GFfi?OQWTX$%%afYJQi@SNdX3hEpfpoLF
zTs5ONc~*-bc&8u!-g^#jqcIAk5X;fH&t29NJa2hm?3&h^JNkDViyFyg$4v?TaW@wn
zWzK-uaE|VOzek-oCUFQJX3IRGg%tYMVsc)bAAy#ZSKLg-6RUnpJ{SJW!|8K6Q919%
z<%8rH2kVE@AYEwe%E@gpdV}R3b2yEvs%B&NbpIYa?<az!y=~4BT_CSL|2!N7g{e3t
zo*&t?ZG0Z)6NkkhdUo9GV{^Ra?0Zg8gY9$(d+A9~*D-%Dx>%FL#u_4c4!UEym6b4M
z#rF{N6c92WS_i8)ZG$CAK}8O8If((XG0mbt-3+>mQk%H~!etK{OdM#%eo5yD3Cluz
zseYzOAGU2vJa{N@z~}_cQ-p^~srJwKg34UsAm>Nz79G|3P}xAkQhpkW8l-zEoIbA;
zHJr_qH!-9FN~j*Xivfe-I_VSl+kJw<Waa3pjI+T4(oUTvr}~Ht9i$4UG2K^1!Z~Y}
zWoy9WErf5n5cR#o?g})z)@Yw8=(Y{#Ei^G+4_&2ebLvBalDQ?D#9IDW`Kz_M&O5*G
zE5GVok6=&Vm?ZR6YT>N5I(rVd__C?fre#C`$OroP*_YOx{$w<m6V3S>V7nD|mzpT=
ztkm_7F{ycJvs!p;TAP#@@w4G>5C72>C^q3P&vSJyb3bpp$mxePxZvSz$9c_^OywfU
zG-4O^S=c%lq^P2b`TB>`)O^I4!xWx)-h504>Deys=Ud2cU*#hWRBwUL75_WXqD|N~
z*<By&=nHT_>VwQ5l}lZRd&;OWiFz=9(%YK7WpC<F3(|~+DVvp6l$*Uy;w&nMCAU8K
z973nG*{7?j5^v7aZ=3L0o_v{F5cfP}{M9cM#`z|>fr*S=eDhy}68ERJxoS@BcfIn(
zV)b)O&d^x+p##m5bCv)>nyL@`PTNIxzktsO`|uuYHyfA`_3~*P1AQ*xM%eALGwwh-
z?<HE}pLZ35my~kHN@MC>+HTqC`X}gLhj+ETad<$eqNOTYha7dS5>mG@g3Hc);;)WD
z70ld;WZfUI%@cPqkF=c1l|~6yBa$isl9!Tc?KlW6wrCm-c%gSiN<o>Md6hHYD8y-6
z_^?A7`_FRCA8}p|3duLFb&1F;p0o^>a8dXC;=oIF%8wV0hT66h-Yb)@Iax9~03K0d
z0~l_g4F`)ue>I6CLBAZX6c2>2y4u_iyF*6BFx#IFMH<DGylHue9bUeYzOkjlPGBDc
zRnwv9(QSUWD`}iMKKv2Wu3ghb1C*I3oPv6X&~vlO2Iie*qkPI^Q+J6VsqPM)#dEb-
z-))upNvDcuDF)uHDx+FANs&q<=!te&?x_75CP@~iVG_AO8kE$4R@LV5HCFiI&+7vc
z11P83Ij?xGL{Vpw=!Csp#K8|3^7WmaUB9u(_+c`J5vlU<g0|m^U5J<`a^jbQVk+@4
zOAIv-<ho{geC>Qi<Z|l4v?7Q}^IeMV9fs2}V)Ot(&o;PF!C4!zaAe+x;8SE^_v`6F
zG~C99oqXhOg(t0^z}H|y4akg>lYxYH$|mY{h;~ee&x()}Hz!^>?av_RppVP$oSuZ|
zZl~qu`7M4Wt23VG(Yjz%8=ve_3&tkAX-T<h)@cGSo3!~&KxEhBSSoo~8G>>mh_8*$
z_;3w8?~Us=xx~_WR`gz$A|xQoCsLs02AX5@Ai>>ndMaSmqzt_<FW1Y>yhWc&Rupbk
zF-RQD9od?e=Qpf8>8#s=m?ScSM?&Z{F7~yA=ewO3F#pV@ZlT!ZD>_h2STa#klWo@s
zZy+XB>J{&F08tu-<WlU8lskM~2Xp+=NiJmS`!LSE*=;p=(jlZhbA6iTlkwjwo~p&#
zUX0!c0SjtGS!&c8(v6=<8#`j7(U^fKmfF9p1%hCkB-Pi8$`vU>e_e;vD*|jY<0bLf
z9Fds+=>KiI5b6Ka*P&Ja<ttG}2$hBx`PtIdpP4lOlkJL{e*)F`ePDmJRG$eluT2PF
z_3pQJXQ>a=_^UEqRd5~OC1)_<s=~%wv6}k6ijP9U_d>>Zi`)^LC{`?X^n?{=f+k!u
z>(SUxt~?;B->?ak)SWw2nPU9S+fqH{a&c<<1#$>1O7yBMhV(?T;t0d#Mby+mqs6aQ
zqa!C~eUTE4`(VTeZsv4>=v`pkjZAi-e>cT`8S!b8Ktu8?sd}|JPx;>!=v=)X(s{jI
zyG=8c-Qu9}UT05jdlW@`6qkpCWLo!S@bPCCk8diz423LN1lVnK<`q!7zIE$Vw+O3^
zFnZmoSc>P|3?jPWX~*B{#Dfc#*BdVdsV9GVUA+Tbk3B>jyWDkSW8?gmT~`$ml_|55
zak@C}ZoBO8LIN)sV<ZwOky0C&NoF%zauK!~vLjCZlzHCqXl|lKdHT5ZU&MHHaKnjt
zkG$V;8bH2JpDb{um6@rU+-!Ts92D&?_L8FY4H<%hc2;K>O1+iwI&|Z+!hMpQrjtle
zm2Y{%Ja6K$A1^25P=pN;^ghE=mhe+c)Rh@VaA>`|8*L9{-i}xOr8XtEY5f{&rk!r6
zFF?=u_j30zJ?IawH4&TZaeevGl*p@}H&{&t-=GHukB|$F0tQgYCI@)(`1l(X8zs=E
zBy~V)TX5Kl%V$R8fAm`@6PvnF(LRcA8EoFjt26!%C@0<1O*t7FnwPnjiZ0G$z520v
z2^QC`s+ACy+vPZbrwtSs?$b@n0^vPH7bA%%-0n72hMNUz&0}@s#~9|}Nd@=KU8dXo
zBo+VZ-*TpEayB88JtAP>*wGTNz6vpsWbwVb^b}vsOT}!lF@+y~Q6#JMBFXR|><7Qq
zM@bc~`899+F1nzTTSXd=X~{UdD~x21R}NIATkhg`yjNlm_|E06I^*qXKMYUUQs2_a
zDzE|4o2Afnd`(x{E@#fI`e_{S(Zq*7P$hJY(~Frl>8UU9YudwuvZlEFN#JhlxdTT2
zwi;us_spGU=5%E*!u48HL2tR%G_or3cS{Wasyi4PH?lVa>5Sc~5BQXRzDx4$>3(jX
z&65CZb%?hFjlGNPPH?+D-5m7lZJre*j7i#p+-Ys}*c|Z|r@<Z5yW8#E5`n(;q!qe8
zJJ}q~7_`}hH4D|BBmS00kJ~Lqx4j?j&4fE4T1U_4mnr=1)BZllRlN?6T_QGrPFy^0
zs+YSaZA**caJZdraY^TNFQ0!}z-L~UImos;fBSBmsy=w?ogV)K>tXSB)mxjq#;<nf
zFr_imRl%`Vi*C3@Z%{+JfXx;xy;eTaZj&(m+6}xJ?hEE}+9dMs%Y93``@J_Mkd`i5
z24t3Bxl3Ki7o2f}TucdF-!9FdADdc=O6z~bBf4B0#M+rnvel#B4&_R!l2*?{h&5Lg
z<DSkdhB05ZY-)xScU%29e4elF9K8~SmKKkT{vyii3^j?XpGR8Df^?H;O6=S#1*)BS
zQ-FM1M^J&>K<#8!GX+i_^z*8}k%%ddajh3D*pUNi$KQU_{RKmEU~wuiweNhBYJX-q
zlJz<CAgdt-JH?SR&wKf9B*=#Z)XSa^O(}_~>!`rMCNY&rnvh1>_mo5)5^^{HuCz^1
zgYpGPk1;Msb;kumgeSd9CePO*h=14Q41uKQq{DIGOW`h~p*-7D8nyR-{DTSfYo_Kf
zt9bbz!^Z5P)wGlUT-?7_-Y7&=c+>mknXbUjI}UCaYu~zxq=DPI6Z1Q^w0S*E{Mmj?
z*&N3)3pst*3V&SJh6P;^gprHTwh2>b!vxg(OsBuw>epif9+<cIA_d!TauU`<G612&
z-s2uuW&WE*QBSMCLMk^2Ht_*?-Mq1{RusSIbz@d;LPBOEi$+;7G%5l74E$Yxr(ty-
z%N1s=$KA<vb=@KDebtm?fc&d&qj3C_?<Y;eBFJnlPnPRA-?rMu&sx}@8*Sbk7Y#RH
z9iCs@?1%IXW5TxnLt+9>VV|4OB9!=0{Nrec@3hO+DAVDmWx00^h&11}+E2o6KbN~|
zba!!^2JGkZ1Xtsg>Z{g#`sQbsv!_1q3ys2Wu=sp|18Y{4)@y~4l^Wxij?6!6x(~0j
z?B9yE&k(-7d}}lllibN{>gb>3-57sE0N39l*sK{i$bPLY6~;WI`%!(4*V(c+FzY2G
ze#Tlqkuf-D)V6zv+VGKAee<qhM!@;bF+>~*PnS9t=r%L!B`C#KZP$I;(Fxxy#b_O$
zYuoDOn!c}c*fiSLT<|R@3o?GM)-KX8TeT6|-=Eb<#$Uu3>mVe_XAda|M?#)O6D&m~
zcdP1O+W4oQ`0R;NJUSJGcVUfQrmAlh-`hreeAxyiw6M7=_}x4}=)({iX0UHgrF0#g
zT+vQ`Y*hHg=*&ZCY-{X~SF6+-Drt-bi7D=ka81DCkSw7I{vH=0q4NdS2-Qv3W4oR)
zdD)H_%k|j1KhM(!j;*XZyebPpxzIZcUw#b%cRNM-=xS59(#VEai<*3=u{!1qKN6Mn
z%W2el4UWK9Id0DC0mpt5yuilR36Iqo_G+soep@3fTc&V(t25X26CcmJ2BJ@sqZI`l
z9%yy?bI+lEl&5ao-K%hf8>HIc6y~r?SXk$6!~@P_A|H^i&aC`${yiD5X_V8-A+e%)
z3m+HttYZGv8OLo{ENpf@rP{|MGH3lxajq+qO-U^}gG!V1LPP7h!6Au^?F(Z!wdGw#
z|Cpz*mt9c=%Vjm8qg*j_!8l?_zjJ#04cZ~8yQAnQ+W_K`wxV0-*Z<M=7Cvp3gPTBL
zGv!>f`@5%UofMN82POSITK^u(i<GQw5CquzzNl5pjc!i8pFTll9V~7!BnsJzd58h7
zC~nX{qZ12`IN3<U&OnkWii@}<4y^5*t}2fS>ePPi5cM_vFn;9D_hXyEJ=#=MhGob}
zN=jO1T_Ssd@jejp`Vjjj*WQ>}p#cFBtM+Hdzr{;{j&*h7+9#YF<?|eq+-4J;-Bc^x
zy2f^?r6rV)Y;}q77-7#?OWB}g?u|C!7Zv<fiLJ>iq!TlB1$9r9bKQ&4EiBhlnU1G<
z+4!jLI?3Gsa4lcZnRNxO_k{t1$0g6eaMW>rPdcloi$*sal{e{VjavozeO8r$kGYU)
zsdiKEtFwN#uPg#W9n+bz6PpF&Ex+2&mxRUBhmdq<<3i$jQm5EE6uLv9Nk2oOc|1wp
zg2>Cxq679IT!-A_9gZIl$@<)~QPI4-*B(pLPgYBJN~4coG|lV0(=hdW!d_SZa*x0E
z?b1s2>gU|~wlQz!*tLlqWYuZPQhijvysvwL1fKak8~<GiwDYrO0|Pr?niQ?mDm5V5
zN_z$^*J3CSW45wWj2wP;(-&4Q{6~bAh0wUBNh%RwG$+T`8A|Na{HVoz1Y2(kSoHd2
zs0Z_r02Kp@@<_F)Bx?a)Vl~=f&ZNM4oj>WJ-Lc@9PU0L=nWG&MTX$OHM;p9eZm&-$
zyYg_kL+pWrSvlf=F|as<jZwgM4lmz+t5VGi;@|+rt?MS%V7!)T(tfCoa>_~+f%+Rj
z1A78~{SA4{HNw!yvsN{?$q&@9kN<W{m;C!PGLSNsOr<r23pDJjQAr78sK;Zm1VLSb
z##QqEJMj8m8%#O8ddaJ&?&LX|rgQ9=>)L8zpkVLgSdwMnv><&&x2~r1%5xPb;}HyN
zueIOi=A6D;JoN9wLiKsByLkBD5?oj;N}@d}tHs~Fe{K4hc5>ye7XYnj)(-Pcd>$|H
zhn~gYvY%Zb`ai@d7&h9jdTTJNE}1;MxDtvyzjpYi=?f-Aq&*I+Px_}B`N-Ve-Td6K
zxqNYWJ9!@tlW`tFL`tQ%pKiTwKYV{*>$*JWy5VxPv|kaIc#)e^X+*>BgpGn3K;X#D
zuhbXj8&1Lzj1|T2OM}}gjqyxHWluli2>tz1_IbqNvb4&*D#RV_yMX)33(V&aMZL+M
zDND5_rpO1QBaezt_&+LQJh*7XzP}tTSMz4WT%ILdRNM3vK8zTue?g6d@a8?+2Lf(<
z_4BRw28!qIiGPX2S8*|*ub91v8>|fD&9ZSr73oT1pfd-Z=+E>jjDVX)wTv#d!bbgX
zSu&?aO1%ZXglHdFa(!|mF(WO<F77m9+OKlw2p~$TjPEx-a|xswFO#z)Yr)qu5t<Zm
z<O08i-Us=*%6Z@3R0<&80{6Ay1TGkjT{7>A(qG>1k~?)Dcqj6np+|JGa~UnFE7N96
z?7KgE9hUESGb(*)Yipj@_U9aX{Z$9|?XF-E?)2^;cGYsdHC=V8tj7_Xs}3*JMz{2#
z5_r_C5zB##`Fvc^i4gMX6sD3-P#sOLxj9%@CWSxdi;wed{RQsWt23fw*KrL4fNIa)
zCqh>S17H%|JiYe@*C<xIceRD<_l|eT)m*i`NL2h^Er9(w&n#|8u}xLtGBR`)78hk-
z{fR@w!B4)Qyzqd~tpL_j@CxC)?)pobn@S?ug5hsJ>dxjYr^&v^CNVq&#{L1*waFi)
z@sK@|e-E`b1sLlam?wzP4--zeA3aCL<2CZ;@-!G|IeJ50yKjX<T&Ks5ONxC`7JI5-
zKL1A6zY&aTR#p&5qIF7drW38#M{9e-FSB;eUStRW64}<4k4pW~Z|=B%C$N<b{sHY-
zj3VIu0K`JeolvrUG7|0wO)KBmk!x?X2TSBR_P{q%6pY59RxiFf19G*bvdc@Pc|#Fu
zF&Y)^7yc(6)zqFO;4Y;2mO_`Xa7qnVA5jIZmoDj-b1SWwNL>XJiA=)9RG78@8le-1
z=N5A#CZ`m3l#F!HUc(-AtbPjz3jIUcsy>6m2vpLNZE=Kw5Ab`=CSib`+0%Liz2PV0
zZ}btp_ke=sFU&_xLk_6TksSkq=6|^6I^*edzOQ08kXT$JBGE>hER<R<o9<*P1ZNiM
zUe;78<Gr3^c66NgGKNH(+o<`BP)NOg^m=7$imq1tt3-x8!N8-@o;k@Xc}m*&c*<qC
ze`@~`#E6E^r4{&dmzctzrg=hF=l#3Ht<S}f7@@EbBdn|_)n$VMlL~PI0|HTqLjekz
z6YRhmM!=1bpT-POQAv!+Wms6IN@`KVW1@8cya}@5T@?Q(oVLh(-C6P$;_Z-^ejwIQ
zvD@5h&D$KUJ`N(0N_b`2xnSj6lus6OxMYEK0PIoh%FkP_sV8xBX%;^4(HVeaVh}0E
z>_s|L-_EQ;=ve*WX%|D_1V8bIlFRgrx?oT}p7_L;iJd@FKbLpjB2~v<<Yx!xa4*lU
zudGyJSYU#rq#QgGKhX2%wcExtXo3Qu^Ir1!m)2!+s}*@k6`r)e>fAfEHRF|0PI=TD
zqnAJkeq3z*K2OhN9G8ri0MNkx@{PG6r!tF1J?+t?yhf}#H&QO&wBuhv3p5-BeLMAs
z6J*CLdSZ$7C6XkT1oYg+@BsKXhST^~F53~HQq3dTKrn*7R1P8lgs3|m-85^;^ijop
z@nTNFMF1Ty_ZuytC@4VVCJ|Wb<&8PCuWC+@)FXS&KfN*;86kzi_G_i>wgF2sw#{_1
zQF{>&ncJm+iGQTd-UUZjy6ZkeCBve;HsAUb&-Ods@$s=4YCQ|FOtt^T);kAB8g*;m
z9h(!|>e#lOOl(^d+t$Q0vF(X%+qTV#@nxR#o_fz$=dJ#yyQ=H1uKQkV_g>ff?Q1#Q
z#v|E)0vuk_S0^s>q;dZ4qC0&bZ}DH+{;i3xc<&+=xtg>ktl83nD$dJy<g;SwS@S$m
zN+}?djDwr~pB#$%>Z53=^Qvr)&F4FJxjWzp_yTxX*bL~P`~?+qKF-K8Ib;Q08gA7w
z4w(Tqb3?niMTtJDT$o_$69b<#YK}Unvjt$8e?@j%hC75^HFXcjVEwZkj%-IZEnU^z
z3qvDHUik~rne){~>U*R^YZG*%H)KUX`~L_fRVO*hx2ZMpR6Z}P)(uCxNiHVR&rhi+
za574PgQqk}RoJFW`6J>%aGFZ7!)ekDzX}7F-YO4ns~i`WMK%Z;*k;?=JpQ(lz_**b
zHnn<HNNll?BYUaa0M+D68Wa8O7$iPdjL$k_azDU^+yeI8g)dW2&?GJwuhbWJ+P1!p
zk-J>LF4FM4@rZjZIF%t?Vu7omt3^d7O%bjiV(0kw=`AN^r9Vy3W!_s+r@QfSd#Zp9
z%KGu4bG|=M7#DYB8mZ@bvqxtR!o!Ix-BSNO+GZ8`l9m6HM^=VJ_|=7;ZO*#}GW>)K
zO~sr3Y?!Fs6%`eDp?dRmAA`z19H(Hv=ZHa&H7CUf+by$Ug57TJU`s`5Xu^(=PqqDk
zxzs6;H&km=lWA26G%F`tA-eiZPcz}yMIbFW049%yxIds_NA*B-nGn<KV{yFHihcJ!
z1<R~eaJ5d&GKzvZ(JE`abFcn9C+UM#0*{Oa;*~+i*dXUUZa3G2SXIZuvvC9;RgM?e
zQ|dP0%zuH?<H3vnp(mH(RcO&u`i!wKk58CQJv2+d^On~J!1>3re@8<3MOPefG^gAP
z6c%SXd8zr@*4<@)cWPAG?_n%RbT?60xZE)JEt{jk>UR97q6sv7aYp)S*4BUP_Urx4
z$?{^V2<@hQA1%mmnTUYA(FP8%%mRE=&0Av4-foo~{)=xIY#=lKE2GnEg^1wbVNMPG
zeM31Fsn3PO<CP0|uTo#Gg(K%xpvY2?Y)3DYjSI%JxRHI~wC7F`CjIawN?Lrg?j91&
zXfX%}Z`=c^?H^BSPC(U@>UdZU&E^rP0f}As<l%q(W*wvKcd(Xx^i?WHGr<tGI|(QY
zweXub!+O34#VJ}JoL!}=W<xH2B@S1>+)2s<k~5}n`)j|K#AKC(>T#24lJ0qY`#|e<
zF09_6@HMl{SySD$FM_teOhSQUoJ`oFU%#l-=NL6ZE!fKFymYLzDba?orWp>8Z~G4A
zlp~WvA!`D|hbC1~{gLXuY^K?S;Wdd6$Pw@_=hP%D8!@n{=PV)AY7XBbS$3_$<b0^#
zQ9RGcQpJ85X))8NywlE2>#n@PJiye45|3wkzmCCUjmXo%pNu^|iwwlG7X_1ynxjix
z=OIL`);yUM6mxt+tSZgDWG$cl<K@ge2~VSmxFIdq^AR{@llHz-p6-j_byPi?RY%x1
z$#B*&q;9g1I4c&N!OSc?BmoZ%=x=^XUBc9IYI^%aHwB{d@jhw|!=nFsKQ(2%`Eggj
z75=Ih`6#P@`^Jrq$vWJm-C=&h;W2ku^>#Ohx%Ivm%;$ccK}m3_T=%z%?UY_CZcp>%
z<oRHQ<uW%+!tGi#Y^ciT<_rRXLwrODV=Ted#+Ee~b+HqV=)~)DbIE;A$tg+h2gB!^
zR#-t7QWi~OI}d!v!{iBHFyBwQReL3JAlK-hRrR<~o)j>EH+T&8;I@Qtm?Loyty}8v
zC1=b=2{)V-s_U;AOmSKqT%#eg;UKc}J!m3pKMP-IO6_nKdgN_Q@Qa*8E(apOWN!;E
zD3q$CrFpbCI7~LE$p%h56&7QxD9tFC!vbDBN{pNSpU|_4fX~_ghLO`Z<LLfj&qii<
zjhXPi!4z=RQU=mV2gFNNL4}n`B$qqloq~TJYDOKANqN0B29cB-S{X?XWGH8wKS;S0
zYK;B3BIFwQB0B?`-Y0$w>?DL3OZ1SrdM0Dtp)H*#`E2{v5`iH?>JsHjgd~wMy68N|
z90UgX6VV%0IzJR9Q*dwl@>8aAwM)H@QL9rFo|n&croY=ZO5Acg{x4oVgI26wRIQBD
z?0<9KvIZVdn!kRm=V-^p596Um^Mz}TS!Of?3-aw@*S~o`dbA&q6BnZ$p)?k}nfpR(
zd~{{uGEje5rZ;p$P9cjp$nTVIEn5N3cHWv?!8={unyy6PeB}&xYCo19Apd9;Tk_9)
zy%lof7oY7xg%j-Uf=S!N>iVgn!}`zM%_xxM|5T?mg-iHlxSiai?ra97KOvypmYCOS
zb>fxsM7ipBm+~=Zi<m7VOn@y>$IsQ#f(8ih+S)zni48v8^B`$Qs7(y4KJQ2DO7R=c
zTi0KkX+QEqcydr%+UkQ-x2;Q+8@yra#)cSfEN9h=yNGXR9X~9zSCi95e!ehoRcMOR
zEeh2=_<lDKI6DUl_>F||p>Zs5wozqIPrdFK3Gsl`{)m`w>~`3SCuVGhK2+|;@xsR`
z4IbxGa_Vp)Vfg1=)j~bRJY+aqsgs`PE%wtzuL8K7L?KPFVS0gUFB4ZNYcbB)Ww;UD
z5&9&Dd$nU*>3dXkf915HU#p(*r9`9K^cg=OP$VVc-`#iKj)y1)IylQ5NY(MYBp3gu
zNOkEGL2n;N-?vNtGw8%*PD}ayg+HLpC*u-@@P|GI=<9U+MqHa3XU=XBi9}<)6=nyI
z-lNV}8OaQ+4w%8@C!bBTm2IYKPT;swK3P^{_lC#33ro_22B`9o-(gj~2DRI<u<&dz
zbh)s1Qkj^C{53dv^2A^YX*(xQ@Qq{gLuH>AtE!hSnowu12sF(U?keZB=NnsHuy6})
zZQbygxQhMy1UVA`YBa}3CJXMa2udZTtjFW{Rh|l4FW0Sy=a?$?sX7syZk8Ybx{L<g
zh7R4%9$$VyZ4W=WzesMZUGX_h0r%YRMg+E+Unb3)*lnEdvF_ha(eqFJ((CrixeU^a
zp7cLtAOK#s>4}5k_FaFk>&6a`m3+^aFe$g*ZxLMxA;ucUXxIf9ZM0_A7`Fb--lkJ2
zx>&syKkC094`H7^G>qL=T;IRl+Hl>jEK#d(VE@^hYtTe&NK(z^8l6{)lPR9e5CD!t
zFT<g7(03k`Vs`SHsZ#<qv%dP{WHBk)vHfLE8j4<3Q*wd`<&x+~ek5jv+4$Ywl(%5G
zpIOv48r>Dqsc^`%@lhRcfC3t|RvFnhG1>|NloHP%<Kq5DyrI9RFpMgcQ82&(VJ8tR
zX}=}I%zl@S=(8DIfK72>hDg~Yd)>viMi`y!Qk|s}|Dfbc<i{$zW==&~qu9;*F<EI4
zNycIssq6@@19Q3X@c+XsV;iW_zN+X(Cl*)K%#y5Cy~ouYAgsPi(;I=t<of%cqA|(5
zgSYqJ`X+mR{B)G)r!_anl7TSlm1cH;z0g|Ak8UN9`rm}L(qnE1P8E%t<bqG>M}dms
zE?K$O|G>0&Q!oBpJ~TZOjGPUp5ZU;IopFUUrVCR8c*>>YX~rvwfNa*JA;920$f`Yu
zDh?u5Rz><xrDaNojZjA)C=h=W<3o5gOV=KwsU-f0tH{nN$67bX1Gs_HyC2$ueBWaQ
z2<2K|4E9AhUbmh_k&)(;mR-HIbegCrm(?fa3>AiWIr-iq%9XOzG7ZJ6)vQ+L8Fu>$
z%~R09vh`7+)m*f%<`Gl@rUTC=!rsgC2Cy}|NuviyNAw>(u7^Rp^`=AS(o9q9C^xGM
z;K_|$DFuAb@-7z`QqqOvpmwX{;b(8qMCfFy^j^pJ351odZ13p!T~jih)NEgk{6GS1
zIS>t4TOM|;Q@8TbhH^j%!H6^%t=B;WcI)q7gwVb=oV6xuz77(H+HGfzDm7(gM@5-b
zKE#fbq!-n>f(<@fO`2|BM+7%u#Yva+3tbP~)%+LU2FDX)F-fXA@^#yx0BX860`(hO
z^kq4+%{@Pz-8;Iz=A(W%Ne!B3ClgS=hIPLFTF9Y=f5|cg-1s?0`0d>{8K}%cos84H
zk1D&4{p(?oGdPiZqRaT<@7Z0<#PL7+og%}wl#;fTGX&%(UFe)V`NGwe%XEZwIna)8
zSL4YI=_9~GtJ0e0&j$|NHI5{s(y&XR8#mMMNi8nP0{UrxEJ+;uAuL&P0~pg2;m;NW
zy;)W?36jr(Gf9@L@h;fGYX00hc7r9rh5qYIbtc4X>>!461*?Uxtk6e8?_2x2oof!V
zm&7Ay*ajp3j(bq3q?HM7{|U#h541ca7Q`wJ3l(9lELL-07;fk%$$vvi76}$}+g`Vc
zzfNA9IlI1GfuBj~t-Va#Iw&0egYN=~$gDc~KOiO(Uy)q6uf=uWpuC$~(~rOC#GpgC
z&y`xp>eO&Z1WZ0oB!`K4!SOH0GbzbA-?hqJIVM)cp>BgI!v!_D?0?v=!%bi}mK<*k
zfOwPO>G3l4Ic%FR^lE!(+*FpVe?H5#IceD~e86l1k@fB9y85X%M4Q-}g%gKW=ga@^
za_W?u&1qG0B#ey*(Smule#;ewJsk-QuuoqmB{{=d_75q>WPpxn7F*)^^Rd(()mAtC
zO8UfH)j<geFRU=AjBA&7Wc+vSCA`nA>kzmWVT!bguOBrNCiW9?zAjbQn{7o|tbu}5
z?)85%%IJU8h^_xOy8Oh^6O^BZ#@Y<2V4opSPRtvP`IPGx99HdGRAz>IBzP62x3OIw
zvL1z*LEyc%hG~5r9BUCT6ovbB?T>Pgk}nXN-r);WuF@$wBPit_ewki|cme9~2l27(
zWSSo{x?-qxgk5AC-+4XV3&C5EN_c#`?}YX9_8$qLZx{8sxldny!`V%ur8MDW_ls>&
z`s$ekHmBF#utmd9pD(jrv{~U+iaitd)eP0VgZ1M~d5QSg4L&F^Za!vT8YH^PX*A=l
z2~@wf5T6su*i<!~(M&O`aUAQ}_$gHSelp?f-V!x-eJW^dbeT?J3Yl1t{>Yc>&+r4<
z=@5C;T!{M8)#+;xeBJZV#?X{(6IuAGi-Md0GEQVPvTi6b%u(ty-iY={xW@2^v(zVr
z&NBi}y`ZBZQe(_bd59bFA%|r=TO+%?F_U&4{9+Cx`xdyX6HpXPaQx{Z%vV#oFc!gL
zJptd}><H>eqV<?$EQsgbyM%F;ZoRHe<<~b0!@5DZem&Sio-W-%97Z}&*X-vj;UNMf
z`kb!=A9FX8$r>+IYM5NaXK&OZs{|&9LqLU{nWNhB(=LMCd24-wqg8QhC087^A^8C!
z7L3ZE_rSzvkVHs9X%XRru2nmP&NslB%k@<hRM<z5P4j%!8Sj`z=H@pmC#&+a5|5|@
zgrl=&-UgIq>?V$m=$0e+$q>@t?a*eJUsGw~cLE>YqlgaQw14b@js)3K-dd-2RQ~jx
z?>{;$U+;M|p6RCW^Efkn)5wG1LBLt<hL0^rW*K<bCzXt2zGWb~iMwWEWtHMy4Sa>)
z@L0k>X0l_9ix^5FRj?8HbAKKPv6N$ldHD%Ro&d+Ns<5*%g#t8?1L{c$GTjjHF2k&G
z7|FpHy%?>!x91O4Fc{dCRpoHDyZl`N1M*`r2n2BAc4{LyksZnown47HA(WkMv4I;6
z;;o~v$rh5m*6(6{G=Yy14n{Q@F7i+%e9WPowp)Dieuw-SZ_Kn$wb==Pu!|lv<>&kZ
zYkID4t1fB;iW=Zh?dM8%DBVW4-J)7i_1EQoO1t6|`dmfAuUfd)t&gysd+#HDm^UD8
zF)mq~yEV?|(<q$lQ*FK3;BLDM{kdU$vnZE@AE?qok%MRN7sgyV$&~nccNYJZ_a!Wx
zaf+>Sv<srXAEfp<FpbVC;kIMbRV^rn=<e6Rr6PMPx}#wXJWE^a^%}erHp!|DgnE=`
zhTTg}XT6BN7z}LZT=x$|jmO-V&-1S{xM&MYzQs0DR~^Wx(76!MxiVKdLZZkZ5Guae
zCD0gXO0{s2fq~&UB!OsRf+z)2NMuRV!ji%`EBAVC94i~CukY~)mgy@ac6mvB3Rz)c
z8<}2Hd{-@3T#w_KJU(9&A^)NT%hc}p*i1lDkug5mpotUqZVCe&u6`0`g*mZJ_8U7K
z4f4VHX_FS#YP2GylQ1%XkJ;}A_*R-|=WH#~ZH>(uB4@xXZh?Oq+`rnNt>fsqF|3ZV
zLbB6>m#W8Wy$X!NR`Wxe?DhpsZ?a)&?)Tgtd2t|qs8eZ>ympLFiQj6#x-#b=OXMqB
zdC;|r(aws)orT9J*D~-H8wkW*d@x?@f|f{1F@?Oy$b{ZviM@u*%5NsEL!t?)ka;w)
z^W(?Oy{pv{ycnTG=oiVAH6cjMCgXR+sa?!xaes|lk}9bplnE?r*&}pF#sf(5FzXWL
zcLY&|=G;QMIr03`Cd<=DA$7!=bj6qBY5SV%L1y}^`EJbv0Yu}g0Yp|{mhFngW0?OD
z$*nC_vi)lX5&uh_aaUR2-gTR|BKM{fd+wx$aoU&f7)!PU>GljZnRi})5loLWl?58B
zCbV`Obo?->``EJ`tI<<32EyY--SAB>U{<l`farzTW*hg}zB6=q?i^5K?ZasWl^@ky
za`cx21b1V}8I0U{B-z3{{NWX%Fa0A;ydMxIBfSWuHwk{e?ygekD6x&;Qf$ZMLf`x2
zZ6}9wg}HdeRX_qX3=g#6OXyhaGy*GIVo=~cp{sc#v*?MW*J<q(NB%T0Ddv)KCzT8N
zpL(yi-<2X-hWG<bRKUFWxsf)QZ_e%A>yS<_pQM>c(3)dNTV4+O5B8|e!e)A&>X3OA
z9dTb>clv)=NMMEA_HJ#)7l?53q8bzQgu0_ezz2XnDP!HSr*Q40k~bGZ0IHRi+291a
zg05IVh%9*Zu)`5IYfJ(7y9`Db>^hi_7<|OwAb{8&cS9U;SN~`tK8!8fo>XBJZd|c0
zkDqM2xFlL;7br|HiJqjxD1g!1nky(9S!Ol4asjBmv%~EL`|H_4oXzfxrE3#L8w-CC
zEn4;u<tZGr*4SPd<CzI`v>YXpXVA@MBPyu88GDLOya?m7n;j1ax>hy80xVoeei+QL
zGZoYaJkocZy$rKgbYkISI8v(Uz>!8&3=};m;F~=YH>8k!oF~MYpO8vziEoJJef|QL
zp1<W4X*w8S6tTQZxarLO-dY9cuLeNP-HmHK6M&COzjIa@t{N#U^jkHWrH0dz12!?U
z=19B1V!+S@kp<el4NE3%Ja3R!jaHxS0Ku59EzGC~4c-n4V_QX1YOqKyoEE+3f&{xX
z)q`yO;?N<J(H`17y7xT|<HV-T_{w^CHPrlPV0nmFkGXpu4$EeMu$5gs>g=eATCM1V
zAKjnyaopZ<{k6dFNZxgTSSfc8Hsw=WBeX+vQV&`LN}$StpfUB9Mn8$IdQZ!BWfiyT
zyh3GIjfmN-H@DvzSpe<<Ta95Ec`hgg6M>Z;%7{AJH+%^xd?n?+N*w+l9rT$2?NHyi
zOMcX?u6f6&JRFOR$S2Tz@!M{zV=$xd?PW#YbIJIvaVbYPBRrhR==j%+b8bv74`90S
zs~TP6W3WEUU#i+Ea6JZ0RD`O9$26ZL!&iWJWVHzBmcz~8$64g0j+l@pB7bT#kb4iC
z?GSIlYM^`Kx|iA+<!~!fr32j6N^C&IKpbKxT|iNo5Rv5OU;Rk~0FMl8CE|N#f>+$>
zrY^t`n&|66`O(n8xa9lvgTI2g=7Pgw{mWw42ENyckhB&jn(w7iWEbQuw>Pi!_;>h%
z0I3nhW@;!kE-}S3%sCPzqP{+xgV#_#ZmawDHDR+7$daHeevBMGqZ^kpt3PD=q5&b?
zk)8(cvS8h2-}SqVgXPmR)^=#_UtiK6L!syvOZ%un=H%0^SX(HqXa$RK26{nE0)VqE
zA+5g3=OnzISgMXt=A2i-W*P@>LN0$dBC;bz1PiB|J`lh)iwW$G{TYoM&3WwLvLSTC
z08D(F0>lkE#?<BUNtoZmjyM<In&GN}_k}-Yr)Xz*rj9T)DB{M=p0&f+07Dni5^N%+
z;j?o4J$qGI%!v)W56DmS2ZVgOI=iQ1ANa<eiMuDw0A_+JJ4uFbwb-NEc;M2?r*^gj
zL)$|ZNtOl|p%Mgxw@XY%x@6WM-GzjU<Dx&{7tckw0?MJhlN51fZ;Ol%Br~32vgav0
zjH=No2nFC>1lO;qFnkCXCA)ULXM=r1W;g<Kh+u6^fyR33r2M=e%R#U_yv#VjHNzd|
zeyW&9AS=|@TyK;<k(mv|l|lf~qYx!z1ZFPkUM;|XU*?Gp$x(op3$5Ii(T5GzV~;A_
z96bo0)=JJc%A8UV^QXRYztO)`@@V6fNgK@TB><*W!{3BDj7@gj^nos$8!yrCJ3$}E
zNaY^elvi&<JGDuQGl$35=%@C%^wNE~+)+qyo8nYiFy#<t{5&B{OK~@-VPXChMKrgo
zXU<C=sW6H-|5P*K$m9r4?NSSb%*Tgw9uzb$V09W4`|iu0FvNUa53(12gCrCmvFxm(
zDb0mZD_O4Y;8-0gBVelH04{grWUl6DiUUwIkr9`(|HCW4ZGV1<n|TaNP*}?gur?R5
zfBSxeEp-i@t84o_?g*$sD6SMjWk4bD4?bm#YNXlAS38DH0z75FyY7Q>H{+uF#3S$c
z#w->DQbUp%;{IB>r=SU7j#nSG)TcX_k-S_e3L<$PYVii32|leWkNhsSRKTp_Rqt=0
zuqLMkPlXvyGLFUw7~u3;aj+G`{#orC)H<^JbqZ@4)9`~byb{!3<Ybv2iXp^!NAq35
zZeZJi9a19aJ1Sz9pdo|zCP5V~ns}H5X){>dPwfeGulZ#^X!SCGV@_w>uJQgr#&#Tp
zERi=Cz_lY}+MqFZmM{D)FK-=Q6Dy!b0Itn!p;eSAr8-zHF;U3HRBmw6Xk7=sskaFK
z#S{jxO2D8X^5A<u0fEz*7Ld}1qnIMJ3IhCq3bPs4h=nEic&L0!aUO87kjVShb_^Q}
z=rj_I5%?TTrtuf90M~zz@Pj%BVt7>=f|LJd!X+?uKOogn0qv%SaP17_%60$it;;o4
zGue9#=Sj<Oj4Q5H#OO`|xn{6ru7SJNOLriCL=<)>@q+*W5lQq1&Fjc04w&Es=;i@u
z-VUSV)LDE>P!0UybS>|9t{=w0u*k<wa;TM$%8EP*j=QVHXvOr7^LGT}5g6U61P-BO
z0n~=^(!JpI{FKqD0`-5Ve){Y2rY|rqut}6`-?(*nNF-!KR?o-Ck0rt25A`N&2$dlV
z%D`+@Qfu6lg^gNqEk=0X*tf%M{4d@`;Axe4UkrYue|&s<Zs&|1H-t2_$HerLGgLDC
zi9V!0aTBUIhC2Qm<_NX@KHgXJvaqip*3B*fYsWP{+5|vq>}$%s6mg?5*E|_5DUrna
zJ3K%a*{s-prHi3GfRI7Z+N>V6IGOtYAL^)xJ9&h7-yJGibW13%SrE$LlQ-QDxBx^D
zPgV#ICf&+|wc%n~O8xX)mYAz{6^rZt%>oP{j#_jI&#lrRqh;-Lr9B|!QUPcW=6(uO
zWT!#_>VX#rpsHx<MPR_MSN6cKZ_8ozy;dzGp(R2gbcSt+xwe&B?o1*rat2{lN#Ztf
z;x<XKzvXie&#OMwfZxS-BR}MaqeX?2KN2&dnkz(__-pK*WayAWAs{SR0SMwrmD`qJ
zDtS8nd?Djb;XBByglZ(tmzH7UPBD+e#~ac?xIZ`v*Pa-}XBZvpuvm~}`Wzl4Y*goc
z@NO9)t!qyi!QXVX1Hs81zbh`XBgI;eDM7k_yxRAZNp^w&K3t1*bP0tbaK9XaDN&m^
zHAW1{!`Q*7!G&~*Y-Ro}t)wJF%~jjqYT0rT<iQQ5A5m;xVB-aL#?5TfVE~g2oxZOm
zw*hXOJu-be=BDltxBKPpl<?{N14jsnyn9QL8k^A<2nm5vbRMefezVmmoy?K{)=qQa
zk3<Cqv85kkVX=I;%(>0JxV085a-!<_Lk7#=0YO<C0eCu8Okyoboc_W&#$$P*$mOhk
z-6ZC7!%8`kH9TUp;$}=iE1U9T+h;HW3Qr!rOAx5i&Uk3o8cf~`y!O!bv_A#_=KC2U
z8M(XVN_Lp0<z|ei55Pnvi`1b;aGyF7{GNlol02qd77GBa_?O$R1MAYd1-V*zN?j!R
zpHJ)fjs0^OvO9H(y<`q1H_|^Yp<^6H*G}l28le)0#>d|6_urH=Z$^!RHTy`u)<<CE
za$+<!*8pf)0()t$mEDbpYW<R;v}?S@yM=%{n*EG`u$bm|S|VIZY>uiP@^(J4)XFG!
zJ+~Jp3KM30&M1VmkXeh%!z-QK=1c}elym<Z6){#fu27W|gS99a{8{NUSC)Eaz88%?
z$YHt)w>tGGUN$n<IHl>-6>bm(fb_hKWdueGjpPMUaddl9aBU!4oc8*--go1p?RoHx
z9jDp~LVDXFuXq=wMA!aLaUu_f1n7$WoP!(?X;2_FC&Cj=2>=r+4z&G&1TZaMlb=gt
ze^Kvm)m-q3DfS%#fI3K4e?~m4*$3&677q3exA6*4B*&+=%n@DrCxfhHIIIkTmXH^_
zoM7<6>FF30mg_0h@aEccVU3gb73PpH*0PSthaGj&a6?{)+CGlr!4ioocb4@5Zf^<a
zTPk5F_wM0l%0<wV!V9{%zA3zrA=>Js8r?U1*!j3+LGcBzk<5SbL8Y|&hy{Nc_JPO=
z3jZkf@L_iAVys*V4&XAz3y~%XR82E9sEy*|h<+4$;4iQoFzWx^1Apk%Cg*nUeIg%G
zb!kJL4-M;HLDgxM#R0BmW@7-ge}L17ZXCTfusq5rKKM3jf~Iv^yE|h(9_4%h6RvE0
z?7*2VVagNjCUUOuQYSMWp+?fc9H2@Y|E?c(PGPQJ+5L8S!vc_xDKEaJ2-?aX+<yp<
zsH1JAGm7`?2o#wYg&STMOs&l$^WOMVA5ii%f7kB?y>~LMj%d8U;C-(8{!Lj_tRCQ|
z<Mx-ibc>;ssPeX~@YLjTRhoV=>()E`1g!@iJ~wZ33BBZ08YviSRzvvtzA&y&_f6Ap
z(GgoF3^5lcnGRlG2D%um08J#lOcfWpI1shQ4I*fjIT)NkZCWiaja5TMhdXF}A0vf^
z(?k`3=wPOp$8woqr#4N4d#@eDCx<<~GSiVY`Ing46A>{aPU^`5+3vDuHXngtuHjZf
z0pnZ+FGK5URO0$k#Qjo^Oog}>ZDXw`Kzw3Ej@iu}<fOD{i;Jn9zcvgkPICpv7DeR@
zK)rw8B}C(fysuIMJ}+^jDI1g&1+?#R(gQu_II8XKBwlB(7HUBxwyP<U^>a_>7{|rp
z0t^po3y=hX`HNyyb5!6bk?q_aXxRP?3*B9jsBL7?^N{G0!w1Z3yg&>xbjw`zx<atC
zts~m*YZ;@m0_eMc)*{eR^g68;=(9|JZP1|6($1FfGR1tg^%anS7C;=vT!$`DS{yGd
zE-)rGykDaz!iKNUgC?fS#t6t#WBKBD=%<HR8U@YHVu0&2)4qP|X|+SfAW3`7ngVW!
zE8k-M-CLTTLKPoy2tGA5eYPRoKsu*|637aCgf(gSCftT(fOxO3X}#$;cadn;rRvo9
z*ph2))=;EAB6E{ie`_{1T{|16Z+Xd*m9hrtGA5rKq-~Zfza$Usd3-xb3$dvnbj~NV
z1ho1|Ff4VFF=VtuynU%FpqS{*c;|XlL31h)_|lX-1FH*4a(>7<aF$IuK_vfup$l-K
zlunnAv|D&bKdPrdxjrC!wbz|j1C>}^D+kfGF6-tL5$<zv2}L#X>{|jol?BxvU06}6
zTotSjX;y^Y5`s=S6Sz5#VZ``>FvS~$2-RrZSBP;rO5B_bXwGd5y4h+C&BKf;C`Y&j
zxIjQ}+b(Gw9izG<i7SZkYdRrLTI;hvzv^!N>4%dcRm2G)f5qKOR4O*;fo)fLeZ1A8
z^6!<T)d_N@%jt<Y69f#ppYG`_LvsQozG-_P$qOP$);A|?aaSIggSs9c%pPVa6AIZ9
z=SA*pV53_$rzt*Srf-01vxRl~55c~E?SR>iK4*x3qu8A0r}0Xc6T5}le%svk@MrJz
zTuRyN*Vm}WcIdqhb<)oadE6Sx0v*>3ECz*VjO%U?CK>qcK!koIBX^&ncBTGPoE+f3
z+8A6NjDq&%2kJX9vl70<hO+f>JVDaP4~BcD?k~ocx||g$|BcZFjm+bTQaxj+QF`8@
zN_c@6Yzt*AR-+D8J1Y#y+8_XB9j>JJxgEp61cN2~##Kn>RN8?A=Tmeq+XAnPzWyX1
zB=BnsA6pH77iuuJD%@W_V+VL63++N5xtLfj^N1FGNd_GK?#12Z>yqj^lxPk1ixb)z
ziTFK-IiS?6F#|gzouo!l`|m$#EM7MpX2S5}P#dFfie#Xe1utMNB;_{dOH)egg;X#l
zhiOf(9V|*oA^RMC{UGGq#%HHXP*Lk^l!zKDZI$f=jo$ihvw$s}L3LO}{}I{=!~aV`
z-pCWt)JAaklepFMo#JA<L*F3OSCD!#@m5*UQDZH!e#5)4W$K~ZvW#p#aewe;6jsqS
zX~_bXyR-SjOWB!B0R5tG`8ric4MPJ{+8&5M(jv?qYxXiOrbRn*8|P-%yFQ@{r;@Rk
zO!_-6q+%aj$;xo8E`U77dI2M^XAvKZkI*{B$Q+He>Nhj04dkMpO=g+si^slP_g;{L
zL3S?Bm+)YZ65F3Ui<mels23fBFtwvj9S0fh2MIyh!zDxzhOpFQeLdzH?Tb<_(0w^K
zToP!n(GgeHgV2MYF4Tt%ouNWhVZRY}(DZ`|vmLb-=I>|*VhMPOw~oRbknj=H2y*)~
zrTdvmW%Kt8lE;w4{p3vsyk}@na)31t0Qw|E>3~YMdqEjxYg02z!&q8hWr(yf`9ZHR
zOX!el+zY|=lSl@xYqRoHV1l@$hoQ@$f9&bz`x}19zVfuA`<n5Ty(A`|U%H6?urY*B
zpX3;?yv;x`65~7FeY<~MX$e`48_2gPLZbmWD7w5vCUQK&iNRWUjh5a^ip~y1y|C|0
z?pApGsbL#Sij#en)<L3`W6tfDA;TIbDuPB~J$nFrqx5l~Dm49Se;e#WI`K<pJbJ61
zhKY!AC=q;=&*BeLs$IU~i<e3iQ%F0oZ|0-|s1Cujh`7cvxeU=cOlZL`Y!c>%)#aHI
zD0?%VpmsvPnE}q+ouxzF;xFiCN{AAV+bv5>bJ!z1@wwlQYHhLEz_Fg>IpMLR7&*ET
zNIxuYjSOHsp8+0<Doy>>Uz>QQO}jMm5EQfrjTvuKe~w^nwY{SttQ)LFy1}Zk?aXV%
zzQ>QRf>lWy#(?Zx-H3AtZIh8g_&p8(q@L@E9K}AypP^=_CLoixNEC>ol{!q5GW=mL
z=DH_qfq2KU^#{clW87GzXxoEBM?nH2KpjdJ7V1}^{v0jPE=r@o1<2`B8qKQI@Vg9a
zqm)hdmy~mx6e~hbnhM#q=_rQt;L#5zo|4VP<Ly!+^a7zS-jV01t6Q20og*{^`%+c?
zh0M1MM33J$1TwF4{)ovi8G%+IJx&m!YcZFcnMEMiibc0S1b(CzBG8;Yuemgt$Zi`H
z;dcL8IMHcUcT*a2#u*NN00DGHQq4)WD9<-!1V*j;XZ>Um`VR0{VXG<lQMoD(JGIA!
zk0IAHr{F(J^Z=i7j`lZFP6;AU)}|w5iLht6ZrR?#<(GYo<@avTlcgFHIC{2wpe+Ia
z8^je~DA!z1@}6QDKR1SMKTG-bt_klgRso=N@WP!e@=nUl4}kRm9=h;){Xjp?W#Ana
zUj?vd7|JWYUPfbFXujr9yDW7RQH?a$7p-3XjL8hB6&zpEa2M-uYMA|jC%(4*=tE^&
zxQ4NC;%<tc!W(d+Fz-$~yZb|C#p+`YFL2-&)6qBHS1R%7AyLR_;&%$f`eQXemSZ@t
z3al-QDpOl}42FUF5%*@ytP40m8Od8BEY9vNZy=oZO&$DPXdW<!uF{%o$BlMjXQjuz
zfsjhDT-=OC*{Y$8UeJRoD-8k$fT&6RbO?pV<h)C(9;sT6@`keM3vx4-JKeCY6@<zO
zu<OPUk&!c;vTXCcqP5{)iD;tSS@|--6#W;>jIduKVt!rC(!l`n3_>4;A*-ND_%qbj
z<zkn;m`PVJtrqsr$`khyOrHF7MV&i>HCH7Oc(CFOAx{NP@*SPIU%OJs$Kj`}Nq2O2
zK&Rh5%}wc6Qik9md}_S^gv_0k?+?ZxVZVlUQcwJGBFO#OSlg-WIIMsm(ZTQ1@JGJ~
zam9^F47v`*xe1Cty5a1FUD02iw2`5{#G<nQqq)eNa7+dtGWy-o;qI9C@T#dpa>LiX
zh`?Hm{WxJ{{|Hz!+j4FS7o#;oiF$(~`8%K>uygMP9nbOPJ&hZ#^Ha|;D&(|37uVHx
z@Z+;5z7?vzfyn(zL7rA8X83VufEVk1)2$Je1&Z3by%EQc4@`S>cM1c8P0VvrZ2u>g
z*<;S+JCse)S6AY_2NwzXPP?B3DPf-PX;>r3k|GI}t^U#A@BIhv3?E&ZEbTjr0B=|W
z+|4WwSs5J#6YXTKMh7$jw)+q3a@%euiGB8oETi)8`L`hH5|4#!Cj3~Z!P-!9Q+&wp
z{ECfvwv4R|7CA?ZvPrw|9fMmfPSs-_$Lemy;IX|XlqMMYX@TZM1i0b5Ea9c?0!*F&
z(oEB$^`T<{|8aYiC|*Tn?Vfl=;xRIziHu6^`^>}h120>X$F1;7pOJ|EJG9Q<@cOBR
zfpgJ{4p)F;G+M2o<+dJCRNhzOESp2Lweqd)LK!4f?#EI#(3d{^WnYB#pqVQ$Q{W;x
ziy29{m=JS{U!*bl<0oqe=KJX-y!gZ9F$;L2El5romXe>*JBUi$D@r~T^Q@-Xs893<
z*zg-h?JyWdp7m#gox<8M{HJ7M&o9+YFVeOxapx}RzQ83-#6nC*T^I;Dzb2|ZeCR8)
zhvO9LIF%a%A>-Q6|2$5O<_!{zd%CX&`z1|de5nlop7H<V?QISWTxg?4kC9XquRBTY
z*K9lVuWydg)`gS*(cTxr#O0~aEdEZr|M--8j|K;I!k1&>!=oMeQ;gQ}mz<JU>ydWF
z&lG{r)T-|2CLe8tgy@WzeWZFAO}8_}1LrQ)im<F;$v0+O<;#r{Ga0%SEogpdsv6zp
z+Nfh5VruJT3W}Xe#wgluj}gZ!YM+BxROOVy&TFs1vvQ#HlUIN+*2y=X*6RCFd=_S)
zkg?(XtHcK|+otWS@qFHcmImvsK08tT(8aZ0i^O%%<%^|ob|{(B{FxI4o?o=vB6Qsl
zpcYZD{d6dy(}_EImNR`}=*<LTz10&yGUGH4BC|ChiI3qo|MY$z)9=IR>w~ej)$^G8
zc-acqVZKv`?ES<gkG@sN&ECL*Z}k21-Lc*{8<RtScm`Q`G!e1Vy<T_D$;9G_I9qQq
z-WqNVx9o#4manMe?tM$0d6cy*iUBH;4jJYVh?Ma*(upgEM=YA?X1dh2=S@ZzjS<KV
z=l4o@ObZGDNV2_hV>p49@@}d-Zq42J%_lu8NI&&xuGNRrd(2_~W#_d9Q&4L0k!4_C
z&qKZNmu{pVVKzKwHoPH$n1S&Fq~vPC2KuX|#+tXY)lI+_LAr3kcS71gD6c_(az|zR
zy&Uae6n>2gpD8}?Orp)c@Y~_SS0wd$aPnLm`@rRI8U%6YsctSvwkg`t=kQURd);A4
zg|@wKCWMl`=R`dVxskq9@ne)0rr6Md6XKycHl0lRewipJr~mf-g*C8xIDsE9^*~Cw
zNS#7EvEHnp+H<$y?UT^xb!T8dV2IQu&TDDi#l)nOTk_~OJyA?N#Qd;`)P;9_*E5}7
zYWR9IdXF$I`&in!^|?VRg;J$>-}#_0M80Q2v5AsLW$jf)jf;J`R1%J*RJWLuN>I1<
zi9V;D3*F_x{Zv^y3rU(VGT1S*lYO=WE9QQBK)*%jd~M?~ooiEpNpM`L=&ZdQfXbt{
z;~V0_9<>^xRb*39<h^`iW7I5+;=3n0RQS#055`LYSECh%P_8faBM3qE#kngTn@%qD
zPd@Co50e(Q1ypZ2J56`dUIOb|cyx|2`0A9l8fy+|b$&VRg%7>Wn0K>$lZqj~*3i$Z
zdJ?i%%8M0-dh@RNh7t!N8V>6=yof??iaNd_<!JKD&oGj3VO%|H*;d}z$00#4e0}@D
z7m?;d@#Kf95;^CLaQmX1Cp`M3#sY$aKnHb6-kFV_<xvI5n=|c2l<!AILmc7j(Q{|l
z3-GLUy<)}C8Jp4gC<r)Bwm+M;`bH+g-w^fXLjsZlgr|mnc(N3=V%sfVH-SqX#b1Uh
zYz_k2+U9T4S5x^qtt5x<ibr7plB)ubuch|lDTL2fBbWypS$emJo8Q?*yxP56Wd(Yu
z%U$y^tDY@Af;k*E0DfEuo?cg5goq6co$YR~W!cqwe41qRZOG@pTvKa^t)}MouQ8+e
zyVUR*eP{k4A%$xFy==JuBb{^ydun4M`WZ1fs5lLF^#1e+C2+nWjAK-BelYxDI+N~q
zrcY2hCZIo@ZjT^z4^f#r_ThAMZlhjAACGtaQszMnqZDbir>orPi&nU8r0{Ju<N>e$
zUPrpkx46wQb)G|Yg;>|Iqt{`<*5|==4<un!mq*?}gv+^jO~F8S-Fe7wo6V>fTh3$3
zu<!Nz0*rSrQ&!y<2WW}uMbp5BXmL2(BGc8aI#j&z*d*$%?41gzX*6y9+vOMP@{{;!
zD_?LPwv+0@?oUK}&|M#YxOU3h>f!0&ReYgEcF!fD?+MQ;Sh&43LVYH@hZl27_Vg)N
zqoSq`12T88mrvI~aaZN#VD9dfpZb8<+0&}om$YM*t$us4Sq7_JUaQd3QN#4xm-BM&
ztg?<ccf~g*F>^aSxI*Yz4r%poywAZ&`vGpV{P*@lKSComw#$w?JP^S;QZ?sI&XA1N
z91TK+w@?pS?@HtFx5K9?6*_k)LSX8(=C$=kDMs{?WLF?}`Y%bihH+`i>a%uFaKdMw
z!Bw=fGh@9eKg``*=k?u07e<)pulPrOI68baZP#72e>`((a~>-Tloe-xqkc5+yd;}y
zxlyav@RqY#ISvozTinOCYFy^)hv(`g>>SJM^~*ySN)A*3$uTGdt+-5G4OoI+C5`Pe
zq?)Vie{TZ`VQ*K{D8SmllpMkpAUd-1Y)F@rp!LH;SJJ3K5TncebGoL{h~445oH*yX
zI*s)RiUCP{i}irkBY>7TWDtYK;v4#hn5b&!>9%$dLTwR&uq))6=B*J<ns7WV+}`AO
z9YS)$(x?uj3r5zJX|vOg{n+l!sru6noA(o~S%pv!U+uRfG&>xd{Ayc-58~{&GkceK
z5WvOD@Fc46<P=g#>5tk@g)jLbSY`0-M}<G@Mn19SXIDOrFmn^%#z?EFHVXJ_;d(aj
zNPLAo<Z-ge+o9MEnYFDxQxZc(T`kHx2RB^4;ut!<9&aIqW!JlRxtN!OMK#w<aE8xp
zj8$o6^sme`u`cq(ob#}XF)}h&%@Un)nyAaiO6RxrRjbwvSPuo9+LXU#bUBOXJtuQw
z{SB-KT^cyGu`a*BNG|V&dzWEw3-hyb3jadND7h`oHxdv>EK|YUv_NT;h%dxuxixq`
z29sZLp)J#&_s1k$UR*J2FT=yOmqM>GHcLfhB+I{4g$bi%UAu+htM{c}YUXU{eyRjt
zW%lEkfGtkhzE(O6gmhC2)dvvHze+AHJZ6x*t!pnbe~+d~_oC84Ir&C{zEtfnkBk*x
z!)9Y6(1lvXxx1hQ3#hN#YsKA(^s(z?Q<@!kZd%*H6!_DyI0SJLEzpaO`R+A3P%aKJ
zewkEo-0ADmB;LjdK4@K_FO)gqM4g*bnCU};zGJ@iCuQm5Dd=t|vX9{Jo^Kt$Wo%{i
zbDcq#a~lXdK?4T_xlq;++RjqvG_D$aXHkO<n$HfG#Uea<hN*CiG^Xo?_{kD(f&N7C
z1=Y6QYS7)5m6%eeOaTfZBm3@ptIL<GKj)vZlk0}rh^Z}gbHa^-6?I_#v@7)J&5qlX
zIY`A-l@+F$U-WSGOdH+8El$Yr#P1{E=@7G<^N)(}_J_scZ;*UAhg_&g-gkVi9pRY>
zkK6a|kn!m^NlpB^IIM*6=}arCpOs#I=WEf!2pS(0B<bgWP(B`F!39ExCp1<e<~NR>
z<Sxd0M@Py+;VN5Yaj!yuo35djgZMM>-dqrhDU4?^ExYtx=n%99{(j%;`g>OO_myo*
zKZ`YwshT@R>tltgyg-5U&{j&NL6UmM7aM2}g_8!G+*vZBx{qOvOhk`>zNq=M*0`AZ
zBfI%>{_@j_=W*~l0%*LjtF^df&po;I$4c-#y<=<q)Aw{vJ|@|^$P^Hr8OEmqBc@tV
z*vO2k8ZvDU5;!{vx7e|r*l-!KuvD&fxuHttK}mRxv%wTS$|t6!W^feIinl$Gd|)~1
z#XC{<{JRUsW*KFR+*Y9>eYhSj{{kN%m^f8zzc@gN>&Lv}3%}MOV0tAcg(WB<ZTy7G
z(_&=00XpqVwDxYeIsl;<pI`)w07Z5&?CcZ$fS89BIEuSIaiMdWX>No)YK(S)Db3^Y
z-4Rz2pcKEqu<CBC&>-3RCm(aREOYhykTn8PZmTaXOxa<qU$?3wz+fZj<bi5$2TWQd
zGOwkX&$|>WHiv49gWNE7z0|FRxsrbYiw(btf11K1z%}3NgK+OcVMa^YJ6_#$nqMf1
zJ*4dc|Ccs}QM-66Mty;QB{&M2F>sD4Z<{saf;-LC6$GFsHA?^Es3~ggyBSR<jrktc
z?|5%_o^h{Dmwuvj`A$>`AgthXOa>+4SY)LkRLTX<+GFKWhS%$KLHlVxL+Vup%|yEs
zQHUt_y<cZF-^KD=)R(163isjFIY-K`L+rH<BABm}B)yc-07hSJ2C<1^&6d3|(?L}*
zZrgK#5a0v4J)gK4zBAsuv)$Ss*X=|Z_*#$wc)i`%xc1X@bGs{fCg-5yO*Wn6D%iNw
z(*{ybz0pOhRqc<cqSfbNrIft!2T)kCN8q>`C@E@vXnX#h17^RkW>VRgc+l)UX1GE6
zv+dr6W|$U0YJOp1k?d`&vwbTA^QINYA+_38t!I{A^LAJq0`jexk>rAQy}D*{FmbL*
zPuutU{H%}Bze>Z$N@B6C{4W+vlMTMX8Pw%eqUuX`vC0KcZaPn2=`Z8W3t{7bsSS?8
zy2y}Cpz6jO$gZDR8d41=7gbZoMTd(WUo(`(ArfMi`h!@>FCGMC99sWlD!Rx-B1GPV
z0wLeWCWo5j2<h}8i<l;la(%{W`9mnFm<3BvU7DV7;oUQu>dX~Aw-4I&mWq2ATU2aU
z-ihboMy%CK3z#_IOS@*wX!>=NzM`qug8mYzvt3%p<d<R(LmfW1GA+V&NpsJ@RY^=2
zEqc2ws`B?kXk$v7d3~jSm7r-I3rBYu?%ZFc)w%3EkUWxuQtw?1`lfr3iO#eMlVBxA
zC?O|iDvUaT!S=Kiuf1Wj_o1~ELmz}XCM-^jJ+GW{1|3^Luy)ur{-Myd2H>5Zy9X@f
zbKv6kDObfS!VL`|uGx4b3TqQl8NrBwsP9`oPYwxowog#qZdO=A)6iaLb0ds;n*XLD
z=q6UAAkr|1Uc_%FjV7oOHaKx$g-#SmgK8CmObuHTleiGlPO`+z9E4~@`d_5jTtjQ)
z?O@$Jkro{AlF6Zo)~BF);coOlkVpF4Gakn&5$1k<={|~&l8I=f!U1cX3FQjE=m{k>
z1)>oLvqQE664sWR;3#87ctC@AIMf86)_4+}p~EDM#z~ivf0EoiS}OftIBh}Q&~>7B
zs=<5(I+w`i2<N-y)Ky0=C}6bH_%{bEq7FmwT6b}gyZ*|9#OMm^IL!GT!&+K7WSRYY
zyA1?Dss@A(pU{)I7e%Ss&r42BhHTnO>?lI~W#K^lBQv@XuG9NtX+&SYvK}_G$vKJk
z`D~&#&s7WV#O8dBeQ|}``LY5ToAE6*?7b^eZa&fq8?fx(vQ>TT^E@$Ky*safLtBb#
zgAE{)|ByFmADqmx&34~=YXM?QccNDqg8R%sE7Kcq>aWXr8C^ym!_HAe(FZZ?SsYcN
zIYq9IpjmK{*H&eQ<JB)9+<sG&*T5akh5ELNi|*$%U_>LKmh_A8NuyK4G%}$ci2uQU
zW*L+awO$Et0li;UQUT-jKOnDR<oXQ@O#K8Ge_)mW_)kQ<et2i1q0Zd}UVsLYVc2-V
zv-8KI6e!22wSmT1@ydU*06_zB^*|nHV!EllL^lT-AosRm(UsBZIaDi21OF|AtP$^g
zJ4r${6$N)}0(YKhe}LZqM9Df22`DcPzz=*oi_9pm`Vdnk>QcRL?RwjkK}1%F1J+Nb
znrE%<!e?S#?~0|7PVCB$FMl#2O6i=l*Lww?u!Z1l^q)n?sy|gF<&cNikca0eX{QFo
zw<Ga5aO?VnwEgh6fF^e<wo&PSlMo1YVUG;-;Ar4(>Ea*Cr7d$9B0N1O(W5lxBTHUk
zV}nb>fB5l>j-{Z~?}+wQ+IVfqb_NdLw@D7~-A)Vw1Z!lOf!j|&Gr@)V^X_Usnfdt`
zlP~mV!;hB=)+wrpeGCR4@r%t3>%YK7j!tQ9%ptICVA<?nQE6qrsTT}@wR?4VztAaQ
z)Td-@uTeEZ9k}=Bx%DXK{345Bf{4OchF75u&AERXCq6-osp{gwto>+1NVW66iN+^F
z+`YZR=I}9706+Mw&8cxc&`-a(ROoMCa=0&q8qCB`$z`0zi%Py69*pXss0-sg@*jRl
zMfzofDw;@yo(dq<z!KgcxC|3FnSa$si#X*sS1t;B<}V1NP(?AWG*{}UyoHTfhTd|j
z(&njn;bPRA^$jy)Xa>+}kZeaj>J-%>2L1fcq8MDCLb|wI3(HnZ*pgalrtKzKA+i7f
zYSm*vW9GLIVWV+Mxu#^sK)TZ<Q-AB`U>&Xkwf|Z?asMrzOd=5GsaU1Wlkam1%rt@g
zA9U5W?%%22G)J5|;#~sP5)qdaJ%?$fyd*A0yCm5_G|H?w559MQzVnn4U7t<BXVBED
zTP|gg^8#RX%_TA5b8n5BGyPD?5y$&~oS!*fgz<!@t@mlAw&xcBFZSh`KX)U6#7H?{
z5;Y=VE#LJW4scN7Geu6&`FBWWEV^4~F9unBFn9LDbXqXBB^TLsTfi1>um_nk+Z+|M
z4b_Spg%2st1`tyfWE`LB`P$QhY#AtWa4#&3+XJ2S&Gdy+qZwfji7ezH2X>at3b=Pm
zJ)otABwm#u`~{U1)jfZ|VL_HSY@;bh<s9y8hc~Z!rdSKSaT2OwFF)Y2+PT|svP15)
z{EXK?7$opnBfbHAC>qYFILr2*W}`5DyOQloib1aXfc`HuQEYDeU<N^#*Wn3iy~N*|
zs3>-@2=R9t9yN|&keqeR&k!dDS^}FK%`3wvU-o9!H*a`{zG=^{_-5li*m`Rm*(&2*
z8dh%P)W*K2*y%!|hE2`u|H~(W?NW0E;wyO~m<m1yIH+zr^E(2r1SKbPai$M<!@vOB
z<_>?LeYG)>RhRK&YWt9_qQ0S9SfdCFO;5i3zCS5%`@;n=u-Ulqzg>5H?w)$IP2F>x
zBR0{{feDi*a2;&o7zGXcTLT)HBKqrd+ZrKf|D|e5&vz&4dx&^86zih>-@gYx8BRUU
z%NNugk0kWWpm_J6mYm*y>8k7qBrQ(2-0qf5{d{nrq_Y~Rw$z%T3wm&O{(B^%EO1fF
zuLRcjN`TO$^L;$WiDk64z1{V${7W;q{6#sX=~g+r9&QEh6A%68<7d}<vq+Bu;pGVH
zGqEzhQt9>~ASJNMRfS+mW^n6S=+EW!Xlq()0TNH6!UcWC+IkDAsO(fd8+pD`vWTow
zVjgdCT^2i;OENos?nnyZe?fgmhesJ{1%$h><sgy36v@{|({=o(dsIPj2#INDem666
z^&${}Sfk1OeQTabm}b2yHeo~FAsvjjJS2}J2>yCZWT%E3i}J7Tt>um0kfz8f$^VbA
zcMgv9`NBsh$;RH;$;P&A+uqo=v$2hhZQHhO+qQrCe05Q`>i+ds%}jOo+db#>!E?^z
zCkk<4K4y{x;%mib1smrYdd>VHQ&1qRwSV+_swNU-*iTg`iH?UNJT7w}wt~XL2(E)<
z7Hr6~hg<?>^a?6xkD8cJe8aLg<(Guq_$`SdRz_eVi#^C7an+G!W-SXsawa0^fs4&M
zqZw}+HSbz`?}CdfcXJrCemG6IUS;hG;LeHb2`*b)eHP27VO?SPXS**whT=O_;z*lR
zlsiBorQz4;RF|&ex#dx>MXM?o3b1A8&_=<8nk*A$7>QXEpi>XJ%<uq)PnB^G>aW6|
zfc#JAi~~N-Dqb5fS9PH6UHJX>Cubc;yACfF@5?vB4*>vQ+ttCn?p)~K8;z%1cPoU9
z#>d0?L<(l#D`=aGtIt1HR<C5ax^p5#Qcf&1Fx@ChvmMFK&*l_qhAsxH)KMT8DtBBJ
zA`O=>5#J@Zo1DvgCE*k-<BOkJYw?{*VO&3koFcZ?K1#bVG-Gmw^Dd@E1}W#O=rbb0
zvfFR77L!4;O=C6++<J1dq;0Q1BocF(XKN`cj~xr<mR;TpjZARFcPiQ|f`e-Ss&yCr
zQd!8=$`%u#p<QPtx*RLShCYsbKFtwyoyHB8mj4OBWg6|C?(EO=c;9mw`*QlU_Mo2(
zdE`CgU5skyhXICOB2<YOhZs9#&T=i#Zcf+UcL+V1`7(&(WLJ0u$%DxhdIfif#?b{5
zMNfIQMkyg}qoxuhbg{=BKO|jBc6Am<VdRkp5G$)O0m&&e7(5v#tMSpDd?7Q#lkx9+
zT08(Kd{65V!|}QLB52i2Xaq7Ow}SM?h2GA9eH|-wzlo7`BBfwbQ+0A5=fKWxy@?qh
z9NhVHNw#=Iksj<H6C>FW3`jBLL+I4N;dYO;JF8&~xVj%fgE!J)DRX+d0WVqE#x^%O
zj+R;e$-On#<)5TY`nGIX{)E%ykl?b})o466@T#a#c`qoD+i-k5*33;hDh6K!S|z|y
zJJVM03`o$u*XB&Fa5qap-D4Q08a=T)CqwuXeT-vvk|2P$x@rp*D;TQ5+r(-!dx7T4
z@{wirh_vt>mF0R6mnegRi<?^}!>gf9t?rzeSCmEHT9{clwHsbGLxVwkrR(b^n**0d
zvPwbDpB?L8kx)?xP=3yfYx{F$krkyQ5v@w)lF^+i#Yi1F>buz6!23h*H!lv+5g2#F
zb62=7>8-oRmq(}E1JY~Hju4BIL(Vj{Bv!0Tv<7I?1^)i8tBVb9a|8z4@58ytqV9`(
z;(63f8Gp+e`9>$b*b4J}s)~GM7D8-R3a2#7a4S~tXH{8Ce}pu&BvHyvTpe8P;K#E4
zfc@ACQtKkOfcN3<ow4-55Y!D|28eIpgMN??Or7Owx&Vd6akmyPymmQox@muqqU^RD
z(>fk49#@|4jB%v|C)MWubds1_eNg**`dQ;x{+G1oAi>5YhKPoI=G=cCVssAzpveiy
z);2}sB+Gk&61)^@o7JI_6SgzrsAi~UxK{UM|Kk<1vMws;8h2#6${Uais7{dOg-Y=>
z&g|565hcrep4ISC9<UAMV0$XmxL`K~juMr2Xh+TFPhr*3lWZ)h81E_mzvDPRi8BJ_
zO*wPkMLAz{U!O84Dp0Hp1lQDJ1M(;`8*q{NKoYiW!EKbT)|F_kHS{fH)qiKVA5IOG
zEWp($h!jO%`7}uWmP!u(nQW=(A$|RI;N{@~1t5x2AkC(0+;3xzGoF;vxEF5u5Zb!H
z(mKnk={-R0x)qv*maKKw&LdoO{Jexr5$bpK!mD-QU)bcG2OGoFe?_Sd>JI6L%tFee
zSTLg*I>QtZA01T1{XMj`9`8eiqyQF`$8`u7N2gC$+vsMNVz5vZhWGO&DSFAZYvRnZ
zU!^?w!|y?xW&=vL3#U@-^wpc}H>H^?^tkPqr~FFXkpt~YOZhwF{c2?9jHurhP9Jb9
z_RQ3;RO2!g#L%j-Q*I!G;@N?zgMQ@(fG(0I3(GIPXlAD%%oL+v1@D+HrGGJ*!%DM?
zS{(~;_;V-YO22!ACV%ZX!ECHeZ|LWeu-*YYN(Za7z9Yaf#f<GTP$@7B<P24ay>bMX
zPwgrd1c^s20&p~5WFk_ACS*;J=hKO^A^%FbAkL8kYE^iRTEq_zcVLv6RCBEljy-9O
zbq|dhjPaLMFcRqcT5`LP7zpi5uFNKdwH9+Uvj&e&Ox@_H$oTSrOhb0%!7^F+h)0DJ
z-WjI|f&@){_KLzJwPxnvQjRdMVrM)8z*u)}c^YqYBXW0m@KFs8^~}&GKSL_QTB8MV
z2Y*wm-~{nKR#5Z%{cIs8vq+06q!z{4HuLw<J<Y?nH0eOO@*Ge;R0U*aK6<VW+R<PE
zP4i5#(-#jT`SU>VKLj@5RdB1p0YqhqJm5K4eY^v<qAh04p#tId8c9ER@*4*qgw=`$
zR7-{K$DSwGU(dcdqu@^3j-@bq;+BRgxSVWvXv-d(vfP>zAR5=5^*bjE8^&E_Klk0b
zEUv0LMpu?s{TdS)0n~Lh4M|C*OuHHCs+sPuZ^^%wtJk)8=)0zJ4Me}Gd7*M>CoyNc
z$?MvFJ?v529sV9tP+8m_mFtpHEZBzLO;guMxD{@K0N)17atO!h3^?KN<#>?2C|klT
zyhJYGJqc2cH3uez4->f{v4ARvCHf_n6(>OQhb8M+!+?@r6&An*0!T>L2T~5*=|wP-
zuJN@@H(YNHLai<$tCJK@)%4UsxnNF+(<aj3U7bQ1(7aD`C8v}CE)F|=$RRdoHsz#4
zuD5E;T1~%!(yWEGGQt&Eb=^3bN{Jb9+@@kNMU}{FN$YY5Jg_Re^C3>?Acd~J`#NXu
z%BfhtAOpbZz+{V~ts3;gXs&&<dB1)cS~atuBPlysn2S-Mpsa04>$e7a--c*L!;elW
zE$+ANuO6mn$=CvH3x93&IbSJS=XF5&jN&((M6=M8Qqh!JeqGM4fw$7=oGzSIt)VH2
z3|bt?fTX6|&w6H3uUDa4pyS5+f+h%K<J;8<4?b$<tO0f3i3b7c%0U7mlJAzbT1Og5
zxNg0TKznYZaW+>LZc>=NhrkLmDbNN(Zqbhz$21$v>%y7}t@u`k0dfi!gA%!l7LgIE
z)w+ZnST%|3uMN8Xx|T(obqrQtP8EwPESDS3j7GWTKry*<DbWw(Hz)W{2{)iE^9ft6
z?fPXBR7fKNg=?cydfXX2TN^yRh3_Atiav_-W|Y9Xa~i0;-|}j80#gt%$zW$GA%jaq
zh-cE8zgX7E4#X$l;bpZ7RScxL#;GpqZ&@Y*PWQS{-9QL1Ki8bCf%P$>?Rsi3&-_Xo
znSdD(&Q<7{z@-AMs2RRQ=z&9*RTgqcHV{jMYwY+tO<+~$SDe+NuK1JhJFM7gmt~}D
zY|L<ozwC^WfMBEf53X5Ao2NiH6Z0qMFxlU>&=g-%0P(3a=FBfu&=Q<|rM)Eq=EW7L
zMLuhKm?Pi8$(|B&YS^rBqYqm%&du<CoW(+%n=VAL&2S=MN_JCrQ{T952`CwmPAH1*
z0ib+9RmXRaGNg0U;?bGW#PmYelP~I$Xkb!H6EB?e$;1P3`W19^)YH*)#rbq!lzTak
znCEbeK}Jn0J#$1uYg`tlQ8z&GWYidFx)+Z6aYr?S`^r4VCbNlzgAwbcQewot#g@k+
zo%-QwMY1^qhSlZH0iG!JI)kl{@A>rtMNiV&^r-QfrN&qzw+T!vf9<>Z&8_=VyH}0r
z<dPQ$P3wH^&(6y2*9PGG8~dhQIlZJRs65(H%<`q-Ax=Vv2fUF(sysE_)mVPvbn+?I
zliLueYA0~mYs_9ChBuDgy!;rt?Sue;T)dxFvvWSqzNfr$_)(Dxcqrw7f`IJuqEe7X
zJ+*IfC~8d0ABKLe|6q<AcFGpTLCpdao5N(eW!r=4GABI`=tOiThIAI56!H@13o=!H
zj*dck5;v0s^C?Q(3&?<rk&8SJ!iqvo-JT|>U{zHU5A@Dp`vEsHVCDUP;+8|ax991g
zzVqvO(?Kv=NfjW?Svu`r)jcn@`DB^ka+yOw<xL=g?S}~av_2`d-GaQ!Vg2S-n#Cn^
z16%Vs!Tri$N&=c%+Q6eLiG@8k06u#gGoZz>&6px()o=b3z1H<1C^-xa8+97+>d(ob
zA<A6cnMG5!UwS1{iU&Q79wtelGqwP}rZYm2lGdaNkm`%eS>4i=c1>j@Pe)Lrt@0Aj
zL&~*3-uESJI&ze)XGEOj#l*qx)Fn$BejnUL)?s+JoeHk)y&q6#RF;(LF?V@?#B?%m
zUtcM30Cck}7sk%WMv)qK_Ue$MRNakLUlEUF&jn=smU65!D#n{<xt5lwR*<Q?h3~sF
z30Xg1UMETa5jpFf@625zF{6@eQfTt7<a*-B`CmHwBbL@yWPp~X?`lyzk#jXL1!W|!
zLoO8%UzE?3ww2m>*>F2vJ%f_P&u>1yjfHs4KdOF&gTLAWZcii$g4>?!K4G>QlHhOz
zm}vr$a>mCK#-#<>e4Xf+x0<_ZY2{O-9LWAgW~X2zkT-ClB=~kvqR%H05M5XMHU3<9
zuqx^+U>ugV)+_N7Q~})vn1B(Bl<`xomuD-p95;b=iBx5j%={ZA&QJIMM2Q!F>EKZM
z+#B}D4D^&dRC@mK;SD(26cRxBDLK=DgKavW{z~K!j24p_wkW+t^k@rUpw!Hx_A|%9
z57gT4gL{xeXmr?vf}3Y`!J$&SK8I%H{HT97W;R{gp_Q`l3A`wRj^vb99*rHI9Z)om
zx?OK&P6IJ5+BD!0z(R?4DoW3t;COh06I_CNDpOQd>LZ_?O6pW{I8L6Yo<=DiuG)|I
z=Vol21YEEkcW`TdUtsP>GcCLYra}$n5gJ^c%O);#dD??jTOWlRhwQRG9vnHVYGaYY
zxJ>#nSWuts)SuYt#u}(1x)ID|Z`I-(@-Ig@M2swCW5wNO_4TP;-UA7uo&`YlIN77X
z@CeN0<bjH+t0KLL7C?Nfp^e}Yiaj9PVu$oU8Nx4llET)PdN-JqiSAI>+vspOu36(#
zVVAXt0i&yM!zgQXy2D4w41fI5lk=FTa9Lj(10c_Z%${zI3Q<RhaQ^a4P1h=2_8RM~
z(BURzZc_#`@b95Jv6bdEbGnqj{OZh3Fyr-gW*bjb0`XO*T}>1oA<ng6&?zGkg(_x*
z^dna_K|X?@iVxjo%`n?z{+1ERFxZR<!sYS`4G=<rC;P~!rm7YR24mXeqX2&x*$+@T
zglTp3K$h}t!%V6%w+#b6gr^nn#L^L_Q7%RK>(aFZ@<l8aGUXsrjFCv1m%56Dgb}a@
zJ$a?X9AMwm``hq?OeB)EwhQvnJwPfX&adD~29{)2*9$=}wFDKDGU13PL$^zdOWE<p
zH*YgHv-m-wd&*TzSW&}(v$!x><Q7?<RpRTWbRt+&leeOw>Shhc&L4ng3K@{at+c|b
zC2V5JmU;uA%HqpUT?dUD`Ya+DP2FT=4p^HeJ)XL=g?j3v1x#Nw>?+%?UJmHBFoa$Z
zWD8d}{M>_8CYIrcx`#{L)7zyb@_}Ss>AJ)e(DdvUAll&L$4N;YmyR1)NW|yVMSEyb
zqVpQ+l$_qWa?t&PeR$Eh0)x}V1z|f+vmbLl_)hyS3eteoQ}#GxH+%LzR|{d*=QwdG
zQux~=Vg>0-)(V&nUBuCe)WVhxQ&m)>r4Ts$-q?@HRh?`=ACfc*x`~+S@w3Y4dYG6Q
zO8eUki)af}yh`qq>7$W5$s9IR#h+|ju!YlH>i$3lDU5(^|6;e#?mE_9wSMgYsF=mF
zZR}-hiI;5^U^<`;oEZIc;op@x#{<7k%>C!g=TY!|o4%U|@O|U;rEnrLgKcX@xV{TK
zqW%ZfpCL>B2dW>|3f^yu)!qqMjD0>vpKSnqL-k!fAqHLbEm-&nEPr78=7m<YgOg^1
z6KQCT*kml;GX6ohx9@qd+~ckMzCle*yg-jeNQ+Rld0d%l;<6dOdn-pzy<g7l`M6cS
z6t$0yvu4^Vm3uh6W$eWfZ3>dYJ|tCd>P>$4;HCc<@pM`o@hWnt=X*(!Rq2<~tvMMs
z{;G;L<b-oO$%9CnuiE4#+kJrT{ZPr&ZKF21ZO0L1@p_)f**9<MtlM<2$UB_B^XTsg
z;ukY9*lMhpWZ9`|XKC+%UG1X3=+jMF>Y$e>HmW4LJTGwvMVazd@RjJWJ=Fh*6rE_W
zMEShQqFf!yXt8e#XtLn7UHy_iDd+qeES02?Z~SSlj^IVV7y}M_LBT&8+Mh)GSKVgS
z2jLIl0ey^}3!yqzOM1{7ZiS#}mU~ZVLVUZ>M+IQe{}GNb{fEk@V>g+GM$efIrs>Fq
zLH-A_ad)^_r<5yr>xOG;$#%T;v4!BNLu<3GcvEPc-bM4hT5jS@)Z#DypCg+iFI^Kq
zsFPZ?c5i31iDR1O?qRhBw6ys}lSfp2Z#=>(I0QqG2G-{Xw&<LFL?q*U4!pjiaj)Uh
zP{k?A^w#n=rE#dmS9?6Vx?w(i71Bu$3bOaB8%fRD+-`;@IHL5mw1HFyJ$Sc{jZ!>m
zveNtSu}7DE`@a-vd8cFYwcDq-jJL6rMnQYq<Sv3|97)iYt`DUqTt7@|m5(5>$zKaM
zF;R|O4<JYk2`Jh56Ev0|k-gF+)?H!0<MMI4LVzCQf9!J^MdF-HBGxEX72n#tb`izt
zn*m{cL}WgGv7;}E(p~$ljf?lbGVQ1b%J;o`jw&dYONOTLciARoGr&W`I_*?z`QNP*
zm+1DcpCPKWMP?fS;WNhx_vOeF+E}`{%P4>eH%D(vu>_V={x4ndVJp<H<2{!$1{%Sk
zwNZE8bCw*CmRqySht&CkTKx+S<$g_|wax@<j*5n>qt91UjT?i<P<=plI=1T9c41^m
zdtzUY%%Vm6S|9)ZYS?-i#ok^;YwX>p?&Q`4#OE5N&(R4*L84~_ukDevz2C<-?KmQ&
zreKNIoAAK?0Z-Q_(F*d2ljr;$qQ}J4Sa_WiAiF)Ti*?IvkhMqGGtuXk#qQ+fcK2(4
z_4wXDMZ^S?yiFNH`|8WO6B{tF5N5#)9|#%sFLV%eI7!9*@1UhGor`LXI2W$ay$T|D
z(D^rwW}~o2ynVLf`1Uiv(1=0##eAZLanWa{(dX*Y---Z4rd_N>#;jTadGYqhjXoD0
zh=REdHucP0CUD)Iq{v9IWrK;oIU>gDl0;|7Rp@=sTQ}*BpHJwAEi-XT7cJpX&5lLE
z&H{_x8%BsWFpI|5oO#DDh;dJTFVL*wC1Cd8%V;+qGEILAuVgAxg`9WRVF2aF)u5J#
z(zy+Jz#_9!kXg3!Sxb<@&j0TMkit|{s$0bwo(R~i5hJ5NPB}#X6sa5<S(|?@>g{re
zx*elXJU|i1Bph`o9bo-W@f{M7k@%Z?&HO%ti^z;-maJif!c>*QfMfx&ply^<{`J9i
zOR{~#&sIG(ErLSX-UK1KD`yrgZh%iaICuw}xg!7nUn3Hd*AvM`kmwggfWTJ5r?%A!
zKW4M1Pvc6gk91mLiz5dq_tKnMsLFFm+Yi(IMg8YazPOz}5AQZ==NJdhc$yKW5=Ltc
zh);|*f<jaexH2j1`Ehar#6s#M{Pg+D<f?ryk8G9gGi{?IZc`k-!v#XSR4Mk;4}vT^
zS6{dW@EGQ+FyIFf21OPID@;z&5rjG`CMM>8pV>CHaXI-W`cn+QscD3muh*0J#oyq{
zIFp5OYJ76?S9{W<&Hx_YsN8r8d@{FK1AcRxIW5_0i{<@h`%7>!Xay&2%WohmNL?w+
zV)cf{2GUI|5@g-=2FG24s;jm}$l02qv^5rZiZ3RE16D@9FN`C*Cz}_5#4lcKW+9D-
znfIloiRoXor%z3yQ(jLot)fARrv)!xJaaYzhovrfJ|-VhaAfU{wtaI*y6?aEH}o5F
z$5|>DE5?Hyu(~2~@6_@Hv7Cw2=ab5zEQlSF?v<?H=RxP*@A<^tpEptJblofzl|nf*
z$w$lgy_gqmAuf;M_d=V~&ADd@=W>xxHv+EMkm%;#(NE5k6%^hd{3F)HaunjlkzHsD
zMI^%KW{NSk9_#=y&}Nf}<nOHHdGA8mxf@A+wbRz<Tb($3^2p?YR<R6WRj?p8c$yJ;
z&nhlAR-6FeliGB9kp)fn1E!N>toju-o_xkF4rD;TWooM2iM%ztHq@FxYxJImG#GXM
z2xRG?jN;#B8|E!*>?K$1At17xz!`h*mT_W}{;wo^tIGor5nBRm{9G~(iPA~$Ek8kf
zc~Th<d6}uoUNlwj<TdW8o1^^vQIqvlnUFW(&OO)81)^>N2RQMeChac<Np@+Djz~wG
zz6P3aFDs=}A<l8%!SMxe%kw8dPLVh=K|ZgFIWmE|gn|Wy%XCBK@mXv%KM782tOOgJ
zPsFYryGCAOMDc?EOh+#11(iVExdWa4#&O%Bjtf`wm>O_sIhO;gZsg+KA6Ma!ds0R)
zC3CCGhUiu!3^`z`E6L312={CmDfvQL#j5K52bE`?z}SVLd#0R;LBD*<6%Q_3eFpUG
zsHpOJ#PK0^XW0p@aFn2m8}qtH$PaifGqEOI1ufCqZ=a2wJ|l~cd7H-tc=!Yn^enTj
z{no@F6w`}%EbH!<$>5I(pYFH79&CVM(8;up;EN1UfxFdjK|)~*UlN<pv~ozdCycD*
zS0q9Go}y?HZ^wE|Nl<DkPXht1NzFfuI;OY0aAXwhH(s-OS4JdDy|>wMosFl;aVubh
zy9J808k<mmZ%y}Vq5!7yDkCZWgIwamBLP=00&~RL`;_zpZ7L*|>wg_+o=CWZs*d@E
z9ao*b0XJ&(vw8YQEv|C?MK|*_Uld7}s{N}o0#*&Rr}sMQx0z(0IgLv}Q}I|-`e3}?
z_`Ee}RP6WHsAJJz^2%>$hVG9RW3|nVV!r>y0{qz7>{-7K-3HXeh+HLF*fPCckS|0w
z$tF550<uNGXDzvgfP{BuZ?5vo;CsoU&)s;#NrgI{bUPK{0Ws3`Y=2OZRafU@YSi1a
z_tGAYI05#b4=w5w3{8F+yLzEEyb%`M7<9AkT-}JZuhpelE2<NW7-u@wL;mIr#jW^f
z=(vdVHa~IO;rk=5LDZ^I=o=g<ve-elw7Q`U=ynmDl@cF}*z`w<AozCGsg?uc6F)4(
zht{@sBSZf(qbLA<hS9EVCU^nEQxC->(HZ}$2T=DEkQKKBZIS%|fNccxqkP`YvW&m>
zJ+|=bljx{NxWWJ4CAubN`y@@W8fp*{2@lQ^TDp}bEY$mf&<Hh^sbbfVo<vAL4$1o&
z)UJW)EBW(gU4yC_Uh#@DQk+O=N1%p+cG<uL%)jS1-6=v&2Az9Gp}|~hg%Imo)pWl9
zAFKNDZ5S|ryEZ<tY2b_HCRfr<=g~V49Zu)O?TWG?k{fq9#z)1TtrSr3Jk)70y*-h0
z9}p`FJi^T@V(fQh?T2xJCEGJ!D_y;zJlihys`|z`Xy7}Hf2On6L%l-ibu%OTZop_7
z8;cR}{TZfhGQ1a^-7H8zGuvkBQs+8PGYn#C>)fsu1>){>fW>NB0(M;Oa)z^r)o+=e
zT-usX#Bw)O*$NSuv8wXz6-dg%9##xlZ^cMhHh0ppBIIxp<b|715KGYD@4?ZVes-Ps
z;Q{cSTG**lSN>T8CQZPP@kK`nsxQ|A85Yob-0PNbo82D(1vu#~0+GuE>I7lPJm+S6
zglHsBHXweEMn8iF3>I^s=<vTym^-J^`8|C$d)`&0w3#pHvKi$TB^ckE_0LrQdN5JB
z0@Xq^(wU+F!~PMj+>`}QCFmYylzR~mp*A!&`p>Wa_i(}2V6C@-WxaGxj)$1OgB`tv
zl_fM5|KEUiNX-{VRd8yJxZqtBZyw#zE#-^HY|!9c{kBb<1)FEbH|RWB!N#i`u_+FH
zWq7+=@Cc`d$uW_ydsz>z-Cv6yIXh;KZ%^!_n956W4F^4G`Lt&*|6Ond7J~JAbk5#P
z9{QL|?!Gg^bcA%)t_>^~$IeRU!+1S&)4uezA6#B5f0VFV&%{C#*u&=S-}26JOxgf<
zK@dmBK5@=X^6s;2J<N@L*G}nIY|Z~oWAkzGg5u8LBK6ldbOZ4mrUktSPH#X~tbDqJ
zopqoNUSCZSf&_al+=!P@TFE2vKl^7#+P%T1iOYuU!a8(O%c?8jivEZ_(DUq`T(PD%
z()#4bgYMF@yY9U|n^tNgecG`=uMUzTNwf1%bv@wz?yA{o_~&1*+psBcmI8ieGiBpd
zjq~y&vjaLbxW*jXyCYzFN6m{jeN>ke|9N{O5d9$VVy*fHxixZdNO7n9lHxxHxd->B
zL;4-AK$!O%`Hl(sGFkj&JVv#*?!z|3q;Kc+X4=o?Y7txG!M!^XG7bVb7hYZaixq~d
zY1{Y%uo}%@jGEOIYC{9^V}>gUW}v$3+9Bzp>_7jK2+kilU94~kg}%VXo#E^SL$Cq*
zOR7d&#m^EBPb#kZP?y#~IKujDJZnmyn!@RvyGJi#A8_zjK}xT>-?TPAo)UkrmWjmy
zy1OVdQv$sCx5wEW&@FuU68Hn3fAs10oZ-5f0@0`ex_!tRC%TuacEgcPG4*=l(bv&6
z7<;1$SK#|JvgzO?c?NU1+L$ORT0i8tn1ONH`2h~}yHR@u(!+TaR3$y-FU?&j>1=!g
z0&I(3WvkFo52d2vh#UAryFv%xOvvriySVL42os(;;QRUkID@MfA&jMw*ahxq!*K<<
zE&Atd5ob|{mw=e8sI5f<?Q>Y0`Mqfi4xUyl58i>bq0v0085I>t=k8kOW5rIU*B4;V
zc$Jgj3DKRFPE$mH2`&Pn6R<_+ch<;a(bO9)6DyiVCwm}dyk*l#0&y(w3L@e(;*tN_
z85n#R%(DqOOIP9GBPd_K<I17D9+_B@Vp(Fw-`rB!0k7n|s=VKDVlaVHr?DfuJ}G~C
ziG4c*1wB2K+-A4-2cRF6QYE*KJwi9IjNobp1CJN>NsX%x7;R!nf@Xwoe*ym2&su=Z
zu~-UdkRvdSo@$8&naqd(yAJvyRF^ToO6TZLjDO2&1g8n8$qn@12h3e6-+&HXf=wLw
zasD)+_Bs#}0N>?6ZB?sNfAZZ<e2`6-a4HB%MBnarWe!R@{c3R@8&DDT@f>ufM=Uvr
z?;zR-ckC@?r5Ip)16p@7P>`YX4agWz3OmAS;%2xlq~>ZKX%mGTi|`QsUBA11#1z9H
zMc3fmv7G}nezE6wun3^tUGKqhKS1xnhAjK~QTR7~#KGHFA~ht2yx#LI+3kewea~Ny
zoK0wnhf)!|h(FdL&xq_O_TMRlXJ<Z6-S-dZNwnTJ3=;UhAk@Dd=x7rZ_sZo>l~j-r
zJg!I5_bvka^qv_3o*0`vV&hfjFUAx}8<8MbH=9mltSW{o6e|(1WjASnsY=%xAC$qT
zvk;n|<vXlNwC)c2!uuf#*7YYu1|k3idH}7lfJFC_2M``ixt3pK$bx>a&^`Tjv{%Sf
zkbF=Y=dW62x12v_N?UK~6khq3;>4Qd?$d=8=QpvVpQRFB7F>nP_kIi#UKx;W`gF}m
z9Ie~-xPW7jnN-p7P>BJStLQ=CX;d$6JNk-K4K}n0bI6-tyAuGud((rc_PSwkj>kZk
zpN}TnPzcj7seN>mI@EfhF#neR!HhaT5Z?Pck#!W`U&NT??l4W+>TqxwrRgW;bXFvu
zcQ@;tZ1OOGx47yD_VLqzqv(}paIx?jMli3noHXdqNpRnoOb9?H7aTNzx==RIg5|I?
z*cJ)!o)|JwcdbO0$*lzKf<_y#b2WC%i&|k&bEj+QG%#CujT$3lUWw@I%Q6jg#+qoR
zq^>6{2^?c<$r=TOkB<y~cYSB+q$5|U$~^Jb8^3!O0%cx$<A=!k*=vSWjpn1>+cbCM
z$jaq|Tr2H`a$3PD`SU(2>QiR9@rOljIY)viojt0~MI?^J%?za4{BXHeZ9uUDVEYR4
zzDc1BvFkH*j>H#V%RkyZuL;Y049L;d_E-Iht0_IrU!dQj6pa(bI#^Uuy`y-)%afk4
z(nTIRrb>E6N0XEq6LZ0>mPdL1k+sru40Eo+>rov!hu5lyPMUXosto#46lc6(m>({F
z(AT<_#3OlMy`jIGb^AA|%0RA$SJ2OWVKrljK>$U;gmUTdR?wc;Wa~5rtNO^J5O$y@
zXa7^llYc<APkz67VB*2t4<`CI<M;5xgL6}jG>gr&<5+e@rR>i0(%Cf^QL_PngC2q6
zYB<01otwuOe-ivdSQ5QHMj_LG&g6h&Tgb|W!{`8j#*KYJY>Gs>3y_At*>g~2VMVG1
znG1Gi9AH?=`@enCYn0A3xI~@mrp?=dRKyK_+FhYQaH!I=z=S@C_~{Z>?DMiFIO>w2
z;l~(*Yw7w2vmDeX-e}df?{X?NjfGq31%@(mbz)?@BOv_#f^leVtr&ZB$ir1@f0tB|
zht{c@SpgI(v!byCODCjPaY}B%NF$X;0jHMAs<G()nV*iA@T$Pq$FqpdetRv6-U`UU
zM>>P&PR&#*9iEJyaHvjwIkY#@v#`KNzgp4F&|-C!6_q+i|6_%iUKewZ{B;RH+NQ_!
ziKx8)GG<j~x8rAuLZ`Q-<BHBHrWbj^_cT~x2QDBkGE#PRAMkS|WTKfyM4oA#U6+Z3
zBD}u#_<P4Il@eOQi0FlG(X?CNDu}Hi-F@rvT_e589z_Mozj3|$yFq_V(T2SBH;kj`
z{*=*^H>HMP2U;<x8JMYdHYr&lb5+wN)yT<q4!<54jFK5pv8ZA;Iv8WId5UskIc6Os
zfQbum4QKmf*1pmwu1w|EW7KT1&J(+Glbo>RYUp<%p&75)gg<jqOA=Z$#gkJ#I&V;p
z5AD5kAI)!D1e&YrS_OlGDGV;Gs;AzO3D>>t24#blAK!d;V5y-mvcP~NAT+oj;Niwf
zhJV{;beGvE=~yO|44~Goq9ulWh`-k(iS-f-5fp%wurWc*yWvIYT@ha0ei=cuOIE)t
zsh^T#$iXzb`-{3Ul>Vs#p%Nx5!N)EDbZe8M3x`6O=BRE;(CqF5<qs%JIA6>|@L5wO
z(F{VVt}`RRM-Qbox?V2Sg2N(HLBd{Mf@lr)(#C!#ks^H2z{+m@M%@$5Ho<kelXsRh
z1tZZYXg*%px)roeO8v$c|B>BMW8@IiJrGgg_y+bC#BiSe;%{Hc!uAt@rC*g?A@RL|
zmel$v<PUxxc~CmV3n3j2Or=X+Q3B8n#^Md(h$>vgmSwG%q$ut|sUzj*fv50sOHWQa
zK6?_nQg8z!!1V;np5>(%9?AmK#@L%D!NV77^=%58c_jV&IR*yJc61|vY>OX0`1H7_
znyUY`7hT|3#{~@c6Zx(nk49Cg)Y;<veH*{~a-<wv`0OMvkPOXu#7NnGnU0@^rW3Ns
zyH@P)xj~!;tGw2J-JC^P1OKAPf;FQ62Jjx8g-?h9X-zMT4O*T?PdvX9^=m8?m!|{2
zzi}RVfqpki?6Q*d6G#G*u_Lj(Xfi)l775?U;p2)r(7w`T)@crNA$3GS@F?u1l2JFN
zd|1pOmR?2yse~<TP~f2G{Ts%*)&D3puHg%ws-#0wOHwx)2hINnkbK&&fEso9E1S2K
zP1$Q<^Iv<`<rVdSTKZc&k<3-DN5yGPcJ&ma+>M{#*oanZpoLh4wy$sqvA7xKVX$*D
z-EZQ?)C-;jK9B^*WA;0?ax;`$GtB7+%4xlPWjxq*<V%8nsoJ<WX9cnDyFnjgrSo5V
zf1Ms;N!FX14Kr9g$JK=7k)*E&izfDYAKQ?z^8-~dvnTm#Z;CKv45UcZm$LE8SI7x#
zm|FGP3I-L9AL06C3&r@;*s~6_?@<5YmnAoF9V^KOECGgvjMAudc)T4XIyVvqIFQTn
zuWA}>1_U1fxgfm>kJcmpg5UOKsdAHSp0nbOA1_=GVG9B#+C3g*2*i|%o;c!L?{&9W
zJ1aPEhVUPltVg*sQ051UT<Cs27oiW0M_@FiF=#kf16*g}>|xNoAi*qury&aNV0~%h
zZ!>Q)j^XnI?5RDl1bXIx4Q?PWq;~<@lWkGAsf_@>jK}xVY1|FbtZMJdQnOJ(wUz)9
zvb#7q<^_)k{+RIkg<W%wnz3^uLQhtIK=av*H%=PjRK)_(!{nQT=nXp%wbW4D>E8#k
zDof!Z*8?rVP?k3V;dlq+Nw=RYQKj0nu_V6SffL>Cdy*Nl7G@}KH8KI7gK@3<v-P3<
zF$*-=_7^O2$TN<f*Yz^6>tzrDV9uSui`F^0i&5w0e^-i(dXISM&_EdcwjA~snC=;!
z5&kMj64yJ5E(_%(d!YK&&dv=w15}<HpO8M$r`#6_491&x4-&1Q3m7Lw(U|(sbx4R?
z{PngMzHtCvw_n9l*W!{r=#|v~<=*wRk{IYSWsX#7oDf$ND)eRF{2PFeg@6DGZJt}f
z@VoO-3fXZ0xG^6HpTMcGXFG12y|OyPt0>ja8(SZ)E$AQB=-(z<<C${4I^HuNtu)oO
z>_#Anuu#emK$JP)C(TwOV|?(>F(fgyH$y0rY;RV&Hj@I-Yimex*I}n}#N5<6fh#t9
zC}r`@?N-*zkquQ8Yl(4ee8O2t^i|CI2L&hgL{~_!r|r4efec6lpr?Oog$YR6Q45`C
z6v}g7I3P1AH0GBYIfBA#G%061#<P6Kz@SGN%64{vh@Ah3Qo*S<z~#;_0SU`LlOW21
z>YdF{uso|#w#Y*OU|Qk*Dc+9?to}ZL3-OKjQ-;%D0ZFC*==?GC)n9wDBx9uTzpLuo
zAIH|<Y6Aw}3h;T@8lL@62!XY2^VO8H5OFTVOv&d#d2R_&bX@n(7M>p?(0_exyEz2&
z0_2YP1qW_n!m$2VljNWxL<u~#>u(m;7=jJNhfOmE#>l@SQd=B>4!zZx+rBjZbQ<BT
zKE`do|8pOpvnH;p^~`MVG}(0}I&e>UMij{`vX(J@(=Y&}-SZHuU#Rjq^ENr9jsIE6
ziDuJY0c)YOr~^=no!UFk<DuVw-Tvm37!7j5Yz*M?bM`4&0ZYA)ItjtKkpF)D-{8Ri
z-2VS7VqoWyXSe^&;S1*9zyOwq4aB9Ix7Cu3x`oPDzdf8`<XlnMGYA%+0t*Zy!p%SR
zph5GT#H^0_&`Qh_i4iE@MNp}g94L@2%+n||PSxo)LsO3=GQL;Y2~7D<z~l9?I;1l6
z$Zr5B-u-lgnTdD7^?hg`O$GUI^r0uE{jrl8C;6oawu_T_bzHw~$F@wr_VU!I;(RiI
za6)J9Um+6V)wf0^&o#V0W2c02QnvfKb#5d(8}(epvH}(^5i|GbY($$-arOrMpech@
z9;<^s+HiGZ7cpnhtdi8sisKTL-Nf}E6s)FtoDHcIt9uixbP5_V`%CW3_tR$-#)5kM
z$13<i*2Rry=qaG9te+<<CTS`SuYGMUnYX8CKAAF;tXMK!b5a+;vERhx#z>oQ7oLqm
z<jh4`n~$r*-R3kD6l3L{52(ZCz0iOVho>c(u!O<(MU}Ef!{nW{a5G|=3D_NrKFrZg
z)kYC%s{-N+G;<N3N}M(sPUlGDZX{2!c!{zH0j!-&r`4LouUBUp>20xK)_Q}{ue;2F
zRNOuGqFeJ&R$kK#=V8-c<#bu^+zu0&z&9OiE^uhCEow@=V@ZL#q~f&!FUCl1+Mo)w
zDLkXAF1>lYA3xdnj~V=wUIuL^!=GLM+!1D0HsP<%bt1ugnX=c9|BQD{Lm!(tIiQ}v
zy%he^POJYdKiawl6IiSDOBEYiOJ{S1`^08z`|Q=kWXXv>M_e4`)A{v>3Jd$ysp}P^
zbm!&@IYZ}K)JkhDFk9!|em3prId&RyYQp@-d1ex{$Z0(@QYM0^s=WcNno|dhd`_&g
zg{|jNinI^>S!Mz<W=q#XFXE~M=7}Sru6fOomZ^e*>3fND7Wdhq>PJr$8#~XN=u>_^
z+*BjJ`Gaz$s=9I8ELTBXXnbFOlO|pmq_hMS_m|C>@YAv5LWH=7rO|@F#6z5jmuIr&
zg)IvY6FE84dzXrh%rs}*>2uQ{F{MR5b`7(2&Z&la;_(`!#iCg<_b_{ckM0)#vulQN
zz*WWhzIBdLg3hKX`+d&Aw5a}rHKeKd+ft=bMBe6{Bh~=>dO7E|is;B|ZCtis!xJS!
zbL9LzmaIh72*yi8{o~1xb$KjXvRm0v;mBrOTF6csSTYuCC(hOshBdLuFLj>miM=-{
zGJt6+&+T4k^cBr=gMCjhC=RaH_3hMKI+(M!v5&Vplr%Obyod9{;D7;$uY<DMP~H|L
z@7K#C-%`3FuZ_;<Lki=UQ5n_&%Gp8t<;(l<BlyV{-lV2`WBy37TUA#_UA*8^Ww;E6
zQi_JWF&5^=&lD@SoN+s#uQ&apwT&0^$KP<3?pmMDn`1sn9i6J<Y)QmxHn751l$w2T
zns)u{e`AQqJ$Vn>*}A+vlZDftOm<Hc>vKzPzkcp1RC+OKQ;hkgd-CrU)P2dZAvQ&6
z&3XKw#k<LRs8yc`h$RH73z*)_C(?-8q?DZOuR}UIkl2+^wxDE~U>62r<G90duL}ec
z=}_;v!Rvhy89pjA$5F_2yw!9Kw-;EQh;}xYimOAiCe=LAblt=X30c}Z^ilq$!>eKU
z=L4(bLw=f07yopSCe&euz{}%y*N583%R|LZCJ<<udj2b1`cFs3z@5*5=S?2LZZTOh
z+M0fX=-mCftTzh^2WNz9_fe=*MY9LtCa)?d*3a@qi?(>>d9e{pB3JV}tE*<z3t8Rw
zmU;KMuXWm0HmNAry}v?0w!Ja%tCeX&PhOe#X2`I(`)}v(Nmlo<c}eII3n69`+>#m-
zS7N0(Rgvx}Mvb%^N)+nTGHPqi0|+nMXd@OhagRtJcwgm_Oa6$opDq*967*)#6$yJQ
z?j4@KOGRn^Z91cC^<0dBOR(PAGlFFrXI1ICu1Xa?7HYN9kqLy2gVgiZT9>=v=W$=1
z6OHGaKTF7@#OHtbcJ~0-ie+s><MG5w9WQMtI1!edwdx@KTnKNvq)!<{-l{nyShmY^
z*tZ;jYp{{vZ4#v!(3$(Nsd3Z=!Fa};vPM4cMl!5Nz?P#-7lS@!3cegKyLkL(9iZ1v
z0KRv)b<D}L1`cTnm5k8*Pd04=<kV1aMm8iJcF{qFCwXnK35A|dzb%GNsU0X5B{4U?
zvV;_QFBM6M@VJgbq!gF#mF6BO#w;cCGzsf!(MG2mUG1}CN#3s?0?jXacHT{J3ht-B
zam}rbwH@b%3vZ)~)k7-ol}n_n@^xcZ7iZ#W-x_cU;`1PUqQJw}y<YJ~Gb*6H7^h9e
zG#^~)yl2J<=~BH2#~rVzBAcp3z3eSYkjY@lOyjj?CsZD9+9AiHJ`b;Irv=st`9gqG
z@18??sIV!eBK?&)T<Y}E?F%dE5cHyXii4CmP~>Yxe=KDh>xs%XvfW1->ccHv&WM)i
z$D3s*LaJl?O8%j82C&>tm*a&$9BCk~&T(;BsJv6%7nC#y`m#t_rOv^O1V5pX1sgjp
zH%@B(SXTimfKB$P;Ycvv`wo%<C!>SQry1FO7sq6%7EzS*B6&I=i9q{)K@G`_q0Y%t
zVMtchvDq3e$gh*-R5@X#Ge&_zeU0V%x59BwVASg^ZI=@j)3+K9dkI?jTR)`IxT{{H
zQ)!1sx^;_FmwM>!5ic<1t!Avo{8^zs!qQQ-4t8Ol6ILNra%DwYu3n`5(BgccH5mwK
zn!`=kq(mX$hpso++Rac3YREimQSrEnKgdHT0Ft#B@~(s|%}Ud^W+?D?P2+nYgfx2y
zaz1D1S*u|gxc*P>rETy0ibaOeIit}c4Ga-W>M#rz6b=`z;7%#nS@GMWKYzH=mjLih
zzCOk4)?THtS9CocCC?g$r08*Wsy%-+%DVi;<7KuUe%QzvnjVl0;^^<>b)GCl7i<uc
zt4wyecHH|-!<4{XN`X>%@OMT?o1>Vj?slOyDaD4#{h~7q_m2I2c6(;5H}X`1MzhO|
z-DU2UXNT6shkY-61m0bXHa#&8=$fXpl1|7Z&D6=t$be4iwzHP`{MN=uipjcc-H>Og
z7E63hw9G|UsBjRNPo*g^h!7}`t%of5L+9i%{2R>4d51H2*ZBwEIMqujY?<Z=qf)w%
z3k>=q*e+8CfR8r!9zR<%VSaT-mT0L+tvc(<wAGAtbP5JIgkis-q^Fp49;xgLjOqw2
z<DI$o6}#)*ztb#8*GC~n`gvblnATQ*#Z11Xu*e9P5eBWAMSBo>B}dbYbcD!vFM|(Y
zo^D1-Di%Uf1+tRt{1BqaX5S$Xo0N=AE2y_@GjiS*NQMAXpUre37BusBJba}>;+hI?
zTO38z6miBOaJ-b&!a~H&21|8P3VRl&q0_daVqsEvtf~e7E~h3uMXvnzWAH0<mg>p1
zJx@s1>nh6|&!@(NWmdi$qIgjY+bO}=rrk9^#dyn9_%mI?{ow0)p?s2+f~9?k$G=a<
zsJ}*>y8MGpP51F;HCi@yr%;J2mNNtA`OTQ+f2sY>?u(j_+4tH0KD*oQsM&_bH1Xl`
zfwhbcpgV1=6fgKnOJy;alMsT$*XVsR^t#rZWc4_S$hiElw(OYngWhjmFa0hwf6_&8
zOy0b|5lr@ORa=m5hU$uy%7vT`Lm8EyPiEtkQb%X7sg=yeeL)MSeFIT1JyX7n{&o}U
zgE|Y2e$xi{B;eS90oaRv&u#7g{c?M_AC?;VQH7?(rWST^izqreoCi@kc<C-ZCqk*?
z5~YLv;;j-t6YrYntn!a_k#@ZLW}|Vn#29k~L_gGQBYA2;IqI3ORcnBB^joa!(}d#8
zFATQpgK{$SaAtw~Lm{c+AAt<Rtyiu}ciq=ewHl!-R72Pww4*q;lpXor`zW<Hjba7L
zI#}*o&I`sQyq`p0sagYCEpw*c>-aR&kcXD;mPOBZK;~p9@`6DVKiyeLy)(Cg=%X`N
zslB_BQFYgp15gD6AO%|vGqb@kYjjs{)6%IIElQNu5)OqG90S5B<$iO<%TKZ<RIXwY
zTNyLJ;XFU?v3DW#0?qS5?;iY>R?x`QW+yo6b8?G-hagA~JWP)X_iE`r?6;TacuPr0
z(q-Xjdqm;b9CLF60!vL3l*{-y@kHu0!>?r(UkN&mcw@N}2f*b|IAAsz2NaQUQ3_kf
z&N^V3TC4nd-%uFEC$MEgLm|{<eVcPaew{d|M=R(nD*%?XGSp@1_)W=jYKUrJ!dXjP
z7YA-79HlQ=eWTf9e|~fa2EebRZUe=?i*``IK6&fT_nq7Nu)mQ5HfBCU%zY!7fJo4K
zetm!km})5R$UL=WqMt<((t6r2cAGI(t0^5>u$-dI!F^%`3(NZ4KR+R<WRTk*GnvfD
zX|I=7^(tSus>H1<E^s8R)Xbe@SUGlY2VcUfW8fOdD>DEfq>X)U_@5MMT{JNC+Pg;8
zJrjw)vmS)~AnjivDU8|%lX#q-94%^<pcc#5|7ef9s|Po)+H_jG%nQh_XdRpycJ3Lr
zBvuy4q&NvTzw9DEBzlZ;;{Rd+?9RqrPNRBx3$Wu;A2@gMVA!=L>E{iPm!1&7#&-gc
z*)K^cJmN_}0)Zy-KP2<p<7&&iitLGt3hsR57>Qp+`bYSbt@BlBRz!x5CIUNuJ+l)$
z1vnC57(;cihTSSBo-hBogUT)O5n~UW26dQtz46*O-b}2OZ`7`>fCQK^L_IN&ii02Y
zVpB*6okgu<E2}nK1pb+_e|2QH4mY&jPF){+@{GlHmmFtVC9M;e2^Ho8pPUnB*az`N
z7;d>6hR!pO6B>F<7bQ%+ZA(!6;e}MWf}r=C(QGSN;m=B=$aiSHv96XmA+Pd~o_uEh
zsvnqj_Lg9iTb`q%Zd{1?1^}qTzAO1VEVz|&HD5(?Q9MXJpfXc|)j>B#{Ux@Tq#Kc3
zXCzPhY#v6F>>h#y*0E+i$7J=MrK+QA=6t!scomAu%P|DwQBnQfgx<J6*sAMqw)h9F
z!HLP>uMF?y_)dROHaDsf$)**zf&(h|;pO7IudpNRsVXToECP@iXz5TR9Ja_W`UfO{
zz=DS`leGqGj0i}_=aFR?yCSlkdgo(%Y}uH9pKAcIO;{ZJAHIC$3B=IFKTp=D3>T5U
zs6l?hynjcNOcNeZ9Ot@B-@JL#-%dsgp&?FA=v&+d^b~|Upsco9MMf8Gtxu1k?Q9Yt
zXpchkm=L@6i8HBs47HE=tUU^;j8Q*4AY~_@Qg7Y{U=iawE2b1bMha-_@}y7ue>y5A
z{cwho#pv8L#dOiu$j+~_?-*rRvo=*9@Ud!rw@5Mt#+w~_8zI&7q!f)(GbXDsi`1X_
zF*y`Z7())2ZYM%S!1O>cl-HzJchDsFsMdIJf4G5Ln4a^&i2RrGY5Yg|aB39mQz{DX
zu$#%!PE6OV^JXb^j&#RP2Qx=Iik{k;dHibUv;#3VO>Nao`jC+%!;g8)A)-_Kyc5+B
zLtM|e;#A)=uP)~iG6MX#C^E~$<(uuxujo<?Mtwhy?S*z9ThlC#T{I|B%DV#v#J375
zvv0|@np-3&(WoyeqthkNX~iNnj)_1{YQK=+u(^;bQ?fx}fZFYN3W#m$?h=D6+5Ngg
zr3~~59(=mdCY{;9GDNh+#)tVkITCss_(kR!;<I(S5$ALv?pW*jsfALO;T-+eFP=pE
zL7}N7wnyMug<$_|ML#w@?ZD`tZkrAUyUmqxFcz37y%Ftz>bsa;m8=xw%vei%uv}cG
z9^rK%rfzHmzxsDznGpmy;3;d%SsfU#*%Ava7o(DW)pp+`UDy6=V-+TBIB|M)Y2cAX
zP`i#l1IPCeItsNM-u_37hxJ;VN#?VyZqkI}rqzO`z4gu4q0>s6{lH0m3%D$#*QNc}
zN9<-*7Tq?g0u}>WhFYhi%aN#Ol;^dVpRm)&w&zfl8VCO8$7I&vU-^f4P~~K;*1tUk
z#79jY#uKVjAlZ<-+>CmQt98PUQI;(2RhE$&4^?8YV9(9`_y}VSw_aL|r>AJU{as1g
znpunY2qO1nTY(PZ9PQzyZsb5mVvg8Ss;1JLzq1LbNgP%!Pqt@k7jpLvCt@%>+pKS6
z2@`;$Dj?u7KQa;&<i?08;mrGOO1F=M_L4P!<=Ql><`x<fO212vQUHY{<jp)@j<DLt
zBRN<lmd}>W+`eQP)@Z0Q=MTV466o^W@}H#K-6k6DTo$#c;0(_oJ&s7lI;bUa+V@b4
zpNdNW6~PICxF6)6a;u4?*8ejkegTm=nC!utOKdc5*P}xjCb?@*Avj7!4z?3>w0PJq
zdW+f=sQPxQ<lLl^iiC(xGfekP9m$l*ycUI%Sg<NFHIL`VzWUPQ)rZ;YI5pZJE!A-R
zAFGzw*C<`-JG}bb>nF?O)t3%t{`d#4b8gzBqftN=%FyehYSUCEYBKhU;;!XA#h<=|
zy%!(6a-FB%6R|;~l7;h_0|x;9%Tzx59pkTXAU>?!SrvGu$1mpE&@K=F`DrwzO?#X-
zQ&BHZ+O`NM99R<&V9aKU$U94H;rMKM!N;4IMo)Tw-w2G*m$sJX{P;P^!A&PGcQe(@
zkWlbx7l^zr<gBxJV01*FeC&lBjR-Pb_9VX5xNmhRe$5Kf+rZ=qTn0VBda}}kCi1OV
z?SLBOYNw~_p5nz-=ujBilR~#Pr%Iut(XeqvxDd_qy&eGA;qw`lv{^74;kM?dghiuf
zkzf%ryrR8DzcIf~7%OR`8HEFi@^6FmRcgKHpZu#-t!&i*Djo6^7tN)WOWSoPy0XJC
z`q@xssEJ7~Y8k0nY)`2e7<l<6jmr{zHTNx;;-Z&68?kjmwU$`S^4oaqFYFWd@}5f{
zyEC`soi}msPc$t*@PmsFy>f>5cAWzbN2h<>&4I=E`R~r!?CV2eCn?silD^$t_@K$6
zE}E1ia1ukf+q&<rhF&qngqW1wh2dGe1l=k#=jAtSnTv(Lv1w;|9{b;7ss3Eb4;&4I
zOH09;;H56o`txNvNi8F@DJq@utRo$w!-x2P*!srk$hvObio4@<td4ElPRF)w+qP{R
z9UC3n6&oGfzIos8J7?T+$Ng1%)Q?qb*P33>e5R~M^g%1^aW5mq7A!y_l|`tuf{oGM
zQZ$a>5c@=Loo!6Na%@v18HH~B{o7JA6i4f&hRm{@V?)8M(od<*PWugLnN1rCrm*>;
zU**7MplK+&Q$(G-YXgSoYP@v1^%RTMq=5xD*zP8uqxW9}84d?VF)3~j)?Z3pHWk-a
zyAVb}@AY@_4E>?8?pIB|>tw#aUrWU(xuqvLAezmTMaPG9+Ofx)Rp>6~inL+a_Eu~c
z&%}dbLJ!m2r`OL_|G=>Rs^PMrX5zm^=;7%!7GHwuiD9dxTPYvzJJ^%P&e3q+e8Cku
zB|$&WTw@tnk}kBj<h`1m?hhoZe)a?+x^|o!kALOKa{5#qBOA0o)#V>t-72Y7ybSOq
zIbZVK+?w1xI<hW@x0=M|lIaucSImRgvz@$DxeQ{?6M5NfYvQ>gVn^H$KA3_e)Csve
z66dziLgb0WTOb5qL9!ZzSQZ-9>vtnKzgxgyQ4J0$F(|3l8bt(rgYI1!bQyJqI-Gp=
z{9`9PhE8yVe}rE;27yvzUBM~Toxzw{co6l&?Vbn=)NY`XM<63hzA%*q4L7l#*zF#_
zGy9|IK)~3NTueLKuwJH(L?J#-|3ZNL*}n46ZZ8Liy$n3FM~eU&&MV6f;0O0I4S+<G
z4TZcjWqDS1sVcquj&7!K5q_GIH-o+6G5w3oYIOs(VVkS)lZRld`}pK5+1#tS2h{gD
z@_ACYyxc9j<Ds?2z^}fwxehX^6g6fYUPO8u2%I!GtS<wt`8s4v<@0T4v}twd-`^tZ
zzJ_9d-8ZQT2@pAtsP@6S7d$H^sku9m$_TuW(mL!vM0HWj+}PoraCPK{sO}Mom6m>u
z8uiX?<Q1*y?ruJ9qHTcF{N7#j)t+>*A3QVgD_^4SeCrIH-I8+4qq5zIgUk2No;jIz
zXUhBP@!2!2*cT_Hbt@oDRjKE_*rd4vm03WCs+kQ_=0?YBUoxm1>!VtK^dHZ?oY5?Y
zT`ffdVOs3XVRR&?z`*xlG2IsUlS6nsrz-BKoTq-oaU-yDj4GO$5!a5S*#2N6{1%kQ
zfgi1D<~VPj@PN9Q+kC!k^H(uFv@1$T?P82p#W7dlp6svCo~qf|FK%>fV7o?k0temH
z5^_kPf(;y@nDJjxf>Cm5aATNWe?S)c;X%M|p@aUUj>~lapYP-aCgnE6-t+Dpzk)Om
zE132nQ!+<`7hreY`oV|4Qi+=i<1NS)xolu?#<U`eVc~@dgG)1!ae5`gQW<0A0uq_-
z?%A&_@9;$Q3g@6OJ7wZ>@<PO`TgPPN#ppW?C_fmlfj}{R5C05ox}<{rrwrG{Gird}
z#^(^k9T&Ij#qu_tDp?X_$lAzc-4`7A)nzVpL!-xSwWvUc*X)IDi?8C-h=1B0>V^WX
zlip#aJA2xv!%J-b*!NI=FyR#b)wo7|)T=k>@h1ZB>)#Bfgv16Wc2gb%J5DlFG3%T^
zRX*fMFuRYw*9&U-YsIn`nQMldn;Q?C*>e9@4}L2v??~a`5F8ZlGDcHKOhwhtl^=|*
zpqGJfcX}Ow^0|R*bt9~_l)eEi_uEl7>l1B^z-aQXu1Ijk*tn3t$;^};jf8>C0z%H9
zwWETuqPMkrk=4kl<##`dy)wURHDC(fVvcZ8ihPh8qb>-JO7;K+OZ`a#BO1{pQzY49
zZkm79^rtryApthTCr9Fwc`hWylWm17QYHo+-prrw_q{jvQR4jgF<ew^-zwd(=k)wy
zEsM1cS*~i!&IB|U<zm{ghK;fveiaec_<-V1yf=-nkEK}c3j$i7Z~Zvr&11jwnMn^%
zdn9{{zjHgxc!ngbCdHwVpxXG*q+HG%cQNp0Z&9+#DP_dZH0WxtJk^2&prDbxvweMf
zP1AfAhxQre%U6Eb6Z7qgf5hb8(7w-p42pbc`}R1k>j~+misI;XEAUsF3Xa`Z)QJMI
zDAe-UH9?tqr^GkC^5;zeR~@;B1g2;pfXmCa6J)#%wpqhXYRV$Dx0<!eH4WZIPB+`F
zCvS)`Uczo7FjH`h6kp>wTn;isGF(7`^FA(f!K{Ih?x2VDh*iIe$MEx3i${H({cC*?
z?jbdr>Bh(smh4h_JtTj_W2w}c1Ih2;O<6M2l6VQeM$f4g#KhYA{+hPxGvTXSwHL+t
zIvEJtnAlH(<BUeiH_e6w;6HZ;K<oSg6Dmd5miUjB#LaiUZf&n%AR7W;q~>?+q{26%
z?K3ZyweqBcbYVZb%vAPvFnl633o)gSl*;apU&dXw;i)mUrS)`6=O9yAayxNJCsX*8
z``Ey)if*G_ab`b;E>dI-Pe!%^GElvd>SN&y&_*kUvM+6m&xqR2sxlgZqh{;49=fd_
z=}!8OW;OkzSsY7c2EFEA&d$yK_n{USpE%IAwkacE`S<wIT6H3uFS`UNVEC^q3q&+$
zycJh}qtT$L(Ba<cKt4aDU&1(&xu0oV2OvqtIwGc<*Ik4EnBr66;~Bi6-9x)$8l&i!
z`t9WCTvT7e!{e@NEO$rwWgKaH&vY8fmlHcnZ8IU^a!qIDhnn1F;)tYr`<sls(x7s0
z#&KzMkG48E;b_V<+usupCXlbqP<!TWY`LsoNm;-V=6EQNA)k1dIpAag$insqGh#{x
zWS=$>1exXU5TGhT_lh&kZ*L?x&X2DEQR1=6A!a;wRt40scDDg--&FAkX~GkyXcPOi
z!?(1(PV2n3SocRV4NCIoJTUFvuS!acDizfAkn*odLCbg57u%^YlOzfANVrwkXcqWs
z{O)4iN^U9-%=6Eee-k*Gvvr6u-u=yVA^K|g<jS`vGlRQif)Tz1w5bJ?pmyo?2U1pj
z1*a;t71#I>#d7Qv%?mCAFDJj7Dp@rp&mZ5OQ$_e!pZ1Hhlc!RPSL7M}0-U}hg06p?
ztA1AGy`LQ{^&VfKh@z-l2u>@&K&2>X7}A77`IDfS0JD2MX&+|<$TLT$_S?SH0A44M
zkci2Ir&S<00bp70CS?-=1Op8g-pUJ=t60e_3MJ%!;@}TstRZ--?r3S3T0`L%oF3|7
zd)o?CZL6Ovb76}EbJEg3uTKg>RX88v{yvC|L@3yw54V{KpuGW|1%gj<HfN1*LdrmF
z(Wp)<wQB1p#+v6?9&xr{?IY>BugWFB0Xkd_*LNuuRq{4E6fEuRsCE~ajMWs3J(Dpi
znNkZgDlVIbL^3kBtSq_vif=nlk=Ta&5r0bidRVC1GX4o9oi+XmBxR>0j_<(r-Pk;w
z&3n_J06H@K&+`&k=<EOyk!HN_v{MlLpU;Avitcr_^u+|?#?_y6MJwn=3@W@p!8KEA
zJU1<=sp>T;(F1bzd)WykP;j=mlj(J!kpKXHwo0h}+5ojJVycw%9@H;rSFktu$So-h
zi1}D~8axMEF(dh)yye(1W>+H&qoJi_38KzKM?NfyJH>KlF7}mMGc1uuKDu4+ztqEl
zEr?e-GqnapN5`+Zm=wGs&ugZ34SQT6?{(UF-F{H7_2(S#)&#mAF?yS=%+qCwJ?_xx
zw;`r@ICBgpv|kR>7{6Vay5&^W=*+6AfySErnL0?Y@Xl}t3&s>lnEdiL9mbICk3P2V
z$hlY_8)tttnn=*`-0iROEMe0di6L9xfK~a(Dk7=Nl+PY_lc9IF0w((;_lMhR6zVJg
zM0mzj&PU=66j{x}F<jD?UqhcW?P&cNP#O87nb{E9AF>pmJw=+TIaKr5e=-8XOU{ZH
zf=}54z5%_y2~MRj-EJ?0I#T%-<_oD#Y4Tr;o=*QshB-Rm8zkD2Yjp(qNXGU;0_<*U
z^(RzX^e`WQid%MzL{hdlf2oTfLvUZZo9ChfSaQRDlooq4X^L=$_s**B6e=o3Fikqh
z2!(?d=(^a|WQd(sNR~%GM^grx*VZFTAl^<EimUGlm)$1l&Gc$>5gZ-4r(6>YO2O2s
z^4ia&@)ht+WGpIoWpi$>c5-d!-#%x7^%G55qNQ)Cz7Xxalf{n1(6K+eUQ|&sWkE6=
z^5~J<B@%IPs~=#P&&@7sd;TVUyd%>9N6m`o?@tNv*OIINehC8s$Pi|He}JV`zJIyk
zW`vl7OGlMI9%_Dq-bm77D<8e;3Sc=sPCD7wjx|x9C|gI5VXc_;)Ny>86z&D;Opa~l
zp1*9{ftc3E9)S88B}^a+g4T5Fg}Jey0Vq1sRud%QJ?Tuwk}Q2=y)8hg*K&I34}TS|
zq;!vc-E37^QAw7=BIciLN{Wmg;7U4PlH{`9u%J<^YgTz+Hik6UJA#xxpOH>CBKhWE
zw>+%hkG4a9E>`VZSp4Hr%<@?^)LA%d4W2Ip7kX}+CI?rL9Da&lb{`-x*cXj&WZ};%
zjyC@q=cPLgXnZIRue<9Dw)9nng%hB}W+XaQWr*Bcjozs-@pDcZEyE$H-iKwL20zqU
zx>>f!BZL73#FM_`i)L3iLH(LaV7l2}j(v2fNOw2?fPluEQoIIl!!jX4wLAIa2{Tf6
z10Mkymzh5|#=1kzOjQ|@Zei^%z`=UrR3m@uQbgUr;}|{n<L2mK&*8+L<G$64BTJ)#
z$s6^e$JgPZJiEg%g8a*aJg)N1^Lc*eZoR8qQkb#57r(A2E_Qcvl&?Ew`1$WaLYf8n
z+2r`4aJrnlV-78R`mFg5f}-HKT?YOx$Fo|#S01U*PThdwzMoPneM+{yP`bu~IPi#!
zseZl~3*yjpv37gi>)Dm`@|aR%?<scQ+FJv5!3#*3XsVv7n3T>O{zb4k2`ZtJc7I(P
zT-wAaR;o|Jwl~uahCuBhbq9p=`D_ahMvE;<x_t9~TtdhY#bNiRP<1h1bsaNIT#Xpk
z(eRne8&i=aq4LmO!E$*)M+9w+^Fg^7XrbF02`#BftWnw=KU@xhsiJ=`gka_=v9eEk
zJOFK%mjDYztQnP)(Iii$DbzSB?rJ<H?w(Ez;}S7utGOnRp-VEHPOXN+M2JMn&wwvv
z3B>vpzOzuUw~h-8w=Ah!+wbM@+DaW6+*5iWl!mg`ia?R?_Bv%ypC64a5g8c_#-|<d
z#qcLTG*bP^thg_DMKBLBuMh3oClWD>l-De&awd3mP^~aR<#mhRq(fGG2d+lWtP{kg
zJ4^x=9D1-z;FW0#G1=3&40=dg<ihHqVRnYbvHjg=Ta)-0gJuM5wtqI6^o<xj{9#P%
zC3`{lfc3T&?I-y%Df*UN$*bJv8ury+Fqe^~9^y6s(}%{m9}+aQMWY)yxm04ga{3a+
zbmZe!<5*+zrCz{hD3J`L*piK)nPUYDN^rV@a5SR+TJLh^oIpH8DJb%Le6J!5=Z}}l
zC9#h76ouC`!a1GSQOEb&^M{AA7vmm=4e(M?&fKJ^#~!A1kiC`0Sa^4D`j-3H?&BUY
z#m}0biktw6CdH=hQ^w8~(SA$LcCduK-*q`Fq+iqUf-wp6Ts^MGd$(akkVXs6s!n}s
zr+H|Ojvwczk}rzLDYY6F>0R^_FL~!|mTm3Nfk(mmT63wXpOYYf-JNcOu2_<)qdwH{
zwCy#8UKiFf(>`%7LwcIJ^UqYa9~aLnjVit`rdAualrA#}2p~1x6asZR*yNT)R?)k=
zEO=-#YB*2tqLU$k3gg#4hFX)lbW?5Ap#0azQMpXqCEn{N{mGc0+66k=ojG1gwj3F)
zOoJxaMbGFFF)B}I$iyJxoQiJEclq=p-qs71<PFg|1O&FG^`C{)Eo%7^pJXZtxXi9B
z<#y_AMt#9|j+aXsTivm*K|3+DLj^#lJzuG&9++lhs;}Z^7~JqN0y{nz+t}#AW+h$F
zkHOndR4wY};hr&)wK;JPgY$n4kF)p&85!K6P>rZe!J8q*=Lr2IOwC+4v77TgWV7fA
z{B=?U8>)K3LA6+Gn<0yBV?wOh95>UQjooBQ%VnuSV4NgJr{jK^cjG4_?>-#|uh0g&
z8Qxf7Q8L%$O>mESFZ)N$q4=A*Bu|*GE>MBO1ckMsw)OHLZ@87W7WzAsx%~GmF4bwQ
zU^1h<Z{6m233tQy9hv8oqB!Cs-!_X8Ure;-b%KZ`kn~aOYeSMVmD3>XrG>&#Xf~cc
zw2GyGoGgz44ps{XT7`fADe8Lu#d<Ie&Sd*UY|3*!B>9S}NOmG6z*s65yB`KT`-65P
zJ5pr4&hEXJScy0v+#J{b3LNB`RK1x%9`WsQUwqKu@k{K77KVsd@@9O#v}0=Qi@bk4
z9JO8kRCqk9QRrg++%kQU9?`nL*t@LC9R&$ag|~6@*p1XBF3a4e8nfE7*ch{7Z@FGO
zVu)qoY}6M^5V0Pu_^rZdDj|C?B&$t7DT|O)6nd%6@S5DhDw15*kX$e!`2`0H;rU25
zmxsQ$>2uBco@VY7<@E52g5u+4@rYI7NaxzIpw*LsML{DgMs)J2CKk+3OWZL=e5XeO
z^MDK#^}HD;CD^6^>ERp@Q6NrX6`3UOWvzhqSvSZYVe5>()eHtmqaCL(RpOB}<RrL2
ze~#IER!IcFOmYz8Zn>N*yDN}3Ic;mm9IyizBlZr$q7@_$7DQwcWo(JGhwZA#0@3F7
zzmk`5hf!9mbW&XJKvwMWP^Z6|p`d<g(u&AqKe=l=5{ikBM-Go}_`08o0ePev7&M3I
zOM*)(4x(?i6ia_~c=f>1`#=aI3W|vpU>H-I<}oN(!!7ZMb*oO0D*m@wy4FD29}8E!
z;Ti`DCHU8HPofg<Q{fqeaeDGU)nV3})jNEVA(QKX7~93%OTfr8Ge^FH4oT@ReNFL4
zd#%bjx9*FIWHZ%yg_B*CGUKI4BxG4AUbgYQy5LPvy(w1Q)i`ArS1sxlPO^+{teZ39
z&tT+ubj>8WsD~z{2BAa0=|!zB=l%P?l5{hDp<DxJwBYO+$)ciB_t=;HAk0+ldhc%w
zsC?-)ycIYd7kx?``%PkCylLWcdaDhLF0&^EbCan!WMn0`$R&{LhcW;To&voM$5ho1
zE9$TQZKG#Lo&AZlyk`Wr9{Myey%BocRZH?Ms7j?;I4iRvGq{<38v8^Rf=k}LTLoVO
zaq6eL*@4)Y6zlT5;9y&+uyJ=PyCE3qkFWk=60&YtkGrmkeT|Xkq`M~N+Jp&KdNjIh
zkJ%fQ-Xt;XSZ8ql$a={s9Ol0gl#--g)94wr$Ar4!6q`+q`g=oJj%{qmBa9*llm+w6
zw_stz1<5~AJB9}X33;PSU7l6zj5-JxW6&%rla)&!#}XceuMwKMQUtTt^^lmJuECze
zyYxo$LtE5*-eN1TR*e7cf&TyXJtx!Le8%5~UeSam7TK1orKU$^$j@Oxa1HkV*z&<x
z@?g{}a(DM5GII7WjFVrUQtlh@u6%acYaQBShv%2LuOcWNsk8Sg^?b@JG*CEz9m}yA
zK%_WycLaI75dgq4-|8~lpmS`k>p3=9Cg$mT#SuwA?X7yc0gWpbGplfQ<YJ=RGcA|r
zW0H)UO>6$azeZ)o5G|RPy9@+om2mPjZQZWcRf5~%GHua_nvq56lpZfP+EC3-eo!$V
z>*-<BFtLB(d)H|Ze>C!QJ<x21_XH+A{I}n@?Pu5+#0?nVQjB}B>(W*c7Pf^=i8UFl
zb}8;NVyUquG#p*5G3ghen7fn6jVc|QrH_yird;L?M?#OB0AB~}2{9VyA=4^<g7O}i
z4o{Gk8WK=I9E^sUF7O2hE(CFXo`FIp<KYjBG(6`$bmH1&6gE4NiF7O%4iiGIF}GE4
z5Fewgfl3%Jp9`-Y@mulQBC~g^PBJy9(?oW{ed3k1ho_j!r%|@*)n9O3hK3KEotcee
zt+mY1<k+BjWxCB*oDi*G;<v3CRN7SbJ1+1tNl(idmQskl&ZK<;0Vt$q_7|k{{JWLd
zEn>aq5+S|kVJbLHbu*rANA#_M?|>qljBcT*b#>bd4$PP^D31IkjNKwA%|GSp0Cwg>
zr|Y?R*&-a5zzThjv_E>xcPbalNsjgPTnky$hv*F04F3f^+hm?81B^2V&c#1C3Lf@}
z{<qiof6>ZHFd*E+RlQ&B+Hjpjt(gr=iTBR`AeKGkAqxe1+kV8R2#;qFpORIk?8@{x
zhWxGRI4VyaND5eM*V!F&RwoD7*f;z&AjKtv>v&Y!=1ID{Sub45iuj8Wz%K+!c4hry
zCnFOF*GR7t^HkxJB{SSQZ+2JI?E35ZYTQ6YVnfBrP*+v6%dFo|J@C0~Gm7F1ndb1P
zg_@&SzE;y<Ud?Ges<omcD*jK|<j>I;ASCM?i-+)hL!H-CG3T^|H4M%FU;*+@yb-*R
zjcaW9)Lj|WCsA?y!DDv3VHKXXlqy`M1;he65V6RNQ8%@`D|P7(zd-oC{%-AkKYfvL
zTh|5>Tp-N7W7;`;4FhJp$tk!=vtx_xNNarJZ1xU=f?4~n4%;S@|02gP_Tm0~4`y|B
z-1NaW(ZG;J_C-fF0CtlKZiz8ju@XQ&Ux6}=7d7jwDXf?kxQu!o_8!~J>07crI5z<!
zSrNs^H3RSKT6$tHvKR)X43{D)K)-|uz6(1p&{m#G5l_`QnSl|3(V|IAq19vDV>Sc@
z`@RmUJDgFqCAX?0t?B_f<`Z#>O^{a?p_I}K|MD;*3(x#}SNY3go(_dP=QB;G2nRuR
zzS>-OPThy7_IV+Je?GXxTwQcRK1i1A5K<3RaE^C4g=n{(pJdEH1I+a!(f2x~gK2N5
zAE3SQmUB4jNcRFJL()5}mm;=wmcMx)WMY=rtfk`3rzoI%XWR0tx7QO?hCBpQB3a9*
zRj*HIA|L*{$7ti4j<n9eoC1e)A*Uo!QALl}B`PA*o}_;2(K3r?{@PF!*-5xvH+O5(
zZcSZ<#x;j+F^z|Wab1D1Rfae>hv>{dUNW@D1JCgLjq&yAn-`2sHj80CnvVq&SYM;!
z#o#QZ^nW)`n~kW~+$f`+M{$)vp{?V_o3=iz)G=-8b6;YAGbmXRD-Jt%SW)(G^w6Fk
zLIBK2x0-6NJT~w#;eAaL7i;uh8-qfNX!~m^V&49ZC>Q?_UE@bRNX`@dK>(NiPY~ft
za8Nn0XifcaN$Ph>^ZTfo0um&4e$gFw3X9036zy&udcmXh+*VdXZhkoC(=wFnNG-jJ
zi>gR)SAx5OH1+3owEqW8Hh!wS&{BnMPZBM58{J`FV*}8eibL-CQMjuFw7hR=&N*<z
zrFA-!)_M;QffCL@C(YfWJkZ)m71>@@J#wQvJb=J3vw;^la4%N&)*l!9N~&L~fvpyK
z@})S~(2H_6w!p<a`%5*#L?8?3>85I#>bwrd1GVY0#mb}Xb4GSZqp#|Gr|`=mP5DR;
zTp`Z)&QRotgDc#FUj)UJ<vK9-M<Z>4I&VUhPP^@m2i!ROPJ!<$V9YW2Y`m|A{wqeQ
z6Bg9RGyb-GIkzwbIQ(#p_&PBw#Ki~6O*XNA1Yh;DO3?u$gUp{rPF9ZDbQ&v1j#f=J
z>~`8)vz)D9gp*t(xmyayEs{J51~AGer)Os(wnB7>{}(t96!3*56)N2od`?`J#G=p?
zaxYS}fnl{a#$(;B7(%k-sbR;f88`Ie|MrzH9|mcijYF`Kr9{rHOcynJp(0uKhc6Nh
zs|;9pnu$)8pFyhgK4hiYG|EzD8b(ydYqxD?tc`W+G|GsYdamY0c-4nk>poXZHV{}D
zM>#L%uN;XaJD?t{OSvzU*~^sm1xmgrkDaY@w#Nwev}HXMIJq?`>9t|f)?2QtUe!7b
zP(F%}siGEUw|>1J%E$Dk^RSqF=cQ@$y0(Wcaefe*2aI-w6N<3#bA-WQZWns5j=Y>4
z5{v=5h`bWG08;#><u~FYenBjPu5}XE4z3=)1b$H022a=T#I4iAe8iqyw^N!qkJ&3L
zD`gJur`&C2KLFe>Fhm!-(7Y|@E5-R<hEd``wq@ROd)n`QLPt*ay>>?4l(@^4gbipp
zP7M8wG)Fe@)>$tR)o_k^8534HM#60KWKGLq*+RkjvNxKW36Yh6-UU?*&PZg&<fPp4
zA5t0!$RR@`EULyCO<I)qMCX_L@AC(Nr)Kw>p<k3>a$kdVu+ec+X&?~^<r~^Ws}>WV
z=_3>Bq$#M15~N^1$T?exNeZ9x5?WI=su2U)RQ8^IVt2PxE!@T$V9*gInS4`W#`P^G
z2cu9z21hctQhrs-EXT&~61~aYQB_woSXdqr!g>ZVWy>pcr%wLVI<<WAk&Qp6`vrlP
zd=0uC(AH`iY)6N3o-CUclH7+9b@M~|z5b$!QUXunm|KeH=_2qPwMn}zk36GEg_b&y
zAtMrV0^z0*drO%b8sG+x8Zxz=<a995gF--TAlH=<%c7%<%^)_=oqC|ETCh~-9as&Q
z;(cxrSnyWWe1KhYkNLhTLjl1`TSdq4@rw!-ur1gY22iS!pRnn^JQe6GB*2r8prNG&
z1jFK!Cp0jc16?B0wTzgjh}*jSkjD_*gCD!yFyG4>KfFa8giMsBu{^&EUG5Fw9PCpL
z683kXZ?#h$UMe%;vEHLXN*`9hkBKcQP?40#?HZRj>@BTXP3gZnI&V_)<P{zG$L_Df
z?Lc|VMn@)}>{QbK;1a~tI{X>QDoxdDL)6TghEw?i#-iN;3hQl5B-Z!|^?FB8BVqS`
zj)H0F++&kYJw`W1h3&elWDYKuDxqSyB6=kMu*|*6NpSUDe^N3dA9u?TR{lpaV`cNi
zl%Iu+{$Dwlo{OU~Tr}&>v$OW4a$sUKgfgj-N>nryYh=X&<=JXfI*V5AcOZ4yF2`zx
z<)X)!-jpVQ(?MUr!TjQ2iUO;`1HFMbGk#e$eN$#U=_&T0xAdu-ZO*qxzKFl(uo{O4
zA9u6xIGn&zxMFtlP9oY-!j9M}W5$<#^nKOEuC{%mg8LYLsV>EJeLO!}Nw=;kpRxg3
zma!o7II)6NVKP79$Dr#)_1U^ax%jH|9xTL7^Rt6K2_TD?CZ@Cafl@>yK|z1F!0L*o
zpe;11{cv5~5yaok4K(S_OZ{%kX6=THB?z>*v3}~ZNciArIwBkF1|{P$HVeuRpfpN@
zHaxN4cY2c)Z1P5Os0tFtG(U(m|4hr1tnHcQ7CGz+U{LUQQ_I#Ap1VMsDimIMHn~5Z
zk(@H$ISFlr*B-6uqTGWZ*qQ$l*No<wl(-QO6a7-%hc4)dJybxBe`mia4YPMwmM#Qh
zn;bLj(QxPs#j%KAyi?kMz5C4~ghMzgfU$m1e!eMM6(|~oRCj6o3QRt9wtB4}9&e^w
zBU4VvV^Q0Z?=d-WV(c?$)3YspnK#_D&muFM<30IX;yIO=#;$bG>UM>FO)^_8-y}lO
zARwV2`6u*_#4Dj=c!VN&?2l`?n><Bj5@mfRV*?9Cf(x7dkb&`QW>ay+M3aqbX~7A<
z+swehjqwv8i)d@+?{s<3!n)>}KE_OFEoOIxEF)pkr1QmZGsWfrOI8ERz){LGH9251
zcI*W6Q?li%oT-n7gWTwZz<}@+od`!)x{Ax;YYQnU$bqmTyfZtIfm=+*FeS;|1Oc?)
zlcTo{QIXurtND3A@KK1;szXHo#MF_h(=XMU1~bF22B^-d?DcaMM#C4>Oc88nXFnvE
zRSVS6rgRJKLk;PX<~-JE`RW=>@=g5Q=v`QI2NfTtk=GhiiRPRYRiN5J3iai4GPY0l
z%xRI6iyxwa@&k3Pd)j`=aD^yae=YMA2^{f@O1>(ek(U8iy{_g?wT5;3sIwGRdzKJ(
zWw(Jvpy~L8<*vl*?Bs)lGIlvbejFV^D*}>>0!JFmz1SdDajOegfqPFDpLSXI*k%(M
zssdG5DuSCYFE!#2`;=q06*L)n1zW01r%*^x)B#uQ_S+kPzaBJC6yddpW{c)f7CGSM
zhYtc!G8pm)Fmk)dskvygFf9x}ZE2k32RIRcTwRjlz{~K@dGOfXgm3|;Kk4|W!~{+0
z!wb-(mbIQrI`0U|7BBCc79#q7V1)D`-lX=`(dhkky;#x1NaT*HYTgpV`8Ws5=F5Y#
zW%U5XsqPG&$VX4adb%a%ulff$%D9ma@N|d2m@VqSE+`)Z&8b{`OT1(d6bcS^ui=`k
z7PW@D`RK!x#v=@8ZU{RnJ<N>#fY#sqU;7h*&yi0(FHOnUx?Bm^@*wf9Rk+wMv@#&h
z`Cy?e{n3OXn6FXGxsPM|{){1l<Mr;Z0LOdGF1Vs~NE*osM#aulFcb-)tld@xHx=EP
zR|7{gAxl7o4+<b>^#il#3T;2;04B7wE1K;{AfrpVqrzpZU~`tv3?+_bdoB2_JSPn5
z?WxaLqdBKfV$^L{@#(5%awsmfDI&9`9J2e-C~rPzc~MyJ%WT>LYAkV*K1guGQ9HIM
zgZxc8$+BnPIJ8?t2d=1SZUu<UUw>mP29VPH&Tc&lEQO~TsbR(5GSnW=ukdiG6P-(A
zIU8H|1C}T<fx=0Vt5I)z^&*r16b7GwaDM9-oz`w*a4tfjK>Nn~G0=jHbW_ff1Ouni
z%CAJCC=uxJPWl~eII&*)#{a!hA;6Wc`&AAyQN96_pd0ZUu{DqeZ&c(d-;AZYV^xwn
z9Dp$#zBdHKi>!S~FB$+8e$&huJ34!;JlBbis|5J%f%v6`0n#GReqBzvtq>{9qR!XW
zaMv2HrLuEuwtt;(`GCaN`PSYCIg}(sVu(h0meXWJ!i(-K+4KlPkegT(U%?RJXst}`
zZKdv2N!sYJbj*Hnf9}!K63fxrJDP{PKZIs7GBHbVhksL>VviDCvo|02;&p*WcZ{5Q
zKts7qh<ztMwDeIRa6+o-ZgEixKHSn@bN~_@vL8=JU;^B968~cwZ0gLI>H;2+Sahh%
zPR5L_5!r46Dp<1&KSIXyZ9L!sx$=T7YWsAl3NmbVCbmymb7=}~S+VP5Q>j#t*wX<v
z4Q1n2Ltzl5?`=NTe;u4U24UgGRN*4W6CO7X+lK;#r_bb*)M66N<ZF;~E~moOlA}_d
z@x=r+Kv0$HSCP{61yq{c)45ex+LiCm9HRF<7R_cX=F2htDUqRn{*)UdP?Upd0tvy-
z;wum%KCH>nWGGmeN_5na8K1bal+bt}bmv=^tVJ&LjEDA3Q_SZbMUpV$3&3%|RAnK1
zO!}tvm>-kt1T(M?QVhDP8-0u0o6ev3<K!H!(8L04-?vBz>g2PlYU&j!X2>#7Isiio
zyw5{u+NWprqB;kc^S-lZHDCyFnI}qS-c5V12(29F`9JpE0?U@DSNk+GxpAX$P>z>d
zjskBgvm)t92=1DsUebdVLExN&uTWw8Y`jHut^iDL`=#5s?Da4Vp7=gWv%Wm*eJ5r@
zN?L&`8RQQ_R6lX0!hS!@zMJk3AJi@TAAIB~XI>JVmFI4%9MY>TRVIuwGz-)m_Q0m2
z=Eo6%23ba;FPr{#aPy6z#r5DA-=^CHKw+)fx7A#z$+4UcGFY+V$ygYBq;6ZNQWhYm
z@+)%se<LjgTzd1wBm9DDS=8jRiJREm<_KmEQUbargp7+_7@M{j&IlxxTlfQOSxtVQ
zs$!`(#ydn5s@bjPo-Ue9Ejmvz1{P}EF#?^XIWD>O+e1c-X-zq4vo0N($jB&+t=nu|
zZ=NIfp(kyd%73>M9+{{zYWxjEGrsJQyz>@JT`72qp`j?&X{@InDPwJNukwamG!syD
zB-fm-_<5?b_?xO>jeGP)A|#smNb(z+Tw|;xfJSZ#?baI7!N+$@L>aI>8_DI`)NEI{
zD0$_N$RX|=`3)QT7KtP65ha;txSS-)1!LUPeI^PA&ip=W%d${iQI%GWe^h_6RxX@{
z?qeUwrzt<GdK2-K7Blb=sjzEC`q!*8nfVr6kn8q*m0~yn7Xv8JlW_sD?*JH>hnn#+
zOHZiXN4;eTe9nUd+D>xt>7+836MpG&M$=OG`BS&6!w|Fkbn4hMb8lm9fpKRv;IUe_
zQ-T6-s0DXeb62iOkymq*ep-m}GavVJ*cn@_x!T1>6$^bR*sbskf#PF5UJ8=-!G{+=
zCTy*Y3u>wIODaMptfVO+8e4zRyg2G$?=${YgeXoj`6NJ12{W|W(-7Xas%W-Hoj>DQ
zXsWCcY0=~zjgn(sY8xz&212JuMZgoYBL;KSq}=>h8ssM19b7u2M-s8pbqg^0Bx&o*
z#8-K!U2J6MQ<q}~)+DZBr|r#%{0G)YUzI6dQ<rjv*Jl)1tYq@x2$Y*xxjV6G@!C?e
zH=+f^lA|(Mm)|Yo$7*!Vjb=qBDbR-l8k!`#RwqW=r_4?41`?xnmsV<7Grcxj#+@$?
z8PS=t!<{;F5vUVde92XvkVQ8qA2ExqG%wdpEJDxD$=g?aitTyRs?U72D?AjAu7b)s
z&AH-hfB`X;($Z*71HBp4M>6ovRi?_Z&QzA{2`fA~Myk5-)<puUps5sON_1Ch<~Ncg
z4rqKw<_YbglmbPQb{B8J)t!Uld}&((n~<zz2!gP%@VPoSx!{x{dB!a9wIV{8eQ(KQ
zlucO`=teIRu>uY#^VeCgEiOC8oK=)GPVN2UpIVopK@)}xe}y!3C$B{$3;y<BJ&Duy
z;SE~Sd0Y>RCibXmtWP6&rW>7=6c6H)y1mRL@=+Zmytp-}j?m;DtnnIuTP4fo_>LWn
zA>3N1U?3=s$a$vP-vua=Du(sCs}?*^kp%nZE5+%fRDDuEn}nBC_PGbiOO~}RI$pWG
zQ8-nQpK{$^BEh=s1I+50@<qYJfd#*%StLK?LmF<bO}S=;TyO49s4ODB<q5sk$s7K3
zX{Wu8Iv_liqogS|O(>Jn-z3F7rEy6okFhGv;+3oh^)lqRM4o%tQl6_26Pp5Kwr@%B
zr42?TA<9Ou=zqpaev?f0QCCej^##<7R~1M^I_%1>8Zi0-4T;b3i$RFJ<hn#Y{mcy>
z?J_d+l#=|P;=*RZ6BN|^#=pD1rJpCBeKU5<=AvFzs+MaOD#sWd<|PcvGz*5?<jMBI
zAD9aviZLDz$f%)>)ouGCI<F%~9}sZ`=PwYm`+j{G%et`35o5JKn;UEW{Zv4b(=MKc
zgg`Qe@<91Q5~#*eOi)y@C_0WQcmNOW+lR}gOVpMYyFNa3F_c$Gt~d|bp-ZE%@<?S(
zy^5hX7=Siyuawz_yrJ>MYmykP{jWS)Y??Y|zkXE#rNj`K)y?o^5_OVcsC#*z?QoV%
zBM=>zQxf)ahU>ip&sA6d1_I2&9qz2dbBP9cDbsY58JoOECJ1CLZq>wK&)Ok?1#9mw
z6*~>0LRZ9vFAn6%kfbQh-QFL2`pKTfG(Wb^IlKFndPQMc#ywRQKN~SbHeKhw6X7uh
zT|$$S+}(|4#48cYbK)FhmxJf=OGxi}zRuQ5S|b$u#y?1U4GVZZb_4R1<{}as8#gu3
zo802kPTAqfV^bfgQ(0`(p|<C9nf!CuEkY$K;Uzw&4h?E|G@}kQ9Q=ZAggFAuuxb;i
zE<NIhq;@qQwz-Bt{FL|`WPT_#ghm2uPr3j}OgA5w61k&Vq2_tUhp)=+eT}-SZ@gRX
zj7t`b!ysh^#^I6@!GEvYD<n|M(|mwlT{TV}3Y*zXMU<w{S-)#v+_0f+H1MD&pS6$Q
z*oX1rnX>rIhHSHDN-uimi{Wm|f<aj`Ub?FdaJF_RYu=RrWfO9Y$}lK`pdLSxD4v~J
zWX)&wBbtf1ah^*TUVwJV0!K9?RRW2{r$xAoTgJ>w_E>uPgM)r#Nvp;L&(uxM2dlD&
z>;P!WxuhVv{Rsmtoz}f+t6U>7^32n9{n-+82o9mm=kFeyy)D^a1KsDQ+?3y9^5KSY
zPGf3lQ+3-W-)!p25^9Mrw>{tpn*%)B6e17V>*HP7V!&X#o;JItZngUyCEas66j*d*
z>~$$gRC!wy?%GpM)vBWvoxSFOUi&gGE^Ls%f{FY?`d1)fGEvW5UqN)A$%NX>HV3>V
zlWT$IyUsA0)mi(LeA5c^E$>?QKX#817jN>hGb8EUrjkQgDu0Dfyt?Ci-F#csBklU~
zQPqD$?aMbFqS^2A#l7ond%ol8cJeRYT>%+nEw2BOv>1q$*>fLnAclIscaD*=ZcMR*
z>*68`;zz6goTuRL+2Tx*Ip=QuxrR<MSM%U*t@jfm3uv8EAu%C*vl8}WB7#26r63y!
zZPiK0fkfd=YMs}*WnRJ53U$e1OQG6Hr=ywt!f>J1`q1H)ZNfMCdKvHF`>`Wcy!aR@
zGB+MeUJWOPG6>dVXq@_K@%(7MYVra`f}hoGtYG3m7mgmmM~DsR_L_`QVs5{V6B>fN
zh!P*-;=e}<+7{&*wu@#NtaJH7q42oU$f{4!F|xj27KbEf?o+hqCCo{S08!!$#$b*A
z6&;4R*@n;VK>9=P8~=#1mnGd7QT1^;%Uqpvgfs%jzrXPPOB;>4t0}WpR-MXe+mt3b
zESaUTk7vG?k15dz_~$`v-jH;fH7hkRdv0-FQlhPf2$%Dp_cMk2&*wiI`S*+e>mjD(
zI~^YLCPkO9U%2h&3jydGY<uRB8S6G2V#X$|P$BvNmB-~CYOgaa#@kFW(HlEY=RZsS
zX9cZmM1~WSDzyM>U4!`_ULW5)*y3YV5S_ZvPWk!<@X2g;->%lzmhVV+JC%GeIl(i#
z2dc_UcxZ&y&zGM_Lm*Ck&T!f{VytuZqqdCCm%w0B^w&~ZJ~yy@%7g6cbxn;;2K2U|
zep`R{NY6-#e&GwS#<NJS;CQ(m)GEy;%Y=aBi?+sNafV?{<I|<xoSB7Xl5zAG5}oVP
z{`XCpk=cC{7zAdVck`~r(=30DyIw3#v27PKu(u&!lK4O2lY&a`POt_%AYcDcGO```
zY0Aq*2T4GSK{zvs@S3K(wH=MvlsSN>ShD@X8}<;Q;19M|cVt?mx`NcP*YtGfVN~5W
z0c0-~zhreYA{A}%mkZy(uG>c6mqg!OcBI_wfsD-U8*6aMX!1=abZ46j-M%-yUih`F
z?h@SkS#~<p0t&N~UlHF<Z{TH1KDw;yVIJxt(4*q@j`V?oG=m!p+a6@V4y?UpWHOl9
zhN$*D!CDuMd6%STUEDF$aPQA)Z0QP7N0(MDB1&sTM3p%?F{qiJN=zjatmS6T`_Dge
z#wc?;dIpbK?(WecYdMh>G`oRFEl4q3GpTk5<3L=ET3Ax~uSgWC*KS`4XiYeMQA~rf
ze>Qyw6MY1myS`)GACVS^&^c$ggiJag5E_@?o+z!al-UWUoBh>S0r_@E6l(vt7vH?x
zj8q9dQ_ocr_2(6G{SB4!q>`H*{!+_#2SxeYA4^9>)o?u30>U3HQUg$;>)kj9O^;ZC
z^yg^nYvTgv!<`xqII%sE#<JVV9d@^`?3G&IFZirbAb$>eMlS|ZV5vUujzFVmuU<B2
zE!Rdpy@x>&cG6i}pGfu4j;!M|EMKu&c=b4>vz@J)okH)wW_<>_a&a@m9#i~g4XRnM
zpDkW8x)l?8xjop0!=0qrV=kPyh>OoCZNVm@=Z4i>BHRc_+e~9ds%Bq*0He&;VX)||
z_*cR+uAyVZ`1Fr9vg#uKk`i(+CUc0!K~c`j5wg)htkWa!khtw*AEwv>`2WQF+85~`
z$p6;IoU3A2>B2T6a?t(bZEyC-1Ha^+LL9PF?5VdBdDDG=ap6F-3;VQB;*|)8NPOdF
zi6UA%O!o{x<OGagi0Gj<{~V5!L4TO&)`;G9o6wG)Cev4;{)-#<;jgXSh#kcr5gQ}$
zY<uTfZfp~VVHMNv5Y2WLNO+DoXYnb*ef4zD|HZg%dMI&rP#+)jnZkEEQ@xdD<xaw&
z@F63$rv4i1E60h@awl>}NxZf|B}${}{Es?|AqUx=cNmNju3bCb=c*J_9akouO-3+E
zIoUvzUeLbtKAnzd@X`5#;28q|Zm?L9*E};M(0_Ec0fSKox7VZP8M>l(ef^3I?9f@L
zp)Pu(vFtXG00xu>yxuSsdbO`hyV8D!cHA+At3{~gnsaY*MeKFN;QrjbyypT*Gtiu$
zA!+n!fMU>BSH00MC_e!3Q|&hfm}P1YZ+f(?!|9gP%mXF23$6#Gzsk0ne)cb%&aShn
zEcx%nXmWX!2*XqF%6+3=_!y!Jvbjr>f=g2C_e43zk+;)Ra2PAN?7=+_mZT<79|97-
zQ5Sw&H~9dO(%&8=tnXlJ;#`)@XO)L>oj-kbq8XNU6ZgnxI)nDMKpwZkD%bvq$N!9t
z?HOA10&II-pIKsP#(3)dsgneJ!ws|jL<mhWn1Uaf@U%?&0uUuKv>~j%fboxFR_TNk
zkLH0J<_yAsv^uiNECcWjP*gSpYIFKa)9<|*FFIv^z5oy|6ysOEW6(FVB^jO3@LXb0
zmje);FoU6n3oPls=~eT8L1x}rBFam|?U!pI*&`THdB70uUy+}5q1^2Kq7tvwUaW<V
zBH(}+;M@M5IfAdv^zucx17ceSruij4D|MeIgi-8~*t&wvuz&%m$W4(YqSgzZB+Dx*
zx9w;5Z*Tx&;){OIE&Oi5MAX%oVZ*?g8i-DJ{=VxjwN4x{i=NoZDeTo53zQOYJz%JK
zlX(MD;3@M}k&x|Dfy5AZioO8c&+!|V1)|#zrmHF7@)MHI3Y@yoc>c!qj1sIl1W4SZ
zxb&aHTtm$|$SHlMKn<L_0!_nl+UpQW^WKGq@w#mf9k~NF7DyAd8RztstUdV5HhFLJ
zy1dhmiPjStlcfX}3_BtPt!auT8t}VbD1<+Jm<V)&6~LWcr8ZQ=d^tGO!j%8oF7ujg
z;*UZUREw8#2T=(v1b|E~FSX%bs`%}2bpv8%jOtR}4}i$f%B}Hm(ka7CR8wZW3Lp}c
z&zBfwK@0XGcKRZ4*qr(kX%SJ25A@gC?!{7^62vC@y9R+djStJ-thrfkkch7S94xmh
zQ3-8u3L~Ql0Mw|{bz};x@^{S<P6(gx;4CBfu->Yf*CxE{gir<Q@7>$SIt_k3I&PK$
znFgAWz4<l#+yPZ=e?-{ITWkiD+|F<n^bLc@h3`{Pduu|HA{yC2xC~2;0bBor1pt3+
z8WNk{F?y$#kviIr-R&m_X@?WEgKXX>fHFe@vxlkxXws%sL-?6_R_N*S^voFzO?S|{
zu(x{}CN|I8y|wQ&kRc{SevvoVK$S=hb+)-(spHi1Qw$c69I-;#u1BqP^NS$<T?aA7
z+gw#{@ak_x_d^U&)$K#1!&!^2Wt1zxX9qtf!D5A4xtGWzSJpN;rx!6y!~5YQnE&@M
zU*P@v0~Y0C__b1A5(y_{1X``^OHxa9MU%=;zu21IpRCX&tFB=GG%e|ECbqu27cFBc
zs#-9pMT<l9)Ci^{)Zj)#R9}t2EbHcP(osE7U90{ObrNI4GeQURqxgaAPJAA$9;mBK
zWQ^y-4W`Ka!3G=IN$-txgX&Bb<SI06_SS_Z_G@PgnhpMsr%&rK?!I<o<t(kOSw_Cw
zUd{Kon7uWnYE}cg?22f$%^K;%nBMxljA097RQUH&!#}{~7YLm#?S9p>6tGvl6``xi
zp|RwV#MyQPQdcpu%M4T;*26M-uz69dp1I|En9h6!FZ%m48S2&?bR~`y_hf5<C1VrE
z7%r>7qW8rWrmk-*&bdanA<b1g1}-k?@r^4j=ZK9z{A4gt!WJUYa@avOyN_6KTAF${
zYvX9kRiiX&PW}ztNZSJvJKL{yEeb}YgiF2~T7^*zJb*ncsZhr3ZQ$v*m1Six;C4f_
zUOEq`g7&^RdAV}^jOr&^v-EK=;QN>uijz1>i*nA4+k&}W!&l=EDI&!Pg+KS>&a!J<
zHvE%u&#v~}YT!lj$p!M~N%XL*K)n6iH-IoWDEbnJ=tSqw5T;hgpE7D7deUern+hEY
ziec_B+s?Bv!wRD!hUoMc@KIO2hg(ZhR{*<iw<l4f+COw{{O_^ScBF2gs3i1_{h5!w
zbl7auLg@i1-EeOnjzdVxHKMh0)>Q0-Hr;UgByMNQXVn0|NldkC44ccCVOJrLu|)bu
zQ!fV8=@Nr2{JZMDvs%k7GsCT4^hS^&Zu$qBYF_K3(tB39N{Q-3tMG#OgJj=j*5?S(
zMD<pdo*D*rY|q3ZxZW8HrL?CRU2J=80N_CenhZW|V1a@0yAy3>U)9i<KdVpP$GA9U
z;C?LSPdhqqy1wg=2u3vToDtp;Pu9Qhd!OK!e?vhdZs79v_KeCgJ7hy_eMSW)0|W}7
zHZLN1d7m1DC!w1jKOV#;yRHd0G5tV%)U?Z{u(6O9(ffI>hHXa_8&|?cohw)k+&h}9
z{sa)g)bprdS0W<q*$g{^{Wkf&xuSXK%p^KaXp`gLOUV6XF-goS*th?n!6632wA>P(
zp=)lnV!kP-PHl9ulC5S(MrXFC_Nv-s1h-`Lzmk=JzJ6=E<ee~ytx+H1xw3*PI%l#q
zaKDTV_o-yn>E=rni>=ewFAtDw#lCIX)w&)p!%(jMuVh8Sls*iIclL$3VqC)$=?H9(
z7^ld>4*3C$Y=jKX>#R6D?fC_ly05A}e`SJxkxN&p_<_|HJOA9#;pdQKsWLFW==H(e
zfa(<roZ#_}YwQ1Dg0mQ$1wV`Fx$1exytl*$F*MP)v9<by-7?DhbUb6hFzD~&`{Sl#
zKqY7Z;h-o#$6njFCMgdZWckYa8zVsf&&Wy$G9$Ot75yI<ta21<u70`K%p_;GLk!3b
z|4=T2bA>Z<piAxdy>@<yKDKbUx2Ybq^d>3Wp$8D@K^;?GI~NPO8^6Px{y-wc^PPmd
zsmID6#uXlaXD>CpK4_c0{i}5io?!vs?##5(S(a{D$k_t|f2=-M;q|P(bm2eziqTg^
z^?>!K197`MgWT7Xji>4>CIx^qd`#JE-*-`nf#elW2amJ4xPz@eU7g6|Lp*UPS4J;u
zEiG?OVIrZ%9N7tn5>b95oSoQ&jRp2mLcU$vb1z}%_V_=0p5~(Mw;D5GfPuv~fPF_(
zWfx1V!C4MFSEbeb!x7sBkmBh;g^5l<$6~Z(r)VIZvJaocqM&O%o`#Eq!UlmOPln+r
z=7xyn3FJy4eBCuog#OTpDCHX{UDG>>HAct_&MP-qP>}ua$%es98zQxTQ{B?k{DwZ3
znVb5H_S6-^UDgex?b-Qf=9=9Q=q!{d=;-7k1qw8xbnas@>wbp*m4A4d*JkjeA6cB{
zx0OEyn6EflC+59jTvvj=XRq*dHe7r{+i&*M;ze%(M$ibz?8xkXVORA0&4T4YnBQ)|
zcp}Mu0syoCUYv<yIPH;ymqbH2G}yGTCgjuijT2SVWa+*s?cdHJ<U3{$?&d3x4x->;
z<l}+qtPxA)BUO-w%puQv%XCxcf#kn>wQCI*;aaa*rF!7Pxqcf#z;ilgMZ>(;7fw`_
z9KtL9zQW2{^;dnw*A-Q=<!0&Q2<|AMI>g_pf+#?bDw--?X}tFoIGcxlYs3?JG4#Xx
z02LJ`@Qm)N&;YBT1oRG6YUaNY9%xd5@b90};4L4(oqtV{iyzU6PGqfSRoH14eQ>F@
zQM=x5BWb@qG$_-E+o{V?3l`gA<%gJ9gi(*1WxRyI+m@>F)-HF5LDOFOM_b#hAWV54
z0)T8GIUC`@L*p=TnJife>M)0`LnhHl=<9c;kGFb;c_76W+gXD0Y5usF%XLtiQ`?#4
ztu&CgGG$6pdP|8fcjEsfrWv!)F<GSNnxYmaM`#u)v<+VMn5cfX^ll3#C`kH0e<v44
zEN14MuSKk*kTt|aRWbG=_;W`PJ1Ymf^{U9%>PmuWwJMftn0(G~GA?D4mgfWtA#!2X
z!VlFcr*(iNJGbAOh39|<nX9o?Ph~Id##Y)rGKp6SD=@S-1>l8BLI9%j!vJ&hGrueC
z3h3VaCLF5KsG+E_uNFT%6w%x6-g2xNK<OrhjR|F%`}ZEVw?U00PaY{%k|e|6{K?8o
ziyc{{lfg0c47vqXx`GY^CMwLh5CwWoukXG21C>NZ)A$e~z3hSX>(01nu6>5nKr3O_
zE?u~vr{rTwchtKl{`{<ey+Y<00mR?k9D+)GHsaOyfd7ZEw+yNy+PXzI8Z-n55Zv8@
zySqCCx8UwB3GTt&-QC^Y-Q6~}(T#IC=ezg)xbIcH^|Pz1dR6u4*<;Ny$DD1B!5%&8
z>WsdtZ_J;+HiZMEz6Q>7S~0p_w{}J(rgmSGYLIKz8D4cc_a1T-9PsZ_56YMG`5;~0
z+E)39DAmr)TqzlvtdAB`;gXb8^sF|_-<}oW&CAY_t#-z*BJLm$_wKOi`04eC**cvd
znx6UXuBrz6=(4IG>_#t%mg5W{SX^s94!v=l+rL(g;p3Vj5zC)%f86>=>%P!Zh~sT_
zSB-<Y{e^3A^88$0el|2iGyzcgS8#!5X#U(&c{?fpKL^H1a~KKgqE)Z78HqfbrxlgR
z(tue*e6-JYCLJiAh>|OaEI@1dq?!kwW9?$jSU6ch4uJy9l2`T?9#42le${H6`h-7_
z^xpm%p3GM?eGSAXty}Vz8hl?QB6~KZsJ6mZtr)!9Or!=y?6UlFhCOyiLv~t`t8GQw
zkaJd?p*fHSQ$T6eVPFDy0Rs_bC;@qkO{hHNFSiX^_GZMk=Ye(E_I+E|NdtlH1mexY
zydZ))ubp+T>ziL2&6w(oUjN}>u+F`c_@LZQrXv%`+7paG($(lP-tQW{-{I`OnhwIJ
zE*kcva1tT6M`R|KX$31=KjU8yKHf7#hW2cIcYCRv)#L&Mdhwu|(0CRpe)m_=6scXW
z=3%Zk1{sMW3lc&|0JD%wml#PODpMaBkQHQm8oWczKyFnO-Hst=3(IQww?ka+&BM6h
z9svxeBx0F1dx#Pd#vHWvX--2@_GOFaSP?rjOJ$nABHc7+?diYPF>1z%X{aW<g~^Jn
zxXshS7i!)<2&$DP+WgVlKOKqkmPsd%SQX07#%iNjpD_ZQbas*1Q#@@uk{VfR5F5kK
zG(`fIOYNg^t&d1ZOEqV7{an2l4=1W(V^^?4=vg9+H%F<{w4=|F1PsiGOSA@m4OUV9
z&w-gmtJm-kr4V0OSV$>3;1Rq-GOn0f@I8UG$Y0(2mQQ>;1bl2XDE}*f>E05qxYpgS
zze2j;YA6-H#qj4+RTFriABvGbyc<pNGGNr$fM#HB^PYezmBk+IhactCJ0cgL2-@2b
zIviu$H)IyYV0Qe`15sXsq|7Z7z8XUU{TE3ie)Nx>ZKS(PxA&OB;u;PtX_!6q>CZ}f
z5iY?S`-9(6Aoy<M55d=MYiL{lRv6pM7#7^x-3_5)Ue5>dpD{b?fN$%F`O>l3p(2Ag
zRaxmL9!8b|s`wHen&mLvZ<wTnLuPh6F`1Ioux7%D`W4Tpr)YvRZ=M@yf2Q?%3=wO-
z+`jA{;{LoKN-`_oEH{|vNC7byO$$x)tz-o|B5V_Zu76>oz(}r#Pbj6_LwmoACn3-J
zFfa_%(88$fgMc<G?l=U!Ag*APa{7@I4XDW2A4f6!-Mi;vwqr?Ux6ZuSe{8Nfbzx_}
zhzvoX?IAWiv*d4Es%8vP8|>MPtiwL`r}!6ME3POFE!783zBrt5cJLz#5Q>-n{m0;%
z<+FCRjGwy7^b5B;ekflKTX@X~C}@BBnDf=H<Ze9L2OC#?_mYx{^cyv;z1G~3M%1Va
z(iUfP7CH}Rr-=Wz$k+S4>67pi4EPKo@kAEi!2|A+RmshD-FdS0|AE{sgJL9jEASd-
z!V{sDac3H`F^T@s5?@>|hFrn$5P}M##WK`1Yaxd=IBLbWFzCOqTlp{S4q!B_FqZ3s
zF{_OoqqVJ%aQ*{3d_Plt7ruI{QJiR&=p;!)hYB99L8WnMjmbV2=Dm7Fh`?b3M*%9z
zT3%#-t-%uY|4jvGjbMfax!<$D>AX~zqz6(F`GvU*?+#%w`Egt(flgE>I^YMwA1hNj
zh3AK**)VidACI83Ixvl!jiWj}9J45GGY}vo1tM4VjrHG-Cz@E?54Aho`E0YlwthdG
zw*=n*?QC%(CP?{fRUHD6qsHliC$-kJ7Tg5wzsq6ho+*%}6}G-ymi<DSIaq%SI;m{&
zrFo<|e}Y0(U*uxz@oy&(tX}hr>clqw^LDix8-P=_l=sFN`Ov3Ou2kVsuD%Pg@y>nO
z_LX$lm;^;qQXsey50Ii|H1#9n8DraI;d|YOZ%99%{W6lZ`xg&{Gd)0)4lf%PhkP$v
zr@e*%;3wA36|22Jq-x=QEqRI$deJsCK$={hU^uKzJ!j<>xr=#k$nXSmC45@@-)1$9
z5iAMx<Jy*LJiXeYW`gT*WwRhO5h*POAzi<|81jr=)Q}_S8G)Av+fB{ud^GL4E<dvJ
zcp&?yMxU+-$ldQ-kExI;jxsIl{aN(H`48TB|AKEw*^#pVHsg=&N6>NF6}iQEGXBfq
z@U<K_L1bUJE*4CYaknLJ)qEdrsdnrZI>hLTlKbo%iP5W)3tC~g(<dy>@cxUc#s8wp
z#ES>WxJRcG__ca(^~J%PfSD{YNo9G57#k&~KXV=eF)kdS@C(BwYa#FdLDfDo`+rfj
zc>A~9p3=(vnj7}GWz@8a2~FG7?N#%z3^z4%QqtOP8I77Q+J&;1(=zolU8V=+aQqD<
zsK)eAHC(rSo^4X}ztj0#KSg&V7;6s22GW3UKA`!P2UO2gXXMNfeT|A&G^@)$0<(#|
z_SC#}aO--)&>!0;;PCmxq!r36cOz8aZuBit@G(V*Y3~-_RZr9O&yC}5oEPqlK#?hj
z^hsw{81ZM6!|(qUAa)6$bzzodC*F|8FNgLdKszszbtg2nF+G>R?x_0Y_y5>stoYv&
z1~Q@bL)shB-yD31c7IUoI_Uk_M8TVJ;-tU<%`wt!Z_K`F4s#7e_9Xy*W9Eeu@xm^n
z2=A(&Gj=oE{JwE?U#j>m)LPIk65tR`kgL(;^WVT75{;Nsz4O^~mVHA8^zdC2`yK=D
z3lW@6h`%cDGyk3o2Ggu3K={wqSCMzSyO->_#BY)5W;vDq_0%a~Sa!_Q_X-i(pl8^;
zD@ECBSpPBM^H*fTN-^wCG#j$LDh*IK(F+!ekN+3&>DO6<jC_fcL>vA85ncB4@{}d$
z-66uE-*&(BYl=dq=g|uPSEs0n6N~uKU=Ny-l!A>LcgFv(sPq4pYW}Y)hJ<;P#oZZ|
zA|V7O+-dmGpbUokPX^L|cGq0ud}2=V)8P#Z!H~@bm+$>AJ(q??c=QqS-uQh6spwk5
zrk#`-EkkBAVrEcnjN>u?W_;sJn?S9F`M?Ud{X++)%1i32m{y$0>h1g~B~~H^TST&k
zN59;*oA$R@o+Ds|X!+&3##e@91$Mn|&xALQ-q@7m!K&ECkBL~0E)osar~Q0L(@>GU
zlZVx~)^5&cOg!&7*S3aTuj?OldOo<ydQIe}x?LUHfhJ44aDSRZHFU*Lc<D`&*iU`a
zyOz0lNEnvNFG;>0Z-f6Zf)9RC7Z#45ZFf{9UhnZhhIBay=7kVi7+;|RuD17wj``pA
zcTUmDJ+Athw6f7^Uf2d@J$&wGAybtt`JC(zZ}&;WC^gfmSzdr9|1<+I0N<|or?29v
z<UG6Lg{;Q;jn&m=JUQ+4Wwvx}ei&uT6=3y04@2v_Z0|rmZ*=V>ziDDhQzzcURHbqh
zHYyo+7mVXM>`?|w$sosLMu=P;Yd2LjlTi;KpeNx_EPmK2#sDFsoqcBQZ7v8YC(vK?
zhCLS3LZNT_lX1l5$#gcK4nl(A>w&!By>FbtKkl^T5c9Jz*P84OV3cU(^e8U$DeyN7
z36~1;p9G0wRRXh&!#1yUoP@~8;B+|Q?>dpTvf6dl-kWS*Ahne}(Up>lmsz%lHx{#P
zwc?n(Y>(y^kC??um4Osrvdxz6M;}?}o*{i79(2>bC&wxsce@bB-m6W$c<SBSpH(lp
z2qZ0eP2vw}!5+2CMLgfd5R76wU}O7y{n+$<;LPu3+l9ZrBgd-GdGl4vH5C2Y*n7=q
zYjykb&X0}lFx=#v!m^}jCn~<*QoR1=L&iW#%5Wig97A}G=;kW`b$#Rg+a^0QvMQ#5
zRBL$rGMT<!dtP0Ad|=!dNQ>W0IcV~G0Dp7A_YyjPRw~<BLgTZ75ttnK70Js=Y`Nd!
za~}@ZAFl2e;iK`K#`?+HrZJ%xwG0v^O;q)WDrSb)%Kd*+GbApq<aC2jlERJq87N0}
z#Y?Fs-}{>0Y}Oy#$TSGx?csh<AbAhkUnut%pbVhKATl+o>CaqzzPv&9MziKGQ>?OD
zG);)}s-<Nz^biPCFo_U?78wbWkuAU55%7-QDClkv%VN{GBgxt*bE&0$R}1m0Z{OHm
zs-1jA`ved}hPK*U6CnLpjxMv={p?*%^{=LU+Z)a%R;OR<R;_-;gfu5CfMBl8*`8y;
z-6<TUF!lq{u8^<-FXM#ONVoL7pm8_E?oa(~8`4HIYn2g;bvHh<+;mQ0+t>Mhw`^&j
z&}TQ%Ws~puF3qc_LTXVqRZZMk^S64vaMZ5W2I#a+<Czm1&=FD%zq-x;JVD5ojh}eq
zdQ5w1DKhqcQMz6i@N_G-+Czyo6)v}ts#JK1J3#vITzXOO=i}sIRI1Q?cA3rQrAD{i
z{4)Qtpf-qlWiHHo@JOG4xYzgPmhafHmr&*l%1m1sjV5E^@2n5A!_qXG5n3cxIsR9a
zAgt@Np~h4q=pe}tI+Y5oI#LO(4Tb?^BDFB-J#n!Iia(pJMEY?{C0`6_8$bY<ozqD-
z{2WH4PjPusYCw{KPKe8rk^8{eW4jqHDIvZ!d279tT!fl)HNn}$63bnV3{6kcV{g0+
zvAbEWWrR4lx&xh!8;R4GiQIu-JVVpPbBjV7x%pV*`;t_TuLEkfFFsd~Hg{VWXg+%a
zzP;cR(`!*E=1xT?{rWWH9ehJuIF284UpLs`?eHv8km0|+s8MPjh5lM2nw?*-@?LEA
z9#8ei9>Fgb-vC=w3^xQ~xs87ZP)2&!&(D=Q-%?@|;up{M_Y-*J`Ba>)JT_0rdmAf#
zqwHAR4YM5xyDqyMPgw1Aj9;uXNU1BB&x;*vQcz%&C)cftX#wxA<fOtYym@WO()|bM
z)_$%VjN2q9`B!;fnKbX7yQ{KWoO??%JlkjHV_e*3$?7j{D|Nuo6@oLzz&7OU^2c01
zYCrZ``u1con(#3sEqMQ)ek6C!MxbDy8NwTE>=@bMfI5v=Tu&AmNk)cj5g@V`AgPMw
zXo*<(S)PpyxPE|`GOtv{{x>dEUh-*W$Wi?}xpW=@8RDT|9h-*xD9OKp6(lfA<0&<K
zCfqHzai%j%Hu>Qls&W6}iK3Y#aT?2&83pKp(QnTSo!bOAR{4G-5`D8X`C8cE{ZWlO
zJr@Bs54E{mH7H_rdYXvNnz9iyc#skP09VV_^Z)ooN=C?MRV-YO37!}3v`$?VclP*g
zs+|iP?22ODG!rl2>(W=s$Eh=L(N4Ab-u-Q_qAH^l%O`|kw1D+J=#nC;OX*mlDC<^U
z+4E*Hi-Nu$zv?3-_}XouYClc#JR(>sA_y*fjd<`s5%}44$(~U{i{B)rK@^S+0_S1p
zhZo}Kb@9ysY~YAI!y;{17U|&U=l`(lxivqFXRx=2iA%9{w%3Xrb#NhUX1J$ZtDR0!
zL|fg<G|cSj$9#}i=+XQ0X`kRT9EJHcyu2%J40>U<%<OD4@A;<Et(XuKb04&$J79Ym
z6*V2MAX%TIHIkCr4&y20(@L{#)$%hKYyYkg((XRD9{ho-jjOkHi!x;LiZQzd0O;g=
z#N|6+my6_;)jKKf#1!v6bOA3k<1>*tK5&w2n+uB)RLZNDnq6e4P9A3Ss<6)c3?elO
z^@}DhTfdi^h!l_5U^}cIyQf+Dz2025L<;l+mvF!O%;D>nKC#s6S1k%w*R0{!8?A$)
zupL6StCT7*U)q-H%I;U0PSgXL^CJg4GlK?Ykgt4<+`;@)ApkiGl&QnS@P8$%!BUL3
zdTE<$GcqYP3qKukP#LS9-RCY%K1CvA^z0*9yhrud6O_T&D_q$7+0W?Nx1yi%GnoYy
zbP>pO>+V;pq^g{0X-t}~;xLP6Vhh4Ky&*9O<~&7bTKiCrSx)p#Z(45sNdiFtL9lqM
z8Z*Tajney$l|-oq;UCw1+OLmj+jen8+?$;-rbd*x*?lz6B~bBd9(BJ36)&MD83K`i
z)X6qR`V=Kq-zCq?L(bN&zePF|6VN!Jb6ZxXlca4fW@U3oq;2}JIFyu%lG*b6cKQRW
zZvPY&9cw_lp;0GZYHb^Q-}mQw`p$#mYTkkcia~3new!JvMLB_WH1Jm%SW(r`KXaN(
z4wf*bZ?%|>mHtGb1kS3m5kzDh?Ybzf#TY{2J-W`z7MUB1OBF<rmNbOe`rn@tT9L=l
z5p^G6Ph8gqx6{>tD^GkvOn9S0nD&D}HR;-?*WWY-fiotoSU)~bD=_q{lvnTa>r+Io
z<7NFf<dqaRm7Y#rz5s(smAUSO=;D&*a~|;%cK=85Z?Rv<v^w;;+JqS@W@ea)m8L^G
z-wr3I$H|*;O!3(8DW^L1$Kq?0be!E7a$uM|{s0zaRWMhhi>+D^eyrW<Rvl|Kkn@T?
zDLt*YIokeNXZEspu!E<+IqcStpIn4EokZ3lf+k3O*UBs5$Gyd;z55~TEdr0C$TGQ2
zPWf7vpq>?>n21_?G2TQZf=i<}+%ndbBgoxBG^Ebhb%#koS9w~wV|?}iWt;81uUGK1
z-UzW<6AT-JcfQCZeFr82NXHz#UOiVlTJpdPcdzFiZQ!p^#^o0#rgu$x+Zs9?wL(#g
z_SbmjWu=^Mv;2iJw@5PiAY4_LrsdCX@)EMfy<RRFX#)6Pk9(P@ez4KHy@DnJX$0#A
zKQcd#fPHrCbJ|N!C|#VMoiKz{)M5|6LO~*?61pa3uRBvJ0>v~mNIKMNkg%olJQLSw
zb}_ie4c^Xa3I*`wr5LNIf?Y?xtKI`YP*re?9{!O2{q`X*l!gIF=$otlNT}*0F46B<
zov7cD`-}2LJ4iV_^RUAx+?;aD^4oeKgJ&;~!&WWFjkZF@nAHMHyMEIIkfnnGRi6>@
z3TyP%U)6l|)o1B8!qR%ccD26IjrCyry|N-V2jLbdH;2#h<?cqniAH~ta`V#_@z?T=
z=9FhzrICI*&O#)CaM)s|o`=3X@{{*mic!&yEeN^2%YTvIlMtuw&g@D#mjs8s9_;EA
zU{%04gSk(WD;IR=^CZQ$8Ia6n`k;EDl$rQygq{saD>=K%;V#4xRKy)@poAt_4I^IP
zEDHrKmz0^xx<=qL6mtivbDJW{`3bVJs5T4SqmKhR6YDtTc?%DoZ-gKMb##7k>z7Jv
zN<SD{<|`s3WCYZVtli{T`iSlDNS?SNV||BCu}~rwdP8eb0!lS@R4b>Kj!u+0EdXgT
zH_9jR^h}l{d);thU6h-qV#9%W?&J^Ohc*?Wr)o3l6yv4I@Ch*28Yv;aP*L&F5Po#Y
zBTrO`HOfCqIx7gP6xQEQ+c=oRxXP8}Mw@`wBRi)qLl-VFtlRy#EMWnA>s@Y$8M<C%
zgv0^1nQMDHH~K2g*#j3$KH50lqm2MH$}Z1cIe^g@9{8b;vKPuH<KuWj0(Pf7xO6$E
zPitXyLi<I`_X(eqOfSEbo2^{On9KU3Xy&30ut`S|{xn_cVikMcMAqh23;7aUWXo+@
z($x^<Dr+MWK=_P@-=}{1k6BxHy1`TSre?=x5`-X<IW~ab=-j6HvxWI)=jXWup%9`$
z=|gBgB{>Udx$Zoi-aeLbjogRJ_a@AP)NM9fpGm{M0Uo@j(eO-`rzK~`S_uNBpSDI$
zrsfOMN&lZ(fY1|7Tx(`)wR<3RuP6-T-g3az))y1Mksz(d@c>a#kuVK}$tpMtAT3hn
zXO32SY+4nbqA~<t#Q1>TZgfzMP2<b|W!A*un5)-Tmul|S*{Bz8!3uvEqm=KLHbfBj
z2rEkBYj+e<VzsK&`SmH=V6mhS9!PL>mH+yFpR`B;D7gR4Kauy_T4fBOlngyUARK{B
zm(3Y9n6EE&ii&!B+!Uqip3S?vc;q3u5HiAxS%W5Z)O<D(@h*0f96%)M_|6*+R-qTm
zGs9vaN-%wAz)I?0_;kHeBSpk=bkiqmElLbDL26H1+thSUxnw6;EIF1g#58orgB6ld
zs>+p=)NlYjWn?~Ng||QNciK^0$)k0mzc&`~1oL~e>yJ*oUimft#-fT-f<qs#FQ*@X
z@7F(jy`Kzj5OCCUUj}Y+9L&C~za3<LPVlZ{MgZ-tH1qgyi%mRp*u4)YIp$m3K^c+`
zdBSw4d5b4@I3gZzS-@Xl)}Am;=U-*%#N_}K$7trQ;4+Hd67Gosz3+Ocv(r0Y(75SN
zV6VmsL=NFs$DY7Z-ae+$N3|b!%flG*ME^?oU@2fx_*<f;CmEZ}%@{IYj7{W5M+mA7
zGOjI(Ibiokrn&U91;>3M=GT_w;&Gl$2D<i9Ya4erhggv2hW63^c2pBGQoL$qbX6nF
zNAi)hs+nP&T0a%3xPu-_w0#xcc!k(q5IpSRxb8KD@`mQrer`Rg{{}x!FpbkC#xqhO
z{@OPIk0)vJ&D_u~`DMOocd5d69ro;eAutD5I$EDYIwh8|(-cVC6aT?0<<bejG?Vn7
zq46imE_*6CYctZGDfJD2g&hvN+wqJL3&`5E(6kY?j&UIsPE{&`F_Adveu>DZaQN{4
z^+60Jv3H4fbs12>cT?sJ?RFfzMbdQLO#hgvt|UmLyC->|c^H#zjxFX)=sUwYyKL>{
z$D{UH_0+2AZBE5iudjE_b8kMZfJez|QP+9H*EnNJm$+ZX$cuA>TDW55=QG?7rQ8&!
zLfmlPhw(r{eui<o=$*pIkOAbXQq{c9q$VumN63*3`>5@`$vIXuJVBC|(vW|ZK@}!}
zjg?VSC_D6VwfSTOy2m98@wN+jWon)M<r6riG%<M`NcYn^s8DdRC94&NqRinaG+|z)
ziwMLiR%}^UV5(0)G()3BiCE*G|Kt7k`iV1+aGs`k>)mVHJ-K#v9xZvVw;MIAVLA@z
z@d|kc6t)%?3EgV=`FPDRb+7Egi!pNtKb6?Aunr+z?LstUc9uJ9CQ$n4k<xB^KE5||
z9G7R^R4v&p#(Hq@t~u?uM|?fnYQFIQ38MMfz9Ini>9H`7;s_tzbRr(xoj82f9(}fK
zwV2;vZmBuLoFq(p5RZw8tEl-f{qvSoj>XclF;AXJsP}rf4>%dkCd_htiR(W^1|Jp9
z+ytB1fp}g9Y0H^S%)CX+Z)dg^#5Ms$ZiA6t{0c7DeEMN&lW^Aof<%kaH0OE_udRdy
zl4n>Me$tE&7()-0n?X*}Th~~NH%gFG@jtj!j}$e!42a@f=Q&0GblCV#TF#!%?~Q0b
zPIV?`@=(L@@_Zv;b!a`m%e}OuXTjQ%d~_z>h$y0OAScsPwKum|6`o%ne^LX)B8v6<
z`+ApT$LSR;)rpr=&`9{HlNDEm7i`jJNQBkhP6Anu6Eo)f7Ev7V+v0S+Hse$C>_hUL
z_w&}{D|`|l^>oAF(&EcJP?G*X9MDtSm-eDaw4YjUDe@=vyo~>jAtfCY7E#yR9C}1h
zCO`!<c#Qy<7S!09w%4Vx`RCS=%w#tl6mMo+4C1h5&v<(uaB-53z%VeGWm0Kow2S`H
zRdNo7{J|5_%_}zXLG01TLN12TgIgeFDAItRCP7=~`mTFu17G%6;vp+epqWd8F(dZC
zWE}s}ywx5Pknv7xyoByC{Ha#Y%oWGOn`2zB*Dj$F01o!8ob<dOCaU_lU##;)maQYA
zVF2sEka<7JVy&UGRocC<-i^`0;UfB<+5qn~KO?#3<W8$I9OSn)b`thf514Cz@1~41
zmgdd&`M}@V`5amQOzepl?bx&@WiI(PpI%O|mhW3!sx?n8E?&T;qgSftywH^HvUl}w
z<@`Uq*cXHUA!g;)4vzyh<V@AVc~zbVB?<v>U!I+=Q@?I*r|n?fS8**C&DC+`8pwF`
ztQ_arO-w!0s$HA!a^*DxMi$rQH}0f@t8i#A2a<a2I?;FHQ{I4UY5gWE4=&{<ji|MJ
zONVeK5~&m`Cr688Cz`K4iY79hOpY9PLc7~dFtirrFz-t80u)m}ron3@7c^Cq>ct5H
zAIfEby3BApIG+&I?#u?sKR+h7c@q+B<B$CERTT|F;w*mh{tUdjX>X{m;F3A40kSxh
zI4a(wLLrgRC9=N!v|$MY-xm(Y1R#a%92?kWcS<j^wPbyXD(EMR9*=Kk_$N~V_!mnb
zowoIOUy#&sRl=^4sM!cqDW}ve6<cjH(*I;IOFDu?1X%!bK7Gu$=JlpmdE{I{>dFLG
z)e(frmrpB^AfW63Gs4)^ard*GK-H3#Dn=JnXzbknFmR)<39_AHfmgp~-i`&#%|kk8
z&j=pMMWn^DI-2qcQhu)Le~LSb8Z<IEBO<c<sJ^}Ga-B%AGUNY<`Dozac=dM6Y%b-h
z9&yFDoas{gcb(USe?R`xaJexx?f95JXf<befa-pckD`ySH;hn5&q1J*gq=gqqlZ1;
zWm280U#QvGe7@*5)ptfC;0M~wkIw$VZQJU7>(i+f{1ld_zitTjMkC~Nxz4_dy0hc-
z31gZk#1Ulf(yA+8px*Y+Xf!$swX$tHeqscB%ISC69cD5iKVX0TUK!`gQ1)auj8JIX
zl@K%DzLn(K!HBO@m=JiYF^R#7F;QUZs#WYtxv9qznOXR*PKh-U^qg;0tgK@taO=yZ
zFKj@l>|?j;YYB16r+vblaO--M!nc@|n*LQ%m2&1c7uV=l3+`oRF$+kTos0Y}$NfKu
zM<jm@wy2XOzeRqFRIE!-M%e!4Wj4Y?UC*X8S}r_eK!WB^Dx?eNnAkz0aX|O!Qy+%|
zmitn4hhr?zjV!^gpXoe|iVvE^hBx3{5C)ZHtEboyWF%u99}1y!q+s+q*;{=jnk9YJ
z%CQ_gE{vQ;^9sf_Hj-WZ5QAl1+112opBqNuT;MYGJ1&niWo#CeHGjI0>FR<8i28{D
z{t@cmUC)oQn34%RyOv%Jlw9${S9uMEXJ|jJ$c=)hr?fm$((inWW9*p2afWbR5*5DD
z_&qHexjl)<bR*gP6fZ!Qp7M37{mo~uQ<j|>rjbzE7~^QIwlyUC!~HP^q20J<#Hu#7
zcsYRaQRDqzEuEBuZwK&=J4sVaLpbG1gwSQnjfCM%RY%-0Ik^pL%jiwQ?m=4}LE3aX
zy?vU}yw`3Mh47;FtorM83@U)SShPGzcV4Z30ar;VLcNhdBs{x~hcb5#{y({=wg2Rv
zECb6#Q^gYqk~py9l=3AvpE*kqk5Ss3cq%=r^@_f{tCMA&q1#kfHOv^B0rZtWM^=0$
z{AMz>F-8ITsNzt}C@N#|D>J5y82Laa=h@GyL$TaKuM+yuA9acK<T>B}y5(m_pLh=b
z7=U@oF-lf8?JT%2s7Lt&Trw?V=25y|ZOo5#4??~AxrZ;_@i*uCoV}@PW41t5veG{p
z<uheP_pQqzqZpvVDWueiffuqPH3Dt80@+`nfE53k?~$hjL=s#s<+)JuD|N!jkD1Bf
zj3D6f4eNDJE}!8=OF{)Yk&GUCm<YPJR69DJw&WB7T1MKT+!HdX7jJfglvOV@Ux9lr
zg@77E73qjxp38PS<vX*h?1~50Zij9157vgGWo$d}<>NxHH1gYx5=+<9F2Q_=$O~Uv
zW1!JP{640&9(be~ak(M&+KkDhX~W%K-*j2)NL$w9ZR@0;k)EH-%fl<+mi-!Fc6al@
z`aQjJ?ToCH)n>dHMIOyF`x#X9^331nAfg#iGWd<<zKKE7>*6d>`q&$)fd)L&ZH4mI
z{xEFkE4Au&*Z4Gj|FJt&i6JjT^bJK}g#4bsO4XFgEQW{bIwJ8ex+<)_>L^!lOv<Di
zwj}$9?#n5gW3N+C8de$xOJyD$94VgVf94M8ePb(7*b@@%(NPRBvR*KPIEKpV5jW&v
zut}XBmftn9MP1wayQh0on|<&)2Wy_{QVk)F+Qe%KcKBCMKfcI#4+7G2?8&aj!}&X8
zaN6qlM7*FGfg>d4M|E-w@I~DP_$L%bp)FA1Z@CB0*I4jz+0s$>%HQceJC%po2(kT#
z@S9{?tLk8uhT63N;J|N7w_VR^NS{3WmBhU#ZEDT94@H0DV*j1(W90c@1++Y=hD=RN
zKTY*=`SiQX3cOs6e0uG8x^x2!4<vYJK8}!M23XU}pxnM6F8!NDebUdULQT}Nf#;Dy
zb4{vvYJFT-V^ElkI=O!-<ugsZehzf>XDd$Nt_uA0_Ra>sp)#>5DiJ{$g>uOIx#hjM
z0lvKpWQ903;Q<~)d%*liOuq5%7cz$?-*5G9y=+Zhc(!A<IH_!$sMp2GtaT3P=_e4o
zS!uH}utJkj0Zi^U1bM$}OCyt4tHUQ~+L%4~uSG(>Xlbg`bG9CZP9E9dfxXMI#pTuj
z=DkT1XI@95O)NpUiS@0&fiancx9pUO=495(E{7C>Apa+U=F|hV=Q$S(0n?0R^#C7T
zE6tbxe6iMnXp2<y4-K*J?a_KZP}^LUQ$TG1;QIn~gSANwU~B6k+Ag<28S*jBBdk~e
z!0Z}rX#J-Dl$O@5`d}%>(y08nSosW`<Ru2wL2~Kx*ZmDI#)v@DggxFhz%;8??i}#=
z_dlH+6x?vDvz$Gf)SB6i$3N$>nhn$G29{q{R=yxkXA>UCUsSf_N)<{z`8`zeRE5*p
z2pmsr$Xw-or)59y9R6h_Q$IAIFkdgl-f1SMJHO<t!jWFVv`E%&k*>!^;aW?IFb6H<
zdF;5mmFm<b0D#z?n&|9TV>*7iMnPgZ=CkwI0(Y=D4SnUJN`OWobA)$u&ebKsMwakN
zBi;<2h^Nd_C~GeFa=qn-`9oT0c<d@jzc$h6z)AsqsDI17#H9Z7gzF+^-J)}9F%rqc
zngvz8@Pa>DDnD3ETH8q#0J?ILw*&Qu4d2nqnn{^bd*`*mDylL8N(8cW0D*3ZiGP9%
z<t85_lIbFBRz!3wc~cI5vfF}A#*3d0x}JNhg2VeXLGxvl&70Tn1=yY5zH1uA9wt}4
z9TT6E73~M=oO}#48>_9=BAf`M={lbeYu_$64!7uW3LkskjUuB?_aqcIQTZ8%Gu%c6
z531hvJv-C8W+7cPahsEO+5!n6pxNCD<JxBx;TK1<I<^bG-)IrlAX4?<>A-mZO}}dY
zMoWjLihB$=?`Q$UzL|$I(z<-Qu`f2@f01f+;M)-U`WmotUIQI{+S)$2*r-!Pvq_Ot
zDCMMy*41eS8!NeuY_8z3TkB*>Gwf+<MA1?kZebh2RY+56Fg0jluFio=j+8mJiVuzN
z29(uHU}XGM+_;x&%M0jIFqN{7m<YUr!U4gSSyEUvValXG1zTl~u@KbS%ma6_MAWZ;
z0Zx@(DadW4RaeL@+-11b_|vb6!x(}-$4U7D4Qu*I$pof=G6XfjXk=n4XA^~{<Dkg(
zHg@@9?#3<J?I5*;{*doT&7#i$Hv6Q-<bXg4WrRcs03+uf^g+tb!-IKA^>&j)uktph
zK#sauS0W4z5g5+SuM2jFts-iPWlmg9-G&%4<ZD9V=2r}W`E)J+j>}673*e6kDa9}R
zD__0!e|HIcW6OG_tq+AgQk$n&qp~VA-0r^rFn$llkZLsixNNeMpwskv+(=}<c(RNs
zr>}3S@_r6v43&5;i}czyZ(*X<tOmArWE0!4mTFAO)E+|o+4rP7i`qkxQHjJvCjgEe
z@Uf$Pvp;_E!IW6d(*JiYZ&`jt@S~>MOvBYle2w5tKG0Gk)gj?R8O)Gi7PCibTenUN
zAR+;nd-9B;K?~#*iGT1RXmbI&cDI3DOOsu|je4Q7rjq?ZvCtC<5$|6XKI@5;u|25>
zRJ?uxYyWCFq3FyxSkg*WH%9`}R$FuPKw*}C#RQD%K0`NM;ur_Yrs!(=`)zzGtBpn1
zOZ3f70nLZbmMo-c&Pt@$IC{Df{|E|(C6(_8%@!eLz_A0E;cG}IDycyOQKTap=-Vn*
zpYG;_(;BC+C#{B7M(#h)e~T%amzq#%ThgkTrY-z7<j-8HOn*buldSum%oBz)Js%xH
z;dC4Gy&XNFt~|{Wl0SDTCtu$lAw>S-ufLWf#$oq#72u3HpW>O7cQ|@`UmcEmyaG#M
zOsuqoceW82UT;FBlQoJDN<c1(v6WpWc7B;>hGKQTF~()Sja$;4AGW+3Yq9~$WiLfy
zM`TOEM0b1LPXsX*FP!PNPU;5mvrtInKF%oZzwDUnr9#J~34CW;_miz}Kf|Rj1bS^9
zNG25GJGJ{j5u*7~H!juRb#4R*53fbQLOk&P^k4VzfboW%_b;ku*ZMMJ(31oYD|py?
z#)Xn6a{O&|((Jb;HEoq(k0{REU9DbsEUU8kQ&s%uXlk|BNAOq^3a7Azwd@(I3Y7mN
zjHmmdYkB+zDG^jbm(O}G`;{)XKVLHGKha<}d;dB#b=9vQ5Cf@`GBK<l35U2R;b)^r
z{)csUbb(W`duEDS12=2uDpseoa?c?q&-&*6NAY!CBIX5=V{gxC3$=fnV34gu`p<Om
z7n_Opqq!w_Yg$fjSRd>C{w*m9EU)vMk8kwiXKX|zK7mqKB=~CbJzpNs1=uVS@pf9%
z%OZB`-D|tMW%PDn*2lY_%PMxwM8biI)`$Bn9u<*uZN`lN#cbWgUqQWy0r@!Czi?cu
z7!%qGAeSy%k0TS6l>9bq4Z3j45q6wb)r4{{QkQyKf*WT&#ksH3)gQE}gY~dcw;$im
zcWBMVS2Wu4@c;|lix906=V2&Fv7uSaIZ5nhcpA#Jn+k<`o))*$QFaRuQwmr7j&JL(
zAzR*!!;49p+8P;7u-{sJnwaemDTGhapC)j1+t$jnJT^^Rkb${Xvh4QHI`d}_(1+vc
zbNT}Ij<vQuU0J%Tlh_ts6}YHn=q9%RlB3=lQiqZ3d|O&rQ`P)sQx@*f(8)=s@|pL&
zqEGcJ?}%u>V9z9)6<?D|r1{-gO~aP1of6+}AZL7;&2?HYeGbJy>se3-)Bk{~5GBFa
zDQ!#q!dAyZYbb^R%BB;8PAOC6E6;Jh?HX^B7cpf~)9=TidA!b~v!fheAC0DTD6XAv
za50gLud*bg9FzXWsR=YSlt8)du;F!&UKor?KE?%QpzER;M||IJJPG@%)E^-rhH<Ig
zyXYO|9v$JpQ@z}p5eqT$0rr!T2ET%2ERiK9ABqW9YhLv~RzPxhwB72+TD~79xm?vB
z7x@_!0a`}IQ`tCHvBnZXP{0%qnUCs`tmf-8ftyUh#iHV@t<JmCMuG12{ln~-kSwn=
z^jk<~eXXZ}Khsp^G1~R}i!M)y)gO<?jWOL1#-2V4E#rhO#o7DdZePQ5CpazUGyMCi
z2?*oMHZ#vFz+KnJ+^~So;_Dz)C2jfPsJ5@&tYX-u8pOYe%ycwue)j|5n6GixEAVt{
zH2r~q-b|>IQrB~T@6TBDi~fe1m86E2hV40=9KN;Cnq4Vn_iMo^E}7Am*T+k_(|Xdu
z1`RYAr~5Hj27O`R%V$pV4ugg(=^<qTRk}?+u1)m1qj}+VN#Wl!<xC6axPaauq6%($
zzOn`mPk1@z<9$x2sj?NDm32P%)9if**vMj!UUIu%6Yj!;Ke0@6tyg@j!A>o1_*bxw
zdFqnNr2L*dAr8<^R_BYtOTwToqg-3|@ACt?zjs;U7FB5*3th<CM%b8>h;gZvIAoy%
z6C{eiG%e1wNRrh=fVDbR>tm?WC&c9B*g98ZY2OE9{PG^$C4o-aY(~jiDKL~F<bP)Z
z^tzZ8I}=w;CE?vhlD1nW!+KCJnp!tQ;){JIjO>z%_{AMvL1hTv^dG<6R!nO~8L1xy
ze~i9_lW$191m^-(Os$+IXHu1alYOHe^c|Ofmuw=$cS+Ci3groqtiCN#ol-_aHdkIp
zSYtl35LrKKhyiLV?uw<J@JSQY>r9RZ;0e)DkL4B|`B{RFFEvJ7(m7E`=ZFtMz40+w
z=NCgHh5Jg$I-rr`U8_ri24C;dkM|m^CE}b21y$Qwfu%(*z{~qztR_)jpLzf3Hca36
zK4bA<U2f=+)0Eu9DxrGHUvzOM=2SV)(`i_GTE`m?PA;*KkFXnHR~;}Z+vxCj%oCR9
zyb{Fco6Zj^&Y2n6>QdkP`!x@gJ1y{EmkYwFoon68Ofjb|{&#I`z`vTAMXS7wcB|-v
za=06858nkbpU3xN#D_)Tbn~Ub`<PwdM`OhYm`N=ARmtr3Hggk-^STgv(%~K`^%(%H
z`c1v=pMXK-d+)c=CKslS+ka0Y0`RXYX?Ust{x){A$zq1%dS@T6GGe$fH=(Gg%^N#s
z8(D86RklbsW29{B+OGtQaxnkut3CbtWen497qK-|Oz}-e${u%rO(460b#16O{uMC`
zjB|Br@h9bYm<W5xe$C|VaRUv^1l7L<oU>KyBtB_oc_1v!CpN*jc=!7~Vfa$f3*dco
zo()40rXK5!Qp09vd06bK+lp-9TM`Wfil*|6yks6uBzb0lGOQm~ZBH5N>A<k%VO*g<
zq>H}_ZZ(e)K+(b<Gd+y5d(QKYZ@<)MhPVeobrHicnCQRuCe{m=v6pOC;Nh5Hd*_;n
z>${#4xsAZd=lqdKpx?GPf`D0A0&lb;j7)l!o~V~)_1>PJADn&|ZrT>06DHNO-==v&
zf3<U1NLR~_?YJtdnvYwRT{MGTYh%un(qKc|PfX2_B^@&@-1zE(Rjx%9R8rBfqBzau
z$9TmdgX4u<7uOQs>t>KX6>QdM-VdaX9tzCcYiDPC|55w*><Q=@J?_9$`JZ?eTL#LH
zdG~T3^xvJvbAX(x@MFxf^mw|Lu=TY}vL1hYS{38qfA+fV4}CY*@O_?bDB5Q5I}I4`
z<(NR>xjK^u+=pZd_ys@TAcA?Hmk!lc@!pTF5$!x3BWg9=8ix)OyEpkg46nx(-tWWM
zG?a3lPmUU!>D#WhHHWhJmlHIPOWaJV_&`%3)L7dqCgW>%P8s6W)^xKiEzB;MN3$?8
z8gvm4FhIokrRuJu+~F;|ciZMJcAYUKfbV9=P)}Bh-qO)56a98h9N)hC$l-Ej2fGgJ
z`7rqXrcW(~|J|@IwzvYjdh{^1vmjRk;;UY2*`=TM<R~u}j>yqizV>@o<!fE|I#)AB
zo=gYpP4%bR<*~}nc52mFVj+=}rk|mm%4?p)>i(@q$w_katyb%|6-Ca(a>m1L;rp>9
zR0u$D(;=ySdZwJ!C2Wi^oYncyf*;e)fr<7)=4XvsjuQRR6mi40vNXic6=uyF9?MH9
zxl2fwtK#1WgU&r@AWPqKbJBEkeNBmE7~n(q?W2cs%<h~&6CfwyrlVpAYr50TgiT`e
zfkIq|<X#gA&=IXsTqCXh<@e&V&)ATeMW2}RIo?_TB!Z>#0^S@1GslocSz40F7dK<<
zi%wy+#-K%{{3Rsy6?ug}>u-{;kkWtB$Xt%O7k45A*3@S{f9tqwdc{tv%YX622&pB!
z3m&QGzWJ-&7;9Fx@m45qzA<6*Wk1+~j^m@-K(3^*doU$a*;g`p4IGzM<^8taM9Q#u
zg)Z7lNvvDa%0Piu{vd&k{pdj^6gpusEx9D*03P$--Mh6Pp7#Tl`Jsu7V*VQX9Ax*&
zmi{+!kj!R!cYmo6Kye9WY~X{+_m0bf@-YiLe9bXWUPqDh`3Sf&psx@0MX!b>4nbEz
zf(e#1V)Bq4rZhl3MdyA=cUb><PS5UlSJ~|g4~lN$+C>&E$yKI2!~*7`ji&zk9bUy!
z3-?TFY!Q1;j88__z})`mdj4g$uw{MuRtxb<&_z^?DhLSdW|U?0qPx8D^3oOlllDCD
zaj*eWy{`RQa@}}T&QX;#!CkYSrJJ_vP4_T|>p6A%rN`>ipJmgeQ36{fTi^hG@HK@V
zS7>~DRbJw`O2DTQ5YtYw&{9O_UlN)Hz<YrTYm)9-EVXWMQ#TTP*s86^jO9d2^b%V8
z^~lec`{x>=(q&3?tum!!8w|=C%y~0Ryw8TGrr8}uQZujLuDG(t;~3NA%@`qJ5-hXo
zvOH>>u2QMhybxO>H8Pr7l|P)!y9WV^$^DLq0RLw+$eJZsLj;2$(Ma_&0tzzp)mGc)
zn-|)-oTr9kZ)u2yW`1B}*|g-An<k9Km~|15#l=iQMdLZmS(kKGnJYW^{9Xq_ag15H
zP>Hx>ZAH5TL!TxroYf$X)tU}a!)-ghr`GhfL<|Bts<>-M;%n3V^=$M1gp;9`%!M;n
zQ!=8@wFC1wZ#b=WtRqE#x$tGyP5Zc$PU0EvKGSq0-~e&E4(Z}zQ^>pO$w7ANs0F%Q
zvBlrtzb6$^xUI5g%1ajEUmyeYd*n~G2(6KSW|g-Daj&PP7|+g8UPV)qn7(vG_Ddo+
zAqRQNyRMuVxy1cJ*#cp>B5;xet;#5f>u+pM;Zq*PY(@GgIEK4BCDVs&uDRbJARzwK
zr`+tWXF@+h20}l%P2jFWLi)AAh|xvCiyfj&Ouc{K&#GlX!^iu)5kCj6>G%Js1;C60
zl@!KAbehV19In(!oQ&AR{E&KKNc?NEU{d2VP3?gpOrH5;cKpyBAh;C~y-6)h2>H3p
z9NsBvmwyEhu)U=*vXT((u>T!W5dhs4sJ!h>pW=WcGf`2ysEF*FH0VKBa!@+F^rxId
zG**Gp(Eq<HQt-y^y{XWRSR_w)`#;b6D+UA2&1e1-{!F5RgbYRj0q!iDx*qE%6k?b*
z6}fBy1cX6j2X_>CcX`rEpdR!Tr*rEdcP`=jGe=>;Ry)*_TvLV{#vGwj(E;0g5cE7M
z%7}w}(>`|LqXHqmFm9iCCPne%+%@BvF77zA@1v5L)*n!`%C3furmEnMY=xsPA>TN&
zZgTgpq5I$3S71+=#Z&CZ?_=i-3a;YWNZPik%)xe=xeL+F6K!~2S1ttQXcf+;CZqF*
z8n&+XztP-kzpIr~ybY-B@(ZpAd)&z?cZ%?(453Q?&Ckv1&AyLCKUj5}-%G{|3(<M~
zBDV6KYnK-X8+mVMF_rfPmz;L;B>1fhoxZ+`xFE?!H#cDc8(%}8#wI2HX&MUX6yDTH
z!p~VsDNib?3QZ;H{!?^XSOWL2@w7MYn}=g~Kyjs#qsb#uY_Ke61d?}J-b9Ojqlpqk
zZ@ig7V!6XzL+#1x0d8jOABEhB%bSB#?Fckcx*Az-!ci1%78x!4U4)(<E}V{32UH2Y
z(YPeNxql|CRam($9p?FMA6BLs^4<CtGKa2TC{1B6(k8x!!!QF7KhgRx|I%Hek`J-V
zMqKJH@uo$pfFTiobwJGzjsNd}XnX~$E$FUF1s-BY!RuZ~%F*nf=1zj(q`I3=sAP~y
z817@++BduxvxgNH`r@B@O(9Sq6y9}i&SLU0XmnRs#BiGB$JzO#3$u7TXK`5m026)|
z>|fzI*D{5F`lZ^pn>DO@&RY9&);KkGoWnV9`jnaDqB|AB8|o(*Q&^H7(rL5z_ctEl
z-EQVjHQJQJnoDFGQM`R}O&y0duPr>!>@60^ly4)P=FQ~ZuQA}5aN5Z-9wI~b0p*0^
z?ec|7A``vS&Z#i+YT^>BgqEo@0W-lhv)R<eaG@($oayB{7x{hbFwjtEy>=Pim-;0N
ze2kJp&cZw&J5+zP`tfOgAp>b!MR=V~U;=fCB(xrPDH9vK{Yw(#TsEA!F3pZ-=l;8`
z(cJfv5*z+rzZTZte-_xj4)n@2myhb#4COPQew2_C;{bk2ckNUTeK5Wy8;=u+z7KL+
z5Ut<&D_@#-C71;Af=wMk5N7JsM6p#Y7GOhGx}--~e?Ui4akVSKl<lL&+=pwcodAi7
zf9`XR=c93Bj?};o*A0l8tOYR^pf@hlR6hD)tmYDouK4rRBX_~+JMvcufCTEeuLf5}
z6^A~NdlRoSBz!b6CcL8ipsgziy>X%_7dh)a@OFmDxH80dZbyu@2_=@(@@rWLza^9Y
z^1c@Ac>QHgV>YMX_RQVAJ0kXLL7_rt+b&b%kgS0Unj1u-4c+Owx}3y5VJR3_TBMhy
zOQjs@B=isKL=47KS~Y>e^=D7X%NX=%ZWU(S*@EqF79dER%>YIJ<(o3uq~|UzMF;>9
zTsi|vmRLV2z<<^Kkl}M6fu5a~#Zy6+0F*x={!`#0<M+?~61al))sHP73tR*L61m6m
z-jU#-LM+_e)M2`z-ED;~WzJ%o!3ej#O)}G{zP+I~&cOrTS?E}j_ax`rTeMi_mVzmU
zfdhZ5swRYnt9c)OE&Gb)pM>HTt`G!rduWo>yA(S3gtCZielRxX%=r%kf6O)>pLkTb
zRG3`eS5Ee<M7Jjhw{w*`JB7P`UBq2>(oHp1s{U=p!c>B9Vrr!SQgXTV4Tlb>c2ZlS
zUYVzxZefNTV<ilQxv)pu$vGD^t>|$hw~&@=>mydlO%CptJM=+*vGl57C$%74ymLhp
zm8eQ+Uo1&iFFkYt>~QF1`Qp>-o^7;l3O*Gvk?L;GJV^10TWY4cYFeiLME3Yle;@;n
zSO-$_P1K}evZjl4s_0u-<+JN3nA&75gxbnwvl@}o>!uncK3gZf!SKBE7^~1<xY{T1
zx_S$^Io2pAbz`~iBl5*q!Cr9Ajd!o@1M5<o6o95u3XiM8Mj?PzOIyPLx18UkPLYM1
z&#~vqeB#WVLrkQJ-j|(ogwrJ$_kbN9b$+lX&2in`G*<*!XVKX4P<fPuT2`}sDFX3Z
zRibeHVy6HoSfdum0+G`dYW!V(tzZ*PJhacs3RmouO&@4!#+9z=f~}!yge>+H7MvI!
z-bqIu%Y*li)MEO!(80}Ue?MvsOeovm2HLP&sKa@D$h&4aD7^+=O_!^Eg@Q36!@vE9
zhwpzQdOyO%$>~k1G%u>Bbqn(vG81acd&SdOfy2LP@%r0B8BYHLt)2yIZKs5qeW?qZ
zPN6g48ME##W>HIE?To}?!{_(7v2>}fna;72I<P=@7%e-hBN_s5A#B`d@RGEcc0T?b
zdvd9WQiISQf}B$V4}EB<$56f9_c;;eEV@s19yx<yE@8N^r|DuUU@WHk=V0JOTiP8q
zb+#9J<3W7|V~VcWj%4ZbHyoUq7J>(SS_LiXGjQ3L?)|Uw-tGVVwW>V3x0Y_C`21{l
z{LA?0>fw~}E_lS!e)KGNkKq(mU&M2xdRBQ~I*!$?#zx^Ok(nw-+*bw^cIEz-0pT+s
zr=LGWPRY``+mhPYm^)U;)191-At5~`h7gqRYLJDB-xFa7&`4OF&WI^XrlmD}<ztK&
zXE^GvFbS_322PF?{s-ueqN~@_L-J{j)vVs^hSU{nhN0_?Iq52_P9+a5rp_k8Vx7sE
zd|>WLs#_B0RK)<XPIw#4#Zt8fE0)QMT@SeuGa>xxS%PIr0TX8Agg+1sR)Jb-_H9n#
zTi$%rachwUKC1KU9&9qt$vD2*tPjdv*HA@)^Qan%T@tI^^E3D&mDs1^%|!~9EXw1K
z&EseuudK?TE+@OZu8B5Yi{P_{HJ&5Kl4KyQjm^neMSncbY~^Wu8~fa7F2%1PjJgCu
z2%;G^qNB1GM+m?n-D$V2%Q$Z(wydetq(kGXEam=>k+>{SJs~`N5NQ~XKL~yS{9~Na
zv@z$sQ?OZtEp@fg%D_o^v?86={QG)SloR4<d!Uxg;^cIhi3`B~JjG<_P)>r&x^&`5
zrkx8_XA1G5Hc9)H69JI=_ym;^={|whHuyBmv9ShIvgbnot{`RjMZoOh9C^Tf7Pb)%
z0KrLHQZvyNC*Hi!m3jPHk+cA%=u}TXpDZ09QFGDetRQ)(%*E|*)^#E)Z!upwpJg}S
zvMNwUeh*L@r(1&GFJK_1YsZ^e2(EGhcV;}R)!8U;oNG?r#Ec$qioc)`ucO}&RhkUX
z&9MCuhppS70l?vjy!EQMImDxEs`%~6C}m&m2CI>!I9~-l3;b$Cr%O~53dfNtP_19r
zuVrom|1Y}UDZG-nS^Hi|CYX3)I}=W9n-kl%ZQHhO+qP}nw!X}>_x`SZu;2gLI_cG@
zuI{d1)qN9Nnjq$vhnD;{SX|5xxbFymm9PFI#r!Ks%<aMASKLR)kIY)h3C;(%-nLs9
zz0dR;gS{4H&&8j41%oGNulYj$uhE}(q<>_YIg1q80C-2u28XkVg?xetAltZ9E_8YH
zi;$TsB5Iha<+<2Ut*vx6W8>ahE`=~2heru+DwbTjRQdQP=gU{^mdOmAs5c2R{Lt0K
zgP|gQcJ~~K3b(x;Sb(1ec~u1Y;l!V9B|18^_z5-Xv!1XEI7_->N||-VO?7ofnnu5!
z(!>l?JqspsH7{U|`+aLv2MjC<)s|co5lz*mlaHFQmH_0QGGT2pW`(Irvp;V;k5pvU
zrdEX?l;=|lFW+%98hLP13Xr6t^RUdn72DH93po^-TN&TQ(qdArx?{h~VuVBZM-oRq
z8-tKm8>VwaOD3u_dswFxuVQkTv5n)g_?hP1tqmTsOG03_#psGRI2<MDYy{$_Cj5RA
z4Ec14#GKnkyZrjyDxf7%9G9x56H3e+QyI`cJz$UfG<Acte-hMl@oX7lnrs+j9e)N~
zs433e!<%1NHt3hETg$(x5EX>8^8owe1&C?%?a&9ler3N3A;veIZa4c2<Q|In70yM&
z1EjG4%~4u!Uut#ye^dyB!-;1lEA1?_W-aiXQ&SUHBYzdE-5nH*9ijzw<7KbQv&@KK
zAo{H0E{K8F!U3u|6bDSKfsJ+3EVo4WY~#)KPw`d>efBT*)qmUU{j^QPsij+}WNsQg
z<LCc*>u7__!#YMC3kIFzlQ<}R{&&4;{~)OOjMzJ+y|6$OgSRa(?@_p6eSq`ybYtC<
z3cG<1_9e!Eq!xqO$^a2}7k9PTw$j>7rR?IMA*%Hjrs?AaehBSH5U>K6`>cciECj}{
zA8S?<QTWNUVrA$KkQB}IgjWOKk8zGgFvb|v`vx8V7gl*N0uX>5FjBt;%7yWiNp$;B
zgKastl#2{mtxNv}Hu!~2%TqpGTofA(dsZ#leI}?xUGb24;V-Dm*SnF16n2M<l+<ap
z%st>qXot1F(~|m_l=dwk^&@Qgk8&)LYUnn;OUTT-T3Ka_djUE6*=q_3A+{Nl3%j-g
zGfF9sNtgTya48K{>9*DT&LP)Ceusy1od|szvw8|UaK$vs3W&c)(~%`4QVJ8+r;e*8
zeTJ$D;k0LN<5K`-*0SoE?7vkOO#3p7x%dg@O@3g!1lpec!1IZX+QcN>Hu7%#hKiHt
z(SCfQ*E|GC*21W(#IZBh^F=lT-f8~_>NZ^tT3RF^N2Bw390)<?LSYG8P4a1G)oQ>2
z6zjJt>`Li(8&w)yt}n9L&s?yZs1N;8R2J4NM931jJeO<}&OP^-tC9vPPh@A|Yej&R
z!a4ehEneb>jKnB_P0czE{<lD8$FyK%G4^m1_d8ci6Wx%YbZZ{d#jwLscyUk=Q|8|!
zjd@TB4>&$d8<~deup{4UzqEHTO_Y|uSjZ9zYrF)ueU6&~@x(&Ed}j>=Edr2+1ME5@
z{_ksxK!KJO^Q6nGq=aMUmplyBx@sNuB2jHT<O=JZopL+<Bfea2Hp(Gcesh#;Gk$c>
zU7wsitMY$ePRlpDv(@pvW2OOU>`^7`u({Z$3A>D@?Cai)aAN7w>sw%Ej;-<VdUA9L
zA=A-bqEZs=z0f>tA4bYz1&hqzQ40~48k}zGgf5xiuB@x}W`f#uL5}jAE~DjMqt>z$
zRm2HP<x^)Z-&JeBr0NSNRzS40X^wO$%hRFzggEiri_Zej!M5Y&kMdu}n;64<l31KG
zJiF}~M~u!eRh5DwaI<<uWUo<mralF4BDzq57GU>Dizo=pk$74X?o~Ej#bPP2>`M=K
z$aFUkAa%S?0e>(3<$Q=^hx0R<m|-TCFgcr5FMrI#jCOKXr28phx?vV48eDGI9Er{B
zlpCh*t4+l|I{3#e-0Ttv+~?tQmCtV^S$T+<dv%Kqap_sS93_7e<xR(%vwcrG#Hh%{
zt@kMK!1@dt#y*^!ejd%|Ya@6>GH7QqkolOal^|iRZ7NL2J64#ehug7NDXg=c&Q^Vk
z99gcDFcQ}5sArKHTeYuD>)D-^l+e#Zrk6o#6C*J40%NRN_tdP`bVDDH(pxykkigJ&
zjfywYxCsT-76VPqRR4-d5c)%K>S=IQsMw)*C+k936df5|y7PC|=4DvjkqO(6D)+Av
zl<FRaUZCU0C|;N=Sy6K+XwyfFfyJSv#t{{LbE%+|oQBiyBabBYrC%-Mdw+%V3TDQN
zQ%6hRrgN6Wh|3hxc9a<Hm)8{R&6Ma;!{;H`#oa?3x<ql>dv#rUQc^d`RU0UaWh^l6
zmLJiVvq3p0a#mdzAC%=(@-$K;?(!3*OqYl4VIL@4rS90~6|h_)nC;0^BC9*Ynhz6@
zA+C7K<C)E+2nA)lvJXj>g{?E5@?!}N;;(igyTw&(0_NQaU|vN3RDlD!V($BA3J-vt
z=6NB50{Bc=>HkqaW|iBf>WrY44vH&oVaV$}))%nQ7DP>5^V9$4w-uT>wf6~wn&KXG
z3mI3nhYZp~c2U`5cqLX^j>Qv*QRBnz9RS7N(9wctp#B%)vU}sa+R!cK3Hg#K^${+x
zhqd|L)W{ax*ft-yXKpros+ISK9Fn3`dK)DS<lxh*gnWL9!^T<vw1R5d{@RqZm1a$&
zD>y_tGqc!)+fcUt$RePw;)T=<Tg7isRTZzGYN#csrzf4RW3Gw({w#U9B9mm4a&3g2
zH6Jehy%*&9&m*$^)G$_+ts>ftfM73pX>E5QqhjRq7OW3ZeU{N%&OZl?^*g?L4SGJ9
ziwSLa4+K&e`knzt?@Bk(f`9U_E)sb^oFC67K}0X~Jz%D6ObAo@wI~AS>o(3LH^VCP
z@=ur3d)fI)!7QFZ9o4z$k}@U+v&+PUq%c?aFk(tIy6A>;H7Cd{^m;Z_3luC44K<FK
z=$m&%ua+Dxl+ujcH?5M+#*gUW=rgF%t?Q69D=lA&Ofku)p2HYif3LmgxxvY`>02qy
zR9q;1M+-;Zp81oU*hh!$mmB4|$x)1X9*Vt&1x9T)1sIb)FFosgL#6}gqWq#YaUE;s
zd}XKl>hS%yA>T3A#F_Mx%B*;Mj@AfTbtlRD`Th`G?h~tQQzhjeT)g0Pp^EJm6H5-?
z?H-Jwc6qu9g*ePr4cN>_vamMIRD14`<q?%1C!7&XxE7G5xqt6*h@(_04-a@F@e+{^
zq!C#D55O`%+?0Zp*_HH^MjX)rrXspNvdvx%)Ac$d(=^f&)Jz|I&lV+iKw0pB5}rd}
zFf4*68~TyR=rtO4vzJxOi4*&}ZWOUxfMVD)q7#C5pB)<uZK>b6>HYsgj<i;Kpp={v
z7_<tI0Pgp)HHQ!{;0QC`lJ-#4LfeEq$2wc%c!TSJM0Agp8ozaXLKYt|9GOP<yg0=V
zFlp}Vc<l0h0UE@_xIcpTg*{y5`I1KJ6?v&{UVzN8@;p&?_FKfL4C)L!)RFZu7qpPf
z`O*u_#(p}=R8%5*HAWHmkQBk}>e|^ku@S>}l{JzE!ugT8ufEm|5fUy+Ba1`E2MDZ9
z$uRX1gN5i;E&L^mU5;>(p!h!Uhs8>xQsmMmx;1FB9oUsy%qG@fEWH<Mz^bd(1K-Ii
zyQpk#Pw6ma3oC3EV$}lxnDt<jkTl(tp9(%|u8rApCd&cGa$`M_+QX1zCWos{b*+<i
zp(wKVmxozB{$F&rWu}8;T==lIZUxOA*}!#m8fPh3{^Bix7Ucn~Ubp9aW2F=00!=Y?
z8h80kXRVKA6ZDK%W_B4b>W89*gu%(wPhp28QpE+1+DWZm(AXW)ky}@Pr<jjwRy%XP
z4H?4cZHZMzV7aP9;D&!XjW$S;wt#W7?uU{@xRg_XJ+Aw@&RBGIo<5h){NgB)@o0%3
zy)Tu3LI^?Qbtis)1b9#HFjQhVl$6)s+E?*w7>Qcl1ZooN^}lA`*u6Z7jX1k(bJk9Q
zRrXJJ>gjw*j8L4Rb={)1%8sOET7BwkXyo1o5x{8RJ!nC*xU8T!92He?8xP6c$Jq7@
zhh`DL04Wo5CoUB8s*xYfMR#OU0K`;;N*T!gm6p(BYj?$oWn#eo#s)@!0u+ZVRN6}w
zq9Xn`{&~npB`$5OPSu%D?ST}RB9L%++j4p5C>gRg=|%%ci@9i`;BT*g=RLpwgEH+k
zm7-031;VtZiGj~!Ju#>LOreOfd~s{M9V53q@{TiV->siWc+KK}`vd0Pij`P~3Gnxi
zz$-Q+{=+!s^5PlEMZ|_dEc`IYXf02;%^9=e{kzOly0LV2TjiUGbx%@|1H7sW8>3an
zGx&|W3gUsas|{-Ro#xje(>0TCj4ZO|Bd1$8Mz5+w{0`?b@5n%<r^@7%4bE^_Dde5J
z{t8VMeI$7+G2aC;eSf7Fvz|6G)9xaaOz8r)9WKU|hOQXucT)8xj!*4h5=;)62Xf2(
z3oHr<Nq!lbl$kF73qhG}X)&NP5tI30!%lI}<OQUZgi$xvfp+<Fo{cv$bQfCe>FkKS
zKkl=0?)tyk(;|2~NbOEoQ@@krXo42Hj!ac`iXkQ1HC9qXO3Lvf_fi9BhsIJ%Dbv(=
zdzFROUCX%NUlNBTp>*NWE*mCGg2CsTFVc>{(VyZbn`5uID+@+eOaB#t{)-an`AhTB
z!UZwRV#re^fr&SjF0;Wyt-9LuDD#n)cMl27wSg|*cW$S;xPjwBArJ++bspBry;{@Q
zz9rAdS!BhV)Dzph1C~n^bA17wuE*4KN<wx2(E|RM@fB$N{M~L={D+oJlVi@UdBmPY
zi6nRKRpX?aO60wdclQZje?p>*)iA9OA7U>gpHc=`e^&pWI`wyI@h&ucg`#*dWBz%=
zfBfNlk?^9B!%qk7Z#~cCHf}qzB-B}t^3v~b=Bz7DD)7C#&TJxze4sS+|90n9<~=Tr
zqwMWFW}O<=dEnTCAtuxkaVRY~ZCBYFuaEg=LH`yHhyb`S58Qv~i<I*l_<!ij(Ye}t
z4@O|IUA`s|AUpA<*D8UZyIS(`KDF9+dLc_$sXZ3kc~K>6;w+u7RE|o)XcEJyFyeoJ
zN-Crm5D+Ks&3|wU*~S0DEdq=1|L;W;<&7s@rI9{-oxs-Q85|B@W{v102{HotGVaDV
zLjp*wdu<u1^FCwHhUwV`g2*9g|DQknG3lyIV~5V=f}OTCU{$4efsN)6=x!LGJv{Jy
z1EY?%GbqaN1CBdtD|0Xzknwd+2inyUcGl)_YJfhd9`PWhXWD$N_e67VYVL_y$1i!-
z?CER?!_>9*Y$teMg3vo*vyq@e2sX6oJ5i;Vf0bg8cjKge#~mTIfd0|)X9@jiMAB#E
zN$(ERs1=lbJWC4I3c|iOd`@LMHpagR3gUaE^QE`P)f6N#=%YuR2^wQluNGf^eH-X?
zqT|PXMyVpK<`X+gzuX`%zN`EU-IkHP60H~4()}avrB<+58~MwAnpl|?Q)TVimRtmW
zSI=7LoK9r=im$y9ZD>i)C;;<Fg@EQa0*baVgrkWkwa~54Kr<_UjWs?>gwPWY4d$bH
z&*@Z*##ZDq2-RR0D*hFe`U|5ZDP1-5WivvZD}QBQ<b(62I1(vI7K<*eW(!2sW{_0a
zT8sIcFzc)%o*QJQE5uVpf8%K#k-Z^Rw=$;YJJ5qBMlbkL6tH;TWvLu{L)@Ul_6PHI
z9H>s8^-#VXX`tF(D|MX^v?_@9eM&2AQ;b<xtVer;O^VE>vD9}rTmOT_t*<QrwG$#O
zt<`kQVbJCFUf_5o2=@MHZU7TFgKEz{bNn(khOMXx{Gm7Dj>e3X;Ey)r@+Z5ZSBU$7
zgr$?rH+}neW^-X-Bl7jG;s`D%@1PFD3qB4<kDghWJ$o~-q+LFb#5BT&G%0Upx5@H<
z`(+u=z<bSJ8H)3HvDhkaQkUN<4|)6?2vynhHec@odpSkV@AURmcKBJ^wA1K7>QJPl
z;Dr>`85RTCdE6b9AUocH?sVUC`0$*I#2KiwW8SViQ2V59W)VD0>#Q>~A}-GgDaGYY
z>+pP4R6VeB3w4tUSE(74T4?7%P`z*a?vNk0Ds^XkptJsgu(<9wRMl6jBt1SEIGw_V
zhzPf9P!+MghJEy7ubYIFyFm+y%|#tqv@PaG|BuYo)%gq?&gd3?-ReDyeUGl&Waia|
znL;UPg!%WN?#^Zl^4htbV+f6u+L@9i{Uc%F*SnKl7@x^R8#Wn3rxB5ixit@6nhFXg
zk05jQU16QgfMZdc1uy9%*rq16|2~neu#(H5w)p|Lp0c82;K8b7Dnk-Ud!CLse?VDE
zpXv^SNZd!NUw*ipW@e?au^^n-<Pqm^PkDUTIWx+z)qtc0o^z-W6HZeK+Qlmc?1?X*
zyE`6X05son!64WaaDCKf(I?$Gfki%xdD}MY3}7DIgP$l*v6LD$w_wYNGW3lLD}L02
zXcU|3A#jl(KgbX=Q$kd@cgGL_$8<nupP|>T=4|0)AW}FgZ^j_xvDe#6%It7UB-#u3
z!BTu@xmWuBcI`G0=To$oC5bJBy4Ccjqx74`xL7G~(JS|uH+>sn-s&8m{OnG;Qb`d%
zKGi=d@yf3x8adL?O7t-k&COm7KuQ&NZflM|L1)v2S~e6o$^L`b4}J^KBgQS`^E9Ta
zEi0!cnd?W^)T?pFYK%&$T7geQy9L~qH_ey+rfPzY2ZQmya5MN~+LTNSz%y^<a7KZN
z0ssv6658gmacRMqP^(`=Cug2tHU_z?+>osH0RW=EseX4sde+PWVBWyxC})`iX~LLa
z-?LVhTHzxbJlM-k$W>pcL1sYRv!E1~J@=W_Y|-_IL%FnN)TMJb<7Ugc=N_b6o6Y%{
zk5vPkt4s;gpv_+7yKTLw+Dzx0p-Wvnt=NF=pd-zJ{@(*#Ex@=)>E&fyN86R4Xup6g
z`*Lbgf=GcuR@+~|tU(nVt+P8Jf+XJ+col!b|HPdY%Yv#LidI*D(t5X`Oued7rqx5U
zM&d?gQ1zMulaCxK|9md}0ZqysTE#tJg}I$RBN-+1cKkE{BRFfa?>y}0P$wS4a>xI1
zXd-F1z4Ll!ShBZkbEpsjklo{aEIMA&0~56;jSa9*35K)k?*wgsbpM}TfTrti#p2W>
zCUQcwyF<NC<NKeW-;#9h9bi@kK8WL<5K)0UtH|H&@!rWP&-b?NPc)wyYpWzf3~&3L
zOV(#p*eM&{$aX?L1^6|kE420bz&te0zb!NT@MG}2`vUJXn!h~ct@&eiZPh`nkqy{f
z!L)l8p0>YU3B7^IYh$k$gRpZbERF~90Nm@=xUUaB)WV0F?Kk+13FsI~?2lQ>5hnx9
z_Qa8803P4!S7K;ZZ&2#IL2s=dxTtczBpM#xQL6TLpjh+3^64Y@Z($}6y<en2kgz1X
z3l1#P_ku<qn>2x$^ffflTJMPHl6p+D+iV~lC$no2#<F_YWjeedIAsSH#)5}?NqYfz
z)t@jNogk$?6i(=YYbbhRQp4V=Vd3`W8etR2U@XFE==ZxK6s<6tD}<ZVWH1a5=Qfni
znW*-xic#MMpyQVD)pWhUiNEq%Lf=2Q&9E5bRwDFaV3LE8rtHM#kb4978rI-b1J{%Y
z`*vzs74`s>+Uqn;ZKWij{~oTA8sI}w{{Fo&{n$LuKTh4k4^Zn=rN1<@*Jet|5P87I
z@hKHVtuChsbuk*eNv!tCfd)ocyPe88Ovoy>%5dHz*;#Hb_<&6#IE(UhKiY<&2auNt
z@iC>`!`J{=-;%=yL%o8@%3)WY!iHq$(D*qbR2Cd)tT<L%Kf3gkpR`zVtBu(<PyM<$
zLgrmXdeD{-OSX2r8k+5Xz82^{xFt7X!D)pKSoMgYqjLl4kZW!(O~RB_^3xPkc)sGo
zDiYG+h#TryXsOphqQiFkG*oSyq3;mdY{ffLVY0(~bwZk=Y^uQt=$M9m)!6r>N#z-(
z$*pcU_=4@cdrH$quMp@A{q2$HxE|~qHq96ap?(d@)#WDl$%%tc`PPSshU*{ft3`hB
zt^=5Lf_PtEl<>V7+ZC0dWLXWRo1mctZ-rlc3&SH>ZTS@gyFcSYzE@jwDRKs@;r4Q|
zD<dm*MdrY5<BnM`uvZIi`<Qh*?xg&7T3|u-#tI-&)D;83UUa*$7V8Ix^Enpy1o^Fg
zn^kb|YZ>lcUqqJRi+n;G1YQLRg%44T$uweCxkr#k4p#=(^-RJDhNjps=Kj^1f(~-p
zySON}@8*U?)$&((+C3GHzPvB2yw|M;vVs13176^5c1FoO3t`6@uuS`GR;|$r%95k?
zKnn!haRvoE59)aP&kM|BT$h36U-f!H?W|#cF(a3ORNFI(C3hm{2I&eoy}vTTD&p6Z
zP-XZg@msGzk($m~S|u?<S4acfY=BC`?)5?E{flo6OcR$jT8UQQM9>G0Mba|qaIMgz
z$-Y9T>-osS`%;&K>ltM`Oy8)zIVqX^+$H02+&~|n2y85i$r&9m2~3l>gdPgFZcMg-
zu)@rVe%~V(-XuN7sBijVm(svG1f7;r+-d({KA6S%Bx<oqlgP+1K8ZsgOZ)bi;+siF
z10UBLGgEjYVDJM>Z=XROIjsLFx&rOMQRyN7-z#u;$=NnME&<3SxroQU&62EHXX}p3
zr9K4o?|g@cU1rtL2mZ;XaZiG|F``^dz`a{H8v!&Ry@m1uk$6vJFXi*UIg*1@5J%)X
z(*CP%BjSz0a&6JaX6OZt<}3BN#c0Wa_%HR)v`ju(Y`}YRL{#Nqg`V|L;-D96Ehabi
zP`nFTbRe!L|A+|38fFZgEfQxB>FX0{sCB<W-B6^JSN|rPHm4^?C|uHBqfE0Kdva(W
zH~{ZAma!W6^Y*A<HOlU)0?RJI+v@K6<Uk@Lm9E?s7RW-AMUi}MTw`$EjAjGQjN4Lu
z8z{S{`9l`#3q=bBP{GZ_>#+m3Os;bgR%FF9Y(uFQU>b<igZ=GyF$u&n)i+Ev$i{*~
z*#@aWVY7rNQV-O9#rnKYrOpZMbOiu0mA%<MayFvH8SSnVMN^AHzGCi}DfFP~i9bk2
z@RrKzDGS<gH&$OGdC+GH=8A)#yfLiBEb9N=4X%90<ymU~!hIq9FH-ZqBbD6o-4`1G
z0Wow4>FxsaTbN)Y!$WF4QH32WZP)1lYFQ2(uw}UYZAKHZXEPV5*kPWu*Ba^(`RxV@
zJM{8#GbTxs{YLWx2y?C*+BO3l*DJEa0l*uIn~57X!~0w!I|V6m<oV#S*CLA2P6LF<
zckPhEWrZfNRFixdbk)W8i{6k>qH?YwCb0=~3`5o0fY&05age;<w?%1h=jZdILwoe{
zZo-cU3bkr;*4{CjGsK9nWi-&cH}nH6!tv?Oi2L`^?Szd(m<+?5|3qg>yLPzV8n-Et
zne*>DrlVvXdc=h!Nllugsm!;0CM&cNjPGI!Nx1%aCmA<E4Lcuwb?3!h1p<{y$XXi^
z&k8I@+s{y1%cbJ~%E9dsj)_O*=?cr*Q~QyQ%o#Bv>(IV*j1+YXxE~-srkdArwR^+{
zL#hq^S+K2RvvnsRYYS~H*!uI3F4rv#(^p6n69^$cb%r;><68&2_DOW3eDU>mwqCh2
zpktwdS+D>B`unE{xgg#c^61N{Bu*5LWoS%5o?!Yozx>xLF1F^jVX^)WM&`$PIUdzl
z`h4#-4qRk!V$%(;<XsjbRWA~W=KD{KC-L+Hk(wMlkc3Sa<V}?TF}&5~CZ9ht$rvH;
z6D+yCQ>dPu);RoN!dbl4OdnFOaLzmMzcu{Uz_;6)svAa^TRM~3(I}B|^X;$Mzl8Le
zYTHxjF*ra%F5S1!jR``%gK!5c=4LkPNbS7TGf3wa>ilg`^)AGh-(i_L!W_nc@Ybi=
z=rAjfFlAf;ZpinTGi;s_5pJ^QN;tibuFzS&+Q1@cv`E84leSX+V<KP>yZjq_t$}uP
zaKJoK*>P*k7q?*HH#;u$yka*lfijpT-+-kf<2752p;b7~jiFVrn-99KDR2lw2btpY
z%94Wv((KE}2vO|{W&d?FQRFYQ@b}pG8s`ocf2*wyp+(p2GUTPpx#;wKU5WCws^;-<
z`A*?@Aj=RT)19m)&B+vYG<b(MZ2YKSx@=rz+h?HJX75eo1$v;?R`17Ge;0F~6UXAZ
zuks3f6K2VOhk?Ig>EU<NsJmZ}`0`^L7C?lwL7G&df~hA*rrwRxv`cScGOi3VaX^-t
z!BeF@KX_c7*A0eb1(O9lJt%=YGXVi*_Id1pD=AO6&GneRp?^%PJpTO`04ct{+2T?l
z2Rjk(8J_fa)npF~546W-61$8vlo`Bx$mEd*5%)6)sDZQw!+QNwkBLarTvborUd<Wd
zyNBH!q)*^(AiBsGf(e#qXLe^cpr(5Yasfy&NEMIZM?2cnIxv6%nir`-0sGrqV=+t*
z1O>VceoJHd^eQqMMS}@+t+9_40tFO2idnqOgX)1d8FWFg_(1c94Ljvwdk$NU-{x5S
zDbuf5a?n9)=T+SLL_ygVS+;TaL8^KwgY-^Y{erY?Vb1O=!1;y%Ya^7zF;_saNv7GV
z)eZ9LuhJziZw+=L;5iy4%aESwQnY5u;@O<JFnq`#{vG=7Rp8!Mqmlw9PX`RZo!En7
zzFwv?4;DZvTSnKRu}RbUgOeL}s7okut~kQJd2(zMhXyHY-8ENmshv8o5|oi+5xz_W
zZ4I+JXVHcZ%2Ztik_TQ|dAhUGo^>d=a<wTYQ_IC1)QR&k|1vG`-&5=9mT$-qrb(Zv
zmo>8{CF#~z)Qc$#yu$}JzSPeSQdkAH@lg9r@?9nv4rQ;@xtuMx?}F_iUs?6%zwg{y
zSlILSTHqbd;Dp=2rM!I7Q@D973&A0-p9~Njdbm~tGvrMxJbrkHq*wrD;wq4G9XyG$
zhgW-tFFR9Nnh-8w3>vA_c%H@z`B1YC7Ul*NCOj4dgw#T9UL|f8GwCU{KU0nte7vn`
zD#C)AjPSnJKMz7XQ}f=p>l-kda%hD_*}tiw3BKK!LF^?L%a5OTH~sopufTAhzO5*I
zFAv=i=(h;()%gP{sC#dA*GXOY1+XQ^Xsd|$NDj~d_f|Zx;YoY9KSg!3P(l#VYI^g&
zjNTup9Cd9Avw{_-o`!1(ehEssRG=yzHcv3iZ&<d-A9g7q3Xll7+fu3~Cjt_3RRG0j
z(@ws{>E1gYLyh~CV2JID{6#Kpp3++ejyA|LKbuK;^(H_SY`+E^Ggt8COEVb9qC))1
z@rv)=Z{VSu?lqP|V4m-B)*?)drSNgEsK)rZGTiiqid`i)^@wGu*PkzO)%wtm3iv+T
zdDtXD%59ztnmZR<->N!gt-COO!D!){-CmFNQm7ZFVrggL%OXo_j0`4I-GpDJ>hQIy
z6QEM!P^PZskxk67;ow<AFHJj(!tl=wi-nA9;(Mc}oTorv(~k}Y{&w~b1^;ryY)374
zdk%~Rr`y#i*qyIYL+Fr7U+~h2ZRC*op~^#n8E@R@`E7B?xFuIn^7y2oZ7A=4Q8vOc
z`iy#0+pc4Vt1L$%;lD0$gZg1TNzZq@X}QzIhMK~t{~|JfGJEhLuz97Y!XVYO21ml?
zd@dPkPb`$hr4S(I_tV|eVia!nwkX!Pwjl~?Xg4#`>VB|OOk2>szA=3gyD|ukh;W&}
zaf5Do_%l1TyvV~2#USB9^24-$zqmsa8suM?DMYN4_4q7j#~EyDMlO?~&1|{}!Mts+
z-|?koO<`1-hxGW}N!P$obaK92CUSx_aYm@6d0KiQv+|4>uHQh`W_W{iVFO%s9PRUR
zgeQ0)zUTbFw<J#(u~0}JQP3N<8|nIC1sqTw3mCqL7&*=O-EB55&{PAFsrRhRw$Z$Y
z4jH(NE9@+>JtaXUx@$i#tnTIFp?>J-`wJxmg}Ocm5=OU@)Nz$3bAk=`M?yXom`3M7
zc6s=*Z-MsGY&gfa;4}d_FaqGQk0s+x&Qknny-)9@SFyiCW0iIpW#hMYefYOzP7ZUW
z&^f#9jm&Q_b#G#N9kTu^(7^Xnz2-@UpixGvbRKQ)_FJsYFN)oLM+}}1VPJ=4nd88S
z`j*M&2zA%C!ruwD?~T}9mP1u*H9Ovm{J0gA#TPZM<+Ch#9OddE)S)&Hkm@sKCMCr#
z21Y+&*JkVpTGcpqL_IWG8e@37X1B4VocS?RT^~0SBIv8Z8$yp%`n;D;tRsIi-9^XT
zQyMR3Y2ZGv)M4rqU4-ZTsY4k`9U%*>!eWNN=dna@#%Vg6kNZ#ISW}3CjrvQI44oRT
zUHEaOI{|IgiSoRQ%;is0YrLocrS!1rYW=c!mmI~Q7~xg?$5I`e*Qy&=Lg>PL{@|t5
zGQwE3v1atR`2rp<ks*pt@2FS@2P-(&Gg_TxF9qCgoQ1W3?u|=y)XqYG<cXO670(W6
zvp!wtTWbe9j_31R#xpBABX2S{W~YI(nQ$4VSOe=Y@V67z0A@~L4>P(I4!~}^FN)?2
zrQ8!b>&r*a;h3p(z<0^VZ$y>gAtlgRTMt$!!t7ITL52v$dnG!4HrD~w7sDHAhet8*
zdSpxcNnpJhc&96y31w_B&zjSdRmbBep%A_-pS~181T7>*fmF1o6B0yN3JK&>nFIDA
zC`R6F-WS(17`<ul!fX4@LZk}tAZSk0`Al7l?5({_ppN6$ggfBLUX3^v*{7GJJ)&98
zUg<>DXN9}%J5+rS6uuntC#84?BGNnFpHWns=kWLbWdFkx-m%g?>x_r}8Xxr9T#Yky
zW;5hjR1Y-*Z_xD=7?f$a8Gy?s86&h$E2lXk%~YJxnCvp5=a2}iERYyN?hqI<7FsxE
zuo<QryH94jw@kVo9U?%AZc_|+E|SiIlj7NfxiUGdsB-A&O=bX|u{pyn>mtfb$nXNq
zJao(DD9?#8_f`8wVA{NW(U;kNa3RtIxy#+BYd!2>N960r5R#tf!S|c)b_8O9doNaa
zC~z*#o|gqzo>|W@OEx^~!{u|r?<L+Tq1VmJl-~`1{wq+=fsvhGOrAMH&#w4;@}5iN
zuSOl)pFj*Ld(WPB<~X%=Sd2n-G8wWdVE%ok{hGY-XRgnwFuKxM5z)M^SG?gcL%U&<
zn4}#r%%qLY1f6)Udz6`?Z;L74VcSCsLHZNP7$>K$k+PkBR>LDGi(}4X&v6(9GS=Jr
z*TZtD;{UHh1pOa8#b_)oP7whM_<=Otf{t@csj165N8I>}LLXB8O3A5QZY-6lMlP(y
z4&tIIUKRk|_&4!AGF5Ho;UwX_TMKEu1x-m4Y?o*DclmSw^pF?~vPR4EHpFEInqA}e
z+T-Gg;AgWvtv;R`w_<ygMg?w?1Iq3V+|83<vn$y=`Frw;a#hmr-BnbZF+TNn2u1Iu
zy<?qx47d44aX3J-BYI)O^WKb<&4bgc6dKupvoZ2zJ8&2Zf9cTV)y+EUA4>@}n~gtc
zEB9;Z2FW1jp6E{JjMnu(KMr*j0bFkw$bnjOq-%a<S-lQWG<)vq-vy*vxE*##Kqu#Q
zw>j1aF4w3Dr9QK#|3{zAhVA<;aA@*k3n2a5Qju4^6&^LB-(e4s-H6m>=nD*8JT>_3
zOg3Pk?27(9TcnRY7?Y^Dz5D{SdDl}QM~h~y$e<?ermoR1C4hA8=_W2=QF0n4!w9XU
z4hsc9c0qTxfbpcd^0vWbOpGex>fyh$(eN8GWSmrDAFY2#zeUH9x86Wn=fwG8y&97i
z0-cs)GcjC_?H4d2646`#k_>vSdj5(0_1=EtCJHvR5c!eX_l$?x<k&~Dw)UgYtm_tM
z34JFbTw)l<r<%e1kC|O3=uJ-X6d$tPR8_cj1_kDcTU$};d}DUwkf|HHDzlBIdc>#H
zc21g&GqNpG28EG(*qZ!07wQrf=()%r@b?|<R}K>aB@Cw7M+(C9J#;H$ezmF1wpvfk
zYb3+kz+Y8!+gNethv<YRW8Vb>hsf07^Y1?1iwhwF!7#mveIzBN-^J8?-2&?Dpa{}h
zKK-~ghh>XyDJHgU|7r!^JVpKun42!(UhmjHJ1ai9UOde`K?pqp0#kp{{mAMJv$EnL
z{WUsmO}1Wxk)}i-^lBIGws<lsa*pV=UWc)z9>zoP{u0h#q<!^kN&9Xs8Rgz6!UKqT
zC)Vz7T}pRKw}@A6I>EonGhmnx)Np%vz|Tr=LhJezyZHe*e>FgCRrr~vyc1C)Y9|qH
z-5GEs1(C(_7p5=fN;?0OZ16+wBos`0kwsd&pF!PtV3gXSvxV?oW&6jjk**G!?U=L_
zJa&{|oOI*QHnT}d%onicbu-19JfUBg(>m#d1o!8SRsRmMTjl3W4{g}{#4|<D9n{Q(
zu)Vdqcec2ezrpsTQZ$i#euyUGH0ZN2_dNH|cfDC-Bu2Rr%R?WjNN<6=x>NnR&RYf&
z26kxKu7(C4a5`FjLD7DLUHY<OObAu!hV^x%Tead*wX>+vi_aErC*YsC@reA73$lnq
z@%u!26Zw(BGjlUwP4KO*aEbE#TiFJ+!4bmcVNOEicF~G|?Ef?V_U|nHzm_#q->%fa
z*a|Q(!RU7#lP6Gsla0EVPzxDfQTp~swr#<7@ij17h3I=;O%hm(?NhMDOmFzMFN$pr
z(qHxm8?y)v_Ki2zkv@B-OsGZC<k|u6Z94l&$kf$-$MJH8t)X#$k<xRhLQUAvOQ5Q=
zL8ix%(a@!ahQ=nDCQm|nk_X3qOS13E(Ln)=zf~3|iw4(8hmBzT2P?1WJ7FTejYQXB
z*%_{qh0!~TG*z8GiO-h)n2Qqr2d$A<rrMm)@=M}RJLg+HF-aBh;9m}T4!b;!4_0EL
zA6faWeDktn&7ba5ro>(E=eH4a7{W!ehS*%<5XLLf`8j%4E>1?Bes-D(k9%`auCMi+
zgzxKK=Q7Wq?5<5qA2EDETCdk#U0ZJDvodMUZtXK*F^|oiH&9uxui7P}tWHRmANMgW
zHkM4t4F-!`t{D1E+Moa;>wCgBq)9nkbYn)>gX|TpWoL@>mXaWSMa)J2AX#TMmd-A`
z<?mr@Cm}_;XP~hFE7hY8gN&!rgY~omoDNlovx6TmzD?zKs$YLGHl@2`@V%Ne*YAg*
z6jcVPvVkOi6U5BcH<i;<5!D~K-exUARa)6>g%P;7a-56|QjE82UCvF7t%<QZuVNTH
zVSG0u*6hUc9Qpj+MHwYLjCSl&koY%rX3X#tjtgc}vs!ZHw%u;bZgT#dUO?p&$m@;e
zv-Re^X~|BJBl&G{sbL{}p)PR*|JaH<eDbBl>?sa{f#$hlo|cvMkEdsFs9A+A+45KJ
znp?+HUp0S9UT4Q((G9RXMr;0BR~K$(BK>a?qx(;-w~FL5y@$WfeD8iEUv*9!H!{d;
zU+i{QjrW^~ct0RI0;m*90|;_CdS2^trZjO*<!W?M2SPjW6wiI}6!7j*5M=T2@qO+y
zHzqDS=)1UMqkq&sZEi^9w{zlt;-##o%uS`xU;L$Berzty_8|yb&*u9&YkO}svewj;
zT|K;v`a9E<JFK1jYTc^^9(Q{iTl@6rdWG`^ag<aW+_c2m1vfc%W+w$aBUW|WJj&9R
za7gy>w_Tzx>#~NCkc^u8WIE6?N>i7Hr6lh1dNk)p!XU8@VXxME>y*!VetUa<e8dLo
z1fA<Iqy016sZk^{v+^;N(uvX4A9~a_Cv+cUOEPkETbOUbR)6LsesZTtUQ+4~yo5-d
zt7+9(c_`Rgit<Rga&M;7O1eoh8)Gnj$Wd&==Iy`8iqdqSd_eyAlyk^4jD5u}Z!XO+
z&D#9ZQ|hvn|5hx}u^;Z!ZN37{$23}t{1i=Bh&_9#iV$u0kYfY~Xe6a|ZQU;pESM!y
zx)-!gIY52g?ft&0`MBCtUr6Rdlq(W_YJVBoJ(20|VQNNXIjzC{a&|4(dfCM7a=obg
zcw<g93A+v5o81=Ql+tv;{<=$W(_)j}a#`(=;^-*NGP&*+eoAGmQT=6v96AX(X)0@s
zq&}a3Tkh&wy`2wE|AKC_JLdLvC%iY8BYP7mdq~BckI2n!{}BS8!%BvEvu)NyR7i5P
zz@CFSDJKvjMTzfXJ8CHDXVOoq)1Ak#&uOxyxf!dVP*y<rGQq7H#c0U8xwE};>+^uM
z+22KdVH<*mMPBh0z0zEmlV=GZ7Z~?ypV%2W!bMb!3-d_0g6*2ZxOd>j3ZTZ#nX;DB
z=>|EH041>nhLJJ|TCIg;RoeU@<|9g!d!905Z`!Y^O}7hC8uZT|%Z+*Mj{)bZ;Qp8}
z=gSig;`}fj&$r&bPN52U#gMMQecpw66xz~MRod(wc_k6_ymq;_#yy!ny@l&!F0xEg
zmTUSs2i%6F(0-TKFgV0;usY42=unhYz~xo#!9>J@rL-|ZE}P#EgTUT&<}~%ZU`eI=
z-np*lxbF*xAYmt)wT^EGkWatnn=+_-DSW!y<Q&%<3fQ{iX%f&|tw)`ZY>y*7rE;lx
z1Mvt!ye|ze3$AlJDU_Yc^;}%z)XM5^bhmatk(qr99bVfKhwh|$$cdQHm7NuJaxN&J
ziX1}D_1*d)cigTSozkKhL51F{f@wR6z!{7S!da<Q=%jiq7mKMKY&FlZ^t%%5O=diw
zvNIpMROt!rOC72JK>RiA-WO;*!3L7W!+npVN4z-`+%pQn*O?uhYA^`D^ywpY0WyNo
z2*{}m_6VxKFf)AM@Yy9_o;}zv&_Cz2zkaa)VE;NxZwFiiCwX$Lw(WFr<#AIUzHbwD
zKm&OAslHl$@35iRnCDXllD#~fV(m2Bj*1+J-^V#ITB({U8SOH=-dk}rClgqahlq8)
zR!Q%Cn}iq$$oe;9$DMm-b5zx<=q62(GO*JV3Z@}m{n?pSoF|*I4A>gLgM>D#Gwv$B
zAc-e$M^oHqtj5<~(u+7|rjGqBoB3j5VBLhdF9r)6JP1YIWw|{{&{pKlEtmc1^OFLt
z$U@vixIZjt$03ZD{q)d?G;9BI-<XzK@xs0omA+{r+Rr7Ov<f=+#(__Q)6C`<yoy^n
z-E0QJ&N|j4IiJvJY*8JdRkaHb6dl00dflT3n9FeQb$q(Gh@N;6l`m)6A7+ALpxoMN
z&PLJqGj&9xVZJID%5F|RuV}2bf@Tj?L3iji9uQl&^^a{s%E2&KN{+4}WE3wkRod3e
zW{ad?ZgNpyh>xlvu1LTE7)ZA-_(fg1{0A8Xj<&O{qKGeC2ZzdN+0Lq7$jGde)&Y5l
zw3T-coVB;Foo}vLbB;Qs(`9s(1e2E~@v>8|nKNp)v5j222IjAOMUF%VALyHOTh_(j
ziBC)-3wfv@L&!OZ`67A2AwoGR$$mRQXwWpK%8av2Olt*fqgGmwLhiPsqrYJ6-m1My
ztM+^Pe_MUk&(5)ifXFb%^HuKqdNnZ3=2)Fkx7Cq_{z7m_@_c=3O}?{}8|Q|G;pL!J
zbtA&x$eNe(Qh~lPm0}>cT$1wQho*g>y4msyw0x!e=<bK&W9DFKVn9j;mVmjFm#Zo(
z4A7lI9HT!4@=maHJ}Rm$tLieeAATExM9+`q?DDuCX5Q*}OS^dNp#PnI2@66(<!O^k
zcJ^}8<esVH2nl*%11cBI9Z)g2?kulRNk-X}Q`cxOjc#<X7&)i{(RP0!!M%>sda-kp
z)S0e3vuLN+khkVLrG*)Do7MA0_NhJT;8R3+lx+m?wQ9y4KQU0eq^zp<>par1+WMt&
z{kTwtTW`7ugB)7#lYsk@>fq_^h$#TcY;&|Ih}I+z@^=jdLoByYW~TS?ebw|u@GV;N
zBY=xO;My1-lX{J+s8T=S@Nh(a+qve62m=WkP#&ptk?7=J;E*9)Vx&;}4&!`n^FO@+
zB1Pf>l77Wm+<@g!mCK^p9l}%2HwlzCSQ5_|0TKX0)p{SS$DgDnljD@=<ga5e(BU+k
zq_XpfOq*SG{Y*A3^62XjhDKbNZ~`GKc<;2An5By#JH~q8S4+Mt3S)UC0_%C4*tyPF
zsIm3I6@fTSq&%^MuFQl97_bw5;dV+e?AXQjiF4Dxk7)#txDxNZ!2oM|>J6%*&;HVi
zB1-uH0)rQFacLh+a@C^gQcB(!doRAEWodWx?>nm8roQ&cT<xjVV=lriF&7Ov@7=0}
zQ@@w=3Wv58fCwb*alGGENh)Fz9Y+e=!F3pu<_9J$r)jZqZSd)(RW{D;fFB^q{kWJ6
zUI~Q;FAAiop}lf96cU80gi>;$IqeXkUWeaG0nlE(^>Kme`a_z|M8(~J6MatRmC$)D
z{(^e;{H_3$H(9TVJA-;IBB-Vr43URAsIFh%=`dG=8`;<Zv9yc1LaqYTF`tVo=o%7r
zQu?iPpRtE&A+RvhiWtLFa%hwA5d$n3x=!N=g@GF$uQXO`0q7nr<NlIs{ia?yKEyA?
z@Zq`C0UeQyf<`UPv4o2u8xO5iI#t{|ah)s|FSC<LlPC<gDlX~<=?Xp5?6-Gtgn>d(
zz<3F2OckWg?+-%gWKZV{D<mklQ<xPIRK=6;V_+wPX29TJNZ1q#bN`Y&DQ|;~iluE`
zStF|2?M3iSkvvG&#)-=JnU8Ro;!7z1i|u?{<=$_v!w3EL;*4o`;F$zTKR9D-wLJP9
zsW2PmWoHKx%0_nrX5*}c@aqRqH2KSB!z}Zev&LN|0nuN0BZ+(szwQYRhr0G%RK?#J
zOUfpPWL1Cnj-j-;vsF3cWG0#8RTpyeO@Hg165eNu67E8PHm4{V)rC(T^oljv@?nU9
zum2Vp_+@%@(59@x5^*VZE_?uTH4>l@F|%Tozx+gpfd!rHBFO4P|27ve$(Ljt??IK6
zk`eM&`a%Ri6m6F}!j<|FnF?aN3fWS;3p_EQ%Cn%#>XnY>LB^ThBboMr{u-KxBK;xb
zvX*As(7{<ttw2_MA`~>PyIxPon4UmXT*w-ln0;GeymhmOPY;0avh>T9zJ2SF^^a_K
zbe!)z;Ktra^~2l^>PPP+tp_}$WO3dA12mqP`q8atu;)Oc-?!Pp$K{LsHY!=Q<j|GK
z*Kdb@akws(HF?pWMSL_AdNy&e%~<b8NXao=I4kz5R5bY6Jf1r3y$gWQd=`%FCg$re
zGd@5AbdNB(opr7^zwXsyO<$DK>Ykb0zyKQB>UjRcWJ_9CNjAnqjUGd1%Iwy84}5$3
zf^ZKtR?Rm77mTS6{0RgVc-Te?bTFq9{u1x<{e?ogccyeq=#Q_8F22V5xy(0L)c2U-
zsoeXvWr?rYA>p9nItPYI(G0M^hSvE8+#UD9C;3E<YIc*IUGBnc4LtPDhFj`Av)qrJ
zEcg1+gxV+6_k>&zG8M42AS7J>hF=Q}P_f>zm}3pX&nudou9U&SMDBogjU6!3^v^!a
z^on?OTK=q~dC2_d4{`^MzutTM-OO!EH6noP9cn94@w&OY>{eV8jIDy7CQ*N9&^sM8
zyjYY^7v{#Irs9c``#O!MwW1CR&}D#umu?9%6GiB7o$IE_{3=t|gwiv@;O51`q_%Pu
ztZXci%clf2;G(eOS2<H(5=}v+Oe*~lZA$a^R(IJd6+&4s0s)v)?rD%IdDnDJTg6j2
z?$;I+J8Tf1_h7!4#fmGv>$A!X68WK3mT}JD;gd(YH7*@39oK!ay!0caO+`<;U5Pwz
zlIYFuF*1H@ami_(y!23N^bGDMZPv|WgvVV%<8lwMUk{8DC>$v$e;!LDR(Hl!Z5=rn
zi%zbUKm*EZ4w=}jGe10f*a7{GPoc-}51)8CdVW>+HHPO^5}ZA$Q<yI=n#`iznR{8d
zhVn$w&T4i7xy(QDHQcLQ=*WB2KaQIg2N5FZI&yV3!8x;V1N^wt-#HL%_(6{BEzo~6
zhL>r-MUu%L21=n;S&N*(ibFiM=%!LV6pgNLJS6KK<4Pzc(v;*o_R+q-1t!0A;e4<t
zFg-$lJQ>@b=hfPmG1Uw7DNqYNiH~Hx=M1pz)z|ZcXdc)k*eEjB&$cdPWj(jZ*YX8p
z{<1yF_^DM}Pez?~rqCioqQcAXM+&qD=%%<M;yFhWkse*JpLNhA6Q3@z@e}qZI(hC~
zKnVlmYMZOW5FEug3k)DvO+hJUCH-Rj%WT7@@g;dC2qqT$DdlvhjdUKbbV!hoi%qY!
zMBM#(Th*QkLU58HkSo57yLE>Vx!lt`%*w`H_c2kC4up5?5ph{bn{OQT{!q0ZkEhP2
z;682a<qFz#eTPOdp$!2JC~M418hr_rEmMt`zg(e_#;Wr^m8?xq7$@j6%ARh4gSlRm
z?~xfM4W@>PAWSGL&@)_pg6!cImsE+ARDuFAx@*9t|9Oo;7?~ohLN&HN{7Z~Ln5_w9
z&We<l#_?Dib3w9ckL$+pe0gg8Qk+c!K5!t$LQ1^g5Q>wTzAin3!w?$gR)@q?wayjk
z;g=5%1BY@Y)jLTowZX=5u}Zj`V}5vD?GFV*+RJfoz|G5B7dt+P_cr1olsu{;rf}!|
z*b(!Oq8E}#@rvjf!gVE&v>bd-buYwehn>e$IK6g&Jl6Z=K--nGfn3SypDWY7MO=0F
zgAS0zKQ10xJHCJ127aM}zPsLClQ^c>pyY5`S8hD4ikrP{VWqzJGP62PaQX#KxqlSU
zu1r07G4};FN}<$m*zwc)q2N@VIy}uvU4eJoc{aN(!dT%JTXYTo9@KbQPWU9w;^?5$
zS}euHAf46h-7%!+`@lyKk&qAAs!Ve{g^Ls^)3U6TItvVz3uL(HW&LfX*4Mxx#?uk(
z)9V`BcI)dCNi?4GO6M{r9<h+SH{|eryd7XQ`}&hWRhI$)DJ`lar6#+nP~HfEab&`F
zmq)Y5`Fr|BvHE-SotCnLSy%7j1GbOr9KK}ku?p!kl|1>ml^opUefhHQ?G_c1C%*Ib
zW!#<b+uZE789#C9zfnC|AChhjDr;e^MIfCYVqIVI+i#OZnQr<S?6{ci&$<F^Ju5BW
z)pMQzjUGmKN3dkF(Y~cWkXv%f9V*X=gf+m*=x5Q`-^rbKJ{JXO<qK&5n!J_iQ`XoN
z7I;=}gjP3=b0kxNnZKsA@~Bl}Snpy^#lYN^Vhqo}_0(hbG^<`3paV63NlnZqc*Z%5
zc$Jc);T;#8?Bq3E)EzlIjCd`)Df^!3u+`L^PW_o|K{dr2AlbiU9_(<00$_a+UL}Hu
z&Yc2yaF5pJAnZfmSu5=Fe|oz=KgCILDb{zi4{)U|S8p};{|5H{NNTg|8aYrse!xI`
z=_XCBW3ZSUGlcSn6QlP!dyAKn)6CORUm}$qnf3$ap(-ix!<A5`6CS_iv{xvk^b2H4
zH*HMW>ilr7LavdjJoUPus$&@*x~kHn*Q}Ux{wX=UzdRJU(8XA=UyPkoktTnvfT09q
zq=2d-|1r|G0Du7f%Bd}O>q4cziBi$!GF3WRNmp%bVX_|e(yL;VsXip77j%ihB?7kX
zYeZyrko8fzFo0@pjz-mjxtHL+8NZ518Y3NBs>oa*m0eU$`Xj$G%HWe>^%@}2Dv0)L
zkf|v*Mw1ooz-vY8Gg6JUIupA~irFfa#=5S)!z9#-b?{TY?-Zyu;Vct1=vxk8q}`Vn
zl|r39P~Iv=^VN63MjLZ%>Ff&Y&;6&us)ikxUcq@h9tLkje^u7B6=e)8%Uyp|o;!bw
zf_S|BeMKaZx&%yu`5BZ1loH)VdUnlpPHM|dsR!j35dn3<r||NP#QLff+F}Zt;5=mh
zo4r`rw_jdjnK>ZZiI3T)((yOqm$R>~qQRwivz3n9rm=e%Ikj5*v*D^8#7b=mD@pse
z%)=^wdIU)iK1+qKT#F)ANY1NyOLvHdhowkQb}=S4bC}Igq`Zw{hFS51u6icW%+XU;
zX3O$zoKuo`%Nks~Sn63}YxZOh&rN2QX6wuCNE~(7<;??-ou=|z-^3qDIk~H2|I3K!
z3c2c?@J{Rqif6~mgl#L<>w(!VTOD|K`<D(UEvy+n$Wl%xtmbg~?y^Qs&K9-x?lZ2j
zMw6=*w_(DniF(iXE8-xmDm1ps7RNbXADf*|whXVO|BtVCjE*eox`ivYZFlUBZL?$B
zwrx8d+qTV)ZKq?~$xT1cd*A#0`hL`?8dc}i-eaA$Hs+dp&AOKE9AqxflN?)VNHad4
zlf9!YmdwB2kB^TQlkIuI#4Wi7MM>`-`#sjW%w-4R{sXs<s)g3Jl5Z;Y<&eAiVj?n7
z%;uR{&7+$V+olh{Y!rG<0z+nM0SjaeV?Qh=J^v~~2?R<Ew6J)#f*H*S);(dK8af0>
zFJ_}rpMK**ZYi0`v!bOg)uu70O7OiSs$EAhAlQN=f%>v36{KO{Vc@mEDwDgZD@%B{
zvU^rirb7>q_##fAxumUZ0z}j<Cw0SXcn)PzJ4C{Ezq&1ul@3Gdm)a^5@t{q?sFB$y
z3Bez>eXW}_N?X_-Sa0r|On!JopGpHEb8YcKKj`{uRbA86sRj}8ZmnF?bJlLsO_#4{
zb6G!s>fCsGXeZU#wUON>w9;d|ydVK)z>Y!u=aM3x@Tbz*=+CxP%RlI%Urs;bQd}!X
zgAbmxvz$lz1Fqm_PHZ2&t}Fs&LAn?*Ucd)l_vKPp#|bosm3KmbMb`YXHVmtitUM8<
zstTBIVi;W>jm@bemk)&K3H1z~qYIn@(6QXzzuv+DXKd~SCJaX>$^^@dQ&gSE10R>)
zu=V9c;fA4vyLuPK1BjPXRqEE-Wm>W_ZD*HVi|zF|-xHUeS??puCP5Aj@SMbCO;77^
z#p53~g8*IKRd=Q`uj9kSG8OW_X9m+2|8UF-^l}4Z?7UaM&azDDOmU6Fk-jc-fZMIg
zmRr5xq34%D0zbq^bF!+2n+DR381_9?Apsn?+-HV_2PQ1TalEgeqd#d#){`2g@NW0s
zU$%!|x^vN)a>3rW&9PeT*pH1~17#|v9>sk>xgifP9D-re3m6^u<FK%i1xz3)Ao&B$
zYw1s$8?cx0J23Qa!7bWkE>~J@c?KoPo}X;Fgt~hjm{kU>33W`R?Y?&rf4|n)yeB56
zlrXe%N+?c6M<)L*`HeHPep@!CDPxDZvfn_F^X?9EVaje|Qe+ECRMS=i5fi_wP1Tq6
zjRR(mGeE!=P?as!-F9&wxKeo=oRnDrm78{?77NW_FvTN2_uu%W!L!^4)!7?kv~Ska
zSS~)oMS}&VYFOIS5L*lOHWu^!R!;>xIxqXfflS5a%Wczk`@~yA0`=pD{SNO`^#hIY
zq{rps3P@ziWonnV7r%EDFhATDug<GvgN!Fde0c+#@AcKmUasMlR+rvr*V)oiBaG(#
zO+(F9^tmaYT$9Bj+?FgVOBpkxyFj(zI8!uBY%;FP&H|OX`j1o~Tmy3E;2W6WEt1jV
zp7d-Tk`iS%9NTt%6P;-!Oj(L_RxXsVtr>GWqd{ROzqZQY$U4VJumucY|EvKYwYB$z
zIQGclX^f63u>%*53(vO3c03Q2R~3Xn_(ub}8<%5sn-zAd(x(l7W@~z4;E=NRvR|4~
z8?kY$y21|7N1Q2L2uMP~cD^YH$Y^kPR7ZQd<Hq6*Sb08GF41j-x)SOE78~+QoT<+B
zLc5iEBJae){94y{eqdD`Scg)8XEA6$T2=Gda0VOm?WYiyPx)(~wbrAFhl_Bcn#qcn
z(;J#Rxt=3Bgo`hwhwUafEGWL~lRt8-qkwBy8JpJW*yRw}2%3+-ZY1R!CUP>>k}}n=
z7olT@Jx@Nzv!nh!`0M5>dCP23z|Dz^8}>g6xvSA_8fD^vAx_7P_%Tic_jQdQ-=G1+
zpJb4FWKG{Hh2UK`vZcF`_v09gOLjCqOJ6<P&K)O{E6yYhY|7N*VL@`y*#yQu7r&VA
z^0x@LzyZQnWWSvfhN=Z?_FAdfE3U_mA9~p~ug;CsUmT`vAue191{OxRCYjClz<bA8
zk8~M#jGO`(`+Fs!|D4-;ZXOv<mCha4Y9A$M5Q>6!-wUOlY%NBbnD}NaM^%Bpv@bQd
zL?p2+sl$+!s}x%|#oKBP(RV8zCvWDzqC*0VX&;+bE%kuBykw2Js&3gUKp~^=kZS+{
zqcM_K%BruiX}3?qgOwJeaV}K{bXf>(DQgZ|IthCh@LA$*yJlt2>A}cjfK)s+iiRr_
zn*k}YUbUSw@g&fe8tmyxE4_UM*uuI%h?oC?i76d-PV~8yIvb}A`hE%?<^K6!t%7L3
z`R_UJ@rN<JZ8x9ze9NTDudJpcP*M0(3}UPCM4;Y^GZF1xge%VKZ2dK<hH*VexToS$
z6M(!gaT6kB1QeowNSVyVBl)2g%A(zPkCrpVNU^n6Pv6}L)@`a!T?bJ?Eyict^Xgwu
zUILE1hTZ88m7#1d_>Ga(rfhF;E#_gs=HACaq^8&1N_9QX7UtZ=*5(x2T2VqEgd_tg
z(}b}6JU%DAsE(Jh+~1zh`FM}-$;(zQf^c{S0K`&OooSm8(Ta5q1p@XvdfczCh9d}(
z#|ii^=M<2dn*@<yyMiwXwIfrIBTNg(tKLuDpdykVC~CB_c*IqF!~|~YvNt417*IUL
zFeE4vx5Q<G8|B2{nfP0c_veVzT<6G6M8c%jnZ_5b*?ny^Kpw<1kInMTEg-iZ=Dueo
z2kz1BHl;foJ0@QVlLNtYf#MP@aD?xpbeDUa4dPKhYB}LDm68G?Kw0d*_q({w7V(4-
zNAj(d&Hk=~H*0<cD#}vkzSFwSg1~>}F1ee_7eDGd&ly1EwMjt?lK2GTN!;tZYVf<L
zJL5CcqdYvtaw#Q3=SlCEgE9RyR>se$`2z$gf+qle7$$2#jB_<rXJlt*iBFQhEu&b0
zOwc?kppE&XU@S6p;Px#JMJ*$e@>oZ-zH|3HBKmRzRCE_V2LU!bb^$=wCpg?%wr}?k
zjzTkulI2?-4UffSyd;Jv#Y)9tXcs&KstEOV552*(AsuHeK#sh;+$IWHOkHF9RQr_^
z)I!U-X*cZk&&PpR8e{;(`(@YkWf>H<^c8B1!eul7uh4$=Nk9Vq_*_$n4u<=|AvVs<
zWB1ctb%W5EPMZ6DBJ7gl%g@o}rtGXjadpG2I(cL2dH92l1Mh~xKY`C>bACn0fPgOl
z;&};9-QRv|8V@9W&S-$=SA@SGRgvB-FBrfoG4H-`^y5Z~=<6A|1dQ5YTa<V;$1BpJ
zhDla$C^)G=vjl@LX&osvkN_i{_GI;#=J*OsL2WDyfYHJtpnH%oSI6PUB^PyY2yFSV
zz@u~bkx7;RD-w^Jwsi+(p{1hyQZ#&~WvijscY2X=*=*s-%KRxb8V9^Jn5zkMBVZ(@
z@k%9G?;7vU<7c-a&u0u)-^$D4q2fcWDNnnJ6dCwL#)_L_7&v_P2HfKW4_L_<<zs-%
zc8yt(?U#6&(b{k_&3EmCsMrVdekB5I0^kMI<+1;)_M(~jK}30)csmG<U!t`iG(4-N
ze9YckO@1@H4Z-dVmas`@K8SjBX-t;{)|~|@<WWd)6@TF44rPaL=VEy)ba*?bh;-PP
z6^P?tioYu>=}yO-@6!drd7GZXs6qDvY<AI-8Saa>WUeAkJ>~gw>2P5EChnH)FQwjO
ziSiRe3DvNu%YvRDPq**$^UMk1kQD0P?mg|)S@>>3litC^0MQXv*4Isdus<V1+3WSX
z**Q>iLgM0P15M6a(*T+mTwYSr(k!^7<oZ2mw+F&UEuECr_nP;@kR(AkQvgj4-XDQp
zR3abXqM^#2C{GJ#sQ%F-=Y8Aat%wf3Xm7KyuyT;oOr`jMdQcWeA%Qd8rgEt``wTQe
zL?`&$a&Yg*TV)Ftj_yYRtRolMf;%>qtRQ`1)t8-^^ow=5kBZ6iJ;3x=M=@x~YC~5i
z?kkv1YuDaU&N$9zm0T(psRkBoK}Z-y13nuFzqidpwZ(n*0mj;~f3S~XR9q!xaOI>e
zJvMQE{b!H}NEc28jDG8@$F^UyaD~3s<c66{e8h)IvMq(s_F2F_&i3?UhfRIhhcOow
zfWLW+HOyY21Rs;QFH4x8u43Opt&V5fSj$=Yu4jF#3Hb5qa=P<?BvK~&zo^Y2+EFHu
zu+_Sz`ElEyJSRB!o6TA~sfS40Wplc~_EBm!7<O&jb1&EY`~3hCTLNw#^<_fcWe=Bx
zf2eT3pmOB|)RFSY=SDxt8=Ea1os@Ah;eZ$`o<Y7*?~sy_*OmRl));&pbR7OJH(R8s
z3F{Y^c{gIMVjor!pHxxOV|!-y7=Vi+aTb#d?=NiU9CVKUq<bYwE)fhcApFRi8gFae
z0xa_T5lXs6BL{S88`9T|{e>(Nh+rFS`yJf~xFQk^3v+<5mDd8aVQDBgLp9yaDPk}$
zJ|+az+c+I-4LEZt4zFgli3%YkzYof))Fz^x8<8uvZl;}7JlFV6Qm%JcSc}q%T|6G)
z>+)T79W8%h-yG^Lb{+C~IrDF=f4xxEggdvF)-ex@o(z@>2>50G^uFwgpasM6UG<uS
zSNi(cfbl%+zP?G9+uu@iB-Weg$w|A+>N1+8f}5tGh}G;cJh@G5uu-o&+%MVI@Gj(a
zI(`?!KQ>u+dXu!CCZgD_Tw1GR_axtZ>V2l$I=;PDmh)|EeHo%C%07r#sLIelRU+n8
z1t#@8+V0S>;dWSPpgdX4(LGLhed;zun`jvyt+2`1{Izy-ZP_uI?pCzmXeeT4Ws6tO
zYLw}-T$pcTmM^XlSYWn65d%QxRfL2&02}|CSoL)4PBwRpKF_B!8OeklSs=(BjXh|L
zCvD$&CtO~mA8o9}#n&9;nnoMdiX!&ta45$mQy>U8&bgq5Q*V{1nCRq9w-|j!dQ@!J
z;ScU+F0?${&}}%|0!c#fL(J6yUAjH0;HR#vHPtrw)a*m#PH<UeHTYnvuq<($n!Ea0
zZrZd3;ou}n)jB&cq)g)6uf9bO6(^$i!DWXHL&4?H`@W8YeB2cdr@kQk)17Spbn8l+
zfH=3<()Hf6^J^^rHPeEUEYm7I1y@MJ9AbAaH)paiBpn~_BM24hwn)c;ZPfP(<f|em
z|I*Kx#jIJ=UST3qP)MYFAHx#91nd03OXR!x*3DF>?%&X8G~TJ;vQ$z6Sf(sC6qZ>I
z744v8I+@XQfrEwa4gx@fdiheRbBgI-r2;vIHE317j`-q1KTodn<~8M(U93~)KJ{d1
zz1~A}5w5P9Y}8KVGH69q+(NMg?;>+_ZJK~mK!R&*;C%E2Vy^}wePoW}K|pFwLH;&P
z&wTSQ{_b*S<(}aHMs*U4A(GWE{#aT>ko6va%!tj_r8Sj}kR2LgdZ{0iL3wT81w-IO
zoHVgWZL`Yx7T(>eJ`mV8zrn$H+96NA9S?>$00{koYJ4#*wtr=~D~8nQ?=;Sgx8H)$
zqh7LA%v<s}In34wTxrjL#E$OOuxXx25C5_6ElWj49Z?1{j!0@#P;I$SPFIgC=y?%-
zx<PMSp9mZOu*#vO<0As%-|XHahy<x|uXv-DieSUv?*j?A>RdG2&hDVnT?BVmHo162
z=L;Pk1>8O^<C?Lf7K_)6wMMX4xP@enDUXoYcJb{xYtO#Yq@_7wINQutZZPNB7XXVs
zFg)TTF<928))YNXo;CE)+iinY+(@biP_^%}Txp<;QNeq@>A0K<P)Kk#*1ei#aos9k
zsz?7DdItUtJy;YggSS6m>`Q)<r+W8@wYn!<3h=qB;s?CV)$zz*XEdq~NQpe|pPw1E
z>$PA0xwJCHu4(K$M(AN`c3@7WgRD$i?8wC18WfX5+*4^dH?X#!;gOF?fLBRZKg{8_
z2(g>>CiNsZ@+UPYG^s>ohF&~B8)c*UhUoWt45rX^G!b$>r|b(%FdC$h+M@{Fdvdxv
zRyVB%h4+dfyIB~9=jjF@|0Mo;Y8>sRtK6s@q6u@6Aa-c?I(%!BOe;6E(}o^vpN)5f
zTfPv-GIc$~zBCQi^?tb64d!|6`E3qy&OtDNU*WlbF>>W*lc476G%2OJ@i<s~I2ooR
zgzo*c*jk)(NdIEM`}~UKkMX4lmdksQY>x7mO~-pD-1zRHl>7Z`K9$bR<s0Abklep5
zhjWchSH2x?XyLoteLyYcXg=8QsCGLJ#I^32MzdEjzfjAZgy4H&`nX;1Z}xfD%+|J?
zPVZHiUeHnEH=WXUlL<m9rI%EHdX0|dd3f3Nu<leG!~#gyd6Vd`Iv2i2RT*9$htv-(
z9p1%F32vVO;na-9A$XA<8RytUfBqWkqxGFiUZOihpE`>`M5l-C!~>|o(aWX$@`;bk
zumLUCw%i^b)JY85>H@^9{dAv(ZfmV}S4{s%*<_MA_KBZqKme%8)xLkE$IPj@N@S4b
zT}kJ?S@lkhw~TT1So%=O(d|C+Hm+-ZYf~&3H!R5geP1erp-y`876aFj^_&2z*&T^x
z@j&^`OS!32*!m`n$YJcg!tf*j_^I~6IHDn@xvEV$<YavaK&nyOr@#R=2P`L*<<)pv
znjb#q`%*t|n20Q(qYM0k)|@zE8$qU`UDAn64`#O*&&@Q&O3Pd7*L;+GlhB$Je(j*6
zgy%?5%4ZN?Y0+77KNox_oidaEA;nZx<;Z_2J|)L~Lf#Yv^8zaNMjSN`lq<!z8UkRm
z1v=P{@64;<8?_^goCXz3y(fjrRL>*3uR?m)@u84_G}D~VMv9^<_7y*tTMF;KhBukH
zZsV!t)08uQg>GH^tS|Fj@RX9H#RH?)K!(-1^Yvz0S^^}cq9;(!lbD1k`lS}D`abjb
zo$;y3;VDmPq;RAT@%UISz^EcBZAwn}{$DPD=9fmo!*NCvTn0U*ahphg<@e|Sf#`=;
zq(a|uHJCs^`=D{0eBry1;o>bi0kRyz&7KX+fT7t^&CGTY_zm}hDN!i?1%JLl6FWTK
z%kJX3-<=)I)cm-tYOAra-B9eaw8+l<c9^o`7X+8?1mLEJj_yAl4{Zti7jf2<vlXn>
z$Wv5$WuE4j3U9v@R5#bm+c5w-ni@U6kwuD2Gt5XKyekJoK<7rHo9Sd6IbMoBwR;5Z
z_0kFf5qdLE5diU>0x4k4_K~4|#qG&Mn?I^`rY%30;9!&+m`poWDc{a&?S4%kqFOwS
zxRj~==1^%hz&t<jT8Dmn!f7iWoqG14KBqqlON}l`tO0-(VrO^9wArz|wS^~RD^-~)
zqXgL`N^GTSosLS2extykixq{|^)sHx7mN_K*JF~sFwz-&6h^40ZDaW6^BICQSdH_r
z-%1r+BXB9x^)ZkibVvrxQtnmE6t4A1j@T8jc?zjejDU$wqrjv`l!|)o+BWq&QnLia
z{UJvmTc1!>&EnG)qs_Q~>zNI$0lfdNXF?#jcYqMwb_gKo*RIGulFmw}u;lRUdwgDT
z48r;bx*K2(=x^qX+q<<nT@VMND-v&;g~?BOV4wWHZ}fKrgA7+M&G}5)p?ya{!t=_q
zdF?PLoObu4ibfyquIYJaB<g)eh<3|6G<nt88#I0`V^ioVDYn}^sKZBh>jlB!{#JX%
zHKN)8?)bYKcQ`m5DNK$8jLa<>Hebin!@%`qci@FqOc?`y#?F3v=Uz25fQayY8-A;w
zHg8nj;5sDY-q~XJQRbA$brzuu)Q&Tn){nu3G#4z{)0VL!=OduQO8%_}N-W0$hFe)H
zPtEE^52s}`hI=H@_l)%0gDUE^6~BG|J3MYQ+;1BQLf}bw2`(@8UDz03tu|jiT#Gw`
zV+x`iLi-R`imiU876nKmNKF}r{U#R$0HAdmE+n3=2SD(z{UGReo@MfF79PTFUT^*e
z%h25WLw1QDpThwhIOtzxBsHD4Dml^;i)fW_T{v!7`+xP>%K%Ahml0{o`iRjz(a3B6
zMt=OZs9m0Bn<~cXg`R8a1$#yL!}aKY{{26X=$kw!{YVwy$r|1f|Nblg;gIA%ruc6B
ze}4YgkN@}a7olJ-KHWcKv2zi+`F}Ed^6+#|{kOAbxjv+|IJ2HwU8dE$K&HLx7<l9a
z#QkpBy3n%1&pEcXvXEcDuyKFtvYo(dw4^C7=gjXT^Ksh6)0xwht^ApASsr1Do|EyG
zCiGM@p9JfdKmho~2<uY9cd4IqX&$>UMxRTb&b4xR?D_jbMmeoywD&Ow;itmz(3MzW
zQ1{GC*932t<=CN7ZuU+%jKDh;*I3fid+7Ux;^1E&{|&}{!fVmd^MddB#pl38sk6Py
zc+eTU`9(N2HN`?Fy}qo!r^W5db=d{IEZe_g!=4?H*zDN1m_L2+d<>stE0%HyV_(XL
z?+Gs_!*9VPOEE@a_0vZav>nE?VtU&wsPOE17x(X_$mNTpX<Q;3RwU`G1JMFa$@`y!
zJ6S<+<nOZFB=sl<Q7(DQFZSjPP;lU2P`5(iI8VbULL&=W+B=1sk{-O4+7SFZH1^lR
ziVZ@%Nkh9r@5F>T14lta!uGcxjYi?ts_7)oVmoGxHwM_qKnD9PtK3hjl;l!p%t*sX
z?GkLr1}5w1l0_<2`{jm32KjWmR{QD%k}t%t-a)(rU*t~7*q?dhOH=pG7Y8ErhyoOj
z1N(;G8P$_Qh|KUe=ql6bX^aF_4g$j`zOaS{$7sjpN2mbPQ&Cx=(}Kry#UtJeXEJmd
zQCX&~QNWFe7is0AV?e%5>R#0<dmTJimb<$UMpPl<v0wM+N)-i3A0W%62GLKw!EQ)z
z@YQco|4OCv6U5<coxfw`;CTlcwQ|t8X9tzUyL~77jG+uhnA)XsV4N>sp7Ub>sNv?&
zSnU<Do7%i!y;+l^-i6ThXSOFS0<ECK<ct2Etg0O``OLMF%Q3fCuv{2A@w@ydPtDPH
zWjDGg>Z7ra9^tS-2WWa!+4fY3%pQ&9&s>sO2~hXj7&)UmFgrdhGNk2jAu(i2@bUMI
zaUD`KKzI}(hq~7O(XQdQ42TGqtBCn&TQu{3X|_3E$<R~kL5>@d*_s>I&uR#6H23e(
zZxR0=dvQeFwVA&OGDPQ4-=E8Axtr?5N(lLDalaGEW=nxdUD>F4ky#|zFFPc0FdLWh
zg^=?O@k3Fs-~3^XD0AJ(u3o8!ryfUKMrio4FT+#)0_$9*j-L>uTEpH&LlLsKDi&un
z)UusNhkZvsqzS%Ji`yi#jUB*f%4<Wg^0+frr5tMih3xeV$o}Nhy89tH6?(GxHDkHw
zLlWkH*XT4g{b7$a#x{O{FYA$8b?ZM1$&s;67j|~=@DVIPB5|Sdw!M8fEJo)GPNcC<
z4wav^r_VKd`ZjxAr<5~n^{zFt3i74&=^^W>fWXGRGb<4*+bp-CYV&Zt3WC3`3NkNm
zKQXx=KMgaF6n`vfO}qkX$yz>D_F+O?-3gDR+<F9aG{y$U#Mz1jv95V($tT<lXAall
zzm#`vP9rYZ4~=V92PcLRBhu1e57Q*1;l26hKzefXN$h10Oel_Vy(cWK5ltWkL}<m%
z+leRe@chOg`o!&Rbg%?oD&1Gmv$KEFN`@3UKNXmy1A8r4)b?Up^C_5<Cg}DvEIQRX
z^_Ob>u*!e<c$h$de+<{ko2&7y2J6kpxQqu9&-xyMcq$Ftmw7nEk}Uyv9)oF05Kv^^
z_~FL_e}%zgIAA+wzT5T>JDY)=giF^*sLe2OppbN-+g&sVef3{mdJ!wWKW|`2fO{u9
zojNjKQ7W1_xz32|Kp^?3k{fwTO0Is~cL#_%lL3oe5OG{o6x*YnSpQVxn>$g=n<qRy
zLI5-yq`Z|mJ%<(B<M~(?4(Ol^;J{eEU!y!$E|FRE{4v<x9i&e<2Ib#N_FT!UIk^4B
zwE_7q8sSY}(AVderka$aBjqAazhG1-9lzEB|8NSt$Z5POzY~(+wSEZBcN@iX(aK6<
zN8=rA@7y&c@g#q@{3vslVd26#_olAB?BV|L%b|*EHzMI!s#I-6(Z`Z1_-9<<s(t$F
z9N@a3XPjlriC+%e%s|BC$<g?@lYff)%`kLw4W69~*qIjvGzP;{E?=Mz(0l5(XyZPj
zil@`4c*F5c3Pr(tj@m*6h<7^Bb2a8Kwn*Yj%nBxZWo77~GCUx8Ocx^A2LW$PR5Yj$
zA35k7@3)!?KnD%Ji?LDgZ{4?Q8AAYSpxVP7<6n|^y7<5MR5lc1oW`2+2g#nf`Kom5
z@i^=iW-*4*MR`uW)`Cj7c`iELk&D6e$JK*AO1#(ET53go=u<+KNi-spf)7GYziiE`
zT%s;o<*4dgqZe0igP=F$n{5tSYc|S9P4}cA=#UL94tg-g(Nq8oa3~{R1hj7}-Hsh0
ze#QLp7N3>p>ntYA0E+&@(~wx9K8U$3Z7O!l8`$a>Tw|zqOJh6~`=mB~c*OyA_v*Yj
zPwLac@1x5DG{v-~)5dMotKl+H(Tg0aeMt5n4Xs52>kx*MCDA=PpP*Zlmc7s<C3+gZ
z_b~!tY!tl{YM;nkd`r)%@gVk3R#6c^P5NJ~ogcLD89@9PA;GQ&UgXEt;;Z5NNWYW(
z(n;KIXss5}^`o`zjA7xuqP$H@?fc2x+-UX&^g-3|9<2t}sqG8<`qHm&6{F17c5Xfe
zy%gNqFI>AIpC$+W^sYGzlUtZ12(DNkL+qdy(Z4HyVNR-Ih>uc&3F;A6J#*Zl-~So;
z@{at1^|y6Y>J9SgWvn#k4>7#*P=XsMynJp$g)L<d(d`}xd8m~$D-bQ%@PMvY*`JPN
zd~xXX#WYTrp~>aCY=y=k@9mAx2zcTh*)D?ffsN&fq-<(^FfUa9j%v{EPPn(!-FWLb
zv>t1t5Q5_A-l)D~Yyd!6<oQ5|#<IOm0QWAp_C=(v9v=`TG|1Q@&zOVv;@^Nc=U&PF
zL&wG{*}c!9Y%RyBLjrO%`Kf9TPHg(L;aisFw;`fz2d)l=c-Y|Np(x2Yw-97YZ6|GI
zai$d0EJW^J(t@$lrQu0O>m)d1kW2ax*e(p5obLjvTKcxwn8SCz$>Wy#=hFM+VTSt$
zGBu-%Q(A~*gOKr`rO)BZEfhkho{@%EdBemmM!{CBvs0;1LIlK`ISFGlRQJHSL_bd$
z8T)b2I{r@V*V<zW$!ivwYZcjA|3CJglBR?;0XFUcj8E#grCwOkO+irnr`IO3i9TS5
zMHH7gwq7fxEuJJvIL0a&<a^seMIsWB)T2CC0i$r1<SdkiBYA6`h=bciwl>BVF{g^T
z>=Tu|YW|F9urgW&3oyfsh85nlwb3OrBSxx=L#UTrwt+7obz&C?){2`xYjMyLD=<_@
z+I0aUm&W{P+;KeI>mxFM$dGnGF&)VrGu=nD|Es0ZBgcEs)nab|OR{A`=lag%Uq7v|
zbQB`4*_CRHArw{&RS=A{<+Z7}#Ge}>rr0bGrhAl)!2*jqLX+E`NMlOYFnWze;dChk
z(urgGY$^p^J^sz<kKk1qLSJw@fH#|=#<&>$KGDD;CSVx;|HEFBSp45mE|NAM;fhWc
z@(!5sWzs*X94@9!<RItCJM$6ZxTJ2Ox=mZIO?vv98yZBUdK0b7Kp6(#nsVDU=bx3n
zM3O|IIG&U2-7$QQofI^Q6dFwuoU{IPp*W&0734g5RGQ?v(NGT`!9KPjKlCq>lm10=
zdDNOQ`uyW%9C1oFHoz;>xG2gwhnNenycIC0#eIiU31GjKOqW7vsP2Vi_Sp_PXHvs_
z2Z>u#a)!nViAC>q!X57krbSha8mX^teNi`B5V{_iksW=;<4d!@!gU(&J<HL5<$iyn
zn$Q8KEgE{>g-p5`_Q`Df`q7Et5xhU0V^<1Jbn}}Tihz7)c!=Es#OnE3=AD?>j1V7t
zQ?x~4|GMuX&hdJclMvNV^F5jl_NvEE*0lXTu=SoL(<KZ3VW`n2E{3>cXpqX`C%V&c
z$Crrg*(y3?z9)bRAs70X3z^7$MJp<iUy0jkT^?Zt=4ST_fVf`VPu<MwDZ=ct5<|H^
zGYx^$xcOZu1%rUcZ${ATg$!EeHw#E4!B7vufDeosi;gdjH$mUs^3JQAJVun54d{9_
zMhjbtEowIyVaQ&Z2<Am}Bi=I&g7SBHx6vw#>f{I-(PNe{GIGai5-7*gZt1Pt1T7md
zzyC1l*qR)^#r`-+qU#1~0x&L3Y3UK_(SV5=-GMS;-6Sz;7rS3ns}VrT+nR>9B~H#~
z5GtdkRI%uF=rKSD0j9yp?SGbM!}Qu-l~$+w@0Lc39sqyewKkvI1h0Us-ek#Bx;{cs
zK#oG^HN5gkpzg}bBFK6OlNW&W$YUchwnaLgh}K=pW?%$~4<nGaxZhYjE!yW)Dp-e=
zKU4CUf`P7~9p0sX2Om|ZNSy%@r=HypghK0o(zF0G#9hu)(x!a*s8`nm@ozzG4z{fw
zD<^*w=f}3G&K849oX2jJi&fRT$2iOCck%^ZV}@B8_SGTf3W<1WdcIvNp%lYy*yi$3
zfbLWz3iW|pyYn#aIeulTbbG?$To0=fTksf>*r?UhoS545EyZpV>kVFwC2@0D9ctnE
zd@&1h=Vbig-S@NKSFAlxCMWiD<=MJOg3qgVMm)D%mP)O(zQ%DR@>INkaY6o1bN7tW
zMw0na5PCyv0|nT!QQ-ufNKL*KOnIk+p}$(7PMe9?<^Flt^eJPo>V@G8Ig&f&17ClP
z?cS14f9=#DMShA|#MBXnieyT@NnT|H#>Ejp9DwJ=Lv&!Z3?Typ&e`Jb%*y?L<Ffo_
zHJj|}Jv=6Z5`H3HG9)sOwb{|#&>in`RP|e?c19xlJKa5~Lk*7`(fM=%@nj|?qQnz8
z&MOv(s@+^46Tu#_ftX~Ej=Epta9LHESk7b-t1it2BId(+8~xi#%!{M>(z>Hr(G^pw
zd+0>Ogy(QFSQiVOI~0`~P&qZE%C@sD(Q0bBpJQ~{mqX6r!RcY7zX+ZLKPaV*NK7o3
zEEsVK#m~ruhvrH1Y|Zkh?(eMT4XZmfpdD!U<-&j!`duH&2+__2Y{c)Z+OHdujaIZ6
z4&X!G>w1^*TQ_Eie&8+2v#O|^*$jj6K{SeOcOQ+ynn~|8w4<g!eEZsvXlFYeo21jP
zo$46ny1(k0&)*WgAcSbDCQJAH4;SRy5GH1ERY1W2%Q8tP^b=2@wlkoX5<z!66z6sK
z6Hkxd8XW%vC}(2WP^`|AG-SbW_eh3(EvbhLlLw)o>t-`j%>&cAoxM&;a8!@@ha*Q&
z2w3hVo62e<*IK6-T^2QKBh_{(ZL%XySPOj+fQTD1g!HsYl2sH@sWDxOYl}!oumrMe
z_?NFQAkGTV+PCnyy>uBTbrjYo6jqyP$)dm$jwK#PlC0FUMuCI{duP!m8DItgsPvX|
zJV=3Vf+e4%#Sh+tPA4=lp~{Ulu~aYFHgSBD+G6sqZ@{Sj%XDJ>Nw1vM%sA-mkxZ$$
z9+#i1ijliSIhM*PVr%)*u1sw&`C1Y^uFxL;r^`%>m~!P$n|OXG(%<nH5gSj*CmqT;
z=OQ3bu#Ps^+<+_^bdUQy-u7YZiR!>;)k6Cbuy*(fkfax_hEUDn837oPuSFVHj0$Im
zzBJ4*ReqB3wn5qhJuS-$p`86n-V%G#K6*guQf^|*H#u{;?L=fCP)~<em0j<Og9yx&
z;*|a0B6EBr*JcpRn9G5{l#JIhoD!D_1PRD*6$pAxXZ8hmU`$5Jyti{+#vlnp&R2%2
z+OkFZu+pvHWk+;`{{j0%FTZ-b$$;H$3r8{jP)uzjUtEB^$!HXO?!iXe4RzXWHQRj{
zB@Ujf^c-vBh9lj29*p|eK|`d1kfF}<kEshx->lm$Jgc`a?qfj)Zp0Tpk}ioe*~|W|
z7tEiaI-0W%)%vE0!ic>lAQYf7Dj|@zxxkCqYKc8?o`(j#cE6hoWZ{m0x<|jx?s=G^
zfg5+@QZPh>rMtmm;ro|juSIn3YEbA0%(yN;QCQh4$5*K1bV6mt6c!m%{nsiKz=Yi_
z6ZI&DLw5dNjV9?ceG_uoV;r0=z&_xAia(4}b*`ZxY=y=5Uey?AHZ|Ku|6aqP0nsfS
zK+4M>0zQTD_e%?dXGm?j4sr1*U#u=Ys0>gid<94B$rh$LXlB4h?>9p{ZD=j*<9;uR
zBq@$hzqsAv*`VtCX0qEx0lT)XM#=MqfhMr7qvV?x@=^Kh(k`QiVITnwC~Yp3Rhi%X
z>PbvG)}QIqsT9;+-?w;EAsKxD@Ph#eMTvnABbw`6Lv@TJl-!C+RWY)cD92OTC2Xa>
z9gNCe@!P>H$Bjf(usKpNUF<z+qTvKyj%*0>fPbg0v%e2O1yirP1Bb|47zPi))n%sQ
zAMy;(%@DSYP0l6kZ4%h*RWj+S{B8KCZG0gkvPX~3p?ArO9lLN?dvYi{bmpjQal5&Y
zQA%dZSy`StojGDJo1TCL1msGPqtX0xvjdT?F!)+jj`J7X_yCs(&M9;y_X8%jFdTb<
z)tHSDb^qz9p`^!{sUvI^8x3f{cDTW|a1vc=46d!5P8OQnF)te@G^tKwVx6!gnU2D7
zP;;A5e1h$A0?{wzHK@}4getfoG}6+)SQ~d7c&Qm>x2p%GyAC?b-8ajWSDSgwU(<m*
zV79rnjUq39Vu)d!x)~5#JEFq^?fuL&s196E)AOE!<1;^L7EahRcEC_mxG2)fHUsD7
zHL!h2vN1z8b$9>JPSOX@12#B;#C(L&L;pZpfP#g=|KKsg`Hf~mxI)kgim(9%_=(t!
zdT7z;NVTQ5>nIrDpSt%XrCCwu8%dQB^!K9nDL}SA4`p(N%2x^wav`r6(`4j#*gwLN
z5xmW=3qL{BAxxRmU!^n3;GNFsWJjHG%Zck)5_=Gd8@9*OwDuMMLOQ@<0XBOD$*d5R
z>{th{WoJpbWZ}m!y9!4<ri`BRj1S_1EjvqqX<_pk)St->_|dbX4^Pdn?&6^rNU{4h
z{nT6-B4P#3*tN&jwQlR*c$`gJ+k^r_6l-44awuJN_KGknG54qa^PI*n7Wpk8z1k-k
z>W}dFETUnM22J~*hCEWM+xTybRh@;HeVe5{{>dDk3mg3T?I0eUe?`2<b;VrB#UeNQ
zWezS8T<v&=TrPXt7oW9!g?X>*Gxx-Z>5x67F+_hP{1s6QZywJ$_zzbm(cWg)<WIQD
za%D$VlwgA_mBzoRdOUKi6*lZsk|zg@(vD8bFB{Uv3PWWt1cac%3Pu{FMr%K$!)LAz
z&%VXpg{^qB(}}tP*ZS+&3*Ml}f)bijq98~>74gNd@#;#Y$>FJvQ!{&ph;414UAx&E
zn+Uc$WDKjanEJvqQU0}EtHgb;lvo!+M`WnQ@=qMC)iN@A2mg7Oe2M2`wtZnTEwzMv
zAG6sVhxLd}G_up;Skg;nc^%ym4!r#my07+v1Q?cc?Zwv}VTJ<4b1*;ue4|LH9m;uA
zsjWm_(57#}by#8%G!__(A722dQmG;p@dBu)c7;7otF**-VZxxM-nJt9imgDQIChZf
zD8V&J?soJg^ntWJ2L2#+h>F9;=Uaz&dnB7rgt@BGQsHgc>k_jSAw5VT(zuN1$EyC5
z_Z@`4%NEIcw0i217*CB<=6@C^ONO1|)tvAuPevtrKUxg7$465adW>0>q{Lx^G0caG
zR0LtZDLWZb0D42RWWiLVg)h0be0+d3$Vu5!@nH0NC1OBsL7Ya!RLrfSa4d4Clhu*F
z4b;(Q3FOv~Y*)nrrPHL;<rFiVw;4nvWr&{yd2=lI@02#)azxa|Lui6t2nJvA${gw8
z9Qn&*cg#pjQsUxz=IZcTzXR=AykSPai9xCK@}<fbYLwK~sC!~ieU>;=VVrU`QkhD9
zk_t6bmR0j)kU}>3Ay)23C6yc}3Q6?yg0>KTZ{JE)y%r<T+9l8_qzmNZWK9?TDT8;*
zclclV-X#gNJ?t&i(INBl1Pkv(MVajh5^^Y4h`@<qHZZP7Y2e8nd>g$lKhIcST1QP)
zCgt9Vl2uQB=*krkD>x|OX#XRjTxwKUE?uPjuNS7=NK)sAC|or;L>uT_BS`fnOwVQo
zf#$szR{Y5aX2X3}GuGTmcR!%%x_pxma~b?TKfC#x_@>jA4CA9AhIFIqY%%(%+nVop
zzV)ROyk3zWCA_mD=?xpy=Y!SsZSmXhb^4SnZMl^nY#S{$7}ne39veiU%A=aw@n^3Q
zC^qQeaz>geTrFJ-d0u$NHs5P!Mj_t5M{e>(J_;9K{t=y8(?g5oT*K*HiGUb`mLE{<
zhQ=}f+|%X&C&q3G(N{Z04BmL5@81yEg~~<E=!x21BUp|GAO<&#3tP};0C`16%iQj9
zAR{#{21(7W;fpEfS;Uw_01+{|uyxjqE&|65y9JYN?sxYDJB%9kTa0dLX`I7o^0ae`
zcXQ&TO02tXnRiW9i`lEjNN=f@x8-)j=xp9ea~^F1!Nq~!8)N*9JNumeoC|dgv1HPC
zho3q1k=J0TTc-l`BXz$#yYvM=&H99taqsI=blYL$1zh%iB(-I~j8g5I%c^`^qwWXD
zfaiYtrP~NlH1TBWFPyP7*6ato$ZiqL7Y2^@#0I@NV_a(+Yo^0JD<>?{ACrkN(1hS9
z+U-dxz*BC@tmOM)jUwf>{9BXdrcj?u)bqEJF@tiK`<p+YglvRmp<9?SJ+pV0Wt?WT
z4ScX$-V&xTe&q!eS$5aUh84#HmA-#O1@gIMHwB1n5=D7O{Jq#&OePd{d%4LZP^&7G
zy$Y{6XdMZvMmPy{9T(xKbvzD$;vp?6VGY3z-M4r~_e=W6rO~0*_&Vf{gEXJp6|%s}
z$Rc<N8QKsPdsm%U?YBJJo$nC|*MjM)wpYYTdN}o3YWE8l6o*747XBDcClFRjsX_PP
zB9(8Y_Es5<F@gdahThr<{c>pE`kO3Xph=3@nT}y>mp0HTB8gLY=3QnZ2+ZXZwl4fk
zrkEpbepW*zQCJ4S;$L#5S5zVhqwn4(XoqoXs#m0vY@e)wcJ&F+8o{cn;<Cv$+Z;yX
zH`8dipuXm?i>cNHrI$8#W+Ch*bwKtX9OL?g(_XGx$IDV`mN(Wtios~Ao#1m{fZff1
z6My9W7Wf(*RpH5@rChKwbVdmp^c3C%*D(#929%`oCAaR5j!>-!VAo8==uoaJjO<pD
z6}KMcm@`CQ0Qr53l9f@eRiAQy=e_Ds#W>Bee~=FMHOD4i{%p7J4=op}Z0^Q0SXI9X
z8r!hjZr85!4%opmXo1YWiPACwav6t6INnh=cn5kzf(s^fe&M{O`i>G>A@JUcl{{6_
zT_naEo!R%OB;Ctw)0sm@+##D~veM$|OEKK#Te#&TY?~31P&Mb$3m8&203$TRFc3e#
zFSa&_B{+4(seF$=y^7u(aOVp}w`>S4XajwS8?KaVlbkZKD?|icUvk0q8@;u)665Y4
z&$=IIP2Im4v4$OJ)@Lo4!#EH)dK)w3>yaD?qsrXA2!F%r`UFe3?md)T518P#5Sz%u
zR48>ol$@~-g5caSn3>(tSH$Y85~<-S&S?sx`z`<%VnR4#$IE@7d5Z2d2SaMWIHFc#
zh2*2A`uYD~E`YO|=h!tEEM^cQ5K$I@(4O#zO2JROH)@u~>~v8#{YUu)0?`Qd3ecW+
zWR%NcvFZI-Biu4j7UD4k>K>75P{jKV;5(9=Srm3XAeX(OJhxNHiPg{p@`Y~Wm1{6M
zcW6g~KEJG$^k@zE9z96PXNDpLp22UCc^|6jcBwTQC~s5fO;eC>>{)s1Mf)uDo;{)`
zfeB9V-7F8GxBU4gQ?#RMe8&sdVc8yvAB!uU2=?}fMa6pDm`}2UG;c&aZyOPyr=pWO
zP@%c_*g7P<XQ~LjP&~?&I*#2^3381m8oiSix;FZL`Xq&;n;)JErSQuP7mReFc-&nW
zrK?hY>ytD#hi>oz!-Eva@BZsN%hd~21ZTvz;ox$P>*W4NR}j2nVT6+as0hvT+E7es
z7#bQHD4NJQG(|)NMMVDnmXH|{6cp46k8A42=4GcZsejPM#pNa$Y2S;_Erd}$^ECJL
z_lt{*D?@5N0kUkxwRoZWv<dK6`eX)s&JlRoh05&az$KZI$7sDd>WabNlGT47kTknD
z?~te9=&QY07@-v5v*^}UZI-Gv7d%fkn${+}qT1Et9GI~bDn0L;%*8!*Gg5?lgphuN
zLwjGzTDS74Av}p%I~QcEvTxRX!CyUz3ZRgQ|E26IjfgxGovSugR_-o&7pu@ntgk=H
zQL|JXq8NNXgqBv}IU4U=_{LtX{c_B!YwX0e)Q}`omDS2R&jIfTYnYGw)Rv^-_d0~<
ztMVvufK-lqwh^8$l3~?B*1Zo|y{XhI4Fe638+G8(6p)O6^op`!yQ?Y&0BD=$b<t{m
z&4lb@p2bw3j@KlOC~W?z)R(oV<{js7c(<wc^fj1tHbAeYFKdiK72`eGOxp)&yLO8`
zjo<KGy0?*5upZXGh6RnS+4(wkFg(7Pb+5w}KC4;|F$yttJ!e(9o92Bu(Oq;=xA3lp
zi<dt-<0>b4D@uiUnIn-udjGKn+WzqM>NAj-x9;2@%_TczPw&{Q%dO|@;M;Fav2As%
z*}e4ot5(j5`^GtU=__b=@Re_al<${`K+_SsXuUDI8tQ5Fn+vSL2B?nE1>&%3C{3fC
zq_%MHtijCzSM;J^)U(1zJ^ME+7;u~y>|J+%-zj>d$=-qO^`6m0HhdYRFR6-E#yF2(
z$JS6_B7+T+6M%N$<rjOw<f}|NaBrL@L*W?xbj`r|_QLc>-M4nK$Zt=sA96stAs;=4
zHy%k^(9oP4AB1$1m<1+!sCLIZ+#bS0=495QhCvuUD}KO}zpS?OCw$;s<pygRF~>nz
zNpl8maRHd=d#my6U(710IZHH#XBN0;5gn#`HLh`F)Y>q;>HZ~$hHIo73wW+i;DBFr
zpR%A3qh_Q*Jk>Z~*@%^{CkF9O9#U+d99xMU?Sjjy9hG8meP@`k!%c!SH1_Y%L>n3A
zdut2IBnfG538Pqht+9iwyV6wPfqi<Vxsm-xIfieMX11k|Z$NT}N6=1e3~<`RH7HBo
z{?SkUIX~h3gDuzby+AQ8WBX-Jr%|e-UDRVSm#20fDxb|1WWKeLapn;VWUsM)G+vhs
zdr=|n&1PE8rY2n^I7CS^E{9d48rh68hJxCGY@-5?ne{_!3VH}Bm<%LE^yx8R0%*#9
ze^IJz1|G!j<r%XZno!lr>0!{MMb5yuU0af~?kvzRKSRgJ5ln&HYta;a{kL&QV)Gt;
zD>Snnh9{Eo>H%r7sP<N}U^)O1$jhM)fbd{;BDy&-!-yKjYdPd!`zws0=wl<>^(kcY
zik2XXrvKCULE+V)H>j<gU{ZF~4!bmLdZQ>m@FAU0WgC*j<ag)b=$YJ`cRF!9hfLZC
zF;W=t7%^ed9Wi0QEhis<LAc(FFG5KQAofr0GVcGr{NMNg`=%ANEMVsLR(-F7SaY(e
zC+z3nW8ztICp6-6y}xp8@V{3_S;kB?)ZP7xy02Jv;i+{)bMaBQar9hSMDG9Nl9ilx
zH*jaWzs-iY?`*7415tMeQe_&e%YyUZj>^SnwLzXweOCU5@cj+!P}sa)!LU#v(_Gi`
zQ%l!Aa2C=ub2wliY_K!yzr8B(Ct7$Px(+`!9_+}FR}r&5Wh{pH>xN6!-tOI%uMN|!
z;m;=m>eN^8QIn4;+jQ1BVSs25Km?riVORUgCg7w4P?ckKI9Cnmu8uK8erGgC{_!N-
z$Yw+Wf7PEr5U*7%vBsq{l!@I!-Mo+aMi(V}8nG<2U`68k^G_@Gf4g*Sk_pbbNIeJ_
zid1Ir(IMwJfgOvKg+wDr*SBS@c8fA+=_3)5yUFgwgk^rlXbDm&o6PiIvo2_AsP1C~
zh8Ao?b*h@mVCOT=V2msif1To&IT?2#8z2y&Lq2u4x0Nwpv=ch6y3;%ZZ(6J6Y{gkA
zJ^473;fnJ4iD~K|p;u0e%+vk;i9GJ~`-Ut^X;YMIiFoAbmcCPSf45JZ7eeY=l%5tx
z+gpa!$6`L`jM|0)dp&A?rr0C6b(evdMb>sX)KHwl<vqlRS>v(yxz22OH|9!S<6}C&
z@OsK96oDm43hTdqa7tg*aoULQ#~*=4PV~jL*0sho&fbkS^5xlHUKZM;LNptY2nO(@
z9d*Nc8p(aY#{IR~AsFw58lL<`g74<V6c>@ow(5?osmp5c-twN-SE-vid#e#4&f&@6
zEO+4hDKJaCu>>=FhNMg86`7~zMn3@|KQ}H5H&*mNe)tepdk5q7!p$pD^?4``%j&Ce
zgCVv(A_PJGd9jU-AUyzAl~*DjGbE;~FBX#scgj%y&l_4B^Ro2*I;tW1bsX+iq5=9t
z4L7Zm6~AjYu;U^`3zq01_8JVfeYm|+qbBjmAI$oq4m*jAP=I>+gBYQ7d&3aqs9LIm
z>~7wSqQZs&oA%9aKJR#DGAYky(GSb@24$NaAOM2XR%)TC_XU8$et&@4Si{i6$Hk#W
zCT}l<R43i^?j0PfwoyFYaC>FxAK6}dLtAU~@yEM?Qg`=dbIV*bcO%Imh>pu+0#?I>
zI&S(rGMQBuUdE7NCx;t@TPc75H+>03$4<B?+d|>sJpm9pYC%7M{NPFu_PT12EEkM|
zRSd7yd>do@*br9iP5~*tk^9NpUbN%=f25jL;*vl>g|6OlG$%t06#+}WVW1VPI7p4y
zVIx2CH4#gZ$nP@i;saVNXAAqiD+9n-+$s}VRD*?b(%g=~t<?Qfp9JRQ9TVx?+@Qf(
z0s-PbNHYgabM#I9Lw*<FVl52E&mAwRHAvYDkr7j$t{&9oDm7Sus>IY;AgT2QRF7BU
zI&OrUV0-+1?c9msqfVmIl;^N9OJhN`Gc0W7Em2xRoI$(dgZ*;jt_Oue4~_gqhRz?P
zrA!Kha+Ldv>hcqR`aWPfIZ(bX>3<^LN7at*>sNmYecW;E`cbYolg_GI-2ppaUj9Z6
zGp{!=5!Uk|j**+*94JkCY-sj?LIcVLRzBkjf;}Ih+}+(wF0UFZihF3S6-Wd{fDn>-
zP@0bH47rRbABxX<$e`A5<L4I=x)$^`xXVDftI!cJuQwhVqTk%8)SA25s`kaOfFQ)q
zdc?p^I|qVpX@R_`9Yj(Lm93dEc4x?(OOZUVY$8lo6m*{ORr;OGCOT*1KGX490e(GK
zZkEwqU6HY8cb*7u1{+Xxwt)f|yV24u8#8hz$e|p*ePPA`O@mWNuO)0(I>7)iilIYh
z%r&qqZ@W4G05;xiWPbwa_s?f#jwATJH)+g#`!hY7oBn&U(fGwG#3iiF{F^86Oo{+s
zW@((Dr+2$?uF-_*bC#n(Mr%DO{`{dfB*9Mmr|8<Oel{o#Yg9(ioDCpKC|w&MK?b)t
z6jsGs7wdGVpaif*Zk3_+3c79Skv*K+eaB9fZm$9rM?JYp56o_iIvc!t(w|r1P}+7`
zu0zl<4igIDuo0|^kJQmD9f)j7{dM`-n^-U!w8wgs>XgG&DO8#>&S}YpF<i6KRbrPD
zFqh8_XS`*&Y>kuHbW>AwVx-oO)+~^dpgWxR2*QHV!Q`@jE%faOeRxRh*JKG5nSm(0
zkWXwQ5l8Vxww&^G#{ZpS%owQIQOio=EqcYNH4gQccTdY|!?0Wl8xdo>0zgCoD=7g@
zvHC6;+}+dRn<rJTByoHD?BsOeW(YjBr_}H2$Je$|CAIgSzb)&u@l0exZRsw3;p&P2
z*J4a6)5AiHZcZ3R0Rqg7qcCS%gSWpPPm^k|=+8m;`6*n`cS^Vz2{Df{Ii3d1)5tP8
z;Q_n;eg#?^QNdR`c9Z}s>0Z~TU0-jzFTS|OM$6%0KD$EHl>ok}{fsoXRtWrUm^5M+
z@=9&SV%pC&1gx-2U;;f$ZX@NM@=Eu~SawBd#LUOu^{$zD2w(Ja^}O3PU7wm(R+T|6
z@7ZMpoZD)ryIEI*QV3qnUv&(HSu;AAd;Z(L0x6Y~q8=0Ju-ZQ^HG&$@0V}^loLkJB
z;uHQwHB$^t>3LoGmQMEqnZdmk_cjI&UoRI#d8bXWd_x!(Gt%$aP@S^YaJUwIL7XZ^
zF)5>3TN0L@Ikkp)dm-aGd4=iAC@^buB~gyyHTp#+%hn$a4iom|>6A~SS?+y2zAl^O
z$@?KG>H}S?tI1)7liej>z5Zs;<a$z*A648oI$>h@076@Wtu=os81_th{Ivf=*IP!l
z-925yfg%NpySrP9ySuwfp}4!dyA&(#?(SBgxE6N{4#A!9a{cAG@7LDKTKSZmUovOr
z%*@%dcUUz3l`4$V-i^us#PzsE=jTC`FGv#43Rx-JADB;wMFgoliv<WCb31#9J1F_S
zKuBsaK7W9A-_7)1etyKgLwVX%D?Lo1JwU~M*9Eu}ehlld9H!8{4c8YiOGujAzf?-N
zj&yazkCe+eG&Nnnhv37D4uIr8(J-5Q@_}w2b{q`j*x26j=`8PbloCnn!Cb=18Qf%X
zA%rr7ygXXOl^O>7Xoko}eEO{OY+WZ3YdxI}2q+QIWZH_!3V!0RJ5}|`-Yw$ev%^99
z8BL7dv?}#Qf|I!D!tLs*I&*XC7!@<@=&M*bDcxtXSu0`6c=bCs0MGg}R}Ls}+F)20
zwjvj6zs>9$&KqQ655A+Brg0pVK6hPWgJHW3^da9pJjUJGqSlOYKTlt~_JDLc`w&4|
zfi~eJg59$-<3zBl5Tgw6cb1A1Qapb!uja1tBuH-b(VH>{jFNj6l8^i$Q5G>atbT6)
zn}mMz4c(2r$%*#gshmW2;T^?~O>_gHKCM@dmQ@g=-!?mEN&KJh{#mc1?Y<~Oj%_dO
z6YaQvFZynI9lSUNw4%wU2+a3HI)QJKBjpX;Ls4?9V#G&qa$ZmoG*dyN{ccw+NtYM$
zT)p_UXOeLtWkeoUWzJ!a@|sgdqAj=u*tbxW^X+csn7C9&KHo{cswk2BafJx`&MYBk
z2Iecbwapr6R0pz<18_WC>67P`dWtasVm+(ZA4GHYdB{jLf1-J_!DLl9LEjSF+90Gg
zsyTM~x8Y3og`GyJ?7TWP&8vKm=Fm2P&fnA+%eL#YGFsD4+cgpTJ|_Xku$?ii4!XBL
znV2mvrC3eO7SO+NsNB$}Rc}`f8`M9S<e9tw38F$+gqWJbQy8tHJZQt3Jh3ov_?x?t
z3ws)*lU$K{h!NF=ai-9J@wS{3SzEdtm#XE0l_hvV80IWUn)7=AFa<y&A>(sNU<fd#
z<%P@q*Fh!mNxwglR%vgx+e8HJI~c*9sKTw25>xo)8&~x+>E}nb7B4C>WwTE%U%57s
zlZoS7v5X>_VUYf8px3|h@ZI|iNw_Snb<Ybx1LE{n49U0gzYwKpMt;5vXofPyXn+>y
zXhII87Pg!;(H}&73yAi(SJg`ZY{vvphg(@K5vH@JYNW8ve_Aw7R<1tRaLqzN){0H5
zjeSEue*4A_0~<Y)^Zl-eK27%QIi-70w-R%n)It!V_DkRB-LLmFe%W%=dDO{35Yn3A
zbA4r{Q~Fz`TH=Z{ez{j?5Y;4{$4+4szQ{_E$AIcWP!v(+?l~sn5AYh!%~v8Xh)w(L
z#>eq{l`?HQQQYlgdqYhf<G6|%44a}e&5D0ciDczP=Z%FbO32PI-o`MjTGd!?CP~&%
zqIN#!HqbPZY_ql!H)JPYX&X0hCu^w%#Ty%ZpqVg9fTXGmI*Hs+Nx3@Mn81%X!aJuQ
zdT8#ijV{u^_H_)5P;88%gfQ-xz{?r~<H?W2N=z?&mx6%b_lf$x0G)a~CI$knzV=Vp
zeU(}t>_)H}T^-iWmf^Pt1QLMg0K5CFV<#{<6(IEMA?0nuFrW;=!n*8HUQ6*71x3^E
zr!g%@F2oWM>*}iaN6MHAp<s$QWY>8y;`3zJfrAmD^b#VWW_XK%qI+i})$GQMx(>Yo
zJxJW`12U2xIuUE?L{$wJofzE0&3Kg=+8xtS($9w<e!Zeu4)(++6c~N53pS0uTJVj)
zIAZ`bpCct38<wDRG#q@l7a)Vl&rJJiQ^DbMbRLz_1l-%|e)MJrZ$|sa(c3<knF*W5
ztKZ+t^2-eT4%NzyUAb}az8TXMAIhla<}#IN^ozhcPqT{QMsfu%OW?i9kRG(5eVAbW
z9~1CH@<!`6hQZXTMsnMUv0{_|%z)mwGaoKK!BUIv8$*@${G*)uagKL<n4yNd;nQot
zJfBiuRzUbxpJ<9;JcA^BLL+)SlW2o_@qe>3QYG@MdSei`Tx37J`}c8Z52%4d3IRT(
zl_2|`{yNFa<I_i9<SEPmR+8V?r@giJk+9IWi8yERs=Xwg64yCxpUMZm9l|}n#<I~D
zcx%v~e<f55`(e(&gduv{pEnzTSl_PWT{dIK{Re>yIi~xQHZO$#(Ow-3Rs*zQZGXf|
zy^X-)MIa@Ps$GBs#5l4L49VVBt>d2TFEB&L`EZR`veF|=VEj;p)(D3UZ^)YDUNiUO
z6;6~%h)dJW*<Zg8d+KRh$q1u;Jzz4i55)k85(o$wXrBaL{g^4hA+7#eOx$MD<-dI$
zN_XzHJ=DHT5ROJHhXW@{q;XMs{Z;$7;i=<v(l6WyXKTm)lF8cS*isv4b{#}v+3(iy
zUbj83;{`Wd367qniZ9AXsE{Gwm#5hU3O{}+MM7jUi}~wVkiEu_!C<XxG{5yYgyM)3
zqeCZ24wVPDCAM;#e;b-^K^EErgm{GgeM)siD?reB!HQ#VTpou5mzXcqHJlXo`}aGL
z8|^TGx<2i))JkpBAc5v?7|WPfO=rdeS>0(HtF^@y&(N<u4K`;+vU2U2k9Hc9dTXA}
zx>5!^!8DhSM3hR5tGR-s8f$+a_b(b!4nzr(DoU!`u&fY!bO<31vin;g9+zM;fC6DS
z={t0u-q^qU1G6X^4nGxkY!(owF<yHAq<P8V$HWCR13tP>>yALeKW9r04`N^NgX{Ue
zi(X5=mUzmFkNbUw=xK1T)J}~V7U=8J{rZLlNRU-luV}EraP2>D6^0@qWrP6L{yuos
zv1lc0lpnUXzFLP`=O<J_1xr;N*-r_q{}@=O{pE@f0bS4g)&3l)2&v0@IqxHv8Iswt
zcd-fhJ~p%!xedVOdi!*+=I}tmw+RbXmywte0aaMywvpIgz=qE3AB;`?!_CvO7@Bp@
zfeK2L>N}K>Jl8F!z-#@kw=~|`<n>?^ElR-tk6#a%NE#sJQCgqunDBx+H|83-7Q&Yl
zmJfF>kyZuZI3a|oJprFwf4!}lUZJ^>wBtkW*7Mf>xg*ngE@XfcZ*cZY@dmheN5fJZ
zt(zPHbi!^*9S-16dFv88KEzt3O%dq4s~TDhpUI{=WoPa&`5piYj3QC;#Rnm=9$LT2
z3munS`eIn00;m~MQt1A-iI@Is;uP{a-hZ1o^w*x*KPILfKZ_HrOs>#TVzlFmk{a8r
zF)gAQ(sDn*kYq<sHtnw@zQBVbqM`2#6s$YJelbt~XbAnQ=|hk=P$*mHO#1ujU7~X-
zs|JQIHk*ECBTo(DY7kxa@>KtlY9be(K!-sK<kE@GD>#Ib`+l-)&J{WEYtN1C2U|$Q
zEpdkGf4;1VR4?1?!_x@@8hc4)J1RCRYu!G`XLq~47I1Rqt)av$80{$1ZLPP%Sj6}(
ze6{2zNP<kr2xkeZOZ~M@?8)m;w!hkx*gw9b-N?ZzV>3Z$#duJM>Seo@_V2QAPjFma
zr{8iDTRvc6*dgWb@w3%~U@<)@4y#!~O2C=3)-6xVzTwM2$+u^9(U3k)l<t~g3VQ&}
z<Uo#L-7Y7_U+Y;3vI{@lRvs?v`=b|+BNFEbooH^G5QDY*|5P21$Xg=+{5ORcKWxQh
z#kf4oi@ri%4arIV-+E;K`Mv+^?aEN{b|0z)8YVcFMdF7jVES7+Zp@z@*E2>sn8L*G
z+s|F}AsYL(xATzJJ}|2Ag^r>=?RL}fi5i|;nJqSZ3pZ~0!C$SI+>b@oEkQa+*>*U1
zvz*9Ttu)3m_QAbU2!AJD{M#<~fA0FUf5S;y+Gr@b*}aTO<Sfc=`MTBPR>quL)#<iE
z^J4!yF_k$Yn~eTFlgZXon}y?XU=GqOD%kj_#*;&p*m2O7>$>PpMESgR_nT1H4pNr)
zs29&io8=9Lfpq{iur=}%?A(Cjno2aDODE#iY1TRF(q`oe8Peg_X+QIQsV+^i_?3Ux
zxBB#+1I)msUcY6Dc>dMjo8*Aa-qWT-!Kb&8P?6~4K61up0ZJvir5UF=YkY-$nPe5&
zgG5*6m^h5=nAIp2`n1L13A`#mfX9Q+PG0OBE3;ndU!BJ3kvj>U*ntO5ptUIe>a(?>
zneAJ3WSonS2Ej|c-K)&TBXIW)`BFYpQ}-vvDgtNCd~7ZFZ?Cl{q$E#w8NTMzI6ih{
zH<gn?3R%*3zY&>@y84hxFTtn$i$C1zIo^(+3FvP9n+w8r6cMUd=dXgwLjTk@5bBun
z)~ETVh0c1QNbOVPuhAGkR9@(zz`;RcOF;Ub_OG$_G@pB|by(Nm$vJ&ePAy$xwbt3(
z2nW9ik99qj({uicGHsWu!DH~vS(#@APR|_C?>4rA##q16(yIG$go<fsa)VAi|B_Gk
zuFnHajN@b7Pw45kAE#6c1)jRCePrZhWTt=kx2ALI)H=(1i17JJPtsWQ>Z`Nej^uN2
z^_&ti`ti@RQc@o5-?vQ1&8eRz8VEigFZvV5OG`&e^R4d`O1}Nh+L{*X;v;^mHkXkp
zmDEMAep9#8)HZ9i(@n9WG9XeluxmY)`&elr(tmBDSGm@Gj(TG@MHGRqSvKPq!PnWg
z^he~!1AnX6U1Q2Jxulp{UIJ#Mco&`3GsP>}7EbsXEDCG&sI+=u9V$OPgem-fp&wGt
zzr)=>QKpk&_Osi#YjIuT<<KO8bNGzIaO<tjX;*Cb`m#GS9GaS<Z8&4I@t9&9J;sa)
zH8mG&NZW$6kX&9NYx~JW37!rjK#x<EY<92WoX&v@#Q8n_lwQ*6=t$ayQ)GISd+0+e
zYN~Z@rhDp%2=2Yh+xO+A1ydP-qPu=G(DGnUv)bjdxh9@%HtBs(YHJYODbUbeM`nN$
zZ$?g}fB#f)h1%!Hy9$SMxvtpT%eTx4x>T&(db>WFt!`g6^Bi((&%+noZ1lr=yE$*S
zC#1I)FuMp!<8-|`TJZ%NB~hu<k5$bTdL?R4!efR-w>>4vGe5XE0WOJpVDw(iE?9dt
zeN2{8o0%oubn)?C{<USB*BGwis3^pvHWb=Pm}~%BwgT9%iRU9mI(Kuw1#J#hnBQA(
zeZ;Z$G2t_42w%c~M?bnA=&aK~g)W1&DRrAB;s_#tF%I5RnwA3p>Y9vZLb>e(`ACzU
zIN6Gqc!tvg6zzLd4O_nUS+K20KYnFmQxGt+caa*M>$gX-NlId=>1kDUj>^iMPjE4{
zAoNhB*u~27-i>ac?`2YK8xfW_@T0a8qj9J(liKyU9nteQn(bYTTF&_~QON@FG8E!}
zt!`pyzZNNYE%4Nj(Yi#Xsj=oIClo#LitJCvcz=)M>OJy_e$9z<sN1j0?L$+-Mw5Sp
z?p{h7pTf(l(zW(6)n;1nwtn7D=J74J>ERdN!>&Li<aUUWy<V#m{KmcGSd=Q8m()?A
zVw0sk7x#gD(h6KImc38oIeK;^`kT6?rn1??oP6;|np%Whqst<<`7{~|ge%(HzkCs}
zB4(q%D6dYNEZR@HIFeb(C2Sp+gsRpe+<5cp*94iBUO(rza<-p#yM^7NPhTup8Dd*&
zoF_I6ckqd9{4po-e=~cUhG{WvH7F{ek<Tv%eCCr22v_xFg3F}5y-<{y9x-=U8cl+7
zBi}Kipv{4tf&E0HOgQ><o_r#uW)2u!gB_XAD5oPy2}o7W{4y$4j;LW>s0dFm^}--&
zWpkP6^Nab~FVFP0;(jUA4Zm%vy+AtSW`(5o+TROVCq?}D%AEHIA^?G?l_Ph~_koky
zAB9A0qk}11MaSvrka4ByfC#aEsM|lCM*huBgIDpeg^Z>}He<a*y}%OmP>J$0KBrN#
z#B$u*8m@bcrSh)K&qSj|1iE7p*^c#Z5vZ5%be@QS$>-ic#(e`%Bx@nXDXgr#7s+IC
z-VoNES1%XY^~Xh(-Y|Q@J@d&QX6)a-be;1CZH~n?ny`pVPDRJ69aqGk<-Y`k@pC;B
z{f?z~9kAbVQD>8`S)`B585q2xAL1~w+5Eu<^F?pMX=C|CkFPa9u1o)jBu1as&2F~O
z1<0NU98D%7My{x5V?LttnP>lqTenXKgERld0)VQQ2x80I%>%8`US(w_6w#qNm8Bw(
zw0$|KO#R1ctGRgnm4KShamt;l#%_YA<?iC;&%Eyu(kr+t2Bp>dz!jN%$+6YTYrj(|
zxv_&w4j#ZZ<eMNDYElC!MTL(W68tOJXChFui=W<%ej_ILhYAwgxtW8pe9;r(`K~HY
zt=8Oels*ppfA*Q4Ou5;HYa;K*TKuP$Wv_c__d`XmxH_(2*Q0+n*kmr|8ZhJT2EKaz
z8+{A>+D|m+vvc?%tNL1N_DUT?&o3S9BAAltDre^;42I?2pdTA^FWkhCY(@NBcl4N~
z$~P{1hP&Ntoy|3!4tpO5Qn^@F`rTF0oovVKhXn*Cak(xhA5n>;22zioALc(oVgZPJ
zlPi}M<+3_7G1|kwUO`PoV4)@6Ms8I6M{@h3bI~*9_YyAfk8i8*Ru4-lZul)r?K9*M
zL=Z&4hjJpql32L@eCVwl+D`!P!!2b0scv8#Zg7yGKrZP(s;|W!^|W8B-H^n%Z#ear
zP8I@~FNU`V4)Kpm!_!YEF{8BQDQiG}$Tu#nD0$4<3Yj5XPb{{jR3y6bDm|SgmK*s$
zes$-=@1bXYUPsGA^=7v0niCYZ7w;z<e)ZG0K2)bk<&BV54Erm!xBw9P3Bupwb(NE<
znq*BR_S>bz37zN4L=`W)>h)K+8hPZO^|3syP4ueHs3g|9C<ju5I0|3K!~LpTj3m92
za`c}R(4S_cP!J|J=!dG)5aiPAOCZDG2_+o@g#je^mOH|hTUNHb!O0))oyu&<k!rsf
zd~^2+Ae)-?8hSp@eV5@Y37`Ffw&g%}9T1B}@KdoW<vIq>ii+X{w?4eL=^VOzMh6u)
zTyc0s7L<1VF>{5z5sDB&0>g|Fka5&bxu`mdCj+66-?L}JRDiidE2AJqttpG!Za03`
zKh#AlwlC%1OP4-IIG=gis`Z)AXzewy>e*((J$c3z<;qsXBOt?K%7FI5yuIvpPD$lB
zvB5Wmu`Cbq1EfHs-jXM@%7n6(#@us@VyCA)t8*clsvo`~aQvq`v4D$S;&HN_*<%?{
z>!w`L3k#v-LiV;eYFQ6-Lkrn-7vuL<{5~xehm`_;kw3WsVHFwhB#6u-_Hdp=YJ)d^
za|d7*rz5}lT^)-<r(1Pm4{GdWzQ@`?18{C^ACj-PN=##Lf8uGvELYY0A9mG~f=(H4
zTjar?tl|vp`(dx!eY}+;E`txm5!sS^{Fk1H(a)e4=$534TU3P1D^=o+{Uck4o6Iw(
zvQN-0g^Yr(jJXmD+x3ASMKk2$wm7R$NQfe5yzP-6HQr5B&+}i7i-WvPh?Vk{ZNwmC
z*h=M^tm>jF$S4cyO)C^#HtmMKm)nA*+Cw&C-q58o^AC`UsYdU>DGqp{qHZ&h4|(}|
zVr{XgyRPWB#2C9b$3tA$?fBwc6p9I(?c<W$VNAdUIQ`Ih-e-<bpH@eyTA$l<8mMGD
z$x^C=3LJLCyFF8wq~lk)*LsjBo1;+;zj#Wy$Dc-y{^{SY#JZfw^y3Lmv`vax%jvjB
zz9rX9NwqzK4ELMv(OOgpbP%i!^zEf#3#dhD52!D0!7ulVEz277vsHoPS}{BRzMgJj
zstoCAbXOvJjMJHfRrQBoU*3w%_BI^i2rTO|#qA8<IE672V+cu24$eHuEu>Nz@<~)<
zIMrnNL77Rf@s(v5qCVbZ^K1=5Lqkwy<Vq^>L)RqvsMv05j!w>-XpA|}U(*k*5wtq7
zh8IV1t6cJTfR{#jbDDvg+?O(ER55-5SssfS$(2+oQmX=FO?IMCND0b5B0S9{GDuZf
z(N_9P6tf$j<?Bo}1zU&mF_WD|5Iw7$I%Ahl&+etpb^1F%rRY=uk{(+xF_M?oJ?_uP
z{x8W9<XhmZI(oQ9-FvHwcb<VS$=PpC{rDeB0&Y||?}5lM55qasf_!GXVyGIG2R`z}
z`nrFnwx*511EBSXjiQIRR1cSQR{u8ey0_t=)#_ChMWc=-;rQ7KaB6M!G%(+NW8TH`
z47ai*1478c?~vO5mhV+At=REE_k43`tr{0F7*GPSJs`Q^7!FEDe{myj|DJ3ujIRW$
z6;1yLBDlg#BcW*6%ZZn3N5#0AtSGaMPIc0Csp{kCP@gcnA`CTqWEC;qnShp&hC~#6
zcurMW=1!F8UvJTBatGkbuiJ^s3FI=6v1;sTZT(g0Xew#W1+(dS$+90~b!fh^ks44{
zIFffeP160f{fd2)g>n%3`e|+jp-u@WNLi(<+-zDwPYFZ*MShGvOd!LWI{*ZdY-LE9
zZ19@2;sg{uK?!`YNt`7|-;~Ld@%Zl_TGB1JV!#NF;j#dottpaVmtLuQ9#l=1WLxwa
zy;;)6%C91h2BDv&N<;uCWZeEl(BWmN6tj)w*fSv|U^-w*-%OS@w;ay8%IbZKnu#(f
zu>mvruBr;rwAOipnlj_Qx_TtOsXh8ZF*VMnLP=Sh4A4iGt8FBEV01L*j=Md^<>XmZ
zroK@#n$-9P|FB>6wBqwkv*kEcsea$MJ(SC6q>`{FBVYEF-?v{S+PyZR9k~hI|1uGQ
z9TiR67hSm7bCD!%yt-J`D!`I<gh)>Gg^*{AetR-V?v5sd^PR~#X=+E7=!UPJ?KqeV
zH$YD>Ll3pjau?Z>7!u_Sgo*m*;zuG61G{mi?{#1yy)OQA{UXsL&?s@q<+4+$%0i8@
zT-NO^R&cW&tou0O@vWe_+yeYij7eMQ<PZHep;+VX3y6FF1zyl*J16|wtiG^aldm6I
z4{G}-0kGS_g<nfm<$&^3BqIOwrkCJT_eJ$ipS=BUrGc??f9uA>!foERm&yl=8n*_)
z(*lM2-SWaRw!AVg_ukATZFxSia-tZ$MhYSMxpKXxVdCTy<M89KCbs`*eM*r1D)VDM
ztgb(KE<y9MT1f?BVKs)H6p17q(o!BYEr*Z=mQaG|g3p|*KCSLdxm)lv^l-%O2(eis
z41cF;qfUG>|6(j^1=m=Ul8@eVXFQh=-@|nH0x^pN#ev;bPL9+XbG4#`1NO!9+8`Eq
zaj18W1^#o<k1vrEss8VQSgK+V`!9-^zVeHvon>DF^7g)5?VL&<kXoMC&KI%^x;0%E
z^*>+ZS(U_U(G6=GYOxjVIR&nOpX0(|ZLonZg)>d$X-nA{VA4#xZBbuGV0F%(oVuk?
zsf^@!Jmg5)kKWp5&zT#qo#*tdEQZ_-8B~$qFG-b&iWQSDW9{h;6JwrnG6KgEOcfam
zybS6SiDL~kUP7906PVuuQ1IE)*>0so`ca>5A*||!J|ASn?s!iREv6NdRfg%Q?d`qL
z2&^MN3I45sEu_^J=BA$a>HXfiA#v{N=3V4fefhk1$|M8m^X9yQh+>KQ^0u{lxp0=3
z<aZuE2$Z$JJ}K;(RN8Wq(nQW%=;{`)EZ~FKCpLWeAiU}7W|X{3c5ikYk7Mrev}<LQ
zO(Pg>^FK7o-x7K^1RZy72f*D)*^cNrZEv)KPrMXIayWZr8?0(@^^OK9?e%jXy_PV|
z8S3860^c&mv02+<5JCxww82Ar0E@Z!c)5(X{(7|5kD2-BN|Huh19R$|LMn8TR}z$E
zI&Vy`T&{yT;;hEE`p0WkullsF6`DY%ted%uNwslFI4;G4L!}G_{imQnDIG<iOZ(hZ
zE1gC(lO9U=#vk`1QqYPh?e<FQWnO7-N|wO9ezn;Ur8F9c{^y&5NRZB+!jcqM)4WZ|
zsJ|4qDIoD$On+<B2VIbx+pyX!R)e20_fffpTb=IbVyh!j=yeX~*mPFfU*^x8d=t&*
zV)sN2ie^z=8x8B}(RQM9NGk9it{-E^UO@-^T4osy+GDhzNQ$YVMN4l8J4d}A413m%
z;xVf7tc1mFX}q&f1*DDm$ng>Nk}-Rp*!C>$6h>(xQXo8FI#?F<(`4}HE*?~{&U>y8
zwEgv$Pgz}7K9p#ETFQiA7J<2JE?{Gc#{|lu-UE>>(z9Y|<0<zmP65?l%%8fZI0Rf0
zT10Qk>TRaCOg9hmSUmLB4Id8`4u2z*Qfp%ux43iox+4Mf9{EkD(6y;!0eRLZ&e;$a
zSm5!|gB>D3k!o*o@1x$qW*6OyO+lv3I_?G$pbDQz8qAb#bzE!ya7hj0AU&?Apl`$S
z>5<~_?9UXlr{)1W-l}W0<XHa%eFSXL8CuQZ>!NHa{FMN8Np=c_11Zq{Nk@)&-93LG
z;|QD6wfikV`e^6;<>3hqgu^bt^qC0vO)t0MLDH033)N|el?@1{Yp$efw2GKuc=i!T
z1^f;KYbC6Fj0AB$i!-uQYN=as3<2$!;c)JJZkwVlGto`rKTqfLLkZDsx$TxH(j8T_
z{0UlSdz^HK^ieSM0k%dBm?oc}YD`-Fla!=MmR-~Q4N0+EBZ>bt@L)}5U%M!Iaga0e
zvew~2$XMJbcpW-CnEvDOV$IeYfzG`0<~lbM$P#c?uzM;}+dpWJJefu+al=|eEzWCe
z@5_i!Tc@kAa7;un=>EFkR@e4T7Wnm))q%!2;SQD1g>0hucK6$=F(2quRxukA7qWl4
ze^bCay~4Up0Qp3E?TR3c@?47nQ|AMQSit4uwQ-oFbKoo4o?bCgp`EKEa4f@AQAH0_
z86p_{3GsPw06nj0O}5~j>Ga;PyarB5Ox6~U#U$PAjocK11dzfCKbY9qR!34!BWlf5
z5oK>!P<lH*N|#2X`=5|dx*>7l>gH9nqjParsA<NOI?oS#V>9X<4_s!mXTbWD2@9be
z?&o)!<47(UmwESF5UjfOcslG|(Ir3WDc)kIE1YR2{EX+yYnAq3xtZUb`?S0?&PgRY
zP42M1E@}6<(inOn;}j{)6vkrbB2BWza@BV+EfVXT-TTh#ej~Ctm%r&YWRE&5&YEe(
z&Hte!->=|k$?CG3cvwPF8+_<J@M<k=81=S5)+lRG8vA<J!Y@nb=T@6iIh8g?YYAFw
z*%-HxTpSNIdhL4(DhWwfThG=Q-H<-ibS*q6>s=Uyc9wrNS|`U=JNfM*HC9hrM@`$?
z@`%D7eEW;qr7P#g?cf*xLIx%$VM5ud&|dK)t6NZsGrKCrkTPIX;DmjNQ12@?5!7Fz
z@);OmWMO1(d8UF(TYJzKPioVatklLa6t;i}sBI}F$)GRX^jnzRviH*5XhB}(xudnl
z(Ci3w)}kw?diSF|#Rf%W@{*5|`DfwHRF$xYz#&i1nZN$&CjHJr&PXJ)qHknME%%LN
zq0?yIVaK{HY{~CpF!QTB+JCx7e>@YN&s-~o2bv%FS|jz=A9Eu3`oaMsz#RY*YL559
z(mnI3nA{h)M9^~C0x_&6{}1u85%06qN7#enYTiGwhHe{@tw-XBZ?Sks=pl2tejIE1
z;F-CaAPx+#B1G=Dgz`Q!Zl5s?Uj<SF<*);R>(M)HU6uU39YMa^DG0LKA&DFVWX4P8
zHzv~s+?6MAMeC`S8Kyp5eh+f(k;A2p-1XD1<i|LKPQa$|T{y|Tb*eMM;YOO{47J4-
zvwmFmQH#6t8n(m-v46KxWvc#P^=c9cXh!WV9|~HJlbqW&73#B7<A3|2rexU|&0ne6
zZ<e}5xB^*flkvekPT)Lmx7nzN6H2c~`;|Y={DtSh6f-Xt^h-*hALe=}0^~-cXv=Zl
zl4z~y$u}9#xgP1lw2zX&S<Qk3GLYeK!P`8Zm<u-WOhgI3zjI1a(uM!Wm)#(r@9Xr~
zx;0h;$7iB>7615`f{Cx&c^S1q{vdC%M>tw7i3MM$ytd|r#ayZ+V?Y}6qm;nM$mX}K
zQh+FquwOGK!7!&8#lD2mrSZmNyz8FkNtiq};Fjp(pg`T;r=SC!LV6{%*#tT^=SS_v
zpHo*P?;?nupHeE)8sAW`4(O??2?(3e0N9?2fcV`BGDc(r8u1k{u$Ey<4GQ4@=FMc>
zcku!uCVo3^C~{J~!SCh)ho91ed4T6c=Q%to75VxCRtHO48`h7P&zsKf7%CIqPPe<Z
znM7{~8?lULU~M5x>l)tmw3X(JrwHlV4QyYVo$JD%X|0@G_Mea)yqN73^#ex>_!S#4
zDed0(^RGnWZ-_UY{A=5F!A_^gAx{3>;^`Z=9e5XVe0-#s8s1gP8D!?UP6@l%Bkktp
zP}?C{eyPMf@u1~+o0rb(zt;OvhwzxpY~xfq5~wILTxxc1R482}R=)%yVNoGe?NU&F
z6q~Vf5nn=Sz@O5t-M2p8C$*)v!d2Ue_8T1UBdaJVGtO7JR3mwzE;3j>I3_f*%L1A2
zE<c=bC%c6j74T-^czbk$^*}jzft{H3bA^VQNLb5WU|vxHIx-@}GRem2JUuQYL+<mH
zx<A&(U2tXt^g>hqnJd$aNwx~J3hLHZ2$YNW;<dL0_LaeKz$L;Vglxkc5xU>V^%U`4
z`J>|MFm-sB8C|73oTaqP)d}|QlY+hhKK9&QaRDJE5EqXBUi|s+T?SBB$i+SXQo1H8
z5pw9`moK7bRsZLlHfBw=?P@sarq|WS%FpA$a2mu}e!El(2dgy~UA8AD)vnLDTDL_G
zjfmq+DfH#)Pw0YqXBA99ovtU5lN%i1awibvi&OCaeA^aEIfM~yaOdr(pV^rzZhxHH
zRxPz6LE+-EZ;M*u-urblCks0wjR-L7c}-L>X`_BzYuri4Qh7AC{WR!qOKf9i(931H
z=UBO*EBG90#(J001TnLIUY^uhEZM>latu8C!UB9jiucT%!m#?XTyr`mA5s_4>Syz9
zv(jQ`a1f-*BwN|vQ?pRjEjdPXdiI&JqEK$_uSAC{diRc5kEn6VLMs3;Qr%EHsq=+(
z``i}vh$SOy3ovvv+&xAPi1E_ktavtj!o%xTyLS>tZ&rF#pM0*^@Du@1;HosZ_%LEJ
zkC?&zgqj-Y*U##fyQ7;99u$J=OSXS^YrVLZE(Ntz9GH!<@TT9be3O;j345Wt0e6ib
z!nP-QkK0+OOr=et_`F7fT*XH6Q>pZlzNaIIX?Ia=JjY@`$C3_t7Y~G6lp}6#JTWaT
zi7<I_FG@J=_>F7{$pTmFgCwTwx9ke<cqIAf_UqF=87aT!M;~n!%6{$T6^8^&YkblT
z$l-Ai<{xM}pg0gAMmrhGmx2jsh<3yk`kveiNZwjaKGXl|Dk1iSd!n)vNfF)R=Ig!5
zA(q?mdKwJG4Q1b(7O%bVysZQeWSqY9=~QSrZ|w9;)GVBB*#5cmiinOoV61SObcS^@
z?_H{#To0b&FQ_*q7EFyb*pcV^9JO)nIRrjQHgy|5weoVtIGirzno4=dv`L?b^5BGk
z9l@f5@Y))m){j6ULmri)1+Y#|2|3_TO_Ln*v};IB&ch!CRdf+Dq9G%XP`2HkIIVCW
zFB{V?riCExuf-m|v{HLxtv1LnXvkU%pwE5qCYD##t$xfu1}=LBcU)M(6#qn=LCvW=
zN3|-@5PBYVYkG#|wXE;3FB{PlXn$u+f4*k)N;o5%%AIkBEsLH`hc><pu$j-37N;-M
zQVQls?w&F#$3jq1s<{2qsP`dE(Fh?~TtQxZPwu}Xj!)tX-hPr_m`W>dFEs&(r=yXG
zJ))ZMG?e;0W`~4}(s!u(lvFA7AXqnM^H_>%e$zru?#s~pkdeWea7-`(<l&lE2cTS7
zgJQxO8u-I)f7wOc0_5o47$*_{`IdQaU@HsFMvjUHsq~)|s#IOPhSZng3}^s{Nv~sJ
z*?9eA2oHCplgdV)tHN@hxkgj$p5Chcn&Qp3!ggE7h5|LcVK@Pv1W$jLT+QP4a89?(
z=auqPY`m10e^sSp9doVlS<7gLSd@J21+V=KwVj146C4>$%H;;M=S|-bFE2J+BoIve
zle~4TS#}C))_wj+bafs0Em+A!T%AY4<>n?<^5nw2bZ9gt{gZT>OZ<~`Dr^cLk5Cwy
zAbTB?cD4fmL0ti3tx00U9so+p6Ob~_4aAJUKw_MR;TgR`H&#)FH0|V+h!XykBJ*MD
zLe~uiUl{`gM+P`vP2h(zE{c)6nG3b5t1*#UR`xh6yl=!?lGn-C)4v=bdJ|zJQ#bO{
z$~Jq&CPF>+tE1G6@;}2)bnWR_@;oDn7I2Il{k61~tJx;L=8PFM67JLz{=d-jh{nXw
zRx(NSc`l39$RLFB`&`>|+H#`}dTvg~afPM_)t6eZ=($d6IsV73L{buM1={UYIlKhE
zHtG+#XNL=XCH?%OX+N#}kTMrC$%`;!dvF=WY2Fr)L%!DMb+5Eq48*WrZ6RJ%yL<!H
zLpQXz*&gh&KsCkO*CeZ9&#~apOwlE({d1P3;%>jfcHJr(>zuW^x6D~que2SO=ZiA2
z+KgqI2SgiA5D6T2|24H@U-Gb;v04s5G0EkteIp=%Wv9Q_6gPA4x`4ke0<tM+QswfB
z=u5e{OmY+VWx?R)nPnIPd?lwUuPb9a+_IRz%Y}RqDk#^bx!d81CksmQHUa8!cLEIF
zxO&Ip@4Q?NgP`|`yRL<J+anBKH(Cy@;r*G&x}MooAp<--I<*=%&M58}q<DK=t$FjS
zKiulOLh&V4e_%785RibIo;c?`f<65pr~5T2t;R@QPu>jRRN=z}2QGX}9pGY;Rj71S
zs9w$hy?1ck5>3fEmR9AXV>9Gk{_3DougbF#o?KPB<dOWqjU|^CWB8DW!B+AC!Dq*X
zY9~97%dn>D)}GMRuGU68w{JSq!w;CC4e#Spik<{WHdjeUj$73d4=<h=1hyacVCLTa
zl=oL>or<ItnOfo*Ss}Y)Xmmg_B{m_A$gp$|DP|+<7SQXHO>w=O;C<;5@)>1b-dTaR
zsDCS#sgVCTp#b<^t}<VLa<y!eJmm^M_ractXBys0`|8bROPd^;U~(f38K6>b5;()Q
zI|mykrNj!6;1sJSPxmxqZC)bZ`FhifSsdWHv1fkhW7Sf2r`fJ=nx5h+PMZQjwj8g4
zXI1lsraEX#Z<b<S@Ad#zVsbo>>11pYI!nWy!@sEey!2(-*Wq={L_gS9zj9@ih}OFb
zom|Z{nH#k$<~o<x(qm~nGunA?A2Olmjo#3BSE?1COSmMQxoj!bTVx8>5?dx|?|7v#
z&3{gQDM-z2F~RagF!|XbTXJpmIRc4~M0O!ZcZ4O6oUa@xw@~h>WaO6Wyk7<BfwUdm
zwLYe%Kc1&{=o{{t9W-%a;tOQQn2CM?HoZBm`aKylG+TAbX=`S%9n(lQkTJt<etM))
z7VwWMInVDYe54{`6Vwkr)YGAybxSJX$L?+tQ3LNPY6RYBILsR|=IrJDpL}sqxAcH$
z^L8m6E$U}?ZTIE$M7+WK;ZmKcKep?yr&~raEiqpsPw`xy@!&RGFu53Mfg}mZP)x3$
zbt<>*Y1sL(MxMp6wLL)w_>XyJuf_A`K{R+t@OI3jcCZ+M)ABJU$f=X^CDlJuz;Y^M
zGPnB`Onf*d;<a^uhHlHScA;B)?)+JXr7~r)dcxpaJpZ?*P;4DO{&S!`mOj`xS!Ghi
zZ@tD=9ZT(Z1~!1g@jdR7Iwui##R~bsg5jnGYU|#}lg~=2_`BtMrc<`<)?W}2o8?@J
z$mH0Y`o~rNsTx05kTp-h@7$34!_1JGrW6&gJHn!z^Y#(CR{y35vz&4*0-$Jn1d$rr
z&TO)^K-OQ(am?{D4KF_g+i#(u2a+kmk_O@>n=ixI<5$#lyCt5jj7$<|Y#Ib}ax!tn
z8vKW#a(O+3SVL;bsht-=d9-^~?uaIw-;U)fdcbSjKDByToXLo!*dY=D3LmII`Kj^h
z9ND6=q3w^<NXA|D5&fd*+=ZY_XEKU3%0Q2v-8atuE}7{lFF75GJ`_i+4c%3bRjEst
z18HwfkS^j~r4Vy-<BZ9fH$LT0Z6Z0*Hf*n$%KdBsB+4f~U(308r^reD^znD9bL{pv
zy&6|Q)Z*wLJlALB!{Fe+?*hh!K0wI^{x%|HgmUWgg>bgsz`YybUsyH^l@<7pTV~6T
zQZiX~fzhH+JJMoSG$Nh0xLEiz*{<c<=<>L~+Qsy2D?%|Z&4+4~^jbN(W~#yQ`KpA>
zxhh`T)$jPgN+M8QvEtP9+GKk1rBwm4^rY9@nhL^qfz+$1nmo=6`v*~rgW6I{kB0!u
z?11D|OP$YmxGS0%p7o7_B%X0N#J_Z{HX7Tx#$j-}a-P{(o^7Ppp)=2_L7u83vDL?k
zORRBepduPt18|__YvW|EujIpuTcv$2m15ksia__HJrN)Q@J?ANQWY*URU&&i>rRaB
zq)P8~78_GYbq7w(kurR=-j-xt1ry~oyLp$-4t#B(bvTxVi#o3WCPne9EQZaty`Jw%
zN0arw=)KyM&YKx8a~Y1OMPD<m0{T2CPD`r-a6zrU-j<7tH*96PGr<pdRo+RQ#T9YF
zIvy=1_9^e-V$uMWI4oj%e_FZvUb=I-u_`p&pYR_Yz}|<eMcKg#|6R%zQG(^JlNP9<
z47eqifcF5mu(-EZ>e$=cZ)psj<X7Qr52AG$HOY)+yZAY*_76gKU|QzfOeSBHF*Dx!
zW}5z^INua&jnjXi4&Ox7CDK`oY?D+auH~6M6&hX#NWnR%yGcEBff!J(2QaOos}gHQ
zi0){M2-mCp>u-BQ*lS}iigS<%U;Hj7Q<m&YTdYMY@P4_iD%_*+#$kpxr!r^dVL|kq
zbAuXN^m|pvf<6_UOs|(ieNLNJQJz%OAGljtk(u_TmVAppedtPPN=i-c@3c;t>zH_M
zns|x3=AlgA7=2zB*49+dtWW+g7C`5pF!j^Yh>TJ+!nTxg>&tPT9$Vx?(*C-Qymj2M
zq(vsGPc3gEhHN#<m!$=*6$eIa#$NBJ{oilOm%6do{!Lo_j{fTW!$zI4i>CzlQnDIt
zUUv_r2hFF?2io-C<)2N)zF&1C8+dFtqXvC5y3tK~Z~eXooQ%ln#;VcfFS_<`Wqf<)
znDM8ATCdAT5n35-9sZKE>3tXpO>h4<e|x@`IllXSL4Va?L)|J33;Z$?AiV<W_S&Ma
zyx0!dz2Oz~_PAEfrLbJ{t)Xd@vD_H5;Q>E!mJYwwj@C?blxQ_CR@oLfDzTbR%I#4p
z<Z_Zv0Fq7r*l9Z*Iy3vaR>)=6U|6|LOVm7QmQa?nwQ+AfA@zwMOiK+5q^O|P62$ry
zhUTch=i0njqq3`7O^79>`aHY<gqTV^y^EF+RWyK+LX`g6?&Biis6N9;0P#`jkCA`c
zaSv_)Wsg03{LUKEe(fm~pcorCUzlM~Ow0d$&2EoZaeqw#qKeHvt;v4_h|DIlGQS#W
z&6>Rj82L&y=9nv6uF2qJE+x5`c(K>!rYanL9D0K}E7tzedNGsoHY{QszLD>|J~syR
zrGD@Y&>8U6c4ib~SWXWgxv_3p!2@PgbbNG}*cN|R>A20e+%eX?$@>h_)X>5%D>>=N
zkT#Pzhi>I0?y9!MDLVyqYnDa1jZ*4!=?7(5n#%`f@Jo$H62K-8%DnWZu=P9^+CYDt
z&CMU>G+l88R?&!#EpO$aF48V9gcE6Zf|_lL<Ww?JH7P%}gYEd+Q<MtqKhW2Ch@Y-E
zs*XwVVgekz+y2uq2mzF>E=%UznDIYtOsx;IN~Sq|U1S~`lax^mf0~F5>sYN6S`SK&
zGxPJn>$I_bZhE{>FbC7YaAhP3OT;2);{1kSJ9L??pq@*8)$%%42R^2lmyXLDwsG#p
zjzWnS`!mPp_Er`7+)xgWj;6mB9iz5Bq6<yM(Ca)c4;2fhk2l?FHh={l_6f}ka@zPG
zNAn2)sv5^Nj3r~fbu#A_d2=7P=K%&<&UO{cw+oUYIYeR~fDif$c|UXep;UMsz1Q6$
zXHRDF&3luZOzym*vp#p)hn`g5d@LuQVsJ%sB}F5=*`DrS^eSd?xz5%V4@E!|Md{g*
zf^%R|zS-{wzlNdAjs08JKa;Xa0`Ghv53o8<gWPOT)R8OUZvfg?e@mf-%Qg$C^(e8E
zR9{SMxA7kvIQdqE6X{1O<nO*wy{8@HwDbMbRV@sDyWjnsh_!BxF4z}|TU6v(JLTei
zE%mb~*4dKrxp4`;)0dRCjxc4duYE0Ua3@czo3J97Y$Y6NPKN{((>htf032XM0PP*Z
zCir=u6r0Q{m=vV!CZ>wRZPrq+2&o(<sT>Fb8cvE`Q|~O(9|+BaqgXnV?%MB6B$YK!
zGF-CAai^7dphk7e5QS>89Kt|5lF`lGp*ojI=K-<yOSzyq1i-$Em0W@NADt0#h{xNV
zFL~yQ%i34UtwDR>3a>bk&e-`=46nftKzj^NU()Gys@*(;f(w=4XKy`DFh8l*^t|Tu
zXTp$r`k^VtlNQvsZ2!TcvlyG&AMoZM9|?o}FQ~_(1mTZAYO9m-|AWK;u~`!G<_FAP
zM)(61h(tBtOv_eIGy`2w5e--Lv((I;kE*gjlW<Ez%8i7zTzrXMf|Rgws*LP}9O(zf
z*by<@2j_!B1cGF6xY2EM+3YLWnG*w5uT2o1bJXlfaMmvP996g9=xdFu*qmSB@>sui
zV>_|78=)D`Towe3b9L!W52OtGeqpq&CA1u6?610X5gY)?x&C<mUpeA`Eik=Bv8zz8
zY6A5Cn=XO#rS$4}z%w8xx_gxwJg?b_*diJ7L>BB=ZO(XU)9=Z>%xL+4C<OjDO~C)c
zKK}#G*4gG~_FrqTL+x{x+xlmj$=^>u131KnMSMkrCwnKJzet?#0E0VjXvz9!MvyV6
zAzx4SyfM!R+#XP*_a{X_-XT+}j~tv1JJk_a6ztmR26%ihHPbBhhfqBmTpuq50g^-g
zQ+qUaPbE$pywN934r$l5gkgZ=tur4t#i5!XR_deE26oi9U}>;ldMr{2BFxRGwdbb0
zo>%NK_pPx0dm_bYE>Es1-rKq_rfCiLyMgx)!4D|aH4~G0Wemh_?DSQMt&=itv`mdw
z?j$XunL_{NvB#UhM0VJk<aY;ry$I2cVp0m&BQ~U5fq<^=h^5zN*eT@c?y$5lQafZO
zI-TB85*xkG7XTz|_RUwgZ;f?UbU%^FpHBQx21b)&pwYPFkiSXS`>RAEa+7@jIpfSl
zyGflLQF=+$W0Zh*Y3>_x|9fP({j50k6Ez_sFVq*b)vZ40@IWmKM>2WvLMle>U7w$*
zpyOb6$glm48yoIooi+6|8A`P_ipGC{%*F6C?z_BqZ;Fp}rM)u42B>c-m3RNbF~g!A
zMceH8^IMcz1P^IRh~7wtvEKBESau&j=|s`RI$rcdu`Ffz<DV{5f6kz}Ck}3VS{%%>
zqMU~r$-@9{GN^LI={5C?RfstE{Qbhzz`Y}5xu|ix46|ZW>EG)lNf*8ZUvv&x@4KAh
z&zxKLRxj70-o9~p-rssO&2B00l0MfPO`*!@i%~u>sl|mR?R~k4i$dJ=MY6nEIHsTD
z#}ybuZ$0R3%BNZMi-_D;vAjlNBs!hk4-N(a@c)~w!A$bZZSQi_q^Nqh3bCz73WVk1
zf+f)upcLh+TlYw9vRu<uw}!#c2{)emyTgWeVU@W!Vk>-K*yEg=uNlR=W_P#zFFn`J
zK-&!06VwYlF(6Uw4@!~Li$HC&kzTDf-~Trd)T)cm<tr(Gul=Ap0sW&2O10cHg75qL
z(%TTE8vj4g+g~j6P5s6U!Lc)cctP~3i<vpK#bt9ihZism&I1H5J}660JpTHc#t+e3
zDsUFK&7%o1$*bR+8ywYOM_s=zoze;{Gf>y0Rio-<&i)qac0JXxD!x0`ypSq(sTTX|
z-<0B|3AfMq6!)Rh3fYY@6iID)6R_OF$Uy6~YUs2By`rOQkT(#qDa4Xv5PBQd#CEg*
z6KyAPMa1{Y=#<?)%E%iJZJ5`Icxrv+Z2$j5EwO-zN)YT$W!Rof8?wD%j;b03TI$D%
zT>G=@%Wvi%{d3IvPWYD>{>7<XuOo2ox2lH^tp<N!8t6}q=}3<b0_2(Xt{o#W&X)wV
za$v?ITXzlpR-qv6(|E^T_?X2b!sl5Y)kL8hZCS0jaZ~-anf|PcBAX{c?<GQF@vENP
z^o{QI;s+ubG!hpyku*BO;;3s;Xoh9z&ItY9sHmv!?~*7sWuM{6<d5^ig&?I#pru5-
z+9}*Sd3yzaCO|oLdb`6-`U-$aTUXNEH?O-u6H`+S<N9WV*p+_bJAx|tHL&{lJTAFi
z9XCDK>iW|>x67Kr<(z^?3MVR)PCroz{tgmrU6ZD;Mnkm|EKp7qfHZ6&9%F!S&~CT>
zyH~7$L>VqoP`=Ny;bIbW+FWf`qRg>DSVOSW+W{Q;F-PEbaucYw1Ct=GsY5rya=M`x
z4f(=E<!0&|&8u9QjO3^(aFoyPSKv0<#M@#IFca^Tcr`|Ja#HP7P_hGB(#q|Vt<aQg
z8z<51xMN*E2Lb74=Jn7qsN@GL7x%+cRQtYC=Iyn=0AZH!4>pfMo!6hpfI#1?C;rRo
zKfRLQ>h_-a=?$xe9mx)Af2Zwz<Ap(p(<_pu0i8z~JHPencRK4+ISCt)U}@B;%IMH8
z8Q8WBGsF>hw%vme1nO<pVBdKW-+0H~1t_uDJ!}<^`r~`z3H-*q3IN+uGY)vOvCkoB
zh4`QQCKy~3?<^!HbAR4DKOVV-lm^5!49v{}RTT7vyyA8{ktuQlLq7dV2ZEA+`lZNL
zvW16HTk^+Q6H4-T1NweaoBJ>l$*bctZ*%_yt)_W|p#**s)9BI^=n|o;QksF0^<D9z
zkX@S-<*m6f!NU{h3cDVdO9bJ?EV=cHnEMUtSs55@G}K?5UO^te3X)dntUeZ~UC3Rk
zqH&~NV><1gNJOu!3aZ$j$aMG5ElQc%HAzaI{P^iSIoW3&L_ZP=0&5wSTfwB;3hPfp
z35Y&Tk(bpH14b~bOyZkPJFyI#RIa7j{b2y;vA!!GqVFG%rYO+WHQNpU!D*0Ba(OoG
z-W~V+1YxG3w!Gb*o_Oz>iCm#iV<wr~NHkq<FIK{&cNodmhM5mwZJcxAHjPYH)msBm
z)<Kf)D8f5#&ZU|cqtOG}kkG>v2kNn_M@#1=imDLB<J2Re)%CeyF?*f3;<6I7hn#J^
z84&aMFAhX>QLRiv;he-#5TnT!*^alVRTLt_wAvtxRiZGOKeOMWNle?Fxixg18hvY>
zvn*%AM5nV5<?cxNXN!yTqa)+JKoT1;y>$xFRX_q%iT#cUo3>?7FS7B_GJZ!SYm29>
zEzp&Pjq*5T%(#D6@TIztRZ7%GVCDM5J%;7NF{VScM`Jy3_JM;C0f!o&S05$m*c27f
z13%!43%E{yWS(xZw22tl+Jne*eku~1Xuz}!2{aO?tjZd)m)pciamUS9Kmz^LSL9Zx
zQ>u^w4##82ZE1LOMdu*tV!Q`>IEp5O1X9z(MGx3(&hb<Owl2a^8l@i;rIkHciDNn5
z{9#wNT`Q48cPD5(PT4#KyU17DaU}+M&cARyCSHlnmLAm=U+-Mcr^j;!hSS+|g29Df
zOL%$02euF~5+=3oVFdWKU(!hHf3ZS;`Yp`JRYyn+4k$DOpg?{D`F*iP42J#?)xwNH
zou!c-Iwk&|*^)7{jKvwUx1F}^4{;?CKZG8PiVH<fqWK-<=F^5&&Q2K!hp;8t+c8O+
zJ2lYCeRxWDg2%^)%KzF&=TKCqjOOTWZEOgKuB-zGqjs1Nu0uqnzJ~B`OOSZZ;=<Q&
za2!VVXu#$>5&b;S0YQDGsZf3QU@Im~9Ago`bxrz7oVxx*(q{GZX&u#~MRIM<z*V!B
zJEMd_ykdNTkh99AUHpsPVDqel(TLO_wd|$6pZvkl-}iwsr}aCuI5h~N?}7~7_^?=e
z<>zINB7QSJ)&*;2hZX?e&xVjQ<ezM~@64%Qk~o5&gcDWH)g!ZYs8YQW-CCVDap%B-
zAC0je3&#MZ>|vDf8v$vOM-(!a#&!;mRk`gTI^aaLlQt<jrSYZ2EcduH%_cK7_19?V
zE<s!Vu+ujbj$So<zMAZEMUru_J{?1NJ!0(t#n(4SNBTAEcI=5JwrykLiEZ1Nm=oKc
z*qPY2or!JRHgC`G`@VD5x#zC?U$1_9_4{^pRqeg2>UkdALB!~U#&)ViOU}Kpm)WPH
zXMK*ZWa2}$`UZ?IdF}KnG*K9K=R)tj%Oz}z23Xp}=6it3E{xTyXl<(1DM;aG4eL>k
z%;z4*5+*fS9r{$6`f+FN%b`Dw7z6&2iQW|y`=B%kC*QT%>!`5+=7b2>f&-RCF(|BY
zThQVmdxk?32ER#j7zE>-sMA$!jZy^rh-1@t?m%S;Ij+bi-g^s{(p;4?6PDSP?|+;P
zJZ6iQJxYZvGQyDz3hbELT&O&gQ_KKk{$P@=U8Pk{b`lIjG!M$*eQhcDaX$@&`ZZrN
z@XHR=y7WH$^O9*W0A;2NBv*4UA!Y#n%ix7}6NpR9Fj*3T69d}BFoo(!BFdUk3%gEn
zlh!%>r=muWJr0$XaGa5fp&*bzK_Ebn3sY=jxcrO@7GH|jT!2QgU6t3OP=~@%cc`G>
z#M}!NgD0rsQxRRoXd5;`l1g!oSecjn;-%PSe+p^bnLuLCxMl1&RkBW&^bw~m<)PPp
zS-88YiNg*>{N=8870&X3t;uxqLvv!S*G|uRT9z1Plz5zqa*Ixjzoj|=Tz3Bzo`_4T
z{1tW1WFg)FZx=UlAMfyYc@T4SExWRb>PXi}L(^}$(iL&CheRvyeY5ixhZ{|RT@za9
z@{HeET1jHYQ-DsHiKHS`lsH>-#*td;xbgwq$U>C{6PCdG&m1s>n_rS_owLTox*OG`
z%y3()$=G#!EM_Jw#a1{|newUDoND(C3Cb&%&UtvE$Xws0WvcX?u5g4Ps`JOCiE}V;
zJN86mdxERtE~2!|NXWq$szlKM!DDszQi#9E^Rlt58VNf9iOlWoamr2JhnrA(Yj8^F
zN$&tD06F5o4&~Z2f4*|St;pqqxJH29xSKikN`d|~2c{28RtvHcy6~u>o3Y-LxZ5Lu
zo>fX7!wI&xRnNW|{v$4h8&pqpw-G|T4uJ0YjIVlq6*aI6mTu1O1kINYa}3_O3;@@+
z3+O@yy*{=w_cB0sfZp90{3+!*2WGS)C@t(BP~aQu*W84_=M71LU4@85vf`2VL@4Q7
z`M#YU=5u2Q2^|$!jW_Sh29;d};u}g%rFm`Xh0n2jn2E^-zP?r?v1-Aot8+b&2R+;~
zQ!vbA0Hi!hiGj)*^phMeP`@K;<qJ|PGCEKzzUotI65I$_#A&8s2yx8Z*~8<(L>0eN
zwxo=01h!OEK?GEj7|)Vg%iz(d9D?G4wYD|-9li`BAOdRl0K7~sppkcO3RfGZ?}x6Y
z(BP69Dgj-nzxMn1M`bd&$m-go6!8I|j9f+Pm|Ovn9D8Y!Nzcg%dI$m|6G*|byWEel
zuBE`N2`;xAu&(|BoY~)lTPR2z(pt0~)THXdCREJTKUz(PyNhQD2Yk0KR{VKKH>XT|
z=_bRg1tP%rYe4Un(0ViIOj`bQk=6`POdkH;HMvd-r2AV|tAD|nfo$jScb%}f-!G8?
zLv_e<DASPhpTj1q!&DAb&Az&UQuYtk94+!2pI=bv#U&g{Xu0U>Q0DH=R<i8$|BU9J
zMfiBO(rr#1Oj>l!ZD{>qzB~Uj|3!YD0*!bssGdO1BJ1u_sH7hhkXjV9Jv)&KI}pYU
zP}7@;LtYor3E#J_nn$BSu|{3b`O+MyYBwf2vLbJcwy!QfpNNVW%J!6KWWU!w)_7N*
zrKJAHo9h)`Xi%X_nac{U>}2rXLO7ClBn;BKb0+_v<vLMH{Q?Bi*KIb71%@gCm9NZ0
zpOCYnOsXd^`Zm~ML#?y4(CpOS;<3tUScLB((5;byKtIlvp-e|Ngylh{LglNcVvB#N
z59xPen|&h>l3S(I+>RAVWEE4p6h~I|>1|4@lE}Pb1X&GJS*B0w#f=fZ5=#<<8r!;q
zuKd3&^2l6Dw^q}^py^cN`@jFZ44f9!ZO_HhXO1jt&$J=oS10*L?09U-BADez*)o^G
zyUHOHedScTZ%6^gCfog<kj$|5y8ibt3h!;e)CH9=A_1V<baY59)MCi;(uustn1W<A
zG)`3n-Eg(Da8Z>ydMA^>?!yQf%q9zR5_Ihq7NrcJZw=X*9t5?+<f?U^jk_A*T*PF@
z%Z)pfogPaN!LibtEmm0is#qTbd1E)WU?@kXS~c)Ntq-=4)jyMdt&fYp45QIIEet@~
zfzxjG-}T4(WiUK&4rez83MiA?9@07i%}0Vm?>+agYaWP)8=Nq@v&OXSO&*QYGb29<
z<Ko!4vwVvOb7RAgLar3}4g){!c24h>Id}&FRFEI3OYMr!`U$;Yg^W{d4I$QjmkLeY
z)5k!P3kqm7HXP_nnMa5@^M_9;(*KxzvV_f&?aTT&Qi=L0h21edco=bYDe;6SeN*JO
zQLIjfv3UN6<1+E4=$cI}(RCv%Xbg1c0AwN^?j}fz*ZEzE84~p?n`Tc9Of-1p4mU!9
zE|39I6Tpa}H0z_)DK(Nk@_J9aW>YxR7#HXY&O?tUXF=RtqO)s4DPwqq;EI?tOa-Ro
zgS`WFt63rfehCV=p=wD`n8ch4gj0>1JWVF@siSrNU12y}vL1O&T8=2_vfe0AgfGj*
zF&goE1H9;g5k?@+lRV~hDyS8%0Y?%qBnS=9pb_IpleVwyxa9{!8Lr6g!L_c{ek6Fy
z+62@@e^9ggVrfQLd2RJ{IB;*N)oIYgPhb!lQp6!&+CyP2MtPs-jbFT^{HeZy)xd!r
zM}Tk>^s_?QShyoO2<;3@VRXR1v=Vm#(wUfnawzVWndVqSO4cCO7zrO>Od}w8wtq+?
zLQO$ZAbPXVbemgA`)tir)tjsBvdn0}VxDIr|B~!RDSG5WLja!iT$xh#{0m(+O1y^x
zji$IYJVRt0*<VOwMCh~zjt|6Q)_-Jd3;xhNS_bO3w94ccQ-mmIonOoxMjs6k9a@|Z
z418(7p3`e!6%)cO>N?qER<0uhNMa-Qc3@B9HVi`$xRgn_ND@anaA9yn<ta18ZSV5R
zc;p8i79^gzd?_s0;!f|X3Hg*fJ|@WiQ2Fz}yb!)}kS<>DrGlTeLD+X}wIU#x4XI+`
zB7&;Z0w9X07zmdTD1}NO5zK6dHY|>&F$yz_<$tw=K-GTo`NT+9FsR$9k8;?#MP@`j
z+b=ypbdHyQavgBP*Bef7tLr=J3~C1M!Pd(PON`>`S<!umK{_iO_Xh!Ts<2quN&EkS
z1}xC#Gl@9+8(>(Lr@c^YoP-Y92>a-dYb|ZKg~e8tgWm(h2-8CWDR9_(`ZPSQD$irq
zE#j5nm%!;C9u&T84N!}mE@>|XuZ%Ek@ntLCO<Q=XRjTvV(NdA-A%}HHD)Z3Pap)^>
zxtujlrta^)Y*iLmp_#jhr69fz6WA%uDEM|*bdmV$>LKiZoo~@WdZOYtQ9zg!Xr1U3
zw9i+1`xi870d^L+05zmsJ7b<0R|ZKs2U%U2XoF`ljgTJJZZ&Fq2MdYoGeim#)l>!`
z%b>gR+aUtIDN0m(P)sYt08ar4zr=Hz+UE1bTf^gARB83cx&@t@^>c8?2W>it?=I_e
zzEB_v$u@|i!Y%IFytzoF2!Ptry3sRLUGOzjlOA2!dB2)H6!oVdS9C_QhT!DG{#S~p
z=kVB(KjI);Oc|Hh0dFRTma2{?C-IEAw=3pUp|q||v_taLwZCzB+Q(CosqEVfAykH>
zNORcadqkvAL21<G!>}@TGm^^2mG95&7VMfUtv24QFg%*f&-6T58E!d@(DF%DA~dp9
zSdbar{r5+C2pR!|8_GFIQt3X91rOMNuu51rq`=HYD95b!m`|T+WNu)%OpMOaOW$~z
zJ@Kt)GmU>3!zYs$*;U$sIo#mTGHAwW!SsO9gHPCa8pUD>uzp)JQ{783xblt5_|z!A
zHDT{T8>XtSAuV<JB0D}aGqrl9O>p-7WzrV7edN3!)ai?Tfs1BIiOdm|_l0J}BGe#M
z>w$mz>6bZ>_Xq~K_k#**`8v+~vs~v_W1m0YZndel(aybP^$5A)kgPh7Ad>yl-Sf;1
zIqIH+IDC1$21o$G31TnGa7)=?<cK=zE1NnO4NG4cngyEFO=nY*>{nt#i6D+K3+#H5
z*y;^%v;06?OF1!`ZHp$s#`RzdQPe%y;!fk?^6GG;HyF7zHxh+eH!Z_~<*{<#dIjF<
zDrEa=W@}rp)crdhS|=ooGn!<??Z|nD9lwK|IcgVnMDO$B<Ops3%d!J{()w@uIUTwj
ztZ!WT-y}wzCD{|}_%q_3GgdUbrj`p1Pn3_hgs7%}f$Q}-V@}@35b@|DO<MA_Ye-@|
zdg}6EnI(?VuGr5X2%O!S6|PgDk<=IJB?FMYFO+H+)mbfmtz(4Q>PXP+1XtCUMgala
z&RFs+$w$D!EyIPYh1B6HL@@g~<ATdnWa7eJBu?v-uARD2{^r>tS%6Ii%O@e+()>q+
zoATnbX<D=8R#AtVyuKvrAk-$rC>zr8TagmgclwCmI<|*57!qh{qjqSoEBa_?Hflhq
zh5{8uJBirZsB0Dlw5^7cBF;c<JOo;bAkHCcW*eL4)HJ2iLS5+)x3=w4f`-<I^ArWz
zkGb9&pX*!;k;a|k0XJa{>KWXHCgjEPe9X>@P`}!=<gjMI32Z`kz0u&Q!2F`WqD9*x
zS+Kir0iOArvbrG}S`PmGE94%EDg>tI3EQPK-O1KSG8UR|5kKb~f}lVw%z}e5#~mcH
z$H#Zs(o88d6xl=&-K%~1eC%{yQ0Zz_){~||Jt_+!)5~s1W)5kw(!(vJe(CN}Fgs(i
zgDNqVfD7r0sQ@T`G#^=OyTkjZUF@}I()hAi#mLHv?e7Y=HnmcOLcWnste34dTQCfS
zZQ5lJqkbdzZeF%|WOOC<9~DeQ;0$8|D$KGXyK!yRK18)RDFKg%3iTmj0GilIbVut~
zg(_!71vWs6;c-iu^DKmE3Fsl5pU{tDZyMNJWOiRiw7qpP4HG0Q{%}W@nlTn^@~cBm
z1+5&MHhCX>GANu5Au<ui4x1wS<C%-9{g>ZG;U)ya`V{osntTpDAG#W&Zdw3`&J4Bw
z?=FN3dV44#3wYrifA#}fil?<rcuQTy%|_FOY2!?6jqyHWT<~NXD`)B*OFJ*%e}i05
zz6wk8Dw^4VMYY7-hEepY9*mh`D^Gmb2_3x1Q$YzxUwk>ypf@S{M1qqFjAOAdhn^_3
zz)@r3=}6~tnLp5xeX0wWqZTdBU^ql`j05BBx@WtzpgCTi2OFN|BUaT8n&O+Y?ociq
zuEkh}O<aaQ59?xpo#ae&N2@moFiJG?vsg&%*mcgLupWpzs~?*<_!?*OLC8Hk2^y9~
z;$%6*%vX;uIj8zf4^ojzBwQwYPh#&pL#?6Rb@`b>hC6$do(`401mQ4mwP%SV{>!6%
z=l7Y$nEdd{w`!i2tiJsUtMgS|%h}FGY7UcZ<?@^pF(=K9*KqZB%*_u4LGN*QTH!JX
zYnA|VzHiy-|Ct4VTNznTqdk&NSpLVERcx2yHH1H$ISH2Q72t+G20{vvm&5bWcM(iV
zQrJ&9zVRytCuZ_RHZIz23*G=LvwojQmVi+{n;~HhsM1c;xYFZm%a-KsHYmY{jARe*
zE;A)$JhAtVy)#1qk|wHa4&$x=&jR6w;((Fip$kK4EZ+wo;u2VZzXx%&m?G$yZ*C9l
zMA{`T)$eFBFr(>tI15XH<h#pYb^IYjR_=<zT6lQqd%y&1{7*CF!Y?8*4Gk1stcIKo
zj&^}aV+1ifcqvWT2ZN<m(tQC{^R_y<Hg0Ev%{Bw0II#v0nCy7H2my@D%@0;P_I+Cr
z<#HAW-#D#Xg{uvHvQ*(NDEp)E6dq8c*#@}!LwOEztcWgrFpAoYj=#Ctf4$HNaIDI?
zX4R4`)mUq&-sK-LsB8I<i>+Umeju?9nR+R6rXpp)v)+ArN-t0<>V8Eg(%_AUCa;Tk
z5)DSOFH={Bv53*;4!e!t1Et$EMOjXLFJFhQT(stl8!l&##A7HXmu9^X<a>p#bB|?T
zRIC)2weghy{b)C_NpN*2q&9j_Q2A^57)`OPsHJ!a!P_H$4YisX+B*;*{nxMV`pBm5
zz0r7j^dTF-YjMUGh6MwJqRsBLsQjb*E6pksaY`|c-yj`r^u<0KJv#od1qZWH5~@>;
z${3&o{48@Ll|AB>#YCqw!!t$4&tjT;Pia1PO(dR~^GoZFcm4Bx2%0#Yij|?Kb#hF6
zs8(`U=A;7LGIZOgo^~*3(St3Xn08w71aRbv_3!0tDymM^O)BSVF^)>a(~Jo4iVs7B
zD$xIUwmqWm!TLvF0J@=e?sEUC&7#Zf2~|tuC)-*Z$F)GQ=p=H}jmjtUfp9a)&UByU
z?S|y@5;r=xU)zB}d}lTj0m@pJ!f5gctjX$rxPkVVw(e3tb-CT8!6O(Wnf20+I`D8f
zJ6~{3v(IVCmD;fP_3$b6Wjgc=K)hc*Eur{ac~pubF-g2;|5qWOwlt0U1ItWS@I3kf
zB^Pb78iz1_8>w`0`QP}8TcWs1?{0!KrDBkRNbJTx*5^Iv3X9=2mzifIQf{iEQ&j-U
zB*2y$H0Ti%cq{E??HJ+jj59<m2Td>quus$^w&6A9r1A4)+vApTBmiqWK6n#i>;;z7
zONXI)h=zOmKw^N6bqjT@QpG+0cqyIK)$qKezadty(RKVBhaLWbbo+XRN3gHM&dd}j
z`Y5zdeywb9`;^!>MVwf1UAj4n+9gk@M&GrSkmS#%XwN|ZK(yf;puI1-Dx0&WK}DvZ
zBx_M49b%ho)ZgJ|%cpwgJ3ydR36UN2h?-`mLTrTLFtig4qFz^85=BkU`-$`+DbxZ*
z9vN7J6yeIYB5pX*52HVJ&e?_)j~FTObcbXNm*gFS{Ae^C@$^h!tU|<FDTuGY14Us8
zP3$+G8hWbpX>=?>x+hR6VCWE_ISjWC_|un*+R#h!9^LV7_sIKH8N&5-_La~TY$3aj
zF9hHI>Tqil8(?V2)c*DP52t+j_DM@v6;0ut=)D4IT7#zDu_AnW0E6xT0Z*(ZyroDn
zh3bbdJTl=CJ62QRR>YxQHOf*Hhx_gT4x=-FQf8&&lFw%Or+|@)|5MDcbLMbEHmJJB
zHoL`ROcej-aO`8I+gMNp?yxh+9!iq)?<59lMNAz3NCatcdBUOsJA2*oa>-fBa35q;
zkxF5oN-YLJY?=B1jOvQHSF}o+_@0QQ-;IdHBlB_lxJAM0-i^&%EcqdNh8nRrPqtay
zZj0)A%a>~aA$qkE1vH3}=HM!GF(09gcfg?bP*C*m3QEG?yc#2Oos06OX5Ps>--KF(
z6${^?#@(V0JlJ8C?B79E{{U#DJSH`n(yV+CtT`Y6rOf+3R9Y$ei=YHkGdAUKBhm1T
zLy3EOhWSets)Ea4kH?WyaXf}U2qez#>-&_enUkDr1wZO4%#La6TyoC~6<`HKzqe-G
zB_`-ZO2L`EX#l$bB=we6&HLXfXTew8K??w-8XC3QGj3iw6NwM>6yGSO9@yOZa!Wd?
z-j&wq?K8!uz9{)gs%pbG3nekspydO#g^P~t!7$h$0O~5JyDHb*5Y|fv>Sj*PC2x{k
z(VDWR2wVeH-buInyQ>yId<^NTjRrmyB?`zCe>~@Vs7Znd(_&y~O<qb&4)6aQj~k_j
zK&7_odp>d@d}x8L9BRlvbG14Ls($dicPtgs5U@mLxvRaCw4FROj8g-vDcXX$*Tk|r
zQ1Oe7+Gp$9*FqArtQ+hs=G(YhEvr~?)US27SVJ}L!UL;pdwN5+an>c8j1LI;ee3N$
z>s`IJJAHm{h;*xnx+f!RF1QW2wv<u@122sSV$`~E3>58D&Z)AivibRGnK~5sZ&Az6
zu!%-0*|&<z8HlADR)kr)v9i7HAp0X``I)x4r^+iIs#%~WPz5@pmR$+1FjmuVI?YP`
z!b*(0<VbKRp9Ae^;ueKm<zzUU_<cr;Msw`tHY1KV+V;C&uLK4K$F%&vMRiQ1MI<Nf
zJpV~yLr|nzC|tC;qZRKyx841aX!d4?2b2x|$rGPOr}C=+=nu<a&TI|+;x}BtzIXKL
zuXA$;!EZ(TRpeVXc)?$7M>aC4vFXcmG1P)>Hs=%x`p_BC^2(-NA>1~NxgDIXnyX%y
zj&adfu4Xs%mn702mymcDdO;q**x0K?Vt=FNsphCz7dgJUt?#;K&$7@J#EYc{=}*8E
z>685E>h}eY`(yMfohb4%1<`(y&EEOs1U5dkIllV1_dXl?T*#@!>1ZlfIOGeS8XEle
z6OaS^me(*c${Ps$YV?j&&#TOJcXRHE(KEW&x#|p+t9H}5<W}x!S@5nu5~`L||E?p<
ztqG3b_tdyi{yS76FlA+`(M#f<ovKSnZA|4i4MZw~*#r^aUE1Q$Y|EsFniQ7<2Ze)u
zszl&({k`#ScmNsBZCCf9>&|<N+t#;y<r8WP?9TP-BO-8<?GM}YCEs1%J2YH8OC<3z
zN1+7US&V<Wu0^NfVp7r)23LaJY}z;+fLK_K3(M=_?ApZR(iUo`0>az<ajtR^zPsQC
z?f?}H1`=o8EXCu0{ZQ^ok&NYV59p1IKsyXCh#^xd98834R^B^&6dDGHNp7d&=TIxH
z6VqKfcBv$7#mZB0pmn$p|7|92C+%-rZo|ZPAw{rcWddoOd=h^z|Hq2|{i5EF#kcG2
z;YUleU~{Q!JTkuMMJZlp4_qcscf`qd!C#aA*N4^cS|@rJ7#L?x;~%Vgdnaq|Pgg!|
z5IWU`mX@nJn3WiKZ^_v^g58>K8SYyNwD{-TAD+I~DP*@Sy-X*15x3S>f<hV2E~emB
z{t;Cpt_)>4Pan@_K(jq+24$H@1Wk|3_h|di?Zn`GZ8rvk<wUAr+utclwZwHXBEtea
zaXq9MDzhd|7yZcyj4}b)HYuy0#Nh^NT@RzQPedC8pi}d39@stugIkbOQpO~!-UDs*
za|*KU9ON>+ds(4&A=-XktJOzl#>!UlE(f2Cul~p3Zosm>Xi#SBjy9or<FpBKt{Oqw
z^uL~Khk3$8m7MY_SVpv!xnn&K!8CFxwDJmrFxlu3o%RL7OoXQ;GpFzV=?AlHMSrBq
zR7}#sKW@tH#A;=+P#%SVAMG7-Z4(h@71_;}#aR#f9ph2F;Py2!wizQ#AoO*hLgxH<
z5hS%tZl|RRnZ|HGb@Y!Y-KE-LfZ?523QkZ3PIWDyqSatVyxpw(&Q`u>&id{WcF$w(
za|=HT3W|gTE$Lt?QHj0vDXslxI^)B$#7%f8G0C33iCNH(;|KFh;_*2>5hhBY&mv(S
zN}N3=|Cb6XQ|}mRkLGoLd|R2|51ZnDn>^1%vW^CJ8f<Iy>Kb|YGs>Hxag6zk^<eI2
zRweyh-^*m2O-~$fFcfmHJ<wwpxdRtU<*|}6pFqHUy(<(ZMjEpAdL~<jH>^XMedc=e
z#tg6ZUMrriid=ML)31c*<f8_;0M1T|L8QFjzD(5y!~d#Rr&wCxC&N0|f4p)W(L0C#
zW8C)2RxUEz7v>xCJ_3NOMg5)&odAji^O-g4w&(oTZVVPc)OWp0_jG{enY8ZaYR~)e
z(%RSnMzH1gt>N=>9shAX)GBYgH#RO*E{XL-4HX^}4eFT_Wy0EAEeRGNc)0DR|F!ig
z0FVTme=&$EC9i!ekSP4AfH{ko*|&WO2|H{`>j9RXrF^OeCS=HD1`8P&plPSi!}kUv
zHjaG<FVI~scI|V%EeZldfl}jU;dms8MNaEU@P2}R$Cnvm>zMYG-i9yMMu~|v^SHZP
zu%u92vUybFX2?h!pbx$Wd$t~ps7BmS+c=(#VQ{3e_5>;`1rXq^KEiY23JkmatsS7(
z6KIA(I0c0i*A8{*9nlXfqZ*1G5b{dG{q+KuaK{{ULoZm^S&yo6qA$*|B9t=@@u_d%
zgQHOsafp<l{0-Vd)ta3+v=tIjP6Uy^8WxwTen=E{qw@PN*jsf7ILj+_GFw~da6XRR
z3agrJqxO2Z_~0b4w(TA&%q47I!qm8=aE7k_1w(|4yfJu7`~0u#*jg^39Lh`D3X@-k
z{C9r}CK}CS0>we1N6W{!CaP0|k-4%kGOo>n$|j6m=rn{uWJSVvxe9<=!HcIYK{tY-
zjPK%gOWGOKO#o2i!qnBD(iu_o%gwt`yvuO-?olQGPBP{XXc-W<*WI(6@-P5TfUY+P
z*t(rDM&}=qF!)b^af101bbBCz9?3dR(}burq^@ohH9$Z?^W3?r@@Yo_d{6&aaW93@
z0u=k940#Y5{y}I)j&kmecdiO?qYW#_<9dTSf%yrFs2nu0yi*{X73+OWy$<3SqBvoD
zKPunf^k}gQv9lSYke2opBncpmA3mVaeCs1#vXEnjCHA-zkx5z8%?4Q13xS9+Sf~?k
zXw0vqeY*KpzO#)JF$A^pR>p|cRVk7RRY~9%RKfJfbygvN$x#f)4Pmfe#i<SXDK3rY
z$B<{g3YxFsOZ}GUpSwOa4^|Wb(v2DX1y>P8e_>0FO?*9oz`-E0`x9Z1m_u4C&{Ja_
zwnt~01k|UhcU#e|X)p@xx)Q_29q#AMb6z1n=Ij?k>>0X;?-=$&ct%9{12e1@?67$L
zlcqx4ezxoY5KP{wFE~^`+t_7R{Qr>#p(&HUOAQWM+}W(Uk{rK@(j4vlcKsZ1#T!N7
zBa#)!{*5UYhr4yLa*NV28kU7}1xP^6+IR-AEtYTjos}5|F?8!sJw&Ywq&eGVrg4mB
z`BBJDY<A<%@^RKIM|~UISiY_A;*t_qzszAtsCg?OcK7&w1p-bkA*7AMFht*!5~Wix
zxHxfD7;<NW{pkrSqgvoU3rya3Rl5;SrZOD-Wr$S$t#QnwU;@3NSF!Uo)`{56$R8x4
zn#dZV*00#fy`Y7YBJwc!-dHebfNC;S8vM#rHAf1C_wCUui+H@Iz`<^aCr_A##HF|N
z@I1FeC}nn|F32@rge-{WM>JAZknR<DPYyW5exnO^1oxzBt8XqKgoN-~5!a*Em|HQ*
z9uwbcv`k^d5J3b&8T8B0tNP(=4fN0e<+6Q`k6Raf&8{S*bnmK$_nK!_pzQkR60{vy
zh=bd4nXy<XO}#64Mk_||Hp2oU9BzR07-7}>veu;J&&YQbfM6|*?SqgUVmXaMozQwm
z*Sms;?Qh?vm)}(ws+mnSp+iTjjB|ku$&2*x7Gm-Y@J!n=o3RvDb#ZW}(!oR+O$^;k
zaDZ~YAOhQIOA<2M#orPpOSL(*LzYHp#QJx%yt5c({QX)m2)YvT<{I61>DyX?P`Z_w
z{lTFrQ?fLN<_5uq*7*l&*jkP09Lnf$X!mE*w4A>%>g|8bsx=rR3>m8);F>K-{}h?n
zgE)L!w$D~RK%mp;YdJfECb6iqz0o8U>E=Pep<mk^*$&2Fq`(Ehx^74L5LxcJ{CD&1
zh=5`C-%DUUyg9b8G6g08lc|+u@2h9}+SuhA+&`TSE&IQnjbA`i{@i2PPj{A53UzFh
z@bjY=W6&F4v#cI4VPpdbarf6(w72O+sAa7<ZI#ziU;_qqx&TAF;V4!3^7MM2XXyp)
z;~jg{1`?pBG&)k=l2!G+hv*Drx)MtI;W51f&x6eARLjHm5As>L=%e2iDIf%2$B$)6
zXD`&wLINO|-vmjcZD)I805IRT|F{_+UQQthvDVvKmFC&swmY|r1%1mXoEP=ycXuQ7
zXbYIM&Af9t@xRg+0Vg5G-1bHaRfVJeS&pvCwDpPK!(#t*qtYHX^;A!|N(c9GbQr<1
z8mD{=eP}+Dh=4=&n%JjWJ!v!<01Tt>AoNkV@l>|61P#<f&VEz61dNQkL(|~^I$zU-
z5x)$@tniTRe(MPPm)?CWEFXqJRD$ig3dV<?!$*>Y#r|`qMS~nP+p2)hPtkuz&$Ppq
z2a<YwH^>|WALz)9zRg99&EKwq=b*uOvuM}iT^TYxGUiznN!L;n;%{0Q*LMG9j;+De
z6n4}<tJmAGXHAEkI8ZMYShlj>0pnDvd#XZLzHojTGLz>N+vlft4m`RWQJyf{_HLfV
zUa+pxY7c__%aYJGc0`nB5BH<x!%Tf!AS8kiU}fEM9!%AUFYen6`sSRnRW_xi3%)0?
z07i!sRmv`b=Ok(XQnRSZ%YU~n8eSu+g#d$r+jrC%)s_v&X8ts>O3;6Z(m9XMZFFjO
z{2Zm6?hg%%HRXGZ*lJ)ybglhhQ|J!6Qu3yl4<Qi=If^WFN*tomb=a(dqBjmpun+EM
zKg(=k-CfAhHR%~xZ5OJgOzARqG1D95b?s)dGbaP+{7e%{QypQ24aghK3}0>Denr?8
z>6?<G<0@^toJ6$+6WwFrnlWMtM&$sI^_c}~k0=aI|Gg_uvxPYHTO>^UjS@>oiH3{{
zQ1ho=5Rp-$1BJvy>x!jf+42{AjK|s+*mrO5Y?^i|E7Xe$J%Qriis&CqjD;)-kKT=f
zP~Qu)g4~S`bL%3(_bzlHY2AI#I?V<FkR8S}fnMD~g|xPTgQx1#iLoio*7;h!f)riP
zVGPFu2!n=<gxT&-Bge3-*b`WW!L6`LQy08(IPv}#=I1uko4=U77+LZ@BoGI0wdou(
zB(ol?$)Ig$R^)u~Pl0j!35YK5f4i5_kVNp#oQ8bz)|-{$mpLgF{il|{YC)o6t2Sk9
zf}QoA?;=E*jz+<YKv#TJL%pH9%5=~b#)P=zXSV%;-N~zK%Mg@QV5tmNxgm2Z33ph0
zBH1H4;$5&(3)Y?sZ}P24dldWDAIy&YuU3J|gni2RSJ6E?UAv8JYh7pJI-YE$4B+(c
z-q$G3Uy&#|4Fuu=Z!@G#>6*Dvh~Cs687o_hr`JPl&9@Syr>hSCwLJuPC&UUXBFcMs
z<Hrs-KA$$GOHM{`BV3Tn9TB!?i|n+s_3UCJ;DJS6K{lbVBW(HTTJdh^_Kmw1;C4Y<
zWl)KNFIc+c!GFQN>H$txoz$$`B9xAR5H7vHU0=|PJ^|`E7CuncQ0;l+EoBvz7gz#l
z!IVu93jTO!#<h5}>p(&VmU;=1v@^Khi2rb7&)4h%)|U`!c%uo5vpv*nuXVV&BM0WT
zksPjFqshAzYnp4(l+}ub7=3udUG+CC)8%f~SGPNY)Ey9epUBaDSB5}UmJ+Q(qRO9_
zGy<pmj<yR)(@Ud%xVQZ#A0Ym*64vFqbD6p1CT=k+M)Fr!0K051`sk~!8wky$;R5g4
zN})|@@lq`tff&tnD*<s}VU^_`ZhC92HA$3rK{r?QRWS3{`!xqTD>HqMZRLfjEobVC
zUGQ|SVR1`zr-f{5J!j53D`V3A$UNFQlp*e4N~}$|3oyC@E(QTZVC>Bu%m|2`!B8h3
z>9>5$es2{iulUU6{|*ADBXjyIM7g06f><I@W_GWL8V17^rK1|0)ft6}tz#&9<ZKEd
z$eGXY4|ZeTU-5l*6VQ;qG0^r`v!E&MT;E9l820}|fG>76O*D*7s}pYEcr{S=WCW!c
zAs7XHUk==NYxgoP;fVS4EyIPonv`(M^cfK?rG=I=L*rv|Vk5<==cw?&zAxku!%_Iz
zv&1!_T?I>_pi>AnZmsTP+B0mV$Dr}(Uk@c%^_XqHgAdEk)`ik}*q@rWGvn|Rh?GS7
zPRQ`S{%F-RGp=m2{J+YO^6M(7gE4}u%-|vhlKfNfp0V;id6HfKtAOd2LTm6Yx%P}{
z^YHxy);MhCO>)@{C?p{~ha>`;&Vszy_AxZ`OMJM5Vc$rUh#mmlU9HFP6j|xJ#7Kyd
zI{)yL2qD$g2UI*c`u_HYSX+vO56tY1Kk_fmqb(Gd{YUW22C47q<s)770!AHE-Z>qz
z`dUF7l4!2Sv;S&^@I@0m3O@9(MRlzfjB%B=D*hFove?EIa}&lIakptnYS@Dq+LB(F
z+Hnrg*!`N$HTd^$AIwgy;?7zIF7~TfVp92(_T?;G1FECoi(`W#FkwaVAmCz#Lbk&c
z)wDX9tNXB|<cpub+;edWe{wp3zJNym=cLG`X15biQ+Uyn#s(ELITZEFPKWm52mx>a
z`j+_xc38j}5+7Jxw&|@;2MAR5hUIZC*!8jWUD#en!P($OPWU!pTFqLSX$QSBo}#TW
zA@>dH<3fcFb1H6DQ4_xs0n}&al$A6}PwFVogSBk^00O-wte#g~AJmq?-d1cbkX7Z~
zv#54Mtl|ag9=~1MpWEz;LPHAm2W1G+Nk1Zf(wy+al$RgwWi#sa<AGg^6CibKhMhU(
ztC*iGVx?MD9qbeoxOp?1&TCiH>D!<vf-)L|iUP(WJA8KYvaPz3^J_MF)z&y6cw_C6
zZj<!oc99ba2AZ(k2ytm#bg#A%SG^11O=u`ds?h-OEil5^Z*DhYW130~x+`77M<Cg|
zOS*17@1VpT3SOWEwO-yTvA(ODgYUoW-i<K<s!_kh;vBN>t(U~tSMlcaYatT9sV=Wh
zyCEN*e>eYR&gw)I!yr^rw&1d6!%tu|W3|bKR3<KfwhJn#R4|!Pm{0VNN_YomT+Tt9
z5%~qj(T4IY4BQ|V4dIAID!b@kKMpWSfPx{B{AJp}JWIn8U)y9A_LVH!nY?JpGBt-A
z(dOOmRlrWbnF(cK=XMi2+oW*#{J#o3+yJlx`rZW$q~3RqmyQ!Bwk?<+@0c~B1(2aM
z_&R}`wjn&z@6WXX=y19Ycg+Y|UEN4ApO$B*)u`-TLl*3__FRlJK9oiOsX={6Z87*D
z>i}aJYG{E_?nUnIHG2ll83<y@5r`qeH0y@zD)w|dr0z~UQcI>F4l#;Htc6pMLBb9D
z^RDp3@Q|dJ$<Exm%xk4uF49umCR}G9ji0O5<mLRI8&sNWgV1nVzYrrmT@dDfigtZc
z>0E!Lc(eR=%a9rHSF6cAIzeoqnXaN2Lvnlhy+|nS0OeaMboPWmP$h`fhHXu{6`g$L
z!#<Jr?Fs~cDUV0wf8XNDBK9A*Z*Kp|&5DxCzJW#cr~jH+N9@0?_MZjn|Md<l0zPhs
z|3Fbze-R#&{CaFM7P#8TsU|Ry#xUb?-${yA89UW~4FyT4msbW>{&vHC|Ajh0&~Ulq
zI=#*)^Izw+h$(tvENee?zWx!!_uD-M5_)k$<RoHYPf4w`67=$`ds9*qKhc32j|0zU
z7{NW#w?~O$C0nfray@)7M~ht^Tfw7*4N+Ua#EjClcclfRh>`Hh&`T-D;PfO{9n5%^
zn-!%$=$Wcj_}bLjKU%!+fl?#>@xx|8^ajqKyd>6c5~a;&F=VqeSRL`xR^E7rL|Zn(
zUC}oW6zMm(2oEaJU$J)=>?}gvA6q|9*Ue}nYi4$>^wO7B_JwTj@$OFe;_xz78%yR1
zCfZ)3COsd9KFU!dxC~_T7a)lDy`$oO>1sGP3m8UfI6QtnogFduOnBx{*4@lY5!N}3
z;*+SUR*NpV+R{W3d|R-q3RsbE?2Km*j3sj9UrmX(HHef5qB`AdX{nK03HEdHmc)E4
zF?ciVdwL8Ke6+7vVdY*5i`gEcXOFaf)BC(&D<C?)Y2SWnB^aVda+k@saTY@Mu^Be(
ztF{khkF1Y@H!|aJ`z^Z7lW_UjwSpeZ-y_ywwQW>Dd-im=voSf)$5T~mTPDwsvIT`L
z?fLB<neD&^V=AJMCM!^8$0L$BdHZqJF)3_yquxf#T;@-+G^vBLhr`c3Jg=ofM3%$x
zN!|7lZSv812VvMpx0}hV)Kh=r2_ps9$pNbC)Kr9zR~EwZnh`F!#nXfO=YvTbv6)@f
z%>%_%z<#SN!sl7c#SqIb3yTN-Tibg3G(C`hH@w+B9<HVI*jpvnK!m+Pu;qef^`o=N
z%+&NP&S!<6ZDh(^gq}VxJM`mK-qY07^QBWZd+Z*zk)I5iW3k1`-PF`26-TB%TCGLT
zBsKFlLP1hky2XeTUSmPOndu<G#+=QEItB)h*9?}<a(#|s7iqQL)G19Xu5`@gSft$A
z+DDLtsG4Dn7oLsAPZ1!qmtCM`L~Y@rMds5Z1`hf}PGM^ohl|UnHuisJ0k-+oX(M4<
z6G&ZQ3JlNg)E2C5HJdufRya)9VkagS7M+cBk#`2=X9wJ6E7X|X$sCFNFE}FgXhq!E
zCen<8t|Nk?x07whFF8gTy=$f#FHW&KS>Sgu;HCwq3?A#3#vlCpu+PeHson;gpa$0J
z3KBqkryeG<8$Io;kM%CcJnHI4BY(<$)DBqNJ#u{}%(2S?l}*RIF3TWxh5dwO?)F%=
zj`cp=EUL}6JM}s}Uem##*fGq@2)@1+cpLGr*Em3GJst?#;+EU69ONGAzSO0cn4P_O
znaa%NQr3-x(ua*%s%}YViDu}&O#Ski^FC7@TTQI0kyq+mw6~_z)KkFG?vEt+@Gg=&
zDUH#6q71O&KiGIZpkFs1;XC{lu7mOjEyP^V?}K@t*8|p!e_QfNvGd_ozFk3PH86Mf
z;-i{bUQxB?-#t?hfP=Lbs;0K$LVJlpX!EAsXr3!6DP(qi?Iqz{o6#<qv=(N|adIdz
zGab)MQ`hSS?_0*RSa3NnY^NApZ$|a@{aGZM@3&MD(0AeU1SM_^v~5lU%9)kuIqkV5
zj3Xa9=;0+M3;14~@1HmADOi8#Z%Nq(#Xy5b>x$#f^+B}I)S>^VU0}BJ{%!#F@DPsp
z{6j)r&-MChrFYVsnd1EGeyeHT&{O?5-OEvODYNTru@=~c)>@Ws^4&@9!E&sAot`tb
zGHzTvyLf+nF@fF#?I(q6Pmy8>715(Nx=~u%-5Y%vNX}dJA~$_jZ=+}0^R)sx6RG({
z-nn6<*kHR&Wqn^!P)!w()P<(TsGa(qdgN@4RIJ2ggYmd8IwJUw7XPR_f0R=euEQh+
zlQ&B|{-(AqIa#)osM^TKk2XE}xy#*4VnaD}hM%uL*bkZS7P?nA&-Hm7pGq<{&rkJ7
zOG$v7S|KEJ7H-;o2rp8)uBj$HQp9M&D&%FL0{YBg<mV=o_Hd9~WO$lG#;Dh4A|w>o
zAAUOrWGg4!z)VS#dLa4-B=~}q5L1KfkP}T84`%EJ$P5JZ-5o^VKv!~#PlGXm-ZoIe
z3w(jfPI5<uLnrFE-kUDmBh@xq&Z}GA!7tx{WTSxM&wHA1%vERG^fa^|d~cuLynUE7
zo3E$Ab!WZbu!UCJ7Sgdsb=mU*%Dl9YzrK?BeKu(r7V#aa(U4*=d4!C~c5G_FmC%fq
zv;USNsjEc;U^81$7_ELVbo;&IOFnYvA$&hAv*`QEmM>?%J}W95Lh(x-EL%BCY?_Y%
zYj91qX~Bk+X%c6!Ycj-b4uL9|plxZY>{qY{mBoFt!CQ!D4)Rnr)DRgEZMekvMs8`&
zsP0h1cXq%njoGDcj!}NQsS=GXJQS#tp#p>b*=ex$ZQRpF_=+U>`ts(3J{sL9^T|FU
zsM4B&rLP$wls6vh@wgi<>*hKbCfn(6j`<*QfA)KVd!(Hb_}paP^-1mK_=Dyt((O95
z!{RC?8)kV@aSX}d;`C)R3#;p$N=@wRXxmyNJD;PKdZeIM*9g~l1CfyxJ4YWQAI}3l
zqH}nFfL8}UFK%`VHDNn>$jkGG9W&pyiR<D@xk1W@m8Ypt89q>fU1VkK%#OG2bSR=V
zqX|yf;9m}wAw|{j;|Q~njm3LasdBKD-`ifz^Pn|{y&dweV_ANbFELoJPtq0J=#?R%
zwG**?Y^67Z&l~CuX{t7KI>2+I<%TO1_ILb~9yi|St|mI>0szUg_!&|_Ns;Ya_+7od
zHP+UKxQCA^yY+WxjmX$3D1=>pwBD*D875#h98h6qO~GkgvO9l*tb@V8evIC34Z)Tn
zpsz~HCYffy7Uj3ad<17xw5w=ACV=VNV7a?2d3A_zi|%{aH@IP%cS|anjWPnQerz$J
zng<Xb+P)ku`lp-95*&RV|G~xDS?(y~_c(ba;McWoG209@I7F?Oyn?7g<iPWBemf(h
zGHnx)zer|zc2`gz8EatZku>27La(1zH3#a5cs3N69DojaHSZs`fi?0oIj!~fOIp)`
zZSnf^8pzTY*S2*2$TLaw$eaqUy`QgFNNxPN*uvkqM{1%zRX9O$E`%nfL)7#$p)rDl
zODn}|^pd%Z7Q)y%;vpe0I@hzH{qa#0(WTz?cqQ|cISvjMtftyOQ*lPJWl5V~<`!$j
z6<^Tn9eCi-C-cbH*|hNT&!4LeM^JfTtKa38E6i00G@|6E#e0?=p(-wV&Dm!CjdKq}
zCdz^2o2qd_d^!yeo%xLHSn@N-d32Eb9y<T_GqBjwVmCsuCFcX3@}9I}$i8B?xCjHF
zezO-@HIP?=ov#>pNZI)+u!AMe3H*`|S*l~Tmip2UL|mMzq({xfip%BfOLx5cTd=Y6
z;@GVWDeTPo#B)-C6@H5TIno$T@3Wni?0*`?YF4%X6K{)9pSx~E1zH5-6|yyFw$llI
za0bTAH)r+m?V}H}*%=z6T?Sm>c$?*u<5}4-3hig-<JeWv#oalUsD{OSVZribyH1AJ
zg#c_1<5T68n3>xnbS{AAn@Y=L%&Z(O<%G&=2cbyNTLTp>urz0?@xyeys>opw{*P=a
zq=?nd=5tjA^_vS=+rHc-2!>^M=A&<h=G@#C42PZW6Wd@Zq7DDEqo&g2J<b}5N|=hT
z;E$>39k;Ny<G~`$Z>;kqW1;c&;j=^nod@2Df8-5B!dDm@Z}Cn-`kP>9=m3NmN%R^N
zx;_DVw%K*dW<6Lx5n-)@w3FHL+YN)Ec{Y^LRv_u!C%*mciBr2>jZE*gn5%Q>0&-RL
z7B~*aPX>5|0EY|ERc$o9PnN$ouq)auH$-`W=WnvB&7&v>{hTMiZan6z*=V7-1(Nt<
z{i7YC$7Lk;ZuPp*KJtU6w}Wy%$IMJq6$?nG#Ep?FsZjW(ao2UhmY0K8`-83wCi;Rs
zI-M~vxTQz2+vT0=<A#ByPSXXSDdH06yT4Zth#}KzlkS^0SXuF=O5l;fTmCld2*%i0
z{6}0;RXkijjVARtx5<DQW@~RBDkTIojE`dIZBipIO`^ILg=}BZw)*-rZ5GLMrB|34
zG%}}v@qovEA5DHQx0+IGX;NmQ7Nq`3uXC1ofEF?=BMXg8vQm;b*TCP%S7UbY%h2lo
z?o32qrct0>Cn^1=tx%h+k?QE&_M3keu(E4IUyqins+vNm20mR)X(;pSi#PFpLh&;s
zl$u(CO}x&K-N%K41}~cI2v=4{HX;!lD&BXQQn$8Rv^m2bK_8bdKw}J21N4cR5aD#=
zfbqgZiKjuok8YtEp&a#fqxCeo&lEtIb-p8H?=qh234Yh*EP3={(p6~9<EIhVq1ob@
zt^}h@@Osd)2!K9MzaqV~y1==N!i({8nv#Y90g8%9$`|M{nVk}pq<n5^J$mvVuY>Iu
z+SDB)x=MIGo{GqLlq4FfwypFsx4E>PCt+gfADu5YxKl6<l$MwP{N-o}?1=JAC+?)V
z+O1wc%ENC})}2P>+ZGM1i`6&r;bwe^SYB}^p7T49>h@5=UR=o6&|NCgb3}=o7nlmb
zt(-{)52GSoNp#m+Y`!Txgea>Qn7l^^iU`Oiz~Q0HEJYBorr#_(oJ>kTP*_9W1`rqc
z=q87kSyes!PXwtccGD3}Q@MMUP*?E8+g8h53QZAx@)-Hb0e9u&uJLMwp`ZyJNmFV!
zgvv;&)_$!Jxn%!V)Ndg`byfmgIcqV7{qk6;WgW&pu-0W-5NX+G^|3Aevk7OMDP^v6
zx!vr8fOYu<LcCG`pq`_c8x(6rDh6lgLOws*SJ#qi+(C9$2TXoW#g&^vWlMX@_UhtD
zAenDvz>^?{5|=PvV=9qv;GHd_K?7$24Vn1a9COWFM15Q4?L_Rurv?ts{PE!jVBmFs
z58SlI_pzvA$gYE+_aHf6vFsbZl*E>D=Oj{mU4QH5^F9t>@QYu}_zm@PT-V#;$Sg$d
zQ7;tCev#DzEhYb+PiB%dNB*b%L5nNxMF%K;E5i%LV*>JIQX-Qts%XdZb)7_S$@ouO
zPeqLjLtJ~GsVM~;zAB8e3nX+$*uza-tR*(%>AuR4O|EN$cz6N&vXSBfjiis+k{H01
z3{YaE9bT8vFW}wAu1b<iKFdk7(r0sc)@Ts=i$`4&ZX%T&VQt|-Xutl>8&Jc}hmUnd
zoBK1QbcGCi|N4fW!)M`o9)$DmHkE8>s<dfx4v2!67Vd)m<+Dlxq<!<yS|kj`i4MPV
z%;pspe`(+}l4C1ubwbRenH<?!zLBB0?k>O5@|JsLmSA>)che{2dj2lxkjP%+mW-o^
zc$$>*?dEo*6y}i3w&0rjv5dCPJ!fC7T*u+1$+HGlyUhFJag(4!nUC2rw?$J02h9-8
z+?RnY77I|lBaOVJ^@_B|!j|o%tu}&QU#8dP{c#Pt+SORA7?71|p<(^^7$p)&Et-m+
zfEWL9K>|-8$Kg$?g`;HlhS!_<&EB%9o*C?8{U}E(uyJD{sH@Hr@+#kv7lw!C^BR@L
zDD>#heKxgQTE(Tc5i`JlVm1g0DsHV~CVVrMDh-Dt&1cNq%Yv)SSgl$)Z5ss~pt7Rd
z;q?E8YO`Fc{wpWBgzZDEO9ipqge5u@fIq5N%3z$F7g|7wRT<MiN)C=VL=%^C+%x}4
zL<8ub2*~IkQ#CwtD>c!`jQ;-s&xu|ED8FEKES{wyHcMIPBFV_COl}*rV<{|?cfPWf
zoSlz6QUm7=KF)9x@}wi!){LL`Y-{HO>hXcl%kPa{qz7da1oOlYfX@>W{;VW`uOs3e
zK+;h%>U~qa!8mCXxhjQ7;yVgA_|IZneWx(onRRfH@l}nNpUpJBzlHfb`3^fdn)b@F
z2&xur?{gtIc;}4zcp@GS*V>#3HZQR+H!sg#wf(V@k;aJ}fA+50mS1|Cbw@9D@*B*r
zF$+YoQk3P-W;}Lzg9CW3Z!;w7_;}SP<}?>vs*EHQmtWH8%tJG-m(@7j$U4;ze?2g4
zGuB~&=x)LEw<<ualSFboLY3^S1l?Pm2r+moSG6YI{F-^_N=dRQp|Q^`=I+CdQy`pH
zD#;aCc@aIgRQL<<MXyxKXg7i~^0o5l^&?~WRV$U=VuBW|c%()+-6XFR*1p@2RyVcJ
zqVd*%IP;)0JOK$KEuDn;Nt^wNH2z=ETPsbMn4(I3DvuO+0a5$k@ZIytRyQ!hSFC(X
zQ3YMrGLoJ89trFv3G#oKKjUx8K*X1^dZ#S35Akm%)+4!CboY^|R)_yLw6?yXyqqQx
zDzR8RjwX_I4R(?^$#JV!u;zcFi(e%QxGb}j2v$gURQVb?nE4y<S4PvWwU}ofTv;%F
z@OKF&NB308a%AXu|JYF~7+}6KnnpHStSSnD*HC`&0MX`#=;D+Z{``1aqL2zV_GJm(
z4S=*<HJhX^b$!!0*F9E4m_1%6J8fJM1Dy-n%S>9?TsS#j2E^Wr9h`~XMk@n+a}&kH
zNT#^=nn<jLqyhPPRujCRP8Soskgq?8LDg)dLO}qhrCeB>W{h;Z&QS<IodDmiKjKQ@
z#uEX2qx_Anrx6#<h0{}2MkI<Q=5L$=+*-086EWUq)IMvwS5ZTxFswNT5SkIseIB*k
zbTMuplNU|oDbJj)lU;JMZe>EdM4TTaBv}_q?>)tJ7OLPGhv6f;Dko|(rt^0RS}*fM
zK;24+*A~tuucpNz_n<B#*}BsDAF|X>MQdhrEXW*LeD`W;KVY5lu!q1D#~V>8yc7l1
z#?jz}Xg(J=Z?47p-fz-Y{*fY49<}_}309eFgtcd+u{>UE?BE4r<dYSfq$8IC_Op@x
zEl!0=KQH6H+U^#U{(->WZ2fE3O@8|YLkl+HYRVP$rWND$N>8{kH1gV=V7^n?(_oVW
z1X$zfGGyO7Sj$9LgvUswaY=#%%-d(3>-x3ISGl(~*GElvvP5~Iu!Jcg462#9DG`P0
zh;W3qBROOmO6nOAB;>?GN_Bbg0?CjmAy`t<d;xd44XK+88y_E1BA9kp*UJuY(6z^3
zKJlXy6BA<-W8)X+Cp|}DTAVn1u~$V;k)Q+CGOYWyL`|TCLY<<kMHs7NI?`0J9@Kc5
z1*?|g=^j`*xy?Sh_YuYahq12=itF3HY}_q4jXS|5xVu|$cXxM(;1=AS;BLV^xVuAe
zZQL1t@BQDashRmO-)>iRoxXkVwzJRLYkkfv*cgv_EXbBvnzIZ_h;<R6qlS+|2B1#a
zL9Ph9`9b_Wum3{BO;Tb`Y=F3zL;cC5yT4;|nIbxspCq{g-8gM!@U=8menu^!G7}gR
z1%V4W*=dGdSwwDnkRYmk+_oLg$AfI$AgiR!Y-M<-t5PPlo*l>9a!3AR(v6|Ct(q1m
zua}OlT0+E|GF6JtojgXnSzigVIz}>)czYh%GyZ`>^s>Fi!$&#wa+o@N>Qg$w3Dab$
z9@9+U;i^8<yvTUES}y{0pDQE6vX=^s4P9Es&gq`(o(wmk;UGLaz|9kb*#vH~7p(<v
zQK+s8;ud?Gxgda?mn_yrVEF5Je?Jusu3;gAh$E@TTAC1?R@I4-1lOES++Vr~B;Gx2
zUKiMpVd2?9FxV;|_{+rCuH9nc=*YgKL>dFR%j8&34K3XxG}41ou8qG=7kT{i2$*%>
z$FzrjSRMq{2OAkqXw@@I|JmPJ2v%vLk0_vwzi4QUb!TFL28PkdXqpvIcy&jkpl>7X
z3FU{wltPpSdnnPBI3Pe25|<oYU_ph!!I41%B!axqi=vLDV@2kEZm$WVhlDg>fwzh1
z=!VYr3s(a!b3$w_Mn_!-JXklYsd>m#mK~oeiz@M}HPE+a)_a~-|Lm{+!CWQz4hzT@
z+H|ryp&`HZlxwl$<k|8m7aHSGqq6wJ6lb9F+R<yl&NMk0-4HnRVT{35`c97<z(#aN
z7#@jK5lK-^;dZ^$WLH)540ml)OIAIKTpWGkTrYC^3%MmXyJ-=FiQ8lXpMwJ&fQM2=
z6%W+CTCj%uUP{?<Wm&hDw(UCRdy-Q}YI4x+Vc$2`z+lHaD9Z5ryu#ZR4{8soYhwYp
zpXvWi)1^ZCIXOOTAUsKEJe&pVI(c~S@i`%u6XsO=cVt~=y?c?!SfBB)EwZ<7m0t+B
zxCD6C3SWoklg-7}hH1BITysoK2A|saS}ObNoY82oNtMyLC*fdp*zU0Z(0#|ci8SL&
z_8edEez)H#opj-A?A%!E=L(pjR{m=GVzNLy4e8CeJnzIw<8ud!PICg@T2q;}p-E|1
zcCxCNrO=3iXbctjak-P`CyY9ISP1iA9_CJJwxGOT^%Km~2`A{GbkJiaz}F>{b)Q05
zH}haV&^_s0xQ`ko1;l7%`Z6}IbfgAWCfBdTRugh9p5=^}(fb1J2b_4KGYdGwz#SZ$
z-pc5caP5bt5QapAg+z)vttjUpS#fWmm~($9aP)yYkP6Woa+9Qhkm6ft8##nTF}Y?C
znTVa5g>FO0P{p)-LNYod?i16#LrV9y&4(aMNsW$UoZ1#23h%8nkTr~}CFP<yd$zh;
z;=DPfmZm9Y=z>4Kv`384ihI=ndLa2OMheI)G)5AUi+^#}KfVoWM}ckU>P7^<p^T@Y
zt-NN6ji?SXJtUld@#`vl?*1-tzWKg@z7PLw8eIB*wTJ%9czJZ!=P!oQpoh!lKed={
z&A&Bkb<!;SRjLiN%{k?!T-~0dp4IqpYEIU6f!)>NE<T0r_G;X}8cJqsyV&)`(m}}G
z|7|OSrkY3Zh-ZJTNcv?W9Vd$zBi}B)gjaPuqT%{lk@_IJ5Ilg@Xo$=0imusMzy5G5
zqhjd~rZvO@)ke6ume9_z1kOCCBlsjP9uyR|5iwp*nmQF{df5o%5GGw<dLRDq<y#0+
zW=~_zP^i4f4hhM<IY~<^81>iy&gt71sy?va2^k4wr!rG9s8B-9*I8+*laPqyzYFKr
zvn(%yUoXW9!E=Qhr!5U8OFD|>@&BHjgo+oUb=hshjw8uv*2RkQ?Es7e`FthEMul1>
zoO~q`5=Htz)LN7M#Xz9n57MzRxQ>AqC`Iw7QEL}2NXMH)fZdS2uKE0u0joNA4_^S(
z*Y8F5X|=&v?(gO9cZ}Gn!^qFm8Z+_uv$OMwuJ%;5*?j`|r)&EgyC2dOP6S?7u0t*D
zkbuV;^1&(78;GucaHnp$3bSOj3}a-hL43N^Ynh!;0iLdBGr<-C27Knx=%prH2o*Dp
z?sbJ~eTvyyUQ#%?q<y%6p(QBG)5*{p2*AgS29}XL4WJfG525>Z;SE*5P2Li2a2;iR
zYjyd4Mr^|UR%Z1(T@~3b2aAPP9_VI4d?vyX+Hnz#Sc_^gZ%5879VC5E+usmfc`MKO
zv3!w^RU&uuvn7i?Q`d!T%Z^#KR1yy`v6jhSXDzM>?Ch2wA0hwgcXCw_1+q!#gEQ@}
z#Ft}w;}du)RxNS{Wr3swiWi+K1iSB*)c8p)qncd9zN~1L*vQ3SY)W5tWS+;Xls+H8
z0X$vro6=<rz;$#O4$1GF>YNA-Dz+@McmeTf_7)QJAB-GtF;mH|TZ!cOE23foB`*-N
zrcRwAhBjk2w15D^bI<ZD7DrONo}>lAUZn|>3<FBzBFn=WvMk3{@-$%_dnCCE8UR;X
z%UX?))LNdGLjbX`B$~W^UIyC?xgcr}PPut)BYClT<UgrT5N{%fAl;PR{(i@@4KCWb
z|EQ%IQ8Ws@fFWQ1!GY*rup9u8&u?h~kKxIn%x%wb{&}5ubLVWPNCz%BSez!?L%SR-
zatAAeGLhrsZ?NzNCOnh=SK9RL_gxyhWNO#r4`bD~NG|8Kbrj^u*RHMjl;5^gV-%lh
z5C3pQepG!$c=Gr=*AedYxS*m@Av5RfBG&nsba1O^M}zBLu%E={1&84bZXraaLvJ)p
zR3eUdm;G+TFEj^BXlPX0GQiQg)zk#JmW2kaX%aZoOqT3pqv`scQBKSV*f%BCygTvp
zUOPM^CPBKveH1&|FQMOWLM=FU{dv~-6VI{5ktcVYqwh{kdy>t)zUI>*S-&ZheS_$e
ze>ZuvUbT#1;Q|g8^|M_eFK)@u5e%Hr4jlbdr}R*rIU7YwH$2D(k>J-|eXB3j(N%q!
z0}`hQ<spfzT!)jps@$m@Y9E$4jV9JBw<?Oz&}Cs%kO+0cvV;_F!4-o8FdStc2}C3I
zRr<*Z--K=WgHJhS3ZKS(*z0D3>FIwDK=idt=`3qq`e<fgQ-M=YegQB{XA_U%QSE}J
zCIt>ZrQ8!6Fb{?deje@_dAiIz9t9|;-O$1dcKF~x2f+f^ZnAK<!Pn_lM8pPr_jpT=
zf)N9h%sRx<!FxhIGzn{h{4iw--@{E(>Jno#9gcl~!{Vy&fS$&qG6;GBS1HKt*_HOV
zW~V#Gq4Md0LkxONmFFXDhPMn>ZzEBu>a^HBohIUj_Y3w4dG{&XV{T8?bpq$nqG8&N
z8n&s~`q@yg82gxkwnKeQwMhs-h3~Jy`R2$XB{IDoBcBzqo?`VsZ&mRPl#F`E<(=8}
zP7V~&oIKrEzDML+^$NqeANQ3SOOF^wOZ=nkv68Dsw(0q^4YFL<ad1?W4*l(OW5r<K
zNdO)^5a0BvEOiV4(lYz*SE-nQJf3bW`9;S2<f1J^9nG5$3bxCvKUCqvYZfo!^+FPl
zjX@{lQrlqkhCthqO(T~SOJyl27605>K*GO0NW^keNSeqj!xIjQ54T!Fw%bH|(~kL2
z-D(PaVuLYbaxGqfRjV&361-<FI$K!vQ-_Pq05>2xwMbRcO2~_W?Q`^2umQ1lrb6Yo
zMKsV4(<7PNH^Yd-ZbB%ow6wXVYuM{*Zm+}9WMfn3DL~85@1;xFC7ZkPc@1Z%Vfd<<
zDL3l3M_ZOrSL@;7-NNH>&5^K@W_L$f5qM5jX8XKD`JL@KM3PA=e0>rS1^EV%iSTV}
zBi)7B>zpiKYq<i-_bC3o>rX_d;sYI!HVLySISg}jb~W{982j0i{nklV!+p-5wqg8o
z@?*(UZyejuG>^WVDTyX}T=gCoG*Usi#yr&DvC+;GF~zI*(Llu%NVEXKId{dAQ5QlX
zPM|;y>diowFz18my7fg0tBbJ@CkB3@dXm$ik=HTf`!)&&p{#+R?++dL034mOBD($^
z)wjqtBR8<DRdi?g2_E&ApSk&L0hkwGWZ>WkMw+7p2MtLM%T?N}MCH|OBpFJN4+U2n
zY*#fL^x)fO8x3E4i*R2#_vqTpm9`>4JBlum*GSBI)?|r`32C%u*nMRJr{^}Trk0vC
z-+8O(U{0Zsj46mn*|p{Ar&0%gp*;Q7nY}QTTf>UcH&odARQJ){Qrx-SNfi0P@R3A`
zp%hT^p`Hk_Q6wcVul7Tf6$SJ4UfXYBYSJTL$tY5Osrysu>za)Wpi+cEL@z!JXV<l$
zmxR<Ug3`sy{k?Jd{yqmEo|YjUBih~Fk<#UX|L=(*&7k6RjgjR%QG)Dbe0(=8N;c80
zovyEc^IC8}SJpU>4getBrU=JCesv8cGSChM1M6w35=+Z`(%<l~{{7|VZ@p7b2dLP2
zuA5nPG)DcmzGY6asTd6=Sf6H&1U&UpYqVl+T<W(QR!sknMp=+$fZOP3FSz^>8GSCw
z9><iVj@R>ODl^n`Q(S!vSz@yW(CpVZT|=*Da>UyGOaMcZcEF9%fN(tjn-#y2k>nB&
zu6)t(+~2bOY%~PH)t8whNUsZ>bA>RF*|zkB9RC9cf2tvOv?;@(Wr+(s_U_(-M*gsq
zOUekGr6HG&*OFOgtl)$fv7YyTumC0*W|ZI2s4$ejtjEAzghZk@QEh)6U!y;Gl|D}|
zEfWAa4xjqoQ`iDU5wK80y=KwH1Z6agg2{_dtOpL-rit$>uVMtB=o%I(I3G-WIsZz~
z%+^$@?_9LoJ8gohKC<YGsrhbq)_6+&?q((hUa{Y_*9}jsAH0efe0_DT<RmhB0{5Vy
zty+67^a4=Pxc0kj<_0&qFDIBF20wf`8LdV;RM*sh(5?H8?8TaI#kt5o8%?S~VY5j-
zXnT2pR-@tOmhAQKHWRziX??uqy!ZB-lf83Ri_Qw5Xma***cqlK(HOgUTa#I}I^Cwc
ztq&GAaVV-jUnETTgf-^PRs;f6fpvx7125Mx`}>u3E>Q*WsZuG$nwAmCI*Fo*kqk-X
z5uKHr<S_Mnwa7)=W&K!LofOpIv>;`XKqw68beR377+W0{_s-prCzM&pl@gl1MAN)N
zrn!;`eK{K*4@WpHMFiJ2LPK}`+Z+OqMTL~jmU+BKR^)|jloFygDP>k!HBvhA6*F3f
zyfIs_7A(!oe5EmOR+8MCbVjWbV#egXcTARmu$cX<6>5JG0`oU9)2WdR2mcIQvXtb2
z*2Dlq$c{Aqk1!j4T{<uzOERs1;Eqt520uTvN^Ct_(et;tkUOL8xlcxWsS`sj9oT{&
zKY?=ZVsxr%_+MBD2OyhI1s8GIF7y#Fi_6iz`3KN`#3?KE4P85$3yOJJ2BTgJu-~dy
zJus8d;+nz7a2QTrftd3~Td#3OpC1AIHrrUB(TYbz*@wf{TMa8W3i?ZvWpL(qi>7-5
z{F((csnb8Q=>8bNxhBtDgA|vA#h4DqMus$fgqk$FX=YUUs_qO%<qjZHPWyt0L*qgr
z&kV<)W`d!6AIOoJc{*W#ppq4rD};N3$HDg;-(UpqK-R9QQjP&Au*C`p=5+gy-KOhe
zWFD`>_uorNs>p|C+*`M2af>PH;3ePFbI%`gI11mU{51Us<^t?;9$dhcffkNKQ?4FF
zF<}cX_W;OJ!vsCg{e$2&nR-vb%hwYQp^2&Fp(0R0RQ0fKSK-<;I+1Bk^{SMTR=r0V
z^L0#$wZL5Us<qqc##yqV><LGz+dc#UbgNN2yM(Xm#UK(;QN2dJ)h>Ko=9x|vbG=6|
z@RRuvrKaXng+*QPKCE-!6#DH7b-Ny%{3UtJgj|B0KBm5YFgHau4S2iPlA-z%(!BRJ
z{9DzJgX7~13c!@Ap2OUGv%6@cRNv&XOR%%uOW-DC(}&vB`gbMsT!C}(kCWF6ARR!G
zPt&RVq>yO@G<r)r(hz;9z_6Zybu}Pki)B&oMhROW<m^4h9al_)PFd6~@p1ng>&r)p
z=<f6_nZb+t_%JHAW_fHxS}T~Pd57%|4B{GoH%s^Ow+{)%RPKtdPuDowoAmb-U_#>{
zH<O5|Svq}dtAs4UWSCBK76#~$`W|GMp}rncSax+Wj%X7XrTw@EZ}*j@Gy;gs!b<w>
zvJpLQV75>CXk#aZ%5GKWDKm)H@@5iy?|vFgWI4Wju*e2L%|)DoWY}-!l%d-=j+k1F
z)BqBr<Q}Vpi8^ea>2W+eXG|<YPxAWm;m7V&Y{nwT|1)2V?GF5Rw5e_r+nqr+AKB=&
z+Zb0j**%>lP!s|h_2kkfAG{}!Bp{2txQT2*?K91X@X2(dEpv<|S@a4Di`Q0DOt+Y6
z-BFUOhDRtD>1)>XRcSwbU$4B^<>xnt9v{(H!26}ydV5|ffIpO+z4bmaKxKYewsCMY
z?>sr=8f@j4c|V9UC+Hq~({b}a3c#$(jm0CSdp+A<p)Ijg!g(0>Ha7FA)nAe5ReqZ-
z(4Bh7jc>RLF5T3BLWM}uS#J4<2*EGA(ni0Xe2PT@m}<UvY`-)R=Ucz>uBxp(Ax#s^
zY_4lEq>%2~-A(xGPvmCZcEU&Ji?2>6W99!us0v;gOMP*?=L6kf0L$^uOR5DDj}^*d
z>+|B{`BI9tCz8BGtZYnqU$P=f-Q%8h2`9dj_nf{D*3=AY`Z3{#MVppVfFND|6HMsQ
zCplyWdZ6?NGZAVVa{qEH0U&Z#gT$&cURUijEHNcbu5j6{rJ=<YJm6Z!=vhk4JTsYS
z|KZx^5M<LX6_9>#i5+WG*~zK+C;vcRc8vxRLQqsQ5$C2VUe7~JNR+cK!38+hn2V?-
zJjbB&f?zqyLQ9|crk3^B-M=qnV-PylKo}=L!m=a2yaT{E8!a$^%*cFZNwP4DJ7koC
z+LUvPGu&8#r{r`OJ|Md@&C}>g4xA0OB~nsdE5!a;A<(Garwa0`W6PS!!EU&w6IJ~g
z*ho0VBxu>_U{dAa*<M+=*YvroBS@A2d1KWP3^CIWF(U@RYkgtFO8yp5nN%5LQnNR8
zyu1jpEFYkuBGcx;>Yrr3_F&xa4IZE&KbC0en2v<y&2<-{N7_1N*3LJAHHj?^d~XiW
za%Q*p|7Nxuk%vum?{kerg#2rqcB}hqi<i=;Q!(-7bYZeMEB64=l|H*6I$^O$^9}hj
z+v-t_j42*dPkq3~zjgBFA2eV%8JSYzqR(*;rhp8fe#iBG6oMa3_p6X&U!?Q*f%ukO
z*es5Oyw=w(#xI*XDq5<;W;o0gQQ1rsS9&Pm;hM~Yw0a%4gJ$1D6G89?-Fo4^M>bbu
zD32X1X<!E93|rm(8V%a2<@&gPq9v8_@+?o$sjP+hJvJYjzy{KkJI*4KrjS+b%kn5F
zE@dUh{W&aFY3VP`0%ju%1xolqhVohvI5G1c`_IX{n$RWn3ME+_-9V2ibb8Wk!1U~T
z<j)t`&>-;9kn=m~in#VjT=TJJ|Ag1`mZwsL>KXTsM7*RB`L$jm;v9Rw9Zinc2?C4;
zx(MzfeW_7o%}NMX6}yy`-A<=L|Gi}i`wFDoVYT!p8@E?MHzWJBo8!Q{gIxDHc+>oc
zdG~{-k#*hR^d0nGfDc^E7RhRz$0l1_qR5PVodxWg8>f`6h^L?=CNhJ>Qv1rZ6hLr{
zUQ|QEfSy~X(1X@r(0~WocvS&fwy_q~A;=<l=U2My&nXkpjLuvmJj2M4MmFFkY>~5{
z#F=IvI}RU7>nyk!;dBs1d~y+6(VFxW)bP3HbxhBsCS?_raizvlKjh{hGz8OZmaflP
zjge9@=^OX1s>(0L{N00)51G|Jp;>YA$)Z1@mjZze!gFn^du|2Ze=o!5eT59QRJXr=
zese}eQ1Xh-_HTP7t2YAD>Wh%vUls<z6}ek0%0l66gqE`x@Y0NMcuWpH4XRo-Ct|Ch
zbajd%tL|enP#Efvwuq2Yg1n4eIlt<^eiSOOi_38lBBYgj<Mni+TBKEtu(2`#J_JXL
zrRq68@=e$--3sQb9hXjOo5P;jA1f${(8x>zyf5t9=vMn#RUI{7ABfaV|5?7z|LY+N
zp!M;y)a@u&!u-6|R!<?xZL$n`p>N%0>+8Xxi|Ab~4fNSyf`3XiwI7$O3N+v3g$L<5
zKsCcUtqH6q1*_4Yx814jVl~LAy#l6@PKlLV&Z68@BOD6<&w7ga!l4-?6}a{P{q*09
z$S|l=Nb!x-xkjPJ@>n}^&h{WnUgPb&?p~B9vQO$kRuk2=R(LIU7aJ6J@rAz=nf4aF
z-#Rr)oWsI?<p|vYKUcp|&(8m<vJPu;AI*Lp1-w*o-W_tutmr)Dn_PN2SW3A3$--U#
z6^U=|MaK4TWI2(X_6Kyz-@ExBXpzg|u;S$wy!I5M1z8t&OVW}Ed1KH6OEjoCA8jwT
zg@3TxGd%vMNdwq&6W&~~{gDYI8jA5SFXF8-L9Oj-%K|%I<n=d^kEL3B+~3E*&caC)
z<1G%H3%@EDjT(K3gPMV^g#`hWM}1mKo3kag9E!^7L)PUMl`_AY^jNQ{fiA|H&;?ya
z?=CoA5p)nxuJ2HXvD-0tptof2Y2lBb@q{Ag*9`uXY?JXLyFbB>IQF}zNYDdgNL(B*
zPv?~l(Xo}%g^84vf9JT4xa+c?mno!TA!AH^V}x(nzp_!#yR-tG!^ob9v2vgs#ZCc9
znVF)t1?M<)=^-*a4n@;pZg}>hkAe^`Zo|w{QuW*xNeZqgvS|SkeADYtM!2z;!$JD-
z%7%gG_r{<*QJwV=82@2Yq2G;t<1oyXn5|Cun}JW62_yO|wWs8CzY(JJ2Z!(xOy~uQ
zB{`#$z#gysJzSBIQ`S!iHQVk@@ds6#XB3m@!xHlMW*QK4?ZpO>s2mBzU4Ntn{MtQT
zwWsLP53|Md2s1Y8w*C_)_qICO5VByIo$umq6ny&U_n=cu3KY#<PfDxr5rk~_$$pkV
z40CSbxVYxGTJzTY!*{uD=jzn0R-s*kInb+>iTw#<zw~Rv9bL<k^J9lZXSdHi3;SW&
zr2Jr0`SyAqs&a_2^>%;MNP4+&m5fNy(=ZKy3cCUmA6LqW+yHhDn=Gf!rG3wJE(ojN
z3yj9YmVzaOvIzFDInA3x8hN*^=?}WCg@z+ogL)w_P7cWf3L-c`!Pt!Y{=BDzHzdTk
z&w*}s_x(~)O+TF<?a^j8nNcl^k>3LXZU51dY&3|;7BS`M>PjnVv2nrE_?nG(VM4lu
z{Hc)|nb9{enQ^ak*x`fpZ+Oe?t1ZSk2aBl#4kw21l)(-XwS%wo`bF3rP*JePx*NQp
z5ETisRcDQZS^K#u_z=48ci7TQQ;WtR;c`Lj`&xj`(yBmfW3MwrLSp!6SbVYw_wR(m
z_lbW$D#N|)yX$`*)vV%nu4%mvgkpH8K)zsQPFh{dt5*?xQ&1s*^!fq*shou%b?DCO
zH0|(?J&zYoOn5Fs!(9OOgLM40xA|HwnOxy==s2u7(qE0V>`R?$d!QTf4c~aUVCEgC
zs(FIY-VZK?9v6&azSE`)PAoJny4+wQ1~5nv9Y0~Dp}(;+1Ay%`I9Z{$0{mmpu*X*Y
zp6;y?K6J+8#=SCf;Ff7T2CB2^(7xZgyN+h-kHs939>$mv$tK>Lo^=ke@5D}2bLB9Q
zKA7~FJkiRJ47!62O>)><+t7}MTiMZi<t7FQQ<I7{|HqH)#XOxirAHO!?{01|wMtE(
zy5oc%8;q<eat%5y<62hW@qO3gHrQ3;RjY?tXMBx=I$_|ULG>Qf&=?Rfz@p_M`%6Z1
zE#;gu0S=LZPV5+$#4S7C(=!-X<~59Eq91oku)rM}>{kLM1JiJ^;9LTb{U@^>)8&d(
z1&yWTC(&I#X5XZHs4~*ri}Pg7Z$z;@vrP2rRX|^B0+#VI)&?$zJK)zi)_1iV#|Ze=
zM0x^A#l?8HDQDZ&FR@^vNm*#Si%ZIGz+P8e!SxKZPmEQDw`BN}Djh@jD<1s<766g_
zOf1IRx=%SN>x<D6f+iFI(AmLODg2vWVs&CMMD=|4VlqZg>Fw~}k$=7>DQlljqCi@?
zy`=-Dxu*L4W_3j)MaxwEhy%Rvcb+kmPgXCW0L@yU_Zng019uu}N<sL;fGL^N6CmR+
zoP`Epn_xP{MYIF6r6`Cao*?R9%_B!6V(j%Z-4Z$0-nlTy(h5Z%s<;lD@vtS<dJ#ei
zHx1_wD9((xD4(S}U=-iVs6V;Zd?dLU)x`4R(Zi3c-pn%%pQuqEadK={Oep4!l*<zo
zV>e>_NS1J7*oGh|qnZNE&Cn3Uy@f1&j-d^zN0IFGK-o-H`ek!=p^J4gR}%P*g~DR!
z^jre#tf|ID=myx2OH&iBIGQ&ic8u$Ikv-u>@<ROJ!ah(M_&`T=S*#F(J&HD2VV9eI
zOUD3IZg|FfkxaqXT0mTDp+*N*Y4Qdhb+Hg2K!S(Y7v;hRf<R1~t?QZaWB=>6rrOIQ
zz1k2vhT_3GDi`ve7x6p<AhQ1IMY>WlzM^CyI~c9W`ReZ%Uhm4$%$=Q7M|~bn)_{P&
z7L^*`CGa2#e(bKG9sPv>S4klO!RoziDkBf%J*fD&QMu9ed;cI=o>v3ciatVS29t=g
z)=X^1PxssRiCyr+6qJ6M#Y<WY+Ne(q1Fr}MQ|O3n&Y%8Hp50UbjWez0m%b(A^E)`=
zWG|nygA@R;8~LeGG-nyDAFiw!1!d5)<~%cwzK!OOh~O{il1@r5>5b`$Qi(_(W)wul
z?i+DqX3Fg}z$&TH{zYo_Tx_3Ct*ra^s{J1&JFM74N<%>ehX8|tC(%l+P~T8^pLXFm
z6H`K|7dHu??8dG5$&=!jCdSz|m!X4HM@M?X7Z~A~-?=Y14{F=*E%D{9Y+6!|rY-79
zWG~;M&fH#*ET{BEdK(Z@cwyoodAk9Jr#41O_fssMbPx&<qpXT$DfTKlWAO5h445Y?
z`1Je?l%~N*MyrShFWhqkQG-rU->iHUs<$voc0(Kv6ttuwx^NxY7nK*?{z6Zh+-e%_
zdi7cuXl)MOdnKRwr%th|F41Yl8o$XJo$%L@=U#))c;yij0miWhcv<(Bejd5aePvHG
zlMSF6Z4MU)%iCQs^?^t5#b)p5E+&maK?ey;ZsC5GP|lXWil$%k8YOYnXZL|pqo|4=
z!qEcKw6wiXO!VS)oq9bN4<SaZ08UpE-prX>fsj|_BW;$d9}W=O2;Tgdk+l13YMv72
zN*!037M~52u-Z<MKY<UAI%JA8WJolUEtp4xO+IxzmM_$&38Y!e(iO3SWs=I%YVwn_
zDP&M!JZfYk5Gb+|8t|K2K~4aSGOi{euRhV+Z@W``lB2;=A?+|mR$nFfJ3$kOIJ33)
zR4UI#y9Sl8gL_2VHc%QIw^o4-{=4dAdTG(k=5^aVqVj{<4+gXF)KY$04}qltp;YvA
zmyfQ(FakC&nC8;kb9g_07^(t!S+Eaj1EnjqLbkX(T>C2^=;D#^Lu!bE;-fF!09`m5
zhyH96wLXMeItv54nsCvy;!RNggi@~H8a;q<iwIMDlD79np8^RU6pS2UwCOe?ALTj@
zAg-W+wFPn>IFq^2elB2oJ(0R7ck!8k%#SMsEg1D8NEhBcSNcR9?>&2_iR=B1z&vti
z2K)iBN7#M+1-Bma>~G>M@%AR}RtMsiY^7$fECgkA|2hZg?89M}e7GU&o`OzomEDBK
zxy!>J8Jd&qo~cVlECH5CzX*e78PU`c864`+I<<MX;A(;dL$z-N+xW6?UH$56O_B{F
zz}=oMBl4A+?wMc^gWnJKYw(CsA_vsX<$(XzZhr>3f~EFx?E*f;2HFklHD*o!=xxO~
z<@u4i)(Z<>(!8+oi1g%1IV$<?k{q?;;Id)b7C5UpS-EVNei@fW?72BJCw{iBV;L&o
zR>)#%_e=>V`IFh47=+_D8q~#g0St$lOsfa96?9-Fd1FQqYRvF7ArJzQ_>rwAX%`a6
za)d@#lci?)8Nb@rNxvmibd$)fRKTe5!?egOx1z0pYu)#>I;<Zk>-HwxpTqMdiV;Yy
zC6jf@XVjB*O<qW<r$nQh-JT=W5G)YMS-&#%ARKp-h&ZrmjX3<<J)0uW?*HYU!P8(C
zy<jc*x!9B1nt!`i1;+l?(Y<E(dKt{0OUg;Oz>h8{$3|K!_Hs2<b>*iYJxvJPK?#Nk
z2RAFAEDnpws@EPI%*WQ|fvlkrJ}OCUOPIq*LEF6irHBD(2}2uC_;c0hTrNp^7ddg*
zQ?I0Yj@)0PjkLgD`_jg2T1A=U^UULv&;r8yEYJderWUu~!Gd!8o_OYprY4v{>Q8j0
zI+{|2<TMbdmiO``KmgdUG|gYQ@5FnT^cd!gqg<}-@!DX5k_t13Iel(tUkSN|%L<x}
z=7srNzyZoXTX~4g?M|ic&+}EZ@Mh!fWR%?0=;l~^%~~<1$A8`}kZ*kYoN@{oQsk{i
z(JAwK^y1U9|GJZHF&(o0E99Ii<Hsi-EIkS<zo-ir;59qQ6=iP)c6?p`jq$Lc_WTR9
zXn`+y^M$Y-htH?*4ZgDH$~EC?6Ii|Dq*mQ<2)+NFC|50nzkW|fna3wQfg4guaNQCB
zdj(z{JIu|?iMC3|%Z+{b70h5v%qB~X)%Tj&oj<FF8#jsZx78WGIDb$tbfuR5n-+M0
zWB<*=_AHjoB;<+yM9<L<WD=&(8uU$0zzfB?05%1w@H*aO%I*9d(^iDt1ctf;`E3Ox
z<?B7Rd=doY44%&-jPE+gyKA;N<=d~`H<aEQSjMinLQ_C36(&$`pnu2X*uj=-ie>8a
zjH*#XX_noD8XYk$5^Qq$kr``vrL|bc4H=&E6$KfBm>A;)zU~R__Cd%98UPt41XKA+
zxE5LYqJ<>RAKmh7FsAI|)_C85Mqz7;wu<su!x`J)G$s0(+Rh&M6*n<f2uabirBoJG
zRhtn`JRuH`eg1dP*GG(;vlv{S)8cEjmnL=?nu3Skb*RGCom?{1z=ItJC^srW6`XIf
z8Xq!E=HVRMb2&#lk+xz^T8bB{be;yGSEms|(64vEda-}!HSPBLN9#E3<Yo=i_tA{4
z_=3vbx9>Zu0p?pZe)K5Y%+=@nvf@K6w6~I2F68Fw_b=QOSk}2U&cw4bEH->megxAS
zO&Ly-jF8}4_<<|E7RAxD-W`#6D>bSnEnD`I-tTw=A2Ed!JC1}rmFL1u{Q|7SV$?_j
zQE?D}iC*leS{fuPTnVwlpoFxZ!8!~`JHklVWKkt_$p=lHVICZ8kvD#yG=M!03cMIE
zCjlqHK$H=4sCHTqhhXITMnMk~iDAg6e4L_vkP9=P%t!$VTo)3XkR+$IAt~2DGPx<h
zAmY-(ZrjK9uaoUx`15!gNL4CbP2poh67>Lgg}&9z=GW-7vHng3%X%2Rkx|V)Cp;89
zqFa#YGylMnPe+O)#;~W$30&#(hb3086S1HvMUSA8ZFFcit74=Plr{V@3@Qb22MQv*
z$HhtHErj|-LRk)VGADX)|BU*(Xz^m)I)0eKaOOtc2k<ps>*cVvov9~!szu01YFQ`X
zk;NoOLTS&3(~dzLZQK9cexOK_7Xm<1ecxDJAr!+1{Y-33GzrIaWH{ZQ6?TJ>PmpIT
z8<pIQ#AP3rKtPf+hysdnAO%F}8P}a4oV{RuR1K|`0k&0*PqAZ3fgY#yygWD)NGV%_
z7v6C8uEXVVS5j}}3SCt}OPOeVf>V3H=+y^xQ~gX|lPjSqnx;MKmD!)l6WsBrJQ~ln
zw$Q(xKEN|-VMK{w9<c!IAPr`kSmOi9pzfL6`Jss|&JDHa<FCJ}@z(aOxEw0R^S(Oi
zmBr#;BO+__6pGXeWV{r%2?TZKlSJ<2g$#ZLsV}~TL7K*V((;h(0gUJ{^-X=-Ni{WR
z5*l?^s-V{BKEV?_7{}DHm!e$3GcAE&J%$$g#7G||+;~+<PNwbusgca};raY6N%edP
z;wpP6Hl3b^2tRaU70iv#5D~Ki&AY`CvGsf~H?s4DKW*y9QKUM#6QuwRpkeyLHSYMj
zsjyrNCwpqCbHs*0_{GQ{tDGABzj&lMcQR3-nEL-09x2G(xFA#>!kK-a-gOsNeKrZ~
z|A9LSIr}vOtIy#8$=g&%uP`QOkk$JoEz_h^U2XD9%AAKm_BNu)!J_8bH?lFv7+M#|
zj^KG3QFv6b)LCU#mYC_^!U`q~6oyC+;4C*)XWx=}U`oFpA^Sl#c<(K9cQn+nTd@#&
z7{PwwAPelvgDHf8Kt)2-f=xyp`#b>K5OTh{X8lx)?@JD>Yt5enSN=%8z$>W72e4J@
zu2vTc^}<aC9OArkmGJwz*Tz`Y%{G%fr0kaoNwG)A5I?!0Up?uzIsh(-gsKC!FFafw
z&gT+wc<)I{wqm>q`;va3`U7M*wnZH~+3L(`^ALwdY0rhbs_<PVn5QA?GHusj9Ce?Q
z7rT_?gJ-oYcr{m`3ArdOvhvAX8QQ)tUSjGcrR*G1BOb-@Uo0bk%9j<>t6jTtseFz_
z=Oix))2ME%R(co|fA)NEFhgXz$yO>=Bq||tdL6CZFQSpA^cZFqa_A{4gy5o7|JGE#
zAi<4Rvg!m@%8u0=?fbNU(bQZ_$oj{KwCUB_?lp%=bsc$;GngEhI*<z+p~Rm^pVv+r
zWbh-@;M?l^D}E)sWr(@8H`G91y~aM71A^eF9=2Vv1O&q2s!%Ztv2az`%%DoQwAXvN
zd}3#Iy?@2D$rm_Sb)lY%zuKFxNz}jfNn)B>6`2VxkL2>|U7nI_31fOv6sEbPL2vdx
zdq)%pYxsuZ_+F3JWc|{30oQQ1%k;GHft8@ks`!`b<o{oAnnnFXt^y80x?n+D`w9|h
zh=DKjru_wMR=LU}rC)4ms6$0H`|7bU{;Xu|vk^j)jRH7`YJbs)SZtdIv|(U2ZpsYS
zeZ;3*7?%n641Vb$(4&Jl35J2uhZr}#d#*~v5TUy|o2f*eazzrl$Hxz<b@b>KFyh#m
z@IUb_v4#~=M_xCv$<`^|*LZd1A@nBz?Q?2}PttEs=AF=e)n$bQ&`90aWN9>;a<oDm
z7b6Kp6$HUFPO~ocL@Zh<G8JGjy#>b=o)qf{*CB0rN?B}W3`(zsv6<F=8RYHr*%3Ya
z@X&5N!ewi1V03`9_X%bL157%36#Jd$5rgH94}x>7^P|Sa4DYU8?P@Qq&4cxXa0m?k
zI=nhtb4dT8de<T{)|f0}q3;2)CAyTF20mt)^qF$HqM<P@dbPS^uPU!Bb@|^AnNsI(
zLT2BjJ!Xz<{~Y}oLE}`5W(sosQRAXkU_#fB21OHtw@5p`$XhGy;Vvq(J-nAfP$Q<v
zwTl~GauEL?EC7a9dkDGQA?RLxp{BJ!=~}hC8k&M$Eup*qfP<U{0rM9ii<fRpI>J6R
zIXNV@=v+Fbp1@B8uJZ2Gpr}y%)de;fCchhd_D4@CcrH=5@`0NuZK%%5j_PNpg`TY4
zcO_MLYRlvOi3NU65!RzUQ1C5YT8u0x5C$D*Iv(Rcc$8ZfQ)cyXhJf$hM)LWdhgSaA
ztVww8I}CM6@zV)5?XW8NSWeYm!|2jrsHL>cw5fBq&cx>{?6!2R#6MaSi*&S)72PI6
zy3qIf^N%q0ZS7Cjf8OoH6N!0hTF(1hIV5;lwN**dj`ey8^)FAWwPn>bXAK2&VN1ZH
ztrMN!F8G5k126E6PI5h=3H_`4uZ`I+M)NtbQ638#+Fw7OLkfXELVn&|1HQviqaJxt
zO#OgI<pk)``<kn`B2SLx>fYTre>0T>Y(|Uj2#v2g?Po+E^X6p!Ft_&0(T`Rkb|*4p
z5RSzCHBdb#D1-P=6YIS3qle(}&<5hN*K!34k5%4;1F`AMr3Z7P1Gw>HaUqWj8|DVh
z11O#7$kKIB^_+-QUti)2_fHzM992F1U^Z;+&hCT(Mo?D<Y$7m>C!-5tfQi4KZ|Fqp
z`frCW1W-XQ<-U|erLn?fI$d4S@lMYM=_gsxLeYmw0Hio|EK2v;Jh~TFsi6S=*xIkj
zjnK)Ky+)swMQ7})PST3v<q%$d8u)qgb5)RhtdSaWU&!o9&8GRt@jZQzU2?uwEx-OE
zkg>m*9&2LwL4hQ^;VNjR8mJiCugQM&hh!>mV3mSm1lwSV<kcJYgRpOMPC1kR#8Pq9
zDEWzY%ugh-o(tQNvhgVD0B=kI^VzMUzP_3))Qw`t`3wXcrT-}RBZzYWeUQd%cQJdk
zVqc@|T1Y{N(u(P<?Ehm{F=XvYR4xNI+NG5P0<@yjwpRd#zvcTt%oqgZj<nn*KnO3D
zb>Ew%S+s^4_^vc~Sc2B5Sw^iMqE80FBZCy5Y!rgft%FnHNOySg=w|ewEHiW9Id{A(
zbj(Yt-bT0rwoDKE|0gCQ)`3DUy%d+qV$ININ+KR#Zi4i-MR))3|HMXgojjU|*-HI^
zU2KAUUX-oa3@L(VR=R6$(MS=0D<%2fb`60+7!t9+XI$-L)kd$-@N>GH2b)>7)dMYy
zV`ku{ZpO)W|1X^>SIiIT*IL4UGlQATWe3z`{xlb=RyI2RRVLMlr2ap6G3_sVQ(N>^
z0Gz8ygk{2DW%XzvvM;~dyugpGv`7<!`NBUdNWJLKICKI?bziI(4VPIpt{D7Qq8gnb
z-D}X5X&uF#hRu$M8=>7w3%qMq1+escW@JA*cCj_z7hNT21nV8S+cKWg1W*^S6()n0
z1el<A-#7oP2KqA)O^p;-yFb=mS%Lu!H<%i6+CZF|zqXI}m(ZzXPeLO(MLDK7D~dki
z`7!47!%n+fEyQmKk*ow3*)$@)Su_3h^tnNM=MEnbX7YmkZ8)bOsiXtdSmH|)mE4Gg
zJ4)*I7BF*ZGzvWOf_(X@D7|xl#EwT>m@EgwicDdo47uqK%QI_m6=+S@#fy|MoI}ma
z^o2-%n6XrmuCK+oQ?#ldqvK0}?~EjE;1DK+I5=-XO~#8b3D#t=9eYW4<oL>Rin)lk
z^)!@W9?Y&^MHix2+di9Kw<@(vKa|0^$e&FZ4?*l;%o(TE)Wy6ktfFVv5Od3ligbyD
z!s&9zuKculY+3k}c~B3_o3ytQ*oRHuUX4LH_7@J~7<IF{7~F5<yjS};c<kUCzF_)@
zPj}@}f!~g>AWcY``mowRTW!>JZZG6CRYI0gs%JHHkDqQ%>C=KKLTPkdvFw3gKxJ3s
ze;L>K-xwS*RX1$^N2px?2U#{3g!SZZ3<)fBihV=v&%qpv;s9En&VTPlQXfKMJ^W6S
zOkW#J2!ZTy3QxN(@Y2-as|GrdAvcfAnpI4{EdIjFk7EmaiDb!9|5bFRDmljp10yb=
zlZt+7PH`HP@_V3?UDmbPhNTPv^GF&(C=+FNO)z^Uar1~UR6r<8!O9z;BeCK;W{$Pw
zz-<gEp-{KiLuU;Yxtv~1u#v=W_JssodEOeakmSuXR~OM>+a1JR+r0SMcqjl+$1F8j
z=&M^MaxxH$?mWW4qzgmItV73$kfd6^4Mm3X%Wmu1FagLWRtAUPzhbF=O&l_vRInl6
z7-BiE$kF@tp;ACEcF+Bu6>G~Ea1I$RrmoaHtETnYBb)R1!xug5*}(*dvWcJ^arD7t
z9b7=mj)@sQ3+m_UV8J50H;yW9X}6(TXNAL$cY<%|8m@cJHAri?+QjQ%MMF^tRE+Na
zSzc(osl@xtm6IM&hn^2*0mU$|Q&~U7kr4{$$@6CZHA%#1GtlopddalweAV6Nu>&TX
z1=$QP@!t0;=ZdA$<Z*`UQt@Ov@P-2>N<T1;4xh7_cP@$OJT%o^SR0r^|5f>FS9$z5
z_V<gb3<=5D{<eDP1|n;`ae>$$0t3c-%qAE^pIzuAjaSP#<!;P#8STn1YqjDlSrO`6
z1AOQX>Kwd_2!LqMM-Di|q<v2e3BMk9?sZmF0x)Mo`u)dT5M|sj^mg$kallH*EqPYW
zPB|&e;3o|?9vc8shc}Lbwr*oKqCuF1Uq8U@a?f9Z%#K0X6S%4+dfIgb)zxxaPGidz
zvvj$Sor%J+?Z0=WksO<dX{oRES@FhSETQETS255+oBJ|b;D>?DhyU^i?K3VsR8gO)
zuSTT|?fk&t1x6$NsCIH(q;CclgndErc^4>h2{i{t*72pufv)0HOo%p`VgJYe|7f>&
zCMGTBH4c7#P*?x#I*lH-Y;%E4#SIjG2cS=40px#SU_QBNYDyhRu2v^K;=jCx$s#77
zEzL+$8BNuAJi8vr8_AR)IVx(s)a$IA|C1+dN!vUAohRt_aw%>!x?pA9WltgK4H$;%
zY&Af%44hthC7%b-8HBI;v*HYYeO$`P?aVBKLFX;YFUWnjcki1Y-_Eqd?7UQkn;b4f
zVk+wP;XLAj0otm;9PfVz#-WxuV8G6*W-jHZXepfIId}G<9`}@5Q5SMl8Ld!$^9T8E
z8N{DfaX;ACr5A|bXZG8#3+Lz$Rv{IqDmKWgF%}n4rrH12+N)yM!$gW5b?JCQQsa*u
zWCfj(W_>FotwXGFpz{Fpv-CLl0lgNm2YWlIrck#pN8LGi@GeJ#q>BpewY#4C2g@$P
z&z?q;c@k$40dd+Db;yF*yx}#QhlATrwB0Jhf)4|oHz6ku9{gi5Z5ie1gQWcSV19-k
z=XgHd3Elbw>-P1log;O{wuR)fjoh!){U4tCsuu!&&Qkkoz?#S*p&@==v8!W9$kTcF
zSWHwlYlx{E4@0zq%%E^KkF!syynT$dpE6fxb=p!q9A#`;_d=`&8#J&j;@vGtm7GND
z0+{*uPG6WG$j+!+pGuEoEY#&#aoRld4++w?!2$bEoR7eiw}>xZtS3h)(Jm*lZ4piW
z2wr}eEk1vg@Ac)YaLj4--&9H>#ELmGRqU!j<rcEF_@a7zNqSblEn&xvz8g~3egm&M
zo1vE$6CSB5##6=n7u4X{4YU0IAB@ER20r*N+~A)J2LoJH_^)>O7Fjs*$wBa#Cv@NQ
z`v`004e(B2wZ8>hc@eLM&DBI^Voz3EbhOEE9%c5V-=6R)<`+Z^QgM`=0(Igwd0&}x
z_j=Bk!rn7@h=h0B4<4h+6@fT9Fm?k7<EAivpqtTOk0rh7)x}GdZGk_%j``Rcj|z_e
zOj*{@QPZH>L+017dM~->5XE!7PDX)}%VRcpTlLsiJl@J1&K4m>w7RQ~F;s4>!)o{V
z@+;x+%SdxsEhMKQ*((|M&JbrLWxfogEeP9biYVF{ec~RP6|_M;r#^O}g+(@h@@{1>
zr?|RL%Bf>AZRP)TI99Iet+g^-`6{nHu+zM0HEBS7p7N~Px2DgcrUd8z1bO&F^7QM3
z{dLy3MvCPKWfh0z-UwBYFa~KqvMSWMyANmD@5vL^bouYU-Kuk^gFS+nE4>l)OZ6|q
zF%EQE!uvgLea!9>qNSxR9s9O!hFV&m>2QWlW8-3PZs*6<Qm`B~;usz}?(X!dW+T7G
zNaWgAxnxWH*7rSy`y}R~RLDzGGs|9ny#GTS6H}P<SM&MUbz3u|{`5-Dw2?4&3RX!2
zQDu5j-cr(9Ul=diJnqM#ee7?Gf+S`Bhw+p)bgi!)=DIT6UHP~TI>0tzV4H^X@SKh0
zm=}c<L-eQi98mM4R6n&GBg@50f~WZ)uJF*xE7m;AI*pY7Ebnuc(HQpo(u;o?0bl3j
zC<R1KuTD2gISrz341(<%6O__W=A&0Ih)T~cmW!ESexXoY>_E%!qx9hIX2Se?2CRhq
zWKE6zn}+>wYs-^Ljyd&LJ36#M__}IqM_*s-xOrQ@iJG(x20PkG@uHH&r<D_+$`)&_
zoxD5W)^&T;PMy?73vWRMWlwE36^#FzdTPjg`20L!>ANkDb&<SvY3~;*4yQZ(`t=$*
zjOah*Y&gwhB319<CkYvNXzeW<K(fX=@uImHpQ?%OQZnW5WQnovk5(n^-RISboIDe+
z4H8yXrRlbx$xr%$cA`N9St^pnkzLlS=Iy-!t*i{q+^xyixl!J{P>!3FwgNBdB$e&-
z^Z^tmUz$kzxmtmHOD3z(rKrtJ%|=qO1i5XU+mxbd!}ztgC5#;i{`?gNS7hSjl*ds<
z%|iT9SAoi%psnC`w&mb0H{-#7Xzf0-+T4qNLELZX3FpKVBUs`~F>?l)5PEAh8LYMX
z<Th8}Df1_P1+4kvRo&VkDLSNSD$+L<b|Yu<)6x5ksy6FTcBfFcd5Mf1bll*2^3<7c
z%YC0!p$dhZ#)w4K-zogxAY|UgHTG%*4RhRo8+Kxy+wj5m#1CY5<4K1!1>+qnx)<P~
zEHwv5#I@WSvjz*?6U-;}CB-X=gVZMvBw_B(MK&+=^ul`>I1*>@_T@}Frc(wq_-2vc
zFz)sud8Qk4mv9%}-q`oC*?Y0D{D8@y8BLprW_Nh#9>UjDng$+Fvaly`sp(`6x@R==
z)mlI9)vU4K+~chsyYY@HN6Nv`Ld<MCT5C%P?6E|^I$Qbh&;0PR&(nSfO`P(7T>Kr`
z@EpBn8}Y-voEby0^NP27xeZm2S8c?<>pOdB4g-3*c;B=tC9qI<rr^%F?r6#*RQAfn
z$yn=oyw#i_pgo=Sx51+u9XH?0h$z3z&Ju^!M*LjWdv@JieKcB{+{?}3xBiZ^#`@Z1
zd|hA^F5@h$9D3B51TuSlY0%v=@#)%Cz%O;>bD7!lG0GOUd<s3`U0gw7lj3ap*_Ynx
zZl)D;(Bb=(O*<$}L6Sxih~kXqD=F52(=CFb6Rys=cP^fYx7%YxBF5Pa&EJuh1&1kz
zGoSSJfP#Y}_SUxJ0$zChY#>!#T_-&RjnYD};ej84@Bn5&*LFI(0$DS2_TYj=-8*c(
z{*_yAkdJix^fLIl^~(Hx^5fauc$`G9l4Q*+$-JU6h>;^TwG~I4cl+fw(rsLqnJC*X
z4GB)|B{{bskt{J0+LE8bW$(qV*t_9?0ee*eJ`LoWX6Q7|^8*S#U?*(6-FA@tx4Gv@
zJ?E-V{MLBtTG+9%gs)BG4&^s_*5^GpMt4f~X!R0(sT=~CA4Sy8t8g;*+DxMB53Z}b
zH${5`0i|8=H-1b93mZ*ViS<$vCKR?)i!Y`SovBsUo9Dti54nd$4ZnL)*t}f~y?uw$
zIgn`<YO<3||Hoy1?0E5b54$;PqeqD^h0;b|t7sty^cX-QHeZjs;7Q)U%bm|4N`Qwk
z`7!U}%5a6rPUevap+T1Q?bt&V#`x-|+Jsn--T7zCm`5IRz?&uylzjss2><Lt6#gIJ
zQuFs*;MXX}9`+2%O07z8f)R~&GUuy<;QxY`GG-U-CT*D??2_;YoUIegqomYzdd?P(
zhK#?9_dE6*{GCg~jr8TIr9mOtNn^r~YHa=BNm}3_&4u-02aP5&A4Z{U3W{?1t%lbV
z%L0QbxOqFUic{BS*Ht01Dy;b+)XctnJ;xw(0}OnI?5Oi@ucA{_zY#G!cE#W(&CdSP
zcmF$G@nB)0#RrN@n7wU6X?Cx#f@D}>v~=6D3)It@ZOM>oe!2}N?QCsLP28rLXjl)g
zMwyz`0;C1}KvDYr!LQG=h+DMEO^PISJ|<Hr58=DiHj+d+by}`|-8FjquFUfp5+hr4
zLOKg$bjG1t7ZGXx3H@sg!9mT4aGt8bwj}Ek7>u*t8P`McnrY<D)S1PdY_>XuFWF%h
zr0N!ZLG#KoWJPHNt<1D++1lTjo3mb8V&%@ee0o%^MYG)2)pbAP;qHf3!@J4Af;U#0
z8Gm=NxDDa3W}{(s+vRU(v@!`T1^A}hH_vQ=V{T|7$r#S7u%DBJ`6q-=JfyDrifL+^
z-LqZtMxwK`4sK6>MMY2U1Ddq}1|7U9IT4a?8yu~pE#BU5E+o50FAVYvo3h>?HJ^)$
zU~pC9c{Y8@00>(hnj&!P)**-(b$sqNug}t?q?8snu^Jh_8GQidpELaZ9vnnZ*t=7*
zz%yM$)tv6>Rv70BY8vz>zNS*n`%732lqpm|Rfv9$y{0U5-Qv4ggh@}bl)<hAYIg{?
zJG9+L;YQPfWz7CB&fYR8vZm`6EWGi?-QC^Y-KB8XMjLl%+}+*Xt?|a41{xZN!rk2&
zo_Fr^-Y;fu#6--Wic@v!)H#)zd*{x*R<2E$eKLVT(%00SaMAc1ZmQ!O@^2Hn-NMY*
z!36<sFG`aJw@Ed(9K&K$Qq1Mmd#~Pu?{>Rsdht~Pc5nYHo<{5qCBRYFNNRoOQlxb*
zS`OWLZZVXKo$Sj(_Ud}Tc=tt8RG{M+5hF4JiQZbtw}OY7fWFBiYjO@`76eH#c&iEZ
z_fQ<Ff&w`Fw5~Zg1%nXp9yVP((O)!oe)JxTcYYvzx@lNJ*D#w)cJ-mJVqxB&neT7+
zD@_;x;{EgI>%}f_q7MIn>1+55(#Py_2E$)hJHzI>w0XRO_M<6aQ_hELabdWqf|1$p
zZ`wr){qg5%93Jg#<@79?SWm%;ldrPP>ZvnwH=jhb22YEu810UOG%8=@E>4fhSF0q}
zaex+3hzon?X1u0WTC0G5ZUO9{*u((WwGBmHf>L-S%B}im^4uVz$wXR4>$=Q7;Ws?6
z&*2HCvdoGs1}?>tEff7*v=K_Mr_X9%JcQjU;XXV?0HAFeO8)DkSNNLNVL#CR+c#Vn
zFk25$f-f3m!wY_GTmf4D^wT@&#CCA#m4?3_!#L4gX|)}RkT;?>rjecg(r^+yIROf9
z9CV<b<IlcAAosHT8h~rP4ep%1_8=0?G<PS%$sEjVk?F5ae`6Xb8u8TScuYsqR6fp=
z@c-bM-P5s=j<o_1a+YFua6Z2F1Lmcpk_MYV@EIX7+y+o2<TJj{YJy_Vd_R#FJg~n6
zY_s7!D0E@#8{DOz+$mq;#d+U-F|qpoRLgPX;A@cX_aqD#<F<*`$0T$(%Mk!(btR!T
zZ<uC~rJGLi(^~`$x84`1ObsxaU$L*y@b6CN`KIh857nDh^f8t5;Qfxwci3D*_*S=2
z2!8;_($JfTi00N?y}5d~Cr8+QIpHZMhwFOaz+;GH^~CE!J|d@w@X&>F-EX!?ED-rS
zO&<>6gz-RUmxfA~m>k+uvuNZX?w^{b4ht~xyLwoCY;gB}xSo`m2CF*I!%3eQ#C4!F
z!%}7cX$<Nq)o6lh(%(K9_Df!Mnk3gO$S!$F+1C~vI>f$wll?Fdp@+YGDit_k>gmqc
zk@}OIqtn42cDZ_fO*<!<arL18O7`IGb~D-$PiL7FJ1VOh<n$Iv17joP#ATWFXX=Za
zB{r0kTX5rKcrn950}d_6#I6YPyU6E0Sh2t%(4Sg2H*y~YKKrj|yV2wPULJJ6o`k*?
z|LyT!8qmvA-oAjs+=M^6@_!_9pJ`mtm#|_B&SFl6y#wd?liuC`3>xBp58ao=HHQgq
z^s^1)lUb<4Y~A8^HRg-4d<zt&wca2hu}IRgswPzET+Xbo#QJ@{c8Kx!Bkw_D?|sLK
zCupyg{mR$b7T3s#RB#{MImBP6eA$1i|2AjZGiU236UG#h1)0;V_P8e=08XS?AgJ;@
z{eKcDeFbWZ8^I$GBI7p~Io1V&1svcd_K!t-XK1*~9<xPWnoz)}`}9VPqtmzm;pWYU
z>5d*bjqBT-s~RzO+=(OO7QSR{j1b|vZ2jQ#($2`REWaX$_GFs`v89)ya32<eOQ?A$
z25Yez;l5QCy5&ilP4laA!eD6SkUe)BXe1tK{5kw_R#o-U<;Iz+F(i)pCTXOO<$@3z
z$A&G;ZgNJY<yTM&{^$P}rxBP!vJyRP12MaT>?KSuHV;O>9z0lyWd`vdQsemAC#i7@
z4iPnYBNl6<sEW%9$K>Wj5u%NI=eUq?PsJ7-inb9&H>;hP2kY`j?S>~2wh%$ipQ|M$
zk8Y}O@QXSKurQ29-WINfzCKiuUZz@nuc=YA7o!=-4uYnTfbE4=Z(^r+{v3FaAF@0g
zf5ZLa%}dgi<4G<_2NA1+@KF1O#WX~|wIzwfW!u}4G%~)=-h`T@WYLf1YVMuXqqOO@
z2O#N&&v{dsUv~YaSp|vDbC#HE1UyiRZl#HFsA+9Za(|iTHNo1L*XXjyJ;VpaccD6*
zHQ+ybLn`QYkIPOB-R`1a7;Z7WE)+yxgdri-l^Y7fN$=sp;R3@Y#UUZl!6dvc7=khX
ze36m9I7?j9Keu=95lW1QOziIN6kiei^_sMr<NjIa^P-DSV*m64Vc7d|G6SiBi!r-9
zQPt~brA--vnmNNlDC|kpALt=!TYLc>1P{L_?;2U;sW*<5Lbbza8Xpv?&gO!2v|YtX
z2|Ah#1#`pEK4r}!LyMH)mJ)nE=CjUx52my_w4`4}U3fp@Hg7mmnPoa>`z{&`TB*P6
z*p~_`<-3T<cs7bnkJPeIvM9S5tvuA)G26>^J|{E_==rgr#~k)<$TLYfnL*X<f%TRW
ztvcXNQC)Gxp|z=Pbbphl+p}AGubUgEe_y~<EGmS^HR@o<|LtQkIj0$&31*6;#E|Ec
z$@H5_GB%N~fY>nj>de~RztZv7Rcoj{*N^YfJEVS6J5(8pXk!JgT_}LCemWm{?AepP
zj@cL~*7g0Z$Fl4dBOTJM#z;lmU+vBGK}u_VHattNCg3Z76k9P^Od!VSOc1P(t`_J=
z3Z2_^-xo>`t|XyOXy{~^rnP5I1EzHy(rJ~JvOen#b?XBkJefFNCK%lgVTOhvjm!pq
z+27rGXs=wI*7?n+QYVWU-s5wxEqGcRr^+l&Pa57<FBIiGTyxplS4-;=j6rNhxyoQn
z<&nRp+(Q6b?^{S&rP|4;<KAmOn&yTK7$W2ks_yZ4mZq`CiTTaN*p-^lqg&3v@~PV+
zzuTAy-I3*4;NBGqxnj`Z8hdIFHRtL2F5@l!w6tx5{jmR?l&N`PCNWRP{8Xn)YHYW}
z(Qp-fCEbit>xL#dPWr(p-=Q8V6N%Jw8;ie@uI6;gX^^qU^#*!$O~`Icd7<;ISpBs-
zbSOS77&#{AyDC+Tq+9hjrrSmtB@x(WV4SPKI<%L14vK$Qs#Sp*{#CX*!Nj#XD1~TP
zO2bwWqgsU2+zGExz<;0!mlOk7UCIz;WZ6qfJ&|1swD^0nGRL4LS$n$pP2zAFcf6Dw
z^<Ilkr`(7REol2>ZR@;|gyeRX$U|&O38!y*%)(t{MZ#VRb!}ztt#l%j8z=QmZv0EH
zs$C!r2;c9*usA(m1*>$CJR@kh{u*HmOxcP}<NlivEnW8NGm{F3sbriHNEKIbU9@?Z
zWM7v1q<G&HY4$CYHCHMcheKa-IpvHi%tGx+cNO+R66)6S1<Hvk%_+njAoa(OtCFB%
zf0|WMW-Y}Rqd`GCFg(3rp%Ic|&r_cu4;Ln{wK+<lj0POAkmhEhjI9{0DMi*_)WkfG
z<xxwpeucBY4b5n1rwHjPHJA1jY|Gr^($pibr0ZmcQMaQY1=Wv|%u!E?tKw$vtxzyg
z>&SKgRiGf5Fu5i)e2vhi)o}d^(PmpKNyQLvWjUz$ePS<77)KZe$>asbiK=IR-fPZ$
zqLW`Y_tzV;Lwy-8vPs8_nxzoO{x^B=>aX-xQlzW-G$*>Ipce=vsRgn=SfyzZWmLgc
zL;^tIZg%DTz$5HoMPDwO^k`6OSP>d29h;{8`qhM9x$5Oh-b|-yzi=?;(CIXaF7z<i
zIxd+T^813(2044&&^72QE8>OH@St*dh6B`n09)8a?e<3fNE3sO_jWI+O$Fhnusm+0
z>(u3>$>0f?z(UO+BPL@`eZB*OnJ@I_LB=NP)hbFa!CO@~*-fvK+|1(!^DeKXe^e)u
zc<C8SBTw{|bh%qpfV<%&VsGX{g4WG9Fxd!9Me43l(tLfUHi{iHPF6sk@aXSCAJPfG
zr~OtJBmg!avbS(fh35V9x5ZHHT9sH42vT_N=G$hjZe?{8?))G)tB%VqubMo>fWVX0
z)Sml4i&Rbu=W%Qr4$F5#A6bi6qmg?+)`Q%h$@|lt+lx~|qEPGeGKfW(X$oVIpKJMm
z?Sr%2yEJ=vDZ-2_FI!3ZolVukFW3Nbdw;vv>c5M!;WXphTAgX#|8fDwbs*6eunG`c
z$Eu94CRV|O_ZO_E>!N;M^3#*eT5X<xNeygJrJcqyC%fo!oM`jc*09%INFms0al-g*
zcYZ2DYQaZkCq`p+$Qn-JEkrYJ19xIBhuXs-KD^en8zyB8iQGF}a?V*sA@kC{#u~7F
zZGKI-j*ToOSOHL0W)QXF&Eji`ruzdS?9^d9np`=JJ5@SYN&3E)c<p@s6pik7S>+Pd
zI{#E(Io&ag{XXor@roQ<d<d7933f5tyu%>42RYkf*#V<0i%B6FK(#E@ZVNycew-9t
zuE%LkqbvK(PJseBF<x$=^e0mEeKK+UGO7q7^Ns5|5_{*jUs~7W>3UIkVaj5f+8&Rt
zeXKW7e-vUBt}yv*LFtaLzUvXhPp#wa%W9DNBDGfT9tr0Wkboz~{}RcE8JC=z!>4Ca
z=E@L6`(`rxV{V^^swTg2t{rpw(Vq_npn6X^osmcIDcj=Y|Dq|I-|!%$0=7X5(7Vlz
zj@y{v%`>#iQ6P(3FT;ZZ3ou@^k?|)-VYyy$xy}V;De7TxSZ7GWZyu~=b*}oF0C6D0
z%NJQAg7M00=pY<<C|uGcrZnYEc1|7Sd&a)!uTQxDIOeD_l(+6KnU#9s<tHdL=3C{#
z?-97qQcVckY(uoUHF#*e2s;?W+w=n_Q_<Hccb9r_F56jD`0E!z3(pd-!Z+zO8}g3N
zI)qSe7zH*`vR;@)++053DJUxOVNX~2*h0HmfYtgeN2CbS<X1g^gJ<>sSpwo-9Vzy2
zE!%d)F@DjJSWXu2C$#wvk6~|KXhclqb|rSeEFkch#9>zau?Y1PhB(oRLI4(fP2(_H
z8e_(r!=780U25ZS1A}yJ4sZ<}?J?`TFT<Zs04HpeoSgSder~?1it(WV`+Z&E^fcj{
z!TEv9gdsGkmod&qaL^dqz~HT-O;vd#&ygiQanm+usNo|fE0chj`MddiGLKK{i-<M7
zVP)|ff+IC?2G9mctDhyvQ9JOpi60beKc6kzDgMQ1H8t^v*&v#UIXfvoZ&o1Vq{qf*
zCE=0Vr%W3D>7la&);YQ$imfk|iB*p|7<w3$y8<1|_HI6vE9&aR_#)a6Cxs|knCK9w
zH+*T8oWBgB-o`VzF$)WOc7ycnaR7`QGMtWZbERbd?<Va#8T1oj{=n~88cyJR9-Qly
zbgs{kBqsc=j9PQC!4sK{J$v`vhQ!h_B9*8E2wx^gGA3FMG-Zn#ww2ZhaK>2d;P9`R
zAK;VgWI=hsQ%#q$%mzYgSL0KT_|j6Kug%c|J*J~)!F8FvF%pe3FeS5vIPo!Au6r=e
zOWj03mtK_9Uoi@Em)|VAJPG;34o?7^XW(mDeJV!7kfTkPrzUIj5WVN@wpj+twl@tP
zIJOtdh&J>cQf`=JxqZSI3wC`uJC@ckU7R>aoegYgj$JlANO<|pU#=~*uKDrjSX@~m
zJs<hh3DO4qJnznRZYvHL_mq%%{TUXipWDnc<O1m83Em%ocuIr2{Z%j3(?YsVqfPZg
zn|by?tDM$5#M_#$Ny&Q@R0k<2DtD~+U^Q7h-|Fo2T!YWw%!t~eGagnp1#a%mG@&Ia
zX}Iv|_i>0NEQJUbUe%mwigpLr6yKe}7D(zBlN{=vw?Z^vA`62oh-k=5X|fn?mLJXf
zpG#Z%O6+o2m}@0&6v+;{1Wq30ILGai7AWTDG|Hg(qFH3zO}sa>e5a+@v0B3}oyuPi
z161VmB<9<PNEyM4X}uc0b))`07t2seyc(S@l@y`aTZAKzjf!e{HWCDPB^TjZT84ni
z*S7|GCll^O-L?2LU%7=?2m#F?s{jDO7$DjT$rl&wHm~Ca9zt|@Ko?j(oqH;C@{42X
zo$$&m3Lx4GAYQ=Akl?7jl5+3z<MYb=Zl!CT_?{c0<K3`E4qXmt3_ExL`F?yTa>EgU
z@JE&uE~3k=$nwL<JoqB&ss~LMtx_f}9km=2@!g-rlw2j;Wir_O)7LZ6{bzr{DSx#F
z``*=W96u&y&JlJc(O=t&9yJBm_}UpfCLEgZ7B4EY=VdJqSZ_ccs*A-DQ@v$flr^>`
zs^Y&Mr84@GyZn4l^$T9k9PDb2kXi2Fti*&#6HxRe+e#g~uAQ1^M;GL;9%&#>pUMfA
zEvY+M^tadtZ!$I{^6+ai%NNH|V$SG@c#q!0_3<XMnCgzaPWG3BYqgZZ+KFDK@NIVr
zAQ7@Pq0Polae9pcS@VF+mqYT4L|v(GI~~=PK>7)4)Dw@?qe=tf8)y9<G9zq_HX}F5
z;@=1_I@15Q*Rh5#3D(V!F0cDeb!{#ds*F{s|9x{M)D3*uIaK|0e1CLr;5CWikTJ&b
zJvRhXT&}Qj=5IoyrE>2;jldb4(<Zt@a?z`Jz`RYcOGzL<u^{l;$cchqy7FlWtr+xm
z_z2w4xB1#p^vJ%a{*N~Mmfkt~LJj;-E*YX%XOv**G-Hu~ms+D^VHx!zCpv5UX`olQ
zB&4Jz%l!2{E^<zR4-DHBG^@ThbGtuY|2+x>3tJ$mvJ?vBKp(7fRybU^5u`a{b+lyU
zKtwCix+lp=Tb>f!j$E_F{Hn5_`5(CLBEkG!@HD;%*E3lbtccmk#tuB6+61=?;RdSF
zAV=gxsD+<PJ;-Ec_J>>1^Zt&Of1M<;8I`0CYU_D|j+>|;kVB!M4(|YnDm*;U2Cc$i
z^Q6!x^G#p!0%Ha8dE->o_}!bOj<-4&N7Zjxyw<|e`|zTSo$Jfle!m9BjA;nL2>j@Q
z?s5Zo&3oSD6aZLCtnlLsy+vW}k>vDb+*mgE_Ijy8V;vEpgkOHUStw^yNa7JgnqvWd
zTfgPu0+0wg_vT(s*V;*9{IoN)>@h}AvUc8&fmfeOpgFpXZG~tmOgmh5J4DlT{)dZp
z8x^F1Ar3KGZYH3Ute*9Cvy~r_gJSy0ct{I3wj_JUID)SIV|j+K#(bdnt+96f0|Fj1
z$zWpz?WP(gNxWkEo8v11VBE!%^UiPGG<%=-zc1?_9{1`M%RcqV<Is92m1Wj0V?K&5
z1WC=Jf)|uqfVE9FdsYZ6Ry!|MDkRX;lJg=kEHcU71CfTz@xItfoe@~pyCO=to&QZ1
zDFh+Z)}%Tvf(r-@V21!CCz^mMh@3&tnu|3Am;~DnhG*hB=9feF?DVk&pYbHp3Qp@I
zQSp+U^0J)0L?lYL(VL5n0qhnasOsYH2)eWaa$b~1+Bw><>&pP#UTgt^GFCCLY(^TL
zM4iCbq<gjb048?xyD<_P8ODuQ5&XH<H!RaNKA%EC4OK#zB%2d9KY?Me-imE<rOq6s
zPUO4aZyY6!Z^wuU2a%-H7-t&>9^Oh>P*GicZ{9D3!@*tmgzWj#<$Pr(l?E&;<@%&x
zh{^lk118szXtEqyK?nc?B^HFoY}C)(w0_S^pMC?2#pDRZ5M-2)yN|!_jU|wi_Yd7x
zu+EZX^1&C-kzl67qKyaM3TAQ*IDq1(u{vwff{~~}pO?a=tte17>&d^_qx}<=YaCo(
zM1<xW3P;9OQVahBEqtw5s(6^bwJLv9vgyoP5#itJH=u~7OWqixUHiGA&Wp#trCTPv
z=6UBktUo32J6(TIstP7kLj6eQswhoTjr^K?9zIA4`XkOdN15Se9|7R`H`H2;r8yvH
zJ*S~jGCH3PTwWsi+YV#^?t86|$J9^!WMm;ArLs#h9rh%r%@inti5i0fg5C44BqhY`
zH<8t#0wb%LtIA}hHt;(8=rXcAxbYFJOy92ILX8TJLX^H)ZCj-7@ZwYE((@wlgYlJU
z(<~6PI7JqL$Q3TY2pdJ^$EOAVZFA6PHwov=eT{_0Rf18p%u<xv@?<<_Vg!mi%sc*L
z$QBa5%wJ=m&yg@}4yNdA$axv8Rzn?V5G{P8&R&=U8-6gvXXr9~w-!#tWc8+|*6PI1
z4WI&09BYZ12$w=Tc~e(()`fIrSz_1*Ouq6a)|CG4qfuf&^noUF8!4H3JaqY+#<BuC
zjoe?86aKleP=rndA{l{}hg-mdfIXm!Od4tb7XqM}?bO<8Uc-BE=^GKucK_ULm9sb3
zzAY;ZfK%ax9V`M#jzvI<d6#lmWb52oPHYN7Sli2ta&!A&u&|$&;y@^y{co9%04&gD
zN0D<vyc<cs6j`~rcEzKDpOW2-Q0w)neUa-H7d@ZbQG-glealE-8dJ5W>|wm!j{!!%
zTR<H>a_Y3Fn#LyfZfY)+@#^tOj~{E-!KPCCFDC!XtRg}r8N)KjZ1Ph+^EU*0?+Gjn
zHGU;8xGWM5L~Zg{fKFl(?9ct?qQq%7HlQ>DGd78Hk(R7gnT@B#XtlzUxEw-2KY_a4
zqCF}i3t&xU=WiykCdowA0bZ3m(K~c;7?jde>eHz*y4mlyBg+k-HaWU~8<e5cN<D;y
zsgHe7GJt=MDRd$0eS5w>^X0hDOzN^C4B(A|&?1t8({^o#_J7KH1PaipE92`f5F6%1
z4<AyK@s6&c3&SEjnM394tyy(^l2;Qw=K%E^NG;Yq)u(IbWTn);8Udg7Cy{~Q``kIt
zSQqXkVN+Bp-cKzvZ`N0<PnQb2=nN3%I<ExG>dPH`icUD6ku27MYH2Q5V|XM$b@ZNY
zA^LTaw-M3?@pK(iTHZY6AuoIk)tc*7oqUQqSnC%%s>YrnCm8$MTENIs#vSnQHs4=$
zZCoS)M!RfyN;ZtLcqzwwe@tZO0G;;lYFWgVY6j6u)8UxM<Ks;1$u(zPhze94X?_BX
z?~6;gW&2U}b>_)a$<j-vQ`QCjHS+w|Oy7aSO#{41d_-a`A%M+q@ana83Cm(o$;s&k
z*jhS(0Q|R%P93&oVD>Y$BLzR)?hRL6{)uBpas`Xqgnm_wIjd|5xM5%=@sEJ71?jzk
z>7O*6FdhZuQW;BHDFr^2UCpI+m{@Jpm@l!v_bcS&P(QZ8L6&P-s_LvLI3gNZa}hCc
z)O}yzf*mD=6<Gq)!cyi+j`?tDI*0Uihb6d`4Sds6N#yH@kJm<q@nfw2X57<FM3dS=
zITs10s#f-<1(NNjF{G8Zg?=tlbgN>-Q(DRqBO7|m?|rfRtd-%o+kS|c<BCEnVIWYH
zH@FUm%az4@!tdAg?!{{&aQBCZ{1~(S3h$1AP{MJ{@N-5Viz4ObbXO(j;26p38Xq4{
z#PmwrLHw+@P^{c9E`FSdK)XJv-a)k`(X{?2vc<0;YyuPb*;*ES>tv#xlFI<D_+;f2
zh{{x+KazH<X*b8tObRwnC)?$$GxiXMxF?ZOSxWnvnuUz-n@9anXl003D{U+}5LO3_
z1DOMkjQnScyhHJB+jR^rDHyej<qV8L&PHT>&#F&g)=m$?T>0Fc!E7?0w#P9IIGcYd
zBEYlk%=7kNWBWCH!q61hc$B|!KKgXvcGqNkoKIg_&HVXl>#MR-zFoPzxnVyF$}(|#
zhK8ecWMyF5sWWUavy9*mXoX?7-UKV8fC_Q67h4^tja5qeSxgYn4|xgTPV@?fR47|T
zEK|H-b>@hPE#3&0vMJSO6Qr&Ey%|aeCcL}^Q8@kQ!1?J^l(L>{$E!Rw#>j^;Prnzk
zwHSf#iBt|~H=4<!pI3qbyEb&^Q_+wbM>6J*dxC#M|Ahf+;@Y!V87A+%`HZA?X@>ZE
z!5^CH&O>EbH&-CbNzUDd{Q+C(PW}7utaCJ~mDlECb+t~L_{kfn4|et}IEjl|`fC>&
zTmZG4YFI_LWQ@BbC?RbKjD4;r4|O;(T)t<a(YK?KnqF=(GX9~B*STjTiS5kapqQ~M
zEd75ODy5E<-g^Uo91WWu#K&a#T#(!Mbe8C$zg_T9fZii+0WE)`%pL>3Wct08bf~tj
z%J)jf+Q&;K6RNt3Yx9F2G5(now%%;t2cT*QH=*`0YJusN#`-9t9swpc4h5vtKxi_B
z_0-y{%lS%>jy^5#ZL=~^lhQF$5baVY{`*0;ZdDyf;O(oi;RJOS%|G+toM?z{22Ku;
z#($Gto4xuQXFApxRw%Q8mkP`WsX1hRMQo6DDpi`qnpu*25EJ%9^DX&@9_fOump^km
zD@X0#`N8;x>FJN{$cE@?8nevXVgh7GD04vmC&b!7-KOqJ0^w1(_~ZMJ=+K0^y!3)V
zM_PZn1Z$ye*vX<JTSkT|!T(H(;$oEv;sqM$5SP4cq~*M(#T`Z9q}U>0Go`4_`D=Rd
zc`6U+jgWwnMw@u6U|`a1_wXy}a(zZ~9GBC!f{sYAp*FNJT{_Mk&FUX}`p8-h{1RJD
z?bX_7yr|bpTvS+Z+Zs+(jfFx^>W%096`+}!{nVUS7zq{@JWB(Y&Z*cFl4%{|;Up<5
z0<N$DLr{}t6NUcC6t)ri3J<B^^kAp`*=&Tw+F#tVzgAHq03vVVBIxM@c;*Tw-gBuX
z0fC?~XGgOQE%d;CXRS6ocZt3gkFJj5Z$a30Q9lhrrmTJ3AZ4HfHkVvq>xe=<jZJxl
z3vP(H!NW|dYWh5nD`Y&=9ta{CNT_)}hG3-1-X8a6{kt^@HGk&b-zO=KRe_d$4jzd!
zls+2Xe9fwrEU^OMkut8;TRG1jYm;!Gg?*2sD7Ms6tNGeCK01Sr6yFS<K6NXMhelq+
z^@2(C9L7R4epyE6HSKM7DE$KYS50=W-nt)fE#`TA4{L*G2=?H-Yc}?5Mf5X$@1<<D
zy1w64;$o=nV3A#dtK6La(EdYyJ)g1))#aOHkYt#?H14r==D?&8cXM25TUl*wH!q<*
z^W49ZuP5gB@**+N&X!Q|jT_P>@9}k)nDKPIjxlmwbm)2Jy&E>0dfFiR6Gw#KWBpbu
z)C^nbTjjbSuFz;gmk5fcI-ARIWG#O^3Lt6jO0Sbn!W%s!D;^UsJ(y^7&A5zp*-2nm
zn;cm$AN`blz$FVZx09NHX5UXF4HpsNTMow$mU-6v{UK0#1m1o^!AOS!4W2<K0b(8&
z*F+2+R`0=<FDlbsrxDGjp&ZBd9Z;_~A^!Qk`DT#s-7`&@OG#l~f1=EQ#2Vkm&^0Y5
z|DjaA3oow!MHUthCb2Dt31!`e57BsS4Zt;Q$;EV^DM>cgCYp(C-XRz?_{C(iz?OnH
zjZ9B-0>m%uGtBC{k&jyYbz9!^uF}%;gs5Y561lar+PCR0;k?~HZ{Fg_=%m0=Y3lvj
zJ%@0{VB&Q@`XsTP;p2MpnJd)8-6?ksQ@S><Qd{Z8Sip=`a^W}Zrfq0w+wKv<0TQMq
z9$3j)prH@mI(>vZ%e7l1qf%SkH_2L`49{*K04<F{iw@egeeVTmbTNmW+vUN-hC1g}
z?zzDSke{8CTIb3YoVNB^x2o=t{m)xO>F!G6WEJk*^|8H~&uiU8oSN?G-R})ARbZtm
z(hbb{8VsdYT}8UG@+YE_oLc+b;qht$67ox_;hW+hI^Y-<`B>e4bs+;J8;osaoblhi
zU>eqq3i@TWxw-g0d6sPX{OM6oa)woPY1;K^`B;DB28;ot>QWrw(2^I$y94>*#qzY;
zn1)`SxUv}1%n4$4JW{Hagj+`XlWA6d{ZzY19p@Ct8AfhuSWK<X&bS0--Z>kpb)dH9
z!-DEF?wjE}p=Mj}mDbw7j$3to*CR0e7ULU2la=@xYt&d3Q0ipxNb~hkA)CHlcqpQN
z0J+(`%TF0#80m3p&ko-i5?WV1v<L0PLec$Bc)aYxPm3^Lhp1J{!~UQkdA`ObStv0Q
z$=3!8VU%58jmfXl=E|&bZnz`Oo!HU7lWyr(P(oPorbJc0&u&OJqRkYu;qk}F$w8dR
zj+sQOpezg_q_D`W2>HzLcVw{5uYSuI(iYYBaN)cvh`;tuvHP8LYh|DYm%(?&6`Y!O
z#Z^cb+m3-I@)v^)R^k&WL09%kWg-}a{G^k{Ca6N3@-C37wAa3tHFPvVDxwpZM@K+5
zFyemCCAYbdU?qF{W1@VY{GbdcDJY~AOgZ$J5;8_ELKhzKtnP9ET%M;ksV@VEo|6Y7
zQu8ZsDsN2wa2)Qz9vAMAagUVUCmpbnCO>UxS(TR8o>=(@M6oygp3u&rbVB51yB1jB
z+~9=Lnj5r%hz1j+&{xSkKk>s|1}mNe?&Bmzpi_B*-5?}xf6Itm_LRj9JNfBLx3Z~2
zG9^w#@2F*hGk!K(a>C;guZIAq-SA9W!z-GtPy{-`D=#ogLp~>H&IJJeV`uDet>#$j
z&Mw$IkV!&Zz9n}Wg#wTga}t3uDfJ$8nd@OpqK7216I8LD;0hU58MAS^KjkmUWV>v9
zqyS+g{pxArzwBNm<Z%>LU~B!_SNB=tV=JO^ub5L`Xrt9rc+Y<hXq%1X<WhaJsV@N-
zFYF=Y34b}ydLjx{Oe<o31}RBRzr9AcO)ZMvB^H|2-4W*9tRFD>wYpIvqJspx&;P>0
z`zfNQEn)3056*?|X*<6yDzKOuTyi(ryElr^o6m$+vwN*2hp2TY3u|i*ChSdjJ&c8B
zx;rdNEURnJt&}HOlAOTX1X(m+9mUS&y*z4TVa}8q^4v~MA`7jfSD<l3CKsdr1eC7J
z3oAvMwA=i09D{X7u8bvHV&uqdyP7d6q$p;GC;TB_h6NVDMEP{k7Ot=7wih8x5r$yt
z*?Om3s$dh4PaX*m>Nii*3{isx;Wd+GVEU$O+JOnD{Vp@Wa0RjCjpclVLxwWH6Qrm1
z0gNWetRpx$k8ZT}9x*E?v^s{!<4qD1scD~QL-3TU&2-{Q@Zw6W0p`Wrp-h##?WdJj
zk3g3hwCHKal|1NZ>WHnxDQ(;$!GW~qvb`&xRGuQaEk)Dx1ncD}YY+y&gMdbX{P>R-
zb=8I?{{)L&=pP0uFdbE`FH4)hDLNM>Rsov`Fj(S>ZQC!y^aofQuBKqVx#yD|Ymu+r
z4YnuQ*w;NDCurTEoPhqe#6i{Oin2@%0v|s;bHk^+lMy;Sk;pt7JnwSsd>MO64*o%#
zY(B*JHSD{UC+mryC+D^<G4S0yArBv$o_Q2#)a9;Wz(EEbZPgx^xYDO$dW%=|JgOY(
zfayr}u%3h-ld@L%=&o$zi>~sF2EUs;H*cHIqB}`7e9q!(?W)4%25LzF;|RzWu*Al_
z1@erKgSz%#>uG<;D;D|lZl|6iDKLuL9*eGiUJG62yleJ;SmhVfpT_MT{2G<12*b&Z
z?<zgU*j|QgE-_Sy;PTmKdwLos;RHy_*f0N`TM<=+G><&G*GwuQc#2;76GVsV|Hkp*
z)#vYm`6C|+sv!R7JvjA&1YLHOdu|krc&!Yv<}xt8QG?J%0-odV_~cQy)6>B0WK&Hg
z^rqYi!mzD{p1*~tJNEV1GDGOESTvO?1P`Y(u7O7J`-mU6^|1M1rYsRW{kk(kLg{)L
zn;FFfySmf0&-PXDY`N^LXP;81l;F^b{-K?1F?94*SDrlHO;@FXu%{Ev3_@h37V1XY
zlgcR0!%pAFT=0Yh1*=oBhgruzQD8@@^7iqx`+_V*3vGa8VeB^J#ilC!RCxYzpyNLX
z$M><d_Pm)ZfBCrxfUpZk?#9;HIA`S?c87U;tv&E?Jku(8f+V!n<%WhG@l)9qoao6W
zg;RbonDT9W8$UK5LtNZfys8j<WR_hSwNL*wr?bggx~-ZrlF6mWH`nMDU?u&V#dIFz
zldyphS2H15I-#=y9a7^E<2xk2zrb(zW!IqBmTX^PFq%r_2<1B*{7=%>T+Q(lwT3Io
z4cwqD%lb~vh(<eRPf{)7BV0`T-jd9-#rO~<uB{^2bPlL&+!r+3)WE%vt!0O+Ymev*
z0FUsvBOh+Vwgn5}JAipp2BG|Z=gcm>W#qP9Xc)iiC-zP5aBzgtxZ`)G)HC6+AfLG|
zNLW;IEx;m9V?0Oo&vkzltkp~c0$Q8JVq-cL{w5*rr)GzEJ=WTPzQ#|TPyH+8I$jA|
zcR%6lNT~fsiq9j0&VrF4_xr@Gc0UAC9oHTSsKFji1`YL?$Vuq+nNHC!I6o6+=D`oI
zY%xFSIsr8`<&;4rFgOh5K4^(jvA8+F5xoR1KkGJs{I_F!$%pn^@_3$G3d+~yl0>N&
zB<auFN_(t{h%ARUYJj7gJ3#R7f<$TX#<|i9h1>5<U(J0U8G8sFZrVXbO`p$5D0QgT
zaEMi%6QfbLladndTTJFm6GZmU4O!Du`3Aa?(Tv~$dV*sscF`*%A8A~&UJ9n4aIrP$
zc)*lANjjcbq@RrcP+4$#bmdv|J?ko7Zby<UtDn1mX6Oc(hBF6ul5qP*ltUpMf9XNG
z!){P~dFSy+LwJP{`%eq~bA8~y2mJ$xp->do|NDdgaRxFnWGBeIl9CL@TS(OoPIt5z
z9TXJvvWJIC=r~F+TS|d{6qY}s!5WvmPb3iWKYrJPS<C@)x<7&9@ZuW4^7qa>+dzNh
z=?^WvZq(cf-FxnR<sQZg%7uT7soYmv8-wn3!;vE*!XD=uhSUe+;CP2GHbo=?2Vf1N
zo!Z=Q@S!|{jCUJQO}|UH(hi;*>!b|vb>n#a9zbw$x#Iuh@9;;LpW(5G#C{Bn-KFmu
z+_(p}!Am=hU|kfHy#<j5thKt40EFWZZ7#3k9?xxahRkcfxCKqZpG_jXX+seX3%FrU
zyfBN7as{^-cOTSaUki2dp+>^Y!NEnJA_yXF9ea^dQ`c$SMHasjA6538PEZpkk#{h?
z(~Fp?E8|G9pM<(^490SBU!(X`)-)X7f777tdUfckDpvS!o7+$txJ&fcrn3_;xmCWM
z6@G4T0=GG+8IaugmkY2ncfjmQ;q(Zj%Z-Gx6%Ob+yY#ACF{J5?L0&9MLiwyz1@A3n
zf2~uFcp?xc@j-Iv2>}v_*Hq>dC4$idMS`n35JUuYY5t{)y@n{Mg6T?;L6u>K?^gk{
zi^8char-(i!|ek2KBf$WM?j~|{|b7G0PiWZiJ?tpr~P*b7)=dU;qrSKokcm)3{+U%
z+G%+I=>I~$65>jdjut$m;&BLJLAV&V^SonvIij!;Iyd}At4n0HfX4`FQ`jp+c=x`@
zFSJx6pC}#Zksc0*&3}bz0kbtTt>uN;(FqO?cMnI5752M8S+-W@-+?#}^Ucf=&fav9
z6Q2)mAfK0w8?b%9(`$r)7nE0+03<TjZc_2+6ap70fP7R9&Ko)=Xe+7t0v6UChMaSC
zD!RrF2zdBvn-vS%7@4j}+0*dw1Iy$JNhIEaTd?hK_d#i?thdGR(xlxi3t39{biZA;
z_+o$)+iIT=@TIZWA6&(&lqjV2smCV#9e~1;cDXJoo*ap`gl=Aj>0!+Z%@q_#Oam@t
z-&?U(8Q#9=7=0SR>F3x4g?Nek`i|k(f!OJ`#6x8LYo}dobKEd>>u-riBZ3-8s&Os3
z3vdz;-+;XerH}*2r-tubAZ4#5RiYY9kr6`6ryr<(@~DKewGI$7ffVJ^P{F)LR5K6p
z5i{4p!}LOm%E&WSe46Fy<8JHOKBxliq{tN>WBh57$wP<W33Z1i3aii5RqW#1YKb^J
zgVBkrvTS%(61Nf8645e9x`UH8OKhY$fq!wvuyV-@b%5R(#r5$jXgvFJT&Xx-db;XD
zzHu00Ay{t;AS)cGKX%t+s`w*0C+J~{&)X50OiByF2bFhP_L@>AOhUjL4)+enpP+n4
zp)tT-K^Xd3f9su1!+yp?NzS_GN_cj4EPiW;fVs&Y{wu`wGu>GKzRTf`pt04ohn*fY
zMnska0T?Ho0Op^$M!z7r4?3L(To{I^;T!12dUP+9_x2zfd<&ZQZ@5Kpd1#av(1y~7
zzEype{MQo|kg#%x%2%&L0Ae5~z9P2fja-6RIfR+sHIT0SAE-pzxZjJJeLP>gA%^a;
z+0Z9&ckYl;>{&AkM><lLhWbm;FmG%2+HKscvqN7UtJk17eq>Sk$Q9J!L~L{f3pM52
z2A4gXwlkE{OVx(g_4X$dtZt<}IZh9jDvYWdziQDN1Oqn)H0*|4%wHjI=Z&Ue$#+F2
z24-OsJORp?;dIcqr$}jJ7<g-DxrZl#^ZxOD8L4TmBbG!(bqs}!n?KFauN<AFR8@vt
z79oNCij>kg{DlKo6Q1Zt#yhbrN=8?@>33lEIO30?M%pAG<`TpSfv|yuJ88%MIp?p*
z!P9O)d0V(`3D2DR+@Z%}8EU+OUu2{oqJA8Pt|zgE`=Tj<ppW1U0yJpSW*Q6s*d<mq
z&9AA8>fNHK8O8KgzGwzO0be$#3Fw{qy2tI>TLl7scoj}_!#cOar7vObTcNm$F)Zy&
zJ<fwkAmS_tKpxnmCuN)Xs~e=F)JKoSW2o@-Wt+?(cfPLa;CUYicQPw@zd`FAPqcLF
zZ7dxdE{0|rCG|7Bki)9>#Xve*YDHYe2k$Vl^=@vg8r__a>avI{;Kh#~>b<wJjJp*D
zC_fic1T8UJRa$O87qY-Ni!xyiT1G~}Q8yDo@@>8p&8QfG?daD;{YYcLriwld+Eo`P
zUvH9@`gd@M1ajcuUrF~M4H&sxm**iM0jwIlg=!B2$d>%^vP!r9{`R=(YSXyV@p(mL
zJOLQF^S^tbFu9DZ6}c-7pXXRh8NvV@u<~0oB9y+O_pTsvE2~>}>$dJhBISQA>R;5K
z9qKtxlTb}HK9={u+=`k0stE_6N^H18octEY#iVXs#Ewh%KBzy2rW)znaQGKDhi>`u
z0-9(uEs8lkIZYH~eP|P9C)YsxOxO~&Q|b0a4Z3%$pF|HJ{DYKRKRjnT|0kZkdH5wF
zin+}LqT0gGHRms?rty`7%n;x=-}jwjtP>*|OK)vgs3h{OncBX-qH9lKI>~2&hw)Fo
zfuryOmi{*n<w-~Xv#bB%Tt>*NV%GP_)X_aC;7CsPzX;TObM(Lli6Bh(Cx0$+F+Wag
z4!KCp9!p`oxJ`h9`MuGw@s?Z5Lv0l>0qfRFoZW<8p(Bc<fZqQju|-AwmrAF2zX8?2
zytN}uFI}Dnxp`L%_G(w|9)~vqML0L27)-S74>7Dhh?tcDLT*B!m?_H(%EA}LEAB)a
z$;X*7B0#BsKnNp1IXh6{m#LgQg*mP|imcD&uq}X?N2>vqPnEdj`+wt!_Y;Izkr>k6
zD&uoeMS-YGn!_cC%A2q43`dIM>Fxx;=r8AA{?1n3ZKZCxVK>5TzCFzPFun7{q1Pzi
zT_p%}LGpr0XsV>P7yZIxz2BsSNkIi5(1cT2t>9k6w=k&HjScS=&9n@aYjV2~@<)*f
z{6NP?Z4#1>K(Xr`F)@{AnA5LnLoG%CAaum^M+MFH!vfg70FEjVH=mt`*UyFfh4Rie
zRA~X~(<y^RNNE|jc&*P2;8c7Nm;On`F>d20$m#6gmuKi`%nw=6VX97+?tP~0Mhd`J
z>W;|m(R!d*09Bv0=y+m^;h1#R=yC-RUjBr+CUF*%@-8NnEZjf^)vx^%>HH0&B}9OS
zn>hi)jc)f<REP+k7+;&2gTnFtTJafuGvJCv6*~4H2t4<bAcU~<wnDHvHsnhtB<gzX
z5U^DlZ`#3>fB(i*YX*qL=0I`A%HJh;Rm+9`vvq=e#nD?nQ;WBe{(}p1^IkOArg%o~
zU;EnnHMOa(SG>-g_a_`I19$YSpjdnw`Jy)*pTVqES(&;awtHKe{{d?M6*<Y$WL$nQ
zd+4~PO?AYs#k>TNZ&qD0xzvm4NEjnfWP?7-CyHR_ityWd)}L69F~68avV&}UF|r9c
zScGnqUhF$3dkf7JZf!6PgcS=RNbtw1<<+vpuG8g7G!(?p6EsVmt-!M+L|<|4)b*H7
zfmQIkV)%--X{VuQcSif))Eb=ll90(BH~n>UsHl?`RZ_5%tlN(3C(A`jVH)=574OE+
zHkQz4zvTtQvjBR_jUdeS7kfNr#&fqC5=U|W<F@Ec;k}9Jn!xs2%n&GuOCIU)eLIW7
z$dJGx-r{@kj)tGh!+YZc?!xFKk0+L`J_Lu|`_IKVl6$Sc-$8B|UoIj<I|N=z)7&Qh
z8(}{>uyM1(aD!J+APyyW!iB0PqX4Mcz@4bA6SDi%pv1mQEc2;Q0x~PvpleR7Meuuc
zqW6#v=ZL0b1}Zf@cHSbPF5S^s)CN1KopF-^D`Hx>25jJ(Q93{+_QxB3Xe40=tYV}<
zU7Vh7p9l9loxQy~WjvH!B)rPhBDm@;*>qMj>@_s$k<MSlArJvtm=1{O2YCCbH9!#a
zQ!-UbgyO9E(4lsh(n4gZz!uyqs>%QzH=-;U3>S0xYquVdg2P1v2#-PLP;(cVT<$g=
zxWKjLx;JAoyNLZnYw!ecldESux8L}-r;To|)}ul<UbDHYG6i=x4^6}sQE4<-qBh#4
zaZ}O$7JAsIhcgbqD}zp6Y-B+f9t1PH?JqXcQzZ-U--mBG#bL+8|073Sl{&_OPK@m6
z2o|LCM=OMe8d8rySY$<-;=i#eiPc0TluN*50NpZTf0C}ZiwTN*3u*0?BGl>Zn1;Ic
zFT%rq(!zb5m=09HWn+~oArJxlacNOzE`PYepT$97Gy2EI9nDd9GGaS-8giZ{wc_C4
z^vYl1E)972CP-u<{c1%lRe0CaB-L8kU7zz56hUwW!?!Eg|9AlKTo|hcwgKE8V~b@S
zU$Ld<RBxoXepYIIBdIJE&8}RATN$2EC<xd#We@jmEcmTOJceY9UmmU^mY4~~Ekxg(
zf$$s*4g`0RiRFyr{R>$49ekS710zJHQb-mIgL7aUbK<U7^oflX22d?6jW<x2M^Uk@
zEkZ4gmLAdMm8pHpO*lgOfwPf<QeBHUPAD}JJGoZmHrSqEo%>qt2zUm;Og6*VaKd?!
zQ?OP%a7m%UsUZUyn5wljsEos4F({{6S3$l2TrirSDksl`AWcVb`vch{y#KCFCi;+$
zeym~ZF~kMnxSS$zLEFcG5tpNdmRAYXK$-_dtSe*2gnO+`)%Hu>I5MMB++*`0jQa#@
zZonrw!c~YdTMC{clT8Ik>VKobV?|Yn+}c1#^A1$(e=z1S+5UsR1}!-)esA3i8z~*E
z`C?HeBT349t-Xs6bAVt@?$?1tXe9vU;JM=hsTxVrBn3hVKtb`mBd+>t{+a*m&tJTp
zNL%to`UxjOx3v>M;7=;ER_HDU%{jEaE^-Os$E!TCxW2Nt_uZCE(l?OiqHsqdTSgf6
zM-W~5m+BaR10t|LIfff0woGa>if73W@f+c}-MO}dN}5AB9o;FOt2PLCnkH{G`&URr
z-=i&MY_aej^b7T?<GQ-Gnpf)|DvX}Pi{L|l+FIJGKtjBqMu&RUdcidZ`R)UQeMV~a
zl^wOm_63xCHBAOAsDCB2m!A6#fHC~Q@QYO8E0TSB;r%e~cuQH}HZ}Z<#@USNoCSg}
z&V*3keUkKSU!C(**}@${T!MK2*Et6*P0c9Kz3~iWwLySgS|4AL66iS@OL)f7#SLbS
z<?y2O6Ns1<<-uS1vFu=+32$#F5vjs%-dDc4!Z_$QQV4a)8?J{ZpZ&!g$*;mCIzPf=
zmS8bSS$=aJ!8E9EXeUmb=KR0jsh%|G<|^vT2U49O7+~~jZQ@Y<$@WnlL8_%J#Yzxd
z%<gKD5q;sLtl1V%KKBczbVq0io@0d*o`g2)hE`07lF4`yp!XymJ0>edsfiTjB=$2y
zhE9wdOf-zVN_Q?$kvsorLbrhzbx<0hX6kPe<FWp4UP$Aey<po~8)^RR>egix;3yq6
z@?i75KA(^rqcqzer>Upcd577GT#_vSMMh<b%&!4G4$Xh3#67<)a=j(TSTC(BRGwZd
zcx>lNoQi)D5y0-roejX<tl5!GcbYWRG8=UEy|Qpu4iJf&ha61%ER49-Sm;xPWT&;m
z0}yunPUfd(<mBHBh7j_gTw7FKpIdV~)|=}H!#U4+^}9P@S#mNf97iee57{<4rhQGD
z>{>B~{5YL*opr=<=_g2UTqia~{`=>|>^58118N}_*|JrjB};P1TP5S}|0~Z`ayQ4u
zuZapPCZA`jz5KZDkuqRIc6o{}9JK`A3+>gD`|L*ij-JTd&x2%nGleZSp@JF{BjYiI
ztUJBfC|RmF9;otzgy1I4WCMND3z~KFUgJ}#3MB=E7%h>{XX=GK3KoQ$hD3bpu*NC+
z@2oA-?+-K5y3|V8nHPqp;lS?wD`w7SMux^37`Tgv2+d<)7&}KakoDwHV<gdyTvSUQ
zK^}3Qzr*&KZGm3m@{lmmp*9bCnz*`XsxSI?DvKxHA_?)N!s%=tx%Rx2@0-Az(h4YQ
zuDQWCDZ-?PTf^d!*^tuR2t$W6y#3r!D=@lG80AI8l}iyp2nmVQ=V4jAUlbh(B&NI-
zeW&?^(v(uIbP>*=aSyoxMSG7P2M}IpdH-gm0wGzLse;7%ig2=bSRBm%vRco@Z?!93
zsS_N0HGCti)AMR(ryYB-ns}KZ&4=L+m|E-=AiNW_=a)lW_g8jw6j}7cc7OqN_+-Dp
z*xcto_E^YkamnX|meM=f8(*bys{;P(^<a^isGSYdRG2UKF|J^Pl?bXjqY_boujSV2
zi4Q8N!2dSs|JT9mPout>L`-r4xi<g!<(cYYC|J~DO-hme9o(2#pq`4;%%2cgL<bR>
zk<TP0x$>X&U*-aIq~xe?1tg3&-+{1u!tOq4cN~{kskqLvMB+#q-R41-+Y3~o>CIB&
zg)nGwp}ETor=Ox;ITI~^dj5uu@MCAwfa_s0-e)W+9FdbrSg%C+mvpsswFUTN>jfnU
zwU?~3UQ8MX&6(V)%6Ymt{_<(uI!@79-hs`8dlg<-_<0RNI3F$3qj`8d-s!{78FDta
zXE$LmOTO@+ET^)wfj1C~+<6?m)3ZPF-5Gy_@|@OuU3QOdH&<P?U!qP!YOKi}EXe8T
z>3TN_&HY*!yZXya&vdBUH%9Ik6BFK8%VO4is;y-<ue{&KK{rq}@;0-65qxNWC*(u}
zI`+e4F@`_(YvFW9<5>_&4=dY?lt^w!-Udu=2+b<;s*3El&1*gX1gzsoYMTPi;2NfU
z#Fh4mYIDAUx#r-nCX?L_-dB%+khbGp^(=SuBLBp&;Bhg{vFGl=N0@nOnMRS*a%E5H
zsb2;J<6;z*XHwTJDMGP2^e4Qrtu<zmPNvYo<1jI$hsVoFM7u@%>M#A`1Lnl5CpU0#
zVjC7&oDQ48<++139HDg_8{ACm6l&Ix!0~mAW~{yK%lu(dxS6<A@x)v_+>Bp%(>`|G
zO_N`<ZUY?6OkaMd_8xR3nN}rXG0GyYm(c7#vGzR2n}7W7VH|_u$6M$4w!{-W3{6D^
zd|5p>*L5B=#<$J&VA%ZWdsc+Xd*LUkA`)P+qHz7<=@8boyScl|xQN7M$Sq3pbB2Q&
z59WBIr~TebK{Qz0^;?hy@1*UugGbu#?q+!s!v+Ck9Z7;H%l4T?SRD)%6%3W0{oBq-
ztie8VUvkaViFXG%)lc7U912Z?Ew2#I*2){qLiy!NO23tBd0R&(r^^`ADXbV(>d9Lf
z8<$T$e#mhNzn2%|`pUhI=;vw2!7EInIN*x%{?ek!c>gCeq<V-!U5~B`V|?MXQu(P7
zr@8Xl*If7hMS0nA`ek`+U8?qr%*S8HeVc&{hv-zF)S|7mytAhYANg|rUGL>yuI1j$
zhVsTT+t2rAP$zEFKT<deGVF=QbHAi~cBYgc%?a-hO%_+^X_A8L_&DsWP{YA1quAfu
z?W|n5D6+rVOIN$d@mh5VQE7>q^cH-<?VOb$TnMM#a71so+VHZXRbZY-8Muph^i&*i
z8StDJlcfOkf4Ap!e0CxhY4@d~Yi72;t|TC3_aW&pBEzP{X_K5hk=p^A9MYheb1=vL
zd5r4hyL90yEjG{6O<n^|N_EUbO>fihUo3dLDDgT}1)sZDvbDAFF!@W2KuJe;<{@1I
zl$ulQ3PK#_BKL<s-vSNz3n&4^HmomoXdq-wBE5!78`o7Fc+j$Ef2)7kq9Ue-JT{HS
zPC;GWtLyi0WXEpIDeeb9hl35J7rtG?jrONiP_2PLE|on$Ms=DS!QEUt0o&-0x&vR=
z8hWGMu1^Sb(co{%T;T++O40wt);k9G@&(<(zu2~I+fGhw+di>vJ16#uZQD7qZQJ&n
z|9$TB;jOw~rfN_#d#0v$_wHV6btB<4`A<HYH?tnNz)^wNXTH<zNlmA~dZIg?hS?s8
z-nxw)w2Gk;P700H(CGf5C-norpxKV&s)!554U|cDy~k&?vD{*;8cB@I35f#gQp)Sm
zjGI1x)0b7RO{UzOGx7<?u1M{(qC*$SZpAZ@)P6Y@c||Gq@`SuVL)~qEwy9H3#xuCs
z+pMmSue2VM{|It=RgwPEQXPUC2rgZFSMtjgxOX_#a$O{&0R)gbsJjNrL6VzBB}uwF
zJHs+de(w>1fGj>{Mlb(Dd^ezdznr>>hpp6TrynQZbBl8ZCAz(?IQIl?aw(zdJ)yv~
zcaU<Vj#Gsj)aAFevpz88ZtV9p{iD}Cjq@s1KlzKBW0d;Eu%voLj_t$pIaOGDMqbp{
zqsteabV0M`v|3+*n8-#UrkHi}DP3fAv~ozmfsVp+`jbn7jq0ud1{X-MAt<F0I$J{S
zBdL=-gB5${_3h(GXsk3rnr-j;6O;z0sd4DTH3{o3qf|ZK{9LJ8I7##MWw9y+VNd=$
ztDZW?ily&;h#*MET$G+u&y<`fxAB*H|Cf$iS9IKY#$*ilCjG{ZjU06W=1b#9!*-L3
z*@pXbr^bI=io*Y4a5Z5+`K0+myn-NTe0%A)63>vK-~phi;qsVi?ut9jYBxO<+cmz9
zsQOnG=<%rR7^s<IH$3_p1jK-9|AJ%?bJS;yu$p`Ih|;jUzS!uL<<vtJ^7<&^4>($G
z9Oin20v8nq70=&U(C_^)VU>i(u)jd|g1ET1F{&{c*4Beeu8yOc>`z2F@cY&jL-*Gu
z7oq8}4sm3N(mQTwO6p2&sCgRrhLy~`eUBuDT??kF*9zI<E$36IBPco{-5$LHY}SKK
z@Q-be`>N^i7}GAvSa3hHF`)o6w$967(U~doD}6ZLCr2bJ{LllpRfB?}w-c>%0m^A=
zc$5q57zMvej~GS+wFGk~O7Qlgl-xm><bTXe)y4dsU*vvvBc?0Zc94}|>Zy(c|Gmnn
znCe4CbUC4;y2eI~x%+zUw{UgOx|U+~KPGJ$$TmifJYJCDH@+siAVekPujd3@$7^gj
z%|FKomXMO4KEI@K?o)^%m!v&-U9w0lx1TEw5-nMeapmXKTu|mmq3(Z6<-ZR!)S>~_
zyp}wKr+5!-`#cf;)-PFz%=}QA6s!E}_xD7FkyD*jB2V2<t_1#x^NXl@Gb$+w5sZqc
z)onc`6NA+i2p{TdM^Q>Ef599ORcIoR5gNh8=CklntMDI4YU#zeo%O6GTChl<BU4*n
zk;x7a04L$l{8OI`E;L6XQL}b+F0Iu40})NPz7?Q2n(cSyHLWDC#{V<|KRVjS<dtdD
zhV6Zw0k$@9nR~F4ZM>@W{;N6R{V20<6a$2Uy~<|VyD1md=3|N+BG+g6mtlkw+Vlm2
z9RDQ_DTaE@4JI{VLM{96%kFmMEbp0)He7%OM#&;a;2*cP_v8`SYI?sdc=-2;sbZs~
zB>7JsPOb_41woCn8vk^<{lxVu&8??uRZQUjYYIA2;q{%#*QW<NEZ1w4H2Pl$!uEGS
z(*U(#d94B(<u6(dhRxQJD)Yl<WliN8lF`29?rMcf%y+F{tA&pt>v^hlDz(W_VzyPQ
zs(<gUeG_Zaq}P>ugBrn)zZ}IBePIrXav7WRH?_7R@X)9USR)b_k)o7rWqK4|!_`*;
z{@%?pEJA8-nvIM28u(m>C~G<AD!kTGp@Kj?^I#_^R-uoJptHm-rdm>->?HqOoWUPZ
zu2yY<Q2cE58jrEkx3|2rv1woWq(3UcZ-h(TcIT;#e}{LjHexW@IzJ`n)(%&`N^uu|
zSZRGYUd?hq^tb+K3ysKs8P`Lil(ttDb-LX4;zq&aAGK!7Po4R>y3eq5*zTW*uxYlJ
z60GX-4SgY;bWXiW1;YW6zFPW(X(TPF%F=?!pfVD=$zMmcWc4B|K9544et{3ZW>~<>
zhOxj$_Vd9+na`$gd-mu+8cO&3vD^1bvsug6(6}+g=H@LYf@Y_4IQ7+dJQt1;n_0Sk
ztKP4}JqZ#0$}$Nq$D#CBPtb6f&R`F8-?bTD7W@MB+?B7u_th4NSUvQ=XyRA^<Lgs^
ztV~Yz6sj&>l5A3wFi!sxM^%i~hW#2bT^{2ddf}_f!IB!k0sm$vOR`5`nz%oO7F%zW
zwy=mYKZ&K<c-Xf#i6V8kR3^O4x<hmc10~-m&$QUp4h);>Jo<6K@65lAQ8a*?qQVno
zH^YXN=t@LWpn#3jSO!M^FH{@CS3~bIip%vR=0T@r-vj0-YLJj4nM|lgdF4nV%C<f+
zn<M7?!CTr7m0wNnF*ZwCMwb5Kw{Y~H(rjb?<#h9AxR;0Wvw&Gd7hr;pfN@$@AL{r4
z#%5iFvA)biCjSJ~(0h(%$JZiaN^P9rzP}jjS5Rw<XfyGF9~t@}m}5?mo27i07a~+P
zLO`M-wsah#6zTC2OQCpg+*PYqoDPk1vnDE;)26cHtp&OEWLZ==Pz%;Y%ZoNbOuj|G
z2O6RNc4a6`@Tu8jPPv{)bGfVVj`2;4eN9%lAT;Duja|KPPI=7QDA=v1_%c(VfeHGM
z?3Y1VA{}BIuG+GEZe?H24W*J>ZPv+_UHfULc^(Twr+0qe``(*#x;zvE<;%^7Ud#G<
zIT)stEyC0nZ$ZSpvV#GlKf071Uu!JWNgxV;r2zdB8Qk3<>$u~<Cz^ledhBj7uQR^v
z+omq9vMWsMhWUJ>blDd0^78Vw*}f`|gW)cKkH@K)MM_GoSC;i%_S+)$(kF}Dlb-Ji
z(3yRNeoh8PhO!b_-7w9gA?_ZPp7|*Q)oj`Kavu3rZ)Q0uIrUO%dSQnubvq^<)Wbkw
zr`Iv4FAW;MhPg6D6?9L)Ve%y)m6`t+WU@nv;atO6ceTGV!x~I1=d2_?_1!_^Kq)sv
z)mnpI<?gpf4(pY#x=g%Gs2t15X|_1Yz812z{~(vkJYNf)R0pDnv@@;zb4g^QW*XR%
zWdB3kEj20pRWrjr*yt%Vhh+H|_f2uQH5F?mkb%YH|I`%1AE&cozTpvRK}{0+w_yce
zmWly`(Z4QUhu`F5ACjs{OEuUmXysPqq?n!%8`&dqy*_H1g?~W@YB0aMz@j-RZbjEP
zLD<E*d~H^a@Ybu<NW0ybW=(U*Ty;3O5t?x4>@$lj^3F?qX*Gi97D(NsG|dA(Juox*
z*bQ>Xj9AXAlEsWswI-rYn^Mv+l4jSUu#@Na$WxB=_<mah4Odei@z5RP8Bp_F_fIS;
zqN(s&vN3g0Is^S=>thx!g~Y_<3-P~LfDtrlFy3*_5(kQwKk&LI9nIG>@GASWGW%1F
zK_q~ahS$Q!;S=rW!WZy5AURT|#$p9(>JzwhW5OXsRQ>(@W_wMr<RA}teTBvS#68~L
zrn?nmtiyS9i9MwTYGMD4{myQh%jGPou?pw2b`N^#y+5uurxfnpJrgu1IeI;4^X+I-
z&)7BDBu%+YWTkL0xzv;x9GLwQmPL+{{o%fdmz%*-|HwsO${=CtLt%LAECBwF7F(+j
zTwc}Rxn1Y6QG07&+g|2oZl_(;;VWK4)hp7GWW$3PvJ4De$DechdWp|6%Z;hFp7Js*
zipH$2iWks<{u0-<v={UpJWkiw2!ets>4rkN-6O9rVT==PCAm)1T~2mf{p31boNqhF
z0%n&J!!EZ_b;I&em;U>MBl7$Zf@kN$#vl}%`~rv_1Ru|aILV}~I_*J$!>x|DvD?hI
zC%O#VZ;$!v2#cO@U9Yq0!xQQP+~wAGb=Z?y^3%+dTOu|3TicK_9lMDus^asy?TjGt
zfkr`uqLXb;THg=GUaoi(4LMX+&uM=jt4HQ$X1eJu5&KT?5VzdU=x7LV3^v`@!$$bH
zfuyI57op+sMT4t8oNWuqi9I;5yMR**LY5=Q>EGi04f|&lOJ8NnD(B~WNEDe2#5Id1
zQHW)s_L4Ho(x#bvj%kwy$s(2al5M7G%)|%gp`^?9^BgbKuMP%L<-C9E9H+RrOjtob
z6d2YGcIxq)7KqTJ05c~Q<Q9x1_lFO8?^}_BgbEq$@hzzIGxw<c)?>XwHk=SKITkp8
z?qHw9#-(B;FtHrnI1R>>@|r*y-iV@;=O6{yhjbXTQK2?kwNBFwxP~OMWrTZBjGXlU
zQ`AFt49N(G5-R7sJb^7E(taPPpFD<*X>9Q!YA6iYZj4+_M?Zq6?~y?&p)H^d%U<b6
z`jt-}&+>-n022(!GrrkpMcr13C_-3H4P;?|z&%8*!%7^0*>c0JwtZKkC{$Z*`q-uD
zf>#!^&Qzg1n^&xh6&4lIqHIhy{*|z}vdbcKvM2+y6=b2nIsGkGRvAJSJ1mcZvY%YV
zK!tuBLVX-dhx82Nchl~Fwt1-kWx-HsP_GyrZv}Jig|3qIcF`+e&7Ad7buy|dw;f#T
zWq19VZTD75VP(ZhDB+}seX~VeW*~hEW4CS{Q>^JGDwDa7^3d5P%2J4~&hHt-=Pj`?
z_TCv+HRj6_0%XAE!Ubm;lKWA;vkee^_7W=uhyWzqjs6{WyPSquDMM?{KmYpjU7kR$
z6}bMh9~}u=-+{LhjM*7HljE!Y$=BX8d3VC$0!N4K;w!da{|x?NO&sg3|1b(Q7z?E}
zSK)ED#8f?Y&|?$3P_(-~&jWl{yw5D`&5%h^^kFfzdfbb=Uu)|ui}h#R>YF!&r{=u-
zBeimoD$-JLCHv2483Og(*+T*uc8z=Y`b@!V!*<K^&nj3$abMj>$0ehQM5N8-lOjYQ
zdE5ojXe4aQLHv4J<17oq242=u<B)r%)<8<3CuLx=jhXNXl9=*Xi~Y2%a)E87+CgME
zEH>q(@6ojbp34oi0bTqIeH{ov^^uuR!AbPhxRTY0fAhoc$Z9nO)2G0Bo)Yy!b?Jc6
znKHXx=M3w_^A_W3$6o?GhJ15u#cul+J2p+RKbS1BXYz4PZVG@1+b-2^4NbLL<NXNp
zd`73ktL{B>;Q1zPdyK)TYO|c5z@!k%*w8hJF2BMVNL@sj%j4>(BhoRHN7}Xf*AziH
zbY^$?2OFhGO?PY`6)9y?th!vb411QB(4i{Wu%=S;>ued7LP;O#M4UtzRhp+~fS8!n
z51Co>0wtt=TGQt9;nyx$?sy7d?iieiQJkwab{xQIHU6M<$R~u0IUXlawZJ*O;VmL^
zdNML7L7+lLLvgorz!;L>+>U0--?)w2KX*9s$2{?3V5KZKZ9MKFjXpYttRp97+{U&T
zpQ)?2UNfelF9!s8mv<~%@P^ZB%vj8H0{jdQA_G(`%1o_)ZVAM{rXyrAzDxyJezhMB
z7`kzbEH7~Nz63gpKKv^$rVGRN5WW`^9N7M`gqxM}>-@_O1`UAdJ@5&Tt{Y<A4apT~
zqbFs{`~FdY1^XoaXl$9r+Ao2>2lnL4GV$o?;P5Xe+2;3qzGSeWTjrJ5wbmI)Kug``
z@t!YFhKRCTcM!xCpt?!T9Og^^J>ZAP9dxvIpsu&Vc~M-uIqmZkro>?7k!xkC^W9u6
z3$zmeroX<f#Fo1}T2rhIm!7M|^Zxqa%^`YiC1*7`LIP0znl4fnHFI1_iJUUw41o}#
z4t`Y=+a@1ne+9{Sd`8Lgz!ZWy$O#wR=PJ2=PCep&|CGZM@~gwW9M%0rJsJLnLYt1j
zz-{Jt@>;$*8tzCmdvP59DE$!om-tj4XmevV9PKGT3Z>`=mqu9%l8>*Corgjj?}tl@
z(h+r~D%V&wzqh@iyl5)saPHHuxiLygEfs49kqk?7&=dh6do}AcGkoA;DyQv{PkqSP
zGFGRKv6U)Yg!er;=)}|Fm;qaTHX{@~)0#C&Jb-)^sZa;w;2S`Sa#2W|NVnkIR7s=C
z>Q}zfC8+;~u;tO5nrp^ztk3j;8Vs!!?y80!IPu%Og1#Dq<o4_W4zCY^`Qw`UV!~Q0
zULCg!oYmT*l2v1Eq4|Ll4Zxjg&3Y#td*V}<$_=1!=TvAZ9U?TKIj1+pAj9Q`o1|NF
zRK4PIbg;@vc&D$9HP+2rcY_p_4z#USlo9Ifth%s}%+{mQ%gK005LI|r!$SYob4Cpg
z3GU%LXyPL->R4g?OaQO%6%L{o;#I+MVWB@$@JmUn^r4IYDLE5}@VaFqlYmmT3D}=#
z$<80@1nE)PN+$^eaQIRq=I2*QT2{ZxpP6>k#AEaZ;(vbJ;nY2~>-qACkM!6pn(^s*
zmWW~F3b;<r)!;cGh!M-qap2pR=mLF)LIM<3ro?(SK9`djg>Ki;$WcODXnZaY$*pI$
z9Kn4sA6=h^>Sq5&5r2F8cChLjSIZ9D37(4e_+7al!)2;TADqo(t$3_%qeGX$Ht!H|
zIM6~1fCT&A(wTERxyJx=);Aq@v@~cgQu$p0mvQetfffSRW6o4#acxN=CRn!ZIwzE=
zlAvn-8i<PX_AxHxYZ)^Av1Z>I-R{d1tQke(67{$uve+eq(fYEKyIPqUa=ZIm8wUUM
zut4E8?0m@10}q0|q4T}a^gbAA{h)Bzvi%cv{f5U0U_z1lMMh4V=)c(+DHMrRogqxi
zbAZ8bss?{y^a?(J_a{WC=ij>(y-E36rI;*gY_qlEp1jfC&dRWrj=|{!FcED4<SCq=
zekv_RNMr#9^dCLs2}!A8&!Seu<CBc&W-FG*3)<6CEEQ@Kyta<2Nd_yG(~4gcILY-_
z3-(G>ly)^4lG7vD)znU;<6&;>%}QLArxRBBo4PkOdqZJbDY#lHNPgTejz+r2WAxx3
z(>mM{I@G`3ZvND?D$Om(^jjw(UWRNm!O;{<K8!#0tl49zUP(F(%Q_1JuR093AQ7MX
zHep^4&G#5SR+tV-i1wNW%t+%pfv}-cW$N$IgX{YV_p(_movi<fzXHr0BMsaT0_+bP
zqH7K+QQ$VpjGsQrf)0y_ty&o^faQ4xe>gd~GSU7~XYS<#)h9jh*_tGr_ion}NluCI
zspIV}H&T5LM1rSZ1p2L~bE^#uT}Kg<0n$0^FQ2lL-P*<co1V`${``Ex(N*>>Y}Gp$
z9JOx#pEo5nHIo5~f;UCaTYMz-=>(QW{9ZdulYpA7$A=64I+E(wm%;|TG{ug`W~4eK
zphVOen%fk&*kM{<pMi>bkO=yTwQEmMt+nNpP^Ftiwt4!tyA%q3sVB|1*KRwz@askx
z28E_yTV3_L+toE`8{T$b4rHff9?RBueQcH7N@)+Jr4_7XaI+1X$ugn5)@e=+PpPG>
zNudz^?V0H~%W5|7$&Ofk1rnbfZ0~J&CI<t1c~lE6d=P7vMoa32!iJ@O0c`+i;28yM
zG~jjHBCSx1U<*(h19bTBFSz6UiuuaE1i^lKWE6eY3BM7>Z{2~1B2fQX7=Q(23}h&s
zWLdr23M3~j6|R4czPT~K2n-SHAi`4NFj<HkXzU%G%wN`K0V06toDHoIf5o<Kc^OHJ
zi@1E1oNiEtD;g5)Iy}d+UVF$IpHy35JSeeFts}p*ppiM4YuJ8A&2M^!vwabtPWQE6
zI4E5d!;1ccGBDwx`xT4m$<`5FBr&(Q#czI_f!vo84Ax3hoep8(!`B3yRG+)kmx>re
zzE4R#0zd$&8AQ+|f-28<JFM{((~bAUq3^vb{Z5p%k7%@_*1K*R7F)m8pQNqxmo>;%
z_Z;QvPRl!K58}e-O~GcB+c}oH7&bNT>2G)R%a-&X=I*}Z_=KEyd*<GU##zRk>?<QA
zWEPggr>Nvi0f}8MPcCfbJNNUa^OCP`(}+!`8JuPW(wAEooBejgELX{|V>4J!E6N?3
zCLKiQxO7z&0dMPD{+@UYKWxvJm7ButcYY>q(1U!d&595F(Q;+MGyHl-*^S>uz9+@`
zN$svD%OVq6xMkXvCHUpLrrdpw8mn58W>ch-6;JU(tcc#va$7e|J^ctDeI^01kq#Ku
zm%L4&Hx!SqXxvGm{?}VmCLqzjFya0QOtcBUh3Vg@lr7{_lg~$iBPU($L-$r_C{jfS
zmDMaHT~Pb};ov{uZq0!r2@WoS-Dj|J$eC*MPiaawOJ1+e*o}6ZR=Qf!jA^Y;+KlUH
zt~P6as=l<>tJT`Nug+?Yg85lJ^t89dj)9Z|A44V3yFMVeWh%%Pz5{Mx$w+jY3Mk@j
z=b@;RFaB61E#Mg+G6RP;WkrM+zCZ4T?^1qgOj$hk5my+Q(OgipDbLC_sHLA>!YthE
z!QJJk-sLPxwQ=CN=Pr<lVwg?mIwpBjo0}!3Sr=*2z&Yjq8K(OS-m3~#{iqVB8&N_)
z)l|eLXi_LJ?(1gzuLEGwk{JlPkfedC%ML!WwVdnWlMM!7|4PT=b6B=%nT&hgX}a)q
zf=hcB8+KF1{^EWvO8CU*)+jO7`TJfk-_t$xa7|@=wW&9GdlTfOztMh`Gp(n&?z9Td
zqCVvPl(*0772fvxmU4K|{Ct(g5X<{`O=BnB>NY>@`f$f{XWP+KBaXeH=xs4x6W09k
zHd!KIa>es>0TUPZ`4)P4i7-cedl#w{b7YgzuA}DK8Dq3IK`mzw*2|>kES&aK%V@#7
z`X;`=Xnhb}?L4qtGBJ#YD})rBKWhvnN+7{q+&vg2;a`=nsp0I<fwzDF91u0&qO<iB
zIOB&Dqfh^&1@DxY_?E3?dkQ*{g8{WA3L5QH)aIluRa3`ME!Xfi@Bg~@;!#L0$yJ-X
zJbHsi1e-m_S`E4)&26qI;Q#=jaT7SfXr_llu9Q!W38&nH(v%e_MhvF?$ndk0qbBFF
zdao7ySh(r`Shy$cl3ua48og};(F6f;z<Gbt{p#7yi+H5J`?~yqowcNDD*+H9A{k%`
zw~3Fue_=VSldpL<EYMA<<ZJ%uL<ZW!#&!}z-UKoz?CXB6*6_RbcTE+8?aOXlB>#sp
zkpCqc7gD!?4jwyA`Nu%#aOaM5(M7e~s&3bl*L|5j1mA<jLb$%%Ws~L2IffjNc|u4F
zpSc2odK~M9Qz0>sbqKJ8VfVlHy}=m<0O1`&AV5tG1|Y0*Q}GSY;+x@ms@%keOOpfV
z{;|%_(TUz***{u^?t+&P-nN+{zOMKBZ@9AzAv_KVz~m02m-ySw@}`2j8hjGFp4mg-
z#$}twb7i?Rt?Ma#{Lnh<T{O=0m+l<EeW>|kJQTy_+$NH>zTT+*B{Sgpb#1P~<t^>F
z{){j@L5RV7+o?P5uq=e4XVfNNEzFm1pfdL-M6js|LzZQj$FP1)aq%8L?C&*G7Q7||
zlv=2LwOJWJc>BmN8_-!zb7LW5o9%7|0RCl(!#ZhwCHI{6myGFxS?|lm`X4o&U^$J0
zN@Z8JqW(08We}KpC!4D^C~9AQZm7&Su1dIHPIy@_6oMJzAJHjmJ7)D`tC{3(GqaG#
z^YT^md9*$GXH4cnxjGUlRb&Y>)XkS2#>_2>22}`x9C2vgmLbFnOpfR;fe2^M1q2d}
ztW%_;W*QMXn`W`%Ysz+3r+nn%s*r2Of+Uq+gDy@Ue^;aX?#7l*?`Dt1_!^YjQ23tp
z=q!a=AL2xp(FV^{|2w6-&9FqtgDU-%F$U+CBfC?nbODGwSFg3k8O&5P;vNp52;3wq
z&7Eo@1dd7MkZRFTT~?OKc63EQ9Ev0?6uQF^4RCYCRz~r1d%%0CHKpoX4?J88NdOH4
z0uVQpVnW>DQvf|XRLy)iNUX>|&+L(UtovQk?eHm1muofQ_c`zL*tV|PX*kr-as6u2
z|G>E)D&kU}Hf^-rI`E&FCz~hXap{Bxm)bJ~X1IpN#dfaaU$)3&yR2#_jyV{AYY+fi
zdzB$~%nJgsQRR4Vlcw6^?BKvdGg7Dn3jF4wA(#Y_^E9|14315QATLEgWGeHsyM%3z
z>3b0ai$Tgr_YT3-qUJ|pIhm6O7^uZRB@amdZhIRF`_;cwwM{JL>o0jeiXoWcwI!uq
zn><yfq}gnMQDz>B(A8KTv&lNDm9$NkAfK{_=1E9?weCi*SS7$`3uBkq=>QD^T6-{W
zSg~ZLwN%E{9}J&JnOE8>R@E!<i7lf@aCq9n#O0BQgETKy`VI`l5!i}>@VJ#AWGk$V
zW8`Inuw6}$nF+zpQ<5cQ^bFJ}KY&y2HAlr4Lzwft-ABq?=%!K+(MGTU(h<Pnvp}F^
zHlvYv?p){9;oyo3g*-auK{A^BIn>5!s8*m>yXDR*0ia<@YxYUx4E(#mgOq-5+%BB1
z1o3qX3zIOlmN(kEl>npPwO+n1(G}X*bX-bdYrnOjyu)A-Lp~qRBOAp7kvgyJi9mLE
zNKLZ(UT2@1-&AN*ReNr=F5xP?DF$b%sAQ6<xh(>6fev;bN$_piH*~GT7&Lvn$CTAv
zd>2PlOEh)WhV}Yj_7mEO&-+@=Onwpo%TF3h;;F3ILlvlnnlONEraJXU(N%LaOV4L7
zcghO*>JKD>TrYvsCeDesx&BIodF`x*JdvIpLtBdfQW5wFs?W@y3T^UStrA&$iMctw
z>yrS)JrGvkY|__0n9{1nFYFC1Fn>E=d9H=}RrNpL+k&drrTeBukf$Ob(Utj+uzeEw
z@4(<0H{MZvmx?};YNP2YPCV0JauI$ykmq6&^w;rnT<Rvhg2C{=Z5=YR*{r}99eBvx
zTEtXGDv+`bc>1ylef!o#%9P0lXAF=Ym@T(VCw;vVSlt5aFPVle0;NMyr9|^x@$>5h
z9zmwL3!6xaeaV&PIZ=opJ5_M`a#TJK);ikAe0gfvNjOt5DQmuIr6CKp1TU!=@mMS5
zZ7S6idWuolHP~uEV1)<)szW;K0VO46j;c51(7mFea^$6EuV8c)$ZqnFE2<4PvQG<k
z%gLKA`<LTyKCQ%yK-k=uPhdnV??cUwm!Qh2kMHpJB2lT6(H{@<!eDtq1!m6y*3Vyo
z^OvaVeM{Hf&d=3vt@T~Q0eLT&`t3D(1);Ss3VFqiYO{ksZg+qcgw=j;d)eDldF5&Z
zL+{%#WuApD%~LiPGqgTej!j^^7;d6{OErw0vBFwEl{KUEjL+DJlG<<F+U*_u7qTB1
z8|O+wP);F%2<{`uZ!iNu%RMzqAh;qy*{+1Hh`<>_ntULTg8LWwmLC@$bJ)d;W`VSi
znW<*q*o5%(EvrG0(jfp)gT$&Ly2$T4JSAne8`3kHyf}AZZRw0UmNDs@tOXbx{|VpD
zChs=vwD540rlcx@Uwj82K`PWPkIH8*zNjFM0S?>#hG-i)VJCG9<^}n4`!%VdEd&ac
z`Y`Q`(p@1xdat*I_0J?`ixi@2Q&N+{AEHDi#-A-q_;iv@lL@c#YMGP|88j>619jS5
zUFg;N;@A%@RYK2m3X6H6x~jGHRz$YAkKelQwKjm_zMru^8q$M&0H-=pxY^&es9^A6
zGIgikeQ0G?sq&6(>nXeXt?UhLUGthZwZ*A*a+aNyG{_duaxw{tis|OS0dToeOr#IQ
zqCN(eRFWtGXrXdULe+d)6C2$;R6@b4iWbX#*XYu>AiL^%=g(UO=uR{y+{24>F)6r~
z3ldn#ermxCUF4)+nfb637Pa4O4Pv<EE6QL1sqDRAOdQ$Mgtr0{NeKib1?r4D18tSM
z&u^KYy(;o=n2e?U?Db%~>*+6(xJ@WV)&I5OEGKZpSs#;`fHt5`&k+7^HTU4nyPZt6
z%@Tqi0y{jry{9gLo15QjSSHIhuj5gp_<!DYLoRlKu9*+N{L1taQctbf5W>&db)L3}
zI3)cTW}iHMyJsIBUV+&g91Tk#z9gn<53@px@F8kP;Bp`SYx`Gn$6!WJ`tv&s9`mv+
zofL^h8iSSZpSWW7ltJ*dZ&xA<)&y63bDuq1ey1B^;9l;17;rCsaeZX$=&}5%iKz^>
zpt08M#Ewnnq8jYmyqw=~{GSm(l(P;NncS*BeU{J3iYz16QsKK)5#2^1ns2nQe*QtI
zU<6dpXR|Uan??jk;4l<Ujj|;lNPZ~c((tiQI2I&qs_51<&gXw#%S{=4KOHHV9<oTC
z;|#FG0754!R)Fd09i2aBF7~(eG7tEYA|M*wSb#$OL5$Lg5b~o~UK_4a(mM4hhXBg=
zR>Rohum7TGzt{1^NRV^(;$_DL^3VH-$?>hP<s*G!{r3T8`_=7g*a@He@9uv#g~E|?
zI`Nov5wj#gK&B5LMSfIG7{6aVv=d-ze}5l4y{GcGygkPm>3?=H+K**VPdszAot3$8
z)6*&tw75>6=VH*czm9LK3w#d0$%wC{9mes_jI=#2vAxmbD->v+pRN|Inm_m;$ef=B
z<@j~%oldK<ZekWygVoGVe?90-CtX6wt1|WEpj5w{?*ZNA^mNtNc<|f8G%R(j%~`-S
zls_#N2?-zhee73NZ}KSL(cQ%1biAa{ywQxtb=In1H_Aj8*P(C$OAdk(@kV2GR-iU*
zBwuXix>_$??4aw-xyNTB3KfVuiUq3E#$-yuu~q)%yWT5dzs-pXxpgDF2bcpjj_^`1
z)J7Y_Ma*<d%VE*Mb!%j-iHvfM>Hfk#sfyE~n0`rd>CjBO;Ye&sZ9trJqAq%slG?8q
zoI$p<AZ3s<T*5{aKxT^)G)tzt=1IEOgbQ9VHQJ<)6%<xJY(%xEo5%@@GWQ<Mx5GgG
z7IJ*HkHQ)Rwe!pQ^chHaIb*HhOZJ!*+A>dxx96*mbHoU;6m0O^o|5~$GYb<e`JC_v
zf(wB-0cC@=;JgUQsY#<H`<{@vaBL*bl1~0)0GCr45)Mo_<fMtVK%=ITxyNktTWUmr
z-t2m(3H}A%`nf+ETD&sN)C_U}1&rWk-;ect((+US??EHm%d*s3VH|_m&x}bO28DoF
zb2JNLIk$0JNlnlBK-b8Z+U+%=6-%Ym$Z`}8-;-$U^|z3&)Gf+3M33KhudMO7--a1O
zS&)1y6K&6fe(o|C(EILQs#_?pn|9ANv6Qdmz9LCrH72a{+%FHNe!C}5N#sJJ0RKHc
zYhQb@Z0qN1wjySOJCBnfTP6xC<vWujYg`w}6|t_@K0h>qvTaF4?fbXP=GVAEpRanu
zNA}e3l^Y22*$o8f?@CYrGHUDHC*$(h8j2Y7M>NS%i0)hzfp7Ioylm!nyRn%3C-TRW
zs*hh3^{16~_To4z4?3q0LE2fXmaeGkPhG^YsryT5G9PWT`%6KqOXReH@lMI_c!Y);
z#uQMCPy6|o^`xBRt-G<@d7KKLnfD-8Tc)}&%jGqLeX>G+ft>A~tFi-_@L6GU_bskp
z<#iELJ=qNIdWyYfJgWWhYm25RaS{vqK9PKg&8spteP$&h0OdU$JO)9Bb$xwW?|rR_
zqKD?>WkX$B?F@UN7Vg?q-Rp1uS!>)jSqVdM;-RrNt>#kfi8|i@R!J6b>YoJr)KYk~
z!})BuxGp+A`(+ynAwH82bb?|3MtmyNs`2OTHxsGjzguy1*>pcVcmKAd=HM}e_V)wR
zZipHGMpJ15UWey$DP%n{vh=h|af{{=dwDMDrZ~v%vH$5J0mEy9KqIg@MM%pb4tXm1
z8B@6-*}hHoWZ3y5wxUTCGJC~R*4Gz{cZ}!On4vqtt$X4ZNBKEgMgIbSU3gKc%2FD$
zj@7o#r}|coB!4Cu`0u=kGei}=AI$x^knb0Yuhb~-;;dHEy8B^-+5U?YhCj2OM<fd%
z3&Xc)ke~d)^B-cpJk@Auln6A@Lt0i!;Czc`m?#KY<&w?ydeq<)(ub8nWC`C0a$-f{
zg<UPp_viuw<(T-%NpY9bl#ZGjEI_qq^w4++2qAoUQYSXQ3&r4DnZ9&Ehy@T33`;={
zRICAj#QoK=m`9(jssbW7R1?W1gy~Ro(iO4jF`olds!&`=aER;A{WG0{1v6r=#=Q(D
zmewt7!>IPOKV4fnGBuTOUr2rIMcKs)Y}l>bQ|S29ymt*n%vIR&JG={+M=Vut>$hIi
z$lKbiJsoG?EVSs$*nC*NmdmFG+36v&?jKtLVi!`6WYzV2UIQq$b#47$Ul`=|z1JIf
z9(_nF*y(G&?yn-E#`Juimdv+$Qh?b?Tr0cJ>%+Fjms+N^lg(mE%u~(Q6A%QXJ05Cw
zdDLqrT~3E!&#0;LU{d+LRSTi)lW;d1@7_kfZY9S%TGp@h<&Xat3(#NrSl!IJR;Vfa
zem0jE$XCH=@ERk(iAW3l)E|VS-~BXNA|O560N?9w!;cVy5~>5k>EY7u_yR)qe2^Z%
zVo=Rl{yNQdH;lG1)z$>Md)ptb4dlOgGqyQ4o0~j0j1pkQ(eBFRutRG&Bj{hiuDbeN
zq-152(VF8uV46$ukWC7U2@7xuq5Y1p-fucfJhZ82H2FK@#<a7S%#+-;&0a-8X}ZCd
z_M|CA1pq&nOu74;xLq${Ff`U@HySQ&*+aI&#(S+2q+Vfs1<46Ns;!sz$$*r9Jfi{q
zuT)mqF@ip0F*n06{*US3ZBRoCU_dRm?c`C)FD~t+(GFC@8QL{FD1&1&mL0eyrLjuU
z)o(JaCjY0Z)L+fjT0#hB<8o>|N!axol44$F^Y4dMHBcZJGx#u+U^_c(mX+;%@1hHw
zMx7@Z>^HvDxQdR_Ykx^%lF9JYmQz?4*h)2hu6Fj~r7gCH{FBvF0Cnb5Z5Mi^zC=ZW
zmx`v>$781m9rU7HxoiqLJpxINt9`c5x)=}3;=*FRnu;w>E*>HQq&(g2TrmRpUekM}
z;`BjW1?=mQLfNeK%e5yh`T{=SrvH>HgnO-RakIMX!1Fpg(<agh+8CpOJ9#JXzCgfe
zdTMw+fn0_=C{pTID1Q11UoitqZxU26<NH)K`$|(5(Uyp6G_t;p2?Ez9qK<bwqgB84
zUCj*C?7dxXEm+TY2-v%v1kF<dv@JKMWSfVxfvxtf{K3V`=K$01%uW%g?-!efewi}A
zxl&qeM?JVCEkCfkkFKMbX})J|UV|J`mGhPoK3uNozG=tLgS+#vd$jh;XDgdv?R*R^
zQ_cxy)i>shyEy=Q+E<*71GZ|;2IT!|5MKNOS!hMte)`FuyJ5-V<x{g%%H`N9U<HN-
zq=JF?x@Zf$c$H}xcT196M4#nGSMfuxy&_GWm3*@mS)UF%t%icihAnnY()4KP<j|=x
zAr*<&Z*z~E=+za8h95U0)ff#!(#5l@sR6)_aPsSeyy4Tw6slL`XPPx_l};hue=Kr`
z01Bz&cTqsXfuSf1wRcCa8TaJ_xLpz^q+?EPmxv8=`CZkBVgTlrLTZSmtn_C-8Hu*B
zD>udu$G^))fE}0Yl<Y-o@J9!poR0N;DS5U%Nj}MNrQxAE;hqRWf1@K)oWn-_#;NSn
zXsskP8cDz7+xw6eL*brT0HOL#;DuQjKUTOOAW7N2>CRo7nk8)RL^}8i@VoOup6gLu
zZ4*<q(+JYPbjV2MK4lwwdFe3=s4|PJrx3O~@<~S`A}G}+9^rfNF=yYB@bim0l>KYr
zQ>u<f;j7qb*$`kLCN(#XSs(n=rBx_6X=plq4EOw$qZ;oCLsCN|g;v8|h`UmWdeE4b
zTPkqr{-ZIdI|HU`uP6AAZSJFGka8Oa$_e8H;`(&%!>#CR6WcesbDQy7m1*HcfE36f
z&;7PzE<VTH4RQbRT>SXzWNCZG)bYPN%zz!kAkKXn4t)4Q@(ZWZ@|Iz>=fQlH2wory
zVL12s@j-4Ou9ZTy;?ckIlC9gdudu{xSF{R;tK(jB#d5lOIwqJ<7<CJht%6}Fpk1R$
zi;%*@i}Tksxj_}e{M@L0r-$=k09C|W20-My^)kI_wW3Pow&<d3Pb8!cQS#q;Jkq&u
z$ujlY_b@a&9yfeW`EhI!#C~!p2Yx`F%3WfU;~DqS-Z$3-Mk#5>PGI0aQzKG9-VWOF
zS0lZL^UoNCFg~7viDs9jgXHZ<sm>B5)I&DFbo0!q=l^@V?@PU_%|Aa)E!ZMi;#8Mi
zM@yv>|L48`@76_EU3dBae9ZszHU59+{^yAOm0+-7N8!&7`zk+Tr;ubSf*#|}epmyA
zF>$|h0KvS3C@3bqJGzW+n5muuAtqstpI31VfBaX4o8z~eS0oW2=#40krpQ$&6~T41
zO?pcACKo8exkEUsZtlNg4_QUwAWyJDt{i@!b-uIYa{4ibj>KIFi5e!ohZgKT7tBAA
zkg{v+BR!GeZ$wp$VA;@Z!?d1qCtFl2h#qq8r|r<!>!t5MZ=yNkYY+e^mYRNbJEIZt
zmwVaDZU~a;Ki0L7;QEn|cDsA=uAQPFH!spJ_gv9S^~X1(FZU!H8=rx(RG2<^?0jK^
zJ21&Xu@;8^Tvl#@%pkI?Gqj`6Lol{SV&kyCbn!f@!!3?mFN-vX;*hU;V>y`moqbO&
zF8Ee%?YdO5bMxpcmU8k1mUIyrZ|zoYmtL#;<Qk5@RW>-|b~jd>#93Fie!F~m{g5id
zzG_Ba{eVOnkX*Bmf1|wo=f9|fLj%{{S6vTJrYFuE@67`+B>!L_p37I$^*9z^Z`Q8E
z?u)aI^vCgDaI3CzZbzVi>x*>^A!&_Bw@`-pnVHYvHcH^K{aLtBj5W1?LH?GYbc9J1
zMwdc4B05xD9=$_n@QgzQXFw#*7edwZ3CH`^qGD_5>zdtcXASw5_<IbBy_Jb6l_a1}
z$zCj-a`sV9RoTP&?&~=Wv~U!syY6;3KT?}9EZtB|F*xkXN1M9LHfcH1N&9Q5PB(7+
z@M&1{iYEVgy1MEdXW@WP7_(jhG7i|`c8pJI%&l^4iBVJbBULbyW<hkMn>Z9V$<HsY
z4^I-HkoR#L%^wh6xLzcjCd<_xK$D%BD=eV_Nhwh)Fjkp;$rtU^3lhl_Mg7d~(VYxA
zEXQM8@uLXnG5qe>4Y_Y%c+=W2kXEt=!Fc1y%Z9VsacjjLPOw*?aLmo%iQ+>)j1#5U
z3gtC<c`6=a;7mzsAOUzPTWc@~E)?JbGnysVVTWewHc-P|iAdfi8QBfJ@J-$88ds<V
zU;c=m4}7?c@T%^s%t1V_HAm6=02;bWXMop_UZ(FmN7!9w=CIflIQ+K~lr{QtZ0vqQ
zby3}RQ}5f+I0GD=#(_)=@=kZ0vd1#)viGN@R!De8VS{BCH*vPwVO_o<k^sv)kK@Uu
zJyvu=CmfVUPcw`qOP)2SssQ!zt((WH#s{6FB_nHG-2RrPwpm%Nicie1(mM5L0?=8x
z_oKGW8kr&T;-|p=ZP(0=ftyY7^g&PsJ>|xg+eF;v(sYUuW_@J5gcvMk&?K=InJkbe
zVe7|#N2n;LCEV;i^r&;a$EKF$&1X82Y~163P4bXVB6s)a`y-7@yW1L@Dpp%if@d48
z6TrgL9LjY@@c~_qJsq3>mvxtjXkkjO+OXPU&Agg(^u$W2L9{)F{GaNR_errnVergL
zQNO=o;Uk_;DAC@*I;B#QF%Bop-`iBk{dVJX7O5uXT<R{#-1VX_pWO*lFdR)6Js#Up
z#a(p-m6}wR`%GVF6SgKhK}k_!B0#654ntB&qxXCqyd3E|wl+H*@VNaCST8BZ#8RIT
z{nx&E#2=%iDh5jQs<tAfJY4rUD9}OCcZQPC{ju5XETGO59%pD#QpI^oQD~l})n`g-
zuCeZEMCyi%y{Tu@D}PwZC07(5wX(Cow<oDXAo$+(=ie^&yi5GBX>8#C`nI>k6CCkJ
zCrS|1bYe3$ThE<TYF#@|I727|`XRBbxo?r-BHLQ_bM#i~pscA8c~GOw_SrzH-!PX_
zkP+}=QW<!hJZVCASH&6I;kUhEtT||VFzqlMHjhhfyq7Tp$;KVd!`aJe7fTjL9KNYL
zzX3VjNa|go%uhXgs>PTxcOwZk3Paxo`_!E61mXdd+fF<v*3+%{GaFRC3$NVB37jbV
zal4C7<mQ{**J|SHJ;H7J^9<fz`_-ZcCjF~e^=I+1Q(dGTMzJMd?*hQ)WNzQ$4Z~bJ
zC&Ckdzpa1j-#g7~tiKGcK%2iKae4N{jlPCXgd8rHORdfM??}14WKlXkueeqJ@{PoH
zBt;&MEpa4SVF1)dizMem(zZ3!EE^_p=%d>M#@^GdQEf&#f+c?C1s+~=H4uOjo)9ys
z?2Y6mvqb*jh+smQ%x7dGMnMlr-I~h_yN1J+ZS#LYFvy9Re6wIPlKzHg%SgVoqfvzi
zR5og5xUj`s7UNDX%?A<H`6a(SAHEWdh5c!rqqkEzR7Y5u(-5-4X$`WBbLWg>98thd
zkbo<r3$yS2CMGf}(QzK0tNQ^`6@@C9p3^+S(W<2}$o1%9vIde}E)pgz-|U&d1AN1^
z<t&kCHpZt@)2T!b*^BOIiBc8SA!awexIQ$C%3-G9+$((|5g8V;MIT=mx&y+;YlKYL
zu3j5`E;Bv7`0K&Mx!0XIy5s)H6)s(auLbXwIILSdd?ANrR_RM4xu2o0{87xD*}D`<
zHEIO9<_(dD0SaUVnw}o4e0=$f3+Nx&{nSRf=zZEx<K3A^Sj=4tdZonw#Hu*nKl;*0
zfd1++yz8PMPTQ|isr`;|m}Z;I-WA8lujIY|WFJGy;tl>&GET&>;fEC;SF+savUO4l
z^VM?k`tj7%U^9KJ6?EJZ_Vv7S|E)**yJC%Y`v;JR<F^7k4oxdBIDu`_x|SNpOSPU&
zxcMHR6&WgvyO8_Ps&T@U_yz&+Z%8`yCMB2#jV9$ptv2y}n=d&txyq6&@J#$u6oVru
zitHAIsFL^lJqH0tEYsD*vRm4aRfr1QS{G89)RQs3;2@Q?@c52yB3%&20$p;OqUh_9
zC+SxtM%Q}$086ez(Gie8N!VefVTd-Cbdr{fy}=DIDrHO#sWzub!=?!67s?<}>P$Rh
z?{EdR_QhTTI3x%}?^~v~drOCHi0IoE-P4tbC^X{&u5zqj87fCp*4k0azz$n5c%b=b
z`NGT0E{H`u22C9sU(=ORB}#Ari^OOgUGwe?B{m-H`0~Wu3T7jL$&j?=g9$O&eZxyg
zm=|3Bp3U(T2;BEGJ~^x&rKmHA!(AjPnJF9#hvR{OI4*noOBf2!4!d4XVd2L=+DC%e
z^ph3!!SK+yj+a{sU92kh&PK~iZlPT@m|({(tr#1lrTj6!W=<2_+c@Gxz`u>oT)cOw
zvc|J|NkAxnf8Mx-GXt^x0=}|RkA;~Fa73D<ap+v0h0z@lP-~2NwKLxI?7Wlc46DNo
zEjBJNU}CJ|naZo%!V2C>VlFDyeRu~A^52HHKi+#imiSK+?nYYT`TNf=aBA(`(rcIj
zuXa`^D!Gq=WVJkLFT7;c^)>a=MApkv+>mVntCz=P`Ms)*HwPv|_#?Q1yer5@Ah0yJ
z+#Y|oAG)CF0^~*)CQ3&Tw}S=7)(7~A4S+CYf0u``3IbLRcQdL}V&W_&Lx%So-1Y1o
ze{2CI)oo;Vk<-Fj)k!C~hm4pXnA~5p&JSZtCuri0fvM|e?;Lac1?rFoVSj#)g|1|o
zbfX1vK%}=yqU!hT=-s2xc@0AwY!n`@eG+k#W)E!#E@VhTWBhS{CKD$Chi}lgwBS5<
z7|?teaLJ9AgUAwRE!LtjQw4)BH3Uex-0rd6?Xg*FamVRwsQ@1w)_I*FxS4*WTWmqT
zGBH<QUV5t&Ja||jK#qp_dCxAlcO#s)mch0Mn8kD8UxE{=onPQ(3<214M%X)fo*Sz-
znBefON#_?=?84bhpf97rlte8osdmQ9lrOA2_-<&JLq8Zmk>&Q%(ffmQYkavcA*HE>
zs~X;7Tp1g7gy0^-ppWta8r1&``Qw9sYZ3rKxZ4hKliGdr*FW&0!2P*_oXd-zCZ@6K
zP#o~n%uwWH9)>*j55(<~`HF6twT{cTj~Q8U@@`~_LMZ@nJ20k-=?w~_FJ^P^&el$)
zhvy06c4eJ^7J&wd0BlltIZ%<iSE`zdzCfq8{`@Eum#%>t%=Y~&MLIWDg;z|x(t3XF
zQ9{XdsU%+r552<dk}ef}n0{cKrS_DLw+kW?eqvX|VcAIL3J6Kz_rI~hv&9v|rC9Zh
zI=Ribg-&e>v$(xqnaVtPuggxBr2>x{;#yCY3CfL)*B%dQ(`wY3BFQA%L@&EQsNS(S
z9Kx2)Ssghe$?!UloQ`O8cxC1lu`5pN*bBz$h9dSO#4@pAKTqLIk3hg~%0uG#$tZZ?
zQY^CQl7!|Ny6@A2n(bUA|8vaI?CPjt*Jf+B%Jx6-b*)K><INOY2V8T`kWvERiV6r&
zNPHBME3^Iu{TV=wTswO^{lDm7C(8eW4i26FLwyak*Q??CVOcc1>i8$&r~|mOO9)tE
z!d*-IAB|I{jpZ#dP=G!Dp&X$*F56*UKC>B!O`hie1N@8=M`u7rYr_X<<)TQsjV!>$
zfC@rc-ICQwk%;q1N}+CxnHRXG+DkG`I;=&}=IobP0G;C<43;TEb{|8pMpS5=O98$Y
zN=cc>mJ9#;lcP7B=vujR-p7!n{y2km04K(NJr$#PZ7fqnW{=I2qWX6nn~l3XW6MM-
zX~)h}U)vbtJVr}o^hal5B6JY)3@qu8Ju{ZuT@$KZ43PlIEQ`&)La29krID5F$B7mj
z@sEGxG$<gaQp!cBH}ln`;Q@B|!ofrCKlGEvw9@u0KAf4D^j6;zjU0gGQod5MNP1ai
zFu7+Z|5+_nqnP;aVNp0VK{TMNZUtFNxar+gC~1Ni!^Y%N%0T{<vzU11>m_>`C1g6o
zGNd$)QX?m$hINUfJ;E<O!gLJnPN;|J5Q#5n-5@H;4(f$r14`#OQd!8tQBssfgbr6~
zHbx_;vR+m)qSeAk+YSLdn$Ul7F8MSuuLn4~rq0sXC(nNL^|*!9Y%KH_*XmA5vS0@n
zISTyXb2Ov40l00ZvQWOWrkHjEHQEmKz^<YGf`zP4$-*OhLF+roVbeVUEU>Av107xV
z^9>Sif;S^+_!8e}0&Diy$PbbuV{uG=Sol4_QQIN0$f&pbh=n_gBDN`^#NfsTpzI&v
z#%z!=BZ-<Cn>fogf+;BWMvvAnnxZ$5ysWEmYbRyy*IJaTFYYLap@XAz<y&q!B5_N4
zhgUF$XJH;bgyy>@4UO1rSS>@lRU-+T%*)6qZ{Ypjn2WvfP>_>D%}S_1v$yfCeL$^|
zw_h~?#C<u`Gx^NlYoXVF7|p3e-}a`bIN>NvX!W#1$3ERJ%{4fMNoFRYy$VvnVEZ5t
z2rDsjeL{^GXtn&&;`XLS?Ek?75=0nz!Tmm>jnP4$deQ#eS^=uPv5F!?(I0}Sz$1Vp
zUg47~oj8?Ro?@db_NV}ZjJ)@#<nM$o2>erGY$6tzj^#KMjj$un`$42CJiB<I(hPl(
z5DuFt|D3aBH7#Ei`J9bk9N?@z>`!SsS3sV5BR<tG9Tq=Y;Co7p*A!rHMgC#|WHx8y
z1wEO6+YHg<QCAG*rN7_ELdh__NE55Q8JtQbvDna+YF8FtpHu(wcGwq-kK1pc?c!Ft
zNBx-=G&}euo58HG7wR?OtnIeCH6t<14c^0Ej&p{~QmK!26y3k+UoiI8?G(!iZBfx-
zhXC85s|B8&bK$V%+)6Dp*=c;?IMjLRemul*aIw5g2`PLPUZw3%Jjh*a^~q983WxtP
zVuI+S38Hpn;RyJpk<xIZKXS48&D56@Je$wL`6?_F=Boq6_kuc*bONrs#bfa{e;HV^
z(3OtFz$i}Tj7UDpxV2kzVeyF?0LVc}DojNhs;nBQ0wZr8N5acm*|C2FJ;iPH`R{6j
z_Kj{HDL`?9Md{H<d|pP?b*L<>_B#F_0N{!`b&-$Lo$&~lY?=<t8@ufeLjRDC{1Bq$
z<!ebJ@ozfwV-NrnGLpR};REu>h9I2S*iouG$|UZRvl-j$75$6)?VgB?Ey8_@%UvC&
z<qg_gmZ+YrWGx3zqc9T>&J)~Yw!CFo{pV1qv4bN_QMz=dYizJHgg<{AW+()ZKTYoc
zN7Xw9Nzz4I!_~HJ+wN)Gwr$(iv~3&Hwr$()p7ylux1W3CMtt9|%F4)!O6;BI>~+>&
z%hZR=Jcm;k>~3LN%97VQ8!fA3eRXaOaagIUzg8~1OSj|n0bzLJxGY7hT@Qwo96r{z
zY6L8Gh8A%EIXr&HC{1A+y~Lzt%^sL)eZwdPd=K9H9tzrBBao6fclqLIiH$O0N4mT~
zX#F-wNfQF#>ACRmLl{f2dA=GkOUgO<s`+UnpnUzc&{Q&zzfWt)Z~}W=1RLO9#|^$z
zt;@kE&i&K%v^=Ib<5jW+gjk})9F0Q~0#TPuO_!A{aecH@nR)3aN8bo+AnJJ#-D$Dg
zPfFEZ!9-D3Z@k+&D+};=CIj}^IFafZCXw9mTtR@t&FF?b6oV@0q1`PMZRG033zSPl
zb8gz)xL=I7AF#nVpsBwPc;AV9<W%zo@vcNWG?m`h58V8UC~^hV@j>Y8{N@%v%*}!G
zcQWE<M>V?hd6?|$;8)}WW_S=O57&|PRerdHOFj_Mp2p{1sTu9(GC*0$8!(@ASe4ky
z11;TqK>~zBgKMb=is?9G!IHHZg2{0L8Q22#=<ZPNNL6_t@m0^5r&Ma+(i>eprXPnc
z>$A(i11b1#`GP^O9{e`SKWc_w0=4hcf)lpqafbnhc3g&DVjOyNzZ>6e7vIYaMB2|;
z?2ouYAi4RXSexsJquu{wjiea!o-5dZ2531xsC;+WR@mw-t3NXvmG9j*z!Pv#8JIj|
zqzCY;TUiM5KV$|N#JVeO)PHKnkhof3kG1{D9e^Zf7&Ia9dFRpNzk)9d;>D?l008Z;
z8IB;V{t#D~qh?C0mOjfBd*!>ML4NKNJB<ErWN+-SZC1f4Rx9225oZTTjbZvK2F`O3
z5R>pegv~f$5v%s!%iTM8rS$!PG!*91Z@6VGErnJMy4_VMB&hWB&|N<vs>L!ASNZvc
zgv{oPs1K{TRPbdwwZ)AK=eCgc)%{yXjdyZAIlGo_eXz!m%2c8@Xm`Fv#vc*6`uw;Z
zj}i*zw$+4G-Ls*stF{6V!K~Lb7YS@^T+b>JU#8LS-+zp+BuJOis<+JHRAbxFE*6*!
z3B}&nB$(Y`3j-0J21-~4TXL#-TFvpW#HVXgN!EfOzG8Ws0f;pQXN10vhXcutCyq+I
zi)=z0UZkUhj4)YRR~@Pq?DF<_9UoL%+js!#=e^L&_|1$TC~l9{8X@rtq>m*z+Qog5
zF*Z^DNJhW@xmjtd8Lk(|pwi~$u+LMdIO_5(xN)Tw#iAPqg8wf10#ZPRlv5D1AsW72
zy~<OG-ahq61C2%dX9@Z0U)LZ>c*IMn@VNQ<C{nh-p0M|HKAAoX1PELKkzd`{xYgFv
zCg{Qc5|yPqnfBz3FrY!Mlm3q4$e$odtl=8&v0@_v^8MmqIlS0x?dSih<5Bmf#hG(h
zRlq-qWk_^e5DND5)d0$kL`#Hv`<K+MUZ(y&uxCG1`%K6XIn2KPw0ppn><9idC?1dC
zG~2wV+?5!eQW9Ue-P@{P;+ObDU?vKLbn6%|{IR?INwc9TL&<$i5Pkl9sX=l}${6TC
z+ioQ~VOC(k55ZsV^F5ecIBpS<<QCq>L66?q+jMcJA@g&KFErLi16E_!DN(a}TiNdy
zZ3S-8J^`c#tHtp--x^crd4AOluS5YRM#x8A{K_ee=s0H`E(ywBccW;F0}~`M<em#K
zY6o^5FtKj{wT260UN6jhn$ZiV2bpDd2}7t+8^PVTL$6hT4rgj1jrepAR$T1R48o12
z-D2&#e$Y7mRyWX0i~X6SD$#T#zGgWecfpLQARFSkWUFPal-QXH&ll(0M_68B{OZ(X
zF(YYM;i-DI!k#HGKpnq<(+e)d5aC?QQ}dX~0N3a<KnjlTG;e1L3oJL(#QDU*<!MCq
zIav$k7#>)9w9L|0h8i@w9kO*sU{?T8_X~({?V@T@N?*t#Ad-ZW()hu_!`5yCsK$AV
z<)f7gO%gsj3-;S2ohl3gD6+0~0_C7VDS#;)0rXFEQ@&MwW)FfdlkJF1JhV?<iMlx6
zLo&P;HybfmIn#HCf>K0_-3TWOaHU37X)_4p9>cS-4@cD(1|Qe_-R#B)ZK#nCW2B#G
zBsV+TVG6xwa{-BK=bZ-3Wurz)@f`KHo5Fu-^rz^_>ly2pD27>Fp*w|1CA-E?`Q;ky
zI1jLq0Y+hR=869uGkiH)m;36cy)c*NxV5nyVu1P?1oBqZ=(**fm+oYT;Sqmk#p1a8
z-7Z+7Ys>s`OMgc)Z%&yiJMa#^^+678y8SwK2p=m#q|FHt4kQLuqeS1D!0rJj?c1M$
zB;*5<zZ4LSg2E8m9`76gx&Rb0bl0deO^6MI0x3Wm4&Ii%_vg9=voKcOChb|la)o(=
z1^%dF51t-`-2cWY)g=!F099OOd9}tG>(Z<EkBEx<yF_Izkd5@i$#DzT@doMS3l$Ls
z2}oOYGf4?Pb$Wq=gLXbGEinUOvCWXwoaIEI&&TnDM=9xN!D;rw<Rum{OwRFl5n3--
zf5IrWT-&R!0dR?&nvNDf!_m>GXRio0dX-9A(@W#|wA3<e{j-2u$11rt0MYoqTrhkd
zqRv_K*Jo5JiXX6FD#8t^o(QlF+H}+2fg5)@0q8+ZkE7#Hx8N5dl!@vFYxTBsCO2B+
z0RTYF%8ILMljwnh#5j|3JY$QcaqeDu76BGKgw@J^-qvvDg9WHLylcS-`HHgmaH?N*
zN>55&x=wbAqWECO0YC=9XR`Uu8RNNXsGZ=0+P?sXkEXF@=#$roUi&2o-4VGV4gvG7
zY>e&&Yv92IG9rgonEfz20*<CQvP{*^4(E$IO&7O+HU7N=`|r*-ams)=PP&+U1;D~H
zpp-+Q5+ZlODr6hD)&UU#?U{P)!2|LIZ;I+Px!zv{7MzT>naU;mW4?!`(+(r8>mRg=
zF9)*p_w!36-vu!aSEIDM4qzR23!GPg0!UBig7_Fm2$>Ko_?zqrLZHRX?R8w`>#>kR
zYE;qxj|)IrP>R~Z-n8P5q}L8w=C+^FO{qTTONyWAMsKpr7q4jc`!5KIrCWDqkK^o(
zzTL3<JCi5v2-u#xftEXJjjg8FIrwihfJ{&ex>bATu+Z}Jqa4^EV=WG}zgUZOZ7kO*
z6<(8D9?{GB%pzS!X=4d1Te(ra%H+nyQT7~4-M}#qOJaoqy3Za&GHPd9idokJ3C%Ot
zLIX`)^PFCkt^L)L2KKo;?~0;#fvDX4@Aah9ZLIY_balmst#}cOh+PoPyo?O6;`}z8
zXeHfPD<He}(%AUsxcxXi0+JPanrv}66QNWmPpZv1$!Dy8rbm!Fm@zt?>a7`CQuY>y
z+t~4G<W8r>bKM=f0ymTm0Pg){!q8;IirlHgs{NJJ02C~)jQq?a3_t*)aIomyWU*%&
z+xucvaXU(~Z5)+Z+D4}xu_%yx5auUjpW(@}8R#f7$kC&CAf({~>oguP%GnOa)AW?i
zF1@P98CQu_80J>q9O}&F*799)UMh;UU31VIn=ADHQE<~FTA4sarS3+he(ZObiSf8f
zrpFaw{J4R|khd`y=R!{4rv34j(@avDELv`)+ztqlj}@$o7RSh@;E5Ph<D*A<Srh9Z
zZ*=TZfc}@E4jP9^2&GV!voyHB*Y&tVw`ARqxF7?Ae0v968S0IK7BLPpwQ*qi88Ka)
zVt-NZHd`2mKV?_3&{t)Zv^Am|(4fiZl3!9|{jdX5nw|XIy*pQW=w@e)wSk*4v5%2b
z^hN5FIA`C(SiryjnXF@G-AdYSml@H4;8Zgf5D58)U}Wi#EQhYr86gr*t&blS7+W|m
z1d^f6YJZQe)a|{ch_f+gUr|sH4l%$0NHvp6RwNxmX9fLmWikPogB2o-qp1BARr($m
zH|PuIW=f>EroRYBan**iRs$A;h`zsrY<i~)wO4jP_WO4eS8*0oF$6H>d7L(L7zy;)
zuZS7mWZgS)K)n8@C1fS@%>Z=O!)UR{RvTh1LZ5FO$vX6Km{wm8((JXpq7xPRWzNXC
z)*Mv#2np!Ro`p0lE<6@vpUCF4;_s1VLswf*Xy*aqB7e*-Nth_BB}%hs2<Y1}h%sdV
zq3+O+dsfUQQl=}Pt(<uXh7KE@kAklb+Ba_pkSI!>3G0*QT;5(3uXzX5VTTjiGofDd
zHjeG&v#Zb;;Si8Mfy4EkooUIUvWiQw<t24ullgu`D^4lXR4G@pMU9|p)N<WZSm5oc
zbh<mnl@D;wtf8w|QjZEF4Lm2{THv{10i~AJw50H7v{@MXC%84Yt7V(x&rKi0p64bY
zei{2~nrij;kB#a1KbvKA@vSiXL`GX`a&QuVE+IURBY{Cmyzx4`dh;BtGP=$NAU~oG
z(`8yaoi-;sdGDg_j2Su$m8@!ZCbW_Q>{Fx#qvOKdI3DwPK(0Q&W$ocB1tOoq>2_9$
zS@{z(Ea{UK6Fs6S!RqcH9GUd`W8wm9_j8G`J=&1&T_9bT+KR{Ow3Z0J5y0xa_SxZf
z!1(l+<SBkXb0i>WuA(X8I2I60JBTP2GLk{@ND>ydO=)mcwM084k1E8zl9%i#Mi7-|
zTKN1k8|}NB1`s|H_6V5Ld))hl^rWu^?ZN|M@(p`_L@@X=Hz;vIF8w<ZSu-WL+Zs(P
zRD1LsdB|UY9w9jEh}ATx9x}x~TRF0S9k2z7c@-E@xH~#<*D{k>AU-Bw!yB_d6nzD}
znov|*vRqXKBf>@q*@Y#j)-gBEIrG4+%^A??kyw<6|M9)zPh^HGEg=4b(CYDL37Bxl
zPvAbd;z8TnTadu)S)~F-a+zH77fm(t!8_6_Le<880`gRs!o{)2|DRXhz(p$Qn%Ulg
z0Q}?=+e6BVnPN+zsK{W>uq&6k+zz4s>nXF|gZQmRSPBmy5<4J)L^WOq6lRw3waUO_
zS&%CMLO&1>FtNnL#^6FF5i!BFN^rbn+Y@LaP*@5&E~ci<h~B^0mf2vN?N2DYIrT|*
zKiqFNuOZrObXawkjbdMdK-dAh#`7>kanb>d=7~GJqE5xyw8{GXbpZw7EOL7y$Zau7
z(Bslx+URQEoG@@&jl^*nX`v>v>{E|kN$D^F*mn0rinddW3c+*@`u@%LN&d5J#_C}u
zIE_Oh;#6AWi{;|96RxTT3y|3THoxW?EGqA~`H^vv_PP#5_9ASWE0GcxLJ<`h4vK_B
zeH;waP*k)e4hoM{LLL55H{X%AAR;A-kCzqln!O@l&uHI`BP9(qF=NjX==03`kR*4$
zIy;%l;eOUaqB`Qneu5ufVt+Xh^Up^V4M_0Jt#H-R_DGE_!a-WY+5VMX*#lFw)rNel
zof-rOmClWw)L1ay*L$|=F7;Y6*EyIFC~1@KL&ndc<^E4U*x1_V22_XPaG6cws5TE^
zwTMR9Uk^)TQ_QGjVyjZtDs7cGJD6J(>7qRtw17`@dAUj|H5>#smh~I!-oO*%qDJMR
z9yytAJ)Fr{f&kQ3Jg6kK68c^>r{mA281$zU@yQZ}J!Nixd;J%C0Q-4|Rd7tz^e;7K
zwd@4!HZ4gh)OUtNh{HgpvGa&6VNOMp=9sGLZRQOHHOKS2$|Nw%U4-fuqSB>~E~2d&
zuhfZ;7L^Vz%1M_j4#Ip8odA;d<=n91iv&6r&SPF5E4yLkhh<rzn+uz<Nv*gfAu(cF
zRBVKS>=WZ6L7<hWTU%+|;0S$&k#%@ae@$Wp^(j;Zl<Ddgy>L!tm;l;L?~;Qts|atP
zw%8Lcj|E&1TGS^ZnMS)1a%d=Z>N584<3?}C%M+)L?c`@;tw#a0*#?7%pJg@k0t9ft
z>Wqv4lGMRaHgLX*43F67o3pPOWW-6usR*!mJv<MuduAkn_F*B;XfH`7kE3lUxTy^_
zHpiM4Z0uEf?7H7AXK?)*S^8fF`XMH}ba+%DDnNcwZgFLB4L^>MDN;-1baORa&eHP&
zuCpZ?&*C2w)4LWY(tP}oSCc`u>w)WN0W{TtDaa;Mo0Z)8g1ph3vdu2WSV>Xg>2MS7
z3?uly4{6EI|4-0w7$I+-VCis)iei+mQ-;wYAI@^jVdLhSk>`tY(EDV@XF|^eTNu5<
zDCV28`ZZ!QCSATmxBFyA;ujAShDjn7Rx;$&8F%oGmgwZ8Q!ISgg-xRv%P;Lk$|FVf
zf%A@~;N~yI)M31&-{(8+*iG6bBTqCtlPTkp`Ys3^azuW~H-hYvhZ#395{Mvpn`gd6
zY1mwFusdW`LEV>}%@@`~4n@4ck?aj`;nMuAmL{gkJu<30t+T)#Xvvzkd{QU^i`BK#
ztWvHy*|XFcH-uIn(AoQWxH!t{F`>*py-0&*hU?aAE}*8l=`I{?CbazXjE%^Wqw!4G
z&rgH;{!34(eem|v{WBJ*+=g2Yr_S|n8ZqjW<RHj_igCo&44@pRMfK;nL(Cs_K!dsc
z2d%f0exzxHb=u7<qILw?@q!jm|Jd@iXaDe{>-9&tgo}v`t7Ub$2{H*VJJQz&y`J(T
ztwYGq1i$k$z8YIGnEV^yU;P6fMZdi_KG28-Xu60j2px+Z&hP<KuO(CWmN}1Dz!b^A
z9vQ$Z-6P}2jTUl3VwF4PN8UqH^?Vyd;5Qh%e|ZD>@C8k~>p$JUj;7;ZcKX{NlS^U<
zMm7g#kWXXeSIenY$b}3~Xi8}|6S~+d(M(w0X%u0D(~3J{q60L-6Fn6iK;ts6fd{6@
zr6lt26~AbABw2m_h!dVHKYd^w#0GUmMDTAt12RJF&^ycRq$X<Q4RrO9sLbWz#z3PB
zuIh-v5M>i(kou2b2T)STY~^szkL2Vn&0Zdz#|N2=^Js~zM9)kSEvFY$(!lN2;93eS
zw>+nAAI8bwg;?8HDdMNvk{7ohcpBzrAb!`5b4@$A21o!Lwq)fcr9q-%QtWO=k6%_w
zTVcbvq`TWoI6ba}K!}5YMPKaA=igXDk<EzvCZh?lT37UR8DYnMP3DQ4<Oz+YuH>4;
zMs4!n?6<#gn^vuK8}S`hQ87Q?x$?G;s3y$@#Qvx)AZsq%2;=JE1qm1|$6DDJ*i_WD
zyfijMDyP+~*!P!<*L|>kc)$jE+m^|!q;S~D^G=%kX;c5G`I&ae26dVlbp@2GU;^!?
zVy>bX5wB2CR*SPw@8NF9)Lv2$m%@ne7SfUYxJ%k>Iso>ZEv$@&!zeP<Y+8SZ$BW<3
zK$f||R7k4voJ#G|pabisukb>Fgom<T=<_|v*N4}78TuWd6dbCQ4ts<pFI3@utnXHc
z?yqSrJW0;nZ)8=zw+j$@i>~iC0z{w4f4p}#{RlTp5CG})5sEag#S;~=i4uOh%q@eQ
zrR$twKnhY(M#Di9>rzazoNrWIvSu4RV@v|`n)_>Sk@ty!zuyyid+RN}>vi}5!c+xg
zVmemp#MWHGp=ubxgmm3*HN{N#RN|1AH{y3LaSV%dx%$CFRr@|^`FjYp`kaya%QB|A
zxh@i+zw#-gc_72z8t_p%zYT3HAOZ?sf)Lvk$5`3pag<E#_889BQa{&Y12hDZP-t>T
zq~&hjJzEw%TBb?+gq#teMmf}R$^0(O8u2WD<r)SYQ0~8Y5mg?8q@)vx*pY6JGTD*`
zqpK>WKDlKbJD@7mMA2AEyqlb1`CX67bb4!iBgrs=+)&1%!NNHLTH{6O@G@4EF~I{M
zjep9LnD|8d&@NZOOmj<5uwVxhw2rOGFd1NgmeS!l+m4()x$Y>l?c}3RiO_6JS>=fE
z6BEyj@eC=C3%>+bA-us3`D?IT3OfkZ%NMa8b`;X@y5<)1e=^=%98kFNF6j3w`zEry
z+RQgI2p-nNW-@^a;g?Wox)L)`Ja1UJ83FYu1z;9bHA94Qnmae}-~ocq#tO~+dh5|x
z{^Qs0gXa5>q3QR8<Z{5;k%#`q^Ql(eSQfWyET>wpo8c9hKqB<R{}!QZ)CwOZV4eGB
z{Rw*mQ*Tnt3K(G#<bHz(1T0Oy_`tcTT{We7L$mCR8Xq#5ppMi5;)-Ejq}SKAS~P$J
zCi!lFSC&^+(#ZEi(bC=dOSkm(&f+nHqr^m!*O}?5H;0}%_8%QRs<tkWX}aXNlxWX9
zUfH%dfSz53jd_9kl7szG`T)d;?<{(Uw;KLkYcQa7=?RGelVYO(`ywzEA(?>*9x=oe
zkPZL9(Em_!3=1D{EIDlD1mC6DUl*|9@)CAX#QnzKJ#*L<2mwz0psvAY(5H&{oP>y9
z0<*j2^f`Rzfz#?JWJL-sboDDCRXT4-=xSY6Pg+1ve$ueC7oV2Qo<%R3?)3Py9HI>g
zOe^s5q{&6O`H<k@0%IhhN2n9eD5umPKbIO1Tlo3?$r6M88nAW~k?%4(j^ukItI1E|
z7yl$aGjhb*GfwUofs1(^+cq@Lx>9FJb3yUJQfSks2egMFE`ARJBQZ4|hhLhW`c50(
zBW>QRZH0?d@`cBPm?b&x+ur<_LEwT<_F61k@9NgISOb2A!Yx7Qb<{?9Np_jsatJh9
zix5t@eNX>a>ztha;q|9pe}Bs9A9Xeru(a5<54sjUAa$qFPB1fuk$$in<8Pe99mftO
z<lZ5CXN<#H@%{2Q=fy$WguqUopkRID_(gxVCwmCi;+SHpO7t$YuYVk<5WT}wKhCZv
zPXtvi+1NVND&-0Vg|uL`zA<cZ#;-O!ov@B(s$|WBys%LxeH2);KK8@FxZT1z++TNQ
ztn0JSE<l*4VNw1>$}jTK?|BPohXIDX{QzBX!)SCEzvi<kyk)U(swUh>C_9O9QK~?D
zX_<dfTOi@IJuJ2^S!UNGjR~x#P%t~CnJUgRwlUnz3l%J!|8o++fCcyisvvoCLWQ!K
zy(J*vYc+??=wFkFB|4(mJWufWH|3uP8MC+l#>uJe?ssm$*|S4$b}^s%OK4_Ll*@=h
zgjdLDKLDL~S06Xsc%OePO9jo{A20);VgU+?Q6#;_NBWe7?u9XSi~qJg*b|F%%E0V5
zxyp~TH@!;_;j3Ll*s7t?e$J!~JT-VM_)lbcr;QaPZJ}%HOKXTf-i0>|Y&e6`@*km4
zXf#=-{mOOi<>LQ2UZLQ>UH@|l|DTOWZV+6JV|KGVM{>LBh*U+m^`ZQF^CkIm)pCU*
znNaBFBt>p4v{qA<3Wb7$mVn%|N30WNqy|>A9x}d9Im9SV7G1p~VA_NFxEI<YYDKhv
zZ<benm}xsLL!~=49d~{@i;Wo`FKB$7dgcvIcx_0|>DCaO#eQn&SevY%i)`+Bt#kfL
z^4*nT=*5|F-`O7v2Zddm2UQYk-rpl~Q6CGxcXP0{OG}rzAzCLWaO`#1Ccd%^Bqll7
z@Ia{jWl`L^NiefM$ce2eirkp3W@`^h%_iL7ms<x6b-a1*FK?Ter7R6Uo)AVkI&ZVh
zMtu7q$~?T>+@dzj{54i*p1W_CcgvDsCS)jb?JHb@B)oKdC!wyt9r?ublT%HzcRr5C
z05K^_Qg^hzkLWkFvg?*F=p@yF%8fy2_)2AaJ6=}88*dX$g1DW%o{43wSJO{gWP_HH
zr<IvZl}$*M%}A4MAh~A2S*vSn5!RzIdet%IuZykDp4JjvJtcVBucPxYY`h~Z@F_A#
z@@{ihm+?#?6}ghVbFsOamoeBN&;2^P&(xH#zM(Ld+hdzjDf2IEK7X;lKIXZtqL4>|
zJv;+$$*yMph_HbOK^&K!MUnuaw9%7DpzwUM`11OnqD&TurnVK64<vLCezUjuRAFp4
z4lrIfColV_M~c*|ROJrje6?108vd4_bJbj$_jJ{1>sPom&r%nVO=+BYdgj^v=(IJ&
zK<=>h6;T%qFyxkn|2V&%xeap&E_h$}*Pg|xSX^1G4)11ZXHsA0tD!}eP$^@_Y`Gt#
z`-=W&#~7l&wtKvcw1JI$=0c)x`FP##5KP3gukxG0yz@m%KQTP`^IvZV4lJH|E3wp3
z3ch-#dDcQ0s_B6N$5~Fx?}Guju$y~ttzLGmvc?4p+j-R-^knQbkLTN03+2&9sC{r@
zkEI=U81mE02)3tc4pYmBV&0Y=q(8J1R{nAqeRTTOx(|rP>aX8#v0EpVY$QH*riq=Q
zI*MM8IFkkPw7>a|s=ZB?6X!T8-#Qeptvh0j{@JZ~Tm2XG894j*(d<Ue<YOgf%ed7M
z8r7BrYcAe?aabGS%bDmY-g2G%#W6p7k3i65p|`GP!JE9T^ohU#vQeY{JI}A%q1<Ux
z@5Ob8!uMa#7ks}1bMkie74~_CYS!!4Cwnw8_Ytxy$u_p%y1y=VuVGzgcpopqW_!4u
z&Fo_vz670gMvNc+kZ9u<a`R=}->xql7adRen`@`*KG)RdFjGn4CGt#4xJY}XHvV|Q
zR*fzb9DiJ2M;4vEOc}33<FK81U(~`$UeGLopZH&^Z|<DgiEfyN8zT~d6It<_@?h@z
z*`%#v&N93%mRUU7sMqE6CM!K!kEcX_P4q*s3UYR44FtBi7->Zx^K`vzTMse+v9S2Y
z(($lY!loIyLIx8*z#sA8ObQX({!%S&FQWu_i?<kGb5lS-Ne+w??2Si7oc$4Ll~c#P
z#Tj@Ji8{&JLLXVOL3BpWLKc5hyLtvC^!h4k-%Zu?f1@%4e)I0Vx7=eSAUqx!>gPO*
zuP5`|$CnlbpJ6{%o7|z__tUS2IlUaq+s%Dno-I8s>e7&GS*C17$MV$w&{Fzq!Eqp1
zTc+M>cop%rr!z<^QSPksszOPXkjySImmEKR&4ux!R@o+H!98xjqJH_0T)fv+CLe%l
zH}?BdUB2*L4NGlgE?<zZ@ubDBte5eeBneHt*fDdSpgChRLW8Jwsx6Uc^C_N0G-FXt
zW8Uu;@peyre3Bt)F2YaVcYWrt;56-7EkknRCqh%2_*Z%9FRtsIgcVk4UN872r3_tz
z2_F1hEVX?%Ue)8Mo9%h2CZ$L(>mOqkvi4mtxDCqMiXv3|wFl5dBLY(agmo-HZfXx9
z@I8bT1MPS!O(Ziv{_!ZB^7ek$T&BJ`8{_3UGQvfBu%hM%M^S%+tbd`=UqZ<ksi`eq
zzPjcDBn&9q8}gLsp#FgdaB=}*oi|A)oyRt=KDn2tqyOtAPg-!Ub(;eM9R6}s#xEH)
zV`IqcKL#dP%NC=ei~X=wNAGrw2`e2&`A(;l)%;e__P$6ZmWY+^B3PrDTbg}WVH^ja
z<{@5KI^s<sb+ybrBJE(~k=6z>_%OpQd6)yyd(^lla;^O-NSb<>Z7sBU8)s!u{NJt$
z@7OrKN>?#96ysE8nlB_fTbqz3fAN<|C2Tkrsat!yC^#?(2kEbfRs8_i0YPk>9d=u%
z%NqsHEE`q>iCM07S)YiqLsqiZ`fT3Y`;;6modH=aH2onAtFfMc0-tSfd=+u(lkb<7
zTd^+sVl=DImI@=VMhf&NVZ!Vx-*y?drz}T(*Vhdo<32l=M_BebYBUYHc>Os-zPVy6
z+0-2b^>FCJaAI4tQ3sap5SG7+Vc>XdAo)N3`1+zwp5d?K+i_yf$yM6uoMjRdB{Z?)
z;_~z1*{z+eYQX@aJ1-*d_rv(RfG4fXf4|GC56E|2Sm-OVH7WbUaAZSX6}B456~7MJ
z9>V3Q(O-FNQ^P`envSIWU1v{AEUdC6aF|2%J5}}eJ>u{6rQNC<Ec;c~_g^q&^GnB0
zvR)kSDYw_Cq8xNiBKkcgK@U^c+ka9{YUy)<+eRvkQzlJx<Fy@CHcP8prcD`TL(V0y
z>}_e)Ktg4g#du`7Dx9u(m7YLf^3JNLF$sO-Es9kwfbLL587;{jw_KQD>bs3uU2Y>S
z=aRd~w32OjA1`_MSZML`OKWvk<GrT3P0>W>0&Pa)J%yT$G5@Co&cH$EQ0Lr8^Gw?b
z{~U8C^!MY@u>?S9cKv$Ln*C0YyRqxMoZ^DyqxN^DR`1jCexlk`J_noQ@0-X4yUV_~
z@Z|x2czQeij0qad!eN8k6+P@kqzoECKeXssyQxJ@)qL`?=9`uA{ghXnX8m;<MK^pe
zv&U2+Wh3(hK!bw7Jl)7y>O5P&Cb(g$o897P1eR(lu;sPhHuo+3TK)9T(3kZatM=>B
z5n`}K{!w7pawj=^FLzzMCT7C`E^LtW4tt3+;%vlxHIKpIp7`B#J>`Zw`vw}2JfB@8
z^nlK^tMbDwVNZv_8)@?f1XvV<QG^=fB=-m=7Sb9EXE-)jug^t9`$HO1Mb5%tutT2x
zQa#%-r$j*=X?sQK27wfieONG(mO*AM*s5EPwoEeJy^?ygkT~_uj8`&z-V~}A`=Zew
z$za79WWN~U>;wpCmZm?@5jaZ%sV6$%_q$%nXLm!v`~Y)&)FR*H=&361<8Nb?e>+Vr
zFSwtNxV8s9JOJdGY0?hUWRET9f3AoHHl|jaXzbxTe)35D<JZY#gK!zO%*wH6jjHtk
zQ$Tp(z0lN%)rP`VJ#1H*g%^U*x%x*1%F+skNp|n#R2k3j2WJbMa>r&80Q77bFC!D%
zpRGvT)%*QEbprQm{Jyz?L|*>lu3JsNiDoz|){Q`U&>7#c<|qP?xd9dDzq{)Cn(28&
ztzLpC2d&QX0+0ZMrMH@}yWY~$IP7F(UFe(Ca{osD50dA1U6(iZRX+}^z69qW52{-B
zeW*=;y*=Hx#94ywyUC-CoeT9&amsyZ0G)nJY;o7n{8f*7@QI8Y^jy(i!|fk}_-YTG
zGZRXpgktuG>TL*b!t=%K5M}_PGtBDc-ssN7{30C<8BA5KvylN)WQwZr*i;#0!vVLd
zEX?)rJ)SX!-V0&pYr15W5U+F`&2%HJOM&0T%F7e1fo8xg+x2Gp+wlQ3j-+yn{S_wY
z{&P1O8q|cvn=!)om`ZC+4VHStk<S9UuB4WNoetBP#4<QWs*H0aSRg%Yk-%(=LTZA<
zhOupwLIq_K1n(WiB}zX$6so^`4Vn1w7{gIGBVb&GRN*+=Lw{ZY*(PFcgslEYc%q&w
z10cS<+_&G~ju>oe)zm_jL|Y*RGU43i5n|UE>|aF3H?3^yk*-qr3<@qmNh}JGh{!Me
zvK;D$yIDekB?tW;r>HtrTY1BtoU0Waj!z`m=zEra#U6f1@!DrrO6o^{8d*&NZg}f+
zx6$^Dh5)O=P$;7<E+St2OB1_yIk71umb<n1SdrG0%;7stqXWaZAPK92mdDG)uPF~E
z-CUE;U?}5)b_$Uq1QbLe+O*I{edseVr=I?S9sE#lk$1(avLX%C8H<|mvze;jI7CMX
zT#1><w{Dg+W5YtcpX<j|be0pyI^$yH$&W`PN3^4Uy!OC=gRPD%{)R8EG`QLx1i3r@
z?yuI#-^ffwrf~+_&u3=&4+rk|{Gj=k%25>UJC80QG_hR|!<r~X^L<8&TTm0xlVt=S
z@5p-ISBqtS*>w*x^}1_Qt6}H#bf4@}^IBFvm}w0=^X!vhoQ!=L2spo&{7qsxXB6=S
zfYq+w&frsw=cCSf>(%(TJOxgzy6a^!k-L3&Gm){cr>(;@!Rz_pRoNFt3+cv30G;9p
zMHCqDA->d_?}HXY-)Y2153@3KUGmD<OLndk{7?xC&I+EWKTJEB)bVw=KH?B1)2a#q
z`6F)|5DON)Xx9S_8n5Ji;8sBDz*k(z$3kSKZy94rS?In0JhRlp&QQMy8vT4)DXn+y
zP}_!r-JXqD9+BP#W%|GL<L5eFee&Ns$Ieq|SnaQzE2Fg7@R6eJ$r#})XrAo=gLdL$
z4a_`zk=C?S6%~e&S-6qvLP<b5W^1CnQNi_8*kfgN&XdW2{)rD>yt`0adUR=32F(9)
z0hpn?DI#H#9m#l?(I(nF7nAuzw~S7+Sbo}oK(wLX`H-L|Z4xm|nUN(o$NT^s2G}Iz
z5g5-(9!R}C%lI0THVY}JpqU-H3@${~1g5%4A&Z;TMrEw~8~lXdO_<(6sVRZ?CYdot
z-ZT9>?jb@^Z1|Ii*W)_1f~3AVM@^TD9DoPgZvD)CB?nUPL;K^(U&OVCKCHv)lP9#8
zc5~i%E3(VvA35y)k{QMbwZG(B-`1Jz*0MxJQ4QEg_$<GdL1oW(rs8^8F)khkb8oSD
z2Kq0HeAdwhe7vr#<1)LsU+Mh%zdjO&(B_E&_2r}$#M28QdCI+jzU3Y@k;6h)pj-S?
z$68~_t&D@yN~7gxu^Bl8IAf%YE_yK&PT<^?r)Y^Lw<>d(vI_gxR%W!GCuPZD)R?BO
zY`YEhOa9Z}&b`Ieo#A`Ac1gm2Fj&A2rFcG8>HeD&Xs^8o?4k`04muuC%0Ae?N>WHO
zX|DbXSWhIo(;W7$*;~g7T>S3pV%M5$efDbMZ@+Vuvx#7C;oSBm01FW<fz>yr$8y)b
zO-)qy()pQNfzWNX`ED=oHohX)_51SVd6q6C9E2i8$&@r~Fy4_FbZub)CjbMcIc@-}
zQ!#{D6R#$pu4J}?l_QU*hgdZQWvyA$&<{2+roVm)qm?kolxSu$N-m0zO=%X^p!LsC
zi;4`cL4rk|9lVOsP&&yQSYz-Xa|MTH+P9=sr2vwGeNsZ{k9Tt|5u~M@OK#0Wn+95L
z5m5kWfil}H93fW1Kq-HPE{)ri#1&chQBKT~jJ<IUs_+jfmu!NsyXkt&19V}jH)M<W
zG$=jwbFGKoWfi&pqhI^{kB)0<Y1PF9T>7xZ!q5<1p=N-wdW)y{$g<!(Z0yE3>!aL=
z(4sNoLXu-W%Cs1u&U$h!kbFpW%UXJu{!!z2$OA0t<MIOyWzmxO0+~UiTD<Xny(a0D
z-&#~}g9FpZ9OCOwy4l|#;f$@CVuMbLj;u#Vv0;_$V)Bx1-8a26jq+apO-RX!1szH8
z^61AS(gQvZ$9q*EfQGm|MLuJ<!tV1S|H|}D+unkmf=g~d3!mH_45lj`glh|k&@mpJ
z4vGZ=;q}&WT(19HlJ9!M`{-nhwwK+0w{yoot%etux2oW>Ha_?EuUC)jR|=W7Pz%W1
zD0!c!TmBq^XRf>bxCr#&WFWEGVhRiw55Lz|2H^aNULJnKk;ukjmDq*`?+bO(l4^z`
zxDoS@gE$CMpE*xc9V{CivN7c(C_VZ;$QP*!pWKD$jwgh)m&>R>$4hLyZAiS-<`cD$
zzulF{M)4S*L`L&TW1t_UK&#1FHgNa%M$sBY$Hy~?7T4johe*UJ!TxO`qO-bn$1AP%
zC7ZqhA{^O@mt96`1bFTYUn_u&w3ywWon^9O|5`KykBmm1_#@T&N0=ce9qup2-nyVp
zQgMf|Jmou5R6q)d_$5R3?c`KH!UbQW&a4KK`<O+<b{l#oGymNE(y$yMH!1)TnIww`
zG|q-7k5{&m_TQ9Li48HX1@a(6=1`ERkRWCNqs}sHPGNLIQ;mt9$^a$>_M=Qb*o-IZ
z=TwZ){M5D(IRIFJiC3THgJ@(`m{KO~KKsw}5A{i~##$azO>;(c0h~u#jI(R0?&jtZ
z)b-MrKmE`2hKJ)vW#}t$-LLDQp2b$>PjEW=Hx`Hv_#S)tIg@Wp{x^RxPvSnSSIE4t
ziIsI_<Ff>RX}oFtlDbZ>E`w3Qi$p*XNrrkTdmN}gI|?B2n|&%f%d;O6uwhX4<dvVX
zdySF#z7B+F^d;qe@fcmyzPz#y>S@o5xdacO_2<cZFh*7-uJu*#ZU0OkI>I1lV9o&Y
zN%3{GE^Ec3ku5UVdXpsG*5~r53y4>pa`CTTP8`?iT6}${hX%&1y{omIl%dI$x~gM3
zt+ve};4wVt_{H_@ZMsz^7Miu^0gvF-t$ubw(m=2MBT7LdHA%x(gFD-BL{)T?l@bbo
z1bLJ86U(ZL6YB(}XVPsMQ(zZ8`N!afb1OFItFG*>hkp5S3E_SSDDYX2h~c9us0@n)
zldU@u&+GU#tmpe&8#!%Sd})pHKktqoP=y-LG}55p{R{E;w8^_i)VuZA*w!Xq`?nUl
zZ7CV*8Xb9Weg=EwWk(*r*6R;4OnkLQl?wb9aoMNu5mQ1Zc8&)rlhExPpyUz%{o*|@
z5jbcRsrD}8&;B6)Wio#`mExiVTn14@F=J@6CNPk9w0MWQYh5b28TwBt0J0t1_Byw!
zH7Y%s!d<n4OM17GsQSv><@KNdfrj7}wA7Qv`mZW?M(OrAYA)hyPjnvt!Xc2*RtK^P
zbVfVeT<fG&@m^DUB6u%T^duRRCjlLlu{Rrq7yPiu1V?_T8i+Ggw^wRQxIs>ir3~yC
zp#yzNr2!cm6^c0Wv(#u1-Paakc}@dz4Jolo;3FBS5g(_sue?gC(_a(%JeLO>_F9ke
zhLP@eh<L2m&C$3xJU*X)!uD5gIUoD{y*zrC+_ob``KnpaO?Jlxoq=w;hYfPm+)YkQ
zd7pl-E2O6yZE-pGAKN|4M*68vhXp%4AWeHW+=JQ>?!Kp;A<Q(CMIO6VHT`__*fG*$
zeH3b<V6s|0#%GA?h2ae!-H%zh$@M+O?6_WCZ|g6K&9n5s^cOhUCpHHNG<9yBJ(9-M
zztM@rINzZBJ+S<}qBQm<cOJ3J%F!s$mJ7YKt{-yUhGbqD?6KrWHqk~%jQmQPN+pQ0
zetWws`PnOyvIV<jjfTP-;9gcCDyKF~WwmsSn(|=rBc#Vdg7I+TapDcB)W;9BZ$F;E
zENLk>K1Tu%g0_-?0>pv6kcz{pq*{a*llq?WZ-snx=t8&1YwQGWnTWIl#1RJASxt}F
zjd(B-C@|w9MISkR)RffOXEji2=ePPqH^NnaaJCI1Wk^6yPS=UbOj&&V37c*wv0cKE
zO|abV5>|fypbm)Q+dX;GaIB+)0q#GGfBfVLjn}K$KoWBX82-t2TH2J3wDsM!HKx+O
zukr!f!M2X3JejP2o-^R-NVvDqIPAOE?OkpVV6t<d02VsUb^>lHJ888;@>%HoCrLsl
zOo2FRo@%?sq7t*d`(H0*Cna`#lOnX%-$$QZF~FW6*G_i=<F&mR);V7a%rznGq@+sV
zOmqv$vuQbz`_^h)2Z-hNSEPDtiS0CCTIe;xzW8TlhAC@fJNxUeHDvtQD?<@0lQjHx
z+dPw}k@t>%cBa3RFb0!qLU0a*F+zZ1Gcy^+tjcJQQK!7AKZ}z_3wH-+a<83S%(FOt
zI|K66@>M1u7gd7=P)_STr0@4hzmG;23#F^-{sWjK{{xs}6f!84!v`7%dUTjwC@Xe`
zy+W94^2OojBWriTyw3F#%rmY8o6&Swy5oU3lbm|*V2ybM;&2f?>0G!@n<RcoQ%P@l
z?mp>AF0IRL-I#795Lmy-nXfGl?AHz_dU0}y8nS}zotk{AT2r#%N5^r?h==kxgN)U<
zG0WB^)$1TRdwRH$(E_}Y=Wve~3lr=EdUOkVp@=8OBhUkY67Jy&DR2WR7X}WO4g{Oj
zhpT`Upl9kETqLZN$d%4})Va{HXY*{M!7AH2=!I;X_}uA+LJp>g`&L&qWpsEKjM)I>
zdyX9FqFA9)dS?oe3x|`tx;@p1fUkAu@!s8i%|_y&9=%izKG(m@PQo9vAk<%*H<GO_
z40-g5jPy91m+u65bN)>EC)prisP}r<?H0Q&>-;_~&BIN2uPTX7hy8B37n1F7E(V4J
zU$wb0dmXy32Va`J$N%0&Bi%7twyc{U$(s9L<UPJC@*81N^N?_H@%lN>H3Q~<ac)@O
z%bKdC>Bg?D3sVX_T4o{#r=uy44hr|AJ10N`W}+-H*8A_*=J-r@dsD<~6E1e(RQ|b;
zWLi*#W+50VWDG%ZLRg^6v>|dA0?GVZj!X*8oHoerL)M_AW%~GvTX#cAPhD(}KO5tx
z)_Kt!qqhM}Fte3jIY#jA1GXim#}e3@Ph`S_h_&4mrzj0Sz>&A1te}j7coI70SgFRS
zL|}5jQ)MPr*~4RWwqFY8O@h)`IDw@HmDFrV6y-VllGXE=id{`fbcoydiX`S0_f<&g
z_V?FP;BfNCoT;U8Z>_*Fsr22F;C~a&^x*bQzjaSmWuia05d(BSH1cUBtzw|KEj-H@
zyj4FEJI)94pJhwn#);_IQEfd~axXETzBFoQ>@n~u>91W+*X<X3)=2<;frX?5qxu97
z*vDy~vQA)?O;gCe#e{DX{VV!+wI672ch-Ko-(5~yq$IUT93aUhXbT<OJZFw67Da9m
zq^t&0NPw6$l0*(2*i8VS2ceF3sLBXn@VS-dw_ozk=k_n?fH*Sry1lEu{jq2=$n8;f
zO`Xz~<bZ|QpriM!(O$NY_YiQ94<gX?RFxCPp>6Uv1y?=H9834?^5kpnIK%9iE(*Cd
zw^0Mvm1Nh3UA9aD2Qa;!$6PP1B|y_%D>o%Yk>q!N6I4W1BVZ`7tgp@<bnp89l7@~1
z9||)<@nKSapcd$RA+FgjvVd=G8-lz}sr)1tf3+=k-II11uVDK$4F_=gQ*GUd+7HXg
zrFS7|^<YHC)2GJ6yY?eFNTRnKTmGs)^R}5++2Jf5<lqB?=9_MZz-$`9){<RUGs^%5
z2&<k|JxY$?od+C8gHy*^Q7nRTW1-0QL|++3f1>x}PI*{ZI30n;$M|}G(ovq_s35>2
zia<&Zw9Bd_(Pn}{0%LYYLZ+@1yA(@o(cr-p&wsSvvQnWGuxs~P75+va5!VylwKL59
zXBZ3sJQ2A!17dz9(C&6>HJ~`<-`_bJC{O|moGqWa^zqK6fJ~S>M8?hJ@hta#d;kje
ze2g+09CJG535umPzdpzB^oA3AjQ738&1x^Wi`(r+Gms@GVjwm>YbcIzN{t$3a;Ak4
z`0crah-q}!QoXDH8{nFBOX24P8*gN;2CP8!`4d=-E#p?4<+NUvf?!N^G*LxYPu|J-
zf-?c)_KX1<VqgL%I?eXv^Fo6{j7rdbGK~xS>zR)8QNPsKA(mw50#-m&aXKx-bMS_Y
zbl&$`9ughg5)hAMe6Ec)#p--F6G&iQXq97LnfKm!c~cZp#dHsqP?`Y)c3(2n#v7Ii
z%)D7cA;wGofQt)ybOfWv5~HPz3!JVyE4OYDbPW#+9w>3ESL}7Q8oTuO#Z5t0p?o;u
z_MbqtRq<0jQN8@*G?Cb$^imk6wA7$n6$bi1DuE*BLxBndQ0QYa1PMo;tq9QMsTYCG
z91fjXwBTzV(*21CX_%V3fSYL+^_Jx|{nX>3Z~!z5Xu!QY(O7vD%I#8FTHbvHVgqH(
z(gLQ<ozD~)ehynMS3YLy)&dWryL?z6AuvF;*8+%>|77E%py^?Z3SapF$SpupY$wPC
zXfJ5nI!(R5EwWirnb;DQB9nP<t%7${EENjS$9ho!LifvC6?AWHyr{M1-=@CIQAxxs
z^^1?@ZILwYJ2=yOp{Qg{`kbSjR=nqC=S(I0ma}%Jj2;e)L7<|R-kD>GXX;7{{gAJZ
zw2qd?Ye@<j51?-2cb2SmwFFMeIhvAjOhth4>|O<3{G+g3)dH}lyzcr7c{C^IlqLrA
z_~gs@%jE7*#Bz@Oe@V11^<O!g37Hbhd^E;Om7UuMcP&;c3zvQm)HeuJ{=p@A2+Ez`
zrtw7sV~h{zc&FKynI7*cOy&-(?6~tsnr^4OyFI8-+u%d8>2u`!Ra@wc>>(h%CgyFb
zZ|$1eUJ?ym{=!!RL|yb#iT2BdEo74<&lq%Vhj!t^s#BKgG}qYIHlL`U&jL^Lk!CVz
z&-1fr4Fp93_boPU3%#zXfU+831*EK+<is}xxzMsY%<d`>+0&^nlPn#VwOFNc=&yCr
z!EEQ{uCyHBUi8by-S^$Xy*D1gSdAa$K-|xpZp=m68)LR!4QdZMF)=@GxI~h<?#|-S
z+$`=Yz7{q(dO9moZE1o3QgizAXmtjKYKjiikc@-Ceh<r7^SQH=6OY~em4HZhZVl!;
z7VoDw*5Od{rpNB8pypB=-MS>Fx$%~`!HDnad6Q2KoAIEC>+raVB}_pZ)BIG@8r#$r
zH=i1rCbxQWuW0K$0>xM+1X`YPd?bu9!Ksp~@yB+O6J!K58~~cx5T!&>x(GR-`RW;(
zPGWX6Sb%V-<Vjtit3Hw>yd&wgtsZMc)cwZc|JNH@ePp-ROo$#_;2-XVq-NM4&InrL
z@D$HlD_JUOrgQx{1&6F9(Bv)&Itns#qAg17g0avFT(wiX$kQsF1bqP&hTuj+wbrsy
zESgh^<?z#|0LzQxh@g{dVGqgSc)=d+5suJK2WetULOPw<@n8?Z#l8WXsiiIz3lAL)
z&;>l4vN*p;)l)WgZf#`3^?k&8@wATYg;|WgvhovpvEV9&2&a41>FK;R|L`psYCaW2
zWJ7)y>-bKOT!O{heAll3EZz4y9u2FM?EKl=<6gXSq787sLh%4fC}hswKh*@$^*SK0
z8#2W+qw43K<zQjIGu1|5&u8>fVfXJrxteA+FX$1~s+dgV@dw!3c5kP-GorXuv=eh~
ze%9>4jBI010AVtu>0Z!hEgqu?Po`r)ym7IUPDH}>=(fB5@@x`~G+^==gJI@lLx-HA
z_MvToNBSaCi5fVhk~j8;CnkeMluJ<k@Wh1S*ECS>!O`b+J~0B79WS2AzZ?7Qx>AC6
zQgbbiw$|#GT%G&_Q&)%oObi=|J+X%IAS(1v{*d+knm6K;xb8_IU}7qs+=iuCP#(Wq
za+-<qB((LlP~z$K_<2OrE)))A&!l;u+<DWCcq7cKZ>-MHp(M91_EihY-ma-<P?mmB
zxZbL+SuFyWCYfdw%Ge}-m66v{p#Fs~ETVO;QD1LbU%sZivB<;m-!he1`8<(b;)uYY
zBZgxC==lmrYZ!%+mmIH#FW1izepTH>^g+8fCRSo2S=}q+JokYlIm_9;Q`DpvzMQ_>
zU*$d>L3DmU=swvS{<f^$y0+4|?S%`IQo{ZYJOqEU=KQw13P8kXItr9=KHuSgD$@)Y
z0J-+Z{B<<g%-sv8*Kz;nBEWn%#z8`(!5}LL1iN^Yj<3bXcOxVN$Gyh)<o+^Es@qG>
z-_`D-!B^f^(QPgWb=FB8C(Zo#4aPCN-F^Ui?bh=Q0!*b`bYe@8?u&P?{~GaI-x-Z(
zp>kBuGw-hoUjKh7vvO*+KCX(Xo$7ixKOap!P3(7t2$z-YqJKAe2neA@5waCJk|XcU
zgWeU}kn?(~S}|mG>57+iLTz_rp~_QVEQqGVE7NgJeKEi7ROb5V(=GXu=g}k37R%AS
zOfhVkA};S?>2nGTVHRyr2hk&LPiT(ArhdPkI>?SPWeQG*6jNHwGu1pztkD(SW(@~q
z*zBs09UZDX5YmA&$wVUR{_?$G*F-s%UMvzdMhZu{#S!a^YG;!lJ60YduIpcHOB_V4
z32E;e6$_qFObuIVL&xq_eDKf2dtqn7Eed@l^jhOy9MT^$GPM+w!C)9})CF&V&u98x
zNz9rcgZ7H2`6W<+W5{sBbRsC~<(h=}!G&|zuyR-&p8yFHIuguy^15cBV5-v&Z_3LH
zB){Tc>G4^R;wIC2(v}RfbRd$sJ6-2#^e+PXVw2K7=RY)Bh~bkGoNxTWGgz8OB1(FH
ztvyv8>2W@VIM&h(Sj**bpbV;_Vvi@BJhc}QY+|u#vFVYqWt2oBx)2@d?MbBKM1^4s
z?BG@2<4Lt<8+Yb`J})s!OhnS<EvvV!*0X-FMsL0MlEXZ?uV4ElCGoZYEs?p;hy8O=
z7@uIq>b+5ZB(Hv{wsO-K4@h_rcKVeQ?z(!uE>o^1z<{52fVXVO$;4cd9N`pC?~9A@
z)X33=nStxPWA~7)1C94n@U8tW1$9_-Qaznm&$j1F`EuhE{X}nv0nQj!Uw=CZ1~4@3
zdW+2<ZE`!z3MAK2Q`B_@Rbb99!*86J*810HBZz;y_eZhGzIRIYT{_zBZNI;d4MZZA
z=DCZI>IZ&~9y!WGmDRw!IpoM}h6r6b^d03&^KE5(rbYmaEN1kYb;y2pO;boSKkF6X
z>+<A!3fce4Y@!og$*}AnJ}6rDdxk~@V9ucC(0x<NDCuQ5l6j_%fBZkT-Z{vUF8K4l
zJ#E`|_cW$$8`HLJ+qP}nwrykDwry@dyRpAF;*I_9)Q!3ow{B&gIw$j!`3-wrkN?be
zt^21hHGJjD-?*^xuk)=QM0`9D^6Gf4ri!OA<~(rsN&0Bd2%h{S)BGLVgI!BpLw1<;
zqJ-NtB(oC(yu_m#7h>rC_!&)`WldklY}_76+@lf}@i(&35`j~WDaJII&V44y?XlR?
ztzLRcW)L!%tD`<xv+$YnSE7GHIQ7_GG4W(2#FU2B;6A#kH|7Ja?KEP`Mac(lUs9vT
zaX9_E={KR}jWazVG9Vl-VwljfV>Qzlo>_forAQC0dsNXR?YVDn2zSv3$730qWS6PP
zda$J?NwX~LZ^E^qDG;+J|8ZSqLNZpgqDEF;rA<xOam!E+saJq$FF;_5nM4u5Mh6nR
zP}t~Hc$E|#6ntY+M(+Q{52@lLTxum_1!#rE_6|>5ZoU^qr|~7dtq=!hmQ?9{eRv;W
z+ds_0m+`d!>Ml2me&R;6+@dSJYdMwd&Vg(9$Xws_K><*7-HeqI_Rq^4PwQ}NMSP_4
zZeuc@cL|R3KqX_Ppk26iZwFQuU2{KPrH5eVo{aZ3%}9B^RtOoLul+orwzXESjA^fX
z!HX60F8HcV^ID1`nBn-i@yHwooAMewimA}GrkA+oZEbV~gEk4R#KWtkWsxi{NwsYe
zXo=}2^b*;bBg>KyKL&LK^2|?lIugyCUQH4E&5G~r!S9CHbV_F9-VW0BM@j%fgy|I`
z;Tb$(gS}|(o)2}1aP<HkOCvC!oF{+i28AJ3#k_3)G1@&v^OTn5`wz}&uk@F_z|^K8
z9{IyN`;sZ!iV?DQc0;iLc1j5x97=6*KF*9gNDmN7M;1D_4MF+3EENh-!kSQRkk*{Q
zA7Ofz6plkKrFJA0anM?1^3sLRczLDwDN5G|(_6r%Oou>4o%B?)vMU_SO^#u{KA<{@
zK*Sn<wV%pzh(xL^M)Ln6)I**mT7PqqpoP${P3VhA(<uG36jhHl!N_HkVC&XyZPr{;
zc02zsG))@!(QRZIV)wVf4hA?k5p5_ObQo+lDc*%R4f`d6quI!(nV0}gQEvJ>iMOx8
z>b+i%8^A}MH!P%X+SqSU)5If}15JCsS}jxm8WFfR%tn(NPdPE2Qb3*!=c*UHo>1d%
z&!;9mme;h3`seUvUW(D+6uYm1{I!b%@%45nOeBzHcGNlRvq#hWvMGPWpA;`wIL0aR
zy#zwn)R_YlahG!|0?5?aayPxLEW(Gf?TO#+<19j9aECSL=G&HtUvI2Oa!*G?S+iRx
zUT?4v#<?Hm`&|o?z*q>q+I#mbUT3OE;sBM}XQu7OR&!?qoLdKL5<q8^jI(A`u37b)
zxf;fhBz_Uh^ln%(fw}LR`}$GBM_=N%=Bv<ri6~XF;%t6?3z_D)7pLx<<kYp1@7_Ez
zFIKiIFI5{*rig@gn_ZD>vft{<ZQ?|7%jdO6zFHtRKs{5-{V11RN0u+`C%0*SD~C=`
zGu`SSzQ?+KkUh~MzWphwE{nur1+L@U+SNQ*<^HO{M&WMst7)t|KGEt<6`M$rcD!;-
zdv&je{-WTrV*Gfl35_QKmp3+R1v**N-L>HGxT{f7?UegH%SevMWk%QdMTicdBV^zb
z_UP)i#ncur*k@g*3$gCbM*qR*#zzMss+>2`WjXrO3YfG>Q8mMTp5rHB4%KoS0?Oiu
zvEa<0Tm1U!%PmBOBl@$T@gygnpA<w{fK(tLA=kJSBG|lN-<v_|?mL0(d&Hx-^F^cf
zt0XHT^r~^BUb&iymjQVU{8fDxDXWpa_8+~x*8{PQ-h?R0E|XOrMh06A%xc_JtPnAb
zEA%}2WINF3>#VM{`yZb>r^qL^!(}zNUJ3k;kF>T=C^aZCEwd{A@I$!@L<N0cG=P<~
zheDycaH)FKIz8|$!a&!Ui#2&KT<%@^W5UCN3Y$UEuv9!L{t&<6oai8L1beyQ5O(z=
zRh%YAWPN53%l%1M_oaNHS`Nj+HuCObqb%j#xqG}J8c5JBHX)VMJEgLAC4z!$Q_F#i
zb?a)=DMlgEWgPNV+m5@OQTL#L|IP1Ks4M=*6JKc}?0tt88}J?0n7K69&bIfR(>AvO
z10dR%45)ncGEDQz@k?K7K)<R&gVx&w$;xMbE<REs{EikWh+FY89zW!-uOwRj_`@6j
z51`Cx*d(a@KS%#Fu%qhpGg71}t%ZY=Hsz`z#Cd3WEp`bEh-fb<Kf`9_JNKV$wv|)3
z%7Rvgu0E}b_{YvCxHy@61dIB6@kNRFzn|N}{vV*MR%M2s%QnWrsD*BR?G|!xFPpSH
zI;(r4XsPZOu&qA>RhboKEoDe$;~#BM=S4c~s%nS4@6XE9mkp0dd(6J|S$C{43Da4X
zffzW`TMbV?tMzDbUTITh!-R5}5$s*Fvm@d7kM)f&%XnvJ8RN>n0ko378W*jqug`|c
z8}FgZENH6TuIf;&|J<D`Ab=`y?YVfhblDQ;W6#)iv+C}clYo&au5*sWe!6NLyG0z=
zk|Ry0>Y_y@u>6OCFU$M-3F~AzQBh*R?;Qex4Q^tpwM@{S<3M6exTgh{;wrYLJ+B4B
zJ?r<`lHm2tvmuZ-J_v>tiBC#3;swl*@1D`(Br29|{9hJere%*O3cQ~?4~U~}r?Bw2
zmcul0eFPPmOjq9pgk6AXZ;_Dt3sk(Qsdm$ux;s5|k;e4|UQ?ma0D96JVnE%Os;^E<
z^?_>s_1xxy0dnH1?=Gc|y#lSiNv9~3H@NW2_1mel6CfJ?b&e^~_E=<B@ZZ0rzHl~s
zd!jdJvM%esZl)O`w@ENeTz``str6@*RVN7CLN|HkfxKF4u6gd3e8W)%oVc_I)*`ow
zH*tz((ZN-O*~(&#?+wpr<H~kCqc>?nr(RY8HVxC_bg>P@eyn^LwO$Cvk~LYQ{8aq)
zP(Z@Fym|QK376wkbDJV_ytj<QyjmtZ2V!hn85B#B`2m#OnVRa2T^8~JtLK?NbpOaU
zGn?#T<%c%l{!84|2zEY@tWYv!N!9gFc=S%&<0xWPYuy9XkxxW5S2NR290-gEPt+<Q
zTPw7NJpxWJ<Urluh_dZI)dkJ$-51BbM|kB-^eqq6UD6jb#z>%49<ZEqIs@)-s_TDl
zx_6FT|C*wu#qZ4dVYD^<nH_GY4N}`-)b@Nh1ewDhvC|mXU~s~Dj_V#+6kB;9T-f(F
z$PVT-II4Y1#e{&oqgkKDC)4fD`y2vXwFcHtjyx*&U^FYD;4B5275?GlXzaH6iM0pT
z2hS!+v9xCyd`pkAxBRx*Xm+|$Hu7$&XEmc3ong?b#*K|B;w6-+gqVc>etnMnt+-Lm
z$c7Ntp);zawDpp<JOD=uNr8}_T(J3$;0aCl?r~mhGtPayp`B@AYV%<Ni!^SV=gB-v
zTi6qzwrkpiXj0K-IQyd8hfJ5lXBUIz5)v)kidKQP^Iieqr;dmT)?ab{NQVV%b=4hF
zwx;ay!MwHfcpIKp9FE5HTlnZ&ffzRr^h3YM;8U$)EZJC&w=k+d25=6ILnHiGN@AIf
z-G6Q^s`c*=@G@L@Afs66N7TyhP#7Q7)+(4}LS0<=cQWsG_s>15@&EXZgLm?&0c55l
zAIlfJzvrW>BkFIg(>@OUCgoGV;~$u<P5PM*56?I3=nzTKr_nHMMwW~s((azz9UQ?o
z{iJ9pIhBNO=HV^!zATkGpZ=ca_FwX@sX&`v1LgwRME7Q+e`auCcL^jVs&fy`PXsU5
zYARUT@Iw$nQqEJmwU%FOMvkufSJ(!aL*4*}3p@ZJs&S{#)-pg<1Sq;Ot;S5HTe<_A
z)!k_bSE+qImSx7FN*y^GNC+hhU7tnSp496Pq2Kp{qXX(w7bS`+pw~Op_y_v(Tt~|I
zJ(9FRE&gxq?rP=LYA9!UW<)};t$Nl4M8rwNlz<Dj7myEm&O2OAh5CKEj5;GD(8EV(
z#O8oO<t-2i31HeveTD&J4QPgu8;QG!(5sSlgv9rX798&mnQ!Us@?+~jE0JP-fGxNk
z=WBfM!$XJ)<%&erupNT|)DGkyo+z+SwVLB~%k*sd6T0jM-Ja|LnGXhSU@@vi!!=FH
z%HstY%jPm6qgQ_>iR!cLK;o9=&D=81(Syc(27W*C{lnIw2@V8Osb%civ)fy=MtSJ3
zWqIMoCW>_d^|2hz-mHZwD{2<k=?Z?iT(M&fju|S)IG~{RLwX{`_~JO~*qw80H3b6n
z<gIYwZg=_B$O8xrQM6AYl)r2Zf$-?bYdyKADLI8@#{B_+Wfs>ro{dc?j_^VX&o(&l
zdej?gi_dm$<zZG7*`rKEdbs^|;z3jZ6vNF3R%LWbhExS!z^)R#>yZPOM?IH~?yx4;
zEEpUN0RcT!g->ZQtp9AD>rd-NcYlD9h$ct0%1_}LF#QQLY|d7c7S-)EJ%sWm6%dVx
zV*o}Ba*z_WxJUG4t37+kv>htn_}fplSF=Eu6DcgHHaI8OErWUppG=%B7L`wLoTl);
zgvp!>x`8d)m4<J{F8~5LwYGosF`YMMxDhv+FYcBmgbk~&=!H1-C!U;$uyXA5?>kIY
z%yifx5LV0AUnw->mWGnXu{X}7>6I>MN%yKnuV=%ZgrcjQFf&pD-^M$DzQBo;T4x%#
zBdXC$C`Nf)JCdw*t1+i}H^Fv;M7$R7r0F_j@2rT$N7oB{h@>O$E8-2E@G_g;+@>aV
zaXY2!%6#Rg4CU4HEY?CsA5zek>6Z`o*5Uovp;k>R!~)0vTn)2zHID?==<Fd13N?x~
zz~KYBn~8s}XAOP_?61Kf$?cvt)StcO7UPN{!l{uu9^*M%S?ckkPQJ$KQL33LBmE5t
zp0J?qAGGe;y*`;rKRW34l;6?AEDQn=$+~|Gwy!*=$m4}P4x2f3!Z;|24Vr+v@PXHS
zJaI6)?isCSt+{Fzgr~Vp`S;Xp_d};K5~+*Tj!rI5pPNfcYX-eNb}6R5TD<?%s?jqc
z;kOp#C@;-$cCL}p4p*9S!AiD6?K5uPZ2nJej{_+zP)E10KNVhPn6tR63zY;w7NfpA
z{2?&x#Gqg2JvJ7&0Rmk`NM$<6?WupcK{qAxkvDG=8X4Tc2?Eat-mXYDYpwxv@2lU2
zY%(o!$xihHm#BC*>YdJvIgyE%#$!OLcb>7SbL;jr6pm-*7JC}KuYr^deqc@6)sT=j
z1;|LX1IEYJ_BuS}eOX}12cg>?Lx8Az9n@7%x9NM%)!<)<sq+9$(^XP0o1UV@O-h_>
zmGA50Nad00D;Sam?G(9tqn+@V8VVrmt$)GyGffQmLqos;qsW&O*W&A!Z|<5Rp;wc6
z@mQcvwEiGLAiI7{|G$#>r=(yTa!1Ji9-kdgLd}fb?l09d|94*DV*eyfc{C7Bj@|RN
z8;KEkUV=?H<YB#C3)d&7O!|piY7;NWn4~9Iweg>~otEzxT&pe2Hl{2={{pl)C={CD
zKdb=0t;2E^4f?p3Hwvh6-Rq#bXWd=N)LSxIH9&6xda{(DHA(WPp8%8$J_v?hb<<de
zzp%@GFRN=${g{G#jpH3;KOef#cckXfwVu(i(ow=AhRWI-16pFEfWfK6^!Yd<!Cngu
zg?;~up6Vh@!!hwZ1#h(?OtP*C4p>ND0&?{curCk5N^LO9S3GRw7l1ZvPzG}reAmxU
z^}?4jB93NUgWpZLj2W29z1VrsprCJLCuBmx>OY6Nb2dt^)Im#n`f;f8=1xMX)h^B@
zF7V@ul}^mGU+FF*t#pkpm8pGk)BibD6-)dRm4<y5laYqKRu@$kJz@#XPs`$~j^8}#
zOE0-SobukH>ADt8@w??)YQj|)tQGakyf$JcUlM^2qKt5+G2K_Knj?7VtVbqkJjp>d
zz^W>d?a;v}LZo>@S>tkf`F$p~^D`6{yiSEuAOnU_;AoJbMgZN`a!iiH;E{dR+mAnc
zPMqxm|A))!YDWJ4t8dTcxkjHItuH|cVEZ3%OHf_P<N|7t82?U91n~b6Unh_fMI%XB
z3Fd;Tvn!7R<57Qp)W+@d<z_(CcQQp6W;Q5LrZ#8{e-Qvs7w(w{@bx{p1N$98pO-SI
z%w!7(iG*Wz(HbX*@)Vk8sxS;{56Dw(TwiinK&RPLA9?a60J<JXER($ryQyBKdpfit
z`XfpYF?{Q;mg@l*)i14}T<jQzLk6?OsIg%YPEt>)bxxepDS(dJPblxy;N$k)p#lWZ
z!AxKPuglJ`d*y&2a^6&L0kmBm44}DK|NcQDWpt=t*tS*AM7DbeY?VFI6C~iW*4bdl
z01_~aIkO$|(?HUKL-yVjOa$JeR~2AI<@o}lS*?F2fD#7bY`vo}4|}ZJhOO0wI<q6T
zq5?Vj@@bPv3j~qR^wP-c-mw#-S@gVQ%@1451C#Ts^M+O$14uUqC_}q9lCIOW(ww8l
zIs1p*JFUwvv>BBpJK=@>#I1cLrjDtz7jLtKfns}tj|L(jKmotMJtsan4wEzk>}<nv
z=uUB5P?WyMDFwta-iX*(YWc~?D0;EvA84xuJ_K<Nm77u(Dl=49%BXW!H$EECP?!Y`
z&nGo5D-F;2%h;8J0GhRjV`O&6v{RcpM5uI*Tb+gogctc$ISdrBKOAs~5KzF#b#1tW
zf|Ld#qk0q#gH<^_=Ycn~Y76+Lp~f2|eww2Zdb;bz;(mSMrsXqWuf}5*c4?`7R>}Nl
z^+vDd)t!XGY5`>nJJ}&7+f}aA&-?V%k4-5g3~gF^BIQFO_TEb0nk9n<=PBowrH+fC
zR(2=rK%1GrDZrltd2b%=R4pr&$6L!~l;x=2r^+uLXRznfdXVbY?T8?%Q|c<Jl}aB+
zXJEvD!ar~O_W^tjwT76@B!XGPKjsdU_YjwGtIL(C%k>*AiJ1u+Wz|F2PtSiH@s}?#
zP#1*!U?L1a_y0j9X#sQ5pbN`0inX|Do&bjDrpGhX_L$SLTg9;JB(Uq$ISrxsU$?Yc
zk}KW>_QSTU#n?kv;=_9ivwA7<a6Njvk9^dHYH=WBmBHwAQBR?|;rQsGP&*aG*dxV&
z^t$v)e2;0R#n?SRvC^Pgeh<8w;zYE6k<ZIE*gIhGAlEnz<kj4E<(<u3Uh(@t^Q;3w
z`m`JnE`>f!P?%=IkI)2B06cBJ!ctLErh)lt6}+yht@)$S!Q6>13232e7Y3x^B^hWH
z0v&yu>A98HSPgSWMrA|oUU-@jok4Wx9H^IQe>Rl1I~tWaV1TQnZtp`720zxV-i81~
zLzQ>rQQ$v&QP!&OKwmRkPNJf6PPf~MG^btY1bKm50@q@qg2+OAK&ZTks3_3+`YFZ!
zD2PJ*vH48GvD&a%vjSLtiT^d@dCGFz#uq0b9J?@N&6~bHz=2Df?0DStIPPY(K~ti=
zo7|?_yEV2Ijn!zC&5#-5Mrb$QOHzY|QqTKxB(=UvB7DZ8&6q9JIuxUbzT%c^q{A|K
zG+l>|M(NGfvLL`czNgW<Qbyq;9Bp$}6Qn3#MDP=yE-nG{9UqF;(6=&FGOS%&Hv|3X
zLfnZ0*t~S`i-b)F{KBIm)BcCU3L=u+R**q8FGF13epIo#LMx%dydt(zL)|QJ$<@rV
z)be`)QIi7-H%f1cA6S<@7dzHp5Oc|xs!sDCPq|pyXSb1aM8%)DxSj*DtuKJW@=kNv
z+fx+jty+l9@ow7b2_vperJz66mNz`EB_Y3mAV=UzLL?>W(696l_tQKq>zg!=wG#NE
zR=!9eM_<l6mc%Xr;Z=F+Tnr*?hQfK8PGVuTsR;UEM|(tMhH$v_K`<GCJ~di*&J<$n
z;|K+ebt?)b&*Tmien+yE7L&Dy>Vjius@8h0_mzIQ(b2Nn6$_zaGzM@AiquM+EMIZ}
z=~+SJU?>di0i3M7F^@$5N-x^zXoX%)S(}5cM1plsS?V$<I_v(zO@~^7^KiwdodfzF
zq-A1mQZA4L7&bc_uq!T;Zw9g$i}4Hqum%dp#3bybg(jPXe|kj>!vTn;M^o$Y2W8h-
z0iqqKb8$Vq&FWpO7=d~ZZY!Zi#|&@CEd!ro#SOa75t%phbi-rE`QY5?@<wfMk#l{u
z`0IhTPiF98IG8;=Ue&6pSoZf~5kgkbpmq7r<hBJ|IN-rf<e_@)GQgF<F{rAB-h^L|
zYB8tU92~j6DRz~gU+HBui>>`xNG^Z)3F6_*zgn6N;^BVelAC$){3uri*f*ZuCJ2d$
z=syb?;<<3sEycIK7Ri^ZjKZKI3V7VIUdGbcZe7Ul@Muo_F+bPJQdcF14Frs|x&YwV
zG`X&742L?c$m;TzIQE|U6{x01)gSGE$_Yo|I<^Ag9B*6hka#eRGrv(MBa;->geoC>
zBYwp=hIg-t3p5oSCxq9kh#3GIO?753I81X-s9Y2RA}P0{WUTErC!3ID<WFib5mhEJ
zu;*P>9TJOY7w7hJ%C+N;)C;pHJEl|qDHvrAfw&i!S*uOx_dMxPp)^lZVb7SB)}%0p
z{1$hbvEJWjgtJMLV#}$`C1ApTcGLwQ913E`v>(dOOZJ44EvHhO3(cip+5&9I1SJ@2
z^3`WRnPBF<bGR_$>j(_4tG%kfxXT`7?QVGuH!6)P`~}tNcR*CYUdirhPxXKc+L1Qp
z*B2C-xi~$PciQs9espOC2@OHIFZ@ojQawuNE!tW9Oh^22BfJc#HeO-AF2huK_$uM-
zKutFR(o7OE*7C0X;9}CXo`;2R$H<~=KxL#(^k{xtAftJO*P^m*2K>?iNPHd;(8Rx!
zG&SXDw(gN?y`}J|F0lKF@4-;g5cYsH#_v*EUeETyvd_RahC_M?f`EP5(5{uQa1TZd
z<~*tGgl2eL-AIyIN7nIEtQ5cjG)LYMc{Y1dGP*s09_1}Kt0Qd(h$}GGos`jWEaYAG
zM}cLi^NhM&h#xVmWvpyr?W)m|6xhh2B%(YzEk6n@H^Av8JqrqY1cHFxeVa#s(j%UR
z6hWESQfZr@mI4SGWJ|Is#D`tkTdzh{b!8X~QI{59!kWg*K}o%+rZ({lh0>hAKOWU@
z?SCk&AfiV<g{{rg|IQ`;TC!G90bxVFC#}ZOgktN<B5P4G;?C{NG@LA>b8E(};a|CX
z`kZQKX~h1I5q(ZxBrE9<5&L`&9dlBM@dND~nf|*k0D(lhx|E23)nNBj2D0>^vsUh0
z=t~0RT2^>47wll@2*~vbrWWVT=Iqx?{+^u*v0@xg{cCTt@i``0Gr`x39=HCTK5a>2
zTkPfaTi7B1E|SWSsr-6cRv@nX%>&5lw;%W6l{ux#BftP|8ojp%JpK2C_x>g#uBwm{
z&piy;#b)F`bc;5skR1`~9ls^%qwl3I*tLex9{Do3S+oE^H{A1`CkuXe*K9RM4mCHp
z$&-tccXLV<^?lz49ZF_jCiipon5oU~6sT*#$8pu6ED-x{Y8%X$NUyKKvTrcPfmZS{
z$3qCREk$+o^A3|GbQ)qx!<lhorD8A8<>nc8v0`H`J-Er;&N|LeSSympGx?n}jiXY+
zBPf^h3TvP!E%$c}Twh>ua(DSy0Uvx3)kVc1Y&N**z0CD65zae!!xAv<iHh5m#lp?1
z$x2!jrNfQDfH_fYZ<j!<fh<L=uLCHWyL8q9O@jy|z;%6@OdC=|HWRhH$O3l8xU(AS
zqa&X<Vl*6a1?R_H%*BR|K$x(D>wpO+26tiX@HEKP3X0*BrVwA?E;4ji^(|dty)BvH
zF{IXkIWi|IgQ6<KVe~t-WD|-#aX2FeOzd8$qqULO9^}US`|+q~wUzLHtcK-?KqLZe
z6M>-Ot9*1tyP(><IZmtxDU>~V5cW1(C#d={jrNI7o`Q=PM}dR*8ip2SnZFrnC`njO
zc>Lm-y#ZQSz=FtUiZ~){hG=&gXPQqwda*l>Adj|>1$SaxUurJys5m)p<0Iht8-MfC
zfQ3FY@kDRCdFfJ7;kOP9*$$}kGd>|L3bIvrn>GtbPTzK<$=ajd1)n|~vI1!Pt%mFN
zavD#LLb*d>DIgK4Ihw={Tu1-1gWDF9%3@!NA>Y-Bo&tQ_ga8ydN9C52k}N*SR|I!u
zHcV3;OO>_!uL@bbcN!DssAGEgpqTzao~1Ua{j%d9S<iHpXA=SA`g#K)t3a;~iFBqJ
zC9huJC=EJWj^wGKB}TedgGmKlh1w5+O-IuB8A1n)>`T9{jtUK++P;zoTRJFGI1GA-
zajwcTPq-eDAR*lo$x$A-Y0z<s%5JbN-)&Zd9T@6Y98PH>VeoG_RQYnCWl$GOuxDWe
zTg@Q2tn06O3P^N@-U>uajl8MTKqTMs{-!~Oqk=DfA=VEYI8Au|{Rl{{ST~T6E1a3J
zTrKccMq3*Ifbfz&7lOU6Ri0q)ENcW=Bk~l+3x??2^jfLkM-123tYOy{!%PIku~Ol?
zY|J0*<BRjHCrGEeugAo;0nmul9li2O9xptzonHCppw7Qr&)5)eghhYl7~`98Eo-C<
zBoTqF-7jo#P0VhgFSLP`o(x4tdN>YcrFDQ1i&q=iraug#lMX~jW+1wPVsCe@UOsP0
zpKI%p-<3o@oX~-<hR_!>PU(n8#TOrqj~;$uOK_MAXS8ali<y5ngl9VRwd2BoVvoDz
z>m*qq%b!H|#n3Pacv@CSPpXjp99m;G6E*NeeW0OsIccV#HqTTMCPp{%6pRCt>bH<C
zqhnA3MTj8h?RZD(NqB}voIcWV-D4Uv2+>WJBL)KoE*Aj);k#ly#Lvj|8r)Ezs3uBB
z4H<LLwZkYKr8&2DBs^N>-yrO6T+@pc{#(rO_;c+gk}LW{<;N!e?uxat$}bkACn|dS
zk@!|UI0471X~$v554;fg_W^uWuiW%3>SRMIL`^jerNT+?9)^xrF;l678aG46TeaF~
zSj>QBE?XMRArPJ@dLon!nvXaNZac|X*%sW)X+??rQte3Een)-G1$~fBT@WeY*@QjS
zZdom8eNQs<x}Y;Qe`^l3!c@iliG&BA7qsiyNoHv!H*qPSAxBR{+&iXy&Q!QUAY=)B
zc2p(seuve;m2hi@>|&rBS@IjX^VUUwiLA%UsbXv>vQqQ~s2%9*JI&e&$G$<P^XbM@
z5I|>iDYAH+`eIjRIA;UaWww$32mmmrG+*deeFn~cd=n1YFuXH#%!i5aihpE@`WPl9
z2b-^G+3Dw!)3>9rqOiH3l}s}n1q4l^Gn5J2s=8Venf9{h;>m%fFdRVD{}ot&k?H~T
z$14W2;AYZv6ewR*9%gUwwa|nB@ZbgKMfJg8hFyHY+%qtm7!~s)R|t*44Hk)a{5`an
zg^H$l=;{Wxmhx?L0|Em^<lQ?tK~$YwFoporIPkPdQCeUG?ZvRA9mYPR_u){47cq#j
zA-kORy=d6iDVci5tc@4;B}ktM^j9o;cuSq;aaq?(F9vlVn>osIve(0b-Wny_Iwpk^
z*q01F1es4zGfULgo7h`HR};SxBofp`G<q|-jjVG6`q~i)6r)K@s<+C%`eBvAJOG`H
zAIw*9jiypHBH&*Z+XU*)JE`d#DUUlY{e2$8zr8JU#6?)V-rzGl=Ai%VdCRT#)t!n5
z%P&RJDv@IRtsf1g*`H3!!WHeQeUf6(E%zD%1|$>=G30hXy8gN<w2%r%SW>^19@FN<
z;C%HrVYP8gRZk@$*{|(4__50!q?iRI-f(ikSjLAiiam>Cl_ept`z`A-vLG6Yi@Lpi
zrGKr2Tz6I6t_cGgf;aQ7d=agly=Y+CivRQOPfayY+n`Gj1U*&HICaf@fv)iZ4540(
zl?vmbG<U02Q%C=nH}2t0+w>%9B)ePYs!w~NRvk%);&<sStd0d9Ceq~cW%eN)I}>(+
zL?RK3y#WwBkF-0ny;2G!CV6k~dj-}AcoY@pb=aB*S)JD%E3qlW09xWf@ju7H(j*bS
zFg;Vr1Fj58sOTMH>xV8#Uyeyv6ykX$<ra||Gs16lW|w!xv)*M^{{Ads_YqmMb4UO1
z_a_8){NZ6})-@L^5`x|*Ug7roAaO6$6C2vlseMAF&Iw~pCX}WsD|Byd?u%Euk?4zz
za%u(|!J@b{=Nein6dprniNTY!qWG8{0cCw6itr#h;gM_4zoe^WG|ko0fl1kK&^qdA
zyD#0Bd#DIO<_D%52Q71(Rk(rcKe-xxhesrhDT&JN{YyTTII{94qkE7-up1`e1}-WR
zG?@UpY};&oB@?WWg2z0D#~X&{RT#3*47DBY-y?9gvj~97j@q?{Zb&A))02&Z`Qzhv
zY{544G!E5icPm~$ZBQN+thEbi*$s6ymisPr8tya_7zSY+=Y@RV(--$K;*-u3?)_*>
zMl7o0corr11jwBjNb9LH{}Vp8Z(2akuprKONZ<U0jPXh;=Grgs_}bGPWy&f1=wm3h
z3oVJqJ%+~`hKEi^?V8|7(G`0>PJ!_n5`?);@Um1Z+9DhDvPV9_6wmVWAPM-xFOf*j
zC4UC~KkK{y{mK7t;5y&ypGQg~mY#TXz;7(s5RdkAmT?*gWrL*ayxy_z+r49W&>bRg
zLbm=ci4RC>WvL0}>yL@VO38_~Z-!Ln#PPPwCRz<GcU!rSW~WDH<X{^t;3>-`Ii_5z
z)zlLR=^tV4GvbM`SX7L)*Y70gf;NM4x}tfJlNNc|gob*tE#{k^aF}#or%p?lU{d~F
z$llJryNciQ{E~wpjQnV$sX~7@gmM2(v-A@_8UcqNCqIv=W}3+UJF7TLUa#zZ_$_rD
z?b%m${jSI5q(Ln1_AMR)13bK!gm=>tAQv@=t$GVh%MEkvBy0M})QuZ_h;Lw1eZqbg
z*p{<HiM;iGw{^X+4Lqa$vTtPhg~40G(>|kh!UhQ~cr!$lIqD(iR#|SsF<8C#d}w+s
z&A5~!!-^mfzW4kGV>S1TouSd<+J-i5^j}(3`S};!wAF~$$9+$V0u*dIv<+yO6$0df
z5?Ium`}3n_G=lzUXXj-Cp?AHyF*JX6Pz?_tJ4n<SqftTX_wM`yU)+=o;<I`wtll}a
z#ejU+f#L+b(SXXtz|!bI@`QWOGzg23u#K_cik`)RUXo9H3k?lUnR3o}4(0b@?Q6X>
zu~~<GF@;O<HJ01=E{YcY`X>cGOI5!+Hte#u<#Wxr2*wQ$_6CU4U6sgM)SWHxrBoY-
zI(i(6>&kL642gFYrGC}v+iJ+0YT=rBeKqyVfhwUv!s%kmutG$X-57kByyYd&3etl;
zy1iwQ`Sivja|iPfSIsdMm{|z?lanIu4OA<+^crV%7_?H^?~jZ7n+lvM4AJ$HZS$A)
zZk9Pn+^4@viLiW(RU>cTA2#c*N~IG2ZqIhf9D*sRH4*bEG(^kInaZ=P)fC{Qi~lbR
z5E@%5Vm14BeJtuL?4(paNF>MdZCBTgGz=x2@S2s!lSZ)!N~(2nuOv-+t4W3<G3#=&
z3s<RJnGst-{}8p9YO+BoPs`MBeA;*teM)*Ls9Z5`Ifgln^KV{hk&Jpl1r`m3P|DrK
zQIoAjMFnKuZza=%+v1!k`8D~bx|$(kXi1WbI<y&CyN1fQl0&qMJLbEgKl3byJ~fs@
z)vCnU7ms{7yZAUNfg9Q;T#r?^i!R0L%y2^gj2~5q>k_vqnm2XB<L<tI19MT&ZnYgu
zZ>f2(LH3zHYVj(b_Jh$l_66rMOc`*fh6%2jrqLIR@ehM#T}C_S*2Xpxa(?aQ*r=IA
zW`)yGA#~%BtLUGCFv%*;I5*H`YR1s$C4sfr1jg_T-9AEmLvBY2Gm`=bInV4JxJN#g
zdas<-APwdS)`NF{L2TmS$&b{On>?L7cL{29$_WAZmQIo`$(6a39BofCZ6egW*p36V
z$S>X+z0M8wRzXTEv0yUWEH^*sbavF4ZzqaIL_5Ad^J5IQinKC%zAwj<_S^Q#q50bz
z*K7ZoICqP|d2(9JDR~X#H5_@>)kH~+JURR^6JoC+m@y`CC*aCx_+_wPI(WHl;&o%Q
z3Qi!Uc5E+{Y}fy+UJc8Cp7AfZ2x%_S3m{z9I+_sZT+rn~cX>2_#hXT}LxjpGzw5m)
z1r?>IC9n2qbPO8btHmv$E6Uzfj16nB$@N!s`3{W!G_u&Uq&82B(u*43Bk=fwa+#$u
zgE&bR9h}KwY-4D9*Ln{b|D6;u`#_5bV0oFQtc8zXher?1<4T2475)P+raI<Z{@gx(
z{?TS;m$uKfiy`G&P0BI)_AC6uFa7dhur+?a$t=qI7|e-$wP=nSfgjNP@zpIrN5x~|
z@zaghW?3kU`Sx&t1@CO0g7JGqt6kqCqwkMvXLm8>r{f~)@|m%qK$PPYI46HtU?V?h
zB>dJ>k-^y5<ZDHnv4LmtH;z6d%h`eh4iI0%Cpwc3V{oQwl{%{6uQ&Ip%uNy@Om4@#
zVzliY1ET>nmaNV6@}N%R6R0~&EkYV51}glf`q%g`&zBj>2^%>Y(f7_Lh0yf~xog}W
z3o^o-MiG_%FHJ_R;bp6TN4`(upxE6r(ncts+Bcr3A;#km=lI#E7CO+PEL3r|BkEj&
zRl$NX#n1d-y@JW8cn~Te9H?_Zxw-{FmUwAfelk95RN+0^T1DiCpCNrvkFGUz2N)}u
zV#DtiabI*^Yg5&bN4ybxjIIvI_7=$F58|mUc$ZQuY1%Fuvlw?A#$d!B5Y9(LwXh<v
z{S546A7D;K0j(i>9dpkts%r3_kAwnFFAms?-l<GDR4A$Skfevtzc=Wdk+dyzxb1c;
zg6LgMD3_*((f=6qGZ^wBaq^2#*K}QsyK8hU86(<X4xm8+ayN5U(`826PGKcIG%LUF
z*XJP#NfCW;$H<hPO-Hf1+{FaN&Wh19R+p@){0X$i?_c+E#5LxsBE`vc*D$jSX|Acs
z4xsNXrSrjmHYccnHIs2Q0cq}Qy*_XFJddim;M~V4^8x*^M8_2TL&1_{mxUz7(UQB`
z!%7)9;3h|S=@K-etD>^r=L0<|H5pO@{VdTrKip;!o*i~|Z9kK6_txTOD<8ELEVa;W
zVuT<GHLJZ(*@kB^)4RBaU+ez3-6BivbArXt9eDh6<!}`qN@`^Whs56I74kvDU+b<D
zNwei1Xr?mHJxX~UBDMcSfLVGC?xSS?z2?&QIWqgm?y7_*f0ZcZmGCwyspcyVEq>;e
z+x8%|v9<TB3Gxx?S*@)8X~!w&I9U*a12k6LkDuq2Z{mFwsm)J4&J@l<>#VIOAA-IH
z_6R7U|5~TCm_s&WYg6kie=H}hx>^k)B&fk`_vg|$mKPwN$aoK`5RmaQt)TwipP30N
zhjV2%6n-gWZf7{2@pn80+q~!;M+Y_P+Y(jGQ|X~msKj_zXQ@{^ho0fDFfQGpMlM%U
zubo&P^--nK;mC5%^$jtDpAI+-&;K|c9pEv!7;JOeyy`1+GFF+-n>ZZM@u-~UaUZRy
z;b<24RFe(+<K4f@s`qZ|)Is-375MEN{Wz990|=}cVe*mlsk{+_KJK`X`T*Odnr*hv
zBEIhr&#AKlYgXP0Sa>4+ISabm=ukf96hbFP?#f7oyF>rkJ+Nl@10F%!C?)FVAEzk?
z*6uld3utM`%x%S4T2NGklo@rS8NGEWIMI<+_yRB>$Khh6$37>6D=+2!tPlpT_#%{>
z*XL!VS;+&YMhk21d#m+~LHDa4h~;)WP--2aqzqM|-w_jAg&ZqbUrJ3Ofogh`F*mQ3
zK{3^2x8iY%ai87uFbwzmp6%1SXE%blX-@>Km(7)306C+gqAoylVAS}kNdUWliM0au
z9w{s!dShdpHB*Z9l+P%Wpb0yYe2vH#eL1;=ayyTy;*j{OtWi&tOMETPoG#OB*3a4T
z7eEj#r*jL%Vc{cVEIMFiNsCexUt$<QCXdjkvps%TcFhCea5mB4mFj2%!ivuk&8z3T
zBl|ls*JwjGgpjCtoX_fj>9Q4OL{S6e$cMc)lp??8_bW7bLsLJJ{#iMql9bbytZLPq
z%dSxqh@t#YrCyiY<-wsk5E!uD{I?=5G6kOkc#L~O`0@aHa1bK=?wfC^FOBmSQpJ>-
ziWw|&Bx)wA&McSv#QEF66PR*M?2h)v{Lk8-REDj+>aRf~l<?SP7&Cq;s1u1<e|<-z
zwkV3$2LlbbLaj}JuS!CH#75iH-czEQxlUAt8<nb@=L?6F$5fXOe24KDg9$bi-`wNF
zv1p0#nZ%!lEb@1smv9SF-gK1H=+Er8+h@=+7r4UMvG>k1-gn_+XC5ZL@cBl>?=5d1
zZ~o%8P3U^voPd!Je;|M$Ym-XS7YmJn>GmQ8w=RPS-n3dRr_DYhgISJ4Ou55)wiCdI
zv8UaXkG|{Z<yrAexihhGU)c$o3-xN(kqnoBRS82>R(pKQcq7EGVVL8EQqEP<YaM(P
zQA&kP9a4;>6xIlN+1onwgO;@q0PxhF3kEJW$#y!wh|fxg6&d50r7M5E>+Cf`MF3gM
zw~lAN(`1<8arS;-Wrq!k(GxmTORc7xIf__F=D}WacX=|v=uIr)t|PrnAT?q^!dq?5
z^8&Q?#GFfLVVh4~85EZxYp!vckR7Jpi(5F7n({k1z8)~T#E8-vn<+%yxa6B5x;Gme
zG9p2GR5~##nkJ`#v){v?q76ShAAd`iVO^B645T4?nelRB*pIb&6>EJX!cs!F0+-Zk
z1yI_k(D|16YH}F9?L)|IZz=^2f3C^_pXjO}z=m;*S*=bTr{kGbQwQ(sHe3A}pG(jO
z<P)-+w3YU}5M{Ma(iWt553yJa)G_rIyl|j56mfmmD=xUz$Ii2ef;+FI*K^wYFl4qH
zIvs+oH0rBI7j^+tVi91;C-#n5?Jz)P&z@BbONgvMEve3?Lxm3=)X-Hq9z?UXc3&)K
z9O)^U85+!b(FHdPOZv2~`+>Q_ve5LO72c8GKe<}KxW5Fj?2MaLejw9h0b<?sr(qr}
z0Bt~V$8md6eo=Cs$j~Y~iLK9hiBUI|ywzXf6H1X=t{7X_0R(?2fV87R7gXDjStao?
ztZH4^+ml?{lxO;eBR#B8Hjr&%gg99dnDeRda0Caos?(93!ytv#5%_X~PC8z}!`OW}
zQIe*6dPmJnlfqNJ2f?#!pOeVg-&%m;ZRrXsHQOCgg0$#rDZi$H;19_4o>_1>p$vQ;
z%)S2r_p4kJc=N(>1@X`5I>FdiZI=k^&5EWT`==c31lLtUH&`KgQ}IrSj6(Ih(<&w1
zZd9LR0djFN9B+i5wk+6hPQLmvwkI;a+MRwQD)@7N{$?>Y1^SHIKB55-Sg6CMOmpkN
zI}E3}_;i-%88Ki)<(~^NI!a;ges2wKu=aRd#>nw%Qr4L<T3rE#rtp_U!`IAc1{>Nc
z9w!^DGRhJJQ22UMvf(tbFilXH831XLxzHFneF@~8!&<y9Z}#DD+Da<C43nD{bu5#r
z+m$Snk|b!wDBZCIS{m|`koG0=xk-tW&7MT|bZ1om$SdP(of8!_ilszRz9$Y(2Oq8}
zasW4Rp4r1lWM(cL55!CBaIfgC*pze#6q|DL=}$188^0A8fQ^2>5_6_3sXk}@MPl_Q
zMFmC}fV&uQdL<N1eb~eWSa~w`kSTmM{2I3V1wUTmQ4~VxCfPjmS3PZPd!ygX@+4S>
zF>AX(+RJ+UU$RkmFfqm-ni{C%i2Km6f`jQ%bi3RX`mh=1dF?EUA-nv2$z?V(eDu=i
zn<8#bBl6~FrgW)8n=67&&VRM=>ztvSZLw6d8t53frZIfwx;>QQf-QJcY(oxl8M8a=
z#h)1VCn{Tp%G$e1lt1&{>Ce1p>|_)bm6)}1wQu%mboHjKPmnmDP``k1uJeg-v|5Q;
zsj+B&^m>I-($C1Q@io6SeJBOBB&lrQ(P+Zo;MHSZr{~YLyZzuM3Hy}AW!$yp+Tpd)
zD-#|8**gm6v;J``SKqj=7U4agOpyp|;`)efd0byhuwaQWHk$Dsztqq)6W?N0^G8Y(
za|n1R!fDLNFOkGj<{c5B@u`iNmaqYtXoBBja_MBJB9U)>@3PHm@91hr5D=OOOV2eW
zPZxKVjY!!ByT3K6*I&{d#VqXby_nQw8hB`gitJ<kB?Yg!9@o7K_KUM461F<ET4)y4
zRiaewzhw(+{iFY>SR|zNQ$fgh{?~7@?$QxeVGUk)6Be6sTK42X*5VhLx8tQ6xy<^u
z5$vwgLLGYpr@a+@)P1zKrm(-bjmj0+b~5g0@hbmKkH%?x_KWYV8(*9wg}}%wQ(nVA
zDrWa{0q7PF#!Y!Fr+gl*^C+&r0EK);zgEC#QS3w6a~d^O`q3&;wOXvN@)+#hdX%XI
zW|kr?rHS-nn)HLArWxodx`%PEh_Dev@IT{Nm9<fzywsi~L<_Tyoyi8eU^hMDE8`k|
z(xO5#fMjz_iC3fhZ)@@)5Fp&ND+8lwto?e0KybdiLy*;suChr8>vP`0VtPhTi1+IG
zmm#!#(il1wv}+18@ebGcMW5DABns?#{?An&{*5r3Hll#g$?3cu27C`c3>e+bQ!v4_
z=?2>m=;~1jTN0~;ve7W}JEZ;0Nv$mvWxX@xvs`<HMiUR25~EYkJ!$QUzHaV?TGUHR
zlkR|fRb?H4q{v#-%DP-;RFn|n^SGTz^kPC1Or0w~IDp^pck6S#MN`KG-D^ma1A&Qw
zF-*C`PwHpd7b6Z!`Px$%3@*BM{3Ve6q#A@0@cqzfScDdIA2T`&>hwXqF&l`C(3lau
zNvu$}FNiZJbU0p3{(lFD|Db3(ZFl}?{t5O#7=|0HiK2JnvBm@ddus)6Qfsd7cWM8F
zIbTQTl>ti$-Hry}oha<u7-p+>0bt9?5-c#jxUbj|(wuu|$>=r(1cDlNyxjHN1uNe$
z!jj-aOA<}bBK<2UK-67AI-tlKV&PuE_?@xbdsF?IJb(yt*T#rkAFTxzbw|`-t|C~T
z*pxM|*UbYf2}+OaGasfn*R34@y(=CZ0AWnw@v8`Do76qDOO$!m-#LPef57k8u~GTG
z*4F@i4%28=k1e3FK341fE!y8tLeZ<wKvQ%7bTYm#DxF1>Y1=aCxj&HBt4i*9YaFv&
z_yfR0+jrUy`ky1<n!JYgC;fSmqVh$-Oi8oi<X85p4$rrN_>f#Wna#(?D@X@7M)$6o
zAdD+*q_Lewlfq1yZft)^_9=SzEL+s)xqR&un|<$fa674yJKL7rX|aiKoCXL@o>w%|
z6y@egk|%ebOUP~QtJ!eI-*nOcZXQp@#{-Sy0%$C!A7>_$Tp!y%{K!d;9cXbfW=nh8
z^W^5H2hTa8J#Xt*&jJAD>-9kU*DSbLGWk|euZ++VJ@LIICABhL;;dG}SzWd+^z$ea
zI@@v+;5M*1NbofXYn$0JG`|4vvTJB0S46v#r_n`+ZJICn^;fDA;g#Pc#lqlUlbHHW
zl%i07?#oVZFr_&+4-}*kw6KdM1trGv1CdB=V85tK#r3oxHD)WTD{JGd6vBbRHV2cU
zHBAr>(h!>kw5VI{OMGOfc)e^s^GvTkr$F4ElCg<-sekYIS-sAUFP)RWJZQ;($k3wD
zbn@bpPP`I(uYd==a`lc%>1lTj;{Fj|d}9oGd{SrSwzSUq!-b&TVJ1ygTDh*dQ0BKS
z1MHjVqqJabB3uE)hj%io3CVQx%GsV50}G%vws|YTH_D!>sGT9}b&zrWX)}xA(v$Qd
z%792*W95;v%6&3;IA?%v(FpLKZmTPKJbpSnEP!ZF7AL_uyV$_+ouJL*oVMz8q{hCs
z_1b`q2ELSg<Ei3rxNAy8)A+@+x%?Cajny2`wZB`4_@hLF=fBTGu~R_%h8oadgK0P8
zY|3~CHOD;CunLl>)@ZGS2nYvTm5W_%oa)z;{*q*Fi8K~j5<1MLw!{3e>up^(1Gl+l
z>2Chys0FCBUk*y-pv)?1O@XTAzV}~i;^^D>w6$E=V(PuCGuN|+1#&O#VgBZt7<?QU
z3)}qYHT%o@(-Vyp^VEcs=(^VKmL;FKSB~e<YIQL0?|VXV!y)|b8p&5Lzc##VN$3T3
zvjYD3Da_b0A+#>pLveWjkKEgx`LE0)g~L0{uGHl3R9ZCNaZNQK8adp9AERqsG*s)k
z{X60Ov3ehvI(5M{#xZULlndxLK^X<>67%S=6UGGi{Xp$hW<JC?_u|7z<CH7u<5D8b
z-qFe^HzjC^%xsqI?Rxv<O>aomhJjVOQJ__2xe)ROapi*q#Qt}-XY!9-s7^4+Utu2i
z892xz1N7(%JtC)Dd!J(~T%b0A`bTB;ylsenz%6rBFjISV*BJI|26Du$4YFxfHKt5f
zFowG#QZp0k7ppN796JzC<h##dt_{Fj?9kbQlgxk{JJ51xTNGD2rh_zBGahRUfUXQy
zv()byKeyB#3}+>22v$_(xU8YrvJ;a4otB;HzLG}bEv%4rk6J2V+xFvE)Mnpygu7wY
zo8Ot%2K}BW_YjVi`!>y`)qO80YaUxMaM7`-Adi~G2{zRm6-t6<X%TM42MsC?fAd+H
zCN#0zfz%LvXxtCe_ye-tZW9Wo4bXAcZY6?RTFp3nhNUKE3;i<k$5)u=jBv1;O)m<&
z+U;Jm4Jj~Mc^J>DN;;_q#T$s1@u`n634%&`FcwK_KO=fbG0f>1B&7e^;GZ0lB(Q@%
zyE!=-_NE?!d!JnY4Z~Xf=tAque4H{Z$Zq{D`X#-PMry=c(sEZEZu5K4)})6yOWU};
zGvUvJvHP@<FzT72+F~_AP}!2s7<hymvWEC8D|p!P-hL&ISX3@WIH1<$hX9LmcJO_p
z*3r!3oV#j_!DcdP6+l)6RRw)v>JIItA3R$TjdjR8HszoT%m>sa>YziFd72wzYRQ<C
z&fI_=Qk|zm(2jsCM=NG^h5YTkrNE75{l!Faet^1U*mX9Jg^enTKvN3mu#((m=8^F}
z_!HVWgIC<)Gx0fTvH6E#Wy;C9HXS^OH-A%U6%)+F2m0V}7vz0jBm66ewE0mP1e8+J
z=R@=C0)gsr^&n5HrV%3CbdJ$_nyhN3ws)J?!Lbm)cSP+1WKVSO<Id~7H~6Bqjm8f5
zyxqChwTDTiDYCUbGt|RFZndt&VX1bXldUi+G<v?h&<ESD<zrT1<rA7ml?(f$itHy7
zGmDZ6lcN7O$pO>oxW@9NSM++4BOZz!_!vlA!DAGIo~6FY!yvoi3jW_3TldpldWi<(
zjIra8J9~Fq`Opw{-k5k^`Ac$66VQcGQc7<*e%cI8=Dqr`FnG(5PfMG7*XC+~6ffrB
zuVTl!Ya;dH3J$-?ZL6{A;DA#9XKnGA`G5W0Xwm;?RpS_(o@PWO=a|G9Ckl(fr&Ou1
zsXjkVU?PpE^(q}88RCX4=u&CjlxiyONVX%E^p@m-y#{+Q>C-6=7xW8?UA_jXUzYGk
zx>Lo;FWx~D4!lJgg_x{?F>!>hc}CxD#oTS>CtY!i0uav1sn;yBzqb!MqE4x)+Q0aq
zP}W&eW>8kG?fy-%3vnD>O)CaFlGRmmif%g=sGN1hEi*D2pvMmc2Fxd@h-0*41)i8I
zCN#nO$V9}}cxwKoXqU#h#!m3~(B)w`&eiXGF2{!Mb}bWFe#b+A7Er8b4W9W1iml}0
z^OJLT$GrUnf>7KZ_8csavx5$LOqh=prU2=@wEdQw`){kXu$LvNDXvVvb9p&RUX8ie
z3<kJ-4u=ld`%AwBPB@#R^L2RVB@D1VS&`btD=CqIhkh|q(>E)aH5)y8x$K(o(A;)5
zecCe0f@qKY9*p|gK7G`=9IJh!B2BuvjP4=78-IO$W{V)hqagIfox?BPTkejca;6JI
zlKXfQM_$H0>^m%QPI1_mqHPLTTvata3R@Jwwdzx1YuE;rt`yIey<DVX;n6_7Y+wfh
z+h)o1^gUz@G+u~gv1xvtHjNi?3MXYb4p@X{_YOtm%XN>X|FQs23(b`o%ZvSAguP>U
zW!<*#J7XtRv29drS8Ut1Z6_7mwr$%^Dt5)TbyM#;Yn^@e+4tUOe3>7{^UOK=><y#!
z-@moq6d_5c+QgKva@HgOP+0IaDon@A;8$ItDj&Tdi=n6y9GiT?LM3rO9FKy?>s>A~
z+An%vcw3Rp;5w;}1UM29rdAYF^iXA(RUlX}gU<8fCSh$osm1)Niu&092{u(w{Aw&q
zE*rH;-6Q?kzHv9!cH@`>V0)(XB~UYshMISAJI!uOcqg-Ra@?wBerel_Nhk?p^+B9&
zFu%QL#I@q3eW@;J*d$R|Dz4@n0_yP@9Myhk*S<nOim(3>l#t9jRKge}X9E3rMlQO#
zcGKC)bN(sDQB6-&9Y6+$J{K-J>C{B0MZa32O$Y>6;=s;#pckDm$+~I@4!AtT0QYo;
z0?_eP@xC49E~CFrn2-#D-geu+xN5{FCxKxfXW8b7E(<3ted`wMO1oULaMf6aPsjuY
zkTe@v8j@DdMs)Z)PF`6GtB9|y_%LP8^0hnI{mHTr&hOM8A%i2O6f^_DZzWR@X_k1j
zsJK(UTEY08!mH6?RUJx&j1fe=l$fa7sfBuOifpWMw=xpQtK`y(qNg)1j7s}eonLeg
zmNzy@Z7~&(x+MA<j@KYsGUMd{<hu_2x*9P!1N`vdQWhn?kTeBKXC%|#GzBQ>#T$cA
z`JfWn&!1MByzUNOt!V2IWx{l2^Doq8N?ytATecP`{ZqeQ2${$D_YI)P<(-RPv0~kl
z0wZU#p=Q%{qKuY`3d4e0)dwX(cD*SGCnh$a{XXG)s`?0aPLA$5sWEUCAfaTRNnbD+
z+#Z6w)PonsiFTT$28`iG)(g(`0y|@FQT{(Hu<d&2Y6GM8d31XFHyPc0&`MA^S%&42
zUW}g89H8|KzB+mjaKOwD+nijApExe|Wk2S&XcZfP$tn)(c$PCc!~YOj=X->(TuhiL
z9Yd-1a%1@oXo}M7tYA7I+UH(f)#b|#fcSnmD}ryITu$Uoz(`C@VR800-$|NPUA<&h
z#bLBX;gH=c75vz8t!;>-H^xr+Tu4pDYJ0RPVY3w?W3%TrUop?3!EP0&B7I$5uynk+
zZpf9@l<=uP*j!cZc3!Osqgu>%HkQRU8hw>2lFS1-<K_qH@U!*pySCoW-;1H&{v8OI
zi93UBVa?4<@T{s@yq!1opUBjw$Yr&Z;1p<FMdfQ4fF$SQQ$ln56^ssaQF1K4FH;$>
zFApK}=l@1^g$om?S~b9`3=<;Zo)B%7;Qflqeg|ei#VABv^}&hQOJA>QIFVM@kPfEh
zlfpnBjhSN|+t{n1ImAXKxX2W#q0e&%a@?j;XxzaRFKF<`n0#T*2B1GWtbkjb7~>w4
zICPTshOPi%4D7!5PI)nE@nFvqTO024<&w*P*g9)@mYGuZ^Q26v98>@#bO*<`{H<;C
zOl-IS(IGgZo)<RdLo@gHR0+}um6sI&CgTmNu`K}WNWHUz@F;9i*eEnmF0N!W(ChSo
z8cA;(;A=f229($Co(`eAwOU!eUgI57#59p!2ctqw<z`mu^$2(oM5Y}<*{}}`!2X@_
zetxKk|9Ft)Y~T}l{GO_=s;$@7#|3jL{{4)D0h0A_%iSe$3KS6GX&(?OC1{qf*{P{s
z!2wruiOrV#z0PMk5~clzO>R|%=4sy9nXwfl?r!df^IoNsou|+t(qE&hDirL))kyy*
z)g`(lba6xGECFe)kEo&n09ZM5-p+|rK`eda5N|ItN^XH-@_8LpC|O^_6!0Lb%1)V~
z7K|4vPbjQ<%6q>%q-qI2I~B!DX+2e*!EXOdvYt<GYeta{q-2z!WChs)ERN2(?_QU6
z2`Vu#tM!`0sH^d-&5h6V!LhXk@VjCC1gFJ9m&mDZ=!y*gB-k~k(LlkT3j-o+VHjau
zgVW#nU(odH#_djyd{!nm)s^Nfr15lb?l%Ttod>=<=?U(@FrAuOC_zrtGu1OJjh!iz
zD;t@P8z6nBUsQaj;I?^k?kDkmNIZP@z$Z<f@$7w2qBN!9wUBqDeDH-M$vBj%{HoKB
z&bB#`n@zN@lgT>S%U>tJrrf5F-qq2z{m+wR4ilV_7mK}D{*ObF*xQ|UyH@ZyS{(4^
zz`Lox8aU694OT<XHOkt*iYsCo6(JI`zT955cQdrDA~Bq@8A^SrIISPL%+rAL_1*bQ
zES+n%+v}0iQ)>+BdVhu%9|Q!$&rHSZ-zk{Fs7}>%=ICn6FL@1mYWQdK|7HQ;R9v7<
zDNV6ymTs4RXxxNVcMzNdOy_z)1SM`@w&&uS;_ZZl0WqxkIDY=1R{*v+_rO5OJPm}R
zK9?nX)~^8`o4zJ6MRo=}99=_!lYhZx9ADU4klVkwGt%z>J5I%y3%kVfXGvMcv6gV!
z2FGf@3i|nD67|@gOr7a+s>1+(15YtLQdh`)xS$VM7n8xX>HT_`6yXiiVi3(PT!7{3
z`~~$5EusR7n^hS$MUE7Ssd#HUA+6RneQL=ElNzZ_BO;WAyyZ#7ia+y7*$+!lUs}TE
zPv(7;F>t9bYC6VCA^{An0>9^PZdw}<@7_W8u2pT_yWYo*DV1oJ@S<b)z=>-xv|Oc~
zv#7{BDmt|C)_s~T6_h7JhT7VO3<o%h5C4JehJdwyRLjU34`Ny*WkVuK5{u#4`1o)(
zkjLkvLG^QUR|un?J3IaC>UKTPpE4jche{nQk%R&1^v`Y7zI&9<EX~pMohyi`$}k#4
zZA+ZT4?F-Hj>(r<OUy5cN5>VeW7YtYJzU<aNvocIRqqZ}wrMD}-C5MQbJU+_4!|8Y
zfcv5){8M7<Ya<N20t_mDy5j5a-7v5$d+kul&|1y5Q!V^it4=x|8v~cV`W<W&l;Zq#
z;B>Rv34=&@X0bBTm>{}rV8JL5WTHmnpPa_~P5J=7?Nu`qYY;7vUaMUJq8W)B$h2%j
zfoVKmg5p4AymRU>S~txtwwo4_+ikt2%-Tz+gr!_vwkdBz4OyFn)ECm^fphu+7!ExP
z-BDMQAYbp#X^H(f2^hzdbM863-5@G=C{Nx(@_wSElyV6S477@@6Z~IHT~`u;X(MFr
zQLvLU4<x(<W(IHrjg!%tPGg3*{tGNPw-L!Y_4Qkd2Udg0cb~#JGv-zOZ#_#uqSXVp
zE1nVOLC&vsxno=m9`I2U5Dxvaw%`sA+ga+u9xygPT3-FptwLP30<GA(xcm)?_-xNG
zv(6*=H<w+pa%OUQGkgW?oH`(i^)yBzS~8Sa^Nk9D2~018Et)4k?S!ao{oQ|@ZgYLU
zEw4+w!Ve~XOUQVCiO>I<Y;|zNyEzVz)|m42;V@N}h-ca5pcyyOJpGHOi(#=jfT|}b
zIMRnlBHh{ZanzAW_HJtlhH!}X>3;jA2M>PJ`Qm*jS<e|tf_IJV&n;Y^qr?==RsxUt
zYEnSAcdh=XRHw+H7~Yh%KHK%Gv|YB|w?8ZE3orXCKkm*~-Z58lXJ2=_p1eLbXoaCP
zdP(ofyV01!UM}tBc`j#4URypR&8#^dKOWJjl*zuZ%?s_@)e<wqF9>8d7(EnJBdN<#
z7XjF0tekWAn1623_Bip8do_5*8zl~jf-u$2NCGGV?R?G8mSGum4h~}GM!(B)wnsEB
zDn{5K#hTIf7I7!@2wcFdC?&dEdl73ci$y4C?CaFx-l~U01To*=xd|mTVdT70b6Z66
z%EP`nT+^5^0+fL@tjjtqvTbdKzVK#H7g$@@>GS)apY*duDW?aECJ}oFcpaagN7i`t
zp*sbF2(L{js7?{Y-Y}Q19P@_`;!aV>D8BN2i?PHP+k<$lr(C{vE)eS&TikElc;kDF
zPwCf^?K}}Uq7ysN_kMl@HoNad^c!2n)|q4-SPLbzQpNUiiD)L``*0Z}C(=l43XYCn
zUF&6TPd+3^B$b^bN+N4)$lO!KGddO|h%3bGzSZbPw$)7u|1dDJ>JSq~uKoeO&-V;l
zp!?_6eo$Su2m0q%c72q`z_YT`_K=Ax(zf^JB%fXykXhVE#QfzfI6!hb)2=rtn!)DN
ztsckT$daBKTrifPWf$Pg7RU8uRZ=5j8=b+~*8KFUS~+%80|wPd`OF?SX}y71#q;DP
zJ38}r=W+Wn<HxrQHK}N{#KV%Se+POk+s?b(=*VE=w7Yh3#wfqrzpCN_WPeOaEV`o;
ziCY&q*vdBGom@N8wYK5!h7EOew4EMjzwf@x2Nr$47+P_cDy)%1fC0O75tE57!3L5b
zE(WW2zODU{yM6yqC3|Jguwa;b#SrPYxxKYc2k?2ZTc{+B2ck%IYo$4Hg|;+0q+gfK
zxw5$Fl&z!+L)#=|R9^WY_`v&~h+i+vCHH~uGYhDEB|qqhFb{=K9WT<mBy|({*Vr~h
zrz<smMmw<-95o>h(Z*v*8yO;Sbxt!$)ae;D+><XRIu31!O*t4_HJMNTaQ3$bXV_U?
zxBTSs$1m4;8s-*fR9ycmn1x}O8z(J*n~}LL;FDfO9TMNJ5v8brk8L{b{V3U9OuLwe
zHS>^67WAZFPU*AZ7LY-R_gYQh#gl@DmF4KAPu_B?Thx2m*((z_Myr|x^aNjAk)~rx
zMZhce7n_o1M|a99FF_eOBZ+lOrokF=ND1i^)8ELl6qm73*CEc7fM9XNN=Sg53XlGk
zVJs?HtA7ju{o(XKer8FuP5p*8*6wkB5-HN~Qr8hzItsn0CMyZ1^hl?>iwc_&W#mwM
z4-0#Nev7<}Ox-QZsujBDFoGRy;-Pzaal%rzygjeRh8~0n5rGbBgu9qgem52M|F42z
zhyq&54^)M|2*=-UfyUw3dN-0o{9)*;Ld4M2mjpzX08m7&B1xjhyGI~w+wpPOc8A2&
zkv#IBAYyYQ17|c{0=j@*#{%$)dcczZl%}pi{?+1ca@~V!z#)JaFv79wk$8nC523qi
z$%ZYQ_8kaENP}N?+Gxe&_JG&mfXSl$D)>7c=?7O)^jSz^cE`s(pR(8KcHZn~y33yn
zQqeW(Y^$~P<~N`CB<l=Nd&j_Wg?1RAqx^21)$G@u_LbX3$+&#{gKXMhna`7i7M0+j
zqqsf;n|t)c_kNXXuU2OUIApS*&o5{D=q-)BRDrs;GV$dG)f}ugE^DXXrf+{&dngLm
z5(Tgr7tIn4Pp58Ig5IUZiX=(CAKk*yC%&xz+x^9w5d6#inV$tG6d*nZOP-GU`XLY5
zsrc+DLOqgV6cbn$Qp8(wFlC!U$(i&q{xbW-1Y8XgU&5lbrjJwddKB-)Tr*8Kp^r3J
z0)0ymboj2(LVdr%6jRezf-}Z+KFVYR254LJJVBAuIo@Y%sn3qfp(CxKnWshuNVXEw
z)XtT!{~ywX0^+c-%r?mRP$S9k?~VcAnc(<j!VI4K?6dAwB!|&v31k?%0*?7G>2isa
z6c&uTZDuLD3gBqE2Tcx?4Z{DosNp$6V*_kn3~An-c-|3Km)Nbi<#z4jJ%uE@S8G$a
z(I?ninbJl+wd4O(D#VGR>+e;H5$Z{WQI>&HtJYUl)P7Hvil{sy-8I7mAUFZzHAYF$
ze6#9JtHhtU1pzkUdeZ)VH12I9WB0rjazU*-vXJ@0Tx_{NT(HGKljMob<`6L*k}vm7
zC$2<zoFmV2e(|w*AAbMS;nlJfOZ0lY@((-;2-E0j4tR)L^j!{69Fj(Zv-4^kP8(-6
z>~M7}eHOyop3)XrJ_YhIJZ)rldqsg`JAu^gXzE1Cb=Nez0w5bhso~&!O~S?OUVm>t
z;&Uo23;U4w73|UFbr!&+)}|oBw9g3^c$DUc5enJ}6j!%@psKd5V&m4a6+TCdR_V_C
z++J^_K`Cl?U7T-y;B~=zyb(M-#~1q1hgYW3JtbWl@Q@SJac~5EZ3(V^pLg9Hk^LIw
z(a4`d1CWo)??$Ym*%pkDq|e;4YN)}<#x3S)VY1t3>#%r!JZARfhk^b{V6y`!`@<o*
zO%XQh_Eor29A9}w#n!N#Yw^o*Stl)!y6<0w7^EbpZAoRL`7o!|rNnxr%xdXQ5EVD0
zH{+4zJ<wk5o!ATwhMvv8AMxk&gB0l_dIUCan?8iZmzRwf_cdYwzE#4ZFvS)5#fe_L
zkzP!N)Aglx>Lwrihng*Bn$3Ty-f-l|;s~7zrQp=krC5<AWoe60deAmC($$n(QO+4N
z4^omqj*Sg~Xeh`5mc8LF<s$X}_^XvKe&esd!W&@^QISkx2B+nL81o(Zq%)!Vb8@7}
zBS6Wr+0#C)dqr_pT6HpBH`qe2>$g{)QV)biwYHS<#fc3U=hGW;wGf`kkgshf{15t-
z;Qyvy@wtemz`~mxu0W%6hehX}`V1fBv}=xu-QCA9)%ocD>LZ2z>j{XFHoQeWid2AZ
z27b*YKPL*Yh6lr@dLZMF?xR&cTTma?x<p8=7nA#c@%Q(TU+BAMWQ9}y3rSu|8?PeD
z1sY*8@{hl4J^~E+m`@bfnZr<2Y5H}?R&2<7Pa74kUSdlpIgG~O%d*52K`#7%WEqrr
zM4SJEEMu!$MqR@UOt~)gAKKs5SE)k^|D2Qvf2KGNv9jRXUkQL~gaA(hP(mhR4mrdc
z#O+FQ2n785itv<RrVLwHotY@>iTJUM9s8VkdtjR{0g8i9@2X0TC+VhYFk5L?8Bmo~
zjUj4>Je`374a@dlEk@yTfshz?HXFW^?LYd0zJS0-!9^@U%tI#uq4HeF-(SMjl|#N&
z`Y&4FCr$~d6^6^50qz{&J5H49Avyc%N)+26_;UlF8@pQW$r<?#MINGf$n0nZ{YNvM
z1qR_@xoB{5ch9Z$f=)*ru#IMgO%=&sal?O=GDM@Hqjo^a8`KEP#>mm#G`0`2LUu8C
zfGCyx^sFsV{vX8;Tz)Z}xkij^vk08o$S@?gs%9V8@uG7D|5Yk+0fPH-sDeeU9e#Ch
z#7pZcL0Zn(kmY}+LpO3Pmg|AQ@s3b#LLjP5%QY|k^rV5U;Va8oo^p2<ly7nEKONBA
zw@WtLkLM6bQdUWNI_Cc<rcH74U-THVV3rFyu;`)E=APXMFCl*XAS@MqKp2{<y2g(p
zl8s3gH$1BRez`b3!$f&UA7d6k8xR-qjfZLne@SuQMd=pPK~^wyFvB>($CYfnxD*5F
zynpz8*X%tnN1|>%Vuzs;IrNS1Ko8psEsoF<&iJiAW$SGMQ)%^eiE219IQ<9PWAqR`
zl>W1peer;{lX?4WAXiFsgz-&J_}K4ko~S!e(O&~;f=ExdpvM4rjsuPHBV><C+7d@R
zrr8a?CSHgKmBZ5(wePuaBmTsHANa&Gm`5Mg(~-z$a@2X`G-U;8wD`Io^(`}ShF|r8
z>uijdtjB%39D)8f9A~rM28knj6w0n1?M2yt7C(>-bZ%)NTbAhpNX1`ib~_uk?J?a1
zcPVN&jW~8s1tD7SOMyh~ime_F3X=CVN>C)`8muTJ?;2He0fcYd<QwJi$#l&%3m-vJ
zZyykP3tqeZgihjrHqBL_@A-bzr?><kYJ7KJ!`v?TPdi($6&=O5f>sBG4jy<J=3sw(
zc0^t)@@|!H50$kREORV7`vTkIJ|z9=FxMHlNIbz|UkvDfXT`psDWKndKWN=9WN*;}
z1!My)vp{uwMPw@w+zw=594!ItK?tXb2C+b}@}Edit9nX-%ZVvTHtYeL=n={nIe-96
z*6H1MIC6YKCW`)q71u6`GgDsyed5KpAFI&7j)MYGy<fXw_vbzu6KKWE|3#cN>T`?y
zvgS6cOJEiWjO_Up1?dd#+b4OZ9nO5M)KwyqKQ8F`h#XbXhjuvDsVJ+$9Az0WI6hn1
z!QAE!&tk0DM(;|#c@Z_#Rbv7`(*L3ROsYxMS{}Kb<?2Da+Ui&GJ=3N7IFKue|FIW+
z6_w_F#~K22n|ZkbvOHc;?b9yqC^nj%c><Z>zd)LTL*<yBb9EVU7si{=KRb#2R80bC
zlXG-fhP;B;umQ60s&&YfReE~}ExR{AtZM&Au?_E5lC&7LaMtm_%({FS{M3ivh6htB
z^82vzCB~*^hU+cNCqMJ|le%_+cikzMCm{N_E4bQov_0q!r^wze`o3*z$c>nB-NzJ2
zygSbQHDUV3Ch@&g!Qzbp3m4<*-NkTO_c!E3b~r0fA4(+#=82#tOP&T=3obtk0)T<`
z&R*zbOY{)X(+T693ZIT_`GN$F5OER0-0QkeHK68l0`>n&wwPALK>BK+QK$dvfTUiF
zBm{P$eJahR+4`id5WD&n+Cyt1XX;xCk>!T@rxIUKg((5(Xg9Fre573V6-J}C97WxA
zr$?tn8}<=D0_T?wmcfbVI>WCRl^AO;GelkPt9_FrqmUzqC#j&HxEHvhKPsxc7;(e1
z`+QEX?zzv?F<ntHSA2Dn^;lt+9$c$cn8zNiBb|ZRI<S_)x7Pu??mG}<T#q<)Y=Eot
z@NBXGi2)mtFEwo`mp?{yqQQUTdRp@;u2RJAN`^Dct-fAA3ACWp|H2rxu_LZZl^v*u
z$o0zKf@Le_cXY8|8u=|C)_;7RA>pOb|7w>tTi(_-?E#*g-9Tw(C@cQSscVXqVomS`
zv?d@*Wy;y21o53-*sAOpqRs(r;g3l7<GU)+qA>hNq$VQ`0kL_s6P11p;5Vn1PeeBq
zl*N_SD$_h3qtj#PfWCf6Zpi`nMWVFy!cth>&U7$d1cYL~{+a0n<6zt7BLILp2h(1S
zyP*S((A#lgJJ7#d2%Z3ReHd6|da-g-+{)mU(QE{_d#vuD1?pYTID<1DRDVNWP%9?v
zBLZE)`2nl8=St>{0mGOh0zw=@Y~cZ5VfY<@_M))*FR|w=<ORHn|AHLK0I~rX&BNKS
z5soeBYy8!#V8;s3Wd@jyvNllLeX$sHCuv?XP7}?*O$sKQ_$ZwrG|xpCH`Vn982aE9
zH5WrjiUnYM7y7QuuME}aGkl!G_h$j@mXnYQ+1V5b@~6pV+ip4e;say7hq(J?(2Rgh
zE|pXnd6*~VgZ=$#)%j{obNRARC(B*g60rNZ7QbT5rpC{o_%Yze+=s-6XH%X&#D1Xm
z#*Z2CAjD_4<9IQnQyuSKCeFsFD%t=C`YNqoo$!FC+;7=B7g-34m%VwPy%$Lj?bsrj
z+y@Q$M76|&b%^G&0?M1mq9z^YtPHLh3dFUjck3Ug9E<1baEIR}P6GC^dVLFeA%Q<8
ztOeW-XqOWLXWmui4j8VdI>6)KuQufq=m9y(PayXTbdP<EJ|ZIonr+`2VMlv&)GNVZ
z(dl%1e1Sl~rSW6|JKn24CSiR8qS)Gzos@4CSM`0V(eK#YuL7?Q6WAI)A|Qh+?|eWb
zDIBOH!#9KgIw5^YbZBLw`rPMf1e-o(Fc6Wx?%gLx22lpcZCe0xTrxHg1Zys+>k+}5
z0Ylu|dVz3XiNp0KVTCuIkC(5^j{s>JS5E73{mF>$+po2y3x2>Zjj}bU8j7&EAiS4D
z_qoKCDeM4h7(Ao4EYvi+QQqqr+m1)3EDM|GBCoXjy9y-iS7#7Dd)a!_VDMaB8hAF2
zRR|f@C=RCyyPaHMG51o2*a~UB49D*nTt#XXU@mr&73EVsFT$|wNWGvjbdKL_(Xpu3
zxa6A=TsA{2P<LbIK5i!OPOp1xE1nT}#yF$4#SItpO?k`K9E9x3zn1A=>*e<Yp_3Iu
z;sX-UXS_SSV&#1aIje-UWT>BsgG5H;33Ae=r;O~}x#bznr!XyKR4HA}CTAH!0g39*
zaX~fJxmUu1<KqFn^ojSQ4f?kF=Ye|12Sw9y`#|orW``p@eAQq)mRu2`9ot1}MY5&M
zkd;3P6p}#fwbO0;*5ceuHQ0q<EZhOUD%45q;qHrc+;4w6By$Pf-8`_I*bP7TW$f)X
zv&DsaYc@<k4>6GM9)wR$$)DwTO&tB&Vib`~j)R8F+@E6ZP*Q5oOww(0Im1jYSHLQ3
zs>7$(gQywom<B&<U{f-F3GlY4mfC%HAk_&F5jMC*<Z634Dx<gXh5H2wL_4U}3;@6h
zd<&`smn>iSyMz8&njW(Te}^~AAiM1rn}jl!-#`!huFewa6oKj>ILSl4YggU(DO^yy
z{c?0*v5~H377oXytFj27B0qmh(3}5^z{_wlwG_fW1n@-@MC8i>P1J-n$5Ac6p@ls(
zQaE?+LGl@~WNG|L4zL>%d^`8-SVVB)`RzHwhcA|5yQsST?cx*RMhP$yXZL8Rr9Q)6
zh0Z-p2>di%Wl)$a0#lj%k@vP;VKYyev$D|A6;JGtBg}7({04=oIXQanx(znbhVto(
z?l-;Nd1hc{k!-BR-Cn0kkk;@Gb3+^k$Go-};qT%>a{W#uzW*WIGLxgK+!Yn?KeCN6
zsZZ0AO&lHR)b2gFW7k3lmu?XwUSlZWvG%wM#((1GYR|>c)dw=Z_JnD}r;GybBmgM{
z0s@d=`s2Hf&DN+6_ir<V&ER3PM(vYbfV5x(UTb0-uc-pQewXzCtT9G^oN*L1vrWCh
zJ%c7s3@zl#*21ToM?ZAbLWl0o4zIqYFMmh>LDYG^5d-H0_=e?b*-Qe)_bph+bfU;x
z)4!Qj;8->)?X|QQZ)-OS!Iw@lYCegW4IQM!mh|jIje9ptZ|IH*9|Ef^YM~mJ2Ah9R
z7dAe&vvYx3TCzUe&Wn5$oO&EsYOv5tP(^4N=6c!SsSH_#wg-j6Dmhehwxa$}-4>r`
z1V@9i|3!QtJ2V&QyxHC2pEYAWXnBzJBX;_k!|zw&iAB~(7(hh>X^LvG0}1T0yKs2D
z6Dj)5T8NuxksZ2*7{Y6MC`dt%a>z!=-GgOt$B(^4Jp_ywyLoHUkJlNPA_aG?W0BDl
z`ls){nr_;EbzxW|!_wZFs@({;b60yxs<8;&qM%0Gk(s*io^SL;>%pH~k=cuSIw&P5
z*S$|CJ|hdwe(P@NcqTg^6r!M;AB_tWTYk|=`m0i|_duR)@KK@@oG|u0+H1dySSqK7
z`E?(Z$kpHi`{JSo+k1R7x@GB5mbQX&wq%b4=O8yKJci{ypIbQL%UuY%QH$_1*pXyw
z$~8lXQ7YE`sf_=Wo?h?6|E3d!^VOy~!cc*f045FApKhMSv-Q(Zzv|C-(N*I(@weS{
zRHdqM6-aj=uQElAJmnN)c)R{S<&AxNIXn}o8Xv$BwGAoSesw|Lj#YLw##qDUe|pJ3
zOZ3#JDWUx0-n731pgUDh_<&-DU3Bc|RIq5<?-`b$J4fw!W9!lkdIKkhzoZN2?qoY@
zpcmQBB@{ae;0pl$>j%P^$!Gk38GDIl`t8W^As2bhAKad-)=CfFRNHQBv`}Ne@(6Y1
zH6Lch&wxBJBJ_*kyc<pOTT%i;%ykbZ)wbvX^(FVCMoWm~yMiS(dopUToBtD7{<?*2
zN3~vxk=~C*2wOH5@4!!W+gU+aK!(y2NwJ%<W-W>eZ%}t;G(|m~1~BrT@wUjjPM@yo
zGn{o7LelwDu2rjM6VMVxivey`2l{}YmXBU<@v!&ek{h~=R~W=}|JH#(WiKs6TB-TO
zU}m*J?_i1#J)j00dpV%<B?{TCU(SHS9DFxyTn{)W&zAS&{YR40Nu1#Unk!%L*3<y6
zNB}^Z^Ui|bLzBQgLJ0Xv&jZPZTb=xRSm+iXq?NN~TflNrq~29?OKeUp&;z$e$iZ%k
z?#&7rusn9H0e@t7DEphT<Bs8lD-^<JC@W}Er~La&MX`wqeby6tw6<?~IyDP~dlX)x
zO<yDJPEsq|BXA1P=C1&c7^N*BRF5{h-(m()zF(o<i6$S0=}29fCo&!r)3Fkae$u_>
zlXeeYNR?%=sTrOy%!zLU*E1p9hxpI@{ki3p-GYN713<D3Jzo9&X8W+^MTFc}J`4iw
zPZX7HFPCWK@)J_l=gCo}<R9gK$F09!+L1lQ?sZ)C9sSSxC*k;$N9~IgY<<>|9cO+8
zY}DV2gSOjUALn{li+1<b;=Aa-(u03Fcc_4Mf=*Qs&CS!&Ww~NUo>oWhs2N9H0$2|p
z!BBVg2#>Z|OIt%*!>dz;8Gs}f7&L5V;EFNVLt`z>(Ekn*P(mUV+bLJgWVWH<9^B2J
zSf9)5D+P1+Y+tm01V2-aA;j-_gZ24H;{c+sOK0m~TvXE?!+nf=BP2-1K#1gDG5DW|
z!xoE=GbiGSFwnm2pq&|VwmL<YSTz*;?`ZU&@BIJz;HQ8^>O+Yo|CI<`F@S)p;|t{B
za-#*pzo`T01LEc-&Wsh38{q<siJ;KwX2f(0^L643(zKE;-3C&%3?T>k4#A;{1TK@2
zGA#S+#m(MB>z!M>xpv{*_mEVBXxW<#voH~B3j%3X(RpnWn12tH!<=Jvk95E8uZk~X
zBv7Q%YI7Vtx8xn0pcr$&u3d1jsj(cl+riOta`THthe&}SsegE=YF!7a`;6)IA23Kb
zBR)m4W;&rfa9>PNJBC{YPBKKM_Riy}+)#4(MwDPp7`)atK2jJ(7K=Frl{^>8c|9#A
zC-x_5jk8FX;bn@ZG5=9B=Q{-x!{oS0LSVslww<!5^Km<PvrgL0hRnXYQx3Xp>Gbd@
z=aoN-3CDFmEVg=HfL|*L8u?;v0r&thL4L(G_aiNQ#Au6i`p42s=j8GX2a)ThX}qk|
z?Ss6$6l1$nu^hE^hnc(T6E`f&P71ZdVOJ-v(_E&3RWylyg{TR`p7){^oAg6!mT9+1
zrX6Dn_QFZ?&J4=z&SkFR^XV1>DKKn|r;_LOB%Q3z8KxUg%$cudtO=wvEHbH5rl-$)
zSO@jhHusz1gr0R=7dn&NlAS6SD_C7x>n>MkE{Qakl<iAcTix_CZus$mtv53m1zO2P
z--#)KnUVq_vOz6qUj)@|{T(K6rz+MJ1XVwP9%;_6n`hsmmu^wHWNV%{HE0aJ>V)=?
zZI_4N-MWW}agee>0?<qf_xBrLp4lmLD@O`-KOL+ko-d~Z80~{UZ6ga?K`7zc=&m!f
zgAEVA?u%T$*0=;?q%lT-A^w9W85Qk+9$gNFgWZ|{o*1mT@cv3ebaOMupnTuz6Wj_X
zf;v9o;ql(YNJC3YV`A~yY>g1=#Jds;_+0bBj!kC0de9c6?fzpo$mF4P5b90}<b9iU
z)J{tEb-UFgUMC*gn!epUX=iMr1YFn<$*h4v*1O|&R7OKbM}wBngPUd5LUv2OPP7NA
z196jTG`C`QawCj|&vWD8!C`fQH;s=C4*91?t(ow|D6BnMEaenJ=cVS~1qu)Is0RJ|
zyZS|_hSX$IgQxSn$xh%}#;I4-lo6?IJ-UJUM<nN;ZpC)NmE|}1EwX`n%o>40^4%HB
z!;6S66Ak>^VyrSOc{yU4ERdJFyO{{?hZ32w0g@ZluloDl(`9N+roAxCAk~_-TT4_R
zr0}g)N=^<?Qg3Zi?e7bZXj7pO&P_y_HP;B<@AF7V0aQ)ioqL6!)>|JYtzFc#*vY~f
z?+<O&ReRlCw!;pbm<q-l*CR;02oG5FXMU9|T6w5*6}_`!xoQ$HaXK|9Av|5XUD;{8
zz2ym(<nwCMq1pGEm_N@g#J@HrIg}(JvCKwe*gPaAr#9vbAktG}r75vF>sIMA?~ID=
zWh*#fQc0E%)-|ea*Ch&o$neXVS0n0|ythv>`<)~@MQFFWG?u_uzxxB|BJjAYUM9kn
zy`E$Xst6U!eZU(?p`SrS5D-YFF&LRObflO```Rr$v&zOBJt2y7&e4DdXY*n04M=fZ
zMMY=dv>4wD(d)%ajvPCS#%v&Cezq&UojPpI;ZuxY05$msrOyuD)B(A=vd%1JSa88$
z=dE5}3ZKy<Ey|^*o`g<yO_H_8B=o7a=JU`JT%(^iW7V%VH#<Cc>6dv<PGbT8al6KV
ziWs6;CegXKtZZHk&E_)Koi+0<H#^qO_!AesmwYTmc;7LFtm9@^T%Bj<&2$gfxq_6n
z%acs=$&|1DR~Nxj=~LcK(^>()u-?ogs0vov?G=94TV}nwcPAIuEL`q&H)X@N;9m?i
z%M(>eb{|gXn<K6iu+|~2)t}lGKK)`%CWhlwz2A{21dB7eL783Znp<*reSAN?KUwO}
zVrECws2IjQVfLSjA*D9x&eGR#mVs8nhI8ux0{CUaUCrxk$N8$p{B%03&UlX9{%9E1
zWM@!+z7_C7$#=0$C26-^m{GuFPG)2M>WXay2Mf*>K%}7ch?(ljiDQTI{vJ866{j^5
z?YiP&0?zc#cs1c7!M5e*;{yYj8FApP-1F?0qL4bBu>V7njdzf-Wc6$;M8WGF9bEdl
zmAuAA`?NRK^>IPt06k1HoBURK)8`XyMJg}e=8dx(R2?~o<UYt`VdrT7mEi*A*r`+>
zdQOta;Z~4@XWa|`Yr7dlRXE;Z9jGlebgVVU{T7*Y(2n0#M@>(E*p4`>-c=KiyQH6X
z(~4>W=6Kjv4IVe4Ws&JjNz<5>l>U9v^@%*6F<7)&E9}lNgP~h!R-J0Hb+pq7$5Zz=
z^nBT|?4yFDGSIGv;U1jN>%{H@)#$<PCT3i6a?-Oxb>Z54)K)!TK2i6i#On)J>jpV7
znGnrNdQx-ka7Whp2Jp;@N)k}0#qHeU=B3TGU`djNx7fHwW{mkFYZaRY6dR%h5&l)H
zm6_Z4ANO=1-{6q0E>4=u_L703Gwkml-2rClS+I9DQz8cv-D2Zw30%KVhSEgGl)UP1
z!8@OCdJLTPAfFb{RYdDuNJ&ms)@k*ev{%z!-z#Z+-kyRRI&=)=4RKhGBP$xt)YyKU
zv#{V784XvInw*7oG~m!O!6-+2bDydyyz1lKjR^#4lZJJ^?=PXI>$t6T9FbxQ`YL=i
zF&Hfjix~hrV2_pn;+R|&7wNR-IZR5T78ZT0JYcs;N8~&#N<oS!BF;+7;f;^siB3D@
zq7`{@A;zfvWSVvpifYJkzCmE0W-_UDQ#DVnfeScTi~{ba>n?ID)A<ZH7SbCh$~I&M
z22j23M%s+gcAd;I5^eFQ4&)?QKksC|^1i-J;$gE|bK8v7?$BAD^qCaD81Zr+z97_F
zTF2t!s@%XJ<l6pTO^YroYZO9(FF2xt7-S09@RF)W=6=0T)Y<&j_^>%zpS@+Yw8RLY
zASXp{nz#W^hWY&AzUaCLWA>}DngY%$>Mqys@-?AwUC0B0Oo*!0Ba_~`8YrcUhAClS
zI<GF%>bYz36zyH$1tAtZi*}IMm(BIro%x+g*@%-P6*`?7Aw{^K2;jSLdop<vOya(E
z`^$aNkSfJ7oyG}EIzRx>BiCooEBkOZf5GnB#$^f%6-7h}CF{C?+VrZ>n5Qi=9Z0-s
zf{9yJ<*8cf%px*WdRzNA@+==ZAXz9DV5Z7d3+@Y8AA0OOTaPc#N1=O60@vi*^*{{G
zw{A|W6{MkjOf%+9d#J$HDf)PzU0A&PNfZ<1r47GTN$ruz-WZ6@C4g&B3Kd0)*kjdU
z*_rkMS8m4k2L=;6^qy)lhYu4|namW$LYCAEm%fmNrVBQCT6>*K{aGW5S);S-c!*Qx
zyYb*t%&AR81_MuyO&-PXXh6w|*Hat}v<vgGSdxfV;@2#q9U?^XYO|-^UH=g6GD<dk
zf}l~Z>&s9VEesB(DBzBwnXdg}fyW;el#8pKx+fUTXVHOK0AICi*l~*&E4|qYF|gxE
z-#_d38Y_%jN}dh=Iv);4PrIG0vhcubDl6K^gmbAdh|@JJZ?CHXIu|yVB%0+WzrhQE
z=%^}RzTZdyzyE0CeU5?&K&&X))bSyQC!go8V#ED1GV%UZPEUJK=T6nET>wB??slho
zto0L(p0c7L2RTj&KF@ZsKFPBnNzsnDwYGipH}}iF2rwg>F_%^ngGW|@!qnev!J>}=
z|DxZ;K!ijTF-LJ(<p+)D)4nlIsK<j0l%)U5c{bc6LCNOB2HqHRaxfeW4UcM(QT*nJ
zcnN={o!UiPe(tK8KCLYweV{y!{X>xnT+{&SX=X@Rha{Hg#-ryMwwXBLD@%7~>&^Dc
zoLju<PXPA5XaDrrl8>DRQYb0Ixw)I93?ddhlx*44;{KQkmFxSgme3KiP!?z611v=I
z^_|km+@)&kTxsbXje>S!FFhoGFJGiH2~icRV5Pd6e0|(C7C9VS_7Eu&v@KTksGb^L
znUIq9LLgHZd?$aH4C(JtDwf(8^t73Hw#RbLP5JP$^m>OYHn$meCPLtv>oI6xmxp2r
z3i(IS1fP<mwe`{0w0mLzZ=8EEMFB)Co4HE~hQz|3u^;N`jX&@08+GF{=+ZAn^@k_w
zsRQ<|S><lMozBb6BkPIEXr*XOSAu1X>9t>CQ6~xE%+;c1keIR(GqJihtv~>X>mIIL
z;y&wY!6kMo6X9DAqpYt>*gXr}!lW8JlyxAH9-prxi~vcmRXLL*4AyC=!M66TWxae-
zqzvhe`?R4J@!6B?haEo+osR4J)@sY@TP)9a5Cxi7?PuNODx7J;v_^F=$@<T2iytzL
zfcR=|GPl_(>f)*_pp?G2e*D47mXosWiVdtq>+xz{<=^Lzu$3m<Nx{Jn%!Rp=vD)O%
z73zgMAio;o@J5$^i%WjcOcnL5EEh?~RBFQG69^Ra63M>CtIy_`yhja?_?_#cu*m#s
zh)N*Sl-UPvx|EnA6dMzC`-$MRP;ahe;BeaV++dg9_9}9*J%A|%Y^ixD>~1%W=|>w^
z#7#a7o?{>1#)=0IZ$W%g=5&9?8zW47(}%YZrmh-i8ht(2@~un%dp+ZMRwF5Zc%O@6
zXzE6}eigc^WB@yC3|g!50O)35t+X-ai)UVaGaX}}EAbdf8&0%ucVS|!@wXg6DA?gI
ztHcECfnrkTn!_w95WgVg=*@O)do<?3FCwoRgmKk|wB3L;4t+hkDvUmRcp*U($F!CF
zeo!_!GeN;)qr7QV+xemKcjf~C0Gs+$ibTcV=@*l02buR?ZLz7-2J6d3xj@-cBF+1d
zcS!~XD*KS4ONp3(V%A;t2cEY1)bsHbQ8>0AQT|0s>k^uu+B|Mm<-V_B+V#(FmxDCu
zPinUd8js9Dj`O6HQAXgttV+s7SZyH`1Wk)*T;#`_%#U_799Qm4Al*i|)=8j@Lr=LU
za6s#OCt=Yy2T0MofnT36mLsd$$=<(kxNVTJ9ru}_G;Vm;`%5Hqt{x744V;k)IU}^)
z%|2;2r9pfw&2$J79jG*EK1g>L4;vgNhw!e4@5$+*Jy>RvIz>=jc`adw7Jgse-~}HG
z<Ax>#rcE&t|16?(aUlB904tWGlgLoma1kBwG`tX+?9=_(>A0{;dxB>Y7w}0jZ8;;7
zWZ8PO64=`gUDR!1!*-cc$2U;zs!2b&8l|lKIUW+yMWcX;PZAy3v7e-kS08~fy@ttL
zC|AwoD;%T%JOt#cvQOc=P7{$6VX;zhSchmaQ)x#uBwUpG)TDFf{EuUy`RiDMLZCY(
z5zJl6x+7VnG6j5m^3Nr}#pgbZ+pIyMS<7_xzZy?u+P0Q@l-xdFx)DJbGT=uNC)8zk
zZ8u_z5f#{>rTJS;sVv!o`|9=-7HN>h{GmB1-g4;Ho;ypu*-$=2l4#9z(JyoCM+5=D
zy+mn;ox;hLD<>g8T4IpOw1lR?*MsQLw}<uU$&Y;nmmCW)5m~tye9T12GH*Hf)uSAk
zf*4DuC9)&uS|&?eoex|Ez$esA;5hlXk;muWFG9QB^)){Xt}s>fwa)s?1?lQr9w^<j
z?dAy#!8WN_VY2u}8FHhhD(&=@Wxq%+J772j!w~beFn2Dv1ivmO(w~(S9N!m`msvcS
z!>^~J2bjW{OX$O|jln@jWIk_i1t<ZcezW|1QgV?_>keC9u1<o&q9+A+;wWAQ{te9-
z>h6-5e<1EOYq}0L1bqOBoV-2{P3bzSYDI42?TamuoM<0gI07ov?rs{hQsvEK2Gfx5
zA8qu}mUTPCc|@jFYj<-F;~|=8jTfoY@N7<xu(DJ%W7QWvYZiEKNC4ieeJh7*Z!Zy?
zr4zNS`m92R+K0x1SwBUJbz=cVNJHSl{pS=csrsn5UY`Br!{{oRbm1{Z;ij`b_L3^C
zp?l8+-xnkpp?<xKQ8ZY|f~BC}npIWaRc?*syjx8B_NAX+?LKi1eSPo<{Y<>`P=7nx
zPWKfE>mQES0&yLZn7AL<U5ek`Ssu1_ml#C?<ftSM=<^GXz9ngtF4Rj`8rN;;Fbq~I
zBON=j-<KPoW|_4)WZ_IDPq!sLV2Cc-+(a2ig*8UN<%xBQ?HEt_`T7ljdb@UCaH~3J
zHA~W1faaj?rIAi2gToq~vf_HJlZXJ*n3~Iy!__XhS;u4Ft5s}@BV|HX?Fp@|F$~H!
zh67z8Jnnf0A1WRPv^^wt1X)C9a%sE_@_3cDIv#J{URIat_Z%i-Eb`-NVzM6ZuU?Mp
z9pk+|X)3Ikte9-6XpI6!D<(qO6}EUhw6|I=nuqv21c~0@ttvj88a;M`)I~=L8mE~@
zX|)gl&%FCuJ}P3u+<=t$fEP7CYr8Guf`Mls*~d56r&);bC6$I%lX&F!{*wYlfUUQS
z#)V0%CPMc||DOv?8HA1`yPaDWPG6U?hYz}=>z<@G;o+7ny8^jf5m8@tbrBJ+8H?E<
zd*_*p@P{%=Q^k39?U3_(tlL*wDfhcW0u{@;(SDEsA5PcJ@Ouv0-q4J!yX~VPpK0=q
zOF_joQaEp+UGv!r48m}WO`m#jK<>7VGRh;y+t~_1Xt?ETCMNgV+_=g@(4;H*ah^cX
z_yc3N>*r{{5ueqn^PfT~Xu}1$E?w~`&xgU9oCyJ$k7du+2-R-w`-;KXWqs}k+1f99
zEx!6KN~&EO6KhhraVPd;3sUjz!1Kdlv&U~s?IW{j+*qt%nc`HV=;<NgY{{tNJHAEB
zv6<VRAYxsV3PVa<fdpAh+QOIvUadQPg%OzXEscpdNS6xBlCyEy06$b6%5QOh2#EkP
zM57SS>?b=Vn_n9DhGHtyX`<EPrG;UYZbkcpiQ)?G$C^ho73;3|EXua%cJ*c>JW1Vg
ztguPK#ox*!I707I1<XQUmTt`(K>#=KsYO#uw1$Xt0Xcz6Yo0NW=a%DClUsRX<FV6i
zQ4d&R%GF%zNX`qZ71pdK@nV9+QEI)V>Qzak@(xkzM?+OSv<<r7SA#E&={KKZNhi}B
z;40N3h8gi+?j8)N&_sIMCQ-yMUT}=UE}Rq;T*X0U>-N(Rt2kX=?i{K;pB`smveiEJ
zohqdj=6wUTz0zjeH3Iiry0jvxzzXj!QS`U2XDxX5`UnZ$);X;?shSc|nLHkFxQZ~g
z7c8<<HaXpv6F(>IT4otflsB2E*+~Zsp^w?GFKsTx(;io=t0kdG+T0ht7l};GbObPY
z^2)#xbtq1?tv}RWDHPPR(U<e9eE8K~%j(XllyRssuYD`Zbx9}d=am~dG45z@BTgG_
zUUFiYIFRp8Rh7oEbk<NCCHbEq=k6@eQLP~`y7+ME{J>vYdy9;x`%s+XmJzr#Ca28F
zl-idVMWi?&zM&Uv)L-%unQ4Mrp8hrmtNXetVis&ci<?|RI?|aq8Pvpx2#1i6fXGA9
z`D6#gxn5KaHozMtg$6_k-AZ+6;KKeU1JPD<#cULcv3q8@p{8$t6w>FT!9iyLyjiX5
zLx!K%6v+5u@dAHlpN>74{ihLMht=KhYFOTh1D%%l)$UInOd?k{zfL_qObltB25?=R
zZ-%46AdmobL23QIby|rw8|hvvMk_8IvPfK<cB5;tm6xh=;glC0Y_A7kLD`o%4%+9B
zi-V}~@ZLz%kYRlNOIyopS|2lvReYGhQFnegoBHMQ*cy-IRu1G)q76l$wGq|g%E&#`
z1diqt%)3%?xH!)cZ@aNG!P7UJllm98<=j;kY0QQs!=PI)#-EcO^Y#cu`$h<^mUQ1t
z&0kL{-?P-*?)|aCSs;YCKF_yt+C!>z77urh8FH`}-|x|;4HpRLNQ67yl*Sz8ou-{a
z=CRgiszbOf?7qr{GTe&&<Boa8A#HX3l9}S_OT*tmOv#_xm^+>ggT|UahLA&}M9ppb
ztPe2;`RL5*%13&cfIT;KB<cJ0{RSiaaWW)`ncL<SNJjbs_KvI5On6K%UDy+wN-aKj
zXBTRQe`8rUw#_p}=FsodRH{&M*I;KRVug&&C_*xj@$myN`HB2xyR#PDA8I|Iyn*;|
zTuQnoU*X!-QvG8H&Q(UVDp(8}*Ma`{tb-1>>S#U2IP7~&988_~AKoJ8T0L2#?iS*O
znmHR(%~~s&5dhH>(*=VL#rQ(DI2q)41`;<`6`=l#gfoUfosLk2^(ECrBh77U5uOf5
zo0@I8ZY0xrZ3PD;eb&-?zpbWQr^Vl8s~|982#-vVtmsIZew=oo1wVG0Xaq#r6%LH^
zyqsMwvXVx$?N*ydfw@e3dhbs+`@GE|Y|y?ohQWN9Sx50of0hRA_`+U=`yrmg-VVf8
z%TrOTONHvi5Ei&imXpS7Tj4B_;^@FMo;kBR?L5<7?Hu<He{~e9t#Ktl`^rw|+#cAR
zZ>{0J4NbN-(Qw5T%a&umWk)O#b+BxMr88*^i0<6?kzaW9KutHw1Vf|e&NKL;pwjS%
zxJC;O@+X?ByY{Vz`z7kt#-6!J3yyr#c_x!JDcjUL(3ieh3q_Inan92`8D_6Y7&Q}2
zlNl?@yS;%8uR_Glrd1~FYu`A<!=UuQ@UNk2-p{l@EZ#Baz7hc2bS(qiBbDzKvJ#m3
z<+sbEUSaV+QJ|s{fu4(OLN<RZ$IbGC@`+}Eve^rHNEV1y!?{~H-uggqO{Lr=RMrwv
z>^ZqLO5jc<fx~;Btd|f(FTE)(DaKym;9+}zBA@_1$|fVB-d@5=%<POV4_V{KaHj5@
z7LHHLe4gq~wxdBV-0-cJA0b#*nV#UnihOr%;as$!LWdWKA|KchMRU3|!6fDUMs(_2
zt`GsgItAl;#7_ZyVK6@Xk>ukdsfRquD&w_RIs^z_o3E=X@yZe7YHCD_-$PSVZQVM~
z3lS_QvcY{pRRQ1XyZ21w&!pkJgLchlDhQ~`Kee*&TMN_Q%MTIWYUYn&8zwwk){IcK
z<^ZnGW&SY1xY9>Pk&QKTgbbHH@0YL*MoOo!%UR=N5+k*G(_SlH(tMK!hlg*pm*kBc
zcc*I8FMkW4?YQDhoswH?!XJmzZxx^MFNY24UN9iOH_ET88I3g{etsflnJh}$0l=b@
zw}_vz0K=j80}QKA%H`GPQhOW?``?i|cBld&I{Y{g>RNGsE@1PNI(MwgKe9r3>46^f
zWk?$~6|D!v4SST2j|I~}I^5_-n%#7E;GAawXejn*<&#l9*PaYzw6*`3PvT$maj2S=
z?!&;(b}|UBRl)A$6<w+q=`14k7$=Cp;$f3lPcH`c^_gaD3%FcKsMgZs7`GqO3k`$H
zDbWMWxRQ55Ldw7<`W2N*ZM=y5=wRwPPV#AVe*_BYvI`K=<QbK}S`|r8r-U|{t%mt*
zym&wumJ+LdYwP4+uD{&op2U6d)C8s6Xw63^+Rb~1G~Z~@__7p{*9)<Js<J)7ua`iU
zjrdzBar$N;zu6psgDpx8D4rC-0Bk&HW0nKJSzA4DWRq!NY-~evXMHNummOGywvXXE
zFK-P8HoM?zi_FG#M;lejKo-G$CQ+mW$tkXaxRur7xUa!{dRCT}{C=Q<A4S|qL1ukL
z*C|FuIkYY*;<+h8qa9h!N0p_`tC^d2xfK>B6Kl}Qmf{+E>8q{0x_|)GR&%JwQ<fU3
zGH;DLP8_m1zd!&-!B^}_u5@P_>179H9b_4eYSG4VUMM@Jz`=ViN1*V1`JjRDv3BUD
zrrqiX{6;SK#m4(7dnTT3c^dv|6KQ5#%u+sk48wq8BopjUP$UW?3t=K;@YSWBxKI`Y
zaFy37%@+k@ed#_rG~}d#GSN)>1jGX8T^_E;Ck=0tt%I|Bk|eAVHBiE-OC`LW<6YNK
zcuezEVx0rttl9kr@{NsLKVs#&H@T_kE-yj(^L3%k0u3xmB9Cf5HHMO7y91wb#9t?v
z#*}%zk{7n~s*@WDw;b)33Rgw4UR60MYv=H>rz`07(z~7?2r%lY)I9Ef8Ydj?y3jZA
z@)O@y@uqM??#0fnXtVhNcWi9j#q$5*>z%_R>zek_jx))0jEQYcl8!U6ZQHgru`#i2
z+xARs+vddj<$2!s`<?6h&biKC-Mzbe@3nW;s#UA*yQ)YDx1td}CnCyzZoj@=n$|81
z6$^G}-JOw(8bmk`3l8cO5um5fTRZL__dmrJf_b6?gdhQQ#qm=7R}d#B4Ka|5s^DAQ
z-T5}Q?MtefQ|KiQ=pUBuPdY_L^_87thKFKba1vi7HdUB7>y2Jw*jwO!6A@lauH7l|
z19EQaSjM`#Gc^WL_W!g1a`L(`V2LrlM1^y?Z)($ll;s-f%c>`I(i@?G<R(|oZ3xU_
zlMRGTK!ORDj%yOeah)-iwDTXL%da-K!C*FrHl1H>$P7J)4tbLe2F5>A9^a$y_R=RK
zdWOi#M;c~z`rnPq%fJ7vD;+mAG+PQi?%ZB$FTDEg5MFP$k13gc-JR{C%;>#KeZL|S
zcqayDl{<$!Pl8fHSE|VJ&#F;`m6N+m@bRPAZjoZ~FQ{LUPR&yWiy&wwGN95n%6_`O
z%9N#|@GWa_WswYMTf(XEI}RUH-jQUrIm+`F>lhUXwg%H5Y;A(3Tn~#6LZgeu;zBaO
z?-}<yfSN(A*BuED6!6;y-(PRPq5%%f&|GX36ZjT9Erykt9@7bvJbxv~OLfY#16z1)
zZ;jW50Jw(#TXT5-nv8h{bxd=2GB0Cxt33%ggTnPAW$FmPOGvDZlX!d}o6yqfdN`6D
z)W;(W!Wajrfvvg%a+wS86)EZTgND}?El<dzJXb(ZoY;hGZ{~PnB*sdYQ%MEE7z5aI
zbU?rPR*U%s!rf?SvF-1zCFN;n%e-Q9Cx_1~FpT4PS|XUQ>fYayYJbdU;#e$J^WG>X
zYmbBJT&Y@9(cT_By|hQdcbIwaH*czd-d?jxpGh^<X?I0OC~bc?gYg;Kj2B^lO~JvP
z$IUM6MXiv-c0sRo$^Kzj5Lq@P=z{n9uC53<I;aX2)KskT-&q5CWozGwaroNClqY)o
zP#;j8L2u~!6#Ur*7)J?aZ|{+W;2SaWx)C2;^`VAREuE~fw$t=<HqM3>AS3(3@$&AY
zmaE|rJ%*-8ot9>T10r<Ir(tH=QIhW%>**|gn(;o(RJVGu^Xo}&MTb_;vAgt$b?L|=
z+qtLrVeMcW!kfoJeL8L!-2xDC{)&msU-id}GfNDPgOj7ZJ7+mK7IW1;5-OSCWFFJ5
z=53=V&E_~Y|MSq*npKzU<#cv`Qx#t#^f={<3RQl?N9$iPsH1!d5z{0mdFHD!Xvk<D
zjo~&hJY^&RCHLjek*rGV4ZT_>6$Pk|YXu=+)1Cc!PmVmZmMdru#PV1b*l*YP-WC7D
z1)vfhDY3f-hSSTX=Z=rC=E~@(9OxIW$ZH_22Fo5|XT8LxnAjd*OaD;17Q|8C7Ex)5
z#akK7ypYn}m!xm4@j9Ixtv_KuS>V09x=il8`+K=L-1V#}{V{sc$qu@_dr8`B44pvZ
zz3vFRCg<>RW6voXPyHz#)_FB~se<PM&hqoe-B{AoWJmK^z@BOn9$e;C48<Yj9<9fj
zDPFcbQjBKvcB3r9WT($@-9y&n1H%h;zKFKZhju3(jqRsxI7AWxSvEc=9r!kIU8b%5
z0IXkj9)-nV;=dUrsKNV~e>~r(UL60l=2H9P-xkw;6zu+%0DS0bXm$2+n6F=`UzxF+
zua|qlo|)>8o$}u`zj2F}Lt&N)kKPH2nD4iKxOpm`2~?To)#;C@Ps0=~{D#e&QBM9y
zHk(j7r!|_EET8$h1-Idy1-i#LTOCn{J!g%OXr%RYy<Pd`T^W~Ug3Z1PDosyokKm#M
z&FK=fB4oXBNVe!;yD}_y$JWEnc%u|TS$K@zST6+?_11P!X3j7AL&mn4L&B9)+NOix
z)#wWLM)!gnadQJrC{vHOG=9Jf!t(wtO?%CmyTx}LFll@QWZ)LT3b?+snC7_9m1h$d
zZqTQ{Z{5j2B9P(LPtX3TPp*4RFAR%`?*Mib!41HD==p3(sua6PI?isQ`HU)D=5+SS
z-Ex%kR!vToDj1O>Q4N0dM8AnO5#afhYyIlY<R{&yrB<#RljbC)TJTRXp)(JylvyjQ
z<PS>T%XzWmIA?0CL2`g(G^WOCkA9br|3RTm#P&Mq{w<a%;YWLn^^b*>J9mlUe4@^y
zZHE5MH`5RF{LwCTV+I>Oz6P?goV{aNY+PS&(dh_F;;h!vOH9VWP1BneeSJ(I<Y(1;
zGY)dI=Wp@iOh7m&r4Mt*zEPZv)1>(%N?(?(tPfJs^GeA{Rka-B0S<Z7hn>|d`jzE|
z_`It7#zkw#3)!bV;aku0jNbhG%Pf)GPjn{+4nU}%%g~LpzoyXqP!mo#TB9z1_;-&h
zi)zJY_Mln+VSBg>@#pCb5AR^2S6f-`#w6ztEcTm1$n6$vBuCOD5$`ukhPestl&j^J
zq6d}o&dHb`Y)jXhLFgf9fRas>8)xyQ!jFsFzPvbI#GBAu<mT7)6RqqQN53M(o0CrG
zQ_VMCYI&$%&7Cfyv$@}iy0LfR%ojqx!j$<;#Js%ldUje-zyHuQ_9<dk&|r!1BnP>B
z9X)m}fEfxN$~+*}Ep~b+PhbXZgy_+!hq09C<Gd$pZ-?BB`~c%W#C;-6$UA$lH~HDg
z_Kg1UZy=`gN)E{22opr3zTrgm6uQ4x$Iv9UD9yZ%S79?EI6%l*%K-ONuIc1aA(lDY
zyDfSHH2l|$pouX+l|v86Z^!Xsfv(yHscdjtrRS+~!(1%(r@JNt#oK*~E402Kf^FRD
zvYPvy`#6$Ie1dhNU+j#1UFi!A-1v#*rYY?;H0M3hQ;&ttVrUQ1g?PRTYW?J|wiq&Z
zUi|j<<yDJ;7}CjK{ucV@{OvL1q_WbRGiA>w8jb4Z>PY8VB6CuAkC%tx)XIxjTJQ#|
zSNmH1j=U(dXX9G^FJ*Rr;y%vRr(A#6duICH_Hf;jr|G!AZKr3akuP5A-mgKiao61(
znFxKv#&~xbDU5#5>;9eI-|EiBbXjnn|17tolfokGy+7EFukO`~rR>@D)8JnELnHt4
zsLD)B=WW<}_b{pJrWz;P>wy|>4qxkSqY`uNb^^@1eKH7S+3=iXvO4j=JHh=Be8h73
z_UmwNmARz8<yRK(&)&jXm7H3)#n0S+_p58fhXxM){W8-^)5gN>IFs0WmV(?6l4N{M
z)gBVX0)AC61f9&ni^rI>WXB4&;IRbJhWDRUbzVfxjyk%LNBA=}IAFf>H{s4FRhM&d
zN$svDNnDFetsfwBzMsDN^n&YkN_3^XoK)ja&9gj`Cyv2$wuAr>t^w4lGhU(jQbC16
z0so<-_W_uUPOZrL<I}Y4ere$v$FKV=St>yAGj7s*m&R0+lfLjt)8wBTNApeiUQ74)
z-UBn@3w6OH;ge@k_ZSX^8>CWOYyjnc#}(ggujA%j#X;%m#?aJ9yvGCtV57&9S>4$i
zCa`Jfd?b5vdd{)n5et+G4tK&d&piVMVtX-9O3M_5A+38m$IC5K?>~W7y!BC8n@9t1
zeu>3DRD_#5S77tWJK=sL`NzK0f(BHIr^`zDqvOa%bRy<<rOXL?%G}@mSe?;nRGMkY
zNG9^V)6Sk!R4^B+h84Z8spneHvi`z1k*&EqF99D!M||@;^v6Ao$8Cobhh(cK_Ylc8
zc^EF<;pGywU32guIL(Z@iLPxsUH0bX2Mi;Kdn`X#zgxP~@wuxbr!rF9zf!_o)s3aO
zUQ&BKjRup5Ce~wKW=_TtynDVfV<OFgUYjUi{8UfVnm80j93l!^Z+96G$N)4l)#_e{
zxx%`uICod&oIl%0cFQUT+N(l4Jei>MXw22>`xfdDRX|nHpig)hg8S!j7rgYJk2boK
z4dyVq=7aI>!>*PtcS)$~N^hr&uJB=0`fjfM4@$YkmgD-4ZeHcIO|bc-P~A#<VUT5y
z&d1v8+r;oL!?R~I$2-7HTYdL_{+?P{bW#Z0+4aFRq^@86ZWII0?c*&xGm+wGgeey~
zs3zrQ7@YLXPguXQf45Kk*!IA#`Y+AdGEKx?pI~FhSmu%Pkk2ZK_UfhCm&T_b#R|lk
zyz*^&pbT`cbA?09pAOoonb&w9&OAT)cubixeZVMl=5EH&#{$ZiWu?m+<leZ-vxx7q
zWNvs4!Wn3=eyGo&TllCfl+E~>H(Un!W~wTKz3V-H{RC#r7O6E8600TNCiB-P^3nM6
zJ!kZwXg#w*k5*LnopFmz{x?O~wZ=7NV%R^U6JUFWBtPVsy7cFx={3{wG9jhoQQn^X
z2x5FfRCNnaR*XBR{6CQww#BQVPvpgudGSA4F%-D(PFIcxSgH!~T(O+@*#{iezhf~3
zy(q98e!AZq%;sEl;SD&9Gnl)VqbiIC_xwZS-%<i23WFbW#7_n<m<>G+rIB{rNZ1AE
z0xJdar#&`3t-%z^oqoZtEnhG>c)yt&JV;$ssIM)Wx;s%5g#4uEx{JO4(o&*cLnt;7
z6LZ}@ltr0=1q(|dBuigPx=e}3Q8=y``72q3OpXve1g>Ms25ImQ&03p%uRl!)yaGVP
z|BmN5ajYaXh1TjxSzWzHP2@w>@bYb@MTD;W5;CD)z<CzNsE=i)MYHDKxv{LbMq5@7
zi!$mB=8i^gk=EK2BHC{P!4PWL*RKizRor`EZg%k8X5W@$!HUJGpdCE2pz}bomkIm6
z{(O=qNI6)HlhJ@7-VhA%FV_|O=AQ@WN1xFx{>oD1_l54`$68}*5XV<}Q!y&A&orc~
z9fE|&Y_4%Gid9ZymPFBPN$`sADt6q=fbOihxcn+l!OHJCa?a8~obP%$<({oSU9q<e
zTuVr@l^3y?nEo#p*=|IsnyIB$d@W)p8>N$t0P8>U`hU`y{>u?={v`7TqkVp`b0B;Q
z$V%zV5~*PR=PV@Q*x#qf_yWY$Yz<hoW<ul77412RUL9t!Os^^*sG(Sj|F)2(Aav@=
z*wq0isS9=1I1ku1oEDUq9$J{|Ya+yE0Du&+J}oL|S|BW-{(8kK>7D<uC3B+ZIQU3&
z%+RC$Uk+{;-qEAlqP%>AWzVnR+<cjM#ZTUsq=S^B{m29N&KNyY#jem&;w7~R1T-fT
zajVU_K`Q+-=WL0M)p;jRbq=RDB#$4c9f!i(G~T9a>o@7P7S%}6#dBhL<^(z|sX68L
z%Us<G>S*=L?hGsnIv5-Z{#V<-(zH3np`@KmGZR+MJbX)9?gL5+?fmPR<H%zEhPhdN
zhk^S_?$5mD$Hc=$UsVsHYnb=v>dlO3Ljx8MuGTISA(lOOQT6dG(_DZ=tW7R{3JW=|
zTGnMCtvQ-BSpvDyFKt%m|GBFON&#9R$xzlaC#SbVcz|hlIoj`<uL;o6#{zIX;yOi}
zRbI-B*w~<{Tx9VnkC{9()w-yOZ+^0b;}=8Xo67~OH0<_@W>TE1>tBkg75vd~BEuQn
zNO*H!J-%0^mD{|3i-qHon^Pt|);2opP+7eG9vcYq=XU;Fyer|?WJSc!5^qZE3y31l
z-y+K2Nxdk;BFJFsS|^4L$x*<2vWxx-se72_EcblrrNS4Mr8ED=c<<D-q)1o%U8gn?
z;tKK1f`*-9a5PfPY%Wi`Yy`b23uJjI(KL-kaz!Ooe`$3C;uJ>bPEuo^{Jr-&N06Lr
zkf@<AHpAyR3Zp_ZhkJ2^vN)O^BGx|~+qOT^-L*AN(E5rIcr@-un&EN^HY~Hio-!m=
zaPakDtC({fT1H8Pw=lni2nbOe9^IxQ!>ISz<yWP(AFc_sWV2fl(&LyTP;ScqcpxAK
za_feR1MIJE?kt{FD_WKRr8o_N1O6cb+PuHqG~-$}5#Mm$w)mV?za&ZwPgh9^?x(WF
zuRm}hCP1KsrAov@&(^pZ00CevQJ0>}trX42vf|mRdpezAQeeR=>nB--7V_?+9=%`P
zf2WeNr-=cYuj@W9##T|(yRMEYjxF)%Q`m6cNq4X@;|p)*B};5Scdo*m)DTIt*US+K
z8E;cxXwz?Q2Mb`AP`iK`$?|R+a(=2<Q19A0zR6)EWsgoF<=a-)T)L2*4<~u4gY_T&
z6EKmBjO-hws)E#zsoJ)OslkcjSa4S%*?y9zLeT{D0|`A_>tcIt#!p0gdCP2Ry!hKo
zL+qJ1E3Ot#Bz8AfET{hV{h8{)TGq{5wcuW_pAZ*VU#d0f@-|h6HZu@+(TLQ|4?^?$
zh_SE+;H|_2Kh+wfKg>f&y%P>+zuEUqZ=sKSkRG$iVcYRUNt2^(vFgP4*YPMtl%;iY
zS=DjtVFP16c~+C<Y~?sfk6zOfBnM{hY_CT(6yrX*zJ29Qb?cI=+%(~00*L5?oDBI#
zR3%UXD3{DYL}gW;3Kg!;QmEnPCthdP9AR`jVzfZ}BGecEqKb}yU~PA++N$$#k?CAE
zvFks9obH3<Dg=V49w>)C&cm7(@{I@)^KyBXqtkV2w_>wnr>kXtwLn+uL6^&tnK3Gj
zRBi66!@3*#@Mlsk&)opd6LCau-L*1zwm_A^qk7*WWMSdP@D^57Q(%mx03J5lAWi0c
zqoo@3pIzI$gSV3v)p_j0Fu7P&cikM_+QD#=xE5uzbJ9=*Pbrzt*2NknDy#tCO*8kK
zO|vJ@iKtWO1Y7WEkhP#yJm+B?fHLneeMm}Rn`>l28XI&P7LRYDmJ8iEp4(MgJup)f
zWI0V69S?qqu~LAK7v@;Py=`Ou4?~Cqpe8zkT2<@-w)#M38cS-N$DJFpvQ~D}C!3Il
zH1ncC1yWtVXSU^ZUP^%gM3Le4+mAUf7kw8%v#Do^PjtvaGc<KCSGR^zRWd*j-j5}t
zLRVf@J0QQX<BKj>HxbXj=*gA^4O4x9foRh(y{c8_dea0vrD7@W<y5<J7TDLOvJ)r=
zgK}<gHkLkvNZfo`Zd{ER_1==o=>*aoqS(%e>bETlHj7)BfT#j<#F1LClC^@1@sNOi
z?65Wq?cMM!=b8$(M6E9iL^E60=je?P=0d~_ukw{8L1ba~-x#9cw`njKxgh>G17u~+
zi`a+7nRHL=wc>YGTi$$_wID4p)@L;lT2#BVYab`~9%`2pvCe@a3QL^!=M6M80F*Wq
zl=}{2a(mNJO%NvS-xjaD{6h;6jx8uxih*%8#Dc3j6G)0?>fY&#N|*T*i01an^lY=A
zteUz5HJ%pN@HL)dO-MRq*{?c9TX^d`l`$a@XqJVjDLS%yFgs*@azW4<fNBZ)Qe!{=
zaM#3s5PIH9Wjk+W%t7`G#jKjSuolc~(6S=TJ1Ug)UXH)wmOeZyP2);S)W96pup*ej
z?9T|!Q4I|uor<0+X{ZQUe3@=S04wJaI2Ebp`rVf{ZCYUZaB}xBnsmhc&hNr~Gxdr(
z)#WRZTZy#RWRMZ3erm-+E<-(hPO4%chZ1)cTip$L_%l71r;W45T|spY)|Vjk{7b^<
zJnVm!*aSFfDL@CbP>b$5(P+qG%7Px@)5S*3T|mn`%gD<wd-yK-Uk&a^I`@zSc8g-W
zBY)hI6a~)as>*dKFW1U1;s_#(rftwQh-W&A%b|GZa(kdqJx{e-$Fq*7+0Ue_QD|&j
z(}z5lbfHKJ#+yX3Q(f8QN?V+WF^7!M%AfFNRB8^lhW%~(l{Pv*KUs<n1pLajO>=OU
zq!IPTC~uw-qVT72pLSVz&f*e9CPd}^=^LLLlP<8xuIfEGKFtTTHM?__AYXkWvpn?Y
z9+LD?l>{L9*5^^r{-rUuI%PLLbRV6o69HK8SDD{<nfJ&w`Q+miyZH|z!5?}uY5XuC
z?xZjFnYUVJmTnfT?|-^cZ=T_S`134{{p$Z~>B+$gFzNm$HH*r_bb6v?#}uo~g%R++
z9XBd-&i#Pd_{o2;_++q}B%tB-InaQ?A2Wx{pxjj-&Rf6$_VAdbGpl2CrSU%LrMxsv
z<yEH625;d{=%=by@z|16oDG*2S~#PVB2v^*UyY=*@!_TN-?!A$Ta(i-N_lG)K=}7p
zJ8URYaSBr{;q#omb!xzZl31aUn|o{ymEI=0ouXX{b(MZ426GI_86gjCDLQ4Vab~*0
zvQPR%V_C^F(iiSq)H_lyz(k_;QT^eYE*r1rz9~MlfQ5<fEIAZDb+q$_(6pjDeAe-&
z{nS@N{?~rG85i|eamNR{>>bXps`cs*j298TsJ%;Ud{@KH6sTZ239Z6CaS$P`!KI5Z
zp6_tug5eW54lRc*)l1(nSFic*&Y#$ovBOjkKg8lrMl+dTQe9tfs&XiOaZjE4<y-<+
z*t?CB@CwSiF?@7Is=n&Bf*j3KE_>fhWf5G7PE``MltYw`_7u{6^Olw>slG*-CY-Z=
zK5BDH{BX1%fwItW@3V~0qxkJ8X*I3NY&(=op(DLHxwz`@ei5Qe>%$4UXE@t&i`h{%
zin+XDjycu4L^<rZ6ccgP46DudLDtezl1eekWUA25d|PL&sDkO-k`F)SMk~<<Yx&WG
zQR&JZZBGd(S6@g-ez-(~K7H~0ci!>^HUAM-NApE4BeA)!r5{GvDByt4QYg)jjUUa<
zICFLI`=PNyE5Gl81(?NgMeO*fDs675$?3tHbpItx0Mv-ew?XXaPN<+FQ<eWREKqDX
ztZlVACr{vASdMY?k-kAH`HM`263%_t|D9iBtj^*-R2_?5pkeUScIGcfJxOjGwAFm`
zXjIurx{tw1&Oehax-b4yT3|<V$Rz$vS}q3z%@a?#({tPOL|pI-9GfFL9~qYx@g1HR
zg!DKLSErlp9~$PCQz~Co1e#x@|APN-c`9vgqT202s}xh)@O!^>)h@_Y4iCz$42a%y
z$B7T&npJ)6J1gl8qucK@dSipP<Z?tpq}%T0>?>}W!d<}WTKZ!zz4#SX@FfF0Vlf*E
zb17~dOTG$00}dc5Ll-&bBuCBjI#wGUI(R3&#HmU@d%tf?a|FFaQ`_Fi!<ZbR9t3pF
z<}Aw3?V6EaLAjnkEv<}YwoRm`O{pgBf=|4iw1v!}mXg@s_`nQsZswSz)-lh69^p8k
zxi8TR)gBI=I(NkMR6Py?FlKI96{WZ*JvLe&S`f3^=5ktA{&o&}Bnh(YpXo;xFk3cA
zI>M-=+l<3H2?;FQzySS)dR{}n)Fd|7AyV+poS=<_Dl>8I<;bC|#r!s2Lzd1b!2*gJ
zvZ^}4vKd8lyI_=l7N%YA!$E^Yh=-O%5@NEcC!+qw<d;|7mWX1e1xww%TdArU#v2PZ
zDm6QnYVH1Ip({QiMW3-(J+D{$W%tBWg<?(wkb?q1qKO65G=7=$?5|EC0jhsFFFRHL
z%%C2S_R&0DEH6Z1Yy3IZ65UzR;x{Bsnk2oJDilvFf1SH1S^_ZH{cMc!O<?<vOV(6u
z0;ih1xT4dpv8UT+7>HV{^4`H*-0dMG83a!%{u=hB2DAOI$p0q=;n+u!2=UisTWwHz
zc)n@MT|-+Whs_FeJ(w@)ah<qdNVs99s(eGd89%RR*DaK^x;rg!M_6YnA=opvd)J{P
zISGQ$tc;ry-8h@_<%WyB-qlOynoJr0kfgfq_RkIfruoz<<%vBA_0fOzeyxf1cB#EH
z{3{-IH75oI*`+7JsTWibrmYceqC$`=MyvkQh8<~{(cdu`s<0F2Imf|igkEr9c-eTo
zQEl2rC6#H6CFx|nNXWmk1CivO9m1%<BnGUuqJ9_MIzs<J?oe>|I~@7&yo2M=xnm*t
zmr)#dWP;a01;=IrC~_{OuZdtK9v4;oo3NeQ`rplibk8zlPB;Hkwsof3XTN#DkLi{z
z#yPmG#0?YMZ_WR~mp51L9~vtsL|b+izZ8QjlE#J|1?v1G!zOc=qlK4ua-c@u)P=EA
z+vA;BoJWa+v8wju$-wjcU^U`a<-IknDMU;*;b3rmn|NGf?D@(DvM#aZRv}sFk+dLf
z#oBs*GX}~g%=g*Y$u!Lm&ML%Z-7|D+Y}cP|g7tE7YrV>R2!2~ke}=qIq7Ub_dr9xV
zmR{nTYf-B|q$reKdZ@De3xOJCthP$q=g%`=+FT|E*rcO*l&~+jqYKMQ)7e!~`=*M`
zMGzAH3Xb?ja}QM{sFEe#A7Zayx~J;CjBT>H*~_6c>j24_cRh0jAKE6ke6O0`xQp=T
z3@=MjOjK_EFX?fM*Pgb^{R)h>TWS%S(C$gZ*YlOc3CffFjGYn8wWh;`#?*G_%=Xw`
zWjc?zlQu<;%l1fTyx39h2`7*Wwmp?{y_&Tw=aEL~nQ^1eLn&+2(fLUGU}9v}Q%<I}
z#z34+91QLER2?UibIaXIVjx_Zv^U1859C5AzpP`4+C&=0sq%tZvPt!B!EbUX&KV*a
z4h4~YlPW+*Mxu)N`tZyz-T4s_z!i>2OhXfz&Du183YQ$N&>4AKNEi!cNb;S$$sVzJ
z_=<<Q;FDtJswVom%s)K$RX7tyCCGOQJ|I&o-u7n4HM!E%eWGqucSn*Ly7d;S%#5n9
ztXKY>p%)ByCxc9N+LZHyEp1s)bDV$yUf3ybb1WJ|GG&FBYlVTEB1OlG+tXN5mJ*Z|
z<>DqzMF#V|#?Od~&8sh-G=#t#(~s9@z=mb_38D&{{0WC*U2(2`riR8M<E0>+&!IO%
zZh%SL{AO!2P1Mj-3E$j%!5OCmS$t~I25nFw@~p+h_~6|?O2J>R7FUs>%0lP^0;*Ll
zz-?03VEY_V6y~jf-l(w&LT28cAIo+^SRE!ce%#trTPYmn?x-Cqqy12B)MMB>5+v@I
zw_lo7&>;k3GOC=xYc*G_?JxdE7u+^J&=B)WK0UATxo);e@AXzkRW2$WJq~(j(s=wu
z38E;gQ3|>TMpuwBUb>>&r(%!-yL+NXMK_F1ZM~<I$@0m7*DW3;7K>F*BJ$Y>3A^6C
z>l%g9)(0lqhb~5T=oH?%i;cS0SvT(8>uQJI^taz<)x|f{3$G-c$8jv)2;E1VXF^M@
z?ienti(IfewcVSSs+=ZZ5I?b8swme{?+d0{(+p3?JBumj#!|_ED&iV?phvu*_Ne--
zLFWi|mDxSLOn5m%@;~~KicxYb4bT1mM(cj8tn}%KBeWqV&(bTx!xM=jDHg@m!e?Bc
z;L4CA8#gMLhqR^6k0lBysZ<@(aKQ0)L_K7YM|D8MxY$z!G;Z1_U5JKkQezs~nIegE
zL`WpkDn1yyDS$`83(v<4<GtG7oE6f(o0#wHlG;L4mx9;!@um<w#?4c$yy8DAN&Cp1
ze1_u<>NUIoG6;&0x$TK#e@!TyII5ye!6>0BFcfCc9r|@MLXfEhm+LjlPaJN%vug)%
zj+R39Aj;jfNx(xIG(dCx)uwT1f>x@T%O?WG60xy-1!x}-T+d<bwLW)Or|@o--YNt4
z#*%^*5@1`NK9245*Rq9QDg~&kw+Gd=_G>Ctn1a)x$5^G02X9;*Ln617uv=8sZ#zXa
z?oK7&dYIX2>PV;pYdW;3^0<IaHFeNY_QI8Y?Yw|V^Mzjpndfhb!`T#>_7s1Xhupt~
z;Vqg>^PUOJZmH=cOq^Kq`-`oCz=M<%c8&UQJTX=amIMcDC(<cB$}DpK7rg2G67)+9
zyUL(q3A4e-+2L&D<@cpFS|Kv1lmQS2N-etN^k~e*AGI$e>7G`wV8UHxKNdtylN3<8
zG;xmFP}ncem_b%z5hr<KYSpI`rOd?=wIoHnjdfjK)+BJ+H`bUziYX5%yFZuEMZ1F%
z>dF~*(3&^daBI#o)gBhtU35NIO)s|Cz#QhhbWEj4jV9dTZgr)d^iZH{hDe{sGj|%$
zY8^&6?CRf8uUKLoa4EFqf%R3bUuU44d2=|yt2-Aj<l77x(;5=@#yF)0_pIWlyS(q}
zI(e*^Mz&Xw^KLDW5G76c@Yp^Y?#E`ODn~P)dQ!-C_l;MrkZ1GRxSut^C6i3(#3&t3
zo#FFUzI}xl&zLi{=lRn5F}dL!EGqB3?K+b5cLN^D!#4L}gA~LM35j#R!NVt9L0JMq
z79Q|N6P82fzVOBVA1(ltypRWwE|9c<Pr$==wT{`bn?PJlz{S+W6_tqnGM->LGt+b8
z$6HcseYPC{E^rUBC<KOzc|<eeJ&bFd(fWm1+XKv3kF>44pkYD_laXB>Io=$bGG<%W
z`oP#m9cF7GWWisn)rcrAZNl+`Hh*<}5HcpW-`rQwojY6P&q?*K@ocvMAtA<X?bN1N
zKo9z_$Z|C0#t_NKs=ZD?ATEyw&AcPZx(TP4I#4?dy~ylh%c7{Cv~8I*4O)-b_*x)L
z#^vXEVgaOTp3A&bW!2vjxs4zd3V04E)+5!n?kEVDMnpfOH)<z0KNI>J^Ckk&E@RTU
z`imp=!=Zu!p>HZ_HS6gRlQr~AWigm9qqJButsLb@IZhB0QFqhc7pgYCsW`Z=Lhme8
zZA?|+kWQX%Nko5UeylNO9kYkqaN&LbwPVnOC2-e(lr8!Rr7SR;WBUTM!;xOlvvndh
z;YH8X*T@HdC~+@vpa|Q_(p{OqUQbS++Z64C0E8m&Z;3Tr$mVJ>wb8#%RF)I_V>fdt
zsrTT+hL0}Zs2uq-wWx+2Dvp0QGD}08Tu8-Suw2vMv*dCw%2#1C6thnxem=Za8Ru-V
z=E{VjMh#YTTOJ2eF0PXR1s#)l2chGU?U6L?KVf-MDC0uj{K5NbmE*YAHpiZomNm7f
zoR;$k=cx~acc*Uj^(3>5`clovO3T#;Wr72caZf)MJD68($TMqC4x*x(G%8xGLst_s
zuD7DZGg4&TVg{uiL{oS6J1PcMPwf?=2Q?ykqRr&i+VQHZu}Li1@hJw&7*4e~I4#=o
zkRJUxEznQPYfnwk=gm_&Pn3sJ-(6F?l${ds*AY~T`S=BUOsl9Z@No9Z!~~}OiOb0$
zMpEHY3)3D`%bb7pDaY?g#0D#*Q_1D<^;#p`Ph8-mO2N428O8kldYZ|vdK~M|HSC^Q
zuA`wuFaTh7g>hN7W?$`#KMIGHm6sVm#_*<^mFLkdUh>a_5>}BmLb?z}eD%F!iv8TY
zIVAPXcaJO2j$=0$N25{xbA|ITE-&ceO2l)>PjmVEXF$~q36v|Wl2ZF%S<*%l1BRE1
z{ok`pw#R@Kcpr$=1A0IYW?aVl+WrrJb$bqB`0$D}Sg|lW`_$zGiAa;6@}HUIMHwtM
zvUvXt-_L)w5mNErR|Y1I<{a&cvxKS^`h)};CWX(V;7}3^|NIIZ3hv*r{I54HKel&*
zhqwxp4RVdsn!G46@GS<V&_Gz<Eoz!K=>?<Um0bUB4091Kgz=sGMO$z4(_9q(-;-@c
zhrp4T>aS|xK4HTw80^*`*{63j_zM(=Ewv+{dReuE-S=1$?DV{ZI>kN~eh}h5V&4j;
z|E>8N`(XI-@@=Pbsn+_)i#OUUY#P5gp$aw0wkNi_{QUy{wK=6GwyKgl;!&@f!rq9k
z&C-?u@6H`VlqYdiS+U{pxmLy}!wTiw6<l;h`#Q^#-o01(POv|DihUYfg$U{33i>~f
zogdZjoB~VnDz)N-7oj#{jOwXreP!E*7AvZJxRx3$0f*S%PBUX!B=-)|iwT(eVn33!
zI8p9}bPSI^wG3e@wAs~bmJ?TvA}f{ZU-|?20FFPTUbNN#MnM{5$%YGAS4wzDW^6qO
z$KT1?&-Bnh3BE=oV=ZQ%mngmcX~<@_=9#|29c%TL7G(KE&A%gFfY8@oy|YiouHzDt
z^6~r6QDOhEr=A5V3U=fv7!mUHXE}>Sn><ZF+r@1}^p3Wz<@XO_9M<W^OjBe6rFOoH
ztTyPySm$;FmMG`Pl(iQ9uvPa<J)h2PI9KG)5~vd*>hm$qH@kb4*Hc`GK(onaY8y&3
z2dv^_BbRdIQge-VO~<jQzLJS6Wq!)xumH7d)H?Q7^!$qQfAu0qd~)kMkJEruk+&*b
z&6_o<MdS&vU?&myd&iapxus!frd{3zSJqa<kFI)zRl9$udOEXz0@~}2B&t?+YdML%
zj(`guX#+}8#IO;&{u9rr`t40}Jw2BmQc^*%p&lys+42)X8}>k|hXQ-88*6|5!NTji
zHv;~tP2oLirv^$0riwv-gxe|6m_`)$w#@erB9iG#6crY1DC=*~ZM!?HXm9P8rmd;;
zF)3yP0RE~E8*2-AZ7w$(BmyfpJeDr)Wjr?8lcOuvz4m#p?G-p#M1BhtYHR@&gyW;l
zWTRP8!Ij&}a2&WajUjV^)O8CXi?oHRFMU%0+;?Cpw9sF^IY>}G<E7^}B5lTzj<SDM
zJniahw4$xcRe!^fP~9%_(nJ<xa13fB73H=q1K8RROg}O=mw4-0HUQz)4sXj+%`5Dq
zBZLCAU8@7zl#fw&&@jog1r7b2hNJ?N-XD_h86xi0oUX1Jp<*mNy8hCsfFL($g2;iA
z&POT&!0U@azu^_@wjC~XV|QxZ<Gcjgu--JiRb=0*i<$@42)ql~v<0B!%Yt_B)n?9%
z?d=*8&k~xkvF=*USO0`tvC?-Tj_sgQKF*C5Lw&M)m1D8qpQBmmlq<GlX6_Wi1+Tj)
zJ{`~fo0Qt&9Gyr_s9`3@;qnv8{~8559RJJ~g~WzF++^xEMa8mTZHm9SDPaYbn#Q;0
zHVQXUU%INEJ#GyuBq0Fbk9eVX+wu%4y|not{PEM1w{I<#yT6`9n-=NwQ69l%@CG;X
z63QR~sDIMBq4cNmYx|`rw%~`#SIQ*?BJ%XgyH5(5Yi?c0X)T31K6@lixpgo>B7;qV
z`y)&b*SJu`eFXq0Xmta8=4W-Y8G4G&+SnA$IFKe~Mc4?C@aQoY+JyS&2m8jbw&g4U
zU{b9uUb~tIs<&XeW+j|A8QcV!GuKmykGc$V6`AFX9q@L*m%4Ij6Vne7ae_#T0NooR
zfbe3CB^Sag@YW9A5wxRfOK8vV{>^V1_1Ya5&PaCKt*IB4`FkEZ2(py%@k|qU0tT>x
zSKSrBxbL<{r^WioZs+xSpq!{4?lasHzN|zE=E@`2SCDP^3+Wq&d$!_x7e<IC(j7ji
z<7Nj|l>$a+M%pyl%T~P|@wbf?OWiR3khfRSl+>*W%p&smbJiD2T7DIbqyeCDMh_?&
zPW{0|lgkyHq3XDy3lF1}t(8!Pu5eEc%m6E~`-o_125Oo44$pt9_^2W>B0~@-fZPfc
z)e$*OnnEea=x@8U>yX3Hw%`2e2^GArKZIg*1K?}bACz!v3;k0rN8ewy6}Xt(w+X+6
z^b@+Al}Lm_5}s~&`{~^b{i`bU7LqHrCF`!i-HUzUZZJ0pCyYvG>4_?C{KknC<<w|E
zynKOPG>&*z4H-C6qsC|{nyI&8%F2W7_jY=<Ab!Q9aewJwT&yq0Tmz^UbwFXY8HhE&
zVie_O5_^hGaUHc<u4*BY#||A?w$ZKOWe^)uD}|-a<9~6-h~bD9VumSW;J|L!%o48R
zj9cC}0wS|-QQaRVoM3dc?Zg*vr-quU5VrQ6>?yfJ<@oa%DMdO|QU7P{bA+aNx6Lh)
zTaXRHCGueaEO|YDk9pH28AN>;7j0MS=)@5LK$^R=7!N0u9u*JU!o(^70sx4z0~ku$
zf6oIL2tsC^t=_@VeNs5To@(xFyZ+Jx-;LfF|8<4qv#{HGY?kSZzDa1os*~<#eo9mv
z8F>WHfL}hLsa6Ab6o>%!xNE9K9bgMt6w^1P;-*IxN8<};r4^-3+tI$e&ySG?#1CgU
z@aqn@y@&Amrf|we{nP86CvCocaHkZt0cWTYIyo{y;|rG=625J;bM>~xI<1WP^bqPG
zrX0A_1>z<McSINi2^VahF$Lhr%K8co&`%N~@@X_F5|6>7_-;bk*0ST<F>A-oxjTxv
zog8)9CD?>oB-J+~>~^A@!Nx~97~Xi)fpj_E*HN8w+uH|2n9&PEQC4ItbOF`#ynRmg
zZO?y{;#wM80`l>hs8ML>fG~pf3mTc^EiJ*y_pjG{XEBrso%koSFy*HC-?7VGa}#>l
z07RVMLTP2~1FJ%l#Yffov_M_lesOT@FZw&$YR@PaKk>v5h7uAJ5LJkUdM3H#4}!z;
zYdWy9v?I+jLE4O)YzDgE!Or}qY(^LmzO0beSfm-jI>Fk?#K&KKe*3Y0eL(1i!yMD{
z^WxWl_sg87`}*^|uTa5_wLg+yZQsw6N5H02I|^erxB@wx1|J)d9$}MgbUs$BB7QD5
zrExUAfF;yiZp2_;1RdMk#NY`Q_Z{vst0G)=htBh1Ah>utE9`tVb~N8zR_et6zDk*y
zeTPw$m?`u`Y^}<u$x3wX7bTC-{#hu)QZ^>3Va1WMJ#b~R-fhgDG>t>fTYO|0*|TYr
zd~i3oqe9=*rHPC9&#dhzzu6G@`Sd2vpF8p_GmNT>BObI{fBR>g0*4v&{Le&@e_XFE
z*34e<wfRRx7UY6q677g-6Ct#nBlS^7nl|=|SFm7@{kgMLJBFU!OX49|fTv>Zz7IEg
zm}!j4+nxmI{r5l)WrOrU7R2w%Xk)sqQR1k0gGiBd6+ZeZwe&May$78PX7HEV2kfr&
zsAA8pAXFr`0c}WMLfaf4yqw;(Qn|ye-oh3IFhDzVjknC5lr&KieTZZyOmu6Uhqo!?
zJ=j;rzM)EG2yQ?FS5~Uu*!m+CPRUE%7Y%q*K2>mMnvM@xZYD-csu9S*cDAeCadS+4
ze7}qL8xuRF6c$7<GPif@j0LcsUXYb1{)1~TJOvS8|BG4!gsyad`5*RKf=(&5E9*N{
z>zxOMZy=lit(rH8im-b7*_IY*iECO^x|ja+ty?u5n=hYH@S1JSS9yawwxl0}$ZdH#
z<aDO^6dwcP05nQ}lEKGgu&-Cbadd}SOJnsdh$=6aaWQrauz>dX>o-HU21NW1oDST!
z1+Q$v1K2Tb#wy@DHxwA`DLC6!wh%0nVJ4WS>sAJG4$@^HqGxU~&O2r7jKE!I_p6Sx
zZ6qAQov<$A8FfN54ioYeykO?l%V!_Ny<;)Zg7}Hp*vh^!kWp<mr)6*?f;s`t@N(GF
zyVjGAhg191o;fy2IfVsh<8$Jjm+@O6g@{+~58-me_SQugoJp9BvJL~o{s_o(aP7cH
z??JgUF5D<{sQ2?^4H`z1Opp1UND?!!n@rxX7Pzhbif6$cowyewb$^c9jF{EGk{Wt{
ze$m8Q>x7&P1n1ipr{#*o8LSo?q;yyQ*PUN$YH>G{HK$AljIj7R0CTjw_!OH{coP|(
zJ&4|5cgkaoM>(VFaXIh&9oKc!puW>m=H!9r^!_%_<j;YZi&ns@S34d?8qb&1W&g9)
znvOFQqpmYch~9!05zol>AzVCP>8BQ%6(jt^?ysbkMEO(Oy7o7tq2Zr=Mx6s%fo^zp
z@$xh5F@5Qh^5Bpoo@_NEh=N|R&XB5Z?B?4AK~J1<Uo>2N+n(9PJ+G#X|NaC_HVoRH
z+E*xTbZSJN!xDj|@8CS9{^Z~u#oCBG{t_2C+tjgjwqm{qUfmg7985I!hyKF4m}c8J
z&cS5LlbE$?Ahz1>(b6gl2-uK`8m&L`=z@d7w2u}%wQ+t^#a~bN>fU3LNttp+TBGvi
zZ=T@8kU?MW*K(lcBkG%NQd4!eogo9jy0*JN4;ifacDS({kd}a-i6xbjT&pcEEy!3R
zVTac61ws+e!B9)M{KcqM<B%7Q^3?6I{84lLgO*GCp@Hy}uH0*S5=VU)$+Cvx;CEai
zI$qdn;<`r7xPh&INe13ckjN-JFqOq>PhDlKmL`owLC0<?3x^Pq6&(8)4VQz2J4)6E
z0lr$y*t2Ck_`61oD$gLMXwG>6P?k6)QJHb1l;Yn#Os{ol`lO*gR~-p{Iej4fQ$Y1C
zS@Yjc|43#n-?LYZ(F2pcZ#fPD!Qh8_r;y-al<L(FWF|(Zxh?@oac-UPyO5@Y?MNMo
z;>_2McGMwY{rEjQJnZ#Qwz#EOL{nLAM(lAu0>pmt7!4R8zS6A%XkD;g*dJTFU~wUs
z*^q!0cpK2)LZJ3<1!tIHCeRTJShsY^t#^=Ur8+CZux!s77&SsNlVuBfck)7yWKf;f
zk$ApZCgh~TRG@w+1^tK7Do<#g8uwrNgUu+c+wYF}J2Cp_tQqzD>^NLU;hw2F5);-%
zTf6Oc=ifGXg1qo^e_Y*sUxl>EuCRg#;f7G6pOS0T87GgqknWOodSt{7c+RPYxd-bP
zh;3a}P^N<*#{-yQnbRdKqWT0O1C*pPk0B!L1>cdJv|yQBx69P4qDc+3Ni^FfO|3jn
zhS0RfTffC&qt&XZ%LnmSWB4LGho|S~h>b?VulZ(Jjn>6QayS?ntBWeQ7&l{BH7=!_
zYzpmtt^^<*9kZnhebh+@gJ|#Rir5?ffcrBye5<b@LRDafA}rjj9W8KJW?K${Rl5JP
z*FYz+JflEImQt|jKZbuQ(8TT$?P3hN%p%Z+(BlH*cK9?GV$HiZhcmwfX$#VkL#kln
z>TFEkh+;X#+07^c4FAeRZa_R@Wb%uNHeOpGpvApdfowACz0s}ehg2LlOo%|cxSJ<{
z{&FCXSHD7df(mzCt!B2?)T5G%V&}on?eS+Q8*%Qp%=F%XV0i!_ir3$F4h?ihn=yii
z&*#yq1x$hn=Dp^3%FKn=)u=bsL=Pl$)Q=pVS8>}$&d`i@l6lt21uw*1dFo9qBPqmT
zi3)?5n+oR<P~iwNg_(>qTSnyRNoI7m=7Uxh4pVDFqgi9LgT+saWI4ZnwN%ELJ};)}
zH>mu_Z&m&_jre<@kHJ0@#upNU0T?g5h@54tQ#o$xi#lfP{HmH!6?!@R>R0ief*;0Q
zXeO#Z`X^m`EKggVy2CogdErpGauAq$bsT!o^I%FB0v}O_665UPL~4Fc90wxZy_+n9
z4)oV?>QU4T$itw~KUWT{Jra!c#Fp(uSbV5utQFBErn@Ci0hr2uN*C3U)R-)f#J)Yw
zYB{=v2*I9%O=pzp*8daoUso55o);g&ZO>2jo=+}-#%nMwSH=5%7JY~YQ(sTQAxvJk
zBM%O`1tU{t)WNK#NVMkoAJGOH#JQiadWbi05EO?qS_4+j_$!bB;GTIf5lgdE`3na|
z2;J7TozDI=*FA1d_k0eY%?G{PbGRY~Zk@{*1+id}&Y+Fvx1WTNix35xJ24d6_c++g
z2x-FwuI*`;yl+pEh_Gb4b?b9P+qVjfx4j^3FGb6+2-)qBT@i<lddix^9=;(UZcPS4
z>&TdIpi?tX?2pWET?>qv#nchl56)aCC14=_2$%?Rb3kWm-)SGdI{3!@jzdj)$@1xk
zJ-ZB4us+Ty5ID~Ixg1>tM5Hd1aigW@+y&DBJM|zYXXFf>NPqdq4>ma}{}H4@cnwc6
zczs0*hT3+D%Xca_Qb7RtRk6B#iuwyASPt2N9PNyAps77UMa)#!(VrcI^LnDfqwq%`
zVa}$4t-<S*EJS65_mL!H)#w4vV|V3K`(0=)&D~DXt<=aMoL{}`++cG>TzUh4aB-YS
z@lW?of0s2zNW{_f`JvVsX^IByV9=l|mw6=kkx9xm03H~8pRBz+fkI`*jyyYGzilAu
zd&U|xamYxFj<iJ^tt5(#)l%4m3Mx%RE!MrlT8UN~{9O2@?~KAY>}O_TDik-9lYejZ
zR<@q1Z6bs+$-cuKF{mc$5Pp^<$k_wIt^-S~%$PQCD*o>-`JZV#&?CpQPDux0%?@yL
zDHI&hlR|=%z>e>Qvsww4k1@O>w&IG0)0M&jyXRcUut`x5n~VRA71Iv0)vTSQ!kuw7
z<hX<x;lL(^4YVd&$gZf*DUj_~)>{ks{Q}d0*--oVN*oC1)eM!NH4x5LyNgtXgS?Wz
z;M)wIY%r*1!GVU{!)tyt-F`4SW67Qg<PS-COk*(rBzh{*)9X|k@Z75kJ@n_pZ@p3c
z?M<17;dr?|j0%v!aykXmh3*;$<Y>D_(hB=<PhgI=co^m!Mw)l(hYLpPR6%#YAoOSV
zCSPtp?21uCR|?l~xxD)-A>>RMQy)NXj}Erz0c7;mZ9ClAin99;q)I)ZaF+tFZ4C|t
zoVbGWsVFJz9>7oofQ(4K3H@ROVNVQw=L|+E$P4v8M8T-yDHvhRhx#AR>`#5?Ogxoy
zIk4JTQ-OM+6gxirIzO1v56k+cI?w`17+Z9p6LFxUpx6h{em9yTw<S(#53}g?aqr=S
zap#5&K7WJV(IKZdMS#h--&E`1BH*IWQS#Llg}2O3I_B*A*B7*%V{f1g(3O-rh2ccc
zo(so8aT@f_9?s^vzLHEik1DWknfOy*J{0NvS*2;nOQxOiXdC8H|8eq8C%;_a0f`XC
zoLuuv0<^#{Av&{QlTA9vLTOX0AYV8H8D4whZH8g^KKffHk{7N(gLNzY$2T5yOWmRS
zdZdo;cE8TpsRUJsIZ>KvI2ebs{>QvH-1v7khQIw|Uc!cOL-JC+k;NqfqL=C)m0y_K
zGb;3d?Ebz+tNnH=CR4k>6y$fym?|m-?Zl@CNq!e>hn}to5L1p+xGVTKeA_}|VmGI>
zDyqJDBAfeAlgszM5^jizojmv&@0QZ<IQ#tpUk*K#BNA%WsIx*zWjZlhTJ>s1D3T+5
zJ!$Aq>qH78koK1c7<|`YYTN190dB_~-bPCJi>W`u;6_53N9Ps@|Mi=!Oz%Lc9K=AN
zrM=j%=J^F)TtM(fKyG7KM-$$|2f6nJVseOT@=oi^cW3Nxs4{QS`&^cp*f~RjvU#3&
z#f<gep+j|oOeg=eXhba-GLAs;UI^5lRcZv8+JCgWnK1>&^g}{#{qn%-o(ALqhx?{m
z?wOkkl+o)xta^j0+{{?tUtwGQmpTDs%Wm$-CQ`lH>(_F&fGNzaYP2a|K#Icks|IZg
z4D%%zpf|MKzC}S39<rEq8wY6em0z?+ODmt>zAY~F2!?k{Q&LdczDmlS^4$OBfDg)7
zROGW8tFN~(kgr+7K;6w1M<+8dgqrT&Liy)lr<B&jHLn43NC@<H5Kj)E9_*M(Y~fGd
zDeUA9PYP-TB=2Vhb9ult$uomjTmFf+IMZ?Xi;p`lYvE3*oE4Y+BxB{O^6nrfhds&D
zcZK#|8suTP)AeeBKnf{UdFmw-RR@Di7Cdpy_Rcu8#n1gixF*+$%#K$Fxb?<Rxh$a#
z)eL)BQoQS~IsRniU;r~11WGu-R0($G69%aeaw4_){C~8!y&&$6gH1<L;jMqC9jWE-
zTF%&%T|H1e198~xS?CW*EoZ{|2vJgd%j8`u1IC5e41-EzxFW5Vzx@FLJ%A#EjEx9j
zw;Io=)PFF57RMZfK~>%DDIBxn%G)>J&pw2BZI<X?=6mu{n|?;E$MnQ21QHo2xVb<@
z)AA$TZsvFn|B;BkRGe_Lhw|}8s!I55TY#4)^!MT(@EO9-wfRuqRMjJ?_*C=!RR2{X
z;<pfo@PGBz?rR0Hf4CFvGYSs=P@3uWoCWDOv{<!ZSIi1G1hB>HJ#rk@tyh@bFTF?%
zT2H{%*Ps3uKP6Ne;6?7BflfH#Uo2>!#CI~eJ{$J5_=U!%>;(N4NTGxj(X;r8hA-mu
zl=(@Xi<qxB;eZ(77{tY<J)p$*Fg;cM?`?h=`HBEA!s|6e<H_)si((2eghG4O?4`k)
ztQ3hPCYA?X!vEA8g}V9xwtY~k*LHpG;^@@($n=jrmvjr3>cLxy=GJjKp$)@n0N>#4
zUok6QfW~_=bFpxUok5=7w7T3MU$Qv!zX=5l;tmR4TD|=nm;#5o3zvYJ*HeSVO&CN(
zHk6nD4j)eV9|T6N4mO&vCec(xV&<1x(QmQ;jPw5or1|%&Q8|v;k^bdRw?n5W=Z_zh
zAPqN-+!Uxn#ywoZ&z~HeZvD`ZHK)vm#6Ds?Y&l#G4P-5M;nW;t6{^nu1eRR<@=%d^
z-V^N}-F1DE6&XX5w`+?SW|rp3poYy|*}R}AEWz}(*r(%tCcG|>{Q8PIzsuC}aG!rU
zU({$om9okEa7$&`Xm?t<<E;BjTDY6`JXOK7Ax8HHosR1&0l_|tCJSX8u6EDyONq#M
zZ)@_{q9jgM_$**P)LqPD7B}1e^yb}qtRCF*Dk~qG{a1!}kR(HA<?+V5im7GHkqdnz
zg}vFNj;xP2b-6#1LR!ni+n;gJ-Q^Yj>xTOOA?z*N;%cHc?Z!P2G!QgEa7b`>cXxMp
zcXxMpcXxMhoZ#;6H2QMSGc(70d+P`E-bdG}wO3uW>b#;gU7Lf7NCCqQXOYX@&+qFG
z@$l~_CcpNpQA6h!g(clwmW#l%QRL$stY6Oz1QeNtt>m(YYBs^Mhcujjb}5LQZlCY%
z(CZLU?P+rq=2<_PbC$(~Z;f<Jv><sL%j02{|MskoR<DUxFTi<&MBD6~P9#~2#_Q3>
zQ+lfLSsn+EKD`fi*MCUaODT7kD%L7j5(Lo;ELVic<Q}i?jma$T9WARr<?nDsUVKU`
zArR~6X*65!!_C6SxB5kF_G+=`;Vu>Cp7<8=7uRkK%VGwgUkHFezTXNvH*EZxOl%IL
zy-m5>*E3_?GhioH4tz9-@lOT5RZ3~pl6$?=dZiJj2Ck0vUHEvo7r%c;aaPE5bkfN|
zNlR8fvx(6W)rw=doOa=wf6L&~qAj`q_wHL<4winx$#oyG)$zMnsJQ5%^IGK$%7Dq7
z;|s^Kl2uLsMKhli7>Td;g#vKQTHakg&NefPOF?c@V-?ma5y6@Ir=tGu^p~E7hW@}Z
z1epB*+vvpuaj^S#Zo@S{$Ii7D9>1nz*S^ci!DxwLk!Ej~{;0fG02lY)k9=#?X4DSF
zW~=`{y#NJuv%m4;l9Z6bXN%rmp*(A==7SPP8yiPceO9T{@|}t;XKOZSBA!Io^)DV}
z-L#FruYNmEe>gpGFe^FTvf!x8sZ@!AYfa+2#IzR@Jyba?AV`n#9$aZ4;T^DmUAv-r
z7<@P_l~Ekf)+H{l;Ldqnlsi+RDF<3VWmkO7sW}E=g?!RsIs_yNct3>i3@b(4+_uh|
zk}lKL)-dN*InIf5NHF}Fa2yFy&-vCx&4r_lOGQJM$oUolvh~xyK6!9JIVSR_>vh8S
zqE}_w=i0{kb*RtRliZ2eY9KCUSvXdrLW3Nz`or8z@sI7SzhftK=ga(+4U!!l=j(iO
zOb?sSM-I4~nsy@X1;fYP9>-BU54WfF3Y5Z~9gxP`LI$fOdjl(LaRRl89Ei%*PRc1^
z=4WTW{Ohjc=;O&_u|lA2Jpn{NL2=`8kp!IrnwYqw_ex98uiTO#0NP;ra88j-FrODm
zC{*jACk>C_{%S<VWA#004t;!&<Zww|khUfDXe+!=j~TX5Qi_!Th{F5q*nne=7cgw-
zbDr&uym#@H64r~tYypKIizILO-@N@?iaI-HxGxpO3-AMJV*48)eH*Ce%WCNV=H`wm
zlJO0k_^R&2lU{8rfEc#=QqZc6KVO%m5zYAf7T3g-SCuzif(V`M<|1@5ti89Gg+dT-
zea;GI<iL0}-(v+k%wikvUgjVU%l~E9P*o;jasCSEer7JLp>i>^*}>vDHIT98cWS5_
zc551?c)2GtNUNAneSOPT-3soedhCioY9Q*P)H)%gS|$E#CacGwVePZl^(H$#2Lv_G
z`{RG+XU*ULW0Agv1WbMN>3M%K+uuGiJKGigH{)xfW4R&i;kFLr{&TZ#w0ziS=5S~_
z5$QcCmukGh;GkG_qSAeQ^^qzVLFDWD?C-QwR;J@R;3{Y`$_tc(!xXksNL-KFVshq~
zrkmrW(ci8^_3^mZ=_t%_&ix6a(zIx-rS8gK?R{aXRxh%PY0(nGj@aTix$V_Y(6W-e
zq0x`w_c!VXn5^v_gf#OMyR4tX%H}(Tfxqp+pPej<D{DnrLMNs;z|1pvE<cC-^0)8#
z#rzx)xtbfkxNS-0u+R1=XgiSC?EI{$Q&QdJwdqeuIAvviaC+bya?iwn<9wQWoM*bG
zs;2S9;@_eIG$}uw@EVCyVj~bZOaZ=+S*=x}u?aCOHJY%x0#_T^La-DuA8tPQWj!kV
zi@R|=4}pa?*=tKH%~i1Zjuf9BpF3j1WbfsvhW&>GSfaz}oA&%QtU!6Lb|%h<FPMG6
zB@f@|tjGKLzbhi=8sfQ9jg&TI?F?zr$z57?w&opx*4O7q;h`0#{K&3Jv4dqn&f*_o
z%W3gi-QIGAhf}N_om5ayWwiRliv<|Ahb<%5znil~;;X#HrgnjMjTjPkWEG(*m8Nfs
zx7q&102;hDVXmFO96&2m5(^WKTC}AK_LkNu!vlK4U3>KyAk3mhhW=s#_gQ)}CibUC
zMb#1U*_B%EyO)nx#G4ta#b5Y3J#UR_!Q!m&)TQ|5>i~5fGxlJ7i3rZ-88w3#StjK3
zC`k^~Icb`hYS(7elekt!P0f_72+1|91$87qW6RO1M4Va28$VS;L(CKM@-La5i&M>{
zti=ZJXh{ydO(_e3XbbKdD}D7NCo1-hMg)Pv9#lsmH|NR1L3QO8WVU!rH^;n&=9dwh
z>`2L1;#@YWf&X%1B3Hy*QO1J<T<PZD3UlmM9-7<!5GDVl0-aa&<c025WcK~MFZmnO
zgQM1BsY1o8S{uZAAq>_skDsYAfguz`D=X49);h{;;pF1{=KgSfl34D&I3ioMsTkuW
zz_o*+E)ifh9QmTi<k{5jBcqm7PQvJ=xQ8{X4lhaNd@nz&ut@%^OtR^MKV9B#7TwMI
z8s}uG-=dlF)IllrsAogR<9KsZ*+e8pmDP<+DOw?mee%aq$nj7Hnk0a5pWyla$lv2|
z3TOWn)MN>!seOM*hw0tpwQ(6fGA)hc?ZA4E({>*aCmnVrH1)~MXM?u9>xfNegN%b=
z^inRO1gbyphi6Pt`4)ah?cG%8X8cB0$<?|i*JDtFm{H3)Oju(Ch}7`qxW9oCu4r&n
zR!?qS1~Xfba=6IReialQUiDDcWE`)H3eHFPAvVXH2a0e!!&iLd(_dSt=0z;}I{DyF
zE%qOot>g>+Xqpbj1CeBP&}aQ-03*t!6zzlKb}o^vtihIaLo(oq&hPR9@Xo}=GrWz_
z+&V*twNS6nxRkFz7ONqzZa@Gi?SmF-+FD6Yk~c&evR>sc`4YpySmkkPG*^eQP7NC+
z<?=oi9<KM1yQfo9D}L>brnTDdf#ieXe~5)R<#qW}R3VW29*fPvJ7|_iR`|9v&D&Ap
zt;g%bj?>+wv|O)1eY-ms6!GqbKDzVi8aSg`7S%fOo>04zSnqD~-(O9A{n30zIKGji
z56CA2kv;#*36kGKLQXo4YxVxxp#DOFt3Yd`tmaELZ%|#Vw!bZc;qdmtXz~YAMrS)c
z7ycaK6k?=;_L%gUba@7(H0M#ukiqkw6jgeZ7!N9*h8cMP5wxCbU4SU*i8#ofDIcpN
zLnkcX3T4YeI8k4AHG$TAjJ)Cuh_gK=-Sv&EBIZy2<wi5z5JWU!fIVgxnTj`NVvqHi
zdsVdFG=q<EA0L&S;&;Pod?46E*K(3mK&+x61-#s3E>s>w)36MFXEX82T)TIbhbyrO
z<br0Ev*4>l8~c>%kB@c778Dxsc&9Wz-fqkG-5b$Dk^H%t=12U)fYcaxc}f5;IraM^
zvi0r;cURZ#++DA!8VinbmTXoQXkFj`&(Cag*`{lqx_?aGCkIcr88WHEqlpcyT6Wn*
zBCdD=-5V(XI0E$m)ibuX7Q<&$<&Gqq^$rfpf3ADp3@YLI*x#!m)*%`?+dU37CsOLg
zL<~vG`6$}?PjAv?t)`g@Grphl&C~Cni%y_&p|+@wa4Jqt6!LvJ7rzMo9S{i8sa{5Q
zR!o7LEX;EZMWBQq9phS;2?^_t7s6mV^=`J2pq%-M*o%?S;A6jaMb@6KC1lE!nMEIO
zeS(xvRu}SI)e#6@E#^Qf{}2>eqLziykdb<(;)R%*CFjm-i$C(*4sR6Kc$yx2G5zc+
zr}*AK^C+G)fkID*!r&)MXqXk?my!ZQdPW6*`MxskGRw{Fn~jbkU#bDlBF;sT^h9dT
zK#@Ikid*&~ju^dYtXvbmB-)K!@!Ep*jcz~O9M84rbU50}zrAtBvxzsH3S;pQyIIL1
zya)`;DCN1es>xjUMqTmJH|D=W$&j|@vW-T$iBKDDywqUmgjuhm;U96ChuYm(4($n;
zuf5F%@ej8it;rCb&(~t8oV7QH+u4d%o_v*7V})k0KUyH;n^%CM6*b8Zpr4GO+wQYO
zj`qwvCB~%j%0oJ&7VTH}t(fZly-17~kI^E?zJ&G;D{6tH>V;i+Df-Jzt*Dxr9yqOq
zpE@rMf#`8veVz0d&RC5GLe?$F!w(LJ!6w_IzbIj3T5EZO+I)gW;8eS#NX{kC?mj++
zBMq7J`Xh`!t$CKvvEp{!DKD_3i$i{r&z{&|US0e^^TLvIvY6coyn?h6;b1oDWDd=!
z=Pt;8Hw6s?9hyj(d|_>%uo;WPm3yifL5w4GTY`z8|6BAnvR5xwMtSvPj#$R@O^P=$
zM&R6w0<HTm2jVW*3DlFNlxWW+BuBnkvyX8nMHEvnIqhE+Mn}?(GUQ{=QFPP+zayi6
z^xi)azN)}O^R*k5fdLjhQPFf!=AvPZf&%v_n#jW8jkJ_p3`002EF1z0t2#Hsti7@3
zUyV+WGc^7B{$@w<yZ`d%nBBDQ?1lvVLs?DWvtx`?AYpeY?0OS>sqxffYn(a>-8qki
z{n!riGz)T!8Ehh?HL)`b)yR5h9!rRv(kz2neBm2rNaATJ5f>~*2k-{P)<#Ph<z9?C
zV(Z2btXxpYOSL@soOs8??}0RYm<=&uGlP+2lT4J&Lybea=XciBP7}8pFl#DpFAkp8
z(W<;1rG7lPt6_uvSWHD;^Z6^3bR%<F4@5k`xhN%r2#&J5dC6rJp?5XHqII9y-eNNy
zx|>c>*4Fw-1wa{(EK>r@EPPA7p#Uu1YJX1(S%paaM9JyUih?_uFklEuKZ;u4IE>au
z@p@ll^)sfh9i00SC(rS>n`Yg(>-)O6PWv&8fzlZHrj9bhYsBLfQtuF++Lkt-t4+-b
zjYWwVwxf{emV3-#(avf=8({r|^&5A!!bq9E53MwpLBFHaGK#xNcJDzFL2GcyC34oC
z#qF@F_S)uE8Q($^9m1|ra&@KgFbt8F{+x)-pC4o!ikP7fU#A(Yz`5w;nzdJ}Lpo6A
zcS%>CEwUWThb&vSN&7A_c^vj>*i~Rgarw7p!XY!<Ugo>}SeZi0Id8Qvi<#f;-0z;m
zO8e{D0er!kcxGzlUuEQ(Z%DX%8g8Q2{^w}{4z|$eyV-^ibb7d_=!30{Vdkz&aeoT}
zmuqx+P>CC;W>652eELHyXdkZUQ*<1*-<|%wq+<Qya8V=-;LAUvR$c<5z&88VtP`d{
zW!$g&NLmG|sv6`?|D&>0(cSy!8Y@UY-~fb2MrNDFpB#;JC5q)-BK`>f@?FxG!y5lo
ztwwR^jU$Uk#|@n~4&_cD;DGO_?|gfuF_uyj6w(_5e=76-^Py026RT!w&<(T3f#g&S
z#$0Z!eDhRk7H2F`V&=;c*QC0%lRTW*y(<#`hMb#hFy}W0hOXC%@m}gCa3`nbS-v4s
zT@gQ3_V*}+5KqD?OhK3#U+3>cF6~;;7BP*iA$+mTiSDQVM@f9Z4;3GlT*eN?HJ_Dg
zo2#d`^I2<C%kMGGVAgYMh)mxFI@rNzurkRvP)-qZk9QxDv)y(F0zmO4of5N5TAJ=p
z4jYd(ns&6WH^e3@-Vj_qUaeQV^X}{XjF7;C5+3bGljV^2=$_AarH1olFm(wN9lDe2
z$@Cf>0B`lBtMT|3y(<x|EcsyL?0DDdd820YBJOEXgJT{9U5m6<VjHTB%!6Eu-g>GH
z#aWEwvIir!zInh@abK=|o~pgrVOxDO^7x&NdUiT7IQVbGzk!}`bEYh1tZR{Er729U
zo@yNKkdqk!R_{!d-ZrEm-$9#0EA9oYa--QW7E0USKact4xtT|Xm#J9y8!ZXTJV2gk
zyf;CVPFtIiJt48`B#ZTuRl^7=&ajzMDoTnKY>f(Gwr}s_3`aqgXXl|MC(K!;XeD@i
zX}Q;_gpS1n>I&E<uwa_(a+I-^hASSmh$L17IX2+EB_-v-Q-<u$XwsSGZ5!q>f{lb_
zd~*MjHpFrzP#o3S7Z9I*#d~#Imq4PAzydP6F5I{WysP*9c$z7#PU<pXfa#BZS5xvw
zR$cUNdS-P1OS<;Ti?@f$+&rprZyMiXf$a<hMbH*m^rwzk9N>>REv0U3r@&q4wBs9H
zLPg&QWXYrgsSj=)P3H^_B};<M9q;qV9oY8EmD!!nWLG5wz^PTkgJy>MIAvlgAQNzH
z*JIRmV?G_$ul{P;|K>sfX8{8^)B+ZI=ZNp$FSmKjL_i!@eA%byRI>n{e|?T$PTRCA
zFEh~}uPzhc=pOD406ewXHXP(ClIB+gTO=5&uQ^S7#!J$v?kxy9HuWt2{q$(xbWsOB
z+B$untro^O(j)iX;Nd-*6U>tt+{RB`cbFkbb@u2x7P%%P#<3OYR8c|k&JuEjJFGf_
zbUQ_k#l7m)@{PPK`||8-{?-IdjZXecp=O2RKtAgO_dIAugRznqR7N^LD7W20=DxL$
z0D8W*ln)pUKAg!;$p2S-bZ{xIPZ;(|e!D~!o-%m>A%vXX$8~p*!GF@zZAnK$K5Mjo
zbecc17QYf*3feg}xBq^tllcR-AeZkRbHNmN%PJiXS=yhf7Em@vyk0Nm9}O4@bZmMV
z<C7fGX=5;wN~5Y!%1I6$6JHc5%Tw;tB}u~)jUXT1$Qm5-!+~EK7~kZUNGkWL<v}(t
zWtL;injp}gPEiE#su!E@PY&0R9qfBqG^LRM<CSt0xy)o}C~2u~D)O1+g_wKgrKbUT
z?OkQJoaWs3RC2EnMT4VbrLj=)uPiwTzTly;T9r6lDc|mQBpMEu^5bo<B+OvLIyBEP
z?Px-m1M5c+Fprt-DjH^pv7hFyvU=L=%S3s+i(@6Y?1*v_y6RL9Hr8QAqdweL2GB%e
zvRR)Vdbmn@K98b9EV!hkIszNb6@r$gJQ*KWn}t*CEH?9!LU#I#nK~5m^tQQf+DwEY
zm*)HpC!%0F+@M9r>RN<bzFl!YWhBD?R2K&IjdX;-xRxs7(}Zx|x=H?PWb&!RxfB~S
zS9{SO$qi2hIqFbeWHgb9Th&Ji3(ZPjK8Kh07_0@Zg5qQLWIVq-k*BiOC=wy*A+YM|
z;f>499n~wGOW1n~@ELSo%A{9Q9-jg)TV*x7zFKw;@7P?Q3MsE>B7Q^5a$(lu!OT}T
z<2I13)E^f^P&RUj{>n+!B{E%IqUSTC2HQUUy<xxS_gEC*naeYsVynxf%Y;H7C=dSR
zoID-d5_c5tO0*1_1C|&LZaQ8<9Art<GK$YVA#)4j^mG@?8KcXCqCg6l5LiDwZypmK
zqS*<DCpf@{pO0Dlx)ruM6y$98>&E94YRQe)0VlUV*bQ=^(aNA~)FLbkg6aGB)$tyb
z8fXqq3720^np<~xzw$W{B~@!zP#C%2I!G@szi5V>i`u;2lCvf?B-7bh&+8#YmuUPg
zo|hW0kr><^*B}qn9M#ymcW}I>_IHyfQ$_lhpX@VJFvB_C%&M6mu>vZBIKQ~!VTh>I
zbtaWEqxMb@WyeVs*Vd(4I~iPjzA_M}2sGy(-l5UixP}RZ2(GBD5-U-ZFQ6c!))}Y7
zXgHFskGoa~gUT<38lhrRXU#b%Tct%U_lEU)S=svSx^o6=?g^h0`yKffwAa;6?sTZu
zO4K&_W*KE91)IQ^%6}`Kj7o2}18Q}`KkqF}{$~+-a4Ggr80O!D`_#tbu*H{a5xhDU
za`8nIkSYNe@Al7iz(;1d2B@VfutyJYd$Y<LskUevkw<R^z)OOKA);_juweB{oj;_q
zsp86kt3otG@+gq<?%}Ck<W9x0D&YLR?aVJHp^qw&+>J3m9mxXg!+n~v8=bzFI$Ql7
zYd})U5#loce_Fl>@6MU+)YyKBRmUm<XsvbmQvo)uB6HK!jeh9ir<2>NPy(PRlMreZ
z5wHKWZhY<p@LW6lM$9U%Yq$&P9m*V)IbQWxGq&VoX03{bRbp&io7%yYqhv5Yzsvr`
z2LrDqh+F~uM}6631xk~hAe2<;DmRa*Y<a-*9k2YguR#nCKE~t0X+=`<;a_Ko-I#z1
z@2p3?m}a^hhVk5q!0FBVcj8qUm?!T`Tev>|lwn$))}xgx?#&JTM}i^2#)IL2J<hci
zd#f#4DYp9|1v$$Yi=53n*P5fpPqP8|0OF@`Y`wuoH@vvp>6SX-HOqp&|8mK;#3{AK
zkNLn(Rw`2OI$7JGYXB{rno6o3LTdDTX@HMXk9$<RnO5GZpD~||B&0SNderIEG`cEQ
zsbQhac$hrci@!S2up}b%jI}O#D%_;qdY+MF2ZiGxZu0>ydd@c8=jc%iGw+1{Q+b|T
zU#0{#EzHU)y$(ngnRvsVIJz;50&^x(DGE<RW$zN*=q5^(`KA(0ewwJ31#O$CFaZ9W
zpLa}d3ovm?uqGs@<6b?p6_eEtNnGszS!wpjhG363I_+HAD)ArI=zthP=u%OPHG_Uc
zt$9!bw-Nz8cMs>iR#zDj8_9v0k%qR6A-j{COTNxBiv)6tiZaQ5|FW76-Zt2_t(v*-
znamR?3V!_a)E%Ruupif>ljPBL>=JKi+57DIHb3{WNBirt&v8u#50au`66#q}EUOmV
zT<tpXcerDCSKfo8@H35S#}#mZ-xEDzV5dDm*S}N6>$GGAoyShh4ZCm7h4ZTle(77(
zdwngzrN&tPj`4@tP`dVGujav@;R1YI2*OvMgF%{dS~vN)hFl9So7Aw#$@}J&S%#V6
zT+`d>NvL5(iQ)0VxPhs@5G>YT;6$OrD5!A`+B~q+(tH&eFWY62EO8X^-{ZvitR}(n
z7Xl-KJY|kFLBU(JVn;dH`@%xaJ7$n(Ng26_q)T$soET(+jBUp<PgJyYo`D5GUszo>
zrVRkIb!u|-L?9CWrdvKtI-LzD{fn?@aQZQ>wRYcDuSj(&2IVJm@kRC?MWgOT_>!_C
z)<RF)b+`NOa<eKUcd3=iKke}g8_^MtBdC#Ge%53+x-}|wFryu<43`7_)!F~+$E$ut
zu$V@+FMPzrjV+WV`O(|%CVzQB!JMP`Jpa)Reu1QrPrc$USoc0GXGHegFgrNf*TgYz
zWDBv7&s4`8`0bW=mR27fM;L*gW`us@w}sP^JIRE;1-PD>zT@wgr{moTT!}rf-nN5Y
zOhUVo8VQxu!?#3m(>HKU(?ocH?s()Bbf*B9TCTmRg17$7y;@(AN$DMFO11K6!P%z6
zw5-%ix|9he6}-bEfy5Tu$9c<p2+Q)D-6r{}{a&A4_Jw8JrlREL5Q5t=#{QLH-lTAc
z)4ujZGdkn$<)f(1jYIsH@S15YT&C>TZc?q13&>)}CWzen5&#_t-w%QFl<tHjj)VcB
zEdmRG7@G*Tu~-$LLjT9AB8oVOSn6fYg;$lInMs(qH(W4LO!Coh&pn(4k2~5JrT@}W
z5KXspd+%gCcv=HDX0}49Vw}oW>PeAYe+}uh*M!LL`b|~=abpI*oXptwGlN6tDJZK@
za+R6HwOaDh=jNqbG6G*wo8m$&u5f;E+Q~S1j-792EVi%|lZ2660B2X(<e?lF2^Hm6
zbFdl($N0;tZ&O8l_S|(`4@m;Vb4_+<bICNQzK~EFAe%k_VOa|kglqAFKJA_O=E$q$
zGL9-4b*rr!9nmqFS23;vkvO1fN(p{&Au+!V1t45enFRdYw?2u4PB?j1`^L~jB<-u6
z-$S~>*&FPkaan`dUSA~FBC<=~Qx5dAIC`W;)9Ql&Y*eN|54sX50Jc|GN^077&+uNx
z3r7x;JnP%v`jV>O2aW^k{K-`uN5rhnWf2~obz~#f=Q}#2wtld<hDmq!>^cs)VWuP%
z7d`F6lF&$bn`s^NQx{|}TRK~)&6Q%(<$SN10BCxI0L}e6ui$qNE}v=@l)qKi$<fjR
zz1Hm0b1nzQ#&k$wo1$d?TR|(s_+c8AH29R4Mz?aV!8|NMcpCxhs)j7+5WX=8vhR-Z
z<4DrHZf*At=<UA%`&V?&cTQxl<8xP#)u#iZxAr^p>5nt8P{l9AGT~s~U44nweD0F4
zBVc{uF&PSolgg3YWEnYBl+kf`CdeKb^%u$Lt|Aoql--<jPb<D|McSG$E7EMBLd3OE
zlgVX_#T6#uge4}>b8+^UU0*6*J{``DmDgS-PNTgTiiXf*V9aIkWBR=O?9PPoMNPh>
zPqpvFtV+YWkg(uG)jt#0h{mjZP{}?}EnYLMnpTh5&rLS@No%u}5Rxr3X|3^qf2JoR
zdD~Y;6LMQ*HI&+UCHl903SaG^5anXg!O<eMM$lwERr;?9?wg$jhW9g9v1+VH3PWPr
zHpcfu^{KK|x_&J337R8P4Qo!;Nd{hzZ?1P&iIJ&O$c<lTjx?qk-w3utIwzLRbBqj%
zjMSdQRU=d<5<OzXvgEw=ZSwn+*GzwymWE<Cu9A>s5j&%^pB^^;)E)H&pg>Si1{V`w
z$iFWMJ87)q%@pwhdK2#716yaaMr13aJPd=tiE4h(zMICJraZ7am3XP4XSIQNIr0(>
zKc?}v1h>UtU>2nq4gln2DjXWks#%3PUtCwS#c_U9i_T=QA9HY;6gpSX&ay;0qcr{w
z8snMb@YM@%7{+6%7%98hzOl3<T0uuYe(SSJ9l>KiOqVG&>A&=p;5`1h_|>kUycYIo
zBxld39*?SyvYcya7OI-nR56ExE*kVbl0{M3*p2dHWku?|JmJBBV9?Ea8$0vfN4!4w
zWI4Xawf=lC?5EE`7%3#-Nyx-)ZW{B{%8I!r;R;!}H>jxg_Ug*DTdqDym?0M{0({Tu
z%hXI>LMA1D58b7w9Cp$XyAsMIatxDtlcN?ZLSLbnPuS;^Vk-DB+s!&VS&=HB+R|*{
zA};XrHzqzg?@=4~ccm+!a}G!P5Xe742+;cz1Yf(;$D;j55X5Kz*3BzY*ovCJC6)TO
z;P7hJNw~N3J&5YAhfz`Ve-xYD`d@*tfFbp0WqS4MZ{##yJgP?oy5#S=Rnm`)rCIg%
zw%{cP5K}p3Bk%XFbE^?7SZDP27CIBmk6&ljR@bs{bPYtVCxJZCvANYu84(EjLHe>@
zuPQu)f(jeLGnKs4+9}pm+wroH<yHVODH4^hIWRi;T1wQDL<#pjaCQY8F-@`$a^`=0
zdzaN(P#}4w{whMKlrtaj#hp{{BeV_K;`ctcvMQFXs_=;&dQ~`O!2+Wdy^?6q6DAe-
zhbf5m5@WFiCU33LQj(~})GOj9$tOe30KXMUH6w_zN5Woz3~z;@8;#Xw{%jz*g{HW*
znElBhn1uYXkGWP2W$~V5z^43vi@vKa7x%suE}!3tXo)$lU)v`WpU2Iu9_Z?iipGI+
zmCGARjn^I;vqg9%DC9Io64fE-r)%iv(bBZ1Lmc{#6({lu#6*1Wr}yKuE1UHvr|0t4
z+18K$(+l90mK~7e&M{7EbP&%)uU$YW-SW1dKBcB`XtU9BQzi5GJMGOKsP?RX79J3D
zk@&<8`M=~|S|Dv4u!prW2tmD*ey{2(d8zZSxF&*h+|}Ey_m^^VRE+^=P4fbDbyWAb
z+@~VQDa*>KY@&9mX=JQy(qtlLEG&QzgF&_CwvZoZK3@h0)b=?(1Hfe{b9wfzMCh09
z)SO&m*;@((%#l7tDaOP~({YW!kGJsyRr)A0t-0fsQ{a^5OO5TVc+CDrojj4mPowq)
zSTjc(j|UD)DA~>1Mn*&_I;H30tVYU25g8+0oKORIC`EUji43{tKQSml=-)j{F$K)n
zvtp{UyC2f4Pf<nd4WP8J$yq2((V?WtsY^8^3K5KS`%M~#4Is18z0x9LpyJHc7zN`d
ztvsJABqvf9xlNukEB>IBdXm4$6Sp8H;-NVXq&WlY%OM0!f-P7g=GU7CBvD)7`(*wI
zY!=Q*$It1@s<U<^RB!~^Ps?Rf`6S##%v`dyCt-=VAhf$%xknp%dV%Tuc5Sh}lc>)+
z#+PY0NeNqtGUxU;4i9{urzfGPhWa`?DI~IX+EpoH8jV{=Z#?c3o<3xt?|qRicfGWi
zoQk2mU_0kta!o~{3vZho(rO2tPA$;_6>#u}|D7+pxZ1ep4SaBecnIkCf9&km+(-bu
zY#Qpo|7ebW9G3!LV_M$-5*{tPqAqM$2$K<3>4`RgSr@#PD@K+#ko9uJgx}KsNsqar
znm7PdO-$$n2WnBobWOumr)Rr>qHKhwyHdRB?CHBYEvMAI7Wxk}c;sz34V|y{KIh2U
zFD51-f&jd3Zq@&`O`>Ug;)e#L=Djk%OkKu;o*IB>MXwf}iB0<|S3u)0LN&R|8d1Tt
z7zaCU>rFAFT>DqcrRkSAoHt(us<j-Si@oZRx8m$?$;M@!?b^*K3QEHT98Vv7B%U#y
zB`_0IPre`F+?*WV?Gvltg)MNM#B+;^S10C_KCI9s!o)gvpYtCG=;i-UtAU_lt9s{=
z`wTH%qk7&rh$9XwQxPI#xt)5GUMK|l8h1u{tuE&%adz4|_;&G5-h0xP6H;PKTr&W*
zd580rn+zR&sI7IwX)j0?*X1N<&M=Gk1;gh5h{fWrX*8p(<b_ej{Whx7<<|y`ch}^L
z5|?i$jL(k6A&o-A)|Zu$ae<)r+6&fq*TmB(=KivY!d7r~<W?+L4&?8b(c9(t_adzm
zT#9&PrNJ$z)jGd0sMptKt5sSHdQiooaJJ8?+tBcJEvDt;DitpR-d9#6<GZo=35s63
zhPAo)$E9p9)X&Tfl)db4yPMjjBTYogxkU(Rso3Hhm5JdBNrGerC@x`D3;{mE<XQc$
z*Zh3hm24xGUkq6C;$?_d9Dzyj#*4El%YP~n%F)^U$AmKIpUPK#1Z?WHn>u0>b>b~!
z>RF5UV`cCymLMW)zO`xs&A$+b6<>YV`RYxN4`iEoL#OdiG#M|)y8%oY-?KbuR=SN$
zA4=G$Sf;>09`VbeTBHEU6dqibOr3|>h=^sNTmkFla?5Ydk7+r#n9J~4Qc{>~>_4P7
ziySdsU3&OPiCP@>Hz#FuK6Xl*mkx5-q}9x{z?TReFD#xLxzB>1E+uIP&4{a+34Aiy
zZMw?2n12oi&vkBkD{Q=fs+g#hG$j{ZCM5?eWrOunR63v_mL$NRS>YwrB6Tzo#@;&a
zu4SHZB9{`9!o3C2ff^Gtx@HZi*BTy=6fc2AgS?@%FdyF~pGLmUKZ%1zK&e`u)(>I4
z2R`XBaF!u*k|W;$d?2GQrb$jk1spF$PAbw~Dl<gdV-}z{m7*{w<$*lvhS4R|fL+FT
zRT5&d@S5Dm++zv>2gIp=DcF)NHV=S2mJj?_^L(H2yR8A_uvT`7cG5i0H$M7cp)@Pl
zX#}Tcd`GrP_+3uYRi)U91YiqAvS+>+a1^ynpEFGGiMw%WtS$`!&?otioKg)|Uw*>*
z1f>7EBqn+NgFO?PHF4z5OcCN*^PmLIQy*vJucB!4J*?7+TwW(al{BV3^&|yK02;>M
zv|_*8A0G?G+J^x=yXq)MYMNh_Jei%6d;nydMk^K0Z+(<`I27^GhYBZSxBm-qDW1!=
zX*VBQJ#ZB#_GP*9U~@igi#@t}a(B$5Lr_Hj5o0}Bqb|NHxpp{`u-u=Mh1qCJ8U97e
zKAoxaBj<2J`mmgeDk9DyrSjq($3IQHHo@jic(XK@RNOY?!65|Q6#dkmRIM9u-IF^Q
zd{8ll->Kn2efv;^FB<Mq{!Oc{rQHUKFAiG3H6EYb_TZ%89Sx(=`t&>;&q4gn_I@zc
z!{g$n&3_#61nOptgw6#r;cwK`Y{F0ptAKwUBPT(RK2(X#EA3oy?mdkYisz`eU&bxO
zNGn>E5gHlUNQzN<G8j%vOkEZG+0UO`&EvbVT)9ImJnO$F<x>qeKq9sqF(gdcKm%P1
z)e;#1^4T`*K7+E86Q*hU?mY{;0oMG={?=RL6*^u@u64&c?Ddk00r@kf9FX9N%lS##
zO#^##d39&<p#m=$Rx3miPQ3y}os-GONpx=*Bb@)biv!skW+xBm6GHwdy!L8}Mq4p`
zJ|o8^tw7oD{JguZIM*6Do>kz3(8LbgqWfoOe|0gIROF|5Yu;c@J#S37;f@3Nl4kBL
z0l7`+P_RxIzifSR5J_9)n;3}LVzZ)V*ZUSFL&O{##2Ar!6`#xtl>SQ@i<F{?|D}u&
zWoJPnQW~){rg&Pv*gVk<8CC!kzdiW;KtSS{2Yk~r*(Kvh;|0+11Pb6EcU&DWul2RD
z2CTo#sK-*JP)|OKTJ*X5kkW_*TB9|w$Kn4ED@E9sVZ$iReNt21NW$y?P-Nr=T_XCN
zb;&AKoUCVC1sOk0uG;qsD3=}?9Hy<AyPjq=3R7l^;KB0=e~mZky`Sr2O&q9Sc9oX?
zt0iPce^9Tb!h}rPB!WaG^a})l%}xAX;W9aVC596db)H_?pmxe8@QKaLOmo@1?Yx>y
zV>k*fqF|#!OQ@3HLH!yf2(V)5Mp^fXsHLJ>qL~rb<(N&emp~0Nu4>4c1giV8(<eu~
zILdcb{@uzDRKSo>Q9sqrLSe8ZmNyv5-yoFO(H(IMgtdD-hw-F4hNaYxDzn0%fCBcE
z6czCx(XWv?l!&ZBg=z``3-`@5jis5CWV#Jb2s{c|U<_CppN00G-Ao)$#fpk*!a+^q
z)?5@2(O`_QX<xZY?PS;v9+{6<LPbPbPQS9$w%Vs(7SHg*PNl*Q;2S{4##|)f^*>Jl
zWst1vo@A>&?dg?$hl6YR&Kdg>a3#gHLidqb?k%(S{rgG8*8@Bj{e7JoXNIiBM!=Ni
zzkqH;|9?XdTAcU2g~kg313u{`IreK%Qxe$?2L#7nOAk^C$ln$QHh!GYyTjS&5``%w
z?)NeNL7AMMc&u$izJG%+!wQ@K_SZ!n#!0_|VD`4cYc1|mb^?l__KCverEhgB7G?ES
zj%jvmiK_&U<LIjZ6j(iu9HU@nzb0jBZkF8cFy?sL7rSD`_FhaBA|;U?p<I4gY@nVW
zTDQcW39j<~cZ9Kk4eTY8Gj?&imAoIjuAmu^e=b)`_sTUoXZm-Wd&gU5STs*1kxkiS
z?*Ju28kRyn>&*3lRW0!Z)?ZTkJ{()`^b*a5%SS@;?Zxa(jetq5>)PA>+-M{?i}u6+
zmuG6aCs<TCgxz&Lb@qE#vrWtj#H&>Rje!l};IuMu?zUp`(SkbZ$L5&lrSD5tp+QY3
zfwU@GNgN3~Dmuw8Nc*XN-k<RXGCn`EIM{~zo~Re>m7bkc+L75K5Iw{5Cp&eRjO5_P
z5=!)vs9N2}RqritqZs1+Wb!93Z}(3$B2Wdj&9Ujh%wpIYZhva+;Pm#gnRlkyVT*8&
z#V0q5KUJ9OYw%Y*&tkkZU#S*3pT3JzCw<ZUZwkyTan^{)Mgi1cAxbEs^VDt4gV1dy
zEVk}+>Pu8e8F2BDaRx?`&k`0x{Q78{&@vKD2+0euS_1=_nfOnll0msQci$KYnpx&}
z`r4Etjny61k7Qf31>N*d;qvm%tTg*Oi04bv@1$AtsU4*ExQ}<f|L<2fNRyF)R{mx7
zdNS_TCEBpnvOLjO(Kei`Vq4vJl4!RdP-cjJ@fnM%G*+Md#{~R>QJZTE*tW}XxnD9@
zgIE-ABj?uSsoTH@+>LJ7oxfkw7T+Q&d}BG<(pdtHv=9zjp2x$k7IWdQsX58uaQLgc
z(8KU-7$vi+VdDk)oCL`u%m17cK9ZM?i>;%xV^(R~t(aRQC4u<a=i|%%W_+qLbvO4t
zWqp!>^)@fXA>^BK^eO6Ptj9Mm-|L74a)hl18!Mom?=fk(Q!hEwjmpu7zru-1uzZ;w
z7<u#Z7RrpoiFX-l2JG%Ol*L0MY2{<NI6JVJWCRTGQjSGa`u^(Qf?L5%d}@3ad-rcE
z##|`+rI@;F@x~<<FNXaI0{|a}C!q0AxC1wc2@7t^vBd#wqv|-65j*l&h|UTX2Meyp
zd#RRr=w$ycFkIFZ92fiJE2mE1EuWfg)y`4Q!;uFzrj<6HNC@zQ_1YyG`Q%=#S}<x8
z?(;W|5Tc^WP{Zfm>`GaVn7Hc&@&5F@Vwlc?nWW)zlyBD(Mq@__D)0>HzDt1KbK0mW
z%3yc?-Q;ulb{ErLGom5d;-kT?c;>@dl;VN*FOfuBa1lQFMW8@P<c^^1>56Zlm%(RY
z0^IEC&a{<>L;tDU-Io+lc+$Zm&05|WzY_WTy@P6lw#cpu4yrXP#kej~$X)v{z?aZ7
zan*`CDiji++$X_&dd7VN%1;_4i+aNbyqV>gRDS6B4o9#w;N>v4t86Fi!b0(lqBM;R
zG18;f-sSg0%b-SXhBD*MnwdcH$K%)CBh7!lm1yrm`uff$|DCVvxYW{|4INxXv9IK#
z{&70a@#8sZ1pjQc#+32Gt0I0TU6zb)y_ZtoOdn=<a-pTG=qM@mS`~u0{SlWqrs=UI
zvZtsH`-g^0j&tE0M;W3+IBN*b!&zH(r-59Kp^1&YEUwY!VE1$R&I$@R<^x5fs-j{=
zs0D-F(sk=^Mm@goI@m*TL~rh;0yZT}l3ouL?k8ey_?JqXSpQVc>-2?DbuipH;EKJn
z6%)oEdXA2TlmOd2vUpBtG_Jrl@2ap{sXxC2woqORzY{Z2OBobvKt~Psxin7wL^Na`
z_+N;BsQ-=lU#%7SF-CnT#^;FOH5VBr*naD;RNkQWi0XVSGc2r{uGKgDtzKZQH6Z|_
zc0fbc%sc<cZi+CPxZsWIayfQtklQSklxxQXLG1XO;aQuAc_##jDz$(|>Qt~EA@axA
z8Cx`qeAxhj;)lC5T{Sd7!^i2FMsdo>qi2^oyb&+&n@!EK_9CcnNZpM5#IXQ1xylBV
zw%i%6lm!J?6k&VW4HQ_V*$FgVx30k`x-cYdjz6e0Gz!w34`V_U8o{b`M7Pm9`Pn)E
z#uVP1mW$YmMU`E>=*`Q5gFoQVvy3pIXCbi`qb$<6{OQR@=afp0QeZm1_oY{bGaq*#
z_x9;U@Vnu;g$*M>I+nzVy=}+1>tVmC&prwy5#@QVOjO3V%|MHQ{yI#sY%F|dD7%1N
zdo8nmDzTzdhUOGh<|@Ka#JN9P2f}AEHuKzQ^i})-%>2M1hz=)6-I#Dv^FdvPe{ojU
zJlO%4y(jel^{z`>qdjDYCuJE#jIB+#JxD%~t?Zvp>vB1h+&#`nXUM!zs6*iNe6e7k
zdZE!z=>+*8x9VJ?=ht+n_w~n(I;wXGZQT&N*y=|R`8ij=c5h;W3gdW|ZFx_Olbz7T
ze_gOjV&jgcbPbya(>;m>z~WVZ>q)P-Z1#W>VGJXf)Ac^n#kMhDfw$~R%of<dpFJ^y
z0$P!LQH%|c^!r3rHhTkg+>YzOdw%sXwlh&^mtTB!B&Sg1dE74ynK~5BnNWUSa1~>_
zSI&lNx<|*2n0GWe*(_8Ss&P<u(UMSSC9z4`b-)I*38e}Qy}K7s*{Cjjp)wt6(1g>F
z^+p4~0-bb_+FbU(K-XKk?)=SIpX+xN`pVRhO`ix|#*2mXvn=H>>oilJQ5)D$m>M^z
z60|uzp?a#}J}4mmN%b5alZwgbp(6n@wpw#nkU<n8rjNAFlL^Nz(`)<5Ace;ozfWUt
zy`oFqKqTWn;FN!WcV%B1b4pdmjA+EX{XZc-BMi;9fS{}=qWU5afVIa6ZF^bL1n_>B
zcwettq?fUPrfVpy)%lx&ZHSAeHizc@NS3E(TWAl1@;7w#TkXI|Djs7l&9VBiwz0Dv
z(s`C5rG$L@qmjjutu+x|iJXOB_pMu3Ej-{GZf#_D@g=2*5OhWDED0HZxa+3!(sd|-
z2!1Z=C%`vhQ%0>{neFo>Tf@LtUVCx-s?o7|k7{Xhg*TGmU4RGP7m#^?p+VajJ<PP=
zO$r1l0c)UhkBl{hrBvD<j4hB(vSV9Mz5*HOK9-ieX;>u9x!LaBka7xI1k57PEb&1k
zrphL3LBcla9k1in<b9A@PBk!@C^rniEFfGKXLTer{fvBRYJl)S$&f7YSGA@9Ko-pa
zt|Oz?C#0SjegBb{BYU{&V!#nqt>(YbDIY>k=oZQ5zoL;2tnJmP60P0Rw=lxVD~~(U
z8DUz?@w01-y@#)qo1BFTlvr^vhmK7Pg30Jq9%a8V>}Y|4*?gwo+8;Odea>>d#V@Xr
zyyQ{xybJG0#A8l<fQu5ifLMo7dgB*6g*?_IFxXI8PV8AT3n-xFf3c}FSf^V`MTei3
zc1;Cr)SG<kG(?!-ihK@Zbfn|BCaXCuL$s8zq#O@}!^D^jh0HeCud56sSQ!V4{j+KV
zO%!A~z~O{|iAh&TpQ4Zs%-i**(LNb>z<h9Wew;k(9NW+)WysSBQ(GvhfbduSqf*gY
zIfZz}4m9VlgPL-Sp755+eP(%AMQt)Zfw=?vc3!z9qo1jHE`|zadE7s2&BUdYdp(+s
zK$p#aYxcIg7$B+PT>8@v<xOf__ySW~xY%T#12*cm*5;Ma*1uM}dLMrlsC>^F@>1T7
zYA*17qB3=N?65%NJRz8wK2D%Z4`Zt@Aw7?@zEJchI5V245v_!KFK{rX)VBd$9LA|P
zYQbIga}Vm$5ElNg-R}?<2i%$>`8y`T2jWwlYLVI0KZ<X?;b+W!t1Ks=`Ni~#-7Zme
zqAzy=XaP6{ed6sDehBX+D?3P`C}mqsexljE#OeZ5Q*wamH^4fu2h>BOQ*tDuK>Uhk
z#KmH|CLBKvu~l$2W;zVJP<3OUSZs&LEBi-wUx{^=9ESkzRlZ9w;1mXMPDpjYNP_Js
zkg(W|_Hr<)(|2Fp=tR%fn(dH8@{MG)YR&Lq(Z0*2q4OJK<o333H3YeSNDQS``#hn<
z1tteww#IFK*7^f_Z${_uIg+Tty6?4gixHZf1+;5}R3Y=-4GS|x)E*F2E_ZUwH^g9i
zO_WDCHPn`lot@9+R9m)dIWG2vgd~XMOgjnH#EHUlqq>UJHCw^kQF1s@$C0)E9K^R;
z|9!&^tYqnK{p*+~|L}xN^C|*#rG5QdC-P}7*qGv5+T^5Qw@>KIM5s7-ACm)GbuKx|
zI>$t4QnO^#5nrbLwHr!DEPsbWxx9l0|F3I6_Lpmbq}LSM%UEL^i(3y=>og1byV6>=
z<%wGr4np=_xO3s;d6agP=(Y;KFnjmh>JGkyB{(qkY<*)tpoEr&yqekTsxJFLR)EVx
zl{jq@XKH-if3aAD0ldb+bYdZatiqVpjqHL^k3o*qVEP6Bjsc)N7*1tsn+*K+^R^V{
zyJ(TJvOlx{k?zMJ_&)@k+V}*59!l=mG>kg&(mp+sea`$t2NA@mFnvbwMUPhFeklR6
zvH-H!`lgpdsZMbLS%RV?TR*SXjp$>PQpnxmFbr=@));0w2s?*PcP4=B&{<JDARpX&
zk7jR#WhpP>zxj1KHx?;3eS_U?@#D~#RhA>y+<%}_1T;9nh?r96T^n-9sQQTGQD2!#
zE!@0mbxy$I;N_*bwl$J)z79yFL8X&`4T3A;+og?Wbu{*5tHhVgJT8~wRrB4bdmW{?
zcb|}9n6o_iubm1jseUq-rBzgW4ruupI|F3V6}TxvW%Y?Eb?MC07=C`uEn=NN=sSoO
z6Vd6QjyV*|txxvn<=-AG>ec#e2twD$uT~dOL{k@xx+JB}0lJR(fgSfPB}Y#AkNYgB
zE@Qcv6-g8X>sN=p)yci%$8c=*#2R(X5|S$qpi{U1a7?8Mb((w>)<N42Xfsk&aSRr_
zj20o`n3)%98Fvbnx;D3Tl~V}c;>Sj?`(vx{EvH4JY17G4WbXv-s{F&gSi^_d031_~
zC}oaXj*0_PZIJKLmt!0oAoh=W-i$cg(}8POiul753{}W<A5|M#t#JN_DIo%z_ro(d
z>e1Bs^7cXJWc18Zp%a1qz0dTV1WnaTZ1|sl40@bR&9Q@EkRcC91WVaiO8Ily16o%#
zvSCvMmEgg2hW2EcIMi~2q*I+;X6BvUssRlSWVxStRvYW1Y_4f-Eq>?J7I-p0st1K?
zZ{xzN(u=IE;K(X=N1}h#qai&QKwWlwo{6BcLnyC)vRMr1jJW(x6X}ef+CE3NF~l^F
z=V<*_numh>TdhlFi&;emiOBAVO6xa;K>S!bS(CwGw98^cV-$h~*<NS-8WT%(`#lxQ
zds@bmm|o!0{TUY0O<x9+g{AdHI=fU=Z(B8(a=t8`C~qzj7A{pZlrg_bw%I@kr&&D6
zDZ3|J$+($3BK;cIFUr(^?ukC%X1@7t!}Q{xN111wf~bV3k^`Ap+yAl+V29QcOv}R*
zd`~wBHhv!`iFhF|X$^;Jd2iFRI<(e0qGf0;7m|_Fa$!I6O3_?KZJXSa6xmDkR*~Zh
zNOH>MvR1r3I>9K`S^T4GqcTfVZ5SA-7$M%gW3+VY+_Xj=aUf(eyeT|OS)ZG`%6L>a
z#ZW7T;GQlp<j#DrT2n9FK<_b?@GA%X-{=|cshVTXu3KpZ>n*m;4@G(!JufV~DT(m!
zv+1f7HEh|!VZ~s)An)4bZT2m(BH=Rf)lnv2tXhL1@s2*md#tWfoG)PL%$~|wF~YhW
z6e&0+eAUiqCi$eut}JP9|I*cNQeEdAE9p$m5iYabB;FIMgFuT@i5#VPGn0GJ_?+B{
z5Anmq+_F#a={zq6a3d<UT6`qh(j);dW^&Ti3y=(q#-zCDKsj2j94rVJ4^L^h{VpDI
zBW?s=zI;3~u5suldP&eZ!DAY8V|d_F>@2-#va5=N7g(RuxRB*^*gUt-k$8=+uQt}j
z*1Gu>5_E=`7V#L@yObn|g?>FJM*T_l%HzoIg&4`Iw3&QpyLQy`>#gCSyodFM3fimN
z{v0Gv`5$@IIe0Y6tH?^fd@9@=7KOm6V0gj({W$N4zk)(GZDKY}P$>7hwxp<&_a`l@
zGA_b;WA#@FgX}g(a%aJL<S-@hC8I?@skS@suH0p<DP)YjfCKH!h?5$7<lw4|Gca>p
zF|{Pb7VFu9S^^cBR<DuG|0hhCp|zCgg;!CYEQHJdCrlVi7^9$EERuwq(lVT~)+V>Z
z|FaNa`mzvsbn8*8zT-}DOFgkHoWK(ojO#u{>dFsce=#oF`q6A(=8;jRRo_x^jQN@r
z8+R(=7;5$M1@y~Z1%V-WEVXg0RYGa0WE4{$hx<vX&1B%7ssn@ZzdR;vNgG@^DXP0Q
zS4Yp(GE8Q@!jJN*8wz7w2U_F*>UqgLuZ$sI@OIoK6{<EL{ozGnidXM*cxtVK>I-0t
zev&U^RFSDryR^UN(y1NPNF+i|n0&|-igzY9dtYqNWls-s_F7D=cnE;W6GoM2Z)U*A
zyosll7DlxyQdWfXBBsj94?L~xooq>C^mawKVpKlyfp{#kCkwdf{QY(+^SW7ec)35V
zJNF1)j$U^^Eb=EfN-jU&mz;D5M){M1ZW!6CxW!xZ<T{qgzQEg%AQLxPl;6el#BAGm
z_zZy+l>JrH;*E!vh)%O>t0U?Q@WO6AVNkIgSy9JaY!uw%=Rx{ky=+{xlMtr;X3kaA
z9*;4!%^K*IUt3w8v&uJe6miytaVdorE9UEHQrh}isPsv@K)~sRH^GBH8F*kw6?b78
zN-$AFf2`uD<oXD+-8KoGUTN6jvjdlqbazFprooC#W+#9{^BOGEa38tnW>%SxNRm1j
zLpr0X*GExgX!E9a{-p#s-FAH%h_%f1$&|h--`<)-KA0PaX-*g!$*OBrD8Em+vC27{
zcR2r;(vnf3N~|)*C`j5*D>q`RvHexrvK9j=xN198x2yVRZn5l!>MCuE1G6ZuQ3(rB
zxJaI!tnO2qjSaLjBL4Ifx3^$zww+7+y;N+Sc&>Y}xGDahqX4S>qG`dyqWPkE^dEi~
z^AoeC%L6^`+b_qop8?hRlcGO&y{AMMJ9W|w<aBt^5sW!Ul&lV=95dRMnPgttt1Y@$
zIkoP(Q_nhqM%jk!{-a~&C9K&uk=n9wmJ2OKGu{ddk87D8$R0;^`d<n_QfeH|G>OE&
zXe`D9IVO<y;zwk%#chH>wd-8wNV~o+kj4~!V{`fc<Lj$};_S9<8+Uhyph1GW1`^zZ
z25H>g8xQV;;10pv-QC^Y-CY{F{Cl5$Z`C<<&wS{Ie)y_;)%fOGYmPbQP-n{I{OLyv
zGnXh+)S6Kjn)Q2dy*Iyeo)FOOKGn;nVqEF>=Z7Ggb2_zGACY)`1i^_%|HOA;^Czge
z8&btrD#^s0|MUX9ZT=KETO^Agsq+tH+EFL%QKY}Sz&jS!RImFAmighXUF?*B$OGD<
z_j<*P6gC^Mzs0g{$ei|0nkLbse(7xgiK1p?Cxp2)(g>U7YivU2B?i)r|NJ?;W1h=Q
zI*~$p;tkMQ?A9lwyKEL2ss0>$pQwx&S8#lScS74rr_>x4|ByQ`>yo<(Jw3bd7T%DV
zTYH}8Bn1H|^CerAfal?6*WJi+FR9-KrFd5TVTr2G_YJys5*&ERq3=iYnP^^Dh(B|W
z0>h03M5%*0UwE~^)~FS`zOkn5$EElcPC}V3DTn}7Ud9C$06fBloMQhqkwwPMUu$9#
zNp0fm2ckR6?PBsx!I-508X2E?wG-)vs@f5btUq{oP!M{~Bcji&=cn@gas}7`vG2Gt
z9>58v{-QwcH^zG@`v5iT={HZ+BfjMNWZBQY7P<-J(u5T;HI&c!3Q`?IwKp7>)$Z%)
zJGZrd895aoqBdrAK3N!m?%b#w%8Ps!$^!98WVw7i5H$9pTSYfw>Y+9xBo<PWrNn8~
z@2I^*R|uEqTNgdupdh%BC)hO{?amN?;SlzqTqWQ&f|ol%T`LpGb<ce%rEn9&y|lD~
z&k@F!m_d2E5TR23GK?Jl955D8rPuAKJ#Vu9t>LPzoaykSd0e#)<i77!<<&M}OlriJ
z7e5V#RK9PkxkqR1M|)MUToIGYkVk7bc!|+5ymvVxGU&i$$0TIl&TTIb9#?x_EykXh
zlat%gxydDncJAw3*H9$>2afH7gzGoCh0hL5@eMUx5T&^zWfm%H3R3FDQX+4j1IN|{
z?xe?jQJw=t21TP98|>aDPgXrh?jL3A7MagQ`vcxn^<E=ue1XF?yipZ-e0L!&8+=DN
zoWp1zv<za*f+kH{Q9qoNoFs#!PC6?&1l1M&2(_&yU!P3TxMWc-mytEizxfM$NR=W;
z1Ti{@Ix;2;L|ude7hF_cx7y_|5$f3X>FDqEwQJ<cZPF7JzuU>n$eo>oWV?Hgo+gU6
z<^*o!m~JZLj*VoT_e~;aX2k!Yg#HQ6-yf8Wc;)Zir36%rF(9McNR`FS68DooC-Kw)
zgEbU{2=lIl_oU0)=y>It<uszQ`axy68^X$4YYktjI&Yo|txhpJuVq>W*Pnk_laDB5
zc%i0>@TAHjL2;`3v25=fA16a1^$&kDSo*)vFk6C<{$IW3d6e{jj9a~;<7BHH(O{Y)
zV>8Uo*arUvk~5m#wGY+!o<LUy{nf$?P$tm*_aFH9G!<mTcf=7&jgBYNd-81M#`02#
zohU_j>VTHn=<Su{w)vawwhhDRgZudxtPcS@@`!LJla%RgE%N6D!=)O042su9!P`bs
zhK;_!?1EaL&!|pFJlX793)i_3!j?(L`7mQh*PE-sp66{<x-J(X4;I4)3&ULU;e=e%
zxPU?i2L3aPT05v&tFrIqN#!c2mmtZ09J|qo>geoWKam!LHp9ruyu_&^jHaHtHjGRs
z+ZG(9I`7FYN}X=1^(Qr#x?W7{nZD$`6#Ba)FmDZ=a3)40`f%jn&}E*@&!vr6K{v$9
z@=_XBl4W^dr<TX~ch=0eRw10=1bwe6q6f`SF_<t&la$y*fg9mUFM6!D<18Ou0wd4a
zs^}UpTooTfnSbl7MJ(!k>Ech^+Qig;Ac<mND<m<|4X!%NQqx~!8+|1NEr)X7XN0LU
z_gkWEg&U4>th}g337-5GM1BVmqX~v`8k<TTMl@l+GF(ni6y7W0c_&TcS)p;oXRKzY
zPgX#MulF+J20ZkRQqU?PH#|E7O}--kgwl6W&<S4|tOFK#xAQfQGTL&`o<;cVB+!7q
zu0(}0XLrl#aPINl2!Jd;-JXgeJ>L{<qlB`5*-7I~UZbW=PhKZo#a)o=UL*~v_Ki0@
z%S?LUM76YWXbE>$7X65As<O>Vy5)BY>f%4fO#0){%jT`_?U{~!rmI5`>11!xB^H%u
zebc%}ToG}m*E=#CRK8BlJ%3gSqKI8Cxz!x9_Syps`W7KXxJY$FdY;X5+dJix9C?T5
zH_!X%>`cpw-Gxnje1!-TYBvX@Klg9^N+zjvAV|Q@a#oOSLa+E~KNnnRW))J1-Ria!
z`a^}2@ZB5xv+Cmuk_y#!N~qf!+5)pUXsyjVCdmcG=49vZJ(e!hQXm-E-wk(pE7y3e
zN^EE<b{K*0-^G6!HsM}b*ZoAX_(l*We~uR@f2uBVOp^<F^_8}P%eerEW@HnCZv`TH
zTCWh;k2JBqeJ~wFD}Vp4D6uLCx#Y2BhM)s7&WWuUVkcudnkWe4rW&t}aD+8>NsMqZ
zac=<%i1%+_kj3bP-g~i{e_B=?eIzSh-MTk9kwW;0(AWk)EbkaX<E@srvNK*}^tNwR
zsQ7s_Z^x@ZfL)xm;aw`NRqlb2pa1hd@I=iHd-_>T#=$fL++J_Zw4hZFnH6#?p^7Vg
zJ0k;11O_)^j=l`G?GXX=7TY0LwA4t0HgG?U{7UC+`ISI%VZNH-7nNzC<!>sLpds+&
zQ@HAT{T6wC?t-9P>IRnbbb=?BRKHxskI)ILxPc%yLC0MW3bA-;L+TmluQI)wBg8J)
zuDZBfr&|3OrOHnsj9?uSC5F*;wJ%@kn6nYf<S5g-nOw*);g$okGqV1!wx-Za_5g(4
z-9E}p1z~y=TT$8DJk<o$wlgnXTN&iOa3<B~p9c#o^1&_KN|aD9?r@Bpl^_3WT@c8a
zMQ7Pr|HCK9+`Qn7PG!<Ke_Dch33zh3G^?}5-)InFF57V!0ZA|1C|<?ZTcg;TBnSQv
zMo1skhEeZTe%$-<&VL!moDs?G2ml}kMf3#d9wr17iYWRnRXu`Q+dA%<cfgw&MffSu
z$DQ+YN$<QaOAwuy{+g}^DnuG2k~+~)_V_Cp#vWIzCmP1*UUXXg+8F`X7y99CQq)cu
zq@=&@t12N%Ayd^1-!M<hpaGAD=a%@|1&<A;TRE**&U0IytFE8jCH&O&O!fU`u)qG2
zTla)&44Rg<%X+4BA$>0k@_G`%evzc~(sf5_KG@EmxRUgl6$VxrI4S4}dykdWz3mGt
zvY{LD@2q&TWSI%KgCR%WeI1?HEjhM7JWotNdp7~_bp0A!vpa7w<uy!K?P0zg!V5>8
zs<hU@`y4<4P`Y;B`x_lzHf9zzVF0ZDS65|=&4B3gpf9ZrY6KKX90al8Y%zR59C4Q`
zQk5PWPgh{Hp$m^qTHu;IAcV}Hxx6b_VKaTTUnp7mB327HphJXW<N~D@ae`D2M<jhh
zB1VM+@Ut<rTi|huhJ+x-S!^LiV-{uQ#`*jO%n6~cWRhhHz}0>SyiF1O!k(;R#z7LY
zLC^`+$M*-kT=}47|A1TMsjlA~i>}I_RO#4W^f4h7C+Wda*#3<Qpu)e=6@NHuyv2!2
zy<~XY$#g`=LN$}z2vHXjwFvyo;FRPG4$3lw^ureEDMxX$X02cFnp#TY9?c%Zmqi%(
z!~Oe+!;}(YA$e0Oaot8d)(=$L=|>}=wtHswZ6B(lKO9eQDb>xL#0iUO;I?<|2Wu&c
zibw;cBlEfk8bi38T~rc5#I_{%8jaR{2sg4cRCb176wJhpAH@J6Yh|Zj#t7p+vF+k$
z`0+>tjNpT5m#QsWOL8fNFJ8<xNWRFDq7_fKgGk@QZbHC_Py35}JU;*lpL^^-fd3~E
z>?nx#Y)bB-k{h7ck>~|Sv+|pXXie6c)zV=}wnR`eimhmM2t^OZ%tB_=`<*~z)9(Mn
zr2RKS$Pw)1#0Umx>NnowQkm`~lPSXZQXXh{EwS#gA=mE=2*;@UN(W7{<l@ZgMi7R$
z+6KQvFuoB-nQ3z&BJpkR`%vZ(O2fm}e(jHb?2qy&$o>Jl?-e4Yz7xv8;tVkw7jp(j
zp*_H$l?u|sSs~Feyc*$NR0=A*PvXM8aPCEM{Cxx<cDqpZEco;njg)X+wg!RnY8?3x
ze7VI&PDn}k5=jkfD;&-xXJdXpi$EBGke+4yspM;S6j{*9%Jvv-WraO1EteCj*cDeC
zKro1$9?plPPoF$nkg-Gwh3BU7QUYK$mqy>Kexjao`e?z_ANg&9oRQm=P~Hr!6%6=$
zb9pr|cry?;lyrlC?oO=5&?U`kE95Q^_O2U9aFO!~GkP6Rk1;XVRI;fHu;9o5VfH{)
zIg$vCenk*d;i#68wL-O+r~UO;)-ZXjXC9GKH0GWfQBD{wk~l=YLVSy+^_fJP_pd>W
z#xH3bdgaz5b#&u?caz0Bgp2a;p->Q0jk^Y;AoPWIERXc|*?1-7dGeU8RBAe;eriM3
z1{9O={(Qt8@9$N>Kp;CyF|9lFjv^~y5p(MM*M8VVxkpu$dz;<^2|dd|pNP&@5!uXO
zPZO)aM$*GI#15Zel00}ze}<r~ct!1}Pf=W&Hns`evSW&Vb~E26UAA^)Yq&7&(z7GK
zt=q`QmXlX!#SEkv<AnX1VSRvnc@=uADgV-js1<b>9Oz29i{AbSDdAju7Ca<qud8^5
z7?tFRob=U<vI>}NwFI@!LZ=<zeouodFo6_A%+N|-pLM_%&O1Q#G1B0fZMKH{?X*cD
z4Ai4Nf62n{F)F!#x}uN2T-XW1$NV))gQTGHT@n5{qBjEC>Jfb@MbpMrRYCe+okXoT
z#M=@ootlVw{(PI_7J{YkSCFo3(1GaFjqX<$1yqleA6Ba%fteC2HUt2lpv4&pDqvi@
z{(zmy(e*4HB0Ur`qg`Xd`5{0cYSn3X*)ALF45`Y(@y3z?r{(hcpwLQLUPq9G0;cg*
zSh5V#H*e{2*L^kKFS*3x-RObl#R0yDCVPbRrIq-}>(Z0|ThZWD1a!{fDh5y3S~;!<
z{Z)^$RS{%@{*kw*C+GQjIC#PDXt9n2uubWk@9axf-hw<&*=UdI!VlOC_J7<?X^u}3
z9Ze4Jq+uquq?YS1H+Vt8--~__Dofvl$f9UGKqP*K03JX@3Uht6h6m6~>z##|zN2La
z+szTjvDTuRZ!M%c*7txQo_mwDx~evd2|}2<ye9O-U;r=4{uAdtcY^lsd@NZ4P|;q2
z4+Yy-vR1@?Z*xg?h3Ao6S8dQe<^7c+o>#=WD|`F-_EidmLspn1LF9frXB^x%Qj$Sr
zm3A23pY5Nx$0WkIUlDUgH75AxUxS<h@bCk}2A*C}LE`!q{0AA0Of@{PC)*E0cvVe^
z0Pn%xcblFvD0?tj<b1Wx{R#a&ud;gg5)u~QPQ#s^NJ$1ftlB9A`;c?|<1NF-dcjY>
zUWxkLBK0#<i>np3Jgj6|T*%dJ_I<_24!b~%1ocoEfDLnny`OO<l6i>`n#L!^KiP68
za(=Tj{#rGVVu)kV^>}jCOa8(_#%yDDDeaeKj8xuCi1EGgBzalNsx@dRebga}z{G4_
zT-@8Z+PDGKqgSO^_|ZVomD;KoWtiGwL1XDgQ<LP_s?W|`%<SK~nJ(;c9&51963f{-
zGM>TmhZmgB+!v$<Khj&B57xrbexo{<g7ocnc6+lm+i%oS{5L!w3CCn7G%*;;MT~J>
zIXn&{L@_0>u#dsjgs*Jm@N_$%4zm;8`T4ej1GvfZ2hHVKFTEBktP1EOewmNC_pncy
zxmB8fS?GwH7-Do)!Kpn&m6~D?Z}4U>iSn@DVIYW6eMMPkn*AC@vWW9&qV|V$BIWqp
zQT;j)l0D!kU7c?xI2xh&rz^kQ_4=eb5H5(&e`$q@zUwP?y;72Yt%zmrXQ9=7hVeU~
z9{-f9PR@))-44Q8*9^lXA75?w#WaPF5!k~}r4`(P^2Wu3Mjo3Zrmk`FW^ys%W=|Wm
z>g&<GIRK-fV{xua)b9#4(kXGo^fKN-kUS=9+kXc&(F^M;WLNJ46$Pmv@T)~UJKj`j
z-@5}=$)wN}2I@<f2eaWG_z?`n*iH!e^y0-(bL8HR3$s%7U94a|a%VxigSOXuNWQd8
zyh0zI!q;zI(6>hexEpGhY!3JeW_f5V-(PRz2V^;4hK_KLUBixEZNV6dAYQ8GYZ8Sv
zjW4Xrzy8J!R<k$53C@+&2r<9Mbt@%MtJ)@e*a>ZSyXbK97TcNe({8W|?cRhZ){U%{
zR^S<kE7x9>JXI&v>Jp3=gb)?<_&86DATcF#uEs54AGr0J2n{3YK06}qekIF-$-5>m
zh`Z?Xirx%@;hA*;1#LaRxILn@)?n8E(r}~2RQa)Llb;dy&sF*o<G3j0fATd%Bz|H!
z<|WXJK1RmlSS5({(Z(-IVB@Qo9HUXj<$AoKH-E>@CK>Pvh#G`w?Gw4YMTlK7=jvT_
z0DcUQmj*!oYJGu?9!uv@Mv!57f#+b>I?y8~&lkEFNgu4~Aw(u(eQXWijs}odpf`uZ
za9{EAa2~nLq9h5T6A5>9sLfBHo8iCNa@>1I3KG9@DH73%FkUu@y85bip?(YUBkO^3
zg#@5TumrZ%<{@cLyE#~O`)y%e?evOwxCU@(7|&FiFs13}PgU+Hw$*NX6p?i^(eWel
zKZGt23|c{VsNrJ-r2|_U(Ec)_aKFMeXh$)a=shFnR`kD2RQ9FQ-DCmn<CY?CS3!un
z&G=yTo#ea0g_v19v`7bqt&F2#K{FmT1R3%dNq>c!<dcVhkLJlo2dp5J-Ymrz#0cr`
zY_gP+V!5nlNPtyX70z%f-G&kj05?x5d7aTVDbr70vN!vp^27R799H|l&=&3V*Tgwr
z`!{u;FG1NbFr=1Ys@S)-a4MbWJTWjZObox^VWW0AD;UJaS#wJEt&Mj7L4i)Rp#Gg)
z)<22C6_jmU6QsqKx<x#(I4S|^lJU70LVJc}qEkgWz>exBE*<YWzI!}@7fJ~uIAb+!
zfM_6^jdie~{wS5$PpjD}4*iF(0SQX~i?4YTcREd!_3vVDxE3cay9q;_)GLH0gafE`
zmjEnzB-gCk+$-9x%QFZ?x5w3+WtD@dVmTEo22O>DQ*9(*&@o|PoW&~1=gGz$RBps)
zY9f6oZ7WhWB?h|K$gwdH!#E5%CBQwJQ-vETfvnOgF}#fVzeZ6Cq=F7M(Ww;r*~O|H
z5lF!(swmAjwvp@fv*wSWpZ@&JT?z*~`x3u(10xJ>&HNR^=wSigtRZmKHLDpT1f#d2
z=!m-ssdak1icdrtE3;<De-q~~mg;+VhE5dYqr6D$-{18|w0AA~AK2ieIjJNleL1G5
zuTt`VLX}n`04Yi|yKh8H#GLRWBsbS)`-SvGi~kC`d86(JZoXhN9x1oFke++|b)jrN
zcul#~_}BR!=?gwGad*zewl6AxfS#1txEN?_#09F$POEyeOW+Ix+IRRZD!jr32kZSr
z<VyIIycz3E8>CU=J*T~OCbZC`tM1%KM1!$}V*Tsg+9u;m%3OTX$>`$X<O)nm>1eO;
zMsYeiTZ>)y%%q=aH0S00a@5r#Qj#6_`7^CwMxTer@fo$5W`#H>I{JKT`KVn~b~!W`
zCOBSyg!D29-#`#tZX65hs`=TsQ>x#8g3LQ$$aPct%vPI~_;z|-jF-FyPTMwixu+>e
z>fLgR16Y4LIdM^6wNX?Uw&wk(sw5=tFR;HG>;kZk%UxVf5wf7F^E)^<uY?OGFXjHq
zDeRtW&o1w6#XK1%KG%j~X)fmHd!2?w#$K)b;h$|iCPA#vL9yOo=(um_#rh}cZ%x@f
zxBcs+`uAl7(?|2iE3DSGsWBa1;+C0TX16R?kaj8xw@Ou}mN^!s)yTw>@Ip%ab>AiN
zgVx8|OjR6F$Dx?Ho*s;?M-towxDfg*Sx$nnGHp~%w$DxN)z>;abj47Af0SB*-|MmL
z^qyR@n7%}ma5`;F!NYium~9Pww)W`S?oG%sVQS1rM>xo~BCF3|c$X<#u@tjvJR-fN
z>n&Bk92Dhg-Yl}OBPv5VFYB%#$Qo)acD#XmB_4zEo1#@#+{<nxtcQnIdNAS&!okZ2
zXlkgRwySWm#Th(3G(JF)6X%RdB%gR&DypIa?7yCWOV*emj)0ieL&;n6Zi~?*_Lqy{
zfPYoV<=REb@rJ3o80@3fJaoXwkNmX<?>)i3r_R*lT&`BAeba9b?c81BSarxnRXoNB
za6X4p(O<*hwxZhSyWw&;Iun(%_^#28+fmVXVR<#+GL;`Kj*IP4icvBfbx5A!i76Ac
z^{m-gZ@s3Xv{=nf)<QpJ!tzs7U`xtSr>Q<hssqz5inf&^NO7Xwa!CNnL$SmygHzTm
z9pb>P%Y>BePYg`ko#}$Q;P@#GfmE7(FIzazd}^9O^ImT`Jd6WUS7hT_)_-jutb|jb
zDTSYJB6qEDDjmX&xC;FD5_=A3dObN`R56nQ#QJ-335!VHv*BO{uX9zXgsNh|vJIPR
z)Db~ZU5W7445Q$Vn=WAq9TWo1l_3I$n#Sf%7w_d%0lo*nt`~A<*)K}OAI!e)fC_7~
zWYy49XC4QPFJxh49hT>z!NPCO%-(WhAQl=RycPv+spYN6P=>!(X8@7C70j*O;`HUc
z3k#gk8?@m?Z)?Hj9FRvbFt;6rrWN&65-W68pK2M3!C}%><ds?G!BC7;14em<h;c3O
zFEP19l^3w=(tN{kMsJl538SMc!?y%>dywtLW%U`+{o#9@Um+LZ_bQyBbWCPcSszU~
zDKji2i!-3um153j-jB>DV(MXY?R~p|b5RS~LQE7s!86JVh5QgiP#!waQd3oisS$ku
zw^=m8YK??T#@3vu|0L0P_*vEmyKTWx6?d3d^iy`Ofj&L{?>laXfz1Rs^cQ|qzNup1
zj3~0@gMkI&hqIY6+$LGzX1ZHWzn`DCTqiRIWq0L?7O~}azCls5{DA+JMsgUGaV50j
zqML|V@ev)?t(Jcn)FPT}+OHgjUo4M#`d{gjc!qo3=PwUvwE0Qjn_z&}VxPsF8cZ_0
zxHc-d*}@Ggzj)KiiL|hNbM2h%%35-3gRsTFW%$UZ9ZX$gXxqo|r?1Fx9FE?5GUZs8
z{a4CDAmV3ns44tcx!8%rpOds0Jbq~wt}oJq&Meh2RSh2bQdKa0q?Wz(cV84E)H4D%
ztX8kluT6FmA#)NKuC^xdy$JS&1DLt|19x8Z^Fh-A|4wNH<5vOPz33-Pu1u*zNE!3=
z8Kx-gy0p8*6^o<n;%wDfAAC~#G022FmQ&l5m_6pxwuY@kSV;oHcn3`4v7}%KB6+zW
z4H{r2xKFcx)kfq0UC|OIxLUJZJHqN);{I58pW<1sG^{RNZso=Y1c+{+na0Xapq^L)
zzeStZ-qg{<4A&o>;GP6J2QMBCG}iE+ail8)ka08_&%6X177uzxfWfJptNb_%Itbe$
z#~Vp^$wkreDfG<_S5r0uZV3Hl-DqQDvC*)bVMU6+POX#b;E9NA6P-!BX2^DciCfP{
zlQLBtCH1<@i@rp_?(`paL&lYmt%P7#ik?-qm85w9%e8cb)#b=5aPyfg(iPu);PR1p
z)r09vDq<etiBI<`H43Smmi<in;g5%z#u66P#al!Z8&>-|)bxHsEAsXi)V_S+4BcwP
z$-95*m%c-Uq(T5;wd=M7BA|ZW?N;>k9X4}!7Pp!~sH<N0qucW3{!<j&R2v`-<aWra
z%?g9}&?N^2=+yPys1bpHRWaRZe@b$u&Icj@N)f>>`mSOOcBSv|WY1e+7>BSt;U`RV
z=L_g(aFm1^v#TmU7*+3B<L-Ow7CIqC2D)Th+tE94>qI*02>B!4J%a{lck&6N*VOrS
z?c+l4(%z^^XY6KJR)x`_?bJSTBPHYHKi`R)*dvoliHUQF%lB*eu2dblwqB{8J^Ycq
zXNY>e)_J5Oa;4s?sgr}8sRKSmos3?J?{5sAM_vkQ=q&DfBP|DKyOT*Ldw3fMooFu&
zF0Kg9<u3XeMB{kye-L!79BAp8T|2IN3&gu-uuP_JzAetH?4;cCaP%=s(9oS-5uoXa
z{|m>6|AHgY0gS?y+&s&UGvxTypD_VLs;bfT$C@rxX111(hTe4>8s%@qCvx)kb8KJl
zl%P@jBYUy{bA5}I*hn4Lo(ajnKNJ=J#JHqJ?ByHy@dPMY&-wg18C-QOcUvWeGDlg<
z-~I>?ej)1)Q3>kI`>-BU6AE?PTRnUzorzCgq=j(PBW>@%`1<Yn#yptaugzn_H~zxF
z=(33rjA_$Nec(1`f>{7XnJ&ir{U1I9QZWy)^%o^xbX#~J_fB1M<B6(~igY|jbVx>$
zE3*OG=6Lk#qOT)r_dn^R3M@f9HxcSR@mXg|B!UEhcuN`@swVJM*TwCcD=b4S0cK6Y
zj9L{{!RoCWFcwpM<mQUcOy{bGX%?_lEBV$$vzFb*BO!jcWDWcm15ktM05hOPtQ)!l
zubbpYCEVn<0}0Jaf{_vG0sLO95`%6HM*;h2M0ER6V|SERx4{0m8k49HuY~iy_f>y7
zn!q&q%s~bD8f++y4p6}{7;A95k%+shnG(lcz2$h@+AduxtJo=zoTm60;b;_)v34K-
z&lQJ921zV5!S}D9`EN8~=qMA4G2+aB%eAIhG^uJO{K8$ur5!2@WRE5PS)u<ewylDw
zeTNfksHu$Nq$G)h5d+<wfF^eZod4+su#;)07cI@&T~%(GbC`b)iqoWlKnP`r{<jW`
z%jl_mX<QJb{29}fOA`L<wJ_z-=p<t%N;OTuR=uTo=R9vfxWn<1dLaLHMvT(in$l!U
zDv7TX*JO(tj$y$EwAlqR{%+cfR2X(Qtl%*kIni?I=YNEHv|@@TAFuFS4kR!>prJE=
zSCDz=Z6-rI8OfMukpCFdt!*;I4*e#^gg4r`UXXSKw?@d-O{)PLxnr(i&Kt-?E`D1!
z-*r$m7j5=5cOdB;czBcmk^Zy~THg9wGr}!zPMj{AjPl6HTe;;&g>vF^0C$4M&vTIH
zks#z@PSla_`VIO0!X(l*b*a2*j*Pl=0Y{<rW+nlO8WkMmv7D+yj`?6|DZD4VaYi@E
zdk{sb)&6+!_>CJ6r;jbXA_FqHj|mRgnCr*gy}zQB`hr{<>LEB8#QAjPw2mE>`2~@6
zizwkShJE9Sl5(SqcL9mr+vDlDU+D8;qLarg+m-c6F3h}Cg=Wx3cCF2dS)Hz&8uL%R
z^x4Oa-@2SI#7A$;C)Cazt!7bq?|B@R<KL*H37R_j+&^Wb9K_mcFgNFQIWmWZC>{Uy
zS*T~(*RK<!B_m_l+w{P-NX50_pC5)wq#7qKq_PiN_8>M-$Tg!1je?G(#GokXT)Dxu
zEYY<qPdOPK6q1X>L4O=9II|@jOq`fVzSB7OyErwDP^}3XqIitS1n<3It{g*qqatel
zj`<Tiv$-)b6&k5p9ssTFsj!0PbKb;Wa)HMEIL9RtPdf8w{i$dnBP}j1&3ncBg2S>k
zbFK$66guE{KI5WiM-U6^r^Mwf=?a3g_KjI)T3X`+U^*FzsWrzZ;f^ab*B37jX?c0+
z`TcU+G2}?ccO_f|<fJFVj<mFMc7Dv79h?V-gryQTg;_R)+stRDL{);%yu6?J6I|U-
zKM4zSdrcGRG}UGm0x{Wn?wcl>ZAYYshNPr)rk;jA*8{eryaa7D1wK^`xD#jZ|1H&A
zY%Z=~svK{NdR};KD{Favh8$^J{2}E~ph!QC)^?%&Vb(bpp5hS=U7EWhe8SL=@LqMB
zF7m1{k7bvrc`d6cb?LtX#(@_d&<fI(E?%h0p=PSRCvb}*c^y`&j)@<bd_ya#>N1V7
zO*`h{OJ*a&Uhrw<5O}H=mf;0xEU&%nWmW(cpHD_=bm`8#*GeVY-`MTGRd~G77cpgr
z`lME|1HF94bD{M-*q0H=o*x&41qDCl+TAQ<w%%^dmoXrY8iVvZIIjOTEHE}jy<c~?
zP1u&$@NcazDZH=FbO194xK`wfe$v%+g~*4FimNHUh*|O6UbRKPsDPgo&JLSBWB1}7
zbrtHeNuKYs34;H|J^!`3^k-iClh#gCusq2fr?%kr1|ETW@P6ozwKZZ$r(N|P7>$0v
zoDe*Z?Y5)(S_VHf_2Ye;<4-?|s=Kgw&iZt{)jo<XlV<VRSlN4(g^x83Ha=2Do-Np)
z@^`>}*4Y<j%A7i3T(;n31WIazg_6(ylFocG!2Vlu%&A!Mpx=y{q$Xo-TPCRF<dR21
zl3$P|(^&r_Wt`G>I$V10kH*NW@&eIrtbmMB85Ujnj)v!1x3|CLj;(_`;pS+)*;6Nb
z^;s1<k~p|<7w6*sm{pQRG4isQHq|7o+%O;#?FLT9J-XsjqasebFfw@_$apOOjGW_K
zu@`k~q5N*^siTU!D}26u$dBukk5};O>M>#^X}46tI)o@eH4SUd+17(M5fJz8Y&5>&
zo>+9%&=Gqo%yb4kaYFSi&dC(C?NWI=SmCuj-!2pHANS1qQEhz?aBynlNvl++eXD%{
z=Z?<ZZ#h|^XmT+ur!-RRJp6L=L0L0w@Lv9;Idai_v9_g_&`rFb40C4>_58qd=<AYm
zhqUN!YG&<mO^4f*%zy(<htfj->Z3H?$`(m<Ij1EMO^b^-X3<bEO0fdNvz_fl{eHx}
z-uNL-vQH_#rv!lhxB}sG6Dy2~59gq`@rGpjMwQE8E&M$)Y)XxhO`X*p?gP$@<%E26
zQ2FQweAaiSrPAJzeLr}n?>H-BFxbsI2yUaf$DQRe0_}TmHi&RFKAfoZk)j>iU#H5w
z0U|kHo=QV*oEsX-G)>iF->&-f$3ai|wh1IVat~%2%dZ=@F5`}Pzy<2gHe-4H4yt`J
z1}E>!yRJG>`Z62Mp2w~Q*raUTs!?%DK2EmqvJV4}lLd$NW3nmIQtI&YJ8`1Olj`4F
zH;%jt>1#74!`v_Y5yVM~53-ZXdodjAowR*5Bz%`BCjmsq8D}e!*Bzy?x<7VKa8oVs
zH*YU2wsoa{3LB+!03)j)Xzn*3?^HjMEQup^9Tz?-uVx7tB8Mp!SA(x_=$6W!rc?Zf
zZjF5FSdSx-=kA$>y7M-qOtecuayevh{YLW4!<oL^Jwws_knP>@M`C#|+9}Zbk#eq?
z#j3QipX({8X`K)_t2UK+DnF#T;cXGTFArgM$<SdVRpO|uCQP__5UTuYqmlBbhK+T}
zq8w;nj~O9Z8rhk3(2%?PLbx%62;lf+^%fPEcJVjXqT11@_W=BZO8^U7F*UtR-7EG_
zO}4XbDiLq_S;Q9)2lrOq3NS(o3-k`>p*mfS>lbQ^C3oHJ;j}o_XxPQ$x5pyq&%7PI
z^{R4@x!lcc*QWX%wPTx|i_Ii838?lX4$AdyiX|E!g8)m7#ZJNvCrjXQ#FIljTK-9j
z?br2pdn@KF5b_0rJOyg>qJK;@X$AA3Q=BY`NLV)9uhN}0BYp?8l*O*sQ>7=T8pyL*
z{Bd*m`y?yM_dddBUQUQJ`NyDl%{KiujBw9&{7BfT+ISk$GIO`4n>%+D1q$YE>y7h9
z<-J^8Hl#m)DV)6+!gr6^XD8K<!Bm@*@%Zc&guGlOC)|2-_}=bz12<ruN*gT{gW5AN
z3bKiK&v=(_HdYE+W5VctrGLZ7#*Sk1I4dc3*VN61vL1`~H%RVN_hPESWVe6I1g;Ub
zJ#Q&t9ptN}SQ7YR5)(msxPOfw3G~5ZB3eBO<Ra{HUthbqkQCr~9|o<I$Ucc1?}s@L
z_}J~{8S_upkJGM+;%tBkEWv=Y*~Hz~p*4>$-EPL8J4davv#InURT-A@FNg%aSvQPD
znDfAS(pH~B{P9ZXW)dn5JYJ3H|GWH^6`Uq9TfJ2&Dw!H8o!ZVpg$*E<(7cCRE^q5+
z3f3;X$Nwg}9r_)DL$@{b>`|7vlx2#ILMmG0Iq1me?FX~{Jljsv(W2MOt8!p(RCbyB
z^d+<b5;R0(`bGM|YP|I}z1~@_Q%eMm6FH*96ROt%t-J281vc<Z+`(*s=j(&d$$bhO
z;a8_iZBB#W`xDQ74rPZyp1K7VOiVFs-xbi?Pr)-HwV%!cqA222^%aYLkk<Ha>6^ui
ze)LBID}S_W9;emY%)VON!r1bvS>HeB5?y@yo`i!XYTLwQaXZ=hMJj>C2QtfPV9Q6_
zg{7`vzL-x>d^(3);#MZNwbtTkph=-sCC%eS1ToyX_nlhMPDkUy4e@f?KR(r)@Afin
zn^L?5kC9~CM<-(u0>GkgpP81jK{}es!p2=jIGI+|aUcxV*^(G}<P;7@u_kQ$YQeI&
z{&!y^gs#VgI^DL!{k8uUXw3D1Ufw0>9<K(YQ3rblKOp1xQsGv6*EZvaWlc9!%7cxz
zn|iK3D&dELP^W)_%}S41#Efgi3-HBB`11U{W%qgzVr#%5`fF8D7xp-!T4MTLP9JgE
z>Y|RVIUc*Mi{f)y`umtIzkRWR^2D}x9~)73h1Sd8Kzk@m9GFQ&hWD4-P2q#NWyw_s
zk(Dg9$qpSQRhh3i_ZJD4+}b$nw5Nk_o|Kul;_9MEgm)v=3$s7!Zp@6!v81x&QYLG-
znTR4JPpj6y7t#$!bS-#Jz$qw;(^lD{aj>hO^C~3^{GoyER_a`ME%kckZdeF0qcE&c
zhjS*k$4~^6CE32ofj8K6l{!k`NhC^s^iQH<Y`SFJC%zrImWuG_<gu0g&~1&)f%6md
zRo;;n*R~BQCp4Dok?!wknLbk{Tu4#;K!G{#h(_)Kj)yANwAnIPjXIk%TVA*Emul~H
zFKTack*$Z!1Vho-IEC0ODc;PWWaoG|BEsrYW_hjZGWB1*7+pPA+6$ujSip<awO7LA
z{kJW;mHdkr6=7wkgn1Jb#p~1zer35dNmt`aEE6AZ!P)GFAC~#;&#G;+OPF(s**FoN
zJ+w9W%sYdUCNVIP0uuNLun)!K&cKUGC;-CIEH}h}_i9G;A;p5c++y`(>ZmH%&I|lj
z_9`@70$uFt!vod?B#e(Gv7f&1(*){|`P*96{0N7UFF0}^%K|dl?kRX&Ev_-I-*<ej
zuwr_+0F4+LzTCH8e=RN|nfR0(S^liC@0-D`9eWBF(R{T%&s<=_BUgvqiMh^4EdA0*
zz%I(>QmWOqC(;*MY}0Oxzjji^MJR06dN~x_%%8Y%dAiJo=IJjUoyOYhzDm0m=;9lH
z$nlp*>1}s_ovRK*MntFb$WD#B7)ymn9ZJfKInPu$?ll)rEm^aJ@~W&;Su<NgbosfY
z$2QyI%f}hhR4Mli-r3FLwc_A*`*^uTEPv*h={bt5$sbD#8KKrOmguODi3lBtEeFz$
zMEW)b>-7M^!(*jH$ILqCAmU1x+>7>Bh?me+fnzPKLV!7(*fvU^Y(FB71(<fJ#?%^e
zP^+#MEkEid4EihjL%r<(C!uzyb;KE2^A9-Z_@vR02=Gmj?7_yi-8Kp9^|j#;2s-et
zz)R?vPpBs=i!!TtfAZ5kW+9DPL^Kc#ucNr<oA6RTfWx!Q%g&vNl-8(k-#hq;qiQ<G
zxKJIzU1tSTuPZ%~ozWXJ5Mwawl$ZopfySg6`+me7AB>o^U(o+^7;R1?q?q!3&3Q_7
zzBChc!g~p0R`_|HpU;~hj`cp%*qB(6aYvWuBK>oMKSPwzyP9!RruAuhRZc%lkg&RE
z@9)-YM6#ADwtR_~RxqSXYpbm{AynsZakV8vnyDA)5(Qv!<MEv_dtUK(5=KlSoT{-E
zlLCM5@dh^{Lc2|=pBx<SnSl!Rq?@DTH-kI%zsoSdyNZCQ`{@CpiejC=7}4r?EzjvU
zZ~WLR9ek~3+&|IaGv~AQQ#ht7$nSNcKQ{U-7l^9KgtKXM0;eTtnPu+2C8846u?qE1
zIt~%$1H*|I13C+|IyYYX9_Gzwt%of^F|QZ6x$4PSGIuT8O}!aKO?Y2QOH({WHOUDp
z8i7@#{l5}`RZdgcwjVV<x-vM4HIV5*^wPM!<Jnx$a^YmLNDd_(#15b{+>t}X8cY87
zM5O1mqfRK(p;||be~vPv=g9Q1G?x2)zHtslsNj6~KPLc!IO_!;GBX19(6=k`onYj+
z+*PBdCNk9Wg+wFDVp<aK$UL1S$Mc8Q6e#+m1X0ZBs?7FXW8$*s&tmzSqNn5P>h`d{
zSu3guEy1yrskamD2X7?tp*wSM*5d`jd+{&G3Bw#O1`t`pt0jrs?qW`JbTVOD_a`~1
z9qB(&YrJGM@}jbYq*u;47$;{Dqq6>z|8Ej^2#B7!E%hG>V=fh&Av9NFt1G_<*nA&Z
z>kU2FOVV`@yf6nB-)xiFlWGadkgep@gv<6;ChnI<$M4Gyq<YN1q4TTEYs`t6|3-Am
zu8MItUmq%L?`_{I(Ts4lr%KSY`s%M4!Oc!C@_O+KB%X#4K?p;DmA;X-7Rz|InYxSN
z7mJn1$2mI0B(iE9o2+;p)O`~P*0hwtqk#d?Ex+|SKCE7KXFdfLv=ZHEwRw&2J>2Ww
zU$-)W8Y)&xQH6w0!KrX#>v{v9zsU@0w{PVg_?$R9-lmwoH%yo}8~ZMst^fK{{?K~g
z^$K`wuQ*S3czv<nTP-wpd~gR}Hs9?<14-RaUkeg<kI%tDb+67Btv(>L;~&mKM{k&@
z4J#NVi18vNM5?FO2?zu4dKL9fHm}dMc^!P^K5JjnUZ0PFP02RqfUBHBzEQ!LDN#Q8
zoOwvEy_>p{?{KIZ;=mlIvyu7IEn@gXS?tT(K6e{)qy|P=3o4stLcGBmU5ETUZjhQm
z{+@J3o63jkJw(^63Y9RcH=z3TQ%-{1PtNqS$1rmnoevS%g5o=7{r*x4`@zx{)G>_f
z%=p^SGRpeUs8VA}6=|(1t%Duqfry@~0fcaxxjUNL|J2bhENq-Re1l}b|EXArQndg&
zk0r(-DD4)HO@sfu4bmb)3;VYs{c`sec_NPu&g+ihePUg8K;6Fd%+%#ULpxLil1ehn
zvPxN--Yt7oRHq0mk-nTKFJo&Psq9b4#7S2hSKkPYhH&-!w}^H$)xqhwrw<i{==gbt
zBPMwh_~p^xsG9wvRp?@Te3x-!&GX8tk?Lh*;V8UaKK=EZF)z$~JT(E>$3>_25l6Kn
zp>vY<<%zd>+jge>r6Y_D@zUMiWKqKze43nRGLgwCRKH1>B!5xy=v82O9?1T?dq%k;
zHD{xl1R(#K;0UG+l)?o}N`Q3@pqs^C(q@^up+)$ru0|ada88-5YbR)mXM)m|>;apP
zdvB+<HOVPY?kG`iM#zbGHq$Q)Wn2I<yaJoU_f~~AVRhDW4|e6jNq>+CJ)5Ig=IPbF
zC&k#qqo0ZtB;HT3dHLG&x=z8fC&}Gv{;!1rtw0JPZ=Z~`yZrBa6g(6^axw^&ZZgfk
z6QBlgg#)i|;)&ElO}^u4Dn1>7;{ot+_hO*06%ZA=M;m+AmO*0Krj`anE{>bE1v$8B
z<6uhvluvCm$QXbkmzB_9zRx`+^VKjqPJ<=3u+KD^-u8xTTWr_YcZH^T1VfgkE4cKw
z#>Ja@E8f{ZYz`!x|E{Et#<ZBwNxwU_wnwS5Z!)_dQ>^`Ec<fr~YrB*2T#<SPlhwkK
zw<Mi!bYI%{`k*o7On$#w(2=Ki4Xf~yVnSY&bG&=@=)d;z!9i20GcDdt$AqTjp}ZpM
zM8lWp%_-Nu+F{)IZL5k!oi12HDOkRTyyvvQaK~IuRj!2=ABfsF8mUU0-(-qzk8_YI
zuV8IB2la@t7NX>vOxtGSpq*X2<6P8@3g9hpj>RiBWxI-|pv%RX=L!LHxnHI?w-h?C
z1xhv8CnD4GH*oF-kZ^LdlbJd}BA|Y)L6m>OEh<DRn25X9UYtAlg^gU@Jmpe?uW%|E
zW71a_G)>=shJ*faK{>{b=W(6^m1l6jp40dDxVh*{p%#mx+hxImO)9JNaRgDu6NBCx
zgO+z=+0?>pn(F~++wo+LW#v{{dwS#u*yUuVXT#-o#Fg8qr<2mG-~T}Y(UuCPFJlGO
zW(K)3Y>ip=j6m=)XoCIh%PsOvJ+*&M&x<qP`=Y(8XA(N+#oES3GQNn)UFl1y>0}>c
zt1Z>g(@R@h{FftGz+ns1v*$rU&0s~txR5%n;MXO0`-!k-pO%hngB@mAc}b5Abk_=O
zw2A_ptruej#9~Yn<pw_MZvsc}f4rB^hH1U*D6|Uz8uyde&)n_v{>oJ$S=qVwOU3@9
zuxv&}lMfE#1H0WEI35XQg|S}}ee<NuKQjebEV!E#${GPYJ>xxW_&=WTjiuBh7ZJk`
z!ViKYT8-_oug)o`HJoE5)?6ROZvdSHf(LUokvtQ(*;z9Ol&Qi<;l{Hi7+3KJdasG1
z!rA7;D0SOU@%!HbXs54Z4;vaJG~+9&H(XV_OltIQkw^UyR2F_dR2J=;I-ebxs?-}P
zX!<q46^?o(BpJp_sa}19lwJm?_f3q(M?bZC<EJbWo}MrOlQ4%+zqSLa(MT1vYU$3p
zxanWZkFV!~DIzB{Vy<P#nz_!-^FSw24(#f>*Ijk6>0wVUO{3iSbHZ;%mQ(sA1nNOV
zZ0yQ#?)zDF+O=eS6kL(ny)EHYsmyXefsLGa?xYa0JvO8{J9C4BBj9yYsN#+>&3I9r
z%!=#AadWlJc=UbO4X_t#F6xL7FC%T)MKy$Pboo(9LxM*>HIB^1u<$0)%ku<O6e(Hl
zL$vOMEDqo*;&=tPx}$osOQhqcUV6b5A1CaxlH6;7w|inTA<h10LBo|vrE6H_?{#5q
zS)6Q!EaAaGmsb;@Qm{p1EfEKk|CSa9WMifxgXBUaLl1b7EYl4{-t_CbKh63}3JZno
zzDsHxL2IABEU3z+)Y!q|oag;)**q1_`&L;C#%hQPvQDsVoIRGF&}PBIg+9?O8bujX
zN^WA6#I6e^cLor{cfvS!wO5|zsh;b&O!VxcBqi%utTY0>(s08s$rc@gR=XV7fA*b{
z>mD%L5fe;j6p*Z_{U~9WgLzo^{O`95?MyPm1aF>@$s`_jn?&5RJ46Bh3N=WE78cP|
z>d$DPs)$=7+1Rt0`$rFR<9Gwibs>GB%FT8l>+Gq|L!T?RDr9Fu#|-7bscyBA$t*2H
zjRj7R&$GJu22l55f!7xK=yh?+0%zx12iNQAjHLfv*ZatypB_I!i0}2zI+ax8W<KaV
z+?(07TCjmcpkQe%gD7#2p1r}x^FmgCaOhpP#puyrtD*5Ss4LdgI4e5Y)evaZe*4{^
z&axRI`-YS3LZfEV^~661*E_}BH5Kw#QY*P?mVI(QUodXE-S+ITxfFdYfVjX^`3XVh
zsXb?~UihR!mvW50)tPopk)cE%9+{H(n42F9etojY&ZzgBlW$#aOt?KuDoPr&8zh|n
zPC(-;r;rUQUX4bGPQ-Pa^7MnUy)nZr<3lMaED3R-tWnuyjY^Asocehaiu$tdHvsaC
z^GpGEd?OhJ(|X7*<``}Y2!AW_TK|m$kE)uzG*vs?ClV<3vkd;uvf6SK<tgkMQ)N4-
zb-t-A);bJH6z2*F51>CZ;h(^<XG9Bx>=gEcJ6&?{kbS(mxPRCCwuS~Gqlxrc`Z<$=
z&E_aSr#_K;^$Oc6K<Tu36VE?dM}WZpyp*i)o&eC3P<2U~h+YVm52bs%RUs)FJ(pbl
z5z|;;(1W%|%YE;4Iuz2?k+Ev4np9y+i&~j!?`@qm-DuG`bsb^EqxU%mpi_t@?-kFt
z$pC<V$D8oSP5yXg;N1^8vV)joO&QtMSs8tX-jAFGZ8Zt%oSpXTr9lKSl}G7#5<fSd
zN2S|%Y|(9@0Dm90<@l!d6_YAX8xc7eE{6~A1{>PWk1Vv_-RFZ0QG=uPpV@Wr2vqE$
z^r%-H4^a7Lnu1wZMZ&L#S}&djb`9l<6pt#`4&sB+yP<&KY_RObuyGB0$B22BTA=6J
ziRNp>F6X=|5_Onb{<$?J*c2<(31x$}M(K_T9Ux73X6dNX1^f7zHs+GDYd`m?bD>P8
z6%z2<T;Z^Q^OZr^5L__aWIGghUt!7-LF6E4I$_}?8CJp&BK{OqQg-Y?qx%hR5ph*>
z()~{p1|<f-GPwoG9JaFAKyjttD@Jvt6U0CCn_t7m<vjcVDaLE)M0};pK%klul%k_;
zS&MG>j2L@ftbRWobmOlgxT41yZw{wmc>5cI;^mwe0nlo|e1huo=`GG7=!kBd@fQWh
zXsQ@BjBm<J=#z+IA^@ULXF2IXi2uELaQVkuUf7PNi}TJiijKhgZ}52{oCQ0g#M{LP
zaQUVaFNfBJ{lz=?XZ=CF{{ctK(hV<Z;o;)cC*<fuqfdnnO16TadSjiiB&RXzL7l4~
z?vXOhUp<2a8_d^G^ud_~f~I@+C2+a$I*kBQ)zEX#4Jup~hRqoSVv#dhNMvsmih#rH
z9STi+C_TgPPw+=WPekUS;S_00Nl=q;Ia}n6B&^9IV?1CCbGc@xTj$SR(E-5zhm4`<
zC`yln(C_m!IILM9w;wY#KZ=R%LM8*zf7M<xS+3k6_fug^Vr5ubBh|6Nk-t)tn!DEt
zlqk=mz@%8Noo4=VrrPj=|6IHa2`>|EYSV6t8!`oLq0}X%`I$~q5r%uWZrr?t5P^*a
zHaXV75+sq<L1Z^yZ1%bA;)y{%-1qiKkd~X17nl&AmIa_kq7n(YrKPi@QE)#TivV{Y
z=l_UT-Z4XB`+oK9Psp!kbSS-`oZ5V3D!PCjawUM?QxU32$ff0x+fYi1VDL9a4i_#6
zwZJE}T^V0=lG$rd)rgW5A~{nkG{=NGfY2*5#-o3ot$kB@4~pKLgu;)HulyyB&oV!T
z_M^BPDE0ZMrPzX2Or5YBm|}*N`|i^BO5ik`L6_6wJ!=j6lP`0$Uw|etnH4XM*Bm1^
z!{|gD{IEwO?4({DKcNA-K86e51y${HGTM}NtEtg0n>e1E&*^^t_)~gc)|T3OeMv%e
zb?<!{z6i=r;5IS!Oc5nw$V7Z<UZ@HGXQNVQR9PRM&AIh;a*JYdhUeEJtc-^espM9C
zcm6YuN7HGg_C~d+4D0)PSLKvzUR6QgK&iMl`mSE}M}<CrN=)!J$K*QwA-rICnJZR_
zfLhDDcbrP(63*Uhubc)65)g`W@wYw#*8xYYkbei#7g`2qQwCYU;+y(*dx>)4SXObG
z5%5fq+Y)g+`ml>}U+stFLoRs*k#*zzWpC83`MqA5Qo%*?_AgauBG{zJrdzf~jA(1A
z6D}P6!?ketg*8LLt#i$;#rL^;gS|@i^s9k!2jrg|P3JNcU+fNNGwgCnNBOnn?RTxg
zZzp`74_czUs@&yfCB<L$WaAVB^PVS@(6fps89(2zx?Coi_#)xoya1Cy2$r@{b3Hnr
z@eOIC5WXu-5A~Za@f>N+)gUf^isgL>{!cH!0{ayaTZ!<f2Y11e_B4vu>T9OZT8G)0
zU-Af=n~D_M?<APC_Mm(+6C0<Ti~c9bdVvppo`xnbvKQ~gv&Z+lHeTV*KM05-22EN7
zH+#<tlz!o4Unents-RvdrTM%@2IY5Yhxk@QjZJjr#h>2VZf7tPKsFAB<ipy+ipUDt
z+^_z5tzK36z3v%J%G6k2e?s8Pl-Ly<09{x8Yueza25iN8Z_JpqGSORnhEj|&-4wF#
z{`4&)wCs){je|DD82>@qPaQPx+YV<eo1Io;S06&KJq09v6uqPJSHzF)XAFg)%yGV$
z@$2yE+@^n);~(|8<C??@?UJFVDzs~k1_#1)utFaJzIdPXz`g3(n#X-6Z<!wiqpO4}
z2J+252*i7b#OPzYG$EWg{|08zw1_n`W{Dv9l9l@$hXb&vX4qkva*YC-rNiyRY1;&7
zr2kgX^1QF!f*iJ#Ur`x-$Q<^>FK?UT&Z3?w##iU$P8pZ%@}7}?|MK;n$j|WjeB!=E
zzu1@Z|FHFzQE_zL)@WnFJ-E9&1a}V>+})kVg1fuByA#~q-JPJp2@Z{Od0zR>ckex8
z^p6_VRW)|ivc1=udrgX$aez=o$~j5_*~}-AMnDIgpNf&;ca^z7rc!#1*{jQGP$k$%
zd#JMg$Do;d#(xYcf<*$1wDG)J<xc1FhmokBcaL&f_01B9zG5QJ?q+-dT>gCO_eCta
zuTH}IR^8!P`~MgX7X9b!PRBtH^Z7*{ljWD86HuCz0UC$9{hf?51|ee*Hi>|zcvE`}
zsP$!@H_EiMZgDZh*Sw0rpB5@Z@wGu?66kH_V9wV2ZQMjfLYj&jg041XCM<++8LDhF
z03c+-y&X=4#Ni$&9%*UF-8p>Kw{=mMs#?Sv<S1NEHQJUQ%^m=95D*h8PvoWM5wZ)R
zOt$Uk)&SOJrdwG{3+r*NJ6G>^6O1jKk7*S)hdR1?2u^J%+&(NUz)tRt->5#W^c<$*
zuQyT*O&V;y+_3pFJnwA#zTtM?%!~^}683x}KI-~-p)JjEX&(hP42z!zjgkoavD+N>
z`(mu$yg!+~;6VRq+doi8V)Qb-C(0G?xg9z2o4E7_mi#>2nD|!SDk1EnbKCuMB`4kK
zWyQD3XIC(D!CHh#_jQnr|L?|yR_z53BzH!#)<%lir6DpuYkmi3yI}WDFvkR*T~tD9
zfaR);V9z{1aAY^pbg|{-80zPAhu9|QQ5za}gvy+sj=ype(VTxpHE8&LiRABP(xJKB
z_*sZ$FM-T+{&8qwH#*kqnT<x-iZli;{+M{IAq=r$;gftm{UzCn>_V599#H2<VnR@D
z3{L4ZqR<N)i#te~C#|5(E|J?CqnfUeXLYQ)>V?l|kzY!1uuO2}9xkS~z;fiwO0@a6
z(H^sIPo?vI$M-eZNy8oR&PAN8?BeReZ2KcgL3!2(HeA{E*rQe*n!0W;JT84s;;aKI
zB^it`rtmZo;`#Z65@EJfHUC&Wa+OOn7-F4-v@DpC#fB<)!_uDkg4{i0q6KK8IJo*9
zgIOr_3pYFvg38~LlyI+2h=2=wGhnYdie+|m4pPbkM|5W<5r}VWZG?70IO^)gSX1yv
z!!gZNlW!u3E!s2g3^i=rWzkVS7cB894uv=<c2g)*Kf!h{WRvO-B}*vN$+z(R2@A(g
zIQelI;T$sxyHV?GugZEzakaGY3(+9M$f8a@m_D&odP)lRSH)@pNnIwDO9T42E9t%P
z{VDBC>kb|nOK%mbL&00o*^1B?8v@1G1y^lhj!s@25hwVMuI6>5)tJMcHoC`Timo1H
zx<`(5aReltS>#d6?EGNn?Q${~9=#PoKwM|ZBm!-@>-ke*#Sh4+tyu4QZrY_Rx9>#)
zA^GZ|dTW6M??2z`){WZRPJe@{*m94XALQOn|04CEW)o)jA9y)FUn&8J{lVzef_acK
zlxL)_I1su??@l#b?~-51)DE81hy)wXSMrc+&hE9vb~!gH87TJ`Eq2c3VC(m3g?uD#
zHh*bsc^6tu-%M}&RA_f8pK|khh2*~79u${~1AgH%zSc2cwSU}s?Emfem9O6s?gMQa
zI-gH%B~@AkR*^1sw#?1s>yiVwB`ac<eZEri>IVZ&E!D0NG!HW6#W$}VVlmnSdgjTk
z=5?2=6&t)}f+7jgnM+#gF3bG5mAkxb50g2~d~%Q4;MMk$J0UTg2dwArDU*`2uO7Od
z&x3yyxV`3nHY=gJNxsyyl(@k?^AD!gNT(a!kZ>xwnKS30%JlJ#>#>cvP!yyQfbM&1
z19ru?2=f)~m5`3mJWmnYjmiFY>N<WWSF;P9Bl4keesiUCg{k<n)RC04Iy@}@r;u}D
zQp5!~%Qh-0O=X{9d3s6ji0Qi~N`A|1>`(61XjNgt1~+t0_olsmAaA$0AhIlPR^vY-
zw9=}Gp<ui4cu^=dJ$%@a$v-6_OYVVtsSRa}u;L9#!mYH|C$XkJGCqY{9ng9)5SB!r
z?de;iQ*w%bA@h%)a{NDjYT&l&s<O75x2_S?tFBDoM|QUFzVCe537Y)Pq<~6~<J<WS
zG;Q9(VIy&e+imk(egDi?>-8ZuvhO_ugX<&}4!|L8ufw9~aWo~F^JY;;ctGXjy<0)S
z^j8UVQnT4wwRib4GD+icRNSGb<3a|llD*mX+}#%IomFfHYNMZmtG1PCxL+-`PB7nG
zvs^hv<VI@Z4|Mwa2iSnc*u}UBv-p+VMi+RiJmU*27&Did_E7UsOUIM9`~px``G8s7
zTacMq<Dsm?8!i*h24lT!VmjpT_){f6u3g2Q8tlCPvJJDUDIVc`hfYJ)(8lqsfEDuX
zom+deK5GrT;cK2Ug5V<~AWyZ*IX3AkQbog;G|oNJm=oh!cK78040}>~zOS}eL}s9X
z{Z<fZ1H-F!;!)-qOz7S+!&7Xjlzr)X&o%y1F!PcF+2Pl`?)<w8qWXcf_~cydSzFvb
z;D-jQ<zA_h-NIt<p-kvXd>>ou)@@(KYI&l|mRPqrl-{9?XRa{|+tabX*QH^TDtk(*
zDrnbz<DULN%2Qx4&-!uI{j))lrYdXouf_oDN^a8kTU@N497NpFk%s`(Llc_NM(`;Y
z*9_9)0|)Pp*{BqO{EAKSDF`m_FANs>CA~J3Xl$AL0H=UP-|C{90U~#r(FOV$ME7cC
z3)LiI(Oq?;3jbJ~2@r$@6mRkpd2IpI=lhP$YU<Q#dD|_Yift@ueAn)Tb9uei*xMY)
zCTgd-nx+zg?A251vUUOf-T>AeW^N>|EzBWLM!Fd>jxS7VV&2&n$IC&G3A%yKD+_l_
z?V$rzf3Gu{%3$=??Rl}<nmwNXKr$E_ORgjw)4mqHUsFh45csYuRhZjGc9Yx&nY`rN
zo&E6VyOV8j*1m-+n4r1gpC&NKJgD$wB7W!RzeKhiR)=)lKAy}c!%2*>Iz%_ekVt+_
zzdTmdtltDQ+JG2&%w(E&e%a4F-rbDP#V?{nL^4%t$(P&lZ--m$3>Z}vr)}IP#WO$k
zUM*Uzxq5ZbKWwK7n6R>~f^B5%y1(y_&s70351N8;VvfkLHs@SQumEO^HQe<JYK-N_
z=~t-&>u*cKcd`)&u`LY(Z;f{vYwn+<8EOIb%*QW55ad^5Ef9DeBM1BF+cPGFW9rT3
zvFytb@T&E!>YeH=Z?}-X6BLLvi~dVUb#b};F}b|pF-pxZ)+3+~X4UxY`odgZy&1Hc
zoL;$XcqEicjT^Po;kk1xD%J00kCAG!e>~+WxUJJxQ_`a{s80}*GY5a8ZU2N@@f0vH
zJ~;5hD&rZ7AEQokN)Fs>PWH;x)LGHQht3=3u$$G%NSQ`%O}MOApR~*nc29`bNVIT=
z!E)!=hVo0scw?Y^6QesP_{M3i0V%iJ;Z|1_jR?A`m{7^itb$gGTZwMgwstd;ykYmO
zU!Khq4*Y_6M4-3nw{o{&x8q#nc6t?h&$f*!f`I$N$Q&fluS#_C{L_9z7=hECFr}fv
zDNE0|^$Q{{yAC~Z(S*|5<dM7myRXH3ALp@IH<Q?7BZN}h^lK~fJzLHmMAVVxU`$5l
z$qP)P;JiXl@Pai*a7^lm75!{p{y-oI{E}SR@Eey{v}gsoAk(}%HVJWG>g^nl#}(G8
z0j~ObC9~X|&aW8%e9F{xTU=3gi_hC2I=rw8!&*>@2UjXxdYsy^cX<_$347^HWl0AY
zqt65q7S9tR82<V>W>5|JN-*}M6L}-M_E06OTeqJfA-p{*f*eb9ELT<-Y<lNrxAIjT
z*e#BaXX9JVUFziJf6_hmcAv!!lP%#Gz^oXPTvFxn1QNRIPSUMt%*UX1OTj<`{&blN
zrd3^wettJx9*0-Tc+RtDmzs}j*^wOjJAat2sLMk{fD#SeDlw(473XDEmFHk~7PHZp
z>u(~JJFTUF5{>CNn!iuADivLMr)g-*dBUQSEsnJpSuKgb^B<HO`>U>{{(1I4Z!0_?
zp4bIvuucg?PVkK><A3^}fBw%U|2k-e1mi0O{v%7QFP&Jew+$=Gw=VxYVm80;DZV#H
zthUX=wmQEL!|kQu?;lY}?2V`V9Wg&&&km=6kKFm4yrFiQpH3-%8|x1X2vZ+{fvG1U
z(PXAC<x9KottBk&Ckoeph#6{5iL({~0G|0L+}-(&p!eIyoW#~J4I^ozoa6A2TSzia
zqhh;b`fd=y=Pzb>VLs;lO{>)N4jn6QucutqYQul}-lh6Loc9a6oyDwkJ=uu&Q8hu-
zj3MY)Qh_4ax5-`B5>)rXH-CPrRcO54jg*MBxBYXs531D%Zuow%Tr8_jAE5^G&1@&J
zL$MvpvI2Q<_w{;l!p(;i4Ybo(6~z-h6k@uw2P~_9lORLr0INJCdqJt+m`N9A%rT*l
zn`V3bQJHkbo4B4Ggg|bEVtA4Oe-NdXUVFCh*hkKejV~2P6v4;EnS;Gva(McMieG8|
zp~}V9ua~=jcC5%M*O@Q6FZ3~3v^}f`9dj?J9N9_Seq%o|tDF~n1P++k8s~t*TRCpB
z))S#=X;mA}95XN1mX1RAyGw<>Mvb?IRTYl%6m!b;lSyL|!{B%Xg!d$vUzxSbN6_qA
zQ)|t@v@Q%uGJ`lZV%56ptQ1HG)GxUYxNakJPkzAem?4|0so`MM+n|EUsmAk$Ld$hF
z!R&aj$hH1uLtFo_ll>J%e^4xM9jG{2cBJ|^!<V%c@m90hnGZkw3+34F{hf=Lj%*8%
z?NN*3$L+-Yle)l5h=HpSp3X<eRSw<+l;a<JL~74(_XuT<bFx5yyy-{tn?%KUTdnh*
z>}Kc?87U()S$+Ta$gi5RU^{I)Q>l&6^E$UD8op)(&x-ZXPtx|j@U+ojiuwJ&SC|6b
zY(y8K^Ou^4ytTJ3#yT|GJioq>kWP(XQfJ-KBU|)ntvt`hPY=L27J27>Uq*5ez>(~?
zM`0w8t5CK$MWS?%&l4sm%`z!wNsbMTCWG|DT4BH(3diD{N=ha)0(5%4tJ88}p<uOP
zb+xwUKWQLl1UGNDGHrPDJ#NN#e)o*}jm0vBRr>d~PiIo(J;8r4+w<@~&5<T9dPIG9
za!BRZ-9`ApN}d(+#V6;9dI|yu)%CeKHocKIo!;88;qz}dVocr^BX8IOXoG2$s>S{G
z8AHqQn>a%^C%fDFJd}vkoZeqnUM)x|(;8kF@5a4y)`m5{%P3J#k-(MDeQ2rn)m;9e
z+rt%-SN+wkb`%lo12?C>pG@{Wii5oxO033MAFW@DH;R>_6LGa@iLj&NSkt>i@tJCg
zMv-ykCbjW-yUkrvb>0y~7Katk23?~4->|E3dV{0)@1z%}8C^3tvT9%N3myt^IoU0E
z%1=zr2ECuuqGxc~H`D`8ly+}6xI_^r6eQfTc$>lv&@0#!fr@`Q(H*7`VQPCJ^xM_C
z%aiBod>yKq4!TV-SpP~@{6=iVcw#abW4?RDmBh0hm<u*sBltBmz}Gpp;B9V@Mo7ds
zkXi~BU_w|cKb$o6SceVZi5{%zKv4-KpkjVVI3$~BSuWrMQ+N+pVgq{Or%*KoCh5Uk
ziL^ECn%DY!^{jbmn4|F0t<h1`l)6-dpWIh5GU5Z6#aeF)+k2S)@wzA?b_=oHK^JZ!
z^wxJ{xpr~PZ+4Eau##%9y@|iZbQS@O%n8_C!T>YV6FPjVdh3s*yLSEKxkMOzAw?G*
zp6jM0eI<RSG)e?~nO7cELIX9mPWA7v;c99f?Wd%QfiM#&kr_UvrI%x%><RH<w46RK
zo$t>TK00ep%Q#g;CmtBvE-*(&$bbitjJI?*Qr)Fi`CJZ1vMsd!Q#kAM!G@T|5(=xH
za*>btL8gFXHzAV)=#y*vqWK2iO_)~+__x}_fIu)hIyzfD8CM>C>M<!FiSIK!OO;3!
zE;sEY1Bl#D&69{J?*(KhNjzi@jNa)$7w=#iWQS#Y{EhdD+O-p@?NsMFj(PnV88d}`
z3`rjSF<8uuU-{i%m3S$ZVip#2;Q<q?)T-`IfsDK0a*e&G?llP6Sfg#*?_378c2F7F
z!s#=R{^&v7%B^_@fILh!pwK!<H504)t5-~d%fKL_kD@&sKupaijPRp<tih2`dRgSa
zD?3#0EA##S%k*J?AuKdAUFBpEjlR^=fy=%gfCgp$;KNxIyvTM&3Ihpnl~I=2iBdkp
zn{b<CMm~f1Bt>NpAJKV(0OxVgOyDlm5OBz~qQRK-NncNdBgX|z7hRgdT;oI!G?9`N
zjJu&zSry?e`aZ3cM6V*K!}<15VkLRf9Xbe}IijLVtw241=zf+G`*KrV??u_YxnnAV
z)zE0%rlN)jC_(KH(r!ywih1)?g=A01p*ftn>DD!MMf4Lb4Q`L$j|bJcQS14eapd&z
z=aMlAD^yq6lE(0HRtbM+pQz<9akSUWRv{}?(->+D%CO1k%E{T1IN{2+#=r;T><-$n
zZt|vnf2_J#vCbWO;cikfykpm4LGkV&9>l{Js@8bH72wkZrJ@D`Klq|fz^7x#I<B{V
zav4GabgAgOpwZh!>?QksvfxIN2+O{YRDSd^x}Ywv60A7)%`I_x#o&Tk(PCpoWwE0G
zO*=bwoh^hXO-Rc@E89b5&xoIPHI(`^Wh?l=%Eyiu7|=&AMQdx6Ah5-7j%Y|qYil4R
zM}ix}h!U@g5Y#J_apm;z_c%3DyJz47G1OjErFRglSNc^^24Nt-=LZY8vd8X`(T}`y
zav#mmo{s=yBX|znr{xBzji_xZ!&3w=H*ksyIr==T3q3z+eglJ1`Ce#!14&>t(SS0O
zVFu36PQM~6z%e_V^~GR(?A4&1RQ=2{%K$Q)x#9AU!7l(IaWEgv;Mh|I8x%(0r0w?#
z6+H;R@NWM>i<1bW+=u@h%DiosgL{<93T<6ylToqYi90+|90S4Dpp_th<rt)2hDZpB
zg)3JlV;oAnX0?mNsx2mwSs^#Cr78_NMFFzVnr68SwV-U`e)?}DlAtpWDBqL7$0Mln
z`elrV190BDP5ojewy58&Y2p2?*p?f3O2u^0V%NHlFuqA|gI2i7B=_FIKxBtu@Qn8+
z6As|-nnNb<sB;fJ`Z}6PEC5zNqUU!Qkc4Juk_VjY7h{-7jEdo8&t-Y#EvyE2Z0H+^
z;l`xJhy8$#U!BoPmKX?%I+NHwje;A`-<lKwSM55jUZ|1{mZyRU`Q%2<iTF}>-4Uz_
z+3~Lpjvh;>P4ar2f7(c>wlUlK3>cNvyW^9)CtG6@8wdM>5vf9aH8`LEHRxEVFcV*5
zW6{{-uc)O)EZRJ&LV@JY<ihDmsS{SNEStS9F(SedBT!lLud7&Yxla0o_*k5^MFpYk
zyrHDI(F4JA@NF3b^ViXn(_wY!*UhZufA!HvU+~?%YoZ&ILoLim9;bC;>t3nto9}hC
zc!i;2$?fx5yQkThtgz{Ix`P(7^EJ=P<pO35y0rxvdpqocee;WUx}!cverAkeBOI=t
zBNVLHW+|C7OJB>)iYw#QHfy2Ot;uJ3@H}(ywonw*bnL+(=tj6vpAiw!Jd0GG(D0Q4
z9z%J^`=h!N|J3seq7*Gdw(|UxH9c}3z5SB&&wjU8C4H_YhTNkNoJSN<x8K_>1x8@2
z@QTxUoSSn`1qjuVO=&#$z`JAo92ftDT_2kz=a26$7k;g5Lk7%Q&Ws}UrJI?l?N{KR
zwtT6ES1nOSP|A|DI8M_zZOOrJ5-4_eHo#-+_;*-sK~Xb6O%DNZ%?$`q0ml62D@PLH
z;p7lC-8VZ?GgzCi?_g3@wLHO5y;L#=Ji$%deS{Hh=vRvLcAl^_96N6gmg+?|g9>VV
zTtxiJzxJFab%IK<47MbHC~HOGgbTr5;`g<^*!Mr@D`5M4z>ZX+paniD|7wS}(~Cji
zH5fTfeiRp)HQ@W!9BfB6vcHc<V!C@<Ekr%c@r<WS<@E^Ho^v)IyIavRd(K5Ljir7U
zl;%Gv0bdzbr!kLsDHvT<QpsQ>RtrcX5{H`gWfyV$)rDg2H;R4iTKL7`kMWWOAk0c}
z*Hjy?vj9Wze5mmndnd4GDLZ6;n<$qrVAiWjGtdkDaI*h~3V5l^Wdu<@7y+97fPH=8
z*?gp-?{nKTn}u+5vDbZ)IMf7)Q0wW0)NM(vht4?t5Jp9dIFAU?Di`Xw@(!8h_rzX^
zC%onM4sX2WC~w3C$Y;;X>F8{a8%XD4lC2DZ^{}S+27MFY8_hw68T<pq%zEsu+sioe
zpr782{$s2H?=3q`HughEo69-5zQ3nP1OREk-lM~L|AmoHqk>QSp`k8IuxJk#pk&u<
z*Dun2N!<Rk2fnuJO#%(Vm?{C6zkrM%)2Rfm{RpFO6x=U|o8mJce6|#O9<83n1Ouy2
z9pu?C*@7QF=BQn*g{}Us8F2#%*Go70#9{a?rAw2x1}sdaVj;FO>GF?4!vp~0gd=eu
zu9%=!2E!FF%3Yn=`Qx`2hABB4*^~LfeZ{_IcBj|D5gn7hd$x+(Zh^@2^l;O>vL#I9
zzKEBF9R=VKVZXCi35gk5@XuanSiI;I4reSkxes{-o>lV#Ewlw(H6#&F))h?-VTP2<
z$!<&fMV2>oW5RdB1$t--0nd9<K8+hK8qh1z<E1R;;)&C6tjkPF<{eq+jSITUqBIVC
zGRP&zO_AUP$Y4%g+M!p@WcOXCg)mwTi1h>RVoWLruU=1l3-hb{K_9#khQ~n;fxCPI
zn*iO&S2bYTVUF;iYL+h#e^az7@{Xi4nFN?w0WD7pQ^g;8@i7rgC_1iwKpepCI65e4
z{xSAUAN!c^a4GmI=;8(Osg-HFV$fVNqw#~v?$yT7Aw`2-38rb`&H8No>`JUVqAemy
zzGAZGp8V9q@Tz$9X%={%*RCQq$JYASNkwYTmd?5|jBEl?FUL&p+xz&@)(uZNb>Z@7
zlx4+sOpLc4RDm}7UU&9mq6uRHw)2f31M73cXCsOag~kmlS_PPa)3@$+SP;?xM91kn
z`8~0ZV00bZ94}(#yTr9Y=Q05axZ_vz(R_8}Je2b32>x$2t5E|>y=pcB;T(|;+bDdU
zSStPD#sCyl$SmzXmYtBcS*)Fu1F0s6-VnYjZJn7{C3;_it)nb!2DL1<pI{62!;t7|
zzR`Og5Qnc0AK+PAenhumA0-Ve{qVn3gtj4SH^Dv@TJ5+is0-e-o`!R>j2&eAcjQlL
zxp;JblJ(PG%|?c`0D7D8y>3zLaQ#9-{@{mS`JNyIvO`N*9Sqn*Rt!$C?)4kT1Z9|A
zQHMQ@e^<JJAhn!<B6VSL`C_XBMJP4O0D3$N_qPj+GvRW#{2v>%z6H%1<LAU%-8&GE
zzlgCzfO?ta#$3XhiA{~S1gzxFxZCF7N0-Qe0s;VAn%2Aatw6b3Hws_Y)l0e-`cfie
zAZ-0$K?Efp1!;icZ+g`*6a;|Ktp&yY>t64WsG++Vxh^A^OyazfNl%isrB2gKg%f^q
zI6`Xw2o^O2)+E$R|IN>V$_g_)(aq25cvRB2qS0ej=tUmQCr8GqmU1utisV-EH?w`#
zuOFht0y@t4V;eJRLOij=qsfl&d=E)Ezm<w255Qq=keFeGaQKx+K^G%W$EVFK9mu?N
zGDg$z&bDdLqql9R#0|RBh?=yI_9biAi|2dr=0?PNU@r9Lqz%adtWDMO-Z7QWS%b_7
zK43z{aM{jw`8VCuqD;7-&@8j^Nmx%NIGR@0!sZ4jalN)F#Oc6RVtdJ)1^N+l4whiy
z0%CB$59nV1Mm6W|(XyLaB`cask4Ti0p@eNTc!uhfF&z|zPn?Mbp2|B3VdMg0s~!x*
zgu5jD4{z8=Nw$PJX%3uv|G}+V_(&6)T3)4@Ht_j!$OHaBDgntR+jc|K2rpMQtFp;6
zt)e!J{aTr=j%eGDS5d5hc>mEioUwbYpOl25n8u?HZhuAgn?eEuu!H~|1UtQz^{hdj
z5T<1+eHoj-xmr;ICHfn&Fex&ipGZM7hn^;<ke_YtIXEL=(mZ%`@B?&ncP6qzK6|J}
z*CB0w@SZzpr2>;k)&gp9$}BPmgb0$$0R3G{(#&7?MI6k?lqk}o06Sd42qCKivzMaP
zDhr&uQ!-b_Q`m?$Ug#ZkOZ?V@cink3kE}S;l(efhJ6?V0KhWpEmJ=klX8Wd_c}$wJ
zQWWtZw*h-UVNoN}yU<r?K5L_8(#8dFw^z9|QSAXLf0L02OqNK!zT84ErtUH}XrZ1$
z`wOX<dwQ8O_7j=*{2IQ*48uYN3^@P3JCQruEA^tJnH$IpEc{{U$`D(5p_v?K1@PMk
z^TQ4YXiR98Y$ZO8&q(>J*Ly5oH_GdE4-P$jgTAyC{x23FrB<>S4Xb$DM#qzuq3n=!
z7*&+dNerk+LjBgiuTTcCGIjm(!Q9`M{g)4HfO}g07T(&J`?C#)N9?{xU=bX$j7+_`
zubWguzlY{0rwRJr!^&eTx6Y&yi7U%E=)3f`%uvPl1gv+k^v|W4ipJeYZ;pTTF7jEn
z8qj-N;jA<)a^RgUskaz;4AAyp$YDaGDa%#dSPLMn-8}qqP0TpD5r4!!akbWzHordi
zWK=jVDg(B|t9eWmy4Pg%T)zBg3F<m1$EmQIxIW-5X&9I_I)0-&`%S@&{AgpzWE3Cv
zFPui2g}uK44(z!5ml-eljRUh!-Qu-s&0cA;dvzJ}Y$^Yn>wBel_2niKFF6;V`j_w#
zJcNJgMi@3VL|BD-@ua^O-CZ|x!r_VtN9h_Q6LHU?^qA}ke%AW@d{E}~ISl?I+{|B_
zR+=pMUIO&^cd~hGSqTRT2f$okQK$)YbqEH`12kPf83+Ktg3(7>{@&<FtEax}Bpl$c
zZn&>1x3t=$m@GG#)8%mIFF$y_fVem=IDvywCaOwOHBEymOZkJ1{EL|}k`Pf;2t>K_
zADc7HV1ue)&ZEi6imIzv%DF)4-Ikc~wf3^UK{SAM2;B6k)R7GAwA6L(O182pi30@V
z&l*Q?mJA_=A0H%T+fvgoDG944ROAi+MksMF-hou3yJH=`=|kg_I+KVIJ8l;?^VPJQ
zTdRjMc3svc=aGD6&<ifL>b3(aA*xQ_{X2ZCPPHKJl;2geI}t^8W+5XN9A0<Ug;3&K
zM!%gdRh6Oi@pJn^FaYnBogl)`p^n>jYfte$cnYw_sIS7l1vd!t<v-DHq@$my?K%Cg
z7^_nx`xMq8h{{vU{mJ2~0{H3+&7U$j!B*KxO+VcAkK(bK*kDm!4?Ma7N(QoMVEnuM
ztBmv`h*Sb<TbN~VdTk?!3U5VDyhelz=a#bZ8rO_g6BcjBUZ_gN7Bs9pW8ycWhiE5d
zZf=r^T5U)FEQXJh@Tv`e+ieJ7eRc<kNmQ~>rC<5L>~;$_QS5S1iK|7gE!g=-r@rBS
ze2dm1z0<8&=sJ;-wl|t^L`%9xIQ5dBsM9Wn{N2RrE<k5hweb|9oUt^d&*`EhAz^Ft
zazvDXf!WIh$#<H{z!Q|d!(3Q$jUbM{>i_DDC4+%>QvvXWyrx#pD);+=j-NugzwDS!
z#xRRNTaG#v9j$$hj~~#g=>|kdSl%CFD6?bFqQMP>gt@J=^eLn=-)Wg}*!Uo6!=*Vm
z-o|*xw*sMH^N@g#PK%wX?SAgXhIX8?qOka4qkVPSM@hj@UcXz(q6?Yw+wauG<i2;{
z=g!sHC`NK_v8zf%7<@36Wq&cH2t4W!SHExoUB38%7f3Pd<5Ecz5s>!9$z1ykoztxL
z3lSs%bY0ysJ~e~H5ld%k%!Oc|jbYUa`_{&w<8+zE_w4(dQ#4y+K}Ip5A;qQKA19{*
zuQWCu@+1r;!KPla_Ir=<YFygk+?n<q6LR9E0-s<YcABYhcqi7H3UjbA1V6VY@F%OK
z7|ex!M*%YgqR!$6JjIoxGfXOsvV^5d*J_t`!q+QpF42<454QEVyV3E~igbItUZ<1P
z54oxR$JLWgTWqTbDe=Q)Vi}V*-@2`jy=Mg~USFWCIxg05@N?cNC(G`6ysQV~g`I!{
z_S|2S9G!(chlfyTcFqR7#Mn%)l7G-kMwY>Lr_nklkP)nlQ<YiSTQi&1E;H@?^U|9C
z%pwWh=g`#jqDN7)K$zv<zcF#mDE&HMy(1+Nrsm(btN+Zf{7WO#tn}J=^k?3R*mw*6
zrIDzb(?1I`-!&yYHfzro5>0!KxKi@${yL-npfIM9cTpl{X}NmmxZ7EOzD?6+O3~F&
zSS97;Yq8_B-Ins$o`O!6?s%uue1=E2-w%~9;pOaT?piGO$~Lw8oDi~#3dkXM(=YSU
z-g$^g>H~|+DwFe^X7auVOdGY(!g?5)PCr$ZeO8<CrY+P^eSgPD%9}0@H~YTtQV+j7
zPT~dXWyWbB0(M1N#Dt9as{FbYq0INyFM^5|O?JNDfh0rbRlP|dm^Fmf<0(s*Rx5h_
zr1W=W(KA3PhVL2(>pDL@WYE18d7ve+{He?fypU7uEV?@eQ~Y1_ELYq6-S_8ScAC(c
z?8KWP3?5&wYufOY2hQx!iC9tJdsC9swgMMyiJg(~8CB@|_=`0hU@N*Mtz>wlqgwBM
z?wE%7FL&;Qs@mXZ6b2Haf6)nOM++)3*E7|e1%L3Q7xo@}4{th<<(1Kv<lUZ*^~o|h
zH)l_CCYs@BT*h-Uq-;k<4Pi*Qxgmx`*R4-W0!V0zQ<Ck6w<^;&2=fTh9bLVnF(^98
z#EeekoAH-k4cJSlfjj-cX5t>H&1@wB!L~_H?#i^w?LD$)R6URKbhBZh`rSkyc|GnM
zSn4l~c02)R60^Lk>hT9*m;_VqAvhw(Z~5P%zrKAXdPx&_^izq0f(~R%a~K)=GuR%t
z@2rC{1CHWkiSbx=7JNz&1%)Oc%?H$>F?RZOXK$Ix+oq@hugRO<_C){!FL`una)n=h
zTvV@iy<r(j_E1#B4@JNc!nPGfQLo$TaD&pnU-@LgD<fwZ8F$1pF#B=gz#~x|f2B<k
zypL8>7%maJig&1pq`h1Hgz_P;G={AM(8D!NrMh`vDS~EsI+fm=0Giut$Pb>)vJq(I
zJu=T5T7ugjZyL{e18Y@a%h39HN1E@!DGJz4z_rm2neo4Mf#}!tA#GCee@qCYfh1+H
zec^Tf-D0QUthDt{T&L1olu-6Hk8gOKAS6u>#epZ^EzG?0$}jrSl&M8|14M>t?@1p5
z%N1tqc~9C8VI!imhyUK$&g?;9FKH{;kdd~R?t2)}R<;F@T7+a|5&o^1jTJ-7k+LUC
zB}ewyYO#vUHXnJW)3PHv1hlHL4AyWJ=F8{%$4Y+M<Py83%(7(_cTy*>`a#Uk8E(#U
zi%cp?wnvC0)O%&SV|=bWQ%N8UFzz1lNI!y5KzRn<ijxfYlWb+T+@EIhf~GQWK0_Ac
z`4sYEjTpNhuUxUd_~4Gl7l!SQT?j^OK)lihw?xxeR3P{ErTZ0EImO^0@zD(VoFt7C
zwx6aGZ=2_{E1)-ZE80p_->|;cdYMtb6Y^fHSeiGBHEmS!qlJFr6!9{?37Gn3K!GnY
zRDW6+a;*P)-65T98#G<c2=WH70#`SLz5aW#lY`L+*_THuXi-MnN7Do8!J|N}xVTN~
z`o{r;I1&7b3NnFfb$t9_-c(Wx_^S9;J4m=@qY2G{BNhu75w{>`D8JUeG@bB06MP!=
zIS*Hy-C+0Bf<s8ODl3XsGepX*ScUiK?FZs6{4CUXAB_)!dT~F4ULE?FUaFbBGQ`!`
z6~>|46@z!fD*oy_`k`(8z44>ED_Df}Slx7HwnwNyh2DxFo_iG6&N&BFJ(tc_-9Im%
zlkF)8{3_?vMqk~9$UAJf9yDb{uStz=A|blf@+zK=rXuEVglpRAFnK{{MOUJ)nyO9h
zE2e@G*QDE??1BbdfLSZEF{5NTE6+(YQkDj8BxWk9mzD3dEmaU#1bsMtO0g|*PfPfy
zAMVkS9T~A%!{SbUFi!PJqAF9V|1V$&fH>t>C%wq&L-ts7<s&^ni<saw10j3pJ_A{8
ziMfWa0y$zs?Z(>-sA~?y_rq07mZhVwI67necbIvobV=?ga|e{p<Uvs|j;gzN+d?20
zBactNet+ScydEjSUqQ~e&SgZfMbj8$m`INXLrSTeH%y-fwMU(CBLga&ENb>*U`4>8
zQB~&lhO^A8&Z$M|VUZ=TrHg^8jpId37qgoxqDZx5f#wcf*3~a2WM{6^=H+4B&p>`G
zM|=RB45i$w$~ePFa4^*~eQn|mChg@J-*v(N54%9!)vFZeSj10cG|S<2&Id49VwhAH
zJ~L_E-5l}guY@mFzj0l3Wv>jQA$&5|l3j3h3Y0{b42M^I6j3Z5R?0dlQt*v|xC?wD
z3B-H#+*?@GS;eh87jYADw{x@mZMP~wG=!WXR^j8aNWdnxc49wd_ZHk5th2>C)gsWe
z6aV$#Y_oFotSAHF$p)2bS1{qD;dO`i>1KsOb;9i^M>u*0h}pp(pVukiNeJAW;N;V^
zcEgR$QeFyauBGa_{3>$ld+Jy{3q|cS)BR$x@f^M9-6}U2c<V6GMC?j_-aBs}H~*au
z+>^0ecBqhz*%s?tqsl$qU4MW(ir;ym#xoQWdvabOfT^m_$qBe1B9*+FrP*RzLr&Pz
z8SHszFsyS7rWTk;6;~ktoLvBB@Y;mEeVj_QvRe{8e)JwD?q<bJ*h%Pg<X_wOzJ2xV
zkv78v#c$UIZB91ac*cy#^@v2sRaMYL$X{w4!P)%*bx<K{b3(Ft$7+`y9j?AZONbJm
z9TbfZz%INVRLOdU)nCe4mc5=)=i)(WVeC)gRFpc%f!Y}zF;+0@!`I=*Zqb7SETg@q
z!y@HbP{H_W2;LHq4DKus@XTLwyiJz6F<rc(dFKx=nK`pqWdDPDfD5pno$}HTyPD&g
zV{u=Kv7po|x^-#CAv*Suuu!r57pMg4xMOEQq3(@)5GV81XL5h_N#F|}2NFkb57DxB
z2;xs-zeePM;1~vEfrLmHp&`lx5G;YQj;#bPPt3K)lCG9BV;Ulo;(lDnH~&kqd{00_
z5=%IWGH1<;lv0BXZL>wx32|pa{*%!IH+fvgxhl!85YtX3v#d6aG<Tp<@jpliT)?W+
z^&ct?7rZTR0H{VRLe5zFlX%t-1DW*v>&4T2Fd`QgCP8PwK5qb<fAMD(vxlYT8yO-2
zBo7*>it$_7!Egfdc?Xgu-~245jM6a#st3;Y6ds^RN$r=g?7A31#{L=hKSS7i;I0ZF
z^qf*moT?zeLgi(WulN^sLzH3qd{7tCeo`1KP^}M`f$e<i-;2Q4iU!;4D%SK5!b8U^
zXRMO<=<gr8Z!a`jhRbe6pW~i7`Um*&Iey0-s2`~7mDK5wLXtbP-K=x}I{R;2$iF}z
z|GF-7=N^Tz+gtsM{V~s-9W!a~=+D))lef7R&R6cK&VLQ$zZd5Z<bTMmKEake>(2t^
z+`KVdebhjg&sVqNL6Q6I-`S30OSgNsYYozV-j?iw430dlW(WoCS#hrcuJ0}0xnYbm
zmGZ{dAoJF)NLrjG$;L>wzuI!SOiA0bvq)s}p8m?QMV1}^gIxKtyQwdm6TOSs*#ygB
z%U%MejsPY%&^La|yJEJ#em(T^s2ke**_rXqoqV7es9UOu6=g^=3-<N~%sa^@_OSQs
z5Mp(#Q4h$kjxk09XEsMVL=sOzE`thnH5@`7tx**J8_l%);FLnQ$D(tONzZr_!6{U#
zC6VKxH1ITg1b@KE-q;c56d&w?)3dus)}&wy`Wu30X7t@R=vZiKwF8mPXE5E#K7sU@
zAA)E`e9L3=3Lc-a$?D%9|5G@>8ZWZ+qcWouN3P{F5iO(oO?|i?5XYx4<G)XhB!6N(
zV1<Hao~Gn<aaIsBtmXICW|%bwpV_byqt^9mGXe+hI<AH2UG0XR(ZrB@v&uEfM_h6T
z`jbo>_wl~Ie0%LLg}%TGJ$GK!4pb)`JAQSle=Fp;e-e2@MEuLJr(=_^H*C*!FZEY>
z0}&OQD1-nn-d1!HWwH}amwWS(q2hD8KFZw5y>cRh_@wq9v`}COeCl%c&pYfu;t)`x
z&<E!*|2Dfa{tNWTJIKw2k*K*!q=Z2F0N__W>I)_ll0UM-Rnhu0nB*3Q^~{%)l8+B-
zbO=6E%MIN#-=t{QS0<OkV%}cHel4C)>6&nITlr%^zf31)XaKc|&@y_ng%M%m!jFOQ
zaF^kZc)Q|XCikgt4qznbuL!w<(XmdMKHRJbzFuk|EXnskPvpfn!T)dVu`Uwgl*Jat
z0(Wo5&VnlK`D+g1AcIW&DZnpmOrxbWhZX?oO|`#ed5i@PzRDoA9Xrw^<o*|4m9VgM
zH^TpT1Bzs82Vga{zH+tuPYfeAV!p@?Wzp?j1DbGdy&zFlMY|n^rZ+HKQyW15@(KVw
zRsE8d1_0;Q6V%sAtWItr5jAiDtp(i9gizSpo=C-e@iyety@^-M_rsWxSvE|GkjViz
zU&M!`3fz{FWH&E-qkaR(GAQVu`(5`^Elc-LdvLPU{Q;(23}Arkp@^2bOKh_qhz7W>
z0N5FN$x<O9u^X_?TM9J#iXs$GC_>z5!uYFQFjT6&>kBRX%AVV%5)^53Pt<>vcXyt#
zv~{VB<%yR+uyBxESV_aW5Rj*a^9-2b6Ta)l$450+?iNk*s7VCSva88&-~|qRh6*RN
z=I&Um2Vtc-r&6$1d%|JYV1SgGNs;lr)j9oVX6FxoU;@FIX3Kca?;AWg!q3E*-9~`U
zOa!6E)(EZpXC|s$p`ml;dN8v*E&c`AhwhzXnVg!}x%~s3!(_+5xRprx)Ds3j>|-<3
zkA1TT9LKeEh^B#H*8dx&bnp4b91~WHPv{38()OVQ^~V3GfFT_h;z#nYdp46VJI@=a
zsnJ-Ri?-a16J^$*%UA_MVGDufD&cNeCo{vR#8waueq9@L4h!7=Yy2bschw$bL_+`M
z$R8dkbiTqAqEgsA+6Kmmu+Ld-*rr3nwxjg^(fxveaEfYXyHOagddL!GjTeIR{4`!L
zqM^O!)Ho%G|E;?948<@M9{6a&M0<V(HxyM__o}#ghcHiIJ4VN=Ry)W99`I$qu1@}=
zf^A6QOz|KRNBPP_o$rbsNh@gt@hnup@bQfbzg9#F;ZULPl(5yEoAq3X<6WvR2<-SW
za^V1Aa2~bAr?h9Nny=m@CFpkvXAsrjGi(^liCH7WqM9P&=8F)~pWCzJMgiV#)Thz8
zA8WlWmcQt=oW)dg49fzM?z%!B^tiK3N0QT<fzZSnfgc-dACwe4(*mB4&AAMPGiKSr
zBhM3<1)0pQCcJ@{YLB^hFTHwAqgTVQO?{8g{<ZQVaNDv<J5&VrcZkt4Kxa=`y)Pcb
z4VNRVCUN6YTyM_#8WO;pa?n84oTnBb|9#9+K&@F-FW_Q<{?du>+Uz^q4LPG*!OX>3
z(Wm^eI5wlE?L5g{ZlVbyYrq{~C7?<6v-;7gdPk50NA`!M27P1BC60E)qJ|Re+&(N#
zn!Y0a(dPJ1?80TtfI||sV|9#9I~9_paV4<IfID;e9Su|2E6PN=1rFG7yqXeiwFD4u
z9ra(_t<J$1Ju=S)OOoyz0Mxwwx9PIpqYogr-jSNs@YQ3*;dj*oD459daRJ}V_bW3U
zE}8j$!6zA<lSbVSx2s=Ygr__w{j!ID03#+w;GMYMpTb5Da8{q@2d10BQpJD?iJ|P!
zW3?ErWpb$?0`OR`{_3_mL8iPyNl&%@FJ+}95<@C{2%tEV%^EVC7@{B3l>%;Af!-46
z^&Xi^2N8ul^J>@u;eO~6<GWIs@59mdX^!0N?o>SXNv!_&%*v;`OqRZ&CH)nQkVP^Z
zuHnq9jT!2q&+Jw&qEkLoFT+H<6|^6syGDyfb=03mT|}ybUD<#e+{&`QO~s4^CEG!z
zl12lbZfxCiM`o=2pI?m>GI@6k>kP9FmDKEB<;-c(EhNRXs7RgG({;_B`YXKY(|I^U
zSz;dFA8(saM%023Pxgrye1*>R*C@Vl_?(l57ap2R&P6fAnSushLg{R;L{2gRI53=5
zkBfIT!WH^~H(fxUGm+kge*+Z$G%|>(_XP2gg^26OgZ2LoEl5pAcPAn&jF9H8q^bd9
zFo~!!%A*Ehe<8Z)CNeEW`&d!*FTlg8_7!3H-q<g){iqYQ8=Sp$bYUdEkp84fI71fX
zLyr|DeMSt$0+5w}pyc{e$K+E)`53ePm+Xy?N>{IOmKnkQh?O_yt9Wv2MaNk1G3T66
zWNTtGJMf?>5U@2tHsWXx%LY3dkEnhldGEbA=S)tatx;lr#FRq8U#H!_y>S7=UcNDH
z%XSecAobNKT$#p1-d%n2*cCwvnv^BSGeQP>#dmB>fm#Tyc+G`U9mImkXz_Ie^2w|y
zs7vc2){%r_efgtGLk;eGuC=@t76P(BRq%af#93?6Vwt=Gk{GpFqf&acn<)X-xEl!d
zUJs*~i&DQ3ceEBA;>}bAMi}guC4haR-gd!Ut6wa{D>lPu4xRb#d|RK$vIIamG!cS=
z{rew7BfN(A{;DA2`ga%A%_Z!!UhSSjab$-7D~R^xKad-5!EXuesII!HCT?%M^;Hs1
zq67oMq@L%RyirucTklObeGoA>!-6?U-9Llfmrz~q>EURg^--q&riD`k1k|@<FGJ#A
zxc^Sy%Qr`YG6Gv_hR1%p0R<x{oN)q1C|fD9L2d`QVqe$tZbSTgCw1^rx#R4Ex3DC@
z;UOA!UIMXs!O7mPp_%jH<?StKD%JdP;Q`q0rZj0YhTUDb0B5hno4)@kJUBl|Xy{Vc
z97iqm5KrW*Np!;M3Hi{Fx0vkZH+zCcI6*lKa~xTb`P9NV(FaM5T`4mI9T1orf2RZ|
z<4@8-AxuBwwpnYxddJ}EHPMq%bUA9n)mYgyoMs~A^4CGBqS-*S;&SK|XnwBWW-^-;
zb*_Ho^2Y|+`l}UHBpbttS|Yg~8Gt^?HhNQU9gGoDN(27aDu{`8Q{u1xIw~wns8H6O
zEOk%<hFNbjR4t)R{bmAf{yTQosv^u60cnd2SeC^wKSGJ47yt43t98e!s{zw}hclZ_
zPgp{ac0026m;D@qTrhxS#>@)%W3Zp(oASRi>LLE?iZrB*U-clDjwsJ~WO1RghS76(
zk{|&z;P1IzXECt_79ZPdjz3SjLQzC68Jx@K6^p`d&<7)GyUySr*WqbtY1Pi5gcWV5
z!{$AiNa9eWq{vA4Q#W-l?0z1CB+(Lt?0z~)T3mn<1&I^0-JfsIC(kGM2RNe7V5e}k
z&lYfYq0FJqWzSmg5veBO<z;?1Nc)o56PHjJ#o`dabZ@vnI7=70E@|vmtHPfWA3G4}
z;Rlh?F<)K|vloZNO@~2uZ?8NqDiqdNlyEb55>Cl2##c1aNzJ>0EBLD1ibz#QF!9}U
zlv&i#F6*%|A9nczk$2upcVB1)6e<@|MP}*=Tzh$c0W~edxhv|GX5;I1%OB1qHh+ZF
zXJyu!GoY^WyCrZmYGhkY0(moN9R9fKU2W#*Hd`&^IYPSfmb#^7^N-Qs#-|22=9$94
z>|lfvf(Kb@a8z&U>qH9H_Gf>HHyc?;bTdeXA`$R7AI}0|cd{a43nr12nZ59uxgvjc
zLCz5<#`{CixCly@W;oPO9*YqZ@XoBw>cv4k=9`Cohn8ns{)h?ffec{g`_2|wGg2*~
zN&ygi&Y8NbVI4#g;Z>fpC-p2$_4{+0__gvEC58_4=3-6V<t#Qe6jw5LlElb;&|!Pa
z2^=%A)?c{j)%Rlt;_~;kIIH~}VGGW?uW_z<7rzJM125<2eE3SDgWPaG{#e)3VMNne
z3%i8S!rf99*zg`!IkzQTZeU(A_OARSldv!WFVj`XgX2};6qcMOJ*O7GGq}4_ERa)`
zWUSUzOi-d(zU&p`y_!L);w@@CDfIu6%%HZmKI4!Sd6Y8{A+pH>%{j8tO-uW5PT#MH
zr-dX0Uw5q*%`#G4rE?}#s7o`5|8p;d_3Oc=7r%9EuUxRCrfA?&`5-=WL3$>tv|M1$
zdc&ET3u1-1!9iG27BI<DEut>x&(|sb5oZxVoHF>ARrwu%b)fIxnZU?6sIRttqL-u#
z<?|Jy{}ltxPFDX&IKc=D2P)H6K-1b4T<|ukmjleAzkSb881(fT-J=t4OsYQ{$vP38
zkA=ffAb1oDHf~s9Pr+wLPJVATM+u_`<Et0wHu=Wm-+4_7&U}Qy4AP@De#fDG#$d40
zLt5M_*e$pzHd&CAn*jj~Lc~#H8d;w#t(-C}r-Yrn$P>*2s1fDrqNBqFzw-dp%f5lv
zGse$4cdNnGCuJsA$Y8la3W-7#Hk*-|BYOvHk0->FUk$VIG+%7IbQCOVY@5tTAh3V(
z!f^^A1<>FS5mngU_YVRsRQ-P~r||%ED7Q9rL3!h?dTtMfRnij0L^XJb%CMN1RV``s
z`<EE4x4=o5;cL^;l*YB>`kSPtypZLAIDpNlNNu-E4}0$5#cO-E0KsscIyOoOYEPC^
zbWK<eORuHLTBeaYlGh7?#P87Hnf+3^(Haq(S_#6R#bhqlKNS+jaaEc%Os#8Ix^zN*
z>IGlpO!|O7&Fs_~HRaeoT46}Y_Pr<=JPFJa>nvSuF&?B9($YZ@&}<~9r0vW9*Xo*J
z&IS0!aJ8!BSq|O4PHjd?S>fId<|Jz`ag<?lCe??WMHLPyCmB^yaSy4^K&np-ljBIY
z{Q|_pw$?CNd`T&S05lQP6xTpA0+InVz4-`SVAL(Av-$rPz78B47mg&b>OI6fM0b0K
zj?4}_V%o0(p>n}`tM&WC?s6({gggp66qb+pbItia+gVI%2<Z2##q(ThG~bJdh@htb
zFBSmAawH+!g9@;~I8`=f3Tnf%%YjApi`qnYyHu{C;YZ$IR%v#3bH~YPNBSunYBPKq
zh3gaPx+f2dtT0rCCyXz(9>qOzS_A2NxF7D`YRFo163+V!?$?C<Q4|P49d|=^DBWtz
zO!yZXoXd7pdIUDI1jwJ?R&vj-_lP+o-&eg<-Gs}R9ks}e(1BD4FdN$Pz3Nlo08v=t
zxAfw1$_4{W2nVxj>q<!^lO?a^C@*4%>It|yR$Xn?$A2sbu=ekNQZ7eht6ip2rS2~a
zo{sX?;iU7UB!$>g9Pu%clAt^wq**SUSGaN7`ND(bhMSZP0BHnNv84C(e>-O5+nYM*
zq)icNwX5oz3U|q;wc+P3#Q9v9Vx}ciiso;_lih@d1C4<%&b=XvO1*e7>+;FQF%?x`
zor`SLwTxmsfucC$j&|KS$z;E%uE?z|>Ue_F_6^ycm`G_B&cpdD8!N1SFxa(5NR2Po
z{9odJ0Dna2{TtW^@xXen7p>rH`%2IDFW34n`7#>xio(|&aEo1k!~ko#G!Z?}v<1Wz
z5|y9_@nRVUFIxsuj~~3ogd@K&@px>8FytDhZTBpJT-Z?=jbldUWJiio;@`!&#sA|c
z@<s82;Mt;BzK8}ooFji7#Y*am<hbbhu9k%?aSsK3haCd@g%8v)p3SQcV3h1=XOCw_
zOAP#UK)k{x;3WuRV`k^oovbb<H$eC0DihJ-qRavJNbdH}-OkTT|Ix?e$CW+sshvTP
zB-hn%VVxbvXQSws+Jt13h)lD*Ccpmuv=6xD6ul=qC+_v7Vi@obgFBpnv2MT*)quY}
zdjo<$`f9`o!dv&DUUMTG%#b@nUqHuSfLlf}7y0VVJ}$@q(fjwI+8_S}p!~uoV_RqN
z0$ndQrJUeKI9-W<o&B$4{O_RtYc2o1{qxRi`_SVl*!HiVhh4HG2VXunb1hVfjvN@e
zJgcklIO|X{1K+mLNUcu4x!&QJYjrbzB}nBA6I?N_LD?_j)lY<Dz?xnUmhVpsZDYey
zJ?K7I&2+Ss8pI~zGxxb$>@E?CPd-|AeM@_L?2l0L;HFOG+-z+;3n+V?Q$H%<a^C26
zbf~kbe;QuuI^TwkA?IUo4KIJQ&*^-CT5}vDO2K3o#m^dTo{q128&qVg`v96ZKfT88
zaY%JOW8(X6r6+h^-@H@EHXy0P<k0B3U~GVjl8n2HM!N2*Ys&F~1YV~Kdk+5(UvC){
zXVkRo4iF@`LvVKu?(Xi+;O-XOLU4z{CAdRy2=4Cg4#8z`J-qL(ul7E*Po2NdRLxVf
zrn*<JURU3Dkl)3Ni&oB0RtrVFx0Aw@LDyV3qMK2{2twad4O2OQuh9ek`@=}?OZ^z(
z;sy$pl>wzP(NZ$Y)4>)p&R8_-(DB<?E)hOCC#wzpY~{K)nw93oisLOjf^DGRL%(%9
zi%ws?gREE(kg4>c3c-If)7CVawd~*3=u^_(R8%EmAz0tJcPKO>3JC)zLhRyTZx>%)
z2A(kF`tt$)JK~w4L3aYv6kc`J+ri_LNv=$m()k~XWa6e}78A&wlP)EHBV3`j&A&Kd
z+dIA8sW#rYPleNe?b(#Vd9_zdW;d0J`uJ{rblmg>QKiSt@`i9{t>Sk@rM2N&q|wg;
z&?*H2A{y?HjuxRO=f~y5wKoMn3^JUggqq&pDtW*z*dG>EzvmTCsbRZ5s!y`-w8W$8
zck63DcIW#mE4_s(dQI>mvmPEg4|^VKG~M|UH*F8>2Q!elJ5L*ymEO;CQb1{-g_mt1
z`=e+Mymf}Lh-M)kE_hDCYC3kOeN{Yyt+y1-uFLam5XjR^t*zA*5sCXd-jLwRVXjz&
zj!wk!3$Nd;vas3Q0~;#wW!U?_Y|z3%9;Y~c*XSPI+}Vt6h3ZuQknIV=d2=z9g*hdW
z;g-jyXF+WQ=W#@(zKycAKDr>uZlk#YaxwMi$5i%K59?-0T-K5P8y7n1<mOTCYhsOF
zI(zOq)W$O=eZe|eTIXAtf8j0}v4_O<$4P#mm6@E)<4jgLayNI<w$@X0lUkLsY(w`o
ze*QUI7-2$m6!V&Xq|JC#OxSu0o9d|iV=T_K%T%IjMdgZ(UzAy3sGtD$Imyz|Ek<qd
z`iF0FX@^l7<OU}!iP!>ge2P(YOblHL#1E>?e~VoyDt&CF!`iqqz5&9kE?%AYe6%u`
z+69h~TvK&i-(SFzxp^DJ>*|IW%;8#NDkvQ<1FsP?-FcFQ80`PbazA{HO9MtabGv*_
zE1+OGF>S|gBKKTK_k=b(O|V~1W5R$!R&m4+S8U9cCx;7dN9}%^3i+CaI=>2{MC&uK
zJ(&YA6#ZVV0zN8RX|(8;bqZ^<RQ(t2t!cn=?Y#2otM~KFHB2(BFYeiHmuEcmyjOmI
z1zLyTr_2V>wy;CYMr1N^ae5_?cYVh9M1>OXFHP?-^q*{wJry?sDijyhMFi1|j&FM0
z5d|rJ(=XYyqoPw)y(IHCm`TNoZ_!cQQ{Q7|)TNAeQncXX>?+O9WVzBOgU(C=?S4;8
zZ+8(8gsBSd=p4aO(#2u;U}PS(O)#S<Wky24PF40wot5)o5e2<k=C-X#{Ojk1V`oFI
zUmO392~1emmBm>p-1fg#(g-ly?rr4R(`hzGZO5>xDl_vJ3Q4~kcliL|@zqJ9l79o$
zWxSPrv;81+Bd@`8&y)sMr=h6>a@!AQzKe`~E#&N6q_0dv8Yp#<1hg_g8`3ttpQ7GD
znTk^%+73b-Cpk*Io(gjQ9wp-dr`~WaKBk;ePXDaC9hF5B?S8Si#&aXy?-v{uRbM$7
zV*{!-Obui(9yPvcC0I<2Diq~F_w7IMF%gI~`zCh$`*O@rd2$iQ8!|5IZz7hRk!&}M
zp+mb?f9m}7FCL}Kb_Q&=vgC+$cs01g6}I)R=%co|)5_OyvNVyS!K2!w-7GL~`e-nK
zq9gY4x4-Gk5VIV&yiOYn0Le_hy->)TDn5z+j7*_XcDrmr<&(5cL_wEmR>%q%R0dEq
zvGKG<utG(g!v{V-LzFaXmcz%>_ngV+$1_IDIPo&S<ae8IF4-22A^9Q_AIBvUr)L`|
z`)}Yrpf~gWpcsi1BtBDnQ`+ju#b)uaa-b#$IOQ!d(VN>H30yBAKzw?XF;1CAYh1jU
z+mrJBhznglsqU(ZK43^+*le@bL&F@R-1%r0v1q+SDkV*HWcA@QZ;g7k`PwncUg7NK
zY^Avf*)6g0_h)U@2hQQ3KT46MKzt}~*WDo7U0QCB_F#p8{FS;URrMBZsB`ne<X(n!
znB`|y{i@>M$l#7T$jo_rT)3kX+b>|8_SlK)0LgyV!+MYY`8>Kkfo*;-TEA2Yy+bM-
z11HL!{I0!Z&m}NIPTwresX6nAlRc>sAv@%2)IfC=6RXY>qAYjf!s%YmQKiDy&{M&a
z91tk&#xk=A7JX`?zWZ0$dj{wc>@HfMB5j3szfs#?Y4BA|&o$;%qyzYkZ^&UxcAax+
z?O&{NOmmgu_$vBb&u@GE1G}Q`ggSO#U*J}5S|e3?6$GGVyZZr!+TslxTQ56XEI5EW
zz2!v$c$pDx+H#!QU%BBdAg_>y5z$rTr>nVyg5$wsixUdjMYl&cdzLOkduR6#x1N&T
z`BdLg?VMPsi;eZPCfrlxr-C;bJ%^7bL8>iJH+8<pP~|eOi@oM<50}lC3W=_ZyUKDu
zbK=`!F{}=G+ItUlY(~y@aP7{y54RAczO0WE6O%?r|0JutZ_dMv-C}4?@8duy+FZD&
z!@^J!=M?^+pl#X}h2?H{^S+cHNv!7*%b(_ASq-c~|J_HgtcXBI^5~o?*vJX8#1r*3
z(nA+ICZ^9Og-?u|Ga9>C)?@85*_9~xbh0J2X`!_z0Z>CybMl~GqsSGF(6?!sQn(5c
zh+Xxuow|$f*lO+cZ-^R9TiDw{FO>fBc7vkDd$IXrBfP%PczXD$CgxVw$9(s!My*OA
zU)M{2lb$>9XF;znxU5`10k|vN-sGa3ZgH@9Se%ZMd-Xn;`;O6cKC**>O|jB&hZy(}
zbrr@@)G~U&kR6qyk#i@Eck;T3uhaxu0~Dy&qs^1Qaf)N{bw&>g4K|)j+;G(uE1auZ
zutBM>g|JBF4><?NT)cJkgc6>MdH*<Sliwvb5hkeg49jW{PSH6vEDjDu$d+>MAq5CC
zR{F-ZgZb?FekS{9nvdl+WOX;64LrdD0t*5y{AmdVsyFLDtnzFFc8Mj#iQ=_a481+m
z^-X4`*+^?Yuza9L@pDtgvN;l*_uUBiz<#t!WRfn7f1O2U`uCwAS?KvXr@h$K#ORHz
z#(w1VN;FgPiyat04gYZQuN`9dagM0@IwNr-#5}Ti!l4Ru=!PVH{L^sgSN@mtP)PEh
zVA^9C#(#!Z8^jdfe`Qomwj{z!jXrBE{tjkWuT;#_(D?~z{SdvJ=Y3O@%Hr=lVKqR^
z({urTEX1GUmtdurgdOkXbL%I`y{|R-jRRpMnDr2#=8{x?M*-*O7?JH`>2!%3n_jUP
zkO}T;9(9={kS4_o-NbrXuIwgKA?O}&ZR!Zf@pkcFv2NTzFgY#dI5pM%9PVR0PS<!_
zTYq)#b4ff8+?RhY`M0no+o>~VQ4LSvR{ih{@Be#94nImXgqWZDo=$DSr#biaSlsmV
z`EJh@qz;W+=>0}>Bj?-UkcR(o#omRBF{-4kC;=gnF{BYI1y4XL+c(eY=?Ry($)NZH
z0AOSdcuRFVza#bg3GWKullesmSrMUXg4;#pn^+W;?*d5^Jn%8varBkE26I3uZPYfo
z{-)(KX?5+m$38#L4R^BgqexRW#mKql8fq7iALMlG`RNJ2yNhWkz}0C7=rM12s3}i%
z&rwIs|2Nm$DBJ62w01D5^C8&rDE7lRWx??H%+`OdJoagN7@b!-@ACcDN?^omxc0N{
zeQQswTV^+qD>~{rs37fJpYp9eU8h0@bEH)7*L#(W8H=Ydo$1SaN+)oP!M!bV+9HI-
zi(-ivcYHLFYeX)fU|`l<0VKMB!<K`=z-~?Hnxl7jeRUt|C2&VH6!ttDDXz#b1Acpo
zClQ@wM9efSlWo177dbThJ;3fLWLMY3U#bg4dqlzfYuNWI1fZ#@D?0t>i$jXHD&u9v
zyoC)r{Q{589cb4!R;n?5OmhH__Exd4JJt=XU)Hc0q-BC)eAcmlrEe)&i>E<m{qTFb
zm=TRTFn{-tubXuTo^~tt0&k6s?k&k#i2Cx?I(DkAa`jh^`P$Jv!$Hj@8Y!D8_{nS`
z;wDJIwc{E+-md@xI??6s%o52<;LTV>)wdRoJf*DbOkaE>q5B248c5VNjzlBKn!i6x
zNScJ+dqn7|Bb|6TmTc+vWS{ij`D49M+PxkglD2r1j~DFk+Y<)&E`8Grt%vH-Cv2)F
z<m-PluUUAoK=wIyQC*xDs+Sb!K!l4pi)<GRuDe79oa|(;-COESV!Q7Nh@I;+7eOez
zqHq2qMBQ{)HbBTdv3h#RVUAsG6sky%x6@^E?aBVym5@EMoD~ti**HnnXYHs=4M#=w
z7$11y+q_x&sKzvd-qkLxjxbH3YvNvl&T@wqI(`^J;QdN1DJJu(Y%Cqze$3H2ZaBy5
z#A~_5O#J?n2bc911~L6yOM+pmCCCkblv0pV{Q0+Avo8ZaGK?Ax-5AH+*~Tw~2=mr}
zVM;8PrfqbXYbdDY)#kF8@`uWMNa5X@J#ssCTZAea<3xGHAR5M*d7FO>h<@R0*~LSt
zqngZ2?|7Y;7-pwn)!GTRj0!77y!<w&9{;*V0ze2ZQ@qrQVR4c4?Zr6sullU5gGAZ1
z-PRDa-svx1d-!!Ld6Nls*vSW#3`ph`u3J>*DQ)84VdI;c!9nRa?;0FrbtO;$0`@yG
z+N7{DzAgKBKL7oul2Z2#!Pjd&sL^H|#<u~F@-$gVQqf9&jVe+_+<VoM8prR2AL$R{
zYsg!I#wc5Bhf-VfDoR@FEP*&f?K9U&BPJK2!AnAQ8h8o?7g4x^gVg^T>*h{W8q7A&
zo35%=5Qwh@Up)q2Mlb<YrK6Q!w;A4s)=>a(F_&0qP>2vDJ7Qwh4^^@P%IUt5i++y#
zmt3}(aUCl_;-V~JlG?#dw1}Q46#Ii8bM-U!m4{wJ>I=!yqp$FT-*Vl2%~6rxk{|9^
z`|pr47XSKZ%(GMnU$z}e>)>@(wUd)n3DA-D{}|<FeM+qx7x0j0^N8Eg#8fT&<MJl6
z9$<SmzNO@w!;r}vx*?R7^;*d-VR}r5>*&c?tfxBpPsv_mDO&@Z=DLEv`uoI5tfraH
z+g%wjs*vu=8A|lBt!AS6b~p`Mv#p$+K^3dzk5TMAL3Ph)9fh#fH*w|u&t&7LLu>m-
zW-k;GP62b}eStIczljF#KZzzNjLth9Tb&^B<Cr=&Yq;v=_YN796#6CV<yp+S!A+!m
zh{s;&IHn#nFV5@a86v9mkvO`V^v7$021~=g36w0VXT9u82Xjn-$WdlLY-s$P&w+Ut
zTMg%HNNw*P)e(YRdW^xKdTaGFnVztq_?TVH)TO7F2(JW~K~&$ex{#U{s8FQ^MtkRe
z(U@{CD&ODYxd}Qc0LWU;q8u@zcz;65<J(qL0!=}r(c(xHIQcp1V=tqP>E9<t-D711
zjzt*Dbr;&~G%6F$pb<NatUM1RamB;?D>ab_MrhWQ)I8Y2phRhwTnM%vjO{!{IQcl{
z^YKzIO`l2u$?v@<#L>lt&<7dH;1|(?J;TNSq?+<6_!|DdugQpjcE=WCqe-qzn9ldL
zrRGqAum4yWTGb_A;Dqk%LkB~QH#!0rT|Lr-V(ws+y{(>XQ8r%&2gw%HHWvmPi8BJ;
z`UDm`JDdXE1@!K}LRG`RzD>SQoi*)}?fOpZx4u*@eO&lkF5hc)O*z?IeA|}S_xJEB
zfyMEAq5-5_&;3kt^!qTPR6EsKtG^I|>JqJh^~lv;#sb`=PPCkYF%-|IIE~@MbgJMG
z0)<HyT(F#*xi7|v2~stgOZAFyUf@ih=P!DBXdU(X8uVqmy)ekb%J~l`kzmNI*<#o*
z$Mg(q(iul5v8BfM`R?-9n%Q7Ho5}gLN6}k9jeRQaD!D0T$Vw0r1R35KEnP-=pu<vf
z>=|4e_03?z^~vy_9}fDUtSriOr|=pxL{UD(i>MkS3n%0!E3zB{8lT6#GEy1!-vCS1
z2rIQ~Y#HBVn^aaowlgXF7siNJ$D-nY+CLe2qZRE%yw+i4;mHxqFr_2Dhu?f23j!C3
z<j{<zHp(h^qnbyZ3g5L=%Le)fcz1xKHz@38k@*Y}kXN5qZ7+xqWwS6|YkWH3=Ipl{
zyEELUQH9Xnq9LjYj#L#RuVXZ|C1%G+yrw_94<@*L5`scH49|l0uK{CnwB7iH5okXf
z2{VQm?$1A#{p?9SJhN9d-j`B}f8k6@!z+%QJ4E@|astdg(m7sggUPW0Ed5XJ>=29v
z{sQR42hhTT&r+N9O4*w#s*bq|QCA>6T{i&W$PwjJ1#qO{>U4wcq*g?KFrR!5TiYHW
zNXy$)cM9%obdL#j-q@4oNqY*p3e?vgxyxBPJhv9j*xJF59r@n!=Y-jvaPi@C@}i+(
zpuXboR{I*=?akfC(Z0K*E<4k=kXVOnb)gp@Q+OqAG>=8RjPG5td*w5gcw|bMU60d<
zflfw3plpYw^Tun4T1P!4ZVm4yDjdghL_Ba8HdofDforh0gb&IkCBWsb2?NDmRYdb>
z45z<kdTA5!MvmuhmzX1LjOKKyAZLO5zXwe9l`;075zco>sfk0_kU0e;&;9Dln8biA
zgp_(Zn972cxNx??YXL49zEPX{1)1k1JR8_yO{!1r#&5EaP4%kqwa@``s3x0a9q&ku
zEJpYfthg8W<3HXFR@Iz&)DG%S*qr~gl|F|<z@RnJd7O~gawI%FSW3kOBmP9)HgN=+
zg35iIgi!Eg+9C+FNE{7GQuzQRr^(zd-r%Jq-J8yeRe6xbLb*~^j#~+~MheKK!X##Y
z81~EV0TRpXo)@cAh3nkqI4W|Q4yZ6sw7AkJTOSYzh(1h>D6n)+Ag$v8+A@~If4uh(
zFVB$Q5veQ&yC{@C`Q;@zGrLyUhL9soxzrGFx4Ag)+ij_lnO|^gQ&?|mGr$am0ib;X
zyxt~lrQ$k07UxbOOFEt(lzuF}WMqINtmmp>?Dax%r;gVaTH1lWC7cjVKerfkKb=71
zwrz?1uTF-&b(POspSC$C0Q6h;z5kk=1uXqQ7gnNErR$zbQ!U{D6+|n6+v>O^U3r7s
zB|dV<h~k`uT=yTcav&hjkCn=urFGAxIpD>8dZ*dc%^C*cs`&w$td{f|&f=?`p5*C~
z+*4`$9+LH1+w4151Ak(dP0sH!BPtHZk~^Cpvv-tzX)7l{cb7bUPZEYTYn}7R8uuD~
z3epy?GXEwM=K7%9401Q3-Y3q3G=YU2EH1+M<ya$Y7hM~2k$P(ZwzQ;g0HDxaP9};z
z4GtFMsYk1Ruu+K7mx&?^m=ENbY|<_93_{w5?$~${aSDKxC@;qTT(Ihof0gUBI3sY!
z1^!fBk=XO>rT?uB)~GVEaDLIDbJ4M2-xH_mWE*D1p&acEsJ=I;_V_6C!^UIxLFF3*
z?^|_tbWJX$O+|yto~fz+wg1PHB7vv+BS`V951#>u*D`|9#&^AW>gfdofC_~qBCMi%
zETvRDk(O|Og>UikwRX#oK=&gWi>GTp0e|iyJE`rJgzI`EmUzPolj92C2LyyG_kSN)
z{C69c;*3?8*PXyQ-QKbIedJT+bDkv(Jy%<;omikQ-^d;rksne@a-CCpzwzJj+R?iu
zWJTxHGdqYg8+hkzFjq-NPulwtgu-{ulal83ot3@{?79H}*6z&e?Fr27-thc5y1Yiv
zxw38k8Rm1QJ$G?D14(iKvIW)o)bTQ-nu=jphZ8G|=CrUex0Zi>cCWYOh)rf(G(gd~
z{vN|ZoXnLHpFl42_RL+#h6C5+M_=(&ZD{fGo`*hl=P<L}kP$=3gY=kW(*}P&_$$zU
zOP&%cS`rs&m}eMQi8lmzuTHD(SB<A2PVzfB{RgWh9BWqouLC2*V8{C0*nj>5xV^s~
zd+L5_ax+;8tjtUNer`;sn@}iy##<;zcoaw7g4@Lx@fH1j%>rw#<3%P@7QzD{7P?~f
z6=!+H;BkZ~mJXhUVdJg_j!Q3l8vldr>yP{F&EQMQQv;$6a~AXOfW9U^=w`#e4vu6H
z@EA*Kotc3Zt|JLBaF)`E^ayl;!_om6wVrmvCIJ2MY!QAs#mq*Ab{3eIY6)g0U2~Yg
zt|j6)qK5MvAF8IuvyEsQIRxAngVi`On|I#R7{l}2Wnhu9zM#h-*VdN#vyt>x7*{IW
zxR>u)a7+c!^L-Vl%HmaH5Yxv&&{MHKQ()=A-u1ay=^~frmiMVA=Hb@M^L$G|+xTjK
zWw18{#y?%)qdQax+3s;K%+X)4^XN*h=A&loq1my?ldNKJJl)evjLGp&r3y#_A?`2D
z^_bN)D-{&CJUI5c@8~KUHa_NK-mpV*Qdg_=>36zrdNwIduv6*AnLNp(@O->r1P&U6
zt#b$Jo*5@Tx6suWMVKQM>$y|kuo3-U`Mf*%<n#ErR~nr3DX}TpDLf<09R{NqCRmO}
z%hu-tBEya&3*WhWDo7&&`dGp><-PY1c5iakB&(+B+qdwuF{v-p1o8iHwY5|#d~A6Y
zEgH$jfqsmNItYn%FbjowcJ2;qX7#)I$`Y^S(84W8OGFRs$!0CY5U8jFP_gnw0#vVm
zBn*U3w7|LRadC(~D>g#8n02F-k(W7&du?t$Ppf|}rZTy-G_@$swo|=;m8qYS3KA9}
zms4C}F_Co7WNn;+d|4xFV@b`aHLqo7`^4F~X*dhuhorVjy4UAlu7TuJ<N8{nqkA?9
zl6wTS(%q^IP$p^2bzOXm=X`+hSD_qO#>y`MLAu9ml-}sALj4zgbLhU;RLJ+{_Ve@0
zCT%_zzXBZ{DGC$2@o}qDJ)mwG*AdjN=@((d&GuB9l`Ohfy4VWQ`p8Q8Pf6mfi_VlL
zEQIfxL@vC3F{Zf=Jbk4ycmVp%WVRwHLwS6)!UXKYq%t8l@BXC>-D*~&HfDMhQgN7$
zceRQL!NVh}qK|kDsVbPaPu+cw&v0xiBa&6`kYBSQU;7hj;3u#}+p&43hYG-4T3b4-
z3`DxRvp;*p9xSH_tnp&LM*bo^IL;Am{iyX`JeFHNXd^-I%JOBt<{7WuOB7%R&!Z;T
z5FN2HPbHSp<JIaJWm~D*(d`wV77oys!w=Z7@AR%4an!rBWi!vn)V|}$Pnqmp__4J3
zM(KV8>!s?WhC(4DSB4Y}B)Ptn4k0^)JL(mq#X<DRpjv^E$ApO{$Ku=f^U(o)*~;;4
zCOyi-u8L}8)mI0|2AFExzFLVC9Iy*snA^HnbI+R9x(7{XH9cU$+@D~NI*uhmbhq7U
zRCUK*OlsD!WJ??mu!KrHI<cq${^ZI|!Umf{LH~YUD0UfQn{$Y)78EmJ63W_{=By65
zOz(^4iRxTYGf?3Me`I{j-iLJ(ag%L6E(OsId~O{%b7vM)NAd%hM7-MJf+{<PU$7J!
z^ptW0==nG!w#uWC_#&O8!nlbc5x~NlG1{&SIKu^GE7_Nsg>&QZkD))IN`H<7&U86!
z{K6%<`RrRm{Hg8r4QV=nly7K>p!kmO3K<&j4U~%NA46zBw-hvJB2GnNicfl#+1K!W
ziFoZsHhXbZ&1>wjJ8rcV)%Es}0bwY9HK9S1CI>2W^&}RO{SONOoHCM60YL4vg3t3b
z55MfY&jy9!c+|nWuPNuX^0t1E>%D-hyc0y(aHN;7H^wL2Ek3<!gc<QD%1WWJkZj^Z
z>lRw=7V<@429p<AD$J$yYmi!OH13kY#7|>NGJ&rHe$-kV+`tqp;v&F!iMen%G70y&
zY_8i@CN)ubsc{L}!Y0E*uk7p$Ir`tIJjvhaljuIQ(oQr(BE^92n>Zc_($TJ3HoUX@
z^A`$vt^rR7O)UR0@aOj+IAj5l_H0rl#bT3H(v1a>wyFuC{cFTv0M+Ki<k|~8YM6nJ
zOY!e8L#aYK6-hbj+V7ifpysY~zCX~-tm$;B1MZ!ZQ-JT5?o&K>p*}|Dan`xSgg03d
z>A(YLkhNwCsMh_e@C!k1!0t6l1&)PRA0wk>!vaN&?)7LZZHj((v*Wr#mGYy#bL8S1
zk;CX{9|z~|9{6ghsw7lrGtF%`N?mvBk^SFNM^5H&Lfru8fEcJlo=^6E_=Oswz^9fi
z>a6KI0PY&Xrb`k1Z5vu$vphh`m=?Nw(T|MSihD&X!Ie_kovB>g7(#T_1wvBSPUvAG
z>B>kQh9ad|v3gQF8j=ieB05LCTw(ZU<Vx$`e3noSe^n(mO~2KfPEoA=L<^Mi&Wwk9
zH|wbq4!P#>L3XCGvUv+#isO7q6HsMuWFR;CQWB=`CA$*3-YrFnu(p!0Kym~{F|$Zc
z`wM;Rr>llb&?#q#r(x7$$J5=ByiwT*Qc;xzLiOW<1y4+z&x&p~eQd+;9Lu#>2B1dx
z=EI~F&^7Mv%BKdQr}~l;t87hnA%a71blP-qIHLyG@_Vyjt=G%W@gn^g)AC}FICXJ5
zOekrzw8@!L?-!xSS4Ll3T8<FP5J)U&P@T=x1Z<o&OiQ=ORE^w}g0736E!6r#aM@kB
zh%pVnOWnH;CzJQ$ZDnL5`({0r|LLH;>)mhV<U(^j?WA0dkOYeLPlEOK(f?2~&oun#
z6`;pN(`{GTfH*k$dG}lu6MCN|WF!L%O;VrL82#jIFoc>H;bUga%E<6@3c&RHzRs{F
zN53?1R=|?jN^0V4K6m!s5f`%cUumdyF*@M-#=ZVXvLY$Vl;r%0(;n}u{lpR*Ko9vR
z^H(InDP-9wD-qiEH4IBCdO^(xwZsx*P5l@P0DBnGl<+pLpz)U>tm$>v$ug|9D<~jZ
z*w)As%|$YY`;I7dGO>DUVI+1kN2v}Tyyj84hQZHdp7L&3F*nvRHT$Vef7vR->Nr2;
z;wS#8?R`6%sh`fmwolWOk%WAcuj<7hw!j0sYMKz|6Lm+&ROg_BOPaU4rNon5cUqTv
zGx`E&Wnzc{jTKG6AIpp%nKNE>0on>4hiyo#BIUB9B{70N8pIIh_iCI-uMR9neV%)a
z{y{Nintd%9MKkf_SRV@XI>6}adQo(nPiu=@4&Cmc-RvR&iPi`*ob!w&6D}DkBeXD6
z6AMTAzs*!N$CkW{BOzi<h{=OEqRhASiM+v2PqR^W`mz67Td)&VvES<BE9-`J-Wz*{
zOuVkXU{B2b{!bu%&01_85Ly;_e#+UqB<5|?UiuAu@OB{kZ0M|g`K%M`sJ<{GyxAf|
zoftN^ws5DX1l<yAzo21AdFxMnO+FvfysUa;VT86O?)g5qTx;qs<h4j2R4#cKuQSOz
z_}Wr!ieL75D&rSEfH}oZhJ@)&`fTHJ(xT9rS?Y=-jBX2rqg-E?s=C(%t4_Qyo$^9w
z2$VgS`_Pz{c+9LDu>Zgj0QG0B5~-ztsAT?@CuGsk249j0Y8Fz*)vce82Ott(49J4n
zwI|bc(CwLNS8Zq5*u)oz-!YRp4E_^4COk}o9llkQlu~#kuUnssy4iekIWHSJO2{nK
z;V>vwQ~4rrvk@?!ZNcwlYP9(B@y1l4nP+l4eHtnmCF)jVB&?Xl{q_NG*NX4ImVESO
zJQL{eetD}U1O%I}^VupwBe#AGL<k-`3N_32alnu6X<q0zP&nS471;^~>~t&)og4dE
zPWn|=neJ`SHyDKd7O&T}1<#%(Jr0}p={@~kNaAY0I)D9(Uy$6m4SJldscDkkZ2vH$
zy|d-G3jL5jr#bh%sS>yYCspJu<Y=UZM&*E>C`mE8o(~+3?yE+4EFOm*GQF3O2=_N!
zfm`N0D9_L#R!k14Vk8l`!(m~y>jN%^eT0RZge_^_H38$}iY1Hku{UV?Zp>6sSCM<W
zQZAwJx@<8gX4Fe{nrcrF4?B;7l29!vd)%GD#e~%nnN9YpF8Rym!Q7QaS?T>*l1$Tj
z_^rq(O<9BEhp>V&if1P5Aq{wg&O9zI=ePFL?6rCnV@ky-@TfxQ9FfBLlmke%5d^vr
zf)1g|jWMM0PEv)*W-N_4SYnubjq<TRk&bU6q-JrxyikfTtRYTenXQ(;P4F9|xB2)f
z!cWr&zHSl4D7tbHDyB3gOKy#!_~n?Ln;m{f#b|%i8B}Uey-7Yi=^A+hd3dJTVtfI+
z*zlB0btm{*(V&h>)f8F+6VC_kyoHB(db9i~-fd!;i)h<8q*ZkgKJQv&#8ys{KY2l#
z+F-Ya6H1E7cvn}_5L8wP-bD2WsfGLXU5h*$HdB!hAu>V%Uysw3#p(&QNulyYaPB+p
z<D3*<)w$N~7}eS_-D3!Tp9{R9j_Lux4i>z%j(2k+a2^oN{pJH7b@I(k42R_O6_HW=
zG3J6fvVEBYHNHbi0g<WN#Q~_MLIOdRODz~>?OgetM=!r~aC0dn#<B0dD>0zdn_9wr
zApfBX<7klCYwqfaswAN6YDmgiCpTLc2nnE|aoQ;{p6mb(-IzUo^NB@hE9T&Pw0Vc9
z;O)`~1LwR5JQifGzJ1g9W2Xih7-Q!}=5|#J-fgkDEBuV^*+1IY9V)C|{^Jk8@Lb1)
zHO0vG#jWdw*F-h+Pjg9}SAA5sIiK@Q&o-kz8SGi|{mwS|Ny79B7j?gQ5OKx2%H@Y~
z?f1Y+C@k0tA$YZYEpvT|3=J|d$(8c6(l#RddS(6&CWT_dU5)FzW=fiS`IZ)upr5Om
zyeM#4{HtqInok#u$3lnRM8OMYMU^6-={e`qUm;R1?)lNc^-z>XhPS=Pw|6(fALOIC
zC%s}KaHWjJYzyzgHCs93yZ&u#q)_PM;F5q+@PherQdC;Y!OCa9I{Dt(Gs($f&U~%a
zhbnTash}<P&v#gPh%4q|dQR5k$loUf+Rf5Z-Vxc<;pD5+XMN+O-Ca;eKJu&2eB@-@
z!VWDb!)C&zd~y<vs_rNkmX_3f?*cJzC|uhCqJ!9))?tnh-c=Jich(~>)hE1^|H)PS
zL3Nc4(z6;d;yPZu<bB}{5_F9sn_?45Pk?l69GeW+@wKVd*xi@)&}fRoLKb&^ON+h^
z-G=9L+R!L?@fG4vm5YMUZT?B4ksx)?uu1bMk(^Ou=f~EYlbhnpMGc`V<Ycr`F*4Sc
z*T=CBkcd)SvC_+LG$3b1yZPHp+m!2A7ry38SGr>W8;0G6yNK3@CUUp`evC8u{*O)H
zv-ANrBpSZw7X*w8FYAgXr5~U{^Mg}j0`}Ic?9>bY>p4B{-@E%MQ^aXE{nX!94X?1Q
zHLdLpGpfQmA2|<JKSCVee9cqTY^S!fN?coI=8o1ets&1!k`|fT&&!Uw1Xqo;O8$?`
zbl|xbp$5Tr>3MN)1o0<(_2VJ4nIGKS%y9(eoevzPbJe!u-@3!@?ip1(_?bJRb8P8j
z+O3`U<L$#zHekw<bC96~EvNgT9Uou?O~1lK{YHf|p981<)a;6n#T&EB_X84_E^gQ-
zbrd?~?`P9JXO1)0@dwscEdoG2JD&%Z-A`7nQE!#v+JO4{yckkZvrc2PvHc=gvNfKk
z&B?yR^*@vUybAB4lRUPGe8A1FtlRb!TOp*%VDsF{2&z$misA3T&1(j^wBaH5qcv*C
zK=pAKHXA{H$IhGs2CtW)f6fA1-gJOJbeajGV~j_n6{{%H_=ZQk`h8MyJG<P%qUMoV
z5|dC99R3+}CFaiArpFP3f_dK^i$ELPeP6x*Ch$O8fXTilaU++?C;nhe;P8JesDw7p
z02O^6qUoy2@yuu*6?rZ8F<`(30Nu$tHoWnh>A9QDqQVDv{WcpP!HR`njkedx7J+B_
zVDX#eH`cgyyxZK?JjiXD>eXj2l?l~EGax75uQ%q4yfPKnlHUwf-}{0mkF3pVE@p@s
zdF$OUZ`RjHjj(>W$-K2eZfmOueq&>GQN@M*laC25i929=Ejt-68MTgzQz&s(+QND}
z!Gv^O5OOS;@M*5|22&2rjL*I9AJ1^Xpa<qCax(kx&#wuso#{S;vI7Kt_fzJVha8ao
ze7Rw}b(I_4s~SCsD`#8ily{_6@QhaE;*>D<482*-Mtb@)tlzJy$GLvY+m#t%VNEFt
z8s7Mhj}PtD90kh0TwK;)c(<~=@XtTWzLv*Sh}Xm0r7V@?Itdc{^%*cydqWw4B<`W~
z?9A&zbG~jpTx-_c{q`zL;c&F{y_Oisn?-OlOV5YFGG=#+{31Qw-u&|<Z0M;kQApmB
z=vb@PGLB&p3Pl54S1evb_B^HXejn>jIiE9?tqLJzO(Rr9oJDE3rg{{IpH@7sxYART
zh44MZHq^DCBoL|)KBX?@ud~Z#k&K2ZvkUd6yYAr4dG+q9B6MImLq-w`AS(hjkW(EF
z1c36)|I8w6q+apa75B3ETL*jwLyhgRdw^y9CQiMD63WZA%3w_E`@$2jmARCP=1HQP
z0lALqH~i4?MtMkOd8NXe4oK}^O*P76{wW@EzAr((&4K{oiZsff>5QKzZ|Lo%IJO`{
zzV+egxWCx?;0hZa_&vj7&64hf|IU$E!FalE7;;6Y4@4-Gp^y=C$oopcah&Y74WsgY
z#lVg-(Brry8C=t(wy=*l{<N5?{tw@q3J({NZJPGTf7y3h_lfg{NHvy9|7~|jd&In)
zFwo9tUTjIFlL~ei`h<C}w>x^;O4ZYl6lGH54|}IF`zg>N(Z7epVH|I6m8#|PblHK9
zv4(zyBO=}tXj;!f=l|yoT28}ZWzg5G5Fw9Vxw*_u?w@dThqAb<N)QcD!u}S>dO<ms
zAo#ODYzTy$;N~f5cfMP>vKvRB_i+4uRv#kN#l9H)4q2`^4TVs+{@s8gm6gmAE&&j@
z-b~=5=H~Su7<mXQt4rqA-Xt|`_2cjueI~D9<mz<DD~M3(?=<ndex)<BPHebC)aOq)
z)<9_2a~5RskmIeh_9|i`|KF7O{~z+)5cp8twpQmw8hGU9b^6~oB24CfX{3Y^m<QTS
zgKMh&2ze)oeP5@2IVHZNF@d25A_4=WoPodmk=ra$WybGBxA=Zlt35SoxvEq}9KhA{
zy0_}z{0EN4@&OJtccnN6FiQQHOQe63%fEU-BzGW@I4#p~*bHiii7?IG9Wm5Z_hDqX
zKJpf%rb4DHYAd}U{LAk4kJF3t$Zx4iD=mxsf(?;C0e+FgN3r$H^#Qu@Y5mpb;K_d)
z(fRgVe+DK}WcRVe^HkEN=~QKe@cfkLAaR5imxr)sJtoYtd!m4)fw3+r;iv^O63VR=
zJ9i^0kx+WhcMS?Bu*7f>Odj7(Sc2I|EQm{=3)PJOGM@Tb#`Wtwy5W6)AO-gthR^gT
zeabGmG7?*WlHN_~E?k7C&GH_kRcqA*vj(^2Udc&;y-Uw<gdsC=F25Z4JcykSJmByc
z+*&daV!k;4iF8YOYD-QizU%g%131syhiD%+@u;eR7M&N$RKH?5%$yln=gRUxMjJdb
zy?tOcjecXEuGQ-Iytfm;5$zT24*K#^Fn!~Qf=4$yZCV*CH$mmjPI*b+V93q`lu<cw
z8Q;K(KXe6O9-O><Ax-KJ+KcC(N;jPU{YwS_ZCcu7G3qAdqV_^p4}a~On%R=(*{e|-
zjC9kpRjTm!(c|E&22(DUbem;Aa)RZDfB-|4f2!=AA=j(Vbrp=uj(zw}L%V;coq$p*
z*{7P?RE*@HM|%?dZdeG7IuG+#Vmm&FOND{5#^r@%J-&Waicrxne_@Q`^6$OK#n0by
z!bg%=i@0<jgLVHn(qq4e$or6+HFsg>%8OjUk3S<>emP!)N15m?)kH1-<I0Hr8tr?0
z2J0g~(6(eWgQ0D>EZrQ_{Jrp8{LrZV6*I>Zd5w8{-#W?CDPPhFZRGZkKLRlz;WJLn
zM)<n89UXjCDm>A7<o@x+s~63hW~QGh1pCC7N+%`^vI`QiCZhs2^?hwIDS@l(YMOO%
z5Lfqa&Ewnp;=}1TIgV&_Gts^VxHkV;V&n}m=B@UcW$&4NUrGtk80!yUFFP=!b1KZ~
z>)cc9hD-sM{}{-~gGyx>dys-V`!6wvm^0z%omVhQ<IFAA{I`ilLVA63HwW#(tTU5U
z5Vbn30DXOXZXw;4cMyNjC4ZWFj*(?P_cfLMB^F=9Px7e4cZIR~GO({s5JbT<WV+{#
z+P;CT+D}1y)(>xWyCEn!<@MxL{TCU2Fr~Mwwlh(U&mPOYA^$v{-lB;F>+WCU8>@EP
zZUtb^tTI|&gs1E1idwoTu3<)0Ki%sef)w2GtiXrp7Wc1owz(XkMyvAc8}-*cAic4;
z-I?a=V^hx^<n>!7c;@+#K>y4ZsX16GjD5Gm7P9JMF1I5eBnnUfAJ>OAK2iWQsV*DV
z*F#;ZZs+jTHfJ<3o<6h_qg37rUMBUo$V3H~2qstqJYKiV_BwE<O9hi9;or-Oo{Acl
zeZ@&D%O~3Kv*}@C?nn}??_r3#UwwF7|FvmkLWu1BQcfWBlaU>R3fG^+e@4bJS>#s2
z2FkbHgwPdPexpO4{X2m{HG9q*tnamzvHFc5r~ggrY&!P9my~e5XCM3$+e6xqpm9vo
zRmh;zeOHgF6C2iPy?U$Ac#mS=od+f?dw<6~MkXlRL~6i(V&2XXZ_tVSdDpZPj^=s6
zwCqt(r}VRg4;Up5CFqa5l?4f>>e<eTUZA;mL<WHSlt#Fe{6m--XW}$eFQw^FC8>jc
z_!c@vZQ=ntF60tqDEdp-F<IyI{c<Dw@_R&FIE3?`T|$=|c-=YOfH)my<JaAcF6Q^)
zT6bd6OLoLFX|5@d?5ST9^*!p~rX2E=y9Fi`e+2GG<G(>@35+BZxbDicN7191@e?7+
zb0W-7H%mxZWp#p-I3^I-mT)#8dfJcW8iks_yRy<MEbA44L(AF&DPYzGa;pyKh!_Bf
zh0J&=a=UH8>k9n;z$R7VVffzj!O~4lWnoReN3{BGw!LiXL@9B;T5-Uoy~yleDk#p2
z=94j}HjZ&PGDoTXiymGZV3#85$*F|2>nx)@8G3wq3)`;3%?f%PIFDVF*50twnFNHJ
z{F168(&~s!k|Y0@y^w+v{^>LL6BjBtJSI1y0q9R_*~ULN0ymSF8Gf^}BUB4#-vI3`
zIm~$NkPs1|^MbHcPEXAqDv$u?mv^XN)k{vKq=6t%%Df&I+y5G}p^99YvCOi5QrH`=
zK-ls^$N4739jKGelU?l3c$B&j?Ss}JEPWO*U>I~WSaRS(4e*RZl~Nq4J<6tSwIQID
z6Js4Le+(|K<o_9I(0VRKG+k-JQ_Yxyu;=|6_UYN2l>|B~PJv@8=5Wr5NAagPO0~WE
zH5N}tsiXo{79(~(I}5dtI-Zm&oa2lu`>UOxEP^+>S(Wtw(!)BCe{IQ``dSORIec=l
z#sYZWVT5k=U<F*PH;Rdgs%=a2l$Q>AG{Tqr*CFRJ-4lndD;4^+X;>|ye_M~@8O6Ju
zAIqTLqmk>wtCXx4eg9>0US*Y}>sClXe~<x0yO+;s4bEAWK31-s`9?sSn!`Jsh1igG
zcpj$Ub6g<_l8a4#ldhsuCeq@_pj|6WyoUe`R`>q)`7F`B*4pZH_WUUm#D741KggO}
zSPaTXnx6@avX}cFwLq3Qqyel~UP!illZ3ktVlZ{iZt0KpEs6c}N=vxDxeV*(AO!=_
z+#a&B;IV*j+gbT^muPuqtl4;Aw2d2m8ar7FcLxEhOrO#o8>h7RYOb!t&yDrdq=(1J
z2!HbfLaGWt5^6f>hr5Xm1DohU%7<RC`g@n#&<91YaUrBwvqcaaR%qzm71A;D+S7#w
zoy-Wb6xyeG=M9V7&;Z@jxQ7g}bc5jLn!q<Hps7+9_)Cf^PYNy#T1pm=0u7iec@JXw
zYJrby#4NmFjF0|3GEf;;2Fgn@BZi5mWe@hX8RhjvACCMl1a&P{m*mUKVqQD3WMf~A
z#Bbqanb#(Q)1@As`~)7ngGDxJy_l}*!GE^b*D9E{its__PM1h6f03dQ(`6q2+1fFc
zPqurWP)3*a8!&H6V*x@?x|=_Gf(FvskQO9q5WTXtZZq^PU;%2x#=~}s!+ApiChW=m
zC|IEs!yHxL#|+5Qp`_Q=p1S3|KIk;xp3(#e0sld=oEAY}Oi)SDKU-*7)bG54y^{4!
z(~;;@BmJo1vuqhjDowe?XBNn?A<ESU+?|(w%U7Z?V9y_i!M!?@mo74t^4I#kaK=`_
z?bk@3+(SGyQ?i_|Z1}CnvBQ%#Cjnxyvif4N4W&QCC6m51!`Pb`Q(0gwbSg_YF>d!_
zr-J?bFLqoyghqueH|$Ws{&dB;Jvs9V9Gn28t%t95cV1=7#ow#J6pS7&Xnx_&P!;)r
z?q9AdB7Z7xA8ACG(N`dENOcc4dE^Pco+>HR9UZc~Xol+O%Ohkd-g!b&XA!?bUiw_9
z+ub#n5zU_AmAi1>p}{B~oxL3N1+c)97d!2m3T)Ni#B@s2FBfJAXbmxf1v3l*f}yr-
zX~f%oi%j_oh;(a(kzvUHFU+kHN15<{vysY4Jm2pzL)ZHvyx2{l8%M6rM}~gvK>FEi
zUNNU&uP=QL6JVNFMlzR<jAB^*q33!V#>fCMO7)mT5aVD=jcUqKSLrX&`U+=cHGE-o
z{51YE4+v1C)Bv_1mZ{!ga-e`>W%z_j(|On%cG}{o*neqqvmeySv7!GZ=1Tt0?v|gW
z1Fi5ZjqD$M=?b-Wg#-$2CE{|m%XM=~Exv=JjKwU7w6W8w{(XW2*qICQ?~{ICntW?p
zuwG0w-iYF%o8!yz(qS_vFt;w9txOI8**Z#OsxKr&UeYhUj@q7=SdZEOuG|m8Ke@lG
z6D|6TTd^dIvE)+KUFn55eq1e{jIwrS8rv@KK{M1Ndcb*WIO<B}btV-vIx3tLx+|dP
zjYo}hg1%7GY4dv9L-@eHufDvdwRHBq5@pFBF|Ta)`u49(SiEr-TuOV;$d`2<DQ2&D
zwLkZAg|NGaEC1pnaJ2H_0b-iQ8}ohpw75nC#P|t@i1-r1B#E|1m!dB_^*-C67)qgT
zv{2f<+7^xr->+pJSMUGU(8~h0ap;M1LYvC8AF-$=yFVPd=Le?0f6JLB7Wux(6X?2t
zJ_DUicD2OJtsgY~MIQgx)Y^8_6ZZ~);PKVqm5QW=ItO=Mx_PGWYJ@SK?P@`n1X1kt
zEe1C>4k$6^8Wk^=c7;8evAg%mQq5S1Azj0Th01~Z(7)IBL0Yi$3SiAMAQ?r@C-}#U
zny0g@9>`C^3$e?&3}GoK_yz^gWyj0M(mTCr!4f*}PBZ>@7<IR**!T5c<P?#ZwqWNQ
z_LE_nFX7=--<#4-AkuvFugii{{dN}&hbPDs)bS1^Hx$DP%WBA&ga1VbQYCWEaf{Wq
zAGo&`!UO8+2hiAT^}aEb&716+WM46xKfzkPK?M>#1q!#fLr8k_Gs8HzJ3ME9>xE#e
zD1Z2&3NP@AVZT34I|{!z0u6xcw(?Ks_QuB15n5dSzaT*MD16cXlRX5_j=nC&X13}w
z)j^3fp&`A!-0VQG*JCOthuY9MvL%7(O4fiNct(JgVUyDxlztnN*^on{a}_%u5*lHP
zGBCpw2CyYQiO=AU0=^Psn#@e&UIwr8=fpfFVPF4o%*RrkR=0s6UJSb`%OSd#l>7JI
zobIV8n{PqqBVUg`zkjw7du2o`x1WU&;QN<;ZQ5dr+P~VXX?$$DiwoHIyIg_JvoxV0
zbJ!XB<`CMY6$((N7(rf=tAaI}NCUVu+9Zs1*pD`MJFRFOh#VhiF4Kb57iVlKAvd?C
zk;F0wDuY0<2>p0xqXI%VSr%F@np3ouzCsftVxLN{+uReI!{vXk-*zKpgehlGbD6oy
zlldhk#H@Mv`~o3Jg7h!-;Ar#Ogvtz9Pz6#J2Es!whL8^0Yu3xDEG;wIPjMWUDe^2s
z)t7;AuG0o`HpNRj5&jysSkRg3pAnl<C>@pgE5|S4t`<CPXkQd=W9GznXf>U`X1J*T
zO-co?{rg0_$-72%2gqJkLkiD#%X}h0Wrka0l)y_BY?}}&%C7c%v{dHBJYeisZ5FA)
zB;&09EPe!ldtzG;!O!ss(d*_fS6Wi<60naJI!E1aLK1Xu+2IYIF&x&_ag>xHA*}^W
zdsOF1p#r#FtyaGu_t$1ne+qB#&<?X2H(-3FT>e{g-HJ7)(*6cDX^72gH0bt-vzL>a
zpbibFV7uO^Y7s(1v9EecGWEG$qD9OJzqi(IB$5!g_NEVkA6Df6BA>4Upt%oi>V`r=
z6}4UP+EELiZAL`?X@s~70Lb|k6(9}`bu_t+%W4acSmONROW+FV9@YP}3_2yDOzQ#&
z9`OjDNc|5BkTt*v%I#|ltZg=K!4U*T=Ie4ezk6Q6Wa&oaf`bA>*VDF<v`3AterjEc
zcGIr26JudIzaKrN+*XP?8OG%7tXepUue%|Tjb0B&E!#r`#^`9@!#SLXO8p3i1eK*d
zV05NMmM9uc3E$S5PA(yJT46*|gxpj0dQgSA>;(O(EHrQQxvBCw$Uhc!ueh1y`=qag
zeP6p_Z_s*Js9ZKH%+x4EtbcwZNZpoM#_gPQVj=+mC}05=w>Gbi^gl)==0f5HL$(Ig
zpE(o$hv=J};D`XixPBJ{evSeb5z(e09OR1{88D{Gp+*CQUCYv)-wC_V1ue0kDxJSY
zaw@lC;4B60Uzo^~u)e{$*fc|XH*g=U=o#8F#gqI%NrFh8ZHMgi!<p2oTv0v|B&fWF
za}^L-vioMJFp1@pZV$I)8;klU!{VYCq@eFaCAmweP3}U)sweaFo8N(^R@01`k6>>+
z+=p;?We=5s4-L+LakNecolT5du5Fr-D7aAfM*S1f_S6vUj9wM+(`Tu>o&s|uVyJvi
zK4q<$Sf7&BOQMDf0Vu`T7S6!SWyUDyzfHCo)!Sqe_o+{AE`*HIYduSh2sskLn}7o2
z9V^4uu1$!3(O%@6wVu$@_3TdwR-n^VZp7lTe*2A!Hld2c9hdD2T_}e{Ck3Nq5^J&L
z);FepaAvVMt-Zt{3-%iCQi$A~ID5e%I%2!Y9io#?pet5*nZ&rc|7ab7U@S7no@DM=
zLB@Bfko-L7fh@hy*@AzIPf9yp$vFal2OoS;;v7J|Q#hb+9iyo{11FyNa41W{^ZpTs
zWC0UY@u|Tcrd#s2Cs3DFr5_$=h1<}m-8%s8tBe~+GQU98G!AKQOZ<C9skry6Rfs6O
z34zym@YITrnT=gfP@nEaHyVpK=iy!N;?$Lb=0**l{?8so{zn`FCm!ZK28l>$My22F
zUa>Xq87j!)&sK9rxS^qBmnZ~DJLZr8OHM_WhKnzKit4s^k96%TXmMMgI!(lmCVG9e
zqCFN+N3c18-e_olu$RVq6g`SHp2qEUW$jU4AtM5$$S_%@xN(SNTaA|I(h5mwVE=Cr
z2_D@<lfL(r6qV+OA|gwq6E?ddlr>pb9pU50{Un=UWI4j#)OgBmPCP1Hh_Z$^n)Pg^
zEKVVfMz<&ymUs_jIHC1TFd3P|7xAJ8vb<0txRCgekoe7)rq;_aio*Ep?2QR3Iqr{K
zVl!$!*CWA_je0eJp+$9fmH;)Z-81d;9lb!9_upaj*osbiihVFgn+vCi{NB)u7uns9
zddED-5dC5cr|Uz{G#8#YTfQ7EgzE@so>0myi<q_>!;8O&Y<hC}Q|~OU<1mY3`QXad
zs<%sgog`A<?$ev+8uGVxCbJSI9hV1#_pJ6KJqb&YuJ2_-a@Dh4pSBOS3xqILl35ZN
z(ddec3kg@13DLU7N%R>HbbRXXA5)t7!MAL6S<JXu^huUK*~pp0UlN{7vC}R0Tq3_+
zKSkhz(sLlY%Tn8QFen^nHhq*6Ts0^Yre9b7VCtqgsi0<DwWkyf;2YZ?W+iCb;Z*&O
z+(kdqz!^5yb?1S?R#9g7o`&Pfpq2S8%QC4xbj00Y;1F1l-z?$RbyK!H3=GnUUoK@R
z7F1(pG&)60VaUp@g6VF(fhSrWkL+qu^^P%{ET!;Ieb{~blrvKro=rYy|C%8B@48p6
zG!diK5bXJZtv~NPsLa75VSxfmBG@YKqw+I^pC-$wuV)=$3-=4m|I^%CaK+JdZKDt@
zxVyVUaEIU?EVwhcTNoUI2X}YZ!QCB#ySux)9q#*i-fz9<`vd3H%<9#vx~IB&&%R2o
z+O@ZRtoN!JUf+Sp5u`Tg)GFt1<Py^TchAzy#NwQTO^mw47KN^!`=&a~ENHAw+H_!l
zJW<mFR}apqb@z%N3^&wi{A3B~E;;t4J-BR7IuP6!=#L(?D);kpySj?nCcw{@8L%-@
z08uIXhbax~U|jTu0YhswoRLqfIfF3ZbGxht(F~XjGKSDs*=~X5XQ`h9f1CCEO=`<^
znr63->$cH8W{r{59_zOqbz<<D3|%mEDh_!1j{G>W1PK{M$GLozI+uocwE4dBd~=N>
zo%x;@*b^7$w6_{VbL7c5<uGo7_Z_I?aVAsJ)m@Xnh8RyTren~-{MU0e@YI%7I|0SB
zf=t9xP*x^DQgppvLW<>H%?W?J5jA^v#jAqh$ze=F$JI|0z;=0x>@@IdzN}e2gUc~d
z>d|ttaqO4DlQmv50AWIyW`7_!LnZCuTFWHjag@~4&piTY)*^2>7C<FGOObArRzhav
z21Q_VPZg_90@#jAX$wtxzn_ye9MCELX34-(bYx{?>cB`t6kt(X#fF4+GFi4x#;3k}
zL1pt8-QUL`locf34OBPxY?xQVy~RLH+x0T32zG2aSuQJ*z56>xtg0$5(q5~Cx^7c*
zaU)p6ndhck9IcvV$ElRqCYMCsjKGy$nOXd~0WVBVF>n`FSP0JBZX_$MNYS$rwq5;i
zQa=X9AB1V6A5YENxqgN2DUba4bsBLei0y#HL?8J&Y19aY)0c#(e75NWNvtsZ?YwO|
z5ibGnG1loVy<nB=@=a5+6l^<W;|(sOek+kVvu-8n7mz&qIxNGh){%bTF9vFuHkGSi
z5F*ecF!8qiY<52wEsYN7v3Y!Jsf}rPp`hB%vWJ68^Eu2Nj@Y*^aF<Faw+yj1zW{Nk
z5uOVP^js!)<9Tg=w_oe<09-1Rj7BMEV!97D?af)ghVhabWA76Sd;jTOniH1g+3j^O
zaQ$P4)b&2@>cn)uOU_O>cH9#v+1)<O$)SiI68gRWJ_2*x9^9y=fG!zvm#}*wNw&Vu
zIi(*ML2J2PTRqh2KLqV+2M6*FOGa}X64;Y!?W+TmMU9;{x#PWL3U;>mT)?#I7h2Y;
z(=j;q99qrU%wgnt!^@}2Q=?947in@$+jFax@G?PiVc`AI^W|MhE`I;8LEcS)hZU66
z5-2nEecqPL4n3#!F-=kDcDFXUwfL&MTo{6MxBA2biuS+?JiwTgMILK1dFGYTIC&N*
zB}8frOqjc%9<hR-<Iz=i5l4_6F^a4m$a^$>YwB8y1*Ox0_}bl=C5_J(po1}nD|XY`
z$epZ4XuqWJR9bxdR9?0Lom09cFm66c^aITy<La0C65LS19oLOiDYzsTy(5NuGB%sC
zb-NV9321BOS<%4H8t7t8O7A=5ZwlH}yEOp6Y!_sq%1#8^d8}`RFv+t2RjYw>V?l`E
zRsiM?q@=own~ExgV?IDpxq-q3^lx_Z1%=Q?iE5j9#7A-)t>nWe;6U97{k4divzB8K
z1{QO*nBg*gD!0q|>F~)kPD-#zjqzU7`A^N|mgI)bwT2zQw8NJMogJX@xkU?`(2-;6
zutyuM)r{;{e)HA60{6Q)_2xe-`Q}ino)XnPdz4ypFV_-I7(ME#txC$6v&6U*w8hLo
zS>;Ir<{6<0XvX<+chQYx%3b}qn;5<STbqrhXPJGxC?bRU*Tve$YnInVGzhx7Yw;@~
z!(iFAB{k7YJK%6tpAP8vS_yQt9Tj2!z?wv*IU^%#-DEO}$nk>F96LsSx4Z?M$i!JH
zp;MFNV$ZOYqvH{FRd|A3TKLa9uEL2hWiw25FE!4^lO3NEZc?&42{+{=$+~k&()09y
z65O@q^{{X@Payje@NS;i5ia}^Vc@e~mFaqL-H{@5srHe@o_R)B!d9nMvalnM^fC2Y
zdiXZqj;fIRaseUJU<lN<n{(JxgGHA%+Z7&NP~2!*-3yzKjlLrOWq*`0`IACXCrGTQ
z&l9noxV7a{f18%L0(p$I4Q{j_+nCqagC!fYho5lPD*X0AsexxGmhy?eUZdeVhaizb
zdR!f@R!VTv;osZmuNwf)$iyP&-L&WCqJG_wiKyL8w&|RTX^Ajvl%!4}qvF*0Qf^#v
ziT%1Jh#n)$^52cW&3vu$+OM|kiL?{YB|`6E|B>#apqEIsO8b^AwxGwVpwOkV->OdI
z?U2!B)Od94$x!z3dwM69i4+YFIuK@XV|Kk6ifYf3aodIA6uJ9>P;+6T`4IloAyqo#
zX@=&mzDPseB3&Q+Lys|I>tBK{TVjru4dab~O4VFngA@kR_#+%gh<efr%!&5$!>RAC
z_HiY9_O?BI>vNe)fb5VutI?I;Yt1ASLXJOwgha-=&F*B_1nhc33}UX(J)a_X-Lhb7
z>xV}}X=boozt$pv2#9mroyxw^gpJm&*o!+6WBJGq4SzZ4n>!s7rq9=UCu}iF225;o
z(w^twxm+mZ-2d$8rM@2eo><`r2y^sCp-VRF<l22I!gbm)CS6|PLagw(31|&Yz97*&
zSkmcJ9a!bgiY&O-QKd7^z;tvUN*#@-|4~JNNT7}P29dmIeHd1~-C<x3Djfjzy$v}6
z5@S_H!zS8bE*5aW4i+*xF&WNE5>>hAXftyssLqy0QfGfZ)9v70)x*I%8Lwj0sA5Ks
zlv1FDP6R!z+k{>?UE)yK9rlV~A1Pn^%C?-?JaLNdf-i79P%wN&JSk%?4Oz)|g;K3q
zo<OnnE=usCuw#|YY?Z=~v(z(=#&Wvdvz@_YH=fuxBbYfxyke0Z?xZ>(Z_leKz8K+-
zN=&anX!r%zRS%_45C4=SA|s)yzW@9><me#k`SV}U8Hd!pE$`l6o9z$TM6%h)cL?+C
zW=smoRp7L;;?m|#13Q8`=@0lle?yYKR2S9dpUxCC#?_}%HVRSguH4)~U)50Pnpfqg
z8&%5%%ll+MtZ1+huZ#<y{V^0E_3=#*#+*qAY4Ht6y0oM|UC~_+q;q+6#zNW<X+Vd*
z`)xxvuS@fbRN9uE?Dso*j58W9*W!B5GCs=eVjE`rMt{x3)q;;}bkuT%>@KS4M0d#s
zB6!!Zd7XF1WAEt8*U;c-|4lwhOHyoO2puw8F)XC_c_N*2-;$e6Z^-5joHZiYLHpg9
zXVyAvL<L;_lP}-n)D9E=?D91wG8vxa1y%|K2_VneKpx1b+TWPoCjY+EH~QdNm4&f`
z*Ec&|j-+Ai%6U?3(?dVO-gYOlN8R9$n$YjREL%j=Hm)k_r1usEct_t0Rg^CoXyzIE
z1{GvZ>8>h0-$fw&(XI#D7=!B?%Y&2p3xqI)WAo&M{}P>LDTIn93kd$J)ml~VDQy<>
z-pDCMZ?&p4-$n@b^@)Kx)+F(GqMDzN$>7@r#8P)ln6|SC(~l8;a$~N8ge?&fnG`f(
z;JXUeH$}Cgz;Xv|u*t%z;1~j!f&BDJ6Gh#b%-0~h>(J3gX8mB8x}lD|ute{QoUZNr
zuM-`EBesXR5k8aQvO;cY%C@BfHSv2a-+O!1%^jbI@qX>&BSHASnv)I~G#zj^CKA*H
z?8dT9Xe|E<dj8ym7JGru3ks+pI~t2;Not5L<7-lbcpT{Mu37Ydp}fv|cblhVkyq*1
zlFEc3A)yv&su#wNi!ALY@W5)6c0eBMEElL3xj!Z8I48-3$u`mi282(){UQ|xJ|Tm~
zNII0d`6Xpa?O2h`CytFL?)LGKVXigYc@2<-i;Xayr&^q>rmj^r-wZ!({6~27A=Ic@
z@t*<ZJWi^rE|lkziTJev=|*avSh0aswVq{>=~Vq8kv^&sGNDC>wbFy8{Kz!g!&;4W
zkr$1Es5R*HWJ#*x6c|~EH|;Bs8%a;YTKBs(_vUcKY!p?CLiO)syYdp($VvF#!yrSi
zJ4sB3G>pn@#g;$lZ88Tniu0DG3~$;Q`6g}eLnM^@ha+qIG&HvVMIXdG6X{24X4Gxe
zU%!sZT|9*Z53IMcd#mf^@7I=hODC$jDJKu)BmIb1O43UD8_z?&sub|T8%L>;`zMI|
zJeab)`R(t_Y{#@e3st@Lqhv1JCpUo!>9z3A4>@iOyKoLIHye3N_8n9BjzmK(pw_B_
zOL;d{jW8<xt~9MtyrAmJ-zwyf?E5yN=1>)eb1aL_*cZs(H`o@nGxsQ#0e#<weixr4
zf4W^tXyBFq(y<t>5Nz}+b;#=QE%#DnBA!I<75oCJ+c!t?i(KGKBP!jPisdZ0uWe<H
z_8;Vni>^nnpsbfX`JO>pmJ>t-Lg*AY?1!Bd-68M%4z#%S{ye;*3-enjCg#D>GPDM)
zsVZW3K7#|>d|A$$S$dpK$T;XcNuM?bh`JECZb2e2>yynq!KM%71}y#x&932!ru8pz
z1Dit+QW%%Un>U$`n~u#zh+q9&Q?GE!aGE6aW@1cp-N)z9*-ghY%Q&=HHhn^aI4pib
z3Zp;@|D=zvuQr5uf5DKqmi1ac5`_c_(`%>Z80n-M4caa8L4gt;;S<yMGron4c3c*S
zNA+H3Pfa7BVs)1Uw`J0gNCS8yYi|xt+Pg}|4`ZFojY@}g{)8{30+0>{fbUx8g+^Oe
zbz2VetSR$6bbcgX{YWyoXIYXvi8|Z<B(SmAK#AO#%lsW|=Sdv%dw^(b9S(uF9}VW^
z4j{$Qi3<#UKHsyGd&+tq#Y`pdL6cRcS=*e`+`j+=Yx$X2rH=n;Tk<V6)sjV>4A5|%
z+{+q(zhVAUi9sJAK4X!QNA~%&uiMfTOel5^kG5YeR}^6+?P#_0z*l=%tf2gE=$?ik
z4TmI7Pp**M&y7@sP*`g$BER}&CyRax1_e^dD|(pJTv#YGG`<`Tls-s}`me<Pz4njj
zq(ln?R-ZvjH4eVHTKduh!-n)_4Q55o-A)l(J#ilY=kA|;sS%Q!?zavl(>u#sEBYvp
z+FL$$k3Z*0!udhffPLM|VIcPv<}z>m+U&V5Bq;Iu^h#!?_)QM-{nl6rRo4?_>D>Ki
z<6CnBMMS1pW{BCcda{7J>MBWQSNKhSHWyh;J^H^j(*SepKQCV}s2k}<hRLp(bhVl6
z<OuktGhV*xM(3o%;jQm43fIIjI2xJ2jgS{<^_q-HWPSn*H8~2EB-7b1aRhd$njhoc
z8oQ!#tn|ZC9Rb%b$7b{3D=CcnxWSTsh_W=^SyO-V>!PE$2L$tnF9G?1j44E*aYT8K
zXc;l4`KKE+t`KUb9SzMC5;U$`iG1pr<&0Mr7ZP_a|DrD<oa0$NHJzwM9IOpa=KNqn
z$o;*#IIZ}%<`)0z1zjC`*<{AAvp^)S>Q$rO`a4lGv(?3*y1!oe%1b-PD4w|8-{lAY
zR>(*2fM5Y?YlA%-lQLnt4)ggjduOE#{Lk(FDR-!@2(8MBMLa>b-Efo=c4A0u<x@vC
zQZ97wUDe=)K=E0DVtOOc=ydV5+4XP{*;#YxHuP1#34s+oy4ZHmddRJ@R;#?c^Uc7K
zSIA${?^Xz&xWC-OU(lZh`dlU&9=&M}*A@S*ErUv`fD-#5Bru4B6eTlqN9{ftYL)vB
zzQTr%fFQD@w{QR+=@FPOAmrnVU8A_akp0?bJv{>I0*cZt^ElE4B9zf(|8Ga{KNWNl
zAw?sZu*w^;Q#HKe`MXXy-k?L`!I)-@%0~YUrT~ll&u|!Af@ywjB*u;8JO3c)YwmUo
z@T%`<7wyAkpi3BM7Wz&XoP->_)u+4V+czXH!2uC2x%A*xJh0*=cs{+s0fkE^xudeM
zmF-KrK#$f2xEUtQ_f9MFHnuMU_+3GybT}U`?XwP)Ibs|0C_N~*hkh<sO5mH9I?Qq>
zVTGBSV84*gb^C%l$=f$!RB?Il#XqoIL7e=AT@WHn4W9n>4~T^7UpTZ42fjI%BI-q0
znN_><*&fIwn}NZFXZb5dY<5BLia`U`_Cu5D9ZoOLWSnU%4=XZ)<*)W$$KsJEs|2la
z$v{S9rs=W?&a2SOTfLyKmqCmqyPMaV<?DeSZh<d4bqH&5-?rKMKBKBQ_0$kg-9ke%
zOEy5Z`VnF=h$C`+593R!@<jJ@q9{@96fy;hLFjY;1!J^@G2FvirE!<7rb8u-y3Z9i
zX5ECv-?>;UU4a)}tvaC&u*$dS%kefFB??a@GT`|t%^^XKYL&zqM|Prt3Pq_=o?M?4
zAo;@b*g+jx(T$Cr9anXLH^$<H(=r=KFu6zeO62{9`TGdXDALvV+peV1I-|n`RX-xc
zl#X+z{5{mnjbAs870s708uRDmen2G8lw1#PN+$MbwOLHXzOf6frYIyEfB$W|ave+~
zmIenQ$S}DYVau|8ti+ll+qa8i(1izDL1G3+ZaK2~Y*UPb>Ys)O1#`Vylb3i#aG;(a
zEZW0x%It94HyVBsCjtRHQ!nIi^d*`rVdPuTSM@d)T>0E8bLMMsFpI6g72Q<BHv-pw
zz>R6&is2ARJU>Xx`fYL!s_`=z!u3TC(OI<-f-*Cp-`1Gb)jdxQ=~~0#x8Ntqv1_zJ
zE0#~9;2TD7Tkx~XL0|>&wo>Kc%eazr-!plxp-ybaBvCBW!w=u&g?lnVE{f>EjNl3-
zyD|6()l^iyt5b4y0(Y9&+m0!CnEOy^3HxY<U6cMTo2#QDECt?yXYkUYJ#Aalj^G)F
zt9BFDcdPx%3PMgJ)Se?csyF9wonR~-B@GFzp?*>$Xp&@CrmF1Axo*!r<l?j8Pjv>T
zt|1dCEQGSn83e{p(|Imi)1G=J3FmG{?6!LWv|lC@sX&pBpvfR|5u0?NLuB$TT3ur`
zk4~vX$J*r$_aRyJ70zZLNH=^^YIM0^EMKq>gWb4VIS(%Cp8U#2;WNZKCDa+dsE3Q4
zzkXpa4;G&bi4x2QC(bOv1UHt8eIFq5_Yg^GOp~tkYAvio?{^yP3^OOs?%OtlZv&yW
znCg?aEMbELPPr*LY^>DGpYyB2&soW8bRvh`=s1-mg~jvyg<p%~Ca$xy<Rc)0S`SIm
ztnN6-q2udv2u;Q8qFych`u$+40!j(=zyE!JI4`&6InD;bg|2T`&IpdPLsw*F^>srG
zb_84Bs&F{tvpGt1D4V)WQV(1>5zGa`s9r!e0T?%CgiUQ&B>fY~9bZp|;Ta=&$My;&
zXBTtlj$+Vy=WufbaU*%<m#DJ7<QV%O-7B&v>BwL(c~!so3+www+0gbigW)CZ!NFi6
zNxu>LD14_@SY_L9rk04(3|`>^%P!>0uEd(?HQU&c5d=F$9L%yawDf56BH*PR9P3^8
zZ%Rcb=<R-4<cFTo-f6!<!SRF0vH1NSVZTcT*;UDt?i*)_g0QSQmHF`quYLoL1U$Xe
z<*Re($w3gM!|;08cnjP>RNH*PzVw54NouZ=iu6XGTtn)7S6al0jRf*J*Y>{q#L!61
z3_$~eMN&RJF*>Ltf_V@d4W1}-pw+t2ve8BgLiIDMY5m;7IOHPAYV&O`yYf=}qm3qZ
zU*2`dVz1C!CmtBKn5u<fNyD)(^#@_k%6JGwalUleWSFf<!#lD6=*QzGtQF4aQx;!t
zxcpx*zlM(v!|yNE9&yqVapfB$-qh66qDrTB0FlUskU?AA_m6iKtZmP@rnAt#v+$4m
z>~+&dd>7%k<S4D!K7$aq*R22POdyEI6+bj-z!!5joKQrnkA6UH+*DqQs4MhAZG(_p
z8mejo_rXJ>=-u3A8WA<P{iY+hZ{J8LzGQj&S*&fDnN1%?2!VRgnVU$dP=MF)LVw_U
zFd0)D{M+N*61SefAMYd~ZM%*(s!R~TnpQMjMq^K&M3ikeOR*5Od&VDk2GaXY2va*1
zAJ@WB($#asvALam5g60J9h#C&|8Dl!ffIbup)9^!1YWE``ttrTS>f`c0(e`cYevaW
zNkmEpWwv(}Y*yNr;L-9=O~bO7$-lnM%UK=RD6YVG3trv`+aS|$m%xQ;md6+8_7y)|
zN?W}?Q+B}8z15Mtd8oPO`txm%Z>wd}vPe$r98F2Bg5=b?xx*O!5Bbyf;IT&FF;h6g
z32O6`0m|&PihAE>GU-W>wS3_S5@2~KUx-X6`U8H2c(n<TZyxe`KB9Xg1=x7JUNd>_
z#Tt3UsZWag6C?cwb&~$mbM`n6eUf0U-=Qx#?NvzVQJXQ}rV&#F2*4VXsxS7Gv#<%&
z$vC|ak3*w7BU+KjPOzvLyLZ)Dj0hwmdoyY^+7Z<w+|nap2N}6H9(U2Oi_D{=VFJ;u
zxp(nW4<tk{d+D2eu)>(gG=rBbu7rU*RI7E(tVo~nakK4x5reHwR~=HIubLHkyAwr`
zAV#{!M-Hcnn431gO}29yJtV5D%6?CP0Bd0Fr85@dd^+|7Qyh{>I9j7NF!az_4po4N
z@Fp+s`P`97>cU0Fq0AAx)J+tk5I9aDKU(J!Y`VyKrW6KxY{r4c#HiMgRuT_#x$`C1
zEge};Ca*C|fk^iac)ULNYcLwas{XHfe@a;+jB&;bJ>{PU%h4^zs5VFmkcj3a7iNm}
z7v6Na_Q`D$?dN7O9e2^Ue2E=v_Hn&FAJ|29gq<%{x1isP<E=(A$g3~-h6pYVn>O7L
z>0exA4rgyEtpC+&I*>ox8T}z^49r(cW6P;N_<MqDO&*R28F(5)`sX0I-{4Vi&XptL
zoY6o?eSN0-RXT2v*fG!-rb@8MnUccrr-k98DQzN8o|C#9UU<TU!98^#c5a&Ys^p*<
zSeKK@1Q(3`eE@>^hH}>mQmS=va*mr?wiyfw7IDQO1R+?!-z#sR^dN`XDB9<wyr_|o
zT~m>zWRTI&`Lf2Js_3z`I~ZjFwRdG(nJU$O(LKkyHD9NduJSUm)X$Kc9XCKc1EmK3
zCMv!to|He+U+D56;aXd0Z(OxIS=TBar#1!;x6UOdWfXqU?*o(RYoN{)l!7#rIODu;
zJvI@}O{eI`QE~%Vr2f`Il~Ma=E2AO|wb+^{q^@if8STww_CK}&-OXtKC_KXXQa}@F
z<Ribf?F8D5A8c|QN4`czcQU|{9i4|f?#A!wz8qMFo3i$rZe;4hNnIpGagN05+d{M{
zvzz1yXw@aGix(9nfC)-^bOyTz4x~9b1T&5NtMa*io0V(A_6(31f*(<Kep3;Owv0(Q
z5ZpNl!BPpq&Y0F~TN=+VsmAHDffsB;p?&py{U4Y_>Toi*7Vu)5A}v>WbU30^KTf;L
zH^8`@D{0-_Z;2ayU#-C|9T+@1uxFH7(eakBytikdEB2aHFDb;Y+)Pm*eYqw@X&;*Q
z!<$_>GN7Oz@!SI?&afvXA~$0vg4mr`C0+l+9%EJt%(5)v{T^U8bY-SNvuD?f)x}lR
z(Sh<OEKN-oLODA4W>>kce@%#Q)Zh5{#yA_BGy`Ti3pX?v2uaR9O|j#N=h>QF;J>(t
zV41(LEN-Tp7KDD_aLXT=Ie3L{gzXitthj1~D4x*6<{mO3*bAZv&kE*x4NDBo^_ZvF
zaUnW(@y*J8tv~}rt~XCt#)!3|{oyI>Lv#>3SaS48B>ElEUtUhyeT>jYz?Pfx2X#2w
zZ-2S=y@JZj<qxVf|4vAhCc{8#oC?K7^L*{+%8at?D}Oe1!$Bb6Sv^_pb|X9?1UeRi
z#R)2x{okRxUop*Ytt4Q<Ma%*moSJj1V1nhEysj;T4Ry%W{@$12bG9!EM)rfe5Swb^
z_ly$%Y**#jP9V<sMsHPv20PLqQP(*757NgYXh;rDJBcV<jStHEtloC#%ZAHeOuQgS
zYs;K6dfSh%{J~J*m68A-+QovH!8amf;jI9sH!wy&mHhF@AqV&&H{X}8k)3FquT4Gs
zSo2V#ihvp7!#7T~(ZL2MMGqqlg&|@C6BJ0CR5QjOx&!!cRmQCEEs=8IdJ_pZD`rps
zz)D=(DGwF)HY+4QZnC-i9&3J`X4x|M_nQ(kyxtv4Im9DPIUL=4?(fe@?~Eq5C;ZY6
zoLQJpGdEyPU(_%!!BQaC#vl%GbtMQ!%ff|{DYFSKsQCY4DVdq}(r(4An7iNw-rY_)
zTHxwRp(seSOu}_bs@>?_JHt$}b}BzENr>yUlWu-_;o&y8%$O?c2s?yvV5o-5lMs${
z`i+Umy@OrBJJ9q`X5Lg?fw?2}A0t=oz(I03Grg@dT_pqTL1OG^jr6oEgYo}^LFH>d
zi~nHIe3XSgH3cgMfz~`yAk2<KpjLJm@0l$ULjg6cdVd$g%VU4ijTQO?<rRg;R{;!K
z0GSj`n+##lg%qY682T~XN`k+M=0J`%+w~tblJRldcvV#%26M>s3noXQieAdl%efPQ
zIjY#Rf8i$qE2SCLi*Tzn+_eHD*(JZ`JWp)fOxfC|vaah60l6Yg=I<DYZH3a`!3{8X
z=XW1Y5i^f~G3JVdMp;GsB3*v*X0|J#6{J%|V@=zMSjYj(?(MZNe})R4q1$W<WWx%k
zT)Dg=k;8-4r9zUx%Cx(NYAfk4H^h0t<L2;F0IWA`tA7cbxXH*!uI$fea;+5L{vH>c
z{59Y}iWkHKU|LP}W#-(O$-&XDs{afdsQvX$q*3?~u}VirFf{9(&Qm|OZ-?stMVATY
zovtim1X|QrpS=Q@-zV+Vw?oQEenjwsO`dT$(_d}95#n@Ky1H%^q0XV%8gi#SFFs&?
zwf}VGmEz~%l7JTQM`&}66z3a;jBknk2dBtLait`A@4W4?Tqr$_ZT0qi<g|P`abnIC
zndd8#Ewgytd{<`ggHa0-+q2=e6bW*Ug|EP@I3H#d5A=bI7`a1h>_6Qb{&vVj?cTjL
zH*<0*kEUqo+@DW)=cQPnN_&p(FV_C9Fg13$3Zbw)Q|1@{7v8sLDgJb*NQB?2;f;Oi
z2!&y;Mmh_!OsMcyVE^swzJC9cGJ^7mYx(ydE}*sf_?Gm`LUuyMA`-X9sAiA=`qog4
zfHt8rM!BQbkMEoA&Q9)HURmGJ+F1rq%_THM#oR+3;r<=pE1)}`5a-G>I{)fj^OBks
zz#Q}{-46wRzc}cIU~Jtop%i>s>EZ*Hf-B_eYEpx@f9peJDN%H|gzcJ)loE&-S(;NJ
z*M@1INS)g!)t22?G-L_puX8_<{g<}761#zPwtv<Cj%aZ5>+rLxf~roG4}FI$#mth^
z0t|0xgVUv*BLaV1Od{;<T_jtvS^7}Hu2me)^~;xn8Po_llnth_aS9GJYZufEmnm68
z;KF!zbLO=5{}n<AwFhpW##U(X&Y?2kGlxEW<`U7jGSfqXH5WBe+)3=e)R{u}UteDC
z|4pW;At|VQ|L@g*@(uSCVS@kDUjBRRS<XR1`d2*v`Bgx@C?Uar1pl9-)hA{6zYCm4
z`epymc<+C{<%GwZ|Eqjq4Zhj#fARR=8>(E2{r|)I{pTr$Xa65p;D5dB|9-E}^F9^C
zBIl|kq35L0@v*TW4_-5o^V2<pSw^$;h_Yb9wR{OWl>F>l99cLm2nF{-a^^gmXZ91>
zciCtO$T_<F&6%+B`@XoR)Aemr&QEWX-XEs5b&P8SWov(U?^ZMWMX>qvW*=bMtb(Hy
z3JZu+H6*WP!kkX(Ie8z(mvibd6M$snZx1CJsEtCF<rJ8u-vf)VlqXmJecXJ;kra7o
zZa(wV=f~nFEL7-3bVLl^Tt=3A^G!Z#Kd<uS^86{8?eH+6j?HCp^B^t3sX={(;QCuX
zbEWyxUCQ0ANk#TrYo~6w3fll{FOoM$6DYGDjafZj2s>SLq#5Q1<9TY8$z2ZjSzZ*O
zhxLdtPpdm$LMLCM+u1|~@L1uA-hNJ2uSO;{V6{v?5|6|E7QdELfZ+jSZ8`ko{$d3A
z1_vOQ=IL}XP5RE6kmnarF((0aqco5Iv=?+oTvu0%C!{=k%6W6JlQV2Nkj%t!I}`;-
z<+jhyUW)%yov1STb;IWvv(B@S4F{HIkQ1KCB4zzKsBN@#s;p8aOP8k{Lwy}YPVPm|
zE~{4m@mEJX{Bif-O`X`d*va1%a%kA6VgM#VUa+H=NV5Hd(rmg|hq`PgFR4>!sYzXu
z*p2cz#-=NpvemBe5C?D^P{xOKTUL;*RbXj}IfJoFkcHoR?J9-@kV|rT>Ef!KZ!EB!
z3E=RUGH$xpa5>x^M^0VBtF>$XxU~uo#C{VzW!)@}EYLP=jH)eLF<b9M#s!>SC789-
zN;=_&3DsGjr%!O{s<XKG?1eE!G3f0t?Y#+ssDwgyk4Uu#;?Ex(#xvAc%@_=CqEidb
zx_v3ZeMieSQeVPN&Tv)Alx<4BH+`D9v2L)mlG~nZz8!hYnEAAv|NH_tUFWhnW32T1
zT`{Ku#b$rpED&aLak^(r=}mEy=Bza`3w(cbcpqJYS0j!z3GWA;9goKNVQ!ahVLBs5
zh9u!$dns4pgqiYQaci1mcJzKo8HXnvZAMEdh)6S*R-R<%@!s3dj4nuGvbLG|3P?Vy
znJ1RZeC)09GIFPM<H$C*S?v|oQXyKN_r!f@MIc{~%fp0cD30bYo!GJs*fN+~isBvN
zIv&u%3leRNM^v&4Z42lvCwFPQcH0$2d3pWqVI<WW5b3nGQSkmbTpv0N_xEjmF|A)?
zJLbadN9t>L>Blrq*vjODKUvO{)je7I%f+zS)J8qXn~=cmOo?wB2e6d%!IOBKOv&T&
zL>W_!Pb^>s0oHclYhw|v>$=jpX}9}}I_u}B;1B$&A>1EM*$hT+`$q)LwU1xpCp-y8
zHCC62KqfEgXbiBvUMI}9Y>9O_Met^r^NL0o4U9<=tXNN~vf8p`1_o9fs$0Xyn;}+^
zt<P(po_$i{YOYqb!zn+O`+sB9Wg<m_Ly3E3VU(wr4rNP#Wm{jKm+)gXd+n?#6B0}x
z!rGfbJYRDRW|^Ii(o{O`C*9V+BSn&WVcr!I44W{Rjw}w`6C7D32x?fSJZ>N34ESMl
z7V(=4;5l$eWXx6vm+@jGCb4!7A3)yQ@7=iM$ILm~i(%GTbWo&Mhg51|>k%C-Iy^xP
zfF>-mNuVNhYWdn9XZCKi1##yKcMftisrBsMx8qG-n23|NE13%&evDDSJ0E*90pz6G
zz0TcTmXMG}A|r>5!&y{yCKGuwWH#_iF3+#eOWzg%pFj@Zqh1quHYxJkI6BkvY}$EU
z3-E&v`Bef$V$PcEX*No2;fxsYV!4<zWon2x2#T+#XgyFDG(MfyjsmH;cshu(qW|dJ
z>V?>B(?>RDIJod;atEGITG)J<dFL9wxYEmHm;G|E{PKWNDERI!PyRz)v+P1ro0)&e
zB%GyCy4B~`#{-1do~gE|1xCa{;5V#}rsjx1Rg?{_v!9CdSxrYWIz#{lE?)ayApUq?
zX)^EmXcUB{;4^5oY@{5~EY}eiAhLYsB?}|ek|RE$+EEnLETHAV%#E6m!-%6YJtm-!
z1j@$W>ceD+<J4QKG~)4jaHuhbI!o>R7%VwavN-lLzrEbv=gANVKO8=ZG6l1Kh4H?6
zh%hDuFi>C5E|;9?xRnfIhE*pN7~pPHCc<5xGmkE!;G~d#8%T~$Li=SnHlo*t;e}|%
z3vZck&3#iY<8{?*dN+{8ywqJ1gopbI(qncyYh(+nwxYaHthTx7g&45)nbjb*_?f$I
z!{UV*u^&{GuIu$TW{WmFm#jIwjAfqzptR9Y!&o_ELn5n|@Zo6t)>y#e0+hD$m{xDw
z$6jds<U+2OqWp2gH0OqgkFAv0wi7h^X-Z=#vp!7=W7^JJ)p5ggmU9n_Ocuajt~FPW
z?_K89$ji!A<<uv=4yAK`Y7ckpw1^G-h`QP@%kv8=MZLQ7J51F*e^_o|L$%-?&=3S@
zaRB5niQ9m}+QHX@#Fz8c`~x+9oJ{Zb=i47=u)}6izwC|fne@5Mp39+5#*M!vIvIpl
zo=#05qrXcVhEwV<HW*#CE!7HYT#hM>49u%1KAx}1XN|ibtUX}av?UKG-)~EfozYL`
zVnh(tQjB|y;trrK{HjZG`{lV)p`OM&Y}Jn2x7dq0u>!uyA56T!igo{s8e4#FrCy(K
zkbO|XJ*ieVmlE9NOue7=E@n#)?L;(XVsq>&yt){IeqX`IV;N?H@COHL;~$_scS?kR
ztA1Hd*bmd{(_Xu|%1LU$&yMS}ZT$iDf@FoRv7S<ZuAkLNolt$MqA%}u5=??A`_|ry
z4tAOOHZQ?a2)|Zsyxd27<I|oxp>cZ*f*La#uNH0u_m}i?(d(_l79<vE@>S=3#3-S7
zIO7AHm(%WSxO%<v!TYqv4r&~3V>Kicl7L<6`Mcz^-Cb1&cGwlbVfCd~RfMf)33`oV
zcV><lGkhFE3Ry%bPMK5Pc-ct80iG5by`Q$y1Fe2ge52BNX_Mdb|J@fwPXu7B$R^sT
z41)V>8M&M_qR|H`V54ro8t4NacsHBs{*g458d7s-%b?_leNhldDdOd7t&V-bRd4ZE
zd1FWW03|0m5cxmsvuuq9NG3_Iuxk^HYb+i>0Y!0e5{jP_XBRr&j=2+k&R;Bc^v>1>
zDrfmPGh1lrQb+pKAE9fEF`t+ZI1Ln-0A|#4vA@;hy;^!ziYm>=?1qsd`(%P{TunT9
zRfvi8wN3Z%Qm`xg=p>XPcJ<Em@c3OXt4dDt81MDs9XV<&swu*&PxETEcpWxR(|qiI
z^!IdFnCa_s)Ld)zyFz6=pZ+yW&Fd9tR_?@E*L^In;iWS##zWO-meQzox|cU2l3m!{
z5By-AloZnn9`B@Jbpbj|F@L>wCj%-u*uH(p`8e~yyIyR0IO2q9tmmyl8>CpZTjPy!
zml>9l=UH7R)={{<Epg$rK8UM4FyY7I0vh)@@7?#R5>4KhW~#GqmaN9S25@BImtT*P
zu`Lt5DAUTvwUh3~OO0jyMn*htG*3(Kr!!@(R`y@a2eucm*EncyJWd?NUF>(kYi%*^
z=XTz4&MM0TLKr&gTS^Qz3~j!I={~g)rn_H^nxg7ARQ(<qdHESwWUz94A~mq>eXe^*
z(>6HblmDsC3zir!e(|lv+?f#iCu1Z7=bo!#nwoH5{`y{h<g>c$)NW${65tXe)Ina2
zg)A-(jyABv^8Bew_1Z+ei*LldybggeK7XY#RkCPK&HoTBd=Ia$@^km<T&Df{5^05w
z!>5v*89uGfKclHkzWy@T$rhlU#aRpW*TudxM<RCv^MQ5T>M_T&@N@T04h`oR)*67p
zdCN(r*Ml>=gVJlV`Xse%3Klo@3o!<n%MYuqA%P5~pZrPEnp?7MVWrcrjoGFKu!hKR
z#A+GtUN5Vl%$lN~`ctW$$9&w^Eh-bR3=UpgW>%Hr^mKX&Dl9UZNz$#kogy6D1lpsk
zNuxL;umWDZIwQ*OnX{7(&z8n}^`TdA*LwaR<Ho1&cIYb$clLL;R`bAnA=-Yz2+N{u
zR}LeCc7w?gYdpE7q;W^&@Qc=6CIC?V_MV30`+DKyfUllzJ4%Dw$=GU-Lh?|y=0F6w
z;pS`V{Le4GDrsEqOYk3zI_|8h-#iCOtHw5n7HIgQtTlNWFG>L8x-xST8J(Hsj1~+c
z$5R$Id~Nl|Qd(gwSvG>$Y4#3lefvN9eRAx}PLT4&3N1(Z+>ONG_+Qs3bx(847d}jc
z#6bGqWa1ZM*GTnv>~#5ty2$u>Oz-motDFrl^p*0Om)g<2LySo-atOuSz({p{%w&mz
zKpom0lHzOj=#?QJ8VG2FE6LpfeNgck;XmnYj>}~O1!K&EGuoLlqNj0UaD{nrpH-N;
zs%>Rt<;xGj@q{@?_2;N1oF+q*MziTn=E^<ITE8fZ7`Gion$4M}pq?tf+$p)EjY@sS
z)s@GSy>dUWl0U0YJFxY+y_eUynnyc$*Z_Kh_743s46*ey!VkgkgAryxAFg^JdD1kJ
z(a#3DxFd!T(bgz$ob->AI%2zhAyS8F{)oN~tF94^>no06CzA~7&yE#*ksX(#P!LqP
z=B{qz`g3584pZj7q)~hB%0-Dr=NOn#!?|d;_*Zl!%=XTwCD(j!uSVuZKd`kECffBW
z%Wj=uvS`A$8a}cW>En1v-wsQ#cJpYaQO3$!)Cej({rwAeyTjd+oK;ly=h_;>0N$3#
zd~VF>@W&D~liLDU#VS4&KJF^aXzEn$;kN&A(Nvs9SqSq{?7f`V-3c4h&U{v9R(c|a
z*UsjH|LX5s7>i}gl5BGhqgD5uHio4FJNmRV{fRXf<E3;P>3ZHf&xY9u-Pc-iUAvUp
zDD-HoI8Z{NvYr-GcAdICn5&1KopyfU#zd?ddi85SvGd}5@s`1`UJer<3%vck0~XoB
z-Hqa-0&lYE#Tk{Tnn)q&P$71rGGo1{Bh06<gdQTWA#NdSh2?xov>F#3r)y-iT_AG@
zY#_g4ZWmOq`+N7&81>}WQ6mRKU3BZmn8$qa24gba`|_~YijN-uRzFhK>NU>e81)%p
zDQ||LINgx0RWsP#ex|}W9R-`al{(S5;5Zscr@`v&>5phw@G{Yx(P`Iu`*XyrfeHoP
znXccpR^_{=`;Al)ptdD^6(y&^7K%7Z{b`8~!+8pUmWF5y4nr=2E=K<vJ&(;`XU}8;
zpBogz(vXXK^JZB<(ls5~G1G8UmqpB;b=TRObM!~JvvXlgn^au?O3tjiW)3(M+xQA%
z)^?LW*gX79=JXJ*_%M<ll==c3XfGgAW<UwG&vFv&1#f*NGV)7e+`t_AIA|HQgr&_4
zV1+50Jr@3WabN*q2HE{m-?+jf7^w79i)n|hXOC{!2mBlKTz^8C+I#iGP)vIoRuq0S
zmEP6%3Iy?5-0jaJ`hxv~(qo>yzrKb$nWB9cog04}@3nsZ<v)q49#9QWsAXb{|7sPr
zbbElYlJ)FD$YnQvqI*1d+R5K`R5vDc>wf!l#j<cJPQ46AZ;FyAb75&@uG8%$a)PT;
zzibTK@Vn>a7`rZqs$xDKi(~sGPU;Y1FaG?|>t2K>soO@Hyw$H{AaDCF&oFsdqS5kg
zFs`qeZ_$@(I$G4`_$`Wp;;F*SEb=G<+QP!y;yr|4mNJ=?Wi*MnE<9L-+FTFu84>f~
zzFu$RcU`tH0yJKJ49v%~Ew}=aff=ycQ^0wH&M|tjdNB6kEoomMx*a8&Y9Vs(Kx+qe
z>^Y_EF^wgg5gT|TuPqs!ah5)}XPw>euoG5W3BmhTa&(Pu@wnVw$xQyNaB2BtZu=p_
zV#m@nxXC`El}o4DW@Fu9fg%AZm>Tu)^fvmA-GkJ8d>%?VVPUXAq5X}92z~suuZ;(Y
zDYtjJh+sN3DGjE_Yzd@D2aESJ5PSpf`Z|*iL!oKSqsy4_exGZ{c`2OaoDlYvCwkWS
z4IIZ!-xJc~t!Pql@d1oMf*X}oa9DCK+bMG@t?%r;t#`g$8z0-X7Yetog$lK_lGDl6
zOQnuRd7>jz%*)@aZ?%r6(XzY=;#s}jT7znt_Ecpf`pBx9lB#dJ_Oy3`6}-%RH`c3w
z5-<Cw8TS*S8Tn)jLt6btHtG5J3vrVmQ$#)_%~RU2Txdt!nf(&n)3s9*qqo@W+JDA3
z?8B(ERae(8n=!OtzI69${F{0!sz~NpoL-2tuV}aRB-g0|`d-j1Bk#>cHP8PlQbhHD
zTKHc12+j;Fni@K0uv6MX>r!9&sxz%WxG&ZF<aGam>HB(haOYT#)zh3p9(9#kO!6jc
zt{=0+Z>RGbOGnYZ4?9_V+q+xVDNC_!cVX)>rd<jXjCTd2XFz+=ZEkz<1u_343OIUE
zyLnHAr>1&Cy7F*~*SoM87p#8b(|y+R9Q49Hq?z_?z_o}Afs{xZ@Y9R3XPWB+5ZY~X
zd;TMKWJW3u$B`Lbk^dQ7M5^796%PE3*DWp1>@>@*xt{goc{s$A)~BMwXIFzCukA|0
z38tM?<>qpBTnKKdLx{WmbokIwr3M`6gM4)|XpMh+y8CCg3WjHX_x_Xr`Tpx+VM%5G
z1G9p*{=okQfHK+c@LcfmBVp58O6%%cG$|t<(WBEHR8zxI_5;k7NB@Y>#Uu_FU(h14
z&ZMuaAgN{%Jv*C1Wu_?GoLyx@$e9}paUjx8_3<mb+Zrib%V()Toe55Bb<@7ZP_fmA
zEKexe$8fr>>v2keyF8*ug>Y|HHJhNeDjLs$;Nf~jGEr{_5|oh-{)W}iHDBp*g;H~-
z(d0-CbH($9F6iyW$&49iE2e61g?xD0#fI^CW&UDn7+#w6p>}BoTO4t(rVWN`dvmE;
zoA9j>;&3EZbsiI0h#)yK5#Wxwe$m}pe>8)V+L}aMnkDjIr65RmIuRa=_IfwaSVvbJ
zmP$5j$HP@;No-|8cZ{vY;Xn4ErIRMK(MyE01^12=H!Hh^yM(MktNk^n{Es%U^vs>6
zh3hxI5pJyZ-X!S_l@#hxX+=nBGfU~zCM`rT#jsa;a-2*k@lg?X=y=RM_X2Cr@R3Sk
zC}fu-m|PBSAE<Tocn*HLE}Y>%=!DB*pYk6=4<UQjY$_^ml{AH~*QnR-U5?%2trd-X
z4wIU$4X)(UZ`ytdv|A9?^}=-Am_PRgopr_Jq1_N=uD<D~Lk|gd8h2l@e7syg5@lgZ
zvSkt8Y*~S($_{K9xy#Gv7k%y{6qY)<F6VpYy4M@;$}XZD4U>{iBk8mp4>pz>$e(*3
z%))J6Pqw44r>iP_CbshUZ)EC}CoTktQq*(Fc63_h@V7F6p1n)X7GANdvii*YoVIJL
zaUV}iFKiko4?WSa6~Dg%Oan}Ggq-m+s9!INVDSBv%3{{Go`{KMu(+ds<A1oxI-QSJ
zB+GHXG!k=~h@tCFN^a<k{x(rXS<|vnom^0Dd!DP?kbJ#)Du~ABvgUCl=S%{Y;%*Yw
zyPq#_|I+ea{OzPU6XezDB_AQ=UrX?s)=HT6vh_|OjM-qNzANb@xKXdv?5HnQYM|e$
z{sw2YA3|%s;Q4n&KIV4eR}m4pgh1+kJUvWgfGOL_&q;#5Jk9fhf{QbPcAN3589^cI
z_SlP$>pEZyy`3kESy6y2*yx|?PowSgmpKLD#m3KwH>m?j9|9N{iOH4aQ`VCnXW4?@
zR5Fwt+L~YA@Q$W!Gk8>AgWIBfc)P@P_z5veK$&>BAzjeza=#81DnDL~-&V5NyDFYW
zm`v3}fZD8~4Z5!v>UXvo9qvN%_N5CBeY1uW=FFaty#=esNB-M4)+9-LYpYc(*3Xh*
zNav2)zc%$c0D0Z--(`*>|70>~ioe4fXX;(g?ZxQ7xj#1Yjvx=Vba2~DeGd*H7UGMh
z;17JpD}JIpw93)K@U?jZP0*sakk!fUS!Lj*pjYPq42PaKVYqpI*LHPSoe&y)^%U1G
ztL}|?A||XdP9N>4a+F<-9`+%4zY9}^xhQGN^m)tUL7XdEU&bsbNyO8%sW56ua&Q3`
zfO#-q&R1;|20+)_4+}It7EIxXg_q*d(R^Y;i}_Hq7N0q6y7Gg1#gE7{{4^H~4B|mr
zO!y~O8?x?DBqC3PkyM2rlS0ZtVz132t=i>y2ATEo?TdZy@ML_CI-~KrP_6Ax!v4IA
znq+u&z+5;>qPNFI>~G9DFCeb7UxF|<=jBxEzT3h<kqv^(<hOyE3&LmjkdM691&n$a
z=C=pSt=0`(z|zBnwdaL+rLvb$^M`g32gAisev3(#^7bM?o5~|xRz*grf1_g#n>1WN
zW2!q@(*J6laYM(0mp6)KK-m^bZ<zI&_AOnu^}!{`_>)kg+PZ#@@pc5O!D|<KyOGn#
z;crH+e0^D4#2WWBDJH3@UoKI6WhymFcRw37HOvxFf3#^<F9Le=62$6ci+OLKy%9Ik
zz4bXaD{P3v^whvL4C=kQiA}ZNa^3}bHov&*G<1DZ_X()PE`}q!&@%A!hn%|smyhhh
zqc-_fdQgai^bWU@Y+w!Gq8+RFv2@=C9P=j1eHy(ScGfo?#Er^7_lZ8dSr%t|)dIZ*
z@nVbVaKfqX){i2bTIQo=rx$caSje>#PB-Jdu~j){hc<!YZRIo*cZ<<|8snMjR+j@2
zGPA9W`IVw!NBEH&;q=kpgx&`_hzA;-O9lkZ%`*{qS<~Dry?q#18#lw2N0ZYA)sPqo
zsqc)3>2CE?)E6Ea^+Hux1~jyW&L{Ls3tYACI5ckX=NFV&=DiMC2uI#p6_y^BG;A0x
zf3%_9uv(n3j#u~B*>KIsR8ldN#@MuX%erjHO<|^6?H=9D=+U&8H{)3vSJa0d!F>|A
z88fW9`~D}AoZf<k6~S%G9w{0eWCgKPwWf`Df0t8!ZOuA)s0}|fBxb&t5`Rw9IL(E%
zsR7KuO@Wv4NMi<v8G60K2Wf_@OmXGkKV6qGD5Qj^L)gi@r1hsCN-CeE$)`iMDQKmB
z21}7zO8fTstb&XOY9f6m2Q*t)hP|FY>~%++7ZRPFSq^?+A8$s(<!3*^q2-fUh~dR_
z<TD@1u7Q6Rm&+{;hc+ju4Cbqw2djM{Zs#+mew~-V9o!HG8h~OtKDXF+x-SNPr~5Rq
zpqGmF%SW{kdq&G=o_qc0%pn$oA`^@IDbLJAHb9+bI8+MC4}$_q`m>@WUa-?i>||2p
lpBevW#qa<BCk)*m;Oji$6RsZ{%V3{LTKtC?NW{SJ{{aH}#isxO

literal 0
HcmV?d00001

diff --git a/doc/source/development.rst b/doc/source/development.rst
new file mode 100644
index 0000000000..776ac6cb64
--- /dev/null
+++ b/doc/source/development.rst
@@ -0,0 +1,140 @@
+==========================
+ Developing with Devstack
+==========================
+
+Now that you have your nifty DevStack up and running, what can you do
+with it?
+
+Inspecting Services
+===================
+
+By default most services in DevStack are running in a `screen
+<https://www.gnu.org/software/screen/manual/screen.html>`_
+session.
+
+.. code-block:: bash
+
+   os3:~> screen -list
+   There is a screen on:
+        28994.stack	(08/10/2016 09:01:33 PM)	(Detached)
+   1 Socket in /var/run/screen/S-sdague.
+
+You can attach to this screen session using ``screen -r`` which gives
+you a view of the services in action.
+
+.. image:: assets/images/screen_session_1.png
+   :width: 100%
+
+Basic Screen Commands
+---------------------
+
+The following minimal commands will be useful to using screen:
+
+* ``ctrl-a n`` - go to next window. Next is assumed to be right of
+  current window.
+* ``ctrl-a p`` - go to previous window. Previous is assumed to be left
+  of current window.
+* ``ctrl-a [`` - entry copy/scrollback mode. This allows you to
+  navigate back through the logs with the up arrow.
+* ``ctrl-a d`` - detach from screen. Gets you back to a normal
+  terminal, while leaving everything running.
+
+For more about using screen, see the excellent `screen manual
+<https://www.gnu.org/software/screen/manual/screen.html>`_.
+
+Patching a Service
+==================
+
+If you want to make a quick change to a running service the easiest
+way to do this is:
+
+* attach to screen
+* navigate to the window in question
+* ``ctrl-c`` to kill the service
+* make appropriate changes to the code
+* ``up arrow`` in the screen window to display the command used to run
+  that service
+* ``enter`` to restart the service
+
+This works for services, except those running under Apache (currently
+just ``keystone`` by default).
+
+.. warning::
+
+   All changes you are making are in checked out git trees that
+   DevStack thinks it has full control over. Uncommitted work, or
+   work committed to the master branch, may be overwritten during
+   subsequent DevStack runs.
+
+Testing a Patch Series
+======================
+
+When testing a larger set of patches, or patches that will impact more
+than one service within a project, it is often less confusing to use
+custom git locations, and make all your changes in a dedicated git
+tree.
+
+In your ``local.conf`` you can add ``**_REPO``, ``**_BRANCH`` for most projects
+to use a custom git tree instead of the default upstream ones.
+
+For instance:
+
+.. code-block:: bash
+
+   [[local|localrc]]
+   NOVA_REPO=/home/sdague/nova
+   NOVA_BRANCH=fold_disk_config
+
+Will use a custom git tree and branch when doing any devstack
+operations, such as ``stack.sh``.
+
+When testing complicated changes committing to these trees, then doing
+``./unstack.sh && ./stack.sh`` is often a valuable way to
+iterate. This does take longer per iteration than direct patching, as
+the whole devstack needs to rebuild.
+
+You can use this same approach to test patches that are up for review
+in gerrit by using the ref name that gerrit assigns to each change.
+
+.. code-block:: bash
+
+   [[local|localrc]]
+   NOVA_BRANCH=refs/changes/10/353710/1
+
+
+Testing Changes to Apache Based Services
+========================================
+
+When testing changes to Apache based services, such as ``keystone``,
+you can either use the Testing a Patch Series approach above, or make
+changes in the code tree and issue an apache restart.
+
+
+Testing Changes to Libraries
+============================
+
+When testing changes to libraries consumed by OpenStack services (such
+as oslo or any of the python-fooclient libraries) things are a little
+more complicated. By default we only test with released versions of
+these libraries that are on pypi.
+
+You must first override this with the setting ``LIBS_FROM_GIT``. This
+will enable your DevStack with the git version of that library instead
+of the released version.
+
+After that point you can also specify ``**_REPO``, ``**_BRANCH`` to use
+your changes instead of just upstream master.
+
+.. code-block:: bash
+
+   [[local|localrc]]
+   LIBS_FROM_GIT=oslo.policy
+   OSLOPOLICY_REPO=/home/sdague/oslo.policy
+   OSLOPOLICY_BRANCH=better_exception
+
+Because libraries are used by many services, library changes really
+need to go through a full ``./unstack.sh && ./stack.sh`` to see your
+changes in action.
+
+To figure out the repo / branch names for every library that's
+supported, you'll need to read the devstack source.
diff --git a/doc/source/index.rst b/doc/source/index.rst
index c1302eb930..d89637e796 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -113,6 +113,9 @@ You can ``source openrc`` in your shell, and then use the
 You can ``cd /opt/stack/tempest`` and run tempest tests that have
 been configured to work with your devstack.
 
+You can :doc:`make code changes to OpenStack and validate them
+<development>`.
+
 Going further
 -------------
 
diff --git a/doc/source/site-map.rst b/doc/source/site-map.rst
index 480d6aaf5e..74b944b5e1 100644
--- a/doc/source/site-map.rst
+++ b/doc/source/site-map.rst
@@ -17,5 +17,6 @@
    plugins
    plugin-registry
    faq
+   development
    hacking
    guides

From 3d5f03abe515009aea34599c0e5b0d541afcac0a Mon Sep 17 00:00:00 2001
From: Andrey Pavlov <andrey-mp@yandex.ru>
Date: Wed, 10 Aug 2016 12:46:50 +0300
Subject: [PATCH 0560/2409] fix nova's fake virt driver plugin

nova's config was changed -
now virt driver parameter needs not full path for virt driver

Change-Id: I2a32b4dee3f27efc78bd1e546a96cfbc1225b8b5
---
 lib/nova_plugins/hypervisor-fake | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova_plugins/hypervisor-fake b/lib/nova_plugins/hypervisor-fake
index 2434dce884..6ac219961e 100644
--- a/lib/nova_plugins/hypervisor-fake
+++ b/lib/nova_plugins/hypervisor-fake
@@ -36,7 +36,7 @@ function cleanup_nova_hypervisor {
 
 # configure_nova_hypervisor - Set config files, create data dirs, etc
 function configure_nova_hypervisor {
-    iniset $NOVA_CONF DEFAULT compute_driver "nova.virt.fake.FakeDriver"
+    iniset $NOVA_CONF DEFAULT compute_driver "fake.FakeDriver"
     # Disable arbitrary limits
     iniset $NOVA_CONF DEFAULT quota_instances -1
     iniset $NOVA_CONF DEFAULT quota_cores -1

From bc883df1c23fab66f681f2c4fe9c0d3affadc671 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Fri, 12 Aug 2016 07:21:59 -0400
Subject: [PATCH 0561/2409] add networking write up for devstack

This explains the current state of networking in devstack, and a
couple of scenarios that people might want to try out for local
testing.

Change-Id: I2be35f4345bf9306c981ef6f0186b48da7d06772
---
 doc/source/index.rst      |  3 +-
 doc/source/networking.rst | 97 +++++++++++++++++++++++++++++++++++++++
 doc/source/site-map.rst   |  1 +
 3 files changed, 100 insertions(+), 1 deletion(-)
 create mode 100644 doc/source/networking.rst

diff --git a/doc/source/index.rst b/doc/source/index.rst
index d89637e796..435011bb96 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -120,7 +120,8 @@ Going further
 -------------
 
 Learn more about our :doc:`configuration system <configuration>` to
-customize devstack for your needs.
+customize devstack for your needs. Including making adjustments to the
+default :doc:`networking <networking>`.
 
 Read :doc:`guides <guides>` for specific setups people have (note:
 guides are point in time contributions, and may not always be kept
diff --git a/doc/source/networking.rst b/doc/source/networking.rst
new file mode 100644
index 0000000000..1d56c3367e
--- /dev/null
+++ b/doc/source/networking.rst
@@ -0,0 +1,97 @@
+=====================
+ DevStack Networking
+=====================
+
+An important part of the DevStack experience is networking that works
+by default for created guests. This might not be optimal for your
+particular testing environment, so this document tries it's best to
+explain what's going on.
+
+Defaults
+========
+
+If you don't specify any configuration you will get the following:
+
+* neutron (including l3 with openvswitch)
+* private project networks for each openstack project
+* a floating ip range of 172.24.4.0/24 with the gateway of 172.24.4.1
+* the demo project configured with fixed ips on 10.0.0.0/24
+* a ``br-ex`` interface controlled by neutron for all it's networking
+  (this is not connected to any physical interfaces).
+* DNS resolution for guests based on the resolv.conf for you host
+* an ip masq rule that allows created guests to route out
+
+This creates an environment which is isolated to the single
+host. Guests can get to the external network for package
+updates. Tempest tests will work in this environment.
+
+.. note::
+
+   By default all OpenStack environments have security group rules
+   which block all inbound packets to guests. If you want to be able
+   to ssh / ping your created guests you should run the following.
+
+   .. code-block:: bash
+
+      openstack security group rule create --proto icmp --dst-port 0 default
+      openstack security group rule create --proto tcp --dst-port 22 default
+
+Locally Accessible Guests
+=========================
+
+If you want to make you guests accessible other machines on your
+network, we have to connect ``br-ex`` to a physical interface.
+
+Dedicated Guest Interface
+-------------------------
+
+If you have 2 or more interfaces on your devstack server, you can
+allocate an interface to neutron to fully manage. This **should not**
+be the same interface you use to ssh into the devstack server itself.
+
+This is done by setting with the ``PUBLIC_INTERFACE`` attribute.
+
+.. code-block:: bash
+
+   [[local|localrc]]
+   PUBLIC_INTERFACE=eth1
+
+That will put all layer 2 traffic from your guests onto the main
+network. When running in this mode the ip masq rule is **not** added
+in your devstack, you are responsible for making routing work on your
+local network.
+
+Shared Guest Interface
+----------------------
+
+.. warning::
+
+   This is not a recommended configuration. Because of interactions
+   between ovs and bridging, if you reboot your box with active
+   networking you may loose network connectivity to your system.
+
+If you need your guests accessible on the network, but only have 1
+interface (using something like a NUC), you can share your one
+network. But in order for this to work you need to manually set a lot
+of addresses, and have them all exactly correct.
+
+.. code-block:: bash
+
+   [[local|localrc]]
+   PUBLIC_INTERFACE=eth0
+   HOST_IP=10.42.0.52
+   FLOATING_RANGE=10.42.0.52/24
+   PUBLIC_NETWORK_GATEWAY=10.42.0.1
+   Q_FLOATING_ALLOCATION_POOL=start=10.42.0.250,end=10.42.0.254
+
+In order for this scenario to work the floating ip network must match
+the default networking on your server. This breaks HOST_IP detection,
+as we exclude the floating range by default, so you have to specify
+that manually.
+
+The ``PUBLIC_NETWORK_GATEWAY`` is the gateway that server would normally
+use to get off the network. ``Q_FLOATING_ALLOCATION_POOL`` controls
+the range of floating ips that will be handed out. As we are sharing
+your existing network, you'll want to give it a slice that your local
+dhcp server is not allocating. Otherwise you could easily have
+conflicting ip addresses, and cause havoc with your local network.
diff --git a/doc/source/site-map.rst b/doc/source/site-map.rst
index 74b944b5e1..801fc66b80 100644
--- a/doc/source/site-map.rst
+++ b/doc/source/site-map.rst
@@ -14,6 +14,7 @@
 
    overview
    configuration
+   networking
    plugins
    plugin-registry
    faq

From b1a4f34bfc6adb9ab4577520601c44e8ccff277d Mon Sep 17 00:00:00 2001
From: Andrew Laski <andrew@lascii.com>
Date: Fri, 27 May 2016 15:23:54 -0400
Subject: [PATCH 0562/2409] Setup cellsv2 for Nova

Run "nova-manage cell_v2 simple_cell_setup --transport_url ..." after
Nova is started. This will add all compute hosts into a new cell, and
setup a db for cell0.

Change-Id: I50a955b97d0e18426406c15397bdfbc9e807d908
Depends-On: I559f9c87e89926414b368cac9442dec4eadcb89b
---
 lib/nova | 5 +++++
 stack.sh | 1 +
 2 files changed, 6 insertions(+)

diff --git a/lib/nova b/lib/nova
index af5d1222a0..4c079f46b9 100644
--- a/lib/nova
+++ b/lib/nova
@@ -937,6 +937,11 @@ function create_flavors {
     fi
 }
 
+# create_cell(): Group the available hosts into a cell
+function create_cell {
+    nova-manage cell_v2 simple_cell_setup --transport-url $(get_transport_url)
+}
+
 # Restore xtrace
 $_XTRACE_LIB_NOVA
 
diff --git a/stack.sh b/stack.sh
index 68e3d936b8..948475a270 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1263,6 +1263,7 @@ if is_service_enabled nova; then
     echo_summary "Starting Nova"
     start_nova
     create_flavors
+    create_cell
 fi
 if is_service_enabled cinder; then
     echo_summary "Starting Cinder"

From 06f3639a70dc5884107a4045bef5a9de1fb725a5 Mon Sep 17 00:00:00 2001
From: Dean Troyer <dtroyer@gmail.com>
Date: Fri, 12 Aug 2016 09:35:42 -0500
Subject: [PATCH 0563/2409] Add os-client-config and osc-lib from source

There is currently a hole in our testing that lets os-client-config,
which sits at the bottom of the dependency chain for some key pieces
like neutronclient and python-openstackclient, introduce gate breakages.
Step one in fixing this is allowing os-client-config to be optionally
installed from source so that jobs can be put into its gate to exercise
its master vs devstack installs.

Additionally, osc-lib is a new and lovely library that's going to need
the same things.

We're putting both in install_oslo, even though they're not oslo
libraries, because that'll make grenade work properly.

Co-Authored-By: Monty Taylor <mordred@inaugust.com>
Change-Id: I747480b6063a62e82ca2b030f274d3e87bf28b3b
---
 lib/oslo                     | 4 ++++
 stackrc                      | 9 +++++++++
 tests/test_libs_from_pypi.sh | 4 ++--
 3 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/lib/oslo b/lib/oslo
index 1773da2975..e34e48ad03 100644
--- a/lib/oslo
+++ b/lib/oslo
@@ -26,6 +26,8 @@ GITDIR["automaton"]=$DEST/automaton
 GITDIR["cliff"]=$DEST/cliff
 GITDIR["debtcollector"]=$DEST/debtcollector
 GITDIR["futurist"]=$DEST/futurist
+GITDIR["os-client-config"]=$DEST/os-client-config
+GITDIR["osc-lib"]=$DEST/osc-lib
 GITDIR["oslo.cache"]=$DEST/oslo.cache
 GITDIR["oslo.concurrency"]=$DEST/oslo.concurrency
 GITDIR["oslo.config"]=$DEST/oslo.config
@@ -71,6 +73,8 @@ function install_oslo {
     _do_install_oslo_lib "cliff"
     _do_install_oslo_lib "debtcollector"
     _do_install_oslo_lib "futurist"
+    _do_install_oslo_lib "osc-lib"
+    _do_install_oslo_lib "os-client-config"
     _do_install_oslo_lib "oslo.cache"
     _do_install_oslo_lib "oslo.concurrency"
     _do_install_oslo_lib "oslo.config"
diff --git a/stackrc b/stackrc
index 4fefe8da30..bfb897b338 100644
--- a/stackrc
+++ b/stackrc
@@ -508,10 +508,19 @@ GITDIR["ceilometermiddleware"]=$DEST/ceilometermiddleware
 GITREPO["os-brick"]=${OS_BRICK_REPO:-${GIT_BASE}/openstack/os-brick.git}
 GITBRANCH["os-brick"]=${OS_BRICK_BRANCH:-master}
 
+# os-client-config to manage clouds.yaml and friends
+GITREPO["os-client-config"]=${OS_CLIENT_CONFIG_REPO:-${GIT_BASE}/openstack/os-client-config.git}
+GITBRANCH["os-client-config"]=${OS_CLIENT_CONFIG_BRANCH:-master}
+GITDIR["os-client-config"]=$DEST/os-client-config
+
 # os-vif library to communicate between Neutron to Nova
 GITREPO["os-vif"]=${OS_VIF_REPO:-${GIT_BASE}/openstack/os-vif.git}
 GITBRANCH["os-vif"]=${OS_VIF_BRANCH:-master}
 
+# osc-lib OpenStackClient common lib
+GITREPO["osc-lib"]=${OSC_LIB_REPO:-${GIT_BASE}/openstack/osc-lib.git}
+GITBRANCH["osc-lib"]=${OSC_LIB_BRANCH:-master}
+
 # ironic common lib
 GITREPO["ironic-lib"]=${IRONIC_LIB_REPO:-${GIT_BASE}/openstack/ironic-lib.git}
 GITBRANCH["ironic-lib"]=${IRONIC_LIB_BRANCH:-master}
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index bb58088ef3..fb55023886 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -36,8 +36,8 @@ ALL_LIBS+=" oslo.messaging oslo.log cliff python-heatclient stevedore"
 ALL_LIBS+=" python-cinderclient glance_store oslo.concurrency oslo.db"
 ALL_LIBS+=" oslo.versionedobjects oslo.vmware keystonemiddleware"
 ALL_LIBS+=" oslo.serialization django_openstack_auth"
-ALL_LIBS+=" python-openstackclient oslo.rootwrap oslo.i18n"
-ALL_LIBS+=" oslo.utils python-swiftclient"
+ALL_LIBS+=" python-openstackclient osc-lib os-client-config oslo.rootwrap"
+ALL_LIBS+=" oslo.i18n oslo.utils python-swiftclient"
 ALL_LIBS+=" python-neutronclient tooz ceilometermiddleware oslo.policy"
 ALL_LIBS+=" debtcollector os-brick automaton futurist oslo.service"
 ALL_LIBS+=" oslo.cache oslo.reports osprofiler"

From 14b12a74f6a258b6e97dbf85b0ccfd74028b83b0 Mon Sep 17 00:00:00 2001
From: Armando Migliaccio <armamig@gmail.com>
Date: Fri, 12 Aug 2016 19:07:12 -0700
Subject: [PATCH 0564/2409] Remove stale config l3|dhcp_agent_manager options

There is no longer a trace of these options anywhere in the
Neutron codebase. These can be safely removed.

Change-Id: Ibf00e158248e2a20248917c8cfc0011d30da6a82
---
 lib/neutron_plugins/linuxbridge_agent | 3 +--
 lib/neutron_plugins/openvswitch_agent | 3 +--
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/lib/neutron_plugins/linuxbridge_agent b/lib/neutron_plugins/linuxbridge_agent
index 0a066354ca..67d0405c23 100644
--- a/lib/neutron_plugins/linuxbridge_agent
+++ b/lib/neutron_plugins/linuxbridge_agent
@@ -44,14 +44,13 @@ function neutron_plugin_configure_debug_command {
 
 function neutron_plugin_configure_dhcp_agent {
     local conf_file=$1
-    iniset $conf_file DEFAULT dhcp_agent_manager neutron.agent.dhcp_agent.DhcpAgentWithStateReport
+    :
 }
 
 function neutron_plugin_configure_l3_agent {
     local conf_file=$1
     sudo brctl addbr $PUBLIC_BRIDGE
     iniset $conf_file DEFAULT external_network_bridge
-    iniset $conf_file DEFAULT l3_agent_manager neutron.agent.l3_agent.L3NATAgentWithStateReport
 }
 
 function neutron_plugin_configure_plugin_agent {
diff --git a/lib/neutron_plugins/openvswitch_agent b/lib/neutron_plugins/openvswitch_agent
index 69e38f4df1..02eebe1bfd 100644
--- a/lib/neutron_plugins/openvswitch_agent
+++ b/lib/neutron_plugins/openvswitch_agent
@@ -29,13 +29,12 @@ function neutron_plugin_configure_debug_command {
 
 function neutron_plugin_configure_dhcp_agent {
     local conf_file=$1
-    iniset $conf_file DEFAULT dhcp_agent_manager neutron.agent.dhcp_agent.DhcpAgentWithStateReport
+    :
 }
 
 function neutron_plugin_configure_l3_agent {
     local conf_file=$1
     _neutron_ovs_base_configure_l3_agent
-    iniset $conf_file DEFAULT l3_agent_manager neutron.agent.l3_agent.L3NATAgentWithStateReport
 }
 
 function neutron_plugin_configure_plugin_agent {

From b08b673def8f5c80b7a91ba2127edbb13c39c26a Mon Sep 17 00:00:00 2001
From: Pavlo Shchelokovskyy <pshchelokovskyy@mirantis.com>
Date: Sun, 14 Aug 2016 13:26:13 +0300
Subject: [PATCH 0565/2409] Allow properly overriding DEST

Change the order of variable declarations in stackrc so that setting
custom DEST in local.conf is also affecting DATA_DIR, SERVICE_DIR and
SUBUNIT_OUTPUT.

Change-Id: I00847bb6733febf105855ae6fc577a7c904ec4b4
Closes-Bug: #1285720
---
 stackrc | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/stackrc b/stackrc
index 4fefe8da30..9513e5a714 100644
--- a/stackrc
+++ b/stackrc
@@ -23,15 +23,6 @@ source $RC_DIR/functions
 # Destination path for installation
 DEST=/opt/stack
 
-# Destination for working data
-DATA_DIR=${DEST}/data
-
-# Destination for status files
-SERVICE_DIR=${DEST}/status
-
-# Path for subunit output file
-SUBUNIT_OUTPUT=${DEST}/devstack.subunit
-
 # Determine stack user
 if [[ $EUID -eq 0 ]]; then
     STACK_USER=stack
@@ -137,6 +128,15 @@ elif [[ -f $RC_DIR/.localrc.auto ]]; then
     source $RC_DIR/.localrc.auto
 fi
 
+# Destination for working data
+DATA_DIR=${DATA_DIR:-$DEST/data}
+
+# Destination for status files
+SERVICE_DIR=${SERVICE_DIR:-$DEST/status}
+
+# Path for subunit output file
+SUBUNIT_OUTPUT=${SUBUNIT_OUTPUT:-$DEST/devstack.subunit}
+
 # Default for log coloring is based on interactive-or-not.
 # Baseline assumption is that non-interactive invocations are for CI,
 # where logs are to be presented as browsable text files; hence color

From 65be33f68e613cb054d8bf3057535976b6df4918 Mon Sep 17 00:00:00 2001
From: Isaac Beckman <isaacb@il.ibm.com>
Date: Sun, 14 Aug 2016 15:27:40 +0300
Subject: [PATCH 0566/2409] Remove lib/cinder_backends/xiv

Since support for sections was added to devstack local.conf parsing
we don't need this, and actually prefer just using the
sections in local.conf.

Change-Id: I5908fdf7ad127997bb1f4a6bbb16d0d8cf073ddd
---
 lib/cinder_backends/xiv | 86 -----------------------------------------
 1 file changed, 86 deletions(-)
 delete mode 100644 lib/cinder_backends/xiv

diff --git a/lib/cinder_backends/xiv b/lib/cinder_backends/xiv
deleted file mode 100644
index e8b5da05d5..0000000000
--- a/lib/cinder_backends/xiv
+++ /dev/null
@@ -1,86 +0,0 @@
-#!/bin/bash
-#
-# Copyright 2014 IBM Corp.
-# Copyright (c) 2014 OpenStack Foundation
-# All Rights Reserved.
-#
-#    Licensed under the Apache License, Version 2.0 (the "License"); you may
-#    not use this file except in compliance with the License. You may obtain
-#    a copy of the License at
-#
-#         http://www.apache.org/licenses/LICENSE-2.0
-#
-#    Unless required by applicable law or agreed to in writing, software
-#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-#    License for the specific language governing permissions and limitations
-#    under the License.
-#
-# Authors:
-#   Alon Marx <alonma@il.ibm.com>
-#
-
-# lib/cinder_plugins/xiv
-# Configure the xiv_ds8k driver for xiv testing
-
-# Enable xiv_ds8k driver for xiv with:
-#
-#   CINDER_ENABLED_BACKENDS+=,xiv:<volume-type-name>
-#   XIV_DRIVER_VERSION=<version-string>
-#   SAN_IP=<storage-ip-or-hostname>
-#   SAN_LOGIN=<storage-admin-account>
-#   SAN_PASSWORD=<storage-admin-password>
-#   SAN_CLUSTERNAME=<cluster-name>
-#   CONNECTION_TYPE=<connection-type> iscsi|fc
-#   XIV_CHAP=<chap-type> disabled|enabled
-
-# Dependencies:
-#
-# - ``functions`` file
-# - ``cinder`` configurations
-
-# configure_cinder_backend_xiv - Configure Cinder for xiv backends
-
-# Save trace setting
-_XTRACE_CINDER_XIV=$(set +o | grep xtrace)
-set +o xtrace
-
-# Defaults
-# --------
-# Set up default directories
-
-
-# Entry Points
-# ------------
-
-# configure_cinder_backend_xiv - Set config files, create data dirs, etc
-function configure_cinder_backend_xiv {
-
-    local be_name=$1
-
-    python -c 'from xiv_ds8k_openstack.xiv_nova_proxy import XIVNovaProxy'
-    if [ $? -ne 0 ]; then
-        die $LINENO "XIV_DS8K driver is missing. Please install first"
-    fi
-
-    # For reference:
-    # ``XIV_DS8K_BACKEND='IBM-XIV_'${SAN_IP}'_'${SAN_CLUSTERNAME}'_'${CONNECTION_TYPE}``
-    iniset $CINDER_CONF DEFAULT xiv_ds8k_driver_version $XIV_DRIVER_VERSION
-
-    iniset $CINDER_CONF $be_name san_ip $SAN_IP
-    iniset $CINDER_CONF $be_name san_login $SAN_LOGIN
-    iniset $CINDER_CONF $be_name san_password $SAN_PASSWORD
-    iniset $CINDER_CONF $be_name san_clustername $SAN_CLUSTERNAME
-    iniset $CINDER_CONF $be_name xiv_ds8k_connection_type $CONNECTION_TYPE
-    iniset $CINDER_CONF $be_name volume_backend_name $be_name
-    iniset $CINDER_CONF $be_name volume_driver 'cinder.volume.drivers.ibm.xiv_ds8k.XIVDS8KDriver'
-    iniset $CINDER_CONF $be_name xiv_ds8k_proxy 'xiv_ds8k_openstack.xiv_nova_proxy.XIVNovaProxy'
-    iniset $CINDER_CONF $be_name xiv_chap $XIV_CHAP
-}
-
-# Restore xtrace
-$_XTRACE_CINDER_XIV
-
-# Local variables:
-# mode: shell-script
-# End:

From 9301e8875b8c50e486a3751b3d894d4ccdc94f84 Mon Sep 17 00:00:00 2001
From: Jim Rollenhagen <jim@jimrollenhagen.com>
Date: Mon, 15 Aug 2016 14:58:00 -0400
Subject: [PATCH 0567/2409] Revert "Setup cellsv2 for Nova"

This reverts commit b1a4f34bfc6adb9ab4577520601c44e8ccff277d, which
breaks Ironic's jobs. For example:
http://logs.openstack.org/90/355390/1/check/gate-tempest-dsvm-ironic-ipa-wholedisk-agent_ssh-tinyipa/b9e264a/logs/devstacklog.txt.gz#_2016-08-15_17_31_13_358

Change-Id: Iafc579f73fe4a97056944872e2f2c8cd1a62c21c
---
 lib/nova | 5 -----
 stack.sh | 1 -
 2 files changed, 6 deletions(-)

diff --git a/lib/nova b/lib/nova
index 8ac82008b4..1369c409fc 100644
--- a/lib/nova
+++ b/lib/nova
@@ -936,11 +936,6 @@ function create_flavors {
     fi
 }
 
-# create_cell(): Group the available hosts into a cell
-function create_cell {
-    nova-manage cell_v2 simple_cell_setup --transport-url $(get_transport_url)
-}
-
 # Restore xtrace
 $_XTRACE_LIB_NOVA
 
diff --git a/stack.sh b/stack.sh
index b1903e7095..823b63ba24 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1257,7 +1257,6 @@ if is_service_enabled nova; then
     echo_summary "Starting Nova"
     start_nova
     create_flavors
-    create_cell
 fi
 if is_service_enabled cinder; then
     echo_summary "Starting Cinder"

From 62f6eb68fdca2ecd30fbf0a1092b6b36dad368b0 Mon Sep 17 00:00:00 2001
From: lvdongbing <dongbing.lv@kylin-cloud.com>
Date: Wed, 17 Aug 2016 03:44:42 -0400
Subject: [PATCH 0568/2409] Change quota_injected_file_path_bytes to
 quota_injected_file_path_length

'quota_injected_file_path_bytes' has been renamed to
'quota_injected_file_path_length' long time ago, this patch fixes this
issue in devstack.

Change-Id: I5d3c52c5ded5321435d2d395b682c4c0725279a7
---
 lib/nova_plugins/hypervisor-fake | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova_plugins/hypervisor-fake b/lib/nova_plugins/hypervisor-fake
index 6ac219961e..f9b95c1816 100644
--- a/lib/nova_plugins/hypervisor-fake
+++ b/lib/nova_plugins/hypervisor-fake
@@ -45,7 +45,7 @@ function configure_nova_hypervisor {
     iniset $NOVA_CONF DEFAULT quota_fixed_ips -1
     iniset $NOVA_CONF DEFAULT quota_metadata_items -1
     iniset $NOVA_CONF DEFAULT quota_injected_files -1
-    iniset $NOVA_CONF DEFAULT quota_injected_file_path_bytes -1
+    iniset $NOVA_CONF DEFAULT quota_injected_file_path_length -1
     iniset $NOVA_CONF DEFAULT quota_security_groups -1
     iniset $NOVA_CONF DEFAULT quota_security_group_rules -1
     iniset $NOVA_CONF DEFAULT quota_key_pairs -1

From 023ac218059934a0746fa41c1473bd93ba9cc04a Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Wed, 17 Aug 2016 08:11:12 +0000
Subject: [PATCH 0569/2409] Updated from generate-devstack-plugins-list

Change-Id: I9379f01103bcb1ae7417c8bd14746aee9fb722ea
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index bdb8d8bc9c..bb8527041e 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -73,6 +73,7 @@ kuryr-libnetwork                       `git://git.openstack.org/openstack/kuryr-
 magnum                                 `git://git.openstack.org/openstack/magnum <https://git.openstack.org/cgit/openstack/magnum>`__
 magnum-ui                              `git://git.openstack.org/openstack/magnum-ui <https://git.openstack.org/cgit/openstack/magnum-ui>`__
 manila                                 `git://git.openstack.org/openstack/manila <https://git.openstack.org/cgit/openstack/manila>`__
+masakari                               `git://git.openstack.org/openstack/masakari <https://git.openstack.org/cgit/openstack/masakari>`__
 mistral                                `git://git.openstack.org/openstack/mistral <https://git.openstack.org/cgit/openstack/mistral>`__
 monasca-analytics                      `git://git.openstack.org/openstack/monasca-analytics <https://git.openstack.org/cgit/openstack/monasca-analytics>`__
 monasca-api                            `git://git.openstack.org/openstack/monasca-api <https://git.openstack.org/cgit/openstack/monasca-api>`__

From d7a3f5c4cc55e61bdcb5eb57bf823cee2e059828 Mon Sep 17 00:00:00 2001
From: Matt Van Dijk <mvandijk@tesora.com>
Date: Tue, 16 Aug 2016 15:46:58 +0000
Subject: [PATCH 0570/2409] Make the Neutron l3 plugin use the subnetpools

The plugin creates subnetpools but does not use them when creating the
default subnets. It uses CIDR values that overlap with the
default pools. Change this to use the subnetpools.

Change-Id: I6171c13507e420f146801d323cb1011be36c1e8c
Closes-bug: 1613717
---
 lib/neutron_plugins/services/l3 | 51 ++++++++++++++++++++++++---------
 1 file changed, 38 insertions(+), 13 deletions(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 61b8402818..5e52306206 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -149,6 +149,15 @@ function create_neutron_initial_network {
         neutron_plugin_create_initial_network_profile $PHYSICAL_NETWORK
     fi
 
+    if is_networking_extension_supported "auto-allocated-topology"; then
+        if [[ "$IP_VERSION" =~ 4.* ]]; then
+            SUBNETPOOL_V4_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnetpool-create $SUBNETPOOL_NAME --default-prefixlen $SUBNETPOOL_SIZE_V4 --pool-prefix $SUBNETPOOL_PREFIX_V4 --shared --is-default=True | grep ' id ' | get_field 2)
+        fi
+        if [[ "$IP_VERSION" =~ .*6 ]]; then
+            SUBNETPOOL_V6_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnetpool-create $SUBNETPOOL_NAME --default-prefixlen $SUBNETPOOL_SIZE_V6 --pool-prefix $SUBNETPOOL_PREFIX_V6 --shared --is-default=True | grep ' id ' | get_field 2)
+        fi
+    fi
+
     if is_provider_network; then
         die_if_not_set $LINENO PHYSICAL_NETWORK "You must specify the PHYSICAL_NETWORK"
         die_if_not_set $LINENO PROVIDER_NETWORK_TYPE "You must specify the PROVIDER_NETWORK_TYPE"
@@ -156,14 +165,20 @@ function create_neutron_initial_network {
         die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PHYSICAL_NETWORK $project_id"
 
         if [[ "$IP_VERSION" =~ 4.* ]]; then
-            SUBNET_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create --tenant_id $project_id --ip_version 4 ${ALLOCATION_POOL:+--allocation-pool $ALLOCATION_POOL} --name $PROVIDER_SUBNET_NAME --gateway $NETWORK_GATEWAY $NET_ID $FIXED_RANGE | grep ' id ' | get_field 2)
+            if [ -z $SUBNETPOOL_V4_ID ]; then
+                fixed_range_v4=$FIXED_RANGE
+            fi
+            SUBNET_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create --tenant_id $project_id --ip_version 4 ${ALLOCATION_POOL:+--allocation-pool $ALLOCATION_POOL} --name $PROVIDER_SUBNET_NAME --gateway $NETWORK_GATEWAY ${SUBNETPOOL_V4_ID:+--subnetpool $SUBNETPOOL_V4_ID} $NET_ID $fixed_range_v4 | grep ' id ' | get_field 2)
             die_if_not_set $LINENO SUBNET_ID "Failure creating SUBNET_ID for $PROVIDER_SUBNET_NAME $project_id"
         fi
 
         if [[ "$IP_VERSION" =~ .*6 ]]; then
             die_if_not_set $LINENO IPV6_PROVIDER_FIXED_RANGE "IPV6_PROVIDER_FIXED_RANGE has not been set, but Q_USE_PROVIDERNET_FOR_PUBLIC is true and IP_VERSION includes 6"
             die_if_not_set $LINENO IPV6_PROVIDER_NETWORK_GATEWAY "IPV6_PROVIDER_NETWORK_GATEWAY has not been set, but Q_USE_PROVIDERNET_FOR_PUBLIC is true and IP_VERSION includes 6"
-            SUBNET_V6_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create --tenant_id $project_id --ip_version 6 --ipv6-address-mode $IPV6_ADDRESS_MODE --gateway $IPV6_PROVIDER_NETWORK_GATEWAY --name $IPV6_PROVIDER_SUBNET_NAME $NET_ID $IPV6_PROVIDER_FIXED_RANGE | grep 'id' | get_field 2)
+            if [ -z $SUBNETPOOL_V6_ID ]; then
+                fixed_range_v6=$IPV6_PROVIDER_FIXED_RANGE
+            fi
+            SUBNET_V6_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create --tenant_id $project_id --ip_version 6 --ipv6-address-mode $IPV6_ADDRESS_MODE --gateway $IPV6_PROVIDER_NETWORK_GATEWAY --name $IPV6_PROVIDER_SUBNET_NAME ${SUBNETPOOL_V6_ID:+--subnetpool $SUBNETPOOL_V6_ID} $NET_ID $fixed_range_v6 | grep 'id' | get_field 2)
             die_if_not_set $LINENO SUBNET_V6_ID "Failure creating SUBNET_V6_ID for $IPV6_PROVIDER_SUBNET_NAME $project_id"
         fi
 
@@ -200,14 +215,8 @@ function create_neutron_initial_network {
         fi
 
         EXTERNAL_NETWORK_FLAGS="--router:external"
-        if is_networking_extension_supported "auto-allocated-topology" && is_networking_extension_supported "subnet_allocation"; then
+        if is_networking_extension_supported "auto-allocated-topology"; then
             EXTERNAL_NETWORK_FLAGS="$EXTERNAL_NETWORK_FLAGS --is-default"
-            if [[ "$IP_VERSION" =~ 4.* ]]; then
-                SUBNETPOOL_V4_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnetpool-create $SUBNETPOOL_NAME --default-prefixlen $SUBNETPOOL_SIZE_V4 --pool-prefix $SUBNETPOOL_PREFIX_V4 --shared --is-default=True | grep ' id ' | get_field 2)
-            fi
-            if [[ "$IP_VERSION" =~ .*6 ]]; then
-                SUBNETPOOL_V6_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnetpool-create $SUBNETPOOL_NAME --default-prefixlen $SUBNETPOOL_SIZE_V6 --pool-prefix $SUBNETPOOL_PREFIX_V6 --shared --is-default=True | grep ' id ' | get_field 2)
-            fi
         fi
         # Create an external network, and a subnet. Configure the external network as router gw
         if [ "$Q_USE_PROVIDERNET_FOR_PUBLIC" = "True" ]; then
@@ -232,11 +241,15 @@ function create_neutron_initial_network {
 # Create private IPv4 subnet
 function _neutron_create_private_subnet_v4 {
     local project_id=$1
+    if [ -z $SUBNETPOOL_V4_ID ]; then
+        fixed_range_v4=$FIXED_RANGE
+    fi
     local subnet_params="--tenant-id $project_id "
     subnet_params+="--ip_version 4 "
     subnet_params+="--gateway $NETWORK_GATEWAY "
     subnet_params+="--name $PRIVATE_SUBNET_NAME "
-    subnet_params+="$NET_ID $FIXED_RANGE"
+    subnet_params+="${SUBNETPOOL_V4_ID:+--subnetpool $SUBNETPOOL_V4_ID} "
+    subnet_params+="$NET_ID $fixed_range_v4"
     local subnet_id
     subnet_id=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create $subnet_params | grep ' id ' | get_field 2)
     die_if_not_set $LINENO subnet_id "Failure creating private IPv4 subnet for $project_id"
@@ -249,11 +262,15 @@ function _neutron_create_private_subnet_v6 {
     die_if_not_set $LINENO IPV6_RA_MODE "IPV6 RA Mode not set"
     die_if_not_set $LINENO IPV6_ADDRESS_MODE "IPV6 Address Mode not set"
     local ipv6_modes="--ipv6-ra-mode $IPV6_RA_MODE --ipv6-address-mode $IPV6_ADDRESS_MODE"
+    if [ -z $SUBNETPOOL_V6_ID ]; then
+        fixed_range_v6=$FIXED_RANGE_V6
+    fi
     local subnet_params="--tenant-id $project_id "
     subnet_params+="--ip_version 6 "
     subnet_params+="--gateway $IPV6_PRIVATE_NETWORK_GATEWAY "
     subnet_params+="--name $IPV6_PRIVATE_SUBNET_NAME "
-    subnet_params+="$NET_ID $FIXED_RANGE_V6 $ipv6_modes"
+    subnet_params+="${SUBNETPOOL_V6_ID:+--subnetpool $SUBNETPOOL_V6_ID} "
+    subnet_params+="$NET_ID $fixed_range_v6 $ipv6_modes"
     local ipv6_subnet_id
     ipv6_subnet_id=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create $subnet_params | grep ' id ' | get_field 2)
     die_if_not_set $LINENO ipv6_subnet_id "Failure creating private IPv6 subnet for $project_id"
@@ -321,7 +338,11 @@ function _neutron_configure_router_v4 {
             fi
             ROUTER_GW_IP=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" port-list -c fixed_ips -c device_owner | grep router_gateway | awk -F'ip_address'  '{ print $2 }' | cut -f3 -d\" | tr '\n' ' ')
             die_if_not_set $LINENO ROUTER_GW_IP "Failure retrieving ROUTER_GW_IP"
-            sudo ip route replace  $FIXED_RANGE via $ROUTER_GW_IP
+            local replace_range=${SUBNETPOOL_PREFIX_V4}
+            if [[ -z "${SUBNETPOOL_V4_ID}" ]]; then
+                replace_range=${FIXED_RANGE}
+            fi
+            sudo ip route replace $replace_range via $ROUTER_GW_IP
         fi
         _neutron_set_router_id
     fi
@@ -360,7 +381,11 @@ function _neutron_configure_router_v6 {
 
             # Configure interface for public bridge
             sudo ip -6 addr replace $ipv6_ext_gw_ip/$ipv6_cidr_len dev $ext_gw_interface
-            sudo ip -6 route replace $FIXED_RANGE_V6 via $IPV6_ROUTER_GW_IP dev $ext_gw_interface
+            local replace_range=${SUBNETPOOL_PREFIX_V6}
+            if [[ -z "${SUBNETPOOL_V6_ID}" ]]; then
+                replace_range=${FIXED_RANGE_V6}
+            fi
+            sudo ip -6 route replace $replace_range via $IPV6_ROUTER_GW_IP dev $ext_gw_interface
         fi
         _neutron_set_router_id
     fi

From 556139e710392c4f2586504b17490d8b63c4b21d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?S=C3=A9bastien=20Han?= <seb@redhat.com>
Date: Thu, 18 Aug 2016 15:09:44 +0200
Subject: [PATCH 0571/2409] fix ceph config file path variable
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CEPH_CONF does not exist anymore, resulting both cinder-volume and
cinder-backup being configured with an empty rbd_ceph_conf option.
Using CEPH_CONF_FILE to fix this.

Change-Id: I1aa590aba900a4a94698917e45a0ea5c6f497f18
Signed-off-by: Sébastien Han <seb@redhat.com>
---
 lib/cinder_backends/ceph | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/cinder_backends/ceph b/lib/cinder_backends/ceph
index 9bff5bef4f..ba86ccf8f4 100644
--- a/lib/cinder_backends/ceph
+++ b/lib/cinder_backends/ceph
@@ -45,7 +45,7 @@ function configure_cinder_backend_ceph {
 
     iniset $CINDER_CONF $be_name volume_backend_name $be_name
     iniset $CINDER_CONF $be_name volume_driver "cinder.volume.drivers.rbd.RBDDriver"
-    iniset $CINDER_CONF $be_name rbd_ceph_conf "$CEPH_CONF"
+    iniset $CINDER_CONF $be_name rbd_ceph_conf "$CEPH_CONF_FILE"
     iniset $CINDER_CONF $be_name rbd_pool "$CINDER_CEPH_POOL"
     iniset $CINDER_CONF $be_name rbd_user "$CINDER_CEPH_USER"
     iniset $CINDER_CONF $be_name rbd_uuid "$CINDER_CEPH_UUID"
@@ -66,7 +66,7 @@ function configure_cinder_backend_ceph {
         sudo chown $(whoami):$(whoami) ${CEPH_CONF_DIR}/ceph.client.${CINDER_BAK_CEPH_USER}.keyring
 
         iniset $CINDER_CONF DEFAULT backup_driver "cinder.backup.drivers.ceph"
-        iniset $CINDER_CONF DEFAULT backup_ceph_conf "$CEPH_CONF"
+        iniset $CINDER_CONF DEFAULT backup_ceph_conf "$CEPH_CONF_FILE"
         iniset $CINDER_CONF DEFAULT backup_ceph_pool "$CINDER_BAK_CEPH_POOL"
         iniset $CINDER_CONF DEFAULT backup_ceph_user "$CINDER_BAK_CEPH_USER"
         iniset $CINDER_CONF DEFAULT backup_ceph_stripe_unit 0

From 0a318ab8a6ede38a330b5bff10479772ab4776f0 Mon Sep 17 00:00:00 2001
From: Brant Knudson <bknudson@us.ibm.com>
Date: Thu, 18 Aug 2016 13:50:18 -0500
Subject: [PATCH 0572/2409] Switch keystone to dogpile.cache.memcached backend

memcache_pool is there to keep a limited number of thread-associated
connections open rather than a connection for every thread. If you
don't have a huge number of threads it doesn't offer anything.
Keystone is an example of a service where memcache_pool doesn't
improve things -- eventlet isn't supported anymore and more threads
is not useful due to GIL.

As such, keystone cache backend is changed to dogpile.cache.memcached.

See https://review.openstack.org/357407 for the oslo.cache help text
change.

Change-Id: I4452a8c4968073cdea4c0f384453a5a28519fa08
---
 lib/keystone | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/keystone b/lib/keystone
index 6198e43b58..6d8a43c0c2 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -245,7 +245,7 @@ function configure_keystone {
 
     # Enable caching
     iniset $KEYSTONE_CONF cache enabled "True"
-    iniset $KEYSTONE_CONF cache backend "oslo_cache.memcache_pool"
+    iniset $KEYSTONE_CONF cache backend "dogpile.cache.memcached"
     iniset $KEYSTONE_CONF cache memcache_servers localhost:11211
 
     # Do not cache the catalog backend due to https://bugs.launchpad.net/keystone/+bug/1537617

From 7682ea88a6ab8693b215646f16748dbbc2476cc4 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 18 Aug 2016 16:19:36 -0400
Subject: [PATCH 0573/2409] Change default for FORCE_CONFIG_DRIVE

We really should be using the metadata server more in our normal
testing, this changes the default to use it.

Change-Id: I8ef14e6110da1160163c0106e32032d27226f929
---
 lib/nova | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index e187220198..235b533d77 100644
--- a/lib/nova
+++ b/lib/nova
@@ -83,7 +83,7 @@ METADATA_SERVICE_PORT=${METADATA_SERVICE_PORT:-8775}
 
 # Option to enable/disable config drive
 # NOTE: Set ``FORCE_CONFIG_DRIVE="False"`` to turn OFF config drive
-FORCE_CONFIG_DRIVE=${FORCE_CONFIG_DRIVE:-"True"}
+FORCE_CONFIG_DRIVE=${FORCE_CONFIG_DRIVE:-"False"}
 
 # Nova supports pluggable schedulers.  The default ``FilterScheduler``
 # should work in most cases.

From 85ad108adf84718d5d7747e892ba236a21fc2dac Mon Sep 17 00:00:00 2001
From: Chris Dent <cdent@anticdent.org>
Date: Mon, 22 Aug 2016 17:00:50 +0000
Subject: [PATCH 0574/2409] Fix typo in tools/info.sh comment

A trivial fix to a typo in tools/info.sh discovered while looking at
it to see what it was.

Change-Id: I9fb8906c375f99e43cdd0f41f7e4510c901fd3a1
---
 tools/info.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/info.sh b/tools/info.sh
index c056fa73f8..282667f9d0 100755
--- a/tools/info.sh
+++ b/tools/info.sh
@@ -8,7 +8,7 @@
 # Output types are git,localrc,os,pip,pkg:
 #
 #   git|<project>|<branch>[<shaq>]
-#   localtc|<var>=<value>
+#   localrc|<var>=<value>
 #   os|<var>=<value>
 #   pip|<package>|<version>
 #   pkg|<package>|<version>

From 31813e92199386f19dd7e993a9e951d293503a01 Mon Sep 17 00:00:00 2001
From: Brian Haley <brian.haley@hpe.com>
Date: Mon, 22 Aug 2016 15:39:22 -0400
Subject: [PATCH 0575/2409] Let neutron use default gateway IP for subnets

By default, FIXED_RANGE and NETWORK_GATEWAY (and the
IPv6 equivalents) are in the same subnet.  But if
FIXED_RANGE is over-ridden in local.conf we could
create a subnet with an invalid gateway address.

Since neutron will pick the lowest host IP as the
gateway by default, do not specify them unless the
user has specifically set them.

Do this for both the private and public subnets, as
well as the public IPv4 subnet.

Change-Id: Ifc71400a3af1f131bb8a9722188e13de5bd3c806
---
 lib/neutron_plugins/services/l3 | 20 +++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index a4e72483b4..c6f14d35f6 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -63,14 +63,14 @@ IPV6_ADDRESS_MODE=${IPV6_ADDRESS_MODE:-slaac}
 IPV6_PUBLIC_SUBNET_NAME=${IPV6_PUBLIC_SUBNET_NAME:-ipv6-public-subnet}
 IPV6_PRIVATE_SUBNET_NAME=${IPV6_PRIVATE_SUBNET_NAME:-ipv6-private-subnet}
 FIXED_RANGE_V6=${FIXED_RANGE_V6:-fd$IPV6_GLOBAL_ID::/64}
-IPV6_PRIVATE_NETWORK_GATEWAY=${IPV6_PRIVATE_NETWORK_GATEWAY:-fd$IPV6_GLOBAL_ID::1}
+IPV6_PRIVATE_NETWORK_GATEWAY=${IPV6_PRIVATE_NETWORK_GATEWAY:-}
 IPV6_PUBLIC_RANGE=${IPV6_PUBLIC_RANGE:-2001:db8::/64}
 IPV6_PUBLIC_NETWORK_GATEWAY=${IPV6_PUBLIC_NETWORK_GATEWAY:-2001:db8::2}
 IPV6_ROUTER_GW_IP=${IPV6_ROUTER_GW_IP:-2001:db8::1}
 
 # Gateway and subnet defaults, in case they are not customized in localrc
-NETWORK_GATEWAY=${NETWORK_GATEWAY:-10.0.0.1}
-PUBLIC_NETWORK_GATEWAY=${PUBLIC_NETWORK_GATEWAY:-172.24.4.1}
+NETWORK_GATEWAY=${NETWORK_GATEWAY:-}
+PUBLIC_NETWORK_GATEWAY=${PUBLIC_NETWORK_GATEWAY:-}
 PRIVATE_SUBNET_NAME=${PRIVATE_SUBNET_NAME:-"private-subnet"}
 PUBLIC_SUBNET_NAME=${PUBLIC_SUBNET_NAME:-"public-subnet"}
 
@@ -234,7 +234,9 @@ function _neutron_create_private_subnet_v4 {
     local project_id=$1
     local subnet_params="--tenant-id $project_id "
     subnet_params+="--ip_version 4 "
-    subnet_params+="--gateway $NETWORK_GATEWAY "
+    if [[ -n "$NETWORK_GATEWAY" ]]; then
+        subnet_params+="--gateway $NETWORK_GATEWAY "
+    fi
     subnet_params+="--name $PRIVATE_SUBNET_NAME "
     subnet_params+="$NET_ID $FIXED_RANGE"
     local subnet_id
@@ -251,7 +253,9 @@ function _neutron_create_private_subnet_v6 {
     local ipv6_modes="--ipv6-ra-mode $IPV6_RA_MODE --ipv6-address-mode $IPV6_ADDRESS_MODE"
     local subnet_params="--tenant-id $project_id "
     subnet_params+="--ip_version 6 "
-    subnet_params+="--gateway $IPV6_PRIVATE_NETWORK_GATEWAY "
+    if [[ -n "$IPV6_PRIVATE_NETWORK_GATEWAY" ]]; then
+        subnet_params+="--gateway $IPV6_PRIVATE_NETWORK_GATEWAY "
+    fi
     subnet_params+="--name $IPV6_PRIVATE_SUBNET_NAME "
     subnet_params+="$NET_ID $FIXED_RANGE_V6 $ipv6_modes"
     local ipv6_subnet_id
@@ -262,9 +266,11 @@ function _neutron_create_private_subnet_v6 {
 
 # Create public IPv4 subnet
 function _neutron_create_public_subnet_v4 {
-    local subnet_params+="--ip_version 4 "
+    local subnet_params="--ip_version 4 "
     subnet_params+="${Q_FLOATING_ALLOCATION_POOL:+--allocation-pool $Q_FLOATING_ALLOCATION_POOL} "
-    subnet_params+="--gateway $PUBLIC_NETWORK_GATEWAY "
+    if [[ -n "$PUBLIC_NETWORK_GATEWAY" ]]; then
+        subnet_params+="--gateway $PUBLIC_NETWORK_GATEWAY "
+    fi
     subnet_params+="--name $PUBLIC_SUBNET_NAME "
     subnet_params+="$EXT_NET_ID $FLOATING_RANGE "
     subnet_params+="-- --enable_dhcp=False"

From 01acdabb1d65594a5fd74a6c72dcd5f5b0c1b0c6 Mon Sep 17 00:00:00 2001
From: igor <igor.milovanovic@ammeon.com>
Date: Fri, 29 Jul 2016 13:11:53 +0200
Subject: [PATCH 0576/2409] Fixes language: "following allowing" -> "allowing"

Stops propagation of initially erroneous construct.

Change-Id: I2197de57cbac98e87fb39fa0dca4c691fe5e856f
---
 HACKING.rst                   | 2 +-
 exercises/aggregates.sh       | 2 +-
 exercises/boot_from_volume.sh | 2 +-
 exercises/client-args.sh      | 2 +-
 exercises/client-env.sh       | 2 +-
 exercises/floating_ips.sh     | 2 +-
 exercises/neutron-adv-test.sh | 2 +-
 exercises/sec_groups.sh       | 2 +-
 exercises/swift.sh            | 2 +-
 exercises/volumes.sh          | 2 +-
 10 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/HACKING.rst b/HACKING.rst
index d763c75b8b..b76cb6c4a7 100644
--- a/HACKING.rst
+++ b/HACKING.rst
@@ -219,7 +219,7 @@ These scripts are executed serially by ``exercise.sh`` in testing situations.
     set -o errexit
 
     # Print the commands being run so that we can see the command that triggers
-    # an error.  It is also useful for following allowing as the install occurs.
+    # an error.  It is also useful for following as the install occurs.
     set -o xtrace
 
 * Settings and configuration are stored in ``exerciserc``, which must be
diff --git a/exercises/aggregates.sh b/exercises/aggregates.sh
index 808ef76e2f..8cbca54fb2 100755
--- a/exercises/aggregates.sh
+++ b/exercises/aggregates.sh
@@ -20,7 +20,7 @@ echo "**************************************************"
 set -o errexit
 
 # Print the commands being run so that we can see the command that triggers
-# an error.  It is also useful for following allowing as the install occurs.
+# an error.  It is also useful for following as the install occurs.
 set -o xtrace
 
 
diff --git a/exercises/boot_from_volume.sh b/exercises/boot_from_volume.sh
index 84ac08f017..7478bdf138 100755
--- a/exercises/boot_from_volume.sh
+++ b/exercises/boot_from_volume.sh
@@ -16,7 +16,7 @@ echo "*********************************************************************"
 set -o errexit
 
 # Print the commands being run so that we can see the command that triggers
-# an error.  It is also useful for following allowing as the install occurs.
+# an error.  It is also useful for following as the install occurs.
 set -o xtrace
 
 
diff --git a/exercises/client-args.sh b/exercises/client-args.sh
index 2c8fe81390..b380968da8 100755
--- a/exercises/client-args.sh
+++ b/exercises/client-args.sh
@@ -13,7 +13,7 @@ echo "*********************************************************************"
 set -o errexit
 
 # Print the commands being run so that we can see the command that triggers
-# an error.  It is also useful for following allowing as the install occurs.
+# an error.  It is also useful for following as the install occurs.
 set -o xtrace
 
 
diff --git a/exercises/client-env.sh b/exercises/client-env.sh
index 6ab4d08715..fff04df9f2 100755
--- a/exercises/client-env.sh
+++ b/exercises/client-env.sh
@@ -13,7 +13,7 @@ echo "*********************************************************************"
 set -o errexit
 
 # Print the commands being run so that we can see the command that triggers
-# an error.  It is also useful for following allowing as the install occurs.
+# an error.  It is also useful for following as the install occurs.
 set -o xtrace
 
 
diff --git a/exercises/floating_ips.sh b/exercises/floating_ips.sh
index 485208ba30..5abc7137b3 100755
--- a/exercises/floating_ips.sh
+++ b/exercises/floating_ips.sh
@@ -13,7 +13,7 @@ echo "*********************************************************************"
 set -o errexit
 
 # Print the commands being run so that we can see the command that triggers
-# an error.  It is also useful for following allowing as the install occurs.
+# an error.  It is also useful for following as the install occurs.
 set -o xtrace
 
 
diff --git a/exercises/neutron-adv-test.sh b/exercises/neutron-adv-test.sh
index 81150061ca..dc6bbbb5c7 100755
--- a/exercises/neutron-adv-test.sh
+++ b/exercises/neutron-adv-test.sh
@@ -20,7 +20,7 @@ echo "*********************************************************************"
 set -o errtrace
 
 # Print the commands being run so that we can see the command that triggers
-# an error.  It is also useful for following allowing as the install occurs.
+# an error.  It is also useful for following as the install occurs.
 set -o xtrace
 
 # Environment
diff --git a/exercises/sec_groups.sh b/exercises/sec_groups.sh
index 5f8b0a4d5d..2f78e393eb 100755
--- a/exercises/sec_groups.sh
+++ b/exercises/sec_groups.sh
@@ -13,7 +13,7 @@ echo "*********************************************************************"
 set -o errexit
 
 # Print the commands being run so that we can see the command that triggers
-# an error.  It is also useful for following allowing as the install occurs.
+# an error.  It is also useful for following as the install occurs.
 set -o xtrace
 
 
diff --git a/exercises/swift.sh b/exercises/swift.sh
index 4a41e0f1ed..8aa376b8a7 100755
--- a/exercises/swift.sh
+++ b/exercises/swift.sh
@@ -13,7 +13,7 @@ echo "*********************************************************************"
 set -o errexit
 
 # Print the commands being run so that we can see the command that triggers
-# an error.  It is also useful for following allowing as the install occurs.
+# an error.  It is also useful for following as the install occurs.
 set -o xtrace
 
 
diff --git a/exercises/volumes.sh b/exercises/volumes.sh
index 0de1226fee..e7c3560894 100755
--- a/exercises/volumes.sh
+++ b/exercises/volumes.sh
@@ -13,7 +13,7 @@ echo "*********************************************************************"
 set -o errexit
 
 # Print the commands being run so that we can see the command that triggers
-# an error.  It is also useful for following allowing as the install occurs.
+# an error.  It is also useful for following as the install occurs.
 set -o xtrace
 
 

From 7eb672d1a95794644db8c34411f44734927bd87f Mon Sep 17 00:00:00 2001
From: Jan Stodt <stodtj@de.ibm.com>
Date: Wed, 24 Aug 2016 15:29:06 +0200
Subject: [PATCH 0577/2409] Update doc to reflect neutron became devstack
 default

Removing the explicit enablment of Neutron services, as with [1] they are configured as defaults in stackrc.

[1] https://review.openstack.org/#/c/350750/

Change-Id: Ic8910cd28fe37842f7d824e68bd2ea705e7e52de
---
 doc/source/guides/neutron.rst | 21 +--------------------
 1 file changed, 1 insertion(+), 20 deletions(-)

diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index c5b1634f62..b26fd1e8ee 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -76,12 +76,6 @@ serving as a hypervisor for guest instances.
         RABBIT_PASSWORD=secret
         SERVICE_PASSWORD=secret
 
-        # Do not use Nova-Network
-        disable_service n-net
-        # Enable Neutron
-        ENABLED_SERVICES+=,q-svc,q-dhcp,q-meta,q-agt,q-l3
-
-
         ## Neutron options
         Q_USE_SECGROUP=True
         FLOATING_RANGE="172.18.161.0/24"
@@ -389,11 +383,7 @@ controller node.
 
         Q_USE_PROVIDER_NETWORKING=True
 
-        # Do not use Nova-Network
-        disable_service n-net
-
-        # Neutron
-        ENABLED_SERVICES+=,q-svc,q-dhcp,q-meta,q-agt
+        disable_service q-l3
 
         ## Neutron Networking options used to create Neutron Subnets
 
@@ -530,12 +520,6 @@ setup, with small modifications for the interface mappings.
     RABBIT_PASSWORD=secret
     SERVICE_PASSWORD=secret
 
-    # Do not use Nova-Network
-    disable_service n-net
-    # Enable Neutron
-    ENABLED_SERVICES+=,q-svc,q-dhcp,q-meta,q-agt,q-l3
-
-
     ## Neutron options
     Q_USE_SECGROUP=True
     FLOATING_RANGE="172.18.161.0/24"
@@ -582,10 +566,7 @@ you do not require them.
     Q_ML2_PLUGIN_MECHANISM_DRIVERS=macvtap
     Q_USE_PROVIDER_NETWORKING=True
 
-    #Enable Neutron services
-    disable_service n-net
     enable_plugin neutron git://git.openstack.org/openstack/neutron
-    ENABLED_SERVICES+=,q-agt,q-svc
 
     ## MacVTap agent options
     Q_AGENT=macvtap

From 88f8558d874072536e7660a233f24207a7089651 Mon Sep 17 00:00:00 2001
From: Gary Kotton <gkotton@vmware.com>
Date: Sun, 14 Aug 2016 06:55:42 -0700
Subject: [PATCH 0578/2409] Enable neutron to work in a multi node setup

On the controller node where devstack is being run should create
the neutron network. The compute node should not.

The the case that we want to run a multi-node neutron setup we need
to configure the following (in the case that a plugin does not
have any agents running on the compute node):
ENABLED_SERVICES=n-cpu,neutron

In addition to this the code did not enable decomposed plugins to
configure their nova configurations if necessary.

This patch ensure that the multi-node support works.

Change-Id: I8e80edd453a1106ca666d6c531b2433be631bce4
Closes-bug: #1613069
---
 lib/neutron                     | 3 +++
 lib/neutron_plugins/services/l3 | 8 ++++++++
 stack.sh                        | 5 +----
 3 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index c1552e3d06..7442efd2c1 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -305,6 +305,9 @@ function configure_neutron_nova_new {
 
     iniset $NOVA_CONF DEFAULT firewall_driver nova.virt.firewall.NoopFirewallDriver
 
+    # optionally set options in nova_conf
+    neutron_plugin_create_nova_conf
+
     if is_service_enabled neutron-metadata-agent; then
         iniset $NOVA_CONF neutron service_metadata_proxy "True"
     fi
diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index a4e72483b4..334cd7a694 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -140,6 +140,14 @@ function _neutron_get_ext_gw_interface {
 }
 
 function create_neutron_initial_network {
+    if ! is_service_enabled q-svc && ! is_service_enabled neutron-api; then
+        echo "Controller services not enabled. No networks configured!"
+        return
+    fi
+    if [[ "$NEUTRON_CREATE_INITIAL_NETWORKS" == "False" ]]; then
+        echo "Network creation disabled!"
+        return
+    fi
     local project_id
     project_id=$(openstack project list | grep " demo " | get_field 1)
     die_if_not_set $LINENO project_id "Failure retrieving project_id for demo"
diff --git a/stack.sh b/stack.sh
index 823b63ba24..ce34cd5ef3 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1248,10 +1248,7 @@ if is_service_enabled neutron; then
     start_neutron
 fi
 # Once neutron agents are started setup initial network elements
-if is_service_enabled q-svc && [[ "$NEUTRON_CREATE_INITIAL_NETWORKS" == "True" ]]; then
-    echo_summary "Creating initial neutron network elements"
-    create_neutron_initial_network
-fi
+create_neutron_initial_network
 
 if is_service_enabled nova; then
     echo_summary "Starting Nova"

From c12d1d9ce06ad9f524430469b15a066edadcddde Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Tue, 23 Aug 2016 19:07:57 -0500
Subject: [PATCH 0579/2409] Accept IPv6 RAs on the interface with the default
 route

Because neutron sets ipv6 forwarding settings, we stop accepting RAs
from IPv6-only host environments. This leads to a loss of external
connectivity, which is bad for zuul running tests and stuff.

Setting accept_ra to 2 will cause the RAs to be accepted.

Change-Id: Ia044fff2a1731ab6c04f82aea47096b425e0c0a0
---
 lib/neutron_plugins/services/l3 | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index a4e72483b4..6bbac2c6a9 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -83,6 +83,9 @@ SUBNETPOOL_PREFIX_V6=${SUBNETPOOL_PREFIX_V6:-2001:db8:8000::/48}
 SUBNETPOOL_SIZE_V4=${SUBNETPOOL_SIZE_V4:-24}
 SUBNETPOOL_SIZE_V6=${SUBNETPOOL_SIZE_V6:-64}
 
+default_route_dev=$(ip route | grep ^default | awk '{print $5}')
+die_if_not_set $LINENO default_route_dev "Failure retrieving default route device"
+
 function _determine_config_l3 {
     local opts="--config-file $NEUTRON_CONF --config-file $Q_L3_CONF_FILE"
     echo "$opts"
@@ -113,9 +116,7 @@ function _configure_neutron_l3_agent {
             _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" False False "inet6"
         fi
     else
-        local default_dev=""
-        default_dev=$(ip route | grep ^default | awk '{print $5}')
-        sudo iptables -t nat -A POSTROUTING -o $default_dev -s $FLOATING_RANGE -j MASQUERADE
+        sudo iptables -t nat -A POSTROUTING -o $default_route_dev -s $FLOATING_RANGE -j MASQUERADE
     fi
 }
 
@@ -351,6 +352,11 @@ function _neutron_configure_router_v6 {
 
     # This logic is specific to using the l3-agent for layer 3
     if is_service_enabled q-l3 || is_service_enabled neutron-l3; then
+        # Ensure IPv6 RAs are accepted on the interface with the default route.
+        # This is needed for neutron-based devstack clouds to work in
+        # IPv6-only clouds in the gate. Please do not remove this without
+        # talking to folks in Infra.
+        sudo sysctl -w net.ipv6.conf.$default_route_dev.accept_ra=2
         # Ensure IPv6 forwarding is enabled on the host
         sudo sysctl -w net.ipv6.conf.all.forwarding=1
         # Configure and enable public bridge

From 7e40c6406b553c489515a6ca79014bcaaa5a7db3 Mon Sep 17 00:00:00 2001
From: Doug Wiegley <dougwig@parkside.io>
Date: Sat, 20 Aug 2016 16:32:14 +0000
Subject: [PATCH 0580/2409] Remove lbaas from devstack proper, take 2

p-c patches have merged, neutron-lbaas removal is in the merge queue.

This reverts commit b3f26cb66c70b599c4d77945f2bdadd9537c7c35.

Depends-On: I506949e75bc62681412358ba689cb07b16311b68
Change-Id: I98d62c13ef90b20a9c67ef4f1720efcaa366fb31
---
 lib/neutron-legacy                        | 40 +-----------------
 lib/neutron_plugins/services/loadbalancer | 51 -----------------------
 stackrc                                   |  4 --
 3 files changed, 1 insertion(+), 94 deletions(-)
 delete mode 100644 lib/neutron_plugins/services/loadbalancer

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 25fb6b7847..e8f9aeb938 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -74,7 +74,6 @@ GITDIR["python-neutronclient"]=$DEST/python-neutronclient
 
 NEUTRON_DIR=$DEST/neutron
 NEUTRON_FWAAS_DIR=$DEST/neutron-fwaas
-NEUTRON_LBAAS_DIR=$DEST/neutron-lbaas
 NEUTRON_AUTH_CACHE_DIR=${NEUTRON_AUTH_CACHE_DIR:-/var/cache/neutron}
 
 # Support entry points installation of console scripts
@@ -88,9 +87,6 @@ NEUTRON_CONF_DIR=/etc/neutron
 NEUTRON_CONF=$NEUTRON_CONF_DIR/neutron.conf
 export NEUTRON_TEST_CONFIG_FILE=${NEUTRON_TEST_CONFIG_FILE:-"$NEUTRON_CONF_DIR/debug.ini"}
 
-# Default provider for load balancer service
-DEFAULT_LB_PROVIDER=LOADBALANCER:Haproxy:neutron_lbaas.services.loadbalancer.drivers.haproxy.plugin_driver.HaproxyOnHostPluginDriver:default
-
 # Agent binaries.  Note, binary paths for other agents are set in per-service
 # scripts in lib/neutron_plugins/services/
 AGENT_DHCP_BINARY="$NEUTRON_BIN_DIR/neutron-dhcp-agent"
@@ -252,12 +248,6 @@ if [ -f $TOP_DIR/lib/neutron_plugins/$Q_PLUGIN ]; then
     source $TOP_DIR/lib/neutron_plugins/$Q_PLUGIN
 fi
 
-# Agent loadbalancer service plugin functions
-# -------------------------------------------
-
-# Hardcoding for 1 service plugin for now
-source $TOP_DIR/lib/neutron_plugins/services/loadbalancer
-
 # Agent metering service plugin functions
 # -------------------------------------------
 
@@ -316,10 +306,6 @@ function configure_mutnauq {
     iniset_rpc_backend neutron $NEUTRON_CONF
 
     # goes before q-svc to init Q_SERVICE_PLUGIN_CLASSES
-    if is_service_enabled q-lbaas; then
-        deprecated "Configuring q-lbaas through devstack is deprecated"
-        _configure_neutron_lbaas
-    fi
     if is_service_enabled q-metering; then
         _configure_neutron_metering
     fi
@@ -418,10 +404,6 @@ function install_mutnauq {
 
     git_clone $NEUTRON_REPO $NEUTRON_DIR $NEUTRON_BRANCH
     setup_develop $NEUTRON_DIR
-    if is_service_enabled q-lbaas; then
-        git_clone $NEUTRON_LBAAS_REPO $NEUTRON_LBAAS_DIR $NEUTRON_LBAAS_BRANCH
-        setup_develop $NEUTRON_LBAAS_DIR
-    fi
 
     if [ "$VIRT_DRIVER" == 'xenserver' ]; then
         local dom0_ip
@@ -452,10 +434,6 @@ function install_neutron_agent_packages {
     if is_service_enabled q-agt q-dhcp q-l3; then
         neutron_plugin_install_agent_packages
     fi
-
-    if is_service_enabled q-lbaas; then
-        neutron_agent_lbaas_install_agent_packages
-    fi
 }
 
 # Start running processes, including screen
@@ -516,7 +494,6 @@ function start_mutnauq_other_agents {
     fi
 
     run_process q-meta "$AGENT_META_BINARY --config-file $NEUTRON_CONF --config-file $Q_META_CONF_FILE"
-    run_process q-lbaas "$AGENT_LBAAS_BINARY --config-file $NEUTRON_CONF --config-file $LBAAS_AGENT_CONF_FILENAME"
     run_process q-metering "$AGENT_METERING_BINARY --config-file $NEUTRON_CONF --config-file $METERING_AGENT_CONF_FILENAME"
 
     if [ "$VIRT_DRIVER" = 'xenserver' ]; then
@@ -556,9 +533,6 @@ function stop_mutnauq_other {
         stop_process q-meta
     fi
 
-    if is_service_enabled q-lbaas; then
-        neutron_lbaas_stop
-    fi
     if is_service_enabled q-metering; then
         neutron_metering_stop
     fi
@@ -662,7 +636,7 @@ function cleanup_mutnauq {
     fi
 
     # delete all namespaces created by neutron
-    for ns in $(sudo ip netns list | grep -o -E '(qdhcp|qrouter|qlbaas|fip|snat)-[0-9a-f-]*'); do
+    for ns in $(sudo ip netns list | grep -o -E '(qdhcp|qrouter|fip|snat)-[0-9a-f-]*'); do
         sudo ip netns delete ${ns}
     done
 }
@@ -818,18 +792,6 @@ function _configure_neutron_ceilometer_notifications {
     iniset $NEUTRON_CONF oslo_messaging_notifications driver messaging
 }
 
-function _configure_neutron_lbaas {
-    # Uses oslo config generator to generate LBaaS sample configuration files
-    (cd $NEUTRON_LBAAS_DIR && exec ./tools/generate_config_file_samples.sh)
-
-    if [ -f $NEUTRON_LBAAS_DIR/etc/neutron_lbaas.conf.sample ]; then
-        cp $NEUTRON_LBAAS_DIR/etc/neutron_lbaas.conf.sample $NEUTRON_CONF_DIR/neutron_lbaas.conf
-        iniset $NEUTRON_CONF_DIR/neutron_lbaas.conf service_providers service_provider $DEFAULT_LB_PROVIDER
-    fi
-    neutron_agent_lbaas_configure_common
-    neutron_agent_lbaas_configure_agent
-}
-
 function _configure_neutron_metering {
     neutron_agent_metering_configure_common
     neutron_agent_metering_configure_agent
diff --git a/lib/neutron_plugins/services/loadbalancer b/lib/neutron_plugins/services/loadbalancer
deleted file mode 100644
index 30e9480f2e..0000000000
--- a/lib/neutron_plugins/services/loadbalancer
+++ /dev/null
@@ -1,51 +0,0 @@
-#!/bin/bash
-
-# Neutron loadbalancer plugin
-# ---------------------------
-
-# Save trace setting
-_XTRACE_NEUTRON_LB=$(set +o | grep xtrace)
-set +o xtrace
-
-
-AGENT_LBAAS_BINARY="$NEUTRON_BIN_DIR/neutron-lbaas-agent"
-LBAAS_PLUGIN=neutron_lbaas.services.loadbalancer.plugin.LoadBalancerPlugin
-
-function neutron_agent_lbaas_install_agent_packages {
-    if is_ubuntu || is_fedora || is_suse; then
-        install_package haproxy
-    fi
-}
-
-function neutron_agent_lbaas_configure_common {
-    _neutron_service_plugin_class_add $LBAAS_PLUGIN
-    _neutron_deploy_rootwrap_filters $NEUTRON_LBAAS_DIR
-}
-
-function neutron_agent_lbaas_configure_agent {
-    LBAAS_AGENT_CONF_PATH=/etc/neutron/services/loadbalancer/haproxy
-    mkdir -p $LBAAS_AGENT_CONF_PATH
-
-    LBAAS_AGENT_CONF_FILENAME="$LBAAS_AGENT_CONF_PATH/lbaas_agent.ini"
-
-    cp $NEUTRON_LBAAS_DIR/etc/lbaas_agent.ini.sample $LBAAS_AGENT_CONF_FILENAME
-
-    # ovs_use_veth needs to be set before the plugin configuration
-    # occurs to allow plugins to override the setting.
-    iniset $LBAAS_AGENT_CONF_FILENAME DEFAULT ovs_use_veth $Q_OVS_USE_VETH
-
-    neutron_plugin_setup_interface_driver $LBAAS_AGENT_CONF_FILENAME
-
-    if is_fedora; then
-        iniset $LBAAS_AGENT_CONF_FILENAME DEFAULT user_group "nobody"
-        iniset $LBAAS_AGENT_CONF_FILENAME haproxy user_group "nobody"
-    fi
-}
-
-function neutron_lbaas_stop {
-    pids=$(ps aux | awk '/haproxy/ { print $2 }')
-    [ ! -z "$pids" ] && sudo kill $pids || true
-}
-
-# Restore xtrace
-$_XTRACE_NEUTRON_LB
diff --git a/stackrc b/stackrc
index bfb897b338..446510c291 100644
--- a/stackrc
+++ b/stackrc
@@ -266,10 +266,6 @@ NEUTRON_BRANCH=${NEUTRON_BRANCH:-master}
 NEUTRON_FWAAS_REPO=${NEUTRON_FWAAS_REPO:-${GIT_BASE}/openstack/neutron-fwaas.git}
 NEUTRON_FWAAS_BRANCH=${NEUTRON_FWAAS_BRANCH:-master}
 
-# neutron lbaas service
-NEUTRON_LBAAS_REPO=${NEUTRON_LBAAS_REPO:-${GIT_BASE}/openstack/neutron-lbaas.git}
-NEUTRON_LBAAS_BRANCH=${NEUTRON_LBAAS_BRANCH:-master}
-
 # compute service
 NOVA_REPO=${NOVA_REPO:-${GIT_BASE}/openstack/nova.git}
 NOVA_BRANCH=${NOVA_BRANCH:-master}

From 1c5fc97136cfd9f89afc1d51239af343e0dda6a3 Mon Sep 17 00:00:00 2001
From: zhurong <aaronzhu1121@gmail.com>
Date: Thu, 25 Aug 2016 23:35:21 +0800
Subject: [PATCH 0581/2409] Add files/*.deb and files/*.deb.* to gitignore

Change-Id: Ieb8bc6a0852eabce987fef9441cca8770b711a38
---
 .gitignore | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.gitignore b/.gitignore
index a470ff5d27..d1781bc730 100644
--- a/.gitignore
+++ b/.gitignore
@@ -15,6 +15,8 @@ files/*.gz
 files/*.vmdk
 files/*.rpm
 files/*.rpm.*
+files/*.deb
+files/*.deb.*
 files/*.qcow2
 files/*.img
 files/images

From 1554adef26bd3bd184ddab668660428bdf392232 Mon Sep 17 00:00:00 2001
From: Kevin Benton <kevin@benton.pub>
Date: Fri, 22 Jul 2016 09:40:19 -0700
Subject: [PATCH 0582/2409] Revert "Revert "Use real Neutron network for L3 GW
 by default""

This reverts commit 7da968a8be03229cfa72b215b87f17e28e23a988.

Change-Id: I9ed28ccf6af611b280ada3420d7d2a833178fcac
---
 lib/neutron-legacy              | 4 ++--
 lib/neutron_plugins/services/l3 | 9 +++++++--
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index e8f9aeb938..b1b5230fdd 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -199,7 +199,7 @@ TENANT_VLAN_RANGE=${TENANT_VLAN_RANGE:-}
 # agent, as described below.
 #
 # Example: ``PHYSICAL_NETWORK=default``
-PHYSICAL_NETWORK=${PHYSICAL_NETWORK:-}
+PHYSICAL_NETWORK=${PHYSICAL_NETWORK:-public}
 
 # With the openvswitch agent, if using VLANs for tenant networks,
 # or if using flat or VLAN provider networks, set in ``localrc`` to
@@ -209,7 +209,7 @@ PHYSICAL_NETWORK=${PHYSICAL_NETWORK:-}
 # port for external connectivity.
 #
 # Example: ``OVS_PHYSICAL_BRIDGE=br-eth1``
-OVS_PHYSICAL_BRIDGE=${OVS_PHYSICAL_BRIDGE:-}
+OVS_PHYSICAL_BRIDGE=${OVS_PHYSICAL_BRIDGE:-br-ex}
 
 # With the linuxbridge agent, if using VLANs for tenant networks,
 # or if using flat or VLAN provider networks, set in ``localrc`` to
diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 6eefb77597..b598241c78 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -17,6 +17,11 @@ IPV6_PROVIDER_NETWORK_GATEWAY=${IPV6_PROVIDER_NETWORK_GATEWAY:-}
 PUBLIC_BRIDGE=${PUBLIC_BRIDGE:-br-ex}
 PUBLIC_BRIDGE_MTU=${PUBLIC_BRIDGE_MTU:-1500}
 
+# If Q_ASSIGN_GATEWAY_TO_PUBLIC_BRIDGE=True, assign the gateway IP of the public
+# subnet to the public bridge interface even if Q_USE_PROVIDERNET_FOR_PUBLIC is
+# used.
+Q_ASSIGN_GATEWAY_TO_PUBLIC_BRIDGE=${Q_ASSIGN_GATEWAY_TO_PUBLIC_BRIDGE:-True}
+
 # If Q_USE_PUBLIC_VETH=True, create and use a veth pair instead of
 # PUBLIC_BRIDGE.  This is intended to be used with
 # Q_USE_PROVIDERNET_FOR_PUBLIC=True.
@@ -51,7 +56,7 @@ Q_L3_ROUTER_PER_TENANT=${Q_L3_ROUTER_PER_TENANT:-True}
 #    Q_USE_PROVIDERNET_FOR_PUBLIC=True
 #    PUBLIC_PHYSICAL_NETWORK=public
 #    OVS_BRIDGE_MAPPINGS=public:br-ex
-Q_USE_PROVIDERNET_FOR_PUBLIC=${Q_USE_PROVIDERNET_FOR_PUBLIC:-False}
+Q_USE_PROVIDERNET_FOR_PUBLIC=${Q_USE_PROVIDERNET_FOR_PUBLIC:-True}
 PUBLIC_PHYSICAL_NETWORK=${PUBLIC_PHYSICAL_NETWORK:-public}
 
 # Generate 40-bit IPv6 Global ID to comply with RFC 4193
@@ -327,7 +332,7 @@ function _neutron_configure_router_v4 {
             local cidr_len=${FLOATING_RANGE#*/}
             local testcmd="ip -o link | grep -q $ext_gw_interface"
             test_with_retry "$testcmd" "$ext_gw_interface creation failed"
-            if [[ $(ip addr show dev $ext_gw_interface | grep -c $ext_gw_ip) == 0 && ( $Q_USE_PROVIDERNET_FOR_PUBLIC == "False" || $Q_USE_PUBLIC_VETH == "True" ) ]]; then
+            if [[ $(ip addr show dev $ext_gw_interface | grep -c $ext_gw_ip) == 0 && ( $Q_USE_PROVIDERNET_FOR_PUBLIC == "False" || $Q_USE_PUBLIC_VETH == "True" || $Q_ASSIGN_GATEWAY_TO_PUBLIC_BRIDGE == "True" ) ]]; then
                 sudo ip addr add $ext_gw_ip/$cidr_len dev $ext_gw_interface
                 sudo ip link set $ext_gw_interface up
             fi

From 69d4a71dfe86e8111101dcd1bcf5a4138a7956a4 Mon Sep 17 00:00:00 2001
From: Lance Bragstad <lbragstad@gmail.com>
Date: Sat, 27 Aug 2016 01:01:37 +0000
Subject: [PATCH 0583/2409] Allow setup of credential encryption using fernet

With the addition of encrypted credential in keystone, we need to be able to
add setup steps in devstack to configure the credential repository with
encryption keys.

Depends-On: I97e7701bc5b8765d207cc721793643bcefa2d4e2
Depends-On: Id3e8922adc154cfec5f7a36613e22eb0b49eeffe
Change-Id: I433da9a257daa21ec3b5996b2bca571211f1fbba
---
 lib/keystone | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/lib/keystone b/lib/keystone
index 6198e43b58..797ff50646 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -345,6 +345,8 @@ function configure_keystone {
 
     iniset $KEYSTONE_CONF fernet_tokens key_repository "$KEYSTONE_CONF_DIR/fernet-keys/"
 
+    iniset $KEYSTONE_CONF credential key_repository "$KEYSTONE_CONF_DIR/credential-keys/"
+
     # Configure the project created by the 'keystone-manage bootstrap' as the cloud-admin project.
     # The users from this project are globally admin as before, but it also
     # allows policy changes in order to clarify the adminess scope.
@@ -514,6 +516,9 @@ function init_keystone {
         rm -rf "$KEYSTONE_CONF_DIR/fernet-keys/"
         $KEYSTONE_BIN_DIR/keystone-manage --config-file $KEYSTONE_CONF fernet_setup
     fi
+    rm -rf "$KEYSTONE_CONF_DIR/credential-keys/"
+    $KEYSTONE_BIN_DIR/keystone-manage --config-file $KEYSTONE_CONF credential_setup
+
 }
 
 # install_keystoneauth() - Collect source and prepare

From 8f586fbefe10893343c6cf9d906f1e6734e89e88 Mon Sep 17 00:00:00 2001
From: Janki Chhatbar <jchhatba@redhat.com>
Date: Mon, 18 Jul 2016 08:19:25 +0530
Subject: [PATCH 0584/2409] Start virtlogd service

Ensure the virtlogd service is started, to work-around various
platform issues where it isn't started correctly.

Closes-Bug: #1603009
Change-Id: I548b377df6b2f0c287429e4387ee33184a82a64d
---
 lib/nova_plugins/functions-libvirt | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index 4e5a748e45..cc013c3181 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -124,6 +124,12 @@ EOF
     # Service needs to be started on redhat/fedora -- do a restart for
     # sanity after fiddling the config.
     restart_service $LIBVIRT_DAEMON
+
+    # Restart virtlogd companion service to ensure it is running properly
+    #  https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1577455
+    #  https://bugzilla.redhat.com/show_bug.cgi?id=1290357
+    # (not all platforms have it; libvirt 1.3+ only, thus the ignore)
+    restart_service virtlogd || true
 }
 
 

From 26edd7b071f84e2fd2a9953086209e02b0c27ef3 Mon Sep 17 00:00:00 2001
From: Huan Xie <huan.xie@citrix.com>
Date: Mon, 8 Aug 2016 07:23:36 +0000
Subject: [PATCH 0585/2409] Install conntrack in XenServer Dom0

Neutron openvswitch agent running in compute node will control the
actual connection of the VMs in Dom0 via conntrack-tools, but Dom0
doesn't install conntrack-tools RPM by default.
This patch is to add such support with XenServer 7.0 and above.

Change-Id: Iec56db761015d4b7baa5a5f54314f4ff3fa67e02
---
 lib/nova_plugins/hypervisor-xenserver |  1 +
 tools/xen/functions                   | 22 ++++++++++++++++++++++
 2 files changed, 23 insertions(+)

diff --git a/lib/nova_plugins/hypervisor-xenserver b/lib/nova_plugins/hypervisor-xenserver
index e75226ae64..e5d25da3a3 100644
--- a/lib/nova_plugins/hypervisor-xenserver
+++ b/lib/nova_plugins/hypervisor-xenserver
@@ -87,6 +87,7 @@ CRONTAB
         cat $TOP_DIR/tools/xen/functions
         echo "create_directory_for_images"
         echo "create_directory_for_kernels"
+        echo "install_conntrack_tools"
     } | $ssh_dom0
 
 }
diff --git a/tools/xen/functions b/tools/xen/functions
index cf145686b5..e1864eb4bb 100644
--- a/tools/xen/functions
+++ b/tools/xen/functions
@@ -305,3 +305,25 @@ function get_domid {
 
     xe vm-list name-label="$vm_name_label" params=dom-id minimal=true
 }
+
+function install_conntrack_tools {
+    local xs_host
+    local xs_ver_major
+    local centos_ver
+    local conntrack_conf
+    xs_host=$(xe host-list --minimal)
+    xs_ver_major=$(xe host-param-get uuid=$xs_host param-name=software-version param-key=product_version_text_short | cut -d'.' -f 1)
+    if [ $xs_ver_major -gt 6 ]; then
+        # Only support conntrack-tools in Dom0 with XS7.0 and above
+        if [ ! -f /usr/sbin/conntrackd ]; then
+            sed -i s/#baseurl=/baseurl=/g /etc/yum.repos.d/CentOS-Base.repo
+            centos_ver=$(yum version nogroups |grep Installed | cut -d' ' -f 2 | cut -d'.' -f1-2 | tr '-' '.')
+            yum install -y --enablerepo=base --releasever=$centos_ver conntrack-tools
+            # Backup conntrackd.conf after install conntrack-tools, use the one with statistic mode
+            mv /etc/conntrackd/conntrackd.conf /etc/conntrackd/conntrackd.conf.back
+            conntrack_conf=$(find /usr/share/doc -name conntrackd.conf |grep stats)
+            cp $conntrack_conf /etc/conntrackd/conntrackd.conf
+        fi
+        service conntrackd restart
+    fi
+}

From 4d6017566a2fd550b418609c8452e6cf35dd29a7 Mon Sep 17 00:00:00 2001
From: Chris Dent <cdent@anticdent.org>
Date: Tue, 12 Jul 2016 19:34:09 +0000
Subject: [PATCH 0586/2409] Add support for placement API to devstack

Uses lib/placement, but relies on some functionality from
lib/nova. This leads to some weirdness since the nova has
special status in stack.sh. If/when placement is extracted
it may be good to follow the devstack plugin structure
instead.

Because the placement code is currently a part of nova, there
are dependencies in lib/placement on a some $NOVA_* variable
and, if virtenv is being used, the virtualenv used by nova.

Because placement currently runs using nova's configuration
settings, not a lot actually happens in lib/placement: apache
is configured and keystone accounts and endpoints are created.

If PLACEMENT_DB_ENABLED is true then a separate placement db
will be configured.

When complete the initial version of the placement service will
provide support for managing resource providers, inventories and
allocations.

The placement api only runs under mod-wsgi.

Change-Id: I53dd3e6b41de17387a0e179fc9ac64c143b6a9eb
---
 clean.sh                            |   1 +
 files/apache-placement-api.template |  25 ++++
 lib/placement                       | 201 ++++++++++++++++++++++++++++
 stack.sh                            |  17 +++
 unstack.sh                          |   5 +
 5 files changed, 249 insertions(+)
 create mode 100644 files/apache-placement-api.template
 create mode 100644 lib/placement

diff --git a/clean.sh b/clean.sh
index 452df02d80..bace3f53fe 100755
--- a/clean.sh
+++ b/clean.sh
@@ -46,6 +46,7 @@ source $TOP_DIR/lib/horizon
 source $TOP_DIR/lib/keystone
 source $TOP_DIR/lib/glance
 source $TOP_DIR/lib/nova
+source $TOP_DIR/lib/placement
 source $TOP_DIR/lib/cinder
 source $TOP_DIR/lib/swift
 source $TOP_DIR/lib/heat
diff --git a/files/apache-placement-api.template b/files/apache-placement-api.template
new file mode 100644
index 0000000000..b89ef96776
--- /dev/null
+++ b/files/apache-placement-api.template
@@ -0,0 +1,25 @@
+Listen %PUBLICPORT%
+
+<VirtualHost *:%PUBLICPORT%>
+    WSGIDaemonProcess placement-api processes=%APIWORKERS% threads=1 user=%USER% display-name=%{GROUP} %VIRTUALENV%
+    WSGIProcessGroup placement-api
+    WSGIScriptAlias / %PUBLICWSGI%
+    WSGIApplicationGroup %{GLOBAL}
+    WSGIPassAuthorization On
+    <IfVersion >= 2.4>
+      ErrorLogFormat "%M"
+    </IfVersion>
+    ErrorLog /var/log/%APACHE_NAME%/placement-api.log
+    %SSLENGINE%
+    %SSLCERTFILE%
+    %SSLKEYFILE%
+</VirtualHost>
+
+Alias /placement %PUBLICWSGI%
+<Location /placement>
+    SetHandler wsgi-script
+    Options +ExecCGI
+    WSGIProcessGroup placement-api
+    WSGIApplicationGroup %{GLOBAL}
+    WSGIPassAuthorization On
+</Location>
diff --git a/lib/placement b/lib/placement
new file mode 100644
index 0000000000..4e80c55c26
--- /dev/null
+++ b/lib/placement
@@ -0,0 +1,201 @@
+#!/bin/bash
+#
+# lib/placement
+# Functions to control the configuration and operation of the **Placement** service
+#
+# Currently the placement service is embedded in nova. Eventually we
+# expect this to change so this file is started as a separate entity
+# despite making use of some *NOVA* variables and files.
+
+# Dependencies:
+#
+# - ``functions`` file
+# - ``DEST``, ``DATA_DIR``, ``STACK_USER`` must be defined
+# - ``FILES``
+
+# ``stack.sh`` calls the entry points in this order:
+#
+# - install_placement
+# - cleanup_placement
+# - configure_placement
+# - init_placement
+# - start_placement
+# - stop_placement
+
+# Save trace setting
+_XTRACE_LIB_PLACEMENT=$(set +o | grep xtrace)
+set +o xtrace
+
+# Defaults
+# --------
+
+PLACEMENT_CONF_DIR=/etc/nova
+PLACEMENT_CONF=$PLACEMENT_CONF_DIR/nova.conf
+PLACEMENT_AUTH_STRATEGY=${PLACEMENT_AUTH_STRATEGY:-placement}
+
+
+# The placement service can optionally use a separate database
+# connection. Set PLACEMENT_DB_ENABLED to True to use it.
+# NOTE(cdent): This functionality depends on some code that is not
+# yet merged in nova but is coming soon.
+PLACEMENT_DB_ENABLED=$(trueorfalse False PLACEMENT_DB_ENABLED)
+
+if is_suse; then
+    PLACEMENT_WSGI_DIR=${PLACEMENT_WSGI_DIR:-/srv/www/htdocs/placement}
+else
+    PLACEMENT_WSGI_DIR=${PLACEMENT_WSGI_DIR:-/var/www/placement}
+fi
+
+if is_ssl_enabled_service "placement-api" || is_service_enabled tls-proxy; then
+    PLACEMENT_SERVICE_PROTOCOL="https"
+fi
+
+# Public facing bits
+PLACEMENT_SERVICE_PROTOCOL=${PLACEMENT_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
+PLACEMENT_SERVICE_HOST=${PLACEMENT_SERVICE_HOST:-$SERVICE_HOST}
+PLACEMENT_SERVICE_PORT=${PLACEMENT_SERVICE_PORT:-8778}
+
+# Functions
+# ---------
+
+# Test if any placement services are enabled
+# is_placement_enabled
+function is_placement_enabled {
+    [[ ,${ENABLED_SERVICES} =~ ,"placement-" ]] && return 0
+    return 1
+}
+
+# cleanup_placement() - Remove residual data files, anything left over from previous
+# runs that a clean run would need to clean up
+function cleanup_placement {
+    sudo rm -f $(apache_site_config_for placement-api)
+}
+
+# _config_placement_apache_wsgi() - Set WSGI config files
+function _config_placement_apache_wsgi {
+    sudo mkdir -p $PLACEMENT_WSGI_DIR
+
+    local placement_api_apache_conf
+    local placement_api_port=$PLACEMENT_SERVICE_PORT
+    local venv_path=""
+    placement_api_apache_conf=$(apache_site_config_for placement-api)
+
+    # reuse nova's cert if a cert is being used
+    if is_ssl_enabled_service "placement-api"; then
+        placement_ssl="SSLEngine On"
+        placement_certfile="SSLCertificateFile $NOVA_SSL_CERT"
+        placement_keyfile="SSLCertificateKeyFile $NOVA_SSL_KEY"
+    fi
+    # reuse nova's venv if there is one as placement code lives
+    # there
+    if [[ ${USE_VENV} = True ]]; then
+        venv_path="python-path=${PROJECT_VENV["nova"]}/lib/$(python_version)/site-packages"
+    fi
+
+    # copy wsgi application file
+    sudo cp $NOVA_DIR/nova/api/openstack/placement/placement-api.py $PLACEMENT_WSGI_DIR/placement-api
+
+    sudo cp $FILES/apache-placement-api.template $placement_api_apache_conf
+    sudo sed -e "
+        s|%PUBLICPORT%|$placement_api_port|g;
+        s|%APACHE_NAME%|$APACHE_NAME|g;
+        s|%PUBLICWSGI%|$PLACEMENT_WSGI_DIR/placement-api|g;
+        s|%SSLENGINE%|$placement_ssl|g;
+        s|%SSLCERTFILE%|$placement_certfile|g;
+        s|%SSLKEYFILE%|$placement_keyfile|g;
+        s|%USER%|$STACK_USER|g;
+        s|%VIRTUALENV%|$venv_path|g
+        s|%APIWORKERS%|$API_WORKERS|g
+    " -i $placement_api_apache_conf
+}
+
+# configure_placement() - Set config files, create data dirs, etc
+function configure_placement {
+    if [ "$PLACEMENT_DB_ENABLED" != False ]; then
+        iniset $PLACEMENT_CONF placement_database connection `database_connection_url placement`
+    fi
+
+    iniset $NOVA_CONF placement auth_type "password"
+    iniset $NOVA_CONF placement auth_url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_AUTH_PORT/v3"
+    iniset $NOVA_CONF placement username placement
+    iniset $NOVA_CONF placement password "$SERVICE_PASSWORD"
+    iniset $NOVA_CONF placement user_domain_name "Default"
+    iniset $NOVA_CONF placement project_name "$SERVICE_TENANT_NAME"
+    iniset $NOVA_CONF placement project_domain_name "Default"
+    iniset $NOVA_CONF placement region_name "$REGION_NAME"
+    # TODO(cdent): auth_strategy, which is common to see in these
+    # blocks is not currently used here. For the time being the
+    # placement api uses the auth_strategy configuration setting
+    # established by the nova api. This avoids, for the time, being,
+    # creating redundant configuration items that are just used for
+    # testing.
+
+    _config_placement_apache_wsgi
+}
+
+# create_placement_accounts() - Set up required placement accounts
+# and service and endpoints.
+function create_placement_accounts {
+    create_service_user "placement" "admin"
+    local placement_api_url="$PLACEMENT_SERVICE_PROTOCOL://$PLACEMENT_SERVICE_HOST/placement"
+    get_or_create_service "placement" "placement" "Placement Service"
+    get_or_create_endpoint \
+        "placement" \
+        "$REGION_NAME" \
+        "$placement_api_url" \
+        "$placement_api_url" \
+        "$placement_api_url"
+}
+
+# init_placement() - Create service user and endpoints
+# If PLACEMENT_DB_ENABLED is true, create the separate placement db
+# using, for now, the api_db migrations.
+function init_placement {
+    if [ "$PLACEMENT_DB_ENABLED" != False ]; then
+        recreate_database placement
+        $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF api_db sync
+    fi
+    create_placement_accounts
+}
+
+# install_placement() - Collect source and prepare
+function install_placement {
+    install_apache_wsgi
+    if is_ssl_enabled_service "placement-api"; then
+        enable_mod_ssl
+    fi
+}
+
+# start_placement_api() - Start the API processes ahead of other things
+function start_placement_api {
+    # Get right service port for testing
+    local service_port=$PLACEMENT_SERVICE_PORT
+    local placement_api_port=$PLACEMENT_SERVICE_PORT
+
+    enable_apache_site placement-api
+    restart_apache_server
+    tail_log placement-api /var/log/$APACHE_NAME/placement-api.log
+
+    echo "Waiting for placement-api to start..."
+    if ! wait_for_service $SERVICE_TIMEOUT $PLACEMENT_SERVICE_PROTOCOL://$PLACEMENT_SERVICE_HOST/placement; then
+        die $LINENO "placement-api did not start"
+    fi
+}
+
+function start_placement {
+    start_placement_api
+}
+
+# stop_placement() - Disable the api service and stop it.
+function stop_placement {
+    disable_apache_site placement-api
+    restart_apache_server
+}
+
+# Restore xtrace
+$_XTRACE_LIB_PLACEMENT
+
+# Tell emacs to use shell-script-mode
+## Local variables:
+## mode: shell-script
+## End:
diff --git a/stack.sh b/stack.sh
index 98cdfc40df..cf157ab520 100755
--- a/stack.sh
+++ b/stack.sh
@@ -569,6 +569,7 @@ source $TOP_DIR/lib/horizon
 source $TOP_DIR/lib/keystone
 source $TOP_DIR/lib/glance
 source $TOP_DIR/lib/nova
+source $TOP_DIR/lib/placement
 source $TOP_DIR/lib/cinder
 source $TOP_DIR/lib/swift
 source $TOP_DIR/lib/heat
@@ -859,6 +860,13 @@ if is_service_enabled nova; then
     configure_nova
 fi
 
+if is_service_enabled placement; then
+    # placement api
+    stack_install_service placement
+    cleanup_placement
+    configure_placement
+fi
+
 if is_service_enabled horizon; then
     # django openstack_auth
     install_django_openstack_auth
@@ -1160,6 +1168,11 @@ if is_service_enabled nova; then
     init_nova_cells
 fi
 
+if is_service_enabled placement; then
+    echo_summary "Configuring placement"
+    init_placement
+fi
+
 
 # Extras Configuration
 # ====================
@@ -1265,6 +1278,10 @@ if is_service_enabled nova; then
     start_nova
     create_flavors
 fi
+if is_service_enabled placement; then
+    echo_summary "Starting Placement"
+    start_placement
+fi
 if is_service_enabled cinder; then
     echo_summary "Starting Cinder"
     start_cinder
diff --git a/unstack.sh b/unstack.sh
index ece69acad8..d93b8353db 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -63,6 +63,7 @@ source $TOP_DIR/lib/horizon
 source $TOP_DIR/lib/keystone
 source $TOP_DIR/lib/glance
 source $TOP_DIR/lib/nova
+source $TOP_DIR/lib/placement
 source $TOP_DIR/lib/cinder
 source $TOP_DIR/lib/swift
 source $TOP_DIR/lib/heat
@@ -111,6 +112,10 @@ if is_service_enabled nova; then
     stop_nova
 fi
 
+if is_service_enabled placement; then
+    stop_placement
+fi
+
 if is_service_enabled glance; then
     stop_glance
 fi

From 5237d16d69cf54487b72dd8d12862cb4339efcbc Mon Sep 17 00:00:00 2001
From: Eric Harney <eharney@redhat.com>
Date: Tue, 30 Aug 2016 10:59:52 -0400
Subject: [PATCH 0587/2409] LVM: Handle missing loop device at cleanup

When the loop device is not present because something
has gone wrong, this will print an error:
"losetup: option requires an argument -- 'd'"

Just skip the losetup -d in this case.

Change-Id: Iedc439b1ae924e9a599f6522eb081b83d43190c7
---
 lib/lvm | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/lvm b/lib/lvm
index b9d7c390a2..d35a76fb5f 100644
--- a/lib/lvm
+++ b/lib/lvm
@@ -58,7 +58,9 @@ function _clean_lvm_backing_file {
     if [[ -n "$backing_file" ]] && [[ -e "$backing_file" ]]; then
         local vg_dev
         vg_dev=$(sudo losetup -j $backing_file | awk -F':' '/'$BACKING_FILE_SUFFIX'/ { print $1}')
-        sudo losetup -d $vg_dev
+        if [[ -n "$vg_dev" ]]; then
+            sudo losetup -d $vg_dev
+        fi
         rm -f $backing_file
     fi
 }

From c9f6327844c794789ea3c3905cc8e04523262f71 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Tue, 30 Aug 2016 17:21:30 -0400
Subject: [PATCH 0588/2409] Remove lib/ceph

All jobs using ceph as a storage backend have been moved over
to using the devstack-plugin-ceph repo in project-config so we
should be safe to remove the now unused lib/ceph file.

The files are left in place because the devstack plugin does not
install xfsprogs but it's used by the create_disk function.

And the ceph cinder backend file is left in place since the
devstack-plugin-ceph repo uses that by setting
CINDER_ENABLED_BACKENDS=${CINDER_ENABLED_BACKENDS:-ceph}.

Change-Id: I3fb09fc92bc6ab614e86d701ea46d5741a76b7a8
---
 extras.d/60-ceph.sh |  75 ---------
 functions-common    |   2 +-
 lib/ceph            | 381 --------------------------------------------
 3 files changed, 1 insertion(+), 457 deletions(-)
 delete mode 100644 extras.d/60-ceph.sh
 delete mode 100644 lib/ceph

diff --git a/extras.d/60-ceph.sh b/extras.d/60-ceph.sh
deleted file mode 100644
index cc90128176..0000000000
--- a/extras.d/60-ceph.sh
+++ /dev/null
@@ -1,75 +0,0 @@
-# ceph.sh - DevStack extras script to install Ceph
-
-if is_service_enabled ceph; then
-    if [[ "$1" == "source" ]]; then
-        # Initial source
-        source $TOP_DIR/lib/ceph
-    elif [[ "$1" == "stack" && "$2" == "pre-install" ]]; then
-        echo_summary "Installing Ceph"
-        check_os_support_ceph
-        if [ "$REMOTE_CEPH" = "False" ]; then
-            install_ceph
-            echo_summary "Configuring Ceph"
-            configure_ceph
-            # NOTE (leseb): Do everything here because we need to have Ceph started before the main
-            # OpenStack components. Ceph OSD must start here otherwise we can't upload any images.
-            echo_summary "Initializing Ceph"
-            init_ceph
-            start_ceph
-        else
-            install_ceph_remote
-        fi
-    elif [[ "$1" == "stack" && "$2" == "post-config" ]]; then
-        if is_service_enabled glance; then
-            echo_summary "Configuring Glance for Ceph"
-            configure_ceph_glance
-        fi
-        if is_service_enabled nova; then
-            echo_summary "Configuring Nova for Ceph"
-            configure_ceph_nova
-        fi
-        if is_service_enabled cinder; then
-            echo_summary "Configuring Cinder for Ceph"
-            configure_ceph_cinder
-        fi
-        if is_service_enabled n-cpu; then
-            # NOTE (leseb): the part below is a requirement to attach Ceph block devices
-            echo_summary "Configuring libvirt secret"
-            import_libvirt_secret_ceph
-        fi
-
-        if [ "$REMOTE_CEPH" = "False" ]; then
-            if is_service_enabled glance; then
-                echo_summary "Configuring Glance for Ceph"
-                configure_ceph_embedded_glance
-            fi
-            if is_service_enabled nova; then
-                echo_summary "Configuring Nova for Ceph"
-                configure_ceph_embedded_nova
-            fi
-            if is_service_enabled cinder; then
-                echo_summary "Configuring Cinder for Ceph"
-                configure_ceph_embedded_cinder
-            fi
-        fi
-    fi
-
-    if [[ "$1" == "unstack" ]]; then
-        if [ "$REMOTE_CEPH" = "True" ]; then
-            cleanup_ceph_remote
-        else
-            cleanup_ceph_embedded
-            stop_ceph
-        fi
-        cleanup_ceph_general
-    fi
-
-    if [[ "$1" == "clean" ]]; then
-        if [ "$REMOTE_CEPH" = "True" ]; then
-            cleanup_ceph_remote
-        else
-            cleanup_ceph_embedded
-        fi
-        cleanup_ceph_general
-    fi
-fi
diff --git a/functions-common b/functions-common
index 3fdd71bffc..6312188ea8 100644
--- a/functions-common
+++ b/functions-common
@@ -1880,7 +1880,7 @@ function run_phase {
             # white listed elements in tree. We want these to move out
             # over time as well, but they are in tree, so we need to
             # manage that.
-            local exceptions="60-ceph.sh 80-tempest.sh"
+            local exceptions="80-tempest.sh"
             local extra
             extra=$(basename $extra_plugin_file_name)
             if [[ ! ( $exceptions =~ "$extra" ) ]]; then
diff --git a/lib/ceph b/lib/ceph
deleted file mode 100644
index 1e55c48d68..0000000000
--- a/lib/ceph
+++ /dev/null
@@ -1,381 +0,0 @@
-#!/bin/bash
-#
-# lib/ceph
-# Functions to control the configuration and operation of the **Ceph** storage service
-
-# Dependencies:
-#
-# - ``functions`` file
-# - ``CEPH_DATA_DIR`` or ``DATA_DIR`` must be defined
-
-# ``stack.sh`` calls the entry points in this order (via ``extras.d/60-ceph.sh``):
-#
-# - install_ceph
-# - configure_ceph
-# - init_ceph
-# - start_ceph
-# - stop_ceph
-# - cleanup_ceph
-
-# Save trace setting
-_XTRACE_LIB_CEPH=$(set +o | grep xtrace)
-set +o xtrace
-
-
-# Defaults
-# --------
-
-# Set ``CEPH_DATA_DIR`` to the location of Ceph drives and objects.
-# Default is the common DevStack data directory.
-CEPH_DATA_DIR=${CEPH_DATA_DIR:-/var/lib/ceph}
-CEPH_DISK_IMAGE=${CEPH_DATA_DIR}/drives/images/ceph.img
-
-# Set ``CEPH_CONF_DIR`` to the location of the configuration files.
-# Default is ``/etc/ceph``.
-CEPH_CONF_DIR=${CEPH_CONF_DIR:-/etc/ceph}
-
-# DevStack will create a loop-back disk formatted as XFS to store the
-# Ceph data. Set ``CEPH_LOOPBACK_DISK_SIZE`` to the disk size in
-# kilobytes.
-# Default is 1 gigabyte.
-CEPH_LOOPBACK_DISK_SIZE_DEFAULT=4G
-CEPH_LOOPBACK_DISK_SIZE=${CEPH_LOOPBACK_DISK_SIZE:-$CEPH_LOOPBACK_DISK_SIZE_DEFAULT}
-
-# Common
-CEPH_FSID=$(uuidgen)
-CEPH_CONF_FILE=${CEPH_CONF_DIR}/ceph.conf
-
-# Glance
-GLANCE_CEPH_USER=${GLANCE_CEPH_USER:-glance}
-GLANCE_CEPH_POOL=${GLANCE_CEPH_POOL:-images}
-GLANCE_CEPH_POOL_PG=${GLANCE_CEPH_POOL_PG:-8}
-GLANCE_CEPH_POOL_PGP=${GLANCE_CEPH_POOL_PGP:-8}
-
-# Nova
-NOVA_CEPH_POOL=${NOVA_CEPH_POOL:-vms}
-NOVA_CEPH_POOL_PG=${NOVA_CEPH_POOL_PG:-8}
-NOVA_CEPH_POOL_PGP=${NOVA_CEPH_POOL_PGP:-8}
-
-# Cinder
-CINDER_CEPH_POOL=${CINDER_CEPH_POOL:-volumes}
-CINDER_CEPH_POOL_PG=${CINDER_CEPH_POOL_PG:-8}
-CINDER_CEPH_POOL_PGP=${CINDER_CEPH_POOL_PGP:-8}
-CINDER_CEPH_USER=${CINDER_CEPH_USER:-cinder}
-CINDER_CEPH_UUID=${CINDER_CEPH_UUID:-$(uuidgen)}
-
-# Set ``CEPH_REPLICAS`` to configure how many replicas are to be
-# configured for your Ceph cluster. By default we are configuring
-# only one replica since this is way less CPU and memory intensive. If
-# you are planning to test Ceph replication feel free to increase this value
-CEPH_REPLICAS=${CEPH_REPLICAS:-1}
-CEPH_REPLICAS_SEQ=$(seq ${CEPH_REPLICAS})
-
-# Connect to an existing Ceph cluster
-REMOTE_CEPH=$(trueorfalse False REMOTE_CEPH)
-REMOTE_CEPH_ADMIN_KEY_PATH=${REMOTE_CEPH_ADMIN_KEY_PATH:-$CEPH_CONF_DIR/ceph.client.admin.keyring}
-
-# Cinder encrypted volume tests are not supported with a Ceph backend due to
-# bug 1463525.
-ATTACH_ENCRYPTED_VOLUME_AVAILABLE=False
-
-
-# Functions
-# ------------
-
-function get_ceph_version {
-    local ceph_version_str
-    ceph_version_str=$(sudo ceph daemon mon.$(hostname) version | cut -d '"' -f 4 | cut -f 1,2 -d '.')
-    echo $ceph_version_str
-}
-
-# import_libvirt_secret_ceph() - Imports Cinder user key into libvirt
-# so it can connect to the Ceph cluster while attaching a Cinder block device
-function import_libvirt_secret_ceph {
-    cat > secret.xml <<EOF
-<secret ephemeral='no' private='no'>
-   <uuid>${CINDER_CEPH_UUID}</uuid>
-   <usage type='ceph'>
-     <name>client.${CINDER_CEPH_USER} secret</name>
-   </usage>
-</secret>
-EOF
-    sudo virsh secret-define --file secret.xml
-    sudo virsh secret-set-value --secret ${CINDER_CEPH_UUID} --base64 $(sudo ceph -c ${CEPH_CONF_FILE} auth get-key client.${CINDER_CEPH_USER})
-    sudo rm -f secret.xml
-}
-
-# undefine_virsh_secret() - Undefine Cinder key secret from libvirt
-function undefine_virsh_secret {
-    if is_service_enabled cinder || is_service_enabled nova; then
-        local virsh_uuid
-        virsh_uuid=$(sudo virsh secret-list | awk '/^ ?[0-9a-z]/ { print $1 }')
-        sudo virsh secret-undefine ${virsh_uuid} >/dev/null 2>&1
-    fi
-}
-
-
-# check_os_support_ceph() - Check if the operating system provides a decent version of Ceph
-function check_os_support_ceph {
-    if [[ ! ${DISTRO} =~ (trusty|f23|f24) ]]; then
-        echo "WARNING: your distro $DISTRO does not provide (at least) the Firefly release. Please use Ubuntu Trusty or Fedora 20 (and higher)"
-        if [[ "$FORCE_CEPH_INSTALL" != "yes" ]]; then
-            die $LINENO "If you wish to install Ceph on this distribution anyway run with FORCE_CEPH_INSTALL=yes"
-        fi
-        NO_UPDATE_REPOS=False
-    fi
-}
-
-# cleanup_ceph() - Remove residual data files, anything left over from previous
-# runs that a clean run would need to clean up
-function cleanup_ceph_remote {
-    # do a proper cleanup from here to avoid leftover on the remote Ceph cluster
-    if is_service_enabled glance; then
-        sudo ceph osd pool delete $GLANCE_CEPH_POOL $GLANCE_CEPH_POOL --yes-i-really-really-mean-it > /dev/null 2>&1
-        sudo ceph auth del client.$GLANCE_CEPH_USER > /dev/null 2>&1
-    fi
-    if is_service_enabled cinder; then
-        sudo ceph osd pool delete $CINDER_CEPH_POOL $CINDER_CEPH_POOL --yes-i-really-really-mean-it > /dev/null 2>&1
-        sudo ceph auth del client.$CINDER_CEPH_USER > /dev/null 2>&1
-    fi
-    if is_service_enabled c-bak; then
-        sudo ceph osd pool delete $CINDER_BAK_CEPH_POOL $CINDER_BAK_CEPH_POOL --yes-i-really-really-mean-it > /dev/null 2>&1
-        sudo ceph auth del client.$CINDER_BAK_CEPH_USER > /dev/null 2>&1
-    fi
-    if is_service_enabled nova; then
-        iniset $NOVA_CONF libvirt rbd_secret_uuid ""
-        sudo ceph osd pool delete $NOVA_CEPH_POOL $NOVA_CEPH_POOL --yes-i-really-really-mean-it > /dev/null 2>&1
-    fi
-}
-
-function cleanup_ceph_embedded {
-    sudo killall -w -9 ceph-mon
-    sudo killall -w -9 ceph-osd
-    sudo rm -rf ${CEPH_DATA_DIR}/*/*
-    if egrep -q ${CEPH_DATA_DIR} /proc/mounts; then
-        sudo umount ${CEPH_DATA_DIR}
-    fi
-    if [[ -e ${CEPH_DISK_IMAGE} ]]; then
-        sudo rm -f ${CEPH_DISK_IMAGE}
-    fi
-
-    # purge ceph config file and keys
-    sudo rm -rf ${CEPH_CONF_DIR}/*
-}
-
-function cleanup_ceph_general {
-    undefine_virsh_secret
-}
-
-
-# configure_ceph() - Set config files, create data dirs, etc
-function configure_ceph {
-    local count=0
-
-    # create a backing file disk
-    create_disk ${CEPH_DISK_IMAGE} ${CEPH_DATA_DIR} ${CEPH_LOOPBACK_DISK_SIZE}
-
-    # populate ceph directory
-    sudo mkdir -p ${CEPH_DATA_DIR}/{bootstrap-mds,bootstrap-osd,mds,mon,osd,tmp}
-
-    # create ceph monitor initial key and directory
-    sudo ceph-authtool /var/lib/ceph/tmp/keyring.mon.$(hostname) \
-        --create-keyring --name=mon. --add-key=$(ceph-authtool --gen-print-key) \
-        --cap mon 'allow *'
-    sudo mkdir /var/lib/ceph/mon/ceph-$(hostname)
-
-    # create a default ceph configuration file
-    sudo tee ${CEPH_CONF_FILE} > /dev/null <<EOF
-[global]
-fsid = ${CEPH_FSID}
-mon_initial_members = $(hostname)
-mon_host = ${SERVICE_HOST}
-auth_cluster_required = cephx
-auth_service_required = cephx
-auth_client_required = cephx
-filestore_xattr_use_omap = true
-osd crush chooseleaf type = 0
-osd journal size = 100
-EOF
-
-    # bootstrap the ceph monitor
-    sudo ceph-mon -c ${CEPH_CONF_FILE} --mkfs -i $(hostname) \
-        --keyring /var/lib/ceph/tmp/keyring.mon.$(hostname)
-
-    if is_ubuntu; then
-        sudo touch /var/lib/ceph/mon/ceph-$(hostname)/upstart
-        sudo initctl emit ceph-mon id=$(hostname)
-    else
-        sudo touch /var/lib/ceph/mon/ceph-$(hostname)/sysvinit
-        sudo service ceph start mon.$(hostname)
-    fi
-
-    # wait for the admin key to come up otherwise we will not be able to do the actions below
-    until [ -f ${CEPH_CONF_DIR}/ceph.client.admin.keyring ]; do
-        echo_summary "Waiting for the Ceph admin key to be ready..."
-
-        count=$(($count + 1))
-        if [ $count -eq 3 ]; then
-            die $LINENO "Maximum of 3 retries reached"
-        fi
-        sleep 5
-    done
-
-    # pools data and metadata were removed in the Giant release so depending on the version we apply different commands
-    local ceph_version
-    ceph_version=$(get_ceph_version)
-    # change pool replica size according to the CEPH_REPLICAS set by the user
-    if [[ ${ceph_version%%.*} -eq 0 ]] && [[ ${ceph_version##*.} -lt 87 ]]; then
-        sudo ceph -c ${CEPH_CONF_FILE} osd pool set rbd size ${CEPH_REPLICAS}
-        sudo ceph -c ${CEPH_CONF_FILE} osd pool set data size ${CEPH_REPLICAS}
-        sudo ceph -c ${CEPH_CONF_FILE} osd pool set metadata size ${CEPH_REPLICAS}
-    else
-        sudo ceph -c ${CEPH_CONF_FILE} osd pool set rbd size ${CEPH_REPLICAS}
-    fi
-
-    # create a simple rule to take OSDs instead of host with CRUSH
-    # then apply this rules to the default pool
-    if [[ $CEPH_REPLICAS -ne 1 ]]; then
-        sudo ceph -c ${CEPH_CONF_FILE} osd crush rule create-simple devstack default osd
-        RULE_ID=$(sudo ceph -c ${CEPH_CONF_FILE} osd crush rule dump devstack | awk '/rule_id/ {print $3}' | cut -d ',' -f1)
-        sudo ceph -c ${CEPH_CONF_FILE} osd pool set rbd crush_ruleset ${RULE_ID}
-        sudo ceph -c ${CEPH_CONF_FILE} osd pool set data crush_ruleset ${RULE_ID}
-        sudo ceph -c ${CEPH_CONF_FILE} osd pool set metadata crush_ruleset ${RULE_ID}
-    fi
-
-    # create the OSD(s)
-    for rep in ${CEPH_REPLICAS_SEQ}; do
-        OSD_ID=$(sudo ceph -c ${CEPH_CONF_FILE} osd create)
-        sudo mkdir -p ${CEPH_DATA_DIR}/osd/ceph-${OSD_ID}
-        sudo ceph-osd -c ${CEPH_CONF_FILE} -i ${OSD_ID} --mkfs
-        sudo ceph -c ${CEPH_CONF_FILE} auth get-or-create osd.${OSD_ID} \
-            mon 'allow profile osd ' osd 'allow *' | \
-            sudo tee ${CEPH_DATA_DIR}/osd/ceph-${OSD_ID}/keyring
-
-        # ceph's init script is parsing ${CEPH_DATA_DIR}/osd/ceph-${OSD_ID}/ and looking for a file
-        # 'upstart' or 'sysinitv', thanks to these 'touches' we are able to control OSDs daemons
-        # from the init script.
-        if is_ubuntu; then
-            sudo touch ${CEPH_DATA_DIR}/osd/ceph-${OSD_ID}/upstart
-        else
-            sudo touch ${CEPH_DATA_DIR}/osd/ceph-${OSD_ID}/sysvinit
-        fi
-    done
-}
-
-function configure_ceph_embedded_glance {
-    # configure Glance service options, ceph pool, ceph user and ceph key
-    sudo ceph -c ${CEPH_CONF_FILE} osd pool set ${GLANCE_CEPH_POOL} size ${CEPH_REPLICAS}
-    if [[ $CEPH_REPLICAS -ne 1 ]]; then
-        sudo ceph -c ${CEPH_CONF_FILE} osd pool set ${GLANCE_CEPH_POOL} crush_ruleset ${RULE_ID}
-    fi
-}
-
-# configure_ceph_glance() - Glance config needs to come after Glance is set up
-function configure_ceph_glance {
-    sudo ceph -c ${CEPH_CONF_FILE} osd pool create ${GLANCE_CEPH_POOL} ${GLANCE_CEPH_POOL_PG} ${GLANCE_CEPH_POOL_PGP}
-    sudo ceph -c ${CEPH_CONF_FILE} auth get-or-create client.${GLANCE_CEPH_USER} \
-        mon "allow r" \
-        osd "allow class-read object_prefix rbd_children, allow rwx pool=${GLANCE_CEPH_POOL}" | \
-        sudo tee ${CEPH_CONF_DIR}/ceph.client.${GLANCE_CEPH_USER}.keyring
-    sudo chown ${STACK_USER}:$(id -g -n $whoami) ${CEPH_CONF_DIR}/ceph.client.${GLANCE_CEPH_USER}.keyring
-
-    iniset $GLANCE_API_CONF DEFAULT show_image_direct_url True
-    iniset $GLANCE_API_CONF glance_store default_store rbd
-    iniset $GLANCE_API_CONF glance_store stores "file, http, rbd"
-    iniset $GLANCE_API_CONF glance_store rbd_store_ceph_conf $CEPH_CONF_FILE
-    iniset $GLANCE_API_CONF glance_store rbd_store_user $GLANCE_CEPH_USER
-    iniset $GLANCE_API_CONF glance_store rbd_store_pool $GLANCE_CEPH_POOL
-}
-
-function configure_ceph_embedded_nova {
-    # configure Nova service options, ceph pool, ceph user and ceph key
-    sudo ceph -c ${CEPH_CONF_FILE} osd pool set ${NOVA_CEPH_POOL} size ${CEPH_REPLICAS}
-    if [[ $CEPH_REPLICAS -ne 1 ]]; then
-        sudo ceph -c ${CEPH_CONF_FILE} osd pool set ${NOVA_CEPH_POOL} crush_ruleset ${RULE_ID}
-    fi
-}
-
-# configure_ceph_nova() - Nova config needs to come after Nova is set up
-function configure_ceph_nova {
-    sudo ceph -c ${CEPH_CONF_FILE} osd pool create ${NOVA_CEPH_POOL} ${NOVA_CEPH_POOL_PG} ${NOVA_CEPH_POOL_PGP}
-    iniset $NOVA_CONF libvirt rbd_user ${CINDER_CEPH_USER}
-    iniset $NOVA_CONF libvirt rbd_secret_uuid ${CINDER_CEPH_UUID}
-    iniset $NOVA_CONF libvirt inject_key false
-    iniset $NOVA_CONF libvirt disk_cachemodes "network=writeback"
-    iniset $NOVA_CONF libvirt images_type rbd
-    iniset $NOVA_CONF libvirt images_rbd_pool ${NOVA_CEPH_POOL}
-    iniset $NOVA_CONF libvirt images_rbd_ceph_conf ${CEPH_CONF_FILE}
-
-    if ! is_service_enabled cinder; then
-        sudo ceph -c ${CEPH_CONF_FILE} auth get-or-create client.${CINDER_CEPH_USER} \
-            mon "allow r" \
-            osd "allow class-read object_prefix rbd_children, allow rwx pool=${CINDER_CEPH_POOL}, allow rwx pool=${NOVA_CEPH_POOL},allow rwx pool=${GLANCE_CEPH_POOL}" | \
-            sudo tee ${CEPH_CONF_DIR}/ceph.client.${CINDER_CEPH_USER}.keyring > /dev/null
-        sudo chown ${STACK_USER}:$(id -g -n $whoami) ${CEPH_CONF_DIR}/ceph.client.${CINDER_CEPH_USER}.keyring
-    fi
-}
-
-function configure_ceph_embedded_cinder {
-    # Configure Cinder service options, ceph pool, ceph user and ceph key
-    sudo ceph -c ${CEPH_CONF_FILE} osd pool set ${CINDER_CEPH_POOL} size ${CEPH_REPLICAS}
-    if [[ $CEPH_REPLICAS -ne 1 ]]; then
-        sudo ceph -c ${CEPH_CONF_FILE} osd pool set ${CINDER_CEPH_POOL} crush_ruleset ${RULE_ID}
-    fi
-}
-
-# configure_ceph_cinder() - Cinder config needs to come after Cinder is set up
-function configure_ceph_cinder {
-    sudo ceph -c ${CEPH_CONF_FILE} osd pool create ${CINDER_CEPH_POOL} ${CINDER_CEPH_POOL_PG} ${CINDER_CEPH_POOL_PGP}
-    sudo ceph -c ${CEPH_CONF_FILE} auth get-or-create client.${CINDER_CEPH_USER} \
-        mon "allow r" \
-        osd "allow class-read object_prefix rbd_children, allow rwx pool=${CINDER_CEPH_POOL}, allow rwx pool=${NOVA_CEPH_POOL},allow rwx pool=${GLANCE_CEPH_POOL}" | \
-        sudo tee ${CEPH_CONF_DIR}/ceph.client.${CINDER_CEPH_USER}.keyring
-    sudo chown ${STACK_USER}:$(id -g -n $whoami) ${CEPH_CONF_DIR}/ceph.client.${CINDER_CEPH_USER}.keyring
-}
-
-# init_ceph() - Initialize databases, etc.
-function init_ceph {
-    # clean up from previous (possibly aborted) runs
-    # make sure to kill all ceph processes first
-    sudo pkill -f ceph-mon || true
-    sudo pkill -f ceph-osd || true
-}
-
-# install_ceph() - Collect source and prepare
-function install_ceph_remote {
-    install_package ceph-common
-}
-
-function install_ceph {
-    install_package ceph
-}
-
-# start_ceph() - Start running processes, including screen
-function start_ceph {
-    if is_ubuntu; then
-        sudo initctl emit ceph-mon id=$(hostname)
-        for id in $(sudo ceph -c ${CEPH_CONF_FILE} osd ls); do
-            sudo start ceph-osd id=${id}
-        done
-    else
-        sudo service ceph start
-    fi
-}
-
-# stop_ceph() - Stop running processes (non-screen)
-function stop_ceph {
-    if is_ubuntu; then
-        sudo service ceph-mon-all stop > /dev/null 2>&1
-        sudo service ceph-osd-all stop > /dev/null 2>&1
-    else
-        sudo service ceph stop > /dev/null 2>&1
-    fi
-}
-
-
-# Restore xtrace
-$_XTRACE_LIB_CEPH
-
-## Local variables:
-## mode: shell-script
-## End:

From 0385caa2ee503486cab1a81dbdda691aa259134c Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Wed, 31 Aug 2016 10:07:06 +1000
Subject: [PATCH 0589/2409] Fix comment in plugin-registry header

Fix the comment to actually be a comment.  Regenerate page.

Although we've got a pretty cool system for generating this, I wonder
if anyone actually looks at it?  Maybe it's just helpful as a form of
SEO.

Change-Id: I15aaa983716f9ee897293c2954ca7ae561951372
---
 data/devstack-plugins-registry.header | 20 +++++++++-----------
 doc/source/plugin-registry.rst        | 20 +++++++++-----------
 2 files changed, 18 insertions(+), 22 deletions(-)

diff --git a/data/devstack-plugins-registry.header b/data/devstack-plugins-registry.header
index 6119ab5284..576dbbd35a 100644
--- a/data/devstack-plugins-registry.header
+++ b/data/devstack-plugins-registry.header
@@ -1,18 +1,16 @@
-..
+.. Note to patch submitters:
 
-  Note to patch submitters:
+   # ============================= #
+   # THIS FILE IS AUTOGENERATED !  #
+   # ============================= #
 
-  # ============================= #
-  # THIS FILE IS AUTOGENERATED !  #
-  # ============================= #
+   ** Plugins are found automatically and added to this list **
 
-  ** Plugins are found automatically and added to this list **
+   This file is created by a periodic proposal job.  You should not
+   edit this file.
 
-  This file is created by a periodic proposal job.  You should not
-  edit this file.
-
-  You should edit the files data/devstack-plugins-registry.footer
-  data/devstack-plugins-registry.header to modify this text.
+   You should edit the files data/devstack-plugins-registry.footer
+   data/devstack-plugins-registry.header to modify this text.
 
 ==========================
  DevStack Plugin Registry
diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index bb8527041e..d6df1efa4f 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -1,18 +1,16 @@
-..
+..  Note to patch submitters:
 
-  Note to patch submitters:
+    # ============================= #
+    # THIS FILE IS AUTOGENERATED !  #
+    # ============================= #
 
-  # ============================= #
-  # THIS FILE IS AUTOGENERATED !  #
-  # ============================= #
+    ** Plugins are found automatically and added to this list **
 
-  ** Plugins are found automatically and added to this list **
+    This file is created by a periodic proposal job.  You should not
+    edit this file.
 
-  This file is created by a periodic proposal job.  You should not
-  edit this file.
-
-  You should edit the files data/devstack-plugins-registry.footer
-  data/devstack-plugins-registry.header to modify this text.
+    You should edit the files data/devstack-plugins-registry.footer
+    data/devstack-plugins-registry.header to modify this text.
 
 ==========================
  DevStack Plugin Registry

From d3fab7bfc16284a24a66f1724805c35535432fc0 Mon Sep 17 00:00:00 2001
From: Ken'ichi Ohmichi <ken-oomichi@wx.jp.nec.com>
Date: Tue, 30 Aug 2016 18:13:52 -0700
Subject: [PATCH 0590/2409] Revert "Allow properly overriding DEST"

After I00847bb6733febf105855ae6fc577a7c904ec4b4, we cannot see the
test result (testr_result.html) on gate jobs.
So let's revert the patch for verifying the test result on the gate.

Change-Id: I9db1ff9f43b22d1634a43c7d5e502cc205aa26f2
Closes-Bug: #1617476
---
 stackrc | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/stackrc b/stackrc
index f7bdbc2b04..c14085a910 100644
--- a/stackrc
+++ b/stackrc
@@ -16,6 +16,15 @@ source $RC_DIR/functions
 # Destination path for installation
 DEST=/opt/stack
 
+# Destination for working data
+DATA_DIR=${DEST}/data
+
+# Destination for status files
+SERVICE_DIR=${DEST}/status
+
+# Path for subunit output file
+SUBUNIT_OUTPUT=${DEST}/devstack.subunit
+
 # Determine stack user
 if [[ $EUID -eq 0 ]]; then
     STACK_USER=stack
@@ -121,15 +130,6 @@ elif [[ -f $RC_DIR/.localrc.auto ]]; then
     source $RC_DIR/.localrc.auto
 fi
 
-# Destination for working data
-DATA_DIR=${DATA_DIR:-$DEST/data}
-
-# Destination for status files
-SERVICE_DIR=${SERVICE_DIR:-$DEST/status}
-
-# Path for subunit output file
-SUBUNIT_OUTPUT=${SUBUNIT_OUTPUT:-$DEST/devstack.subunit}
-
 # Default for log coloring is based on interactive-or-not.
 # Baseline assumption is that non-interactive invocations are for CI,
 # where logs are to be presented as browsable text files; hence color

From 43ff27b7e8e9d209d8f1fc0483da717296be93bc Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 30 Aug 2016 21:13:15 -0400
Subject: [PATCH 0591/2409] Use wsgi-script installed nova-placement-api

We should use the standard install nova-placement-api script which is
managed by the python package instead of a one off copy procedure.

Depends-On: I00d032554de273d7493cfb467f81687c08fd5389

Change-Id: I74b39d6a0cedea7c18ce8080dcddb43d13df1de8
---
 lib/placement | 16 ++++------------
 1 file changed, 4 insertions(+), 12 deletions(-)

diff --git a/lib/placement b/lib/placement
index 4e80c55c26..56a4b56675 100644
--- a/lib/placement
+++ b/lib/placement
@@ -40,12 +40,6 @@ PLACEMENT_AUTH_STRATEGY=${PLACEMENT_AUTH_STRATEGY:-placement}
 # yet merged in nova but is coming soon.
 PLACEMENT_DB_ENABLED=$(trueorfalse False PLACEMENT_DB_ENABLED)
 
-if is_suse; then
-    PLACEMENT_WSGI_DIR=${PLACEMENT_WSGI_DIR:-/srv/www/htdocs/placement}
-else
-    PLACEMENT_WSGI_DIR=${PLACEMENT_WSGI_DIR:-/var/www/placement}
-fi
-
 if is_ssl_enabled_service "placement-api" || is_service_enabled tls-proxy; then
     PLACEMENT_SERVICE_PROTOCOL="https"
 fi
@@ -73,11 +67,11 @@ function cleanup_placement {
 
 # _config_placement_apache_wsgi() - Set WSGI config files
 function _config_placement_apache_wsgi {
-    sudo mkdir -p $PLACEMENT_WSGI_DIR
-
     local placement_api_apache_conf
     local placement_api_port=$PLACEMENT_SERVICE_PORT
     local venv_path=""
+    local nova_bin_dir=""
+    nova_bin_dir=$(get_python_exec_prefix)
     placement_api_apache_conf=$(apache_site_config_for placement-api)
 
     # reuse nova's cert if a cert is being used
@@ -90,16 +84,14 @@ function _config_placement_apache_wsgi {
     # there
     if [[ ${USE_VENV} = True ]]; then
         venv_path="python-path=${PROJECT_VENV["nova"]}/lib/$(python_version)/site-packages"
+        nova_bin_dir=${PROJECT_VENV["nova"]}/bin
     fi
 
-    # copy wsgi application file
-    sudo cp $NOVA_DIR/nova/api/openstack/placement/placement-api.py $PLACEMENT_WSGI_DIR/placement-api
-
     sudo cp $FILES/apache-placement-api.template $placement_api_apache_conf
     sudo sed -e "
         s|%PUBLICPORT%|$placement_api_port|g;
         s|%APACHE_NAME%|$APACHE_NAME|g;
-        s|%PUBLICWSGI%|$PLACEMENT_WSGI_DIR/placement-api|g;
+        s|%PUBLICWSGI%|$nova_bin_dir/nova-placement-api|g;
         s|%SSLENGINE%|$placement_ssl|g;
         s|%SSLCERTFILE%|$placement_certfile|g;
         s|%SSLKEYFILE%|$placement_keyfile|g;

From 11817482c03b3994cde93320f138d5a7ccd821d3 Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@midokura.com>
Date: Thu, 21 Jul 2016 16:02:49 +0900
Subject: [PATCH 0592/2409] lib/neutron: Use NEUTRON_PLUGIN instead of
 hardcoding ml2

Change-Id: Ia60381694f30978984cdf33e3141dc153d294e17
---
 lib/neutron | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron b/lib/neutron
index c1552e3d06..3fbcbd9a4d 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -139,7 +139,7 @@ function configure_neutron_new {
 
         cp $NEUTRON_DIR/etc/api-paste.ini $NEUTRON_CONF_DIR/api-paste.ini
 
-        iniset $NEUTRON_CONF DEFAULT core_plugin ml2
+        iniset $NEUTRON_CONF DEFAULT core_plugin $NEUTRON_PLUGIN
 
         iniset $NEUTRON_CONF DEFAULT policy_file $policy_file
         iniset $NEUTRON_CONF DEFAULT allow_overlapping_ips True

From a25ae6c03de2d87bca4f708ffc338c66164eec3b Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 31 Aug 2016 08:56:37 -0400
Subject: [PATCH 0593/2409] convert apache logs to color for screen

If we left the ansi color codes in apache logs, we can run a sed
script to convert the escaped escapes back to ansi escapes which make
the logs colorized again.

There are 8 \ because we need to end up with 2 in the final sed, and
we get interopolated twice. How much fun is escape interpolation? All
the fun.

Change-Id: Id8531cf03ba80f0df62f20add02e757bd63d4f2d
---
 functions-common | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index 3fdd71bffc..7524eab68f 100644
--- a/functions-common
+++ b/functions-common
@@ -1686,7 +1686,7 @@ function tail_log {
     local logfile=$2
 
     if [[ "$USE_SCREEN" = "True" ]]; then
-        screen_process "$name" "sudo tail -f $logfile"
+        screen_process "$name" "sudo tail -f $logfile | sed 's/\\\\\\\\x1b/\o033/g'"
     fi
 }
 

From 44bf88cd3990c5255e1a0b94842446b8a472b87d Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Wed, 31 Aug 2016 10:39:46 -0400
Subject: [PATCH 0594/2409] Fix region name placement config option

The placement config option for setting the region is
actually 'os_region_name', not 'region_name', see:

https://review.openstack.org/#/c/358797/13/nova/conf/placement.py

Change-Id: I62e79c6860e2329428e3115d14ee86f5ff15d7e8
---
 lib/placement | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/placement b/lib/placement
index 56a4b56675..165c670206 100644
--- a/lib/placement
+++ b/lib/placement
@@ -114,7 +114,7 @@ function configure_placement {
     iniset $NOVA_CONF placement user_domain_name "Default"
     iniset $NOVA_CONF placement project_name "$SERVICE_TENANT_NAME"
     iniset $NOVA_CONF placement project_domain_name "Default"
-    iniset $NOVA_CONF placement region_name "$REGION_NAME"
+    iniset $NOVA_CONF placement os_region_name "$REGION_NAME"
     # TODO(cdent): auth_strategy, which is common to see in these
     # blocks is not currently used here. For the time being the
     # placement api uses the auth_strategy configuration setting

From eb6ef2f80ea11aa7ba3f9ff52cb03704db3547d4 Mon Sep 17 00:00:00 2001
From: Andrew Laski <andrew@lascii.com>
Date: Mon, 29 Aug 2016 10:02:41 -0400
Subject: [PATCH 0595/2409] Create the nova_api_cell0 database

As part of Nova cellsv2 there is now a third database that must be setup
for use by Nova. This database is an exact copy of the 'nova' database.
Only do this if NOVA_CONFIGURE_CELLSV2 is overridden.

Change-Id: I8775b8066ba85fbdbcdfb42c28cb567fc7759fe5
---
 lib/nova | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/lib/nova b/lib/nova
index 235b533d77..f5a798c923 100644
--- a/lib/nova
+++ b/lib/nova
@@ -85,6 +85,9 @@ METADATA_SERVICE_PORT=${METADATA_SERVICE_PORT:-8775}
 # NOTE: Set ``FORCE_CONFIG_DRIVE="False"`` to turn OFF config drive
 FORCE_CONFIG_DRIVE=${FORCE_CONFIG_DRIVE:-"False"}
 
+# Option to initialize CellsV2 environment
+NOVA_CONFIGURE_CELLSV2=$(trueorfalse False NOVA_CONFIGURE_CELLSV2)
+
 # Nova supports pluggable schedulers.  The default ``FilterScheduler``
 # should work in most cases.
 SCHEDULER=${SCHEDULER:-filter_scheduler}
@@ -682,10 +685,15 @@ function init_nova {
     # All nova components talk to a central database.
     # Only do this step once on the API node for an entire cluster.
     if is_service_enabled $DATABASE_BACKENDS && is_service_enabled n-api; then
-        # (Re)create nova database
+        # (Re)create nova databases
         recreate_database nova
+        if [ "$NOVA_CONFIGURE_CELLSV2" != "False" ]; then
+            recreate_database nova_api_cell0
+        fi
 
-        # Migrate nova database
+        # Migrate nova database. If "nova-manage cell_v2 simple_cell_setup" has
+        # been run this migrates the "nova" and "nova_api_cell0" database.
+        # Otherwise it just migrates the "nova" database.
         $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF db sync
 
         if is_service_enabled n-cell; then

From 0bf25506b03c78dd809e3638cabcf1fc11e9f1a0 Mon Sep 17 00:00:00 2001
From: melanie witt <melwittt@gmail.com>
Date: Tue, 30 Aug 2016 22:14:04 +0000
Subject: [PATCH 0596/2409] Move RABBIT_USERID to lib/rpc_backend

This moves setting of RABBIT_USERID from stack.sh to lib/rpc_backend
so it may be used in grenade runs, which don't have the defaulted
value from stack.sh. The RABBIT_USERID is needed in order to call
get_transport_url in lib/rpc_backend.

Change-Id: I6f211e9102f79418f9f94a15784f91c4150ab8a7
---
 lib/rpc_backend | 2 ++
 stack.sh        | 1 -
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/rpc_backend b/lib/rpc_backend
index 0ee46dca6f..97b1aa409a 100644
--- a/lib/rpc_backend
+++ b/lib/rpc_backend
@@ -24,6 +24,8 @@
 _XTRACE_RPC_BACKEND=$(set +o | grep xtrace)
 set +o xtrace
 
+RABBIT_USERID=${RABBIT_USERID:-stackrabbit}
+
 # Functions
 # ---------
 
diff --git a/stack.sh b/stack.sh
index cf157ab520..09466a6894 100755
--- a/stack.sh
+++ b/stack.sh
@@ -664,7 +664,6 @@ initialize_database_backends && echo "Using $DATABASE_TYPE database backend" ||
 # Rabbit connection info
 # In multi node DevStack, second node needs ``RABBIT_USERID``, but rabbit
 # isn't enabled.
-RABBIT_USERID=${RABBIT_USERID:-stackrabbit}
 if is_service_enabled rabbit; then
     RABBIT_HOST=${RABBIT_HOST:-$SERVICE_HOST}
     read_password RABBIT_PASSWORD "ENTER A PASSWORD TO USE FOR RABBIT."

From 542abbab3bc58c40a499531165943df4bf2e4ab0 Mon Sep 17 00:00:00 2001
From: Brant Knudson <bknudson@us.ibm.com>
Date: Wed, 31 Aug 2016 15:47:56 -0500
Subject: [PATCH 0597/2409] Keystone uwsgi set lazy-apps=true
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Keystone had a problem where there was a memcached socket
opened very early on startup which then got shared between
worker processes when running under uwsgi. This can be
prevented by setting lazy-apps so this is the recommended
setting.

See http://uwsgi-docs.readthedocs.io/en/latest/ThingsToKnow.html

"""uWSGI tries to (ab)use the Copy On Write semantics of the
fork() call whenever possible. By default it will fork after
having loaded your applications to share as much of their
memory as possible. If this behavior is undesirable for some
reason, use the lazy-apps option. This will instruct uWSGI to
load the applications after each worker’s fork(). Beware as
there is an older options named lazy that is way more invasive
and highly discouraged (it is still here only for backward
compatibility) """

Change-Id: I6f271dc906528f0c86060452deaf15df81b267d2
Related-Bug: 1600394
---
 lib/keystone | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/keystone b/lib/keystone
index 6198e43b58..6e5d3dc42c 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -338,6 +338,8 @@ function configure_keystone {
             iniset "$file" uwsgi buffer-size 65535
             # Make sure the client doesn't try to re-use the connection.
             iniset "$file" uwsgi add-header "Connection: close"
+            # This ensures that file descriptors aren't shared between processes.
+            iniset "$file" uwsgi lazy-apps true
         done
     fi
 

From eb77eef8a57f8a4d012d8bee316e56b1764919de Mon Sep 17 00:00:00 2001
From: Brant Knudson <bknudson@us.ibm.com>
Date: Wed, 31 Aug 2016 16:26:17 -0500
Subject: [PATCH 0598/2409] Keystone re-enable catalog caching

Catalog caching was disabled due to bug 1537617, but this has been
fixed for some time. Re-enabling to get some performance back.

Change-Id: Ic0edf5c70a5040edf3393dbd1e110ab5fb56c110
Related-Bug: 1537617
---
 lib/keystone | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 6198e43b58..f8119ebeea 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -248,9 +248,6 @@ function configure_keystone {
     iniset $KEYSTONE_CONF cache backend "oslo_cache.memcache_pool"
     iniset $KEYSTONE_CONF cache memcache_servers localhost:11211
 
-    # Do not cache the catalog backend due to https://bugs.launchpad.net/keystone/+bug/1537617
-    iniset $KEYSTONE_CONF catalog caching "False"
-
     iniset_rpc_backend keystone $KEYSTONE_CONF
 
     # Register SSL certificates if provided

From 40b433fb07d2612075a30e2e18fbae094c2c8ec0 Mon Sep 17 00:00:00 2001
From: Clay Gerrard <clay.gerrard@gmail.com>
Date: Thu, 1 Sep 2016 02:07:12 -0700
Subject: [PATCH 0599/2409] Make unstack.sh more independently deterministic

In some initialization conditions (having never ran stack.sh) the
result of unstack.sh is dependent on if the user had previously
installed lvm2 or disabled the cinder service.

This change makes all results the same with a bit of LBYL.

There's also a drive-by to put a comment back where it belongs after
being accidentally moved in the related change.

Related-Change: I09b1a7bee0785e5e1bb7dc96158a654bd3f15c83

Change-Id: I9a7e052677d60cbbbdd582877f3c6c48c387f668
Closes-Bug: #1619195
---
 unstack.sh | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/unstack.sh b/unstack.sh
index d93b8353db..f888896cb9 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -189,11 +189,13 @@ if [[ -n "$SCREEN" ]]; then
     fi
 fi
 
-# BUG: maybe it doesn't exist? We should isolate this further down.
 # NOTE: Cinder automatically installs the lvm2 package, independently of the
-# enabled backends. So if Cinder is enabled, we are sure lvm (lvremove,
-# /etc/lvm/lvm.conf, etc.) is here.
-if is_service_enabled cinder; then
+# enabled backends. So if Cinder is enabled, and installed successfully we are
+# sure lvm2 (lvremove, /etc/lvm/lvm.conf, etc.) is here.
+if is_service_enabled cinder && is_package_installed lvm2; then
+    # Using /bin/true here indicates a BUG - maybe the
+    # DEFAULT_VOLUME_GROUP_NAME doesn't exist?  We should
+    # isolate this further down in lib/cinder cleanup.
     clean_lvm_volume_group $DEFAULT_VOLUME_GROUP_NAME || /bin/true
     clean_lvm_filter
 fi

From 6930ba312f787e0459f7455ac6ba2a70b3c7c37d Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Thu, 1 Sep 2016 07:25:28 -0500
Subject: [PATCH 0600/2409] Specify a cloud for openstack complete

there is a bug in openstackclient that is causing a password prompt

Related-Bug: 1619274
here.

Change-Id: I3aee25845ece846ed2b35aa242dc684b55ac2381
---
 stack.sh | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index 09466a6894..1cc4eca1b9 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1383,7 +1383,12 @@ check_libs_from_git
 # ===============
 
 # Prepare bash completion for OSC
-openstack complete | sudo tee /etc/bash_completion.d/osc.bash_completion > /dev/null
+#
+# BUG: https://bugs.launchpad.net/python-openstackclient/+bug/1619274
+# the os-cloud param should not be required but if we don't provide it
+# then this command hangs indefinitely if something is wrong with
+# default environment credentials.
+openstack --os-cloud=devstack complete | sudo tee /etc/bash_completion.d/osc.bash_completion > /dev/null
 
 # If cinder is configured, set global_filter for PV devices
 if is_service_enabled cinder; then

From 71119b47a0e3fb86b349732a1777be8c83d2e6c2 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Mon, 15 Aug 2016 12:06:55 -0700
Subject: [PATCH 0601/2409] Setup cellsv2 for Nova

This patch setup cellsv2 for Nova after plugin initialization phase.
Since this requires compute hosts to be started, we need to do it
after we have initialized all other plugins. Things like ironic
aren't setup when we were running this as part of nova setup, and
thus this command can fail.

When cellsv1 is used (n-cell is enabled) skip calling
cells_v2 simple_cell_setup, which will never have hosts
at the top level and which will always fail.

Change-Id: Ic7d0115da51d6ea17ee49071af259a7789c62ab9
Depends-On: I9bbaa4c92503222c9fd015fe075926b50f3dcc8c
---
 lib/nova | 9 +++++++++
 stack.sh | 8 ++++++++
 2 files changed, 17 insertions(+)

diff --git a/lib/nova b/lib/nova
index f5a798c923..670f605fd6 100644
--- a/lib/nova
+++ b/lib/nova
@@ -946,6 +946,15 @@ function create_flavors {
     fi
 }
 
+# create_cell(): Group the available hosts into a cell
+function create_cell {
+    if ! is_service_enabled n-cell; then
+        nova-manage cell_v2 simple_cell_setup --transport-url $(get_transport_url)
+    else
+        echo 'Skipping cellsv2 setup for this cellsv1 configuration'
+    fi
+}
+
 # Restore xtrace
 $_XTRACE_LIB_NOVA
 
diff --git a/stack.sh b/stack.sh
index 1cc4eca1b9..4b071841b8 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1379,6 +1379,14 @@ service_check
 check_libs_from_git
 
 
+# Configure nova cellsv2
+# ----------------------
+
+# Do this late because it requires compute hosts to have started
+if is_service_enabled n-api && [ "$NOVA_CONFIGURE_CELLSV2" == "True" ]; then
+    create_cell
+fi
+
 # Bash completion
 # ===============
 

From 085f2fb0e2d399281b137c9fa95a7a39e270be7d Mon Sep 17 00:00:00 2001
From: Ken'ichi Ohmichi <ken-oomichi@wx.jp.nec.com>
Date: Fri, 2 Sep 2016 14:00:39 -0700
Subject: [PATCH 0602/2409] Remove the same configurations as the default

The default value of force_dhcp_release is True on Nova side:
https://github.com/openstack/nova/blob/master/nova/conf/network.py#L306
The default value of vnc.enabled is True on Nova side:
https://github.com/openstack/nova/blob/master/nova/conf/vnc.py#L27
The default value of spice.enabled is False on Nova side:
https://github.com/openstack/nova/blob/master/nova/conf/spice.py#L30

So it is not necessary to set them on Devstack.

Change-Id: I67cc103269d2d612ad443c72f2a77d7ae2ca09e3
---
 lib/nova | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/lib/nova b/lib/nova
index 670f605fd6..8496868821 100644
--- a/lib/nova
+++ b/lib/nova
@@ -461,7 +461,6 @@ function create_nova_conf {
     iniset $NOVA_CONF DEFAULT rootwrap_config "$NOVA_CONF_DIR/rootwrap.conf"
     iniset $NOVA_CONF DEFAULT scheduler_driver "$SCHEDULER"
     iniset $NOVA_CONF DEFAULT scheduler_default_filters "$FILTERS"
-    iniset $NOVA_CONF DEFAULT force_dhcp_release "True"
     iniset $NOVA_CONF DEFAULT default_floating_pool "$PUBLIC_NETWORK_NAME"
     iniset $NOVA_CONF DEFAULT s3_host "$SERVICE_HOST"
     iniset $NOVA_CONF DEFAULT s3_port "$S3_SERVICE_PORT"
@@ -557,7 +556,6 @@ function create_nova_conf {
         # For multi-host, this should be the management ip of the compute host.
         VNCSERVER_LISTEN=${VNCSERVER_LISTEN=$NOVA_SERVICE_LOCAL_HOST}
         VNCSERVER_PROXYCLIENT_ADDRESS=${VNCSERVER_PROXYCLIENT_ADDRESS=$NOVA_SERVICE_LOCAL_HOST}
-        iniset $NOVA_CONF vnc enabled true
         iniset $NOVA_CONF vnc vncserver_listen "$VNCSERVER_LISTEN"
         iniset $NOVA_CONF vnc vncserver_proxyclient_address "$VNCSERVER_PROXYCLIENT_ADDRESS"
         iniset $NOVA_CONF vnc novncproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
@@ -575,8 +573,6 @@ function create_nova_conf {
         iniset $NOVA_CONF spice server_listen "$SPICESERVER_LISTEN"
         iniset $NOVA_CONF spice server_proxyclient_address "$SPICESERVER_PROXYCLIENT_ADDRESS"
         iniset $NOVA_CONF spice html5proxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
-    else
-        iniset $NOVA_CONF spice enabled false
     fi
 
     # Set the oslo messaging driver to the typical default. This does not

From 0a40710b9f82555abd0478498d743a973680f5d9 Mon Sep 17 00:00:00 2001
From: Lenny Verkhovsky <lennyb@mellanox.com>
Date: Sun, 4 Sep 2016 12:52:01 +0000
Subject: [PATCH 0603/2409] Adding vfio to cgroup_device_acl during libvirt
 configuration

vfio should be added to cgroups on some of the Distributions like
Ubuntu 16-04

Change-Id: I7239858b6307e37bf1237b92d69a0520ab5ad304
---
 lib/nova_plugins/functions-libvirt | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index cc013c3181..6b7c7c263b 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -65,6 +65,7 @@ cgroup_device_acl = [
     "/dev/random", "/dev/urandom",
     "/dev/ptmx", "/dev/kvm", "/dev/kqemu",
     "/dev/rtc", "/dev/hpet","/dev/net/tun",
+    "/dev/vfio/vfio",
 ]
 EOF
     fi

From 0063495b00409651c3bd02a7b3a31ba5b6ea40c0 Mon Sep 17 00:00:00 2001
From: Andreas Scheuring <andreas.scheuring@de.ibm.com>
Date: Fri, 26 Aug 2016 10:29:20 +0200
Subject: [PATCH 0604/2409] Make PIP_GET_PIP_URL configurable via local.conf

The default get_pip url regulary times out when starting devstack
from behind company firewalls. Making this a configureable variable,
user can make use of internal git-pip.py mirrors without modifying
any code.

Change-Id: I66a5534d51ab23a4d8586c27d37b4b6b8a6892c9
---
 tools/install_pip.sh | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index 12676998d2..a5ccb19399 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -24,7 +24,20 @@ set -o xtrace
 
 FILES=$TOP_DIR/files
 
-PIP_GET_PIP_URL=https://bootstrap.pypa.io/get-pip.py
+# The URL from where the get-pip.py file gets downloaded. If a local
+# get-pip.py mirror is available, PIP_GET_PIP_URL can be set to that
+# mirror in local.conf to avoid download timeouts.
+# Example:
+#  PIP_GET_PIP_URL="http://local-server/get-pip.py"
+#
+# Note that if get-pip.py already exists in $FILES this script will
+# not re-download or check for a new version.  For example, this is
+# done by openstack-infra diskimage-builder elements as part of image
+# preparation [1].  This prevents any network access, which can be
+# unreliable in CI situations.
+# [1] http://git.openstack.org/cgit/openstack-infra/project-config/tree/nodepool/elements/cache-devstack/source-repository-pip
+
+PIP_GET_PIP_URL=${PIP_GET_PIP_URL:-"https://bootstrap.pypa.io/get-pip.py"}
 LOCAL_PIP="$FILES/$(basename $PIP_GET_PIP_URL)"
 
 GetDistro

From f3daa9548efd53e09d141f588342d4d94683b6c8 Mon Sep 17 00:00:00 2001
From: scottda <scott.dangelo@hpe.com>
Date: Tue, 6 Sep 2016 13:45:32 -0600
Subject: [PATCH 0605/2409] Add thin-provisioning-tools for Cinder

Ubuntu's LVM packaging does not support thin provisioning by
default:
 /usr/sbin/thin_check: execvp failed: No such file or directory
This is fixed with install of thin-provisioning-tools.

Change-Id: I31f572934ea94cae6e2aea27a2c731ee5bca68d3
Closes-Bug: #1615134
---
 files/debs/cinder | 1 +
 1 file changed, 1 insertion(+)

diff --git a/files/debs/cinder b/files/debs/cinder
index 3595e011da..c1b79fda47 100644
--- a/files/debs/cinder
+++ b/files/debs/cinder
@@ -3,3 +3,4 @@ open-iscsi
 open-iscsi-utils # Deprecated since quantal dist:precise
 qemu-utils
 tgt # NOPRIME
+thin-provisioning-tools

From 95469032656c442982730ea307644d47d7755a81 Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Thu, 8 Sep 2016 17:08:36 -0700
Subject: [PATCH 0606/2409] Set sensible default for LB_PHYSICAL_INT

Configure the linux bridge physical interface to use the interface for
the default route on the current host. In the future we should consider
using a dangling interface so that we aren't affecting the host
instances networking but this roughly matches what testing has been
using in the past.

Change-Id: I7859437f97e6cab929e90208fe56f7efd62dfe01
---
 lib/neutron-legacy | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index b1b5230fdd..1b7c4db507 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -211,13 +211,15 @@ PHYSICAL_NETWORK=${PHYSICAL_NETWORK:-public}
 # Example: ``OVS_PHYSICAL_BRIDGE=br-eth1``
 OVS_PHYSICAL_BRIDGE=${OVS_PHYSICAL_BRIDGE:-br-ex}
 
+default_route_dev=$(ip route | grep ^default | awk '{print $5}')
+die_if_not_set $LINENO default_route_dev "Failure retrieving default route device"
 # With the linuxbridge agent, if using VLANs for tenant networks,
 # or if using flat or VLAN provider networks, set in ``localrc`` to
 # the name of the network interface to use for the physical
 # network.
 #
 # Example: ``LB_PHYSICAL_INTERFACE=eth1``
-LB_PHYSICAL_INTERFACE=${LB_PHYSICAL_INTERFACE:-}
+LB_PHYSICAL_INTERFACE=${LB_PHYSICAL_INTERFACE:-$default_route_dev}
 
 # When Neutron tunnels are enabled it is needed to specify the
 # IP address of the end point in the local server. This IP is set

From 9c69eacabaac45a7ea3574744975fac5cf1ac10d Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 12 Sep 2016 14:58:20 +1000
Subject: [PATCH 0607/2409] Don't add deb-* packaging repos to plugin list

A couple of hundred of these were added with
Ia02f4e1819ac47b12b4ce4381e04253eb26e9f70 and you can see in some of
the proposals at I21fd2b3866efe66dd1f7173003c2521688aa7fd6 they're
starting to match.  Just ignore packaging repos as they're not really
relevant for the purposes of plugin list.

Change-Id: Iaf9e0c0fb672a70c3aee1bbcf587bb0d387e5945
---
 tools/generate-devstack-plugins-list.py | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/tools/generate-devstack-plugins-list.py b/tools/generate-devstack-plugins-list.py
index bbad1bf502..56f12e7ab6 100644
--- a/tools/generate-devstack-plugins-list.py
+++ b/tools/generate-devstack-plugins-list.py
@@ -46,6 +46,9 @@ def is_in_openstack_namespace(proj):
 
 # Check if this project has a plugin file
 def has_devstack_plugin(proj):
+    # Don't link in the deb packaging repos
+    if "openstack/deb-" in proj:
+        return False
     r = requests.get("https://git.openstack.org/cgit/%s/plain/devstack/plugin.sh" % proj)
     return r.status_code == 200
 

From 6390d5ef8236028c8dc00c5514e7ceac60ffd627 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Mon, 12 Sep 2016 11:23:19 -0400
Subject: [PATCH 0608/2409] libvirt: install python-guestfs when
 ENABLE_FILE_INJECTION=True

There is a bit of a weird history here, but the net is we're not
installing python-guestfs when ENABLE_FILE_INJECTION is set, which
it is in the gate-tempest-dsvm-neutron-full-ssh job, which makes
file injection (personality) tests fail.

The history:

Commit 0ae942b41c6dcd0fe7353e7d68574194fb72a66d moved installing
python-guestfs to the hypervisor-libvirt file and it was conditional
on a flag to enable file injection and the backing distro.

Commit a3c94468baa159840a47c34cf94d97d816208313 removed the ability
to configure nova for file injection, which never made any Tempest
tests fail because we didn't have a job that tested file injection
with ssh, which is what gate-tempest-dsvm-neutron-full-ssh does.

Commit 6d3670a65280d71529f8aad8ca5a0422abffebd0 added the ability
back to enable file injection and the gate-tempest-dsvm-neutron-full-ssh
job uses it, but missed added the condition back in from 0ae942b41
which installed the python-guestfs package. This change adds that
back in.

Change-Id: I1c1ef093b70007100646c086dc5724cd64751d00
Closes-Bug: #1622649
---
 lib/nova_plugins/hypervisor-libvirt | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/lib/nova_plugins/hypervisor-libvirt b/lib/nova_plugins/hypervisor-libvirt
index 20dde8ecc5..b4eb3c12a2 100644
--- a/lib/nova_plugins/hypervisor-libvirt
+++ b/lib/nova_plugins/hypervisor-libvirt
@@ -100,6 +100,14 @@ function install_nova_hypervisor {
             yum_install libcgroup-tools
         fi
     fi
+
+    if [[ "$ENABLE_FILE_INJECTION" == "True" ]] ; then
+        if is_ubuntu; then
+            install_package python-guestfs
+        elif is_fedora || is_suse; then
+            install_package python-libguestfs
+        fi
+    fi
 }
 
 # start_nova_hypervisor - Start any required external services

From 14cb490d1e9837c237ade5c0a63de56faae5e89d Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Thu, 8 Sep 2016 13:07:59 -0400
Subject: [PATCH 0609/2409] nova: stop setting deprecated use_usb_tablet option

The use_usb_tablet option is replaced by the pointer_model
option.

Depends-On: Id18b5503799922e4096bde296a9e7bb4f2a994aa

Change-Id: Ic2a49f88df988c6404c1c72e9ee28a487e4f7908
---
 lib/nova_plugins/hypervisor-libvirt | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/nova_plugins/hypervisor-libvirt b/lib/nova_plugins/hypervisor-libvirt
index b4eb3c12a2..167ab6f2e7 100644
--- a/lib/nova_plugins/hypervisor-libvirt
+++ b/lib/nova_plugins/hypervisor-libvirt
@@ -40,7 +40,8 @@ function configure_nova_hypervisor {
     configure_libvirt
     iniset $NOVA_CONF libvirt virt_type "$LIBVIRT_TYPE"
     iniset $NOVA_CONF libvirt cpu_mode "none"
-    iniset $NOVA_CONF libvirt use_usb_tablet "False"
+    # Do not enable USB tablet input devices to avoid QEMU CPU overhead.
+    iniset $NOVA_CONF DEFAULT pointer_model "ps2mouse"
     iniset $NOVA_CONF libvirt live_migration_uri "qemu+ssh://$STACK_USER@%s/system"
     iniset $NOVA_CONF DEFAULT default_ephemeral_format "ext4"
     iniset $NOVA_CONF DEFAULT compute_driver "libvirt.LibvirtDriver"

From 57d390c5d7a52befc21d4d50ee676fb904b76d6d Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Wed, 14 Sep 2016 06:59:40 +0000
Subject: [PATCH 0610/2409] Updated from generate-devstack-plugins-list

Change-Id: I21fd2b3866efe66dd1f7173003c2521688aa7fd6
---
 doc/source/plugin-registry.rst | 27 +++++++++++++++------------
 1 file changed, 15 insertions(+), 12 deletions(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index d6df1efa4f..a59a5464b9 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -1,16 +1,16 @@
-..  Note to patch submitters:
+.. Note to patch submitters:
 
-    # ============================= #
-    # THIS FILE IS AUTOGENERATED !  #
-    # ============================= #
+   # ============================= #
+   # THIS FILE IS AUTOGENERATED !  #
+   # ============================= #
 
-    ** Plugins are found automatically and added to this list **
+   ** Plugins are found automatically and added to this list **
 
-    This file is created by a periodic proposal job.  You should not
-    edit this file.
+   This file is created by a periodic proposal job.  You should not
+   edit this file.
 
-    You should edit the files data/devstack-plugins-registry.footer
-    data/devstack-plugins-registry.header to modify this text.
+   You should edit the files data/devstack-plugins-registry.footer
+   data/devstack-plugins-registry.header to modify this text.
 
 ==========================
  DevStack Plugin Registry
@@ -24,6 +24,7 @@ official OpenStack projects.
 ====================================== ===
 Plugin Name                            URL
 ====================================== ===
+almanach                               `git://git.openstack.org/openstack/almanach <https://git.openstack.org/cgit/openstack/almanach>`__
 aodh                                   `git://git.openstack.org/openstack/aodh <https://git.openstack.org/cgit/openstack/aodh>`__
 app-catalog-ui                         `git://git.openstack.org/openstack/app-catalog-ui <https://git.openstack.org/cgit/openstack/app-catalog-ui>`__
 astara                                 `git://git.openstack.org/openstack/astara <https://git.openstack.org/cgit/openstack/astara>`__
@@ -61,11 +62,12 @@ gce-api                                `git://git.openstack.org/openstack/gce-ap
 gnocchi                                `git://git.openstack.org/openstack/gnocchi <https://git.openstack.org/cgit/openstack/gnocchi>`__
 group-based-policy                     `git://git.openstack.org/openstack/group-based-policy <https://git.openstack.org/cgit/openstack/group-based-policy>`__
 heat                                   `git://git.openstack.org/openstack/heat <https://git.openstack.org/cgit/openstack/heat>`__
-higgins                                `git://git.openstack.org/openstack/higgins <https://git.openstack.org/cgit/openstack/higgins>`__
 horizon-mellanox                       `git://git.openstack.org/openstack/horizon-mellanox <https://git.openstack.org/cgit/openstack/horizon-mellanox>`__
 ironic                                 `git://git.openstack.org/openstack/ironic <https://git.openstack.org/cgit/openstack/ironic>`__
 ironic-inspector                       `git://git.openstack.org/openstack/ironic-inspector <https://git.openstack.org/cgit/openstack/ironic-inspector>`__
 ironic-staging-drivers                 `git://git.openstack.org/openstack/ironic-staging-drivers <https://git.openstack.org/cgit/openstack/ironic-staging-drivers>`__
+karbor                                 `git://git.openstack.org/openstack/karbor <https://git.openstack.org/cgit/openstack/karbor>`__
+karbor-dashboard                       `git://git.openstack.org/openstack/karbor-dashboard <https://git.openstack.org/cgit/openstack/karbor-dashboard>`__
 kingbird                               `git://git.openstack.org/openstack/kingbird <https://git.openstack.org/cgit/openstack/kingbird>`__
 kuryr-libnetwork                       `git://git.openstack.org/openstack/kuryr-libnetwork <https://git.openstack.org/cgit/openstack/kuryr-libnetwork>`__
 magnum                                 `git://git.openstack.org/openstack/magnum <https://git.openstack.org/cgit/openstack/magnum>`__
@@ -110,6 +112,7 @@ neutron-lbaas-dashboard                `git://git.openstack.org/openstack/neutro
 neutron-vpnaas                         `git://git.openstack.org/openstack/neutron-vpnaas <https://git.openstack.org/cgit/openstack/neutron-vpnaas>`__
 nova-docker                            `git://git.openstack.org/openstack/nova-docker <https://git.openstack.org/cgit/openstack/nova-docker>`__
 nova-lxd                               `git://git.openstack.org/openstack/nova-lxd <https://git.openstack.org/cgit/openstack/nova-lxd>`__
+nova-mksproxy                          `git://git.openstack.org/openstack/nova-mksproxy <https://git.openstack.org/cgit/openstack/nova-mksproxy>`__
 nova-powervm                           `git://git.openstack.org/openstack/nova-powervm <https://git.openstack.org/cgit/openstack/nova-powervm>`__
 octavia                                `git://git.openstack.org/openstack/octavia <https://git.openstack.org/cgit/openstack/octavia>`__
 osprofiler                             `git://git.openstack.org/openstack/osprofiler <https://git.openstack.org/cgit/openstack/osprofiler>`__
@@ -122,8 +125,6 @@ scalpels                               `git://git.openstack.org/openstack/scalpe
 searchlight                            `git://git.openstack.org/openstack/searchlight <https://git.openstack.org/cgit/openstack/searchlight>`__
 searchlight-ui                         `git://git.openstack.org/openstack/searchlight-ui <https://git.openstack.org/cgit/openstack/searchlight-ui>`__
 senlin                                 `git://git.openstack.org/openstack/senlin <https://git.openstack.org/cgit/openstack/senlin>`__
-smaug                                  `git://git.openstack.org/openstack/smaug <https://git.openstack.org/cgit/openstack/smaug>`__
-smaug-dashboard                        `git://git.openstack.org/openstack/smaug-dashboard <https://git.openstack.org/cgit/openstack/smaug-dashboard>`__
 solum                                  `git://git.openstack.org/openstack/solum <https://git.openstack.org/cgit/openstack/solum>`__
 tacker                                 `git://git.openstack.org/openstack/tacker <https://git.openstack.org/cgit/openstack/tacker>`__
 tap-as-a-service                       `git://git.openstack.org/openstack/tap-as-a-service <https://git.openstack.org/cgit/openstack/tap-as-a-service>`__
@@ -137,6 +138,8 @@ watcher                                `git://git.openstack.org/openstack/watche
 watcher-dashboard                      `git://git.openstack.org/openstack/watcher-dashboard <https://git.openstack.org/cgit/openstack/watcher-dashboard>`__
 zaqar                                  `git://git.openstack.org/openstack/zaqar <https://git.openstack.org/cgit/openstack/zaqar>`__
 zaqar-ui                               `git://git.openstack.org/openstack/zaqar-ui <https://git.openstack.org/cgit/openstack/zaqar-ui>`__
+zun                                    `git://git.openstack.org/openstack/zun <https://git.openstack.org/cgit/openstack/zun>`__
+zun-ui                                 `git://git.openstack.org/openstack/zun-ui <https://git.openstack.org/cgit/openstack/zun-ui>`__
 ====================================== ===
 
 

From cb3a216c2315041f1665dda2b81555883ba2dc6b Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Thu, 15 Sep 2016 06:52:36 +0000
Subject: [PATCH 0611/2409] Updated from generate-devstack-plugins-list

Change-Id: Ib75ecf5c822f3778978177c793399afbd802bf70
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index a59a5464b9..e9b0480344 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -129,6 +129,7 @@ solum                                  `git://git.openstack.org/openstack/solum
 tacker                                 `git://git.openstack.org/openstack/tacker <https://git.openstack.org/cgit/openstack/tacker>`__
 tap-as-a-service                       `git://git.openstack.org/openstack/tap-as-a-service <https://git.openstack.org/cgit/openstack/tap-as-a-service>`__
 tricircle                              `git://git.openstack.org/openstack/tricircle <https://git.openstack.org/cgit/openstack/tricircle>`__
+trio2o                                 `git://git.openstack.org/openstack/trio2o <https://git.openstack.org/cgit/openstack/trio2o>`__
 trove                                  `git://git.openstack.org/openstack/trove <https://git.openstack.org/cgit/openstack/trove>`__
 trove-dashboard                        `git://git.openstack.org/openstack/trove-dashboard <https://git.openstack.org/cgit/openstack/trove-dashboard>`__
 vitrage                                `git://git.openstack.org/openstack/vitrage <https://git.openstack.org/cgit/openstack/vitrage>`__

From 81d89cf3584a5edadbaa2514305cf5721b29cdff Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Fri, 16 Sep 2016 06:52:00 +0000
Subject: [PATCH 0612/2409] Updated from generate-devstack-plugins-list

Change-Id: I20039918452f6aa430037ae986f7cd88bd220d76
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index e9b0480344..9d023bf5e2 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -103,6 +103,7 @@ networking-ovs-dpdk                    `git://git.openstack.org/openstack/networ
 networking-plumgrid                    `git://git.openstack.org/openstack/networking-plumgrid <https://git.openstack.org/cgit/openstack/networking-plumgrid>`__
 networking-powervm                     `git://git.openstack.org/openstack/networking-powervm <https://git.openstack.org/cgit/openstack/networking-powervm>`__
 networking-sfc                         `git://git.openstack.org/openstack/networking-sfc <https://git.openstack.org/cgit/openstack/networking-sfc>`__
+networking-vpp                         `git://git.openstack.org/openstack/networking-vpp <https://git.openstack.org/cgit/openstack/networking-vpp>`__
 networking-vsphere                     `git://git.openstack.org/openstack/networking-vsphere <https://git.openstack.org/cgit/openstack/networking-vsphere>`__
 neutron                                `git://git.openstack.org/openstack/neutron <https://git.openstack.org/cgit/openstack/neutron>`__
 neutron-dynamic-routing                `git://git.openstack.org/openstack/neutron-dynamic-routing <https://git.openstack.org/cgit/openstack/neutron-dynamic-routing>`__

From 734f144f5d47c9b76562d5b5c705428be0963aec Mon Sep 17 00:00:00 2001
From: Henry Gessau <HenryG@gessau.net>
Date: Sat, 17 Sep 2016 19:28:53 -0400
Subject: [PATCH 0613/2409] Neutron L3: account for all default routes

Some systems may have more than one default route.
Set up iptables NAT rules on all v4 default route devices.
Accept RAs on all v6 default route devices.

Closes-Bug: #1624773

Change-Id: If58509297497ea33c6c156f083a4394000bd0561
---
 lib/neutron_plugins/services/l3 | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 2e96284357..09c08e3280 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -88,8 +88,10 @@ SUBNETPOOL_PREFIX_V6=${SUBNETPOOL_PREFIX_V6:-2001:db8:8000::/48}
 SUBNETPOOL_SIZE_V4=${SUBNETPOOL_SIZE_V4:-24}
 SUBNETPOOL_SIZE_V6=${SUBNETPOOL_SIZE_V6:-64}
 
-default_route_dev=$(ip route | grep ^default | awk '{print $5}')
-die_if_not_set $LINENO default_route_dev "Failure retrieving default route device"
+default_v4_route_devs=$(ip -4 route | grep ^default | awk '{print $5}')
+die_if_not_set $LINENO default_v4_route_devs "Failure retrieving default IPv4 route devices"
+
+default_v6_route_devs=$(ip -6 route | grep ^default | awk '{print $5}')
 
 function _determine_config_l3 {
     local opts="--config-file $NEUTRON_CONF --config-file $Q_L3_CONF_FILE"
@@ -121,7 +123,9 @@ function _configure_neutron_l3_agent {
             _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" False False "inet6"
         fi
     else
-        sudo iptables -t nat -A POSTROUTING -o $default_route_dev -s $FLOATING_RANGE -j MASQUERADE
+        for d in $default_v4_route_devs; do
+            sudo iptables -t nat -A POSTROUTING -o $d -s $FLOATING_RANGE -j MASQUERADE
+        done
     fi
 }
 
@@ -371,11 +375,13 @@ function _neutron_configure_router_v6 {
 
     # This logic is specific to using the l3-agent for layer 3
     if is_service_enabled q-l3 || is_service_enabled neutron-l3; then
-        # Ensure IPv6 RAs are accepted on the interface with the default route.
+        # Ensure IPv6 RAs are accepted on interfaces with a default route.
         # This is needed for neutron-based devstack clouds to work in
         # IPv6-only clouds in the gate. Please do not remove this without
         # talking to folks in Infra.
-        sudo sysctl -w net.ipv6.conf.$default_route_dev.accept_ra=2
+        for d in $default_v6_route_devs; do
+            sudo sysctl -w net.ipv6.conf.$d.accept_ra=2
+        done
         # Ensure IPv6 forwarding is enabled on the host
         sudo sysctl -w net.ipv6.conf.all.forwarding=1
         # Configure and enable public bridge

From d2ef615d8f2edc9d8b535c94fca1a5afde3d0694 Mon Sep 17 00:00:00 2001
From: Gary Kotton <gkotton@vmware.com>
Date: Tue, 20 Sep 2016 04:12:11 -0700
Subject: [PATCH 0614/2409] Neutron: enable setting debug as True or False

The flag ENABLE_DEBUG_LOG_LEVEL indicates if this should be
set or not.

This will now be supported in Neutron.

Change-Id: I3afe0546b379873247fee1ef9f4cc2708a7b5713
---
 lib/neutron | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 7442efd2c1..3efa685caf 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -126,7 +126,7 @@ function configure_neutron_new {
     iniset $NEUTRON_CONF oslo_concurrency lock_path $NEUTRON_STATE_PATH/lock
     iniset $NEUTRON_CONF DEFAULT use_syslog $SYSLOG
 
-    iniset $NEUTRON_CONF DEFAULT debug True
+    iniset $NEUTRON_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
 
     iniset_rpc_backend neutron $NEUTRON_CONF
 
@@ -172,7 +172,7 @@ function configure_neutron_new {
     # Neutron OVS or LB agent
     if is_service_enabled neutron-agent; then
         iniset $NEUTRON_PLUGIN_CONF agent tunnel_types vxlan
-        iniset $NEUTRON_PLUGIN_CONF DEFAULT debug True
+        iniset $NEUTRON_PLUGIN_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
 
         # Configure the neutron agent
         if [[ $NEUTRON_AGENT == "linuxbridge" ]]; then
@@ -188,7 +188,7 @@ function configure_neutron_new {
     if is_service_enabled neutron-dhcp; then
         cp $NEUTRON_DIR/etc/dhcp_agent.ini.sample $NEUTRON_DHCP_CONF
 
-        iniset $NEUTRON_DHCP_CONF DEFAULT debug True
+        iniset $NEUTRON_DHCP_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
         # make it so we have working DNS from guests
         iniset $NEUTRON_DHCP_CONF DEFAULT dnsmasq_local_resolv True
 
@@ -202,7 +202,7 @@ function configure_neutron_new {
         iniset $NEUTRON_L3_CONF DEFAULT interface_driver $NEUTRON_AGENT
         iniset $NEUTRON_CONF DEFAULT service_plugins router
         iniset $NEUTRON_L3_CONF agent root_helper_daemon "$NEUTRON_ROOTWRAP_DAEMON_CMD"
-        iniset $NEUTRON_L3_CONF DEFAULT debug True
+        iniset $NEUTRON_L3_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
         neutron_plugin_configure_l3_agent $NEUTRON_L3_CONF
     fi
 
@@ -210,7 +210,7 @@ function configure_neutron_new {
     if is_service_enabled neutron-metadata-agent; then
         cp $NEUTRON_DIR/etc/metadata_agent.ini.sample $NEUTRON_META_CONF
 
-        iniset $NEUTRON_META_CONF DEFAULT debug True
+        iniset $NEUTRON_META_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
         iniset $NEUTRON_META_CONF DEFAULT nova_metadata_ip $SERVICE_HOST
         iniset $NEUTRON_META_CONF agent root_helper_daemon "$NEUTRON_ROOTWRAP_DAEMON_CMD"
 

From 4b49e409f853104dae021dfca1a9342ec9ac4709 Mon Sep 17 00:00:00 2001
From: Gregory Haynes <greg@greghaynes.net>
Date: Wed, 31 Aug 2016 18:19:51 -0700
Subject: [PATCH 0615/2409] Use apache for tls-proxy ssl termination

Stud is now abandonware (see https://github.com/bumptech/stud) and is
not packaged in xenial. Lets use Apache for SSL termination since its
there already.

Change-Id: Ifcba410f5969521e8b3d30f02795541c1661f83a
---
 files/debs/tls-proxy |  2 +-
 functions-common     | 10 ++++++
 lib/apache           | 31 +++++++++++++++---
 lib/cinder           |  4 +--
 lib/glance           |  4 +--
 lib/keystone         |  4 +--
 lib/neutron          |  2 +-
 lib/neutron-legacy   |  2 +-
 lib/nova             |  2 +-
 lib/swift            |  2 +-
 lib/tls              | 78 +++++++++++++++++++++++++++++++-------------
 stack.sh             |  1 +
 12 files changed, 103 insertions(+), 39 deletions(-)

diff --git a/files/debs/tls-proxy b/files/debs/tls-proxy
index dce9c07d3f..5bd8e213a2 100644
--- a/files/debs/tls-proxy
+++ b/files/debs/tls-proxy
@@ -1 +1 @@
-stud
+apache2
diff --git a/functions-common b/functions-common
index 1a4a8f8eea..4716567be3 100644
--- a/functions-common
+++ b/functions-common
@@ -2304,6 +2304,16 @@ function stop_service {
     fi
 }
 
+# Service wrapper to stop services
+# reload_service service-name
+function reload_service {
+    if [ -x /bin/systemctl ]; then
+        sudo /bin/systemctl reload $1
+    else
+        sudo service $1 reload
+    fi
+}
+
 # Test with a finite retry loop.
 #
 function test_with_retry {
diff --git a/lib/apache b/lib/apache
index 2c84c7a481..740f58835e 100644
--- a/lib/apache
+++ b/lib/apache
@@ -42,24 +42,40 @@ fi
 
 # Functions
 # ---------
+
+# Enable apache mod and restart apache if it isn't already enabled.
+function enable_apache_mod {
+    local mod=$1
+    # Apache installation, because we mark it NOPRIME
+    if is_ubuntu || is_suse ; then
+        if ! a2query -m $mod ; then
+            sudo a2enmod $mod
+            restart_apache_server
+        fi
+    elif is_fedora; then
+        # pass
+        true
+    else
+        exit_distro_not_supported "apache enable mod"
+    fi
+}
+
 # install_apache_wsgi() - Install Apache server and wsgi module
 function install_apache_wsgi {
     # Apache installation, because we mark it NOPRIME
     if is_ubuntu; then
         # Install apache2, which is NOPRIME'd
         install_package apache2 libapache2-mod-wsgi
-        # WSGI isn't enabled by default, enable it
-        sudo a2enmod wsgi
     elif is_fedora; then
         sudo rm -f /etc/httpd/conf.d/000-*
         install_package httpd mod_wsgi
     elif is_suse; then
         install_package apache2 apache2-mod_wsgi
-        # WSGI isn't enabled by default, enable it
-        sudo a2enmod wsgi
     else
-        exit_distro_not_supported "apache installation"
+        exit_distro_not_supported "apache wsgi installation"
     fi
+    # WSGI isn't enabled by default, enable it
+    enable_apache_mod wsgi
 
     # ensure mod_version enabled for <IfVersion ...>.  This is
     # built-in statically on anything recent, but precise (2.2)
@@ -192,6 +208,11 @@ function restart_apache_server {
     time_stop "restart_apache_server"
 }
 
+# reload_apache_server
+function reload_apache_server {
+    reload_service $APACHE_NAME
+}
+
 # Restore xtrace
 $_XTRACE_LIB_APACHE
 
diff --git a/lib/cinder b/lib/cinder
index a87f395c8e..0fe950b6c2 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -305,8 +305,8 @@ function configure_cinder {
     if is_service_enabled tls-proxy; then
         # Set the service port for a proxy to take the original
         iniset $CINDER_CONF DEFAULT osapi_volume_listen_port $CINDER_SERVICE_PORT_INT
-
         iniset $CINDER_CONF DEFAULT public_endpoint $CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT
+        iniset $CINDER_CONF DEFAULT osapi_volume_base_URL $CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT
     fi
 
     if [ "$SYSLOG" != "False" ]; then
@@ -534,7 +534,7 @@ function start_cinder {
 
     # Start proxies if enabled
     if is_service_enabled c-api && is_service_enabled tls-proxy; then
-        start_tls_proxy '*' $CINDER_SERVICE_PORT $CINDER_SERVICE_HOST $CINDER_SERVICE_PORT_INT &
+        start_tls_proxy cinder '*' $CINDER_SERVICE_PORT $CINDER_SERVICE_HOST $CINDER_SERVICE_PORT_INT
     fi
 }
 
diff --git a/lib/glance b/lib/glance
index 8d95aad73f..a31e564104 100644
--- a/lib/glance
+++ b/lib/glance
@@ -383,8 +383,8 @@ function install_glance {
 function start_glance {
     local service_protocol=$GLANCE_SERVICE_PROTOCOL
     if is_service_enabled tls-proxy; then
-        start_tls_proxy '*' $GLANCE_SERVICE_PORT $GLANCE_SERVICE_HOST $GLANCE_SERVICE_PORT_INT &
-        start_tls_proxy '*' $GLANCE_REGISTRY_PORT $GLANCE_SERVICE_HOST $GLANCE_REGISTRY_PORT_INT &
+        start_tls_proxy glance-service '*' $GLANCE_SERVICE_PORT $GLANCE_SERVICE_HOST $GLANCE_SERVICE_PORT_INT
+        start_tls_proxy glance-registry '*' $GLANCE_REGISTRY_PORT $GLANCE_SERVICE_HOST $GLANCE_REGISTRY_PORT_INT
     fi
 
     run_process g-reg "$GLANCE_BIN_DIR/glance-registry --config-file=$GLANCE_CONF_DIR/glance-registry.conf"
diff --git a/lib/keystone b/lib/keystone
index 6198e43b58..f52cc3fb4b 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -609,8 +609,8 @@ function start_keystone {
 
     # Start proxies if enabled
     if is_service_enabled tls-proxy; then
-        start_tls_proxy '*' $KEYSTONE_SERVICE_PORT $KEYSTONE_SERVICE_HOST $KEYSTONE_SERVICE_PORT_INT &
-        start_tls_proxy '*' $KEYSTONE_AUTH_PORT $KEYSTONE_AUTH_HOST $KEYSTONE_AUTH_PORT_INT &
+        start_tls_proxy keystone-service '*' $KEYSTONE_SERVICE_PORT $KEYSTONE_SERVICE_HOST $KEYSTONE_SERVICE_PORT_INT
+        start_tls_proxy keystone-auth '*' $KEYSTONE_AUTH_PORT $KEYSTONE_AUTH_HOST $KEYSTONE_AUTH_PORT_INT
     fi
 
     # (re)start memcached to make sure we have a clean memcache.
diff --git a/lib/neutron b/lib/neutron
index c1552e3d06..e37701879d 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -409,7 +409,7 @@ function start_neutron_api {
 
     # Start proxy if enabled
     if is_service_enabled tls-proxy; then
-        start_tls_proxy '*' $NEUTRON_SERVICE_PORT $NEUTRON_SERVICE_HOST $NEUTRON_SERVICE_PORT_INT &
+        start_tls_proxy neutron '*' $NEUTRON_SERVICE_PORT $NEUTRON_SERVICE_HOST $NEUTRON_SERVICE_PORT_INT
     fi
 }
 
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index b1b5230fdd..18100994f3 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -460,7 +460,7 @@ function start_neutron_service_and_check {
 
     # Start proxy if enabled
     if is_service_enabled tls-proxy; then
-        start_tls_proxy '*' $Q_PORT $Q_HOST $Q_PORT_INT &
+        start_tls_proxy neutron '*' $Q_PORT $Q_HOST $Q_PORT_INT
     fi
 }
 
diff --git a/lib/nova b/lib/nova
index 235b533d77..8970a7c693 100644
--- a/lib/nova
+++ b/lib/nova
@@ -800,7 +800,7 @@ function start_nova_api {
 
     # Start proxies if enabled
     if is_service_enabled tls-proxy; then
-        start_tls_proxy '*' $NOVA_SERVICE_PORT $NOVA_SERVICE_HOST $NOVA_SERVICE_PORT_INT &
+        start_tls_proxy nova '*' $NOVA_SERVICE_PORT $NOVA_SERVICE_HOST $NOVA_SERVICE_PORT_INT
     fi
 
     export PATH=$old_path
diff --git a/lib/swift b/lib/swift
index 0c74411a9c..f9ea028cea 100644
--- a/lib/swift
+++ b/lib/swift
@@ -806,7 +806,7 @@ function start_swift {
     done
     if is_service_enabled tls-proxy; then
         local proxy_port=${SWIFT_DEFAULT_BIND_PORT}
-        start_tls_proxy '*' $proxy_port $SERVICE_HOST $SWIFT_DEFAULT_BIND_PORT_INT &
+        start_tls_proxy swift '*' $proxy_port $SERVICE_HOST $SWIFT_DEFAULT_BIND_PORT_INT
     fi
     run_process s-proxy "$SWIFT_DIR/bin/swift-proxy-server ${SWIFT_CONF_DIR}/proxy-server.conf -v"
     if [[ ${SWIFT_REPLICAS} == 1 ]]; then
diff --git a/lib/tls b/lib/tls
index ca57ed44e0..2c4e18d388 100644
--- a/lib/tls
+++ b/lib/tls
@@ -16,7 +16,6 @@
 #
 # - configure_CA
 # - init_CA
-# - cleanup_CA
 
 # - configure_proxy
 # - start_tls_proxy
@@ -221,19 +220,6 @@ function init_CA {
     fi
 }
 
-# Clean up the CA files
-# cleanup_CA
-function cleanup_CA {
-    if is_fedora; then
-        sudo rm -f /usr/share/pki/ca-trust-source/anchors/devstack-chain.pem
-        sudo update-ca-trust
-    elif is_ubuntu; then
-        sudo rm -f /usr/local/share/ca-certificates/devstack-int.crt
-        sudo rm -f /usr/local/share/ca-certificates/devstack-root.crt
-        sudo update-ca-certificates
-    fi
-}
-
 # Create an initial server cert
 # init_cert
 function init_cert {
@@ -455,26 +441,72 @@ function enable_mod_ssl {
 # Starts the TLS proxy for the given IP/ports
 # start_tls_proxy front-host front-port back-host back-port
 function start_tls_proxy {
-    local f_host=$1
-    local f_port=$2
-    local b_host=$3
-    local b_port=$4
-
-    stud $STUD_PROTO -f $f_host,$f_port -b $b_host,$b_port $DEVSTACK_CERT 2>/dev/null
+    local b_service="$1-tls-proxy"
+    local f_host=$2
+    local f_port=$3
+    local b_host=$4
+    local b_port=$5
+
+    local config_file
+    config_file=$(apache_site_config_for $b_service)
+    local listen_string
+    # Default apache configs on ubuntu and centos listen on 80 and 443
+    # newer apache seems fine with duplicate listen directive but older
+    # apache does not so special case 80 and 443.
+    if [[ "$f_port" == "80" ]] || [[ "$f_port" == "443" ]]; then
+        listen_string=""
+    elif [[ "$f_host" == '*' ]] ; then
+        listen_string="Listen $f_port"
+    else
+        listen_string="Listen $f_host:$f_port"
+    fi
+    sudo bash -c "cat >$config_file" << EOF
+$listen_string
+
+<VirtualHost $f_host:$f_port>
+    SSLEngine On
+    SSLCertificateFile $DEVSTACK_CERT
+
+    <Location />
+        ProxyPass http://$b_host:$b_port/ retry=5 nocanon
+        ProxyPassReverse http://$b_host:$b_port/
+    </Location>
+</VirtualHost>
+EOF
+    for mod in ssl proxy proxy_http; do
+        enable_apache_mod $mod
+    done
+    enable_apache_site $b_service
+    # Only a reload is required to pull in new vhosts
+    # Note that a restart reliably fails on centos7 and trusty
+    # because apache can't open port 80 because the old apache
+    # still has it open. Using reload fixes trusty but centos7
+    # still doesn't work.
+    reload_apache_server
 }
 
 
 # Cleanup Functions
 # =================
 
-# Stops all stud processes. This should be done only after all services
+# Stops the apache service. This should be done only after all services
 # using tls configuration are down.
 function stop_tls_proxy {
-    killall stud
+    stop_apache_server
 }
 
-# Remove CA along with configuration, as well as the local server certificate
+# Clean up the CA files
+# cleanup_CA
 function cleanup_CA {
+    if is_fedora; then
+        sudo rm -f /usr/share/pki/ca-trust-source/anchors/devstack-chain.pem
+        sudo update-ca-trust
+    elif is_ubuntu; then
+        sudo rm -f /usr/local/share/ca-certificates/devstack-int.crt
+        sudo rm -f /usr/local/share/ca-certificates/devstack-root.crt
+        sudo update-ca-certificates
+    fi
+
     rm -rf "$DATA_DIR/CA" "$DEVSTACK_CERT"
 }
 
diff --git a/stack.sh b/stack.sh
index 09466a6894..119ca8561b 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1052,6 +1052,7 @@ EOF
 
     if is_service_enabled tls-proxy; then
         echo "export OS_CACERT=$INT_CA_DIR/ca-chain.pem" >> $TOP_DIR/userrc_early
+        start_tls_proxy http-services '*' 443 $SERVICE_HOST 80
     fi
 
     source $TOP_DIR/userrc_early

From 4c813ac0fb64c7b4eeec7f67692ccfd7affd2153 Mon Sep 17 00:00:00 2001
From: Luigi Toscano <ltoscano@redhat.com>
Date: Wed, 21 Sep 2016 19:39:36 +0200
Subject: [PATCH 0616/2409] Fix the logic of if used with is_service_enabled

The value to be evaluated is the returned value, not the output of the
command.

Change-Id: I22d7c967e911bcfee6b1910f666dbbc647c00085
---
 lib/tempest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index b491bf82ef..048f3464b3 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -317,7 +317,7 @@ function configure_tempest {
     # set the equiv validation option here as well to ensure they are
     # in sync. They shouldn't be separate options.
     iniset $TEMPEST_CONFIG validation connect_method $ssh_connect_method
-    if [[ ! $(is_service_enabled n-cell) && ! $(is_service_enabled neutron) ]]; then
+    if ! is_service_enabled n-cell && ! is_service_enabled neutron; then
         iniset $TEMPEST_CONFIG compute fixed_network_name $PRIVATE_NETWORK_NAME
     fi
 

From a5d965a3d7c558239d770428e1dd815943a8d887 Mon Sep 17 00:00:00 2001
From: Patrick East <patrick.east@purestorage.com>
Date: Wed, 3 Aug 2016 14:44:53 -0700
Subject: [PATCH 0617/2409] Use userrc_early for all nodes

Instead of only using the userrc_early when keystone
is an enabled service we will do it on all runs of
stack.sh. This way services can be split up more
across devstack nodes, and you can do configuration
requiring credentials on nodes that don't install
keystone.

Change-Id: I74574ae9f45a74bcbcc8e3149228ecb795ab4fb7
---
 stack.sh | 40 ++++++++++++++++++++--------------------
 1 file changed, 20 insertions(+), 20 deletions(-)

diff --git a/stack.sh b/stack.sh
index 6a5a2a318f..8f548997d4 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1021,21 +1021,12 @@ start_dstat
 # Keystone
 # --------
 
-if is_service_enabled keystone; then
-    echo_summary "Starting Keystone"
-
-    if [ "$KEYSTONE_AUTH_HOST" == "$SERVICE_HOST" ]; then
-        init_keystone
-        start_keystone
-        bootstrap_keystone
-    fi
-
-    # Rather than just export these, we write them out to a
-    # intermediate userrc file that can also be used to debug if
-    # something goes wrong between here and running
-    # tools/create_userrc.sh (this script relies on services other
-    # than keystone being available, so we can't call it right now)
-    cat > $TOP_DIR/userrc_early <<EOF
+# Rather than just export these, we write them out to a
+# intermediate userrc file that can also be used to debug if
+# something goes wrong between here and running
+# tools/create_userrc.sh (this script relies on services other
+# than keystone being available, so we can't call it right now)
+cat > $TOP_DIR/userrc_early <<EOF
 # Use this for debugging issues before files in accrc are created
 
 # Set up password auth credentials now that Keystone is bootstrapped
@@ -1050,12 +1041,21 @@ export OS_REGION_NAME=$KEYSTONE_REGION_NAME
 
 EOF
 
-    if is_service_enabled tls-proxy; then
-        echo "export OS_CACERT=$INT_CA_DIR/ca-chain.pem" >> $TOP_DIR/userrc_early
-        start_tls_proxy http-services '*' 443 $SERVICE_HOST 80
-    fi
+if is_service_enabled tls-proxy; then
+    echo "export OS_CACERT=$INT_CA_DIR/ca-chain.pem" >> $TOP_DIR/userrc_early
+    start_tls_proxy http-services '*' 443 $SERVICE_HOST 80
+fi
+
+source $TOP_DIR/userrc_early
+
+if is_service_enabled keystone; then
+    echo_summary "Starting Keystone"
 
-    source $TOP_DIR/userrc_early
+    if [ "$KEYSTONE_AUTH_HOST" == "$SERVICE_HOST" ]; then
+        init_keystone
+        start_keystone
+        bootstrap_keystone
+    fi
 
     create_keystone_accounts
     create_nova_accounts

From a80d4097a973acaff9c7718334487a1182ba7dc6 Mon Sep 17 00:00:00 2001
From: Kevin Zhao <kevin.zhao@linaro.org>
Date: Thu, 11 Aug 2016 10:41:34 +0000
Subject: [PATCH 0618/2409] Modify the default Qemu packages name for AArch64.

In Debian jessie and later release,there is no packages
called "qemu-kvm" for AArch64. Also modify the libguestfs0
packages for AArch64

Closes-bug: #1612182

Change-Id: I5eb6bd137896eb9abfc4f8dbb41b41105e4820cd
Signed-off-by: Kevin Zhao <kevin.zhao@linaro.org>
---
 lib/nova_plugins/functions-libvirt | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index 4e5a748e45..790227beb5 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -23,12 +23,7 @@ DEBUG_LIBVIRT=$(trueorfalse True DEBUG_LIBVIRT)
 # Installs required distro-specific libvirt packages.
 function install_libvirt {
     if is_ubuntu; then
-        if is_arch "aarch64" && [[ ${DISTRO} == "trusty" ]]; then
-            install_package qemu-system
-        else
-            install_package qemu-kvm
-            install_package libguestfs0
-        fi
+        install_package qemu-system
         install_package libvirt-bin libvirt-dev
         pip_install_gr libvirt-python
         if [[ "$EBTABLES_RACE_FIX" == "True" ]]; then

From a4705403aa6a4ba0f5ea8c67bff89a67d0be2070 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 23 Sep 2016 15:08:48 +1000
Subject: [PATCH 0619/2409] yum_install: fix awk return code

TIL:

  Similarly, all the END rules are merged, and executed when all the
  input is exhausted (or when an exit statement is executed).

i.e. matching YUM_FAILED calls "exit", which falls through to the END
rules which calls "exit result" ... which is zero.  i.e. if the return
code is 1 then we actually hide that and return with zero.

This is rather annoying because errors that should halt to alert us of
a package install failure pass through, only for you to have to debug
much later on seemingly unrelated problems.

This always sets "result" and thus should be returning the right
thing.  I've updated the documentation to hopefully make it clearer
what's going on.

Change-Id: Ia15b7dc55efb8d3e3e945241b67a468b8a914672
---
 functions-common | 32 +++++++++++++++++++-------------
 1 file changed, 19 insertions(+), 13 deletions(-)

diff --git a/functions-common b/functions-common
index 1a4a8f8eea..120aa970d9 100644
--- a/functions-common
+++ b/functions-common
@@ -1346,20 +1346,26 @@ function yum_install {
 
     time_start "yum_install"
 
-    # - We run with LC_ALL=C so string matching *should* be OK
-    # - Exit 1 if the failure might get better with a retry.
-    # - Exit 2 if it is fatal.
-    parse_yum_result='             \
-        BEGIN { result=0 }         \
-        /^YUM_FAILED/ { exit $2 }  \
-        /^No package/ { result=2 } \
-        /^Failed:/    { result=2 } \
-        //{ print }                \
+    # This is a bit tricky, because yum -y assumes missing or failed
+    # packages are OK (see [1]).  We want devstack to stop if we are
+    # installing missing packages.
+    #
+    # Thus we manually match on the output (stack.sh runs in a fixed
+    # locale, so lang shouldn't change).
+    #
+    # If yum returns !0, we echo the result as "YUM_FAILED" and return
+    # that from the awk (we're subverting -e with this trick).
+    # Otherwise we use awk to look for failure strings and return "2"
+    # to indicate a terminal failure.
+    #
+    # [1] https://bugzilla.redhat.com/show_bug.cgi?id=965567
+    parse_yum_result='              \
+        BEGIN { result=0 }          \
+        /^YUM_FAILED/ { result=$2 } \
+        /^No package/ { result=2 }  \
+        /^Failed:/    { result=2 }  \
+        //{ print }                 \
         END { exit result }'
-
-    # The manual check for missing packages is because yum -y assumes
-    # missing or failed packages are OK.
-    # See https://bugzilla.redhat.com/show_bug.cgi?id=965567
     (sudo_with_proxies "${YUM:-yum}" install -y "$@" 2>&1 || echo YUM_FAILED $?) \
         | awk "$parse_yum_result" && result=$? || result=$?
 

From 499a9e39c1bfeb39928b04a9f1cc84a91521dcad Mon Sep 17 00:00:00 2001
From: John Hua <john.hua@citrix.com>
Date: Mon, 26 Sep 2016 11:43:49 +0800
Subject: [PATCH 0620/2409] XenAPI: Remove legacy tty image

UPLOAD_LEGACY_TTY was for console access, but it's no longer used.

Change-Id: I294c8716be2e6ee9f53108d4eb41faf99e975538
---
 stack.sh | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/stack.sh b/stack.sh
index 6a5a2a318f..9aa770f2b9 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1221,11 +1221,6 @@ if is_service_enabled g-reg; then
 
     echo_summary "Uploading images"
 
-    # Option to upload legacy ami-tty, which works with xenserver
-    if [[ -n "$UPLOAD_LEGACY_TTY" ]]; then
-        IMAGE_URLS="${IMAGE_URLS:+${IMAGE_URLS},}https://github.com/downloads/citrix-openstack/warehouse/tty.tgz"
-    fi
-
     for image_url in ${IMAGE_URLS//,/ }; do
         upload_image $image_url
     done

From 323b726783d6d4ef24a0c9f0d7c77b9e8b152c61 Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Fri, 23 Sep 2016 13:33:40 -0700
Subject: [PATCH 0621/2409] Don't make root CA if it exists

To support multinode testing where we just copy the CA to all the
instances don't remake the CA if it already exists.

The end result is that you can trusty a single chain and all your
clients will be happy regardless of which host they are talking to.

Change-Id: I90892e6828a59fa37af717361a2f1eed15a87ae4
---
 lib/tls | 22 ++++++++++++----------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/lib/tls b/lib/tls
index 2c4e18d388..2443d7d31d 100644
--- a/lib/tls
+++ b/lib/tls
@@ -322,15 +322,17 @@ function make_root_CA {
     create_CA_base $ca_dir
     create_CA_config $ca_dir 'Root CA'
 
-    # Create a self-signed certificate valid for 5 years
-    $OPENSSL req -config $ca_dir/ca.conf \
-        -x509 \
-        -nodes \
-        -newkey rsa \
-        -days 21360 \
-        -keyout $ca_dir/private/cacert.key \
-        -out $ca_dir/cacert.pem \
-        -outform PEM
+    if [ ! -r "$ca_dir/cacert.pem" ]; then
+        # Create a self-signed certificate valid for 5 years
+        $OPENSSL req -config $ca_dir/ca.conf \
+            -x509 \
+            -nodes \
+            -newkey rsa \
+            -days 21360 \
+            -keyout $ca_dir/private/cacert.key \
+            -out $ca_dir/cacert.pem \
+            -outform PEM
+    fi
 }
 
 # If a non-system python-requests is installed then it will use the
@@ -507,7 +509,7 @@ function cleanup_CA {
         sudo update-ca-certificates
     fi
 
-    rm -rf "$DATA_DIR/CA" "$DEVSTACK_CERT"
+    rm -rf "$INT_CA_DIR" "$ROOT_CA_DIR" "$DEVSTACK_CERT"
 }
 
 # Tell emacs to use shell-script-mode

From 890342ed878f4a8f556ae733b6bd6c872308a937 Mon Sep 17 00:00:00 2001
From: Jens Rosenboom <j.rosenboom@x-ion.de>
Date: Tue, 13 Sep 2016 22:41:41 +0200
Subject: [PATCH 0622/2409] Work around issue in glance_store swift driver

With [1] glance_store introduced default settings for user_domain_id and
project_domain_id. Sadly since these are always passed to the keystone
client, they override any settings to user_domain_name and
project_domain_name that are made in the config, leading to authentication
failures.

So as a workaround until [2] is fixed, we explicitly place the corresponding
domain_ids into the config.

[1] https://review.openstack.org/297665
[2] https://bugs.launchpad.net/tempest/+bug/1620999

Change-Id: Ica81a1a176614392291f2db4cc6398ed30663aed
---
 lib/glance | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/lib/glance b/lib/glance
index 8d95aad73f..5274714a6c 100644
--- a/lib/glance
+++ b/lib/glance
@@ -187,8 +187,6 @@ function configure_glance {
 
         iniset $GLANCE_SWIFT_STORE_CONF ref1 key $SERVICE_PASSWORD
         iniset $GLANCE_SWIFT_STORE_CONF ref1 auth_address $KEYSTONE_SERVICE_URI/v3
-        iniset $GLANCE_SWIFT_STORE_CONF ref1 user_domain_name $SERVICE_DOMAIN_NAME
-        iniset $GLANCE_SWIFT_STORE_CONF ref1 project_domain_name $SERVICE_DOMAIN_NAME
         iniset $GLANCE_SWIFT_STORE_CONF ref1 auth_version 3
 
         # commenting is not strictly necessary but it's confusing to have bad values in conf
@@ -312,6 +310,11 @@ function create_glance_accounts {
             "$GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT" \
             "$GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT" \
             "$GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT"
+
+        # Note(frickler): Crude workaround for https://bugs.launchpad.net/glance-store/+bug/1620999
+        service_domain_id=$(get_or_create_domain $SERVICE_DOMAIN_NAME)
+        iniset $GLANCE_SWIFT_STORE_CONF ref1 project_domain_id $service_domain_id
+        iniset $GLANCE_SWIFT_STORE_CONF ref1 user_domain_id $service_domain_id
     fi
 
     # Add glance-glare service and endpoints

From 04e69de6c513e1cddaaa74eb2ff428a5db4d223b Mon Sep 17 00:00:00 2001
From: Jamie Lennox <jamielennox@gmail.com>
Date: Wed, 27 Jul 2016 08:05:05 +1000
Subject: [PATCH 0623/2409] Mount identity admin script at /identity_admin

The /identity_admin endpoint is the port 80/443 equivalent of the
service that typically runs on port 35357. In v2 some operations must be
performed on the admin endpoint whereas on v3 the services on 5000 and
35357 are exactly the same. This would be why the service was mounted at
/identity_v2_admin however that is misleading because both the v2 and v3
services are present on that endpoint.

This is particularly confusing because we set this as the OS_AUTH_URL
endpoint and it makes it seem like we are doing v2 authentication when
we are not.

Change-Id: If73735026079fb19ca5bd44b3a4dc1f507b5c99d
---
 files/apache-keystone.template | 4 ++--
 lib/keystone                   | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/files/apache-keystone.template b/files/apache-keystone.template
index 8a4b0f0c43..428544f25c 100644
--- a/files/apache-keystone.template
+++ b/files/apache-keystone.template
@@ -44,8 +44,8 @@ Alias /identity %KEYSTONE_BIN%/keystone-wsgi-public
     WSGIPassAuthorization On
 </Location>
 
-Alias /identity_v2_admin %KEYSTONE_BIN%/keystone-wsgi-admin
-<Location /identity_v2_admin>
+Alias /identity_admin %KEYSTONE_BIN%/keystone-wsgi-admin
+<Location /identity_admin>
     SetHandler wsgi-script
     Options +ExecCGI
 
diff --git a/lib/keystone b/lib/keystone
index 851db042ba..23f09a5499 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -124,7 +124,7 @@ fi
 # complete URIs
 if [ "$KEYSTONE_DEPLOY" == "mod_wsgi" ]; then
     # If running in Apache, use path access rather than port.
-    KEYSTONE_AUTH_URI=${KEYSTONE_AUTH_PROTOCOL}://${KEYSTONE_AUTH_HOST}/identity_v2_admin
+    KEYSTONE_AUTH_URI=${KEYSTONE_AUTH_PROTOCOL}://${KEYSTONE_AUTH_HOST}/identity_admin
     KEYSTONE_SERVICE_URI=${KEYSTONE_SERVICE_PROTOCOL}://${KEYSTONE_SERVICE_HOST}/identity
 else
     KEYSTONE_AUTH_URI=${KEYSTONE_AUTH_PROTOCOL}://${KEYSTONE_AUTH_HOST}:${KEYSTONE_AUTH_PORT}

From 69e3c0aac99981f17c76c22111e5c397824b8428 Mon Sep 17 00:00:00 2001
From: Ian Cordasco <graffatcolmingov@gmail.com>
Date: Mon, 26 Sep 2016 12:53:14 -0500
Subject: [PATCH 0624/2409] Update certificate creation for urllib3

urllib3 1.18 was released today and contains new more correct hostname
matching that takes into account the ipAddress portion of a certificate
and disallows matching an IP Address against a DNS hostname.

Change-Id: I37d247b68911dc85f55adec6a7952ed321c1b1d8
---
 functions-common | 12 ++++++++++++
 lib/tls          |  5 ++++-
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index 4716567be3..9544c8102f 100644
--- a/functions-common
+++ b/functions-common
@@ -2207,6 +2207,18 @@ function cidr2netmask {
     echo ${1-0}.${2-0}.${3-0}.${4-0}
 }
 
+# Check if this is a valid ipv4 address string
+function is_ipv4_address {
+    local address=$1
+    local regex='([0-9]{1,3}.){3}[0-9]{1,3}'
+    # TODO(clarkb) make this more robust
+    if [[ "$address" =~ $regex ]] ; then
+        return 0
+    else
+        return 1
+    fi
+}
+
 # Gracefully cp only if source file/dir exists
 # cp_it source destination
 function cp_it {
diff --git a/lib/tls b/lib/tls
index 2c4e18d388..78d476fbf2 100644
--- a/lib/tls
+++ b/lib/tls
@@ -226,7 +226,7 @@ function init_cert {
     if [[ ! -r $DEVSTACK_CERT ]]; then
         if [[ -n "$TLS_IP" ]]; then
             # Lie to let incomplete match routines work
-            TLS_IP="DNS:$TLS_IP"
+            TLS_IP="DNS:$TLS_IP,IP:$TLS_IP"
         fi
         make_cert $INT_CA_DIR $DEVSTACK_CERT_NAME $DEVSTACK_HOSTNAME "$TLS_IP"
 
@@ -249,6 +249,9 @@ function make_cert {
         else
             alt_names="$alt_names,DNS:$SERVICE_HOST"
         fi
+        if is_ipv4_address "$SERVICE_HOST" ; then
+            alt_names="$alt_names,IP:$SERVICE_HOST"
+        fi
     fi
 
     # Only generate the certificate if it doesn't exist yet on the disk

From 4a55d2a66092e351726251bb21a1d82b3501bdcd Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@midokura.com>
Date: Wed, 24 Aug 2016 15:30:09 +0900
Subject: [PATCH 0625/2409] lib/neutron: Rename core plugin variables

NEUTRON_PLUGIN -> NEUTRON_CORE_PLUGIN
NEUTRON_PLUGIN_* -> NEUTRON_CORE_PLUGIN_*

Change-Id: I1d93d8bd1e6e3bbca0e56a2da0684ab3f3fbb525
---
 lib/neutron | 42 +++++++++++++++++++++---------------------
 1 file changed, 21 insertions(+), 21 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index ab84f7eefe..5370392796 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -47,10 +47,10 @@ NEUTRON_STATE_PATH=${NEUTRON_STATE_PATH:=$DATA_DIR/neutron}
 NEUTRON_AUTH_CACHE_DIR=${NEUTRON_AUTH_CACHE_DIR:-/var/cache/neutron}
 
 # By default, use the ML2 plugin
-NEUTRON_PLUGIN=${NEUTRON_PLUGIN:-ml2}
-NEUTRON_PLUGIN_CONF_FILENAME=${NEUTRON_PLUGIN_CONF_FILENAME:-ml2_conf.ini}
-NEUTRON_PLUGIN_CONF_PATH=$NEUTRON_CONF_DIR/plugins/$NEUTRON_PLUGIN
-NEUTRON_PLUGIN_CONF=$NEUTRON_PLUGIN_CONF_PATH/$NEUTRON_PLUGIN_CONF_FILENAME
+NEUTRON_CORE_PLUGIN=${NEUTRON_CORE_PLUGIN:-ml2}
+NEUTRON_CORE_PLUGIN_CONF_FILENAME=${NEUTRON_CORE_PLUGIN_CONF_FILENAME:-ml2_conf.ini}
+NEUTRON_CORE_PLUGIN_CONF_PATH=$NEUTRON_CONF_DIR/plugins/$NEUTRON_CORE_PLUGIN
+NEUTRON_CORE_PLUGIN_CONF=$NEUTRON_CORE_PLUGIN_CONF_PATH/$NEUTRON_CORE_PLUGIN_CONF_FILENAME
 
 NEUTRON_AGENT_BINARY=${NEUTRON_AGENT_BINARY:-neutron-$NEUTRON_AGENT-agent}
 NEUTRON_L3_BINARY=${NEUTRON_L3_BINARY:-neutron-l3-agent}
@@ -117,9 +117,9 @@ function configure_neutron_new {
 
     configure_neutron_rootwrap
 
-    mkdir -p $NEUTRON_PLUGIN_CONF_PATH
+    mkdir -p $NEUTRON_CORE_PLUGIN_CONF_PATH
 
-    cp $NEUTRON_DIR/etc/neutron/plugins/$NEUTRON_PLUGIN/$NEUTRON_PLUGIN_CONF_FILENAME.sample $NEUTRON_PLUGIN_CONF
+    cp $NEUTRON_DIR/etc/neutron/plugins/$NEUTRON_CORE_PLUGIN/$NEUTRON_CORE_PLUGIN_CONF_FILENAME.sample $NEUTRON_CORE_PLUGIN_CONF
 
     iniset $NEUTRON_CONF database connection `database_connection_url neutron`
     iniset $NEUTRON_CONF DEFAULT state_path $NEUTRON_STATE_PATH
@@ -139,7 +139,7 @@ function configure_neutron_new {
 
         cp $NEUTRON_DIR/etc/api-paste.ini $NEUTRON_CONF_DIR/api-paste.ini
 
-        iniset $NEUTRON_CONF DEFAULT core_plugin $NEUTRON_PLUGIN
+        iniset $NEUTRON_CONF DEFAULT core_plugin $NEUTRON_CORE_PLUGIN
 
         iniset $NEUTRON_CONF DEFAULT policy_file $policy_file
         iniset $NEUTRON_CONF DEFAULT allow_overlapping_ips True
@@ -162,25 +162,25 @@ function configure_neutron_new {
 
         # Configure VXLAN
         # TODO(sc68cal) not hardcode?
-        iniset $NEUTRON_PLUGIN_CONF ml2 tenant_network_types vxlan
-        iniset $NEUTRON_PLUGIN_CONF ml2 type_drivers vxlan
-        iniset $NEUTRON_PLUGIN_CONF ml2 mechanism_drivers openvswitch,linuxbridge
-        iniset $NEUTRON_PLUGIN_CONF ml2_type_vxlan vni_ranges 1001:2000
-        iniset $NEUTRON_PLUGIN_CONF ml2 extension_drivers port_security
+        iniset $NEUTRON_CORE_PLUGIN_CONF ml2 tenant_network_types vxlan
+        iniset $NEUTRON_CORE_PLUGIN_CONF ml2 type_drivers vxlan
+        iniset $NEUTRON_CORE_PLUGIN_CONF ml2 mechanism_drivers openvswitch,linuxbridge
+        iniset $NEUTRON_CORE_PLUGIN_CONF ml2_type_vxlan vni_ranges 1001:2000
+        iniset $NEUTRON_CORE_PLUGIN_CONF ml2 extension_drivers port_security
     fi
 
     # Neutron OVS or LB agent
     if is_service_enabled neutron-agent; then
-        iniset $NEUTRON_PLUGIN_CONF agent tunnel_types vxlan
-        iniset $NEUTRON_PLUGIN_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
+        iniset $NEUTRON_CORE_PLUGIN_CONF agent tunnel_types vxlan
+        iniset $NEUTRON_CORE_PLUGIN_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
 
         # Configure the neutron agent
         if [[ $NEUTRON_AGENT == "linuxbridge" ]]; then
-            iniset $NEUTRON_PLUGIN_CONF securitygroup iptables
-            iniset $NEUTRON_PLUGIN_CONF vxlan local_ip $HOST_IP
+            iniset $NEUTRON_CORE_PLUGIN_CONF securitygroup iptables
+            iniset $NEUTRON_CORE_PLUGIN_CONF vxlan local_ip $HOST_IP
         else
-            iniset $NEUTRON_PLUGIN_CONF securitygroup iptables_hybrid
-            iniset $NEUTRON_PLUGIN_CONF ovs local_ip $HOST_IP
+            iniset $NEUTRON_CORE_PLUGIN_CONF securitygroup iptables_hybrid
+            iniset $NEUTRON_CORE_PLUGIN_CONF ovs local_ip $HOST_IP
         fi
     fi
 
@@ -397,7 +397,7 @@ function start_neutron_api {
 
     # Start the Neutron service
     # TODO(sc68cal) Stop hard coding this
-    run_process neutron-api "$NEUTRON_BIN_DIR/neutron-server --config-file $NEUTRON_CONF --config-file $NEUTRON_PLUGIN_CONF"
+    run_process neutron-api "$NEUTRON_BIN_DIR/neutron-server --config-file $NEUTRON_CONF --config-file $NEUTRON_CORE_PLUGIN_CONF"
 
     if is_ssl_enabled_service "neutron"; then
         ssl_ca="--ca-certificate=${SSL_BUNDLE_FILE}"
@@ -475,9 +475,9 @@ function _set_config_files {
 
     NEUTRON_CONFIG_ARG+=" --config-file $NEUTRON_CONF"
 
-    #TODO(sc68cal) OVS and LB agent uses settings in NEUTRON_PLUGIN_CONF (ml2_conf.ini) but others may not
+    #TODO(sc68cal) OVS and LB agent uses settings in NEUTRON_CORE_PLUGIN_CONF (ml2_conf.ini) but others may not
     if is_service_enabled neutron-agent; then
-        NEUTRON_CONFIG_ARG+=" --config-file $NEUTRON_PLUGIN_CONF"
+        NEUTRON_CONFIG_ARG+=" --config-file $NEUTRON_CORE_PLUGIN_CONF"
     fi
 
     if is_service_enabled neutron-dhcp; then

From 1aa436813566081c24f0223b2ac48c2389c244ce Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@midokura.com>
Date: Thu, 21 Jul 2016 19:37:04 +0900
Subject: [PATCH 0626/2409] Move Q_ROUTER_NAME to where it belongs

The motivation is to make it more friendly with lib/neutron.
ie. independent from lib/neutron-legacy

Change-Id: I19821b009cbf1bc715a6c7b2854e4c77d2041ec4
---
 lib/neutron-legacy              | 2 --
 lib/neutron_plugins/services/l3 | 3 +++
 lib/tempest                     | 1 -
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 123ba4238f..9e926a000f 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -125,8 +125,6 @@ Q_USE_ROOTWRAP_DAEMON=$(trueorfalse True Q_USE_ROOTWRAP_DAEMON)
 Q_META_DATA_IP=${Q_META_DATA_IP:-$SERVICE_HOST}
 # Allow Overlapping IP among subnets
 Q_ALLOW_OVERLAPPING_IP=${Q_ALLOW_OVERLAPPING_IP:-True}
-# The name of the default q-l3 router
-Q_ROUTER_NAME=${Q_ROUTER_NAME:-router1}
 Q_NOTIFY_NOVA_PORT_STATUS_CHANGES=${Q_NOTIFY_NOVA_PORT_STATUS_CHANGES:-True}
 Q_NOTIFY_NOVA_PORT_DATA_CHANGES=${Q_NOTIFY_NOVA_PORT_DATA_CHANGES:-True}
 VIF_PLUGGING_IS_FATAL=${VIF_PLUGGING_IS_FATAL:-True}
diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 408b322702..54dae2b4c7 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -22,6 +22,9 @@ PUBLIC_BRIDGE_MTU=${PUBLIC_BRIDGE_MTU:-1500}
 # used.
 Q_ASSIGN_GATEWAY_TO_PUBLIC_BRIDGE=${Q_ASSIGN_GATEWAY_TO_PUBLIC_BRIDGE:-True}
 
+# The name of the default router
+Q_ROUTER_NAME=${Q_ROUTER_NAME:-router1}
+
 # If Q_USE_PUBLIC_VETH=True, create and use a veth pair instead of
 # PUBLIC_BRIDGE.  This is intended to be used with
 # Q_USE_PROVIDERNET_FOR_PUBLIC=True.
diff --git a/lib/tempest b/lib/tempest
index b491bf82ef..0845ad0afa 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -15,7 +15,6 @@
 #   - ``SERVICE_HOST``
 #   - ``BASE_SQL_CONN`` ``lib/database`` declares
 #   - ``PUBLIC_NETWORK_NAME``
-#   - ``Q_ROUTER_NAME``
 #   - ``VIRT_DRIVER``
 #   - ``LIBVIRT_TYPE``
 #   - ``KEYSTONE_SERVICE_PROTOCOL``, ``KEYSTONE_SERVICE_HOST`` from lib/keystone

From b34d459bbc100e65fbc308438b3b7f72bd5fb5b6 Mon Sep 17 00:00:00 2001
From: Drago Rosson <drago@rosson.me>
Date: Mon, 26 Sep 2016 13:23:23 -0500
Subject: [PATCH 0627/2409] Allow default IPv6 route device names to have dots

When dots are used with sysctl, they are reinterpreted as slashes.
Route devices can have dots in their names, so when they are used in a
sysctl command that also uses dots, its dot will be replaced with a
slash, causing an error.

Change-Id: Ie32126a3aa8d646568d7d37ec4874419b9658935
Closes-Bug: #1627770
---
 lib/neutron_plugins/services/l3 | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 408b322702..8c26b2b199 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -401,7 +401,10 @@ function _neutron_configure_router_v6 {
         # IPv6-only clouds in the gate. Please do not remove this without
         # talking to folks in Infra.
         for d in $default_v6_route_devs; do
-            sudo sysctl -w net.ipv6.conf.$d.accept_ra=2
+            # Slashes must be used in this sysctl command because route devices
+            # can have dots in their names. If dots were used, dots in the
+            # device name would be reinterpreted as a slash, causing an error.
+            sudo sysctl -w net/ipv6/conf/$d/accept_ra=2
         done
         # Ensure IPv6 forwarding is enabled on the host
         sudo sysctl -w net.ipv6.conf.all.forwarding=1

From aa7ec81fd794d4ab02b96f726ae08f53abc90073 Mon Sep 17 00:00:00 2001
From: Hironori Shiina <shiina.hironori@jp.fujitsu.com>
Date: Wed, 28 Sep 2016 20:21:57 +0900
Subject: [PATCH 0628/2409] Fix typo in documentation

This patch just removes a duplicate 'the'.

Change-Id: I3393a51d55ba8ec1639c2548781f8972f0d5c9d0
---
 doc/source/guides/neutron.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index b26fd1e8ee..05f60bae5f 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -595,7 +595,7 @@ to be configured for VLAN tenant networks.
 
 For OVS, a similar configuration like described in the
 :ref:`OVS Provider Network <ovs-provider-network-controller>` section can be
-used. Just add the the following line to this local.conf, which also loads
+used. Just add the following line to this local.conf, which also loads
 the MacVTap mechanism driver:
 
 ::

From 0009869caebe3b671c84f19cbde694547e3dd11b Mon Sep 17 00:00:00 2001
From: Andrew Laski <andrew@lascii.com>
Date: Wed, 28 Sep 2016 15:05:31 -0400
Subject: [PATCH 0629/2409] Don't install Nova policy.json

Nova ships with an empty policy.json file which it does not need.
oslo.policy previously required the empty file to be there but as of
version 1.14.0 it is possible to run with no policy file at all. Since
there are no policies defined in the sample file let's no install it.

Change-Id: I85a251376dfe38caa4b100861bf764014a98bc37
Depends-On: I09fa842ffbe75bed269cef6edc9c82d18bfe9297
---
 lib/nova | 2 --
 1 file changed, 2 deletions(-)

diff --git a/lib/nova b/lib/nova
index 334cba6dd7..3e9857a778 100644
--- a/lib/nova
+++ b/lib/nova
@@ -302,8 +302,6 @@ function configure_nova {
     # Put config files in ``/etc/nova`` for everyone to find
     sudo install -d -o $STACK_USER $NOVA_CONF_DIR
 
-    install_default_policy nova
-
     configure_rootwrap nova
 
     if [[ "$ENABLED_SERVICES" =~ "n-api" ]]; then

From b3a210f643989603d192b32a40b2001664f8ed73 Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Thu, 29 Sep 2016 13:26:30 +0000
Subject: [PATCH 0630/2409] Enable bridge firewalling if iptables are used

With the plan [1] to stop enabling it by Neutron iptables firewall
driver itself, deployment tools should catch up and enable the firewall
themselves.

This is needed for distributions that decided to disable the kernel
firewall by default (upstream kernel has it enabled). This is also
needed for distributions that ship newer kernels but don't load the
br_netfilter module before starting nova-network or Neutron iptables
firewall driver. In the latter case, firewall may not work, depending on
the order of operations executed by the driver.

To isolate devstack setups from the difference in distribution
kernel configuration and version, the following steps are done:

- we load bridge kernel module, and br_netfilter if present, to get
  access to sysctl knobs controlling the firewall;
- once knobs are available, we unconditionally set them to 1, to make
  sure the firewall is in effect.

More details at:
http://wiki.libvirt.org/page/Net.bridge.bridge-nf-call_and_sysctl.conf

[1] I9137ea017624ac92a05f73863b77f9ee4681bbe7

Change-Id: Id6bfd9595f0772a63d1096ef83ebbb6cd630fafd
Related-Bug: #1622914
---
 functions                             | 18 ++++++++++++++++++
 lib/neutron                           |  2 ++
 lib/neutron_plugins/linuxbridge_agent |  1 +
 lib/neutron_plugins/ovs_base          |  1 +
 lib/nova                              |  6 +++++-
 5 files changed, 27 insertions(+), 1 deletion(-)

diff --git a/functions b/functions
index 58565788ff..6a0ac67b69 100644
--- a/functions
+++ b/functions
@@ -646,6 +646,24 @@ function set_mtu {
 }
 
 
+# enable_kernel_bridge_firewall - Enable kernel support for bridge firewalling
+function enable_kernel_bridge_firewall {
+    # Load bridge module. This module provides access to firewall for bridged
+    # frames; and also on older kernels (pre-3.18) it provides sysctl knobs to
+    # enable/disable bridge firewalling
+    sudo modprobe bridge
+    # For newer kernels (3.18+), those sysctl settings are split into a separate
+    # kernel module (br_netfilter). Load it too, if present.
+    sudo modprobe br_netfilter 2>> /dev/null || :
+    # Enable bridge firewalling in case it's disabled in kernel (upstream
+    # default is enabled, but some distributions may decide to change it).
+    # This is at least needed for RHEL 7.2 and earlier releases.
+    for proto in arp ip ip6; do
+        sudo sysctl -w net.bridge.bridge-nf-call-${proto}tables=1
+    done
+}
+
+
 # Restore xtrace
 $_XTRACE_FUNCTIONS
 
diff --git a/lib/neutron b/lib/neutron
index 5370392796..9e9eb2d2b1 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -182,6 +182,8 @@ function configure_neutron_new {
             iniset $NEUTRON_CORE_PLUGIN_CONF securitygroup iptables_hybrid
             iniset $NEUTRON_CORE_PLUGIN_CONF ovs local_ip $HOST_IP
         fi
+
+        enable_kernel_bridge_firewall
     fi
 
     # DHCP Agent
diff --git a/lib/neutron_plugins/linuxbridge_agent b/lib/neutron_plugins/linuxbridge_agent
index 7d59e1347c..d0de2f5e5d 100644
--- a/lib/neutron_plugins/linuxbridge_agent
+++ b/lib/neutron_plugins/linuxbridge_agent
@@ -69,6 +69,7 @@ function neutron_plugin_configure_plugin_agent {
     fi
     if [[ "$Q_USE_SECGROUP" == "True" ]]; then
         iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver neutron.agent.linux.iptables_firewall.IptablesFirewallDriver
+        enable_kernel_bridge_firewall
     else
         iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver neutron.agent.firewall.NoopFirewallDriver
     fi
diff --git a/lib/neutron_plugins/ovs_base b/lib/neutron_plugins/ovs_base
index f6d10ea4f9..3cd6c85053 100644
--- a/lib/neutron_plugins/ovs_base
+++ b/lib/neutron_plugins/ovs_base
@@ -84,6 +84,7 @@ function _neutron_ovs_base_configure_debug_command {
 function _neutron_ovs_base_configure_firewall_driver {
     if [[ "$Q_USE_SECGROUP" == "True" ]]; then
         iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver neutron.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver
+        enable_kernel_bridge_firewall
     else
         iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver neutron.agent.firewall.NoopFirewallDriver
     fi
diff --git a/lib/nova b/lib/nova
index 334cba6dd7..d321b73205 100644
--- a/lib/nova
+++ b/lib/nova
@@ -866,9 +866,13 @@ function start_nova_rest {
     run_process n-cond "$NOVA_BIN_DIR/nova-conductor --config-file $compute_cell_conf"
     run_process n-cell-region "$NOVA_BIN_DIR/nova-cells --config-file $api_cell_conf"
     run_process n-cell-child "$NOVA_BIN_DIR/nova-cells --config-file $compute_cell_conf"
-
     run_process n-crt "$NOVA_BIN_DIR/nova-cert --config-file $api_cell_conf"
+
+    if is_service_enabled n-net; then
+        enable_kernel_bridge_firewall
+    fi
     run_process n-net "$NOVA_BIN_DIR/nova-network --config-file $compute_cell_conf"
+
     run_process n-sch "$NOVA_BIN_DIR/nova-scheduler --config-file $compute_cell_conf"
     run_process n-api-meta "$NOVA_BIN_DIR/nova-api-metadata --config-file $compute_cell_conf"
 

From c12c12f6630f591d20dd5098be1fe105f2cc790b Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Fri, 30 Sep 2016 06:57:24 +0000
Subject: [PATCH 0631/2409] Updated from generate-devstack-plugins-list

Change-Id: Id9ce2cbdad53665ca2f6b7e57cb2553cb89cd982
---
 doc/source/plugin-registry.rst | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 9d023bf5e2..f29b0d7ae2 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -59,6 +59,7 @@ freezer                                `git://git.openstack.org/openstack/freeze
 freezer-api                            `git://git.openstack.org/openstack/freezer-api <https://git.openstack.org/cgit/openstack/freezer-api>`__
 freezer-web-ui                         `git://git.openstack.org/openstack/freezer-web-ui <https://git.openstack.org/cgit/openstack/freezer-web-ui>`__
 gce-api                                `git://git.openstack.org/openstack/gce-api <https://git.openstack.org/cgit/openstack/gce-api>`__
+glare                                  `git://git.openstack.org/openstack/glare <https://git.openstack.org/cgit/openstack/glare>`__
 gnocchi                                `git://git.openstack.org/openstack/gnocchi <https://git.openstack.org/cgit/openstack/gnocchi>`__
 group-based-policy                     `git://git.openstack.org/openstack/group-based-policy <https://git.openstack.org/cgit/openstack/group-based-policy>`__
 heat                                   `git://git.openstack.org/openstack/heat <https://git.openstack.org/cgit/openstack/heat>`__
@@ -69,6 +70,7 @@ ironic-staging-drivers                 `git://git.openstack.org/openstack/ironic
 karbor                                 `git://git.openstack.org/openstack/karbor <https://git.openstack.org/cgit/openstack/karbor>`__
 karbor-dashboard                       `git://git.openstack.org/openstack/karbor-dashboard <https://git.openstack.org/cgit/openstack/karbor-dashboard>`__
 kingbird                               `git://git.openstack.org/openstack/kingbird <https://git.openstack.org/cgit/openstack/kingbird>`__
+kuryr-kubernetes                       `git://git.openstack.org/openstack/kuryr-kubernetes <https://git.openstack.org/cgit/openstack/kuryr-kubernetes>`__
 kuryr-libnetwork                       `git://git.openstack.org/openstack/kuryr-libnetwork <https://git.openstack.org/cgit/openstack/kuryr-libnetwork>`__
 magnum                                 `git://git.openstack.org/openstack/magnum <https://git.openstack.org/cgit/openstack/magnum>`__
 magnum-ui                              `git://git.openstack.org/openstack/magnum-ui <https://git.openstack.org/cgit/openstack/magnum-ui>`__
@@ -111,6 +113,7 @@ neutron-fwaas                          `git://git.openstack.org/openstack/neutro
 neutron-lbaas                          `git://git.openstack.org/openstack/neutron-lbaas <https://git.openstack.org/cgit/openstack/neutron-lbaas>`__
 neutron-lbaas-dashboard                `git://git.openstack.org/openstack/neutron-lbaas-dashboard <https://git.openstack.org/cgit/openstack/neutron-lbaas-dashboard>`__
 neutron-vpnaas                         `git://git.openstack.org/openstack/neutron-vpnaas <https://git.openstack.org/cgit/openstack/neutron-vpnaas>`__
+nimble                                 `git://git.openstack.org/openstack/nimble <https://git.openstack.org/cgit/openstack/nimble>`__
 nova-docker                            `git://git.openstack.org/openstack/nova-docker <https://git.openstack.org/cgit/openstack/nova-docker>`__
 nova-lxd                               `git://git.openstack.org/openstack/nova-lxd <https://git.openstack.org/cgit/openstack/nova-lxd>`__
 nova-mksproxy                          `git://git.openstack.org/openstack/nova-mksproxy <https://git.openstack.org/cgit/openstack/nova-mksproxy>`__

From c58a15575d3d202c1ecb19ebba82a908dfb66028 Mon Sep 17 00:00:00 2001
From: rajinir <rajini_ram@dell.com>
Date: Tue, 27 Sep 2016 17:14:59 -0500
Subject: [PATCH 0632/2409] Neutron L3 subnetpool creation should be optional

Added an option to make subnetpools to be optional
as it ignores the public network specified in
FIXED_RANGE.

DocImpact
Change-Id: Ic89ceca76afda67da5545111972c3348011f294f
Closes-Bug: #1628267
---
 doc/source/guides/neutron.rst   |  2 ++
 lib/neutron_plugins/services/l3 | 13 ++++++++-----
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index b26fd1e8ee..78150f3742 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -392,6 +392,7 @@ controller node.
         PROVIDER_SUBNET_NAME="provider_net"
         PROVIDER_NETWORK_TYPE="vlan"
         SEGMENTATION_ID=2010
+        USE_SUBNETPOOL=False
 
 In this configuration we are defining FIXED_RANGE to be a
 publicly routed IPv4 subnet. In this specific instance we are using
@@ -577,6 +578,7 @@ you do not require them.
     PROVIDER_SUBNET_NAME="provider_net"
     PROVIDER_NETWORK_TYPE="vlan"
     SEGMENTATION_ID=2010
+    USE_SUBNETPOOL=False
 
     [[post-config|/$Q_PLUGIN_CONF_FILE]]
     [macvtap]
diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 408b322702..33db4cb538 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -80,6 +80,7 @@ PRIVATE_SUBNET_NAME=${PRIVATE_SUBNET_NAME:-"private-subnet"}
 PUBLIC_SUBNET_NAME=${PUBLIC_SUBNET_NAME:-"public-subnet"}
 
 # Subnetpool defaults
+USE_SUBNETPOOL=${USE_SUBNETPOOL:-True}
 SUBNETPOOL_NAME=${SUBNETPOOL_NAME:-"shared-default-subnetpool"}
 
 SUBNETPOOL_PREFIX_V4=${SUBNETPOOL_PREFIX_V4:-10.0.0.0/8}
@@ -168,11 +169,13 @@ function create_neutron_initial_network {
     fi
 
     if is_networking_extension_supported "auto-allocated-topology"; then
-        if [[ "$IP_VERSION" =~ 4.* ]]; then
-            SUBNETPOOL_V4_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnetpool-create $SUBNETPOOL_NAME --default-prefixlen $SUBNETPOOL_SIZE_V4 --pool-prefix $SUBNETPOOL_PREFIX_V4 --shared --is-default=True | grep ' id ' | get_field 2)
-        fi
-        if [[ "$IP_VERSION" =~ .*6 ]]; then
-            SUBNETPOOL_V6_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnetpool-create $SUBNETPOOL_NAME --default-prefixlen $SUBNETPOOL_SIZE_V6 --pool-prefix $SUBNETPOOL_PREFIX_V6 --shared --is-default=True | grep ' id ' | get_field 2)
+        if [[ "$USE_SUBNETPOOL" == "True" ]]; then
+            if [[ "$IP_VERSION" =~ 4.* ]]; then
+                SUBNETPOOL_V4_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnetpool-create $SUBNETPOOL_NAME --default-prefixlen $SUBNETPOOL_SIZE_V4 --pool-prefix $SUBNETPOOL_PREFIX_V4 --shared --is-default=True | grep ' id ' | get_field 2)
+            fi
+            if [[ "$IP_VERSION" =~ .*6 ]]; then
+                SUBNETPOOL_V6_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnetpool-create $SUBNETPOOL_NAME --default-prefixlen $SUBNETPOOL_SIZE_V6 --pool-prefix $SUBNETPOOL_PREFIX_V6 --shared --is-default=True | grep ' id ' | get_field 2)
+            fi
         fi
     fi
 

From c271b3ea1fe16561b7a46507fdf961668182b256 Mon Sep 17 00:00:00 2001
From: Mike Perez <thingee@gmail.com>
Date: Mon, 3 Oct 2016 16:00:33 -0700
Subject: [PATCH 0633/2409] Update OpenStackClient role list commands

This command is deprecated. The new command is role assignment list.

Change-Id: I8dba0be21d5af6751bea13d8ff29cd4b7589ab3e
---
 doc/source/guides/multinode-lab.rst |  2 +-
 exercises/neutron-adv-test.sh       |  2 +-
 functions-common                    | 32 +++++++++--------------------
 3 files changed, 12 insertions(+), 24 deletions(-)

diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
index c996f95743..8751eb8d6a 100644
--- a/doc/source/guides/multinode-lab.rst
+++ b/doc/source/guides/multinode-lab.rst
@@ -260,7 +260,7 @@ for scripting:
     openstack user create $NAME --password=$PASSWORD --project $PROJECT
     openstack role add Member --user $NAME --project $PROJECT
     # The Member role is created by stack.sh
-    # openstack role list
+    # openstack role assignment list
 
 Swift
 -----
diff --git a/exercises/neutron-adv-test.sh b/exercises/neutron-adv-test.sh
index dc6bbbb5c7..e003c56331 100755
--- a/exercises/neutron-adv-test.sh
+++ b/exercises/neutron-adv-test.sh
@@ -148,7 +148,7 @@ function get_user_id {
 function get_role_id {
     local ROLE_NAME=$1
     local ROLE_ID
-    ROLE_ID=`openstack role list | grep $ROLE_NAME | awk '{print $2}'`
+    ROLE_ID=`openstack role assignment list | grep $ROLE_NAME | awk '{print $2}'`
     die_if_not_set $LINENO ROLE_ID "Failure retrieving ROLE_ID for $ROLE_NAME"
     echo "$ROLE_ID"
 }
diff --git a/functions-common b/functions-common
index 9544c8102f..87e6bb453d 100644
--- a/functions-common
+++ b/functions-common
@@ -865,11 +865,9 @@ function get_or_add_user_project_role {
     domain_args=$(_get_domain_args $4 $5)
 
     # Gets user role id
-    user_role_id=$(openstack role list \
+    user_role_id=$(openstack role assignment list \
         --user $2 \
-        --column "ID" \
         --project $3 \
-        --column "Name" \
         $domain_args \
         | grep " $1 " | get_field 1)
     if [[ -z "$user_role_id" ]]; then
@@ -878,11 +876,9 @@ function get_or_add_user_project_role {
             --user $2 \
             --project $3 \
             $domain_args
-        user_role_id=$(openstack role list \
+        user_role_id=$(openstack role assignment list \
             --user $2 \
-            --column "ID" \
             --project $3 \
-            --column "Name" \
             $domain_args \
             | grep " $1 " | get_field 1)
     fi
@@ -894,22 +890,18 @@ function get_or_add_user_project_role {
 function get_or_add_user_domain_role {
     local user_role_id
     # Gets user role id
-    user_role_id=$(openstack role list \
+    user_role_id=$(openstack role assignment list \
         --user $2 \
-        --column "ID" \
         --domain $3 \
-        --column "Name" \
         | grep " $1 " | get_field 1)
     if [[ -z "$user_role_id" ]]; then
         # Adds role to user and get it
         openstack role add $1 \
             --user $2 \
             --domain $3
-        user_role_id=$(openstack role list \
+        user_role_id=$(openstack role assignment list \
             --user $2 \
-            --column "ID" \
             --domain $3 \
-            --column "Name" \
             | grep " $1 " | get_field 1)
     fi
     echo $user_role_id
@@ -920,13 +912,11 @@ function get_or_add_user_domain_role {
 function get_or_add_user_domain_role {
     local user_role_id
     # Gets user role id
-    user_role_id=$(openstack role list \
+    user_role_id=$(openstack role assignment list \
         --user $2 \
         --os-url=$KEYSTONE_SERVICE_URI_V3 \
         --os-identity-api-version=3 \
-        --column "ID" \
         --domain $3 \
-        --column "Name" \
         | grep " $1 " | get_field 1)
     if [[ -z "$user_role_id" ]]; then
         # Adds role to user and get it
@@ -935,13 +925,11 @@ function get_or_add_user_domain_role {
             --domain $3 \
             --os-url=$KEYSTONE_SERVICE_URI_V3 \
             --os-identity-api-version=3
-        user_role_id=$(openstack role list \
+        user_role_id=$(openstack role assignment list \
             --user $2 \
             --os-url=$KEYSTONE_SERVICE_URI_V3 \
             --os-identity-api-version=3 \
-            --column "ID" \
             --domain $3 \
-            --column "Name" \
             | grep " $1 " | get_field 1)
     fi
     echo $user_role_id
@@ -952,19 +940,19 @@ function get_or_add_user_domain_role {
 function get_or_add_group_project_role {
     local group_role_id
     # Gets group role id
-    group_role_id=$(openstack role list \
+    group_role_id=$(openstack role assignment list \
         --group $2 \
         --project $3 \
-        -c "ID" -f value)
+        -f value)
     if [[ -z "$group_role_id" ]]; then
         # Adds role to group and get it
         openstack role add $1 \
             --group $2 \
             --project $3
-        group_role_id=$(openstack role list \
+        group_role_id=$(openstack role assignment list \
             --group $2 \
             --project $3 \
-            -c "ID" -f value)
+            -f value)
     fi
     echo $group_role_id
 }

From ca89d071b3c249fba55a824f7f4fc247b7c22948 Mon Sep 17 00:00:00 2001
From: Miguel Angel Ajo <majopela@redhat.com>
Date: Tue, 4 Oct 2016 18:17:44 +0200
Subject: [PATCH 0634/2409] Reduce the scope of the subnet pool prefix in
 neutron

Some of the clouds used for CI use the 10.2xx.0.0/16 range
for VMs, and collide with the wider 10.0.0.0/8.

This setting allows for creation of 256 subnets out of the pool.

Change-Id: I48c86f94098f1501f0e7f90a265dda7e81440eb0
Closes-Bug: 1629133
---
 lib/neutron_plugins/services/l3 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 54dae2b4c7..d998c065cf 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -85,7 +85,7 @@ PUBLIC_SUBNET_NAME=${PUBLIC_SUBNET_NAME:-"public-subnet"}
 # Subnetpool defaults
 SUBNETPOOL_NAME=${SUBNETPOOL_NAME:-"shared-default-subnetpool"}
 
-SUBNETPOOL_PREFIX_V4=${SUBNETPOOL_PREFIX_V4:-10.0.0.0/8}
+SUBNETPOOL_PREFIX_V4=${SUBNETPOOL_PREFIX_V4:-10.0.0.0/16}
 SUBNETPOOL_PREFIX_V6=${SUBNETPOOL_PREFIX_V6:-2001:db8:8000::/48}
 
 SUBNETPOOL_SIZE_V4=${SUBNETPOOL_SIZE_V4:-24}

From 57df186c132c522231aab1e577d879f7fa51c992 Mon Sep 17 00:00:00 2001
From: Clenimar Filemon <clenimar.filemon@gmail.com>
Date: Thu, 30 Jun 2016 17:30:26 -0300
Subject: [PATCH 0635/2409] Make Nova/Ironic communication use Identity v3

As long as nova already supports an Identity v3 auth flow when talking
to ironic (Id837d26bb21c158de0504627e488c0692aef1e24), make it use
v3 by default.

This way we don't fail in a keystone v3-only situation, for
example.

Change-Id: I028dfb52108d0630f47a53f8b420b70d4979eb55
---
 lib/nova_plugins/hypervisor-ironic | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/lib/nova_plugins/hypervisor-ironic b/lib/nova_plugins/hypervisor-ironic
index c40427c089..7ffd14d046 100644
--- a/lib/nova_plugins/hypervisor-ironic
+++ b/lib/nova_plugins/hypervisor-ironic
@@ -45,11 +45,13 @@ function configure_nova_hypervisor {
     iniset $NOVA_CONF DEFAULT ram_allocation_ratio 1.0
     iniset $NOVA_CONF DEFAULT reserved_host_memory_mb 0
     # ironic section
-    iniset $NOVA_CONF ironic admin_username admin
-    iniset $NOVA_CONF ironic admin_password $ADMIN_PASSWORD
-    iniset $NOVA_CONF ironic admin_url $KEYSTONE_AUTH_URI/v2.0
-    iniset $NOVA_CONF ironic admin_tenant_name demo
-    iniset $NOVA_CONF ironic api_endpoint $IRONIC_SERVICE_PROTOCOL://$IRONIC_HOSTPORT/v1
+    iniset $NOVA_CONF ironic auth_type password
+    iniset $NOVA_CONF ironic username admin
+    iniset $NOVA_CONF ironic password $ADMIN_PASSWORD
+    iniset $NOVA_CONF ironic auth_url $KEYSTONE_AUTH_URI/v3
+    iniset $NOVA_CONF ironic project_domain_id default
+    iniset $NOVA_CONF ironic user_domain_id default
+    iniset $NOVA_CONF ironic project_name demo
 }
 
 # install_nova_hypervisor() - Install external components

From a283526c88d98f7668d369f4c20db44d3d06425a Mon Sep 17 00:00:00 2001
From: Daniel Gonzalez <daniel@gonzalez-nothnagel.de>
Date: Fri, 15 Jul 2016 19:13:38 +0200
Subject: [PATCH 0636/2409] Set cinder coordination backend url

If DLM is enabled, cinder should be configured to use the correct
backend url for the dlm.
At the moment only zookeeper is supported, as it is the only backend
currently supported in devstack.

Change-Id: I7afc8dc95bc5b3f11b888e10607615c1212c45f4
---
 lib/cinder | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/lib/cinder b/lib/cinder
index 0fe950b6c2..4ed944cfcb 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -358,6 +358,13 @@ function configure_cinder {
     iniset $CINDER_CONF DEFAULT os_privileged_user_password "$SERVICE_PASSWORD"
     iniset $CINDER_CONF DEFAULT os_privileged_user_tenant "$SERVICE_PROJECT_NAME"
     iniset $CINDER_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
+
+    # Set the backend url according to the configured dlm backend
+    if is_dlm_enabled; then
+        if [[ "$(dlm_backend)" == "zookeeper" ]]; then
+            iniset $CINDER_CONF coordination backend_url "zake://"
+        fi
+    fi
 }
 
 # create_cinder_accounts() - Set up common required cinder accounts

From 66ce5c257ae32e269ede901f1737d04e194a6457 Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Wed, 5 Oct 2016 12:11:05 -0700
Subject: [PATCH 0637/2409] Update apache tls proxy logs

This creates log files per proxy vhost and sets the log level to info to
help debug potential issues with tls proxying.

Change-Id: I02a62224662b021b35c293909ba045b4b74e1df8
---
 lib/apache | 1 +
 lib/tls    | 5 +++++
 2 files changed, 6 insertions(+)

diff --git a/lib/apache b/lib/apache
index 740f58835e..8a38cc45e5 100644
--- a/lib/apache
+++ b/lib/apache
@@ -39,6 +39,7 @@ elif is_suse; then
     APACHE_NAME=apache2
     APACHE_CONF_DIR=${APACHE_CONF_DIR:-/etc/$APACHE_NAME/vhosts.d}
 fi
+APACHE_LOG_DIR="/var/log/${APACHE_NAME}"
 
 # Functions
 # ---------
diff --git a/lib/tls b/lib/tls
index c78ea5b191..6697dc875e 100644
--- a/lib/tls
+++ b/lib/tls
@@ -476,6 +476,11 @@ $listen_string
         ProxyPass http://$b_host:$b_port/ retry=5 nocanon
         ProxyPassReverse http://$b_host:$b_port/
     </Location>
+    ErrorLog $APACHE_LOG_DIR/tls-proxy_error.log
+    ErrorLogFormat "[%{u}t] [%-m:%l] [pid %P:tid %T] %7F: %E: [client\ %a] [frontend\ %A] %M% ,\ referer\ %{Referer}i"
+    LogLevel info
+    CustomLog $APACHE_LOG_DIR/tls-proxy_access.log common
+    LogFormat "%v %h %l %u %t \"%r\" %>s %b"
 </VirtualHost>
 EOF
     for mod in ssl proxy proxy_http; do

From 05dc1aad6c4633dbad53bc8e5a574d871becec43 Mon Sep 17 00:00:00 2001
From: Jan Stodt <stodtj@de.ibm.com>
Date: Thu, 25 Aug 2016 15:46:02 +0200
Subject: [PATCH 0638/2409] Fix provider networking error message

This fix replaces Q_USE_PROVIDERNET_FOR_PUBLIC with
Q_USE_PROVIDER_NETWORKING in the error messages introduced by
[1].

The error is thrown when provider networking with IPv6 has been
requested via local.conf, but no provider IPv6 range or provider
IPv6 gateway is provided. But if a provider network should be used
over the private network is determined along the variable
Q_USE_PROVIDER_NETWORKING and not Q_USE_PROVIDERNET_FOR_PUBLIC.

The variable Q_USE_PROVIDERNET_FOR_PUBLIC determines if a provider
network should be used as public network. This happens a few lines
later in the code and is not related to those error messages.

[1] https://review.openstack.org/#/c/326638/1/lib/neutron_plugins/
services/l3

Change-Id: I50aa1e9d2027eef598c95404851e51c31a397fbb
---
 lib/neutron_plugins/services/l3 | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 408b322702..14928fb09c 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -191,8 +191,8 @@ function create_neutron_initial_network {
         fi
 
         if [[ "$IP_VERSION" =~ .*6 ]]; then
-            die_if_not_set $LINENO IPV6_PROVIDER_FIXED_RANGE "IPV6_PROVIDER_FIXED_RANGE has not been set, but Q_USE_PROVIDERNET_FOR_PUBLIC is true and IP_VERSION includes 6"
-            die_if_not_set $LINENO IPV6_PROVIDER_NETWORK_GATEWAY "IPV6_PROVIDER_NETWORK_GATEWAY has not been set, but Q_USE_PROVIDERNET_FOR_PUBLIC is true and IP_VERSION includes 6"
+            die_if_not_set $LINENO IPV6_PROVIDER_FIXED_RANGE "IPV6_PROVIDER_FIXED_RANGE has not been set, but Q_USE_PROVIDER_NETWORKING is true and IP_VERSION includes 6"
+            die_if_not_set $LINENO IPV6_PROVIDER_NETWORK_GATEWAY "IPV6_PROVIDER_NETWORK_GATEWAY has not been set, but Q_USE_PROVIDER_NETWORKING is true and IP_VERSION includes 6"
             if [ -z $SUBNETPOOL_V6_ID ]; then
                 fixed_range_v6=$IPV6_PROVIDER_FIXED_RANGE
             fi

From ec498cd0619805c409b28f81c6a7bcd3a01136ed Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 6 Oct 2016 15:00:44 -0400
Subject: [PATCH 0639/2409] remove sites-enabled/keystone.conf link on clean

doing a clean.sh / stack.sh cycle with USE_SSL=True was failing
because we were no longer cleaning up the keystone site fully, so some
of the early mod_ssl queries hit an invalid apache configuration.

Change-Id: Ic6f3f601e532ec50c0234d928c25b378d9e95e32
---
 lib/keystone | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 13fa50b17e..f9ee8eb761 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -25,7 +25,6 @@
 # - create_keystone_accounts
 # - stop_keystone
 # - cleanup_keystone
-# - _cleanup_keystone_apache_wsgi
 
 # Save trace setting
 _XTRACE_KEYSTONE=$(set +o | grep xtrace)
@@ -149,11 +148,7 @@ function is_keystone_enabled {
 # cleanup_keystone() - Remove residual data files, anything left over from previous
 # runs that a clean run would need to clean up
 function cleanup_keystone {
-    _cleanup_keystone_apache_wsgi
-}
-
-# _cleanup_keystone_apache_wsgi() - Remove wsgi files, disable and remove apache vhost file
-function _cleanup_keystone_apache_wsgi {
+    disable_apache_site keystone
     sudo rm -f $(apache_site_config_for keystone)
 }
 

From 148d0e6e08caaaa9c6ca828c8404e5e82b6de8ee Mon Sep 17 00:00:00 2001
From: Clay Gerrard <clay.gerrard@gmail.com>
Date: Thu, 1 Sep 2016 02:38:06 -0700
Subject: [PATCH 0640/2409] Clarify default IP_VERSION in docs

The prior art on other options in the same document seemed to be
calling out the default in a pre-formatted block after describing the
possible values.

I believe the default value for the option was first changed [1], then
the docs were fixed [2], then the information was unintentionally
dropped from the docs [3].

1. Related-Change: If0e0b818355e4cb1338f7fa72af5e81e24361574
2. Related-Change: Ib6603b4f6ea0b4079f9a4ea46e723ecbb2ea371d
3. Related-Change: Iddd27cb54f1d9f062b9c47ff9ad6a2bef3650d6b

Change-Id: I662403db3b08a351a680587440ad1f15a6f8ee5d
---
 doc/source/configuration.rst | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 1161b344e2..22809ebd7a 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -521,16 +521,14 @@ created flavors as follows:
 IP Version
 ----------
 
-``IP_VERSION`` can be used to configure DevStack to create either an
-IPv4, IPv6, or dual-stack self service project data-network by with
+``IP_VERSION`` can be used to configure Neutron to create either an
+IPv4, IPv6, or dual-stack self-service project data-network by with
 either ``IP_VERSION=4``, ``IP_VERSION=6``, or ``IP_VERSION=4+6``
-respectively.  This functionality requires that the Neutron networking
-service is enabled by setting the following options:
+respectively.
 
     ::
 
-        disable_service n-net
-        enable_service q-svc q-agt q-dhcp q-l3
+        IP_VERSION=4+6
 
 The following optional variables can be used to alter the default IPv6
 behavior:

From f06455e1b55b5419b6546a0d85ebfa734bf3c6b4 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Fri, 7 Oct 2016 06:57:03 -0400
Subject: [PATCH 0641/2409] Add a screen session for tls logs

When tls is enabled, we aren't bringing the logs to the forefront,
which makes it hard to debug when things go wrong. This does that.

Change-Id: I7c6c7e324e16da6b9bfa44f4bad17401ca4ed7e3
---
 lib/tls  | 7 +++++++
 stack.sh | 4 ++++
 2 files changed, 11 insertions(+)

diff --git a/lib/tls b/lib/tls
index 6697dc875e..40f3e81438 100644
--- a/lib/tls
+++ b/lib/tls
@@ -495,6 +495,13 @@ EOF
     reload_apache_server
 }
 
+# Follow TLS proxy
+function follow_tls_proxy {
+    sudo touch /var/log/$APACHE_NAME/tls-proxy_error.log
+    tail_log tls-error /var/log/$APACHE_NAME/tls-proxy_error.log
+    sudo touch /var/log/$APACHE_NAME/tls-proxy_access.log
+    tail_log tls-proxy /var/log/$APACHE_NAME/tls-proxy_access.log
+}
 
 # Cleanup Functions
 # =================
diff --git a/stack.sh b/stack.sh
index 9aa770f2b9..5170d1b8a4 100755
--- a/stack.sh
+++ b/stack.sh
@@ -993,6 +993,10 @@ if [[ "$USE_SCREEN" == "True" ]]; then
     fi
     screen -r $SCREEN_NAME -X hardstatus alwayslastline "$SCREEN_HARDSTATUS"
     screen -r $SCREEN_NAME -X setenv PROMPT_COMMAND /bin/true
+
+    if is_service_enabled tls-proxy; then
+        follow_tls_proxy
+    fi
 fi
 
 # Clear ``screenrc`` file

From cac6ef09c5a7ecc0e9959b1e3ace48c41a0add71 Mon Sep 17 00:00:00 2001
From: Attila Fazekas <afazekas@redhat.com>
Date: Tue, 11 Oct 2016 08:23:48 +0200
Subject: [PATCH 0642/2409] Remove the heat stack owner role

We should not require any special role for heat
since very long time.

We should use the same roles as with the primary user.

Change-Id: Id9150f94c30505ed0da33b8fbc2a5a7bd4fcf5d0
---
 lib/tempest | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 6ffc927176..27023c2081 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -390,11 +390,6 @@ function configure_tempest {
 
     # Orchestration Tests
     if is_service_enabled heat; then
-        # Though this is not needed by heat, some tempest tests explicitly
-        # try to set this role. Removing them from the tempest tests breaks
-        # some non-devstack CIs.
-        get_or_create_role "heat_stack_owner"
-
         if [[ ! -z "$HEAT_CFN_IMAGE_URL" ]]; then
             iniset $TEMPEST_CONFIG orchestration image_ref $(basename "${HEAT_CFN_IMAGE_URL%.*}")
         fi
@@ -408,7 +403,7 @@ function configure_tempest {
             iniset $TEMPEST_CONFIG orchestration instance_type "m1.heat"
         fi
         iniset $TEMPEST_CONFIG orchestration build_timeout 900
-        iniset $TEMPEST_CONFIG orchestration stack_owner_role "heat_stack_owner"
+        iniset $TEMPEST_CONFIG orchestration stack_owner_role Member
     fi
 
     # Scenario

From 5ff77d6a2ac81a411505dc1d3b7b814eb7fbb259 Mon Sep 17 00:00:00 2001
From: Steve Martinelli <s.martinelli@gmail.com>
Date: Tue, 6 Sep 2016 19:10:22 +0000
Subject: [PATCH 0643/2409] Remove workaround for `openstack complete`

This reverts commit 6930ba312f787e0459f7455ac6ba2a70b3c7c37d.

By reverting this patch we are no longer using the bandaid fix mentioned
in the code. The latest openstackclient release (3.3.0) fixes the bug.

Related-Bug: 1619274

Change-Id: I20e3c5a92b97bf46c8d2318cd37044f0f36e1745
---
 stack.sh | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/stack.sh b/stack.sh
index 1cc4eca1b9..09466a6894 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1383,12 +1383,7 @@ check_libs_from_git
 # ===============
 
 # Prepare bash completion for OSC
-#
-# BUG: https://bugs.launchpad.net/python-openstackclient/+bug/1619274
-# the os-cloud param should not be required but if we don't provide it
-# then this command hangs indefinitely if something is wrong with
-# default environment credentials.
-openstack --os-cloud=devstack complete | sudo tee /etc/bash_completion.d/osc.bash_completion > /dev/null
+openstack complete | sudo tee /etc/bash_completion.d/osc.bash_completion > /dev/null
 
 # If cinder is configured, set global_filter for PV devices
 if is_service_enabled cinder; then

From 2bd8d906813679cfc22f5bc62882a289906a64af Mon Sep 17 00:00:00 2001
From: Attila Fazekas <afazekas@redhat.com>
Date: Thu, 13 Oct 2016 08:24:57 +0200
Subject: [PATCH 0644/2409] Objects versions new style config

allow_versions is going to be a deprecated option.
Setting up the object versining in the new way.

[1] http://docs.openstack.org/developer/swift/overview_object_versioning.html

Change-Id: Ia520fbb6eb535b08ce83c0cb4bea31e7bba55eb3
---
 lib/swift | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/lib/swift b/lib/swift
index f9ea028cea..b175f2e5c1 100644
--- a/lib/swift
+++ b/lib/swift
@@ -397,6 +397,9 @@ function configure_swift {
     iniset ${SWIFT_CONFIG_PROXY_SERVER} app:proxy-server node_timeout 120
     iniset ${SWIFT_CONFIG_PROXY_SERVER} app:proxy-server conn_timeout 20
 
+    # Versioned Writes
+    iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:versioned_writes allow_versioned_writes true
+
     # Configure Ceilometer
     if is_service_enabled ceilometer; then
         iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:ceilometer "set log_level" "WARN"
@@ -489,8 +492,6 @@ EOF
         generate_swift_config_services ${swift_node_config} ${node_number} $(( CONTAINER_PORT_BASE + 10 * (node_number - 1) )) container
         iniuncomment ${swift_node_config} DEFAULT bind_ip
         iniset ${swift_node_config} DEFAULT bind_ip ${SWIFT_SERVICE_LISTEN_ADDRESS}
-        iniuncomment ${swift_node_config} app:container-server allow_versions
-        iniset ${swift_node_config} app:container-server allow_versions  "true"
 
         swift_node_config=${SWIFT_CONF_DIR}/account-server/${node_number}.conf
         cp ${SWIFT_DIR}/etc/account-server.conf-sample ${swift_node_config}

From d8682dbdf9f8247c20c4aa9612a560d2a9022c09 Mon Sep 17 00:00:00 2001
From: Eric Harney <eharney@redhat.com>
Date: Fri, 14 Oct 2016 14:36:29 -0400
Subject: [PATCH 0645/2409] worlddump: Add cinder-volume guru meditation report

cinder also supports GMR, it would be good
to have this when debugging gate failures.

Change-Id: I4db6dfd810d011faaca084e0dacaec4031b2a4ff
---
 tools/worlddump.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tools/worlddump.py b/tools/worlddump.py
index e1ef544a55..1ce931efd5 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -34,6 +34,7 @@
     'neutron-linuxbridge-agent',
     'neutron-metadata-agent',
     'neutron-openvswitch-agent',
+    'cinder-volume',
 )
 
 

From 51db6d33c11b12fae0b2a404062cbee2b18a4427 Mon Sep 17 00:00:00 2001
From: Chuck Short <chuck.short@canonical.com>
Date: Sat, 15 Oct 2016 09:39:52 -0400
Subject: [PATCH 0646/2409] Replace wily support with yakkety

Ubuntu wily support is EOL so lets make room for yakkety.

Change-Id: Ib13d43f6d89bdf7c684cd34655a077a13e237be3
Signed-off-by: Chuck Short <chuck.short@canonical.com>
---
 stack.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index 5e566e0388..fab2edd299 100755
--- a/stack.sh
+++ b/stack.sh
@@ -192,7 +192,7 @@ source $TOP_DIR/stackrc
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (trusty|wily|xenial|7.0|wheezy|sid|testing|jessie|f23|f24|rhel7|kvmibm1) ]]; then
+if [[ ! ${DISTRO} =~ (trusty|xenial|yakkety|7.0|wheezy|sid|testing|jessie|f23|f24|rhel7|kvmibm1) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From bc5cfc05842a4d4514082a2431020c5b881e52a1 Mon Sep 17 00:00:00 2001
From: Hongbin Lu <hongbin.lu@huawei.com>
Date: Sun, 9 Oct 2016 16:31:15 +0000
Subject: [PATCH 0647/2409] Allow running nova compute with docker group

A use case is from Zun project that needs to start n-cpu with
"docker" group.

Change-Id: Ib8f193ea1edf1f148e9ba505205495170ebf6d67
---
 lib/nova | 2 ++
 stackrc  | 3 +++
 2 files changed, 5 insertions(+)

diff --git a/lib/nova b/lib/nova
index 334cba6dd7..8da8ef2d29 100644
--- a/lib/nova
+++ b/lib/nova
@@ -829,6 +829,8 @@ function start_nova_compute {
         run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $compute_cell_conf" $LIBVIRT_GROUP
     elif [[ "$VIRT_DRIVER" = 'lxd' ]]; then
         run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $compute_cell_conf" $LXD_GROUP
+    elif [[ "$VIRT_DRIVER" = 'docker' ]]; then
+        run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $compute_cell_conf" $DOCKER_GROUP
     elif [[ "$VIRT_DRIVER" = 'fake' ]]; then
         local i
         for i in `seq 1 $NUMBER_FAKE_NOVA_COMPUTE`; do
diff --git a/stackrc b/stackrc
index c419ef4b15..bf92a77d81 100644
--- a/stackrc
+++ b/stackrc
@@ -589,6 +589,9 @@ case "$VIRT_DRIVER" in
     lxd)
         LXD_GROUP=${LXD_GROUP:-"lxd"}
         ;;
+    docker)
+        DOCKER_GROUP=${DOCKER_GROUP:-"docker"}
+        ;;
     fake)
         NUMBER_FAKE_NOVA_COMPUTE=${NUMBER_FAKE_NOVA_COMPUTE:-1}
         ;;

From 201c01f19b855aec3521c206fc0add5a01940c4b Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Tue, 18 Oct 2016 07:24:00 -0500
Subject: [PATCH 0648/2409] Don't clone dib-utils in install_heat

It's not used, and a recent change to trim down projects lists in
devstack-gate broke devstack in the gate that enabled heat.

Change-Id: I405423bdc9ba8dd9b30fce6fdceacccf662d5da3
---
 lib/heat | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/lib/heat b/lib/heat
index c841e0a499..0863128f81 100644
--- a/lib/heat
+++ b/lib/heat
@@ -40,7 +40,6 @@ HEAT_DIR=$DEST/heat
 HEAT_CFNTOOLS_DIR=$DEST/heat-cfntools
 HEAT_TEMPLATES_REPO_DIR=$DEST/heat-templates
 OCC_DIR=$DEST/os-collect-config
-DIB_UTILS_DIR=$DEST/dib-utils
 ORC_DIR=$DEST/os-refresh-config
 OAC_DIR=$DEST/os-apply-config
 
@@ -276,7 +275,6 @@ function install_heat_other {
     git_clone $OAC_REPO $OAC_DIR $OAC_BRANCH
     git_clone $OCC_REPO $OCC_DIR $OCC_BRANCH
     git_clone $ORC_REPO $ORC_DIR $ORC_BRANCH
-    git_clone $DIB_UTILS_REPO $DIB_UTILS_DIR $DIB_UTILS_BRANCH
 }
 
 # start_heat() - Start running processes, including screen
@@ -420,7 +418,7 @@ function create_heat_accounts {
 
 # build_heat_pip_mirror() - Build a pip mirror containing heat agent projects
 function build_heat_pip_mirror {
-    local project_dirs="$OCC_DIR $OAC_DIR $ORC_DIR $HEAT_CFNTOOLS_DIR $DIB_UTILS_DIR"
+    local project_dirs="$OCC_DIR $OAC_DIR $ORC_DIR $HEAT_CFNTOOLS_DIR"
     local projpath proj package
 
     rm -rf $HEAT_PIP_REPO

From 94ab1a4aa8ed1e438b66cc41f3637e78c8323dd0 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Wed, 19 Oct 2016 08:16:16 +0000
Subject: [PATCH 0649/2409] Updated from generate-devstack-plugins-list

Change-Id: I15cdb23e00664efe637de5cbc7b5a1e8efa21d13
---
 doc/source/plugin-registry.rst | 1 -
 1 file changed, 1 deletion(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index f29b0d7ae2..771f2ef6a7 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -121,7 +121,6 @@ nova-powervm                           `git://git.openstack.org/openstack/nova-p
 octavia                                `git://git.openstack.org/openstack/octavia <https://git.openstack.org/cgit/openstack/octavia>`__
 osprofiler                             `git://git.openstack.org/openstack/osprofiler <https://git.openstack.org/cgit/openstack/osprofiler>`__
 panko                                  `git://git.openstack.org/openstack/panko <https://git.openstack.org/cgit/openstack/panko>`__
-python-freezerclient                   `git://git.openstack.org/openstack/python-freezerclient <https://git.openstack.org/cgit/openstack/python-freezerclient>`__
 rally                                  `git://git.openstack.org/openstack/rally <https://git.openstack.org/cgit/openstack/rally>`__
 sahara                                 `git://git.openstack.org/openstack/sahara <https://git.openstack.org/cgit/openstack/sahara>`__
 sahara-dashboard                       `git://git.openstack.org/openstack/sahara-dashboard <https://git.openstack.org/cgit/openstack/sahara-dashboard>`__

From aa47a0a8be9a9aced97d6a083d955949635fa3b3 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Thu, 20 Oct 2016 22:27:25 -0400
Subject: [PATCH 0650/2409] ceph: set rbd_secret_uuid in cinder.conf, not
 rbd_uuid

The ceph cinder backend script was setting the wrong
config option in cinder.conf for the secret uuid. This
was being masked by a bug in nova which is failing on
this bug when trying to fix the nova bug...right. It
makes sense.

See:

http://docs.ceph.com/docs/master/rbd/rbd-openstack/#configuring-cinder

Change-Id: I4655cae3212d589177d2570403b563a83aad529a
Closes-Bug: #1635488
---
 lib/cinder_backends/ceph | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/cinder_backends/ceph b/lib/cinder_backends/ceph
index 9bff5bef4f..a213d5e005 100644
--- a/lib/cinder_backends/ceph
+++ b/lib/cinder_backends/ceph
@@ -48,7 +48,7 @@ function configure_cinder_backend_ceph {
     iniset $CINDER_CONF $be_name rbd_ceph_conf "$CEPH_CONF"
     iniset $CINDER_CONF $be_name rbd_pool "$CINDER_CEPH_POOL"
     iniset $CINDER_CONF $be_name rbd_user "$CINDER_CEPH_USER"
-    iniset $CINDER_CONF $be_name rbd_uuid "$CINDER_CEPH_UUID"
+    iniset $CINDER_CONF $be_name rbd_secret_uuid "$CINDER_CEPH_UUID"
     iniset $CINDER_CONF $be_name rbd_flatten_volume_from_snapshot False
     iniset $CINDER_CONF $be_name rbd_max_clone_depth 5
     iniset $CINDER_CONF DEFAULT glance_api_version 2

From 4440da85637aa8239f24bd4f23a9a8e1ac2d0b8d Mon Sep 17 00:00:00 2001
From: Adam Young <ayoung@redhat.com>
Date: Wed, 26 Oct 2016 11:40:08 +0200
Subject: [PATCH 0651/2409] Unset admin_project config options for Keystone

Until the policy changes land for Nova, Glance, etc, this
value is not used.  Additionally, by having it set, it actually
makes it hard/impossible for the required changes to land in
the other services.  Disable/comment out the changes in the
Keystone specific lib file for now, and we will re-enable once
the Services can make use of them.

Change-Id: Ia1de9083c21107dac2f0abb56bda166bdb37a69d
---
 lib/keystone | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index f9ee8eb761..8db0876f8b 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -344,8 +344,8 @@ function configure_keystone {
     # Configure the project created by the 'keystone-manage bootstrap' as the cloud-admin project.
     # The users from this project are globally admin as before, but it also
     # allows policy changes in order to clarify the adminess scope.
-    iniset $KEYSTONE_CONF resource admin_project_domain_name Default
-    iniset $KEYSTONE_CONF resource admin_project_name admin
+    #iniset $KEYSTONE_CONF resource admin_project_domain_name Default
+    #iniset $KEYSTONE_CONF resource admin_project_name admin
 }
 
 # create_keystone_accounts() - Sets up common required keystone accounts

From d5f730caf41430a142fcf37b216dfa4d69ec4d2c Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@midokura.com>
Date: Thu, 21 Jul 2016 18:39:44 +0900
Subject: [PATCH 0652/2409] lib/neutron: Remove remaining references to Q_
 variables

Q_ variables belong to neutron-legacy.

These are True by default in neutron.
Remove them in favor of post-config meta section.

Change-Id: If691a79b09003f85a07c9f33e0379a2b21e48141
---
 lib/neutron | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 9e9eb2d2b1..53fc5fcd15 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -147,10 +147,6 @@ function configure_neutron_new {
         iniset $NEUTRON_CONF DEFAULT auth_strategy $NEUTRON_AUTH_STRATEGY
         configure_auth_token_middleware $NEUTRON_CONF neutron $NEUTRON_AUTH_CACHE_DIR keystone_authtoken
 
-        # Configuration for neutron notifations to nova.
-        iniset $NEUTRON_CONF DEFAULT notify_nova_on_port_status_changes $Q_NOTIFY_NOVA_PORT_STATUS_CHANGES
-        iniset $NEUTRON_CONF DEFAULT notify_nova_on_port_data_changes $Q_NOTIFY_NOVA_PORT_DATA_CHANGES
-
         iniset $NEUTRON_CONF nova auth_type password
         iniset $NEUTRON_CONF nova auth_url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_AUTH_PORT/v3"
         iniset $NEUTRON_CONF nova username nova

From 07edde1c14d8ab91533c1ef6fe0470f088d5c8bb Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@midokura.com>
Date: Wed, 19 Oct 2016 19:21:00 +0000
Subject: [PATCH 0653/2409] lib/neutron: Create initial topology only on
 controller node

To avoid it being created multiple times for multinode setup.

Note: This reverts "Enable neutron to work in a multi node setup"
(commit 88f8558d874072536e7660a233f24207a7089651) partly and fixes
the issue differently.
The configuration in question uses the new lib/neutron. (not neutron-legacy)
In that case, calling create_neutron_initial_network from stack.sh directly
is a wrong way, as create_neutron_initial_network is sourced by
neutron-legacy.  The new neutron code should not rely on the legacy one.

Closes-Bug: #1613069
Change-Id: I868afeb065d80d8ccd57630b90658e330ab94251
---
 lib/neutron                     | 20 +++++++++++---------
 lib/neutron_plugins/services/l3 |  8 --------
 stack.sh                        |  5 ++++-
 3 files changed, 15 insertions(+), 18 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 53fc5fcd15..9923721e74 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -431,15 +431,17 @@ function start_neutron_new {
     if is_service_enabled neutron-l3; then
         run_process neutron-l3 "$NEUTRON_BIN_DIR/$NEUTRON_L3_BINARY $NEUTRON_CONFIG_ARG"
     fi
-    # XXX(sc68cal) - Here's where plugins can wire up their own networks instead
-    # of the code in lib/neutron_plugins/services/l3
-    if type -p neutron_plugin_create_initial_networks > /dev/null; then
-        neutron_plugin_create_initial_networks
-    else
-        # XXX(sc68cal) Load up the built in Neutron networking code and build a topology
-        source $TOP_DIR/lib/neutron_plugins/services/l3
-        # Create the networks using servic
-        create_neutron_initial_network
+    if is_service_enabled neutron-api; then
+        # XXX(sc68cal) - Here's where plugins can wire up their own networks instead
+        # of the code in lib/neutron_plugins/services/l3
+        if type -p neutron_plugin_create_initial_networks > /dev/null; then
+            neutron_plugin_create_initial_networks
+        else
+            # XXX(sc68cal) Load up the built in Neutron networking code and build a topology
+            source $TOP_DIR/lib/neutron_plugins/services/l3
+            # Create the networks using servic
+            create_neutron_initial_network
+        fi
     fi
     if is_service_enabled neutron-metadata-agent; then
         run_process neutron-metadata-agent "$NEUTRON_BIN_DIR/$NEUTRON_META_BINARY $NEUTRON_CONFIG_ARG"
diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index aa61a109fa..9c9143a225 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -154,14 +154,6 @@ function _neutron_get_ext_gw_interface {
 }
 
 function create_neutron_initial_network {
-    if ! is_service_enabled q-svc && ! is_service_enabled neutron-api; then
-        echo "Controller services not enabled. No networks configured!"
-        return
-    fi
-    if [[ "$NEUTRON_CREATE_INITIAL_NETWORKS" == "False" ]]; then
-        echo "Network creation disabled!"
-        return
-    fi
     local project_id
     project_id=$(openstack project list | grep " demo " | get_field 1)
     die_if_not_set $LINENO project_id "Failure retrieving project_id for demo"
diff --git a/stack.sh b/stack.sh
index fab2edd299..2783efed6b 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1267,7 +1267,10 @@ if is_service_enabled neutron; then
     start_neutron
 fi
 # Once neutron agents are started setup initial network elements
-create_neutron_initial_network
+if is_service_enabled q-svc && [[ "$NEUTRON_CREATE_INITIAL_NETWORKS" == "True" ]]; then
+    echo_summary "Creating initial neutron network elements"
+    create_neutron_initial_network
+fi
 
 if is_service_enabled nova; then
     echo_summary "Starting Nova"

From 7b07ccf5e4b7f724eceedb069a51c29284b357aa Mon Sep 17 00:00:00 2001
From: Eric Brown <browne@vmware.com>
Date: Thu, 27 Oct 2016 06:14:00 -0700
Subject: [PATCH 0654/2409] Remove deprecated/obsolete ldap options

The devstack ldap configuration for keystone is still using some
old options that are no longer valid. The write support is
being removed this release. And in previous releases, the ldap
assignment driver support was removed and was not removed here.

Change-Id: I538626b681eaee6a7ac10dfbc29605b73fbe13bf
---
 lib/keystone | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index f9ee8eb761..b2dfa833e3 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -221,13 +221,6 @@ function configure_keystone {
         iniset $KEYSTONE_CONF ldap password $LDAP_PASSWORD
         iniset $KEYSTONE_CONF ldap user $LDAP_MANAGER_DN
         iniset $KEYSTONE_CONF ldap suffix $LDAP_BASE_DN
-        iniset $KEYSTONE_CONF ldap use_dumb_member "True"
-        iniset $KEYSTONE_CONF ldap user_attribute_ignore "enabled,email,tenants,default_project_id"
-        iniset $KEYSTONE_CONF ldap tenant_attribute_ignore "enabled"
-        iniset $KEYSTONE_CONF ldap tenant_domain_id_attribute "businessCategory"
-        iniset $KEYSTONE_CONF ldap tenant_desc_attribute "description"
-        iniset $KEYSTONE_CONF ldap tenant_tree_dn "ou=Projects,$LDAP_BASE_DN"
-        iniset $KEYSTONE_CONF ldap user_domain_id_attribute "businessCategory"
         iniset $KEYSTONE_CONF ldap user_tree_dn "ou=Users,$LDAP_BASE_DN"
         iniset $KEYSTONE_CONF DEFAULT member_role_id "9fe2ff9ee4384b1894a90878d3e92bab"
         iniset $KEYSTONE_CONF DEFAULT member_role_name "_member_"

From fb73d85afe7df7b93b9a460372a8ad6558e887e0 Mon Sep 17 00:00:00 2001
From: Eric Brown <browne@vmware.com>
Date: Fri, 28 Oct 2016 02:03:37 -0700
Subject: [PATCH 0655/2409] Remove unused KEYSTONE_CATALOG_BACKEND

This patch simply removes a var noted to be removed back in Newton.

Change-Id: I7c66e1d8d65f562596543ed8ca402dba8c8ea271
---
 lib/keystone | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index f9ee8eb761..e2303c08de 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -51,9 +51,6 @@ KEYSTONE_CONF_DIR=${KEYSTONE_CONF_DIR:-/etc/keystone}
 KEYSTONE_CONF=$KEYSTONE_CONF_DIR/keystone.conf
 KEYSTONE_PASTE_INI=${KEYSTONE_PASTE_INI:-$KEYSTONE_CONF_DIR/keystone-paste.ini}
 
-# NOTE(sdague): remove in Newton
-KEYSTONE_CATALOG_BACKEND="sql"
-
 # Toggle for deploying Keystone under HTTPD + mod_wsgi
 # Deprecated in Mitaka, use KEYSTONE_DEPLOY instead.
 KEYSTONE_USE_MOD_WSGI=${KEYSTONE_USE_MOD_WSGI:-${ENABLE_HTTPD_MOD_WSGI_SERVICES}}

From dc486bc12fb63ecb5939f8d29dd9cf7a659847cd Mon Sep 17 00:00:00 2001
From: Steve Martinelli <s.martinelli@gmail.com>
Date: Thu, 8 Sep 2016 02:29:25 +0000
Subject: [PATCH 0656/2409] Switch fernet to be the default token provider

this is the first patch in a series to actually make fernet the default
token provider in keystone. the patches for grenade, release notes, and
actually switching the value in keystone all depend on this patch first.

reasons for switching over:

- fernet tokens are the recommended token provider
- the install guide for newton recommends deployers use fernet tokens [0]
- we previously attempted this switch but ran into timing issues [1],
  the timing issues have been resolved [2]

[0] http://docs.openstack.org/newton/install-guide-ubuntu/keystone-install.html
[1] 153db269705f37d4144ad3fcf26dc67269755d7d
[2] https://review.openstack.org/#/q/topic:make-fernet-default

Change-Id: I3b819ae8d2924f3bece03902e05d1a8c5e5923f1
---
 lib/keystone | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/keystone b/lib/keystone
index b2dfa833e3..fd92f31afb 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -88,7 +88,7 @@ KEYSTONE_RESOURCE_BACKEND=${KEYSTONE_RESOURCE_BACKEND:-sql}
 
 # Select Keystone's token provider (and format)
 # Choose from 'uuid', 'pki', 'pkiz', or 'fernet'
-KEYSTONE_TOKEN_FORMAT=${KEYSTONE_TOKEN_FORMAT:-}
+KEYSTONE_TOKEN_FORMAT=${KEYSTONE_TOKEN_FORMAT:-fernet}
 KEYSTONE_TOKEN_FORMAT=$(echo ${KEYSTONE_TOKEN_FORMAT} | tr '[:upper:]' '[:lower:]')
 
 # Set Keystone interface configuration

From ade65b813b33bfb71c707b5ac6995e8ca4099fb5 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Tue, 1 Nov 2016 06:46:36 +0000
Subject: [PATCH 0657/2409] Updated from generate-devstack-plugins-list

Change-Id: I1b357b2e668ff5ed56c5deb9d71709a7526e17ea
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 771f2ef6a7..7c97171806 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -69,6 +69,7 @@ ironic-inspector                       `git://git.openstack.org/openstack/ironic
 ironic-staging-drivers                 `git://git.openstack.org/openstack/ironic-staging-drivers <https://git.openstack.org/cgit/openstack/ironic-staging-drivers>`__
 karbor                                 `git://git.openstack.org/openstack/karbor <https://git.openstack.org/cgit/openstack/karbor>`__
 karbor-dashboard                       `git://git.openstack.org/openstack/karbor-dashboard <https://git.openstack.org/cgit/openstack/karbor-dashboard>`__
+keystone                               `git://git.openstack.org/openstack/keystone <https://git.openstack.org/cgit/openstack/keystone>`__
 kingbird                               `git://git.openstack.org/openstack/kingbird <https://git.openstack.org/cgit/openstack/kingbird>`__
 kuryr-kubernetes                       `git://git.openstack.org/openstack/kuryr-kubernetes <https://git.openstack.org/cgit/openstack/kuryr-kubernetes>`__
 kuryr-libnetwork                       `git://git.openstack.org/openstack/kuryr-libnetwork <https://git.openstack.org/cgit/openstack/kuryr-libnetwork>`__

From c9c9d31d3eb98f3d6382cedfd2aebc75ce236d1f Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Thu, 15 Sep 2016 20:33:22 -0400
Subject: [PATCH 0658/2409] tempest: set network-feature-enabled.port_security

Sets the port_security feature flag in tempest.conf
if the port_security extension is enabled, which it's not
by default in neutron but is set by default in devstack.

This adds global variable for setting the port_security
extension in ml2.conf and in tempest.conf so we only have
to set this in one place.

Depends-On: I1efd5c838aa0d73cc6e8864e3041eea25850198d

Change-Id: I6334b200e42edd785f74cfb41520627393039619
Related-Bug: #1624082
---
 lib/neutron             | 4 +++-
 lib/neutron_plugins/ml2 | 6 +++++-
 lib/tempest             | 1 +
 stackrc                 | 3 +++
 4 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 53fc5fcd15..415344e88d 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -162,7 +162,9 @@ function configure_neutron_new {
         iniset $NEUTRON_CORE_PLUGIN_CONF ml2 type_drivers vxlan
         iniset $NEUTRON_CORE_PLUGIN_CONF ml2 mechanism_drivers openvswitch,linuxbridge
         iniset $NEUTRON_CORE_PLUGIN_CONF ml2_type_vxlan vni_ranges 1001:2000
-        iniset $NEUTRON_CORE_PLUGIN_CONF ml2 extension_drivers port_security
+        if [[ "$NEUTRON_PORT_SECURITY" = "True" ]]; then
+            iniset $NEUTRON_CORE_PLUGIN_CONF ml2 extension_drivers port_security
+        fi
     fi
 
     # Neutron OVS or LB agent
diff --git a/lib/neutron_plugins/ml2 b/lib/neutron_plugins/ml2
index 7e8020930f..e429714f06 100644
--- a/lib/neutron_plugins/ml2
+++ b/lib/neutron_plugins/ml2
@@ -35,7 +35,11 @@ Q_ML2_PLUGIN_VLAN_TYPE_OPTIONS=${Q_ML2_PLUGIN_VLAN_TYPE_OPTIONS:-}
 Q_ML2_PLUGIN_GENEVE_TYPE_OPTIONS=${Q_ML2_PLUGIN_GENEVE_TYPE_OPTIONS:-vni_ranges=$TENANT_TUNNEL_RANGES}
 # List of extension drivers to load, use '-' instead of ':-' to allow people to
 # explicitly override this to blank
-Q_ML2_PLUGIN_EXT_DRIVERS=${Q_ML2_PLUGIN_EXT_DRIVERS-port_security}
+if [[ "$NEUTRON_PORT_SECURITY" = "True" ]]; then
+    Q_ML2_PLUGIN_EXT_DRIVERS=${Q_ML2_PLUGIN_EXT_DRIVERS-port_security}
+else
+    Q_ML2_PLUGIN_EXT_DRIVERS=${Q_ML2_PLUGIN_EXT_DRIVERS:-}
+fi
 
 # L3 Plugin to load for ML2
 # For some flat network environment, they not want to extend L3 plugin.
diff --git a/lib/tempest b/lib/tempest
index 6ffc927176..0d018432af 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -387,6 +387,7 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG network default_network "$FIXED_RANGE"
     iniset $TEMPEST_CONFIG network-feature-enabled ipv6 "$IPV6_ENABLED"
     iniset $TEMPEST_CONFIG network-feature-enabled ipv6_subnet_attributes "$IPV6_SUBNET_ATTRIBUTES_ENABLED"
+    iniset $TEMPEST_CONFIG network-feature-enabled port_security $NEUTRON_PORT_SECURITY
 
     # Orchestration Tests
     if is_service_enabled heat; then
diff --git a/stackrc b/stackrc
index c419ef4b15..ea8b044faf 100644
--- a/stackrc
+++ b/stackrc
@@ -778,6 +778,9 @@ fi
 
 HOST_IPV6=$(get_default_host_ip "" "" "$HOST_IP_IFACE" "$HOST_IPV6" "inet6")
 
+# Whether or not the port_security extension should be enabled for Neutron.
+NEUTRON_PORT_SECURITY=$(trueorfalse True NEUTRON_PORT_SECURITY)
+
 # SERVICE IP version
 # This is the IP version that services should be listening on, as well
 # as using to register their endpoints with keystone.

From 2d9959c53b7866e0dbfb0bcda15c59db1c3de6b6 Mon Sep 17 00:00:00 2001
From: "Castulo J. Martinez" <castulo.martinez@intel.com>
Date: Tue, 1 Nov 2016 13:34:20 -0700
Subject: [PATCH 0659/2409] Removing config values no longer in tempest.conf

This commit removes some config values for tempest that no
longer exist in tempest/config.py therefore are no longer needed
in tempest.conf.

Change-Id: I5778973012e57e8d9df9bf864590f8ed7fe05561
---
 lib/tempest | 11 +----------
 1 file changed, 1 insertion(+), 10 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 6ffc927176..3f9ebca225 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -267,8 +267,7 @@ function configure_tempest {
     if [[ "$TEMPEST_HAS_ADMIN" == "True" ]]; then
         iniset $TEMPEST_CONFIG auth admin_username $admin_username
         iniset $TEMPEST_CONFIG auth admin_password "$password"
-        iniset $TEMPEST_CONFIG auth admin_tenant_name $admin_project_name
-        iniset $TEMPEST_CONFIG auth admin_tenant_id $admin_project_id
+        iniset $TEMPEST_CONFIG auth admin_project_name $admin_project_name
         iniset $TEMPEST_CONFIG auth admin_domain_name $admin_domain_name
     fi
     if [ "$ENABLE_IDENTITY_V2" == "False" ]; then
@@ -306,15 +305,10 @@ function configure_tempest {
     fi
 
     # Compute
-    iniset $TEMPEST_CONFIG compute ssh_user ${DEFAULT_INSTANCE_USER:-cirros} # DEPRECATED
     iniset $TEMPEST_CONFIG compute image_ref $image_uuid
     iniset $TEMPEST_CONFIG compute image_ref_alt $image_uuid_alt
-    iniset $TEMPEST_CONFIG compute image_alt_ssh_user ${ALT_INSTANCE_USER:-cirros}
     iniset $TEMPEST_CONFIG compute flavor_ref $flavor_ref
     iniset $TEMPEST_CONFIG compute flavor_ref_alt $flavor_ref_alt
-    iniset $TEMPEST_CONFIG compute ssh_connect_method $ssh_connect_method
-    # set the equiv validation option here as well to ensure they are
-    # in sync. They shouldn't be separate options.
     iniset $TEMPEST_CONFIG validation connect_method $ssh_connect_method
     if ! is_service_enabled n-cell && ! is_service_enabled neutron; then
         iniset $TEMPEST_CONFIG compute fixed_network_name $PRIVATE_NETWORK_NAME
@@ -419,9 +413,6 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG scenario aki_img_file "cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-vmlinuz"
     iniset $TEMPEST_CONFIG scenario img_file "cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img"
 
-    # Telemetry
-    iniset $TEMPEST_CONFIG telemetry-feature-enabled events "True"
-
     # Validation
     iniset $TEMPEST_CONFIG validation run_validation ${TEMPEST_RUN_VALIDATION:-False}
     iniset $TEMPEST_CONFIG validation ip_version_for_ssh 4

From 54482cd80b9d64f2d7043cd8560504d9d5752fc1 Mon Sep 17 00:00:00 2001
From: Huan Xie <huan.xie@citrix.com>
Date: Sun, 9 Oct 2016 09:47:48 +0000
Subject: [PATCH 0660/2409] Stop q-domua process when XenServer is used

When using XenServer, it will create two neutron-openvswitch-agent
q-agt and q-domua even it's single box environment, but it didn't
stop the q-domua, this patch is to stop q-domua in unstack.sh

Change-Id: I511ed534bfb7d5fe6136f6a0b33f1d749d30862c
Closes-Bug: #1631721
---
 lib/neutron-legacy | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 9e926a000f..938d5662ec 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -511,6 +511,10 @@ function start_neutron_agents {
 
 function stop_mutnauq_l2_agent {
     stop_process q-agt
+
+    if [ "$VIRT_DRIVER" = 'xenserver' ]; then
+        stop_process q-domua
+    fi
 }
 
 # stop_mutnauq_other() - Stop running processes (non-screen)

From 75bf9722392c9fc1ca7c6a95b99e8897c86d4271 Mon Sep 17 00:00:00 2001
From: Paulo Ewerton <pauloewerton@lsd.ufcg.edu.br>
Date: Fri, 22 Jan 2016 19:13:31 +0000
Subject: [PATCH 0661/2409] Move default Keystone API version to v3

This patch sets Keystone v3 as default in services
configuration files and in the openrc and stackrc scripts.

Change-Id: I24546f02067ea23d088d383b85e3a78d7b43f166
Partially-Implements: bp keystonev3
---
 lib/glance             |  2 +-
 lib/tempest            | 12 +++++++-----
 openrc                 |  4 ++--
 stackrc                |  2 +-
 tools/create_userrc.sh |  2 +-
 5 files changed, 12 insertions(+), 10 deletions(-)

diff --git a/lib/glance b/lib/glance
index 5259174799..da9cd43536 100644
--- a/lib/glance
+++ b/lib/glance
@@ -235,7 +235,7 @@ function configure_glance {
     iniset $GLANCE_CACHE_CONF DEFAULT use_syslog $SYSLOG
     iniset $GLANCE_CACHE_CONF DEFAULT image_cache_dir $GLANCE_CACHE_DIR/
     iniuncomment $GLANCE_CACHE_CONF DEFAULT auth_url
-    iniset $GLANCE_CACHE_CONF DEFAULT auth_url $KEYSTONE_AUTH_URI/v2.0
+    iniset $GLANCE_CACHE_CONF DEFAULT auth_url $KEYSTONE_AUTH_URI/v3
     iniuncomment $GLANCE_CACHE_CONF DEFAULT auth_tenant_name
     iniset $GLANCE_CACHE_CONF DEFAULT admin_tenant_name $SERVICE_PROJECT_NAME
     iniuncomment $GLANCE_CACHE_CONF DEFAULT auth_user
diff --git a/lib/tempest b/lib/tempest
index 0d018432af..166a521bd9 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -271,13 +271,15 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG auth admin_tenant_id $admin_project_id
         iniset $TEMPEST_CONFIG auth admin_domain_name $admin_domain_name
     fi
-    if [ "$ENABLE_IDENTITY_V2" == "False" ]; then
-        # Only Identity v3 is available; then skip Identity API v2 tests
+    if [ "$ENABLE_IDENTITY_V2" == "True" ]; then
+        # Run Identity API v2 tests ONLY if needed
+        iniset $TEMPEST_CONFIG identity-feature-enabled api_v2 True
+        iniset $TEMPEST_CONFIG identity auth_version ${TEMPEST_AUTH_VERSION:-v2}
+    else
+        # Skip Identity API v2 tests by default
         iniset $TEMPEST_CONFIG identity-feature-enabled api_v2 False
-        # In addition, use v3 auth tokens for running all Tempest tests
+        # Use v3 auth tokens for running all Tempest tests
         iniset $TEMPEST_CONFIG identity auth_version v3
-    else
-        iniset $TEMPEST_CONFIG identity auth_version ${TEMPEST_AUTH_VERSION:-v2}
     fi
 
     if is_ssl_enabled_service "key" || is_service_enabled tls-proxy; then
diff --git a/openrc b/openrc
index 8d8ae8b030..d1c61297a1 100644
--- a/openrc
+++ b/openrc
@@ -81,12 +81,12 @@ KEYSTONE_AUTH_PROTOCOL=${KEYSTONE_AUTH_PROTOCOL:-$SERVICE_PROTOCOL}
 KEYSTONE_AUTH_HOST=${KEYSTONE_AUTH_HOST:-$SERVICE_HOST}
 
 # Identity API version
-export OS_IDENTITY_API_VERSION=${IDENTITY_API_VERSION:-2.0}
+export OS_IDENTITY_API_VERSION=${IDENTITY_API_VERSION:-3}
 
 # Authenticating against an OpenStack cloud using Keystone returns a **Token**
 # and **Service Catalog**.  The catalog contains the endpoints for all services
 # the user/project has access to - including nova, glance, keystone, swift, ...
-# We currently recommend using the 2.0 *identity api*.
+# We currently recommend using the version 3 *identity api*.
 #
 export OS_AUTH_URL=$KEYSTONE_AUTH_PROTOCOL://$KEYSTONE_AUTH_HOST:5000/v${OS_IDENTITY_API_VERSION}
 
diff --git a/stackrc b/stackrc
index ea8b044faf..e4ff1b7eee 100644
--- a/stackrc
+++ b/stackrc
@@ -158,7 +158,7 @@ else
 fi
 
 # Configure Identity API version: 2.0, 3
-IDENTITY_API_VERSION=${IDENTITY_API_VERSION:-2.0}
+IDENTITY_API_VERSION=${IDENTITY_API_VERSION:-3}
 
 # Set the option ENABLE_IDENTITY_V2 to True. It defines whether the DevStack
 # deployment will be deploying the Identity v2 pipelines. If this option is set
diff --git a/tools/create_userrc.sh b/tools/create_userrc.sh
index 30d1a01577..f4a4edcbe2 100755
--- a/tools/create_userrc.sh
+++ b/tools/create_userrc.sh
@@ -152,7 +152,7 @@ if [ -z "$OS_USERNAME" ]; then
 fi
 
 if [ -z "$OS_AUTH_URL" ]; then
-    export OS_AUTH_URL=http://localhost:5000/v2.0/
+    export OS_AUTH_URL=http://localhost:5000/v3/
 fi
 
 if [ -z "$OS_USER_DOMAIN_ID" -a -z "$OS_USER_DOMAIN_NAME" ]; then

From 30ab23cd9b103470a7d89c4c88bccba789884c36 Mon Sep 17 00:00:00 2001
From: Brian Haley <brian.haley@hpe.com>
Date: Wed, 2 Nov 2016 16:30:31 -0400
Subject: [PATCH 0662/2409] Fix stevedore warning with neutron firewall_driver

The initial start of the neutron OVS agent always prints
a warning:

 WARNING stevedore.named [] Could not load
 neutron.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver

There's an alias for that in setup.cfg called
iptables_hybrid that would avoid it.

Change-Id: I3f5bf782f4f27dc123e462e494741a8a941641ec
---
 lib/neutron_plugins/ovs_base | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/neutron_plugins/ovs_base b/lib/neutron_plugins/ovs_base
index 3cd6c85053..baf7d7f34b 100644
--- a/lib/neutron_plugins/ovs_base
+++ b/lib/neutron_plugins/ovs_base
@@ -83,10 +83,10 @@ function _neutron_ovs_base_configure_debug_command {
 
 function _neutron_ovs_base_configure_firewall_driver {
     if [[ "$Q_USE_SECGROUP" == "True" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver neutron.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver
+        iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver iptables_hybrid
         enable_kernel_bridge_firewall
     else
-        iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver neutron.agent.firewall.NoopFirewallDriver
+        iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver noop
     fi
 }
 

From f881a0e4ee995a2e2122e0e048cc8b7ccc88d6a0 Mon Sep 17 00:00:00 2001
From: Huan Xie <huan.xie@citrix.com>
Date: Tue, 27 Sep 2016 05:57:06 +0000
Subject: [PATCH 0663/2409] XenAPI: Enable linux bridge in Dom0 for neturon

When using neutron network under xenserver, we must enable linux bridge
in Dom0 as neutron will use linux bridge qbr in compute node for
security group. But by default XenServer use openvswitch and disabled
linux bridge. This patch is to remove this restriction.

Change-Id: I0e8124ff2323810fdc46c717a750ce7e8f4aa0c6
---
 lib/nova_plugins/hypervisor-xenserver | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/nova_plugins/hypervisor-xenserver b/lib/nova_plugins/hypervisor-xenserver
index e5d25da3a3..a63e72e764 100644
--- a/lib/nova_plugins/hypervisor-xenserver
+++ b/lib/nova_plugins/hypervisor-xenserver
@@ -90,6 +90,10 @@ CRONTAB
         echo "install_conntrack_tools"
     } | $ssh_dom0
 
+    if is_service_enabled neutron; then
+        # Remove restriction on linux bridge in Dom0 when neutron is enabled
+        $ssh_dom0 "rm -f /etc/modprobe.d/blacklist-bridge*"
+    fi
 }
 
 # install_nova_hypervisor() - Install external components

From 62f29a98d70298372590957bcec7b9f7bc59d963 Mon Sep 17 00:00:00 2001
From: Pierre Riteau <priteau@uchicago.edu>
Date: Thu, 3 Nov 2016 10:10:03 +0000
Subject: [PATCH 0664/2409] Update stable branch example

The stable/juno branch was deleted 11 months ago:
http://lists.openstack.org/pipermail/openstack-announce/2015-December/000869.html

Update the example to Newton, which should keep it valid for a while.

Change-Id: I4cd8738862a529fd319be2ec5694d00defd94f84
---
 README.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index 4ba4619c6d..ff5598b0c5 100644
--- a/README.md
+++ b/README.md
@@ -25,9 +25,9 @@ in a clean and disposable vm when you are first getting started.
 The DevStack master branch generally points to trunk versions of OpenStack
 components.  For older, stable versions, look for branches named
 stable/[release] in the DevStack repo.  For example, you can do the
-following to create a juno OpenStack cloud:
+following to create a Newton OpenStack cloud:
 
-    git checkout stable/juno
+    git checkout stable/newton
     ./stack.sh
 
 You can also pick specific OpenStack project releases by setting the appropriate

From 4f11ff30cf2f7c674316fe8c98f1c006f397013f Mon Sep 17 00:00:00 2001
From: Armando Migliaccio <armamig@gmail.com>
Date: Thu, 27 Oct 2016 06:15:23 -0700
Subject: [PATCH 0665/2409] Adopt openstack client for neutron commands

The neutron client is going to be deprecated during the
Ocata timeframe, so it is time to start switching to the
openstack client to invoke networking commands.

use of neutron client in neutron-legacy has been left as is.

The command for setting the router gateway is left as follow up.

Change-Id: I0a63e03d7d4a08ad6c27f2729fc298322baab397
---
 doc/source/guides/devstack-with-lbaas-v2.rst | 12 ++--
 exercises/neutron-adv-test.sh                | 12 ++--
 lib/neutron_plugins/services/l3              | 76 ++++++++++----------
 lib/tempest                                  |  2 +-
 tools/ping_neutron.sh                        |  2 +-
 5 files changed, 51 insertions(+), 53 deletions(-)

diff --git a/doc/source/guides/devstack-with-lbaas-v2.rst b/doc/source/guides/devstack-with-lbaas-v2.rst
index 0c439ad3ad..21bea9973b 100644
--- a/doc/source/guides/devstack-with-lbaas-v2.rst
+++ b/doc/source/guides/devstack-with-lbaas-v2.rst
@@ -66,21 +66,21 @@ Run stack.sh and do some sanity checks
     ./stack.sh
     . ./openrc
 
-    neutron net-list  # should show public and private networks
+    openstack network list  # should show public and private networks
 
 Create two nova instances that we can use as test http servers:
 
   ::
 
     #create nova instances on private network
-    nova boot --image $(nova image-list | awk '/ cirros-.*-x86_64-uec / {print $2}') --flavor 1 --nic net-id=$(neutron net-list | awk '/ private / {print $2}') node1
-    nova boot --image $(nova image-list | awk '/ cirros-.*-x86_64-uec / {print $2}') --flavor 1 --nic net-id=$(neutron net-list | awk '/ private / {print $2}') node2
+    nova boot --image $(nova image-list | awk '/ cirros-.*-x86_64-uec / {print $2}') --flavor 1 --nic net-id=$(openstack network list | awk '/ private / {print $2}') node1
+    nova boot --image $(nova image-list | awk '/ cirros-.*-x86_64-uec / {print $2}') --flavor 1 --nic net-id=$(openstack network list | awk '/ private / {print $2}') node2
     nova list # should show the nova instances just created
 
     #add secgroup rules to allow ssh etc..
-    neutron security-group-rule-create default --protocol icmp
-    neutron security-group-rule-create default --protocol tcp --port-range-min 22 --port-range-max 22
-    neutron security-group-rule-create default --protocol tcp --port-range-min 80 --port-range-max 80
+    openstack security group rule create default --protocol icmp
+    openstack security group rule create default --protocol tcp --dst-port 22:22
+    openstack security group rule create default --protocol tcp --dst-port 80:80
 
 Set up a simple web server on each of these instances. ssh into each instance (username 'cirros', password 'cubswin:)') and run
 
diff --git a/exercises/neutron-adv-test.sh b/exercises/neutron-adv-test.sh
index e003c56331..bfd45eca5c 100755
--- a/exercises/neutron-adv-test.sh
+++ b/exercises/neutron-adv-test.sh
@@ -156,7 +156,7 @@ function get_role_id {
 function get_network_id {
     local NETWORK_NAME="$1"
     local NETWORK_ID
-    NETWORK_ID=`neutron net-list -F id  -- --name=$NETWORK_NAME | awk "NR==4" | awk '{print $2}'`
+    NETWORK_ID=`openstack network list | grep $NETWORK_NAME | awk '{print $2}'`
     echo $NETWORK_ID
 }
 
@@ -234,9 +234,9 @@ function create_network {
     PROJECT_ID=$(get_project_id $PROJECT)
     source $TOP_DIR/openrc $PROJECT $PROJECT
     local NET_ID
-    NET_ID=$(neutron net-create --project-id $PROJECT_ID $NET_NAME $EXTRA| grep ' id ' | awk '{print $4}' )
+    NET_ID=$(openstack network create --project $PROJECT_ID $NET_NAME $EXTRA| grep ' id ' | awk '{print $4}' )
     die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PROJECT_ID $NET_NAME $EXTRA"
-    neutron subnet-create --ip-version 4 --project-id $PROJECT_ID --gateway $GATEWAY --subnetpool None $NET_ID $CIDR
+    openstack subnet create --ip-version 4 --project $PROJECT_ID --gateway $GATEWAY --subnet-pool None --network $NET_ID --subnet-range $CIDR "${NET_NAME}_subnet"
     neutron_debug_admin probe-create --device-owner compute $NET_ID
     source $TOP_DIR/openrc demo demo
 }
@@ -325,10 +325,10 @@ function delete_network {
     PROJECT_ID=$(get_project_id $PROJECT)
     #TODO(nati) comment out until l3-agent merged
     #for res in port subnet net router;do
-    for net_id in `neutron net-list -c id -c name | grep $NET_NAME | awk '{print $2}'`;do
+    for net_id in `openstack network list -c ID -c Name | grep $NET_NAME | awk '{print $2}'`;do
         delete_probe $net_id
-        neutron subnet-list | grep $net_id | awk '{print $2}' | xargs -I% neutron subnet-delete %
-        neutron net-delete $net_id
+        openstack subnet list | grep $net_id | awk '{print $2}' | xargs -I% openstack subnet delete %
+        openstack network delete $net_id
     done
     source $TOP_DIR/openrc demo demo
 }
diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index aa61a109fa..ddc615589f 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -174,10 +174,10 @@ function create_neutron_initial_network {
     if is_networking_extension_supported "auto-allocated-topology"; then
         if [[ "$USE_SUBNETPOOL" == "True" ]]; then
             if [[ "$IP_VERSION" =~ 4.* ]]; then
-                SUBNETPOOL_V4_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnetpool-create $SUBNETPOOL_NAME --default-prefixlen $SUBNETPOOL_SIZE_V4 --pool-prefix $SUBNETPOOL_PREFIX_V4 --shared --is-default=True | grep ' id ' | get_field 2)
+                SUBNETPOOL_V4_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet pool create $SUBNETPOOL_NAME --default-prefix-length $SUBNETPOOL_SIZE_V4 --pool-prefix $SUBNETPOOL_PREFIX_V4 --share --default | grep ' id ' | get_field 2)
             fi
             if [[ "$IP_VERSION" =~ .*6 ]]; then
-                SUBNETPOOL_V6_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnetpool-create $SUBNETPOOL_NAME --default-prefixlen $SUBNETPOOL_SIZE_V6 --pool-prefix $SUBNETPOOL_PREFIX_V6 --shared --is-default=True | grep ' id ' | get_field 2)
+                SUBNETPOOL_V6_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet pool create $SUBNETPOOL_NAME --default-prefix-length $SUBNETPOOL_SIZE_V6 --pool-prefix $SUBNETPOOL_PREFIX_V6 --share --default | grep ' id ' | get_field 2)
             fi
         fi
     fi
@@ -185,14 +185,14 @@ function create_neutron_initial_network {
     if is_provider_network; then
         die_if_not_set $LINENO PHYSICAL_NETWORK "You must specify the PHYSICAL_NETWORK"
         die_if_not_set $LINENO PROVIDER_NETWORK_TYPE "You must specify the PROVIDER_NETWORK_TYPE"
-        NET_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" net-create $PHYSICAL_NETWORK --tenant_id $project_id --provider:network_type $PROVIDER_NETWORK_TYPE --provider:physical_network "$PHYSICAL_NETWORK" ${SEGMENTATION_ID:+--provider:segmentation_id $SEGMENTATION_ID} --shared | grep ' id ' | get_field 2)
+        NET_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" network create $PHYSICAL_NETWORK --project $project_id --provider-network-type $PROVIDER_NETWORK_TYPE --provider-physical-network "$PHYSICAL_NETWORK" ${SEGMENTATION_ID:+--provider-segment $SEGMENTATION_ID} --share | grep ' id ' | get_field 2)
         die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PHYSICAL_NETWORK $project_id"
 
         if [[ "$IP_VERSION" =~ 4.* ]]; then
             if [ -z $SUBNETPOOL_V4_ID ]; then
                 fixed_range_v4=$FIXED_RANGE
             fi
-            SUBNET_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create --tenant_id $project_id --ip_version 4 ${ALLOCATION_POOL:+--allocation-pool $ALLOCATION_POOL} --name $PROVIDER_SUBNET_NAME --gateway $NETWORK_GATEWAY ${SUBNETPOOL_V4_ID:+--subnetpool $SUBNETPOOL_V4_ID} $NET_ID $fixed_range_v4 | grep ' id ' | get_field 2)
+            SUBNET_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet create --project $project_id --ip-version 4 ${ALLOCATION_POOL:+--allocation-pool $ALLOCATION_POOL} $PROVIDER_SUBNET_NAME --gateway $NETWORK_GATEWAY ${SUBNETPOOL_V4_ID:+--subnet-pool $SUBNETPOOL_V4_ID} --network $NET_ID --subnet-range $fixed_range_v4 | grep ' id ' | get_field 2)
             die_if_not_set $LINENO SUBNET_ID "Failure creating SUBNET_ID for $PROVIDER_SUBNET_NAME $project_id"
         fi
 
@@ -202,7 +202,7 @@ function create_neutron_initial_network {
             if [ -z $SUBNETPOOL_V6_ID ]; then
                 fixed_range_v6=$IPV6_PROVIDER_FIXED_RANGE
             fi
-            SUBNET_V6_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create --tenant_id $project_id --ip_version 6 --ipv6-address-mode $IPV6_ADDRESS_MODE --gateway $IPV6_PROVIDER_NETWORK_GATEWAY --name $IPV6_PROVIDER_SUBNET_NAME ${SUBNETPOOL_V6_ID:+--subnetpool $SUBNETPOOL_V6_ID} $NET_ID $fixed_range_v6 | grep 'id' | get_field 2)
+            SUBNET_V6_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet create --project $project_id --ip-version 6 --ipv6-address-mode $IPV6_ADDRESS_MODE --gateway $IPV6_PROVIDER_NETWORK_GATEWAY $IPV6_PROVIDER_SUBNET_NAME ${SUBNETPOOL_V6_ID:+--subnet-pool $SUBNETPOOL_V6_ID} --network $NET_ID $fixed_range_v6 | grep 'id' | get_field 2)
             die_if_not_set $LINENO SUBNET_V6_ID "Failure creating SUBNET_V6_ID for $IPV6_PROVIDER_SUBNET_NAME $project_id"
         fi
 
@@ -212,7 +212,7 @@ function create_neutron_initial_network {
             sudo ip link set $PUBLIC_INTERFACE up
         fi
     else
-        NET_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" net-create --tenant-id $project_id "$PRIVATE_NETWORK_NAME" | grep ' id ' | get_field 2)
+        NET_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" network create --project $project_id "$PRIVATE_NETWORK_NAME" | grep ' id ' | get_field 2)
         die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PRIVATE_NETWORK_NAME $project_id"
 
         if [[ "$IP_VERSION" =~ 4.* ]]; then
@@ -230,23 +230,23 @@ function create_neutron_initial_network {
         # Create a router, and add the private subnet as one of its interfaces
         if [[ "$Q_L3_ROUTER_PER_TENANT" == "True" ]]; then
             # create a tenant-owned router.
-            ROUTER_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" router-create --tenant-id $project_id $Q_ROUTER_NAME | grep ' id ' | get_field 2)
+            ROUTER_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" router create --project $project_id $Q_ROUTER_NAME | grep ' id ' | get_field 2)
             die_if_not_set $LINENO ROUTER_ID "Failure creating ROUTER_ID for $project_id $Q_ROUTER_NAME"
         else
             # Plugin only supports creating a single router, which should be admin owned.
-            ROUTER_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" router-create $Q_ROUTER_NAME | grep ' id ' | get_field 2)
+            ROUTER_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" router create $Q_ROUTER_NAME | grep ' id ' | get_field 2)
             die_if_not_set $LINENO ROUTER_ID "Failure creating ROUTER_ID for $Q_ROUTER_NAME"
         fi
 
-        EXTERNAL_NETWORK_FLAGS="--router:external"
+        EXTERNAL_NETWORK_FLAGS="--external"
         if is_networking_extension_supported "auto-allocated-topology"; then
-            EXTERNAL_NETWORK_FLAGS="$EXTERNAL_NETWORK_FLAGS --is-default"
+            EXTERNAL_NETWORK_FLAGS="$EXTERNAL_NETWORK_FLAGS --default"
         fi
         # Create an external network, and a subnet. Configure the external network as router gw
         if [ "$Q_USE_PROVIDERNET_FOR_PUBLIC" = "True" ]; then
-            EXT_NET_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" net-create "$PUBLIC_NETWORK_NAME" -- $EXTERNAL_NETWORK_FLAGS --provider:network_type=flat --provider:physical_network=${PUBLIC_PHYSICAL_NETWORK} | grep ' id ' | get_field 2)
+            EXT_NET_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" network create "$PUBLIC_NETWORK_NAME" $EXTERNAL_NETWORK_FLAGS --provider-network-type flat --provider-physical-network ${PUBLIC_PHYSICAL_NETWORK} | grep ' id ' | get_field 2)
         else
-            EXT_NET_ID=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" net-create "$PUBLIC_NETWORK_NAME" -- $EXTERNAL_NETWORK_FLAGS | grep ' id ' | get_field 2)
+            EXT_NET_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" network create "$PUBLIC_NETWORK_NAME" $EXTERNAL_NETWORK_FLAGS | grep ' id ' | get_field 2)
         fi
         die_if_not_set $LINENO EXT_NET_ID "Failure creating EXT_NET_ID for $PUBLIC_NETWORK_NAME"
 
@@ -268,16 +268,16 @@ function _neutron_create_private_subnet_v4 {
     if [ -z $SUBNETPOOL_V4_ID ]; then
         fixed_range_v4=$FIXED_RANGE
     fi
-    local subnet_params="--tenant-id $project_id "
-    subnet_params+="--ip_version 4 "
+    local subnet_params="--project $project_id "
+    subnet_params+="--ip-version 4 "
     if [[ -n "$NETWORK_GATEWAY" ]]; then
         subnet_params+="--gateway $NETWORK_GATEWAY "
     fi
-    subnet_params+="--name $PRIVATE_SUBNET_NAME "
-    subnet_params+="${SUBNETPOOL_V4_ID:+--subnetpool $SUBNETPOOL_V4_ID} "
-    subnet_params+="$NET_ID $fixed_range_v4"
+    subnet_params+="${SUBNETPOOL_V4_ID:+--subnet-pool $SUBNETPOOL_V4_ID} "
+    subnet_params+="${fixed_range_v4:+--subnet-range $fixed_range_v4} "
+    subnet_params+="--network $NET_ID $PRIVATE_SUBNET_NAME"
     local subnet_id
-    subnet_id=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create $subnet_params | grep ' id ' | get_field 2)
+    subnet_id=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet create $subnet_params | grep ' id ' | get_field 2)
     die_if_not_set $LINENO subnet_id "Failure creating private IPv4 subnet for $project_id"
     echo $subnet_id
 }
@@ -291,52 +291,50 @@ function _neutron_create_private_subnet_v6 {
     if [ -z $SUBNETPOOL_V6_ID ]; then
         fixed_range_v6=$FIXED_RANGE_V6
     fi
-    local subnet_params="--tenant-id $project_id "
-    subnet_params+="--ip_version 6 "
+    local subnet_params="--project $project_id "
+    subnet_params+="--ip-version 6 "
     if [[ -n "$IPV6_PRIVATE_NETWORK_GATEWAY" ]]; then
         subnet_params+="--gateway $IPV6_PRIVATE_NETWORK_GATEWAY "
     fi
-    subnet_params+="--name $IPV6_PRIVATE_SUBNET_NAME "
-    subnet_params+="${SUBNETPOOL_V6_ID:+--subnetpool $SUBNETPOOL_V6_ID} "
-    subnet_params+="$NET_ID $fixed_range_v6 $ipv6_modes"
+    subnet_params+="${SUBNETPOOL_V6_ID:+--subnet-pool $SUBNETPOOL_V6_ID} "
+    subnet_params+="${fixed_range_v6:+--subnet-range $fixed_range_v6 $ipv6_modes} "
+    subnet_params+="--network $NET_ID $IPV6_PRIVATE_SUBNET_NAME "
     local ipv6_subnet_id
-    ipv6_subnet_id=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create $subnet_params | grep ' id ' | get_field 2)
+    ipv6_subnet_id=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet create $subnet_params | grep ' id ' | get_field 2)
     die_if_not_set $LINENO ipv6_subnet_id "Failure creating private IPv6 subnet for $project_id"
     echo $ipv6_subnet_id
 }
 
 # Create public IPv4 subnet
 function _neutron_create_public_subnet_v4 {
-    local subnet_params="--ip_version 4 "
+    local subnet_params="--ip-version 4 "
     subnet_params+="${Q_FLOATING_ALLOCATION_POOL:+--allocation-pool $Q_FLOATING_ALLOCATION_POOL} "
     if [[ -n "$PUBLIC_NETWORK_GATEWAY" ]]; then
         subnet_params+="--gateway $PUBLIC_NETWORK_GATEWAY "
     fi
-    subnet_params+="--name $PUBLIC_SUBNET_NAME "
-    subnet_params+="$EXT_NET_ID $FLOATING_RANGE "
-    subnet_params+="-- --enable_dhcp=False"
+    subnet_params+="--network $EXT_NET_ID --subnet-range $FLOATING_RANGE --no-dhcp "
+    subnet_params+="$PUBLIC_SUBNET_NAME"
     local id_and_ext_gw_ip
-    id_and_ext_gw_ip=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create $subnet_params | grep -e 'gateway_ip' -e ' id ')
+    id_and_ext_gw_ip=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet create $subnet_params | grep -e 'gateway_ip' -e ' id ')
     die_if_not_set $LINENO id_and_ext_gw_ip "Failure creating public IPv4 subnet"
     echo $id_and_ext_gw_ip
 }
 
 # Create public IPv6 subnet
 function _neutron_create_public_subnet_v6 {
-    local subnet_params="--ip_version 6 "
+    local subnet_params="--ip-version 6 "
     subnet_params+="--gateway $IPV6_PUBLIC_NETWORK_GATEWAY "
-    subnet_params+="--name $IPV6_PUBLIC_SUBNET_NAME "
-    subnet_params+="$EXT_NET_ID $IPV6_PUBLIC_RANGE "
-    subnet_params+="-- --enable_dhcp=False"
+    subnet_params+="--network $EXT_NET_ID --subnet-range $IPV6_PUBLIC_RANGE --no-dhcp "
+    subnet_params+="$IPV6_PUBLIC_SUBNET_NAME"
     local ipv6_id_and_ext_gw_ip
-    ipv6_id_and_ext_gw_ip=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" subnet-create $subnet_params | grep -e 'gateway_ip' -e ' id ')
+    ipv6_id_and_ext_gw_ip=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet create $subnet_params | grep -e 'gateway_ip' -e ' id ')
     die_if_not_set $LINENO ipv6_id_and_ext_gw_ip "Failure creating an IPv6 public subnet"
     echo $ipv6_id_and_ext_gw_ip
 }
 
 # Configure neutron router for IPv4 public access
 function _neutron_configure_router_v4 {
-    neutron --os-cloud devstack-admin --os-region "$REGION_NAME" router-interface-add $ROUTER_ID $SUBNET_ID
+    openstack --os-cloud devstack-admin --os-region "$REGION_NAME" router add subnet $ROUTER_ID $SUBNET_ID
     # Create a public subnet on the external network
     local id_and_ext_gw_ip
     id_and_ext_gw_ip=$(_neutron_create_public_subnet_v4 $EXT_NET_ID)
@@ -371,7 +369,7 @@ function _neutron_configure_router_v4 {
                 sudo ip addr add $ext_gw_ip/$cidr_len dev $ext_gw_interface
                 sudo ip link set $ext_gw_interface up
             fi
-            ROUTER_GW_IP=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" port-list -c fixed_ips -c device_owner | grep router_gateway | awk -F'ip_address'  '{ print $2 }' | cut -f3 -d\" | tr '\n' ' ')
+            ROUTER_GW_IP=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" port list -c 'Fixed IP Addresses' --device-owner network:router_gateway | awk -F'ip_address'  '{ print $2 }' | cut -f2 -d\' | tr '\n' ' ')
             die_if_not_set $LINENO ROUTER_GW_IP "Failure retrieving ROUTER_GW_IP"
             local replace_range=${SUBNETPOOL_PREFIX_V4}
             if [[ -z "${SUBNETPOOL_V4_ID}" ]]; then
@@ -385,7 +383,7 @@ function _neutron_configure_router_v4 {
 
 # Configure neutron router for IPv6 public access
 function _neutron_configure_router_v6 {
-    neutron --os-cloud devstack-admin --os-region "$REGION_NAME" router-interface-add $ROUTER_ID $IPV6_SUBNET_ID
+    openstack --os-cloud devstack-admin --os-region "$REGION_NAME" router add subnet $ROUTER_ID $IPV6_SUBNET_ID
     # Create a public subnet on the external network
     local ipv6_id_and_ext_gw_ip
     ipv6_id_and_ext_gw_ip=$(_neutron_create_public_subnet_v6 $EXT_NET_ID)
@@ -416,7 +414,7 @@ function _neutron_configure_router_v6 {
         sudo sysctl -w net.ipv6.conf.all.forwarding=1
         # Configure and enable public bridge
         # Override global IPV6_ROUTER_GW_IP with the true value from neutron
-        IPV6_ROUTER_GW_IP=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" port-list -c fixed_ips | grep $ipv6_pub_subnet_id | awk -F'ip_address' '{ print $2 }' | cut -f3 -d\" | tr '\n' ' ')
+        IPV6_ROUTER_GW_IP=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" port list -c 'Fixed IP Addresses' | grep $ipv6_pub_subnet_id | awk -F'ip_address' '{ print $2 }' | cut -f2 -d\' | tr '\n' ' ')
         die_if_not_set $LINENO IPV6_ROUTER_GW_IP "Failure retrieving IPV6_ROUTER_GW_IP"
 
         if is_neutron_ovs_base_plugin; then
@@ -446,6 +444,6 @@ function is_provider_network {
 function is_networking_extension_supported {
     local extension=$1
     # TODO(sc68cal) cache this instead of calling every time
-    EXT_LIST=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" ext-list -c alias -f value)
+    EXT_LIST=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" extension list --network -c Alias -f value)
     [[ $EXT_LIST =~ $extension ]] && return 0
 }
diff --git a/lib/tempest b/lib/tempest
index 6ffc927176..2444ee9967 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -242,7 +242,7 @@ function configure_tempest {
     # the public network (for floating ip access) is only available
     # if the extension is enabled.
     if is_networking_extension_supported 'external-net'; then
-        public_network_id=$(neutron net-list | grep $PUBLIC_NETWORK_NAME | \
+        public_network_id=$(openstack network list | grep $PUBLIC_NETWORK_NAME | \
             awk '{print $2}')
     fi
 
diff --git a/tools/ping_neutron.sh b/tools/ping_neutron.sh
index dba7502652..c75575406a 100755
--- a/tools/ping_neutron.sh
+++ b/tools/ping_neutron.sh
@@ -54,7 +54,7 @@ fi
 REMAINING_ARGS="${@:2}"
 
 # BUG: with duplicate network names, this fails pretty hard.
-NET_ID=$(neutron net-list | grep "$NET_NAME" | awk '{print $2}')
+NET_ID=$(openstack network list | grep "$NET_NAME" | awk '{print $2}')
 PROBE_ID=$(neutron-debug probe-list -c id -c network_id | grep "$NET_ID" | awk '{print $2}' | head -n 1)
 
 # This runs a command inside the specific netns

From f166081d0e4a3b04b157a25e94f0bb2a1769f813 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Tue, 1 Nov 2016 15:44:06 -0400
Subject: [PATCH 0666/2409] Always setup cells v2

Nova is going to land a database migration in Ocata
under change I72fb724dc13e1a5f4e97c58915b538ba761c582d
which enforces that at least the simple cells v2 setup
is performed, which creates the cell mappings, cell0 and
host mappings. Before we can land that change in Nova
we have to make cells v2 setup a default in the integrated
gate jobs.

Depends-On: Ie44e615384df464516aa30b9044b5e54b7d995bb

Change-Id: If1af9c478e8ea2420f2523a9bb8b70fafddc86b7
---
 lib/nova | 7 +------
 stack.sh | 2 +-
 2 files changed, 2 insertions(+), 7 deletions(-)

diff --git a/lib/nova b/lib/nova
index f38fb8b146..09b4aa5587 100644
--- a/lib/nova
+++ b/lib/nova
@@ -85,9 +85,6 @@ METADATA_SERVICE_PORT=${METADATA_SERVICE_PORT:-8775}
 # NOTE: Set ``FORCE_CONFIG_DRIVE="False"`` to turn OFF config drive
 FORCE_CONFIG_DRIVE=${FORCE_CONFIG_DRIVE:-"False"}
 
-# Option to initialize CellsV2 environment
-NOVA_CONFIGURE_CELLSV2=$(trueorfalse False NOVA_CONFIGURE_CELLSV2)
-
 # Nova supports pluggable schedulers.  The default ``FilterScheduler``
 # should work in most cases.
 SCHEDULER=${SCHEDULER:-filter_scheduler}
@@ -681,9 +678,7 @@ function init_nova {
     if is_service_enabled $DATABASE_BACKENDS && is_service_enabled n-api; then
         # (Re)create nova databases
         recreate_database nova
-        if [ "$NOVA_CONFIGURE_CELLSV2" != "False" ]; then
-            recreate_database nova_api_cell0
-        fi
+        recreate_database nova_api_cell0
 
         # Migrate nova database. If "nova-manage cell_v2 simple_cell_setup" has
         # been run this migrates the "nova" and "nova_api_cell0" database.
diff --git a/stack.sh b/stack.sh
index fab2edd299..e908a9a335 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1380,7 +1380,7 @@ check_libs_from_git
 # ----------------------
 
 # Do this late because it requires compute hosts to have started
-if is_service_enabled n-api && [ "$NOVA_CONFIGURE_CELLSV2" == "True" ]; then
+if is_service_enabled n-api; then
     create_cell
 fi
 

From 8c7cec52d0a263d6e5e54afdfdb73f408df68a75 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Fri, 4 Nov 2016 11:31:22 +0000
Subject: [PATCH 0667/2409] Updated from generate-devstack-plugins-list

Change-Id: Id23209fa26e39d569b7e4b4e95d42e72fd92c32e
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 7c97171806..69311350ae 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -119,6 +119,7 @@ nova-docker                            `git://git.openstack.org/openstack/nova-d
 nova-lxd                               `git://git.openstack.org/openstack/nova-lxd <https://git.openstack.org/cgit/openstack/nova-lxd>`__
 nova-mksproxy                          `git://git.openstack.org/openstack/nova-mksproxy <https://git.openstack.org/cgit/openstack/nova-mksproxy>`__
 nova-powervm                           `git://git.openstack.org/openstack/nova-powervm <https://git.openstack.org/cgit/openstack/nova-powervm>`__
+oaktree                                `git://git.openstack.org/openstack/oaktree <https://git.openstack.org/cgit/openstack/oaktree>`__
 octavia                                `git://git.openstack.org/openstack/octavia <https://git.openstack.org/cgit/openstack/octavia>`__
 osprofiler                             `git://git.openstack.org/openstack/osprofiler <https://git.openstack.org/cgit/openstack/osprofiler>`__
 panko                                  `git://git.openstack.org/openstack/panko <https://git.openstack.org/cgit/openstack/panko>`__

From 7c0af1bfb8d39fe4edad4b79b930d90077f4454e Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Thu, 10 Nov 2016 06:49:01 +0000
Subject: [PATCH 0668/2409] Updated from generate-devstack-plugins-list

Change-Id: Ifce4376733d55452a1ce85df75a4203ac2f2aff9
---
 doc/source/plugin-registry.rst | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 69311350ae..6ece9978ac 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -78,6 +78,7 @@ magnum-ui                              `git://git.openstack.org/openstack/magnum
 manila                                 `git://git.openstack.org/openstack/manila <https://git.openstack.org/cgit/openstack/manila>`__
 masakari                               `git://git.openstack.org/openstack/masakari <https://git.openstack.org/cgit/openstack/masakari>`__
 mistral                                `git://git.openstack.org/openstack/mistral <https://git.openstack.org/cgit/openstack/mistral>`__
+mixmatch                               `git://git.openstack.org/openstack/mixmatch <https://git.openstack.org/cgit/openstack/mixmatch>`__
 monasca-analytics                      `git://git.openstack.org/openstack/monasca-analytics <https://git.openstack.org/cgit/openstack/monasca-analytics>`__
 monasca-api                            `git://git.openstack.org/openstack/monasca-api <https://git.openstack.org/cgit/openstack/monasca-api>`__
 monasca-ceilometer                     `git://git.openstack.org/openstack/monasca-ceilometer <https://git.openstack.org/cgit/openstack/monasca-ceilometer>`__
@@ -85,6 +86,7 @@ monasca-log-api                        `git://git.openstack.org/openstack/monasc
 monasca-transform                      `git://git.openstack.org/openstack/monasca-transform <https://git.openstack.org/cgit/openstack/monasca-transform>`__
 murano                                 `git://git.openstack.org/openstack/murano <https://git.openstack.org/cgit/openstack/murano>`__
 networking-6wind                       `git://git.openstack.org/openstack/networking-6wind <https://git.openstack.org/cgit/openstack/networking-6wind>`__
+networking-arista                      `git://git.openstack.org/openstack/networking-arista <https://git.openstack.org/cgit/openstack/networking-arista>`__
 networking-bagpipe                     `git://git.openstack.org/openstack/networking-bagpipe <https://git.openstack.org/cgit/openstack/networking-bagpipe>`__
 networking-bgpvpn                      `git://git.openstack.org/openstack/networking-bgpvpn <https://git.openstack.org/cgit/openstack/networking-bgpvpn>`__
 networking-brocade                     `git://git.openstack.org/openstack/networking-brocade <https://git.openstack.org/cgit/openstack/networking-brocade>`__

From bac2e4ddc28393fbd3c6f45248737893b5d0fd97 Mon Sep 17 00:00:00 2001
From: Carlos Goncalves <carlos.goncalves@neclab.eu>
Date: Fri, 11 Nov 2016 15:02:57 +0100
Subject: [PATCH 0669/2409] Update local.sh sample file to use OSC

Besides updating to OSC CLI, this patch also fixes an argument name typo
present before in 'nova keypair-add' (--pub_key should be --pub-key).

Specifying $OS_PROJECT_NAME in case user is associated to multiple
projects containing security groups with same name (e.g. 'default').

Change-Id: I776f6edfc4c6c798a39d3260827a18c695f05c87
---
 samples/local.sh | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/samples/local.sh b/samples/local.sh
index 634f6ddb17..9cd0bdcc17 100755
--- a/samples/local.sh
+++ b/samples/local.sh
@@ -36,7 +36,7 @@ if is_service_enabled nova; then
     # Add first keypair found in localhost:$HOME/.ssh
     for i in $HOME/.ssh/id_rsa.pub $HOME/.ssh/id_dsa.pub; do
         if [[ -r $i ]]; then
-            nova keypair-add --pub_key=$i `hostname`
+            openstack keypair create --public-key $i `hostname`
             break
         fi
     done
@@ -53,8 +53,8 @@ if is_service_enabled nova; then
     MI_NAME=m1.micro
 
     # Create micro flavor if not present
-    if [[ -z $(nova flavor-list | grep $MI_NAME) ]]; then
-        nova flavor-create $MI_NAME 6 128 0 1
+    if [[ -z $(openstack flavor list | grep $MI_NAME) ]]; then
+        openstack flavor create $MI_NAME --id 6 --ram 128 --disk 0 --vcpus 1
     fi
 
 
@@ -62,7 +62,7 @@ if is_service_enabled nova; then
     # ----------
 
     # Add tcp/22 and icmp to default security group
-    nova secgroup-add-rule default tcp 22 22 0.0.0.0/0
-    nova secgroup-add-rule default icmp -1 -1 0.0.0.0/0
+    openstack security group rule create --project $OS_PROJECT_NAME default --protocol tcp --ingress --dst-port 22
+    openstack security group rule create --project $OS_PROJECT_NAME default --protocol icmp
 
 fi

From bd42d4918eebc7ca2a72bb459bc5f8d953623e5f Mon Sep 17 00:00:00 2001
From: "John L. Villalovos" <john.l.villalovos@intel.com>
Date: Sat, 12 Nov 2016 11:09:15 -0800
Subject: [PATCH 0670/2409] Remove call to undefined teardown_neutron_debug

Previously the usage of neutron debug ports was removed by
5e01c47e4d671166b9396c507a7105a5ac8256dc but there was still call to
teardown_neutron_debug. Recently a change to devstack-gate
1d6cc0771a3399300117f488e9d71e7ea46a4d82 caused that call to be
triggered and breaking the gate-devstack-dsvm-updown job.

This patch deletes the call and comments regarding setup_neutron_debug
and teardown_neutron_debug.

Change-Id: Ifdacb0cec1307db469bd66f551474539184cf2cd
---
 lib/neutron-legacy | 2 --
 unstack.sh         | 5 -----
 2 files changed, 7 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 9e926a000f..613e0f1365 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -24,11 +24,9 @@
 # - check_neutron_third_party_integration
 # - start_neutron_agents
 # - create_neutron_initial_network
-# - setup_neutron_debug
 #
 # ``unstack.sh`` calls the entry points in this order:
 #
-# - teardown_neutron_debug
 # - stop_neutron
 # - stop_neutron_third_party
 # - cleanup_neutron
diff --git a/unstack.sh b/unstack.sh
index f888896cb9..c05d1f0952 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -97,11 +97,6 @@ set -o xtrace
 # Phase: unstack
 run_phase unstack
 
-if [[ "$Q_USE_DEBUG_COMMAND" == "True" ]]; then
-    source $TOP_DIR/openrc
-    teardown_neutron_debug
-fi
-
 # Call service stop
 
 if is_service_enabled heat; then

From 2b3ac6dc64a6d31a1dae2ede6483bf9f73a3918f Mon Sep 17 00:00:00 2001
From: Jianghua Wang <jianghua.wang@citrix.com>
Date: Wed, 9 Nov 2016 12:50:00 +0800
Subject: [PATCH 0671/2409] Specify the correct image parameters for XenServer

The deprecated AMI image file opts will be removed soon.
See https://review.openstack.org/#/c/338377.
So we can't use the fallback mechanism anymore. This patch is to
specify the correct image parameters for XenServer.

Change-Id: Ic287a3ed1725c42ea29022158bc9720c9a96533f
---
 lib/tempest | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 657c3ad592..56c97d52a9 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -295,7 +295,6 @@ function configure_tempest {
     fi
     if [ "$VIRT_DRIVER" = "xenserver" ]; then
         iniset $TEMPEST_CONFIG image disk_formats "ami,ari,aki,vhd,raw,iso"
-        iniset $TEMPEST_CONFIG scenario img_disk_format vhd
     fi
 
     # Image Features
@@ -407,12 +406,20 @@ function configure_tempest {
     fi
 
     # Scenario
-    SCENARIO_IMAGE_DIR=${SCENARIO_IMAGE_DIR:-$FILES/images/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-uec}
+    if [ "$VIRT_DRIVER" = "xenserver" ]; then
+        SCENARIO_IMAGE_DIR=${SCENARIO_IMAGE_DIR:-$FILES}
+        SCENARIO_IMAGE_FILE="cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.vhd.tgz"
+        iniset $TEMPEST_CONFIG scenario img_disk_format vhd
+        iniset $TEMPEST_CONFIG scenario img_container_format ovf
+    else
+        SCENARIO_IMAGE_DIR=${SCENARIO_IMAGE_DIR:-$FILES/images/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-uec}
+        SCENARIO_IMAGE_FILE="cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img"
+    fi
     iniset $TEMPEST_CONFIG scenario img_dir $SCENARIO_IMAGE_DIR
+    iniset $TEMPEST_CONFIG scenario img_file $SCENARIO_IMAGE_FILE
     iniset $TEMPEST_CONFIG scenario ami_img_file "cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-blank.img"
     iniset $TEMPEST_CONFIG scenario ari_img_file "cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-initrd"
     iniset $TEMPEST_CONFIG scenario aki_img_file "cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-vmlinuz"
-    iniset $TEMPEST_CONFIG scenario img_file "cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img"
 
     # Validation
     iniset $TEMPEST_CONFIG validation run_validation ${TEMPEST_RUN_VALIDATION:-False}

From 8f985b6ff1179d19872e83c97035fa49a8f660f6 Mon Sep 17 00:00:00 2001
From: xiaolihope <dixiaobj@cn.ibm.com>
Date: Wed, 18 May 2016 00:32:08 +0800
Subject: [PATCH 0672/2409] Remove heat code from devstack tree

This removes all of the heat code from the devstack tree, in favor of the
devstack plugin in Heat's tree.

Depends-On: I4bed1e5cef5afa7b049b07640086a86a3f881e13
Depends-On: Ic392bcc24bc374ee8511a94f1d8f6ac23131c7e3

Change-Id: I5b60422bf1f5fa78aa8f3383f7a222e0356d9e42
---
 clean.sh                                  |   3 +-
 files/apache-heat-api-cfn.template        |  27 --
 files/apache-heat-api-cloudwatch.template |  27 --
 files/apache-heat-api.template            |  27 --
 files/apache-heat-pip-repo.template       |  15 -
 files/debs/heat                           |   1 -
 lib/heat                                  | 467 ----------------------
 stack.sh                                  |  27 --
 stackrc                                   |   8 -
 tests/test_libs_from_pypi.sh              |   2 +-
 unstack.sh                                |   5 -
 11 files changed, 2 insertions(+), 607 deletions(-)
 delete mode 100644 files/apache-heat-api-cfn.template
 delete mode 100644 files/apache-heat-api-cloudwatch.template
 delete mode 100644 files/apache-heat-api.template
 delete mode 100644 files/apache-heat-pip-repo.template
 delete mode 100644 files/debs/heat
 delete mode 100644 lib/heat

diff --git a/clean.sh b/clean.sh
index bace3f53fe..b59635a821 100755
--- a/clean.sh
+++ b/clean.sh
@@ -49,7 +49,6 @@ source $TOP_DIR/lib/nova
 source $TOP_DIR/lib/placement
 source $TOP_DIR/lib/cinder
 source $TOP_DIR/lib/swift
-source $TOP_DIR/lib/heat
 source $TOP_DIR/lib/neutron
 source $TOP_DIR/lib/neutron-legacy
 
@@ -108,7 +107,7 @@ if is_service_enabled nova && [[ -r $NOVA_PLUGINS/hypervisor-$VIRT_DRIVER ]]; th
 fi
 
 # Clean out /etc
-sudo rm -rf /etc/keystone /etc/glance /etc/nova /etc/cinder /etc/swift /etc/heat /etc/neutron /etc/openstack/
+sudo rm -rf /etc/keystone /etc/glance /etc/nova /etc/cinder /etc/swift /etc/neutron /etc/openstack/
 
 # Clean out tgt
 sudo rm -f /etc/tgt/conf.d/*
diff --git a/files/apache-heat-api-cfn.template b/files/apache-heat-api-cfn.template
deleted file mode 100644
index ab33c66f7e..0000000000
--- a/files/apache-heat-api-cfn.template
+++ /dev/null
@@ -1,27 +0,0 @@
-Listen %PUBLICPORT%
-
-<VirtualHost *:%PUBLICPORT%>
-    WSGIDaemonProcess heat-api-cfn processes=2 threads=1 user=%USER% display-name=%{GROUP} %VIRTUALENV%
-    WSGIProcessGroup heat-api-cfn
-    WSGIScriptAlias / %HEAT_BIN_DIR%/heat-wsgi-api-cfn
-    WSGIApplicationGroup %{GLOBAL}
-    WSGIPassAuthorization On
-    AllowEncodedSlashes On
-    <IfVersion >= 2.4>
-      ErrorLogFormat "%{cu}t %M"
-    </IfVersion>
-    ErrorLog /var/log/%APACHE_NAME%/heat-api-cfn.log
-    %SSLENGINE%
-    %SSLCERTFILE%
-    %SSLKEYFILE%
-
-    <Directory %HEAT_BIN_DIR%>
-        <IfVersion >= 2.4>
-            Require all granted
-        </IfVersion>
-        <IfVersion < 2.4>
-            Order allow,deny
-            Allow from all
-        </IfVersion>
-    </Directory>
-</VirtualHost>
diff --git a/files/apache-heat-api-cloudwatch.template b/files/apache-heat-api-cloudwatch.template
deleted file mode 100644
index 06c91bbdb1..0000000000
--- a/files/apache-heat-api-cloudwatch.template
+++ /dev/null
@@ -1,27 +0,0 @@
-Listen %PUBLICPORT%
-
-<VirtualHost *:%PUBLICPORT%>
-    WSGIDaemonProcess heat-api-cloudwatch processes=2 threads=1 user=%USER% display-name=%{GROUP} %VIRTUALENV%
-    WSGIProcessGroup heat-api-cloudwatch
-    WSGIScriptAlias / %HEAT_BIN_DIR%/heat-wsgi-api-cloudwatch
-    WSGIApplicationGroup %{GLOBAL}
-    WSGIPassAuthorization On
-    AllowEncodedSlashes On
-    <IfVersion >= 2.4>
-      ErrorLogFormat "%{cu}t %M"
-    </IfVersion>
-    ErrorLog /var/log/%APACHE_NAME%/heat-api-cloudwatch.log
-    %SSLENGINE%
-    %SSLCERTFILE%
-    %SSLKEYFILE%
-
-    <Directory %HEAT_BIN_DIR%>
-        <IfVersion >= 2.4>
-            Require all granted
-        </IfVersion>
-        <IfVersion < 2.4>
-            Order allow,deny
-            Allow from all
-        </IfVersion>
-    </Directory>
-</VirtualHost>
diff --git a/files/apache-heat-api.template b/files/apache-heat-api.template
deleted file mode 100644
index 4924b3978b..0000000000
--- a/files/apache-heat-api.template
+++ /dev/null
@@ -1,27 +0,0 @@
-Listen %PUBLICPORT%
-
-<VirtualHost *:%PUBLICPORT%>
-    WSGIDaemonProcess heat-api processes=3 threads=1 user=%USER% display-name=%{GROUP} %VIRTUALENV%
-    WSGIProcessGroup heat-api
-    WSGIScriptAlias / %HEAT_BIN_DIR%/heat-wsgi-api
-    WSGIApplicationGroup %{GLOBAL}
-    WSGIPassAuthorization On
-    AllowEncodedSlashes On
-    <IfVersion >= 2.4>
-      ErrorLogFormat "%{cu}t %M"
-    </IfVersion>
-    ErrorLog /var/log/%APACHE_NAME%/heat-api.log
-    %SSLENGINE%
-    %SSLCERTFILE%
-    %SSLKEYFILE%
-
-    <Directory %HEAT_BIN_DIR%>
-        <IfVersion >= 2.4>
-            Require all granted
-        </IfVersion>
-        <IfVersion < 2.4>
-            Order allow,deny
-            Allow from all
-        </IfVersion>
-    </Directory>
-</VirtualHost>
diff --git a/files/apache-heat-pip-repo.template b/files/apache-heat-pip-repo.template
deleted file mode 100644
index d88ac3e35a..0000000000
--- a/files/apache-heat-pip-repo.template
+++ /dev/null
@@ -1,15 +0,0 @@
-Listen %HEAT_PIP_REPO_PORT%
-
-<VirtualHost *:%HEAT_PIP_REPO_PORT%>
-    DocumentRoot %HEAT_PIP_REPO%
-    <Directory %HEAT_PIP_REPO%>
-        DirectoryIndex index.html
-        Require all granted
-        Order allow,deny
-        allow from all
-    </Directory>
-
-    ErrorLog /var/log/%APACHE_NAME%/heat_pip_repo_error.log
-    LogLevel warn
-    CustomLog /var/log/%APACHE_NAME%/heat_pip_repo_access.log combined
-</VirtualHost>
diff --git a/files/debs/heat b/files/debs/heat
deleted file mode 100644
index 1ecbc780b1..0000000000
--- a/files/debs/heat
+++ /dev/null
@@ -1 +0,0 @@
-gettext # dist:trusty
diff --git a/lib/heat b/lib/heat
deleted file mode 100644
index 0863128f81..0000000000
--- a/lib/heat
+++ /dev/null
@@ -1,467 +0,0 @@
-#!/bin/bash
-#
-# lib/heat
-# Install and start **Heat** service
-
-# To enable, add the following to localrc
-#
-#   ENABLED_SERVICES+=,heat,h-api,h-api-cfn,h-api-cw,h-eng
-
-# Dependencies:
-# (none)
-
-# stack.sh
-# ---------
-# - install_heatclient
-# - install_heat
-# - configure_heatclient
-# - configure_heat
-# - _config_heat_apache_wsgi
-# - init_heat
-# - start_heat
-# - stop_heat
-# - cleanup_heat
-
-# Save trace setting
-_XTRACE_HEAT=$(set +o | grep xtrace)
-set +o xtrace
-
-
-# Defaults
-# --------
-
-# set up default directories
-GITDIR["python-heatclient"]=$DEST/python-heatclient
-
-# Toggle for deploying Heat-API under HTTPD + mod_wsgi
-HEAT_USE_MOD_WSGI=${HEAT_USE_MOD_WSGI:-False}
-
-HEAT_DIR=$DEST/heat
-HEAT_CFNTOOLS_DIR=$DEST/heat-cfntools
-HEAT_TEMPLATES_REPO_DIR=$DEST/heat-templates
-OCC_DIR=$DEST/os-collect-config
-ORC_DIR=$DEST/os-refresh-config
-OAC_DIR=$DEST/os-apply-config
-
-HEAT_PIP_REPO=$DATA_DIR/heat-pip-repo
-HEAT_PIP_REPO_PORT=${HEAT_PIP_REPO_PORT:-8899}
-
-HEAT_AUTH_CACHE_DIR=${HEAT_AUTH_CACHE_DIR:-/var/cache/heat}
-HEAT_STANDALONE=$(trueorfalse False HEAT_STANDALONE)
-HEAT_ENABLE_ADOPT_ABANDON=$(trueorfalse False HEAT_ENABLE_ADOPT_ABANDON)
-HEAT_CONF_DIR=/etc/heat
-HEAT_CONF=$HEAT_CONF_DIR/heat.conf
-HEAT_ENV_DIR=$HEAT_CONF_DIR/environment.d
-HEAT_TEMPLATES_DIR=$HEAT_CONF_DIR/templates
-HEAT_API_HOST=${HEAT_API_HOST:-$HOST_IP}
-HEAT_API_PORT=${HEAT_API_PORT:-8004}
-HEAT_SERVICE_USER=${HEAT_SERVICE_USER:-heat}
-HEAT_TRUSTEE_USER=${HEAT_TRUSTEE_USER:-$HEAT_SERVICE_USER}
-HEAT_TRUSTEE_PASSWORD=${HEAT_TRUSTEE_PASSWORD:-$SERVICE_PASSWORD}
-HEAT_TRUSTEE_DOMAIN=${HEAT_TRUSTEE_DOMAIN:-default}
-
-# Support entry points installation of console scripts
-HEAT_BIN_DIR=$(get_python_exec_prefix)
-
-# other default options
-if [[ "$HEAT_STANDALONE" = "True" ]]; then
-    # for standalone, use defaults which require no service user
-    HEAT_STACK_DOMAIN=$(trueorfalse False HEAT_STACK_DOMAIN)
-    HEAT_DEFERRED_AUTH=${HEAT_DEFERRED_AUTH:-password}
-    if [[ ${HEAT_DEFERRED_AUTH} != "password" ]]; then
-        # Heat does not support keystone trusts when deployed in
-        # standalone mode
-        die $LINENO \
-            'HEAT_DEFERRED_AUTH can only be set to "password" when HEAT_STANDALONE is True.'
-    fi
-else
-    HEAT_STACK_DOMAIN=$(trueorfalse True HEAT_STACK_DOMAIN)
-    HEAT_DEFERRED_AUTH=${HEAT_DEFERRED_AUTH:-}
-fi
-HEAT_PLUGIN_DIR=${HEAT_PLUGIN_DIR:-$DATA_DIR/heat/plugins}
-ENABLE_HEAT_PLUGINS=${ENABLE_HEAT_PLUGINS:-}
-
-# Functions
-# ---------
-
-# Test if any Heat services are enabled
-# is_heat_enabled
-function is_heat_enabled {
-    [[ ,${ENABLED_SERVICES} =~ ,"h-" ]] && return 0
-    return 1
-}
-
-# cleanup_heat() - Remove residual data files, anything left over from previous
-# runs that a clean run would need to clean up
-function cleanup_heat {
-    sudo rm -rf $HEAT_AUTH_CACHE_DIR
-    sudo rm -rf $HEAT_ENV_DIR
-    sudo rm -rf $HEAT_TEMPLATES_DIR
-    sudo rm -rf $HEAT_CONF_DIR
-}
-
-# configure_heat() - Set config files, create data dirs, etc
-function configure_heat {
-
-    sudo install -d -o $STACK_USER $HEAT_CONF_DIR
-    # remove old config files
-    rm -f $HEAT_CONF_DIR/heat-*.conf
-
-    HEAT_API_CFN_HOST=${HEAT_API_CFN_HOST:-$HOST_IP}
-    HEAT_API_CFN_PORT=${HEAT_API_CFN_PORT:-8000}
-    HEAT_ENGINE_HOST=${HEAT_ENGINE_HOST:-$SERVICE_HOST}
-    HEAT_ENGINE_PORT=${HEAT_ENGINE_PORT:-8001}
-    HEAT_API_CW_HOST=${HEAT_API_CW_HOST:-$HOST_IP}
-    HEAT_API_CW_PORT=${HEAT_API_CW_PORT:-8003}
-    HEAT_API_PASTE_FILE=$HEAT_CONF_DIR/api-paste.ini
-    HEAT_POLICY_FILE=$HEAT_CONF_DIR/policy.json
-
-    cp $HEAT_DIR/etc/heat/api-paste.ini $HEAT_API_PASTE_FILE
-    cp $HEAT_DIR/etc/heat/policy.json $HEAT_POLICY_FILE
-
-    # common options
-    iniset_rpc_backend heat $HEAT_CONF
-    iniset $HEAT_CONF DEFAULT heat_metadata_server_url http://$HEAT_API_CFN_HOST:$HEAT_API_CFN_PORT
-    iniset $HEAT_CONF DEFAULT heat_waitcondition_server_url http://$HEAT_API_CFN_HOST:$HEAT_API_CFN_PORT/v1/waitcondition
-    iniset $HEAT_CONF DEFAULT heat_watch_server_url http://$HEAT_API_CW_HOST:$HEAT_API_CW_PORT
-    iniset $HEAT_CONF database connection `database_connection_url heat`
-    iniset $HEAT_CONF DEFAULT auth_encryption_key $(generate_hex_string 16)
-
-    iniset $HEAT_CONF DEFAULT region_name_for_services "$REGION_NAME"
-
-    # logging
-    iniset $HEAT_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-    iniset $HEAT_CONF DEFAULT use_syslog $SYSLOG
-    if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ] && [ "$HEAT_USE_MOD_WSGI" == "False" ]  ; then
-        # Add color to logging output
-        setup_colorized_logging $HEAT_CONF DEFAULT tenant user
-    fi
-
-    if [ ! -z "$HEAT_DEFERRED_AUTH" ]; then
-        iniset $HEAT_CONF DEFAULT deferred_auth_method $HEAT_DEFERRED_AUTH
-    fi
-
-    if [ "$HEAT_USE_MOD_WSGI" == "True" ]; then
-        _config_heat_apache_wsgi
-    fi
-
-    if [[ "$HEAT_STANDALONE" = "True" ]]; then
-        iniset $HEAT_CONF paste_deploy flavor standalone
-        iniset $HEAT_CONF clients_heat url "http://$HEAT_API_HOST:$HEAT_API_PORT/v1/%(tenant_id)s"
-    else
-        configure_auth_token_middleware $HEAT_CONF heat $HEAT_AUTH_CACHE_DIR
-    fi
-
-    # If HEAT_DEFERRED_AUTH is unset or explicitly set to trusts, configure
-    # the section for the client plugin associated with the trustee
-    if [ -z "$HEAT_DEFERRED_AUTH" -o "trusts" == "$HEAT_DEFERRED_AUTH" ]; then
-        iniset $HEAT_CONF trustee auth_type password
-        iniset $HEAT_CONF trustee auth_url $KEYSTONE_AUTH_URI
-        iniset $HEAT_CONF trustee username $HEAT_TRUSTEE_USER
-        iniset $HEAT_CONF trustee password $HEAT_TRUSTEE_PASSWORD
-        iniset $HEAT_CONF trustee user_domain_id $HEAT_TRUSTEE_DOMAIN
-    fi
-
-    # clients_keystone
-    iniset $HEAT_CONF clients_keystone auth_uri $KEYSTONE_AUTH_URI
-
-    # OpenStack API
-    iniset $HEAT_CONF heat_api bind_port $HEAT_API_PORT
-    iniset $HEAT_CONF heat_api workers "$API_WORKERS"
-
-    # Cloudformation API
-    iniset $HEAT_CONF heat_api_cfn bind_port $HEAT_API_CFN_PORT
-
-    # Cloudwatch API
-    iniset $HEAT_CONF heat_api_cloudwatch bind_port $HEAT_API_CW_PORT
-
-    if is_ssl_enabled_service "key" || is_service_enabled tls-proxy; then
-        iniset $HEAT_CONF clients_keystone ca_file $SSL_BUNDLE_FILE
-    fi
-
-    if is_ssl_enabled_service "nova" || is_service_enabled tls-proxy; then
-        iniset $HEAT_CONF clients_nova ca_file $SSL_BUNDLE_FILE
-    fi
-
-    if is_ssl_enabled_service "cinder" || is_service_enabled tls-proxy; then
-        iniset $HEAT_CONF clients_cinder ca_file $SSL_BUNDLE_FILE
-    fi
-
-    if [[ "$HEAT_ENABLE_ADOPT_ABANDON" = "True" ]]; then
-        iniset $HEAT_CONF DEFAULT enable_stack_adopt true
-        iniset $HEAT_CONF DEFAULT enable_stack_abandon true
-    fi
-
-    iniset $HEAT_CONF cache enabled "True"
-    iniset $HEAT_CONF cache backend "dogpile.cache.memory"
-
-    sudo install -d -o $STACK_USER $HEAT_ENV_DIR $HEAT_TEMPLATES_DIR
-
-    # copy the default environment
-    cp $HEAT_DIR/etc/heat/environment.d/* $HEAT_ENV_DIR/
-
-    # copy the default templates
-    cp $HEAT_DIR/etc/heat/templates/* $HEAT_TEMPLATES_DIR/
-
-    # Enable heat plugins.
-    # NOTE(nic): The symlink nonsense is necessary because when
-    # plugins are installed in "developer mode", the final component
-    # of their target directory is always "resources", which confuses
-    # Heat's plugin loader into believing that all plugins are named
-    # "resources", and therefore are all the same plugin; so it
-    # will only load one of them.  Linking them all to a common
-    # location with unique names avoids that type of collision,
-    # while still allowing the plugins to be edited in-tree.
-    local err_count=0
-
-    if [ -n "$ENABLE_HEAT_PLUGINS" ]; then
-        mkdir -p $HEAT_PLUGIN_DIR
-        # Clean up cruft from any previous runs
-        rm -f $HEAT_PLUGIN_DIR/*
-        iniset $HEAT_CONF DEFAULT plugin_dirs $HEAT_PLUGIN_DIR
-    fi
-
-    for heat_plugin in $ENABLE_HEAT_PLUGINS; do
-        if [ -d $HEAT_DIR/contrib/$heat_plugin ]; then
-            setup_package $HEAT_DIR/contrib/$heat_plugin -e
-            ln -s $HEAT_DIR/contrib/$heat_plugin/$heat_plugin/resources $HEAT_PLUGIN_DIR/$heat_plugin
-        else
-            : # clear retval on the test so that we can roll up errors
-            err $LINENO "Requested Heat plugin(${heat_plugin}) not found."
-            err_count=$(($err_count + 1))
-        fi
-    done
-    [ $err_count -eq 0 ] || die $LINENO "$err_count of the requested Heat plugins could not be installed."
-}
-
-# init_heat() - Initialize database
-function init_heat {
-
-    # (re)create heat database
-    recreate_database heat
-
-    $HEAT_BIN_DIR/heat-manage --config-file $HEAT_CONF db_sync
-    create_heat_cache_dir
-}
-
-# create_heat_cache_dir() - Part of the init_heat() process
-function create_heat_cache_dir {
-    # Create cache dirs
-    sudo install -d -o $STACK_USER $HEAT_AUTH_CACHE_DIR
-}
-
-# install_heatclient() - Collect source and prepare
-function install_heatclient {
-    if use_library_from_git "python-heatclient"; then
-        git_clone_by_name "python-heatclient"
-        setup_dev_lib "python-heatclient"
-        sudo install -D -m 0644 -o $STACK_USER {${GITDIR["python-heatclient"]}/tools/,/etc/bash_completion.d/}heat.bash_completion
-    fi
-}
-
-# install_heat() - Collect source and prepare
-function install_heat {
-    git_clone $HEAT_REPO $HEAT_DIR $HEAT_BRANCH
-    setup_develop $HEAT_DIR
-    if [ "$HEAT_USE_MOD_WSGI" == "True" ]; then
-        install_apache_wsgi
-    fi
-}
-
-# install_heat_other() - Collect source and prepare
-function install_heat_other {
-    git_clone $HEAT_CFNTOOLS_REPO $HEAT_CFNTOOLS_DIR $HEAT_CFNTOOLS_BRANCH
-    git_clone $HEAT_TEMPLATES_REPO $HEAT_TEMPLATES_REPO_DIR $HEAT_TEMPLATES_BRANCH
-    git_clone $OAC_REPO $OAC_DIR $OAC_BRANCH
-    git_clone $OCC_REPO $OCC_DIR $OCC_BRANCH
-    git_clone $ORC_REPO $ORC_DIR $ORC_BRANCH
-}
-
-# start_heat() - Start running processes, including screen
-function start_heat {
-    run_process h-eng "$HEAT_BIN_DIR/heat-engine --config-file=$HEAT_CONF"
-
-    # If the site is not enabled then we are in a grenade scenario
-    local enabled_site_file
-    enabled_site_file=$(apache_site_config_for heat-api)
-    if [ -f ${enabled_site_file} ] && [ "$HEAT_USE_MOD_WSGI" == "True" ]; then
-        enable_apache_site heat-api
-        enable_apache_site heat-api-cfn
-        enable_apache_site heat-api-cloudwatch
-        restart_apache_server
-        tail_log heat-api /var/log/$APACHE_NAME/heat-api.log
-        tail_log heat-api-cfn /var/log/$APACHE_NAME/heat-api-cfn.log
-        tail_log heat-api-cloudwatch /var/log/$APACHE_NAME/heat-api-cloudwatch.log
-    else
-        run_process h-api "$HEAT_BIN_DIR/heat-api --config-file=$HEAT_CONF"
-        run_process h-api-cfn "$HEAT_BIN_DIR/heat-api-cfn --config-file=$HEAT_CONF"
-        run_process h-api-cw "$HEAT_BIN_DIR/heat-api-cloudwatch --config-file=$HEAT_CONF"
-    fi
-}
-
-# stop_heat() - Stop running processes
-function stop_heat {
-    # Kill the screen windows
-    stop_process h-eng
-
-    if [ "$HEAT_USE_MOD_WSGI" == "True" ]; then
-        disable_apache_site heat-api
-        disable_apache_site heat-api-cfn
-        disable_apache_site heat-api-cloudwatch
-        restart_apache_server
-    else
-        local serv
-        for serv in h-api h-api-cfn h-api-cw; do
-            stop_process $serv
-        done
-    fi
-
-}
-
-# _cleanup_heat_apache_wsgi() - Remove wsgi files, disable and remove apache vhost file
-function _cleanup_heat_apache_wsgi {
-    sudo rm -f $(apache_site_config_for heat-api)
-    sudo rm -f $(apache_site_config_for heat-api-cfn)
-    sudo rm -f $(apache_site_config_for heat-api-cloudwatch)
-}
-
-# _config_heat_apache_wsgi() - Set WSGI config files of Heat
-function _config_heat_apache_wsgi {
-
-    local heat_apache_conf
-    heat_apache_conf=$(apache_site_config_for heat-api)
-    local heat_cfn_apache_conf
-    heat_cfn_apache_conf=$(apache_site_config_for heat-api-cfn)
-    local heat_cloudwatch_apache_conf
-    heat_cloudwatch_apache_conf=$(apache_site_config_for heat-api-cloudwatch)
-    local heat_ssl=""
-    local heat_certfile=""
-    local heat_keyfile=""
-    local heat_api_port=$HEAT_API_PORT
-    local heat_cfn_api_port=$HEAT_API_CFN_PORT
-    local heat_cw_api_port=$HEAT_API_CW_PORT
-    local venv_path=""
-
-    sudo cp $FILES/apache-heat-api.template $heat_apache_conf
-    sudo sed -e "
-        s|%PUBLICPORT%|$heat_api_port|g;
-        s|%APACHE_NAME%|$APACHE_NAME|g;
-        s|%HEAT_BIN_DIR%|$HEAT_BIN_DIR|g;
-        s|%SSLENGINE%|$heat_ssl|g;
-        s|%SSLCERTFILE%|$heat_certfile|g;
-        s|%SSLKEYFILE%|$heat_keyfile|g;
-        s|%USER%|$STACK_USER|g;
-        s|%VIRTUALENV%|$venv_path|g
-    " -i $heat_apache_conf
-
-    sudo cp $FILES/apache-heat-api-cfn.template $heat_cfn_apache_conf
-    sudo sed -e "
-        s|%PUBLICPORT%|$heat_cfn_api_port|g;
-        s|%APACHE_NAME%|$APACHE_NAME|g;
-        s|%HEAT_BIN_DIR%|$HEAT_BIN_DIR|g;
-        s|%SSLENGINE%|$heat_ssl|g;
-        s|%SSLCERTFILE%|$heat_certfile|g;
-        s|%SSLKEYFILE%|$heat_keyfile|g;
-        s|%USER%|$STACK_USER|g;
-        s|%VIRTUALENV%|$venv_path|g
-    " -i $heat_cfn_apache_conf
-
-    sudo cp $FILES/apache-heat-api-cloudwatch.template $heat_cloudwatch_apache_conf
-    sudo sed -e "
-        s|%PUBLICPORT%|$heat_cw_api_port|g;
-        s|%APACHE_NAME%|$APACHE_NAME|g;
-        s|%HEAT_BIN_DIR%|$HEAT_BIN_DIR|g;
-        s|%SSLENGINE%|$heat_ssl|g;
-        s|%SSLCERTFILE%|$heat_certfile|g;
-        s|%SSLKEYFILE%|$heat_keyfile|g;
-        s|%USER%|$STACK_USER|g;
-        s|%VIRTUALENV%|$venv_path|g
-    " -i $heat_cloudwatch_apache_conf
-}
-
-
-# create_heat_accounts() - Set up common required heat accounts
-function create_heat_accounts {
-    if [[ "$HEAT_STANDALONE" != "True" ]]; then
-
-        create_service_user "heat" "admin"
-        get_or_create_service "heat" "orchestration" "Heat Orchestration Service"
-        get_or_create_endpoint \
-            "orchestration" \
-            "$REGION_NAME" \
-            "$SERVICE_PROTOCOL://$HEAT_API_HOST:$HEAT_API_PORT/v1/\$(project_id)s" \
-            "$SERVICE_PROTOCOL://$HEAT_API_HOST:$HEAT_API_PORT/v1/\$(project_id)s" \
-            "$SERVICE_PROTOCOL://$HEAT_API_HOST:$HEAT_API_PORT/v1/\$(project_id)s"
-
-        get_or_create_service "heat-cfn" "cloudformation" "Heat CloudFormation Service"
-        get_or_create_endpoint \
-            "cloudformation"  \
-            "$REGION_NAME" \
-            "$SERVICE_PROTOCOL://$HEAT_API_CFN_HOST:$HEAT_API_CFN_PORT/v1" \
-            "$SERVICE_PROTOCOL://$HEAT_API_CFN_HOST:$HEAT_API_CFN_PORT/v1" \
-            "$SERVICE_PROTOCOL://$HEAT_API_CFN_HOST:$HEAT_API_CFN_PORT/v1"
-
-        # heat_stack_user role is for users created by Heat
-        get_or_create_role "heat_stack_user"
-    fi
-
-    if [[ "$HEAT_STACK_DOMAIN" == "True" ]]; then
-        # domain -> heat and user -> heat_domain_admin
-        domain_id=$(get_or_create_domain heat 'Owns users and projects created by heat')
-        iniset $HEAT_CONF DEFAULT stack_user_domain_id ${domain_id}
-        get_or_create_user heat_domain_admin $SERVICE_PASSWORD heat
-        get_or_add_user_domain_role admin heat_domain_admin heat
-        iniset $HEAT_CONF DEFAULT stack_domain_admin heat_domain_admin
-        iniset $HEAT_CONF DEFAULT stack_domain_admin_password $SERVICE_PASSWORD
-    fi
-}
-
-# build_heat_pip_mirror() - Build a pip mirror containing heat agent projects
-function build_heat_pip_mirror {
-    local project_dirs="$OCC_DIR $OAC_DIR $ORC_DIR $HEAT_CFNTOOLS_DIR"
-    local projpath proj package
-
-    rm -rf $HEAT_PIP_REPO
-    mkdir -p $HEAT_PIP_REPO
-
-    echo "<html><body>" > $HEAT_PIP_REPO/index.html
-    for projpath in $project_dirs; do
-        proj=$(basename $projpath)
-        mkdir -p $HEAT_PIP_REPO/$proj
-        pushd $projpath
-        rm -rf dist
-        python setup.py sdist
-        pushd dist
-        package=$(ls *)
-        mv $package $HEAT_PIP_REPO/$proj/$package
-        popd
-
-        echo "<html><body><a href=\"$package\">$package</a></body></html>" > $HEAT_PIP_REPO/$proj/index.html
-        echo "<a href=\"$proj\">$proj</a><br/>" >> $HEAT_PIP_REPO/index.html
-
-        popd
-    done
-
-    echo "</body></html>" >> $HEAT_PIP_REPO/index.html
-
-    local heat_pip_repo_apache_conf
-    heat_pip_repo_apache_conf=$(apache_site_config_for heat_pip_repo)
-
-    sudo cp $FILES/apache-heat-pip-repo.template $heat_pip_repo_apache_conf
-    sudo sed -e "
-        s|%HEAT_PIP_REPO%|$HEAT_PIP_REPO|g;
-        s|%HEAT_PIP_REPO_PORT%|$HEAT_PIP_REPO_PORT|g;
-        s|%APACHE_NAME%|$APACHE_NAME|g;
-    " -i $heat_pip_repo_apache_conf
-    enable_apache_site heat_pip_repo
-    restart_apache_server
-    sudo iptables -I INPUT -d $HOST_IP -p tcp --dport $HEAT_PIP_REPO_PORT -j ACCEPT || true
-}
-
-# Restore xtrace
-$_XTRACE_HEAT
-
-# Tell emacs to use shell-script-mode
-## Local variables:
-## mode: shell-script
-## End:
diff --git a/stack.sh b/stack.sh
index 54485b60b9..aa3b1f6709 100755
--- a/stack.sh
+++ b/stack.sh
@@ -572,7 +572,6 @@ source $TOP_DIR/lib/nova
 source $TOP_DIR/lib/placement
 source $TOP_DIR/lib/cinder
 source $TOP_DIR/lib/swift
-source $TOP_DIR/lib/heat
 source $TOP_DIR/lib/neutron
 source $TOP_DIR/lib/neutron-legacy
 source $TOP_DIR/lib/ldap
@@ -800,9 +799,6 @@ fi
 if is_service_enabled neutron nova horizon; then
     install_neutronclient
 fi
-if is_service_enabled heat horizon; then
-    install_heatclient
-fi
 
 # Install shared libraries
 if is_service_enabled cinder nova; then
@@ -873,13 +869,6 @@ if is_service_enabled horizon; then
     stack_install_service horizon
 fi
 
-if is_service_enabled heat; then
-    stack_install_service heat
-    install_heat_other
-    cleanup_heat
-    configure_heat
-fi
-
 if is_service_enabled tls-proxy || [ "$USE_SSL" == "True" ]; then
     configure_CA
     init_CA
@@ -1071,10 +1060,6 @@ if is_service_enabled keystone; then
         create_swift_accounts
     fi
 
-    if is_service_enabled heat; then
-        create_heat_accounts
-    fi
-
 fi
 
 # Write a clouds.yaml file
@@ -1284,18 +1269,6 @@ if is_service_enabled cinder; then
     create_volume_types
 fi
 
-# Configure and launch Heat engine, api and metadata
-if is_service_enabled heat; then
-    # Initialize heat
-    echo_summary "Configuring Heat"
-    init_heat
-    echo_summary "Starting Heat"
-    start_heat
-    if [ "$HEAT_BUILD_PIP_MIRROR" = "True" ]; then
-        echo_summary "Building Heat pip mirror"
-        build_heat_pip_mirror
-    fi
-fi
 
 if is_service_enabled horizon; then
     echo_summary "Starting Horizon"
diff --git a/stackrc b/stackrc
index ea8b044faf..b47cd18d13 100644
--- a/stackrc
+++ b/stackrc
@@ -239,10 +239,6 @@ CINDER_BRANCH=${CINDER_BRANCH:-master}
 GLANCE_REPO=${GLANCE_REPO:-${GIT_BASE}/openstack/glance.git}
 GLANCE_BRANCH=${GLANCE_BRANCH:-master}
 
-# heat service
-HEAT_REPO=${HEAT_REPO:-${GIT_BASE}/openstack/heat.git}
-HEAT_BRANCH=${HEAT_BRANCH:-master}
-
 # django powered web control panel for openstack
 HORIZON_REPO=${HORIZON_REPO:-${GIT_BASE}/openstack/horizon.git}
 HORIZON_BRANCH=${HORIZON_BRANCH:-master}
@@ -301,10 +297,6 @@ GITBRANCH["python-brick-cinderclient-ext"]=${BRICK_CINDERCLIENT_BRANCH:-master}
 GITREPO["python-glanceclient"]=${GLANCECLIENT_REPO:-${GIT_BASE}/openstack/python-glanceclient.git}
 GITBRANCH["python-glanceclient"]=${GLANCECLIENT_BRANCH:-master}
 
-# python heat client library
-GITREPO["python-heatclient"]=${HEATCLIENT_REPO:-${GIT_BASE}/openstack/python-heatclient.git}
-GITBRANCH["python-heatclient"]=${HEATCLIENT_BRANCH:-master}
-
 # ironic client
 GITREPO["python-ironicclient"]=${IRONICCLIENT_REPO:-${GIT_BASE}/openstack/python-ironicclient.git}
 GITBRANCH["python-ironicclient"]=${IRONICCLIENT_BRANCH:-master}
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index fb55023886..415fec506d 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -32,7 +32,7 @@ done
 ALL_LIBS="python-novaclient oslo.config pbr oslo.context"
 ALL_LIBS+=" python-keystoneclient taskflow oslo.middleware pycadf"
 ALL_LIBS+=" python-glanceclient python-ironicclient"
-ALL_LIBS+=" oslo.messaging oslo.log cliff python-heatclient stevedore"
+ALL_LIBS+=" oslo.messaging oslo.log cliff stevedore"
 ALL_LIBS+=" python-cinderclient glance_store oslo.concurrency oslo.db"
 ALL_LIBS+=" oslo.versionedobjects oslo.vmware keystonemiddleware"
 ALL_LIBS+=" oslo.serialization django_openstack_auth"
diff --git a/unstack.sh b/unstack.sh
index c05d1f0952..6cd039f638 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -66,7 +66,6 @@ source $TOP_DIR/lib/nova
 source $TOP_DIR/lib/placement
 source $TOP_DIR/lib/cinder
 source $TOP_DIR/lib/swift
-source $TOP_DIR/lib/heat
 source $TOP_DIR/lib/neutron
 source $TOP_DIR/lib/neutron-legacy
 source $TOP_DIR/lib/ldap
@@ -99,10 +98,6 @@ run_phase unstack
 
 # Call service stop
 
-if is_service_enabled heat; then
-    stop_heat
-fi
-
 if is_service_enabled nova; then
     stop_nova
 fi

From c30b8def82c14e161c0242307e117697e24e1ece Mon Sep 17 00:00:00 2001
From: "Daniel P. Berrange" <berrange@redhat.com>
Date: Mon, 14 Nov 2016 13:23:14 +0000
Subject: [PATCH 0673/2409] Move certificate setup earlier in deployment

Currently the x509 certificate setup is done after all the
openstack services have been deployed. This is OK because
none of the services require that the x509 certs exist
when they are being deployed. With the integration of TLS
into the nova novnc proxy (and later spice & serial proxy)
service, x509 certs will need to exist before Nova is
deployed.

The CA setup must thus be moved earlier in the devstack
deployment flow, prior to the setup of any services. One
part of the CA setup, however, fixes up the global cert
bundle locations and this can only be done after the
python requests module is install, thus must remain in
its current location.

Change-Id: Idcd264fb73bb88dc2f4280c53c013dfe4364afff
---
 lib/tls            |  1 -
 stack.sh           | 14 ++++++++------
 tools/make_cert.sh |  1 +
 3 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/lib/tls b/lib/tls
index 40f3e81438..14cdf19d8e 100644
--- a/lib/tls
+++ b/lib/tls
@@ -201,7 +201,6 @@ subjectAltName          = \$ENV::SUBJECT_ALT_NAME
 # Create root and intermediate CAs
 # init_CA
 function init_CA {
-    fix_system_ca_bundle_path
     # Ensure CAs are built
     make_root_CA $ROOT_CA_DIR
     make_int_CA $INT_CA_DIR $ROOT_CA_DIR
diff --git a/stack.sh b/stack.sh
index 54485b60b9..f20c9d9ae3 100755
--- a/stack.sh
+++ b/stack.sh
@@ -809,6 +809,13 @@ if is_service_enabled cinder nova; then
     install_os_brick
 fi
 
+# Setup TLS certs
+if is_service_enabled tls-proxy || [ "$USE_SSL" == "True" ]; then
+    configure_CA
+    init_CA
+    init_cert
+fi
+
 # Install middleware
 install_keystonemiddleware
 
@@ -881,14 +888,9 @@ if is_service_enabled heat; then
 fi
 
 if is_service_enabled tls-proxy || [ "$USE_SSL" == "True" ]; then
-    configure_CA
-    init_CA
-    init_cert
-    # Add name to ``/etc/hosts``.
-    # Don't be naive and add to existing line!
+    fix_system_ca_bundle_path
 fi
 
-
 # Extras Install
 # --------------
 
diff --git a/tools/make_cert.sh b/tools/make_cert.sh
index 2628b40524..e91464fc0f 100755
--- a/tools/make_cert.sh
+++ b/tools/make_cert.sh
@@ -45,6 +45,7 @@ DEVSTACK_CERT=$DATA_DIR/$DEVSTACK_CERT_NAME.pem
 
 # Make sure the CA is set up
 configure_CA
+fix_system_ca_bundle_path
 init_CA
 
 # Create the server cert

From caa822fce46d0fab1163bbae4fb5d520745aef20 Mon Sep 17 00:00:00 2001
From: Jianghua Wang <jianghua.wang@citrix.com>
Date: Fri, 11 Nov 2016 18:23:17 +0800
Subject: [PATCH 0674/2409] XenAPI: correct the ml2 configuration for neutron

XenAPI requires two instances of L2Agent: the standard one manages OVS
bridges in DomU and the service name is called as q-agt in Devstack;
the other new L2Agent manages OVS bridges in Dom0 and the service name
is called as q-domuA. In order to support the new agent q-domuA, it
requires some XenAPI-specific configurations. But unfortunately those
XenAPI-specific configurations were configured in the standard agent
file, meaning other changes made to the standard agent file would not
have the correct effect. So it has caused issues, for example, floating
IP addresses are not reachable.
This fix is to move the XenAPI-specific configurations from the stardard
agent configuration file to the XenAPI-specific agent configuration file
so that it won't impact the standard agent's behavior.

Change-Id: I45944e84a1f81d016aa00da6d782801ee8457ea4
---
 lib/neutron_plugins/openvswitch_agent | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/lib/neutron_plugins/openvswitch_agent b/lib/neutron_plugins/openvswitch_agent
index e27b8a634a..0af2f2035c 100644
--- a/lib/neutron_plugins/openvswitch_agent
+++ b/lib/neutron_plugins/openvswitch_agent
@@ -81,19 +81,19 @@ function neutron_plugin_configure_plugin_agent {
         # integration bridge.  This is enabled by using a root wrapper
         # that executes commands on dom0 via a XenAPI plugin.
         # XenAPI does not support daemon rootwrap now, so set root_helper_daemon empty
-        iniset /$Q_PLUGIN_CONF_FILE agent root_helper "$Q_RR_DOM0_COMMAND"
-        iniset /$Q_PLUGIN_CONF_FILE agent root_helper_daemon ""
+        iniset "/$Q_PLUGIN_CONF_FILE.domU" agent root_helper "$Q_RR_DOM0_COMMAND"
+        iniset "/$Q_PLUGIN_CONF_FILE.domU" agent root_helper_daemon ""
 
         # Disable minimize polling, so that it can always detect OVS and Port changes
         # This is a problem of xenserver + neutron, bug has been reported
         # https://bugs.launchpad.net/neutron/+bug/1495423
-        iniset /$Q_PLUGIN_CONF_FILE agent minimize_polling False
+        iniset "/$Q_PLUGIN_CONF_FILE.domU" agent minimize_polling False
 
         # Set "physical" mapping
-        iniset /$Q_PLUGIN_CONF_FILE ovs bridge_mappings "physnet1:$FLAT_NETWORK_BRIDGE"
+        iniset "/$Q_PLUGIN_CONF_FILE.domU" ovs bridge_mappings "physnet1:$FLAT_NETWORK_BRIDGE"
 
         # XEN_INTEGRATION_BRIDGE is the integration bridge in dom0
-        iniset /$Q_PLUGIN_CONF_FILE ovs integration_bridge $XEN_INTEGRATION_BRIDGE
+        iniset "/$Q_PLUGIN_CONF_FILE.domU" ovs integration_bridge $XEN_INTEGRATION_BRIDGE
 
         # Set up domU's L2 agent:
 
@@ -107,11 +107,11 @@ function neutron_plugin_configure_plugin_agent {
         sudo ovs-vsctl -- --may-exist add-port $PUBLIC_BRIDGE $PUBLIC_INTERFACE
 
         # Set bridge mappings to "physnet1:br-$GUEST_INTERFACE_DEFAULT"
-        iniset "/$Q_PLUGIN_CONF_FILE.domU" ovs bridge_mappings "physnet1:br-$VLAN_INTERFACE,physnet-ex:$PUBLIC_BRIDGE"
+        iniset /$Q_PLUGIN_CONF_FILE ovs bridge_mappings "physnet1:br-$VLAN_INTERFACE,physnet-ex:$PUBLIC_BRIDGE"
         # Set integration bridge to domU's
-        iniset "/$Q_PLUGIN_CONF_FILE.domU" ovs integration_bridge $OVS_BRIDGE
+        iniset /$Q_PLUGIN_CONF_FILE ovs integration_bridge $OVS_BRIDGE
         # Set root wrap
-        iniset "/$Q_PLUGIN_CONF_FILE.domU" agent root_helper "$Q_RR_COMMAND"
+        iniset /$Q_PLUGIN_CONF_FILE agent root_helper "$Q_RR_COMMAND"
     fi
     iniset /$Q_PLUGIN_CONF_FILE agent tunnel_types $Q_TUNNEL_TYPES
     iniset /$Q_PLUGIN_CONF_FILE ovs datapath_type $OVS_DATAPATH_TYPE

From df5e69114fa2af663c50e734b4a842c727e6a7e9 Mon Sep 17 00:00:00 2001
From: Kevin Benton <kevin@benton.pub>
Date: Tue, 15 Nov 2016 15:02:23 -0800
Subject: [PATCH 0675/2409] Stop setting route pointing back to tenant router

This removes the logic to add a route pointing to the IPv4
tenant private network range since the router is performing
SNAT. If reaching the IPs via the route worked at all, it was
by accident since this behavior is certainly not guaranteed
by Neutron.

Change-Id: If45e3fc15c050cfbac11b57c1eaf137dd7ed816f
---
 lib/neutron_plugins/services/l3 | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index aa61a109fa..e9ee03f865 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -373,11 +373,6 @@ function _neutron_configure_router_v4 {
             fi
             ROUTER_GW_IP=$(neutron --os-cloud devstack-admin --os-region "$REGION_NAME" port-list -c fixed_ips -c device_owner | grep router_gateway | awk -F'ip_address'  '{ print $2 }' | cut -f3 -d\" | tr '\n' ' ')
             die_if_not_set $LINENO ROUTER_GW_IP "Failure retrieving ROUTER_GW_IP"
-            local replace_range=${SUBNETPOOL_PREFIX_V4}
-            if [[ -z "${SUBNETPOOL_V4_ID}" ]]; then
-                replace_range=${FIXED_RANGE}
-            fi
-            sudo ip route replace $replace_range via $ROUTER_GW_IP
         fi
         _neutron_set_router_id
     fi

From 4bfbc291eefd92d8b7885f36275b7ff541e067ab Mon Sep 17 00:00:00 2001
From: Kevin Benton <kevin@benton.pub>
Date: Tue, 15 Nov 2016 17:26:05 -0800
Subject: [PATCH 0676/2409] Derive IP ranges from new ADDRS_SAFE_TO_USE vars

The switch to using subnetpools caused quite a bit of confusion
because it didn't respect the value of FIXED_RANGE. This caused
conflicts in the gate with it's default IPv4 value of 10.0.0.0/8.

This patch does a few things to address the issue:
* It introduces the IPV4_ADDRS_SAFE_TO_USE and IPV6_ADDRS_SAFE_TO_USE
  values and adjusts all of the FIXED_RANGE and SUBNETPOOL_PREFIX values
  to dervive from them by default.
  * This addresses the concern that was raised about implying that
    SUBNETPOOL_PREFIX and FIXED_RANGE are equivalent when setting
    SUBNETPOOL_PREFIX=FIXED_RANGE by default. Now we have a new value
    for the operator specify a chunk of addresses that are safe to
    use for private networks without implementation implications.
  * Backwards compatibility is maintained by alloing users to override
    override all of these values.
* The default for IPV4_ADDRS_SAFE_TO_USE uses /22 instead of /24
  * Because we want to be able to use subnetpools for auto allocated
    topologies and we want to be able to have a large chunk of
    instances on each network, we needed a little more breathing room
    in the default v4 network size.
* SUBNET_POOL_SIZE_V4 default is changed from 24 to 26
  * In conjuction with this change and the one above, the default
    subnetpool will support up to 16 64-address allocations.
  * This should be enough to cover any regular gate scenarios.
  * If someone wants a bigger/smaller subnet, they can ask for that
    in the API request, change this value themselves, or use a different
    network entirely.
* FIXED_RANGE_V6 defaults to a max prefix of /64 from IPV6_ADDRS_SAFE_TO_USE
  * This avoids the private subnet in the non-subnetpool case from being
    larger than /64 to avoid issues identified in rfc 7421.
  * Users can still explicitly set this value to whatever they want.
    This 'max' behavior is only for the default.
  * This allows IPV6_ADDRS_SAFE_TO_USE to default to a /56, which leaves
    tons of room for v6 subnetpools.

Closes-Bug: #1629133
Change-Id: I7b32804d47bec743c0b13e434e6a7958728896ea
---
 doc/source/configuration.rst    | 16 ++++++++--------
 doc/source/guides/neutron.rst   | 12 ++++++------
 doc/source/networking.rst       | 21 ++++++++++++++++++++-
 lib/neutron_plugins/services/l3 | 11 +++++++----
 stackrc                         |  3 ++-
 5 files changed, 43 insertions(+), 20 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 22809ebd7a..bc3f5584b7 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -63,7 +63,7 @@ exists it will be used instead to preserve backward-compatibility.
 ::
 
     [[local|localrc]]
-    FIXED_RANGE=10.254.1.0/24
+    IPV4_ADDRS_SAFE_TO_USE=10.254.1.0/24
     ADMIN_PASSWORD=speciale
     LOGFILE=$DEST/logs/stack.sh.log
 
@@ -161,8 +161,8 @@ values that most often need to be set.
 
 -  no logging
 -  pre-set the passwords to prevent interactive prompts
--  move network ranges away from the local network (``FIXED_RANGE`` and
-   ``FLOATING_RANGE``, commented out below)
+-  move network ranges away from the local network (``IPV4_ADDRS_SAFE_TO_USE``
+   and ``FLOATING_RANGE``, commented out below)
 -  set the host IP if detection is unreliable (``HOST_IP``, commented
    out below)
 
@@ -173,7 +173,7 @@ values that most often need to be set.
     DATABASE_PASSWORD=$ADMIN_PASSWORD
     RABBIT_PASSWORD=$ADMIN_PASSWORD
     SERVICE_PASSWORD=$ADMIN_PASSWORD
-    #FIXED_RANGE=172.31.1.0/24
+    #IPV4_ADDRS_SAFE_TO_USE=172.31.1.0/24
     #FLOATING_RANGE=192.168.20.0/25
     #HOST_IP=10.3.4.5
 
@@ -537,12 +537,12 @@ behavior:
 
         IPV6_RA_MODE=slaac
         IPV6_ADDRESS_MODE=slaac
-        FIXED_RANGE_V6=fd$IPV6_GLOBAL_ID::/64
+        IPV6_ADDRS_SAFE_TO_USE=fd$IPV6_GLOBAL_ID::/56
         IPV6_PRIVATE_NETWORK_GATEWAY=fd$IPV6_GLOBAL_ID::1
 
-*Note*: ``FIXED_RANGE_V6`` and ``IPV6_PRIVATE_NETWORK_GATEWAY`` can be
-configured with any valid IPv6 prefix. The default values make use of
-an auto-generated ``IPV6_GLOBAL_ID`` to comply with RFC4193.
+*Note*: ``IPV6_ADDRS_SAFE_TO_USE`` and ``IPV6_PRIVATE_NETWORK_GATEWAY``
+can be configured with any valid IPv6 prefix. The default values make
+use of an auto-generated ``IPV6_GLOBAL_ID`` to comply with RFC4193.
 
 Service Version
 ~~~~~~~~~~~~~~~
diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index bc6816c7e6..092809a1cf 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -79,7 +79,7 @@ serving as a hypervisor for guest instances.
         ## Neutron options
         Q_USE_SECGROUP=True
         FLOATING_RANGE="172.18.161.0/24"
-        FIXED_RANGE="10.0.0.0/24"
+        IPV4_ADDRS_SAFE_TO_USE="10.0.0.0/22"
         Q_FLOATING_ALLOCATION_POOL=start=172.18.161.250,end=172.18.161.254
         PUBLIC_NETWORK_GATEWAY="172.18.161.1"
         PUBLIC_INTERFACE=eth0
@@ -387,17 +387,17 @@ controller node.
 
         ## Neutron Networking options used to create Neutron Subnets
 
-        FIXED_RANGE="203.0.113.0/24"
+        IPV4_ADDRS_SAFE_TO_USE="203.0.113.0/24"
         NETWORK_GATEWAY=203.0.113.1
         PROVIDER_SUBNET_NAME="provider_net"
         PROVIDER_NETWORK_TYPE="vlan"
         SEGMENTATION_ID=2010
         USE_SUBNETPOOL=False
 
-In this configuration we are defining FIXED_RANGE to be a
+In this configuration we are defining IPV4_ADDRS_SAFE_TO_USE to be a
 publicly routed IPv4 subnet. In this specific instance we are using
 the special TEST-NET-3 subnet defined in `RFC 5737 <http://tools.ietf.org/html/rfc5737>`_,
-which is used for documentation.  In your DevStack setup, FIXED_RANGE
+which is used for documentation.  In your DevStack setup, IPV4_ADDRS_SAFE_TO_USE
 would be a public IP address range that you or your organization has
 allocated to you, so that you could access your instances from the
 public internet.
@@ -524,7 +524,7 @@ setup, with small modifications for the interface mappings.
     ## Neutron options
     Q_USE_SECGROUP=True
     FLOATING_RANGE="172.18.161.0/24"
-    FIXED_RANGE="10.0.0.0/24"
+    IPV4_ADDRS_SAFE_TO_USE="10.0.0.0/24"
     Q_FLOATING_ALLOCATION_POOL=start=172.18.161.250,end=172.18.161.254
     PUBLIC_NETWORK_GATEWAY="172.18.161.1"
     PUBLIC_INTERFACE=eth0
@@ -573,7 +573,7 @@ you do not require them.
     Q_AGENT=macvtap
     PHYSICAL_NETWORK=default
 
-    FIXED_RANGE="203.0.113.0/24"
+    IPV4_ADDRS_SAFE_TO_USE="203.0.113.0/24"
     NETWORK_GATEWAY=203.0.113.1
     PROVIDER_SUBNET_NAME="provider_net"
     PROVIDER_NETWORK_TYPE="vlan"
diff --git a/doc/source/networking.rst b/doc/source/networking.rst
index 1d56c3367e..2301a2e931 100644
--- a/doc/source/networking.rst
+++ b/doc/source/networking.rst
@@ -15,7 +15,8 @@ If you don't specify any configuration you will get the following:
 * neutron (including l3 with openvswitch)
 * private project networks for each openstack project
 * a floating ip range of 172.24.4.0/24 with the gateway of 172.24.4.1
-* the demo project configured with fixed ips on 10.0.0.0/24
+* the demo project configured with fixed ips on a subnet allocated from
+  the 10.0.0.0/22 range
 * a ``br-ex`` interface controlled by neutron for all it's networking
   (this is not connected to any physical interfaces).
 * DNS resolution for guests based on the resolv.conf for you host
@@ -95,3 +96,21 @@ the range of floating ips that will be handed out. As we are sharing
 your existing network, you'll want to give it a slice that your local
 dhcp server is not allocating. Otherwise you could easily have
 conflicting ip addresses, and cause havoc with your local network.
+
+
+Private Network Addressing
+==========================
+
+The private networks addresses are controlled by the ``IPV4_ADDRS_SAFE_TO_USE``
+and the ``IPV6_ADDRS_SAFE_TO_USE`` variables. This allows users to specify one
+single variable of safe internal IPs to use that will be referenced whether or
+not subnetpools are in use.
+
+For IPv4, ``FIXED_RANGE`` and ``SUBNETPOOL_PREFIX_V4`` will just default to
+the value of ``IPV4_ADDRS_SAFE_TO_USE`` directly.
+
+For IPv6, ``FIXED_RANGE`` will default to the first /64 of the value of
+``IPV6_ADDRS_SAFE_TO_USE``. If ``IPV6_ADDRS_SAFE_TO_USE`` is /64 or smaller,
+``FIXED_RANGE`` will just use the value of that directly.
+``SUBNETPOOL_PREFIX_V6`` will just default to the value of
+``IPV6_ADDRS_SAFE_TO_USE`` directly.
diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index ddc615589f..56eb22387b 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -70,7 +70,10 @@ IPV6_RA_MODE=${IPV6_RA_MODE:-slaac}
 IPV6_ADDRESS_MODE=${IPV6_ADDRESS_MODE:-slaac}
 IPV6_PUBLIC_SUBNET_NAME=${IPV6_PUBLIC_SUBNET_NAME:-ipv6-public-subnet}
 IPV6_PRIVATE_SUBNET_NAME=${IPV6_PRIVATE_SUBNET_NAME:-ipv6-private-subnet}
-FIXED_RANGE_V6=${FIXED_RANGE_V6:-fd$IPV6_GLOBAL_ID::/64}
+IPV6_ADDRS_SAFE_TO_USE=${IPV6_ADDRS_SAFE_TO_USE:-fd$IPV6_GLOBAL_ID::/56}
+# if we got larger than a /64 safe to use, we only use the first /64 to
+# avoid side effects outlined in rfc7421
+FIXED_RANGE_V6=${FIXED_RANGE_V6:-$(echo $IPV6_ADDRS_SAFE_TO_USE | awk -F '/' '{ print ($2>63 ? $2 : 64) }')}
 IPV6_PRIVATE_NETWORK_GATEWAY=${IPV6_PRIVATE_NETWORK_GATEWAY:-}
 IPV6_PUBLIC_RANGE=${IPV6_PUBLIC_RANGE:-2001:db8::/64}
 IPV6_PUBLIC_NETWORK_GATEWAY=${IPV6_PUBLIC_NETWORK_GATEWAY:-2001:db8::2}
@@ -86,10 +89,10 @@ PUBLIC_SUBNET_NAME=${PUBLIC_SUBNET_NAME:-"public-subnet"}
 USE_SUBNETPOOL=${USE_SUBNETPOOL:-True}
 SUBNETPOOL_NAME=${SUBNETPOOL_NAME:-"shared-default-subnetpool"}
 
-SUBNETPOOL_PREFIX_V4=${SUBNETPOOL_PREFIX_V4:-10.0.0.0/16}
-SUBNETPOOL_PREFIX_V6=${SUBNETPOOL_PREFIX_V6:-2001:db8:8000::/48}
+SUBNETPOOL_PREFIX_V4=${SUBNETPOOL_PREFIX_V4:-$IPV4_ADDRS_SAFE_TO_USE}
+SUBNETPOOL_PREFIX_V6=${SUBNETPOOL_PREFIX_V6:-$IPV6_ADDRS_SAFE_TO_USE}
 
-SUBNETPOOL_SIZE_V4=${SUBNETPOOL_SIZE_V4:-24}
+SUBNETPOOL_SIZE_V4=${SUBNETPOOL_SIZE_V4:-26}
 SUBNETPOOL_SIZE_V6=${SUBNETPOOL_SIZE_V6:-64}
 
 default_v4_route_devs=$(ip -4 route | grep ^default | awk '{print $5}')
diff --git a/stackrc b/stackrc
index ea8b044faf..8210eb9ad2 100644
--- a/stackrc
+++ b/stackrc
@@ -765,7 +765,8 @@ ENABLE_DEBUG_LOG_LEVEL=$(trueorfalse True ENABLE_DEBUG_LOG_LEVEL)
 # Note that setting ``FIXED_RANGE`` may be necessary when running DevStack
 # in an OpenStack cloud that uses either of these address ranges internally.
 FLOATING_RANGE=${FLOATING_RANGE:-172.24.4.0/24}
-FIXED_RANGE=${FIXED_RANGE:-10.0.0.0/24}
+IPV4_ADDRS_SAFE_TO_USE=${IPV4_ADDRS_SAFE_TO_USE:-10.0.0.0/22}
+FIXED_RANGE=${FIXED_RANGE:-$IPV4_ADDRS_SAFE_TO_USE}
 FIXED_NETWORK_SIZE=${FIXED_NETWORK_SIZE:-256}
 HOST_IP_IFACE=${HOST_IP_IFACE:-}
 HOST_IP=${HOST_IP:-}

From 21d84c29b22fb69b00739ae40d69f80d5182a94e Mon Sep 17 00:00:00 2001
From: "John L. Villalovos" <john.l.villalovos@intel.com>
Date: Fri, 11 Nov 2016 15:26:11 -0800
Subject: [PATCH 0677/2409] If plugin is enabled multiple times fail

When using the enable_plugin command and grenade jobs it can be
easy to enable the same plugin twice, as the grenade job has a
registration section and the configuration in project-config can also
enable it due to code-reuse in project-config.

If a plugin is enabled twice it will likely fail, though it won't be
obvious that it was due to the plugin being enabled multiple times.

This change makes it so if it sees the same plugin name is enabled
more than once it will die and an error message outputted.

Change-Id: I9f1d7e58b861b04473b6a57c9ad404203fb7277a
---
 functions-common | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/functions-common b/functions-common
index 87e6bb453d..eeced621a9 100644
--- a/functions-common
+++ b/functions-common
@@ -1767,6 +1767,9 @@ function enable_plugin {
     local name=$1
     local url=$2
     local branch=${3:-master}
+    if [[ ",${DEVSTACK_PLUGINS}," =~ ,${name}, ]]; then
+        die $LINENO "Plugin attempted to be enabled twice: ${name} ${url} ${branch}"
+    fi
     DEVSTACK_PLUGINS+=",$name"
     GITREPO[$name]=$url
     GITDIR[$name]=$DEST/$name

From ea1abcde180ec0f7fbcec604650f0e95db503102 Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Wed, 16 Nov 2016 18:47:44 +0100
Subject: [PATCH 0678/2409] Swift: fix rsyncd.conf, ports were incorrect

Swift port base was changed in Ifd95b99004aead5ddc8ae1a8dd3ccd9c4f2abe91
but we forgot to update the rsyncd.conf. This patch update the rsyncd.conf
file.

Change-Id: Id457c047c672a810c4c0c7721b6beeb01b719879
---
 files/swift/rsyncd.conf | 48 ++++++++++++++++++++---------------------
 1 file changed, 24 insertions(+), 24 deletions(-)

diff --git a/files/swift/rsyncd.conf b/files/swift/rsyncd.conf
index c670531b31..c49f716fa7 100644
--- a/files/swift/rsyncd.conf
+++ b/files/swift/rsyncd.conf
@@ -4,76 +4,76 @@ log file = %SWIFT_DATA_DIR%/logs/rsyncd.log
 pid file = %SWIFT_DATA_DIR%/run/rsyncd.pid
 address = 127.0.0.1
 
-[account6012]
+[account6612]
 max connections = 25
 path = %SWIFT_DATA_DIR%/1/node/
 read only = false
-lock file = %SWIFT_DATA_DIR%/run/account6012.lock
+lock file = %SWIFT_DATA_DIR%/run/account6612.lock
 
-[account6022]
+[account6622]
 max connections = 25
 path = %SWIFT_DATA_DIR%/2/node/
 read only = false
-lock file = %SWIFT_DATA_DIR%/run/account6022.lock
+lock file = %SWIFT_DATA_DIR%/run/account6622.lock
 
-[account6032]
+[account6632]
 max connections = 25
 path = %SWIFT_DATA_DIR%/3/node/
 read only = false
-lock file = %SWIFT_DATA_DIR%/run/account6032.lock
+lock file = %SWIFT_DATA_DIR%/run/account6632.lock
 
-[account6042]
+[account6642]
 max connections = 25
 path = %SWIFT_DATA_DIR%/4/node/
 read only = false
-lock file = %SWIFT_DATA_DIR%/run/account6042.lock
+lock file = %SWIFT_DATA_DIR%/run/account6642.lock
 
 
-[container6011]
+[container6611]
 max connections = 25
 path = %SWIFT_DATA_DIR%/1/node/
 read only = false
-lock file = %SWIFT_DATA_DIR%/run/container6011.lock
+lock file = %SWIFT_DATA_DIR%/run/container6611.lock
 
-[container6021]
+[container6621]
 max connections = 25
 path = %SWIFT_DATA_DIR%/2/node/
 read only = false
-lock file = %SWIFT_DATA_DIR%/run/container6021.lock
+lock file = %SWIFT_DATA_DIR%/run/container6621.lock
 
-[container6031]
+[container6631]
 max connections = 25
 path = %SWIFT_DATA_DIR%/3/node/
 read only = false
-lock file = %SWIFT_DATA_DIR%/run/container6031.lock
+lock file = %SWIFT_DATA_DIR%/run/container6631.lock
 
-[container6041]
+[container6641]
 max connections = 25
 path = %SWIFT_DATA_DIR%/4/node/
 read only = false
-lock file = %SWIFT_DATA_DIR%/run/container6041.lock
+lock file = %SWIFT_DATA_DIR%/run/container6641.lock
 
 
-[object6010]
+[object6613]
 max connections = 25
 path = %SWIFT_DATA_DIR%/1/node/
 read only = false
-lock file = %SWIFT_DATA_DIR%/run/object6010.lock
+lock file = %SWIFT_DATA_DIR%/run/object6613.lock
 
-[object6020]
+[object6623]
 max connections = 25
 path = %SWIFT_DATA_DIR%/2/node/
 read only = false
-lock file = %SWIFT_DATA_DIR%/run/object6020.lock
+lock file = %SWIFT_DATA_DIR%/run/object6623.lock
 
-[object6030]
+[object6633]
 max connections = 25
 path = %SWIFT_DATA_DIR%/3/node/
 read only = false
-lock file = %SWIFT_DATA_DIR%/run/object6030.lock
+lock file = %SWIFT_DATA_DIR%/run/object6633.lock
 
-[object6040]
+[object6643]
 max connections = 25
 path = %SWIFT_DATA_DIR%/4/node/
 read only = false
-lock file = %SWIFT_DATA_DIR%/run/object6040.lock
+lock file = %SWIFT_DATA_DIR%/run/object6643.lock

From 56b39126853ff47525c89c7ba3c02422a639ddc3 Mon Sep 17 00:00:00 2001
From: "Gary W. Smith" <gary.smith@hpe.com>
Date: Wed, 16 Nov 2016 22:03:43 -0800
Subject: [PATCH 0679/2409] Use -y on zypper remove to avoid hanging

When using zypper remove, include the -y option to avoid stack.sh from
hanging waiting for user confirmation.  Due to output buffering, the
script could hang before giving the user the prompt to enter Y to
continue, making it unclear why the script was hanging.

Change-Id: I5ea761e5ae0829439953c385f8e7d0546acba886
Closes-Bug: 1642736
---
 functions-common | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index 8e14b5ec7b..d5014fd80a 100644
--- a/functions-common
+++ b/functions-common
@@ -1318,7 +1318,7 @@ function uninstall_package {
     elif is_fedora; then
         sudo ${YUM:-yum} remove -y "$@" ||:
     elif is_suse; then
-        sudo zypper rm "$@" ||:
+        sudo zypper remove -y "$@" ||:
     else
         exit_distro_not_supported "uninstalling packages"
     fi

From f5069f35a176109e3e28347ce7e0418ffc57c4cb Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Tue, 8 Nov 2016 12:10:12 +0100
Subject: [PATCH 0680/2409] lib/lvm: don't use $VOLUME_GROUP variable anymore

We should be using $VOLUME_GROUP_NAME instead since Icehouse.
$VOLUME_GROUP_NAME has been introduced in
I93b8ef32832269d730c76a6dc24ddb4f20c6d9df and $VOLUME_GROUP is nowadays
only use as a fallback to $VOLUME_GROUP_NAME.

As a code comment in lib/lvm says it we kept the $VOLUME_GROUP around as
"for compatibility with icehouse-generation Grenade". Icehouse is long
gone so now seems a good time to remove any usage of $VOLUME_GROUP.

Change-Id: Id3051b5a196c45266c39fde4f08401aaacf0f6bd
---
 doc/source/configuration.rst        | 4 ++--
 doc/source/guides/multinode-lab.rst | 6 +++---
 lib/lvm                             | 6 +-----
 3 files changed, 6 insertions(+), 10 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 22809ebd7a..391e5bec70 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -703,13 +703,13 @@ Cinder
 ~~~~~~
 
 The logical volume group used to hold the Cinder-managed volumes is
-set by ``VOLUME_GROUP``, the logical volume name prefix is set with
+set by ``VOLUME_GROUP_NAME``, the logical volume name prefix is set with
 ``VOLUME_NAME_PREFIX`` and the size of the volume backing file is set
 with ``VOLUME_BACKING_FILE_SIZE``.
 
     ::
 
-        VOLUME_GROUP="stack-volumes"
+        VOLUME_GROUP_NAME="stack-volumes"
         VOLUME_NAME_PREFIX="volume-"
         VOLUME_BACKING_FILE_SIZE=10250M
 
diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
index 8751eb8d6a..81c08dc747 100644
--- a/doc/source/guides/multinode-lab.rst
+++ b/doc/source/guides/multinode-lab.rst
@@ -294,10 +294,10 @@ created inside OpenStack. The size can be overridden by setting
 
 ``stack-volumes`` can be pre-created on any physical volume supported by
 Linux's LVM. The name of the volume group can be changed by setting
-``VOLUME_GROUP`` in ``localrc``. ``stack.sh`` deletes all logical
-volumes in ``VOLUME_GROUP`` that begin with ``VOLUME_NAME_PREFIX`` as
+``VOLUME_GROUP_NAME`` in ``localrc``. ``stack.sh`` deletes all logical
+volumes in ``VOLUME_GROUP_NAME`` that begin with ``VOLUME_NAME_PREFIX`` as
 part of cleaning up from previous runs. It is recommended to not use the
-root volume group as ``VOLUME_GROUP``.
+root volume group as ``VOLUME_GROUP_NAME``.
 
 The details of creating the volume group depends on the server hardware
 involved but looks something like this:
diff --git a/lib/lvm b/lib/lvm
index d35a76fb5f..99c7ba9b9f 100644
--- a/lib/lvm
+++ b/lib/lvm
@@ -23,11 +23,7 @@ set +o xtrace
 # Defaults
 # --------
 # Name of the lvm volume groups to use/create for iscsi volumes
-# This monkey-motion is for compatibility with icehouse-generation Grenade
-# If ``VOLUME_GROUP`` is set, use it, otherwise we'll build a VG name based
-# on ``VOLUME_GROUP_NAME`` that includes the backend name
-# Grenade doesn't use ``VOLUME_GROUP2`` so it is left out
-VOLUME_GROUP_NAME=${VOLUME_GROUP:-${VOLUME_GROUP_NAME:-stack-volumes}}
+VOLUME_GROUP_NAME=${VOLUME_GROUP_NAME:-stack-volumes}
 DEFAULT_VOLUME_GROUP_NAME=$VOLUME_GROUP_NAME-default
 
 # Backing file name is of the form $VOLUME_GROUP$BACKING_FILE_SUFFIX

From 7938d83d3bd37ef63cfea60e188918848ea87858 Mon Sep 17 00:00:00 2001
From: Michael Turek <mjturek@linux.vnet.ibm.com>
Date: Tue, 12 Apr 2016 14:55:21 -0400
Subject: [PATCH 0681/2409] Allow provider network to be used for ssh
 validation

Currently devstack assumes that the network used for ssh
validation is the private network. This patch adds a hook that
sets the network used for ssh validation based on whether or not
provider networking is being used. It also moves the function
'is_provider_network' into functions-common as it will now be
used by both tempest and neutron.

Change-Id: I265c9e26c9bfb18b7e201f27d8912b8bec235872
---
 functions-common                | 8 ++++++++
 lib/neutron_plugins/services/l3 | 7 -------
 lib/tempest                     | 7 ++++++-
 3 files changed, 14 insertions(+), 8 deletions(-)

diff --git a/functions-common b/functions-common
index 8e14b5ec7b..56d0a64f39 100644
--- a/functions-common
+++ b/functions-common
@@ -2260,6 +2260,14 @@ function maskip {
     echo $subnet
 }
 
+function is_provider_network {
+    if [ "$Q_USE_PROVIDER_NETWORKING" == "True" ]; then
+        return 0
+    fi
+    return 1
+}
+
+
 # Return the current python as "python<major>.<minor>"
 function python_version {
     local python_version
diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index ddc615589f..9c475e9171 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -434,13 +434,6 @@ function _neutron_configure_router_v6 {
     fi
 }
 
-function is_provider_network {
-    if [ "$Q_USE_PROVIDER_NETWORKING" == "True" ]; then
-        return 0
-    fi
-    return 1
-}
-
 function is_networking_extension_supported {
     local extension=$1
     # TODO(sc68cal) cache this instead of calling every time
diff --git a/lib/tempest b/lib/tempest
index f43036e12b..5e636379d0 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -414,12 +414,17 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG scenario aki_img_file "cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-vmlinuz"
     iniset $TEMPEST_CONFIG scenario img_file "cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img"
 
+    # If using provider networking, use the physical network for validation rather than private
+    TEMPEST_SSH_NETWORK_NAME=$PRIVATE_NETWORK_NAME
+    if is_provider_network; then
+        TEMPEST_SSH_NETWORK_NAME=$PHYSICAL_NETWORK
+    fi
     # Validation
     iniset $TEMPEST_CONFIG validation run_validation ${TEMPEST_RUN_VALIDATION:-False}
     iniset $TEMPEST_CONFIG validation ip_version_for_ssh 4
     iniset $TEMPEST_CONFIG validation ssh_timeout $BUILD_TIMEOUT
     iniset $TEMPEST_CONFIG validation image_ssh_user ${DEFAULT_INSTANCE_USER:-cirros}
-    iniset $TEMPEST_CONFIG validation network_for_ssh $PRIVATE_NETWORK_NAME
+    iniset $TEMPEST_CONFIG validation network_for_ssh $TEMPEST_SSH_NETWORK_NAME
 
     # Volume
     # TODO(obutenko): Remove snapshot_backup when liberty-eol happens.

From 37f48f3c208de1031ef4589d15194c4079ad4a97 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tomasz=20Tr=C4=99bski?= <tomasz.trebski@ts.fujitsu.com>
Date: Mon, 14 Nov 2016 09:10:57 +0100
Subject: [PATCH 0682/2409] Always set ALLOWED_HOSTS for horizon

If devstack is deployed in the VM with defined
public IP address (like 192.168.10.6) it is not possible to
access the Horizon from the browser.
This is because DEBUG=True means that ALLOWED_HOSTS, if not set,
is equal to ['localhost', '127.0.0.1', '[::1]'] according
to Django's documentation.

Change-Id: I74ae99569dafa10eee7066713a05fb49183e3fca
---
 lib/horizon | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/lib/horizon b/lib/horizon
index 78cbe8b58d..50896503a1 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -97,6 +97,11 @@ function configure_horizon {
     _horizon_config_set $local_settings "" OPENSTACK_API_VERSIONS {\"identity\":3}
     _horizon_config_set $local_settings "" OPENSTACK_KEYSTONE_URL "\"${KEYSTONE_SERVICE_URI}/v3\""
 
+    # note(trebskit): if HOST_IP points at non-localhost ip address, horizon cannot be accessed
+    # from outside the virtual machine. This fixes is meant primarily for local development
+    # purpose
+    _horizon_config_set $local_settings "" ALLOWED_HOSTS [\"$HOST_IP\"]
+
     if [ -f $SSL_BUNDLE_FILE ]; then
         _horizon_config_set $local_settings "" OPENSTACK_SSL_CACERT \"${SSL_BUNDLE_FILE}\"
     fi

From d038b60e65dcf6916445a03fe87a11a39c6516c8 Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Fri, 4 Nov 2016 13:32:39 +0100
Subject: [PATCH 0683/2409] Neutron: use "OSC show -f value -c id" instead of
 "OSC list + grep"

We should leverage server-side filtering.

Change-Id: I3deef791868769b0b7cfc405d73dff57458ca427
---
 exercises/neutron-adv-test.sh | 2 +-
 lib/tempest                   | 3 +--
 tools/ping_neutron.sh         | 2 +-
 3 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/exercises/neutron-adv-test.sh b/exercises/neutron-adv-test.sh
index bfd45eca5c..e8c8f62140 100755
--- a/exercises/neutron-adv-test.sh
+++ b/exercises/neutron-adv-test.sh
@@ -156,7 +156,7 @@ function get_role_id {
 function get_network_id {
     local NETWORK_NAME="$1"
     local NETWORK_ID
-    NETWORK_ID=`openstack network list | grep $NETWORK_NAME | awk '{print $2}'`
+    NETWORK_ID=`openstack network show -f value -c id $NETWORK_NAME`
     echo $NETWORK_ID
 }
 
diff --git a/lib/tempest b/lib/tempest
index f43036e12b..2816740180 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -242,8 +242,7 @@ function configure_tempest {
     # the public network (for floating ip access) is only available
     # if the extension is enabled.
     if is_networking_extension_supported 'external-net'; then
-        public_network_id=$(openstack network list | grep $PUBLIC_NETWORK_NAME | \
-            awk '{print $2}')
+        public_network_id=$(openstack network show -f value -c id $PUBLIC_NETWORK_NAME)
     fi
 
     iniset $TEMPEST_CONFIG DEFAULT use_syslog $SYSLOG
diff --git a/tools/ping_neutron.sh b/tools/ping_neutron.sh
index c75575406a..73fe3f3bdf 100755
--- a/tools/ping_neutron.sh
+++ b/tools/ping_neutron.sh
@@ -54,7 +54,7 @@ fi
 REMAINING_ARGS="${@:2}"
 
 # BUG: with duplicate network names, this fails pretty hard.
-NET_ID=$(openstack network list | grep "$NET_NAME" | awk '{print $2}')
+NET_ID=$(openstack network show -f value -c id "$NET_NAME")
 PROBE_ID=$(neutron-debug probe-list -c id -c network_id | grep "$NET_ID" | awk '{print $2}' | head -n 1)
 
 # This runs a command inside the specific netns

From a5afa7d81ad380eeb91f7c58dd07facb214b347b Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Fri, 18 Nov 2016 12:32:19 -0800
Subject: [PATCH 0684/2409] Fix default ipv6 fixed range var

The intent was to make any ipv6 safe addr range bigger than a /64 a /64
when setting the fixed range. Unfortunately the awk only emited the mask
and not the addr. Fix this by sprinkling the address back in.

Fixes-Bug: 1643055
Change-Id: I526d4c748fd404ecb3c77afcbb056aa95090c409
---
 lib/neutron_plugins/services/l3 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 2099757b03..6d518e25d8 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -73,7 +73,7 @@ IPV6_PRIVATE_SUBNET_NAME=${IPV6_PRIVATE_SUBNET_NAME:-ipv6-private-subnet}
 IPV6_ADDRS_SAFE_TO_USE=${IPV6_ADDRS_SAFE_TO_USE:-fd$IPV6_GLOBAL_ID::/56}
 # if we got larger than a /64 safe to use, we only use the first /64 to
 # avoid side effects outlined in rfc7421
-FIXED_RANGE_V6=${FIXED_RANGE_V6:-$(echo $IPV6_ADDRS_SAFE_TO_USE | awk -F '/' '{ print ($2>63 ? $2 : 64) }')}
+FIXED_RANGE_V6=${FIXED_RANGE_V6:-$(echo $IPV6_ADDRS_SAFE_TO_USE | awk -F '/' '{ print $1"/"($2>63 ? $2 : 64) }')}
 IPV6_PRIVATE_NETWORK_GATEWAY=${IPV6_PRIVATE_NETWORK_GATEWAY:-}
 IPV6_PUBLIC_RANGE=${IPV6_PUBLIC_RANGE:-2001:db8::/64}
 IPV6_PUBLIC_NETWORK_GATEWAY=${IPV6_PUBLIC_NETWORK_GATEWAY:-2001:db8::2}

From 90742fc1be7b4ad77bf3fda110d5a9bda4eb2100 Mon Sep 17 00:00:00 2001
From: Jakub Wachowski <jakub.wachowski@ts.fujitsu.com>
Date: Fri, 18 Nov 2016 14:28:47 +0100
Subject: [PATCH 0685/2409] Pass branch parameter to git clone

Without this parameter, when we set GIT_DEPTH,
it may happen that we clone only master and
then cannot checkout branch

Change-Id: I39376914f8bfc286a308c99db6bc92cddab195b5
---
 functions-common | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/functions-common b/functions-common
index d5014fd80a..458f3de363 100644
--- a/functions-common
+++ b/functions-common
@@ -534,10 +534,8 @@ function git_clone {
                 echo "the project to the \$PROJECTS variable in the job definition."
                 die $LINENO "Cloning not allowed in this configuration"
             fi
-            git_timed clone $git_clone_flags $git_remote $git_dest
-            cd $git_dest
-            # This checkout syntax works for both branches and tags
-            git checkout $git_ref
+            # '--branch' can also take tags
+            git_timed clone $git_clone_flags $git_remote $git_dest --branch $git_ref
         elif [[ "$RECLONE" = "True" ]]; then
             # if it does exist then simulate what clone does if asked to RECLONE
             cd $git_dest

From 82fa946d8fad036d9d5fae57f9f138c31cc210d4 Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Wed, 2 Nov 2016 11:15:42 +0100
Subject: [PATCH 0686/2409] lib/tempest: use OSC to create nova flavors.

OSC is the future and it's available now.

Change-Id: Ib0dac761673a0c4f05a328ee530018e8bb269c4c
---
 lib/tempest | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index f43036e12b..928fbbdb6c 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -193,11 +193,11 @@ function configure_tempest {
         available_flavors=$(nova flavor-list)
         if  [[ -z "$DEFAULT_INSTANCE_TYPE" ]]; then
             if [[ ! ( $available_flavors =~ 'm1.nano' ) ]]; then
-                nova flavor-create m1.nano 42 64 0 1
+                openstack flavor create --id 42 --ram 64 --disk 0 --vcpus 1 m1.nano
             fi
             flavor_ref=42
             if [[ ! ( $available_flavors =~ 'm1.micro' ) ]]; then
-                nova flavor-create m1.micro 84 128 0 1
+                openstack flavor create --id 84 --ram 128 --disk 0 --vcpus 1 m1.micro
             fi
             flavor_ref_alt=84
         else
@@ -398,7 +398,7 @@ function configure_tempest {
             # build a specialized heat flavor
             available_flavors=$(nova flavor-list)
             if [[ ! ( $available_flavors =~ 'm1.heat' ) ]]; then
-                nova flavor-create m1.heat 451 512 0 1
+                openstack flavor create --id 451 --ram 512 --disk 0 --vcpus 1 m1.heat
             fi
             iniset $TEMPEST_CONFIG orchestration instance_type "m1.heat"
         fi

From 541617b15ef678cd5daf05d19ceea84ec1c8ebf9 Mon Sep 17 00:00:00 2001
From: Hidekazu Nakamura <hid-nakamura@vf.jp.nec.com>
Date: Wed, 9 Nov 2016 15:27:19 +0900
Subject: [PATCH 0687/2409] Improve Live Migration section in multinode-lab.rst

Added root user login check to ensure SSH keys exchanged.


Change-Id: I8513bc883ac273af8dcc2f61562a838d33b45a82
---
 doc/source/guides/multinode-lab.rst | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
index 8751eb8d6a..a98c2700a5 100644
--- a/doc/source/guides/multinode-lab.rst
+++ b/doc/source/guides/multinode-lab.rst
@@ -400,6 +400,10 @@ SSH keys need to be exchanged between each compute node:
 
         ssh-keyscan -H DEST_HOSTNAME | sudo tee -a /root/.ssh/known_hosts
 
+3. Verify that login via ssh works without a password::
+
+        ssh -i /root/.ssh/id_rsa.pub stack@DESTINATION
+
 In essence, this means that every compute node's root user's public RSA key
 must exist in every other compute node's stack user's authorized_keys file and
 every compute node's public ECDSA key needs to be in every other compute

From a5b72b053efec9af8a57c59b35f96142e4f38433 Mon Sep 17 00:00:00 2001
From: Kaitlin Farr <kaitlin.farr@jhuapl.edu>
Date: Tue, 26 Jan 2016 22:46:13 -0500
Subject: [PATCH 0688/2409] Set fixed-key key manager

With the key manager refactoring in nova and cinder, the key manager
class will need to be explicitly set.

Nova key manager refactoring: Ib563b0ea4b8b4bc1833bf52bf49a68546c384996
Cinder key manager refactoring: Ief8885bb4ca8d62b03cf1a52c25dd0e62c835bfe

Change-Id: I733279864ee1a4aaffc9c8eed81b5e12f8d8821b
Implements: blueprint use-castellan-key-manager
---
 lib/cinder | 2 ++
 lib/nova   | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/lib/cinder b/lib/cinder
index c4a49cd992..c7ce0f5aa3 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -283,6 +283,8 @@ function configure_cinder {
 
     iniset $CINDER_CONF DEFAULT os_region_name "$REGION_NAME"
 
+    iniset $CINDER_CONF key_manager api_class cinder.keymgr.conf_key_mgr.ConfKeyManager
+
     if is_service_enabled c-vol && [[ -n "$CINDER_ENABLED_BACKENDS" ]]; then
         local enabled_backends=""
         local default_name=""
diff --git a/lib/nova b/lib/nova
index ca9a6c7f50..d3e8ce85af 100644
--- a/lib/nova
+++ b/lib/nova
@@ -475,6 +475,8 @@ function create_nova_conf {
     iniset $NOVA_CONF DEFAULT metadata_listen "$NOVA_SERVICE_LISTEN_ADDRESS"
     iniset $NOVA_CONF DEFAULT s3_listen "$NOVA_SERVICE_LISTEN_ADDRESS"
 
+    iniset $NOVA_CONF key_manager api_class nova.keymgr.conf_key_mgr.ConfKeyManager
+
     if is_fedora || is_suse; then
         # nova defaults to /usr/local/bin, but fedora and suse pip like to
         # install things in /usr/bin

From 2ccd1203423ea29cc7b8c462aa17e18981d32d60 Mon Sep 17 00:00:00 2001
From: David Lyle <dklyle0@gmail.com>
Date: Mon, 21 Nov 2016 22:16:17 +0000
Subject: [PATCH 0689/2409] Revert "Always set ALLOWED_HOSTS for horizon"

This reverts commit 37f48f3c208de1031ef4589d15194c4079ad4a97.

Change-Id: I8c853c35c5b0b61925c27b461ad625266381f73b
---
 lib/horizon | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/lib/horizon b/lib/horizon
index 50896503a1..78cbe8b58d 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -97,11 +97,6 @@ function configure_horizon {
     _horizon_config_set $local_settings "" OPENSTACK_API_VERSIONS {\"identity\":3}
     _horizon_config_set $local_settings "" OPENSTACK_KEYSTONE_URL "\"${KEYSTONE_SERVICE_URI}/v3\""
 
-    # note(trebskit): if HOST_IP points at non-localhost ip address, horizon cannot be accessed
-    # from outside the virtual machine. This fixes is meant primarily for local development
-    # purpose
-    _horizon_config_set $local_settings "" ALLOWED_HOSTS [\"$HOST_IP\"]
-
     if [ -f $SSL_BUNDLE_FILE ]; then
         _horizon_config_set $local_settings "" OPENSTACK_SSL_CACERT \"${SSL_BUNDLE_FILE}\"
     fi

From b6cbf922d79d7189dab7d68dc6014fa8682aad9d Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Mon, 21 Nov 2016 21:10:49 -0500
Subject: [PATCH 0690/2409] Change CINDER_LVM_TYPE back to 'default' as the
 default

Change dddb2c7b5f85688de9c9b92f025df25d2f2d3016 recently
changed devstack to enable the Cinder image cache by default
and changed to use thinly provisioned LVM volumes by default.

Since then we've had a spike in thin LVM snapshot test failures
in the gate, which is by far our top gate bug at 219 hits in the
last 10 days.

So unless there is a fix on the Cinder side, this changes the
default lvm_type back to 'default' for thick provisioning.

Change-Id: I1c53bbe40177fe104ed0a222124bbc45c553b817
Related-Bug: #1642111
---
 lib/cinder | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index c4a49cd992..9ff74e80be 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -68,8 +68,12 @@ CINDER_SERVICE_PROTOCOL=${CINDER_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 CINDER_SERVICE_LISTEN_ADDRESS=${CINDER_SERVICE_LISTEN_ADDRESS:-$SERVICE_LISTEN_ADDRESS}
 
 # What type of LVM device should Cinder use for LVM backend
-# Defaults to thin. For thick provisioning change to 'default'
-CINDER_LVM_TYPE=${CINDER_LVM_TYPE:-thin}
+# Defaults to default, which is thick, the other valid choice
+# is thin, which as the name implies utilizes lvm thin provisioning.
+# Thinly provisioned LVM volumes may be more efficient when using the Cinder
+# image cache, but there are also known race failures with volume snapshots
+# and thinly provisioned LVM volumes, see bug 1642111 for details.
+CINDER_LVM_TYPE=${CINDER_LVM_TYPE:-default}
 
 # Default backends
 # The backend format is type:name where type is one of the supported backend

From 7f95baa5706980a0910741693abee73abea98b89 Mon Sep 17 00:00:00 2001
From: John Schwarz <jschwarz@redhat.com>
Date: Mon, 21 Nov 2016 15:52:36 +0200
Subject: [PATCH 0691/2409] Fix devstack with linuxbridge without l3 agent

The linuxbridge agent for Neutron expects that the public bridge will
already be created by the time it starts. On devstack, this only occurs
as part of the l3 agent configuration. If a compute node doesn't have an
l3 agent and is using a linuxbridge agent, then br-ex won't be created
and the process will not be able to start (causing stack.sh to fail).

This causes the gate-grenade-dsvm-neutron-linuxbridge-multinode-nv gate
to fail.

Closes-Bug: #1643562
Change-Id: I6f441c6febb5070ad885569d9c798634d0272b6c
---
 lib/neutron_plugins/linuxbridge_agent | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/linuxbridge_agent b/lib/neutron_plugins/linuxbridge_agent
index d0de2f5e5d..194981ee40 100644
--- a/lib/neutron_plugins/linuxbridge_agent
+++ b/lib/neutron_plugins/linuxbridge_agent
@@ -62,7 +62,9 @@ function neutron_plugin_configure_plugin_agent {
         LB_INTERFACE_MAPPINGS=$PHYSICAL_NETWORK:$LB_PHYSICAL_INTERFACE
     fi
     if [[ "$PUBLIC_BRIDGE" != "" ]] && [[ "$PUBLIC_PHYSICAL_NETWORK" != "" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE linux_bridge bridge_mappings "$PUBLIC_PHYSICAL_NETWORK:$PUBLIC_BRIDGE"
+        if is_service_enabled neutron-l3; then
+            iniset /$Q_PLUGIN_CONF_FILE linux_bridge bridge_mappings "$PUBLIC_PHYSICAL_NETWORK:$PUBLIC_BRIDGE"
+        fi
     fi
     if [[ "$LB_INTERFACE_MAPPINGS" != "" ]]; then
         iniset /$Q_PLUGIN_CONF_FILE linux_bridge physical_interface_mappings $LB_INTERFACE_MAPPINGS

From 471855ecd1b36c744162ec7c6c52768e1a1073e2 Mon Sep 17 00:00:00 2001
From: Attila Fazekas <afazekas@redhat.com>
Date: Wed, 23 Nov 2016 12:24:52 +0100
Subject: [PATCH 0692/2409] Add Fedora 25 support

Fedora 25 released,
adding the required knobs.

Change-Id: I8ce86aa9f23e9572d69eadcfc81af2e96d5be64f
---
 files/rpms/general | 4 ++--
 files/rpms/nova    | 2 +-
 files/rpms/swift   | 2 +-
 stack.sh           | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/files/rpms/general b/files/rpms/general
index d0ceb56621..77d2fa5f0a 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -7,9 +7,9 @@ gcc-c++
 gettext  # used for compiling message catalogs
 git-core
 graphviz # needed only for docs
-iptables-services  # NOPRIME f23,f24
+iptables-services  # NOPRIME f23,f24,f25
 java-1.7.0-openjdk-headless  # NOPRIME rhel7
-java-1.8.0-openjdk-headless  # NOPRIME f23,f24
+java-1.8.0-openjdk-headless  # NOPRIME f23,f24,f25
 libffi-devel
 libjpeg-turbo-devel # Pillow 3.0.0
 libxml2-devel # lxml
diff --git a/files/rpms/nova b/files/rpms/nova
index a883ec4399..45f1c94f1f 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -7,7 +7,7 @@ gawk
 genisoimage # required for config_drive
 iptables
 iputils
-kernel-modules # dist:f23,f24
+kernel-modules # dist:f23,f24,f25
 kpartx
 kvm # NOPRIME
 libvirt-bin # NOPRIME
diff --git a/files/rpms/swift b/files/rpms/swift
index bd249ee71b..2f12df0e3b 100644
--- a/files/rpms/swift
+++ b/files/rpms/swift
@@ -2,7 +2,7 @@ curl
 liberasurecode-devel
 memcached
 pyxattr
-rsync-daemon # dist:f23,f24
+rsync-daemon # dist:f23,f24,f25
 sqlite
 xfsprogs
 xinetd
diff --git a/stack.sh b/stack.sh
index f20c9d9ae3..d5dbfb275c 100755
--- a/stack.sh
+++ b/stack.sh
@@ -192,7 +192,7 @@ source $TOP_DIR/stackrc
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (trusty|xenial|yakkety|7.0|wheezy|sid|testing|jessie|f23|f24|rhel7|kvmibm1) ]]; then
+if [[ ! ${DISTRO} =~ (trusty|xenial|yakkety|7.0|wheezy|sid|testing|jessie|f23|f24|f25|rhel7|kvmibm1) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From bcaadd63d8739b528f0121775d6612aebd333a4f Mon Sep 17 00:00:00 2001
From: Attila Fazekas <afazekas@redhat.com>
Date: Wed, 23 Nov 2016 12:43:02 +0100
Subject: [PATCH 0693/2409] Apache reload issue when it is stopped

Since 4b49e409f853104dae021dfca1a9342ec9ac4709 devstack
started to use reload instead of restart.

Using reload in devstack for a fresh install,
does not makes too much sense unless multiple service
plugin touches the same service configs.

Systemd rejects to reload something,
which was not loaded before.

 $ sudo /bin/systemctl reload httpd
 httpd.service is not active, cannot reload.

We will switch to `reload-or-restart` action instead of `reload`,
it is more likely the action what the previous patch wanted.

Change-Id: I70d597fbe4a8923d937ba8432e29edefb27d1058
---
 functions-common | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/functions-common b/functions-common
index d5014fd80a..951010fdad 100644
--- a/functions-common
+++ b/functions-common
@@ -2310,11 +2310,12 @@ function stop_service {
     fi
 }
 
-# Service wrapper to stop services
+# Service wrapper to reload services
+# If the service was not in running state it will start it
 # reload_service service-name
 function reload_service {
     if [ -x /bin/systemctl ]; then
-        sudo /bin/systemctl reload $1
+        sudo /bin/systemctl reload-or-restart $1
     else
         sudo service $1 reload
     fi

From 203716646472135e81bc7e8984bb200d87c0bf1c Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Wed, 23 Nov 2016 15:51:10 +0100
Subject: [PATCH 0694/2409] stackrc: update code comment now that Neutron is
 enabled by default

No need to explain how to enable Neutron now that it's enabled by
default. Keep but reformat the 'how to enable swift' part though.

Change-Id: I3f9b7796fad10abf1039e4c68eb2cd5ef6cdbc99
---
 stackrc | 14 ++------------
 1 file changed, 2 insertions(+), 12 deletions(-)

diff --git a/stackrc b/stackrc
index 31f07594ad..b5018dea0f 100644
--- a/stackrc
+++ b/stackrc
@@ -44,20 +44,10 @@ KEYSTONE_REGION_NAME=${KEYSTONE_REGION_NAME:-$REGION_NAME}
 # Specify which services to launch.  These generally correspond to
 # screen tabs. To change the default list, use the ``enable_service`` and
 # ``disable_service`` functions in ``local.conf``.
-# For example, to enable Swift add this to ``local.conf``:
-#  enable_service s-proxy s-object s-container s-account
-# In order to enable Neutron (a single node setup) add the following
+# For example, to enable Swift as part of DevStack add the following
 # settings in ``local.conf``:
 #  [[local|localrc]]
-#  disable_service n-net
-#  enable_service q-svc
-#  enable_service q-agt
-#  enable_service q-dhcp
-#  enable_service q-l3
-#  enable_service q-meta
-#  # Optional, to enable tempest configuration as part of DevStack
-#  enable_service tempest
-
+#  enable_service s-proxy s-object s-container s-account
 # This allows us to pass ``ENABLED_SERVICES``
 if ! isset ENABLED_SERVICES ; then
     # Keystone - nothing works without keystone

From 5c4691af3e9cf9d0fe9a2afa2bbe1fc73796610d Mon Sep 17 00:00:00 2001
From: Dan Kolb <openstack@dankolb.net>
Date: Wed, 16 Nov 2016 13:47:49 -0600
Subject: [PATCH 0695/2409] remove listen directive bound to only ipv4

Using devstack on a  RHEL based system results in
"Listen 0.0.0.0:80" being added to the
/etc/httpd/conf/httpd.conf.
This configures Apache to only listen to port 80 on an IPv4 interface.
This makes it not possible to access Horizon via IPv6 without
re-configuring and restarting httpd.

Removing this sed leaves the default "Listen 80" from the rpm package,
 which binds to all interfaces and will allow connection to Horizon
via IPv6.

Change-Id: I9fe8cbebff0ca6a30ceeaae0f7e035c9bb828d44
---
 lib/horizon | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/lib/horizon b/lib/horizon
index 78cbe8b58d..3271e2a654 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -121,9 +121,7 @@ function configure_horizon {
     if is_ubuntu; then
         disable_apache_site 000-default
         sudo touch $horizon_conf
-    elif is_fedora; then
-        sudo sed '/^Listen/s/^.*$/Listen 0.0.0.0:80/' -i /etc/httpd/conf/httpd.conf
-    elif is_suse; then
+    elif is_fedora || is_suse; then
         : # nothing to do
     else
         exit_distro_not_supported "horizon apache configuration"

From 868a6631721219bac4042eca88e290c278589e26 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tomasz=20Tr=C4=99bski?= <tomasz.trebski@ts.fujitsu.com>
Date: Mon, 14 Nov 2016 09:10:57 +0100
Subject: [PATCH 0696/2409] Always set ALLOWED_HOSTS=['*'] for horizon

If devstack is deployed in the VM with defined
public IP address (like 192.168.10.6) it is not possible to
access the Horizon from the browser.
This is because DEBUG=True means that ALLOWED_HOSTS, if not set,
is equal to ['localhost', '127.0.0.1', '[::1]'] according
to Django's documentation.

Change-Id: I0ab2b57e459dbfa3b01b3e9388bbcefac076a142
Co-Authored-By: David Lyle <dklyle0@gmail.com>
Closes-Bug: #1643050
---
 lib/horizon | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/lib/horizon b/lib/horizon
index 78cbe8b58d..f5e9c7e0a7 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -97,6 +97,11 @@ function configure_horizon {
     _horizon_config_set $local_settings "" OPENSTACK_API_VERSIONS {\"identity\":3}
     _horizon_config_set $local_settings "" OPENSTACK_KEYSTONE_URL "\"${KEYSTONE_SERVICE_URI}/v3\""
 
+    # note(trebskit): if HOST_IP points at non-localhost ip address, horizon cannot be accessed
+    # from outside the virtual machine. This fixes is meant primarily for local development
+    # purpose
+    _horizon_config_set $local_settings "" ALLOWED_HOSTS [\"*\"]
+
     if [ -f $SSL_BUNDLE_FILE ]; then
         _horizon_config_set $local_settings "" OPENSTACK_SSL_CACERT \"${SSL_BUNDLE_FILE}\"
     fi

From 0dab8d63b3e5431bd5edb562f466296478285251 Mon Sep 17 00:00:00 2001
From: Peter Stachowski <peter@tesora.com>
Date: Mon, 21 Nov 2016 20:36:31 +0000
Subject: [PATCH 0697/2409] (doc) Fixed references to FIXED_RANGE_V6

In the 'Private Network Addressing' section of the doc,
there are references to FIXED_RANGE when referring to V6
networks.  These have been changed to FIXED_RANGE_V6.

Also fixed a few typos and grammatical errors when
giving the doc a quick read-through looking for more
references to FIXED_RANGE.

Change-Id: Iaa530c476ce2b36a3f616945ddd2e24fa599a16c
---
 doc/source/networking.rst | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/doc/source/networking.rst b/doc/source/networking.rst
index 2301a2e931..bdbeaaa7a8 100644
--- a/doc/source/networking.rst
+++ b/doc/source/networking.rst
@@ -4,7 +4,7 @@
 
 An important part of the DevStack experience is networking that works
 by default for created guests. This might not be optimal for your
-particular testing environment, so this document tries it's best to
+particular testing environment, so this document tries its best to
 explain what's going on.
 
 Defaults
@@ -17,9 +17,9 @@ If you don't specify any configuration you will get the following:
 * a floating ip range of 172.24.4.0/24 with the gateway of 172.24.4.1
 * the demo project configured with fixed ips on a subnet allocated from
   the 10.0.0.0/22 range
-* a ``br-ex`` interface controlled by neutron for all it's networking
+* a ``br-ex`` interface controlled by neutron for all its networking
   (this is not connected to any physical interfaces).
-* DNS resolution for guests based on the resolv.conf for you host
+* DNS resolution for guests based on the resolv.conf for your host
 * an ip masq rule that allows created guests to route out
 
 This creates an environment which is isolated to the single
@@ -40,7 +40,7 @@ updates. Tempest tests will work in this environment.
 Locally Accessible Guests
 =========================
 
-If you want to make you guests accessible other machines on your
+If you want to make you guests accessible from other machines on your
 network, we have to connect ``br-ex`` to a physical interface.
 
 Dedicated Guest Interface
@@ -109,8 +109,8 @@ not subnetpools are in use.
 For IPv4, ``FIXED_RANGE`` and ``SUBNETPOOL_PREFIX_V4`` will just default to
 the value of ``IPV4_ADDRS_SAFE_TO_USE`` directly.
 
-For IPv6, ``FIXED_RANGE`` will default to the first /64 of the value of
+For IPv6, ``FIXED_RANGE_V6`` will default to the first /64 of the value of
 ``IPV6_ADDRS_SAFE_TO_USE``. If ``IPV6_ADDRS_SAFE_TO_USE`` is /64 or smaller,
-``FIXED_RANGE`` will just use the value of that directly.
+``FIXED_RANGE_V6`` will just use the value of that directly.
 ``SUBNETPOOL_PREFIX_V6`` will just default to the value of
 ``IPV6_ADDRS_SAFE_TO_USE`` directly.

From f0252a9d8147cfbeaedbae4d6c2a8be0e97e72b0 Mon Sep 17 00:00:00 2001
From: Rob Cresswell <robert.cresswell@outlook.com>
Date: Fri, 25 Nov 2016 11:29:31 +0000
Subject: [PATCH 0698/2409] Remove Horizon setup scripts usage of run_tests.sh

Horizon is removing run_tests in favour of tox during Ocata, as part of
https://blueprints.launchpad.net/horizon/+spec/enhance-tox. To complete
this move, we need to remove any reliance on run_tests.

Change-Id: Ia8ad073aee68d1660d3bb5a68ec07516d8ce0665
---
 lib/horizon | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/horizon b/lib/horizon
index 78cbe8b58d..08d6259526 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -81,7 +81,7 @@ function configure_horizon {
     # Horizon is installed as develop mode, so we can compile here.
     # Message catalog compilation is handled by Django admin script,
     # so compiling them after the installation avoids Django installation twice.
-    (cd $HORIZON_DIR; ./run_tests.sh -N --compilemessages)
+    (cd $HORIZON_DIR; python manage.py compilemessages)
 
     # ``local_settings.py`` is used to override horizon default settings.
     local local_settings=$HORIZON_DIR/openstack_dashboard/local/local_settings.py

From 02f3f9a6bbb6c4af989ad6cf504d5c49d7c9b4e2 Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@midokura.com>
Date: Sat, 26 Nov 2016 00:43:07 +0900
Subject: [PATCH 0699/2409] meta-config: Fix consecutive same sections

The current coding fails to process local.conf like
the following.  Note: This example is taken from a
real use case. [1]

    [[post-config|$NEUTRON_CONF]]
    [qos]
    notification_drivers = midonet
    [[post-config|$NEUTRON_CONF]]

    [quotas]
    # x10 of default quotas (at the time of writing)
    quota_network=100
    quota_subnet=100
    quota_port=500
    quota_router=100
    quota_floatingip=500
    quota_security_group=100
    quota_security_group_rule=1000

[1] https://review.openstack.org/#/c/400627/

Closes-Bug: #1583214
Change-Id: Ie571b5fa5a33d9ed09f30ba7c7724b958ce17616
---
 inc/meta-config           | 10 ++++------
 tests/test_meta_config.sh | 29 ++++++++++++++++++++++++++++-
 2 files changed, 32 insertions(+), 7 deletions(-)

diff --git a/inc/meta-config b/inc/meta-config
index 6eb7a00f69..6252135747 100644
--- a/inc/meta-config
+++ b/inc/meta-config
@@ -40,12 +40,10 @@ function get_meta_section {
     $CONFIG_AWK_CMD -v matchgroup=$matchgroup -v configfile=$configfile '
         BEGIN { group = "" }
         /^\[\[.+\|.*\]\]/ {
-            if (group == "") {
-                gsub("[][]", "", $1);
-                split($1, a, "|");
-                if (a[1] == matchgroup && a[2] == configfile) {
-                    group=a[1]
-                }
+            gsub("[][]", "", $1);
+            split($1, a, "|");
+            if (a[1] == matchgroup && a[2] == configfile) {
+                group=a[1]
             } else {
                 group=""
             }
diff --git a/tests/test_meta_config.sh b/tests/test_meta_config.sh
index 327fb56185..92f9c01f69 100755
--- a/tests/test_meta_config.sh
+++ b/tests/test_meta_config.sh
@@ -125,6 +125,14 @@ foo=bar
 [[test10|does-not-exist-dir/test.conf]]
 foo=bar
 
+[[test11|test-same.conf]]
+[DEFAULT]
+foo=bar
+
+[[test11|test-same.conf]]
+[some]
+random=config
+
 [[test-multi-sections|test-multi-sections.conf]]
 [sec-1]
 cfg_item1 = abcd
@@ -147,6 +155,9 @@ cfg_item1 = abcd
 cfg_item2 = efgh
 cfg_item2 = \${FOO_BAR_BAZ}
 
+[[test11|test-same.conf]]
+[another]
+non = sense
 EOF
 
 echo -n "get_meta_section_files: test0 doesn't exist: "
@@ -385,8 +396,24 @@ EXPECT_VAL=255
 check_result "$VAL" "$EXPECT_VAL"
 set -e
 
+echo -n "merge_config_file test11 same section: "
+rm -f test-same.conf
+merge_config_group test.conf test11
+VAL=$(cat test-same.conf)
+EXPECT_VAL='
+[DEFAULT]
+foo = bar
+
+[some]
+random = config
+
+[another]
+non = sense'
+check_result "$VAL" "$EXPECT_VAL"
+
+
 rm -f test.conf test1c.conf test2a.conf \
     test-space.conf test-equals.conf test-strip.conf \
     test-colon.conf test-env.conf test-multiline.conf \
-    test-multi-sections.conf
+    test-multi-sections.conf test-same.conf
 rm -rf test-etc

From d9ec42028df9ad12aa7760e21c664d6927790d9e Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@midokura.com>
Date: Thu, 21 Jul 2016 16:14:52 +0900
Subject: [PATCH 0700/2409] lib/neutron: Add a utility method to add service
 plugin

Partial-Bug: #1604664
Change-Id: I6d49ac188f7f1cfc8da314a26c9c5fc4b6d65bf4
---
 lib/neutron | 29 +++++++++++++++++++++--------
 1 file changed, 21 insertions(+), 8 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 1bb14f21b2..d30e18562f 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -200,7 +200,7 @@ function configure_neutron_new {
     if is_service_enabled neutron-l3; then
         cp $NEUTRON_DIR/etc/l3_agent.ini.sample $NEUTRON_L3_CONF
         iniset $NEUTRON_L3_CONF DEFAULT interface_driver $NEUTRON_AGENT
-        iniset $NEUTRON_CONF DEFAULT service_plugins router
+        neutron_service_plugin_class_add router
         iniset $NEUTRON_L3_CONF agent root_helper_daemon "$NEUTRON_ROOTWRAP_DAEMON_CMD"
         iniset $NEUTRON_L3_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
         neutron_plugin_configure_l3_agent $NEUTRON_L3_CONF
@@ -249,14 +249,8 @@ function configure_neutron_new {
         source $TOP_DIR/lib/neutron_plugins/services/metering
         neutron_agent_metering_configure_common
         neutron_agent_metering_configure_agent
-        # TODO(sc68cal) hack because we don't pass around
-        # $Q_SERVICE_PLUGIN_CLASSES like -legacy does
-        local plugins=""
-        plugins=$(iniget $NEUTRON_CONF DEFAULT service_plugins)
-        plugins+=",metering"
-        iniset $NEUTRON_CONF DEFAULT service_plugins $plugins
+        neutron_service_plugin_class_add metering
     fi
-
 }
 
 # configure_neutron_rootwrap() - configure Neutron's rootwrap
@@ -496,6 +490,16 @@ function _set_config_files {
 
 }
 
+# neutron_service_plugin_class_add() - add service plugin class
+function neutron_service_plugin_class_add_new {
+    local service_plugin_class=$1
+    local plugins=""
+
+    plugins=$(iniget $NEUTRON_CONF DEFAULT service_plugins)
+    plugins+=",${service_plugin_class}"
+    iniset $NEUTRON_CONF DEFAULT service_plugins $plugins
+}
+
 # Dispatch functions
 # These are needed for compatibility between the old and new implementations
 # where there are function name overlaps.  These will be removed when
@@ -555,6 +559,15 @@ function install_neutron {
     fi
 }
 
+function neutron_service_plugin_class_add {
+    if is_neutron_legacy_enabled; then
+        # Call back to old function
+        _neutron_service_plugin_class_add "$@"
+    else
+        neutron_service_plugin_class_add_new "$@"
+    fi
+}
+
 function start_neutron {
     if is_neutron_legacy_enabled; then
         # Call back to old function

From 89a855f784644f2c4d88331a0d29f85e5fcd741c Mon Sep 17 00:00:00 2001
From: Sharat Sharma <sharat.sharma@nectechnologies.in>
Date: Mon, 3 Oct 2016 12:10:23 +0530
Subject: [PATCH 0701/2409] Changed the order of steps in the devstack install
 document

The order of the steps were a bit confusing for the first timers
in the devstack document. So, changed the order of installation
steps to make it clear.

Change-Id: Ifaa051887dab95719b9ca5d1b2fbe2f5f549d269
Closes-Bug: #1627939
---
 doc/source/index.rst | 43 ++++++++++++++++++++++++++-----------------
 1 file changed, 26 insertions(+), 17 deletions(-)

diff --git a/doc/source/index.rst b/doc/source/index.rst
index 435011bb96..b8dd506aab 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -45,12 +45,34 @@ as well as Debian and OpenSUSE.
 If you do not have a preference, Ubuntu 16.04 is the most tested, and
 will probably go the smoothest.
 
+Add Stack User
+--------------
+
+Devstack should be run as a non-root user with sudo enabled
+(standard logins to cloud images such as "ubuntu" or "cloud-user"
+are usually fine).
+
+You can quickly create a separate `stack` user to run DevStack with
+
+::
+
+   $ adduser stack
+
+Since this user will be making many changes to your system, it should
+have sudo privileges:
+
+::
+
+    $ echo "stack ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers
+    $ su stack
+
 Download DevStack
 -----------------
 
 ::
 
-   git clone https://git.openstack.org/openstack-dev/devstack
+   $ git clone https://git.openstack.org/openstack-dev/devstack
+   $ cd devstack
 
 The ``devstack`` repo contains a script that installs OpenStack and
 templates for configuration files
@@ -58,8 +80,8 @@ templates for configuration files
 Create a local.conf
 -------------------
 
-Create a ``local.conf`` file with 4 passwords preset
-
+Create a ``local.conf`` file with 4 passwords preset at the root of the
+devstack git repo.
 ::
 
    [[local|localrc]]
@@ -70,25 +92,12 @@ Create a ``local.conf`` file with 4 passwords preset
 
 This is the minimum required config to get started with DevStack.
 
-Add Stack User
---------------
-
-Devstack should be run as a non-root user with sudo enabled
-(standard logins to cloud images such as "ubuntu" or "cloud-user"
-are usually fine).
-
-You can quickly create a separate `stack` user to run DevStack with
-
-::
-
-   devstack/tools/create-stack-user.sh; su stack
-
 Start the install
 -----------------
 
 ::
 
-   cd devstack; ./stack.sh
+   ./stack.sh
 
 This will take a 15 - 20 minutes, largely depending on the speed of
 your internet connection. Many git trees and packages will be

From 2a5981402ff26973c77ccf534164e4318dd8897a Mon Sep 17 00:00:00 2001
From: Gary Kotton <gkotton@vmware.com>
Date: Tue, 29 Nov 2016 03:48:34 -0800
Subject: [PATCH 0702/2409] Provide configuration file to ovs-cleanup utility

There may be cases when the configuration of the OVS is different
from the default one. This enables one to make use of the neutron
configuration file to contain all of the OVS settings.

Change-Id: I728cf8cdc653667c076b07b39c13c1278281c01b
Closes-bug: #1645691
---
 lib/neutron_plugins/ovs_base | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/neutron_plugins/ovs_base b/lib/neutron_plugins/ovs_base
index baf7d7f34b..10043252d6 100644
--- a/lib/neutron_plugins/ovs_base
+++ b/lib/neutron_plugins/ovs_base
@@ -30,7 +30,7 @@ function _neutron_ovs_base_add_bridge {
 
 function _neutron_ovs_base_setup_bridge {
     local bridge=$1
-    neutron-ovs-cleanup
+    neutron-ovs-cleanup --config-file $NEUTRON_CONF
     _neutron_ovs_base_add_bridge $bridge
     sudo ovs-vsctl --no-wait br-set-external-id $bridge bridge-id $bridge
 }
@@ -97,7 +97,7 @@ function _neutron_ovs_base_configure_l3_agent {
         iniset $Q_L3_CONF_FILE DEFAULT external_network_bridge $PUBLIC_BRIDGE
     fi
 
-    neutron-ovs-cleanup
+    neutron-ovs-cleanup --config-file $NEUTRON_CONF
     if [[ "$Q_USE_PUBLIC_VETH" = "True" ]]; then
         ip link show $Q_PUBLIC_VETH_INT > /dev/null 2>&1 ||
         sudo ip link add $Q_PUBLIC_VETH_INT type veth \

From cfb9f057ea5896687d95cdcc5aa5216ef32b87f8 Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Tue, 29 Nov 2016 10:43:05 -0800
Subject: [PATCH 0703/2409] Tune apache connections for tls proxy

We are seeing connection errors to the proxy occasionally. These errors
do not result in a logged http request or error to the backends,
resulting in a theory that the proxy itself may just not be able to
handle the number of connections. More than double the total number of
connections that will be accepted by the proxy in an attempt to fix
this.

Change-Id: Iefa6c43451dd1f95927528d2ce0003c84248847f
Related-bug: 1630664
---
 lib/apache |  5 +++++
 lib/tls    | 48 ++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 53 insertions(+)

diff --git a/lib/apache b/lib/apache
index 8a38cc45e5..2dc626f130 100644
--- a/lib/apache
+++ b/lib/apache
@@ -29,15 +29,20 @@ APACHE_GROUP=${APACHE_GROUP:-$(id -gn $APACHE_USER)}
 
 
 # Set up apache name and configuration directory
+# Note that APACHE_CONF_DIR is really more accurately apache's vhost
+# configuration dir but we can't just change this because public interfaces.
 if is_ubuntu; then
     APACHE_NAME=apache2
     APACHE_CONF_DIR=${APACHE_CONF_DIR:-/etc/$APACHE_NAME/sites-available}
+    APACHE_SETTINGS_DIR=${APACHE_SETTINGS_DIR:-/etc/$APACHE_NAME/conf-enabled}
 elif is_fedora; then
     APACHE_NAME=httpd
     APACHE_CONF_DIR=${APACHE_CONF_DIR:-/etc/$APACHE_NAME/conf.d}
+    APACHE_SETTINGS_DIR=${APACHE_SETTINGS_DIR:-/etc/$APACHE_NAME/conf.d}
 elif is_suse; then
     APACHE_NAME=apache2
     APACHE_CONF_DIR=${APACHE_CONF_DIR:-/etc/$APACHE_NAME/vhosts.d}
+    APACHE_SETTINGS_DIR=${APACHE_SETTINGS_DIR:-/etc/$APACHE_NAME/conf.d}
 fi
 APACHE_LOG_DIR="/var/log/${APACHE_NAME}"
 
diff --git a/lib/tls b/lib/tls
index 14cdf19d8e..57b5e525ac 100644
--- a/lib/tls
+++ b/lib/tls
@@ -442,6 +442,52 @@ function enable_mod_ssl {
 # Proxy Functions
 # ===============
 
+function tune_apache_connections {
+    local tuning_file=$APACHE_SETTINGS_DIR/connection-tuning.conf
+    if ! [ -f $tuning_file ] ; then
+        sudo bash -c "cat > $tuning_file" << EOF
+# worker MPM
+# StartServers: initial number of server processes to start
+# MinSpareThreads: minimum number of worker threads which are kept spare
+# MaxSpareThreads: maximum number of worker threads which are kept spare
+# ThreadLimit: ThreadsPerChild can be changed to this maximum value during a
+#              graceful restart. ThreadLimit can only be changed by stopping
+#              and starting Apache.
+# ThreadsPerChild: constant number of worker threads in each server process
+# MaxClients: maximum number of simultaneous client connections
+# MaxRequestsPerChild: maximum number of requests a server process serves
+#
+# The apache defaults are too conservative if we want reliable tempest
+# testing. Bump these values up from ~400 max clients to 1024 max clients.
+<IfModule mpm_worker_module>
+# Note that the next three conf values must be changed together.
+# MaxClients = ServerLimit * ThreadsPerChild
+ServerLimit          32
+ThreadsPerChild      32
+MaxClients         1024
+StartServers          3
+MinSpareThreads      96
+MaxSpareThreads     192
+ThreadLimit          64
+MaxRequestsPerChild   0
+</IfModule>
+<IfModule mpm_event_module>
+# Note that the next three conf values must be changed together.
+# MaxClients = ServerLimit * ThreadsPerChild
+ServerLimit          32
+ThreadsPerChild      32
+MaxClients         1024
+StartServers          3
+MinSpareThreads      96
+MaxSpareThreads     192
+ThreadLimit          64
+MaxRequestsPerChild   0
+</IfModule>
+EOF
+        restart_apache_server
+    fi
+}
+
 # Starts the TLS proxy for the given IP/ports
 # start_tls_proxy front-host front-port back-host back-port
 function start_tls_proxy {
@@ -451,6 +497,8 @@ function start_tls_proxy {
     local b_host=$4
     local b_port=$5
 
+    tune_apache_connections
+
     local config_file
     config_file=$(apache_site_config_for $b_service)
     local listen_string

From 6653d74fc4cbff1b06888fe53a0712117e2394dc Mon Sep 17 00:00:00 2001
From: Armando Migliaccio <armamig@gmail.com>
Date: Tue, 29 Nov 2016 23:30:18 +0000
Subject: [PATCH 0704/2409] Revert "Fix devstack with linuxbridge without l3
 agent"

I am seeing red all over the linuxbridge gate.

This reverts commit 7f95baa5706980a0910741693abee73abea98b89.

Change-Id: I179f761f991db4b63c0e3445a9a13e43ffe68992
---
 lib/neutron_plugins/linuxbridge_agent | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/lib/neutron_plugins/linuxbridge_agent b/lib/neutron_plugins/linuxbridge_agent
index 194981ee40..d0de2f5e5d 100644
--- a/lib/neutron_plugins/linuxbridge_agent
+++ b/lib/neutron_plugins/linuxbridge_agent
@@ -62,9 +62,7 @@ function neutron_plugin_configure_plugin_agent {
         LB_INTERFACE_MAPPINGS=$PHYSICAL_NETWORK:$LB_PHYSICAL_INTERFACE
     fi
     if [[ "$PUBLIC_BRIDGE" != "" ]] && [[ "$PUBLIC_PHYSICAL_NETWORK" != "" ]]; then
-        if is_service_enabled neutron-l3; then
-            iniset /$Q_PLUGIN_CONF_FILE linux_bridge bridge_mappings "$PUBLIC_PHYSICAL_NETWORK:$PUBLIC_BRIDGE"
-        fi
+        iniset /$Q_PLUGIN_CONF_FILE linux_bridge bridge_mappings "$PUBLIC_PHYSICAL_NETWORK:$PUBLIC_BRIDGE"
     fi
     if [[ "$LB_INTERFACE_MAPPINGS" != "" ]]; then
         iniset /$Q_PLUGIN_CONF_FILE linux_bridge physical_interface_mappings $LB_INTERFACE_MAPPINGS

From 2864150940bfb003e86bf103cb18b32bdb4a080b Mon Sep 17 00:00:00 2001
From: Huan Xie <huan.xie@citrix.com>
Date: Tue, 20 Sep 2016 06:49:50 +0000
Subject: [PATCH 0705/2409] Make neutron ml2 use ovs native interface

Neutron has changed to use ovs native interface by default, but when
the hypervisor is XenServer, we cannot use ovs native interface without
extra configurations in neutron-openvswitch-agent(q-agt) in compute
node.

This patch is to add the needed configurations automatically during
deployment, so user needn't to do it manually and restart q-agt.

Change-Id: Ibc69d3cdb4d75833f2ac16840c62bcacf460dd4f
---
 lib/neutron_plugins/openvswitch_agent | 5 +++++
 lib/nova_plugins/hypervisor-xenserver | 9 +++++++++
 2 files changed, 14 insertions(+)

diff --git a/lib/neutron_plugins/openvswitch_agent b/lib/neutron_plugins/openvswitch_agent
index e27b8a634a..8860d7b0f2 100644
--- a/lib/neutron_plugins/openvswitch_agent
+++ b/lib/neutron_plugins/openvswitch_agent
@@ -95,6 +95,11 @@ function neutron_plugin_configure_plugin_agent {
         # XEN_INTEGRATION_BRIDGE is the integration bridge in dom0
         iniset /$Q_PLUGIN_CONF_FILE ovs integration_bridge $XEN_INTEGRATION_BRIDGE
 
+        # Set OVS native interface for ovs-agent in compute node
+        XEN_DOM0_IP=$(echo "$XENAPI_CONNECTION_URL" | cut -d "/" -f 3)
+        iniset /$Q_PLUGIN_CONF_FILE ovs ovsdb_connection tcp:$XEN_DOM0_IP:6640
+        iniset /$Q_PLUGIN_CONF_FILE ovs of_listen_address $HOST_IP
+
         # Set up domU's L2 agent:
 
         # Create a bridge "br-$VLAN_INTERFACE"
diff --git a/lib/nova_plugins/hypervisor-xenserver b/lib/nova_plugins/hypervisor-xenserver
index a63e72e764..b053856348 100644
--- a/lib/nova_plugins/hypervisor-xenserver
+++ b/lib/nova_plugins/hypervisor-xenserver
@@ -93,6 +93,15 @@ CRONTAB
     if is_service_enabled neutron; then
         # Remove restriction on linux bridge in Dom0 when neutron is enabled
         $ssh_dom0 "rm -f /etc/modprobe.d/blacklist-bridge*"
+
+        count=`$ssh_dom0 "iptables -t filter -L XenServerDevstack |wc -l"`
+        if [ "$count" = "0" ]; then
+        {
+            echo "iptables -t filter --new XenServerDevstack"
+            echo "iptables -t filter -I INPUT -j XenServerDevstack"
+            echo "iptables -t filter -I XenServerDevstack -p tcp --dport 6640 -j ACCEPT"
+        } | $ssh_dom0
+        fi
     fi
 }
 

From 50bf4fc0758df3dfb0bf9fa6e5f56ecebd1200e4 Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Wed, 30 Nov 2016 14:27:36 -0500
Subject: [PATCH 0706/2409] lib/neutron-legacy - Use stevedore alias for ML2
 plugin

Similar to 30ab23cd9b103470a7d89c4c88bccba789884c36, fix the
plugin name to avoid warnings like:

WARNING stevedore.named [-] Could not load neutron.plugins.ml2.plugin.Ml2Plugin

Change-Id: Ibb45f1305816b255ba2419ba662d9e29eff68f58
---
 lib/neutron_plugins/ml2 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/ml2 b/lib/neutron_plugins/ml2
index e429714f06..eed0fc2da4 100644
--- a/lib/neutron_plugins/ml2
+++ b/lib/neutron_plugins/ml2
@@ -63,7 +63,7 @@ function populate_ml2_config {
 function neutron_plugin_configure_common {
     Q_PLUGIN_CONF_PATH=etc/neutron/plugins/ml2
     Q_PLUGIN_CONF_FILENAME=ml2_conf.ini
-    Q_PLUGIN_CLASS="neutron.plugins.ml2.plugin.Ml2Plugin"
+    Q_PLUGIN_CLASS="ml2"
     # The ML2 plugin delegates L3 routing/NAT functionality to
     # the L3 service plugin which must therefore be specified.
     _neutron_service_plugin_class_add $ML2_L3_PLUGIN

From df875c5f16980228e2443c50298f35063f2b54ae Mon Sep 17 00:00:00 2001
From: Huan Xie <huan.xie@citrix.com>
Date: Wed, 30 Nov 2016 19:47:24 -0800
Subject: [PATCH 0707/2409] Reconfig ml2 ovs configuration for neutron on
 XenServer

XenServer already support OVS native mode and I have a patch for
configuring it https://review.openstack.org/#/c/372952/ which
is fine. But we have another patch which revert the usage of
ml2_confi.ini and ml2_conf.ini.domU
https://review.openstack.org/#/c/396573/. Both patches work well
separately. But the two should have some dependent relationship.
Once one merged, the other should change accordingly. Sorry that
we missed the dependency.
This patch is to fix the ovs config based on reverted ml2_conf.ini
and ml2_conf.ini.domU to make sure we configure the correct IP for
ovs agent

Change-Id: Ib53e37e210cc849f161dd6630f81e5b2331a91d5
---
 lib/neutron_plugins/openvswitch_agent | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/neutron_plugins/openvswitch_agent b/lib/neutron_plugins/openvswitch_agent
index f009966a01..76a1a4f3a1 100644
--- a/lib/neutron_plugins/openvswitch_agent
+++ b/lib/neutron_plugins/openvswitch_agent
@@ -97,8 +97,8 @@ function neutron_plugin_configure_plugin_agent {
 
         # Set OVS native interface for ovs-agent in compute node
         XEN_DOM0_IP=$(echo "$XENAPI_CONNECTION_URL" | cut -d "/" -f 3)
-        iniset /$Q_PLUGIN_CONF_FILE ovs ovsdb_connection tcp:$XEN_DOM0_IP:6640
-        iniset /$Q_PLUGIN_CONF_FILE ovs of_listen_address $HOST_IP
+        iniset /$Q_PLUGIN_CONF_FILE.domU ovs ovsdb_connection tcp:$XEN_DOM0_IP:6640
+        iniset /$Q_PLUGIN_CONF_FILE.domU ovs of_listen_address $HOST_IP
 
         # Set up domU's L2 agent:
 

From 1d83a08a385ad079c546d8a0ac9558dc72eaa9fd Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Wed, 30 Nov 2016 14:22:24 -0500
Subject: [PATCH 0708/2409] lib/neutron: Remove type_driver configuration

Instead, rely on what Neutron ships by default.

Change-Id: I8bdc646d24b3edf10f421e4472a790caeb8e4887
---
 lib/neutron | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/neutron b/lib/neutron
index d30e18562f..4915dcce31 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -159,7 +159,6 @@ function configure_neutron_new {
         # Configure VXLAN
         # TODO(sc68cal) not hardcode?
         iniset $NEUTRON_CORE_PLUGIN_CONF ml2 tenant_network_types vxlan
-        iniset $NEUTRON_CORE_PLUGIN_CONF ml2 type_drivers vxlan
         iniset $NEUTRON_CORE_PLUGIN_CONF ml2 mechanism_drivers openvswitch,linuxbridge
         iniset $NEUTRON_CORE_PLUGIN_CONF ml2_type_vxlan vni_ranges 1001:2000
         if [[ "$NEUTRON_PORT_SECURITY" = "True" ]]; then

From 50ce0a8032bf315df20c594df1dd3d0822168b4d Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <ghanshyammann@gmail.com>
Date: Thu, 1 Dec 2016 08:45:43 +0000
Subject: [PATCH 0709/2409] Revert "Set cinder coordination backend url"

gate-tempest-dsvm-layer4 job is failing due to this change as no module found on zake[1]. Heat not able to create cinder stack.
This is blocking tempest now so we will revert revert this once find the real cause.

This reverts commit a283526c88d98f7668d369f4c20db44d3d06425a.

..1 http://logs.openstack.org/64/405064/2/check/gate-tempest-dsvm-layer4/feb21fe/logs/screen-c-vol.txt.gz#_2016-12-01_05_43_40_369

Change-Id: I50981db7760688a25a2bf4de9a41153ede76f4aa
---
 lib/cinder | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 4ed944cfcb..0fe950b6c2 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -358,13 +358,6 @@ function configure_cinder {
     iniset $CINDER_CONF DEFAULT os_privileged_user_password "$SERVICE_PASSWORD"
     iniset $CINDER_CONF DEFAULT os_privileged_user_tenant "$SERVICE_PROJECT_NAME"
     iniset $CINDER_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
-
-    # Set the backend url according to the configured dlm backend
-    if is_dlm_enabled; then
-        if [[ "$(dlm_backend)" == "zookeeper" ]]; then
-            iniset $CINDER_CONF coordination backend_url "zake://"
-        fi
-    fi
 }
 
 # create_cinder_accounts() - Set up common required cinder accounts

From c74315e055a770ef3508276442816fffde07cfc6 Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@midokura.com>
Date: Thu, 21 Jul 2016 17:49:43 +0900
Subject: [PATCH 0710/2409] Load neutron-legacy only if enabled

To avoid using legacy functions accidentially.

Depends-On: Ida1f83b6b3ef9b76be13c063c7e35a8703214078
Change-Id: I3ff136fc8330c92007cdfe91b77d7f9865eabd8d
---
 lib/neutron        | 13 +++++++++++++
 lib/neutron-legacy |  2 +-
 stack.sh           |  1 -
 unstack.sh         |  1 -
 4 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index d30e18562f..852787db36 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -90,6 +90,10 @@ function is_neutron_legacy_enabled {
     return 1
 }
 
+if is_neutron_legacy_enabled; then
+    source $TOP_DIR/lib/neutron-legacy
+fi
+
 # cleanup_neutron() - Remove residual data files, anything left over from previous
 # runs that a clean run would need to clean up
 function cleanup_neutron_new {
@@ -568,6 +572,15 @@ function neutron_service_plugin_class_add {
     fi
 }
 
+function install_neutron_agent_packages {
+    if is_neutron_legacy_enabled; then
+        # Call back to old function
+        install_neutron_agent_packages_mutnauq "$@"
+    else
+        :
+    fi
+}
+
 function start_neutron {
     if is_neutron_legacy_enabled; then
         # Call back to old function
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 0b0caf18b5..37d278344e 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -423,7 +423,7 @@ function install_mutnauq {
 }
 
 # install_neutron_agent_packages() - Collect source and prepare
-function install_neutron_agent_packages {
+function install_neutron_agent_packages_mutnauq {
     # radvd doesn't come with the OS. Install it if the l3 service is enabled.
     if is_service_enabled q-l3; then
         install_package radvd
diff --git a/stack.sh b/stack.sh
index 74edb10afc..17cc248a59 100755
--- a/stack.sh
+++ b/stack.sh
@@ -574,7 +574,6 @@ source $TOP_DIR/lib/cinder
 source $TOP_DIR/lib/swift
 source $TOP_DIR/lib/heat
 source $TOP_DIR/lib/neutron
-source $TOP_DIR/lib/neutron-legacy
 source $TOP_DIR/lib/ldap
 source $TOP_DIR/lib/dstat
 source $TOP_DIR/lib/dlm
diff --git a/unstack.sh b/unstack.sh
index c05d1f0952..fe2bb8bfea 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -68,7 +68,6 @@ source $TOP_DIR/lib/cinder
 source $TOP_DIR/lib/swift
 source $TOP_DIR/lib/heat
 source $TOP_DIR/lib/neutron
-source $TOP_DIR/lib/neutron-legacy
 source $TOP_DIR/lib/ldap
 source $TOP_DIR/lib/dstat
 source $TOP_DIR/lib/dlm

From 8b1bbd690c3aea36dea804542c1bc56274b2ad31 Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@midokura.com>
Date: Thu, 1 Dec 2016 22:29:12 +0900
Subject: [PATCH 0711/2409] Make deprecated() output to stderr

So that it can be used by functions like _determine_config_server,
which is used like RESULT=$(_determine_config_server).

Change-Id: Ia4e641c5529b95ada30ae662221f370bc7fa88a7
---
 functions-common | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index cc1d42b0d6..f07b382ce6 100644
--- a/functions-common
+++ b/functions-common
@@ -216,7 +216,7 @@ function die_if_not_set {
 function deprecated {
     local text=$1
     DEPRECATED_TEXT+="\n$text"
-    echo "WARNING: $text"
+    echo "WARNING: $text" >&2
 }
 
 # Prints line number and "message" in error format

From eede9ddb1d0f0970672f02bcdfb33923603e65e7 Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@midokura.com>
Date: Fri, 15 Jul 2016 10:27:53 +0900
Subject: [PATCH 0712/2409] Deprecate Q_PLUGIN_EXTRA_CONF_PATH

This single global variable is no longer useful as we have multiple
repositories and devstack plugins nowadays.

Also, add a utility function, neutron_server_config_add, for devstack
plugins to add an extra config file.

Related-Bug: #1599936
Change-Id: I90112823ef96ae2fba97d7b09b00bec8cb816d8d
---
 lib/neutron        | 26 ++++++++++++++++++++-
 lib/neutron-legacy | 56 +++++++++++++++++++++++++++++-----------------
 2 files changed, 60 insertions(+), 22 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 852787db36..590e03818d 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -73,6 +73,9 @@ NEUTRON_ROOTWRAP_DAEMON_CMD="sudo $NEUTRON_ROOTWRAP-daemon $NEUTRON_ROOTWRAP_CON
 # Add all enabled config files to a single config arg
 NEUTRON_CONFIG_ARG=${NEUTRON_CONFIG_ARG:-""}
 
+# Additional neutron api config files
+declare -a _NEUTRON_SERVER_EXTRA_CONF_FILES_ABS
+
 # Functions
 # ---------
 
@@ -393,9 +396,17 @@ function start_neutron_api {
         service_protocol="http"
     fi
 
+    local opts = ""
+    opts+="--config-file $NEUTRON_CONF"
+    opts+="--config-file $NEUTRON_CORE_PLUGIN_CONF"
+    local cfg_file
+    for cfg_file in ${_NEUTRON_SERVER_EXTRA_CONF_FILES_ABS[@]}; do
+        opts+=" --config-file $cfg_file"
+    done
+
     # Start the Neutron service
     # TODO(sc68cal) Stop hard coding this
-    run_process neutron-api "$NEUTRON_BIN_DIR/neutron-server --config-file $NEUTRON_CONF --config-file $NEUTRON_CORE_PLUGIN_CONF"
+    run_process neutron-api "$NEUTRON_BIN_DIR/neutron-server $ops"
 
     if is_ssl_enabled_service "neutron"; then
         ssl_ca="--ca-certificate=${SSL_BUNDLE_FILE}"
@@ -504,6 +515,10 @@ function neutron_service_plugin_class_add_new {
     iniset $NEUTRON_CONF DEFAULT service_plugins $plugins
 }
 
+function neutron_server_config_add_new {
+    _NEUTRON_SERVER_EXTRA_CONF_FILES_ABS+=($1)
+}
+
 # Dispatch functions
 # These are needed for compatibility between the old and new implementations
 # where there are function name overlaps.  These will be removed when
@@ -581,6 +596,15 @@ function install_neutron_agent_packages {
     fi
 }
 
+function neutron_server_config_add {
+    if is_neutron_legacy_enabled; then
+        # Call back to old function
+        mutnauq_server_config_add "$@"
+    else
+        neutron_server_config_add_new "$@"
+    fi
+}
+
 function start_neutron {
     if is_neutron_legacy_enabled; then
         # Call back to old function
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 37d278344e..29c187e1e1 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -128,10 +128,24 @@ Q_NOTIFY_NOVA_PORT_DATA_CHANGES=${Q_NOTIFY_NOVA_PORT_DATA_CHANGES:-True}
 VIF_PLUGGING_IS_FATAL=${VIF_PLUGGING_IS_FATAL:-True}
 VIF_PLUGGING_TIMEOUT=${VIF_PLUGGING_TIMEOUT:-300}
 
+# The directory which contains files for Q_PLUGIN_EXTRA_CONF_FILES.
+# /etc/neutron is assumed by many of devstack plugins.  Do not change.
+_Q_PLUGIN_EXTRA_CONF_PATH=/etc/neutron
+
 # List of config file names in addition to the main plugin config file
-# See _configure_neutron_common() for details about setting it up
+# To add additional plugin config files, use ``neutron_server_config_add``
+# utility function.  For example:
+#
+#    ``neutron_server_config_add file1``
+#
+# These config files are relative to ``/etc/neutron``.  The above
+# example would specify ``--config-file /etc/neutron/file1`` for
+# neutron server.
 declare -a Q_PLUGIN_EXTRA_CONF_FILES
 
+# same as Q_PLUGIN_EXTRA_CONF_FILES, but with absolute path.
+declare -a _Q_PLUGIN_EXTRA_CONF_FILES_ABS
+
 
 Q_RR_CONF_FILE=$NEUTRON_CONF_DIR/rootwrap.conf
 if [[ "$Q_USE_ROOTWRAP" == "False" ]]; then
@@ -270,9 +284,23 @@ set +o xtrace
 # ---------
 
 function _determine_config_server {
+    if [[ "$Q_PLUGIN_EXTRA_CONF_PATH" != '' ]]; then
+        if [[ "$Q_PLUGIN_EXTRA_CONF_PATH" = "$_Q_PLUGIN_EXTRA_CONF_PATH" ]]; then
+            deprecated "Q_PLUGIN_EXTRA_CONF_PATH is deprecated"
+        else
+            die $LINENO "Q_PLUGIN_EXTRA_CONF_PATH is deprecated"
+        fi
+    fi
+    if [[ ${#Q_PLUGIN_EXTRA_CONF_FILES[@]} > 0 ]]; then
+        deprecated "Q_PLUGIN_EXTRA_CONF_FILES is deprecated.  Use neutron_server_config_add instead."
+    fi
+    for cfg_file in ${Q_PLUGIN_EXTRA_CONF_FILES[@]}; do
+        _Q_PLUGIN_EXTRA_CONF_FILES_ABS+=($_Q_PLUGIN_EXTRA_CONF_PATH/$cfg_file)
+    done
+
     local cfg_file
     local opts="--config-file $NEUTRON_CONF --config-file /$Q_PLUGIN_CONF_FILE"
-    for cfg_file in ${Q_PLUGIN_EXTRA_CONF_FILES[@]}; do
+    for cfg_file in ${_Q_PLUGIN_EXTRA_CONF_FILES_ABS[@]}; do
         opts+=" --config-file $cfg_file"
     done
     echo "$opts"
@@ -668,11 +696,6 @@ function _configure_neutron_common {
 
     # Set plugin-specific variables ``Q_DB_NAME``, ``Q_PLUGIN_CLASS``.
     # For main plugin config file, set ``Q_PLUGIN_CONF_PATH``, ``Q_PLUGIN_CONF_FILENAME``.
-    # For additional plugin config files, set ``Q_PLUGIN_EXTRA_CONF_PATH`` and
-    # ``Q_PLUGIN_EXTRA_CONF_FILES``.  For example:
-    #
-    #    ``Q_PLUGIN_EXTRA_CONF_PATH=/path/to/plugins``
-    #    ``Q_PLUGIN_EXTRA_CONF_FILES=(file1 file2)``
     neutron_plugin_configure_common
 
     if [[ "$Q_PLUGIN_CONF_PATH" == '' || "$Q_PLUGIN_CONF_FILENAME" == '' || "$Q_PLUGIN_CLASS" == '' ]]; then
@@ -699,20 +722,6 @@ function _configure_neutron_common {
     # NOTE(freerunner): Need to adjust Region Name for nova in multiregion installation
     iniset $NEUTRON_CONF nova region_name $REGION_NAME
 
-    # If addition config files are set, make sure their path name is set as well
-    if [[ ${#Q_PLUGIN_EXTRA_CONF_FILES[@]} > 0 && $Q_PLUGIN_EXTRA_CONF_PATH == '' ]]; then
-        die $LINENO "Neutron additional plugin config not set.. exiting"
-    fi
-
-    # If additional config files exist, copy them over to neutron configuration
-    # directory
-    if [[ $Q_PLUGIN_EXTRA_CONF_PATH != '' ]]; then
-        local f
-        for (( f=0; $f < ${#Q_PLUGIN_EXTRA_CONF_FILES[@]}; f+=1 )); do
-            Q_PLUGIN_EXTRA_CONF_FILES[$f]=$Q_PLUGIN_EXTRA_CONF_PATH/${Q_PLUGIN_EXTRA_CONF_FILES[$f]}
-        done
-    fi
-
     if [ "$VIRT_DRIVER" = 'fake' ]; then
         # Disable arbitrary limits
         iniset $NEUTRON_CONF quotas quota_network -1
@@ -863,6 +872,11 @@ function _neutron_service_plugin_class_add {
     fi
 }
 
+# mutnauq_server_config_add() - add server config file
+function mutnauq_server_config_add {
+    _Q_PLUGIN_EXTRA_CONF_FILES_ABS+=($1)
+}
+
 # _neutron_deploy_rootwrap_filters() - deploy rootwrap filters to $Q_CONF_ROOTWRAP_D (owned by root).
 function _neutron_deploy_rootwrap_filters {
     if [[ "$Q_USE_ROOTWRAP" == "False" ]]; then

From 8bf8c8f3810766d19b92f9cb21231095beca30c6 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 1 Dec 2016 10:24:06 -0500
Subject: [PATCH 0713/2409] Add test-config local.conf processing

We need a local.conf processing phase after every run phase which lets
us override config options after that point. We didn't explicitly
support this for test-config before, which broke some CI systems when
we moved tempest to use this later phase.

Closes-Bug: #1646391

Change-Id: I7d693afa19acf3e8231e84e45b7a868628ebdbc0
---
 stack.sh | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/stack.sh b/stack.sh
index 9aa770f2b9..4b8552c30a 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1407,6 +1407,9 @@ fi
 # Phase: test-config
 run_phase stack test-config
 
+# Apply late configuration from ``local.conf`` if it exists for layer 2 services
+# Phase: test-config
+merge_config_group $TOP_DIR/local.conf test-config
 
 # Fin
 # ===

From 1c442eebc8fe005af453bd610e750a1919a2b3ed Mon Sep 17 00:00:00 2001
From: Andrea Frittoli <andrea.frittoli@gmail.com>
Date: Wed, 30 Nov 2016 20:44:44 +0000
Subject: [PATCH 0714/2409] Fix libguestfs on Ubuntu

libguestfs does not work on ubuntu because the kernel is not
world readable. This breaks file injection with libvirt.
See https://bugs.launchpad.net/ubuntu/+source/linux/+bug/759725
for more details.

The workaround proposed by Ubuntu is to relax the kernel ACL
if needed, so we need to do that in case file injection is
enabled on an Ubuntu host running libvirt.

Partial-bug: #1646002
Change-Id: I405793b9e145308e51a08710d8e5df720aec6fde
---
 lib/nova_plugins/hypervisor-libvirt | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/lib/nova_plugins/hypervisor-libvirt b/lib/nova_plugins/hypervisor-libvirt
index 167ab6f2e7..f3c8add696 100644
--- a/lib/nova_plugins/hypervisor-libvirt
+++ b/lib/nova_plugins/hypervisor-libvirt
@@ -105,6 +105,16 @@ function install_nova_hypervisor {
     if [[ "$ENABLE_FILE_INJECTION" == "True" ]] ; then
         if is_ubuntu; then
             install_package python-guestfs
+            # NOTE(andreaf) Ubuntu kernel can only be read by root, which breaks libguestfs:
+            # https://bugs.launchpad.net/ubuntu/+source/linux/+bug/759725)
+            INSTALLED_KERNELS="$(ls /boot/vmlinuz-*)"
+            for kernel in $INSTALLED_KERNELS; do
+                STAT_OVERRIDE="root root 644 ${kernel}"
+                # unstack won't remove the statoverride, so make this idempotent
+                if [[ ! $(dpkg-statoverride --list | grep "$STAT_OVERRIDE") ]]; then
+                    sudo dpkg-statoverride --add --update $STAT_OVERRIDE
+                fi
+            done
         elif is_fedora || is_suse; then
             install_package python-libguestfs
         fi

From 1c08b191fd04e028a8d908c9ccb4fdc536248c96 Mon Sep 17 00:00:00 2001
From: Armando Migliaccio <armamig@gmail.com>
Date: Tue, 29 Nov 2016 15:58:53 -0800
Subject: [PATCH 0715/2409] Fix devstack with linuxbridge without l3 agent

The linuxbridge agent for Neutron expects that the public bridge will
already be created by the time it starts. On devstack, this only occurs
as part of the l3 agent configuration. If a compute node doesn't have an
l3 agent and is using a linuxbridge agent, then br-ex won't be created
and the process will not be able to start (causing stack.sh to fail).

This causes the gate-grenade-dsvm-neutron-linuxbridge-multinode-nv gate
to fail. To avoid the issue, skip the bridge mappings setup unless L3 is
configured. This is done in a backward compatible fashion: if localrc
uses the old q-l3 tags, the is_service_enabled neutron-l3 would not be
able to succeed.

Closes-Bug: #1643562

Change-Id: I292ff0dc080fb84b5f879ba2f00f03eff295b55b
---
 lib/neutron_plugins/linuxbridge_agent | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/linuxbridge_agent b/lib/neutron_plugins/linuxbridge_agent
index d0de2f5e5d..0c8ccb8718 100644
--- a/lib/neutron_plugins/linuxbridge_agent
+++ b/lib/neutron_plugins/linuxbridge_agent
@@ -62,7 +62,9 @@ function neutron_plugin_configure_plugin_agent {
         LB_INTERFACE_MAPPINGS=$PHYSICAL_NETWORK:$LB_PHYSICAL_INTERFACE
     fi
     if [[ "$PUBLIC_BRIDGE" != "" ]] && [[ "$PUBLIC_PHYSICAL_NETWORK" != "" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE linux_bridge bridge_mappings "$PUBLIC_PHYSICAL_NETWORK:$PUBLIC_BRIDGE"
+        if is_service_enabled q-l3 || is_service_enabled neutron-l3; then
+            iniset /$Q_PLUGIN_CONF_FILE linux_bridge bridge_mappings "$PUBLIC_PHYSICAL_NETWORK:$PUBLIC_BRIDGE"
+        fi
     fi
     if [[ "$LB_INTERFACE_MAPPINGS" != "" ]]; then
         iniset /$Q_PLUGIN_CONF_FILE linux_bridge physical_interface_mappings $LB_INTERFACE_MAPPINGS

From 6b8a115b95c7a637e01b8145aa961892ca3b9cd1 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Sat, 3 Dec 2016 06:56:32 +0000
Subject: [PATCH 0716/2409] Updated from generate-devstack-plugins-list

Change-Id: I21c31b0778486971719f1281428c7a089f583656
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 6ece9978ac..89f74c3afc 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -76,6 +76,7 @@ kuryr-libnetwork                       `git://git.openstack.org/openstack/kuryr-
 magnum                                 `git://git.openstack.org/openstack/magnum <https://git.openstack.org/cgit/openstack/magnum>`__
 magnum-ui                              `git://git.openstack.org/openstack/magnum-ui <https://git.openstack.org/cgit/openstack/magnum-ui>`__
 manila                                 `git://git.openstack.org/openstack/manila <https://git.openstack.org/cgit/openstack/manila>`__
+manila-ui                              `git://git.openstack.org/openstack/manila-ui <https://git.openstack.org/cgit/openstack/manila-ui>`__
 masakari                               `git://git.openstack.org/openstack/masakari <https://git.openstack.org/cgit/openstack/masakari>`__
 mistral                                `git://git.openstack.org/openstack/mistral <https://git.openstack.org/cgit/openstack/mistral>`__
 mixmatch                               `git://git.openstack.org/openstack/mixmatch <https://git.openstack.org/cgit/openstack/mixmatch>`__

From 8a834940b893b0535887d8cf08504dab4b9b710e Mon Sep 17 00:00:00 2001
From: jeckxie <xiexiaozhe@inspur.com>
Date: Mon, 5 Dec 2016 15:32:25 +0800
Subject: [PATCH 0717/2409] Missing parameter in comment

Change-Id: Iba55013b3be00974321ad58a276bb37ff2cac4da
---
 lib/lvm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/lvm b/lib/lvm
index 99c7ba9b9f..0cebd92f77 100644
--- a/lib/lvm
+++ b/lib/lvm
@@ -101,7 +101,7 @@ function _create_lvm_volume_group {
 # init_lvm_volume_group() initializes the volume group creating the backing
 # file if necessary
 #
-# Usage: init_lvm_volume_group() $vg
+# Usage: init_lvm_volume_group() $vg $size
 function init_lvm_volume_group {
     local vg=$1
     local size=$2

From ae61e6f3d25df98f4ebeca9695a3c73239ce82b2 Mon Sep 17 00:00:00 2001
From: Anton Merzlyakov <amerzlyakov@selit.ru>
Date: Wed, 30 Nov 2016 14:29:18 +0300
Subject: [PATCH 0718/2409] Postgres: fix detection of existing roles

Role "root" it is hardcode.
In general case role name comes from  local.conf: string  "DATABASE_USER="

Change-Id: Iedfca48e04d23c313851f48d68ac40ba29340805
---
 lib/databases/postgresql | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/databases/postgresql b/lib/databases/postgresql
index 14425a53b7..1f347f5548 100644
--- a/lib/databases/postgresql
+++ b/lib/databases/postgresql
@@ -47,7 +47,7 @@ function recreate_database_postgresql {
 }
 
 function configure_database_postgresql {
-    local pg_conf pg_dir pg_hba root_roles version
+    local pg_conf pg_dir pg_hba check_role version
     echo_summary "Configuring and starting PostgreSQL"
     if is_fedora; then
         pg_hba=/var/lib/pgsql/data/pg_hba.conf
@@ -85,8 +85,8 @@ function configure_database_postgresql {
     restart_service postgresql
 
     # Create the role if it's not here or else alter it.
-    root_roles=$(sudo -u root sudo -u postgres -i psql -t -c "SELECT 'HERE' from pg_roles where rolname='root'")
-    if [[ ${root_roles} == *HERE ]];then
+    check_role=$(sudo -u root sudo -u postgres -i psql -t -c "SELECT 'HERE' from pg_roles where rolname='$DATABASE_USER'")
+    if [[ ${check_role} == *HERE ]];then
         sudo -u root sudo -u postgres -i psql -c "ALTER ROLE $DATABASE_USER WITH SUPERUSER LOGIN PASSWORD '$DATABASE_PASSWORD'"
     else
         sudo -u root sudo -u postgres -i psql -c "CREATE ROLE $DATABASE_USER WITH SUPERUSER LOGIN PASSWORD '$DATABASE_PASSWORD'"

From 6d66e647ca35910cbca4d940b5203d7307efa1db Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 5 Dec 2016 06:28:26 -0500
Subject: [PATCH 0719/2409] don't setup cells if n-cpu isn't also running

create_cell requires n-api and at least one n-cpu up and running. If
we have a configuration where it is not guarunteed that there is an
n-cpu at the end of a devstack run we have to skip this step and make
the user run it manually later.

Change-Id: I2287ab29f3c1a7252271dcce81673ef365615296
---
 stack.sh | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index 9c63f5feac..05a7666ce5 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1386,7 +1386,15 @@ check_libs_from_git
 
 # Do this late because it requires compute hosts to have started
 if is_service_enabled n-api; then
-    create_cell
+    if is_service_enabled n-cpu; then
+        create_cell
+    else
+        # Some CI systems like Hyper-V build the control plane on
+        # Linux, and join in non Linux Computes after setup. This
+        # allows them to delay the processing until after their whole
+        # environment is up.
+        echo_summary "SKIPPING Cell setup because n-cpu is not enabled. You will have to do this manually before you have a working environment."
+    fi
 fi
 
 # Bash completion

From 8e0fc9dc8e89994cedfa152e4ff5d2895d19c8a8 Mon Sep 17 00:00:00 2001
From: Vasyl Saienko <vsaienko@mirantis.com>
Date: Tue, 6 Dec 2016 09:35:02 +0200
Subject: [PATCH 0720/2409] Fix doc formating

Fix formating issue in the doc/source/plugin.rst

Trivial fix.

Change-Id: Ifc9a43aebdab0c15c83485cf0b6d4133d7194a9d
---
 doc/source/plugins.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/plugins.rst b/doc/source/plugins.rst
index 31987bc62b..5b3c6cf714 100644
--- a/doc/source/plugins.rst
+++ b/doc/source/plugins.rst
@@ -99,7 +99,7 @@ The current full list of ``mode`` and ``phase`` are:
       should exist at this point.
    -  **extra** - Called near the end after layer 1 and 2 services have
       been started.
-   - **test-config** - Called at the end of devstack used to configure tempest
+   -  **test-config** - Called at the end of devstack used to configure tempest
       or any other test environments
 
 -  **unstack** - Called by ``unstack.sh`` before other services are shut

From 9abb26d69666e836d310ad769d65cb811e2708e7 Mon Sep 17 00:00:00 2001
From: Jens Rosenboom <j.rosenboom@x-ion.de>
Date: Wed, 7 Dec 2016 21:12:55 +0100
Subject: [PATCH 0721/2409] Try to set initial mysql root password also on
 Ubuntu

On Ubuntu nodes, devstack tries to predefine the initial mysql root
password by doing some debconf-set-selections, but these will not take
effect if the corresponding package has been installed earlier. So
just try to set it every time, like we do on other distros.

Change-Id: I2c167051fc5e53dd0ccf82a60ab085cd9cdea28d
---
 lib/databases/mysql | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/lib/databases/mysql b/lib/databases/mysql
index f6cc9224af..89ae082c81 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -82,10 +82,9 @@ function configure_database_mysql {
     fi
 
     # Set the root password - only works the first time. For Ubuntu, we already
-    # did that with debconf before installing the package.
-    if ! is_ubuntu; then
-        sudo mysqladmin -u root password $DATABASE_PASSWORD || true
-    fi
+    # did that with debconf before installing the package, but we still try,
+    # because the package might have been installed already.
+    sudo mysqladmin -u root password $DATABASE_PASSWORD || true
 
     # Update the DB to give user '$DATABASE_USER'@'%' full control of the all databases:
     sudo mysql -uroot -p$DATABASE_PASSWORD -h127.0.0.1 -e "GRANT ALL PRIVILEGES ON *.* TO '$DATABASE_USER'@'%' identified by '$DATABASE_PASSWORD';"

From 470580bba68e5dc727ceb4d575649cb143eef7d5 Mon Sep 17 00:00:00 2001
From: ghanshyam <ghanshyam.mann@nectechnologies.in>
Date: Thu, 8 Dec 2016 13:10:59 +0900
Subject: [PATCH 0722/2409] Remove baremetal tempest config setting from
 devstack

Now all configuration are present in Ironic tempest plugin
and those are going to be removed from tempest in
Id518a6d87d0949737cd1c50cb6a83149b85e5f85

Patch- I73c649625d106fc7f068e12e21eaacba8f43cbbb set
those in ironic devstack plugin.

We can remove all baremetal config setting from devstack.

Along with moved one this patch deletes other unused baremetal
config setting.

Change-Id: If826321ebc0c20ea372d206d49383f3826c9b547
Depends-On: Id518a6d87d0949737cd1c50cb6a83149b85e5f85
Depends-On: I73c649625d106fc7f068e12e21eaacba8f43cbbb
---
 lib/tempest | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 6dc83b558e..39b565f62f 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -494,12 +494,6 @@ function configure_tempest {
 
     # Baremetal
     if [ "$VIRT_DRIVER" = "ironic" ] ; then
-        iniset $TEMPEST_CONFIG baremetal driver_enabled True
-        iniset $TEMPEST_CONFIG baremetal unprovision_timeout $BUILD_TIMEOUT
-        iniset $TEMPEST_CONFIG baremetal active_timeout $BUILD_TIMEOUT
-        iniset $TEMPEST_CONFIG baremetal deploywait_timeout $BUILD_TIMEOUT
-        iniset $TEMPEST_CONFIG baremetal deploy_img_dir $FILES
-        iniset $TEMPEST_CONFIG baremetal node_uuid $IRONIC_NODE_UUID
         iniset $TEMPEST_CONFIG compute-feature-enabled change_password False
         iniset $TEMPEST_CONFIG compute-feature-enabled console_output False
         iniset $TEMPEST_CONFIG compute-feature-enabled interface_attach False

From 8040232e05a68ce18e4ddfa233140d604c94cc77 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Thu, 8 Dec 2016 06:54:23 +0000
Subject: [PATCH 0723/2409] Updated from generate-devstack-plugins-list

Change-Id: I857aea09db183a03393acdaa9bfcde8f24cec4f8
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 89f74c3afc..9a75090713 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -58,6 +58,7 @@ ec2-api                                `git://git.openstack.org/openstack/ec2-ap
 freezer                                `git://git.openstack.org/openstack/freezer <https://git.openstack.org/cgit/openstack/freezer>`__
 freezer-api                            `git://git.openstack.org/openstack/freezer-api <https://git.openstack.org/cgit/openstack/freezer-api>`__
 freezer-web-ui                         `git://git.openstack.org/openstack/freezer-web-ui <https://git.openstack.org/cgit/openstack/freezer-web-ui>`__
+fuxi                                   `git://git.openstack.org/openstack/fuxi <https://git.openstack.org/cgit/openstack/fuxi>`__
 gce-api                                `git://git.openstack.org/openstack/gce-api <https://git.openstack.org/cgit/openstack/gce-api>`__
 glare                                  `git://git.openstack.org/openstack/glare <https://git.openstack.org/cgit/openstack/glare>`__
 gnocchi                                `git://git.openstack.org/openstack/gnocchi <https://git.openstack.org/cgit/openstack/gnocchi>`__

From 30b58bfa277820e0d41a7dc5edd06d8b4ff53500 Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Fri, 9 Dec 2016 00:58:54 +0100
Subject: [PATCH 0724/2409] Update openvswitch restart for suse

Starting with SLE12 SP2 and with openSUSE Leap the distro-shipped
openvswitch is the normal systemd openvswitch.service service file
and no longer the older openvswitch-switch Sysv5 init script. Add
a special case for that.

Change-Id: I5152f2585c3d4d18853988d6290039d6b1713b99
---
 lib/neutron_plugins/ovs_base | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/ovs_base b/lib/neutron_plugins/ovs_base
index 10043252d6..62a4d00bcd 100644
--- a/lib/neutron_plugins/ovs_base
+++ b/lib/neutron_plugins/ovs_base
@@ -69,7 +69,11 @@ function _neutron_ovs_base_install_agent_packages {
         restart_service openvswitch
         sudo systemctl enable openvswitch
     elif is_suse; then
-        restart_service openvswitch-switch
+        if [[ $DISTRO == "sle12" ]] && [[ $os_RELEASE -lt 12.2 ]]; then
+            restart_service openvswitch-switch
+        else
+            restart_service openvswitch
+        fi
     fi
 }
 

From ea774b684d5116c626eb7b64eed9de4ecd5821a4 Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Fri, 9 Dec 2016 00:57:57 +0100
Subject: [PATCH 0725/2409] [opensuse] add python-xml to general deps list

the python-xml is a subpackage from the standard cpython package that
that contains elementtree and other bits that are needed almost
everywhere in OpenStack but isn't installed on a absolutely minimal
openSUSE Leap installation. This package doesn't exist on pip but
is a SUSE only invention, so just treat it similar to a bindep.

Change-Id: I82887c2e6895740d1b16d1269574519450ca783e
---
 files/rpms-suse/general | 1 +
 1 file changed, 1 insertion(+)

diff --git a/files/rpms-suse/general b/files/rpms-suse/general
index 3b19071770..1044c25288 100644
--- a/files/rpms-suse/general
+++ b/files/rpms-suse/general
@@ -21,6 +21,7 @@ postgresql-devel  # psycopg2
 psmisc
 python-cmd2 # dist:opensuse-12.3
 python-devel  # pyOpenSSL
+python-xml
 screen
 tar
 tcpdump

From 16fb9bddf2dfc4ecdda5aeed5d09d10e78558f16 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Fri, 9 Dec 2016 06:53:39 +0000
Subject: [PATCH 0726/2409] Updated from generate-devstack-plugins-list

Change-Id: Ia08c86b2adff782b42a83509359c38d7d531e481
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 9a75090713..358e1e4ba5 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -79,6 +79,7 @@ magnum-ui                              `git://git.openstack.org/openstack/magnum
 manila                                 `git://git.openstack.org/openstack/manila <https://git.openstack.org/cgit/openstack/manila>`__
 manila-ui                              `git://git.openstack.org/openstack/manila-ui <https://git.openstack.org/cgit/openstack/manila-ui>`__
 masakari                               `git://git.openstack.org/openstack/masakari <https://git.openstack.org/cgit/openstack/masakari>`__
+meteos                                 `git://git.openstack.org/openstack/meteos <https://git.openstack.org/cgit/openstack/meteos>`__
 mistral                                `git://git.openstack.org/openstack/mistral <https://git.openstack.org/cgit/openstack/mistral>`__
 mixmatch                               `git://git.openstack.org/openstack/mixmatch <https://git.openstack.org/cgit/openstack/mixmatch>`__
 monasca-analytics                      `git://git.openstack.org/openstack/monasca-analytics <https://git.openstack.org/cgit/openstack/monasca-analytics>`__

From f575aefdfa2db204f975b3b4b178da1e292f4372 Mon Sep 17 00:00:00 2001
From: Roman Podoliaka <rpodolyaka@mirantis.com>
Date: Tue, 11 Oct 2016 13:15:55 +0300
Subject: [PATCH 0727/2409] lib/nova: create api db first

Since I21ae13a6c029e8ac89484faa212434911160fd51 nova-manage db sync
may try to make a request to api db in order to get cell mapping and
will fail, as the db is not created yet. While this is non fatal, we
could avoid the error anyway.

Change-Id: I19483e9420071d484f029779bcc8c6d623c210ce
Related-Bug: #1631033
---
 lib/nova | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/nova b/lib/nova
index d5db5eaeb7..9f0cddeaf3 100644
--- a/lib/nova
+++ b/lib/nova
@@ -676,6 +676,9 @@ function init_nova {
     # All nova components talk to a central database.
     # Only do this step once on the API node for an entire cluster.
     if is_service_enabled $DATABASE_BACKENDS && is_service_enabled n-api; then
+        recreate_database $NOVA_API_DB
+        $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF api_db sync
+
         # (Re)create nova databases
         recreate_database nova
         recreate_database nova_api_cell0
@@ -689,9 +692,6 @@ function init_nova {
             recreate_database $NOVA_CELLS_DB
         fi
 
-        recreate_database $NOVA_API_DB
-        $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF api_db sync
-
         # Run online migrations on the new databases
         # Needed for flavor conversion
         $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF db online_data_migrations

From 22b63666de41bf62b008cff709168c5e84a0bf3b Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Fri, 9 Dec 2016 07:33:01 -0500
Subject: [PATCH 0728/2409] Warn instead of die on undefined config names

When using local.conf in multinode envs not everything is going to be
defined in all places. Eventually we probably want to make it so we
have a host role for these sections or something. But for now warn
instead of die when we can't find a config var.

Change-Id: I6959099373f035fbfe9e540a44e4c52b8e7c95c0
Closes-Bug: #2000824
---
 inc/meta-config           |  3 ++-
 tests/test_meta_config.sh | 11 +++++++----
 2 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/inc/meta-config b/inc/meta-config
index 6252135747..be73b60800 100644
--- a/inc/meta-config
+++ b/inc/meta-config
@@ -181,7 +181,8 @@ function merge_config_group {
 
             realconfigfile=$(eval "echo $configfile")
             if [[ -z $realconfigfile ]]; then
-                die $LINENO "bogus config file specification: $configfile is undefined"
+                warn $LINENO "unknown config file specification: $configfile is undefined"
+                break
             fi
             dir=$(dirname $realconfigfile)
             if [[ -d $dir ]]; then
diff --git a/tests/test_meta_config.sh b/tests/test_meta_config.sh
index 92f9c01f69..087aaf468b 100755
--- a/tests/test_meta_config.sh
+++ b/tests/test_meta_config.sh
@@ -29,6 +29,10 @@ function die {
     exit -1
 }
 
+function warn {
+    return 0
+}
+
 TEST_1C_ADD="[eee]
 type=new
 multi = foo2"
@@ -92,7 +96,7 @@ $TEST_1C_ADD
 [[test3|test-space.conf]]
 [DEFAULT]
 attribute=value
- 
+
 # the above line has a single space
 
 [[test4|\$TEST4_DIR/\$TEST4_FILE]]
@@ -378,11 +382,10 @@ set -e
 
 echo -n "merge_config_group test9 undefined conf file: "
 set +e
-# function is expected to fail and exit, running it
-# in a subprocess to let this script proceed
+# function is expected to trigger warn and continue
 (merge_config_group test.conf test9)
 VAL=$?
-EXPECT_VAL=255
+EXPECT_VAL=0
 check_result "$VAL" "$EXPECT_VAL"
 set -e
 

From 7f68548538a5855cff8fe1debf4e65ff74074e09 Mon Sep 17 00:00:00 2001
From: Jamie Lennox <jamielennox@gmail.com>
Date: Tue, 13 Dec 2016 15:47:11 +1100
Subject: [PATCH 0729/2409] Always add the service role to service users

When creating a service user we allow the user to be created with a
different role. Currently in auth_token middleware we want to check that
the service token is specified with the service role so we should always
add the service role and optionally add additional roles.

Change-Id: Ie954a679674b4795079b539ebc8d4d2dcbd7dacc
---
 lib/keystone | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index fd1d1d4a61..a8de3efa51 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -445,14 +445,16 @@ function create_keystone_accounts {
 #
 # create_service_user <name> [role]
 #
-# The role defaults to the service role. It is allowed to be provided as optional as historically
+# We always add the service role, other roles are also allowed to be added as historically
 # a lot of projects have configured themselves with the admin or other role here if they are
 # using this user for other purposes beyond simply auth_token middleware.
 function create_service_user {
-    local role=${2:-service}
-
     get_or_create_user "$1" "$SERVICE_PASSWORD" "$SERVICE_DOMAIN_NAME"
-    get_or_add_user_project_role "$role" "$1" "$SERVICE_PROJECT_NAME" "$SERVICE_DOMAIN_NAME" "$SERVICE_DOMAIN_NAME"
+    get_or_add_user_project_role service "$1" "$SERVICE_PROJECT_NAME" "$SERVICE_DOMAIN_NAME" "$SERVICE_DOMAIN_NAME"
+
+    if [[ -n "$2" ]]; then
+        get_or_add_user_project_role "$2" "$1" "$SERVICE_PROJECT_NAME" "$SERVICE_DOMAIN_NAME" "$SERVICE_DOMAIN_NAME"
+    fi
 }
 
 # Configure the service to use the auth token middleware.

From edcb7e5bb321d247c9667933f3ff7c72973caa6f Mon Sep 17 00:00:00 2001
From: "Sean M. Collins" <sean@coreitpro.com>
Date: Thu, 15 Dec 2016 11:29:28 -0500
Subject: [PATCH 0730/2409] lib/neutron: Fix some settings

* Set ml2_type_flat setting so that the public flat network is created
correctly

* Set securitygroup driver correctly

It should be set as:

[securitygroup]
firewall_driver = iptables

Change-Id: I7369b45fbc5a47ce958693c67a1902a8cb24f367
---
 lib/neutron | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 4915dcce31..5d03543180 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -161,6 +161,7 @@ function configure_neutron_new {
         iniset $NEUTRON_CORE_PLUGIN_CONF ml2 tenant_network_types vxlan
         iniset $NEUTRON_CORE_PLUGIN_CONF ml2 mechanism_drivers openvswitch,linuxbridge
         iniset $NEUTRON_CORE_PLUGIN_CONF ml2_type_vxlan vni_ranges 1001:2000
+        iniset $NEUTRON_CORE_PLUGIN_CONF ml2_type_flat flat_networks public
         if [[ "$NEUTRON_PORT_SECURITY" = "True" ]]; then
             iniset $NEUTRON_CORE_PLUGIN_CONF ml2 extension_drivers port_security
         fi
@@ -173,10 +174,10 @@ function configure_neutron_new {
 
         # Configure the neutron agent
         if [[ $NEUTRON_AGENT == "linuxbridge" ]]; then
-            iniset $NEUTRON_CORE_PLUGIN_CONF securitygroup iptables
+            iniset $NEUTRON_CORE_PLUGIN_CONF securitygroup firewall_driver iptables
             iniset $NEUTRON_CORE_PLUGIN_CONF vxlan local_ip $HOST_IP
         else
-            iniset $NEUTRON_CORE_PLUGIN_CONF securitygroup iptables_hybrid
+            iniset $NEUTRON_CORE_PLUGIN_CONF securitygroup firewall_driver iptables_hybrid
             iniset $NEUTRON_CORE_PLUGIN_CONF ovs local_ip $HOST_IP
         fi
 

From a09cb5acf908e04b6509484fdff43016ebebf2cf Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Wed, 14 Dec 2016 07:57:26 -0800
Subject: [PATCH 0731/2409] Use java version independent package on Ubuntu

Different versions of Ubuntu ship with different versions of Java.
Trusty had 7, Xenial has 8, and so on. This causes problems when we
hardcode a versioned package name into our dep lists as that version may
not exist everywhere. Thankfully Ubuntu provides a default-jre-headless
package that we can use instead that maps properly onto whatever java
version is correct.

Change-Id: I4e5da215c8f7aa426494686d5043995ce5d3c3af
---
 files/debs/general   | 2 +-
 pkg/elasticsearch.sh | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/files/debs/general b/files/debs/general
index a1f2a4b159..c121770fa2 100644
--- a/files/debs/general
+++ b/files/debs/general
@@ -2,6 +2,7 @@ bc
 bridge-utils
 bsdmainutils
 curl
+default-jre-headless  # NOPRIME
 g++
 gcc
 gettext  # used for compiling message catalogs
@@ -17,7 +18,6 @@ libxml2-dev  # lxml
 libxslt1-dev  # lxml
 libyaml-dev
 lsof # useful when debugging
-openjdk-7-jre-headless  # NOPRIME
 openssh-server
 openssl
 pkg-config
diff --git a/pkg/elasticsearch.sh b/pkg/elasticsearch.sh
index 856eaff36f..fefd454312 100755
--- a/pkg/elasticsearch.sh
+++ b/pkg/elasticsearch.sh
@@ -83,7 +83,7 @@ function install_elasticsearch {
         return
     fi
     if is_ubuntu; then
-        is_package_installed openjdk-7-jre-headless || install_package openjdk-7-jre-headless
+        is_package_installed default-jre-headless || install_package default-jre-headless
 
         sudo dpkg -i ${FILES}/elasticsearch-${ELASTICSEARCH_VERSION}.deb
         sudo update-rc.d elasticsearch defaults 95 10

From 8e14240d232366b8b1dd7de59800595211698fc1 Mon Sep 17 00:00:00 2001
From: Eric Berglund <esberglu@us.ibm.com>
Date: Tue, 29 Nov 2016 17:33:28 -0600
Subject: [PATCH 0732/2409] Confirm network is created before setting
 public_network_id

The current code assumes that there exists a public openstack network
and uses that assumption to set the public_network_id variable in
tempest lib. If NEUTRON_CREATE_INITIAL_NETWORKS is set to false this
step will fail as there is no public network to be found. This change
adds a check for NEUTRON_CREATE_INITIAL_NETWORKS before attempting to
set this variable.

Change-Id: I62e74d350d6533fa842d64c15b01b1a3d42c71c2
Closes-Bug: #1645900
---
 lib/tempest | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index 6dc83b558e..a1b84b6bfc 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -241,7 +241,9 @@ function configure_tempest {
 
     # the public network (for floating ip access) is only available
     # if the extension is enabled.
-    if is_networking_extension_supported 'external-net'; then
+    # If NEUTRON_CREATE_INITIAL_NETWORKS is not true, there is no network created
+    # and the public_network_id should not be set.
+    if [[ "$NEUTRON_CREATE_INITIAL_NETWORKS" == "True" ]] && is_networking_extension_supported 'external-net'; then
         public_network_id=$(openstack network show -f value -c id $PUBLIC_NETWORK_NAME)
     fi
 

From 51a225c5d7f7d8655be62cab0e4d677b6839f35a Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 15 Dec 2016 16:32:08 -0500
Subject: [PATCH 0733/2409] Create mechanism for enabling placement-client on
 subnodes

When doing multinode devstack we need a way to specify that we've
enabled for the placement service. We use a pseudo service of
placement-client for this.

Change-Id: I04a655fbc58913b3d607400a7f677be299499142
---
 lib/placement | 15 ++++++++-------
 stack.sh      | 10 ++++++++++
 2 files changed, 18 insertions(+), 7 deletions(-)

diff --git a/lib/placement b/lib/placement
index 165c670206..ff630e29d8 100644
--- a/lib/placement
+++ b/lib/placement
@@ -55,7 +55,7 @@ PLACEMENT_SERVICE_PORT=${PLACEMENT_SERVICE_PORT:-8778}
 # Test if any placement services are enabled
 # is_placement_enabled
 function is_placement_enabled {
-    [[ ,${ENABLED_SERVICES} =~ ,"placement-" ]] && return 0
+    [[ ,${ENABLED_SERVICES} =~ ,"placement-api" ]] && return 0
     return 1
 }
 
@@ -101,12 +101,7 @@ function _config_placement_apache_wsgi {
     " -i $placement_api_apache_conf
 }
 
-# configure_placement() - Set config files, create data dirs, etc
-function configure_placement {
-    if [ "$PLACEMENT_DB_ENABLED" != False ]; then
-        iniset $PLACEMENT_CONF placement_database connection `database_connection_url placement`
-    fi
-
+function configure_placement_nova_compute {
     iniset $NOVA_CONF placement auth_type "password"
     iniset $NOVA_CONF placement auth_url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_AUTH_PORT/v3"
     iniset $NOVA_CONF placement username placement
@@ -121,7 +116,13 @@ function configure_placement {
     # established by the nova api. This avoids, for the time, being,
     # creating redundant configuration items that are just used for
     # testing.
+}
 
+# configure_placement() - Set config files, create data dirs, etc
+function configure_placement {
+    if [ "$PLACEMENT_DB_ENABLED" != False ]; then
+        iniset $PLACEMENT_CONF placement_database connection `database_connection_url placement`
+    fi
     _config_placement_apache_wsgi
 }
 
diff --git a/stack.sh b/stack.sh
index f4bac30dac..1817f61704 100755
--- a/stack.sh
+++ b/stack.sh
@@ -869,6 +869,16 @@ if is_service_enabled placement; then
     configure_placement
 fi
 
+# create a placement-client fake service to know we need to configure
+# placement connectivity. We configure the placement service for nova
+# if placement-api or placement-client is active, and n-cpu on the
+# same box.
+if is_service_enabled placement placement-client; then
+    if is_service_enabled n-cpu; then
+        configure_placement_nova_compute
+    fi
+fi
+
 if is_service_enabled horizon; then
     # django openstack_auth
     install_django_openstack_auth

From ea3e87d4e5a7a23870e86bbe133064a99e9519cf Mon Sep 17 00:00:00 2001
From: Julia Varlamova <jvarlamova@mirantis.com>
Date: Fri, 16 Dec 2016 14:39:31 +0400
Subject: [PATCH 0734/2409] Add new parameter RECREATE_KEYSTONE_DB

If 'RECREATE_KEYSTONE_DB=False' database won't be recreated.
It would be useful for multinode Grenade tests for Keystone. This parameter
will help us to deploy multiple services on different machines talking to
the same DB.

Devstack recreates Keystone DB each time during Keystone service installation.
If our controller node is already deployed, Keystone DB already contains
important information about OpenStack services and their endpoints. When
the second Keystone node is being deployed, we don't want to delete
records about controllers' services endpoints.

Partially-Implements: bp rolling-upgrade-testing

Change-Id: Ia8d07b4295ca165be01e44466c95d5275f596e83
---
 lib/keystone | 6 ++++--
 stackrc      | 4 ++++
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index fd1d1d4a61..0d54dee2db 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -488,8 +488,10 @@ function init_keystone {
         init_ldap
     fi
 
-    # (Re)create keystone database
-    recreate_database keystone
+    if [[ "$RECREATE_KEYSTONE_DB" == True ]]; then
+        # (Re)create keystone database
+        recreate_database keystone
+    fi
 
     # Initialize keystone database
     $KEYSTONE_BIN_DIR/keystone-manage --config-file $KEYSTONE_CONF db_sync
diff --git a/stackrc b/stackrc
index e7771cfab5..ae87b22e13 100644
--- a/stackrc
+++ b/stackrc
@@ -819,6 +819,10 @@ GIT_DEPTH=${GIT_DEPTH:-0}
 # Use native SSL for servers in ``SSL_ENABLED_SERVICES``
 USE_SSL=$(trueorfalse False USE_SSL)
 
+# We may not need to recreate database in case 2 Keystone services
+# sharing the same database. It would be useful for multinode Grenade tests.
+RECREATE_KEYSTONE_DB=$(trueorfalse True RECREATE_KEYSTONE_DB)
+
 # ebtables is inherently racey. If you run it by two or more processes
 # simultaneously it will collide, badly, in the kernel and produce
 # failures or corruption of ebtables. The only way around it is for

From 3f771b7bcb04a22c056f87e9e9bae76209fd3555 Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Sat, 17 Dec 2016 04:12:24 +0000
Subject: [PATCH 0735/2409] iptables: don't enable arptables firewall

Neutron doesn't use any arptables based firewall rules. This should
somewhat optimize kernel packet processing performance.

I think the setting came from:
http://wiki.libvirt.org/page/Net.bridge.bridge-nf-call_and_sysctl.conf

but does not apply to the way we use iptables.

Change-Id: I41796c76172f5243e4f9c4902363abb1f19d0d12
Closes-Bug: #1651765
---
 functions | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions b/functions
index 6a0ac67b69..0be9794d9a 100644
--- a/functions
+++ b/functions
@@ -658,7 +658,7 @@ function enable_kernel_bridge_firewall {
     # Enable bridge firewalling in case it's disabled in kernel (upstream
     # default is enabled, but some distributions may decide to change it).
     # This is at least needed for RHEL 7.2 and earlier releases.
-    for proto in arp ip ip6; do
+    for proto in ip ip6; do
         sudo sysctl -w net.bridge.bridge-nf-call-${proto}tables=1
     done
 }

From 91070d7e408de28ae6971fb480f499aa5ba41919 Mon Sep 17 00:00:00 2001
From: Sylvain Bauza <sbauza@redhat.com>
Date: Mon, 19 Dec 2016 18:07:55 +0100
Subject: [PATCH 0736/2409] Add placement services to default devstack

Now that the placement service is mandatory for running Nova in Ocata,
we want to enable it by default when running devstack by default.

In the past, we added a placement-client service with
I04a655fbc58913b3d607400a7f677be299499142

Devstack-gate will also be able to run a multinode devstack with the
help of Ibd760c642e3c1ffff2dd61be48e30530b0d24720

Change-Id: I273c3c8299ee329bed425f3e7cd4b583ed1187a4
---
 stackrc | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/stackrc b/stackrc
index e7771cfab5..f6cf0ce171 100644
--- a/stackrc
+++ b/stackrc
@@ -54,6 +54,8 @@ if ! isset ENABLED_SERVICES ; then
     ENABLED_SERVICES=key
     # Nova - services to support libvirt based openstack clouds
     ENABLED_SERVICES+=,n-api,n-cpu,n-cond,n-sch,n-novnc,n-cauth
+    # Placement service needed for Nova
+    ENABLED_SERVICES+=,placement-api,placement-client
     # Glance services needed for Nova
     ENABLED_SERVICES+=,g-api,g-reg
     # Cinder

From 7cdefd4e08e52e246582d5a91a71207e3b0a7bf9 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Tue, 20 Dec 2016 07:02:50 +0000
Subject: [PATCH 0737/2409] Updated from generate-devstack-plugins-list

Change-Id: Ica922f54ffd53e81b3ec034c2ce9b91715304954
---
 doc/source/plugin-registry.rst | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 358e1e4ba5..a6f509e238 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -95,6 +95,7 @@ networking-bgpvpn                      `git://git.openstack.org/openstack/networ
 networking-brocade                     `git://git.openstack.org/openstack/networking-brocade <https://git.openstack.org/cgit/openstack/networking-brocade>`__
 networking-calico                      `git://git.openstack.org/openstack/networking-calico <https://git.openstack.org/cgit/openstack/networking-calico>`__
 networking-cisco                       `git://git.openstack.org/openstack/networking-cisco <https://git.openstack.org/cgit/openstack/networking-cisco>`__
+networking-dpm                         `git://git.openstack.org/openstack/networking-dpm <https://git.openstack.org/cgit/openstack/networking-dpm>`__
 networking-fortinet                    `git://git.openstack.org/openstack/networking-fortinet <https://git.openstack.org/cgit/openstack/networking-fortinet>`__
 networking-generic-switch              `git://git.openstack.org/openstack/networking-generic-switch <https://git.openstack.org/cgit/openstack/networking-generic-switch>`__
 networking-huawei                      `git://git.openstack.org/openstack/networking-huawei <https://git.openstack.org/cgit/openstack/networking-huawei>`__
@@ -121,6 +122,7 @@ neutron-lbaas-dashboard                `git://git.openstack.org/openstack/neutro
 neutron-vpnaas                         `git://git.openstack.org/openstack/neutron-vpnaas <https://git.openstack.org/cgit/openstack/neutron-vpnaas>`__
 nimble                                 `git://git.openstack.org/openstack/nimble <https://git.openstack.org/cgit/openstack/nimble>`__
 nova-docker                            `git://git.openstack.org/openstack/nova-docker <https://git.openstack.org/cgit/openstack/nova-docker>`__
+nova-dpm                               `git://git.openstack.org/openstack/nova-dpm <https://git.openstack.org/cgit/openstack/nova-dpm>`__
 nova-lxd                               `git://git.openstack.org/openstack/nova-lxd <https://git.openstack.org/cgit/openstack/nova-lxd>`__
 nova-mksproxy                          `git://git.openstack.org/openstack/nova-mksproxy <https://git.openstack.org/cgit/openstack/nova-mksproxy>`__
 nova-powervm                           `git://git.openstack.org/openstack/nova-powervm <https://git.openstack.org/cgit/openstack/nova-powervm>`__

From 95ed7c6f0513debdc0c692e78b898c08b84eab99 Mon Sep 17 00:00:00 2001
From: Zane Bitter <zbitter@redhat.com>
Date: Tue, 20 Dec 2016 17:29:14 -0500
Subject: [PATCH 0738/2409] Don't buffer log output in sed

Services that run inside Apache use tail -f on the corresponding log
file to display output in the screen session. However, they also use sed
to replace some control characters, and this means that the output is
buffered. This results in debugging experiences that range from
"impossible" (the log you want isn't shown) to "Kafkaesque nightmare"
(the log you want isn't shown, except that sometimes it is, and
sometimes it isn't even though you double-checked and you're completely
sure that you must have output a log, but when you check back later you
realise it actually is and you wonder if history is actually not mutable
after all and begin to question what is real and what is not).

This adds the --unbuffered option to ensure streaming output.

Change-Id: I665ff5f047156401d8152f478d834ac40ff31658
---
 functions-common | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index cc1d42b0d6..9423f9ed90 100644
--- a/functions-common
+++ b/functions-common
@@ -1678,7 +1678,7 @@ function tail_log {
     local logfile=$2
 
     if [[ "$USE_SCREEN" = "True" ]]; then
-        screen_process "$name" "sudo tail -f $logfile | sed 's/\\\\\\\\x1b/\o033/g'"
+        screen_process "$name" "sudo tail -f $logfile | sed -u 's/\\\\\\\\x1b/\o033/g'"
     fi
 }
 

From 20eb274b753ed7cfeabd4eca8865774fe4bed182 Mon Sep 17 00:00:00 2001
From: Pawel Koniszewski <pawel.koniszewski@intel.com>
Date: Wed, 21 Dec 2016 13:27:09 +0100
Subject: [PATCH 0739/2409] Move RABBIT_HOST to lib/rpc_backend

This moves setting of RABBIT_HOST from stack.sh to lib/rpc_backend
so it may be used in grenade runs, which don't have the defaulted
value from stack.sh. The RABBIT_HOST is needed in order to call
get_transport_url in lib/rpc_backend.

Change-Id: I504f7fac7bb9a8c158e20046dbd1dd2d507db02b
Closes-Bug: #1649586
Depends-On: I3d4d7b309e50f4e2970cda55aada02d68c4fa705
---
 lib/rpc_backend | 3 +++
 stack.sh        | 1 -
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/rpc_backend b/lib/rpc_backend
index 97b1aa409a..a21f781b4e 100644
--- a/lib/rpc_backend
+++ b/lib/rpc_backend
@@ -25,6 +25,9 @@ _XTRACE_RPC_BACKEND=$(set +o | grep xtrace)
 set +o xtrace
 
 RABBIT_USERID=${RABBIT_USERID:-stackrabbit}
+if is_service_enabled rabbit; then
+    RABBIT_HOST=${RABBIT_HOST:-$SERVICE_HOST}
+fi
 
 # Functions
 # ---------
diff --git a/stack.sh b/stack.sh
index 1817f61704..5de2b6366f 100755
--- a/stack.sh
+++ b/stack.sh
@@ -664,7 +664,6 @@ initialize_database_backends && echo "Using $DATABASE_TYPE database backend" ||
 # In multi node DevStack, second node needs ``RABBIT_USERID``, but rabbit
 # isn't enabled.
 if is_service_enabled rabbit; then
-    RABBIT_HOST=${RABBIT_HOST:-$SERVICE_HOST}
     read_password RABBIT_PASSWORD "ENTER A PASSWORD TO USE FOR RABBIT."
 fi
 

From 70a620846483c3f65500dbfe26aef7f3dc1ce50c Mon Sep 17 00:00:00 2001
From: Sylvain Bauza <sbauza@redhat.com>
Date: Tue, 20 Dec 2016 15:34:29 +0100
Subject: [PATCH 0740/2409] Placement service only using default HTTPd ports

The placement API configuration was binding a specific port *and* was supporting
to be called by the default HTTPd ports using a Location directive.

Given that the corresponding service catalog entry for the placement service type
doesn't mention the specific application port but is rather using the default
port 80, we can remove that specific port and just use the default config.

Note that we still need to use a VirtualHost directive for the specific placement
config because ErrorLog is only scoped for either server or virtualhost but can't
be set for a Location (or a Directory) context.

Change-Id: I9a26dcff4b879cf9e82e43a3d1aca2e4fe6aa3e6
---
 files/apache-placement-api.template | 8 +++++---
 lib/placement                       | 7 -------
 2 files changed, 5 insertions(+), 10 deletions(-)

diff --git a/files/apache-placement-api.template b/files/apache-placement-api.template
index b89ef96776..011abb95fc 100644
--- a/files/apache-placement-api.template
+++ b/files/apache-placement-api.template
@@ -1,6 +1,8 @@
-Listen %PUBLICPORT%
-
-<VirtualHost *:%PUBLICPORT%>
+# NOTE(sbauza): This virtualhost is only here because some directives can
+# only be set by a virtualhost or server context, so that's why the port is not bound.
+# TODO(sbauza): Find a better way to identify a free port that is not corresponding to an existing
+# vhost.
+<VirtualHost *:8780>
     WSGIDaemonProcess placement-api processes=%APIWORKERS% threads=1 user=%USER% display-name=%{GROUP} %VIRTUALENV%
     WSGIProcessGroup placement-api
     WSGIScriptAlias / %PUBLICWSGI%
diff --git a/lib/placement b/lib/placement
index ff630e29d8..93b72eb5e0 100644
--- a/lib/placement
+++ b/lib/placement
@@ -47,7 +47,6 @@ fi
 # Public facing bits
 PLACEMENT_SERVICE_PROTOCOL=${PLACEMENT_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 PLACEMENT_SERVICE_HOST=${PLACEMENT_SERVICE_HOST:-$SERVICE_HOST}
-PLACEMENT_SERVICE_PORT=${PLACEMENT_SERVICE_PORT:-8778}
 
 # Functions
 # ---------
@@ -68,7 +67,6 @@ function cleanup_placement {
 # _config_placement_apache_wsgi() - Set WSGI config files
 function _config_placement_apache_wsgi {
     local placement_api_apache_conf
-    local placement_api_port=$PLACEMENT_SERVICE_PORT
     local venv_path=""
     local nova_bin_dir=""
     nova_bin_dir=$(get_python_exec_prefix)
@@ -89,7 +87,6 @@ function _config_placement_apache_wsgi {
 
     sudo cp $FILES/apache-placement-api.template $placement_api_apache_conf
     sudo sed -e "
-        s|%PUBLICPORT%|$placement_api_port|g;
         s|%APACHE_NAME%|$APACHE_NAME|g;
         s|%PUBLICWSGI%|$nova_bin_dir/nova-placement-api|g;
         s|%SSLENGINE%|$placement_ssl|g;
@@ -161,10 +158,6 @@ function install_placement {
 
 # start_placement_api() - Start the API processes ahead of other things
 function start_placement_api {
-    # Get right service port for testing
-    local service_port=$PLACEMENT_SERVICE_PORT
-    local placement_api_port=$PLACEMENT_SERVICE_PORT
-
     enable_apache_site placement-api
     restart_apache_server
     tail_log placement-api /var/log/$APACHE_NAME/placement-api.log

From 8a92b7f1deeb1b9e99b41b7d7b8e22ca9636b6af Mon Sep 17 00:00:00 2001
From: Pawel Koniszewski <pawel.koniszewski@intel.com>
Date: Wed, 5 Oct 2016 16:14:19 +0200
Subject: [PATCH 0741/2409] Add new configuration option for LM+grenade job

In order to test whether live migration is backward compatible
we need to live migrate VM back and forth between two versions
of nova. This configuration option will allow to reuse existing
tests just by adding if condition in a method that invokes live
migration and validates outcome:

* If set to False, it will use existing behaviour
* If set to True, it will live migrate VM, validate whether it
succeded, then live migrate the same VM once again and again
validate the result

Depends-On: Icaeca404ec3e4b8f3cd489789fdac6117740ec43
Change-Id: I8da2b3bd0c08d9a3111d3531c346d06bd52cae7b
---
 lib/tempest | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/tempest b/lib/tempest
index 6dc83b558e..efd698db1c 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -354,6 +354,7 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG compute-feature-enabled live_migration ${LIVE_MIGRATION_AVAILABLE:-False}
     iniset $TEMPEST_CONFIG compute-feature-enabled change_password False
     iniset $TEMPEST_CONFIG compute-feature-enabled block_migration_for_live_migration ${USE_BLOCK_MIGRATION_FOR_LIVE_MIGRATION:-False}
+    iniset $TEMPEST_CONFIG compute-feature-enabled live_migrate_back_and_forth ${LIVE_MIGRATE_BACK_AND_FORTH:-False}
     iniset $TEMPEST_CONFIG compute-feature-enabled attach_encrypted_volume ${ATTACH_ENCRYPTED_VOLUME_AVAILABLE:-True}
     if is_service_enabled n-cell; then
         # Cells doesn't support shelving/unshelving

From 36f81ff6d568395bd2fd7f48bc983b9756924e3d Mon Sep 17 00:00:00 2001
From: Armando Migliaccio <armamig@gmail.com>
Date: Wed, 2 Nov 2016 17:50:56 -0700
Subject: [PATCH 0742/2409] Switch to using openstack client for setting the
 router's gateway

Depends-on: Ifb5a4d1965cd7e75c0c8cf2cfb677e0628b699dc
Change-Id: Iba58f5275cacc7bc82fa2f2d2b96315c2350ab70
---
 lib/neutron_plugins/services/l3 | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 569a366c79..ae086ce9a3 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -337,7 +337,7 @@ function _neutron_configure_router_v4 {
     ext_gw_ip=$(echo $id_and_ext_gw_ip  | get_field 2)
     PUB_SUBNET_ID=$(echo $id_and_ext_gw_ip | get_field 5)
     # Configure the external network as the default router gateway
-    neutron --os-cloud devstack-admin --os-region "$REGION_NAME" router-gateway-set $ROUTER_ID $EXT_NET_ID
+    openstack --os-cloud devstack-admin --os-region "$REGION_NAME" router set --external-gateway $EXT_NET_ID $ROUTER_ID
 
     # This logic is specific to using the l3-agent for layer 3
     if is_service_enabled q-l3 || is_service_enabled neutron-l3;  then
@@ -385,7 +385,7 @@ function _neutron_configure_router_v6 {
     # If the external network has not already been set as the default router
     # gateway when configuring an IPv4 public subnet, do so now
     if [[ "$IP_VERSION" == "6" ]]; then
-        neutron --os-cloud devstack-admin --os-region "$REGION_NAME" router-gateway-set $ROUTER_ID $EXT_NET_ID
+        openstack --os-cloud devstack-admin --os-region "$REGION_NAME" set --external-gateway $EXT_NET_ID $ROUTER_ID
     fi
 
     # This logic is specific to using the l3-agent for layer 3

From afa8a00c14f100cf610ac076f07db2379cfcee20 Mon Sep 17 00:00:00 2001
From: Davanum Srinivas <davanum@gmail.com>
Date: Mon, 19 Dec 2016 09:51:01 -0500
Subject: [PATCH 0743/2409] Switch to python 3.5

Use trueorfalse to normalize the values for USE_PYTHON3

Install 3.5 instead of 3.4 When USE_PYTHON3 is specified.
Also, since not many packages are classified correctly, fallback
to looking for just "Programming Language :: Python :: 3" and
log a message for the package to highlight the problem.

Also special case some services that are *almost* ready

Depends-On: Id48e1b328230fcdf97ed1cb4b97f4c3f9cf6eb8a
Depends-On: Ib7d9aa0e0b74a936002e0eea0b3af05102b06a62
Change-Id: I243ea4b76f0d5ef57a03b5b0798a05468ee6de9b
---
 inc/python  | 53 ++++++++++++++++++++++++++++++++++++++++++++++++++++-
 lib/apache  | 10 +++++++++-
 lib/horizon | 12 ++++++++++--
 stackrc     |  4 ++--
 4 files changed, 73 insertions(+), 6 deletions(-)

diff --git a/inc/python b/inc/python
index e4cfab803c..54fd90533a 100644
--- a/inc/python
+++ b/inc/python
@@ -76,6 +76,27 @@ function get_python_versions_for_package {
         | grep 'Language' | cut -f5 -d: | grep '\.' | tr '\n' ' '
 }
 
+# Check for python3 classifier in local directory
+function check_python3_support_for_package_local {
+    local name=$1
+    cd $name
+    set +e
+    classifier=$(python setup.py --classifiers \
+        | grep 'Programming Language :: Python :: 3$')
+    set -e
+    echo $classifier
+}
+
+# Check for python3 classifier on pypi
+function check_python3_support_for_package_remote {
+    local name=$1
+    set +e
+    classifier=$(curl -s -L "https://pypi.python.org/pypi/$name/json" \
+        | grep '"Programming Language :: Python :: 3"')
+    set -e
+    echo $classifier
+}
+
 # Wrapper for ``pip install`` to set cache and proxy environment variables
 # Uses globals ``OFFLINE``, ``PIP_VIRTUAL_ENV``,
 # ``PIP_UPGRADE``, ``TRACK_DEPENDS``, ``*_proxy``,
@@ -123,9 +144,39 @@ function pip_install {
                 # default pip
                 local package_dir=${!#}
                 local python_versions
-                if [[ -d "$package_dir" ]]; then
+
+                # Special case some services that have experimental
+                # support for python3 in progress, but don't claim support
+                # in their classifier
+                echo "Check python version for : $package_dir"
+                if [[ ${package_dir##*/} == "nova" || ${package_dir##*/} == "glance" || ${package_dir##*/} == "cinder" ]]; then
+                    echo "Using $PYTHON3_VERSION version to install $package_dir"
+                    sudo_pip="$sudo_pip LC_ALL=en_US.UTF-8"
+                    cmd_pip=$(get_pip_command $PYTHON3_VERSION)
+                elif [[ -d "$package_dir" ]]; then
                     python_versions=$(get_python_versions_for_package $package_dir)
                     if [[ $python_versions =~ $PYTHON3_VERSION ]]; then
+                        echo "Using $PYTHON3_VERSION version to install $package_dir"
+                        sudo_pip="$sudo_pip LC_ALL=en_US.UTF-8"
+                        cmd_pip=$(get_pip_command $PYTHON3_VERSION)
+                    else
+                        # The package may not have yet advertised python3.5
+                        # support so check for just python3 classifier and log
+                        # a warning.
+                        python3_classifier=$(check_python3_support_for_package_local $package_dir)
+                        if [[ ! -z "$python3_classifier" ]]; then
+                            echo "Using $PYTHON3_VERSION version to install $package_dir"
+                            sudo_pip="$sudo_pip LC_ALL=en_US.UTF-8"
+                            cmd_pip=$(get_pip_command $PYTHON3_VERSION)
+                        fi
+                    fi
+                else
+                    # Check pypi as we don't have the package on disk
+                    package=$(echo $package_dir | grep -o '^[.a-zA-Z0-9_-]*')
+                    python3_classifier=$(check_python3_support_for_package_remote $package)
+                    if [[ ! -z "$python3_classifier" ]]; then
+                        echo "Using $PYTHON3_VERSION version to install $package"
+                        sudo_pip="$sudo_pip LC_ALL=en_US.UTF-8"
                         cmd_pip=$(get_pip_command $PYTHON3_VERSION)
                     fi
                 fi
diff --git a/lib/apache b/lib/apache
index 2dc626f130..d1a11ae18b 100644
--- a/lib/apache
+++ b/lib/apache
@@ -71,7 +71,15 @@ function install_apache_wsgi {
     # Apache installation, because we mark it NOPRIME
     if is_ubuntu; then
         # Install apache2, which is NOPRIME'd
-        install_package apache2 libapache2-mod-wsgi
+        install_package apache2
+        if python3_enabled; then
+            if is_package_installed libapache2-mod-wsgi; then
+                uninstall_package libapache2-mod-wsgi
+            fi
+            install_package libapache2-mod-wsgi-py3
+        else
+            install_package libapache2-mod-wsgi
+        fi
     elif is_fedora; then
         sudo rm -f /etc/httpd/conf.d/000-*
         install_package httpd mod_wsgi
diff --git a/lib/horizon b/lib/horizon
index 830da095f6..4cabbe483c 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -81,7 +81,11 @@ function configure_horizon {
     # Horizon is installed as develop mode, so we can compile here.
     # Message catalog compilation is handled by Django admin script,
     # so compiling them after the installation avoids Django installation twice.
-    (cd $HORIZON_DIR; python manage.py compilemessages)
+    if python3_enabled; then
+        (cd $HORIZON_DIR; python${PYTHON3_VERSION} manage.py compilemessages)
+    else
+        (cd $HORIZON_DIR; python manage.py compilemessages)
+    fi
 
     # ``local_settings.py`` is used to override horizon default settings.
     local local_settings=$HORIZON_DIR/openstack_dashboard/local/local_settings.py
@@ -162,7 +166,11 @@ function install_django_openstack_auth {
         git_clone_by_name "django_openstack_auth"
         # Compile message catalogs before installation
         _prepare_message_catalog_compilation
-        (cd $dir; python setup.py compile_catalog)
+        if python3_enabled; then
+            (cd $dir; python${PYTHON3_VERSION} setup.py compile_catalog)
+        else
+            (cd $dir; python setup.py compile_catalog)
+        fi
         setup_dev_lib "django_openstack_auth"
     fi
     # if we aren't using this library from git, then we just let it
diff --git a/stackrc b/stackrc
index ae87b22e13..cb9b8176ca 100644
--- a/stackrc
+++ b/stackrc
@@ -101,12 +101,12 @@ if [[ -r $RC_DIR/.localrc.password ]]; then
 fi
 
 # Control whether Python 3 should be used.
-export USE_PYTHON3=${USE_PYTHON3:-False}
+export USE_PYTHON3=$(trueorfalse False USE_PYTHON3)
 
 # When Python 3 is supported by an application, adding the specific
 # version of Python 3 to this variable will install the app using that
 # version of the interpreter instead of 2.7.
-export PYTHON3_VERSION=${PYTHON3_VERSION:-3.4}
+export PYTHON3_VERSION=${PYTHON3_VERSION:-3.5}
 
 # Just to be more explicit on the Python 2 version to use.
 export PYTHON2_VERSION=${PYTHON2_VERSION:-2.7}

From 09cef5a2330031ce4e3dd28dff02ad926e83be19 Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Wed, 28 Dec 2016 23:03:28 +0100
Subject: [PATCH 0744/2409] lib/tempest: Liberty EOL: remove an useless feature
 flag

The snapshot_backup feature flag was introduced in
Ib695e60c2ed7edf30c8baef9e00f0307b1156551 to enable Tempest tests
introduced in I1964ce6e1298041f8238d76fa4b7029d2d23bbfb

But I1964ce6e1298041f8238d76fa4b7029d2d23bbfb was never merged so that
feature flag was never really useful.

Change-Id: I4e0bc786d2320907cb101fc788ad51444628537d
---
 lib/tempest | 2 --
 1 file changed, 2 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 6dc83b558e..7d68092893 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -430,8 +430,6 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG validation network_for_ssh $TEMPEST_SSH_NETWORK_NAME
 
     # Volume
-    # TODO(obutenko): Remove snapshot_backup when liberty-eol happens.
-    iniset $TEMPEST_CONFIG volume-feature-enabled snapshot_backup True
     # TODO(ynesenenko): Remove the volume_services flag when Liberty and Kilo will correct work with host info.
     iniset $TEMPEST_CONFIG volume-feature-enabled volume_services True
     # TODO(ameade): Remove the api_v3 flag when Mitaka and Liberty are end of life.

From 2bf5b416a748ff6c1489b870bab3956aa1b24aee Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Wed, 28 Dec 2016 23:22:17 +0100
Subject: [PATCH 0745/2409] lib/tempest: don't set cli_dir and dashboard_url
 config options

CLI tests have been removed from Tempest in
I4f8638f1c048bbdb598dd181f4af272ef9923806

Dashboard tests have been removed from Tempest in
I2a69ebed2947a5ab5e5ca79557130bd093e168dd

Change-Id: I6df74a07e209b07fd3feae762c9cdab16e09414f
---
 lib/tempest | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 6dc83b558e..c3cfae3c7f 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -486,12 +486,6 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG volume storage_protocol "$TEMPEST_STORAGE_PROTOCOL"
     fi
 
-    # Dashboard
-    iniset $TEMPEST_CONFIG dashboard dashboard_url "http://$SERVICE_HOST/"
-
-    # CLI
-    iniset $TEMPEST_CONFIG cli cli_dir $NOVA_BIN_DIR
-
     # Baremetal
     if [ "$VIRT_DRIVER" = "ironic" ] ; then
         iniset $TEMPEST_CONFIG baremetal driver_enabled True

From 42e73db840213b581c2848aef1ae87b5f6e61faa Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Wed, 28 Dec 2016 23:34:06 +0100
Subject: [PATCH 0746/2409] lib/tempest: remove the
 allow_port_security_disabled option

Now that Liberty is EOLed, the feature flag is not needed anymore.

Change-Id: I5206535761773d4bcb02ebb8f25d1b0c1b59110c
Depends-On: If0b2168080a0b0ecdc6682ef69856a0879f4f6d3
---
 lib/tempest | 2 --
 1 file changed, 2 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 6dc83b558e..7e4c7788b3 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -347,8 +347,6 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG compute max_microversion $tempest_compute_max_microversion
     fi
 
-    # TODO(mriedem): Remove allow_port_security_disabled after liberty-eol.
-    iniset $TEMPEST_CONFIG compute-feature-enabled allow_port_security_disabled True
     iniset $TEMPEST_CONFIG compute-feature-enabled personality ${ENABLE_FILE_INJECTION:-False}
     iniset $TEMPEST_CONFIG compute-feature-enabled resize True
     iniset $TEMPEST_CONFIG compute-feature-enabled live_migration ${LIVE_MIGRATION_AVAILABLE:-False}

From ee3383f7198fbe4563425a3d4fdc1dc2529f2950 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Tue, 3 Jan 2017 07:02:56 +0000
Subject: [PATCH 0747/2409] Updated from generate-devstack-plugins-list

Change-Id: I8ea9f059757ef9b40dc38b93a9ae8072c5be9e4c
---
 doc/source/plugin-registry.rst | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index a6f509e238..cb9c437458 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -95,6 +95,7 @@ networking-bgpvpn                      `git://git.openstack.org/openstack/networ
 networking-brocade                     `git://git.openstack.org/openstack/networking-brocade <https://git.openstack.org/cgit/openstack/networking-brocade>`__
 networking-calico                      `git://git.openstack.org/openstack/networking-calico <https://git.openstack.org/cgit/openstack/networking-calico>`__
 networking-cisco                       `git://git.openstack.org/openstack/networking-cisco <https://git.openstack.org/cgit/openstack/networking-cisco>`__
+networking-cumulus                     `git://git.openstack.org/openstack/networking-cumulus <https://git.openstack.org/cgit/openstack/networking-cumulus>`__
 networking-dpm                         `git://git.openstack.org/openstack/networking-dpm <https://git.openstack.org/cgit/openstack/networking-dpm>`__
 networking-fortinet                    `git://git.openstack.org/openstack/networking-fortinet <https://git.openstack.org/cgit/openstack/networking-fortinet>`__
 networking-generic-switch              `git://git.openstack.org/openstack/networking-generic-switch <https://git.openstack.org/cgit/openstack/networking-generic-switch>`__
@@ -130,6 +131,7 @@ oaktree                                `git://git.openstack.org/openstack/oaktre
 octavia                                `git://git.openstack.org/openstack/octavia <https://git.openstack.org/cgit/openstack/octavia>`__
 osprofiler                             `git://git.openstack.org/openstack/osprofiler <https://git.openstack.org/cgit/openstack/osprofiler>`__
 panko                                  `git://git.openstack.org/openstack/panko <https://git.openstack.org/cgit/openstack/panko>`__
+picasso                                `git://git.openstack.org/openstack/picasso <https://git.openstack.org/cgit/openstack/picasso>`__
 rally                                  `git://git.openstack.org/openstack/rally <https://git.openstack.org/cgit/openstack/rally>`__
 sahara                                 `git://git.openstack.org/openstack/sahara <https://git.openstack.org/cgit/openstack/sahara>`__
 sahara-dashboard                       `git://git.openstack.org/openstack/sahara-dashboard <https://git.openstack.org/cgit/openstack/sahara-dashboard>`__

From 0c0d848b8ce151c72b21114ac741508351a0bf37 Mon Sep 17 00:00:00 2001
From: Davanum Srinivas <davanum@gmail.com>
Date: Tue, 3 Jan 2017 08:52:25 -0500
Subject: [PATCH 0748/2409] Add swift and uwsgi to py35 whitelist

Really close to getting swift and keystone under uwsgi working, so
let's white list them. Won't affect any existing jobs, so we should
be good.

Change-Id: I51d56d16a5b175bd45dee09edc0b2748d72a5d06
---
 inc/python | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/inc/python b/inc/python
index 54fd90533a..5a9a9ed588 100644
--- a/inc/python
+++ b/inc/python
@@ -149,7 +149,9 @@ function pip_install {
                 # support for python3 in progress, but don't claim support
                 # in their classifier
                 echo "Check python version for : $package_dir"
-                if [[ ${package_dir##*/} == "nova" || ${package_dir##*/} == "glance" || ${package_dir##*/} == "cinder" ]]; then
+                if [[ ${package_dir##*/} == "nova" || ${package_dir##*/} == "glance" || \
+                        ${package_dir##*/} == "cinder" || ${package_dir##*/} == "swift" || \
+                        ${package_dir##*/} == "uwsgi" ]]; then
                     echo "Using $PYTHON3_VERSION version to install $package_dir"
                     sudo_pip="$sudo_pip LC_ALL=en_US.UTF-8"
                     cmd_pip=$(get_pip_command $PYTHON3_VERSION)

From 2a7e909b3f9480d3a61bd9ec497a954c833d14c8 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Tue, 3 Jan 2017 21:11:55 -0500
Subject: [PATCH 0749/2409] Explicitly set use_neutron=False in nova.conf when
 running nova-net

nova-network has been deprecated since Netwon and Nova change
I8388c29ad310cd8800084b4d5c026013158bfbed is switching the default
value of use_neutron to True, so we need devstack to explicitly
set use_neutron=False when running and configuring nova-network.

Part of blueprint use-neutron-by-default

Change-Id: I82721b5d10711401b9b0ebc2b0ed07cc8287bbf7
---
 lib/nova | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/nova b/lib/nova
index d5db5eaeb7..50c0d4708e 100644
--- a/lib/nova
+++ b/lib/nova
@@ -663,6 +663,7 @@ function create_nova_conf_nova_network {
     if [ -n "$FLAT_INTERFACE" ]; then
         iniset $NOVA_CONF DEFAULT flat_interface "$FLAT_INTERFACE"
     fi
+    iniset $NOVA_CONF DEFAULT use_neutron False
 }
 
 # create_nova_keys_dir() - Part of the init_nova() process

From 52b10746154d57c067b152009bbc13024c2951d9 Mon Sep 17 00:00:00 2001
From: Mehdi Abaakouk <sileht@redhat.com>
Date: Thu, 1 Dec 2016 16:11:17 +0100
Subject: [PATCH 0750/2409] cinder: configure dlm when this one is zookeeper

Previous this was set the zake, but that was revert to missing
dependencies issue and because zake is a test fixture and not somthing
to deploy.

This change configures the Cinder dlm with this one is zookeeper.
And it installs tooz and the extra dependencies needed for the
zookeeper driver.

To do it, this commit have to introduce a new method for package
installation: 'pip_install_gr_extras package extra1,extra2'.

Change-Id: Idca310c08e345db59840eb31434c6cb1f849fa70
---
 inc/python | 14 ++++++++++++++
 lib/cinder |  7 +++++++
 lib/dlm    |  1 +
 3 files changed, 22 insertions(+)

diff --git a/inc/python b/inc/python
index 5a9a9ed588..04cde34fe1 100644
--- a/inc/python
+++ b/inc/python
@@ -69,6 +69,20 @@ function pip_install_gr {
     pip_install $clean_name
 }
 
+# Wrapper for ``pip install`` that only installs versions of libraries
+# from the global-requirements specification with extras.
+#
+# Uses globals ``REQUIREMENTS_DIR``
+#
+# pip_install_gr_extras packagename extra1,extra2,...
+function pip_install_gr_extras {
+    local name=$1
+    local extras=$2
+    local clean_name
+    clean_name=$(get_from_global_requirements $name)
+    pip_install $clean_name[$extras]
+}
+
 # Determine the python versions supported by a package
 function get_python_versions_for_package {
     local name=$1
diff --git a/lib/cinder b/lib/cinder
index f6ad780bb9..40f0f16d6b 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -373,6 +373,13 @@ function configure_cinder {
     iniset $CINDER_CONF DEFAULT os_privileged_user_password "$SERVICE_PASSWORD"
     iniset $CINDER_CONF DEFAULT os_privileged_user_tenant "$SERVICE_PROJECT_NAME"
     iniset $CINDER_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
+
+    # Set the backend url according to the configured dlm backend
+    if is_dlm_enabled; then
+        if [[ "$(dlm_backend)" == "zookeeper" ]]; then
+            iniset $CINDER_CONF coordination backend_url "zookeeper://${SERVICE_HOST}:2181"
+        fi
+    fi
 }
 
 # create_cinder_accounts() - Set up common required cinder accounts
diff --git a/lib/dlm b/lib/dlm
index e391535910..b5ac0f5d33 100644
--- a/lib/dlm
+++ b/lib/dlm
@@ -91,6 +91,7 @@ function configure_dlm {
 # install_dlm() - Collect source and prepare
 function install_dlm {
     if is_dlm_enabled; then
+        pip_install_gr_extras tooz zookeeper
         if is_ubuntu; then
             install_package zookeeperd
         elif is_fedora; then

From 80b1d0ae7db263dada7fdc4d9d8190d0518b8f6c Mon Sep 17 00:00:00 2001
From: Jens Rosenboom <j.rosenboom@x-ion.de>
Date: Wed, 4 Jan 2017 16:58:04 +0100
Subject: [PATCH 0751/2409] Fix placement service for identity-v3

The domain_name to be used needs to be $SERVICE_DOMAIN_NAME, as this is
changed in devstack from "Default" to "service".

Change-Id: I6351c1b2ca7ea4448e13eb87455bff4058df4fa7
---
 lib/placement | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/placement b/lib/placement
index 93b72eb5e0..871e282f32 100644
--- a/lib/placement
+++ b/lib/placement
@@ -103,9 +103,9 @@ function configure_placement_nova_compute {
     iniset $NOVA_CONF placement auth_url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_AUTH_PORT/v3"
     iniset $NOVA_CONF placement username placement
     iniset $NOVA_CONF placement password "$SERVICE_PASSWORD"
-    iniset $NOVA_CONF placement user_domain_name "Default"
+    iniset $NOVA_CONF placement user_domain_name "$SERVICE_DOMAIN_NAME"
     iniset $NOVA_CONF placement project_name "$SERVICE_TENANT_NAME"
-    iniset $NOVA_CONF placement project_domain_name "Default"
+    iniset $NOVA_CONF placement project_domain_name "$SERVICE_DOMAIN_NAME"
     iniset $NOVA_CONF placement os_region_name "$REGION_NAME"
     # TODO(cdent): auth_strategy, which is common to see in these
     # blocks is not currently used here. For the time being the

From 53a49d104a59678ec36c5b8f4406ad51d69cf5f7 Mon Sep 17 00:00:00 2001
From: Hongbin Lu <hongbin.lu@huawei.com>
Date: Fri, 23 Dec 2016 16:16:50 -0600
Subject: [PATCH 0752/2409] Add virt driver 'zun' to devstack

According to the feedback in the TC meeting [1], we renamed the Nova
virt driver from "docker" to "zun" [2] to avoid name collision
to nova-docker. This rename also help to clarify the difference
between these two drivers.

[1] http://eavesdrop.openstack.org/meetings/tc/2016/
    tc.2016-11-29-20.01.log.html
[2] https://review.openstack.org/#/c/414651/

Change-Id: I747080953ae4d1d35ed334831100413b6e4466c4
---
 lib/nova | 2 +-
 stackrc  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/nova b/lib/nova
index 50c0d4708e..8f11e0f311 100644
--- a/lib/nova
+++ b/lib/nova
@@ -823,7 +823,7 @@ function start_nova_compute {
         run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $compute_cell_conf" $LIBVIRT_GROUP
     elif [[ "$VIRT_DRIVER" = 'lxd' ]]; then
         run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $compute_cell_conf" $LXD_GROUP
-    elif [[ "$VIRT_DRIVER" = 'docker' ]]; then
+    elif [[ "$VIRT_DRIVER" = 'docker' || "$VIRT_DRIVER" = 'zun' ]]; then
         run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $compute_cell_conf" $DOCKER_GROUP
     elif [[ "$VIRT_DRIVER" = 'fake' ]]; then
         local i
diff --git a/stackrc b/stackrc
index 7ce6c513b0..19f5b53372 100644
--- a/stackrc
+++ b/stackrc
@@ -573,7 +573,7 @@ case "$VIRT_DRIVER" in
     lxd)
         LXD_GROUP=${LXD_GROUP:-"lxd"}
         ;;
-    docker)
+    docker|zun)
         DOCKER_GROUP=${DOCKER_GROUP:-"docker"}
         ;;
     fake)

From 85879f1f8157a60fc190eb2731e4edd0deb1dae3 Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Wed, 4 Jan 2017 19:51:50 -0500
Subject: [PATCH 0753/2409] Use the installed swift scripts

This commit switches how scripts we use to launch the installed version
in the path. Previously the scripts were manually executed in the source
repo, but this has issues if you're trying to run with py3 in a system
where python == py2. Setuptools already does the shebang magic for us
at install time, so we just need to use the installed version of the
script.

Change-Id: Iaa4d80ec607a2aa200400330e16cad3a4ca782ac
---
 lib/swift | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/swift b/lib/swift
index b175f2e5c1..761ae74b6b 100644
--- a/lib/swift
+++ b/lib/swift
@@ -809,10 +809,10 @@ function start_swift {
         local proxy_port=${SWIFT_DEFAULT_BIND_PORT}
         start_tls_proxy swift '*' $proxy_port $SERVICE_HOST $SWIFT_DEFAULT_BIND_PORT_INT
     fi
-    run_process s-proxy "$SWIFT_DIR/bin/swift-proxy-server ${SWIFT_CONF_DIR}/proxy-server.conf -v"
+    run_process s-proxy "swift-proxy-server ${SWIFT_CONF_DIR}/proxy-server.conf -v"
     if [[ ${SWIFT_REPLICAS} == 1 ]]; then
         for type in object container account; do
-            run_process s-${type} "$SWIFT_DIR/bin/swift-${type}-server ${SWIFT_CONF_DIR}/${type}-server/1.conf -v"
+            run_process s-${type} "swift-${type}-server ${SWIFT_CONF_DIR}/${type}-server/1.conf -v"
         done
     fi
 

From 0f97841dfa0187a34f3345ba5f6e58d398e82832 Mon Sep 17 00:00:00 2001
From: yatin <yatin.karel@nectechnologies.in>
Date: Thu, 5 Jan 2017 12:32:57 +0530
Subject: [PATCH 0754/2409] Remove duplicate entry for flat_networks

Currently if PHYSICAL_NETWORK and PUBLIC_PHYSICAL_NETWORK are
same then duplicate entry is created in ml2_conf.ini like below:
flat_networks = public,public,

With this patch, if PHYSICAL_NETWORK and PUBLIC_PHYSICAL_NETWORK
are same then add only PHYSICAL_NETWORK to flat_networks in
ml2_conf.ini

Change-Id: Iae4d1ee3882f6d96b4e4abd52ecc673a620563b5
Closes-Bug: #1654148
---
 lib/neutron_plugins/ml2 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/ml2 b/lib/neutron_plugins/ml2
index e429714f06..d798929d36 100644
--- a/lib/neutron_plugins/ml2
+++ b/lib/neutron_plugins/ml2
@@ -105,7 +105,7 @@ function neutron_plugin_configure_service {
             if [[ -n "$PHYSICAL_NETWORK" ]]; then
                 Q_ML2_PLUGIN_FLAT_TYPE_OPTIONS+="${PHYSICAL_NETWORK},"
             fi
-            if [[ -n "$PUBLIC_PHYSICAL_NETWORK" ]]; then
+            if [[ -n "$PUBLIC_PHYSICAL_NETWORK" ]] && [[ "${PHYSICAL_NETWORK}" != "$PUBLIC_PHYSICAL_NETWORK" ]]; then
                 Q_ML2_PLUGIN_FLAT_TYPE_OPTIONS+="${PUBLIC_PHYSICAL_NETWORK},"
             fi
         fi

From 80f3635521c23235b75c6a9cbb8e8edcaf667ae6 Mon Sep 17 00:00:00 2001
From: Davanum Srinivas <davanum@gmail.com>
Date: Mon, 2 Jan 2017 09:30:16 -0500
Subject: [PATCH 0755/2409] Run Swift services under py35

* iniuncomment followed by iniset for reseller_prefix just adds a
  duplicate line in the config file that configparser does not like
  so just remove the uncomment
* fall back to http:// url for glance->swift keystone authentication
* insecure flag to talk to swift

Depends-On: I51d56d16a5b175bd45dee09edc0b2748d72a5d06
Change-Id: I02ed01e20f8dce195c51273e8384130af53384ce
---
 lib/glance | 11 ++++++++++-
 lib/swift  |  1 -
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/lib/glance b/lib/glance
index da9cd43536..4ba1d20bd7 100644
--- a/lib/glance
+++ b/lib/glance
@@ -161,6 +161,9 @@ function configure_glance {
     if is_service_enabled s-proxy; then
         iniset $GLANCE_API_CONF glance_store default_store swift
         iniset $GLANCE_API_CONF glance_store swift_store_create_container_on_put True
+        if python3_enabled; then
+            iniset $GLANCE_API_CONF glance_store swift_store_auth_insecure True
+        fi
 
         iniset $GLANCE_API_CONF glance_store swift_store_config_file $GLANCE_SWIFT_STORE_CONF
         iniset $GLANCE_API_CONF glance_store default_swift_reference ref1
@@ -186,7 +189,13 @@ function configure_glance {
         fi
 
         iniset $GLANCE_SWIFT_STORE_CONF ref1 key $SERVICE_PASSWORD
-        iniset $GLANCE_SWIFT_STORE_CONF ref1 auth_address $KEYSTONE_SERVICE_URI/v3
+        if python3_enabled; then
+            # NOTE(dims): Currently the glance_store+swift does not support either an insecure flag
+            # or ability to specify the CACERT. So fallback to http:// url
+            iniset $GLANCE_SWIFT_STORE_CONF ref1 auth_address ${KEYSTONE_SERVICE_URI/https/http}/v3
+        else
+            iniset $GLANCE_SWIFT_STORE_CONF ref1 auth_address $KEYSTONE_SERVICE_URI/v3
+        fi
         iniset $GLANCE_SWIFT_STORE_CONF ref1 auth_version 3
 
         # commenting is not strictly necessary but it's confusing to have bad values in conf
diff --git a/lib/swift b/lib/swift
index b175f2e5c1..aafe09d310 100644
--- a/lib/swift
+++ b/lib/swift
@@ -454,7 +454,6 @@ function configure_swift {
     # out. Make sure we uncomment Tempauth after we uncomment Keystoneauth
     # otherwise, this code also sets the reseller_prefix for Keystoneauth.
     iniuncomment ${SWIFT_CONFIG_PROXY_SERVER} filter:tempauth account_autocreate
-    iniuncomment ${SWIFT_CONFIG_PROXY_SERVER} filter:tempauth reseller_prefix
     iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:tempauth reseller_prefix "TEMPAUTH"
 
     if is_service_enabled swift3; then

From b51a8862b1f80a947815094148bc229ba3d58ae1 Mon Sep 17 00:00:00 2001
From: Rodrigo Duarte <rduartes@redhat.com>
Date: Mon, 26 Sep 2016 15:22:35 -0300
Subject: [PATCH 0756/2409] Adds keystone security compliance settings

The PCI-DSS feature has been introduced during the Newton
release and its settings are disabled by default. This
patch adds the possibility to enable some of them during
DevStack setup.

Change-Id: If6b5eb3e3cbc43eb241c94d18af80ad50be08772
Depends-On: Id97ca26f93b742cc3d8d49e98afc581f22360504
---
 lib/keystone | 12 ++++++++++++
 lib/tempest  |  6 ++++++
 2 files changed, 18 insertions(+)

diff --git a/lib/keystone b/lib/keystone
index 825fe44fca..34730b892a 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -131,6 +131,12 @@ fi
 KEYSTONE_AUTH_URI_V3=$KEYSTONE_AUTH_URI/v3
 KEYSTONE_SERVICE_URI_V3=$KEYSTONE_SERVICE_URI/v3
 
+# Security compliance
+KEYSTONE_SECURITY_COMPLIANCE_ENABLED=${KEYSTONE_SECURITY_COMPLIANCE_ENABLED:-True}
+KEYSTONE_LOCKOUT_FAILURE_ATTEMPTS=${KEYSTONE_LOCKOUT_FAILURE_ATTEMPTS:-2}
+KEYSTONE_LOCKOUT_DURATION=${KEYSTONE_LOCKOUT_DURATION:-5}
+KEYSTONE_UNIQUE_LAST_PASSWORD_COUNT=${KEYSTONE_UNIQUE_LAST_PASSWORD_COUNT:-2}
+
 
 # Functions
 # ---------
@@ -339,6 +345,12 @@ function configure_keystone {
     # allows policy changes in order to clarify the adminess scope.
     #iniset $KEYSTONE_CONF resource admin_project_domain_name Default
     #iniset $KEYSTONE_CONF resource admin_project_name admin
+
+    if [[ "$KEYSTONE_SECURITY_COMPLIANCE_ENABLED" = True ]]; then
+        iniset $KEYSTONE_CONF security_compliance lockout_failure_attempts $KEYSTONE_LOCKOUT_FAILURE_ATTEMPTS
+        iniset $KEYSTONE_CONF security_compliance lockout_duration $KEYSTONE_LOCKOUT_DURATION
+        iniset $KEYSTONE_CONF security_compliance unique_last_password_count $KEYSTONE_UNIQUE_LAST_PASSWORD_COUNT
+    fi
 }
 
 # create_keystone_accounts() - Sets up common required keystone accounts
diff --git a/lib/tempest b/lib/tempest
index 3915c570ee..4b8fbb7a46 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -261,6 +261,9 @@ function configure_tempest {
     # Identity
     iniset $TEMPEST_CONFIG identity uri "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:5000/v2.0/"
     iniset $TEMPEST_CONFIG identity uri_v3 "$KEYSTONE_SERVICE_URI_V3"
+    iniset $TEMPEST_CONFIG identity user_lockout_failure_attempts $KEYSTONE_LOCKOUT_FAILURE_ATTEMPTS
+    iniset $TEMPEST_CONFIG identity user_lockout_duration $KEYSTONE_LOCKOUT_DURATION
+    iniset $TEMPEST_CONFIG identity user_unique_last_password_count $KEYSTONE_UNIQUE_LAST_PASSWORD_COUNT
     # Use domain scoped tokens for admin v3 tests, v3 dynamic credentials of v3 account generation
     iniset $TEMPEST_CONFIG identity admin_domain_scope True
     if [[ "$TEMPEST_HAS_ADMIN" == "True" ]]; then
@@ -285,6 +288,9 @@ function configure_tempest {
     fi
 
     # Identity Features
+    if [[ "$KEYSTONE_SECURITY_COMPLIANCE_ENABLED" = True ]]; then
+        iniset $TEMPEST_CONFIG identity-feature-enabled security_compliance True
+    fi
     # TODO(rodrigods): Remove the reseller flag when Kilo and Liberty are end of life.
     iniset $TEMPEST_CONFIG identity-feature-enabled reseller True
 

From 51ecf0a869720ae5e8845b95fd2973b2760dcecf Mon Sep 17 00:00:00 2001
From: Davanum Srinivas <davanum@gmail.com>
Date: Thu, 5 Jan 2017 16:11:17 -0500
Subject: [PATCH 0757/2409] Introduce a PYTHON env var

* $PYTHON will have the path to python runtime to be used
* Use $PYTHON to run all the scripts

Change-Id: Ib5ab7820fc18cae5e50ea47302b610494197ad47
---
 functions-common         |  6 +++---
 lib/horizon              | 12 ++----------
 tools/install_prereqs.sh |  3 +++
 3 files changed, 8 insertions(+), 13 deletions(-)

diff --git a/functions-common b/functions-common
index 8d03b88d24..8d32bb4148 100644
--- a/functions-common
+++ b/functions-common
@@ -87,7 +87,7 @@ function write_clouds_yaml {
         CA_CERT_ARG="--os-cacert $SSL_BUNDLE_FILE"
     fi
     # demo -> devstack
-    $TOP_DIR/tools/update_clouds_yaml.py \
+    $PYTHON $TOP_DIR/tools/update_clouds_yaml.py \
         --file $CLOUDS_YAML \
         --os-cloud devstack \
         --os-region-name $REGION_NAME \
@@ -99,7 +99,7 @@ function write_clouds_yaml {
         --os-project-name demo
 
     # alt_demo -> devstack-alt
-    $TOP_DIR/tools/update_clouds_yaml.py \
+    $PYTHON $TOP_DIR/tools/update_clouds_yaml.py \
         --file $CLOUDS_YAML \
         --os-cloud devstack-alt \
         --os-region-name $REGION_NAME \
@@ -111,7 +111,7 @@ function write_clouds_yaml {
         --os-project-name alt_demo
 
     # admin -> devstack-admin
-    $TOP_DIR/tools/update_clouds_yaml.py \
+    $PYTHON $TOP_DIR/tools/update_clouds_yaml.py \
         --file $CLOUDS_YAML \
         --os-cloud devstack-admin \
         --os-region-name $REGION_NAME \
diff --git a/lib/horizon b/lib/horizon
index 4cabbe483c..9c7ec005a2 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -81,11 +81,7 @@ function configure_horizon {
     # Horizon is installed as develop mode, so we can compile here.
     # Message catalog compilation is handled by Django admin script,
     # so compiling them after the installation avoids Django installation twice.
-    if python3_enabled; then
-        (cd $HORIZON_DIR; python${PYTHON3_VERSION} manage.py compilemessages)
-    else
-        (cd $HORIZON_DIR; python manage.py compilemessages)
-    fi
+    (cd $HORIZON_DIR; $PYTHON manage.py compilemessages)
 
     # ``local_settings.py`` is used to override horizon default settings.
     local local_settings=$HORIZON_DIR/openstack_dashboard/local/local_settings.py
@@ -166,11 +162,7 @@ function install_django_openstack_auth {
         git_clone_by_name "django_openstack_auth"
         # Compile message catalogs before installation
         _prepare_message_catalog_compilation
-        if python3_enabled; then
-            (cd $dir; python${PYTHON3_VERSION} setup.py compile_catalog)
-        else
-            (cd $dir; python setup.py compile_catalog)
-        fi
+        (cd $dir; $PYTHON setup.py compile_catalog)
         setup_dev_lib "django_openstack_auth"
     fi
     # if we aren't using this library from git, then we just let it
diff --git a/tools/install_prereqs.sh b/tools/install_prereqs.sh
index 8895e1e77c..da59093581 100755
--- a/tools/install_prereqs.sh
+++ b/tools/install_prereqs.sh
@@ -83,6 +83,9 @@ fi
 
 if python3_enabled; then
     install_python3
+    export PYTHON=$(which python${PYTHON3_VERSION} 2>/dev/null || which python3 2>/dev/null)
+else
+    export PYTHON=$(which python 2>/dev/null)
 fi
 
 # Mark end of run

From 09698d0e0e21f2cb401418db94d725d305acdc7d Mon Sep 17 00:00:00 2001
From: Vincent Untz <vuntz@suse.com>
Date: Fri, 6 Jan 2017 11:25:46 +0100
Subject: [PATCH 0758/2409] Fix typo in commands to enable nested KVM with
 kvm-amd

Change-Id: Ie3c6df2409385d9c6bbc50b3b1f8b20689478466
---
 doc/source/guides/devstack-with-nested-kvm.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/guides/devstack-with-nested-kvm.rst b/doc/source/guides/devstack-with-nested-kvm.rst
index 85a5656198..3732f06fd8 100644
--- a/doc/source/guides/devstack-with-nested-kvm.rst
+++ b/doc/source/guides/devstack-with-nested-kvm.rst
@@ -73,7 +73,7 @@ back:
 ::
 
     sudo rmmod kvm-amd
-    sudo sh -c "echo 'options amd nested=1' >> /etc/modprobe.d/dist.conf"
+    sudo sh -c "echo 'options kvm-amd nested=1' >> /etc/modprobe.d/dist.conf"
     sudo modprobe kvm-amd
 
 Ensure the Nested KVM Kernel module parameter for AMD is enabled on the

From 0c6956862e6ac1cdb51b674c872183074df98c50 Mon Sep 17 00:00:00 2001
From: Lucas Alvares Gomes <lucasagomes@gmail.com>
Date: Fri, 23 Dec 2016 14:35:45 +0000
Subject: [PATCH 0759/2409] Remove default image logic for Ironic from DevStack

The logic to set the default image for Ironic has been moved into the
Ironic tree. This patch is just removing it from DevStack.

Change-Id: Iaeb177f194adc83e40d86696e5553f9f72bbd1f9
Depends-On: Id828b41dc44113ce1cd094ce5fc245989699d4ff
---
 stackrc | 11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)

diff --git a/stackrc b/stackrc
index 19f5b53372..d8d0ee4b3e 100644
--- a/stackrc
+++ b/stackrc
@@ -647,14 +647,9 @@ if [[ "$DOWNLOAD_DEFAULT_IMAGES" == "True" ]]; then
             IMAGE_URLS+="http://ca.downloads.xensource.com/OpenStack/cirros-0.3.4-x86_64-disk.vhd.tgz"
             IMAGE_URLS+=",http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-x86_64-uec.tar.gz";;
         ironic)
-            # Ironic can do both partition and full disk images, depending on the driver
-            if [[ -z "${IRONIC_DEPLOY_DRIVER%%agent*}" ]]; then
-                DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-x86_64-disk}
-            else
-                DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-x86_64-uec}
-            fi
-            IMAGE_URLS+="http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-x86_64-uec.tar.gz"
-            IMAGE_URLS+=",http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-x86_64-disk.img";;
+            # NOTE(lucasagomes): The logic setting the default image
+            # now lives in the Ironic tree
+            ;;
         *) # Default to Cirros with kernel, ramdisk and disk image
             DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-uec}
             IMAGE_URLS+="http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-uec.tar.gz";;

From 78c26504e28291c6e5b7d04b6fb985cc82c53bb8 Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Wed, 28 Dec 2016 22:53:33 +0100
Subject: [PATCH 0760/2409] lib/tempest: remove the
 identity_feature_enabled.reseller flag.

Now that Liberty is EOLed, all supported versions of OpenStack have
the 'reseller' [1] feature.

[1]: http://specs.openstack.org/openstack/keystone-specs/specs/kilo/reseller.html

Change-Id: Id823f1969fbd2cf28542a0ef0f905ddae4a0318c
Depends-On: Ia86c6f351919bddf2611524bf0b143aa09dbddee
---
 lib/tempest | 2 --
 1 file changed, 2 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 4b8fbb7a46..aa3877b4ab 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -291,8 +291,6 @@ function configure_tempest {
     if [[ "$KEYSTONE_SECURITY_COMPLIANCE_ENABLED" = True ]]; then
         iniset $TEMPEST_CONFIG identity-feature-enabled security_compliance True
     fi
-    # TODO(rodrigods): Remove the reseller flag when Kilo and Liberty are end of life.
-    iniset $TEMPEST_CONFIG identity-feature-enabled reseller True
 
     # Image
     # We want to be able to override this variable in the gate to avoid

From c60818421152e5711fc93cab79122379c4e243aa Mon Sep 17 00:00:00 2001
From: Huan Xie <huan.xie@citrix.com>
Date: Wed, 16 Nov 2016 00:40:32 -0800
Subject: [PATCH 0761/2409] XenAPI: Use XenServer DevStack plugins

Hypervisor XenServer will change to use os-xenapi in the future,
this will need DevStack changes, this patch is to remove install
Dom0 plugins part to our own DevStack plugins.

Change-Id: Ic327135b893a77672fd42af919f47f181e932773
---
 lib/nova_plugins/hypervisor-xenserver | 27 ++++++++++++++++++---------
 tools/xen/xenrc                       |  1 +
 2 files changed, 19 insertions(+), 9 deletions(-)

diff --git a/lib/nova_plugins/hypervisor-xenserver b/lib/nova_plugins/hypervisor-xenserver
index b053856348..0046a366c9 100644
--- a/lib/nova_plugins/hypervisor-xenserver
+++ b/lib/nova_plugins/hypervisor-xenserver
@@ -48,6 +48,21 @@ function configure_nova_hypervisor {
     if [ -z "$XENAPI_CONNECTION_URL" ]; then
         die $LINENO "XENAPI_CONNECTION_URL is not specified"
     fi
+
+    # Check os-xenapi plugin is enabled
+    local plugins="${DEVSTACK_PLUGINS}"
+    local plugin
+    local found=0
+    for plugin in ${plugins//,/ }; do
+        if [[ "$plugin" = "os-xenapi" ]]; then
+            found=1
+            break
+        fi
+    done
+    if [[ $found -ne 1 ]]; then
+        die $LINENO "os-xenapi plugin is not specified. Please enable this plugin in local.conf"
+    fi
+
     read_password XENAPI_PASSWORD "ENTER A PASSWORD TO USE FOR XEN."
     iniset $NOVA_CONF DEFAULT compute_driver "xenapi.XenAPIDriver"
     iniset $NOVA_CONF xenserver connection_url "$XENAPI_CONNECTION_URL"
@@ -64,14 +79,6 @@ function configure_nova_hypervisor {
     local ssh_dom0
     ssh_dom0="sudo -u $DOMZERO_USER ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null root@$dom0_ip"
 
-    # Find where the plugins should go in dom0
-    xen_functions=`cat $TOP_DIR/tools/xen/functions`
-    PLUGIN_DIR=`$ssh_dom0 "$xen_functions; set -eux; xapi_plugin_location"`
-
-    # install nova plugins to dom0
-    tar -czf - -C $NOVA_DIR/plugins/xenserver/xenapi/etc/xapi.d/plugins/ ./ |
-        $ssh_dom0 "tar -xzf - -C $PLUGIN_DIR && chmod a+x $PLUGIN_DIR/*"
-
     # install console logrotate script
     tar -czf - -C $NOVA_DIR/tools/xenserver/ rotate_xen_guest_logs.sh |
         $ssh_dom0 'tar -xzf - -C /root/ && chmod +x /root/rotate_xen_guest_logs.sh && mkdir -p /var/log/xen/guest'
@@ -107,7 +114,9 @@ CRONTAB
 
 # install_nova_hypervisor() - Install external components
 function install_nova_hypervisor {
-    pip_install_gr xenapi
+    # xenapi functionality is now included in os-xenapi library which houses the plugin
+    # so this function intentionally left blank
+    :
 }
 
 # start_nova_hypervisor - Start any required external services
diff --git a/tools/xen/xenrc b/tools/xen/xenrc
index bb27454e30..2161247b76 100644
--- a/tools/xen/xenrc
+++ b/tools/xen/xenrc
@@ -101,6 +101,7 @@ set +u
 
 ## Note that the lines below are coming from stackrc to support
 ## new-style config files
+source $RC_DIR/functions-common
 
 # allow local overrides of env variables, including repo config
 if [[ -f $RC_DIR/localrc ]]; then

From 94129c7d02902e0f000c09c8245be341df1c5965 Mon Sep 17 00:00:00 2001
From: Doug Hellmann <doug@doughellmann.com>
Date: Mon, 9 Jan 2017 21:24:24 +0000
Subject: [PATCH 0762/2409] allow config to manage python3 use explicitly

Add variables ENABLED_PYTHON3_PACKAGES and DISABLED_PYTHON3_PACKAGES to
work like ENABLED_SERVICES and DISABLED_SERVICES and to manage which
packages are installed using Python 3. Move the list of whitelisted
packages in pip_install to the default for ENABLED_PYTHON3_PACKAGES,
except swift which is not enabled by default for now.

Add enable_python3_package and disable_python3_package functions to make
editing the variables from local.conf easier.

Add python3_enabled_for and python3_disabled_for functions to check the
settings against packages being installed by pip.

Update pip_install to check if python3 is disabled for a service, then
see if it is explicitly enabled, and only then fall back to looking at
the classifiers in the packaging metadata.

Update pip_install messages to give more detail about why the choice
between python 2 and 3 is being made for a given package.

Change-Id: I69857d4e11f4767928614a3b637c894bcd03491f
Signed-off-by: Doug Hellmann <doug@doughellmann.com>
---
 inc/python           | 119 ++++++++++++++++++++++++++++++++++++++++---
 stackrc              |  12 ++++-
 tests/test_python.sh |  30 +++++++++++
 3 files changed, 153 insertions(+), 8 deletions(-)
 create mode 100755 tests/test_python.sh

diff --git a/inc/python b/inc/python
index 5a9a9ed588..1c581ba22b 100644
--- a/inc/python
+++ b/inc/python
@@ -97,6 +97,111 @@ function check_python3_support_for_package_remote {
     echo $classifier
 }
 
+# python3_enabled_for() checks if the service(s) specified as arguments are
+# enabled by the user in ``ENABLED_PYTHON3_PACKAGES``.
+#
+# Multiple services specified as arguments are ``OR``'ed together; the test
+# is a short-circuit boolean, i.e it returns on the first match.
+#
+# Uses global ``ENABLED_PYTHON3_PACKAGES``
+# python3_enabled_for dir [dir ...]
+function python3_enabled_for {
+    local xtrace
+    xtrace=$(set +o | grep xtrace)
+    set +o xtrace
+
+    local enabled=1
+    local dirs=$@
+    local dir
+    for dir in ${dirs}; do
+        [[ ,${ENABLED_PYTHON3_PACKAGES}, =~ ,${dir}, ]] && enabled=0
+    done
+
+    $xtrace
+    return $enabled
+}
+
+# python3_disabled_for() checks if the service(s) specified as arguments are
+# disabled by the user in ``DISABLED_PYTHON3_PACKAGES``.
+#
+# Multiple services specified as arguments are ``OR``'ed together; the test
+# is a short-circuit boolean, i.e it returns on the first match.
+#
+# Uses global ``DISABLED_PYTHON3_PACKAGES``
+# python3_disabled_for dir [dir ...]
+function python3_disabled_for {
+    local xtrace
+    xtrace=$(set +o | grep xtrace)
+    set +o xtrace
+
+    local enabled=1
+    local dirs=$@
+    local dir
+    for dir in ${dirs}; do
+        [[ ,${DISABLED_PYTHON3_PACKAGES}, =~ ,${dir}, ]] && enabled=0
+    done
+
+    $xtrace
+    return $enabled
+}
+
+# enable_python3_package() adds the repositories passed as argument to the
+# ``ENABLED_PYTHON3_PACKAGES`` list, if they are not already present.
+#
+# For example:
+#   enable_python3_package nova
+#
+# Uses global ``ENABLED_PYTHON3_PACKAGES``
+# enable_python3_package dir [dir ...]
+function enable_python3_package {
+    local xtrace
+    xtrace=$(set +o | grep xtrace)
+    set +o xtrace
+
+    local tmpsvcs="${ENABLED_PYTHON3_PACKAGES}"
+    local python3
+    for dir in $@; do
+        if [[ ,${DISABLED_PYTHON3_PACKAGES}, =~ ,${dir}, ]]; then
+            warn $LINENO "Attempt to enable_python3_package ${dir} when it has been disabled"
+            continue
+        fi
+        if ! python3_enabled_for $dir; then
+            tmpsvcs+=",$dir"
+        fi
+    done
+    ENABLED_PYTHON3_PACKAGES=$(_cleanup_service_list "$tmpsvcs")
+
+    $xtrace
+}
+
+# disable_python3_package() prepares the services passed as argument to be
+# removed from the ``ENABLED_PYTHON3_PACKAGES`` list, if they are present.
+#
+# For example:
+#   disable_python3_package swift
+#
+# Uses globals ``ENABLED_PYTHON3_PACKAGES`` and ``DISABLED_PYTHON3_PACKAGES``
+# disable_python3_package dir [dir ...]
+function disable_python3_package {
+    local xtrace
+    xtrace=$(set +o | grep xtrace)
+    set +o xtrace
+
+    local disabled_svcs="${DISABLED_PYTHON3_PACKAGES}"
+    local enabled_svcs=",${ENABLED_PYTHON3_PACKAGES},"
+    local dir
+    for dir in $@; do
+        disabled_svcs+=",$dir"
+        if python3_enabled_for $dir; then
+            enabled_svcs=${enabled_svcs//,$dir,/,}
+        fi
+    done
+    DISABLED_PYTHON3_PACKAGES=$(_cleanup_service_list "$disabled_svcs")
+    ENABLED_PYTHON3_PACKAGES=$(_cleanup_service_list "$enabled_svcs")
+
+    $xtrace
+}
+
 # Wrapper for ``pip install`` to set cache and proxy environment variables
 # Uses globals ``OFFLINE``, ``PIP_VIRTUAL_ENV``,
 # ``PIP_UPGRADE``, ``TRACK_DEPENDS``, ``*_proxy``,
@@ -149,16 +254,16 @@ function pip_install {
                 # support for python3 in progress, but don't claim support
                 # in their classifier
                 echo "Check python version for : $package_dir"
-                if [[ ${package_dir##*/} == "nova" || ${package_dir##*/} == "glance" || \
-                        ${package_dir##*/} == "cinder" || ${package_dir##*/} == "swift" || \
-                        ${package_dir##*/} == "uwsgi" ]]; then
-                    echo "Using $PYTHON3_VERSION version to install $package_dir"
+                if python3_disabled_for ${package_dir##*/}; then
+                    echo "Explicitly using $PYTHON2_VERSION version to install $package_dir based on DISABLED_PYTHON3_PACKAGES"
+                elif python3_enabled_for ${package_dir##*/}; then
+                    echo "Explicitly using $PYTHON3_VERSION version to install $package_dir based on ENABLED_PYTHON3_PACKAGES"
                     sudo_pip="$sudo_pip LC_ALL=en_US.UTF-8"
                     cmd_pip=$(get_pip_command $PYTHON3_VERSION)
                 elif [[ -d "$package_dir" ]]; then
                     python_versions=$(get_python_versions_for_package $package_dir)
                     if [[ $python_versions =~ $PYTHON3_VERSION ]]; then
-                        echo "Using $PYTHON3_VERSION version to install $package_dir"
+                        echo "Automatically using $PYTHON3_VERSION version to install $package_dir based on classifiers"
                         sudo_pip="$sudo_pip LC_ALL=en_US.UTF-8"
                         cmd_pip=$(get_pip_command $PYTHON3_VERSION)
                     else
@@ -167,7 +272,7 @@ function pip_install {
                         # a warning.
                         python3_classifier=$(check_python3_support_for_package_local $package_dir)
                         if [[ ! -z "$python3_classifier" ]]; then
-                            echo "Using $PYTHON3_VERSION version to install $package_dir"
+                            echo "Automatically using $PYTHON3_VERSION version to install $package_dir based on local package settings"
                             sudo_pip="$sudo_pip LC_ALL=en_US.UTF-8"
                             cmd_pip=$(get_pip_command $PYTHON3_VERSION)
                         fi
@@ -177,7 +282,7 @@ function pip_install {
                     package=$(echo $package_dir | grep -o '^[.a-zA-Z0-9_-]*')
                     python3_classifier=$(check_python3_support_for_package_remote $package)
                     if [[ ! -z "$python3_classifier" ]]; then
-                        echo "Using $PYTHON3_VERSION version to install $package"
+                        echo "Automatically using $PYTHON3_VERSION version to install $package based on remote package settings"
                         sudo_pip="$sudo_pip LC_ALL=en_US.UTF-8"
                         cmd_pip=$(get_pip_command $PYTHON3_VERSION)
                     fi
diff --git a/stackrc b/stackrc
index 19f5b53372..ae7177214f 100644
--- a/stackrc
+++ b/stackrc
@@ -102,9 +102,19 @@ if [[ -r $RC_DIR/.localrc.password ]]; then
     source $RC_DIR/.localrc.password
 fi
 
-# Control whether Python 3 should be used.
+# Control whether Python 3 should be used at all.
 export USE_PYTHON3=$(trueorfalse False USE_PYTHON3)
 
+# Control whether Python 3 is enabled for specific services by the
+# base name of the directory from which they are installed. See
+# enable_python3_package to edit this variable and use_python3_for to
+# test membership.
+export ENABLED_PYTHON3_PACKAGES="nova,glance,cinder,uwsgi"
+
+# Explicitly list services not to run under Python 3. See
+# disable_python3_package to edit this variable.
+export DISABLED_PYTHON3_PACKAGES=""
+
 # When Python 3 is supported by an application, adding the specific
 # version of Python 3 to this variable will install the app using that
 # version of the interpreter instead of 2.7.
diff --git a/tests/test_python.sh b/tests/test_python.sh
new file mode 100755
index 0000000000..8652798778
--- /dev/null
+++ b/tests/test_python.sh
@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+
+# Tests for DevStack INI functions
+
+TOP=$(cd $(dirname "$0")/.. && pwd)
+
+source $TOP/functions-common
+source $TOP/inc/python
+
+source $TOP/tests/unittest.sh
+
+echo "Testing Python 3 functions"
+
+# Initialize variables manipulated by functions under test.
+export ENABLED_PYTHON3_PACKAGES=""
+export DISABLED_PYTHON3_PACKAGES=""
+
+assert_false "should not be enabled yet" python3_enabled_for testpackage1
+
+enable_python3_package testpackage1
+assert_equal "$ENABLED_PYTHON3_PACKAGES" "testpackage1"  "unexpected result"
+assert_true "should be enabled" python3_enabled_for testpackage1
+
+assert_false "should not be disabled yet" python3_disabled_for testpackage2
+
+disable_python3_package testpackage2
+assert_equal "$DISABLED_PYTHON3_PACKAGES" "testpackage2"  "unexpected result"
+assert_true "should be disabled" python3_disabled_for testpackage2
+
+report_results

From a2eb89417fbb6d61526b1819cbe3d0a60537eedd Mon Sep 17 00:00:00 2001
From: Doug Hellmann <doug@doughellmann.com>
Date: Mon, 9 Jan 2017 22:11:49 +0000
Subject: [PATCH 0763/2409] install LIBS_FROM_GIT using python 2 and 3 where
 appropriate

When installing a library from source and python 3 is enabled, first run
the installation process with python 2 enabled to ensure the library is
also installed under python 2 for any services not yet running under
3. The python 3 version is installed second so that command line tools
installed with libraries are installed under python 3 when python 3 is
enabled.

Change-Id: Ibb0f7a68d21081bf7652a0c1515080c0c54888ca
Signed-off-by: Doug Hellmann <doug@doughellmann.com>
---
 inc/python | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/inc/python b/inc/python
index 1c581ba22b..086056350f 100644
--- a/inc/python
+++ b/inc/python
@@ -399,6 +399,16 @@ function setup_lib {
 function setup_dev_lib {
     local name=$1
     local dir=${GITDIR[$name]}
+    if python3_enabled; then
+        # Turn off Python 3 mode and install the package again,
+        # forcing a Python 2 installation. This ensures that all libs
+        # being used for development are installed under both versions
+        # of Python.
+        echo "Installing $name again without Python 3 enabled"
+        USE_PYTHON3=False
+        setup_develop $dir
+        USE_PYTHON3=True
+    fi
     setup_develop $dir
 }
 

From 14e16e42f95cd02aaee1db0d5357027ea81a50e2 Mon Sep 17 00:00:00 2001
From: Pushkar Umaranikar <pushkar.umaranikar@intel.com>
Date: Fri, 9 Dec 2016 20:20:42 +0000
Subject: [PATCH 0764/2409] Setup service user configuration in nova.conf

In Nova, service token will be passed along with user token to communicate
with services when dealing with long running tasks like live migration.

This change addresses adding service user configuration for nova in
devstack.

Part of Nova blueprint use-service-tokens

Depends-On: I51eb0a8937fa39a2e5dafb1ad915e7113ea61f72

Co-Authored-By: Sarafraj Singh <sarafraj.singh@intel.com>

Change-Id: I2d7348c4a72af96c0ed2ef6c0ab75d16e9aec8fc
---
 lib/nova | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/lib/nova b/lib/nova
index 8f11e0f311..bdfab3dea9 100644
--- a/lib/nova
+++ b/lib/nova
@@ -161,6 +161,14 @@ NOVA_ALLOW_MOVE_TO_SAME_HOST=$(trueorfalse True NOVA_ALLOW_MOVE_TO_SAME_HOST)
 TEST_FLOATING_POOL=${TEST_FLOATING_POOL:-test}
 TEST_FLOATING_RANGE=${TEST_FLOATING_RANGE:-192.168.253.0/29}
 
+# Other Nova configurations
+# ----------------------------
+
+# ``NOVA_USE_SERVICE_TOKEN`` is a mode where service token is passed along with
+# user token while communicating to external RESP API's like Neutron, Cinder
+# and Glance.
+NOVA_USE_SERVICE_TOKEN=$(trueorfalse False NOVA_USE_SERVICE_TOKEN)
+
 # Functions
 # ---------
 
@@ -619,6 +627,22 @@ function create_nova_conf {
     fi
 
     iniset $NOVA_CONF DEFAULT dhcpbridge_flagfile "$NOVA_CONF_DIR/nova-dhcpbridge.conf"
+
+    if [ "$NOVA_USE_SERVICE_TOKEN" == "True" ]; then
+        init_nova_service_user_conf
+    fi
+}
+
+function init_nova_service_user_conf {
+    iniset $NOVA_CONF service_user send_service_user_token True
+    iniset $NOVA_CONF service_user auth_type password
+    iniset $NOVA_CONF service_user auth_url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_AUTH_PORT"
+    iniset $NOVA_CONF service_user username nova
+    iniset $NOVA_CONF service_user password "$SERVICE_PASSWORD"
+    iniset $NOVA_CONF service_user user_domain_name "$SERVICE_DOMAIN_NAME"
+    iniset $NOVA_CONF service_user project_name "$SERVICE_PROJECT_NAME"
+    iniset $NOVA_CONF service_user project_domain_name "$SERVICE_DOMAIN_NAME"
+    iniset $NOVA_CONF service_user auth_strategy keystone
 }
 
 function init_nova_cells {

From afac732d5d9b03da7abbd61f814c2f0d1a9039da Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Wed, 11 Jan 2017 18:45:27 +0100
Subject: [PATCH 0765/2409] lib/tempest: allow tweaking
 volume-feature-enabled/manage_snapshot

Only a few Cinder backends support the 'manage snapshot' feature. So
we need a feature flag here. Luckily the LVM driver does support this
feature so default the feature flag to True in devstack(/Gate) but
introduce a variable to tweak the config.

Change-Id: Ifcb9f91059f08bdf2faf2a8d65229aba5742ee1c
Depends-On: I77be1cf85a946bf72e852f6378f0d7b43af8023a
---
 lib/tempest | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/tempest b/lib/tempest
index aa3877b4ab..60ba542894 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -434,6 +434,7 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG validation network_for_ssh $TEMPEST_SSH_NETWORK_NAME
 
     # Volume
+    iniset $TEMPEST_CONFIG volume-feature-enabled manage_snapshot $(trueorfalse True TEMPEST_VOLUME_MANAGE_SNAPSHOT)
     # TODO(ynesenenko): Remove the volume_services flag when Liberty and Kilo will correct work with host info.
     iniset $TEMPEST_CONFIG volume-feature-enabled volume_services True
     # TODO(ameade): Remove the api_v3 flag when Mitaka and Liberty are end of life.

From 92575baa6b010ec09fea3e715030da8be61c0c64 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Wed, 21 Sep 2016 16:15:31 -0400
Subject: [PATCH 0766/2409] tempest: configure
 compute-feature-enabled.swap_volume if libvirt

The only virt driver in nova that supports the swap volume API is
libvirt so enable testing that in Tempest only if using libvirt.

Depends on two changes:

1. The Tempest change that adds the new config option and test.

Depends-On: I2d4779de8d21aa84533f4f92d347e932db2de58e

2. A nova fix for correctly waiting for the block copy job in the guest
   to complete.

Depends-On: I0c52917a5555a70c4973f37dea1aebf878dd73b4

Change-Id: Ibb6b309574d2c6a06fcecb0626ea21527fb7f412
---
 lib/tempest | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index aa3877b4ab..2f2721311e 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -508,13 +508,17 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG compute-feature-enabled suspend False
     fi
 
-    # Libvirt-LXC
-    if [ "$VIRT_DRIVER" = "libvirt" ] && [ "$LIBVIRT_TYPE" = "lxc" ]; then
-        iniset $TEMPEST_CONFIG compute-feature-enabled rescue False
-        iniset $TEMPEST_CONFIG compute-feature-enabled resize False
-        iniset $TEMPEST_CONFIG compute-feature-enabled shelve False
-        iniset $TEMPEST_CONFIG compute-feature-enabled snapshot False
-        iniset $TEMPEST_CONFIG compute-feature-enabled suspend False
+    # Libvirt
+    if [ "$VIRT_DRIVER" = "libvirt" ]; then
+        # Libvirt-LXC
+        if [ "$LIBVIRT_TYPE" = "lxc" ]; then
+            iniset $TEMPEST_CONFIG compute-feature-enabled rescue False
+            iniset $TEMPEST_CONFIG compute-feature-enabled resize False
+            iniset $TEMPEST_CONFIG compute-feature-enabled shelve False
+            iniset $TEMPEST_CONFIG compute-feature-enabled snapshot False
+            iniset $TEMPEST_CONFIG compute-feature-enabled suspend False
+        fi
+        iniset $TEMPEST_CONFIG compute-feature-enabled swap_volume True
     fi
 
     # ``service_available``

From e194330f2753c8cacbcb18668ee32b4722cba2ec Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Wed, 4 Jan 2017 07:26:58 -0800
Subject: [PATCH 0767/2409] Don't skip cellsv2 setup for cellsv1

Since cellsv2 setup is no longer optional, we can't even exclude
cellsv1 from this step. Since cellsv1 users can't use the simple
command, this does the individual steps as needed.

Depends-On: Icfbb17cce8ce8b03dc8b7b4ffb202db01e5218a6
Change-Id: I3c9101a34b2bb0804fc4deda62dbb8637e7b8f94
---
 lib/nova | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index d5db5eaeb7..cb3ec51d6c 100644
--- a/lib/nova
+++ b/lib/nova
@@ -948,7 +948,11 @@ function create_cell {
     if ! is_service_enabled n-cell; then
         nova-manage cell_v2 simple_cell_setup --transport-url $(get_transport_url)
     else
-        echo 'Skipping cellsv2 setup for this cellsv1 configuration'
+        # NOTE(danms): map_cell0 always returns 1 right now; remove this when that is fixed
+        (nova-manage cell_v2 map_cell0 || true)
+        nova-manage --config-file $NOVA_CELLS_CONF  --verbose cell_v2 map_cell_and_hosts \
+                --transport-url $(get_transport_url child_cell) --name 'cell1'
+        nova-manage db sync
     fi
 }
 

From 1ec93a8fc21850c98fbfd4b292d329b4349e5cff Mon Sep 17 00:00:00 2001
From: Brian Haley <brian.haley@hpe.com>
Date: Thu, 12 Jan 2017 16:11:11 -0500
Subject: [PATCH 0768/2409] Create private IPv6 subnet specifying mode flags

$ipv6_modes should always be passed when creating the
default IPv6 subnet, not just when fixed_range_v6 is
set.  Without it the default was DHCPv6, which cirros
doesn't support out of the box.  Was broken in
change-over from neutron to openstack cli.

Change-Id: Iadd39b1ce02fe0b3781bd3ae04adfd20d7e12d9f
Closes-bug: #1656098
---
 lib/neutron_plugins/services/l3 | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index cd0c1ed59a..cead46ff3b 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -292,8 +292,8 @@ function _neutron_create_private_subnet_v6 {
         subnet_params+="--gateway $IPV6_PRIVATE_NETWORK_GATEWAY "
     fi
     subnet_params+="${SUBNETPOOL_V6_ID:+--subnet-pool $SUBNETPOOL_V6_ID} "
-    subnet_params+="${fixed_range_v6:+--subnet-range $fixed_range_v6 $ipv6_modes} "
-    subnet_params+="--network $NET_ID $IPV6_PRIVATE_SUBNET_NAME "
+    subnet_params+="${fixed_range_v6:+--subnet-range $fixed_range_v6} "
+    subnet_params+="$ipv6_modes --network $NET_ID $IPV6_PRIVATE_SUBNET_NAME "
     local ipv6_subnet_id
     ipv6_subnet_id=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet create $subnet_params | grep ' id ' | get_field 2)
     die_if_not_set $LINENO ipv6_subnet_id "Failure creating private IPv6 subnet for $project_id"

From dd07151366175e8f9c61c4a1eabde4ed5d38dd62 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Fri, 13 Jan 2017 07:11:15 +0000
Subject: [PATCH 0769/2409] Updated from generate-devstack-plugins-list

Change-Id: I65fd56546af13453274601ec2b923c5d03b8a8ab
---
 doc/source/plugin-registry.rst | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index cb9c437458..4cfbcb16ba 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -82,6 +82,7 @@ masakari                               `git://git.openstack.org/openstack/masaka
 meteos                                 `git://git.openstack.org/openstack/meteos <https://git.openstack.org/cgit/openstack/meteos>`__
 mistral                                `git://git.openstack.org/openstack/mistral <https://git.openstack.org/cgit/openstack/mistral>`__
 mixmatch                               `git://git.openstack.org/openstack/mixmatch <https://git.openstack.org/cgit/openstack/mixmatch>`__
+mogan                                  `git://git.openstack.org/openstack/mogan <https://git.openstack.org/cgit/openstack/mogan>`__
 monasca-analytics                      `git://git.openstack.org/openstack/monasca-analytics <https://git.openstack.org/cgit/openstack/monasca-analytics>`__
 monasca-api                            `git://git.openstack.org/openstack/monasca-api <https://git.openstack.org/cgit/openstack/monasca-api>`__
 monasca-ceilometer                     `git://git.openstack.org/openstack/monasca-ceilometer <https://git.openstack.org/cgit/openstack/monasca-ceilometer>`__
@@ -121,7 +122,6 @@ neutron-fwaas                          `git://git.openstack.org/openstack/neutro
 neutron-lbaas                          `git://git.openstack.org/openstack/neutron-lbaas <https://git.openstack.org/cgit/openstack/neutron-lbaas>`__
 neutron-lbaas-dashboard                `git://git.openstack.org/openstack/neutron-lbaas-dashboard <https://git.openstack.org/cgit/openstack/neutron-lbaas-dashboard>`__
 neutron-vpnaas                         `git://git.openstack.org/openstack/neutron-vpnaas <https://git.openstack.org/cgit/openstack/neutron-vpnaas>`__
-nimble                                 `git://git.openstack.org/openstack/nimble <https://git.openstack.org/cgit/openstack/nimble>`__
 nova-docker                            `git://git.openstack.org/openstack/nova-docker <https://git.openstack.org/cgit/openstack/nova-docker>`__
 nova-dpm                               `git://git.openstack.org/openstack/nova-dpm <https://git.openstack.org/cgit/openstack/nova-dpm>`__
 nova-lxd                               `git://git.openstack.org/openstack/nova-lxd <https://git.openstack.org/cgit/openstack/nova-lxd>`__
@@ -129,6 +129,7 @@ nova-mksproxy                          `git://git.openstack.org/openstack/nova-m
 nova-powervm                           `git://git.openstack.org/openstack/nova-powervm <https://git.openstack.org/cgit/openstack/nova-powervm>`__
 oaktree                                `git://git.openstack.org/openstack/oaktree <https://git.openstack.org/cgit/openstack/oaktree>`__
 octavia                                `git://git.openstack.org/openstack/octavia <https://git.openstack.org/cgit/openstack/octavia>`__
+os-xenapi                              `git://git.openstack.org/openstack/os-xenapi <https://git.openstack.org/cgit/openstack/os-xenapi>`__
 osprofiler                             `git://git.openstack.org/openstack/osprofiler <https://git.openstack.org/cgit/openstack/osprofiler>`__
 panko                                  `git://git.openstack.org/openstack/panko <https://git.openstack.org/cgit/openstack/panko>`__
 picasso                                `git://git.openstack.org/openstack/picasso <https://git.openstack.org/cgit/openstack/picasso>`__

From b612b6281a424556f6ed30d421214d0aa32ded55 Mon Sep 17 00:00:00 2001
From: Victor Morales <victor.morales@intel.com>
Date: Thu, 12 Jan 2017 19:53:07 -0600
Subject: [PATCH 0770/2409] Use delete action for clean up *.pyc files

Findutils added in release 4.2.3 a new --delete action for deleting
matching files. This action performs better than -exec rm {} \;
because it doesn't have to spawn an external process.  This change
uses a new action whenever is possible.

Change-Id: Iff16a86b18e924cfe78ac7c6107910940ce51e03
---
 clean.sh | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/clean.sh b/clean.sh
index e369eda26c..90b21eb353 100755
--- a/clean.sh
+++ b/clean.sh
@@ -149,5 +149,10 @@ rm -rf ~/.config/openstack
 
 # Clean up all *.pyc files
 if [[ -n "$DEST" ]] && [[ -d "$DEST" ]]; then
-    sudo find $DEST -name "*.pyc" -print0 | xargs -0 rm
+    find_version=`find --version | awk '{ print $NF; exit}'`
+    if vercmp "$find_version" "<" "4.2.3" ; then
+        sudo find $DEST -name "*.pyc" -print0 | xargs -0 rm
+    else
+        sudo find $DEST -name "*.pyc" -delete
+    fi
 fi

From 29bb53fd3e7762c1fea023842ba09fcbfab60252 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Sun, 15 Jan 2017 09:50:40 -0800
Subject: [PATCH 0771/2409] Fix cellsv2 cell0 database name

For some reason we were defaulting the name of the cell0 database
to nova_api_cell0 instead of nova_cell0. Devstack inherited that to
make things work, but we don't really want that. This patch makes us
use the proper name and create the cell0 mapping accordingly. As a
side effect, it also starts the process of unifying the cellsv1 and
cellsv2 paths by creating the cell0 mapping the same for both.

Change-Id: I4e7f6c5eaa068c98e5c4ef3feaee50d8e4f5d484
---
 lib/nova | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/lib/nova b/lib/nova
index cb3ec51d6c..d8bc6c9593 100644
--- a/lib/nova
+++ b/lib/nova
@@ -678,10 +678,10 @@ function init_nova {
     if is_service_enabled $DATABASE_BACKENDS && is_service_enabled n-api; then
         # (Re)create nova databases
         recreate_database nova
-        recreate_database nova_api_cell0
+        recreate_database nova_cell0
 
         # Migrate nova database. If "nova-manage cell_v2 simple_cell_setup" has
-        # been run this migrates the "nova" and "nova_api_cell0" database.
+        # been run this migrates the "nova" and "nova_cell0" database.
         # Otherwise it just migrates the "nova" database.
         $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF db sync
 
@@ -945,11 +945,12 @@ function create_flavors {
 
 # create_cell(): Group the available hosts into a cell
 function create_cell {
+    # NOTE(danms): map_cell0 always returns 1 right now; remove this when that is fixed
+    (nova-manage cell_v2 map_cell0 --database_connection `database_connection_url nova_cell0`|| true)
+
     if ! is_service_enabled n-cell; then
         nova-manage cell_v2 simple_cell_setup --transport-url $(get_transport_url)
     else
-        # NOTE(danms): map_cell0 always returns 1 right now; remove this when that is fixed
-        (nova-manage cell_v2 map_cell0 || true)
         nova-manage --config-file $NOVA_CELLS_CONF  --verbose cell_v2 map_cell_and_hosts \
                 --transport-url $(get_transport_url child_cell) --name 'cell1'
         nova-manage db sync

From ba3c8f48bb07707e421f1c5aac5acedd1e63d3fd Mon Sep 17 00:00:00 2001
From: Huan Xie <huan.xie@citrix.com>
Date: Sun, 15 Jan 2017 20:07:04 -0800
Subject: [PATCH 0772/2409] Change the way to get conntrack-tools version

In the incoming XenServer, it failed to install conntrack-tools
in Dom0 due to the bash script which is trying to find the correct
CentOS release version to be used in yum command. This patch is to
fix the problem

Change-Id: If7f169e118ccb7c29fc479c361417a916dc40b40
---
 tools/xen/functions | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/xen/functions b/tools/xen/functions
index e1864eb4bb..93f3413d6d 100644
--- a/tools/xen/functions
+++ b/tools/xen/functions
@@ -317,7 +317,7 @@ function install_conntrack_tools {
         # Only support conntrack-tools in Dom0 with XS7.0 and above
         if [ ! -f /usr/sbin/conntrackd ]; then
             sed -i s/#baseurl=/baseurl=/g /etc/yum.repos.d/CentOS-Base.repo
-            centos_ver=$(yum version nogroups |grep Installed | cut -d' ' -f 2 | cut -d'.' -f1-2 | tr '-' '.')
+            centos_ver=$(yum version nogroups |grep Installed | cut -d' ' -f 2 | cut -d'/' -f 1 | cut -d'-' -f 1)
             yum install -y --enablerepo=base --releasever=$centos_ver conntrack-tools
             # Backup conntrackd.conf after install conntrack-tools, use the one with statistic mode
             mv /etc/conntrackd/conntrackd.conf /etc/conntrackd/conntrackd.conf.back

From 3eb7c97a6ddc4780ebcb833c1b86cf4b86b5e14d Mon Sep 17 00:00:00 2001
From: Patrick East <patrick.east@purestorage.com>
Date: Fri, 13 Jan 2017 11:44:54 -0800
Subject: [PATCH 0773/2409] Restrict enabling the manage_snapshot volume
 feature

The test that is in tempest for this feature is
specific to LVM and will *not* work for other backends
regardless of them supporting the feature. It shouldn't
default to enabled for everyone, only for LVM.

If others want to opt-in they can, but its definitely
the minority that would.

Change-Id: I21347f2a5069059e6413208b254d5acd246faaea
---
 lib/tempest | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index 5a072291f1..deffcfae61 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -434,7 +434,11 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG validation network_for_ssh $TEMPEST_SSH_NETWORK_NAME
 
     # Volume
-    iniset $TEMPEST_CONFIG volume-feature-enabled manage_snapshot $(trueorfalse True TEMPEST_VOLUME_MANAGE_SNAPSHOT)
+    # Only turn on TEMPEST_VOLUME_MANAGE_SNAPSHOT by default for "lvm" backends
+    if [[ "$CINDER_ENABLED_BACKENDS" == *"lvm"* ]]; then
+        TEMPEST_VOLUME_MANAGE_SNAPSHOT=${TEMPEST_VOLUME_MANAGE_SNAPSHOT:-True}
+    fi
+    iniset $TEMPEST_CONFIG volume-feature-enabled manage_snapshot $(trueorfalse False TEMPEST_VOLUME_MANAGE_SNAPSHOT)
     # TODO(ynesenenko): Remove the volume_services flag when Liberty and Kilo will correct work with host info.
     iniset $TEMPEST_CONFIG volume-feature-enabled volume_services True
     # TODO(ameade): Remove the api_v3 flag when Mitaka and Liberty are end of life.

From 1b457c9acfe7c0bcf7ba06dd4029d1e4ef9cdded Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 18 Jan 2017 07:53:33 -0500
Subject: [PATCH 0774/2409] remove db setting when no nova service need it

We shouldn't have the db connection laying around if services don't
need it.

Change-Id: I9290e80c499c0c4644094e3c0666fd0ab002a23c
---
 lib/nova | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/lib/nova b/lib/nova
index 450242b579..3e29c1320d 100644
--- a/lib/nova
+++ b/lib/nova
@@ -465,8 +465,6 @@ function create_nova_conf {
     else
         iniset $NOVA_CONF DEFAULT my_ip "$HOST_IP"
     fi
-    iniset $NOVA_CONF database connection `database_connection_url nova`
-    iniset $NOVA_CONF api_database connection `database_connection_url nova_api`
     iniset $NOVA_CONF DEFAULT instance_name_template "${INSTANCE_NAME_PREFIX}%08x"
     iniset $NOVA_CONF DEFAULT osapi_compute_listen "$NOVA_SERVICE_LISTEN_ADDRESS"
     iniset $NOVA_CONF DEFAULT metadata_listen "$NOVA_SERVICE_LISTEN_ADDRESS"
@@ -478,6 +476,14 @@ function create_nova_conf {
         iniset $NOVA_CONF DEFAULT bindir "/usr/bin"
     fi
 
+    # only setup database connections if there are services that
+    # require them running on the host. The ensures that n-cpu doesn't
+    # leak a need to use the db in a multinode scenario.
+    if is_service_enabled n-api n-cond n-sched; then
+        iniset $NOVA_CONF database connection `database_connection_url nova`
+        iniset $NOVA_CONF api_database connection `database_connection_url nova_api`
+    fi
+
     if is_service_enabled n-api; then
         if is_service_enabled n-api-meta; then
             # If running n-api-meta as a separate service

From f80e2cfee85a200ba204ac00bada74695abcd964 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 18 Jan 2017 15:42:32 -0500
Subject: [PATCH 0775/2409] add install_devstack_tools

An initial install for devstack-tools, this will need to use all the
fun pip extra variables for installation, however the current
pip_install always prefers python2, and we only want to do python3
here.

Change-Id: I3dcdb35130f76fad81cb7b0d4001b7e96efbbd84
---
 inc/python | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/inc/python b/inc/python
index 04cde34fe1..5afc07f636 100644
--- a/inc/python
+++ b/inc/python
@@ -441,6 +441,13 @@ function install_python3 {
     fi
 }
 
+function install_devstack_tools {
+    # intentionally old to ensure devstack-gate has control
+    local dstools_version=${DSTOOLS_VERSION:-0.1.2}
+    install_python3
+    sudo pip3 install -U devstack-tools==${dstools_version}
+}
+
 # Restore xtrace
 $INC_PY_TRACE
 

From b6753cea8cd0e07d982048d2f856c6168fc74a92 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 5 Apr 2016 11:52:44 -0400
Subject: [PATCH 0776/2409] simplify colorized logging setup

This makes setup_colorized_logging be a thing which takes a single
parameter and doesn't let projects do things differently. It also
changes the order of values from user / project to project / user to
represent the hierachy more clearly.

Change-Id: I8c0ba7da54be588e3e068734feb4f78ed7c5a14a
---
 functions          | 8 ++++----
 lib/cinder         | 2 +-
 lib/glance         | 6 +++---
 lib/keystone       | 2 +-
 lib/neutron-legacy | 2 +-
 lib/nova           | 2 +-
 6 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/functions b/functions
index 0be9794d9a..3e0e0d5559 100644
--- a/functions
+++ b/functions
@@ -578,11 +578,11 @@ function vercmp {
 # setup_colorized_logging something.conf SOMESECTION
 function setup_colorized_logging {
     local conf_file=$1
-    local conf_section=$2
-    local project_var=${3:-"project_name"}
-    local user_var=${4:-"user_name"}
+    local conf_section="DEFAULT"
+    local project_var="project_name"
+    local user_var="user_name"
     # Add color to logging output
-    iniset $conf_file $conf_section logging_context_format_string "%(asctime)s.%(msecs)03d %(color)s%(levelname)s %(name)s [%(request_id)s %("$user_var")s %("$project_var")s%(color)s] %(instance)s%(color)s%(message)s"
+    iniset $conf_file $conf_section logging_context_format_string "%(asctime)s.%(msecs)03d %(color)s%(levelname)s %(name)s [%(request_id)s %("$project_var")s %("$user_var")s%(color)s] %(instance)s%(color)s%(message)s"
     iniset $conf_file $conf_section logging_default_format_string "%(asctime)s.%(msecs)03d %(color)s%(levelname)s %(name)s [-%(color)s] %(instance)s%(color)s%(message)s"
     iniset $conf_file $conf_section logging_debug_format_suffix "from (pid=%(process)d) %(funcName)s %(pathname)s:%(lineno)d"
     iniset $conf_file $conf_section logging_exception_prefix "%(color)s%(asctime)s.%(msecs)03d TRACE %(name)s %(instance)s"
diff --git a/lib/cinder b/lib/cinder
index 40f0f16d6b..cf5bb25cfe 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -334,7 +334,7 @@ function configure_cinder {
 
     # Format logging
     if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ] && [ "$CINDER_USE_MOD_WSGI" == "False" ]; then
-        setup_colorized_logging $CINDER_CONF DEFAULT "project_id" "user_id"
+        setup_colorized_logging $CINDER_CONF
     else
         # Set req-id, project-name and resource in log format
         iniset $CINDER_CONF DEFAULT logging_context_format_string "%(asctime)s.%(msecs)03d %(levelname)s %(name)s [%(request_id)s %(project_name)s] %(resource)s%(message)s"
diff --git a/lib/glance b/lib/glance
index 4ba1d20bd7..17361143df 100644
--- a/lib/glance
+++ b/lib/glance
@@ -230,8 +230,8 @@ function configure_glance {
 
     # Format logging
     if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ]; then
-        setup_colorized_logging $GLANCE_API_CONF DEFAULT tenant user
-        setup_colorized_logging $GLANCE_REGISTRY_CONF DEFAULT tenant user
+        setup_colorized_logging $GLANCE_API_CONF
+        setup_colorized_logging $GLANCE_REGISTRY_CONF
     fi
 
     cp -p $GLANCE_DIR/etc/glance-registry-paste.ini $GLANCE_REGISTRY_PASTE_INI
@@ -273,7 +273,7 @@ function configure_glance {
     if is_service_enabled g-glare; then
         local dburl
         dburl=`database_connection_url glance`
-        setup_colorized_logging $GLANCE_GLARE_CONF DEFAULT tenant user
+        setup_colorized_logging $GLANCE_GLARE_CONF
         iniset $GLANCE_GLARE_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
         iniset $GLANCE_GLARE_CONF DEFAULT bind_host $GLANCE_SERVICE_LISTEN_ADDRESS
         iniset $GLANCE_GLARE_CONF DEFAULT bind_port $GLANCE_GLARE_PORT
diff --git a/lib/keystone b/lib/keystone
index 34730b892a..474af8be1d 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -284,7 +284,7 @@ function configure_keystone {
 
     # Format logging
     if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ] && [ "$KEYSTONE_DEPLOY" != "mod_wsgi" ] ; then
-        setup_colorized_logging $KEYSTONE_CONF DEFAULT
+        setup_colorized_logging $KEYSTONE_CONF
     fi
 
     iniset $KEYSTONE_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 29c187e1e1..cf59b2d6dd 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -733,7 +733,7 @@ function _configure_neutron_common {
 
     # Format logging
     if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ]; then
-        setup_colorized_logging $NEUTRON_CONF DEFAULT project_id
+        setup_colorized_logging $NEUTRON_CONF
     else
         # Show user_name and project_name by default like in nova
         iniset $NEUTRON_CONF DEFAULT logging_user_identity_format "%(user_name)s %(project_name)s"
diff --git a/lib/nova b/lib/nova
index 450242b579..617cf5c3aa 100644
--- a/lib/nova
+++ b/lib/nova
@@ -520,7 +520,7 @@ function create_nova_conf {
     fi
     # Format logging
     if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ] && [ "$NOVA_USE_MOD_WSGI" == "False" ]  ; then
-        setup_colorized_logging $NOVA_CONF DEFAULT
+        setup_colorized_logging $NOVA_CONF
     else
         # Show user_name and project_name instead of user_id and project_id
         iniset $NOVA_CONF DEFAULT logging_user_identity_format "%(user_name)s %(project_name)s"

From 9751be66fa45681d069af200632515c3693833d0 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 5 Apr 2016 12:08:57 -0400
Subject: [PATCH 0777/2409] unify logging setup on all services

This provides a single setup_logging function which builds consistent
colorization if the config supports it, otherwise builds the identity
strings that we need to actually keep track of requests.

Change-Id: Iffe30326a5b974ad141aed6288f61e0d6fd18ca9
---
 functions          | 18 ++++++++++++++++++
 lib/cinder         |  7 +------
 lib/glance         |  8 +++-----
 lib/neutron-legacy |  7 +------
 lib/nova           |  8 ++------
 5 files changed, 25 insertions(+), 23 deletions(-)

diff --git a/functions b/functions
index 3e0e0d5559..89ee3672d3 100644
--- a/functions
+++ b/functions
@@ -569,6 +569,19 @@ function vercmp {
     esac
 }
 
+# This sets up defaults we like in devstack for logging for tracking
+# down issues, and makes sure everything is done the same between
+# projects.
+function setup_logging {
+    local conf_file=$1
+    local other_cond=${2:-"False"}
+    if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ] && [ "$other_cond" == "False" ]; then
+        setup_colorized_logging $conf_file
+    else
+        setup_standard_logging_identity $conf_file
+    fi
+}
+
 # This function sets log formatting options for colorizing log
 # output to stdout. It is meant to be called by lib modules.
 # The last two parameters are optional and can be used to specify
@@ -588,6 +601,11 @@ function setup_colorized_logging {
     iniset $conf_file $conf_section logging_exception_prefix "%(color)s%(asctime)s.%(msecs)03d TRACE %(name)s %(instance)s"
 }
 
+function setup_standard_logging_identity {
+    local conf_file=$1
+    iniset $conf_file DEFAULT logging_user_identity_format "%(project_name)s %(user_name)s"
+}
+
 # These functions are provided for basic fall-back functionality for
 # projects that include parts of DevStack (Grenade).  stack.sh will
 # override these with more specific versions for DevStack (with fancy
diff --git a/lib/cinder b/lib/cinder
index cf5bb25cfe..870ee0b905 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -333,12 +333,7 @@ function configure_cinder {
     iniset $CINDER_CONF DEFAULT volume_clear $CINDER_VOLUME_CLEAR
 
     # Format logging
-    if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ] && [ "$CINDER_USE_MOD_WSGI" == "False" ]; then
-        setup_colorized_logging $CINDER_CONF
-    else
-        # Set req-id, project-name and resource in log format
-        iniset $CINDER_CONF DEFAULT logging_context_format_string "%(asctime)s.%(msecs)03d %(levelname)s %(name)s [%(request_id)s %(project_name)s] %(resource)s%(message)s"
-    fi
+    setup_logging $CINDER_CONF $CINDER_USE_MOD_WSGI
 
     if [ "$CINDER_USE_MOD_WSGI" == "True" ]; then
         _cinder_config_apache_wsgi
diff --git a/lib/glance b/lib/glance
index 17361143df..26c41507ed 100644
--- a/lib/glance
+++ b/lib/glance
@@ -229,10 +229,8 @@ function configure_glance {
     fi
 
     # Format logging
-    if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ]; then
-        setup_colorized_logging $GLANCE_API_CONF
-        setup_colorized_logging $GLANCE_REGISTRY_CONF
-    fi
+    setup_logging $GLANCE_API_CONF
+    setup_logging $GLANCE_REGISTRY_CONF
 
     cp -p $GLANCE_DIR/etc/glance-registry-paste.ini $GLANCE_REGISTRY_PASTE_INI
 
@@ -273,7 +271,7 @@ function configure_glance {
     if is_service_enabled g-glare; then
         local dburl
         dburl=`database_connection_url glance`
-        setup_colorized_logging $GLANCE_GLARE_CONF
+        setup_logging $GLANCE_GLARE_CONF
         iniset $GLANCE_GLARE_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
         iniset $GLANCE_GLARE_CONF DEFAULT bind_host $GLANCE_SERVICE_LISTEN_ADDRESS
         iniset $GLANCE_GLARE_CONF DEFAULT bind_port $GLANCE_GLARE_PORT
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index cf59b2d6dd..5ec61f9645 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -732,12 +732,7 @@ function _configure_neutron_common {
     fi
 
     # Format logging
-    if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ]; then
-        setup_colorized_logging $NEUTRON_CONF
-    else
-        # Show user_name and project_name by default like in nova
-        iniset $NEUTRON_CONF DEFAULT logging_user_identity_format "%(user_name)s %(project_name)s"
-    fi
+    setup_logging $NEUTRON_CONF
 
     if is_service_enabled tls-proxy; then
         # Set the service port for a proxy to take the original
diff --git a/lib/nova b/lib/nova
index 617cf5c3aa..c47f81a530 100644
--- a/lib/nova
+++ b/lib/nova
@@ -519,12 +519,8 @@ function create_nova_conf {
         iniset $NOVA_CONF DEFAULT force_config_drive "$FORCE_CONFIG_DRIVE"
     fi
     # Format logging
-    if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ] && [ "$NOVA_USE_MOD_WSGI" == "False" ]  ; then
-        setup_colorized_logging $NOVA_CONF
-    else
-        # Show user_name and project_name instead of user_id and project_id
-        iniset $NOVA_CONF DEFAULT logging_user_identity_format "%(user_name)s %(project_name)s"
-    fi
+    setup_logging $NOVA_CONF $NOVA_USE_MOD_WSGI
+
     if [ "$NOVA_USE_MOD_WSGI" == "True" ]; then
         _config_nova_apache_wsgi
     fi

From fb1c7b51b57b11d263c8b08d4f12992fb58748cb Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 17 Jan 2017 12:17:48 -0500
Subject: [PATCH 0778/2409] remove obsolete s3 conf from nova.conf

Change-Id: If0b42c647382b739ee4f1d98ea0394ec7b171ebf
---
 lib/nova | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/lib/nova b/lib/nova
index 3e29c1320d..85561ca570 100644
--- a/lib/nova
+++ b/lib/nova
@@ -457,8 +457,6 @@ function create_nova_conf {
     iniset $NOVA_CONF DEFAULT scheduler_driver "$SCHEDULER"
     iniset $NOVA_CONF DEFAULT scheduler_default_filters "$FILTERS"
     iniset $NOVA_CONF DEFAULT default_floating_pool "$PUBLIC_NETWORK_NAME"
-    iniset $NOVA_CONF DEFAULT s3_host "$SERVICE_HOST"
-    iniset $NOVA_CONF DEFAULT s3_port "$S3_SERVICE_PORT"
     if [[ $SERVICE_IP_VERSION == 6 ]]; then
         iniset $NOVA_CONF DEFAULT my_ip "$HOST_IPV6"
         iniset $NOVA_CONF DEFAULT use_ipv6 "True"
@@ -468,7 +466,6 @@ function create_nova_conf {
     iniset $NOVA_CONF DEFAULT instance_name_template "${INSTANCE_NAME_PREFIX}%08x"
     iniset $NOVA_CONF DEFAULT osapi_compute_listen "$NOVA_SERVICE_LISTEN_ADDRESS"
     iniset $NOVA_CONF DEFAULT metadata_listen "$NOVA_SERVICE_LISTEN_ADDRESS"
-    iniset $NOVA_CONF DEFAULT s3_listen "$NOVA_SERVICE_LISTEN_ADDRESS"
 
     if is_fedora || is_suse; then
         # nova defaults to /usr/local/bin, but fedora and suse pip like to

From 465ee459867bc972fdd6568839db800a12289e05 Mon Sep 17 00:00:00 2001
From: Jianghua Wang <jianghua.wang@citrix.com>
Date: Tue, 8 Nov 2016 17:49:45 +0800
Subject: [PATCH 0779/2409] XenAPI: enable root_helper_daemon for XenServer

The daemon mode of root helper for XenAPI has been implemented by
this change which has been merged to neutron:
https://review.openstack.org/#/c/390931/
It will help to import the performance. Let's enable this mode
by default in devstack.

Change-Id: I52246bef3e4434dfc49446535b122580bc475ac3
---
 lib/neutron_plugins/openvswitch_agent | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/lib/neutron_plugins/openvswitch_agent b/lib/neutron_plugins/openvswitch_agent
index 76a1a4f3a1..c5c616a7df 100644
--- a/lib/neutron_plugins/openvswitch_agent
+++ b/lib/neutron_plugins/openvswitch_agent
@@ -81,8 +81,11 @@ function neutron_plugin_configure_plugin_agent {
         # integration bridge.  This is enabled by using a root wrapper
         # that executes commands on dom0 via a XenAPI plugin.
         # XenAPI does not support daemon rootwrap now, so set root_helper_daemon empty
-        iniset "/$Q_PLUGIN_CONF_FILE.domU" agent root_helper "$Q_RR_DOM0_COMMAND"
-        iniset "/$Q_PLUGIN_CONF_FILE.domU" agent root_helper_daemon ""
+        iniset "/$Q_PLUGIN_CONF_FILE.domU" agent root_helper ""
+        iniset "/$Q_PLUGIN_CONF_FILE.domU" agent root_helper_daemon "xenapi_root_helper"
+        iniset "/$Q_PLUGIN_CONF_FILE.domU" xenapi connection_url "$XENAPI_CONNECTION_URL"
+        iniset "/$Q_PLUGIN_CONF_FILE.domU" xenapi connection_username "$XENAPI_USER"
+        iniset "/$Q_PLUGIN_CONF_FILE.domU" xenapi connection_password "$XENAPI_PASSWORD"
 
         # Disable minimize polling, so that it can always detect OVS and Port changes
         # This is a problem of xenserver + neutron, bug has been reported

From 10db2b8e6559724673a3efc691c595f307eb12d6 Mon Sep 17 00:00:00 2001
From: Michelle Mandel <mmandel@us.ibm.com>
Date: Wed, 20 Jul 2016 11:39:42 -0400
Subject: [PATCH 0780/2409] Enable VNC console in tempest.conf

If the NoVNC service is enabled, enable vnc_console in tempest.conf.
This will allow tempest tests that interact with VNC to be executed.

Change-Id: Idb38a3b11e2f61f23adf1ec23c04ddccd72e7539
Depends-On: I09aed8de28f1ba2637382e870134ced38808df29
---
 lib/tempest | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index 331252267c..9f89dbe120 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -377,6 +377,10 @@ function configure_tempest {
         fi
     fi
 
+    if is_service_enabled n-novnc; then
+        iniset $TEMPEST_CONFIG compute-feature-enabled vnc_console True
+    fi
+
     # Network
     iniset $TEMPEST_CONFIG network api_version 2.0
     iniset $TEMPEST_CONFIG network project_networks_reachable false

From 5713497aa5819f240050fee05d047c480845a8cd Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Fri, 20 Jan 2017 09:01:49 -0500
Subject: [PATCH 0781/2409] Add discover_hosts.sh script

This adds a simple script to run the
'nova-manage cell_v2 discover_hosts'
command which will be used by
devstack-gate to discover the compute
hosts after devstack is fully setup.

This allows us to manage the branches
where this can run from devstack rather
than require branch logic in devstack-gate.

Change-Id: Icc595d60de373471aa7ee8fb9f3a81fc12d80438
Depends-On: I4823737246a8e9cc4eaebf67ff6bdba8bf42ab29
---
 tools/discover_hosts.sh | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)
 create mode 100755 tools/discover_hosts.sh

diff --git a/tools/discover_hosts.sh b/tools/discover_hosts.sh
new file mode 100755
index 0000000000..65966c3d04
--- /dev/null
+++ b/tools/discover_hosts.sh
@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+
+# **discover_hosts.sh**
+
+# This is just a very simple script to run the
+# "nova-manage cell_v2 discover_hosts" command
+# which is needed to discover compute nodes and
+# register them with a parent cell in Nova.
+# This assumes that /etc/nova/nova.conf exists
+# and has the following entries filled in:
+#
+# [api_database]
+# connection = This is the URL to the nova_api database
+#
+# In other words this should be run on the primary
+# (API) node in a multi-node setup.
+
+nova-manage cell_v2 discover_hosts --verbose

From 5c6aa56e11b2dc79adc70154187d3a029e8e0976 Mon Sep 17 00:00:00 2001
From: Mehdi Abaakouk <sileht@redhat.com>
Date: Thu, 26 Jan 2017 11:31:58 +0100
Subject: [PATCH 0782/2409] Don't assume nova-manage is present

tools/discover_hosts.sh is run by devstack-gate, and breaks all dsvm job
that doesn't use nova.

nova-manage is perhaps not installed if nova services are not enabled.

This change checks the presence of nova-.

Change-Id: Ic555d241f98d0fa027897c69a7115d1be88f6c96
---
 tools/discover_hosts.sh | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/tools/discover_hosts.sh b/tools/discover_hosts.sh
index 65966c3d04..4ec6a40511 100755
--- a/tools/discover_hosts.sh
+++ b/tools/discover_hosts.sh
@@ -15,4 +15,6 @@
 # In other words this should be run on the primary
 # (API) node in a multi-node setup.
 
-nova-manage cell_v2 discover_hosts --verbose
+if [[ -x $(which nova-manage) ]]; then
+    nova-manage cell_v2 discover_hosts --verbose
+fi

From e9a9fbef8fc29437d1f69727e2ab73c31e957488 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Mon, 30 Jan 2017 22:22:43 -0500
Subject: [PATCH 0783/2409] Don't run swap_volume tests in Tempest if cells v1
 is enabled

Cells v1 apparently doesn't support the swap volume API which
was recently enabled for testing in change:

92575baa6b010ec09fea3e715030da8be61c0c64

Rather than revert that change, we should just handle the cells
v1 case and not enable that test in that environment.

Change-Id: I80f52e8299641098d90d3c374a80770fc45b8122
Closes-Bug: #1660511
---
 lib/tempest | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index 050ac382c5..7cafadbf3f 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -516,8 +516,10 @@ function configure_tempest {
             iniset $TEMPEST_CONFIG compute-feature-enabled shelve False
             iniset $TEMPEST_CONFIG compute-feature-enabled snapshot False
             iniset $TEMPEST_CONFIG compute-feature-enabled suspend False
+        elif ! is_service_enabled n-cell; then
+            # cells v1 does not support swapping volumes
+            iniset $TEMPEST_CONFIG compute-feature-enabled swap_volume True
         fi
-        iniset $TEMPEST_CONFIG compute-feature-enabled swap_volume True
     fi
 
     # ``service_available``

From e1644ac1d86d4836ca26e89258b5aa6e93b9f770 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Tue, 31 Jan 2017 11:59:09 -0500
Subject: [PATCH 0784/2409] Remove OS_NO_CACHE from openrc

Nothing uses this variable either in devstack or libraries,
so it's dead code (at least on master), and we can remove it.

Change-Id: I5975c476ae5b26402c209d6e5746e7a5a5a91507
---
 openrc | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/openrc b/openrc
index d1c61297a1..483b5af387 100644
--- a/openrc
+++ b/openrc
@@ -53,10 +53,6 @@ export OS_USERNAME=${OS_USERNAME:-demo}
 # or NOVA_PASSWORD.
 export OS_PASSWORD=${ADMIN_PASSWORD:-secret}
 
-# Don't put the key into a keyring by default. Testing for development is much
-# easier with this off.
-export OS_NO_CACHE=${OS_NO_CACHE:-1}
-
 # Region
 export OS_REGION_NAME=${REGION_NAME:-RegionOne}
 

From ac5fdb4c4090efd682cc5c55aa30ec433da29fc7 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Tue, 31 Jan 2017 15:20:18 -0500
Subject: [PATCH 0785/2409] nova: call map_cell0 much earlier in the setup

The map_cell0 command creates a cell mapping record in the
nova_api database, and the nova-manage db sync command
will migrate the db schema for the nova_cell0 database. This
patch takes advantage of that by moving the map_cell0 call
much earlier in the setup process so we get the nova_cell0
db schema migrated at the same time as the main nova db.

This also removes the || true condition around map_cell0
since it's idempotent now due to fix:

aa7b6ebbb254f00fcb548832941ca9dbd3996d9f

Change-Id: Ice4fbb1771270c618b2acbc933d4fbfb6805df81
---
 lib/nova | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/lib/nova b/lib/nova
index 4d336f6271..ba9cac5161 100644
--- a/lib/nova
+++ b/lib/nova
@@ -683,9 +683,13 @@ function init_nova {
         recreate_database nova
         recreate_database nova_cell0
 
-        # Migrate nova database. If "nova-manage cell_v2 simple_cell_setup" has
-        # been run this migrates the "nova" and "nova_cell0" database.
-        # Otherwise it just migrates the "nova" database.
+        # map_cell0 will create the cell mapping record in the nova_api DB so
+        # this needs to come after the api_db sync happens. We also want to run
+        # this before the db sync below since that will migrate both the nova
+        # and nova_cell0 databases.
+        nova-manage cell_v2 map_cell0 --database_connection `database_connection_url nova_cell0`
+
+        # Migrate nova and nova_cell0 databases.
         $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF db sync
 
         if is_service_enabled n-cell; then
@@ -945,9 +949,6 @@ function create_flavors {
 
 # create_cell(): Group the available hosts into a cell
 function create_cell {
-    # NOTE(danms): map_cell0 always returns 1 right now; remove this when that is fixed
-    (nova-manage cell_v2 map_cell0 --database_connection `database_connection_url nova_cell0`|| true)
-
     if ! is_service_enabled n-cell; then
         nova-manage cell_v2 simple_cell_setup --transport-url $(get_transport_url)
     else

From 705b3785ca5383179c970c7d707bde9f69d96635 Mon Sep 17 00:00:00 2001
From: PranaliD <pdeore@redhat.com>
Date: Wed, 1 Feb 2017 11:32:09 +0530
Subject: [PATCH 0786/2409] Corrected router gateway set command

While configuring the external network as the default
router gateway for IPV6 in lib/neutron_plugins/services/l3,
"router" keyword is missing in the command.

Corrected the command.

Change-Id: I055bea5137a841f709d4865ec9a43d6b53f8f4c9
Closes-Bug: 1660712
---
 lib/neutron_plugins/services/l3 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index cd0c1ed59a..00b5a63756 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -385,7 +385,7 @@ function _neutron_configure_router_v6 {
     # If the external network has not already been set as the default router
     # gateway when configuring an IPv4 public subnet, do so now
     if [[ "$IP_VERSION" == "6" ]]; then
-        openstack --os-cloud devstack-admin --os-region "$REGION_NAME" set --external-gateway $EXT_NET_ID $ROUTER_ID
+        openstack --os-cloud devstack-admin --os-region "$REGION_NAME" router set --external-gateway $EXT_NET_ID $ROUTER_ID
     fi
 
     # This logic is specific to using the l3-agent for layer 3

From debc695ddfc8b7b2aeb53c01c624e15f69ed9fa2 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Wed, 1 Feb 2017 07:27:18 +0000
Subject: [PATCH 0787/2409] Updated from generate-devstack-plugins-list

Change-Id: Ia858ddf2e688903af2c76d532ddf7780bd591ef9
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 4cfbcb16ba..2721eda776 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -80,6 +80,7 @@ manila                                 `git://git.openstack.org/openstack/manila
 manila-ui                              `git://git.openstack.org/openstack/manila-ui <https://git.openstack.org/cgit/openstack/manila-ui>`__
 masakari                               `git://git.openstack.org/openstack/masakari <https://git.openstack.org/cgit/openstack/masakari>`__
 meteos                                 `git://git.openstack.org/openstack/meteos <https://git.openstack.org/cgit/openstack/meteos>`__
+meteos-ui                              `git://git.openstack.org/openstack/meteos-ui <https://git.openstack.org/cgit/openstack/meteos-ui>`__
 mistral                                `git://git.openstack.org/openstack/mistral <https://git.openstack.org/cgit/openstack/mistral>`__
 mixmatch                               `git://git.openstack.org/openstack/mixmatch <https://git.openstack.org/cgit/openstack/mixmatch>`__
 mogan                                  `git://git.openstack.org/openstack/mogan <https://git.openstack.org/cgit/openstack/mogan>`__

From 6d79ebcae10dddb804856e7838aa391749266ebb Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Thu, 2 Feb 2017 10:52:53 -0500
Subject: [PATCH 0788/2409] Add top memory consuming process to dstat output

Right now we under pressure because of increasing memory consumption in
dsvm jobs. So it'll be good to see which process is eating the most ram
at a given time. It may not end up being useful, but it doesn't hurt to
at least display just in case.

Change-Id: I096bf4b425db51358240335e41f6238d1ec1bb40
---
 tools/dstat.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/dstat.sh b/tools/dstat.sh
index 3c0b3be089..1c80fb70f8 100755
--- a/tools/dstat.sh
+++ b/tools/dstat.sh
@@ -13,7 +13,7 @@
 LOGDIR=$1
 
 # Command line arguments for primary DStat process.
-DSTAT_OPTS="-tcmndrylpg --top-cpu-adv --top-io-adv --swap"
+DSTAT_OPTS="-tcmndrylpg --top-cpu-adv --top-io-adv --top-mem --swap"
 
 # Command-line arguments for secondary background DStat process.
 DSTAT_CSV_OPTS="-tcmndrylpg --output $LOGDIR/dstat-csv.log"

From 06f2ea2b962ffafeb415770d7eec5ee7886ee3b5 Mon Sep 17 00:00:00 2001
From: Armando Migliaccio <armamig@gmail.com>
Date: Thu, 2 Feb 2017 16:47:00 -0800
Subject: [PATCH 0789/2409] Cut back on the number of workers ran for neutron

The dedicated RPC worker is overkill in single or multinode
devstack deployments. Also metadata API workers was left
default, which meant they were as many as the CPU cores.

Related-bug: 1656386

Change-Id: Ibbf7787dfa48e13a51f961f3e0ee2b8f49964759
---
 lib/neutron        | 1 +
 lib/neutron-legacy | 5 +++++
 2 files changed, 6 insertions(+)

diff --git a/lib/neutron b/lib/neutron
index f6c705c2b0..9b032b72e2 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -219,6 +219,7 @@ function configure_neutron_new {
 
         iniset $NEUTRON_META_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
         iniset $NEUTRON_META_CONF DEFAULT nova_metadata_ip $SERVICE_HOST
+        iniset $NEUTRON_META_CONF DEFAULT metadata_workers $API_WORKERS
         iniset $NEUTRON_META_CONF agent root_helper_daemon "$NEUTRON_ROOTWRAP_DAEMON_CMD"
 
         # TODO(dtroyer): remove the v2.0 hard code below
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 5ec61f9645..af91470e65 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -359,6 +359,10 @@ function configure_mutnauq {
     fi
 
     iniset $NEUTRON_CONF DEFAULT api_workers "$API_WORKERS"
+    # devstack is not a tool for running uber scale OpenStack
+    # clouds, therefore running without a dedicated RPC worker
+    # for state reports is more than adequate.
+    iniset $NEUTRON_CONF DEFAULT rpc_state_report_workers 0
 }
 
 function create_nova_conf_neutron {
@@ -788,6 +792,7 @@ function _configure_neutron_metadata_agent {
 
     iniset $Q_META_CONF_FILE DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
     iniset $Q_META_CONF_FILE DEFAULT nova_metadata_ip $Q_META_DATA_IP
+    iniset $Q_META_CONF_FILE DEFAULT metadata_workers $API_WORKERS
     iniset $Q_META_CONF_FILE AGENT root_helper "$Q_RR_COMMAND"
     if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
         iniset $Q_META_CONF_FILE AGENT root_helper_daemon "$Q_RR_DAEMON_COMMAND"

From 18682324856285743c7f2b54f1dc0523ea74a70f Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Wed, 28 Dec 2016 23:12:42 +0100
Subject: [PATCH 0790/2409] lib/tempest: Liberty EOL: remove the
 volume_services feature flag

Now that Liberty is EOLed, the feature flag is not needed anymore.

Change-Id: Ib82cb21edbda383d17f8cf69fedc884f2357fead
Depends-On: I7073106988a79aad19c6b95bb050d2eaf00c36c0
---
 lib/tempest | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 2efaebc694..5c1113130c 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -443,8 +443,7 @@ function configure_tempest {
         TEMPEST_VOLUME_MANAGE_SNAPSHOT=${TEMPEST_VOLUME_MANAGE_SNAPSHOT:-True}
     fi
     iniset $TEMPEST_CONFIG volume-feature-enabled manage_snapshot $(trueorfalse False TEMPEST_VOLUME_MANAGE_SNAPSHOT)
-    # TODO(ynesenenko): Remove the volume_services flag when Liberty and Kilo will correct work with host info.
-    iniset $TEMPEST_CONFIG volume-feature-enabled volume_services True
+
     # TODO(ameade): Remove the api_v3 flag when Mitaka and Liberty are end of life.
     iniset $TEMPEST_CONFIG volume-feature-enabled api_v3 True
     local tempest_volume_min_microversion=${TEMPEST_VOLUME_MIN_MICROVERSION:-None}

From 9d49ed983435cd0ff3791224dff47a4d51f0bf01 Mon Sep 17 00:00:00 2001
From: Joanna Taryma <joanna.taryma@intel.com>
Date: Mon, 6 Feb 2017 11:30:15 -0800
Subject: [PATCH 0791/2409] Added printing exit code of component process if it
 failed to start

When command failed and component failed to start, original exit code
was overwritten due to original command being executed in background.
This commit adds information about command's exit code to echoed message
about component's start up failure.

Change-Id: I8a3dd485b1b1f2d70d42c5610baac7c0c713f53a
Signed-off-by: Joanna Taryma <joanna.taryma@intel.com>
---
 functions-common | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index 8d32bb4148..be8b07b0f7 100644
--- a/functions-common
+++ b/functions-common
@@ -1552,7 +1552,7 @@ function screen_process {
     # Append the process to the screen rc file
     screen_rc "$name" "$command"
 
-    screen -S $SCREEN_NAME -p $name -X stuff "$command & echo \$! >$SERVICE_DIR/$SCREEN_NAME/${name}.pid; fg || echo \"$name failed to start\" | tee \"$SERVICE_DIR/$SCREEN_NAME/${name}.failure\"$NL"
+    screen -S $SCREEN_NAME -p $name -X stuff "$command & echo \$! >$SERVICE_DIR/$SCREEN_NAME/${name}.pid; fg || echo \"$name failed to start. Exit code: \$?\" | tee \"$SERVICE_DIR/$SCREEN_NAME/${name}.failure\"$NL"
 }
 
 # Screen rc file builder

From 09949e0dc61d9ef420b1528d0549092f88bc422a Mon Sep 17 00:00:00 2001
From: "John L. Villalovos" <john.l.villalovos@intel.com>
Date: Mon, 6 Feb 2017 13:46:32 -0800
Subject: [PATCH 0792/2409] worlddump: Use __future__ print_function

Commit e7361775c112e32ea517eddc344641897d273d25 changed the code to
use Python 3 style print function, but when doing 'print()' in Python
2.7 it would print '()':
    >>> print()
    ()

Import the __future__ print function so that a blank line will be
printed as expected. This will now work the same in Python 2 & 3.

Change-Id: I61742e107278f2327c18c9ab0de52d1914f16c97
---
 tools/worlddump.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/tools/worlddump.py b/tools/worlddump.py
index 1ce931efd5..1244dfbec3 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -17,6 +17,8 @@
 
 """Dump the state of the world for post mortem."""
 
+from __future__ import print_function
+
 import argparse
 import datetime
 from distutils import spawn

From fd406772975a4a16c8c510d8bb11b2097017347c Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Tue, 7 Feb 2017 14:43:32 +0100
Subject: [PATCH 0793/2409] lib/tempest: remove an unused network option

Tempest doesn't support the `api_version` config option for networking
anymore. I can't track which Tempest patch removed it, but it's been more
than 2 years.

Change-Id: I4012f470e8c317803203b6fa1e265600dbc49b3d
---
 lib/tempest | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index 2efaebc694..937436dc5c 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -382,7 +382,6 @@ function configure_tempest {
     fi
 
     # Network
-    iniset $TEMPEST_CONFIG network api_version 2.0
     iniset $TEMPEST_CONFIG network project_networks_reachable false
     iniset $TEMPEST_CONFIG network public_network_id "$public_network_id"
     iniset $TEMPEST_CONFIG network public_router_id "$public_router_id"

From 40aae6adbfce1bd896d5f7b0e281e798b56d1ca8 Mon Sep 17 00:00:00 2001
From: Hirofumi Ichihara <ichihara.hirofumi@lab.ntt.co.jp>
Date: Wed, 8 Feb 2017 00:08:53 +0900
Subject: [PATCH 0794/2409] Down PUBLIC_BRIDGE before trying to delete it

When cleanup devstack with linuxbridge, PUBLIC_BRIDGE should be
DOWN before trying to delete it.

Change-Id: I2d205cbe4d92a03ee5c376a23282d9880dd9a1df
Closes-Bug: #1662543
---
 lib/neutron_plugins/linuxbridge_agent | 1 +
 1 file changed, 1 insertion(+)
 mode change 100644 => 100755 lib/neutron_plugins/linuxbridge_agent

diff --git a/lib/neutron_plugins/linuxbridge_agent b/lib/neutron_plugins/linuxbridge_agent
old mode 100644
new mode 100755
index 0c8ccb8718..5885616951
--- a/lib/neutron_plugins/linuxbridge_agent
+++ b/lib/neutron_plugins/linuxbridge_agent
@@ -8,6 +8,7 @@ _XTRACE_NEUTRON_LB=$(set +o | grep xtrace)
 set +o xtrace
 
 function neutron_lb_cleanup {
+    sudo ip link set $PUBLIC_BRIDGE down
     sudo brctl delbr $PUBLIC_BRIDGE
 
     if [[ "$Q_ML2_TENANT_NETWORK_TYPE" = "vxlan" ]]; then

From 88b84094ec1e2a18b6edba91f510cae53bc9c821 Mon Sep 17 00:00:00 2001
From: Roman Podoliaka <rpodolyaka@mirantis.com>
Date: Tue, 7 Feb 2017 13:34:12 +0200
Subject: [PATCH 0795/2409] mysql: set default sql_mode to TRADITIONAL

We currently use a more permisive STRICT_ALL_TABLES mode, but that's
not what modern MySQL versions default to (i.e. TRADITIONAL):

https://dev.mysql.com/doc/refman/5.7/en/sql-mode.html#sql-mode-changes

(non-Devstack deployments will most likely use TRADITIONAL as well)

Due to the fact that we default to TRADITIONAL in oslo.db, this
produces annoying warnings on MySQL 5.7 versions we use in the gate:

    Warning: (3090, u"Changing sql mode 'NO_AUTO_CREATE_USER' is
              deprecated. It will be removed in a future release.")

https://git.openstack.org/cgit/openstack/oslo.db/tree/oslo_db/options.py#n49

Unlike STRICT_ALL_TABLES, TRADITIONAL mode includes NO_AUTO_CREATE_USER,
and MySQL emits this warning on switching it on:

https://dev.mysql.com/worklog/task/?id=8326

So we have two options here:

1) make oslo.db default to STRICT_ALL_TABLES
2) make Devstack default to TRADITIONAL

The latter seems to be more appropriate as:

1) it's what modern MySQL versions default to
2) it's what people are actually using, if they do not override the
   oslo.db default
3) it's more strict

Closes-Bug: #1652452

Change-Id: Ie6d823c9f8465ac9f2ce4825929d1a50438fab45
---
 lib/databases/mysql | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/databases/mysql b/lib/databases/mysql
index 89ae082c81..7bbcace399 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -94,7 +94,7 @@ function configure_database_mysql {
     # Change bind-address from localhost (127.0.0.1) to any (::) and
     # set default db type to InnoDB
     iniset -sudo $my_conf mysqld bind-address "$SERVICE_LISTEN_ADDRESS"
-    iniset -sudo $my_conf mysqld sql_mode STRICT_ALL_TABLES
+    iniset -sudo $my_conf mysqld sql_mode TRADITIONAL
     iniset -sudo $my_conf mysqld default-storage-engine InnoDB
     iniset -sudo $my_conf mysqld max_connections 1024
     iniset -sudo $my_conf mysqld query_cache_type OFF

From cfc3edc97c3075c800e8366e3ff4e1d21578caca Mon Sep 17 00:00:00 2001
From: Kevin Zhao <kevin.zhao@linaro.org>
Date: Wed, 8 Feb 2017 10:54:29 +0800
Subject: [PATCH 0796/2409] Add "--nvram" to virsh undefine domain when
 clean_nova

For the instance which has boot by uefi, we should use
virsh undefine --nvram to undefine it. Check the libvirt
version for whether it supports nvram and use new undefine
parameters since this parameters is compatible with those
instance which don't use uefi.

Closes-bug: #1612613

Change-Id: Ibca1450e965df1481e6cd6b0d597b4323d667e60
Signed-off-by: Kevin Zhao <kevin.zhao@linaro.org>
---
 lib/nova | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index 4d336f6271..5f7a658e6a 100644
--- a/lib/nova
+++ b/lib/nova
@@ -202,7 +202,10 @@ function cleanup_nova {
         instances=`sudo virsh list --all | grep $INSTANCE_NAME_PREFIX | sed "s/.*\($INSTANCE_NAME_PREFIX[0-9a-fA-F]*\).*/\1/g"`
         if [ ! "$instances" = "" ]; then
             echo $instances | xargs -n1 sudo virsh destroy || true
-            echo $instances | xargs -n1 sudo virsh undefine --managed-save || true
+            if ! xargs -n1 sudo virsh undefine --managed-save --nvram <<< $instances; then
+                # Can't delete with nvram flags, then just try without this flag
+                xargs -n1 sudo virsh undefine --managed-save <<< $instances
+            fi
         fi
 
         # Logout and delete iscsi sessions

From d9aaae95f2b84170bf35e037715e4963d89f940c Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 8 Feb 2017 07:49:26 -0500
Subject: [PATCH 0797/2409] Generate deprecation warning for postgresql

Change-Id: I599e6d84b70bb6a7718ae48dd0cfc91796af189e
---
 lib/databases/postgresql | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/databases/postgresql b/lib/databases/postgresql
index 1f347f5548..618834b550 100644
--- a/lib/databases/postgresql
+++ b/lib/databases/postgresql
@@ -95,6 +95,7 @@ function configure_database_postgresql {
 
 function install_database_postgresql {
     echo_summary "Installing postgresql"
+    deprecated "Use of postgresql in devstack is deprecated, and will be removed during the Pike cycle"
     local pgpass=$HOME/.pgpass
     if [[ ! -e $pgpass ]]; then
         cat <<EOF > $pgpass

From 26e5a00957768df61ed81bba7ba3011c97d1290b Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Wed, 8 Feb 2017 14:19:00 +0000
Subject: [PATCH 0798/2409] Updated from generate-devstack-plugins-list

Change-Id: I4cf11a25b1d107cc5ab9664cae47a5a13f7a2450
---
 doc/source/plugin-registry.rst | 1 -
 1 file changed, 1 deletion(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 2721eda776..17da67b816 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -123,7 +123,6 @@ neutron-fwaas                          `git://git.openstack.org/openstack/neutro
 neutron-lbaas                          `git://git.openstack.org/openstack/neutron-lbaas <https://git.openstack.org/cgit/openstack/neutron-lbaas>`__
 neutron-lbaas-dashboard                `git://git.openstack.org/openstack/neutron-lbaas-dashboard <https://git.openstack.org/cgit/openstack/neutron-lbaas-dashboard>`__
 neutron-vpnaas                         `git://git.openstack.org/openstack/neutron-vpnaas <https://git.openstack.org/cgit/openstack/neutron-vpnaas>`__
-nova-docker                            `git://git.openstack.org/openstack/nova-docker <https://git.openstack.org/cgit/openstack/nova-docker>`__
 nova-dpm                               `git://git.openstack.org/openstack/nova-dpm <https://git.openstack.org/cgit/openstack/nova-dpm>`__
 nova-lxd                               `git://git.openstack.org/openstack/nova-lxd <https://git.openstack.org/cgit/openstack/nova-lxd>`__
 nova-mksproxy                          `git://git.openstack.org/openstack/nova-mksproxy <https://git.openstack.org/cgit/openstack/nova-mksproxy>`__

From 999dd7e989ae850bec7158a0058c0d38893ecdae Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 9 Feb 2017 17:56:40 -0500
Subject: [PATCH 0799/2409] only apply ebtables race fix on trusty

Change-Id: Ifc83e7301d9d921ce9ceed349f116584ce03842b
---
 lib/nova_plugins/functions-libvirt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index 5e7695a2b2..47b054bc58 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -26,7 +26,7 @@ function install_libvirt {
         install_package qemu-system
         install_package libvirt-bin libvirt-dev
         pip_install_gr libvirt-python
-        if [[ "$EBTABLES_RACE_FIX" == "True" ]]; then
+        if [[ ${DISTRO} == "trusty" && ${EBTABLES_RACE_FIX} == "True" ]]; then
             # Work around for bug #1501558. We can remove this once we
             # get to a version of Ubuntu that has new enough libvirt.
             TOP_DIR=$TOP_DIR $TOP_DIR/tools/install_ebtables_workaround.sh

From 47bcf4fbcb6572cb72a8f4e268a09bf3edff23d8 Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Fri, 13 Jan 2017 18:27:38 +0000
Subject: [PATCH 0800/2409] Removed neutron_plugin_configure_debug_command
 functions

Those are not called by devstack anymore. This cleanup also gets rid of
code that attempts to set external_network_bridge to an empty value,
which triggers a deprecation warning for the option since it's going to
be removed in a next Neutron release.

Change-Id: I5adcbab877b4e8742522de81b1a85acfc33160d7
---
 lib/neutron_plugins/README.md            | 1 -
 lib/neutron_plugins/bigswitch_floodlight | 4 ----
 lib/neutron_plugins/brocade              | 4 ----
 lib/neutron_plugins/cisco                | 5 -----
 lib/neutron_plugins/linuxbridge_agent    | 4 ----
 lib/neutron_plugins/nuage                | 4 ----
 lib/neutron_plugins/openvswitch_agent    | 4 ----
 lib/neutron_plugins/ovs_base             | 8 --------
 8 files changed, 34 deletions(-)

diff --git a/lib/neutron_plugins/README.md b/lib/neutron_plugins/README.md
index f03000e7cb..ed40886fda 100644
--- a/lib/neutron_plugins/README.md
+++ b/lib/neutron_plugins/README.md
@@ -24,7 +24,6 @@ functions
 * ``neutron_plugin_configure_common`` :
   set plugin-specific variables, ``Q_PLUGIN_CONF_PATH``, ``Q_PLUGIN_CONF_FILENAME``,
   ``Q_PLUGIN_CLASS``
-* ``neutron_plugin_configure_debug_command``
 * ``neutron_plugin_configure_dhcp_agent``
 * ``neutron_plugin_configure_l3_agent``
 * ``neutron_plugin_configure_plugin_agent``
diff --git a/lib/neutron_plugins/bigswitch_floodlight b/lib/neutron_plugins/bigswitch_floodlight
index 586ded79b4..52c6ad58b5 100644
--- a/lib/neutron_plugins/bigswitch_floodlight
+++ b/lib/neutron_plugins/bigswitch_floodlight
@@ -26,10 +26,6 @@ function neutron_plugin_configure_common {
     BS_FL_CONTROLLER_TIMEOUT=${BS_FL_CONTROLLER_TIMEOUT:-10}
 }
 
-function neutron_plugin_configure_debug_command {
-    _neutron_ovs_base_configure_debug_command
-}
-
 function neutron_plugin_configure_dhcp_agent {
     :
 }
diff --git a/lib/neutron_plugins/brocade b/lib/neutron_plugins/brocade
index 6ba0a66c3f..1b42e7794e 100644
--- a/lib/neutron_plugins/brocade
+++ b/lib/neutron_plugins/brocade
@@ -49,10 +49,6 @@ function neutron_plugin_configure_service {
 
 }
 
-function neutron_plugin_configure_debug_command {
-    iniset $NEUTRON_TEST_CONFIG_FILE DEFAULT external_network_bridge
-}
-
 function neutron_plugin_configure_dhcp_agent {
     iniset $Q_DHCP_CONF_FILE DEFAULT dhcp_agent_manager neutron.agent.dhcp_agent.DhcpAgentWithStateReport
 }
diff --git a/lib/neutron_plugins/cisco b/lib/neutron_plugins/cisco
index fc2cb8ad17..b397169b59 100644
--- a/lib/neutron_plugins/cisco
+++ b/lib/neutron_plugins/cisco
@@ -45,7 +45,6 @@ source $TOP_DIR/lib/neutron_plugins/openvswitch
 _prefix_function neutron_plugin_create_nova_conf ovs
 _prefix_function neutron_plugin_install_agent_packages ovs
 _prefix_function neutron_plugin_configure_common ovs
-_prefix_function neutron_plugin_configure_debug_command ovs
 _prefix_function neutron_plugin_configure_dhcp_agent ovs
 _prefix_function neutron_plugin_configure_l3_agent ovs
 _prefix_function neutron_plugin_configure_plugin_agent ovs
@@ -83,10 +82,6 @@ function neutron_plugin_configure_common {
     Q_PLUGIN_CLASS="neutron.plugins.cisco.network_plugin.PluginV2"
 }
 
-function neutron_plugin_configure_debug_command {
-    :
-}
-
 function neutron_plugin_configure_dhcp_agent {
     iniset $Q_DHCP_CONF_FILE DEFAULT dhcp_agent_manager neutron.agent.dhcp_agent.DhcpAgentWithStateReport
 }
diff --git a/lib/neutron_plugins/linuxbridge_agent b/lib/neutron_plugins/linuxbridge_agent
index 5885616951..f1216377fa 100755
--- a/lib/neutron_plugins/linuxbridge_agent
+++ b/lib/neutron_plugins/linuxbridge_agent
@@ -39,10 +39,6 @@ function neutron_plugin_install_agent_packages {
     install_package bridge-utils
 }
 
-function neutron_plugin_configure_debug_command {
-    iniset $NEUTRON_TEST_CONFIG_FILE DEFAULT external_network_bridge
-}
-
 function neutron_plugin_configure_dhcp_agent {
     local conf_file=$1
     :
diff --git a/lib/neutron_plugins/nuage b/lib/neutron_plugins/nuage
index 61e634e453..1c04aaac9a 100644
--- a/lib/neutron_plugins/nuage
+++ b/lib/neutron_plugins/nuage
@@ -33,10 +33,6 @@ function neutron_plugin_configure_common {
     NUAGE_CNA_DEF_NETPART_NAME=${NUAGE_CNA_DEF_NETPART_NAME:-''}
 }
 
-function neutron_plugin_configure_debug_command {
-    :
-}
-
 function neutron_plugin_configure_dhcp_agent {
     :
 }
diff --git a/lib/neutron_plugins/openvswitch_agent b/lib/neutron_plugins/openvswitch_agent
index 76a1a4f3a1..61305e1779 100644
--- a/lib/neutron_plugins/openvswitch_agent
+++ b/lib/neutron_plugins/openvswitch_agent
@@ -23,10 +23,6 @@ function neutron_plugin_install_agent_packages {
     _neutron_ovs_base_install_agent_packages
 }
 
-function neutron_plugin_configure_debug_command {
-    _neutron_ovs_base_configure_debug_command
-}
-
 function neutron_plugin_configure_dhcp_agent {
     local conf_file=$1
     :
diff --git a/lib/neutron_plugins/ovs_base b/lib/neutron_plugins/ovs_base
index 62a4d00bcd..795d2bb5b2 100644
--- a/lib/neutron_plugins/ovs_base
+++ b/lib/neutron_plugins/ovs_base
@@ -77,14 +77,6 @@ function _neutron_ovs_base_install_agent_packages {
     fi
 }
 
-function _neutron_ovs_base_configure_debug_command {
-    if [ "$Q_USE_PROVIDERNET_FOR_PUBLIC" = "True" ]; then
-        iniset $NEUTRON_TEST_CONFIG_FILE DEFAULT external_network_bridge ""
-    else
-        iniset $NEUTRON_TEST_CONFIG_FILE DEFAULT external_network_bridge $PUBLIC_BRIDGE
-    fi
-}
-
 function _neutron_ovs_base_configure_firewall_driver {
     if [[ "$Q_USE_SECGROUP" == "True" ]]; then
         iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver iptables_hybrid

From 952ecb6fec87e98bf7677cd4b481a20a8ffe36aa Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Fri, 13 Jan 2017 18:30:19 +0000
Subject: [PATCH 0801/2409] Don't set external_network_bridge by default

Since the empty value is the default for the option, and when explcitly
set in config file, it triggers a deprecation warning for the option,
avoid setting it unless we actually need to override the new default
value.

Change-Id: If423114d7a52da29b97d1fb473a955d9d69a1a3e
---
 lib/neutron_plugins/brocade           | 1 -
 lib/neutron_plugins/linuxbridge_agent | 1 -
 lib/neutron_plugins/ovs_base          | 4 +---
 3 files changed, 1 insertion(+), 5 deletions(-)

diff --git a/lib/neutron_plugins/brocade b/lib/neutron_plugins/brocade
index 1b42e7794e..310b72e5ad 100644
--- a/lib/neutron_plugins/brocade
+++ b/lib/neutron_plugins/brocade
@@ -54,7 +54,6 @@ function neutron_plugin_configure_dhcp_agent {
 }
 
 function neutron_plugin_configure_l3_agent {
-    iniset $Q_L3_CONF_FILE DEFAULT external_network_bridge
     iniset $Q_L3_CONF_FILE DEFAULT l3_agent_manager neutron.agent.l3_agent.L3NATAgentWithStateReport
 }
 
diff --git a/lib/neutron_plugins/linuxbridge_agent b/lib/neutron_plugins/linuxbridge_agent
index f1216377fa..dfed49b5e4 100755
--- a/lib/neutron_plugins/linuxbridge_agent
+++ b/lib/neutron_plugins/linuxbridge_agent
@@ -48,7 +48,6 @@ function neutron_plugin_configure_l3_agent {
     local conf_file=$1
     sudo brctl addbr $PUBLIC_BRIDGE
     set_mtu $PUBLIC_BRIDGE $PUBLIC_BRIDGE_MTU
-    iniset $conf_file DEFAULT external_network_bridge
 }
 
 function neutron_plugin_configure_plugin_agent {
diff --git a/lib/neutron_plugins/ovs_base b/lib/neutron_plugins/ovs_base
index 795d2bb5b2..1a97001824 100644
--- a/lib/neutron_plugins/ovs_base
+++ b/lib/neutron_plugins/ovs_base
@@ -87,9 +87,7 @@ function _neutron_ovs_base_configure_firewall_driver {
 }
 
 function _neutron_ovs_base_configure_l3_agent {
-    if [ "$Q_USE_PROVIDERNET_FOR_PUBLIC" = "True" ]; then
-        iniset $Q_L3_CONF_FILE DEFAULT external_network_bridge ""
-    else
+    if [ "$Q_USE_PROVIDERNET_FOR_PUBLIC" != "True" ]; then
         iniset $Q_L3_CONF_FILE DEFAULT external_network_bridge $PUBLIC_BRIDGE
     fi
 

From e0a37cf21e43fbb4ba3f9f8fa5321a0a0e1bedf1 Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Fri, 10 Feb 2017 15:01:37 +0100
Subject: [PATCH 0802/2409] tls proxy: immediately close a connection to the
 backend

Force mod_proxy to immediately close a connection to the backend
after being used, and thus, disable its persistent connection and
pool for that backend.

Let's see if that helps fixing bug #1630664 (the
Connection aborted/ BadStatusLine thing).

We already have an ER query (in queries/1630664.yaml) that should show
whether this is effective.

Change-Id: I03b09f7df5c6e134ec4091a2f8dfe8ef614d1951
---
 lib/tls | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tls b/lib/tls
index 57b5e525ac..d96ca4f197 100644
--- a/lib/tls
+++ b/lib/tls
@@ -520,7 +520,7 @@ $listen_string
     SSLCertificateFile $DEVSTACK_CERT
 
     <Location />
-        ProxyPass http://$b_host:$b_port/ retry=5 nocanon
+        ProxyPass http://$b_host:$b_port/ retry=5 disablereuse=on keepalive=off nocanon
         ProxyPassReverse http://$b_host:$b_port/
     </Location>
     ErrorLog $APACHE_LOG_DIR/tls-proxy_error.log

From 9f2dcd333103553626db1924a019e151e3e7252e Mon Sep 17 00:00:00 2001
From: "Andrea Frittoli (andreaf)" <andrea.frittoli@hpe.com>
Date: Sun, 12 Feb 2017 22:14:15 +0000
Subject: [PATCH 0803/2409] Use the latest 0.3.5 version of CirrOS

This new version of CirrOS is built on top of 0.3 branch, so wrt
version 0.3.4 it includes only two commits:

- Cherry-pick of the fix for https://launchpad.net/bugs/1564948
- One extra fix to make the above working on 0.3

Cherry-picked commit is http://bazaar.launchpad.net/~cirros-dev/cirros/trunk/revision/366

A Tempest test for hard reboot in some cases hits the case where
host key are empty. This triggers bugs/1564948, i.e. the ssh
daemon does not start at all, and the Tempest test fails with
"connection refused", which is misleading.

The new version of CirrOS solves this problem as it ensure host
keys are generated if missing, and the sshd deamon started.

I tested the scenario of missing host keys in Iea74c63925be17a1df894c1a2c23f5ba2793e0c6
using a private build of what then became 0.3.5.

Change-Id: I5c154ec25555e768954538fc22b4f5d5975b2deb
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index d8d0ee4b3e..52a0ff9cb9 100644
--- a/stackrc
+++ b/stackrc
@@ -614,7 +614,7 @@ esac
 #IMAGE_URLS="http://smoser.brickies.net/ubuntu/ttylinux-uec/ttylinux-uec-amd64-11.2_2.6.35-15_1.tar.gz" # old ttylinux-uec image
 #IMAGE_URLS="http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img" # cirros full disk image
 
-CIRROS_VERSION=${CIRROS_VERSION:-"0.3.4"}
+CIRROS_VERSION=${CIRROS_VERSION:-"0.3.5"}
 CIRROS_ARCH=${CIRROS_ARCH:-"x86_64"}
 
 # Set default image based on ``VIRT_DRIVER`` and ``LIBVIRT_TYPE``, either of

From ee37d20f80d3a4871edd17a16c12e8ea5f0afadf Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 8 Feb 2017 11:24:31 -0500
Subject: [PATCH 0804/2409] pass role by name not id

Change-Id: Ie67758bed3563c9a46a5180eaa9c8d47721fffd8
---
 lib/keystone | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 474af8be1d..c1a6d43410 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -384,8 +384,7 @@ function create_keystone_accounts {
     admin_project=$(openstack project show "admin" -f value -c id)
     local admin_user
     admin_user=$(openstack user show "admin" -f value -c id)
-    local admin_role
-    admin_role=$(openstack role show "admin" -f value -c id)
+    local admin_role="admin"
 
     get_or_add_user_domain_role $admin_role $admin_user default
 
@@ -403,13 +402,20 @@ function create_keystone_accounts {
     get_or_create_role ResellerAdmin
 
     # The Member role is used by Horizon and Swift so we need to keep it:
-    local member_role
-    member_role=$(get_or_create_role "Member")
+    local member_role="member"
+
+    # Captial Member role is legacy hard coded in Horizon / Swift
+    # configs. Keep it around.
+    get_or_create_role "Member"
+
+    # The reality is that the rest of the roles listed below honestly
+    # should work by symbolic names.
+    get_or_create_role $member_role
 
     # another_role demonstrates that an arbitrary role may be created and used
     # TODO(sleepsonthefloor): show how this can be used for rbac in the future!
-    local another_role
-    another_role=$(get_or_create_role "anotherrole")
+    local another_role="anotherrole"
+    get_or_create_role $another_role
 
     # invisible project - admin can't see this one
     local invis_project

From 9ef346f59da92416b0e27ead8a846bc8dbd68c0b Mon Sep 17 00:00:00 2001
From: Attila Fazekas <afazekas@redhat.com>
Date: Mon, 13 Feb 2017 15:09:35 +0100
Subject: [PATCH 0805/2409] Using sudo in the Quick start section

Adding sudo to the example commands in the quick start section.

Also adding '-' as su argument in order to use
the stack user's env (home).

Change-Id: I23ab38104d05c3f4c8d48b55e66cf19dc4e4f90d
---
 doc/source/index.rst | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/doc/source/index.rst b/doc/source/index.rst
index b8dd506aab..edd6595da2 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -56,15 +56,15 @@ You can quickly create a separate `stack` user to run DevStack with
 
 ::
 
-   $ adduser stack
+   $ sudo adduser stack
 
 Since this user will be making many changes to your system, it should
 have sudo privileges:
 
 ::
 
-    $ echo "stack ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers
-    $ su stack
+    $ sudo tee <<<"stack ALL=(ALL) NOPASSWD: ALL" /etc/sudoers
+    $ sudo su - stack
 
 Download DevStack
 -----------------

From 11eb2017ef70a758c54cc984e90e445205886e7e Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 13 Feb 2017 16:16:59 -0500
Subject: [PATCH 0806/2409] simplify endpoints used in devstack

The proliferation of internal/admin endpoints is mostly legacy and
based on some specific deployment patterns. These are not used by
everyone, and for the devstack case aren't really that useful. We
should simplify our service catalog down to the minimum we need for
development.

Change-Id: Ided7a65c81b3a0b56f0184847fc82e17c29a771e
---
 functions-common   | 12 ++++++++----
 lib/cinder         |  6 ------
 lib/glance         |  4 ----
 lib/neutron        |  2 --
 lib/neutron-legacy |  2 --
 lib/nova           |  4 ----
 lib/placement      |  2 --
 lib/swift          |  3 +--
 8 files changed, 9 insertions(+), 26 deletions(-)

diff --git a/functions-common b/functions-common
index 8d32bb4148..f0940e57cf 100644
--- a/functions-common
+++ b/functions-common
@@ -992,7 +992,7 @@ function _get_or_create_endpoint_with_interface {
 }
 
 # Gets or creates endpoint
-# Usage: get_or_create_endpoint <service> <region> <publicurl> <adminurl> <internalurl>
+# Usage: get_or_create_endpoint <service> <region> <publicurl> [adminurl] [internalurl]
 function get_or_create_endpoint {
     # NOTE(jamielennnox): when converting to v3 endpoint creation we go from
     # creating one endpoint with multiple urls to multiple endpoints each with
@@ -1004,9 +1004,13 @@ function get_or_create_endpoint {
     # endpoints they need.
     local public_id
     public_id=$(_get_or_create_endpoint_with_interface $1 public $3 $2)
-    _get_or_create_endpoint_with_interface $1 admin $4 $2
-    _get_or_create_endpoint_with_interface $1 internal $5 $2
-
+    # only create admin/internal urls if provided content for them
+    if [[ -n "$4" ]]; then
+        _get_or_create_endpoint_with_interface $1 admin $4 $2
+    fi
+    if [[ -n "$5" ]]; then
+        _get_or_create_endpoint_with_interface $1 internal $5 $2
+    fi
     # return the public id to indicate success, and this is the endpoint most likely wanted
     echo $public_id
 }
diff --git a/lib/cinder b/lib/cinder
index 870ee0b905..24967d4151 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -395,24 +395,18 @@ function create_cinder_accounts {
         get_or_create_endpoint \
             "volume" \
             "$REGION_NAME" \
-            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/\$(project_id)s" \
-            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/\$(project_id)s" \
             "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/\$(project_id)s"
 
         get_or_create_service "cinderv2" "volumev2" "Cinder Volume Service V2"
         get_or_create_endpoint \
             "volumev2" \
             "$REGION_NAME" \
-            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v2/\$(project_id)s" \
-            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v2/\$(project_id)s" \
             "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v2/\$(project_id)s"
 
         get_or_create_service "cinderv3" "volumev3" "Cinder Volume Service V3"
         get_or_create_endpoint \
             "volumev3" \
             "$REGION_NAME" \
-            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v3/\$(project_id)s" \
-            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v3/\$(project_id)s" \
             "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v3/\$(project_id)s"
 
         configure_cinder_internal_tenant
diff --git a/lib/glance b/lib/glance
index 26c41507ed..58f1deff6f 100644
--- a/lib/glance
+++ b/lib/glance
@@ -314,8 +314,6 @@ function create_glance_accounts {
         get_or_create_endpoint \
             "image" \
             "$REGION_NAME" \
-            "$GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT" \
-            "$GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT" \
             "$GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT"
 
         # Note(frickler): Crude workaround for https://bugs.launchpad.net/glance-store/+bug/1620999
@@ -331,8 +329,6 @@ function create_glance_accounts {
 
         get_or_create_endpoint "artifact" \
             "$REGION_NAME" \
-            "$GLANCE_SERVICE_PROTOCOL://$GLANCE_GLARE_HOSTPORT" \
-            "$GLANCE_SERVICE_PROTOCOL://$GLANCE_GLARE_HOSTPORT" \
             "$GLANCE_SERVICE_PROTOCOL://$GLANCE_GLARE_HOSTPORT"
     fi
 }
diff --git a/lib/neutron b/lib/neutron
index 9b032b72e2..19568eaf25 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -330,8 +330,6 @@ function create_neutron_accounts_new {
             "network" "Neutron Service")
         get_or_create_endpoint $neutron_service \
             "$REGION_NAME" \
-            "$NEUTRON_SERVICE_PROTOCOL://$NEUTRON_SERVICE_HOST:$NEUTRON_SERVICE_PORT/" \
-            "$NEUTRON_SERVICE_PROTOCOL://$NEUTRON_SERVICE_HOST:$NEUTRON_SERVICE_PORT/" \
             "$NEUTRON_SERVICE_PROTOCOL://$NEUTRON_SERVICE_HOST:$NEUTRON_SERVICE_PORT/"
     fi
 }
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index af91470e65..b381b642c6 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -410,8 +410,6 @@ function create_mutnauq_accounts {
         get_or_create_endpoint \
             "network" \
             "$REGION_NAME" \
-            "$Q_PROTOCOL://$SERVICE_HOST:$Q_PORT/" \
-            "$Q_PROTOCOL://$SERVICE_HOST:$Q_PORT/" \
             "$Q_PROTOCOL://$SERVICE_HOST:$Q_PORT/"
     fi
 }
diff --git a/lib/nova b/lib/nova
index 4d336f6271..7c2fddbc75 100644
--- a/lib/nova
+++ b/lib/nova
@@ -407,16 +407,12 @@ function create_nova_accounts {
         get_or_create_endpoint \
             "compute_legacy" \
             "$REGION_NAME" \
-            "$nova_api_url/v2/\$(project_id)s" \
-            "$nova_api_url/v2/\$(project_id)s" \
             "$nova_api_url/v2/\$(project_id)s"
 
         get_or_create_service "nova" "compute" "Nova Compute Service"
         get_or_create_endpoint \
             "compute" \
             "$REGION_NAME" \
-            "$nova_api_url/v2.1" \
-            "$nova_api_url/v2.1" \
             "$nova_api_url/v2.1"
     fi
 
diff --git a/lib/placement b/lib/placement
index 871e282f32..e7ffe3330b 100644
--- a/lib/placement
+++ b/lib/placement
@@ -132,8 +132,6 @@ function create_placement_accounts {
     get_or_create_endpoint \
         "placement" \
         "$REGION_NAME" \
-        "$placement_api_url" \
-        "$placement_api_url" \
         "$placement_api_url"
 }
 
diff --git a/lib/swift b/lib/swift
index 03fd454dc6..5b510e5930 100644
--- a/lib/swift
+++ b/lib/swift
@@ -636,8 +636,7 @@ function create_swift_accounts {
         "object-store" \
         "$REGION_NAME" \
         "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$SWIFT_DEFAULT_BIND_PORT/v1/AUTH_\$(project_id)s" \
-        "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$SWIFT_DEFAULT_BIND_PORT" \
-        "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$SWIFT_DEFAULT_BIND_PORT/v1/AUTH_\$(project_id)s"
+        "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$SWIFT_DEFAULT_BIND_PORT"
 
     local swift_project_test1
     swift_project_test1=$(get_or_create_project swiftprojecttest1 default)

From bfff93e1568a236be26a8e6c67e758b877f55a2a Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 13 Feb 2017 16:18:08 -0500
Subject: [PATCH 0807/2409] remove keystone internal uri

There is really no reason to have an internal uri referenced for
keystone in devstack.

Change-Id: If0588a0ab512d94451992e7131dd3c8a33c5797c
---
 lib/keystone | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 474af8be1d..45f0fa4fff 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -654,8 +654,7 @@ function bootstrap_keystone {
         --bootstrap-service-name keystone \
         --bootstrap-region-id "$REGION_NAME" \
         --bootstrap-admin-url "$KEYSTONE_AUTH_URI" \
-        --bootstrap-public-url "$KEYSTONE_SERVICE_URI" \
-        --bootstrap-internal-url "$KEYSTONE_SERVICE_URI"
+        --bootstrap-public-url "$KEYSTONE_SERVICE_URI"
 }
 
 # Restore xtrace

From ff10ac318ce4be49d8bceafb7fea92ae1655b497 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Mon, 13 Feb 2017 12:44:24 -0500
Subject: [PATCH 0808/2409] Remove distro support based on new libvirt minimum

Nova is going to increase the minimum required libvirt
in Pike to 1.2.9 in change:

I9a972e3fde2e4e552f6fc98350820c07873c3de3

Based on the libvirt distro support matrix wiki [1] that
drops support for Ubuntu Trusty and Debian 7.0/Wheezy.

Trusty has libvirt 1.2.2 and Wheezy has 0.9.12 (the Wheezy
support should have been removed long ago apparently). The
7.0 removed here is for Wheezy also based on commit
b2ef890db3d78b24f9da2f4dd80502165c669ad0.

This does not undo the check for "trusty" with the
EBTABLES_RACE_FIX in lib/nova_plugins/function-libvirt
since you can still force devstack to run on Trusty if
you specify the FORCE=yes variable.

Note that RHEL 7.1 has libvirt 1.2.8 so it won't technically
work with devstack and nova + pike + libvirt, but with the
way os_RELEASE is calculated the minor version is dropped
for RHEL distros so we just get "rhel7".

Also note that this doesn't attempt to continue supporting
Trusty or Wheezy if nova is not configured to use libvirt,
simply in order to start moving forward on devstack distro
support in general and to keep some sanity and closeness
to what we test with in the CI system.

While we're in here, we also drop Fedora 23 and add
Ubuntu Zesty.

[1] https://wiki.openstack.org/wiki/LibvirtDistroSupportMatrix

Depends-On: I9a972e3fde2e4e552f6fc98350820c07873c3de3
Depends-On: If69f99bd789e646b0261e27a8a061efde32436f7

Change-Id: I6617283afd798af37e64913b7865cea3c8a62aba
---
 functions-common | 4 ++--
 stack.sh         | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/functions-common b/functions-common
index 8d32bb4148..f4171049c0 100644
--- a/functions-common
+++ b/functions-common
@@ -302,9 +302,9 @@ function warn {
 # such as "install_package" further abstract things in better ways.
 #
 # ``os_VENDOR`` - vendor name: ``Ubuntu``, ``Fedora``, etc
-# ``os_RELEASE`` - major release: ``14.04`` (Ubuntu), ``20`` (Fedora)
+# ``os_RELEASE`` - major release: ``16.04`` (Ubuntu), ``23`` (Fedora)
 # ``os_PACKAGE`` - package type: ``deb`` or ``rpm``
-# ``os_CODENAME`` - vendor's codename for release: ``trusty``
+# ``os_CODENAME`` - vendor's codename for release: ``xenial``
 
 declare os_VENDOR os_RELEASE os_PACKAGE os_CODENAME
 
diff --git a/stack.sh b/stack.sh
index 7d440a7c20..02bcc58c0a 100755
--- a/stack.sh
+++ b/stack.sh
@@ -12,7 +12,7 @@
 # a multi-node developer install.
 
 # To keep this script simple we assume you are running on a recent **Ubuntu**
-# (14.04 Trusty or newer), **Fedora** (F20 or newer), or **CentOS/RHEL**
+# (16.04 Xenial or newer), **Fedora** (F24 or newer), or **CentOS/RHEL**
 # (7 or newer) machine. (It may work on other platforms but support for those
 # platforms is left to those who added them to DevStack.) It should work in
 # a VM or physical server. Additionally, we maintain a list of ``deb`` and
@@ -192,7 +192,7 @@ source $TOP_DIR/stackrc
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (trusty|xenial|yakkety|7.0|wheezy|sid|testing|jessie|f23|f24|f25|rhel7|kvmibm1) ]]; then
+if [[ ! ${DISTRO} =~ (xenial|yakkety|zesty|sid|testing|jessie|f24|f25|rhel7|kvmibm1) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From 6fc332d85279865c32f50b081efb25ba7b671a9a Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Wed, 6 Jul 2016 13:44:55 -0400
Subject: [PATCH 0809/2409] Switch devstack to use qcow cirros img

This commit switches devstack to use the published qcow2 cirros image
instead of the AMI version. Using AMI was mostly a historical artifact
dating pretty far back, but in the real world no one really uses AMI
images with openstack clouds. This change reflects that and also
enables tempest ro remove its deprecated config options for using AMI
as a fallback on misconfiguration (which was just there to support
devstack's defaults)

Change-Id: Id65ebae73b28da7185cb349b714b659af51ef77f
---
 lib/tempest |  7 ++-----
 stackrc     | 12 ++++++------
 2 files changed, 8 insertions(+), 11 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 937436dc5c..108256ef81 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -415,14 +415,11 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG scenario img_disk_format vhd
         iniset $TEMPEST_CONFIG scenario img_container_format ovf
     else
-        SCENARIO_IMAGE_DIR=${SCENARIO_IMAGE_DIR:-$FILES/images/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-uec}
-        SCENARIO_IMAGE_FILE="cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img"
+        SCENARIO_IMAGE_DIR=${SCENARIO_IMAGE_DIR:-$FILES}
+        SCENARIO_IMAGE_FILE=$DEFAULT_IMAGE_NAME
     fi
     iniset $TEMPEST_CONFIG scenario img_dir $SCENARIO_IMAGE_DIR
     iniset $TEMPEST_CONFIG scenario img_file $SCENARIO_IMAGE_FILE
-    iniset $TEMPEST_CONFIG scenario ami_img_file "cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-blank.img"
-    iniset $TEMPEST_CONFIG scenario ari_img_file "cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-initrd"
-    iniset $TEMPEST_CONFIG scenario aki_img_file "cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-vmlinuz"
 
     # If using provider networking, use the physical network for validation rather than private
     TEMPEST_SSH_NETWORK_NAME=$PRIVATE_NETWORK_NAME
diff --git a/stackrc b/stackrc
index d8d0ee4b3e..b1c0825dd6 100644
--- a/stackrc
+++ b/stackrc
@@ -634,9 +634,9 @@ if [[ "$DOWNLOAD_DEFAULT_IMAGES" == "True" ]]; then
                 lxc) # the cirros root disk in the uec tarball is empty, so it will not work for lxc
                     DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-rootfs}
                     IMAGE_URLS+="http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-rootfs.img.gz";;
-                *) # otherwise, use the uec style image (with kernel, ramdisk, disk)
-                    DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-uec}
-                    IMAGE_URLS+="http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-uec.tar.gz";;
+                *) # otherwise, use the qcow image
+                    DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img}
+                    IMAGE_URLS+="http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img";;
                 esac
             ;;
         vsphere)
@@ -650,9 +650,9 @@ if [[ "$DOWNLOAD_DEFAULT_IMAGES" == "True" ]]; then
             # NOTE(lucasagomes): The logic setting the default image
             # now lives in the Ironic tree
             ;;
-        *) # Default to Cirros with kernel, ramdisk and disk image
-            DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-uec}
-            IMAGE_URLS+="http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-uec.tar.gz";;
+        *) # Default to Cirros qcow2 image file
+            DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img}
+            IMAGE_URLS+="http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img";;
     esac
     DOWNLOAD_DEFAULT_IMAGES=False
 fi

From bc3d01c8ec4f79c852b9cd2b0a7d679b2a777aa6 Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Tue, 14 Feb 2017 15:35:59 +0000
Subject: [PATCH 0810/2409] Revert "tls proxy: immediately close a connection
 to the backend"

This reverts commit e0a37cf21e43fbb4ba3f9f8fa5321a0a0e1bedf1.

This didn't help fixing bug #1630664. Issue seems to be between
client<--->Apache2, not between Apache2<--->eventlet

Change-Id: I092c1bbf0c5848b50fc9e491d1e9211451208a89
---
 lib/tls | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tls b/lib/tls
index d96ca4f197..57b5e525ac 100644
--- a/lib/tls
+++ b/lib/tls
@@ -520,7 +520,7 @@ $listen_string
     SSLCertificateFile $DEVSTACK_CERT
 
     <Location />
-        ProxyPass http://$b_host:$b_port/ retry=5 disablereuse=on keepalive=off nocanon
+        ProxyPass http://$b_host:$b_port/ retry=5 nocanon
         ProxyPassReverse http://$b_host:$b_port/
     </Location>
     ErrorLog $APACHE_LOG_DIR/tls-proxy_error.log

From 437092518172770c549dabafaf9f81e3766719ce Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Tue, 14 Feb 2017 16:48:20 +0100
Subject: [PATCH 0811/2409] TLS proxy: disable HTTP KeepAlive

There's a race condition when a client makes a request "at the same
time" the HTTP connection is being closed by Apache because the
`KeepAliveTimeout` is expired.

This is explained in detail and can be reproduce using
https://github.com/mikem23/keepalive-race or
https://github.com/JordanP/openstack-snippets/blob/master/keepalive-race/keep-alive-race.py

Just disable KeepAlive to fix the
('Connection aborted.', BadStatusLine("''",)) error we are seeing.

Change-Id: I46e9f70ee740ec7996c98d386d5289c1491e9436
---
 lib/tls | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/tls b/lib/tls
index d96ca4f197..e044066c6a 100644
--- a/lib/tls
+++ b/lib/tls
@@ -519,6 +519,10 @@ $listen_string
     SSLEngine On
     SSLCertificateFile $DEVSTACK_CERT
 
+    # Disable KeepAlive to fix bug #1630664 a.k.a the
+    # ('Connection aborted.', BadStatusLine("''",)) error
+    KeepAlive Off
+
     <Location />
         ProxyPass http://$b_host:$b_port/ retry=5 disablereuse=on keepalive=off nocanon
         ProxyPassReverse http://$b_host:$b_port/

From c6e6939e89a44a408065eb4585963175f8d0d6e3 Mon Sep 17 00:00:00 2001
From: "John L. Villalovos" <john.l.villalovos@intel.com>
Date: Mon, 6 Feb 2017 14:24:42 -0800
Subject: [PATCH 0812/2409] Fix error in 'ip netns' parsing

Sometimes when doing worlddump would see a command line like this:
 sudo ip netns exec (id: ip addr

This would cause an error to be seen in console.log:
  2017-02-07 00:03:03.659570 | /bin/sh: 1: Syntax error: "(" unexpected

This is caused by there sometimes being extra data returned from the
'ip netns' command [1]. For example it might look like:
    qrouter-0805fd7d-c493-4fa6-82ca-1c6c9b23cd9e (id: 1)
    qdhcp-bb2cc6ae-2ae8-474f-adda-a94059b872b5 (id: 0)

[1] https://lwn.net/Articles/629715/

Change-Id: Icece442023125ef55696b8d92a975d37e358b1b4
Closes-Bug: 1653969
---
 tools/worlddump.py | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/tools/worlddump.py b/tools/worlddump.py
index 1ce931efd5..8b418ede5a 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -151,7 +151,11 @@ def iptables_dump():
 def _netns_list():
     process = subprocess.Popen(['ip', 'netns'], stdout=subprocess.PIPE)
     stdout, _ = process.communicate()
-    return stdout.split()
+    # NOTE(jlvillal): Sometimes 'ip netns list' can return output like:
+    #   qrouter-0805fd7d-c493-4fa6-82ca-1c6c9b23cd9e (id: 1)
+    #   qdhcp-bb2cc6ae-2ae8-474f-adda-a94059b872b5 (id: 0)
+    output = [x.split()[0] for x in stdout.splitlines()]
+    return output
 
 
 def network_dump():

From 88312fa61f889307de85cd04b12250db57210470 Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Wed, 15 Feb 2017 16:48:04 +0100
Subject: [PATCH 0813/2409] Do not run cinder API V1 tests anymore by default

I think now is a good time to stop running Cinder V1 tests. It should
save quite some Infra resources and jobs should run faster too.

Also, remove some useless variables in lib/tempest.

Change-Id: I0edf1d88c136c3b910a5773690a603eeacb50266
---
 lib/tempest | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 937436dc5c..4cceda6942 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -48,10 +48,6 @@ TEMPEST_CONFIG_DIR=${TEMPEST_CONFIG_DIR:-$TEMPEST_DIR/etc}
 TEMPEST_CONFIG=$TEMPEST_CONFIG_DIR/tempest.conf
 TEMPEST_STATE_PATH=${TEMPEST_STATE_PATH:=$DATA_DIR/tempest}
 
-NOVA_SOURCE_DIR=$DEST/nova
-
-BUILD_INTERVAL=1
-
 # This is the timeout that tempest will wait for a VM to change state,
 # spawn, delete, etc.
 # The default is set to 196 seconds.
@@ -446,6 +442,7 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG volume-feature-enabled volume_services True
     # TODO(ameade): Remove the api_v3 flag when Mitaka and Liberty are end of life.
     iniset $TEMPEST_CONFIG volume-feature-enabled api_v3 True
+    iniset $TEMPEST_CONFIG volume-feature-enabled api_v1 $(trueorfalse False TEMPEST_VOLUME_API_V1)
     local tempest_volume_min_microversion=${TEMPEST_VOLUME_MIN_MICROVERSION:-None}
     local tempest_volume_max_microversion=${TEMPEST_VOLUME_MAX_MICROVERSION:-"latest"}
     if [ "$tempest_volume_min_microversion" == "None" ]; then

From 0b259c3abdafa99e7194e62c9a47483ddcf6b65a Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Fri, 17 Feb 2017 11:51:36 -0500
Subject: [PATCH 0814/2409] only set nova catalog if it's not the default

This ensures we only set the nova catalog when it's not the default,
instead of also putting defaults in devstack.

Change-Id: Ibb0dcb8bae2e9223db302d7b19e8fbee4ebbf0e3
---
 lib/cinder | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 24967d4151..767fd00d34 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -125,12 +125,6 @@ if is_service_enabled c-vol && [[ -n "$CINDER_ENABLED_BACKENDS" ]]; then
     done
 fi
 
-# Change the default nova_catalog_info and nova_catalog_admin_info values in
-# cinder so that the service name cinder is searching for matches that set for
-# nova in keystone.
-CINDER_NOVA_CATALOG_INFO=${CINDER_NOVA_CATALOG_INFO:-compute:nova:publicURL}
-CINDER_NOVA_CATALOG_ADMIN_INFO=${CINDER_NOVA_CATALOG_ADMIN_INFO:-compute:nova:adminURL}
-
 # Environment variables to configure the image-volume cache
 CINDER_IMG_CACHE_ENABLED=${CINDER_IMG_CACHE_ENABLED:-True}
 
@@ -268,8 +262,15 @@ function configure_cinder {
 
     configure_auth_token_middleware $CINDER_CONF cinder $CINDER_AUTH_CACHE_DIR
 
-    iniset $CINDER_CONF DEFAULT nova_catalog_info $CINDER_NOVA_CATALOG_INFO
-    iniset $CINDER_CONF DEFAULT nova_catalog_admin_info $CINDER_NOVA_CATALOG_ADMIN_INFO
+    # Change the default nova_catalog_info and nova_catalog_admin_info values in
+    # cinder so that the service name cinder is searching for matches that set for
+    # nova in keystone.
+    if [[ -n "$CINDER_NOVA_CATALOG_INFO" ]]; then
+        iniset $CINDER_CONF DEFAULT nova_catalog_info $CINDER_NOVA_CATALOG_INFO
+    fi
+    if [[ -n "$CINDER_NOVA_CATALOG_ADMIN_INFO" ]]; then
+        iniset $CINDER_CONF DEFAULT nova_catalog_admin_info $CINDER_NOVA_CATALOG_ADMIN_INFO
+    fi
 
     iniset $CINDER_CONF DEFAULT auth_strategy keystone
     iniset $CINDER_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL

From 6e49cab0913c13cb2fbf2620a9abe20cfc5f7ce3 Mon Sep 17 00:00:00 2001
From: Jianghua Wang <jianghua.wang@citrix.com>
Date: Wed, 22 Feb 2017 11:42:22 +0800
Subject: [PATCH 0815/2409] Xen: support Ubuntu Xenial for xen DevStack

Upgrade xen tool to install Ubuntu Xenial; change the upstart
task to systemd task to finish the OpenStack installation
by using devstack.

Change-Id: I8129923be3c41e7f60e9d32348a5ea8e07d4845b
---
 tools/xen/build_xva.sh                       | 78 ++++++++++----------
 tools/xen/install_os_domU.sh                 |  2 +-
 tools/xen/scripts/install_ubuntu_template.sh |  2 +-
 tools/xen/xenrc                              |  4 +-
 4 files changed, 42 insertions(+), 44 deletions(-)

diff --git a/tools/xen/build_xva.sh b/tools/xen/build_xva.sh
index 25bf58cb8a..34ef719ab9 100755
--- a/tools/xen/build_xva.sh
+++ b/tools/xen/build_xva.sh
@@ -96,48 +96,27 @@ mkdir -p $STAGING_DIR/opt/stack/devstack
 tar xf /tmp/devstack.tar -C $STAGING_DIR/opt/stack/devstack
 cd $TOP_DIR
 
-# Create an upstart job (task) for devstack, which can interact with the console
-cat >$STAGING_DIR/etc/init/devstack.conf << EOF
-start on stopped rc RUNLEVEL=[2345]
-
-console output
-task
-
-pre-start script
-    rm -f /opt/stack/runsh.succeeded
-end script
-
-script
-    initctl stop hvc0 || true
-
-    # Read any leftover characters from standard input
-    while read -n 1 -s -t 0.1 -r ignored; do
-        true
-    done
-
-    clear
-
-    chown -R $STACK_USER /opt/stack
-
-    su -c "/opt/stack/run.sh" $STACK_USER
-
-    # Update /etc/issue
-    {
-        echo "OpenStack VM - Installed by DevStack"
-        IPADDR=\$(ip -4 address show eth0 | sed -n 's/.*inet \\([0-9\.]\\+\\).*/\1/p')
-        echo "  Management IP:   \$IPADDR"
-        echo -n "  Devstack run:    "
-        if [ -e /opt/stack/runsh.succeeded ]; then
-            echo "SUCCEEDED"
-        else
-            echo "FAILED"
-        fi
-        echo ""
-    } > /etc/issue
-    initctl start hvc0 > /dev/null 2>&1
-end script
+# Create an systemd task for devstack
+cat >$STAGING_DIR/etc/systemd/system/devstack.service << EOF
+[Unit]
+Description=Install OpenStack by DevStack
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStartPre=/bin/rm -f /opt/stack/runsh.succeeded
+ExecStart=/bin/su -c "/opt/stack/run.sh" stack
+StandardOutput=tty
+StandardError=tty
+
+[Install]
+WantedBy=multi-user.target
+
 EOF
 
+# enable this service
+ln -s $STAGING_DIR/etc/systemd/system/devstack.service $STAGING_DIR/etc/systemd/system/multi-user.target.wants/devstack.service
+
 # Configure the hostname
 echo $GUEST_NAME > $STAGING_DIR/etc/hostname
 
@@ -178,6 +157,8 @@ set -eux
 (
   flock -n 9 || exit 1
 
+  sudo chown -R stack /opt/stack
+
   [ -e /opt/stack/runsh.succeeded ] && rm /opt/stack/runsh.succeeded
   echo \$\$ >> /opt/stack/run_sh.pid
 
@@ -187,7 +168,24 @@ set -eux
 
   # Got to the end - success
   touch /opt/stack/runsh.succeeded
+
+  # Update /etc/issue
+  (
+      echo "OpenStack VM - Installed by DevStack"
+      IPADDR=$(ip -4 address show eth0 | sed -n 's/.*inet \([0-9\.]\+\).*/\1/p')
+      echo "  Management IP:   $IPADDR"
+      echo -n "  Devstack run:    "
+      if [ -e /opt/stack/runsh.succeeded ]; then
+          echo "SUCCEEDED"
+      else
+          echo "FAILED"
+      fi
+      echo ""
+  ) > /opt/stack/issue
+  sudo cp /opt/stack/issue /etc/issue
+
   rm /opt/stack/run_sh.pid
 ) 9> /opt/stack/.runsh_lock
 EOF
+
 chmod 755 $STAGING_DIR/opt/stack/run.sh
diff --git a/tools/xen/install_os_domU.sh b/tools/xen/install_os_domU.sh
index 66b9eda474..d2e2c572c6 100755
--- a/tools/xen/install_os_domU.sh
+++ b/tools/xen/install_os_domU.sh
@@ -424,7 +424,7 @@ else
     echo "looking at the console of your domU / checking the log files."
     echo ""
     echo "ssh into your domU now: 'ssh stack@$OS_VM_MANAGEMENT_ADDRESS' using your password"
-    echo "and then do: 'sudo service devstack status' to check if devstack is still running."
+    echo "and then do: 'sudo systemctl status devstack' to check if devstack is still running."
     echo "Check that /opt/stack/runsh.succeeded exists"
     echo ""
     echo "When devstack completes, you can visit the OpenStack Dashboard"
diff --git a/tools/xen/scripts/install_ubuntu_template.sh b/tools/xen/scripts/install_ubuntu_template.sh
index d80ed095e8..6ea364255e 100755
--- a/tools/xen/scripts/install_ubuntu_template.sh
+++ b/tools/xen/scripts/install_ubuntu_template.sh
@@ -50,7 +50,7 @@ disk_size=$(($OSDOMU_VDI_GB * 1024 * 1024 * 1024))
 # however these need to be answered before the netinstall
 # is ready to fetch the preseed file, and as such must be here
 # to get a fully automated install
-pvargs="-- quiet console=hvc0 partman/default_filesystem=ext3 \
+pvargs="quiet console=hvc0 partman/default_filesystem=ext3 \
 console-setup/ask_detect=false locale=${UBUNTU_INST_LOCALE} \
 keyboard-configuration/layoutcode=${UBUNTU_INST_KEYBOARD} \
 netcfg/choose_interface=eth0 \
diff --git a/tools/xen/xenrc b/tools/xen/xenrc
index 2161247b76..60be02f3fe 100644
--- a/tools/xen/xenrc
+++ b/tools/xen/xenrc
@@ -63,8 +63,8 @@ PUB_IP=${PUB_IP:-172.24.4.10}
 PUB_NETMASK=${PUB_NETMASK:-255.255.255.0}
 
 # Ubuntu install settings
-UBUNTU_INST_RELEASE="trusty"
-UBUNTU_INST_TEMPLATE_NAME="Ubuntu 14.04 (64-bit) for DevStack"
+UBUNTU_INST_RELEASE="xenial"
+UBUNTU_INST_TEMPLATE_NAME="Ubuntu 16.04 (64-bit) for DevStack"
 # For 12.04 use "precise" and update template name
 # However, for 12.04, you should be using
 # XenServer 6.1 and later or XCP 1.6 or later

From 447f141d4f0e1b7be7f186714f18236c069b486e Mon Sep 17 00:00:00 2001
From: Ivan Kolodyazhny <e0ne@e0ne.info>
Date: Thu, 28 Jul 2016 18:42:25 +0300
Subject: [PATCH 0816/2409] Added support for fake drivers as Cinder backend

FakeLoggingVolumeDriver  will be used for functional Cinder tests to
prevent dependencies on any storage.

FakeGateDriver is based on LVM and will be used to run Tempest tests for
such features like CG's, replication, etc.

Depends-On: I383bcdb531c7d52c0fdbb6875de73f1274a92854
Change-Id: I2dc8ea416f5eb3fcc9d2e959533497e464220ff5
---
 lib/cinder_backends/fake      | 47 ++++++++++++++++++++++
 lib/cinder_backends/fake_gate | 74 +++++++++++++++++++++++++++++++++++
 2 files changed, 121 insertions(+)
 create mode 100644 lib/cinder_backends/fake
 create mode 100644 lib/cinder_backends/fake_gate

diff --git a/lib/cinder_backends/fake b/lib/cinder_backends/fake
new file mode 100644
index 0000000000..4749aced69
--- /dev/null
+++ b/lib/cinder_backends/fake
@@ -0,0 +1,47 @@
+#!/bin/bash
+#
+# lib/cinder_backends/fake
+# Configure the Fake backend
+
+# Enable with:
+#
+#   CINDER_ENABLED_BACKENDS+=,fake:fake
+
+# Dependencies:
+#
+# - ``functions`` file
+# - ``cinder`` configurations
+
+# CINDER_CONF
+
+# clean_cinder_backend_fake - called from clean_cinder()
+# configure_cinder_backend_fake - called from configure_cinder()
+# init_cinder_backend_fake - called from init_cinder()
+
+
+# Save trace setting
+_XTRACE_CINDER_FAKE=$(set +o | grep xtrace)
+set +o xtrace
+
+
+function cleanup_cinder_backend_fake {
+    local be_name=$1
+}
+
+function configure_cinder_backend_fake {
+    local be_name=$1
+
+    iniset $CINDER_CONF $be_name volume_backend_name $be_name
+    iniset $CINDER_CONF $be_name volume_driver "cinder.tests.fake_driver.FakeLoggingVolumeDriver"
+
+}
+
+function init_cinder_backend_fake {
+    local be_name=$1
+}
+
+# Restore xtrace
+$_XTRACE_CINDER_FAKE
+
+# mode: shell-script
+# End:
diff --git a/lib/cinder_backends/fake_gate b/lib/cinder_backends/fake_gate
new file mode 100644
index 0000000000..6b1f848790
--- /dev/null
+++ b/lib/cinder_backends/fake_gate
@@ -0,0 +1,74 @@
+#!/bin/bash
+#
+# lib/cinder_backends/lvm
+# Configure the LVM backend
+
+# Enable with:
+#
+#   CINDER_ENABLED_BACKENDS+=,fake_gate:lvmname
+
+# Dependencies:
+#
+# - ``functions`` file
+# - ``cinder`` configurations
+
+# CINDER_CONF
+# DATA_DIR
+# VOLUME_GROUP_NAME
+
+# clean_cinder_backend_lvm - called from clean_cinder()
+# configure_cinder_backend_lvm - called from configure_cinder()
+# init_cinder_backend_lvm - called from init_cinder()
+
+
+# Save trace setting
+_XTRACE_CINDER_LVM=$(set +o | grep xtrace)
+set +o xtrace
+
+
+# TODO: resurrect backing device...need to know how to set values
+#VOLUME_BACKING_DEVICE=${VOLUME_BACKING_DEVICE:-}
+
+# Entry Points
+# ------------
+
+# cleanup_cinder_backend_lvm - Delete volume group and remove backing file
+# cleanup_cinder_backend_lvm $be_name
+function cleanup_cinder_backend_lvm {
+    local be_name=$1
+
+    # Campsite rule: leave behind a volume group at least as clean as we found it
+    clean_lvm_volume_group $VOLUME_GROUP_NAME-$be_name
+    clean_lvm_filter
+}
+
+# configure_cinder_backend_lvm - Set config files, create data dirs, etc
+# configure_cinder_backend_lvm $be_name
+function configure_cinder_backend_lvm {
+    local be_name=$1
+
+    iniset $CINDER_CONF $be_name volume_backend_name $be_name
+    iniset $CINDER_CONF $be_name volume_driver "cinder.tests.fake_driver.FakeGateDriver"
+    iniset $CINDER_CONF $be_name volume_group $VOLUME_GROUP_NAME-$be_name
+    iniset $CINDER_CONF $be_name iscsi_helper "$CINDER_ISCSI_HELPER"
+    iniset $CINDER_CONF $be_name lvm_type "$CINDER_LVM_TYPE"
+
+    if [[ "$CINDER_VOLUME_CLEAR" == "non" ]]; then
+        iniset $CINDER_CONF $be_name volume_clear none
+    fi
+}
+
+# init_cinder_backend_lvm - Initialize volume group
+# init_cinder_backend_lvm $be_name
+function init_cinder_backend_lvm {
+    local be_name=$1
+
+    # Start with a clean volume group
+    init_lvm_volume_group $VOLUME_GROUP_NAME-$be_name $VOLUME_BACKING_FILE_SIZE
+}
+
+# Restore xtrace
+$_XTRACE_CINDER_LVM
+
+# mode: shell-script
+# End:

From ed887d8b9f91f8c75b45770d5c250b9939f36619 Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@midokura.com>
Date: Wed, 22 Feb 2017 14:21:33 -0500
Subject: [PATCH 0817/2409] lib/neutron: Fix conf handling

- Remove extra spaces
- Fix a missing space in the generated option string
- Fix a fatal typo

Change-Id: Ieca1c3e3c7e2ff59089ef45435e126ce7ff4f9b5
Closes-Bug: #1667073
---
 lib/neutron | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 19568eaf25..7d427555a4 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -395,9 +395,9 @@ function start_neutron_api {
         service_protocol="http"
     fi
 
-    local opts = ""
-    opts+="--config-file $NEUTRON_CONF"
-    opts+="--config-file $NEUTRON_CORE_PLUGIN_CONF"
+    local opts=""
+    opts+=" --config-file $NEUTRON_CONF"
+    opts+=" --config-file $NEUTRON_CORE_PLUGIN_CONF"
     local cfg_file
     for cfg_file in ${_NEUTRON_SERVER_EXTRA_CONF_FILES_ABS[@]}; do
         opts+=" --config-file $cfg_file"
@@ -405,7 +405,7 @@ function start_neutron_api {
 
     # Start the Neutron service
     # TODO(sc68cal) Stop hard coding this
-    run_process neutron-api "$NEUTRON_BIN_DIR/neutron-server $ops"
+    run_process neutron-api "$NEUTRON_BIN_DIR/neutron-server $opts"
 
     if is_ssl_enabled_service "neutron"; then
         ssl_ca="--ca-certificate=${SSL_BUNDLE_FILE}"

From 84e45c91434c3c7e6796f9a201fd9b0fb8f7adcd Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@midokura.com>
Date: Wed, 22 Feb 2017 14:25:14 -0500
Subject: [PATCH 0818/2409] lib/neutron: Fix an extra comma in service_plugins

Closes-Bug: #1667077
Change-Id: Ib63a94a931c38a7b2a5fc91a8339a9cd657f7927
---
 lib/neutron | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/lib/neutron b/lib/neutron
index 7d427555a4..f277062b32 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -510,7 +510,10 @@ function neutron_service_plugin_class_add_new {
     local plugins=""
 
     plugins=$(iniget $NEUTRON_CONF DEFAULT service_plugins)
-    plugins+=",${service_plugin_class}"
+    if [ $plugins ]; then
+        plugins+=","
+    fi
+    plugins+="${service_plugin_class}"
     iniset $NEUTRON_CONF DEFAULT service_plugins $plugins
 }
 

From f58b37356323262d9ce22815a4cf4e129195c679 Mon Sep 17 00:00:00 2001
From: Prashant Shetty <prashantshetty@vmware.com>
Date: Thu, 23 Feb 2017 13:48:12 +0000
Subject: [PATCH 0819/2409] Enable placement section on controller in multinode
 setup

Currently placement api section will be configured on controller
only if service n-cpu is running. It breaks multi node setup.
Closes-Bug: #1667219

Change-Id: I8b0f60f253859f704bb9831d7dac8f55df353ac7
---
 stack.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index 7d440a7c20..9a0cec601f 100755
--- a/stack.sh
+++ b/stack.sh
@@ -872,7 +872,7 @@ fi
 # if placement-api or placement-client is active, and n-cpu on the
 # same box.
 if is_service_enabled placement placement-client; then
-    if is_service_enabled n-cpu; then
+    if is_service_enabled n-cpu || is_service_enabled n-sch; then
         configure_placement_nova_compute
     fi
 fi

From 6f0205b03630ecb308877f65ca3d4ab9020bc28d Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Wed, 22 Feb 2017 05:59:30 -0800
Subject: [PATCH 0820/2409] Refactor rpc backend vhost creation

The creation of the cellsv1 rpc vhost was buried in the restart function,
which makes it hard to extend. This breaks it out into a helper method
and moves the conditional logic into the nova module itself.

Change-Id: Ib0e377aabe45c27bb6ce59ca275ce73085e8b9d2
---
 lib/nova        |  1 +
 lib/rpc_backend | 19 +++++++++++++------
 2 files changed, 14 insertions(+), 6 deletions(-)

diff --git a/lib/nova b/lib/nova
index 4c264209d5..f5ab20100e 100644
--- a/lib/nova
+++ b/lib/nova
@@ -644,6 +644,7 @@ function init_nova_cells {
     if is_service_enabled n-cell; then
         cp $NOVA_CONF $NOVA_CELLS_CONF
         iniset $NOVA_CELLS_CONF database connection `database_connection_url $NOVA_CELLS_DB`
+        rpc_backend_add_vhost child_cell
         iniset_rpc_backend nova $NOVA_CELLS_CONF DEFAULT child_cell
         iniset $NOVA_CELLS_CONF DEFAULT dhcpbridge_flagfile $NOVA_CELLS_CONF
         iniset $NOVA_CELLS_CONF cells enable True
diff --git a/lib/rpc_backend b/lib/rpc_backend
index a21f781b4e..3c1404e998 100644
--- a/lib/rpc_backend
+++ b/lib/rpc_backend
@@ -97,13 +97,20 @@ function restart_rpc_backend {
 
             break
         done
-        if is_service_enabled n-cell; then
-            # Add partitioned access for the child cell
-            if [ -z `sudo rabbitmqctl list_vhosts | grep child_cell` ]; then
-                sudo rabbitmqctl add_vhost child_cell
-                sudo rabbitmqctl set_permissions -p child_cell $RABBIT_USERID ".*" ".*" ".*"
-            fi
+    fi
+}
+
+# adds a vhost to the rpc backend
+function rpc_backend_add_vhost {
+    local vhost="$1"
+    if is_service_enabled rabbit; then
+        if [ -z `sudo rabbitmqctl list_vhosts | grep $vhost` ]; then
+            sudo rabbitmqctl add_vhost $vhost
+            sudo rabbitmqctl set_permissions -p $vhost $RABBIT_USERID ".*" ".*" ".*"
         fi
+    else
+        echo 'RPC backend does not support vhosts'
+        return 1
     fi
 }
 

From 615e115474a570a9d3b7f6edfec365d1bbd31dc3 Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Thu, 23 Feb 2017 10:41:51 +0000
Subject: [PATCH 0821/2409] lib/neutron: set variables needed for sane l3 agent
 setup

Since for the new devstack library we still rely on some functions from
ovs_base, we need to initialize them with sane default values so that
setup works as intended and as lib/neutron-legacy behaves by default for
external connectivity setup.

Change-Id: I412ed4f988b8e03a3e3a08066375b55a6e6aa3e6
---
 lib/neutron | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/lib/neutron b/lib/neutron
index d80e9d90a1..10f488de90 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -70,6 +70,14 @@ NEUTRON_ROOTWRAP=$(get_rootwrap_location neutron)
 NEUTRON_ROOTWRAP_CONF_FILE=$NEUTRON_CONF_DIR/rootwrap.conf
 NEUTRON_ROOTWRAP_DAEMON_CMD="sudo $NEUTRON_ROOTWRAP-daemon $NEUTRON_ROOTWRAP_CONF_FILE"
 
+# This is needed because _neutron_ovs_base_configure_l3_agent will set
+# external_network_bridge
+Q_USE_PROVIDERNET_FOR_PUBLIC=${Q_USE_PROVIDERNET_FOR_PUBLIC:-True}
+# This is needed because _neutron_ovs_base_configure_l3_agent uses it to create
+# an external network bridge
+PUBLIC_BRIDGE=${PUBLIC_BRIDGE:-br-ex}
+PUBLIC_BRIDGE_MTU=${PUBLIC_BRIDGE_MTU:-1500}
+
 # Additional neutron api config files
 declare -a _NEUTRON_SERVER_EXTRA_CONF_FILES_ABS
 

From bf697f50650beecea46b665b706fa5bb5ecb1ede Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Thu, 23 Feb 2017 12:09:01 +0000
Subject: [PATCH 0822/2409] lib/neutron: untangle metering configuration from
 legacy

The old code assumed _neutron_service_plugin_class_add presence, as well
as used a configuration file path that is not standard (under
/etc/neutron/services/ instead of /etc/neutron/metering_agent.ini).

The patch untangles metering configuration in the new library from that
old and bad code, and reimplements it inline.

This should help the effort to switch gate from lib/neutron-legacy to
lib/neutron.

Change-Id: I0d235498af4b6a70bd5dae6ea178d5aa8ba41e80
---
 lib/neutron | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index d80e9d90a1..1aabf04b8a 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -52,9 +52,13 @@ NEUTRON_CORE_PLUGIN_CONF_FILENAME=${NEUTRON_CORE_PLUGIN_CONF_FILENAME:-ml2_conf.
 NEUTRON_CORE_PLUGIN_CONF_PATH=$NEUTRON_CONF_DIR/plugins/$NEUTRON_CORE_PLUGIN
 NEUTRON_CORE_PLUGIN_CONF=$NEUTRON_CORE_PLUGIN_CONF_PATH/$NEUTRON_CORE_PLUGIN_CONF_FILENAME
 
+NEUTRON_METERING_AGENT_CONF_FILENAME=${NEUTRON_METERING_AGENT_CONF_FILENAME:-metering_agent.ini}
+NEUTRON_METERING_AGENT_CONF=$NEUTRON_CONF_DIR/$NEUTRON_METERING_AGENT_CONF_FILENAME
+
 NEUTRON_AGENT_BINARY=${NEUTRON_AGENT_BINARY:-neutron-$NEUTRON_AGENT-agent}
 NEUTRON_L3_BINARY=${NEUTRON_L3_BINARY:-neutron-l3-agent}
 NEUTRON_META_BINARY=${NEUTRON_META_BINARY:-neutron-metadata-agent}
+NEUTRON_METERING_BINARY=${NEUTRON_METERING_BINARY:-neutron-metering-agent}
 
 # Public facing bits
 if is_ssl_enabled_service "neutron" || is_service_enabled tls-proxy; then
@@ -251,9 +255,7 @@ function configure_neutron_new {
 
     # Metering
     if is_service_enabled neutron-metering; then
-        source $TOP_DIR/lib/neutron_plugins/services/metering
-        neutron_agent_metering_configure_common
-        neutron_agent_metering_configure_agent
+        cp $NEUTRON_DIR/etc/metering_agent.ini.sample $NEUTRON_METERING_AGENT_CONF
         neutron_service_plugin_class_add metering
     fi
 }
@@ -454,7 +456,7 @@ function start_neutron_new {
     fi
 
     if is_service_enabled neutron-metering; then
-        run_process neutron-metering "$AGENT_METERING_BINARY --config-file $NEUTRON_CONF --config-file $METERING_AGENT_CONF_FILENAME"
+        run_process neutron-metering "$NEUTRON_METERING_BINARY --config-file $NEUTRON_CONF --config-file $NEUTRON_METERING_AGENT_CONF"
     fi
 }
 

From 1d0841286e8eb4fbb18334cf664d89d78fef8efe Mon Sep 17 00:00:00 2001
From: Daniel Alvarez <dalvarez@redhat.com>
Date: Thu, 16 Feb 2017 09:38:13 +0000
Subject: [PATCH 0823/2409] Adding haproxy package to Neutron

This patch adds haproxy package to devstack as Neutron will rely on it
for serving metadata instead of the current Python implementation.

haproxy will reduce the memory footprint from ~50MB to ~1.5MB for
serving metadata. It will be spawned for every Neutron router so,
for large deployments, it will be a significant memory reduction.

Change-Id: I36a5531cacc21c0d4bb7f20d4bec6da65d04c262
---
 files/debs/neutron      | 1 +
 files/rpms-suse/neutron | 1 +
 files/rpms/neutron      | 1 +
 3 files changed, 3 insertions(+)

diff --git a/files/debs/neutron b/files/debs/neutron
index 2307fa54d5..e30f678f7a 100644
--- a/files/debs/neutron
+++ b/files/debs/neutron
@@ -2,6 +2,7 @@ acl
 dnsmasq-base
 dnsmasq-utils # for dhcp_release only available in dist:precise
 ebtables
+haproxy # to serve as metadata proxy inside router/dhcp namespaces
 iptables
 iputils-arping
 iputils-ping
diff --git a/files/rpms-suse/neutron b/files/rpms-suse/neutron
index e9abc6eca6..d1cc73f115 100644
--- a/files/rpms-suse/neutron
+++ b/files/rpms-suse/neutron
@@ -2,6 +2,7 @@ acl
 dnsmasq
 dnsmasq-utils # dist:opensuse-12.3,opensuse-13.1
 ebtables
+haproxy # to serve as metadata proxy inside router/dhcp namespaces
 iptables
 iputils
 mariadb # NOPRIME
diff --git a/files/rpms/neutron b/files/rpms/neutron
index 2e49a0cf93..a4e029a6eb 100644
--- a/files/rpms/neutron
+++ b/files/rpms/neutron
@@ -2,6 +2,7 @@ acl
 dnsmasq # for q-dhcp
 dnsmasq-utils # for dhcp_release
 ebtables
+haproxy # to serve as metadata proxy inside router/dhcp namespaces
 iptables
 iputils
 mysql-devel

From 79b55f51e4a2a44e7e2a7a8c7df435e3451a4e22 Mon Sep 17 00:00:00 2001
From: Gary Kotton <gkotton@vmware.com>
Date: Wed, 22 Feb 2017 07:00:59 -0800
Subject: [PATCH 0824/2409] Fix file permissions for
 lib/neutron_plugins/linuxbridge_agent

The permissions changed with commit
40aae6adbfce1bd896d5f7b0e281e798b56d1ca8

TrivialFix

Change-Id: I100cb9589309f9289b4581265a5e4206464ddc0e
---
 lib/neutron_plugins/linuxbridge_agent | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 mode change 100755 => 100644 lib/neutron_plugins/linuxbridge_agent

diff --git a/lib/neutron_plugins/linuxbridge_agent b/lib/neutron_plugins/linuxbridge_agent
old mode 100755
new mode 100644

From 807de8e5907f4bce8a697c194383d161b0e9c572 Mon Sep 17 00:00:00 2001
From: Mehdi Abaakouk <sileht@redhat.com>
Date: Fri, 24 Feb 2017 14:55:33 +0100
Subject: [PATCH 0825/2409] Set OS_AUTH_TYPE to password

Devstack configures keystone for auth mechanism but don't tell
keystoneauth1 library that it should use keystone too.

In simple case, this is not an issue because some application
set 'password' by default (like the openstack cli).

But applications can have no default or another default.

Change-Id: Idd1e1d2e7546fce7531175440788a8c7cb27aec1
---
 openrc | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/openrc b/openrc
index 483b5af387..7d5f0bbf3e 100644
--- a/openrc
+++ b/openrc
@@ -79,6 +79,9 @@ KEYSTONE_AUTH_HOST=${KEYSTONE_AUTH_HOST:-$SERVICE_HOST}
 # Identity API version
 export OS_IDENTITY_API_VERSION=${IDENTITY_API_VERSION:-3}
 
+# Ask keystoneauth1 to use keystone
+export OS_AUTH_TYPE=password
+
 # Authenticating against an OpenStack cloud using Keystone returns a **Token**
 # and **Service Catalog**.  The catalog contains the endpoints for all services
 # the user/project has access to - including nova, glance, keystone, swift, ...

From f069acf9ee4ecb0532d55158c99356faa4ff6fc9 Mon Sep 17 00:00:00 2001
From: Jens Rosenboom <j.rosenboom@x-ion.de>
Date: Fri, 24 Feb 2017 16:25:59 +0100
Subject: [PATCH 0826/2409] Make subnet pool names unique

Using the same name for two different subnet pools means that one needs
to reference them by their UUID. Choosing unique names will allow us to
use the name to reference the pool later on.

At the same time simplify the command used for pool creation by
instructing OSC to only output the value that we are interested in.

Change-Id: Idedcb6328925d44cdd0f415450ec4ebbc272401d
---
 lib/neutron_plugins/services/l3 | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index e87a30cadb..381162693d 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -87,7 +87,8 @@ PUBLIC_SUBNET_NAME=${PUBLIC_SUBNET_NAME:-"public-subnet"}
 
 # Subnetpool defaults
 USE_SUBNETPOOL=${USE_SUBNETPOOL:-True}
-SUBNETPOOL_NAME=${SUBNETPOOL_NAME:-"shared-default-subnetpool"}
+SUBNETPOOL_NAME_V4=${SUBNETPOOL_NAME:-"shared-default-subnetpool-v4"}
+SUBNETPOOL_NAME_V6=${SUBNETPOOL_NAME:-"shared-default-subnetpool-v6"}
 
 SUBNETPOOL_PREFIX_V4=${SUBNETPOOL_PREFIX_V4:-$IPV4_ADDRS_SAFE_TO_USE}
 SUBNETPOOL_PREFIX_V6=${SUBNETPOOL_PREFIX_V6:-$IPV6_ADDRS_SAFE_TO_USE}
@@ -169,10 +170,10 @@ function create_neutron_initial_network {
     if is_networking_extension_supported "auto-allocated-topology"; then
         if [[ "$USE_SUBNETPOOL" == "True" ]]; then
             if [[ "$IP_VERSION" =~ 4.* ]]; then
-                SUBNETPOOL_V4_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet pool create $SUBNETPOOL_NAME --default-prefix-length $SUBNETPOOL_SIZE_V4 --pool-prefix $SUBNETPOOL_PREFIX_V4 --share --default | grep ' id ' | get_field 2)
+                SUBNETPOOL_V4_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet pool create $SUBNETPOOL_NAME_V4 --default-prefix-length $SUBNETPOOL_SIZE_V4 --pool-prefix $SUBNETPOOL_PREFIX_V4 --share --default -f value -c id)
             fi
             if [[ "$IP_VERSION" =~ .*6 ]]; then
-                SUBNETPOOL_V6_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet pool create $SUBNETPOOL_NAME --default-prefix-length $SUBNETPOOL_SIZE_V6 --pool-prefix $SUBNETPOOL_PREFIX_V6 --share --default | grep ' id ' | get_field 2)
+                SUBNETPOOL_V6_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet pool create $SUBNETPOOL_NAME_V6 --default-prefix-length $SUBNETPOOL_SIZE_V6 --pool-prefix $SUBNETPOOL_PREFIX_V6 --share --default -f value -c id)
             fi
         fi
     fi

From a1875b1ffcf29a7c1645d8e21402da331c102b6e Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@midokura.com>
Date: Thu, 23 Feb 2017 05:44:22 +0900
Subject: [PATCH 0827/2409] neutron-legacy: Defer service_plugins configuration

This allows post-config phase to use neutron_service_plugin_class_add
so that devstack plugins can use it in the same way for both of
neutron-legacy and its "modern" counterpart, lib/neutron.

Closes-Bug: #1667037
Change-Id: I9068fd608e82e70db8d725f92269a26920efebcb
---
 lib/neutron-legacy | 13 ++++++++-----
 stack.sh           |  1 +
 2 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index b381b642c6..446c7144f5 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -20,6 +20,7 @@
 # - init_neutron_third_party
 # - start_neutron_third_party
 # - create_nova_conf_neutron
+# - configure_neutron_after_post_config
 # - start_neutron_service_and_check
 # - check_neutron_third_party_integration
 # - start_neutron_agents
@@ -331,7 +332,6 @@ function configure_mutnauq {
     _configure_neutron_common
     iniset_rpc_backend neutron $NEUTRON_CONF
 
-    # goes before q-svc to init Q_SERVICE_PLUGIN_CLASSES
     if is_service_enabled q-metering; then
         _configure_neutron_metering
     fi
@@ -464,6 +464,13 @@ function install_neutron_agent_packages_mutnauq {
     fi
 }
 
+# Finish neutron configuration
+function configure_neutron_after_post_config {
+    if [[ $Q_SERVICE_PLUGIN_CLASSES != '' ]]; then
+        iniset $NEUTRON_CONF DEFAULT service_plugins $Q_SERVICE_PLUGIN_CLASSES
+    fi
+}
+
 # Start running processes, including screen
 function start_neutron_service_and_check {
     local service_port=$Q_PORT
@@ -836,10 +843,6 @@ function _configure_neutron_service {
     # Update either configuration file with plugin
     iniset $NEUTRON_CONF DEFAULT core_plugin $Q_PLUGIN_CLASS
 
-    if [[ $Q_SERVICE_PLUGIN_CLASSES != '' ]]; then
-        iniset $NEUTRON_CONF DEFAULT service_plugins $Q_SERVICE_PLUGIN_CLASSES
-    fi
-
     iniset $NEUTRON_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
     iniset $NEUTRON_CONF oslo_policy policy_file $Q_POLICY_FILE
     iniset $NEUTRON_CONF DEFAULT allow_overlapping_ips $Q_ALLOW_OVERLAPPING_IP
diff --git a/stack.sh b/stack.sh
index 7d440a7c20..19b07ab06b 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1241,6 +1241,7 @@ if is_service_enabled neutron-api; then
     start_neutron_api
 elif is_service_enabled q-svc; then
     echo_summary "Starting Neutron"
+    configure_neutron_after_post_config
     start_neutron_service_and_check
 elif is_service_enabled $DATABASE_BACKENDS && is_service_enabled n-net; then
     NM_CONF=${NOVA_CONF}

From c043b6f8a84a575ea5cedc71499a81414a610e70 Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@midokura.com>
Date: Thu, 23 Feb 2017 22:30:08 -0500
Subject: [PATCH 0828/2409] lib/neutron: Add neutron_deploy_rootwrap_filters

Change-Id: Icfa2cfa662013324d38099b82ce0f58ed8377e60
---
 lib/neutron | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/lib/neutron b/lib/neutron
index f277062b32..c43cb674ba 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -521,6 +521,13 @@ function neutron_server_config_add_new {
     _NEUTRON_SERVER_EXTRA_CONF_FILES_ABS+=($1)
 }
 
+# neutron_deploy_rootwrap_filters() - deploy rootwrap filters
+function neutron_deploy_rootwrap_filters_new {
+    local srcdir=$1
+    sudo install -d -o root -g root -m 755 $NEUTRON_CONF_DIR/rootwrap.d
+    sudo install -o root -g root -m 644 $srcdir/etc/neutron/rootwrap.d/*.filters $NEUTRON_CONF_DIR/rootwrap.d
+}
+
 # Dispatch functions
 # These are needed for compatibility between the old and new implementations
 # where there are function name overlaps.  These will be removed when
@@ -626,5 +633,14 @@ function stop_neutron {
     fi
 }
 
+function neutron_deploy_rootwrap_filters {
+    if is_neutron_legacy_enabled; then
+        # Call back to old function
+        _neutron_deploy_rootwrap_filters "$@"
+    else
+        neutron_deploy_rootwrap_filters_new "$@"
+    fi
+}
+
 # Restore xtrace
 $XTRACE

From 3a6916e76811cbd1962636e4fe8016f79ed6028e Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Sat, 25 Feb 2017 05:12:38 +0000
Subject: [PATCH 0829/2409] Install same packages for neutron-* services as for
 q-*

This patch creates symlinks between neutron-* files tracking runtime
dependencies for services, and q-* files. Since lib/neutron is the
new recommended way to deploy neutron with devstack, this patch made
neutron-* files real files, while q-* files are just symlinks.

Change-Id: I0f361f31160d0fee40ad3e8de873edd05173e54e
---
 files/debs/neutron-agent      | 1 +
 files/debs/neutron-l3         | 3 +++
 files/debs/q-agt              | 2 +-
 files/debs/q-l3               | 4 +---
 files/rpms-suse/neutron-agent | 1 +
 files/rpms-suse/neutron-l3    | 2 ++
 files/rpms-suse/q-agt         | 2 +-
 files/rpms-suse/q-l3          | 3 +--
 files/rpms/neutron-agent      | 1 +
 files/rpms/neutron-l3         | 2 ++
 files/rpms/q-agt              | 2 +-
 files/rpms/q-l3               | 3 +--
 12 files changed, 16 insertions(+), 10 deletions(-)
 create mode 100644 files/debs/neutron-agent
 create mode 100644 files/debs/neutron-l3
 mode change 100644 => 120000 files/debs/q-agt
 mode change 100644 => 120000 files/debs/q-l3
 create mode 100644 files/rpms-suse/neutron-agent
 create mode 100644 files/rpms-suse/neutron-l3
 mode change 100644 => 120000 files/rpms-suse/q-agt
 mode change 100644 => 120000 files/rpms-suse/q-l3
 create mode 100644 files/rpms/neutron-agent
 create mode 100644 files/rpms/neutron-l3
 mode change 100644 => 120000 files/rpms/q-agt
 mode change 100644 => 120000 files/rpms/q-l3

diff --git a/files/debs/neutron-agent b/files/debs/neutron-agent
new file mode 100644
index 0000000000..ea8819e884
--- /dev/null
+++ b/files/debs/neutron-agent
@@ -0,0 +1 @@
+ipset
diff --git a/files/debs/neutron-l3 b/files/debs/neutron-l3
new file mode 100644
index 0000000000..106a6a35aa
--- /dev/null
+++ b/files/debs/neutron-l3
@@ -0,0 +1,3 @@
+conntrack
+conntrackd
+keepalived
diff --git a/files/debs/q-agt b/files/debs/q-agt
deleted file mode 100644
index ea8819e884..0000000000
--- a/files/debs/q-agt
+++ /dev/null
@@ -1 +0,0 @@
-ipset
diff --git a/files/debs/q-agt b/files/debs/q-agt
new file mode 120000
index 0000000000..99fe353094
--- /dev/null
+++ b/files/debs/q-agt
@@ -0,0 +1 @@
+neutron-agent
\ No newline at end of file
diff --git a/files/debs/q-l3 b/files/debs/q-l3
deleted file mode 100644
index 106a6a35aa..0000000000
--- a/files/debs/q-l3
+++ /dev/null
@@ -1,3 +0,0 @@
-conntrack
-conntrackd
-keepalived
diff --git a/files/debs/q-l3 b/files/debs/q-l3
new file mode 120000
index 0000000000..0a5ca2a45f
--- /dev/null
+++ b/files/debs/q-l3
@@ -0,0 +1 @@
+neutron-l3
\ No newline at end of file
diff --git a/files/rpms-suse/neutron-agent b/files/rpms-suse/neutron-agent
new file mode 100644
index 0000000000..ea8819e884
--- /dev/null
+++ b/files/rpms-suse/neutron-agent
@@ -0,0 +1 @@
+ipset
diff --git a/files/rpms-suse/neutron-l3 b/files/rpms-suse/neutron-l3
new file mode 100644
index 0000000000..a7a190c063
--- /dev/null
+++ b/files/rpms-suse/neutron-l3
@@ -0,0 +1,2 @@
+conntrack-tools
+keepalived
diff --git a/files/rpms-suse/q-agt b/files/rpms-suse/q-agt
deleted file mode 100644
index ea8819e884..0000000000
--- a/files/rpms-suse/q-agt
+++ /dev/null
@@ -1 +0,0 @@
-ipset
diff --git a/files/rpms-suse/q-agt b/files/rpms-suse/q-agt
new file mode 120000
index 0000000000..99fe353094
--- /dev/null
+++ b/files/rpms-suse/q-agt
@@ -0,0 +1 @@
+neutron-agent
\ No newline at end of file
diff --git a/files/rpms-suse/q-l3 b/files/rpms-suse/q-l3
deleted file mode 100644
index a7a190c063..0000000000
--- a/files/rpms-suse/q-l3
+++ /dev/null
@@ -1,2 +0,0 @@
-conntrack-tools
-keepalived
diff --git a/files/rpms-suse/q-l3 b/files/rpms-suse/q-l3
new file mode 120000
index 0000000000..0a5ca2a45f
--- /dev/null
+++ b/files/rpms-suse/q-l3
@@ -0,0 +1 @@
+neutron-l3
\ No newline at end of file
diff --git a/files/rpms/neutron-agent b/files/rpms/neutron-agent
new file mode 100644
index 0000000000..ea8819e884
--- /dev/null
+++ b/files/rpms/neutron-agent
@@ -0,0 +1 @@
+ipset
diff --git a/files/rpms/neutron-l3 b/files/rpms/neutron-l3
new file mode 100644
index 0000000000..a7a190c063
--- /dev/null
+++ b/files/rpms/neutron-l3
@@ -0,0 +1,2 @@
+conntrack-tools
+keepalived
diff --git a/files/rpms/q-agt b/files/rpms/q-agt
deleted file mode 100644
index ea8819e884..0000000000
--- a/files/rpms/q-agt
+++ /dev/null
@@ -1 +0,0 @@
-ipset
diff --git a/files/rpms/q-agt b/files/rpms/q-agt
new file mode 120000
index 0000000000..99fe353094
--- /dev/null
+++ b/files/rpms/q-agt
@@ -0,0 +1 @@
+neutron-agent
\ No newline at end of file
diff --git a/files/rpms/q-l3 b/files/rpms/q-l3
deleted file mode 100644
index a7a190c063..0000000000
--- a/files/rpms/q-l3
+++ /dev/null
@@ -1,2 +0,0 @@
-conntrack-tools
-keepalived
diff --git a/files/rpms/q-l3 b/files/rpms/q-l3
new file mode 120000
index 0000000000..0a5ca2a45f
--- /dev/null
+++ b/files/rpms/q-l3
@@ -0,0 +1 @@
+neutron-l3
\ No newline at end of file

From 1e7f738f284b85ed95d514fb13fbc1afb6b31087 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 27 Feb 2017 11:19:40 +1100
Subject: [PATCH 0830/2409] Ensure we install setuptools from requirements

Use pip_install_gr so we get the version pinned by requirements.  The
depends-on is an example of where we're trying to pin to workaround
issues.

Depends-On: I9c57c08a150571c5bb62235d502839394d53a4c1
Change-Id: I780cca681b12a3e9d228dbf2fd9fa6e8ab1a82e1
---
 tools/install_pip.sh | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index a5ccb19399..dbe52782a4 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -144,6 +144,9 @@ if [[ -n $PYPI_ALTERNATIVE_URL ]]; then
 fi
 
 set -x
-pip_install -U setuptools
+
+# Note setuptools is part of requirements.txt and we want to make sure
+# we obey any versioning as described there.
+pip_install_gr setuptools
 
 get_versions

From 52bb64105fd559ee69a8ec1c0733e1f7448401a5 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 27 Feb 2017 15:11:11 +1100
Subject: [PATCH 0831/2409] Use qemu-kvm-ev package on centos

For the latest qemu-kvm, you have to use the qemu-kvm-ev package,
which is based off the qemu-kvm-rhev package, which is explained in
[1] but you probably can't read it.  The gist is, that qemu-kvm-rhev
is a later build of kvm that is incompatible with the base version
provided.  qemu-kvm-rhev is only provided with the RHV (ovirt) and
RHOS (openstack) products.  CentOS rebuilds this package as
qemu-kvm-ev as part of it's virtualisation SIG.

I9a972e3fde2e4e552f6fc98350820c07873c3de3 has bumped up the minimum
qemu version to 2.1.0.  It seems there is a an issue (bug #1668164)
where having the qemu-system package installed gets picked up if
installed, and reports the incorrect version to nova, causing failure.

This removes the installs from files/rpms/nova as it is all being done
in function-libvirt.  We only install the qemu-kvm-ev package on
centos and remove the old work-around.

[1] https://access.redhat.com/solutions/629513
[2] https://wiki.centos.org/SpecialInterestGroup/Virtualization

Change-Id: Ide91b261f35fb19d8bd7155ca016fa3b76a45ea1
---
 files/rpms/nova                    |  5 -----
 lib/nova_plugins/functions-libvirt | 21 +++++++++++++--------
 2 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/files/rpms/nova b/files/rpms/nova
index 45f1c94f1f..a368c552aa 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -9,10 +9,6 @@ iptables
 iputils
 kernel-modules # dist:f23,f24,f25
 kpartx
-kvm # NOPRIME
-libvirt-bin # NOPRIME
-libvirt-devel # NOPRIME
-libvirt-python # NOPRIME
 libxml2-python
 m2crypto
 mysql-devel
@@ -21,7 +17,6 @@ mysql-server # NOPRIME
 numpy # needed by websockify for spice console
 parted
 polkit
-qemu-kvm # NOPRIME
 rabbitmq-server # NOPRIME
 sqlite
 sudo
diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index 47b054bc58..d225ef84fb 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -34,18 +34,23 @@ function install_libvirt {
         #pip_install_gr <there-si-no-guestfs-in-pypi>
     elif is_fedora || is_suse; then
         # On "KVM for IBM z Systems", kvm does not have its own package
-        if [[ ! ${DISTRO} =~ "kvmibm1" ]]; then
+        if [[ ! ${DISTRO} =~ "kvmibm1" && ! ${DISTRO} =~ "rhel7" ]]; then
             install_package kvm
         fi
-        # there is a dependency issue with kvm (which is really just a
-        # wrapper to qemu-system-x86) that leaves some bios files out,
-        # so install qemu-kvm (which shouldn't strictly be needed, as
-        # everything has been merged into qemu-system-x86) to bring in
-        # the right packages. see
-        # https://bugzilla.redhat.com/show_bug.cgi?id=1235890
-        install_package qemu-kvm
+
+        if [[ ${DISTRO} =~ "rhel7" ]]; then
+            # On centos7 install the qemu-kvm-ev package, which is a
+            # later version of qemu-kvm rebuilt from the qemu-kvm-rhev
+            # package by the virt SIG (as required by nova).  This
+            # package is only provided for RHOS (openstack) or RHV
+            # (ovirt) in RHEL.  We have already insalled the RDO
+            # repositories which provide this.
+            install_package qemu-kvm-ev
+        fi
+
         install_package libvirt libvirt-devel
         pip_install_gr libvirt-python
+
     fi
 }
 

From 0bf75a471ecce8c05718644e7e070b4d5a8657d6 Mon Sep 17 00:00:00 2001
From: Denis Buliga <dbuliga@cloudbasesolutions.com>
Date: Mon, 6 Feb 2017 16:56:46 +0200
Subject: [PATCH 0832/2409] Skips enabling kernel bridge firewall in container

Calling enable_kernel_bridge_firewall inside a
container, devstack will crash because it tries to
load a kernel module by calling 'sudo modprobe' on
net.bridge.

Change-Id: Id4718c065d5a8c507d49f38e19c2796a64221aa4
Closes-Bug: #1662194
---
 functions                             | 10 ++++++++++
 lib/neutron                           |  4 +++-
 lib/neutron_plugins/linuxbridge_agent |  4 +++-
 lib/neutron_plugins/ovs_base          |  4 +++-
 lib/nova                              |  4 +++-
 5 files changed, 22 insertions(+), 4 deletions(-)

diff --git a/functions b/functions
index 89ee3672d3..f262fbccc4 100644
--- a/functions
+++ b/functions
@@ -664,6 +664,16 @@ function set_mtu {
 }
 
 
+# running_in_container - Returns true otherwise false
+function running_in_container {
+    if grep -q lxc /proc/1/cgroup; then
+        return 0
+    fi
+
+    return 1
+}
+
+
 # enable_kernel_bridge_firewall - Enable kernel support for bridge firewalling
 function enable_kernel_bridge_firewall {
     # Load bridge module. This module provides access to firewall for bridged
diff --git a/lib/neutron b/lib/neutron
index f6c705c2b0..a43fdeb903 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -188,7 +188,9 @@ function configure_neutron_new {
             iniset $NEUTRON_CORE_PLUGIN_CONF ovs local_ip $HOST_IP
         fi
 
-        enable_kernel_bridge_firewall
+        if ! running_in_container; then
+            enable_kernel_bridge_firewall
+        fi
     fi
 
     # DHCP Agent
diff --git a/lib/neutron_plugins/linuxbridge_agent b/lib/neutron_plugins/linuxbridge_agent
index 0c8ccb8718..f031fc7c59 100644
--- a/lib/neutron_plugins/linuxbridge_agent
+++ b/lib/neutron_plugins/linuxbridge_agent
@@ -71,7 +71,9 @@ function neutron_plugin_configure_plugin_agent {
     fi
     if [[ "$Q_USE_SECGROUP" == "True" ]]; then
         iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver neutron.agent.linux.iptables_firewall.IptablesFirewallDriver
-        enable_kernel_bridge_firewall
+        if ! running_in_container; then
+            enable_kernel_bridge_firewall
+        fi
     else
         iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver neutron.agent.firewall.NoopFirewallDriver
     fi
diff --git a/lib/neutron_plugins/ovs_base b/lib/neutron_plugins/ovs_base
index 62a4d00bcd..733a5c13e2 100644
--- a/lib/neutron_plugins/ovs_base
+++ b/lib/neutron_plugins/ovs_base
@@ -88,7 +88,9 @@ function _neutron_ovs_base_configure_debug_command {
 function _neutron_ovs_base_configure_firewall_driver {
     if [[ "$Q_USE_SECGROUP" == "True" ]]; then
         iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver iptables_hybrid
-        enable_kernel_bridge_firewall
+        if ! running_in_container; then
+            enable_kernel_bridge_firewall
+        fi
     else
         iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver noop
     fi
diff --git a/lib/nova b/lib/nova
index 4d336f6271..d1c0d470a7 100644
--- a/lib/nova
+++ b/lib/nova
@@ -864,7 +864,9 @@ function start_nova_rest {
     run_process n-crt "$NOVA_BIN_DIR/nova-cert --config-file $api_cell_conf"
 
     if is_service_enabled n-net; then
-        enable_kernel_bridge_firewall
+        if ! running_in_container; then
+            enable_kernel_bridge_firewall
+        fi
     fi
     run_process n-net "$NOVA_BIN_DIR/nova-network --config-file $compute_cell_conf"
 

From 4af6eeac524f2ba316b0198a72ef8d916df9d56f Mon Sep 17 00:00:00 2001
From: Eli Qiao <liyong.qiao@intel.com>
Date: Tue, 28 Feb 2017 15:13:02 +0800
Subject: [PATCH 0833/2409] cinder: wait for cinder-api for wsgi too

Wait for cinder-api's status if CINDER_USE_MOD_WSGI=True

Change-Id: I40e5e08633572f877a25280496141423f232d447
---
 lib/cinder | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 767fd00d34..130345f560 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -528,10 +528,11 @@ function start_cinder {
         tail_log c-api /var/log/$APACHE_NAME/c-api.log
     else
         run_process c-api "$CINDER_BIN_DIR/cinder-api --config-file $CINDER_CONF"
-        echo "Waiting for Cinder API to start..."
-        if ! wait_for_service $SERVICE_TIMEOUT $service_protocol://$CINDER_SERVICE_HOST:$service_port; then
-            die $LINENO "c-api did not start"
-        fi
+    fi
+
+    echo "Waiting for Cinder API to start..."
+    if ! wait_for_service $SERVICE_TIMEOUT $service_protocol://$CINDER_SERVICE_HOST:$service_port; then
+        die $LINENO "c-api did not start"
     fi
 
     run_process c-sch "$CINDER_BIN_DIR/cinder-scheduler --config-file $CINDER_CONF"

From e624e48ddf8ba9e8bd12e1de5990ae74bb269922 Mon Sep 17 00:00:00 2001
From: Eli Qiao <liyong.qiao@intel.com>
Date: Tue, 28 Feb 2017 15:16:16 +0800
Subject: [PATCH 0834/2409] nova: Fix comments for _config_nova_apache_wsgi

Comments cleanup.

Change-Id: I02748b906f7bb75240bc4e5259005cd72ef49f6b
---
 lib/nova | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index f5ab20100e..b4a5fb143c 100644
--- a/lib/nova
+++ b/lib/nova
@@ -247,7 +247,7 @@ function _cleanup_nova_apache_wsgi {
     sudo rm -f $(apache_site_config_for nova-metadata)
 }
 
-# _config_nova_apache_wsgi() - Set WSGI config files of Keystone
+# _config_nova_apache_wsgi() - Set WSGI config files of Nova API
 function _config_nova_apache_wsgi {
     sudo mkdir -p $NOVA_WSGI_DIR
 

From 19f4b3faae5f64a497bf6c13fb29b65301ae499c Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Thu, 23 Feb 2017 20:44:18 +0000
Subject: [PATCH 0835/2409] lib/neutron: stop loading all config files into all
 processes

DHCP agent should not load core plugin config file; L3 agent has no
interest in metadata agent configuration file; etc. It's a mistake to
form a single global list of configuration files and pass it into all
processes. Every process should have its own list, that may or may not
have some files in common with other processes.

The only file that is common to all neutron processes is neutron.conf,
and we could in theory keep it into the common list. But I decided at
this point it's better to be explicit about what's loaded into services.
Also the order of arguments is important, and neutron.conf should always
be the first CLI argument, which is hard to achieve by keeping
neutron.conf file in the global list.

Plugins may be interested in loading additional files into neutron
processes. For example, dragonflow needs to load /etc/neutron/dragonflow.ini
into neutron-server. But we should not necessarily load all those files
into all processes, so such extendable lists should be per process.
Besides, neutron_server_config_add_new is already available to use to
append additional configuration files for neutron-server. That's why the
patch completely kills the NEUTRON_CONFIG_ARG variable.

Depends-On: I4bd54a41a45486a5601373f9a9cce74d7686d1aa
Change-Id: Ia3c3862399bba335db5edf9ea70f850fb2638d09
---
 lib/neutron | 40 ++++++----------------------------------
 1 file changed, 6 insertions(+), 34 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 19568eaf25..d80e9d90a1 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -70,9 +70,6 @@ NEUTRON_ROOTWRAP=$(get_rootwrap_location neutron)
 NEUTRON_ROOTWRAP_CONF_FILE=$NEUTRON_CONF_DIR/rootwrap.conf
 NEUTRON_ROOTWRAP_DAEMON_CMD="sudo $NEUTRON_ROOTWRAP-daemon $NEUTRON_ROOTWRAP_CONF_FILE"
 
-# Add all enabled config files to a single config arg
-NEUTRON_CONFIG_ARG=${NEUTRON_CONFIG_ARG:-""}
-
 # Additional neutron api config files
 declare -a _NEUTRON_SERVER_EXTRA_CONF_FILES_ABS
 
@@ -347,7 +344,7 @@ function init_neutron_new {
     recreate_database neutron
 
     # Run Neutron db migrations
-    $NEUTRON_BIN_DIR/neutron-db-manage $NEUTRON_CONFIG_ARG upgrade heads
+    $NEUTRON_BIN_DIR/neutron-db-manage upgrade heads
 
     create_neutron_cache_dir
 }
@@ -426,20 +423,19 @@ function start_neutron_api {
 
 # start_neutron() - Start running processes, including screen
 function start_neutron_new {
-    _set_config_files
-
     # Start up the neutron agents if enabled
     # TODO(sc68cal) Make this pluggable so different DevStack plugins for different Neutron plugins
     # can resolve the $NEUTRON_AGENT_BINARY
     if is_service_enabled neutron-agent; then
-        run_process neutron-agent "$NEUTRON_BIN_DIR/$NEUTRON_AGENT_BINARY $NEUTRON_CONFIG_ARG"
+        # TODO(ihrachys) stop loading ml2_conf.ini into agents, instead load agent specific files
+        run_process neutron-agent "$NEUTRON_BIN_DIR/$NEUTRON_AGENT_BINARY --config-file $NEUTRON_CONF --config-file $NEUTRON_CORE_PLUGIN_CONF"
     fi
     if is_service_enabled neutron-dhcp; then
         neutron_plugin_configure_dhcp_agent $NEUTRON_DHCP_CONF
-        run_process neutron-dhcp "$NEUTRON_BIN_DIR/$NEUTRON_DHCP_BINARY $NEUTRON_CONFIG_ARG"
+        run_process neutron-dhcp "$NEUTRON_BIN_DIR/$NEUTRON_DHCP_BINARY --config-file $NEUTRON_CONF --config-file $NEUTRON_DHCP_CONF"
     fi
     if is_service_enabled neutron-l3; then
-        run_process neutron-l3 "$NEUTRON_BIN_DIR/$NEUTRON_L3_BINARY $NEUTRON_CONFIG_ARG"
+        run_process neutron-l3 "$NEUTRON_BIN_DIR/$NEUTRON_L3_BINARY --config-file $NEUTRON_CONF --config-file $NEUTRON_L3_CONF"
     fi
     if is_service_enabled neutron-api; then
         # XXX(sc68cal) - Here's where plugins can wire up their own networks instead
@@ -454,7 +450,7 @@ function start_neutron_new {
         fi
     fi
     if is_service_enabled neutron-metadata-agent; then
-        run_process neutron-metadata-agent "$NEUTRON_BIN_DIR/$NEUTRON_META_BINARY $NEUTRON_CONFIG_ARG"
+        run_process neutron-metadata-agent "$NEUTRON_BIN_DIR/$NEUTRON_META_BINARY --config-file $NEUTRON_CONF --config-file $NEUTRON_META_CONF"
     fi
 
     if is_service_enabled neutron-metering; then
@@ -480,30 +476,6 @@ function stop_neutron_new {
     fi
 }
 
-# Compile the lost of enabled config files
-function _set_config_files {
-
-    NEUTRON_CONFIG_ARG+=" --config-file $NEUTRON_CONF"
-
-    #TODO(sc68cal) OVS and LB agent uses settings in NEUTRON_CORE_PLUGIN_CONF (ml2_conf.ini) but others may not
-    if is_service_enabled neutron-agent; then
-        NEUTRON_CONFIG_ARG+=" --config-file $NEUTRON_CORE_PLUGIN_CONF"
-    fi
-
-    if is_service_enabled neutron-dhcp; then
-        NEUTRON_CONFIG_ARG+=" --config-file $NEUTRON_DHCP_CONF"
-    fi
-
-    if is_service_enabled neutron-l3; then
-        NEUTRON_CONFIG_ARG+=" --config-file $NEUTRON_L3_CONF"
-    fi
-
-    if is_service_enabled neutron-metadata-agent; then
-        NEUTRON_CONFIG_ARG+=" --config-file $NEUTRON_META_CONF"
-    fi
-
-}
-
 # neutron_service_plugin_class_add() - add service plugin class
 function neutron_service_plugin_class_add_new {
     local service_plugin_class=$1

From 0b1ea080a256b02610f1c9a840a3c2a3f4ea0e68 Mon Sep 17 00:00:00 2001
From: Doug Hellmann <doug@doughellmann.com>
Date: Tue, 28 Feb 2017 14:04:59 -0500
Subject: [PATCH 0836/2409] install OSC with py3 by default

Add python-openstackclient to the list of packages installed under
Python 3 by default, so that jobs running with Python 3 exercise the
client that way.

Change-Id: I9778a6810bb3e4850132cfc19e583d50fed23ef5
Signed-off-by: Doug Hellmann <doug@doughellmann.com>
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 95f017b9b1..9673074a5e 100644
--- a/stackrc
+++ b/stackrc
@@ -109,7 +109,7 @@ export USE_PYTHON3=$(trueorfalse False USE_PYTHON3)
 # base name of the directory from which they are installed. See
 # enable_python3_package to edit this variable and use_python3_for to
 # test membership.
-export ENABLED_PYTHON3_PACKAGES="nova,glance,cinder,uwsgi"
+export ENABLED_PYTHON3_PACKAGES="nova,glance,cinder,uwsgi,python-openstackclient"
 
 # Explicitly list services not to run under Python 3. See
 # disable_python3_package to edit this variable.

From f119121d21fa0446197b26378091677daac1606a Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 16 Feb 2017 16:33:08 -0500
Subject: [PATCH 0837/2409] clean up virt drivers that we do image logic for

openvz is not in the nova tree, and is referencing a crazy old image,
we're going to assume that if anyone is using this they can build a
devstack plugin.

drop doing anything by default because this actually requires that we
special case things like ironic in tree to *not* do anything by
default.

Change-Id: I9d33b98263c3d52a95b9983e90eb0b341fa1d363
---
 stackrc | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/stackrc b/stackrc
index 95f017b9b1..97819d712b 100644
--- a/stackrc
+++ b/stackrc
@@ -636,9 +636,6 @@ if [[ "$DOWNLOAD_DEFAULT_IMAGES" == "True" ]]; then
         IMAGE_URLS+=","
     fi
     case "$VIRT_DRIVER" in
-        openvz)
-            DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-ubuntu-12.04-x86_64}
-            IMAGE_URLS+="http://download.openvz.org/template/precreated/ubuntu-12.04-x86_64.tar.gz";;
         libvirt)
             case "$LIBVIRT_TYPE" in
                 lxc) # the cirros root disk in the uec tarball is empty, so it will not work for lxc
@@ -656,13 +653,6 @@ if [[ "$DOWNLOAD_DEFAULT_IMAGES" == "True" ]]; then
             DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-0.3.4-x86_64-disk}
             IMAGE_URLS+="http://ca.downloads.xensource.com/OpenStack/cirros-0.3.4-x86_64-disk.vhd.tgz"
             IMAGE_URLS+=",http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-x86_64-uec.tar.gz";;
-        ironic)
-            # NOTE(lucasagomes): The logic setting the default image
-            # now lives in the Ironic tree
-            ;;
-        *) # Default to Cirros qcow2 image file
-            DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img}
-            IMAGE_URLS+="http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img";;
     esac
     DOWNLOAD_DEFAULT_IMAGES=False
 fi

From b1d8519b40845c3b28c32e530010aa015f970185 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Thu, 23 Feb 2017 08:01:32 -0800
Subject: [PATCH 0838/2409] Move rpc backend start/configure to earlier

Because things like nova may need to create vhosts in the rpc backend,
we need to have started and created credentials before we configure
the service.

Change-Id: I01c9c5288e197fc50a8a4a032e3a32cd166eb180
---
 stack.sh | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/stack.sh b/stack.sh
index 94315e1368..2f43db7418 100755
--- a/stack.sh
+++ b/stack.sh
@@ -761,6 +761,7 @@ install_infra
 run_phase stack pre-install
 
 install_rpc_backend
+restart_rpc_backend
 
 # NOTE(sdague): dlm install is conditional on one being enabled by configuration
 install_dlm
@@ -952,11 +953,6 @@ EOF
 fi
 
 
-# Finalize queue installation
-# ----------------------------
-restart_rpc_backend
-
-
 # Export Certificate Authority Bundle
 # -----------------------------------
 

From 94c400cc5428f24d96ed98678a988bd26485e63e Mon Sep 17 00:00:00 2001
From: Rodrigo Duarte Sousa <rduartes@redhat.com>
Date: Thu, 2 Feb 2017 14:48:28 -0300
Subject: [PATCH 0839/2409] Add allow_global_implied_dsr_disabled feature flag

This patch enabled the "allow_global_implied_dsr_disabled" feature
flag. This is a feature flag toggle for bug 1590578 which is fixed
in Newton and Ocata. This option can be removed after Mitaka is
end of life.

Change-Id: I70e3ce79ee6d9b00cc48bb178bd423d0196f6588
Related-Bug: #1590578
---
 lib/tempest | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index 128e9728fe..d95a9f5c3d 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -290,6 +290,10 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG identity-feature-enabled security_compliance True
     fi
 
+    # TODO(rodrigods): This is a feature flag for bug 1590578 which is fixed in
+    # Newton and Ocata. This option can be removed after Mitaka is end of life.
+    iniset $TEMPEST_CONFIG identity-feature-enabled forbid_global_implied_dsr True
+
     # Image
     # We want to be able to override this variable in the gate to avoid
     # doing an external HTTP fetch for this test.

From 008aa3e095904130e191f5867ec47d4cf53353da Mon Sep 17 00:00:00 2001
From: Evgeny Antyshev <eantyshev@virtuozzo.com>
Date: Thu, 2 Mar 2017 11:14:25 +0000
Subject: [PATCH 0840/2409] Fix install_libvirt for other RHEL-based distros

Since https://review.openstack.org/#/c/438325 landed
it only works for Centos 7, but not for other
RHEL-based distributions: Virtuozzo and, probably, RHEV.

Both of above have own version for qemu-kvm package: qemu-kvm-vz and qemu-kvm-rhev,
accordingly. These packages provide "qemu-kvm", like qemu-kvm-ev,
and, when you call "yum install qemu-kvm", they replace the default OS package.

Change-Id: I46da627c0da8925064862fdc283db81591979285
---
 lib/nova_plugins/functions-libvirt | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index d225ef84fb..56bb6bda1c 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -39,13 +39,11 @@ function install_libvirt {
         fi
 
         if [[ ${DISTRO} =~ "rhel7" ]]; then
-            # On centos7 install the qemu-kvm-ev package, which is a
-            # later version of qemu-kvm rebuilt from the qemu-kvm-rhev
-            # package by the virt SIG (as required by nova).  This
-            # package is only provided for RHOS (openstack) or RHV
-            # (ovirt) in RHEL.  We have already insalled the RDO
-            # repositories which provide this.
-            install_package qemu-kvm-ev
+            # This should install the latest qemu-kvm build,
+            # which is called qemu-kvm-ev in centos7
+            # (as the default OS qemu-kvm package is usually rather old,
+            # and should be updated by above)
+            install_package qemu-kvm
         fi
 
         install_package libvirt libvirt-devel

From 1e66388c5f2b81b4fc5d544dbf5fde2935218bd0 Mon Sep 17 00:00:00 2001
From: Amrith Kumar <amrith@amrith.org>
Date: Mon, 27 Feb 2017 13:29:03 -0500
Subject: [PATCH 0841/2409] put mysql on a memory diet

We propose several MySQL configuration parameter changes (with
explanations) to reduce the memory footprint of MySQL. A demonstration
of the improvement is provided in
https://etherpad.openstack.org/p/change-438668.

As Clint provided some of the descriptions that I've used, I have
listed him as a co-author (thanks Clint). Let this serve as a warning
to all that commetors may be enlisted :)

Change-Id: Icb2d6ea91d3d45a68ce99c817a746b10039479cc
Co-Authored-By: Clint 'SpamapS' Byrum <clint@fewbar.com>
---
 lib/databases/mysql | 183 +++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 182 insertions(+), 1 deletion(-)

diff --git a/lib/databases/mysql b/lib/databases/mysql
index 7bbcace399..e2c83433d2 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -96,10 +96,191 @@ function configure_database_mysql {
     iniset -sudo $my_conf mysqld bind-address "$SERVICE_LISTEN_ADDRESS"
     iniset -sudo $my_conf mysqld sql_mode TRADITIONAL
     iniset -sudo $my_conf mysqld default-storage-engine InnoDB
-    iniset -sudo $my_conf mysqld max_connections 1024
+
+    # the number of connections has been throttled to 256. In the
+    # event that the gate jobs report "Too many connections" it is
+    # indicative of a problem that could be the result of one of many
+    # things. For more details about debugging this error, refer
+    # https://dev.mysql.com/doc/refman/5.5/en/too-many-connections.html.
+    # Note that the problem may not ONLY be an issue with MySQL
+    # connections. If the number of fd's at the OS is too low, you
+    # could see errors manifest as MySQL "too many connections".
+    iniset -sudo $my_conf mysqld max_connections 256
     iniset -sudo $my_conf mysqld query_cache_type OFF
     iniset -sudo $my_conf mysqld query_cache_size 0
 
+    # Additional settings to put MySQL on a memory diet. These
+    # settings are used in conjunction with the cap on max_connections
+    # as the total memory used by MySQL can be simply viewed as
+    # fixed-allocations + max_connections * variable-allocations. A
+    # nifty tool to help with this is
+    # http://www.mysqlcalculator.com/. A short description of each of
+    # the settings follows.
+
+    # binlog_cache_size, determines the size of cache to hold changes
+    # to the binary log during a transaction, for each connection. For
+    # more details, refer
+    # https://dev.mysql.com/doc/refman/5.6/en/replication-options-binary-log.html#sysvar_binlog_cache_size
+    # When binary logging is enabled, a smaller binlog cache could
+    # result in more frequent flushes to the disk and a larger value
+    # would result in less flushes to the disk but higher memory
+    # usage. This however only has to do with large transactions; if
+    # you have a small transaction the binlog cache is necessarily
+    # flushed on a transaction commit. This is a per-connection cache.
+    iniset -sudo $my_conf mysqld binlog_cache_size 4K
+
+    # binlog_stmt_cache_size determines the size of cache to hold non
+    # transactional statements in the binary log. For more details,
+    # refer
+    # https://dev.mysql.com/doc/refman/5.6/en/replication-options-binary-log.html#sysvar_binlog_stmt_cache_size
+    # This cache holds changes to non-transactional tables (read:
+    # MyISAM) or any non-transactional statements which cause
+    # modifications to data (truncate is an example). These are
+    # written to disk immediately on completion of the statement or
+    # when the cache is full. If the cache is too small, you get
+    # frequent writes to the disk (flush) and if the cache is too
+    # large, it takes up more memory. This is a per-connection cache.
+    iniset -sudo $my_conf mysqld binlog_stmt_cache_size 4K
+
+    # bulk_insert_buffer_size for MyISAM tables that use a special
+    # cache for insert statements and load statements, this cache is
+    # used to optimize writes to the disk. If the value is set to 0,
+    # the optimization is disabled. For more details refer
+    # https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_bulk_insert_buffer_size
+    # We set this to 0 which could result in higher disk I/O (I/O on
+    # each insert block completion).
+    iniset -sudo $my_conf mysqld bulk_insert_buffer_size 0
+
+    # host_cache_size controls a DNS lookup optimization. For more
+    # details refer
+    # https://dev.mysql.com/doc/refman/5.6/en/host-cache.html
+    iniset -sudo $my_conf mysqld host_cache_size 0
+
+    # innodb_buffer_pool_size This is the size of the server wide
+    # buffer pool. It is the cache for all data blocks being used by
+    # the server and is managed as a LRU chain. Dirty blocks either
+    # age off the list or are forced off when the list is
+    # full. Setting this to 5MB (default 128MB) reduces the amount of
+    # memory used by the server and this will result in more disk I/O
+    # in cases where (a) there is considerable write activity that
+    # overwhelms the allocated cache, or (b) there is considerable
+    # read activity on a data set that exceeds the allocated
+    # cache. For more details, refer
+    # https://dev.mysql.com/doc/refman/5.6/en/innodb-parameters.html#sysvar_innodb_buffer_pool_size
+    iniset -sudo $my_conf mysqld innodb_buffer_pool_size 5M
+
+    # innodb_ft_cache_size and innodb_ft_total_cache_size control the
+    # per-connection full text search cache and the server wide
+    # maximum full text search cache. We should not be using full text
+    # search and the value is set to the minimum allowable. The former
+    # is a per-connection cache size and the latter is server
+    # wide. For more details, refer
+    # https://dev.mysql.com/doc/refman/5.7/en/innodb-parameters.html#sysvar_innodb_ft_cache_size
+    # and
+    # https://dev.mysql.com/doc/refman/5.7/en/innodb-parameters.html#sysvar_innodb_ft_total_cache_size
+    iniset -sudo $my_conf mysqld innodb_ft_cache_size 1600000
+    iniset -sudo $my_conf mysqld innodb_ft_total_cache_size 32000000
+
+    # innodb_log_buffer_size This buffer is used to buffer
+    # transactions in-memory before writing them to the innodb
+    # internal transaction log. Large transactions, or high amounts of
+    # concurrency, will cause the system to fill this faster and thus
+    # make the system more disk-bound. For more details, refer
+    # https://dev.mysql.com/doc/refman/5.7/en/innodb-parameters.html#sysvar_innodb_log_buffer_size
+    iniset -sudo $my_conf mysqld innodb_log_buffer_size 256K
+
+    # innodb_sort_buffer_size, This buffer is used for sorting when
+    # InnoDB is creating indexes. Could cause that to be slower, but
+    # only if tables are large. This is a per-connection setting. For
+    # more details, refer
+    # https://dev.mysql.com/doc/refman/5.7/en/innodb-parameters.html#sysvar_innodb_sort_buffer_size
+    iniset -sudo $my_conf mysqld innodb_sort_buffer_size 64K
+
+    # join_buffer_size, This buffer makes table and index scans
+    # faster. So this setting could make some queries more disk
+    # bound. This is a per-connection setting. For more details refer
+    # https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_join_buffer_size.
+    iniset -sudo $my_conf mysqld join_buffer_size 128
+
+    # key_buffer_size defines the index blocks used for MyISAM tables
+    # and shared between threads. This is a server wide setting. For
+    # more details see
+    # https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_key_buffer_size
+    iniset -sudo $my_conf mysqld key_buffer_size 8
+
+    # max_heap_table_size sets the maximum amount of memory for MEMORY
+    # tables (which we don't use). The value is set to 16k, the
+    # minimum allowed. For more details, see
+    # https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_max_heap_table_size
+    iniset -sudo $my_conf mysqld max_heap_table_size 16K
+
+    # net_buffer_length Each client has a buffer for incoming and
+    # outgoing data, both start with a size of net_buffer_length and
+    # can grow (in steps of 2x) upto a size of max_allowed_packet. For
+    # more details see
+    # https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_net_buffer_length
+    iniset -sudo $my_conf mysqld net_buffer_length 1K
+
+    # read_buffer_size, read_rnd_buffer_size are per-thread buffer
+    # used for scans on MyISAM tables. It is a per-connection setting
+    # and so we set it to the minimum value allowable. Same for
+    # read_rnd_buffer_size. For more details refer
+    # https://dev.mysql.com/doc/refman/5.6/en/server-system-variables.html#sysvar_read_buffer_size
+    # and
+    # https://dev.mysql.com/doc/refman/5.6/en/server-system-variables.html#sysvar_read_rnd_buffer_size
+    iniset -sudo $my_conf mysqld read_buffer_size 8200
+    iniset -sudo $my_conf mysqld read_rnd_buffer_size 8200
+
+    # sort_buffer_size when a sort is requested, it will be performed
+    # in memory in a buffer of this size (allocated per connection)
+    # and if the data exceeds this size it will spill to disk. The
+    # innodb and myisam variables are used in computing indices for
+    # tables using the specified storage engine. Since we don't
+    # dynamically reindex (except during upgrade) these values should
+    # never be material. Obviously performance of disk based sorts is
+    # worse than in memory sorts and therefore a high value here will
+    # improve sort performance for large data. For more details,
+    # refer:
+    # https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_sort_buffer_size
+    # and
+    # https://dev.mysql.com/doc/refman/5.7/en/innodb-parameters.html#sysvar_innodb_sort_buffer_size
+    # and
+    # https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_myisam_sort_buffer_size
+    iniset -sudo $my_conf mysqld sort_buffer_size 32K
+    iniset -sudo $my_conf mysqld innodb_sort_buffer_size 64K
+    iniset -sudo $my_conf mysqld myisam_sort_buffer_size 4K
+
+    # thread_cache_size specifies how many internal threads to cache
+    # for use with incoming connections. We set this to 0 whic means
+    # that each connection will cause a new thread to be created. This
+    # could cause connections to take marginally longer on os'es with
+    # slow pthread_create calls. For more details, refer
+    # https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_thread_cache_size
+    iniset -sudo $my_conf mysqld thread_cache_size 0
+
+    # thread_stack is the per connection stack size, the minimum is
+    # 128k and the default is 192k on 32bit and 256k on 64bit
+    # systems. We set this to 192k. Complex queries which require
+    # recursion, stored procedures or other memory intensive
+    # operations could exhaust this and generate a very characteristic
+    # failure ("stack overflow") which is cleanly detected and the
+    # query is killed. For more details see
+    # https://dev.mysql.com/doc/refman/5.6/en/server-system-variables.html#sysvar_thread_stack
+    iniset -sudo $my_conf mysqld thread_stack 196608
+
+    # tmp_table_size is the maximum size of an in-memory temporary
+    # table. Temporary tables are created by MySQL as part of a
+    # multi-step query plan. The actual size of the temp table will be
+    # the lesser of tmp_table_size and max_heap_table_size. If a
+    # temporary table exceeds this size, it will be spooled to disk
+    # using the internal_tmp_disk_storage_engine (default
+    # MyISAM). Queries that often generate in-memory temporary tables
+    # include queries that have sorts, distinct, or group by
+    # operations, also queries that perform IN joins. For more details
+    # see
+    # https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_tmp_table_size
+    iniset -sudo $my_conf mysqld tmp_table_size 1K
+
     if [[ "$DATABASE_QUERY_LOGGING" == "True" ]]; then
         echo_summary "Enabling MySQL query logging"
         if is_fedora; then

From 0ce4ba915bb6649884e1a3b6c72a8e879eb562f9 Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Fri, 24 Feb 2017 05:13:53 +0000
Subject: [PATCH 0842/2409] Use lib/keystone to configure [nova] section in
 neutron.conf

This simplifies neutron library code and makes it less prone to breakage
in the future. So far there are no specific known issues with existing
code per se, it works, still.

Change-Id: I28f1997d226baae902dae5ca8ee6cd4fd89efe31
---
 lib/neutron | 14 +-------------
 1 file changed, 1 insertion(+), 13 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index f277062b32..f9d044225f 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -153,15 +153,7 @@ function configure_neutron_new {
 
         iniset $NEUTRON_CONF DEFAULT auth_strategy $NEUTRON_AUTH_STRATEGY
         configure_auth_token_middleware $NEUTRON_CONF neutron $NEUTRON_AUTH_CACHE_DIR keystone_authtoken
-
-        iniset $NEUTRON_CONF nova auth_type password
-        iniset $NEUTRON_CONF nova auth_url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_AUTH_PORT/v3"
-        iniset $NEUTRON_CONF nova username nova
-        iniset $NEUTRON_CONF nova password $SERVICE_PASSWORD
-        iniset $NEUTRON_CONF nova user_domain_id default
-        iniset $NEUTRON_CONF nova project_name $SERVICE_TENANT_NAME
-        iniset $NEUTRON_CONF nova project_domain_id default
-        iniset $NEUTRON_CONF nova region_name $REGION_NAME
+        configure_auth_token_middleware $NEUTRON_CONF nova $NEUTRON_AUTH_CACHE_DIR nova
 
         # Configure VXLAN
         # TODO(sc68cal) not hardcode?
@@ -240,10 +232,6 @@ function configure_neutron_new {
         iniset $NEUTRON_CONF DEFAULT bind_port "$NEUTRON_SERVICE_PORT_INT"
     fi
 
-    if is_ssl_enabled_service "nova"; then
-        iniset $NEUTRON_CONF nova cafile $SSL_BUNDLE_FILE
-    fi
-
     if is_ssl_enabled_service "neutron"; then
         ensure_certificates NEUTRON
 

From f15224c740b880842e8d34e9a6c2ad08ba34448f Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Thu, 2 Mar 2017 12:45:47 -0500
Subject: [PATCH 0843/2409] Create cell1 cell before n-api starts

Change ac5fdb4c4090efd682cc5c55aa30ec433da29fc7 introduced
a problem for gnocchi CI because the deployments steps
are now:

1. create cell0
2. start nova-api (with multiple workers)
3. install ceilometer via extras
4. ceilometer calls nova-api to list servers; at this point
   nova-api getes the list of cells and caches them, which
   will just be cell0
5. create cell1 via simple_cell_setup which also discovers
   the n-cpu node so we can schedule instances
6. gnocchi tests create and list instances and at this point it hits
   an n-api worker that only has cell0 cached so it does not
   find some test servers it created and fails.

The cell0 and cell1 cells should be created in the nova_api db
before starting n-api so that when we first list instances, we
store both cells in the cache that's in n-api. This deployment
order is also how the nova docs describe rolling out cells v2
but the way we were doing this devstack wasn't following that,
or accounting for when devstack plugins are loaded via extras.

This change creates the main cell1 cell earlier in the setup
before n-api is started, and then changes to just run
discover_hosts at the end after n-cpu is running (which is what
simple_cell_setup and map_cell_and_hosts would do implicitly).

Change-Id: I38eab6707340253a10159a169ae61d34784c2d28
Related-Bug: #1669473
---
 lib/nova | 19 ++++++++-----------
 stack.sh |  2 +-
 2 files changed, 9 insertions(+), 12 deletions(-)

diff --git a/lib/nova b/lib/nova
index 0ce6699ad1..ac6df9dcf2 100644
--- a/lib/nova
+++ b/lib/nova
@@ -664,6 +664,10 @@ function init_nova_cells {
         $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CELLS_CONF db sync
         $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CELLS_CONF cell create --name=region --cell_type=parent --username=$RABBIT_USERID --hostname=$RABBIT_HOST --port=5672 --password=$RABBIT_PASSWORD --virtual_host=/ --woffset=0 --wscale=1
         $NOVA_BIN_DIR/nova-manage cell create --name=child --cell_type=child --username=$RABBIT_USERID --hostname=$RABBIT_HOST --port=5672 --password=$RABBIT_PASSWORD --virtual_host=child_cell --woffset=0 --wscale=1
+
+        # Creates the single cells v2 cell for the child cell (v1) nova db.
+        nova-manage --config-file $NOVA_CELLS_CONF cell_v2 create_cell \
+            --transport-url $(get_transport_url child_cell) --name 'cell1'
     fi
 }
 
@@ -720,6 +724,10 @@ function init_nova {
         # Run online migrations on the new databases
         # Needed for flavor conversion
         $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF db online_data_migrations
+
+        # create the cell1 cell for the main nova db where the hosts live
+        nova-manage cell_v2 create_cell --transport-url $(get_transport_url) \
+            --name 'cell1'
     fi
 
     create_nova_cache_dir
@@ -968,17 +976,6 @@ function create_flavors {
     fi
 }
 
-# create_cell(): Group the available hosts into a cell
-function create_cell {
-    if ! is_service_enabled n-cell; then
-        nova-manage cell_v2 simple_cell_setup --transport-url $(get_transport_url)
-    else
-        nova-manage --config-file $NOVA_CELLS_CONF  --verbose cell_v2 map_cell_and_hosts \
-                --transport-url $(get_transport_url child_cell) --name 'cell1'
-        nova-manage db sync
-    fi
-}
-
 # Restore xtrace
 $_XTRACE_LIB_NOVA
 
diff --git a/stack.sh b/stack.sh
index 2f43db7418..4cee385a33 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1364,7 +1364,7 @@ check_libs_from_git
 # Do this late because it requires compute hosts to have started
 if is_service_enabled n-api; then
     if is_service_enabled n-cpu; then
-        create_cell
+        $TOP_DIR/tools/discover_hosts.sh
     else
         # Some CI systems like Hyper-V build the control plane on
         # Linux, and join in non Linux Computes after setup. This

From 80e82eac4cd127a68fceea37270d09f9cbd71c75 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Fri, 15 Jul 2016 22:53:17 -0400
Subject: [PATCH 0844/2409] Disable glance v1 by default

Nova has been supporting glance v2 since Newton and removed
support for glance v1 in Ocata:

97e7b97210139a7f7888f0d6901e499664de02a3

We should disable glance v1 by default because there are several
test paths in Tempest which don't get run when glance v1 is
available because it uses glance v1 rather than v2.

Depends-On: I54db379f6fbe859fd9f1b0cdd5b74102539ab265

Change-Id: I7f962a07317cdad917ee896d79e49ee18938d074
---
 lib/glance | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/glance b/lib/glance
index 58f1deff6f..0077de5e17 100644
--- a/lib/glance
+++ b/lib/glance
@@ -57,7 +57,7 @@ GLANCE_SCHEMA_JSON=$GLANCE_CONF_DIR/schema-image.json
 GLANCE_SWIFT_STORE_CONF=$GLANCE_CONF_DIR/glance-swift-store.conf
 GLANCE_GLARE_CONF=$GLANCE_CONF_DIR/glance-glare.conf
 GLANCE_GLARE_PASTE_INI=$GLANCE_CONF_DIR/glance-glare-paste.ini
-GLANCE_V1_ENABLED=${GLANCE_V1_ENABLED:-True}
+GLANCE_V1_ENABLED=${GLANCE_V1_ENABLED:-False}
 
 if is_ssl_enabled_service "glance" || is_service_enabled tls-proxy; then
     GLANCE_SERVICE_PROTOCOL="https"

From dc6e55021861afceae2a7778b299df94ceab0a6e Mon Sep 17 00:00:00 2001
From: Ken'ichi Ohmichi <ken-oomichi@wx.jp.nec.com>
Date: Fri, 3 Mar 2017 16:55:50 -0800
Subject: [PATCH 0845/2409] Change auth_version to v3 on Tempest

Keystone v3 API is CURRENT and the v2 API is deprecated now.
So we need to change the default config of auth_version to fit
for current API status.

Depends-On: Id5e5ed9bf4f8b0f9eb376bfc7c5801f0956da1d9
Change-Id: I801e6740258ddea2a1b628a209970e0307d39d12
---
 lib/tempest | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index d95a9f5c3d..b48dd07f1b 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -273,13 +273,11 @@ function configure_tempest {
     if [ "$ENABLE_IDENTITY_V2" == "True" ]; then
         # Run Identity API v2 tests ONLY if needed
         iniset $TEMPEST_CONFIG identity-feature-enabled api_v2 True
-        iniset $TEMPEST_CONFIG identity auth_version ${TEMPEST_AUTH_VERSION:-v2}
     else
         # Skip Identity API v2 tests by default
         iniset $TEMPEST_CONFIG identity-feature-enabled api_v2 False
-        # Use v3 auth tokens for running all Tempest tests
-        iniset $TEMPEST_CONFIG identity auth_version v3
     fi
+    iniset $TEMPEST_CONFIG identity auth_version ${TEMPEST_AUTH_VERSION:-v3}
 
     if is_ssl_enabled_service "key" || is_service_enabled tls-proxy; then
         iniset $TEMPEST_CONFIG identity ca_certificates_file $SSL_BUNDLE_FILE

From 2b4735f1b3ac2834fa46a288ba5d09290acfbf3d Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Fri, 10 Feb 2017 06:17:37 +0000
Subject: [PATCH 0846/2409] Added list of mlock-using processes to
 peakmem_tracker output

The change makes peakmem_tracker list processes that lock memory pages
from swapping to disk. It may be helpful when debugging oom-killer job
failures in gate in case when dstat shows that swap is not fully used
when oom-killer is triggered.

The peakmem_tracker service was renamed into memory_tracker to reflect
its new broader scope.

Needed-By: I5862d92478397eac2e61b8a61ce3437b698678be
Change-Id: I1dca120448ee87930fe903fd81277b58efaefc92
---
 lib/dstat                                     | 14 ++--
 .../{peakmem_tracker.sh => memory_tracker.sh} | 64 ++++++++++++-------
 tools/mlock_report.py                         | 59 +++++++++++++++++
 3 files changed, 111 insertions(+), 26 deletions(-)
 rename tools/{peakmem_tracker.sh => memory_tracker.sh} (51%)
 create mode 100755 tools/mlock_report.py

diff --git a/lib/dstat b/lib/dstat
index b705948094..62795f5e72 100644
--- a/lib/dstat
+++ b/lib/dstat
@@ -21,16 +21,22 @@ function start_dstat {
     # A better kind of sysstat, with the top process per time slice
     run_process dstat "$TOP_DIR/tools/dstat.sh $LOGDIR"
 
-    # To enable peakmem_tracker add:
-    #    enable_service peakmem_tracker
+    # To enable memory_tracker add:
+    #    enable_service memory_tracker
     # to your localrc
-    run_process peakmem_tracker "$TOP_DIR/tools/peakmem_tracker.sh"
+    run_process memory_tracker "$TOP_DIR/tools/memory_tracker.sh"
+
+    # remove support for the old name when it's no longer used (sometime in Queens)
+    if is_service_enabled peakmem_tracker; then
+        deprecated "Use of peakmem_tracker in devstack is deprecated, use memory_tracker instead"
+        run_process peakmem_tracker "$TOP_DIR/tools/memory_tracker.sh"
+    fi
 }
 
 # stop_dstat() stop dstat process
 function stop_dstat {
     stop_process dstat
-    stop_process peakmem_tracker
+    stop_process memory_tracker
 }
 
 # Restore xtrace
diff --git a/tools/peakmem_tracker.sh b/tools/memory_tracker.sh
similarity index 51%
rename from tools/peakmem_tracker.sh
rename to tools/memory_tracker.sh
index ecbd79a0bc..dac0267a7e 100755
--- a/tools/peakmem_tracker.sh
+++ b/tools/memory_tracker.sh
@@ -21,11 +21,15 @@ SLEEP_TIME=20
 # around reclaimable memory.  However, it is not available until 3.14
 # kernel (i.e. Ubuntu LTS Trusty misses it).  In that case, we fall
 # back to free+buffers+cache as the available memory.
-USE_MEM_AVAILBLE=0
+USE_MEM_AVAILABLE=0
 if grep -q '^MemAvailable:' /proc/meminfo; then
     USE_MEM_AVAILABLE=1
 fi
 
+function get_mem_unevictable {
+    awk '/^Unevictable:/ {print $2}' /proc/meminfo
+}
+
 function get_mem_available {
     if [[ $USE_MEM_AVAILABLE -eq 1 ]]; then
         awk '/^MemAvailable:/ {print $2}' /proc/meminfo
@@ -37,40 +41,56 @@ function get_mem_available {
     fi
 }
 
-# whenever we see less memory available than last time, dump the
-# snapshot of current usage; i.e. checking the latest entry in the
-# file will give the peak-memory usage
 function tracker {
     local low_point
+    local unevictable_point
     low_point=$(get_mem_available)
+    # log mlocked memory at least on first iteration
+    unevictable_point=0
     while [ 1 ]; do
 
         local mem_available
         mem_available=$(get_mem_available)
 
-        if [[ $mem_available -lt $low_point ]]; then
-            low_point=$mem_available
+        local unevictable
+        unevictable=$(get_mem_unevictable)
+
+        if [ $mem_available -lt $low_point -o $unevictable -ne $unevictable_point ]; then
             echo "[[["
             date
+
+            # whenever we see less memory available than last time, dump the
+            # snapshot of current usage; i.e. checking the latest entry in the file
+            # will give the peak-memory usage
+            if [[ $mem_available -lt $low_point ]]; then
+                low_point=$mem_available
+                echo "---"
+                # always available greppable output; given difference in
+                # meminfo output as described above...
+                echo "memory_tracker low_point: $mem_available"
+                echo "---"
+                cat /proc/meminfo
+                echo "---"
+                # would hierarchial view be more useful (-H)?  output is
+                # not sorted by usage then, however, and the first
+                # question is "what's using up the memory"
+                #
+                # there are a lot of kernel threads, especially on a 8-cpu
+                # system.  do a best-effort removal to improve
+                # signal/noise ratio of output.
+                ps --sort=-pmem -eo pid:10,pmem:6,rss:15,ppid:10,cputime:10,nlwp:8,wchan:25,args:100 |
+                    grep -v ']$'
+            fi
             echo "---"
-            # always available greppable output; given difference in
-            # meminfo output as described above...
-            echo "peakmem_tracker low_point: $mem_available"
-            echo "---"
-            cat /proc/meminfo
-            echo "---"
-            # would hierarchial view be more useful (-H)?  output is
-            # not sorted by usage then, however, and the first
-            # question is "what's using up the memory"
-            #
-            # there are a lot of kernel threads, especially on a 8-cpu
-            # system.  do a best-effort removal to improve
-            # signal/noise ratio of output.
-            ps --sort=-pmem -eo pid:10,pmem:6,rss:15,ppid:10,cputime:10,nlwp:8,wchan:25,args:100 |
-                grep -v ']$'
+
+            # list processes that lock memory from swap
+            if [[ $unevictable -ne $unevictable_point ]]; then
+                unevictable_point=$unevictable
+                sudo ./tools/mlock_report.py
+            fi
+
             echo "]]]"
         fi
-
         sleep $SLEEP_TIME
     done
 }
diff --git a/tools/mlock_report.py b/tools/mlock_report.py
new file mode 100755
index 0000000000..1d23af90d7
--- /dev/null
+++ b/tools/mlock_report.py
@@ -0,0 +1,59 @@
+#!/usr/bin/env python
+
+# This tool lists processes that lock memory pages from swapping to disk.
+
+import re
+import subprocess
+
+import psutil
+
+
+SUMMARY_REGEX = re.compile(r".*\s+(?P<locked>[\d]+)\s+KB")
+
+
+def main():
+    try:
+        print _get_report()
+    except Exception as e:
+        print "Failure listing processes locking memory: %s" % str(e)
+
+
+def _get_report():
+    mlock_users = []
+    for proc in psutil.process_iter():
+        pid = proc.pid
+        # sadly psutil does not expose locked pages info, that's why we
+        # call to pmap and parse the output here
+        try:
+            out = subprocess.check_output(['pmap', '-XX', str(pid)])
+        except subprocess.CalledProcessError as e:
+            # 42 means process just vanished, which is ok
+            if e.returncode == 42:
+                continue
+            raise
+        last_line = out.splitlines()[-1]
+
+        # some processes don't provide a memory map, for example those
+        # running as kernel services, so we need to skip those that don't
+        # match
+        result = SUMMARY_REGEX.match(last_line)
+        if result:
+            locked = int(result.group('locked'))
+            if locked:
+                mlock_users.append({'name': proc.name(),
+                                    'pid': pid,
+                                    'locked': locked})
+
+    # produce a single line log message with per process mlock stats
+    if mlock_users:
+        return "; ".join(
+            "[%(name)s (pid:%(pid)s)]=%(locked)dKB" % args
+            # log heavy users first
+            for args in sorted(mlock_users, key=lambda d: d['locked'])
+        )
+    else:
+        return "no locked memory"
+
+
+if __name__ == "__main__":
+    main()

From 45da777d2526acd355da974eb338695559dd64c8 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Sun, 5 Mar 2017 13:07:39 -0500
Subject: [PATCH 0847/2409] Change to messagingv2 for
 oslo_messaging_notifications.driver

The oslo.messaging docs on the notification messaging driver
says that "messaging" (1.0) is a legacy format and you should
use messagingv2 unless otherwise required for that old format.

By default we should be testing with messagingv2.

Change-Id: I3031afe7551a0c8dde46e1ccfacff445fb68e122
---
 lib/cinder         | 2 +-
 lib/glance         | 4 ++--
 lib/neutron-legacy | 2 +-
 lib/nova           | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 767fd00d34..c17cea06c7 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -315,7 +315,7 @@ function configure_cinder {
     fi
 
     if is_service_enabled ceilometer; then
-        iniset $CINDER_CONF oslo_messaging_notifications driver "messaging"
+        iniset $CINDER_CONF oslo_messaging_notifications driver "messagingv2"
     fi
 
     if is_service_enabled tls-proxy; then
diff --git a/lib/glance b/lib/glance
index 58f1deff6f..0ba2cfa3d4 100644
--- a/lib/glance
+++ b/lib/glance
@@ -112,7 +112,7 @@ function configure_glance {
     iniset $GLANCE_REGISTRY_CONF DEFAULT workers "$API_WORKERS"
     iniset $GLANCE_REGISTRY_CONF paste_deploy flavor keystone
     configure_auth_token_middleware $GLANCE_REGISTRY_CONF glance $GLANCE_AUTH_CACHE_DIR/registry
-    iniset $GLANCE_REGISTRY_CONF oslo_messaging_notifications driver messaging
+    iniset $GLANCE_REGISTRY_CONF oslo_messaging_notifications driver messagingv2
     iniset_rpc_backend glance $GLANCE_REGISTRY_CONF
     iniset $GLANCE_REGISTRY_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
 
@@ -125,7 +125,7 @@ function configure_glance {
     iniset $GLANCE_API_CONF DEFAULT image_cache_dir $GLANCE_CACHE_DIR/
     iniset $GLANCE_API_CONF paste_deploy flavor keystone+cachemanagement
     configure_auth_token_middleware $GLANCE_API_CONF glance $GLANCE_AUTH_CACHE_DIR/api
-    iniset $GLANCE_API_CONF oslo_messaging_notifications driver messaging
+    iniset $GLANCE_API_CONF oslo_messaging_notifications driver messagingv2
     iniset_rpc_backend glance $GLANCE_API_CONF
     if [ "$VIRT_DRIVER" = 'xenserver' ]; then
         iniset $GLANCE_API_CONF DEFAULT container_formats "ami,ari,aki,bare,ovf,tgz"
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index b381b642c6..1a16a44986 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -798,7 +798,7 @@ function _configure_neutron_metadata_agent {
 }
 
 function _configure_neutron_ceilometer_notifications {
-    iniset $NEUTRON_CONF oslo_messaging_notifications driver messaging
+    iniset $NEUTRON_CONF oslo_messaging_notifications driver messagingv2
 }
 
 function _configure_neutron_metering {
diff --git a/lib/nova b/lib/nova
index 79f07f2a99..4c9f30f593 100644
--- a/lib/nova
+++ b/lib/nova
@@ -575,7 +575,7 @@ function create_nova_conf {
 
     # Set the oslo messaging driver to the typical default. This does not
     # enable notifications, but it will allow them to function when enabled.
-    iniset $NOVA_CONF oslo_messaging_notifications driver "messaging"
+    iniset $NOVA_CONF oslo_messaging_notifications driver "messagingv2"
     iniset_rpc_backend nova $NOVA_CONF
     iniset $NOVA_CONF glance api_servers "${GLANCE_SERVICE_PROTOCOL}://${GLANCE_HOSTPORT}"
 

From e65ab4a1c57a56161ebbf51a10b3c47a665037d7 Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Fri, 24 Feb 2017 17:47:55 +0000
Subject: [PATCH 0848/2409] lib/neutron: configure root_helper for agents

Before the patch, we were only configuring root_helper_daemon to point
to oslo.rootwrap, but not root_helper. (The former is used for long
running commands only, while the latter is used for short lived
commands.) This made neutron agents to directly call to sudo when a
privileged process was to be executed. This failed because /etc/sudoers
was not configured to allow anything except the rootwrap call itself.

This patch simplifies rootwrap handling in the code; it also sets
root_helper to point to rootwrap; as well as configure daemon in
sudoers. While at it, we also set l2 agent to use rootwrap too.
Hopefully, it will be enough for agents to actually configure backend as
needed.

Change-Id: Ib05a6e0e024f534d7f616d41d70fb67ecf6daeaf
---
 lib/neutron | 27 ++++++++++++++++-----------
 1 file changed, 16 insertions(+), 11 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 44d41f8cf5..e72c9fe6ea 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -72,7 +72,8 @@ NEUTRON_SERVICE_PROTOCOL=${NEUTRON_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 NEUTRON_AUTH_STRATEGY=${NEUTRON_AUTH_STRATEGY:-keystone}
 NEUTRON_ROOTWRAP=$(get_rootwrap_location neutron)
 NEUTRON_ROOTWRAP_CONF_FILE=$NEUTRON_CONF_DIR/rootwrap.conf
-NEUTRON_ROOTWRAP_DAEMON_CMD="sudo $NEUTRON_ROOTWRAP-daemon $NEUTRON_ROOTWRAP_CONF_FILE"
+NEUTRON_ROOTWRAP_CMD="$NEUTRON_ROOTWRAP $NEUTRON_ROOTWRAP_CONF_FILE"
+NEUTRON_ROOTWRAP_DAEMON_CMD="$NEUTRON_ROOTWRAP-daemon $NEUTRON_ROOTWRAP_CONF_FILE"
 
 # Additional neutron api config files
 declare -a _NEUTRON_SERVER_EXTRA_CONF_FILES_ABS
@@ -115,6 +116,13 @@ function cleanup_neutron_new {
     done
 }
 
+# configure_root_helper_options() - Configure agent rootwrap helper options
+function configure_root_helper_options {
+    local conffile=$1
+    iniset $conffile agent root_helper "sudo $NEUTRON_ROOTWRAP_CMD"
+    iniset $conffile agent root_helper_daemon "sudo $NEUTRON_ROOTWRAP_DAEMON_CMD"
+}
+
 # configure_neutron() - Set config files, create data dirs, etc
 function configure_neutron_new {
     sudo install -d -o $STACK_USER $NEUTRON_CONF_DIR
@@ -171,6 +179,7 @@ function configure_neutron_new {
     if is_service_enabled neutron-agent; then
         iniset $NEUTRON_CORE_PLUGIN_CONF agent tunnel_types vxlan
         iniset $NEUTRON_CORE_PLUGIN_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
+        configure_root_helper_options $NEUTRON_CORE_PLUGIN_CONF
 
         # Configure the neutron agent
         if [[ $NEUTRON_AGENT == "linuxbridge" ]]; then
@@ -194,7 +203,7 @@ function configure_neutron_new {
         # make it so we have working DNS from guests
         iniset $NEUTRON_DHCP_CONF DEFAULT dnsmasq_local_resolv True
 
-        iniset $NEUTRON_DHCP_CONF agent root_helper_daemon "$NEUTRON_ROOTWRAP_DAEMON_CMD"
+        configure_root_helper_options $NEUTRON_DHCP_CONF
         iniset $NEUTRON_DHCP_CONF DEFAULT interface_driver $NEUTRON_AGENT
         neutron_plugin_configure_dhcp_agent $NEUTRON_DHCP_CONF
     fi
@@ -203,7 +212,7 @@ function configure_neutron_new {
         cp $NEUTRON_DIR/etc/l3_agent.ini.sample $NEUTRON_L3_CONF
         iniset $NEUTRON_L3_CONF DEFAULT interface_driver $NEUTRON_AGENT
         neutron_service_plugin_class_add router
-        iniset $NEUTRON_L3_CONF agent root_helper_daemon "$NEUTRON_ROOTWRAP_DAEMON_CMD"
+        configure_root_helper_options $NEUTRON_L3_CONF
         iniset $NEUTRON_L3_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
         neutron_plugin_configure_l3_agent $NEUTRON_L3_CONF
     fi
@@ -215,7 +224,8 @@ function configure_neutron_new {
         iniset $NEUTRON_META_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
         iniset $NEUTRON_META_CONF DEFAULT nova_metadata_ip $SERVICE_HOST
         iniset $NEUTRON_META_CONF DEFAULT metadata_workers $API_WORKERS
-        iniset $NEUTRON_META_CONF agent root_helper_daemon "$NEUTRON_ROOTWRAP_DAEMON_CMD"
+        # TODO(ihrachys) do we really need to set rootwrap for metadata agent?
+        configure_root_helper_options $NEUTRON_META_CONF
 
         # TODO(dtroyer): remove the v2.0 hard code below
         iniset $NEUTRON_META_CONF DEFAULT auth_url $KEYSTONE_SERVICE_URI/v2.0
@@ -252,12 +262,6 @@ function configure_neutron_new {
 
 # configure_neutron_rootwrap() - configure Neutron's rootwrap
 function configure_neutron_rootwrap {
-    # Set the paths of certain binaries
-    neutron_rootwrap=$(get_rootwrap_location neutron)
-
-    # Specify ``rootwrap.conf`` as first parameter to neutron-rootwrap
-    local rootwrap_sudoer_cmd="${neutron_rootwrap} $NEUTRON_CONF_DIR/rootwrap.conf"
-
     # Deploy new rootwrap filters files (owned by root).
     # Wipe any existing rootwrap.d files first
     if [[ -d $NEUTRON_CONF_DIR/rootwrap.d ]]; then
@@ -274,7 +278,8 @@ function configure_neutron_rootwrap {
 
     # Set up the rootwrap sudoers for Neutron
     tempfile=`mktemp`
-    echo "$STACK_USER ALL=(root) NOPASSWD: $rootwrap_sudoer_cmd *" >$tempfile
+    echo "$STACK_USER ALL=(root) NOPASSWD: $NEUTRON_ROOTWRAP_CMD *" >$tempfile
+    echo "$STACK_USER ALL=(root) NOPASSWD: $NEUTRON_ROOTWRAP_DAEMON_CMD" >>$tempfile
     chmod 0440 $tempfile
     sudo chown root:root $tempfile
     sudo mv $tempfile /etc/sudoers.d/neutron-rootwrap

From c2c89e4b35a9ad5fb1a2670943328a9725b37001 Mon Sep 17 00:00:00 2001
From: Brant Knudson <bknudson@us.ibm.com>
Date: Thu, 23 Feb 2017 20:15:47 -0600
Subject: [PATCH 0849/2409] Use KEYSTONE_SERVICE_URI consistently

lib/keystone builds KEYSTONE_SERVICE_URI so that other services
don't need to reconstruct the identity URI. Many services already
use it, but some parts were still building the identity URI from
the different parts.

This will allow changing the identity URI to include a path
(e.g., to http://<host>/identity) in 1 place rather than in
multiple places.

Change-Id: I58cbdbe591d8869807545e0815480fc3375e0479
---
 lib/neutron   | 2 +-
 lib/nova      | 2 +-
 lib/placement | 2 +-
 lib/tempest   | 4 ++--
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index b30c5c8e89..ab005a9a01 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -282,7 +282,7 @@ function configure_neutron_rootwrap {
 function configure_neutron_nova_new {
     iniset $NOVA_CONF DEFAULT use_neutron True
     iniset $NOVA_CONF neutron auth_type "password"
-    iniset $NOVA_CONF neutron auth_url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_AUTH_PORT/v3"
+    iniset $NOVA_CONF neutron auth_url "$KEYSTONE_SERVICE_URI/v3"
     iniset $NOVA_CONF neutron username neutron
     iniset $NOVA_CONF neutron password "$SERVICE_PASSWORD"
     iniset $NOVA_CONF neutron user_domain_name "Default"
diff --git a/lib/nova b/lib/nova
index 4c9f30f593..a36a740265 100644
--- a/lib/nova
+++ b/lib/nova
@@ -631,7 +631,7 @@ function create_nova_conf {
 function init_nova_service_user_conf {
     iniset $NOVA_CONF service_user send_service_user_token True
     iniset $NOVA_CONF service_user auth_type password
-    iniset $NOVA_CONF service_user auth_url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_AUTH_PORT"
+    iniset $NOVA_CONF service_user auth_url "$KEYSTONE_SERVICE_URI"
     iniset $NOVA_CONF service_user username nova
     iniset $NOVA_CONF service_user password "$SERVICE_PASSWORD"
     iniset $NOVA_CONF service_user user_domain_name "$SERVICE_DOMAIN_NAME"
diff --git a/lib/placement b/lib/placement
index e7ffe3330b..4cc5cd8b6a 100644
--- a/lib/placement
+++ b/lib/placement
@@ -100,7 +100,7 @@ function _config_placement_apache_wsgi {
 
 function configure_placement_nova_compute {
     iniset $NOVA_CONF placement auth_type "password"
-    iniset $NOVA_CONF placement auth_url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_AUTH_PORT/v3"
+    iniset $NOVA_CONF placement auth_url "$KEYSTONE_SERVICE_URI/v3"
     iniset $NOVA_CONF placement username placement
     iniset $NOVA_CONF placement password "$SERVICE_PASSWORD"
     iniset $NOVA_CONF placement user_domain_name "$SERVICE_DOMAIN_NAME"
diff --git a/lib/tempest b/lib/tempest
index d95a9f5c3d..25db046829 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -17,7 +17,7 @@
 #   - ``PUBLIC_NETWORK_NAME``
 #   - ``VIRT_DRIVER``
 #   - ``LIBVIRT_TYPE``
-#   - ``KEYSTONE_SERVICE_PROTOCOL``, ``KEYSTONE_SERVICE_HOST`` from lib/keystone
+#   - ``KEYSTONE_SERVICE_URI``, ``KEYSTONE_SERVICE_URI_V3`` from lib/keystone
 #
 # Optional Dependencies:
 #
@@ -257,7 +257,7 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG volume build_timeout $BUILD_TIMEOUT
 
     # Identity
-    iniset $TEMPEST_CONFIG identity uri "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:5000/v2.0/"
+    iniset $TEMPEST_CONFIG identity uri "$KEYSTONE_SERVICE_URI/v2.0/"
     iniset $TEMPEST_CONFIG identity uri_v3 "$KEYSTONE_SERVICE_URI_V3"
     iniset $TEMPEST_CONFIG identity user_lockout_failure_attempts $KEYSTONE_LOCKOUT_FAILURE_ATTEMPTS
     iniset $TEMPEST_CONFIG identity user_lockout_duration $KEYSTONE_LOCKOUT_DURATION

From 73a3e2decd2e7d9fd652fb40c4e697794d9abd05 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Tue, 7 Mar 2017 08:49:22 +0000
Subject: [PATCH 0850/2409] Updated from generate-devstack-plugins-list

Change-Id: Iffde64ae167fa32a377d20a9628c17286f1bf958
---
 doc/source/plugin-registry.rst | 1 -
 1 file changed, 1 deletion(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 17da67b816..58d393ae74 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -108,7 +108,6 @@ networking-midonet                     `git://git.openstack.org/openstack/networ
 networking-mlnx                        `git://git.openstack.org/openstack/networking-mlnx <https://git.openstack.org/cgit/openstack/networking-mlnx>`__
 networking-nec                         `git://git.openstack.org/openstack/networking-nec <https://git.openstack.org/cgit/openstack/networking-nec>`__
 networking-odl                         `git://git.openstack.org/openstack/networking-odl <https://git.openstack.org/cgit/openstack/networking-odl>`__
-networking-ofagent                     `git://git.openstack.org/openstack/networking-ofagent <https://git.openstack.org/cgit/openstack/networking-ofagent>`__
 networking-onos                        `git://git.openstack.org/openstack/networking-onos <https://git.openstack.org/cgit/openstack/networking-onos>`__
 networking-ovn                         `git://git.openstack.org/openstack/networking-ovn <https://git.openstack.org/cgit/openstack/networking-ovn>`__
 networking-ovs-dpdk                    `git://git.openstack.org/openstack/networking-ovs-dpdk <https://git.openstack.org/cgit/openstack/networking-ovs-dpdk>`__

From f511c368f8e1e6690b7be4da926cad97d07ee85f Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Tue, 7 Mar 2017 06:31:49 +0000
Subject: [PATCH 0851/2409] lib/neutron: allow to add more ml2 extension
 drivers

The patch will allow jobs to append new ml2 extension drivers without
overriding port_security.

Change-Id: I45f017d1b8a3054452c3166ed4fb460d21959adb
---
 lib/neutron        | 23 ++++++++++++++++++++++-
 lib/neutron-legacy | 10 ++++++++++
 2 files changed, 32 insertions(+), 1 deletion(-)

diff --git a/lib/neutron b/lib/neutron
index c97104ec46..e69e25fd55 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -163,7 +163,7 @@ function configure_neutron_new {
         iniset $NEUTRON_CORE_PLUGIN_CONF ml2_type_vxlan vni_ranges 1001:2000
         iniset $NEUTRON_CORE_PLUGIN_CONF ml2_type_flat flat_networks public
         if [[ "$NEUTRON_PORT_SECURITY" = "True" ]]; then
-            iniset $NEUTRON_CORE_PLUGIN_CONF ml2 extension_drivers port_security
+            neutron_ml2_extension_driver_add port_security
         fi
     fi
 
@@ -481,6 +481,18 @@ function neutron_service_plugin_class_add_new {
     iniset $NEUTRON_CONF DEFAULT service_plugins $plugins
 }
 
+function _neutron_ml2_extension_driver_add {
+    local driver=$1
+    local drivers=""
+
+    drivers=$(iniget $NEUTRON_CORE_PLUGIN_CONF ml2 extension_drivers)
+    if [ $drivers ]; then
+        drivers+=","
+    fi
+    drivers+="${driver}"
+    iniset $NEUTRON_CORE_PLUGIN_CONF ml2 extension_drivers $drivers
+}
+
 function neutron_server_config_add_new {
     _NEUTRON_SERVER_EXTRA_CONF_FILES_ABS+=($1)
 }
@@ -553,6 +565,15 @@ function neutron_service_plugin_class_add {
     fi
 }
 
+function neutron_ml2_extension_driver_add {
+    if is_neutron_legacy_enabled; then
+        # Call back to old function
+        _neutron_ml2_extension_driver_add_old "$@"
+    else
+        _neutron_ml2_extension_driver_add "$@"
+    fi
+}
+
 function install_neutron_agent_packages {
     if is_neutron_legacy_enabled; then
         # Call back to old function
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index ccab527f66..86a2b1d58e 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -870,6 +870,16 @@ function _neutron_service_plugin_class_add {
     fi
 }
 
+# _neutron_ml2_extension_driver_add_old() - add ML2 extension driver
+function _neutron_ml2_extension_driver_add_old {
+    local extension=$1
+    if [[ $Q_ML2_PLUGIN_EXT_DRIVERS == '' ]]; then
+        Q_ML2_PLUGIN_EXT_DRIVERS=$extension
+    elif [[ ! ,${Q_ML2_PLUGIN_EXT_DRIVERS}, =~ ,${extension}, ]]; then
+        Q_ML2_PLUGIN_EXT_DRIVERS="$Q_ML2_PLUGIN_EXT_DRIVERS,$extension"
+    fi
+}
+
 # mutnauq_server_config_add() - add server config file
 function mutnauq_server_config_add {
     _Q_PLUGIN_EXTRA_CONF_FILES_ABS+=($1)

From afef8bf097356d7bb37c57d0daa44653c7905c17 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 6 Mar 2017 14:07:23 -0500
Subject: [PATCH 0852/2409] Make declared variables global

When variables use the 'declare' directive, it is by default a local
variable. While other variables have global scope.

For example:
   declare -A AN_ARRAY   # local in scope
   foo=1                 # global in scope

This causes errors to occur as some of the variables will be local only
and others will be global.

Update the code, as appropriate, so that variables using the 'declare'
directive also include the '-g' flag to have them also be global. Not
every instance of a declared variable has been updated.

Closes-Bug: #1669509
Co-Authored-By: John L. Villalovos <john.l.villalovos@intel.com>
Change-Id: I2180b68fe861ad19c6d4ec0df0f9f8a528347862
---
 functions          |  2 +-
 functions-common   | 18 +++++++++---------
 inc/python         |  2 +-
 lib/neutron        |  2 +-
 lib/neutron-legacy |  4 ++--
 stackrc            |  2 +-
 6 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/functions b/functions
index 89ee3672d3..48c821c0a6 100644
--- a/functions
+++ b/functions
@@ -12,7 +12,7 @@
 
 # ensure we don't re-source this in the same environment
 [[ -z "$_DEVSTACK_FUNCTIONS" ]] || return 0
-declare -r _DEVSTACK_FUNCTIONS=1
+declare -r -g _DEVSTACK_FUNCTIONS=1
 
 # Include the common functions
 FUNC_DIR=$(cd $(dirname "${BASH_SOURCE:-$0}") && pwd)
diff --git a/functions-common b/functions-common
index 0d1b01f2fe..64f97f005a 100644
--- a/functions-common
+++ b/functions-common
@@ -37,12 +37,12 @@ set +o xtrace
 
 # ensure we don't re-source this in the same environment
 [[ -z "$_DEVSTACK_FUNCTIONS_COMMON" ]] || return 0
-declare -r _DEVSTACK_FUNCTIONS_COMMON=1
+declare -r -g _DEVSTACK_FUNCTIONS_COMMON=1
 
 # Global Config Variables
-declare -A GITREPO
-declare -A GITBRANCH
-declare -A GITDIR
+declare -A -g GITREPO
+declare -A -g GITBRANCH
+declare -A -g GITDIR
 
 TRACK_DEPENDS=${TRACK_DEPENDS:-False}
 
@@ -306,7 +306,7 @@ function warn {
 # ``os_PACKAGE`` - package type: ``deb`` or ``rpm``
 # ``os_CODENAME`` - vendor's codename for release: ``xenial``
 
-declare os_VENDOR os_RELEASE os_PACKAGE os_CODENAME
+declare -g os_VENDOR os_RELEASE os_PACKAGE os_CODENAME
 
 # Make a *best effort* attempt to install lsb_release packages for the
 # user if not available.  Note can't use generic install_package*
@@ -361,7 +361,7 @@ function GetOSVersion {
 
 # Translate the OS version values into common nomenclature
 # Sets global ``DISTRO`` from the ``os_*`` values
-declare DISTRO
+declare -g DISTRO
 
 function GetDistro {
     GetOSVersion
@@ -2376,9 +2376,9 @@ function sudo_with_proxies {
 # Resolution is only in whole seconds, so should be used for long
 # running activities.
 
-declare -A _TIME_TOTAL
-declare -A _TIME_START
-declare -r _TIME_BEGIN=$(date +%s)
+declare -A -g _TIME_TOTAL
+declare -A -g _TIME_START
+declare -r -g _TIME_BEGIN=$(date +%s)
 
 # time_start $name
 #
diff --git a/inc/python b/inc/python
index 5afc07f636..d0e45df489 100644
--- a/inc/python
+++ b/inc/python
@@ -19,7 +19,7 @@ set +o xtrace
 
 # PROJECT_VENV contains the name of the virtual environment for each
 # project.  A null value installs to the system Python directories.
-declare -A PROJECT_VENV
+declare -A -g PROJECT_VENV
 
 
 # Python Functions
diff --git a/lib/neutron b/lib/neutron
index 19568eaf25..4a547ac0bf 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -74,7 +74,7 @@ NEUTRON_ROOTWRAP_DAEMON_CMD="sudo $NEUTRON_ROOTWRAP-daemon $NEUTRON_ROOTWRAP_CON
 NEUTRON_CONFIG_ARG=${NEUTRON_CONFIG_ARG:-""}
 
 # Additional neutron api config files
-declare -a _NEUTRON_SERVER_EXTRA_CONF_FILES_ABS
+declare -a -g _NEUTRON_SERVER_EXTRA_CONF_FILES_ABS
 
 # Functions
 # ---------
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index b381b642c6..96d86743ab 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -141,10 +141,10 @@ _Q_PLUGIN_EXTRA_CONF_PATH=/etc/neutron
 # These config files are relative to ``/etc/neutron``.  The above
 # example would specify ``--config-file /etc/neutron/file1`` for
 # neutron server.
-declare -a Q_PLUGIN_EXTRA_CONF_FILES
+declare -a -g Q_PLUGIN_EXTRA_CONF_FILES
 
 # same as Q_PLUGIN_EXTRA_CONF_FILES, but with absolute path.
-declare -a _Q_PLUGIN_EXTRA_CONF_FILES_ABS
+declare -a -g _Q_PLUGIN_EXTRA_CONF_FILES_ABS
 
 
 Q_RR_CONF_FILE=$NEUTRON_CONF_DIR/rootwrap.conf
diff --git a/stackrc b/stackrc
index afe385c2a1..14c5960ed4 100644
--- a/stackrc
+++ b/stackrc
@@ -5,7 +5,7 @@
 
 # ensure we don't re-source this in the same environment
 [[ -z "$_DEVSTACK_STACKRC" ]] || return 0
-declare -r _DEVSTACK_STACKRC=1
+declare -r -g _DEVSTACK_STACKRC=1
 
 # Find the other rc files
 RC_DIR=$(cd $(dirname "${BASH_SOURCE:-$0}") && pwd)

From d5919d08ba131ac2bde27251c8b4e77bf428e876 Mon Sep 17 00:00:00 2001
From: "jeremy.zhang" <zhangjun_inspur@163.com>
Date: Wed, 8 Mar 2017 15:27:37 +0800
Subject: [PATCH 0853/2409] Restrict enabling the manage_volume volume feature

Not all Cinder backends support the 'manage volume' feature. The test that
in tempest for this feature is specific to LVM and will *not* work for
other work backends regardless of them supporting the feature.

Change-Id: I055aa66738deb5ae2fb925429cec565e3901340c
---
 lib/tempest | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index d95a9f5c3d..95b25bcf4e 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -439,7 +439,11 @@ function configure_tempest {
         TEMPEST_VOLUME_MANAGE_SNAPSHOT=${TEMPEST_VOLUME_MANAGE_SNAPSHOT:-True}
     fi
     iniset $TEMPEST_CONFIG volume-feature-enabled manage_snapshot $(trueorfalse False TEMPEST_VOLUME_MANAGE_SNAPSHOT)
-
+    # Only turn on TEMPEST_VOLUME_MANAGE_VOLUME by default for "lvm" backends
+    if [[ "$CINDER_ENABLED_BACKENDS" == *"lvm"* ]]; then
+        TEMPEST_VOLUME_MANAGE_VOLUME=${TEMPEST_VOLUME_MANAGE_VOLUME:-True}
+    fi
+    iniset $TEMPEST_CONFIG volume-feature-enabled manage_volume $(trueorfalse False TEMPEST_VOLUME_MANAGE_VOLUME)
     # TODO(ameade): Remove the api_v3 flag when Mitaka and Liberty are end of life.
     iniset $TEMPEST_CONFIG volume-feature-enabled api_v3 True
     iniset $TEMPEST_CONFIG volume-feature-enabled api_v1 $(trueorfalse False TEMPEST_VOLUME_API_V1)

From b75a4928707feb53d0e306f8b289096eb5c0b37b Mon Sep 17 00:00:00 2001
From: Sylvain Bauza <sbauza@redhat.com>
Date: Fri, 16 Oct 2015 15:57:50 +0200
Subject: [PATCH 0854/2409] Add a new FAQ entry for dev environments

Since it's pretty common to see blogposts recommending to mount /opt/stack
remotely or editing inline the code, adding some notes about the potential
risk of a reclone that could impact weeks of work.

Change-Id: I733d40b76fb02d8edf3719533fc8202547771871
Co-Authored-By: Stephen Finucane <sfinucan@redhat.com>
---
 doc/source/faq.rst | 51 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 51 insertions(+)

diff --git a/doc/source/faq.rst b/doc/source/faq.rst
index 7793d8eb68..e6c1d6ed41 100644
--- a/doc/source/faq.rst
+++ b/doc/source/faq.rst
@@ -18,6 +18,57 @@ production systems.
 Your best choice is probably to choose a `distribution of OpenStack
 <https://www.openstack.org/marketplace/distros/>`__.
 
+Can I use DevStack as a development environment?
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Sure, you can. That said, there are a couple of things you should note before
+doing so:
+
+- DevStack makes a lot of configuration changes to your system and should not
+  be run in your main development environment.
+
+- All the repositories that DevStack clones when deploying are considered
+  volatile by default and thus are subject to hard resets. This is necessary to
+  keep you in sync with the latest upstream, which is what you want in a CI
+  situation, but it can result in branches being overwritten and files being
+  removed.
+
+  The corollary of this is that if you are working on a specific project, using
+  the DevStack project repository (defaulted to ``/opt/stack/<project>``) as
+  the single master repository for storing all your work is not recommended.
+  This behavior can be overridden by setting the ``RECLONE`` config option to
+  ``no``.  Alternatively, you can avoid running ``stack.sh`` to redeploy by
+  restarting services manually. In any case, you should generally ensure work
+  in progress is pushed to Gerrit or otherwise backed up before running
+  ``stack.sh``.
+
+- If you use DevStack within a VM, you may wish to mount a local OpenStack
+  directory, such as ``~/src/openstack``, inside the VM and configure DevStack
+  to use this as the clone location using the ``{PROJECT}_REPO`` config
+  variables. For example, assuming you're using Vagrant and sharing your home
+  directory, you should place the following in ``local.conf``:
+
+  .. code-block:: shell
+
+     NEUTRON_REPO=/home/vagrant/src/neutron
+     NOVA_REPO=/home/vagrant/src/nova
+     KEYSTONE_REPO=/home/vagrant/src/keystone
+     GLANCE_REPO=/home/vagrant/src/glance
+     SWIFT_REPO=/home/vagrant/src/swift
+     HORIZON_REPO=/home/vagrant/src/horizon
+     CINDER_REPO=/home/vagrant/src/cinder
+     HEAT_REPO=/home/vagrant/src/heat
+     TEMPEST_REPO=/home/vagrant/src/tempest
+     HEATCLIENT_REPO=/home/vagrant/src/python-heatclient
+     GLANCECLIENT_REPO=/home/vagrant/src/python-glanceclient
+     NOVACLIENT_REPO=/home/vagrant/src/python-novaclient
+     NEUTRONCLIENT_REPO=/home/vagrant/src/python-neutronclient
+     OPENSTACKCLIENT_REPO=/home/vagrant/src/python-openstackclient
+     HEAT_CFNTOOLS_REPO=/home/vagrant/src/heat-cfntools
+     HEAT_TEMPLATES_REPO=/home/vagrant/src/heat-templates
+     NEUTRON_FWAAS_REPO=/home/vagrant/src/neutron-fwaas
+     # ...
+
 Why a shell script, why not chef/puppet/...
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 

From 93a415601562853301d44e82ab07ee6bf1734945 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89douard=20Thuleau?= <ethuleau@juniper.net>
Date: Thu, 9 Mar 2017 18:53:18 +0100
Subject: [PATCH 0855/2409] Don't create keystone account for disabled service

If service is disabled, don't expect to create the corresponding
keystone account.

Change-Id: I007088862de1c8643eca3a6b9b313f0125b9b8d1
---
 stack.sh | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/stack.sh b/stack.sh
index 4cee385a33..f08d56f60a 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1057,11 +1057,18 @@ if is_service_enabled keystone; then
     fi
 
     create_keystone_accounts
-    create_nova_accounts
-    create_glance_accounts
-    create_cinder_accounts
-    create_neutron_accounts
-
+    if is_service_enabled nova; then
+        create_nova_accounts
+    fi
+    if is_service_enabled glance; then
+        create_glance_accounts
+    fi
+    if is_service_enabled cinder; then
+        create_cinder_accounts
+    fi
+    if is_service_enabled neutron; then
+        create_neutron_accounts
+    fi
     if is_service_enabled swift; then
         create_swift_accounts
     fi

From 9bc7708c801221a009a8e5f963c4343d81a6c913 Mon Sep 17 00:00:00 2001
From: Dave Chen <wei.d.chen@intel.com>
Date: Fri, 10 Mar 2017 05:34:21 +0800
Subject: [PATCH 0856/2409] Update the enabled service on compute nodes

Change the service from 'n-network' to 'q-agt' since
Nova network is not supported by default.

Change-Id: I085aac75d4c1b721498afa568c8ecfd5abc7b20c
---
 doc/source/guides/multinode-lab.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
index dfc9936915..1b7f4cd356 100644
--- a/doc/source/guides/multinode-lab.rst
+++ b/doc/source/guides/multinode-lab.rst
@@ -176,7 +176,7 @@ machines, create a ``local.conf`` with:
     MYSQL_HOST=$SERVICE_HOST
     RABBIT_HOST=$SERVICE_HOST
     GLANCE_HOSTPORT=$SERVICE_HOST:9292
-    ENABLED_SERVICES=n-cpu,n-net,n-api-meta,c-vol
+    ENABLED_SERVICES=n-cpu,q-agt,n-api-meta,c-vol
     NOVA_VNC_ENABLED=True
     NOVNCPROXY_URL="http://$SERVICE_HOST:6080/vnc_auto.html"
     VNCSERVER_LISTEN=$HOST_IP

From 1be04a0769124c8d44a22189d42d42712e87fed9 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Fri, 10 Mar 2017 08:05:05 +0000
Subject: [PATCH 0857/2409] Updated from generate-devstack-plugins-list

Change-Id: I95309e2857f0361b65dc6fbaf686aab94626c086
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 58d393ae74..266ab0dcc0 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -149,6 +149,7 @@ trove-dashboard                        `git://git.openstack.org/openstack/trove-
 vitrage                                `git://git.openstack.org/openstack/vitrage <https://git.openstack.org/cgit/openstack/vitrage>`__
 vitrage-dashboard                      `git://git.openstack.org/openstack/vitrage-dashboard <https://git.openstack.org/cgit/openstack/vitrage-dashboard>`__
 vmware-nsx                             `git://git.openstack.org/openstack/vmware-nsx <https://git.openstack.org/cgit/openstack/vmware-nsx>`__
+vmware-vspc                            `git://git.openstack.org/openstack/vmware-vspc <https://git.openstack.org/cgit/openstack/vmware-vspc>`__
 watcher                                `git://git.openstack.org/openstack/watcher <https://git.openstack.org/cgit/openstack/watcher>`__
 watcher-dashboard                      `git://git.openstack.org/openstack/watcher-dashboard <https://git.openstack.org/cgit/openstack/watcher-dashboard>`__
 zaqar                                  `git://git.openstack.org/openstack/zaqar <https://git.openstack.org/cgit/openstack/zaqar>`__

From d15f222e2b2c3ab40ae719cca115f984178e71e4 Mon Sep 17 00:00:00 2001
From: Ben Swartzlander <ben@swartzlander.org>
Date: Tue, 24 Jan 2017 00:23:41 -0500
Subject: [PATCH 0858/2409] Fix IPv6 provider networks

Add a missing --subnet-range argument when creating an ipv6 provider
network. Also changed SUBNET_V6_ID to IPV6_SUBNET_ID. And remove the
--ipv6-address-mode arg because it doesn't apply to subnets on routers.

Change-Id: I82796804a06e758e458606dc9eb400bcd08ad6e4
---
 lib/neutron_plugins/services/l3 | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index e87a30cadb..07974feb10 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -197,8 +197,8 @@ function create_neutron_initial_network {
             if [ -z $SUBNETPOOL_V6_ID ]; then
                 fixed_range_v6=$IPV6_PROVIDER_FIXED_RANGE
             fi
-            SUBNET_V6_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet create --project $project_id --ip-version 6 --ipv6-address-mode $IPV6_ADDRESS_MODE --gateway $IPV6_PROVIDER_NETWORK_GATEWAY $IPV6_PROVIDER_SUBNET_NAME ${SUBNETPOOL_V6_ID:+--subnet-pool $SUBNETPOOL_V6_ID} --network $NET_ID $fixed_range_v6 | grep 'id' | get_field 2)
-            die_if_not_set $LINENO SUBNET_V6_ID "Failure creating SUBNET_V6_ID for $IPV6_PROVIDER_SUBNET_NAME $project_id"
+            IPV6_SUBNET_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet create --project $project_id --ip-version 6 --gateway $IPV6_PROVIDER_NETWORK_GATEWAY $IPV6_PROVIDER_SUBNET_NAME ${SUBNETPOOL_V6_ID:+--subnet-pool $SUBNETPOOL_V6_ID} --network $NET_ID --subnet-range $fixed_range_v6 | grep ' id ' | get_field 2)
+            die_if_not_set $LINENO IPV6_SUBNET_ID "Failure creating IPV6_SUBNET_ID for $IPV6_PROVIDER_SUBNET_NAME $project_id"
         fi
 
         if [[ $Q_AGENT == "openvswitch" ]]; then

From b763dbda739c644ca048059d402d5667fe0e45ef Mon Sep 17 00:00:00 2001
From: wangxiyuan <wangxiyuan@huawei.com>
Date: Tue, 7 Mar 2017 20:47:58 +0800
Subject: [PATCH 0859/2409] Remove glare from glance

glare has been removed from glance already. Now error will be raised
if enable g-glare in local.conf.

Remove the glare support by glance.

Change-Id: I9a389af194dd2b8aed75d3c921293d800f8c591b
---
 lib/glance | 73 ------------------------------------------------------
 1 file changed, 73 deletions(-)

diff --git a/lib/glance b/lib/glance
index 6125f45cd8..2f4aa5f0f8 100644
--- a/lib/glance
+++ b/lib/glance
@@ -55,8 +55,6 @@ GLANCE_CACHE_CONF=$GLANCE_CONF_DIR/glance-cache.conf
 GLANCE_POLICY_JSON=$GLANCE_CONF_DIR/policy.json
 GLANCE_SCHEMA_JSON=$GLANCE_CONF_DIR/schema-image.json
 GLANCE_SWIFT_STORE_CONF=$GLANCE_CONF_DIR/glance-swift-store.conf
-GLANCE_GLARE_CONF=$GLANCE_CONF_DIR/glance-glare.conf
-GLANCE_GLARE_PASTE_INI=$GLANCE_CONF_DIR/glance-glare-paste.ini
 GLANCE_V1_ENABLED=${GLANCE_V1_ENABLED:-False}
 
 if is_ssl_enabled_service "glance" || is_service_enabled tls-proxy; then
@@ -72,8 +70,6 @@ GLANCE_HOSTPORT=${GLANCE_HOSTPORT:-$GLANCE_SERVICE_HOST:$GLANCE_SERVICE_PORT}
 GLANCE_SERVICE_PROTOCOL=${GLANCE_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 GLANCE_REGISTRY_PORT=${GLANCE_REGISTRY_PORT:-9191}
 GLANCE_REGISTRY_PORT_INT=${GLANCE_REGISTRY_PORT_INT:-19191}
-GLANCE_GLARE_PORT=${GLANCE_GLARE_PORT:-9494}
-GLANCE_GLARE_HOSTPORT=${GLANCE_GLARE_HOSTPORT:-$GLANCE_SERVICE_HOST:$GLANCE_GLARE_PORT}
 
 # Functions
 # ---------
@@ -98,9 +94,6 @@ function configure_glance {
     sudo install -d -o $STACK_USER $GLANCE_CONF_DIR $GLANCE_METADEF_DIR
 
     # Copy over our glance configurations and update them
-    if is_service_enabled g-glare; then
-        cp $GLANCE_DIR/etc/glance-glare.conf $GLANCE_GLARE_CONF
-    fi
     cp $GLANCE_DIR/etc/glance-registry.conf $GLANCE_REGISTRY_CONF
     iniset $GLANCE_REGISTRY_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
     iniset $GLANCE_REGISTRY_CONF DEFAULT bind_host $GLANCE_SERVICE_LISTEN_ADDRESS
@@ -143,9 +136,6 @@ function configure_glance {
 
     # Store specific configs
     iniset $GLANCE_API_CONF glance_store filesystem_store_datadir $GLANCE_IMAGE_DIR/
-    if is_service_enabled g-glare; then
-        iniset $GLANCE_GLARE_CONF glance_store filesystem_store_datadir $GLANCE_IMAGE_DIR/
-    fi
     iniset $GLANCE_API_CONF DEFAULT registry_host $GLANCE_SERVICE_HOST
 
     iniset $GLANCE_API_CONF DEFAULT workers "$API_WORKERS"
@@ -172,22 +162,6 @@ function configure_glance {
 
         iniset $GLANCE_SWIFT_STORE_CONF ref1 user $SERVICE_PROJECT_NAME:glance-swift
 
-        # Store the glare in swift if enabled.
-        if is_service_enabled g-glare; then
-            iniset $GLANCE_GLARE_CONF glance_store default_store swift
-            iniset $GLANCE_GLARE_CONF glance_store swift_store_create_container_on_put True
-
-            iniset $GLANCE_GLARE_CONF glance_store swift_store_config_file $GLANCE_SWIFT_STORE_CONF
-            iniset $GLANCE_GLARE_CONF glance_store default_swift_reference ref1
-            iniset $GLANCE_GLARE_CONF glance_store stores "file, http, swift"
-            iniset $GLANCE_GLARE_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
-
-            # commenting is not strictly necessary but it's confusing to have bad values in conf
-            inicomment $GLANCE_GLARE_CONF glance_store swift_store_user
-            inicomment $GLANCE_GLARE_CONF glance_store swift_store_key
-            inicomment $GLANCE_GLARE_CONF glance_store swift_store_auth_address
-        fi
-
         iniset $GLANCE_SWIFT_STORE_CONF ref1 key $SERVICE_PASSWORD
         if python3_enabled; then
             # NOTE(dims): Currently the glance_store+swift does not support either an insecure flag
@@ -266,29 +240,6 @@ function configure_glance {
         iniset $GLANCE_API_CONF DEFAULT cinder_endpoint_template "https://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/%(project_id)s"
         iniset $GLANCE_CACHE_CONF DEFAULT cinder_endpoint_template "https://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/%(project_id)s"
     fi
-
-    # Configure GLANCE_GLARE (Glance Glare)
-    if is_service_enabled g-glare; then
-        local dburl
-        dburl=`database_connection_url glance`
-        setup_logging $GLANCE_GLARE_CONF
-        iniset $GLANCE_GLARE_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-        iniset $GLANCE_GLARE_CONF DEFAULT bind_host $GLANCE_SERVICE_LISTEN_ADDRESS
-        iniset $GLANCE_GLARE_CONF DEFAULT bind_port $GLANCE_GLARE_PORT
-        inicomment $GLANCE_GLARE_CONF DEFAULT log_file
-        iniset $GLANCE_GLARE_CONF DEFAULT workers "$API_WORKERS"
-
-        iniset $GLANCE_GLARE_CONF database connection $dburl
-        iniset $GLANCE_GLARE_CONF paste_deploy flavor keystone
-        configure_auth_token_middleware $GLANCE_GLARE_CONF glare $GLANCE_AUTH_CACHE_DIR/artifact
-        # Register SSL certificates if provided
-        if is_ssl_enabled_service glance; then
-            ensure_certificates GLANCE
-            iniset $GLANCE_GLARE_CONF DEFAULT cert_file "$GLANCE_SSL_CERT"
-            iniset $GLANCE_GLARE_CONF DEFAULT key_file "$GLANCE_SSL_KEY"
-        fi
-        cp $GLANCE_DIR/etc/glance-glare-paste.ini $GLANCE_GLARE_PASTE_INI
-    fi
 }
 
 # create_glance_accounts() - Set up common required glance accounts
@@ -298,7 +249,6 @@ function configure_glance {
 # SERVICE_PROJECT_NAME  glance          service
 # SERVICE_PROJECT_NAME  glance-swift    ResellerAdmin (if Swift is enabled)
 # SERVICE_PROJECT_NAME  glance-search   search (if Search is enabled)
-# SERVICE_PROJECT_NAME  glare           service (if enabled)
 
 function create_glance_accounts {
     if is_service_enabled g-api; then
@@ -321,16 +271,6 @@ function create_glance_accounts {
         iniset $GLANCE_SWIFT_STORE_CONF ref1 project_domain_id $service_domain_id
         iniset $GLANCE_SWIFT_STORE_CONF ref1 user_domain_id $service_domain_id
     fi
-
-    # Add glance-glare service and endpoints
-    if is_service_enabled g-glare; then
-        create_service_user "glare"
-        get_or_create_service "glare" "artifact" "Glance Artifact Service"
-
-        get_or_create_endpoint "artifact" \
-            "$REGION_NAME" \
-            "$GLANCE_SERVICE_PROTOCOL://$GLANCE_GLARE_HOSTPORT"
-    fi
 }
 
 # create_glance_cache_dir() - Part of the init_glance() process
@@ -400,15 +340,6 @@ function start_glance {
     if ! wait_for_service $SERVICE_TIMEOUT $GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT; then
         die $LINENO "g-api did not start"
     fi
-
-    #Start g-glare after g-reg/g-api
-    if is_service_enabled g-glare; then
-        run_process g-glare "$GLANCE_BIN_DIR/glance-glare --config-file=$GLANCE_CONF_DIR/glance-glare.conf"
-        echo "Waiting for Glare [g-glare] ($GLANCE_GLARE_HOSTPORT) to start..."
-        if ! wait_for_service $SERVICE_TIMEOUT $GLANCE_SERVICE_PROTOCOL://$GLANCE_GLARE_HOSTPORT; then
-            die $LINENO " Glare [g-glare] did not start"
-        fi
-    fi
 }
 
 # stop_glance() - Stop running processes
@@ -416,10 +347,6 @@ function stop_glance {
     # Kill the Glance screen windows
     stop_process g-api
     stop_process g-reg
-
-    if is_service_enabled g-glare; then
-        stop_process g-glare
-    fi
 }
 
 # Restore xtrace

From 3345a6d316bd50f005d22bfd231a4f9c0a5b7d62 Mon Sep 17 00:00:00 2001
From: "John L. Villalovos" <john.l.villalovos@intel.com>
Date: Mon, 13 Mar 2017 13:47:34 -0700
Subject: [PATCH 0860/2409] Use string comparison to compare UUID values

Was using the '-ne' integer comparison operator to compare UUID
values. This caused error messages like:

/opt/stack/new/devstack/lib/tempest: line 226: [[: dfae26ac-1780-4677-902d: value too great for base (error token is "902d")

Change it to use '!=' string comparison operator

Change-Id: Ib7c9197dd0fe58addf33b4f82beea6de64f6b10b
---
 lib/tempest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index a9461d42ff..cf7eb6f722 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -223,7 +223,7 @@ function configure_tempest {
             # Ensure ``flavor_ref`` and ``flavor_ref_alt`` have different values.
             # Some resize instance in tempest tests depends on this.
             for f in ${flavors[@]:1}; do
-                if [[ $f -ne $flavor_ref ]]; then
+                if [[ "$f" != "$flavor_ref" ]]; then
                     flavor_ref_alt=$f
                     break
                 fi

From 99d5d1ce82e59347d6e90a8756dd6a08153a1486 Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Wed, 15 Mar 2017 13:42:25 +0100
Subject: [PATCH 0861/2409] FAQ: remove references to stable/kilo: use
 stable/ocata instead

It's 2017, some of our newest OpenStack developers/users may not
even know what stable/kilo is/was.

Change-Id: I00f39cc80af7e1632293bf057d95040b6bfa48e0
---
 doc/source/faq.rst | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/source/faq.rst b/doc/source/faq.rst
index 7793d8eb68..f03304f37f 100644
--- a/doc/source/faq.rst
+++ b/doc/source/faq.rst
@@ -130,8 +130,8 @@ How do I run a specific OpenStack release?
 DevStack master tracks the upstream master of all the projects. If you
 would like to run a stable branch of OpenStack, you should use the
 corresponding stable branch of DevStack as well. For instance the
-``stable/kilo`` version of DevStack will already default to all the
-projects running at ``stable/kilo`` levels.
+``stable/ocata`` version of DevStack will already default to all the
+projects running at ``stable/ocata`` levels.
 
 Note: it's also possible to manually adjust the ``*_BRANCH`` variables
 further if you would like to test specific milestones, or even custom

From 4b59fbb8573c57b27cf1ceb2a043cbe9cf7fd111 Mon Sep 17 00:00:00 2001
From: Jens Rosenboom <j.rosenboom@x-ion.de>
Date: Wed, 15 Mar 2017 21:58:48 +0000
Subject: [PATCH 0862/2409] Revert "put mysql on a memory diet"

The diet seems to be too strict, jobs failing with "out of sort memory". Needs more investigation before resubmitting.

This reverts commit 1e66388c5f2b81b4fc5d544dbf5fde2935218bd0.

Change-Id: Ic10effaaf047eb3527082baab889772c5e57fa90
---
 lib/databases/mysql | 183 +-------------------------------------------
 1 file changed, 1 insertion(+), 182 deletions(-)

diff --git a/lib/databases/mysql b/lib/databases/mysql
index e2c83433d2..7bbcace399 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -96,191 +96,10 @@ function configure_database_mysql {
     iniset -sudo $my_conf mysqld bind-address "$SERVICE_LISTEN_ADDRESS"
     iniset -sudo $my_conf mysqld sql_mode TRADITIONAL
     iniset -sudo $my_conf mysqld default-storage-engine InnoDB
-
-    # the number of connections has been throttled to 256. In the
-    # event that the gate jobs report "Too many connections" it is
-    # indicative of a problem that could be the result of one of many
-    # things. For more details about debugging this error, refer
-    # https://dev.mysql.com/doc/refman/5.5/en/too-many-connections.html.
-    # Note that the problem may not ONLY be an issue with MySQL
-    # connections. If the number of fd's at the OS is too low, you
-    # could see errors manifest as MySQL "too many connections".
-    iniset -sudo $my_conf mysqld max_connections 256
+    iniset -sudo $my_conf mysqld max_connections 1024
     iniset -sudo $my_conf mysqld query_cache_type OFF
     iniset -sudo $my_conf mysqld query_cache_size 0
 
-    # Additional settings to put MySQL on a memory diet. These
-    # settings are used in conjunction with the cap on max_connections
-    # as the total memory used by MySQL can be simply viewed as
-    # fixed-allocations + max_connections * variable-allocations. A
-    # nifty tool to help with this is
-    # http://www.mysqlcalculator.com/. A short description of each of
-    # the settings follows.
-
-    # binlog_cache_size, determines the size of cache to hold changes
-    # to the binary log during a transaction, for each connection. For
-    # more details, refer
-    # https://dev.mysql.com/doc/refman/5.6/en/replication-options-binary-log.html#sysvar_binlog_cache_size
-    # When binary logging is enabled, a smaller binlog cache could
-    # result in more frequent flushes to the disk and a larger value
-    # would result in less flushes to the disk but higher memory
-    # usage. This however only has to do with large transactions; if
-    # you have a small transaction the binlog cache is necessarily
-    # flushed on a transaction commit. This is a per-connection cache.
-    iniset -sudo $my_conf mysqld binlog_cache_size 4K
-
-    # binlog_stmt_cache_size determines the size of cache to hold non
-    # transactional statements in the binary log. For more details,
-    # refer
-    # https://dev.mysql.com/doc/refman/5.6/en/replication-options-binary-log.html#sysvar_binlog_stmt_cache_size
-    # This cache holds changes to non-transactional tables (read:
-    # MyISAM) or any non-transactional statements which cause
-    # modifications to data (truncate is an example). These are
-    # written to disk immediately on completion of the statement or
-    # when the cache is full. If the cache is too small, you get
-    # frequent writes to the disk (flush) and if the cache is too
-    # large, it takes up more memory. This is a per-connection cache.
-    iniset -sudo $my_conf mysqld binlog_stmt_cache_size 4K
-
-    # bulk_insert_buffer_size for MyISAM tables that use a special
-    # cache for insert statements and load statements, this cache is
-    # used to optimize writes to the disk. If the value is set to 0,
-    # the optimization is disabled. For more details refer
-    # https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_bulk_insert_buffer_size
-    # We set this to 0 which could result in higher disk I/O (I/O on
-    # each insert block completion).
-    iniset -sudo $my_conf mysqld bulk_insert_buffer_size 0
-
-    # host_cache_size controls a DNS lookup optimization. For more
-    # details refer
-    # https://dev.mysql.com/doc/refman/5.6/en/host-cache.html
-    iniset -sudo $my_conf mysqld host_cache_size 0
-
-    # innodb_buffer_pool_size This is the size of the server wide
-    # buffer pool. It is the cache for all data blocks being used by
-    # the server and is managed as a LRU chain. Dirty blocks either
-    # age off the list or are forced off when the list is
-    # full. Setting this to 5MB (default 128MB) reduces the amount of
-    # memory used by the server and this will result in more disk I/O
-    # in cases where (a) there is considerable write activity that
-    # overwhelms the allocated cache, or (b) there is considerable
-    # read activity on a data set that exceeds the allocated
-    # cache. For more details, refer
-    # https://dev.mysql.com/doc/refman/5.6/en/innodb-parameters.html#sysvar_innodb_buffer_pool_size
-    iniset -sudo $my_conf mysqld innodb_buffer_pool_size 5M
-
-    # innodb_ft_cache_size and innodb_ft_total_cache_size control the
-    # per-connection full text search cache and the server wide
-    # maximum full text search cache. We should not be using full text
-    # search and the value is set to the minimum allowable. The former
-    # is a per-connection cache size and the latter is server
-    # wide. For more details, refer
-    # https://dev.mysql.com/doc/refman/5.7/en/innodb-parameters.html#sysvar_innodb_ft_cache_size
-    # and
-    # https://dev.mysql.com/doc/refman/5.7/en/innodb-parameters.html#sysvar_innodb_ft_total_cache_size
-    iniset -sudo $my_conf mysqld innodb_ft_cache_size 1600000
-    iniset -sudo $my_conf mysqld innodb_ft_total_cache_size 32000000
-
-    # innodb_log_buffer_size This buffer is used to buffer
-    # transactions in-memory before writing them to the innodb
-    # internal transaction log. Large transactions, or high amounts of
-    # concurrency, will cause the system to fill this faster and thus
-    # make the system more disk-bound. For more details, refer
-    # https://dev.mysql.com/doc/refman/5.7/en/innodb-parameters.html#sysvar_innodb_log_buffer_size
-    iniset -sudo $my_conf mysqld innodb_log_buffer_size 256K
-
-    # innodb_sort_buffer_size, This buffer is used for sorting when
-    # InnoDB is creating indexes. Could cause that to be slower, but
-    # only if tables are large. This is a per-connection setting. For
-    # more details, refer
-    # https://dev.mysql.com/doc/refman/5.7/en/innodb-parameters.html#sysvar_innodb_sort_buffer_size
-    iniset -sudo $my_conf mysqld innodb_sort_buffer_size 64K
-
-    # join_buffer_size, This buffer makes table and index scans
-    # faster. So this setting could make some queries more disk
-    # bound. This is a per-connection setting. For more details refer
-    # https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_join_buffer_size.
-    iniset -sudo $my_conf mysqld join_buffer_size 128
-
-    # key_buffer_size defines the index blocks used for MyISAM tables
-    # and shared between threads. This is a server wide setting. For
-    # more details see
-    # https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_key_buffer_size
-    iniset -sudo $my_conf mysqld key_buffer_size 8
-
-    # max_heap_table_size sets the maximum amount of memory for MEMORY
-    # tables (which we don't use). The value is set to 16k, the
-    # minimum allowed. For more details, see
-    # https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_max_heap_table_size
-    iniset -sudo $my_conf mysqld max_heap_table_size 16K
-
-    # net_buffer_length Each client has a buffer for incoming and
-    # outgoing data, both start with a size of net_buffer_length and
-    # can grow (in steps of 2x) upto a size of max_allowed_packet. For
-    # more details see
-    # https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_net_buffer_length
-    iniset -sudo $my_conf mysqld net_buffer_length 1K
-
-    # read_buffer_size, read_rnd_buffer_size are per-thread buffer
-    # used for scans on MyISAM tables. It is a per-connection setting
-    # and so we set it to the minimum value allowable. Same for
-    # read_rnd_buffer_size. For more details refer
-    # https://dev.mysql.com/doc/refman/5.6/en/server-system-variables.html#sysvar_read_buffer_size
-    # and
-    # https://dev.mysql.com/doc/refman/5.6/en/server-system-variables.html#sysvar_read_rnd_buffer_size
-    iniset -sudo $my_conf mysqld read_buffer_size 8200
-    iniset -sudo $my_conf mysqld read_rnd_buffer_size 8200
-
-    # sort_buffer_size when a sort is requested, it will be performed
-    # in memory in a buffer of this size (allocated per connection)
-    # and if the data exceeds this size it will spill to disk. The
-    # innodb and myisam variables are used in computing indices for
-    # tables using the specified storage engine. Since we don't
-    # dynamically reindex (except during upgrade) these values should
-    # never be material. Obviously performance of disk based sorts is
-    # worse than in memory sorts and therefore a high value here will
-    # improve sort performance for large data. For more details,
-    # refer:
-    # https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_sort_buffer_size
-    # and
-    # https://dev.mysql.com/doc/refman/5.7/en/innodb-parameters.html#sysvar_innodb_sort_buffer_size
-    # and
-    # https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_myisam_sort_buffer_size
-    iniset -sudo $my_conf mysqld sort_buffer_size 32K
-    iniset -sudo $my_conf mysqld innodb_sort_buffer_size 64K
-    iniset -sudo $my_conf mysqld myisam_sort_buffer_size 4K
-
-    # thread_cache_size specifies how many internal threads to cache
-    # for use with incoming connections. We set this to 0 whic means
-    # that each connection will cause a new thread to be created. This
-    # could cause connections to take marginally longer on os'es with
-    # slow pthread_create calls. For more details, refer
-    # https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_thread_cache_size
-    iniset -sudo $my_conf mysqld thread_cache_size 0
-
-    # thread_stack is the per connection stack size, the minimum is
-    # 128k and the default is 192k on 32bit and 256k on 64bit
-    # systems. We set this to 192k. Complex queries which require
-    # recursion, stored procedures or other memory intensive
-    # operations could exhaust this and generate a very characteristic
-    # failure ("stack overflow") which is cleanly detected and the
-    # query is killed. For more details see
-    # https://dev.mysql.com/doc/refman/5.6/en/server-system-variables.html#sysvar_thread_stack
-    iniset -sudo $my_conf mysqld thread_stack 196608
-
-    # tmp_table_size is the maximum size of an in-memory temporary
-    # table. Temporary tables are created by MySQL as part of a
-    # multi-step query plan. The actual size of the temp table will be
-    # the lesser of tmp_table_size and max_heap_table_size. If a
-    # temporary table exceeds this size, it will be spooled to disk
-    # using the internal_tmp_disk_storage_engine (default
-    # MyISAM). Queries that often generate in-memory temporary tables
-    # include queries that have sorts, distinct, or group by
-    # operations, also queries that perform IN joins. For more details
-    # see
-    # https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_tmp_table_size
-    iniset -sudo $my_conf mysqld tmp_table_size 1K
-
     if [[ "$DATABASE_QUERY_LOGGING" == "True" ]]; then
         echo_summary "Enabling MySQL query logging"
         if is_fedora; then

From dab52d755481500dce3bf5f990037cde5d8022eb Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Thu, 16 Mar 2017 07:51:22 +0000
Subject: [PATCH 0863/2409] Updated from generate-devstack-plugins-list

Change-Id: I55dea8141046350f9cf06afb7edc957c35397b38
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 266ab0dcc0..cc55c0bd20 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -128,6 +128,7 @@ nova-mksproxy                          `git://git.openstack.org/openstack/nova-m
 nova-powervm                           `git://git.openstack.org/openstack/nova-powervm <https://git.openstack.org/cgit/openstack/nova-powervm>`__
 oaktree                                `git://git.openstack.org/openstack/oaktree <https://git.openstack.org/cgit/openstack/oaktree>`__
 octavia                                `git://git.openstack.org/openstack/octavia <https://git.openstack.org/cgit/openstack/octavia>`__
+octavia-dashboard                      `git://git.openstack.org/openstack/octavia-dashboard <https://git.openstack.org/cgit/openstack/octavia-dashboard>`__
 os-xenapi                              `git://git.openstack.org/openstack/os-xenapi <https://git.openstack.org/cgit/openstack/os-xenapi>`__
 osprofiler                             `git://git.openstack.org/openstack/osprofiler <https://git.openstack.org/cgit/openstack/osprofiler>`__
 panko                                  `git://git.openstack.org/openstack/panko <https://git.openstack.org/cgit/openstack/panko>`__

From 5f8bd0e452957c2b8f7c2a9c962342e69d33b17e Mon Sep 17 00:00:00 2001
From: jianghua <jianghua.wang@citrix.com>
Date: Tue, 14 Mar 2017 08:04:53 +0000
Subject: [PATCH 0864/2409] Xen: restrict devstack VM use upto 8 vCPUs.

Change-Id: Iea6086a3feb03dff581d9c04560133c4f57a6f6c
Closes-Bug: 1672642
---
 tools/xen/functions | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/tools/xen/functions b/tools/xen/functions
index 93f3413d6d..bc0c515e01 100644
--- a/tools/xen/functions
+++ b/tools/xen/functions
@@ -294,6 +294,18 @@ function max_vcpus {
     # Assert ithas a numeric nonzero value
     expr "$cpu_count" + 0
 
+    # 8 VCPUs should be enough for devstack VM; avoid using too
+    # many VCPUs:
+    # 1. too many VCPUs may trigger a kernel bug which result VM
+    #    not able to boot:
+    #    https://kernel.googlesource.com/pub/scm/linux/kernel/git/wsa/linux/+/e2e004acc7cbe3c531e752a270a74e95cde3ea48
+    # 2. The remaining CPUs can be used for other purpose:
+    #    e.g. boot test VMs.
+    MAX_VCPUS=8
+    if [ $cpu_count -ge $MAX_VCPUS ]; then
+        cpu_count=$MAX_VCPUS
+    fi
+
     xe vm-param-set uuid=$vm VCPUs-max=$cpu_count
     xe vm-param-set uuid=$vm VCPUs-at-startup=$cpu_count
 }

From fe1d3d6a7b3faa804800292c48f6ed2d75157963 Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Wed, 15 Mar 2017 13:27:20 +0100
Subject: [PATCH 0865/2409] Apache Keystone Template: reduce the number of
 processes to 3

Now Apache2 has 5 dedicated processes for Keystone Admin and 5 for
Keystone Public. As each Apache process consumes some memory and
we arbitrarly decided 5 was a good number more than 2 years ago,
maybe now (with the recent memory pressure we feel) is a good time
to reconcider.

With 5 processes our peakmem_tracker.py script reports a max RSS size
for the "wsgi:keystone-ad" and "wsgi:keystone-pu" processes of
2 (public and admin) * 5 (number of processes) * 90 Mo (RSS of each
process) = 900 Mo.

With 3 processes, the overall max RSS for Keystone is
2 * 3 * 90 = 540 Mo.

Note that this is RSS memory, but using the "smem" linux command on
my laptop, I noticed that the USS (Unique set size, i.e RSS excluding
shared memory) is around 80Mo per process. So reducing the number of
processes will actually reduce memory consumption.

Change-Id: Iba72d94aa15ecaa87c0115ad26d6bpeakmem_tracker62d5b3bea0a
---
 files/apache-keystone.template | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/files/apache-keystone.template b/files/apache-keystone.template
index 84dc273200..128436027d 100644
--- a/files/apache-keystone.template
+++ b/files/apache-keystone.template
@@ -7,7 +7,7 @@ LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\" %D(us)"
 </Directory>
 
 <VirtualHost *:%PUBLICPORT%>
-    WSGIDaemonProcess keystone-public processes=5 threads=1 user=%USER% display-name=%{GROUP} %VIRTUALENV%
+    WSGIDaemonProcess keystone-public processes=3 threads=1 user=%USER% display-name=%{GROUP} %VIRTUALENV%
     WSGIProcessGroup keystone-public
     WSGIScriptAlias / %KEYSTONE_BIN%/keystone-wsgi-public
     WSGIApplicationGroup %{GLOBAL}
@@ -21,7 +21,7 @@ LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\" %D(us)"
 </VirtualHost>
 
 <VirtualHost *:%ADMINPORT%>
-    WSGIDaemonProcess keystone-admin processes=5 threads=1 user=%USER% display-name=%{GROUP} %VIRTUALENV%
+    WSGIDaemonProcess keystone-admin processes=3 threads=1 user=%USER% display-name=%{GROUP} %VIRTUALENV%
     WSGIProcessGroup keystone-admin
     WSGIScriptAlias / %KEYSTONE_BIN%/keystone-wsgi-admin
     WSGIApplicationGroup %{GLOBAL}

From 8cf9acd577a30bf9e6a54a9d82b9b7fc9ae769fb Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Thu, 16 Mar 2017 14:06:58 -0700
Subject: [PATCH 0866/2409] Tune apache connection limits down

We are facing memory pressure in gate testing. Apache is fairly large so
tune its connection limits down to try and squeeze out more useable
memory. THis should be fine for dev envs, also tlsproxy is not enabled
by default so we can check that this tuning works well on a subset of
jobs before making it default everywhere.

Data comparisons done with gate-tempest-dsvm-neutron-full-ubuntu-xenial
jobs.

Old: http://logs.openstack.org/37/447037/2/check/gate-tempest-dsvm-neutron-full-ubuntu-xenial/721fc6f/logs/screen-peakmem_tracker.txt.gz
       PID   %MEM             RSS       PPID       TIME     NLWP WCHAN                     COMMAND
     20504    0.2           16660      19589   00:00:00       34 -                         /usr/sbin/apache2 -k start
     20505    0.2           16600      19589   00:00:00       34 -                         /usr/sbin/apache2 -k start
     20672    0.2           16600      19589   00:00:00       34 -                         /usr/sbin/apache2 -k start
     20503    0.1           14388      19589   00:00:00       34 -                         /usr/sbin/apache2 -k start
     19589    0.1            9964          1   00:00:00        1 -                         /usr/sbin/apache2 -k start
Total RSS: 74212

New: http://logs.openstack.org/41/446741/1/check/gate-tempest-dsvm-neutron-full-ubuntu-xenial/fa4d2e6/logs/screen-peakmem_tracker.txt.gz
       PID   %MEM             RSS       PPID       TIME     NLWP WCHAN                     COMMAND
      8036    0.1           15316       8018   00:00:01       34 -                         /usr/sbin/apache2 -k start
      8037    0.1           15228       8018   00:00:01       34 -                         /usr/sbin/apache2 -k start
      8018    0.1            8584          1   00:00:00        1 -                         /usr/sbin/apache2 -k start
Total RSS: 39128

Note RSS here is in KB. Total difference is 35084KB or about
34MB. Not the biggest change, but we seem to be functional and it
almost halves the apache overhead.

Change-Id: If82fa347db140021197a215113df4ce38fb4fd17
---
 lib/tls | 25 +++++++++++++------------
 1 file changed, 13 insertions(+), 12 deletions(-)

diff --git a/lib/tls b/lib/tls
index f9ef554a6c..fb2fa3a17b 100644
--- a/lib/tls
+++ b/lib/tls
@@ -457,29 +457,30 @@ function tune_apache_connections {
 # MaxClients: maximum number of simultaneous client connections
 # MaxRequestsPerChild: maximum number of requests a server process serves
 #
-# The apache defaults are too conservative if we want reliable tempest
-# testing. Bump these values up from ~400 max clients to 1024 max clients.
+# We want to be memory thrifty so tune down apache to allow 256 total
+# connections. This should still be plenty for a dev env yet lighter than
+# apache defaults.
 <IfModule mpm_worker_module>
 # Note that the next three conf values must be changed together.
 # MaxClients = ServerLimit * ThreadsPerChild
-ServerLimit          32
+ServerLimit           8
 ThreadsPerChild      32
-MaxClients         1024
-StartServers          3
-MinSpareThreads      96
-MaxSpareThreads     192
+MaxClients          256
+StartServers          2
+MinSpareThreads      32
+MaxSpareThreads      96
 ThreadLimit          64
 MaxRequestsPerChild   0
 </IfModule>
 <IfModule mpm_event_module>
 # Note that the next three conf values must be changed together.
 # MaxClients = ServerLimit * ThreadsPerChild
-ServerLimit          32
+ServerLimit           8
 ThreadsPerChild      32
-MaxClients         1024
-StartServers          3
-MinSpareThreads      96
-MaxSpareThreads     192
+MaxClients          256
+StartServers          2
+MinSpareThreads      32
+MaxSpareThreads      96
 ThreadLimit          64
 MaxRequestsPerChild   0
 </IfModule>

From 4ae92b846b45ac9ef02e9d19b5d9ddcb4ac05bf3 Mon Sep 17 00:00:00 2001
From: Julian Edwards <bigjools@gmail.com>
Date: Thu, 16 Mar 2017 09:01:39 +1000
Subject: [PATCH 0867/2409] Make running_in_container work in more containers

Instead of grepping for 'lxc' in /proc/1/cgroup, use systemd's
features. This now at least also works in LXD containers.

Change-Id: I35e807c26f0b1fbba83ddbe04cfb4901a7a95cbe
---
 functions | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions b/functions
index 1aa7517a8a..4435f2de2f 100644
--- a/functions
+++ b/functions
@@ -666,7 +666,7 @@ function set_mtu {
 
 # running_in_container - Returns true otherwise false
 function running_in_container {
-    if grep -q lxc /proc/1/cgroup; then
+    if [[ $(systemd-detect-virt --container) == 'none' ]]; then
         return 0
     fi
 

From a4c57cadf2fcc448dbee04a5f911af5613038678 Mon Sep 17 00:00:00 2001
From: David Rabel <rabel@b1-systems.de>
Date: Fri, 17 Mar 2017 16:14:00 +0100
Subject: [PATCH 0868/2409] Replace "sid" and "testing" by "stretch"

Supported Debian distros (codenames) are "sid", "testing",
and "jessie", but it should be "stretch" and "jessie".

"testing" is no codename and therefore should be replaced by
"stretch".

"sid" changes all the time and cannot be guaranteed to run
correctly or is at least not tested.

Change-Id: Id4b80a055452bbff69036d4dc1adeda46ce99664
Closes-Bug: #1673810
Closes-Bug: #1674416
---
 stack.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index f08d56f60a..20cdc1dfcc 100755
--- a/stack.sh
+++ b/stack.sh
@@ -192,7 +192,7 @@ source $TOP_DIR/stackrc
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (xenial|yakkety|zesty|sid|testing|jessie|f24|f25|rhel7|kvmibm1) ]]; then
+if [[ ! ${DISTRO} =~ (xenial|yakkety|zesty|stretch|jessie|f24|f25|rhel7|kvmibm1) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From bacfb94390e0680fac13cb7f7236b9d5d0e89b89 Mon Sep 17 00:00:00 2001
From: Armando Migliaccio <armamig@gmail.com>
Date: Mon, 20 Mar 2017 22:27:20 -0700
Subject: [PATCH 0869/2409] Enable openSUSE to work in Python 3.x environments

Add packages required to run devstack with USE_PYTHON3=True.

Change-Id: Iee43c9335bd82c10cfaeffb02d1d99290c34bb83
---
 inc/python | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/inc/python b/inc/python
index a4819c2d9d..2443c4d465 100644
--- a/inc/python
+++ b/inc/python
@@ -553,6 +553,8 @@ function python3_enabled {
 function install_python3 {
     if is_ubuntu; then
         apt_get install python${PYTHON3_VERSION} python${PYTHON3_VERSION}-dev
+    elif is_suse; then
+        install_package python3-devel python3-dbm
     fi
 }
 

From 583c52066da6738d12201bf3fcbb02b6c6690cfc Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 21 Mar 2017 11:15:05 -0400
Subject: [PATCH 0870/2409] rebuild the tempest tox env during install

When redoing a stack.sh over and over again, tempest venv can get out
of sync and cause issues until deleted. We should rebuild that tempest
venv on every stack.

Change-Id: I2f66bb1a7ccf9f89e11db1326d8553589e52fbf2
---
 lib/tempest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index cf7eb6f722..1160ee723c 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -618,7 +618,7 @@ function install_tempest {
     git_clone $TEMPEST_REPO $TEMPEST_DIR $TEMPEST_BRANCH
     pip_install tox
     pushd $TEMPEST_DIR
-    tox --notest -efull
+    tox -r --notest -efull
     # NOTE(mtreinish) Respect constraints in the tempest full venv, things that
     # are using a tox job other than full will not be respecting constraints but
     # running pip install -U on tempest requirements

From 983cccb75be919677bacb8c9b292550075b0358f Mon Sep 17 00:00:00 2001
From: Jim Rollenhagen <jim@jimrollenhagen.com>
Date: Tue, 21 Mar 2017 18:37:24 -0400
Subject: [PATCH 0871/2409] Enable baremetal scheduler filters when using
 ironic

These are recommended for all ironic deploys; turn them on.

Change-Id: Ia3df144e626266ed1774c4cd9863aedb876c409f
---
 lib/nova_plugins/hypervisor-ironic | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/nova_plugins/hypervisor-ironic b/lib/nova_plugins/hypervisor-ironic
index 7ffd14d046..c9544fe6c7 100644
--- a/lib/nova_plugins/hypervisor-ironic
+++ b/lib/nova_plugins/hypervisor-ironic
@@ -42,6 +42,7 @@ function configure_nova_hypervisor {
     iniset $NOVA_CONF DEFAULT compute_driver ironic.IronicDriver
     iniset $NOVA_CONF DEFAULT firewall_driver $LIBVIRT_FIREWALL_DRIVER
     iniset $NOVA_CONF DEFAULT scheduler_host_manager ironic_host_manager
+    iniset $NOVA_CONF filter_scheduler use_baremetal_filters True
     iniset $NOVA_CONF DEFAULT ram_allocation_ratio 1.0
     iniset $NOVA_CONF DEFAULT reserved_host_memory_mb 0
     # ironic section

From c779b00840b79ce9c0b3a3c80ade5267e6fcb5f8 Mon Sep 17 00:00:00 2001
From: Huan Xie <huan.xie@citrix.com>
Date: Thu, 16 Feb 2017 20:10:36 -0800
Subject: [PATCH 0872/2409] Remove XenServer specific ovs agent config

With XenServer we have two neutron-openvswitch-agent(q-agt, q-domua)
For the q-domua it is specific for XenServer, this patch is to move
the specific configurations to os-xenapi which we have devstack plugin
in that repo

Depends-On: Ic816404c84f6a8899d01a77cb67fbfb421653e6b

Change-Id: I8a31c81d9475387fe4ed7030b70b26098e588771
---
 lib/neutron-legacy                    | 27 -----------
 lib/neutron_plugins/openvswitch_agent | 65 ---------------------------
 lib/nova_plugins/hypervisor-xenserver | 14 ------
 3 files changed, 106 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index ccab527f66..41bd0c0d78 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -432,24 +432,6 @@ function install_mutnauq {
 
     git_clone $NEUTRON_REPO $NEUTRON_DIR $NEUTRON_BRANCH
     setup_develop $NEUTRON_DIR
-
-    if [ "$VIRT_DRIVER" == 'xenserver' ]; then
-        local dom0_ip
-        dom0_ip=$(echo "$XENAPI_CONNECTION_URL" | cut -d "/" -f 3-)
-
-        local ssh_dom0
-        ssh_dom0="sudo -u $DOMZERO_USER ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null root@$dom0_ip"
-
-        # Find where the plugins should go in dom0
-        local xen_functions
-        xen_functions=$(cat $TOP_DIR/tools/xen/functions)
-        local plugin_dir
-        plugin_dir=$($ssh_dom0 "$xen_functions; set -eux; xapi_plugin_location")
-
-        # install neutron plugins to dom0
-        tar -czf - -C $NEUTRON_DIR/neutron/plugins/ml2/drivers/openvswitch/agent/xenapi/etc/xapi.d/plugins/ ./ |
-            $ssh_dom0 "tar -xzf - -C $plugin_dir && chmod a+x $plugin_dir/*"
-    fi
 }
 
 # install_neutron_agent_packages() - Collect source and prepare
@@ -523,11 +505,6 @@ function start_mutnauq_other_agents {
 
     run_process q-meta "$AGENT_META_BINARY --config-file $NEUTRON_CONF --config-file $Q_META_CONF_FILE"
     run_process q-metering "$AGENT_METERING_BINARY --config-file $NEUTRON_CONF --config-file $METERING_AGENT_CONF_FILENAME"
-
-    if [ "$VIRT_DRIVER" = 'xenserver' ]; then
-        # For XenServer, start an agent for the domU openvswitch
-        run_process q-domua "$AGENT_BINARY --config-file $NEUTRON_CONF --config-file /$Q_PLUGIN_CONF_FILE.domU"
-    fi
 }
 
 # Start running processes, including screen
@@ -539,10 +516,6 @@ function start_neutron_agents {
 
 function stop_mutnauq_l2_agent {
     stop_process q-agt
-
-    if [ "$VIRT_DRIVER" = 'xenserver' ]; then
-        stop_process q-domua
-    fi
 }
 
 # stop_mutnauq_other() - Stop running processes (non-screen)
diff --git a/lib/neutron_plugins/openvswitch_agent b/lib/neutron_plugins/openvswitch_agent
index acab582212..b65a2587c2 100644
--- a/lib/neutron_plugins/openvswitch_agent
+++ b/lib/neutron_plugins/openvswitch_agent
@@ -11,12 +11,6 @@ source $TOP_DIR/lib/neutron_plugins/ovs_base
 
 function neutron_plugin_create_nova_conf {
     _neutron_ovs_base_configure_nova_vif_driver
-    if [ "$VIRT_DRIVER" == 'xenserver' ]; then
-        iniset $NOVA_CONF xenserver vif_driver nova.virt.xenapi.vif.XenAPIOpenVswitchDriver
-        iniset $NOVA_CONF xenserver ovs_integration_bridge $XEN_INTEGRATION_BRIDGE
-        # Disable nova's firewall so that it does not conflict with neutron
-        iniset $NOVA_CONF DEFAULT firewall_driver nova.virt.firewall.NoopFirewallDriver
-    fi
 }
 
 function neutron_plugin_install_agent_packages {
@@ -58,65 +52,6 @@ function neutron_plugin_configure_plugin_agent {
     fi
     AGENT_BINARY="$NEUTRON_BIN_DIR/neutron-openvswitch-agent"
 
-    if [ "$VIRT_DRIVER" == 'xenserver' ]; then
-        # Make a copy of our config for domU
-        sudo cp /$Q_PLUGIN_CONF_FILE "/$Q_PLUGIN_CONF_FILE.domU"
-
-        # change domU's config file to STACK_USER
-        sudo chown $STACK_USER:$STACK_USER /$Q_PLUGIN_CONF_FILE.domU
-
-        # Deal with Dom0's L2 Agent:
-        Q_RR_DOM0_COMMAND="$NEUTRON_BIN_DIR/neutron-rootwrap-xen-dom0 $Q_RR_CONF_FILE"
-
-        # For now, duplicate the xen configuration already found in nova.conf
-        iniset $Q_RR_CONF_FILE xenapi xenapi_connection_url "$XENAPI_CONNECTION_URL"
-        iniset $Q_RR_CONF_FILE xenapi xenapi_connection_username "$XENAPI_USER"
-        iniset $Q_RR_CONF_FILE xenapi xenapi_connection_password "$XENAPI_PASSWORD"
-
-        # Under XS/XCP, the ovs agent needs to target the dom0
-        # integration bridge.  This is enabled by using a root wrapper
-        # that executes commands on dom0 via a XenAPI plugin.
-        # XenAPI does not support daemon rootwrap now, so set root_helper_daemon empty
-        iniset "/$Q_PLUGIN_CONF_FILE.domU" agent root_helper ""
-        iniset "/$Q_PLUGIN_CONF_FILE.domU" agent root_helper_daemon "xenapi_root_helper"
-        iniset "/$Q_PLUGIN_CONF_FILE.domU" xenapi connection_url "$XENAPI_CONNECTION_URL"
-        iniset "/$Q_PLUGIN_CONF_FILE.domU" xenapi connection_username "$XENAPI_USER"
-        iniset "/$Q_PLUGIN_CONF_FILE.domU" xenapi connection_password "$XENAPI_PASSWORD"
-
-        # Disable minimize polling, so that it can always detect OVS and Port changes
-        # This is a problem of xenserver + neutron, bug has been reported
-        # https://bugs.launchpad.net/neutron/+bug/1495423
-        iniset "/$Q_PLUGIN_CONF_FILE.domU" agent minimize_polling False
-
-        # Set "physical" mapping
-        iniset "/$Q_PLUGIN_CONF_FILE.domU" ovs bridge_mappings "physnet1:$FLAT_NETWORK_BRIDGE"
-
-        # XEN_INTEGRATION_BRIDGE is the integration bridge in dom0
-        iniset "/$Q_PLUGIN_CONF_FILE.domU" ovs integration_bridge $XEN_INTEGRATION_BRIDGE
-
-        # Set OVS native interface for ovs-agent in compute node
-        XEN_DOM0_IP=$(echo "$XENAPI_CONNECTION_URL" | cut -d "/" -f 3)
-        iniset /$Q_PLUGIN_CONF_FILE.domU ovs ovsdb_connection tcp:$XEN_DOM0_IP:6640
-        iniset /$Q_PLUGIN_CONF_FILE.domU ovs of_listen_address $HOST_IP
-
-        # Set up domU's L2 agent:
-
-        # Create a bridge "br-$VLAN_INTERFACE"
-        _neutron_ovs_base_add_bridge "br-$VLAN_INTERFACE"
-        # Add $VLAN_INTERFACE to that bridge
-        sudo ovs-vsctl -- --may-exist add-port "br-$VLAN_INTERFACE" $VLAN_INTERFACE
-
-        # Create external bridge and add port
-        _neutron_ovs_base_add_public_bridge
-        sudo ovs-vsctl -- --may-exist add-port $PUBLIC_BRIDGE $PUBLIC_INTERFACE
-
-        # Set bridge mappings to "physnet1:br-$GUEST_INTERFACE_DEFAULT"
-        iniset /$Q_PLUGIN_CONF_FILE ovs bridge_mappings "physnet1:br-$VLAN_INTERFACE,physnet-ex:$PUBLIC_BRIDGE"
-        # Set integration bridge to domU's
-        iniset /$Q_PLUGIN_CONF_FILE ovs integration_bridge $OVS_BRIDGE
-        # Set root wrap
-        iniset /$Q_PLUGIN_CONF_FILE agent root_helper "$Q_RR_COMMAND"
-    fi
     iniset /$Q_PLUGIN_CONF_FILE agent tunnel_types $Q_TUNNEL_TYPES
     iniset /$Q_PLUGIN_CONF_FILE ovs datapath_type $OVS_DATAPATH_TYPE
 }
diff --git a/lib/nova_plugins/hypervisor-xenserver b/lib/nova_plugins/hypervisor-xenserver
index 0046a366c9..4abb92a654 100644
--- a/lib/nova_plugins/hypervisor-xenserver
+++ b/lib/nova_plugins/hypervisor-xenserver
@@ -96,20 +96,6 @@ CRONTAB
         echo "create_directory_for_kernels"
         echo "install_conntrack_tools"
     } | $ssh_dom0
-
-    if is_service_enabled neutron; then
-        # Remove restriction on linux bridge in Dom0 when neutron is enabled
-        $ssh_dom0 "rm -f /etc/modprobe.d/blacklist-bridge*"
-
-        count=`$ssh_dom0 "iptables -t filter -L XenServerDevstack |wc -l"`
-        if [ "$count" = "0" ]; then
-        {
-            echo "iptables -t filter --new XenServerDevstack"
-            echo "iptables -t filter -I INPUT -j XenServerDevstack"
-            echo "iptables -t filter -I XenServerDevstack -p tcp --dport 6640 -j ACCEPT"
-        } | $ssh_dom0
-        fi
-    fi
 }
 
 # install_nova_hypervisor() - Install external components

From fca0da5069f0c90ddcd38d489cb81597d569953a Mon Sep 17 00:00:00 2001
From: David Rabel <rabel@b1-systems.de>
Date: Fri, 17 Mar 2017 14:47:18 +0100
Subject: [PATCH 0873/2409] Create /opt/stack and make it home directory

single-machine.rst and index.rst

Before this, one had to create /opt/stack
manually and chown it to the stack user.
Now it is created when the user is created.

This is the same way the multi-node guide
handles it. A stack group is created too.

Change-Id: I5363d81c8fb38796f565cc6ebf6ab2dee2673989
Closes-Bug: #1673787
Closes-Bug: #1671409
---
 doc/source/guides/single-machine.rst | 2 +-
 doc/source/index.rst                 | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/source/guides/single-machine.rst b/doc/source/guides/single-machine.rst
index 011c41fbce..48a4fa8b12 100644
--- a/doc/source/guides/single-machine.rst
+++ b/doc/source/guides/single-machine.rst
@@ -47,7 +47,7 @@ below)
 
 ::
 
-    adduser stack
+    useradd -s /bin/bash -d /opt/stack -m stack
 
 Since this user will be making many changes to your system, it will need
 to have sudo privileges:
diff --git a/doc/source/index.rst b/doc/source/index.rst
index edd6595da2..f8d500813e 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -56,7 +56,7 @@ You can quickly create a separate `stack` user to run DevStack with
 
 ::
 
-   $ sudo adduser stack
+   $ sudo useradd -s /bin/bash -d /opt/stack -m stack
 
 Since this user will be making many changes to your system, it should
 have sudo privileges:

From 530d90c9c245e11feaae5b4031bd4d8b95e4db84 Mon Sep 17 00:00:00 2001
From: David Rabel <rabel@b1-systems.de>
Date: Wed, 22 Mar 2017 08:25:26 +0100
Subject: [PATCH 0874/2409] Delete unnecessary groupadd in multinode-lab

Change-Id: I13c86a19c421d8ef102f35bcae63f6dc69317268
Closes-Bug: #1674897
---
 doc/source/guides/multinode-lab.rst | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
index 1b7f4cd356..484ebba571 100644
--- a/doc/source/guides/multinode-lab.rst
+++ b/doc/source/guides/multinode-lab.rst
@@ -73,8 +73,7 @@ Otherwise create the stack user:
 
 ::
 
-    groupadd stack
-    useradd -g stack -s /bin/bash -d /opt/stack -m stack
+    useradd -s /bin/bash -d /opt/stack -m stack
 
 This user will be making many changes to your system during installation
 and operation so it needs to have sudo privileges to root without a

From 9e64bad03ab11918f6b08f7926685bfb9d7e4596 Mon Sep 17 00:00:00 2001
From: Huan Xie <huan.xie@citrix.com>
Date: Thu, 9 Mar 2017 20:05:57 -0800
Subject: [PATCH 0875/2409] Use br-int when XenServer is hypervisor

Previously we use a specific integration bridge for neutron ovs agent
which is running in compute node, but this isn't necessary, this
patch is to remove the specific integration bridge for XenSever and
remove the custom integration bridge definition

Depends-On: I675565e1ea6c887d40d7a53f62968c4aa385ecca

Change-Id: If5886e3711765a97f40f20e478f958b988b5a620
---
 lib/nova_plugins/hypervisor-xenserver |  4 ----
 tools/xen/README.md                   |  5 -----
 tools/xen/install_os_domU.sh          | 12 +-----------
 tools/xen/xenrc                       |  1 -
 4 files changed, 1 insertion(+), 21 deletions(-)

diff --git a/lib/nova_plugins/hypervisor-xenserver b/lib/nova_plugins/hypervisor-xenserver
index 0046a366c9..67b3d76932 100644
--- a/lib/nova_plugins/hypervisor-xenserver
+++ b/lib/nova_plugins/hypervisor-xenserver
@@ -26,10 +26,6 @@ set +o xtrace
 
 # Allow ``build_domU.sh`` to specify the flat network bridge via kernel args
 FLAT_NETWORK_BRIDGE_DEFAULT=$(sed -e 's/.* flat_network_bridge=\([[:alnum:]]*\).*$/\1/g' /proc/cmdline)
-if is_service_enabled neutron; then
-    XEN_INTEGRATION_BRIDGE_DEFAULT=$(sed -e 's/.* xen_integration_bridge=\([[:alnum:]]*\).*$/\1/g' /proc/cmdline)
-    XEN_INTEGRATION_BRIDGE=${XEN_INTEGRATION_BRIDGE:-$XEN_INTEGRATION_BRIDGE_DEFAULT}
-fi
 
 VNCSERVER_PROXYCLIENT_ADDRESS=${VNCSERVER_PROXYCLIENT_ADDRESS=169.254.0.1}
 
diff --git a/tools/xen/README.md b/tools/xen/README.md
index 7062ecb48c..9559e773d3 100644
--- a/tools/xen/README.md
+++ b/tools/xen/README.md
@@ -171,8 +171,3 @@ VM as `TEMPLATE_FILENAME`:
     umount "$mountdir"
     rm -rf "$mountdir"
 
-### Migrate OpenStack DomU to another host
-
-Given you need to migrate your DomU with OpenStack installed to another host,
-you need to set `XEN_INTEGRATION_BRIDGE` in localrc if neutron network is used.
-It is the bridge for `XEN_INT_BRIDGE_OR_NET_NAME` network created in Dom0
diff --git a/tools/xen/install_os_domU.sh b/tools/xen/install_os_domU.sh
index d2e2c572c6..ac7af0df43 100755
--- a/tools/xen/install_os_domU.sh
+++ b/tools/xen/install_os_domU.sh
@@ -66,10 +66,6 @@ setup_network "$VM_BRIDGE_OR_NET_NAME"
 setup_network "$MGT_BRIDGE_OR_NET_NAME"
 setup_network "$PUB_BRIDGE_OR_NET_NAME"
 
-# With neutron, one more network is required, which is internal to the
-# hypervisor, and used by the VMs
-setup_network "$XEN_INT_BRIDGE_OR_NET_NAME"
-
 if parameter_is_specified "FLAT_NETWORK_BRIDGE"; then
     if [ "$(bridge_for "$VM_BRIDGE_OR_NET_NAME")" != "$(bridge_for "$FLAT_NETWORK_BRIDGE")" ]; then
         cat >&2 << EOF
@@ -292,15 +288,9 @@ add_interface "$GUEST_NAME" "$PUB_BRIDGE_OR_NET_NAME" "$PUB_DEV_NR"
 #
 $THIS_DIR/build_xva.sh "$GUEST_NAME"
 
-# Attach a network interface for the integration network (so that the bridge
-# is created by XenServer). This is required for Neutron. Also pass that as a
-# kernel parameter for DomU
-attach_network "$XEN_INT_BRIDGE_OR_NET_NAME"
-
 XEN_INTEGRATION_BRIDGE_DEFAULT=$(bridge_for "$XEN_INT_BRIDGE_OR_NET_NAME")
 append_kernel_cmdline \
-    "$GUEST_NAME" \
-    "xen_integration_bridge=${XEN_INTEGRATION_BRIDGE_DEFAULT}"
+    "$GUEST_NAME"
 
 FLAT_NETWORK_BRIDGE="${FLAT_NETWORK_BRIDGE:-$(bridge_for "$VM_BRIDGE_OR_NET_NAME")}"
 append_kernel_cmdline "$GUEST_NAME" "flat_network_bridge=${FLAT_NETWORK_BRIDGE}"
diff --git a/tools/xen/xenrc b/tools/xen/xenrc
index 60be02f3fe..169e0427a8 100644
--- a/tools/xen/xenrc
+++ b/tools/xen/xenrc
@@ -29,7 +29,6 @@ OSDOMU_VDI_GB=8
 # Get the management network from the XS installation
 VM_BRIDGE_OR_NET_NAME="OpenStack VM Network"
 PUB_BRIDGE_OR_NET_NAME="OpenStack Public Network"
-XEN_INT_BRIDGE_OR_NET_NAME="OpenStack VM Integration Network"
 
 # VM Password
 GUEST_PASSWORD=${GUEST_PASSWORD:-secret}

From d18d7c86581b419541b291990173f5fb33a45445 Mon Sep 17 00:00:00 2001
From: kesper <paresh.h.sao@gmail.com>
Date: Thu, 23 Mar 2017 05:52:33 +0000
Subject: [PATCH 0876/2409] Change for the 'running_in_container' check

This commit change check of 'running_in_container'
method so that other services ironic, nova and neutron
will not break.

Change-Id: I42eb587cfaebf37944cb10e459b8b8f7b4b4e4ba
---
 functions | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/functions b/functions
index 4435f2de2f..872f21691a 100644
--- a/functions
+++ b/functions
@@ -666,11 +666,7 @@ function set_mtu {
 
 # running_in_container - Returns true otherwise false
 function running_in_container {
-    if [[ $(systemd-detect-virt --container) == 'none' ]]; then
-        return 0
-    fi
-
-    return 1
+    [[ $(systemd-detect-virt --container) != 'none' ]]
 }
 
 

From 5ae945244ec22634f95897cb50e44fb7c2da43a6 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 23 Mar 2017 12:45:29 -0400
Subject: [PATCH 0877/2409] run memory_tracker as root

In order to get memlocked pages this needs to be run as root, just
start it as root so that we don't have issues with the inability to
run sudo later in the run.

Change-Id: I7adab8cbb6d89d4717e427aec22e316d27bea075
---
 lib/dstat               | 4 ++--
 tools/memory_tracker.sh | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/dstat b/lib/dstat
index 62795f5e72..517e4237ac 100644
--- a/lib/dstat
+++ b/lib/dstat
@@ -24,12 +24,12 @@ function start_dstat {
     # To enable memory_tracker add:
     #    enable_service memory_tracker
     # to your localrc
-    run_process memory_tracker "$TOP_DIR/tools/memory_tracker.sh"
+    run_process memory_tracker "sudo $TOP_DIR/tools/memory_tracker.sh"
 
     # remove support for the old name when it's no longer used (sometime in Queens)
     if is_service_enabled peakmem_tracker; then
         deprecated "Use of peakmem_tracker in devstack is deprecated, use memory_tracker instead"
-        run_process peakmem_tracker "$TOP_DIR/tools/memory_tracker.sh"
+        run_process peakmem_tracker "sudo $TOP_DIR/tools/memory_tracker.sh"
     fi
 }
 
diff --git a/tools/memory_tracker.sh b/tools/memory_tracker.sh
index dac0267a7e..7397c03941 100755
--- a/tools/memory_tracker.sh
+++ b/tools/memory_tracker.sh
@@ -86,7 +86,7 @@ function tracker {
             # list processes that lock memory from swap
             if [[ $unevictable -ne $unevictable_point ]]; then
                 unevictable_point=$unevictable
-                sudo ./tools/mlock_report.py
+                ./tools/mlock_report.py
             fi
 
             echo "]]]"

From 682e0abe1a58edcdde40a92df1f060dc8fa758c8 Mon Sep 17 00:00:00 2001
From: David Rabel <rabel@b1-systems.de>
Date: Fri, 17 Mar 2017 19:19:00 +0100
Subject: [PATCH 0878/2409] Do not use libvirt-bin package anymore

The package libvirt-bin is a transitional package in Debian and should
not be used anymore.

Ubuntu Xenial is an exception here.

Because of that this change also adds the possibility to use "not:" to
exclude distros in files/debs/* just as "dist:" limits distros.

Depends-On: Icc59ea79f54d4ff8751f2e353ee3530fff3d961e
Closes-Bug: #1673840
Change-Id: I3998a7178d14ec40eae5cb199d66da9546cd6ccf
---
 files/debs/nova                    |  4 +++-
 functions-common                   | 15 +++++++++++++++
 lib/nova_plugins/functions-libvirt |  6 +++++-
 3 files changed, 23 insertions(+), 2 deletions(-)

diff --git a/files/debs/nova b/files/debs/nova
index 58dad411a8..5e14aec836 100644
--- a/files/debs/nova
+++ b/files/debs/nova
@@ -10,7 +10,9 @@ iputils-arping
 kpartx
 libjs-jquery-tablesorter # Needed for coverage html reports
 libmysqlclient-dev
-libvirt-bin # NOPRIME
+libvirt-bin # dist:xenial NOPRIME
+libvirt-clients # not:xenial NOPRIME
+libvirt-daemon-system # not:xenial NOPRIME
 libvirt-dev # NOPRIME
 mysql-server # NOPRIME
 parted
diff --git a/functions-common b/functions-common
index a86cfd8a63..82881e6dc0 100644
--- a/functions-common
+++ b/functions-common
@@ -1148,6 +1148,19 @@ function _parse_package_files {
                 fi
             fi
 
+            # Look for # not:xxx in comment
+            if [[ $line =~ (.*)#.*not:([^ ]*) ]]; then
+                # We are using BASH regexp matching feature.
+                package=${BASH_REMATCH[1]}
+                distros=${BASH_REMATCH[2]}
+                # In bash ${VAR,,} will lowercase VAR
+                # Look for a match in the distro list
+                if [[ ${distros,,} =~ ${DISTRO,,} ]]; then
+                    # If match then skip this package
+                    inst_pkg=0
+                fi
+            fi
+
             if [[ $inst_pkg = 1 ]]; then
                 echo $package
             fi
@@ -1166,6 +1179,8 @@ function _parse_package_files {
 # - ``# NOPRIME`` defers installation to be performed later in `stack.sh`
 # - ``# dist:DISTRO`` or ``dist:DISTRO1,DISTRO2`` limits the selection
 #   of the package to the distros listed.  The distro names are case insensitive.
+# - ``# not:DISTRO`` or ``not:DISTRO1,DISTRO2`` limits the selection
+#   of the package to the distros not listed. The distro names are case insensitive.
 function get_packages {
     local xtrace
     xtrace=$(set +o | grep xtrace)
diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index 56bb6bda1c..7af23cfd2a 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -24,7 +24,11 @@ DEBUG_LIBVIRT=$(trueorfalse True DEBUG_LIBVIRT)
 function install_libvirt {
     if is_ubuntu; then
         install_package qemu-system
-        install_package libvirt-bin libvirt-dev
+        if [[ ${DISTRO} == "xenial" ]]; then
+            install_package libvirt-bin libvirt-dev
+        else
+            install_package libvirt-clients libvirt-daemon-system libvirt-dev
+        fi
         pip_install_gr libvirt-python
         if [[ ${DISTRO} == "trusty" && ${EBTABLES_RACE_FIX} == "True" ]]; then
             # Work around for bug #1501558. We can remove this once we

From 2954e337e2d2993bd3fee3f2861b3fc2f85312bc Mon Sep 17 00:00:00 2001
From: Luz Cazares <luz.cazares@intel.com>
Date: Thu, 23 Mar 2017 17:34:19 +0000
Subject: [PATCH 0879/2409] Update devstack supported OS's on documentation

Since Feb 25th devstack supported operating systems changed
due to Nova increasing its minimum required libvirt version.
Further details see: I6617283afd798af37e64913b7865cea3c8a62aba

This patch is to update versions on devstack documentation.

Change-Id: I12bb59b0903a728376ee9422213c2903b9138249
---
 doc/source/index.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/index.rst b/doc/source/index.rst
index edd6595da2..eb10bdd420 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -39,7 +39,7 @@ Install Linux
 -------------
 
 Start with a clean and minimal install of a Linux system. Devstack
-attempts to support Ubuntu 14.04/16.04, Fedora 23/24, CentOS/RHEL 7,
+attempts to support Ubuntu 16.04/17.04, Fedora 24/25, CentOS/RHEL 7,
 as well as Debian and OpenSUSE.
 
 If you do not have a preference, Ubuntu 16.04 is the most tested, and

From 1298f1bacd039347c1d2a58ddea6efc2e0db25e1 Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Thu, 23 Mar 2017 10:59:49 +0100
Subject: [PATCH 0880/2409] Remove the EBTABLES_RACE_FIX added for Trusty

Now that we don't support Ubuntu Trusty anymore, we can remove
the ebtables race workaround.

Closes-Bug: #1675714
Change-Id: I70483f871e35fcaa933d1b7bac7dbb396aa22cef
---
 files/ebtables.workaround            | 23 ---------------------
 lib/nova_plugins/functions-libvirt   |  5 -----
 stackrc                              | 11 ----------
 tools/install_ebtables_workaround.sh | 31 ----------------------------
 4 files changed, 70 deletions(-)
 delete mode 100644 files/ebtables.workaround
 delete mode 100755 tools/install_ebtables_workaround.sh

diff --git a/files/ebtables.workaround b/files/ebtables.workaround
deleted file mode 100644
index c8af51fad5..0000000000
--- a/files/ebtables.workaround
+++ /dev/null
@@ -1,23 +0,0 @@
-#!/bin/bash
-#
-# Copyright 2015 Hewlett-Packard Development Company, L.P.
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-#    http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-#
-#
-# This is a terrible, terrible, truly terrible work around for
-# environments that have libvirt < 1.2.11. ebtables requires that you
-# specifically tell it you would like to not race and get punched in
-# the face when 2 run at the same time with a --concurrent flag.
-
-flock -w 300 /var/lock/ebtables.nova /sbin/ebtables.real $@
diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index 56bb6bda1c..a0242388e5 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -26,11 +26,6 @@ function install_libvirt {
         install_package qemu-system
         install_package libvirt-bin libvirt-dev
         pip_install_gr libvirt-python
-        if [[ ${DISTRO} == "trusty" && ${EBTABLES_RACE_FIX} == "True" ]]; then
-            # Work around for bug #1501558. We can remove this once we
-            # get to a version of Ubuntu that has new enough libvirt.
-            TOP_DIR=$TOP_DIR $TOP_DIR/tools/install_ebtables_workaround.sh
-        fi
         #pip_install_gr <there-si-no-guestfs-in-pypi>
     elif is_fedora || is_suse; then
         # On "KVM for IBM z Systems", kvm does not have its own package
diff --git a/stackrc b/stackrc
index c3b94d02f8..3ae3b0c8ef 100644
--- a/stackrc
+++ b/stackrc
@@ -820,17 +820,6 @@ USE_SSL=$(trueorfalse False USE_SSL)
 # sharing the same database. It would be useful for multinode Grenade tests.
 RECREATE_KEYSTONE_DB=$(trueorfalse True RECREATE_KEYSTONE_DB)
 
-# ebtables is inherently racey. If you run it by two or more processes
-# simultaneously it will collide, badly, in the kernel and produce
-# failures or corruption of ebtables. The only way around it is for
-# all tools running ebtables to only ever do so with the --concurrent
-# flag. This requires libvirt >= 1.2.11.
-#
-# If you don't have this then the following work around will replace
-# ebtables with a wrapper script so that it is safe to run without
-# that flag.
-EBTABLES_RACE_FIX=$(trueorfalse False EBTABLES_RACE_FIX)
-
 # Following entries need to be last items in file
 
 # Compatibility bits required by other callers like Grenade
diff --git a/tools/install_ebtables_workaround.sh b/tools/install_ebtables_workaround.sh
deleted file mode 100755
index 45ced87f13..0000000000
--- a/tools/install_ebtables_workaround.sh
+++ /dev/null
@@ -1,31 +0,0 @@
-#!/bin/bash -eu
-#
-# Copyright 2015 Hewlett-Packard Development Company, L.P.
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-#    http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-#
-#
-# This replaces the ebtables on your system with a wrapper script that
-# does implicit locking. This is needed if libvirt < 1.2.11 on your platform.
-
-EBTABLES=/sbin/ebtables
-EBTABLESREAL=/sbin/ebtables.real
-FILES=$TOP_DIR/files
-
-if [[ -f "$EBTABLES" ]]; then
-    if file $EBTABLES | grep ELF; then
-        sudo mv $EBTABLES $EBTABLESREAL
-        sudo install -m 0755 $FILES/ebtables.workaround $EBTABLES
-        echo "Replaced ebtables with locking workaround"
-    fi
-fi

From 9573edb4ebc8af68002f499f54da3616a1bfaa48 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 28 Mar 2017 19:37:39 +1100
Subject: [PATCH 0881/2409] Run mlock_report under python3

psutil is only installed under python3 for the 3.5 gate jobs.  Call
mlock_report.py with $PYTHON so we support both environments.

Updates to mlock_report.py for python3 compatability

Change-Id: If7926ce6a2996b766c49b010a7f6640ae624f860
---
 tools/memory_tracker.sh | 4 +++-
 tools/mlock_report.py   | 7 ++++---
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/tools/memory_tracker.sh b/tools/memory_tracker.sh
index 7397c03941..cbdeb8f420 100755
--- a/tools/memory_tracker.sh
+++ b/tools/memory_tracker.sh
@@ -14,6 +14,8 @@
 
 set -o errexit
 
+PYTHON=${PYTHON:-python}
+
 # time to sleep between checks
 SLEEP_TIME=20
 
@@ -86,7 +88,7 @@ function tracker {
             # list processes that lock memory from swap
             if [[ $unevictable -ne $unevictable_point ]]; then
                 unevictable_point=$unevictable
-                ./tools/mlock_report.py
+                ${PYTHON} ./tools/mlock_report.py
             fi
 
             echo "]]]"
diff --git a/tools/mlock_report.py b/tools/mlock_report.py
index 1d23af90d7..2169cc2dce 100755
--- a/tools/mlock_report.py
+++ b/tools/mlock_report.py
@@ -8,14 +8,15 @@
 import psutil
 
 
-SUMMARY_REGEX = re.compile(r".*\s+(?P<locked>[\d]+)\s+KB")
+SUMMARY_REGEX = re.compile(b".*\s+(?P<locked>[\d]+)\s+KB")
 
 
 def main():
     try:
-        print _get_report()
+        print(_get_report())
     except Exception as e:
-        print "Failure listing processes locking memory: %s" % str(e)
+        print("Failure listing processes locking memory: %s" % str(e))
+        raise
 
 
 def _get_report():

From 5edae54855b6b9af4283cef07e0b0d1a0f90cd3e Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 21 Mar 2017 20:50:24 -0400
Subject: [PATCH 0882/2409] initial work to enable systemd service running

During the PTG there was a discussion that the screen developer
workflow wasn't nearly as useful as it once was. There were now too
many services to see them all on one screen, and one of the most
common service restart scenarios was not restarting one service, but a
bunch to get code to take effect.

This implements a 3rd way of running services instead of direct
forking via bash, or running under screen, which is running as systemd
units.

Logging is adjusted because it's redundant to log datetime in oslo.log
when journald has that.

Swift needed to have services launched by absolute path to work.

This is disabled by default, but with instructions on using it. The
long term intent is to make this the way to run devstack, which would
be the same between both the gate and local use.

Some changes were also needed to run_process to pass the run User
in. A hack around the keystone uwsgi launcher was done at the same
time to remove a run_process feature that only keystone uwsgi uses.

Change-Id: I836bf27c4cfdc449628aa7641fb96a5489d5d4e7
---
 SYSTEMD.rst      | 177 +++++++++++++++++++++++++++++++++++++++++++++++
 functions        |  15 +++-
 functions-common |  75 +++++++++++++++++++-
 lib/dstat        |   4 +-
 lib/keystone     |   7 +-
 lib/swift        |  13 +++-
 stackrc          |  17 +++++
 7 files changed, 298 insertions(+), 10 deletions(-)
 create mode 100644 SYSTEMD.rst

diff --git a/SYSTEMD.rst b/SYSTEMD.rst
new file mode 100644
index 0000000000..b6ed19335d
--- /dev/null
+++ b/SYSTEMD.rst
@@ -0,0 +1,177 @@
+===========================
+ Using Systemd in DevStack
+===========================
+
+.. note::
+
+   This is an in progress document as we work out the way forward here
+   with DevStack and systemd.
+
+DevStack can be run with all the services as systemd unit
+files. Systemd is now the default init system for nearly every Linux
+distro, and systemd encodes and solves many of the problems related to
+poorly running processes.
+
+Why this instead of screen?
+===========================
+
+The screen model for DevStack was invented when the number of services
+that a DevStack user was going to run was typically < 10. This made
+screen hot keys to jump around very easy. However, the landscape has
+changed (not all services are stoppable in screen as some are under
+Apache, there are typically at least 20 items)
+
+There is also a common developer workflow of changing code in more
+than one service, and needing to restart a bunch of services for that
+to take effect.
+
+To enable this add the following to your local.conf::
+
+  USE_SYSTEMD=True
+
+
+
+Unit Structure
+==============
+
+.. note::
+
+   Originally we actually wanted to do this as user units, however
+   there are issues with running this under non interactive
+   shells. For now, we'll be running as system units. Some user unit
+   code is left in place in case we can switch back later.
+
+All DevStack user units are created as a part of the DevStack slice
+given the name ``devstack@$servicename.service``. This lets us do
+certain operations at the slice level.
+
+Manipulating Units
+==================
+
+Assuming the unit ``n-cpu`` to make the examples more clear.
+
+Enable a unit (allows it to be started)::
+
+  sudo systemctl enable devstack@n-cpu.service
+
+Disable a unit::
+
+  sudo systemctl disable devstack@n-cpu.service
+
+Start a unit::
+
+  sudo systemctl start devstack@n-cpu.service
+
+Stop a unit::
+
+  sudo systemctl stop devstack@n-cpu.service
+
+Restart a unit::
+
+  sudo systemctl restart devstack@n-cpu.service
+
+See status of a unit::
+
+  sudo systemctl status devstack@n-cpu.service
+
+
+Querying Logs
+=============
+
+One of the other major things that comes with systemd is journald, a
+consolidated way to access logs (including querying through structured
+metadata). This is accessed by the user via ``journalctl`` command.
+
+
+Logs can be accessed through ``journalctl``. journalctl has powerful
+query facilities. We'll start with some common options.
+
+Follow logs for a specific service::
+
+  journalctl -f --unit devstack@n-cpu.service
+
+Following logs for multiple services simultaneously::
+
+  journalctl -f --unit devstack@n-cpu.service --user-unit
+  devstack@n-cond.service
+
+Use higher precision time stamps::
+
+  journalctl -f -o short-precise --unit devstack@n-cpu.service
+
+
+Known Issues
+============
+
+Be careful about systemd python libraries. There are 3 of them on
+pypi, and they are all very different. They unfortunately all install
+into the ``systemd`` namespace, which can cause some issues.
+
+- ``systemd-python`` - this is the upstream maintained library, it has
+  a version number like systemd itself (currently ``233``). This is
+  the one you want.
+- ``systemd`` - a python 3 only library, not what you want.
+- ``python-systemd`` - another library you don't want. Installing it
+  on a system will break ansible's ability to run.
+
+
+If we were using user units, the ``[Service]`` - ``Group=`` parameter
+doesn't seem to work with user units, even though the documentation
+says that it should. This means that we will need to do an explicit
+``/usr/bin/sg``. This has the downside of making the SYSLOG_IDENTIFIER
+be ``sg``. We can explicitly set that with ``SyslogIdentifier=``, but
+it's really unfortunate that we're going to need this work
+around. This is currently not a problem because we're only using
+system units.
+
+Future Work
+===========
+
+oslo.log journald
+-----------------
+
+Journald has an extremely rich mechanism for direct logging including
+structured metadata. We should enhance oslo.log to take advantage of
+that. It would let us do things like::
+
+  journalctl REQUEST_ID=......
+
+  journalctl INSTANCE_ID=......
+
+And get all lines related to the request id or instance id.
+
+sub targets/slices
+------------------
+
+We might want to create per project slices so that it's easy to
+follow, restart all services of a single project (like swift) without
+impacting other services.
+
+log colorizing
+--------------
+
+We lose log colorization through this process. We might want to build
+a custom colorizer that we could run journalctl output through
+optionally for people.
+
+user units
+----------
+
+It would be great if we could do services as user units, so that there
+is a clear separation of code being run as not root, to ensure running
+as root never accidentally gets baked in as an assumption to
+services. However, user units interact poorly with devstack-gate and
+the way that commands are run as users with ansible and su.
+
+Maybe someday we can figure that out.
+
+References
+==========
+
+- Arch Linux Wiki - https://wiki.archlinux.org/index.php/Systemd/User
+- Python interface to journald -
+  https://www.freedesktop.org/software/systemd/python-systemd/journal.html
+- Systemd documentation on service files -
+  https://www.freedesktop.org/software/systemd/man/systemd.service.html
+- Systemd documentation on exec (can be used to impact service runs) -
+  https://www.freedesktop.org/software/systemd/man/systemd.exec.html
diff --git a/functions b/functions
index 872f21691a..f6679fdebe 100644
--- a/functions
+++ b/functions
@@ -575,7 +575,9 @@ function vercmp {
 function setup_logging {
     local conf_file=$1
     local other_cond=${2:-"False"}
-    if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ] && [ "$other_cond" == "False" ]; then
+    if [[ "$USE_SYSTEMD" == "True" ]]; then
+        setup_systemd_logging $conf_file
+    elif [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ] && [ "$other_cond" == "False" ]; then
         setup_colorized_logging $conf_file
     else
         setup_standard_logging_identity $conf_file
@@ -601,6 +603,17 @@ function setup_colorized_logging {
     iniset $conf_file $conf_section logging_exception_prefix "%(color)s%(asctime)s.%(msecs)03d TRACE %(name)s %(instance)s"
 }
 
+function setup_systemd_logging {
+    local conf_file=$1
+    local conf_section="DEFAULT"
+    local project_var="project_name"
+    local user_var="user_name"
+    iniset $conf_file $conf_section logging_context_format_string "%(levelname)s %(name)s [%(request_id)s %("$project_var")s %("$user_var")s] %(instance)s%(message)s"
+    iniset $conf_file $conf_section logging_default_format_string "%(levelname)s %(name)s [-] %(instance)s%(color)s%(message)s"
+    iniset $conf_file $conf_section logging_debug_format_suffix "from (pid=%(process)d) %(funcName)s %(pathname)s:%(lineno)d"
+    iniset $conf_file $conf_section logging_exception_prefix "ERROR %(name)s %(instance)s"
+}
+
 function setup_standard_logging_identity {
     local conf_file=$1
     iniset $conf_file DEFAULT logging_user_identity_format "%(project_name)s %(user_name)s"
diff --git a/functions-common b/functions-common
index a86cfd8a63..ec68644757 100644
--- a/functions-common
+++ b/functions-common
@@ -1443,6 +1443,59 @@ function _run_process {
     exit 0
 }
 
+function write_user_unit_file {
+    local service=$1
+    local command="$2"
+    local group=$3
+    local user=$4
+    local extra=""
+    if [[ -n "$group" ]]; then
+        extra="Group=$group"
+    fi
+    local unitfile="$SYSTEMD_DIR/$service"
+    mkdir -p $SYSTEMD_DIR
+
+    iniset -sudo $unitfile "Unit" "Description" "Devstack $service"
+    iniset -sudo $unitfile "Service" "User" "$user"
+    iniset -sudo $unitfile "Service" "ExecStart" "$command"
+    if [[ -n "$group" ]]; then
+        iniset -sudo $unitfile "Service" "Group" "$group"
+    fi
+    iniset -sudo $unitfile "Install" "WantedBy" "multi-user.target"
+
+    # changes to existing units sometimes need a refresh
+    $SYSTEMCTL daemon-reload
+}
+
+function _run_under_systemd {
+    local service=$1
+    local command="$2"
+    local cmd=$command
+    local systemd_service="devstack@$service.service"
+    local group=$3
+    local user=${4:-$STACK_USER}
+    write_user_unit_file $systemd_service "$cmd" "$group" "$user"
+
+    $SYSTEMCTL enable $systemd_service
+    $SYSTEMCTL start $systemd_service
+    _journal_log $service $systemd_service
+}
+
+function _journal_log {
+    local service=$1
+    local unit=$2
+    local logfile="${service}.log.${CURRENT_LOG_TIME}"
+    local real_logfile="${LOGDIR}/${logfile}"
+    if [[ -n ${LOGDIR} ]]; then
+        $JOURNALCTL_F $2 > "$real_logfile" &
+        bash -c "cd '$LOGDIR' && ln -sf '$logfile' ${service}.log"
+        if [[ -n ${SCREEN_LOGDIR} ]]; then
+            # Drop the backward-compat symlink
+            ln -sf "$real_logfile" ${SCREEN_LOGDIR}/screen-${service}.log
+        fi
+    fi
+}
+
 # Helper to remove the ``*.failure`` files under ``$SERVICE_DIR/$SCREEN_NAME``.
 # This is used for ``service_check`` when all the ``screen_it`` are called finished
 # Uses globals ``SCREEN_NAME``, ``SERVICE_DIR``
@@ -1478,16 +1531,24 @@ function run_process {
     local service=$1
     local command="$2"
     local group=$3
-    local subservice=$4
+    local user=$4
 
-    local name=${subservice:-$service}
+    local name=$service
 
     time_start "run_process"
     if is_service_enabled $service; then
-        if [[ "$USE_SCREEN" = "True" ]]; then
+        if [[ "$USE_SYSTEMD" = "True" ]]; then
+            _run_under_systemd "$name" "$command" "$group" "$user"
+        elif [[ "$USE_SCREEN" = "True" ]]; then
+            if [[ "$user" == "root" ]]; then
+                command="sudo $command"
+            fi
             screen_process "$name" "$command" "$group"
         else
             # Spawn directly without screen
+            if [[ "$user" == "root" ]]; then
+                command="sudo $command"
+            fi
             _run_process "$name" "$command" "$group" &
         fi
     fi
@@ -1618,6 +1679,14 @@ function stop_process {
 
     if is_service_enabled $service; then
         # Kill via pid if we have one available
+        if [[ "$USE_SYSTEMD" == "True" ]]; then
+            # Only do this for units which appear enabled, this also
+            # catches units that don't really exist for cases like
+            # keystone without a failure.
+            $SYSTEMCTL stop devstack@$service.service
+            $SYSTEMCTL disable devstack@$service.service
+        fi
+
         if [[ -r $SERVICE_DIR/$SCREEN_NAME/$service.pid ]]; then
             pkill -g $(cat $SERVICE_DIR/$SCREEN_NAME/$service.pid)
             # oslo.service tends to stop actually shutting down
diff --git a/lib/dstat b/lib/dstat
index 517e4237ac..982b70387e 100644
--- a/lib/dstat
+++ b/lib/dstat
@@ -24,12 +24,12 @@ function start_dstat {
     # To enable memory_tracker add:
     #    enable_service memory_tracker
     # to your localrc
-    run_process memory_tracker "sudo $TOP_DIR/tools/memory_tracker.sh"
+    run_process memory_tracker "$TOP_DIR/tools/memory_tracker.sh" "" "root"
 
     # remove support for the old name when it's no longer used (sometime in Queens)
     if is_service_enabled peakmem_tracker; then
         deprecated "Use of peakmem_tracker in devstack is deprecated, use memory_tracker instead"
-        run_process peakmem_tracker "sudo $TOP_DIR/tools/memory_tracker.sh"
+        run_process peakmem_tracker "$TOP_DIR/tools/memory_tracker.sh" "" "root"
     fi
 }
 
diff --git a/lib/keystone b/lib/keystone
index 530f3b42d9..af607c344b 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -602,8 +602,11 @@ function start_keystone {
         tail_log key /var/log/$APACHE_NAME/keystone.log
         tail_log key-access /var/log/$APACHE_NAME/keystone_access.log
     else # uwsgi
-        run_process key "$KEYSTONE_BIN_DIR/uwsgi $KEYSTONE_PUBLIC_UWSGI_FILE" "" "key-p"
-        run_process key "$KEYSTONE_BIN_DIR/uwsgi $KEYSTONE_ADMIN_UWSGI_FILE" "" "key-a"
+        # TODO(sdague): we should really get down to a single keystone here
+        enable_service key-p
+        enable_service key-a
+        run_process key-p "$KEYSTONE_BIN_DIR/uwsgi $KEYSTONE_PUBLIC_UWSGI_FILE" ""
+        run_process key-a "$KEYSTONE_BIN_DIR/uwsgi $KEYSTONE_ADMIN_UWSGI_FILE" ""
     fi
 
     echo "Waiting for keystone to start..."
diff --git a/lib/swift b/lib/swift
index 5b510e5930..6c2af61551 100644
--- a/lib/swift
+++ b/lib/swift
@@ -38,6 +38,15 @@ fi
 # Set up default directories
 GITDIR["python-swiftclient"]=$DEST/python-swiftclient
 
+# Swift virtual environment
+if [[ ${USE_VENV} = True ]]; then
+    PROJECT_VENV["swift"]=${SWIFT_DIR}.venv
+    SWIFT_BIN_DIR=${PROJECT_VENV["swift"]}/bin
+else
+    SWIFT_BIN_DIR=$(get_python_exec_prefix)
+fi
+
+
 SWIFT_DIR=$DEST/swift
 SWIFT_AUTH_CACHE_DIR=${SWIFT_AUTH_CACHE_DIR:-/var/cache/swift}
 SWIFT_APACHE_WSGI_DIR=${SWIFT_APACHE_WSGI_DIR:-/var/www/swift}
@@ -807,10 +816,10 @@ function start_swift {
         local proxy_port=${SWIFT_DEFAULT_BIND_PORT}
         start_tls_proxy swift '*' $proxy_port $SERVICE_HOST $SWIFT_DEFAULT_BIND_PORT_INT
     fi
-    run_process s-proxy "swift-proxy-server ${SWIFT_CONF_DIR}/proxy-server.conf -v"
+    run_process s-proxy "$SWIFT_BIN_DIR/swift-proxy-server ${SWIFT_CONF_DIR}/proxy-server.conf -v"
     if [[ ${SWIFT_REPLICAS} == 1 ]]; then
         for type in object container account; do
-            run_process s-${type} "swift-${type}-server ${SWIFT_CONF_DIR}/${type}-server/1.conf -v"
+            run_process s-${type} "$SWIFT_BIN_DIR/swift-${type}-server ${SWIFT_CONF_DIR}/${type}-server/1.conf -v"
         done
     fi
 
diff --git a/stackrc b/stackrc
index c3b94d02f8..61501b5696 100644
--- a/stackrc
+++ b/stackrc
@@ -87,6 +87,23 @@ HORIZON_APACHE_ROOT="/dashboard"
 # be disabled for automated testing by setting this value to False.
 USE_SCREEN=$(trueorfalse True USE_SCREEN)
 
+# Whether to use SYSTEMD to manage services
+USE_SYSTEMD=$(trueorfalse False USE_SYSTEMD)
+USER_UNITS=$(trueorfalse False USER_UNITS)
+if [[ "$USER_UNITS" == "True" ]]; then
+    SYSTEMD_DIR="$HOME/.local/share/systemd/user"
+    SYSTEMCTL="systemctl --user"
+    JOURNALCTL_F="journalctl -f -o short-precise --user-unit"
+else
+    SYSTEMD_DIR="/etc/systemd/system"
+    SYSTEMCTL="sudo systemctl"
+    JOURNALCTL_F="journalctl -f -o short-precise --unit"
+fi
+
+if [[ "$USE_SYSTEMD" == "True" ]]; then
+    USE_SCREEN=False
+fi
+
 # When using screen, should we keep a log file on disk?  You might
 # want this False if you have a long-running setup where verbose logs
 # can fill-up the host.

From 213c9a151f907988b283e4223404d0a09a5d4aa3 Mon Sep 17 00:00:00 2001
From: Lance Bragstad <lbragstad@gmail.com>
Date: Tue, 28 Mar 2017 14:32:28 +0000
Subject: [PATCH 0883/2409] Remove installation of keystone policy file

As of Id6e3c0ac54b21d85e68625a5b52fe2559fb70f24 keystone's policy
file is empty and it is no longer required at runtime. This commit
updates devstack to not deploy a policy file for keystone because
devstack doesn't specify any policy overrides. Instead, we can remove
the sample policy file and rely on the defaults that have been
registered in code. This is the same approach nova took with policy
in I85a251376dfe38caa4b100861bf764014a98bc37.

Change-Id: Ib1d9a51a78e2a84a3d7294dc8782605a681fa9e8
---
 lib/keystone | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/keystone b/lib/keystone
index 530f3b42d9..ea33abae96 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -202,7 +202,6 @@ function configure_keystone {
 
     if [[ "$KEYSTONE_CONF_DIR" != "$KEYSTONE_DIR/etc" ]]; then
         install -m 600 $KEYSTONE_DIR/etc/keystone.conf.sample $KEYSTONE_CONF
-        cp -p $KEYSTONE_DIR/etc/policy.json $KEYSTONE_CONF_DIR
         if [[ -f "$KEYSTONE_DIR/etc/keystone-paste.ini" ]]; then
             cp -p "$KEYSTONE_DIR/etc/keystone-paste.ini" "$KEYSTONE_PASTE_INI"
         fi

From 50686fe244cf5df95c59ffdfa124bedb4f253dbf Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Wed, 29 Mar 2017 08:28:40 +0000
Subject: [PATCH 0884/2409] Updated from generate-devstack-plugins-list

Change-Id: Id1313b029df86ea446b90ad086cc436702379dc9
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index cc55c0bd20..cfa54551ae 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -68,6 +68,7 @@ horizon-mellanox                       `git://git.openstack.org/openstack/horizo
 ironic                                 `git://git.openstack.org/openstack/ironic <https://git.openstack.org/cgit/openstack/ironic>`__
 ironic-inspector                       `git://git.openstack.org/openstack/ironic-inspector <https://git.openstack.org/cgit/openstack/ironic-inspector>`__
 ironic-staging-drivers                 `git://git.openstack.org/openstack/ironic-staging-drivers <https://git.openstack.org/cgit/openstack/ironic-staging-drivers>`__
+ironic-ui                              `git://git.openstack.org/openstack/ironic-ui <https://git.openstack.org/cgit/openstack/ironic-ui>`__
 karbor                                 `git://git.openstack.org/openstack/karbor <https://git.openstack.org/cgit/openstack/karbor>`__
 karbor-dashboard                       `git://git.openstack.org/openstack/karbor-dashboard <https://git.openstack.org/cgit/openstack/karbor-dashboard>`__
 keystone                               `git://git.openstack.org/openstack/keystone <https://git.openstack.org/cgit/openstack/keystone>`__

From 980d65f58672388538e588cdd52c9169feec4a91 Mon Sep 17 00:00:00 2001
From: Jordan Pittier <jordan.pittier@scality.com>
Date: Mon, 27 Mar 2017 14:29:58 +0200
Subject: [PATCH 0885/2409] Swift: Optionally start only the necessary services

Currently Devstack starts all Swift services, including those
in charge of "consistency convergence" (remember Swift is eventually
consistent), data scrubbing, hard-deletion (*-reaper services)
cleanup.

But when running with Replication Factor 1 some of those services
are not needed at all. Besides, the fonctionnalities provided by
some of these services are not tested at all (neither in Tempest
nor in Swift functional tests).

Thus, in light of saving some Mo of RAM, this patch introduces a config
flag to start only a minimal set of Swift services, just what's required
to make all of our current tests pass.

The default value for this new config flag is set to start all services,
that is to maintain Devstack's current behavior.

For sake of completeness, here is the list of services that are not
going to be started is the config flag is toggled, and the associated RSS
according to our peakmem_tracker

40004  swift-object-replicator /etc/swift/object-server/1.conf
34320  swift-container-replicator /etc/swift/container-server/1.conf
33584  swift-object-auditor /etc/swift/object-server/1.conf
33328  swift-object-reconstructor /etc/swift/object-server/1.conf
31936  swift-object-updater /etc/swift/object-server/1.conf
31492  swift-account-reaper /etc/swift/account-server/1.conf
31076  swift-account-replicator /etc/swift/account-server/1.conf
29540  swift-container-updater /etc/swift/container-server/1.conf
29220  swift-account-auditor /etc/swift/account-server/1.conf
29036  swift-container-auditor /etc/swift/container-server/1.conf

So we are looking at saving at most ~350Mo of RAM (could be less
because RSS doesn't account for shared memory).

A follow-up patch will soon be proposed in devstack-gate to not run
those additional services in our Gate jobs.

Change-Id: I8a0d03ac0296a74e38efd185beb8513866eaf0c4
---
 lib/swift | 55 +++++++++++++++++++++++++++++++++++++------------------
 1 file changed, 37 insertions(+), 18 deletions(-)

diff --git a/lib/swift b/lib/swift
index 6c2af61551..96e2f03e5f 100644
--- a/lib/swift
+++ b/lib/swift
@@ -128,6 +128,11 @@ SWIFT_PARTITION_POWER_SIZE=${SWIFT_PARTITION_POWER_SIZE:-9}
 SWIFT_REPLICAS=${SWIFT_REPLICAS:-1}
 SWIFT_REPLICAS_SEQ=$(seq ${SWIFT_REPLICAS})
 
+# Set ``SWIFT_START_ALL_SERVICES`` to control whether all Swift
+# services (including the *-auditor, *-replicator, *-reconstructor, etc.
+# daemons) should be started.
+SWIFT_START_ALL_SERVICES=$(trueorfalse True SWIFT_START_ALL_SERVICES)
+
 # Set ``SWIFT_LOG_TOKEN_LENGTH`` to configure how many characters of an auth
 # token should be placed in the logs. When keystone is used with PKI tokens,
 # the token values can be huge, seemingly larger the 2K, at the least. We
@@ -786,8 +791,11 @@ function start_swift {
     fi
 
     if [ "$SWIFT_USE_MOD_WSGI" == "True" ]; then
+        # Apache should serve the "PACO" a.k.a "main" services
         restart_apache_server
+        # The rest of the services should be started in backgroud
         swift-init --run-dir=${SWIFT_DATA_DIR}/run rest start
+        # Be we still want the logs of Swift Proxy in our screen session
         tail_log s-proxy /var/log/$APACHE_NAME/proxy-server
         if [[ ${SWIFT_REPLICAS} == 1 ]]; then
             for type in object container account; do
@@ -797,31 +805,42 @@ function start_swift {
         return 0
     fi
 
-    # By default with only one replica we are launching the proxy,
-    # container, account and object server in screen in foreground and
-    # other services in background. If we have ``SWIFT_REPLICAS`` set to something
-    # greater than one we first spawn all the Swift services then kill the proxy
-    # service so we can run it in foreground in screen.  ``swift-init ...
-    # {stop|restart}`` exits with '1' if no servers are running, ignore it just
-    # in case
-    local todo type
-    swift-init --run-dir=${SWIFT_DATA_DIR}/run all restart || true
+
+    # By default with only one replica we are launching the proxy, container
+    # account and object server in screen in foreground. Then, the rest of
+    # the services is optionally started.
+    #
+    # If we have ``SWIFT_REPLICAS`` set to something greater than one
+    # we first spawn *all* the Swift services then kill the proxy service
+    # so we can run it in foreground in screen.
+    #
+    # ``swift-init ... {stop|restart}`` exits with '1' if no servers are
+    #  running, ignore it just in case
     if [[ ${SWIFT_REPLICAS} == 1 ]]; then
-        todo="object container account"
+        local foreground_services type
+
+        foreground_services="object container account"
+        for type in ${foreground_services}; do
+            run_process s-${type} "$SWIFT_BIN_DIR/swift-${type}-server ${SWIFT_CONF_DIR}/${type}-server/1.conf -v"
+        done
+
+        if [[ "$SWIFT_START_ALL_SERVICES" == "True" ]]; then
+            swift-init --run-dir=${SWIFT_DATA_DIR}/run rest start
+        else
+            # The container-sync daemon is strictly needed to pass the container
+            # sync Tempest tests.
+            swift-init --run-dir=${SWIFT_DATA_DIR}/run container-sync start
+        fi
+    else
+        swift-init --run-dir=${SWIFT_DATA_DIR}/run all restart || true
+        swift-init --run-dir=${SWIFT_DATA_DIR}/run proxy stop || true
     fi
-    for type in proxy ${todo}; do
-        swift-init --run-dir=${SWIFT_DATA_DIR}/run ${type} stop || true
-    done
+
     if is_service_enabled tls-proxy; then
         local proxy_port=${SWIFT_DEFAULT_BIND_PORT}
         start_tls_proxy swift '*' $proxy_port $SERVICE_HOST $SWIFT_DEFAULT_BIND_PORT_INT
     fi
     run_process s-proxy "$SWIFT_BIN_DIR/swift-proxy-server ${SWIFT_CONF_DIR}/proxy-server.conf -v"
-    if [[ ${SWIFT_REPLICAS} == 1 ]]; then
-        for type in object container account; do
-            run_process s-${type} "$SWIFT_BIN_DIR/swift-${type}-server ${SWIFT_CONF_DIR}/${type}-server/1.conf -v"
-        done
-    fi
 
     if [[ "$SWIFT_ENABLE_TEMPURLS" == "True" ]]; then
         swift_configure_tempurls

From f85e0ba353c71fc5c8bacebe006e68bebf2af024 Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Fri, 17 Mar 2017 12:54:30 -0700
Subject: [PATCH 0886/2409] Enable Kernel Samepage Merging by default

In an effort to reduce memory consumption enable KSM by default. The
biggest win here is when using libvirt with nova or ironic with its
fake baremetal instances. In theory any process that runs duplicates
with mergeable memory will benefit though.

Change-Id: I4c5addfd3e83b6516023b36cbaabd5169f0d5ceb
---
 stack.sh | 16 ++++++++++++++++
 stackrc  |  8 ++++++++
 2 files changed, 24 insertions(+)

diff --git a/stack.sh b/stack.sh
index 20cdc1dfcc..504d94f148 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1006,6 +1006,22 @@ init_service_check
 # Save configuration values
 save_stackenv $LINENO
 
+# Kernel Samepage Merging (KSM)
+# -----------------------------
+
+# Processes that mark their memory as mergeable can share identical memory
+# pages if KSM is enabled. This is particularly useful for nova + libvirt
+# backends but any other setup that marks its memory as mergeable can take
+# advantage. The drawback is there is higher cpu load; however, we tend to
+# be memory bound not cpu bound so enable KSM by default but allow people
+# to opt out if the CPU time is more important to them.
+
+if [[ "ENABLE_KSM" == "True" ]] ; then
+    if [[ -f /sys/kernel/mm/ksm/run ]] ; then
+        sudo sh -c "echo 1 > /sys/kernel/mm/ksm/run"
+    fi
+fi
+
 
 # Start Services
 # ==============
diff --git a/stackrc b/stackrc
index 61501b5696..b53f791380 100644
--- a/stackrc
+++ b/stackrc
@@ -104,6 +104,14 @@ if [[ "$USE_SYSTEMD" == "True" ]]; then
     USE_SCREEN=False
 fi
 
+# Whether or not to enable Kernel Samepage Merging (KSM) if available.
+# This allows programs that mark their memory as mergeable to share
+# memory pages if they are identical. This is particularly useful with
+# libvirt backends. This reduces memory useage at the cost of CPU overhead
+# to scan memory. We default to enabling it because we tend to be more
+# memory constrained than CPU bound.
+ENABLE_KSM=$(trueorfalse True ENABLE_KSM)
+
 # When using screen, should we keep a log file on disk?  You might
 # want this False if you have a long-running setup where verbose logs
 # can fill-up the host.

From bfcc760b9650b09af073e1c6beb489069e5eec0d Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Wed, 29 Mar 2017 11:52:06 +1100
Subject: [PATCH 0887/2409] Enable libvirt coredumps

This adds a flag and basic config for enabling coredumps for libvirt.

Partial-Bug: 1643911
Co-Authored-By: Matthew Booth <mbooth@redhat.com>

Change-Id: If7cd54e804a5a389a0d82a325b58f5b41b8ef0db
---
 lib/nova_plugins/functions-libvirt | 49 +++++++++++++++++++++++++-----
 tools/worlddump.py                 |  9 ++++++
 2 files changed, 50 insertions(+), 8 deletions(-)

diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index 56bb6bda1c..1ae049226a 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -20,8 +20,46 @@ set +o xtrace
 # extremely verbose.)
 DEBUG_LIBVIRT=$(trueorfalse True DEBUG_LIBVIRT)
 
+# Try to enable coredumps for libvirt
+# Currently fairly specific to OpenStackCI hosts
+DEBUG_LIBVIRT_COREDUMPS=$(trueorfalse False DEBUG_LIBVIRT_COREDUMPS)
+
+# Only Xenial is left with libvirt-bin.  Everywhere else is libvirtd
+if is_ubuntu && [ ! -f /etc/init.d/libvirtd ]; then
+    LIBVIRT_DAEMON=libvirt-bin
+else
+    LIBVIRT_DAEMON=libvirtd
+fi
+
+# Enable coredumps for libvirt
+#  Bug: https://bugs.launchpad.net/nova/+bug/1643911
+function _enable_coredump {
+    local confdir=/etc/systemd/system/${LIBVIRT_DAEMON}.service.d
+    local conffile=${confdir}/coredump.conf
+
+    # Create a coredump directory, and instruct the kernel to save to
+    # here
+    sudo mkdir -p /var/core
+    sudo chmod a+wrx /var/core
+    echo '/var/core/core.%e.%p.%h.%t' | \
+        sudo tee /proc/sys/kernel/core_pattern
+
+    # Drop a config file to up the core ulimit
+    sudo mkdir -p ${confdir}
+    sudo tee ${conffile} <<EOF
+[Service]
+LimitCORE=infinity
+EOF
+
+    # Tell systemd to reload the unit (service restarts later after
+    # config anyway)
+    sudo systemctl daemon-reload
+}
+
+
 # Installs required distro-specific libvirt packages.
 function install_libvirt {
+
     if is_ubuntu; then
         install_package qemu-system
         install_package libvirt-bin libvirt-dev
@@ -48,7 +86,10 @@ function install_libvirt {
 
         install_package libvirt libvirt-devel
         pip_install_gr libvirt-python
+    fi
 
+    if [[ $DEBUG_LIBVIRT_COREDUMPS == True ]]; then
+        _enable_coredump
     fi
 }
 
@@ -68,14 +109,6 @@ cgroup_device_acl = [
 EOF
     fi
 
-    # Since the release of Debian Wheezy the libvirt init script is libvirtd
-    # and not libvirtd-bin anymore.
-    if is_ubuntu && [ ! -f /etc/init.d/libvirtd ]; then
-        LIBVIRT_DAEMON=libvirt-bin
-    else
-        LIBVIRT_DAEMON=libvirtd
-    fi
-
     if is_fedora || is_suse; then
         # Starting with fedora 18 and opensuse-12.3 enable stack-user to
         # virsh -c qemu:///system by creating a policy-kit rule for
diff --git a/tools/worlddump.py b/tools/worlddump.py
index eb109b9d51..6fff1497a7 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -223,6 +223,14 @@ def guru_meditation_reports():
         print("guru meditation report in %s log" % service)
 
 
+def var_core():
+    if os.path.exists('/var/core'):
+        _header("/var/core dumps")
+        # NOTE(ianw) : see DEBUG_LIBVIRT_COREDUMPS.  We could think
+        # about getting backtraces out of these.  There are other
+        # tools out there that can do that sort of thing though.
+        _dump_cmd("ls -ltrah /var/core")
+
 def main():
     opts = get_options()
     fname = filename(opts.dir, opts.name)
@@ -238,6 +246,7 @@ def main():
         ebtables_dump()
         compute_consoles()
         guru_meditation_reports()
+        var_core()
 
 
 if __name__ == '__main__':

From def07b21f86ee70cae223785f0195c91de1f2b64 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 30 Mar 2017 07:18:49 -0400
Subject: [PATCH 0888/2409] Updated docs from finding more things about systemd

Change-Id: I3d807cd342f30eada04a6be2af7db482f9c4a796
---
 SYSTEMD.rst | 30 +++++++++++++++++++++---------
 1 file changed, 21 insertions(+), 9 deletions(-)

diff --git a/SYSTEMD.rst b/SYSTEMD.rst
index b6ed19335d..729fdf47b6 100644
--- a/SYSTEMD.rst
+++ b/SYSTEMD.rst
@@ -74,6 +74,20 @@ See status of a unit::
 
   sudo systemctl status devstack@n-cpu.service
 
+Operating on more than one unit at a time
+-----------------------------------------
+
+Systemd supports wildcarding for unit operations. To restart every
+service in devstack you can do that following::
+
+  sudo systemctl restart devstack@*
+
+Or to see the status of all Nova processes you can do::
+
+  sudo systemctl status devstack@n-*
+
+We'll eventually make the unit names a bit more meaningful so that
+it's easier to understand what you are restarting.
 
 Querying Logs
 =============
@@ -92,9 +106,13 @@ Follow logs for a specific service::
 
 Following logs for multiple services simultaneously::
 
-  journalctl -f --unit devstack@n-cpu.service --user-unit
+  journalctl -f --unit devstack@n-cpu.service --unit
   devstack@n-cond.service
 
+or you can even do wild cards to follow all the nova services::
+
+  journalctl -f --unit devstack@n-*
+
 Use higher precision time stamps::
 
   journalctl -f -o short-precise --unit devstack@n-cpu.service
@@ -138,14 +156,8 @@ that. It would let us do things like::
 
   journalctl INSTANCE_ID=......
 
-And get all lines related to the request id or instance id.
-
-sub targets/slices
-------------------
-
-We might want to create per project slices so that it's easy to
-follow, restart all services of a single project (like swift) without
-impacting other services.
+And get all lines related to the request id or instance id. (Note:
+this work has been started at https://review.openstack.org/#/c/451525/)
 
 log colorizing
 --------------

From 571ba8b3bb6b600a9b2479be1e88f829b086631b Mon Sep 17 00:00:00 2001
From: Hongbin Lu <hongbin.lu@huawei.com>
Date: Wed, 29 Mar 2017 22:06:54 -0400
Subject: [PATCH 0889/2409] Change mode of DATA_DIR to 0755 as well

It looks libvirt/qemu requires mode 0755 to functioning properly,
but DATA_DIR won't be set to 0755 if it is different from default.

Change-Id: I37ca0b02b6a75b3756860b547e84c37ccfc99d13
Closes-Bug: #1677421
---
 stack.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/stack.sh b/stack.sh
index 20cdc1dfcc..310676ac5c 100755
--- a/stack.sh
+++ b/stack.sh
@@ -328,6 +328,7 @@ fi
 DATA_DIR=${DATA_DIR:-${DEST}/data}
 sudo mkdir -p $DATA_DIR
 safe_chown -R $STACK_USER $DATA_DIR
+safe_chmod 0755 $DATA_DIR
 
 # Configure proper hostname
 # Certain services such as rabbitmq require that the local hostname resolves

From 87535a5b9fa77471d67432a8da793e00fafc8870 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Mon, 3 Apr 2017 08:24:23 +0000
Subject: [PATCH 0890/2409] Updated from generate-devstack-plugins-list

Change-Id: I68d8812558e1f1f09ab5f30145ce5c0943cae7db
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index cfa54551ae..beb6abbb9e 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -69,6 +69,7 @@ ironic                                 `git://git.openstack.org/openstack/ironic
 ironic-inspector                       `git://git.openstack.org/openstack/ironic-inspector <https://git.openstack.org/cgit/openstack/ironic-inspector>`__
 ironic-staging-drivers                 `git://git.openstack.org/openstack/ironic-staging-drivers <https://git.openstack.org/cgit/openstack/ironic-staging-drivers>`__
 ironic-ui                              `git://git.openstack.org/openstack/ironic-ui <https://git.openstack.org/cgit/openstack/ironic-ui>`__
+k8s-cloud-provider                     `git://git.openstack.org/openstack/k8s-cloud-provider <https://git.openstack.org/cgit/openstack/k8s-cloud-provider>`__
 karbor                                 `git://git.openstack.org/openstack/karbor <https://git.openstack.org/cgit/openstack/karbor>`__
 karbor-dashboard                       `git://git.openstack.org/openstack/karbor-dashboard <https://git.openstack.org/cgit/openstack/karbor-dashboard>`__
 keystone                               `git://git.openstack.org/openstack/keystone <https://git.openstack.org/cgit/openstack/keystone>`__

From 9c5ffd8d132866bd6120696e138e5b7b42dc3f23 Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Wed, 29 Mar 2017 16:47:57 -0400
Subject: [PATCH 0891/2409] Handle uwsgi on systemd properly

uwsgi is a different service type under systemd and shouldn't be run as
a standard oneshot type. The uwsgi docs outline a good pattern for
writing systemd unit files:

http://uwsgi-docs.readthedocs.io/en/latest/Systemd.html

This commit takes those suggestions and creates a separate path for
writing uwsgi unit files.

Change-Id: I9b541b86781afdded311dba058cedd783e1a0dfa
---
 functions-common | 32 +++++++++++++++++++++++++++++++-
 lib/keystone     |  7 +++++--
 2 files changed, 36 insertions(+), 3 deletions(-)

diff --git a/functions-common b/functions-common
index ec68644757..5b096c60f7 100644
--- a/functions-common
+++ b/functions-common
@@ -1467,6 +1467,32 @@ function write_user_unit_file {
     $SYSTEMCTL daemon-reload
 }
 
+function write_uwsgi_user_unit_file {
+    local service=$1
+    local command="$2"
+    local group=$3
+    local user=$4
+    local unitfile="$SYSTEMD_DIR/$service"
+    mkdir -p $SYSTEMD_DIR
+
+    iniset -sudo $unitfile "Unit" "Description" "Devstack $service"
+    iniset -sudo $unitfile "Service" "User" "$user"
+    iniset -sudo $unitfile "Service" "ExecStart" "$command"
+    iniset -sudo $unitfile "Service" "Type" "notify"
+    iniset -sudo $unitfile "Service" "KillSignal" "SIGQUIT"
+    iniset -sudo $unitfile "Service" "Restart" "Always"
+    iniset -sudo $unitfile "Service" "NotifyAccess" "all"
+    iniset -sudo $unitfile "Service" "RestartForceExitStatus" "100"
+
+    if [[ -n "$group" ]]; then
+        iniset -sudo $unitfile "Service" "Group" "$group"
+    fi
+    iniset -sudo $unitfile "Install" "WantedBy" "multi-user.target"
+
+    # changes to existing units sometimes need a refresh
+    $SYSTEMCTL daemon-reload
+}
+
 function _run_under_systemd {
     local service=$1
     local command="$2"
@@ -1474,7 +1500,11 @@ function _run_under_systemd {
     local systemd_service="devstack@$service.service"
     local group=$3
     local user=${4:-$STACK_USER}
-    write_user_unit_file $systemd_service "$cmd" "$group" "$user"
+    if [[ "$command" =~ "uwsgi" ]] ; then
+        write_uwsgi_user_unit_file $systemd_service "$cmd" "$group" "$user"
+    else
+        write_user_unit_file $systemd_service "$cmd" "$group" "$user"
+    fi
 
     $SYSTEMCTL enable $systemd_service
     $SYSTEMCTL start $systemd_service
diff --git a/lib/keystone b/lib/keystone
index d4b3a66e24..3db3c8d4aa 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -604,8 +604,8 @@ function start_keystone {
         # TODO(sdague): we should really get down to a single keystone here
         enable_service key-p
         enable_service key-a
-        run_process key-p "$KEYSTONE_BIN_DIR/uwsgi $KEYSTONE_PUBLIC_UWSGI_FILE" ""
-        run_process key-a "$KEYSTONE_BIN_DIR/uwsgi $KEYSTONE_ADMIN_UWSGI_FILE" ""
+        run_process key-p "$KEYSTONE_BIN_DIR/uwsgi --ini $KEYSTONE_PUBLIC_UWSGI_FILE" ""
+        run_process key-a "$KEYSTONE_BIN_DIR/uwsgi --ini $KEYSTONE_ADMIN_UWSGI_FILE" ""
     fi
 
     echo "Waiting for keystone to start..."
@@ -638,6 +638,9 @@ function stop_keystone {
     if [ "$KEYSTONE_DEPLOY" == "mod_wsgi" ]; then
         disable_apache_site keystone
         restart_apache_server
+    else
+        stop_process key-p
+        stop_process key-a
     fi
     # Kill the Keystone screen window
     stop_process key

From 5cd44dbe6c0a641258f36d7959952bc971435b74 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 5 Apr 2017 07:23:37 -0400
Subject: [PATCH 0892/2409] add use_journal if we are enabling systemd

This is going to be a new option in oslo.log, which we can start
setting early to make it take effect.

Change-Id: If0e5e4717a1810c759058f33608fbac7543f2d85
---
 functions | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/functions b/functions
index f6679fdebe..c99e435175 100644
--- a/functions
+++ b/functions
@@ -606,11 +606,13 @@ function setup_colorized_logging {
 function setup_systemd_logging {
     local conf_file=$1
     local conf_section="DEFAULT"
-    local project_var="project_name"
-    local user_var="user_name"
-    iniset $conf_file $conf_section logging_context_format_string "%(levelname)s %(name)s [%(request_id)s %("$project_var")s %("$user_var")s] %(instance)s%(message)s"
-    iniset $conf_file $conf_section logging_default_format_string "%(levelname)s %(name)s [-] %(instance)s%(color)s%(message)s"
-    iniset $conf_file $conf_section logging_debug_format_suffix "from (pid=%(process)d) %(funcName)s %(pathname)s:%(lineno)d"
+    iniset $conf_file $conf_section use_journal "True"
+    iniset $conf_file $conf_section logging_context_format_string \
+           "%(levelname)s %(name)s [%(request_id)s %(project_name)s %(user_name)s] %(instance)s%(message)s"
+    iniset $conf_file $conf_section logging_default_format_string \
+           "%(levelname)s %(name)s [-] %(instance)s%(color)s%(message)s"
+    iniset $conf_file $conf_section logging_debug_format_suffix \
+           "from (pid=%(process)d) %(funcName)s %(pathname)s:%(lineno)d"
     iniset $conf_file $conf_section logging_exception_prefix "ERROR %(name)s %(instance)s"
 }
 

From eb235814d3436953d548bb83c65851f7cec6d1e7 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 6 Apr 2017 10:52:48 -0400
Subject: [PATCH 0893/2409] Install systemd python bindings by default

These are needed for oslo.log to use journald support. They are
*probably* already installed, but just in case we force install them.

Change-Id: I0dc66bd2628ff4b3e1caa7ab4366d7f36ff7ea94
---
 files/debs/general | 1 +
 files/rpms/general | 1 +
 2 files changed, 2 insertions(+)

diff --git a/files/debs/general b/files/debs/general
index c121770fa2..3a0e24182a 100644
--- a/files/debs/general
+++ b/files/debs/general
@@ -25,6 +25,7 @@ psmisc
 python2.7
 python-dev
 python-gdbm # needed for testr
+python-systemd
 screen
 tar
 tcpdump
diff --git a/files/rpms/general b/files/rpms/general
index 77d2fa5f0a..baba06b5ab 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -27,6 +27,7 @@ pyOpenSSL # version in pip uses too much memory
 python-devel
 redhat-rpm-config # missing dep for gcc hardening flags, see rhbz#1217376
 screen
+systemd-python
 tar
 tcpdump
 unzip

From 9fecc2ad04a9414bfb3127d80ee02fed1d36a30d Mon Sep 17 00:00:00 2001
From: Dean Troyer <dtroyer@gmail.com>
Date: Fri, 7 Apr 2017 12:28:40 -0500
Subject: [PATCH 0894/2409] Add OpenStackSDK as a lib install

This is required to install python-openstacksdk from source for testing
other projects against master.

Change-Id: Iee7b043ac7d381dadf89d26098f69e935ed81d6b
---
 lib/oslo                     | 2 ++
 stackrc                      | 4 ++++
 tests/test_libs_from_pypi.sh | 2 +-
 3 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/lib/oslo b/lib/oslo
index e34e48ad03..1a78bdfe73 100644
--- a/lib/oslo
+++ b/lib/oslo
@@ -48,6 +48,7 @@ GITDIR["oslo.versionedobjects"]=$DEST/oslo.versionedobjects
 GITDIR["oslo.vmware"]=$DEST/oslo.vmware
 GITDIR["osprofiler"]=$DEST/osprofiler
 GITDIR["pycadf"]=$DEST/pycadf
+GITDIR["python-openstacksdk"]=$DEST/python-openstacksdk
 GITDIR["stevedore"]=$DEST/stevedore
 GITDIR["taskflow"]=$DEST/taskflow
 GITDIR["tooz"]=$DEST/tooz
@@ -95,6 +96,7 @@ function install_oslo {
     _do_install_oslo_lib "oslo.vmware"
     _do_install_oslo_lib "osprofiler"
     _do_install_oslo_lib "pycadf"
+    _do_install_oslo_lib "python-openstacksdk"
     _do_install_oslo_lib "stevedore"
     _do_install_oslo_lib "taskflow"
     _do_install_oslo_lib "tooz"
diff --git a/stackrc b/stackrc
index 5ace0fbf20..00aab8d3c4 100644
--- a/stackrc
+++ b/stackrc
@@ -529,6 +529,10 @@ GITBRANCH["os-vif"]=${OS_VIF_BRANCH:-master}
 GITREPO["osc-lib"]=${OSC_LIB_REPO:-${GIT_BASE}/openstack/osc-lib.git}
 GITBRANCH["osc-lib"]=${OSC_LIB_BRANCH:-master}
 
+# python-openstacksdk OpenStack Python SDK
+GITREPO["python-openstacksdk"]=${OPENSTACKSDK_REPO:-${GIT_BASE}/openstack/python-openstacksdk.git}
+GITBRANCH["python-openstacksdk"]=${OPENSTACKSDK_BRANCH:-master}
+
 # ironic common lib
 GITREPO["ironic-lib"]=${IRONIC_LIB_REPO:-${GIT_BASE}/openstack/ironic-lib.git}
 GITBRANCH["ironic-lib"]=${IRONIC_LIB_BRANCH:-master}
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index 415fec506d..3d4bcd2596 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -37,7 +37,7 @@ ALL_LIBS+=" python-cinderclient glance_store oslo.concurrency oslo.db"
 ALL_LIBS+=" oslo.versionedobjects oslo.vmware keystonemiddleware"
 ALL_LIBS+=" oslo.serialization django_openstack_auth"
 ALL_LIBS+=" python-openstackclient osc-lib os-client-config oslo.rootwrap"
-ALL_LIBS+=" oslo.i18n oslo.utils python-swiftclient"
+ALL_LIBS+=" oslo.i18n oslo.utils python-openstacksdk python-swiftclient"
 ALL_LIBS+=" python-neutronclient tooz ceilometermiddleware oslo.policy"
 ALL_LIBS+=" debtcollector os-brick automaton futurist oslo.service"
 ALL_LIBS+=" oslo.cache oslo.reports osprofiler"

From 7f80649eaf1969a4b3d22fa8c654dc68f7000f30 Mon Sep 17 00:00:00 2001
From: Leticia Wanderley <leticiafwanderley@gmail.com>
Date: Thu, 6 Apr 2017 20:40:19 -0300
Subject: [PATCH 0895/2409] Removes double colon on script comments

A few comment lines on stack.sh had two colons where only one colon
was necessary.

Change-Id: Ia02e1ca28a8fadc2e5477201887a1f4d59996db8
---
 stack.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/stack.sh b/stack.sh
index d8f3ad6b53..759a8dbacc 100755
--- a/stack.sh
+++ b/stack.sh
@@ -161,16 +161,16 @@ rm -f $TOP_DIR/.localrc.auto
 extract_localrc_section $TOP_DIR/local.conf $TOP_DIR/localrc $TOP_DIR/.localrc.auto
 
 # ``stack.sh`` is customizable by setting environment variables.  Override a
-# default setting via export::
+# default setting via export:
 #
 #     export DATABASE_PASSWORD=anothersecret
 #     ./stack.sh
 #
-# or by setting the variable on the command line::
+# or by setting the variable on the command line:
 #
 #     DATABASE_PASSWORD=simple ./stack.sh
 #
-# Persistent variables can be placed in a ``local.conf`` file::
+# Persistent variables can be placed in a ``local.conf`` file:
 #
 #     [[local|localrc]]
 #     DATABASE_PASSWORD=anothersecret

From 2a2db2efc522306acf90b2fb9cf0106cf7cf8e6d Mon Sep 17 00:00:00 2001
From: Huan Xie <huan.xie@citrix.com>
Date: Sun, 9 Apr 2017 22:37:50 -0700
Subject: [PATCH 0896/2409] XenAPI: Remove final references to Integration
 bridge

The change to remove references of XEN_INTEGRATION_BRIDGE
(If5886e3711765a97f40f20e478f958b988b5a620) unfortunately left some
code which should have been removed.  This remaining code caused an
error in some situations when deploying from scratch (which the CI
avoids for expediency)

Change-Id: Ia568462c9cca8cff8fcfada8148d185609d61a7d
---
 tools/xen/install_os_domU.sh | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/tools/xen/install_os_domU.sh b/tools/xen/install_os_domU.sh
index ac7af0df43..f4ca71a906 100755
--- a/tools/xen/install_os_domU.sh
+++ b/tools/xen/install_os_domU.sh
@@ -288,10 +288,6 @@ add_interface "$GUEST_NAME" "$PUB_BRIDGE_OR_NET_NAME" "$PUB_DEV_NR"
 #
 $THIS_DIR/build_xva.sh "$GUEST_NAME"
 
-XEN_INTEGRATION_BRIDGE_DEFAULT=$(bridge_for "$XEN_INT_BRIDGE_OR_NET_NAME")
-append_kernel_cmdline \
-    "$GUEST_NAME"
-
 FLAT_NETWORK_BRIDGE="${FLAT_NETWORK_BRIDGE:-$(bridge_for "$VM_BRIDGE_OR_NET_NAME")}"
 append_kernel_cmdline "$GUEST_NAME" "flat_network_bridge=${FLAT_NETWORK_BRIDGE}"
 

From c9a9e415b9a955525a407b78650f93e9193c8117 Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Wed, 29 Mar 2017 10:28:55 -0700
Subject: [PATCH 0897/2409] Test using UCA for libvirt 2.5.0

We have had issues with libvirt 1.3.1 which is stock on Xenial. Try
using 2.5.0 from UCA instead.

Related-Bug: 1643911
Related-Bug: 1646779
Related-Bug: 1638982
Change-Id: Ia4434541c71f050fe1ffb54f4c4c1e302391d00b
---
 stackrc              |  8 ++++++--
 tools/fixup_stuff.sh | 27 +++++++++++++++++++++++++++
 2 files changed, 33 insertions(+), 2 deletions(-)

diff --git a/stackrc b/stackrc
index b53f791380..fc03f49f29 100644
--- a/stackrc
+++ b/stackrc
@@ -599,8 +599,12 @@ VIRT_DRIVER=${VIRT_DRIVER:-$DEFAULT_VIRT_DRIVER}
 case "$VIRT_DRIVER" in
     ironic|libvirt)
         LIBVIRT_TYPE=${LIBVIRT_TYPE:-kvm}
-        if [[ "$os_VENDOR" =~ (Debian) ]]; then
-            LIBVIRT_GROUP=libvirt
+        if [[ "$os_VENDOR" =~ (Debian|Ubuntu) ]]; then
+            # The groups change with newer libvirt. Older Ubuntu used
+            # 'libvirtd', but now uses libvirt like Debian. Do a quick check
+            # to see if libvirtd group already exists to handle grenade's case.
+            LIBVIRT_GROUP=$(cut -d ':' -f 1 /etc/group | grep 'libvirtd$' || true)
+            LIBVIRT_GROUP=${LIBVIRT_GROUP:-libvirt}
         else
             LIBVIRT_GROUP=libvirtd
         fi
diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index 4dec95eb4d..6f680b860e 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -67,6 +67,33 @@ else
     echo_summary "WARNING: unable to reserve keystone ports"
 fi
 
+# Ubuntu Cloud Archive
+#---------------------
+# We've found that Libvirt on Xenial is flaky and crashes enough to be
+# a regular top e-r bug. Opt into Ubuntu Cloud Archive if on Xenial to
+# get newer Libvirt.
+if [[ "$DISTRO" = "xenial" ]]; then
+    # This pulls in apt-add-repository
+    install_package "software-properties-common"
+    # Use UCA for newer libvirt. Should give us libvirt 2.5.0.
+    if [[ -f /etc/ci/mirror_info.sh ]] ; then
+        # If we are on a nodepool provided host and it has told us about where
+        # we can find local mirrors then use that mirror.
+        source /etc/ci/mirror_info.sh
+
+        sudo apt-add-repository -y "deb $NODEPOOL_UCA_MIRROR xenial-updates/ocata main"
+
+        # Disable use of libvirt wheel here as presence of mirror implies
+        # presence of cached wheel build against older libvirt binary.
+        # TODO(clarkb) figure out how to use wheel again.
+        sudo bash -c 'echo "no-binary = libvirt-python" >> /etc/pip.conf'
+    else
+        # Otherwise use upstream UCA
+        sudo add-apt-repository -y cloud-archive:ocata
+    fi
+    sudo apt-get update
+fi
+
 
 # Python Packages
 # ---------------

From a48ffa8c5823d2e0c26fff6ec9804f9da1981ffa Mon Sep 17 00:00:00 2001
From: Cyril Roelandt <cyril@redhat.com>
Date: Thu, 6 Apr 2017 15:23:13 +0200
Subject: [PATCH 0898/2409] Do not ask users to overwrite their /etc/sudoers
 file

Give instructions to add permissions for stack user without touching
main config.

Closes-Bug: #1680459
Closes-Bug: #1681418
Change-Id: Idd27e684e63c616466de28c07551729a1e091bdd
---
 doc/source/index.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/index.rst b/doc/source/index.rst
index c3bac9db72..cbd697112a 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -63,7 +63,7 @@ have sudo privileges:
 
 ::
 
-    $ sudo tee <<<"stack ALL=(ALL) NOPASSWD: ALL" /etc/sudoers
+    $ echo "stack ALL=(ALL) NOPASSWD: ALL" | sudo tee /etc/sudoers.d/stack
     $ sudo su - stack
 
 Download DevStack

From f68f6f2e33cd83c6a0a317abf12bd8a26d5504b6 Mon Sep 17 00:00:00 2001
From: youri jeong <prises0221@gmail.com>
Date: Wed, 12 Apr 2017 19:23:40 +0900
Subject: [PATCH 0899/2409] fix typo

fix typo for tools/dstat.sh
retreive must be retrieve

Change-Id: I7a817ec02e7156c886d7d6abb28688bfe2ef5998
---
 tools/dstat.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/dstat.sh b/tools/dstat.sh
index 1c80fb70f8..ae7306ecb7 100755
--- a/tools/dstat.sh
+++ b/tools/dstat.sh
@@ -9,7 +9,7 @@
 # Assumes:
 #  - dstat command is installed
 
-# Retreive log directory as argument from calling script.
+# Retrieve log directory as argument from calling script.
 LOGDIR=$1
 
 # Command line arguments for primary DStat process.

From 3d4c6d2dd16280de150b462ae51ccf85a932c7c1 Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Wed, 12 Apr 2017 13:57:36 -0700
Subject: [PATCH 0900/2409] Install netcat for libvirt live migration

Libvirt live migration requires netcat. It appears that newer UCA
packages may not automagically pull this in so explicitly list it as a
dependency of nova compute here. Note that netcat/netcat-traditional do
not appear to work and netcat-openbsd is required.

Change-Id: If2dbc53d082fea779448998ea12b821bd037a14e
---
 files/debs/n-cpu | 1 +
 1 file changed, 1 insertion(+)

diff --git a/files/debs/n-cpu b/files/debs/n-cpu
index 69ac430290..d8bbf59d07 100644
--- a/files/debs/n-cpu
+++ b/files/debs/n-cpu
@@ -2,6 +2,7 @@ cryptsetup
 genisoimage
 gir1.2-libosinfo-1.0
 lvm2 # NOPRIME
+netcat-openbsd
 open-iscsi
 python-guestfs # NOPRIME
 qemu-utils

From 8f8b274e60ac94bd6b2486ea075217411550c257 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 13 Apr 2017 09:34:12 -0400
Subject: [PATCH 0901/2409] Clean up apache 2.2 cruft from Ubuntu 12.04

All the apache 2.2 handling is obsolete now, as we don't support those
distros, so get rid of it.

Change-Id: I9c0f78af2b32afabb2c4264aebc92089c4694f91
---
 lib/apache | 48 +++---------------------------------------------
 1 file changed, 3 insertions(+), 45 deletions(-)

diff --git a/lib/apache b/lib/apache
index d1a11ae18b..f438407aca 100644
--- a/lib/apache
+++ b/lib/apache
@@ -90,49 +90,15 @@ function install_apache_wsgi {
     fi
     # WSGI isn't enabled by default, enable it
     enable_apache_mod wsgi
-
-    # ensure mod_version enabled for <IfVersion ...>.  This is
-    # built-in statically on anything recent, but precise (2.2)
-    # doesn't have it enabled
-    sudo a2enmod version || true
-}
-
-# get_apache_version() - return the version of Apache installed
-# This function is used to determine the Apache version installed. There are
-# various differences between Apache 2.2 and 2.4 that warrant special handling.
-function get_apache_version {
-    if is_ubuntu; then
-        local version_str
-        version_str=$(sudo /usr/sbin/apache2ctl -v | awk '/Server version/ {print $3}' | cut -f2 -d/)
-    elif is_fedora; then
-        local version_str
-        version_str=$(rpm -qa --queryformat '%{VERSION}' httpd)
-    elif is_suse; then
-        local version_str
-        version_str=$(rpm -qa --queryformat '%{VERSION}' apache2)
-    else
-        exit_distro_not_supported "cannot determine apache version"
-    fi
-    if [[ "$version_str" =~ ^2\.2\. ]]; then
-        echo "2.2"
-    elif [[ "$version_str" =~ ^2\.4\. ]]; then
-        echo "2.4"
-    else
-        exit_distro_not_supported "apache version not supported"
-    fi
 }
 
 # apache_site_config_for() - The filename of the site's configuration file.
 # This function uses the global variables APACHE_NAME and APACHE_CONF_DIR.
 #
-# On Ubuntu 14.04, the site configuration file must have a .conf suffix for a2ensite and a2dissite to
+# On Ubuntu 14.04+, the site configuration file must have a .conf suffix for a2ensite and a2dissite to
 # recognise it. a2ensite and a2dissite ignore the .conf suffix used as parameter. The default sites'
 # files are 000-default.conf and default-ssl.conf.
 #
-# On Ubuntu 12.04, the site configuration file may have any format, as long as it is in
-# /etc/apache2/sites-available/. a2ensite and a2dissite need the entire file name to work. The default
-# sites' files are default and default-ssl.
-#
 # On Fedora and openSUSE, any file in /etc/httpd/conf.d/ whose name ends with .conf is enabled.
 #
 # On RHEL and CentOS, things should hopefully work as in Fedora.
@@ -141,22 +107,14 @@ function get_apache_version {
 # +----------------------+--------------------+--------------------------+--------------------------+
 # | Distribution         | File name          | Site enabling command    | Site disabling command   |
 # +----------------------+--------------------+--------------------------+--------------------------+
-# | Ubuntu 12.04         | site               | a2ensite site            | a2dissite site           |
 # | Ubuntu 14.04         | site.conf          | a2ensite site            | a2dissite site           |
 # | Fedora, RHEL, CentOS | site.conf.disabled | mv site.conf{.disabled,} | mv site.conf{,.disabled} |
 # +----------------------+--------------------+--------------------------+--------------------------+
 function apache_site_config_for {
     local site=$@
     if is_ubuntu; then
-        local apache_version
-        apache_version=$(get_apache_version)
-        if [[ "$apache_version" == "2.2" ]]; then
-            # Ubuntu 12.04 - Apache 2.2
-            echo $APACHE_CONF_DIR/${site}
-        else
-            # Ubuntu 14.04 - Apache 2.4
-            echo $APACHE_CONF_DIR/${site}.conf
-        fi
+        # Ubuntu 14.04 - Apache 2.4
+        echo $APACHE_CONF_DIR/${site}.conf
     elif is_fedora || is_suse; then
         # fedora conf.d is only imported if it ends with .conf so this is approx the same
         local enabled_site_file="$APACHE_CONF_DIR/${site}.conf"

From 1f92d44544998291165942ae59626ccac7731fc8 Mon Sep 17 00:00:00 2001
From: Paul Belanger <pabelanger@redhat.com>
Date: Thu, 13 Apr 2017 12:07:57 -0400
Subject: [PATCH 0902/2409] Use apt_get_update after we setup UCA

It is possible some CI system are using an http_proxy. Use the helper
function to cover this use case.

Change-Id: Iee685147ca0244fc7de328a765f937602223de20
Signed-off-by: Paul Belanger <pabelanger@redhat.com>
---
 tools/fixup_stuff.sh | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index 6f680b860e..f3ba702a3b 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -91,7 +91,9 @@ if [[ "$DISTRO" = "xenial" ]]; then
         # Otherwise use upstream UCA
         sudo add-apt-repository -y cloud-archive:ocata
     fi
-    sudo apt-get update
+    # Force update our APT repos, since we added UCA above.
+    REPOS_UPDATED=False
+    apt_get_update
 fi
 
 

From 13a29ab787657491aff3b463e1a328a0872f65d0 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 13 Apr 2017 08:31:00 -0400
Subject: [PATCH 0903/2409] Add python3-systemd package

Otherwise journal logging under python3 doesn't work

Change-Id: Ib136d88a522c40482a3e94d0386a26600236f135
---
 files/debs/general | 1 +
 1 file changed, 1 insertion(+)

diff --git a/files/debs/general b/files/debs/general
index 3a0e24182a..edf64ce932 100644
--- a/files/debs/general
+++ b/files/debs/general
@@ -23,6 +23,7 @@ openssl
 pkg-config
 psmisc
 python2.7
+python3-systemd
 python-dev
 python-gdbm # needed for testr
 python-systemd

From bc4b8eb5bf4804cb2e6e5d9d07f1b87d46a6a689 Mon Sep 17 00:00:00 2001
From: Paul Belanger <pabelanger@redhat.com>
Date: Thu, 13 Apr 2017 15:06:36 -0400
Subject: [PATCH 0904/2409] Enable EPEL mirror by default

We recently disabled EPEL in openstack-infra, enable it again.

Change-Id: I213b302b34b740354d63b69e8ac7f4e1b3d3cdd7
Signed-off-by: Paul Belanger <pabelanger@redhat.com>
---
 stack.sh | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/stack.sh b/stack.sh
index 759a8dbacc..dfc2bd9162 100755
--- a/stack.sh
+++ b/stack.sh
@@ -348,6 +348,10 @@ SKIP_EPEL_INSTALL=$(trueorfalse False SKIP_EPEL_INSTALL)
 # is pre-installed.
 if [[ -f /etc/nodepool/provider ]]; then
     SKIP_EPEL_INSTALL=True
+    if is_fedora; then
+        # However, EPEL is not enabled by default.
+        sudo yum-config-manager --enable epel
+    fi
 fi
 
 if is_fedora && [[ $DISTRO == "rhel7" ]] && \

From 4222ee35f64d1950ecfc146b51738b74c316e758 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 13 Apr 2017 20:33:42 -0400
Subject: [PATCH 0905/2409] Make auth_uri available in the swift test setup

The swift functional tests use a config which requires keystone ports,
we're about to make those go away. This exposes the actual auth_uri to
swift for consumption.

Change-Id: I5868dfdb8e5f0972ba04e359d212b04351502436
---
 lib/swift | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/swift b/lib/swift
index 96e2f03e5f..5eac904559 100644
--- a/lib/swift
+++ b/lib/swift
@@ -538,6 +538,7 @@ EOF
         auth_vers=$(iniget ${testfile} func_test auth_version)
         iniset ${testfile} func_test auth_host ${KEYSTONE_SERVICE_HOST}
         iniset ${testfile} func_test auth_port ${KEYSTONE_AUTH_PORT}
+        iniset ${testfile} func_test auth_uri ${KEYSTONE_AUTH_URI}
         if [[ $auth_vers == "3" ]]; then
             iniset ${testfile} func_test auth_prefix /v3/
         else

From 968ebeee4146b306c026ca9b51d43ae6a993d1e2 Mon Sep 17 00:00:00 2001
From: Brianna Poulos <Brianna.Poulos@jhuapl.edu>
Date: Fri, 14 Apr 2017 11:33:56 -0400
Subject: [PATCH 0906/2409] Add castellan to LIBS_FROM_GIT

Allow castellan to be installed from git instead of pip.

Castellan has recently been moved under the oslo framework,
and the barbican-tempest-plugin tests which use castellan
would benefit from the ability to usd castellan from git
instead of pip.

Change-Id: I96edca90c61aec84637b7b1ce842eff04c521923
---
 lib/oslo                     | 2 ++
 stackrc                      | 4 ++++
 tests/test_libs_from_pypi.sh | 1 +
 3 files changed, 7 insertions(+)

diff --git a/lib/oslo b/lib/oslo
index 1a78bdfe73..182295c167 100644
--- a/lib/oslo
+++ b/lib/oslo
@@ -23,6 +23,7 @@ set +o xtrace
 # Defaults
 # --------
 GITDIR["automaton"]=$DEST/automaton
+GITDIR["castellan"]=$DEST/castellan
 GITDIR["cliff"]=$DEST/cliff
 GITDIR["debtcollector"]=$DEST/debtcollector
 GITDIR["futurist"]=$DEST/futurist
@@ -71,6 +72,7 @@ function _do_install_oslo_lib {
 # install_oslo() - Collect source and prepare
 function install_oslo {
     _do_install_oslo_lib "automaton"
+    _do_install_oslo_lib "castellan"
     _do_install_oslo_lib "cliff"
     _do_install_oslo_lib "debtcollector"
     _do_install_oslo_lib "futurist"
diff --git a/stackrc b/stackrc
index 88f75413c4..72ad52d765 100644
--- a/stackrc
+++ b/stackrc
@@ -364,6 +364,10 @@ GITDIR["python-openstackclient"]=$DEST/python-openstackclient
 #
 ###################
 
+# castellan key manager interface
+GITREPO["castellan"]=${CASTELLAN_REPO:-${GIT_BASE}/openstack/castellan.git}
+GITBRANCH["castellan"]=${CASTELLAN_BRANCH:-master}
+
 # cliff command line framework
 GITREPO["cliff"]=${CLIFF_REPO:-${GIT_BASE}/openstack/cliff.git}
 GITBRANCH["cliff"]=${CLIFF_BRANCH:-master}
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index 3d4bcd2596..314a9d56e3 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -43,6 +43,7 @@ ALL_LIBS+=" debtcollector os-brick automaton futurist oslo.service"
 ALL_LIBS+=" oslo.cache oslo.reports osprofiler"
 ALL_LIBS+=" keystoneauth ironic-lib neutron-lib oslo.privsep"
 ALL_LIBS+=" diskimage-builder os-vif python-brick-cinderclient-ext"
+ALL_LIBS+=" castellan"
 
 # Generate the above list with
 # echo ${!GITREPO[@]}

From f9c2a68338aa566051bb301aa0f1b3dec44f5c90 Mon Sep 17 00:00:00 2001
From: Brianna Poulos <Brianna.Poulos@jhuapl.edu>
Date: Fri, 14 Apr 2017 13:00:19 -0400
Subject: [PATCH 0907/2409] Add cursive to LIBS_FROM_GIT

Allow cursive to be installed from git instead of pip.

The barbican-tempest-plugin, which uses cursive indirectly
through nova and glance, would benefit from the ability to
use cursive from git instead of pip.

Change-Id: Icae7d310f1ee392d080e7c8e421a26d7c0ef4727
---
 lib/oslo                     | 2 ++
 stackrc                      | 4 ++++
 tests/test_libs_from_pypi.sh | 2 +-
 3 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/lib/oslo b/lib/oslo
index 1a78bdfe73..8eada67c0f 100644
--- a/lib/oslo
+++ b/lib/oslo
@@ -24,6 +24,7 @@ set +o xtrace
 # --------
 GITDIR["automaton"]=$DEST/automaton
 GITDIR["cliff"]=$DEST/cliff
+GITDIR["cursive"]=$DEST/cursive
 GITDIR["debtcollector"]=$DEST/debtcollector
 GITDIR["futurist"]=$DEST/futurist
 GITDIR["os-client-config"]=$DEST/os-client-config
@@ -72,6 +73,7 @@ function _do_install_oslo_lib {
 function install_oslo {
     _do_install_oslo_lib "automaton"
     _do_install_oslo_lib "cliff"
+    _do_install_oslo_lib "cursive"
     _do_install_oslo_lib "debtcollector"
     _do_install_oslo_lib "futurist"
     _do_install_oslo_lib "osc-lib"
diff --git a/stackrc b/stackrc
index 88f75413c4..56c19cd7f2 100644
--- a/stackrc
+++ b/stackrc
@@ -483,6 +483,10 @@ GITBRANCH["pbr"]=${PBR_BRANCH:-master}
 #
 ##################
 
+# cursive library
+GITREPO["cursive"]=${CURSIVE_REPO:-${GIT_BASE}/openstack/cursive.git}
+GITBRANCH["cursive"]=${CURSIVE_BRANCH:-master}
+
 # glance store library
 GITREPO["glance_store"]=${GLANCE_STORE_REPO:-${GIT_BASE}/openstack/glance_store.git}
 GITBRANCH["glance_store"]=${GLANCE_STORE_BRANCH:-master}
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index 3d4bcd2596..ad36312778 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -40,7 +40,7 @@ ALL_LIBS+=" python-openstackclient osc-lib os-client-config oslo.rootwrap"
 ALL_LIBS+=" oslo.i18n oslo.utils python-openstacksdk python-swiftclient"
 ALL_LIBS+=" python-neutronclient tooz ceilometermiddleware oslo.policy"
 ALL_LIBS+=" debtcollector os-brick automaton futurist oslo.service"
-ALL_LIBS+=" oslo.cache oslo.reports osprofiler"
+ALL_LIBS+=" oslo.cache oslo.reports osprofiler cursive"
 ALL_LIBS+=" keystoneauth ironic-lib neutron-lib oslo.privsep"
 ALL_LIBS+=" diskimage-builder os-vif python-brick-cinderclient-ext"
 

From 4da0fa8c1387e3888de1f4174b478e82e7cc7a67 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 13 Apr 2017 08:56:44 -0400
Subject: [PATCH 0908/2409] Always install apache and proxy-uwsgi

We're going to want to start using it by default so just start with
always installing it. This should not negatively impact anything else.

Also had to fix the test using cowsay, now that cowsay depends on
cowsay-off.

Part of uwsgi in devstack.

Change-Id: I8306a992d9d006bc0130a255145a6880065aa0df
---
 files/debs/general      | 3 +++
 files/rpms/general      | 2 ++
 tests/test_functions.sh | 2 +-
 3 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/files/debs/general b/files/debs/general
index edf64ce932..20490c6072 100644
--- a/files/debs/general
+++ b/files/debs/general
@@ -1,3 +1,5 @@
+apache2
+apache2-dev
 bc
 bridge-utils
 bsdmainutils
@@ -9,6 +11,7 @@ gettext  # used for compiling message catalogs
 git
 graphviz # needed for docs
 iputils-ping
+libapache2-mod-proxy-uwsgi
 libffi-dev # for pyOpenSSL
 libjpeg-dev # Pillow 3.0.0
 libmysqlclient-dev  # MySQL-python
diff --git a/files/rpms/general b/files/rpms/general
index baba06b5ab..106aa6ae88 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -7,6 +7,8 @@ gcc-c++
 gettext  # used for compiling message catalogs
 git-core
 graphviz # needed only for docs
+httpd
+httpd-devel
 iptables-services  # NOPRIME f23,f24,f25
 java-1.7.0-openjdk-headless  # NOPRIME rhel7
 java-1.8.0-openjdk-headless  # NOPRIME f23,f24,f25
diff --git a/tests/test_functions.sh b/tests/test_functions.sh
index 8aae23dcb8..adf20cdb80 100755
--- a/tests/test_functions.sh
+++ b/tests/test_functions.sh
@@ -224,7 +224,7 @@ fi
 
 # test against removed package...was a bug on Ubuntu
 if is_ubuntu; then
-    PKG=cowsay
+    PKG=cowsay-off
     if ! (dpkg -s $PKG >/dev/null 2>&1); then
         # it was never installed...set up the condition
         sudo apt-get install -y cowsay >/dev/null 2>&1

From 2b85cf0f06b099f9a771e9fbdbdef173c9d04784 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 13 Apr 2017 09:02:14 -0400
Subject: [PATCH 0909/2409] Just use normal restart for apache

We're now in a systemd world where systemd is managing the restart
effectively, there is no reason to be tricksy with apache now that
we're not working around weird upstartd issues.

Change-Id: Ifadfd504eb10a90db5177ea9180b9cd8331a2948
---
 lib/apache | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/lib/apache b/lib/apache
index f438407aca..e36d0c998f 100644
--- a/lib/apache
+++ b/lib/apache
@@ -173,11 +173,7 @@ function restart_apache_server {
     # Apache can be slow to stop, doing an explicit stop, sleep, start helps
     # to mitigate issues where apache will claim a port it's listening on is
     # still in use and fail to start.
-    time_start "restart_apache_server"
-    stop_service $APACHE_NAME
-    sleep 3
-    start_service $APACHE_NAME
-    time_stop "restart_apache_server"
+    restart_service $APACHE_NAME
 }
 
 # reload_apache_server

From 2f8c88e0532b6b712cc386a9c15d833d3629b19a Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 13 Apr 2017 09:08:39 -0400
Subject: [PATCH 0910/2409] Factor out code to write uwsgi config files

Instead of this code all existing in keystone inline, factor out into
a dedicated set of functions, and make keystone use this. This drops
uwsgi supporting https directly, but that's not going to be a
supported model going forward once we get to proxy only anyway.

Change-Id: I1d89be1f1b36f26eaf543b99bde6fdc5701474fe
---
 lib/apache   | 53 ++++++++++++++++++++++++++++++++++++++++++++++++++++
 lib/keystone | 47 ++++++++--------------------------------------
 2 files changed, 61 insertions(+), 39 deletions(-)

diff --git a/lib/apache b/lib/apache
index e36d0c998f..fc73b49912 100644
--- a/lib/apache
+++ b/lib/apache
@@ -181,6 +181,59 @@ function reload_apache_server {
     reload_service $APACHE_NAME
 }
 
+function write_uwsgi_config {
+    local file=$1
+    local wsgi=$2
+    local url=$3
+    local http=$4
+    local name=""
+    name=$(basename $wsgi)
+    local socket="/tmp/${name}.socket"
+
+    # always cleanup given that we are using iniset here
+    rm -rf $file
+    iniset "$file" uwsgi wsgi-file "$wsgi"
+    iniset "$file" uwsgi socket "$socket"
+    iniset "$file" uwsgi processes $API_WORKERS
+    # This is running standalone
+    iniset "$file" uwsgi master true
+    # Set die-on-term & exit-on-reload so that uwsgi shuts down
+    iniset "$file" uwsgi die-on-term true
+    iniset "$file" uwsgi exit-on-reload true
+    iniset "$file" uwsgi enable-threads true
+    iniset "$file" uwsgi plugins python
+    # uwsgi recommends this to prevent thundering herd on accept.
+    iniset "$file" uwsgi thunder-lock true
+    # Override the default size for headers from the 4k default.
+    iniset "$file" uwsgi buffer-size 65535
+    # Make sure the client doesn't try to re-use the connection.
+    iniset "$file" uwsgi add-header "Connection: close"
+    # This ensures that file descriptors aren't shared between processes.
+    iniset "$file" uwsgi lazy-apps true
+    iniset "$file" uwsgi chmod-socket 666
+
+    # If we said bind directly to http, then do that and don't start the apache proxy
+    if [[ -n "$http" ]]; then
+        iniset "$file" uwsgi http $http
+    else
+        local apache_conf=""
+        apache_conf=$(apache_site_config_for $name)
+        echo "ProxyPass \"${url}\" \"unix:${socket}|uwsgi://uwsgi-uds-${name}/\"" | sudo tee $apache_conf
+        enable_apache_site $name
+        reload_apache_server
+    fi
+}
+
+function remove_uwsgi_config {
+    local file=$1
+    local wsgi=$2
+    local name=""
+    name=$(basename $wsgi)
+
+    rm -rf $file
+    disable_apache_site $name
+}
+
 # Restore xtrace
 $_XTRACE_LIB_APACHE
 
diff --git a/lib/keystone b/lib/keystone
index 3db3c8d4aa..936af6a5e1 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -50,6 +50,10 @@ fi
 KEYSTONE_CONF_DIR=${KEYSTONE_CONF_DIR:-/etc/keystone}
 KEYSTONE_CONF=$KEYSTONE_CONF_DIR/keystone.conf
 KEYSTONE_PASTE_INI=${KEYSTONE_PASTE_INI:-$KEYSTONE_CONF_DIR/keystone-paste.ini}
+KEYSTONE_PUBLIC_UWSGI_CONF=$KEYSTONE_CONF_DIR/keystone-uwsgi-public.ini
+KEYSTONE_ADMIN_UWSGI_CONF=$KEYSTONE_CONF_DIR/keystone-uwsgi-admin.ini
+KEYSTONE_PUBLIC_UWSGI=$KEYSTONE_BIN_DIR/keystone-wsgi-public
+KEYSTONE_ADMIN_UWSGI=$KEYSTONE_BIN_DIR/keystone-wsgi-admin
 
 # Toggle for deploying Keystone under HTTPD + mod_wsgi
 # Deprecated in Mitaka, use KEYSTONE_DEPLOY instead.
@@ -293,44 +297,9 @@ function configure_keystone {
         _config_keystone_apache_wsgi
     else # uwsgi
         # iniset creates these files when it's called if they don't exist.
-        KEYSTONE_PUBLIC_UWSGI_FILE=$KEYSTONE_CONF_DIR/keystone-uwsgi-public.ini
-        KEYSTONE_ADMIN_UWSGI_FILE=$KEYSTONE_CONF_DIR/keystone-uwsgi-admin.ini
-
-        rm -f "$KEYSTONE_PUBLIC_UWSGI_FILE"
-        rm -f "$KEYSTONE_ADMIN_UWSGI_FILE"
-
-        if is_ssl_enabled_service key; then
-            iniset "$KEYSTONE_PUBLIC_UWSGI_FILE" uwsgi https $KEYSTONE_SERVICE_HOST:$service_port,$KEYSTONE_SSL_CERT,$KEYSTONE_SSL_KEY
-            iniset "$KEYSTONE_ADMIN_UWSGI_FILE" uwsgi https $KEYSTONE_ADMIN_BIND_HOST:$auth_port,$KEYSTONE_SSL_CERT,$KEYSTONE_SSL_KEY
-        else
-            iniset "$KEYSTONE_PUBLIC_UWSGI_FILE" uwsgi http $KEYSTONE_SERVICE_HOST:$service_port
-            iniset "$KEYSTONE_ADMIN_UWSGI_FILE" uwsgi http $KEYSTONE_ADMIN_BIND_HOST:$auth_port
-        fi
 
-        iniset "$KEYSTONE_PUBLIC_UWSGI_FILE" uwsgi wsgi-file "$KEYSTONE_BIN_DIR/keystone-wsgi-public"
-        iniset "$KEYSTONE_PUBLIC_UWSGI_FILE" uwsgi processes $(nproc)
-
-        iniset "$KEYSTONE_ADMIN_UWSGI_FILE" uwsgi wsgi-file "$KEYSTONE_BIN_DIR/keystone-wsgi-admin"
-        iniset "$KEYSTONE_ADMIN_UWSGI_FILE" uwsgi processes $API_WORKERS
-
-        # Common settings
-        for file in "$KEYSTONE_PUBLIC_UWSGI_FILE" "$KEYSTONE_ADMIN_UWSGI_FILE"; do
-            # This is running standalone
-            iniset "$file" uwsgi master true
-            # Set die-on-term & exit-on-reload so that uwsgi shuts down
-            iniset "$file" uwsgi die-on-term true
-            iniset "$file" uwsgi exit-on-reload true
-            iniset "$file" uwsgi enable-threads true
-            iniset "$file" uwsgi plugins python
-            # uwsgi recommends this to prevent thundering herd on accept.
-            iniset "$file" uwsgi thunder-lock true
-            # Override the default size for headers from the 4k default.
-            iniset "$file" uwsgi buffer-size 65535
-            # Make sure the client doesn't try to re-use the connection.
-            iniset "$file" uwsgi add-header "Connection: close"
-            # This ensures that file descriptors aren't shared between processes.
-            iniset "$file" uwsgi lazy-apps true
-        done
+        write_uwsgi_config "$KEYSTONE_PUBLIC_UWSGI_CONF" "$KEYSTONE_PUBLIC_UWSGI" "/identity" "$KEYSTONE_SERVICE_HOST:$service_port"
+        write_uwsgi_config "$KEYSTONE_ADMIN_UWSGI_CONF" "$KEYSTONE_ADMIN_UWSGI" "/identity_admin" "$KEYSTONE_ADMIN_BIND_HOST:$auth_port"
     fi
 
     iniset $KEYSTONE_CONF DEFAULT max_token_size 16384
@@ -604,8 +573,8 @@ function start_keystone {
         # TODO(sdague): we should really get down to a single keystone here
         enable_service key-p
         enable_service key-a
-        run_process key-p "$KEYSTONE_BIN_DIR/uwsgi --ini $KEYSTONE_PUBLIC_UWSGI_FILE" ""
-        run_process key-a "$KEYSTONE_BIN_DIR/uwsgi --ini $KEYSTONE_ADMIN_UWSGI_FILE" ""
+        run_process key-p "$KEYSTONE_BIN_DIR/uwsgi --ini $KEYSTONE_PUBLIC_UWSGI_CONF" ""
+        run_process key-a "$KEYSTONE_BIN_DIR/uwsgi --ini $KEYSTONE_ADMIN_UWSGI_CONF" ""
     fi
 
     echo "Waiting for keystone to start..."

From f3b2f4c85307b14f115a020f5eaf6c92026b55b4 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 13 Apr 2017 10:11:48 -0400
Subject: [PATCH 0911/2409] Remove USE_SSL support

tls-proxy is the way we're now doing a standard install using https
between services. There is a lot more work to make services directly
handle https, and having python daemons do that directly is a bit of
an anti pattern. Nothing currently tests this in project-config from
my recent grepping, so in the interest of long term maintenance,
delete it all.

Change-Id: I910df4ceab6f24f3d9c484e0433c93b06f17d6e1
---
 lib/cinder         | 20 ++------------------
 lib/glance         | 17 +++--------------
 lib/keystone       | 17 +----------------
 lib/neutron        | 21 +++------------------
 lib/neutron-legacy | 17 +----------------
 lib/nova           | 24 +++---------------------
 lib/placement      | 11 +----------
 lib/swift          |  9 +--------
 lib/tempest        |  2 +-
 lib/tls            | 25 ++++++-------------------
 stack.sh           | 11 ++---------
 stackrc            |  3 ---
 unstack.sh         |  3 ---
 13 files changed, 24 insertions(+), 156 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index c17cea06c7..ac61537c41 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -58,7 +58,7 @@ CINDER_CONF=$CINDER_CONF_DIR/cinder.conf
 CINDER_API_PASTE_INI=$CINDER_CONF_DIR/api-paste.ini
 
 # Public facing bits
-if is_ssl_enabled_service "cinder" || is_service_enabled tls-proxy; then
+if is_service_enabled tls-proxy; then
     CINDER_SERVICE_PROTOCOL="https"
 fi
 CINDER_SERVICE_HOST=${CINDER_SERVICE_HOST:-$SERVICE_HOST}
@@ -215,11 +215,6 @@ function _cinder_config_apache_wsgi {
     local cinder_api_port=$CINDER_SERVICE_PORT
     local venv_path=""
 
-    if is_ssl_enabled_service c-api; then
-        cinder_ssl="SSLEngine On"
-        cinder_certfile="SSLCertificateFile $CINDER_SSL_CERT"
-        cinder_keyfile="SSLCertificateKeyFile $CINDER_SSL_KEY"
-    fi
     if [[ ${USE_VENV} = True ]]; then
         venv_path="python-path=${PROJECT_VENV["cinder"]}/lib/python2.7/site-packages"
     fi
@@ -347,7 +342,7 @@ function configure_cinder {
     iniset $CINDER_CONF DEFAULT osapi_volume_workers "$API_WORKERS"
 
     iniset $CINDER_CONF DEFAULT glance_api_servers "${GLANCE_SERVICE_PROTOCOL}://${GLANCE_HOSTPORT}"
-    if is_ssl_enabled_service glance || is_service_enabled tls-proxy; then
+    if is_service_enabled tls-proxy; then
         iniset $CINDER_CONF DEFAULT glance_protocol https
         iniset $CINDER_CONF DEFAULT glance_ca_certificates_file $SSL_BUNDLE_FILE
     fi
@@ -356,14 +351,6 @@ function configure_cinder {
         iniset $CINDER_CONF DEFAULT glance_api_version 2
     fi
 
-    # Register SSL certificates if provided
-    if is_ssl_enabled_service cinder; then
-        ensure_certificates CINDER
-
-        iniset $CINDER_CONF DEFAULT ssl_cert_file "$CINDER_SSL_CERT"
-        iniset $CINDER_CONF DEFAULT ssl_key_file "$CINDER_SSL_KEY"
-    fi
-
     # Set os_privileged_user credentials (used for os-assisted-snapshots)
     iniset $CINDER_CONF DEFAULT os_privileged_user_name nova
     iniset $CINDER_CONF DEFAULT os_privileged_user_password "$SERVICE_PASSWORD"
@@ -464,9 +451,6 @@ function install_cinder {
 
     if [ "$CINDER_USE_MOD_WSGI" == "True" ]; then
         install_apache_wsgi
-        if is_ssl_enabled_service "c-api"; then
-            enable_mod_ssl
-        fi
     fi
 }
 
diff --git a/lib/glance b/lib/glance
index 2f4aa5f0f8..23a1cbf2c7 100644
--- a/lib/glance
+++ b/lib/glance
@@ -57,7 +57,7 @@ GLANCE_SCHEMA_JSON=$GLANCE_CONF_DIR/schema-image.json
 GLANCE_SWIFT_STORE_CONF=$GLANCE_CONF_DIR/glance-swift-store.conf
 GLANCE_V1_ENABLED=${GLANCE_V1_ENABLED:-False}
 
-if is_ssl_enabled_service "glance" || is_service_enabled tls-proxy; then
+if is_service_enabled tls-proxy; then
     GLANCE_SERVICE_PROTOCOL="https"
 fi
 
@@ -187,18 +187,7 @@ function configure_glance {
         iniset $GLANCE_REGISTRY_CONF keystone_authtoken identity_uri $KEYSTONE_AUTH_URI
     fi
 
-    # Register SSL certificates if provided
-    if is_ssl_enabled_service glance; then
-        ensure_certificates GLANCE
-
-        iniset $GLANCE_API_CONF DEFAULT cert_file "$GLANCE_SSL_CERT"
-        iniset $GLANCE_API_CONF DEFAULT key_file "$GLANCE_SSL_KEY"
-
-        iniset $GLANCE_REGISTRY_CONF DEFAULT cert_file "$GLANCE_SSL_CERT"
-        iniset $GLANCE_REGISTRY_CONF DEFAULT key_file "$GLANCE_SSL_KEY"
-    fi
-
-    if is_ssl_enabled_service glance || is_service_enabled tls-proxy; then
+    if is_service_enabled tls-proxy; then
         iniset $GLANCE_API_CONF DEFAULT registry_client_protocol https
     fi
 
@@ -233,7 +222,7 @@ function configure_glance {
 
     cp -p $GLANCE_DIR/etc/metadefs/*.json $GLANCE_METADEF_DIR
 
-    if is_ssl_enabled_service "cinder" || is_service_enabled tls-proxy; then
+    if is_service_enabled tls-proxy; then
         CINDER_SERVICE_HOST=${CINDER_SERVICE_HOST:-$SERVICE_HOST}
         CINDER_SERVICE_PORT=${CINDER_SERVICE_PORT:-8776}
 
diff --git a/lib/keystone b/lib/keystone
index 936af6a5e1..45ba2c5352 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -116,7 +116,7 @@ SERVICE_PROJECT_NAME=${SERVICE_PROJECT_NAME:-service}
 SERVICE_TENANT_NAME=${SERVICE_PROJECT_NAME:-service}
 
 # if we are running with SSL use https protocols
-if is_ssl_enabled_service "key" || is_service_enabled tls-proxy; then
+if is_service_enabled tls-proxy; then
     KEYSTONE_AUTH_PROTOCOL="https"
     KEYSTONE_SERVICE_PROTOCOL="https"
 fi
@@ -171,12 +171,6 @@ function _config_keystone_apache_wsgi {
     local keystone_auth_port=$KEYSTONE_AUTH_PORT
     local venv_path=""
 
-    if is_ssl_enabled_service key; then
-        keystone_ssl_listen=""
-        keystone_ssl="SSLEngine On"
-        keystone_certfile="SSLCertificateFile $KEYSTONE_SSL_CERT"
-        keystone_keyfile="SSLCertificateKeyFile $KEYSTONE_SSL_KEY"
-    fi
     if is_service_enabled tls-proxy; then
         keystone_service_port=$KEYSTONE_SERVICE_PORT_INT
         keystone_auth_port=$KEYSTONE_AUTH_PORT_INT
@@ -247,11 +241,6 @@ function configure_keystone {
 
     iniset_rpc_backend keystone $KEYSTONE_CONF
 
-    # Register SSL certificates if provided
-    if is_ssl_enabled_service key; then
-        ensure_certificates KEYSTONE
-    fi
-
     local service_port=$KEYSTONE_SERVICE_PORT
     local auth_port=$KEYSTONE_AUTH_PORT
 
@@ -297,7 +286,6 @@ function configure_keystone {
         _config_keystone_apache_wsgi
     else # uwsgi
         # iniset creates these files when it's called if they don't exist.
-
         write_uwsgi_config "$KEYSTONE_PUBLIC_UWSGI_CONF" "$KEYSTONE_PUBLIC_UWSGI" "/identity" "$KEYSTONE_SERVICE_HOST:$service_port"
         write_uwsgi_config "$KEYSTONE_ADMIN_UWSGI_CONF" "$KEYSTONE_ADMIN_UWSGI" "/identity_admin" "$KEYSTONE_ADMIN_BIND_HOST:$auth_port"
     fi
@@ -546,9 +534,6 @@ function install_keystone {
 
     if [ "$KEYSTONE_DEPLOY" == "mod_wsgi" ]; then
         install_apache_wsgi
-        if is_ssl_enabled_service "key"; then
-            enable_mod_ssl
-        fi
     elif [ "$KEYSTONE_DEPLOY" == "uwsgi" ]; then
         pip_install uwsgi
     fi
diff --git a/lib/neutron b/lib/neutron
index dd914664ae..492a0ee8fb 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -61,7 +61,7 @@ NEUTRON_META_BINARY=${NEUTRON_META_BINARY:-neutron-metadata-agent}
 NEUTRON_METERING_BINARY=${NEUTRON_METERING_BINARY:-neutron-metering-agent}
 
 # Public facing bits
-if is_ssl_enabled_service "neutron" || is_service_enabled tls-proxy; then
+if is_service_enabled tls-proxy; then
     NEUTRON_SERVICE_PROTOCOL="https"
 fi
 NEUTRON_SERVICE_HOST=${NEUTRON_SERVICE_HOST:-$SERVICE_HOST}
@@ -243,14 +243,6 @@ function configure_neutron_new {
         iniset $NEUTRON_CONF DEFAULT bind_port "$NEUTRON_SERVICE_PORT_INT"
     fi
 
-    if is_ssl_enabled_service "neutron"; then
-        ensure_certificates NEUTRON
-
-        iniset $NEUTRON_CONF DEFAULT use_ssl True
-        iniset $NEUTRON_CONF DEFAULT ssl_cert_file "$NEUTRON_SSL_CERT"
-        iniset $NEUTRON_CONF DEFAULT ssl_key_file "$NEUTRON_SSL_KEY"
-    fi
-
     # Metering
     if is_service_enabled neutron-metering; then
         cp $NEUTRON_DIR/etc/metering_agent.ini.sample $NEUTRON_METERING_AGENT_CONF
@@ -404,17 +396,10 @@ function start_neutron_api {
     # TODO(sc68cal) Stop hard coding this
     run_process neutron-api "$NEUTRON_BIN_DIR/neutron-server $opts"
 
-    if is_ssl_enabled_service "neutron"; then
-        ssl_ca="--ca-certificate=${SSL_BUNDLE_FILE}"
-        local testcmd="wget ${ssl_ca} --no-proxy -q -O- $service_protocol://$NEUTRON_SERVICE_HOST:$service_port"
-        test_with_retry "$testcmd" "Neutron did not start" $SERVICE_TIMEOUT
-    else
-        if ! wait_for_service $SERVICE_TIMEOUT $service_protocol://$NEUTRON_SERVICE_HOST:$service_port; then
-            die $LINENO "neutron-api did not start"
-        fi
+    if ! wait_for_service $SERVICE_TIMEOUT $service_protocol://$NEUTRON_SERVICE_HOST:$service_port; then
+        die $LINENO "neutron-api did not start"
     fi
 
-
     # Start proxy if enabled
     if is_service_enabled tls-proxy; then
         start_tls_proxy neutron '*' $NEUTRON_SERVICE_PORT $NEUTRON_SERVICE_HOST $NEUTRON_SERVICE_PORT_INT
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 74f36e0ce3..1dfd5fec7d 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -61,7 +61,7 @@
 
 deprecated "Using lib/neutron-legacy is deprecated, and it will be removed in the future"
 
-if is_ssl_enabled_service "neutron" || is_service_enabled tls-proxy; then
+if is_service_enabled tls-proxy; then
     Q_PROTOCOL="https"
 fi
 
@@ -461,9 +461,6 @@ function start_neutron_service_and_check {
     # Start the Neutron service
     run_process q-svc "$NEUTRON_BIN_DIR/neutron-server $cfg_file_options"
     echo "Waiting for Neutron to start..."
-    if is_ssl_enabled_service "neutron"; then
-        ssl_ca="--ca-certificate=${SSL_BUNDLE_FILE}"
-    fi
 
     local testcmd="wget ${ssl_ca} --no-proxy -q -O- $service_protocol://$Q_HOST:$service_port"
     test_with_retry "$testcmd" "Neutron did not start" $SERVICE_TIMEOUT
@@ -714,18 +711,6 @@ function _configure_neutron_common {
         iniset $NEUTRON_CONF DEFAULT bind_port "$Q_PORT_INT"
     fi
 
-    if is_ssl_enabled_service "nova"; then
-        iniset $NEUTRON_CONF nova cafile $SSL_BUNDLE_FILE
-    fi
-
-    if is_ssl_enabled_service "neutron"; then
-        ensure_certificates NEUTRON
-
-        iniset $NEUTRON_CONF DEFAULT use_ssl True
-        iniset $NEUTRON_CONF DEFAULT ssl_cert_file "$NEUTRON_SSL_CERT"
-        iniset $NEUTRON_CONF DEFAULT ssl_key_file "$NEUTRON_SSL_KEY"
-    fi
-
     _neutron_setup_rootwrap
 }
 
diff --git a/lib/nova b/lib/nova
index a36a740265..cba9acdd79 100644
--- a/lib/nova
+++ b/lib/nova
@@ -68,7 +68,7 @@ fi
 # Toggle for deploying Nova-API under HTTPD + mod_wsgi
 NOVA_USE_MOD_WSGI=${NOVA_USE_MOD_WSGI:-False}
 
-if is_ssl_enabled_service "nova" || is_service_enabled tls-proxy; then
+if is_service_enabled tls-proxy; then
     NOVA_SERVICE_PROTOCOL="https"
 fi
 
@@ -262,11 +262,6 @@ function _config_nova_apache_wsgi {
     local nova_metadata_port=$METADATA_SERVICE_PORT
     local venv_path=""
 
-    if is_ssl_enabled_service nova-api; then
-        nova_ssl="SSLEngine On"
-        nova_certfile="SSLCertificateFile $NOVA_SSL_CERT"
-        nova_keyfile="SSLCertificateKeyFile $NOVA_SSL_KEY"
-    fi
     if [[ ${USE_VENV} = True ]]; then
         venv_path="python-path=${PROJECT_VENV["nova"]}/lib/$(python_version)/site-packages"
     fi
@@ -501,7 +496,7 @@ function create_nova_conf {
     fi
 
     if is_service_enabled cinder; then
-        if is_ssl_enabled_service "cinder" || is_service_enabled tls-proxy; then
+        if is_service_enabled tls-proxy; then
             CINDER_SERVICE_HOST=${CINDER_SERVICE_HOST:-$SERVICE_HOST}
             CINDER_SERVICE_PORT=${CINDER_SERVICE_PORT:-8776}
             iniset $NOVA_CONF cinder cafile $SSL_BUNDLE_FILE
@@ -586,20 +581,10 @@ function create_nova_conf {
 
     iniset $NOVA_CONF cinder os_region_name "$REGION_NAME"
 
-    if is_ssl_enabled_service glance || is_service_enabled tls-proxy; then
+    if is_service_enabled tls-proxy; then
         iniset $NOVA_CONF DEFAULT glance_protocol https
     fi
 
-    # Register SSL certificates if provided
-    if is_ssl_enabled_service nova; then
-        ensure_certificates NOVA
-
-        iniset $NOVA_CONF DEFAULT ssl_cert_file "$NOVA_SSL_CERT"
-        iniset $NOVA_CONF DEFAULT ssl_key_file "$NOVA_SSL_KEY"
-
-        iniset $NOVA_CONF DEFAULT enabled_ssl_apis "$NOVA_ENABLED_APIS"
-    fi
-
     if is_service_enabled n-sproxy; then
         iniset $NOVA_CONF serial_console serialproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
         iniset $NOVA_CONF serial_console enabled True
@@ -790,9 +775,6 @@ function install_nova {
 
     if [ "$NOVA_USE_MOD_WSGI" == "True" ]; then
         install_apache_wsgi
-        if is_ssl_enabled_service "nova-api"; then
-            enable_mod_ssl
-        fi
     fi
 }
 
diff --git a/lib/placement b/lib/placement
index 4cc5cd8b6a..a29784b93c 100644
--- a/lib/placement
+++ b/lib/placement
@@ -40,7 +40,7 @@ PLACEMENT_AUTH_STRATEGY=${PLACEMENT_AUTH_STRATEGY:-placement}
 # yet merged in nova but is coming soon.
 PLACEMENT_DB_ENABLED=$(trueorfalse False PLACEMENT_DB_ENABLED)
 
-if is_ssl_enabled_service "placement-api" || is_service_enabled tls-proxy; then
+if is_service_enabled tls-proxy; then
     PLACEMENT_SERVICE_PROTOCOL="https"
 fi
 
@@ -72,12 +72,6 @@ function _config_placement_apache_wsgi {
     nova_bin_dir=$(get_python_exec_prefix)
     placement_api_apache_conf=$(apache_site_config_for placement-api)
 
-    # reuse nova's cert if a cert is being used
-    if is_ssl_enabled_service "placement-api"; then
-        placement_ssl="SSLEngine On"
-        placement_certfile="SSLCertificateFile $NOVA_SSL_CERT"
-        placement_keyfile="SSLCertificateKeyFile $NOVA_SSL_KEY"
-    fi
     # reuse nova's venv if there is one as placement code lives
     # there
     if [[ ${USE_VENV} = True ]]; then
@@ -149,9 +143,6 @@ function init_placement {
 # install_placement() - Collect source and prepare
 function install_placement {
     install_apache_wsgi
-    if is_ssl_enabled_service "placement-api"; then
-        enable_mod_ssl
-    fi
 }
 
 # start_placement_api() - Start the API processes ahead of other things
diff --git a/lib/swift b/lib/swift
index 5eac904559..d764b25fdb 100644
--- a/lib/swift
+++ b/lib/swift
@@ -31,7 +31,7 @@ set +o xtrace
 # Defaults
 # --------
 
-if is_ssl_enabled_service "s-proxy" || is_service_enabled tls-proxy; then
+if is_service_enabled tls-proxy; then
     SWIFT_SERVICE_PROTOCOL="https"
 fi
 
@@ -398,13 +398,6 @@ function configure_swift {
         iniset ${SWIFT_CONFIG_PROXY_SERVER} DEFAULT bind_port ${SWIFT_DEFAULT_BIND_PORT}
     fi
 
-    if is_ssl_enabled_service s-proxy; then
-        ensure_certificates SWIFT
-
-        iniset ${SWIFT_CONFIG_PROXY_SERVER} DEFAULT cert_file "$SWIFT_SSL_CERT"
-        iniset ${SWIFT_CONFIG_PROXY_SERVER} DEFAULT key_file "$SWIFT_SSL_KEY"
-    fi
-
     # DevStack is commonly run in a small slow environment, so bump the timeouts up.
     # ``node_timeout`` is the node read operation response time to the proxy server
     # ``conn_timeout`` is how long it takes a connect() system call to return
diff --git a/lib/tempest b/lib/tempest
index f6fc57dc72..04f8f6a3f6 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -279,7 +279,7 @@ function configure_tempest {
     fi
     iniset $TEMPEST_CONFIG identity auth_version ${TEMPEST_AUTH_VERSION:-v3}
 
-    if is_ssl_enabled_service "key" || is_service_enabled tls-proxy; then
+    if is_service_enabled tls-proxy; then
         iniset $TEMPEST_CONFIG identity ca_certificates_file $SSL_BUNDLE_FILE
     fi
 
diff --git a/lib/tls b/lib/tls
index fb2fa3a17b..c2c92a1bae 100644
--- a/lib/tls
+++ b/lib/tls
@@ -343,7 +343,7 @@ function make_root_CA {
 # one. If the value for the CA is not rooted in /etc then we know
 # we need to change it.
 function fix_system_ca_bundle_path {
-    if is_service_enabled tls-proxy || [ "$USE_SSL" == "True" ]; then
+    if is_service_enabled tls-proxy; then
         local capath
         capath=$(python -c $'try:\n from requests import certs\n print certs.where()\nexcept ImportError: pass')
 
@@ -362,27 +362,14 @@ function fix_system_ca_bundle_path {
 }
 
 
-# Certificate Input Configuration
-# ===============================
-
-# check to see if the service(s) specified are to be SSL enabled.
-#
-# Multiple services specified as arguments are ``OR``'ed together; the test
-# is a short-circuit boolean, i.e it returns on the first match.
-#
-# Uses global ``SSL_ENABLED_SERVICES``
+# Only for compatibility, return if the tls-proxy is enabled
 function is_ssl_enabled_service {
-    local services=$@
-    local service=""
-    if [ "$USE_SSL" == "False" ]; then
-        return 1
-    fi
-    for service in ${services}; do
-        [[ ,${SSL_ENABLED_SERVICES}, =~ ,${service}, ]] && return 0
-    done
-    return 1
+    return is_service_enabled tls-proxy
 }
 
+# Certificate Input Configuration
+# ===============================
+
 # Ensure that the certificates for a service are in place. This function does
 # not check that a service is SSL enabled, this should already have been
 # completed.
diff --git a/stack.sh b/stack.sh
index 759a8dbacc..635a328190 100755
--- a/stack.sh
+++ b/stack.sh
@@ -539,13 +539,6 @@ rm -f $SSL_BUNDLE_FILE
 source $TOP_DIR/lib/database
 source $TOP_DIR/lib/rpc_backend
 
-# Service to enable with SSL if ``USE_SSL`` is True
-SSL_ENABLED_SERVICES="key,nova,cinder,glance,s-proxy,neutron"
-
-if is_service_enabled tls-proxy && [ "$USE_SSL" == "True" ]; then
-    die $LINENO "tls-proxy and SSL are mutually exclusive"
-fi
-
 # Configure Projects
 # ==================
 
@@ -806,7 +799,7 @@ if is_service_enabled cinder nova; then
 fi
 
 # Setup TLS certs
-if is_service_enabled tls-proxy || [ "$USE_SSL" == "True" ]; then
+if is_service_enabled tls-proxy; then
     configure_CA
     init_CA
     init_cert
@@ -886,7 +879,7 @@ if is_service_enabled horizon; then
     stack_install_service horizon
 fi
 
-if is_service_enabled tls-proxy || [ "$USE_SSL" == "True" ]; then
+if is_service_enabled tls-proxy; then
     fix_system_ca_bundle_path
 fi
 
diff --git a/stackrc b/stackrc
index 88f75413c4..3ceb78c0d6 100644
--- a/stackrc
+++ b/stackrc
@@ -846,9 +846,6 @@ SYSLOG_PORT=${SYSLOG_PORT:-516}
 # Set to 0 to disable shallow cloning
 GIT_DEPTH=${GIT_DEPTH:-0}
 
-# Use native SSL for servers in ``SSL_ENABLED_SERVICES``
-USE_SSL=$(trueorfalse False USE_SSL)
-
 # We may not need to recreate database in case 2 Keystone services
 # sharing the same database. It would be useful for multinode Grenade tests.
 RECREATE_KEYSTONE_DB=$(trueorfalse True RECREATE_KEYSTONE_DB)
diff --git a/unstack.sh b/unstack.sh
index b0ebaf725e..485fed7f80 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -129,9 +129,6 @@ if is_service_enabled tls-proxy; then
     stop_tls_proxy
     cleanup_CA
 fi
-if [ "$USE_SSL" == "True" ]; then
-    cleanup_CA
-fi
 
 SCSI_PERSIST_DIR=$CINDER_STATE_PATH/volumes/*
 

From a1446b960fa7c21bc1e7141921d6fc95c6e212d2 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 17 Apr 2017 14:31:21 -0400
Subject: [PATCH 0912/2409] always retry proxy errors

When an apache worker gets a proxy error, it will not retry talking to
the backend server until the retry timeout expires. We bring up the
proxy server *before* the backend server, and poll it. If we are
running a small number of workers, there is a likely chance that we're
going to hit one that errored before the backend was up, thus failing
for now real reason.

Set this to 0 instead to mean always retry failed connections.

Change-Id: I9e584f087bd375f71ddf0c70f83205c425094a17
Ref: https://httpd.apache.org/docs/2.4/mod/mod_proxy.html#proxypass
---
 lib/tls | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tls b/lib/tls
index c2c92a1bae..7a7b10454e 100644
--- a/lib/tls
+++ b/lib/tls
@@ -512,7 +512,7 @@ $listen_string
     KeepAlive Off
 
     <Location />
-        ProxyPass http://$b_host:$b_port/ retry=5 nocanon
+        ProxyPass http://$b_host:$b_port/ retry=0 nocanon
         ProxyPassReverse http://$b_host:$b_port/
     </Location>
     ErrorLog $APACHE_LOG_DIR/tls-proxy_error.log

From 604e598e2abca37c84d6cd3c84ad8fa5295fb327 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 13 Apr 2017 13:28:12 -0400
Subject: [PATCH 0913/2409] Install and enable apache uwsgi proxy

The uwsgi proxy version that comes with Ubuntu xenial is too old, so
we have to build it from source. This is a temporary solution until
the next LTS.

This lays the ground work for using it in keystone.

Change-Id: I00fb1759e6988c7df0ce0f3df5ff1ce9fd7cd381
---
 lib/apache | 42 ++++++++++++++++++++++++++++++++++++++++++
 stack.sh   |  3 +++
 2 files changed, 45 insertions(+)

diff --git a/lib/apache b/lib/apache
index fc73b49912..9fed1003a4 100644
--- a/lib/apache
+++ b/lib/apache
@@ -66,6 +66,48 @@ function enable_apache_mod {
     fi
 }
 
+# NOTE(sdague): Install uwsgi including apache module, we need to get
+# to 2.0.6+ to get a working mod_proxy_uwsgi. We can probably build a
+# check for that and do it differently for different platforms.
+function install_apache_uwsgi {
+    local apxs="apxs2"
+    if is_fedora; then
+        apxs="apxs"
+    fi
+
+    # Ubuntu xenial is back level on uwsgi so the proxy doesn't
+    # actually work. Hence we have to build from source for now.
+    #
+    # Centos 7 actually has the module in epel, but there was a big
+    # push to disable epel by default. As such, compile from source
+    # there as well.
+
+    local dir
+    dir=$(mktemp -d)
+    pushd $dir
+    pip_install uwsgi
+    pip download uwsgi -c $REQUIREMENTS_DIR/upper-constraints.txt
+    local uwsgi
+    uwsgi=$(ls uwsgi*)
+    tar xvf $uwsgi
+    cd uwsgi*/apache2
+    sudo $apxs -i -c mod_proxy_uwsgi.c
+    popd
+    # delete the temp directory
+    sudo rm -rf $dir
+
+    if is_ubuntu; then
+        # we've got to enable proxy and proxy_uwsgi for this to work
+        sudo a2enmod proxy
+        sudo a2enmod proxy_uwsgi
+    elif is_fedora; then
+        # redhat is missing a nice way to turn on/off modules
+        echo "LoadModule proxy_uwsgi_module modules/mod_proxy_uwsgi.so" \
+            | sudo tee /etc/httpd/conf.modules.d/02-proxy-uwsgi.conf
+    fi
+    restart_apache_server
+}
+
 # install_apache_wsgi() - Install Apache server and wsgi module
 function install_apache_wsgi {
     # Apache installation, because we mark it NOPRIME
diff --git a/stack.sh b/stack.sh
index 635a328190..e12b3fe06e 100755
--- a/stack.sh
+++ b/stack.sh
@@ -780,6 +780,9 @@ echo_summary "Installing OpenStack project source"
 # Install Oslo libraries
 install_oslo
 
+# Install uwsgi
+install_apache_uwsgi
+
 # Install client libraries
 install_keystoneauth
 install_keystoneclient

From 64ffff9b7d79b9e75616cf43f9f7b31c89026f30 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 13 Apr 2017 13:36:42 -0400
Subject: [PATCH 0914/2409] Convert placement to new uwsgi mode

This converts the placement API to use the new WSGI_MODE variable
(which is not introduced until the next changeset). We do this so that
placement and keystone patches can be reviewed independently, but
there are some hidden coupling of mod_wsgi setup which happens only in
keystone, so if we do keystone first, it breaks placement.

Change-Id: Id5b2c67701bcc7b12c8e3764c7199d10f85df80f
---
 lib/placement | 37 ++++++++++++++++++++++++++++++-------
 1 file changed, 30 insertions(+), 7 deletions(-)

diff --git a/lib/placement b/lib/placement
index a29784b93c..fd09cd8c4e 100644
--- a/lib/placement
+++ b/lib/placement
@@ -32,7 +32,15 @@ set +o xtrace
 PLACEMENT_CONF_DIR=/etc/nova
 PLACEMENT_CONF=$PLACEMENT_CONF_DIR/nova.conf
 PLACEMENT_AUTH_STRATEGY=${PLACEMENT_AUTH_STRATEGY:-placement}
-
+# Nova virtual environment
+if [[ ${USE_VENV} = True ]]; then
+    PROJECT_VENV["nova"]=${NOVA_DIR}.venv
+    PLACEMENT_BIN_DIR=${PROJECT_VENV["nova"]}/bin
+else
+    PLACEMENT_BIN_DIR=$(get_python_exec_prefix)
+fi
+PLACEMENT_UWSGI=$PLACEMENT_BIN_DIR/nova-placement-api
+PLACEMENT_UWSGI_CONF=$PLACEMENT_CONF_DIR/placement-uwsgi.ini
 
 # The placement service can optionally use a separate database
 # connection. Set PLACEMENT_DB_ENABLED to True to use it.
@@ -114,7 +122,13 @@ function configure_placement {
     if [ "$PLACEMENT_DB_ENABLED" != False ]; then
         iniset $PLACEMENT_CONF placement_database connection `database_connection_url placement`
     fi
-    _config_placement_apache_wsgi
+    # TODO(sdague): this really should flag off of something else, but
+    # it won't really work without systemd today.
+    if [[ "$WSGI_MODE" == "uwsgi" ]]; then
+        write_uwsgi_config "$PLACEMENT_UWSGI_CONF" "$PLACEMENT_UWSGI" "/placement"
+    else
+        _config_placement_apache_wsgi
+    fi
 }
 
 # create_placement_accounts() - Set up required placement accounts
@@ -147,9 +161,13 @@ function install_placement {
 
 # start_placement_api() - Start the API processes ahead of other things
 function start_placement_api {
-    enable_apache_site placement-api
-    restart_apache_server
-    tail_log placement-api /var/log/$APACHE_NAME/placement-api.log
+    if [[ "$WSGI_MODE" == "uwsgi" ]]; then
+        run_process "placement-api" "$PLACEMENT_BIN_DIR/uwsgi --ini $PLACEMENT_UWSGI_CONF"
+    else
+        enable_apache_site placement-api
+        restart_apache_server
+        tail_log placement-api /var/log/$APACHE_NAME/placement-api.log
+    fi
 
     echo "Waiting for placement-api to start..."
     if ! wait_for_service $SERVICE_TIMEOUT $PLACEMENT_SERVICE_PROTOCOL://$PLACEMENT_SERVICE_HOST/placement; then
@@ -163,8 +181,13 @@ function start_placement {
 
 # stop_placement() - Disable the api service and stop it.
 function stop_placement {
-    disable_apache_site placement-api
-    restart_apache_server
+    if [[ "$WSGI_MODE" == "uwsgi" ]]; then
+        stop_process "placement-api"
+        remove_uwsgi_config "$PLACEMENT_UWSGI_CONF" "$PLACEMENT_UWSGI"
+    else
+        disable_apache_site placement-api
+        restart_apache_server
+    fi
 }
 
 # Restore xtrace

From 6ed53156b6198e69d59d1cf3a3497e96f5b7a870 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 13 Apr 2017 13:33:16 -0400
Subject: [PATCH 0915/2409] Convert keystone to use uwsgi with the proxy

This makes keystone use the proxy uwsgi module when running in uwsgi
mode. It also introduces a new stackrc variable which is WSGI_MODE
that we can use to control the conditionals in services that current
work with mod_wsgi.

Also update retry timeouts on proxy pass so that workers don't disable
their connections during polling for initial activity.

Change-Id: I46294fb24e3c23fa19fcfd7d6c9ee8a932354702
---
 lib/apache   |  2 +-
 lib/keystone | 56 +++++++++++++++++++++-------------------------------
 openrc       |  4 +---
 stackrc      |  6 ++++++
 4 files changed, 30 insertions(+), 38 deletions(-)

diff --git a/lib/apache b/lib/apache
index 9fed1003a4..20700d802f 100644
--- a/lib/apache
+++ b/lib/apache
@@ -260,7 +260,7 @@ function write_uwsgi_config {
     else
         local apache_conf=""
         apache_conf=$(apache_site_config_for $name)
-        echo "ProxyPass \"${url}\" \"unix:${socket}|uwsgi://uwsgi-uds-${name}/\"" | sudo tee $apache_conf
+        echo "ProxyPass \"${url}\" \"unix:${socket}|uwsgi://uwsgi-uds-${name}/\" retry=0 " | sudo tee $apache_conf
         enable_apache_site $name
         reload_apache_server
     fi
diff --git a/lib/keystone b/lib/keystone
index 45ba2c5352..a26ef8afd2 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -55,21 +55,13 @@ KEYSTONE_ADMIN_UWSGI_CONF=$KEYSTONE_CONF_DIR/keystone-uwsgi-admin.ini
 KEYSTONE_PUBLIC_UWSGI=$KEYSTONE_BIN_DIR/keystone-wsgi-public
 KEYSTONE_ADMIN_UWSGI=$KEYSTONE_BIN_DIR/keystone-wsgi-admin
 
-# Toggle for deploying Keystone under HTTPD + mod_wsgi
-# Deprecated in Mitaka, use KEYSTONE_DEPLOY instead.
-KEYSTONE_USE_MOD_WSGI=${KEYSTONE_USE_MOD_WSGI:-${ENABLE_HTTPD_MOD_WSGI_SERVICES}}
-
 # KEYSTONE_DEPLOY defines how keystone is deployed, allowed values:
 # - mod_wsgi : Run keystone under Apache HTTPd mod_wsgi
 # - uwsgi : Run keystone under uwsgi
-if [ -z "$KEYSTONE_DEPLOY" ]; then
-    if [ -z "$KEYSTONE_USE_MOD_WSGI" ]; then
-        KEYSTONE_DEPLOY=mod_wsgi
-    elif [ "$KEYSTONE_USE_MOD_WSGI" == True ]; then
-        KEYSTONE_DEPLOY=mod_wsgi
-    else
-        KEYSTONE_DEPLOY=uwsgi
-    fi
+if [[ "$WSGI_MODE" == "uwsgi" ]]; then
+    KEYSTONE_DEPLOY=uwsgi
+else
+    KEYSTONE_DEPLOY=mod_wsgi
 fi
 
 # Select the token persistence backend driver
@@ -121,15 +113,8 @@ if is_service_enabled tls-proxy; then
     KEYSTONE_SERVICE_PROTOCOL="https"
 fi
 
-# complete URIs
-if [ "$KEYSTONE_DEPLOY" == "mod_wsgi" ]; then
-    # If running in Apache, use path access rather than port.
-    KEYSTONE_AUTH_URI=${KEYSTONE_AUTH_PROTOCOL}://${KEYSTONE_AUTH_HOST}/identity_admin
-    KEYSTONE_SERVICE_URI=${KEYSTONE_SERVICE_PROTOCOL}://${KEYSTONE_SERVICE_HOST}/identity
-else
-    KEYSTONE_AUTH_URI=${KEYSTONE_AUTH_PROTOCOL}://${KEYSTONE_AUTH_HOST}:${KEYSTONE_AUTH_PORT}
-    KEYSTONE_SERVICE_URI=${KEYSTONE_SERVICE_PROTOCOL}://${KEYSTONE_SERVICE_HOST}:${KEYSTONE_SERVICE_PORT}
-fi
+KEYSTONE_AUTH_URI=${KEYSTONE_AUTH_PROTOCOL}://${KEYSTONE_AUTH_HOST}/identity_admin
+KEYSTONE_SERVICE_URI=${KEYSTONE_SERVICE_PROTOCOL}://${KEYSTONE_SERVICE_HOST}/identity
 
 # V3 URIs
 KEYSTONE_AUTH_URI_V3=$KEYSTONE_AUTH_URI/v3
@@ -155,8 +140,15 @@ function is_keystone_enabled {
 # cleanup_keystone() - Remove residual data files, anything left over from previous
 # runs that a clean run would need to clean up
 function cleanup_keystone {
-    disable_apache_site keystone
-    sudo rm -f $(apache_site_config_for keystone)
+    if [[ "$WSGI_MODE" == "uwsgi" ]]; then
+        remove_uwsgi_config "$KEYSTONE_PUBLIC_UWSGI_CONF" "$KEYSTONE_PUBLIC_UWSGI"
+        remove_uwsgi_config "$KEYSTONE_ADMIN_UWSGI_CONF" "$KEYSTONE_ADMIN_UWSGI"
+        sudo rm -f $(apache_site_config_for keystone-wsgi-public)
+        sudo rm -f $(apache_site_config_for keystone-wsgi-admin)
+    else
+        disable_apache_site keystone
+        sudo rm -f $(apache_site_config_for keystone)
+    fi
 }
 
 # _config_keystone_apache_wsgi() - Set WSGI config files of Keystone
@@ -256,10 +248,8 @@ function configure_keystone {
     # work when you want to use a different port (in the case of proxy), or you
     # don't want the port (in the case of putting keystone on a path in
     # apache).
-    if is_service_enabled tls-proxy || [ "$KEYSTONE_DEPLOY" == "mod_wsgi" ]; then
-        iniset $KEYSTONE_CONF DEFAULT public_endpoint $KEYSTONE_SERVICE_URI
-        iniset $KEYSTONE_CONF DEFAULT admin_endpoint $KEYSTONE_AUTH_URI
-    fi
+    iniset $KEYSTONE_CONF DEFAULT public_endpoint $KEYSTONE_SERVICE_URI
+    iniset $KEYSTONE_CONF DEFAULT admin_endpoint $KEYSTONE_AUTH_URI
 
     if [[ "$KEYSTONE_TOKEN_FORMAT" != "" ]]; then
         iniset $KEYSTONE_CONF token provider $KEYSTONE_TOKEN_FORMAT
@@ -285,9 +275,8 @@ function configure_keystone {
         iniset $KEYSTONE_CONF DEFAULT logging_exception_prefix "%(asctime)s.%(msecs)03d %(process)d TRACE %(name)s %(instance)s"
         _config_keystone_apache_wsgi
     else # uwsgi
-        # iniset creates these files when it's called if they don't exist.
-        write_uwsgi_config "$KEYSTONE_PUBLIC_UWSGI_CONF" "$KEYSTONE_PUBLIC_UWSGI" "/identity" "$KEYSTONE_SERVICE_HOST:$service_port"
-        write_uwsgi_config "$KEYSTONE_ADMIN_UWSGI_CONF" "$KEYSTONE_ADMIN_UWSGI" "/identity_admin" "$KEYSTONE_ADMIN_BIND_HOST:$auth_port"
+        write_uwsgi_config "$KEYSTONE_PUBLIC_UWSGI_CONF" "$KEYSTONE_PUBLIC_UWSGI" "/identity"
+        write_uwsgi_config "$KEYSTONE_ADMIN_UWSGI_CONF" "$KEYSTONE_ADMIN_UWSGI" "/identity_admin"
     fi
 
     iniset $KEYSTONE_CONF DEFAULT max_token_size 16384
@@ -568,10 +557,7 @@ function start_keystone {
     # unencryted traffic at this point.
     # If running in Apache, use the path rather than port.
 
-    local service_uri=$auth_protocol://$KEYSTONE_SERVICE_HOST:$service_port/v$IDENTITY_API_VERSION/
-    if [ "$KEYSTONE_DEPLOY" == "mod_wsgi" ]; then
-        service_uri=$auth_protocol://$KEYSTONE_SERVICE_HOST/identity/v$IDENTITY_API_VERSION/
-    fi
+    local service_uri=$auth_protocol://$KEYSTONE_SERVICE_HOST/identity/v$IDENTITY_API_VERSION/
 
     if ! wait_for_service $SERVICE_TIMEOUT $service_uri; then
         die $LINENO "keystone did not start"
@@ -595,6 +581,8 @@ function stop_keystone {
     else
         stop_process key-p
         stop_process key-a
+        remove_uwsgi_config "$KEYSTONE_PUBLIC_UWSGI_CONF" "$KEYSTONE_PUBLIC_UWSGI"
+        remove_uwsgi_config "$KEYSTONE_ADMIN_UWSGI_CONF" "$KEYSTONE_ADMIN_UWSGI"
     fi
     # Kill the Keystone screen window
     stop_process key
diff --git a/openrc b/openrc
index 483b5af387..4cdb50efef 100644
--- a/openrc
+++ b/openrc
@@ -73,8 +73,6 @@ else
 fi
 
 SERVICE_PROTOCOL=${SERVICE_PROTOCOL:-http}
-KEYSTONE_AUTH_PROTOCOL=${KEYSTONE_AUTH_PROTOCOL:-$SERVICE_PROTOCOL}
-KEYSTONE_AUTH_HOST=${KEYSTONE_AUTH_HOST:-$SERVICE_HOST}
 
 # Identity API version
 export OS_IDENTITY_API_VERSION=${IDENTITY_API_VERSION:-3}
@@ -84,7 +82,7 @@ export OS_IDENTITY_API_VERSION=${IDENTITY_API_VERSION:-3}
 # the user/project has access to - including nova, glance, keystone, swift, ...
 # We currently recommend using the version 3 *identity api*.
 #
-export OS_AUTH_URL=$KEYSTONE_AUTH_PROTOCOL://$KEYSTONE_AUTH_HOST:5000/v${OS_IDENTITY_API_VERSION}
+export OS_AUTH_URL=$KEYSTONE_AUTH_URI
 
 # Currently, in order to use openstackclient with Identity API v3,
 # we need to set the domain which the user and project belong to.
diff --git a/stackrc b/stackrc
index 3ceb78c0d6..adcb9426ea 100644
--- a/stackrc
+++ b/stackrc
@@ -225,6 +225,12 @@ DATABASE_QUERY_LOGGING=$(trueorfalse False DATABASE_QUERY_LOGGING)
 # Zero disables timeouts
 GIT_TIMEOUT=${GIT_TIMEOUT:-0}
 
+# How should we be handling WSGI deployments. By default we're going
+# to allow for 2 modes, which is "uwsgi" which runs with an apache
+# proxy uwsgi in front of it, or "mod_wsgi", which runs in
+# apache. mod_wsgi is deprecated, don't use it.
+WSGI_MODE=${WSGI_MODE:-"uwsgi"}
+
 # Repositories
 # ------------
 

From 921da2654bfece3d5352d42e8f92b57cac21b9cd Mon Sep 17 00:00:00 2001
From: Prabhuraj Kamaraj <k.prabhuraj@ericsson.com>
Date: Tue, 18 Apr 2017 05:11:52 +0000
Subject: [PATCH 0916/2409] Adding placement-client to compute node local.conf
 for multinode setup

Change-Id: Ie98f908d5a932da259ae13934af45d535fcffb82
Closes-Bug: #1682362
---
 doc/source/guides/multinode-lab.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
index 484ebba571..1a8ddbc194 100644
--- a/doc/source/guides/multinode-lab.rst
+++ b/doc/source/guides/multinode-lab.rst
@@ -175,7 +175,7 @@ machines, create a ``local.conf`` with:
     MYSQL_HOST=$SERVICE_HOST
     RABBIT_HOST=$SERVICE_HOST
     GLANCE_HOSTPORT=$SERVICE_HOST:9292
-    ENABLED_SERVICES=n-cpu,q-agt,n-api-meta,c-vol
+    ENABLED_SERVICES=n-cpu,q-agt,n-api-meta,c-vol,placement-client
     NOVA_VNC_ENABLED=True
     NOVNCPROXY_URL="http://$SERVICE_HOST:6080/vnc_auto.html"
     VNCSERVER_LISTEN=$HOST_IP

From e0be9e3a2e527754a72d6282883370c09159fac1 Mon Sep 17 00:00:00 2001
From: Chris Dent <cdent@anticdent.org>
Date: Tue, 18 Apr 2017 16:52:25 +0100
Subject: [PATCH 0917/2409] Remove a TODO that no longer applies

The removed TODO was talking about USE_SYSTEMD, not WSGI_MODE.

WSGI_MODE makes sense, so the TODO has been done.

Change-Id: Ib574ef123ea4c82d4d88012c990cd1ad660d7879
---
 lib/placement | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/lib/placement b/lib/placement
index fd09cd8c4e..4755a58bf2 100644
--- a/lib/placement
+++ b/lib/placement
@@ -122,8 +122,7 @@ function configure_placement {
     if [ "$PLACEMENT_DB_ENABLED" != False ]; then
         iniset $PLACEMENT_CONF placement_database connection `database_connection_url placement`
     fi
-    # TODO(sdague): this really should flag off of something else, but
-    # it won't really work without systemd today.
+
     if [[ "$WSGI_MODE" == "uwsgi" ]]; then
         write_uwsgi_config "$PLACEMENT_UWSGI_CONF" "$PLACEMENT_UWSGI" "/placement"
     else

From 2fcdaac56e20f1002ae76c6ae1b30a093452d21b Mon Sep 17 00:00:00 2001
From: Chris Dent <cdent@anticdent.org>
Date: Tue, 18 Apr 2017 16:54:12 +0100
Subject: [PATCH 0918/2409] Make a2dissite fail softly if the site is not
 enabled

a2dissite will return a non-zero error code if the site that is being
disabled is not currently enabled (that is, if the conf file for it does
not exist). This can happen during development if you've been messing
with files by hand. Rather than exploding out of a ./stack.sh, accept
the missing file as meaning "it's disabled" and carry one. The rpm
version of disable, which does not use a2dissite, does this already.

Change-Id: Ie5dfd42efdff4bdba5ffaa765af000dd8e1d596e
---
 lib/apache | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/apache b/lib/apache
index 20700d802f..f88f1d3504 100644
--- a/lib/apache
+++ b/lib/apache
@@ -186,7 +186,7 @@ function enable_apache_site {
 function disable_apache_site {
     local site=$@
     if is_ubuntu; then
-        sudo a2dissite ${site}
+        sudo a2dissite ${site} || true
     elif is_fedora || is_suse; then
         local enabled_site_file="$APACHE_CONF_DIR/${site}.conf"
         # Do nothing if no site config exists

From 0effa1a6cb6960b0d1cf82087e6d60c066b7a5f6 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 18 Apr 2017 15:16:37 -0400
Subject: [PATCH 0919/2409] remove some unused *_PROTOCOL from export

Things like SERVICE_PROTOCOL and KEYSTONE_AUTH_PROTOCOL shouldn't
really be exported in openrc as they encourage using them directly to
build up keystone urls instead of actually using the OS_AUTH_URL.

Remove them.

Change-Id: I4b7cc680f7f14dae29b706a227be540c9e212cad
---
 functions-common | 4 ++--
 openrc           | 2 --
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/functions-common b/functions-common
index 90c92000b3..56dd20307f 100644
--- a/functions-common
+++ b/functions-common
@@ -48,8 +48,8 @@ TRACK_DEPENDS=${TRACK_DEPENDS:-False}
 
 # Save these variables to .stackenv
 STACK_ENV_VARS="BASE_SQL_CONN DATA_DIR DEST ENABLED_SERVICES HOST_IP \
-    KEYSTONE_AUTH_PROTOCOL KEYSTONE_AUTH_URI KEYSTONE_SERVICE_URI \
-    LOGFILE OS_CACERT SERVICE_HOST SERVICE_PROTOCOL STACK_USER TLS_IP \
+    KEYSTONE_AUTH_URI KEYSTONE_SERVICE_URI \
+    LOGFILE OS_CACERT SERVICE_HOST STACK_USER TLS_IP \
     HOST_IPV6 SERVICE_IP_VERSION"
 
 
diff --git a/openrc b/openrc
index 4cdb50efef..828cab3c6d 100644
--- a/openrc
+++ b/openrc
@@ -72,8 +72,6 @@ else
     GLANCE_HOST=${GLANCE_HOST:-$HOST_IP}
 fi
 
-SERVICE_PROTOCOL=${SERVICE_PROTOCOL:-http}
-
 # Identity API version
 export OS_IDENTITY_API_VERSION=${IDENTITY_API_VERSION:-3}
 

From f43ea4776668e259b3053e0c1d4b7d13685f424d Mon Sep 17 00:00:00 2001
From: Tim Burke <tim.burke@gmail.com>
Date: Tue, 18 Apr 2017 21:51:57 -0700
Subject: [PATCH 0920/2409] Send useful auth_port and auth_prefix to swift's
 test.conf

Until we can test with a version of swiftclient that knows how to eat
auth_uri, swift still needs a working gate.

Change-Id: I09f9ad5c87b542df962a79898e06fbf1e968b1e3
Related-Change: I46294fb24e3c23fa19fcfd7d6c9ee8a932354702
Related-Change: Ie427f3b0b9eb834ff940fa5d52444a5a6cdcab15
---
 lib/swift | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/lib/swift b/lib/swift
index d764b25fdb..8b75fcc505 100644
--- a/lib/swift
+++ b/lib/swift
@@ -530,12 +530,16 @@ EOF
         local auth_vers
         auth_vers=$(iniget ${testfile} func_test auth_version)
         iniset ${testfile} func_test auth_host ${KEYSTONE_SERVICE_HOST}
-        iniset ${testfile} func_test auth_port ${KEYSTONE_AUTH_PORT}
+        if [[ "$KEYSTONE_AUTH_PROTOCOL" == "https" ]]; then
+            iniset ${testfile} func_test auth_port 443
+        else
+            iniset ${testfile} func_test auth_port 80
+        fi
         iniset ${testfile} func_test auth_uri ${KEYSTONE_AUTH_URI}
-        if [[ $auth_vers == "3" ]]; then
-            iniset ${testfile} func_test auth_prefix /v3/
+        if [[ "$auth_vers" == "3" ]]; then
+            iniset ${testfile} func_test auth_prefix /identity/v3/
         else
-            iniset ${testfile} func_test auth_prefix /v2.0/
+            iniset ${testfile} func_test auth_prefix /identity/v2.0/
         fi
     fi
 

From 09a08aacf4235b673de948278aa3cbfdc6cbbdc0 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Wed, 19 Apr 2017 09:24:43 +0000
Subject: [PATCH 0921/2409] Updated from generate-devstack-plugins-list

Change-Id: If6c07fd6b56d776a5548564b72e637f6bd3dfbfc
---
 doc/source/plugin-registry.rst | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index beb6abbb9e..96a2733690 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -44,6 +44,7 @@ devstack-plugin-additional-pkg-repos   `git://git.openstack.org/openstack/devsta
 devstack-plugin-amqp1                  `git://git.openstack.org/openstack/devstack-plugin-amqp1 <https://git.openstack.org/cgit/openstack/devstack-plugin-amqp1>`__
 devstack-plugin-bdd                    `git://git.openstack.org/openstack/devstack-plugin-bdd <https://git.openstack.org/cgit/openstack/devstack-plugin-bdd>`__
 devstack-plugin-ceph                   `git://git.openstack.org/openstack/devstack-plugin-ceph <https://git.openstack.org/cgit/openstack/devstack-plugin-ceph>`__
+devstack-plugin-container              `git://git.openstack.org/openstack/devstack-plugin-container <https://git.openstack.org/cgit/openstack/devstack-plugin-container>`__
 devstack-plugin-glusterfs              `git://git.openstack.org/openstack/devstack-plugin-glusterfs <https://git.openstack.org/cgit/openstack/devstack-plugin-glusterfs>`__
 devstack-plugin-hdfs                   `git://git.openstack.org/openstack/devstack-plugin-hdfs <https://git.openstack.org/cgit/openstack/devstack-plugin-hdfs>`__
 devstack-plugin-kafka                  `git://git.openstack.org/openstack/devstack-plugin-kafka <https://git.openstack.org/cgit/openstack/devstack-plugin-kafka>`__
@@ -86,6 +87,7 @@ meteos-ui                              `git://git.openstack.org/openstack/meteos
 mistral                                `git://git.openstack.org/openstack/mistral <https://git.openstack.org/cgit/openstack/mistral>`__
 mixmatch                               `git://git.openstack.org/openstack/mixmatch <https://git.openstack.org/cgit/openstack/mixmatch>`__
 mogan                                  `git://git.openstack.org/openstack/mogan <https://git.openstack.org/cgit/openstack/mogan>`__
+mogan-ui                               `git://git.openstack.org/openstack/mogan-ui <https://git.openstack.org/cgit/openstack/mogan-ui>`__
 monasca-analytics                      `git://git.openstack.org/openstack/monasca-analytics <https://git.openstack.org/cgit/openstack/monasca-analytics>`__
 monasca-api                            `git://git.openstack.org/openstack/monasca-api <https://git.openstack.org/cgit/openstack/monasca-api>`__
 monasca-ceilometer                     `git://git.openstack.org/openstack/monasca-ceilometer <https://git.openstack.org/cgit/openstack/monasca-ceilometer>`__

From 37c7843aad745fcde7584777e8a7ec896bb154e2 Mon Sep 17 00:00:00 2001
From: Paul Belanger <pabelanger@redhat.com>
Date: Wed, 19 Apr 2017 13:19:21 -0400
Subject: [PATCH 0922/2409] Increase rsyslog buffer sizes.

Swift proxy logs to syslog during the devstack-gate tempest runs. To
better capture the swift logs increase the rsyslog buffer size to 6k
bytes allowing for longer messages like tracebacks.

This was setup by openstack-infra previous during our diskimage
builds.

  I03e42964e14d9f930c07ed047851bdf775639c59

Change-Id: Iaa232335865410600c93f47d4777ed4f1bce08e2
Signed-off-by: Paul Belanger <pabelanger@redhat.com>
---
 lib/swift | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/swift b/lib/swift
index 8b75fcc505..16f398a613 100644
--- a/lib/swift
+++ b/lib/swift
@@ -554,6 +554,7 @@ EOF
     if [[ $SYSLOG != "False" ]]; then
         sed "s,%SWIFT_LOGDIR%,${swift_log_dir}," $FILES/swift/rsyslog.conf | sudo \
             tee /etc/rsyslog.d/10-swift.conf
+        echo "MaxMessageSize 6k" | sudo tee /etc/rsyslog.d/99-maxsize.conf
         # restart syslog to take the changes
         sudo killall -HUP rsyslogd
     fi

From 1b245cef7f078139f95260b080558422063f363f Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 19 Apr 2017 15:51:52 -0400
Subject: [PATCH 0923/2409] Cleanup duplicate get_or_add_user_domain_role

It turns out that we ended up with duplicate versions of this function
merging on top of each other within 3 days, and gerrit didn't catch
it. Boo gerrit. Boo bash.

Change-Id: Ic6aa2f9bafdec906de2bc51d5929beeec48a6a40
---
 functions-common | 28 ----------------------------
 1 file changed, 28 deletions(-)

diff --git a/functions-common b/functions-common
index 90c92000b3..35b48603c5 100644
--- a/functions-common
+++ b/functions-common
@@ -905,34 +905,6 @@ function get_or_add_user_domain_role {
     echo $user_role_id
 }
 
-# Gets or adds user role to domain
-# Usage: get_or_add_user_domain_role <role> <user> <domain>
-function get_or_add_user_domain_role {
-    local user_role_id
-    # Gets user role id
-    user_role_id=$(openstack role assignment list \
-        --user $2 \
-        --os-url=$KEYSTONE_SERVICE_URI_V3 \
-        --os-identity-api-version=3 \
-        --domain $3 \
-        | grep " $1 " | get_field 1)
-    if [[ -z "$user_role_id" ]]; then
-        # Adds role to user and get it
-        openstack role add $1 \
-            --user $2 \
-            --domain $3 \
-            --os-url=$KEYSTONE_SERVICE_URI_V3 \
-            --os-identity-api-version=3
-        user_role_id=$(openstack role assignment list \
-            --user $2 \
-            --os-url=$KEYSTONE_SERVICE_URI_V3 \
-            --os-identity-api-version=3 \
-            --domain $3 \
-            | grep " $1 " | get_field 1)
-    fi
-    echo $user_role_id
-}
-
 # Gets or adds group role to project
 # Usage: get_or_add_group_project_role <role> <group> <project>
 function get_or_add_group_project_role {

From 9bfabc68c4ff2094ed8463b11382d6982743b768 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 20 Apr 2017 15:11:43 -0400
Subject: [PATCH 0924/2409] Make openrc more robust for grenade scenarios

This makes openrc more robust for the grenade scenarios by having a
sane fallback when stackrc is not found.

Change-Id: I297ba519d581d2b6fb4d80d59434acace054bada
---
 openrc | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/openrc b/openrc
index 4cdb50efef..b748055be1 100644
--- a/openrc
+++ b/openrc
@@ -82,7 +82,12 @@ export OS_IDENTITY_API_VERSION=${IDENTITY_API_VERSION:-3}
 # the user/project has access to - including nova, glance, keystone, swift, ...
 # We currently recommend using the version 3 *identity api*.
 #
-export OS_AUTH_URL=$KEYSTONE_AUTH_URI
+
+# If you don't have a working .stackenv, this is the backup possition
+KEYSTONE_BACKUP=$SERVICE_PROTOCOL://$SERVICE_HOST:5000
+KEYSTONE_AUTH_URI=${KEYSTONE_AUTH_URI:-$KEYSTONE_BACKUP}
+
+export OS_AUTH_URL=${OS_AUTH_URL:-$KEYSTONE_AUTH_URI}
 
 # Currently, in order to use openstackclient with Identity API v3,
 # we need to set the domain which the user and project belong to.

From ef1e88ec09bda30cad19589629744b59e12b4093 Mon Sep 17 00:00:00 2001
From: Andrea Frittoli <andrea.frittoli@gmail.com>
Date: Thu, 20 Apr 2017 23:37:32 +0100
Subject: [PATCH 0925/2409] Enable ssh validation by default

The -ssh job with ssh validation enabled has been quite stable
for a while now [0] so I think it's time to add ssh validation
to the integration gate to prevent regressions from lurking in.

Doing this in devstack ensures that the change only affects
master as we didn't test ssh validation on on stable branches.

[0] http://status.openstack.org/openstack-health/#/g/build_name/gate-tempest-dsvm-neutron-full-ssh?duration=P3M

Change-Id: I187e560911f5d5d482eb7959e5174068c4c9a801
---
 lib/tempest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index cf7eb6f722..1640f2c21a 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -425,7 +425,7 @@ function configure_tempest {
         TEMPEST_SSH_NETWORK_NAME=$PHYSICAL_NETWORK
     fi
     # Validation
-    iniset $TEMPEST_CONFIG validation run_validation ${TEMPEST_RUN_VALIDATION:-False}
+    iniset $TEMPEST_CONFIG validation run_validation ${TEMPEST_RUN_VALIDATION:-True}
     iniset $TEMPEST_CONFIG validation ip_version_for_ssh 4
     iniset $TEMPEST_CONFIG validation ssh_timeout $BUILD_TIMEOUT
     iniset $TEMPEST_CONFIG validation image_ssh_user ${DEFAULT_INSTANCE_USER:-cirros}

From aa26baacb8206967d61aef74686be94e3f8c90b8 Mon Sep 17 00:00:00 2001
From: rabi <ramishra@redhat.com>
Date: Thu, 20 Apr 2017 10:55:16 +0530
Subject: [PATCH 0926/2409] Create custom dir for uwsgi domain sockets

On Centos, apache has a private view of /tmp and thus can't see this
socket, causing keystone to fail. This happened after
I46294fb24e3c23fa19fcfd7d6c9ee8a932354702.

Move it to /var/run.

Closes-Bug: #1684360
Change-Id: I47f091656802719c259752454ec88bf50760b967
---
 lib/apache | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/lib/apache b/lib/apache
index f88f1d3504..afeac158ca 100644
--- a/lib/apache
+++ b/lib/apache
@@ -230,7 +230,12 @@ function write_uwsgi_config {
     local http=$4
     local name=""
     name=$(basename $wsgi)
-    local socket="/tmp/${name}.socket"
+
+    # create a home for the sockets; note don't use /tmp -- apache has
+    # a private view of it on some platforms.
+    local socket_dir='/var/run/uwsgi'
+    sudo install -d -o $STACK_USER -m 755 $socket_dir
+    local socket="$socket_dir/${name}.socket"
 
     # always cleanup given that we are using iniset here
     rm -rf $file

From 26e431dbd76dff958f65871c852eb9d61d8d00d8 Mon Sep 17 00:00:00 2001
From: Thomas Herve <therve@redhat.com>
Date: Thu, 13 Apr 2017 14:27:35 +0200
Subject: [PATCH 0927/2409] Define a new function for notifications URL

This defines a new function get_notification_url, which returns the URL
of RabbitMQ when you want connect to it, and uses in
ceilometermiddleware. This fixes an issue when we try to use AMQP for
RPC, but not for notifications.

Change-Id: I14450b2440806a17a90e5ddefc243868fdbe4f2c
---
 lib/rpc_backend | 9 +++++++++
 lib/swift       | 2 +-
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/lib/rpc_backend b/lib/rpc_backend
index 3c1404e998..3177e88ef2 100644
--- a/lib/rpc_backend
+++ b/lib/rpc_backend
@@ -122,6 +122,15 @@ function get_transport_url {
     fi
 }
 
+# Repeat the definition, in case get_transport_url is overriden for RPC purpose.
+# get_notification_url can then be used to talk to rabbit for notifications.
+function get_notification_url {
+    local virtual_host=$1
+    if is_service_enabled rabbit || { [ -n "$RABBIT_HOST" ] && [ -n "$RABBIT_PASSWORD" ]; }; then
+        echo "rabbit://$RABBIT_USERID:$RABBIT_PASSWORD@$RABBIT_HOST:5672/$virtual_host"
+    fi
+}
+
 # iniset configuration
 function iniset_rpc_backend {
     local package=$1
diff --git a/lib/swift b/lib/swift
index 96e2f03e5f..f3ff2412bd 100644
--- a/lib/swift
+++ b/lib/swift
@@ -419,7 +419,7 @@ function configure_swift {
         iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:ceilometer "set log_level" "WARN"
         iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:ceilometer paste.filter_factory "ceilometermiddleware.swift:filter_factory"
         iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:ceilometer control_exchange "swift"
-        iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:ceilometer url $(get_transport_url)
+        iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:ceilometer url $(get_notification_url)
         iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:ceilometer driver "messaging"
         iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:ceilometer topic "notifications"
         SWIFT_EXTRAS_MIDDLEWARE_LAST="${SWIFT_EXTRAS_MIDDLEWARE_LAST} ceilometer"

From f6a2d2cd4edd06408690081d6207ff73b76f543a Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Wed, 26 Apr 2017 10:50:29 +1000
Subject: [PATCH 0928/2409] Always restart apache

As described in [1], it seems that mod_wsgi is not "graceful" reload
safe.  Upon re-init, it can end up in a segfault loop.

The "reload" (not *restart*) after setting up uwsgi was added with
I1d89be1f1b36f26eaf543b99bde6fdc5701474fe but not causing an issue
until uwsgi was enabled.

We do not notice in the gate, because the TLS setup ends up doing a
restart after this setup.  In the period between the
write_uwsgi_config and that restart, Apache is sitting in a segfault
loop, but we never noticed because we don't try talking to it.  Other
jobs that don't do any further apache configuration have started
failing, however.

Looking at the original comments around "reload_apache_server" I'm not
sure if it is still necessary.  [2] shows it is not used outside these
two calls.

[1] https://bugzilla.redhat.com/show_bug.cgi?id=1445540
[2] http://codesearch.openstack.org/?q=reload_apache_server&i=nope&files=&repos=

Closes-Bug: #1686210
Change-Id: I5234bae0595efdcd30305a32bf9c121072a3625e
---
 lib/apache | 7 +------
 lib/tls    | 7 +------
 2 files changed, 2 insertions(+), 12 deletions(-)

diff --git a/lib/apache b/lib/apache
index afeac158ca..34ac660266 100644
--- a/lib/apache
+++ b/lib/apache
@@ -218,11 +218,6 @@ function restart_apache_server {
     restart_service $APACHE_NAME
 }
 
-# reload_apache_server
-function reload_apache_server {
-    reload_service $APACHE_NAME
-}
-
 function write_uwsgi_config {
     local file=$1
     local wsgi=$2
@@ -267,7 +262,7 @@ function write_uwsgi_config {
         apache_conf=$(apache_site_config_for $name)
         echo "ProxyPass \"${url}\" \"unix:${socket}|uwsgi://uwsgi-uds-${name}/\" retry=0 " | sudo tee $apache_conf
         enable_apache_site $name
-        reload_apache_server
+        restart_apache_server
     fi
 }
 
diff --git a/lib/tls b/lib/tls
index 7a7b10454e..238687c5dd 100644
--- a/lib/tls
+++ b/lib/tls
@@ -526,12 +526,7 @@ EOF
         enable_apache_mod $mod
     done
     enable_apache_site $b_service
-    # Only a reload is required to pull in new vhosts
-    # Note that a restart reliably fails on centos7 and trusty
-    # because apache can't open port 80 because the old apache
-    # still has it open. Using reload fixes trusty but centos7
-    # still doesn't work.
-    reload_apache_server
+    restart_apache_server
 }
 
 # Follow TLS proxy

From 92e6b1a0e83cbfeeb1d29bbe2b8c71e212f885fd Mon Sep 17 00:00:00 2001
From: Andreas Scheuring <andreas.scheuring@de.ibm.com>
Date: Wed, 26 Apr 2017 13:40:42 +0200
Subject: [PATCH 0929/2409] default gateway regex: use exact match for iface
 name

If the current interface has a default gateway configured is
determined by the regex

  default.+<interface-name>

If for example 'enc1' is used, but also an interface 'enc1800' is
present, the regex will also match the 'enc1800' default gateway.

This patch fixes this by looking for <interface-name><white-space>.
This way 'enc1800' is not matched.

Change-Id: Id1d58f5be6296c3a37aef788359ae8fe0fe11d8b
---
 lib/neutron-legacy | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 1dfd5fec7d..a409164386 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -570,7 +570,7 @@ function _move_neutron_addresses_route {
         local IP_DEL=""
         local IP_UP=""
         local DEFAULT_ROUTE_GW
-        DEFAULT_ROUTE_GW=$(ip -f $af r | awk "/default.+$from_intf/ { print \$3; exit }")
+        DEFAULT_ROUTE_GW=$(ip -f $af r | awk "/default.+$from_intf\s/ { print \$3; exit }")
         local ADD_OVS_PORT=""
         local DEL_OVS_PORT=""
         local ARP_CMD=""

From befe0925e7cb3d3b34ee9e856c4bc822a499975f Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Thu, 16 Feb 2017 15:45:11 -0500
Subject: [PATCH 0930/2409] Differentiate between DEFAULT_IMAGE_NAME and
 filename

The DEFAULT_IMAGE_NAME variable is used to reference the name of the
default image in glance after it has been uploaded by devstack. It is
used both inside and outside of devstack for that purpose. However, when
configuring tempest there are some tests which also do image uploads and
need a filename for specifying which file they should upload into glance
for testing purposes. Previously we were just using DEFAULT_IMAGE_NAME
for both purposes, but this causes a conflict if the name of the image
we upload into glance does not have a file extension. So instead of
conflating the things this commit differentiates between them and adds a
new DEFAULT_IMAGE_FILE_NAME variable to use for this purpose.

Change-Id: Icf74badcf2093d8c75db538232b10b3ac7b86eb8
---
 lib/tempest |  3 ++-
 stackrc     | 12 ++++++++----
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 128e9728fe..69a2500a5d 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -11,6 +11,7 @@
 #   - ``DEST``, ``FILES``
 #   - ``ADMIN_PASSWORD``
 #   - ``DEFAULT_IMAGE_NAME``
+#   - ``DEFAULT_IMAGE_FILE_NAME``
 #   - ``S3_SERVICE_PORT``
 #   - ``SERVICE_HOST``
 #   - ``BASE_SQL_CONN`` ``lib/database`` declares
@@ -412,7 +413,7 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG scenario img_container_format ovf
     else
         SCENARIO_IMAGE_DIR=${SCENARIO_IMAGE_DIR:-$FILES}
-        SCENARIO_IMAGE_FILE=$DEFAULT_IMAGE_NAME
+        SCENARIO_IMAGE_FILE=$DEFAULT_IMAGE_FILE_NAME
     fi
     iniset $TEMPEST_CONFIG scenario img_dir $SCENARIO_IMAGE_DIR
     iniset $TEMPEST_CONFIG scenario img_file $SCENARIO_IMAGE_FILE
diff --git a/stackrc b/stackrc
index 97819d712b..399e45ee28 100644
--- a/stackrc
+++ b/stackrc
@@ -640,17 +640,21 @@ if [[ "$DOWNLOAD_DEFAULT_IMAGES" == "True" ]]; then
             case "$LIBVIRT_TYPE" in
                 lxc) # the cirros root disk in the uec tarball is empty, so it will not work for lxc
                     DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-rootfs}
-                    IMAGE_URLS+="http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-rootfs.img.gz";;
+                    DEFAULT_IMAGE_FILE_NAME=${DEFAULT_IMAGE_FILE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-rootfs.img.gz}
+                    IMAGE_URLS+="http://download.cirros-cloud.net/${CIRROS_VERSION}/${DEFAULT_IMAGE_FILE_NAME}";;
                 *) # otherwise, use the qcow image
-                    DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img}
-                    IMAGE_URLS+="http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img";;
+                    DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk}
+                    DEFAULT_IMAGE_FILE_NAME=${DEFAULT_IMAGE_FILE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img}
+                    IMAGE_URLS+="http://download.cirros-cloud.net/${CIRROS_VERSION}/${DEFAULT_IMAGE_FILE_NAME}";;
                 esac
             ;;
         vsphere)
             DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-0.3.2-i386-disk.vmdk}
-            IMAGE_URLS+="http://partnerweb.vmware.com/programs/vmdkimage/cirros-0.3.2-i386-disk.vmdk";;
+            DEFAULT_IMAGE_FILE_NAME=${DEFAULT_IMAGE_FILE_NAME:-$DEFAULT_IMAGE_NAME}
+            IMAGE_URLS+="http://partnerweb.vmware.com/programs/vmdkimage/${DEFAULT_IMAGE_FILE_NAME}";;
         xenserver)
             DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-0.3.4-x86_64-disk}
+            DEFAULT_IMAGE_FILE_NAME=${DEFAULT_IMAGE_NAME:-cirros-0.3.4-x86_64-disk.vhd.tgz}
             IMAGE_URLS+="http://ca.downloads.xensource.com/OpenStack/cirros-0.3.4-x86_64-disk.vhd.tgz"
             IMAGE_URLS+=",http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-x86_64-uec.tar.gz";;
     esac

From 71d20e6582e07a4567abc785e7237872574b6ac8 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 21 Apr 2017 11:48:12 +1000
Subject: [PATCH 0931/2409] Always disable use of libvirt wheel with UCA

It's not only using our upstream caches that you might get an old
libvirt-python wheel that is incompatible with UCA.  Move the ignore
out of the mirror check to apply it globally.

This is an alternative to Iba301a8c80c9ed584f5fb5a816f3d2cf5f5f0e77

Change-Id: I588b1e8e49aa60f3ce976dc1b6c8013ba1d88079
---
 tools/fixup_stuff.sh | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index f3ba702a3b..d07d2675c6 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -82,15 +82,17 @@ if [[ "$DISTRO" = "xenial" ]]; then
         source /etc/ci/mirror_info.sh
 
         sudo apt-add-repository -y "deb $NODEPOOL_UCA_MIRROR xenial-updates/ocata main"
-
-        # Disable use of libvirt wheel here as presence of mirror implies
-        # presence of cached wheel build against older libvirt binary.
-        # TODO(clarkb) figure out how to use wheel again.
-        sudo bash -c 'echo "no-binary = libvirt-python" >> /etc/pip.conf'
     else
         # Otherwise use upstream UCA
         sudo add-apt-repository -y cloud-archive:ocata
     fi
+
+    # Disable use of libvirt wheel since a cached wheel build might be
+    # against older libvirt binary.  Particularly a problem if using
+    # the openstack wheel mirrors, but can hit locally too.
+    # TODO(clarkb) figure out how to use upstream wheel again.
+    iniset -sudo /etc/pip.conf "global" "no-binary" "libvirt-python"
+
     # Force update our APT repos, since we added UCA above.
     REPOS_UPDATED=False
     apt_get_update

From a881b887211a6bc9ce24a9b42400dffe88abdb67 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Wed, 19 Apr 2017 15:42:34 +1000
Subject: [PATCH 0932/2409] Switch to lioadm for centos cinder

Centos/RHEL 7 doesn't support tgtd.  While the packages are still in
EPEL, there's no point in testing because nobody runs like this.
Switch cinder to use lioadm which uses LIO, and update package
installations.

Depends-On: I964917d13d9415223845ac17eb804ee7faceaf6f
Change-Id: Idc5a4e856bfc93e9dc650d565a98a8e9b3df3481
---
 files/rpms/cinder |  3 ++-
 lib/cinder        | 21 ++++++++++++++-------
 2 files changed, 16 insertions(+), 8 deletions(-)

diff --git a/files/rpms/cinder b/files/rpms/cinder
index 0274642fd6..2c7b45baaf 100644
--- a/files/rpms/cinder
+++ b/files/rpms/cinder
@@ -1,4 +1,5 @@
 iscsi-initiator-utils
 lvm2
 qemu-img
-scsi-target-utils # NOPRIME
+scsi-target-utils # not:rhel7,f24,f25 NOPRIME
+targetcli # dist:rhel7,f24,f25 NOPRIME
\ No newline at end of file
diff --git a/lib/cinder b/lib/cinder
index 9fc25c75bb..3c182ccb26 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -109,7 +109,16 @@ CINDER_VOLUME_CLEAR=$(echo ${CINDER_VOLUME_CLEAR} | tr '[:upper:]' '[:lower:]')
 # https://bugs.launchpad.net/cinder/+bug/1180976
 CINDER_PERIODIC_INTERVAL=${CINDER_PERIODIC_INTERVAL:-60}
 
-CINDER_ISCSI_HELPER=${CINDER_ISCSI_HELPER:-tgtadm}
+# Centos7 switched to using LIO and that's all that's supported,
+# although the tgt bits are in EPEL we don't want that for CI
+if is_fedora; then
+    CINDER_ISCSI_HELPER=${CINDER_ISCSI_HELPER:-lioadm}
+    if [[ ${CINDER_ISCSI_HELPER} != "lioadm" ]]; then
+        die "lioadm is the only valid Cinder iscsi_helper config on this platform"
+    fi
+else
+    CINDER_ISCSI_HELPER=${CINDER_ISCSI_HELPER:-tgtadm}
+fi
 
 # Toggle for deploying Cinder under HTTPD + mod_wsgi
 CINDER_USE_MOD_WSGI=${CINDER_USE_MOD_WSGI:-False}
@@ -443,12 +452,10 @@ function init_cinder {
 function install_cinder {
     git_clone $CINDER_REPO $CINDER_DIR $CINDER_BRANCH
     setup_develop $CINDER_DIR
-    if [ "$CINDER_ISCSI_HELPER" = "tgtadm" ]; then
-        if is_fedora; then
-            install_package scsi-target-utils
-        else
-            install_package tgt
-        fi
+    if [[ "$CINDER_ISCSI_HELPER" == "tgtadm" ]]; then
+        install_package tgt
+    elif [[ "$CINDER_ISCI_HELPER" == "lioadm" ]]; then
+        install_package targetcli
     fi
 
     if [ "$CINDER_USE_MOD_WSGI" == "True" ]; then

From bc6c992e3c5cf7ae48e64203cc83cb7665c5050e Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Thu, 27 Apr 2017 16:07:51 +1000
Subject: [PATCH 0933/2409] Remove fping requirement

The os-fping API was deprecated in nova in
I92064cbcb5f6414da0c9d294f912a860428af698.  I can't see anything
obviously using it on codesearch.

This is only in EPEL for centos, which I'm trying to remove.  But I
think less dependencies is always better than more in general hence
the removal.

This is essentially a revert of
Ibdc7479a9038321e4fc3953774a6f3e1dac90530

Change-Id: I163fc48c860bae2a92c83cfdaed26b2e54630e20
---
 files/debs/n-api      | 1 -
 files/rpms-suse/n-api | 1 -
 files/rpms/n-api      | 1 -
 3 files changed, 3 deletions(-)
 delete mode 100644 files/debs/n-api
 delete mode 100644 files/rpms/n-api

diff --git a/files/debs/n-api b/files/debs/n-api
deleted file mode 100644
index 0928cd56b9..0000000000
--- a/files/debs/n-api
+++ /dev/null
@@ -1 +0,0 @@
-fping
diff --git a/files/rpms-suse/n-api b/files/rpms-suse/n-api
index af5ac2fc54..0f08daace3 100644
--- a/files/rpms-suse/n-api
+++ b/files/rpms-suse/n-api
@@ -1,2 +1 @@
-fping
 python-dateutil
diff --git a/files/rpms/n-api b/files/rpms/n-api
deleted file mode 100644
index 0928cd56b9..0000000000
--- a/files/rpms/n-api
+++ /dev/null
@@ -1 +0,0 @@
-fping

From faffde1f970c0786d0256e4d51725fbe2ceda063 Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Thu, 27 Apr 2017 09:54:27 -0700
Subject: [PATCH 0934/2409] Use string cert CA defaults

Switch from sha1 to sha256 and from 1024 bits to 2048 bits. Do this
because things don't like the old inseucre sha1+1024bits combo.

Change-Id: Iae2958969aed0cd880844e19e8055c8bdc7d064d
---
 lib/tls | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/tls b/lib/tls
index 238687c5dd..7c6b967bc4 100644
--- a/lib/tls
+++ b/lib/tls
@@ -113,11 +113,11 @@ new_certs_dir           = \$dir/newcerts
 certificate             = \$dir/cacert.pem
 private_key             = \$dir/private/cacert.key
 RANDFILE                = \$dir/private/.rand
-default_md              = default
+default_md              = sha256
 
 [ req ]
-default_bits            = 1024
-default_md              = sha1
+default_bits            = 2048
+default_md              = sha256
 
 prompt                  = no
 distinguished_name      = ca_distinguished_name

From e43f60ba2a3a227918e5fdb652a0adc2643f618d Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Thu, 27 Apr 2017 18:27:36 -0500
Subject: [PATCH 0935/2409] Use the proper keystone endpoints in clouds.yaml

KEYSTONE_SERVICE_API is the keystone endpoint and it is what we should
use. The admin url should DIAF - but until it does, it CERTAINLY should
not be the thing we put into clouds.yaml.

Change-Id: If8196a04f852f633e0b7548793f68c92376aa6da
---
 functions-common | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/functions-common b/functions-common
index 35b48603c5..be34bd6ee5 100644
--- a/functions-common
+++ b/functions-common
@@ -93,7 +93,7 @@ function write_clouds_yaml {
         --os-region-name $REGION_NAME \
         --os-identity-api-version 3 \
         $CA_CERT_ARG \
-        --os-auth-url $KEYSTONE_AUTH_URI \
+        --os-auth-url $KEYSTONE_SERVICE_URI \
         --os-username demo \
         --os-password $ADMIN_PASSWORD \
         --os-project-name demo
@@ -105,7 +105,7 @@ function write_clouds_yaml {
         --os-region-name $REGION_NAME \
         --os-identity-api-version 3 \
         $CA_CERT_ARG \
-        --os-auth-url $KEYSTONE_AUTH_URI \
+        --os-auth-url $KEYSTONE_SERVICE_URI \
         --os-username alt_demo \
         --os-password $ADMIN_PASSWORD \
         --os-project-name alt_demo
@@ -117,7 +117,7 @@ function write_clouds_yaml {
         --os-region-name $REGION_NAME \
         --os-identity-api-version 3 \
         $CA_CERT_ARG \
-        --os-auth-url $KEYSTONE_AUTH_URI \
+        --os-auth-url $KEYSTONE_SERVICE_URI \
         --os-username admin \
         --os-password $ADMIN_PASSWORD \
         --os-project-name admin

From c006bbdeb26df2c60f43d222bdf918f9e24d551f Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 26 Apr 2017 06:57:58 -0400
Subject: [PATCH 0936/2409] make USE_SCREEN=False imply USE_SYSTEMD=True

In order to start making the transition in the gate make
USE_SCREEN=False also mean USE_SYSTEMD=True. We'll never actually
declare USE_SYSTEMD=True in the gate (as that doesn't exist for stable
branches), but this will let us roll over the existing transition.

We also have to install systemd-python 234 because we are recording
exception info in the journal, and all versions before that had a bug
in processing that.

Remove the somewhat pointless screen following journalctl commands. We
really don't want or need those, and they tend to build up over time.

Depends-On: I24513f5cbac2c34cf0130bf812ff2df6ad76657c

Change-Id: I6af6d1857effaf662a9d72bd394864934eacbe70
---
 files/debs/general |  3 +--
 files/rpms/general |  2 +-
 functions-common   | 22 ++++------------------
 stack.sh           |  3 +++
 stackrc            |  9 +++++++++
 5 files changed, 18 insertions(+), 21 deletions(-)

diff --git a/files/debs/general b/files/debs/general
index 20490c6072..1dde03b7fe 100644
--- a/files/debs/general
+++ b/files/debs/general
@@ -17,6 +17,7 @@ libjpeg-dev # Pillow 3.0.0
 libmysqlclient-dev  # MySQL-python
 libpq-dev  # psycopg2
 libssl-dev # for pyOpenSSL
+libsystemd-dev # for systemd-python
 libxml2-dev  # lxml
 libxslt1-dev  # lxml
 libyaml-dev
@@ -26,10 +27,8 @@ openssl
 pkg-config
 psmisc
 python2.7
-python3-systemd
 python-dev
 python-gdbm # needed for testr
-python-systemd
 screen
 tar
 tcpdump
diff --git a/files/rpms/general b/files/rpms/general
index 106aa6ae88..1393d18328 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -29,7 +29,7 @@ pyOpenSSL # version in pip uses too much memory
 python-devel
 redhat-rpm-config # missing dep for gcc hardening flags, see rhbz#1217376
 screen
-systemd-python
+systemd-devel # for systemd-python
 tar
 tcpdump
 unzip
diff --git a/functions-common b/functions-common
index 35b48603c5..65c38a58eb 100644
--- a/functions-common
+++ b/functions-common
@@ -1495,22 +1495,6 @@ function _run_under_systemd {
 
     $SYSTEMCTL enable $systemd_service
     $SYSTEMCTL start $systemd_service
-    _journal_log $service $systemd_service
-}
-
-function _journal_log {
-    local service=$1
-    local unit=$2
-    local logfile="${service}.log.${CURRENT_LOG_TIME}"
-    local real_logfile="${LOGDIR}/${logfile}"
-    if [[ -n ${LOGDIR} ]]; then
-        $JOURNALCTL_F $2 > "$real_logfile" &
-        bash -c "cd '$LOGDIR' && ln -sf '$logfile' ${service}.log"
-        if [[ -n ${SCREEN_LOGDIR} ]]; then
-            # Drop the backward-compat symlink
-            ln -sf "$real_logfile" ${SCREEN_LOGDIR}/screen-${service}.log
-        fi
-    fi
 }
 
 # Helper to remove the ``*.failure`` files under ``$SERVICE_DIR/$SCREEN_NAME``.
@@ -1700,8 +1684,10 @@ function stop_process {
             # Only do this for units which appear enabled, this also
             # catches units that don't really exist for cases like
             # keystone without a failure.
-            $SYSTEMCTL stop devstack@$service.service
-            $SYSTEMCTL disable devstack@$service.service
+            if $SYSTEMCTL is-enabled devstack@$service.service; then
+                $SYSTEMCTL stop devstack@$service.service
+                $SYSTEMCTL disable devstack@$service.service
+            fi
         fi
 
         if [[ -r $SERVICE_DIR/$SCREEN_NAME/$service.pid ]]; then
diff --git a/stack.sh b/stack.sh
index 31ea2e1112..8864a18d4f 100755
--- a/stack.sh
+++ b/stack.sh
@@ -746,6 +746,9 @@ fi
 # Do the ugly hacks for broken packages and distros
 source $TOP_DIR/tools/fixup_stuff.sh
 
+if [[ "$USE_SYSTEMD" == "True" ]]; then
+    pip_install_gr systemd-python
+fi
 
 # Virtual Environment
 # -------------------
diff --git a/stackrc b/stackrc
index ed1cf6e074..6ff9585984 100644
--- a/stackrc
+++ b/stackrc
@@ -157,6 +157,15 @@ elif [[ -f $RC_DIR/.localrc.auto ]]; then
     source $RC_DIR/.localrc.auto
 fi
 
+# if we are forcing off USE_SCREEN (as we do in the gate), force on
+# systemd. This allows us to drop one of 3 paths through the code.
+if [[ "$USE_SCREEN" == "False" ]]; then
+    # Remove in Pike: this gets us through grenade upgrade
+    if [[ "$GRENADE_PHASE" != "target" ]]; then
+        USE_SYSTEMD="True"
+    fi
+fi
+
 # Default for log coloring is based on interactive-or-not.
 # Baseline assumption is that non-interactive invocations are for CI,
 # where logs are to be presented as browsable text files; hence color

From fa898f5174e3aff9c65366024c170ce3cdda306d Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Tue, 25 Apr 2017 01:30:10 -0400
Subject: [PATCH 0937/2409] Add external lock dir to glance api config

As we move to enabling glance-api to use a wsgi script that might be run
as multiple processes, there are a couple places where external
synchronization is necessary. To use this we need to set the lock_path
config option from oslo.concurrency so external locks will work.

Change-Id: I9a66a8636d12037ff9aa4fb73cc3f9b9343dd7e9
---
 lib/glance | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/glance b/lib/glance
index 23a1cbf2c7..57f07f5aba 100644
--- a/lib/glance
+++ b/lib/glance
@@ -43,6 +43,7 @@ fi
 
 GLANCE_CACHE_DIR=${GLANCE_CACHE_DIR:=$DATA_DIR/glance/cache}
 GLANCE_IMAGE_DIR=${GLANCE_IMAGE_DIR:=$DATA_DIR/glance/images}
+GLANCE_LOCK_DIR=${GLANCE_LOCK_DIR:=$DATA_DIR/glance/locks}
 GLANCE_AUTH_CACHE_DIR=${GLANCE_AUTH_CACHE_DIR:-/var/cache/glance}
 
 GLANCE_CONF_DIR=${GLANCE_CONF_DIR:-/etc/glance}
@@ -116,6 +117,7 @@ function configure_glance {
     iniset $GLANCE_API_CONF database connection $dburl
     iniset $GLANCE_API_CONF DEFAULT use_syslog $SYSLOG
     iniset $GLANCE_API_CONF DEFAULT image_cache_dir $GLANCE_CACHE_DIR/
+    iniset $GLANCE_API_CONF DEFAULT lock_path $GLANCE_LOCK_DIR
     iniset $GLANCE_API_CONF paste_deploy flavor keystone+cachemanagement
     configure_auth_token_middleware $GLANCE_API_CONF glance $GLANCE_AUTH_CACHE_DIR/api
     iniset $GLANCE_API_CONF oslo_messaging_notifications driver messagingv2

From 38d4782c9f6b8558fea2c5268b9bf5de5070a0fe Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 19 Apr 2017 16:12:00 -0400
Subject: [PATCH 0938/2409] remove auth_uri from keystonemiddleware config

auth_uri is not a keystonemiddleware option, and it's use in config
files is confusing at best. Remove it for clarity.

Change-Id: Ie3a9ab30d81809363444d5f3b41588b3889dc185
---
 lib/keystone | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index a26ef8afd2..75a06791de 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -434,14 +434,13 @@ function configure_auth_token_middleware {
     local section=${4:-keystone_authtoken}
 
     iniset $conf_file $section auth_type password
-    iniset $conf_file $section auth_url $KEYSTONE_AUTH_URI
+    iniset $conf_file $section auth_url $KEYSTONE_SERVICE_URI
     iniset $conf_file $section username $admin_user
     iniset $conf_file $section password $SERVICE_PASSWORD
     iniset $conf_file $section user_domain_name "$SERVICE_DOMAIN_NAME"
     iniset $conf_file $section project_name $SERVICE_PROJECT_NAME
     iniset $conf_file $section project_domain_name "$SERVICE_DOMAIN_NAME"
 
-    iniset $conf_file $section auth_uri $KEYSTONE_SERVICE_URI
     iniset $conf_file $section cafile $SSL_BUNDLE_FILE
     iniset $conf_file $section signing_dir $signing_dir
     iniset $conf_file $section memcached_servers $SERVICE_HOST:11211

From bb4431126b80be4805f1072442676797e6019576 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 19 Apr 2017 16:22:42 -0400
Subject: [PATCH 0939/2409] Try to remove /identity_admin

We should be able to operate without the identity admin endpoint,
given that in v3 it's all the same. This floats that out there to see
if we can or not.

Change-Id: Ic233f6b43dd1e3cfdadff0f18aba4ea78825a996
---
 lib/keystone | 14 ++++++--------
 lib/tempest  |  4 ++++
 2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 75a06791de..fd1e29ce28 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -113,8 +113,9 @@ if is_service_enabled tls-proxy; then
     KEYSTONE_SERVICE_PROTOCOL="https"
 fi
 
-KEYSTONE_AUTH_URI=${KEYSTONE_AUTH_PROTOCOL}://${KEYSTONE_AUTH_HOST}/identity_admin
 KEYSTONE_SERVICE_URI=${KEYSTONE_SERVICE_PROTOCOL}://${KEYSTONE_SERVICE_HOST}/identity
+# for compat
+KEYSTONE_AUTH_URI=$KEYSTONE_SERVICE_URI
 
 # V3 URIs
 KEYSTONE_AUTH_URI_V3=$KEYSTONE_AUTH_URI/v3
@@ -141,6 +142,7 @@ function is_keystone_enabled {
 # runs that a clean run would need to clean up
 function cleanup_keystone {
     if [[ "$WSGI_MODE" == "uwsgi" ]]; then
+        # TODO: remove admin at pike-2
         remove_uwsgi_config "$KEYSTONE_PUBLIC_UWSGI_CONF" "$KEYSTONE_PUBLIC_UWSGI"
         remove_uwsgi_config "$KEYSTONE_ADMIN_UWSGI_CONF" "$KEYSTONE_ADMIN_UWSGI"
         sudo rm -f $(apache_site_config_for keystone-wsgi-public)
@@ -543,11 +545,7 @@ function start_keystone {
         tail_log key /var/log/$APACHE_NAME/keystone.log
         tail_log key-access /var/log/$APACHE_NAME/keystone_access.log
     else # uwsgi
-        # TODO(sdague): we should really get down to a single keystone here
-        enable_service key-p
-        enable_service key-a
-        run_process key-p "$KEYSTONE_BIN_DIR/uwsgi --ini $KEYSTONE_PUBLIC_UWSGI_CONF" ""
-        run_process key-a "$KEYSTONE_BIN_DIR/uwsgi --ini $KEYSTONE_ADMIN_UWSGI_CONF" ""
+        run_process keystone "$KEYSTONE_BIN_DIR/uwsgi --ini $KEYSTONE_PUBLIC_UWSGI_CONF" ""
     fi
 
     echo "Waiting for keystone to start..."
@@ -578,9 +576,9 @@ function stop_keystone {
         disable_apache_site keystone
         restart_apache_server
     else
-        stop_process key-p
-        stop_process key-a
+        stop_process keystone
         remove_uwsgi_config "$KEYSTONE_PUBLIC_UWSGI_CONF" "$KEYSTONE_PUBLIC_UWSGI"
+        # TODO(remove in at pike-2)
         remove_uwsgi_config "$KEYSTONE_ADMIN_UWSGI_CONF" "$KEYSTONE_ADMIN_UWSGI"
     fi
     # Kill the Keystone screen window
diff --git a/lib/tempest b/lib/tempest
index f19686a862..c5853c9a83 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -278,6 +278,10 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG identity-feature-enabled api_v2 False
     fi
     iniset $TEMPEST_CONFIG identity auth_version ${TEMPEST_AUTH_VERSION:-v3}
+    if [[ "$TEMPEST_AUTH_VERSION" != "v2.0" ]]; then
+        # we're going to disable v2 admin unless we're using v2.0 by default.
+        iniset $TEMPEST_CONFIG identity-feature-enabled api_v2_admin False
+    fi
 
     if is_service_enabled tls-proxy; then
         iniset $TEMPEST_CONFIG identity ca_certificates_file $SSL_BUNDLE_FILE

From c13b8a1f33a3ea78388794896a3e7f3256c89ec9 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 20 Apr 2017 06:54:51 -0400
Subject: [PATCH 0940/2409] try to use unversioned keystone endpoints
 everywhere

Change-Id: Iad2a3654d8ba181a7ad452d8aba872a8313d4ece
---
 lib/glance                         | 2 +-
 lib/neutron                        | 4 ++--
 lib/neutron-legacy                 | 2 +-
 lib/nova_plugins/hypervisor-ironic | 2 +-
 lib/placement                      | 2 +-
 5 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/lib/glance b/lib/glance
index 57f07f5aba..d6438a6b48 100644
--- a/lib/glance
+++ b/lib/glance
@@ -207,7 +207,7 @@ function configure_glance {
     iniset $GLANCE_CACHE_CONF DEFAULT use_syslog $SYSLOG
     iniset $GLANCE_CACHE_CONF DEFAULT image_cache_dir $GLANCE_CACHE_DIR/
     iniuncomment $GLANCE_CACHE_CONF DEFAULT auth_url
-    iniset $GLANCE_CACHE_CONF DEFAULT auth_url $KEYSTONE_AUTH_URI/v3
+    iniset $GLANCE_CACHE_CONF DEFAULT auth_url $KEYSTONE_AUTH_URI
     iniuncomment $GLANCE_CACHE_CONF DEFAULT auth_tenant_name
     iniset $GLANCE_CACHE_CONF DEFAULT admin_tenant_name $SERVICE_PROJECT_NAME
     iniuncomment $GLANCE_CACHE_CONF DEFAULT auth_user
diff --git a/lib/neutron b/lib/neutron
index 492a0ee8fb..c7f62ed4a9 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -226,7 +226,7 @@ function configure_neutron_new {
         iniset $NEUTRON_META_CONF agent root_helper_daemon "$NEUTRON_ROOTWRAP_DAEMON_CMD"
 
         # TODO(dtroyer): remove the v2.0 hard code below
-        iniset $NEUTRON_META_CONF DEFAULT auth_url $KEYSTONE_SERVICE_URI/v2.0
+        iniset $NEUTRON_META_CONF DEFAULT auth_url $KEYSTONE_SERVICE_URI
         configure_auth_token_middleware $NEUTRON_META_CONF neutron $NEUTRON_AUTH_CACHE_DIR DEFAULT
     fi
 
@@ -284,7 +284,7 @@ function configure_neutron_rootwrap {
 function configure_neutron_nova_new {
     iniset $NOVA_CONF DEFAULT use_neutron True
     iniset $NOVA_CONF neutron auth_type "password"
-    iniset $NOVA_CONF neutron auth_url "$KEYSTONE_SERVICE_URI/v3"
+    iniset $NOVA_CONF neutron auth_url "$KEYSTONE_SERVICE_URI"
     iniset $NOVA_CONF neutron username neutron
     iniset $NOVA_CONF neutron password "$SERVICE_PASSWORD"
     iniset $NOVA_CONF neutron user_domain_name "Default"
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index af9a3d25b9..fa508f8180 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -368,7 +368,7 @@ function configure_mutnauq {
 function create_nova_conf_neutron {
     iniset $NOVA_CONF DEFAULT use_neutron True
     iniset $NOVA_CONF neutron auth_type "password"
-    iniset $NOVA_CONF neutron auth_url "$KEYSTONE_AUTH_URI/v3"
+    iniset $NOVA_CONF neutron auth_url "$KEYSTONE_AUTH_URI"
     iniset $NOVA_CONF neutron username "$Q_ADMIN_USERNAME"
     iniset $NOVA_CONF neutron password "$SERVICE_PASSWORD"
     iniset $NOVA_CONF neutron user_domain_name "$SERVICE_DOMAIN_NAME"
diff --git a/lib/nova_plugins/hypervisor-ironic b/lib/nova_plugins/hypervisor-ironic
index c9544fe6c7..7d47ef070c 100644
--- a/lib/nova_plugins/hypervisor-ironic
+++ b/lib/nova_plugins/hypervisor-ironic
@@ -49,7 +49,7 @@ function configure_nova_hypervisor {
     iniset $NOVA_CONF ironic auth_type password
     iniset $NOVA_CONF ironic username admin
     iniset $NOVA_CONF ironic password $ADMIN_PASSWORD
-    iniset $NOVA_CONF ironic auth_url $KEYSTONE_AUTH_URI/v3
+    iniset $NOVA_CONF ironic auth_url $KEYSTONE_AUTH_URI
     iniset $NOVA_CONF ironic project_domain_id default
     iniset $NOVA_CONF ironic user_domain_id default
     iniset $NOVA_CONF ironic project_name demo
diff --git a/lib/placement b/lib/placement
index 4755a58bf2..2c51ed69b4 100644
--- a/lib/placement
+++ b/lib/placement
@@ -102,7 +102,7 @@ function _config_placement_apache_wsgi {
 
 function configure_placement_nova_compute {
     iniset $NOVA_CONF placement auth_type "password"
-    iniset $NOVA_CONF placement auth_url "$KEYSTONE_SERVICE_URI/v3"
+    iniset $NOVA_CONF placement auth_url "$KEYSTONE_SERVICE_URI"
     iniset $NOVA_CONF placement username placement
     iniset $NOVA_CONF placement password "$SERVICE_PASSWORD"
     iniset $NOVA_CONF placement user_domain_name "$SERVICE_DOMAIN_NAME"

From 803acffcf9254e328426ad67380a99f4f5b164ec Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 1 May 2017 10:52:38 -0400
Subject: [PATCH 0941/2409] Make ./clean.sh work in more situations

When transitioning between different wsgi modes, or service modes, we
should really safely stop and cleanup things that are started in any
service mode, which makes it easier to ensure that we don't leave
things around from past runs.

Change-Id: I33acbee39e1a2da2bfd79a5dd54b84a12a778be1
---
 functions-common | 15 ++++++---------
 lib/keystone     | 20 ++++++++++----------
 lib/placement    |  1 +
 3 files changed, 17 insertions(+), 19 deletions(-)

diff --git a/functions-common b/functions-common
index 65c38a58eb..90f540017c 100644
--- a/functions-common
+++ b/functions-common
@@ -1679,15 +1679,12 @@ function stop_process {
     SERVICE_DIR=${SERVICE_DIR:-${DEST}/status}
 
     if is_service_enabled $service; then
-        # Kill via pid if we have one available
-        if [[ "$USE_SYSTEMD" == "True" ]]; then
-            # Only do this for units which appear enabled, this also
-            # catches units that don't really exist for cases like
-            # keystone without a failure.
-            if $SYSTEMCTL is-enabled devstack@$service.service; then
-                $SYSTEMCTL stop devstack@$service.service
-                $SYSTEMCTL disable devstack@$service.service
-            fi
+        # Only do this for units which appear enabled, this also
+        # catches units that don't really exist for cases like
+        # keystone without a failure.
+        if $SYSTEMCTL is-enabled devstack@$service.service; then
+            $SYSTEMCTL stop devstack@$service.service
+            $SYSTEMCTL disable devstack@$service.service
         fi
 
         if [[ -r $SERVICE_DIR/$SCREEN_NAME/$service.pid ]]; then
diff --git a/lib/keystone b/lib/keystone
index fd1e29ce28..61b0a0c287 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -141,16 +141,16 @@ function is_keystone_enabled {
 # cleanup_keystone() - Remove residual data files, anything left over from previous
 # runs that a clean run would need to clean up
 function cleanup_keystone {
-    if [[ "$WSGI_MODE" == "uwsgi" ]]; then
-        # TODO: remove admin at pike-2
-        remove_uwsgi_config "$KEYSTONE_PUBLIC_UWSGI_CONF" "$KEYSTONE_PUBLIC_UWSGI"
-        remove_uwsgi_config "$KEYSTONE_ADMIN_UWSGI_CONF" "$KEYSTONE_ADMIN_UWSGI"
-        sudo rm -f $(apache_site_config_for keystone-wsgi-public)
-        sudo rm -f $(apache_site_config_for keystone-wsgi-admin)
-    else
-        disable_apache_site keystone
-        sudo rm -f $(apache_site_config_for keystone)
-    fi
+    # TODO: remove admin at pike-2
+    # These files will be created if we are running WSGI_MODE="uwsgi"
+    remove_uwsgi_config "$KEYSTONE_PUBLIC_UWSGI_CONF" "$KEYSTONE_PUBLIC_UWSGI"
+    remove_uwsgi_config "$KEYSTONE_ADMIN_UWSGI_CONF" "$KEYSTONE_ADMIN_UWSGI"
+    sudo rm -f $(apache_site_config_for keystone-wsgi-public)
+    sudo rm -f $(apache_site_config_for keystone-wsgi-admin)
+
+    # These files will be created if we are running WSGI_MODE="mod_wsgi"
+    disable_apache_site keystone
+    sudo rm -f $(apache_site_config_for keystone)
 }
 
 # _config_keystone_apache_wsgi() - Set WSGI config files of Keystone
diff --git a/lib/placement b/lib/placement
index 2c51ed69b4..ad12824a38 100644
--- a/lib/placement
+++ b/lib/placement
@@ -69,6 +69,7 @@ function is_placement_enabled {
 # cleanup_placement() - Remove residual data files, anything left over from previous
 # runs that a clean run would need to clean up
 function cleanup_placement {
+    sudo rm -f $(apache_site_config_for nova-placement-api)
     sudo rm -f $(apache_site_config_for placement-api)
 }
 

From 8b8441f3becbae2e704932569bff384dcc5c6713 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 2 May 2017 06:14:11 -0400
Subject: [PATCH 0942/2409] Default developer use case to systemd

This moves the developer use case over to systemd, and updates all the
relevant docs to discuss the systemd workflow instead of screen. It
does so by defaulting USE_SCREEN=False, so will not impact people that
set it explicitly.

Change-Id: I6d664612bc2b850eb7f56852afbc841867223ab7
---
 doc/source/configuration.rst          | 42 +++-----------
 doc/source/development.rst            | 81 ++++++++++-----------------
 doc/source/faq.rst                    |  5 +-
 doc/source/site-map.rst               |  1 +
 SYSTEMD.rst => doc/source/systemd.rst | 36 +++---------
 stack.sh                              |  7 +++
 stackrc                               | 16 ++++--
 7 files changed, 68 insertions(+), 120 deletions(-)
 rename SYSTEMD.rst => doc/source/systemd.rst (85%)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 53ae82ff8a..318e044909 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -278,43 +278,22 @@ number of days of old log files to keep.
 
         LOGDAYS=1
 
-The some of the project logs (Nova, Cinder, etc) will be colorized by
-default (if ``SYSLOG`` is not set below); this can be turned off by
-setting ``LOG_COLOR`` to ``False``.
-
-    ::
+Some coloring is used during the DevStack runs to make it easier to
+see what is going on. This can be disabled with::
 
         LOG_COLOR=False
 
 Logging the Service Output
 ~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-DevStack will log the ``stdout`` output of the services it starts.
-When using ``screen`` this logs the output in the screen windows to a
-file.  Without ``screen`` this simply redirects stdout of the service
-process to a file in ``LOGDIR``.
-
-    ::
-
-        LOGDIR=$DEST/logs
+By default, services run under ``systemd`` and are natively logging to
+the systemd journal.
 
-Note the use of ``DEST`` to locate the main install directory; this
-is why we suggest setting it in ``local.conf``.
-
-Enabling Syslog
-~~~~~~~~~~~~~~~
-
-Logging all services to a single syslog can be convenient. Enable
-syslogging by setting ``SYSLOG`` to ``True``. If the destination log
-host is not localhost ``SYSLOG_HOST`` and ``SYSLOG_PORT`` can be used
-to direct the message stream to the log host.
-
-    ::
+To query the logs use the ``journalctl`` command, such as::
 
-        SYSLOG=True
-        SYSLOG_HOST=$HOST_IP
-        SYSLOG_PORT=516
+  journalctl --unit devstack@*
 
+More examples can be found in :ref:`journalctl-examples`.
 
 Example Logging Configuration
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -326,7 +305,6 @@ a file, keep service logs and disable color in the stored files.
 
        [[local|localrc]]
        DEST=/opt/stack/
-       LOGDIR=$DEST/logs
        LOGFILE=$LOGDIR/stack.sh.log
        LOG_COLOR=False
 
@@ -587,9 +565,7 @@ Swift
 
 Swift is disabled by default.  When enabled, it is configured with
 only one replica to avoid being IO/memory intensive on a small
-VM. When running with only one replica the account, container and
-object services will run directly in screen. The others services like
-replicator, updaters or auditor runs in background.
+VM.
 
 If you would like to enable Swift you can add this to your ``localrc``
 section:
@@ -630,7 +606,7 @@ install the swift3 middleware emulation. Swift will be configured to
 act as a S3 endpoint for Keystone so effectively replacing the
 ``nova-objectstore``.
 
-Only Swift proxy server is launched in the screen session all other
+Only Swift proxy server is launched in the systemd system all other
 services are started in background and managed by ``swift-init`` tool.
 
 Heat
diff --git a/doc/source/development.rst b/doc/source/development.rst
index 776ac6cb64..a3f2747604 100644
--- a/doc/source/development.rst
+++ b/doc/source/development.rst
@@ -8,56 +8,33 @@ with it?
 Inspecting Services
 ===================
 
-By default most services in DevStack are running in a `screen
-<https://www.gnu.org/software/screen/manual/screen.html>`_
-session.
+By default most services in DevStack are running as `systemd` units
+named `devstack@$servicename.service`. You can see running services
+with.
 
 .. code-block:: bash
 
-   os3:~> screen -list
-   There is a screen on:
-        28994.stack	(08/10/2016 09:01:33 PM)	(Detached)
-   1 Socket in /var/run/screen/S-sdague.
+   sudo systemctl status --unit="devstack@*"
 
-You can attach to this screen session using ``screen -r`` which gives
-you a view of the services in action.
-
-.. image:: assets/images/screen_session_1.png
-   :width: 100%
-
-Basic Screen Commands
----------------------
-
-The following minimal commands will be useful to using screen:
-
-* ``ctrl-a n`` - go to next window. Next is assumed to be right of
-  current window.
-* ``ctrl-a p`` - go to previous window. Previous is assumed to be left
-  of current window.
-* ``ctrl-a [`` - entry copy/scrollback mode. This allows you to
-  navigate back through the logs with the up arrow.
-* ``ctrl-a d`` - detach from screen. Gets you back to a normal
-  terminal, while leaving everything running.
-
-For more about using screen, see the excellent `screen manual
-<https://www.gnu.org/software/screen/manual/screen.html>`_.
+To learn more about the basics of systemd, see :doc:`/systemd`
 
 Patching a Service
 ==================
 
 If you want to make a quick change to a running service the easiest
-way to do this is:
+way to do that is to change the code directly in /opt/stack/$service
+and then restart the affected daemons.
+
+.. code-block:: bash
+
+   sudo systemctl restart --unit=devstack@n-cpu.service
+
+If your change impacts more than one daemon you can restart by
+wildcard as well.
 
-* attach to screen
-* navigate to the window in question
-* ``ctrl-c`` to kill the service
-* make appropriate changes to the code
-* ``up arrow`` in the screen window to display the command used to run
-  that service
-* ``enter`` to restart the service
+.. code-block:: bash
 
-This works for services, except those running under Apache (currently
-just ``keystone`` by default).
+   sudo systemctl restart --unit="devstack@n-*"
 
 .. warning::
 
@@ -102,14 +79,6 @@ in gerrit by using the ref name that gerrit assigns to each change.
    NOVA_BRANCH=refs/changes/10/353710/1
 
 
-Testing Changes to Apache Based Services
-========================================
-
-When testing changes to Apache based services, such as ``keystone``,
-you can either use the Testing a Patch Series approach above, or make
-changes in the code tree and issue an apache restart.
-
-
 Testing Changes to Libraries
 ============================
 
@@ -132,9 +101,17 @@ your changes instead of just upstream master.
    OSLOPOLICY_REPO=/home/sdague/oslo.policy
    OSLOPOLICY_BRANCH=better_exception
 
-Because libraries are used by many services, library changes really
-need to go through a full ``./unstack.sh && ./stack.sh`` to see your
-changes in action.
+As libraries are not installed `editable` by pip, after you make any
+local changes you will need to:
+
+* cd to top of library path
+* sudo pip install -U .
+* restart all services you want to use the new library
+
+You can do that with wildcards such as
+
+.. code-block:: bash
+
+   sudo systemctl restart --unit="devstack@n-*"
 
-To figure out the repo / branch names for every library that's
-supported, you'll need to read the devstack source.
+which will restart all nova services.
diff --git a/doc/source/faq.rst b/doc/source/faq.rst
index f03304f37f..cb2f3281f6 100644
--- a/doc/source/faq.rst
+++ b/doc/source/faq.rst
@@ -41,8 +41,9 @@ Why not use packages?
 ~~~~~~~~~~~~~~~~~~~~~
 
 Unlike packages, DevStack leaves your cloud ready to develop -
-checkouts of the code and services running in screen. However, many
-people are doing the hard work of packaging and recipes for production
+checkouts of the code and services running locally under systemd,
+making it easy to hack on and test new patches. However, many people
+are doing the hard work of packaging and recipes for production
 deployments.
 
 Why isn't $MY\_FAVORITE\_DISTRO supported?
diff --git a/doc/source/site-map.rst b/doc/source/site-map.rst
index 801fc66b80..022cc73959 100644
--- a/doc/source/site-map.rst
+++ b/doc/source/site-map.rst
@@ -21,3 +21,4 @@
    development
    hacking
    guides
+   systemd
diff --git a/SYSTEMD.rst b/doc/source/systemd.rst
similarity index 85%
rename from SYSTEMD.rst
rename to doc/source/systemd.rst
index 729fdf47b6..efe79e4b0c 100644
--- a/SYSTEMD.rst
+++ b/doc/source/systemd.rst
@@ -2,12 +2,7 @@
  Using Systemd in DevStack
 ===========================
 
-.. note::
-
-   This is an in progress document as we work out the way forward here
-   with DevStack and systemd.
-
-DevStack can be run with all the services as systemd unit
+By default DevStack is run with all the services as systemd unit
 files. Systemd is now the default init system for nearly every Linux
 distro, and systemd encodes and solves many of the problems related to
 poorly running processes.
@@ -25,12 +20,6 @@ There is also a common developer workflow of changing code in more
 than one service, and needing to restart a bunch of services for that
 to take effect.
 
-To enable this add the following to your local.conf::
-
-  USE_SYSTEMD=True
-
-
-
 Unit Structure
 ==============
 
@@ -42,8 +31,9 @@ Unit Structure
    code is left in place in case we can switch back later.
 
 All DevStack user units are created as a part of the DevStack slice
-given the name ``devstack@$servicename.service``. This lets us do
-certain operations at the slice level.
+given the name ``devstack@$servicename.service``. This makes it easy
+to understand which services are part of the devstack run, and lets us
+disable / stop them in a single command.
 
 Manipulating Units
 ==================
@@ -89,6 +79,8 @@ Or to see the status of all Nova processes you can do::
 We'll eventually make the unit names a bit more meaningful so that
 it's easier to understand what you are restarting.
 
+.. _journalctl-examples:
+
 Querying Logs
 =============
 
@@ -126,7 +118,7 @@ pypi, and they are all very different. They unfortunately all install
 into the ``systemd`` namespace, which can cause some issues.
 
 - ``systemd-python`` - this is the upstream maintained library, it has
-  a version number like systemd itself (currently ``233``). This is
+  a version number like systemd itself (currently ``234``). This is
   the one you want.
 - ``systemd`` - a python 3 only library, not what you want.
 - ``python-systemd`` - another library you don't want. Installing it
@@ -145,20 +137,6 @@ system units.
 Future Work
 ===========
 
-oslo.log journald
------------------
-
-Journald has an extremely rich mechanism for direct logging including
-structured metadata. We should enhance oslo.log to take advantage of
-that. It would let us do things like::
-
-  journalctl REQUEST_ID=......
-
-  journalctl INSTANCE_ID=......
-
-And get all lines related to the request id or instance id. (Note:
-this work has been started at https://review.openstack.org/#/c/451525/)
-
 log colorizing
 --------------
 
diff --git a/stack.sh b/stack.sh
index 40ebf5a853..2c10200f75 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1474,6 +1474,13 @@ if [[ -n "$DEPRECATED_TEXT" ]]; then
     echo_summary "WARNING: $DEPRECATED_TEXT"
 fi
 
+# If USE_SYSTEMD is enabled, tell the user about using it.
+if [[ "$USE_SYSTEMD" == "True" ]]; then
+    echo "Services are running under systemd unit files."
+    echo "For more information see: "
+    echo "https://docs.openstack.org/developer/devstack/systemd.html"
+fi
+
 # Indicate how long this took to run (bash maintained variable ``SECONDS``)
 echo_summary "stack.sh completed in $SECONDS seconds."
 
diff --git a/stackrc b/stackrc
index d5c0d74e25..1300f45cda 100644
--- a/stackrc
+++ b/stackrc
@@ -80,12 +80,19 @@ NOVA_ENABLED_APIS=osapi_compute,metadata
 # Set the root URL for Horizon
 HORIZON_APACHE_ROOT="/dashboard"
 
+# TODO(sdague): Queens
+#
+# All the non systemd paths should be removed in queens, they only
+# exist in Pike to support testing from grenade. Ensure that all this
+# is cleaned up and purged, which should dramatically simplify the
+# devstack codebase.
+
 # Whether to use 'dev mode' for screen windows. Dev mode works by
 # stuffing text into the screen windows so that a developer can use
 # ctrl-c, up-arrow, enter to restart the service. Starting services
 # this way is slightly unreliable, and a bit slower, so this can
 # be disabled for automated testing by setting this value to False.
-USE_SCREEN=$(trueorfalse True USE_SCREEN)
+USE_SCREEN=$(trueorfalse False USE_SCREEN)
 
 # Whether to use SYSTEMD to manage services
 USE_SYSTEMD=$(trueorfalse False USE_SYSTEMD)
@@ -100,9 +107,6 @@ else
     JOURNALCTL_F="journalctl -f -o short-precise --unit"
 fi
 
-if [[ "$USE_SYSTEMD" == "True" ]]; then
-    USE_SCREEN=False
-fi
 
 # Whether or not to enable Kernel Samepage Merging (KSM) if available.
 # This allows programs that mark their memory as mergeable to share
@@ -157,6 +161,10 @@ elif [[ -f $RC_DIR/.localrc.auto ]]; then
     source $RC_DIR/.localrc.auto
 fi
 
+# TODO(sdague): Delete all this in Queens.
+if [[ "$USE_SYSTEMD" == "True" ]]; then
+    USE_SCREEN=False
+fi
 # if we are forcing off USE_SCREEN (as we do in the gate), force on
 # systemd. This allows us to drop one of 3 paths through the code.
 if [[ "$USE_SCREEN" == "False" ]]; then

From 27f66e9830727addd3d84b7a23eee907210540bb Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 2 May 2017 09:08:17 -0400
Subject: [PATCH 0943/2409] Fix logging when under systemd

Both keystone and neutron didn't yet have systemd awareness for
setting up logging (i.e. drop the extra date / time stamps)

Change-Id: Ib442c603c9afb679676976c37c2c6122201ae846
---
 lib/keystone | 4 +---
 lib/neutron  | 7 +------
 2 files changed, 2 insertions(+), 9 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 61b0a0c287..4bb6893089 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -267,9 +267,7 @@ function configure_keystone {
     fi
 
     # Format logging
-    if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ] && [ "$KEYSTONE_DEPLOY" != "mod_wsgi" ] ; then
-        setup_colorized_logging $KEYSTONE_CONF
-    fi
+    setup_logging $KEYSTONE_CONF
 
     iniset $KEYSTONE_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
 
diff --git a/lib/neutron b/lib/neutron
index c7f62ed4a9..941a697816 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -231,12 +231,7 @@ function configure_neutron_new {
     fi
 
     # Format logging
-    if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ]; then
-        setup_colorized_logging $NEUTRON_CONF DEFAULT project_id
-    else
-        # Show user_name and project_name by default
-        iniset $NEUTRON_CONF DEFAULT logging_context_format_string "%(asctime)s.%(msecs)03d %(levelname)s %(name)s [%(request_id)s %(user_name)s %(project_name)s] %(instance)s%(message)s"
-    fi
+    setup_logging $NEUTRON_CONF
 
     if is_service_enabled tls-proxy; then
         # Set the service port for a proxy to take the original

From 29c1f981feded19f81f873e5147428ec87cd7c52 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 2 May 2017 08:40:26 -0400
Subject: [PATCH 0944/2409] convert README to rst

Everything else in our documentation is RST, we should convert the
Readme to RST as well (as github supports this, so it's fine to read
it there)

Change-Id: If2aabf629affc09b5daa570f4ca3bdf268cb53b0
---
 README.md => README.rst | 26 ++++++++++++++++----------
 setup.cfg               |  2 +-
 2 files changed, 17 insertions(+), 11 deletions(-)
 rename README.md => README.rst (89%)

diff --git a/README.md b/README.rst
similarity index 89%
rename from README.md
rename to README.rst
index ff5598b0c5..dfa68b927f 100644
--- a/README.md
+++ b/README.rst
@@ -1,6 +1,7 @@
 DevStack is a set of scripts and utilities to quickly deploy an OpenStack cloud.
 
-# Goals
+Goals
+=====
 
 * To quickly build dev OpenStack environments in a clean Ubuntu or Fedora
   environment
@@ -20,12 +21,13 @@ execute before you run them, as they install software and will alter your
 networking configuration.  We strongly recommend that you run `stack.sh`
 in a clean and disposable vm when you are first getting started.
 
-# Versions
+Versions
+========
 
 The DevStack master branch generally points to trunk versions of OpenStack
 components.  For older, stable versions, look for branches named
 stable/[release] in the DevStack repo.  For example, you can do the
-following to create a Newton OpenStack cloud:
+following to create a Newton OpenStack cloud::
 
     git checkout stable/newton
     ./stack.sh
@@ -38,7 +40,8 @@ milestone-proposed branches that need to be tested::
     GLANCE_REPO=git://git.openstack.org/openstack/glance.git
     GLANCE_BRANCH=milestone-proposed
 
-# Start A Dev Cloud
+Start A Dev Cloud
+=================
 
 Installing in a dedicated disposable VM is safer than installing on your
 dev machine!  Plus you can pick one of the supported Linux distros for
@@ -54,14 +57,15 @@ endpoints, like so:
 * Keystone: http://myhost:5000/v2.0/
 
 We also provide an environment file that you can use to interact with your
-cloud via CLI:
+cloud via CLI::
 
     # source openrc file to load your environment with OpenStack CLI creds
     . openrc
     # list instances
-    nova list
+    openstack server list
 
-# DevStack Execution Environment
+DevStack Execution Environment
+==============================
 
 DevStack runs rampant over the system it runs on, installing things and
 uninstalling other things.  Running this on a system you care about is a recipe
@@ -81,10 +85,12 @@ check it out to see what DevStack's expectations are for the account
 it runs under.  Many people simply use their usual login (the default
 'ubuntu' login on a UEC image for example).
 
-# Customizing
+Customizing
+===========
 
 DevStack can be extensively configured via the configuration file
 `local.conf`.  It is likely that you will need to provide and modify
 this file if you want anything other than the most basic setup.  Start
-by reading the [configuration guide](doc/source/configuration.rst) for
-details of the configuration file and the many available options.
+by reading the `configuration guide
+<https://docs.openstack.org/developer/devstack/configuration.html>_`
+for details of the configuration file and the many available options.
diff --git a/setup.cfg b/setup.cfg
index e4b2888dcb..3487f6541b 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -2,7 +2,7 @@
 name = DevStack
 summary = OpenStack DevStack
 description-file =
-    README.md
+    README.rst
 author = OpenStack
 author-email = openstack-dev@lists.openstack.org
 home-page = http://docs.openstack.org/developer/devstack

From 2686b36c32cf99e3fad5e55466d8c582b58f82cb Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 2 May 2017 08:49:17 -0400
Subject: [PATCH 0945/2409] Correct various inaccuracies in overview.rst

This still was referencing nova-network

Change-Id: Id584d3fd26482330f42319aee4cb36981066db55
---
 doc/source/overview.rst | 18 ++++++------------
 1 file changed, 6 insertions(+), 12 deletions(-)

diff --git a/doc/source/overview.rst b/doc/source/overview.rst
index d245035a1a..e64819372e 100644
--- a/doc/source/overview.rst
+++ b/doc/source/overview.rst
@@ -20,11 +20,11 @@ Base OS
 
 *The OpenStack Technical Committee (TC) has defined the current CI
 strategy to include the latest Ubuntu release and the latest RHEL
-release (for Python 2.6 testing).*
+release.*
 
 -  Ubuntu: current LTS release plus current development release
 -  Fedora: current release plus previous release
--  RHEL: current major release
+-  RHEL/Centos: current major release
 -  Other OS platforms may continue to be included but the maintenance of
    those platforms shall not be assumed simply due to their presence.
    Having a listed point-of-contact for each additional OS will greatly
@@ -38,7 +38,6 @@ Databases
 *As packaged by the host OS*
 
 -  MySQL
--  PostgreSQL
 
 Queues
 ------
@@ -46,7 +45,6 @@ Queues
 *As packaged by the host OS*
 
 -  Rabbit
--  Qpid
 
 Web Server
 ----------
@@ -58,9 +56,6 @@ Web Server
 OpenStack Network
 -----------------
 
-*Defaults to nova network, optionally use neutron*
-
--  Nova Network: FlatDHCP
 -  Neutron: A basic configuration approximating the original FlatDHCP
    mode using linuxbridge or OpenVSwitch.
 
@@ -68,9 +63,9 @@ Services
 --------
 
 The default services configured by DevStack are Identity (keystone),
-Object Storage (swift), Image Service (glance), Block Storage (cinder),
-Compute (nova), Networking (nova), Dashboard (horizon), Orchestration
-(heat)
+Object Storage (swift), Image Service (glance), Block Storage
+(cinder), Compute (nova), Networking (neutron), Dashboard (horizon),
+Orchestration (heat)
 
 Additional services not included directly in DevStack can be tied in to
 ``stack.sh`` using the :doc:`plugin mechanism <plugins>` to call
@@ -80,8 +75,7 @@ Node Configurations
 -------------------
 
 -  single node
--  multi-node is not tested regularly by the core team, and even then
-   only minimal configurations are reviewed
+-  multi-node configurations as are tested by the gate
 
 Exercises
 ---------

From 3336b4bed6455e9e77a7696b353d8798270c5b2e Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 2 May 2017 08:45:34 -0400
Subject: [PATCH 0946/2409] remove out of date heat references

This removes some remnant heat code and references now that heat is
running in a plugin. Before merging this patch the heat team should
verify they got everything they needed into their heat plugin, as
there were more parts left than I was expecting.

Change-Id: I477e3a6e75591aa8ff836c28f7ef56aa1b5f8727
---
 doc/source/configuration.rst | 23 -----------------------
 doc/source/faq.rst           | 10 ----------
 doc/source/overview.rst      |  3 +--
 lib/tempest                  | 18 ------------------
 stack.sh                     |  6 +-----
 stackrc                      |  8 --------
 6 files changed, 2 insertions(+), 66 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 318e044909..66b8702f76 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -609,29 +609,6 @@ act as a S3 endpoint for Keystone so effectively replacing the
 Only Swift proxy server is launched in the systemd system all other
 services are started in background and managed by ``swift-init`` tool.
 
-Heat
-~~~~
-
-Heat is disabled by default (see ``stackrc`` file). To enable it
-explicitly you'll need the following settings in your ``localrc``
-section
-
-::
-
-    enable_service heat h-api h-api-cfn h-api-cw h-eng
-
-Heat can also run in standalone mode, and be configured to orchestrate
-on an external OpenStack cloud. To launch only Heat in standalone mode
-you'll need the following settings in your ``localrc`` section
-
-::
-
-    disable_all_services
-    enable_service rabbit mysql heat h-api h-api-cfn h-api-cw h-eng
-    HEAT_STANDALONE=True
-    KEYSTONE_SERVICE_HOST=...
-    KEYSTONE_AUTH_HOST=...
-
 Tempest
 ~~~~~~~
 
diff --git a/doc/source/faq.rst b/doc/source/faq.rst
index cb2f3281f6..a186336f54 100644
--- a/doc/source/faq.rst
+++ b/doc/source/faq.rst
@@ -159,16 +159,6 @@ to a working IP address; setting it to 127.0.0.1 in ``/etc/hosts`` is
 often good enough for a single-node installation. And in an extreme
 case, use ``clean.sh`` to eradicate it and try again.
 
-Configure ``local.conf`` thusly:
-
-    ::
-
-        [[local|localrc]]
-        HEAT_STANDALONE=True
-        ENABLED_SERVICES=rabbit,mysql,heat,h-api,h-api-cfn,h-api-cw,h-eng
-        KEYSTONE_SERVICE_HOST=<keystone-host>
-        KEYSTONE_AUTH_HOST=<keystone-host>
-
 Why are my configuration changes ignored?
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
diff --git a/doc/source/overview.rst b/doc/source/overview.rst
index e64819372e..c07a8e6d67 100644
--- a/doc/source/overview.rst
+++ b/doc/source/overview.rst
@@ -64,8 +64,7 @@ Services
 
 The default services configured by DevStack are Identity (keystone),
 Object Storage (swift), Image Service (glance), Block Storage
-(cinder), Compute (nova), Networking (neutron), Dashboard (horizon),
-Orchestration (heat)
+(cinder), Compute (nova), Networking (neutron), Dashboard (horizon)
 
 Additional services not included directly in DevStack can be tied in to
 ``stack.sh`` using the :doc:`plugin mechanism <plugins>` to call
diff --git a/lib/tempest b/lib/tempest
index fd8e3e7e14..47785ec06b 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -394,24 +394,6 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG network-feature-enabled ipv6_subnet_attributes "$IPV6_SUBNET_ATTRIBUTES_ENABLED"
     iniset $TEMPEST_CONFIG network-feature-enabled port_security $NEUTRON_PORT_SECURITY
 
-    # Orchestration Tests
-    if is_service_enabled heat; then
-        if [[ ! -z "$HEAT_CFN_IMAGE_URL" ]]; then
-            iniset $TEMPEST_CONFIG orchestration image_ref $(basename "${HEAT_CFN_IMAGE_URL%.*}")
-        fi
-        # Nova might not be enabled, especially when we want to test tempest scenario/API that only create Neutron resources
-        if is_service_enabled nova; then
-            # build a specialized heat flavor
-            available_flavors=$(nova flavor-list)
-            if [[ ! ( $available_flavors =~ 'm1.heat' ) ]]; then
-                openstack flavor create --id 451 --ram 512 --disk 0 --vcpus 1 m1.heat
-            fi
-            iniset $TEMPEST_CONFIG orchestration instance_type "m1.heat"
-        fi
-        iniset $TEMPEST_CONFIG orchestration build_timeout 900
-        iniset $TEMPEST_CONFIG orchestration stack_owner_role Member
-    fi
-
     # Scenario
     if [ "$VIRT_DRIVER" = "xenserver" ]; then
         SCENARIO_IMAGE_DIR=${SCENARIO_IMAGE_DIR:-$FILES}
diff --git a/stack.sh b/stack.sh
index 2c10200f75..bddf11f830 100755
--- a/stack.sh
+++ b/stack.sh
@@ -2,7 +2,7 @@
 
 # ``stack.sh`` is an opinionated OpenStack developer installation.  It
 # installs and configures various combinations of **Cinder**, **Glance**,
-# **Heat**, **Horizon**, **Keystone**, **Nova**, **Neutron**, and **Swift**
+# **Horizon**, **Keystone**, **Nova**, **Neutron**, and **Swift**
 
 # This script's options can be changed by setting appropriate environment
 # variables.  You can configure things like which git repositories to use,
@@ -1328,10 +1328,6 @@ if is_service_enabled nova && is_service_enabled keystone; then
         USERRC_PARAMS="$USERRC_PARAMS --os-cacert $SSL_BUNDLE_FILE"
     fi
 
-    if [[ "$HEAT_STANDALONE" = "True" ]]; then
-        USERRC_PARAMS="$USERRC_PARAMS --heat-url http://$HEAT_API_HOST:$HEAT_API_PORT/v1"
-    fi
-
     $TOP_DIR/tools/create_userrc.sh $USERRC_PARAMS
 fi
 
diff --git a/stackrc b/stackrc
index 1300f45cda..35856ca73e 100644
--- a/stackrc
+++ b/stackrc
@@ -518,14 +518,6 @@ GITBRANCH["cursive"]=${CURSIVE_BRANCH:-master}
 GITREPO["glance_store"]=${GLANCE_STORE_REPO:-${GIT_BASE}/openstack/glance_store.git}
 GITBRANCH["glance_store"]=${GLANCE_STORE_BRANCH:-master}
 
-# heat-cfntools server agent
-HEAT_CFNTOOLS_REPO=${HEAT_CFNTOOLS_REPO:-${GIT_BASE}/openstack/heat-cfntools.git}
-HEAT_CFNTOOLS_BRANCH=${HEAT_CFNTOOLS_BRANCH:-master}
-
-# heat example templates and elements
-HEAT_TEMPLATES_REPO=${HEAT_TEMPLATES_REPO:-${GIT_BASE}/openstack/heat-templates.git}
-HEAT_TEMPLATES_BRANCH=${HEAT_TEMPLATES_BRANCH:-master}
-
 # django openstack_auth library
 GITREPO["django_openstack_auth"]=${HORIZONAUTH_REPO:-${GIT_BASE}/openstack/django_openstack_auth.git}
 GITBRANCH["django_openstack_auth"]=${HORIZONAUTH_BRANCH:-master}

From b2bfe5617ac43a678a9113d5c955f5456c151319 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 3 May 2017 09:58:21 -0400
Subject: [PATCH 0947/2409] Turn off use_journal because of eventlet concerns

use_journal uses the systemd native path for logging, however there
are concerns that this might be negatively interacting with
eventlet. To be on the safe side fall back to stdout.

This introduces a USE_JOURNAL option which will let folks turn this
back on for testing.

This also adjusts the debug lines. When using the journal the pid
reported by systemd is correct. When using stdout, it will be the
parent process id, so we need to keep it to see which child each thing
is coming from.

Change-Id: Id7891c532bf99c099252e82d511a37a49506fea9
---
 functions | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/functions b/functions
index c99e435175..8968a1861b 100644
--- a/functions
+++ b/functions
@@ -606,13 +606,25 @@ function setup_colorized_logging {
 function setup_systemd_logging {
     local conf_file=$1
     local conf_section="DEFAULT"
-    iniset $conf_file $conf_section use_journal "True"
+    # NOTE(sdague): this is a nice to have, and means we're using the
+    # native systemd path, which provides for things like search on
+    # request-id. However, there may be an eventlet interaction here,
+    # so going off for now.
+    USE_JOURNAL=$(trueorfalse USE_JOURNAL False)
+    if [[ "$USE_JOURNAL" == "True" ]]; then
+        iniset $conf_file $conf_section use_journal "True"
+        # if we are using the journal directly, our process id is already correct
+        iniset $conf_file $conf_section logging_debug_format_suffix \
+               "{{%(funcName)s %(pathname)s:%(lineno)d}}"
+    else
+        iniset $conf_file $conf_section logging_debug_format_suffix \
+               "{{(pid=%(process)d) %(funcName)s %(pathname)s:%(lineno)d}}"
+    fi
+
     iniset $conf_file $conf_section logging_context_format_string \
            "%(levelname)s %(name)s [%(request_id)s %(project_name)s %(user_name)s] %(instance)s%(message)s"
     iniset $conf_file $conf_section logging_default_format_string \
            "%(levelname)s %(name)s [-] %(instance)s%(color)s%(message)s"
-    iniset $conf_file $conf_section logging_debug_format_suffix \
-           "from (pid=%(process)d) %(funcName)s %(pathname)s:%(lineno)d"
     iniset $conf_file $conf_section logging_exception_prefix "ERROR %(name)s %(instance)s"
 }
 

From 401de4d20cb204b811dd5877e9e7688d72eb6e39 Mon Sep 17 00:00:00 2001
From: TommyLike <tommylikehu@gmail.com>
Date: Thu, 4 May 2017 17:56:22 +0800
Subject: [PATCH 0948/2409] Copy 'resource_filters.json' file to cinder config
 folder

Cinder use 'resource_filters.json' to config allowed filters,
copy the new added json file when set config files.

Change-Id: I397cb5859e2b3349af3cb07ee02b6463c6eccc35
Depends-On: 27aeba0b5d3cf64286125937e8336ba1d3b26b16
---
 lib/cinder | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/cinder b/lib/cinder
index 9fc25c75bb..e3a687b4f2 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -244,6 +244,10 @@ function configure_cinder {
 
     configure_rootwrap cinder
 
+    if [[ -f "$CINDER_DIR/etc/cinder/resource_filters.json" ]]; then
+        cp -p "$CINDER_DIR/etc/cinder/resource_filters.json" "$CINDER_CONF_DIR/resource_filters.json"
+    fi
+
     cp $CINDER_DIR/etc/cinder/api-paste.ini $CINDER_API_PASTE_INI
 
     inicomment $CINDER_API_PASTE_INI filter:authtoken auth_host

From 148d58c3519aca4723edd6eb59fc7150b92e74d7 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 4 May 2017 13:08:25 -0400
Subject: [PATCH 0949/2409] Make devstack fail early for common systemd
 pitfalls

There are a couple of issues that have ended up being hit by devstack
plugin authors which we can detect and error in a much nicer way
instead of them having a cryptic systemd failure.

Change-Id: I45e4ac363aeefb4503015f9e1b57c58f79b58f40
---
 functions-common | 33 ++++++++++++++++++++++++++++++++-
 1 file changed, 32 insertions(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index 90f540017c..fe608b4a48 100644
--- a/functions-common
+++ b/functions-common
@@ -1480,10 +1480,41 @@ function write_uwsgi_user_unit_file {
     $SYSTEMCTL daemon-reload
 }
 
+function _common_systemd_pitfalls {
+    local cmd=$1
+    # do some sanity checks on $cmd to see things we don't expect to work
+
+    if [[ "$cmd" =~ "sudo" ]]; then
+        local msg=<<EOF
+You are trying to use run_process with sudo, this is not going to work under systemd.
+
+If you need to run a service as a user other than $STACK_USER call it with:
+
+   run_process \$name \$cmd \$group \$user
+EOF
+        die $LINENO $msg
+    fi
+
+    if [[ ! "$cmd" =~ ^/ ]]; then
+        local msg=<<EOF
+The cmd="$cmd" does not start with an absolute path. It will fail to
+start under systemd.
+
+Please update your run_process stanza to have an absolute path.
+EOF
+        die $LINENO $msg
+    fi
+
+}
+
+# Helper function to build a basic unit file and run it under systemd.
 function _run_under_systemd {
     local service=$1
     local command="$2"
     local cmd=$command
+    # sanity check the command
+    _common_systemd_pitfalls "$cmd"
+
     local systemd_service="devstack@$service.service"
     local group=$3
     local user=${4:-$STACK_USER}
@@ -1527,7 +1558,7 @@ function is_running {
 # If an optional group is provided sg will be used to run the
 # command as that group.
 # Uses globals ``USE_SCREEN``
-# run_process service "command-line" [group]
+# run_process service "command-line" [group] [user]
 function run_process {
     local service=$1
     local command="$2"

From c2200bc880f8d7ea4b6489f8daafa9c02136e174 Mon Sep 17 00:00:00 2001
From: "Ian Y. Choi" <ianyrchoi@gmail.com>
Date: Thu, 4 May 2017 21:13:29 +0200
Subject: [PATCH 0950/2409] Fix systemctl option: removes --unit option in doc

--unit option is for journalctl, not systemctl.
Just executing systemctl without "--unit=" works.

Change-Id: I9752561332e62ec6327b17b12d2d868892718041
---
 doc/source/development.rst | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/doc/source/development.rst b/doc/source/development.rst
index a3f2747604..957de9b0e1 100644
--- a/doc/source/development.rst
+++ b/doc/source/development.rst
@@ -14,7 +14,7 @@ with.
 
 .. code-block:: bash
 
-   sudo systemctl status --unit="devstack@*"
+   sudo systemctl status "devstack@*"
 
 To learn more about the basics of systemd, see :doc:`/systemd`
 
@@ -27,14 +27,14 @@ and then restart the affected daemons.
 
 .. code-block:: bash
 
-   sudo systemctl restart --unit=devstack@n-cpu.service
+   sudo systemctl restart devstack@n-cpu.service
 
 If your change impacts more than one daemon you can restart by
 wildcard as well.
 
 .. code-block:: bash
 
-   sudo systemctl restart --unit="devstack@n-*"
+   sudo systemctl restart "devstack@n-*"
 
 .. warning::
 
@@ -112,6 +112,6 @@ You can do that with wildcards such as
 
 .. code-block:: bash
 
-   sudo systemctl restart --unit="devstack@n-*"
+   sudo systemctl restart "devstack@n-*"
 
 which will restart all nova services.

From e264b4ab323385e8c861da79c96cf9d643ca395d Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 4 May 2017 15:56:37 -0400
Subject: [PATCH 0951/2409] disable journald rate limiting

systemd-journald has rate limiting built in, but that's not sufficient
for the level of logging of OpenStack services during test
runs. Disable the rate limiting so that no log messages are lost.

Change-Id: I64599aba74c5a39276bb8f946cd236600b9cc81b
---
 stack.sh | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/stack.sh b/stack.sh
index 2c10200f75..9fdb47ecbd 100755
--- a/stack.sh
+++ b/stack.sh
@@ -748,6 +748,10 @@ source $TOP_DIR/tools/fixup_stuff.sh
 
 if [[ "$USE_SYSTEMD" == "True" ]]; then
     pip_install_gr systemd-python
+    # the default rate limit of 1000 messages / 30 seconds is not
+    # sufficient given how verbose our logging is.
+    iniset -sudo /etc/systemd/journald.conf "Journal" "RateLimitBurst" "0"
+    sudo systemctl restart systemd-journald
 fi
 
 # Virtual Environment

From eaadffe07b0516f103321c84013b755061ba7fb5 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 4 May 2017 16:05:19 -0400
Subject: [PATCH 0952/2409] Always have ./clean.sh run ./unstack.sh

There was detection code in clean.sh to only run it if a screen
session was found, but in systemd world, that's obviously not
true. This was causing me (and others) substantial confusion.

Change-Id: I204e94cd86b8c67012aabfca74796e593151c3a4
---
 clean.sh | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/clean.sh b/clean.sh
index 90b21eb353..ef38fbf4f8 100755
--- a/clean.sh
+++ b/clean.sh
@@ -64,13 +64,8 @@ if [[ -d $TOP_DIR/extras.d ]]; then
     done
 fi
 
-# See if there is anything running...
-# need to adapt when run_service is merged
-SESSION=$(screen -ls | awk '/[0-9].stack/ { print $1 }')
-if [[ -n "$SESSION" ]]; then
-    # Let unstack.sh do its thing first
-    $TOP_DIR/unstack.sh --all
-fi
+# Let unstack.sh do its thing first
+$TOP_DIR/unstack.sh --all
 
 # Run extras
 # ==========

From f41bf2a92fab6ffcea48d8b295c04ace4d2fa7ff Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Fri, 5 May 2017 07:50:52 -0400
Subject: [PATCH 0953/2409] Set SyslogIdentifier for uwsgi processes

Now that we aren't using native journal messages by default, the
syslog identifier of all the uwsgi processes is the same. We should be
more explicit with those.

Change-Id: Id5406d02407b022d4016517c2e18890973876d88
---
 functions-common | 1 +
 1 file changed, 1 insertion(+)

diff --git a/functions-common b/functions-common
index 90f540017c..c3f37b9493 100644
--- a/functions-common
+++ b/functions-common
@@ -1463,6 +1463,7 @@ function write_uwsgi_user_unit_file {
     mkdir -p $SYSTEMD_DIR
 
     iniset -sudo $unitfile "Unit" "Description" "Devstack $service"
+    iniset -sudo $unitfile "Service" "SyslogIdentifier" "$service"
     iniset -sudo $unitfile "Service" "User" "$user"
     iniset -sudo $unitfile "Service" "ExecStart" "$command"
     iniset -sudo $unitfile "Service" "Type" "notify"

From 621704f4b3503b2509db18a9a0db134d54789fab Mon Sep 17 00:00:00 2001
From: Mike Perez <thingee@gmail.com>
Date: Fri, 5 May 2017 08:59:25 -0700
Subject: [PATCH 0954/2409] Stop setting osapi_volume_base_URL

This option is a duplicate of public_endpoint for Cinder.

Change-Id: I8aee1b9f93a09d2e92bde80c0e413e1540723bac
Depends-On: I2a74af7906d14cbc49b8cf0a88c344ca30fcbd26
---
 lib/cinder | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/cinder b/lib/cinder
index 9fc25c75bb..b3de1915e4 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -319,7 +319,6 @@ function configure_cinder {
         # Set the service port for a proxy to take the original
         iniset $CINDER_CONF DEFAULT osapi_volume_listen_port $CINDER_SERVICE_PORT_INT
         iniset $CINDER_CONF DEFAULT public_endpoint $CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT
-        iniset $CINDER_CONF DEFAULT osapi_volume_base_URL $CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT
     fi
 
     if [ "$SYSLOG" != "False" ]; then

From 1df17c94f512f0d1a084ba70cc0d4feb05feb8fb Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@midokura.com>
Date: Mon, 1 May 2017 17:00:42 +0900
Subject: [PATCH 0955/2409] lib/neutron: Don't assume plugin config is provided
 by neutron repo

It isn't the case for plugins provided by subprojects.

Change-Id: Ic28a9da9f11355e5e1eae5db9b2d4ee6ed081b55
---
 lib/neutron | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/lib/neutron b/lib/neutron
index 492a0ee8fb..fd08a125be 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -135,7 +135,11 @@ function configure_neutron_new {
 
     mkdir -p $NEUTRON_CORE_PLUGIN_CONF_PATH
 
-    cp $NEUTRON_DIR/etc/neutron/plugins/$NEUTRON_CORE_PLUGIN/$NEUTRON_CORE_PLUGIN_CONF_FILENAME.sample $NEUTRON_CORE_PLUGIN_CONF
+    # NOTE(yamamoto): A decomposed plugin should prepare the config file in
+    # its devstack plugin.
+    if [ -f $NEUTRON_DIR/etc/neutron/plugins/$NEUTRON_CORE_PLUGIN/$NEUTRON_CORE_PLUGIN_CONF_FILENAME.sample ]; then
+        cp $NEUTRON_DIR/etc/neutron/plugins/$NEUTRON_CORE_PLUGIN/$NEUTRON_CORE_PLUGIN_CONF_FILENAME.sample $NEUTRON_CORE_PLUGIN_CONF
+    fi
 
     iniset $NEUTRON_CONF database connection `database_connection_url neutron`
     iniset $NEUTRON_CONF DEFAULT state_path $NEUTRON_STATE_PATH

From f28e7ef6ba48030d7bc5c6ea27f28b8a1fc281e9 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Sun, 7 May 2017 22:02:10 -0400
Subject: [PATCH 0956/2409] uninstall libvirt-python and reinstall

libvirt-python compiles against the currently installed libvirt. If
you upgrade that, it needs to rebuild, however it won't change
versions, so pip install just noops. Force an uninstall / reinstall of
it every time to handle potential upgrades of libvirt.

Change-Id: If34541b34aa6d55eedaf6c603fd1fe92eb887308
---
 inc/python                         | 14 ++++++++++++++
 lib/nova_plugins/functions-libvirt |  3 +++
 2 files changed, 17 insertions(+)

diff --git a/inc/python b/inc/python
index 2443c4d465..a004217b4a 100644
--- a/inc/python
+++ b/inc/python
@@ -351,6 +351,20 @@ function pip_install {
     return $result
 }
 
+function pip_uninstall {
+    local name=$1
+    if [[ -n ${PIP_VIRTUAL_ENV:=} && -d ${PIP_VIRTUAL_ENV} ]]; then
+        local cmd_pip=$PIP_VIRTUAL_ENV/bin/pip
+        local sudo_pip="env"
+    else
+        local cmd_pip
+        cmd_pip=$(get_pip_command $PYTHON2_VERSION)
+        local sudo_pip="sudo -H"
+    fi
+    # don't error if we can't uninstall, it might not be there
+    $sudo_pip $cmd_pip uninstall $name || /bin/true
+}
+
 # get version of a package from global requirements file
 # get_from_global_requirements <package>
 function get_from_global_requirements {
diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index 47605af991..326c8bf4ae 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -67,6 +67,8 @@ function install_libvirt {
         else
             install_package libvirt-clients libvirt-daemon-system libvirt-dev
         fi
+        # uninstall in case the libvirt version changed
+        pip_uninstall libvirt-python
         pip_install_gr libvirt-python
         #pip_install_gr <there-si-no-guestfs-in-pypi>
     elif is_fedora || is_suse; then
@@ -84,6 +86,7 @@ function install_libvirt {
         fi
 
         install_package libvirt libvirt-devel
+        pip_uninstall libvirt-python
         pip_install_gr libvirt-python
     fi
 

From db8a199b309e22f1341186517c00ec875ae421bb Mon Sep 17 00:00:00 2001
From: vmud213 <vinay50muddu@yahoo.com>
Date: Thu, 11 May 2017 09:33:43 +0000
Subject: [PATCH 0957/2409] Add files/ironic-inspector* to .gitignore

When ironic-inspector is enabled through devstack, these two files
are created which needs to be masked.

Change-Id: I7a3db6fd6197da20cca1e938727d54195957ac18
Closes-Bug: #1690105
---
 .gitignore | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.gitignore b/.gitignore
index d1781bc730..7967e14a19 100644
--- a/.gitignore
+++ b/.gitignore
@@ -23,6 +23,7 @@ files/images
 files/pip-*
 files/get-pip.py*
 files/ir-deploy*
+files/ironic-inspector*
 local.conf
 local.sh
 localrc

From f24e29920b9ec40e924c71bbe1999e027d61390e Mon Sep 17 00:00:00 2001
From: Angel Noam <noama@mellanox.com>
Date: Thu, 11 May 2017 15:13:29 +0300
Subject: [PATCH 0958/2409] Add support for image name end with .raw

Change-Id: If3bd42825a29755fa8e68fa5661d068c6f0019d2
---
 functions | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/functions b/functions
index 8968a1861b..f842f63038 100644
--- a/functions
+++ b/functions
@@ -310,6 +310,11 @@ function upload_image {
             disk_format=qcow2
             container_format=bare
             ;;
+        *.raw)
+            image_name=$(basename "$image" ".raw")
+            disk_format=raw
+            container_format=bare
+            ;;
         *.iso)
             image_name=$(basename "$image" ".iso")
             disk_format=iso

From 2a6112ea9ab698714c6b4e92ddb829e2d4574a7c Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Fri, 12 May 2017 10:16:33 -0700
Subject: [PATCH 0959/2409] Document testing of new devstack features

At the Boston 2017 Summit I had mentioned that the pattern of using non
voting/experimental jobs was not working for getting new features into
Devstack. It is slow and leads people to being too conservative when it
comes to pushing new things in. Instead I suggested that since Devstack
changes are self testing we add the features, have change that enables
the feature, and if that changes passes we move forward with merging
(assuming code review is fine and necessary communication is done).

Document this process in the HACKING file so that we have something we
can point to when people want to add a new experimental job for every
new little thing (ipv6, tls, systemd, etc).

Change-Id: I5190cc3d3de4e81d52748347306133b5034d5531
---
 HACKING.rst | 25 ++++++++++++++++++++++++-
 1 file changed, 24 insertions(+), 1 deletion(-)

diff --git a/HACKING.rst b/HACKING.rst
index b76cb6c4a7..fc67f09a7b 100644
--- a/HACKING.rst
+++ b/HACKING.rst
@@ -322,7 +322,7 @@ Variables and Functions
 
 
 Review Criteria
-===============
+---------------
 
 There are some broad criteria that will be followed when reviewing
 your change
@@ -364,3 +364,26 @@ your change
 
 * **Reviewers** -- please see ``MAINTAINERS.rst`` for a list of people
   that should be added to reviews of various sub-systems.
+
+
+Making Changes, Testing, and CI
+-------------------------------
+
+Changes to Devstack are tested by automated continuous integration jobs
+that run on a variety of Linux Distros using a handful of common
+configurations. What this means is that every change to Devstack is
+self testing. One major benefit of this is that developers do not
+typically need to add new non voting test jobs to add features to
+Devstack. Instead the features can be added, then if testing passes
+with the feature enabled the change is ready to merge (pending code
+review).
+
+A concrete example of this was the switch from screen based service
+management to systemd based service management. No new jobs were
+created for this. Instead the features were added to devstack, tested
+locally and in CI using a change that enabled the feature, then once
+the enabling change was passing and the new behavior communicated and
+documented it was merged.
+
+Using this process has been proven to be effective and leads to
+quicker implementation of desired features.

From 84ce2f1c9b0e2aaba95015aea8ed9acaacb62e1b Mon Sep 17 00:00:00 2001
From: Doug Hellmann <doug@doughellmann.com>
Date: Tue, 9 May 2017 07:35:08 -0400
Subject: [PATCH 0960/2409] add a table of contents

Add a table of contents help readers find the information they need
without having to read all of the prose on every page. Remove the
site-map file, which doesn't appear to be linked anywhere.

Change-Id: Ib5761c9cfdd5a083df562413d727cb4ac7547c9e
Signed-off-by: Doug Hellmann <doug@doughellmann.com>
---
 doc/source/index.rst    |  9 +++++++++
 doc/source/site-map.rst | 24 ------------------------
 2 files changed, 9 insertions(+), 24 deletions(-)
 delete mode 100644 doc/source/site-map.rst

diff --git a/doc/source/index.rst b/doc/source/index.rst
index cbd697112a..47087c5a0b 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -142,3 +142,12 @@ services, features, and configuration not present in base devstack.
 Get :doc:`the big picture <overview>` of what we are trying to do
 with devstack, and help us by :doc:`contributing to the project
 <hacking>`.
+
+Contents
+--------
+
+.. toctree::
+   :glob:
+   :maxdepth: 2
+
+   *
diff --git a/doc/source/site-map.rst b/doc/source/site-map.rst
deleted file mode 100644
index 022cc73959..0000000000
--- a/doc/source/site-map.rst
+++ /dev/null
@@ -1,24 +0,0 @@
-:orphan:
-
-.. the TOC on the front page actually makes the document a lot more
-   confusing. This lets us bury a toc which we can link in when
-   appropriate.
-
-==========
- Site Map
-==========
-
-.. toctree::
-   :glob:
-   :maxdepth: 3
-
-   overview
-   configuration
-   networking
-   plugins
-   plugin-registry
-   faq
-   development
-   hacking
-   guides
-   systemd

From 1f55d38911cec5e597e7b10cc7324804c2ba063f Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Tue, 16 May 2017 08:50:53 -0700
Subject: [PATCH 0961/2409] Add systemd ulimit override function and set an
 override for NOFILE

This sets our default ulimit NOFILE to 2048, which is double what we
set things like mysql'd max_connections to.

Change-Id: I5126bed1e6b9f8c64db00eae4151ac61e47b1bf8
---
 functions | 16 ++++++++++++++++
 stack.sh  |  3 +++
 stackrc   |  3 +++
 3 files changed, 22 insertions(+)

diff --git a/functions b/functions
index f842f63038..bc2d26b496 100644
--- a/functions
+++ b/functions
@@ -720,6 +720,22 @@ function enable_kernel_bridge_firewall {
 }
 
 
+# Set a systemd system override
+#
+# This sets a system-side override in system.conf. A per-service
+# override would be /etc/systemd/system/${service}.service/override.conf
+function set_systemd_override {
+    local key="$1"
+    local value="$2"
+
+    local sysconf="/etc/systemd/system.conf"
+    iniset -sudo "${sysconf}" "Manager" "$key" "$value"
+    echo "Set systemd system override for ${key}=${value}"
+
+    sudo systemctl daemon-reload
+}
+
+
 # Restore xtrace
 $_XTRACE_FUNCTIONS
 
diff --git a/stack.sh b/stack.sh
index d6837ef5d0..e83eaea326 100755
--- a/stack.sh
+++ b/stack.sh
@@ -765,6 +765,9 @@ install_infra
 # Phase: pre-install
 run_phase stack pre-install
 
+# NOTE(danms): Set global limits before installing anything
+set_systemd_override DefaultLimitNOFILE ${ULIMIT_NOFILE}
+
 install_rpc_backend
 restart_rpc_backend
 
diff --git a/stackrc b/stackrc
index 35856ca73e..ea1bcdf3f0 100644
--- a/stackrc
+++ b/stackrc
@@ -925,6 +925,9 @@ fi
 # ``LOGDIR`` is always set at this point so it is not useful as a 'enable' for service logs
 # ``SCREEN_LOGDIR`` may be set, it is useful to enable the compat symlinks
 
+# System-wide ulimit file descriptors override
+ULIMIT_NOFILE=${ULIMIT_NOFILE:-2048}
+
 # Local variables:
 # mode: shell-script
 # End:

From 954fd1b729f792dc6cbc470285a5e147053147a8 Mon Sep 17 00:00:00 2001
From: Brian Haley <bhaley@redhat.com>
Date: Tue, 16 May 2017 12:24:45 -0400
Subject: [PATCH 0962/2409] Use -y with 'pip uninstall'

'pip uninstall' will hang running stack.sh if it has to
prompt the user for input, use -y.

Change-Id: Ic94639e444b87fd3538463d5a51c01a0208a2ab2
Closes-bug: #1691172
---
 inc/python | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/inc/python b/inc/python
index a004217b4a..4c443d6a00 100644
--- a/inc/python
+++ b/inc/python
@@ -362,7 +362,7 @@ function pip_uninstall {
         local sudo_pip="sudo -H"
     fi
     # don't error if we can't uninstall, it might not be there
-    $sudo_pip $cmd_pip uninstall $name || /bin/true
+    $sudo_pip $cmd_pip uninstall -y $name || /bin/true
 }
 
 # get version of a package from global requirements file

From 8cd310d7638843f07f4c88adaf3aed9db7668073 Mon Sep 17 00:00:00 2001
From: Eric Fried <efried@us.ibm.com>
Date: Tue, 16 May 2017 13:52:03 -0500
Subject: [PATCH 0963/2409] Restore log colors under devstack/systemd

One of the pending issues with the conversion to systemd was the loss of
log coloring.  It turns out that journalctl by default strips out
characters it considers "unprintable" - including the color codes
emitted by the old-style logging.  However, journalctl can be made to
print them by adding the `-a` flag.

This change makes devstack's log formatter conf settings include color
codes like the old screen-based setup used to

We also remove stackrc's setting of JOURNALCTL_F, whose usage was
removed via I6af6d1857effaf662a9d72bd394864934eacbe70.

Change-Id: I2401e267913a24d18dae355aa933072dbbdab1d8
---
 doc/source/systemd.rst | 18 +++++++++++-------
 functions              | 15 ++++++---------
 stackrc                |  2 --
 3 files changed, 17 insertions(+), 18 deletions(-)

diff --git a/doc/source/systemd.rst b/doc/source/systemd.rst
index efe79e4b0c..60a7719262 100644
--- a/doc/source/systemd.rst
+++ b/doc/source/systemd.rst
@@ -109,6 +109,17 @@ Use higher precision time stamps::
 
   journalctl -f -o short-precise --unit devstack@n-cpu.service
 
+By default, journalctl strips out "unprintable" characters, including
+ASCII color codes. To keep the color codes (which can be interpreted by
+an appropriate terminal/pager - e.g. ``less``, the default)::
+
+  journalctl -a --unit devstack@n-cpu.service
+
+When outputting to the terminal using the default pager, long lines
+appear to be truncated, but horizontal scrolling is supported via the
+left/right arrow keys.
+
+See ``man 1 journalctl`` for more.
 
 Known Issues
 ============
@@ -137,13 +148,6 @@ system units.
 Future Work
 ===========
 
-log colorizing
---------------
-
-We lose log colorization through this process. We might want to build
-a custom colorizer that we could run journalctl output through
-optionally for people.
-
 user units
 ----------
 
diff --git a/functions b/functions
index f842f63038..9bb64cc3c4 100644
--- a/functions
+++ b/functions
@@ -616,21 +616,18 @@ function setup_systemd_logging {
     # request-id. However, there may be an eventlet interaction here,
     # so going off for now.
     USE_JOURNAL=$(trueorfalse USE_JOURNAL False)
+    local pidstr=""
     if [[ "$USE_JOURNAL" == "True" ]]; then
         iniset $conf_file $conf_section use_journal "True"
         # if we are using the journal directly, our process id is already correct
-        iniset $conf_file $conf_section logging_debug_format_suffix \
-               "{{%(funcName)s %(pathname)s:%(lineno)d}}"
     else
-        iniset $conf_file $conf_section logging_debug_format_suffix \
-               "{{(pid=%(process)d) %(funcName)s %(pathname)s:%(lineno)d}}"
+        pidstr="(pid=%(process)d) "
     fi
+    iniset $conf_file $conf_section logging_debug_format_suffix "{{${pidstr}%(funcName)s %(pathname)s:%(lineno)d}}"
 
-    iniset $conf_file $conf_section logging_context_format_string \
-           "%(levelname)s %(name)s [%(request_id)s %(project_name)s %(user_name)s] %(instance)s%(message)s"
-    iniset $conf_file $conf_section logging_default_format_string \
-           "%(levelname)s %(name)s [-] %(instance)s%(color)s%(message)s"
-    iniset $conf_file $conf_section logging_exception_prefix "ERROR %(name)s %(instance)s"
+    iniset $conf_file $conf_section logging_context_format_string "%(color)s%(levelname)s %(name)s [%(request_id)s %(project_name)s %(user_name)s%(color)s] %(instance)s%(color)s%(message)s"
+    iniset $conf_file $conf_section logging_default_format_string "%(color)s%(levelname)s %(name)s [-%(color)s] %(instance)s%(color)s%(message)s"
+    iniset $conf_file $conf_section logging_exception_prefix "ERROR %(name)s %(instance)s"
 }
 
 function setup_standard_logging_identity {
diff --git a/stackrc b/stackrc
index 35856ca73e..2a2007f581 100644
--- a/stackrc
+++ b/stackrc
@@ -100,11 +100,9 @@ USER_UNITS=$(trueorfalse False USER_UNITS)
 if [[ "$USER_UNITS" == "True" ]]; then
     SYSTEMD_DIR="$HOME/.local/share/systemd/user"
     SYSTEMCTL="systemctl --user"
-    JOURNALCTL_F="journalctl -f -o short-precise --user-unit"
 else
     SYSTEMD_DIR="/etc/systemd/system"
     SYSTEMCTL="sudo systemctl"
-    JOURNALCTL_F="journalctl -f -o short-precise --unit"
 fi
 
 

From d1fe0e62e77b2eaf711e0b4c157dc571be9ad13e Mon Sep 17 00:00:00 2001
From: Kevin Benton <kevin@benton.pub>
Date: Tue, 16 May 2017 22:27:58 -0700
Subject: [PATCH 0964/2409] Always setup libvirt for tap devices when using
 Neutron

This logic has been tied to OVS since it was introduced in [1] and
revised in [2]. However, many other backends may use tap devices that
aren't related to OVS, such as Calico[3] and Linux Bridge after [4]
merges.

This patch just removes the dependency on OVS specifically so
/dev/net/tun is added to cgroups whenever any Neutron backend is used.
This is done in other deployment tools like Juju[5] so it's not
unprecedented.

1. Ifab268f739b004db13024633e8abeb17691b9e46
2. Ic1da132fa421f1c70c10a319ee3239831b0f956f
3.
http://docs.projectcalico.org/master/getting-started/openstack/installation/ubuntu#compute-node-install
4. I23c5faaeab69aede1fd038a36f4a0b8f928498ce
5.
https://github.com/openstack/charm-nova-compute/blob/2790f81ecd32d9962617c4c3126621fffdc318a0/templates/qemu.conf

Change-Id: I075595158d8f3b5a6811c4794aa7b91912940db5
Partial-Bug: #1675343
---
 lib/nova_plugins/functions-libvirt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index 326c8bf4ae..3e38b898ec 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -98,7 +98,7 @@ function install_libvirt {
 # Configures the installed libvirt system so that is accessible by
 # STACK_USER via qemu:///system with management capabilities.
 function configure_libvirt {
-    if is_service_enabled neutron && is_neutron_ovs_base_plugin && ! sudo grep -q '^cgroup_device_acl' $QEMU_CONF; then
+    if is_service_enabled neutron && ! sudo grep -q '^cgroup_device_acl' $QEMU_CONF; then
         # Add /dev/net/tun to cgroup_device_acls, needed for type=ethernet interfaces
         cat <<EOF | sudo tee -a $QEMU_CONF
 cgroup_device_acl = [

From 54a8dc291f271c6782a7381d6f981223fdabd459 Mon Sep 17 00:00:00 2001
From: Isaac Beckman <isaacb@il.ibm.com>
Date: Wed, 17 May 2017 14:18:18 +0300
Subject: [PATCH 0965/2409] cleanup: remove DEVSTACK_CINDER_SECURE_DELETE

DEVSTACK_CINDER_SECURE_DELETE is deprecated from liberty release.
This should have been removed after kilo-eol

Change-Id: I82c15a19f8fe0326d4a5c2a076baa6d3e53fcf32
---
 lib/cinder              | 14 --------------
 lib/cinder_backends/lvm |  3 ---
 2 files changed, 17 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 9fc25c75bb..60379475f7 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -84,20 +84,6 @@ CINDER_LVM_TYPE=${CINDER_LVM_TYPE:-default}
 # CINDER_ENABLED_BACKENDS=${CINDER_ENABLED_BACKENDS:-lvm:lvmdriver-1,lvm:lvmdriver-2}
 CINDER_ENABLED_BACKENDS=${CINDER_ENABLED_BACKENDS:-lvm:lvmdriver-1}
 
-
-# Should cinder perform secure deletion of volumes?
-# Defaults to zero. Can also be set to none or shred.
-# This was previously CINDER_SECURE_DELETE (True or False).
-# Equivalents using CINDER_VOLUME_CLEAR are zero and none, respectively.
-# Set to none to avoid this bug when testing:
-# https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1023755
-if [[ -n $CINDER_SECURE_DELETE ]]; then
-    CINDER_SECURE_DELETE=$(trueorfalse True CINDER_SECURE_DELETE)
-    if [[ $CINDER_SECURE_DELETE == "False" ]]; then
-        CINDER_VOLUME_CLEAR_DEFAULT="none"
-    fi
-    deprecated "Configure secure Cinder volume deletion using CINDER_VOLUME_CLEAR instead of CINDER_SECURE_DELETE."
-fi
 CINDER_VOLUME_CLEAR=${CINDER_VOLUME_CLEAR:-${CINDER_VOLUME_CLEAR_DEFAULT:-zero}}
 CINDER_VOLUME_CLEAR=$(echo ${CINDER_VOLUME_CLEAR} | tr '[:upper:]' '[:lower:]')
 
diff --git a/lib/cinder_backends/lvm b/lib/cinder_backends/lvm
index d927f9cd6b..03e188029f 100644
--- a/lib/cinder_backends/lvm
+++ b/lib/cinder_backends/lvm
@@ -53,9 +53,6 @@ function configure_cinder_backend_lvm {
     iniset $CINDER_CONF $be_name iscsi_helper "$CINDER_ISCSI_HELPER"
     iniset $CINDER_CONF $be_name lvm_type "$CINDER_LVM_TYPE"
 
-    if [[ "$CINDER_SECURE_DELETE" == "False" ]]; then
-        iniset $CINDER_CONF $be_name volume_clear none
-    fi
 }
 
 # init_cinder_backend_lvm - Initialize volume group

From fc572a5da0cad4f0f6f247abfe835a5948d3aa47 Mon Sep 17 00:00:00 2001
From: melanie witt <melwittt@gmail.com>
Date: Tue, 16 May 2017 23:04:46 +0000
Subject: [PATCH 0966/2409] Add --tcp option to dstat command for connection
 stats

This enables tcp stats (listen, established, syn, time_wait, close) in
dstat to allow us to get a high-level view of performance changes in
the system during gate runs.

Change-Id: Ifbffbed22446e7e6a3b825c18266b63d2f2e7718
---
 tools/dstat.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/dstat.sh b/tools/dstat.sh
index ae7306ecb7..01c6d9b7e9 100755
--- a/tools/dstat.sh
+++ b/tools/dstat.sh
@@ -13,10 +13,10 @@
 LOGDIR=$1
 
 # Command line arguments for primary DStat process.
-DSTAT_OPTS="-tcmndrylpg --top-cpu-adv --top-io-adv --top-mem --swap"
+DSTAT_OPTS="-tcmndrylpg --top-cpu-adv --top-io-adv --top-mem --swap --tcp"
 
 # Command-line arguments for secondary background DStat process.
-DSTAT_CSV_OPTS="-tcmndrylpg --output $LOGDIR/dstat-csv.log"
+DSTAT_CSV_OPTS="-tcmndrylpg --tcp --output $LOGDIR/dstat-csv.log"
 
 # Execute and background the secondary dstat process and discard its output.
 dstat $DSTAT_CSV_OPTS >& /dev/null &

From 00ff904b09e07880a274cc9b0cf35b6433dc5877 Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Fri, 19 May 2017 13:40:56 +0100
Subject: [PATCH 0967/2409] stack: Workaround libvirt issue with multiple of 16
 byte fixed_key values

Unable to use LUKS passphrase that is exactly 16 bytes long
https://bugzilla.redhat.com/show_bug.cgi?id=1447297

Change-Id: I565339762549b076119ffedb6b83abfa12977f5e
---
 stack.sh | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index 9fdb47ecbd..5b73291bcf 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1253,8 +1253,13 @@ if is_service_enabled g-reg; then
 fi
 
 # Create a randomized default value for the key manager's fixed_key
+# NOTE(lyarwood): This is currently set to 36 as a workaround to the following
+# libvirt bug that incorrectly pads passphrases that are a multiple of 16 bytes
+# in length.
+# Unable to use LUKS passphrase that is exactly 16 bytes long
+# https://bugzilla.redhat.com/show_bug.cgi?id=1447297
 if is_service_enabled nova; then
-    iniset $NOVA_CONF key_manager fixed_key $(generate_hex_string 32)
+    iniset $NOVA_CONF key_manager fixed_key $(generate_hex_string 36)
 fi
 
 # Launch the nova-api and wait for it to answer before continuing

From 4db30f9f05ad8aba9001d444313ee2915f86ecd1 Mon Sep 17 00:00:00 2001
From: Doug Hellmann <doug@doughellmann.com>
Date: Tue, 9 May 2017 07:35:45 -0400
Subject: [PATCH 0968/2409] update sphinx

Update sphinx to the version used to build the documentation elsewhere
and turn on the option to treat warnings as errors to ensure that no
poorly constructed rst is introduced. Cap sphinx<1.6.1, since that
version has a conflict with pbr right now.

Change-Id: I19b3332229e2094988cbf8968c42a0323194a209
Signed-off-by: Doug Hellmann <doug@doughellmann.com>
---
 setup.cfg | 1 +
 tox.ini   | 8 ++++----
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/setup.cfg b/setup.cfg
index 3487f6541b..73d22b5268 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -15,6 +15,7 @@ classifier =
 all_files = 1
 build-dir = doc/build
 source-dir = doc/source
+warning-is-error = 1
 
 [pbr]
 warnerrors = True
diff --git a/tox.ini b/tox.ini
index 55a06d0cae..cc7c5444a8 100644
--- a/tox.ini
+++ b/tox.ini
@@ -37,8 +37,8 @@ commands = bash -c "find {toxinidir}             \
 deps =
    Pygments
    docutils
-   sphinx>=1.1.2,<1.2
-   pbr>=0.6,!=0.7,<1.0
+   sphinx>=1.5.1,<1.6.1
+   pbr>=2.0.0,!=2.1.0
    oslosphinx
    nwdiag
    blockdiag
@@ -52,8 +52,8 @@ commands =
 
 [testenv:venv]
 deps =
-   pbr>=0.6,!=0.7,<1.0
-   sphinx>=1.1.2,<1.2
+   pbr>=2.0.0,!=2.1.0
+   sphinx>=1.5.1,<1.6.1
    oslosphinx
    blockdiag
    sphinxcontrib-blockdiag

From ac2ae8c04779e4ad78d3813b8bc4bc4200b6d686 Mon Sep 17 00:00:00 2001
From: Nir Magnezi <nmagnezi@redhat.com>
Date: Mon, 22 May 2017 12:40:57 +0300
Subject: [PATCH 0969/2409] Remove nova cert from devstack

As a followup to I2c78a0c6599b92040146cf9f0042cff8fd2509c3, the nova
cert service should be removed from devstack.

Without this fix, stacking will fail is USE_SCREEN=True

Change-Id: I115580352fa380b896bae290f9a4efbfe4ff0dfd
---
 doc/source/guides/devstack-with-lbaas-v2.rst | 2 +-
 lib/nova                                     | 3 +--
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/doc/source/guides/devstack-with-lbaas-v2.rst b/doc/source/guides/devstack-with-lbaas-v2.rst
index 21bea9973b..4ed64bf12f 100644
--- a/doc/source/guides/devstack-with-lbaas-v2.rst
+++ b/doc/source/guides/devstack-with-lbaas-v2.rst
@@ -45,7 +45,7 @@ Edit your ``local.conf`` to look like
     # Horizon
     ENABLED_SERVICES+=,horizon
     # Nova
-    ENABLED_SERVICES+=,n-api,n-crt,n-cpu,n-cond,n-sch
+    ENABLED_SERVICES+=,n-api,n-cpu,n-cond,n-sch
     # Glance
     ENABLED_SERVICES+=,g-api,g-reg
     # Neutron
diff --git a/lib/nova b/lib/nova
index de053ab389..e580abb4b0 100644
--- a/lib/nova
+++ b/lib/nova
@@ -878,7 +878,6 @@ function start_nova_rest {
     run_process n-cond "$NOVA_BIN_DIR/nova-conductor --config-file $compute_cell_conf"
     run_process n-cell-region "$NOVA_BIN_DIR/nova-cells --config-file $api_cell_conf"
     run_process n-cell-child "$NOVA_BIN_DIR/nova-cells --config-file $compute_cell_conf"
-    run_process n-crt "$NOVA_BIN_DIR/nova-cert --config-file $api_cell_conf"
 
     if is_service_enabled n-net; then
         if ! running_in_container; then
@@ -929,7 +928,7 @@ function stop_nova_rest {
     # Kill the nova screen windows
     # Some services are listed here twice since more than one instance
     # of a service may be running in certain configs.
-    for serv in n-api n-crt n-net n-sch n-novnc n-xvnc n-cauth n-spice n-cond n-cell n-cell n-api-meta n-sproxy; do
+    for serv in n-api n-net n-sch n-novnc n-xvnc n-cauth n-spice n-cond n-cell n-cell n-api-meta n-sproxy; do
         stop_process $serv
     done
 }

From 546656fc0543ec2bc5b422fd9eee17f1b8122758 Mon Sep 17 00:00:00 2001
From: Davanum Srinivas <davanum@gmail.com>
Date: Tue, 14 Mar 2017 07:05:19 -0400
Subject: [PATCH 0970/2409] etcd3 as a base service

ETCD_DOWNLOAD_URL is set to github url, in our CI, we can point
ETCD_DOWNLOAD_URL to a url in tarballs.openstack.org possibly
in devstack-gate

Download the etcd binaries and drop them into /opt/stack/bin and
use it from there. Cache the tgz for subsequent use (local workflow)

daemon-reload is called twice once from inside the write_user_unit_file
and then when we adjust the entries with additional things recommended
by the etcd team. We need a better way to do this in the future.

Added a TODO to verify the downloaded artifact later. The etcd team
posts gpg signature, we could verify that or run sha256sum and hard
code that in lib/etcd3 file. We would have to update it whenever we
bump the etcd3 version.

We use the public key "CoreOS Application Signing Key <security@coreos.com>"
with ID FC8A365E to verify the integrity of the downloaded file

Any jobs that need to be run on architectures where v3.1.7 is not available
should rey the v3.2.0-rcX release candidates. We can switch to v3.2.0
when it gets released.

Initial version of this code was borrowed from the dragonflow
repo:
http://git.openstack.org/cgit/openstack/dragonflow/tree/devstack

Change-Id: Ibbb430fb1dbf66942168e0cb52d990ab6a2eb8d7
---
 lib/etcd3  | 126 +++++++++++++++++++++++++++++++++++++++++++++++++++++
 stack.sh   |   6 +++
 stackrc    |   2 +-
 unstack.sh |   6 +++
 4 files changed, 139 insertions(+), 1 deletion(-)
 create mode 100644 lib/etcd3

diff --git a/lib/etcd3 b/lib/etcd3
new file mode 100644
index 0000000000..fa60a392c9
--- /dev/null
+++ b/lib/etcd3
@@ -0,0 +1,126 @@
+#!/bin/bash
+#
+# lib/etcd3
+#
+# Functions to control the installation and configuration of etcd 3.x
+# that provides a key-value store (and possibly other functions).
+
+# Dependencies:
+#
+# - ``functions`` file
+
+# ``stack.sh`` calls the entry points in this order:
+#
+# - start_etcd3
+# - stop_etcd3
+# - cleanup_etcd3
+
+# Save trace setting
+_XTRACE_ETCD3=$(set +o | grep xtrace)
+set +o xtrace
+
+
+# Defaults
+# --------
+
+# Set up default values for etcd
+ETCD_DOWNLOAD_URL=${ETCD_DOWNLOAD_URL:-https://github.com/coreos/etcd/releases/download}
+ETCD_VERSION=${ETCD_VERSION:-v3.1.7}
+ETCD_DATA_DIR="$DEST/data/etcd"
+ETCD_SYSTEMD_SERVICE="devstack@etcd.service"
+ETCD_BIN_DIR="$DEST/bin"
+
+if is_ubuntu ; then
+    UBUNTU_RELEASE_BASE_NUM=`lsb_release -r | awk '{print $2}' | cut -d '.' -f 1`
+fi
+
+# start_etcd3() - Starts to run the etcd process
+function start_etcd3 {
+    _install_etcd
+
+    local cmd="$ETCD_BIN_DIR/etcd"
+    cmd+=" --name $HOSTNAME --data-dir $ETCD_DATA_DIR"
+    cmd+=" --initial-cluster-state new --initial-cluster-token etcd-cluster-01"
+    cmd+=" --initial-cluster $HOSTNAME=http://$SERVICE_HOST:2380"
+    cmd+=" --initial-advertise-peer-urls http://$SERVICE_HOST:2380"
+    cmd+=" --advertise-client-urls http://$SERVICE_HOST:2379"
+    cmd+=" --listen-peer-urls http://0.0.0.0:2380 "
+    cmd+=" --listen-client-urls http://$SERVICE_HOST:2379"
+
+    local unitfile="$SYSTEMD_DIR/$ETCD_SYSTEMD_SERVICE"
+    write_user_unit_file $ETCD_SYSTEMD_SERVICE "$cmd" "" "root"
+
+    iniset -sudo $unitfile "Unit" "After" "network.target"
+    iniset -sudo $unitfile "Service" "Type" "notify"
+    iniset -sudo $unitfile "Service" "Restart" "on-failure"
+    iniset -sudo $unitfile "Service" "LimitNOFILE" "65536"
+
+    $SYSTEMCTL daemon-reload
+    $SYSTEMCTL enable $ETCD_SYSTEMD_SERVICE
+    $SYSTEMCTL start $ETCD_SYSTEMD_SERVICE
+}
+
+# stop_etcd3() stops the etcd3 process
+function stop_etcd3 {
+    $SYSTEMCTL stop $ETCD_SYSTEMD_SERVICE
+}
+
+function cleanup_etcd {
+    $SYSTEMCTL disable $ETCD_SYSTEMD_SERVICE
+
+    local unitfile="$SYSTEMD_DIR/$ETCD_SYSTEMD_SERVICE"
+    sudo rm -f $unitfile
+
+    $SYSTEMCTL daemon-reload
+
+    sudo rm -rf $ETCD_DATA_DIR
+}
+
+function _install_etcd {
+    echo "Installing etcd"
+
+    # Make sure etcd3 downloads the correct architecture
+    if is_arch "x86_64"; then
+        ETCD_ARCH="amd64"
+    elif is_arch "aarch64"; then
+        ETCD_ARCH="arm64"
+    elif is_arch "ppc64le"; then
+        ETCD_ARCH="ppc64le"
+    else
+        exit_distro_not_supported "invalid hardware type - $ETCD_ARCH"
+    fi
+
+    # Install the libraries needed. Note: tooz for example does not have a hard dependency on these libraries
+    pip_install etcd3
+    pip_install etcd3gw
+
+    # Create the necessary directories
+    sudo mkdir -p $ETCD_BIN_DIR
+    sudo mkdir -p $ETCD_DATA_DIR
+
+    # Download and cache the etcd tgz for subsequent use
+    if [ ! -f "$DEST/etcd/etcd-$ETCD_VERSION-linux-$ETCD_ARCH/etcd" ]; then
+        mkdir -p $DEST/etcd
+        ETCD_DOWNLOAD_FILE=etcd-$ETCD_VERSION-linux-$ETCD_ARCH.tar.gz
+        wget $ETCD_DOWNLOAD_URL/$ETCD_VERSION/$ETCD_DOWNLOAD_FILE -O $DEST/etcd/$ETCD_DOWNLOAD_FILE
+        wget $ETCD_DOWNLOAD_URL/$ETCD_VERSION/$ETCD_DOWNLOAD_FILE.asc -O $DEST/etcd/$ETCD_DOWNLOAD_FILE.asc
+
+        # use gpg to verify the artifact, use a backup key server in case the first one is down for some reason
+        gpg --keyserver hkps.pool.sks-keyservers.net --recv-key FC8A365E || gpg --keyserver pgpkeys.mit.edu --recv-key FC8A365E
+        gpg --verify $DEST/etcd/$ETCD_DOWNLOAD_FILE.asc $DEST/etcd/$ETCD_DOWNLOAD_FILE
+
+        tar xzvf $DEST/etcd/$ETCD_DOWNLOAD_FILE -C $DEST/etcd
+        sudo cp $DEST/etcd/etcd-$ETCD_VERSION-linux-$ETCD_ARCH/etcd $ETCD_BIN_DIR/etcd
+    fi
+    if [ ! -f "$ETCD_BIN_DIR/etcd" ]; then
+        sudo cp $DEST/etcd/etcd-$ETCD_VERSION-linux-$ETCD_ARCH/etcd $ETCD_BIN_DIR/etcd
+    fi
+}
+
+# Restore xtrace
+$_XTRACE_ETCD3
+
+# Tell emacs to use shell-script-mode
+## Local variables:
+## mode: shell-script
+## End:
diff --git a/stack.sh b/stack.sh
index e83eaea326..ecf068a4a9 100755
--- a/stack.sh
+++ b/stack.sh
@@ -574,6 +574,7 @@ source $TOP_DIR/lib/neutron
 source $TOP_DIR/lib/ldap
 source $TOP_DIR/lib/dstat
 source $TOP_DIR/lib/dlm
+source $TOP_DIR/lib/etcd3
 source $TOP_DIR/lib/os_brick
 
 # Extras Source
@@ -1043,6 +1044,11 @@ fi
 # A better kind of sysstat, with the top process per time slice
 start_dstat
 
+# Etcd
+# -----
+
+# etcd is a distributed key value store that provides a reliable way to store data across a cluster of machines
+start_etcd3
 
 # Keystone
 # --------
diff --git a/stackrc b/stackrc
index 41ff268bbe..9203f8b5b9 100644
--- a/stackrc
+++ b/stackrc
@@ -65,7 +65,7 @@ if ! isset ENABLED_SERVICES ; then
     # Dashboard
     ENABLED_SERVICES+=,horizon
     # Additional services
-    ENABLED_SERVICES+=,rabbit,tempest,mysql,dstat
+    ENABLED_SERVICES+=,rabbit,tempest,mysql,etcd3,dstat
 fi
 
 # Global toggle for enabling services under mod_wsgi. If this is set to
diff --git a/unstack.sh b/unstack.sh
index 485fed7f80..a9826f5a97 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -69,6 +69,7 @@ source $TOP_DIR/lib/swift
 source $TOP_DIR/lib/neutron
 source $TOP_DIR/lib/ldap
 source $TOP_DIR/lib/dstat
+source $TOP_DIR/lib/etcd3
 source $TOP_DIR/lib/dlm
 
 # Extras Source
@@ -162,6 +163,11 @@ if is_service_enabled neutron; then
     cleanup_neutron
 fi
 
+if is_service_enabled etcd3; then
+    stop_etcd3
+    cleanup_etcd3
+fi
+
 if is_service_enabled dstat; then
     stop_dstat
 fi

From 0d9fd60ad4a999ba3d57042b7bc861d86126651a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20J=C3=B3zefczyk?= <maciej.jozefczyk@corp.ovh.com>
Date: Tue, 23 May 2017 10:17:48 +0200
Subject: [PATCH 0971/2409] Change version of noVNC to stable

In master branch of noVNC project file vnc_auto.html was renamed to
vnc_lite.html Because of that nova-novncproxy looks for file that
actually doesn't exist.

We need to change branch of noVNC to latest stable, because other
projects are not ready yet to rename the path. Those projects
depends on noVNC package installed in system, but it is too old
for now for both CentOS (version 0.5) and Ubuntu (version 0.4).
The only way to make noVNC console working on Devstack is to change
the branch to stable one.

Unit test also has to be modified in order to ignore novnc repo
from checking against cloning non-master branch.

Change-Id: Iaf4761aedf93bc6b914a6a0c5cf1cfedcc29583c
Closes-bug: #1692513
---
 stackrc            | 2 +-
 tests/test_refs.sh | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/stackrc b/stackrc
index ea8b044faf..f96688bf6c 100644
--- a/stackrc
+++ b/stackrc
@@ -563,7 +563,7 @@ IRONIC_PYTHON_AGENT_BRANCH=${IRONIC_PYTHON_AGENT_BRANCH:-master}
 
 # a websockets/html5 or flash powered VNC console for vm instances
 NOVNC_REPO=${NOVNC_REPO:-https://github.com/kanaka/noVNC.git}
-NOVNC_BRANCH=${NOVNC_BRANCH:-master}
+NOVNC_BRANCH=${NOVNC_BRANCH:-stable/v0.6}
 
 # a websockets/html5 or flash powered SPICE console for vm instances
 SPICE_REPO=${SPICE_REPO:-http://anongit.freedesktop.org/git/spice/spice-html5.git}
diff --git a/tests/test_refs.sh b/tests/test_refs.sh
index bccca5dff7..65848cdc72 100755
--- a/tests/test_refs.sh
+++ b/tests/test_refs.sh
@@ -15,7 +15,7 @@
 
 echo "Ensuring we don't have crazy refs"
 
-REFS=`grep BRANCH stackrc | grep -v -- '-master'`
+REFS=`grep BRANCH stackrc | grep -v -- '-master' | grep -v 'NOVNC_BRANCH'`
 rc=$?
 if [[ $rc -eq 0 ]]; then
     echo "Branch defaults must be master. Found:"

From d8283fde660bee2d4a5f639197a6a7010988b269 Mon Sep 17 00:00:00 2001
From: Davanum Srinivas <davanum@gmail.com>
Date: Tue, 23 May 2017 22:12:39 -0400
Subject: [PATCH 0972/2409] Avoid installing etcd3 in subnodes

We need to handle this better, for now, just don't install
etcd in the sub nodes. We need to setup the proper clustering
mechanism if we want to have etcd3 running in multiple nodes

Change-Id: I8dd385e3c993942473e67d04367cdf74495dbeef
---
 lib/etcd3 | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/lib/etcd3 b/lib/etcd3
index fa60a392c9..2a4fa2a6af 100644
--- a/lib/etcd3
+++ b/lib/etcd3
@@ -36,6 +36,11 @@ fi
 
 # start_etcd3() - Starts to run the etcd process
 function start_etcd3 {
+    # Don't install in sub nodes (multinode scenario)
+    if [ "$SERVICE_HOST" != "$HOST_IP" ]; then
+        return
+    fi
+
     _install_etcd
 
     local cmd="$ETCD_BIN_DIR/etcd"
@@ -62,10 +67,20 @@ function start_etcd3 {
 
 # stop_etcd3() stops the etcd3 process
 function stop_etcd3 {
+    # Don't install in sub nodes (multinode scenario)
+    if [ "$SERVICE_HOST" != "$HOST_IP" ]; then
+        return
+    fi
+
     $SYSTEMCTL stop $ETCD_SYSTEMD_SERVICE
 }
 
 function cleanup_etcd {
+    # Don't install in sub nodes (multinode scenario)
+    if [ "$SERVICE_HOST" != "$HOST_IP" ]; then
+        return
+    fi
+
     $SYSTEMCTL disable $ETCD_SYSTEMD_SERVICE
 
     local unitfile="$SYSTEMD_DIR/$ETCD_SYSTEMD_SERVICE"

From 2715fd0b4acf44842ceb67760bbc348093e7d70d Mon Sep 17 00:00:00 2001
From: Lucian Petrut <lpetrut@cloudbasesolutions.com>
Date: Wed, 24 May 2017 11:31:56 +0300
Subject: [PATCH 0973/2409] Do not upload vhdx images as vhd

This change ensures that when uploading vhdx images, we use the
proper format.

At the moment, vhdx images are uploaded as vhd, which can be
troublesome: first because this is misleading, second because the
actual image format may be checked, having the image rejected.

Change-Id: I9578be41ea9dc252404b7553679ac527e08a0ff6
---
 functions | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions b/functions
index 52a82faf0a..689aad074e 100644
--- a/functions
+++ b/functions
@@ -323,7 +323,7 @@ function upload_image {
         *.vhd|*.vhdx|*.vhd.gz|*.vhdx.gz)
             local extension="${image_fname#*.}"
             image_name=$(basename "$image" ".$extension")
-            disk_format=vhd
+            disk_format=$(echo $image_fname | grep -oP '(?<=\.)vhdx?(?=\.|$)')
             container_format=bare
             if [ "${image_fname##*.}" == "gz" ]; then
                 unpack=zcat

From bba924121c8ad5e95f5cf55ab489d4276dcc39b1 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 24 May 2017 07:56:10 -0400
Subject: [PATCH 0974/2409] Use sha256sum instead of gpg for verification

gpg verification requires network connectivity which is non
mirrorable. We try to avoid that in devstack whenever possible. A
sha256sum is a totally reasonable way of knowing if the downloaded
package is valid.

Closes-Bug: #1693092

Change-Id: Id496ab53f76444f08dc6961f1ecd25f450cc96d7
---
 lib/etcd3 | 32 +++++++++++++++++++-------------
 1 file changed, 19 insertions(+), 13 deletions(-)

diff --git a/lib/etcd3 b/lib/etcd3
index fa60a392c9..15c29132be 100644
--- a/lib/etcd3
+++ b/lib/etcd3
@@ -29,6 +29,10 @@ ETCD_VERSION=${ETCD_VERSION:-v3.1.7}
 ETCD_DATA_DIR="$DEST/data/etcd"
 ETCD_SYSTEMD_SERVICE="devstack@etcd.service"
 ETCD_BIN_DIR="$DEST/bin"
+ETCD_SHA256_AMD64="4fde194bbcd259401e2b5c462dfa579ee7f6af539f13f130b8f5b4f52e3b3c52"
+# NOTE(sdague): etcd v3.1.7 doesn't have anything for these architectures, though 3.2.0 does.
+ETCD_SHA256_ARM64=""
+ETCD_SHA256_PPC64=""
 
 if is_ubuntu ; then
     UBUNTU_RELEASE_BASE_NUM=`lsb_release -r | awk '{print $2}' | cut -d '.' -f 1`
@@ -82,14 +86,19 @@ function _install_etcd {
     # Make sure etcd3 downloads the correct architecture
     if is_arch "x86_64"; then
         ETCD_ARCH="amd64"
+        ETCD_SHA256=${ETCD_SHA256:-$ETCD_SHA256_AMD64}
     elif is_arch "aarch64"; then
         ETCD_ARCH="arm64"
+        ETCD_SHA256=${ETCD_SHA256:-$ETCD_SHA256_ARM64}
     elif is_arch "ppc64le"; then
         ETCD_ARCH="ppc64le"
+        ETCD_SHA256=${ETCD_SHA256:-$ETCD_SHA256_PPC64}
     else
         exit_distro_not_supported "invalid hardware type - $ETCD_ARCH"
     fi
 
+    ETCD_NAME=etcd-$ETCD_VERSION-linux-$ETCD_ARCH
+
     # Install the libraries needed. Note: tooz for example does not have a hard dependency on these libraries
     pip_install etcd3
     pip_install etcd3gw
@@ -99,21 +108,18 @@ function _install_etcd {
     sudo mkdir -p $ETCD_DATA_DIR
 
     # Download and cache the etcd tgz for subsequent use
-    if [ ! -f "$DEST/etcd/etcd-$ETCD_VERSION-linux-$ETCD_ARCH/etcd" ]; then
-        mkdir -p $DEST/etcd
-        ETCD_DOWNLOAD_FILE=etcd-$ETCD_VERSION-linux-$ETCD_ARCH.tar.gz
-        wget $ETCD_DOWNLOAD_URL/$ETCD_VERSION/$ETCD_DOWNLOAD_FILE -O $DEST/etcd/$ETCD_DOWNLOAD_FILE
-        wget $ETCD_DOWNLOAD_URL/$ETCD_VERSION/$ETCD_DOWNLOAD_FILE.asc -O $DEST/etcd/$ETCD_DOWNLOAD_FILE.asc
-
-        # use gpg to verify the artifact, use a backup key server in case the first one is down for some reason
-        gpg --keyserver hkps.pool.sks-keyservers.net --recv-key FC8A365E || gpg --keyserver pgpkeys.mit.edu --recv-key FC8A365E
-        gpg --verify $DEST/etcd/$ETCD_DOWNLOAD_FILE.asc $DEST/etcd/$ETCD_DOWNLOAD_FILE
-
-        tar xzvf $DEST/etcd/$ETCD_DOWNLOAD_FILE -C $DEST/etcd
-        sudo cp $DEST/etcd/etcd-$ETCD_VERSION-linux-$ETCD_ARCH/etcd $ETCD_BIN_DIR/etcd
+    if [ ! -f "files/etcd-$ETCD_VERSION-linux-$ETCD_ARCH/etcd" ]; then
+        ETCD_DOWNLOAD_FILE=$ETCD_NAME.tar.gz
+        wget $ETCD_DOWNLOAD_URL/$ETCD_VERSION/$ETCD_DOWNLOAD_FILE -O files/$ETCD_DOWNLOAD_FILE
+        echo "${ETCD_SHA256} files/${ETCD_DOWNLOAD_FILE}" > files/etcd.sha256sum
+        # NOTE(sdague): this should go fatal if this fails
+        sha256sum -c files/etcd.sha256sum
+
+        tar xzvf files/$ETCD_DOWNLOAD_FILE -C files
+        sudo cp files/$ETCD_NAME/etcd $ETCD_BIN_DIR/etcd
     fi
     if [ ! -f "$ETCD_BIN_DIR/etcd" ]; then
-        sudo cp $DEST/etcd/etcd-$ETCD_VERSION-linux-$ETCD_ARCH/etcd $ETCD_BIN_DIR/etcd
+        sudo cp files/$ETCD_NAME/etcd $ETCD_BIN_DIR/etcd
     fi
 }
 

From 94b9fae4e9f43eb1329384cbeb1977baac60846e Mon Sep 17 00:00:00 2001
From: Andreas Scheuring <andreas.scheuring@de.ibm.com>
Date: Wed, 24 May 2017 13:31:13 +0200
Subject: [PATCH 0975/2409] Allow disabling etcd3

Etcd3 was enabled recently as new service in devstack [1]. But there's
no way to disable etcd3. This is required on architectures where no etcd
binaries are available (e.g. s390x). The long term goal of course should
be to have those binaries available. The short term circumvention is to
allow disabling the service in local.conf:

   disable_service etcd3

[1] https://github.com/openstack-dev/devstack/commit/546656fc0543ec2bc5b422fd9eee17f1b8122758
Change-Id: I6184ed193482dad9643ccb2b97133d4957485408
Partial-Bug: #1693192
---
 stack.sh | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index ecf068a4a9..a63f6b9e7c 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1048,7 +1048,9 @@ start_dstat
 # -----
 
 # etcd is a distributed key value store that provides a reliable way to store data across a cluster of machines
-start_etcd3
+if is_service_enabled etcd3; then
+    start_etcd3
+fi
 
 # Keystone
 # --------

From c0d16c279ad2a24bd13e2dbd6ae6986c37c4f230 Mon Sep 17 00:00:00 2001
From: Davanum Srinivas <davanum@gmail.com>
Date: Fri, 19 May 2017 10:23:46 -0400
Subject: [PATCH 0976/2409] Get rid of zookeeper from devstack

In Ibbb430fb1dbf66942168e0cb52d990ab6a2eb8d7, we are adding
etcd3 as a new base service. We should drop zookeeper
and use etcd3 as the backend.

Since cinder is the first service for this tooz+etcd3 DLM
scenario and cinder uses eventlet we have cannnot use the
grpc based driver in tooz. So new CINDER_COORDINATION_URL
that defaults to the etcd3's grpc HTTP gateway based
tooz backend.

We need to hold this change until the tooz change (see
Depends-On) is available in a tooz release.

Depends-On: I6184ed193482dad9643ccb2b97133d4957485408
Change-Id: Ia187e1a86413edf25b909b6bb57e84fb4930a696
---
 files/debs/zookeeper             |   1 -
 files/rpms/zookeeper             |   1 -
 files/zookeeper/environment      |  36 ----------
 files/zookeeper/log4j.properties |  69 -------------------
 files/zookeeper/myid             |   1 -
 files/zookeeper/zoo.cfg          |  74 ---------------------
 lib/cinder                       |   9 ++-
 lib/dlm                          | 111 -------------------------------
 stack.sh                         |   5 --
 unstack.sh                       |   1 -
 10 files changed, 4 insertions(+), 304 deletions(-)
 delete mode 100644 files/debs/zookeeper
 delete mode 100644 files/rpms/zookeeper
 delete mode 100644 files/zookeeper/environment
 delete mode 100644 files/zookeeper/log4j.properties
 delete mode 100644 files/zookeeper/myid
 delete mode 100644 files/zookeeper/zoo.cfg
 delete mode 100644 lib/dlm

diff --git a/files/debs/zookeeper b/files/debs/zookeeper
deleted file mode 100644
index f41b559007..0000000000
--- a/files/debs/zookeeper
+++ /dev/null
@@ -1 +0,0 @@
-zookeeperd
diff --git a/files/rpms/zookeeper b/files/rpms/zookeeper
deleted file mode 100644
index 1bfac538a2..0000000000
--- a/files/rpms/zookeeper
+++ /dev/null
@@ -1 +0,0 @@
-zookeeper
diff --git a/files/zookeeper/environment b/files/zookeeper/environment
deleted file mode 100644
index afa2d2f89f..0000000000
--- a/files/zookeeper/environment
+++ /dev/null
@@ -1,36 +0,0 @@
-#
-# (C) Copyright 2015 Hewlett Packard Enterprise Development Company LP
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#    http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-# implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-# Modified from http://packages.ubuntu.com/saucy/zookeeperd
-NAME=zookeeper
-ZOOCFGDIR=/etc/zookeeper/conf
-
-# seems, that log4j requires the log4j.properties file to be in the classpath
-CLASSPATH="$ZOOCFGDIR:/usr/share/java/jline.jar:/usr/share/java/log4j-1.2.jar:/usr/share/java/xercesImpl.jar:/usr/share/java/xmlParserAPIs.jar:/usr/share/java/netty.jar:/usr/share/java/slf4j-api.jar:/usr/share/java/slf4j-log4j12.jar:/usr/share/java/zookeeper.jar"
-
-ZOOCFG="$ZOOCFGDIR/zoo.cfg"
-ZOO_LOG_DIR=/var/log/zookeeper
-USER=$NAME
-GROUP=$NAME
-PIDDIR=/var/run/$NAME
-PIDFILE=$PIDDIR/$NAME.pid
-SCRIPTNAME=/etc/init.d/$NAME
-JAVA=/usr/bin/java
-ZOOMAIN="org.apache.zookeeper.server.quorum.QuorumPeerMain"
-ZOO_LOG4J_PROP="INFO,ROLLINGFILE"
-JMXLOCALONLY=false
-JAVA_OPTS=""
diff --git a/files/zookeeper/log4j.properties b/files/zookeeper/log4j.properties
deleted file mode 100644
index 6c45a4aad9..0000000000
--- a/files/zookeeper/log4j.properties
+++ /dev/null
@@ -1,69 +0,0 @@
-#
-# (C) Copyright 2015 Hewlett Packard Enterprise Development Company LP
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#    http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-# implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-# From http://packages.ubuntu.com/saucy/zookeeperd
-
-# ZooKeeper Logging Configuration
-#
-
-# Format is "<default threshold> (, <appender>)+
-
-log4j.rootLogger=${zookeeper.root.logger}
-
-# Example: console appender only
-# log4j.rootLogger=INFO, CONSOLE
-
-# Example with rolling log file
-#log4j.rootLogger=DEBUG, CONSOLE, ROLLINGFILE
-
-# Example with rolling log file and tracing
-#log4j.rootLogger=TRACE, CONSOLE, ROLLINGFILE, TRACEFILE
-
-#
-# Log INFO level and above messages to the console
-#
-log4j.appender.CONSOLE=org.apache.log4j.ConsoleAppender
-log4j.appender.CONSOLE.Threshold=INFO
-log4j.appender.CONSOLE.layout=org.apache.log4j.PatternLayout
-log4j.appender.CONSOLE.layout.ConversionPattern=%d{ISO8601} - %-5p [%t:%C{1}@%L] - %m%n
-
-#
-# Add ROLLINGFILE to rootLogger to get log file output
-#    Log DEBUG level and above messages to a log file
-log4j.appender.ROLLINGFILE=org.apache.log4j.RollingFileAppender
-log4j.appender.ROLLINGFILE.Threshold=WARN
-log4j.appender.ROLLINGFILE.File=${zookeeper.log.dir}/zookeeper.log
-
-# Max log file size of 10MB
-log4j.appender.ROLLINGFILE.MaxFileSize=10MB
-# uncomment the next line to limit number of backup files
-#log4j.appender.ROLLINGFILE.MaxBackupIndex=10
-
-log4j.appender.ROLLINGFILE.layout=org.apache.log4j.PatternLayout
-log4j.appender.ROLLINGFILE.layout.ConversionPattern=%d{ISO8601} - %-5p [%t:%C{1}@%L] - %m%n
-
-
-#
-# Add TRACEFILE to rootLogger to get log file output
-#    Log DEBUG level and above messages to a log file
-log4j.appender.TRACEFILE=org.apache.log4j.FileAppender
-log4j.appender.TRACEFILE.Threshold=TRACE
-log4j.appender.TRACEFILE.File=${zookeeper.log.dir}/zookeeper_trace.log
-
-log4j.appender.TRACEFILE.layout=org.apache.log4j.PatternLayout
-### Notice we are including log4j's NDC here (%x)
-log4j.appender.TRACEFILE.layout.ConversionPattern=%d{ISO8601} - %-5p [%t:%C{1}@%L][%x] - %m%n
diff --git a/files/zookeeper/myid b/files/zookeeper/myid
deleted file mode 100644
index c227083464..0000000000
--- a/files/zookeeper/myid
+++ /dev/null
@@ -1 +0,0 @@
-0
\ No newline at end of file
diff --git a/files/zookeeper/zoo.cfg b/files/zookeeper/zoo.cfg
deleted file mode 100644
index b8f55827e3..0000000000
--- a/files/zookeeper/zoo.cfg
+++ /dev/null
@@ -1,74 +0,0 @@
-#
-# (C) Copyright 2015 Hewlett Packard Enterprise Development Company LP
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#    http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-# implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-# http://hadoop.apache.org/zookeeper/docs/current/zookeeperAdmin.html
-
-# The number of milliseconds of each tick
-tickTime=2000
-# The number of ticks that the initial
-# synchronization phase can take
-initLimit=10
-# The number of ticks that can pass between
-# sending a request and getting an acknowledgement
-syncLimit=5
-# the directory where the snapshot is stored.
-dataDir=/var/lib/zookeeper
-# Place the dataLogDir to a separate physical disc for better performance
-# dataLogDir=/disk2/zookeeper
-
-# the port at which the clients will connect
-clientPort=2181
-
-# Maximum number of clients that can connect from one client
-maxClientCnxns=60
-
-# specify all zookeeper servers
-# The fist port is used by followers to connect to the leader
-# The second one is used for leader election
-
-server.0=127.0.0.1:2888:3888
-
-# To avoid seeks ZooKeeper allocates space in the transaction log file in
-# blocks of preAllocSize kilobytes. The default block size is 64M. One reason
-# for changing the size of the blocks is to reduce the block size if snapshots
-# are taken more often. (Also, see snapCount).
-#preAllocSize=65536
-
-# Clients can submit requests faster than ZooKeeper can process them,
-# especially if there are a lot of clients. To prevent ZooKeeper from running
-# out of memory due to queued requests, ZooKeeper will throttle clients so that
-# there is no more than globalOutstandingLimit outstanding requests in the
-# system. The default limit is 1,000.ZooKeeper logs transactions to a
-# transaction log. After snapCount transactions are written to a log file a
-# snapshot is started and a new transaction log file is started. The default
-# snapCount is 10,000.
-#snapCount=1000
-
-# If this option is defined, requests will be will logged to a trace file named
-# traceFile.year.month.day.
-#traceFile=
-
-# Leader accepts client connections. Default value is "yes". The leader machine
-# coordinates updates. For higher update throughput at thes slight expense of
-# read throughput the leader can be configured to not accept clients and focus
-# on coordination.
-#leaderServes=yes
-
-# Autopurge every hour to avoid using lots of disk in bursts
-# Order of the next 2 properties matters.
-# autopurge.snapRetainCount must be before autopurge.purgeInterval.
-autopurge.snapRetainCount=3
-autopurge.purgeInterval=1
\ No newline at end of file
diff --git a/lib/cinder b/lib/cinder
index e3a687b4f2..1b4f4e6da2 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -363,11 +363,10 @@ function configure_cinder {
     iniset $CINDER_CONF DEFAULT os_privileged_user_tenant "$SERVICE_PROJECT_NAME"
     iniset $CINDER_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
 
-    # Set the backend url according to the configured dlm backend
-    if is_dlm_enabled; then
-        if [[ "$(dlm_backend)" == "zookeeper" ]]; then
-            iniset $CINDER_CONF coordination backend_url "zookeeper://${SERVICE_HOST}:2181"
-        fi
+    if [[ ! -z "$CINDER_COORDINATION_URL" ]]; then
+        iniset $CINDER_CONF coordination backend_url "$CINDER_COORDINATION_URL"
+    elif is_service_enabled etcd3; then
+        iniset $CINDER_CONF coordination backend_url "etcd3+http://${SERVICE_HOST}:2379"
     fi
 }
 
diff --git a/lib/dlm b/lib/dlm
deleted file mode 100644
index b5ac0f5d33..0000000000
--- a/lib/dlm
+++ /dev/null
@@ -1,111 +0,0 @@
-#!/bin/bash
-#
-# lib/dlm
-#
-# Functions to control the installation and configuration of software
-# that provides a dlm (and possibly other functions). The default is
-# **zookeeper**, and is going to be the only backend supported in the
-# devstack tree.
-
-# Dependencies:
-#
-# - ``functions`` file
-
-# ``stack.sh`` calls the entry points in this order:
-#
-# - is_dlm_enabled
-# - install_dlm
-# - configure_dlm
-# - cleanup_dlm
-
-# Save trace setting
-_XTRACE_DLM=$(set +o | grep xtrace)
-set +o xtrace
-
-
-# Defaults
-# --------
-
-# <define global variables here that belong to this project>
-
-# Set up default directories
-ZOOKEEPER_DATA_DIR=$DEST/data/zookeeper
-ZOOKEEPER_CONF_DIR=/etc/zookeeper
-
-
-# Entry Points
-# ------------
-#
-# NOTE(sdague): it is expected that when someone wants to implement
-# another one of these out of tree, they'll implement the following
-# functions:
-#
-# - dlm_backend
-# - install_dlm
-# - configure_dlm
-# - cleanup_dlm
-
-# This should be declared in the settings file of any plugin or
-# service that needs to have a dlm in their environment.
-function use_dlm {
-    enable_service $(dlm_backend)
-}
-
-# A function to return the name of the backend in question, some users
-# are going to need to know this.
-function dlm_backend {
-    echo "zookeeper"
-}
-
-# Test if a dlm is enabled (defaults to a zookeeper specific check)
-function is_dlm_enabled {
-    [[ ,${ENABLED_SERVICES}, =~ ,"$(dlm_backend)", ]] && return 0
-    return 1
-}
-
-# cleanup_dlm() - Remove residual data files, anything left over from previous
-# runs that a clean run would need to clean up
-function cleanup_dlm {
-    # NOTE(sdague): we don't check for is_enabled here because we
-    # should just delete this regardless. Some times users updated
-    # their service list before they run cleanup.
-    sudo rm -rf $ZOOKEEPER_DATA_DIR
-}
-
-# configure_dlm() - Set config files, create data dirs, etc
-function configure_dlm {
-    if is_dlm_enabled; then
-        sudo cp $FILES/zookeeper/* $ZOOKEEPER_CONF_DIR
-        sudo sed -i -e 's|.*dataDir.*|dataDir='$ZOOKEEPER_DATA_DIR'|' $ZOOKEEPER_CONF_DIR/zoo.cfg
-        # clean up from previous (possibly aborted) runs
-        # create required data files
-        sudo rm -rf $ZOOKEEPER_DATA_DIR
-        sudo mkdir -p $ZOOKEEPER_DATA_DIR
-        # restart after configuration, there is no reason to make this
-        # another step, because having data files that don't match the
-        # zookeeper running is just going to cause tears.
-        restart_service zookeeper
-    fi
-}
-
-# install_dlm() - Collect source and prepare
-function install_dlm {
-    if is_dlm_enabled; then
-        pip_install_gr_extras tooz zookeeper
-        if is_ubuntu; then
-            install_package zookeeperd
-        elif is_fedora; then
-            install_package zookeeper
-        else
-            die $LINENO "Don't know how to install zookeeper on this platform"
-        fi
-    fi
-}
-
-# Restore xtrace
-$_XTRACE_DLM
-
-# Tell emacs to use shell-script-mode
-## Local variables:
-## mode: shell-script
-## End:
diff --git a/stack.sh b/stack.sh
index ecf068a4a9..6ff2464fce 100755
--- a/stack.sh
+++ b/stack.sh
@@ -573,7 +573,6 @@ source $TOP_DIR/lib/swift
 source $TOP_DIR/lib/neutron
 source $TOP_DIR/lib/ldap
 source $TOP_DIR/lib/dstat
-source $TOP_DIR/lib/dlm
 source $TOP_DIR/lib/etcd3
 source $TOP_DIR/lib/os_brick
 
@@ -772,10 +771,6 @@ set_systemd_override DefaultLimitNOFILE ${ULIMIT_NOFILE}
 install_rpc_backend
 restart_rpc_backend
 
-# NOTE(sdague): dlm install is conditional on one being enabled by configuration
-install_dlm
-configure_dlm
-
 if is_service_enabled $DATABASE_BACKENDS; then
     install_database
 fi
diff --git a/unstack.sh b/unstack.sh
index a9826f5a97..77a151f933 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -70,7 +70,6 @@ source $TOP_DIR/lib/neutron
 source $TOP_DIR/lib/ldap
 source $TOP_DIR/lib/dstat
 source $TOP_DIR/lib/etcd3
-source $TOP_DIR/lib/dlm
 
 # Extras Source
 # --------------

From c0644f39a47958a416a82f10f1091d07fec97896 Mon Sep 17 00:00:00 2001
From: Kirill Zaitsev <k.zaitsev@me.com>
Date: Wed, 24 May 2017 13:00:47 +0300
Subject: [PATCH 0977/2409] Use correct argument order in truorfalse for
 USE_JOURNAL

truorfalse function from common-functions accepts default as the first
parameter. The arguments for USE_JOURNAL were mixed up and this commit
restores correct order.

Change-Id: Id3621b0e1910a625d6cfb8e81bd27bea82543ae9
---
 functions | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions b/functions
index 52a82faf0a..d3a2b5104f 100644
--- a/functions
+++ b/functions
@@ -615,7 +615,7 @@ function setup_systemd_logging {
     # native systemd path, which provides for things like search on
     # request-id. However, there may be an eventlet interaction here,
     # so going off for now.
-    USE_JOURNAL=$(trueorfalse USE_JOURNAL False)
+    USE_JOURNAL=$(trueorfalse False USE_JOURNAL)
     local pidstr=""
     if [[ "$USE_JOURNAL" == "True" ]]; then
         iniset $conf_file $conf_section use_journal "True"

From bb436d3373715253a17b6e1fd9211c2bc110a96f Mon Sep 17 00:00:00 2001
From: Amrith Kumar <amrith@amrith.org>
Date: Wed, 10 May 2017 08:21:04 -0400
Subject: [PATCH 0978/2409] Make use of Ubuntu Cloud Archive switchable

The trove development environment is typically a linux VM within which
openstack is installed, and trove launches guest vm's within that
environment. To make it possible for these vm's to launch in one human
lifetime, one must set vt/x and enable nested hypervisors to use with
kvm; qemu emulation will take way too long.

The new libvirtd (v2.5.0) in Ubuntu Cloud Archive doesn't handle
nested hypervisors well and if you use it, you end up with a guest
hanging on the GRUB line.

To enable that use-case, we provide ENABLE_UBUNTU_CLOUD_ARCHIVE which
the trove developer can set (to False) before running devstack.

Change-Id: Ia0265c67bb7d2a438575a03c0ddbf2d9c53266ed
Closes-Bug: #1689370
---
 stackrc              | 2 ++
 tools/fixup_stuff.sh | 5 ++++-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 1300f45cda..f7a0c876f2 100644
--- a/stackrc
+++ b/stackrc
@@ -665,6 +665,8 @@ case "$VIRT_DRIVER" in
         ;;
 esac
 
+# By default, devstack will use Ubuntu Cloud Archive.
+ENABLE_UBUNTU_CLOUD_ARCHIVE=$(trueorfalse True ENABLE_UBUNTU_CLOUD_ARCHIVE)
 
 # Images
 # ------
diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index d07d2675c6..0b78bdeb00 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -72,7 +72,10 @@ fi
 # We've found that Libvirt on Xenial is flaky and crashes enough to be
 # a regular top e-r bug. Opt into Ubuntu Cloud Archive if on Xenial to
 # get newer Libvirt.
-if [[ "$DISTRO" = "xenial" ]]; then
+# Make it possible to switch this based on an environment variable as
+# libvirt 2.5.0 doesn't handle nested virtualization quite well and this
+# is required for the trove development environment.
+if [[ "${ENABLE_UBUNTU_CLOUD_ARCHIVE}" == "True" && "$DISTRO" = "xenial" ]]; then
     # This pulls in apt-add-repository
     install_package "software-properties-common"
     # Use UCA for newer libvirt. Should give us libvirt 2.5.0.

From 853b475bfd79621ce7189b133625cb404d618efb Mon Sep 17 00:00:00 2001
From: Davanum Srinivas <davanum@gmail.com>
Date: Thu, 25 May 2017 13:03:10 -0400
Subject: [PATCH 0979/2409] Fix typo

should be etcd3

Change-Id: Icfa24654699a4e4e4be8a53f7bbe4634badbff7b
---
 lib/etcd3 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/etcd3 b/lib/etcd3
index d62214c111..5cab3f556a 100644
--- a/lib/etcd3
+++ b/lib/etcd3
@@ -79,7 +79,7 @@ function stop_etcd3 {
     $SYSTEMCTL stop $ETCD_SYSTEMD_SERVICE
 }
 
-function cleanup_etcd {
+function cleanup_etcd3 {
     # Don't install in sub nodes (multinode scenario)
     if [ "$SERVICE_HOST" != "$HOST_IP" ]; then
         return

From e123edeebf1559731b451cec0fd3c06ff974bbf2 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 23 May 2017 15:53:48 -0400
Subject: [PATCH 0980/2409] Add global_request_id to systemd logs

With cinder supporting this now, start logging global_request_id in
systemd logs. It will be None for all the services until the work
starts coming together, but it is safe to do.

Change-Id: Ic6ba1a42da88c03e43d89658b453f6a0b353e0db
---
 functions | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions b/functions
index 52a82faf0a..ebc4c282d3 100644
--- a/functions
+++ b/functions
@@ -625,7 +625,7 @@ function setup_systemd_logging {
     fi
     iniset $conf_file $conf_section logging_debug_format_suffix "{{${pidstr}%(funcName)s %(pathname)s:%(lineno)d}}"
 
-    iniset $conf_file $conf_section logging_context_format_string "%(color)s%(levelname)s %(name)s [%(request_id)s %(project_name)s %(user_name)s%(color)s] %(instance)s%(color)s%(message)s"
+    iniset $conf_file $conf_section logging_context_format_string "%(color)s%(levelname)s %(name)s [%(global_request_id)s %(request_id)s %(project_name)s %(user_name)s%(color)s] %(instance)s%(color)s%(message)s"
     iniset $conf_file $conf_section logging_default_format_string "%(color)s%(levelname)s %(name)s [-%(color)s] %(instance)s%(color)s%(message)s"
     iniset $conf_file $conf_section logging_exception_prefix "ERROR %(name)s %(instance)s"
 }

From d0db62a476e29355ca08db0237295139c8fce4f6 Mon Sep 17 00:00:00 2001
From: Kirill Zaitsev <k.zaitsev@me.com>
Date: Fri, 26 May 2017 19:02:52 +0300
Subject: [PATCH 0981/2409] Use systemd-tmpfiles to create /var/run/uwsgi

On ubuntu contents of /var/run do not persist between reboots. Devstack
uses /var/run/uwsgi as home for wsgi sockets. This means that after
rebooting the machine services, that rely on uwsgi would fail to start.
Currently it affects keystone.service and placement-api.service.
This patch changes delegates directory creation to systemd-tmpfiles,
which would run on startup.

Change-Id: I27d168cea93698739ef08ac76c828695a49176c7
Closes-Bug: #1692767
---
 lib/apache | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/lib/apache b/lib/apache
index 34ac660266..3be6c1dbb1 100644
--- a/lib/apache
+++ b/lib/apache
@@ -229,7 +229,13 @@ function write_uwsgi_config {
     # create a home for the sockets; note don't use /tmp -- apache has
     # a private view of it on some platforms.
     local socket_dir='/var/run/uwsgi'
-    sudo install -d -o $STACK_USER -m 755 $socket_dir
+
+    # /var/run will be empty on ubuntu after reboot, so we can use systemd-temptiles
+    # to automatically create $socket_dir.
+    sudo mkdir -p /etc/tmpfiles.d/
+    echo "d $socket_dir 0755 $STACK_USER root" | sudo tee /etc/tmpfiles.d/uwsgi.conf
+    sudo systemd-tmpfiles --create /etc/tmpfiles.d/uwsgi.conf
+
     local socket="$socket_dir/${name}.socket"
 
     # always cleanup given that we are using iniset here

From de8580691d133fb8ad479ef53008d197e651332b Mon Sep 17 00:00:00 2001
From: Hongbin Lu <hongbin.lu@huawei.com>
Date: Wed, 24 May 2017 18:42:33 +0000
Subject: [PATCH 0982/2409] Expose etcd port as a variable

This allows devstack plugins to retrieve the etcd port from devstack
instead of hard-coding it.

Change-Id: I106b559b8ac0fb99a0426bce97a27f67e32d264d
---
 lib/etcd3 | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/lib/etcd3 b/lib/etcd3
index d62214c111..5472926f64 100644
--- a/lib/etcd3
+++ b/lib/etcd3
@@ -33,6 +33,7 @@ ETCD_SHA256_AMD64="4fde194bbcd259401e2b5c462dfa579ee7f6af539f13f130b8f5b4f52e3b3
 # NOTE(sdague): etcd v3.1.7 doesn't have anything for these architectures, though 3.2.0 does.
 ETCD_SHA256_ARM64=""
 ETCD_SHA256_PPC64=""
+ETCD_PORT=2379
 
 if is_ubuntu ; then
     UBUNTU_RELEASE_BASE_NUM=`lsb_release -r | awk '{print $2}' | cut -d '.' -f 1`
@@ -52,9 +53,9 @@ function start_etcd3 {
     cmd+=" --initial-cluster-state new --initial-cluster-token etcd-cluster-01"
     cmd+=" --initial-cluster $HOSTNAME=http://$SERVICE_HOST:2380"
     cmd+=" --initial-advertise-peer-urls http://$SERVICE_HOST:2380"
-    cmd+=" --advertise-client-urls http://$SERVICE_HOST:2379"
+    cmd+=" --advertise-client-urls http://$SERVICE_HOST:$ETCD_PORT"
     cmd+=" --listen-peer-urls http://0.0.0.0:2380 "
-    cmd+=" --listen-client-urls http://$SERVICE_HOST:2379"
+    cmd+=" --listen-client-urls http://$SERVICE_HOST:$ETCD_PORT"
 
     local unitfile="$SYSTEMD_DIR/$ETCD_SYSTEMD_SERVICE"
     write_user_unit_file $ETCD_SYSTEMD_SERVICE "$cmd" "" "root"

From fabc976e41ae1d036403403719aac42f111caa35 Mon Sep 17 00:00:00 2001
From: root <root@localhost.localdomain>
Date: Sat, 27 May 2017 15:01:16 +0800
Subject: [PATCH 0983/2409] Fix configuration link syntax error

The configuration guide link has syntax problem in README.rst,
and the click the link will lead to page 404.

Fix the syntax problem

Change-Id: I47a1641a6898930dca508cdac98b1b43c05dc446
---
 README.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.rst b/README.rst
index dfa68b927f..b4240bdc91 100644
--- a/README.rst
+++ b/README.rst
@@ -92,5 +92,5 @@ DevStack can be extensively configured via the configuration file
 `local.conf`.  It is likely that you will need to provide and modify
 this file if you want anything other than the most basic setup.  Start
 by reading the `configuration guide
-<https://docs.openstack.org/developer/devstack/configuration.html>_`
+<https://docs.openstack.org/developer/devstack/configuration.html>`_
 for details of the configuration file and the many available options.

From 4baac6572573945f49b3b3df7b7ea27f15955477 Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Sat, 27 May 2017 20:53:20 -0700
Subject: [PATCH 0984/2409] Use proper python when configuring certs

We have to do silly overrides of cert locations for requests for
reasons. If we are running under python3 then we were previously looking
in the wrong location for the requests certs. Update the cert fixing
function to properly use python3 to find the certs if python3 is
enabled.

Change-Id: Id1369da0d812edcf9b1204e9c567f8bfe77c48b2
---
 lib/tls  | 3 ++-
 stack.sh | 3 +++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/lib/tls b/lib/tls
index 7c6b967bc4..65c2cba300 100644
--- a/lib/tls
+++ b/lib/tls
@@ -345,7 +345,8 @@ function make_root_CA {
 function fix_system_ca_bundle_path {
     if is_service_enabled tls-proxy; then
         local capath
-        capath=$(python -c $'try:\n from requests import certs\n print certs.where()\nexcept ImportError: pass')
+        local python_cmd=${1:-python}
+        capath=$($python_cmd -c $'try:\n from requests import certs\n print (certs.where())\nexcept ImportError: pass')
 
         if [[ ! $capath == "" && ! $capath =~ ^/etc/.* && ! -L $capath ]]; then
             if is_fedora; then
diff --git a/stack.sh b/stack.sh
index 7a24ed947f..1615b1c046 100755
--- a/stack.sh
+++ b/stack.sh
@@ -888,6 +888,9 @@ fi
 
 if is_service_enabled tls-proxy; then
     fix_system_ca_bundle_path
+    if python3_enabled ; then
+        fix_system_ca_bundle_path python3
+    fi
 fi
 
 # Extras Install

From 309b99ebcfa9d8bcf18c1d3eed1e52787c63f8c7 Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Tue, 23 May 2017 15:18:31 -0400
Subject: [PATCH 0985/2409] Add a function to get an available random port

This commit adds a new function get_random_port to return a randomly
available port from the local port range.

Change-Id: Icaed180cc14602a74cdb3fd3456b690d8a4c729c
---
 functions | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/functions b/functions
index 52a82faf0a..4d2703f150 100644
--- a/functions
+++ b/functions
@@ -732,6 +732,24 @@ function set_systemd_override {
     sudo systemctl daemon-reload
 }
 
+# Get a random port from the local port range
+#
+# This function returns an available port in the local port range. The search
+# order is not truly random, but should be considered a random value by the
+# user because it depends on the state of your local system.
+function get_random_port {
+    read lower_port upper_port < /proc/sys/net/ipv4/ip_local_port_range
+    while true; do
+        for (( port = upper_port ; port >= lower_port ; port-- )); do
+            sudo lsof -i ":$port" &> /dev/null
+            if [[ $? > 0 ]] ; then
+                break 2
+            fi
+        done
+    done
+    echo $port
+}
+
 
 # Restore xtrace
 $_XTRACE_FUNCTIONS

From e6217a9719b88b550ccbbce7c9bc064cb746c1a3 Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Mon, 24 Apr 2017 16:49:04 -0400
Subject: [PATCH 0986/2409] Use uwsgi for glance-api

This commit adds support for deploying glance as a wsgi script under
uwsgi. To get around limitations in the uwsgi protocol when using
python3 for chunked encoding we have to setup uwsgi in http mode on a
random port listening on localhost and use mod_proxy to forward the
incoming requests. The alternative approach of having apache buffer the
requests locally with the send_cl option with mod_proxy_uwsgi only
worked on python2 and also has the limitation that apache is buffering
the entire chunked object, which could be several gigabytes in size.

Depends-On: I089a22a4be4227a551c32442dba27c426f54c87d
Change-Id: Ie98fb7da5e8ecfa49cd680b88139cb7034d5f88f
---
 lib/apache | 54 +++++++++++++++++++++++++++++++++++++++++++++++++++++-
 lib/cinder |  2 +-
 lib/glance | 39 ++++++++++++++++++++++++++++-----------
 lib/nova   |  2 +-
 4 files changed, 83 insertions(+), 14 deletions(-)

diff --git a/lib/apache b/lib/apache
index 34ac660266..f2de7f2ea9 100644
--- a/lib/apache
+++ b/lib/apache
@@ -260,12 +260,64 @@ function write_uwsgi_config {
     else
         local apache_conf=""
         apache_conf=$(apache_site_config_for $name)
-        echo "ProxyPass \"${url}\" \"unix:${socket}|uwsgi://uwsgi-uds-${name}/\" retry=0 " | sudo tee $apache_conf
+        echo "SetEnv proxy-sendcl 1" | sudo tee $apache_conf
+        echo "ProxyPass \"${url}\" \"unix:${socket}|uwsgi://uwsgi-uds-${name}/\" retry=0 " | sudo tee -a $apache_conf
         enable_apache_site $name
         restart_apache_server
     fi
 }
 
+# For services using chunked encoding, the only services known to use this
+# currently are Glance and Swift, we need to use an http proxy instead of
+# mod_proxy_uwsgi because the chunked encoding gets dropped. See:
+# https://github.com/unbit/uwsgi/issues/1540 You can workaround this on python2
+# but that involves having apache buffer the request before sending it to
+# uswgi.
+function write_local_uwsgi_http_config {
+    local file=$1
+    local wsgi=$2
+    local url=$3
+    name=$(basename $wsgi)
+
+    # create a home for the sockets; note don't use /tmp -- apache has
+    # a private view of it on some platforms.
+
+    # always cleanup given that we are using iniset here
+    rm -rf $file
+    iniset "$file" uwsgi wsgi-file "$wsgi"
+    port=$(get_random_port)
+    iniset "$file" uwsgi http "127.0.0.1:$port"
+    iniset "$file" uwsgi processes $API_WORKERS
+    # This is running standalone
+    iniset "$file" uwsgi master true
+    # Set die-on-term & exit-on-reload so that uwsgi shuts down
+    iniset "$file" uwsgi die-on-term true
+    iniset "$file" uwsgi exit-on-reload true
+    iniset "$file" uwsgi enable-threads true
+    iniset "$file" uwsgi plugins python
+    # uwsgi recommends this to prevent thundering herd on accept.
+    iniset "$file" uwsgi thunder-lock true
+    # Override the default size for headers from the 4k default.
+    iniset "$file" uwsgi buffer-size 65535
+    # Make sure the client doesn't try to re-use the connection.
+    iniset "$file" uwsgi add-header "Connection: close"
+    # This ensures that file descriptors aren't shared between processes.
+    iniset "$file" uwsgi lazy-apps true
+    iniset "$file" uwsgi chmod-socket 666
+    iniset "$file" uwsgi http-raw-body true
+    iniset "$file" uwsgi http-chunked-input true
+    iniset "$file" uwsgi http-auto-chunked true
+
+    enable_apache_mod proxy
+    enable_apache_mod proxy_http
+    local apache_conf=""
+    apache_conf=$(apache_site_config_for $name)
+    echo "KeepAlive Off" | sudo tee $apache_conf
+    echo "ProxyPass \"${url}\" \"http://127.0.0.1:$port\" retry=0 " | sudo tee -a $apache_conf
+    enable_apache_site $name
+    restart_apache_server
+}
+
 function remove_uwsgi_config {
     local file=$1
     local wsgi=$2
diff --git a/lib/cinder b/lib/cinder
index e3a687b4f2..dc6f443051 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -347,7 +347,7 @@ function configure_cinder {
 
     iniset $CINDER_CONF DEFAULT osapi_volume_workers "$API_WORKERS"
 
-    iniset $CINDER_CONF DEFAULT glance_api_servers "${GLANCE_SERVICE_PROTOCOL}://${GLANCE_HOSTPORT}"
+    iniset $CINDER_CONF DEFAULT glance_api_servers "$GLANCE_URL"
     if is_service_enabled tls-proxy; then
         iniset $CINDER_CONF DEFAULT glance_protocol https
         iniset $CINDER_CONF DEFAULT glance_ca_certificates_file $SSL_BUNDLE_FILE
diff --git a/lib/glance b/lib/glance
index d6438a6b48..19564183cd 100644
--- a/lib/glance
+++ b/lib/glance
@@ -71,6 +71,16 @@ GLANCE_HOSTPORT=${GLANCE_HOSTPORT:-$GLANCE_SERVICE_HOST:$GLANCE_SERVICE_PORT}
 GLANCE_SERVICE_PROTOCOL=${GLANCE_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 GLANCE_REGISTRY_PORT=${GLANCE_REGISTRY_PORT:-9191}
 GLANCE_REGISTRY_PORT_INT=${GLANCE_REGISTRY_PORT_INT:-19191}
+GLANCE_UWSGI=$GLANCE_BIN_DIR/glance-wsgi-api
+GLANCE_UWSGI_CONF=$GLANCE_CONF_DIR/glance-uswgi.ini
+# If wsgi mode is uwsgi run glance under uwsgi, else default to eventlet
+# TODO(mtreinish): Remove the eventlet path here and in all the similar
+# conditionals below after the Pike release
+if [[ "$WSGI_MODE" == "uwsgi" ]]; then
+    GLANCE_URL="$GLANCE_SERVICE_PROTOCOL://$GLANCE_SERVICE_HOST/image"
+else
+    GLANCE_URL="$GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT"
+fi
 
 # Functions
 # ---------
@@ -103,16 +113,13 @@ function configure_glance {
     dburl=`database_connection_url glance`
     iniset $GLANCE_REGISTRY_CONF database connection $dburl
     iniset $GLANCE_REGISTRY_CONF DEFAULT use_syslog $SYSLOG
-    iniset $GLANCE_REGISTRY_CONF DEFAULT workers "$API_WORKERS"
     iniset $GLANCE_REGISTRY_CONF paste_deploy flavor keystone
     configure_auth_token_middleware $GLANCE_REGISTRY_CONF glance $GLANCE_AUTH_CACHE_DIR/registry
     iniset $GLANCE_REGISTRY_CONF oslo_messaging_notifications driver messagingv2
     iniset_rpc_backend glance $GLANCE_REGISTRY_CONF
     iniset $GLANCE_REGISTRY_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
 
-    cp $GLANCE_DIR/etc/glance-api.conf $GLANCE_API_CONF
     iniset $GLANCE_API_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-    iniset $GLANCE_API_CONF DEFAULT bind_host $GLANCE_SERVICE_LISTEN_ADDRESS
     inicomment $GLANCE_API_CONF DEFAULT log_file
     iniset $GLANCE_API_CONF database connection $dburl
     iniset $GLANCE_API_CONF DEFAULT use_syslog $SYSLOG
@@ -140,8 +147,6 @@ function configure_glance {
     iniset $GLANCE_API_CONF glance_store filesystem_store_datadir $GLANCE_IMAGE_DIR/
     iniset $GLANCE_API_CONF DEFAULT registry_host $GLANCE_SERVICE_HOST
 
-    iniset $GLANCE_API_CONF DEFAULT workers "$API_WORKERS"
-
     # CORS feature support - to allow calls from Horizon by default
     if [ -n "$GLANCE_CORS_ALLOWED_ORIGIN" ]; then
         iniset $GLANCE_API_CONF cors allowed_origin "$GLANCE_CORS_ALLOWED_ORIGIN"
@@ -198,7 +203,6 @@ function configure_glance {
     setup_logging $GLANCE_REGISTRY_CONF
 
     cp -p $GLANCE_DIR/etc/glance-registry-paste.ini $GLANCE_REGISTRY_PASTE_INI
-
     cp -p $GLANCE_DIR/etc/glance-api-paste.ini $GLANCE_API_PASTE_INI
 
     cp $GLANCE_DIR/etc/glance-cache.conf $GLANCE_CACHE_CONF
@@ -231,6 +235,13 @@ function configure_glance {
         iniset $GLANCE_API_CONF DEFAULT cinder_endpoint_template "https://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/%(project_id)s"
         iniset $GLANCE_CACHE_CONF DEFAULT cinder_endpoint_template "https://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/%(project_id)s"
     fi
+
+    if [[ "$WSGI_MODE" == "uwsgi" ]]; then
+        write_local_uwsgi_http_config "$GLANCE_UWSGI_CONF" "$GLANCE_UWSGI" "/image"
+    else
+        iniset $GLANCE_API_CONF DEFAULT bind_host $GLANCE_SERVICE_LISTEN_ADDRESS
+        iniset $GLANCE_API_CONF DEFAULT workers "$API_WORKERS"
+    fi
 }
 
 # create_glance_accounts() - Set up common required glance accounts
@@ -255,7 +266,7 @@ function create_glance_accounts {
         get_or_create_endpoint \
             "image" \
             "$REGION_NAME" \
-            "$GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT"
+            "$GLANCE_URL"
 
         # Note(frickler): Crude workaround for https://bugs.launchpad.net/glance-store/+bug/1620999
         service_domain_id=$(get_or_create_domain $SERVICE_DOMAIN_NAME)
@@ -320,15 +331,21 @@ function install_glance {
 function start_glance {
     local service_protocol=$GLANCE_SERVICE_PROTOCOL
     if is_service_enabled tls-proxy; then
-        start_tls_proxy glance-service '*' $GLANCE_SERVICE_PORT $GLANCE_SERVICE_HOST $GLANCE_SERVICE_PORT_INT
+        if [[ "$WSGI_MODE" != "uwsgi" ]]; then
+            start_tls_proxy glance-service '*' $GLANCE_SERVICE_PORT $GLANCE_SERVICE_HOST $GLANCE_SERVICE_PORT_INT
+        fi
         start_tls_proxy glance-registry '*' $GLANCE_REGISTRY_PORT $GLANCE_SERVICE_HOST $GLANCE_REGISTRY_PORT_INT
     fi
 
     run_process g-reg "$GLANCE_BIN_DIR/glance-registry --config-file=$GLANCE_CONF_DIR/glance-registry.conf"
-    run_process g-api "$GLANCE_BIN_DIR/glance-api --config-file=$GLANCE_CONF_DIR/glance-api.conf"
+    if [[ "$WSGI_MODE" == "uwsgi" ]]; then
+        run_process g-api "$GLANCE_BIN_DIR/uwsgi --ini $GLANCE_UWSGI_CONF"
+    else
+        run_process g-api "$GLANCE_BIN_DIR/glance-api --config-file=$GLANCE_CONF_DIR/glance-api.conf"
+    fi
 
-    echo "Waiting for g-api ($GLANCE_HOSTPORT) to start..."
-    if ! wait_for_service $SERVICE_TIMEOUT $GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT; then
+    echo "Waiting for g-api ($GLANCE_SERVICE_HOST) to start..."
+    if ! wait_for_service $SERVICE_TIMEOUT $GLANCE_URL; then
         die $LINENO "g-api did not start"
     fi
 }
diff --git a/lib/nova b/lib/nova
index de053ab389..f9cad2551d 100644
--- a/lib/nova
+++ b/lib/nova
@@ -574,7 +574,7 @@ function create_nova_conf {
     # enable notifications, but it will allow them to function when enabled.
     iniset $NOVA_CONF oslo_messaging_notifications driver "messagingv2"
     iniset_rpc_backend nova $NOVA_CONF
-    iniset $NOVA_CONF glance api_servers "${GLANCE_SERVICE_PROTOCOL}://${GLANCE_HOSTPORT}"
+    iniset $NOVA_CONF glance api_servers "$GLANCE_URL"
 
     iniset $NOVA_CONF DEFAULT osapi_compute_workers "$API_WORKERS"
     iniset $NOVA_CONF DEFAULT metadata_workers "$API_WORKERS"

From 35649ae0d2a356c310fd92f16356bdd086cab290 Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Sat, 27 May 2017 17:52:55 -0700
Subject: [PATCH 0987/2409] Make stack.sh work on SUSE

This adds packages to suse for systemd python linkages as well as
apache2 and which. And configures mod_proxy and mod_proxy_uwsgi with
a2enmod.

We also properly query if apache mods are enabled to avoid running
into systemd service restart limits. Enable mod_version across the board
as we use it and it may not be enabled by default (like in SUSE).

Also in addition to enabling mod_ssl we enable the SSL flag so that TLS
will work...

Finally we tell the system to trust the devstack CA.

Change-Id: I3442cebfb2e7c2550733eb95a12fab42e1229ce7
---
 files/rpms-suse/general |  4 ++++
 lib/apache              | 15 ++++++++++++---
 lib/tls                 | 12 ++++++++++++
 3 files changed, 28 insertions(+), 3 deletions(-)

diff --git a/files/rpms-suse/general b/files/rpms-suse/general
index 1044c25288..370f2409f7 100644
--- a/files/rpms-suse/general
+++ b/files/rpms-suse/general
@@ -1,3 +1,5 @@
+apache2
+apache2-devel
 bc
 bridge-utils
 ca-certificates-mozilla
@@ -23,9 +25,11 @@ python-cmd2 # dist:opensuse-12.3
 python-devel  # pyOpenSSL
 python-xml
 screen
+systemd-devel # for systemd-python
 tar
 tcpdump
 unzip
 util-linux
 wget
+which
 zlib-devel
diff --git a/lib/apache b/lib/apache
index 34ac660266..43d5000808 100644
--- a/lib/apache
+++ b/lib/apache
@@ -53,8 +53,15 @@ APACHE_LOG_DIR="/var/log/${APACHE_NAME}"
 function enable_apache_mod {
     local mod=$1
     # Apache installation, because we mark it NOPRIME
-    if is_ubuntu || is_suse ; then
-        if ! a2query -m $mod ; then
+    if is_ubuntu; then
+        # Skip mod_version as it is not a valid mod to enable
+        # on debuntu, instead it is built in.
+        if [[ "$mod" != "version" ]] && ! a2query -m $mod ; then
+            sudo a2enmod $mod
+            restart_apache_server
+        fi
+    elif is_suse; then
+        if ! a2enmod -q $mod ; then
             sudo a2enmod $mod
             restart_apache_server
         fi
@@ -96,7 +103,7 @@ function install_apache_uwsgi {
     # delete the temp directory
     sudo rm -rf $dir
 
-    if is_ubuntu; then
+    if is_ubuntu || is_suse ; then
         # we've got to enable proxy and proxy_uwsgi for this to work
         sudo a2enmod proxy
         sudo a2enmod proxy_uwsgi
@@ -171,6 +178,8 @@ function apache_site_config_for {
 # enable_apache_site() - Enable a particular apache site
 function enable_apache_site {
     local site=$@
+    # Many of our sites use mod version. Just enable it.
+    enable_apache_mod version
     if is_ubuntu; then
         sudo a2ensite ${site}
     elif is_fedora || is_suse; then
diff --git a/lib/tls b/lib/tls
index 238687c5dd..de7a3affa1 100644
--- a/lib/tls
+++ b/lib/tls
@@ -212,6 +212,9 @@ function init_CA {
     if is_fedora; then
         sudo cp $INT_CA_DIR/ca-chain.pem /usr/share/pki/ca-trust-source/anchors/devstack-chain.pem
         sudo update-ca-trust
+    elif is_suse; then
+        sudo cp $INT_CA_DIR/ca-chain.pem /usr/share/pki/trust/anchors/devstack-chain.pem
+        sudo update-ca-certificates
     elif is_ubuntu; then
         sudo cp $INT_CA_DIR/ca-chain.pem /usr/local/share/ca-certificates/devstack-int.crt
         sudo cp $ROOT_CA_DIR/cacert.pem /usr/local/share/ca-certificates/devstack-root.crt
@@ -354,6 +357,9 @@ function fix_system_ca_bundle_path {
             elif is_ubuntu; then
                 sudo rm -f $capath
                 sudo ln -s /etc/ssl/certs/ca-certificates.crt $capath
+            elif is_suse; then
+                sudo rm -f $capath
+                sudo ln -s /etc/ssl/ca-bundle.pem $capath
             else
                 echo "Don't know how to set the CA bundle, expect the install to fail."
             fi
@@ -416,6 +422,9 @@ function enable_mod_ssl {
 
     if is_ubuntu; then
         sudo a2enmod ssl
+    elif is_suse; then
+        sudo a2enmod ssl
+        sudo a2enflag SSL
     elif is_fedora; then
         # Fedora enables mod_ssl by default
         :
@@ -522,6 +531,9 @@ $listen_string
     LogFormat "%v %h %l %u %t \"%r\" %>s %b"
 </VirtualHost>
 EOF
+    if is_suse ; then
+        sudo a2enflag SSL
+    fi
     for mod in ssl proxy proxy_http; do
         enable_apache_mod $mod
     done

From 14728c7a51c56141eafbf58617814680887c6690 Mon Sep 17 00:00:00 2001
From: Markus Zoeller <mzoeller@de.ibm.com>
Date: Mon, 29 May 2017 15:39:21 +0200
Subject: [PATCH 0988/2409] docs: add "kvm on s390x" specific configuration in
 `local.conf`

The upstream CI runs exclusively on nodes with x86 architectures, but
OpenStack supports even more platforms. One of them is the KVM
on s390x (IBM z systems), which is supported since the *Kilo* release.
This change describes the additional settings in the ``local.conf`` file
to enable Devstack on that platform. This is useful for PoCs.

Change-Id: I943b552ca2e36210ac57f36c16db930eb5e58623
---
 doc/source/configuration.rst | 60 ++++++++++++++++++++++++++++++++++++
 1 file changed, 60 insertions(+)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 66b8702f76..064bf515e6 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -195,6 +195,9 @@ will not be set if there is no IPv6 address on the default Ethernet interface.
 Setting it here also makes it available for ``openrc`` to set ``OS_AUTH_URL``.
 ``HOST_IPV6`` is not set by default.
 
+For architecture specific configurations which differ from the x86 default
+here, see `arch-configuration`_.
+
 Historical Notes
 ================
 
@@ -749,3 +752,60 @@ overridden by setting them in the ``localrc`` section.
     ::
 
         TERMINATE_TIMEOUT=30
+
+
+.. _arch-configuration:
+
+Architectures
+-------------
+
+The upstream CI runs exclusively on nodes with x86 architectures, but
+OpenStack supports even more architectures. Some of them need to configure
+Devstack in a certain way.
+
+KVM on s390x (IBM z Systems)
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+KVM on s390x (IBM z Systems) is supported since the *Kilo* release. For
+an all-in-one setup, these minimal settings in the ``local.conf`` file
+are needed::
+
+    [[local|localrc]]
+    ADMIN_PASSWORD=secret
+    DATABASE_PASSWORD=$ADMIN_PASSWORD
+    RABBIT_PASSWORD=$ADMIN_PASSWORD
+    SERVICE_PASSWORD=$ADMIN_PASSWORD
+
+    DOWNLOAD_DEFAULT_IMAGES=False
+    IMAGE_URLS="https://cloud-images.ubuntu.com/xenial/current/xenial-server-cloudimg-s390x-disk1.img"
+
+    enable_service n-sproxy
+    disable_service n-novnc
+    disable_service etcd3  # https://bugs.launchpad.net/devstack/+bug/1693192
+
+    [[post-config|$NOVA_CONF]]
+
+    [serial_console]
+    base_url=ws://$HOST_IP:6083/  # optional
+
+Reasoning:
+
+* The default image of Devstack is x86 only, so we deactivate the download
+  with ``DOWNLOAD_DEFAULT_IMAGES``. The referenced guest image
+  in the code above (``IMAGE_URLS``) serves as an example. The list of
+  possible s390x guest images is not limited to that.
+
+* This platform doesn't support a graphical console like VNC or SPICE.
+  The technical reason is the missing framebuffer on the platform. This
+  means we rely on the substitute feature *serial console* which needs the
+  proxy service ``n-sproxy``. We also disable VNC's proxy ``n-novnc`` for
+  that reason . The configuration in the ``post-config`` section is only
+  needed if you want to use the *serial console* outside of the all-in-one
+  setup.
+
+* The service ``etcd3`` needs to be disabled as long as bug report
+  https://bugs.launchpad.net/devstack/+bug/1693192 is not resolved.
+
+.. note:: To run *Tempest* against this *Devstack* all-in-one, you'll need
+   to use a guest image which is smaller than 1GB when uncompressed.
+   The example image from above is bigger than that!

From 2dfca047d97d4867048dbc9eec34b6f7ff54655e Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Thu, 25 May 2017 14:57:19 -0700
Subject: [PATCH 0989/2409] Don't run and check c-api if it is disabled

Previously we didn't block out the c-api startup code because the
devstack functions to start services check that for us. However, since
the cinder devstack code checks the service is up and runs the tls proxy
if tls is enabled we need to block it all off to avoid doing those
things if c-api is disabled.

Change-Id: I1c4f22f785af96caaf4baa21ff28714b9afd3458
---
 lib/cinder | 32 +++++++++++++++++---------------
 1 file changed, 17 insertions(+), 15 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index e3a687b4f2..f36c179cf2 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -512,17 +512,24 @@ function start_cinder {
         fi
     fi
 
-    if [ "$CINDER_USE_MOD_WSGI" == "True" ]; then
-        enable_apache_site osapi-volume
-        restart_apache_server
-        tail_log c-api /var/log/$APACHE_NAME/c-api.log
-    else
-        run_process c-api "$CINDER_BIN_DIR/cinder-api --config-file $CINDER_CONF"
-    fi
+    if is_service_enabled c-api ; then
+        if [ "$CINDER_USE_MOD_WSGI" == "True" ]; then
+            enable_apache_site osapi-volume
+            restart_apache_server
+            tail_log c-api /var/log/$APACHE_NAME/c-api.log
+        else
+            run_process c-api "$CINDER_BIN_DIR/cinder-api --config-file $CINDER_CONF"
+        fi
 
-    echo "Waiting for Cinder API to start..."
-    if ! wait_for_service $SERVICE_TIMEOUT $service_protocol://$CINDER_SERVICE_HOST:$service_port; then
-        die $LINENO "c-api did not start"
+        echo "Waiting for Cinder API to start..."
+        if ! wait_for_service $SERVICE_TIMEOUT $service_protocol://$CINDER_SERVICE_HOST:$service_port; then
+            die $LINENO "c-api did not start"
+        fi
+
+        # Start proxies if enabled
+        if is_service_enabled tls-proxy; then
+            start_tls_proxy cinder '*' $CINDER_SERVICE_PORT $CINDER_SERVICE_HOST $CINDER_SERVICE_PORT_INT
+        fi
     fi
 
     run_process c-sch "$CINDER_BIN_DIR/cinder-scheduler --config-file $CINDER_CONF"
@@ -532,11 +539,6 @@ function start_cinder {
     # NOTE(jdg): For cinder, startup order matters.  To ensure that repor_capabilities is received
     # by the scheduler start the cinder-volume service last (or restart it) after the scheduler
     # has started.  This is a quick fix for lp bug/1189595
-
-    # Start proxies if enabled
-    if is_service_enabled c-api && is_service_enabled tls-proxy; then
-        start_tls_proxy cinder '*' $CINDER_SERVICE_PORT $CINDER_SERVICE_HOST $CINDER_SERVICE_PORT_INT
-    fi
 }
 
 # stop_cinder() - Stop running processes

From 29ec28216f91eab118134b5444e0276ef845e0d0 Mon Sep 17 00:00:00 2001
From: Sean McGinnis <sean.mcginnis@gmail.com>
Date: Tue, 30 May 2017 14:21:39 -0500
Subject: [PATCH 0990/2409] Configure volume_clear setting per backend

volume_clear is currently set in the DEFAULT section,
but this is a backend specific setting, and therefore
needs to be set in the backend config section.

Change-Id: Ifa3a659bb4768b8915a0f23e7f14b0f3348d93d2
---
 lib/cinder | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 2f302c0204..762edc4393 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -289,6 +289,9 @@ function configure_cinder {
                 default_name=$be_name
             fi
             enabled_backends+=$be_name,
+
+            iniset $CINDER_CONF $be_name volume_clear $CINDER_VOLUME_CLEAR
+
         done
         iniset $CINDER_CONF DEFAULT enabled_backends ${enabled_backends%,*}
         if [[ -n "$default_name" ]]; then
@@ -318,8 +321,6 @@ function configure_cinder {
 
     iniset_rpc_backend cinder $CINDER_CONF
 
-    iniset $CINDER_CONF DEFAULT volume_clear $CINDER_VOLUME_CLEAR
-
     # Format logging
     setup_logging $CINDER_CONF $CINDER_USE_MOD_WSGI
 

From 6f962a2ee5e131282b1e2bc117784ae41b083cad Mon Sep 17 00:00:00 2001
From: Rodolfo Alonso Hernandez <rodolfo.alonso.hernandez@intel.com>
Date: Wed, 31 May 2017 11:00:08 +0100
Subject: [PATCH 0991/2409] Change "files" directory in etcd project

Function "_install_etcd" is trying to use "files" directory
to download a file. Instead of this, this directory should be
$FILES, which is defined previously in parent script.

TrivialFix
Change-Id: I643ce3b9aba1f65f03524430c748bf120d071509
---
 lib/etcd3 | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/lib/etcd3 b/lib/etcd3
index 5cab3f556a..a1a2ac6a74 100644
--- a/lib/etcd3
+++ b/lib/etcd3
@@ -123,18 +123,18 @@ function _install_etcd {
     sudo mkdir -p $ETCD_DATA_DIR
 
     # Download and cache the etcd tgz for subsequent use
-    if [ ! -f "files/etcd-$ETCD_VERSION-linux-$ETCD_ARCH/etcd" ]; then
+    if [ ! -f "$FILES/etcd-$ETCD_VERSION-linux-$ETCD_ARCH/etcd" ]; then
         ETCD_DOWNLOAD_FILE=$ETCD_NAME.tar.gz
-        wget $ETCD_DOWNLOAD_URL/$ETCD_VERSION/$ETCD_DOWNLOAD_FILE -O files/$ETCD_DOWNLOAD_FILE
-        echo "${ETCD_SHA256} files/${ETCD_DOWNLOAD_FILE}" > files/etcd.sha256sum
+        wget $ETCD_DOWNLOAD_URL/$ETCD_VERSION/$ETCD_DOWNLOAD_FILE -O $FILES/$ETCD_DOWNLOAD_FILE
+        echo "${ETCD_SHA256} $FILES/${ETCD_DOWNLOAD_FILE}" > $FILES/etcd.sha256sum
         # NOTE(sdague): this should go fatal if this fails
-        sha256sum -c files/etcd.sha256sum
+        sha256sum -c $FILES/etcd.sha256sum
 
-        tar xzvf files/$ETCD_DOWNLOAD_FILE -C files
-        sudo cp files/$ETCD_NAME/etcd $ETCD_BIN_DIR/etcd
+        tar xzvf $FILES/$ETCD_DOWNLOAD_FILE -C $FILES
+        sudo cp $FILES/$ETCD_NAME/etcd $ETCD_BIN_DIR/etcd
     fi
     if [ ! -f "$ETCD_BIN_DIR/etcd" ]; then
-        sudo cp files/$ETCD_NAME/etcd $ETCD_BIN_DIR/etcd
+        sudo cp $FILES/$ETCD_NAME/etcd $ETCD_BIN_DIR/etcd
     fi
 }
 

From 07b3bc24a3dc30cf4ec7ab2448128bf5a07fbfc0 Mon Sep 17 00:00:00 2001
From: gong yong sheng <gong.yongsheng@99cloud.net>
Date: Mon, 5 Jun 2017 14:02:28 +0800
Subject: [PATCH 0992/2409] Change restart Always to always

Change-Id: I1cb00cc012eda72ff50e958ba1fb04daeac69e26
Closes-bug: #1695822
---
 functions-common | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index 30933ea4c2..26d1c28cac 100644
--- a/functions-common
+++ b/functions-common
@@ -1468,7 +1468,7 @@ function write_uwsgi_user_unit_file {
     iniset -sudo $unitfile "Service" "ExecStart" "$command"
     iniset -sudo $unitfile "Service" "Type" "notify"
     iniset -sudo $unitfile "Service" "KillSignal" "SIGQUIT"
-    iniset -sudo $unitfile "Service" "Restart" "Always"
+    iniset -sudo $unitfile "Service" "Restart" "always"
     iniset -sudo $unitfile "Service" "NotifyAccess" "all"
     iniset -sudo $unitfile "Service" "RestartForceExitStatus" "100"
 

From 1ade00da55cfc383b4832f8da03df01001b40fcd Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Mon, 5 Jun 2017 11:01:45 -0400
Subject: [PATCH 0993/2409] Fix scheduler_default_filters usage

The scheduler_default_filters config option moved out of the
DEFAULT option group into a more specific group, and the old
option is deprecated as a result so we need to update our usage.

Change-Id: I5d6574d19c3f16abadddb19f34cb645dcdcc07f4
---
 lib/nova                         | 2 +-
 lib/nova_plugins/hypervisor-fake | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/nova b/lib/nova
index e580abb4b0..9c3ba33013 100644
--- a/lib/nova
+++ b/lib/nova
@@ -454,7 +454,7 @@ function create_nova_conf {
     iniset $NOVA_CONF wsgi api_paste_config "$NOVA_API_PASTE_INI"
     iniset $NOVA_CONF DEFAULT rootwrap_config "$NOVA_CONF_DIR/rootwrap.conf"
     iniset $NOVA_CONF DEFAULT scheduler_driver "$SCHEDULER"
-    iniset $NOVA_CONF DEFAULT scheduler_default_filters "$FILTERS"
+    iniset $NOVA_CONF filter_scheduler enabled_filters "$FILTERS"
     iniset $NOVA_CONF DEFAULT default_floating_pool "$PUBLIC_NETWORK_NAME"
     if [[ $SERVICE_IP_VERSION == 6 ]]; then
         iniset $NOVA_CONF DEFAULT my_ip "$HOST_IPV6"
diff --git a/lib/nova_plugins/hypervisor-fake b/lib/nova_plugins/hypervisor-fake
index f9b95c1816..49c8dee83a 100644
--- a/lib/nova_plugins/hypervisor-fake
+++ b/lib/nova_plugins/hypervisor-fake
@@ -49,7 +49,7 @@ function configure_nova_hypervisor {
     iniset $NOVA_CONF DEFAULT quota_security_groups -1
     iniset $NOVA_CONF DEFAULT quota_security_group_rules -1
     iniset $NOVA_CONF DEFAULT quota_key_pairs -1
-    iniset $NOVA_CONF DEFAULT scheduler_default_filters "RetryFilter,AvailabilityZoneFilter,ComputeFilter,ComputeCapabilitiesFilter,ImagePropertiesFilter,CoreFilter,RamFilter,DiskFilter"
+    iniset $NOVA_CONF filter_scheduler enabled_filters "RetryFilter,AvailabilityZoneFilter,ComputeFilter,ComputeCapabilitiesFilter,ImagePropertiesFilter,CoreFilter,RamFilter,DiskFilter"
 }
 
 # install_nova_hypervisor() - Install external components

From 7a74c2ab24dc7083996df5c9ed7baf89cbf219f3 Mon Sep 17 00:00:00 2001
From: Chris Dent <cdent@anticdent.org>
Date: Mon, 5 Jun 2017 16:06:06 +0000
Subject: [PATCH 0994/2409] Start placement before services that might like to
 use it

Otherwise those services, notably n-cpu, will try to register
resource providers before placement is ready.

Change-Id: I89fd4fa42baf3d19ee209c59cd85b97adb97c58b
Closes-Bug: #1695634
---
 stack.sh | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/stack.sh b/stack.sh
index 048acf8e52..24f534d2a5 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1300,6 +1300,13 @@ elif is_service_enabled $DATABASE_BACKENDS && is_service_enabled n-net; then
     $NOVA_BIN_DIR/nova-manage --config-file $NM_CONF floating create --ip_range=$TEST_FLOATING_RANGE --pool=$TEST_FLOATING_POOL
 fi
 
+# Start placement before any of the service that are likely to want
+# to use it to manage resource providers.
+if is_service_enabled placement; then
+    echo_summary "Starting Placement"
+    start_placement
+fi
+
 if is_service_enabled neutron; then
     start_neutron
 fi
@@ -1314,10 +1321,6 @@ if is_service_enabled nova; then
     start_nova
     create_flavors
 fi
-if is_service_enabled placement; then
-    echo_summary "Starting Placement"
-    start_placement
-fi
 if is_service_enabled cinder; then
     echo_summary "Starting Cinder"
     start_cinder

From e28db4c2f297c8438fdc614954339f9178c07d54 Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Thu, 1 Jun 2017 16:07:32 -0700
Subject: [PATCH 0995/2409] Set swift functest config when using tls

Because the swift functests (which use test.conf) run out of a
virtualenv they don't get access to the system wide trust of the
devstack CA. Handle this by explicitly configuring the cafile to trust
in the test.conf file.

We also set the web_front_end to apache2 as that is what is terminating
TLS for us. The tests handle different web server behaviors using this
flag.

Swift's functests will need to read these values in and properly
configure things on its end.

Change-Id: I4cdba36ccab6acd76205184882ee29e4f1e12333
---
 lib/swift | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/swift b/lib/swift
index 8fad6b8f97..79ead6c104 100644
--- a/lib/swift
+++ b/lib/swift
@@ -541,6 +541,10 @@ EOF
         else
             iniset ${testfile} func_test auth_prefix /identity/v2.0/
         fi
+        if is_service_enabled tls-proxy; then
+            iniset ${testfile} func_test cafile ${SSL_BUNDLE_FILE}
+            iniset ${testfile} func_test web_front_end apache2
+        fi
     fi
 
     local user_group

From e61e19ee82b8b35decdaa4151aa9d4762b8153cb Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Sat, 27 May 2017 23:43:05 +0200
Subject: [PATCH 0996/2409] Enable opensuse-42.2 as a tested distro

openSUSE 42.2 passes testing on the experimental gate and
in order to add it as continuosly tested target we need to
add it to the positive list of tested distributions.

Change-Id: I46f94cfad828534f324994c3d21bddff40e8f9a2
---
 stack.sh                 | 2 +-
 tools/install_prereqs.sh | 8 ++++++++
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index 83da1c61cb..8989ad6141 100755
--- a/stack.sh
+++ b/stack.sh
@@ -192,7 +192,7 @@ source $TOP_DIR/stackrc
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (xenial|yakkety|zesty|stretch|jessie|f24|f25|rhel7|kvmibm1) ]]; then
+if [[ ! ${DISTRO} =~ (xenial|yakkety|zesty|stretch|jessie|f24|f25|opensuse-42.2|rhel7|kvmibm1) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"
diff --git a/tools/install_prereqs.sh b/tools/install_prereqs.sh
index da59093581..a77eae6fe7 100755
--- a/tools/install_prereqs.sh
+++ b/tools/install_prereqs.sh
@@ -60,6 +60,14 @@ export_proxy_variables
 # Install Packages
 # ================
 
+if [[ "${DISTRO}" == "opensuse-42.2" ]]; then
+    # temporary workaround until https://bugzilla.suse.com/show_bug.cgi?id=1041161 is fixed
+    sudo zypper ar -f http://download.opensuse.org/update/leap/42.2-test/ leap42.2-test-updates
+    sudo zypper --non-interactive --gpg-auto-import-keys --no-gpg-checks ref
+    sudo zypper --non-interactive install liberasurecode-devel
+    sudo zypper rr leap42.2-test-updates
+fi
+
 # Install package requirements
 PACKAGES=$(get_packages general,$ENABLED_SERVICES)
 PACKAGES="$PACKAGES $(get_plugin_packages)"

From f4dbd12f78236c7c98b68d7841783ed29d6e77d7 Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Wed, 31 May 2017 13:17:22 -0700
Subject: [PATCH 0997/2409] Set specified header size when enabling tls-proxy

As part of getting swift's functional testing to work properly through
the tls-proxy we need to increase the allowed request header size in
apache. This was a non issue without tls proxy as requests hit the
eventlet webserver directly which was configured via the swift config
which sets this relatively large limit (by default devstack configures
swift to have a header size limit of 16384).

Now we pass in an optional parameter to start_tls_proxy that includes
the desired header size. lib/swift then passes in the value it also
configures in its swift.conf.

If not explicitly set we default to 8190 which is apache2's default.

Change-Id: Ib2811c8d3cbb49cf94b70294788526b15a798edd
---
 lib/swift | 2 +-
 lib/tls   | 7 +++++++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/lib/swift b/lib/swift
index 8fad6b8f97..8769e98cd8 100644
--- a/lib/swift
+++ b/lib/swift
@@ -837,7 +837,7 @@ function start_swift {
 
     if is_service_enabled tls-proxy; then
         local proxy_port=${SWIFT_DEFAULT_BIND_PORT}
-        start_tls_proxy swift '*' $proxy_port $SERVICE_HOST $SWIFT_DEFAULT_BIND_PORT_INT
+        start_tls_proxy swift '*' $proxy_port $SERVICE_HOST $SWIFT_DEFAULT_BIND_PORT_INT $SWIFT_MAX_HEADER_SIZE
     fi
     run_process s-proxy "$SWIFT_BIN_DIR/swift-proxy-server ${SWIFT_CONF_DIR}/proxy-server.conf -v"
 
diff --git a/lib/tls b/lib/tls
index 65c2cba300..3f59d5b8a3 100644
--- a/lib/tls
+++ b/lib/tls
@@ -485,6 +485,8 @@ function start_tls_proxy {
     local f_port=$3
     local b_host=$4
     local b_port=$5
+    # 8190 is the default apache size.
+    local f_header_size=${6:-8190}
 
     tune_apache_connections
 
@@ -512,6 +514,11 @@ $listen_string
     # ('Connection aborted.', BadStatusLine("''",)) error
     KeepAlive Off
 
+    # This increase in allowed request header sizes is required
+    # for swift functional testing to work with tls enabled. It is 2 bytes
+    # larger than the apache default of 8190.
+    LimitRequestFieldSize $f_header_size
+
     <Location />
         ProxyPass http://$b_host:$b_port/ retry=0 nocanon
         ProxyPassReverse http://$b_host:$b_port/

From aefc926cd45b2dc74d98f89e3a3b4cc92f2090ff Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Wed, 31 May 2017 15:39:48 -0400
Subject: [PATCH 0998/2409] Support installing os-traits from git

This will be used in a src job for running os-traits changes
in a dsvm/tempest setup.

Change-Id: I3c4433fb1ca2787e96b577a15d584b625c364ef3
---
 lib/oslo                     | 6 ++++++
 stackrc                      | 4 ++++
 tests/test_libs_from_pypi.sh | 2 +-
 3 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/lib/oslo b/lib/oslo
index 2895503de6..d15a3031a2 100644
--- a/lib/oslo
+++ b/lib/oslo
@@ -54,6 +54,11 @@ GITDIR["python-openstacksdk"]=$DEST/python-openstacksdk
 GITDIR["stevedore"]=$DEST/stevedore
 GITDIR["taskflow"]=$DEST/taskflow
 GITDIR["tooz"]=$DEST/tooz
+# TODO(mriedem): This is a common pattern so even though os-traits isn't
+# officially an oslo library, it is nice to re-use this script for non-oslo
+# things like os-traits. We should rename this script to be more generic
+# and then fold os-brick into it also.
+GITDIR["os-traits"]=$DEST/os-traits
 
 # Support entry points installation of console scripts
 OSLO_BIN_DIR=$(get_python_exec_prefix)
@@ -104,6 +109,7 @@ function install_oslo {
     _do_install_oslo_lib "stevedore"
     _do_install_oslo_lib "taskflow"
     _do_install_oslo_lib "tooz"
+    _do_install_oslo_lib "os-traits"
 }
 
 # Restore xtrace
diff --git a/stackrc b/stackrc
index e9b8df2131..6d11589f11 100644
--- a/stackrc
+++ b/stackrc
@@ -570,6 +570,10 @@ GITREPO["neutron-lib"]=${NEUTRON_LIB_REPO:-${GIT_BASE}/openstack/neutron-lib.git
 GITBRANCH["neutron-lib"]=${NEUTRON_LIB_BRANCH:-master}
 GITDIR["neutron-lib"]=$DEST/neutron-lib
 
+# os-traits library for resource provider traits in the placement service
+GITREPO["os-traits"]=${OS_TRAITS_REPO:-${GIT_BASE}/openstack/os-traits.git}
+GITBRANCH["os-traits"]=${OS_TRAITS_BRANCH:-master}
+
 ##################
 #
 #  TripleO / Heat Agent Components
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index 608ef6ae91..1f2d3c23b8 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -39,7 +39,7 @@ ALL_LIBS+=" oslo.serialization django_openstack_auth"
 ALL_LIBS+=" python-openstackclient osc-lib os-client-config oslo.rootwrap"
 ALL_LIBS+=" oslo.i18n oslo.utils python-openstacksdk python-swiftclient"
 ALL_LIBS+=" python-neutronclient tooz ceilometermiddleware oslo.policy"
-ALL_LIBS+=" debtcollector os-brick automaton futurist oslo.service"
+ALL_LIBS+=" debtcollector os-brick os-traits automaton futurist oslo.service"
 ALL_LIBS+=" oslo.cache oslo.reports osprofiler cursive"
 ALL_LIBS+=" keystoneauth ironic-lib neutron-lib oslo.privsep"
 ALL_LIBS+=" diskimage-builder os-vif python-brick-cinderclient-ext"

From bbf14db3a7cb72703ee19040e29242ed128ddf0f Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Tue, 6 Jun 2017 23:28:26 +0200
Subject: [PATCH 0999/2409] Remove temporary openSUSE-42.2 workaround

We required initially 42.2 test updates to be enabled as the
liberasurecode-devel update wasn't released. It is now released
so we can stop pulling that part in.

Change-Id: I4e514e317da8a95809593a49c6dce619bc4c021f
---
 tools/install_prereqs.sh | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/tools/install_prereqs.sh b/tools/install_prereqs.sh
index a77eae6fe7..da59093581 100755
--- a/tools/install_prereqs.sh
+++ b/tools/install_prereqs.sh
@@ -60,14 +60,6 @@ export_proxy_variables
 # Install Packages
 # ================
 
-if [[ "${DISTRO}" == "opensuse-42.2" ]]; then
-    # temporary workaround until https://bugzilla.suse.com/show_bug.cgi?id=1041161 is fixed
-    sudo zypper ar -f http://download.opensuse.org/update/leap/42.2-test/ leap42.2-test-updates
-    sudo zypper --non-interactive --gpg-auto-import-keys --no-gpg-checks ref
-    sudo zypper --non-interactive install liberasurecode-devel
-    sudo zypper rr leap42.2-test-updates
-fi
-
 # Install package requirements
 PACKAGES=$(get_packages general,$ENABLED_SERVICES)
 PACKAGES="$PACKAGES $(get_plugin_packages)"

From a40e036d808a1db5961351c506bfb2bacc61cd2f Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Wed, 7 Jun 2017 08:24:31 +0000
Subject: [PATCH 1000/2409] Updated from generate-devstack-plugins-list

Change-Id: I5980980fe5071a781b5b95efd69f479359f8ee6e
---
 doc/source/plugin-registry.rst | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 96a2733690..9bfedcf0ef 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -48,6 +48,7 @@ devstack-plugin-container              `git://git.openstack.org/openstack/devsta
 devstack-plugin-glusterfs              `git://git.openstack.org/openstack/devstack-plugin-glusterfs <https://git.openstack.org/cgit/openstack/devstack-plugin-glusterfs>`__
 devstack-plugin-hdfs                   `git://git.openstack.org/openstack/devstack-plugin-hdfs <https://git.openstack.org/cgit/openstack/devstack-plugin-hdfs>`__
 devstack-plugin-kafka                  `git://git.openstack.org/openstack/devstack-plugin-kafka <https://git.openstack.org/cgit/openstack/devstack-plugin-kafka>`__
+devstack-plugin-libvirt-qemu           `git://git.openstack.org/openstack/devstack-plugin-libvirt-qemu <https://git.openstack.org/cgit/openstack/devstack-plugin-libvirt-qemu>`__
 devstack-plugin-mariadb                `git://git.openstack.org/openstack/devstack-plugin-mariadb <https://git.openstack.org/cgit/openstack/devstack-plugin-mariadb>`__
 devstack-plugin-nfs                    `git://git.openstack.org/openstack/devstack-plugin-nfs <https://git.openstack.org/cgit/openstack/devstack-plugin-nfs>`__
 devstack-plugin-pika                   `git://git.openstack.org/openstack/devstack-plugin-pika <https://git.openstack.org/cgit/openstack/devstack-plugin-pika>`__
@@ -62,7 +63,6 @@ freezer-web-ui                         `git://git.openstack.org/openstack/freeze
 fuxi                                   `git://git.openstack.org/openstack/fuxi <https://git.openstack.org/cgit/openstack/fuxi>`__
 gce-api                                `git://git.openstack.org/openstack/gce-api <https://git.openstack.org/cgit/openstack/gce-api>`__
 glare                                  `git://git.openstack.org/openstack/glare <https://git.openstack.org/cgit/openstack/glare>`__
-gnocchi                                `git://git.openstack.org/openstack/gnocchi <https://git.openstack.org/cgit/openstack/gnocchi>`__
 group-based-policy                     `git://git.openstack.org/openstack/group-based-policy <https://git.openstack.org/cgit/openstack/group-based-policy>`__
 heat                                   `git://git.openstack.org/openstack/heat <https://git.openstack.org/cgit/openstack/heat>`__
 horizon-mellanox                       `git://git.openstack.org/openstack/horizon-mellanox <https://git.openstack.org/cgit/openstack/horizon-mellanox>`__
@@ -136,6 +136,7 @@ octavia-dashboard                      `git://git.openstack.org/openstack/octavi
 os-xenapi                              `git://git.openstack.org/openstack/os-xenapi <https://git.openstack.org/cgit/openstack/os-xenapi>`__
 osprofiler                             `git://git.openstack.org/openstack/osprofiler <https://git.openstack.org/cgit/openstack/osprofiler>`__
 panko                                  `git://git.openstack.org/openstack/panko <https://git.openstack.org/cgit/openstack/panko>`__
+patrole                                `git://git.openstack.org/openstack/patrole <https://git.openstack.org/cgit/openstack/patrole>`__
 picasso                                `git://git.openstack.org/openstack/picasso <https://git.openstack.org/cgit/openstack/picasso>`__
 rally                                  `git://git.openstack.org/openstack/rally <https://git.openstack.org/cgit/openstack/rally>`__
 sahara                                 `git://git.openstack.org/openstack/sahara <https://git.openstack.org/cgit/openstack/sahara>`__
@@ -145,6 +146,7 @@ searchlight                            `git://git.openstack.org/openstack/search
 searchlight-ui                         `git://git.openstack.org/openstack/searchlight-ui <https://git.openstack.org/cgit/openstack/searchlight-ui>`__
 senlin                                 `git://git.openstack.org/openstack/senlin <https://git.openstack.org/cgit/openstack/senlin>`__
 solum                                  `git://git.openstack.org/openstack/solum <https://git.openstack.org/cgit/openstack/solum>`__
+stackube                               `git://git.openstack.org/openstack/stackube <https://git.openstack.org/cgit/openstack/stackube>`__
 tacker                                 `git://git.openstack.org/openstack/tacker <https://git.openstack.org/cgit/openstack/tacker>`__
 tap-as-a-service                       `git://git.openstack.org/openstack/tap-as-a-service <https://git.openstack.org/cgit/openstack/tap-as-a-service>`__
 tricircle                              `git://git.openstack.org/openstack/tricircle <https://git.openstack.org/cgit/openstack/tricircle>`__

From 886d7dbe12bb0f25a3612d54877a41a917dee1f0 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Mon, 5 Jun 2017 11:32:32 -0400
Subject: [PATCH 1001/2409] nova: fix usage of scheduler_driver config option

The scheduler_driver option has been moved and deprecated. This
change uses the new group and name for the option.

Change-Id: I27aeff5911510c9f47191acaa0c0b5b71f977cd7
---
 lib/nova | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index 9c3ba33013..b7a03695df 100644
--- a/lib/nova
+++ b/lib/nova
@@ -453,7 +453,7 @@ function create_nova_conf {
     fi
     iniset $NOVA_CONF wsgi api_paste_config "$NOVA_API_PASTE_INI"
     iniset $NOVA_CONF DEFAULT rootwrap_config "$NOVA_CONF_DIR/rootwrap.conf"
-    iniset $NOVA_CONF DEFAULT scheduler_driver "$SCHEDULER"
+    iniset $NOVA_CONF scheduler driver "$SCHEDULER"
     iniset $NOVA_CONF filter_scheduler enabled_filters "$FILTERS"
     iniset $NOVA_CONF DEFAULT default_floating_pool "$PUBLIC_NETWORK_NAME"
     if [[ $SERVICE_IP_VERSION == 6 ]]; then

From 902158bb8fb8452d747225e5986fb789828e4e67 Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Tue, 30 May 2017 14:11:09 -0700
Subject: [PATCH 1002/2409] Don't treat service as enabled if in disabled list

The old implementation for is_$service_enabled simply checked if any of
the subservices were enabled and if so the service was considered to be
enabled. This makes disabling services complicated as it means you have
to list every single subservice which can and do change over time.

Instead also check if the generic service name is in the disabled
services list and if so don't treat the service as enabled.

Change-Id: I7fe4dfca2cd9c15069d50a04161a29c5638291cb
---
 lib/cinder   | 1 +
 lib/glance   | 1 +
 lib/keystone | 1 +
 lib/neutron  | 2 ++
 lib/nova     | 1 +
 lib/swift    | 1 +
 lib/template | 1 +
 7 files changed, 8 insertions(+)

diff --git a/lib/cinder b/lib/cinder
index 2cbab2030b..291eebee87 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -129,6 +129,7 @@ CINDER_CACHE_ENABLED_FOR_BACKENDS=${CINDER_CACHE_ENABLED_FOR_BACKENDS:-$CINDER_E
 # Test if any Cinder services are enabled
 # is_cinder_enabled
 function is_cinder_enabled {
+    [[ ,${DISABLED_SERVICES} =~ ,"cinder" ]] && return 1
     [[ ,${ENABLED_SERVICES} =~ ,"c-" ]] && return 0
     return 1
 }
diff --git a/lib/glance b/lib/glance
index d6438a6b48..57b5f45113 100644
--- a/lib/glance
+++ b/lib/glance
@@ -78,6 +78,7 @@ GLANCE_REGISTRY_PORT_INT=${GLANCE_REGISTRY_PORT_INT:-19191}
 # Test if any Glance services are enabled
 # is_glance_enabled
 function is_glance_enabled {
+    [[ ,${DISABLED_SERVICES} =~ ,"glance" ]] && return 1
     [[ ,${ENABLED_SERVICES} =~ ,"g-" ]] && return 0
     return 1
 }
diff --git a/lib/keystone b/lib/keystone
index 4bb6893089..eaed937d2e 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -134,6 +134,7 @@ KEYSTONE_UNIQUE_LAST_PASSWORD_COUNT=${KEYSTONE_UNIQUE_LAST_PASSWORD_COUNT:-2}
 # Test if Keystone is enabled
 # is_keystone_enabled
 function is_keystone_enabled {
+    [[ ,${DISABLED_SERVICES} =~ ,"keystone" ]] && return 1
     [[ ,${ENABLED_SERVICES}, =~ ,"key", ]] && return 0
     return 1
 }
diff --git a/lib/neutron b/lib/neutron
index efca88050b..5c88a50bad 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -91,6 +91,7 @@ declare -a -g _NEUTRON_SERVER_EXTRA_CONF_FILES_ABS
 # Test if any Neutron services are enabled
 # is_neutron_enabled
 function is_neutron_enabled {
+    [[ ,${DISABLED_SERVICES} =~ ,"neutron" ]] && return 1
     [[ ,${ENABLED_SERVICES} =~ ,"neutron-" || ,${ENABLED_SERVICES} =~ ,"q-" ]] && return 0
     return 1
 }
@@ -98,6 +99,7 @@ function is_neutron_enabled {
 # Test if any Neutron services are enabled
 # is_neutron_enabled
 function is_neutron_legacy_enabled {
+    [[ ,${DISABLED_SERVICES} =~ ,"neutron" ]] && return 1
     [[ ,${ENABLED_SERVICES} =~ ,"q-" ]] && return 0
     return 1
 }
diff --git a/lib/nova b/lib/nova
index 9c3ba33013..5832f11d67 100644
--- a/lib/nova
+++ b/lib/nova
@@ -175,6 +175,7 @@ NOVA_USE_SERVICE_TOKEN=$(trueorfalse False NOVA_USE_SERVICE_TOKEN)
 # Test if any Nova services are enabled
 # is_nova_enabled
 function is_nova_enabled {
+    [[ ,${DISABLED_SERVICES} =~ ,"nova" ]] && return 1
     [[ ,${ENABLED_SERVICES} =~ ,"n-" ]] && return 0
     return 1
 }
diff --git a/lib/swift b/lib/swift
index 8fad6b8f97..1472e4407b 100644
--- a/lib/swift
+++ b/lib/swift
@@ -174,6 +174,7 @@ SWIFT_STORAGE_IPS=${SWIFT_STORAGE_IPS:-}
 # Test if any Swift services are enabled
 # is_swift_enabled
 function is_swift_enabled {
+    [[ ,${DISABLED_SERVICES} =~ ,"swift" ]] && return 1
     [[ ,${ENABLED_SERVICES} =~ ,"s-" ]] && return 0
     return 1
 }
diff --git a/lib/template b/lib/template
index b92fb40483..25d653cb46 100644
--- a/lib/template
+++ b/lib/template
@@ -41,6 +41,7 @@ XXX_CONF_DIR=/etc/XXXX
 # Test if any XXXX services are enabled
 # is_XXXX_enabled
 function is_XXXX_enabled {
+    [[ ,${DISABLED_SERVICES} =~ ,"XXXX" ]] && return 1
     [[ ,${ENABLED_SERVICES} =~ ,"XX-" ]] && return 0
     return 1
 }

From f15fd26943c0209859d2b6ee7c0d500134b34f3f Mon Sep 17 00:00:00 2001
From: Huan Xie <huan.xie@citrix.com>
Date: Sat, 27 May 2017 01:30:52 -0700
Subject: [PATCH 1003/2409] XenAPI: Move dom0 related operations to os-xenapi
 devstack plugin

When installing OpenStack via DevStack on XenServer, we need to
some preparation operations in dom0 which will refer the function
in devstack/tools/xen/functions file, but we are planning to move
the whole folder of tools/xen from devstack to os-xenapi, so it
this patch is to moving the dom0 related operation to os-xenapi
repo first.

Change-Id: Ib59d802a7a4eab4ccce0e29d80f29efa4655bc0b
Depends-On: I712ee74ce945859ba5118e09b7d9436ca2686cb7
---
 lib/nova_plugins/hypervisor-xenserver | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/lib/nova_plugins/hypervisor-xenserver b/lib/nova_plugins/hypervisor-xenserver
index 880b87f291..6f79e4ff7c 100644
--- a/lib/nova_plugins/hypervisor-xenserver
+++ b/lib/nova_plugins/hypervisor-xenserver
@@ -84,14 +84,6 @@ function configure_nova_hypervisor {
 * * * * * /root/rotate_xen_guest_logs.sh >/dev/null 2>&1
 CRONTAB
 
-    # Create directories for kernels and images
-    {
-        echo "set -eux"
-        cat $TOP_DIR/tools/xen/functions
-        echo "create_directory_for_images"
-        echo "create_directory_for_kernels"
-        echo "install_conntrack_tools"
-    } | $ssh_dom0
 }
 
 # install_nova_hypervisor() - Install external components

From dcd4b64c990660f9b11b999a3b70e17c36323c4c Mon Sep 17 00:00:00 2001
From: Lance Bragstad <lbragstad@gmail.com>
Date: Mon, 12 Jun 2017 14:41:42 +0000
Subject: [PATCH 1004/2409] Increase KEYSTONE_LOCKOUT_DURATION to 10

Transient failures were being reported because the current lockout
period for users was too short. While this does increase the
run time IdentityV3UsersTest.test_user_account_lockout, it
allows for more flexibility if there is network latency or some
other factor that cause the lockout to expired before the
next authentication.

Change-Id: I61bc39bbc35ac414b4a72929a90845956c99eb1a
Closes-Bug: 1693917
---
 lib/keystone | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/keystone b/lib/keystone
index eaed937d2e..b185ae63f2 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -124,7 +124,7 @@ KEYSTONE_SERVICE_URI_V3=$KEYSTONE_SERVICE_URI/v3
 # Security compliance
 KEYSTONE_SECURITY_COMPLIANCE_ENABLED=${KEYSTONE_SECURITY_COMPLIANCE_ENABLED:-True}
 KEYSTONE_LOCKOUT_FAILURE_ATTEMPTS=${KEYSTONE_LOCKOUT_FAILURE_ATTEMPTS:-2}
-KEYSTONE_LOCKOUT_DURATION=${KEYSTONE_LOCKOUT_DURATION:-5}
+KEYSTONE_LOCKOUT_DURATION=${KEYSTONE_LOCKOUT_DURATION:-10}
 KEYSTONE_UNIQUE_LAST_PASSWORD_COUNT=${KEYSTONE_UNIQUE_LAST_PASSWORD_COUNT:-2}
 
 

From f63aa021cf996b500b6a570c0114c490bb57461a Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Thu, 8 Jun 2017 08:22:38 -0400
Subject: [PATCH 1005/2409] Fleetify nova conductor for N cells

This makes us start two levels of nova-conductor processes, and one per cell.

Change-Id: Ice4aceac5dc44954db3661480b9365f54e47a4c9
---
 lib/nova | 111 +++++++++++++++++++++++++++++++++++++++++++++++++------
 stack.sh |   4 +-
 2 files changed, 102 insertions(+), 13 deletions(-)

diff --git a/lib/nova b/lib/nova
index 5832f11d67..8eac254262 100644
--- a/lib/nova
+++ b/lib/nova
@@ -53,10 +53,18 @@ NOVA_AUTH_CACHE_DIR=${NOVA_AUTH_CACHE_DIR:-/var/cache/nova}
 NOVA_CONF_DIR=/etc/nova
 NOVA_CONF=$NOVA_CONF_DIR/nova.conf
 NOVA_CELLS_CONF=$NOVA_CONF_DIR/nova-cells.conf
+NOVA_CPU_CONF=$NOVA_CONF_DIR/nova-cpu.conf
 NOVA_FAKE_CONF=$NOVA_CONF_DIR/nova-fake.conf
 NOVA_CELLS_DB=${NOVA_CELLS_DB:-nova_cell}
 NOVA_API_DB=${NOVA_API_DB:-nova_api}
 
+# The total number of cells we expect. Must be greater than one and doesn't
+# count cell0.
+NOVA_NUM_CELLS=${NOVA_NUM_CELLS:-1}
+# Our cell index, so we know what rabbit vhost to connect to.
+# This should be in the range of 1-$NOVA_NUM_CELLS
+NOVA_CPU_CELL=${NOVA_CPU_CELL:-1}
+
 NOVA_API_PASTE_INI=${NOVA_API_PASTE_INI:-$NOVA_CONF_DIR/api-paste.ini}
 
 if is_suse; then
@@ -479,7 +487,7 @@ function create_nova_conf {
     # require them running on the host. The ensures that n-cpu doesn't
     # leak a need to use the db in a multinode scenario.
     if is_service_enabled n-api n-cond n-sched; then
-        iniset $NOVA_CONF database connection `database_connection_url nova`
+        iniset $NOVA_CONF database connection `database_connection_url nova_cell0`
         iniset $NOVA_CONF api_database connection `database_connection_url nova_api`
     fi
 
@@ -614,6 +622,20 @@ function create_nova_conf {
     if [ "$NOVA_USE_SERVICE_TOKEN" == "True" ]; then
         init_nova_service_user_conf
     fi
+
+    if is_service_enabled n-cond; then
+        for i in $(seq 1 $NOVA_NUM_CELLS); do
+            local conf
+            local vhost
+            conf=$(conductor_conf $i)
+            vhost="nova_cell${i}"
+            iniset $conf database connection `database_connection_url nova_cell${i}`
+            iniset $conf conductor workers "$API_WORKERS"
+            iniset $conf DEFAULT debug "$ENABLE_DEBUG_LOG_LEVEL"
+            rpc_backend_add_vhost $vhost
+            iniset_rpc_backend nova $conf DEFAULT $vhost
+        done
+    fi
 }
 
 function init_nova_service_user_conf {
@@ -628,6 +650,11 @@ function init_nova_service_user_conf {
     iniset $NOVA_CONF service_user auth_strategy keystone
 }
 
+function conductor_conf {
+    local cell="$1"
+    echo "${NOVA_CONF_DIR}/nova_cell${cell}.conf"
+}
+
 function init_nova_cells {
     if is_service_enabled n-cell; then
         cp $NOVA_CONF $NOVA_CELLS_CONF
@@ -692,8 +719,6 @@ function init_nova {
         recreate_database $NOVA_API_DB
         $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF api_db sync
 
-        # (Re)create nova databases
-        recreate_database nova
         recreate_database nova_cell0
 
         # map_cell0 will create the cell mapping record in the nova_api DB so
@@ -705,6 +730,12 @@ function init_nova {
         # Migrate nova and nova_cell0 databases.
         $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF db sync
 
+        # (Re)create nova databases
+        for i in $(seq 1 $NOVA_NUM_CELLS); do
+            recreate_database nova_cell${i}
+            $NOVA_BIN_DIR/nova-manage --config-file $(conductor_conf $i) db sync
+        done
+
         if is_service_enabled n-cell; then
             recreate_database $NOVA_CELLS_DB
         fi
@@ -713,9 +744,13 @@ function init_nova {
         # Needed for flavor conversion
         $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF db online_data_migrations
 
+        # FIXME(danms): Should this be configurable?
+        iniset $NOVA_CONF workarounds disable_group_policy_check_upcall True
+
         # create the cell1 cell for the main nova db where the hosts live
-        nova-manage cell_v2 create_cell --transport-url $(get_transport_url) \
-            --name 'cell1'
+        for i in $(seq 1 $NOVA_NUM_CELLS); do
+            nova-manage --config-file $NOVA_CONF --config-file $(conductor_conf $i) cell_v2 create_cell --name "cell$i"
+        done
     fi
 
     create_nova_cache_dir
@@ -823,25 +858,38 @@ function start_nova_api {
 
 # start_nova_compute() - Start the compute process
 function start_nova_compute {
+    local nomulticellflag="$1"
     # Hack to set the path for rootwrap
     local old_path=$PATH
     export PATH=$NOVA_BIN_DIR:$PATH
 
     if is_service_enabled n-cell; then
         local compute_cell_conf=$NOVA_CELLS_CONF
+        # NOTE(danms): Don't setup conductor fleet for cellsv1
+        nomulticellflag='nomulticell'
     else
         local compute_cell_conf=$NOVA_CONF
     fi
 
+    if [ "$nomulticellflag" = 'nomulticell' ]; then
+        # NOTE(danms): Grenade doesn't setup multi-cell rabbit, so
+        # skip these bits and use the normal config.
+        NOVA_CPU_CONF=$compute_cell_conf
+        echo "Skipping multi-cell conductor fleet setup"
+    else
+        cp $compute_cell_conf $NOVA_CPU_CONF
+        iniset_rpc_backend nova $NOVA_CPU_CONF DEFAULT "nova_cell${NOVA_CPU_CELL}"
+    fi
+
     if [[ "$VIRT_DRIVER" = 'libvirt' ]]; then
         # The group **$LIBVIRT_GROUP** is added to the current user in this script.
         # ``sg`` is used in run_process to execute nova-compute as a member of the
         # **$LIBVIRT_GROUP** group.
-        run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $compute_cell_conf" $LIBVIRT_GROUP
+        run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $NOVA_CPU_CONF" $LIBVIRT_GROUP
     elif [[ "$VIRT_DRIVER" = 'lxd' ]]; then
-        run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $compute_cell_conf" $LXD_GROUP
+        run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $NOVA_CPU_CONF" $LXD_GROUP
     elif [[ "$VIRT_DRIVER" = 'docker' || "$VIRT_DRIVER" = 'zun' ]]; then
-        run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $compute_cell_conf" $DOCKER_GROUP
+        run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $NOVA_CPU_CONF" $DOCKER_GROUP
     elif [[ "$VIRT_DRIVER" = 'fake' ]]; then
         local i
         for i in `seq 1 $NUMBER_FAKE_NOVA_COMPUTE`; do
@@ -850,13 +898,13 @@ function start_nova_compute {
             # gets its own configuration and own log file.
             local fake_conf="${NOVA_FAKE_CONF}-${i}"
             iniset $fake_conf DEFAULT nhost "${HOSTNAME}${i}"
-            run_process "n-cpu-${i}" "$NOVA_BIN_DIR/nova-compute --config-file $compute_cell_conf --config-file $fake_conf"
+            run_process "n-cpu-${i}" "$NOVA_BIN_DIR/nova-compute --config-file $NOVA_CPU_CONF --config-file $fake_conf"
         done
     else
         if is_service_enabled n-cpu && [[ -r $NOVA_PLUGINS/hypervisor-$VIRT_DRIVER ]]; then
             start_nova_hypervisor
         fi
-        run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $compute_cell_conf"
+        run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $NOVA_CPU_CONF"
     fi
 
     export PATH=$old_path
@@ -876,7 +924,6 @@ function start_nova_rest {
     fi
 
     # ``run_process`` checks ``is_service_enabled``, it is not needed here
-    run_process n-cond "$NOVA_BIN_DIR/nova-conductor --config-file $compute_cell_conf"
     run_process n-cell-region "$NOVA_BIN_DIR/nova-cells --config-file $api_cell_conf"
     run_process n-cell-child "$NOVA_BIN_DIR/nova-cells --config-file $compute_cell_conf"
 
@@ -899,8 +946,38 @@ function start_nova_rest {
     export PATH=$old_path
 }
 
+function enable_nova_fleet {
+    if is_service_enabled n-cond; then
+        enable_service n-super-cond
+        for i in $(seq 1 $NOVA_NUM_CELLS); do
+            enable_service n-cond-cell${i}
+        done
+    fi
+}
+
+function start_nova_conductor {
+    if is_service_enabled n-cell; then
+        echo "Starting nova-conductor in a cellsv1-compatible way"
+        run_process n-cond "$NOVA_BIN_DIR/nova-conductor --config-file $NOVA_CELLS_CONF"
+        return
+    fi
+
+    enable_nova_fleet
+    if is_service_enabled n-super-cond; then
+        run_process n-super-cond "$NOVA_BIN_DIR/nova-conductor --config-file $NOVA_CONF"
+    fi
+    for i in $(seq 1 $NOVA_NUM_CELLS); do
+        if is_service_enabled n-cond-cell${i}; then
+            local conf
+            conf=$(conductor_conf $i)
+            run_process n-cond-cell${i} "$NOVA_BIN_DIR/nova-conductor --config-file $conf"
+        fi
+    done
+}
+
 function start_nova {
     start_nova_rest
+    start_nova_conductor
     start_nova_compute
 }
 
@@ -929,14 +1006,24 @@ function stop_nova_rest {
     # Kill the nova screen windows
     # Some services are listed here twice since more than one instance
     # of a service may be running in certain configs.
-    for serv in n-api n-net n-sch n-novnc n-xvnc n-cauth n-spice n-cond n-cell n-cell n-api-meta n-sproxy; do
+    for serv in n-api n-net n-sch n-novnc n-xvnc n-cauth n-spice n-cell n-cell n-api-meta n-sproxy; do
         stop_process $serv
     done
 }
 
+function stop_nova_conductor {
+    enable_nova_fleet
+    for srv in n-super-cond $(seq -f n-cond-cell%0.f 1 $NOVA_NUM_CELLS); do
+        if is_service_enabled $srv; then
+            stop_process $srv
+        fi
+    done
+}
+
 # stop_nova() - Stop running processes (non-screen)
 function stop_nova {
     stop_nova_rest
+    stop_nova_conductor
     stop_nova_compute
 }
 
diff --git a/stack.sh b/stack.sh
index 6793d45cc1..5148ae1d77 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1268,7 +1268,9 @@ fi
 # Unable to use LUKS passphrase that is exactly 16 bytes long
 # https://bugzilla.redhat.com/show_bug.cgi?id=1447297
 if is_service_enabled nova; then
-    iniset $NOVA_CONF key_manager fixed_key $(generate_hex_string 36)
+    key=$(generate_hex_string 36)
+    iniset $NOVA_CONF key_manager fixed_key "$key"
+    iniset $NOVA_CPU_CONF key_manager fixed_key "$key"
 fi
 
 # Launch the nova-api and wait for it to answer before continuing

From f266a2dc81be050fec41a180906723ab5cf61df5 Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Mon, 12 Jun 2017 14:57:59 -0700
Subject: [PATCH 1006/2409] Install test-requirements with main install

To reduce the total number of invocations necessary for pip which isn't
the quickest thing ever (due to needing to evaluate constraints and deps
lists and what is currently installed) combine the main installation of
software with its test-requirements.txt file which should roughly halve
our pip invocations.

Change-Id: Ibcc3264136e66d34a879ad1c90a62e1bb6a84243
---
 inc/python | 24 +++++++++---------------
 1 file changed, 9 insertions(+), 15 deletions(-)

diff --git a/inc/python b/inc/python
index 4c443d6a00..718cbb23b1 100644
--- a/inc/python
+++ b/inc/python
@@ -320,6 +320,14 @@ function pip_install {
     fi
 
     $xtrace
+
+    # Also install test requirements
+    local install_test_reqs=""
+    local test_req="${!#}/test-requirements.txt"
+    if [[ -e "$test_req" ]]; then
+        install_test_reqs="-r $test_req"
+    fi
+
     # adding SETUPTOOLS_SYS_PATH_TECHNIQUE is a workaround to keep
     # the same behaviour of setuptools before version 25.0.0.
     # related issue: https://github.com/pypa/pip/issues/3874
@@ -329,24 +337,10 @@ function pip_install {
         no_proxy="${no_proxy:-}" \
         PIP_FIND_LINKS=$PIP_FIND_LINKS \
         SETUPTOOLS_SYS_PATH_TECHNIQUE=rewrite \
-        $cmd_pip $upgrade \
+        $cmd_pip $upgrade $install_test_reqs \
         $@
     result=$?
 
-    # Also install test requirements
-    local test_req="${!#}/test-requirements.txt"
-    if [[ $result == 0 ]] && [[ -e "$test_req" ]]; then
-        echo "Installing test-requirements for $test_req"
-        $sudo_pip \
-            http_proxy=${http_proxy:-} \
-            https_proxy=${https_proxy:-} \
-            no_proxy=${no_proxy:-} \
-            PIP_FIND_LINKS=$PIP_FIND_LINKS \
-            $cmd_pip $upgrade \
-            -r $test_req
-        result=$?
-    fi
-
     time_stop "pip_install"
     return $result
 }

From 2b6e9ac47127453fdf907f3d9b56c71260ed0ba2 Mon Sep 17 00:00:00 2001
From: Boris Pavlovic <boris@pavlovic.me>
Date: Mon, 12 Jun 2017 17:08:33 -0700
Subject: [PATCH 1007/2409] Improve OpenStack performance by redcuing bcrypt
 hasing rounds number

Reduce bcrypt hashing rounds from 12 to 4 (minimal possilbe).

This is going to imporve a lot of perforamcne of OpenStack.

Bcrypt is hashing algorithm that is designed to use a lot of resources and
in that way stops brutforce attacks. It's exponential algorithm that depends
on amount of rounds. By default they use 12 rounds which is quite high value,
good enough for real secure production enviorments.

In case of DevStack it's going to slow down all authentication by many times.
Rally shows about 5 times slownest (adding 2-5 seconds to every authenticate)
DevStack is meant for developemnt & CI so performance is way more important than
security.

Change-Id: Id8c763d63cb91f37a774f9400f35c309f37d6f12
---
 lib/keystone | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/lib/keystone b/lib/keystone
index eaed937d2e..7994065bbd 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -127,6 +127,12 @@ KEYSTONE_LOCKOUT_FAILURE_ATTEMPTS=${KEYSTONE_LOCKOUT_FAILURE_ATTEMPTS:-2}
 KEYSTONE_LOCKOUT_DURATION=${KEYSTONE_LOCKOUT_DURATION:-5}
 KEYSTONE_UNIQUE_LAST_PASSWORD_COUNT=${KEYSTONE_UNIQUE_LAST_PASSWORD_COUNT:-2}
 
+# Number of bcrypt hashing rounds, increasing number exponentially increases required
+# resources to generate password hash. This is very effective way to protect from
+# bruteforce attacks. 4 is minimal value that can be specified for bcrypt and
+# it works way faster than default 12. Minimal value is great for CI and development
+# however may not be suitable for real production.
+KEYSTONE_PASSWORD_HASH_ROUNDS=${KEYSTONE_PASSWORD_HASH_ROUNDS:-4}
 
 # Functions
 # ---------
@@ -225,6 +231,7 @@ function configure_keystone {
     fi
 
     iniset $KEYSTONE_CONF identity driver "$KEYSTONE_IDENTITY_BACKEND"
+    iniset $KEYSTONE_CONF identity password_hash_rounds $KEYSTONE_PASSWORD_HASH_ROUNDS
     iniset $KEYSTONE_CONF assignment driver "$KEYSTONE_ASSIGNMENT_BACKEND"
     iniset $KEYSTONE_CONF role driver "$KEYSTONE_ROLE_BACKEND"
     iniset $KEYSTONE_CONF resource driver "$KEYSTONE_RESOURCE_BACKEND"

From 15b0a5f1eb849a30bcea9a1e437e9a88ae2c6f92 Mon Sep 17 00:00:00 2001
From: Markus Zoeller <mzoeller@de.ibm.com>
Date: Wed, 31 May 2017 11:21:22 +0200
Subject: [PATCH 1008/2409] systemd: Always create the systemd unit files

Commit 5edae54 introduced the usage of systemd in Devstack. This allowed
the transition away from 'screen'. Systemd needs "user unit files" to
describe the services. Currently, those unit files get only created when
an openstack service (n-cpu, c-sch, g-api, ...) is in the list of enabled
services (`ENABLED_SERVICES`). This means, when Devstack is fully stacked,
there is no way to start the systemd unit of an openstack service which
is *not* in that list.

This commit changes that behavior, and creates the systemd unit files
independently of the list ENABLED_SERVICES. This means, when Devstack
is fully stacked, I can start a systemd unit of an openstack service which
wasn't in the ENABLED_SERVICES list. This allows more flexible lifecycle
management of openstack services in the gate, which is useful for tests
which test components which are not in the "default configuration" (e.g.
the "nova-serialproxy" service).

The `clean.sh` script purges all traces of systemd user unit files created
by devstack.

Change-Id: I0f7e1ee8723f4de47cbc56b727182f90a2b32bfb
---
 clean.sh         |  7 +++++++
 functions-common | 23 +++++++++++++++++------
 2 files changed, 24 insertions(+), 6 deletions(-)

diff --git a/clean.sh b/clean.sh
index ef38fbf4f8..9ffe3bee6b 100755
--- a/clean.sh
+++ b/clean.sh
@@ -125,6 +125,13 @@ if [[ -n "$SCREEN_LOGDIR" ]] && [[ -d "$SCREEN_LOGDIR" ]]; then
     sudo rm -rf $SCREEN_LOGDIR
 fi
 
+# Clean out the sytemd user unit files if systemd was used.
+if [[ "$USE_SYSTEMD" = "True" ]]; then
+    sudo find $SYSTEMD_DIR -type f -name '*devstack@*service' -delete
+    # Make systemd aware of the deletion.
+    $SYSTEMCTL daemon-reload
+fi
+
 # Clean up venvs
 DIRS_TO_CLEAN="$WHEELHOUSE ${PROJECT_VENV[@]} .config/openstack"
 rm -rf $DIRS_TO_CLEAN
diff --git a/functions-common b/functions-common
index 30933ea4c2..48ce72524e 100644
--- a/functions-common
+++ b/functions-common
@@ -1508,8 +1508,13 @@ EOF
 
 }
 
-# Helper function to build a basic unit file and run it under systemd.
-function _run_under_systemd {
+# Defines a systemd service which can be enabled and started later on.
+# arg1: The openstack service name ('n-cpu', 'c-sch', ...).
+# arg2: The command to start (e.g. path to service binary + config files).
+# arg3: The group which owns the process.
+# arg4: The user which owns the process.
+# Returns: The systemd service name which got defined.
+function _define_systemd_service {
     local service=$1
     local command="$2"
     local cmd=$command
@@ -1524,9 +1529,7 @@ function _run_under_systemd {
     else
         write_user_unit_file $systemd_service "$cmd" "$group" "$user"
     fi
-
-    $SYSTEMCTL enable $systemd_service
-    $SYSTEMCTL start $systemd_service
+    echo $systemd_service
 }
 
 # Helper to remove the ``*.failure`` files under ``$SERVICE_DIR/$SCREEN_NAME``.
@@ -1567,11 +1570,19 @@ function run_process {
     local user=$4
 
     local name=$service
+    local systemd_service
 
     time_start "run_process"
+    # Note we deliberately make all service files, even if the service
+    # isn't enabled, so it can be enabled by a dev manually on command
+    # line.
+    if [[ "$USE_SYSTEMD" = "True" ]]; then
+        systemd_service=$(_define_systemd_service "$name" "$command" "$group" "$user")
+    fi
     if is_service_enabled $service; then
         if [[ "$USE_SYSTEMD" = "True" ]]; then
-            _run_under_systemd "$name" "$command" "$group" "$user"
+            $SYSTEMCTL enable $systemd_service
+            $SYSTEMCTL start $systemd_service
         elif [[ "$USE_SCREEN" = "True" ]]; then
             if [[ "$user" == "root" ]]; then
                 command="sudo $command"

From d095e97624467fb1e0fa38955b45960d3cbc5651 Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Tue, 13 Jun 2017 10:18:36 -0700
Subject: [PATCH 1009/2409] Support unicode via en_US.utf8

Because C.utf8 is not everywhere and is sometimes called C.UTF-8 (just
to confuse people) use en_US.utf8 which is in most places. This isn't
language/region agnostic but gives a consistent unicode aware locale to
devstack.

Change-Id: I67a8c77a5041e9cee740adf0e02fdc9b183c5bc4
fixes-bug: 1697733
---
 stack.sh | 32 +++++++++++++++++++++++++++++---
 1 file changed, 29 insertions(+), 3 deletions(-)

diff --git a/stack.sh b/stack.sh
index 6793d45cc1..39f0d1080c 100755
--- a/stack.sh
+++ b/stack.sh
@@ -27,11 +27,37 @@ set -o xtrace
 # Make sure custom grep options don't get in the way
 unset GREP_OPTIONS
 
-# Sanitize language settings to avoid commands bailing out
-# with "unsupported locale setting" errors.
+# NOTE(sdague): why do we explicitly set locale when running stack.sh?
+#
+# Devstack is written in bash, and many functions used throughout
+# devstack process text comming off a command (like the ip command)
+# and do transforms using grep, sed, cut, awk on the strings that are
+# returned. Many of these programs are interationalized, which is
+# great for end users, but means that the strings that devstack
+# functions depend upon might not be there in other locales. We thus
+# need to pin the world to an english basis during the runs.
+#
+# Previously we used the C locale for this, every system has it, and
+# it gives us a stable sort order. It does however mean that we
+# effectively drop unicode support.... boo!  :(
+#
+# With python3 being more unicode aware by default, that's not the
+# right option. While there is a C.utf8 locale, some distros are
+# shipping it as C.UTF8 for extra confusingness. And it's support
+# isn't super clear across distros. This is made more challenging when
+# trying to support both out of the box distros, and the gate which
+# uses diskimage builder to build disk images in a different way than
+# the distros do.
+#
+# So... en_US.utf8 it is. That's existed for a very long time. It is a
+# compromise position, but it is the least worse idea at the time of
+# this comment.
+#
+# We also have to unset other variables that might impact LC_ALL
+# taking effect.
 unset LANG
 unset LANGUAGE
-LC_ALL=C
+LC_ALL=en_US.utf8
 export LC_ALL
 
 # Make sure umask is sane

From 633dbc3d8e7d3f06e13d532748c71ffba6cd21ea Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Wed, 14 Jun 2017 12:09:21 -0700
Subject: [PATCH 1010/2409] Track db sync command time useage

We are trying to keep better track of what pieces of devstack consume
the most time. Add the db sync commands to the time tracking as they run
the database migrations which can take more time than expected.

Change-Id: Ib92f2b8304ccf703712d45fd7207444de3599e2d
---
 lib/cinder         | 2 ++
 lib/glance         | 2 ++
 lib/keystone       | 2 ++
 lib/neutron        | 2 ++
 lib/neutron-legacy | 2 ++
 lib/nova           | 2 ++
 lib/placement      | 2 ++
 7 files changed, 14 insertions(+)

diff --git a/lib/cinder b/lib/cinder
index 291eebee87..20688129fd 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -407,8 +407,10 @@ function init_cinder {
         # (Re)create cinder database
         recreate_database cinder
 
+        time_start "dbsync"
         # Migrate cinder database
         $CINDER_BIN_DIR/cinder-manage --config-file $CINDER_CONF db sync
+        time_stop "dbsync"
     fi
 
     if is_service_enabled c-vol && [[ -n "$CINDER_ENABLED_BACKENDS" ]]; then
diff --git a/lib/glance b/lib/glance
index 57b5f45113..baf8c6191c 100644
--- a/lib/glance
+++ b/lib/glance
@@ -285,11 +285,13 @@ function init_glance {
     # (Re)create glance database
     recreate_database glance
 
+    time_start "dbsync"
     # Migrate glance database
     $GLANCE_BIN_DIR/glance-manage --config-file $GLANCE_CONF_DIR/glance-api.conf db_sync
 
     # Load metadata definitions
     $GLANCE_BIN_DIR/glance-manage --config-file $GLANCE_CONF_DIR/glance-api.conf db_load_metadefs
+    time_stop "dbsync"
 
     create_glance_cache_dir
 }
diff --git a/lib/keystone b/lib/keystone
index eaed937d2e..9de660b4e2 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -458,8 +458,10 @@ function init_keystone {
         recreate_database keystone
     fi
 
+    time_start "dbsync"
     # Initialize keystone database
     $KEYSTONE_BIN_DIR/keystone-manage --config-file $KEYSTONE_CONF db_sync
+    time_stop "dbsync"
 
     if [[ "$KEYSTONE_TOKEN_FORMAT" == "pki" || "$KEYSTONE_TOKEN_FORMAT" == "pkiz" ]]; then
         # Set up certificates
diff --git a/lib/neutron b/lib/neutron
index 5c88a50bad..2a660ec8e1 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -336,8 +336,10 @@ function init_neutron_new {
 
     recreate_database neutron
 
+    time_start "dbsync"
     # Run Neutron db migrations
     $NEUTRON_BIN_DIR/neutron-db-manage upgrade heads
+    time_stop "dbsync"
 
     create_neutron_cache_dir
 }
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 67cf110644..784f3a8167 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -417,8 +417,10 @@ function create_mutnauq_accounts {
 # init_mutnauq() - Initialize databases, etc.
 function init_mutnauq {
     recreate_database $Q_DB_NAME
+    time_start "dbsync"
     # Run Neutron db migrations
     $NEUTRON_BIN_DIR/neutron-db-manage --config-file $NEUTRON_CONF --config-file /$Q_PLUGIN_CONF_FILE upgrade head
+    time_stop "dbsync"
 }
 
 # install_mutnauq() - Collect source and prepare
diff --git a/lib/nova b/lib/nova
index aae3108013..18715fc418 100644
--- a/lib/nova
+++ b/lib/nova
@@ -649,7 +649,9 @@ function init_nova_cells {
             iniset $NOVA_CELLS_CONF DEFAULT enabled_apis metadata
         fi
 
+        time_start "dbsync"
         $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CELLS_CONF db sync
+        time_stop "dbsync"
         $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CELLS_CONF cell create --name=region --cell_type=parent --username=$RABBIT_USERID --hostname=$RABBIT_HOST --port=5672 --password=$RABBIT_PASSWORD --virtual_host=/ --woffset=0 --wscale=1
         $NOVA_BIN_DIR/nova-manage cell create --name=child --cell_type=child --username=$RABBIT_USERID --hostname=$RABBIT_HOST --port=5672 --password=$RABBIT_PASSWORD --virtual_host=child_cell --woffset=0 --wscale=1
 
diff --git a/lib/placement b/lib/placement
index ad12824a38..8adbbdec68 100644
--- a/lib/placement
+++ b/lib/placement
@@ -149,7 +149,9 @@ function create_placement_accounts {
 function init_placement {
     if [ "$PLACEMENT_DB_ENABLED" != False ]; then
         recreate_database placement
+        time_start "dbsync"
         $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF api_db sync
+        time_stop "dbsync"
     fi
     create_placement_accounts
 }

From 3e9b562d0b1f1815597daa5346ba32ef48f868af Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Wed, 14 Jun 2017 15:29:47 -0700
Subject: [PATCH 1011/2409] Actually check if roles are set

In the helper functions to check if roles are set and if not add the
role and return the id we weren't actually checking if the role was set.
The reason for this was we grepped for name values while outputing only
uuid values with OSC. Fix for this is straightforward, we just add the
--role argument to OSC which will filter for us then we don't have to
use a grep on the wrong value type.

Change-Id: I2691b347d2a6273100deb4a1750ab353a8e49673
---
 functions-common | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/functions-common b/functions-common
index 30933ea4c2..35613ab7e9 100644
--- a/functions-common
+++ b/functions-common
@@ -864,10 +864,11 @@ function get_or_add_user_project_role {
 
     # Gets user role id
     user_role_id=$(openstack role assignment list \
+        --role $1 \
         --user $2 \
         --project $3 \
         $domain_args \
-        | grep " $1 " | get_field 1)
+        | grep '^|\s[a-f0-9]\+' | get_field 1)
     if [[ -z "$user_role_id" ]]; then
         # Adds role to user and get it
         openstack role add $1 \
@@ -875,10 +876,11 @@ function get_or_add_user_project_role {
             --project $3 \
             $domain_args
         user_role_id=$(openstack role assignment list \
+            --role $1 \
             --user $2 \
             --project $3 \
             $domain_args \
-            | grep " $1 " | get_field 1)
+            | grep '^|\s[a-f0-9]\+' | get_field 1)
     fi
     echo $user_role_id
 }
@@ -889,18 +891,20 @@ function get_or_add_user_domain_role {
     local user_role_id
     # Gets user role id
     user_role_id=$(openstack role assignment list \
+        --role $1 \
         --user $2 \
         --domain $3 \
-        | grep " $1 " | get_field 1)
+        | grep '^|\s[a-f0-9]\+' | get_field 1)
     if [[ -z "$user_role_id" ]]; then
         # Adds role to user and get it
         openstack role add $1 \
             --user $2 \
             --domain $3
         user_role_id=$(openstack role assignment list \
+            --role $1 \
             --user $2 \
             --domain $3 \
-            | grep " $1 " | get_field 1)
+            | grep '^|\s[a-f0-9]\+' | get_field 1)
     fi
     echo $user_role_id
 }
@@ -911,6 +915,7 @@ function get_or_add_group_project_role {
     local group_role_id
     # Gets group role id
     group_role_id=$(openstack role assignment list \
+        --role $1 \
         --group $2 \
         --project $3 \
         -f value)
@@ -920,6 +925,7 @@ function get_or_add_group_project_role {
             --group $2 \
             --project $3
         group_role_id=$(openstack role assignment list \
+            --role $1 \
             --group $2 \
             --project $3 \
             -f value)

From 85cf2933ccdd70f4f6d505c9aca36f063eddf229 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 27 Mar 2017 15:35:13 -0400
Subject: [PATCH 1012/2409] Provide timings for OSC during devstack run

The OSC number remain high, and it's useful to understand how much
time we spend making OSC calls, especially to surface it relative to
other items. The way we embed this in our code makes it hard to
instrument.

This patch creates a wrapper function for OSC which collects the timings
then aliases `openstack` to that function. This means any invocations of
the openstack utility goes through our function while devstack is
running. Because this is an alias it only affects the stack.sh shell and
any subshells.

This also moves the time tracking infrastructure to count in ms,
instead of s, because some of these operations are close enough to a
second that rounding early is losing way to many significant
digits. We divide by 1000 before reporting to the user.

Change-Id: Ic5f1844ce732d447ee980b3c9fdc417f72482609
---
 functions-common | 51 ++++++++++++++++++++++++++++++++++++++++++++++--
 stack.sh         |  9 +++++++++
 2 files changed, 58 insertions(+), 2 deletions(-)

diff --git a/functions-common b/functions-common
index ec68644757..98e9a4bf66 100644
--- a/functions-common
+++ b/functions-common
@@ -2459,7 +2459,7 @@ function time_start {
     if [[ -n "$start_time" ]]; then
         die $LINENO "Trying to start the clock on $name, but it's already been started"
     fi
-    _TIME_START[$name]=$(date +%s)
+    _TIME_START[$name]=$(date +%s%3N)
 }
 
 # time_stop $name
@@ -2480,7 +2480,7 @@ function time_stop {
     if [[ -z "$start_time" ]]; then
         die $LINENO "Trying to stop the clock on $name, but it was never started"
     fi
-    end_time=$(date +%s)
+    end_time=$(date +%s%3N)
     elapsed_time=$(($end_time - $start_time))
     total=${_TIME_TOTAL[$name]:-0}
     # reset the clock so we can start it in the future
@@ -2488,6 +2488,49 @@ function time_stop {
     _TIME_TOTAL[$name]=$(($total + $elapsed_time))
 }
 
+function oscwrap {
+    local out
+    local rc
+    local start
+    local end
+    # Cannot use timer_start and timer_stop as we run in subshells
+    # and those rely on modifying vars in the same process (which cannot
+    # happen from a subshell.
+    start=$(date +%s%3N)
+    out=$(command openstack "$@")
+    rc=$?
+    end=$(date +%s%3N)
+    echo $((end - start)) >> $OSCWRAP_TIMER_FILE
+
+    echo "$out"
+    return $rc
+}
+
+function install_oscwrap {
+    # File to accumulate our timing data
+    OSCWRAP_TIMER_FILE=$(mktemp)
+    # Bash by default doesn't expand aliases, allow it for the aliases
+    # we want to whitelist.
+    shopt -s expand_aliases
+    # Remove all aliases that might be expanded to preserve old unexpanded
+    # behavior
+    unalias -a
+    # Add only the alias we want for openstack
+    alias openstack=oscwrap
+}
+
+function cleanup_oscwrap {
+    local total=0
+    if python3_enabled ; then
+        local python=python3
+    else
+        local python=python
+    fi
+    total=$(cat $OSCWRAP_TIMER_FILE | $python -c "import sys; print(sum(int(l) for l in sys.stdin))")
+    _TIME_TOTAL["osc"]=$total
+    rm $OSCWRAP_TIMER_FILE
+}
+
 # time_totals
 #  Print out total time summary
 function time_totals {
@@ -2506,6 +2549,8 @@ function time_totals {
         fi
     done
 
+    cleanup_oscwrap
+
     xtrace=$(set +o | grep xtrace)
     set +o xtrace
 
@@ -2517,6 +2562,8 @@ function time_totals {
     echo
     for t in ${!_TIME_TOTAL[*]}; do
         local v=${_TIME_TOTAL[$t]}
+        # because we're recording in milliseconds
+        v=$(($v / 1000))
         printf "%-${len}s %3d\n" "$t" "$v"
     done
     echo "========================="
diff --git a/stack.sh b/stack.sh
index 20cdc1dfcc..89b61fc2c5 100755
--- a/stack.sh
+++ b/stack.sh
@@ -493,6 +493,11 @@ function exit_trap {
         kill 2>&1 $jobs
     fi
 
+    #Remove timing data file
+    if [ -f "$OSCWRAP_TIMER_FILE" ] ; then
+        rm "$OSCWRAP_TIMER_FILE"
+    fi
+
     # Kill the last spinner process
     kill_spinner
 
@@ -903,6 +908,10 @@ else
     pip_install_gr python-openstackclient
 fi
 
+# Installs alias for osc so that we can collect timing for all
+# osc commands. Alias dies with stack.sh.
+install_oscwrap
+
 if [[ $TRACK_DEPENDS = True ]]; then
     $DEST/.venv/bin/pip freeze > $DEST/requires-post-pip
     if ! diff -Nru $DEST/requires-pre-pip $DEST/requires-post-pip > $DEST/requires.diff; then

From 19279b0f87e2ab1c684d62078df296211d3a60cc Mon Sep 17 00:00:00 2001
From: Antoni Segura Puimedon <antonisp@celebdor.com>
Date: Fri, 16 Jun 2017 16:03:32 +0200
Subject: [PATCH 1013/2409] etcd3: Allow for multi-host deployments

In Multi host deployments, it is possible to run ETCD in a different
host than the SERVICE_HOST (where all the controllers run). This patch
brings that distinction.

Change-Id: I15fe6f25eedf1efebaab81cce26b080577b856cc
Signed-off-by: Antoni Segura Puimedon <antonisp@celebdor.com>
---
 lib/etcd3 | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/etcd3 b/lib/etcd3
index f8b113bae6..75c2ae93ae 100644
--- a/lib/etcd3
+++ b/lib/etcd3
@@ -53,9 +53,9 @@ function start_etcd3 {
     cmd+=" --initial-cluster-state new --initial-cluster-token etcd-cluster-01"
     cmd+=" --initial-cluster $HOSTNAME=http://$SERVICE_HOST:2380"
     cmd+=" --initial-advertise-peer-urls http://$SERVICE_HOST:2380"
-    cmd+=" --advertise-client-urls http://$SERVICE_HOST:$ETCD_PORT"
+    cmd+=" --advertise-client-urls http://${HOST_IP}:$ETCD_PORT"
     cmd+=" --listen-peer-urls http://0.0.0.0:2380 "
-    cmd+=" --listen-client-urls http://$SERVICE_HOST:$ETCD_PORT"
+    cmd+=" --listen-client-urls http://${HOST_IP}:$ETCD_PORT"
 
     local unitfile="$SYSTEMD_DIR/$ETCD_SYSTEMD_SERVICE"
     write_user_unit_file $ETCD_SYSTEMD_SERVICE "$cmd" "" "root"

From 41da1a9feb397d2536acd2f59daab55937a04513 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Mon, 19 Jun 2017 08:55:47 +0000
Subject: [PATCH 1014/2409] Updated from generate-devstack-plugins-list

Change-Id: Ida1d6d012e1e05f35ba45670436acd6f920c9575
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 9bfedcf0ef..c1c66b9bb6 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -149,6 +149,7 @@ solum                                  `git://git.openstack.org/openstack/solum
 stackube                               `git://git.openstack.org/openstack/stackube <https://git.openstack.org/cgit/openstack/stackube>`__
 tacker                                 `git://git.openstack.org/openstack/tacker <https://git.openstack.org/cgit/openstack/tacker>`__
 tap-as-a-service                       `git://git.openstack.org/openstack/tap-as-a-service <https://git.openstack.org/cgit/openstack/tap-as-a-service>`__
+tap-as-a-service-dashboard             `git://git.openstack.org/openstack/tap-as-a-service-dashboard <https://git.openstack.org/cgit/openstack/tap-as-a-service-dashboard>`__
 tricircle                              `git://git.openstack.org/openstack/tricircle <https://git.openstack.org/cgit/openstack/tricircle>`__
 trio2o                                 `git://git.openstack.org/openstack/trio2o <https://git.openstack.org/cgit/openstack/trio2o>`__
 trove                                  `git://git.openstack.org/openstack/trove <https://git.openstack.org/cgit/openstack/trove>`__

From 62b56601a9c6d6e9ad573e87bdecf360a3dd915e Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Mon, 19 Jun 2017 08:27:16 -0400
Subject: [PATCH 1015/2409] rework etcd3 install to be like other devstack
 services

This separates out the install phase early from the start phase to
make this mirror other services in devstack.

Depends-On: I4124dc7e3fd3b4d973979da85209ec991c0f8c4b

Change-Id: I76f8740448b25a48869ee80006e826baa6cafc2b
---
 lib/etcd3 | 13 +------------
 lib/oslo  |  7 +++++++
 stack.sh  |  4 ++++
 3 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/lib/etcd3 b/lib/etcd3
index f8b113bae6..25de238ff8 100644
--- a/lib/etcd3
+++ b/lib/etcd3
@@ -41,13 +41,6 @@ fi
 
 # start_etcd3() - Starts to run the etcd process
 function start_etcd3 {
-    # Don't install in sub nodes (multinode scenario)
-    if [ "$SERVICE_HOST" != "$HOST_IP" ]; then
-        return
-    fi
-
-    _install_etcd
-
     local cmd="$ETCD_BIN_DIR/etcd"
     cmd+=" --name $HOSTNAME --data-dir $ETCD_DATA_DIR"
     cmd+=" --initial-cluster-state new --initial-cluster-token etcd-cluster-01"
@@ -96,7 +89,7 @@ function cleanup_etcd3 {
     sudo rm -rf $ETCD_DATA_DIR
 }
 
-function _install_etcd {
+function install_etcd3 {
     echo "Installing etcd"
 
     # Make sure etcd3 downloads the correct architecture
@@ -115,10 +108,6 @@ function _install_etcd {
 
     ETCD_NAME=etcd-$ETCD_VERSION-linux-$ETCD_ARCH
 
-    # Install the libraries needed. Note: tooz for example does not have a hard dependency on these libraries
-    pip_install etcd3
-    pip_install etcd3gw
-
     # Create the necessary directories
     sudo mkdir -p $ETCD_BIN_DIR
     sudo mkdir -p $ETCD_DATA_DIR
diff --git a/lib/oslo b/lib/oslo
index d15a3031a2..cbfd5fb513 100644
--- a/lib/oslo
+++ b/lib/oslo
@@ -109,7 +109,14 @@ function install_oslo {
     _do_install_oslo_lib "stevedore"
     _do_install_oslo_lib "taskflow"
     _do_install_oslo_lib "tooz"
+    # installation of additional libraries
+    #
+    # os-traits for nova
     _do_install_oslo_lib "os-traits"
+
+    # etcd (because tooz does not have a hard dependency on these)
+    pip_install etcd3
+    pip_install etcd3gw
 }
 
 # Restore xtrace
diff --git a/stack.sh b/stack.sh
index cfdc2c4c50..c46859567c 100755
--- a/stack.sh
+++ b/stack.sh
@@ -813,6 +813,10 @@ if is_service_enabled neutron; then
     install_neutron_agent_packages
 fi
 
+if is_service_enabled etcd3; then
+    install_etcd3
+fi
+
 # Check Out and Install Source
 # ----------------------------
 

From 3ed99c0b27122ff00e2d236086ab16b0cc1887c1 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 20 Jun 2017 14:09:30 -0400
Subject: [PATCH 1016/2409] mv lib/oslo to lib/libraries

There is confusion about where installation of new libraries should
end up, to prevent lots of little files being added make a
lib/libraries which is the old lib/oslo. Put compat functions and
includes in place to help with transition.

Change-Id: Ieeab605d187ef6aec571211ab235ea67fa95a607
---
 lib/libraries | 135 ++++++++++++++++++++++++++++++++++++++++++++++++++
 lib/oslo      | 121 +-------------------------------------------
 stack.sh      |   6 +--
 3 files changed, 140 insertions(+), 122 deletions(-)
 create mode 100644 lib/libraries

diff --git a/lib/libraries b/lib/libraries
new file mode 100644
index 0000000000..9feb503f1b
--- /dev/null
+++ b/lib/libraries
@@ -0,0 +1,135 @@
+#!/bin/bash
+#
+# lib/oslo
+#
+# Functions to install **Oslo** libraries from git
+#
+# We need this to handle the fact that projects would like to use
+# pre-released versions of oslo libraries.
+
+# Dependencies:
+#
+# - ``functions`` file
+
+# ``stack.sh`` calls the entry points in this order:
+#
+# - install_oslo
+
+# Save trace setting
+_XTRACE_LIB_OSLO=$(set +o | grep xtrace)
+set +o xtrace
+
+
+# Defaults
+# --------
+GITDIR["automaton"]=$DEST/automaton
+GITDIR["castellan"]=$DEST/castellan
+GITDIR["cliff"]=$DEST/cliff
+GITDIR["cursive"]=$DEST/cursive
+GITDIR["debtcollector"]=$DEST/debtcollector
+GITDIR["futurist"]=$DEST/futurist
+GITDIR["os-client-config"]=$DEST/os-client-config
+GITDIR["osc-lib"]=$DEST/osc-lib
+GITDIR["oslo.cache"]=$DEST/oslo.cache
+GITDIR["oslo.concurrency"]=$DEST/oslo.concurrency
+GITDIR["oslo.config"]=$DEST/oslo.config
+GITDIR["oslo.context"]=$DEST/oslo.context
+GITDIR["oslo.db"]=$DEST/oslo.db
+GITDIR["oslo.i18n"]=$DEST/oslo.i18n
+GITDIR["oslo.log"]=$DEST/oslo.log
+GITDIR["oslo.messaging"]=$DEST/oslo.messaging
+GITDIR["oslo.middleware"]=$DEST/oslo.middleware
+GITDIR["oslo.policy"]=$DEST/oslo.policy
+GITDIR["oslo.privsep"]=$DEST/oslo.privsep
+GITDIR["oslo.reports"]=$DEST/oslo.reports
+GITDIR["oslo.rootwrap"]=$DEST/oslo.rootwrap
+GITDIR["oslo.serialization"]=$DEST/oslo.serialization
+GITDIR["oslo.service"]=$DEST/oslo.service
+GITDIR["oslo.utils"]=$DEST/oslo.utils
+GITDIR["oslo.versionedobjects"]=$DEST/oslo.versionedobjects
+GITDIR["oslo.vmware"]=$DEST/oslo.vmware
+GITDIR["osprofiler"]=$DEST/osprofiler
+GITDIR["pycadf"]=$DEST/pycadf
+GITDIR["python-openstacksdk"]=$DEST/python-openstacksdk
+GITDIR["stevedore"]=$DEST/stevedore
+GITDIR["taskflow"]=$DEST/taskflow
+GITDIR["tooz"]=$DEST/tooz
+# TODO(mriedem): This is a common pattern so even though os-traits isn't
+# officially an oslo library, it is nice to re-use this script for non-oslo
+# things like os-traits. We should rename this script to be more generic
+# and then fold os-brick into it also.
+GITDIR["os-traits"]=$DEST/os-traits
+
+# Support entry points installation of console scripts
+OSLO_BIN_DIR=$(get_python_exec_prefix)
+
+
+# Functions
+# ---------
+
+function _install_lib_from_source {
+    local name=$1
+    if use_library_from_git "$name"; then
+        git_clone_by_name "$name"
+        setup_dev_lib "$name"
+    fi
+}
+
+# install_oslo - install libraries that oslo needs
+function install_oslo {
+    install_libs
+}
+
+# install_libs() - Install additional libraries that we need and want
+# on all environments. Some will only install here if from source,
+# others will always install.
+function install_libs {
+    _install_lib_from_source "automaton"
+    _install_lib_from_source "castellan"
+    _install_lib_from_source "cliff"
+    _install_lib_from_source "cursive"
+    _install_lib_from_source "debtcollector"
+    _install_lib_from_source "futurist"
+    _install_lib_from_source "osc-lib"
+    _install_lib_from_source "os-client-config"
+    _install_lib_from_source "oslo.cache"
+    _install_lib_from_source "oslo.concurrency"
+    _install_lib_from_source "oslo.config"
+    _install_lib_from_source "oslo.context"
+    _install_lib_from_source "oslo.db"
+    _install_lib_from_source "oslo.i18n"
+    _install_lib_from_source "oslo.log"
+    _install_lib_from_source "oslo.messaging"
+    _install_lib_from_source "oslo.middleware"
+    _install_lib_from_source "oslo.policy"
+    _install_lib_from_source "oslo.privsep"
+    _install_lib_from_source "oslo.reports"
+    _install_lib_from_source "oslo.rootwrap"
+    _install_lib_from_source "oslo.serialization"
+    _install_lib_from_source "oslo.service"
+    _install_lib_from_source "oslo.utils"
+    _install_lib_from_source "oslo.versionedobjects"
+    _install_lib_from_source "oslo.vmware"
+    _install_lib_from_source "osprofiler"
+    _install_lib_from_source "pycadf"
+    _install_lib_from_source "python-openstacksdk"
+    _install_lib_from_source "stevedore"
+    _install_lib_from_source "taskflow"
+    _install_lib_from_source "tooz"
+    # installation of additional libraries
+    #
+    # os-traits for nova
+    _install_lib_from_source "os-traits"
+
+    # etcd (because tooz does not have a hard dependency on these)
+    pip_install etcd3
+    pip_install etcd3gw
+}
+
+# Restore xtrace
+$_XTRACE_LIB_OSLO
+
+# Tell emacs to use shell-script-mode
+## Local variables:
+## mode: shell-script
+## End:
diff --git a/lib/oslo b/lib/oslo
index cbfd5fb513..3ae64c8210 100644
--- a/lib/oslo
+++ b/lib/oslo
@@ -6,123 +6,6 @@
 #
 # We need this to handle the fact that projects would like to use
 # pre-released versions of oslo libraries.
-
-# Dependencies:
 #
-# - ``functions`` file
-
-# ``stack.sh`` calls the entry points in this order:
-#
-# - install_oslo
-
-# Save trace setting
-_XTRACE_LIB_OSLO=$(set +o | grep xtrace)
-set +o xtrace
-
-
-# Defaults
-# --------
-GITDIR["automaton"]=$DEST/automaton
-GITDIR["castellan"]=$DEST/castellan
-GITDIR["cliff"]=$DEST/cliff
-GITDIR["cursive"]=$DEST/cursive
-GITDIR["debtcollector"]=$DEST/debtcollector
-GITDIR["futurist"]=$DEST/futurist
-GITDIR["os-client-config"]=$DEST/os-client-config
-GITDIR["osc-lib"]=$DEST/osc-lib
-GITDIR["oslo.cache"]=$DEST/oslo.cache
-GITDIR["oslo.concurrency"]=$DEST/oslo.concurrency
-GITDIR["oslo.config"]=$DEST/oslo.config
-GITDIR["oslo.context"]=$DEST/oslo.context
-GITDIR["oslo.db"]=$DEST/oslo.db
-GITDIR["oslo.i18n"]=$DEST/oslo.i18n
-GITDIR["oslo.log"]=$DEST/oslo.log
-GITDIR["oslo.messaging"]=$DEST/oslo.messaging
-GITDIR["oslo.middleware"]=$DEST/oslo.middleware
-GITDIR["oslo.policy"]=$DEST/oslo.policy
-GITDIR["oslo.privsep"]=$DEST/oslo.privsep
-GITDIR["oslo.reports"]=$DEST/oslo.reports
-GITDIR["oslo.rootwrap"]=$DEST/oslo.rootwrap
-GITDIR["oslo.serialization"]=$DEST/oslo.serialization
-GITDIR["oslo.service"]=$DEST/oslo.service
-GITDIR["oslo.utils"]=$DEST/oslo.utils
-GITDIR["oslo.versionedobjects"]=$DEST/oslo.versionedobjects
-GITDIR["oslo.vmware"]=$DEST/oslo.vmware
-GITDIR["osprofiler"]=$DEST/osprofiler
-GITDIR["pycadf"]=$DEST/pycadf
-GITDIR["python-openstacksdk"]=$DEST/python-openstacksdk
-GITDIR["stevedore"]=$DEST/stevedore
-GITDIR["taskflow"]=$DEST/taskflow
-GITDIR["tooz"]=$DEST/tooz
-# TODO(mriedem): This is a common pattern so even though os-traits isn't
-# officially an oslo library, it is nice to re-use this script for non-oslo
-# things like os-traits. We should rename this script to be more generic
-# and then fold os-brick into it also.
-GITDIR["os-traits"]=$DEST/os-traits
-
-# Support entry points installation of console scripts
-OSLO_BIN_DIR=$(get_python_exec_prefix)
-
-
-# Functions
-# ---------
-
-function _do_install_oslo_lib {
-    local name=$1
-    if use_library_from_git "$name"; then
-        git_clone_by_name "$name"
-        setup_dev_lib "$name"
-    fi
-}
-
-# install_oslo() - Collect source and prepare
-function install_oslo {
-    _do_install_oslo_lib "automaton"
-    _do_install_oslo_lib "castellan"
-    _do_install_oslo_lib "cliff"
-    _do_install_oslo_lib "cursive"
-    _do_install_oslo_lib "debtcollector"
-    _do_install_oslo_lib "futurist"
-    _do_install_oslo_lib "osc-lib"
-    _do_install_oslo_lib "os-client-config"
-    _do_install_oslo_lib "oslo.cache"
-    _do_install_oslo_lib "oslo.concurrency"
-    _do_install_oslo_lib "oslo.config"
-    _do_install_oslo_lib "oslo.context"
-    _do_install_oslo_lib "oslo.db"
-    _do_install_oslo_lib "oslo.i18n"
-    _do_install_oslo_lib "oslo.log"
-    _do_install_oslo_lib "oslo.messaging"
-    _do_install_oslo_lib "oslo.middleware"
-    _do_install_oslo_lib "oslo.policy"
-    _do_install_oslo_lib "oslo.privsep"
-    _do_install_oslo_lib "oslo.reports"
-    _do_install_oslo_lib "oslo.rootwrap"
-    _do_install_oslo_lib "oslo.serialization"
-    _do_install_oslo_lib "oslo.service"
-    _do_install_oslo_lib "oslo.utils"
-    _do_install_oslo_lib "oslo.versionedobjects"
-    _do_install_oslo_lib "oslo.vmware"
-    _do_install_oslo_lib "osprofiler"
-    _do_install_oslo_lib "pycadf"
-    _do_install_oslo_lib "python-openstacksdk"
-    _do_install_oslo_lib "stevedore"
-    _do_install_oslo_lib "taskflow"
-    _do_install_oslo_lib "tooz"
-    # installation of additional libraries
-    #
-    # os-traits for nova
-    _do_install_oslo_lib "os-traits"
-
-    # etcd (because tooz does not have a hard dependency on these)
-    pip_install etcd3
-    pip_install etcd3gw
-}
-
-# Restore xtrace
-$_XTRACE_LIB_OSLO
-
-# Tell emacs to use shell-script-mode
-## Local variables:
-## mode: shell-script
-## End:
+# Included for compatibility with grenade, remove in Queens
+source $TOP_DIR/lib/libraries
diff --git a/stack.sh b/stack.sh
index c46859567c..7034bc4ca2 100755
--- a/stack.sh
+++ b/stack.sh
@@ -592,7 +592,7 @@ source $TOP_DIR/lib/tls
 
 # Source project function libraries
 source $TOP_DIR/lib/infra
-source $TOP_DIR/lib/oslo
+source $TOP_DIR/lib/libraries
 source $TOP_DIR/lib/lvm
 source $TOP_DIR/lib/horizon
 source $TOP_DIR/lib/keystone
@@ -822,8 +822,8 @@ fi
 
 echo_summary "Installing OpenStack project source"
 
-# Install Oslo libraries
-install_oslo
+# Install additional libraries
+install_libs
 
 # Install uwsgi
 install_apache_uwsgi

From d064acce4ceca5c897b31304439e235a230ac8f3 Mon Sep 17 00:00:00 2001
From: Pavlo Shchelokovskyy <shchelokovskyy@gmail.com>
Date: Wed, 21 Jun 2017 09:06:37 +0000
Subject: [PATCH 1017/2409] Ignore etcd files downloaded to files/ dir

Change-Id: Ic1458a612ccdefdcc34880529a259513135fa7a1
---
 .gitignore | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.gitignore b/.gitignore
index 7967e14a19..d2c127d099 100644
--- a/.gitignore
+++ b/.gitignore
@@ -24,6 +24,7 @@ files/pip-*
 files/get-pip.py*
 files/ir-deploy*
 files/ironic-inspector*
+files/etcd*
 local.conf
 local.sh
 localrc

From 99a6477c498588b4639c8669eb1a04a128dc7f2b Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 21 Jun 2017 10:46:12 -0400
Subject: [PATCH 1018/2409] remove lib/os_brick

Fold this back into lib/libraries

Change-Id: I2c4e3ebf1a1cc65841e4470d5cfe073f9b505d5f
---
 lib/libraries |  4 ++++
 lib/os_brick  | 32 --------------------------------
 stack.sh      |  6 ------
 3 files changed, 4 insertions(+), 38 deletions(-)
 delete mode 100644 lib/os_brick

diff --git a/lib/libraries b/lib/libraries
index 9feb503f1b..946872c3ad 100644
--- a/lib/libraries
+++ b/lib/libraries
@@ -59,6 +59,7 @@ GITDIR["tooz"]=$DEST/tooz
 # things like os-traits. We should rename this script to be more generic
 # and then fold os-brick into it also.
 GITDIR["os-traits"]=$DEST/os-traits
+GITDIR["os-brick"]=$DEST/os-brick
 
 # Support entry points installation of console scripts
 OSLO_BIN_DIR=$(get_python_exec_prefix)
@@ -120,6 +121,9 @@ function install_libs {
     #
     # os-traits for nova
     _install_lib_from_source "os-traits"
+    # os-brick for nova/cinder
+    _install_lib_from_source "os-brick"
+
 
     # etcd (because tooz does not have a hard dependency on these)
     pip_install etcd3
diff --git a/lib/os_brick b/lib/os_brick
deleted file mode 100644
index d1cca4af44..0000000000
--- a/lib/os_brick
+++ /dev/null
@@ -1,32 +0,0 @@
-#!/bin/bash
-#
-# lib/os_brick
-# Install **os-brick** python module from source
-
-# Dependencies:
-#
-# - functions
-# - DEST, DATA_DIR must be defined
-
-# stack.sh
-# ---------
-# - install_os_brick
-
-# Save trace setting
-_XTRACE_OS_BRICK=$(set +o | grep xtrace)
-set +o xtrace
-
-
-GITDIR["os-brick"]=$DEST/os-brick
-
-# Install os_brick from git only if requested, otherwise it will be pulled from
-# pip repositories by requirements of projects that need it.
-function install_os_brick {
-    if use_library_from_git "os-brick"; then
-        git_clone_by_name "os-brick"
-        setup_dev_lib "os-brick"
-    fi
-}
-
-# Restore xtrace
-$_XTRACE_OS_BRICK
\ No newline at end of file
diff --git a/stack.sh b/stack.sh
index 7034bc4ca2..59f25973ea 100755
--- a/stack.sh
+++ b/stack.sh
@@ -605,7 +605,6 @@ source $TOP_DIR/lib/neutron
 source $TOP_DIR/lib/ldap
 source $TOP_DIR/lib/dstat
 source $TOP_DIR/lib/etcd3
-source $TOP_DIR/lib/os_brick
 
 # Extras Source
 # --------------
@@ -841,11 +840,6 @@ if is_service_enabled neutron nova horizon; then
     install_neutronclient
 fi
 
-# Install shared libraries
-if is_service_enabled cinder nova; then
-    install_os_brick
-fi
-
 # Setup TLS certs
 if is_service_enabled tls-proxy; then
     configure_CA

From 7e41c6ce669a082fcb5f50ef3503b8d66d19b35f Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 21 Jun 2017 10:55:16 -0400
Subject: [PATCH 1019/2409] cleanup comments

Change-Id: I685f726178722e58ccfd008bad16a671cc8b8e2a
---
 lib/libraries | 23 ++++++++++++-----------
 1 file changed, 12 insertions(+), 11 deletions(-)

diff --git a/lib/libraries b/lib/libraries
index 946872c3ad..761ce66694 100644
--- a/lib/libraries
+++ b/lib/libraries
@@ -2,7 +2,7 @@
 #
 # lib/oslo
 #
-# Functions to install **Oslo** libraries from git
+# Functions to install libraries from git
 #
 # We need this to handle the fact that projects would like to use
 # pre-released versions of oslo libraries.
@@ -13,10 +13,10 @@
 
 # ``stack.sh`` calls the entry points in this order:
 #
-# - install_oslo
+# - install_libraries
 
 # Save trace setting
-_XTRACE_LIB_OSLO=$(set +o | grep xtrace)
+_XTRACE_LIB_LIBRARIES=$(set +o | grep xtrace)
 set +o xtrace
 
 
@@ -54,12 +54,11 @@ GITDIR["python-openstacksdk"]=$DEST/python-openstacksdk
 GITDIR["stevedore"]=$DEST/stevedore
 GITDIR["taskflow"]=$DEST/taskflow
 GITDIR["tooz"]=$DEST/tooz
-# TODO(mriedem): This is a common pattern so even though os-traits isn't
-# officially an oslo library, it is nice to re-use this script for non-oslo
-# things like os-traits. We should rename this script to be more generic
-# and then fold os-brick into it also.
-GITDIR["os-traits"]=$DEST/os-traits
+
+# Non oslo libraries are welcomed below as well, this prevents
+# duplication of this code.
 GITDIR["os-brick"]=$DEST/os-brick
+GITDIR["os-traits"]=$DEST/os-traits
 
 # Support entry points installation of console scripts
 OSLO_BIN_DIR=$(get_python_exec_prefix)
@@ -120,18 +119,20 @@ function install_libs {
     # installation of additional libraries
     #
     # os-traits for nova
-    _install_lib_from_source "os-traits"
-    # os-brick for nova/cinder
     _install_lib_from_source "os-brick"
+    _install_lib_from_source "os-traits"
 
 
     # etcd (because tooz does not have a hard dependency on these)
+    #
+    # NOTE(sdague): this is currently a work around because tooz
+    # doesn't pull in etcd3.
     pip_install etcd3
     pip_install etcd3gw
 }
 
 # Restore xtrace
-$_XTRACE_LIB_OSLO
+$_XTRACE_LIB_LIBRARIES
 
 # Tell emacs to use shell-script-mode
 ## Local variables:

From 43304849cfde41fa86a6fdd334ab6e703598ef8d Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Wed, 21 Jun 2017 21:45:14 +0100
Subject: [PATCH 1020/2409] Set public_endpoint to GLANCE_URL for glance-api

We run glance behind uwsgi. This means that the URL glance knows about
itself is wrong, and version discovery fails. Set the public endpoint to
the value of GLANCE_URL which should always be correct.

Change-Id: Ia7c69024a0ef6cc0fdc284ffcd06eee5678a1007
---
 lib/glance | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/lib/glance b/lib/glance
index 99941232f3..41145f980d 100644
--- a/lib/glance
+++ b/lib/glance
@@ -186,9 +186,12 @@ function configure_glance {
         inicomment $GLANCE_API_CONF glance_store swift_store_auth_address
     fi
 
+    # We need to tell glance what it's public endpoint is so that the version
+    # discovery document will be correct
+    iniset $GLANCE_API_CONF DEFAULT public_endpoint $GLANCE_URL
+
     if is_service_enabled tls-proxy; then
         iniset $GLANCE_API_CONF DEFAULT bind_port $GLANCE_SERVICE_PORT_INT
-        iniset $GLANCE_API_CONF DEFAULT public_endpoint $GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT
         iniset $GLANCE_REGISTRY_CONF DEFAULT bind_port $GLANCE_REGISTRY_PORT_INT
 
         iniset $GLANCE_API_CONF keystone_authtoken identity_uri $KEYSTONE_AUTH_URI

From 3410e3e01bdbdbfd360d9baebeac081c33ee0821 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Wed, 21 Jun 2017 22:07:53 +1000
Subject: [PATCH 1021/2409] Revert "Use uwsgi for glance-api"

This reverts commit e6217a9719b88b550ccbbce7c9bc064cb746c1a3.

Unfortunately it seems to break glance; for examples see some of the
nodepool dib jobs which have all failed to upload images into glance.

Note this has a revert for 43304849cfde41fa86a6fdd334ab6e703598ef8d as
well, since that uses GLANCE_URL defined here.

[1] http://logs.openstack.org/51/475051/2/gate/gate-dsvm-nodepool-redhat-src/e1bdb34/
[2] http://logs.openstack.org/51/475051/2/gate/gate-dsvm-nodepool-ubuntu-src/6a7665b/
[3] http://logs.openstack.org/51/475051/2/gate/gate-dsvm-nodepool-opensuse-src/b357de1/

Change-Id: I2aea120e733b05e806801121ec994f4e31a337d9
---
 lib/apache | 54 +-----------------------------------------------------
 lib/cinder |  2 +-
 lib/glance | 44 ++++++++++++--------------------------------
 lib/nova   |  2 +-
 4 files changed, 15 insertions(+), 87 deletions(-)

diff --git a/lib/apache b/lib/apache
index 25c65fe672..c1b6bf8b41 100644
--- a/lib/apache
+++ b/lib/apache
@@ -275,64 +275,12 @@ function write_uwsgi_config {
     else
         local apache_conf=""
         apache_conf=$(apache_site_config_for $name)
-        echo "SetEnv proxy-sendcl 1" | sudo tee $apache_conf
-        echo "ProxyPass \"${url}\" \"unix:${socket}|uwsgi://uwsgi-uds-${name}/\" retry=0 " | sudo tee -a $apache_conf
+        echo "ProxyPass \"${url}\" \"unix:${socket}|uwsgi://uwsgi-uds-${name}/\" retry=0 " | sudo tee $apache_conf
         enable_apache_site $name
         restart_apache_server
     fi
 }
 
-# For services using chunked encoding, the only services known to use this
-# currently are Glance and Swift, we need to use an http proxy instead of
-# mod_proxy_uwsgi because the chunked encoding gets dropped. See:
-# https://github.com/unbit/uwsgi/issues/1540 You can workaround this on python2
-# but that involves having apache buffer the request before sending it to
-# uswgi.
-function write_local_uwsgi_http_config {
-    local file=$1
-    local wsgi=$2
-    local url=$3
-    name=$(basename $wsgi)
-
-    # create a home for the sockets; note don't use /tmp -- apache has
-    # a private view of it on some platforms.
-
-    # always cleanup given that we are using iniset here
-    rm -rf $file
-    iniset "$file" uwsgi wsgi-file "$wsgi"
-    port=$(get_random_port)
-    iniset "$file" uwsgi http "127.0.0.1:$port"
-    iniset "$file" uwsgi processes $API_WORKERS
-    # This is running standalone
-    iniset "$file" uwsgi master true
-    # Set die-on-term & exit-on-reload so that uwsgi shuts down
-    iniset "$file" uwsgi die-on-term true
-    iniset "$file" uwsgi exit-on-reload true
-    iniset "$file" uwsgi enable-threads true
-    iniset "$file" uwsgi plugins python
-    # uwsgi recommends this to prevent thundering herd on accept.
-    iniset "$file" uwsgi thunder-lock true
-    # Override the default size for headers from the 4k default.
-    iniset "$file" uwsgi buffer-size 65535
-    # Make sure the client doesn't try to re-use the connection.
-    iniset "$file" uwsgi add-header "Connection: close"
-    # This ensures that file descriptors aren't shared between processes.
-    iniset "$file" uwsgi lazy-apps true
-    iniset "$file" uwsgi chmod-socket 666
-    iniset "$file" uwsgi http-raw-body true
-    iniset "$file" uwsgi http-chunked-input true
-    iniset "$file" uwsgi http-auto-chunked true
-
-    enable_apache_mod proxy
-    enable_apache_mod proxy_http
-    local apache_conf=""
-    apache_conf=$(apache_site_config_for $name)
-    echo "KeepAlive Off" | sudo tee $apache_conf
-    echo "ProxyPass \"${url}\" \"http://127.0.0.1:$port\" retry=0 " | sudo tee -a $apache_conf
-    enable_apache_site $name
-    restart_apache_server
-}
-
 function remove_uwsgi_config {
     local file=$1
     local wsgi=$2
diff --git a/lib/cinder b/lib/cinder
index 243b639a11..20688129fd 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -335,7 +335,7 @@ function configure_cinder {
 
     iniset $CINDER_CONF DEFAULT osapi_volume_workers "$API_WORKERS"
 
-    iniset $CINDER_CONF DEFAULT glance_api_servers "$GLANCE_URL"
+    iniset $CINDER_CONF DEFAULT glance_api_servers "${GLANCE_SERVICE_PROTOCOL}://${GLANCE_HOSTPORT}"
     if is_service_enabled tls-proxy; then
         iniset $CINDER_CONF DEFAULT glance_protocol https
         iniset $CINDER_CONF DEFAULT glance_ca_certificates_file $SSL_BUNDLE_FILE
diff --git a/lib/glance b/lib/glance
index 41145f980d..baf8c6191c 100644
--- a/lib/glance
+++ b/lib/glance
@@ -71,16 +71,6 @@ GLANCE_HOSTPORT=${GLANCE_HOSTPORT:-$GLANCE_SERVICE_HOST:$GLANCE_SERVICE_PORT}
 GLANCE_SERVICE_PROTOCOL=${GLANCE_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 GLANCE_REGISTRY_PORT=${GLANCE_REGISTRY_PORT:-9191}
 GLANCE_REGISTRY_PORT_INT=${GLANCE_REGISTRY_PORT_INT:-19191}
-GLANCE_UWSGI=$GLANCE_BIN_DIR/glance-wsgi-api
-GLANCE_UWSGI_CONF=$GLANCE_CONF_DIR/glance-uswgi.ini
-# If wsgi mode is uwsgi run glance under uwsgi, else default to eventlet
-# TODO(mtreinish): Remove the eventlet path here and in all the similar
-# conditionals below after the Pike release
-if [[ "$WSGI_MODE" == "uwsgi" ]]; then
-    GLANCE_URL="$GLANCE_SERVICE_PROTOCOL://$GLANCE_SERVICE_HOST/image"
-else
-    GLANCE_URL="$GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT"
-fi
 
 # Functions
 # ---------
@@ -114,13 +104,16 @@ function configure_glance {
     dburl=`database_connection_url glance`
     iniset $GLANCE_REGISTRY_CONF database connection $dburl
     iniset $GLANCE_REGISTRY_CONF DEFAULT use_syslog $SYSLOG
+    iniset $GLANCE_REGISTRY_CONF DEFAULT workers "$API_WORKERS"
     iniset $GLANCE_REGISTRY_CONF paste_deploy flavor keystone
     configure_auth_token_middleware $GLANCE_REGISTRY_CONF glance $GLANCE_AUTH_CACHE_DIR/registry
     iniset $GLANCE_REGISTRY_CONF oslo_messaging_notifications driver messagingv2
     iniset_rpc_backend glance $GLANCE_REGISTRY_CONF
     iniset $GLANCE_REGISTRY_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
 
+    cp $GLANCE_DIR/etc/glance-api.conf $GLANCE_API_CONF
     iniset $GLANCE_API_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
+    iniset $GLANCE_API_CONF DEFAULT bind_host $GLANCE_SERVICE_LISTEN_ADDRESS
     inicomment $GLANCE_API_CONF DEFAULT log_file
     iniset $GLANCE_API_CONF database connection $dburl
     iniset $GLANCE_API_CONF DEFAULT use_syslog $SYSLOG
@@ -148,6 +141,8 @@ function configure_glance {
     iniset $GLANCE_API_CONF glance_store filesystem_store_datadir $GLANCE_IMAGE_DIR/
     iniset $GLANCE_API_CONF DEFAULT registry_host $GLANCE_SERVICE_HOST
 
+    iniset $GLANCE_API_CONF DEFAULT workers "$API_WORKERS"
+
     # CORS feature support - to allow calls from Horizon by default
     if [ -n "$GLANCE_CORS_ALLOWED_ORIGIN" ]; then
         iniset $GLANCE_API_CONF cors allowed_origin "$GLANCE_CORS_ALLOWED_ORIGIN"
@@ -186,12 +181,9 @@ function configure_glance {
         inicomment $GLANCE_API_CONF glance_store swift_store_auth_address
     fi
 
-    # We need to tell glance what it's public endpoint is so that the version
-    # discovery document will be correct
-    iniset $GLANCE_API_CONF DEFAULT public_endpoint $GLANCE_URL
-
     if is_service_enabled tls-proxy; then
         iniset $GLANCE_API_CONF DEFAULT bind_port $GLANCE_SERVICE_PORT_INT
+        iniset $GLANCE_API_CONF DEFAULT public_endpoint $GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT
         iniset $GLANCE_REGISTRY_CONF DEFAULT bind_port $GLANCE_REGISTRY_PORT_INT
 
         iniset $GLANCE_API_CONF keystone_authtoken identity_uri $KEYSTONE_AUTH_URI
@@ -207,6 +199,7 @@ function configure_glance {
     setup_logging $GLANCE_REGISTRY_CONF
 
     cp -p $GLANCE_DIR/etc/glance-registry-paste.ini $GLANCE_REGISTRY_PASTE_INI
+
     cp -p $GLANCE_DIR/etc/glance-api-paste.ini $GLANCE_API_PASTE_INI
 
     cp $GLANCE_DIR/etc/glance-cache.conf $GLANCE_CACHE_CONF
@@ -239,13 +232,6 @@ function configure_glance {
         iniset $GLANCE_API_CONF DEFAULT cinder_endpoint_template "https://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/%(project_id)s"
         iniset $GLANCE_CACHE_CONF DEFAULT cinder_endpoint_template "https://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/%(project_id)s"
     fi
-
-    if [[ "$WSGI_MODE" == "uwsgi" ]]; then
-        write_local_uwsgi_http_config "$GLANCE_UWSGI_CONF" "$GLANCE_UWSGI" "/image"
-    else
-        iniset $GLANCE_API_CONF DEFAULT bind_host $GLANCE_SERVICE_LISTEN_ADDRESS
-        iniset $GLANCE_API_CONF DEFAULT workers "$API_WORKERS"
-    fi
 }
 
 # create_glance_accounts() - Set up common required glance accounts
@@ -270,7 +256,7 @@ function create_glance_accounts {
         get_or_create_endpoint \
             "image" \
             "$REGION_NAME" \
-            "$GLANCE_URL"
+            "$GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT"
 
         # Note(frickler): Crude workaround for https://bugs.launchpad.net/glance-store/+bug/1620999
         service_domain_id=$(get_or_create_domain $SERVICE_DOMAIN_NAME)
@@ -337,21 +323,15 @@ function install_glance {
 function start_glance {
     local service_protocol=$GLANCE_SERVICE_PROTOCOL
     if is_service_enabled tls-proxy; then
-        if [[ "$WSGI_MODE" != "uwsgi" ]]; then
-            start_tls_proxy glance-service '*' $GLANCE_SERVICE_PORT $GLANCE_SERVICE_HOST $GLANCE_SERVICE_PORT_INT
-        fi
+        start_tls_proxy glance-service '*' $GLANCE_SERVICE_PORT $GLANCE_SERVICE_HOST $GLANCE_SERVICE_PORT_INT
         start_tls_proxy glance-registry '*' $GLANCE_REGISTRY_PORT $GLANCE_SERVICE_HOST $GLANCE_REGISTRY_PORT_INT
     fi
 
     run_process g-reg "$GLANCE_BIN_DIR/glance-registry --config-file=$GLANCE_CONF_DIR/glance-registry.conf"
-    if [[ "$WSGI_MODE" == "uwsgi" ]]; then
-        run_process g-api "$GLANCE_BIN_DIR/uwsgi --ini $GLANCE_UWSGI_CONF"
-    else
-        run_process g-api "$GLANCE_BIN_DIR/glance-api --config-file=$GLANCE_CONF_DIR/glance-api.conf"
-    fi
+    run_process g-api "$GLANCE_BIN_DIR/glance-api --config-file=$GLANCE_CONF_DIR/glance-api.conf"
 
-    echo "Waiting for g-api ($GLANCE_SERVICE_HOST) to start..."
-    if ! wait_for_service $SERVICE_TIMEOUT $GLANCE_URL; then
+    echo "Waiting for g-api ($GLANCE_HOSTPORT) to start..."
+    if ! wait_for_service $SERVICE_TIMEOUT $GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT; then
         die $LINENO "g-api did not start"
     fi
 }
diff --git a/lib/nova b/lib/nova
index f56509ac1a..18715fc418 100644
--- a/lib/nova
+++ b/lib/nova
@@ -575,7 +575,7 @@ function create_nova_conf {
     # enable notifications, but it will allow them to function when enabled.
     iniset $NOVA_CONF oslo_messaging_notifications driver "messagingv2"
     iniset_rpc_backend nova $NOVA_CONF
-    iniset $NOVA_CONF glance api_servers "$GLANCE_URL"
+    iniset $NOVA_CONF glance api_servers "${GLANCE_SERVICE_PROTOCOL}://${GLANCE_HOSTPORT}"
 
     iniset $NOVA_CONF DEFAULT osapi_compute_workers "$API_WORKERS"
     iniset $NOVA_CONF DEFAULT metadata_workers "$API_WORKERS"

From 599ecfbd4c71de5f71663b1cadf2700b31a84ec2 Mon Sep 17 00:00:00 2001
From: TommyLike <tommylikehu@gmail.com>
Date: Tue, 20 Jun 2017 11:32:25 +0800
Subject: [PATCH 1022/2409] Download etcd3 only zip file not exists

Give a change to manually prepare the zip file
for etcd.

Change-Id: I54283cf2ed62bb716af34df21e8c168014264c8c
---
 lib/etcd3 | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/etcd3 b/lib/etcd3
index ea58403b24..0e1fbd5bc2 100644
--- a/lib/etcd3
+++ b/lib/etcd3
@@ -115,7 +115,9 @@ function install_etcd3 {
     # Download and cache the etcd tgz for subsequent use
     if [ ! -f "$FILES/etcd-$ETCD_VERSION-linux-$ETCD_ARCH/etcd" ]; then
         ETCD_DOWNLOAD_FILE=$ETCD_NAME.tar.gz
-        wget $ETCD_DOWNLOAD_URL/$ETCD_VERSION/$ETCD_DOWNLOAD_FILE -O $FILES/$ETCD_DOWNLOAD_FILE
+        if [ ! -f "$FILES/$ETCD_DOWNLOAD_FILE" ]; then
+            wget $ETCD_DOWNLOAD_URL/$ETCD_VERSION/$ETCD_DOWNLOAD_FILE -O $FILES/$ETCD_DOWNLOAD_FILE
+        fi
         echo "${ETCD_SHA256} $FILES/${ETCD_DOWNLOAD_FILE}" > $FILES/etcd.sha256sum
         # NOTE(sdague): this should go fatal if this fails
         sha256sum -c $FILES/etcd.sha256sum

From ed7dbe5754b95f54f663f695b27c7c14b1fdbd6c Mon Sep 17 00:00:00 2001
From: Kaitlin Farr <kaitlin.farr@jhuapl.edu>
Date: Mon, 19 Jun 2017 16:50:38 -0400
Subject: [PATCH 1023/2409] Add python-barbicanclient to LIBS_FROM_GIT

Allow python-barbicanclient to be installed from git instead of pip.

Change-Id: I99cd72724e11bab362bcaaeb773f33b2abfe815c
---
 lib/libraries                | 3 +++
 stackrc                      | 5 +++++
 tests/test_libs_from_pypi.sh | 2 +-
 3 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/lib/libraries b/lib/libraries
index 761ce66694..4ceb80423c 100644
--- a/lib/libraries
+++ b/lib/libraries
@@ -121,6 +121,9 @@ function install_libs {
     # os-traits for nova
     _install_lib_from_source "os-brick"
     _install_lib_from_source "os-traits"
+    #
+    # python client libraries we might need from git can go here
+    _install_lib_from_source "python-barbicanclient"
 
 
     # etcd (because tooz does not have a hard dependency on these)
diff --git a/stackrc b/stackrc
index cfe2496240..50f7c89ba3 100644
--- a/stackrc
+++ b/stackrc
@@ -341,6 +341,11 @@ GITBRANCH["python-cinderclient"]=${CINDERCLIENT_BRANCH:-master}
 GITREPO["python-brick-cinderclient-ext"]=${BRICK_CINDERCLIENT_REPO:-${GIT_BASE}/openstack/python-brick-cinderclient-ext.git}
 GITBRANCH["python-brick-cinderclient-ext"]=${BRICK_CINDERCLIENT_BRANCH:-master}
 
+# python barbican client library
+GITREPO["python-barbicanclient"]=${BARBICANCLIENT_REPO:-${GIT_BASE}/openstack/python-barbicanclient.git}
+GITBRANCH["python-barbicanclient"]=${BARBICANCLIENT_BRANCH:-master}
+GITDIR["python-barbicanclient"]=$DEST/python-barbicanclient
+
 # python glance client library
 GITREPO["python-glanceclient"]=${GLANCECLIENT_REPO:-${GIT_BASE}/openstack/python-glanceclient.git}
 GITBRANCH["python-glanceclient"]=${GLANCECLIENT_BRANCH:-master}
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index 1f2d3c23b8..5b4ff32f2a 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -43,7 +43,7 @@ ALL_LIBS+=" debtcollector os-brick os-traits automaton futurist oslo.service"
 ALL_LIBS+=" oslo.cache oslo.reports osprofiler cursive"
 ALL_LIBS+=" keystoneauth ironic-lib neutron-lib oslo.privsep"
 ALL_LIBS+=" diskimage-builder os-vif python-brick-cinderclient-ext"
-ALL_LIBS+=" castellan"
+ALL_LIBS+=" castellan python-barbicanclient"
 
 # Generate the above list with
 # echo ${!GITREPO[@]}

From 13e81ad1cf6d652946b78082b280fb12d190f6f2 Mon Sep 17 00:00:00 2001
From: Yuval Brik <yuval@brik.org.il>
Date: Fri, 23 Jun 2017 10:32:16 +0300
Subject: [PATCH 1024/2409] Fedora mariadb: disable cracklib

In Fedora mariadb, cracklib has been enabled [0] in order to verify the
password strength.
Disable cracklib in Fedora devstack in order to allow simple passwords
in dev environments.

[0] https://src.fedoraproject.org/cgit/rpms/mariadb.git/
    commit: 9442da192282aa74f43e86c96202109a173bbaba

Change-Id: I2d5e965f0f19f86992794eec78134e862899c931
---
 lib/databases/mysql | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/databases/mysql b/lib/databases/mysql
index 7bbcace399..a0cf7a4296 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -71,6 +71,10 @@ function configure_database_mysql {
     elif is_fedora; then
         mysql=mariadb
         my_conf=/etc/my.cnf
+        local cracklib_conf=/etc/my.cnf.d/cracklib_password_check.cnf
+        if [ -f "$cracklib_conf" ]; then
+            inicomment -sudo "$cracklib_conf" "mariadb" "plugin-load-add"
+        fi
     else
         exit_distro_not_supported "mysql configuration"
     fi

From c087c71834a6eb1d44040142f888b33ffefb5192 Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@midokura.com>
Date: Thu, 15 Jun 2017 12:10:45 +0000
Subject: [PATCH 1025/2409] Revert "systemd: Always create the systemd unit
 files"

This reverts commit 15b0a5f1eb849a30bcea9a1e437e9a88ae2c6f92.

The change had an assumption that a service
is properly configured even when it isn't enabled.
The assumption is not true.

Change-Id: Ib5a8ffe63eaec15bc29bfdd133db7169507bab82
Closes-Bug: #1698129
---
 functions-common | 23 ++++++-----------------
 1 file changed, 6 insertions(+), 17 deletions(-)

diff --git a/functions-common b/functions-common
index 48ce72524e..30933ea4c2 100644
--- a/functions-common
+++ b/functions-common
@@ -1508,13 +1508,8 @@ EOF
 
 }
 
-# Defines a systemd service which can be enabled and started later on.
-# arg1: The openstack service name ('n-cpu', 'c-sch', ...).
-# arg2: The command to start (e.g. path to service binary + config files).
-# arg3: The group which owns the process.
-# arg4: The user which owns the process.
-# Returns: The systemd service name which got defined.
-function _define_systemd_service {
+# Helper function to build a basic unit file and run it under systemd.
+function _run_under_systemd {
     local service=$1
     local command="$2"
     local cmd=$command
@@ -1529,7 +1524,9 @@ function _define_systemd_service {
     else
         write_user_unit_file $systemd_service "$cmd" "$group" "$user"
     fi
-    echo $systemd_service
+
+    $SYSTEMCTL enable $systemd_service
+    $SYSTEMCTL start $systemd_service
 }
 
 # Helper to remove the ``*.failure`` files under ``$SERVICE_DIR/$SCREEN_NAME``.
@@ -1570,19 +1567,11 @@ function run_process {
     local user=$4
 
     local name=$service
-    local systemd_service
 
     time_start "run_process"
-    # Note we deliberately make all service files, even if the service
-    # isn't enabled, so it can be enabled by a dev manually on command
-    # line.
-    if [[ "$USE_SYSTEMD" = "True" ]]; then
-        systemd_service=$(_define_systemd_service "$name" "$command" "$group" "$user")
-    fi
     if is_service_enabled $service; then
         if [[ "$USE_SYSTEMD" = "True" ]]; then
-            $SYSTEMCTL enable $systemd_service
-            $SYSTEMCTL start $systemd_service
+            _run_under_systemd "$name" "$command" "$group" "$user"
         elif [[ "$USE_SCREEN" = "True" ]]; then
             if [[ "$user" == "root" ]]; then
                 command="sudo $command"

From 0ffd5a944c371ae441c2c8d977486c5a20bc75fc Mon Sep 17 00:00:00 2001
From: Chris <chris.friesen@windriver.com>
Date: Fri, 23 Jun 2017 11:28:20 -0600
Subject: [PATCH 1026/2409] remove unnecessary cleanup in nova startup

nova's instances directory may be a shared directory (ie nfs), in
these cases, we do not want to call nova_cleanup at startup since it
deletes everything under $NOVA_INSTANCES_PATH.

The nova_cleanup routine will still be called by the clean.sh script
which is fine since we're presumably cleaning up the whole openstack
cluster at that point.

Change-Id: Ieb4e5d0508d4ed4c5349c497554c5da2993c9cb0
Closes-Bug: #1649389
---
 stack.sh | 1 -
 1 file changed, 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index 326d186b19..2be4528991 100755
--- a/stack.sh
+++ b/stack.sh
@@ -893,7 +893,6 @@ fi
 if is_service_enabled nova; then
     # Compute service
     stack_install_service nova
-    cleanup_nova
     configure_nova
 fi
 

From 1fa653635781cd975a1031e212b35b6c38196ba4 Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Fri, 23 Jun 2017 22:32:37 +0000
Subject: [PATCH 1027/2409] Revert "Revert "Use uwsgi for glance-api""

This reverts commit 3410e3e01bdbdbfd360d9baebeac081c33ee0821.

Change-Id: Ic58711311eb8534cb3c4b25c333197c412ffdce5
---
 lib/apache | 54 +++++++++++++++++++++++++++++++++++++++++++++++++++++-
 lib/cinder |  2 +-
 lib/glance | 44 ++++++++++++++++++++++++++++++++------------
 lib/nova   |  2 +-
 4 files changed, 87 insertions(+), 15 deletions(-)

diff --git a/lib/apache b/lib/apache
index c1b6bf8b41..25c65fe672 100644
--- a/lib/apache
+++ b/lib/apache
@@ -275,12 +275,64 @@ function write_uwsgi_config {
     else
         local apache_conf=""
         apache_conf=$(apache_site_config_for $name)
-        echo "ProxyPass \"${url}\" \"unix:${socket}|uwsgi://uwsgi-uds-${name}/\" retry=0 " | sudo tee $apache_conf
+        echo "SetEnv proxy-sendcl 1" | sudo tee $apache_conf
+        echo "ProxyPass \"${url}\" \"unix:${socket}|uwsgi://uwsgi-uds-${name}/\" retry=0 " | sudo tee -a $apache_conf
         enable_apache_site $name
         restart_apache_server
     fi
 }
 
+# For services using chunked encoding, the only services known to use this
+# currently are Glance and Swift, we need to use an http proxy instead of
+# mod_proxy_uwsgi because the chunked encoding gets dropped. See:
+# https://github.com/unbit/uwsgi/issues/1540 You can workaround this on python2
+# but that involves having apache buffer the request before sending it to
+# uswgi.
+function write_local_uwsgi_http_config {
+    local file=$1
+    local wsgi=$2
+    local url=$3
+    name=$(basename $wsgi)
+
+    # create a home for the sockets; note don't use /tmp -- apache has
+    # a private view of it on some platforms.
+
+    # always cleanup given that we are using iniset here
+    rm -rf $file
+    iniset "$file" uwsgi wsgi-file "$wsgi"
+    port=$(get_random_port)
+    iniset "$file" uwsgi http "127.0.0.1:$port"
+    iniset "$file" uwsgi processes $API_WORKERS
+    # This is running standalone
+    iniset "$file" uwsgi master true
+    # Set die-on-term & exit-on-reload so that uwsgi shuts down
+    iniset "$file" uwsgi die-on-term true
+    iniset "$file" uwsgi exit-on-reload true
+    iniset "$file" uwsgi enable-threads true
+    iniset "$file" uwsgi plugins python
+    # uwsgi recommends this to prevent thundering herd on accept.
+    iniset "$file" uwsgi thunder-lock true
+    # Override the default size for headers from the 4k default.
+    iniset "$file" uwsgi buffer-size 65535
+    # Make sure the client doesn't try to re-use the connection.
+    iniset "$file" uwsgi add-header "Connection: close"
+    # This ensures that file descriptors aren't shared between processes.
+    iniset "$file" uwsgi lazy-apps true
+    iniset "$file" uwsgi chmod-socket 666
+    iniset "$file" uwsgi http-raw-body true
+    iniset "$file" uwsgi http-chunked-input true
+    iniset "$file" uwsgi http-auto-chunked true
+
+    enable_apache_mod proxy
+    enable_apache_mod proxy_http
+    local apache_conf=""
+    apache_conf=$(apache_site_config_for $name)
+    echo "KeepAlive Off" | sudo tee $apache_conf
+    echo "ProxyPass \"${url}\" \"http://127.0.0.1:$port\" retry=0 " | sudo tee -a $apache_conf
+    enable_apache_site $name
+    restart_apache_server
+}
+
 function remove_uwsgi_config {
     local file=$1
     local wsgi=$2
diff --git a/lib/cinder b/lib/cinder
index 20688129fd..243b639a11 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -335,7 +335,7 @@ function configure_cinder {
 
     iniset $CINDER_CONF DEFAULT osapi_volume_workers "$API_WORKERS"
 
-    iniset $CINDER_CONF DEFAULT glance_api_servers "${GLANCE_SERVICE_PROTOCOL}://${GLANCE_HOSTPORT}"
+    iniset $CINDER_CONF DEFAULT glance_api_servers "$GLANCE_URL"
     if is_service_enabled tls-proxy; then
         iniset $CINDER_CONF DEFAULT glance_protocol https
         iniset $CINDER_CONF DEFAULT glance_ca_certificates_file $SSL_BUNDLE_FILE
diff --git a/lib/glance b/lib/glance
index baf8c6191c..41145f980d 100644
--- a/lib/glance
+++ b/lib/glance
@@ -71,6 +71,16 @@ GLANCE_HOSTPORT=${GLANCE_HOSTPORT:-$GLANCE_SERVICE_HOST:$GLANCE_SERVICE_PORT}
 GLANCE_SERVICE_PROTOCOL=${GLANCE_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 GLANCE_REGISTRY_PORT=${GLANCE_REGISTRY_PORT:-9191}
 GLANCE_REGISTRY_PORT_INT=${GLANCE_REGISTRY_PORT_INT:-19191}
+GLANCE_UWSGI=$GLANCE_BIN_DIR/glance-wsgi-api
+GLANCE_UWSGI_CONF=$GLANCE_CONF_DIR/glance-uswgi.ini
+# If wsgi mode is uwsgi run glance under uwsgi, else default to eventlet
+# TODO(mtreinish): Remove the eventlet path here and in all the similar
+# conditionals below after the Pike release
+if [[ "$WSGI_MODE" == "uwsgi" ]]; then
+    GLANCE_URL="$GLANCE_SERVICE_PROTOCOL://$GLANCE_SERVICE_HOST/image"
+else
+    GLANCE_URL="$GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT"
+fi
 
 # Functions
 # ---------
@@ -104,16 +114,13 @@ function configure_glance {
     dburl=`database_connection_url glance`
     iniset $GLANCE_REGISTRY_CONF database connection $dburl
     iniset $GLANCE_REGISTRY_CONF DEFAULT use_syslog $SYSLOG
-    iniset $GLANCE_REGISTRY_CONF DEFAULT workers "$API_WORKERS"
     iniset $GLANCE_REGISTRY_CONF paste_deploy flavor keystone
     configure_auth_token_middleware $GLANCE_REGISTRY_CONF glance $GLANCE_AUTH_CACHE_DIR/registry
     iniset $GLANCE_REGISTRY_CONF oslo_messaging_notifications driver messagingv2
     iniset_rpc_backend glance $GLANCE_REGISTRY_CONF
     iniset $GLANCE_REGISTRY_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
 
-    cp $GLANCE_DIR/etc/glance-api.conf $GLANCE_API_CONF
     iniset $GLANCE_API_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-    iniset $GLANCE_API_CONF DEFAULT bind_host $GLANCE_SERVICE_LISTEN_ADDRESS
     inicomment $GLANCE_API_CONF DEFAULT log_file
     iniset $GLANCE_API_CONF database connection $dburl
     iniset $GLANCE_API_CONF DEFAULT use_syslog $SYSLOG
@@ -141,8 +148,6 @@ function configure_glance {
     iniset $GLANCE_API_CONF glance_store filesystem_store_datadir $GLANCE_IMAGE_DIR/
     iniset $GLANCE_API_CONF DEFAULT registry_host $GLANCE_SERVICE_HOST
 
-    iniset $GLANCE_API_CONF DEFAULT workers "$API_WORKERS"
-
     # CORS feature support - to allow calls from Horizon by default
     if [ -n "$GLANCE_CORS_ALLOWED_ORIGIN" ]; then
         iniset $GLANCE_API_CONF cors allowed_origin "$GLANCE_CORS_ALLOWED_ORIGIN"
@@ -181,9 +186,12 @@ function configure_glance {
         inicomment $GLANCE_API_CONF glance_store swift_store_auth_address
     fi
 
+    # We need to tell glance what it's public endpoint is so that the version
+    # discovery document will be correct
+    iniset $GLANCE_API_CONF DEFAULT public_endpoint $GLANCE_URL
+
     if is_service_enabled tls-proxy; then
         iniset $GLANCE_API_CONF DEFAULT bind_port $GLANCE_SERVICE_PORT_INT
-        iniset $GLANCE_API_CONF DEFAULT public_endpoint $GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT
         iniset $GLANCE_REGISTRY_CONF DEFAULT bind_port $GLANCE_REGISTRY_PORT_INT
 
         iniset $GLANCE_API_CONF keystone_authtoken identity_uri $KEYSTONE_AUTH_URI
@@ -199,7 +207,6 @@ function configure_glance {
     setup_logging $GLANCE_REGISTRY_CONF
 
     cp -p $GLANCE_DIR/etc/glance-registry-paste.ini $GLANCE_REGISTRY_PASTE_INI
-
     cp -p $GLANCE_DIR/etc/glance-api-paste.ini $GLANCE_API_PASTE_INI
 
     cp $GLANCE_DIR/etc/glance-cache.conf $GLANCE_CACHE_CONF
@@ -232,6 +239,13 @@ function configure_glance {
         iniset $GLANCE_API_CONF DEFAULT cinder_endpoint_template "https://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/%(project_id)s"
         iniset $GLANCE_CACHE_CONF DEFAULT cinder_endpoint_template "https://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/%(project_id)s"
     fi
+
+    if [[ "$WSGI_MODE" == "uwsgi" ]]; then
+        write_local_uwsgi_http_config "$GLANCE_UWSGI_CONF" "$GLANCE_UWSGI" "/image"
+    else
+        iniset $GLANCE_API_CONF DEFAULT bind_host $GLANCE_SERVICE_LISTEN_ADDRESS
+        iniset $GLANCE_API_CONF DEFAULT workers "$API_WORKERS"
+    fi
 }
 
 # create_glance_accounts() - Set up common required glance accounts
@@ -256,7 +270,7 @@ function create_glance_accounts {
         get_or_create_endpoint \
             "image" \
             "$REGION_NAME" \
-            "$GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT"
+            "$GLANCE_URL"
 
         # Note(frickler): Crude workaround for https://bugs.launchpad.net/glance-store/+bug/1620999
         service_domain_id=$(get_or_create_domain $SERVICE_DOMAIN_NAME)
@@ -323,15 +337,21 @@ function install_glance {
 function start_glance {
     local service_protocol=$GLANCE_SERVICE_PROTOCOL
     if is_service_enabled tls-proxy; then
-        start_tls_proxy glance-service '*' $GLANCE_SERVICE_PORT $GLANCE_SERVICE_HOST $GLANCE_SERVICE_PORT_INT
+        if [[ "$WSGI_MODE" != "uwsgi" ]]; then
+            start_tls_proxy glance-service '*' $GLANCE_SERVICE_PORT $GLANCE_SERVICE_HOST $GLANCE_SERVICE_PORT_INT
+        fi
         start_tls_proxy glance-registry '*' $GLANCE_REGISTRY_PORT $GLANCE_SERVICE_HOST $GLANCE_REGISTRY_PORT_INT
     fi
 
     run_process g-reg "$GLANCE_BIN_DIR/glance-registry --config-file=$GLANCE_CONF_DIR/glance-registry.conf"
-    run_process g-api "$GLANCE_BIN_DIR/glance-api --config-file=$GLANCE_CONF_DIR/glance-api.conf"
+    if [[ "$WSGI_MODE" == "uwsgi" ]]; then
+        run_process g-api "$GLANCE_BIN_DIR/uwsgi --ini $GLANCE_UWSGI_CONF"
+    else
+        run_process g-api "$GLANCE_BIN_DIR/glance-api --config-file=$GLANCE_CONF_DIR/glance-api.conf"
+    fi
 
-    echo "Waiting for g-api ($GLANCE_HOSTPORT) to start..."
-    if ! wait_for_service $SERVICE_TIMEOUT $GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT; then
+    echo "Waiting for g-api ($GLANCE_SERVICE_HOST) to start..."
+    if ! wait_for_service $SERVICE_TIMEOUT $GLANCE_URL; then
         die $LINENO "g-api did not start"
     fi
 }
diff --git a/lib/nova b/lib/nova
index 18715fc418..f56509ac1a 100644
--- a/lib/nova
+++ b/lib/nova
@@ -575,7 +575,7 @@ function create_nova_conf {
     # enable notifications, but it will allow them to function when enabled.
     iniset $NOVA_CONF oslo_messaging_notifications driver "messagingv2"
     iniset_rpc_backend nova $NOVA_CONF
-    iniset $NOVA_CONF glance api_servers "${GLANCE_SERVICE_PROTOCOL}://${GLANCE_HOSTPORT}"
+    iniset $NOVA_CONF glance api_servers "$GLANCE_URL"
 
     iniset $NOVA_CONF DEFAULT osapi_compute_workers "$API_WORKERS"
     iniset $NOVA_CONF DEFAULT metadata_workers "$API_WORKERS"

From 580a506f250162078f1aaf970f58033bfeb859e9 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Sun, 25 Jun 2017 08:01:06 +0000
Subject: [PATCH 1028/2409] Updated from generate-devstack-plugins-list

Change-Id: I6e040449252aae43f330d545d979b3bdba6f855a
---
 doc/source/plugin-registry.rst | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index c1c66b9bb6..92e5ecdb89 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -53,6 +53,7 @@ devstack-plugin-mariadb                `git://git.openstack.org/openstack/devsta
 devstack-plugin-nfs                    `git://git.openstack.org/openstack/devstack-plugin-nfs <https://git.openstack.org/cgit/openstack/devstack-plugin-nfs>`__
 devstack-plugin-pika                   `git://git.openstack.org/openstack/devstack-plugin-pika <https://git.openstack.org/cgit/openstack/devstack-plugin-pika>`__
 devstack-plugin-sheepdog               `git://git.openstack.org/openstack/devstack-plugin-sheepdog <https://git.openstack.org/cgit/openstack/devstack-plugin-sheepdog>`__
+devstack-plugin-vmax                   `git://git.openstack.org/openstack/devstack-plugin-vmax <https://git.openstack.org/cgit/openstack/devstack-plugin-vmax>`__
 devstack-plugin-zmq                    `git://git.openstack.org/openstack/devstack-plugin-zmq <https://git.openstack.org/cgit/openstack/devstack-plugin-zmq>`__
 dragonflow                             `git://git.openstack.org/openstack/dragonflow <https://git.openstack.org/cgit/openstack/dragonflow>`__
 drbd-devstack                          `git://git.openstack.org/openstack/drbd-devstack <https://git.openstack.org/cgit/openstack/drbd-devstack>`__
@@ -123,9 +124,11 @@ networking-vsphere                     `git://git.openstack.org/openstack/networ
 neutron                                `git://git.openstack.org/openstack/neutron <https://git.openstack.org/cgit/openstack/neutron>`__
 neutron-dynamic-routing                `git://git.openstack.org/openstack/neutron-dynamic-routing <https://git.openstack.org/cgit/openstack/neutron-dynamic-routing>`__
 neutron-fwaas                          `git://git.openstack.org/openstack/neutron-fwaas <https://git.openstack.org/cgit/openstack/neutron-fwaas>`__
+neutron-fwaas-dashboard                `git://git.openstack.org/openstack/neutron-fwaas-dashboard <https://git.openstack.org/cgit/openstack/neutron-fwaas-dashboard>`__
 neutron-lbaas                          `git://git.openstack.org/openstack/neutron-lbaas <https://git.openstack.org/cgit/openstack/neutron-lbaas>`__
 neutron-lbaas-dashboard                `git://git.openstack.org/openstack/neutron-lbaas-dashboard <https://git.openstack.org/cgit/openstack/neutron-lbaas-dashboard>`__
 neutron-vpnaas                         `git://git.openstack.org/openstack/neutron-vpnaas <https://git.openstack.org/cgit/openstack/neutron-vpnaas>`__
+neutron-vpnaas-dashboard               `git://git.openstack.org/openstack/neutron-vpnaas-dashboard <https://git.openstack.org/cgit/openstack/neutron-vpnaas-dashboard>`__
 nova-dpm                               `git://git.openstack.org/openstack/nova-dpm <https://git.openstack.org/cgit/openstack/nova-dpm>`__
 nova-lxd                               `git://git.openstack.org/openstack/nova-lxd <https://git.openstack.org/cgit/openstack/nova-lxd>`__
 nova-mksproxy                          `git://git.openstack.org/openstack/nova-mksproxy <https://git.openstack.org/cgit/openstack/nova-mksproxy>`__
@@ -154,6 +157,7 @@ tricircle                              `git://git.openstack.org/openstack/tricir
 trio2o                                 `git://git.openstack.org/openstack/trio2o <https://git.openstack.org/cgit/openstack/trio2o>`__
 trove                                  `git://git.openstack.org/openstack/trove <https://git.openstack.org/cgit/openstack/trove>`__
 trove-dashboard                        `git://git.openstack.org/openstack/trove-dashboard <https://git.openstack.org/cgit/openstack/trove-dashboard>`__
+valet                                  `git://git.openstack.org/openstack/valet <https://git.openstack.org/cgit/openstack/valet>`__
 vitrage                                `git://git.openstack.org/openstack/vitrage <https://git.openstack.org/cgit/openstack/vitrage>`__
 vitrage-dashboard                      `git://git.openstack.org/openstack/vitrage-dashboard <https://git.openstack.org/cgit/openstack/vitrage-dashboard>`__
 vmware-nsx                             `git://git.openstack.org/openstack/vmware-nsx <https://git.openstack.org/cgit/openstack/vmware-nsx>`__

From 20eeff813d21e86c1d529d5cbc4f7b0ad732e69d Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Mon, 26 Jun 2017 07:53:08 +0000
Subject: [PATCH 1029/2409] Revert "Fleetify nova conductor for N cells"

This reverts commit f63aa021cf996b500b6a570c0114c490bb57461a.

Change-Id: I541abe7311e5721d79e300fcb2a0b8ffdcd3c015
Related-Bug: #1700364
---
 lib/nova | 111 ++++++-------------------------------------------------
 stack.sh |   4 +-
 2 files changed, 13 insertions(+), 102 deletions(-)

diff --git a/lib/nova b/lib/nova
index 8eac254262..5832f11d67 100644
--- a/lib/nova
+++ b/lib/nova
@@ -53,18 +53,10 @@ NOVA_AUTH_CACHE_DIR=${NOVA_AUTH_CACHE_DIR:-/var/cache/nova}
 NOVA_CONF_DIR=/etc/nova
 NOVA_CONF=$NOVA_CONF_DIR/nova.conf
 NOVA_CELLS_CONF=$NOVA_CONF_DIR/nova-cells.conf
-NOVA_CPU_CONF=$NOVA_CONF_DIR/nova-cpu.conf
 NOVA_FAKE_CONF=$NOVA_CONF_DIR/nova-fake.conf
 NOVA_CELLS_DB=${NOVA_CELLS_DB:-nova_cell}
 NOVA_API_DB=${NOVA_API_DB:-nova_api}
 
-# The total number of cells we expect. Must be greater than one and doesn't
-# count cell0.
-NOVA_NUM_CELLS=${NOVA_NUM_CELLS:-1}
-# Our cell index, so we know what rabbit vhost to connect to.
-# This should be in the range of 1-$NOVA_NUM_CELLS
-NOVA_CPU_CELL=${NOVA_CPU_CELL:-1}
-
 NOVA_API_PASTE_INI=${NOVA_API_PASTE_INI:-$NOVA_CONF_DIR/api-paste.ini}
 
 if is_suse; then
@@ -487,7 +479,7 @@ function create_nova_conf {
     # require them running on the host. The ensures that n-cpu doesn't
     # leak a need to use the db in a multinode scenario.
     if is_service_enabled n-api n-cond n-sched; then
-        iniset $NOVA_CONF database connection `database_connection_url nova_cell0`
+        iniset $NOVA_CONF database connection `database_connection_url nova`
         iniset $NOVA_CONF api_database connection `database_connection_url nova_api`
     fi
 
@@ -622,20 +614,6 @@ function create_nova_conf {
     if [ "$NOVA_USE_SERVICE_TOKEN" == "True" ]; then
         init_nova_service_user_conf
     fi
-
-    if is_service_enabled n-cond; then
-        for i in $(seq 1 $NOVA_NUM_CELLS); do
-            local conf
-            local vhost
-            conf=$(conductor_conf $i)
-            vhost="nova_cell${i}"
-            iniset $conf database connection `database_connection_url nova_cell${i}`
-            iniset $conf conductor workers "$API_WORKERS"
-            iniset $conf DEFAULT debug "$ENABLE_DEBUG_LOG_LEVEL"
-            rpc_backend_add_vhost $vhost
-            iniset_rpc_backend nova $conf DEFAULT $vhost
-        done
-    fi
 }
 
 function init_nova_service_user_conf {
@@ -650,11 +628,6 @@ function init_nova_service_user_conf {
     iniset $NOVA_CONF service_user auth_strategy keystone
 }
 
-function conductor_conf {
-    local cell="$1"
-    echo "${NOVA_CONF_DIR}/nova_cell${cell}.conf"
-}
-
 function init_nova_cells {
     if is_service_enabled n-cell; then
         cp $NOVA_CONF $NOVA_CELLS_CONF
@@ -719,6 +692,8 @@ function init_nova {
         recreate_database $NOVA_API_DB
         $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF api_db sync
 
+        # (Re)create nova databases
+        recreate_database nova
         recreate_database nova_cell0
 
         # map_cell0 will create the cell mapping record in the nova_api DB so
@@ -730,12 +705,6 @@ function init_nova {
         # Migrate nova and nova_cell0 databases.
         $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF db sync
 
-        # (Re)create nova databases
-        for i in $(seq 1 $NOVA_NUM_CELLS); do
-            recreate_database nova_cell${i}
-            $NOVA_BIN_DIR/nova-manage --config-file $(conductor_conf $i) db sync
-        done
-
         if is_service_enabled n-cell; then
             recreate_database $NOVA_CELLS_DB
         fi
@@ -744,13 +713,9 @@ function init_nova {
         # Needed for flavor conversion
         $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF db online_data_migrations
 
-        # FIXME(danms): Should this be configurable?
-        iniset $NOVA_CONF workarounds disable_group_policy_check_upcall True
-
         # create the cell1 cell for the main nova db where the hosts live
-        for i in $(seq 1 $NOVA_NUM_CELLS); do
-            nova-manage --config-file $NOVA_CONF --config-file $(conductor_conf $i) cell_v2 create_cell --name "cell$i"
-        done
+        nova-manage cell_v2 create_cell --transport-url $(get_transport_url) \
+            --name 'cell1'
     fi
 
     create_nova_cache_dir
@@ -858,38 +823,25 @@ function start_nova_api {
 
 # start_nova_compute() - Start the compute process
 function start_nova_compute {
-    local nomulticellflag="$1"
     # Hack to set the path for rootwrap
     local old_path=$PATH
     export PATH=$NOVA_BIN_DIR:$PATH
 
     if is_service_enabled n-cell; then
         local compute_cell_conf=$NOVA_CELLS_CONF
-        # NOTE(danms): Don't setup conductor fleet for cellsv1
-        nomulticellflag='nomulticell'
     else
         local compute_cell_conf=$NOVA_CONF
     fi
 
-    if [ "$nomulticellflag" = 'nomulticell' ]; then
-        # NOTE(danms): Grenade doesn't setup multi-cell rabbit, so
-        # skip these bits and use the normal config.
-        NOVA_CPU_CONF=$compute_cell_conf
-        echo "Skipping multi-cell conductor fleet setup"
-    else
-        cp $compute_cell_conf $NOVA_CPU_CONF
-        iniset_rpc_backend nova $NOVA_CPU_CONF DEFAULT "nova_cell${NOVA_CPU_CELL}"
-    fi
-
     if [[ "$VIRT_DRIVER" = 'libvirt' ]]; then
         # The group **$LIBVIRT_GROUP** is added to the current user in this script.
         # ``sg`` is used in run_process to execute nova-compute as a member of the
         # **$LIBVIRT_GROUP** group.
-        run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $NOVA_CPU_CONF" $LIBVIRT_GROUP
+        run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $compute_cell_conf" $LIBVIRT_GROUP
     elif [[ "$VIRT_DRIVER" = 'lxd' ]]; then
-        run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $NOVA_CPU_CONF" $LXD_GROUP
+        run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $compute_cell_conf" $LXD_GROUP
     elif [[ "$VIRT_DRIVER" = 'docker' || "$VIRT_DRIVER" = 'zun' ]]; then
-        run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $NOVA_CPU_CONF" $DOCKER_GROUP
+        run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $compute_cell_conf" $DOCKER_GROUP
     elif [[ "$VIRT_DRIVER" = 'fake' ]]; then
         local i
         for i in `seq 1 $NUMBER_FAKE_NOVA_COMPUTE`; do
@@ -898,13 +850,13 @@ function start_nova_compute {
             # gets its own configuration and own log file.
             local fake_conf="${NOVA_FAKE_CONF}-${i}"
             iniset $fake_conf DEFAULT nhost "${HOSTNAME}${i}"
-            run_process "n-cpu-${i}" "$NOVA_BIN_DIR/nova-compute --config-file $NOVA_CPU_CONF --config-file $fake_conf"
+            run_process "n-cpu-${i}" "$NOVA_BIN_DIR/nova-compute --config-file $compute_cell_conf --config-file $fake_conf"
         done
     else
         if is_service_enabled n-cpu && [[ -r $NOVA_PLUGINS/hypervisor-$VIRT_DRIVER ]]; then
             start_nova_hypervisor
         fi
-        run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $NOVA_CPU_CONF"
+        run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $compute_cell_conf"
     fi
 
     export PATH=$old_path
@@ -924,6 +876,7 @@ function start_nova_rest {
     fi
 
     # ``run_process`` checks ``is_service_enabled``, it is not needed here
+    run_process n-cond "$NOVA_BIN_DIR/nova-conductor --config-file $compute_cell_conf"
     run_process n-cell-region "$NOVA_BIN_DIR/nova-cells --config-file $api_cell_conf"
     run_process n-cell-child "$NOVA_BIN_DIR/nova-cells --config-file $compute_cell_conf"
 
@@ -946,38 +899,8 @@ function start_nova_rest {
     export PATH=$old_path
 }
 
-function enable_nova_fleet {
-    if is_service_enabled n-cond; then
-        enable_service n-super-cond
-        for i in $(seq 1 $NOVA_NUM_CELLS); do
-            enable_service n-cond-cell${i}
-        done
-    fi
-}
-
-function start_nova_conductor {
-    if is_service_enabled n-cell; then
-        echo "Starting nova-conductor in a cellsv1-compatible way"
-        run_process n-cond "$NOVA_BIN_DIR/nova-conductor --config-file $NOVA_CELLS_CONF"
-        return
-    fi
-
-    enable_nova_fleet
-    if is_service_enabled n-super-cond; then
-        run_process n-super-cond "$NOVA_BIN_DIR/nova-conductor --config-file $NOVA_CONF"
-    fi
-    for i in $(seq 1 $NOVA_NUM_CELLS); do
-        if is_service_enabled n-cond-cell${i}; then
-            local conf
-            conf=$(conductor_conf $i)
-            run_process n-cond-cell${i} "$NOVA_BIN_DIR/nova-conductor --config-file $conf"
-        fi
-    done
-}
-
 function start_nova {
     start_nova_rest
-    start_nova_conductor
     start_nova_compute
 }
 
@@ -1006,24 +929,14 @@ function stop_nova_rest {
     # Kill the nova screen windows
     # Some services are listed here twice since more than one instance
     # of a service may be running in certain configs.
-    for serv in n-api n-net n-sch n-novnc n-xvnc n-cauth n-spice n-cell n-cell n-api-meta n-sproxy; do
+    for serv in n-api n-net n-sch n-novnc n-xvnc n-cauth n-spice n-cond n-cell n-cell n-api-meta n-sproxy; do
         stop_process $serv
     done
 }
 
-function stop_nova_conductor {
-    enable_nova_fleet
-    for srv in n-super-cond $(seq -f n-cond-cell%0.f 1 $NOVA_NUM_CELLS); do
-        if is_service_enabled $srv; then
-            stop_process $srv
-        fi
-    done
-}
-
 # stop_nova() - Stop running processes (non-screen)
 function stop_nova {
     stop_nova_rest
-    stop_nova_conductor
     stop_nova_compute
 }
 
diff --git a/stack.sh b/stack.sh
index 5148ae1d77..6793d45cc1 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1268,9 +1268,7 @@ fi
 # Unable to use LUKS passphrase that is exactly 16 bytes long
 # https://bugzilla.redhat.com/show_bug.cgi?id=1447297
 if is_service_enabled nova; then
-    key=$(generate_hex_string 36)
-    iniset $NOVA_CONF key_manager fixed_key "$key"
-    iniset $NOVA_CPU_CONF key_manager fixed_key "$key"
+    iniset $NOVA_CONF key_manager fixed_key $(generate_hex_string 36)
 fi
 
 # Launch the nova-api and wait for it to answer before continuing

From b90bb1a46193b052cd98513213eed688e8e29d23 Mon Sep 17 00:00:00 2001
From: Chris Dent <cdent@anticdent.org>
Date: Tue, 18 Apr 2017 16:30:14 +0000
Subject: [PATCH 1030/2409] Use uwsgi for nova when NOVA_USE_MOD_WSGI is not
 False

Unless NOVA_USE_MOD_WSGI is False, run nova-api and nova-metadata
using uwsgi.

Because the metadata server is always expected to run on a port and
without a prefix, we have it configured to use uwsgi but not to
proxy from apache: uwsgi listens on the configured port itself.

uwsgi process that listen themselve do not need a socket or to
chmod-socket, so those config lines have been moved to the block
that is also writing proxy configuration for apache.

Because this change only uses uwsgi for nova-api and nova-api-meta,
nova-api-meta is set to default to enabled in stackrc because the
nova-api wsgi application used by wsgi only presents the one service
(osapi_compute).

If NOVA_USE_MOD_WSGI is False and tls_proxy service is enabled,
nova-api is run on an internal port reached via the tls_proxy.

Depends-On: I8ff08d61520ccf04e32dcd02f4cecc39dae823cb
Change-Id: If2d7e363a6541854f2e30c03171bef7a41aff745
---
 lib/apache |   4 +-
 lib/nova   | 144 ++++++++++++++---------------------------------------
 stackrc    |   2 +-
 3 files changed, 40 insertions(+), 110 deletions(-)

diff --git a/lib/apache b/lib/apache
index 25c65fe672..8f517d2e61 100644
--- a/lib/apache
+++ b/lib/apache
@@ -250,7 +250,6 @@ function write_uwsgi_config {
     # always cleanup given that we are using iniset here
     rm -rf $file
     iniset "$file" uwsgi wsgi-file "$wsgi"
-    iniset "$file" uwsgi socket "$socket"
     iniset "$file" uwsgi processes $API_WORKERS
     # This is running standalone
     iniset "$file" uwsgi master true
@@ -267,7 +266,6 @@ function write_uwsgi_config {
     iniset "$file" uwsgi add-header "Connection: close"
     # This ensures that file descriptors aren't shared between processes.
     iniset "$file" uwsgi lazy-apps true
-    iniset "$file" uwsgi chmod-socket 666
 
     # If we said bind directly to http, then do that and don't start the apache proxy
     if [[ -n "$http" ]]; then
@@ -276,6 +274,8 @@ function write_uwsgi_config {
         local apache_conf=""
         apache_conf=$(apache_site_config_for $name)
         echo "SetEnv proxy-sendcl 1" | sudo tee $apache_conf
+        iniset "$file" uwsgi socket "$socket"
+        iniset "$file" uwsgi chmod-socket 666
         echo "ProxyPass \"${url}\" \"unix:${socket}|uwsgi://uwsgi-uds-${name}/\" retry=0 " | sudo tee -a $apache_conf
         enable_apache_site $name
         restart_apache_server
diff --git a/lib/nova b/lib/nova
index f56509ac1a..3fa5de67eb 100644
--- a/lib/nova
+++ b/lib/nova
@@ -17,7 +17,6 @@
 #
 # - install_nova
 # - configure_nova
-# - _config_nova_apache_wsgi
 # - create_nova_conf
 # - init_nova
 # - start_nova
@@ -28,7 +27,6 @@
 _XTRACE_LIB_NOVA=$(set +o | grep xtrace)
 set +o xtrace
 
-
 # Defaults
 # --------
 
@@ -56,17 +54,20 @@ NOVA_CELLS_CONF=$NOVA_CONF_DIR/nova-cells.conf
 NOVA_FAKE_CONF=$NOVA_CONF_DIR/nova-fake.conf
 NOVA_CELLS_DB=${NOVA_CELLS_DB:-nova_cell}
 NOVA_API_DB=${NOVA_API_DB:-nova_api}
+NOVA_UWSGI=$NOVA_BIN_DIR/nova-api-wsgi
+NOVA_METADATA_UWSGI=$NOVA_BIN_DIR/nova-metadata-wsgi
+NOVA_UWSGI_CONF=$NOVA_CONF_DIR/nova-api-uwsgi.ini
+NOVA_METADATA_UWSGI_CONF=$NOVA_CONF_DIR/nova-metadata-uwsgi.ini
 
 NOVA_API_PASTE_INI=${NOVA_API_PASTE_INI:-$NOVA_CONF_DIR/api-paste.ini}
 
-if is_suse; then
-    NOVA_WSGI_DIR=${NOVA_WSGI_DIR:-/srv/www/htdocs/nova}
-else
-    NOVA_WSGI_DIR=${NOVA_WSGI_DIR:-/var/www/nova}
-fi
-
-# Toggle for deploying Nova-API under HTTPD + mod_wsgi
-NOVA_USE_MOD_WSGI=${NOVA_USE_MOD_WSGI:-False}
+# Toggle for deploying Nova-API under a wsgi server. We default to
+# true to use UWSGI, but allow False so that fall back to the
+# eventlet server can happen for grenade runs.
+# NOTE(cdent): We can adjust to remove the eventlet-base api service
+# after pike, at which time we can stop using NOVA_USE_MOD_WSGI to
+# mean "use uwsgi" because we'll be always using uwsgi.
+NOVA_USE_MOD_WSGI=${NOVA_USE_MOD_WSGI:-True}
 
 if is_service_enabled tls-proxy; then
     NOVA_SERVICE_PROTOCOL="https"
@@ -236,66 +237,10 @@ function cleanup_nova {
     #    cleanup_nova_hypervisor
     #fi
 
-    if [ "$NOVA_USE_MOD_WSGI" == "True" ]; then
-        _cleanup_nova_apache_wsgi
-    fi
-}
-
-# _cleanup_nova_apache_wsgi() - Remove wsgi files, disable and remove apache vhost file
-function _cleanup_nova_apache_wsgi {
-    sudo rm -f $NOVA_WSGI_DIR/*
-    sudo rm -f $(apache_site_config_for nova-api)
-    sudo rm -f $(apache_site_config_for nova-metadata)
-}
-
-# _config_nova_apache_wsgi() - Set WSGI config files of Nova API
-function _config_nova_apache_wsgi {
-    sudo mkdir -p $NOVA_WSGI_DIR
-
-    local nova_apache_conf
-    nova_apache_conf=$(apache_site_config_for nova-api)
-    local nova_metadata_apache_conf
-    nova_metadata_apache_conf=$(apache_site_config_for nova-metadata)
-    local nova_ssl=""
-    local nova_certfile=""
-    local nova_keyfile=""
-    local nova_api_port=$NOVA_SERVICE_PORT
-    local nova_metadata_port=$METADATA_SERVICE_PORT
-    local venv_path=""
-
-    if [[ ${USE_VENV} = True ]]; then
-        venv_path="python-path=${PROJECT_VENV["nova"]}/lib/$(python_version)/site-packages"
-    fi
-
-    # copy proxy vhost and wsgi helper files
-    sudo cp $NOVA_DIR/nova/wsgi/nova-api.py $NOVA_WSGI_DIR/nova-api
-    sudo cp $NOVA_DIR/nova/wsgi/nova-metadata.py $NOVA_WSGI_DIR/nova-metadata
-
-    sudo cp $FILES/apache-nova-api.template $nova_apache_conf
-    sudo sed -e "
-        s|%PUBLICPORT%|$nova_api_port|g;
-        s|%APACHE_NAME%|$APACHE_NAME|g;
-        s|%PUBLICWSGI%|$NOVA_WSGI_DIR/nova-api|g;
-        s|%SSLENGINE%|$nova_ssl|g;
-        s|%SSLCERTFILE%|$nova_certfile|g;
-        s|%SSLKEYFILE%|$nova_keyfile|g;
-        s|%USER%|$STACK_USER|g;
-        s|%VIRTUALENV%|$venv_path|g
-        s|%APIWORKERS%|$API_WORKERS|g
-    " -i $nova_apache_conf
-
-    sudo cp $FILES/apache-nova-metadata.template $nova_metadata_apache_conf
-    sudo sed -e "
-        s|%PUBLICPORT%|$nova_metadata_port|g;
-        s|%APACHE_NAME%|$APACHE_NAME|g;
-        s|%PUBLICWSGI%|$NOVA_WSGI_DIR/nova-metadata|g;
-        s|%SSLENGINE%|$nova_ssl|g;
-        s|%SSLCERTFILE%|$nova_certfile|g;
-        s|%SSLKEYFILE%|$nova_keyfile|g;
-        s|%USER%|$STACK_USER|g;
-        s|%VIRTUALENV%|$venv_path|g
-        s|%APIWORKERS%|$API_WORKERS|g
-    " -i $nova_metadata_apache_conf
+    stop_process "n-api"
+    stop_process "n-api-meta"
+    remove_uwsgi_config "$NOVA_UWSGI_CONF" "$NOVA_UWSGI"
+    remove_uwsgi_config "$NOVA_METADATA_UWSGI_CONF" "$NOVA_METADATA_UWSGI"
 }
 
 # configure_nova() - Set config files, create data dirs, etc
@@ -489,7 +434,7 @@ function create_nova_conf {
             NOVA_ENABLED_APIS=$(echo $NOVA_ENABLED_APIS | sed "s/,metadata//")
         fi
         iniset $NOVA_CONF DEFAULT enabled_apis "$NOVA_ENABLED_APIS"
-        if is_service_enabled tls-proxy; then
+        if is_service_enabled tls-proxy && [ "$NOVA_USE_MOD_WSGI" == "False" ]; then
             # Set the service port for a proxy to take the original
             iniset $NOVA_CONF DEFAULT osapi_compute_listen_port "$NOVA_SERVICE_PORT_INT"
             iniset $NOVA_CONF DEFAULT osapi_compute_link_prefix $NOVA_SERVICE_PROTOCOL://$NOVA_SERVICE_HOST:$NOVA_SERVICE_PORT
@@ -524,11 +469,10 @@ function create_nova_conf {
         iniset $NOVA_CONF DEFAULT force_config_drive "$FORCE_CONFIG_DRIVE"
     fi
     # Format logging
-    setup_logging $NOVA_CONF $NOVA_USE_MOD_WSGI
+    setup_logging $NOVA_CONF
 
-    if [ "$NOVA_USE_MOD_WSGI" == "True" ]; then
-        _config_nova_apache_wsgi
-    fi
+    write_uwsgi_config "$NOVA_UWSGI_CONF" "$NOVA_UWSGI" "/compute"
+    write_uwsgi_config "$NOVA_METADATA_UWSGI_CONF" "$NOVA_METADATA_UWSGI" "" ":${METADATA_SERVICE_PORT}"
 
     if is_service_enabled ceilometer; then
         iniset $NOVA_CONF DEFAULT instance_usage_audit "True"
@@ -777,10 +721,6 @@ function install_nova {
     git_clone $NOVA_REPO $NOVA_DIR $NOVA_BRANCH
     setup_develop $NOVA_DIR
     sudo install -D -m 0644 -o $STACK_USER {$NOVA_DIR/tools/,/etc/bash_completion.d/}nova-manage.bash_completion
-
-    if [ "$NOVA_USE_MOD_WSGI" == "True" ]; then
-        install_apache_wsgi
-    fi
 }
 
 # start_nova_api() - Start the API process ahead of other things
@@ -788,6 +728,7 @@ function start_nova_api {
     # Get right service port for testing
     local service_port=$NOVA_SERVICE_PORT
     local service_protocol=$NOVA_SERVICE_PROTOCOL
+    local nova_url
     if is_service_enabled tls-proxy; then
         service_port=$NOVA_SERVICE_PORT_INT
         service_protocol="http"
@@ -797,29 +738,23 @@ function start_nova_api {
     local old_path=$PATH
     export PATH=$NOVA_BIN_DIR:$PATH
 
-    # If the site is not enabled then we are in a grenade scenario
-    local enabled_site_file
-    enabled_site_file=$(apache_site_config_for nova-api)
-    if [ -f ${enabled_site_file} ] && [ "$NOVA_USE_MOD_WSGI" == "True" ]; then
-        enable_apache_site nova-api
-        enable_apache_site nova-metadata
-        restart_apache_server
-        tail_log nova-api /var/log/$APACHE_NAME/nova-api.log
-        tail_log nova-metadata /var/log/$APACHE_NAME/nova-metadata.log
-    else
+    if [ "$NOVA_USE_MOD_WSGI" == "False" ]; then
         run_process n-api "$NOVA_BIN_DIR/nova-api"
+        nova_url=$service_protocol://$SERVICE_HOST:$service_port
+        # Start proxy if tsl enabled
+        if is_service_enabled tls-proxy; then
+            start_tls_proxy nova '*' $NOVA_SERVICE_PORT $NOVA_SERVICE_HOST $NOVA_SERVICE_PORT_INT
+        fi
+    else
+        run_process "n-api" "$NOVA_BIN_DIR/uwsgi --ini $NOVA_UWSGI_CONF"
+        nova_url=$service_protocol://$SERVICE_HOST/compute/v2.1/
     fi
 
     echo "Waiting for nova-api to start..."
-    if ! wait_for_service $SERVICE_TIMEOUT $service_protocol://$SERVICE_HOST:$service_port; then
+    if ! wait_for_service $SERVICE_TIMEOUT $nova_url; then
         die $LINENO "nova-api did not start"
     fi
 
-    # Start proxies if enabled
-    if is_service_enabled tls-proxy; then
-        start_tls_proxy nova '*' $NOVA_SERVICE_PORT $NOVA_SERVICE_HOST $NOVA_SERVICE_PORT_INT
-    fi
-
     export PATH=$old_path
 }
 
@@ -890,7 +825,11 @@ function start_nova_rest {
     run_process n-net "$NOVA_BIN_DIR/nova-network --config-file $compute_cell_conf"
 
     run_process n-sch "$NOVA_BIN_DIR/nova-scheduler --config-file $compute_cell_conf"
-    run_process n-api-meta "$NOVA_BIN_DIR/nova-api-metadata --config-file $compute_cell_conf"
+    if [ "$NOVA_USE_MOD_WSGI" == "False" ]; then
+        run_process n-api-meta "$NOVA_BIN_DIR/nova-api-metadata --config-file $compute_cell_conf"
+    else
+        run_process n-api-meta "$NOVA_BIN_DIR/uwsgi --ini $NOVA_METADATA_UWSGI_CONF"
+    fi
 
     run_process n-novnc "$NOVA_BIN_DIR/nova-novncproxy --config-file $api_cell_conf --web $NOVNC_WEB_DIR"
     run_process n-xvnc "$NOVA_BIN_DIR/nova-xvpvncproxy --config-file $api_cell_conf"
@@ -921,17 +860,8 @@ function stop_nova_compute {
 }
 
 function stop_nova_rest {
-    if [ "$NOVA_USE_MOD_WSGI" == "True" ]; then
-        disable_apache_site nova-api
-        disable_apache_site nova-metadata
-        restart_apache_server
-    else
-        stop_process n-api
-    fi
-    # Kill the nova screen windows
-    # Some services are listed here twice since more than one instance
-    # of a service may be running in certain configs.
-    for serv in n-api n-net n-sch n-novnc n-xvnc n-cauth n-spice n-cond n-cell n-cell n-api-meta n-sproxy; do
+    # Kill the non-compute nova processes
+    for serv in n-api n-api-meta n-net n-sch n-novnc n-xvnc n-cauth n-spice n-cond n-cell n-cell n-sproxy; do
         stop_process $serv
     done
 }
diff --git a/stackrc b/stackrc
index 50f7c89ba3..eccc52aac5 100644
--- a/stackrc
+++ b/stackrc
@@ -53,7 +53,7 @@ if ! isset ENABLED_SERVICES ; then
     # Keystone - nothing works without keystone
     ENABLED_SERVICES=key
     # Nova - services to support libvirt based openstack clouds
-    ENABLED_SERVICES+=,n-api,n-cpu,n-cond,n-sch,n-novnc,n-cauth
+    ENABLED_SERVICES+=,n-api,n-cpu,n-cond,n-sch,n-novnc,n-cauth,n-api-meta
     # Placement service needed for Nova
     ENABLED_SERVICES+=,placement-api,placement-client
     # Glance services needed for Nova

From 2c0faca0380050b697b7d7fe6589102fa8a0cb5d Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 28 Jun 2017 09:13:04 -0400
Subject: [PATCH 1031/2409] Add devstack-version script

This will help in collecting information about the devstack version
being used.

Change-Id: I23a8ca023bda6d097051cd57ae45401806451ad5
---
 functions | 15 +++++++++++++++
 stack.sh  | 14 +++++++++++++-
 stackrc   |  1 +
 3 files changed, 29 insertions(+), 1 deletion(-)

diff --git a/functions b/functions
index e056c3fba2..738040d7bc 100644
--- a/functions
+++ b/functions
@@ -751,6 +751,21 @@ function get_random_port {
 }
 
 
+function write_devstack_version {
+    pushd $TOP_DIR
+    local git_version=""
+    git_version=$(git log --format="%H %s %ci" -1)
+    cat - > /tmp/devstack-version <<EOF
+#!/bin/bash
+
+echo "DevStack Version: ${DEVSTACK_SERIES} - ${git_version}"
+echo "OS Version: ${os_VENDOR} ${os_RELEASE} ${os_CODENAME}"
+
+EOF
+    sudo install -m 755 /tmp/devstack-version /usr/local/bin/devstack-version
+    rm /tmp/devstack-version
+}
+
 # Restore xtrace
 $_XTRACE_FUNCTIONS
 
diff --git a/stack.sh b/stack.sh
index 59f25973ea..fd1865129f 100755
--- a/stack.sh
+++ b/stack.sh
@@ -216,6 +216,9 @@ if [[ ! -r $TOP_DIR/stackrc ]]; then
 fi
 source $TOP_DIR/stackrc
 
+# this installs a devstack-version script to make it easy to report the version back
+write_devstack_version
+
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
 if [[ ! ${DISTRO} =~ (xenial|yakkety|zesty|stretch|jessie|f24|f25|opensuse-42.2|rhel7|kvmibm1) ]]; then
@@ -1521,19 +1524,28 @@ fi
 
 # Warn that a deprecated feature was used
 if [[ -n "$DEPRECATED_TEXT" ]]; then
-    echo_summary "WARNING: $DEPRECATED_TEXT"
+    echo
+    echo -e "WARNING: $DEPRECATED_TEXT"
+    echo
 fi
 
 # If USE_SYSTEMD is enabled, tell the user about using it.
 if [[ "$USE_SYSTEMD" == "True" ]]; then
+    echo
     echo "Services are running under systemd unit files."
     echo "For more information see: "
     echo "https://docs.openstack.org/developer/devstack/systemd.html"
+    echo
 fi
 
+# devstack version
+devstack-version
+echo
+
 # Indicate how long this took to run (bash maintained variable ``SECONDS``)
 echo_summary "stack.sh completed in $SECONDS seconds."
 
+
 # Restore/close logging file descriptors
 exec 1>&3
 exec 2>&3
diff --git a/stackrc b/stackrc
index 50f7c89ba3..5da9a2abec 100644
--- a/stackrc
+++ b/stackrc
@@ -272,6 +272,7 @@ REQUIREMENTS_DIR=$DEST/requirements
 # Setting the variable to 'ALL' will activate the download for all
 # libraries.
 
+DEVSTACK_SERIES="pike"
 
 ##############
 #

From 82d0610f14e09931e00443364c7da25f42aa89de Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Wed, 28 Jun 2017 17:42:31 -0400
Subject: [PATCH 1032/2409] Ensure keepalive isn't used on uwsgi http mode

According to the uwsgi docs [1] for http keepalive there is a separate
option for http keep alive, and just setting connection close isn't
enough. This commit makes sure we disable http keepalive. This will
hopefully fix the random connection issues we get on image uploads to
glance, which uses uwsgi http mode.

[1] http://uwsgi-docs.readthedocs.io/en/latest/HTTP.html#http-keep-alive

Change-Id: Ic5f83c5c93f28b2bd62ca9ac96ca8c87797ea5c9
Closes-Bug: #1701088
---
 lib/apache | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/apache b/lib/apache
index 25c65fe672..35a9e7b733 100644
--- a/lib/apache
+++ b/lib/apache
@@ -322,6 +322,7 @@ function write_local_uwsgi_http_config {
     iniset "$file" uwsgi http-raw-body true
     iniset "$file" uwsgi http-chunked-input true
     iniset "$file" uwsgi http-auto-chunked true
+    iniset "$file" uwsgi http-keepalive false
 
     enable_apache_mod proxy
     enable_apache_mod proxy_http

From daf1274409ce8b9bd6b21955f4172bd70a7e5c68 Mon Sep 17 00:00:00 2001
From: Sean McGinnis <sean_mcginnis@dell.com>
Date: Fri, 3 Mar 2017 18:09:35 +0000
Subject: [PATCH 1033/2409] Run cinder-api with uWSGI

Per the Pike goal, switching the Cinder API control plane to
use WSGI in Apache.

Co-Authored-By: Ivan Kolodyazhny <e0ne@e0ne.info>
Depends-On: Ie8a0eeab1bf31887d6f37cf155b2d161ddfb172d
Depends-On: I14b68f36e7fcc5341bbdbcf165274d9d50f7dd04
Change-Id: I8cef6c98f9242cc38d66de0ac499490e2a237887
---
 lib/cinder | 155 +++++++++++++++++++++++++----------------------------
 1 file changed, 72 insertions(+), 83 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index b585416f7a..4274be740a 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -55,6 +55,8 @@ CINDER_AUTH_CACHE_DIR=${CINDER_AUTH_CACHE_DIR:-/var/cache/cinder}
 
 CINDER_CONF_DIR=/etc/cinder
 CINDER_CONF=$CINDER_CONF_DIR/cinder.conf
+CINDER_UWSGI=$CINDER_BIN_DIR/cinder-wsgi
+CINDER_UWSGI_CONF=$CINDER_CONF_DIR/cinder-api-uwsgi.ini
 CINDER_API_PASTE_INI=$CINDER_CONF_DIR/api-paste.ini
 
 # Public facing bits
@@ -106,8 +108,9 @@ else
     CINDER_ISCSI_HELPER=${CINDER_ISCSI_HELPER:-tgtadm}
 fi
 
-# Toggle for deploying Cinder under HTTPD + mod_wsgi
-CINDER_USE_MOD_WSGI=${CINDER_USE_MOD_WSGI:-False}
+# Toggle for deploying Cinder under a wsgi server. Legacy mod_wsgi
+# reference should be cleaned up to more accurately refer to uwsgi.
+CINDER_USE_MOD_WSGI=${CINDER_USE_MOD_WSGI:-True}
 
 # Source the enabled backends
 if is_service_enabled c-vol && [[ -n "$CINDER_ENABLED_BACKENDS" ]]; then
@@ -196,38 +199,8 @@ function cleanup_cinder {
         done
     fi
 
-    if [ "$CINDER_USE_MOD_WSGI" == "True" ]; then
-        _cinder_cleanup_apache_wsgi
-    fi
-}
-
-# _cinder_config_apache_wsgi() - Set WSGI config files
-function _cinder_config_apache_wsgi {
-    local cinder_apache_conf
-    cinder_apache_conf=$(apache_site_config_for osapi-volume)
-    local cinder_ssl=""
-    local cinder_certfile=""
-    local cinder_keyfile=""
-    local cinder_api_port=$CINDER_SERVICE_PORT
-    local venv_path=""
-
-    if [[ ${USE_VENV} = True ]]; then
-        venv_path="python-path=${PROJECT_VENV["cinder"]}/lib/python2.7/site-packages"
-    fi
-
-    # copy proxy vhost file
-    sudo cp $FILES/apache-cinder-api.template $cinder_apache_conf
-    sudo sed -e "
-        s|%PUBLICPORT%|$cinder_api_port|g;
-        s|%APACHE_NAME%|$APACHE_NAME|g;
-        s|%APIWORKERS%|$API_WORKERS|g
-        s|%CINDER_BIN_DIR%|$CINDER_BIN_DIR|g;
-        s|%SSLENGINE%|$cinder_ssl|g;
-        s|%SSLCERTFILE%|$cinder_certfile|g;
-        s|%SSLKEYFILE%|$cinder_keyfile|g;
-        s|%USER%|$STACK_USER|g;
-        s|%VIRTUALENV%|$venv_path|g
-    " -i $cinder_apache_conf
+    stop_process "c-api"
+    remove_uwsgi_config "$CINDER_UWSGI_CONF" "$CINDER_UWSGI"
 }
 
 # configure_cinder() - Set config files, create data dirs, etc
@@ -319,9 +292,18 @@ function configure_cinder {
     fi
 
     if is_service_enabled tls-proxy; then
-        # Set the service port for a proxy to take the original
-        iniset $CINDER_CONF DEFAULT osapi_volume_listen_port $CINDER_SERVICE_PORT_INT
-        iniset $CINDER_CONF DEFAULT public_endpoint $CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT
+        if [[ "$ENABLED_SERVICES" =~ "c-api" ]]; then
+            # Set the service port for a proxy to take the original
+            if [ "$CINDER_USE_MOD_WSGI" == "True" ]; then
+                iniset $CINDER_CONF DEFAULT osapi_volume_listen_port $CINDER_SERVICE_PORT_INT
+                iniset $CINDER_CONF DEFAULT public_endpoint $CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST
+                iniset $CINDER_CONF DEFAULT osapi_volume_base_URL $CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST
+            else
+                iniset $CINDER_CONF DEFAULT osapi_volume_listen_port $CINDER_SERVICE_PORT_INT
+                iniset $CINDER_CONF DEFAULT public_endpoint $CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT
+                iniset $CINDER_CONF DEFAULT osapi_volume_base_URL $CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT
+            fi
+        fi
     fi
 
     if [ "$SYSLOG" != "False" ]; then
@@ -333,9 +315,7 @@ function configure_cinder {
     # Format logging
     setup_logging $CINDER_CONF $CINDER_USE_MOD_WSGI
 
-    if [ "$CINDER_USE_MOD_WSGI" == "True" ]; then
-        _cinder_config_apache_wsgi
-    fi
+    write_uwsgi_config "$CINDER_UWSGI_CONF" "$CINDER_UWSGI" "/volume"
 
     if [[ -r $CINDER_PLUGINS/$CINDER_DRIVER ]]; then
         configure_cinder_driver
@@ -374,29 +354,47 @@ function configure_cinder {
 
 # Migrated from keystone_data.sh
 function create_cinder_accounts {
-
     # Cinder
     if [[ "$ENABLED_SERVICES" =~ "c-api" ]]; then
 
         create_service_user "cinder"
 
         get_or_create_service "cinder" "volume" "Cinder Volume Service"
-        get_or_create_endpoint \
-            "volume" \
-            "$REGION_NAME" \
-            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/\$(project_id)s"
-
-        get_or_create_service "cinderv2" "volumev2" "Cinder Volume Service V2"
-        get_or_create_endpoint \
-            "volumev2" \
-            "$REGION_NAME" \
-            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v2/\$(project_id)s"
-
-        get_or_create_service "cinderv3" "volumev3" "Cinder Volume Service V3"
-        get_or_create_endpoint \
-            "volumev3" \
-            "$REGION_NAME" \
-            "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v3/\$(project_id)s"
+        if [ "$CINDER_USE_MOD_WSGI" == "False" ]; then
+            get_or_create_endpoint \
+                "volume" \
+                "$REGION_NAME" \
+                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/\$(project_id)s"
+
+            get_or_create_service "cinderv2" "volumev2" "Cinder Volume Service V2"
+            get_or_create_endpoint \
+                "volumev2" \
+                "$REGION_NAME" \
+                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v2/\$(project_id)s"
+
+            get_or_create_service "cinderv3" "volumev3" "Cinder Volume Service V3"
+            get_or_create_endpoint \
+                "volumev3" \
+                "$REGION_NAME" \
+                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v3/\$(project_id)s"
+        else
+            get_or_create_endpoint \
+                "volume" \
+                "$REGION_NAME" \
+                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST/volume/v1/\$(project_id)s"
+
+            get_or_create_service "cinderv2" "volumev2" "Cinder Volume Service V2"
+            get_or_create_endpoint \
+                "volumev2" \
+                "$REGION_NAME" \
+                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST/volume/v2/\$(project_id)s"
+
+            get_or_create_service "cinderv3" "volumev3" "Cinder Volume Service V3"
+            get_or_create_endpoint \
+                "volumev3" \
+                "$REGION_NAME" \
+                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST/volume/v3/\$(project_id)s"
+        fi
 
         configure_cinder_internal_tenant
     fi
@@ -449,10 +447,6 @@ function install_cinder {
     elif [[ "$CINDER_ISCI_HELPER" == "lioadm" ]]; then
         install_package targetcli
     fi
-
-    if [ "$CINDER_USE_MOD_WSGI" == "True" ]; then
-        install_apache_wsgi
-    fi
 }
 
 # install_cinderclient() - Collect source and prepare
@@ -483,7 +477,8 @@ function _configure_tgt_for_config_d {
 function start_cinder {
     local service_port=$CINDER_SERVICE_PORT
     local service_protocol=$CINDER_SERVICE_PROTOCOL
-    if is_service_enabled tls-proxy; then
+    local cinder_url
+    if is_service_enabled tls-proxy && ["$CINDER_USE_MOD_WSGI" == "False"]; then
         service_port=$CINDER_SERVICE_PORT_INT
         service_protocol="http"
     fi
@@ -507,24 +502,23 @@ function start_cinder {
         fi
     fi
 
-    if is_service_enabled c-api ; then
-        if [ "$CINDER_USE_MOD_WSGI" == "True" ]; then
-            enable_apache_site osapi-volume
-            restart_apache_server
-            tail_log c-api /var/log/$APACHE_NAME/c-api.log
-        else
+    if [[ "$ENABLED_SERVICES" =~ "c-api" ]]; then
+        if [ "$CINDER_USE_MOD_WSGI" == "False" ]; then
             run_process c-api "$CINDER_BIN_DIR/cinder-api --config-file $CINDER_CONF"
+            cinder_url=$service_protocol://$SERVICE_HOST:$service_port
+            # Start proxy if tsl enabled
+            if is_service_enabled tls_proxy; then
+                start_tls_proxy cinder '*' $CINDER_SERVICE_PORT $CINDER_SERVICE_HOST $CINDER_SERVICE_POR_INT
+            fi
+        else
+            run_process "c-api" "$CINDER_BIN_DIR/uwsgi --ini $CINDER_UWSGI_CONF"
+            cinder_url=$service_protocol://$SERVICE_HOST/volume/v3
         fi
+    fi
 
-        echo "Waiting for Cinder API to start..."
-        if ! wait_for_service $SERVICE_TIMEOUT $service_protocol://$CINDER_SERVICE_HOST:$service_port; then
-            die $LINENO "c-api did not start"
-        fi
-
-        # Start proxies if enabled
-        if is_service_enabled tls-proxy; then
-            start_tls_proxy cinder '*' $CINDER_SERVICE_PORT $CINDER_SERVICE_HOST $CINDER_SERVICE_PORT_INT
-        fi
+    echo "Waiting for Cinder API to start..."
+    if ! wait_for_service $SERVICE_TIMEOUT $cinder_url; then
+        die $LINENO "c-api did not start"
     fi
 
     run_process c-sch "$CINDER_BIN_DIR/cinder-scheduler --config-file $CINDER_CONF"
@@ -538,12 +532,7 @@ function start_cinder {
 
 # stop_cinder() - Stop running processes
 function stop_cinder {
-    if [ "$CINDER_USE_MOD_WSGI" == "True" ]; then
-        disable_apache_site osapi-volume
-        restart_apache_server
-    else
-        stop_process c-api
-    fi
+    stop_process c-api
 
     # Kill the cinder screen windows
     local serv

From 3415521d5659b2268b8984bf89ede8e34f1b76f7 Mon Sep 17 00:00:00 2001
From: Manjeet Singh Bhatia <manjeetingh1156@gmail.com>
Date: Fri, 30 Jun 2017 01:46:12 +0000
Subject: [PATCH 1034/2409] Don't dump commit message header to
 devstack-version

Dumping commit message to /usr/local/bin/devstack-version
has broken devstack build, because of bash error in formatting.
error log [1].

[1]. http://logs.openstack.org/20/418720/6/check/gate-tempest-dsvm-networking-odl-boron-snapshot-v2driver/ed9fd45/logs/devstacklog.txt.gz

Change-Id: I4c269a7f3d63ee9a976e7c3636fc3e5e8dab9ae3
---
 functions | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions b/functions
index 738040d7bc..f04bc1fcbb 100644
--- a/functions
+++ b/functions
@@ -754,7 +754,7 @@ function get_random_port {
 function write_devstack_version {
     pushd $TOP_DIR
     local git_version=""
-    git_version=$(git log --format="%H %s %ci" -1)
+    git_version=$(git log --format="%H %ci" -1)
     cat - > /tmp/devstack-version <<EOF
 #!/bin/bash
 

From 1560efe9c93b17438ab37d94443832dde3842637 Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Fri, 30 Jun 2017 12:15:26 -0400
Subject: [PATCH 1035/2409] Switch local http uwsgi conf to http-socket mode

Previously the local uwsgi server mode was using uwsgi in http mode.
This was unessecary and actually not recommend by the uwsgi docs [1][2]
This is because http mode starts a frontend http process that forwards
requests to the workers running the python code. This is done for the
largely the same reasons we're using apache as a proxy and is
unnecessary. http-socket mode doesn't do this and just exposes the
workers as an http interface to the proxy. (in our case apache)

[1] http://uwsgi-docs.readthedocs.io/en/latest/HTTP.html#http-sockets
[2] http://uwsgi-docs.readthedocs.io/en/latest/ThingsToKnow.html

Change-Id: I5671687c8083fa4bdee066c07b083a0f00be532b
---
 lib/apache | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/apache b/lib/apache
index cf438a0794..445241e707 100644
--- a/lib/apache
+++ b/lib/apache
@@ -301,7 +301,7 @@ function write_local_uwsgi_http_config {
     rm -rf $file
     iniset "$file" uwsgi wsgi-file "$wsgi"
     port=$(get_random_port)
-    iniset "$file" uwsgi http "127.0.0.1:$port"
+    iniset "$file" uwsgi http-socket "127.0.0.1:$port"
     iniset "$file" uwsgi processes $API_WORKERS
     # This is running standalone
     iniset "$file" uwsgi master true

From b79531a9f96736225a8991052a0be5767c217377 Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Fri, 30 Jun 2017 12:10:06 -0400
Subject: [PATCH 1036/2409] Increase the socket timeout on uwsgi local mode

This commit increases the socket timeout value from 4 secs to a much
higher 30 secs. This is just for sanity, the load is high when we're
seeing the wsgi.input timeouts, so uwsgi might be just closing the
socket waiting for data over the wire. 30 seconds is overly conservative
just so we can rule this out. This will likely be shrunk to a more
reasonable value in the future.

Change-Id: Iae85d3a084fb33b2a63550d6e353413e98c0b39c
Partial-Bug: #1701088
---
 lib/apache | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/apache b/lib/apache
index 445241e707..e29acf29b3 100644
--- a/lib/apache
+++ b/lib/apache
@@ -323,6 +323,8 @@ function write_local_uwsgi_http_config {
     iniset "$file" uwsgi http-chunked-input true
     iniset "$file" uwsgi http-auto-chunked true
     iniset "$file" uwsgi http-keepalive false
+    # Increase socket timeout for slow chunked uploads
+    iniset "$file" uwsgi socket-timeout 30
 
     enable_apache_mod proxy
     enable_apache_mod proxy_http

From 07cbc4494255efa2c394b4b60e5beaa3d10f244e Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 30 Jun 2017 12:29:19 +1000
Subject: [PATCH 1037/2409] Put devstack-version info into separate file

As a follow on to I4c269a7f3d63ee9a976e7c3636fc3e5e8dab9ae3; the
quoting gets tricky when putting arbitrary command-substitution
strings into saved echo-able strings.  As they say, "the only winning
move is not to play" :)

An alternative proposal is to not write this into a script but just
dump info into a file.  To my mind, this has several advantages --
avoid getting involved in quoting, not dropping a script into the
global environment -- it's just as easy to "cat" -- and the plain-text
file can be collected as an artifact during log collection (also moved
git commit line to separate line for easier parsing during log search,
etc).

Change-Id: Ic7391dd087657c0daf74046e4a052c53f4eb6e1a
---
 functions | 17 +++++++----------
 stack.sh  |  6 +++---
 2 files changed, 10 insertions(+), 13 deletions(-)

diff --git a/functions b/functions
index f04bc1fcbb..6f2164a777 100644
--- a/functions
+++ b/functions
@@ -750,19 +750,16 @@ function get_random_port {
     echo $port
 }
 
-
+# Save some state information
+#
+# Write out various useful state information to /etc/devstack-version
 function write_devstack_version {
-    pushd $TOP_DIR
-    local git_version=""
-    git_version=$(git log --format="%H %ci" -1)
     cat - > /tmp/devstack-version <<EOF
-#!/bin/bash
-
-echo "DevStack Version: ${DEVSTACK_SERIES} - ${git_version}"
-echo "OS Version: ${os_VENDOR} ${os_RELEASE} ${os_CODENAME}"
-
+DevStack Version: ${DEVSTACK_SERIES}
+Change: $(git log --format="%H %s %ci" -1)
+OS Version: ${os_VENDOR} ${os_RELEASE} ${os_CODENAME}
 EOF
-    sudo install -m 755 /tmp/devstack-version /usr/local/bin/devstack-version
+    sudo install -m 644 /tmp/devstack-version /etc/devstack-version
     rm /tmp/devstack-version
 }
 
diff --git a/stack.sh b/stack.sh
index fd1865129f..c453b917e2 100755
--- a/stack.sh
+++ b/stack.sh
@@ -216,7 +216,7 @@ if [[ ! -r $TOP_DIR/stackrc ]]; then
 fi
 source $TOP_DIR/stackrc
 
-# this installs a devstack-version script to make it easy to report the version back
+# write /etc/devstack-version
 write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
@@ -1538,8 +1538,8 @@ if [[ "$USE_SYSTEMD" == "True" ]]; then
     echo
 fi
 
-# devstack version
-devstack-version
+# Useful info on current state
+cat /etc/devstack-version
 echo
 
 # Indicate how long this took to run (bash maintained variable ``SECONDS``)

From 17cdecc689b20bfa3dc06ea23edacccf9e37497d Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Wed, 5 Jul 2017 20:25:02 -0400
Subject: [PATCH 1038/2409] Enable tempest testing for extending an attached
 volume

In Pike, Cinder and Nova will support extending the size of
an attached volume, but it's not supported by all volume and
compute backends. Tempest will also test it but uses a config
option that we need to set based on how devstack is configured.

Depends-On: Ibace6c2f91be9753a44e5f79fd013df11654851b

Related to cinder blueprint extend-attached-volume
Related to nova blueprint nova-support-attached-volume-extend

Change-Id: I52cc2952a2938ce44c442aa3e3b69a905b2b55d5
---
 lib/tempest | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index cc65ec7aa9..537da614d1 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -430,6 +430,12 @@ function configure_tempest {
         TEMPEST_VOLUME_MANAGE_VOLUME=${TEMPEST_VOLUME_MANAGE_VOLUME:-True}
     fi
     iniset $TEMPEST_CONFIG volume-feature-enabled manage_volume $(trueorfalse False TEMPEST_VOLUME_MANAGE_VOLUME)
+    # Only turn on TEMPEST_EXTEND_ATTACHED_VOLUME by default for "lvm" backends
+    # in Cinder and the libvirt driver in Nova.
+    if [[ "$CINDER_ENABLED_BACKENDS" == *"lvm"* ]] && [ "$VIRT_DRIVER" = "libvirt" ]; then
+        TEMPEST_EXTEND_ATTACHED_VOLUME=${TEMPEST_EXTEND_ATTACHED_VOLUME:-True}
+    fi
+    iniset $TEMPEST_CONFIG volume-feature-enabled extend_attached_volume $(trueorfalse False TEMPEST_EXTEND_ATTACHED_VOLUME)
     # TODO(ameade): Remove the api_v3 flag when Mitaka and Liberty are end of life.
     iniset $TEMPEST_CONFIG volume-feature-enabled api_v3 True
     iniset $TEMPEST_CONFIG volume-feature-enabled api_v1 $(trueorfalse False TEMPEST_VOLUME_API_V1)

From f3d533157267a1568eeb36a349aee637195e9c8a Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Thu, 8 Jun 2017 08:22:38 -0400
Subject: [PATCH 1039/2409] Fleetify nova conductor for N cells

This makes us start two levels of nova-conductor processes, and one per cell.

Note that this also sets the notification transport_url to the top-level mq
so that we continue to get a unified stream of notifications.

Related-Bug: #1700496
Change-Id: I08d7da843d18b426dda8a8a231039d950a4c0ce5
Depends-On: I64b600b30f6e54db0ec9083c6c176e895c6d0cc2
Depends-On: If59453f1899e99040c554bcb9ad54c8a506adc56
---
 lib/nova | 111 +++++++++++++++++++++++++++++++++++++++++++++++++------
 stack.sh |   4 +-
 2 files changed, 102 insertions(+), 13 deletions(-)

diff --git a/lib/nova b/lib/nova
index 3fa5de67eb..11c746911b 100644
--- a/lib/nova
+++ b/lib/nova
@@ -51,6 +51,7 @@ NOVA_AUTH_CACHE_DIR=${NOVA_AUTH_CACHE_DIR:-/var/cache/nova}
 NOVA_CONF_DIR=/etc/nova
 NOVA_CONF=$NOVA_CONF_DIR/nova.conf
 NOVA_CELLS_CONF=$NOVA_CONF_DIR/nova-cells.conf
+NOVA_CPU_CONF=$NOVA_CONF_DIR/nova-cpu.conf
 NOVA_FAKE_CONF=$NOVA_CONF_DIR/nova-fake.conf
 NOVA_CELLS_DB=${NOVA_CELLS_DB:-nova_cell}
 NOVA_API_DB=${NOVA_API_DB:-nova_api}
@@ -59,6 +60,13 @@ NOVA_METADATA_UWSGI=$NOVA_BIN_DIR/nova-metadata-wsgi
 NOVA_UWSGI_CONF=$NOVA_CONF_DIR/nova-api-uwsgi.ini
 NOVA_METADATA_UWSGI_CONF=$NOVA_CONF_DIR/nova-metadata-uwsgi.ini
 
+# The total number of cells we expect. Must be greater than one and doesn't
+# count cell0.
+NOVA_NUM_CELLS=${NOVA_NUM_CELLS:-1}
+# Our cell index, so we know what rabbit vhost to connect to.
+# This should be in the range of 1-$NOVA_NUM_CELLS
+NOVA_CPU_CELL=${NOVA_CPU_CELL:-1}
+
 NOVA_API_PASTE_INI=${NOVA_API_PASTE_INI:-$NOVA_CONF_DIR/api-paste.ini}
 
 # Toggle for deploying Nova-API under a wsgi server. We default to
@@ -424,7 +432,7 @@ function create_nova_conf {
     # require them running on the host. The ensures that n-cpu doesn't
     # leak a need to use the db in a multinode scenario.
     if is_service_enabled n-api n-cond n-sched; then
-        iniset $NOVA_CONF database connection `database_connection_url nova`
+        iniset $NOVA_CONF database connection `database_connection_url nova_cell0`
         iniset $NOVA_CONF api_database connection `database_connection_url nova_api`
     fi
 
@@ -518,6 +526,7 @@ function create_nova_conf {
     # Set the oslo messaging driver to the typical default. This does not
     # enable notifications, but it will allow them to function when enabled.
     iniset $NOVA_CONF oslo_messaging_notifications driver "messagingv2"
+    iniset $NOVA_CONF oslo_messaging_notifications transport_url $(get_transport_url)
     iniset_rpc_backend nova $NOVA_CONF
     iniset $NOVA_CONF glance api_servers "$GLANCE_URL"
 
@@ -558,6 +567,20 @@ function create_nova_conf {
     if [ "$NOVA_USE_SERVICE_TOKEN" == "True" ]; then
         init_nova_service_user_conf
     fi
+
+    if is_service_enabled n-cond; then
+        for i in $(seq 1 $NOVA_NUM_CELLS); do
+            local conf
+            local vhost
+            conf=$(conductor_conf $i)
+            vhost="nova_cell${i}"
+            iniset $conf database connection `database_connection_url nova_cell${i}`
+            iniset $conf conductor workers "$API_WORKERS"
+            iniset $conf DEFAULT debug "$ENABLE_DEBUG_LOG_LEVEL"
+            rpc_backend_add_vhost $vhost
+            iniset_rpc_backend nova $conf DEFAULT $vhost
+        done
+    fi
 }
 
 function init_nova_service_user_conf {
@@ -572,6 +595,11 @@ function init_nova_service_user_conf {
     iniset $NOVA_CONF service_user auth_strategy keystone
 }
 
+function conductor_conf {
+    local cell="$1"
+    echo "${NOVA_CONF_DIR}/nova_cell${cell}.conf"
+}
+
 function init_nova_cells {
     if is_service_enabled n-cell; then
         cp $NOVA_CONF $NOVA_CELLS_CONF
@@ -638,8 +666,6 @@ function init_nova {
         recreate_database $NOVA_API_DB
         $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF api_db sync
 
-        # (Re)create nova databases
-        recreate_database nova
         recreate_database nova_cell0
 
         # map_cell0 will create the cell mapping record in the nova_api DB so
@@ -651,6 +677,12 @@ function init_nova {
         # Migrate nova and nova_cell0 databases.
         $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF db sync
 
+        # (Re)create nova databases
+        for i in $(seq 1 $NOVA_NUM_CELLS); do
+            recreate_database nova_cell${i}
+            $NOVA_BIN_DIR/nova-manage --config-file $(conductor_conf $i) db sync
+        done
+
         if is_service_enabled n-cell; then
             recreate_database $NOVA_CELLS_DB
         fi
@@ -660,8 +692,9 @@ function init_nova {
         $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF db online_data_migrations
 
         # create the cell1 cell for the main nova db where the hosts live
-        nova-manage cell_v2 create_cell --transport-url $(get_transport_url) \
-            --name 'cell1'
+        for i in $(seq 1 $NOVA_NUM_CELLS); do
+            nova-manage --config-file $NOVA_CONF --config-file $(conductor_conf $i) cell_v2 create_cell --name "cell$i"
+        done
     fi
 
     create_nova_cache_dir
@@ -760,25 +793,40 @@ function start_nova_api {
 
 # start_nova_compute() - Start the compute process
 function start_nova_compute {
+    local nomulticellflag="$1"
     # Hack to set the path for rootwrap
     local old_path=$PATH
     export PATH=$NOVA_BIN_DIR:$PATH
 
     if is_service_enabled n-cell; then
         local compute_cell_conf=$NOVA_CELLS_CONF
+        # NOTE(danms): Don't setup conductor fleet for cellsv1
+        nomulticellflag='nomulticell'
     else
         local compute_cell_conf=$NOVA_CONF
     fi
 
+    if [ "$nomulticellflag" = 'nomulticell' ]; then
+        # NOTE(danms): Grenade doesn't setup multi-cell rabbit, so
+        # skip these bits and use the normal config.
+        NOVA_CPU_CONF=$compute_cell_conf
+        echo "Skipping multi-cell conductor fleet setup"
+    else
+        cp $compute_cell_conf $NOVA_CPU_CONF
+        # FIXME(danms): Should this be configurable?
+        iniset $NOVA_CPU_CONF workarounds disable_group_policy_check_upcall True
+        iniset_rpc_backend nova $NOVA_CPU_CONF DEFAULT "nova_cell${NOVA_CPU_CELL}"
+    fi
+
     if [[ "$VIRT_DRIVER" = 'libvirt' ]]; then
         # The group **$LIBVIRT_GROUP** is added to the current user in this script.
         # ``sg`` is used in run_process to execute nova-compute as a member of the
         # **$LIBVIRT_GROUP** group.
-        run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $compute_cell_conf" $LIBVIRT_GROUP
+        run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $NOVA_CPU_CONF" $LIBVIRT_GROUP
     elif [[ "$VIRT_DRIVER" = 'lxd' ]]; then
-        run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $compute_cell_conf" $LXD_GROUP
+        run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $NOVA_CPU_CONF" $LXD_GROUP
     elif [[ "$VIRT_DRIVER" = 'docker' || "$VIRT_DRIVER" = 'zun' ]]; then
-        run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $compute_cell_conf" $DOCKER_GROUP
+        run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $NOVA_CPU_CONF" $DOCKER_GROUP
     elif [[ "$VIRT_DRIVER" = 'fake' ]]; then
         local i
         for i in `seq 1 $NUMBER_FAKE_NOVA_COMPUTE`; do
@@ -787,13 +835,13 @@ function start_nova_compute {
             # gets its own configuration and own log file.
             local fake_conf="${NOVA_FAKE_CONF}-${i}"
             iniset $fake_conf DEFAULT nhost "${HOSTNAME}${i}"
-            run_process "n-cpu-${i}" "$NOVA_BIN_DIR/nova-compute --config-file $compute_cell_conf --config-file $fake_conf"
+            run_process "n-cpu-${i}" "$NOVA_BIN_DIR/nova-compute --config-file $NOVA_CPU_CONF --config-file $fake_conf"
         done
     else
         if is_service_enabled n-cpu && [[ -r $NOVA_PLUGINS/hypervisor-$VIRT_DRIVER ]]; then
             start_nova_hypervisor
         fi
-        run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $compute_cell_conf"
+        run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $NOVA_CPU_CONF"
     fi
 
     export PATH=$old_path
@@ -813,7 +861,6 @@ function start_nova_rest {
     fi
 
     # ``run_process`` checks ``is_service_enabled``, it is not needed here
-    run_process n-cond "$NOVA_BIN_DIR/nova-conductor --config-file $compute_cell_conf"
     run_process n-cell-region "$NOVA_BIN_DIR/nova-cells --config-file $api_cell_conf"
     run_process n-cell-child "$NOVA_BIN_DIR/nova-cells --config-file $compute_cell_conf"
 
@@ -840,8 +887,38 @@ function start_nova_rest {
     export PATH=$old_path
 }
 
+function enable_nova_fleet {
+    if is_service_enabled n-cond; then
+        enable_service n-super-cond
+        for i in $(seq 1 $NOVA_NUM_CELLS); do
+            enable_service n-cond-cell${i}
+        done
+    fi
+}
+
+function start_nova_conductor {
+    if is_service_enabled n-cell; then
+        echo "Starting nova-conductor in a cellsv1-compatible way"
+        run_process n-cond "$NOVA_BIN_DIR/nova-conductor --config-file $NOVA_CELLS_CONF"
+        return
+    fi
+
+    enable_nova_fleet
+    if is_service_enabled n-super-cond; then
+        run_process n-super-cond "$NOVA_BIN_DIR/nova-conductor --config-file $NOVA_CONF"
+    fi
+    for i in $(seq 1 $NOVA_NUM_CELLS); do
+        if is_service_enabled n-cond-cell${i}; then
+            local conf
+            conf=$(conductor_conf $i)
+            run_process n-cond-cell${i} "$NOVA_BIN_DIR/nova-conductor --config-file $conf"
+        fi
+    done
+}
+
 function start_nova {
     start_nova_rest
+    start_nova_conductor
     start_nova_compute
 }
 
@@ -861,14 +938,24 @@ function stop_nova_compute {
 
 function stop_nova_rest {
     # Kill the non-compute nova processes
-    for serv in n-api n-api-meta n-net n-sch n-novnc n-xvnc n-cauth n-spice n-cond n-cell n-cell n-sproxy; do
+    for serv in n-api n-api-meta n-net n-sch n-novnc n-xvnc n-cauth n-spice n-cell n-cell n-sproxy; do
         stop_process $serv
     done
 }
 
+function stop_nova_conductor {
+    enable_nova_fleet
+    for srv in n-super-cond $(seq -f n-cond-cell%0.f 1 $NOVA_NUM_CELLS); do
+        if is_service_enabled $srv; then
+            stop_process $srv
+        fi
+    done
+}
+
 # stop_nova() - Stop running processes (non-screen)
 function stop_nova {
     stop_nova_rest
+    stop_nova_conductor
     stop_nova_compute
 }
 
diff --git a/stack.sh b/stack.sh
index fd1865129f..8a19438eba 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1304,7 +1304,9 @@ fi
 # Unable to use LUKS passphrase that is exactly 16 bytes long
 # https://bugzilla.redhat.com/show_bug.cgi?id=1447297
 if is_service_enabled nova; then
-    iniset $NOVA_CONF key_manager fixed_key $(generate_hex_string 36)
+    key=$(generate_hex_string 36)
+    iniset $NOVA_CONF key_manager fixed_key "$key"
+    iniset $NOVA_CPU_CONF key_manager fixed_key "$key"
 fi
 
 # Launch the nova-api and wait for it to answer before continuing

From cc36397134716116d802ba82b9ea9a0bc4830a42 Mon Sep 17 00:00:00 2001
From: Leticia Wanderley <leticiafwanderley@gmail.com>
Date: Mon, 26 Jun 2017 23:52:52 -0300
Subject: [PATCH 1040/2409] Fixes devstack ldap plugin

When the ldap service is enable on local.conf devstack ldap
plugin starts slapd service using its default config on Ubuntu
and installs ldap-utils package.
Enables domain specific drivers on Keystone and creates LDAP
domain 'Users' with a demo user.

Change-Id: I8d7aa260b01f675e4ed201ef93bfd66474f4b228
---
 files/ldap/user.ldif.in | 23 +++++++++++++
 lib/horizon             |  4 +++
 lib/keystone            | 72 +++++++++++++++++++++++++++++++++++------
 lib/ldap                | 24 ++++++++++++--
 4 files changed, 112 insertions(+), 11 deletions(-)
 create mode 100644 files/ldap/user.ldif.in

diff --git a/files/ldap/user.ldif.in b/files/ldap/user.ldif.in
new file mode 100644
index 0000000000..16a980757d
--- /dev/null
+++ b/files/ldap/user.ldif.in
@@ -0,0 +1,23 @@
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied. See the License for the specific language governing
+# permissions and limitations under the License.
+
+# Demo LDAP user
+dn: cn=demo,ou=Users,${BASE_DN}
+cn: demo
+displayName: demo
+givenName: demo
+mail: demo@openstack.org
+objectClass: inetOrgPerson
+objectClass: top
+sn: demo
+uid: demo
+userPassword: demo
diff --git a/lib/horizon b/lib/horizon
index 9c7ec005a2..becc5a0e67 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -106,6 +106,10 @@ function configure_horizon {
         _horizon_config_set $local_settings "" OPENSTACK_SSL_CACERT \"${SSL_BUNDLE_FILE}\"
     fi
 
+    if is_service_enabled ldap; then
+        _horizon_config_set $local_settings "" OPENSTACK_KEYSTONE_MULTIDOMAIN_SUPPORT "True"
+    fi
+
     # Create an empty directory that apache uses as docroot
     sudo mkdir -p $HORIZON_DIR/.blackhole
 
diff --git a/lib/keystone b/lib/keystone
index eb46526264..1061081a5e 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -219,17 +219,10 @@ function configure_keystone {
     fi
 
     # Rewrite stock ``keystone.conf``
-
     if is_service_enabled ldap; then
-        #Set all needed ldap values
-        iniset $KEYSTONE_CONF ldap password $LDAP_PASSWORD
-        iniset $KEYSTONE_CONF ldap user $LDAP_MANAGER_DN
-        iniset $KEYSTONE_CONF ldap suffix $LDAP_BASE_DN
-        iniset $KEYSTONE_CONF ldap user_tree_dn "ou=Users,$LDAP_BASE_DN"
-        iniset $KEYSTONE_CONF DEFAULT member_role_id "9fe2ff9ee4384b1894a90878d3e92bab"
-        iniset $KEYSTONE_CONF DEFAULT member_role_name "_member_"
+        iniset $KEYSTONE_CONF identity domain_config_dir "$KEYSTONE_CONF_DIR/domains"
+        iniset $KEYSTONE_CONF identity domain_specific_drivers_enabled "True"
     fi
-
     iniset $KEYSTONE_CONF identity driver "$KEYSTONE_IDENTITY_BACKEND"
     iniset $KEYSTONE_CONF identity password_hash_rounds $KEYSTONE_PASSWORD_HASH_ROUNDS
     iniset $KEYSTONE_CONF assignment driver "$KEYSTONE_ASSIGNMENT_BACKEND"
@@ -410,6 +403,10 @@ function create_keystone_accounts {
     get_or_add_group_project_role $member_role $non_admin_group $alt_demo_project
     get_or_add_group_project_role $another_role $non_admin_group $alt_demo_project
     get_or_add_group_project_role $admin_role $admin_group $admin_project
+
+    if is_service_enabled ldap; then
+        create_ldap_domain
+    fi
 }
 
 # Create a user that is capable of verifying keystone tokens for use with auth_token middleware.
@@ -615,6 +612,63 @@ function bootstrap_keystone {
         --bootstrap-public-url "$KEYSTONE_SERVICE_URI"
 }
 
+# create_ldap_domain() - Create domain file and initialize domain with a user
+function create_ldap_domain {
+    # Creates domain Users
+    openstack --os-identity-api-version=3 domain create --description "LDAP domain" Users
+
+    # Create domain file inside etc/keystone/domains
+    KEYSTONE_LDAP_DOMAIN_FILE=$KEYSTONE_CONF_DIR/domains/keystone.Users.conf
+    mkdir -p "$KEYSTONE_CONF_DIR/domains"
+    touch "$KEYSTONE_LDAP_DOMAIN_FILE"
+
+    # Set identity driver 'ldap'
+    iniset $KEYSTONE_LDAP_DOMAIN_FILE identity driver "ldap"
+
+    # LDAP settings for Users domain
+    iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap group_allow_delete "False"
+    iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap group_allow_update "False"
+    iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap group_allow_create "False"
+    iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap user_allow_delete "False"
+    iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap user_allow_update "False"
+    iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap user_allow_create "False"
+    iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap user_tree_dn "ou=Users,$LDAP_BASE_DN"
+    iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap user_objectclass "inetOrgPerson"
+    iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap user_name_attribute "cn"
+    iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap user_mail_attribute "mail"
+    iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap user_id_attribute "uid"
+    iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap user "cn=Manager,dc=openstack,dc=org"
+    iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap url "ldap://localhost"
+    iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap suffix $LDAP_BASE_DN
+    iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap password $LDAP_PASSWORD
+    iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap group_tree_dn "ou=Groups,$LDAP_BASE_DN"
+    iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap group_objectclass "groupOfNames"
+    iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap group_name_attribute "cn"
+    iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap group_id_attribute "cn"
+
+    # Restart apache and identity services to associate domain and conf file
+    sudo service apache2 reload
+    sudo systemctl restart devstack@keystone
+
+    # Create LDAP user.ldif and add user to LDAP backend
+    local tmp_ldap_dir
+    tmp_ldap_dir=$(mktemp -d -t ldap.$$.XXXXXXXXXX)
+
+    _ldap_varsubst $FILES/ldap/user.ldif.in $slappass >$tmp_ldap_dir/user.ldif
+    sudo ldapadd -x -w $LDAP_PASSWORD -D "$LDAP_MANAGER_DN" -H $LDAP_URL -c -f $tmp_ldap_dir/user.ldif
+    rm -rf $tmp_ldap_dir
+
+    local admin_project
+    admin_project=$(get_or_create_project "admin" default)
+    local ldap_user
+    ldap_user=$(openstack user show --domain=Users demo -f value -c id)
+    local admin_role="admin"
+    get_or_create_role $admin_role
+
+    # Grant demo LDAP user access to project and role
+    get_or_add_user_project_role $admin_role $ldap_user $admin_project
+}
+
 # Restore xtrace
 $_XTRACE_KEYSTONE
 
diff --git a/lib/ldap b/lib/ldap
index 4cea812d3c..5a53d0eaee 100644
--- a/lib/ldap
+++ b/lib/ldap
@@ -119,8 +119,7 @@ function install_ldap {
 
     printf "installing OpenLDAP"
     if is_ubuntu; then
-        # Ubuntu automatically starts LDAP so no need to call start_ldap()
-        :
+        configure_ldap
     elif is_fedora; then
         start_ldap
     elif is_suse; then
@@ -148,6 +147,27 @@ function install_ldap {
     rm -rf $tmp_ldap_dir
 }
 
+# configure_ldap() - Configure LDAP - reconfigure slapd
+function configure_ldap {
+    sudo debconf-set-selections <<EOF
+    slapd slapd/internal/generated_adminpw password $LDAP_PASSWORD
+    slapd slapd/internal/adminpw password $LDAP_PASSWORD
+    slapd slapd/password2 password $LDAP_PASSWORD
+    slapd slapd/password1 password $LDAP_PASSWORD
+    slapd slapd/dump_database_destdir string /var/backups/slapd-VERSION
+    slapd slapd/domain string Users
+    slapd shared/organization string $LDAP_DOMAIN
+    slapd slapd/backend string HDB
+    slapd slapd/purge_database boolean true
+    slapd slapd/move_old_database boolean true
+    slapd slapd/allow_ldap_v2 boolean false
+    slapd slapd/no_configuration boolean false
+    slapd slapd/dump_database select when needed
+EOF
+    sudo apt-get install -y slapd ldap-utils
+    sudo dpkg-reconfigure -f noninteractive $LDAP_SERVICE_NAME
+}
+
 # start_ldap() - Start LDAP
 function start_ldap {
     sudo service $LDAP_SERVICE_NAME restart

From 254116305c4a471ee857a9301e310bd2c406d937 Mon Sep 17 00:00:00 2001
From: Paul Belanger <pabelanger@redhat.com>
Date: Tue, 11 Jul 2017 11:25:19 -0400
Subject: [PATCH 1041/2409] Remove mysql.qcow2 from stackrc

We no longer host this on tarballs.o.o, additionally it is no longer
used my trove.

Change-Id: I2034e8ebc530704d6e63a231056f92e14a8654e4
Signed-off-by: Paul Belanger <pabelanger@redhat.com>
---
 stackrc | 17 -----------------
 1 file changed, 17 deletions(-)

diff --git a/stackrc b/stackrc
index c57e485343..4f16c3edf7 100644
--- a/stackrc
+++ b/stackrc
@@ -727,23 +727,6 @@ if [[ "$DOWNLOAD_DEFAULT_IMAGES" == "True" ]]; then
     DOWNLOAD_DEFAULT_IMAGES=False
 fi
 
-# Staging area for new images.  These images are cached by a run of
-# ./tools/image_list.sh during CI image build (see
-# project-config:nodepool/elements/cache-devstack/extra-data.d/55-cache-devstack-repos).
-#
-# To avoid CI failures grabbing the images, new images should be here
-# for at least 24hrs (nodepool builds images at 14:00UTC) so the they
-# are in the cache.
-PRECACHE_IMAGES=$(trueorfalse False PRECACHE_IMAGES)
-if [[ "$PRECACHE_IMAGES" == "True" ]]; then
-    # required for trove devstack tests; see
-    #  git.openstack.org/cgit/openstack/trove/tree/devstack/plugin.sh
-    IMAGE_URL="http://tarballs.openstack.org/trove/images/ubuntu/mysql.qcow2"
-    if ! [[ "$IMAGE_URLS"  =~ "$IMAGE_URL" ]]; then
-        IMAGE_URLS+=",$IMAGE_URL"
-    fi
-fi
-
 # Detect duplicate values in IMAGE_URLS
 for image_url in ${IMAGE_URLS//,/ }; do
     if [ $(echo "$IMAGE_URLS" | grep -o -F "$image_url" | wc -l) -gt 1 ]; then

From 2f7df51cfa422ae79942953ca63d6b3a4aa37dd3 Mon Sep 17 00:00:00 2001
From: Jeremy Liu <liujiong@gohighsec.com>
Date: Wed, 12 Jul 2017 10:09:48 +0800
Subject: [PATCH 1042/2409] Correct 'uswgi' to 'uwsgi'

Change-Id: I22026e5640a626f45b7508b60f492dbdb30631af
---
 lib/apache | 2 +-
 lib/glance | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/apache b/lib/apache
index e29acf29b3..ffd7966de1 100644
--- a/lib/apache
+++ b/lib/apache
@@ -287,7 +287,7 @@ function write_uwsgi_config {
 # mod_proxy_uwsgi because the chunked encoding gets dropped. See:
 # https://github.com/unbit/uwsgi/issues/1540 You can workaround this on python2
 # but that involves having apache buffer the request before sending it to
-# uswgi.
+# uwsgi.
 function write_local_uwsgi_http_config {
     local file=$1
     local wsgi=$2
diff --git a/lib/glance b/lib/glance
index 41145f980d..0a5b9f59b6 100644
--- a/lib/glance
+++ b/lib/glance
@@ -72,7 +72,7 @@ GLANCE_SERVICE_PROTOCOL=${GLANCE_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 GLANCE_REGISTRY_PORT=${GLANCE_REGISTRY_PORT:-9191}
 GLANCE_REGISTRY_PORT_INT=${GLANCE_REGISTRY_PORT_INT:-19191}
 GLANCE_UWSGI=$GLANCE_BIN_DIR/glance-wsgi-api
-GLANCE_UWSGI_CONF=$GLANCE_CONF_DIR/glance-uswgi.ini
+GLANCE_UWSGI_CONF=$GLANCE_CONF_DIR/glance-uwsgi.ini
 # If wsgi mode is uwsgi run glance under uwsgi, else default to eventlet
 # TODO(mtreinish): Remove the eventlet path here and in all the similar
 # conditionals below after the Pike release

From 8175df1912a5722c2e308dc27623063ac542f496 Mon Sep 17 00:00:00 2001
From: Bogdan Katynski <bogdan.katynski@workday.com>
Date: Wed, 28 Jun 2017 12:34:52 +0100
Subject: [PATCH 1043/2409] Remove VGs when cleaning LVM up in devstack

This patch adds removing of the volume group
before removing the loopback device and
the backing file when performing LVM cleanup
in unstack.sh

Without this commit:

unstack.sh removes logical volumes, removes the
loopback devices and deletes the backing file
but leaves a dangling volume group

  $ ./stack.sh && ./unstack.sh
  $ sudo vgs
  VG                    #PV #LV #SN Attr   VSize  VFree
  stack-volumes-default   1   0   0 wz--n- 10.01g 10.01g
  $ sudo losetup -a
  $ sudo vgremove stack-volumes-default
  /dev/loop0: lseek 4096 failed: Invalid argument
  vg_remove_mdas stack-volumes-default failed

With this commit:

unstack.sh removes volume groups after removing
all logical volumes but before removing
the loopback device and deleting the backing file

Partial-Bug: 1441236
Change-Id: Id9c06fa50f6cad28764f5a3396f559cac9999649
---
 lib/lvm | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/lib/lvm b/lib/lvm
index 0cebd92f77..f0471816bf 100644
--- a/lib/lvm
+++ b/lib/lvm
@@ -35,7 +35,7 @@ BACKING_FILE_SUFFIX=-backing-file
 
 # _clean_lvm_volume_group removes all default LVM volumes
 #
-# Usage: clean_lvm_volume_group $vg
+# Usage: _clean_lvm_volume_group $vg
 function _clean_lvm_volume_group {
     local vg=$1
 
@@ -43,6 +43,16 @@ function _clean_lvm_volume_group {
     sudo lvremove -f $vg
 }
 
+# _remove_lvm_volume_group removes the volume group
+#
+# Usage: _remove_lvm_volume_group $vg
+function _remove_lvm_volume_group {
+    local vg=$1
+
+    # Remove the volume group
+    sudo vgremove -f $vg
+}
+
 # _clean_lvm_backing_file() removes the backing file of the
 # volume group
 #
@@ -69,6 +79,7 @@ function clean_lvm_volume_group {
     local vg=$1
 
     _clean_lvm_volume_group $vg
+    _remove_lvm_volume_group $vg
     # if there is no logical volume left, it's safe to attempt a cleanup
     # of the backing file
     if [[ -z "$(sudo lvs --noheadings -o lv_name $vg 2>/dev/null)" ]]; then

From 331b3de88e02d6cc480b386766f47b7a2d943125 Mon Sep 17 00:00:00 2001
From: Paul Belanger <pabelanger@redhat.com>
Date: Fri, 14 Jul 2017 13:11:19 -0400
Subject: [PATCH 1044/2409] Reduce tools/image_list.sh down to 4 images

Now that mysql.qcow2 has been removed, we only have 4 images to worry
about. This fixes cache-devstack element for openstack-infra.

Change-Id: Ia06f0e0679e253a1a6614f7c38abf1f5cd13991b
Signed-off-by: Paul Belanger <pabelanger@redhat.com>
---
 tools/image_list.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/image_list.sh b/tools/image_list.sh
index 27b3d4612d..29b93ed1d8 100755
--- a/tools/image_list.sh
+++ b/tools/image_list.sh
@@ -36,7 +36,7 @@ echo $ALL_IMAGES | tr ',' '\n' | sort | uniq
 
 # Sanity check - ensure we have a minimum number of images
 num=$(echo $ALL_IMAGES | tr ',' '\n' | sort | uniq | wc -l)
-if [[ "$num" -lt 5 ]]; then
+if [[ "$num" -lt 4 ]]; then
     echo "ERROR: We only found $num images in $ALL_IMAGES, which can't be right."
     exit 1
 fi

From a6467d36dbcb50c7501d5b237e32ed69ed1b4a44 Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Tue, 27 Jun 2017 08:31:26 +0200
Subject: [PATCH 1045/2409] Prepare guestfs-support for openSUSE

With libguestfs usage for file injection now being enabled by
default as part of I568c56dbcb62ec541661364c142eff2397e3eed7
the opensuse job started to fail due to lack of guestfs images
being available.

The error in question was
NovaException: libguestfs installed but not usable (cannot
find any suitable libguestfs supermin, fixed or old-style
appliance on LIBGUESTFS_PATH (search path: /usr/lib64/guestfs)

This part is being fixed by explicitly adding the missing package
dependencies to the compute node rpm package list while the maintenance
update for Leap 42.2 is in preparation.

Change-Id: Ie76ac0a51c1ee2ad6559917825dee1c7a91a3a76
---
 lib/nova_plugins/hypervisor-libvirt | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/lib/nova_plugins/hypervisor-libvirt b/lib/nova_plugins/hypervisor-libvirt
index f3c8add696..0c08a0fe42 100644
--- a/lib/nova_plugins/hypervisor-libvirt
+++ b/lib/nova_plugins/hypervisor-libvirt
@@ -115,7 +115,10 @@ function install_nova_hypervisor {
                     sudo dpkg-statoverride --add --update $STAT_OVERRIDE
                 fi
             done
-        elif is_fedora || is_suse; then
+        elif is_suse; then
+            # Workaround for missing dependencies in python-libguestfs
+            install_package python-libguestfs guestfs-data augeas augeas-lenses
+        elif is_fedora; then
             install_package python-libguestfs
         fi
     fi

From 04016a5dd117d1696221de1e32b9d2c389b795c8 Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Sat, 15 Jul 2017 12:16:58 +0200
Subject: [PATCH 1046/2409] List openSUSE 42.3 as a supported distro

openSUSE 42.3 is a relatively minor update over 42.2 and I'd
like to maintain it and keep it passing.

Experimental gates are being proposed, once those are passing
(which should be the case with this patch included), we could
enable it as a non-voting gate.

Change-Id: Ia421ada0ed3751c65a2a93a208e3f4a43edf8b16
---
 stack.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index c453b917e2..b786f7bd83 100755
--- a/stack.sh
+++ b/stack.sh
@@ -221,7 +221,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (xenial|yakkety|zesty|stretch|jessie|f24|f25|opensuse-42.2|rhel7|kvmibm1) ]]; then
+if [[ ! ${DISTRO} =~ (xenial|yakkety|zesty|stretch|jessie|f24|f25|opensuse-42.2|opensuse-42.3|rhel7|kvmibm1) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From ecbebd5d7b2f332d3e2432bb7f612d6191bc23b2 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Wed, 19 Jul 2017 14:01:22 -0400
Subject: [PATCH 1047/2409] Only setup nova-dhcpbridge if using nova-network

Closes-Bug: #1705324

Change-Id: I3abc84483bbd256e0bbbfe64d570903080f2a2b7
---
 lib/nova | 24 +++++++++++++-----------
 1 file changed, 13 insertions(+), 11 deletions(-)

diff --git a/lib/nova b/lib/nova
index 3fa5de67eb..d91ccbbea1 100644
--- a/lib/nova
+++ b/lib/nova
@@ -541,19 +541,21 @@ function create_nova_conf {
     # Setup logging for nova-dhcpbridge command line
     sudo cp "$NOVA_CONF" "$NOVA_CONF_DIR/nova-dhcpbridge.conf"
 
-    local service="n-dhcp"
-    local logfile="${service}.log.${CURRENT_LOG_TIME}"
-    local real_logfile="${LOGDIR}/${logfile}"
-    if [[ -n ${LOGDIR} ]]; then
-        bash -c "cd '$LOGDIR' && ln -sf '$logfile' ${service}.log"
-        iniset "$NOVA_CONF_DIR/nova-dhcpbridge.conf" DEFAULT log_file "$real_logfile"
-        if [[ -n ${SCREEN_LOGDIR} ]]; then
-            # Drop the backward-compat symlink
-            ln -sf "$real_logfile" ${SCREEN_LOGDIR}/screen-${service}.log
+    if is_service_enabled n-net; then
+        local service="n-dhcp"
+        local logfile="${service}.log.${CURRENT_LOG_TIME}"
+        local real_logfile="${LOGDIR}/${logfile}"
+        if [[ -n ${LOGDIR} ]]; then
+            bash -c "cd '$LOGDIR' && ln -sf '$logfile' ${service}.log"
+            iniset "$NOVA_CONF_DIR/nova-dhcpbridge.conf" DEFAULT log_file "$real_logfile"
+            if [[ -n ${SCREEN_LOGDIR} ]]; then
+                # Drop the backward-compat symlink
+                ln -sf "$real_logfile" ${SCREEN_LOGDIR}/screen-${service}.log
+            fi
         fi
-    fi
 
-    iniset $NOVA_CONF DEFAULT dhcpbridge_flagfile "$NOVA_CONF_DIR/nova-dhcpbridge.conf"
+        iniset $NOVA_CONF DEFAULT dhcpbridge_flagfile "$NOVA_CONF_DIR/nova-dhcpbridge.conf"
+    fi
 
     if [ "$NOVA_USE_SERVICE_TOKEN" == "True" ]; then
         init_nova_service_user_conf

From ab7035040319d8b145e1ad4ffcefa184ad6bd8a9 Mon Sep 17 00:00:00 2001
From: Tim Burke <tim.burke@gmail.com>
Date: Wed, 19 Jul 2017 09:55:26 -0700
Subject: [PATCH 1048/2409] When configuring temp urls, give Swift time to
 start up

Otherwise, we've seen intermittent "Unable to establish connection"
failures, with the main devstack log reporting things like

   2017-07-19 13:54:29.973 -> start proxy service
   2017-07-19 13:54:30.082 -> start OSC to store temp url key
   2017-07-19 13:54:31.908 -> OSC reports failure

Meanwhile, the s-proxy screen session tells us things like

   Jul 19 13:54:31.919988 -> start child worker
   Jul 19 13:54:32.206598 -> still loading the WSGI app

... and ports aren't actually bound until *after* the app is loaded.

Add a wait_for_service call to wait for the proxy to come up.

Change-Id: I1a722de31b144797230991700e110353a2d937dd
---
 lib/swift | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/lib/swift b/lib/swift
index fc09093925..455740ea82 100644
--- a/lib/swift
+++ b/lib/swift
@@ -846,6 +846,14 @@ function start_swift {
     fi
     run_process s-proxy "$SWIFT_BIN_DIR/swift-proxy-server ${SWIFT_CONF_DIR}/proxy-server.conf -v"
 
+    # We also started the storage services, but proxy started last and
+    # will take the longest to start, so by the time it comes up, we're
+    # probably fine.
+    echo "Waiting for swift proxy to start..."
+    if ! wait_for_service $SERVICE_TIMEOUT $SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$SWIFT_DEFAULT_BIND_PORT/info; then
+        die $LINENO "swift proxy did not start"
+    fi
+
     if [[ "$SWIFT_ENABLE_TEMPURLS" == "True" ]]; then
         swift_configure_tempurls
     fi

From fa0077707e15abfbecddbd22fe8594ffe3b4ecc4 Mon Sep 17 00:00:00 2001
From: Takashi NATSUME <natsume.takashi@lab.ntt.co.jp>
Date: Sat, 22 Jul 2017 08:59:43 +0900
Subject: [PATCH 1049/2409] Update URLs

Some URLs are broken, so fix them.
The others are redirect to new URLs,
so replace them with new ones.

The config options of nova serial console proxy
have been gathered in nova/conf/serial_console.py.
So the description in doc/source/guides/nova.rst
is fixed.

Change-Id: Ifd81cc09969341fbf8f135a913fc6003b94e0acc
---
 README.rst                 |  4 ++--
 doc/source/guides/nova.rst | 10 ++++------
 inc/python                 |  8 ++++----
 samples/local.conf         |  2 +-
 setup.cfg                  |  2 +-
 stack.sh                   |  2 +-
 tools/fixup_stuff.sh       |  2 +-
 7 files changed, 14 insertions(+), 16 deletions(-)

diff --git a/README.rst b/README.rst
index b4240bdc91..adbf59a637 100644
--- a/README.rst
+++ b/README.rst
@@ -14,7 +14,7 @@ Goals
 * To provide an environment for the OpenStack CI testing on every commit
   to the projects
 
-Read more at http://docs.openstack.org/developer/devstack
+Read more at https://docs.openstack.org/devstack/latest
 
 IMPORTANT: Be sure to carefully read `stack.sh` and any other scripts you
 execute before you run them, as they install software and will alter your
@@ -92,5 +92,5 @@ DevStack can be extensively configured via the configuration file
 `local.conf`.  It is likely that you will need to provide and modify
 this file if you want anything other than the most basic setup.  Start
 by reading the `configuration guide
-<https://docs.openstack.org/developer/devstack/configuration.html>`_
+<https://docs.openstack.org/devstack/latest/configuration.html>`_
 for details of the configuration file and the many available options.
diff --git a/doc/source/guides/nova.rst b/doc/source/guides/nova.rst
index a91e0d194c..6bbab53aea 100644
--- a/doc/source/guides/nova.rst
+++ b/doc/source/guides/nova.rst
@@ -13,7 +13,7 @@ In Juno, nova implemented a `spec
 <http://specs.openstack.org/openstack/nova-specs/specs/juno/implemented/serial-ports.html>`_
 to allow read/write access to the serial console of an instance via
 `nova-serialproxy
-<http://docs.openstack.org/developer/nova/man/nova-serialproxy.html>`_.
+<https://docs.openstack.org/nova/latest/cli/nova-serialproxy.html>`_.
 
 The service can be enabled by adding ``n-sproxy`` to
 ``ENABLED_SERVICES``.  Further options can be enabled via
@@ -62,11 +62,9 @@ The service can be enabled by adding ``n-sproxy`` to
 
 Enabling the service is enough to be functional for a single machine DevStack.
 
-These config options are defined in `nova.console.serial
-<https://github.com/openstack/nova/blob/master/nova/console/serial.py#L33-L52>`_
-and `nova.cmd.serialproxy
-<https://github.com/openstack/nova/blob/master/nova/cmd/serialproxy.py#L26-L33>`_.
+These config options are defined in `nova.conf.serial_console
+<https://github.com/openstack/nova/blob/master/nova/conf/serial_console.py>`_.
 
 For more information on OpenStack configuration see the `OpenStack
 Configuration Reference
-<http://docs.openstack.org/trunk/config-reference/content/list-of-compute-config-options.html>`_
+<https://docs.openstack.org/ocata/config-reference/compute.html>`_
diff --git a/inc/python b/inc/python
index 718cbb23b1..f388f48e91 100644
--- a/inc/python
+++ b/inc/python
@@ -441,7 +441,7 @@ function setup_dev_lib {
 # project_dir: directory of project repo (e.g., /opt/stack/keystone)
 # extras: comma-separated list of optional dependencies to install
 #         (e.g., ldap,memcache).
-#         See http://docs.openstack.org/developer/pbr/#extra-requirements
+#         See https://docs.openstack.org/pbr/latest/user/using.html#extra-requirements
 # The command is like "pip install <project_dir>[<extras>]"
 function setup_install {
     local project_dir=$1
@@ -455,7 +455,7 @@ function setup_install {
 # project_dir: directory of project repo (e.g., /opt/stack/keystone)
 # extras: comma-separated list of optional dependencies to install
 #         (e.g., ldap,memcache).
-#         See http://docs.openstack.org/developer/pbr/#extra-requirements
+#         See https://docs.openstack.org/pbr/latest/user/using.html#extra-requirements
 # The command is like "pip install -e <project_dir>[<extras>]"
 function setup_develop {
     local project_dir=$1
@@ -487,7 +487,7 @@ function is_in_projects_txt {
 # flags: pip CLI options/flags
 # extras: comma-separated list of optional dependencies to install
 #         (e.g., ldap,memcache).
-#         See http://docs.openstack.org/developer/pbr/#extra-requirements
+#         See https://docs.openstack.org/pbr/latest/user/using.html#extra-requirements
 # The command is like "pip install <flags> <project_dir>[<extras>]"
 function _setup_package_with_constraints_edit {
     local project_dir=$1
@@ -523,7 +523,7 @@ function _setup_package_with_constraints_edit {
 # flags: pip CLI options/flags
 # extras: comma-separated list of optional dependencies to install
 #         (e.g., ldap,memcache).
-#         See http://docs.openstack.org/developer/pbr/#extra-requirements
+#         See https://docs.openstack.org/pbr/latest/user/using.html#extra-requirements
 # The command is like "pip install <flags> <project_dir>[<extras>]"
 function setup_package {
     local project_dir=$1
diff --git a/samples/local.conf b/samples/local.conf
index 6d5351f904..8b76137c38 100644
--- a/samples/local.conf
+++ b/samples/local.conf
@@ -10,7 +10,7 @@
 
 # This is a collection of some of the settings we have found to be useful
 # in our DevStack development environments. Additional settings are described
-# in http://docs.openstack.org/developer/devstack/configuration.html#local-conf
+# in https://docs.openstack.org/devstack/latest/configuration.html#local-conf
 # These should be considered as samples and are unsupported DevStack code.
 
 # The ``localrc`` section replaces the old ``localrc`` configuration file.
diff --git a/setup.cfg b/setup.cfg
index 73d22b5268..fcd2b13f41 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -5,7 +5,7 @@ description-file =
     README.rst
 author = OpenStack
 author-email = openstack-dev@lists.openstack.org
-home-page = http://docs.openstack.org/developer/devstack
+home-page = https://docs.openstack.org/devstack/latest
 classifier =
     Intended Audience :: Developers
     License :: OSI Approved :: Apache Software License
diff --git a/stack.sh b/stack.sh
index b786f7bd83..018ed3e3cc 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1534,7 +1534,7 @@ if [[ "$USE_SYSTEMD" == "True" ]]; then
     echo
     echo "Services are running under systemd unit files."
     echo "For more information see: "
-    echo "https://docs.openstack.org/developer/devstack/systemd.html"
+    echo "https://docs.openstack.org/devstack/latest/systemd.html"
     echo
 fi
 
diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index 0b78bdeb00..55cd7252ea 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -157,7 +157,7 @@ if is_fedora; then
         # [1] https://bugzilla.redhat.com/show_bug.cgi?id=1099031
         # [2] https://bugs.launchpad.net/neutron/+bug/1455303
         # [3] https://github.com/redhat-openstack/openstack-puppet-modules/blob/master/firewall/manifests/linux/redhat.pp
-        # [4] http://docs.openstack.org/developer/devstack/guides/neutron.html
+        # [4] https://docs.openstack.org/devstack/latest/guides/neutron.html
         if is_package_installed firewalld; then
             sudo systemctl disable firewalld
             # The iptables service files are no longer included by default,

From d2fbcd275dfe9c7d11dc9dd5e8ab93244f653b79 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 24 Jul 2017 10:34:22 +1000
Subject: [PATCH 1050/2409] doc: Switch from oslosphinx to openstackdocstheme

Per the manuals migration effort, switch to openstackdocstheme [1]

[1] https://specs.openstack.org/openstack/docs-specs/specs/pike/os-manuals-migration.html

Change-Id: I0463f7d39bd72f1d27cfe3f6d5395608b9ed6b29
---
 doc/source/conf.py | 10 ++++++++--
 tox.ini            |  8 ++++----
 2 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/doc/source/conf.py b/doc/source/conf.py
index 6e3ec029e9..780237fe58 100644
--- a/doc/source/conf.py
+++ b/doc/source/conf.py
@@ -26,7 +26,13 @@
 
 # Add any Sphinx extension module names here, as strings. They can be extensions
 # coming with Sphinx (named 'sphinx.ext.*') or your custom ones.
-extensions = [ 'oslosphinx', 'sphinxcontrib.blockdiag', 'sphinxcontrib.nwdiag' ]
+extensions = [ 'openstackdocstheme', 'sphinxcontrib.blockdiag', 'sphinxcontrib.nwdiag' ]
+
+# openstackdocstheme options
+repository_name = 'openstack-dev/devstack'
+bug_project = 'devstack'
+bug_tag = ''
+html_last_updated_fmt = '%Y-%m-%d %H:%M'
 
 todo_include_todos = True
 
@@ -87,7 +93,7 @@
 
 # The theme to use for HTML and HTML Help pages.  See the documentation for
 # a list of builtin themes.
-html_theme = 'nature'
+html_theme = 'openstackdocs'
 
 # Theme options are theme-specific and customize the look and feel of a theme
 # further.  For a list of options available for each theme, see the
diff --git a/tox.ini b/tox.ini
index cc7c5444a8..46b15f4cb1 100644
--- a/tox.ini
+++ b/tox.ini
@@ -37,9 +37,9 @@ commands = bash -c "find {toxinidir}             \
 deps =
    Pygments
    docutils
-   sphinx>=1.5.1,<1.6.1
+   sphinx>=1.6.2
    pbr>=2.0.0,!=2.1.0
-   oslosphinx
+   openstackdocstheme>=1.11.0
    nwdiag
    blockdiag
    sphinxcontrib-blockdiag
@@ -53,8 +53,8 @@ commands =
 [testenv:venv]
 deps =
    pbr>=2.0.0,!=2.1.0
-   sphinx>=1.5.1,<1.6.1
-   oslosphinx
+   sphinx>=1.6.2
+   openstackdocstheme>=1.11.0
    blockdiag
    sphinxcontrib-blockdiag
    sphinxcontrib-nwdiag

From 7bbd4e95d02d2c54b673a93e53fc91dee61f2c90 Mon Sep 17 00:00:00 2001
From: Attila Fazekas <afazekas@redhat.com>
Date: Thu, 13 Jul 2017 15:12:55 +0200
Subject: [PATCH 1051/2409] Add f26 to the supported distros

The only mentionable diff is the kvm alias
does not exists so we will install
qemu-kvm as with rhel7 which also exists
in the older supported fedoras.

kvm also just an alias in suse so
switching to qemu-kvm  in suse as well.

Change-Id: I5c79ad1ef0b11dba30c931a59786f9eb7e7f8587
---
 files/rpms/cinder                  |  4 ++--
 files/rpms/general                 |  4 ++--
 files/rpms/nova                    |  2 +-
 files/rpms/swift                   |  2 +-
 lib/nova_plugins/functions-libvirt | 10 +---------
 stack.sh                           |  2 +-
 6 files changed, 8 insertions(+), 16 deletions(-)

diff --git a/files/rpms/cinder b/files/rpms/cinder
index 2c7b45baaf..3bc4e7ae72 100644
--- a/files/rpms/cinder
+++ b/files/rpms/cinder
@@ -1,5 +1,5 @@
 iscsi-initiator-utils
 lvm2
 qemu-img
-scsi-target-utils # not:rhel7,f24,f25 NOPRIME
-targetcli # dist:rhel7,f24,f25 NOPRIME
\ No newline at end of file
+scsi-target-utils # not:rhel7,f24,f25,f26 NOPRIME
+targetcli # dist:rhel7,f24,f25,f26 NOPRIME
diff --git a/files/rpms/general b/files/rpms/general
index 1393d18328..2443cc8cd7 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -9,9 +9,9 @@ git-core
 graphviz # needed only for docs
 httpd
 httpd-devel
-iptables-services  # NOPRIME f23,f24,f25
+iptables-services  # NOPRIME f23,f24,f25,f26
 java-1.7.0-openjdk-headless  # NOPRIME rhel7
-java-1.8.0-openjdk-headless  # NOPRIME f23,f24,f25
+java-1.8.0-openjdk-headless  # NOPRIME f23,f24,f25,f26
 libffi-devel
 libjpeg-turbo-devel # Pillow 3.0.0
 libxml2-devel # lxml
diff --git a/files/rpms/nova b/files/rpms/nova
index a368c552aa..632e796d07 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -7,7 +7,7 @@ gawk
 genisoimage # required for config_drive
 iptables
 iputils
-kernel-modules # dist:f23,f24,f25
+kernel-modules # dist:f23,f24,f25,f26
 kpartx
 libxml2-python
 m2crypto
diff --git a/files/rpms/swift b/files/rpms/swift
index 2f12df0e3b..2e09cec28f 100644
--- a/files/rpms/swift
+++ b/files/rpms/swift
@@ -2,7 +2,7 @@ curl
 liberasurecode-devel
 memcached
 pyxattr
-rsync-daemon # dist:f23,f24,f25
+rsync-daemon # dist:f23,f24,f25,f26
 sqlite
 xfsprogs
 xinetd
diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index 3e38b898ec..8d74c77517 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -73,15 +73,7 @@ function install_libvirt {
         #pip_install_gr <there-si-no-guestfs-in-pypi>
     elif is_fedora || is_suse; then
         # On "KVM for IBM z Systems", kvm does not have its own package
-        if [[ ! ${DISTRO} =~ "kvmibm1" && ! ${DISTRO} =~ "rhel7" ]]; then
-            install_package kvm
-        fi
-
-        if [[ ${DISTRO} =~ "rhel7" ]]; then
-            # This should install the latest qemu-kvm build,
-            # which is called qemu-kvm-ev in centos7
-            # (as the default OS qemu-kvm package is usually rather old,
-            # and should be updated by above)
+        if [[ ! ${DISTRO} =~ "kvmibm1" ]]; then
             install_package qemu-kvm
         fi
 
diff --git a/stack.sh b/stack.sh
index b786f7bd83..2ceb93323c 100755
--- a/stack.sh
+++ b/stack.sh
@@ -221,7 +221,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (xenial|yakkety|zesty|stretch|jessie|f24|f25|opensuse-42.2|opensuse-42.3|rhel7|kvmibm1) ]]; then
+if [[ ! ${DISTRO} =~ (xenial|yakkety|zesty|stretch|jessie|f24|f25|f26|opensuse-42.2|opensuse-42.3|rhel7|kvmibm1) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From 46a54c90895cf5d90ebe4921fc5ce958e960d31c Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Sun, 23 Jul 2017 14:14:23 +0200
Subject: [PATCH 1052/2409] Switch to cirrors 0.3.5 also for the xen case

This image is available on the download site since Feb 2016,
so let's use it.

Change-Id: I3b89211f6e57f2c35056d7e9c57d08651a3a314f
---
 stackrc | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/stackrc b/stackrc
index 4f16c3edf7..e526b548b5 100644
--- a/stackrc
+++ b/stackrc
@@ -719,9 +719,9 @@ if [[ "$DOWNLOAD_DEFAULT_IMAGES" == "True" ]]; then
             DEFAULT_IMAGE_FILE_NAME=${DEFAULT_IMAGE_FILE_NAME:-$DEFAULT_IMAGE_NAME}
             IMAGE_URLS+="http://partnerweb.vmware.com/programs/vmdkimage/${DEFAULT_IMAGE_FILE_NAME}";;
         xenserver)
-            DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-0.3.4-x86_64-disk}
-            DEFAULT_IMAGE_FILE_NAME=${DEFAULT_IMAGE_NAME:-cirros-0.3.4-x86_64-disk.vhd.tgz}
-            IMAGE_URLS+="http://ca.downloads.xensource.com/OpenStack/cirros-0.3.4-x86_64-disk.vhd.tgz"
+            DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-0.3.5-x86_64-disk}
+            DEFAULT_IMAGE_FILE_NAME=${DEFAULT_IMAGE_NAME:-cirros-0.3.5-x86_64-disk.vhd.tgz}
+            IMAGE_URLS+="http://ca.downloads.xensource.com/OpenStack/cirros-0.3.5-x86_64-disk.vhd.tgz"
             IMAGE_URLS+=",http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-x86_64-uec.tar.gz";;
     esac
     DOWNLOAD_DEFAULT_IMAGES=False

From d325875508e7d35d6dd62302d852e83815be2278 Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Fri, 21 Jul 2017 08:19:16 +0200
Subject: [PATCH 1053/2409] Resolve openSUSE devstack failures

This update resolves multiple issues with python-cryptography
causing keystone server and nova deployment to fail.

This is a temporary workaround until I196f025dbf1a9ac297946b8165620676645f7210
has landed and the extraneous dependency on python-cryptography (the
package) has been removed.

Change-Id: Ifb29b9089197c0429a5fc1cd08a25d2095d481f1
---
 tools/install_prereqs.sh | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/tools/install_prereqs.sh b/tools/install_prereqs.sh
index da59093581..933491081c 100755
--- a/tools/install_prereqs.sh
+++ b/tools/install_prereqs.sh
@@ -88,6 +88,22 @@ else
     export PYTHON=$(which python 2>/dev/null)
 fi
 
+if is_suse; then
+    # novnc has an extraneous dependency on pyOpenSSL, which causes symbol conflicts
+    # in the bundled libssl of python-cryptography. when both are loaded into the same
+    # process, they start hanging or segfaulting.
+    install_package novnc
+    # deinstall the extra but irrelevant dependencies
+    sudo rpm -e --nodeps python-cffi python-cryptography python-pyOpenSSL
+    # reinstall cffi which got overwriten by the package.
+    sudo pip install -I cffi
+    # now reinstall cryptography from source, in order to rebuilt it against the
+    # system libssl rather than the bundled openSSL 1.1, which segfaults when combined
+    # with the system provided (which libpython links against) openSSL 1.0
+    sudo pip install cryptography --no-binary :all:
+fi
+
+
 # Mark end of run
 # ---------------
 

From c63ecadb08245eda3f4ef2327a2b9ca85cf4b4f9 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Tue, 25 Jul 2017 17:08:50 -0400
Subject: [PATCH 1054/2409] Add instructions for discovering hosts in the
 multinode guide

When doing a multi-node devstack deployment starting in Ocata
the child compute nodes must be discovered and mapped to the
single nova cell (cell1). In the upstream CI we do this discovery
in devstack-gate after the subnodes are stacked, but for anyone
doing this manually we need to provide some notes on what needs
to happen after child compute nodes are stacked for a multinode
environment.

Change-Id: I68418bcf28d86c60fe42537186d89458fa778bda
Closes-Bug: #1688397
---
 doc/source/guides/multinode-lab.rst | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
index 1a8ddbc194..b4e2891c10 100644
--- a/doc/source/guides/multinode-lab.rst
+++ b/doc/source/guides/multinode-lab.rst
@@ -197,6 +197,22 @@ A stream of activity ensues. When complete you will see a summary of
 to poke at your shiny new OpenStack. The most recent log file is
 available in ``stack.sh.log``.
 
+Starting in the Ocata release, Nova requires a `Cells v2`_ deployment. Compute
+node services must be mapped to a cell before they can be used.
+
+After each compute node is stacked, verify it shows up in the
+``nova service-list --binary nova-compute`` output. The compute service is
+registered in the cell database asynchronously so this may require polling.
+
+Once the compute node services shows up, run the ``./tools/discover_hosts.sh``
+script from the control node to map compute hosts to the single cell.
+
+The compute service running on the primary control node will be
+discovered automatically when the control node is stacked so this really
+only needs to be performed for subnodes.
+
+.. _Cells v2: https://docs.openstack.org/nova/latest/user/cells.html
+
 Cleaning Up After DevStack
 --------------------------
 

From 2f09dcfc98959db87d6d6d7804364c9db3fa5111 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Wed, 26 Jul 2017 08:12:17 +0000
Subject: [PATCH 1055/2409] Updated from generate-devstack-plugins-list

Change-Id: Ic5ccbd05b9be0739b486d0b816b94eaa5d8f355f
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 92e5ecdb89..ea406aa967 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -106,6 +106,7 @@ networking-cumulus                     `git://git.openstack.org/openstack/networ
 networking-dpm                         `git://git.openstack.org/openstack/networking-dpm <https://git.openstack.org/cgit/openstack/networking-dpm>`__
 networking-fortinet                    `git://git.openstack.org/openstack/networking-fortinet <https://git.openstack.org/cgit/openstack/networking-fortinet>`__
 networking-generic-switch              `git://git.openstack.org/openstack/networking-generic-switch <https://git.openstack.org/cgit/openstack/networking-generic-switch>`__
+networking-hpe                         `git://git.openstack.org/openstack/networking-hpe <https://git.openstack.org/cgit/openstack/networking-hpe>`__
 networking-huawei                      `git://git.openstack.org/openstack/networking-huawei <https://git.openstack.org/cgit/openstack/networking-huawei>`__
 networking-infoblox                    `git://git.openstack.org/openstack/networking-infoblox <https://git.openstack.org/cgit/openstack/networking-infoblox>`__
 networking-l2gw                        `git://git.openstack.org/openstack/networking-l2gw <https://git.openstack.org/cgit/openstack/networking-l2gw>`__

From dcdf8c8e60a9db0adb4ee5cae98ed7cc511ecf83 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Tue, 25 Jul 2017 19:51:08 -0400
Subject: [PATCH 1056/2409] Wait for compute service to check in

With cell v2, on initial bring up, discover hosts can't run unless all
the compute nodes have checked in. The documentation says that you
should run ``nova service-list --binary nova-compute`` and see all
your hosts before running discover hosts. This isn't really viable in
a multinode devstack because of how things are brought up in parts.

We can however know that stack.sh will not complete before the compute
node is up by waiting for the compute node to check in before moving
forward. This puts a few more seconds into the run, but ensures
everything is solid in multinode environments.

Change-Id: I667e6a9be3fee8bb5bfd73426eef567489e3d88d
---
 functions | 14 ++++++++++++++
 lib/nova  |  7 +++++++
 2 files changed, 21 insertions(+)

diff --git a/functions b/functions
index 6f2164a777..faa6b761ab 100644
--- a/functions
+++ b/functions
@@ -407,6 +407,20 @@ EOF
     return $rval
 }
 
+function wait_for_compute {
+    local timeout=$1
+    time_start "wait_for_service"
+    timeout $timeout bash -x <<EOF || rval=$?
+        ID=""
+        while [[ "\$ID" == "" ]]; do
+            sleep 1
+            ID=\$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" compute service list --host `hostname` --service nova-compute -c ID -f value)
+        done
+EOF
+    time_stop "wait_for_service"
+    return $rval
+}
+
 
 # ping check
 # Uses globals ``ENABLED_SERVICES``, ``TOP_DIR``, ``MULTI_HOST``, ``PRIVATE_NETWORK``
diff --git a/lib/nova b/lib/nova
index 3fa5de67eb..5a8dc371f3 100644
--- a/lib/nova
+++ b/lib/nova
@@ -795,6 +795,13 @@ function start_nova_compute {
         fi
         run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $compute_cell_conf"
     fi
+    # NOTE(sdague): with cells v2 all the compute services must be up
+    # and checked into the database before discover_hosts is run. This
+    # happens in all in one installs by accident, because > 30 seconds
+    # happen between here and the script ending. However, in multinode
+    # tests this can very often not be the case. So ensure that the
+    # compute is up before we move on.
+    wait_for_compute 60
 
     export PATH=$old_path
 }

From 5adfef0a53a19436cd759b1d345bcad0a46fc1bf Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 26 Jul 2017 11:14:37 -0400
Subject: [PATCH 1057/2409] Introduce CELLSV2_SETUP variable

Some environments, like grenade and ironic, need a way to revert to
the non fleet version of the conductor setup. This really comes down
to a global topology for CELLSV2_SETUP. The prefered is with a
superconductor, but allow a downgrade to singleconductor.

Depends-On: I5390ec14c41da0237c898852935aba3569e7acae

Change-Id: I10fb048ef2175909019461e585d117b4284448c6
---
 lib/nova | 23 ++++++++++++++++-------
 stackrc  |  8 ++++++++
 2 files changed, 24 insertions(+), 7 deletions(-)

diff --git a/lib/nova b/lib/nova
index 0500fc27a8..5362e3fef4 100644
--- a/lib/nova
+++ b/lib/nova
@@ -432,7 +432,16 @@ function create_nova_conf {
     # require them running on the host. The ensures that n-cpu doesn't
     # leak a need to use the db in a multinode scenario.
     if is_service_enabled n-api n-cond n-sched; then
-        iniset $NOVA_CONF database connection `database_connection_url nova_cell0`
+        # If we're in multi-tier cells mode, we want our control services pointing
+        # at cell0 instead of cell1 to ensure isolation. If not, we point everything
+        # at the main database like normal.
+        if [[ "$CELLSV2_SETUP" == "singleconductor" ]]; then
+            local db="nova_cell1"
+        else
+            local db="nova_cell0"
+        fi
+
+        iniset $NOVA_CONF database connection `database_connection_url $db`
         iniset $NOVA_CONF api_database connection `database_connection_url nova_api`
     fi
 
@@ -676,15 +685,15 @@ function init_nova {
         # and nova_cell0 databases.
         nova-manage cell_v2 map_cell0 --database_connection `database_connection_url nova_cell0`
 
-        # Migrate nova and nova_cell0 databases.
-        $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF db sync
-
         # (Re)create nova databases
         for i in $(seq 1 $NOVA_NUM_CELLS); do
             recreate_database nova_cell${i}
             $NOVA_BIN_DIR/nova-manage --config-file $(conductor_conf $i) db sync
         done
 
+        # Migrate nova and nova_cell0 databases.
+        $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF db sync
+
         if is_service_enabled n-cell; then
             recreate_database $NOVA_CELLS_DB
         fi
@@ -795,7 +804,6 @@ function start_nova_api {
 
 # start_nova_compute() - Start the compute process
 function start_nova_compute {
-    local nomulticellflag="$1"
     # Hack to set the path for rootwrap
     local old_path=$PATH
     export PATH=$NOVA_BIN_DIR:$PATH
@@ -803,17 +811,18 @@ function start_nova_compute {
     if is_service_enabled n-cell; then
         local compute_cell_conf=$NOVA_CELLS_CONF
         # NOTE(danms): Don't setup conductor fleet for cellsv1
-        nomulticellflag='nomulticell'
+        CELLSV2_SETUP="singleconductor"
     else
         local compute_cell_conf=$NOVA_CONF
     fi
 
-    if [ "$nomulticellflag" = 'nomulticell' ]; then
+    if [[ "${CELLSV2_SETUP}" == "singleconductor" ]]; then
         # NOTE(danms): Grenade doesn't setup multi-cell rabbit, so
         # skip these bits and use the normal config.
         NOVA_CPU_CONF=$compute_cell_conf
         echo "Skipping multi-cell conductor fleet setup"
     else
+        # "${CELLSV2_SETUP}" is "superconductor"
         cp $compute_cell_conf $NOVA_CPU_CONF
         # FIXME(danms): Should this be configurable?
         iniset $NOVA_CPU_CONF workarounds disable_group_policy_check_upcall True
diff --git a/stackrc b/stackrc
index e526b548b5..877da82261 100644
--- a/stackrc
+++ b/stackrc
@@ -77,6 +77,14 @@ ENABLE_HTTPD_MOD_WSGI_SERVICES=True
 # Set the default Nova APIs to enable
 NOVA_ENABLED_APIS=osapi_compute,metadata
 
+# CELLSV2_SETUP - how we should configure services with cells v2
+#
+# - superconductor - this is one conductor for the api services, and
+#   one per cell managing the compute services. This is prefered
+# - singleconductor - this is one conductor for the whole deployment,
+#   this is not recommended, and will be removed in the future.
+CELLSV2_SETUP=${CELLSV2_SETUP:-"superconductor"}
+
 # Set the root URL for Horizon
 HORIZON_APACHE_ROOT="/dashboard"
 

From 97430cd9e062b907c5937eb50ca6b95ae6fcdeeb Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Thu, 27 Jul 2017 08:21:35 +0000
Subject: [PATCH 1058/2409] Updated from generate-devstack-plugins-list

Change-Id: I4e47d524df32d3d41cc00c608edc6c9c588726b5
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index ea406aa967..f9ca05583f 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -92,6 +92,7 @@ mogan-ui                               `git://git.openstack.org/openstack/mogan-
 monasca-analytics                      `git://git.openstack.org/openstack/monasca-analytics <https://git.openstack.org/cgit/openstack/monasca-analytics>`__
 monasca-api                            `git://git.openstack.org/openstack/monasca-api <https://git.openstack.org/cgit/openstack/monasca-api>`__
 monasca-ceilometer                     `git://git.openstack.org/openstack/monasca-ceilometer <https://git.openstack.org/cgit/openstack/monasca-ceilometer>`__
+monasca-events-api                     `git://git.openstack.org/openstack/monasca-events-api <https://git.openstack.org/cgit/openstack/monasca-events-api>`__
 monasca-log-api                        `git://git.openstack.org/openstack/monasca-log-api <https://git.openstack.org/cgit/openstack/monasca-log-api>`__
 monasca-transform                      `git://git.openstack.org/openstack/monasca-transform <https://git.openstack.org/cgit/openstack/monasca-transform>`__
 murano                                 `git://git.openstack.org/openstack/murano <https://git.openstack.org/cgit/openstack/murano>`__

From afc14c8e8585e6f6f00fafc78daa4e478b1635ae Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 27 Jul 2017 07:09:48 -0400
Subject: [PATCH 1059/2409] Fix last place where we need singleconductor

The actual logic of launching a singleconductor didn't get all the way
to the launch of the conductor itself, so we were still launching 2
conductors in the Ironic case. This attempts to fix that.

Change-Id: I7ddb123dbdf3e1ec9a991e474a9990d2ccbc30d3
---
 lib/nova | 38 +++++++++++++++++++++++++++++++-------
 1 file changed, 31 insertions(+), 7 deletions(-)

diff --git a/lib/nova b/lib/nova
index 5362e3fef4..8311a54930 100644
--- a/lib/nova
+++ b/lib/nova
@@ -51,6 +51,7 @@ NOVA_AUTH_CACHE_DIR=${NOVA_AUTH_CACHE_DIR:-/var/cache/nova}
 NOVA_CONF_DIR=/etc/nova
 NOVA_CONF=$NOVA_CONF_DIR/nova.conf
 NOVA_CELLS_CONF=$NOVA_CONF_DIR/nova-cells.conf
+NOVA_COND_CONF=$NOVA_CONF_DIR/nova.conf
 NOVA_CPU_CONF=$NOVA_CONF_DIR/nova-cpu.conf
 NOVA_FAKE_CONF=$NOVA_CONF_DIR/nova-fake.conf
 NOVA_CELLS_DB=${NOVA_CELLS_DB:-nova_cell}
@@ -588,8 +589,13 @@ function create_nova_conf {
             iniset $conf database connection `database_connection_url nova_cell${i}`
             iniset $conf conductor workers "$API_WORKERS"
             iniset $conf DEFAULT debug "$ENABLE_DEBUG_LOG_LEVEL"
-            rpc_backend_add_vhost $vhost
-            iniset_rpc_backend nova $conf DEFAULT $vhost
+            # if we have a singleconductor, we don't have per host message queues.
+            if [[ "${CELLSV2_SETUP}" == "singleconductor" ]]; then
+                iniset_rpc_backend nova $conf DEFAULT
+            else
+                rpc_backend_add_vhost $vhost
+                iniset_rpc_backend nova $conf DEFAULT $vhost
+            fi
         done
     fi
 }
@@ -632,6 +638,9 @@ function init_nova_cells {
             iniset $NOVA_CELLS_CONF DEFAULT enabled_apis metadata
         fi
 
+        # Cells v1 conductor should be the nova-cells.conf
+        NOVA_COND_CONF=$NOVA_CELLS_CONF
+
         time_start "dbsync"
         $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CELLS_CONF db sync
         time_stop "dbsync"
@@ -802,6 +811,16 @@ function start_nova_api {
     export PATH=$old_path
 }
 
+# Detect and setup conditions under which singleconductor setup is
+# needed. Notably cellsv1.
+function _set_singleconductor {
+    # NOTE(danms): Don't setup conductor fleet for cellsv1
+    if is_service_enabled n-cell; then
+        CELLSV2_SETUP="singleconductor"
+    fi
+}
+
+
 # start_nova_compute() - Start the compute process
 function start_nova_compute {
     # Hack to set the path for rootwrap
@@ -810,8 +829,6 @@ function start_nova_compute {
 
     if is_service_enabled n-cell; then
         local compute_cell_conf=$NOVA_CELLS_CONF
-        # NOTE(danms): Don't setup conductor fleet for cellsv1
-        CELLSV2_SETUP="singleconductor"
     else
         local compute_cell_conf=$NOVA_CONF
     fi
@@ -908,15 +925,15 @@ function enable_nova_fleet {
 }
 
 function start_nova_conductor {
-    if is_service_enabled n-cell; then
+    if [[ "${CELLSV2_SETUP}" == "singleconductor" ]]; then
         echo "Starting nova-conductor in a cellsv1-compatible way"
-        run_process n-cond "$NOVA_BIN_DIR/nova-conductor --config-file $NOVA_CELLS_CONF"
+        run_process n-cond "$NOVA_BIN_DIR/nova-conductor --config-file $NOVA_COND_CONF"
         return
     fi
 
     enable_nova_fleet
     if is_service_enabled n-super-cond; then
-        run_process n-super-cond "$NOVA_BIN_DIR/nova-conductor --config-file $NOVA_CONF"
+        run_process n-super-cond "$NOVA_BIN_DIR/nova-conductor --config-file $NOVA_COND_CONF"
     fi
     for i in $(seq 1 $NOVA_NUM_CELLS); do
         if is_service_enabled n-cond-cell${i}; then
@@ -928,9 +945,16 @@ function start_nova_conductor {
 }
 
 function start_nova {
+    # this catches the cells v1 case early
+    _set_singleconductor
     start_nova_rest
     start_nova_conductor
     start_nova_compute
+    if is_service_enabled n-api; then
+        # dump the cell mapping to ensure life is good
+        echo "Dumping cells_v2 mapping"
+        nova-manage cell_v2 list_cells --verbose
+    fi
 }
 
 function stop_nova_compute {

From 01c0cc6d37ccca13e0e7e48a58dcc7ba98967f1c Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 27 Jul 2017 20:53:57 +0000
Subject: [PATCH 1060/2409] Revert "Wait for compute service to check in"

This reverts commit dcdf8c8e60a9db0adb4ee5cae98ed7cc511ecf83.

Change-Id: Ib14016a3bc6f2714758ad0291396233218c593c6
---
 functions | 14 --------------
 lib/nova  |  7 -------
 2 files changed, 21 deletions(-)

diff --git a/functions b/functions
index faa6b761ab..6f2164a777 100644
--- a/functions
+++ b/functions
@@ -407,20 +407,6 @@ EOF
     return $rval
 }
 
-function wait_for_compute {
-    local timeout=$1
-    time_start "wait_for_service"
-    timeout $timeout bash -x <<EOF || rval=$?
-        ID=""
-        while [[ "\$ID" == "" ]]; do
-            sleep 1
-            ID=\$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" compute service list --host `hostname` --service nova-compute -c ID -f value)
-        done
-EOF
-    time_stop "wait_for_service"
-    return $rval
-}
-
 
 # ping check
 # Uses globals ``ENABLED_SERVICES``, ``TOP_DIR``, ``MULTI_HOST``, ``PRIVATE_NETWORK``
diff --git a/lib/nova b/lib/nova
index 5a8dc371f3..3fa5de67eb 100644
--- a/lib/nova
+++ b/lib/nova
@@ -795,13 +795,6 @@ function start_nova_compute {
         fi
         run_process n-cpu "$NOVA_BIN_DIR/nova-compute --config-file $compute_cell_conf"
     fi
-    # NOTE(sdague): with cells v2 all the compute services must be up
-    # and checked into the database before discover_hosts is run. This
-    # happens in all in one installs by accident, because > 30 seconds
-    # happen between here and the script ending. However, in multinode
-    # tests this can very often not be the case. So ensure that the
-    # compute is up before we move on.
-    wait_for_compute 60
 
     export PATH=$old_path
 }

From 6effdf370a1a638e72319337db57c5ef1fa1312d Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Thu, 27 Jul 2017 20:28:43 +0200
Subject: [PATCH 1061/2409] Remove extra websockify dependency cleanup step

This started to fail due to a missing || : / --force option now
that the dependencies got fixed:

2017-07-30 19:38:37.260 | ++ tools/install_prereqs.sh:source:97       :   sudo rpm -e --nodeps python-cffi python-cryptography python-pyOpenSSL
2017-07-30 19:38:37.293 | error: package python-cffi is not installed
2017-07-30 19:38:37.293 | error: package python-cryptography is not installed
2017-07-30 19:38:37.293 | error: package python-pyOpenSSL is not installed

Change-Id: Ia59afb7ee564cf2044ebdb3c5ad3e54ee91d1222
---
 tools/install_prereqs.sh | 11 ++---------
 1 file changed, 2 insertions(+), 9 deletions(-)

diff --git a/tools/install_prereqs.sh b/tools/install_prereqs.sh
index 933491081c..6189085e9e 100755
--- a/tools/install_prereqs.sh
+++ b/tools/install_prereqs.sh
@@ -89,17 +89,10 @@ else
 fi
 
 if is_suse; then
-    # novnc has an extraneous dependency on pyOpenSSL, which causes symbol conflicts
-    # in the bundled libssl of python-cryptography. when both are loaded into the same
-    # process, they start hanging or segfaulting.
-    install_package novnc
-    # deinstall the extra but irrelevant dependencies
-    sudo rpm -e --nodeps python-cffi python-cryptography python-pyOpenSSL
-    # reinstall cffi which got overwriten by the package.
-    sudo pip install -I cffi
     # now reinstall cryptography from source, in order to rebuilt it against the
     # system libssl rather than the bundled openSSL 1.1, which segfaults when combined
-    # with the system provided (which libpython links against) openSSL 1.0
+    # with a system provided openSSL 1.0
+    # see https://github.com/pyca/cryptography/issues/3804 and followup issues
     sudo pip install cryptography --no-binary :all:
 fi
 

From dea3083d984569eac9647f1a28f10ae98afc42f7 Mon Sep 17 00:00:00 2001
From: Vasyl Saienko <vsaienko@mirantis.com>
Date: Tue, 1 Aug 2017 00:16:51 +0300
Subject: [PATCH 1062/2409] Fix path to mlock_report

This patch fixes path to mlock_report.py. Also add python-psutil
to dstat depends as it is required by mlock_report.

Change-Id: Ia2b507a7b923f1e3393a9cb7746c66d39d6abfde
---
 files/debs/dstat        | 1 +
 files/rpms/dstat        | 1 +
 tools/memory_tracker.sh | 2 +-
 3 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/files/debs/dstat b/files/debs/dstat
index 2b643b8b1b..0d9da4434f 100644
--- a/files/debs/dstat
+++ b/files/debs/dstat
@@ -1 +1,2 @@
 dstat
+python-psutil
diff --git a/files/rpms/dstat b/files/rpms/dstat
index 2b643b8b1b..0d9da4434f 100644
--- a/files/rpms/dstat
+++ b/files/rpms/dstat
@@ -1 +1,2 @@
 dstat
+python-psutil
diff --git a/tools/memory_tracker.sh b/tools/memory_tracker.sh
index cbdeb8f420..63f25ca2de 100755
--- a/tools/memory_tracker.sh
+++ b/tools/memory_tracker.sh
@@ -88,7 +88,7 @@ function tracker {
             # list processes that lock memory from swap
             if [[ $unevictable -ne $unevictable_point ]]; then
                 unevictable_point=$unevictable
-                ${PYTHON} ./tools/mlock_report.py
+                ${PYTHON} $(dirname $0)/mlock_report.py
             fi
 
             echo "]]]"

From fa55cb5f978f6bd9476f1b09a94c8d6aaa18beb4 Mon Sep 17 00:00:00 2001
From: Mathieu Mitchell <mmitchell@iweb.com>
Date: Tue, 24 Jan 2017 11:32:24 -0500
Subject: [PATCH 1063/2409] Ensure valid service names are passed to
 stack_install_service

Currently, stack_install_service will accept any service name. This is
problematic because a project plugin can pass an invalid name without
noticing. This has been the case in ironic-inspector[0].

This commit ensures that stack_install_service will not silently fail
when passing an invalid service name.

[0] https://review.openstack.org/#/c/424680/

Change-Id: I1a8105bdbaf4aecb630df08da416808bf7180824
Closes-Bug: #1659042
---
 lib/stack | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/stack b/lib/stack
index f09ddcee85..bada26f1c2 100644
--- a/lib/stack
+++ b/lib/stack
@@ -33,5 +33,8 @@ function stack_install_service {
         if [[ ${USE_VENV} = True && -n ${PROJECT_VENV[$service]:-} ]]; then
             unset PIP_VIRTUAL_ENV
         fi
+    else
+        echo "No function declared with name 'install_${service}'."
+        exit 1
     fi
 }

From ab980ce5d6792a273db3e93eb3d163bfdc38b1de Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Tue, 1 Aug 2017 16:38:42 -0400
Subject: [PATCH 1064/2409] Disable track_instance_changes when in
 superconductor mode

When configured for superconductor mode, which is the default,
nova-compute can't reach the MQ for nova-scheduler so there is
no point in even enabling the track_instance_changes code since
it's a waste of time as the scheduler will never get the message.

Change-Id: I2662ebd47323428b403d3c2236bec78f1fb1050f
---
 lib/nova | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lib/nova b/lib/nova
index 8311a54930..7266ac70e9 100644
--- a/lib/nova
+++ b/lib/nova
@@ -440,6 +440,9 @@ function create_nova_conf {
             local db="nova_cell1"
         else
             local db="nova_cell0"
+            # When in superconductor mode, nova-compute can't send instance
+            # info updates to the scheduler, so just disable it.
+            iniset $NOVA_CONF filter_scheduler track_instance_changes False
         fi
 
         iniset $NOVA_CONF database connection `database_connection_url $db`
@@ -843,6 +846,9 @@ function start_nova_compute {
         cp $compute_cell_conf $NOVA_CPU_CONF
         # FIXME(danms): Should this be configurable?
         iniset $NOVA_CPU_CONF workarounds disable_group_policy_check_upcall True
+        # Since the nova-compute service cannot reach nova-scheduler over
+        # RPC, we also disable track_instance_changes.
+        iniset $NOVA_CPU_CONF filter_scheduler track_instance_changes False
         iniset_rpc_backend nova $NOVA_CPU_CONF DEFAULT "nova_cell${NOVA_CPU_CELL}"
     fi
 

From c2fe916fc7c6c00cdfa0085e198eaf2ad4d915d1 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Fri, 28 Jul 2017 11:29:18 +0000
Subject: [PATCH 1065/2409] Wait for compute service to check in

With cell v2, on initial bring up, discover hosts can't run unless all
the compute nodes have checked in. The documentation says that you
should run ``nova service-list --binary nova-compute`` and see all
your hosts before running discover hosts. This isn't really viable in
a multinode devstack because of how things are brought up in parts.

We can however know that stack.sh will not complete before the compute
node is up by waiting for the compute node to check in before
completing. This happens quite late in the stack.sh run, so shouldn't
add any extra time in most runs.

Cells v1 and Xenserver don't use real hostnames in the service table
(they encode complex data that is hostname like to provide more
topology information than just hostnames). They are exempted from this
check.

Related-Bug: #1708039

Change-Id: I32eb59b9d6c225a3e93992be3a3b9f4b251d7189
---
 functions | 20 ++++++++++++++++++++
 lib/nova  | 22 ++++++++++++++++++++++
 stack.sh  |  7 +++++++
 3 files changed, 49 insertions(+)

diff --git a/functions b/functions
index 6f2164a777..d55cd74609 100644
--- a/functions
+++ b/functions
@@ -407,6 +407,26 @@ EOF
     return $rval
 }
 
+function wait_for_compute {
+    local timeout=$1
+    local rval=0
+    time_start "wait_for_service"
+    timeout $timeout bash -x <<EOF || rval=$?
+        ID=""
+        while [[ "\$ID" == "" ]]; do
+            sleep 1
+            ID=\$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" compute service list --host `hostname` --service nova-compute -c ID -f value)
+        done
+EOF
+    time_stop "wait_for_service"
+    # Figure out what's happening on platforms where this doesn't work
+    if [[ "$rval" != 0 ]]; then
+        echo "Didn't find service registered by hostname after $timeout seconds"
+        openstack --os-cloud devstack-admin --os-region "$REGION_NAME" compute service list
+    fi
+    return $rval
+}
+
 
 # ping check
 # Uses globals ``ENABLED_SERVICES``, ``TOP_DIR``, ``MULTI_HOST``, ``PRIVATE_NETWORK``
diff --git a/lib/nova b/lib/nova
index 8311a54930..8e75157b44 100644
--- a/lib/nova
+++ b/lib/nova
@@ -944,6 +944,28 @@ function start_nova_conductor {
     done
 }
 
+function is_nova_ready {
+    # NOTE(sdague): with cells v2 all the compute services must be up
+    # and checked into the database before discover_hosts is run. This
+    # happens in all in one installs by accident, because > 30 seconds
+    # happen between here and the script ending. However, in multinode
+    # tests this can very often not be the case. So ensure that the
+    # compute is up before we move on.
+    if is_service_enabled n-cell; then
+        # cells v1 can't complete the check below because it munges
+        # hostnames with cell information (grumble grumble).
+        return
+    fi
+    # TODO(sdague): honestly, this probably should be a plug point for
+    # an external system.
+    if [[ "$VIRT_DRIVER" == 'xenserver' ]]; then
+        # xenserver encodes information in the hostname of the compute
+        # because of the dom0/domU split. Just ignore for now.
+        return
+    fi
+    wait_for_compute 60
+}
+
 function start_nova {
     # this catches the cells v1 case early
     _set_singleconductor
diff --git a/stack.sh b/stack.sh
index 015ee6ec43..51e12168ba 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1433,6 +1433,13 @@ fi
 # Sanity checks
 # =============
 
+# Check that computes are all ready
+#
+# TODO(sdague): there should be some generic phase here.
+if is_service_enabled n-cpu; then
+    is_nova_ready
+fi
+
 # Check the status of running services
 service_check
 

From eca7ce749204f01f0041bf1bb5f00fd04c9109c7 Mon Sep 17 00:00:00 2001
From: Kevin Zhao <kevin.zhao@arm.com>
Date: Fri, 4 Aug 2017 11:50:36 +0800
Subject: [PATCH 1066/2409] ETCD need to add UNSUPPORT environment in AArch64

Closes-bug: #1708575

Change-Id: I77e78389ac7b8df9ba9f84b072f446d2e03d84d1
Signed-off-by: Kevin Zhao <kevin.zhao@arm.com>
---
 lib/etcd3 | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/etcd3 b/lib/etcd3
index 0e1fbd5bc2..bc24790782 100644
--- a/lib/etcd3
+++ b/lib/etcd3
@@ -57,6 +57,9 @@ function start_etcd3 {
     iniset -sudo $unitfile "Service" "Type" "notify"
     iniset -sudo $unitfile "Service" "Restart" "on-failure"
     iniset -sudo $unitfile "Service" "LimitNOFILE" "65536"
+    if is_arch "aarch64"; then
+        iniset -sudo $unitfile "Service" "Environment" "ETCD_UNSUPPORTED_ARCH=arm64"
+    fi
 
     $SYSTEMCTL daemon-reload
     $SYSTEMCTL enable $ETCD_SYSTEMD_SERVICE

From 801494550a58220e1bcbd531e810e1ca59efa7e8 Mon Sep 17 00:00:00 2001
From: Sam Betts <sam@code-smash.net>
Date: Thu, 3 Aug 2017 12:41:36 +0100
Subject: [PATCH 1067/2409] Disable baremetal sched filters when using resource
 classes

When using resource classes to schedule baremetal nodes the baremetal
filters like ExactRam etc should not be used. This patch disables them
in the nova config if devstack is configured to enable ironic resource
classes.

Change-Id: Ic262ccaf8b541308042d61113a953653d2261964
---
 lib/nova_plugins/hypervisor-ironic | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/lib/nova_plugins/hypervisor-ironic b/lib/nova_plugins/hypervisor-ironic
index 7d47ef070c..d59473ca1c 100644
--- a/lib/nova_plugins/hypervisor-ironic
+++ b/lib/nova_plugins/hypervisor-ironic
@@ -42,7 +42,11 @@ function configure_nova_hypervisor {
     iniset $NOVA_CONF DEFAULT compute_driver ironic.IronicDriver
     iniset $NOVA_CONF DEFAULT firewall_driver $LIBVIRT_FIREWALL_DRIVER
     iniset $NOVA_CONF DEFAULT scheduler_host_manager ironic_host_manager
-    iniset $NOVA_CONF filter_scheduler use_baremetal_filters True
+
+    if [[ "$IRONIC_USE_RESOURCE_CLASSES" == "False" ]]; then
+        iniset $NOVA_CONF filter_scheduler use_baremetal_filters True
+    fi
+
     iniset $NOVA_CONF DEFAULT ram_allocation_ratio 1.0
     iniset $NOVA_CONF DEFAULT reserved_host_memory_mb 0
     # ironic section

From 49144e627120f9ec1cf72dfc84e02b9b81e669b6 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 2 Aug 2017 09:49:27 -0400
Subject: [PATCH 1068/2409] Remove glance api_servers from nova config

This should now be able to be discovered from the service catalog,
there is no reason to set it.

Change-Id: I7383b589fbcef9423beeab735db42c594f7b56fd
get auth from context for glance endpoints:
Depends-On: I4e755b9c66ec8bc3af0393e81cffd91c56064717
---
 lib/nova | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index 8311a54930..26f65637c5 100644
--- a/lib/nova
+++ b/lib/nova
@@ -538,7 +538,6 @@ function create_nova_conf {
     iniset $NOVA_CONF oslo_messaging_notifications driver "messagingv2"
     iniset $NOVA_CONF oslo_messaging_notifications transport_url $(get_transport_url)
     iniset_rpc_backend nova $NOVA_CONF
-    iniset $NOVA_CONF glance api_servers "$GLANCE_URL"
 
     iniset $NOVA_CONF DEFAULT osapi_compute_workers "$API_WORKERS"
     iniset $NOVA_CONF DEFAULT metadata_workers "$API_WORKERS"

From b645904d4aae46a8be5cee3a23710565b211f458 Mon Sep 17 00:00:00 2001
From: Kenneth Giusti <kgiusti@gmail.com>
Date: Fri, 4 Aug 2017 18:08:37 -0400
Subject: [PATCH 1069/2409] Use get_notification_url when configuring
 notifications

If a project manually configures the oslo.messaging transport url for
notifications it should use 'get_notification_url', not
'get_transport_url'.  get_transport_url should only be used to obtain
the RPC transport address.

Change-Id: I77772dfa9f30a3db2db6d0387260dfe3452a26ef
Closes-Bug: #1708754
---
 lib/nova        | 2 +-
 lib/rpc_backend | 7 ++++---
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/lib/nova b/lib/nova
index 8311a54930..c988c2f06b 100644
--- a/lib/nova
+++ b/lib/nova
@@ -536,7 +536,7 @@ function create_nova_conf {
     # Set the oslo messaging driver to the typical default. This does not
     # enable notifications, but it will allow them to function when enabled.
     iniset $NOVA_CONF oslo_messaging_notifications driver "messagingv2"
-    iniset $NOVA_CONF oslo_messaging_notifications transport_url $(get_transport_url)
+    iniset $NOVA_CONF oslo_messaging_notifications transport_url $(get_notification_url)
     iniset_rpc_backend nova $NOVA_CONF
     iniset $NOVA_CONF glance api_servers "$GLANCE_URL"
 
diff --git a/lib/rpc_backend b/lib/rpc_backend
index 3177e88ef2..fb1cf73b99 100644
--- a/lib/rpc_backend
+++ b/lib/rpc_backend
@@ -114,7 +114,7 @@ function rpc_backend_add_vhost {
     fi
 }
 
-# builds transport url string
+# Returns the address of the RPC backend in URL format.
 function get_transport_url {
     local virtual_host=$1
     if is_service_enabled rabbit || { [ -n "$RABBIT_HOST" ] && [ -n "$RABBIT_PASSWORD" ]; }; then
@@ -122,8 +122,9 @@ function get_transport_url {
     fi
 }
 
-# Repeat the definition, in case get_transport_url is overriden for RPC purpose.
-# get_notification_url can then be used to talk to rabbit for notifications.
+# Returns the address of the Notification backend in URL format.  This
+# should be used to set the transport_url option in the
+# oslo_messaging_notifications group.
 function get_notification_url {
     local virtual_host=$1
     if is_service_enabled rabbit || { [ -n "$RABBIT_HOST" ] && [ -n "$RABBIT_PASSWORD" ]; }; then

From 41e6e12318718c3c5eb6f47ed75a215ed67eccf2 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 8 Aug 2017 15:06:26 +1000
Subject: [PATCH 1070/2409] Switch Centos/Fedora to Apache woker MPM

In trying to debug periodic gate instability of CentOS, I noticed that
it is using the prefork mpm, while Ubuntu is defaulting to the
multi-threaded worker mpm.

One of the problems seems related to 502 proxy errors from the TLS
proxy.  We see out-of-sync timestamps in the centos TLS proxy access
logs, which might be innocent behaviour based on the prefork model or
indicate something else.

Before going too deep down this rabbit-hole, I think it is better for
consistency to use the same mpm model on all our platforms, and start
debugging from there.

Change-Id: I9881f2e7d51fdd9fc0f7fb3e37179aa53171b531
---
 lib/apache | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/apache b/lib/apache
index ffd7966de1..dfca25a764 100644
--- a/lib/apache
+++ b/lib/apache
@@ -132,6 +132,10 @@ function install_apache_wsgi {
     elif is_fedora; then
         sudo rm -f /etc/httpd/conf.d/000-*
         install_package httpd mod_wsgi
+        # For consistency with Ubuntu, switch to the worker mpm, as
+        # the default is prefork
+        sudo sed -i '/mod_mpm_prefork.so/s/^/#/g' /etc/httpd/conf.modules.d/00-mpm.conf
+        sudo sed -i '/mod_mpm_worker.so/s/^#//g' /etc/httpd/conf.modules.d/00-mpm.conf
     elif is_suse; then
         install_package apache2 apache2-mod_wsgi
     else

From 139837d69d8566088125d29739089aec7b2a9e7c Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 8 Aug 2017 17:51:29 +1000
Subject: [PATCH 1071/2409] Make TLS logs more readable

After looking at these for I9881f2e7d51fdd9fc0f7fb3e37179aa53171b531 I
found them not as useful as they could be.

Fix the CustomLog command, that wants the logfile then the format
string (or a nickname, which the LogFormat line wasn't setting).  Use
standard micro-second timestamps, and trim the access log to have more
relevant info.

Change-Id: I9f4c8ef38ab9e08aeced7b309d4a5276de07af4b
---
 lib/tls | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/lib/tls b/lib/tls
index 6a3d260ebd..7bde5e6496 100644
--- a/lib/tls
+++ b/lib/tls
@@ -533,10 +533,9 @@ $listen_string
         ProxyPassReverse http://$b_host:$b_port/
     </Location>
     ErrorLog $APACHE_LOG_DIR/tls-proxy_error.log
-    ErrorLogFormat "[%{u}t] [%-m:%l] [pid %P:tid %T] %7F: %E: [client\ %a] [frontend\ %A] %M% ,\ referer\ %{Referer}i"
+    ErrorLogFormat "%{cu}t [%-m:%l] [pid %P:tid %T] %7F: %E: [client\ %a] [frontend\ %A] %M% ,\ referer\ %{Referer}i"
     LogLevel info
-    CustomLog $APACHE_LOG_DIR/tls-proxy_access.log common
-    LogFormat "%v %h %l %u %t \"%r\" %>s %b"
+    CustomLog $APACHE_LOG_DIR/tls-proxy_access.log "%{%Y-%m-%d}t %{%T}t.%{msec_frac}t [%l] %a \"%r\" %>s %b"
 </VirtualHost>
 EOF
     if is_suse ; then

From 2d57f93f68ae14e17313486e0d5ad2513af58fd1 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Thu, 3 Aug 2017 14:35:37 +1000
Subject: [PATCH 1072/2409] Don't reinstall python-virtualenv on infra nodes

In the original change I said "for infra nodes, it shouldn't do
anything anyway ...".  Well that was pre-Fedora 26 :)

It seems that dnf > 2.0 now intentionally throws an error when trying
to explicitly install an ignored package.  Thus, as described in the
comment, take a simpler approach of skipping this on infra nodes.
pip-and-virtualenv in dib should have installed the latest pip,
virtualenv and setuptools, so we don't want to fiddle with that
anyway.

[1] https://review.openstack.org/#/c/338998/

Change-Id: Ib300b58377a0d0fe1bd7444c71acdb9a87dc033b
---
 tools/fixup_stuff.sh | 21 +++++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index 55cd7252ea..f1552ab2f7 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -202,5 +202,22 @@ fi
 # on python-virtualenv), first install the distro python-virtualenv
 # to satisfy any dependencies then use pip to overwrite it.
 
-install_package python-virtualenv
-pip_install -U --force-reinstall virtualenv
+# ... but, for infra builds, the pip-and-virtualenv [1] element has
+# already done this to ensure the latest pip, virtualenv and
+# setuptools on the base image for all platforms.  It has also added
+# the packages to the yum/dnf ignore list to prevent them being
+# overwritten with old versions.  F26 and dnf 2.0 has changed
+# behaviour that means re-installing python-virtualenv fails [2].
+# Thus we do a quick check if we're in the infra environment by
+# looking for the mirror config script before doing this, and just
+# skip it if so.
+
+# [1] https://git.openstack.org/cgit/openstack/diskimage-builder/tree/ \
+#        diskimage_builder/elements/pip-and-virtualenv/ \
+#            install.d/pip-and-virtualenv-source-install/04-install-pip
+# [2] https://bugzilla.redhat.com/show_bug.cgi?id=1477823
+
+if [[ ! -f /etc/ci/mirror_info.sh ]]; then
+    install_package python-virtualenv
+    pip_install -U --force-reinstall virtualenv
+fi

From 32608da2c4ecc523fb331212c441fc86aabb6355 Mon Sep 17 00:00:00 2001
From: zhangbailin <zhangbailin@inspur.com>
Date: Wed, 9 Aug 2017 01:43:00 -0700
Subject: [PATCH 1073/2409] Modify some spelling mistakes

There are some comment errors, it's modify 'Captial' to 'Capital' in
keystone file, and modify 'possition' to 'position' in openrc file, and
modify 'comming' to 'coming' in stack file, and
modify 'prefered' to 'preferred' in stackrc file.

Change-Id: I0fdd539cbfff842a4ba7fca9100b881443300f9a
---
 lib/keystone | 2 +-
 openrc       | 2 +-
 stack.sh     | 2 +-
 stackrc      | 4 ++--
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 1061081a5e..749e219e67 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -350,7 +350,7 @@ function create_keystone_accounts {
     # The Member role is used by Horizon and Swift so we need to keep it:
     local member_role="member"
 
-    # Captial Member role is legacy hard coded in Horizon / Swift
+    # Capital Member role is legacy hard coded in Horizon / Swift
     # configs. Keep it around.
     get_or_create_role "Member"
 
diff --git a/openrc b/openrc
index 23c173c8a1..37724c552e 100644
--- a/openrc
+++ b/openrc
@@ -84,7 +84,7 @@ export OS_AUTH_TYPE=password
 # We currently recommend using the version 3 *identity api*.
 #
 
-# If you don't have a working .stackenv, this is the backup possition
+# If you don't have a working .stackenv, this is the backup position
 KEYSTONE_BACKUP=$SERVICE_PROTOCOL://$SERVICE_HOST:5000
 KEYSTONE_AUTH_URI=${KEYSTONE_AUTH_URI:-$KEYSTONE_BACKUP}
 
diff --git a/stack.sh b/stack.sh
index 015ee6ec43..e92418233b 100755
--- a/stack.sh
+++ b/stack.sh
@@ -30,7 +30,7 @@ unset GREP_OPTIONS
 # NOTE(sdague): why do we explicitly set locale when running stack.sh?
 #
 # Devstack is written in bash, and many functions used throughout
-# devstack process text comming off a command (like the ip command)
+# devstack process text coming off a command (like the ip command)
 # and do transforms using grep, sed, cut, awk on the strings that are
 # returned. Many of these programs are interationalized, which is
 # great for end users, but means that the strings that devstack
diff --git a/stackrc b/stackrc
index 877da82261..b03426ffa8 100644
--- a/stackrc
+++ b/stackrc
@@ -80,7 +80,7 @@ NOVA_ENABLED_APIS=osapi_compute,metadata
 # CELLSV2_SETUP - how we should configure services with cells v2
 #
 # - superconductor - this is one conductor for the api services, and
-#   one per cell managing the compute services. This is prefered
+#   one per cell managing the compute services. This is preferred
 # - singleconductor - this is one conductor for the whole deployment,
 #   this is not recommended, and will be removed in the future.
 CELLSV2_SETUP=${CELLSV2_SETUP:-"superconductor"}
@@ -117,7 +117,7 @@ fi
 # Whether or not to enable Kernel Samepage Merging (KSM) if available.
 # This allows programs that mark their memory as mergeable to share
 # memory pages if they are identical. This is particularly useful with
-# libvirt backends. This reduces memory useage at the cost of CPU overhead
+# libvirt backends. This reduces memory usage at the cost of CPU overhead
 # to scan memory. We default to enabling it because we tend to be more
 # memory constrained than CPU bound.
 ENABLE_KSM=$(trueorfalse True ENABLE_KSM)

From a6c782722378827ecc4606afae26f3fb7a48b92d Mon Sep 17 00:00:00 2001
From: linxuhua <linxuhua@unionpay.com>
Date: Wed, 9 Aug 2017 17:25:03 +0800
Subject: [PATCH 1074/2409] modify the default url of noVNC

i had sync the all repos of devstack for installing in intranet
environment, and found the url of noVNC had changed to
https://github.com/novnc/noVNC. This module upgrade from individual to
an organization. the old url had redirect to the new one.

Change-Id: I19fc1e2ad30dcd97cad232c9ad58f53a523616b4
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 877da82261..3bced58b25 100644
--- a/stackrc
+++ b/stackrc
@@ -624,7 +624,7 @@ IRONIC_PYTHON_AGENT_REPO=${IRONIC_PYTHON_AGENT_REPO:-${GIT_BASE}/openstack/ironi
 IRONIC_PYTHON_AGENT_BRANCH=${IRONIC_PYTHON_AGENT_BRANCH:-master}
 
 # a websockets/html5 or flash powered VNC console for vm instances
-NOVNC_REPO=${NOVNC_REPO:-https://github.com/kanaka/noVNC.git}
+NOVNC_REPO=${NOVNC_REPO:-https://github.com/novnc/noVNC.git}
 NOVNC_BRANCH=${NOVNC_BRANCH:-stable/v0.6}
 
 # a websockets/html5 or flash powered SPICE console for vm instances

From 8ea8660e363b0bd1fd8bc40a9b74f76e42649f90 Mon Sep 17 00:00:00 2001
From: Eric Harney <eharney@redhat.com>
Date: Wed, 2 Aug 2017 11:40:41 -0400
Subject: [PATCH 1075/2409] Fix Cinder tls-proxy WSGI test

This currently will throw errors like:

lib/cinder: line 480: [True: command not found

Change-Id: I6bc08532cf99411f39d23523f9fc7851e7804131
---
 lib/cinder | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/cinder b/lib/cinder
index 4274be740a..03328f31b6 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -478,7 +478,7 @@ function start_cinder {
     local service_port=$CINDER_SERVICE_PORT
     local service_protocol=$CINDER_SERVICE_PROTOCOL
     local cinder_url
-    if is_service_enabled tls-proxy && ["$CINDER_USE_MOD_WSGI" == "False"]; then
+    if is_service_enabled tls-proxy && [ "$CINDER_USE_MOD_WSGI" == "False" ]; then
         service_port=$CINDER_SERVICE_PORT_INT
         service_protocol="http"
     fi

From 0629c4fe22ce02aefde7ee9a18ef75a2687bee01 Mon Sep 17 00:00:00 2001
From: Sylvain Bauza <sbauza@redhat.com>
Date: Thu, 10 Aug 2017 15:34:29 +0200
Subject: [PATCH 1076/2409] Remove DiskFilter and RamFilter from Nova
 scheduling defaults

In Ocata, we replaced the verification logic for CPU, RAM and disk by calling
the Placement API instead of using those legacy scheduler filters, it's time
to remove them from the default list of filters that are run, especially
since Nova now removes them from the conf opt defaults thanks to
Ibe1cee1cb2642f61a8d6bf9c3f6bbee4f2c2f414

Change-Id: I2e81f1bbce7476d63e84e70dcdd59a1163f89f09
Related-Bug: #1709328
---
 lib/nova | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index 8311a54930..f1be7ce41d 100644
--- a/lib/nova
+++ b/lib/nova
@@ -101,7 +101,7 @@ SCHEDULER=${SCHEDULER:-filter_scheduler}
 
 # The following FILTERS contains SameHostFilter and DifferentHostFilter with
 # the default filters.
-FILTERS="RetryFilter,AvailabilityZoneFilter,RamFilter,DiskFilter,ComputeFilter,ComputeCapabilitiesFilter,ImagePropertiesFilter,ServerGroupAntiAffinityFilter,ServerGroupAffinityFilter,SameHostFilter,DifferentHostFilter"
+FILTERS="RetryFilter,AvailabilityZoneFilter,ComputeFilter,ComputeCapabilitiesFilter,ImagePropertiesFilter,ServerGroupAntiAffinityFilter,ServerGroupAffinityFilter,SameHostFilter,DifferentHostFilter"
 
 QEMU_CONF=/etc/libvirt/qemu.conf
 

From 0ed3b6208952e546b7ce5c0d3dc13cb628e3f00d Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Fri, 11 Aug 2017 08:26:44 +0000
Subject: [PATCH 1077/2409] Updated from generate-devstack-plugins-list

Change-Id: Ibb3f6cd6aa01daf79413b2abfb5adb3d5f121321
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index f9ca05583f..0ec31b36de 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -138,6 +138,7 @@ nova-powervm                           `git://git.openstack.org/openstack/nova-p
 oaktree                                `git://git.openstack.org/openstack/oaktree <https://git.openstack.org/cgit/openstack/oaktree>`__
 octavia                                `git://git.openstack.org/openstack/octavia <https://git.openstack.org/cgit/openstack/octavia>`__
 octavia-dashboard                      `git://git.openstack.org/openstack/octavia-dashboard <https://git.openstack.org/cgit/openstack/octavia-dashboard>`__
+omni                                   `git://git.openstack.org/openstack/omni <https://git.openstack.org/cgit/openstack/omni>`__
 os-xenapi                              `git://git.openstack.org/openstack/os-xenapi <https://git.openstack.org/cgit/openstack/os-xenapi>`__
 osprofiler                             `git://git.openstack.org/openstack/osprofiler <https://git.openstack.org/cgit/openstack/osprofiler>`__
 panko                                  `git://git.openstack.org/openstack/panko <https://git.openstack.org/cgit/openstack/panko>`__

From 63962fbbe41fe966df96fe2e1bb30943e7ae4047 Mon Sep 17 00:00:00 2001
From: Lance Bragstad <lbragstad@gmail.com>
Date: Fri, 11 Aug 2017 19:37:07 +0000
Subject: [PATCH 1078/2409] Remove keystone configs for ldap read/write

Configuration options that toggle support for LDAP read/write
were deprecated and removed as of the Ocata release:

  I13eada3d5c3a166223c3e3ce70b7054eaed1003a

This means we no longer need to clutter the domain-specific
configuration with these values since they are no longer used.

Change-Id: I23b5b994862f066c3d48ce524c396faecabf60f8
---
 lib/keystone | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 1061081a5e..4a4a30f0cc 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -626,12 +626,6 @@ function create_ldap_domain {
     iniset $KEYSTONE_LDAP_DOMAIN_FILE identity driver "ldap"
 
     # LDAP settings for Users domain
-    iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap group_allow_delete "False"
-    iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap group_allow_update "False"
-    iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap group_allow_create "False"
-    iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap user_allow_delete "False"
-    iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap user_allow_update "False"
-    iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap user_allow_create "False"
     iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap user_tree_dn "ou=Users,$LDAP_BASE_DN"
     iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap user_objectclass "inetOrgPerson"
     iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap user_name_attribute "cn"

From 87d2396d225533aefd8d52bb5fa574ea57dbb987 Mon Sep 17 00:00:00 2001
From: Sampath Priyankara <sam47priya@gmail.com>
Date: Thu, 3 Aug 2017 16:12:40 +0900
Subject: [PATCH 1079/2409] Don't uninstall pip packages if OFFLINE=True

lib/nova does a pip re-install of libvirt-python to rebuild the python
library incase the underlying libvirt version changed during package
installs.  In offline mode, the underlying version of libvirt can't
have changed; so we have the situation that we've removed the libvirt
python bindings but can't reinstall them (because we're offline).

This fixes that particular situation, but skipping uninstalls in
offline mode seems generically OK.

Change-Id: I2b75d45d94d82f87d996c7570c125d46f5f99f6a
Closes-Bug: #1708369
---
 inc/python | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/inc/python b/inc/python
index f388f48e91..5e7f742d48 100644
--- a/inc/python
+++ b/inc/python
@@ -346,6 +346,9 @@ function pip_install {
 }
 
 function pip_uninstall {
+    # Skip uninstall if offline
+    [[ "${OFFLINE}" = "True" ]] && return
+
     local name=$1
     if [[ -n ${PIP_VIRTUAL_ENV:=} && -d ${PIP_VIRTUAL_ENV} ]]; then
         local cmd_pip=$PIP_VIRTUAL_ENV/bin/pip

From a3488d5f0067b570974c14572c58bbf8cedf7ed2 Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Thu, 10 Aug 2017 14:55:15 -0400
Subject: [PATCH 1080/2409] Remove proxy-sendcl from mod_proxy_uwsgi apache
 path

Calling setenv appears to be globally scoped which is breaking the
glance path which relies on chunked uploads. The glance path is
separated by using mod_proxy instead of mod_proxy_uwsgi because
mod_proxy_uwsgi doesn't support chunked encoding.[1] The proxy-sendcl [2]
was set on the mod_proxy_uwsgi path just in case someone tried to send a
chunked request to the api server we would be able to handle it. It
tells apache to locally cache the chunked request and send the
content-length as a normal upload to the upstream server. However, if we
can only set it globally across then small potential benefit is not worth
having all glance uploads cached by apache. This commit just removes
setting the flag. In the future if we can have devstack isolate this
flag it might be worth adding back to the mod_proxy_uwsgi path, but for
right now it's not worth the tradeoff.

[1] https://github.com/unbit/uwsgi/issues/1540
[2] https://httpd.apache.org/docs/2.4/mod/mod_proxy.html#request-bodies

Depends-On: Idf6b4b891ba31cccbeb53d373b40fce5380cea64
Change-Id: Iab2e2848877fa1497008d18c05b0154892941589
Closes-Bug: #1709970
---
 lib/apache | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/apache b/lib/apache
index dfca25a764..5838a4df9b 100644
--- a/lib/apache
+++ b/lib/apache
@@ -277,7 +277,6 @@ function write_uwsgi_config {
     else
         local apache_conf=""
         apache_conf=$(apache_site_config_for $name)
-        echo "SetEnv proxy-sendcl 1" | sudo tee $apache_conf
         iniset "$file" uwsgi socket "$socket"
         iniset "$file" uwsgi chmod-socket 666
         echo "ProxyPass \"${url}\" \"unix:${socket}|uwsgi://uwsgi-uds-${name}/\" retry=0 " | sudo tee -a $apache_conf
@@ -335,6 +334,7 @@ function write_local_uwsgi_http_config {
     local apache_conf=""
     apache_conf=$(apache_site_config_for $name)
     echo "KeepAlive Off" | sudo tee $apache_conf
+    echo "SetEnv proxy-sendchunked 1" | sudo tee -a $apache_conf
     echo "ProxyPass \"${url}\" \"http://127.0.0.1:$port\" retry=0 " | sudo tee -a $apache_conf
     enable_apache_site $name
     restart_apache_server

From 6b354a909535a9dfef164c3e844544989d17514a Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Mon, 14 Aug 2017 13:58:30 -0700
Subject: [PATCH 1081/2409] Don't special case Grenade + systemd

Now that the pike branch exists we don't want to special case grenade +
system on the target side. We should use systemd for both sides of the
pike -> master upgrade. Note this change should not be backported so
that we do not attempt to use systemd on the ocata -> pike upgrade path.

Depends-On: Iedf824a1772115e0dff287a898636f8e58471269
Change-Id: I6198bf1842a44773fce80672c81eee3afc3c6f38
---
 stackrc | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/stackrc b/stackrc
index 877da82261..18c1ce76ce 100644
--- a/stackrc
+++ b/stackrc
@@ -174,10 +174,7 @@ fi
 # if we are forcing off USE_SCREEN (as we do in the gate), force on
 # systemd. This allows us to drop one of 3 paths through the code.
 if [[ "$USE_SCREEN" == "False" ]]; then
-    # Remove in Pike: this gets us through grenade upgrade
-    if [[ "$GRENADE_PHASE" != "target" ]]; then
-        USE_SYSTEMD="True"
-    fi
+    USE_SYSTEMD="True"
 fi
 
 # Default for log coloring is based on interactive-or-not.

From 0525e77d9f297bff5b3a37276b1c28440a384229 Mon Sep 17 00:00:00 2001
From: Vasyl Saienko <vsaienko@mirantis.com>
Date: Tue, 15 Aug 2017 22:02:30 +0300
Subject: [PATCH 1082/2409] Increase host_subset_size for ironic

This patch increase host_subset_size when ironic is used to 999
to minimize race conditions.

Change-Id: I0874fe3b3628cb3e662ee01f24c4599247fdc82d
---
 lib/nova_plugins/hypervisor-ironic | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/nova_plugins/hypervisor-ironic b/lib/nova_plugins/hypervisor-ironic
index d59473ca1c..062afb7f7c 100644
--- a/lib/nova_plugins/hypervisor-ironic
+++ b/lib/nova_plugins/hypervisor-ironic
@@ -47,6 +47,8 @@ function configure_nova_hypervisor {
         iniset $NOVA_CONF filter_scheduler use_baremetal_filters True
     fi
 
+    iniset $NOVA_CONF filter_scheduler host_subset_size 999
+
     iniset $NOVA_CONF DEFAULT ram_allocation_ratio 1.0
     iniset $NOVA_CONF DEFAULT reserved_host_memory_mb 0
     # ironic section

From 59fb961180caf0981aa5e3fc5a022fbe3bf3e463 Mon Sep 17 00:00:00 2001
From: Tim Burke <tim.burke@gmail.com>
Date: Tue, 15 Aug 2017 13:48:04 -0700
Subject: [PATCH 1083/2409] Allow both Keystone and Tempauth reseller prefixes

... to be used with domain_remap. Swift will start functionally testing
domain_remap in I63428132283986bda9e5c082ffe85741449b71ba.

Change-Id: I4c1ab06d040d91fd8c314d0aa2cecbbb00adf8ad
---
 lib/swift | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/swift b/lib/swift
index 455740ea82..72a810352f 100644
--- a/lib/swift
+++ b/lib/swift
@@ -464,6 +464,9 @@ function configure_swift {
     iniuncomment ${SWIFT_CONFIG_PROXY_SERVER} filter:tempauth account_autocreate
     iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:tempauth reseller_prefix "TEMPAUTH"
 
+    # Allow both reseller prefixes to be used with domain_remap
+    iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:domain_remap reseller_prefixes "AUTH, TEMPAUTH"
+
     if is_service_enabled swift3; then
         cat <<EOF >>${SWIFT_CONFIG_PROXY_SERVER}
 [filter:s3token]

From cdfcff511fa0c9f21a700d87530d56066bdad7cf Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Wed, 16 Aug 2017 08:06:13 +0000
Subject: [PATCH 1084/2409] Updated from generate-devstack-plugins-list

Change-Id: I38170528cf78a89b71a616a4d9c6179c4e3f49c5
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 0ec31b36de..84a57428d2 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -99,6 +99,7 @@ murano                                 `git://git.openstack.org/openstack/murano
 networking-6wind                       `git://git.openstack.org/openstack/networking-6wind <https://git.openstack.org/cgit/openstack/networking-6wind>`__
 networking-arista                      `git://git.openstack.org/openstack/networking-arista <https://git.openstack.org/cgit/openstack/networking-arista>`__
 networking-bagpipe                     `git://git.openstack.org/openstack/networking-bagpipe <https://git.openstack.org/cgit/openstack/networking-bagpipe>`__
+networking-baremetal                   `git://git.openstack.org/openstack/networking-baremetal <https://git.openstack.org/cgit/openstack/networking-baremetal>`__
 networking-bgpvpn                      `git://git.openstack.org/openstack/networking-bgpvpn <https://git.openstack.org/cgit/openstack/networking-bgpvpn>`__
 networking-brocade                     `git://git.openstack.org/openstack/networking-brocade <https://git.openstack.org/cgit/openstack/networking-brocade>`__
 networking-calico                      `git://git.openstack.org/openstack/networking-calico <https://git.openstack.org/cgit/openstack/networking-calico>`__

From 98c95f4fa1029adff778902be3afb92c080e15b3 Mon Sep 17 00:00:00 2001
From: Davanum Srinivas <davanum@gmail.com>
Date: Wed, 16 Aug 2017 09:10:04 -0400
Subject: [PATCH 1085/2409] Stop nova conductor properly (singleconductor mode)

stop_nova_conductor dropped the ball when the CELLSV2_SETUP mode is
set to "singleconductor". We should cleanup the older style "n-cond"
in this case.

Change-Id: I9ffd6d09df6f390a842b8a374097f144564d2db4
---
 lib/nova | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/lib/nova b/lib/nova
index 31b51c7c07..fa09fd8fc1 100644
--- a/lib/nova
+++ b/lib/nova
@@ -988,6 +988,11 @@ function stop_nova_rest {
 }
 
 function stop_nova_conductor {
+    if [[ "${CELLSV2_SETUP}" == "singleconductor" ]]; then
+        stop_process n-cond
+        return
+    fi
+
     enable_nova_fleet
     for srv in n-super-cond $(seq -f n-cond-cell%0.f 1 $NOVA_NUM_CELLS); do
         if is_service_enabled $srv; then

From ebbbc0500c7bb7a975967e4b1fadad7d1681c9a7 Mon Sep 17 00:00:00 2001
From: Chris Dent <cdent@anticdent.org>
Date: Wed, 16 Aug 2017 16:00:16 +0100
Subject: [PATCH 1086/2409] Make reference to service-types-authority from
 plugins.rst

We want people creating plugins (that add services) to be aware of the
service-types-authority (STA), so this change adds a Prerequisites
section and notes the existince of the STA there, and the need to apply
there to create a service-type.

Change-Id: I1aa48fe231aaa4499f8b4fe336abea668841b9af
---
 doc/source/plugins.rst | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/doc/source/plugins.rst b/doc/source/plugins.rst
index 5b3c6cf714..fae1a1d8f5 100644
--- a/doc/source/plugins.rst
+++ b/doc/source/plugins.rst
@@ -12,6 +12,15 @@ tree. They are called through a strong contract, so these plugins can
 be sure that they will continue to work in the future as DevStack
 evolves.
 
+Prerequisites
+=============
+
+If you are planning to create a plugin that is going to host a service in the
+service catalog (that is, your plugin will use the command
+``get_or_create_service``) please make sure that you apply to the `service
+types authority`_ to reserve a valid service-type. This will help to make sure
+that all deployments of your service use the same service-type.
+
 Plugin Interface
 ================
 
@@ -250,3 +259,5 @@ See Also
 
 For additional inspiration on devstack plugins you can check out the
 `Plugin Registry <plugin-registry.html>`_.
+
+.. _service types authority: https://specs.openstack.org/openstack/service-types-authority/

From 1d141daaf673d7e28e4980812b4bff953a97518b Mon Sep 17 00:00:00 2001
From: Leticia Wanderley <leticiafwanderley@gmail.com>
Date: Fri, 4 Aug 2017 00:42:59 -0300
Subject: [PATCH 1087/2409] Feature flag on tempest conf to notify enabled LDAP

This adds a new feature flag on tempest conf whenever LDAP is enabled.
When this flag is set to True Tempest users and groups identity tests
adapt to fetch users and groups from different domains.

Change-Id: I368ddf34908b906355c422bd1afd6ab9b1a80053
Depends-On: Iedb470c51fa2174ab7651e6b7e22eff1f25f7aac
---
 lib/tempest | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index cc65ec7aa9..61fda7f1b9 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -297,6 +297,12 @@ function configure_tempest {
     # Newton and Ocata. This option can be removed after Mitaka is end of life.
     iniset $TEMPEST_CONFIG identity-feature-enabled forbid_global_implied_dsr True
 
+    # When LDAP is enabled domain specific drivers are also enabled and the users
+    # and groups identity tests must adapt to this scenario
+    if is_service_enabled ldap; then
+        iniset $TEMPEST_CONFIG identity-feature-enabled domain_specific_drivers True
+    fi
+
     # Image
     # We want to be able to override this variable in the gate to avoid
     # doing an external HTTP fetch for this test.

From aceb27e858b594ae80bf07bb0278a715e5a4cd3b Mon Sep 17 00:00:00 2001
From: Davanum Srinivas <davanum@gmail.com>
Date: Thu, 17 Aug 2017 08:59:59 -0400
Subject: [PATCH 1088/2409] Add procname for uwsgi based services

Code in grenade and elsewhere rely on the process/service name
when one runs "ps auxw" and they grep for example "grep -e glance-api"
to check if the service is running. with uwsgi, let us make sure
we use process name prefix so it is easier to spot the services
and be compatible with code elsewhere that relies on this.

Change-Id: I4d1cd223ed9904fcb19b26fc9362b676e0b4f9b3
---
 lib/cinder    | 2 +-
 lib/glance    | 2 +-
 lib/keystone  | 2 +-
 lib/nova      | 4 ++--
 lib/placement | 2 +-
 5 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 03328f31b6..22c5168089 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -511,7 +511,7 @@ function start_cinder {
                 start_tls_proxy cinder '*' $CINDER_SERVICE_PORT $CINDER_SERVICE_HOST $CINDER_SERVICE_POR_INT
             fi
         else
-            run_process "c-api" "$CINDER_BIN_DIR/uwsgi --ini $CINDER_UWSGI_CONF"
+            run_process "c-api" "$CINDER_BIN_DIR/uwsgi --procname-prefix cinder-api --ini $CINDER_UWSGI_CONF"
             cinder_url=$service_protocol://$SERVICE_HOST/volume/v3
         fi
     fi
diff --git a/lib/glance b/lib/glance
index 0a5b9f59b6..7b42488b59 100644
--- a/lib/glance
+++ b/lib/glance
@@ -345,7 +345,7 @@ function start_glance {
 
     run_process g-reg "$GLANCE_BIN_DIR/glance-registry --config-file=$GLANCE_CONF_DIR/glance-registry.conf"
     if [[ "$WSGI_MODE" == "uwsgi" ]]; then
-        run_process g-api "$GLANCE_BIN_DIR/uwsgi --ini $GLANCE_UWSGI_CONF"
+        run_process g-api "$GLANCE_BIN_DIR/uwsgi --procname-prefix glance-api --ini $GLANCE_UWSGI_CONF"
     else
         run_process g-api "$GLANCE_BIN_DIR/glance-api --config-file=$GLANCE_CONF_DIR/glance-api.conf"
     fi
diff --git a/lib/keystone b/lib/keystone
index 749e219e67..08aa675d43 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -550,7 +550,7 @@ function start_keystone {
         tail_log key /var/log/$APACHE_NAME/keystone.log
         tail_log key-access /var/log/$APACHE_NAME/keystone_access.log
     else # uwsgi
-        run_process keystone "$KEYSTONE_BIN_DIR/uwsgi --ini $KEYSTONE_PUBLIC_UWSGI_CONF" ""
+        run_process keystone "$KEYSTONE_BIN_DIR/uwsgi --procname-prefix keystone --ini $KEYSTONE_PUBLIC_UWSGI_CONF" ""
     fi
 
     echo "Waiting for keystone to start..."
diff --git a/lib/nova b/lib/nova
index fa09fd8fc1..976bf35ad5 100644
--- a/lib/nova
+++ b/lib/nova
@@ -805,7 +805,7 @@ function start_nova_api {
             start_tls_proxy nova '*' $NOVA_SERVICE_PORT $NOVA_SERVICE_HOST $NOVA_SERVICE_PORT_INT
         fi
     else
-        run_process "n-api" "$NOVA_BIN_DIR/uwsgi --ini $NOVA_UWSGI_CONF"
+        run_process "n-api" "$NOVA_BIN_DIR/uwsgi --procname-prefix nova-api --ini $NOVA_UWSGI_CONF"
         nova_url=$service_protocol://$SERVICE_HOST/compute/v2.1/
     fi
 
@@ -912,7 +912,7 @@ function start_nova_rest {
     if [ "$NOVA_USE_MOD_WSGI" == "False" ]; then
         run_process n-api-meta "$NOVA_BIN_DIR/nova-api-metadata --config-file $compute_cell_conf"
     else
-        run_process n-api-meta "$NOVA_BIN_DIR/uwsgi --ini $NOVA_METADATA_UWSGI_CONF"
+        run_process n-api-meta "$NOVA_BIN_DIR/uwsgi --procname-prefix nova-api-meta --ini $NOVA_METADATA_UWSGI_CONF"
     fi
 
     run_process n-novnc "$NOVA_BIN_DIR/nova-novncproxy --config-file $api_cell_conf --web $NOVNC_WEB_DIR"
diff --git a/lib/placement b/lib/placement
index 8adbbdec68..aef9b7454e 100644
--- a/lib/placement
+++ b/lib/placement
@@ -164,7 +164,7 @@ function install_placement {
 # start_placement_api() - Start the API processes ahead of other things
 function start_placement_api {
     if [[ "$WSGI_MODE" == "uwsgi" ]]; then
-        run_process "placement-api" "$PLACEMENT_BIN_DIR/uwsgi --ini $PLACEMENT_UWSGI_CONF"
+        run_process "placement-api" "$PLACEMENT_BIN_DIR/uwsgi --procname-prefix placement --ini $PLACEMENT_UWSGI_CONF"
     else
         enable_apache_site placement-api
         restart_apache_server

From aa33c878d8da59369aed737cb636b628a1f444bb Mon Sep 17 00:00:00 2001
From: Davanum Srinivas <davanum@gmail.com>
Date: Wed, 16 Aug 2017 22:51:07 -0400
Subject: [PATCH 1089/2409] Fix Cleanups for keystone/placement/nova

* Check KEYSTONE_DEPLOY flag and cleanup appropriately
* When we stop process, we should not wipe uwsgi config we should
  remove files only on cleanup
* We should not call cleanup *BEFORE* configure, we are just wiping
  out the uwsgi ini files
* cleanup_placement should be called from clean.sh

Change-Id: I066f5f87ff22d7da2e3814f8c2de75f2af625d2b
---
 clean.sh     |  1 +
 lib/keystone | 25 ++++++++++++-------------
 stack.sh     |  2 --
 3 files changed, 13 insertions(+), 15 deletions(-)

diff --git a/clean.sh b/clean.sh
index 9ffe3bee6b..2333596c1f 100755
--- a/clean.sh
+++ b/clean.sh
@@ -88,6 +88,7 @@ cleanup_cinder || /bin/true
 cleanup_glance
 cleanup_keystone
 cleanup_nova
+cleanup_placement
 cleanup_neutron
 cleanup_swift
 cleanup_horizon
diff --git a/lib/keystone b/lib/keystone
index 749e219e67..685891e8bc 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -148,16 +148,18 @@ function is_keystone_enabled {
 # cleanup_keystone() - Remove residual data files, anything left over from previous
 # runs that a clean run would need to clean up
 function cleanup_keystone {
-    # TODO: remove admin at pike-2
-    # These files will be created if we are running WSGI_MODE="uwsgi"
-    remove_uwsgi_config "$KEYSTONE_PUBLIC_UWSGI_CONF" "$KEYSTONE_PUBLIC_UWSGI"
-    remove_uwsgi_config "$KEYSTONE_ADMIN_UWSGI_CONF" "$KEYSTONE_ADMIN_UWSGI"
-    sudo rm -f $(apache_site_config_for keystone-wsgi-public)
-    sudo rm -f $(apache_site_config_for keystone-wsgi-admin)
-
-    # These files will be created if we are running WSGI_MODE="mod_wsgi"
-    disable_apache_site keystone
-    sudo rm -f $(apache_site_config_for keystone)
+    if [ "$KEYSTONE_DEPLOY" == "mod_wsgi" ]; then
+        # These files will be created if we are running WSGI_MODE="mod_wsgi"
+        disable_apache_site keystone
+        sudo rm -f $(apache_site_config_for keystone)
+    else
+        stop_process "keystone"
+        # TODO: remove admin at pike-2
+        remove_uwsgi_config "$KEYSTONE_PUBLIC_UWSGI_CONF" "$KEYSTONE_PUBLIC_UWSGI"
+        remove_uwsgi_config "$KEYSTONE_ADMIN_UWSGI_CONF" "$KEYSTONE_ADMIN_UWSGI"
+        sudo rm -f $(apache_site_config_for keystone-wsgi-public)
+        sudo rm -f $(apache_site_config_for keystone-wsgi-admin)
+    fi
 }
 
 # _config_keystone_apache_wsgi() - Set WSGI config files of Keystone
@@ -582,9 +584,6 @@ function stop_keystone {
         restart_apache_server
     else
         stop_process keystone
-        remove_uwsgi_config "$KEYSTONE_PUBLIC_UWSGI_CONF" "$KEYSTONE_PUBLIC_UWSGI"
-        # TODO(remove in at pike-2)
-        remove_uwsgi_config "$KEYSTONE_ADMIN_UWSGI_CONF" "$KEYSTONE_ADMIN_UWSGI"
     fi
     # Kill the Keystone screen window
     stop_process key
diff --git a/stack.sh b/stack.sh
index e92418233b..301e1e7c6b 100755
--- a/stack.sh
+++ b/stack.sh
@@ -896,14 +896,12 @@ fi
 if is_service_enabled nova; then
     # Compute service
     stack_install_service nova
-    cleanup_nova
     configure_nova
 fi
 
 if is_service_enabled placement; then
     # placement api
     stack_install_service placement
-    cleanup_placement
     configure_placement
 fi
 

From 64edfd47caba71a0c351269663dd457fd911fcac Mon Sep 17 00:00:00 2001
From: "John L. Villalovos" <john.l.villalovos@intel.com>
Date: Thu, 17 Aug 2017 13:21:25 -0700
Subject: [PATCH 1090/2409] Correct spelling for 'lose' from 'loose'

We can 'lose' networking configuration, not 'loose' it.

Change-Id: I538270c05da6fce63340cc75ec53c3834efcecfe
---
 doc/source/networking.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/networking.rst b/doc/source/networking.rst
index bdbeaaa7a8..74010cd01a 100644
--- a/doc/source/networking.rst
+++ b/doc/source/networking.rst
@@ -69,7 +69,7 @@ Shared Guest Interface
 
    This is not a recommended configuration. Because of interactions
    between ovs and bridging, if you reboot your box with active
-   networking you may loose network connectivity to your system.
+   networking you may lose network connectivity to your system.
 
 If you need your guests accessible on the network, but only have 1
 interface (using something like a NUC), you can share your one

From af9f71d693cd548b18986e99f58503fa57f815f1 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Fri, 18 Aug 2017 08:21:34 +0000
Subject: [PATCH 1091/2409] Updated from generate-devstack-plugins-list

Change-Id: I4747e03aa29828cba364a5887fada0721c8da56e
---
 doc/source/plugin-registry.rst | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 84a57428d2..35b78da44c 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -110,6 +110,7 @@ networking-fortinet                    `git://git.openstack.org/openstack/networ
 networking-generic-switch              `git://git.openstack.org/openstack/networking-generic-switch <https://git.openstack.org/cgit/openstack/networking-generic-switch>`__
 networking-hpe                         `git://git.openstack.org/openstack/networking-hpe <https://git.openstack.org/cgit/openstack/networking-hpe>`__
 networking-huawei                      `git://git.openstack.org/openstack/networking-huawei <https://git.openstack.org/cgit/openstack/networking-huawei>`__
+networking-hyperv                      `git://git.openstack.org/openstack/networking-hyperv <https://git.openstack.org/cgit/openstack/networking-hyperv>`__
 networking-infoblox                    `git://git.openstack.org/openstack/networking-infoblox <https://git.openstack.org/cgit/openstack/networking-infoblox>`__
 networking-l2gw                        `git://git.openstack.org/openstack/networking-l2gw <https://git.openstack.org/cgit/openstack/networking-l2gw>`__
 networking-midonet                     `git://git.openstack.org/openstack/networking-midonet <https://git.openstack.org/cgit/openstack/networking-midonet>`__
@@ -117,6 +118,7 @@ networking-mlnx                        `git://git.openstack.org/openstack/networ
 networking-nec                         `git://git.openstack.org/openstack/networking-nec <https://git.openstack.org/cgit/openstack/networking-nec>`__
 networking-odl                         `git://git.openstack.org/openstack/networking-odl <https://git.openstack.org/cgit/openstack/networking-odl>`__
 networking-onos                        `git://git.openstack.org/openstack/networking-onos <https://git.openstack.org/cgit/openstack/networking-onos>`__
+networking-opencontrail                `git://git.openstack.org/openstack/networking-opencontrail <https://git.openstack.org/cgit/openstack/networking-opencontrail>`__
 networking-ovn                         `git://git.openstack.org/openstack/networking-ovn <https://git.openstack.org/cgit/openstack/networking-ovn>`__
 networking-ovs-dpdk                    `git://git.openstack.org/openstack/networking-ovs-dpdk <https://git.openstack.org/cgit/openstack/networking-ovs-dpdk>`__
 networking-plumgrid                    `git://git.openstack.org/openstack/networking-plumgrid <https://git.openstack.org/cgit/openstack/networking-plumgrid>`__

From 5158486124814cbf032c0e79413c6f856225fd98 Mon Sep 17 00:00:00 2001
From: Omer Anson <omer.anson@toganetworks.com>
Date: Thu, 24 Aug 2017 17:47:37 +0300
Subject: [PATCH 1092/2409] Add function is_plugin_enabled

Add a function which tests if a plugin has been enabled with
enable_plugin. This is helpful if two co-ordinating projects want to run
specific setup in devstack in one only if the other is enabled.

Change-Id: Ibf113755595b19d028374cdc1c86e19b5170be4f
---
 functions-common | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index 660df795db..a5f770f579 100644
--- a/functions-common
+++ b/functions-common
@@ -1882,7 +1882,7 @@ function enable_plugin {
     local name=$1
     local url=$2
     local branch=${3:-master}
-    if [[ ",${DEVSTACK_PLUGINS}," =~ ,${name}, ]]; then
+    if is_plugin_enabled $name; then
         die $LINENO "Plugin attempted to be enabled twice: ${name} ${url} ${branch}"
     fi
     DEVSTACK_PLUGINS+=",$name"
@@ -1891,6 +1891,19 @@ function enable_plugin {
     GITBRANCH[$name]=$branch
 }
 
+# is_plugin_enabled <name>
+#
+# Check if the plugin was enabled, e.g. using enable_plugin
+#
+# ``name`` The name with which the plugin was enabled
+function is_plugin_enabled {
+    local name=$1
+    if [[ ",${DEVSTACK_PLUGINS}," =~ ",${name}," ]]; then
+        return 0
+    fi
+    return 1
+}
+
 # fetch_plugins
 #
 # clones all plugins

From 6d213dfda7d0c3446595ce9edc56408e3924b355 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 22 Aug 2017 16:05:16 +1000
Subject: [PATCH 1093/2409] Get default python versions from interpreter

Query the python2/python3 interpreter for it's version to fill in
PYTHON3_VERSION and PYTHON2_VERSION defaults.  This means on a
python3.6 platform such as Fedora 26, we don't need to override the
default.

Change-Id: Id826f275b99b9f397b95e817941019fc503daa1d
---
 functions-common | 17 ++++++++++++++++-
 stackrc          |  6 ++++--
 2 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/functions-common b/functions-common
index 660df795db..85054883d5 100644
--- a/functions-common
+++ b/functions-common
@@ -2380,13 +2380,28 @@ function is_provider_network {
 }
 
 
+# Return just the <major>.<minor> for the given python interpreter
+function _get_python_version {
+    local interp=$1
+    local version
+    version=$($interp -c 'import sys; print("%s.%s" % sys.version_info[0:2])')
+    echo ${version}
+}
+
 # Return the current python as "python<major>.<minor>"
 function python_version {
     local python_version
-    python_version=$(python -c 'import sys; print("%s.%s" % sys.version_info[0:2])')
+    python_version=$(_get_python_version python2)
+    echo "python${python_version}"
+}
+
+function python3_version {
+    local python3_version
+    python3_version=$(_get_python_version python3)
     echo "python${python_version}"
 }
 
+
 # Service wrapper to restart services
 # restart_service service-name
 function restart_service {
diff --git a/stackrc b/stackrc
index b123d8ac7c..625ce3f27b 100644
--- a/stackrc
+++ b/stackrc
@@ -153,10 +153,12 @@ export DISABLED_PYTHON3_PACKAGES=""
 # When Python 3 is supported by an application, adding the specific
 # version of Python 3 to this variable will install the app using that
 # version of the interpreter instead of 2.7.
-export PYTHON3_VERSION=${PYTHON3_VERSION:-3.5}
+_DEFAULT_PYTHON3_VERSION="$(_get_python_version python3)"
+export PYTHON3_VERSION=${PYTHON3_VERSION:-${_DEFAULT_PYTHON3_VERSION}}
 
 # Just to be more explicit on the Python 2 version to use.
-export PYTHON2_VERSION=${PYTHON2_VERSION:-2.7}
+_DEFAULT_PYTHON2_VERSION="$(_get_python_version python2)"
+export PYTHON2_VERSION=${PYTHON2_VERSION:-${_DEFAULT_PYTHON2_VERSION}}
 
 # allow local overrides of env variables, including repo config
 if [[ -f $RC_DIR/localrc ]]; then

From 9d7e74e57c73d25e214e0269dbd9d342e8cd960c Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Fri, 25 Aug 2017 10:17:18 -0400
Subject: [PATCH 1094/2409] Setup logging for nova_cell1.conf

When run in the default superconductor mode, the screen-n-cond-cell1
logs are not formatting in oslo format or colorized like the other
logs. This is because screen-n-super-cond is running using nova.conf
which is configured for oslo format logging with color.

The oslo format logging is also needed to correctly index the logs
from screen-n-cond-cell1 in logstash.

This change simply configures nova_cell*.conf files for logging
like nova.conf.

Change-Id: I44fc11f09bb7283be0b068f5e02a424f3e5dafe2
Closes-Bug: #1713070
---
 lib/nova | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/nova b/lib/nova
index fa09fd8fc1..581cd548ff 100644
--- a/lib/nova
+++ b/lib/nova
@@ -602,6 +602,8 @@ function create_nova_conf {
                 rpc_backend_add_vhost $vhost
                 iniset_rpc_backend nova $conf DEFAULT $vhost
             fi
+            # Format logging
+            setup_logging $conf
         done
     fi
 }

From 08367bac0bb46a4ada14ed6b9416d570e976dd9f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?S=C5=82awek=20Kap=C5=82o=C5=84ski?= <slawek@kaplonski.pl>
Date: Sun, 27 Aug 2017 08:44:27 +0000
Subject: [PATCH 1095/2409] Switch from $DEST/data/etcd to $DATA_DIR/etcd

Etcd should use $DATA_DIR/etcd instead of "hardcoded"
$DEST/data/etcd directory for its data.

Change-Id: Icdc65f52a9d75981b63789036248e00d8ab72f11
---
 lib/etcd3 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/etcd3 b/lib/etcd3
index bc24790782..6e32cb31ca 100644
--- a/lib/etcd3
+++ b/lib/etcd3
@@ -26,7 +26,7 @@ set +o xtrace
 # Set up default values for etcd
 ETCD_DOWNLOAD_URL=${ETCD_DOWNLOAD_URL:-https://github.com/coreos/etcd/releases/download}
 ETCD_VERSION=${ETCD_VERSION:-v3.1.7}
-ETCD_DATA_DIR="$DEST/data/etcd"
+ETCD_DATA_DIR="$DATA_DIR/etcd"
 ETCD_SYSTEMD_SERVICE="devstack@etcd.service"
 ETCD_BIN_DIR="$DEST/bin"
 ETCD_SHA256_AMD64="4fde194bbcd259401e2b5c462dfa579ee7f6af539f13f130b8f5b4f52e3b3c52"

From c09eaf8e401b12c7b37f18b79d761876953d54a8 Mon Sep 17 00:00:00 2001
From: Le Hou <houl7@chinaunicom.cn>
Date: Mon, 28 Aug 2017 17:25:38 +0800
Subject: [PATCH 1096/2409] Update OS_AUTH_URL in Configuration.rst

I am a new participant, and when I read the document I found that the command in the OS_AUTH_URL example is v2.0, so I want to update it.

Change-Id: I973adc303a3cb37ce377ca4e31d1d666cd41b358
---
 doc/source/configuration.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 064bf515e6..c4834b7a84 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -136,7 +136,7 @@ OS\_AUTH\_URL
 
     ::
 
-        OS_AUTH_URL=http://$SERVICE_HOST:5000/v2.0
+        OS_AUTH_URL=http://$SERVICE_HOST:5000/v3.0
 
 KEYSTONECLIENT\_DEBUG, NOVACLIENT\_DEBUG
     Set command-line client log level to ``DEBUG``. These are commented

From 787412ce6cf9447733dd8986c07883d791b520b2 Mon Sep 17 00:00:00 2001
From: Dima Kuznetsov <dima.kuznetsov@toganetworks.com>
Date: Mon, 28 Aug 2017 09:09:38 +0300
Subject: [PATCH 1097/2409] tempest: Disable l3_agent_scheduler when running
 without L3 agent

Dragonflow can operate without L3 agent, and does not advertise L3 agent
scheduler extension when running this way

Change-Id: I23d0e558c8454636fcde0a1903c78965b70bc324
---
 lib/tempest | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index cc65ec7aa9..33bd74f7a3 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -574,6 +574,11 @@ function configure_tempest {
         DISABLE_NETWORK_API_EXTENSIONS+=", metering"
     fi
 
+    # disable l3_agent_scheduler if we didn't enable L3 agent
+    if ! is_service_enabled q-l3; then
+        DISABLE_NETWORK_API_EXTENSIONS+=", l3_agent_scheduler"
+    fi
+
     local network_api_extensions=${NETWORK_API_EXTENSIONS:-"all"}
     if [[ ! -z "$DISABLE_NETWORK_API_EXTENSIONS" ]]; then
         # Enabled extensions are either the ones explicitly specified or those available on the API endpoint

From 4639984b96a3ff7be28357ccbd7c8ffa60371c42 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Mon, 28 Aug 2017 11:43:37 +0000
Subject: [PATCH 1098/2409] Update function description for start_tls_proxy

In [1] the definition of the function was changed, adding the service
name as first parameter. Since this seems to have caused failures in
some plugins, at least update the function template accordingly.

[1] Ifcba410f5969521e8b3d30f02795541c1661f83a

Change-Id: I4d03957f8d3a18625f06379fb21aa7ba55e32797
---
 lib/tls | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tls b/lib/tls
index 7bde5e6496..b7ad644f5c 100644
--- a/lib/tls
+++ b/lib/tls
@@ -487,7 +487,7 @@ EOF
 }
 
 # Starts the TLS proxy for the given IP/ports
-# start_tls_proxy front-host front-port back-host back-port
+# start_tls_proxy service-name front-host front-port back-host back-port
 function start_tls_proxy {
     local b_service="$1-tls-proxy"
     local f_host=$2

From 0e58d22897457831b9dbf02d66a2f29d43803597 Mon Sep 17 00:00:00 2001
From: Clay Gerrard <clay.gerrard@gmail.com>
Date: Mon, 28 Aug 2017 14:03:18 -0700
Subject: [PATCH 1099/2409] Create correct directory layout for swift on
 purpose.

The pre-existing configuration for swift on devstack set's the
*-server's devices option (the root of the servers list of devices) to:

    devices = /opt/stack/data/swift/1

where "1" is the node_number, and will be 2, 3, ... N if the devstack
machine is built with more than one swift node/device (pretty sure no
one does that on devstack ever).

The device(s) in the rings are named (perhaps confusingly similar to the
swift loopback image) just "sdb1", so all storage servers expect to have
a $STACK_USER writeable file system at:

    os.path.join(<devices_root>, "sdb1")

That directory does not exist when you start up a devstack [1].

Currently Swift's object-server's require that directory exist before
they write data into it (even with mount_check = false!).

Unfortunately however, with mount_check=false the account/container
servers are able to create the device directory when it does not exist
[2].  Which can lead to some unfortunate results with permissions on
some deployments using mount_check = false (e.g. testing or
containerized environments).  Fixing this issue [3] uncovered the
previously benign [4] mis-configuration in devstack.

Attempting

1. It was lost a long while ago I7c65303791689523f02e5ae44483a6c50b2eed1e
2. Essentially they want to:

    mkdir -p /opt/stack/data/swift/1/sdb1/containers/<part#>

... but end up creating the "sdb1" dir too!
3. I3362a6ebff423016bb367b4b6b322bb41ae08764
4. Benign because the object-server share their device with the
account-container devices and they would create the dirs before trying
to write an object.  It was incorrect, but worked by happenstance, which
is nearly as good as worked on purpose.

Change-Id: I52c4ecb70b1ae47e613ba243da5a4d94e5adedf2
---
 lib/swift | 16 +++++++---------
 1 file changed, 7 insertions(+), 9 deletions(-)

diff --git a/lib/swift b/lib/swift
index 455740ea82..3b87610007 100644
--- a/lib/swift
+++ b/lib/swift
@@ -608,15 +608,13 @@ function create_swift_disk {
     # create all of the directories needed to emulate a few different servers
     local node_number
     for node_number in ${SWIFT_REPLICAS_SEQ}; do
-        sudo ln -sf ${SWIFT_DATA_DIR}/drives/sdb1/$node_number ${SWIFT_DATA_DIR}/$node_number;
-        local drive=${SWIFT_DATA_DIR}/drives/sdb1/${node_number}
-        local node=${SWIFT_DATA_DIR}/${node_number}/node
-        local node_device=${node}/sdb1
-        [[ -d $node ]] && continue
-        [[ -d $drive ]] && continue
-        sudo install -o ${STACK_USER} -g $user_group -d $drive
-        sudo install -o ${STACK_USER} -g $user_group -d $node_device
-        sudo chown -R ${STACK_USER}: ${node}
+        # node_devices must match *.conf devices option
+        local node_devices=${SWIFT_DATA_DIR}/${node_number}
+        local real_devices=${SWIFT_DATA_DIR}/drives/sdb1/$node_number
+        sudo ln -sf $real_devices $node_devices;
+        local device=${real_devices}/sdb1
+        [[ -d $device ]] && continue
+        sudo install -o ${STACK_USER} -g $user_group -d $device
     done
 }
 

From 411c34da69f423059a04431a542be2b1b7a65f38 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Tue, 29 Aug 2017 14:40:26 +0000
Subject: [PATCH 1100/2409] Fix URLs when running with tls-proxy enabled

Various services are returning broken links when running behind
tls-proxy. These issues can be fixed by setting the X-Forwarded-Proto
header in the apache config and letting oslo_middleware parse it.

Change-Id: Ibe5dbdc4644ec812f0435f59319666fc336c195a
Partial-Bug: 1713731
---
 lib/cinder         | 3 +--
 lib/neutron        | 1 +
 lib/neutron-legacy | 1 +
 lib/nova           | 1 +
 lib/tls            | 3 ++-
 5 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 03328f31b6..67939f18e9 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -296,8 +296,7 @@ function configure_cinder {
             # Set the service port for a proxy to take the original
             if [ "$CINDER_USE_MOD_WSGI" == "True" ]; then
                 iniset $CINDER_CONF DEFAULT osapi_volume_listen_port $CINDER_SERVICE_PORT_INT
-                iniset $CINDER_CONF DEFAULT public_endpoint $CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST
-                iniset $CINDER_CONF DEFAULT osapi_volume_base_URL $CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST
+                iniset $CINDER_CONF oslo_middleware enable_proxy_headers_parsing True
             else
                 iniset $CINDER_CONF DEFAULT osapi_volume_listen_port $CINDER_SERVICE_PORT_INT
                 iniset $CINDER_CONF DEFAULT public_endpoint $CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT
diff --git a/lib/neutron b/lib/neutron
index 2a660ec8e1..92c585a70f 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -242,6 +242,7 @@ function configure_neutron_new {
     if is_service_enabled tls-proxy; then
         # Set the service port for a proxy to take the original
         iniset $NEUTRON_CONF DEFAULT bind_port "$NEUTRON_SERVICE_PORT_INT"
+        iniset $NEUTRON_CONF oslo_middleware enable_proxy_headers_parsing True
     fi
 
     # Metering
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 784f3a8167..f9e0bd6ded 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -718,6 +718,7 @@ function _configure_neutron_common {
     if is_service_enabled tls-proxy; then
         # Set the service port for a proxy to take the original
         iniset $NEUTRON_CONF DEFAULT bind_port "$Q_PORT_INT"
+        iniset $NEUTRON_CONF oslo_middleware enable_proxy_headers_parsing True
     fi
 
     _neutron_setup_rootwrap
diff --git a/lib/nova b/lib/nova
index fa09fd8fc1..887a70d475 100644
--- a/lib/nova
+++ b/lib/nova
@@ -555,6 +555,7 @@ function create_nova_conf {
 
     if is_service_enabled tls-proxy; then
         iniset $NOVA_CONF DEFAULT glance_protocol https
+        iniset $NOVA_CONF oslo_middleware enable_proxy_headers_parsing True
     fi
 
     if is_service_enabled n-sproxy; then
diff --git a/lib/tls b/lib/tls
index 7bde5e6496..5bf5d96ede 100644
--- a/lib/tls
+++ b/lib/tls
@@ -527,6 +527,7 @@ $listen_string
     # for swift functional testing to work with tls enabled. It is 2 bytes
     # larger than the apache default of 8190.
     LimitRequestFieldSize $f_header_size
+    RequestHeader set X-Forwarded-Proto "https"
 
     <Location />
         ProxyPass http://$b_host:$b_port/ retry=0 nocanon
@@ -541,7 +542,7 @@ EOF
     if is_suse ; then
         sudo a2enflag SSL
     fi
-    for mod in ssl proxy proxy_http; do
+    for mod in headers ssl proxy proxy_http; do
         enable_apache_mod $mod
     done
     enable_apache_site $b_service

From 81f67fd7eb33fe3b197dd9b337d900a2271963b9 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Tue, 29 Aug 2017 09:52:58 +0000
Subject: [PATCH 1101/2409] Delete the default guest user from rabbitmq

Leaving the default user enabled is a security issue, as it can be used
without credentials. It also may mask issues like seen in [1].

[1] https://bugs.launchpad.net/bugs/1651576

Change-Id: I75b4e5696c0f8017b869127a10f3c14e2f8bd121
---
 lib/rpc_backend | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/rpc_backend b/lib/rpc_backend
index 3177e88ef2..5479db3333 100644
--- a/lib/rpc_backend
+++ b/lib/rpc_backend
@@ -97,6 +97,8 @@ function restart_rpc_backend {
 
             break
         done
+        # NOTE(frickler): Remove the default guest user
+        sudo rabbitmqctl delete_user guest || true
     fi
 }
 

From f96f675ddb6448d3e4ab0114935e79690f88b4c6 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Wed, 30 Aug 2017 09:27:06 +0000
Subject: [PATCH 1102/2409] Updated from generate-devstack-plugins-list

Change-Id: I0dae4374fcfc05ae883d782635954dbd8268accd
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 35b78da44c..a1d5ad822b 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -147,6 +147,7 @@ osprofiler                             `git://git.openstack.org/openstack/osprof
 panko                                  `git://git.openstack.org/openstack/panko <https://git.openstack.org/cgit/openstack/panko>`__
 patrole                                `git://git.openstack.org/openstack/patrole <https://git.openstack.org/cgit/openstack/patrole>`__
 picasso                                `git://git.openstack.org/openstack/picasso <https://git.openstack.org/cgit/openstack/picasso>`__
+qinling                                `git://git.openstack.org/openstack/qinling <https://git.openstack.org/cgit/openstack/qinling>`__
 rally                                  `git://git.openstack.org/openstack/rally <https://git.openstack.org/cgit/openstack/rally>`__
 sahara                                 `git://git.openstack.org/openstack/sahara <https://git.openstack.org/cgit/openstack/sahara>`__
 sahara-dashboard                       `git://git.openstack.org/openstack/sahara-dashboard <https://git.openstack.org/cgit/openstack/sahara-dashboard>`__

From def67a47e80c1ed1ed8f1bdcf105563935f6d921 Mon Sep 17 00:00:00 2001
From: Sam Betts <sam@code-smash.net>
Date: Wed, 30 Aug 2017 11:39:16 +0100
Subject: [PATCH 1103/2409] Stop using ironic host manager with resource
 classes

There should be no needs to use the ironic host manager when using
resource classes.

Change-Id: I9a51ea6582dfef28e4da5f8510742230d88cbaf3
---
 lib/nova_plugins/hypervisor-ironic | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova_plugins/hypervisor-ironic b/lib/nova_plugins/hypervisor-ironic
index 062afb7f7c..ebb6a31541 100644
--- a/lib/nova_plugins/hypervisor-ironic
+++ b/lib/nova_plugins/hypervisor-ironic
@@ -41,9 +41,9 @@ function configure_nova_hypervisor {
 
     iniset $NOVA_CONF DEFAULT compute_driver ironic.IronicDriver
     iniset $NOVA_CONF DEFAULT firewall_driver $LIBVIRT_FIREWALL_DRIVER
-    iniset $NOVA_CONF DEFAULT scheduler_host_manager ironic_host_manager
 
     if [[ "$IRONIC_USE_RESOURCE_CLASSES" == "False" ]]; then
+        iniset $NOVA_CONF DEFAULT scheduler_host_manager ironic_host_manager
         iniset $NOVA_CONF filter_scheduler use_baremetal_filters True
     fi
 

From b79be36cdb9e0368d7976e0876ee1273110d5b5c Mon Sep 17 00:00:00 2001
From: Vladyslav Drok <vdrok@mirantis.com>
Date: Wed, 30 Aug 2017 19:19:56 +0300
Subject: [PATCH 1104/2409] Remove setting some of the scheduler settings

It makes sense to set them only if resource classes are not used.

Change-Id: I76d8501a1d1a20357acadad4cd8f2d6cef3896c1
---
 lib/nova_plugins/hypervisor-ironic | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/lib/nova_plugins/hypervisor-ironic b/lib/nova_plugins/hypervisor-ironic
index 062afb7f7c..034e403768 100644
--- a/lib/nova_plugins/hypervisor-ironic
+++ b/lib/nova_plugins/hypervisor-ironic
@@ -45,12 +45,11 @@ function configure_nova_hypervisor {
 
     if [[ "$IRONIC_USE_RESOURCE_CLASSES" == "False" ]]; then
         iniset $NOVA_CONF filter_scheduler use_baremetal_filters True
+        iniset $NOVA_CONF filter_scheduler host_subset_size 999
+        iniset $NOVA_CONF DEFAULT ram_allocation_ratio 1.0
+        iniset $NOVA_CONF DEFAULT reserved_host_memory_mb 0
     fi
 
-    iniset $NOVA_CONF filter_scheduler host_subset_size 999
-
-    iniset $NOVA_CONF DEFAULT ram_allocation_ratio 1.0
-    iniset $NOVA_CONF DEFAULT reserved_host_memory_mb 0
     # ironic section
     iniset $NOVA_CONF ironic auth_type password
     iniset $NOVA_CONF ironic username admin

From 52609c684af195b84d99473cfb7d286a972e334e Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Mon, 28 Aug 2017 11:49:28 +0000
Subject: [PATCH 1105/2409] Fix errors in tls-proxy startup for cinder

Two typos made starting tls-proxy fail when CINDER_USE_MOD_WSGI is
False.

Change-Id: I0435282182087a36d987843699152c1c08c4a494
---
 lib/cinder | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 03328f31b6..71b0683d75 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -506,9 +506,9 @@ function start_cinder {
         if [ "$CINDER_USE_MOD_WSGI" == "False" ]; then
             run_process c-api "$CINDER_BIN_DIR/cinder-api --config-file $CINDER_CONF"
             cinder_url=$service_protocol://$SERVICE_HOST:$service_port
-            # Start proxy if tsl enabled
-            if is_service_enabled tls_proxy; then
-                start_tls_proxy cinder '*' $CINDER_SERVICE_PORT $CINDER_SERVICE_HOST $CINDER_SERVICE_POR_INT
+            # Start proxy if tls enabled
+            if is_service_enabled tls-proxy; then
+                start_tls_proxy cinder '*' $CINDER_SERVICE_PORT $CINDER_SERVICE_HOST $CINDER_SERVICE_PORT_INT
             fi
         else
             run_process "c-api" "$CINDER_BIN_DIR/uwsgi --ini $CINDER_UWSGI_CONF"

From cdba1b371628aa0e8bc5b687351c5ee9b39e9bc6 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 30 Aug 2017 11:11:06 -0400
Subject: [PATCH 1106/2409] Remove screen support from devstack completely

This tears out the alternative path of using screen, so that we only
use systemd enabled paths. This simplifies the number of ways that
devstack can be run, and provides a much more reliable process
launcher than the screen based approach.

Change-Id: I8c27182f60b0f5310b3a8bf5feb02beb7ffbb26a
---
 files/debs/general      |   1 -
 files/rpms-suse/general |   1 -
 files/rpms/general      |   1 -
 functions-common        | 341 ++--------------------------------------
 lib/nova                |   4 -
 stack.sh                |  60 -------
 stackrc                 |  60 +------
 tests/run-process.sh    | 109 -------------
 unstack.sh              |   9 --
 9 files changed, 15 insertions(+), 571 deletions(-)
 delete mode 100755 tests/run-process.sh

diff --git a/files/debs/general b/files/debs/general
index 1dde03b7fe..8e0018d284 100644
--- a/files/debs/general
+++ b/files/debs/general
@@ -29,7 +29,6 @@ psmisc
 python2.7
 python-dev
 python-gdbm # needed for testr
-screen
 tar
 tcpdump
 unzip
diff --git a/files/rpms-suse/general b/files/rpms-suse/general
index 370f2409f7..0c1a2819b1 100644
--- a/files/rpms-suse/general
+++ b/files/rpms-suse/general
@@ -24,7 +24,6 @@ psmisc
 python-cmd2 # dist:opensuse-12.3
 python-devel  # pyOpenSSL
 python-xml
-screen
 systemd-devel # for systemd-python
 tar
 tcpdump
diff --git a/files/rpms/general b/files/rpms/general
index 2443cc8cd7..f3f870823c 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -28,7 +28,6 @@ psmisc
 pyOpenSSL # version in pip uses too much memory
 python-devel
 redhat-rpm-config # missing dep for gcc hardening flags, see rhbz#1217376
-screen
 systemd-devel # for systemd-python
 tar
 tcpdump
diff --git a/functions-common b/functions-common
index 660df795db..fdbb9c067e 100644
--- a/functions-common
+++ b/functions-common
@@ -1380,62 +1380,6 @@ function zypper_install {
         zypper --non-interactive install --auto-agree-with-licenses "$@"
 }
 
-
-# Process Functions
-# =================
-
-# _run_process() is designed to be backgrounded by run_process() to simulate a
-# fork.  It includes the dirty work of closing extra filehandles and preparing log
-# files to produce the same logs as screen_it().  The log filename is derived
-# from the service name.
-# Uses globals ``CURRENT_LOG_TIME``, ``LOGDIR``, ``SCREEN_LOGDIR``, ``SCREEN_NAME``, ``SERVICE_DIR``
-# If an optional group is provided sg will be used to set the group of
-# the command.
-# _run_process service "command-line" [group]
-function _run_process {
-    # disable tracing through the exec redirects, it's just confusing in the logs.
-    xtrace=$(set +o | grep xtrace)
-    set +o xtrace
-
-    local service=$1
-    local command="$2"
-    local group=$3
-
-    # Undo logging redirections and close the extra descriptors
-    exec 1>&3
-    exec 2>&3
-    exec 3>&-
-    exec 6>&-
-
-    local logfile="${service}.log.${CURRENT_LOG_TIME}"
-    local real_logfile="${LOGDIR}/${logfile}"
-    if [[ -n ${LOGDIR} ]]; then
-        exec 1>&"$real_logfile" 2>&1
-        bash -c "cd '$LOGDIR' && ln -sf '$logfile' ${service}.log"
-        if [[ -n ${SCREEN_LOGDIR} ]]; then
-            # Drop the backward-compat symlink
-            ln -sf "$real_logfile" ${SCREEN_LOGDIR}/screen-${service}.log
-        fi
-
-        # TODO(dtroyer): Hack to get stdout from the Python interpreter for the logs.
-        export PYTHONUNBUFFERED=1
-    fi
-
-    # reenable xtrace before we do *real* work
-    $xtrace
-
-    # Run under ``setsid`` to force the process to become a session and group leader.
-    # The pid saved can be used with pkill -g to get the entire process group.
-    if [[ -n "$group" ]]; then
-        setsid sg $group "$command" & echo $! >$SERVICE_DIR/$SCREEN_NAME/$service.pid
-    else
-        setsid $command & echo $! >$SERVICE_DIR/$SCREEN_NAME/$service.pid
-    fi
-
-    # Just silently exit this process
-    exit 0
-}
-
 function write_user_unit_file {
     local service=$1
     local command="$2"
@@ -1535,21 +1479,6 @@ function _run_under_systemd {
     $SYSTEMCTL start $systemd_service
 }
 
-# Helper to remove the ``*.failure`` files under ``$SERVICE_DIR/$SCREEN_NAME``.
-# This is used for ``service_check`` when all the ``screen_it`` are called finished
-# Uses globals ``SCREEN_NAME``, ``SERVICE_DIR``
-# init_service_check
-function init_service_check {
-    SCREEN_NAME=${SCREEN_NAME:-stack}
-    SERVICE_DIR=${SERVICE_DIR:-${DEST}/status}
-
-    if [[ ! -d "$SERVICE_DIR/$SCREEN_NAME" ]]; then
-        mkdir -p "$SERVICE_DIR/$SCREEN_NAME"
-    fi
-
-    rm -f "$SERVICE_DIR/$SCREEN_NAME"/*.failure
-}
-
 # Find out if a process exists by partial name.
 # is_running name
 function is_running {
@@ -1576,135 +1505,11 @@ function run_process {
 
     time_start "run_process"
     if is_service_enabled $service; then
-        if [[ "$USE_SYSTEMD" = "True" ]]; then
-            _run_under_systemd "$name" "$command" "$group" "$user"
-        elif [[ "$USE_SCREEN" = "True" ]]; then
-            if [[ "$user" == "root" ]]; then
-                command="sudo $command"
-            fi
-            screen_process "$name" "$command" "$group"
-        else
-            # Spawn directly without screen
-            if [[ "$user" == "root" ]]; then
-                command="sudo $command"
-            fi
-            _run_process "$name" "$command" "$group" &
-        fi
+        _run_under_systemd "$name" "$command" "$group" "$user"
     fi
     time_stop "run_process"
 }
 
-# Helper to launch a process in a named screen
-# Uses globals ``CURRENT_LOG_TIME``, ```LOGDIR``, ``SCREEN_LOGDIR``, `SCREEN_NAME``,
-# ``SERVICE_DIR``, ``SCREEN_IS_LOGGING``
-# screen_process name "command-line" [group]
-# Run a command in a shell in a screen window, if an optional group
-# is provided, use sg to set the group of the command.
-function screen_process {
-    local name=$1
-    local command="$2"
-    local group=$3
-
-    SCREEN_NAME=${SCREEN_NAME:-stack}
-    SERVICE_DIR=${SERVICE_DIR:-${DEST}/status}
-
-    screen -S $SCREEN_NAME -X screen -t $name
-
-    local logfile="${name}.log.${CURRENT_LOG_TIME}"
-    local real_logfile="${LOGDIR}/${logfile}"
-    echo "LOGDIR: $LOGDIR"
-    echo "SCREEN_LOGDIR: $SCREEN_LOGDIR"
-    echo "log: $real_logfile"
-    if [[ -n ${LOGDIR} ]]; then
-        if [[ "$SCREEN_IS_LOGGING" == "True" ]]; then
-            screen -S $SCREEN_NAME -p $name -X logfile "$real_logfile"
-            screen -S $SCREEN_NAME -p $name -X log on
-        fi
-        # If logging isn't active then avoid a broken symlink
-        touch "$real_logfile"
-        bash -c "cd '$LOGDIR' && ln -sf '$logfile' ${name}.log"
-        if [[ -n ${SCREEN_LOGDIR} ]]; then
-            # Drop the backward-compat symlink
-            ln -sf "$real_logfile" ${SCREEN_LOGDIR}/screen-${1}.log
-        fi
-    fi
-
-    # sleep to allow bash to be ready to be send the command - we are
-    # creating a new window in screen and then sends characters, so if
-    # bash isn't running by the time we send the command, nothing
-    # happens.  This sleep was added originally to handle gate runs
-    # where we needed this to be at least 3 seconds to pass
-    # consistently on slow clouds. Now this is configurable so that we
-    # can determine a reasonable value for the local case which should
-    # be much smaller.
-    sleep ${SCREEN_SLEEP:-3}
-
-    NL=`echo -ne '\015'`
-    # This fun command does the following:
-    # - the passed server command is backgrounded
-    # - the pid of the background process is saved in the usual place
-    # - the server process is brought back to the foreground
-    # - if the server process exits prematurely the fg command errors
-    # and a message is written to stdout and the process failure file
-    #
-    # The pid saved can be used in stop_process() as a process group
-    # id to kill off all child processes
-    if [[ -n "$group" ]]; then
-        command="sg $group '$command'"
-    fi
-
-    # Append the process to the screen rc file
-    screen_rc "$name" "$command"
-
-    screen -S $SCREEN_NAME -p $name -X stuff "$command & echo \$! >$SERVICE_DIR/$SCREEN_NAME/${name}.pid; fg || echo \"$name failed to start. Exit code: \$?\" | tee \"$SERVICE_DIR/$SCREEN_NAME/${name}.failure\"$NL"
-}
-
-# Screen rc file builder
-# Uses globals ``SCREEN_NAME``, ``SCREENRC``, ``SCREEN_IS_LOGGING``
-# screen_rc service "command-line"
-function screen_rc {
-    SCREEN_NAME=${SCREEN_NAME:-stack}
-    SCREENRC=$TOP_DIR/$SCREEN_NAME-screenrc
-    if [[ ! -e $SCREENRC ]]; then
-        # Name the screen session
-        echo "sessionname $SCREEN_NAME" > $SCREENRC
-        # Set a reasonable statusbar
-        echo "hardstatus alwayslastline '$SCREEN_HARDSTATUS'" >> $SCREENRC
-        # Some distributions override PROMPT_COMMAND for the screen terminal type - turn that off
-        echo "setenv PROMPT_COMMAND /bin/true" >> $SCREENRC
-        echo "screen -t shell bash" >> $SCREENRC
-    fi
-    # If this service doesn't already exist in the screenrc file
-    if ! grep $1 $SCREENRC 2>&1 > /dev/null; then
-        NL=`echo -ne '\015'`
-        echo "screen -t $1 bash" >> $SCREENRC
-        echo "stuff \"$2$NL\"" >> $SCREENRC
-
-        if [[ -n ${LOGDIR} ]] && [[ "$SCREEN_IS_LOGGING" == "True" ]]; then
-            echo "logfile ${LOGDIR}/${1}.log.${CURRENT_LOG_TIME}" >>$SCREENRC
-            echo "log on" >>$SCREENRC
-        fi
-    fi
-}
-
-# Stop a service in screen
-# If a PID is available use it, kill the whole process group via TERM
-# If screen is being used kill the screen window; this will catch processes
-# that did not leave a PID behind
-# Uses globals ``SCREEN_NAME``, ``SERVICE_DIR``
-# screen_stop_service service
-function screen_stop_service {
-    local service=$1
-
-    SCREEN_NAME=${SCREEN_NAME:-stack}
-    SERVICE_DIR=${SERVICE_DIR:-${DEST}/status}
-
-    if is_service_enabled $service; then
-        # Clean up the screen window
-        screen -S $SCREEN_NAME -p $service -X kill || true
-    fi
-}
-
 # Stop a service process
 # If a PID is available use it, kill the whole process group via TERM
 # If screen is being used kill the screen window; this will catch processes
@@ -1724,150 +1529,28 @@ function stop_process {
             $SYSTEMCTL stop devstack@$service.service
             $SYSTEMCTL disable devstack@$service.service
         fi
-
-        if [[ -r $SERVICE_DIR/$SCREEN_NAME/$service.pid ]]; then
-            pkill -g $(cat $SERVICE_DIR/$SCREEN_NAME/$service.pid)
-            # oslo.service tends to stop actually shutting down
-            # reliably in between releases because someone believes it
-            # is dying too early due to some inflight work they
-            # have. This is a tension. It happens often enough we're
-            # going to just account for it in devstack and assume it
-            # doesn't work.
-            #
-            # Set OSLO_SERVICE_WORKS=True to skip this block
-            if [[ -z "$OSLO_SERVICE_WORKS" ]]; then
-                # TODO(danms): Remove this double-kill when we have
-                # this fixed in all services:
-                # https://bugs.launchpad.net/oslo-incubator/+bug/1446583
-                sleep 1
-                # /bin/true because pkill on a non existent process returns an error
-                pkill -g $(cat $SERVICE_DIR/$SCREEN_NAME/$service.pid) || /bin/true
-            fi
-            rm $SERVICE_DIR/$SCREEN_NAME/$service.pid
-        fi
-        if [[ "$USE_SCREEN" = "True" ]]; then
-            # Clean up the screen window
-            screen_stop_service $service
-        fi
     fi
 }
 
-# Helper to get the status of each running service
-# Uses globals ``SCREEN_NAME``, ``SERVICE_DIR``
-# service_check
+# use systemctl to check service status
 function service_check {
     local service
-    local failures
-    SCREEN_NAME=${SCREEN_NAME:-stack}
-    SERVICE_DIR=${SERVICE_DIR:-${DEST}/status}
-
-
-    if [[ ! -d "$SERVICE_DIR/$SCREEN_NAME" ]]; then
-        echo "No service status directory found"
-        return
-    fi
-
-    # Check if there is any failure flag file under $SERVICE_DIR/$SCREEN_NAME
-    # make this -o errexit safe
-    failures=`ls "$SERVICE_DIR/$SCREEN_NAME"/*.failure 2>/dev/null || /bin/true`
-
-    for service in $failures; do
-        service=`basename $service`
-        service=${service%.failure}
-        echo "Error: Service $service is not running"
+    for service in ${ENABLED_SERVICES//,/ }; do
+        # because some things got renamed like key => keystone
+        if $SYSTEMCTL is-enabled devstack@$service.service; then
+            # no-pager is needed because otherwise status dumps to a
+            # pager when in interactive mode, which will stop a manual
+            # devstack run.
+            $SYSTEMCTL status devstack@$service.service --no-pager
+        fi
     done
-
-    if [ -n "$failures" ]; then
-        die $LINENO "More details about the above errors can be found with screen"
-    fi
-}
-
-# Tail a log file in a screen if USE_SCREEN is true.
-# Uses globals ``USE_SCREEN``
-function tail_log {
-    local name=$1
-    local logfile=$2
-
-    if [[ "$USE_SCREEN" = "True" ]]; then
-        screen_process "$name" "sudo tail -f $logfile | sed -u 's/\\\\\\\\x1b/\o033/g'"
-    fi
-}
-
-
-# Deprecated Functions
-# --------------------
-
-# _old_run_process() is designed to be backgrounded by old_run_process() to simulate a
-# fork.  It includes the dirty work of closing extra filehandles and preparing log
-# files to produce the same logs as screen_it().  The log filename is derived
-# from the service name and global-and-now-misnamed ``SCREEN_LOGDIR``
-# Uses globals ``CURRENT_LOG_TIME``, ``SCREEN_LOGDIR``, ``SCREEN_NAME``, ``SERVICE_DIR``
-# _old_run_process service "command-line"
-function _old_run_process {
-    local service=$1
-    local command="$2"
-
-    # Undo logging redirections and close the extra descriptors
-    exec 1>&3
-    exec 2>&3
-    exec 3>&-
-    exec 6>&-
-
-    if [[ -n ${SCREEN_LOGDIR} ]]; then
-        exec 1>&${SCREEN_LOGDIR}/screen-${1}.log.${CURRENT_LOG_TIME} 2>&1
-        ln -sf ${SCREEN_LOGDIR}/screen-${1}.log.${CURRENT_LOG_TIME} ${SCREEN_LOGDIR}/screen-${1}.log
-
-        # TODO(dtroyer): Hack to get stdout from the Python interpreter for the logs.
-        export PYTHONUNBUFFERED=1
-    fi
-
-    exec /bin/bash -c "$command"
-    die "$service exec failure: $command"
-}
-
-# old_run_process() launches a child process that closes all file descriptors and
-# then exec's the passed in command.  This is meant to duplicate the semantics
-# of screen_it() without screen.  PIDs are written to
-# ``$SERVICE_DIR/$SCREEN_NAME/$service.pid`` by the spawned child process.
-# old_run_process service "command-line"
-function old_run_process {
-    local service=$1
-    local command="$2"
-
-    # Spawn the child process
-    _old_run_process "$service" "$command" &
-    echo $!
 }
 
-# Compatibility for existing start_XXXX() functions
-# Uses global ``USE_SCREEN``
-# screen_it service "command-line"
-function screen_it {
-    if is_service_enabled $1; then
-        # Append the service to the screen rc file
-        screen_rc "$1" "$2"
-
-        if [[ "$USE_SCREEN" = "True" ]]; then
-            screen_process "$1" "$2"
-        else
-            # Spawn directly without screen
-            old_run_process "$1" "$2" >$SERVICE_DIR/$SCREEN_NAME/$1.pid
-        fi
-    fi
-}
 
-# Compatibility for existing stop_XXXX() functions
-# Stop a service in screen
-# If a PID is available use it, kill the whole process group via TERM
-# If screen is being used kill the screen window; this will catch processes
-# that did not leave a PID behind
-# screen_stop service
-function screen_stop {
-    # Clean up the screen window
-    stop_process $1
+function tail_log {
+    deprecated "With the removal of screen support, tail_log is deprecated and will be removed after Queens"
 }
 
-
 # Plugin Functions
 # =================
 
diff --git a/lib/nova b/lib/nova
index 581cd548ff..bd6695afdf 100644
--- a/lib/nova
+++ b/lib/nova
@@ -573,10 +573,6 @@ function create_nova_conf {
         if [[ -n ${LOGDIR} ]]; then
             bash -c "cd '$LOGDIR' && ln -sf '$logfile' ${service}.log"
             iniset "$NOVA_CONF_DIR/nova-dhcpbridge.conf" DEFAULT log_file "$real_logfile"
-            if [[ -n ${SCREEN_LOGDIR} ]]; then
-                # Drop the backward-compat symlink
-                ln -sf "$real_logfile" ${SCREEN_LOGDIR}/screen-${service}.log
-            fi
         fi
 
         iniset $NOVA_CONF DEFAULT dhcpbridge_flagfile "$NOVA_CONF_DIR/nova-dhcpbridge.conf"
diff --git a/stack.sh b/stack.sh
index 301e1e7c6b..6e930ad234 100755
--- a/stack.sh
+++ b/stack.sh
@@ -228,16 +228,6 @@ if [[ ! ${DISTRO} =~ (xenial|yakkety|zesty|stretch|jessie|f24|f25|f26|opensuse-4
     fi
 fi
 
-# Check to see if we are already running DevStack
-# Note that this may fail if USE_SCREEN=False
-if type -p screen > /dev/null && screen -ls | egrep -q "[0-9]\.$SCREEN_NAME"; then
-    echo "You are already running a stack.sh session."
-    echo "To rejoin this session type 'screen -x stack'."
-    echo "To destroy this session, type './unstack.sh'."
-    exit 1
-fi
-
-
 # Local Settings
 # --------------
 
@@ -491,24 +481,6 @@ else
     exec 6> >( $TOP_DIR/tools/outfilter.py -v >&3 )
 fi
 
-# Set up logging of screen windows
-# Set ``SCREEN_LOGDIR`` to turn on logging of screen windows to the
-# directory specified in ``SCREEN_LOGDIR``, we will log to the file
-# ``screen-$SERVICE_NAME-$TIMESTAMP.log`` in that dir and have a link
-# ``screen-$SERVICE_NAME.log`` to the latest log file.
-# Logs are kept for as long specified in ``LOGDAYS``.
-# This is deprecated....logs go in ``LOGDIR``, only symlinks will be here now.
-if [[ -n "$SCREEN_LOGDIR" ]]; then
-
-    # We make sure the directory is created.
-    if [[ -d "$SCREEN_LOGDIR" ]]; then
-        # We cleanup the old logs
-        find $SCREEN_LOGDIR -maxdepth 1 -name screen-\*.log -mtime +$LOGDAYS -exec rm {} \;
-    else
-        mkdir -p $SCREEN_LOGDIR
-    fi
-fi
-
 # Basic test for ``$DEST`` path permissions (fatal on error unless skipped)
 check_path_perm_sanity ${DEST}
 
@@ -1015,38 +987,6 @@ if is_service_enabled $DATABASE_BACKENDS; then
     configure_database
 fi
 
-
-# Configure screen
-# ----------------
-
-USE_SCREEN=$(trueorfalse True USE_SCREEN)
-if [[ "$USE_SCREEN" == "True" ]]; then
-    # Create a new named screen to run processes in
-    screen -d -m -S $SCREEN_NAME -t shell -s /bin/bash
-    sleep 1
-
-    # Set a reasonable status bar
-    SCREEN_HARDSTATUS=${SCREEN_HARDSTATUS:-}
-    if [ -z "$SCREEN_HARDSTATUS" ]; then
-        SCREEN_HARDSTATUS='%{= .} %-Lw%{= .}%> %n%f %t*%{= .}%+Lw%< %-=%{g}(%{d}%H/%l%{g})'
-    fi
-    screen -r $SCREEN_NAME -X hardstatus alwayslastline "$SCREEN_HARDSTATUS"
-    screen -r $SCREEN_NAME -X setenv PROMPT_COMMAND /bin/true
-
-    if is_service_enabled tls-proxy; then
-        follow_tls_proxy
-    fi
-fi
-
-# Clear ``screenrc`` file
-SCREENRC=$TOP_DIR/$SCREEN_NAME-screenrc
-if [[ -e $SCREENRC ]]; then
-    rm -f $SCREENRC
-fi
-
-# Initialize the directory for service status check
-init_service_check
-
 # Save configuration values
 save_stackenv $LINENO
 
diff --git a/stackrc b/stackrc
index b123d8ac7c..787ae28a29 100644
--- a/stackrc
+++ b/stackrc
@@ -88,22 +88,9 @@ CELLSV2_SETUP=${CELLSV2_SETUP:-"superconductor"}
 # Set the root URL for Horizon
 HORIZON_APACHE_ROOT="/dashboard"
 
-# TODO(sdague): Queens
-#
-# All the non systemd paths should be removed in queens, they only
-# exist in Pike to support testing from grenade. Ensure that all this
-# is cleaned up and purged, which should dramatically simplify the
-# devstack codebase.
-
-# Whether to use 'dev mode' for screen windows. Dev mode works by
-# stuffing text into the screen windows so that a developer can use
-# ctrl-c, up-arrow, enter to restart the service. Starting services
-# this way is slightly unreliable, and a bit slower, so this can
-# be disabled for automated testing by setting this value to False.
-USE_SCREEN=$(trueorfalse False USE_SCREEN)
-
-# Whether to use SYSTEMD to manage services
-USE_SYSTEMD=$(trueorfalse False USE_SYSTEMD)
+# Whether to use SYSTEMD to manage services, we only do this from
+# Queens forward.
+USE_SYSTEMD="True"
 USER_UNITS=$(trueorfalse False USER_UNITS)
 if [[ "$USER_UNITS" == "True" ]]; then
     SYSTEMD_DIR="$HOME/.local/share/systemd/user"
@@ -122,16 +109,6 @@ fi
 # memory constrained than CPU bound.
 ENABLE_KSM=$(trueorfalse True ENABLE_KSM)
 
-# When using screen, should we keep a log file on disk?  You might
-# want this False if you have a long-running setup where verbose logs
-# can fill-up the host.
-# XXX: Ideally screen itself would be configured to log but just not
-# activate.  This isn't possible with the screerc syntax.  Temporary
-# logging can still be used by a developer with:
-#    C-a : logfile foo
-#    C-a : log on
-SCREEN_IS_LOGGING=$(trueorfalse True SCREEN_IS_LOGGING)
-
 # Passwords generated by interactive devstack runs
 if [[ -r $RC_DIR/.localrc.password ]]; then
     source $RC_DIR/.localrc.password
@@ -167,16 +144,6 @@ elif [[ -f $RC_DIR/.localrc.auto ]]; then
     source $RC_DIR/.localrc.auto
 fi
 
-# TODO(sdague): Delete all this in Queens.
-if [[ "$USE_SYSTEMD" == "True" ]]; then
-    USE_SCREEN=False
-fi
-# if we are forcing off USE_SCREEN (as we do in the gate), force on
-# systemd. This allows us to drop one of 3 paths through the code.
-if [[ "$USE_SCREEN" == "False" ]]; then
-    USE_SYSTEMD="True"
-fi
-
 # Default for log coloring is based on interactive-or-not.
 # Baseline assumption is that non-interactive invocations are for CI,
 # where logs are to be presented as browsable text files; hence color
@@ -755,9 +722,6 @@ PUBLIC_NETWORK_NAME=${PUBLIC_NETWORK_NAME:-"public"}
 
 PUBLIC_INTERFACE=${PUBLIC_INTERFACE:-""}
 
-# Set default screen name
-SCREEN_NAME=${SCREEN_NAME:-stack}
-
 # Allow the use of an alternate protocol (such as https) for service endpoints
 SERVICE_PROTOCOL=${SERVICE_PROTOCOL:-http}
 
@@ -877,15 +841,6 @@ RECREATE_KEYSTONE_DB=$(trueorfalse True RECREATE_KEYSTONE_DB)
 
 # Following entries need to be last items in file
 
-# Compatibility bits required by other callers like Grenade
-
-# Old way was using SCREEN_LOGDIR to locate those logs and LOGFILE for the stack.sh trace log.
-# LOGFILE       SCREEN_LOGDIR       output
-# not set       not set             no log files
-# set           not set             stack.sh log to LOGFILE
-# not set       set                 screen logs to SCREEN_LOGDIR
-# set           set                 stack.sh log to LOGFILE, screen logs to SCREEN_LOGDIR
-
 # New way is LOGDIR for all logs and LOGFILE for stack.sh trace log, but if not fully-qualified will be in LOGDIR
 # LOGFILE       LOGDIR              output
 # not set       not set             (new) set LOGDIR from default
@@ -893,9 +848,6 @@ RECREATE_KEYSTONE_DB=$(trueorfalse True RECREATE_KEYSTONE_DB)
 # not set       set                 screen logs to LOGDIR
 # set           set                 stack.sh log to LOGFILE, screen logs to LOGDIR
 
-# For compat, if SCREEN_LOGDIR is set, it will be used to create back-compat symlinks to the LOGDIR
-# symlinks to SCREEN_LOGDIR (compat)
-
 # Set up new logging defaults
 if [[ -z "${LOGDIR:-}" ]]; then
     default_logdir=$DEST/logs
@@ -910,12 +862,6 @@ if [[ -z "${LOGDIR:-}" ]]; then
             # LOGFILE had no path, set a default
             LOGDIR="$default_logdir"
         fi
-
-        # Check for duplication
-        if [[ "${SCREEN_LOGDIR:-}" == "${LOGDIR}" ]]; then
-            # We don't need the symlinks since it's the same directory
-            unset SCREEN_LOGDIR
-        fi
     fi
     unset default_logdir logfile
 fi
diff --git a/tests/run-process.sh b/tests/run-process.sh
deleted file mode 100755
index 301b9a032b..0000000000
--- a/tests/run-process.sh
+++ /dev/null
@@ -1,109 +0,0 @@
-#!/bin/bash
-# tests/exec.sh - Test DevStack run_process() and stop_process()
-#
-# exec.sh start|stop|status
-#
-# Set USE_SCREEN True|False to change use of screen.
-#
-# This script emulates the basic exec environment in ``stack.sh`` to test
-# the process spawn and kill operations.
-
-if [[ -z $1 ]]; then
-    echo "$0 start|stop"
-    exit 1
-fi
-
-TOP_DIR=$(cd $(dirname "$0")/.. && pwd)
-source $TOP_DIR/functions
-
-USE_SCREEN=${USE_SCREEN:-False}
-
-ENABLED_SERVICES=fake-service
-
-SERVICE_DIR=/tmp
-SCREEN_NAME=test
-SCREEN_LOGDIR=${SERVICE_DIR}/${SCREEN_NAME}
-
-
-# Kill background processes on exit
-trap clean EXIT
-clean() {
-    local r=$?
-    jobs -p
-    kill >/dev/null 2>&1 $(jobs -p)
-    exit $r
-}
-
-
-# Exit on any errors so that errors don't compound
-trap failed ERR
-failed() {
-    local r=$?
-    jobs -p
-    kill >/dev/null 2>&1 $(jobs -p)
-    set +o xtrace
-    [ -n "$LOGFILE" ] && echo "${0##*/} failed: full log in $LOGFILE"
-    exit $r
-}
-
-function status {
-    if [[ -r $SERVICE_DIR/$SCREEN_NAME/fake-service.pid ]]; then
-        pstree -pg $(cat $SERVICE_DIR/$SCREEN_NAME/fake-service.pid)
-    fi
-    ps -ef | grep fake
-}
-
-function setup_screen {
-if [[ ! -d $SERVICE_DIR/$SCREEN_NAME ]]; then
-    rm -rf $SERVICE_DIR/$SCREEN_NAME
-    mkdir -p $SERVICE_DIR/$SCREEN_NAME
-fi
-
-if [[ "$USE_SCREEN" == "True" ]]; then
-    # Create a new named screen to run processes in
-    screen -d -m -S $SCREEN_NAME -t shell -s /bin/bash
-    sleep 1
-
-    # Set a reasonable status bar
-    if [ -z "$SCREEN_HARDSTATUS" ]; then
-        SCREEN_HARDSTATUS='%{= .} %-Lw%{= .}%> %n%f %t*%{= .}%+Lw%< %-=%{g}(%{d}%H/%l%{g})'
-    fi
-    screen -r $SCREEN_NAME -X hardstatus alwayslastline "$SCREEN_HARDSTATUS"
-fi
-
-# Clear screen rc file
-SCREENRC=$TOP_DIR/tests/$SCREEN_NAME-screenrc
-if [[ -e $SCREENRC ]]; then
-    echo -n > $SCREENRC
-fi
-}
-
-# Mimic logging
-    # Set up output redirection without log files
-    # Copy stdout to fd 3
-    exec 3>&1
-    if [[ "$VERBOSE" != "True" ]]; then
-        # Throw away stdout and stderr
-        #exec 1>/dev/null 2>&1
-        :
-    fi
-    # Always send summary fd to original stdout
-    exec 6>&3
-
-
-if [[ "$1" == "start" ]]; then
-    echo "Start service"
-    setup_screen
-    run_process fake-service "$TOP_DIR/tests/fake-service.sh"
-    sleep 1
-    status
-elif [[ "$1" == "stop" ]]; then
-    echo "Stop service"
-    stop_process fake-service
-    status
-elif [[ "$1" == "status" ]]; then
-    status
-else
-    echo "Unknown command"
-    exit 1
-fi
diff --git a/unstack.sh b/unstack.sh
index 77a151f933..5d3672e25d 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -171,15 +171,6 @@ if is_service_enabled dstat; then
     stop_dstat
 fi
 
-# Clean up the remainder of the screen processes
-SCREEN=$(which screen)
-if [[ -n "$SCREEN" ]]; then
-    SESSION=$(screen -ls | awk "/[0-9]+.${SCREEN_NAME}/"'{ print $1 }')
-    if [[ -n "$SESSION" ]]; then
-        screen -X -S $SESSION quit
-    fi
-fi
-
 # NOTE: Cinder automatically installs the lvm2 package, independently of the
 # enabled backends. So if Cinder is enabled, and installed successfully we are
 # sure lvm2 (lvremove, /etc/lvm/lvm.conf, etc.) is here.

From 0eebeb415ada3437b598d0ceb6952dc7ad9134d9 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Wed, 30 Aug 2017 14:16:58 -0400
Subject: [PATCH 1107/2409] clean up screen and tail_log references

Change-Id: I6bcfa09931ed1f70e071ccb16688c15c7ef2898f
---
 lib/cinder         | 11 ++++-------
 lib/dstat          |  2 +-
 lib/glance         |  3 +--
 lib/horizon        |  5 ++---
 lib/keystone       |  6 +-----
 lib/neutron        |  4 ++--
 lib/neutron-legacy |  4 ++--
 lib/nova           |  4 ++--
 lib/swift          | 13 +++----------
 lib/template       |  4 ++--
 10 files changed, 20 insertions(+), 36 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 03328f31b6..ba5bd04a0d 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -473,7 +473,7 @@ function _configure_tgt_for_config_d {
     fi
 }
 
-# start_cinder() - Start running processes, including screen
+# start_cinder() - Start running processes
 function start_cinder {
     local service_port=$CINDER_SERVICE_PORT
     local service_protocol=$CINDER_SERVICE_PROTOCOL
@@ -533,12 +533,9 @@ function start_cinder {
 # stop_cinder() - Stop running processes
 function stop_cinder {
     stop_process c-api
-
-    # Kill the cinder screen windows
-    local serv
-    for serv in c-bak c-sch c-vol; do
-        stop_process $serv
-    done
+    stop_process c-bak
+    stop_process c-sch
+    stop_process c-vol
 }
 
 # create_volume_types() - Create Cinder's configured volume types
diff --git a/lib/dstat b/lib/dstat
index 982b70387e..fe38d75585 100644
--- a/lib/dstat
+++ b/lib/dstat
@@ -16,7 +16,7 @@
 _XTRACE_DSTAT=$(set +o | grep xtrace)
 set +o xtrace
 
-# start_dstat() - Start running processes, including screen
+# start_dstat() - Start running processes
 function start_dstat {
     # A better kind of sysstat, with the top process per time slice
     run_process dstat "$TOP_DIR/tools/dstat.sh $LOGDIR"
diff --git a/lib/glance b/lib/glance
index 0a5b9f59b6..6e4a925488 100644
--- a/lib/glance
+++ b/lib/glance
@@ -333,7 +333,7 @@ function install_glance {
     setup_develop $GLANCE_DIR
 }
 
-# start_glance() - Start running processes, including screen
+# start_glance() - Start running processes
 function start_glance {
     local service_protocol=$GLANCE_SERVICE_PROTOCOL
     if is_service_enabled tls-proxy; then
@@ -358,7 +358,6 @@ function start_glance {
 
 # stop_glance() - Stop running processes
 function stop_glance {
-    # Kill the Glance screen windows
     stop_process g-api
     stop_process g-reg
 }
diff --git a/lib/horizon b/lib/horizon
index becc5a0e67..3d2f68d09d 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -181,13 +181,12 @@ function install_horizon {
     git_clone $HORIZON_REPO $HORIZON_DIR $HORIZON_BRANCH
 }
 
-# start_horizon() - Start running processes, including screen
+# start_horizon() - Start running processes
 function start_horizon {
     restart_apache_server
-    tail_log horizon /var/log/$APACHE_NAME/horizon_error.log
 }
 
-# stop_horizon() - Stop running processes (non-screen)
+# stop_horizon() - Stop running processes
 function stop_horizon {
     stop_apache_server
 }
diff --git a/lib/keystone b/lib/keystone
index 685891e8bc..69aadb66e0 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -536,7 +536,7 @@ function install_keystone {
     fi
 }
 
-# start_keystone() - Start running processes, including screen
+# start_keystone() - Start running processes
 function start_keystone {
     # Get right service port for testing
     local service_port=$KEYSTONE_SERVICE_PORT
@@ -549,8 +549,6 @@ function start_keystone {
     if [ "$KEYSTONE_DEPLOY" == "mod_wsgi" ]; then
         enable_apache_site keystone
         restart_apache_server
-        tail_log key /var/log/$APACHE_NAME/keystone.log
-        tail_log key-access /var/log/$APACHE_NAME/keystone_access.log
     else # uwsgi
         run_process keystone "$KEYSTONE_BIN_DIR/uwsgi --ini $KEYSTONE_PUBLIC_UWSGI_CONF" ""
     fi
@@ -585,8 +583,6 @@ function stop_keystone {
     else
         stop_process keystone
     fi
-    # Kill the Keystone screen window
-    stop_process key
 }
 
 # bootstrap_keystone() - Initialize user, role and project
diff --git a/lib/neutron b/lib/neutron
index 2a660ec8e1..a5312888c3 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -409,7 +409,7 @@ function start_neutron_api {
     fi
 }
 
-# start_neutron() - Start running processes, including screen
+# start_neutron() - Start running processes
 function start_neutron_new {
     # Start up the neutron agents if enabled
     # TODO(sc68cal) Make this pluggable so different DevStack plugins for different Neutron plugins
@@ -446,7 +446,7 @@ function start_neutron_new {
     fi
 }
 
-# stop_neutron() - Stop running processes (non-screen)
+# stop_neutron() - Stop running processes
 function stop_neutron_new {
     for serv in neutron-api neutron-agent neutron-l3; do
         stop_process $serv
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 784f3a8167..c8d2540ca5 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -455,7 +455,7 @@ function configure_neutron_after_post_config {
     fi
 }
 
-# Start running processes, including screen
+# Start running processes
 function start_neutron_service_and_check {
     local service_port=$Q_PORT
     local service_protocol=$Q_PROTOCOL
@@ -524,7 +524,7 @@ function stop_mutnauq_l2_agent {
     stop_process q-agt
 }
 
-# stop_mutnauq_other() - Stop running processes (non-screen)
+# stop_mutnauq_other() - Stop running processes
 function stop_mutnauq_other {
     if is_service_enabled q-dhcp; then
         stop_process q-dhcp
diff --git a/lib/nova b/lib/nova
index bd6695afdf..5b78972571 100644
--- a/lib/nova
+++ b/lib/nova
@@ -882,7 +882,7 @@ function start_nova_compute {
     export PATH=$old_path
 }
 
-# start_nova() - Start running processes, including screen
+# start_nova() - Start running processes
 function start_nova_rest {
     # Hack to set the path for rootwrap
     local old_path=$PATH
@@ -999,7 +999,7 @@ function stop_nova_conductor {
     done
 }
 
-# stop_nova() - Stop running processes (non-screen)
+# stop_nova() - Stop running processes
 function stop_nova {
     stop_nova_rest
     stop_nova_conductor
diff --git a/lib/swift b/lib/swift
index 455740ea82..45f679302c 100644
--- a/lib/swift
+++ b/lib/swift
@@ -7,7 +7,7 @@
 #
 # - ``functions`` file
 # - ``apache`` file
-# - ``DEST``, ``SCREEN_NAME``, `SWIFT_HASH` must be defined
+# - ``DEST``, `SWIFT_HASH` must be defined
 # - ``STACK_USER`` must be defined
 # - ``SWIFT_DATA_DIR`` or ``DATA_DIR`` must be defined
 # - ``lib/keystone`` file
@@ -780,7 +780,7 @@ function install_ceilometermiddleware {
     fi
 }
 
-# start_swift() - Start running processes, including screen
+# start_swift() - Start running processes
 function start_swift {
     # (re)start memcached to make sure we have a clean memcache.
     restart_service memcached
@@ -799,13 +799,6 @@ function start_swift {
         restart_apache_server
         # The rest of the services should be started in backgroud
         swift-init --run-dir=${SWIFT_DATA_DIR}/run rest start
-        # Be we still want the logs of Swift Proxy in our screen session
-        tail_log s-proxy /var/log/$APACHE_NAME/proxy-server
-        if [[ ${SWIFT_REPLICAS} == 1 ]]; then
-            for type in object container account; do
-                tail_log s-${type} /var/log/$APACHE_NAME/${type}-server-1
-            done
-        fi
         return 0
     fi
 
@@ -859,7 +852,7 @@ function start_swift {
     fi
 }
 
-# stop_swift() - Stop running processes (non-screen)
+# stop_swift() - Stop running processes
 function stop_swift {
     local type
 
diff --git a/lib/template b/lib/template
index 25d653cb46..e6d003284f 100644
--- a/lib/template
+++ b/lib/template
@@ -81,7 +81,7 @@ function install_XXXX {
     :
 }
 
-# start_XXXX() - Start running processes, including screen
+# start_XXXX() - Start running processes
 function start_XXXX {
     # The quoted command must be a single command and not include an
     # shell metacharacters, redirections or shell builtins.
@@ -89,7 +89,7 @@ function start_XXXX {
     :
 }
 
-# stop_XXXX() - Stop running processes (non-screen)
+# stop_XXXX() - Stop running processes
 function stop_XXXX {
     # for serv in serv-a serv-b; do
     #     stop_process $serv

From 730faa2626cb2522dd07465b8c8cf87e39a99ace Mon Sep 17 00:00:00 2001
From: Anna Khmelnitsky <akhmelnitsky@vmware.com>
Date: Fri, 1 Sep 2017 16:25:09 -0700
Subject: [PATCH 1108/2409] Cap tox != 2.8.0 temporarily to avoid ValueError

This is proposed temporary change to avoid
"ValueError: need more than 1 value to unpack" error in stack.

Change-Id: I743febbef3a1f201cea37471356518be31585277
---
 lib/tempest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index cc65ec7aa9..0ce663c7ab 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -608,7 +608,7 @@ function configure_tempest {
 # install_tempest() - Collect source and prepare
 function install_tempest {
     git_clone $TEMPEST_REPO $TEMPEST_DIR $TEMPEST_BRANCH
-    pip_install tox
+    pip_install 'tox!=2.8.0'
     pushd $TEMPEST_DIR
     tox -r --notest -efull
     # NOTE(mtreinish) Respect constraints in the tempest full venv, things that

From c63d9331a78159833a784806db4b2cd6b58a3eed Mon Sep 17 00:00:00 2001
From: zhangbailin <zhangbailin@inspur.com>
Date: Fri, 1 Sep 2017 19:46:16 -0700
Subject: [PATCH 1109/2409] Replace http with https for doc links in devstack's
 document

1) Update doc links according to OpenStack document migration
2) Use https instead of http for docs links

Change-Id: I81b560d1e4c5210dc00a6a6ac06c03bb1e69d595
---
 HACKING.rst        | 4 ++--
 doc/source/faq.rst | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/HACKING.rst b/HACKING.rst
index fc67f09a7b..d5d6fbcf02 100644
--- a/HACKING.rst
+++ b/HACKING.rst
@@ -20,7 +20,7 @@ in `How To Contribute`__ in the OpenStack wiki.  `DevStack's LaunchPad project`_
 contains the usual links for blueprints, bugs, etc.
 
 __ contribute_
-.. _contribute: http://docs.openstack.org/infra/manual/developers.html
+.. _contribute: https://docs.openstack.org/infra/manual/developers.html
 
 __ lp_
 .. _lp: https://launchpad.net/~devstack
@@ -255,7 +255,7 @@ These scripts are executed serially by ``exercise.sh`` in testing situations.
 * The ``OS_*`` environment variables should be the only ones used for all
   authentication to OpenStack clients as documented in the CLIAuth_ wiki page.
 
-.. _CLIAuth: http://wiki.openstack.org/CLIAuth
+.. _CLIAuth: https://wiki.openstack.org/CLIAuth
 
 * The exercise MUST clean up after itself if successful.  If it is not successful,
   it is assumed that state will be left behind; this allows a chance for developers
diff --git a/doc/source/faq.rst b/doc/source/faq.rst
index a186336f54..ed9b4da6bb 100644
--- a/doc/source/faq.rst
+++ b/doc/source/faq.rst
@@ -32,9 +32,9 @@ That isn't a question, but please do! The source for DevStack is at
 `git.openstack.org
 <https://git.openstack.org/cgit/openstack-dev/devstack>`__ and bug
 reports go to `LaunchPad
-<http://bugs.launchpad.net/devstack/>`__. Contributions follow the
+<https://bugs.launchpad.net/devstack/>`__. Contributions follow the
 usual process as described in the `developer guide
-<http://docs.openstack.org/infra/manual/developers.html>`__. This
+<https://docs.openstack.org/infra/manual/developers.html>`__. This
 Sphinx documentation is housed in the doc directory.
 
 Why not use packages?

From 5f2ed3697c39ee1e579fe3d0927927b2ca6a4fc4 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Mon, 4 Sep 2017 08:48:08 +0000
Subject: [PATCH 1110/2409] Updated from generate-devstack-plugins-list

Change-Id: Ifbb6d64834d6f3609c56c85163dc367d778ed21f
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index a1d5ad822b..2c8805ff16 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -144,6 +144,7 @@ octavia-dashboard                      `git://git.openstack.org/openstack/octavi
 omni                                   `git://git.openstack.org/openstack/omni <https://git.openstack.org/cgit/openstack/omni>`__
 os-xenapi                              `git://git.openstack.org/openstack/os-xenapi <https://git.openstack.org/cgit/openstack/os-xenapi>`__
 osprofiler                             `git://git.openstack.org/openstack/osprofiler <https://git.openstack.org/cgit/openstack/osprofiler>`__
+oswin-tempest-plugin                   `git://git.openstack.org/openstack/oswin-tempest-plugin <https://git.openstack.org/cgit/openstack/oswin-tempest-plugin>`__
 panko                                  `git://git.openstack.org/openstack/panko <https://git.openstack.org/cgit/openstack/panko>`__
 patrole                                `git://git.openstack.org/openstack/patrole <https://git.openstack.org/cgit/openstack/patrole>`__
 picasso                                `git://git.openstack.org/openstack/picasso <https://git.openstack.org/cgit/openstack/picasso>`__

From d8bb220606737719bcdf7c5b4f54906f2974c71c Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Sun, 3 Sep 2017 12:13:59 -0500
Subject: [PATCH 1111/2409] Make list_images.sh emit the etcd3 tarball

We need this for every devstack run now, so downloading it from github
every time isn't the most awesome thing in the world.

Add an extra variable EXTRA_CACHE_URLS which will be appended to the
output of tools/image_list.sh.  This way, these files will be
downloaded during the daily nodepool build, but they will not be in
the IMAGE_LIST and hence be considered as images to upload.

Add a function get_extra_file which echos the path to a file given the
URL.  It will first check the cache at $FILES, and if not present
download it.

Update the documentation in image_list.sh to reflect what's happening.

Move the defaults for etcd variables into stackrc, since it is a base
service now.

Change-Id: I86104824a29d973a6288df1f24b7891feb86267c
---
 functions           | 31 +++++++++++++++++++++++++++++++
 lib/etcd3           | 32 ++++----------------------------
 stackrc             | 34 ++++++++++++++++++++++++++++++++++
 tools/image_list.sh | 23 ++++++++++++++++++++---
 4 files changed, 89 insertions(+), 31 deletions(-)

diff --git a/functions b/functions
index 6f2164a777..ebcae334e0 100644
--- a/functions
+++ b/functions
@@ -45,6 +45,37 @@ function short_source {
 # export it so child shells have access to the 'short_source' function also.
 export -f short_source
 
+# Download a file from a URL
+#
+# Will check cache (in $FILES) or download given URL.
+#
+# Argument is the URL to the remote file
+#
+# Will echo the local path to the file as the output.  Will die on
+# failure to download.
+#
+# Files can be pre-cached for CI environments, see EXTRA_CACHE_URLS
+# and tools/image_list.sh
+function get_extra_file {
+    local file_url=$1
+
+    file_name=$(basename "$file_url")
+    if [[ $file_url != file* ]]; then
+        # If the file isn't cache, download it
+        if [[ ! -f $FILES/$file_name ]]; then
+            wget --progress=dot:giga -c $file_url -O $FILES/$file_name
+            if [[ $? -ne 0 ]]; then
+                die "$file_url could not be downloaded"
+            fi
+        fi
+        echo "$FILES/$file_name"
+        return
+    else
+        # just strip the file:// bit and that's the path to the file
+        echo $file_url | sed 's/$file:\/\///g'
+    fi
+}
+
 
 # Retrieve an image from a URL and upload into Glance.
 # Uses the following variables:
diff --git a/lib/etcd3 b/lib/etcd3
index 6e32cb31ca..60e827add2 100644
--- a/lib/etcd3
+++ b/lib/etcd3
@@ -24,15 +24,9 @@ set +o xtrace
 # --------
 
 # Set up default values for etcd
-ETCD_DOWNLOAD_URL=${ETCD_DOWNLOAD_URL:-https://github.com/coreos/etcd/releases/download}
-ETCD_VERSION=${ETCD_VERSION:-v3.1.7}
 ETCD_DATA_DIR="$DATA_DIR/etcd"
 ETCD_SYSTEMD_SERVICE="devstack@etcd.service"
 ETCD_BIN_DIR="$DEST/bin"
-ETCD_SHA256_AMD64="4fde194bbcd259401e2b5c462dfa579ee7f6af539f13f130b8f5b4f52e3b3c52"
-# NOTE(sdague): etcd v3.1.7 doesn't have anything for these architectures, though 3.2.0 does.
-ETCD_SHA256_ARM64=""
-ETCD_SHA256_PPC64=""
 ETCD_PORT=2379
 
 if is_ubuntu ; then
@@ -95,37 +89,19 @@ function cleanup_etcd3 {
 function install_etcd3 {
     echo "Installing etcd"
 
-    # Make sure etcd3 downloads the correct architecture
-    if is_arch "x86_64"; then
-        ETCD_ARCH="amd64"
-        ETCD_SHA256=${ETCD_SHA256:-$ETCD_SHA256_AMD64}
-    elif is_arch "aarch64"; then
-        ETCD_ARCH="arm64"
-        ETCD_SHA256=${ETCD_SHA256:-$ETCD_SHA256_ARM64}
-    elif is_arch "ppc64le"; then
-        ETCD_ARCH="ppc64le"
-        ETCD_SHA256=${ETCD_SHA256:-$ETCD_SHA256_PPC64}
-    else
-        exit_distro_not_supported "invalid hardware type - $ETCD_ARCH"
-    fi
-
-    ETCD_NAME=etcd-$ETCD_VERSION-linux-$ETCD_ARCH
-
     # Create the necessary directories
     sudo mkdir -p $ETCD_BIN_DIR
     sudo mkdir -p $ETCD_DATA_DIR
 
     # Download and cache the etcd tgz for subsequent use
+    local etcd_file
+    etcd_file="$(get_extra_file $ETCD_DOWNLOAD_LOCATION)"
     if [ ! -f "$FILES/etcd-$ETCD_VERSION-linux-$ETCD_ARCH/etcd" ]; then
-        ETCD_DOWNLOAD_FILE=$ETCD_NAME.tar.gz
-        if [ ! -f "$FILES/$ETCD_DOWNLOAD_FILE" ]; then
-            wget $ETCD_DOWNLOAD_URL/$ETCD_VERSION/$ETCD_DOWNLOAD_FILE -O $FILES/$ETCD_DOWNLOAD_FILE
-        fi
-        echo "${ETCD_SHA256} $FILES/${ETCD_DOWNLOAD_FILE}" > $FILES/etcd.sha256sum
+        echo "${ETCD_SHA256} $etcd_file" > $FILES/etcd.sha256sum
         # NOTE(sdague): this should go fatal if this fails
         sha256sum -c $FILES/etcd.sha256sum
 
-        tar xzvf $FILES/$ETCD_DOWNLOAD_FILE -C $FILES
+        tar xzvf $etcd_file -C $FILES
         sudo cp $FILES/$ETCD_NAME/etcd $ETCD_BIN_DIR/etcd
     fi
     if [ ! -f "$ETCD_BIN_DIR/etcd" ]; then
diff --git a/stackrc b/stackrc
index b123d8ac7c..0757d78775 100644
--- a/stackrc
+++ b/stackrc
@@ -732,6 +732,40 @@ if [[ "$DOWNLOAD_DEFAULT_IMAGES" == "True" ]]; then
     DOWNLOAD_DEFAULT_IMAGES=False
 fi
 
+# This is a comma separated list of extra URLS to be listed for
+# download by the tools/image_list.sh script.  CI environments can
+# pre-download these URLS and place them in $FILES.  Later scripts can
+# then use "get_extra_file <url>" which will print out the path to the
+# file; it will either be downloaded on demand or acquired from the
+# cache if there.
+EXTRA_CACHE_URLS=""
+
+# etcd3 defaults
+ETCD_VERSION=${ETCD_VERSION:-v3.1.7}
+ETCD_SHA256_AMD64="4fde194bbcd259401e2b5c462dfa579ee7f6af539f13f130b8f5b4f52e3b3c52"
+# NOTE(sdague): etcd v3.1.7 doesn't have anything for these architectures, though 3.2.0 does.
+ETCD_SHA256_ARM64=""
+ETCD_SHA256_PPC64=""
+# Make sure etcd3 downloads the correct architecture
+if is_arch "x86_64"; then
+    ETCD_ARCH="amd64"
+    ETCD_SHA256=${ETCD_SHA256:-$ETCD_SHA256_AMD64}
+elif is_arch "aarch64"; then
+    ETCD_ARCH="arm64"
+    ETCD_SHA256=${ETCD_SHA256:-$ETCD_SHA256_ARM64}
+elif is_arch "ppc64le"; then
+    ETCD_ARCH="ppc64le"
+    ETCD_SHA256=${ETCD_SHA256:-$ETCD_SHA256_PPC64}
+else
+    exit_distro_not_supported "invalid hardware type - $ETCD_ARCH"
+fi
+ETCD_DOWNLOAD_URL=${ETCD_DOWNLOAD_URL:-https://github.com/coreos/etcd/releases/download}
+ETCD_NAME=etcd-$ETCD_VERSION-linux-$ETCD_ARCH
+ETCD_DOWNLOAD_FILE=$ETCD_NAME.tar.gz
+ETCD_DOWNLOAD_LOCATION=$ETCD_DOWNLOAD_URL/$ETCD_VERSION/$ETCD_DOWNLOAD_FILE
+# etcd is always required, so place it into list of pre-cached downloads
+EXTRA_CACHE_URLS+=",$ETCD_DOWNLOAD_LOCATION"
+
 # Detect duplicate values in IMAGE_URLS
 for image_url in ${IMAGE_URLS//,/ }; do
     if [ $(echo "$IMAGE_URLS" | grep -o -F "$image_url" | wc -l) -gt 1 ]; then
diff --git a/tools/image_list.sh b/tools/image_list.sh
index 29b93ed1d8..3a27c4acfd 100755
--- a/tools/image_list.sh
+++ b/tools/image_list.sh
@@ -1,5 +1,14 @@
 #!/bin/bash
 
+# Print out a list of image and other files to download for caching.
+# This is mostly used by the OpenStack infrasturucture during daily
+# image builds to save the large images to /opt/cache/files (see [1])
+#
+# The two lists of URL's downloaded are the IMAGE_URLS and
+# EXTRA_CACHE_URLS, which are setup in stackrc
+#
+# [1] project-config:nodepool/elements/cache-devstack/extra-data.d/55-cache-devstack-repos
+
 # Keep track of the DevStack directory
 TOP_DIR=$(cd $(dirname "$0")/.. && pwd)
 
@@ -31,12 +40,20 @@ for driver in $DRIVERS; do
     ALL_IMAGES+=$URLS
 done
 
-# Make a nice list
-echo $ALL_IMAGES | tr ',' '\n' | sort | uniq
-
 # Sanity check - ensure we have a minimum number of images
 num=$(echo $ALL_IMAGES | tr ',' '\n' | sort | uniq | wc -l)
 if [[ "$num" -lt 4 ]]; then
     echo "ERROR: We only found $num images in $ALL_IMAGES, which can't be right."
     exit 1
 fi
+
+# This is extra non-image files that we want pre-cached.  This is kept
+# in a separate list because devstack loops over the IMAGE_LIST to
+# upload files glance and these aren't images.  (This was a bit of an
+# after-thought which is why the naming around this is very
+# image-centric)
+URLS=$(source $TOP_DIR/stackrc && echo $EXTRA_CACHE_URLS)
+ALL_IMAGES+=$URLS
+
+# Make a nice combined list
+echo $ALL_IMAGES | tr ',' '\n' | sort | uniq

From 477a962861afe2e859179245d6d39cb41f6c499d Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Fri, 4 Aug 2017 11:09:26 -0400
Subject: [PATCH 1112/2409] Enable graceful shutdown for services

1] Process using uwsgi:
   uwsgi services doesn't support for graceful shutting down [1].
   It requires some changes in unit files [2] including adding below
   graceful shutdown hook and changing KillSignal:
      --hook-master-start "unix_signal:15 gracefully_kill_them_all
   All the steps and changes required are specified in etherpad [1].

2] Non uwsgi services needs below changes:
   In [service] section:
   a. Add KillMode = process
   b. Add TimeoutStopSec = infinity

NOTE:
Creating unit file for services other than uwsgi is handled by the
'write_user_unit_file' function [3]. This function is common for all
the services so this patch adds the above mentioned parameters for
services using ServiceLauncher also though they don't require.

Added a new stackrc variable WORKER_TIMEOUT which is required to add
graceful shutdown support to uwsgi services. It will be set as a value
to 'worker-reload-mercy' [4] in uwsgi file of service. The default
value set to this variable is 90.

[1] https://etherpad.openstack.org/p/uwsgi-issues
[2] https://www.freedesktop.org/software/systemd/man/systemd.kill.html
[3] https://github.com/openstack-dev/devstack/blob/2967ca3dfd0d64970dfa5dfa7ac2330ee7aa90ed/functions-common#L1439-L1461
[4] http://uwsgi-docs.readthedocs.io/en/latest/Options.html#worker-reload-mercy

Co-Authored-By: Dinesh Bhor <dinesh.bhor@nttdata.com>
Change-Id: Ia95291325ce4858b47102dd49504250183f339ab
---
 functions-common |  4 +++-
 lib/apache       | 10 ++++++++++
 stackrc          |  3 +++
 3 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index a5f770f579..52f53ef147 100644
--- a/functions-common
+++ b/functions-common
@@ -1451,6 +1451,8 @@ function write_user_unit_file {
     iniset -sudo $unitfile "Unit" "Description" "Devstack $service"
     iniset -sudo $unitfile "Service" "User" "$user"
     iniset -sudo $unitfile "Service" "ExecStart" "$command"
+    iniset -sudo $unitfile "Service" "KillMode" "process"
+    iniset -sudo $unitfile "Service" "TimeoutStopSec" "infinity"
     if [[ -n "$group" ]]; then
         iniset -sudo $unitfile "Service" "Group" "$group"
     fi
@@ -1473,7 +1475,7 @@ function write_uwsgi_user_unit_file {
     iniset -sudo $unitfile "Service" "User" "$user"
     iniset -sudo $unitfile "Service" "ExecStart" "$command"
     iniset -sudo $unitfile "Service" "Type" "notify"
-    iniset -sudo $unitfile "Service" "KillSignal" "SIGQUIT"
+    iniset -sudo $unitfile "Service" "KillMode" "process"
     iniset -sudo $unitfile "Service" "Restart" "always"
     iniset -sudo $unitfile "Service" "NotifyAccess" "all"
     iniset -sudo $unitfile "Service" "RestartForceExitStatus" "100"
diff --git a/lib/apache b/lib/apache
index dfca25a764..39d5b7b071 100644
--- a/lib/apache
+++ b/lib/apache
@@ -260,10 +260,15 @@ function write_uwsgi_config {
     # Set die-on-term & exit-on-reload so that uwsgi shuts down
     iniset "$file" uwsgi die-on-term true
     iniset "$file" uwsgi exit-on-reload true
+    # Set worker-reload-mercy so that worker will not exit till the time
+    # configured after graceful shutdown
+    iniset "$file" uwsgi worker-reload-mercy $WORKER_TIMEOUT
     iniset "$file" uwsgi enable-threads true
     iniset "$file" uwsgi plugins python
     # uwsgi recommends this to prevent thundering herd on accept.
     iniset "$file" uwsgi thunder-lock true
+    # Set hook to trigger graceful shutdown on SIGTERM
+    iniset "$file" uwsgi hook-master-start "unix_signal:15 gracefully_kill_them_all"
     # Override the default size for headers from the 4k default.
     iniset "$file" uwsgi buffer-size 65535
     # Make sure the client doesn't try to re-use the connection.
@@ -316,6 +321,11 @@ function write_local_uwsgi_http_config {
     iniset "$file" uwsgi plugins python
     # uwsgi recommends this to prevent thundering herd on accept.
     iniset "$file" uwsgi thunder-lock true
+    # Set hook to trigger graceful shutdown on SIGTERM
+    iniset "$file" uwsgi hook-master-start "unix_signal:15 gracefully_kill_them_all"
+    # Set worker-reload-mercy so that worker will not exit till the time
+    # configured after graceful shutdown
+    iniset "$file" uwsgi worker-reload-mercy $WORKER_TIMEOUT
     # Override the default size for headers from the 4k default.
     iniset "$file" uwsgi buffer-size 65535
     # Make sure the client doesn't try to re-use the connection.
diff --git a/stackrc b/stackrc
index 3591994f79..e936b337e7 100644
--- a/stackrc
+++ b/stackrc
@@ -778,6 +778,9 @@ SERVICE_TIMEOUT=${SERVICE_TIMEOUT:-60}
 # Service graceful shutdown timeout
 SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT=${SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT:-5}
 
+# Service graceful shutdown timeout
+WORKER_TIMEOUT=${WORKER_TIMEOUT:-90}
+
 # Support alternative yum -- in future Fedora 'dnf' will become the
 # only supported installer, but for now 'yum' and 'dnf' are both
 # available in parallel with compatible CLIs.  Allow manual switching

From acb48a1a192b9531c6b30ed42426cb96f012ebb0 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Wed, 6 Sep 2017 10:55:39 +0000
Subject: [PATCH 1113/2409] Update link to nova config reference

For devstack master branch we should point to the latest version and not
to some possibly outdated older branch.

Change-Id: I4af3aef90a2c295df3de4a5b49d127e85ab517ac
---
 doc/source/guides/nova.rst | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/source/guides/nova.rst b/doc/source/guides/nova.rst
index 6bbab53aea..0f105d7c58 100644
--- a/doc/source/guides/nova.rst
+++ b/doc/source/guides/nova.rst
@@ -66,5 +66,5 @@ These config options are defined in `nova.conf.serial_console
 <https://github.com/openstack/nova/blob/master/nova/conf/serial_console.py>`_.
 
 For more information on OpenStack configuration see the `OpenStack
-Configuration Reference
-<https://docs.openstack.org/ocata/config-reference/compute.html>`_
+Compute Service Configuration Reference
+<https://docs.openstack.org/nova/latest/admin/configuration/index.html>`_

From a7e9a5d447b3eeacfb52d7ddc94445058a8d6fd1 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Wed, 6 Sep 2017 10:58:04 +0000
Subject: [PATCH 1114/2409] Update to using pike cloud-archive

Now that Pike has been released, switch to using the pike version of
UCA instead of ocata, too.

One reason to do so it that it adds python3-ceph packages, allow to have
progress with the python3 compatibility of the Ceph integration.

Change-Id: I7d95e53892b697c72af75ad0ce7ce2dec6d31fde
---
 tools/fixup_stuff.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index f1552ab2f7..efe0125741 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -84,10 +84,10 @@ if [[ "${ENABLE_UBUNTU_CLOUD_ARCHIVE}" == "True" && "$DISTRO" = "xenial" ]]; the
         # we can find local mirrors then use that mirror.
         source /etc/ci/mirror_info.sh
 
-        sudo apt-add-repository -y "deb $NODEPOOL_UCA_MIRROR xenial-updates/ocata main"
+        sudo apt-add-repository -y "deb $NODEPOOL_UCA_MIRROR xenial-updates/pike main"
     else
         # Otherwise use upstream UCA
-        sudo add-apt-repository -y cloud-archive:ocata
+        sudo add-apt-repository -y cloud-archive:pike
     fi
 
     # Disable use of libvirt wheel since a cached wheel build might be

From 486376e91b1f9a7680371036e470b8692804e917 Mon Sep 17 00:00:00 2001
From: Sean McGinnis <sean.mcginnis@huawei.com>
Date: Tue, 5 Sep 2017 19:56:06 -0500
Subject: [PATCH 1115/2409] Change CINDER_LVM_TYPE to 'auto' as the default

This was previously set to thin as the default, but at the time
there were failures seen with what appeared to be race conditions
when creating snapshots.

These failures are not seen locally, and we have a lot of installs
using the default auto by this point with no reports from the field
of seeing this failure. This is to be able to more extensively test
this in the gate, and hopefully get this switched over to be able
to thinly provision by default when possible.

Change-Id: I3e99adadd1c37ba8b24b6cb71a8969ffc93f75a1
Related-bug: #1642111
---
 lib/cinder | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 03328f31b6..9a2be653d1 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -70,12 +70,11 @@ CINDER_SERVICE_PROTOCOL=${CINDER_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 CINDER_SERVICE_LISTEN_ADDRESS=${CINDER_SERVICE_LISTEN_ADDRESS:-$SERVICE_LISTEN_ADDRESS}
 
 # What type of LVM device should Cinder use for LVM backend
-# Defaults to default, which is thick, the other valid choice
-# is thin, which as the name implies utilizes lvm thin provisioning.
-# Thinly provisioned LVM volumes may be more efficient when using the Cinder
-# image cache, but there are also known race failures with volume snapshots
-# and thinly provisioned LVM volumes, see bug 1642111 for details.
-CINDER_LVM_TYPE=${CINDER_LVM_TYPE:-default}
+# Defaults to auto, which will do thin provisioning if it's a fresh
+# volume group, otherwise it will do thick. The other valid choices are
+# default, which is thick, or thin, which as the name implies utilizes lvm
+# thin provisioning.
+CINDER_LVM_TYPE=${CINDER_LVM_TYPE:-auto}
 
 # Default backends
 # The backend format is type:name where type is one of the supported backend

From a066abedac916751660c73548e7eab2d216323c5 Mon Sep 17 00:00:00 2001
From: Roman Podoliaka <rpodolyaka@mirantis.com>
Date: Tue, 18 Apr 2017 16:18:14 +0300
Subject: [PATCH 1116/2409] placement: install osc-placement

This makes sure that the openstack client placement plugin gets
installed when either LIBS_FROM_GIT includes osc-placement or
placement is used, which is always now if you've enabled nova,
which is enabled by default.

Co-Authored-By: Matt Riedemann <mriedem.os@gmail.com>

Depends-On: Ica83e29780722dd1555904e46b9ff1d1fdf72516

Change-Id: I7c5a5c10288b356302bb3027837d4ed4f0fbad8c
---
 lib/libraries                | 2 ++
 lib/placement                | 3 +++
 stackrc                      | 4 ++++
 tests/test_libs_from_pypi.sh | 3 ++-
 4 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/lib/libraries b/lib/libraries
index 4ceb80423c..6d52f642a1 100644
--- a/lib/libraries
+++ b/lib/libraries
@@ -30,6 +30,7 @@ GITDIR["debtcollector"]=$DEST/debtcollector
 GITDIR["futurist"]=$DEST/futurist
 GITDIR["os-client-config"]=$DEST/os-client-config
 GITDIR["osc-lib"]=$DEST/osc-lib
+GITDIR["osc-placement"]=$DEST/osc-placement
 GITDIR["oslo.cache"]=$DEST/oslo.cache
 GITDIR["oslo.concurrency"]=$DEST/oslo.concurrency
 GITDIR["oslo.config"]=$DEST/oslo.config
@@ -91,6 +92,7 @@ function install_libs {
     _install_lib_from_source "debtcollector"
     _install_lib_from_source "futurist"
     _install_lib_from_source "osc-lib"
+    _install_lib_from_source "osc-placement"
     _install_lib_from_source "os-client-config"
     _install_lib_from_source "oslo.cache"
     _install_lib_from_source "oslo.concurrency"
diff --git a/lib/placement b/lib/placement
index aef9b7454e..d3fb8c848d 100644
--- a/lib/placement
+++ b/lib/placement
@@ -159,6 +159,9 @@ function init_placement {
 # install_placement() - Collect source and prepare
 function install_placement {
     install_apache_wsgi
+    # Install the openstackclient placement client plugin for CLI
+    # TODO(mriedem): Use pip_install_gr once osc-placement is in g-r.
+    pip_install osc-placement
 }
 
 # start_placement_api() - Start the API processes ahead of other things
diff --git a/stackrc b/stackrc
index 3591994f79..af0709a225 100644
--- a/stackrc
+++ b/stackrc
@@ -388,6 +388,10 @@ GITBRANCH["python-openstackclient"]=${OPENSTACKCLIENT_BRANCH:-master}
 # this doesn't exist in a lib file, so set it here
 GITDIR["python-openstackclient"]=$DEST/python-openstackclient
 
+# placement-api CLI
+GITREPO["osc-placement"]=${OSC_PLACEMENT_REPO:-${GIT_BASE}/openstack/osc-placement.git}
+GITBRANCH["osc-placement"]=${OSC_PLACEMENT_BRANCH:-master}
+
 
 ###################
 #
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index 5b4ff32f2a..0bd8d49357 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -36,7 +36,8 @@ ALL_LIBS+=" oslo.messaging oslo.log cliff stevedore"
 ALL_LIBS+=" python-cinderclient glance_store oslo.concurrency oslo.db"
 ALL_LIBS+=" oslo.versionedobjects oslo.vmware keystonemiddleware"
 ALL_LIBS+=" oslo.serialization django_openstack_auth"
-ALL_LIBS+=" python-openstackclient osc-lib os-client-config oslo.rootwrap"
+ALL_LIBS+=" python-openstackclient osc-lib osc-placement"
+ALL_LIBS+=" os-client-config oslo.rootwrap"
 ALL_LIBS+=" oslo.i18n oslo.utils python-openstacksdk python-swiftclient"
 ALL_LIBS+=" python-neutronclient tooz ceilometermiddleware oslo.policy"
 ALL_LIBS+=" debtcollector os-brick os-traits automaton futurist oslo.service"

From a7f32720228968a589aab9dd10a08a03834b81a5 Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 7 Sep 2017 11:16:40 -0400
Subject: [PATCH 1117/2409] Fix up main readme

A few tweaks to make this more accurate.

Change-Id: I36ae24870be2ca6b5ac0e0507dd457b688739348
---
 README.rst                                   | 9 +++++----
 doc/source/guides/devstack-with-lbaas-v2.rst | 1 -
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/README.rst b/README.rst
index adbf59a637..6885546c94 100644
--- a/README.rst
+++ b/README.rst
@@ -1,4 +1,5 @@
-DevStack is a set of scripts and utilities to quickly deploy an OpenStack cloud.
+DevStack is a set of scripts and utilities to quickly deploy an OpenStack cloud
+from git source trees.
 
 Goals
 =====
@@ -27,9 +28,9 @@ Versions
 The DevStack master branch generally points to trunk versions of OpenStack
 components.  For older, stable versions, look for branches named
 stable/[release] in the DevStack repo.  For example, you can do the
-following to create a Newton OpenStack cloud::
+following to create a Pike OpenStack cloud::
 
-    git checkout stable/newton
+    git checkout stable/pike
     ./stack.sh
 
 You can also pick specific OpenStack project releases by setting the appropriate
@@ -54,7 +55,7 @@ When the script finishes executing, you should be able to access OpenStack
 endpoints, like so:
 
 * Horizon: http://myhost/
-* Keystone: http://myhost:5000/v2.0/
+* Keystone: http://myhost/identity/v2.0/
 
 We also provide an environment file that you can use to interact with your
 cloud via CLI::
diff --git a/doc/source/guides/devstack-with-lbaas-v2.rst b/doc/source/guides/devstack-with-lbaas-v2.rst
index 4ed64bf12f..3592844efb 100644
--- a/doc/source/guides/devstack-with-lbaas-v2.rst
+++ b/doc/source/guides/devstack-with-lbaas-v2.rst
@@ -39,7 +39,6 @@ Edit your ``local.conf`` to look like
     LOGFILE=$DEST/logs/stack.sh.log
     VERBOSE=True
     LOG_COLOR=True
-    SCREEN_LOGDIR=$DEST/logs
     # Pre-requisite
     ENABLED_SERVICES=rabbit,mysql,key
     # Horizon

From 12fcd619302556d98a8b8191a97c914bd014bb3f Mon Sep 17 00:00:00 2001
From: Eric Fried <efried@us.ibm.com>
Date: Thu, 7 Sep 2017 13:36:00 -0500
Subject: [PATCH 1118/2409] doc: How to pdb under systemd

Add a section to the systemd doc describing how to use regular pdb in a
systemd environment.

Change-Id: Ib1f616f407eccc087de1c60624fa74e2555971c2
---
 doc/source/systemd.rst | 26 ++++++++++++++++++++++++--
 1 file changed, 24 insertions(+), 2 deletions(-)

diff --git a/doc/source/systemd.rst b/doc/source/systemd.rst
index 60a7719262..f9971abf5a 100644
--- a/doc/source/systemd.rst
+++ b/doc/source/systemd.rst
@@ -98,8 +98,7 @@ Follow logs for a specific service::
 
 Following logs for multiple services simultaneously::
 
-  journalctl -f --unit devstack@n-cpu.service --unit
-  devstack@n-cond.service
+  journalctl -f --unit devstack@n-cpu.service --unit devstack@n-cond.service
 
 or you can even do wild cards to follow all the nova services::
 
@@ -121,6 +120,29 @@ left/right arrow keys.
 
 See ``man 1 journalctl`` for more.
 
+Debugging with pdb
+==================
+
+In order to break into a regular pdb session on a systemd-controlled
+service, you need to invoke the process manually - that is, take it out
+of systemd's control.
+
+Discover the command systemd is using to run the service::
+
+  systemctl show devstack@n-sch.service -p ExecStart --no-pager
+
+Stop the systemd service::
+
+  sudo systemctl stop devstack@n-sch.service
+
+Inject your breakpoint in the source, e.g.::
+
+  import pdb; pdb.set_trace()
+
+Invoke the command manually::
+
+  /usr/local/bin/nova-scheduler --config-file /etc/nova/nova.conf
+
 Known Issues
 ============
 

From 16ab25c187aa7972f85e96197cf182b009bb8465 Mon Sep 17 00:00:00 2001
From: Eric Fried <efried@us.ibm.com>
Date: Thu, 7 Sep 2017 15:44:34 -0500
Subject: [PATCH 1119/2409] doc: How to remote-pdb under systemd

Add instructions for installing and enabling remote-pdb [1] under
systemd.

[1] https://pypi.python.org/pypi/remote-pdb

Thanks to clarkb for pointing me to this.  TIL.

Change-Id: I640ac36cfbcc5b199e911c0e3f6b18705c3fbbc4
---
 doc/source/systemd.rst | 38 ++++++++++++++++++++++++++++++++++++--
 1 file changed, 36 insertions(+), 2 deletions(-)

diff --git a/doc/source/systemd.rst b/doc/source/systemd.rst
index f9971abf5a..c1d2944057 100644
--- a/doc/source/systemd.rst
+++ b/doc/source/systemd.rst
@@ -120,8 +120,11 @@ left/right arrow keys.
 
 See ``man 1 journalctl`` for more.
 
-Debugging with pdb
-==================
+Debugging
+=========
+
+Using pdb
+---------
 
 In order to break into a regular pdb session on a systemd-controlled
 service, you need to invoke the process manually - that is, take it out
@@ -143,6 +146,37 @@ Invoke the command manually::
 
   /usr/local/bin/nova-scheduler --config-file /etc/nova/nova.conf
 
+Using remote-pdb
+----------------
+
+`remote-pdb`_ works while the process is under systemd control.
+
+Make sure you have remote-pdb installed::
+
+  sudo pip install remote-pdb
+
+Inject your breakpoint in the source, e.g.::
+
+  import remote_pdb; remote_pdb.set_trace()
+
+Restart the relevant service::
+
+  sudo systemctl restart devstack@n-api.service
+
+The remote-pdb code configures the telnet port when ``set_trace()`` is
+invoked.  Do whatever it takes to hit the instrumented code path, and
+inspect the logs for a message displaying the listening port::
+
+  Sep 07 16:36:12 p8-100-neo devstack@n-api.service[772]: RemotePdb session open at 127.0.0.1:46771, waiting for connection ...
+
+Telnet to that port to enter the pdb session::
+
+  telnet 127.0.0.1 46771
+
+See the `remote-pdb`_ home page for more options.
+
+.. _`remote-pdb`: https://pypi.python.org/pypi/remote-pdb
+
 Known Issues
 ============
 

From ef60f2b7180f269a53f405efa7449618eddf86a1 Mon Sep 17 00:00:00 2001
From: Dinesh Bhor <dinesh.bhor@nttdata.com>
Date: Tue, 5 Sep 2017 14:40:32 +0530
Subject: [PATCH 1120/2409] Enable reloadable config in services

uwsgi services:
[1] By default uwsgi is set to exit on reload this breaks config reloading
    of the service [1][2]. It needs to be set to 'false'.
[2] Requires to add 'systemctl reload' command support by adding ExecReload
    in unit file.

Non uwsgi services:
[1] Non uwsgi services only requires to add ExecReload in unit file.

There was a similar patch submitted by Matthew Treinish [3] but it was
already set to workflow +1(not merged as having dependency on other patch)
and it was having some issues as specified in comment and missing reload
functionality for other services.

[1] https://etherpad.openstack.org/p/uwsgi-issues
[2] http://uwsgi-docs.readthedocs.io/en/latest/Options.html#exit-on-reload
[3] https://review.openstack.org/#/c/490904/2

Change-Id: I78f5e9d4574671c74a52af64724946feb41c2d7a
---
 functions-common | 3 +++
 lib/apache       | 4 ++--
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/functions-common b/functions-common
index 52f53ef147..1e6ae5cc76 100644
--- a/functions-common
+++ b/functions-common
@@ -45,6 +45,7 @@ declare -A -g GITBRANCH
 declare -A -g GITDIR
 
 TRACK_DEPENDS=${TRACK_DEPENDS:-False}
+KILL_PATH="$(which kill)"
 
 # Save these variables to .stackenv
 STACK_ENV_VARS="BASE_SQL_CONN DATA_DIR DEST ENABLED_SERVICES HOST_IP \
@@ -1453,6 +1454,7 @@ function write_user_unit_file {
     iniset -sudo $unitfile "Service" "ExecStart" "$command"
     iniset -sudo $unitfile "Service" "KillMode" "process"
     iniset -sudo $unitfile "Service" "TimeoutStopSec" "infinity"
+    iniset -sudo $unitfile "Service" "ExecReload" "$KILL_PATH -HUP \$MAINPID"
     if [[ -n "$group" ]]; then
         iniset -sudo $unitfile "Service" "Group" "$group"
     fi
@@ -1474,6 +1476,7 @@ function write_uwsgi_user_unit_file {
     iniset -sudo $unitfile "Service" "SyslogIdentifier" "$service"
     iniset -sudo $unitfile "Service" "User" "$user"
     iniset -sudo $unitfile "Service" "ExecStart" "$command"
+    iniset -sudo $unitfile "Service" "ExecReload" "$KILL_PATH -HUP \$MAINPID"
     iniset -sudo $unitfile "Service" "Type" "notify"
     iniset -sudo $unitfile "Service" "KillMode" "process"
     iniset -sudo $unitfile "Service" "Restart" "always"
diff --git a/lib/apache b/lib/apache
index 39d5b7b071..5dc0e98192 100644
--- a/lib/apache
+++ b/lib/apache
@@ -259,7 +259,7 @@ function write_uwsgi_config {
     iniset "$file" uwsgi master true
     # Set die-on-term & exit-on-reload so that uwsgi shuts down
     iniset "$file" uwsgi die-on-term true
-    iniset "$file" uwsgi exit-on-reload true
+    iniset "$file" uwsgi exit-on-reload false
     # Set worker-reload-mercy so that worker will not exit till the time
     # configured after graceful shutdown
     iniset "$file" uwsgi worker-reload-mercy $WORKER_TIMEOUT
@@ -316,7 +316,7 @@ function write_local_uwsgi_http_config {
     iniset "$file" uwsgi master true
     # Set die-on-term & exit-on-reload so that uwsgi shuts down
     iniset "$file" uwsgi die-on-term true
-    iniset "$file" uwsgi exit-on-reload true
+    iniset "$file" uwsgi exit-on-reload false
     iniset "$file" uwsgi enable-threads true
     iniset "$file" uwsgi plugins python
     # uwsgi recommends this to prevent thundering herd on accept.

From cbd5f4e0ad2ccc5903d12df73e3f0b033df1b3ae Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Sun, 10 Sep 2017 15:00:29 -0600
Subject: [PATCH 1121/2409] Check that generate-subunit exists before using it

If stack.sh fails before os-testr is installed, the generate-subunit
command won't exist.

Change-Id: I7998ed81e419e25d183e5a780df0b4459cca237c
---
 stack.sh | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/stack.sh b/stack.sh
index 301e1e7c6b..10ffc5e23c 100755
--- a/stack.sh
+++ b/stack.sh
@@ -537,14 +537,20 @@ function exit_trap {
 
     if [[ $r -ne 0 ]]; then
         echo "Error on exit"
-        generate-subunit $DEVSTACK_START_TIME $SECONDS 'fail' >> ${SUBUNIT_OUTPUT}
+        # If we error before we've installed os-testr, which will fail.
+        if type -p generate-subunit > /dev/null; then
+            generate-subunit $DEVSTACK_START_TIME $SECONDS 'fail' >> ${SUBUNIT_OUTPUT}
+        fi
         if [[ -z $LOGDIR ]]; then
             $TOP_DIR/tools/worlddump.py
         else
             $TOP_DIR/tools/worlddump.py -d $LOGDIR
         fi
     else
-        generate-subunit $DEVSTACK_START_TIME $SECONDS >> ${SUBUNIT_OUTPUT}
+        # If we error before we've installed os-testr, which will fail.
+        if type -p generate-subunit > /dev/null; then
+            generate-subunit $DEVSTACK_START_TIME $SECONDS >> ${SUBUNIT_OUTPUT}
+        fi
     fi
 
     exit $r

From 35a0c573b36236c8d73a0699cc7882170787f494 Mon Sep 17 00:00:00 2001
From: "James E. Blair" <jeblair@redhat.com>
Date: Sun, 10 Sep 2017 15:37:56 -0700
Subject: [PATCH 1122/2409] Update gate clone error message for Zuul v3

Change-Id: I351de28aa5d5f25187953f1a4502445bc2ce76cc
---
 functions-common | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index deebdec249..c0fbcafa0c 100644
--- a/functions-common
+++ b/functions-common
@@ -519,7 +519,7 @@ function git_clone {
         if [[ ! -d $git_dest ]]; then
             if [[ "$ERROR_ON_CLONE" = "True" ]]; then
                 echo "The $git_dest project was not found; if this is a gate job, add"
-                echo "the project to the \$PROJECTS variable in the job definition."
+                echo "the project to 'required-projects' in the job definition."
                 die $LINENO "Cloning not allowed in this configuration"
             fi
             git_timed clone $git_clone_flags $git_remote $git_dest

From 02f9e8bbdddd69603cbb0afc93279c4151afd5f5 Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Sun, 10 Sep 2017 02:51:10 +0200
Subject: [PATCH 1123/2409] Replace pmap shellout with pure python
 implementation

Without this patch, the pmap -XX call fails on openSUSE Leap
distributions as those have a fairly ancient procps version that
does not support the -XX parameter. A pure python implementation
is more portable, faster and even shorter than the subprocess
call.

Closes-Bug: #1716066
Change-Id: I2fdb457e65359a1c9d40452c922cfdca0e6e74dc
---
 tools/mlock_report.py | 37 +++++++++++++++----------------------
 1 file changed, 15 insertions(+), 22 deletions(-)

diff --git a/tools/mlock_report.py b/tools/mlock_report.py
index 2169cc2dce..07716b04d6 100755
--- a/tools/mlock_report.py
+++ b/tools/mlock_report.py
@@ -3,12 +3,12 @@
 # This tool lists processes that lock memory pages from swapping to disk.
 
 import re
-import subprocess
 
 import psutil
 
 
-SUMMARY_REGEX = re.compile(b".*\s+(?P<locked>[\d]+)\s+KB")
+LCK_SUMMARY_REGEX = re.compile(
+    "^VmLck:\s+(?P<locked>[\d]+)\s+kB", re.MULTILINE)
 
 
 def main():
@@ -22,28 +22,21 @@ def main():
 def _get_report():
     mlock_users = []
     for proc in psutil.process_iter():
-        pid = proc.pid
         # sadly psutil does not expose locked pages info, that's why we
-        # call to pmap and parse the output here
+        # iterate over the /proc/%pid/status files manually
         try:
-            out = subprocess.check_output(['pmap', '-XX', str(pid)])
-        except subprocess.CalledProcessError as e:
-            # 42 means process just vanished, which is ok
-            if e.returncode == 42:
-                continue
-            raise
-        last_line = out.splitlines()[-1]
-
-        # some processes don't provide a memory map, for example those
-        # running as kernel services, so we need to skip those that don't
-        # match
-        result = SUMMARY_REGEX.match(last_line)
-        if result:
-            locked = int(result.group('locked'))
-            if locked:
-                mlock_users.append({'name': proc.name(),
-                                    'pid': pid,
-                                    'locked': locked})
+            s = open("%s/%d/status" % (psutil.PROCFS_PATH, proc.pid), 'r')
+        except EnvironmentError:
+            continue
+        with s:
+            for line in s:
+                result = LCK_SUMMARY_REGEX.search(line)
+                if result:
+                    locked = int(result.group('locked'))
+                    if locked:
+                        mlock_users.append({'name': proc.name(),
+                                            'pid': proc.pid,
+                                            'locked': locked})
 
     # produce a single line log message with per process mlock stats
     if mlock_users:

From e43dfdd453cd8d2c71f63ebbc96ad261d13e48eb Mon Sep 17 00:00:00 2001
From: Brian Haley <bhaley@redhat.com>
Date: Tue, 12 Sep 2017 16:13:26 -0600
Subject: [PATCH 1124/2409] Change lib/neutron-legacy to not enable linuxbridge
 for DVR

DVR isn't supported by the Linux Bridge agent, but the
mechanism driver is enabled by default, so Neutron attempts
port-bindings for it, generating ERRORS in the neutron-server
log in the check and gate jobs.  Just remove it in the DVR case.

Change-Id: Ic50e12e5fecf366a182c141b5c99649e653254cb
Closes-bug: #1716782
---
 lib/neutron-legacy | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index f9e0bd6ded..0e326d600a 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -168,7 +168,7 @@ fi
 #
 Q_DVR_MODE=${Q_DVR_MODE:-legacy}
 if [[ "$Q_DVR_MODE" != "legacy" ]]; then
-    Q_ML2_PLUGIN_MECHANISM_DRIVERS=openvswitch,linuxbridge,l2population
+    Q_ML2_PLUGIN_MECHANISM_DRIVERS=openvswitch,l2population
 fi
 
 # Provider Network Configurations

From 941940a92cd5424bbe5125569b083f1059569bdb Mon Sep 17 00:00:00 2001
From: Andreas Scheuring <andreas.scheuring@de.ibm.com>
Date: Wed, 13 Sep 2017 00:24:02 +0200
Subject: [PATCH 1125/2409] Add etcd3 support for s390x

Since [1] devstack is failing on s390x with "Distro not supported".
The reason for this is the missing etcd3 support. It worked before
[1] as we were able to disable etcd3 via local.conf. But as etcd3 is
a base service, we might not be able to rely on this workarond in
the future anymore.

As there is no etcd3 binary hosted on github like it is for other
architectures, the user needs to specify an alternative download
URL via local.conf. Otherwise devstack will exit with an appropriate
error message.

  ETCD_DOWNLOAD_URL=<custom-download-url>

[1] https://github.com/openstack-dev/devstack/commit/d8bb220606737719bcdf7c5b4f54906f2974c71c

Change-Id: I1c378a0456dcf2e94d79a02de9d3e16753d946d6
Partial-Bug: #1693192
---
 doc/source/configuration.rst | 15 ++++++++++++---
 stackrc                      | 11 +++++++++++
 2 files changed, 23 insertions(+), 3 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index c4834b7a84..23f680a59c 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -779,9 +779,15 @@ are needed::
     DOWNLOAD_DEFAULT_IMAGES=False
     IMAGE_URLS="https://cloud-images.ubuntu.com/xenial/current/xenial-server-cloudimg-s390x-disk1.img"
 
+    # Provide a custom etcd3 binary download URL and ints sha256.
+    # The binary must be located under '/<etcd version>/etcd-<etcd-version>-linux-s390x.tar.gz'
+    # on this URL.
+    # Build instructions for etcd3: https://github.com/linux-on-ibm-z/docs/wiki/Building-etcd
+    ETCD_DOWNLOAD_URL=<your-etcd-download-url>
+    ETCD_SHA256=<your-etcd3-sha256>
+
     enable_service n-sproxy
     disable_service n-novnc
-    disable_service etcd3  # https://bugs.launchpad.net/devstack/+bug/1693192
 
     [[post-config|$NOVA_CONF]]
 
@@ -803,8 +809,11 @@ Reasoning:
   needed if you want to use the *serial console* outside of the all-in-one
   setup.
 
-* The service ``etcd3`` needs to be disabled as long as bug report
-  https://bugs.launchpad.net/devstack/+bug/1693192 is not resolved.
+* A link to an etcd3 binary and its sha256 needs to be provided as the
+  binary for s390x is not hosted on github like it is for other
+  architectures. For more details see
+  https://bugs.launchpad.net/devstack/+bug/1693192. Etcd3 can easily be
+  built along https://github.com/linux-on-ibm-z/docs/wiki/Building-etcd.
 
 .. note:: To run *Tempest* against this *Devstack* all-in-one, you'll need
    to use a guest image which is smaller than 1GB when uncompressed.
diff --git a/stackrc b/stackrc
index c2bbe21aca..92a939f164 100644
--- a/stackrc
+++ b/stackrc
@@ -719,6 +719,7 @@ ETCD_SHA256_AMD64="4fde194bbcd259401e2b5c462dfa579ee7f6af539f13f130b8f5b4f52e3b3
 # NOTE(sdague): etcd v3.1.7 doesn't have anything for these architectures, though 3.2.0 does.
 ETCD_SHA256_ARM64=""
 ETCD_SHA256_PPC64=""
+ETCD_SHA256_S390X=""
 # Make sure etcd3 downloads the correct architecture
 if is_arch "x86_64"; then
     ETCD_ARCH="amd64"
@@ -729,6 +730,16 @@ elif is_arch "aarch64"; then
 elif is_arch "ppc64le"; then
     ETCD_ARCH="ppc64le"
     ETCD_SHA256=${ETCD_SHA256:-$ETCD_SHA256_PPC64}
+elif is_arch "s390x"; then
+    # An etcd3 binary for s390x is not available on github like it is
+    # for other arches. Only continue if a custom download URL was
+    # provided.
+    if [[ -n "${ETCD_DOWNLOAD_URL}" ]]; then
+        ETCD_ARCH="s390x"
+        ETCD_SHA256=${ETCD_SHA256:-$ETCD_SHA256_S390X}
+    else
+        exit_distro_not_supported "etcd3. No custom ETCD_DOWNLOAD_URL provided."
+    fi
 else
     exit_distro_not_supported "invalid hardware type - $ETCD_ARCH"
 fi

From c04ac03e21546a3d25a2b6794802c4988f4ff532 Mon Sep 17 00:00:00 2001
From: Gyorgy Szombathelyi <gyurco@freemail.hu>
Date: Tue, 23 May 2017 16:52:35 +0200
Subject: [PATCH 1126/2409] Change deprecated nova settings

Change-Id: I0d129150411ede344c9b710d1aca5af1df3478b6
---
 lib/cinder | 19 +++----------------
 1 file changed, 3 insertions(+), 16 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index bc0c13fb88..59bcf8235c 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -230,16 +230,6 @@ function configure_cinder {
 
     configure_auth_token_middleware $CINDER_CONF cinder $CINDER_AUTH_CACHE_DIR
 
-    # Change the default nova_catalog_info and nova_catalog_admin_info values in
-    # cinder so that the service name cinder is searching for matches that set for
-    # nova in keystone.
-    if [[ -n "$CINDER_NOVA_CATALOG_INFO" ]]; then
-        iniset $CINDER_CONF DEFAULT nova_catalog_info $CINDER_NOVA_CATALOG_INFO
-    fi
-    if [[ -n "$CINDER_NOVA_CATALOG_ADMIN_INFO" ]]; then
-        iniset $CINDER_CONF DEFAULT nova_catalog_admin_info $CINDER_NOVA_CATALOG_ADMIN_INFO
-    fi
-
     iniset $CINDER_CONF DEFAULT auth_strategy keystone
     iniset $CINDER_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
 
@@ -254,8 +244,6 @@ function configure_cinder {
     iniset $CINDER_CONF DEFAULT periodic_interval $CINDER_PERIODIC_INTERVAL
     iniset $CINDER_CONF DEFAULT my_ip "$HOST_IP"
 
-    iniset $CINDER_CONF DEFAULT os_region_name "$REGION_NAME"
-
     iniset $CINDER_CONF key_manager api_class cinder.keymgr.conf_key_mgr.ConfKeyManager
 
     if is_service_enabled c-vol && [[ -n "$CINDER_ENABLED_BACKENDS" ]]; then
@@ -332,10 +320,9 @@ function configure_cinder {
         iniset $CINDER_CONF DEFAULT glance_api_version 2
     fi
 
-    # Set os_privileged_user credentials (used for os-assisted-snapshots)
-    iniset $CINDER_CONF DEFAULT os_privileged_user_name nova
-    iniset $CINDER_CONF DEFAULT os_privileged_user_password "$SERVICE_PASSWORD"
-    iniset $CINDER_CONF DEFAULT os_privileged_user_tenant "$SERVICE_PROJECT_NAME"
+    # Set nova credentials (used for os-assisted-snapshots)
+    configure_auth_token_middleware $CINDER_CONF nova $CINDER_AUTH_CACHE_DIR nova
+    iniset $CINDER_CONF nova region_name "$REGION_NAME"
     iniset $CINDER_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
 
     if [[ ! -z "$CINDER_COORDINATION_URL" ]]; then

From 868746b5dac21e4c97a03f53459fca4e5aba73db Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Wed, 13 Sep 2017 15:44:18 -0600
Subject: [PATCH 1127/2409] lib/neutron: fix metering agent startup with
 systemd

With systemd, we now require absolute paths passed to run_process.

Change-Id: Iabd425a6d0ebaaaa5b13bc4a7b062158940958e6
---
 lib/neutron | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron b/lib/neutron
index 2ffabd416b..a672d399ea 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -443,7 +443,7 @@ function start_neutron_new {
     fi
 
     if is_service_enabled neutron-metering; then
-        run_process neutron-metering "$NEUTRON_METERING_BINARY --config-file $NEUTRON_CONF --config-file $NEUTRON_METERING_AGENT_CONF"
+        run_process neutron-metering "$NEUTRON_BIN_DIR/$NEUTRON_METERING_BINARY --config-file $NEUTRON_CONF --config-file $NEUTRON_METERING_AGENT_CONF"
     fi
 }
 

From 387aadd14e87f2890ad8969c15edbe9f1d218a5a Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Thu, 14 Sep 2017 09:25:59 -0600
Subject: [PATCH 1128/2409] Install neutron rpms/debs when lib/neutron is used

lib/neutron service prefixes are neutron-* not q-*. We should install
those packages either way.

The patch moves files/*/neutron into files/*/neutron-common so that we
can correctly match */neutron against service specific dependency files
(f.e. */neutron-agent) and load the common packages if any neutron-*
service is present.

Change-Id: I57b36f2ed3f33737223a35d9ed734bb414f31e0b
---
 files/debs/{neutron => neutron-common}      | 0
 files/rpms-suse/{neutron => neutron-common} | 0
 files/rpms/{neutron => neutron-common}      | 0
 functions-common                            | 6 +++---
 4 files changed, 3 insertions(+), 3 deletions(-)
 rename files/debs/{neutron => neutron-common} (100%)
 rename files/rpms-suse/{neutron => neutron-common} (100%)
 rename files/rpms/{neutron => neutron-common} (100%)

diff --git a/files/debs/neutron b/files/debs/neutron-common
similarity index 100%
rename from files/debs/neutron
rename to files/debs/neutron-common
diff --git a/files/rpms-suse/neutron b/files/rpms-suse/neutron-common
similarity index 100%
rename from files/rpms-suse/neutron
rename to files/rpms-suse/neutron-common
diff --git a/files/rpms/neutron b/files/rpms/neutron-common
similarity index 100%
rename from files/rpms/neutron
rename to files/rpms/neutron-common
diff --git a/functions-common b/functions-common
index deebdec249..33639c5936 100644
--- a/functions-common
+++ b/functions-common
@@ -1211,9 +1211,9 @@ function get_packages {
             if [[ ! $file_to_parse =~ $package_dir/keystone ]]; then
                 file_to_parse="${file_to_parse} ${package_dir}/keystone"
             fi
-        elif [[ $service == q-* ]]; then
-            if [[ ! $file_to_parse =~ $package_dir/neutron ]]; then
-                file_to_parse="${file_to_parse} ${package_dir}/neutron"
+        elif [[ $service == q-* || $service == neutron-* ]]; then
+            if [[ ! $file_to_parse =~ $package_dir/neutron-common ]]; then
+                file_to_parse="${file_to_parse} ${package_dir}/neutron-common"
             fi
         elif [[ $service == ir-* ]]; then
             if [[ ! $file_to_parse =~ $package_dir/ironic ]]; then

From 4324f4ecd99f3cc50dea585bc8b5a680327e54bc Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Thu, 14 Sep 2017 12:59:25 -0600
Subject: [PATCH 1129/2409] Fix devstack python detection if python3 is missing

On platforms without python3 installed devstack fails the python
version check. This does it more gracefully.

Change-Id: I4d79a41eb2d66852ab1a1aa8bd383f8e3e89cdc0
---
 functions-common | 5 ++++-
 stackrc          | 4 ++--
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/functions-common b/functions-common
index deebdec249..b9bf0c9788 100644
--- a/functions-common
+++ b/functions-common
@@ -2080,7 +2080,10 @@ function is_provider_network {
 function _get_python_version {
     local interp=$1
     local version
-    version=$($interp -c 'import sys; print("%s.%s" % sys.version_info[0:2])')
+    # disable erroring out here, otherwise if python 3 doesn't exist we fail hard.
+    if [[ -x $(which $interp) ]]; then
+        version=$($interp -c 'import sys; print("%s.%s" % sys.version_info[0:2])')
+    fi
     echo ${version}
 }
 
diff --git a/stackrc b/stackrc
index 92a939f164..d60e186448 100644
--- a/stackrc
+++ b/stackrc
@@ -131,11 +131,11 @@ export DISABLED_PYTHON3_PACKAGES=""
 # version of Python 3 to this variable will install the app using that
 # version of the interpreter instead of 2.7.
 _DEFAULT_PYTHON3_VERSION="$(_get_python_version python3)"
-export PYTHON3_VERSION=${PYTHON3_VERSION:-${_DEFAULT_PYTHON3_VERSION}}
+export PYTHON3_VERSION=${PYTHON3_VERSION:-${_DEFAULT_PYTHON3_VERSION:-3.5}}
 
 # Just to be more explicit on the Python 2 version to use.
 _DEFAULT_PYTHON2_VERSION="$(_get_python_version python2)"
-export PYTHON2_VERSION=${PYTHON2_VERSION:-${_DEFAULT_PYTHON2_VERSION}}
+export PYTHON2_VERSION=${PYTHON2_VERSION:-${_DEFAULT_PYTHON2_VERSION:-2.7}}
 
 # allow local overrides of env variables, including repo config
 if [[ -f $RC_DIR/localrc ]]; then

From df17927fe84b4e50d5bc7376b6ff12bb70767a61 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Fri, 15 Sep 2017 10:09:54 +0000
Subject: [PATCH 1130/2409] Updated from generate-devstack-plugins-list

Change-Id: I3012b07f87a1d9c432e1b97b7400fae693c9331a
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 2c8805ff16..6aa2e93739 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -39,6 +39,7 @@ cloudkitty                             `git://git.openstack.org/openstack/cloudk
 collectd-ceilometer-plugin             `git://git.openstack.org/openstack/collectd-ceilometer-plugin <https://git.openstack.org/cgit/openstack/collectd-ceilometer-plugin>`__
 congress                               `git://git.openstack.org/openstack/congress <https://git.openstack.org/cgit/openstack/congress>`__
 cue                                    `git://git.openstack.org/openstack/cue <https://git.openstack.org/cgit/openstack/cue>`__
+cyborg                                 `git://git.openstack.org/openstack/cyborg <https://git.openstack.org/cgit/openstack/cyborg>`__
 designate                              `git://git.openstack.org/openstack/designate <https://git.openstack.org/cgit/openstack/designate>`__
 devstack-plugin-additional-pkg-repos   `git://git.openstack.org/openstack/devstack-plugin-additional-pkg-repos <https://git.openstack.org/cgit/openstack/devstack-plugin-additional-pkg-repos>`__
 devstack-plugin-amqp1                  `git://git.openstack.org/openstack/devstack-plugin-amqp1 <https://git.openstack.org/cgit/openstack/devstack-plugin-amqp1>`__

From 6bd4924cec73908225e6744b1b00dd86cb39d3ed Mon Sep 17 00:00:00 2001
From: Javier Pena <jpena@redhat.com>
Date: Fri, 15 Sep 2017 15:55:00 +0200
Subject: [PATCH 1131/2409] Ignore stderr when checking for Python version

https://review.openstack.org/504171 prevented Python version detection
from failing when python3 is not installed. However, "which python3"
returns a message in stderr when python3 is not there, and this output
can make diskimage-builder get confused when parsing
source-repository-images.

Change-Id: Idb649dc341ede73c39954b0432ef3cacf379ed37
---
 functions-common | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index 283a6cf3d5..e53c72dc6e 100644
--- a/functions-common
+++ b/functions-common
@@ -2081,7 +2081,7 @@ function _get_python_version {
     local interp=$1
     local version
     # disable erroring out here, otherwise if python 3 doesn't exist we fail hard.
-    if [[ -x $(which $interp) ]]; then
+    if [[ -x $(which $interp 2> /dev/null) ]]; then
         version=$($interp -c 'import sys; print("%s.%s" % sys.version_info[0:2])')
     fi
     echo ${version}

From 5ad4e58868bf48a72841bee313fd2aae61b6ddf7 Mon Sep 17 00:00:00 2001
From: "John L. Villalovos" <john.l.villalovos@intel.com>
Date: Thu, 7 Sep 2017 15:33:57 -0700
Subject: [PATCH 1132/2409] Display unaccounted time in "DevStack Component
 Timing"

In the "DevStack Component Timing" section, display the unaccounted
time.

Also add the units (seconds) to the output to make it clear to viewers.

Change-Id: Iaca82cc54a355f7077e20e548b771e53387f6628
---
 functions-common | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/functions-common b/functions-common
index 4fc7c6db92..f2b8d98b39 100644
--- a/functions-common
+++ b/functions-common
@@ -2270,11 +2270,13 @@ function cleanup_oscwrap {
 function time_totals {
     local elapsed_time
     local end_time
-    local len=15
+    local len=20
     local xtrace
+    local unaccounted_time
 
     end_time=$(date +%s)
     elapsed_time=$(($end_time - $_TIME_BEGIN))
+    unaccounted_time=$elapsed_time
 
     # pad 1st column this far
     for t in ${!_TIME_TOTAL[*]}; do
@@ -2291,16 +2293,19 @@ function time_totals {
     echo
     echo "========================="
     echo "DevStack Component Timing"
+    echo " (times are in seconds)  "
     echo "========================="
-    printf "%-${len}s %3d\n" "Total runtime" "$elapsed_time"
-    echo
     for t in ${!_TIME_TOTAL[*]}; do
         local v=${_TIME_TOTAL[$t]}
         # because we're recording in milliseconds
         v=$(($v / 1000))
         printf "%-${len}s %3d\n" "$t" "$v"
+        unaccounted_time=$(($unaccounted_time - $v))
     done
+    echo "-------------------------"
+    printf "%-${len}s %3d\n" "Unaccounted time" "$unaccounted_time"
     echo "========================="
+    printf "%-${len}s %3d\n" "Total runtime" "$elapsed_time"
 
     $xtrace
 }

From b2330c89196c65662fcf98a2295b7e41b1652b28 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Tue, 19 Sep 2017 09:10:21 +0000
Subject: [PATCH 1133/2409] Fix memcached_servers setting

By default memcached is bound to 127.0.0.1 and we have no code in place
to change that. So instead of using the $SERVICE_HOST variable, we
hardcode it to localhost, just as we do for the cache settings, see [1].

This also avoids a bug that occurs when $SERVICE_HOST contains an IPv6
address, as in that case it would have to be prefixed by "inet6:" [2].

[1] I95d798d122e2a95e27eb1d2c4e786c3cd844440b
[2] https://bugs.launchpad.net/swift/+bug/1610064

Change-Id: I46bed8a048f4b0d669dfc65b28ddeb36963553e0
Partial-Bug: 1656329
---
 lib/keystone | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/keystone b/lib/keystone
index c38d953742..870a1fa992 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -450,7 +450,7 @@ function configure_auth_token_middleware {
 
     iniset $conf_file $section cafile $SSL_BUNDLE_FILE
     iniset $conf_file $section signing_dir $signing_dir
-    iniset $conf_file $section memcached_servers $SERVICE_HOST:11211
+    iniset $conf_file $section memcached_servers localhost:11211
 }
 
 # init_keystone() - Initialize databases, etc.

From ee22ca8373abd3b5a4c44a9c5c4da39c511195c8 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Wed, 20 Sep 2017 00:29:36 +0000
Subject: [PATCH 1134/2409] Revert "Update to using pike cloud-archive"

This reverts commit a7e9a5d447b3eeacfb52d7ddc94445058a8d6fd1.

The jobs that run live migration tests are failing at about
a rate of 50% since this merged. There are no recent changes
to nova in the last 24 hours that are related to live
migration, and this is failing on the master branch only,
so I suspect the failures are due to new qemu packages
getting pulled in from this change.

Change-Id: Ic8481539c6a0cc7af08a736a625b672979435908
Closes-Bug: #1718295
---
 tools/fixup_stuff.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index efe0125741..f1552ab2f7 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -84,10 +84,10 @@ if [[ "${ENABLE_UBUNTU_CLOUD_ARCHIVE}" == "True" && "$DISTRO" = "xenial" ]]; the
         # we can find local mirrors then use that mirror.
         source /etc/ci/mirror_info.sh
 
-        sudo apt-add-repository -y "deb $NODEPOOL_UCA_MIRROR xenial-updates/pike main"
+        sudo apt-add-repository -y "deb $NODEPOOL_UCA_MIRROR xenial-updates/ocata main"
     else
         # Otherwise use upstream UCA
-        sudo add-apt-repository -y cloud-archive:pike
+        sudo add-apt-repository -y cloud-archive:ocata
     fi
 
     # Disable use of libvirt wheel since a cached wheel build might be

From 7617ac208596665061453dfa04b75e4cc8a76ac9 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Tue, 19 Sep 2017 17:43:48 +0000
Subject: [PATCH 1135/2409] Make is_ipv4_address a bit more robust

Still not ideal, but at least should avoid matching IPv6 addresses.

Change-Id: Ibb64263fdb0308f56c18518289501dd4642dcbad
---
 functions-common | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index 713d92e717..ffdacef32e 100644
--- a/functions-common
+++ b/functions-common
@@ -2014,7 +2014,7 @@ function cidr2netmask {
 # Check if this is a valid ipv4 address string
 function is_ipv4_address {
     local address=$1
-    local regex='([0-9]{1,3}.){3}[0-9]{1,3}'
+    local regex='([0-9]{1,3}\.){3}[0-9]{1,3}'
     # TODO(clarkb) make this more robust
     if [[ "$address" =~ $regex ]] ; then
         return 0

From 146332e349416ac0b3c9653b0ae68d55dbb3f9de Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Wed, 20 Sep 2017 06:18:08 +0000
Subject: [PATCH 1136/2409] Make etcd3 setup work with IPv6 addresses

The client are told to connect to SERVICE_HOST instead of HOST_IP, so
we need to start etcd3 with matching listening parameters.

Change-Id: I96389090180d21d25d72df8f9e8905b850bcaee9
Partial-Bug: 1656329
---
 lib/etcd3 | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/lib/etcd3 b/lib/etcd3
index 60e827add2..e6a04f11de 100644
--- a/lib/etcd3
+++ b/lib/etcd3
@@ -40,9 +40,13 @@ function start_etcd3 {
     cmd+=" --initial-cluster-state new --initial-cluster-token etcd-cluster-01"
     cmd+=" --initial-cluster $HOSTNAME=http://$SERVICE_HOST:2380"
     cmd+=" --initial-advertise-peer-urls http://$SERVICE_HOST:2380"
-    cmd+=" --advertise-client-urls http://${HOST_IP}:$ETCD_PORT"
-    cmd+=" --listen-peer-urls http://0.0.0.0:2380 "
-    cmd+=" --listen-client-urls http://${HOST_IP}:$ETCD_PORT"
+    cmd+=" --advertise-client-urls http://$SERVICE_HOST:$ETCD_PORT"
+    if [ "$SERVICE_LISTEN_ADDRESS" == "::" ]; then
+        cmd+=" --listen-peer-urls http://[::]:2380 "
+    else
+        cmd+=" --listen-peer-urls http://0.0.0.0:2380 "
+    fi
+    cmd+=" --listen-client-urls http://$SERVICE_HOST:$ETCD_PORT"
 
     local unitfile="$SYSTEMD_DIR/$ETCD_SYSTEMD_SERVICE"
     write_user_unit_file $ETCD_SYSTEMD_SERVICE "$cmd" "" "root"

From 917ad0998be8c48bfcc0e3031bc1b75cd9ed1927 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Wed, 20 Sep 2017 14:46:48 +0000
Subject: [PATCH 1137/2409] Update to using pike cloud-archive

This reverts commit ee22ca8373abd3b5a4c44a9c5c4da39c511195c8

Depends-On: Iae2962bb86100f03fd3ad9aac3767da876291e74

Change-Id: I4d5fa052bdc5eef1795f6507589e2eaf4e093e23
Related-Bug: #1718295
---
 tools/fixup_stuff.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index f1552ab2f7..efe0125741 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -84,10 +84,10 @@ if [[ "${ENABLE_UBUNTU_CLOUD_ARCHIVE}" == "True" && "$DISTRO" = "xenial" ]]; the
         # we can find local mirrors then use that mirror.
         source /etc/ci/mirror_info.sh
 
-        sudo apt-add-repository -y "deb $NODEPOOL_UCA_MIRROR xenial-updates/ocata main"
+        sudo apt-add-repository -y "deb $NODEPOOL_UCA_MIRROR xenial-updates/pike main"
     else
         # Otherwise use upstream UCA
-        sudo add-apt-repository -y cloud-archive:ocata
+        sudo add-apt-repository -y cloud-archive:pike
     fi
 
     # Disable use of libvirt wheel since a cached wheel build might be

From e3915938f35737fc231ab7b8b9981dae9048438e Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Fri, 24 Feb 2017 06:24:47 +0000
Subject: [PATCH 1138/2409] Configure bridge_mappings for ovs and linuxbridge
 agents

Otherwise neutron will fail to bind external ports because of missing
entries for external physical network in the mapping.

Configure it only when l3 agent is also installed on the node (otherwise
the l2 agent is not exposed to external network and hence doesn't have
the bridge).

Change-Id: I561b74538acb0dc39f1af3e832108ce6a99441b0
---
 lib/neutron | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/lib/neutron b/lib/neutron
index f277062b32..6da1705525 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -211,6 +211,13 @@ function configure_neutron_new {
         iniset $NEUTRON_L3_CONF agent root_helper_daemon "$NEUTRON_ROOTWRAP_DAEMON_CMD"
         iniset $NEUTRON_L3_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
         neutron_plugin_configure_l3_agent $NEUTRON_L3_CONF
+
+        # Configure the neutron agent to serve external network ports
+        if [[ $NEUTRON_AGENT == "linuxbridge" ]]; then
+            iniset $NEUTRON_CORE_PLUGIN_CONF linux_bridge bridge_mappings "$PUBLIC_NETWORK_NAME:$PUBLIC_BRIDGE"
+        else
+            iniset $NEUTRON_CORE_PLUGIN_CONF ovs bridge_mappings "$PUBLIC_NETWORK_NAME:$PUBLIC_BRIDGE"
+        fi
     fi
 
     # Metadata

From c652a498fb6ae1cdd7480b590be0f1e843768666 Mon Sep 17 00:00:00 2001
From: yuanke wei <weiyuanke123@gmail.com>
Date: Sun, 17 Sep 2017 22:18:07 +0800
Subject: [PATCH 1139/2409] Fix partial download problem

(1) when checksum fails, better delete the broken files and try the second time;
(2) amazon s3 is not good in mainland China, better try one more time with wget

Change-Id: I24ee73f216b78bd80564863cd335e5d5a9b56360
---
 functions | 2 +-
 lib/etcd3 | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/functions b/functions
index 33a0e6aaf5..8b69c73bba 100644
--- a/functions
+++ b/functions
@@ -63,7 +63,7 @@ function get_extra_file {
     if [[ $file_url != file* ]]; then
         # If the file isn't cache, download it
         if [[ ! -f $FILES/$file_name ]]; then
-            wget --progress=dot:giga -c $file_url -O $FILES/$file_name
+            wget --progress=dot:giga -t 2 -c $file_url -O $FILES/$file_name
             if [[ $? -ne 0 ]]; then
                 die "$file_url could not be downloaded"
             fi
diff --git a/lib/etcd3 b/lib/etcd3
index 60e827add2..934bbb004f 100644
--- a/lib/etcd3
+++ b/lib/etcd3
@@ -98,8 +98,8 @@ function install_etcd3 {
     etcd_file="$(get_extra_file $ETCD_DOWNLOAD_LOCATION)"
     if [ ! -f "$FILES/etcd-$ETCD_VERSION-linux-$ETCD_ARCH/etcd" ]; then
         echo "${ETCD_SHA256} $etcd_file" > $FILES/etcd.sha256sum
-        # NOTE(sdague): this should go fatal if this fails
-        sha256sum -c $FILES/etcd.sha256sum
+        # NOTE(yuanke wei): rm the damaged file when checksum fails
+        sha256sum -c $FILES/etcd.sha256sum || (sudo rm -f $etcd_file; exit 1)
 
         tar xzvf $etcd_file -C $FILES
         sudo cp $FILES/$ETCD_NAME/etcd $ETCD_BIN_DIR/etcd

From c4b0059c6b9818e622f9fb010719d6c92de9d91d Mon Sep 17 00:00:00 2001
From: Matthew Treinish <mtreinish@kortar.org>
Date: Fri, 22 Sep 2017 15:07:36 -0400
Subject: [PATCH 1140/2409] Disable the v2.0 identity API by default

The v2.0 identity API is being removed in the Queens release, but in
order to do so we need to stop some v2.0 tempests tests from being
run. This commit switches the default to disable the keystone v2 api.
In a future commit after the removal of the api from keystone the bits
to deploy the v2 api will be removed.

Change-Id: I5afcba6321f496b8170be27789bee7c9ad8eacce
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 0ffcb67219..e7e584b8f2 100644
--- a/stackrc
+++ b/stackrc
@@ -184,7 +184,7 @@ IDENTITY_API_VERSION=${IDENTITY_API_VERSION:-3}
 # will to be set to ``3`` in order to make DevStack register the Identity
 # endpoint as v3. This flag is experimental and will be used as basis to
 # identify the projects which still have issues to operate with Identity v3.
-ENABLE_IDENTITY_V2=$(trueorfalse True ENABLE_IDENTITY_V2)
+ENABLE_IDENTITY_V2=$(trueorfalse False ENABLE_IDENTITY_V2)
 if [ "$ENABLE_IDENTITY_V2" == "False" ]; then
     IDENTITY_API_VERSION=3
 fi

From 03ae3c485e497296146a102f89853fd4063a20db Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Tue, 19 Sep 2017 14:22:19 -0500
Subject: [PATCH 1141/2409] Fix comment wording nit

Change-Id: I558522121099f14d380c163a2c397b34335b03df
---
 stack.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/stack.sh b/stack.sh
index 10ffc5e23c..08cdbe422b 100755
--- a/stack.sh
+++ b/stack.sh
@@ -537,7 +537,7 @@ function exit_trap {
 
     if [[ $r -ne 0 ]]; then
         echo "Error on exit"
-        # If we error before we've installed os-testr, which will fail.
+        # If we error before we've installed os-testr, this will fail.
         if type -p generate-subunit > /dev/null; then
             generate-subunit $DEVSTACK_START_TIME $SECONDS 'fail' >> ${SUBUNIT_OUTPUT}
         fi
@@ -547,7 +547,7 @@ function exit_trap {
             $TOP_DIR/tools/worlddump.py -d $LOGDIR
         fi
     else
-        # If we error before we've installed os-testr, which will fail.
+        # If we error before we've installed os-testr, this will fail.
         if type -p generate-subunit > /dev/null; then
             generate-subunit $DEVSTACK_START_TIME $SECONDS >> ${SUBUNIT_OUTPUT}
         fi

From 66a14df49ebe99805e6a332a2c346ba3e1290a68 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Fri, 22 Sep 2017 20:51:38 -0400
Subject: [PATCH 1142/2409] doc: prefix journalctl examples with sudo

In a devstack environment you likely need to use sudo
to run the journalctl command, so this adds that to
the examples.

Change-Id: Ibe6b71285a3014e80e06a50130f18bfbdb4ff3ab
---
 doc/source/systemd.rst | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/doc/source/systemd.rst b/doc/source/systemd.rst
index c1d2944057..523d399c62 100644
--- a/doc/source/systemd.rst
+++ b/doc/source/systemd.rst
@@ -94,25 +94,25 @@ query facilities. We'll start with some common options.
 
 Follow logs for a specific service::
 
-  journalctl -f --unit devstack@n-cpu.service
+  sudo journalctl -f --unit devstack@n-cpu.service
 
 Following logs for multiple services simultaneously::
 
-  journalctl -f --unit devstack@n-cpu.service --unit devstack@n-cond.service
+  sudo journalctl -f --unit devstack@n-cpu.service --unit devstack@n-cond.service
 
 or you can even do wild cards to follow all the nova services::
 
-  journalctl -f --unit devstack@n-*
+  sudo journalctl -f --unit devstack@n-*
 
 Use higher precision time stamps::
 
-  journalctl -f -o short-precise --unit devstack@n-cpu.service
+  sudo journalctl -f -o short-precise --unit devstack@n-cpu.service
 
 By default, journalctl strips out "unprintable" characters, including
 ASCII color codes. To keep the color codes (which can be interpreted by
 an appropriate terminal/pager - e.g. ``less``, the default)::
 
-  journalctl -a --unit devstack@n-cpu.service
+  sudo journalctl -a --unit devstack@n-cpu.service
 
 When outputting to the terminal using the default pager, long lines
 appear to be truncated, but horizontal scrolling is supported via the

From 3a59c9d7e3e54f3d3d4e64cd6c42fc1572d9ca17 Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Sat, 23 Sep 2017 14:37:58 +0200
Subject: [PATCH 1143/2409] Remove deprecated forbid_global_implied_dsr

This setting was only useful for Mitaka and older, however Mitaka
is now EOL.

Change-Id: Ia1eb87d68a6265d8541cb87a88523246885e5a8a
---
 lib/tempest | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index f086f9a65d..96a170839b 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -293,10 +293,6 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG identity-feature-enabled security_compliance True
     fi
 
-    # TODO(rodrigods): This is a feature flag for bug 1590578 which is fixed in
-    # Newton and Ocata. This option can be removed after Mitaka is end of life.
-    iniset $TEMPEST_CONFIG identity-feature-enabled forbid_global_implied_dsr True
-
     # When LDAP is enabled domain specific drivers are also enabled and the users
     # and groups identity tests must adapt to this scenario
     if is_service_enabled ldap; then

From 5ef8a125cc3a8b8f461a9636001c0ad7f6f88957 Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Mon, 25 Sep 2017 13:08:51 +0200
Subject: [PATCH 1144/2409] Install minimal lsb-release package on openSUSE

lsb-release is a dependency of "lsb", so it used to work
before just fine as well, but it was installing about 300MB
of "stuff" that we don't actually need..

Change-Id: I25c7c750cbaeb40bf4f2e8695608c4b1003289ea
---
 functions-common | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/functions-common b/functions-common
index 1b8ca96fd4..a09f972e6e 100644
--- a/functions-common
+++ b/functions-common
@@ -319,10 +319,7 @@ function _ensure_lsb_release {
     if [[ -x $(command -v apt-get 2>/dev/null) ]]; then
         sudo apt-get install -y lsb-release
     elif [[ -x $(command -v zypper 2>/dev/null) ]]; then
-        # XXX: old code paths seem to have assumed SUSE platforms also
-        # had "yum".  Keep this ordered above yum so we don't try to
-        # install the rh package.  suse calls it just "lsb"
-        sudo zypper -n install lsb
+        sudo zypper -n install lsb-release
     elif [[ -x $(command -v dnf 2>/dev/null) ]]; then
         sudo dnf install -y redhat-lsb-core
     elif [[ -x $(command -v yum 2>/dev/null) ]]; then

From 07a8823d4f42ceb8146cf5eb8b1fffcbb4599e25 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Mon, 25 Sep 2017 11:36:20 +0000
Subject: [PATCH 1145/2409] Update default etcd version

There have been a couple of new stable releases in the meantime, update
to using v3.1.10 which is the currently latest stable version.

Change-Id: Ifa1421c9f12af9753052f992929deb7ebd45e804
---
 stackrc | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/stackrc b/stackrc
index 0ffcb67219..44a42a1ed9 100644
--- a/stackrc
+++ b/stackrc
@@ -714,9 +714,9 @@ fi
 EXTRA_CACHE_URLS=""
 
 # etcd3 defaults
-ETCD_VERSION=${ETCD_VERSION:-v3.1.7}
-ETCD_SHA256_AMD64="4fde194bbcd259401e2b5c462dfa579ee7f6af539f13f130b8f5b4f52e3b3c52"
-# NOTE(sdague): etcd v3.1.7 doesn't have anything for these architectures, though 3.2.0 does.
+ETCD_VERSION=${ETCD_VERSION:-v3.1.10}
+ETCD_SHA256_AMD64="2d335f298619c6fb02b1124773a56966e448ad9952b26fea52909da4fe80d2be"
+# NOTE(sdague): etcd v3.1.10 doesn't have anything for these architectures, though 3.2.x does.
 ETCD_SHA256_ARM64=""
 ETCD_SHA256_PPC64=""
 ETCD_SHA256_S390X=""

From 721f7c2cd0f8c1e4dba95f5f6be7ff342b355f01 Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Mon, 25 Sep 2017 13:53:10 +0200
Subject: [PATCH 1146/2409] Switch DEVSTACK_SERIES to queens

pike is handled in stable/pike branch for some time
already.

Change-Id: I47dc5bf661c50b3b05c19ad665c2671f807233ae
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 0ffcb67219..4901009c09 100644
--- a/stackrc
+++ b/stackrc
@@ -246,7 +246,7 @@ REQUIREMENTS_DIR=$DEST/requirements
 # Setting the variable to 'ALL' will activate the download for all
 # libraries.
 
-DEVSTACK_SERIES="pike"
+DEVSTACK_SERIES="queens"
 
 ##############
 #

From 062829c3f600bef1187c3d8a4baca6f66327b62a Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Wed, 20 Sep 2017 22:49:44 +0200
Subject: [PATCH 1147/2409] Drop MySQL-python installation from packages

We want that one to be installed via pip, if we still use it
(by default PyMySQL is used, which is already installed via
pip as well).

Change-Id: I76454aa7f84379aa387b144686bcfaa327b141ed
---
 files/rpms/keystone       | 1 -
 files/rpms/neutron-common | 1 -
 files/rpms/nova           | 1 -
 3 files changed, 3 deletions(-)

diff --git a/files/rpms/keystone b/files/rpms/keystone
index 170308373a..5f19c6f70c 100644
--- a/files/rpms/keystone
+++ b/files/rpms/keystone
@@ -1,4 +1,3 @@
 memcached
 mod_ssl
-MySQL-python
 sqlite
diff --git a/files/rpms/neutron-common b/files/rpms/neutron-common
index a4e029a6eb..0cc8d11ceb 100644
--- a/files/rpms/neutron-common
+++ b/files/rpms/neutron-common
@@ -6,7 +6,6 @@ haproxy # to serve as metadata proxy inside router/dhcp namespaces
 iptables
 iputils
 mysql-devel
-MySQL-python
 mysql-server # NOPRIME
 openvswitch # NOPRIME
 rabbitmq-server # NOPRIME
diff --git a/files/rpms/nova b/files/rpms/nova
index 632e796d07..64ed480632 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -12,7 +12,6 @@ kpartx
 libxml2-python
 m2crypto
 mysql-devel
-MySQL-python
 mysql-server # NOPRIME
 numpy # needed by websockify for spice console
 parted

From 32712717788d9ff373afd4ecd20b3c4f9079b260 Mon Sep 17 00:00:00 2001
From: Sean McGinnis <sean.mcginnis@huawei.com>
Date: Fri, 22 Sep 2017 07:49:15 -0500
Subject: [PATCH 1148/2409] Change Cinder api_class setting to backend

Castellan switched the `api_class` config option to `backend` in commit
8980bf7da55dd084ad84c84534fe937f0d43b9c0. The old setting will still be
recognized for now, but we should switch to using the new, correct config
option.

Change-Id: I5e46c738531d5d56777e91a00f4cee9531356f2e
---
 lib/cinder | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/cinder b/lib/cinder
index 7a6caf345b..07f82a1580 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -243,7 +243,7 @@ function configure_cinder {
     iniset $CINDER_CONF DEFAULT periodic_interval $CINDER_PERIODIC_INTERVAL
     iniset $CINDER_CONF DEFAULT my_ip "$HOST_IP"
 
-    iniset $CINDER_CONF key_manager api_class cinder.keymgr.conf_key_mgr.ConfKeyManager
+    iniset $CINDER_CONF key_manager backend cinder.keymgr.conf_key_mgr.ConfKeyManager
 
     if is_service_enabled c-vol && [[ -n "$CINDER_ENABLED_BACKENDS" ]]; then
         local enabled_backends=""

From 5085dc0fa50da4a78820c814005f89ab02d36d84 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Fri, 22 Sep 2017 20:54:39 -0400
Subject: [PATCH 1149/2409] doc: add journalctl example for grepping the logs

I had to dig around for awhile to figure this out, so
this adds an example on how to grep journalctl nova logs
for a server instance UUID.

Change-Id: I6a5c47fbcba3af1822e2f9efc2ac20ebe0387f3f
---
 doc/source/systemd.rst | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/doc/source/systemd.rst b/doc/source/systemd.rst
index 523d399c62..c9614db8a6 100644
--- a/doc/source/systemd.rst
+++ b/doc/source/systemd.rst
@@ -118,6 +118,11 @@ When outputting to the terminal using the default pager, long lines
 appear to be truncated, but horizontal scrolling is supported via the
 left/right arrow keys.
 
+You can pipe the output to another tool, such as ``grep``. For
+example, to find a server instance UUID in the nova logs::
+
+  sudo journalctl -a --unit devstack@n-* | grep 58391b5c-036f-44d5-bd68-21d3c26349e6
+
 See ``man 1 journalctl`` for more.
 
 Debugging

From ef5ebed6c9ca3d9d47fd2a732a1542555a0f65ba Mon Sep 17 00:00:00 2001
From: Jamie Lennox <jamielennox@gmail.com>
Date: Mon, 25 Sep 2017 09:38:38 +1000
Subject: [PATCH 1150/2409] Remove cache dirs from the services

PKI tokens have been actively deprecated from keystone and there are
deprecations being emitted from keystonemiddleware. Because of this we
no longer need an auth cache directory in the services where the PKI
certifcates used to be stored.

Remove the creation and use of all these AUTH_CACHE directories.

Change-Id: I5680376e70e74882e9fdb87ee1b95d5f40570ad7
---
 lib/cinder         | 12 +-----------
 lib/glance         | 16 +++-------------
 lib/keystone       |  6 ++----
 lib/neutron        | 17 +++--------------
 lib/neutron-legacy |  6 ++----
 lib/nova           | 13 ++-----------
 lib/swift          |  7 +------
 7 files changed, 14 insertions(+), 63 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 07f82a1580..387fc1ac2c 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -51,7 +51,6 @@ else
 fi
 
 CINDER_STATE_PATH=${CINDER_STATE_PATH:=$DATA_DIR/cinder}
-CINDER_AUTH_CACHE_DIR=${CINDER_AUTH_CACHE_DIR:-/var/cache/cinder}
 
 CINDER_CONF_DIR=/etc/cinder
 CINDER_CONF=$CINDER_CONF_DIR/cinder.conf
@@ -225,9 +224,8 @@ function configure_cinder {
     inicomment $CINDER_API_PASTE_INI filter:authtoken admin_tenant_name
     inicomment $CINDER_API_PASTE_INI filter:authtoken admin_user
     inicomment $CINDER_API_PASTE_INI filter:authtoken admin_password
-    inicomment $CINDER_API_PASTE_INI filter:authtoken signing_dir
 
-    configure_auth_token_middleware $CINDER_CONF cinder $CINDER_AUTH_CACHE_DIR
+    configure_auth_token_middleware $CINDER_CONF cinder
 
     iniset $CINDER_CONF DEFAULT auth_strategy keystone
     iniset $CINDER_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
@@ -385,13 +383,6 @@ function create_cinder_accounts {
     fi
 }
 
-# create_cinder_cache_dir() - Part of the init_cinder() process
-function create_cinder_cache_dir {
-    # Create cache dir
-    sudo install -d -o $STACK_USER $CINDER_AUTH_CACHE_DIR
-    rm -f $CINDER_AUTH_CACHE_DIR/*
-}
-
 # init_cinder() - Initialize database and volume group
 function init_cinder {
     if is_service_enabled $DATABASE_BACKENDS; then
@@ -420,7 +411,6 @@ function init_cinder {
     fi
 
     mkdir -p $CINDER_STATE_PATH/volumes
-    create_cinder_cache_dir
 }
 
 # install_cinder() - Collect source and prepare
diff --git a/lib/glance b/lib/glance
index 74734c7516..8241c5f9d7 100644
--- a/lib/glance
+++ b/lib/glance
@@ -44,7 +44,6 @@ fi
 GLANCE_CACHE_DIR=${GLANCE_CACHE_DIR:=$DATA_DIR/glance/cache}
 GLANCE_IMAGE_DIR=${GLANCE_IMAGE_DIR:=$DATA_DIR/glance/images}
 GLANCE_LOCK_DIR=${GLANCE_LOCK_DIR:=$DATA_DIR/glance/locks}
-GLANCE_AUTH_CACHE_DIR=${GLANCE_AUTH_CACHE_DIR:-/var/cache/glance}
 
 GLANCE_CONF_DIR=${GLANCE_CONF_DIR:-/etc/glance}
 GLANCE_METADEF_DIR=$GLANCE_CONF_DIR/metadefs
@@ -98,7 +97,7 @@ function is_glance_enabled {
 function cleanup_glance {
     # kill instances (nova)
     # delete image files (glance)
-    sudo rm -rf $GLANCE_CACHE_DIR $GLANCE_IMAGE_DIR $GLANCE_AUTH_CACHE_DIR
+    sudo rm -rf $GLANCE_CACHE_DIR $GLANCE_IMAGE_DIR
 }
 
 # configure_glance() - Set config files, create data dirs, etc
@@ -115,7 +114,7 @@ function configure_glance {
     iniset $GLANCE_REGISTRY_CONF database connection $dburl
     iniset $GLANCE_REGISTRY_CONF DEFAULT use_syslog $SYSLOG
     iniset $GLANCE_REGISTRY_CONF paste_deploy flavor keystone
-    configure_auth_token_middleware $GLANCE_REGISTRY_CONF glance $GLANCE_AUTH_CACHE_DIR/registry
+    configure_auth_token_middleware $GLANCE_REGISTRY_CONF glance
     iniset $GLANCE_REGISTRY_CONF oslo_messaging_notifications driver messagingv2
     iniset_rpc_backend glance $GLANCE_REGISTRY_CONF
     iniset $GLANCE_REGISTRY_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
@@ -127,7 +126,7 @@ function configure_glance {
     iniset $GLANCE_API_CONF DEFAULT image_cache_dir $GLANCE_CACHE_DIR/
     iniset $GLANCE_API_CONF DEFAULT lock_path $GLANCE_LOCK_DIR
     iniset $GLANCE_API_CONF paste_deploy flavor keystone+cachemanagement
-    configure_auth_token_middleware $GLANCE_API_CONF glance $GLANCE_AUTH_CACHE_DIR/api
+    configure_auth_token_middleware $GLANCE_API_CONF glance
     iniset $GLANCE_API_CONF oslo_messaging_notifications driver messagingv2
     iniset_rpc_backend glance $GLANCE_API_CONF
     if [ "$VIRT_DRIVER" = 'xenserver' ]; then
@@ -279,13 +278,6 @@ function create_glance_accounts {
     fi
 }
 
-# create_glance_cache_dir() - Part of the init_glance() process
-function create_glance_cache_dir {
-    # Create cache dir
-    sudo install -d -o $STACK_USER $GLANCE_AUTH_CACHE_DIR/api $GLANCE_AUTH_CACHE_DIR/registry $GLANCE_AUTH_CACHE_DIR/search $GLANCE_AUTH_CACHE_DIR/artifact
-    rm -f $GLANCE_AUTH_CACHE_DIR/api/* $GLANCE_AUTH_CACHE_DIR/registry/* $GLANCE_AUTH_CACHE_DIR/search/* $GLANCE_AUTH_CACHE_DIR/artifact/*
-}
-
 # init_glance() - Initialize databases, etc.
 function init_glance {
     # Delete existing images
@@ -306,8 +298,6 @@ function init_glance {
     # Load metadata definitions
     $GLANCE_BIN_DIR/glance-manage --config-file $GLANCE_CONF_DIR/glance-api.conf db_load_metadefs
     time_stop "dbsync"
-
-    create_glance_cache_dir
 }
 
 # install_glanceclient() - Collect source and prepare
diff --git a/lib/keystone b/lib/keystone
index 714f089cca..7bd887ca2d 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -429,7 +429,7 @@ function create_service_user {
 
 # Configure the service to use the auth token middleware.
 #
-# configure_auth_token_middleware conf_file admin_user signing_dir [section]
+# configure_auth_token_middleware conf_file admin_user [section]
 #
 # section defaults to keystone_authtoken, which is where auth_token looks in
 # the .conf file. If the paste config file is used (api-paste.ini) then
@@ -437,8 +437,7 @@ function create_service_user {
 function configure_auth_token_middleware {
     local conf_file=$1
     local admin_user=$2
-    local signing_dir=$3
-    local section=${4:-keystone_authtoken}
+    local section=${3:-keystone_authtoken}
 
     iniset $conf_file $section auth_type password
     iniset $conf_file $section auth_url $KEYSTONE_SERVICE_URI
@@ -449,7 +448,6 @@ function configure_auth_token_middleware {
     iniset $conf_file $section project_domain_name "$SERVICE_DOMAIN_NAME"
 
     iniset $conf_file $section cafile $SSL_BUNDLE_FILE
-    iniset $conf_file $section signing_dir $signing_dir
     iniset $conf_file $section memcached_servers localhost:11211
 }
 
diff --git a/lib/neutron b/lib/neutron
index 21c8d4c735..359f19820d 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -30,7 +30,6 @@ GITDIR["python-neutronclient"]=$DEST/python-neutronclient
 
 NEUTRON_AGENT=${NEUTRON_AGENT:-openvswitch}
 NEUTRON_DIR=$DEST/neutron
-NEUTRON_AUTH_CACHE_DIR=${NEUTRON_AUTH_CACHE_DIR:-/var/cache/neutron}
 
 NEUTRON_BIN_DIR=$(get_python_exec_prefix)
 NEUTRON_DHCP_BINARY="neutron-dhcp-agent"
@@ -44,7 +43,6 @@ NEUTRON_L3_CONF=$NEUTRON_CONF_DIR/l3_agent.ini
 NEUTRON_AGENT_CONF=$NEUTRON_CONF_DIR/
 
 NEUTRON_STATE_PATH=${NEUTRON_STATE_PATH:=$DATA_DIR/neutron}
-NEUTRON_AUTH_CACHE_DIR=${NEUTRON_AUTH_CACHE_DIR:-/var/cache/neutron}
 
 # By default, use the ML2 plugin
 NEUTRON_CORE_PLUGIN=${NEUTRON_CORE_PLUGIN:-ml2}
@@ -175,8 +173,8 @@ function configure_neutron_new {
         iniset $NEUTRON_CONF DEFAULT allow_overlapping_ips True
 
         iniset $NEUTRON_CONF DEFAULT auth_strategy $NEUTRON_AUTH_STRATEGY
-        configure_auth_token_middleware $NEUTRON_CONF neutron $NEUTRON_AUTH_CACHE_DIR keystone_authtoken
-        configure_auth_token_middleware $NEUTRON_CONF nova $NEUTRON_AUTH_CACHE_DIR nova
+        configure_auth_token_middleware $NEUTRON_CONF neutron keystone_authtoken
+        configure_auth_token_middleware $NEUTRON_CONF nova nova
 
         # Configure VXLAN
         # TODO(sc68cal) not hardcode?
@@ -250,7 +248,7 @@ function configure_neutron_new {
 
         # TODO(dtroyer): remove the v2.0 hard code below
         iniset $NEUTRON_META_CONF DEFAULT auth_url $KEYSTONE_SERVICE_URI
-        configure_auth_token_middleware $NEUTRON_META_CONF neutron $NEUTRON_AUTH_CACHE_DIR DEFAULT
+        configure_auth_token_middleware $NEUTRON_META_CONF neutron DEFAULT
     fi
 
     # Format logging
@@ -337,13 +335,6 @@ function create_neutron_accounts_new {
     fi
 }
 
-# create_neutron_cache_dir() - Part of the init_neutron() process
-function create_neutron_cache_dir {
-    # Create cache dir
-    sudo install -d -o $STACK_USER $NEUTRON_AUTH_CACHE_DIR
-    rm -f $NEUTRON_AUTH_CACHE_DIR/*
-}
-
 # init_neutron() - Initialize databases, etc.
 function init_neutron_new {
 
@@ -353,8 +344,6 @@ function init_neutron_new {
     # Run Neutron db migrations
     $NEUTRON_BIN_DIR/neutron-db-manage upgrade heads
     time_stop "dbsync"
-
-    create_neutron_cache_dir
 }
 
 # install_neutron() - Collect source and prepare
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 0ccb17c084..a0e79bc684 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -73,7 +73,6 @@ GITDIR["python-neutronclient"]=$DEST/python-neutronclient
 
 NEUTRON_DIR=$DEST/neutron
 NEUTRON_FWAAS_DIR=$DEST/neutron-fwaas
-NEUTRON_AUTH_CACHE_DIR=${NEUTRON_AUTH_CACHE_DIR:-/var/cache/neutron}
 
 # Support entry points installation of console scripts
 if [[ -d $NEUTRON_DIR/bin/neutron-server ]]; then
@@ -815,7 +814,7 @@ function _configure_neutron_service {
     iniset $NEUTRON_CONF DEFAULT notify_nova_on_port_status_changes $Q_NOTIFY_NOVA_PORT_STATUS_CHANGES
     iniset $NEUTRON_CONF DEFAULT notify_nova_on_port_data_changes $Q_NOTIFY_NOVA_PORT_DATA_CHANGES
 
-    configure_auth_token_middleware $NEUTRON_CONF nova $NEUTRON_AUTH_CACHE_DIR nova
+    configure_auth_token_middleware $NEUTRON_CONF nova nova
 
     # Configure plugin
     neutron_plugin_configure_service
@@ -906,8 +905,7 @@ function _neutron_setup_keystone {
     local conf_file=$1
     local section=$2
 
-    create_neutron_cache_dir
-    configure_auth_token_middleware $conf_file $Q_ADMIN_USERNAME $NEUTRON_AUTH_CACHE_DIR $section
+    configure_auth_token_middleware $conf_file $Q_ADMIN_USERNAME $section
 }
 
 function _neutron_setup_interface_driver {
diff --git a/lib/nova b/lib/nova
index 1112f29bd3..dcf2a1c376 100644
--- a/lib/nova
+++ b/lib/nova
@@ -46,7 +46,6 @@ fi
 NOVA_STATE_PATH=${NOVA_STATE_PATH:=$DATA_DIR/nova}
 # INSTANCES_PATH is the previous name for this
 NOVA_INSTANCES_PATH=${NOVA_INSTANCES_PATH:=${INSTANCES_PATH:=$NOVA_STATE_PATH/instances}}
-NOVA_AUTH_CACHE_DIR=${NOVA_AUTH_CACHE_DIR:-/var/cache/nova}
 
 NOVA_CONF_DIR=/etc/nova
 NOVA_CONF=$NOVA_CONF_DIR/nova.conf
@@ -240,7 +239,7 @@ function cleanup_nova {
         sudo rm -rf $NOVA_INSTANCES_PATH/*
     fi
 
-    sudo rm -rf $NOVA_STATE_PATH $NOVA_AUTH_CACHE_DIR
+    sudo rm -rf $NOVA_STATE_PATH
 
     # NOTE(dtroyer): This really should be called from here but due to the way
     #                nova abuses the _cleanup() function we're moving it
@@ -464,7 +463,7 @@ function create_nova_conf {
             iniset $NOVA_CONF DEFAULT osapi_compute_link_prefix $NOVA_SERVICE_PROTOCOL://$NOVA_SERVICE_HOST:$NOVA_SERVICE_PORT
         fi
 
-        configure_auth_token_middleware $NOVA_CONF nova $NOVA_AUTH_CACHE_DIR
+        configure_auth_token_middleware $NOVA_CONF nova
     fi
 
     if is_service_enabled cinder; then
@@ -658,13 +657,6 @@ function init_nova_cells {
     fi
 }
 
-# create_nova_cache_dir() - Part of the init_nova() process
-function create_nova_cache_dir {
-    # Create cache dir
-    sudo install -d -o $STACK_USER $NOVA_AUTH_CACHE_DIR
-    rm -f $NOVA_AUTH_CACHE_DIR/*
-}
-
 function create_nova_conf_nova_network {
     local public_interface=${PUBLIC_INTERFACE:-$PUBLIC_INTERFACE_DEFAULT}
     iniset $NOVA_CONF DEFAULT network_manager "nova.network.manager.$NETWORK_MANAGER"
@@ -722,7 +714,6 @@ function init_nova {
         done
     fi
 
-    create_nova_cache_dir
     create_nova_keys_dir
 
     if [[ "$NOVA_BACKEND" == "LVM" ]]; then
diff --git a/lib/swift b/lib/swift
index 1601e2b1f8..ab014de909 100644
--- a/lib/swift
+++ b/lib/swift
@@ -48,7 +48,6 @@ fi
 
 
 SWIFT_DIR=$DEST/swift
-SWIFT_AUTH_CACHE_DIR=${SWIFT_AUTH_CACHE_DIR:-/var/cache/swift}
 SWIFT_APACHE_WSGI_DIR=${SWIFT_APACHE_WSGI_DIR:-/var/www/swift}
 SWIFT3_DIR=$DEST/swift3
 
@@ -450,7 +449,7 @@ function configure_swift {
     iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:authtoken log_name swift
 
     iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:authtoken paste.filter_factory keystonemiddleware.auth_token:filter_factory
-    configure_auth_token_middleware $SWIFT_CONFIG_PROXY_SERVER swift $SWIFT_AUTH_CACHE_DIR filter:authtoken
+    configure_auth_token_middleware $SWIFT_CONFIG_PROXY_SERVER swift filter:authtoken
     iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:authtoken delay_auth_decision 1
     iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:authtoken cache swift.cache
     iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:authtoken include_service_catalog False
@@ -745,10 +744,6 @@ function init_swift {
         swift-ring-builder container.builder rebalance 42
         swift-ring-builder account.builder rebalance 42
     } && popd >/dev/null
-
-    # Create cache dir
-    sudo install -d -o ${STACK_USER} $SWIFT_AUTH_CACHE_DIR
-    rm -f $SWIFT_AUTH_CACHE_DIR/*
 }
 
 function install_swift {

From 602a057fe0d0b357533feb84d87256edfb7970e2 Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Tue, 26 Sep 2017 10:15:28 +0200
Subject: [PATCH 1151/2409] Fix dstat dependencies for memory_tracker on SUSE

Memory_tracker imports psutil, but does not run inside a pip/virtualenv
so the system provided psutil library needs to be provided. This
is matching what is done for other non-SUSE distributions

Change-Id: I96f944730dc8644333d906d71339351b29b03e08
---
 files/rpms-suse/dstat | 1 +
 1 file changed, 1 insertion(+)

diff --git a/files/rpms-suse/dstat b/files/rpms-suse/dstat
index 2b643b8b1b..0d9da4434f 100644
--- a/files/rpms-suse/dstat
+++ b/files/rpms-suse/dstat
@@ -1 +1,2 @@
 dstat
+python-psutil

From ba4830b84e529943353e71f375ab6538f37efa02 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Wed, 27 Sep 2017 16:45:25 -0400
Subject: [PATCH 1152/2409] Download default image when using VIRT_DRIVER=fake

Change f119121d21fa0446197b26378091677daac1606a removed
the default image to download which meant if you were using
the fake virt driver, no image would get downloaded and
tempest setup would fail.

This adds it back in but doesn't use a wildcard.

The default image is the same as before, but uses the
variables that are also used for the default libvirt image
case.

Change-Id: I80eddd0d3a99572ed494b5cd36fed8ceb4d05d77
Closes-Bug: #1720003
---
 stackrc | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/stackrc b/stackrc
index e7e584b8f2..61555173db 100644
--- a/stackrc
+++ b/stackrc
@@ -701,6 +701,11 @@ if [[ "$DOWNLOAD_DEFAULT_IMAGES" == "True" ]]; then
             DEFAULT_IMAGE_FILE_NAME=${DEFAULT_IMAGE_NAME:-cirros-0.3.5-x86_64-disk.vhd.tgz}
             IMAGE_URLS+="http://ca.downloads.xensource.com/OpenStack/cirros-0.3.5-x86_64-disk.vhd.tgz"
             IMAGE_URLS+=",http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-x86_64-uec.tar.gz";;
+        fake)
+            # Use the same as the default for libvirt
+            DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk}
+            DEFAULT_IMAGE_FILE_NAME=${DEFAULT_IMAGE_FILE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img}
+            IMAGE_URLS+="http://download.cirros-cloud.net/${CIRROS_VERSION}/${DEFAULT_IMAGE_FILE_NAME}";;
     esac
     DOWNLOAD_DEFAULT_IMAGES=False
 fi

From 59251693e7e0e576b26a33633cfff5d92d0a700e Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Thu, 28 Sep 2017 11:56:40 +0000
Subject: [PATCH 1153/2409] Add a note about overriding the journalctl nowrap
 default

Hoping that this helps people who consider this as annoying as I do.

Change-Id: I45e71301efb8d9a17989b57232a142e786175c2a
---
 doc/source/systemd.rst | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/doc/source/systemd.rst b/doc/source/systemd.rst
index c1d2944057..2009f7407c 100644
--- a/doc/source/systemd.rst
+++ b/doc/source/systemd.rst
@@ -115,8 +115,9 @@ an appropriate terminal/pager - e.g. ``less``, the default)::
   journalctl -a --unit devstack@n-cpu.service
 
 When outputting to the terminal using the default pager, long lines
-appear to be truncated, but horizontal scrolling is supported via the
-left/right arrow keys.
+will be truncated, but horizontal scrolling is supported via the
+left/right arrow keys. You can override this by setting the
+``SYSTEMD_LESS`` environment variable to e.g. ``FRXM``.
 
 See ``man 1 journalctl`` for more.
 

From 5b419ffb1f20dfe613bd694fab8c1f08c8db7cce Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 29 Sep 2017 08:42:34 +1000
Subject: [PATCH 1154/2409] Don't check_libs_from_git for now

"pip freeze" reports an error when checking because the repos don't
have a remote under zuulv3

---
Error when trying to get requirement for VCS system Command "git
config --get-regexp remote\..*\.url" failed with error code 1 in
/opt/stack/new/keystone, falling back to uneditable format

Could not determine repository location of /opt/stack/new/keystone
Complete output from command git config --get-regexp remote\..*\.url:

---

This means this check fails.  I think we can fix this by looking at
"pip list" which I will propose in a follow-on, but this fixes the
immediate breaking issue.

Depends-On: Ib12ddf768ee20fd7614622179f6842f5d57864ff
Change-Id: I21ff749ab3e7911fa074e6d53056768f42f8aa57
---
 stack.sh | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index c545c56de3..f5aa7659f9 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1389,7 +1389,11 @@ service_check
 
 # ensure that all the libraries we think we installed from git,
 # actually were.
-check_libs_from_git
+#
+# NOTE(ianw) 2017-09-27 : "pip freeze" is currently having issues
+# with zuulv3 and the way it clones remotes.  We will restore this
+# with a slightly different check soon
+#check_libs_from_git
 
 
 # Configure nova cellsv2

From ae9c6ab759d9dc1c7e72159092539444ca03cf33 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 29 Sep 2017 10:16:47 +1000
Subject: [PATCH 1155/2409] Use "pip list" in check_libs_from_git

As described in the change, "pip freeze" has issues with the way
zuulv3 clones repos without a remote.  This is an attempt to use "pip
list" to check for local install

Change-Id: I33d25f86b6afcadb4b190a0f6c53311111c64521
---
 inc/python | 15 ++++++++++++++-
 stack.sh   |  6 +-----
 2 files changed, 15 insertions(+), 6 deletions(-)

diff --git a/inc/python b/inc/python
index 5e7f742d48..4bc1856fbd 100644
--- a/inc/python
+++ b/inc/python
@@ -386,7 +386,20 @@ function use_library_from_git {
 # determine if a package was installed from git
 function lib_installed_from_git {
     local name=$1
-    pip freeze 2>/dev/null | grep -- "$name" | grep -q -- '-e git'
+    # Note "pip freeze" doesn't always work here, because it tries to
+    # be smart about finding the remote of the git repo the package
+    # was installed from.  This doesn't work with zuul which clones
+    # repos with no remote.
+    #
+    # The best option seems to be to use "pip list" which will tell
+    # you the path an editable install was installed from; for example
+    # in response to something like
+    #  pip install -e 'git+http://git.openstack.org/openstack-dev/bashate#egg=bashate'
+    # pip list shows
+    #  bashate (0.5.2.dev19, /tmp/env/src/bashate)
+    # Thus we look for "path after a comma" to indicate we were
+    # installed from some local place
+    pip list 2>/dev/null | grep -- "$name" | grep -q -- ', .*)$'
 }
 
 # check that everything that's in LIBS_FROM_GIT was actually installed
diff --git a/stack.sh b/stack.sh
index f5aa7659f9..c545c56de3 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1389,11 +1389,7 @@ service_check
 
 # ensure that all the libraries we think we installed from git,
 # actually were.
-#
-# NOTE(ianw) 2017-09-27 : "pip freeze" is currently having issues
-# with zuulv3 and the way it clones remotes.  We will restore this
-# with a slightly different check soon
-#check_libs_from_git
+check_libs_from_git
 
 
 # Configure nova cellsv2

From 1f82f43016f5e3c51560c8b7c0b9c07350731f6c Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Wed, 4 Oct 2017 09:51:02 +1100
Subject: [PATCH 1156/2409] Revert "Remove cache dirs from the services"

This reverts commit ef5ebed6c9ca3d9d47fd2a732a1542555a0f65ba.

The problem here is a backwards-incompatible change to
configure_auth_token_middleware.  Plugins are still passing a
"signing_dir" which is interpreted now as the "section" argument
... this leads to an interesting red-herring issue; because "v" is a
gnu sed command for checking the version, a signing_dir of "/var/..."
(as done in most plugins) gives the weird error:

 sed: -e expression #1, char 32: expected newer version of sed

I think we'll either need a new function, or dummy arguments to get
this back in.

Change-Id: I2098d4eb2747282622cf486fa7dbf216f932f58b
---
 lib/cinder         | 12 +++++++++++-
 lib/glance         | 16 +++++++++++++---
 lib/keystone       |  6 ++++--
 lib/neutron        | 17 ++++++++++++++---
 lib/neutron-legacy |  6 ++++--
 lib/nova           | 13 +++++++++++--
 lib/swift          |  7 ++++++-
 7 files changed, 63 insertions(+), 14 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 387fc1ac2c..07f82a1580 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -51,6 +51,7 @@ else
 fi
 
 CINDER_STATE_PATH=${CINDER_STATE_PATH:=$DATA_DIR/cinder}
+CINDER_AUTH_CACHE_DIR=${CINDER_AUTH_CACHE_DIR:-/var/cache/cinder}
 
 CINDER_CONF_DIR=/etc/cinder
 CINDER_CONF=$CINDER_CONF_DIR/cinder.conf
@@ -224,8 +225,9 @@ function configure_cinder {
     inicomment $CINDER_API_PASTE_INI filter:authtoken admin_tenant_name
     inicomment $CINDER_API_PASTE_INI filter:authtoken admin_user
     inicomment $CINDER_API_PASTE_INI filter:authtoken admin_password
+    inicomment $CINDER_API_PASTE_INI filter:authtoken signing_dir
 
-    configure_auth_token_middleware $CINDER_CONF cinder
+    configure_auth_token_middleware $CINDER_CONF cinder $CINDER_AUTH_CACHE_DIR
 
     iniset $CINDER_CONF DEFAULT auth_strategy keystone
     iniset $CINDER_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
@@ -383,6 +385,13 @@ function create_cinder_accounts {
     fi
 }
 
+# create_cinder_cache_dir() - Part of the init_cinder() process
+function create_cinder_cache_dir {
+    # Create cache dir
+    sudo install -d -o $STACK_USER $CINDER_AUTH_CACHE_DIR
+    rm -f $CINDER_AUTH_CACHE_DIR/*
+}
+
 # init_cinder() - Initialize database and volume group
 function init_cinder {
     if is_service_enabled $DATABASE_BACKENDS; then
@@ -411,6 +420,7 @@ function init_cinder {
     fi
 
     mkdir -p $CINDER_STATE_PATH/volumes
+    create_cinder_cache_dir
 }
 
 # install_cinder() - Collect source and prepare
diff --git a/lib/glance b/lib/glance
index 8241c5f9d7..74734c7516 100644
--- a/lib/glance
+++ b/lib/glance
@@ -44,6 +44,7 @@ fi
 GLANCE_CACHE_DIR=${GLANCE_CACHE_DIR:=$DATA_DIR/glance/cache}
 GLANCE_IMAGE_DIR=${GLANCE_IMAGE_DIR:=$DATA_DIR/glance/images}
 GLANCE_LOCK_DIR=${GLANCE_LOCK_DIR:=$DATA_DIR/glance/locks}
+GLANCE_AUTH_CACHE_DIR=${GLANCE_AUTH_CACHE_DIR:-/var/cache/glance}
 
 GLANCE_CONF_DIR=${GLANCE_CONF_DIR:-/etc/glance}
 GLANCE_METADEF_DIR=$GLANCE_CONF_DIR/metadefs
@@ -97,7 +98,7 @@ function is_glance_enabled {
 function cleanup_glance {
     # kill instances (nova)
     # delete image files (glance)
-    sudo rm -rf $GLANCE_CACHE_DIR $GLANCE_IMAGE_DIR
+    sudo rm -rf $GLANCE_CACHE_DIR $GLANCE_IMAGE_DIR $GLANCE_AUTH_CACHE_DIR
 }
 
 # configure_glance() - Set config files, create data dirs, etc
@@ -114,7 +115,7 @@ function configure_glance {
     iniset $GLANCE_REGISTRY_CONF database connection $dburl
     iniset $GLANCE_REGISTRY_CONF DEFAULT use_syslog $SYSLOG
     iniset $GLANCE_REGISTRY_CONF paste_deploy flavor keystone
-    configure_auth_token_middleware $GLANCE_REGISTRY_CONF glance
+    configure_auth_token_middleware $GLANCE_REGISTRY_CONF glance $GLANCE_AUTH_CACHE_DIR/registry
     iniset $GLANCE_REGISTRY_CONF oslo_messaging_notifications driver messagingv2
     iniset_rpc_backend glance $GLANCE_REGISTRY_CONF
     iniset $GLANCE_REGISTRY_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
@@ -126,7 +127,7 @@ function configure_glance {
     iniset $GLANCE_API_CONF DEFAULT image_cache_dir $GLANCE_CACHE_DIR/
     iniset $GLANCE_API_CONF DEFAULT lock_path $GLANCE_LOCK_DIR
     iniset $GLANCE_API_CONF paste_deploy flavor keystone+cachemanagement
-    configure_auth_token_middleware $GLANCE_API_CONF glance
+    configure_auth_token_middleware $GLANCE_API_CONF glance $GLANCE_AUTH_CACHE_DIR/api
     iniset $GLANCE_API_CONF oslo_messaging_notifications driver messagingv2
     iniset_rpc_backend glance $GLANCE_API_CONF
     if [ "$VIRT_DRIVER" = 'xenserver' ]; then
@@ -278,6 +279,13 @@ function create_glance_accounts {
     fi
 }
 
+# create_glance_cache_dir() - Part of the init_glance() process
+function create_glance_cache_dir {
+    # Create cache dir
+    sudo install -d -o $STACK_USER $GLANCE_AUTH_CACHE_DIR/api $GLANCE_AUTH_CACHE_DIR/registry $GLANCE_AUTH_CACHE_DIR/search $GLANCE_AUTH_CACHE_DIR/artifact
+    rm -f $GLANCE_AUTH_CACHE_DIR/api/* $GLANCE_AUTH_CACHE_DIR/registry/* $GLANCE_AUTH_CACHE_DIR/search/* $GLANCE_AUTH_CACHE_DIR/artifact/*
+}
+
 # init_glance() - Initialize databases, etc.
 function init_glance {
     # Delete existing images
@@ -298,6 +306,8 @@ function init_glance {
     # Load metadata definitions
     $GLANCE_BIN_DIR/glance-manage --config-file $GLANCE_CONF_DIR/glance-api.conf db_load_metadefs
     time_stop "dbsync"
+
+    create_glance_cache_dir
 }
 
 # install_glanceclient() - Collect source and prepare
diff --git a/lib/keystone b/lib/keystone
index 7bd887ca2d..714f089cca 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -429,7 +429,7 @@ function create_service_user {
 
 # Configure the service to use the auth token middleware.
 #
-# configure_auth_token_middleware conf_file admin_user [section]
+# configure_auth_token_middleware conf_file admin_user signing_dir [section]
 #
 # section defaults to keystone_authtoken, which is where auth_token looks in
 # the .conf file. If the paste config file is used (api-paste.ini) then
@@ -437,7 +437,8 @@ function create_service_user {
 function configure_auth_token_middleware {
     local conf_file=$1
     local admin_user=$2
-    local section=${3:-keystone_authtoken}
+    local signing_dir=$3
+    local section=${4:-keystone_authtoken}
 
     iniset $conf_file $section auth_type password
     iniset $conf_file $section auth_url $KEYSTONE_SERVICE_URI
@@ -448,6 +449,7 @@ function configure_auth_token_middleware {
     iniset $conf_file $section project_domain_name "$SERVICE_DOMAIN_NAME"
 
     iniset $conf_file $section cafile $SSL_BUNDLE_FILE
+    iniset $conf_file $section signing_dir $signing_dir
     iniset $conf_file $section memcached_servers localhost:11211
 }
 
diff --git a/lib/neutron b/lib/neutron
index 359f19820d..21c8d4c735 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -30,6 +30,7 @@ GITDIR["python-neutronclient"]=$DEST/python-neutronclient
 
 NEUTRON_AGENT=${NEUTRON_AGENT:-openvswitch}
 NEUTRON_DIR=$DEST/neutron
+NEUTRON_AUTH_CACHE_DIR=${NEUTRON_AUTH_CACHE_DIR:-/var/cache/neutron}
 
 NEUTRON_BIN_DIR=$(get_python_exec_prefix)
 NEUTRON_DHCP_BINARY="neutron-dhcp-agent"
@@ -43,6 +44,7 @@ NEUTRON_L3_CONF=$NEUTRON_CONF_DIR/l3_agent.ini
 NEUTRON_AGENT_CONF=$NEUTRON_CONF_DIR/
 
 NEUTRON_STATE_PATH=${NEUTRON_STATE_PATH:=$DATA_DIR/neutron}
+NEUTRON_AUTH_CACHE_DIR=${NEUTRON_AUTH_CACHE_DIR:-/var/cache/neutron}
 
 # By default, use the ML2 plugin
 NEUTRON_CORE_PLUGIN=${NEUTRON_CORE_PLUGIN:-ml2}
@@ -173,8 +175,8 @@ function configure_neutron_new {
         iniset $NEUTRON_CONF DEFAULT allow_overlapping_ips True
 
         iniset $NEUTRON_CONF DEFAULT auth_strategy $NEUTRON_AUTH_STRATEGY
-        configure_auth_token_middleware $NEUTRON_CONF neutron keystone_authtoken
-        configure_auth_token_middleware $NEUTRON_CONF nova nova
+        configure_auth_token_middleware $NEUTRON_CONF neutron $NEUTRON_AUTH_CACHE_DIR keystone_authtoken
+        configure_auth_token_middleware $NEUTRON_CONF nova $NEUTRON_AUTH_CACHE_DIR nova
 
         # Configure VXLAN
         # TODO(sc68cal) not hardcode?
@@ -248,7 +250,7 @@ function configure_neutron_new {
 
         # TODO(dtroyer): remove the v2.0 hard code below
         iniset $NEUTRON_META_CONF DEFAULT auth_url $KEYSTONE_SERVICE_URI
-        configure_auth_token_middleware $NEUTRON_META_CONF neutron DEFAULT
+        configure_auth_token_middleware $NEUTRON_META_CONF neutron $NEUTRON_AUTH_CACHE_DIR DEFAULT
     fi
 
     # Format logging
@@ -335,6 +337,13 @@ function create_neutron_accounts_new {
     fi
 }
 
+# create_neutron_cache_dir() - Part of the init_neutron() process
+function create_neutron_cache_dir {
+    # Create cache dir
+    sudo install -d -o $STACK_USER $NEUTRON_AUTH_CACHE_DIR
+    rm -f $NEUTRON_AUTH_CACHE_DIR/*
+}
+
 # init_neutron() - Initialize databases, etc.
 function init_neutron_new {
 
@@ -344,6 +353,8 @@ function init_neutron_new {
     # Run Neutron db migrations
     $NEUTRON_BIN_DIR/neutron-db-manage upgrade heads
     time_stop "dbsync"
+
+    create_neutron_cache_dir
 }
 
 # install_neutron() - Collect source and prepare
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index a0e79bc684..0ccb17c084 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -73,6 +73,7 @@ GITDIR["python-neutronclient"]=$DEST/python-neutronclient
 
 NEUTRON_DIR=$DEST/neutron
 NEUTRON_FWAAS_DIR=$DEST/neutron-fwaas
+NEUTRON_AUTH_CACHE_DIR=${NEUTRON_AUTH_CACHE_DIR:-/var/cache/neutron}
 
 # Support entry points installation of console scripts
 if [[ -d $NEUTRON_DIR/bin/neutron-server ]]; then
@@ -814,7 +815,7 @@ function _configure_neutron_service {
     iniset $NEUTRON_CONF DEFAULT notify_nova_on_port_status_changes $Q_NOTIFY_NOVA_PORT_STATUS_CHANGES
     iniset $NEUTRON_CONF DEFAULT notify_nova_on_port_data_changes $Q_NOTIFY_NOVA_PORT_DATA_CHANGES
 
-    configure_auth_token_middleware $NEUTRON_CONF nova nova
+    configure_auth_token_middleware $NEUTRON_CONF nova $NEUTRON_AUTH_CACHE_DIR nova
 
     # Configure plugin
     neutron_plugin_configure_service
@@ -905,7 +906,8 @@ function _neutron_setup_keystone {
     local conf_file=$1
     local section=$2
 
-    configure_auth_token_middleware $conf_file $Q_ADMIN_USERNAME $section
+    create_neutron_cache_dir
+    configure_auth_token_middleware $conf_file $Q_ADMIN_USERNAME $NEUTRON_AUTH_CACHE_DIR $section
 }
 
 function _neutron_setup_interface_driver {
diff --git a/lib/nova b/lib/nova
index dcf2a1c376..1112f29bd3 100644
--- a/lib/nova
+++ b/lib/nova
@@ -46,6 +46,7 @@ fi
 NOVA_STATE_PATH=${NOVA_STATE_PATH:=$DATA_DIR/nova}
 # INSTANCES_PATH is the previous name for this
 NOVA_INSTANCES_PATH=${NOVA_INSTANCES_PATH:=${INSTANCES_PATH:=$NOVA_STATE_PATH/instances}}
+NOVA_AUTH_CACHE_DIR=${NOVA_AUTH_CACHE_DIR:-/var/cache/nova}
 
 NOVA_CONF_DIR=/etc/nova
 NOVA_CONF=$NOVA_CONF_DIR/nova.conf
@@ -239,7 +240,7 @@ function cleanup_nova {
         sudo rm -rf $NOVA_INSTANCES_PATH/*
     fi
 
-    sudo rm -rf $NOVA_STATE_PATH
+    sudo rm -rf $NOVA_STATE_PATH $NOVA_AUTH_CACHE_DIR
 
     # NOTE(dtroyer): This really should be called from here but due to the way
     #                nova abuses the _cleanup() function we're moving it
@@ -463,7 +464,7 @@ function create_nova_conf {
             iniset $NOVA_CONF DEFAULT osapi_compute_link_prefix $NOVA_SERVICE_PROTOCOL://$NOVA_SERVICE_HOST:$NOVA_SERVICE_PORT
         fi
 
-        configure_auth_token_middleware $NOVA_CONF nova
+        configure_auth_token_middleware $NOVA_CONF nova $NOVA_AUTH_CACHE_DIR
     fi
 
     if is_service_enabled cinder; then
@@ -657,6 +658,13 @@ function init_nova_cells {
     fi
 }
 
+# create_nova_cache_dir() - Part of the init_nova() process
+function create_nova_cache_dir {
+    # Create cache dir
+    sudo install -d -o $STACK_USER $NOVA_AUTH_CACHE_DIR
+    rm -f $NOVA_AUTH_CACHE_DIR/*
+}
+
 function create_nova_conf_nova_network {
     local public_interface=${PUBLIC_INTERFACE:-$PUBLIC_INTERFACE_DEFAULT}
     iniset $NOVA_CONF DEFAULT network_manager "nova.network.manager.$NETWORK_MANAGER"
@@ -714,6 +722,7 @@ function init_nova {
         done
     fi
 
+    create_nova_cache_dir
     create_nova_keys_dir
 
     if [[ "$NOVA_BACKEND" == "LVM" ]]; then
diff --git a/lib/swift b/lib/swift
index ab014de909..1601e2b1f8 100644
--- a/lib/swift
+++ b/lib/swift
@@ -48,6 +48,7 @@ fi
 
 
 SWIFT_DIR=$DEST/swift
+SWIFT_AUTH_CACHE_DIR=${SWIFT_AUTH_CACHE_DIR:-/var/cache/swift}
 SWIFT_APACHE_WSGI_DIR=${SWIFT_APACHE_WSGI_DIR:-/var/www/swift}
 SWIFT3_DIR=$DEST/swift3
 
@@ -449,7 +450,7 @@ function configure_swift {
     iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:authtoken log_name swift
 
     iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:authtoken paste.filter_factory keystonemiddleware.auth_token:filter_factory
-    configure_auth_token_middleware $SWIFT_CONFIG_PROXY_SERVER swift filter:authtoken
+    configure_auth_token_middleware $SWIFT_CONFIG_PROXY_SERVER swift $SWIFT_AUTH_CACHE_DIR filter:authtoken
     iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:authtoken delay_auth_decision 1
     iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:authtoken cache swift.cache
     iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:authtoken include_service_catalog False
@@ -744,6 +745,10 @@ function init_swift {
         swift-ring-builder container.builder rebalance 42
         swift-ring-builder account.builder rebalance 42
     } && popd >/dev/null
+
+    # Create cache dir
+    sudo install -d -o ${STACK_USER} $SWIFT_AUTH_CACHE_DIR
+    rm -f $SWIFT_AUTH_CACHE_DIR/*
 }
 
 function install_swift {

From 56131eb11fa431a13028e90f179e5444c0297f2a Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Sat, 30 Sep 2017 09:55:38 -0700
Subject: [PATCH 1157/2409] Move glance auth cache creation to configure_glance

We install the glance api on all nodes in multinode testing. This has
been failing because we don't configure the glance auth cache dirs if
we only install the glance api service. This was done as part of
init_glance which is only run when installing g-reg.

Fix this by moving the auth cache dir creation step into
configure_glance which is run for the glance api.

Change-Id: Ie669827507df0f524e6e53fe4ab3dff848dd4bd7
---
 lib/glance | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/lib/glance b/lib/glance
index 74734c7516..ad286bacb9 100644
--- a/lib/glance
+++ b/lib/glance
@@ -105,6 +105,11 @@ function cleanup_glance {
 function configure_glance {
     sudo install -d -o $STACK_USER $GLANCE_CONF_DIR $GLANCE_METADEF_DIR
 
+    # We run this here as this configures cache dirs for the auth middleware
+    # which is used in the api server and not in the registry. The api
+    # Server is configured through this function and not init_glance.
+    create_glance_cache_dir
+
     # Copy over our glance configurations and update them
     cp $GLANCE_DIR/etc/glance-registry.conf $GLANCE_REGISTRY_CONF
     iniset $GLANCE_REGISTRY_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
@@ -279,7 +284,7 @@ function create_glance_accounts {
     fi
 }
 
-# create_glance_cache_dir() - Part of the init_glance() process
+# create_glance_cache_dir() - Part of the configure_glance() process
 function create_glance_cache_dir {
     # Create cache dir
     sudo install -d -o $STACK_USER $GLANCE_AUTH_CACHE_DIR/api $GLANCE_AUTH_CACHE_DIR/registry $GLANCE_AUTH_CACHE_DIR/search $GLANCE_AUTH_CACHE_DIR/artifact
@@ -306,8 +311,6 @@ function init_glance {
     # Load metadata definitions
     $GLANCE_BIN_DIR/glance-manage --config-file $GLANCE_CONF_DIR/glance-api.conf db_load_metadefs
     time_stop "dbsync"
-
-    create_glance_cache_dir
 }
 
 # install_glanceclient() - Collect source and prepare

From 9e7ead9ac2e791f70542741aa2c84e7ad828ac7a Mon Sep 17 00:00:00 2001
From: Zane Bitter <zbitter@redhat.com>
Date: Thu, 5 Oct 2017 16:51:09 -0400
Subject: [PATCH 1158/2409] Calculate package directory correctly in
 pip_install

Strip the [<extras>] string from a <package_dir>[<extras>] argument
when looking for the package directory.  Explain what the heck is
going on.

Change-Id: I79beb5c3e9e7c35c91cdd0d5a1d91532bebc4b6d
Closes-Bug: #1721638
---
 inc/python | 26 +++++++++++++++++++++++---
 1 file changed, 23 insertions(+), 3 deletions(-)

diff --git a/inc/python b/inc/python
index 4bc1856fbd..9c810ec9b9 100644
--- a/inc/python
+++ b/inc/python
@@ -219,7 +219,8 @@ function disable_python3_package {
 # Wrapper for ``pip install`` to set cache and proxy environment variables
 # Uses globals ``OFFLINE``, ``PIP_VIRTUAL_ENV``,
 # ``PIP_UPGRADE``, ``TRACK_DEPENDS``, ``*_proxy``,
-# pip_install package [package ...]
+# Usage:
+#  pip_install pip_arguments
 function pip_install {
     local xtrace result
     xtrace=$(set +o | grep xtrace)
@@ -241,6 +242,26 @@ function pip_install {
     if [[ -z "$os_PACKAGE" ]]; then
         GetOSVersion
     fi
+
+    # Try to extract the path of the package we are installing into
+    # package_dir.  We need this to check for test-requirements.txt,
+    # at least.
+    #
+    # ${!#} expands to the last positional argument to this function.
+    # With "extras" syntax included, our arguments might be something
+    # like:
+    #  -e /path/to/fooproject[extra]
+    # Thus this magic line grabs just the path without extras
+    #
+    # Note that this makes no sense if this is a pypi (rather than
+    # local path) install; ergo you must check this path exists before
+    # use.  Also, if we had multiple or mixed installs, we would also
+    # likely break.  But for historical reasons, it's basically only
+    # the other wrapper functions in here calling this to install
+    # local packages, and they do so with single call per install.  So
+    # this works (for now...)
+    local package_dir=${!#%\[*\]}
+
     if [[ $TRACK_DEPENDS = True && ! "$@" =~ virtualenv ]]; then
         # TRACK_DEPENDS=True installation creates a circular dependency when
         # we attempt to install virtualenv into a virtualenv, so we must global
@@ -261,7 +282,6 @@ function pip_install {
                 # versions supported, and if we find the version of
                 # python3 we've been told to use, use that instead of the
                 # default pip
-                local package_dir=${!#}
                 local python_versions
 
                 # Special case some services that have experimental
@@ -323,7 +343,7 @@ function pip_install {
 
     # Also install test requirements
     local install_test_reqs=""
-    local test_req="${!#}/test-requirements.txt"
+    local test_req="${package_dir}/test-requirements.txt"
     if [[ -e "$test_req" ]]; then
         install_test_reqs="-r $test_req"
     fi

From b8335eebe88f5ebe0c1d42344ced60e55ead3c5e Mon Sep 17 00:00:00 2001
From: Markus Zoeller <mzoeller@de.ibm.com>
Date: Tue, 26 Sep 2017 08:32:50 +0200
Subject: [PATCH 1159/2409] Drop support for "kvmibm" distro

The IBM hypervisor distro "KVM for IBM z Systems" gets discontiued,
like announced in March 2017 [1]. The key dates are:

* 03/2017: announcement
* 08/2017: the last day to order (EOM)
* 03/2018: the End of Service (EOL)

As the CI which tests OpenStack with KVM on IBM Z doesn't rely on this
distro anymore and EOM has reached, we remove the Devstack support for
this distro.

This basically reverts commit a5ea08b of Dec 2015.

NOTE: This doesn't affect other distros which have KVM on Z support.

References:
[1] FAQ for KVM for IBM z Systems Delivery Strategy Change
    https://www-01.ibm.com/common/ssi/cgi-bin/ssialias?htmlfid=ZSQ03110USEN&

Change-Id: I009ae4779588615633bff81d0c47a1b879ec9279
---
 functions-common                   | 4 +---
 lib/nova_plugins/functions-libvirt | 5 -----
 stack.sh                           | 2 +-
 3 files changed, 2 insertions(+), 9 deletions(-)

diff --git a/functions-common b/functions-common
index c968531fd1..c6ba99e1a1 100644
--- a/functions-common
+++ b/functions-common
@@ -385,8 +385,6 @@ function GetDistro {
         DISTRO="rhel${os_RELEASE::1}"
     elif [[ "$os_VENDOR" =~ (XenServer) ]]; then
         DISTRO="xs${os_RELEASE%.*}"
-    elif [[ "$os_VENDOR" =~ (kvmibm) ]]; then
-        DISTRO="${os_VENDOR}${os_RELEASE::1}"
     else
         # We can't make a good choice here.  Setting a sensible DISTRO
         # is part of the problem, but not the major issue -- we really
@@ -440,7 +438,7 @@ function is_fedora {
     [ "$os_VENDOR" = "Fedora" ] || [ "$os_VENDOR" = "Red Hat" ] || \
         [ "$os_VENDOR" = "RedHatEnterpriseServer" ] || \
         [ "$os_VENDOR" = "CentOS" ] || [ "$os_VENDOR" = "OracleServer" ] || \
-        [ "$os_VENDOR" = "Virtuozzo" ] || [ "$os_VENDOR" = "kvmibm" ]
+        [ "$os_VENDOR" = "Virtuozzo" ]
 }
 
 
diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index 8d74c77517..c8527387ab 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -72,11 +72,6 @@ function install_libvirt {
         pip_install_gr libvirt-python
         #pip_install_gr <there-si-no-guestfs-in-pypi>
     elif is_fedora || is_suse; then
-        # On "KVM for IBM z Systems", kvm does not have its own package
-        if [[ ! ${DISTRO} =~ "kvmibm1" ]]; then
-            install_package qemu-kvm
-        fi
-
         install_package libvirt libvirt-devel
         pip_uninstall libvirt-python
         pip_install_gr libvirt-python
diff --git a/stack.sh b/stack.sh
index c545c56de3..8632cf1378 100755
--- a/stack.sh
+++ b/stack.sh
@@ -221,7 +221,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (xenial|yakkety|zesty|stretch|jessie|f24|f25|f26|opensuse-42.2|opensuse-42.3|rhel7|kvmibm1) ]]; then
+if [[ ! ${DISTRO} =~ (xenial|yakkety|zesty|stretch|jessie|f24|f25|f26|opensuse-42.2|opensuse-42.3|rhel7) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From 2b97a81640df1f8d537d6cf7b291f15d8f084a18 Mon Sep 17 00:00:00 2001
From: Radoslav Gerganov <rgerganov@vmware.com>
Date: Tue, 10 Oct 2017 16:51:12 +0300
Subject: [PATCH 1160/2409] Remove references to $USE_SCREEN in comments

The USE_SCREEN variable is not used any more

Change-Id: I29ad9cdb6c8498404502d91fbc4e1299bf4a633e
---
 functions-common | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/functions-common b/functions-common
index c968531fd1..263ce264f0 100644
--- a/functions-common
+++ b/functions-common
@@ -1492,7 +1492,6 @@ function is_running {
 # If the command includes shell metachatacters (;<>*) it must be run using a shell
 # If an optional group is provided sg will be used to run the
 # command as that group.
-# Uses globals ``USE_SCREEN``
 # run_process service "command-line" [group] [user]
 function run_process {
     local service=$1
@@ -1513,7 +1512,7 @@ function run_process {
 # If a PID is available use it, kill the whole process group via TERM
 # If screen is being used kill the screen window; this will catch processes
 # that did not leave a PID behind
-# Uses globals ``SERVICE_DIR``, ``USE_SCREEN``
+# Uses globals ``SERVICE_DIR``
 # stop_process service
 function stop_process {
     local service=$1

From cda2cb557f7176c431d151b32bc44eee03f73774 Mon Sep 17 00:00:00 2001
From: Eric Fried <efried@us.ibm.com>
Date: Tue, 10 Oct 2017 11:49:06 -0500
Subject: [PATCH 1161/2409] Create block-storage endpoint for cinder

block-storage is the official service type for cinder, according to the
service-types-authority.  Add it as a service in devstack, with cinder's
unversioned endpoint, to enable proper discovery.

Change-Id: I75cf7212678f7f270c3c32f0bce227dbbf6b466d
---
 lib/cinder | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/lib/cinder b/lib/cinder
index 07f82a1580..c35b89d63b 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -344,8 +344,15 @@ function create_cinder_accounts {
 
         create_service_user "cinder"
 
+        # block-storage is the official service type
+        get_or_create_service "cinder" "block-storage" "Cinder Volume Service"
         get_or_create_service "cinder" "volume" "Cinder Volume Service"
         if [ "$CINDER_USE_MOD_WSGI" == "False" ]; then
+            get_or_create_endpoint \
+                "block-storage" \
+                "$REGION_NAME" \
+                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/"
+
             get_or_create_endpoint \
                 "volume" \
                 "$REGION_NAME" \
@@ -363,6 +370,11 @@ function create_cinder_accounts {
                 "$REGION_NAME" \
                 "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v3/\$(project_id)s"
         else
+            get_or_create_endpoint \
+                "block-storage" \
+                "$REGION_NAME" \
+                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST/"
+
             get_or_create_endpoint \
                 "volume" \
                 "$REGION_NAME" \

From 2da019f133bb3e53ef67e33cfd269a9b6a72d27a Mon Sep 17 00:00:00 2001
From: Ken'ichi Ohmichi <ken-oomichi@wx.jp.nec.com>
Date: Wed, 11 Oct 2017 09:57:25 -0700
Subject: [PATCH 1162/2409] Replace the deprecated nova_metadata_ip

As [1], the option nova_metadata_ip has been deprecated and
we can use nova_metadata_host instead. This patch makes devstack
do it.

[1]: http://git.openstack.org/cgit/openstack/neutron/tree/neutron/conf/agent/metadata/config.py#n49

Change-Id: Ifda43ec8c7743af6acdd3003c55c081ef5b1311c
---
 lib/neutron | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron b/lib/neutron
index 21c8d4c735..c5839f5c3e 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -243,7 +243,7 @@ function configure_neutron_new {
         cp $NEUTRON_DIR/etc/metadata_agent.ini.sample $NEUTRON_META_CONF
 
         iniset $NEUTRON_META_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-        iniset $NEUTRON_META_CONF DEFAULT nova_metadata_ip $SERVICE_HOST
+        iniset $NEUTRON_META_CONF DEFAULT nova_metadata_host $SERVICE_HOST
         iniset $NEUTRON_META_CONF DEFAULT metadata_workers $API_WORKERS
         # TODO(ihrachys) do we really need to set rootwrap for metadata agent?
         configure_root_helper_options $NEUTRON_META_CONF

From 843b039b3ca24c79865d991df43bfcd5ebe0b97b Mon Sep 17 00:00:00 2001
From: jianghua wang <jianghua.wang@citrix.com>
Date: Thu, 21 Sep 2017 14:16:06 +0000
Subject: [PATCH 1163/2409] Use the renamed vnc options

As the following commit has renamed the two vnc options; let's
use the new options in devstack:
https://review.openstack.org/#/c/498387/

Change-Id: Id125666814ea9bb8a22b579aee0f6bc1c65ade80
---
 lib/nova                            | 4 ++--
 lib/nova_plugins/hypervisor-libvirt | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/lib/nova b/lib/nova
index 1112f29bd3..ea0d2f7b89 100644
--- a/lib/nova
+++ b/lib/nova
@@ -520,8 +520,8 @@ function create_nova_conf {
         # For multi-host, this should be the management ip of the compute host.
         VNCSERVER_LISTEN=${VNCSERVER_LISTEN=$NOVA_SERVICE_LOCAL_HOST}
         VNCSERVER_PROXYCLIENT_ADDRESS=${VNCSERVER_PROXYCLIENT_ADDRESS=$NOVA_SERVICE_LOCAL_HOST}
-        iniset $NOVA_CONF vnc vncserver_listen "$VNCSERVER_LISTEN"
-        iniset $NOVA_CONF vnc vncserver_proxyclient_address "$VNCSERVER_PROXYCLIENT_ADDRESS"
+        iniset $NOVA_CONF vnc server_listen "$VNCSERVER_LISTEN"
+        iniset $NOVA_CONF vnc server_proxyclient_address "$VNCSERVER_PROXYCLIENT_ADDRESS"
         iniset $NOVA_CONF vnc novncproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
         iniset $NOVA_CONF vnc xvpvncproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
     else
diff --git a/lib/nova_plugins/hypervisor-libvirt b/lib/nova_plugins/hypervisor-libvirt
index 0c08a0fe42..3d676b9b8d 100644
--- a/lib/nova_plugins/hypervisor-libvirt
+++ b/lib/nova_plugins/hypervisor-libvirt
@@ -71,8 +71,8 @@ function configure_nova_hypervisor {
         iniset $NOVA_CONF libvirt connection_uri "parallels+unix:///system"
         iniset $NOVA_CONF libvirt images_type "ploop"
         iniset $NOVA_CONF DEFAULT force_raw_images  "False"
-        iniset $NOVA_CONF vnc vncserver_proxyclient_address  $HOST_IP
-        iniset $NOVA_CONF vnc vncserver_listen $HOST_IP
+        iniset $NOVA_CONF vnc server_proxyclient_address  $HOST_IP
+        iniset $NOVA_CONF vnc server_listen $HOST_IP
         iniset $NOVA_CONF vnc keymap
     elif [[ "$NOVA_BACKEND" == "LVM" ]]; then
         iniset $NOVA_CONF libvirt images_type "lvm"

From 135ebe955e19992e54350e2ed70c5f0517c93b26 Mon Sep 17 00:00:00 2001
From: Sumit Jamgade <sjamgade@suse.com>
Date: Fri, 13 Oct 2017 15:08:27 +0200
Subject: [PATCH 1164/2409] Revert "Resolve openSUSE devstack failures"

This reverts commit d325875508e7d35d6dd62302d852e83815be2278.
the issue mentioned in the comment is now resolved.

Change-Id: I2705daead3d3b95f6ad82261212f2a1f40a77fb5
---
 tools/install_prereqs.sh | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/tools/install_prereqs.sh b/tools/install_prereqs.sh
index 6189085e9e..da59093581 100755
--- a/tools/install_prereqs.sh
+++ b/tools/install_prereqs.sh
@@ -88,15 +88,6 @@ else
     export PYTHON=$(which python 2>/dev/null)
 fi
 
-if is_suse; then
-    # now reinstall cryptography from source, in order to rebuilt it against the
-    # system libssl rather than the bundled openSSL 1.1, which segfaults when combined
-    # with a system provided openSSL 1.0
-    # see https://github.com/pyca/cryptography/issues/3804 and followup issues
-    sudo pip install cryptography --no-binary :all:
-fi
-
-
 # Mark end of run
 # ---------------
 

From c0d9373e860726570b27f5c560f0fe84448598cc Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Sun, 15 Oct 2017 08:26:37 +0000
Subject: [PATCH 1165/2409] Updated from generate-devstack-plugins-list

Change-Id: I474294bdbb1052f8f99522415dd0c1d26d8a995b
---
 doc/source/plugin-registry.rst | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 6aa2e93739..5fd6697d35 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -114,6 +114,7 @@ networking-huawei                      `git://git.openstack.org/openstack/networ
 networking-hyperv                      `git://git.openstack.org/openstack/networking-hyperv <https://git.openstack.org/cgit/openstack/networking-hyperv>`__
 networking-infoblox                    `git://git.openstack.org/openstack/networking-infoblox <https://git.openstack.org/cgit/openstack/networking-infoblox>`__
 networking-l2gw                        `git://git.openstack.org/openstack/networking-l2gw <https://git.openstack.org/cgit/openstack/networking-l2gw>`__
+networking-lagopus                     `git://git.openstack.org/openstack/networking-lagopus <https://git.openstack.org/cgit/openstack/networking-lagopus>`__
 networking-midonet                     `git://git.openstack.org/openstack/networking-midonet <https://git.openstack.org/cgit/openstack/networking-midonet>`__
 networking-mlnx                        `git://git.openstack.org/openstack/networking-mlnx <https://git.openstack.org/cgit/openstack/networking-mlnx>`__
 networking-nec                         `git://git.openstack.org/openstack/networking-nec <https://git.openstack.org/cgit/openstack/networking-nec>`__
@@ -159,6 +160,7 @@ searchlight-ui                         `git://git.openstack.org/openstack/search
 senlin                                 `git://git.openstack.org/openstack/senlin <https://git.openstack.org/cgit/openstack/senlin>`__
 solum                                  `git://git.openstack.org/openstack/solum <https://git.openstack.org/cgit/openstack/solum>`__
 stackube                               `git://git.openstack.org/openstack/stackube <https://git.openstack.org/cgit/openstack/stackube>`__
+storlets                               `git://git.openstack.org/openstack/storlets <https://git.openstack.org/cgit/openstack/storlets>`__
 tacker                                 `git://git.openstack.org/openstack/tacker <https://git.openstack.org/cgit/openstack/tacker>`__
 tap-as-a-service                       `git://git.openstack.org/openstack/tap-as-a-service <https://git.openstack.org/cgit/openstack/tap-as-a-service>`__
 tap-as-a-service-dashboard             `git://git.openstack.org/openstack/tap-as-a-service-dashboard <https://git.openstack.org/cgit/openstack/tap-as-a-service-dashboard>`__

From 36ddea31a257b38aa22d3232f4c4389c851f5456 Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Mon, 2 Oct 2017 10:05:17 -0500
Subject: [PATCH 1166/2409] Add devstack base job for zuul v3

This should be managed in the devstack repo, since it's a base job to
run devstack.

Change-Id: Iffe54fbccbccd68db08f79a1b51dd7f76dbff408
Depends-On: Ie2119f24360d56690ffd772b95a9ea6b98dd4a39
---
 .zuul.yaml                                    |  85 ++++++++
 playbooks/devstack.yaml                       |   3 +
 playbooks/post.yaml                           |   4 +
 playbooks/pre.yaml                            |  22 +++
 roles/configure-swap/README.rst               |  11 ++
 roles/configure-swap/defaults/main.yaml       |   1 +
 roles/configure-swap/tasks/ephemeral.yaml     | 110 +++++++++++
 roles/configure-swap/tasks/main.yaml          |  63 ++++++
 roles/configure-swap/tasks/root.yaml          |  63 ++++++
 roles/export-devstack-journal/README.rst      |  15 ++
 .../defaults/main.yaml                        |   1 +
 roles/export-devstack-journal/tasks/main.yaml |  29 +++
 roles/fetch-devstack-log-dir/README.rst       |  10 +
 .../fetch-devstack-log-dir/defaults/main.yaml |   1 +
 roles/fetch-devstack-log-dir/tasks/main.yaml  |   5 +
 roles/run-devstack/README.rst                 |   8 +
 roles/run-devstack/defaults/main.yaml         |   1 +
 roles/run-devstack/tasks/main.yaml            |   6 +
 roles/setup-devstack-cache/README.rst         |  15 ++
 roles/setup-devstack-cache/defaults/main.yaml |   2 +
 roles/setup-devstack-cache/tasks/main.yaml    |  14 ++
 roles/setup-devstack-log-dir/README.rst       |  11 ++
 .../setup-devstack-log-dir/defaults/main.yaml |   1 +
 roles/setup-devstack-log-dir/tasks/main.yaml  |   5 +
 roles/setup-devstack-source-dirs/README.rst   |  11 ++
 .../defaults/main.yaml                        |   1 +
 .../tasks/main.yaml                           |  22 +++
 roles/setup-stack-user/README.rst             |  16 ++
 roles/setup-stack-user/defaults/main.yaml     |   2 +
 roles/setup-stack-user/files/50_stack_sh      |   1 +
 roles/setup-stack-user/tasks/main.yaml        |  45 +++++
 roles/setup-tempest-user/README.rst           |  10 +
 roles/setup-tempest-user/files/51_tempest_sh  |   3 +
 roles/setup-tempest-user/tasks/main.yaml      |  20 ++
 roles/start-fresh-logging/README.rst          |  11 ++
 roles/start-fresh-logging/defaults/main.yaml  |   1 +
 roles/start-fresh-logging/tasks/main.yaml     |  56 ++++++
 roles/write-devstack-local-conf/README.rst    |  63 ++++++
 .../defaults/main.yaml                        |   2 +
 .../library/devstack_local_conf.py            | 185 ++++++++++++++++++
 .../write-devstack-local-conf/tasks/main.yaml |   9 +
 41 files changed, 944 insertions(+)
 create mode 100644 .zuul.yaml
 create mode 100644 playbooks/devstack.yaml
 create mode 100644 playbooks/post.yaml
 create mode 100644 playbooks/pre.yaml
 create mode 100644 roles/configure-swap/README.rst
 create mode 100644 roles/configure-swap/defaults/main.yaml
 create mode 100644 roles/configure-swap/tasks/ephemeral.yaml
 create mode 100644 roles/configure-swap/tasks/main.yaml
 create mode 100644 roles/configure-swap/tasks/root.yaml
 create mode 100644 roles/export-devstack-journal/README.rst
 create mode 100644 roles/export-devstack-journal/defaults/main.yaml
 create mode 100644 roles/export-devstack-journal/tasks/main.yaml
 create mode 100644 roles/fetch-devstack-log-dir/README.rst
 create mode 100644 roles/fetch-devstack-log-dir/defaults/main.yaml
 create mode 100644 roles/fetch-devstack-log-dir/tasks/main.yaml
 create mode 100644 roles/run-devstack/README.rst
 create mode 100644 roles/run-devstack/defaults/main.yaml
 create mode 100644 roles/run-devstack/tasks/main.yaml
 create mode 100644 roles/setup-devstack-cache/README.rst
 create mode 100644 roles/setup-devstack-cache/defaults/main.yaml
 create mode 100644 roles/setup-devstack-cache/tasks/main.yaml
 create mode 100644 roles/setup-devstack-log-dir/README.rst
 create mode 100644 roles/setup-devstack-log-dir/defaults/main.yaml
 create mode 100644 roles/setup-devstack-log-dir/tasks/main.yaml
 create mode 100644 roles/setup-devstack-source-dirs/README.rst
 create mode 100644 roles/setup-devstack-source-dirs/defaults/main.yaml
 create mode 100644 roles/setup-devstack-source-dirs/tasks/main.yaml
 create mode 100644 roles/setup-stack-user/README.rst
 create mode 100644 roles/setup-stack-user/defaults/main.yaml
 create mode 100644 roles/setup-stack-user/files/50_stack_sh
 create mode 100644 roles/setup-stack-user/tasks/main.yaml
 create mode 100644 roles/setup-tempest-user/README.rst
 create mode 100644 roles/setup-tempest-user/files/51_tempest_sh
 create mode 100644 roles/setup-tempest-user/tasks/main.yaml
 create mode 100644 roles/start-fresh-logging/README.rst
 create mode 100644 roles/start-fresh-logging/defaults/main.yaml
 create mode 100644 roles/start-fresh-logging/tasks/main.yaml
 create mode 100644 roles/write-devstack-local-conf/README.rst
 create mode 100644 roles/write-devstack-local-conf/defaults/main.yaml
 create mode 100644 roles/write-devstack-local-conf/library/devstack_local_conf.py
 create mode 100644 roles/write-devstack-local-conf/tasks/main.yaml

diff --git a/.zuul.yaml b/.zuul.yaml
new file mode 100644
index 0000000000..cee195cf39
--- /dev/null
+++ b/.zuul.yaml
@@ -0,0 +1,85 @@
+- nodeset:
+    name: openstack-single-node
+    nodes:
+      - name: controller
+        label: ubuntu-xenial
+    groups:
+      - name: tempest
+        nodes:
+          - controller
+
+- nodeset:
+    name: openstack-two-node
+    nodes:
+      - name: controller
+        label: ubuntu-xenial
+      - name: compute1
+        label: ubuntu-xenial
+    groups:
+      - name: tempest
+        nodes:
+          - controller
+      - name: compute
+        nodes:
+          - controller
+          - compute1
+
+- job:
+    name: devstack
+    parent: multinode
+    description: Base devstack job
+    nodeset: openstack-single-node
+    required-projects:
+      - openstack-dev/devstack
+      - openstack/cinder
+      - openstack/glance
+      - openstack/keystone
+      - openstack/neutron
+      - openstack/nova
+      - openstack/requirements
+      - openstack/swift
+    timeout: 7200
+    vars:
+      devstack_localrc:
+        DATABASE_PASSWORD: secretdatabase
+        RABBIT_PASSWORD: secretrabbit
+        ADMIN_PASSWORD: secretadmin
+        SERVICE_PASSWORD: secretservice
+        NETWORK_GATEWAY: 10.1.0.1
+        Q_USE_DEBUG_COMMAND: True
+        FIXED_RANGE: 10.1.0.0/20
+        IPV4_ADDRS_SAFE_TO_USE: 10.1.0.0/20
+        FLOATING_RANGE: 172.24.5.0/24
+        PUBLIC_NETWORK_GATEWAY: 172.24.5.1
+        FLOATING_HOST_PREFIX: 172.24.4
+        FLOATING_HOST_MASK: 23
+        SWIFT_REPLICAS: 1
+        SWIFT_START_ALL_SERVICES: False
+        LOGFILE: /opt/stack/logs/devstacklog.txt
+        LOG_COLOR: False
+        VERBOSE: True
+        NETWORK_GATEWAY: 10.1.0.1
+        NOVNC_FROM_PACKAGE: True
+        ERROR_ON_CLONE: True
+        # NOTE(dims): etcd 3.x is not available in debian/ubuntu
+        # etc. As a stop gap measure, devstack uses wget to download
+        # from the location below for all the CI jobs.
+        ETCD_DOWNLOAD_URL: "http://tarballs.openstack.org/etcd/"
+      devstack_services:
+        horizon: False
+        tempest: False
+    pre-run: playbooks/pre
+    post-run: playbooks/post
+
+
+- project:
+    name: openstack-dev/devstack
+    check:
+      jobs:
+        - devstack:
+            files:
+              - ^playbooks/pre
+              - ^playbooks/post
+              - ^playbooks/devstack
+              - ^roles/
+              - .zuul.yaml
diff --git a/playbooks/devstack.yaml b/playbooks/devstack.yaml
new file mode 100644
index 0000000000..ede8382632
--- /dev/null
+++ b/playbooks/devstack.yaml
@@ -0,0 +1,3 @@
+- hosts: all
+  roles:
+    - run-devstack
diff --git a/playbooks/post.yaml b/playbooks/post.yaml
new file mode 100644
index 0000000000..6f5126ff16
--- /dev/null
+++ b/playbooks/post.yaml
@@ -0,0 +1,4 @@
+- hosts: all
+  roles:
+    - export-devstack-journal
+    - fetch-devstack-log-dir
diff --git a/playbooks/pre.yaml b/playbooks/pre.yaml
new file mode 100644
index 0000000000..4d07960fe8
--- /dev/null
+++ b/playbooks/pre.yaml
@@ -0,0 +1,22 @@
+- hosts: all
+  roles:
+    - configure-swap
+    - setup-stack-user
+    - setup-tempest-user
+    - setup-devstack-source-dirs
+    - setup-devstack-log-dir
+    - setup-devstack-cache
+    - start-fresh-logging
+    - write-devstack-local-conf
+  # TODO(jeblair): remove when configure-mirrors is fixed  
+  tasks:
+    - name: Hack mirror_info
+      shell:
+        _raw_params: |
+          mkdir /etc/ci
+          cat << "EOF" > /etc/ci/mirror_info.sh
+          export NODEPOOL_UCA_MIRROR=http://mirror.dfw.rax.openstack.org/ubuntu-cloud-archive
+          EOF
+      args:
+        executable: /bin/bash
+      become: true
diff --git a/roles/configure-swap/README.rst b/roles/configure-swap/README.rst
new file mode 100644
index 0000000000..eaba5cf595
--- /dev/null
+++ b/roles/configure-swap/README.rst
@@ -0,0 +1,11 @@
+Configure a swap partition
+
+Creates a swap partition on the ephemeral block device (the rest of which
+will be mounted on /opt).
+
+**Role Variables**
+
+.. zuul:rolevar:: configure_swap_size
+   :default: 8192
+
+   The size of the swap partition, in MiB.
diff --git a/roles/configure-swap/defaults/main.yaml b/roles/configure-swap/defaults/main.yaml
new file mode 100644
index 0000000000..4d622321c7
--- /dev/null
+++ b/roles/configure-swap/defaults/main.yaml
@@ -0,0 +1 @@
+configure_swap_size: 8192
diff --git a/roles/configure-swap/tasks/ephemeral.yaml b/roles/configure-swap/tasks/ephemeral.yaml
new file mode 100644
index 0000000000..c2316eac2b
--- /dev/null
+++ b/roles/configure-swap/tasks/ephemeral.yaml
@@ -0,0 +1,110 @@
+# Configure attached ephemeral devices for storage and swap
+
+- assert:
+    that:
+      - "ephemeral_device is defined"
+
+- name: Set partition names
+  set_fact:
+    swap_partition: "{{ ephemeral_device}}1"
+    opt_partition: "{{ ephemeral_device}}2"
+
+- name: Ensure ephemeral device is unmounted
+  become: yes
+  mount:
+    name: "{{ ephemeral_device }}"
+    state: unmounted
+
+- name: Get existing partitions
+  become: yes
+  parted:
+    device: "{{ ephemeral_device }}"
+    unit: MiB
+  register: ephemeral_partitions
+
+- name: Remove any existing partitions
+  become: yes
+  parted:
+    device: "{{ ephemeral_device }}"
+    number: "{{ item.num }}"
+    state: absent
+  with_items:
+    - "{{ ephemeral_partitions.partitions }}"
+
+- name: Create new disk label
+  become: yes
+  parted:
+    label: msdos
+    device: "{{ ephemeral_device }}"
+
+- name: Create swap partition
+  become: yes
+  parted:
+    device: "{{ ephemeral_device }}"
+    number: 1
+    state: present
+    part_start: '0%'
+    part_end: "{{ configure_swap_size }}MiB"
+
+- name: Create opt partition
+  become: yes
+  parted:
+    device: "{{ ephemeral_device }}"
+    number: 2
+    state: present
+    part_start: "{{ configure_swap_size }}MiB"
+    part_end: "100%"
+
+- name: Make swap on partition
+  become: yes
+  command: "mkswap {{ swap_partition }}"
+
+- name: Write swap to fstab
+  become: yes
+  mount:
+    path: none
+    src: "{{ swap_partition }}"
+    fstype: swap
+    opts: sw
+    passno: 0
+    dump: 0
+    state: present
+
+# XXX: does "parted" plugin ensure the partition is available
+# before moving on?  No udev settles here ...
+
+- name: Add all swap
+  become: yes
+  command: swapon -a
+
+- name: Create /opt filesystem
+  become: yes
+  filesystem:
+    fstype: ext4
+    dev: "{{ opt_partition }}"
+
+# Rackspace at least does not have enough room for two devstack
+# installs on the primary partition.  We copy in the existing /opt to
+# the new partition on the ephemeral device, and then overmount /opt
+# to there for the test runs.
+#
+# NOTE(ianw): the existing "mount" touches fstab.  There is currently (Sep2017)
+# work in [1] to split mount & fstab into separate parts, but for now we bundle
+# it into an atomic shell command
+# [1] https://github.com/ansible/ansible/pull/27174
+- name: Copy old /opt
+  become: yes
+  shell: |
+    mount {{ opt_partition }} /mnt
+    find /opt/ -mindepth 1 -maxdepth 1 -exec mv {} /mnt/ \;
+    umount /mnt
+
+# This overmounts any existing /opt
+- name: Add opt to fstab and mount
+  become: yes
+  mount:
+    path: /opt
+    src: "{{ opt_partition }}"
+    fstype: ext4
+    opts: noatime
+    state: mounted
diff --git a/roles/configure-swap/tasks/main.yaml b/roles/configure-swap/tasks/main.yaml
new file mode 100644
index 0000000000..8960c726c8
--- /dev/null
+++ b/roles/configure-swap/tasks/main.yaml
@@ -0,0 +1,63 @@
+# On RAX hosts, we have a small root partition and a large,
+# unallocated ephemeral device attached at /dev/xvde
+- name: Set ephemeral device if /dev/xvde exists
+  when: ansible_devices["xvde"] is defined
+  set_fact:
+    ephemeral_device: "/dev/xvde"
+
+# On other providers, we have a device called "ephemeral0".
+#
+# NOTE(ianw): Once [1] is in our ansible (2.4 era?), we can figure
+# this out more directly by walking the device labels in the facts
+#
+# [1] https://github.com/ansible/ansible/commit/d46dd99f47c0ee5081d15bc5b741e9096d8bfd3e
+- name: Set ephemeral device by label
+  when: ephemeral_device is undefined
+  block:
+    - name: Get ephemeral0 device node
+      command: /sbin/blkid -L ephemeral0
+      register: ephemeral0
+      # If this doesn't exist, returns !0
+      ignore_errors: yes
+      changed_when: False
+
+    - name: Set ephemeral device if LABEL exists
+      when: "ephemeral0.rc == 0"
+      set_fact:
+        ephemeral_device: "{{ ephemeral0.stdout }}"
+
+# If we have ephemeral storage and we don't appear to have setup swap,
+# we will create a swap and move /opt to a large data partition there.
+- include: ephemeral.yaml
+  static: no
+  when:
+    - ephemeral_device is defined
+    - ansible_memory_mb['swap']['total'] | int + 10 <= configure_swap_size
+
+# If no ephemeral device and no swap, then we will setup some swap
+# space on the root device to ensure all hosts a consistent memory
+# environment.
+- include: root.yaml
+  static: no
+  when:
+    - ephemeral_device is undefined
+    - ansible_memory_mb['swap']['total'] | int + 10 <= configure_swap_size
+
+# ensure a standard level of swappiness.  Some platforms
+# (rax+centos7) come with swappiness of 0 (presumably because the
+# vm doesn't come with swap setup ... but we just did that above),
+# which depending on the kernel version can lead to the OOM killer
+# kicking in on some processes despite swap being available;
+# particularly things like mysql which have very high ratio of
+# anonymous-memory to file-backed mappings.
+#
+# This sets swappiness low; we really don't want to be relying on
+# cloud I/O based swap during our runs if we can help it
+- name: Set swappiness
+  become: yes
+  sysctl:
+    name: vm.swappiness
+    value: 30
+    state: present
+
+- debug:  var=ephemeral_device
diff --git a/roles/configure-swap/tasks/root.yaml b/roles/configure-swap/tasks/root.yaml
new file mode 100644
index 0000000000..f22b53700f
--- /dev/null
+++ b/roles/configure-swap/tasks/root.yaml
@@ -0,0 +1,63 @@
+# If no ephemeral devices are available, use root filesystem
+
+- name: Calculate required swap
+  set_fact:
+    swap_required: "{{ configure_swap_size - ansible_memory_mb['swap']['total'] | int }}"
+
+- block:
+    - name: Get root filesystem
+      shell: df --output='fstype' /root | tail -1
+      register: root_fs
+
+    - name: Save root filesystem
+      set_fact:
+        root_filesystem: "{{ root_fs.stdout }}"
+
+    - debug: var=root_filesystem
+
+# Note, we don't use a sparse device to avoid wedging when disk space
+# and memory are both unavailable.
+
+# Cannot fallocate on filesystems like XFS, so use slower dd
+- name: Create swap backing file for non-EXT fs
+  when: '"ext" not in root_filesystem'
+  become: yes
+  command: dd if=/dev/zero of=/root/swapfile bs=1M count={{ swap_required }}
+  args:
+    creates: /root/swapfile
+
+- name: Create sparse swap backing file for EXT fs
+  when: '"ext" in root_filesystem'
+  become: yes
+  command: fallocate -l {{ swap_required }}M /root/swapfile
+  args:
+    creates: /root/swapfile
+
+- name: Ensure swapfile perms
+  become: yes
+  file:
+    path: /root/swapfile
+    owner: root
+    group: root
+    mode: 0600
+
+- name: Make swapfile
+  become: yes
+  command: mkswap /root/swapfile
+
+- name: Write swap to fstab
+  become: yes
+  mount:
+    path: none
+    src: /root/swapfile
+    fstype: swap
+    opts: sw
+    passno: 0
+    dump: 0
+    state: present
+
+- name: Add all swap
+  become: yes
+  command: swapon -a
+
+- debug: var=swap_required
diff --git a/roles/export-devstack-journal/README.rst b/roles/export-devstack-journal/README.rst
new file mode 100644
index 0000000000..5f00592a03
--- /dev/null
+++ b/roles/export-devstack-journal/README.rst
@@ -0,0 +1,15 @@
+Export journal files from devstack services
+
+Export the systemd journal for every devstack service in native
+journal format as well as text.  Also, export a syslog-style file with
+kernal and sudo messages.
+
+Writes the output to the ``logs/`` subdirectory of
+``devstack_base_dir``.
+
+**Role Variables**
+
+.. zuul:rolevar:: devstack_base_dir
+   :default: /opt/stack
+
+   The devstack base directory.
diff --git a/roles/export-devstack-journal/defaults/main.yaml b/roles/export-devstack-journal/defaults/main.yaml
new file mode 100644
index 0000000000..fea05c8146
--- /dev/null
+++ b/roles/export-devstack-journal/defaults/main.yaml
@@ -0,0 +1 @@
+devstack_base_dir: /opt/stack
diff --git a/roles/export-devstack-journal/tasks/main.yaml b/roles/export-devstack-journal/tasks/main.yaml
new file mode 100644
index 0000000000..b9af02a591
--- /dev/null
+++ b/roles/export-devstack-journal/tasks/main.yaml
@@ -0,0 +1,29 @@
+# TODO: convert this to ansible
+- name: Export journal files
+  become: true
+  shell:
+    cmd: |
+      u=""
+      name=""
+      for u in `systemctl list-unit-files | grep devstack | awk '{print $1}'`; do
+        name=$(echo $u | sed 's/devstack@/screen-/' | sed 's/\.service//')
+        journalctl -o short-precise --unit $u | tee {{ devstack_base_dir }}/logs/$name.txt > /dev/null
+      done
+
+      # Export the journal in export format to make it downloadable
+      # for later searching. It can then be rewritten to a journal native
+      # format locally using systemd-journal-remote. This makes a class of
+      # debugging much easier. We don't do the native conversion here as
+      # some distros do not package that tooling.
+      journalctl -u 'devstack@*' -o export | \
+          xz --threads=0 - > {{ devstack_base_dir }}/logs/devstack.journal.xz
+
+      # The journal contains everything running under systemd, we'll
+      # build an old school version of the syslog with just the
+      # kernel and sudo messages.
+      journalctl \
+          -t kernel \
+          -t sudo \
+          --no-pager \
+          --since="$(cat {{ devstack_base_dir }}/log-start-timestamp.txt)" \
+        | tee {{ devstack_base_dir }}/logs/syslog.txt > /dev/null
diff --git a/roles/fetch-devstack-log-dir/README.rst b/roles/fetch-devstack-log-dir/README.rst
new file mode 100644
index 0000000000..360a2e3dd0
--- /dev/null
+++ b/roles/fetch-devstack-log-dir/README.rst
@@ -0,0 +1,10 @@
+Fetch content from the devstack log directory
+
+Copy logs from every host back to the zuul executor.
+
+**Role Variables**
+
+.. zuul:rolevar:: devstack_base_dir
+   :default: /opt/stack
+
+   The devstack base directory.
diff --git a/roles/fetch-devstack-log-dir/defaults/main.yaml b/roles/fetch-devstack-log-dir/defaults/main.yaml
new file mode 100644
index 0000000000..fea05c8146
--- /dev/null
+++ b/roles/fetch-devstack-log-dir/defaults/main.yaml
@@ -0,0 +1 @@
+devstack_base_dir: /opt/stack
diff --git a/roles/fetch-devstack-log-dir/tasks/main.yaml b/roles/fetch-devstack-log-dir/tasks/main.yaml
new file mode 100644
index 0000000000..5a198b21b4
--- /dev/null
+++ b/roles/fetch-devstack-log-dir/tasks/main.yaml
@@ -0,0 +1,5 @@
+- name: Collect devstack logs
+  synchronize:
+    dest: "{{ zuul.executor.log_root }}/{{ inventory_hostname }}"
+    mode: pull
+    src: "{{ devstack_base_dir }}/logs"
diff --git a/roles/run-devstack/README.rst b/roles/run-devstack/README.rst
new file mode 100644
index 0000000000..d77eb15e99
--- /dev/null
+++ b/roles/run-devstack/README.rst
@@ -0,0 +1,8 @@
+Run devstack
+
+**Role Variables**
+
+.. zuul:rolevar:: devstack_base_dir
+   :default: /opt/stack
+
+   The devstack base directory.
diff --git a/roles/run-devstack/defaults/main.yaml b/roles/run-devstack/defaults/main.yaml
new file mode 100644
index 0000000000..fea05c8146
--- /dev/null
+++ b/roles/run-devstack/defaults/main.yaml
@@ -0,0 +1 @@
+devstack_base_dir: /opt/stack
diff --git a/roles/run-devstack/tasks/main.yaml b/roles/run-devstack/tasks/main.yaml
new file mode 100644
index 0000000000..bafebafd65
--- /dev/null
+++ b/roles/run-devstack/tasks/main.yaml
@@ -0,0 +1,6 @@
+- name: Run devstack
+  command: ./stack.sh
+  args:
+    chdir: "{{devstack_base_dir}}/devstack"
+  become: true
+  become_user: stack
diff --git a/roles/setup-devstack-cache/README.rst b/roles/setup-devstack-cache/README.rst
new file mode 100644
index 0000000000..b8938c3dea
--- /dev/null
+++ b/roles/setup-devstack-cache/README.rst
@@ -0,0 +1,15 @@
+Set up the devstack cache directory
+
+If the node has a cache of devstack image files, copy it into place.
+
+**Role Variables**
+
+.. zuul:rolevar:: devstack_base_dir
+   :default: /opt/stack
+
+   The devstack base directory.
+
+.. zuul:rolevar:: devstack_cache_dir
+   :default: /opt/cache
+
+   The directory with the cached files.
diff --git a/roles/setup-devstack-cache/defaults/main.yaml b/roles/setup-devstack-cache/defaults/main.yaml
new file mode 100644
index 0000000000..c56720b4f5
--- /dev/null
+++ b/roles/setup-devstack-cache/defaults/main.yaml
@@ -0,0 +1,2 @@
+devstack_base_dir: /opt/stack
+devstack_cache_dir: /opt/cache
diff --git a/roles/setup-devstack-cache/tasks/main.yaml b/roles/setup-devstack-cache/tasks/main.yaml
new file mode 100644
index 0000000000..84f33f0e16
--- /dev/null
+++ b/roles/setup-devstack-cache/tasks/main.yaml
@@ -0,0 +1,14 @@
+- name: Copy cached devstack files
+  # This uses hard links to avoid using extra space.
+  command: "find {{ devstack_cache_dir }}/files -mindepth 1 -maxdepth 1 -exec cp -l {} {{ devstack_base_dir }}/devstack/files/ ;"
+  become: true
+
+- name: Set ownership of cached files
+  file:
+    path: '{{ devstack_base_dir }}/devstack/files'
+    state: directory
+    recurse: true
+    owner: stack
+    group: stack
+    mode: a+r
+  become: yes
diff --git a/roles/setup-devstack-log-dir/README.rst b/roles/setup-devstack-log-dir/README.rst
new file mode 100644
index 0000000000..9d8dba3442
--- /dev/null
+++ b/roles/setup-devstack-log-dir/README.rst
@@ -0,0 +1,11 @@
+Set up the devstack log directory
+
+Create a log directory on the ephemeral disk partition to save space
+on the root device.
+
+**Role Variables**
+
+.. zuul:rolevar:: devstack_base_dir
+   :default: /opt/stack
+
+   The devstack base directory.
diff --git a/roles/setup-devstack-log-dir/defaults/main.yaml b/roles/setup-devstack-log-dir/defaults/main.yaml
new file mode 100644
index 0000000000..fea05c8146
--- /dev/null
+++ b/roles/setup-devstack-log-dir/defaults/main.yaml
@@ -0,0 +1 @@
+devstack_base_dir: /opt/stack
diff --git a/roles/setup-devstack-log-dir/tasks/main.yaml b/roles/setup-devstack-log-dir/tasks/main.yaml
new file mode 100644
index 0000000000..b9f38dfacb
--- /dev/null
+++ b/roles/setup-devstack-log-dir/tasks/main.yaml
@@ -0,0 +1,5 @@
+- name: Create logs directory
+  file:
+    path: '{{ devstack_base_dir }}/logs'
+    state: directory
+  become: yes
diff --git a/roles/setup-devstack-source-dirs/README.rst b/roles/setup-devstack-source-dirs/README.rst
new file mode 100644
index 0000000000..4ebf8399c2
--- /dev/null
+++ b/roles/setup-devstack-source-dirs/README.rst
@@ -0,0 +1,11 @@
+Set up the devstack source directories
+
+Ensure that the base directory exists, and then move the source repos
+into it.
+
+**Role Variables**
+
+.. zuul:rolevar:: devstack_base_dir
+   :default: /opt/stack
+
+   The devstack base directory.
diff --git a/roles/setup-devstack-source-dirs/defaults/main.yaml b/roles/setup-devstack-source-dirs/defaults/main.yaml
new file mode 100644
index 0000000000..fea05c8146
--- /dev/null
+++ b/roles/setup-devstack-source-dirs/defaults/main.yaml
@@ -0,0 +1 @@
+devstack_base_dir: /opt/stack
diff --git a/roles/setup-devstack-source-dirs/tasks/main.yaml b/roles/setup-devstack-source-dirs/tasks/main.yaml
new file mode 100644
index 0000000000..e6bbae23b7
--- /dev/null
+++ b/roles/setup-devstack-source-dirs/tasks/main.yaml
@@ -0,0 +1,22 @@
+- name: Find all source repos used by this job
+  find:
+    paths:
+      - src/git.openstack.org/openstack
+      - src/git.openstack.org/openstack-dev
+      - src/git.openstack.org/openstack-infra
+    file_type: directory
+  register: found_repos
+
+- name: Copy Zuul repos into devstack working directory
+  command: rsync -a {{ item.path }} {{ devstack_base_dir }}
+  with_items: '{{ found_repos.files }}'
+  become: yes
+
+- name: Set ownership of repos
+  file:
+    path: '{{ devstack_base_dir }}'
+    state: directory
+    recurse: true
+    owner: stack
+    group: stack
+  become: yes
diff --git a/roles/setup-stack-user/README.rst b/roles/setup-stack-user/README.rst
new file mode 100644
index 0000000000..80c4d39eff
--- /dev/null
+++ b/roles/setup-stack-user/README.rst
@@ -0,0 +1,16 @@
+Set up the `stack` user
+
+Create the stack user, set up its home directory, and allow it to
+sudo.
+
+**Role Variables**
+
+.. zuul:rolevar:: devstack_base_dir
+   :default: /opt/stack
+
+   The devstack base directory.
+
+.. zuul:rolevar:: devstack_stack_home_dir
+   :default: {{ devstack_base_dir }}
+
+   The home directory for the stack user.
diff --git a/roles/setup-stack-user/defaults/main.yaml b/roles/setup-stack-user/defaults/main.yaml
new file mode 100644
index 0000000000..6d0be666d4
--- /dev/null
+++ b/roles/setup-stack-user/defaults/main.yaml
@@ -0,0 +1,2 @@
+devstack_base_dir: /opt/stack
+devstack_stack_home_dir: '{{ devstack_base_dir }}'
diff --git a/roles/setup-stack-user/files/50_stack_sh b/roles/setup-stack-user/files/50_stack_sh
new file mode 100644
index 0000000000..4c6b46bdb1
--- /dev/null
+++ b/roles/setup-stack-user/files/50_stack_sh
@@ -0,0 +1 @@
+stack ALL=(root) NOPASSWD:ALL
diff --git a/roles/setup-stack-user/tasks/main.yaml b/roles/setup-stack-user/tasks/main.yaml
new file mode 100644
index 0000000000..8384515ebe
--- /dev/null
+++ b/roles/setup-stack-user/tasks/main.yaml
@@ -0,0 +1,45 @@
+- name: Create stack group
+  group:
+    name: stack
+  become: yes
+
+# NOTE(andreaf) Create a user home_dir is not safe via
+# the user module since it will fail if the containing
+# folder does not exists. If the folder does exists and
+# it's empty, the skeleton is setup and ownership set.
+- name: Create the stack user home folder
+  file:
+    path: '{{ devstack_stack_home_dir }}'
+    state: directory
+  become: yes
+
+- name: Create stack user
+  user:
+    name: stack
+    shell: /bin/bash
+    home: '{{ devstack_stack_home_dir }}'
+    group: stack
+  become: yes
+
+- name: Set stack user home directory permissions
+  file:
+    path: '{{ devstack_stack_home_dir }}'
+    mode: 0755
+  become: yes
+
+- name: Copy 50_stack_sh file to /etc/sudoers.d
+  copy:
+    src: 50_stack_sh
+    dest: /etc/sudoers.d
+    mode: 0440
+    owner: root
+    group: root
+  become: yes
+
+- name: Create new/.cache folder within BASE
+  file:
+    path: '{{ devstack_stack_home_dir }}/.cache'
+    state: directory
+    owner: stack
+    group: stack
+  become: yes
diff --git a/roles/setup-tempest-user/README.rst b/roles/setup-tempest-user/README.rst
new file mode 100644
index 0000000000..bb29c50a28
--- /dev/null
+++ b/roles/setup-tempest-user/README.rst
@@ -0,0 +1,10 @@
+Set up the `tempest` user
+
+Create the tempest user and allow it to sudo.
+
+**Role Variables**
+
+.. zuul:rolevar:: devstack_base_dir
+   :default: /opt/stack
+
+   The devstack base directory.
diff --git a/roles/setup-tempest-user/files/51_tempest_sh b/roles/setup-tempest-user/files/51_tempest_sh
new file mode 100644
index 0000000000..f88ff9f4f2
--- /dev/null
+++ b/roles/setup-tempest-user/files/51_tempest_sh
@@ -0,0 +1,3 @@
+tempest ALL=(root) NOPASSWD:/sbin/ip
+tempest ALL=(root) NOPASSWD:/sbin/iptables
+tempest ALL=(root) NOPASSWD:/usr/bin/ovsdb-client
diff --git a/roles/setup-tempest-user/tasks/main.yaml b/roles/setup-tempest-user/tasks/main.yaml
new file mode 100644
index 0000000000..892eaf655a
--- /dev/null
+++ b/roles/setup-tempest-user/tasks/main.yaml
@@ -0,0 +1,20 @@
+- name: Create tempest group
+  group:
+    name: tempest
+  become: yes
+
+- name: Create tempest user
+  user:
+    name: tempest
+    shell: /bin/bash
+    group: tempest
+  become: yes
+
+- name: Copy 51_tempest_sh to /etc/sudoers.d
+  copy:
+    src: 51_tempest_sh
+    dest: /etc/sudoers.d
+    owner: root
+    group: root
+    mode: 0440
+  become: yes
diff --git a/roles/start-fresh-logging/README.rst b/roles/start-fresh-logging/README.rst
new file mode 100644
index 0000000000..11b029e182
--- /dev/null
+++ b/roles/start-fresh-logging/README.rst
@@ -0,0 +1,11 @@
+Restart logging on all hosts
+
+Restart syslog so that the system logs only include output from the
+job.
+
+**Role Variables**
+
+.. zuul:rolevar:: devstack_base_dir
+   :default: /opt/stack
+
+   The devstack base directory.
diff --git a/roles/start-fresh-logging/defaults/main.yaml b/roles/start-fresh-logging/defaults/main.yaml
new file mode 100644
index 0000000000..fea05c8146
--- /dev/null
+++ b/roles/start-fresh-logging/defaults/main.yaml
@@ -0,0 +1 @@
+devstack_base_dir: /opt/stack
diff --git a/roles/start-fresh-logging/tasks/main.yaml b/roles/start-fresh-logging/tasks/main.yaml
new file mode 100644
index 0000000000..6c7ba66de7
--- /dev/null
+++ b/roles/start-fresh-logging/tasks/main.yaml
@@ -0,0 +1,56 @@
+- name: Check for /bin/journalctl file
+  command: which journalctl
+  changed_when: False
+  failed_when: False
+  register: which_out
+
+- block:
+    - name: Get current date
+      command: date +"%Y-%m-%d %H:%M:%S"
+      register: date_out
+
+    - name: Copy current date to log-start-timestamp.txt
+      copy:
+        dest: "{{ devstack_base_dir }}/log-start-timestamp.txt"
+        content: "{{ date_out.stdout }}"
+  when: which_out.rc == 0
+  become: yes
+
+- block:
+    - name: Stop rsyslog
+      service: name=rsyslog state=stopped
+
+    - name: Save syslog file prior to devstack run
+      command: mv /var/log/syslog /var/log/syslog-pre-devstack
+
+    - name: Save kern.log file prior to devstack run
+      command: mv /var/log/kern.log /var/log/kern_log-pre-devstack
+
+    - name: Recreate syslog file
+      file: name=/var/log/syslog state=touch
+
+    - name: Recreate syslog file owner and group
+      command: chown /var/log/syslog --ref /var/log/syslog-pre-devstack
+
+    - name: Recreate syslog file permissions
+      command: chmod /var/log/syslog --ref /var/log/syslog-pre-devstack
+
+    - name: Add read permissions to all on syslog file
+      file: name=/var/log/syslog mode=a+r
+
+    - name: Recreate kern.log file
+      file: name=/var/log/kern.log state=touch
+
+    - name: Recreate kern.log file owner and group
+      command: chown /var/log/kern.log --ref /var/log/kern_log-pre-devstack
+
+    - name: Recreate kern.log file permissions
+      command: chmod /var/log/kern.log --ref /var/log/kern_log-pre-devstack
+
+    - name: Add read permissions to all on kern.log file
+      file: name=/var/log/kern.log mode=a+r
+
+    - name: Start rsyslog
+      service: name=rsyslog state=started
+  when: which_out.rc == 1
+  become: yes
diff --git a/roles/write-devstack-local-conf/README.rst b/roles/write-devstack-local-conf/README.rst
new file mode 100644
index 0000000000..e30dfa1e9f
--- /dev/null
+++ b/roles/write-devstack-local-conf/README.rst
@@ -0,0 +1,63 @@
+Write the local.conf file for use by devstack
+
+**Role Variables**
+
+.. zuul:rolevar:: devstack_base_dir
+   :default: /opt/stack
+
+   The devstack base directory.
+
+.. zuul:rolevar:: devstack_local_conf_path
+   :default: {{ devstack_base_dir }}/devstack/local.conf
+
+   The path of the local.conf file.
+
+.. zuul:rolevar:: devstack_localrc
+   :type: dict
+
+   A dictionary of variables that should be written to the localrc
+   section of local.conf.  The values (which are strings) may contain
+   bash shell variables, and will be ordered so that variables used by
+   later entries appear first.
+
+.. zuul:rolevar:: devstack_local_conf
+   :type: dict
+
+   A complex argument consisting of nested dictionaries which combine
+   to form the meta-sections of the local_conf file.  The top level is
+   a dictionary of phases, followed by dictionaries of filenames, then
+   sections, which finally contain key-value pairs for the INI file
+   entries in those sections.
+
+   The keys in this dictionary are the devstack phases.
+
+   .. zuul:rolevar:: [phase]
+      :type: dict
+
+      The keys in this dictionary are the filenames for this phase.
+
+      .. zuul:rolevar:: [filename]
+         :type: dict
+
+         The keys in this dictionary are the INI sections in this file.
+
+         .. zuul:rolevar:: [section]
+            :type: dict
+
+            This is a dictionary of key-value pairs which comprise
+            this section of the INI file.
+
+.. zuul:rolevar:: devstack_services
+   :type: dict
+
+   A dictionary mapping service names to boolean values.  If the
+   boolean value is ``false``, a ``disable_service`` line will be
+   emitted for the service name.  If it is ``true``, then
+   ``enable_service`` will be emitted.  All other values are ignored.
+
+.. zuul:rolevar:: devstack_plugins
+   :type: dict
+
+   A dictionary mapping a plugin name to a git repo location.  If the
+   location is a non-empty string, then an ``enable_plugin`` line will
+   be emmitted for the plugin name.
diff --git a/roles/write-devstack-local-conf/defaults/main.yaml b/roles/write-devstack-local-conf/defaults/main.yaml
new file mode 100644
index 0000000000..491fa0fdb9
--- /dev/null
+++ b/roles/write-devstack-local-conf/defaults/main.yaml
@@ -0,0 +1,2 @@
+devstack_base_dir: /opt/stack
+devstack_local_conf_path: "{{ devstack_base_dir }}/devstack/local.conf"
diff --git a/roles/write-devstack-local-conf/library/devstack_local_conf.py b/roles/write-devstack-local-conf/library/devstack_local_conf.py
new file mode 100644
index 0000000000..4134beb048
--- /dev/null
+++ b/roles/write-devstack-local-conf/library/devstack_local_conf.py
@@ -0,0 +1,185 @@
+# Copyright (C) 2017 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+#
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import re
+
+
+class VarGraph(object):
+    # This is based on the JobGraph from Zuul.
+
+    def __init__(self, vars):
+        self.vars = {}
+        self._varnames = set()
+        self._dependencies = {}  # dependent_var_name -> set(parent_var_names)
+        for k, v in vars.items():
+            self._varnames.add(k)
+        for k, v in vars.items():
+            self._addVar(k, str(v))
+
+    bash_var_re = re.compile(r'\$\{?(\w+)')
+    def getDependencies(self, value):
+        return self.bash_var_re.findall(value)
+
+    def _addVar(self, key, value):
+        if key in self.vars:
+            raise Exception("Variable {} already added".format(key))
+        self.vars[key] = value
+        # Append the dependency information
+        self._dependencies.setdefault(key, set())
+        try:
+            for dependency in self.getDependencies(value):
+                if dependency == key:
+                    # A variable is allowed to reference itself; no
+                    # dependency link needed in that case.
+                    continue
+                if dependency not in self._varnames:
+                    # It's not necessary to create a link for an
+                    # external variable.
+                    continue
+                # Make sure a circular dependency is never created
+                ancestor_vars = self._getParentVarNamesRecursively(
+                    dependency, soft=True)
+                ancestor_vars.add(dependency)
+                if any((key == anc_var) for anc_var in ancestor_vars):
+                    raise Exception("Dependency cycle detected in var {}".
+                                    format(key))
+                self._dependencies[key].add(dependency)
+        except Exception:
+            del self.vars[key]
+            del self._dependencies[key]
+            raise
+
+    def getVars(self):
+        ret = []
+        keys = sorted(self.vars.keys())
+        seen = set()
+        for key in keys:
+            dependencies = self.getDependentVarsRecursively(key)
+            for var in dependencies + [key]:
+                if var not in seen:
+                    ret.append((var, self.vars[var]))
+                    seen.add(var)
+        return ret
+
+    def getDependentVarsRecursively(self, parent_var):
+        dependent_vars = []
+
+        current_dependent_vars = self._dependencies[parent_var]
+        for current_var in current_dependent_vars:
+            if current_var not in dependent_vars:
+                dependent_vars.append(current_var)
+            for dep in self.getDependentVarsRecursively(current_var):
+                if dep not in dependent_vars:
+                    dependent_vars.append(dep)
+        return dependent_vars
+
+    def _getParentVarNamesRecursively(self, dependent_var, soft=False):
+        all_parent_vars = set()
+        vars_to_iterate = set([dependent_var])
+        while len(vars_to_iterate) > 0:
+            current_var = vars_to_iterate.pop()
+            current_parent_vars = self._dependencies.get(current_var)
+            if current_parent_vars is None:
+                if soft:
+                    current_parent_vars = set()
+                else:
+                    raise Exception("Dependent var {} not found: ".format(
+                                    dependent_var))
+            new_parent_vars = current_parent_vars - all_parent_vars
+            vars_to_iterate |= new_parent_vars
+            all_parent_vars |= new_parent_vars
+        return all_parent_vars
+
+
+class LocalConf(object):
+
+    def __init__(self, localrc, localconf, services, plugins):
+        self.localrc = []
+        self.meta_sections = {}
+        if plugins:
+            self.handle_plugins(plugins)
+        if services:
+            self.handle_services(services)
+        if localrc:
+            self.handle_localrc(localrc)
+        if localconf:
+            self.handle_localconf(localconf)
+
+    def handle_plugins(self, plugins):
+        for k, v in plugins.items():
+            if v:
+                self.localrc.append('enable_plugin {} {}'.format(k, v))
+
+    def handle_services(self, services):
+        for k, v in services.items():
+            if v is False:
+                self.localrc.append('disable_service {}'.format(k))
+            elif v is True:
+                self.localrc.append('enable_service {}'.format(k))
+
+    def handle_localrc(self, localrc):
+        vg = VarGraph(localrc)
+        for k, v in vg.getVars():
+            self.localrc.append('{}={}'.format(k, v))
+
+    def handle_localconf(self, localconf):
+        for phase, phase_data in localconf.items():
+            for fn, fn_data in phase_data.items():
+                ms_name = '[[{}|{}]]'.format(phase, fn)
+                ms_data = []
+                for section, section_data in fn_data.items():
+                    ms_data.append('[{}]'.format(section))
+                    for k, v in section_data.items():
+                        ms_data.append('{} = {}'.format(k, v))
+                    ms_data.append('')
+                self.meta_sections[ms_name] = ms_data
+
+    def write(self, path):
+        with open(path, 'w') as f:
+            f.write('[[local|localrc]]\n')
+            f.write('\n'.join(self.localrc))
+            f.write('\n\n')
+            for section, lines in self.meta_sections.items():
+                f.write('{}\n'.format(section))
+                f.write('\n'.join(lines))
+
+
+def main():
+    module = AnsibleModule(
+        argument_spec=dict(
+            plugins=dict(type='dict'),
+            services=dict(type='dict'),
+            localrc=dict(type='dict'),
+            local_conf=dict(type='dict'),
+            path=dict(type='str'),
+        )
+    )
+
+    p = module.params
+    lc = LocalConf(p.get('localrc'),
+                   p.get('local_conf'),
+                   p.get('services'),
+                   p.get('plugins'))
+    lc.write(p['path'])
+
+    module.exit_json()
+
+
+from ansible.module_utils.basic import *  # noqa
+from ansible.module_utils.basic import AnsibleModule
+
+if __name__ == '__main__':
+    main()
diff --git a/roles/write-devstack-local-conf/tasks/main.yaml b/roles/write-devstack-local-conf/tasks/main.yaml
new file mode 100644
index 0000000000..1d67616dd4
--- /dev/null
+++ b/roles/write-devstack-local-conf/tasks/main.yaml
@@ -0,0 +1,9 @@
+- name: Write a job-specific local_conf file
+  become: true
+  become_user: stack
+  devstack_local_conf:
+    path: "{{ devstack_local_conf_path }}"
+    plugins: "{{ devstack_plugins|default(omit) }}"
+    services: "{{ devstack_services|default(omit) }}"
+    localrc: "{{ devstack_localrc|default(omit) }}"
+    local_conf: "{{ devstack_local_conf|default(omit) }}"

From 9640d3bfbf55e74560677f9a13c241303666543a Mon Sep 17 00:00:00 2001
From: "James E. Blair" <jeblair@redhat.com>
Date: Sun, 15 Oct 2017 16:23:57 -0700
Subject: [PATCH 1167/2409] Zuul: remove file matcher for devstack job

The file matcher was from the early versions of this when we were
running both v2 and v3.  We should always run the new devstack
job on all changes to devstack now that v3 is in production and we
plan on building jobs off of this one.

Change-Id: I7dd336b0059043f6653bdfdcba0ee5cded3e67b1
---
 .zuul.yaml | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index cee195cf39..bb7239abae 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -76,10 +76,4 @@
     name: openstack-dev/devstack
     check:
       jobs:
-        - devstack:
-            files:
-              - ^playbooks/pre
-              - ^playbooks/post
-              - ^playbooks/devstack
-              - ^roles/
-              - .zuul.yaml
+        - devstack

From 6839d42819c8349d8f1e72a58037198c97baca06 Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@midokura.com>
Date: Tue, 17 Oct 2017 12:58:18 +0900
Subject: [PATCH 1168/2409] neutron-legacy: Remove no longer necessary vpnaas
 conditional

VPNaaS agent is going to be an L3 agent extention.

Related-Bug: #1692128
Depends-On: I0b86c432e4b2210e5f2a73a7e3ba16d10467f0f2
Change-Id: Id827274b7c74cdf71db6d1f2ab3eadb5fef099f5
---
 lib/neutron-legacy | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 0ccb17c084..e2e0bb92a9 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -503,11 +503,7 @@ function start_mutnauq_l2_agent {
 function start_mutnauq_other_agents {
     run_process q-dhcp "$AGENT_DHCP_BINARY --config-file $NEUTRON_CONF --config-file $Q_DHCP_CONF_FILE"
 
-    if is_service_enabled neutron-vpnaas; then
-        :  # Started by plugin
-    else
-        run_process q-l3 "$AGENT_L3_BINARY $(determine_config_files neutron-l3-agent)"
-    fi
+    run_process q-l3 "$AGENT_L3_BINARY $(determine_config_files neutron-l3-agent)"
 
     run_process q-meta "$AGENT_META_BINARY --config-file $NEUTRON_CONF --config-file $Q_META_CONF_FILE"
     run_process q-metering "$AGENT_METERING_BINARY --config-file $NEUTRON_CONF --config-file $METERING_AGENT_CONF_FILENAME"

From 2c2ca80ce0caadc9efa18c9f9289f6b98b3c486e Mon Sep 17 00:00:00 2001
From: Jan Zerebecki <jan.openstack@zerebecki.de>
Date: Tue, 17 Oct 2017 18:27:47 +0200
Subject: [PATCH 1169/2409] Fix libvirt daemon name condition

This makes the condition that chooses which daemon name libvirt to call
the same as for choosing the livirt package names.

Without this fix the condition checking for a directory is incorrect
when livirt is not yet installed, but is used before installing the
packages.

Change-Id: Ib5eb12769128527a6f4b3b5f7674bd2dad0ed160
---
 lib/nova_plugins/functions-libvirt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index 8d74c77517..dd299761e4 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -25,7 +25,7 @@ DEBUG_LIBVIRT=$(trueorfalse True DEBUG_LIBVIRT)
 DEBUG_LIBVIRT_COREDUMPS=$(trueorfalse False DEBUG_LIBVIRT_COREDUMPS)
 
 # Only Xenial is left with libvirt-bin.  Everywhere else is libvirtd
-if is_ubuntu && [ ! -f /etc/init.d/libvirtd ]; then
+if is_ubuntu && [ ${DISTRO} == "xenial" ]; then
     LIBVIRT_DAEMON=libvirt-bin
 else
     LIBVIRT_DAEMON=libvirtd

From 7b8f1e7964cec6ec9b69c7a40136aedcb888ebc2 Mon Sep 17 00:00:00 2001
From: Rafael Folco <rfolco@br.ibm.com>
Date: Mon, 16 Oct 2017 19:10:09 +0000
Subject: [PATCH 1170/2409] Set default disk driver to virtio-blk on Power

Reason is to be identical to the upstream KVM CI. Some Tempest
tests rely on vdX virtio-blk device naming. Others simply create
their own with a brand new image. Also, the scsi support on the
CirrOS image is limited, tests booting from volume fail.

Change-Id: I389147a58042aa6098a695e6dd32f3e697fbbbab
---
 functions | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions b/functions
index 8b69c73bba..20b83b3cd0 100644
--- a/functions
+++ b/functions
@@ -364,7 +364,7 @@ function upload_image {
     esac
 
     if is_arch "ppc64le" || is_arch "ppc64" || is_arch "ppc"; then
-        img_property="--property hw_disk_bus=scsi --property hw_scsi_model=virtio-scsi --property hw_cdrom_bus=scsi --property os_command_line=console=hvc0"
+        img_property="--property hw_cdrom_bus=scsi --property os_command_line=console=hvc0"
     fi
 
     if is_arch "aarch64"; then

From f0cd9a8b08d92524fc8e2c3f05d08cdebc638e2a Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Fri, 6 Oct 2017 13:11:48 -0500
Subject: [PATCH 1171/2409] Update lib_install_from_git to use column format

The pip list command supports a --format=columns option which outputs
things in space delimited columns. Switch to using that.

Change-Id: I5140a7d83bf567b1c3c67516112eb4c57074fa53
---
 inc/python | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/inc/python b/inc/python
index 9c810ec9b9..686efd40cf 100644
--- a/inc/python
+++ b/inc/python
@@ -415,11 +415,11 @@ function lib_installed_from_git {
     # you the path an editable install was installed from; for example
     # in response to something like
     #  pip install -e 'git+http://git.openstack.org/openstack-dev/bashate#egg=bashate'
-    # pip list shows
-    #  bashate (0.5.2.dev19, /tmp/env/src/bashate)
-    # Thus we look for "path after a comma" to indicate we were
-    # installed from some local place
-    pip list 2>/dev/null | grep -- "$name" | grep -q -- ', .*)$'
+    # pip list --format columns shows
+    #  bashate 0.5.2.dev19 /tmp/env/src/bashate
+    # Thus we check the third column to see if we're installed from
+    # some local place.
+    [[ -z $(pip list --format=columns 2>/dev/null | awk "/^$name/ {print \$3}") ]]
 }
 
 # check that everything that's in LIBS_FROM_GIT was actually installed

From e9870eb18d19dbb807d4d312cf4aead23c6f8f40 Mon Sep 17 00:00:00 2001
From: "Daniel P. Berrange" <berrange@redhat.com>
Date: Thu, 10 Nov 2016 13:03:32 +0000
Subject: [PATCH 1172/2409] nova: add support for TLS between novnc proxy &
 compute nodes

Nova is gaining the ability to run TLS over the connection between the
novnc proxy service and the QEMU/KVM compute node VNC server.

This adds a new config param - 'NOVA_CONSOLE_PROXY_COMPUTE_TLS=True' -
which instructs devstack to configure libvirt/QEMU to enable TLS for the
VNC server, and to configure the novncproxy to use TLS when connecting.
NB this use of TLS is distinct from use of TLS for the public facing API
controlled by USE_SSL, they can be enabled independently.

This is done in a generic manner so that it is easy to extend to cover
use of TLS with the SPICE and serial console proxy services too.

Change-Id: Ib29d3f5f18533115b9c51e27b373e92fc0a28d1a
Depends-on: I9cc9a380500715e60bd05aa5c29ee46bc6f8d6c2
Implements bp: websocket-proxy-to-host-security
---
 lib/nova                           | 22 ++++++++++++++++++++++
 lib/nova_plugins/functions-libvirt | 12 ++++++++++++
 lib/tls                            | 18 ++++++++++++++++++
 3 files changed, 52 insertions(+)

diff --git a/lib/nova b/lib/nova
index ea0d2f7b89..c48aba625f 100644
--- a/lib/nova
+++ b/lib/nova
@@ -82,6 +82,10 @@ if is_service_enabled tls-proxy; then
     NOVA_SERVICE_PROTOCOL="https"
 fi
 
+# Whether to use TLS for comms between the VNC/SPICE/serial proxy
+# services and the compute node
+NOVA_CONSOLE_PROXY_COMPUTE_TLS=${NOVA_CONSOLE_PROXY_COMPUTE_TLS:-False}
+
 # Public facing bits
 NOVA_SERVICE_HOST=${NOVA_SERVICE_HOST:-$SERVICE_HOST}
 NOVA_SERVICE_PORT=${NOVA_SERVICE_PORT:-8774}
@@ -197,6 +201,13 @@ function is_n-cell_enabled {
     return 1
 }
 
+# is_nova_console_proxy_compute_tls_enabled() - Test if the Nova Console Proxy
+# service has TLS enabled
+function is_nova_console_proxy_compute_tls_enabled {
+    [[ ${NOVA_CONSOLE_PROXY_COMPUTE_TLS} = "True" ]] && return 0
+    return 1
+}
+
 # Helper to clean iptables rules
 function clean_iptables {
     # Delete rules
@@ -524,6 +535,17 @@ function create_nova_conf {
         iniset $NOVA_CONF vnc server_proxyclient_address "$VNCSERVER_PROXYCLIENT_ADDRESS"
         iniset $NOVA_CONF vnc novncproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
         iniset $NOVA_CONF vnc xvpvncproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
+
+        if is_nova_console_proxy_compute_tls_enabled ; then
+            iniset $NOVA_CONF vnc auth_schemes "vencrypt"
+            iniset $NOVA_CONF vnc vencrypt_client_key "/etc/pki/nova-novnc/client-key.pem"
+            iniset $NOVA_CONF vnc vencrypt_client_cert "/etc/pki/nova-novnc/client-cert.pem"
+            iniset $NOVA_CONF vnc vencrypt_ca_certs "/etc/pki/nova-novnc/ca-cert.pem"
+
+            sudo mkdir -p /etc/pki/nova-novnc
+            deploy_int_CA /etc/pki/nova-novnc/ca-cert.pem
+            deploy_int_cert /etc/pki/nova-novnc/client-cert.pem /etc/pki/nova-novnc/client-key.pem
+        fi
     else
         iniset $NOVA_CONF vnc enabled false
     fi
diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index 8d74c77517..85b2689c59 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -147,6 +147,18 @@ EOF
         fi
     fi
 
+    if is_nova_console_proxy_compute_tls_enabled ; then
+        if is_service_enabled n-novnc ; then
+            echo "vnc_tls = 1" | sudo tee -a $QEMU_CONF
+            echo "vnc_tls_x509_verify = 1" | sudo tee -a $QEMU_CONF
+
+            sudo mkdir -p /etc/pki/libvirt-vnc
+            sudo chown libvirt-qemu:libvirt-qemu /etc/pki/libvirt-vnc
+            deploy_int_CA /etc/pki/libvirt-vnc/ca-cert.pem
+            deploy_int_cert /etc/pki/libvirt-vnc/server-cert.pem /etc/pki/libvirt-vnc/server-key.pem
+        fi
+    fi
+
     # Service needs to be started on redhat/fedora -- do a restart for
     # sanity after fiddling the config.
     restart_service $LIBVIRT_DAEMON
diff --git a/lib/tls b/lib/tls
index 0baf86caa9..bd9272cc18 100644
--- a/lib/tls
+++ b/lib/tls
@@ -340,6 +340,24 @@ function make_root_CA {
     fi
 }
 
+# Deploy the service cert & key to a service specific
+# location
+function deploy_int_cert {
+    local cert_target_file=$1
+    local key_target_file=$2
+
+    sudo cp "$INT_CA_DIR/$DEVSTACK_CERT_NAME.crt" "$cert_target_file"
+    sudo cp "$INT_CA_DIR/private/$DEVSTACK_CERT_NAME.key" "$key_target_file"
+}
+
+# Deploy the intermediate CA cert bundle file to a service
+# specific location
+function deploy_int_CA {
+    local ca_target_file=$1
+
+    sudo cp "$INT_CA_DIR/ca-chain.pem" "$ca_target_file"
+}
+
 # If a non-system python-requests is installed then it will use the
 # built-in CA certificate store rather than the distro-specific
 # CA certificate store. Detect this and symlink to the correct

From d8753b7dc997b5b5558ae4bbe3e14ffd0209666b Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 20 Oct 2017 14:21:33 +1100
Subject: [PATCH 1173/2409] Use configure-swap from o-z-j

Use the generic role

Change-Id: I534ed0256b7dfe5bef4ab13ae57cd73c51e8bd15
Depends-On: I0e9c846ace7fac8a1340746c6818fba6ec963018
---
 .zuul.yaml                                |   2 +
 roles/configure-swap/README.rst           |  11 ---
 roles/configure-swap/defaults/main.yaml   |   1 -
 roles/configure-swap/tasks/ephemeral.yaml | 110 ----------------------
 roles/configure-swap/tasks/main.yaml      |  63 -------------
 roles/configure-swap/tasks/root.yaml      |  63 -------------
 6 files changed, 2 insertions(+), 248 deletions(-)
 delete mode 100644 roles/configure-swap/README.rst
 delete mode 100644 roles/configure-swap/defaults/main.yaml
 delete mode 100644 roles/configure-swap/tasks/ephemeral.yaml
 delete mode 100644 roles/configure-swap/tasks/main.yaml
 delete mode 100644 roles/configure-swap/tasks/root.yaml

diff --git a/.zuul.yaml b/.zuul.yaml
index bb7239abae..8d3b2f4e6d 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -38,6 +38,8 @@
       - openstack/nova
       - openstack/requirements
       - openstack/swift
+    roles:
+      - zuul: openstack-infra/openstack-zuul-jobs
     timeout: 7200
     vars:
       devstack_localrc:
diff --git a/roles/configure-swap/README.rst b/roles/configure-swap/README.rst
deleted file mode 100644
index eaba5cf595..0000000000
--- a/roles/configure-swap/README.rst
+++ /dev/null
@@ -1,11 +0,0 @@
-Configure a swap partition
-
-Creates a swap partition on the ephemeral block device (the rest of which
-will be mounted on /opt).
-
-**Role Variables**
-
-.. zuul:rolevar:: configure_swap_size
-   :default: 8192
-
-   The size of the swap partition, in MiB.
diff --git a/roles/configure-swap/defaults/main.yaml b/roles/configure-swap/defaults/main.yaml
deleted file mode 100644
index 4d622321c7..0000000000
--- a/roles/configure-swap/defaults/main.yaml
+++ /dev/null
@@ -1 +0,0 @@
-configure_swap_size: 8192
diff --git a/roles/configure-swap/tasks/ephemeral.yaml b/roles/configure-swap/tasks/ephemeral.yaml
deleted file mode 100644
index c2316eac2b..0000000000
--- a/roles/configure-swap/tasks/ephemeral.yaml
+++ /dev/null
@@ -1,110 +0,0 @@
-# Configure attached ephemeral devices for storage and swap
-
-- assert:
-    that:
-      - "ephemeral_device is defined"
-
-- name: Set partition names
-  set_fact:
-    swap_partition: "{{ ephemeral_device}}1"
-    opt_partition: "{{ ephemeral_device}}2"
-
-- name: Ensure ephemeral device is unmounted
-  become: yes
-  mount:
-    name: "{{ ephemeral_device }}"
-    state: unmounted
-
-- name: Get existing partitions
-  become: yes
-  parted:
-    device: "{{ ephemeral_device }}"
-    unit: MiB
-  register: ephemeral_partitions
-
-- name: Remove any existing partitions
-  become: yes
-  parted:
-    device: "{{ ephemeral_device }}"
-    number: "{{ item.num }}"
-    state: absent
-  with_items:
-    - "{{ ephemeral_partitions.partitions }}"
-
-- name: Create new disk label
-  become: yes
-  parted:
-    label: msdos
-    device: "{{ ephemeral_device }}"
-
-- name: Create swap partition
-  become: yes
-  parted:
-    device: "{{ ephemeral_device }}"
-    number: 1
-    state: present
-    part_start: '0%'
-    part_end: "{{ configure_swap_size }}MiB"
-
-- name: Create opt partition
-  become: yes
-  parted:
-    device: "{{ ephemeral_device }}"
-    number: 2
-    state: present
-    part_start: "{{ configure_swap_size }}MiB"
-    part_end: "100%"
-
-- name: Make swap on partition
-  become: yes
-  command: "mkswap {{ swap_partition }}"
-
-- name: Write swap to fstab
-  become: yes
-  mount:
-    path: none
-    src: "{{ swap_partition }}"
-    fstype: swap
-    opts: sw
-    passno: 0
-    dump: 0
-    state: present
-
-# XXX: does "parted" plugin ensure the partition is available
-# before moving on?  No udev settles here ...
-
-- name: Add all swap
-  become: yes
-  command: swapon -a
-
-- name: Create /opt filesystem
-  become: yes
-  filesystem:
-    fstype: ext4
-    dev: "{{ opt_partition }}"
-
-# Rackspace at least does not have enough room for two devstack
-# installs on the primary partition.  We copy in the existing /opt to
-# the new partition on the ephemeral device, and then overmount /opt
-# to there for the test runs.
-#
-# NOTE(ianw): the existing "mount" touches fstab.  There is currently (Sep2017)
-# work in [1] to split mount & fstab into separate parts, but for now we bundle
-# it into an atomic shell command
-# [1] https://github.com/ansible/ansible/pull/27174
-- name: Copy old /opt
-  become: yes
-  shell: |
-    mount {{ opt_partition }} /mnt
-    find /opt/ -mindepth 1 -maxdepth 1 -exec mv {} /mnt/ \;
-    umount /mnt
-
-# This overmounts any existing /opt
-- name: Add opt to fstab and mount
-  become: yes
-  mount:
-    path: /opt
-    src: "{{ opt_partition }}"
-    fstype: ext4
-    opts: noatime
-    state: mounted
diff --git a/roles/configure-swap/tasks/main.yaml b/roles/configure-swap/tasks/main.yaml
deleted file mode 100644
index 8960c726c8..0000000000
--- a/roles/configure-swap/tasks/main.yaml
+++ /dev/null
@@ -1,63 +0,0 @@
-# On RAX hosts, we have a small root partition and a large,
-# unallocated ephemeral device attached at /dev/xvde
-- name: Set ephemeral device if /dev/xvde exists
-  when: ansible_devices["xvde"] is defined
-  set_fact:
-    ephemeral_device: "/dev/xvde"
-
-# On other providers, we have a device called "ephemeral0".
-#
-# NOTE(ianw): Once [1] is in our ansible (2.4 era?), we can figure
-# this out more directly by walking the device labels in the facts
-#
-# [1] https://github.com/ansible/ansible/commit/d46dd99f47c0ee5081d15bc5b741e9096d8bfd3e
-- name: Set ephemeral device by label
-  when: ephemeral_device is undefined
-  block:
-    - name: Get ephemeral0 device node
-      command: /sbin/blkid -L ephemeral0
-      register: ephemeral0
-      # If this doesn't exist, returns !0
-      ignore_errors: yes
-      changed_when: False
-
-    - name: Set ephemeral device if LABEL exists
-      when: "ephemeral0.rc == 0"
-      set_fact:
-        ephemeral_device: "{{ ephemeral0.stdout }}"
-
-# If we have ephemeral storage and we don't appear to have setup swap,
-# we will create a swap and move /opt to a large data partition there.
-- include: ephemeral.yaml
-  static: no
-  when:
-    - ephemeral_device is defined
-    - ansible_memory_mb['swap']['total'] | int + 10 <= configure_swap_size
-
-# If no ephemeral device and no swap, then we will setup some swap
-# space on the root device to ensure all hosts a consistent memory
-# environment.
-- include: root.yaml
-  static: no
-  when:
-    - ephemeral_device is undefined
-    - ansible_memory_mb['swap']['total'] | int + 10 <= configure_swap_size
-
-# ensure a standard level of swappiness.  Some platforms
-# (rax+centos7) come with swappiness of 0 (presumably because the
-# vm doesn't come with swap setup ... but we just did that above),
-# which depending on the kernel version can lead to the OOM killer
-# kicking in on some processes despite swap being available;
-# particularly things like mysql which have very high ratio of
-# anonymous-memory to file-backed mappings.
-#
-# This sets swappiness low; we really don't want to be relying on
-# cloud I/O based swap during our runs if we can help it
-- name: Set swappiness
-  become: yes
-  sysctl:
-    name: vm.swappiness
-    value: 30
-    state: present
-
-- debug:  var=ephemeral_device
diff --git a/roles/configure-swap/tasks/root.yaml b/roles/configure-swap/tasks/root.yaml
deleted file mode 100644
index f22b53700f..0000000000
--- a/roles/configure-swap/tasks/root.yaml
+++ /dev/null
@@ -1,63 +0,0 @@
-# If no ephemeral devices are available, use root filesystem
-
-- name: Calculate required swap
-  set_fact:
-    swap_required: "{{ configure_swap_size - ansible_memory_mb['swap']['total'] | int }}"
-
-- block:
-    - name: Get root filesystem
-      shell: df --output='fstype' /root | tail -1
-      register: root_fs
-
-    - name: Save root filesystem
-      set_fact:
-        root_filesystem: "{{ root_fs.stdout }}"
-
-    - debug: var=root_filesystem
-
-# Note, we don't use a sparse device to avoid wedging when disk space
-# and memory are both unavailable.
-
-# Cannot fallocate on filesystems like XFS, so use slower dd
-- name: Create swap backing file for non-EXT fs
-  when: '"ext" not in root_filesystem'
-  become: yes
-  command: dd if=/dev/zero of=/root/swapfile bs=1M count={{ swap_required }}
-  args:
-    creates: /root/swapfile
-
-- name: Create sparse swap backing file for EXT fs
-  when: '"ext" in root_filesystem'
-  become: yes
-  command: fallocate -l {{ swap_required }}M /root/swapfile
-  args:
-    creates: /root/swapfile
-
-- name: Ensure swapfile perms
-  become: yes
-  file:
-    path: /root/swapfile
-    owner: root
-    group: root
-    mode: 0600
-
-- name: Make swapfile
-  become: yes
-  command: mkswap /root/swapfile
-
-- name: Write swap to fstab
-  become: yes
-  mount:
-    path: none
-    src: /root/swapfile
-    fstype: swap
-    opts: sw
-    passno: 0
-    dump: 0
-    state: present
-
-- name: Add all swap
-  become: yes
-  command: swapon -a
-
-- debug: var=swap_required

From 065779517f9c99a80fbc39d51784c614e4ee341c Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Fri, 20 Oct 2017 12:14:29 -0700
Subject: [PATCH 1174/2409] Properly get pip version

The old code was strip()ing the version string instead of split()ing the
version string so we always got the first character of the version
string. This worked fine as long as the pip version was single digit but
as soon as it rolls over to '10.stuff' we will compare:

  pip version 1 (instead of 10) > 6

Which fails bceause 1 is less than six. Instaed we really do want to
compare 10 > 6 so use split on '.' instead.

Change-Id: Ic7d0c04d7fa77774ab2d70fb9d11f182becec553
---
 inc/python | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/inc/python b/inc/python
index 9c810ec9b9..8064014f36 100644
--- a/inc/python
+++ b/inc/python
@@ -333,7 +333,7 @@ function pip_install {
     # packages like setuptools?
     local pip_version
     pip_version=$(python -c "import pip; \
-                        print(pip.__version__.strip('.')[0])")
+                        print(pip.__version__.split('.')[0])")
     if (( pip_version<6 )); then
         die $LINENO "Currently installed pip version ${pip_version} does not" \
             "meet minimum requirements (>=6)."

From c9e109f1359e2310fab1190d164a28822fc09208 Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Sat, 21 Oct 2017 18:04:49 +0200
Subject: [PATCH 1175/2409] Disable nested virt in base devstack job

We were doing this in devstack-gate. The gate can't handle nested virt.

Change-Id: Ie71663c3144908ddd134fa5a5b1b2d265a60edcf
---
 .zuul.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index bb7239abae..9e00231265 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -61,6 +61,8 @@
         NETWORK_GATEWAY: 10.1.0.1
         NOVNC_FROM_PACKAGE: True
         ERROR_ON_CLONE: True
+        # Gate jobs can't deal with nested virt. Disable it.
+        LIBVIRT_TYPE: qemu
         # NOTE(dims): etcd 3.x is not available in debian/ubuntu
         # etc. As a stop gap measure, devstack uses wget to download
         # from the location below for all the CI jobs.

From e8db8674855634dadd90adaadd4381f70c7227ed Mon Sep 17 00:00:00 2001
From: Chandan Kumar <chkumar@redhat.com>
Date: Thu, 26 Oct 2017 15:34:05 +0530
Subject: [PATCH 1176/2409] Change ENABLE_KSM to $ENABLE_KSM

* Since ENABLE_KSM param will be used in local.conf file
  and it's value is received in a variable and while compairing,
  the variable needs to be compared. So we need to change the
  same.

Change-Id: Id4ed17c0642acd2313e456503cfc375ca6f61409
Closes-Bug: #1724690
---
 stack.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index c545c56de3..f14ed96b9b 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1006,7 +1006,7 @@ save_stackenv $LINENO
 # be memory bound not cpu bound so enable KSM by default but allow people
 # to opt out if the CPU time is more important to them.
 
-if [[ "ENABLE_KSM" == "True" ]] ; then
+if [[ $ENABLE_KSM == "True" ]] ; then
     if [[ -f /sys/kernel/mm/ksm/run ]] ; then
         sudo sh -c "echo 1 > /sys/kernel/mm/ksm/run"
     fi

From 228d90d5eb7784f3d4cbd889f478329a8d3a6868 Mon Sep 17 00:00:00 2001
From: "James E. Blair" <jeblair@redhat.com>
Date: Thu, 26 Oct 2017 16:46:15 -0700
Subject: [PATCH 1177/2409] Zuul: add run attribute

A proposed change[1] to Zuul removes the implied run attribute.
Add an explicit run attribute here to prepare for that.

[1] Ia8f23bce9898cd4f387554e6787b091b63e75519

Change-Id: I1fbc36c3d1b8c4ed70fceef1c587255dad50da04
---
 .zuul.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index 9e00231265..826410c2c7 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -71,6 +71,7 @@
         horizon: False
         tempest: False
     pre-run: playbooks/pre
+    run: playbooks/devstack
     post-run: playbooks/post
 
 

From c0d8c1c72d61d53bf723de4e0bea6318c6b951b2 Mon Sep 17 00:00:00 2001
From: "James E. Blair" <jeblair@redhat.com>
Date: Sat, 28 Oct 2017 10:23:58 -0700
Subject: [PATCH 1178/2409] Zuul: add file extension to playbook path

Zuul now supports including the file extension on the playbook path
and omitting the extension is now deprecrated.  Update references
to include the extension.

Change-Id: I4bff5f12742364f7cc92e17869a047fd2185dda4
---
 .zuul.yaml | 25 ++++++++++++-------------
 1 file changed, 12 insertions(+), 13 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 389ada52c2..710b229d5b 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -48,7 +48,7 @@
         ADMIN_PASSWORD: secretadmin
         SERVICE_PASSWORD: secretservice
         NETWORK_GATEWAY: 10.1.0.1
-        Q_USE_DEBUG_COMMAND: True
+        Q_USE_DEBUG_COMMAND: true
         FIXED_RANGE: 10.1.0.0/20
         IPV4_ADDRS_SAFE_TO_USE: 10.1.0.0/20
         FLOATING_RANGE: 172.24.5.0/24
@@ -56,25 +56,24 @@
         FLOATING_HOST_PREFIX: 172.24.4
         FLOATING_HOST_MASK: 23
         SWIFT_REPLICAS: 1
-        SWIFT_START_ALL_SERVICES: False
+        SWIFT_START_ALL_SERVICES: false
         LOGFILE: /opt/stack/logs/devstacklog.txt
-        LOG_COLOR: False
-        VERBOSE: True
-        NETWORK_GATEWAY: 10.1.0.1
-        NOVNC_FROM_PACKAGE: True
-        ERROR_ON_CLONE: True
+        LOG_COLOR: false
+        VERBOSE: true
+        NOVNC_FROM_PACKAGE: true
+        ERROR_ON_CLONE: true
         # Gate jobs can't deal with nested virt. Disable it.
         LIBVIRT_TYPE: qemu
         # NOTE(dims): etcd 3.x is not available in debian/ubuntu
         # etc. As a stop gap measure, devstack uses wget to download
         # from the location below for all the CI jobs.
-        ETCD_DOWNLOAD_URL: "http://tarballs.openstack.org/etcd/"
+        ETCD_DOWNLOAD_URL: http://tarballs.openstack.org/etcd/
       devstack_services:
-        horizon: False
-        tempest: False
-    pre-run: playbooks/pre
-    run: playbooks/devstack
-    post-run: playbooks/post
+        horizon: false
+        tempest: false
+    pre-run: playbooks/pre.yaml
+    run: playbooks/devstack.yaml
+    post-run: playbooks/post.yaml
 
 
 - project:

From 32ecccaeef1b06bb48fc6fe066be4f42332e5a2a Mon Sep 17 00:00:00 2001
From: caowei <cao.wei@99cloud.net>
Date: Wed, 1 Nov 2017 11:45:21 +0800
Subject: [PATCH 1179/2409] Add "sudo" before the journalctl command

Change-Id: I41c396f704918e88168c9a9c6cc9e633e7a81437
---
 doc/source/configuration.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 23f680a59c..d932d8cd86 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -294,7 +294,7 @@ the systemd journal.
 
 To query the logs use the ``journalctl`` command, such as::
 
-  journalctl --unit devstack@*
+  sudo journalctl --unit devstack@*
 
 More examples can be found in :ref:`journalctl-examples`.
 

From a794b12cf2a6b349272ce44892635d07231059d1 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Wed, 1 Nov 2017 06:34:13 +0000
Subject: [PATCH 1180/2409] Updated from generate-devstack-plugins-list

Change-Id: Ic6d3cdb0b1fcc674ab5adcbaf45fa5a80f10b10f
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 5fd6697d35..c3063ac2ed 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -67,6 +67,7 @@ gce-api                                `git://git.openstack.org/openstack/gce-ap
 glare                                  `git://git.openstack.org/openstack/glare <https://git.openstack.org/cgit/openstack/glare>`__
 group-based-policy                     `git://git.openstack.org/openstack/group-based-policy <https://git.openstack.org/cgit/openstack/group-based-policy>`__
 heat                                   `git://git.openstack.org/openstack/heat <https://git.openstack.org/cgit/openstack/heat>`__
+heat-dashboard                         `git://git.openstack.org/openstack/heat-dashboard <https://git.openstack.org/cgit/openstack/heat-dashboard>`__
 horizon-mellanox                       `git://git.openstack.org/openstack/horizon-mellanox <https://git.openstack.org/cgit/openstack/horizon-mellanox>`__
 ironic                                 `git://git.openstack.org/openstack/ironic <https://git.openstack.org/cgit/openstack/ironic>`__
 ironic-inspector                       `git://git.openstack.org/openstack/ironic-inspector <https://git.openstack.org/cgit/openstack/ironic-inspector>`__

From 1d968d7a542c7a271d72aac08fdd7fe8b235011f Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Sat, 23 Sep 2017 14:45:42 +0200
Subject: [PATCH 1181/2409] Switch to mariadb on openSUSE

The mysql-community-server is a compat provide, openSUSE uses
mariadb for quite some time. Make it futureproof in case
the compat provide goes away in the future. Cleanup
mysql service name to MYSQL_SERVICE_NAME and consistently
use it.

Change-Id: I2df7b8d8b798dfa7ceade90e0c127e0609524a8b
---
 lib/databases/mysql | 28 +++++++++++-----------------
 1 file changed, 11 insertions(+), 17 deletions(-)

diff --git a/lib/databases/mysql b/lib/databases/mysql
index a0cf7a4296..0089663285 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -15,10 +15,9 @@ MYSQL_DRIVER=${MYSQL_DRIVER:-PyMySQL}
 
 register_database mysql
 
-# Linux distros, thank you for being incredibly consistent
-MYSQL=mysql
+MYSQL_SERVICE_NAME=mysql
 if is_fedora && ! is_oraclelinux; then
-    MYSQL=mariadb
+    MYSQL_SERVICE_NAME=mariadb
 fi
 
 # Functions
@@ -34,17 +33,17 @@ function get_database_type_mysql {
 
 # Get rid of everything enough to cleanly change database backends
 function cleanup_database_mysql {
-    stop_service $MYSQL
+    stop_service $MYSQL_SERVICE_NAME
     if is_ubuntu; then
         # Get ruthless with mysql
         apt_get purge -y mysql* mariadb*
         sudo rm -rf /var/lib/mysql
         sudo rm -rf /etc/mysql
         return
-    elif is_suse || is_oraclelinux; then
+    elif is_oraclelinux; then
         uninstall_package mysql-community-server
         sudo rm -rf /var/lib/mysql
-    elif is_fedora; then
+    elif is_suse || is_fedora; then
         uninstall_package mariadb-server
         sudo rm -rf /var/lib/mysql
     else
@@ -64,12 +63,9 @@ function configure_database_mysql {
 
     if is_ubuntu; then
         my_conf=/etc/mysql/my.cnf
-        mysql=mysql
     elif is_suse || is_oraclelinux; then
         my_conf=/etc/my.cnf
-        mysql=mysql
     elif is_fedora; then
-        mysql=mariadb
         my_conf=/etc/my.cnf
         local cracklib_conf=/etc/my.cnf.d/cracklib_password_check.cnf
         if [ -f "$cracklib_conf" ]; then
@@ -82,7 +78,7 @@ function configure_database_mysql {
     # Start mysql-server
     if is_fedora || is_suse; then
         # service is not started by default
-        start_service $mysql
+        start_service $MYSQL_SERVICE_NAME
     fi
 
     # Set the root password - only works the first time. For Ubuntu, we already
@@ -124,7 +120,7 @@ function configure_database_mysql {
         iniset -sudo $my_conf mysqld log-queries-not-using-indexes 1
     fi
 
-    restart_service $mysql
+    restart_service $MYSQL_SERVICE_NAME
 }
 
 function install_database_mysql {
@@ -151,13 +147,11 @@ EOF
         chmod 0600 $HOME/.my.cnf
     fi
     # Install mysql-server
-    if is_suse || is_oraclelinux; then
-        if ! is_package_installed mariadb; then
-            install_package mysql-community-server
-        fi
-    elif is_fedora; then
+    if is_oraclelinux; then
+        install_package mysql-community-server
+    elif is_fedora || is_suse; then
         install_package mariadb-server
-        sudo systemctl enable mariadb
+        sudo systemctl enable $MYSQL_SERVICE_NAME
     elif is_ubuntu; then
         install_package mysql-server
     else

From 1db9b5d3cab9ecfdc3505ea40ac4f504075fbea0 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Fri, 3 Nov 2017 08:37:21 +0000
Subject: [PATCH 1182/2409] Remove apache tls-proxy sites when stopping

Currently doing a cycle of

    ./stack.sh; ./unstack.sh; ./stack.sh

fails because the leftover tls-proxy sites will cause apache startup to
fail on the second stack.sh run. So we need to disable these sites on
running stop_tls_proxy.

Change-Id: I03e6879be332289d19ca6a656f5f9f139dffff6f
Closes-Bug: 1718189
---
 lib/tls | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/lib/tls b/lib/tls
index 0baf86caa9..0bc389bb88 100644
--- a/lib/tls
+++ b/lib/tls
@@ -564,6 +564,20 @@ function follow_tls_proxy {
 # using tls configuration are down.
 function stop_tls_proxy {
     stop_apache_server
+
+    # NOTE(jh): Removing all tls-proxy configs is a bit of a hack, but
+    # necessary so that we can restart after an unstack.  A better
+    # solution would be to ensure that each service calling
+    # start_tls_proxy will call stop_tls_proxy with the same
+    # parameters on shutdown so we can use the disable_apache_site
+    # function and remove individual files there.
+    if is_ubuntu; then
+        sudo rm -f /etc/apache2/sites-enabled/*-tls-proxy.conf
+    else
+        for i in $APACHE_CONF_DIR/*-tls-proxy.conf; do
+            sudo mv $i $i.disabled
+        done
+    fi
 }
 
 # Clean up the CA files

From efc5168245406156a98a6623b9bebae757275cf7 Mon Sep 17 00:00:00 2001
From: Brian Haley <bhaley@redhat.com>
Date: Fri, 10 Nov 2017 00:50:48 -0500
Subject: [PATCH 1183/2409] Replace deprecated nova_metadata_ip

Option nova_metadata_ip was deprecated in favor
of nova_metadata_host.  lib/neutron was updated
recently but lib/neutron-legacy was missed.

Change-Id: Iadd42458dda705ad0c24aa4ab2afd5b27dd8f0e1
---
 lib/neutron-legacy | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 0ccb17c084..bb76c5f9ce 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -757,7 +757,7 @@ function _configure_neutron_metadata_agent {
     cp $NEUTRON_DIR/etc/metadata_agent.ini.sample $Q_META_CONF_FILE
 
     iniset $Q_META_CONF_FILE DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-    iniset $Q_META_CONF_FILE DEFAULT nova_metadata_ip $Q_META_DATA_IP
+    iniset $Q_META_CONF_FILE DEFAULT nova_metadata_host $Q_META_DATA_IP
     iniset $Q_META_CONF_FILE DEFAULT metadata_workers $API_WORKERS
     iniset $Q_META_CONF_FILE AGENT root_helper "$Q_RR_COMMAND"
     if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then

From 3b815a3cb2537885b501ad559bfd69ad5efb9085 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20Dulko?= <mdulko@redhat.com>
Date: Tue, 14 Nov 2017 16:04:51 +0100
Subject: [PATCH 1184/2409] Provide finite value for systemd's TimeoutStopSec

This commit switches TimeoutStopSec in DevStack's systemd unit files
from "infinity" to "300". There are two motivations for that change:

* 5 minutes should be more than enough to stop a service.
* systemd included in CentOS 7 and RHEL 7 doesn't support "infinity" as
  a value, "0" should be provided instead. When "infinity" is set,
  systemd will kill the service instantly, leaving service children
  processes orphaned. Instead of differentiating here, we can just set a
  sane, finite number.

Closes-Bug: 1731275
Change-Id: I0a079ea9879fa4fbba23104c2f5ab6e0721a2a2a
---
 functions-common | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index 030ff8c02d..0160c622b7 100644
--- a/functions-common
+++ b/functions-common
@@ -1394,7 +1394,7 @@ function write_user_unit_file {
     iniset -sudo $unitfile "Service" "User" "$user"
     iniset -sudo $unitfile "Service" "ExecStart" "$command"
     iniset -sudo $unitfile "Service" "KillMode" "process"
-    iniset -sudo $unitfile "Service" "TimeoutStopSec" "infinity"
+    iniset -sudo $unitfile "Service" "TimeoutStopSec" "300"
     iniset -sudo $unitfile "Service" "ExecReload" "$KILL_PATH -HUP \$MAINPID"
     if [[ -n "$group" ]]; then
         iniset -sudo $unitfile "Service" "Group" "$group"

From 83194f956e1c5308386adbf7146626e75875bcfe Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Fri, 3 Nov 2017 14:14:53 +0000
Subject: [PATCH 1185/2409] Update supported Ubuntu releases

With the release of 17.10(artful), support for 16.10(yakkety) has ended.
Update our list of supported distros accordingly.

Change-Id: Id85e00f109cfd43141dec0c0d2bfedb66f14e664
---
 stack.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index a125d4a0d7..1d0381483a 100755
--- a/stack.sh
+++ b/stack.sh
@@ -221,7 +221,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (xenial|yakkety|zesty|stretch|jessie|f24|f25|f26|opensuse-42.2|opensuse-42.3|rhel7) ]]; then
+if [[ ! ${DISTRO} =~ (xenial|zesty|artful|stretch|jessie|f24|f25|f26|opensuse-42.2|opensuse-42.3|rhel7) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From e340a7bfff80889361085cfb592b1880d27b5a21 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Thu, 16 Nov 2017 06:17:45 +0000
Subject: [PATCH 1186/2409] Updated from generate-devstack-plugins-list

Change-Id: I884ae2ff23f8c23874e166dd7643b188f7450109
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index c3063ac2ed..43dd3c2eae 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -151,6 +151,7 @@ oswin-tempest-plugin                   `git://git.openstack.org/openstack/oswin-
 panko                                  `git://git.openstack.org/openstack/panko <https://git.openstack.org/cgit/openstack/panko>`__
 patrole                                `git://git.openstack.org/openstack/patrole <https://git.openstack.org/cgit/openstack/patrole>`__
 picasso                                `git://git.openstack.org/openstack/picasso <https://git.openstack.org/cgit/openstack/picasso>`__
+python-openstacksdk                    `git://git.openstack.org/openstack/python-openstacksdk <https://git.openstack.org/cgit/openstack/python-openstacksdk>`__
 qinling                                `git://git.openstack.org/openstack/qinling <https://git.openstack.org/cgit/openstack/qinling>`__
 rally                                  `git://git.openstack.org/openstack/rally <https://git.openstack.org/cgit/openstack/rally>`__
 sahara                                 `git://git.openstack.org/openstack/sahara <https://git.openstack.org/cgit/openstack/sahara>`__

From 4bc42c7197c291639be6841d75f02dc008b8b915 Mon Sep 17 00:00:00 2001
From: Brian Haley <bhaley@redhat.com>
Date: Tue, 7 Nov 2017 15:22:00 -0500
Subject: [PATCH 1187/2409] Change lib/neutron-legacy to use openstackclient

neutronclient has been deprecated, use openstack.

Change-Id: I55ea7b8c90b54c05aa0e3f3d4543732e516dc2e6
---
 lib/neutron-legacy | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 0ccb17c084..39f41fdccc 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -929,7 +929,7 @@ function delete_probe {
 }
 
 function _get_net_id {
-    neutron --os-cloud devstack-admin --os-region "$REGION_NAME" --os-tenant-name admin --os-username admin --os-password $ADMIN_PASSWORD net-list | grep $1 | awk '{print $2}'
+    openstack --os-cloud devstack-admin --os-region-name="$REGION_NAME" --os-project-name admin --os-username admin --os-password $ADMIN_PASSWORD network list | grep $1 | awk '{print $2}'
 }
 
 function _get_probe_cmd_prefix {

From 0d0b69027bc2b0195ed365619be78466867311ec Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 17 Nov 2017 10:33:11 +1100
Subject: [PATCH 1188/2409] Restore qemu-kvm install for CentOS

The kvmibm removal I009ae4779588615633bff81d0c47a1b879ec9279
incorrectly removed this (the check was install if *not* kvmibm).
Since we don't support kvmibm any more, it should be safe to install
everywhere as done here.

For the full history, it started with us installing qemu-kvm-ev with
Ide91b261f35fb19d8bd7155ca016fa3b76a45ea1, then we fixed it to be more
generic and just install qemu-kvm with
I46da627c0da8925064862fdc283db81591979285, then Fedora 26 support in
I5c79ad1ef0b11dba30c931a59786f9eb7e7f8587 made this install everywhere
*but* kvmibm.

Change-Id: If3e9661451ad1055e7c8d670605a53095f0aeda4
---
 lib/nova_plugins/functions-libvirt | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index c8527387ab..dbfa3b5cac 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -72,6 +72,13 @@ function install_libvirt {
         pip_install_gr libvirt-python
         #pip_install_gr <there-si-no-guestfs-in-pypi>
     elif is_fedora || is_suse; then
+
+        # Note that in CentOS/RHEL this needs to come from the RDO
+        # repositories (qemu-kvm-ev ... which provides this package)
+        # as the base system version is too old.  We should have
+        # pre-installed these
+        install_package qemu-kvm
+
         install_package libvirt libvirt-devel
         pip_uninstall libvirt-python
         pip_install_gr libvirt-python

From 1a2c86cff99d5628f93105c8d4ed815baf781941 Mon Sep 17 00:00:00 2001
From: jiangyikun <yikunkero@gmail.com>
Date: Thu, 7 Sep 2017 17:56:13 +0800
Subject: [PATCH 1189/2409] Cleanup nova cell configuration before config it

Some old configuration(such as, LOG_COLOR config) will remain
if we don't cleanup.

So, we should cleanup the configuration before we config it.

Change-Id: I7aff609dadf3acba13a36894614b35005f51280d
---
 lib/nova | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/nova b/lib/nova
index ea0d2f7b89..50deeeb220 100644
--- a/lib/nova
+++ b/lib/nova
@@ -589,6 +589,8 @@ function create_nova_conf {
             local vhost
             conf=$(conductor_conf $i)
             vhost="nova_cell${i}"
+            # clean old conductor conf
+            rm -f $conf
             iniset $conf database connection `database_connection_url nova_cell${i}`
             iniset $conf conductor workers "$API_WORKERS"
             iniset $conf DEFAULT debug "$ENABLE_DEBUG_LOG_LEVEL"

From c5853ac1afe79c9b96a2c4cbd30069566ab12955 Mon Sep 17 00:00:00 2001
From: "James E. Blair" <jeblair@redhat.com>
Date: Tue, 21 Nov 2017 09:44:42 -0800
Subject: [PATCH 1190/2409] Allow plugins to express dependency info

Add a no-op function, "plugin_requires" to allow plugins to indicate
their dependencies on each other.  This will be used by the Devstack
Ansible module when writing local.conf files.

Also add define_plugin to allow plugins to indicate their canonical
names.

Change-Id: Ibd8c7222ed7dfb08d7ea821d871fc6f3b88de24b
---
 doc/source/plugins.rst | 25 +++++++++++++++++++++++++
 functions-common       | 29 +++++++++++++++++++++++++++++
 2 files changed, 54 insertions(+)

diff --git a/doc/source/plugins.rst b/doc/source/plugins.rst
index fae1a1d8f5..89b9381813 100644
--- a/doc/source/plugins.rst
+++ b/doc/source/plugins.rst
@@ -54,6 +54,31 @@ directory. Inside this directory there can be 3 files.
   default value only if the variable is unset or empty; e.g. in bash
   syntax ``FOO=${FOO:-default}``.
 
+  The file should include a ``define_plugin`` line to indicate the
+  plugin's name, which is the name that should be used by users on
+  "enable_plugin" lines.  It should generally be the last component of
+  the git repo path (e.g., if the plugin's repo is
+  openstack/devstack-foo, then the name here should be "foo") ::
+
+    define_plugin <YOUR PLUGIN>
+
+  If your plugin depends on another plugin, indicate it in this file
+  with one or more lines like the following::
+
+    plugin_requires <YOUR PLUGIN> <OTHER PLUGIN>
+
+  For a complete example, if the plugin "foo" depends on "bar", the
+  ``settings`` file should include::
+
+    define_plugin foo
+    plugin_requires foo bar
+
+  Devstack does not currently use this dependency information, so it's
+  important that users continue to add enable_plugin lines in the
+  correct order in ``local.conf``, however adding this information
+  allows other tools to consider dependency information when
+  automatically generating ``local.conf`` files.
+
 - ``plugin.sh`` - the actual plugin. It is executed by devstack at
   well defined points during a ``stack.sh`` run. The plugin.sh
   internal structure is discussed below.
diff --git a/functions-common b/functions-common
index 6d565916fa..aee569bee2 100644
--- a/functions-common
+++ b/functions-common
@@ -1703,6 +1703,35 @@ function run_phase {
     fi
 }
 
+# define_plugin <name>
+#
+# This function is a no-op.  It allows a plugin to define its name So
+# that other plugins may reference it by name.  It should generally be
+# the last component of the canonical git repo name.  E.g.,
+# openstack/devstack-foo should use "devstack-foo" as the name here.
+#
+# This function is currently a noop, but the value may still be used
+# by external tools (as in plugin_requires) and may be used by
+# devstack in the future.
+#
+# ``name`` is an arbitrary name - (aka: glusterfs, nova-docker, zaqar)
+function define_plugin {
+    :
+}
+
+# plugin_requires <name> <other>
+#
+# This function is a no-op.  It is currently used by external tools
+# (such as the devstack module for Ansible) to automatically generate
+# local.conf files.  It is not currently used by devstack itself to
+# resolve dependencies.
+#
+# ``name`` is an arbitrary name - (aka: glusterfs, nova-docker, zaqar)
+# ``other`` is the name of another plugin
+function plugin_requires {
+    :
+}
+
 
 # Service Functions
 # =================

From b5fb7fd627fe24876a8dd2782fce065cf1957b55 Mon Sep 17 00:00:00 2001
From: rabi <ramishra@redhat.com>
Date: Wed, 22 Nov 2017 08:14:29 +0530
Subject: [PATCH 1191/2409] Fix lib_installed_from_git

In commit f0cd9a8b08d92524fc8e2c3f05d08cdebc638e2a we changed to
use column format, but it checks for zero length string and
check_libs_from_git fails.

Change-Id: I97b52b80efb33749647229a55147a08afa112dd2
---
 inc/python | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/inc/python b/inc/python
index 9a65bfefb1..9f56ec5e7f 100644
--- a/inc/python
+++ b/inc/python
@@ -419,7 +419,7 @@ function lib_installed_from_git {
     #  bashate 0.5.2.dev19 /tmp/env/src/bashate
     # Thus we check the third column to see if we're installed from
     # some local place.
-    [[ -z $(pip list --format=columns 2>/dev/null | awk "/^$name/ {print \$3}") ]]
+    [[ -n $(pip list --format=columns 2>/dev/null | awk "/^$name/ {print \$3}") ]]
 }
 
 # check that everything that's in LIBS_FROM_GIT was actually installed

From 007f588f275ac9d7320d4b24f1d05378d3df3d37 Mon Sep 17 00:00:00 2001
From: DamonLi <damonl@vmware.com>
Date: Thu, 23 Nov 2017 10:05:46 +0800
Subject: [PATCH 1192/2409] Convert to safe name in lib_installed_from_git

The 'pip list' command prints the "safe name" which converts _'s to
-'s amongst other things; e.g. glance_store becomes

  "glance-store             0.21.1.dev22      /opt/stack/glance_store"

Because people may use these more familiar "file system" names in
LIBS_FROM_GIT automatically convert names when checking if libraries
are installed.

Change-Id: I30524f80a341f38dfa794a8f629d859e85a4a448
---
 inc/python | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/inc/python b/inc/python
index 9f56ec5e7f..9938f98545 100644
--- a/inc/python
+++ b/inc/python
@@ -406,6 +406,9 @@ function use_library_from_git {
 # determine if a package was installed from git
 function lib_installed_from_git {
     local name=$1
+    local safe_name
+    safe_name=$(python -c "from pkg_resources import safe_name; \
+        print(safe_name('${name}'))")
     # Note "pip freeze" doesn't always work here, because it tries to
     # be smart about finding the remote of the git repo the package
     # was installed from.  This doesn't work with zuul which clones
@@ -419,7 +422,7 @@ function lib_installed_from_git {
     #  bashate 0.5.2.dev19 /tmp/env/src/bashate
     # Thus we check the third column to see if we're installed from
     # some local place.
-    [[ -n $(pip list --format=columns 2>/dev/null | awk "/^$name/ {print \$3}") ]]
+    [[ -n $(pip list --format=columns 2>/dev/null | awk "/^$safe_name/ {print \$3}") ]]
 }
 
 # check that everything that's in LIBS_FROM_GIT was actually installed

From 34c1679f2ee42df40c32ad96b4269f94721dc8d4 Mon Sep 17 00:00:00 2001
From: Claudiu Belu <cbelu@cloudbasesolutions.com>
Date: Mon, 12 Jun 2017 09:32:21 -0700
Subject: [PATCH 1193/2409] use master upper-constraints when building tempest
 venv

The local requirements repo can be checked out to a stable branch,
in which case, the requirements might conflict with tempest's master
requirements.

Master branch's upper-constraints should be used when building tempest's
venv.

Closes-Bug: #1706009

Change-Id: Ifd64638cae2886671421149dbbff3a57f9c64257
---
 lib/tempest | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index bdbaaa5678..fc88f37e21 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -551,7 +551,10 @@ function configure_tempest {
     if [[ "$OFFLINE" != "True" ]]; then
         tox -revenv-tempest --notest
     fi
-    tox -evenv-tempest -- pip install -c $REQUIREMENTS_DIR/upper-constraints.txt -r requirements.txt
+
+    # The requirements might be on a different branch, while tempest needs master requirements.
+    git -C $REQUIREMENTS_DIR show master:upper-constraints.txt > u-c-m.txt
+    tox -evenv-tempest -- pip install -c u-c-m.txt -r requirements.txt
 
     # Auth:
     iniset $TEMPEST_CONFIG auth tempest_roles "Member"

From ad180e0e35d45ebe15840e02dbba835d864a2c58 Mon Sep 17 00:00:00 2001
From: Hongbin Lu <hongbin034@gmail.com>
Date: Wed, 29 Nov 2017 13:21:30 -0500
Subject: [PATCH 1194/2409] Install etcdctl along with etcd3

It is better to have this command line tool for debugging etcd.

Change-Id: Ie0eb79d4e543df29ce6a38b57c8ef57a5d2211b4
---
 lib/etcd3 | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/etcd3 b/lib/etcd3
index 51df8e4c1e..d3f72264b0 100644
--- a/lib/etcd3
+++ b/lib/etcd3
@@ -107,9 +107,11 @@ function install_etcd3 {
 
         tar xzvf $etcd_file -C $FILES
         sudo cp $FILES/$ETCD_NAME/etcd $ETCD_BIN_DIR/etcd
+        sudo cp $FILES/$ETCD_NAME/etcdctl $ETCD_BIN_DIR/etcdctl
     fi
     if [ ! -f "$ETCD_BIN_DIR/etcd" ]; then
         sudo cp $FILES/$ETCD_NAME/etcd $ETCD_BIN_DIR/etcd
+        sudo cp $FILES/$ETCD_NAME/etcdctl $ETCD_BIN_DIR/etcdctl
     fi
 }
 

From 27367bea48a14ce991f6e60400d61ab2aa11532b Mon Sep 17 00:00:00 2001
From: Davanum Srinivas <davanum@gmail.com>
Date: Tue, 28 Nov 2017 08:20:48 -0500
Subject: [PATCH 1195/2409] Allow overrides for ETCD ports

This will enable us to run one etcd for devstack and another
for kubernetes in the same box if necessary

Change-Id: Ib71ded24727b80afd4d98eb68bade0f8c0f72311
---
 lib/cinder | 2 +-
 lib/etcd3  | 9 ++++-----
 stackrc    | 2 ++
 3 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 07f82a1580..2851966bcf 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -327,7 +327,7 @@ function configure_cinder {
     if [[ ! -z "$CINDER_COORDINATION_URL" ]]; then
         iniset $CINDER_CONF coordination backend_url "$CINDER_COORDINATION_URL"
     elif is_service_enabled etcd3; then
-        iniset $CINDER_CONF coordination backend_url "etcd3+http://${SERVICE_HOST}:2379"
+        iniset $CINDER_CONF coordination backend_url "etcd3+http://${SERVICE_HOST}:$ETCD_PORT"
     fi
 }
 
diff --git a/lib/etcd3 b/lib/etcd3
index 51df8e4c1e..dc68524476 100644
--- a/lib/etcd3
+++ b/lib/etcd3
@@ -27,7 +27,6 @@ set +o xtrace
 ETCD_DATA_DIR="$DATA_DIR/etcd"
 ETCD_SYSTEMD_SERVICE="devstack@etcd.service"
 ETCD_BIN_DIR="$DEST/bin"
-ETCD_PORT=2379
 
 if is_ubuntu ; then
     UBUNTU_RELEASE_BASE_NUM=`lsb_release -r | awk '{print $2}' | cut -d '.' -f 1`
@@ -38,13 +37,13 @@ function start_etcd3 {
     local cmd="$ETCD_BIN_DIR/etcd"
     cmd+=" --name $HOSTNAME --data-dir $ETCD_DATA_DIR"
     cmd+=" --initial-cluster-state new --initial-cluster-token etcd-cluster-01"
-    cmd+=" --initial-cluster $HOSTNAME=http://$SERVICE_HOST:2380"
-    cmd+=" --initial-advertise-peer-urls http://$SERVICE_HOST:2380"
+    cmd+=" --initial-cluster $HOSTNAME=http://$SERVICE_HOST:$ETCD_PEER_PORT"
+    cmd+=" --initial-advertise-peer-urls http://$SERVICE_HOST:$ETCD_PEER_PORT"
     cmd+=" --advertise-client-urls http://$SERVICE_HOST:$ETCD_PORT"
     if [ "$SERVICE_LISTEN_ADDRESS" == "::" ]; then
-        cmd+=" --listen-peer-urls http://[::]:2380 "
+        cmd+=" --listen-peer-urls http://[::]:$ETCD_PEER_PORT "
     else
-        cmd+=" --listen-peer-urls http://0.0.0.0:2380 "
+        cmd+=" --listen-peer-urls http://0.0.0.0:$ETCD_PEER_PORT "
     fi
     cmd+=" --listen-client-urls http://$SERVICE_HOST:$ETCD_PORT"
 
diff --git a/stackrc b/stackrc
index ffe405012d..ed356ee237 100644
--- a/stackrc
+++ b/stackrc
@@ -748,6 +748,8 @@ elif is_arch "s390x"; then
 else
     exit_distro_not_supported "invalid hardware type - $ETCD_ARCH"
 fi
+ETCD_PORT=${ETCD_PORT:-2379}
+ETCD_PEER_PORT=${ETCD_PEER_PORT:-2380}
 ETCD_DOWNLOAD_URL=${ETCD_DOWNLOAD_URL:-https://github.com/coreos/etcd/releases/download}
 ETCD_NAME=etcd-$ETCD_VERSION-linux-$ETCD_ARCH
 ETCD_DOWNLOAD_FILE=$ETCD_NAME.tar.gz

From 1d127849121974fe6c8161eabe5ebd7151fa4f4d Mon Sep 17 00:00:00 2001
From: Sean McGinnis <sean.mcginnis@huawei.com>
Date: Thu, 30 Nov 2017 14:15:04 -0600
Subject: [PATCH 1196/2409] Remove Cinder policy.json install

Cinder has now implemented "policy in code" and policy.json is
only needed for overriding default policies. The default policy.json
file has been removed in Cinder so we need to stop trying to copy
it during Cinder setup.

Change-Id: I364e401227fe43e2bacf8a799e10286ee445f835
---
 lib/cinder | 2 --
 1 file changed, 2 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 07f82a1580..01686f7ddf 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -206,8 +206,6 @@ function cleanup_cinder {
 function configure_cinder {
     sudo install -d -o $STACK_USER -m 755 $CINDER_CONF_DIR
 
-    cp -p $CINDER_DIR/etc/cinder/policy.json $CINDER_CONF_DIR
-
     rm -f $CINDER_CONF
 
     configure_rootwrap cinder

From 9ef3e8448580e9d166e1a4669a036da0205243b5 Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Sun, 3 Dec 2017 10:11:12 -0600
Subject: [PATCH 1197/2409] Add python-openstacksdk to python3 enabled list

It's perfectly with with python3, add it to the list.

Change-Id: Ieb9f563a2f95e78a994cef388e56a6d5a84c8935
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index ffe405012d..286a04d3fe 100644
--- a/stackrc
+++ b/stackrc
@@ -121,7 +121,7 @@ export USE_PYTHON3=$(trueorfalse False USE_PYTHON3)
 # base name of the directory from which they are installed. See
 # enable_python3_package to edit this variable and use_python3_for to
 # test membership.
-export ENABLED_PYTHON3_PACKAGES="nova,glance,cinder,uwsgi,python-openstackclient"
+export ENABLED_PYTHON3_PACKAGES="nova,glance,cinder,uwsgi,python-openstackclient,python-openstacksdk"
 
 # Explicitly list services not to run under Python 3. See
 # disable_python3_package to edit this variable.

From e46f22db7fcb6e9aae5922d650eda14a15231fb8 Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Sun, 3 Dec 2017 10:21:26 -0600
Subject: [PATCH 1198/2409] Add workaround for openstacksdk in
 check_libs_from_git

python-openstacksdk does not match its pip name which is openstacksdk.
So setting python-openstacksdk in LIBS_FROM_GIT leads to devstack
thinking there is a problem.

Put in a workaround for now. It would be better to either:

  a) rename python-openstacksdk repo to openstacksdk
  b) rename the pip name for openstacksdk back to python-openstacksdk
  c) add general support in the various GIT hashes for a pip name

Change-Id: I57cf95763d54ad2060a4ce2af91c3ba18ca04db0
---
 inc/python | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/inc/python b/inc/python
index 9938f98545..2e4eff02ea 100644
--- a/inc/python
+++ b/inc/python
@@ -407,6 +407,12 @@ function use_library_from_git {
 function lib_installed_from_git {
     local name=$1
     local safe_name
+    # TODO(mordred) This is a special case for python-openstacksdk, where the
+    # repo name and the pip name do not match. We should either add systemic
+    # support for providing aliases, or we should rename the git repo.
+    if [[ $name == 'python-openstacksdk' ]] ; then
+        name=openstacksdk
+    fi
     safe_name=$(python -c "from pkg_resources import safe_name; \
         print(safe_name('${name}'))")
     # Note "pip freeze" doesn't always work here, because it tries to

From cb8256f22531b59470703ca4090064cba4a0b55e Mon Sep 17 00:00:00 2001
From: lkuchlan <lkuchlan@redhat.com>
Date: Wed, 30 Aug 2017 07:36:11 +0300
Subject: [PATCH 1199/2409] Add fixed_key parameter under key_manager section
 in cinder conf

This change is necessary for uploading an encrypted volume to glance.

Change-Id: I0975fc0c49ec243025d076f0406e28c4f5522d3a
---
 lib/cinder | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/cinder b/lib/cinder
index 07f82a1580..a966a4b28e 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -244,6 +244,7 @@ function configure_cinder {
     iniset $CINDER_CONF DEFAULT my_ip "$HOST_IP"
 
     iniset $CINDER_CONF key_manager backend cinder.keymgr.conf_key_mgr.ConfKeyManager
+    iniset $CINDER_CONF key_manager fixed_key $(openssl rand -hex 16)
 
     if is_service_enabled c-vol && [[ -n "$CINDER_ENABLED_BACKENDS" ]]; then
         local enabled_backends=""

From 5551170ad3902de9c3f271122821a9822658ad50 Mon Sep 17 00:00:00 2001
From: "Andrea Frittoli (andreaf)" <andrea.frittoli@gmail.com>
Date: Thu, 30 Nov 2017 15:49:39 +0000
Subject: [PATCH 1200/2409] Allow jobs to disable all services

Several legacy jobs use the OVERRIDE_ENABLED_SERVICES variable
from d-g so set the list of services that should be enabled and
ignore the default set calculated via the feature matrix.

Add support for a similar functionality in the zuulv3 jobs
using the 'disable_all_services' localconf function.

Change-Id: I690554ec62cef3be600054071efbb3f92a99249e
---
 roles/write-devstack-local-conf/README.rst                 | 7 ++++++-
 .../library/devstack_local_conf.py                         | 3 +++
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/roles/write-devstack-local-conf/README.rst b/roles/write-devstack-local-conf/README.rst
index e30dfa1e9f..1b7eb1b4c0 100644
--- a/roles/write-devstack-local-conf/README.rst
+++ b/roles/write-devstack-local-conf/README.rst
@@ -53,7 +53,12 @@ Write the local.conf file for use by devstack
    A dictionary mapping service names to boolean values.  If the
    boolean value is ``false``, a ``disable_service`` line will be
    emitted for the service name.  If it is ``true``, then
-   ``enable_service`` will be emitted.  All other values are ignored.
+   ``enable_service`` will be emitted. All other values are ignored.
+   The special key ``base`` can be used to enable or disable the base set of
+   services enabled by default. If ``base`` is found, it will processed before
+   all other keys. If its value is ``False`` a ``disable_all_services`` will be
+   emitted; if its value is ``True`` nothing will be emitted since base
+   services are enabled by default.
 
 .. zuul:rolevar:: devstack_plugins
    :type: dict
diff --git a/roles/write-devstack-local-conf/library/devstack_local_conf.py b/roles/write-devstack-local-conf/library/devstack_local_conf.py
index 4134beb048..dbd60f52b9 100644
--- a/roles/write-devstack-local-conf/library/devstack_local_conf.py
+++ b/roles/write-devstack-local-conf/library/devstack_local_conf.py
@@ -124,6 +124,9 @@ def handle_plugins(self, plugins):
                 self.localrc.append('enable_plugin {} {}'.format(k, v))
 
     def handle_services(self, services):
+        base_services = services.pop('base', True)
+        if not base_services:
+            self.localrc.append('disable_all_services')
         for k, v in services.items():
             if v is False:
                 self.localrc.append('disable_service {}'.format(k))

From 1489b9e7101fef6270eea008917b08f3da91a771 Mon Sep 17 00:00:00 2001
From: Chris Dent <cdent@anticdent.org>
Date: Tue, 5 Dec 2017 23:46:58 +0000
Subject: [PATCH 1201/2409] Move remove_uwsgi_config to cleanup_placement

It had been in stop_placement, but we don't want it there: the old
side of grenade needs to call that but should not remove the uwsgi
configuration when doing so. It is configuration, after all.

Change-Id: Iee763adf7895145d97b184924896db3f1f48a015
Partial-Bug: #1736385
---
 lib/placement | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/placement b/lib/placement
index d3fb8c848d..1875857552 100644
--- a/lib/placement
+++ b/lib/placement
@@ -71,6 +71,7 @@ function is_placement_enabled {
 function cleanup_placement {
     sudo rm -f $(apache_site_config_for nova-placement-api)
     sudo rm -f $(apache_site_config_for placement-api)
+    remove_uwsgi_config "$PLACEMENT_UWSGI_CONF" "$PLACEMENT_UWSGI"
 }
 
 # _config_placement_apache_wsgi() - Set WSGI config files
@@ -188,7 +189,6 @@ function start_placement {
 function stop_placement {
     if [[ "$WSGI_MODE" == "uwsgi" ]]; then
         stop_process "placement-api"
-        remove_uwsgi_config "$PLACEMENT_UWSGI_CONF" "$PLACEMENT_UWSGI"
     else
         disable_apache_site placement-api
         restart_apache_server

From 7d4446541d6265491999efc536bc88520beadace Mon Sep 17 00:00:00 2001
From: "Andrea Frittoli (andreaf)" <andrea.frittoli@gmail.com>
Date: Fri, 1 Dec 2017 17:36:38 +0000
Subject: [PATCH 1202/2409] Set the base set of services

Use the test-matrix role from devstack-gate to define a base set of
services to be enabled for the controller and compute nodes.

Extend the local conf module to handle the base set of services.

Since the test-matrix defines services for primary and subnode nodes, we
need a multinode job to test that this works. Add a new host group
called subnode that includes the non-controller hosts. Add a new job
that runs devstack on a two nodes environment.

Using service from the test matrix enables swift in the gate, so we need
to set SWIFT_HASH for devstack to work.

Depends-on: Ie36ba0cd7cfcd450b75000a76a64d856f2a83eba
Depends-on: Id9ad3be4be25e699f77d6b5a252f046ce8234f45
Change-Id: I379abf482c89122533324e64fefbff3d5a618a89
---
 .zuul.yaml                                      | 16 ++++++++++++++++
 playbooks/pre.yaml                              | 12 +++++++++++-
 roles/write-devstack-local-conf/README.rst      | 13 +++++++++++--
 .../defaults/main.yaml                          |  1 +
 .../library/devstack_local_conf.py              | 17 +++++++++++------
 roles/write-devstack-local-conf/tasks/main.yaml |  1 +
 6 files changed, 51 insertions(+), 9 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 710b229d5b..b9ffb34622 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -23,6 +23,9 @@
         nodes:
           - controller
           - compute1
+      - name: subnode
+        nodes:
+          - compute1
 
 - job:
     name: devstack
@@ -39,9 +42,11 @@
       - openstack/requirements
       - openstack/swift
     roles:
+      - zuul: openstack-infra/devstack-gate
       - zuul: openstack-infra/openstack-zuul-jobs
     timeout: 7200
     vars:
+      test_matrix_configs: ['neutron', 'tlsproxy']
       devstack_localrc:
         DATABASE_PASSWORD: secretdatabase
         RABBIT_PASSWORD: secretrabbit
@@ -57,6 +62,7 @@
         FLOATING_HOST_MASK: 23
         SWIFT_REPLICAS: 1
         SWIFT_START_ALL_SERVICES: false
+        SWIFT_HASH: 1234123412341234
         LOGFILE: /opt/stack/logs/devstacklog.txt
         LOG_COLOR: false
         VERBOSE: true
@@ -75,9 +81,19 @@
     run: playbooks/devstack.yaml
     post-run: playbooks/post.yaml
 
+- job:
+    name: devstack-multinode
+    parent: devstack
+    description: Base devstack multinode job
+    nodeset: openstack-two-node
+    # NOTE(andreaf) The multinode job is useful to see the setup of different
+    # services on different nodes, however the subnode configuration is not
+    # ready yet. Until then this job should stay non-voting.
+    voting: false
 
 - project:
     name: openstack-dev/devstack
     check:
       jobs:
         - devstack
+        - devstack-multinode
diff --git a/playbooks/pre.yaml b/playbooks/pre.yaml
index 4d07960fe8..d61fd45de0 100644
--- a/playbooks/pre.yaml
+++ b/playbooks/pre.yaml
@@ -1,3 +1,13 @@
+- hosts: controller
+  roles:
+    - role: test-matrix
+      test_matrix_role: primary 
+
+- hosts: subnode
+  roles:
+    - role: test-matrix
+      test_matrix_role: subnode
+
 - hosts: all
   roles:
     - configure-swap
@@ -8,7 +18,7 @@
     - setup-devstack-cache
     - start-fresh-logging
     - write-devstack-local-conf
-  # TODO(jeblair): remove when configure-mirrors is fixed  
+  # TODO(jeblair): remove when configure-mirrors is fixed
   tasks:
     - name: Hack mirror_info
       shell:
diff --git a/roles/write-devstack-local-conf/README.rst b/roles/write-devstack-local-conf/README.rst
index 1b7eb1b4c0..73f9f0d6fd 100644
--- a/roles/write-devstack-local-conf/README.rst
+++ b/roles/write-devstack-local-conf/README.rst
@@ -47,6 +47,14 @@ Write the local.conf file for use by devstack
             This is a dictionary of key-value pairs which comprise
             this section of the INI file.
 
+.. zuul:rolevar:: devstack_base_services
+   :type: list
+   :default: {{ base_services | default(omit) }}
+
+   A list of base services which are enabled. Services can be added or removed
+   from this list via the ``devstack_services`` variable. This is ignored if
+   ``base`` is set to ``False`` in ``devstack_services``.
+
 .. zuul:rolevar:: devstack_services
    :type: dict
 
@@ -54,11 +62,12 @@ Write the local.conf file for use by devstack
    boolean value is ``false``, a ``disable_service`` line will be
    emitted for the service name.  If it is ``true``, then
    ``enable_service`` will be emitted. All other values are ignored.
+
    The special key ``base`` can be used to enable or disable the base set of
    services enabled by default. If ``base`` is found, it will processed before
    all other keys. If its value is ``False`` a ``disable_all_services`` will be
-   emitted; if its value is ``True`` nothing will be emitted since base
-   services are enabled by default.
+   emitted; if its value is ``True`` services from ``devstack_base_services``
+   will be emitted via ``ENABLED_SERVICES``.
 
 .. zuul:rolevar:: devstack_plugins
    :type: dict
diff --git a/roles/write-devstack-local-conf/defaults/main.yaml b/roles/write-devstack-local-conf/defaults/main.yaml
index 491fa0fdb9..7bc1dec9b8 100644
--- a/roles/write-devstack-local-conf/defaults/main.yaml
+++ b/roles/write-devstack-local-conf/defaults/main.yaml
@@ -1,2 +1,3 @@
 devstack_base_dir: /opt/stack
 devstack_local_conf_path: "{{ devstack_base_dir }}/devstack/local.conf"
+devstack_base_services: "{{ enabled_services | default(omit) }}"
diff --git a/roles/write-devstack-local-conf/library/devstack_local_conf.py b/roles/write-devstack-local-conf/library/devstack_local_conf.py
index dbd60f52b9..55ba4afb69 100644
--- a/roles/write-devstack-local-conf/library/devstack_local_conf.py
+++ b/roles/write-devstack-local-conf/library/devstack_local_conf.py
@@ -106,13 +106,13 @@ def _getParentVarNamesRecursively(self, dependent_var, soft=False):
 
 class LocalConf(object):
 
-    def __init__(self, localrc, localconf, services, plugins):
+    def __init__(self, localrc, localconf, base_services, services, plugins):
         self.localrc = []
         self.meta_sections = {}
         if plugins:
             self.handle_plugins(plugins)
-        if services:
-            self.handle_services(services)
+        if services or base_services:
+            self.handle_services(base_services, services or {})
         if localrc:
             self.handle_localrc(localrc)
         if localconf:
@@ -123,9 +123,12 @@ def handle_plugins(self, plugins):
             if v:
                 self.localrc.append('enable_plugin {} {}'.format(k, v))
 
-    def handle_services(self, services):
-        base_services = services.pop('base', True)
-        if not base_services:
+    def handle_services(self, base_services, services):
+        enable_base_services = services.pop('base', True)
+        if enable_base_services and base_services:
+            self.localrc.append('ENABLED_SERVICES={}'.format(
+                ",".join(base_services)))
+        else:
             self.localrc.append('disable_all_services')
         for k, v in services.items():
             if v is False:
@@ -164,6 +167,7 @@ def main():
     module = AnsibleModule(
         argument_spec=dict(
             plugins=dict(type='dict'),
+            base_services=dict(type='list'),
             services=dict(type='dict'),
             localrc=dict(type='dict'),
             local_conf=dict(type='dict'),
@@ -174,6 +178,7 @@ def main():
     p = module.params
     lc = LocalConf(p.get('localrc'),
                    p.get('local_conf'),
+                   p.get('base_services'),
                    p.get('services'),
                    p.get('plugins'))
     lc.write(p['path'])
diff --git a/roles/write-devstack-local-conf/tasks/main.yaml b/roles/write-devstack-local-conf/tasks/main.yaml
index 1d67616dd4..cc21426b89 100644
--- a/roles/write-devstack-local-conf/tasks/main.yaml
+++ b/roles/write-devstack-local-conf/tasks/main.yaml
@@ -4,6 +4,7 @@
   devstack_local_conf:
     path: "{{ devstack_local_conf_path }}"
     plugins: "{{ devstack_plugins|default(omit) }}"
+    base_services: "{{ devstack_base_services|default(omit) }}"
     services: "{{ devstack_services|default(omit) }}"
     localrc: "{{ devstack_localrc|default(omit) }}"
     local_conf: "{{ devstack_local_conf|default(omit) }}"

From 986cd13a21d34886688a1f22c6dc4a5ba8bfc6d2 Mon Sep 17 00:00:00 2001
From: Dean Troyer <dtroyer@gmail.com>
Date: Wed, 25 Oct 2017 16:05:46 -0500
Subject: [PATCH 1203/2409] Collect devstack config files in post.

Co-Authored-By: yong sheng gong <gong.yongsheng@99cloud.net>
Co-Authored-By: Dean Troyer <dtroyer@gmail.com>
Co-Authored-By: Andrea Frittoli <andrea.frittoli@gmail.com>

Change-Id: Id9ad3be4be25e699f77d6b5a252f046ce8234f45
---
 playbooks/post.yaml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/playbooks/post.yaml b/playbooks/post.yaml
index 6f5126ff16..95c366975c 100644
--- a/playbooks/post.yaml
+++ b/playbooks/post.yaml
@@ -1,4 +1,14 @@
 - hosts: all
+  become: True
+  vars:
+    devstack_conf_dir: "{{ devstack_base_dir|default('/opt/stack') }}/devstack/"
+    stage_dir: "{{ devstack_base_dir|default('/opt/stack') }}"
   roles:
     - export-devstack-journal
+    - role: stage-output
+      zuul_copy_output:
+        { '{{ devstack_conf_dir }}/local.conf': 'logs',
+          '{{ devstack_conf_dir }}/.stackenv': 'logs' }
+      extensions_to_txt:
+        - conf
     - fetch-devstack-log-dir

From 52804403ca821abc887e616cba758c997b46386a Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Wed, 6 Dec 2017 09:11:07 -0600
Subject: [PATCH 1204/2409] Gate on v3 devstack job

The devstack base job in in use in many projects, but it is not being
gated here in devstack. Let's add it to the list so that we don't
accidentally break it.

Change-Id: Iea13235a8438d4b540f9f27b94aed13e719481dc
---
 .zuul.yaml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index b9ffb34622..7c53d45e94 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -97,3 +97,6 @@
       jobs:
         - devstack
         - devstack-multinode
+    gate:
+      jobs:
+        - devstack

From 501aaeb4e7ee07d4c52db987d748ac75dabcaaa6 Mon Sep 17 00:00:00 2001
From: Attila Fazekas <afazekas@redhat.com>
Date: Mon, 11 Dec 2017 12:01:32 +0100
Subject: [PATCH 1205/2409] lioadm make sure targetcli is there

Without installing the targetcli package
tools and configs can be missing.

The code was correct baside a typo,
it is `ISCSI` not `ICSI`

Change-Id: I32e5d84d87560458f0eaaf820dcd00c86e6dec8b
---
 lib/cinder | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/cinder b/lib/cinder
index a966a4b28e..7c5cefe018 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -430,7 +430,7 @@ function install_cinder {
     setup_develop $CINDER_DIR
     if [[ "$CINDER_ISCSI_HELPER" == "tgtadm" ]]; then
         install_package tgt
-    elif [[ "$CINDER_ISCI_HELPER" == "lioadm" ]]; then
+    elif [[ "$CINDER_ISCSI_HELPER" == "lioadm" ]]; then
         install_package targetcli
     fi
 }

From e1b0c3886ba5551d3fa8c79849d6a6406037c811 Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Wed, 6 Dec 2017 09:07:47 -0600
Subject: [PATCH 1206/2409] Add base jobs for functional tests

I keep copy-pasting these to projects from the shade repo. Let's make
some base jobs people can more easily use.

devstack-tox-functional runs devstack and a tox functional environment.

devstack-tox-functional-consumer is the same, but runs devstack in pre.
It's intended for projects for whom patches to the project won't
actually impact the devstack deployment (shade, nodepool, gophercloud
are all examples of such things)

Change-Id: I84de60181cb88574e341ff83cd4857cce241f2dd
---
 .zuul.yaml                  | 54 +++++++++++++++++++++++++++++++++++++
 playbooks/tox/post.yaml     |  5 ++++
 playbooks/tox/pre.yaml      |  8 ++++++
 playbooks/tox/run-both.yaml | 10 +++++++
 playbooks/tox/run.yaml      |  3 +++
 5 files changed, 80 insertions(+)
 create mode 100644 playbooks/tox/post.yaml
 create mode 100644 playbooks/tox/pre.yaml
 create mode 100644 playbooks/tox/run-both.yaml
 create mode 100644 playbooks/tox/run.yaml

diff --git a/.zuul.yaml b/.zuul.yaml
index 7c53d45e94..a699dbaa7d 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -91,6 +91,60 @@
     # ready yet. Until then this job should stay non-voting.
     voting: false
 
+- job:
+    name: devstack-tox-base
+    parent: devstack
+    description: |
+      Base job for devstack-based functional tests that use tox.
+
+      This job is not intended to be run directly. It's just here
+      for organizational purposes for devstack-tox-functional and
+      devstack-tox-functional-consumer.
+    post-run: playbooks/tox/post.yaml
+    vars:
+      tox_envlist: functional
+      tox_install_siblings: false
+
+- job:
+    name: devstack-tox-functional
+    parent: devstack-tox-base
+    description: |
+      Base job for devstack-based functional tests that use tox.
+
+      Runs devstack, then runs the tox ``functional`` environment,
+      then collects tox/testr build output like normal tox jobs.
+
+      Turns off tox sibling installation. Projects may be involved
+      in the devstack deployment and so may be in the required-projects
+      list, but may not want to test against master of the other
+      projects in their tox env. Child jobs can set tox_install_siblings
+      to True to re-enable sibling processing.
+    run: playbooks/tox/run-both.yaml
+
+- job:
+    name: devstack-tox-functional-consumer
+    parent: devstack
+    description: |
+      Base job for devstack-based functional tests for projects that
+      consume the devstack cloud.
+
+      This base job should only be used by projects that are not involved
+      in the devstack deployment step, but are instead projects that are using
+      devstack to get a cloud against which they can test things.
+
+      Runs devstack in pre-run, then runs the tox ``functional`` environment,
+      then collects tox/testr build output like normal tox jobs.
+
+      Turns off tox sibling installation. Projects may be involved
+      in the devstack deployment and so may be in the required-projects
+      list, but may not want to test against master of the other
+      projects in their tox env. Child jobs can set tox_install_siblings
+      to True to re-enable sibling processing.
+    pre-run:
+      - playbooks/devstack.yaml
+      - playbooks/tox/pre.yaml
+    run: playbooks/tox/run.yaml
+
 - project:
     name: openstack-dev/devstack
     check:
diff --git a/playbooks/tox/post.yaml b/playbooks/tox/post.yaml
new file mode 100644
index 0000000000..d9e299ff4d
--- /dev/null
+++ b/playbooks/tox/post.yaml
@@ -0,0 +1,5 @@
+- hosts: all
+  roles:
+    - fetch-tox-output
+    - fetch-testr-output
+    - fetch-stestr-output
diff --git a/playbooks/tox/pre.yaml b/playbooks/tox/pre.yaml
new file mode 100644
index 0000000000..d7e4670a80
--- /dev/null
+++ b/playbooks/tox/pre.yaml
@@ -0,0 +1,8 @@
+- hosts: all
+  roles:
+    # Run bindep and test-setup after devstack so that they won't interfere
+    - role: bindep
+      bindep_profile: test
+      bindep_dir: "{{ zuul_work_dir }}"
+    - test-setup
+    - ensure-tox
diff --git a/playbooks/tox/run-both.yaml b/playbooks/tox/run-both.yaml
new file mode 100644
index 0000000000..e85c2eee96
--- /dev/null
+++ b/playbooks/tox/run-both.yaml
@@ -0,0 +1,10 @@
+- hosts: all
+  roles:
+    - run-devstack
+    # Run bindep and test-setup after devstack so that they won't interfere
+    - role: bindep
+      bindep_profile: test
+      bindep_dir: "{{ zuul_work_dir }}"
+    - test-setup
+    - ensure-tox
+    - tox
diff --git a/playbooks/tox/run.yaml b/playbooks/tox/run.yaml
new file mode 100644
index 0000000000..22f82096c7
--- /dev/null
+++ b/playbooks/tox/run.yaml
@@ -0,0 +1,3 @@
+- hosts: all
+  roles:
+    - tox

From 44a19b4fdceb0d13190b26af04e5092873cd0866 Mon Sep 17 00:00:00 2001
From: Brian Rosmaita <rosmaita.fossdev@gmail.com>
Date: Mon, 11 Dec 2017 18:07:50 -0500
Subject: [PATCH 1207/2409] Clean up Glance config files

The current Glance config files are a combination of copied and
generated files.  This patch makes all the files generated and
removes now unnecssary ini(un)comment statements.  It additionally
removes some ini(un)comment statements that weren't having any
effect on the previously generated files.

Change-Id: I6e4b7694e8bebb7fe6661ead034ee257c768e342
---
 lib/glance | 18 +++---------------
 1 file changed, 3 insertions(+), 15 deletions(-)

diff --git a/lib/glance b/lib/glance
index ad286bacb9..aad4726145 100644
--- a/lib/glance
+++ b/lib/glance
@@ -110,11 +110,9 @@ function configure_glance {
     # Server is configured through this function and not init_glance.
     create_glance_cache_dir
 
-    # Copy over our glance configurations and update them
-    cp $GLANCE_DIR/etc/glance-registry.conf $GLANCE_REGISTRY_CONF
+    # Set non-default configuration options for registry
     iniset $GLANCE_REGISTRY_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
     iniset $GLANCE_REGISTRY_CONF DEFAULT bind_host $GLANCE_SERVICE_LISTEN_ADDRESS
-    inicomment $GLANCE_REGISTRY_CONF DEFAULT log_file
     local dburl
     dburl=`database_connection_url glance`
     iniset $GLANCE_REGISTRY_CONF database connection $dburl
@@ -125,8 +123,8 @@ function configure_glance {
     iniset_rpc_backend glance $GLANCE_REGISTRY_CONF
     iniset $GLANCE_REGISTRY_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
 
+    # Set non-default configuration options for the API server
     iniset $GLANCE_API_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-    inicomment $GLANCE_API_CONF DEFAULT log_file
     iniset $GLANCE_API_CONF database connection $dburl
     iniset $GLANCE_API_CONF DEFAULT use_syslog $SYSLOG
     iniset $GLANCE_API_CONF DEFAULT image_cache_dir $GLANCE_CACHE_DIR/
@@ -184,11 +182,6 @@ function configure_glance {
             iniset $GLANCE_SWIFT_STORE_CONF ref1 auth_address $KEYSTONE_SERVICE_URI/v3
         fi
         iniset $GLANCE_SWIFT_STORE_CONF ref1 auth_version 3
-
-        # commenting is not strictly necessary but it's confusing to have bad values in conf
-        inicomment $GLANCE_API_CONF glance_store swift_store_user
-        inicomment $GLANCE_API_CONF glance_store swift_store_key
-        inicomment $GLANCE_API_CONF glance_store swift_store_auth_address
     fi
 
     # We need to tell glance what it's public endpoint is so that the version
@@ -214,18 +207,13 @@ function configure_glance {
     cp -p $GLANCE_DIR/etc/glance-registry-paste.ini $GLANCE_REGISTRY_PASTE_INI
     cp -p $GLANCE_DIR/etc/glance-api-paste.ini $GLANCE_API_PASTE_INI
 
-    cp $GLANCE_DIR/etc/glance-cache.conf $GLANCE_CACHE_CONF
+    # Set non-default configuration options for the glance-cache
     iniset $GLANCE_CACHE_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-    inicomment $GLANCE_CACHE_CONF DEFAULT log_file
     iniset $GLANCE_CACHE_CONF DEFAULT use_syslog $SYSLOG
     iniset $GLANCE_CACHE_CONF DEFAULT image_cache_dir $GLANCE_CACHE_DIR/
-    iniuncomment $GLANCE_CACHE_CONF DEFAULT auth_url
     iniset $GLANCE_CACHE_CONF DEFAULT auth_url $KEYSTONE_AUTH_URI
-    iniuncomment $GLANCE_CACHE_CONF DEFAULT auth_tenant_name
     iniset $GLANCE_CACHE_CONF DEFAULT admin_tenant_name $SERVICE_PROJECT_NAME
-    iniuncomment $GLANCE_CACHE_CONF DEFAULT auth_user
     iniset $GLANCE_CACHE_CONF DEFAULT admin_user glance
-    iniuncomment $GLANCE_CACHE_CONF DEFAULT auth_password
     iniset $GLANCE_CACHE_CONF DEFAULT admin_password $SERVICE_PASSWORD
     iniset $GLANCE_CACHE_CONF DEFAULT registry_host $GLANCE_SERVICE_HOST
 

From 38a23d901aa1fd55dbe0d57718124c00d4f658cb Mon Sep 17 00:00:00 2001
From: liumk <liumk@rc.inesa.com>
Date: Wed, 13 Dec 2017 15:09:02 +0800
Subject: [PATCH 1208/2409] ceph plugin installation: umount correct device if
 it existed.

The loopback device is created for ceph osd. If the directory
${storage_data_dir} has been mounted when create disk, we should
umount ${storage_data_dir} instead of ${storage_data_dir}/drives/sdb1.

Change-Id: Ie9fe81c820c485dab9f049cf5a81c02424925728
Closes-Bug: #1689089
---
 functions | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions b/functions
index 20b83b3cd0..ee35723745 100644
--- a/functions
+++ b/functions
@@ -712,7 +712,7 @@ function create_disk {
     # Create a loopback disk and format it to XFS.
     if [[ -e ${disk_image} ]]; then
         if egrep -q ${storage_data_dir} /proc/mounts; then
-            sudo umount ${storage_data_dir}/drives/sdb1
+            sudo umount ${storage_data_dir}
             sudo rm -f ${disk_image}
         fi
     fi

From 7a8d850dcc31597d80ddecd4c4bbba3dd37914ce Mon Sep 17 00:00:00 2001
From: ghanshyam <ghanshyammann@gmail.com>
Date: Thu, 14 Dec 2017 09:16:56 +0000
Subject: [PATCH 1209/2409] Add variable to set volume service version on
 tempest

Tempest is going to test volume v3 APIs as default
in gate and running a separate job to run tests on v2 APIs.

To give this ability, this commit provide a var to tell
which API version need to be tested and accordingly it
configure the catalog_type and microversion setting on tempest.

Change-Id: I531f3b32e81ac5d282461597ca286c09429cb143
Needed-By: I0c9193501eb9eaa25eb5f0786bb72eb7855099fb
---
 lib/tempest | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index bdbaaa5678..c7dc19b311 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -422,6 +422,13 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG validation network_for_ssh $TEMPEST_SSH_NETWORK_NAME
 
     # Volume
+    # Set the service catalog entry for Tempest to run on. Typically
+    # used to try different Volume API version targets. The tempest
+    # default it to 'volumev3'(v3 APIs endpoint) , so only set this
+    # if you want to change it.
+    if [[ -n "$TEMPEST_VOLUME_TYPE" ]]; then
+        iniset $TEMPEST_CONFIG volume catalog_type $TEMPEST_VOLUME_TYPE
+    fi
     # Only turn on TEMPEST_VOLUME_MANAGE_SNAPSHOT by default for "lvm" backends
     if [[ "$CINDER_ENABLED_BACKENDS" == *"lvm"* ]]; then
         TEMPEST_VOLUME_MANAGE_SNAPSHOT=${TEMPEST_VOLUME_MANAGE_SNAPSHOT:-True}
@@ -443,6 +450,12 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG volume-feature-enabled api_v1 $(trueorfalse False TEMPEST_VOLUME_API_V1)
     local tempest_volume_min_microversion=${TEMPEST_VOLUME_MIN_MICROVERSION:-None}
     local tempest_volume_max_microversion=${TEMPEST_VOLUME_MAX_MICROVERSION:-"latest"}
+    # Reset microversions to None where v2 is running which does not support microversion.
+    # Both "None" means no microversion testing.
+    if [[ "$TEMPEST_VOLUME_TYPE" == "volumev2" ]]; then
+        tempest_volume_min_microversion=None
+        tempest_volume_max_microversion=None
+    fi
     if [ "$tempest_volume_min_microversion" == "None" ]; then
         inicomment $TEMPEST_CONFIG volume min_microversion
     else

From 4187d2fc4adbebf84e5d03e2f5c1c587b4bc9d04 Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Mon, 18 Dec 2017 11:11:03 -0600
Subject: [PATCH 1210/2409] Add doc/requirements.txt file with doc requirements

The sphinx jobs need to find doc requirements in either
test-requiremnts.txt or doc/requirements.txt. Putting them directly in
to tox.ini, not so much.

Change-Id: I98a43b511a6949fa4f00c26eec224d24d6fa6588
---
 doc/requirements.txt | 10 ++++++++++
 tox.ini              | 19 ++-----------------
 2 files changed, 12 insertions(+), 17 deletions(-)
 create mode 100644 doc/requirements.txt

diff --git a/doc/requirements.txt b/doc/requirements.txt
new file mode 100644
index 0000000000..e140bc0689
--- /dev/null
+++ b/doc/requirements.txt
@@ -0,0 +1,10 @@
+pbr>=2.0.0,!=2.1.0
+
+Pygments
+docutils
+sphinx>=1.6.2
+openstackdocstheme>=1.11.0
+nwdiag
+blockdiag
+sphinxcontrib-blockdiag
+sphinxcontrib-nwdiag
diff --git a/tox.ini b/tox.ini
index 46b15f4cb1..74436b0f26 100644
--- a/tox.ini
+++ b/tox.ini
@@ -34,16 +34,7 @@ commands = bash -c "find {toxinidir}             \
          -print0 | xargs -0 bashate -v -iE006 -eE005,E042"
 
 [testenv:docs]
-deps =
-   Pygments
-   docutils
-   sphinx>=1.6.2
-   pbr>=2.0.0,!=2.1.0
-   openstackdocstheme>=1.11.0
-   nwdiag
-   blockdiag
-   sphinxcontrib-blockdiag
-   sphinxcontrib-nwdiag
+deps = -r{toxinidir}/doc/requirements.txt
 whitelist_externals = bash
 setenv =
   TOP_DIR={toxinidir}
@@ -51,11 +42,5 @@ commands =
   python setup.py build_sphinx
 
 [testenv:venv]
-deps =
-   pbr>=2.0.0,!=2.1.0
-   sphinx>=1.6.2
-   openstackdocstheme>=1.11.0
-   blockdiag
-   sphinxcontrib-blockdiag
-   sphinxcontrib-nwdiag
+deps = -r{toxinidir}/doc/requirements.txt
 commands = {posargs}

From 290d9d87f4e8048078a83c19d056db0c320e1c63 Mon Sep 17 00:00:00 2001
From: "Andrea Frittoli (andreaf)" <andrea.frittoli@gmail.com>
Date: Mon, 11 Dec 2017 14:30:59 +0000
Subject: [PATCH 1211/2409] Use stage_dir instead of /opt/stack

Historically we have collected devstack logs under /opt/stack.
Stop doing that and collect them in the stage_dir instead, so that
once the base job logs pull service comes around we are ready for it.

This add the benefit of writing things into a folder which is
already owned by the ansible user (ansible_user_dir), so we don't
run into issue writing there.

A few logs (devstack log, log summary and dstat) use to show up on
logs.o.o. just because they happened to already be in /opt/stack/logs.
With this change they would be lost, so adding them to post.yaml.

Depends-on: I5ad4dfccbc1389da3afc53f3c866d3475e006db6

Change-Id: Ib4be2f5056c0dc2b776de4a0d18b47b12624be92
---
 playbooks/post.yaml                              | 16 +++++++++++++---
 roles/apache-logs-conf/README.rst                | 12 ++++++++++++
 roles/export-devstack-journal/README.rst         | 10 ++++++++--
 roles/export-devstack-journal/defaults/main.yaml |  1 +
 roles/export-devstack-journal/tasks/main.yaml    | 14 +++++++++++---
 5 files changed, 45 insertions(+), 8 deletions(-)
 create mode 100644 roles/apache-logs-conf/README.rst

diff --git a/playbooks/post.yaml b/playbooks/post.yaml
index 95c366975c..aaa5cdd5ae 100644
--- a/playbooks/post.yaml
+++ b/playbooks/post.yaml
@@ -1,14 +1,24 @@
 - hosts: all
   become: True
   vars:
+    devstack_log_dir: "{{ devstack_base_dir|default('/opt/stack') }}/logs/"
     devstack_conf_dir: "{{ devstack_base_dir|default('/opt/stack') }}/devstack/"
-    stage_dir: "{{ devstack_base_dir|default('/opt/stack') }}"
   roles:
     - export-devstack-journal
     - role: stage-output
       zuul_copy_output:
         { '{{ devstack_conf_dir }}/local.conf': 'logs',
-          '{{ devstack_conf_dir }}/.stackenv': 'logs' }
+          '{{ devstack_conf_dir }}/.stackenv': 'logs' ,
+          '{{ devstack_log_dir }}/dstat-csv.log': 'logs',
+          '{{ devstack_log_dir }}/devstacklog.txt': 'logs',
+          '{{ devstack_log_dir }}/devstacklog.txt.summary': 'logs' }
       extensions_to_txt:
         - conf
-    - fetch-devstack-log-dir
+        - log
+        - summary
+    # NOTE(andreaf) We need fetch-devstack-log-dir only as long as the base job
+    # starts pulling logs for us from {{ ansible_user_dir }}/logs.
+    # Meanwhile we already store things in ansible_user_dir and use
+    # fetch-devstack-log-dir setting devstack_base_dir
+    - role: fetch-devstack-log-dir
+      devstack_base_dir: "{{ ansible_user_dir }}"
diff --git a/roles/apache-logs-conf/README.rst b/roles/apache-logs-conf/README.rst
new file mode 100644
index 0000000000..eccee403a5
--- /dev/null
+++ b/roles/apache-logs-conf/README.rst
@@ -0,0 +1,12 @@
+Prepare apache configs and logs for staging
+
+Make sure apache config files and log files are available in a linux flavor
+independent location. Note that this relies on hard links, to the staging
+directory must be in the same partition where the logs and configs are.
+
+**Role Variables**
+
+.. zuul:rolevar:: stage_dir
+   :default: {{ ansible_user_dir }}
+
+   The base stage directory.
diff --git a/roles/export-devstack-journal/README.rst b/roles/export-devstack-journal/README.rst
index 5f00592a03..a34e0706a9 100644
--- a/roles/export-devstack-journal/README.rst
+++ b/roles/export-devstack-journal/README.rst
@@ -5,11 +5,17 @@ journal format as well as text.  Also, export a syslog-style file with
 kernal and sudo messages.
 
 Writes the output to the ``logs/`` subdirectory of
-``devstack_base_dir``.
+``stage_dir``.
 
 **Role Variables**
 
 .. zuul:rolevar:: devstack_base_dir
    :default: /opt/stack
 
-   The devstack base directory.
+   The devstack base directory. This is used to obtain the
+   ``log-start-timestamp.txt``, used to filter the systemd journal.
+
+.. zuul:rolevar:: stage_dir
+   :default: {{ ansible_user_dir }}
+
+   The base stage directory.
diff --git a/roles/export-devstack-journal/defaults/main.yaml b/roles/export-devstack-journal/defaults/main.yaml
index fea05c8146..1fb04fedc8 100644
--- a/roles/export-devstack-journal/defaults/main.yaml
+++ b/roles/export-devstack-journal/defaults/main.yaml
@@ -1 +1,2 @@
 devstack_base_dir: /opt/stack
+stage_dir: "{{ ansible_user_dir }}"
diff --git a/roles/export-devstack-journal/tasks/main.yaml b/roles/export-devstack-journal/tasks/main.yaml
index b9af02a591..3efa5755b2 100644
--- a/roles/export-devstack-journal/tasks/main.yaml
+++ b/roles/export-devstack-journal/tasks/main.yaml
@@ -1,3 +1,11 @@
+# NOTE(andreaf) This bypasses the stage-output role
+- name: Ensure {{ stage_dir }}/logs exists
+  become: true
+  file:
+    path: "{{ stage_dir }}/logs"
+    state: directory
+    owner: "{{ ansible_user }}"
+
 # TODO: convert this to ansible
 - name: Export journal files
   become: true
@@ -7,7 +15,7 @@
       name=""
       for u in `systemctl list-unit-files | grep devstack | awk '{print $1}'`; do
         name=$(echo $u | sed 's/devstack@/screen-/' | sed 's/\.service//')
-        journalctl -o short-precise --unit $u | tee {{ devstack_base_dir }}/logs/$name.txt > /dev/null
+        journalctl -o short-precise --unit $u | tee {{ stage_dir }}/logs/$name.txt > /dev/null
       done
 
       # Export the journal in export format to make it downloadable
@@ -16,7 +24,7 @@
       # debugging much easier. We don't do the native conversion here as
       # some distros do not package that tooling.
       journalctl -u 'devstack@*' -o export | \
-          xz --threads=0 - > {{ devstack_base_dir }}/logs/devstack.journal.xz
+          xz --threads=0 - > {{ stage_dir }}/logs/devstack.journal.xz
 
       # The journal contains everything running under systemd, we'll
       # build an old school version of the syslog with just the
@@ -26,4 +34,4 @@
           -t sudo \
           --no-pager \
           --since="$(cat {{ devstack_base_dir }}/log-start-timestamp.txt)" \
-        | tee {{ devstack_base_dir }}/logs/syslog.txt > /dev/null
+        | tee {{ stage_dir }}/logs/syslog.txt > /dev/null

From 71bf831a906a02c9801500bcabd4ee2b9c773f22 Mon Sep 17 00:00:00 2001
From: "Andrea Frittoli (andreaf)" <andrea.frittoli@gmail.com>
Date: Thu, 14 Dec 2017 20:35:38 +0000
Subject: [PATCH 1212/2409] Add a few more devstack confs and logs

Add localrc for places where it may be still used.
Collect verify_tempest_conf.

Change-Id: I733c6472e8452ed6fc04c6de1c170713812a436f
---
 playbooks/post.yaml | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/playbooks/post.yaml b/playbooks/post.yaml
index aaa5cdd5ae..f5f189ddc5 100644
--- a/playbooks/post.yaml
+++ b/playbooks/post.yaml
@@ -3,18 +3,34 @@
   vars:
     devstack_log_dir: "{{ devstack_base_dir|default('/opt/stack') }}/logs/"
     devstack_conf_dir: "{{ devstack_base_dir|default('/opt/stack') }}/devstack/"
+  tasks:
+    # NOTE(andreaf) If the tempest service is enabled, a tempest.log is
+    # generated as part of lib/tempest, as a result of verify_tempest_config
+    - name: Check if a tempest log exits
+      stat:
+        path: "{{ devstack_conf_dir }}/tempest.log"
+      register: tempest_log
+    - name: Link post-devstack tempest.log
+      file:
+        src: "{{ devstack_conf_dir }}/tempest.log"
+        dest: "{{ stage_dir }}/verify_tempest_conf.log"
+        state: hard
+      when: tempest_log.stat.exists
   roles:
     - export-devstack-journal
     - role: stage-output
       zuul_copy_output:
         { '{{ devstack_conf_dir }}/local.conf': 'logs',
+          '{{ devstack_conf_dir }}/localrc': 'logs',
           '{{ devstack_conf_dir }}/.stackenv': 'logs' ,
           '{{ devstack_log_dir }}/dstat-csv.log': 'logs',
           '{{ devstack_log_dir }}/devstacklog.txt': 'logs',
-          '{{ devstack_log_dir }}/devstacklog.txt.summary': 'logs' }
+          '{{ devstack_log_dir }}/devstacklog.txt.summary': 'logs',
+          '{{ stage_dir }}/verify_tempest_conf.log': 'logs' }
       extensions_to_txt:
         - conf
         - log
+        - localrc
         - summary
     # NOTE(andreaf) We need fetch-devstack-log-dir only as long as the base job
     # starts pulling logs for us from {{ ansible_user_dir }}/logs.

From b7f8624bed8aabf52a0fbb5ac73a9fdd41400273 Mon Sep 17 00:00:00 2001
From: "Andrea Frittoli (andreaf)" <andrea.frittoli@gmail.com>
Date: Thu, 14 Dec 2017 16:08:51 +0000
Subject: [PATCH 1213/2409] Setup devstack-early log

The whole devstack log is written into the console output
(job-output.txt) and into devstacklog.txt.

Remove it from job-output and add a devstack-early log file (same as in
legacy job) that includes all the output of stack.sh.

Make sure the log file is pulled into the stage folder so that it will
end up on logs.o.o.

Change-Id: Ia7c1d8fe5cc03d15f455c6e62ebf4a5f6d62ab1f
---
 playbooks/post.yaml                   | 2 ++
 roles/run-devstack/README.rst         | 6 ++++++
 roles/run-devstack/defaults/main.yaml | 1 +
 roles/run-devstack/tasks/main.yaml    | 2 +-
 4 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/playbooks/post.yaml b/playbooks/post.yaml
index f5f189ddc5..d99ec10bfe 100644
--- a/playbooks/post.yaml
+++ b/playbooks/post.yaml
@@ -3,6 +3,7 @@
   vars:
     devstack_log_dir: "{{ devstack_base_dir|default('/opt/stack') }}/logs/"
     devstack_conf_dir: "{{ devstack_base_dir|default('/opt/stack') }}/devstack/"
+    devstack_full_log: "{{ devstack_early_log|default('/opt/stack/logs/devstack-early.txt') }}"
   tasks:
     # NOTE(andreaf) If the tempest service is enabled, a tempest.log is
     # generated as part of lib/tempest, as a result of verify_tempest_config
@@ -26,6 +27,7 @@
           '{{ devstack_log_dir }}/dstat-csv.log': 'logs',
           '{{ devstack_log_dir }}/devstacklog.txt': 'logs',
           '{{ devstack_log_dir }}/devstacklog.txt.summary': 'logs',
+          '{{ devstack_full_log}}': 'logs',
           '{{ stage_dir }}/verify_tempest_conf.log': 'logs' }
       extensions_to_txt:
         - conf
diff --git a/roles/run-devstack/README.rst b/roles/run-devstack/README.rst
index d77eb15e99..e53f060602 100644
--- a/roles/run-devstack/README.rst
+++ b/roles/run-devstack/README.rst
@@ -6,3 +6,9 @@ Run devstack
    :default: /opt/stack
 
    The devstack base directory.
+
+.. zuul:rolevar:: devstack_early_log
+   :default: /opt/stack/log/devstack-early.txt
+
+   The full devstack log that includes the whatever stack.sh logs before
+   the LOGFILE variable in local.conf is honoured.
diff --git a/roles/run-devstack/defaults/main.yaml b/roles/run-devstack/defaults/main.yaml
index fea05c8146..dc4528f692 100644
--- a/roles/run-devstack/defaults/main.yaml
+++ b/roles/run-devstack/defaults/main.yaml
@@ -1 +1,2 @@
 devstack_base_dir: /opt/stack
+devstack_early_log: /opt/stack/logs/devstack-early.txt
diff --git a/roles/run-devstack/tasks/main.yaml b/roles/run-devstack/tasks/main.yaml
index bafebafd65..f53212904a 100644
--- a/roles/run-devstack/tasks/main.yaml
+++ b/roles/run-devstack/tasks/main.yaml
@@ -1,5 +1,5 @@
 - name: Run devstack
-  command: ./stack.sh
+  shell: ./stack.sh 2>&1 {{ devstack_early_log }}
   args:
     chdir: "{{devstack_base_dir}}/devstack"
   become: true

From 9c977b56eb74944b45b0f0513ac36347b526c096 Mon Sep 17 00:00:00 2001
From: "Andrea Frittoli (andreaf)" <andrea.frittoli@gmail.com>
Date: Fri, 8 Dec 2017 17:41:40 +0000
Subject: [PATCH 1214/2409] Stage apache logs

Add apache logs to the list of things we stage.

Change-Id: I9d3d8e710ae87a71b74f96538cad6fad58dbef79
---
 playbooks/post.yaml                       |  5 +-
 roles/apache-logs-conf/defaults/main.yaml |  2 +
 roles/apache-logs-conf/tasks/main.yaml    | 80 +++++++++++++++++++++++
 3 files changed, 86 insertions(+), 1 deletion(-)
 create mode 100644 roles/apache-logs-conf/defaults/main.yaml
 create mode 100644 roles/apache-logs-conf/tasks/main.yaml

diff --git a/playbooks/post.yaml b/playbooks/post.yaml
index d99ec10bfe..40c39beb69 100644
--- a/playbooks/post.yaml
+++ b/playbooks/post.yaml
@@ -19,6 +19,7 @@
       when: tempest_log.stat.exists
   roles:
     - export-devstack-journal
+    - apache-logs-conf
     - role: stage-output
       zuul_copy_output:
         { '{{ devstack_conf_dir }}/local.conf': 'logs',
@@ -28,7 +29,9 @@
           '{{ devstack_log_dir }}/devstacklog.txt': 'logs',
           '{{ devstack_log_dir }}/devstacklog.txt.summary': 'logs',
           '{{ devstack_full_log}}': 'logs',
-          '{{ stage_dir }}/verify_tempest_conf.log': 'logs' }
+          '{{ stage_dir }}/verify_tempest_conf.log': 'logs',
+          '{{ stage_dir }}/apache': 'logs',
+          '{{ stage_dir }}/apache_config': 'logs' }
       extensions_to_txt:
         - conf
         - log
diff --git a/roles/apache-logs-conf/defaults/main.yaml b/roles/apache-logs-conf/defaults/main.yaml
new file mode 100644
index 0000000000..1fb04fedc8
--- /dev/null
+++ b/roles/apache-logs-conf/defaults/main.yaml
@@ -0,0 +1,2 @@
+devstack_base_dir: /opt/stack
+stage_dir: "{{ ansible_user_dir }}"
diff --git a/roles/apache-logs-conf/tasks/main.yaml b/roles/apache-logs-conf/tasks/main.yaml
new file mode 100644
index 0000000000..7fd490ea4c
--- /dev/null
+++ b/roles/apache-logs-conf/tasks/main.yaml
@@ -0,0 +1,80 @@
+- name: Ensure {{ stage_dir }}/apache exists
+  file:
+    path: "{{ stage_dir }}/apache"
+    state: directory
+
+- name: Link apache logs on Debian/SuSE
+  block:
+  - name: Find logs
+    find:
+      path: "/var/log/apache2"
+      file_type: any
+    register: debian_suse_apache_logs
+  - name: Dereference files
+    stat:
+      path: "{{ item.path }}"
+    with_items: "{{ debian_suse_apache_logs.files }}"
+    register: debian_suse_apache_deref_logs
+  - name: Create hard links
+    file:
+      src: "{{ item.stat.lnk_source | default(item.stat.path) }}"
+      dest: "{{ stage_dir }}/apache/{{ item.stat.path | basename }}"
+      state: hard
+    with_items: "{{ debian_suse_apache_deref_logs.results }}"
+    when:
+      - item.stat.isreg or item.stat.islnk
+  when: ansible_os_family in ('Debian', 'Suse')
+
+- name: Link apache logs on RedHat
+  block:
+  - name: Find logs
+    find:
+      path: "/var/log/httpd"
+      file_type: any
+    register: redhat_apache_logs
+  - name: Dereference files
+    stat:
+      path: "{{ item.path }}"
+    with_items: "{{ redhat_apache_logs.files }}"
+    register: redhat_apache_deref_logs
+  - name: Create hard links
+    file:
+      src: "{{ item.stat.lnk_source | default(item.stat.path) }}"
+      dest: "{{ stage_dir }}/apache/{{ item.stat.path | basename }}"
+      state: hard
+    with_items: "{{ redhat_apache_deref_logs.results }}"
+    when:
+      - item.stat.isreg or item.stat.islnk
+  when: ansible_os_family == 'Redhat'
+
+- name: Ensure {{ stage_dir }}/apache_config apache_config exists
+  file:
+    path: "{{ stage_dir }}/apache_config"
+    state: directory
+
+- name: Define config paths
+  set_fact:
+    apache_config_paths:
+      'Debian': '/etc/apache2/sites-enabled/'
+      'Suse': '/etc/apache2/conf.d/'
+      'Redhat': '/etc/httpd/conf.d/'
+
+- name: Discover configurations
+  find:
+    path: "{{ apache_config_paths[ansible_os_family] }}"
+    file_type: any
+  register: apache_configs
+
+- name: Dereference configurations
+  stat:
+    path: "{{ item.path }}"
+  with_items: "{{ apache_configs.files }}"
+  register: apache_configs_deref
+
+- name: Link configurations
+  file:
+    src: "{{ item.stat.lnk_source | default(item.stat.path) }}"
+    dest: "{{ stage_dir }}/apache_config/{{ item.stat.path | basename }}"
+    state: hard
+  with_items: "{{ apache_configs_deref.results }}"
+  when: item.stat.isreg or item.stat.islnk

From d04658eb50d7e1f59625039deaef17208a0c9eb9 Mon Sep 17 00:00:00 2001
From: "Andrea Frittoli (andreaf)" <andrea.frittoli@gmail.com>
Date: Fri, 8 Dec 2017 17:52:29 +0000
Subject: [PATCH 1215/2409] Stage rabbitmq and DB logs

Stage rabbitmq and DB logs so they are copied to logs.o.o

Change-Id: Ica8a86c2649b2871f366e3ca48a8b47f455879bc
---
 playbooks/post.yaml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/playbooks/post.yaml b/playbooks/post.yaml
index 40c39beb69..fd30bdbf2a 100644
--- a/playbooks/post.yaml
+++ b/playbooks/post.yaml
@@ -31,7 +31,11 @@
           '{{ devstack_full_log}}': 'logs',
           '{{ stage_dir }}/verify_tempest_conf.log': 'logs',
           '{{ stage_dir }}/apache': 'logs',
-          '{{ stage_dir }}/apache_config': 'logs' }
+          '{{ stage_dir }}/apache_config': 'logs',
+          '/var/log/rabbitmq': 'logs',
+          '/var/log/postgresql': 'logs',
+          '/var/log/mysql.err': 'logs',
+          '/var/log/mysql.log': 'logs' }
       extensions_to_txt:
         - conf
         - log

From e6b0169a0207bed66ae7bec683b5a7a816e1dd13 Mon Sep 17 00:00:00 2001
From: "Andrea Frittoli (andreaf)" <andrea.frittoli@gmail.com>
Date: Fri, 8 Dec 2017 18:19:23 +0000
Subject: [PATCH 1216/2409] Stage libvirt logs and sudoers

Stage libvirt logs and sudoers configuration.

Change-Id: I46112c52f05c6015a9f397eda130404beeb5e899
---
 playbooks/post.yaml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/playbooks/post.yaml b/playbooks/post.yaml
index fd30bdbf2a..ee8a87820e 100644
--- a/playbooks/post.yaml
+++ b/playbooks/post.yaml
@@ -35,7 +35,10 @@
           '/var/log/rabbitmq': 'logs',
           '/var/log/postgresql': 'logs',
           '/var/log/mysql.err': 'logs',
-          '/var/log/mysql.log': 'logs' }
+          '/var/log/mysql.log': 'logs',
+          '/var/log/libvirt': 'logs',
+          '/etc/sudoers': 'logs',
+          '/etc/sudoers.d': 'logs' }
       extensions_to_txt:
         - conf
         - log

From 5a9872a9b90c06cddbbd4a18b16e715e3db9a939 Mon Sep 17 00:00:00 2001
From: "Andrea Frittoli (andreaf)" <andrea.frittoli@gmail.com>
Date: Fri, 15 Dec 2017 13:55:50 +0000
Subject: [PATCH 1217/2409] Stage openstack config files

Stage config files from openstack and all projects used by the
devstack run.

Change-Id: I99f1bc71856b0da7fc5b438d13d4f508d2341e44
---
 playbooks/post.yaml                           |  2 ++
 roles/devstack-project-conf/README.rst        | 11 +++++++++
 .../devstack-project-conf/defaults/main.yaml  |  1 +
 roles/devstack-project-conf/tasks/main.yaml   | 24 +++++++++++++++++++
 4 files changed, 38 insertions(+)
 create mode 100644 roles/devstack-project-conf/README.rst
 create mode 100644 roles/devstack-project-conf/defaults/main.yaml
 create mode 100644 roles/devstack-project-conf/tasks/main.yaml

diff --git a/playbooks/post.yaml b/playbooks/post.yaml
index ee8a87820e..36023a625a 100644
--- a/playbooks/post.yaml
+++ b/playbooks/post.yaml
@@ -20,6 +20,7 @@
   roles:
     - export-devstack-journal
     - apache-logs-conf
+    - devstack-project-conf
     - role: stage-output
       zuul_copy_output:
         { '{{ devstack_conf_dir }}/local.conf': 'logs',
@@ -32,6 +33,7 @@
           '{{ stage_dir }}/verify_tempest_conf.log': 'logs',
           '{{ stage_dir }}/apache': 'logs',
           '{{ stage_dir }}/apache_config': 'logs',
+          '{{ stage_dir }}/etc': 'logs',
           '/var/log/rabbitmq': 'logs',
           '/var/log/postgresql': 'logs',
           '/var/log/mysql.err': 'logs',
diff --git a/roles/devstack-project-conf/README.rst b/roles/devstack-project-conf/README.rst
new file mode 100644
index 0000000000..3f2d4c9697
--- /dev/null
+++ b/roles/devstack-project-conf/README.rst
@@ -0,0 +1,11 @@
+Prepare OpenStack project configurations for staging
+
+Prepare all relevant config files for staging.
+This is helpful to avoid staging the entire /etc.
+
+**Role Variables**
+
+.. zuul:rolevar:: stage_dir
+   :default: {{ ansible_user_dir }}
+
+   The base stage directory.
diff --git a/roles/devstack-project-conf/defaults/main.yaml b/roles/devstack-project-conf/defaults/main.yaml
new file mode 100644
index 0000000000..f8fb8deac9
--- /dev/null
+++ b/roles/devstack-project-conf/defaults/main.yaml
@@ -0,0 +1 @@
+stage_dir: "{{ ansible_user_dir }}"
diff --git a/roles/devstack-project-conf/tasks/main.yaml b/roles/devstack-project-conf/tasks/main.yaml
new file mode 100644
index 0000000000..9c6e06bea9
--- /dev/null
+++ b/roles/devstack-project-conf/tasks/main.yaml
@@ -0,0 +1,24 @@
+- name: Ensure {{ stage_dir }}/etc exists
+  file:
+    path: "{{ stage_dir }}/etc"
+    state: directory
+
+- name: Check which projects have a config folder
+  stat:
+    path: "/etc/{{ item.value.short_name }}"
+  with_dict: "{{ zuul.projects }}"
+  register: project_configs
+
+- name: Copy configuration files
+  command: cp -pRL {{ item.stat.path }} {{ stage_dir }}/etc/{{ item.item.value.short_name }}
+  when: item.stat.exists
+  with_items: "{{ project_configs.results }}"
+
+- name: Check if openstack has a config folder
+  stat:
+    path: "/etc/openstack"
+  register: openstack_configs
+
+- name: Copy configuration files
+  command: cp -pRL /etc/openstack {{ stage_dir }}/etc/
+  when: openstack_configs.stat.exists

From a2b174168a5d9bd3558e60297bea9dd91f39a546 Mon Sep 17 00:00:00 2001
From: "Andrea Frittoli (andreaf)" <andrea.frittoli@gmail.com>
Date: Fri, 15 Dec 2017 17:35:31 +0000
Subject: [PATCH 1218/2409] Stage a number of system type logs

This could be ansiblesed a more, for now more or less the bash code
from d-g wrapped in a role.

Change-Id: Ia7fe40f05ca394da9a65fef6383d72f29a532e2f
---
 playbooks/post.yaml                          | 19 +++++++++-
 roles/capture-system-logs/README.rst         | 20 +++++++++++
 roles/capture-system-logs/defaults/main.yaml |  1 +
 roles/capture-system-logs/tasks/main.yaml    | 38 ++++++++++++++++++++
 4 files changed, 77 insertions(+), 1 deletion(-)
 create mode 100644 roles/capture-system-logs/README.rst
 create mode 100644 roles/capture-system-logs/defaults/main.yaml
 create mode 100644 roles/capture-system-logs/tasks/main.yaml

diff --git a/playbooks/post.yaml b/playbooks/post.yaml
index 36023a625a..41d3c54121 100644
--- a/playbooks/post.yaml
+++ b/playbooks/post.yaml
@@ -21,6 +21,8 @@
     - export-devstack-journal
     - apache-logs-conf
     - devstack-project-conf
+    # capture-system-logs should be the last role before stage-output
+    - capture-system-logs
     - role: stage-output
       zuul_copy_output:
         { '{{ devstack_conf_dir }}/local.conf': 'logs',
@@ -40,7 +42,22 @@
           '/var/log/mysql.log': 'logs',
           '/var/log/libvirt': 'logs',
           '/etc/sudoers': 'logs',
-          '/etc/sudoers.d': 'logs' }
+          '/etc/sudoers.d': 'logs',
+          '{{ stage_dir }}/iptables.txt': 'logs',
+          '{{ stage_dir }}/df.txt': 'logs',
+          '{{ stage_dir }}/pip2-freeze.txt': 'logs',
+          '{{ stage_dir }}/pip3-freeze.txt': 'logs',
+          '{{ stage_dir }}/dpkg-l.txt': 'logs',
+          '{{ stage_dir }}/rpm-qa.txt': 'logs',
+          '{{ stage_dir }}/core': 'logs',
+          '{{ stage_dir }}/listen53.txt': 'logs',
+          '{{ stage_dir }}/deprecations.log': 'logs',
+          '/var/log/ceph': 'logs',
+          '/var/log/openvswitch': 'logs',
+          '/var/log/glusterfs': 'logs',
+          '/etc/glusterfs/glusterd.vol': 'logs',
+          '/etc/resolv.conf': 'logs',
+          '/var/log/unbound.log': 'logs' }
       extensions_to_txt:
         - conf
         - log
diff --git a/roles/capture-system-logs/README.rst b/roles/capture-system-logs/README.rst
new file mode 100644
index 0000000000..c28412457a
--- /dev/null
+++ b/roles/capture-system-logs/README.rst
@@ -0,0 +1,20 @@
+Stage a number of system type logs
+
+Stage a number of different logs / reports:
+- snapshot of iptables
+- disk space available
+- pip[2|3] freeze
+- installed packages (dpkg/rpm)
+- ceph, openswitch, gluster
+- coredumps
+- dns resolver
+- listen53
+- unbound.log
+- deprecation messages
+
+**Role Variables**
+
+.. zuul:rolevar:: stage_dir
+   :default: {{ ansible_user_dir }}
+
+   The base stage directory.
diff --git a/roles/capture-system-logs/defaults/main.yaml b/roles/capture-system-logs/defaults/main.yaml
new file mode 100644
index 0000000000..fea05c8146
--- /dev/null
+++ b/roles/capture-system-logs/defaults/main.yaml
@@ -0,0 +1 @@
+devstack_base_dir: /opt/stack
diff --git a/roles/capture-system-logs/tasks/main.yaml b/roles/capture-system-logs/tasks/main.yaml
new file mode 100644
index 0000000000..cd8f4f0eab
--- /dev/null
+++ b/roles/capture-system-logs/tasks/main.yaml
@@ -0,0 +1,38 @@
+# TODO(andreaf) Make this into proper Ansible
+- name: Stage various logs and reports
+  shell:
+    cmd: |
+      sudo iptables-save > {{ stage_dir }}/iptables.txt
+      df -h > {{ stage_dir }}/df.txt
+
+      for py_ver in 2 3; do
+          if [[ `which python${py_ver}` ]]; then
+              python${py_ver} -m pip freeze > {{ stage_dir }}/pip${py_ver}-freeze.txt
+          fi
+      done
+
+      if [ `command -v dpkg` ]; then
+          dpkg -l> {{ stage_dir }}/dpkg-l.txt
+      fi
+      if [ `command -v rpm` ]; then
+          rpm -qa | sort > {{ stage_dir }}/rpm-qa.txt
+      fi
+
+      # gzip and save any coredumps in /var/core
+      if [ -d /var/core ]; then
+          sudo gzip -r /var/core
+          sudo cp -r /var/core {{ stage_dir }}/
+      fi
+
+      sudo ss -lntup | grep ':53' > {{ stage_dir }}/listen53.txt
+
+      # NOTE(andreaf) Service logs are already in logs/ thanks for the
+      # export-devstack-journal log. Apache logs are under apache/ thans to the
+      # apache-logs-conf role.
+      grep -i deprecat {{ stage_dir }}/logs/*.txt {{ stage_dir }}/apache/*.log | \
+          sed -r 's/[0-9]{1,2}\:[0-9]{1,2}\:[0-9]{1,2}\.[0-9]{1,3}/ /g' | \
+          sed -r 's/[0-9]{1,2}\:[0-9]{1,2}\:[0-9]{1,2}/ /g' | \
+          sed -r 's/[0-9]{1,4}-[0-9]{1,2}-[0-9]{1,4}/ /g' |
+          sed -r 's/\[.*\]/ /g' | \
+          sed -r 's/\s[0-9]+\s/ /g' | \
+          awk '{if ($0 in seen) {seen[$0]++} else {out[++n]=$0;seen[$0]=1}} END { for (i=1; i<=n; i++) print seen[out[i]]" :: " out[i] }' > {{ stage_dir }}/deprecations.log

From b040af4d85c695ba4da210eb714b053d8aa834ad Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Wed, 20 Dec 2017 06:18:43 +0000
Subject: [PATCH 1219/2409] Updated from generate-devstack-plugins-list

Change-Id: Ib7ed514446fbb39f87369fa941dfa87c28046942
---
 doc/source/plugin-registry.rst | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 43dd3c2eae..907671adc8 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -26,7 +26,6 @@ Plugin Name                            URL
 ====================================== ===
 almanach                               `git://git.openstack.org/openstack/almanach <https://git.openstack.org/cgit/openstack/almanach>`__
 aodh                                   `git://git.openstack.org/openstack/aodh <https://git.openstack.org/cgit/openstack/aodh>`__
-app-catalog-ui                         `git://git.openstack.org/openstack/app-catalog-ui <https://git.openstack.org/cgit/openstack/app-catalog-ui>`__
 astara                                 `git://git.openstack.org/openstack/astara <https://git.openstack.org/cgit/openstack/astara>`__
 barbican                               `git://git.openstack.org/openstack/barbican <https://git.openstack.org/cgit/openstack/barbican>`__
 bilean                                 `git://git.openstack.org/openstack/bilean <https://git.openstack.org/cgit/openstack/bilean>`__
@@ -127,6 +126,7 @@ networking-ovs-dpdk                    `git://git.openstack.org/openstack/networ
 networking-plumgrid                    `git://git.openstack.org/openstack/networking-plumgrid <https://git.openstack.org/cgit/openstack/networking-plumgrid>`__
 networking-powervm                     `git://git.openstack.org/openstack/networking-powervm <https://git.openstack.org/cgit/openstack/networking-powervm>`__
 networking-sfc                         `git://git.openstack.org/openstack/networking-sfc <https://git.openstack.org/cgit/openstack/networking-sfc>`__
+networking-spp                         `git://git.openstack.org/openstack/networking-spp <https://git.openstack.org/cgit/openstack/networking-spp>`__
 networking-vpp                         `git://git.openstack.org/openstack/networking-vpp <https://git.openstack.org/cgit/openstack/networking-vpp>`__
 networking-vsphere                     `git://git.openstack.org/openstack/networking-vsphere <https://git.openstack.org/cgit/openstack/networking-vsphere>`__
 neutron                                `git://git.openstack.org/openstack/neutron <https://git.openstack.org/cgit/openstack/neutron>`__
@@ -135,6 +135,7 @@ neutron-fwaas                          `git://git.openstack.org/openstack/neutro
 neutron-fwaas-dashboard                `git://git.openstack.org/openstack/neutron-fwaas-dashboard <https://git.openstack.org/cgit/openstack/neutron-fwaas-dashboard>`__
 neutron-lbaas                          `git://git.openstack.org/openstack/neutron-lbaas <https://git.openstack.org/cgit/openstack/neutron-lbaas>`__
 neutron-lbaas-dashboard                `git://git.openstack.org/openstack/neutron-lbaas-dashboard <https://git.openstack.org/cgit/openstack/neutron-lbaas-dashboard>`__
+neutron-tempest-plugin                 `git://git.openstack.org/openstack/neutron-tempest-plugin <https://git.openstack.org/cgit/openstack/neutron-tempest-plugin>`__
 neutron-vpnaas                         `git://git.openstack.org/openstack/neutron-vpnaas <https://git.openstack.org/cgit/openstack/neutron-vpnaas>`__
 neutron-vpnaas-dashboard               `git://git.openstack.org/openstack/neutron-vpnaas-dashboard <https://git.openstack.org/cgit/openstack/neutron-vpnaas-dashboard>`__
 nova-dpm                               `git://git.openstack.org/openstack/nova-dpm <https://git.openstack.org/cgit/openstack/nova-dpm>`__

From 49f3cc76bffaa09c710212ef6779943071bb050d Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Mon, 11 Dec 2017 09:24:15 +0000
Subject: [PATCH 1220/2409] Make stackenv file visible

The file won't be listed as long as it is called .stackenv.txt.gz, with
this it will be called _stackenv.txt.gz instead.

Change-Id: Ib3b44c287ffb2ec0e48fefef1662a1c02d162657
---
 playbooks/post.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/playbooks/post.yaml b/playbooks/post.yaml
index 36023a625a..a2f695cb21 100644
--- a/playbooks/post.yaml
+++ b/playbooks/post.yaml
@@ -45,6 +45,7 @@
         - conf
         - log
         - localrc
+        - stackenv
         - summary
     # NOTE(andreaf) We need fetch-devstack-log-dir only as long as the base job
     # starts pulling logs for us from {{ ansible_user_dir }}/logs.

From f0636bac05dfb1c963cc1eda2832259075127809 Mon Sep 17 00:00:00 2001
From: Harald Jensas <hjensas@redhat.com>
Date: Wed, 20 Dec 2017 12:07:40 +0100
Subject: [PATCH 1221/2409] Fixing a typo - internationalized

Assuming confusingness a few lines down is intentional ...

Change-Id: I3bd18aa32e1166bb1012ac65e83461b75be4f006
---
 stack.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index a125d4a0d7..ee857c516f 100755
--- a/stack.sh
+++ b/stack.sh
@@ -32,7 +32,7 @@ unset GREP_OPTIONS
 # Devstack is written in bash, and many functions used throughout
 # devstack process text coming off a command (like the ip command)
 # and do transforms using grep, sed, cut, awk on the strings that are
-# returned. Many of these programs are interationalized, which is
+# returned. Many of these programs are internationalized, which is
 # great for end users, but means that the strings that devstack
 # functions depend upon might not be there in other locales. We thus
 # need to pin the world to an english basis during the runs.

From 421753f71d1e2e88b55dcbe58672395afbeced87 Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Wed, 20 Dec 2017 08:31:15 -0600
Subject: [PATCH 1222/2409] Switch to consolidated fetch-subunit-output role

fetch-testr-output and fetch-stestr-output are being merged.

Change-Id: I00d448c4e6b98a1f504b048c74eff4e110c0b511
Depends-On: I833320cf9a932d8e119645eb798ce0c93d854321
---
 playbooks/tox/post.yaml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/playbooks/tox/post.yaml b/playbooks/tox/post.yaml
index d9e299ff4d..7f0cb19824 100644
--- a/playbooks/tox/post.yaml
+++ b/playbooks/tox/post.yaml
@@ -1,5 +1,4 @@
 - hosts: all
   roles:
     - fetch-tox-output
-    - fetch-testr-output
-    - fetch-stestr-output
+    - fetch-subunit-output

From 6a25fb96c1e2c00ec2ec2c2b456d549c092ae495 Mon Sep 17 00:00:00 2001
From: bhagyashris <bhagyashri.shewale@nttdata.com>
Date: Thu, 14 Dec 2017 13:23:41 +0530
Subject: [PATCH 1223/2409] Initialize newly added glance-image-import config
 file

This patch creates a new config file glance-image-import.conf
at /etc/glance path. Also, each config option is initialized
with default values.

Need these changes to implement specs [1]:

[1]: https://blueprints.launchpad.net/glance/+spec/inject-automatic-metadata

Related-Change-Id: If14c7dc4f38360006f9cb350fbba54fa2f33be61
Change-Id: I665507db1838a50e344d3be909d7490f1f52040c
---
 lib/glance | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lib/glance b/lib/glance
index ad286bacb9..95d2450da7 100644
--- a/lib/glance
+++ b/lib/glance
@@ -56,6 +56,7 @@ GLANCE_CACHE_CONF=$GLANCE_CONF_DIR/glance-cache.conf
 GLANCE_POLICY_JSON=$GLANCE_CONF_DIR/policy.json
 GLANCE_SCHEMA_JSON=$GLANCE_CONF_DIR/schema-image.json
 GLANCE_SWIFT_STORE_CONF=$GLANCE_CONF_DIR/glance-swift-store.conf
+GLANCE_IMAGE_IMPORT_CONF=$GLANCE_CONF_DIR/glance-image-import.conf
 GLANCE_V1_ENABLED=${GLANCE_V1_ENABLED:-False}
 
 if is_service_enabled tls-proxy; then
@@ -232,6 +233,11 @@ function configure_glance {
     # Store specific confs
     iniset $GLANCE_CACHE_CONF glance_store filesystem_store_datadir $GLANCE_IMAGE_DIR/
 
+    # Set default configuration options for the glance-image-import
+    iniset $GLANCE_IMAGE_IMPORT_CONF image_import_opts image_import_plugins []
+    iniset $GLANCE_IMAGE_IMPORT_CONF inject_metadata_properties ignore_user_roles admin
+    iniset $GLANCE_IMAGE_IMPORT_CONF inject_metadata_properties inject
+
     cp -p $GLANCE_DIR/etc/policy.json $GLANCE_POLICY_JSON
     cp -p $GLANCE_DIR/etc/schema-image.json $GLANCE_SCHEMA_JSON
 

From f6d566c21d0b33344e58fcbc9ec388d7503570da Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Fri, 22 Dec 2017 11:39:29 -0500
Subject: [PATCH 1224/2409] Configure nova_cell1.conf to use placement for
 reschedules

Nova now calculates alternate hosts in the scheduler and
sends those to the cell for reschedules in case a build on
a given compute node fails.

The cell conductor needs to claim resources against the
alternate hosts in Placement during a reschedule, therefore
it needs to be configured to talk to the placement service.

Part of blueprint return-alternate-hosts

Change-Id: Ie599968d9e7537e551fe6d9deb63a91b256b1e11
---
 lib/nova      |  6 ++++++
 lib/placement | 18 ++++++++++--------
 2 files changed, 16 insertions(+), 8 deletions(-)

diff --git a/lib/nova b/lib/nova
index 50deeeb220..c40c43af6c 100644
--- a/lib/nova
+++ b/lib/nova
@@ -600,6 +600,12 @@ function create_nova_conf {
             else
                 rpc_backend_add_vhost $vhost
                 iniset_rpc_backend nova $conf DEFAULT $vhost
+                # When running in superconductor mode, the cell conductor
+                # must be configured to talk to the placement service for
+                # reschedules to work.
+                if is_service_enabled placement placement-client; then
+                    configure_placement_nova_compute $conf
+                fi
             fi
             # Format logging
             setup_logging $conf
diff --git a/lib/placement b/lib/placement
index 1875857552..1d68f8a185 100644
--- a/lib/placement
+++ b/lib/placement
@@ -103,14 +103,16 @@ function _config_placement_apache_wsgi {
 }
 
 function configure_placement_nova_compute {
-    iniset $NOVA_CONF placement auth_type "password"
-    iniset $NOVA_CONF placement auth_url "$KEYSTONE_SERVICE_URI"
-    iniset $NOVA_CONF placement username placement
-    iniset $NOVA_CONF placement password "$SERVICE_PASSWORD"
-    iniset $NOVA_CONF placement user_domain_name "$SERVICE_DOMAIN_NAME"
-    iniset $NOVA_CONF placement project_name "$SERVICE_TENANT_NAME"
-    iniset $NOVA_CONF placement project_domain_name "$SERVICE_DOMAIN_NAME"
-    iniset $NOVA_CONF placement os_region_name "$REGION_NAME"
+    # Use the provided config file path or default to $NOVA_CONF.
+    local conf=${1:-$NOVA_CONF}
+    iniset $conf placement auth_type "password"
+    iniset $conf placement auth_url "$KEYSTONE_SERVICE_URI"
+    iniset $conf placement username placement
+    iniset $conf placement password "$SERVICE_PASSWORD"
+    iniset $conf placement user_domain_name "$SERVICE_DOMAIN_NAME"
+    iniset $conf placement project_name "$SERVICE_TENANT_NAME"
+    iniset $conf placement project_domain_name "$SERVICE_DOMAIN_NAME"
+    iniset $conf placement os_region_name "$REGION_NAME"
     # TODO(cdent): auth_strategy, which is common to see in these
     # blocks is not currently used here. For the time being the
     # placement api uses the auth_strategy configuration setting

From b4d772b9fdb00fbdec1304ce6fbeafaa77915071 Mon Sep 17 00:00:00 2001
From: Andreas Jaeger <aj@suse.com>
Date: Sat, 23 Dec 2017 20:17:33 +0100
Subject: [PATCH 1225/2409] devstack job: Add irrelevant-files

Do not run devstack and its siblings if only rst files, releasenotes, or
files in doc directory change.

This is the minimal set of irrelevant files shared by most projects
already.

Needed-By: Ie8504ba3d5d46f6338a228ed2d248ba6363e37ae
Change-Id: Id0095763eb91592c2fd1a913526883987df704bd
---
 .zuul.yaml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index a699dbaa7d..037e9a9ea8 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -80,6 +80,14 @@
     pre-run: playbooks/pre.yaml
     run: playbooks/devstack.yaml
     post-run: playbooks/post.yaml
+    irrelevant-files:
+      # Documentation related
+      - ^.*\.rst$
+      - ^api-ref/.*$
+      - ^doc/.*$
+      - ^releasenotes/.*$
+      # Translations
+      - ^.*/locale/.*po$
 
 - job:
     name: devstack-multinode

From f8dc558486fdb484b31338aa30933e33c061638c Mon Sep 17 00:00:00 2001
From: Akihiro Motoki <amotoki@gmail.com>
Date: Sun, 24 Dec 2017 08:17:01 +0900
Subject: [PATCH 1226/2409] Drop django_openstack_auth related code

In Queens cycle, the code of django_openstack_auth was merged into
the horizon repository. The master branch of django_openstack_auth
will be retired. (horizon blueprint merge-openstack-auth)
This commit drops django_openstack_auth related code from DevStack.

_prepare_message_catalog_compilation in lib/horizon was used only
in install_django_openstack_auth, so it is dropped too.

Change-Id: If9467c520a1e07d1968b29e485df0097330356bc
---
 lib/horizon                  | 24 ------------------------
 stack.sh                     |  2 --
 stackrc                      |  4 ----
 tests/test_libs_from_pypi.sh |  2 +-
 4 files changed, 1 insertion(+), 31 deletions(-)

diff --git a/lib/horizon b/lib/horizon
index 3d2f68d09d..fab41bbeca 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -26,9 +26,6 @@ set +o xtrace
 # Defaults
 # --------
 
-# Set up default directories
-GITDIR["django_openstack_auth"]=$DEST/django_openstack_auth
-
 HORIZON_DIR=$DEST/horizon
 
 # local_settings.py is used to customize Dashboard settings.
@@ -159,20 +156,6 @@ function init_horizon {
 
 }
 
-# install_django_openstack_auth() - Collect source and prepare
-function install_django_openstack_auth {
-    if use_library_from_git "django_openstack_auth"; then
-        local dir=${GITDIR["django_openstack_auth"]}
-        git_clone_by_name "django_openstack_auth"
-        # Compile message catalogs before installation
-        _prepare_message_catalog_compilation
-        (cd $dir; $PYTHON setup.py compile_catalog)
-        setup_dev_lib "django_openstack_auth"
-    fi
-    # if we aren't using this library from git, then we just let it
-    # get dragged in by the horizon setup.
-}
-
 # install_horizon() - Collect source and prepare
 function install_horizon {
     # Apache installation, because we mark it NOPRIME
@@ -191,13 +174,6 @@ function stop_horizon {
     stop_apache_server
 }
 
-# NOTE: It can be moved to common functions, but it is only used by compilation
-# of django_openstack_auth catalogs at the moment.
-function _prepare_message_catalog_compilation {
-    pip_install_gr Babel
-}
-
-
 # Restore xtrace
 $_XTRACE_HORIZON
 
diff --git a/stack.sh b/stack.sh
index a125d4a0d7..db7261a380 100755
--- a/stack.sh
+++ b/stack.sh
@@ -894,8 +894,6 @@ if is_service_enabled placement placement-client; then
 fi
 
 if is_service_enabled horizon; then
-    # django openstack_auth
-    install_django_openstack_auth
     # dashboard
     stack_install_service horizon
 fi
diff --git a/stackrc b/stackrc
index 286a04d3fe..7d5c75df41 100644
--- a/stackrc
+++ b/stackrc
@@ -500,10 +500,6 @@ GITBRANCH["cursive"]=${CURSIVE_BRANCH:-master}
 GITREPO["glance_store"]=${GLANCE_STORE_REPO:-${GIT_BASE}/openstack/glance_store.git}
 GITBRANCH["glance_store"]=${GLANCE_STORE_BRANCH:-master}
 
-# django openstack_auth library
-GITREPO["django_openstack_auth"]=${HORIZONAUTH_REPO:-${GIT_BASE}/openstack/django_openstack_auth.git}
-GITBRANCH["django_openstack_auth"]=${HORIZONAUTH_BRANCH:-master}
-
 # keystone middleware
 GITREPO["keystonemiddleware"]=${KEYSTONEMIDDLEWARE_REPO:-${GIT_BASE}/openstack/keystonemiddleware.git}
 GITBRANCH["keystonemiddleware"]=${KEYSTONEMIDDLEWARE_BRANCH:-master}
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index 0bd8d49357..a544b56577 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -35,7 +35,7 @@ ALL_LIBS+=" python-glanceclient python-ironicclient"
 ALL_LIBS+=" oslo.messaging oslo.log cliff stevedore"
 ALL_LIBS+=" python-cinderclient glance_store oslo.concurrency oslo.db"
 ALL_LIBS+=" oslo.versionedobjects oslo.vmware keystonemiddleware"
-ALL_LIBS+=" oslo.serialization django_openstack_auth"
+ALL_LIBS+=" oslo.serialization"
 ALL_LIBS+=" python-openstackclient osc-lib osc-placement"
 ALL_LIBS+=" os-client-config oslo.rootwrap"
 ALL_LIBS+=" oslo.i18n oslo.utils python-openstacksdk python-swiftclient"

From 7b1b6f3446965dda570806dfab06538e6796012e Mon Sep 17 00:00:00 2001
From: Takashi NATSUME <natsume.takashi@lab.ntt.co.jp>
Date: Wed, 20 Dec 2017 11:38:23 +0900
Subject: [PATCH 1227/2409] Fix that DISTRO is not set in unstack.sh

Change-Id: I36cab41fdb767e8e31073a4fa1f929090f702910
Closes-Bug: #1738938
---
 unstack.sh | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/unstack.sh b/unstack.sh
index 5d3672e25d..ccea0ef585 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -45,6 +45,10 @@ fi
 # Configure Projects
 # ==================
 
+# Determine what system we are running on.  This provides ``os_VENDOR``,
+# ``os_RELEASE``, ``os_PACKAGE``, ``os_CODENAME`` and ``DISTRO``
+GetDistro
+
 # Plugin Phase 0: override_defaults - allow plugins to override
 # defaults before other services are run
 run_phase override_defaults
@@ -83,10 +87,6 @@ fi
 
 load_plugin_settings
 
-# Determine what system we are running on.  This provides ``os_VENDOR``,
-# ``os_RELEASE``, ``os_PACKAGE``, ``os_CODENAME``
-GetOSVersion
-
 set -o xtrace
 
 # Run extras

From b3ed561c7af82fabc4a46ff0affcb71737b23a3d Mon Sep 17 00:00:00 2001
From: Toshiaki Takahashi <takahashi.tsc@ncos.nec.co.jp>
Date: Thu, 4 Jan 2018 02:15:08 +0900
Subject: [PATCH 1228/2409] Fix "Centos" to official notation "CentOS".

Change-Id: I2f76fe3a19cd2ebf004d0a7c14852f20f3dadd9e
---
 doc/source/overview.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/overview.rst b/doc/source/overview.rst
index c07a8e6d67..814a2b148b 100644
--- a/doc/source/overview.rst
+++ b/doc/source/overview.rst
@@ -24,7 +24,7 @@ release.*
 
 -  Ubuntu: current LTS release plus current development release
 -  Fedora: current release plus previous release
--  RHEL/Centos: current major release
+-  RHEL/CentOS: current major release
 -  Other OS platforms may continue to be included but the maintenance of
    those platforms shall not be assumed simply due to their presence.
    Having a listed point-of-contact for each additional OS will greatly

From 2700bf88a549088285bef41fe86ac323965c8727 Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Thu, 4 Jan 2018 10:16:16 -0800
Subject: [PATCH 1229/2409] Gzip openstack service logs

These files are quite large and disk space is limited so make sure we
compress the log files before copying them to storage. Additionally
os-loganalyze will only operate on gzipped log files so this should fix
os-loganalyze with tempest-full job's logs.

This is mostly a check to confirm everything works as expected but we
probably want to move the gzip step into the log publication roles so
that all log files end up compressed.

Change-Id: Ie87962428e0ca755c211cc5e664a14a9f2a79ac4
---
 roles/export-devstack-journal/tasks/main.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/roles/export-devstack-journal/tasks/main.yaml b/roles/export-devstack-journal/tasks/main.yaml
index 3efa5755b2..6e760c1f6f 100644
--- a/roles/export-devstack-journal/tasks/main.yaml
+++ b/roles/export-devstack-journal/tasks/main.yaml
@@ -15,7 +15,7 @@
       name=""
       for u in `systemctl list-unit-files | grep devstack | awk '{print $1}'`; do
         name=$(echo $u | sed 's/devstack@/screen-/' | sed 's/\.service//')
-        journalctl -o short-precise --unit $u | tee {{ stage_dir }}/logs/$name.txt > /dev/null
+        journalctl -o short-precise --unit $u | gzip - > {{ stage_dir }}/logs/$name.txt.gz
       done
 
       # Export the journal in export format to make it downloadable
@@ -34,4 +34,4 @@
           -t sudo \
           --no-pager \
           --since="$(cat {{ devstack_base_dir }}/log-start-timestamp.txt)" \
-        | tee {{ stage_dir }}/logs/syslog.txt > /dev/null
+        | gzip - > {{ stage_dir }}/logs/syslog.txt.gz

From c396355befb37d31ee8118fb5994aed63b139843 Mon Sep 17 00:00:00 2001
From: Hunt Xu <mhuntxu@gmail.com>
Date: Mon, 8 Jan 2018 16:11:33 +0800
Subject: [PATCH 1230/2409] Use "ip neigh" instead of "arp -n" in worlddump.py

Worlddumping on a system without net-tools package gets an error showing
"arp: not found". As iproute2 can also show arp tables, we use it
instead.

Change-Id: I0cd83e6d14959dc5a1147c487b11f27fb92aa20a
---
 tools/worlddump.py | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/tools/worlddump.py b/tools/worlddump.py
index 6fff1497a7..750608210a 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -164,8 +164,7 @@ def network_dump():
     _header("Network Dump")
 
     _dump_cmd("brctl show")
-    _dump_cmd("arp -n")
-    ip_cmds = ["addr", "link", "route"]
+    ip_cmds = ["neigh", "addr", "link", "route"]
     for cmd in ip_cmds + ['netns']:
         _dump_cmd("ip %s" % cmd)
     for netns_ in _netns_list():

From fabaa991ca28a181909b420701bbd8e195177814 Mon Sep 17 00:00:00 2001
From: Shachar Snapiri <shachar@snapiri.net>
Date: Wed, 6 Dec 2017 14:45:06 +0200
Subject: [PATCH 1231/2409] Added the ability to specify checksum for etcd

It is possibe for the user to override te etcd version, thus download a
different etcd file, but the checksum is constant, so the checksum
verification will fail in that case.
Added the ability to specify a different checksum, so the user would be
able to specify the new version checksum

Change-Id: I85af3af841ae957964f18d4e37a86ab0703882bc
Closes-Bug: #1736718
---
 stackrc | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/stackrc b/stackrc
index 286a04d3fe..d344981c75 100644
--- a/stackrc
+++ b/stackrc
@@ -720,11 +720,11 @@ EXTRA_CACHE_URLS=""
 
 # etcd3 defaults
 ETCD_VERSION=${ETCD_VERSION:-v3.1.10}
-ETCD_SHA256_AMD64="2d335f298619c6fb02b1124773a56966e448ad9952b26fea52909da4fe80d2be"
+ETCD_SHA256_AMD64=${ETCD_SHA256_AMD64:-"2d335f298619c6fb02b1124773a56966e448ad9952b26fea52909da4fe80d2be"}
 # NOTE(sdague): etcd v3.1.10 doesn't have anything for these architectures, though 3.2.x does.
-ETCD_SHA256_ARM64=""
-ETCD_SHA256_PPC64=""
-ETCD_SHA256_S390X=""
+ETCD_SHA256_ARM64=${ETCD_SHA256_ARM64:-""}
+ETCD_SHA256_PPC64=${ETCD_SHA256_PPC64:-""}
+ETCD_SHA256_S390X=${ETCD_SHA256_S390X:-""}
 # Make sure etcd3 downloads the correct architecture
 if is_arch "x86_64"; then
     ETCD_ARCH="amd64"

From fe4c3cfcf54f863ec10f970805528f9d3d0cc750 Mon Sep 17 00:00:00 2001
From: Shachar Snapiri <shachar.snapiri@huawei.com>
Date: Tue, 19 Sep 2017 09:52:00 +0300
Subject: [PATCH 1232/2409] Modified the subnet-range parameter to be optional

The subnet-range parameter is only sent now if a valid value exists so
the command will not fail

Change-Id: I5296f5b59bc6d3d3db90a685a8678db9a156eece
Closes-Bug: #1718111
---
 lib/neutron_plugins/services/l3 | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 98315b7dd3..41a467df4c 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -188,7 +188,7 @@ function create_neutron_initial_network {
             if [ -z $SUBNETPOOL_V4_ID ]; then
                 fixed_range_v4=$FIXED_RANGE
             fi
-            SUBNET_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet create --project $project_id --ip-version 4 ${ALLOCATION_POOL:+--allocation-pool $ALLOCATION_POOL} $PROVIDER_SUBNET_NAME --gateway $NETWORK_GATEWAY ${SUBNETPOOL_V4_ID:+--subnet-pool $SUBNETPOOL_V4_ID} --network $NET_ID --subnet-range $fixed_range_v4 | grep ' id ' | get_field 2)
+            SUBNET_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet create --project $project_id --ip-version 4 ${ALLOCATION_POOL:+--allocation-pool $ALLOCATION_POOL} $PROVIDER_SUBNET_NAME --gateway $NETWORK_GATEWAY ${SUBNETPOOL_V4_ID:+--subnet-pool $SUBNETPOOL_V4_ID} --network $NET_ID ${fixed_range_v4:+--subnet-range $fixed_range_v4} | grep ' id ' | get_field 2)
             die_if_not_set $LINENO SUBNET_ID "Failure creating SUBNET_ID for $PROVIDER_SUBNET_NAME $project_id"
         fi
 
@@ -198,7 +198,7 @@ function create_neutron_initial_network {
             if [ -z $SUBNETPOOL_V6_ID ]; then
                 fixed_range_v6=$IPV6_PROVIDER_FIXED_RANGE
             fi
-            IPV6_SUBNET_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet create --project $project_id --ip-version 6 --gateway $IPV6_PROVIDER_NETWORK_GATEWAY $IPV6_PROVIDER_SUBNET_NAME ${SUBNETPOOL_V6_ID:+--subnet-pool $SUBNETPOOL_V6_ID} --network $NET_ID --subnet-range $fixed_range_v6 | grep ' id ' | get_field 2)
+            IPV6_SUBNET_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet create --project $project_id --ip-version 6 --gateway $IPV6_PROVIDER_NETWORK_GATEWAY $IPV6_PROVIDER_SUBNET_NAME ${SUBNETPOOL_V6_ID:+--subnet-pool $SUBNETPOOL_V6_ID} --network $NET_ID ${fixed_range_v6:+--subnet-range $fixed_range_v6} | grep ' id ' | get_field 2)
             die_if_not_set $LINENO IPV6_SUBNET_ID "Failure creating IPV6_SUBNET_ID for $IPV6_PROVIDER_SUBNET_NAME $project_id"
         fi
 

From b9891eea1f981fa51682f2c94f8e04f047f3dec4 Mon Sep 17 00:00:00 2001
From: Victor Stinner <vstinner@redhat.com>
Date: Mon, 8 Jan 2018 15:20:36 +0100
Subject: [PATCH 1233/2409] Fix Python3 get_python_exec_prefix on Fedora 27

On Fedora 27, the default Pytho 3 install prefix changed from /usr
to /usr/local:
https://fedoraproject.org/wiki/Changes/Making_sudo_pip_safe

Closes-Bug: #1741901
Change-Id: Id40620efdf173189df053b5d380a801092933f83
---
 inc/python | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/inc/python b/inc/python
index 2e4eff02ea..e074ea498f 100644
--- a/inc/python
+++ b/inc/python
@@ -49,7 +49,11 @@ function get_python_exec_prefix {
     fi
     $xtrace
 
-    if is_fedora || is_suse; then
+    if python3_enabled && [ "$os_VENDOR" = "Fedora" -a $os_RELEASE -gt 26 ]; then
+        # Default Python 3 install prefix changed to /usr/local in Fedora 27:
+        # https://fedoraproject.org/wiki/Changes/Making_sudo_pip_safe
+        echo "/usr/local/bin"
+    elif is_fedora || is_suse; then
         echo "/usr/bin"
     else
         echo "/usr/local/bin"

From 9aaa529f65011e4bfa649043c35ee808970dc426 Mon Sep 17 00:00:00 2001
From: Brian Haley <bhaley@redhat.com>
Date: Wed, 20 Sep 2017 14:23:05 -0400
Subject: [PATCH 1234/2409] Add DVR support to lib/neutron

Added NEUTRON_DISTRIBUTED_ROUTING to more easily control DVR
configuration.  If set to True, DVR will be enabled and the
default agent mode will be set to 'dvr_snat' since that works
with all types of routers by default.  Advanced users can
override that by setting NEUTRON_DVR_MODE, for example in
multi-node configurations where different agent modes are
desired.

This should bring lib/neutron inline with lib/neutron-legacy
in supporting all the different DVR modes.

Change-Id: I9f25921eefc5b935aad3bb1edc5e41ee0ce43a84
---
 lib/neutron | 31 ++++++++++++++++++++++++++++++-
 1 file changed, 30 insertions(+), 1 deletion(-)

diff --git a/lib/neutron b/lib/neutron
index c5839f5c3e..d33b49e890 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -32,6 +32,17 @@ NEUTRON_AGENT=${NEUTRON_AGENT:-openvswitch}
 NEUTRON_DIR=$DEST/neutron
 NEUTRON_AUTH_CACHE_DIR=${NEUTRON_AUTH_CACHE_DIR:-/var/cache/neutron}
 
+NEUTRON_DISTRIBUTED_ROUTING=$(trueorfalse False NEUTRON_DISTRIBUTED_ROUTING)
+# Distributed Virtual Router (DVR) configuration
+# Can be:
+# - ``legacy``          - No DVR functionality
+# - ``dvr_snat``        - Controller or single node DVR
+# - ``dvr``             - Compute node in multi-node DVR
+# - ``dvr_no_external`` - Compute node in multi-node DVR, no external network
+#
+# Default is 'dvr_snat' since it can handle both DVR and legacy routers
+NEUTRON_DVR_MODE=${NEUTRON_DVR_MODE:-dvr_snat}
+
 NEUTRON_BIN_DIR=$(get_python_exec_prefix)
 NEUTRON_DHCP_BINARY="neutron-dhcp-agent"
 
@@ -173,6 +184,7 @@ function configure_neutron_new {
 
         iniset $NEUTRON_CONF DEFAULT policy_file $policy_file
         iniset $NEUTRON_CONF DEFAULT allow_overlapping_ips True
+        iniset $NEUTRON_CONF DEFAULT router_distributed $NEUTRON_DISTRIBUTED_ROUTING
 
         iniset $NEUTRON_CONF DEFAULT auth_strategy $NEUTRON_AUTH_STRATEGY
         configure_auth_token_middleware $NEUTRON_CONF neutron $NEUTRON_AUTH_CACHE_DIR keystone_authtoken
@@ -181,7 +193,15 @@ function configure_neutron_new {
         # Configure VXLAN
         # TODO(sc68cal) not hardcode?
         iniset $NEUTRON_CORE_PLUGIN_CONF ml2 tenant_network_types vxlan
-        iniset $NEUTRON_CORE_PLUGIN_CONF ml2 mechanism_drivers openvswitch,linuxbridge
+
+        local mech_drivers="openvswitch"
+        if [[ "$NEUTRON_DISTRIBUTED_ROUTING" = "True" ]]; then
+            mech_drivers+=",l2population"
+        else
+            mech_drivers+=",linuxbridge"
+        fi
+        iniset $NEUTRON_CORE_PLUGIN_CONF ml2 mechanism_drivers $mech_drivers
+
         iniset $NEUTRON_CORE_PLUGIN_CONF ml2_type_vxlan vni_ranges 1001:2000
         iniset $NEUTRON_CORE_PLUGIN_CONF ml2_type_flat flat_networks public
         if [[ "$NEUTRON_PORT_SECURITY" = "True" ]]; then
@@ -202,6 +222,11 @@ function configure_neutron_new {
         else
             iniset $NEUTRON_CORE_PLUGIN_CONF securitygroup firewall_driver iptables_hybrid
             iniset $NEUTRON_CORE_PLUGIN_CONF ovs local_ip $HOST_IP
+
+            if [[ "$NEUTRON_DISTRIBUTED_ROUTING" = "True" ]]; then
+                iniset $NEUTRON_CORE_PLUGIN_CONF agent l2_population True
+                iniset $NEUTRON_CORE_PLUGIN_CONF agent enable_distributed_routing True
+            fi
         fi
 
         if ! running_in_container; then
@@ -236,6 +261,10 @@ function configure_neutron_new {
         else
             iniset $NEUTRON_CORE_PLUGIN_CONF ovs bridge_mappings "$PUBLIC_NETWORK_NAME:$PUBLIC_BRIDGE"
         fi
+
+        if [[ "$NEUTRON_DISTRIBUTED_ROUTING" = "True" ]]; then
+            iniset $NEUTRON_L3_CONF DEFAULT agent_mode $NEUTRON_DVR_MODE
+        fi
     fi
 
     # Metadata

From 9fd38e79701b65d41116a8915e47978fc50176c6 Mon Sep 17 00:00:00 2001
From: Attila Fazekas <afazekas@redhat.com>
Date: Mon, 11 Dec 2017 12:20:25 +0100
Subject: [PATCH 1235/2409] Add Fedora 27 support

Removing the (f23,)f24 support they are EOL.
The only non-trivial change is the apache-httpd default worker change,
however might not be bad idea to use `event` instead of `worker`
in the future, but for now keep it AS-IS and continue to use `worker`.

Change-Id: I96d414a30b58bc4b43da45066fdf310a6a830079
Closes-Bug: #1740194
---
 files/rpms/cinder  | 4 ++--
 files/rpms/general | 4 ++--
 files/rpms/nova    | 2 +-
 files/rpms/swift   | 2 +-
 lib/apache         | 3 ++-
 stack.sh           | 2 +-
 6 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/files/rpms/cinder b/files/rpms/cinder
index 3bc4e7ae72..e6addc62aa 100644
--- a/files/rpms/cinder
+++ b/files/rpms/cinder
@@ -1,5 +1,5 @@
 iscsi-initiator-utils
 lvm2
 qemu-img
-scsi-target-utils # not:rhel7,f24,f25,f26 NOPRIME
-targetcli # dist:rhel7,f24,f25,f26 NOPRIME
+scsi-target-utils # not:rhel7,f25,f26,f27 NOPRIME
+targetcli # dist:rhel7,f25,f26,f27 NOPRIME
diff --git a/files/rpms/general b/files/rpms/general
index f3f870823c..878b935a1b 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -9,9 +9,9 @@ git-core
 graphviz # needed only for docs
 httpd
 httpd-devel
-iptables-services  # NOPRIME f23,f24,f25,f26
+iptables-services  # NOPRIME f25,f26,f27
 java-1.7.0-openjdk-headless  # NOPRIME rhel7
-java-1.8.0-openjdk-headless  # NOPRIME f23,f24,f25,f26
+java-1.8.0-openjdk-headless  # NOPRIME f25,f26,f27
 libffi-devel
 libjpeg-turbo-devel # Pillow 3.0.0
 libxml2-devel # lxml
diff --git a/files/rpms/nova b/files/rpms/nova
index 64ed480632..9fb7282df5 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -7,7 +7,7 @@ gawk
 genisoimage # required for config_drive
 iptables
 iputils
-kernel-modules # dist:f23,f24,f25,f26
+kernel-modules # dist:f25,f26,f27
 kpartx
 libxml2-python
 m2crypto
diff --git a/files/rpms/swift b/files/rpms/swift
index 2e09cec28f..be0db140e3 100644
--- a/files/rpms/swift
+++ b/files/rpms/swift
@@ -2,7 +2,7 @@ curl
 liberasurecode-devel
 memcached
 pyxattr
-rsync-daemon # dist:f23,f24,f25,f26
+rsync-daemon # dist:f25,f26,f27
 sqlite
 xfsprogs
 xinetd
diff --git a/lib/apache b/lib/apache
index 3af341174e..84cec73234 100644
--- a/lib/apache
+++ b/lib/apache
@@ -133,8 +133,9 @@ function install_apache_wsgi {
         sudo rm -f /etc/httpd/conf.d/000-*
         install_package httpd mod_wsgi
         # For consistency with Ubuntu, switch to the worker mpm, as
-        # the default is prefork
+        # the default is event
         sudo sed -i '/mod_mpm_prefork.so/s/^/#/g' /etc/httpd/conf.modules.d/00-mpm.conf
+        sudo sed -i '/mod_mpm_event.so/s/^/#/g' /etc/httpd/conf.modules.d/00-mpm.conf
         sudo sed -i '/mod_mpm_worker.so/s/^#//g' /etc/httpd/conf.modules.d/00-mpm.conf
     elif is_suse; then
         install_package apache2 apache2-mod_wsgi
diff --git a/stack.sh b/stack.sh
index 1d0381483a..32eb43f292 100755
--- a/stack.sh
+++ b/stack.sh
@@ -221,7 +221,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (xenial|zesty|artful|stretch|jessie|f24|f25|f26|opensuse-42.2|opensuse-42.3|rhel7) ]]; then
+if [[ ! ${DISTRO} =~ (xenial|zesty|artful|stretch|jessie|f25|f26|f27|opensuse-42.2|opensuse-42.3|rhel7) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From 23e87ef6188514b17435897fac067568f0f71ac6 Mon Sep 17 00:00:00 2001
From: ghanshyam <ghanshyammann@gmail.com>
Date: Sun, 10 Dec 2017 05:11:53 +0300
Subject: [PATCH 1236/2409] Remove deprecated 'deactivate_image' feature flag
 setting

'deactivate_image' feature flag was added long back during kilo
cycle. Tempest is going to remove this feature flag.

Depends-On: I843d4c64f24407d9d217005d5ea59d50d7ad62e7
Change-Id: I1ae8efc0e62acc5e05c1c00dc8970b74d8b16da0
---
 lib/tempest | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index bdbaaa5678..35dbb7b6a1 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -310,7 +310,6 @@ function configure_tempest {
     fi
 
     # Image Features
-    iniset $TEMPEST_CONFIG image-feature-enabled deactivate_image True
     if [ "$GLANCE_V1_ENABLED" != "True" ]; then
         iniset $TEMPEST_CONFIG image-feature-enabled api_v1 False
     fi

From 4eb998fd5a494db19b40a0ede71dde73e2d1f5ec Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Sat, 13 Jan 2018 06:17:40 +0000
Subject: [PATCH 1237/2409] Updated from generate-devstack-plugins-list

Change-Id: I6b1214c9b080fbad43609548bf89be50c8191d87
---
 doc/source/plugin-registry.rst | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 907671adc8..31812aeefb 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -167,6 +167,7 @@ storlets                               `git://git.openstack.org/openstack/storle
 tacker                                 `git://git.openstack.org/openstack/tacker <https://git.openstack.org/cgit/openstack/tacker>`__
 tap-as-a-service                       `git://git.openstack.org/openstack/tap-as-a-service <https://git.openstack.org/cgit/openstack/tap-as-a-service>`__
 tap-as-a-service-dashboard             `git://git.openstack.org/openstack/tap-as-a-service-dashboard <https://git.openstack.org/cgit/openstack/tap-as-a-service-dashboard>`__
+telemetry-tempest-plugin               `git://git.openstack.org/openstack/telemetry-tempest-plugin <https://git.openstack.org/cgit/openstack/telemetry-tempest-plugin>`__
 tricircle                              `git://git.openstack.org/openstack/tricircle <https://git.openstack.org/cgit/openstack/tricircle>`__
 trio2o                                 `git://git.openstack.org/openstack/trio2o <https://git.openstack.org/cgit/openstack/trio2o>`__
 trove                                  `git://git.openstack.org/openstack/trove <https://git.openstack.org/cgit/openstack/trove>`__
@@ -174,6 +175,7 @@ trove-dashboard                        `git://git.openstack.org/openstack/trove-
 valet                                  `git://git.openstack.org/openstack/valet <https://git.openstack.org/cgit/openstack/valet>`__
 vitrage                                `git://git.openstack.org/openstack/vitrage <https://git.openstack.org/cgit/openstack/vitrage>`__
 vitrage-dashboard                      `git://git.openstack.org/openstack/vitrage-dashboard <https://git.openstack.org/cgit/openstack/vitrage-dashboard>`__
+vitrage-tempest-plugin                 `git://git.openstack.org/openstack/vitrage-tempest-plugin <https://git.openstack.org/cgit/openstack/vitrage-tempest-plugin>`__
 vmware-nsx                             `git://git.openstack.org/openstack/vmware-nsx <https://git.openstack.org/cgit/openstack/vmware-nsx>`__
 vmware-vspc                            `git://git.openstack.org/openstack/vmware-vspc <https://git.openstack.org/cgit/openstack/vmware-vspc>`__
 watcher                                `git://git.openstack.org/openstack/watcher <https://git.openstack.org/cgit/openstack/watcher>`__

From dc04b5aa24411b4081f0ad08021e0dc694c982e8 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 4 Dec 2017 11:32:36 +1100
Subject: [PATCH 1238/2409] CentOS: Fix EPEL mirroring and RDO install on CI
 nodes

CentOS tests have reverted to using upstream for EPEL rather than
local mirrors, introducing some unnecessary instability.  The root of
the problem is that /etc/nodepool/provider disappeared with zuulv3, so
we now always re-install the EPEL repo and overwrite the local EPEL
.repos files that were made during test setup and point to local
mirrors.

The other change is that we stopped installing the RDO repositories on
the testing nodes too.  That we were incorrectly taking this path and
reinstalling EPEL has hidden the removal of these packages from the
base image in the test, since it ends up installing them too.

Split the install into two parts -- epel and RDO.  Check for
/etc/ci/mirror_info.sh (the sourcable mirror script provided by base
test setup) and if so, just enable EPEL so we get the CI-mirror
version correctly.  Install the RDO repositories (if not already
installed) unconditionally.

Change-Id: Iccb045a6695deb10da4d68a5694e1fa45ccbb810
---
 stack.sh | 49 +++++++++++++++++++++++++++++++++----------------
 1 file changed, 33 insertions(+), 16 deletions(-)

diff --git a/stack.sh b/stack.sh
index 32eb43f292..e57ab7b6fc 100755
--- a/stack.sh
+++ b/stack.sh
@@ -282,7 +282,7 @@ fi
 # Some distros need to add repos beyond the defaults provided by the vendor
 # to pick up required packages.
 
-function _install_epel_and_rdo {
+function _install_epel {
     # NOTE: We always remove and install latest -- some environments
     # use snapshot images, and if EPEL version updates they break
     # unless we update them to latest version.
@@ -313,12 +313,27 @@ EOF
     yum_install epel-release || \
         die $LINENO "Error installing EPEL repo, cannot continue"
     sudo rm -f /etc/yum.repos.d/epel-bootstrap.repo
+}
 
-    # ... and also optional to be enabled
-    sudo yum-config-manager --enable rhel-7-server-optional-rpms
+function _install_rdo {
+    # There are multiple options for this, including using CloudSIG
+    # repositories (centos-release-*), trunk versions, etc.  Since
+    # we're not interested in the actual openstack distributions
+    # (since we're using git to run!) but only peripherial packages
+    # like kvm or ovs, this has been reliable.
+
+    # TODO(ianw): figure out how to best mirror -- probably use infra
+    # mirror RDO reverse proxy.  We could either have test
+    # infrastructure set it up disabled like EPEL, or fiddle it here.
+    # Per the point above, it's a bunch of repos so starts getting a
+    # little messy...
+    if ! is_package_installed rdo-release ; then
+        yum_install https://rdoproject.org/repos/rdo-release.rpm
+    fi
 
-    # install the lastest RDO
-    is_package_installed rdo-release || yum_install https://rdoproject.org/repos/rdo-release.rpm
+    # Also enable optional for RHEL7 proper.  Note this is a silent
+    # no-op on other platforms.
+    sudo yum-config-manager --enable rhel-7-server-optional-rpms
 
     if is_oraclelinux; then
         sudo yum-config-manager --enable ol7_optional_latest ol7_addons ol7_MySQL56
@@ -362,20 +377,22 @@ fi
 # to speed things up
 SKIP_EPEL_INSTALL=$(trueorfalse False SKIP_EPEL_INSTALL)
 
-# If we have /etc/nodepool/provider assume we're on a OpenStack CI
-# node, where EPEL is already pointing at our internal mirror and RDO
-# is pre-installed.
-if [[ -f /etc/nodepool/provider ]]; then
-    SKIP_EPEL_INSTALL=True
-    if is_fedora; then
-        # However, EPEL is not enabled by default.
+if [[ $DISTRO == "rhel7" ]]; then
+    # If we have /etc/ci/mirror_info.sh assume we're on a OpenStack CI
+    # node, where EPEL is installed (but disabled) and already
+    # pointing at our internal mirror
+    if [[ -f /etc/ci/mirror_info.sh ]]; then
+        SKIP_EPEL_INSTALL=True
         sudo yum-config-manager --enable epel
     fi
-fi
 
-if is_fedora && [[ $DISTRO == "rhel7" ]] && \
-        [[ ${SKIP_EPEL_INSTALL} != True ]]; then
-    _install_epel_and_rdo
+    if [[ ${SKIP_EPEL_INSTALL} != True ]]; then
+        _install_epel
+    fi
+    # Along with EPEL, CentOS (and a-likes) require some packages only
+    # available in RDO repositories (e.g. OVS, or later versions of
+    # kvm) to run.
+    _install_rdo
 fi
 
 # Ensure python is installed

From 6bcd8cad16c39dd8596d654eb4587e848d0db1fe Mon Sep 17 00:00:00 2001
From: Peter Penchev <openstack-dev@storpool.com>
Date: Fri, 12 Jan 2018 23:49:04 +0200
Subject: [PATCH 1239/2409] Bump the Cinder LVM backing file size to 24Gb.

This follows a change made to devstack-gate in commit 841ebc3 to allow
tempest to succeed even if it happens to run several volume tests in
parallel.  Right now it's possible for a tempest-full test (run without
devstack-gate) to fail with an "Insufficient free virtual space" error in
the cinder-scheduler log.

Suggested by: Clark Boylan <clark.boylan@gmail.com>
Closes-Bug: 1743597
Change-Id: I16ccb9976d1bc7c9f56a6a4d73e35042a5867ef9
---
 doc/source/configuration.rst | 2 +-
 stackrc                      | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index d932d8cd86..49cad05554 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -667,7 +667,7 @@ with ``VOLUME_BACKING_FILE_SIZE``.
 
         VOLUME_GROUP_NAME="stack-volumes"
         VOLUME_NAME_PREFIX="volume-"
-        VOLUME_BACKING_FILE_SIZE=10250M
+        VOLUME_BACKING_FILE_SIZE=24G
 
 
 Keystone
diff --git a/stackrc b/stackrc
index 286a04d3fe..d7ebdd87d4 100644
--- a/stackrc
+++ b/stackrc
@@ -762,8 +762,8 @@ for image_url in ${IMAGE_URLS//,/ }; do
     fi
 done
 
-# 10Gb default volume backing file size
-VOLUME_BACKING_FILE_SIZE=${VOLUME_BACKING_FILE_SIZE:-10250M}
+# 24Gb default volume backing file size
+VOLUME_BACKING_FILE_SIZE=${VOLUME_BACKING_FILE_SIZE:-24G}
 
 # Prefixes for volume and instance names
 VOLUME_NAME_PREFIX=${VOLUME_NAME_PREFIX:-volume-}

From 789301240adc7fa91cd34405bf87e15c3b21bc51 Mon Sep 17 00:00:00 2001
From: chengebj5238 <chengebj@inspur.com>
Date: Thu, 18 Jan 2018 15:53:27 +0800
Subject: [PATCH 1240/2409] URL changes are modified to be correct

Change-Id: Ied5ee7da0a37405f130f7cecff48919f16435952
---
 doc/source/configuration.rst                 | 2 +-
 doc/source/guides/devstack-with-lbaas-v2.rst | 2 +-
 doc/source/guides/neutron.rst                | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index d932d8cd86..919a053317 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -643,7 +643,7 @@ the instructions in ``./tools/xen/README.md``.
 Cells
 ~~~~~
 
-`Cells <http://wiki.openstack.org/blueprint-nova-compute-cells>`__ is
+`Cells <https://wiki.openstack.org/wiki/Blueprint-nova-compute-cells>`__ is
 an alternative scaling option.  To setup a cells environment add the
 following to your ``localrc`` section:
 
diff --git a/doc/source/guides/devstack-with-lbaas-v2.rst b/doc/source/guides/devstack-with-lbaas-v2.rst
index 3592844efb..7dee520a23 100644
--- a/doc/source/guides/devstack-with-lbaas-v2.rst
+++ b/doc/source/guides/devstack-with-lbaas-v2.rst
@@ -2,7 +2,7 @@ Configure Load-Balancer Version 2
 =================================
 
 Starting in the OpenStack Liberty release, the
-`neutron LBaaS v2 API <http://developer.openstack.org/api-ref-networking-v2-ext.html>`_
+`neutron LBaaS v2 API <https://developer.openstack.org/api-ref/network/v2/index.html>`_
 is now stable while the LBaaS v1 API has been deprecated.  The LBaaS v2 reference
 driver is based on Octavia.
 
diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index 092809a1cf..1b8dccd7f3 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -396,7 +396,7 @@ controller node.
 
 In this configuration we are defining IPV4_ADDRS_SAFE_TO_USE to be a
 publicly routed IPv4 subnet. In this specific instance we are using
-the special TEST-NET-3 subnet defined in `RFC 5737 <http://tools.ietf.org/html/rfc5737>`_,
+the special TEST-NET-3 subnet defined in `RFC 5737 <https://tools.ietf.org/html/rfc5737>`_,
 which is used for documentation.  In your DevStack setup, IPV4_ADDRS_SAFE_TO_USE
 would be a public IP address range that you or your organization has
 allocated to you, so that you could access your instances from the

From ffd0047afa78bfd4d6576afe1d4b8c79435b158c Mon Sep 17 00:00:00 2001
From: Stephen Finucane <sfinucan@redhat.com>
Date: Thu, 18 Jan 2018 15:12:29 +0000
Subject: [PATCH 1241/2409] functions-common: Don't reguess Python versions

We have already established the correct version of Python to use during
installation, either automatically or through user-provided information
(USE_PYTHON3, PYTHON3_VERSION). Don't do it again.

Change-Id: I7bdf2be9a885994bf2c437dd104048a1ff2f6666
Closes-Bug: #1744096
---
 functions-common | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/functions-common b/functions-common
index df295a3395..78710deeb0 100644
--- a/functions-common
+++ b/functions-common
@@ -2301,12 +2301,7 @@ function install_oscwrap {
 
 function cleanup_oscwrap {
     local total=0
-    if python3_enabled ; then
-        local python=python3
-    else
-        local python=python
-    fi
-    total=$(cat $OSCWRAP_TIMER_FILE | $python -c "import sys; print(sum(int(l) for l in sys.stdin))")
+    total=$(cat $OSCWRAP_TIMER_FILE | $PYTHON -c "import sys; print(sum(int(l) for l in sys.stdin))")
     _TIME_TOTAL["osc"]=$total
     rm $OSCWRAP_TIMER_FILE
 }

From bb7d2f233b92a3f9ee17ad0702fecb68bbf1e712 Mon Sep 17 00:00:00 2001
From: Tim Swanson <tiswanso@cisco.com>
Date: Sat, 16 Dec 2017 17:14:10 -0500
Subject: [PATCH 1242/2409] Allow public router external net to use a non-flat
 provider network.

Allow users to auto-create a neutron non-flat providernet public network
and use it for external router interfaces.  By default, keep the existing
flat network type behavior.

Change-Id: I64f71b0c9fcac97b9b84b7d30ee61659b2a690f1
---
 lib/neutron_plugins/services/l3 | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 41a467df4c..9be32b79aa 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -39,9 +39,9 @@ Q_PUBLIC_VETH_INT=${Q_PUBLIC_VETH_INT:-veth-pub-int}
 Q_L3_ROUTER_PER_TENANT=${Q_L3_ROUTER_PER_TENANT:-True}
 
 
-# Use flat providernet for public network
+# Use providernet for public network
 #
-# If Q_USE_PROVIDERNET_FOR_PUBLIC=True, use a flat provider network
+# If Q_USE_PROVIDERNET_FOR_PUBLIC=True, use a provider network
 # for external interface of neutron l3-agent.  In that case,
 # PUBLIC_PHYSICAL_NETWORK specifies provider:physical_network value
 # used for the network.  In case of ofagent, you should add the
@@ -59,6 +59,10 @@ Q_L3_ROUTER_PER_TENANT=${Q_L3_ROUTER_PER_TENANT:-True}
 #    Q_USE_PROVIDERNET_FOR_PUBLIC=True
 #    PUBLIC_PHYSICAL_NETWORK=public
 #    OVS_BRIDGE_MAPPINGS=public:br-ex
+#
+# The provider-network-type defaults to flat, however, the values
+# PUBLIC_PROVIDERNET_TYPE and PUBLIC_PROVIDERNET_SEGMENTATION_ID could
+# be set to specify the parameters for an alternate network type.
 Q_USE_PROVIDERNET_FOR_PUBLIC=${Q_USE_PROVIDERNET_FOR_PUBLIC:-True}
 PUBLIC_PHYSICAL_NETWORK=${PUBLIC_PHYSICAL_NETWORK:-public}
 
@@ -240,7 +244,7 @@ function create_neutron_initial_network {
         fi
         # Create an external network, and a subnet. Configure the external network as router gw
         if [ "$Q_USE_PROVIDERNET_FOR_PUBLIC" = "True" ]; then
-            EXT_NET_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" network create "$PUBLIC_NETWORK_NAME" $EXTERNAL_NETWORK_FLAGS --provider-network-type flat --provider-physical-network ${PUBLIC_PHYSICAL_NETWORK} | grep ' id ' | get_field 2)
+            EXT_NET_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" network create "$PUBLIC_NETWORK_NAME" $EXTERNAL_NETWORK_FLAGS --provider-network-type ${PUBLIC_PROVIDERNET_TYPE:-flat} ${PUBLIC_PROVIDERNET_SEGMENTATION_ID:+--provider-segment $PUBLIC_PROVIDERNET_SEGMENTATION_ID} --provider-physical-network ${PUBLIC_PHYSICAL_NETWORK} | grep ' id ' | get_field 2)
         else
             EXT_NET_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" network create "$PUBLIC_NETWORK_NAME" $EXTERNAL_NETWORK_FLAGS | grep ' id ' | get_field 2)
         fi

From ffe691ecd5f77795666baa9317910de8d6b858e1 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem@us.ibm.com>
Date: Tue, 12 Jan 2016 17:58:44 -0800
Subject: [PATCH 1243/2409] tempest: set
 compute-feature-enabled.volume_multiattach

This adds the ENABLE_VOLUME_MULTIATTACH flag and if True
configures Tempest to run volume multiattach tests.

Note that due to https://bugzilla.redhat.com/show_bug.cgi?id=1378242
we can't run multiattach tests with the Pike UCA packages since
those include qemu 2.10 and libvirt 3.6, and the valid versions for
multiattach support with libvirt is qemu<2.10 or libvirt>=3.10.

Depends-On: I80c20914c03d7371e798ca3567c37307a0d54aaa
Depends-On: I158c6f20e3e6a24bd2e5299abbeb3fc5208e5885

Part of nova blueprint multi-attach-volume

Change-Id: I46b7eabf6a28f230666f6933a087f73cb4408348
---
 lib/tempest          |  4 ++++
 stackrc              | 12 +++++++++++-
 tools/fixup_stuff.sh |  7 ++++++-
 3 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 35dbb7b6a1..3b39dae422 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -382,6 +382,10 @@ function configure_tempest {
         fi
     fi
 
+    if [[ $ENABLE_VOLUME_MULTIATTACH == "True" ]]; then
+        iniset $TEMPEST_CONFIG compute-feature-enabled volume_multiattach True
+    fi
+
     if is_service_enabled n-novnc; then
         iniset $TEMPEST_CONFIG compute-feature-enabled vnc_console True
     fi
diff --git a/stackrc b/stackrc
index 286a04d3fe..ba218b9a38 100644
--- a/stackrc
+++ b/stackrc
@@ -601,6 +601,11 @@ NOVNC_BRANCH=${NOVNC_BRANCH:-stable/v0.6}
 SPICE_REPO=${SPICE_REPO:-http://anongit.freedesktop.org/git/spice/spice-html5.git}
 SPICE_BRANCH=${SPICE_BRANCH:-master}
 
+# Global flag used to configure Tempest and potentially other services if
+# volume multiattach is supported. In Queens, only the libvirt compute driver
+# and lvm volume driver support multiattach, and qemu must be less than 2.10
+# or libvirt must be greater than or equal to 3.10.
+ENABLE_VOLUME_MULTIATTACH=$(trueorfalse False ENABLE_VOLUME_MULTIATTACH)
 
 # Nova hypervisor configuration.  We default to libvirt with **kvm** but will
 # drop back to **qemu** if we are unable to load the kvm module.  ``stack.sh`` can
@@ -612,7 +617,12 @@ VIRT_DRIVER=${VIRT_DRIVER:-$DEFAULT_VIRT_DRIVER}
 case "$VIRT_DRIVER" in
     ironic|libvirt)
         LIBVIRT_TYPE=${LIBVIRT_TYPE:-kvm}
-        if [[ "$os_VENDOR" =~ (Debian|Ubuntu) ]]; then
+        # If ENABLE_VOLUME_MULTIATTACH is True, the Ubuntu Cloud Archive can't
+        # be used until it provides libvirt>=3.10, and with older versions of
+        # Ubuntu the group is "libvirtd".
+        # TODO(mriedem): Remove the ENABLE_VOLUME_MULTIATTACH check when
+        # UCA has libvirt>=3.10.
+        if [[ "$os_VENDOR" =~ (Debian|Ubuntu) && "${ENABLE_VOLUME_MULTIATTACH}" == "False" ]]; then
             # The groups change with newer libvirt. Older Ubuntu used
             # 'libvirtd', but now uses libvirt like Debian. Do a quick check
             # to see if libvirtd group already exists to handle grenade's case.
diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index efe0125741..f78f05f2f8 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -75,7 +75,12 @@ fi
 # Make it possible to switch this based on an environment variable as
 # libvirt 2.5.0 doesn't handle nested virtualization quite well and this
 # is required for the trove development environment.
-if [[ "${ENABLE_UBUNTU_CLOUD_ARCHIVE}" == "True" && "$DISTRO" = "xenial" ]]; then
+# The Pike UCA has qemu 2.10 but libvirt 3.6, therefore if
+# ENABLE_VOLUME_MULTIATTACH is True, we can't use the Pike UCA
+# because multiattach won't work with those package versions.
+# We can remove this check when the UCA has libvirt>=3.10.
+if [[ "${ENABLE_UBUNTU_CLOUD_ARCHIVE}" == "True" && "$DISTRO" = "xenial" && \
+        "${ENABLE_VOLUME_MULTIATTACH}" == "False" ]]; then
     # This pulls in apt-add-repository
     install_package "software-properties-common"
     # Use UCA for newer libvirt. Should give us libvirt 2.5.0.

From 0b45e2f8e8d120d9103e735c580e6f7396df3e29 Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Thu, 18 Jan 2018 17:41:04 -0600
Subject: [PATCH 1244/2409] Remove hack for ubuntu cloud archive

There is a hack here to set up ubuntu cloud archive, pinning it to
mirror.dfw.rax.openstack.org. The mirror-info role seems to be doing
this correctly now though, so let's remove the hack and let things work
normally.

Change-Id: I283cb3452245b64e9492806f06404b484f21c358
---
 playbooks/pre.yaml | 12 ------------
 1 file changed, 12 deletions(-)

diff --git a/playbooks/pre.yaml b/playbooks/pre.yaml
index d61fd45de0..6681fb20a5 100644
--- a/playbooks/pre.yaml
+++ b/playbooks/pre.yaml
@@ -18,15 +18,3 @@
     - setup-devstack-cache
     - start-fresh-logging
     - write-devstack-local-conf
-  # TODO(jeblair): remove when configure-mirrors is fixed
-  tasks:
-    - name: Hack mirror_info
-      shell:
-        _raw_params: |
-          mkdir /etc/ci
-          cat << "EOF" > /etc/ci/mirror_info.sh
-          export NODEPOOL_UCA_MIRROR=http://mirror.dfw.rax.openstack.org/ubuntu-cloud-archive
-          EOF
-      args:
-        executable: /bin/bash
-      become: true

From 64039ef3008ccacbacad5c45dbc1881af4e868fa Mon Sep 17 00:00:00 2001
From: Vasyl Saienko <vsaienko@mirantis.com>
Date: Tue, 23 Jan 2018 12:06:57 +0200
Subject: [PATCH 1245/2409] Increse api_max_retries and api_retry_interval for
 ironic

There is no way to upgrade ironic before nova because of
grenade design. In multinode job we do not restart nova
as we test partial upgrade of ironic there.
On slow nodes upgrading ironic takes time and nova looses
ironic connectivity

This patch increases api_retry_interval and api_max_retries
to make sure we have a time to upgrade ironic before nova
compute stuck.

Change-Id: I3b1429d6561431a82edda04a0e574cac38771837
---
 lib/nova_plugins/hypervisor-ironic | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/nova_plugins/hypervisor-ironic b/lib/nova_plugins/hypervisor-ironic
index ee1a0e0a5e..c91f70b9bb 100644
--- a/lib/nova_plugins/hypervisor-ironic
+++ b/lib/nova_plugins/hypervisor-ironic
@@ -58,6 +58,9 @@ function configure_nova_hypervisor {
     iniset $NOVA_CONF ironic project_domain_id default
     iniset $NOVA_CONF ironic user_domain_id default
     iniset $NOVA_CONF ironic project_name demo
+
+    iniset $NOVA_CONF ironic api_max_retries 300
+    iniset $NOVA_CONF ironic api_retry_interval 5
 }
 
 # install_nova_hypervisor() - Install external components

From 8dd918c59e630cc9e7be87b8eb35aa12079e3693 Mon Sep 17 00:00:00 2001
From: Kaitlin Farr <kaitlin.farr@jhuapl.edu>
Date: Tue, 24 Oct 2017 09:34:03 -0400
Subject: [PATCH 1246/2409] Update nova api_class setting to backend

Castellan switches the `api_class` config option to `backend`. The change
is still backwards compatible with the old `api_class` setting, but cinder
already updated to use the new option (see I5e46c738531d5d56777e91a00f4cee9531356f2e)
and it is better to use the new setting.

Change-Id: Ib609c82e7076d19676baaf4f08abd79ea11db0e3
---
 lib/nova | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index c40c43af6c..db88474f55 100644
--- a/lib/nova
+++ b/lib/nova
@@ -424,7 +424,7 @@ function create_nova_conf {
     iniset $NOVA_CONF DEFAULT osapi_compute_listen "$NOVA_SERVICE_LISTEN_ADDRESS"
     iniset $NOVA_CONF DEFAULT metadata_listen "$NOVA_SERVICE_LISTEN_ADDRESS"
 
-    iniset $NOVA_CONF key_manager api_class nova.keymgr.conf_key_mgr.ConfKeyManager
+    iniset $NOVA_CONF key_manager backend nova.keymgr.conf_key_mgr.ConfKeyManager
 
     if is_fedora || is_suse; then
         # nova defaults to /usr/local/bin, but fedora and suse pip like to

From 842d54a2997adaf65369e56942e1d4f2b27aeb77 Mon Sep 17 00:00:00 2001
From: Ryota MIBU <r-mibu@cq.jp.nec.com>
Date: Mon, 25 Dec 2017 16:28:50 +0900
Subject: [PATCH 1247/2409] use openstack command instead of nova command

In function 'get_instance_ip', 'nova' client command is used to get
instance information in order to retrive IP address of the instance.

There is no need to use the nova command, since 'openstack' client
already supports such basic operation.

Moreover, 'openstack' client has an option to get value of specified
column. That brings more accurate way of retriving IP address.

This patch replaces nova command in 'get_instance_ip' by 'openstack'
command. Note, this nova command is the only one in devstack tree.

Change-Id: Iee0b81a994a4da5b3f4572c2e8eb30514cd43f89
Signed-off-by: Ryota MIBU <r-mibu@cq.jp.nec.com>
---
 functions | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/functions b/functions
index 20b83b3cd0..959133ce5c 100644
--- a/functions
+++ b/functions
@@ -503,13 +503,13 @@ function ping_check {
 function get_instance_ip {
     local vm_id=$1
     local network_name=$2
-    local nova_result
+    local addresses
     local ip
 
-    nova_result="$(nova show $vm_id)"
-    ip=$(echo "$nova_result" | grep "$network_name" | get_field 2)
+    addresses=$(openstack server show -c addresses -f value "$vm_id")
+    ip=$(echo $addresses | sed -n "s/^.*$network_name=\([0-9\.]*\).*$/\1/p")
     if [[ $ip = "" ]];then
-        echo "$nova_result"
+        echo "addresses of server $vm_id : $addresses"
         die $LINENO "[Fail] Couldn't get ipaddress of VM"
     fi
     echo $ip

From 7f3248229b170fe954af9a67a578bf6cd34d2b23 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Fri, 26 Jan 2018 06:19:49 +0000
Subject: [PATCH 1248/2409] Updated from generate-devstack-plugins-list

Change-Id: I0648e5cd08bb88d5972726241da3d396ad1d0129
---
 doc/source/plugin-registry.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 31812aeefb..1dab9ce9f5 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -33,7 +33,6 @@ blazar                                 `git://git.openstack.org/openstack/blazar
 broadview-collector                    `git://git.openstack.org/openstack/broadview-collector <https://git.openstack.org/cgit/openstack/broadview-collector>`__
 ceilometer                             `git://git.openstack.org/openstack/ceilometer <https://git.openstack.org/cgit/openstack/ceilometer>`__
 ceilometer-powervm                     `git://git.openstack.org/openstack/ceilometer-powervm <https://git.openstack.org/cgit/openstack/ceilometer-powervm>`__
-cerberus                               `git://git.openstack.org/openstack/cerberus <https://git.openstack.org/cgit/openstack/cerberus>`__
 cloudkitty                             `git://git.openstack.org/openstack/cloudkitty <https://git.openstack.org/cgit/openstack/cloudkitty>`__
 collectd-ceilometer-plugin             `git://git.openstack.org/openstack/collectd-ceilometer-plugin <https://git.openstack.org/cgit/openstack/collectd-ceilometer-plugin>`__
 congress                               `git://git.openstack.org/openstack/congress <https://git.openstack.org/cgit/openstack/congress>`__
@@ -95,6 +94,7 @@ monasca-api                            `git://git.openstack.org/openstack/monasc
 monasca-ceilometer                     `git://git.openstack.org/openstack/monasca-ceilometer <https://git.openstack.org/cgit/openstack/monasca-ceilometer>`__
 monasca-events-api                     `git://git.openstack.org/openstack/monasca-events-api <https://git.openstack.org/cgit/openstack/monasca-events-api>`__
 monasca-log-api                        `git://git.openstack.org/openstack/monasca-log-api <https://git.openstack.org/cgit/openstack/monasca-log-api>`__
+monasca-tempest-plugin                 `git://git.openstack.org/openstack/monasca-tempest-plugin <https://git.openstack.org/cgit/openstack/monasca-tempest-plugin>`__
 monasca-transform                      `git://git.openstack.org/openstack/monasca-transform <https://git.openstack.org/cgit/openstack/monasca-transform>`__
 murano                                 `git://git.openstack.org/openstack/murano <https://git.openstack.org/cgit/openstack/murano>`__
 networking-6wind                       `git://git.openstack.org/openstack/networking-6wind <https://git.openstack.org/cgit/openstack/networking-6wind>`__

From 744a829ce0b0a61a9b3be5afa8dfb4a258c69f11 Mon Sep 17 00:00:00 2001
From: shutingm <shutingm@vmware.com>
Date: Sun, 28 Jan 2018 23:06:40 -0800
Subject: [PATCH 1249/2409] Add the dependent package for python-pcre
 installation

This patch add libpcre3-dev and pcre-devel package for python-pcre
installation.

Closes-Bug: #1745606

Change-Id: I59fc688519341c90dc33b79d536f0625a6c4dd17
---
 files/debs/general | 1 +
 files/rpms/general | 1 +
 2 files changed, 2 insertions(+)

diff --git a/files/debs/general b/files/debs/general
index 8e0018d284..df872a0a6c 100644
--- a/files/debs/general
+++ b/files/debs/general
@@ -15,6 +15,7 @@ libapache2-mod-proxy-uwsgi
 libffi-dev # for pyOpenSSL
 libjpeg-dev # Pillow 3.0.0
 libmysqlclient-dev  # MySQL-python
+libpcre3-dev # for python-pcre
 libpq-dev  # psycopg2
 libssl-dev # for pyOpenSSL
 libsystemd-dev # for systemd-python
diff --git a/files/rpms/general b/files/rpms/general
index 878b935a1b..5d9a4ad5a5 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -22,6 +22,7 @@ net-tools
 openssh-server
 openssl
 openssl-devel # to rebuild pyOpenSSL if needed
+pcre-devel # for python-pcre
 pkgconfig
 postgresql-devel  # psycopg2
 psmisc

From 540141cc1c32dbd451c0cc7805eda84c2e248a8f Mon Sep 17 00:00:00 2001
From: Jianghua Wang <jianghua.wang@citrix.com>
Date: Tue, 30 Jan 2018 03:18:17 +0000
Subject: [PATCH 1250/2409] Remove libpcre3-dev&pcre-devel from horizon
 prerequisite

As libpcre3-dev&pcre-devel are now added as general prerequisite,
remove it from horizon prerequisite.

Change-Id: I872aec210028373c39baee0ab846469fd9920de9
---
 files/debs/horizon | 1 -
 files/rpms/horizon | 1 -
 2 files changed, 2 deletions(-)

diff --git a/files/debs/horizon b/files/debs/horizon
index 1f45b54f7c..48332893b1 100644
--- a/files/debs/horizon
+++ b/files/debs/horizon
@@ -1,3 +1,2 @@
 apache2  # NOPRIME
 libapache2-mod-wsgi  # NOPRIME
-libpcre3-dev  # pyScss
diff --git a/files/rpms/horizon b/files/rpms/horizon
index aeb2cb5c96..fa5601a95f 100644
--- a/files/rpms/horizon
+++ b/files/rpms/horizon
@@ -1,5 +1,4 @@
 Django
 httpd # NOPRIME
 mod_wsgi  # NOPRIME
-pcre-devel  # pyScss
 pyxattr

From a904caded4269039a087292a8b7b95eb2de21142 Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Mon, 22 Jan 2018 16:18:55 -0600
Subject: [PATCH 1251/2409] Move zuul_copy_output to be a job variable

The zuul_copy_output variable is designed to be able to be used as
a zuul job variable so that zuul dictionary merging will work. However,
it's currently being set in the playbook rather than as a job variable,
so it's not possible to supplement it in a child job.

Move it to be a job variable. Also remove the wrapping {} as they should
not be needed to make zuul_copy_output a dictionary.

Change-Id: I78c7fed47c2ab868384c74dbff7904d33d510dd9
---
 .zuul.yaml          | 34 ++++++++++++++++++++++++++++++++++
 playbooks/post.yaml | 34 ----------------------------------
 2 files changed, 34 insertions(+), 34 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 037e9a9ea8..0de71f7c5f 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -77,6 +77,40 @@
       devstack_services:
         horizon: false
         tempest: false
+      zuul_copy_output:
+        '{{ devstack_conf_dir }}/local.conf': 'logs'
+        '{{ devstack_conf_dir }}/localrc': 'logs'
+        '{{ devstack_conf_dir }}/.stackenv': 'logs'
+        '{{ devstack_log_dir }}/dstat-csv.log': 'logs'
+        '{{ devstack_log_dir }}/devstacklog.txt': 'logs'
+        '{{ devstack_log_dir }}/devstacklog.txt.summary': 'logs'
+        '{{ devstack_full_log}}': 'logs'
+        '{{ stage_dir }}/verify_tempest_conf.log': 'logs'
+        '{{ stage_dir }}/apache': 'logs'
+        '{{ stage_dir }}/apache_config': 'logs'
+        '{{ stage_dir }}/etc': 'logs'
+        '/var/log/rabbitmq': 'logs'
+        '/var/log/postgresql': 'logs'
+        '/var/log/mysql.err': 'logs'
+        '/var/log/mysql.log': 'logs'
+        '/var/log/libvirt': 'logs'
+        '/etc/sudoers': 'logs'
+        '/etc/sudoers.d': 'logs'
+        '{{ stage_dir }}/iptables.txt': 'logs'
+        '{{ stage_dir }}/df.txt': 'logs'
+        '{{ stage_dir }}/pip2-freeze.txt': 'logs'
+        '{{ stage_dir }}/pip3-freeze.txt': 'logs'
+        '{{ stage_dir }}/dpkg-l.txt': 'logs'
+        '{{ stage_dir }}/rpm-qa.txt': 'logs'
+        '{{ stage_dir }}/core': 'logs'
+        '{{ stage_dir }}/listen53.txt': 'logs'
+        '{{ stage_dir }}/deprecations.log': 'logs'
+        '/var/log/ceph': 'logs'
+        '/var/log/openvswitch': 'logs'
+        '/var/log/glusterfs': 'logs'
+        '/etc/glusterfs/glusterd.vol': 'logs'
+        '/etc/resolv.conf': 'logs'
+        '/var/log/unbound.log': 'logs'
     pre-run: playbooks/pre.yaml
     run: playbooks/devstack.yaml
     post-run: playbooks/post.yaml
diff --git a/playbooks/post.yaml b/playbooks/post.yaml
index 0c5e83b6a0..d8ee99e783 100644
--- a/playbooks/post.yaml
+++ b/playbooks/post.yaml
@@ -24,40 +24,6 @@
     # capture-system-logs should be the last role before stage-output
     - capture-system-logs
     - role: stage-output
-      zuul_copy_output:
-        { '{{ devstack_conf_dir }}/local.conf': 'logs',
-          '{{ devstack_conf_dir }}/localrc': 'logs',
-          '{{ devstack_conf_dir }}/.stackenv': 'logs' ,
-          '{{ devstack_log_dir }}/dstat-csv.log': 'logs',
-          '{{ devstack_log_dir }}/devstacklog.txt': 'logs',
-          '{{ devstack_log_dir }}/devstacklog.txt.summary': 'logs',
-          '{{ devstack_full_log}}': 'logs',
-          '{{ stage_dir }}/verify_tempest_conf.log': 'logs',
-          '{{ stage_dir }}/apache': 'logs',
-          '{{ stage_dir }}/apache_config': 'logs',
-          '{{ stage_dir }}/etc': 'logs',
-          '/var/log/rabbitmq': 'logs',
-          '/var/log/postgresql': 'logs',
-          '/var/log/mysql.err': 'logs',
-          '/var/log/mysql.log': 'logs',
-          '/var/log/libvirt': 'logs',
-          '/etc/sudoers': 'logs',
-          '/etc/sudoers.d': 'logs',
-          '{{ stage_dir }}/iptables.txt': 'logs',
-          '{{ stage_dir }}/df.txt': 'logs',
-          '{{ stage_dir }}/pip2-freeze.txt': 'logs',
-          '{{ stage_dir }}/pip3-freeze.txt': 'logs',
-          '{{ stage_dir }}/dpkg-l.txt': 'logs',
-          '{{ stage_dir }}/rpm-qa.txt': 'logs',
-          '{{ stage_dir }}/core': 'logs',
-          '{{ stage_dir }}/listen53.txt': 'logs',
-          '{{ stage_dir }}/deprecations.log': 'logs',
-          '/var/log/ceph': 'logs',
-          '/var/log/openvswitch': 'logs',
-          '/var/log/glusterfs': 'logs',
-          '/etc/glusterfs/glusterd.vol': 'logs',
-          '/etc/resolv.conf': 'logs',
-          '/var/log/unbound.log': 'logs' }
       extensions_to_txt:
         - conf
         - log

From bf1e6e7a34cfdbb859aa072666b7018ef7387e9e Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Thu, 1 Feb 2018 06:18:22 +0000
Subject: [PATCH 1252/2409] Updated from generate-devstack-plugins-list

Change-Id: Idda642196d42d6ae930f4978c88c1b53124b7ead
---
 doc/source/plugin-registry.rst | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 1dab9ce9f5..d830507f07 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -78,6 +78,7 @@ keystone                               `git://git.openstack.org/openstack/keysto
 kingbird                               `git://git.openstack.org/openstack/kingbird <https://git.openstack.org/cgit/openstack/kingbird>`__
 kuryr-kubernetes                       `git://git.openstack.org/openstack/kuryr-kubernetes <https://git.openstack.org/cgit/openstack/kuryr-kubernetes>`__
 kuryr-libnetwork                       `git://git.openstack.org/openstack/kuryr-libnetwork <https://git.openstack.org/cgit/openstack/kuryr-libnetwork>`__
+kuryr-tempest-plugin                   `git://git.openstack.org/openstack/kuryr-tempest-plugin <https://git.openstack.org/cgit/openstack/kuryr-tempest-plugin>`__
 magnum                                 `git://git.openstack.org/openstack/magnum <https://git.openstack.org/cgit/openstack/magnum>`__
 magnum-ui                              `git://git.openstack.org/openstack/magnum-ui <https://git.openstack.org/cgit/openstack/magnum-ui>`__
 manila                                 `git://git.openstack.org/openstack/manila <https://git.openstack.org/cgit/openstack/manila>`__
@@ -130,6 +131,7 @@ networking-spp                         `git://git.openstack.org/openstack/networ
 networking-vpp                         `git://git.openstack.org/openstack/networking-vpp <https://git.openstack.org/cgit/openstack/networking-vpp>`__
 networking-vsphere                     `git://git.openstack.org/openstack/networking-vsphere <https://git.openstack.org/cgit/openstack/networking-vsphere>`__
 neutron                                `git://git.openstack.org/openstack/neutron <https://git.openstack.org/cgit/openstack/neutron>`__
+neutron-classifier                     `git://git.openstack.org/openstack/neutron-classifier <https://git.openstack.org/cgit/openstack/neutron-classifier>`__
 neutron-dynamic-routing                `git://git.openstack.org/openstack/neutron-dynamic-routing <https://git.openstack.org/cgit/openstack/neutron-dynamic-routing>`__
 neutron-fwaas                          `git://git.openstack.org/openstack/neutron-fwaas <https://git.openstack.org/cgit/openstack/neutron-fwaas>`__
 neutron-fwaas-dashboard                `git://git.openstack.org/openstack/neutron-fwaas-dashboard <https://git.openstack.org/cgit/openstack/neutron-fwaas-dashboard>`__

From 854cb67636c478143ed0071d44a84447a72e87a7 Mon Sep 17 00:00:00 2001
From: Peter Penchev <openstack-dev@storpool.com>
Date: Thu, 14 Dec 2017 21:45:52 +0000
Subject: [PATCH 1253/2409] Allow a non-127.0.0.1 definition for the hostname.

In some environments it might be useful to resolve the hostname to
an IP address that is reachable by other hosts in the local network.
If some of the configuration scripts have taken care of putting
a proper line in /etc/hosts, do not try to override it by appending
a 127.0.0.1 one.

Change-Id: I7ae20a66c473b0c683803cc44654cd95fcce3639
Closes-Bug: 1746751
---
 stack.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index 32eb43f292..266ae7c11a 100755
--- a/stack.sh
+++ b/stack.sh
@@ -353,7 +353,7 @@ safe_chmod 0755 $DATA_DIR
 # Certain services such as rabbitmq require that the local hostname resolves
 # correctly.  Make sure it exists in /etc/hosts so that is always true.
 LOCAL_HOSTNAME=`hostname -s`
-if [ -z "`grep ^127.0.0.1 /etc/hosts | grep $LOCAL_HOSTNAME`" ]; then
+if ! fgrep -qwe "$LOCAL_HOSTNAME" /etc/hosts; then
     sudo sed -i "s/\(^127.0.0.1.*\)/\1 $LOCAL_HOSTNAME/" /etc/hosts
 fi
 

From 6e316daf45032ce9a43e0c995ced2682c950cc3b Mon Sep 17 00:00:00 2001
From: "James E. Blair" <jeblair@redhat.com>
Date: Wed, 24 Jan 2018 16:52:00 -0800
Subject: [PATCH 1254/2409] Zuul: Remove project name

Zuul no longer requires the project-name for in-repo configuration.
Omitting it makes forking or renaming projects easier.

Change-Id: I32868cec22149ec1c18fe2737a65e88d32bff531
---
 .zuul.yaml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 037e9a9ea8..0595b98400 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -46,7 +46,7 @@
       - zuul: openstack-infra/openstack-zuul-jobs
     timeout: 7200
     vars:
-      test_matrix_configs: ['neutron', 'tlsproxy']
+      test_matrix_configs: [neutron, tlsproxy]
       devstack_localrc:
         DATABASE_PASSWORD: secretdatabase
         RABBIT_PASSWORD: secretrabbit
@@ -154,7 +154,6 @@
     run: playbooks/tox/run.yaml
 
 - project:
-    name: openstack-dev/devstack
     check:
       jobs:
         - devstack

From 0f39756f6158bf5cf9a7bfc7eda655b883002722 Mon Sep 17 00:00:00 2001
From: Andrea Frittoli <andrea.frittoli@gmail.com>
Date: Fri, 2 Feb 2018 17:03:24 +0000
Subject: [PATCH 1255/2409] Make the apache-logs-conf role less verbose

The role is logging a lot of useless data with all the stat info
from various config and log files. Remove verbosity using no_log.

Change-Id: I72c721573ffc4a14adc3e2b29285c1071b7ec4f7
---
 roles/apache-logs-conf/tasks/main.yaml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/roles/apache-logs-conf/tasks/main.yaml b/roles/apache-logs-conf/tasks/main.yaml
index 7fd490ea4c..60b4fbfead 100644
--- a/roles/apache-logs-conf/tasks/main.yaml
+++ b/roles/apache-logs-conf/tasks/main.yaml
@@ -64,12 +64,14 @@
     path: "{{ apache_config_paths[ansible_os_family] }}"
     file_type: any
   register: apache_configs
+  no_log: true
 
 - name: Dereference configurations
   stat:
     path: "{{ item.path }}"
   with_items: "{{ apache_configs.files }}"
   register: apache_configs_deref
+  no_log: true
 
 - name: Link configurations
   file:
@@ -78,3 +80,4 @@
     state: hard
   with_items: "{{ apache_configs_deref.results }}"
   when: item.stat.isreg or item.stat.islnk
+  no_log: true

From 63171eeae238c09cbda8c37fc55af0cd43edd82c Mon Sep 17 00:00:00 2001
From: "Andrea Frittoli (andreaf)" <andrea.frittoli@gmail.com>
Date: Wed, 31 Jan 2018 21:01:36 +0000
Subject: [PATCH 1256/2409] Move extensions_to_txt to the job defintion

Move extensions_to_txt to the job defintion so that it may be
extended by descendant jobs.

Depends-on: https://review.openstack.org/540485/

Change-Id: I6e9009faa1451698ed781ce1ffdd9f22c97daa93
---
 .zuul.yaml          | 6 ++++++
 playbooks/post.yaml | 6 ------
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 0de71f7c5f..8fe4535814 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -111,6 +111,12 @@
         '/etc/glusterfs/glusterd.vol': 'logs'
         '/etc/resolv.conf': 'logs'
         '/var/log/unbound.log': 'logs'
+      extensions_to_txt:
+        conf: True
+        log: True
+        localrc: True
+        stackenv: True
+        summary: True
     pre-run: playbooks/pre.yaml
     run: playbooks/devstack.yaml
     post-run: playbooks/post.yaml
diff --git a/playbooks/post.yaml b/playbooks/post.yaml
index d8ee99e783..9e66f20e9e 100644
--- a/playbooks/post.yaml
+++ b/playbooks/post.yaml
@@ -24,12 +24,6 @@
     # capture-system-logs should be the last role before stage-output
     - capture-system-logs
     - role: stage-output
-      extensions_to_txt:
-        - conf
-        - log
-        - localrc
-        - stackenv
-        - summary
     # NOTE(andreaf) We need fetch-devstack-log-dir only as long as the base job
     # starts pulling logs for us from {{ ansible_user_dir }}/logs.
     # Meanwhile we already store things in ansible_user_dir and use

From da6de10f5dda20fc023a8215b13b873a068b6a37 Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Mon, 22 Jan 2018 11:42:01 +0000
Subject: [PATCH 1257/2409] fixed_key: By default use a hardcoded fixed_key
 across devstack envs

This change mimics how fixed_key would actually be deployed in a real
world environment, with a single key shared across Nova and Cinder
across all hosts.

Change-Id: I50a48e2da57a1cc1ecd250150ea6e9c3745baaca
---
 stack.sh | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/stack.sh b/stack.sh
index 32eb43f292..f72347557a 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1241,16 +1241,17 @@ if is_service_enabled g-reg; then
     done
 fi
 
-# Create a randomized default value for the key manager's fixed_key
-# NOTE(lyarwood): This is currently set to 36 as a workaround to the following
-# libvirt bug that incorrectly pads passphrases that are a multiple of 16 bytes
-# in length.
-# Unable to use LUKS passphrase that is exactly 16 bytes long
-# https://bugzilla.redhat.com/show_bug.cgi?id=1447297
+# NOTE(lyarwood): By default use a single hardcoded fixed_key across devstack
+# deployments.  This ensures the keys match across nova and cinder across all
+# hosts.
+FIXED_KEY=${FIXED_KEY:-bae3516cc1c0eb18b05440eba8012a4a880a2ee04d584a9c1579445e675b12defdc716ec}
 if is_service_enabled nova; then
-    key=$(generate_hex_string 36)
-    iniset $NOVA_CONF key_manager fixed_key "$key"
-    iniset $NOVA_CPU_CONF key_manager fixed_key "$key"
+    iniset $NOVA_CONF key_manager fixed_key "$FIXED_KEY"
+    iniset $NOVA_CPU_CONF key_manager fixed_key "$FIXED_KEY"
+fi
+
+if is_service_enabled cinder; then
+    iniset $CINDER_CONF key_manager fixed_key "$FIXED_KEY"
 fi
 
 # Launch the nova-api and wait for it to answer before continuing

From 838b833b638ee13599707d8a0be899815f201927 Mon Sep 17 00:00:00 2001
From: Andreas Jaeger <aj@suse.com>
Date: Sun, 4 Feb 2018 17:55:54 +0100
Subject: [PATCH 1258/2409] Add Zuul v3 native unit-tests

Add new job to replace legacy-devstack-unit-tests.

Change-Id: I4fe59b1954514a7146a4412e3103a0a05a9250f2
---
 .zuul.yaml                    | 11 +++++++++++
 playbooks/unit-tests/pre.yaml | 13 +++++++++++++
 playbooks/unit-tests/run.yaml | 12 ++++++++++++
 3 files changed, 36 insertions(+)
 create mode 100644 playbooks/unit-tests/pre.yaml
 create mode 100644 playbooks/unit-tests/run.yaml

diff --git a/.zuul.yaml b/.zuul.yaml
index f03d30a497..802bb79802 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -187,11 +187,22 @@
       - playbooks/tox/pre.yaml
     run: playbooks/tox/run.yaml
 
+- job:
+    name: devstack-unit-tests
+    description: |
+      Runs unit tests on devstack project.
+
+      It runs  ``run_tests.sh``.
+    pre-run: playbooks/unit-tests/pre.yaml
+    run: playbooks/unit-tests/run.yaml
+
 - project:
     check:
       jobs:
         - devstack
         - devstack-multinode
+        - devstack-unit-tests
     gate:
       jobs:
         - devstack
+        - devstack-unit-tests
diff --git a/playbooks/unit-tests/pre.yaml b/playbooks/unit-tests/pre.yaml
new file mode 100644
index 0000000000..cfa1676378
--- /dev/null
+++ b/playbooks/unit-tests/pre.yaml
@@ -0,0 +1,13 @@
+- hosts: all
+
+  tasks:
+
+    - name: Install prerequisites
+      shell:
+        chdir: '{{ zuul.project.src_dir }}'
+        executable: /bin/bash
+        cmd: |
+          set -e
+          set -x
+          echo "IPV4_ADDRS_SAFE_TO_USE=10.1.0.0/20" >> localrc
+          ./tools/install_prereqs.sh
diff --git a/playbooks/unit-tests/run.yaml b/playbooks/unit-tests/run.yaml
new file mode 100644
index 0000000000..181521f072
--- /dev/null
+++ b/playbooks/unit-tests/run.yaml
@@ -0,0 +1,12 @@
+- hosts: all
+
+  tasks:
+
+    - name: Run run_tests.sh
+      shell:
+        chdir: '{{ zuul.project.src_dir }}'
+        executable: /bin/bash
+        cmd: |
+          set -e
+          set -x
+          ./run_tests.sh

From b355a9489f5da99daa5b4eb827353630a37a8138 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 5 Feb 2018 10:54:48 +1100
Subject: [PATCH 1259/2409] Add pcre-devel for opensuse

As a follow-on for I59fc688519341c90dc33b79d536f0625a6c4dd17 add to
suse as well.

Change-Id: I72a3cf33cb98ee2eca7f027c9e28f6fbf1404002
---
 files/rpms-suse/general | 1 +
 1 file changed, 1 insertion(+)

diff --git a/files/rpms-suse/general b/files/rpms-suse/general
index 0c1a2819b1..0b69cb1c01 100644
--- a/files/rpms-suse/general
+++ b/files/rpms-suse/general
@@ -19,6 +19,7 @@ make
 net-tools
 openssh
 openssl
+pcre-devel # python-pcre
 postgresql-devel  # psycopg2
 psmisc
 python-cmd2 # dist:opensuse-12.3

From 81fac768b5a414c7ddd347e799fb49c0ccbc1d0a Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Fri, 19 Jan 2018 10:14:45 -0800
Subject: [PATCH 1260/2409] Remove unneed devstack early log file

In the run devstack role we specify a path to devstack_early_log then
hand it to stack.sh as a parameter which stack.sh does nothing with.
While looking at a fix for this it was pointed out that these early logs
make it into the job's output log now so we don't need a special file
for them. Rather than handle this as a special case just let the
job-output.txt log file pick up the logs for us which allows us to
remove this unneeded feature.

Change-Id: I9bedbe91c60257d94173b1c70676dd6c2b49dc91
---
 roles/run-devstack/README.rst         | 6 ------
 roles/run-devstack/defaults/main.yaml | 1 -
 roles/run-devstack/tasks/main.yaml    | 2 +-
 3 files changed, 1 insertion(+), 8 deletions(-)

diff --git a/roles/run-devstack/README.rst b/roles/run-devstack/README.rst
index e53f060602..d77eb15e99 100644
--- a/roles/run-devstack/README.rst
+++ b/roles/run-devstack/README.rst
@@ -6,9 +6,3 @@ Run devstack
    :default: /opt/stack
 
    The devstack base directory.
-
-.. zuul:rolevar:: devstack_early_log
-   :default: /opt/stack/log/devstack-early.txt
-
-   The full devstack log that includes the whatever stack.sh logs before
-   the LOGFILE variable in local.conf is honoured.
diff --git a/roles/run-devstack/defaults/main.yaml b/roles/run-devstack/defaults/main.yaml
index dc4528f692..fea05c8146 100644
--- a/roles/run-devstack/defaults/main.yaml
+++ b/roles/run-devstack/defaults/main.yaml
@@ -1,2 +1 @@
 devstack_base_dir: /opt/stack
-devstack_early_log: /opt/stack/logs/devstack-early.txt
diff --git a/roles/run-devstack/tasks/main.yaml b/roles/run-devstack/tasks/main.yaml
index f53212904a..64f769c0d0 100644
--- a/roles/run-devstack/tasks/main.yaml
+++ b/roles/run-devstack/tasks/main.yaml
@@ -1,5 +1,5 @@
 - name: Run devstack
-  shell: ./stack.sh 2>&1 {{ devstack_early_log }}
+  shell: ./stack.sh 2>&1
   args:
     chdir: "{{devstack_base_dir}}/devstack"
   become: true

From ac475bbb2a906f481b953494ba28690a716a3554 Mon Sep 17 00:00:00 2001
From: Chris Dent <cdent@anticdent.org>
Date: Wed, 7 Feb 2018 18:35:40 +0000
Subject: [PATCH 1261/2409] Correct configuration setting using
 NUMBER_FAKE_NOVA_COMPUTE

In Change-Id Ia3843818014f7c6c7526ef3aa9676bbddb8a85ca the 'host'
setting used for each of the fake compute hosts was accidentally named
'nhost' ('\nhost' was edited poorly), so the setting doesn't actually do
anything: you create multiple nova-compute processes they think they are
all on the same host and only one hypervisor and resource provider is
created.

With the correction in place, the wait_for_compute function needs to be
updated to be aware of the fact that the hostnames on the compute
services will have a numeric prefix when the fake virt driver is used.

Change-Id: I5e8430d170c0b1c4f195ebe510aff8be59e4a3bc
---
 functions | 7 ++++++-
 lib/nova  | 2 +-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/functions b/functions
index 959133ce5c..eabe249894 100644
--- a/functions
+++ b/functions
@@ -446,7 +446,12 @@ function wait_for_compute {
         ID=""
         while [[ "\$ID" == "" ]]; do
             sleep 1
-            ID=\$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" compute service list --host `hostname` --service nova-compute -c ID -f value)
+            if [[ "$VIRT_DRIVER" = 'fake' ]]; then
+                # When using the fake driver the compute hostnames have a suffix of 1 to NUMBER_FAKE_NOVA_COMPUTE
+                ID=\$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" compute service list --host `hostname`1 --service nova-compute -c ID -f value)
+            else
+                ID=\$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" compute service list --host `hostname` --service nova-compute -c ID -f value)
+            fi
         done
 EOF
     time_stop "wait_for_service"
diff --git a/lib/nova b/lib/nova
index fea2b8509a..a6ad907cf4 100644
--- a/lib/nova
+++ b/lib/nova
@@ -877,7 +877,7 @@ function start_nova_compute {
             # creating or modifying real configurations. Each fake
             # gets its own configuration and own log file.
             local fake_conf="${NOVA_FAKE_CONF}-${i}"
-            iniset $fake_conf DEFAULT nhost "${HOSTNAME}${i}"
+            iniset $fake_conf DEFAULT host "${HOSTNAME}${i}"
             run_process "n-cpu-${i}" "$NOVA_BIN_DIR/nova-compute --config-file $NOVA_CPU_CONF --config-file $fake_conf"
         done
     else

From 34b4ff0bfd0d6fe5a769bb60cdaeba9886ee9317 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Thu, 8 Feb 2018 06:15:13 +0000
Subject: [PATCH 1262/2409] Updated from generate-devstack-plugins-list

Change-Id: I681735a1c29e4b41eb9fa71c2838df1a820f5f75
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index d830507f07..ba747203c6 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -169,6 +169,7 @@ storlets                               `git://git.openstack.org/openstack/storle
 tacker                                 `git://git.openstack.org/openstack/tacker <https://git.openstack.org/cgit/openstack/tacker>`__
 tap-as-a-service                       `git://git.openstack.org/openstack/tap-as-a-service <https://git.openstack.org/cgit/openstack/tap-as-a-service>`__
 tap-as-a-service-dashboard             `git://git.openstack.org/openstack/tap-as-a-service-dashboard <https://git.openstack.org/cgit/openstack/tap-as-a-service-dashboard>`__
+tatu                                   `git://git.openstack.org/openstack/tatu <https://git.openstack.org/cgit/openstack/tatu>`__
 telemetry-tempest-plugin               `git://git.openstack.org/openstack/telemetry-tempest-plugin <https://git.openstack.org/cgit/openstack/telemetry-tempest-plugin>`__
 tricircle                              `git://git.openstack.org/openstack/tricircle <https://git.openstack.org/cgit/openstack/tricircle>`__
 trio2o                                 `git://git.openstack.org/openstack/trio2o <https://git.openstack.org/cgit/openstack/trio2o>`__

From 21e3be8a5e2768f35246e2c8ac03e09a51070225 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Tue, 6 Feb 2018 17:19:38 -0500
Subject: [PATCH 1263/2409] Add the nova-next job to the experimental queue

The nova-next job is being moved from openstack-zuul-jobs
to the nova repo and so we'll remove it's usage from
project-config, therefore we need to define it's usage for
devstack here.

The related project-config change is:

I36d96f89b3e5323746fcbcef5cc7e4d0384a184d

Depends-On: I24a5f73c29094a23e2fdef8ee8b43601300af593
Change-Id: I28971dc7e5cb0b5cf9698e5251a7bb099e63f3db
---
 .zuul.yaml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index 8bc5103588..a90df2f06a 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -212,3 +212,6 @@
       jobs:
         - devstack
         - devstack-unit-tests
+    experimental:
+      jobs:
+        - nova-next

From a4922067009b4e293811ec6aa976ef7f72363069 Mon Sep 17 00:00:00 2001
From: Sean McGinnis <sean.mcginnis@huawei.com>
Date: Thu, 15 Feb 2018 07:45:10 -0600
Subject: [PATCH 1264/2409] Centralize setting default branch for stable
 branching

One of the steps when we create a new stable branch is to
branch devstack, then update the default branch for most
repos to use the new stable branch for each repo.

This requires making multiple updates throughout stackrc,
and to further complicate things, there are some repo
branch variables for branchless repos that should not be
updated along with the others.

This can be error prone if not fully aware of these
exceptions. To simplify this process a little, this
patch adds two common variables - one that can be set to
the new stable branch name for all of the repos that
should be branched, and one that can be used for all of
the branchless repos to make it explicit that those
values should be left alone. The cycle-trailing repos
have until two weeks after final release to branch, so
also adding another variable for those to make it easy
to update them at a later time, separately from the
other repos.

Change-Id: I82aa19e739eeda3721bac1cb5153ad0bf2d1125a
---
 stackrc            | 154 ++++++++++++++++++++++++---------------------
 tests/test_refs.sh |   4 +-
 2 files changed, 85 insertions(+), 73 deletions(-)

diff --git a/stackrc b/stackrc
index c243d271b8..b7105d368e 100644
--- a/stackrc
+++ b/stackrc
@@ -13,6 +13,18 @@ RC_DIR=$(cd $(dirname "${BASH_SOURCE:-$0}") && pwd)
 # Source required DevStack functions and globals
 source $RC_DIR/functions
 
+# Set the target branch. This is used so that stable branching
+# does not need to update each repo below.
+TARGET_BRANCH=master
+
+# Cycle trailing projects need to branch later than the others.
+TRAILING_TARGET_BRANCH=master
+
+# And some repos do not create stable branches, so this is used
+# to make it explicit and avoid accidentally setting to a stable
+# branch.
+BRANCHLESS_TARGET_BRANCH=master
+
 # Destination path for installation
 DEST=/opt/stack
 
@@ -256,35 +268,35 @@ DEVSTACK_SERIES="queens"
 
 # block storage service
 CINDER_REPO=${CINDER_REPO:-${GIT_BASE}/openstack/cinder.git}
-CINDER_BRANCH=${CINDER_BRANCH:-master}
+CINDER_BRANCH=${CINDER_BRANCH:-$TARGET_BRANCH}
 
 # image catalog service
 GLANCE_REPO=${GLANCE_REPO:-${GIT_BASE}/openstack/glance.git}
-GLANCE_BRANCH=${GLANCE_BRANCH:-master}
+GLANCE_BRANCH=${GLANCE_BRANCH:-$TARGET_BRANCH}
 
 # django powered web control panel for openstack
 HORIZON_REPO=${HORIZON_REPO:-${GIT_BASE}/openstack/horizon.git}
-HORIZON_BRANCH=${HORIZON_BRANCH:-master}
+HORIZON_BRANCH=${HORIZON_BRANCH:-$TARGET_BRANCH}
 
 # unified auth system (manages accounts/tokens)
 KEYSTONE_REPO=${KEYSTONE_REPO:-${GIT_BASE}/openstack/keystone.git}
-KEYSTONE_BRANCH=${KEYSTONE_BRANCH:-master}
+KEYSTONE_BRANCH=${KEYSTONE_BRANCH:-$TARGET_BRANCH}
 
 # neutron service
 NEUTRON_REPO=${NEUTRON_REPO:-${GIT_BASE}/openstack/neutron.git}
-NEUTRON_BRANCH=${NEUTRON_BRANCH:-master}
+NEUTRON_BRANCH=${NEUTRON_BRANCH:-$TARGET_BRANCH}
 
 # neutron fwaas service
 NEUTRON_FWAAS_REPO=${NEUTRON_FWAAS_REPO:-${GIT_BASE}/openstack/neutron-fwaas.git}
-NEUTRON_FWAAS_BRANCH=${NEUTRON_FWAAS_BRANCH:-master}
+NEUTRON_FWAAS_BRANCH=${NEUTRON_FWAAS_BRANCH:-$TARGET_BRANCH}
 
 # compute service
 NOVA_REPO=${NOVA_REPO:-${GIT_BASE}/openstack/nova.git}
-NOVA_BRANCH=${NOVA_BRANCH:-master}
+NOVA_BRANCH=${NOVA_BRANCH:-$TARGET_BRANCH}
 
 # object storage service
 SWIFT_REPO=${SWIFT_REPO:-${GIT_BASE}/openstack/swift.git}
-SWIFT_BRANCH=${SWIFT_BRANCH:-master}
+SWIFT_BRANCH=${SWIFT_BRANCH:-$TARGET_BRANCH}
 
 ##############
 #
@@ -294,11 +306,11 @@ SWIFT_BRANCH=${SWIFT_BRANCH:-master}
 
 # consolidated openstack requirements
 REQUIREMENTS_REPO=${REQUIREMENTS_REPO:-${GIT_BASE}/openstack/requirements.git}
-REQUIREMENTS_BRANCH=${REQUIREMENTS_BRANCH:-master}
+REQUIREMENTS_BRANCH=${REQUIREMENTS_BRANCH:-$TARGET_BRANCH}
 
 # Tempest test suite
 TEMPEST_REPO=${TEMPEST_REPO:-${GIT_BASE}/openstack/tempest.git}
-TEMPEST_BRANCH=${TEMPEST_BRANCH:-master}
+TEMPEST_BRANCH=${TEMPEST_BRANCH:-$BRANCHLESS_TARGET_BRANCH}
 
 
 ##############
@@ -310,56 +322,56 @@ TEMPEST_BRANCH=${TEMPEST_BRANCH:-master}
 
 # volume client
 GITREPO["python-cinderclient"]=${CINDERCLIENT_REPO:-${GIT_BASE}/openstack/python-cinderclient.git}
-GITBRANCH["python-cinderclient"]=${CINDERCLIENT_BRANCH:-master}
+GITBRANCH["python-cinderclient"]=${CINDERCLIENT_BRANCH:-$TARGET_BRANCH}
 
 # os-brick client for local volume attachement
 GITREPO["python-brick-cinderclient-ext"]=${BRICK_CINDERCLIENT_REPO:-${GIT_BASE}/openstack/python-brick-cinderclient-ext.git}
-GITBRANCH["python-brick-cinderclient-ext"]=${BRICK_CINDERCLIENT_BRANCH:-master}
+GITBRANCH["python-brick-cinderclient-ext"]=${BRICK_CINDERCLIENT_BRANCH:-$TARGET_BRANCH}
 
 # python barbican client library
 GITREPO["python-barbicanclient"]=${BARBICANCLIENT_REPO:-${GIT_BASE}/openstack/python-barbicanclient.git}
-GITBRANCH["python-barbicanclient"]=${BARBICANCLIENT_BRANCH:-master}
+GITBRANCH["python-barbicanclient"]=${BARBICANCLIENT_BRANCH:-$TARGET_BRANCH}
 GITDIR["python-barbicanclient"]=$DEST/python-barbicanclient
 
 # python glance client library
 GITREPO["python-glanceclient"]=${GLANCECLIENT_REPO:-${GIT_BASE}/openstack/python-glanceclient.git}
-GITBRANCH["python-glanceclient"]=${GLANCECLIENT_BRANCH:-master}
+GITBRANCH["python-glanceclient"]=${GLANCECLIENT_BRANCH:-$TARGET_BRANCH}
 
 # ironic client
 GITREPO["python-ironicclient"]=${IRONICCLIENT_REPO:-${GIT_BASE}/openstack/python-ironicclient.git}
-GITBRANCH["python-ironicclient"]=${IRONICCLIENT_BRANCH:-master}
+GITBRANCH["python-ironicclient"]=${IRONICCLIENT_BRANCH:-$TARGET_BRANCH}
 # ironic plugin is out of tree, but nova uses it. set GITDIR here.
 GITDIR["python-ironicclient"]=$DEST/python-ironicclient
 
 # the base authentication plugins that clients use to authenticate
 GITREPO["keystoneauth"]=${KEYSTONEAUTH_REPO:-${GIT_BASE}/openstack/keystoneauth.git}
-GITBRANCH["keystoneauth"]=${KEYSTONEAUTH_BRANCH:-master}
+GITBRANCH["keystoneauth"]=${KEYSTONEAUTH_BRANCH:-$TARGET_BRANCH}
 
 # python keystone client library to nova that horizon uses
 GITREPO["python-keystoneclient"]=${KEYSTONECLIENT_REPO:-${GIT_BASE}/openstack/python-keystoneclient.git}
-GITBRANCH["python-keystoneclient"]=${KEYSTONECLIENT_BRANCH:-master}
+GITBRANCH["python-keystoneclient"]=${KEYSTONECLIENT_BRANCH:-$TARGET_BRANCH}
 
 # neutron client
 GITREPO["python-neutronclient"]=${NEUTRONCLIENT_REPO:-${GIT_BASE}/openstack/python-neutronclient.git}
-GITBRANCH["python-neutronclient"]=${NEUTRONCLIENT_BRANCH:-master}
+GITBRANCH["python-neutronclient"]=${NEUTRONCLIENT_BRANCH:-$TARGET_BRANCH}
 
 # python client library to nova that horizon (and others) use
 GITREPO["python-novaclient"]=${NOVACLIENT_REPO:-${GIT_BASE}/openstack/python-novaclient.git}
-GITBRANCH["python-novaclient"]=${NOVACLIENT_BRANCH:-master}
+GITBRANCH["python-novaclient"]=${NOVACLIENT_BRANCH:-$TARGET_BRANCH}
 
 # python swift client library
 GITREPO["python-swiftclient"]=${SWIFTCLIENT_REPO:-${GIT_BASE}/openstack/python-swiftclient.git}
-GITBRANCH["python-swiftclient"]=${SWIFTCLIENT_BRANCH:-master}
+GITBRANCH["python-swiftclient"]=${SWIFTCLIENT_BRANCH:-$TARGET_BRANCH}
 
 # consolidated openstack python client
 GITREPO["python-openstackclient"]=${OPENSTACKCLIENT_REPO:-${GIT_BASE}/openstack/python-openstackclient.git}
-GITBRANCH["python-openstackclient"]=${OPENSTACKCLIENT_BRANCH:-master}
+GITBRANCH["python-openstackclient"]=${OPENSTACKCLIENT_BRANCH:-$TARGET_BRANCH}
 # this doesn't exist in a lib file, so set it here
 GITDIR["python-openstackclient"]=$DEST/python-openstackclient
 
 # placement-api CLI
 GITREPO["osc-placement"]=${OSC_PLACEMENT_REPO:-${GIT_BASE}/openstack/osc-placement.git}
-GITBRANCH["osc-placement"]=${OSC_PLACEMENT_BRANCH:-master}
+GITBRANCH["osc-placement"]=${OSC_PLACEMENT_BRANCH:-$TARGET_BRANCH}
 
 
 ###################
@@ -371,119 +383,119 @@ GITBRANCH["osc-placement"]=${OSC_PLACEMENT_BRANCH:-master}
 
 # castellan key manager interface
 GITREPO["castellan"]=${CASTELLAN_REPO:-${GIT_BASE}/openstack/castellan.git}
-GITBRANCH["castellan"]=${CASTELLAN_BRANCH:-master}
+GITBRANCH["castellan"]=${CASTELLAN_BRANCH:-$TARGET_BRANCH}
 
 # cliff command line framework
 GITREPO["cliff"]=${CLIFF_REPO:-${GIT_BASE}/openstack/cliff.git}
-GITBRANCH["cliff"]=${CLIFF_BRANCH:-master}
+GITBRANCH["cliff"]=${CLIFF_BRANCH:-$TARGET_BRANCH}
 
 # async framework/helpers
 GITREPO["futurist"]=${FUTURIST_REPO:-${GIT_BASE}/openstack/futurist.git}
-GITBRANCH["futurist"]=${FUTURIST_BRANCH:-master}
+GITBRANCH["futurist"]=${FUTURIST_BRANCH:-$TARGET_BRANCH}
 
 # debtcollector deprecation framework/helpers
 GITREPO["debtcollector"]=${DEBTCOLLECTOR_REPO:-${GIT_BASE}/openstack/debtcollector.git}
-GITBRANCH["debtcollector"]=${DEBTCOLLECTOR_BRANCH:-master}
+GITBRANCH["debtcollector"]=${DEBTCOLLECTOR_BRANCH:-$TARGET_BRANCH}
 
 # helpful state machines
 GITREPO["automaton"]=${AUTOMATON_REPO:-${GIT_BASE}/openstack/automaton.git}
-GITBRANCH["automaton"]=${AUTOMATON_BRANCH:-master}
+GITBRANCH["automaton"]=${AUTOMATON_BRANCH:-$TARGET_BRANCH}
 
 # oslo.cache
 GITREPO["oslo.cache"]=${OSLOCACHE_REPO:-${GIT_BASE}/openstack/oslo.cache.git}
-GITBRANCH["oslo.cache"]=${OSLOCACHE_BRANCH:-master}
+GITBRANCH["oslo.cache"]=${OSLOCACHE_BRANCH:-$TARGET_BRANCH}
 
 # oslo.concurrency
 GITREPO["oslo.concurrency"]=${OSLOCON_REPO:-${GIT_BASE}/openstack/oslo.concurrency.git}
-GITBRANCH["oslo.concurrency"]=${OSLOCON_BRANCH:-master}
+GITBRANCH["oslo.concurrency"]=${OSLOCON_BRANCH:-$TARGET_BRANCH}
 
 # oslo.config
 GITREPO["oslo.config"]=${OSLOCFG_REPO:-${GIT_BASE}/openstack/oslo.config.git}
-GITBRANCH["oslo.config"]=${OSLOCFG_BRANCH:-master}
+GITBRANCH["oslo.config"]=${OSLOCFG_BRANCH:-$TARGET_BRANCH}
 
 # oslo.context
 GITREPO["oslo.context"]=${OSLOCTX_REPO:-${GIT_BASE}/openstack/oslo.context.git}
-GITBRANCH["oslo.context"]=${OSLOCTX_BRANCH:-master}
+GITBRANCH["oslo.context"]=${OSLOCTX_BRANCH:-$TARGET_BRANCH}
 
 # oslo.db
 GITREPO["oslo.db"]=${OSLODB_REPO:-${GIT_BASE}/openstack/oslo.db.git}
-GITBRANCH["oslo.db"]=${OSLODB_BRANCH:-master}
+GITBRANCH["oslo.db"]=${OSLODB_BRANCH:-$TARGET_BRANCH}
 
 # oslo.i18n
 GITREPO["oslo.i18n"]=${OSLOI18N_REPO:-${GIT_BASE}/openstack/oslo.i18n.git}
-GITBRANCH["oslo.i18n"]=${OSLOI18N_BRANCH:-master}
+GITBRANCH["oslo.i18n"]=${OSLOI18N_BRANCH:-$TARGET_BRANCH}
 
 # oslo.log
 GITREPO["oslo.log"]=${OSLOLOG_REPO:-${GIT_BASE}/openstack/oslo.log.git}
-GITBRANCH["oslo.log"]=${OSLOLOG_BRANCH:-master}
+GITBRANCH["oslo.log"]=${OSLOLOG_BRANCH:-$TARGET_BRANCH}
 
 # oslo.messaging
 GITREPO["oslo.messaging"]=${OSLOMSG_REPO:-${GIT_BASE}/openstack/oslo.messaging.git}
-GITBRANCH["oslo.messaging"]=${OSLOMSG_BRANCH:-master}
+GITBRANCH["oslo.messaging"]=${OSLOMSG_BRANCH:-$TARGET_BRANCH}
 
 # oslo.middleware
 GITREPO["oslo.middleware"]=${OSLOMID_REPO:-${GIT_BASE}/openstack/oslo.middleware.git}
-GITBRANCH["oslo.middleware"]=${OSLOMID_BRANCH:-master}
+GITBRANCH["oslo.middleware"]=${OSLOMID_BRANCH:-$TARGET_BRANCH}
 
 # oslo.policy
 GITREPO["oslo.policy"]=${OSLOPOLICY_REPO:-${GIT_BASE}/openstack/oslo.policy.git}
-GITBRANCH["oslo.policy"]=${OSLOPOLICY_BRANCH:-master}
+GITBRANCH["oslo.policy"]=${OSLOPOLICY_BRANCH:-$TARGET_BRANCH}
 
 # oslo.privsep
 GITREPO["oslo.privsep"]=${OSLOPRIVSEP_REPO:-${GIT_BASE}/openstack/oslo.privsep.git}
-GITBRANCH["oslo.privsep"]=${OSLOPRIVSEP_BRANCH:-master}
+GITBRANCH["oslo.privsep"]=${OSLOPRIVSEP_BRANCH:-$TARGET_BRANCH}
 
 # oslo.reports
 GITREPO["oslo.reports"]=${OSLOREPORTS_REPO:-${GIT_BASE}/openstack/oslo.reports.git}
-GITBRANCH["oslo.reports"]=${OSLOREPORTS_BRANCH:-master}
+GITBRANCH["oslo.reports"]=${OSLOREPORTS_BRANCH:-$TARGET_BRANCH}
 
 # oslo.rootwrap
 GITREPO["oslo.rootwrap"]=${OSLORWRAP_REPO:-${GIT_BASE}/openstack/oslo.rootwrap.git}
-GITBRANCH["oslo.rootwrap"]=${OSLORWRAP_BRANCH:-master}
+GITBRANCH["oslo.rootwrap"]=${OSLORWRAP_BRANCH:-$TARGET_BRANCH}
 
 # oslo.serialization
 GITREPO["oslo.serialization"]=${OSLOSERIALIZATION_REPO:-${GIT_BASE}/openstack/oslo.serialization.git}
-GITBRANCH["oslo.serialization"]=${OSLOSERIALIZATION_BRANCH:-master}
+GITBRANCH["oslo.serialization"]=${OSLOSERIALIZATION_BRANCH:-$TARGET_BRANCH}
 
 # oslo.service
 GITREPO["oslo.service"]=${OSLOSERVICE_REPO:-${GIT_BASE}/openstack/oslo.service.git}
-GITBRANCH["oslo.service"]=${OSLOSERVICE_BRANCH:-master}
+GITBRANCH["oslo.service"]=${OSLOSERVICE_BRANCH:-$TARGET_BRANCH}
 
 # oslo.utils
 GITREPO["oslo.utils"]=${OSLOUTILS_REPO:-${GIT_BASE}/openstack/oslo.utils.git}
-GITBRANCH["oslo.utils"]=${OSLOUTILS_BRANCH:-master}
+GITBRANCH["oslo.utils"]=${OSLOUTILS_BRANCH:-$TARGET_BRANCH}
 
 # oslo.versionedobjects
 GITREPO["oslo.versionedobjects"]=${OSLOVERSIONEDOBJECTS_REPO:-${GIT_BASE}/openstack/oslo.versionedobjects.git}
-GITBRANCH["oslo.versionedobjects"]=${OSLOVERSIONEDOBJECTS_BRANCH:-master}
+GITBRANCH["oslo.versionedobjects"]=${OSLOVERSIONEDOBJECTS_BRANCH:-$TARGET_BRANCH}
 
 # oslo.vmware
 GITREPO["oslo.vmware"]=${OSLOVMWARE_REPO:-${GIT_BASE}/openstack/oslo.vmware.git}
-GITBRANCH["oslo.vmware"]=${OSLOVMWARE_BRANCH:-master}
+GITBRANCH["oslo.vmware"]=${OSLOVMWARE_BRANCH:-$TARGET_BRANCH}
 
 # osprofiler
 GITREPO["osprofiler"]=${OSPROFILER_REPO:-${GIT_BASE}/openstack/osprofiler.git}
-GITBRANCH["osprofiler"]=${OSPROFILER_BRANCH:-master}
+GITBRANCH["osprofiler"]=${OSPROFILER_BRANCH:-$TARGET_BRANCH}
 
 # pycadf auditing library
 GITREPO["pycadf"]=${PYCADF_REPO:-${GIT_BASE}/openstack/pycadf.git}
-GITBRANCH["pycadf"]=${PYCADF_BRANCH:-master}
+GITBRANCH["pycadf"]=${PYCADF_BRANCH:-$TARGET_BRANCH}
 
 # stevedore plugin manager
 GITREPO["stevedore"]=${STEVEDORE_REPO:-${GIT_BASE}/openstack/stevedore.git}
-GITBRANCH["stevedore"]=${STEVEDORE_BRANCH:-master}
+GITBRANCH["stevedore"]=${STEVEDORE_BRANCH:-$TARGET_BRANCH}
 
 # taskflow plugin manager
 GITREPO["taskflow"]=${TASKFLOW_REPO:-${GIT_BASE}/openstack/taskflow.git}
-GITBRANCH["taskflow"]=${TASKFLOW_BRANCH:-master}
+GITBRANCH["taskflow"]=${TASKFLOW_BRANCH:-$TARGET_BRANCH}
 
 # tooz plugin manager
 GITREPO["tooz"]=${TOOZ_REPO:-${GIT_BASE}/openstack/tooz.git}
-GITBRANCH["tooz"]=${TOOZ_BRANCH:-master}
+GITBRANCH["tooz"]=${TOOZ_BRANCH:-$TARGET_BRANCH}
 
 # pbr drives the setuptools configs
 GITREPO["pbr"]=${PBR_REPO:-${GIT_BASE}/openstack-dev/pbr.git}
-GITBRANCH["pbr"]=${PBR_BRANCH:-master}
+GITBRANCH["pbr"]=${PBR_BRANCH:-$TARGET_BRANCH}
 
 
 ##################
@@ -494,65 +506,65 @@ GITBRANCH["pbr"]=${PBR_BRANCH:-master}
 
 # cursive library
 GITREPO["cursive"]=${CURSIVE_REPO:-${GIT_BASE}/openstack/cursive.git}
-GITBRANCH["cursive"]=${CURSIVE_BRANCH:-master}
+GITBRANCH["cursive"]=${CURSIVE_BRANCH:-$TARGET_BRANCH}
 
 # glance store library
 GITREPO["glance_store"]=${GLANCE_STORE_REPO:-${GIT_BASE}/openstack/glance_store.git}
-GITBRANCH["glance_store"]=${GLANCE_STORE_BRANCH:-master}
+GITBRANCH["glance_store"]=${GLANCE_STORE_BRANCH:-$TARGET_BRANCH}
 
 # keystone middleware
 GITREPO["keystonemiddleware"]=${KEYSTONEMIDDLEWARE_REPO:-${GIT_BASE}/openstack/keystonemiddleware.git}
-GITBRANCH["keystonemiddleware"]=${KEYSTONEMIDDLEWARE_BRANCH:-master}
+GITBRANCH["keystonemiddleware"]=${KEYSTONEMIDDLEWARE_BRANCH:-$TARGET_BRANCH}
 
 # s3 support for swift
 SWIFT3_REPO=${SWIFT3_REPO:-${GIT_BASE}/openstack/swift3.git}
-SWIFT3_BRANCH=${SWIFT3_BRANCH:-master}
+SWIFT3_BRANCH=${SWIFT3_BRANCH:-$TARGET_BRANCH}
 
 # ceilometer middleware
 GITREPO["ceilometermiddleware"]=${CEILOMETERMIDDLEWARE_REPO:-${GIT_BASE}/openstack/ceilometermiddleware.git}
-GITBRANCH["ceilometermiddleware"]=${CEILOMETERMIDDLEWARE_BRANCH:-master}
+GITBRANCH["ceilometermiddleware"]=${CEILOMETERMIDDLEWARE_BRANCH:-$TARGET_BRANCH}
 GITDIR["ceilometermiddleware"]=$DEST/ceilometermiddleware
 
 # os-brick library to manage local volume attaches
 GITREPO["os-brick"]=${OS_BRICK_REPO:-${GIT_BASE}/openstack/os-brick.git}
-GITBRANCH["os-brick"]=${OS_BRICK_BRANCH:-master}
+GITBRANCH["os-brick"]=${OS_BRICK_BRANCH:-$TARGET_BRANCH}
 
 # os-client-config to manage clouds.yaml and friends
 GITREPO["os-client-config"]=${OS_CLIENT_CONFIG_REPO:-${GIT_BASE}/openstack/os-client-config.git}
-GITBRANCH["os-client-config"]=${OS_CLIENT_CONFIG_BRANCH:-master}
+GITBRANCH["os-client-config"]=${OS_CLIENT_CONFIG_BRANCH:-$TARGET_BRANCH}
 GITDIR["os-client-config"]=$DEST/os-client-config
 
 # os-vif library to communicate between Neutron to Nova
 GITREPO["os-vif"]=${OS_VIF_REPO:-${GIT_BASE}/openstack/os-vif.git}
-GITBRANCH["os-vif"]=${OS_VIF_BRANCH:-master}
+GITBRANCH["os-vif"]=${OS_VIF_BRANCH:-$TARGET_BRANCH}
 
 # osc-lib OpenStackClient common lib
 GITREPO["osc-lib"]=${OSC_LIB_REPO:-${GIT_BASE}/openstack/osc-lib.git}
-GITBRANCH["osc-lib"]=${OSC_LIB_BRANCH:-master}
+GITBRANCH["osc-lib"]=${OSC_LIB_BRANCH:-$TARGET_BRANCH}
 
 # python-openstacksdk OpenStack Python SDK
 GITREPO["python-openstacksdk"]=${OPENSTACKSDK_REPO:-${GIT_BASE}/openstack/python-openstacksdk.git}
-GITBRANCH["python-openstacksdk"]=${OPENSTACKSDK_BRANCH:-master}
+GITBRANCH["python-openstacksdk"]=${OPENSTACKSDK_BRANCH:-$TARGET_BRANCH}
 
 # ironic common lib
 GITREPO["ironic-lib"]=${IRONIC_LIB_REPO:-${GIT_BASE}/openstack/ironic-lib.git}
-GITBRANCH["ironic-lib"]=${IRONIC_LIB_BRANCH:-master}
+GITBRANCH["ironic-lib"]=${IRONIC_LIB_BRANCH:-$TARGET_BRANCH}
 # this doesn't exist in a lib file, so set it here
 GITDIR["ironic-lib"]=$DEST/ironic-lib
 
 # diskimage-builder tool
 GITREPO["diskimage-builder"]=${DIB_REPO:-${GIT_BASE}/openstack/diskimage-builder.git}
-GITBRANCH["diskimage-builder"]=${DIB_BRANCH:-master}
+GITBRANCH["diskimage-builder"]=${DIB_BRANCH:-$TARGET_BRANCH}
 GITDIR["diskimage-builder"]=$DEST/diskimage-builder
 
 # neutron-lib library containing neutron stable non-REST interfaces
 GITREPO["neutron-lib"]=${NEUTRON_LIB_REPO:-${GIT_BASE}/openstack/neutron-lib.git}
-GITBRANCH["neutron-lib"]=${NEUTRON_LIB_BRANCH:-master}
+GITBRANCH["neutron-lib"]=${NEUTRON_LIB_BRANCH:-$TARGET_BRANCH}
 GITDIR["neutron-lib"]=$DEST/neutron-lib
 
 # os-traits library for resource provider traits in the placement service
 GITREPO["os-traits"]=${OS_TRAITS_REPO:-${GIT_BASE}/openstack/os-traits.git}
-GITBRANCH["os-traits"]=${OS_TRAITS_BRANCH:-master}
+GITBRANCH["os-traits"]=${OS_TRAITS_BRANCH:-$TARGET_BRANCH}
 
 ##################
 #
@@ -562,19 +574,19 @@ GITBRANCH["os-traits"]=${OS_TRAITS_BRANCH:-master}
 
 # run-parts script required by os-refresh-config
 DIB_UTILS_REPO=${DIB_UTILS_REPO:-${GIT_BASE}/openstack/dib-utils.git}
-DIB_UTILS_BRANCH=${DIB_UTILS_BRANCH:-master}
+DIB_UTILS_BRANCH=${DIB_UTILS_BRANCH:-$BRANCHLESS_TARGET_BRANCH}
 
 # os-apply-config configuration template tool
 OAC_REPO=${OAC_REPO:-${GIT_BASE}/openstack/os-apply-config.git}
-OAC_BRANCH=${OAC_BRANCH:-master}
+OAC_BRANCH=${OAC_BRANCH:-$TRAILING_TARGET_BRANCH}
 
 # os-collect-config configuration agent
 OCC_REPO=${OCC_REPO:-${GIT_BASE}/openstack/os-collect-config.git}
-OCC_BRANCH=${OCC_BRANCH:-master}
+OCC_BRANCH=${OCC_BRANCH:-$TRAILING_TARGET_BRANCH}
 
 # os-refresh-config configuration run-parts tool
 ORC_REPO=${ORC_REPO:-${GIT_BASE}/openstack/os-refresh-config.git}
-ORC_BRANCH=${ORC_BRANCH:-master}
+ORC_BRANCH=${ORC_BRANCH:-$TRAILING_TARGET_BRANCH}
 
 
 #################
@@ -587,7 +599,7 @@ ORC_BRANCH=${ORC_BRANCH:-master}
 
 # ironic python agent
 IRONIC_PYTHON_AGENT_REPO=${IRONIC_PYTHON_AGENT_REPO:-${GIT_BASE}/openstack/ironic-python-agent.git}
-IRONIC_PYTHON_AGENT_BRANCH=${IRONIC_PYTHON_AGENT_BRANCH:-master}
+IRONIC_PYTHON_AGENT_BRANCH=${IRONIC_PYTHON_AGENT_BRANCH:-$TARGET_BRANCH}
 
 # a websockets/html5 or flash powered VNC console for vm instances
 NOVNC_REPO=${NOVNC_REPO:-https://github.com/novnc/noVNC.git}
@@ -595,7 +607,7 @@ NOVNC_BRANCH=${NOVNC_BRANCH:-stable/v0.6}
 
 # a websockets/html5 or flash powered SPICE console for vm instances
 SPICE_REPO=${SPICE_REPO:-http://anongit.freedesktop.org/git/spice/spice-html5.git}
-SPICE_BRANCH=${SPICE_BRANCH:-master}
+SPICE_BRANCH=${SPICE_BRANCH:-$BRANCHLESS_TARGET_BRANCH}
 
 # Global flag used to configure Tempest and potentially other services if
 # volume multiattach is supported. In Queens, only the libvirt compute driver
diff --git a/tests/test_refs.sh b/tests/test_refs.sh
index 65848cdc72..0f9aa4a5ca 100755
--- a/tests/test_refs.sh
+++ b/tests/test_refs.sh
@@ -15,10 +15,10 @@
 
 echo "Ensuring we don't have crazy refs"
 
-REFS=`grep BRANCH stackrc | grep -v -- '-master' | grep -v 'NOVNC_BRANCH'`
+REFS=`grep BRANCH stackrc | grep -v 'TARGET_BRANCH' | grep -v 'NOVNC_BRANCH'`
 rc=$?
 if [[ $rc -eq 0 ]]; then
-    echo "Branch defaults must be master. Found:"
+    echo "Branch defaults must be one of the *TARGET_BRANCH values. Found:"
     echo $REFS
     exit 1
 fi

From 22d70554acf711558c1a5018f9162eb5f1f4086c Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Thu, 15 Feb 2018 16:41:19 -0600
Subject: [PATCH 1265/2409] Add /volume to block-storage endpoint

The block-storage endpoint was added to the catalog, but in the suburl
case it was not added with the /volume suburl. This leads to find it and
attempting to use it but not being able to because it's mis-formed.

Needed-By: https://review.openstack.org/545117
Change-Id: I84721c8ae637417e4b01be9e546ff77c250fc149
---
 lib/cinder | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/cinder b/lib/cinder
index 96a7d5bb8e..75486adda5 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -372,7 +372,7 @@ function create_cinder_accounts {
             get_or_create_endpoint \
                 "block-storage" \
                 "$REGION_NAME" \
-                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST/"
+                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST/volume/"
 
             get_or_create_endpoint \
                 "volume" \

From 4d835e33b6e901ef87023ce9b7d71bc21170a9e3 Mon Sep 17 00:00:00 2001
From: IWAMOTO Toshihiro <iwamoto@valinux.co.jp>
Date: Mon, 5 Feb 2018 16:57:41 +0900
Subject: [PATCH 1266/2409] Break up fixup_stuff

Neutron functional tests want to use ubuntu cloud archive but it's
not possible to source the fixup_stuff.sh from a neutron CI setup
script. Break it up so that only the UCA portion can be executed
from neutron.

Change-Id: Ie18833bfa30f1789e63cbe9c86f5ece3453f43fb
---
 stack.sh             |   1 +
 tools/fixup_stuff.sh | 114 +++++++++++++++++++++++++------------------
 2 files changed, 68 insertions(+), 47 deletions(-)

diff --git a/stack.sh b/stack.sh
index 9b496c0e20..81d2ed2bcc 100755
--- a/stack.sh
+++ b/stack.sh
@@ -773,6 +773,7 @@ fi
 
 # Do the ugly hacks for broken packages and distros
 source $TOP_DIR/tools/fixup_stuff.sh
+fixup_all
 
 if [[ "$USE_SYSTEMD" == "True" ]]; then
     pip_install_gr systemd-python
diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index f78f05f2f8..90b2c8bf1f 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -45,27 +45,29 @@ fi
 # where Keystone will try and bind to the port and the port will already be
 # in use as an ephemeral port by another process. This places an explicit
 # exception into the Kernel for the Keystone AUTH ports.
-keystone_ports=${KEYSTONE_AUTH_PORT:-35357},${KEYSTONE_AUTH_PORT_INT:-35358}
-
-# Only do the reserved ports when available, on some system (like containers)
-# where it's not exposed we are almost pretty sure these ports would be
-# exclusive for our DevStack.
-if sysctl net.ipv4.ip_local_reserved_ports >/dev/null 2>&1; then
-    # Get any currently reserved ports, strip off leading whitespace
-    reserved_ports=$(sysctl net.ipv4.ip_local_reserved_ports | awk -F'=' '{print $2;}' | sed 's/^ //')
-
-    if [[ -z "${reserved_ports}" ]]; then
-        # If there are no currently reserved ports, reserve the keystone ports
-        sudo sysctl -w net.ipv4.ip_local_reserved_ports=${keystone_ports}
+function fixup_keystone {
+    keystone_ports=${KEYSTONE_AUTH_PORT:-35357},${KEYSTONE_AUTH_PORT_INT:-35358}
+
+    # Only do the reserved ports when available, on some system (like containers)
+    # where it's not exposed we are almost pretty sure these ports would be
+    # exclusive for our DevStack.
+    if sysctl net.ipv4.ip_local_reserved_ports >/dev/null 2>&1; then
+        # Get any currently reserved ports, strip off leading whitespace
+        reserved_ports=$(sysctl net.ipv4.ip_local_reserved_ports | awk -F'=' '{print $2;}' | sed 's/^ //')
+
+        if [[ -z "${reserved_ports}" ]]; then
+            # If there are no currently reserved ports, reserve the keystone ports
+            sudo sysctl -w net.ipv4.ip_local_reserved_ports=${keystone_ports}
+        else
+            # If there are currently reserved ports, keep those and also reserve the
+            # Keystone specific ports. Duplicate reservations are merged into a single
+            # reservation (or range) automatically by the kernel.
+            sudo sysctl -w net.ipv4.ip_local_reserved_ports=${keystone_ports},${reserved_ports}
+        fi
     else
-        # If there are currently reserved ports, keep those and also reserve the
-        # Keystone specific ports. Duplicate reservations are merged into a single
-        # reservation (or range) automatically by the kernel.
-        sudo sysctl -w net.ipv4.ip_local_reserved_ports=${keystone_ports},${reserved_ports}
+        echo_summary "WARNING: unable to reserve keystone ports"
     fi
-else
-    echo_summary "WARNING: unable to reserve keystone ports"
-fi
+}
 
 # Ubuntu Cloud Archive
 #---------------------
@@ -79,8 +81,12 @@ fi
 # ENABLE_VOLUME_MULTIATTACH is True, we can't use the Pike UCA
 # because multiattach won't work with those package versions.
 # We can remove this check when the UCA has libvirt>=3.10.
-if [[ "${ENABLE_UBUNTU_CLOUD_ARCHIVE}" == "True" && "$DISTRO" = "xenial" && \
-        "${ENABLE_VOLUME_MULTIATTACH}" == "False" ]]; then
+function fixup_uca {
+    if [[ "${ENABLE_UBUNTU_CLOUD_ARCHIVE}" == "False" || "$DISTRO" != "xenial" || \
+            "${ENABLE_VOLUME_MULTIATTACH}" == "True" ]]; then
+        return
+    fi
+
     # This pulls in apt-add-repository
     install_package "software-properties-common"
     # Use UCA for newer libvirt. Should give us libvirt 2.5.0.
@@ -104,8 +110,7 @@ if [[ "${ENABLE_UBUNTU_CLOUD_ARCHIVE}" == "True" && "$DISTRO" = "xenial" && \
     # Force update our APT repos, since we added UCA above.
     REPOS_UPDATED=False
     apt_get_update
-fi
-
+}
 
 # Python Packages
 # ---------------
@@ -120,27 +125,32 @@ function get_package_path {
 # Pre-install affected packages so we can fix the permissions
 # These can go away once we are confident that pip 1.4.1+ is available everywhere
 
-# Fix prettytable 0.7.2 permissions
-# Don't specify --upgrade so we use the existing package if present
-pip_install 'prettytable>=0.7'
-PACKAGE_DIR=$(get_package_path prettytable)
-# Only fix version 0.7.2
-dir=$(echo $PACKAGE_DIR/prettytable-0.7.2*)
-if [[ -d $dir ]]; then
-    sudo chmod +r $dir/*
-fi
+function fixup_python_packages {
+    # Fix prettytable 0.7.2 permissions
+    # Don't specify --upgrade so we use the existing package if present
+    pip_install 'prettytable>=0.7'
+    PACKAGE_DIR=$(get_package_path prettytable)
+    # Only fix version 0.7.2
+    dir=$(echo $PACKAGE_DIR/prettytable-0.7.2*)
+    if [[ -d $dir ]]; then
+        sudo chmod +r $dir/*
+    fi
 
-# Fix httplib2 0.8 permissions
-# Don't specify --upgrade so we use the existing package if present
-pip_install httplib2
-PACKAGE_DIR=$(get_package_path httplib2)
-# Only fix version 0.8
-dir=$(echo $PACKAGE_DIR-0.8*)
-if [[ -d $dir ]]; then
-    sudo chmod +r $dir/*
-fi
+    # Fix httplib2 0.8 permissions
+    # Don't specify --upgrade so we use the existing package if present
+    pip_install httplib2
+    PACKAGE_DIR=$(get_package_path httplib2)
+    # Only fix version 0.8
+    dir=$(echo $PACKAGE_DIR-0.8*)
+    if [[ -d $dir ]]; then
+        sudo chmod +r $dir/*
+    fi
+}
 
-if is_fedora; then
+function fixup_fedora {
+    if ! is_fedora; then
+        return
+    fi
     # Disable selinux to avoid configuring to allow Apache access
     # to Horizon files (LP#1175444)
     if selinuxenabled; then
@@ -198,7 +208,7 @@ if is_fedora; then
             pip_install --upgrade --force-reinstall requests
         fi
     fi
-fi
+}
 
 # The version of pip(1.5.4) supported by python-virtualenv(1.11.4) has
 # connection issues under proxy so re-install the latest version using
@@ -222,7 +232,17 @@ fi
 #            install.d/pip-and-virtualenv-source-install/04-install-pip
 # [2] https://bugzilla.redhat.com/show_bug.cgi?id=1477823
 
-if [[ ! -f /etc/ci/mirror_info.sh ]]; then
-    install_package python-virtualenv
-    pip_install -U --force-reinstall virtualenv
-fi
+function fixup_virtualenv {
+    if [[ ! -f /etc/ci/mirror_info.sh ]]; then
+        install_package python-virtualenv
+        pip_install -U --force-reinstall virtualenv
+    fi
+}
+
+function fixup_all {
+    fixup_keystone
+    fixup_uca
+    fixup_python_packages
+    fixup_fedora
+    fixup_virtualenv
+}

From 8f7216290aebdd07f2277a92ae1baab5418c087c Mon Sep 17 00:00:00 2001
From: Josh <jhershbe@redhat.com>
Date: Thu, 1 Feb 2018 09:45:47 +0200
Subject: [PATCH 1267/2409] Restore NEUTRON_CREATE_INITIAL_NETWORKS flag

Somehow this feature was lost in the transition
from q-svc to neutron-api. This patch does not
modify the default behavior but allows specifying
the flag to false to prevent devstack from creating
the public and private networks.

Change-Id: I952672496d007552c0c4d83db0d0df9be50326fc
Signed-off-by: Josh <jhershbe@redhat.com>
---
 lib/neutron | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/neutron b/lib/neutron
index c5839f5c3e..08347926f7 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -42,6 +42,7 @@ NEUTRON_META_CONF=$NEUTRON_CONF_DIR/metadata_agent.ini
 NEUTRON_DHCP_CONF=$NEUTRON_CONF_DIR/dhcp_agent.ini
 NEUTRON_L3_CONF=$NEUTRON_CONF_DIR/l3_agent.ini
 NEUTRON_AGENT_CONF=$NEUTRON_CONF_DIR/
+NEUTRON_CREATE_INITIAL_NETWORKS=${NEUTRON_CREATE_INITIAL_NETWORKS:-True}
 
 NEUTRON_STATE_PATH=${NEUTRON_STATE_PATH:=$DATA_DIR/neutron}
 NEUTRON_AUTH_CACHE_DIR=${NEUTRON_AUTH_CACHE_DIR:-/var/cache/neutron}
@@ -438,7 +439,7 @@ function start_neutron_new {
     if is_service_enabled neutron-l3; then
         run_process neutron-l3 "$NEUTRON_BIN_DIR/$NEUTRON_L3_BINARY --config-file $NEUTRON_CONF --config-file $NEUTRON_L3_CONF"
     fi
-    if is_service_enabled neutron-api; then
+    if is_service_enabled neutron-api && [[ "$NEUTRON_CREATE_INITIAL_NETWORKS" == "True" ]]; then
         # XXX(sc68cal) - Here's where plugins can wire up their own networks instead
         # of the code in lib/neutron_plugins/services/l3
         if type -p neutron_plugin_create_initial_networks > /dev/null; then

From a3844240ab80626adbfdfda59df0fa8133340a50 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Sun, 18 Feb 2018 17:14:48 -0500
Subject: [PATCH 1268/2409] Set [scheduler]workers=$API_WORKERS

Since blueprint placement-claims in Pike, the Nova FilterScheduler
uses the placement service to make resource allocation 'claims'
before sending the build request to the chosen compute host to
perform the legacy style resource claim. This allows us to safely
scale out the number of scheduler workers when using the FilterScheduler.

The [scheduler]workers option defaults to ncpu if using the
FilterScheduler (which is the default scheduler driver) so to avoid
out of memory issues, we need to set $API_WORKERS scheduler workers
if using the FilterScheduler in devstack.

Depends-On: Ifdcd363d7bc22e73d76d69777483e5aaff4036e3
Change-Id: Ieae234eb5388560b3f66bf60c156a91a8e831bc4
---
 lib/nova | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/nova b/lib/nova
index fea2b8509a..1257967c30 100644
--- a/lib/nova
+++ b/lib/nova
@@ -413,6 +413,9 @@ function create_nova_conf {
     iniset $NOVA_CONF DEFAULT rootwrap_config "$NOVA_CONF_DIR/rootwrap.conf"
     iniset $NOVA_CONF scheduler driver "$SCHEDULER"
     iniset $NOVA_CONF filter_scheduler enabled_filters "$FILTERS"
+    if [[ $SCHEDULER == "filter_scheduler" ]]; then
+        iniset $NOVA_CONF scheduler workers "$API_WORKERS"
+    fi
     iniset $NOVA_CONF DEFAULT default_floating_pool "$PUBLIC_NETWORK_NAME"
     if [[ $SERVICE_IP_VERSION == 6 ]]; then
         iniset $NOVA_CONF DEFAULT my_ip "$HOST_IPV6"

From fddf3430d8b3bb6bc60c6c69c344e7ae437ee894 Mon Sep 17 00:00:00 2001
From: Andrea Frittoli <andrea.frittoli@gmail.com>
Date: Mon, 19 Feb 2018 18:34:43 +0000
Subject: [PATCH 1269/2409] Render devstack ansible roles via zuul-sphinx

Change-Id: Ie0db5bcfdacc2543488704fe4428b68910bd6bf1
---
 doc/requirements.txt | 1 +
 doc/source/conf.py   | 2 +-
 doc/source/index.rst | 2 ++
 doc/source/roles.rst | 4 ++++
 4 files changed, 8 insertions(+), 1 deletion(-)
 create mode 100644 doc/source/roles.rst

diff --git a/doc/requirements.txt b/doc/requirements.txt
index e140bc0689..f65e9dfece 100644
--- a/doc/requirements.txt
+++ b/doc/requirements.txt
@@ -8,3 +8,4 @@ nwdiag
 blockdiag
 sphinxcontrib-blockdiag
 sphinxcontrib-nwdiag
+zuul-sphinx>=0.2.0
diff --git a/doc/source/conf.py b/doc/source/conf.py
index 780237fe58..e9708fae1d 100644
--- a/doc/source/conf.py
+++ b/doc/source/conf.py
@@ -26,7 +26,7 @@
 
 # Add any Sphinx extension module names here, as strings. They can be extensions
 # coming with Sphinx (named 'sphinx.ext.*') or your custom ones.
-extensions = [ 'openstackdocstheme', 'sphinxcontrib.blockdiag', 'sphinxcontrib.nwdiag' ]
+extensions = [ 'sphinx.ext.autodoc', 'zuul_sphinx', 'openstackdocstheme', 'sphinxcontrib.blockdiag', 'sphinxcontrib.nwdiag' ]
 
 # openstackdocstheme options
 repository_name = 'openstack-dev/devstack'
diff --git a/doc/source/index.rst b/doc/source/index.rst
index 47087c5a0b..9254c23cae 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -139,6 +139,8 @@ up to date to the latest devstack).
 Enable :doc:`devstack plugins <plugins>` to support additional
 services, features, and configuration not present in base devstack.
 
+Use devstack in your CI with :doc:`Ansible roles <roles>` for Zuul V3.
+
 Get :doc:`the big picture <overview>` of what we are trying to do
 with devstack, and help us by :doc:`contributing to the project
 <hacking>`.
diff --git a/doc/source/roles.rst b/doc/source/roles.rst
new file mode 100644
index 0000000000..5baa1e4e82
--- /dev/null
+++ b/doc/source/roles.rst
@@ -0,0 +1,4 @@
+Roles
+=====
+
+.. zuul:autoroles::

From 4d55aa734de178e610e0bb8a3e3f55b82c5f2366 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Tue, 20 Feb 2018 06:10:39 +0000
Subject: [PATCH 1270/2409] Updated from generate-devstack-plugins-list

Change-Id: I7c5b33448df43c77fd188a3c44099d9c932d3173
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index ba747203c6..591e226645 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -157,6 +157,7 @@ picasso                                `git://git.openstack.org/openstack/picass
 python-openstacksdk                    `git://git.openstack.org/openstack/python-openstacksdk <https://git.openstack.org/cgit/openstack/python-openstacksdk>`__
 qinling                                `git://git.openstack.org/openstack/qinling <https://git.openstack.org/cgit/openstack/qinling>`__
 rally                                  `git://git.openstack.org/openstack/rally <https://git.openstack.org/cgit/openstack/rally>`__
+rally-openstack                        `git://git.openstack.org/openstack/rally-openstack <https://git.openstack.org/cgit/openstack/rally-openstack>`__
 sahara                                 `git://git.openstack.org/openstack/sahara <https://git.openstack.org/cgit/openstack/sahara>`__
 sahara-dashboard                       `git://git.openstack.org/openstack/sahara-dashboard <https://git.openstack.org/cgit/openstack/sahara-dashboard>`__
 scalpels                               `git://git.openstack.org/openstack/scalpels <https://git.openstack.org/cgit/openstack/scalpels>`__

From 2e9e90b9a862fee3a47ad211b712171497f13e97 Mon Sep 17 00:00:00 2001
From: Daniel Mellado <dmellado@redhat.com>
Date: Tue, 20 Feb 2018 12:17:55 +0100
Subject: [PATCH 1271/2409] Fix RedHat entry in apache_config_path

With CentOS 7, ansible is expecting to have RedHat as an attribute for
the dict so Discover configurations task fails with an undefined
variable error.

Closes-Bug: #1750573
Change-Id: I5bf9c4057ca9f75d730add9e429d0ef050c6d900
---
 roles/apache-logs-conf/tasks/main.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roles/apache-logs-conf/tasks/main.yaml b/roles/apache-logs-conf/tasks/main.yaml
index 60b4fbfead..339ee358be 100644
--- a/roles/apache-logs-conf/tasks/main.yaml
+++ b/roles/apache-logs-conf/tasks/main.yaml
@@ -57,7 +57,7 @@
     apache_config_paths:
       'Debian': '/etc/apache2/sites-enabled/'
       'Suse': '/etc/apache2/conf.d/'
-      'Redhat': '/etc/httpd/conf.d/'
+      'RedHat': '/etc/httpd/conf.d/'
 
 - name: Discover configurations
   find:

From c9c39a4b043af60d06e71976dab218115ffdf524 Mon Sep 17 00:00:00 2001
From: Paul Belanger <pabelanger@redhat.com>
Date: Wed, 21 Feb 2018 14:23:10 -0500
Subject: [PATCH 1272/2409] Make the apache-logs-conf role even less verbose

Round 2 to add no_log to more things. Specific looping over stats, it
is pretty noise in logs and doesn't seem to add any value.

Change-Id: I580171e0061fa331f3ed510713f1ac7a1a6cb5ea
Signed-off-by: Paul Belanger <pabelanger@redhat.com>
---
 roles/apache-logs-conf/tasks/main.yaml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/roles/apache-logs-conf/tasks/main.yaml b/roles/apache-logs-conf/tasks/main.yaml
index 339ee358be..bcc1353a87 100644
--- a/roles/apache-logs-conf/tasks/main.yaml
+++ b/roles/apache-logs-conf/tasks/main.yaml
@@ -10,11 +10,13 @@
       path: "/var/log/apache2"
       file_type: any
     register: debian_suse_apache_logs
+
   - name: Dereference files
     stat:
       path: "{{ item.path }}"
     with_items: "{{ debian_suse_apache_logs.files }}"
     register: debian_suse_apache_deref_logs
+
   - name: Create hard links
     file:
       src: "{{ item.stat.lnk_source | default(item.stat.path) }}"
@@ -24,6 +26,7 @@
     when:
       - item.stat.isreg or item.stat.islnk
   when: ansible_os_family in ('Debian', 'Suse')
+  no_log: true
 
 - name: Link apache logs on RedHat
   block:
@@ -32,11 +35,13 @@
       path: "/var/log/httpd"
       file_type: any
     register: redhat_apache_logs
+
   - name: Dereference files
     stat:
       path: "{{ item.path }}"
     with_items: "{{ redhat_apache_logs.files }}"
     register: redhat_apache_deref_logs
+
   - name: Create hard links
     file:
       src: "{{ item.stat.lnk_source | default(item.stat.path) }}"
@@ -46,6 +51,7 @@
     when:
       - item.stat.isreg or item.stat.islnk
   when: ansible_os_family == 'Redhat'
+  no_log: true
 
 - name: Ensure {{ stage_dir }}/apache_config apache_config exists
   file:

From d3106720d22eed7861e14b746e36715adc2933ee Mon Sep 17 00:00:00 2001
From: Paul Belanger <pabelanger@redhat.com>
Date: Wed, 21 Feb 2018 16:06:49 -0500
Subject: [PATCH 1273/2409] Suppress more stats tasks

By default stat is pretty verbose, we can set no_log: true to avoid
adding this info to our logs.

Change-Id: Ia18ebfe179443382cc670ffc4363ab037c43bb85
Signed-off-by: Paul Belanger <pabelanger@redhat.com>
---
 roles/devstack-project-conf/tasks/main.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/roles/devstack-project-conf/tasks/main.yaml b/roles/devstack-project-conf/tasks/main.yaml
index 9c6e06bea9..917cdbc370 100644
--- a/roles/devstack-project-conf/tasks/main.yaml
+++ b/roles/devstack-project-conf/tasks/main.yaml
@@ -8,6 +8,7 @@
     path: "/etc/{{ item.value.short_name }}"
   with_dict: "{{ zuul.projects }}"
   register: project_configs
+  no_log: true
 
 - name: Copy configuration files
   command: cp -pRL {{ item.stat.path }} {{ stage_dir }}/etc/{{ item.item.value.short_name }}

From a9e946471ef029755d7dd22f70a20273578c9813 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 6 Feb 2018 08:03:03 +1100
Subject: [PATCH 1274/2409] Role apache-logs-conf: fix redhat matching

Ansible complains:

  The task includes an option with an undefined variable. The error
  was: 'dict object' has no attribute 'RedHat'

which is just a mismatch on the "Redhat" string

Change-Id: I447038256561740c224c68388fa5b6a068cc8fed
---
 roles/apache-logs-conf/tasks/main.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roles/apache-logs-conf/tasks/main.yaml b/roles/apache-logs-conf/tasks/main.yaml
index bcc1353a87..bd64574c9b 100644
--- a/roles/apache-logs-conf/tasks/main.yaml
+++ b/roles/apache-logs-conf/tasks/main.yaml
@@ -50,7 +50,7 @@
     with_items: "{{ redhat_apache_deref_logs.results }}"
     when:
       - item.stat.isreg or item.stat.islnk
-  when: ansible_os_family == 'Redhat'
+  when: ansible_os_family == 'RedHat'
   no_log: true
 
 - name: Ensure {{ stage_dir }}/apache_config apache_config exists

From e033e1b80f70c6e31364218b69f9a4fe5c8135a1 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 16 Jun 2017 12:56:53 +1000
Subject: [PATCH 1275/2409] py3 changes for outfilter.py

I started running this with dib where we have pure python3
environments and it failed.

You can't have unbuffered text i/o in python3 for ... reasons? [1]
Changing the file to binary mode works around this.  Python3 opens
sys.stdin in text mode, so we need to manually convert the unicode
strings to bytes before we write them to the binary file.

[1] http://bugs.python.org/issue17404

Change-Id: Iebb26f0d3c2347d262cbc10dfd0912840cd05878
---
 tools/outfilter.py | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/tools/outfilter.py b/tools/outfilter.py
index f82939be1d..296cf8dfe5 100755
--- a/tools/outfilter.py
+++ b/tools/outfilter.py
@@ -50,15 +50,13 @@ def main():
     opts = get_options()
     outfile = None
     if opts.outfile:
-        outfile = open(opts.outfile, 'a', 0)
+        # note, binary mode so we can do unbuffered output.
+        outfile = open(opts.outfile, 'ab', 0)
 
     # Otherwise fileinput reprocess args as files
     sys.argv = []
-    while True:
-        line = sys.stdin.readline()
-        if not line:
-            return 0
 
+    for line in iter(sys.stdin.readline, ''):
         # put skip lines here
         if skip_line(line):
             continue
@@ -75,8 +73,16 @@ def main():
         if opts.verbose:
             sys.stdout.write(line)
             sys.stdout.flush()
+
         if outfile:
-            outfile.write(line)
+            # We've opened outfile as a binary file to get the
+            # non-buffered behaviour.  on python3, sys.stdin was
+            # opened with the system encoding and made the line into
+            # utf-8, so write the logfile out in utf-8 bytes.
+            if sys.version_info < (3,):
+                outfile.write(line)
+            else:
+                outfile.write(line.encode('utf-8'))
             outfile.flush()
 
 

From 83ecb97fec7efde09f543fb1f5ef65bd6d4f1011 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 6 Feb 2018 10:03:34 +1100
Subject: [PATCH 1276/2409] Add VERBOSE_NO_TIMESTAMP flag

As described in the documentation, this flag is intended for the case
where the console output is being captured by a tool that appends its
own timestamps.

In the gate this is the job-output.txt.  We want the console output as
people like to watch that scrolling by as part of the live console
log.  Although this gets saved to job-output.txt, we still want to
keep logging to the individual log files even though it's technically
a duplicate -- in the multinode case the job-output.txt gets
interleaved by all the running nodes; it's much easier to just look at
the individual log files.  Also, people are used to it where it is :)

Change-Id: I3486636f1c76139581f6cd9668426f507b7c621d
---
 .zuul.yaml                   |  1 +
 doc/source/configuration.rst | 12 ++++++++++++
 stack.sh                     |  7 ++++++-
 tools/outfilter.py           | 27 ++++++++++++++++++++-------
 4 files changed, 39 insertions(+), 8 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index a90df2f06a..cc29466f35 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -66,6 +66,7 @@
         LOGFILE: /opt/stack/logs/devstacklog.txt
         LOG_COLOR: false
         VERBOSE: true
+        VERBOSE_NO_TIMESTAMP: true
         NOVNC_FROM_PACKAGE: true
         ERROR_ON_CLONE: true
         # Gate jobs can't deal with nested virt. Disable it.
diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 49cad05554..1d02395058 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -286,6 +286,18 @@ see what is going on. This can be disabled with::
 
         LOG_COLOR=False
 
+When using the logfile, by default logs are sent to the console and
+the file.  You can set ``VERBOSE`` to ``false`` if you only wish the
+logs to be sent to the file (this may avoid having double-logging in
+some cases where you are capturing the script output and the log
+files).  If ``VERBOSE`` is ``true`` you can additionally set
+``VERBOSE_NO_TIMESTAMP`` to avoid timestamps being added to each
+output line sent to the console.  This can be useful in some
+situations where the console output is being captured by a runner or
+framework (e.g. Ansible) that adds its own timestamps.  Note that the
+log lines sent to the ``LOGFILE`` will still be prefixed with a
+timestamp.
+
 Logging the Service Output
 ~~~~~~~~~~~~~~~~~~~~~~~~~~
 
diff --git a/stack.sh b/stack.sh
index 9b496c0e20..1d1f12e116 100755
--- a/stack.sh
+++ b/stack.sh
@@ -405,6 +405,7 @@ is_package_installed python || install_package python
 
 # Set up logging level
 VERBOSE=$(trueorfalse True VERBOSE)
+VERBOSE_NO_TIMESTAMP=$(trueorfalse False VERBOSE)
 
 # Draw a spinner so the user knows something is happening
 function spinner {
@@ -470,8 +471,12 @@ if [[ -n "$LOGFILE" ]]; then
     # stdout later.
     exec 3>&1
     if [[ "$VERBOSE" == "True" ]]; then
+        _of_args="-v"
+        if [[ "$VERBOSE_NO_TIMESTAMP" == "True" ]]; then
+            _of_args="$_of_args --no-timestamp"
+        fi
         # Set fd 1 and 2 to write the log file
-        exec 1> >( $TOP_DIR/tools/outfilter.py -v -o "${LOGFILE}" ) 2>&1
+        exec 1> >( $TOP_DIR/tools/outfilter.py $_of_args -o "${LOGFILE}" ) 2>&1
         # Set fd 6 to summary log file
         exec 6> >( $TOP_DIR/tools/outfilter.py -o "${SUMFILE}" )
     else
diff --git a/tools/outfilter.py b/tools/outfilter.py
index 296cf8dfe5..cf091247d0 100755
--- a/tools/outfilter.py
+++ b/tools/outfilter.py
@@ -36,6 +36,13 @@ def get_options():
     parser.add_argument('-o', '--outfile',
                         help='Output file for content',
                         default=None)
+    # NOTE(ianw): This is intended for the case where your stdout is
+    # being captured by something like ansible which independently
+    # logs timestamps on the lines it receives.  Note that if using a
+    # output file, those log lines are still timestamped.
+    parser.add_argument('-b', '--no-timestamp', action='store_true',
+                        help='Do not prefix stdout with timestamp (bare)',
+                        default=False)
     parser.add_argument('-v', '--verbose', action='store_true',
                         default=False)
     return parser.parse_args()
@@ -61,17 +68,23 @@ def main():
         if skip_line(line):
             continue
 
-        # This prevents us from nesting date lines, because
-        # we'd like to pull this in directly in Grenade and not double
-        # up on DevStack lines
+        # This prevents us from nesting date lines, because we'd like
+        # to pull this in directly in Grenade and not double up on
+        # DevStack lines.
+        # NOTE(ianw): we could actually strip the extra ts in "bare"
+        # mode (which came after this)? ... as we get more experience
+        # with zuulv3 native jobs and ansible capture it may become
+        # clearer what to do
         if HAS_DATE.search(line) is None:
             now = datetime.datetime.utcnow()
-            line = ("%s | %s" % (
+            ts_line = ("%s | %s" % (
                 now.strftime("%Y-%m-%d %H:%M:%S.%f")[:-3],
                 line))
+        else:
+            ts_line = line
 
         if opts.verbose:
-            sys.stdout.write(line)
+            sys.stdout.write(line if opts.no_timestamp else ts_line)
             sys.stdout.flush()
 
         if outfile:
@@ -80,9 +93,9 @@ def main():
             # opened with the system encoding and made the line into
             # utf-8, so write the logfile out in utf-8 bytes.
             if sys.version_info < (3,):
-                outfile.write(line)
+                outfile.write(ts_line)
             else:
-                outfile.write(line.encode('utf-8'))
+                outfile.write(ts_line.encode('utf-8'))
             outfile.flush()
 
 

From 2346e9a8b531d621c1adc167d8117474f69638bc Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 9 Feb 2018 12:49:22 +1100
Subject: [PATCH 1277/2409] Run swift-container-sync under run_process

All the evidence from [1] suggests that on opensuse swift-init is not
detaching the daemon process correctly.  It's possible there's a pipe
still in play that somehow holds our ansible-streamer open.

This is a minimal fix to avoid swift-init.  Although it's possible in
non-default paths to still use swift-init (and hence possibly hit
another variant of this issue), after discussions with swift
developers it was decided the intersection of tests running under our
current ansible, on suse, that would enable these services is
sufficiently small that this is the best course for now.

[1] https://storyboard.openstack.org/#!/story/2001528

Change-Id: I1b68c08c07cf6653ea58506f738cbe0054b38f3a
---
 lib/swift | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/swift b/lib/swift
index 1601e2b1f8..1187846dfc 100644
--- a/lib/swift
+++ b/lib/swift
@@ -827,7 +827,8 @@ function start_swift {
         else
             # The container-sync daemon is strictly needed to pass the container
             # sync Tempest tests.
-            swift-init --run-dir=${SWIFT_DATA_DIR}/run container-sync start
+            enable_service s-container-sync
+            run_process s-container-sync "$SWIFT_BIN_DIR/swift-container-sync ${SWIFT_CONF_DIR}/container-server/1.conf"
         fi
     else
         swift-init --run-dir=${SWIFT_DATA_DIR}/run all restart || true

From 11641ce14ddec3567187099e87f03b148aadc584 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 5 Feb 2018 14:39:18 +1100
Subject: [PATCH 1278/2409] Move platform jobs to zuulv3 native

We've called the jobs that don't run on our main Ubuntu targets
"platform" jobs; start at moving these jobs to native jobs.

Depends-On: https://review.openstack.org/541010

Change-Id: Ib64d91206a9ac677f4d77873bc54c6a84702d6c3
---
 .zuul.yaml                         | 58 ++++++++++++++++++++++++++++++
 roles/run-devstack/tasks/main.yaml |  5 ++-
 2 files changed, 62 insertions(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index cc29466f35..22ba121c2f 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -8,6 +8,36 @@
         nodes:
           - controller
 
+- nodeset:
+    name: devstack-single-node-centos-7
+    nodes:
+      - name: controller
+        label: centos-7
+    groups:
+      - name: tempest
+        nodes:
+          - controller
+
+- nodeset:
+    name: devstack-single-node-opensuse-423
+    nodes:
+      - name: controller
+        label: opensuse-423
+    groups:
+      - name: tempest
+        nodes:
+          - controller
+
+- nodeset:
+    name: devstack-single-node-fedora-27
+    nodes:
+      - name: controller
+        label: fedora-27
+    groups:
+      - name: tempest
+        nodes:
+          - controller
+
 - nodeset:
     name: openstack-two-node
     nodes:
@@ -140,6 +170,31 @@
     # ready yet. Until then this job should stay non-voting.
     voting: false
 
+# NOTE(ianw) Platform tests have traditionally been non-voting because
+# we often have to rush things through devstack to stabilise the gate,
+# and these platforms don't have the round-the-clock support to avoid
+# becoming blockers in that situation.
+- job:
+    name: devstack-platform-centos-7
+    parent: tempest-full
+    description: Centos 7 platform test
+    nodeset: devstack-single-node-centos-7
+    voting: false
+
+- job:
+    name: devstack-platform-opensuse-423
+    parent: tempest-full
+    description: OpenSuSE 43.2 platform test
+    nodeset: devstack-single-node-opensuse-423
+    voting: false
+
+- job:
+    name: devstack-platform-fedora-27
+    parent: tempest-full
+    description: Fedora 27 platform test
+    nodeset: devstack-single-node-fedora-27
+    voting: false
+
 - job:
     name: devstack-tox-base
     parent: devstack
@@ -207,6 +262,9 @@
     check:
       jobs:
         - devstack
+        - devstack-platform-centos-7
+        - devstack-platform-opensuse-423
+        - devstack-platform-fedora-27
         - devstack-multinode
         - devstack-unit-tests
     gate:
diff --git a/roles/run-devstack/tasks/main.yaml b/roles/run-devstack/tasks/main.yaml
index 64f769c0d0..1ff82950e4 100644
--- a/roles/run-devstack/tasks/main.yaml
+++ b/roles/run-devstack/tasks/main.yaml
@@ -1,5 +1,8 @@
 - name: Run devstack
-  shell: ./stack.sh 2>&1
+  shell:
+    cmd: |
+      ./stack.sh 2>&1
+      echo "*** FINISHED ***"
   args:
     chdir: "{{devstack_base_dir}}/devstack"
   become: true

From e619603bdab1eebc05690e42de887614a778022a Mon Sep 17 00:00:00 2001
From: Jianghua Wang <jianghua.wang@citrix.com>
Date: Fri, 23 Feb 2018 03:49:18 +0000
Subject: [PATCH 1279/2409] XenAPI: remove xen tools

The xen tools have been moved to the project of *os-xenapi* since
os-xenapi 0.3.0. We also did some refact work on these tools in
os-xenapi. This commit is to remove these tools from devstack. So
that os-xenapi will be the single place for xen tools.

Change-Id: I4fdbe6bce12dfedd0d1e975ab8dd624ee3740c11
---
 tools/xen/README.md                          | 174 +------
 tools/xen/build_xva.sh                       | 191 --------
 tools/xen/devstackubuntu_latecommand.sh      |  14 -
 tools/xen/devstackubuntupreseed.cfg          | 471 -------------------
 tools/xen/functions                          | 341 --------------
 tools/xen/install_os_domU.sh                 | 418 ----------------
 tools/xen/mocks                              |  92 ----
 tools/xen/prepare_guest.sh                   | 123 -----
 tools/xen/prepare_guest_template.sh          |  94 ----
 tools/xen/scripts/install-os-vpx.sh          | 135 ------
 tools/xen/scripts/install_ubuntu_template.sh |  84 ----
 tools/xen/scripts/manage-vdi                 |  96 ----
 tools/xen/scripts/on_exit.sh                 |  24 -
 tools/xen/scripts/uninstall-os-vpx.sh        |  88 ----
 tools/xen/test_functions.sh                  | 205 --------
 tools/xen/xenrc                              | 114 -----
 16 files changed, 2 insertions(+), 2662 deletions(-)
 delete mode 100755 tools/xen/build_xva.sh
 delete mode 100644 tools/xen/devstackubuntu_latecommand.sh
 delete mode 100644 tools/xen/devstackubuntupreseed.cfg
 delete mode 100644 tools/xen/functions
 delete mode 100755 tools/xen/install_os_domU.sh
 delete mode 100644 tools/xen/mocks
 delete mode 100755 tools/xen/prepare_guest.sh
 delete mode 100755 tools/xen/prepare_guest_template.sh
 delete mode 100755 tools/xen/scripts/install-os-vpx.sh
 delete mode 100755 tools/xen/scripts/install_ubuntu_template.sh
 delete mode 100755 tools/xen/scripts/manage-vdi
 delete mode 100755 tools/xen/scripts/on_exit.sh
 delete mode 100755 tools/xen/scripts/uninstall-os-vpx.sh
 delete mode 100755 tools/xen/test_functions.sh
 delete mode 100644 tools/xen/xenrc

diff --git a/tools/xen/README.md b/tools/xen/README.md
index 9559e773d3..22263bb074 100644
--- a/tools/xen/README.md
+++ b/tools/xen/README.md
@@ -1,173 +1,3 @@
-# Getting Started With XenServer and Devstack
-
-The purpose of the code in this directory it to help developers bootstrap a
-XenServer 6.2 (older versions may also work) + OpenStack development
-environment. This file gives some pointers on how to get started.
-
-Xenserver is a Type 1 hypervisor, so it is best installed on bare metal.  The
-OpenStack services are configured to run within a virtual machine (called OS
-domU) on the XenServer host. The VM uses the XAPI toolstack to communicate with
-the host over a network connection (see `MGT_BRIDGE_OR_NET_NAME`).
-
-The provided localrc helps to build a basic environment.
-
-## Introduction
-
-### Requirements
-
- - An internet-enabled network with a DHCP server on it
- - XenServer box plugged in to the same network
-This network will be used as the OpenStack management network. The VM Network
-and the Public Network will not be connected to any physical interfaces, only
-new virtual networks will be created by the `install_os_domU.sh` script.
-
-### Steps to follow
-
- - Install XenServer
- - Download Devstack to XenServer
- - Customise `localrc`
- - Start `install_os_domU.sh` script
-
-### Brief explanation
-
-The `install_os_domU.sh` script will:
- - Setup XenAPI plugins
- - Create the named networks, if they don't exist
- - Preseed-Netinstall an Ubuntu Virtual Machine (NOTE: you can save and reuse
-   it, see [Reuse the Ubuntu VM](#reuse-the-ubuntu-vm)), with 1 network
-   interface:
-   - `eth0` - Connected to `UBUNTU_INST_BRIDGE_OR_NET_NAME`, defaults to
-     `MGT_BRIDGE_OR_NET_NAME`
- - After the Ubuntu install process finished, the network configuration is
- modified to:
-   - `eth0` - Management interface, connected to `MGT_BRIDGE_OR_NET_NAME`. Xapi
-     must be accessible through this network.
-   - `eth1` - VM interface, connected to `VM_BRIDGE_OR_NET_NAME`
-   - `eth2` - Public interface, connected to `PUB_BRIDGE_OR_NET_NAME`
- - Start devstack inside the created OpenStack VM
-
-## Step 1: Install Xenserver
-Install XenServer on a clean box. You can download the latest XenServer for
-free from: http://www.xenserver.org/
-
-The XenServer IP configuration depends on your local network setup. If you are
-using dhcp, make a reservation for XenServer, so its IP address won't change
-over time. Make a note of the XenServer's IP address, as it has to be specified
-in `localrc`. The other option is to manually specify the IP setup for the
-XenServer box. Please make sure, that a gateway and a nameserver is configured,
-as `install_os_domU.sh` will connect to github.com to get source-code snapshots.
-
-## Step 2: Download devstack
-On your XenServer host, run the following commands as root:
-
-    wget --no-check-certificate https://github.com/openstack-dev/devstack/zipball/master
-    unzip -o master -d ./devstack
-    cd devstack/*/
-
-## Step 3: Configure your localrc inside the devstack directory
-Devstack uses a localrc for user-specific configuration.  Note that
-the `XENAPI_PASSWORD` must be your dom0 root password.
-Of course, use real passwords if this machine is exposed.
-
-    cat > ./localrc <<EOF
-    # At the moment, we depend on github's snapshot function.
-    GIT_BASE="http://github.com"
-
-    # Passwords
-    # NOTE: these need to be specified, otherwise devstack will try
-    # to prompt for these passwords, blocking the install process.
-
-    DATABASE_PASSWORD=my_super_secret
-    ADMIN_PASSWORD=my_super_secret
-    SERVICE_PASSWORD=my_super_secret
-    RABBIT_PASSWORD=my_super_secret
-    SWIFT_HASH="66a3d6b56c1f479c8b4e70ab5c2000f5"
-    # This will be the password for the OpenStack VM (both stack and root users)
-    GUEST_PASSWORD=my_super_secret
-
-    # XenAPI parameters
-    # NOTE: The following must be set to your XenServer root password!
-
-    XENAPI_PASSWORD=my_xenserver_root_password
-
-    XENAPI_CONNECTION_URL="http://address_of_your_xenserver"
-    VNCSERVER_PROXYCLIENT_ADDRESS=address_of_your_xenserver
-
-    # Explicitly set virt driver
-    VIRT_DRIVER=xenserver
-
-    # Explicitly enable multi-host for nova-network HA
-    MULTI_HOST=1
-
-    # Give extra time for boot
-    ACTIVE_TIMEOUT=45
-
-    EOF
-
-## Step 4: Run `./install_os_domU.sh` from the `tools/xen` directory
-
-    cd tools/xen
-    ./install_os_domU.sh
-
-Once this script finishes executing, log into the VM (openstack domU) that it
-installed and tail the run.sh.log file. You will need to wait until it run.sh
-has finished executing.
-
-# Appendix
-
-This section contains useful information for running devstack in CI
-environments / using ubuntu network mirrors.
-
-## Use a specific Ubuntu mirror for installation
-
-To speed up the Ubuntu installation, you can use a specific mirror. To specify
-a mirror explicitly, include the following settings in your `localrc` file:
-
-    UBUNTU_INST_HTTP_HOSTNAME="archive.ubuntu.com"
-    UBUNTU_INST_HTTP_DIRECTORY="/ubuntu"
-
-These variables set the `mirror/http/hostname` and `mirror/http/directory`
-settings in the ubuntu preseed file. The minimal ubuntu VM will use the
-specified parameters.
-
-## Use an http proxy to speed up Ubuntu installation
-
-To further speed up the Ubuntu VM and package installation, an internal http
-proxy could be used. `squid-deb-proxy` has prooven to be stable. To use an http
-proxy, specify:
-
-    UBUNTU_INST_HTTP_PROXY="http://ubuntu-proxy.somedomain.com:8000"
-
-in your `localrc` file.
-
-## Reuse the Ubuntu VM
-
-Performing a minimal ubuntu installation could take a lot of time, depending on
-your mirror/network speed. If you run `install_os_domU.sh` script on a clean
-hypervisor, you can speed up the installation, by re-using the ubuntu vm from
-a previous installation.
-
-### Export the Ubuntu VM to an XVA
-
-Given you have an nfs export `TEMPLATE_NFS_DIR`:
-
-    TEMPLATE_FILENAME=devstack-jeos.xva
-    TEMPLATE_NAME=jeos_template_for_devstack
-    mountdir=$(mktemp -d)
-    mount -t nfs "$TEMPLATE_NFS_DIR" "$mountdir"
-    VM="$(xe template-list name-label="$TEMPLATE_NAME" --minimal)"
-    xe template-export template-uuid=$VM filename="$mountdir/$TEMPLATE_FILENAME"
-    umount "$mountdir"
-    rm -rf "$mountdir"
-
-### Import the Ubuntu VM
-
-Given you have an nfs export `TEMPLATE_NFS_DIR` where you exported the Ubuntu
-VM as `TEMPLATE_FILENAME`:
-
-    mountdir=$(mktemp -d)
-    mount -t nfs "$TEMPLATE_NFS_DIR" "$mountdir"
-    xe vm-import filename="$mountdir/$TEMPLATE_FILENAME"
-    umount "$mountdir"
-    rm -rf "$mountdir"
+Note: XenServer relative tools have been moved to `os-xenapi`_ and be maintained there.
 
+.. _os-xenapi: https://github.com/openstack/os-xenapi/
diff --git a/tools/xen/build_xva.sh b/tools/xen/build_xva.sh
deleted file mode 100755
index 34ef719ab9..0000000000
--- a/tools/xen/build_xva.sh
+++ /dev/null
@@ -1,191 +0,0 @@
-#!/bin/bash
-
-# This script is run by install_os_domU.sh
-#
-# It modifies the ubuntu image created by install_os_domU.sh
-# and previously moodified by prepare_guest_template.sh
-#
-# This script is responsible for:
-# - pushing in the DevStack code
-# - creating run.sh, to run the code on boot
-# It does this by mounting the disk image of the VM.
-#
-# The resultant image is then templated and started
-# by install_os_domU.sh
-
-# Exit on errors
-set -o errexit
-# Echo commands
-set -o xtrace
-
-# This directory
-TOP_DIR=$(cd $(dirname "$0") && pwd)
-
-# Include onexit commands
-. $TOP_DIR/scripts/on_exit.sh
-
-# xapi functions
-. $TOP_DIR/functions
-
-# Source params - override xenrc params in your localrc to suite your taste
-source xenrc
-
-#
-# Parameters
-#
-GUEST_NAME="$1"
-
-function _print_interface_config {
-    local device_nr
-    local ip_address
-    local netmask
-
-    device_nr="$1"
-    ip_address="$2"
-    netmask="$3"
-
-    local device
-
-    device="eth${device_nr}"
-
-    echo "auto $device"
-    if [ $ip_address == "dhcp" ]; then
-        echo "iface $device inet dhcp"
-    else
-        echo "iface $device inet static"
-        echo "  address $ip_address"
-        echo "  netmask $netmask"
-    fi
-
-    # Turn off tx checksumming for better performance
-    echo "  post-up ethtool -K $device tx off"
-}
-
-function print_interfaces_config {
-    echo "auto lo"
-    echo "iface lo inet loopback"
-
-    _print_interface_config $PUB_DEV_NR $PUB_IP $PUB_NETMASK
-    _print_interface_config $VM_DEV_NR $VM_IP $VM_NETMASK
-    _print_interface_config $MGT_DEV_NR $MGT_IP $MGT_NETMASK
-}
-
-#
-# Mount the VDI
-#
-STAGING_DIR=$($TOP_DIR/scripts/manage-vdi open $GUEST_NAME 0 1 | grep -o "/tmp/tmp.[[:alnum:]]*")
-add_on_exit "$TOP_DIR/scripts/manage-vdi close $GUEST_NAME 0 1"
-
-# Make sure we have a stage
-if [ ! -d $STAGING_DIR/etc ]; then
-    echo "Stage is not properly set up!"
-    exit 1
-fi
-
-# Only support DHCP for now - don't support how different versions of Ubuntu handle resolv.conf
-if [ "$MGT_IP" != "dhcp" ] && [ "$PUB_IP" != "dhcp" ]; then
-    echo "Configuration without DHCP not supported"
-    exit 1
-fi
-
-# Copy over devstack
-rm -f /tmp/devstack.tar
-cd $TOP_DIR/../../
-tar --exclude='stage' --exclude='xen/xvas' --exclude='xen/nova' -cvf /tmp/devstack.tar .
-mkdir -p $STAGING_DIR/opt/stack/devstack
-tar xf /tmp/devstack.tar -C $STAGING_DIR/opt/stack/devstack
-cd $TOP_DIR
-
-# Create an systemd task for devstack
-cat >$STAGING_DIR/etc/systemd/system/devstack.service << EOF
-[Unit]
-Description=Install OpenStack by DevStack
-
-[Service]
-Type=oneshot
-RemainAfterExit=yes
-ExecStartPre=/bin/rm -f /opt/stack/runsh.succeeded
-ExecStart=/bin/su -c "/opt/stack/run.sh" stack
-StandardOutput=tty
-StandardError=tty
-
-[Install]
-WantedBy=multi-user.target
-
-EOF
-
-# enable this service
-ln -s $STAGING_DIR/etc/systemd/system/devstack.service $STAGING_DIR/etc/systemd/system/multi-user.target.wants/devstack.service
-
-# Configure the hostname
-echo $GUEST_NAME > $STAGING_DIR/etc/hostname
-
-# Hostname must resolve for rabbit
-HOSTS_FILE_IP=$PUB_IP
-if [ $MGT_IP != "dhcp" ]; then
-    HOSTS_FILE_IP=$MGT_IP
-fi
-cat <<EOF >$STAGING_DIR/etc/hosts
-$HOSTS_FILE_IP $GUEST_NAME
-127.0.0.1 localhost localhost.localdomain
-EOF
-
-# Configure the network
-print_interfaces_config > $STAGING_DIR/etc/network/interfaces
-
-# Gracefully cp only if source file/dir exists
-function cp_it {
-    if [ -e $1 ] || [ -d $1 ]; then
-        cp -pRL $1 $2
-    fi
-}
-
-# Copy over your ssh keys and env if desired
-COPYENV=${COPYENV:-1}
-if [ "$COPYENV" = "1" ]; then
-    cp_it ~/.ssh $STAGING_DIR/opt/stack/.ssh
-    cp_it ~/.ssh/id_rsa.pub $STAGING_DIR/opt/stack/.ssh/authorized_keys
-    cp_it ~/.gitconfig $STAGING_DIR/opt/stack/.gitconfig
-    cp_it ~/.vimrc $STAGING_DIR/opt/stack/.vimrc
-    cp_it ~/.bashrc $STAGING_DIR/opt/stack/.bashrc
-fi
-
-# Configure run.sh
-cat <<EOF >$STAGING_DIR/opt/stack/run.sh
-#!/bin/bash
-set -eux
-(
-  flock -n 9 || exit 1
-
-  sudo chown -R stack /opt/stack
-
-  [ -e /opt/stack/runsh.succeeded ] && rm /opt/stack/runsh.succeeded
-  echo \$\$ >> /opt/stack/run_sh.pid
-
-  cd /opt/stack/devstack
-  ./unstack.sh || true
-  ./stack.sh
-
-  # Got to the end - success
-  touch /opt/stack/runsh.succeeded
-
-  # Update /etc/issue
-  (
-      echo "OpenStack VM - Installed by DevStack"
-      IPADDR=$(ip -4 address show eth0 | sed -n 's/.*inet \([0-9\.]\+\).*/\1/p')
-      echo "  Management IP:   $IPADDR"
-      echo -n "  Devstack run:    "
-      if [ -e /opt/stack/runsh.succeeded ]; then
-          echo "SUCCEEDED"
-      else
-          echo "FAILED"
-      fi
-      echo ""
-  ) > /opt/stack/issue
-  sudo cp /opt/stack/issue /etc/issue
-
-  rm /opt/stack/run_sh.pid
-) 9> /opt/stack/.runsh_lock
-EOF
-
-chmod 755 $STAGING_DIR/opt/stack/run.sh
diff --git a/tools/xen/devstackubuntu_latecommand.sh b/tools/xen/devstackubuntu_latecommand.sh
deleted file mode 100644
index 2afbe2cdf3..0000000000
--- a/tools/xen/devstackubuntu_latecommand.sh
+++ /dev/null
@@ -1,14 +0,0 @@
-#!/bin/bash
-set -eux
-
-# Need to set barrier=0 to avoid a Xen bug
-# https://bugs.launchpad.net/ubuntu/+source/linux/+bug/824089
-sed -i -e 's/errors=/barrier=0,errors=/' /etc/fstab
-
-# Allow root to login with a password
-sed -i -e 's/.*PermitRootLogin.*/PermitRootLogin yes/g' /etc/ssh/sshd_config
-
-# Install the XenServer tools so IP addresses are reported
-wget --no-proxy @XS_TOOLS_URL@ -O /root/tools.deb
-dpkg -i /root/tools.deb
-rm /root/tools.deb
diff --git a/tools/xen/devstackubuntupreseed.cfg b/tools/xen/devstackubuntupreseed.cfg
deleted file mode 100644
index 80f334ba8e..0000000000
--- a/tools/xen/devstackubuntupreseed.cfg
+++ /dev/null
@@ -1,471 +0,0 @@
-### Contents of the preconfiguration file (for squeeze)
-### Localization
-# Preseeding only locale sets language, country and locale.
-d-i debian-installer/locale string en_US
-
-# The values can also be preseeded individually for greater flexibility.
-#d-i debian-installer/language string en
-#d-i debian-installer/country string NL
-#d-i debian-installer/locale string en_GB.UTF-8
-# Optionally specify additional locales to be generated.
-#d-i localechooser/supported-locales en_US.UTF-8, nl_NL.UTF-8
-
-# Keyboard selection.
-# Disable automatic (interactive) keymap detection.
-d-i console-setup/ask_detect boolean false
-#d-i keyboard-configuration/modelcode string pc105
-d-i keyboard-configuration/layoutcode string us
-# To select a variant of the selected layout (if you leave this out, the
-# basic form of the layout will be used):
-#d-i keyboard-configuration/variantcode string dvorak
-
-### Network configuration
-# Disable network configuration entirely. This is useful for cdrom
-# installations on non-networked devices where the network questions,
-# warning and long timeouts are a nuisance.
-#d-i netcfg/enable boolean false
-
-# netcfg will choose an interface that has link if possible. This makes it
-# skip displaying a list if there is more than one interface.
-d-i netcfg/choose_interface select auto
-
-# To pick a particular interface instead:
-#d-i netcfg/choose_interface select eth1
-
-# If you have a slow dhcp server and the installer times out waiting for
-# it, this might be useful.
-d-i netcfg/dhcp_timeout string 120
-
-# If you prefer to configure the network manually, uncomment this line and
-# the static network configuration below.
-#d-i netcfg/disable_autoconfig boolean true
-
-# If you want the preconfiguration file to work on systems both with and
-# without a dhcp server, uncomment these lines and the static network
-# configuration below.
-#d-i netcfg/dhcp_failed note
-#d-i netcfg/dhcp_options select Configure network manually
-
-# Static network configuration.
-#d-i netcfg/get_nameservers string 192.168.1.1
-#d-i netcfg/get_ipaddress string 192.168.1.42
-#d-i netcfg/get_netmask string 255.255.255.0
-#d-i netcfg/get_gateway string 192.168.1.1
-#d-i netcfg/confirm_static boolean true
-
-# Any hostname and domain names assigned from dhcp take precedence over
-# values set here. However, setting the values still prevents the questions
-# from being shown, even if values come from dhcp.
-d-i netcfg/get_hostname string stack
-d-i netcfg/get_domain string stackpass
-
-# Disable that annoying WEP key dialog.
-d-i netcfg/wireless_wep string
-# The wacky dhcp hostname that some ISPs use as a password of sorts.
-#d-i netcfg/dhcp_hostname string radish
-
-# If non-free firmware is needed for the network or other hardware, you can
-# configure the installer to always try to load it, without prompting. Or
-# change to false to disable asking.
-#d-i hw-detect/load_firmware boolean true
-
-### Network console
-# Use the following settings if you wish to make use of the network-console
-# component for remote installation over SSH. This only makes sense if you
-# intend to perform the remainder of the installation manually.
-#d-i anna/choose_modules string network-console
-#d-i network-console/password password r00tme
-#d-i network-console/password-again password r00tme
-
-### Mirror settings
-# If you select ftp, the mirror/country string does not need to be set.
-#d-i mirror/protocol string ftp
-d-i mirror/country string manual
-d-i mirror/http/hostname string archive.ubuntu.com
-d-i mirror/http/directory string /ubuntu
-d-i mirror/http/proxy string
-
-# Alternatively: by default, the installer uses CC.archive.ubuntu.com where
-# CC is the ISO-3166-2 code for the selected country. You can preseed this
-# so that it does so without asking.
-#d-i mirror/http/mirror select CC.archive.ubuntu.com
-
-# Suite to install.
-#d-i mirror/suite string squeeze
-# Suite to use for loading installer components (optional).
-#d-i mirror/udeb/suite string squeeze
-# Components to use for loading installer components (optional).
-#d-i mirror/udeb/components multiselect main, restricted
-
-### Clock and time zone setup
-# Controls whether or not the hardware clock is set to UTC.
-d-i clock-setup/utc boolean true
-
-# You may set this to any valid setting for $TZ; see the contents of
-# /usr/share/zoneinfo/ for valid values.
-d-i time/zone string US/Pacific
-
-# Controls whether to use NTP to set the clock during the install
-d-i clock-setup/ntp boolean true
-# NTP server to use. The default is almost always fine here.
-d-i clock-setup/ntp-server string 0.us.pool.ntp.org
-
-### Partitioning
-## Partitioning example
-# If the system has free space you can choose to only partition that space.
-# This is only honoured if partman-auto/method (below) is not set.
-# Alternatives: custom, some_device, some_device_crypto, some_device_lvm.
-#d-i partman-auto/init_automatically_partition select biggest_free
-
-# Alternatively, you may specify a disk to partition. If the system has only
-# one disk the installer will default to using that, but otherwise the device
-# name must be given in traditional, non-devfs format (so e.g. /dev/hda or
-# /dev/sda, and not e.g. /dev/discs/disc0/disc).
-# For example, to use the first SCSI/SATA hard disk:
-#d-i partman-auto/disk string /dev/sda
-# In addition, you'll need to specify the method to use.
-# The presently available methods are:
-# - regular: use the usual partition types for your architecture
-# - lvm:     use LVM to partition the disk
-# - crypto:  use LVM within an encrypted partition
-d-i partman-auto/method string regular
-
-# If one of the disks that are going to be automatically partitioned
-# contains an old LVM configuration, the user will normally receive a
-# warning. This can be preseeded away...
-d-i partman-lvm/device_remove_lvm boolean true
-# The same applies to pre-existing software RAID array:
-d-i partman-md/device_remove_md boolean true
-# And the same goes for the confirmation to write the lvm partitions.
-d-i partman-lvm/confirm boolean true
-
-# For LVM partitioning, you can select how much of the volume group to use
-# for logical volumes.
-#d-i partman-auto-lvm/guided_size string max
-#d-i partman-auto-lvm/guided_size string 10GB
-#d-i partman-auto-lvm/guided_size string 50%
-
-# You can choose one of the three predefined partitioning recipes:
-# - atomic: all files in one partition
-# - home:   separate /home partition
-# - multi:  separate /home, /usr, /var, and /tmp partitions
-d-i partman-auto/choose_recipe select atomic
-
-# Or provide a recipe of your own...
-# If you have a way to get a recipe file into the d-i environment, you can
-# just point at it.
-#d-i partman-auto/expert_recipe_file string /hd-media/recipe
-
-# If not, you can put an entire recipe into the preconfiguration file in one
-# (logical) line. This example creates a small /boot partition, suitable
-# swap, and uses the rest of the space for the root partition:
-#d-i partman-auto/expert_recipe string                         \
-#      boot-root ::                                            \
-#              40 50 100 ext3                                  \
-#                      $primary{ } $bootable{ }                \
-#                      method{ format } format{ }              \
-#                      use_filesystem{ } filesystem{ ext3 }    \
-#                      mountpoint{ /boot }                     \
-#              .                                               \
-#              500 10000 1000000000 ext3                       \
-#                      method{ format } format{ }              \
-#                      use_filesystem{ } filesystem{ ext3 }    \
-#                      mountpoint{ / }                         \
-#              .                                               \
-#              64 512 300% linux-swap                          \
-#                      method{ swap } format{ }                \
-#              .
-
-# If you just want to change the default filesystem from ext3 to something
-# else, you can do that without providing a full recipe.
-d-i partman/default_filesystem string ext3
-
-# The full recipe format is documented in the file partman-auto-recipe.txt
-# included in the 'debian-installer' package or available from D-I source
-# repository. This also documents how to specify settings such as file
-# system labels, volume group names and which physical devices to include
-# in a volume group.
-
-# This makes partman automatically partition without confirmation, provided
-# that you told it what to do using one of the methods above.
-d-i partman-partitioning/confirm_write_new_label boolean true
-d-i partman/choose_partition select finish
-d-i partman/confirm boolean true
-d-i partman/confirm_nooverwrite boolean true
-
-## Partitioning using RAID
-# The method should be set to "raid".
-#d-i partman-auto/method string raid
-# Specify the disks to be partitioned. They will all get the same layout,
-# so this will only work if the disks are the same size.
-#d-i partman-auto/disk string /dev/sda /dev/sdb
-
-# Next you need to specify the physical partitions that will be used. 
-#d-i partman-auto/expert_recipe string \
-#      multiraid ::                                         \
-#              1000 5000 4000 raid                          \
-#                      $primary{ } method{ raid }           \
-#              .                                            \
-#              64 512 300% raid                             \
-#                      method{ raid }                       \
-#              .                                            \
-#              500 10000 1000000000 raid                    \
-#                      method{ raid }                       \
-#              .
-
-# Last you need to specify how the previously defined partitions will be
-# used in the RAID setup. Remember to use the correct partition numbers
-# for logical partitions. RAID levels 0, 1, 5, 6 and 10 are supported;
-# devices are separated using "#".
-# Parameters are:
-# <raidtype> <devcount> <sparecount> <fstype> <mountpoint> \
-#          <devices> <sparedevices>
-
-#d-i partman-auto-raid/recipe string \
-#    1 2 0 ext3 /                    \
-#          /dev/sda1#/dev/sdb1       \
-#    .                               \
-#    1 2 0 swap -                    \
-#          /dev/sda5#/dev/sdb5       \
-#    .                               \
-#    0 2 0 ext3 /home                \
-#          /dev/sda6#/dev/sdb6       \
-#    .
-
-# For additional information see the file partman-auto-raid-recipe.txt
-# included in the 'debian-installer' package or available from D-I source
-# repository.
-
-# This makes partman automatically partition without confirmation.
-d-i partman-md/confirm boolean true
-d-i partman-partitioning/confirm_write_new_label boolean true
-d-i partman/choose_partition select finish
-d-i partman/confirm boolean true
-d-i partman/confirm_nooverwrite boolean true
-
-## Controlling how partitions are mounted
-# The default is to mount by UUID, but you can also choose "traditional" to
-# use traditional device names, or "label" to try filesystem labels before
-# falling back to UUIDs.
-#d-i partman/mount_style select uuid
-
-### Base system installation
-# Configure APT to not install recommended packages by default. Use of this
-# option can result in an incomplete system and should only be used by very
-# experienced users.
-#d-i base-installer/install-recommends boolean false
-
-# The kernel image (meta) package to be installed; "none" can be used if no
-# kernel is to be installed.
-d-i base-installer/kernel/image string linux-virtual
-
-### Account setup
-# Skip creation of a root account (normal user account will be able to
-# use sudo). The default is false; preseed this to true if you want to set
-# a root password.
-d-i passwd/root-login boolean true
-# Alternatively, to skip creation of a normal user account.
-d-i passwd/make-user boolean false
-
-# Root password, either in clear text
-d-i passwd/root-password password stackpass
-d-i passwd/root-password-again password stackpass
-# or encrypted using an MD5 hash.
-#d-i passwd/root-password-crypted password [MD5 hash]
-
-# To create a normal user account.
-#d-i passwd/user-fullname string Ubuntu User
-#d-i passwd/username string ubuntu
-# Normal user's password, either in clear text
-#d-i passwd/user-password password insecure
-#d-i passwd/user-password-again password insecure
-# or encrypted using an MD5 hash.
-#d-i passwd/user-password-crypted password [MD5 hash]
-# Create the first user with the specified UID instead of the default.
-#d-i passwd/user-uid string 1010
-# The installer will warn about weak passwords. If you are sure you know
-# what you're doing and want to override it, uncomment this.
-d-i user-setup/allow-password-weak boolean true
-
-# The user account will be added to some standard initial groups. To
-# override that, use this.
-#d-i passwd/user-default-groups string audio cdrom video
-
-# Set to true if you want to encrypt the first user's home directory.
-d-i user-setup/encrypt-home boolean false
-
-### Apt setup
-# You can choose to install restricted and universe software, or to install
-# software from the backports repository.
-d-i apt-setup/restricted boolean true
-d-i apt-setup/universe boolean true
-d-i apt-setup/backports boolean true
-# Uncomment this if you don't want to use a network mirror.
-#d-i apt-setup/use_mirror boolean false
-# Select which update services to use; define the mirrors to be used.
-# Values shown below are the normal defaults.
-#d-i apt-setup/services-select multiselect security
-#d-i apt-setup/security_host string security.ubuntu.com
-#d-i apt-setup/security_path string /ubuntu
-
-# Additional repositories, local[0-9] available
-#d-i apt-setup/local0/repository string \
-#       http://local.server/ubuntu squeeze main
-#d-i apt-setup/local0/comment string local server
-# Enable deb-src lines
-#d-i apt-setup/local0/source boolean true
-# URL to the public key of the local repository; you must provide a key or
-# apt will complain about the unauthenticated repository and so the
-# sources.list line will be left commented out
-#d-i apt-setup/local0/key string http://local.server/key
-
-# By default the installer requires that repositories be authenticated
-# using a known gpg key. This setting can be used to disable that
-# authentication. Warning: Insecure, not recommended.
-#d-i debian-installer/allow_unauthenticated boolean true
-
-### Package selection
-#tasksel tasksel/first multiselect ubuntu-desktop
-#tasksel tasksel/first multiselect lamp-server, print-server
-#tasksel tasksel/first multiselect kubuntu-desktop
-tasksel tasksel/first multiselect openssh-server
-
-# Individual additional packages to install
-d-i pkgsel/include string cracklib-runtime curl wget ssh openssh-server tcpdump ethtool git sudo python-netaddr coreutils
-
-# Whether to upgrade packages after debootstrap.
-# Allowed values: none, safe-upgrade, full-upgrade
-d-i pkgsel/upgrade select safe-upgrade
-
-# Language pack selection
-#d-i pkgsel/language-packs multiselect de, en, zh
-
-# Policy for applying updates. May be "none" (no automatic updates),
-# "unattended-upgrades" (install security updates automatically), or
-# "landscape" (manage system with Landscape).
-d-i pkgsel/update-policy select unattended-upgrades
-
-# Some versions of the installer can report back on what software you have
-# installed, and what software you use. The default is not to report back,
-# but sending reports helps the project determine what software is most
-# popular and include it on CDs.
-#popularity-contest popularity-contest/participate boolean false
-
-# By default, the system's locate database will be updated after the
-# installer has finished installing most packages. This may take a while, so
-# if you don't want it, you can set this to "false" to turn it off.
-d-i pkgsel/updatedb boolean false
-
-### Boot loader installation
-# Grub is the default boot loader (for x86). If you want lilo installed
-# instead, uncomment this:
-#d-i grub-installer/skip boolean true
-# To also skip installing lilo, and install no bootloader, uncomment this
-# too:
-#d-i lilo-installer/skip boolean true
-
-# With a few exceptions for unusual partitioning setups, GRUB 2 is now the
-# default. If you need GRUB Legacy for some particular reason, then
-# uncomment this:
-d-i grub-installer/grub2_instead_of_grub_legacy boolean false
-
-# This is fairly safe to set, it makes grub install automatically to the MBR
-# if no other operating system is detected on the machine.
-d-i grub-installer/only_debian boolean true
-
-# This one makes grub-installer install to the MBR if it also finds some other
-# OS, which is less safe as it might not be able to boot that other OS.
-d-i grub-installer/with_other_os boolean true
-
-# Alternatively, if you want to install to a location other than the mbr,
-# uncomment and edit these lines:
-#d-i grub-installer/only_debian boolean false
-#d-i grub-installer/with_other_os boolean false
-#d-i grub-installer/bootdev  string (hd0,0)
-# To install grub to multiple disks:
-#d-i grub-installer/bootdev  string (hd0,0) (hd1,0) (hd2,0)
-
-# Optional password for grub, either in clear text
-#d-i grub-installer/password password r00tme
-#d-i grub-installer/password-again password r00tme
-# or encrypted using an MD5 hash, see grub-md5-crypt(8).
-#d-i grub-installer/password-crypted password [MD5 hash]
-
-# Use the following option to add additional boot parameters for the
-# installed system (if supported by the bootloader installer).
-# Note: options passed to the installer will be added automatically.
-#d-i debian-installer/add-kernel-opts string nousb
-
-### Finishing up the installation
-# During installations from serial console, the regular virtual consoles
-# (VT1-VT6) are normally disabled in /etc/inittab. Uncomment the next
-# line to prevent this.
-d-i finish-install/keep-consoles boolean true
-
-# Avoid that last message about the install being complete.
-d-i finish-install/reboot_in_progress note
-
-# This will prevent the installer from ejecting the CD during the reboot,
-# which is useful in some situations.
-#d-i cdrom-detect/eject boolean false
-
-# This is how to make the installer shutdown when finished, but not
-# reboot into the installed system.
-#d-i debian-installer/exit/halt boolean true
-# This will power off the machine instead of just halting it.
-#d-i debian-installer/exit/poweroff boolean true
-
-### X configuration
-# X can detect the right driver for some cards, but if you're preseeding,
-# you override whatever it chooses. Still, vesa will work most places.
-#xserver-xorg xserver-xorg/config/device/driver select vesa
-
-# A caveat with mouse autodetection is that if it fails, X will retry it
-# over and over. So if it's preseeded to be done, there is a possibility of
-# an infinite loop if the mouse is not autodetected.
-#xserver-xorg xserver-xorg/autodetect_mouse boolean true
-
-# Monitor autodetection is recommended.
-xserver-xorg xserver-xorg/autodetect_monitor boolean true
-# Uncomment if you have an LCD display.
-#xserver-xorg xserver-xorg/config/monitor/lcd boolean true
-# X has three configuration paths for the monitor. Here's how to preseed
-# the "medium" path, which is always available. The "simple" path may not
-# be available, and the "advanced" path asks too many questions.
-xserver-xorg xserver-xorg/config/monitor/selection-method \
-       select medium
-xserver-xorg xserver-xorg/config/monitor/mode-list \
-       select 1024x768 @ 60 Hz
-
-### Preseeding other packages
-# Depending on what software you choose to install, or if things go wrong
-# during the installation process, it's possible that other questions may
-# be asked. You can preseed those too, of course. To get a list of every
-# possible question that could be asked during an install, do an
-# installation, and then run these commands:
-#   debconf-get-selections --installer > file
-#   debconf-get-selections >> file
-
-
-#### Advanced options
-### Running custom commands during the installation
-# d-i preseeding is inherently not secure. Nothing in the installer checks
-# for attempts at buffer overflows or other exploits of the values of a
-# preconfiguration file like this one. Only use preconfiguration files from
-# trusted locations! To drive that home, and because it's generally useful,
-# here's a way to run any shell command you'd like inside the installer,
-# automatically.
-
-# This first command is run as early as possible, just after
-# preseeding is read.
-#d-i preseed/early_command string anna-install some-udeb
-# This command is run immediately before the partitioner starts. It may be
-# useful to apply dynamic partitioner preseeding that depends on the state
-# of the disks (which may not be visible when preseed/early_command runs).
-#d-i partman/early_command \
-#       string debconf-set partman-auto/disk "$(list-devices disk | head -n1)"
-# This command is run just before the install finishes, but when there is
-# still a usable /target directory. You can chroot to /target and use it
-# directly, or use the apt-install and in-target commands to easily install
-# packages and run commands in the target system.
-d-i preseed/late_command string
diff --git a/tools/xen/functions b/tools/xen/functions
deleted file mode 100644
index bc0c515e01..0000000000
--- a/tools/xen/functions
+++ /dev/null
@@ -1,341 +0,0 @@
-#!/bin/bash
-
-function die_with_error {
-    local err_msg
-
-    err_msg="$1"
-
-    echo "$err_msg" >&2
-    exit 1
-}
-
-function xapi_plugin_location {
-    for PLUGIN_DIR in "/etc/xapi.d/plugins/" "/usr/lib/xcp/plugins/" "/usr/lib/xapi/plugins" "/usr/lib64/xapi/plugins"; do
-        if [ -d $PLUGIN_DIR ]; then
-            echo $PLUGIN_DIR
-            return 0
-        fi
-    done
-    return 1
-}
-
-function create_directory_for_kernels {
-    if [ -d "/boot/guest" ]; then
-        echo "INFO: /boot/guest directory already exists, using that" >&2
-    else
-        local local_path
-        local_path="$(get_local_sr_path)/os-guest-kernels"
-        mkdir -p $local_path
-        ln -s $local_path /boot/guest
-    fi
-}
-
-function create_directory_for_images {
-    if [ -d "/images" ]; then
-        echo "INFO: /images directory already exists, using that" >&2
-    else
-        local local_path
-        local_path="$(get_local_sr_path)/os-images"
-        mkdir -p $local_path
-        ln -s $local_path /images
-    fi
-}
-
-function get_local_sr {
-    xe pool-list params=default-SR minimal=true
-}
-
-function get_local_sr_path {
-    pbd_path="/var/run/sr-mount/$(get_local_sr)"
-    pbd_device_config_path=`xe pbd-list sr-uuid=$(get_local_sr) params=device-config | grep " path: "`
-    if [ -n "$pbd_device_config_path" ]; then
-        pbd_uuid=`xe pbd-list sr-uuid=$(get_local_sr) minimal=true`
-        pbd_path=`xe pbd-param-get uuid=$pbd_uuid param-name=device-config param-key=path || echo ""`
-    fi
-    echo $pbd_path
-}
-
-function find_ip_by_name {
-    local guest_name="$1"
-    local interface="$2"
-
-    local period=10
-    local max_tries=10
-    local i=0
-
-    while true; do
-        if [ $i -ge $max_tries ]; then
-            echo "Timeout: ip address for interface $interface of $guest_name"
-            exit 11
-        fi
-
-        ipaddress=$(xe vm-list --minimal \
-                    name-label=$guest_name \
-                    params=networks | sed -ne "s,^.*${interface}/ip: \([0-9.]*\).*\$,\1,p")
-
-        if [ -z "$ipaddress" ]; then
-            sleep $period
-            i=$((i+1))
-        else
-            echo $ipaddress
-            break
-        fi
-    done
-}
-
-function _vm_uuid {
-    local vm_name_label
-
-    vm_name_label="$1"
-
-    xe vm-list name-label="$vm_name_label" --minimal
-}
-
-function _create_new_network {
-    local name_label
-    name_label=$1
-
-    xe network-create name-label="$name_label"
-}
-
-function _multiple_networks_with_name {
-    local name_label
-    name_label=$1
-
-    # A comma indicates multiple matches
-    xe network-list name-label="$name_label" --minimal | grep -q ","
-}
-
-function _network_exists {
-    local name_label
-    name_label=$1
-
-    ! [ -z "$(xe network-list name-label="$name_label" --minimal)" ]
-}
-
-function _bridge_exists {
-    local bridge
-    bridge=$1
-
-    ! [ -z "$(xe network-list bridge="$bridge" --minimal)" ]
-}
-
-function _network_uuid {
-    local bridge_or_net_name
-    bridge_or_net_name=$1
-
-    if _bridge_exists "$bridge_or_net_name"; then
-        xe network-list bridge="$bridge_or_net_name" --minimal
-    else
-        xe network-list name-label="$bridge_or_net_name" --minimal
-    fi
-}
-
-function add_interface {
-    local vm_name_label
-    local bridge_or_network_name
-
-    vm_name_label="$1"
-    bridge_or_network_name="$2"
-    device_number="$3"
-
-    local vm
-    local net
-
-    vm=$(_vm_uuid "$vm_name_label")
-    net=$(_network_uuid "$bridge_or_network_name")
-    xe vif-create network-uuid=$net vm-uuid=$vm device=$device_number
-}
-
-function setup_network {
-    local bridge_or_net_name
-    bridge_or_net_name=$1
-
-    if ! _bridge_exists "$bridge_or_net_name"; then
-        if _network_exists "$bridge_or_net_name"; then
-            if _multiple_networks_with_name "$bridge_or_net_name"; then
-                cat >&2 << EOF
-ERROR: Multiple networks found matching name-label to "$bridge_or_net_name"
-please review your XenServer network configuration / localrc file.
-EOF
-                exit 1
-            fi
-        else
-            _create_new_network "$bridge_or_net_name"
-        fi
-    fi
-}
-
-function bridge_for {
-    local bridge_or_net_name
-    bridge_or_net_name=$1
-
-    if _bridge_exists "$bridge_or_net_name"; then
-        echo "$bridge_or_net_name"
-    else
-        xe network-list name-label="$bridge_or_net_name" params=bridge --minimal
-    fi
-}
-
-function xenapi_ip_on {
-    local bridge_or_net_name
-    bridge_or_net_name=$1
-
-    ip -4 addr show $(bridge_for "$bridge_or_net_name") |\
-    awk '/inet/{split($2, ip, "/"); print ip[1];}'
-}
-
-function xenapi_is_listening_on {
-    local bridge_or_net_name
-    bridge_or_net_name=$1
-
-    ! [ -z $(xenapi_ip_on "$bridge_or_net_name") ]
-}
-
-function parameter_is_specified {
-    local parameter_name
-    parameter_name=$1
-
-    compgen -v | grep "$parameter_name"
-}
-
-function append_kernel_cmdline {
-    local vm_name_label
-    local kernel_args
-
-    vm_name_label="$1"
-    kernel_args="$2"
-
-    local vm
-    local pv_args
-
-    vm=$(_vm_uuid "$vm_name_label")
-    pv_args=$(xe vm-param-get param-name=PV-args uuid=$vm)
-    xe vm-param-set PV-args="$pv_args $kernel_args" uuid=$vm
-}
-
-function destroy_all_vifs_of {
-    local vm_name_label
-
-    vm_name_label="$1"
-
-    local vm
-
-    vm=$(_vm_uuid "$vm_name_label")
-    IFS=,
-    for vif in $(xe vif-list vm-uuid=$vm --minimal); do
-        xe vif-destroy uuid="$vif"
-    done
-    unset IFS
-}
-
-function have_multiple_hosts {
-    xe host-list --minimal | grep -q ","
-}
-
-function attach_network {
-    local bridge_or_net_name
-
-    bridge_or_net_name="$1"
-
-    local net
-    local host
-
-    net=$(_network_uuid "$bridge_or_net_name")
-    host=$(xe host-list --minimal)
-
-    xe network-attach uuid=$net host-uuid=$host
-}
-
-function set_vm_memory {
-    local vm_name_label
-    local memory
-
-    vm_name_label="$1"
-    memory="$2"
-
-    local vm
-
-    vm=$(_vm_uuid "$vm_name_label")
-
-    xe vm-memory-limits-set \
-        static-min=${memory}MiB \
-        static-max=${memory}MiB \
-        dynamic-min=${memory}MiB \
-        dynamic-max=${memory}MiB \
-        uuid=$vm
-}
-
-function max_vcpus {
-    local vm_name_label
-
-    vm_name_label="$1"
-
-    local vm
-    local host
-    local cpu_count
-
-    host=$(xe host-list --minimal)
-    vm=$(_vm_uuid "$vm_name_label")
-
-    cpu_count=$(xe host-param-get \
-        param-name=cpu_info \
-        uuid=$host |
-        sed -e 's/^.*cpu_count: \([0-9]*\);.*$/\1/g')
-
-    if [ -z "$cpu_count" ]; then
-        # get dom0's vcpu count
-        cpu_count=$(cat /proc/cpuinfo | grep processor | wc -l)
-    fi
-
-    # Assert cpu_count is not empty
-    [ -n "$cpu_count" ]
-
-    # Assert ithas a numeric nonzero value
-    expr "$cpu_count" + 0
-
-    # 8 VCPUs should be enough for devstack VM; avoid using too
-    # many VCPUs:
-    # 1. too many VCPUs may trigger a kernel bug which result VM
-    #    not able to boot:
-    #    https://kernel.googlesource.com/pub/scm/linux/kernel/git/wsa/linux/+/e2e004acc7cbe3c531e752a270a74e95cde3ea48
-    # 2. The remaining CPUs can be used for other purpose:
-    #    e.g. boot test VMs.
-    MAX_VCPUS=8
-    if [ $cpu_count -ge $MAX_VCPUS ]; then
-        cpu_count=$MAX_VCPUS
-    fi
-
-    xe vm-param-set uuid=$vm VCPUs-max=$cpu_count
-    xe vm-param-set uuid=$vm VCPUs-at-startup=$cpu_count
-}
-
-function get_domid {
-    local vm_name_label
-
-    vm_name_label="$1"
-
-    xe vm-list name-label="$vm_name_label" params=dom-id minimal=true
-}
-
-function install_conntrack_tools {
-    local xs_host
-    local xs_ver_major
-    local centos_ver
-    local conntrack_conf
-    xs_host=$(xe host-list --minimal)
-    xs_ver_major=$(xe host-param-get uuid=$xs_host param-name=software-version param-key=product_version_text_short | cut -d'.' -f 1)
-    if [ $xs_ver_major -gt 6 ]; then
-        # Only support conntrack-tools in Dom0 with XS7.0 and above
-        if [ ! -f /usr/sbin/conntrackd ]; then
-            sed -i s/#baseurl=/baseurl=/g /etc/yum.repos.d/CentOS-Base.repo
-            centos_ver=$(yum version nogroups |grep Installed | cut -d' ' -f 2 | cut -d'/' -f 1 | cut -d'-' -f 1)
-            yum install -y --enablerepo=base --releasever=$centos_ver conntrack-tools
-            # Backup conntrackd.conf after install conntrack-tools, use the one with statistic mode
-            mv /etc/conntrackd/conntrackd.conf /etc/conntrackd/conntrackd.conf.back
-            conntrack_conf=$(find /usr/share/doc -name conntrackd.conf |grep stats)
-            cp $conntrack_conf /etc/conntrackd/conntrackd.conf
-        fi
-        service conntrackd restart
-    fi
-}
diff --git a/tools/xen/install_os_domU.sh b/tools/xen/install_os_domU.sh
deleted file mode 100755
index f4ca71a906..0000000000
--- a/tools/xen/install_os_domU.sh
+++ /dev/null
@@ -1,418 +0,0 @@
-#!/bin/bash
-
-# This script must be run on a XenServer or XCP machine
-#
-# It creates a DomU VM that runs OpenStack services
-#
-# For more details see: README.md
-
-set -o errexit
-set -o nounset
-set -o xtrace
-
-export LC_ALL=C
-
-# This directory
-THIS_DIR=$(cd $(dirname "$0") && pwd)
-
-# Include onexit commands
-. $THIS_DIR/scripts/on_exit.sh
-
-# xapi functions
-. $THIS_DIR/functions
-
-#
-# Get Settings
-#
-TOP_DIR=$(cd $THIS_DIR/../../ && pwd)
-source $TOP_DIR/inc/meta-config
-rm -f $TOP_DIR/.localrc.auto
-extract_localrc_section $TOP_DIR/local.conf $TOP_DIR/localrc $TOP_DIR/.localrc.auto
-
-# Source params - override xenrc params in your localrc to suit your taste
-source $THIS_DIR/xenrc
-
-xe_min()
-{
-    local cmd="$1"
-    shift
-    xe "$cmd" --minimal "$@"
-}
-
-#
-# Prepare Dom0
-# including installing XenAPI plugins
-#
-
-cd $THIS_DIR
-
-# Die if multiple hosts listed
-if have_multiple_hosts; then
-    cat >&2 << EOF
-ERROR: multiple hosts found. This might mean that the XenServer is a member
-of a pool - Exiting.
-EOF
-    exit 1
-fi
-
-#
-# Configure Networking
-#
-
-MGT_NETWORK=`xe pif-list management=true params=network-uuid minimal=true`
-MGT_BRIDGE_OR_NET_NAME=`xe network-list uuid=$MGT_NETWORK params=bridge minimal=true`
-
-setup_network "$VM_BRIDGE_OR_NET_NAME"
-setup_network "$MGT_BRIDGE_OR_NET_NAME"
-setup_network "$PUB_BRIDGE_OR_NET_NAME"
-
-if parameter_is_specified "FLAT_NETWORK_BRIDGE"; then
-    if [ "$(bridge_for "$VM_BRIDGE_OR_NET_NAME")" != "$(bridge_for "$FLAT_NETWORK_BRIDGE")" ]; then
-        cat >&2 << EOF
-ERROR: FLAT_NETWORK_BRIDGE is specified in localrc file, and either no network
-found on XenServer by searching for networks by that value as name-label or
-bridge name or the network found does not match the network specified by
-VM_BRIDGE_OR_NET_NAME. Please check your localrc file.
-EOF
-        exit 1
-    fi
-fi
-
-if ! xenapi_is_listening_on "$MGT_BRIDGE_OR_NET_NAME"; then
-    cat >&2 << EOF
-ERROR: XenAPI does not have an assigned IP address on the management network.
-please review your XenServer network configuration / localrc file.
-EOF
-    exit 1
-fi
-
-HOST_IP=$(xenapi_ip_on "$MGT_BRIDGE_OR_NET_NAME")
-
-# Set up ip forwarding, but skip on xcp-xapi
-if [ -a /etc/sysconfig/network ]; then
-    if ! grep -q "FORWARD_IPV4=YES" /etc/sysconfig/network; then
-        # FIXME: This doesn't work on reboot!
-        echo "FORWARD_IPV4=YES" >> /etc/sysconfig/network
-    fi
-fi
-# Also, enable ip forwarding in rc.local, since the above trick isn't working
-if ! grep -q  "echo 1 >/proc/sys/net/ipv4/ip_forward" /etc/rc.local; then
-    echo "echo 1 >/proc/sys/net/ipv4/ip_forward" >> /etc/rc.local
-fi
-# Enable ip forwarding at runtime as well
-echo 1 > /proc/sys/net/ipv4/ip_forward
-
-
-#
-# Shutdown previous runs
-#
-
-DO_SHUTDOWN=${DO_SHUTDOWN:-1}
-CLEAN_TEMPLATES=${CLEAN_TEMPLATES:-false}
-if [ "$DO_SHUTDOWN" = "1" ]; then
-    # Shutdown all domU's that created previously
-    clean_templates_arg=""
-    if $CLEAN_TEMPLATES; then
-        clean_templates_arg="--remove-templates"
-    fi
-    ./scripts/uninstall-os-vpx.sh $clean_templates_arg
-
-    # Destroy any instances that were launched
-    for uuid in `xe vm-list | grep -1 instance | grep uuid | sed "s/.*\: //g"`; do
-        echo "Shutting down nova instance $uuid"
-        xe vm-uninstall uuid=$uuid force=true
-    done
-
-    # Destroy orphaned vdis
-    for uuid in `xe vdi-list | grep -1 Glance | grep uuid | sed "s/.*\: //g"`; do
-        xe vdi-destroy uuid=$uuid
-    done
-fi
-
-
-#
-# Create Ubuntu VM template
-# and/or create VM from template
-#
-
-GUEST_NAME=${GUEST_NAME:-"DevStackOSDomU"}
-TNAME="jeos_template_for_devstack"
-SNAME_TEMPLATE="jeos_snapshot_for_devstack"
-SNAME_FIRST_BOOT="before_first_boot"
-
-function wait_for_VM_to_halt {
-    set +x
-    echo "Waiting for the VM to halt.  Progress in-VM can be checked with XenCenter or xl console:"
-    mgmt_ip=$(echo $XENAPI_CONNECTION_URL | tr -d -c '1234567890.')
-    domid=$(get_domid "$GUEST_NAME")
-    echo "ssh root@$mgmt_ip \"xl console $domid\""
-    while true; do
-        state=$(xe_min vm-list name-label="$GUEST_NAME" power-state=halted)
-        if [ -n "$state" ]; then
-            break
-        else
-            echo -n "."
-            sleep 20
-        fi
-    done
-    set -x
-}
-
-templateuuid=$(xe template-list name-label="$TNAME")
-if [ -z "$templateuuid" ]; then
-    #
-    # Install Ubuntu over network
-    #
-    UBUNTU_INST_BRIDGE_OR_NET_NAME=${UBUNTU_INST_BRIDGE_OR_NET_NAME:-"$MGT_BRIDGE_OR_NET_NAME"}
-
-    # always update the preseed file, incase we have a newer one
-    PRESEED_URL=${PRESEED_URL:-""}
-    if [ -z "$PRESEED_URL" ]; then
-        PRESEED_URL="${HOST_IP}/devstackubuntupreseed.cfg"
-
-        HTTP_SERVER_LOCATION="/opt/xensource/www"
-        if [ ! -e $HTTP_SERVER_LOCATION ]; then
-            HTTP_SERVER_LOCATION="/var/www/html"
-            mkdir -p $HTTP_SERVER_LOCATION
-        fi
-
-        # Copy the tools DEB to the XS web server
-        XS_TOOLS_URL="https://github.com/downloads/citrix-openstack/warehouse/xe-guest-utilities_5.6.100-651_amd64.deb"
-        ISO_DIR="/opt/xensource/packages/iso"
-        if [ -e "$ISO_DIR" ]; then
-            TOOLS_ISO=$(ls -1 $ISO_DIR/*-tools-*.iso | head -1)
-            TMP_DIR=/tmp/temp.$RANDOM
-            mkdir -p $TMP_DIR
-            mount -o loop $TOOLS_ISO $TMP_DIR
-            # the target deb package maybe *amd64.deb or *all.deb,
-            # so use *amd64.deb by default. If it doesn't exist,
-            # then use *all.deb.
-            DEB_FILE=$(ls $TMP_DIR/Linux/*amd64.deb || ls $TMP_DIR/Linux/*all.deb)
-            cp $DEB_FILE $HTTP_SERVER_LOCATION
-            umount $TMP_DIR
-            rmdir $TMP_DIR
-            XS_TOOLS_URL=${HOST_IP}/$(basename $DEB_FILE)
-        fi
-
-        cp -f $THIS_DIR/devstackubuntupreseed.cfg $HTTP_SERVER_LOCATION
-        cp -f $THIS_DIR/devstackubuntu_latecommand.sh $HTTP_SERVER_LOCATION/latecommand.sh
-
-        sed \
-            -e "s,\(d-i mirror/http/hostname string\).*,\1 $UBUNTU_INST_HTTP_HOSTNAME,g" \
-            -e "s,\(d-i mirror/http/directory string\).*,\1 $UBUNTU_INST_HTTP_DIRECTORY,g" \
-            -e "s,\(d-i mirror/http/proxy string\).*,\1 $UBUNTU_INST_HTTP_PROXY,g" \
-            -e "s,\(d-i passwd/root-password password\).*,\1 $GUEST_PASSWORD,g" \
-            -e "s,\(d-i passwd/root-password-again password\).*,\1 $GUEST_PASSWORD,g" \
-            -e "s,\(d-i preseed/late_command string\).*,\1 in-target mkdir -p /tmp; in-target wget --no-proxy ${HOST_IP}/latecommand.sh -O /root/latecommand.sh; in-target bash /root/latecommand.sh,g" \
-            -i "${HTTP_SERVER_LOCATION}/devstackubuntupreseed.cfg"
-
-        sed \
-            -e "s,@XS_TOOLS_URL@,$XS_TOOLS_URL,g" \
-            -i "${HTTP_SERVER_LOCATION}/latecommand.sh"
-    fi
-
-    # Update the template
-    $THIS_DIR/scripts/install_ubuntu_template.sh $PRESEED_URL
-
-    # create a new VM from the given template with eth0 attached to the given
-    # network
-    $THIS_DIR/scripts/install-os-vpx.sh \
-        -t "$UBUNTU_INST_TEMPLATE_NAME" \
-        -n "$UBUNTU_INST_BRIDGE_OR_NET_NAME" \
-        -l "$GUEST_NAME"
-
-    set_vm_memory "$GUEST_NAME" "1024"
-
-    xe vm-start vm="$GUEST_NAME"
-
-    # wait for install to finish
-    wait_for_VM_to_halt
-
-    # set VM to restart after a reboot
-    vm_uuid=$(xe_min vm-list name-label="$GUEST_NAME")
-    xe vm-param-set actions-after-reboot=Restart uuid="$vm_uuid"
-
-    # Make template from VM
-    snuuid=$(xe vm-snapshot vm="$GUEST_NAME" new-name-label="$SNAME_TEMPLATE")
-    xe snapshot-clone uuid=$snuuid new-name-label="$TNAME"
-else
-    #
-    # Template already installed, create VM from template
-    #
-    vm_uuid=$(xe vm-install template="$TNAME" new-name-label="$GUEST_NAME")
-fi
-
-if [ -n "${EXIT_AFTER_JEOS_INSTALLATION:-}" ]; then
-    echo "User requested to quit after JEOS installation"
-    exit 0
-fi
-
-#
-# Prepare VM for DevStack
-#
-xe vm-param-set other-config:os-vpx=true uuid="$vm_uuid"
-
-# Install XenServer tools, and other such things
-$THIS_DIR/prepare_guest_template.sh "$GUEST_NAME"
-
-# Set virtual machine parameters
-set_vm_memory "$GUEST_NAME" "$OSDOMU_MEM_MB"
-
-# Max out VCPU count for better performance
-max_vcpus "$GUEST_NAME"
-
-# Wipe out all network cards
-destroy_all_vifs_of "$GUEST_NAME"
-
-# Add only one interface to prepare the guest template
-add_interface "$GUEST_NAME" "$MGT_BRIDGE_OR_NET_NAME" "0"
-
-# start the VM to run the prepare steps
-xe vm-start vm="$GUEST_NAME"
-
-# Wait for prep script to finish and shutdown system
-wait_for_VM_to_halt
-
-## Setup network cards
-# Wipe out all
-destroy_all_vifs_of "$GUEST_NAME"
-# Tenant network
-add_interface "$GUEST_NAME" "$VM_BRIDGE_OR_NET_NAME" "$VM_DEV_NR"
-# Management network
-add_interface "$GUEST_NAME" "$MGT_BRIDGE_OR_NET_NAME" "$MGT_DEV_NR"
-# Public network
-add_interface "$GUEST_NAME" "$PUB_BRIDGE_OR_NET_NAME" "$PUB_DEV_NR"
-
-#
-# Inject DevStack inside VM disk
-#
-$THIS_DIR/build_xva.sh "$GUEST_NAME"
-
-FLAT_NETWORK_BRIDGE="${FLAT_NETWORK_BRIDGE:-$(bridge_for "$VM_BRIDGE_OR_NET_NAME")}"
-append_kernel_cmdline "$GUEST_NAME" "flat_network_bridge=${FLAT_NETWORK_BRIDGE}"
-
-# Add a separate xvdb, if it was requested
-if [[ "0" != "$XEN_XVDB_SIZE_GB" ]]; then
-    vm=$(xe vm-list name-label="$GUEST_NAME" --minimal)
-
-    # Add a new disk
-    localsr=$(get_local_sr)
-    extra_vdi=$(xe vdi-create \
-        name-label=xvdb-added-by-devstack \
-        virtual-size="${XEN_XVDB_SIZE_GB}GiB" \
-        sr-uuid=$localsr type=user)
-    xe vbd-create vm-uuid=$vm vdi-uuid=$extra_vdi device=1
-fi
-
-# create a snapshot before the first boot
-# to allow a quick re-run with the same settings
-xe vm-snapshot vm="$GUEST_NAME" new-name-label="$SNAME_FIRST_BOOT"
-
-#
-# Run DevStack VM
-#
-xe vm-start vm="$GUEST_NAME"
-
-function ssh_no_check {
-    ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "$@"
-}
-
-# Get hold of the Management IP of OpenStack VM
-OS_VM_MANAGEMENT_ADDRESS=$MGT_IP
-if [ $OS_VM_MANAGEMENT_ADDRESS == "dhcp" ]; then
-    OS_VM_MANAGEMENT_ADDRESS=$(find_ip_by_name $GUEST_NAME $MGT_DEV_NR)
-fi
-
-# Get hold of the Service IP of OpenStack VM
-if [ $HOST_IP_IFACE == "eth${MGT_DEV_NR}" ]; then
-    OS_VM_SERVICES_ADDRESS=$MGT_IP
-    if [ $MGT_IP == "dhcp" ]; then
-        OS_VM_SERVICES_ADDRESS=$(find_ip_by_name $GUEST_NAME $MGT_DEV_NR)
-    fi
-else
-    OS_VM_SERVICES_ADDRESS=$PUB_IP
-    if [ $PUB_IP == "dhcp" ]; then
-        OS_VM_SERVICES_ADDRESS=$(find_ip_by_name $GUEST_NAME $PUB_DEV_NR)
-    fi
-fi
-
-# Create an ssh-keypair, and set it up for dom0 user
-rm -f /root/dom0key /root/dom0key.pub
-ssh-keygen -f /root/dom0key -P "" -C "dom0"
-DOMID=$(get_domid "$GUEST_NAME")
-
-xenstore-write /local/domain/$DOMID/authorized_keys/$DOMZERO_USER "$(cat /root/dom0key.pub)"
-xenstore-chmod -u /local/domain/$DOMID/authorized_keys/$DOMZERO_USER r$DOMID
-
-function run_on_appliance {
-    ssh \
-        -i /root/dom0key \
-        -o UserKnownHostsFile=/dev/null \
-        -o StrictHostKeyChecking=no \
-        -o BatchMode=yes \
-        "$DOMZERO_USER@$OS_VM_MANAGEMENT_ADDRESS" "$@"
-}
-
-# Wait until we can log in to the appliance
-while ! run_on_appliance true; do
-    sleep 1
-done
-
-# Remove authenticated_keys updater cronjob
-echo "" | run_on_appliance crontab -
-
-# Generate a passwordless ssh key for domzero user
-echo "ssh-keygen -f /home/$DOMZERO_USER/.ssh/id_rsa -C $DOMZERO_USER@appliance -N \"\" -q" | run_on_appliance
-
-# Authenticate that user to dom0
-run_on_appliance cat /home/$DOMZERO_USER/.ssh/id_rsa.pub >> /root/.ssh/authorized_keys
-
-# If we have copied our ssh credentials, use ssh to monitor while the installation runs
-WAIT_TILL_LAUNCH=${WAIT_TILL_LAUNCH:-1}
-COPYENV=${COPYENV:-1}
-if [ "$WAIT_TILL_LAUNCH" = "1" ]  && [ -e ~/.ssh/id_rsa.pub  ] && [ "$COPYENV" = "1" ]; then
-    set +x
-
-    echo "VM Launched - Waiting for run.sh"
-    while ! ssh_no_check -q stack@$OS_VM_MANAGEMENT_ADDRESS "test -e /opt/stack/run_sh.pid"; do
-        sleep 10
-    done
-    echo -n "devstack service is running, waiting for stack.sh to start logging..."
-
-    pid=`ssh_no_check -q stack@$OS_VM_MANAGEMENT_ADDRESS "cat /opt/stack/run_sh.pid"`
-    if [ -n "$SCREEN_LOGDIR" ]; then
-        while ! ssh_no_check -q stack@$OS_VM_MANAGEMENT_ADDRESS "test -e ${SCREEN_LOGDIR}/stack.log"; do
-            sleep 10
-        done
-
-        ssh_no_check -q stack@$OS_VM_MANAGEMENT_ADDRESS "tail --pid $pid -n +1 -f ${SCREEN_LOGDIR}/stack.log"
-    else
-        echo -n "SCREEN_LOGDIR not set; just waiting for process $pid to finish"
-        ssh_no_check -q stack@$OS_VM_MANAGEMENT_ADDRESS "wait $pid"
-    fi
-
-    set -x
-    # Fail if devstack did not succeed
-    ssh_no_check -q stack@$OS_VM_MANAGEMENT_ADDRESS 'test -e /opt/stack/runsh.succeeded'
-
-    set +x
-    echo "################################################################################"
-    echo ""
-    echo "All Finished!"
-    echo "You can visit the OpenStack Dashboard"
-    echo "at http://$OS_VM_SERVICES_ADDRESS, and contact other services at the usual ports."
-else
-    set +x
-    echo "################################################################################"
-    echo ""
-    echo "All Finished!"
-    echo "Now, you can monitor the progress of the stack.sh installation by "
-    echo "looking at the console of your domU / checking the log files."
-    echo ""
-    echo "ssh into your domU now: 'ssh stack@$OS_VM_MANAGEMENT_ADDRESS' using your password"
-    echo "and then do: 'sudo systemctl status devstack' to check if devstack is still running."
-    echo "Check that /opt/stack/runsh.succeeded exists"
-    echo ""
-    echo "When devstack completes, you can visit the OpenStack Dashboard"
-    echo "at http://$OS_VM_SERVICES_ADDRESS, and contact other services at the usual ports."
-fi
diff --git a/tools/xen/mocks b/tools/xen/mocks
deleted file mode 100644
index 3b9b05c747..0000000000
--- a/tools/xen/mocks
+++ /dev/null
@@ -1,92 +0,0 @@
-#!/bin/bash
-
-test ! -e "$LIST_OF_ACTIONS" && {
-    echo "Mocking is not set up properly."
-    echo "LIST_OF_ACTIONS should point to an existing file."
-    exit 1
-}
-
-test ! -e "$LIST_OF_DIRECTORIES" && {
-    echo "Mocking is not set up properly."
-    echo "LIST_OF_DIRECTORIES should point to an existing file."
-    exit 1
-}
-
-test ! -e "$XE_RESPONSE" && {
-    echo "Mocking is not set up properly."
-    echo "XE_RESPONSE should point to an existing file."
-    exit 1
-}
-
-test ! -e "$XE_CALLS" && {
-    echo "Mocking is not set up properly."
-    echo "XE_CALLS should point to an existing file."
-    exit 1
-}
-
-function mktemp {
-    if test "${1:-}" = "-d";
-    then
-        echo "tempdir"
-    else
-        echo "tempfile"
-    fi
-}
-
-function wget {
-    if [[ $@ =~ "failurl" ]]; then
-        return 1
-    fi
-    echo "wget $@" >> $LIST_OF_ACTIONS
-}
-
-function mkdir {
-    if test "${1:-}" = "-p";
-    then
-        echo "$2" >> $LIST_OF_DIRECTORIES
-    fi
-}
-
-function unzip {
-    echo "Random rubbish from unzip"
-    echo "unzip $@" >> $LIST_OF_ACTIONS
-}
-
-function rm {
-    echo "rm $@" >> $LIST_OF_ACTIONS
-}
-
-function ln {
-    echo "ln $@" >> $LIST_OF_ACTIONS
-}
-
-function [ {
-    if test "${1:-}" = "-d";
-    then
-        echo "[ $@" >> $LIST_OF_ACTIONS
-        for directory in $(cat $LIST_OF_DIRECTORIES)
-        do
-            if test "$directory" = "$2"
-            then
-                return 0
-            fi
-        done
-        return 1
-    fi
-    echo "Mock test does not implement the requested function: ${1:-}"
-    exit 1
-}
-
-function die_with_error {
-    echo "$1" >> $DEAD_MESSAGES
-}
-
-function xe {
-    cat $XE_RESPONSE
-    {
-    for i in $(seq "$#")
-    do
-        eval "echo \"\$$i\""
-    done
-    } >> $XE_CALLS
-}
diff --git a/tools/xen/prepare_guest.sh b/tools/xen/prepare_guest.sh
deleted file mode 100755
index 6de1afc199..0000000000
--- a/tools/xen/prepare_guest.sh
+++ /dev/null
@@ -1,123 +0,0 @@
-#!/bin/bash
-
-# This script is run on an Ubuntu VM.
-# This script is inserted into the VM by prepare_guest_template.sh
-# and is run when that VM boots.
-# It customizes a fresh Ubuntu install, so it is ready
-# to run stack.sh
-#
-# This includes installing the XenServer tools,
-# creating the user called "stack",
-# and shuts down the VM to signal the script has completed
-
-set -o errexit
-set -o nounset
-set -o xtrace
-
-# Configurable nuggets
-GUEST_PASSWORD="$1"
-STACK_USER="$2"
-DOMZERO_USER="$3"
-
-
-function setup_domzero_user {
-    local username
-
-    username="$1"
-
-    local key_updater_script
-    local sudoers_file
-    key_updater_script="/home/$username/update_authorized_keys.sh"
-    sudoers_file="/etc/sudoers.d/allow_$username"
-
-    # Create user
-    adduser --disabled-password --quiet "$username" --gecos "$username"
-
-    # Give passwordless sudo
-    cat > $sudoers_file << EOF
-    $username ALL = NOPASSWD: ALL
-EOF
-    chmod 0440 $sudoers_file
-
-    # A script to populate this user's authenticated_keys from xenstore
-    cat > $key_updater_script << EOF
-#!/bin/bash
-set -eux
-
-DOMID=\$(sudo xenstore-read domid)
-sudo xenstore-exists /local/domain/\$DOMID/authorized_keys/$username
-sudo xenstore-read /local/domain/\$DOMID/authorized_keys/$username > /home/$username/xenstore_value
-cat /home/$username/xenstore_value > /home/$username/.ssh/authorized_keys
-EOF
-
-    # Give the key updater to the user
-    chown $username:$username $key_updater_script
-    chmod 0700 $key_updater_script
-
-    # Setup the .ssh folder
-    mkdir -p /home/$username/.ssh
-    chown $username:$username /home/$username/.ssh
-    chmod 0700 /home/$username/.ssh
-    touch /home/$username/.ssh/authorized_keys
-    chown $username:$username /home/$username/.ssh/authorized_keys
-    chmod 0600 /home/$username/.ssh/authorized_keys
-
-    # Setup the key updater as a cron job
-    crontab -u $username - << EOF
-* * * * * $key_updater_script
-EOF
-
-}
-
-# Make a small cracklib dictionary, so that passwd still works, but we don't
-# have the big dictionary.
-mkdir -p /usr/share/cracklib
-echo a | cracklib-packer
-
-# Make /etc/shadow, and set the root password
-pwconv
-echo "root:$GUEST_PASSWORD" | chpasswd
-
-# Put the VPX into UTC.
-rm -f /etc/localtime
-
-# Add stack user
-groupadd libvirtd
-useradd $STACK_USER -s /bin/bash -d /opt/stack -G libvirtd
-echo $STACK_USER:$GUEST_PASSWORD | chpasswd
-echo "$STACK_USER ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers
-
-setup_domzero_user "$DOMZERO_USER"
-
-# Add an udev rule, so that new block devices could be written by stack user
-cat > /etc/udev/rules.d/50-openstack-blockdev.rules << EOF
-KERNEL=="xvd[b-z]", GROUP="$STACK_USER", MODE="0660"
-EOF
-
-# Give ownership of /opt/stack to stack user
-chown -R $STACK_USER /opt/stack
-
-function setup_vimrc {
-    if [ ! -e $1 ]; then
-        # Simple but usable vimrc
-        cat > $1 <<EOF
-se ts=4
-se expandtab
-se shiftwidth=4
-EOF
-    fi
-}
-
-# Setup simple .vimrcs
-setup_vimrc /root/.vimrc
-setup_vimrc /opt/stack/.vimrc
-
-# remove self from local.rc
-# so this script is not run again
-rm -rf /etc/rc.local
-
-# Restore rc.local file
-cp /etc/rc.local.preparebackup /etc/rc.local
-
-# shutdown to notify we are done
-shutdown -h now
diff --git a/tools/xen/prepare_guest_template.sh b/tools/xen/prepare_guest_template.sh
deleted file mode 100755
index 6cddddaa84..0000000000
--- a/tools/xen/prepare_guest_template.sh
+++ /dev/null
@@ -1,94 +0,0 @@
-#!/bin/bash
-
-# This script is run by install_os_domU.sh
-#
-# Parameters:
-# - $GUEST_NAME - hostname for the DomU VM
-#
-# It modifies the ubuntu image created by install_os_domU.sh
-#
-# This script is responsible for cusomtizing the fresh ubuntu
-# image so on boot it runs the prepare_guest.sh script
-# that modifies the VM so it is ready to run stack.sh.
-# It does this by mounting the disk image of the VM.
-#
-# The resultant image is started by install_os_domU.sh,
-# and once the VM has shutdown, build_xva.sh is run
-
-set -o errexit
-set -o nounset
-set -o xtrace
-
-# This directory
-TOP_DIR=$(cd $(dirname "$0") && pwd)
-
-# Include onexit commands
-. $TOP_DIR/scripts/on_exit.sh
-
-# xapi functions
-. $TOP_DIR/functions
-
-# Source params - override xenrc params in your localrc to suite your taste
-source xenrc
-
-#
-# Parameters
-#
-GUEST_NAME="$1"
-
-# Mount the VDI
-STAGING_DIR=$($TOP_DIR/scripts/manage-vdi open $GUEST_NAME 0 1 | grep -o "/tmp/tmp.[[:alnum:]]*")
-add_on_exit "$TOP_DIR/scripts/manage-vdi close $GUEST_NAME 0 1"
-
-# Make sure we have a stage
-if [ ! -d $STAGING_DIR/etc ]; then
-    echo "Stage is not properly set up!"
-    exit 1
-fi
-
-# Copy prepare_guest.sh to VM
-mkdir -p $STAGING_DIR/opt/stack/
-cp $TOP_DIR/prepare_guest.sh $STAGING_DIR/opt/stack/prepare_guest.sh
-
-# backup rc.local
-cp $STAGING_DIR/etc/rc.local $STAGING_DIR/etc/rc.local.preparebackup
-
-# run prepare_guest.sh on boot
-cat <<EOF >$STAGING_DIR/etc/rc.local
-#!/bin/sh -e
-bash /opt/stack/prepare_guest.sh \\
-    "$GUEST_PASSWORD" "$STACK_USER" "$DOMZERO_USER" \\
-    > /opt/stack/prepare_guest.log 2>&1
-EOF
-
-# Update ubuntu repositories
-cat > $STAGING_DIR/etc/apt/sources.list << EOF
-deb http://${UBUNTU_INST_HTTP_HOSTNAME}${UBUNTU_INST_HTTP_DIRECTORY} ${UBUNTU_INST_RELEASE} main restricted
-deb-src http://${UBUNTU_INST_HTTP_HOSTNAME}${UBUNTU_INST_HTTP_DIRECTORY} ${UBUNTU_INST_RELEASE} main restricted
-deb http://${UBUNTU_INST_HTTP_HOSTNAME}${UBUNTU_INST_HTTP_DIRECTORY} ${UBUNTU_INST_RELEASE}-updates main restricted
-deb-src http://${UBUNTU_INST_HTTP_HOSTNAME}${UBUNTU_INST_HTTP_DIRECTORY} ${UBUNTU_INST_RELEASE}-updates main restricted
-deb http://${UBUNTU_INST_HTTP_HOSTNAME}${UBUNTU_INST_HTTP_DIRECTORY} ${UBUNTU_INST_RELEASE} universe
-deb-src http://${UBUNTU_INST_HTTP_HOSTNAME}${UBUNTU_INST_HTTP_DIRECTORY} ${UBUNTU_INST_RELEASE} universe
-deb http://${UBUNTU_INST_HTTP_HOSTNAME}${UBUNTU_INST_HTTP_DIRECTORY} ${UBUNTU_INST_RELEASE}-updates universe
-deb-src http://${UBUNTU_INST_HTTP_HOSTNAME}${UBUNTU_INST_HTTP_DIRECTORY} ${UBUNTU_INST_RELEASE}-updates universe
-deb http://${UBUNTU_INST_HTTP_HOSTNAME}${UBUNTU_INST_HTTP_DIRECTORY} ${UBUNTU_INST_RELEASE} multiverse
-deb-src http://${UBUNTU_INST_HTTP_HOSTNAME}${UBUNTU_INST_HTTP_DIRECTORY} ${UBUNTU_INST_RELEASE} multiverse
-deb http://${UBUNTU_INST_HTTP_HOSTNAME}${UBUNTU_INST_HTTP_DIRECTORY} ${UBUNTU_INST_RELEASE}-updates multiverse
-deb-src http://${UBUNTU_INST_HTTP_HOSTNAME}${UBUNTU_INST_HTTP_DIRECTORY} ${UBUNTU_INST_RELEASE}-updates multiverse
-deb http://${UBUNTU_INST_HTTP_HOSTNAME}${UBUNTU_INST_HTTP_DIRECTORY} ${UBUNTU_INST_RELEASE}-backports main restricted universe multiverse
-deb-src http://${UBUNTU_INST_HTTP_HOSTNAME}${UBUNTU_INST_HTTP_DIRECTORY} ${UBUNTU_INST_RELEASE}-backports main restricted universe multiverse
-
-deb http://security.ubuntu.com/ubuntu ${UBUNTU_INST_RELEASE}-security main restricted
-deb-src http://security.ubuntu.com/ubuntu ${UBUNTU_INST_RELEASE}-security main restricted
-deb http://security.ubuntu.com/ubuntu ${UBUNTU_INST_RELEASE}-security universe
-deb-src http://security.ubuntu.com/ubuntu ${UBUNTU_INST_RELEASE}-security universe
-deb http://security.ubuntu.com/ubuntu ${UBUNTU_INST_RELEASE}-security multiverse
-deb-src http://security.ubuntu.com/ubuntu ${UBUNTU_INST_RELEASE}-security multiverse
-EOF
-
-rm -f $STAGING_DIR/etc/apt/apt.conf
-if [ -n "$UBUNTU_INST_HTTP_PROXY" ]; then
-    cat > $STAGING_DIR/etc/apt/apt.conf << EOF
-Acquire::http::Proxy "$UBUNTU_INST_HTTP_PROXY";
-EOF
-fi
diff --git a/tools/xen/scripts/install-os-vpx.sh b/tools/xen/scripts/install-os-vpx.sh
deleted file mode 100755
index 66f7ef4763..0000000000
--- a/tools/xen/scripts/install-os-vpx.sh
+++ /dev/null
@@ -1,135 +0,0 @@
-#!/bin/bash
-#
-# Copyright (c) 2011 Citrix Systems, Inc.
-# Copyright 2011 OpenStack Foundation
-# All Rights Reserved.
-#
-#    Licensed under the Apache License, Version 2.0 (the "License"); you may
-#    not use this file except in compliance with the License. You may obtain
-#    a copy of the License at
-#
-#         http://www.apache.org/licenses/LICENSE-2.0
-#
-#    Unless required by applicable law or agreed to in writing, software
-#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-#    License for the specific language governing permissions and limitations
-#    under the License.
-#
-
-set -eux
-
-BRIDGE=
-NAME_LABEL=
-TEMPLATE_NAME=
-
-usage()
-{
-cat << EOF
-
-  Usage: $0 -t TEMPLATE_NW_INSTALL -l NAME_LABEL [-n BRIDGE]
-
-  Install a VM from a template
-
-  OPTIONS:
-
-     -h           Shows this message.
-     -t template  VM template to use
-     -l name      Specifies the name label for the VM.
-     -n bridge    The bridge/network to use for eth0. Defaults to xenbr0
-EOF
-}
-
-get_params()
-{
-    while getopts "hbn:r:l:t:" OPTION; do
-        case $OPTION in
-            h) usage
-                exit 1
-                ;;
-            n)
-                BRIDGE=$OPTARG
-                ;;
-            l)
-                NAME_LABEL=$OPTARG
-                ;;
-            t)
-                TEMPLATE_NAME=$OPTARG
-                ;;
-            ?)
-                usage
-                exit
-                ;;
-        esac
-    done
-    if [[ -z $BRIDGE ]]; then
-        BRIDGE=xenbr0
-    fi
-
-    if [[ -z $TEMPLATE_NAME ]]; then
-        echo "Please specify a template name" >&2
-        exit 1
-    fi
-
-    if [[ -z $NAME_LABEL ]]; then
-        echo "Please specify a name-label for the new VM" >&2
-        exit 1
-    fi
-}
-
-
-xe_min()
-{
-    local cmd="$1"
-    shift
-    xe "$cmd" --minimal "$@"
-}
-
-
-find_network()
-{
-    result=$(xe_min network-list bridge="$1")
-    if [ "$result" = "" ]; then
-        result=$(xe_min network-list name-label="$1")
-    fi
-    echo "$result"
-}
-
-
-create_vif()
-{
-    local v="$1"
-    echo "Installing VM interface on [$BRIDGE]"
-    local out_network_uuid
-    out_network_uuid=$(find_network "$BRIDGE")
-    xe vif-create vm-uuid="$v" network-uuid="$out_network_uuid" device="0"
-}
-
-
-
-# Make the VM auto-start on server boot.
-set_auto_start()
-{
-    local v="$1"
-    xe vm-param-set uuid="$v" other-config:auto_poweron=true
-}
-
-
-destroy_vifs()
-{
-    local v="$1"
-    IFS=,
-    for vif in $(xe_min vif-list vm-uuid="$v"); do
-        xe vif-destroy uuid="$vif"
-    done
-    unset IFS
-}
-
-
-get_params "$@"
-
-vm_uuid=$(xe_min vm-install template="$TEMPLATE_NAME" new-name-label="$NAME_LABEL")
-destroy_vifs "$vm_uuid"
-set_auto_start "$vm_uuid"
-create_vif "$vm_uuid"
-xe vm-param-set actions-after-reboot=Destroy uuid="$vm_uuid"
diff --git a/tools/xen/scripts/install_ubuntu_template.sh b/tools/xen/scripts/install_ubuntu_template.sh
deleted file mode 100755
index 6ea364255e..0000000000
--- a/tools/xen/scripts/install_ubuntu_template.sh
+++ /dev/null
@@ -1,84 +0,0 @@
-#!/bin/bash
-#
-# This creates an Ubuntu Server 32bit or 64bit template
-# on Xenserver 5.6.x, 6.0.x and 6.1.x
-# The template does a net install only
-#
-# Based on a script by: David Markey <david.markey@citrix.com>
-#
-
-set -o errexit
-set -o nounset
-set -o xtrace
-
-# This directory
-BASE_DIR=$(cd $(dirname "$0") && pwd)
-
-# For default setings see xenrc
-source $BASE_DIR/../xenrc
-
-# Get the params
-preseed_url=$1
-
-# Delete template or skip template creation as required
-previous_template=$(xe template-list name-label="$UBUNTU_INST_TEMPLATE_NAME" \
-    params=uuid --minimal)
-if [ -n "$previous_template" ]; then
-    if $CLEAN_TEMPLATES; then
-        xe template-param-clear param-name=other-config uuid=$previous_template
-        xe template-uninstall template-uuid=$previous_template force=true
-    else
-        echo "Template $UBUNTU_INST_TEMPLATE_NAME already present"
-        exit 0
-    fi
-fi
-
-# Get built-in template
-builtin_name="Debian Squeeze 6.0 (32-bit)"
-builtin_uuid=$(xe template-list name-label="$builtin_name" --minimal)
-if [[ -z $builtin_uuid ]]; then
-    echo "Can't find the Debian Squeeze 32bit template on your XenServer."
-    exit 1
-fi
-
-# Clone built-in template to create new template
-new_uuid=$(xe vm-clone uuid=$builtin_uuid \
-    new-name-label="$UBUNTU_INST_TEMPLATE_NAME")
-disk_size=$(($OSDOMU_VDI_GB * 1024 * 1024 * 1024))
-
-# Some of these settings can be found in example preseed files
-# however these need to be answered before the netinstall
-# is ready to fetch the preseed file, and as such must be here
-# to get a fully automated install
-pvargs="quiet console=hvc0 partman/default_filesystem=ext3 \
-console-setup/ask_detect=false locale=${UBUNTU_INST_LOCALE} \
-keyboard-configuration/layoutcode=${UBUNTU_INST_KEYBOARD} \
-netcfg/choose_interface=eth0 \
-netcfg/get_hostname=os netcfg/get_domain=os auto \
-url=${preseed_url}"
-
-if [ "$UBUNTU_INST_IP" != "dhcp" ]; then
-    netcfgargs="netcfg/disable_autoconfig=true \
-netcfg/get_nameservers=${UBUNTU_INST_NAMESERVERS} \
-netcfg/get_ipaddress=${UBUNTU_INST_IP} \
-netcfg/get_netmask=${UBUNTU_INST_NETMASK} \
-netcfg/get_gateway=${UBUNTU_INST_GATEWAY} \
-netcfg/confirm_static=true"
-    pvargs="${pvargs} ${netcfgargs}"
-fi
-
-xe template-param-set uuid=$new_uuid \
-    other-config:install-methods=http \
-    other-config:install-repository="http://${UBUNTU_INST_HTTP_HOSTNAME}${UBUNTU_INST_HTTP_DIRECTORY}" \
-    PV-args="$pvargs" \
-    other-config:debian-release="$UBUNTU_INST_RELEASE" \
-    other-config:default_template=true \
-    other-config:disks='<provision><disk device="0" size="'$disk_size'" sr="" bootable="true" type="system"/></provision>' \
-    other-config:install-arch="$UBUNTU_INST_ARCH"
-
-if ! [ -z "$UBUNTU_INST_HTTP_PROXY" ]; then
-    xe template-param-set uuid=$new_uuid \
-        other-config:install-proxy="$UBUNTU_INST_HTTP_PROXY"
-fi
-
-echo "Ubuntu template installed uuid:$new_uuid"
diff --git a/tools/xen/scripts/manage-vdi b/tools/xen/scripts/manage-vdi
deleted file mode 100755
index 909ce328b0..0000000000
--- a/tools/xen/scripts/manage-vdi
+++ /dev/null
@@ -1,96 +0,0 @@
-#!/bin/bash
-
-set -eux
-
-action="$1"
-vm="$2"
-device="${3-0}"
-part="${4-}"
-
-function xe_min() {
-  local cmd="$1"
-  shift
-  xe "$cmd" --minimal "$@"
-}
-
-function run_udev_settle() {
-  which_udev=$(which udevsettle) || true
-  if [ -n "$which_udev" ]; then
-      udevsettle
-  else
-      udevadm settle
-  fi
-}
-
-vm_uuid=$(xe_min vm-list name-label="$vm")
-vdi_uuid=$(xe_min vbd-list params=vdi-uuid vm-uuid="$vm_uuid" \
-                           userdevice="$device")
-
-dom0_uuid=$(xe_min vm-list is-control-domain=true)
-
-function get_mount_device() {
-  vbd_uuid=$1
-
-  dev=$(xe_min vbd-list params=device uuid="$vbd_uuid")
-  if [[ "$dev" =~ "sm/" || "$dev" =~ "blktap-2/" ]]; then
-    DEBIAN_FRONTEND=noninteractive \
-        apt-get --option "Dpkg::Options::=--force-confold" --assume-yes \
-        install kpartx &> /dev/null || true
-    mapping=$(kpartx -av "/dev/$dev" | sed -ne 's,^add map \([a-z0-9\-]*\).*$,\1,p' | sed -ne "s,^\(.*${part}\)\$,\1,p")
-    if [ -z "$mapping" ]; then
-       echo "Failed to find mapping"
-       exit -1
-    fi
-
-    local device="/dev/mapper/${mapping}"
-    for (( i = 0; i < 5; i++ )) ; do
-        if [ -b $device ] ; then
-            echo $device
-            return
-        fi
-        sleep 1
-    done
-    echo "ERROR: timed out waiting for dev-mapper"
-    exit 1
-  else
-    echo "/dev/$dev$part"
-  fi
-}
-
-function clean_dev_mappings() {
-  dev=$(xe_min vbd-list params=device uuid="$vbd_uuid")
-  if [[ "$dev" =~ "sm/" || "$dev" =~ "blktap-2/" ]]; then
-    kpartx -dv "/dev/$dev"
-  fi
-}
-
-function open_vdi() {
-  vbd_uuid=$(xe vbd-create vm-uuid="$dom0_uuid" vdi-uuid="$vdi_uuid" \
-                         device=autodetect)
-  mp=$(mktemp -d)
-  xe vbd-plug uuid="$vbd_uuid"
-
-  run_udev_settle
-
-  mount_device=$(get_mount_device "$vbd_uuid")
-  mount "$mount_device" "$mp"
-  echo "Your vdi is mounted at $mp"
-}
-
-function close_vdi() {
-  vbd_uuid=$(xe_min vbd-list vm-uuid="$dom0_uuid" vdi-uuid="$vdi_uuid")
-  mount_device=$(get_mount_device "$vbd_uuid")
-  run_udev_settle
-  umount "$mount_device"
-
-  clean_dev_mappings
-
-  xe vbd-unplug uuid=$vbd_uuid
-  xe vbd-destroy uuid=$vbd_uuid
-}
-
-if [ "$action" == "open" ]; then
-  open_vdi
-elif [ "$action" == "close" ]; then
-  close_vdi
-fi
diff --git a/tools/xen/scripts/on_exit.sh b/tools/xen/scripts/on_exit.sh
deleted file mode 100755
index 2846dc42d0..0000000000
--- a/tools/xen/scripts/on_exit.sh
+++ /dev/null
@@ -1,24 +0,0 @@
-#!/bin/bash
-
-set -e
-set -o xtrace
-
-if [ -z "${on_exit_hooks:-}" ]; then
-    on_exit_hooks=()
-fi
-
-on_exit()
-{
-    for i in $(seq $((${#on_exit_hooks[*]} - 1)) -1 0); do
-        eval "${on_exit_hooks[$i]}"
-    done
-}
-
-add_on_exit()
-{
-    local n=${#on_exit_hooks[*]}
-    on_exit_hooks[$n]="$*"
-    if [[ $n -eq 0 ]]; then
-        trap on_exit EXIT
-    fi
-}
diff --git a/tools/xen/scripts/uninstall-os-vpx.sh b/tools/xen/scripts/uninstall-os-vpx.sh
deleted file mode 100755
index 96dad7e852..0000000000
--- a/tools/xen/scripts/uninstall-os-vpx.sh
+++ /dev/null
@@ -1,88 +0,0 @@
-#!/bin/bash
-#
-# Copyright (c) 2011 Citrix Systems, Inc.
-# Copyright 2011 OpenStack Foundation
-# All Rights Reserved.
-#
-#    Licensed under the Apache License, Version 2.0 (the "License"); you may
-#    not use this file except in compliance with the License. You may obtain
-#    a copy of the License at
-#
-#         http://www.apache.org/licenses/LICENSE-2.0
-#
-#    Unless required by applicable law or agreed to in writing, software
-#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-#    License for the specific language governing permissions and limitations
-#    under the License.
-#
-
-set -ex
-
-# By default, don't remove the templates
-REMOVE_TEMPLATES=${REMOVE_TEMPLATES:-"false"}
-if [ "$1" = "--remove-templates" ]; then
-    REMOVE_TEMPLATES=true
-fi
-
-xe_min()
-{
-    local cmd="$1"
-    shift
-    xe "$cmd" --minimal "$@"
-}
-
-destroy_vdi()
-{
-    local vbd_uuid="$1"
-    local type
-    type=$(xe_min vbd-list uuid=$vbd_uuid params=type)
-    local dev
-    dev=$(xe_min vbd-list uuid=$vbd_uuid params=userdevice)
-    local vdi_uuid
-    vdi_uuid=$(xe_min vbd-list uuid=$vbd_uuid params=vdi-uuid)
-
-    if [ "$type" == 'Disk' ] && [ "$dev" != 'xvda' ] && [ "$dev" != '0' ]; then
-        xe vdi-destroy uuid=$vdi_uuid
-    fi
-}
-
-uninstall()
-{
-    local vm_uuid="$1"
-    local power_state
-    power_state=$(xe_min vm-list uuid=$vm_uuid params=power-state)
-
-    if [ "$power_state" != "halted" ]; then
-        xe vm-shutdown vm=$vm_uuid force=true
-    fi
-
-    for v in $(xe_min vbd-list vm-uuid=$vm_uuid | sed -e 's/,/ /g'); do
-        destroy_vdi "$v"
-    done
-
-    xe vm-uninstall vm=$vm_uuid force=true >/dev/null
-}
-
-uninstall_template()
-{
-    local vm_uuid="$1"
-
-    for v in $(xe_min vbd-list vm-uuid=$vm_uuid | sed -e 's/,/ /g'); do
-        destroy_vdi "$v"
-    done
-
-    xe template-uninstall template-uuid=$vm_uuid force=true >/dev/null
-}
-
-# remove the VMs and their disks
-for u in $(xe_min vm-list other-config:os-vpx=true | sed -e 's/,/ /g'); do
-    uninstall "$u"
-done
-
-# remove the templates
-if [ "$REMOVE_TEMPLATES" == "true" ]; then
-    for u in $(xe_min template-list other-config:os-vpx=true | sed -e 's/,/ /g'); do
-        uninstall_template "$u"
-    done
-fi
diff --git a/tools/xen/test_functions.sh b/tools/xen/test_functions.sh
deleted file mode 100755
index 324e6a1a1e..0000000000
--- a/tools/xen/test_functions.sh
+++ /dev/null
@@ -1,205 +0,0 @@
-#!/bin/bash
-
-# Tests for functions.
-#
-# The tests are sourcing the mocks file to mock out various functions. The
-# mocking-out always happens in a sub-shell, thus it does not have impact on
-# the functions defined here.
-
-# To run the tests, please run:
-#
-# ./test_functions.sh run_tests
-#
-# To only print out the discovered test functions, run:
-#
-# ./test_functions.sh
-
-. functions
-
-# Setup
-function before_each_test {
-    LIST_OF_DIRECTORIES=$(mktemp)
-    truncate -s 0 $LIST_OF_DIRECTORIES
-
-    LIST_OF_ACTIONS=$(mktemp)
-    truncate -s 0 $LIST_OF_ACTIONS
-
-    XE_RESPONSE=$(mktemp)
-    truncate -s 0 $XE_RESPONSE
-
-    XE_CALLS=$(mktemp)
-    truncate -s 0 $XE_CALLS
-
-    DEAD_MESSAGES=$(mktemp)
-    truncate -s 0 $DEAD_MESSAGES
-}
-
-# Teardown
-function after_each_test {
-    rm -f $LIST_OF_DIRECTORIES
-    rm -f $LIST_OF_ACTIONS
-    rm -f $XE_RESPONSE
-    rm -f $XE_CALLS
-}
-
-# Helpers
-function setup_xe_response {
-    echo "$1" > $XE_RESPONSE
-}
-
-function given_directory_exists {
-    echo "$1" >> $LIST_OF_DIRECTORIES
-}
-
-function assert_directory_exists {
-    grep "$1" $LIST_OF_DIRECTORIES
-}
-
-function assert_previous_command_failed {
-    [ "$?" != "0" ] || exit 1
-}
-
-function assert_xe_min {
-    grep -qe "^--minimal\$" $XE_CALLS
-}
-
-function assert_xe_param {
-    grep -qe "^$1\$" $XE_CALLS
-}
-
-function assert_died_with {
-    diff -u <(echo "$1") $DEAD_MESSAGES
-}
-
-function mock_out {
-    local FNNAME="$1"
-    local OUTPUT="$2"
-
-    . <(cat << EOF
-function $FNNAME {
-    echo "$OUTPUT"
-}
-EOF
-)
-}
-
-function assert_symlink {
-    grep -qe "^ln -s $2 $1\$" $LIST_OF_ACTIONS
-}
-
-# Tests
-function test_plugin_directory_on_xenserver {
-    given_directory_exists "/etc/xapi.d/plugins/"
-
-    PLUGDIR=$(. mocks && xapi_plugin_location)
-
-    [ "/etc/xapi.d/plugins/" = "$PLUGDIR" ]
-}
-
-function test_plugin_directory_on_xcp {
-    given_directory_exists "/usr/lib/xcp/plugins/"
-
-    PLUGDIR=$(. mocks && xapi_plugin_location)
-
-    [ "/usr/lib/xcp/plugins/" = "$PLUGDIR" ]
-}
-
-function test_no_plugin_directory_found {
-    set +e
-
-    local IGNORE
-    IGNORE=$(. mocks && xapi_plugin_location)
-
-    assert_previous_command_failed
-
-    grep "[ -d /etc/xapi.d/plugins/ ]" $LIST_OF_ACTIONS
-    grep "[ -d /usr/lib/xcp/plugins/ ]" $LIST_OF_ACTIONS
-}
-
-function test_create_directory_for_kernels {
-    (
-        . mocks
-        mock_out get_local_sr_path /var/run/sr-mount/uuid1
-        create_directory_for_kernels
-    )
-
-    assert_directory_exists "/var/run/sr-mount/uuid1/os-guest-kernels"
-    assert_symlink "/boot/guest" "/var/run/sr-mount/uuid1/os-guest-kernels"
-}
-
-function test_create_directory_for_kernels_existing_dir {
-    (
-        . mocks
-        given_directory_exists "/boot/guest"
-        create_directory_for_kernels
-    )
-
-    diff -u $LIST_OF_ACTIONS - << EOF
-[ -d /boot/guest ]
-EOF
-}
-
-function test_create_directory_for_images {
-    (
-        . mocks
-        mock_out get_local_sr_path /var/run/sr-mount/uuid1
-        create_directory_for_images
-    )
-
-    assert_directory_exists "/var/run/sr-mount/uuid1/os-images"
-    assert_symlink "/images" "/var/run/sr-mount/uuid1/os-images"
-}
-
-function test_create_directory_for_images_existing_dir {
-    (
-        . mocks
-        given_directory_exists "/images"
-        create_directory_for_images
-    )
-
-    diff -u $LIST_OF_ACTIONS - << EOF
-[ -d /images ]
-EOF
-}
-
-function test_get_local_sr {
-    setup_xe_response "uuid123"
-
-    local RESULT
-    RESULT=$(. mocks && get_local_sr)
-
-    [ "$RESULT" == "uuid123" ]
-
-    assert_xe_param "pool-list" params=default-SR minimal=true
-}
-
-function test_get_local_sr_path {
-    local RESULT
-    RESULT=$(mock_out get_local_sr "uuid1" && get_local_sr_path)
-
-    [ "/var/run/sr-mount/uuid1" == "$RESULT" ]
-}
-
-# Test runner
-[ "$1" = "" ] && {
-    grep -e "^function *test_" $0 | cut -d" " -f2
-}
-
-[ "$1" = "run_tests" ] && {
-    for testname in $($0); do
-        echo "$testname"
-        before_each_test
-        (
-            set -eux
-            $testname
-        )
-        if [ "$?" != "0" ]; then
-            echo "FAIL"
-            exit 1
-        else
-            echo "PASS"
-        fi
-
-        after_each_test
-    done
-}
diff --git a/tools/xen/xenrc b/tools/xen/xenrc
deleted file mode 100644
index 169e0427a8..0000000000
--- a/tools/xen/xenrc
+++ /dev/null
@@ -1,114 +0,0 @@
-#!/bin/bash
-
-#
-# XenServer specific defaults for the /tools/xen/ scripts
-# Similar to stackrc, you can override these in your localrc
-#
-
-# Name of this guest
-GUEST_NAME=${GUEST_NAME:-DevStackOSDomU}
-
-# Template cleanup
-CLEAN_TEMPLATES=${CLEAN_TEMPLATES:-false}
-
-# Size of image
-VDI_MB=${VDI_MB:-5000}
-
-# Devstack now contains many components.  4GB ram is not enough to prevent
-# swapping and memory fragmentation - the latter of which can cause failures
-# such as blkfront failing to plug a VBD and lead to random test fails.
-#
-# Set to 6GB so an 8GB XenServer VM can have a 1GB Dom0 and leave 1GB for VMs
-OSDOMU_MEM_MB=6144
-OSDOMU_VDI_GB=8
-
-# Network mapping. Specify bridge names or network names. Network names may
-# differ across localised versions of XenServer. If a given bridge/network
-# was not found, a new network will be created with the specified name.
-
-# Get the management network from the XS installation
-VM_BRIDGE_OR_NET_NAME="OpenStack VM Network"
-PUB_BRIDGE_OR_NET_NAME="OpenStack Public Network"
-
-# VM Password
-GUEST_PASSWORD=${GUEST_PASSWORD:-secret}
-
-# Extracted variables for OpenStack VM network device numbers.
-# Make sure they form a continuous sequence starting from 0
-MGT_DEV_NR=0
-VM_DEV_NR=1
-PUB_DEV_NR=2
-
-# Host Interface, i.e. the interface on the nova vm you want to expose the
-# services on. Usually the device connected to the management network or the
-# one connected to the public network is used.
-HOST_IP_IFACE=${HOST_IP_IFACE:-"eth${MGT_DEV_NR}"}
-
-#
-# Our nova host's network info
-#
-
-# Management network
-MGT_IP=${MGT_IP:-dhcp}
-MGT_NETMASK=${MGT_NETMASK:-ignored}
-
-# VM Network
-VM_IP=${VM_IP:-10.255.255.255}
-VM_NETMASK=${VM_NETMASK:-255.255.255.0}
-
-# Public network
-# Aligned with stack.sh - see FLOATING_RANGE
-PUB_IP=${PUB_IP:-172.24.4.10}
-PUB_NETMASK=${PUB_NETMASK:-255.255.255.0}
-
-# Ubuntu install settings
-UBUNTU_INST_RELEASE="xenial"
-UBUNTU_INST_TEMPLATE_NAME="Ubuntu 16.04 (64-bit) for DevStack"
-# For 12.04 use "precise" and update template name
-# However, for 12.04, you should be using
-# XenServer 6.1 and later or XCP 1.6 or later
-# 11.10 is only really supported with XenServer 6.0.2 and later
-UBUNTU_INST_ARCH="amd64"
-UBUNTU_INST_HTTP_HOSTNAME="archive.ubuntu.com"
-UBUNTU_INST_HTTP_DIRECTORY="/ubuntu"
-UBUNTU_INST_HTTP_PROXY=""
-UBUNTU_INST_LOCALE="en_US"
-UBUNTU_INST_KEYBOARD="us"
-# network configuration for ubuntu netinstall
-UBUNTU_INST_IP="dhcp"
-UBUNTU_INST_NAMESERVERS=""
-UBUNTU_INST_NETMASK=""
-UBUNTU_INST_GATEWAY=""
-
-# Create a separate xvdb. Tis could be used as a backing device for cinder
-# volumes. Specify
-#   XEN_XVDB_SIZE_GB=10
-#   VOLUME_BACKING_DEVICE=/dev/xvdb
-# in your localrc to avoid kernel lockups:
-#   https://bugs.launchpad.net/cinder/+bug/1023755
-#
-# Set the size to 0 to avoid creation of additional disk.
-XEN_XVDB_SIZE_GB=0
-
-STACK_USER=stack
-DOMZERO_USER=domzero
-
-RC_DIR="../.."
-
-restore_nounset=$(set +o | grep nounset)
-set +u
-
-## Note that the lines below are coming from stackrc to support
-## new-style config files
-source $RC_DIR/functions-common
-
-# allow local overrides of env variables, including repo config
-if [[ -f $RC_DIR/localrc ]]; then
-    # Old-style user-supplied config
-    source $RC_DIR/localrc
-elif [[ -f $RC_DIR/.localrc.auto ]]; then
-    # New-style user-supplied config extracted from local.conf
-    source $RC_DIR/.localrc.auto
-fi
-
-$restore_nounset

From 730ce45466a903c639554b2e70f6e40a02e9e29d Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Fri, 23 Feb 2018 13:56:48 +0000
Subject: [PATCH 1280/2409] Create NOVA_READY_TIMEOUT in is_nova_ready function

The function was introduced in [0] using a hardcoded timeout of 60
seconds which turns out to be too small on slow machines. Create a new
global variable NOVA_READY_TIMEOUT instead so that users can
override the timeout if necessary.

[0] I32eb59b9d6c225a3e93992be3a3b9f4b251d7189

Co-Authored-By: Mohammed Naser <mnaser@vexxhost.com>
Change-Id: I0cd7f193589a1a0776ae76dc30cecefe7ba9e5db
---
 lib/nova | 2 +-
 stackrc  | 3 +++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index 8691c8eb33..d89d64e72f 100644
--- a/lib/nova
+++ b/lib/nova
@@ -1000,7 +1000,7 @@ function is_nova_ready {
         # because of the dom0/domU split. Just ignore for now.
         return
     fi
-    wait_for_compute 60
+    wait_for_compute $NOVA_READY_TIMEOUT
 }
 
 function start_nova {
diff --git a/stackrc b/stackrc
index b7105d368e..aebf152bad 100644
--- a/stackrc
+++ b/stackrc
@@ -813,6 +813,9 @@ fi
 # Service startup timeout
 SERVICE_TIMEOUT=${SERVICE_TIMEOUT:-60}
 
+# Timeout for compute node registration in Nova
+NOVA_READY_TIMEOUT=${NOVA_READY_TIMEOUT:-$SERVICE_TIMEOUT}
+
 # Service graceful shutdown timeout
 SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT=${SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT:-5}
 

From 7880904d15c1dbbea5c26ece1a30eb0850bf10ab Mon Sep 17 00:00:00 2001
From: Jacky Hu <hudayou@hotmail.com>
Date: Mon, 26 Feb 2018 18:36:59 +0800
Subject: [PATCH 1281/2409] Run local script after nova cellsv2 is configured

If user try to create a server in local script before nova cells is
configured, it will run into the following error:
Host 'x' is not mapped to any cell.

Change-Id: I4fe76865fd6e16d5beb5ed9e5d6a9f3542e990a5
---
 stack.sh | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/stack.sh b/stack.sh
index 1d1f12e116..1803169e2d 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1385,15 +1385,6 @@ run_phase stack extra
 merge_config_group $TOP_DIR/local.conf post-extra
 
 
-# Run local script
-# ----------------
-
-# Run ``local.sh`` if it exists to perform user-managed tasks
-if [[ -x $TOP_DIR/local.sh ]]; then
-    echo "Running user script $TOP_DIR/local.sh"
-    $TOP_DIR/local.sh
-fi
-
 # Sanity checks
 # =============
 
@@ -1428,6 +1419,15 @@ if is_service_enabled n-api; then
     fi
 fi
 
+# Run local script
+# ----------------
+
+# Run ``local.sh`` if it exists to perform user-managed tasks
+if [[ -x $TOP_DIR/local.sh ]]; then
+    echo "Running user script $TOP_DIR/local.sh"
+    $TOP_DIR/local.sh
+fi
+
 # Bash completion
 # ===============
 

From 7b1d5b64ac53e4fea9c2bdb0a6e44fc90fbac067 Mon Sep 17 00:00:00 2001
From: Andrea Frittoli <andrea.frittoli@gmail.com>
Date: Mon, 26 Feb 2018 22:23:02 +0000
Subject: [PATCH 1282/2409] Define devstack-base abstract job

Define an abstract job devstack base that does not require any
project apart from devstack. This job defines basic devstack_localrc
settings that are common to any devstack job (mostly to work with
infra) and devstack_services to emit "disable_all_services" so to
cancel any devstack default.

The variables are defined as global ones as well as host-vars for
the controller and group-vars for peer nodes, so that any
descendent job may extend them, thanks for Zuul dict merging.

Change-Id: I2cdb723f6ee209683044fecec59ff7b510a2752b
---
 .zuul.yaml | 96 +++++++++++++++++++++++++++++++++++++++++-------------
 1 file changed, 74 insertions(+), 22 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index cc29466f35..0ae1187527 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -26,43 +26,43 @@
       - name: subnode
         nodes:
           - compute1
+      - name: switch
+        nodes:
+          - controller
+      - name: peers
+        nodes:
+          - compute1
 
 - job:
-    name: devstack
+    name: devstack-base
     parent: multinode
-    description: Base devstack job
-    nodeset: openstack-single-node
+    abstract: true
+    description: |
+      Base abstract Devstack job.
+
+      Defines plays and base variables, but it does not include any project
+      and it does not run any service by default. This is a common base for
+      all single Devstack jobs, single or multinode.
+      Variables are defined in job.vars, which is what is then used by single
+      node jobs and by multi node jobs for the controller, as well as in
+      job.group-vars.peers, which is what is used by multi node jobs for peer
+      nodes (everything but the controller).
     required-projects:
       - openstack-dev/devstack
-      - openstack/cinder
-      - openstack/glance
-      - openstack/keystone
-      - openstack/neutron
-      - openstack/nova
-      - openstack/requirements
-      - openstack/swift
     roles:
       - zuul: openstack-infra/devstack-gate
       - zuul: openstack-infra/openstack-zuul-jobs
-    timeout: 7200
     vars:
-      test_matrix_configs: [neutron, tlsproxy]
       devstack_localrc:
         DATABASE_PASSWORD: secretdatabase
         RABBIT_PASSWORD: secretrabbit
         ADMIN_PASSWORD: secretadmin
         SERVICE_PASSWORD: secretservice
         NETWORK_GATEWAY: 10.1.0.1
-        Q_USE_DEBUG_COMMAND: true
         FIXED_RANGE: 10.1.0.0/20
         IPV4_ADDRS_SAFE_TO_USE: 10.1.0.0/20
         FLOATING_RANGE: 172.24.5.0/24
         PUBLIC_NETWORK_GATEWAY: 172.24.5.1
-        FLOATING_HOST_PREFIX: 172.24.4
-        FLOATING_HOST_MASK: 23
-        SWIFT_REPLICAS: 1
-        SWIFT_START_ALL_SERVICES: false
-        SWIFT_HASH: 1234123412341234
         LOGFILE: /opt/stack/logs/devstacklog.txt
         LOG_COLOR: false
         VERBOSE: true
@@ -76,8 +76,7 @@
         # from the location below for all the CI jobs.
         ETCD_DOWNLOAD_URL: http://tarballs.openstack.org/etcd/
       devstack_services:
-        horizon: false
-        tempest: false
+        base: false
       zuul_copy_output:
         '{{ devstack_conf_dir }}/local.conf': 'logs'
         '{{ devstack_conf_dir }}/localrc': 'logs'
@@ -117,7 +116,28 @@
         log: True
         localrc: True
         stackenv: True
-        summary: True
+    group-vars:
+      peers:
+        devstack_localrc:
+          DATABASE_PASSWORD: secretdatabase
+          RABBIT_PASSWORD: secretrabbit
+          ADMIN_PASSWORD: secretadmin
+          SERVICE_PASSWORD: secretservice
+          NETWORK_GATEWAY: 10.1.0.1
+          FIXED_RANGE: 10.1.0.0/20
+          IPV4_ADDRS_SAFE_TO_USE: 10.1.0.0/20
+          FLOATING_RANGE: 172.24.5.0/24
+          PUBLIC_NETWORK_GATEWAY: 172.24.5.1
+          LOGFILE: /opt/stack/logs/devstacklog.txt
+          LOG_COLOR: false
+          VERBOSE: true
+          VERBOSE_NO_TIMESTAMP: true
+          NOVNC_FROM_PACKAGE: true
+          ERROR_ON_CLONE: true
+          LIBVIRT_TYPE: qemu
+          ETCD_DOWNLOAD_URL: http://tarballs.openstack.org/etcd/
+        devstack_services:
+          base: false
     pre-run: playbooks/pre.yaml
     run: playbooks/devstack.yaml
     post-run: playbooks/post.yaml
@@ -130,9 +150,41 @@
       # Translations
       - ^.*/locale/.*po$
 
+- job:
+    name: devstack
+    parent: devstack-base
+    description: |
+      Single node devstack job for integration gate.
+    nodeset: openstack-single-node
+    required-projects:
+      - openstack/cinder
+      - openstack/glance
+      - openstack/keystone
+      - openstack/neutron
+      - openstack/nova
+      - openstack/requirements
+      - openstack/swift
+    timeout: 7200
+    vars:
+      test_matrix_configs: [neutron, tlsproxy]
+      devstack_localrc:
+        # Common OpenStack services settings
+        SWIFT_REPLICAS: 1
+        SWIFT_START_ALL_SERVICES: false
+        SWIFT_HASH: 1234123412341234
+        CINDER_PERIODIC_INTERVAL: 10
+        DEBUG_LIBVIRT_COREDUMPS: True
+        NOVA_VNC_ENABLED: true
+        VNCSERVER_LISTEN: 0.0.0.0
+        VNCSERVER_PROXYCLIENT_ADDRESS: "{{ hostvars[inventory_hostname]['nodepool']['private_ipv4'] }}"
+      devstack_services:
+        base: true
+        horizon: false
+        tempest: false
+
 - job:
     name: devstack-multinode
-    parent: devstack
+    parent: devstack-base
     description: Base devstack multinode job
     nodeset: openstack-two-node
     # NOTE(andreaf) The multinode job is useful to see the setup of different

From b59c93cc44bc9ff0e041ff24805880294117f745 Mon Sep 17 00:00:00 2001
From: Pavlo Shchelokovskyy <shchelokovskyy@gmail.com>
Date: Mon, 26 Feb 2018 16:36:54 +0000
Subject: [PATCH 1283/2409] Actually generate pip freeze outputs

the shell script used is actually being run thru 'sh', not bash,
which does not understand "[[" test operators.

Explicitly run this script with /bin/bash instead.

Change-Id: I551d2631bcb6aef49550d69b3830ffcb509abfb7
---
 roles/capture-system-logs/tasks/main.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/roles/capture-system-logs/tasks/main.yaml b/roles/capture-system-logs/tasks/main.yaml
index cd8f4f0eab..de4f8eda08 100644
--- a/roles/capture-system-logs/tasks/main.yaml
+++ b/roles/capture-system-logs/tasks/main.yaml
@@ -1,6 +1,7 @@
 # TODO(andreaf) Make this into proper Ansible
 - name: Stage various logs and reports
   shell:
+    executable: /bin/bash
     cmd: |
       sudo iptables-save > {{ stage_dir }}/iptables.txt
       df -h > {{ stage_dir }}/df.txt

From ca61966f47af9070a7c6ed6fef3f2d630c43c919 Mon Sep 17 00:00:00 2001
From: Thomas Bechtold <tbechtold@suse.com>
Date: Wed, 28 Feb 2018 14:46:05 +0100
Subject: [PATCH 1284/2409] neutron: Do no longer set "url" in nova.conf

Since[1], "url" in the [neutron] section in nova.conf should no
longer be set.

[1]
https://github.com/openstack/nova/commit/6cde77ebbab85bc8ccd2ab7ad977b1d4af4a13fa

Depends-On: https://review.openstack.org/548572
Related-Bug: #1752289
Change-Id: Ied6c155da9d51a25ba7a524e69d018d39ed3442c
---
 lib/neutron        | 1 -
 lib/neutron-legacy | 1 -
 2 files changed, 2 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index c5839f5c3e..72c5872ccd 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -306,7 +306,6 @@ function configure_neutron_nova_new {
     iniset $NOVA_CONF neutron project_domain_name "Default"
     iniset $NOVA_CONF neutron auth_strategy $NEUTRON_AUTH_STRATEGY
     iniset $NOVA_CONF neutron region_name "$REGION_NAME"
-    iniset $NOVA_CONF neutron url $NEUTRON_SERVICE_PROTOCOL://$NEUTRON_SERVICE_HOST:$NEUTRON_SERVICE_PORT
 
     iniset $NOVA_CONF DEFAULT firewall_driver nova.virt.firewall.NoopFirewallDriver
 
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index bb76c5f9ce..5f6cee73fb 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -376,7 +376,6 @@ function create_nova_conf_neutron {
     iniset $NOVA_CONF neutron project_domain_name "$SERVICE_DOMAIN_NAME"
     iniset $NOVA_CONF neutron auth_strategy "$Q_AUTH_STRATEGY"
     iniset $NOVA_CONF neutron region_name "$REGION_NAME"
-    iniset $NOVA_CONF neutron url "${Q_PROTOCOL}://$Q_HOST:$Q_PORT"
 
     if [[ "$Q_USE_SECGROUP" == "True" ]]; then
         LIBVIRT_FIREWALL_DRIVER=nova.virt.firewall.NoopFirewallDriver

From f63ddd609f8ba0c6000d7d07074dc64232830351 Mon Sep 17 00:00:00 2001
From: Lenny Verkhovsky <lennyb@mellanox.com>
Date: Sun, 25 Feb 2018 14:48:05 +0000
Subject: [PATCH 1285/2409] Replace depricated iscsi_helper with target_helper

Cinder change I5231f8fe3399deb9c57e6efb121d0d008dc9c7f4
replaces iscsi_helper with more general one.



Change-Id: I49fe0365b170e5a5b0449d80003bcf970e4c191d
---
 lib/cinder                    | 4 ++--
 lib/cinder_backends/fake_gate | 2 +-
 lib/cinder_backends/lvm       | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 75486adda5..a1d68712b6 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -101,7 +101,7 @@ CINDER_PERIODIC_INTERVAL=${CINDER_PERIODIC_INTERVAL:-60}
 if is_fedora; then
     CINDER_ISCSI_HELPER=${CINDER_ISCSI_HELPER:-lioadm}
     if [[ ${CINDER_ISCSI_HELPER} != "lioadm" ]]; then
-        die "lioadm is the only valid Cinder iscsi_helper config on this platform"
+        die "lioadm is the only valid Cinder target_helper config on this platform"
     fi
 else
     CINDER_ISCSI_HELPER=${CINDER_ISCSI_HELPER:-tgtadm}
@@ -230,7 +230,7 @@ function configure_cinder {
     iniset $CINDER_CONF DEFAULT auth_strategy keystone
     iniset $CINDER_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
 
-    iniset $CINDER_CONF DEFAULT iscsi_helper "$CINDER_ISCSI_HELPER"
+    iniset $CINDER_CONF DEFAULT target_helper "$CINDER_ISCSI_HELPER"
     iniset $CINDER_CONF database connection `database_connection_url cinder`
     iniset $CINDER_CONF DEFAULT api_paste_config $CINDER_API_PASTE_INI
     iniset $CINDER_CONF DEFAULT rootwrap_config "$CINDER_CONF_DIR/rootwrap.conf"
diff --git a/lib/cinder_backends/fake_gate b/lib/cinder_backends/fake_gate
index 6b1f848790..3ffd9a6785 100644
--- a/lib/cinder_backends/fake_gate
+++ b/lib/cinder_backends/fake_gate
@@ -50,7 +50,7 @@ function configure_cinder_backend_lvm {
     iniset $CINDER_CONF $be_name volume_backend_name $be_name
     iniset $CINDER_CONF $be_name volume_driver "cinder.tests.fake_driver.FakeGateDriver"
     iniset $CINDER_CONF $be_name volume_group $VOLUME_GROUP_NAME-$be_name
-    iniset $CINDER_CONF $be_name iscsi_helper "$CINDER_ISCSI_HELPER"
+    iniset $CINDER_CONF $be_name target_helper "$CINDER_ISCSI_HELPER"
     iniset $CINDER_CONF $be_name lvm_type "$CINDER_LVM_TYPE"
 
     if [[ "$CINDER_VOLUME_CLEAR" == "non" ]]; then
diff --git a/lib/cinder_backends/lvm b/lib/cinder_backends/lvm
index 03e188029f..497081c9e4 100644
--- a/lib/cinder_backends/lvm
+++ b/lib/cinder_backends/lvm
@@ -50,7 +50,7 @@ function configure_cinder_backend_lvm {
     iniset $CINDER_CONF $be_name volume_backend_name $be_name
     iniset $CINDER_CONF $be_name volume_driver "cinder.volume.drivers.lvm.LVMVolumeDriver"
     iniset $CINDER_CONF $be_name volume_group $VOLUME_GROUP_NAME-$be_name
-    iniset $CINDER_CONF $be_name iscsi_helper "$CINDER_ISCSI_HELPER"
+    iniset $CINDER_CONF $be_name target_helper "$CINDER_ISCSI_HELPER"
     iniset $CINDER_CONF $be_name lvm_type "$CINDER_LVM_TYPE"
 
 }

From 3360ffb5f27cef3f22da944e8a1314678a4bf970 Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Fri, 2 Mar 2018 21:08:34 +0100
Subject: [PATCH 1286/2409] devstack master is rocky now

See #snowpenstack!

Change-Id: I2df485c2acf1bec0d0f7ddc6538bff2c2ec141e3
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index aebf152bad..4f627ccbd7 100644
--- a/stackrc
+++ b/stackrc
@@ -258,7 +258,7 @@ REQUIREMENTS_DIR=$DEST/requirements
 # Setting the variable to 'ALL' will activate the download for all
 # libraries.
 
-DEVSTACK_SERIES="queens"
+DEVSTACK_SERIES="rocky"
 
 ##############
 #

From 6bab8321b44db260f9e001d8276a660d1ff56ed4 Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Fri, 2 Mar 2018 21:13:12 +0100
Subject: [PATCH 1287/2409] Remove references to hardcoded file writing in /tmp

/tmp is a world writeable directory, so using hardcoded filenames
in there is just a bad coding style (susceptible to symlink attacks).
Avoid using it to not give a bad precedent.

Change-Id: Ia66763a0e4714f2226e98dbd85600b2035bd5088
---
 functions | 4 +---
 stack.sh  | 6 ++----
 2 files changed, 3 insertions(+), 7 deletions(-)

diff --git a/functions b/functions
index 3fcc38dc4b..24994c0470 100644
--- a/functions
+++ b/functions
@@ -810,13 +810,11 @@ function get_random_port {
 #
 # Write out various useful state information to /etc/devstack-version
 function write_devstack_version {
-    cat - > /tmp/devstack-version <<EOF
+    cat - <<EOF | sudo tee /etc/devstack-version >/dev/null
 DevStack Version: ${DEVSTACK_SERIES}
 Change: $(git log --format="%H %s %ci" -1)
 OS Version: ${os_VENDOR} ${os_RELEASE} ${os_CODENAME}
 EOF
-    sudo install -m 644 /tmp/devstack-version /etc/devstack-version
-    rm /tmp/devstack-version
 }
 
 # Restore xtrace
diff --git a/stack.sh b/stack.sh
index 1d1f12e116..c02b663646 100755
--- a/stack.sh
+++ b/stack.sh
@@ -962,17 +962,15 @@ fi
 if [[ $SYSLOG != "False" ]]; then
     if [[ "$SYSLOG_HOST" = "$HOST_IP" ]]; then
         # Configure the master host to receive
-        cat <<EOF >/tmp/90-stack-m.conf
+        cat <<EOF | sudo tee /etc/rsyslog.d/90-stack-m.conf >/dev/null
 \$ModLoad imrelp
 \$InputRELPServerRun $SYSLOG_PORT
 EOF
-        sudo mv /tmp/90-stack-m.conf /etc/rsyslog.d
     else
         # Set rsyslog to send to remote host
-        cat <<EOF >/tmp/90-stack-s.conf
+        cat <<EOF | sudo tee /etc/rsyslog.d/90-stack-s.conf >/dev/null
 *.*		:omrelp:$SYSLOG_HOST:$SYSLOG_PORT
 EOF
-        sudo mv /tmp/90-stack-s.conf /etc/rsyslog.d
     fi
 
     RSYSLOGCONF="/etc/rsyslog.conf"

From d9c1275c5df55e822a7df6880a9a1430ab4f24a0 Mon Sep 17 00:00:00 2001
From: "Andrea Frittoli (andreaf)" <andrea.frittoli@gmail.com>
Date: Wed, 21 Feb 2018 14:35:58 +0000
Subject: [PATCH 1288/2409] Define devstack services without the test-matrix

Emit a disable_all_services and define which service we run in
the job directly. This drops the dependency from the test matrix,
from devstack default list of services and it makes it easier for
jobs to add/remove services based on the list in the base job.

Change-Id: Ib1debefd541b933dbfc54d484c263cc0ed60423d
---
 .zuul.yaml | 79 +++++++++++++++++++++++++++++++++++++++++++++++++++---
 1 file changed, 76 insertions(+), 3 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 0ae1187527..2deb769d30 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -76,6 +76,8 @@
         # from the location below for all the CI jobs.
         ETCD_DOWNLOAD_URL: http://tarballs.openstack.org/etcd/
       devstack_services:
+        # Ignore base set of services setup by test-matrix.
+        # Ignore any default set by devstack. Emit a "disable_all_services".
         base: false
       zuul_copy_output:
         '{{ devstack_conf_dir }}/local.conf': 'logs'
@@ -154,7 +156,7 @@
     name: devstack
     parent: devstack-base
     description: |
-      Single node devstack job for integration gate.
+      Single or multi node devstack job for integration gate.
     nodeset: openstack-single-node
     required-projects:
       - openstack/cinder
@@ -166,7 +168,6 @@
       - openstack/swift
     timeout: 7200
     vars:
-      test_matrix_configs: [neutron, tlsproxy]
       devstack_localrc:
         # Common OpenStack services settings
         SWIFT_REPLICAS: 1
@@ -178,9 +179,81 @@
         VNCSERVER_LISTEN: 0.0.0.0
         VNCSERVER_PROXYCLIENT_ADDRESS: "{{ hostvars[inventory_hostname]['nodepool']['private_ipv4'] }}"
       devstack_services:
-        base: true
+        # Core services enabled for this branch.
+        # This list replaces the test-matrix.
+        # Shared services
+        dstat: true
+        etcd3: true
+        mysql: true
+        peakmem_tracker: true
+        rabbit: true
+        tls-proxy: true
+        # Keystone services
+        key: true
+        # Glance services
+        g-api: true
+        g-reg: true
+        # Nova services
+        n-api: true
+        n-api-meta: true
+        n-cauth: true
+        n-cond: true
+        n-cpu: true
+        n-novnc: true
+        n-obj: true
+        n-sch: true
+        placement-api: true
+        # Neutron services
+        neutron-api: true
+        neutron-agent: true
+        neutron-dhcp: true
+        neutron-l3: true
+        neutron-metadata-agent: true
+        neutron-metering: true
+        # Swift services
+        s-account: true
+        s-container: true
+        s-object: true
+        s-proxy: true
+        # Cinder services
+        c-api: true
+        c-bak: true
+        c-sch: true
+        c-vol: true
+        cinder: true
+        # Services we don't need.
+        # This section is not really needed, it's for readability.
         horizon: false
         tempest: false
+        # Test matrix emits ceilometer but ceilomenter is not installed in the
+        # integrated gate, so specifying the services has not effect.
+        # ceilometer-*: false
+    group-vars:
+      subnode:
+        devstack_services:
+          # Core services enabled for this branch.
+          # This list replaces the test-matrix.
+          # Shared services
+          dstat: true
+          peakmem_tracker: true
+          tls-proxy: true
+          # Nova services
+          n-cpu: true
+          placement-client: true
+          # Neutron services
+          neutron-agent: true
+          # Cinder services
+          c-bak: true
+          c-vol: true
+          # Services we don't run at all on subnode.
+          # This section is not really needed, it's for readability.
+          # keystone: false
+          # s-*: false
+          horizon: false
+          tempest: false
+          # Test matrix emits ceilometer but ceilomenter is not installed in the
+          # integrated gate, so specifying the services has not effect.
+          # ceilometer-*: false
 
 - job:
     name: devstack-multinode

From acca80414ff3db373138ed5e7124ced7306c28df Mon Sep 17 00:00:00 2001
From: Andrea Frittoli <andrea.frittoli@gmail.com>
Date: Sat, 3 Mar 2018 22:16:50 +0000
Subject: [PATCH 1289/2409] Ensure that stack home is owned by stack

The role that sets up the user and its home folder must ensure that
the home folder is owned by stack as well.

Change-Id: I2e72d7b9d68a2a14f8a148ef82cbb3f569bd1cea
---
 roles/setup-stack-user/tasks/main.yaml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/roles/setup-stack-user/tasks/main.yaml b/roles/setup-stack-user/tasks/main.yaml
index 8384515ebe..0fc7c2d78b 100644
--- a/roles/setup-stack-user/tasks/main.yaml
+++ b/roles/setup-stack-user/tasks/main.yaml
@@ -21,10 +21,12 @@
     group: stack
   become: yes
 
-- name: Set stack user home directory permissions
+- name: Set stack user home directory permissions and ownership
   file:
     path: '{{ devstack_stack_home_dir }}'
     mode: 0755
+    owner: stack
+    group: stack
   become: yes
 
 - name: Copy 50_stack_sh file to /etc/sudoers.d
@@ -36,7 +38,7 @@
     group: root
   become: yes
 
-- name: Create new/.cache folder within BASE
+- name: Create .cache folder within BASE
   file:
     path: '{{ devstack_stack_home_dir }}/.cache'
     state: directory

From 2a2349be5f82455c462b294dfada76820d4d2aa4 Mon Sep 17 00:00:00 2001
From: "Andrea Frittoli (andreaf)" <andrea.frittoli@gmail.com>
Date: Wed, 14 Feb 2018 19:24:04 +0000
Subject: [PATCH 1290/2409] Stage .localrc.auto

Change-Id: I9beb713a0b037e0229b13fd13d7d4de156ed0b59
Depends-on: https://review.openstack.org/544606
---
 .zuul.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index dc3a42939e..2176a4c2a4 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -110,6 +110,7 @@
       zuul_copy_output:
         '{{ devstack_conf_dir }}/local.conf': 'logs'
         '{{ devstack_conf_dir }}/localrc': 'logs'
+        '{{ devstack_conf_dir }}/.localrc.auto': 'logs'
         '{{ devstack_conf_dir }}/.stackenv': 'logs'
         '{{ devstack_log_dir }}/dstat-csv.log': 'logs'
         '{{ devstack_log_dir }}/devstacklog.txt': 'logs'
@@ -146,6 +147,7 @@
         log: True
         localrc: True
         stackenv: True
+        auto: True
     group-vars:
       peers:
         devstack_localrc:

From 1610cc22199f84395c87f4d37d079e8398934378 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 6 Mar 2018 11:40:46 +1100
Subject: [PATCH 1291/2409] Add a note on experimental jobs

With I4161e1f1c8d47070dd35fad38b00715438d94eb2 and
I37fe007dc6f387d43cbaf55771027718005ac40d we have removed most of the
legacy experimental jobs.

Add a short note so we don't go back to the Hotel California model of
"you can check in but never check out".  With zuulv3 it is possible to
have self-testing changes for testing indiviual jobs.  Experimental
should be for things with wider application to run against all
changes.

Change-Id: Ibfb902b17a8f7d5355689f2a584c061c001df0d8
---
 .zuul.yaml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index dc3a42939e..2a2648e4ec 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -323,6 +323,12 @@
       jobs:
         - devstack
         - devstack-unit-tests
+    # Please add a note on each job and conditions for the job not
+    # being experimental any more, so we can keep this list somewhat
+    # pruned.
+    #
+    # * nova-next: maintained by nova for unreleased/undefaulted
+    #    things like cellsv2 and placement-api
     experimental:
       jobs:
         - nova-next

From 36c3aaa07e638af0b581efa28828e04146ae1364 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Mon, 5 Mar 2018 10:03:27 -0500
Subject: [PATCH 1292/2409] Add nova-cells-v1 to experimental queue jobs

The legacy-tempest-dsvm-cells job is being moved into the
nova repo and renamed to nova-cells-v1. This change adds
the new job name to the in-tree definition of the experimental
queue jobs that run on devstack changes. A project-config change
will depend on this patch to undefine the legacy job name from
being used on devstack changes.

Depends-On: https://review.openstack.org/549780
Change-Id: I22fa1411809c46ffc423e0dd1cde0d8f40362635
---
 .zuul.yaml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index 25bd757ab3..49bf08b091 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -329,8 +329,15 @@
     # being experimental any more, so we can keep this list somewhat
     # pruned.
     #
+    # * nova-cells-v1: maintained by nova for cells v1 (nova-cells service);
+    #    nova gates on this job, it's in experimental for testing cells v1
+    #    changes to devstack w/o gating on it for all devstack changes.
     # * nova-next: maintained by nova for unreleased/undefaulted
     #    things like cellsv2 and placement-api
     experimental:
       jobs:
+        - nova-cells-v1:
+            irrelevant-files:
+              - ^.*\.rst$
+              - ^doc/.*$
         - nova-next

From 21221d1ad1462cdcaed4d052c3324ae384b407d4 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Tue, 6 Mar 2018 10:08:36 -0500
Subject: [PATCH 1293/2409] Configure nova to auto-calculate compute RPC
 upgrade levels

The openstack-ansible team found a regression in Queens when setting
the compute RPC upgrade_levels to 'auto' on a fresh install before any
computes had started up. The dependent change fixes the issue in nova
but for future proofing against this sort of issue again, we can set
the compute RPC upgrade levels in devstack to 'auto' for fresh installs
as well. Note that grenade already sets 'auto' for compute upgrade
levels, which is why we didn't catch this in grenade testing with the
compute RPC 5.0 version bump that caused the issue.

Depends-On: https://review.openstack.org/549737/

Change-Id: I07f34dbc09b6108ba8f5b2a83a28c75eb42be495
Related-Bug: #1753443
---
 lib/nova | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/nova b/lib/nova
index 580f87f277..3b50950bb0 100644
--- a/lib/nova
+++ b/lib/nova
@@ -506,6 +506,8 @@ function create_nova_conf {
     # Format logging
     setup_logging $NOVA_CONF
 
+    iniset $NOVA_CONF upgrade_levels compute "auto"
+
     write_uwsgi_config "$NOVA_UWSGI_CONF" "$NOVA_UWSGI" "/compute"
     write_uwsgi_config "$NOVA_METADATA_UWSGI_CONF" "$NOVA_METADATA_UWSGI" "" ":${METADATA_SERVICE_PORT}"
 

From 5e714d33081455af4bd7a45bb9e60a905ad6f2e7 Mon Sep 17 00:00:00 2001
From: Andrea Frittoli <andrea.frittoli@gmail.com>
Date: Sat, 17 Feb 2018 22:21:26 +0000
Subject: [PATCH 1294/2409] Fix multinode mode for devstack

Extend the devstack job so that it can support both single and multinode
cases.  Multinode mode require extra settings in devstack configuration,
some of which as subnode specific, some controller specific.

Also keep a simple devstack-multinode job defined for now so we can run
a multinode job in devstack gate, until the full tempest multinode job
is ready to match the old
gate-tempest-dsvm-neutron-multinode-full-ubuntu-xenial-nv.

Fixing multinode also requires sharing the CA configuration between
controller and peers, overlay network configuration for communication
between virtual machines and running discover_hosts for nova after the
subnode has been setup.

The extra orchestration required for multinode is encoded in a
dedicated role to allow for jobs in other repos to re-use it.

Change-Id: I2dcbd9bdb401860820e655d97aa3c4775af2827f
---
 .zuul.yaml                                    | 44 +++++++++++++----
 playbooks/devstack.yaml                       |  2 +-
 playbooks/pre.yaml                            | 30 ++++++++----
 roles/orchestrate-devstack/README.rst         | 24 ++++++++++
 roles/orchestrate-devstack/defaults/main.yaml |  1 +
 roles/orchestrate-devstack/tasks/main.yaml    | 38 +++++++++++++++
 roles/sync-devstack-data/README.rst           | 12 +++++
 roles/sync-devstack-data/defaults/main.yaml   |  1 +
 roles/sync-devstack-data/tasks/main.yaml      | 48 +++++++++++++++++++
 9 files changed, 179 insertions(+), 21 deletions(-)
 create mode 100644 roles/orchestrate-devstack/README.rst
 create mode 100644 roles/orchestrate-devstack/defaults/main.yaml
 create mode 100644 roles/orchestrate-devstack/tasks/main.yaml
 create mode 100644 roles/sync-devstack-data/README.rst
 create mode 100644 roles/sync-devstack-data/defaults/main.yaml
 create mode 100644 roles/sync-devstack-data/tasks/main.yaml

diff --git a/.zuul.yaml b/.zuul.yaml
index 2deb769d30..2ef23c89ff 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -16,19 +16,24 @@
       - name: compute1
         label: ubuntu-xenial
     groups:
+      # Node where tests are executed and test results collected
       - name: tempest
         nodes:
           - controller
+      # Nodes running the compute service
       - name: compute
         nodes:
           - controller
           - compute1
+      # Nodes that are not the controller
       - name: subnode
         nodes:
           - compute1
+      # Switch node for multinode networking setup
       - name: switch
         nodes:
           - controller
+      # Peer nodes for multinode networking setup
       - name: peers
         nodes:
           - compute1
@@ -45,7 +50,7 @@
       all single Devstack jobs, single or multinode.
       Variables are defined in job.vars, which is what is then used by single
       node jobs and by multi node jobs for the controller, as well as in
-      job.group-vars.peers, which is what is used by multi node jobs for peer
+      job.group-vars.peers, which is what is used by multi node jobs for subnode
       nodes (everything but the controller).
     required-projects:
       - openstack-dev/devstack
@@ -76,7 +81,6 @@
         # from the location below for all the CI jobs.
         ETCD_DOWNLOAD_URL: http://tarballs.openstack.org/etcd/
       devstack_services:
-        # Ignore base set of services setup by test-matrix.
         # Ignore any default set by devstack. Emit a "disable_all_services".
         base: false
       zuul_copy_output:
@@ -119,7 +123,7 @@
         localrc: True
         stackenv: True
     group-vars:
-      peers:
+      subnode:
         devstack_localrc:
           DATABASE_PASSWORD: secretdatabase
           RABBIT_PASSWORD: secretrabbit
@@ -156,7 +160,9 @@
     name: devstack
     parent: devstack-base
     description: |
-      Single or multi node devstack job for integration gate.
+      Base devstack job for integration gate.
+
+      This base job can be used for single node and multinode devstack jobs.
     nodeset: openstack-single-node
     required-projects:
       - openstack/cinder
@@ -178,6 +184,15 @@
         NOVA_VNC_ENABLED: true
         VNCSERVER_LISTEN: 0.0.0.0
         VNCSERVER_PROXYCLIENT_ADDRESS: "{{ hostvars[inventory_hostname]['nodepool']['private_ipv4'] }}"
+        # Multinode specific settings
+        SERVICE_HOST: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}"
+        HOST_IP: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}"
+        PUBLIC_BRIDGE_MTU: "{{ external_bridge_mtu }}"
+      devstack_localconf:
+        post-config:
+          $NEUTRON_CONF:
+            DEFAULT:
+              global_physnet_mtu: "{{ external_bridge_mtu }}"
       devstack_services:
         # Core services enabled for this branch.
         # This list replaces the test-matrix.
@@ -254,16 +269,25 @@
           # Test matrix emits ceilometer but ceilomenter is not installed in the
           # integrated gate, so specifying the services has not effect.
           # ceilometer-*: false
+        devstack_localrc:
+          # Multinode specific settings
+          HOST_IP: "{{ hostvars[inventory_hostname]['nodepool']['private_ipv4'] }}"
+          SERVICE_HOST: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}"
+          PUBLIC_BRIDGE_MTU: "{{ external_bridge_mtu }}"
+          # Subnode specific settings
+          DATABASE_TYPE: mysql
+          GLANCE_HOSTPORT: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}:9292"
+          Q_HOST: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}"
+          RABBIT_HOST: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}"
+          DATABASE_HOST: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}"
 
 - job:
     name: devstack-multinode
-    parent: devstack-base
-    description: Base devstack multinode job
+    parent: devstack
     nodeset: openstack-two-node
-    # NOTE(andreaf) The multinode job is useful to see the setup of different
-    # services on different nodes, however the subnode configuration is not
-    # ready yet. Until then this job should stay non-voting.
-    voting: false
+    description: |
+      Simple multinode test to verify multinode functionality on devstack side.
+      This is not meant to be used as a parent job.
 
 - job:
     name: devstack-tox-base
diff --git a/playbooks/devstack.yaml b/playbooks/devstack.yaml
index ede8382632..93d19f1c7a 100644
--- a/playbooks/devstack.yaml
+++ b/playbooks/devstack.yaml
@@ -1,3 +1,3 @@
 - hosts: all
   roles:
-    - run-devstack
+    - orchestrate-devstack
diff --git a/playbooks/pre.yaml b/playbooks/pre.yaml
index 6681fb20a5..4689a6354f 100644
--- a/playbooks/pre.yaml
+++ b/playbooks/pre.yaml
@@ -1,15 +1,25 @@
-- hosts: controller
-  roles:
-    - role: test-matrix
-      test_matrix_role: primary 
-
-- hosts: subnode
-  roles:
-    - role: test-matrix
-      test_matrix_role: subnode
-
 - hosts: all
+  pre_tasks:
+    - name: Gather minimum local MTU
+      set_fact:
+        local_mtu: >
+          {% set mtus = [] -%}
+          {% for interface in ansible_interfaces -%}
+            {% set interface_variable = 'ansible_' + interface -%}
+            {% if interface_variable in hostvars[inventory_hostname] -%}
+              {% set _ = mtus.append(hostvars[inventory_hostname][interface_variable]['mtu']|int) -%}
+            {% endif -%}
+          {% endfor -%}
+          {{- mtus|min -}}
+    - name: Calculate external_bridge_mtu
+      # 50 bytes is overhead for vxlan (which is greater than GRE
+      # allowing us to use either overlay option with this MTU.
+      # TODO(andreaf) This should work, but it may have to be reconcilied with
+      # the MTU setting used by the multinode setup roles in multinode pre.yaml
+      set_fact:
+        external_bridge_mtu: "{{ local_mtu | int - 50 }}"
   roles:
+    - test-matrix
     - configure-swap
     - setup-stack-user
     - setup-tempest-user
diff --git a/roles/orchestrate-devstack/README.rst b/roles/orchestrate-devstack/README.rst
new file mode 100644
index 0000000000..7803ee4d74
--- /dev/null
+++ b/roles/orchestrate-devstack/README.rst
@@ -0,0 +1,24 @@
+Orchestrate a devstack
+
+Runs devstack in a multinode scenario, with one controller node
+and a group of subnodes.
+
+The reason for this role is so that jobs in other repository may
+run devstack in their plays with no need for re-implementing the
+orchestration logic.
+
+The "run-devstack" role is available to run devstack with no
+orchestration.
+
+This role sets up the controller and CA first, it then pushes CA
+data to sub-nodes and run devstack there. The only requirement for
+this role is for the controller inventory_hostname to be "controller"
+and for all sub-nodes to be defined in a group called "subnode".
+
+
+**Role Variables**
+
+.. zuul:rolevar:: devstack_base_dir
+   :default: /opt/stack
+
+   The devstack base directory.
diff --git a/roles/orchestrate-devstack/defaults/main.yaml b/roles/orchestrate-devstack/defaults/main.yaml
new file mode 100644
index 0000000000..fea05c8146
--- /dev/null
+++ b/roles/orchestrate-devstack/defaults/main.yaml
@@ -0,0 +1 @@
+devstack_base_dir: /opt/stack
diff --git a/roles/orchestrate-devstack/tasks/main.yaml b/roles/orchestrate-devstack/tasks/main.yaml
new file mode 100644
index 0000000000..12db58c520
--- /dev/null
+++ b/roles/orchestrate-devstack/tasks/main.yaml
@@ -0,0 +1,38 @@
+- name: Run devstack on the controller
+  include_role:
+    name: run-devstack
+  when: inventory_hostname == 'controller'
+
+- name: Setup devstack on sub-nodes
+  block:
+
+  - name: Sync CA data to subnodes (when any)
+    # Only do this if the tls-proxy service is defined and enabled
+    include_role:
+      name: sync-devstack-data
+    when: devstack_services['tls-proxy']|default(false)
+
+  - name: Run devstack on the sub-nodes
+    include_role:
+      name: run-devstack
+    when: inventory_hostname in groups['subnode']
+
+  - name: Discover hosts
+    # Discovers compute nodes (subnodes) and maps them to cells. Only run
+    # on the controller node.
+    # NOTE(mriedem): We want to remove this if/when nova supports
+    # auto-registration of computes with cells, but that's not happening in
+    # Ocata.
+    # NOTE(andreaf) This is taken (NOTE included) from the discover_hosts
+    # function in devstack gate. Since this is now in devstack, which is
+    # branched, we know that the discover_hosts tool exists.
+    become: true
+    become_user: stack
+    shell: ./tools/discover_hosts.sh
+    args:
+      chdir: "{{ devstack_base_dir }}/devstack"
+    when: inventory_hostname == 'controller'
+
+  when:
+    - '"controller" in hostvars'
+    - '"subnode" in groups'
diff --git a/roles/sync-devstack-data/README.rst b/roles/sync-devstack-data/README.rst
new file mode 100644
index 0000000000..500e8cccc4
--- /dev/null
+++ b/roles/sync-devstack-data/README.rst
@@ -0,0 +1,12 @@
+Sync devstack data for multinode configurations
+
+Sync any data files which include certificates to be used if TLS is enabled.
+This role must be executed on the controller and it pushes data to all
+subnodes.
+
+**Role Variables**
+
+.. zuul:rolevar:: devstack_base_dir
+   :default: /opt/stack
+
+   The devstack base directory.
diff --git a/roles/sync-devstack-data/defaults/main.yaml b/roles/sync-devstack-data/defaults/main.yaml
new file mode 100644
index 0000000000..fea05c8146
--- /dev/null
+++ b/roles/sync-devstack-data/defaults/main.yaml
@@ -0,0 +1 @@
+devstack_base_dir: /opt/stack
diff --git a/roles/sync-devstack-data/tasks/main.yaml b/roles/sync-devstack-data/tasks/main.yaml
new file mode 100644
index 0000000000..46000159d4
--- /dev/null
+++ b/roles/sync-devstack-data/tasks/main.yaml
@@ -0,0 +1,48 @@
+- name: Ensure the data folder exists
+  become: true
+  file:
+    path: "{{ devstack_base_dir }}/data"
+    state: directory
+    owner: stack
+    group: stack
+    mode: 0755
+  when: 'inventory_hostname in groups["subnode"]|default([])'
+
+- name: Ensure the CA folder exists
+  become: true
+  file:
+    path: "{{ devstack_base_dir }}/data/CA"
+    state: directory
+    owner: stack
+    group: stack
+    mode: 0755
+  when: 'inventory_hostname in groups["subnode"]|default([])'
+
+- name: Pull the CA certificate and folder
+  become: true
+  synchronize:
+    src: "{{ item }}"
+    dest: "{{ zuul.executor.work_root }}/{{ item | basename }}"
+    mode: pull
+  with_items:
+    - "{{ devstack_base_dir }}/data/ca-bundle.pem"
+    - "{{ devstack_base_dir }}/data/CA"
+  when: inventory_hostname == 'controller'
+
+- name: Push the CA certificate
+  become: true
+  become_user: stack
+  synchronize:
+    src: "{{ zuul.executor.work_root }}/ca-bundle.pem"
+    dest: "{{ devstack_base_dir }}/data/ca-bundle.pem"
+    mode: push
+  when: 'inventory_hostname in groups["subnode"]|default([])'
+
+- name: Push the CA folder
+  become: true
+  become_user: stack
+  synchronize:
+    src: "{{ zuul.executor.work_root }}/CA/"
+    dest: "{{ devstack_base_dir }}/data/"
+    mode: push
+  when: 'inventory_hostname in groups["subnode"]|default([])'

From 067e36582b8d1589c831524e921f396b270d4f44 Mon Sep 17 00:00:00 2001
From: Andrea Frittoli <andrea.frittoli@gmail.com>
Date: Fri, 23 Feb 2018 16:04:46 +0000
Subject: [PATCH 1295/2409] Document jobs

Add inline documentation to jobs and render it in the jobs doc page.
Adjust the roles page to match jobs for title and filename.

Change-Id: I47a2b4b379c8517b0dea59a75943f3f871c29046
---
 .zuul.yaml                | 19 +++++++++++++++++++
 doc/source/index.rst      |  3 ++-
 doc/source/roles.rst      |  4 ----
 doc/source/zuul_jobs.rst  |  4 ++++
 doc/source/zuul_roles.rst |  4 ++++
 5 files changed, 29 insertions(+), 5 deletions(-)
 delete mode 100644 doc/source/roles.rst
 create mode 100644 doc/source/zuul_jobs.rst
 create mode 100644 doc/source/zuul_roles.rst

diff --git a/.zuul.yaml b/.zuul.yaml
index 2ef23c89ff..693cd774b1 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -163,6 +163,25 @@
       Base devstack job for integration gate.
 
       This base job can be used for single node and multinode devstack jobs.
+
+      With a single node nodeset, this job sets up an "all-in-one" (aio)
+      devstack with the six OpenStack services included in the devstack tree:
+      keystone, glance, cinder, neutron, nova and swift.
+
+      With a two node nodeset, this job sets up an aio + compute node.
+      The controller can be customised using host-vars.controller, the
+      sub-nodes can be customised using group-vars.subnode.
+
+      Descendent jobs can enable / disable services, add devstack configuration
+      options, enable devstack plugins, configure log files or directories to be
+      transferred to the log server.
+
+      The job assumes that there is only one controller node. The number of
+      subnodes can be scaled up seamlessly by setting a custom nodeset in
+      job.nodeset.
+
+      The run playbook consists of a single role, so it can be easily rewritten
+      and extended.
     nodeset: openstack-single-node
     required-projects:
       - openstack/cinder
diff --git a/doc/source/index.rst b/doc/source/index.rst
index 9254c23cae..4c53203d97 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -139,7 +139,8 @@ up to date to the latest devstack).
 Enable :doc:`devstack plugins <plugins>` to support additional
 services, features, and configuration not present in base devstack.
 
-Use devstack in your CI with :doc:`Ansible roles <roles>` for Zuul V3.
+Use devstack in your CI with :doc:`Ansible roles <zuul_roles>` and
+:doc:`Jobs <zuul_jobs>` for Zuul V3.
 
 Get :doc:`the big picture <overview>` of what we are trying to do
 with devstack, and help us by :doc:`contributing to the project
diff --git a/doc/source/roles.rst b/doc/source/roles.rst
deleted file mode 100644
index 5baa1e4e82..0000000000
--- a/doc/source/roles.rst
+++ /dev/null
@@ -1,4 +0,0 @@
-Roles
-=====
-
-.. zuul:autoroles::
diff --git a/doc/source/zuul_jobs.rst b/doc/source/zuul_jobs.rst
new file mode 100644
index 0000000000..cf203a8973
--- /dev/null
+++ b/doc/source/zuul_jobs.rst
@@ -0,0 +1,4 @@
+Zuul CI Jobs
+============
+
+.. zuul:autojobs::
diff --git a/doc/source/zuul_roles.rst b/doc/source/zuul_roles.rst
new file mode 100644
index 0000000000..4939281057
--- /dev/null
+++ b/doc/source/zuul_roles.rst
@@ -0,0 +1,4 @@
+Zuul CI Roles
+=============
+
+.. zuul:autoroles::

From f32f3f5266fe9a88955129fb01a9284465b9e7e5 Mon Sep 17 00:00:00 2001
From: Andrea Frittoli <andrea.frittoli@gmail.com>
Date: Mon, 19 Feb 2018 21:45:22 +0000
Subject: [PATCH 1296/2409] Document v2 to v3 devstack job migration

Document how to map DEVSTACK_GATE flags into the zuul v3 ansible
world. This is just an initial structure, the idea is to document
most of the flags as well as provide example in-line and links to
finished jobs.

Change-Id: I377ebb529bcd8f4971906563c577e8cfc48b98e6
---
 doc/source/index.rst                  |   3 +-
 doc/source/zuul_ci_jobs_migration.rst | 301 ++++++++++++++++++++++++++
 2 files changed, 303 insertions(+), 1 deletion(-)
 create mode 100644 doc/source/zuul_ci_jobs_migration.rst

diff --git a/doc/source/index.rst b/doc/source/index.rst
index 4c53203d97..2ff4ff088a 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -140,7 +140,8 @@ Enable :doc:`devstack plugins <plugins>` to support additional
 services, features, and configuration not present in base devstack.
 
 Use devstack in your CI with :doc:`Ansible roles <zuul_roles>` and
-:doc:`Jobs <zuul_jobs>` for Zuul V3.
+:doc:`Jobs <zuul_jobs>` for Zuul V3. Migrate your devstack Zuul V2 jobs to Zuul
+V3 with this full migration :doc:`how-to <zuul_ci_jobs_migration>`.
 
 Get :doc:`the big picture <overview>` of what we are trying to do
 with devstack, and help us by :doc:`contributing to the project
diff --git a/doc/source/zuul_ci_jobs_migration.rst b/doc/source/zuul_ci_jobs_migration.rst
new file mode 100644
index 0000000000..c00f06e41a
--- /dev/null
+++ b/doc/source/zuul_ci_jobs_migration.rst
@@ -0,0 +1,301 @@
+===============================
+Migrating Zuul V2 CI jobs to V3
+===============================
+
+The OpenStack CI system moved from Zuul v2 to Zuul v3, and all CI jobs moved to
+the new CI system. All jobs have been migrated automatically to a format
+compatible with Zuul v3; the jobs produced in this way however are suboptimal
+and do not use the capabilities introduced by Zuul v3, which allow for re-use of
+job parts, in the form of Ansible roles, as well as inheritance between jobs.
+
+DevStack hosts a set of roles, plays and jobs that can be used by other
+repositories to define their DevStack based jobs. To benefit from them, jobs
+must be migrated from the legacy v2 ones into v3 native format.
+
+This document provides guidance and examples to make the migration process as
+painless and smooth as possible.
+
+Where to host the job definitions.
+==================================
+
+In Zuul V3 jobs can be defined in the repository that contains the code they
+excercise. If you are writing CI jobs for an OpenStack service you can define
+your DevStack based CI jobs in one of the repositories that host the code for
+your service. If you have a branchless repo, like a Tempest plugin, that is
+a convenient choice to host the job definitions since job changes do not have
+to be backported. For example, see the beginning of the ``.zuul.yaml`` from the
+sahara Tempest plugin repo:
+
+.. code:: yaml
+
+  # In http://git.openstack.org/cgit/openstack/sahara-tests/tree/.zuul.yaml:
+  - job:
+      name: sahara-tests-tempest
+      description: |
+        Run Tempest tests from the Sahara plugin.
+      parent: devstack-tempest
+
+Which base job to start from
+============================
+
+If your job needs an OpenStack cloud deployed via DevStack, but you don't plan
+on running Tempest tests, you can start from one of the base
+:doc:`jobs <zuul_jobs>` defined in the DevStack repo.
+
+The ``devstack`` job can be used for both single-node jobs and multi-node jobs,
+and it includes the list of services used in the integrated gate (keystone,
+glance, nova, cinder, neutron and swift). Different topologies can be achieved
+by switching the nodeset used in the child job.
+
+The ``devstack-base`` job is similar to ``devstack`` but it does not specify any
+required repo or service to be run in DevStack. It can be useful to setup
+children jobs that use a very narrow DevStack setup.
+
+If your job needs an OpenStack cloud deployed via DevStack, and you do plan
+on running Tempest tests, you can start from one of the base jobs defined in the
+Tempest repo.
+
+The ``devstack-tempest`` job can be used for both single-node jobs and
+multi-node jobs. Different topologies can be achieved by switching the nodeset
+used in the child job.
+
+Jobs can be customized as follows without writing any Ansible code:
+
+- add and/or remove DevStack services
+- add or modify DevStack and services configuration
+- install DevStack plugins
+- extend the number of sub-nodes (multinode only)
+- define extra log files and/or directories to be uploaded on logs.o.o
+- define extra log file extensions to be rewritten to .txt for ease of access
+
+Tempest jobs can be further customized as follows:
+
+- define the Tempest tox environment to be used
+- define the test concurrency
+- define the test regular expression
+
+Writing Ansible code, or importing existing custom roles, jobs can be further
+extended by:
+
+- adding pre and/or post playbooks
+- overriding the run playbook, add custom roles
+
+The (partial) example below extends a Tempest single node base job
+"devstack-tempest" in the Kuryr repository. The parent job name is defined in
+job.parent.
+
+.. code:: yaml
+
+  # https://git.openstack.org/cgit/openstack/kuryr-kubernetes/tree/.zuul.yaml:
+  - job:
+      name: kuryr-kubernetes-tempest-base
+      parent: devstack-tempest
+      description: Base kuryr-kubernetes-job
+      required-projects:
+        - openstack/devstack-plugin-container
+        - openstack/kuryr
+        - openstack/kuryr-kubernetes
+        - openstack/kuryr-tempest-plugin
+        - openstack/neutron-lbaas
+      vars:
+        tempest_test_regex: '^(kuryr_tempest_plugin.tests.)'
+        tox_envlist: 'all'
+        devstack_localrc:
+          KURYR_K8S_API_PORT: 8080
+          TEMPEST_PLUGINS: '/opt/stack/kuryr-tempest-plugin'
+        devstack_services:
+          kubernetes-api: true
+          kubernetes-controller-manager: true
+          kubernetes-scheduler: true
+          kubelet: true
+          kuryr-kubernetes: true
+          (...)
+        devstack_plugins:
+          kuryr-kubernetes: https://git.openstack.org/openstack/kuryr
+          devstack-plugin-container: https://git.openstack.org/openstack/devstack-plugin-container
+          neutron-lbaas: https://git.openstack.org/openstack/neutron-lbaas
+        (...)
+
+Job variables
+=============
+
+Variables can be added to the job in three different places:
+
+- job.vars: these are global variables available to all node in the nodeset
+- job.host-vars.[HOST]: these are variables available only to the specified HOST
+- job.group-vars.[GROUP]: these are variables available only to the specified
+  GROUP
+
+Zuul merges dict variables through job inheritance. Host and group variables
+override variables with the same name defined as global variables.
+
+In the example below, for the sundaes job, hosts that are not part of the
+subnode group will run vanilla and chocolate. Hosts in the subnode group will
+run stracciatella and strawberry.
+
+.. code:: yaml
+
+  - job:
+      name: ice-creams
+      vars:
+        devstack_service:
+          vanilla: true
+          chocolate: false
+      group-vars:
+        subnode:
+          devstack_service:
+            pistacchio: true
+            stracciatella: true
+
+  - job:
+      name: sundaes
+      parent: ice-creams
+      vars:
+        devstack_service:
+          chocolate: true
+      group-vars:
+        subnode:
+          devstack_service:
+            strawberry: true
+            pistacchio: false
+
+
+DevStack Gate Flags
+===================
+
+The old CI system worked using a combination of DevStack, Tempest and
+devstack-gate to setup a test environment and run tests against it. With Zuul
+V3, the logic that used to live in devstack-gate is moved into different repos,
+including DevStack, Tempest and grenade.
+
+DevStack-gate exposes an interface for job definition based on a number of
+DEVSTACK_GATE_* environment variables, or flags. This guide shows how to map
+DEVSTACK_GATE flags into the new
+system.
+
+The repo column indicates in which repository is hosted the code that replaces
+the devstack-gate flag. The new implementation column explains how to reproduce
+the same or a similar behaviour in Zuul v3 jobs. For localrc settings,
+devstack-gate defined a default value. In ansible jobs the default is either the
+value defined in the parent job, or the default from DevStack, if any.
+
+==============================================  ============= ==================
+DevStack gate flag                              Repo          New implementation
+==============================================  ============= ==================
+OVERRIDE_ZUUL_BRANCH                            zuul          override-checkout:
+                                                              [branch]
+                                                              in the job definition.
+DEVSTACK_GATE_NET_OVERLAY                       zuul-jobs     A bridge called
+                                                              br-infra is set up for
+                                                              all jobs that inherit
+                                                              from multinode with
+                                                              a dedicated `bridge role <https://docs.openstack.org/infra/zuul-jobs/roles.html#role-multi-node-bridge>`_.
+DEVSTACK_GATE_FEATURE_MATRIX                    devstack-gate ``test_matrix_features``
+                                                              variable of the
+                                                              test-matrix role in
+                                                              devstack-gate. This
+                                                              is a temporary
+                                                              solution, feature
+                                                              matrix will go away.
+                                                              In the future services
+                                                              will be defined in
+                                                              jobs only.
+DEVSTACK_CINDER_VOLUME_CLEAR                    devstack      *CINDER_VOLUME_CLEAR: true/false*
+                                                              in devstack_localrc
+                                                              in the job vars.
+DEVSTACK_GATE_NEUTRON                           devstack      True by default. To
+                                                              disable, disable all
+                                                              neutron services in
+                                                              devstack_services in
+                                                              the job definition.
+DEVSTACK_GATE_CONFIGDRIVE                       devstack      *FORCE_CONFIG_DRIVE: true/false*
+                                                              in devstack_localrc
+                                                              in the job vars.
+DEVSTACK_GATE_INSTALL_TESTONLY                  devstack      *INSTALL_TESTONLY_PACKAGES: true/false*
+                                                              in devstack_localrc
+                                                              in the job vars.
+DEVSTACK_GATE_VIRT_DRIVER                       devstack      *VIRT_DRIVER: [virt driver]*
+                                                              in devstack_localrc
+                                                              in the job vars.
+DEVSTACK_GATE_LIBVIRT_TYPE                      devstack      *LIBVIRT_TYPE: [libvirt type]*
+                                                              in devstack_localrc
+                                                              in the job vars.
+DEVSTACK_GATE_TEMPEST                           devstack      Defined by the job
+                                                tempest       that is used. The
+                                                              ``devstack`` job only
+                                                              runs devstack.
+                                                              The ``devstack-tempest``
+                                                              one triggers a Tempest
+                                                              run as well.
+DEVSTACK_GATE_TEMPEST_FULL                      tempest       *tox_envlist: full*
+                                                              in the job vars.
+DEVSTACK_GATE_TEMPEST_ALL                       tempest       *tox_envlist: all*
+                                                              in the job vars.
+DEVSTACK_GATE_TEMPEST_ALL_PLUGINS               tempest       *tox_envlist: all-plugin*
+                                                              in the job vars.
+DEVSTACK_GATE_TEMPEST_SCENARIOS                 tempest       *tox_envlist: scenario*
+                                                              in the job vars.
+TEMPEST_CONCURRENCY                             tempest       *tempest_concurrency: [value]*
+                                                              in the job vars. This
+                                                              is available only on
+                                                              jobs that inherit from
+                                                              ``devstack-tempest``
+                                                              down.
+DEVSTACK_GATE_TEMPEST_NOTESTS                   tempest       *tox_envlist: venv-tempest*
+                                                              in the job vars. This
+                                                              will create Tempest
+                                                              virtual environment
+                                                              but run no tests.
+DEVSTACK_GATE_SMOKE_SERIAL                      tempest       *tox_envlist: smoke-serial*
+                                                              in the job vars.
+DEVSTACK_GATE_TEMPEST_DISABLE_TENANT_ISOLATION  tempest       *tox_envlist: full-serial*
+                                                              in the job vars.
+                                                              *TEMPEST_ALLOW_TENANT_ISOLATION: false*
+                                                              in devstack_localrc in
+                                                              the job vars.
+==============================================  ============= ==================
+
+The following flags have not been migrated yet or are legacy and won't be
+migrated at all.
+
+=====================================  ======  ==========================
+DevStack gate flag                     Status  Details
+=====================================  ======  ==========================
+DEVSTACK_GATE_TOPOLOGY                 WIP     The topology depends on the base
+                                               job that is used and more
+                                               specifically on the nodeset
+                                               attached to it. The new job
+                                               format allows project to define
+                                               the variables to be passed to
+                                               every node/node-group that exists
+                                               in the topology. Named topologies
+                                               that include the nodeset and the
+                                               matching variables can be defined
+                                               in the form of base jobs.
+DEVSTACK_GATE_GRENADE                  TBD     Grenade Zuul V3 jobs will be
+                                               hosted in the grenade repo.
+GRENADE_BASE_BRANCH                    TBD     Grenade Zuul V3 jobs will be
+                                               hosted in the grenade repo.
+DEVSTACK_GATE_NEUTRON_DVR              TBD     Depends on multinode support.
+DEVSTACK_GATE_EXERCISES                TBD     Can be done on request.
+DEVSTACK_GATE_IRONIC                   TBD     This will probably be implemented
+                                               on ironic side.
+DEVSTACK_GATE_IRONIC_DRIVER            TBD     This will probably be implemented
+                                               on ironic side.
+DEVSTACK_GATE_IRONIC_BUILD_RAMDISK     TBD     This will probably be implemented
+                                               on ironic side.
+DEVSTACK_GATE_POSTGRES                 Legacy  This flag exists in d-g but the
+                                               only thing that it does is
+                                               capture postgres logs. This is
+                                               already supported by the roles in
+                                               post, so the flag is useless in
+                                               the new jobs. postgres itself can
+                                               be enabled via the
+                                               devstack_service job variable.
+DEVSTACK_GATE_ZEROMQ                   Legacy  This has no effect in d-g.
+DEVSTACK_GATE_MQ_DRIVER                Legacy  This has no effect in d-g.
+DEVSTACK_GATE_TEMPEST_STRESS_ARGS      Legacy  Stress is not in Tempest anymore.
+DEVSTACK_GATE_TEMPEST_HEAT_SLOW        Legacy  This is not used anywhere.
+DEVSTACK_GATE_CELLS                    Legacy  This has no effect in d-g.
+DEVSTACK_GATE_NOVA_API_METADATA_SPLIT  Legacy  This has no effect in d-g.
+=====================================  ======  ==========================

From dc7b4294632172d0b743f98448942fe260a8a3ff Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Tue, 19 Sep 2017 10:52:32 +0000
Subject: [PATCH 1297/2409] Fix running with SERVICE_IP_VERSION=6

- There are some locations where we need the raw IPv6 address instead of the
  url-quoted version enclosed in brackets.
- Make nova-api-metadata service listen on IPv6 when we need that.
- Use SERVICE_HOST instead of HOST_IP for TLS_IP.

Change-Id: Id074be38ee95754e88b7219de7d9beb06f796fad
Partial-Bug: 1656329
---
 functions-common    |  5 +++++
 lib/cinder          |  2 +-
 lib/databases/mysql |  2 +-
 lib/glance          |  6 +++---
 lib/neutron-legacy  |  4 ++--
 lib/nova            |  4 ++--
 lib/swift           |  2 +-
 lib/tls             | 12 ++++--------
 stackrc             |  4 ++--
 9 files changed, 21 insertions(+), 20 deletions(-)

diff --git a/functions-common b/functions-common
index df295a3395..5f933d67cf 100644
--- a/functions-common
+++ b/functions-common
@@ -2049,6 +2049,11 @@ function is_ipv4_address {
     fi
 }
 
+# Remove "[]" around urlquoted IPv6 addresses
+function ipv6_unquote {
+    echo $1 | tr -d []
+}
+
 # Gracefully cp only if source file/dir exists
 # cp_it source destination
 function cp_it {
diff --git a/lib/cinder b/lib/cinder
index c0356fe09c..4d6085fe48 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -67,7 +67,7 @@ CINDER_SERVICE_HOST=${CINDER_SERVICE_HOST:-$SERVICE_HOST}
 CINDER_SERVICE_PORT=${CINDER_SERVICE_PORT:-8776}
 CINDER_SERVICE_PORT_INT=${CINDER_SERVICE_PORT_INT:-18776}
 CINDER_SERVICE_PROTOCOL=${CINDER_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
-CINDER_SERVICE_LISTEN_ADDRESS=${CINDER_SERVICE_LISTEN_ADDRESS:-$SERVICE_LISTEN_ADDRESS}
+CINDER_SERVICE_LISTEN_ADDRESS=${CINDER_SERVICE_LISTEN_ADDRESS:-$(ipv6_unquote $SERVICE_LISTEN_ADDRESS)}
 
 # What type of LVM device should Cinder use for LVM backend
 # Defaults to auto, which will do thin provisioning if it's a fresh
diff --git a/lib/databases/mysql b/lib/databases/mysql
index 0089663285..cf61056389 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -93,7 +93,7 @@ function configure_database_mysql {
 
     # Change bind-address from localhost (127.0.0.1) to any (::) and
     # set default db type to InnoDB
-    iniset -sudo $my_conf mysqld bind-address "$SERVICE_LISTEN_ADDRESS"
+    iniset -sudo $my_conf mysqld bind-address "$(ipv6_unquote $SERVICE_LISTEN_ADDRESS)"
     iniset -sudo $my_conf mysqld sql_mode TRADITIONAL
     iniset -sudo $my_conf mysqld default-storage-engine InnoDB
     iniset -sudo $my_conf mysqld max_connections 1024
diff --git a/lib/glance b/lib/glance
index 95d2450da7..4a3e25e9a2 100644
--- a/lib/glance
+++ b/lib/glance
@@ -65,7 +65,7 @@ fi
 
 # Glance connection info.  Note the port must be specified.
 GLANCE_SERVICE_HOST=${GLANCE_SERVICE_HOST:-$SERVICE_HOST}
-GLANCE_SERVICE_LISTEN_ADDRESS=${GLANCE_SERVICE_LISTEN_ADDRESS:-$SERVICE_LISTEN_ADDRESS}
+GLANCE_SERVICE_LISTEN_ADDRESS=${GLANCE_SERVICE_LISTEN_ADDRESS:-$(ipv6_unquote $SERVICE_LISTEN_ADDRESS)}
 GLANCE_SERVICE_PORT=${GLANCE_SERVICE_PORT:-9292}
 GLANCE_SERVICE_PORT_INT=${GLANCE_SERVICE_PORT_INT:-19292}
 GLANCE_HOSTPORT=${GLANCE_HOSTPORT:-$GLANCE_SERVICE_HOST:$GLANCE_SERVICE_PORT}
@@ -152,7 +152,7 @@ function configure_glance {
 
     # Store specific configs
     iniset $GLANCE_API_CONF glance_store filesystem_store_datadir $GLANCE_IMAGE_DIR/
-    iniset $GLANCE_API_CONF DEFAULT registry_host $GLANCE_SERVICE_HOST
+    iniset $GLANCE_API_CONF DEFAULT registry_host $(ipv6_unquote $GLANCE_SERVICE_HOST)
 
     # CORS feature support - to allow calls from Horizon by default
     if [ -n "$GLANCE_CORS_ALLOWED_ORIGIN" ]; then
@@ -228,7 +228,7 @@ function configure_glance {
     iniset $GLANCE_CACHE_CONF DEFAULT admin_user glance
     iniuncomment $GLANCE_CACHE_CONF DEFAULT auth_password
     iniset $GLANCE_CACHE_CONF DEFAULT admin_password $SERVICE_PASSWORD
-    iniset $GLANCE_CACHE_CONF DEFAULT registry_host $GLANCE_SERVICE_HOST
+    iniset $GLANCE_CACHE_CONF DEFAULT registry_host $(ipv6_unquote $GLANCE_SERVICE_HOST)
 
     # Store specific confs
     iniset $GLANCE_CACHE_CONF glance_store filesystem_store_datadir $GLANCE_IMAGE_DIR/
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 9701ee7632..3c6ec68b67 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -111,7 +111,7 @@ Q_HOST=${Q_HOST:-$SERVICE_HOST}
 # Default protocol
 Q_PROTOCOL=${Q_PROTOCOL:-$SERVICE_PROTOCOL}
 # Default listen address
-Q_LISTEN_ADDRESS=${Q_LISTEN_ADDRESS:-$SERVICE_LISTEN_ADDRESS}
+Q_LISTEN_ADDRESS=${Q_LISTEN_ADDRESS:-$(ipv6_unquote $SERVICE_LISTEN_ADDRESS)}
 # Default admin username
 Q_ADMIN_USERNAME=${Q_ADMIN_USERNAME:-neutron}
 # Default auth strategy
@@ -121,7 +121,7 @@ Q_OVS_USE_VETH=${Q_OVS_USE_VETH:-False}
 Q_USE_ROOTWRAP=${Q_USE_ROOTWRAP:-True}
 Q_USE_ROOTWRAP_DAEMON=$(trueorfalse True Q_USE_ROOTWRAP_DAEMON)
 # Meta data IP
-Q_META_DATA_IP=${Q_META_DATA_IP:-$SERVICE_HOST}
+Q_META_DATA_IP=${Q_META_DATA_IP:-$(ipv6_unquote $SERVICE_HOST)}
 # Allow Overlapping IP among subnets
 Q_ALLOW_OVERLAPPING_IP=${Q_ALLOW_OVERLAPPING_IP:-True}
 Q_NOTIFY_NOVA_PORT_STATUS_CHANGES=${Q_NOTIFY_NOVA_PORT_STATUS_CHANGES:-True}
diff --git a/lib/nova b/lib/nova
index 580f87f277..da07579b74 100644
--- a/lib/nova
+++ b/lib/nova
@@ -92,7 +92,7 @@ NOVA_SERVICE_PORT=${NOVA_SERVICE_PORT:-8774}
 NOVA_SERVICE_PORT_INT=${NOVA_SERVICE_PORT_INT:-18774}
 NOVA_SERVICE_PROTOCOL=${NOVA_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 NOVA_SERVICE_LOCAL_HOST=${NOVA_SERVICE_LOCAL_HOST:-$SERVICE_LOCAL_HOST}
-NOVA_SERVICE_LISTEN_ADDRESS=${NOVA_SERVICE_LISTEN_ADDRESS:-$SERVICE_LISTEN_ADDRESS}
+NOVA_SERVICE_LISTEN_ADDRESS=${NOVA_SERVICE_LISTEN_ADDRESS:-$(ipv6_unquote $SERVICE_LISTEN_ADDRESS)}
 METADATA_SERVICE_PORT=${METADATA_SERVICE_PORT:-8775}
 
 # Option to enable/disable config drive
@@ -507,7 +507,7 @@ function create_nova_conf {
     setup_logging $NOVA_CONF
 
     write_uwsgi_config "$NOVA_UWSGI_CONF" "$NOVA_UWSGI" "/compute"
-    write_uwsgi_config "$NOVA_METADATA_UWSGI_CONF" "$NOVA_METADATA_UWSGI" "" ":${METADATA_SERVICE_PORT}"
+    write_uwsgi_config "$NOVA_METADATA_UWSGI_CONF" "$NOVA_METADATA_UWSGI" "" "$SERVICE_LISTEN_ADDRESS:${METADATA_SERVICE_PORT}"
 
     if is_service_enabled ceilometer; then
         iniset $NOVA_CONF DEFAULT instance_usage_audit "True"
diff --git a/lib/swift b/lib/swift
index 1187846dfc..62b8a32fed 100644
--- a/lib/swift
+++ b/lib/swift
@@ -56,7 +56,7 @@ SWIFT_SERVICE_PROTOCOL=${SWIFT_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 SWIFT_DEFAULT_BIND_PORT=${SWIFT_DEFAULT_BIND_PORT:-8080}
 SWIFT_DEFAULT_BIND_PORT_INT=${SWIFT_DEFAULT_BIND_PORT_INT:-8081}
 SWIFT_SERVICE_LOCAL_HOST=${SWIFT_SERVICE_LOCAL_HOST:-$SERVICE_LOCAL_HOST}
-SWIFT_SERVICE_LISTEN_ADDRESS=${SWIFT_SERVICE_LISTEN_ADDRESS:-$SERVICE_LISTEN_ADDRESS}
+SWIFT_SERVICE_LISTEN_ADDRESS=${SWIFT_SERVICE_LISTEN_ADDRESS:-$(ipv6_unquote $SERVICE_LISTEN_ADDRESS)}
 
 # TODO: add logging to different location.
 
diff --git a/lib/tls b/lib/tls
index a72b7084d0..e3ed3cc2ac 100644
--- a/lib/tls
+++ b/lib/tls
@@ -37,7 +37,7 @@
 
 if is_service_enabled tls-proxy; then
     # TODO(dtroyer): revisit this below after the search for HOST_IP has been done
-    TLS_IP=${TLS_IP:-$SERVICE_IP}
+    TLS_IP=${TLS_IP:-$(ipv6_unquote $SERVICE_HOST)}
 fi
 
 DEVSTACK_HOSTNAME=$(hostname -f)
@@ -67,9 +67,9 @@ function configure_CA {
     # build common config file
 
     # Verify ``TLS_IP`` is good
-    if [[ -n "$HOST_IP" && "$HOST_IP" != "$TLS_IP" ]]; then
+    if [[ -n "$SERVICE_HOST" && "$(ipv6_unquote $SERVICE_HOST)" != "$TLS_IP" ]]; then
         # auto-discover has changed the IP
-        TLS_IP=$HOST_IP
+        TLS_IP=$(ipv6_unquote $SERVICE_HOST)
     fi
 }
 
@@ -228,6 +228,7 @@ function init_cert {
     if [[ ! -r $DEVSTACK_CERT ]]; then
         if [[ -n "$TLS_IP" ]]; then
             # Lie to let incomplete match routines work
+            # see https://bugs.python.org/issue23239
             TLS_IP="DNS:$TLS_IP,IP:$TLS_IP"
         fi
         make_cert $INT_CA_DIR $DEVSTACK_CERT_NAME $DEVSTACK_HOSTNAME "$TLS_IP"
@@ -246,11 +247,6 @@ function make_cert {
     local alt_names=$4
 
     if [ "$common_name" != "$SERVICE_HOST" ]; then
-        if [[ -z "$alt_names" ]]; then
-            alt_names="DNS:$SERVICE_HOST"
-        else
-            alt_names="$alt_names,DNS:$SERVICE_HOST"
-        fi
         if is_ipv4_address "$SERVICE_HOST" ; then
             alt_names="$alt_names,IP:$SERVICE_HOST"
         fi
diff --git a/stackrc b/stackrc
index 59442529f4..0b49fbca57 100644
--- a/stackrc
+++ b/stackrc
@@ -894,10 +894,10 @@ if [[ "$SERVICE_IP_VERSION" == 6 ]]; then
 
     DEF_SERVICE_HOST=[$HOST_IPV6]
     DEF_SERVICE_LOCAL_HOST=::1
-    DEF_SERVICE_LISTEN_ADDRESS=::
+    DEF_SERVICE_LISTEN_ADDRESS="[::]"
 fi
 
-# This is either 0.0.0.0 for IPv4 or :: for IPv6
+# This is either 0.0.0.0 for IPv4 or [::] for IPv6
 SERVICE_LISTEN_ADDRESS=${SERVICE_LISTEN_ADDRESS:-${DEF_SERVICE_LISTEN_ADDRESS}}
 
 # Allow the use of an alternate hostname (such as localhost/127.0.0.1) for

From 02bb57bfefbe3658b570060a9eb084377dddaddd Mon Sep 17 00:00:00 2001
From: Andrea Frittoli <andrea.frittoli@gmail.com>
Date: Fri, 9 Mar 2018 17:12:38 +0000
Subject: [PATCH 1298/2409] Enforce linear strategy for orchestrate-devstack

Document that orchestrate-devstack requires a linear strategy in the
invoking play. Also enforce the strategy in devstack.yaml.

Change-Id: Ia081225ec2be959fc5a4ddfd491f526296a8ca10
---
 playbooks/devstack.yaml               | 4 ++++
 roles/orchestrate-devstack/README.rst | 1 +
 2 files changed, 5 insertions(+)

diff --git a/playbooks/devstack.yaml b/playbooks/devstack.yaml
index 93d19f1c7a..d0906380ab 100644
--- a/playbooks/devstack.yaml
+++ b/playbooks/devstack.yaml
@@ -1,3 +1,7 @@
 - hosts: all
+  # This is the default strategy, however since orchestrate-devstack requires
+  # "linear", it is safer to enforce it in case this is running in an
+  # environment configured with a different default strategy.
+  strategy: linear
   roles:
     - orchestrate-devstack
diff --git a/roles/orchestrate-devstack/README.rst b/roles/orchestrate-devstack/README.rst
index 7803ee4d74..097dcea55e 100644
--- a/roles/orchestrate-devstack/README.rst
+++ b/roles/orchestrate-devstack/README.rst
@@ -15,6 +15,7 @@ data to sub-nodes and run devstack there. The only requirement for
 this role is for the controller inventory_hostname to be "controller"
 and for all sub-nodes to be defined in a group called "subnode".
 
+This role needs to be invoked from a playbook that uses a "linear" strategy.
 
 **Role Variables**
 

From 4404f680f2447912dcdbcecde14339bc6d1f5175 Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Fri, 2 Mar 2018 00:37:58 +0100
Subject: [PATCH 1299/2409] Add an openSUSE Tumbleweed devstack non-voting
 check job

This adds the necessary fixes to pass a devstack run
on openSUSE Tumbleweed. Also removes opensuse 42.2 as it
is EOL for some time already and no longer actively tested
in the OpenStack infra.

Depends-On: I1b68c08c07cf6653ea58506f738cbe0054b38f3a
Change-Id: I2894482deef063fd02b0818c695a2ddbf6767039
---
 .zuul.yaml           | 20 +++++++++++++++++++-
 functions-common     |  3 +++
 lib/rpc_backend      | 15 ++++++++++++++-
 lib/swift            |  6 +++++-
 stack.sh             |  2 +-
 tools/install_pip.sh |  4 ++--
 6 files changed, 44 insertions(+), 6 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 25bd757ab3..ebe5a78ca5 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -28,6 +28,16 @@
         nodes:
           - controller
 
+- nodeset:
+    name: devstack-single-node-opensuse-tumbleweed
+    nodes:
+      - name: controller
+        label: opensuse-tumbleweed
+    groups:
+      - name: tempest
+        nodes:
+          - controller
+
 - nodeset:
     name: devstack-single-node-fedora-27
     nodes:
@@ -238,10 +248,17 @@
 - job:
     name: devstack-platform-opensuse-423
     parent: tempest-full
-    description: OpenSuSE 43.2 platform test
+    description: openSUSE 43.2 platform test
     nodeset: devstack-single-node-opensuse-423
     voting: false
 
+- job:
+    name: devstack-platform-opensuse-tumbleweed
+    parent: tempest-full
+    description: openSUSE Tumbleweed platform test
+    nodeset: devstack-single-node-opensuse-tumbleweed
+    voting: false
+
 - job:
     name: devstack-platform-fedora-27
     parent: tempest-full
@@ -318,6 +335,7 @@
         - devstack
         - devstack-platform-centos-7
         - devstack-platform-opensuse-423
+        - devstack-platform-opensuse-tumbleweed
         - devstack-platform-fedora-27
         - devstack-multinode
         - devstack-unit-tests
diff --git a/functions-common b/functions-common
index df295a3395..279cfcfdd8 100644
--- a/functions-common
+++ b/functions-common
@@ -373,6 +373,9 @@ function GetDistro {
         DISTRO="f$os_RELEASE"
     elif [[ "$os_VENDOR" =~ (openSUSE) ]]; then
         DISTRO="opensuse-$os_RELEASE"
+        # Tumbleweed uses "n/a" as a codename, and the release is a datestring
+        # like 20180218, so not very useful.
+        [ "$os_CODENAME" = "n/a" ] && DISTRO="opensuse-tumbleweed"
     elif [[ "$os_VENDOR" =~ (SUSE LINUX) ]]; then
         # just use major release
         DISTRO="sle${os_RELEASE%.*}"
diff --git a/lib/rpc_backend b/lib/rpc_backend
index 44d0717116..1c7c82fcd3 100644
--- a/lib/rpc_backend
+++ b/lib/rpc_backend
@@ -52,7 +52,20 @@ function install_rpc_backend {
     if is_service_enabled rabbit; then
         # Install rabbitmq-server
         install_package rabbitmq-server
-        if is_fedora; then
+        if is_suse; then
+            install_package rabbitmq-server-plugins
+            # the default systemd socket activation only listens on the loopback interface
+            # which causes rabbitmq to try to start its own epmd
+            sudo mkdir -p /etc/systemd/system/epmd.socket.d
+            cat <<EOF | sudo tee /etc/systemd/system/epmd.socket.d/ports.conf >/dev/null
+[Socket]
+ListenStream=
+ListenStream=[::]:4369
+EOF
+            sudo systemctl daemon-reload
+            sudo systemctl restart epmd.socket epmd.service
+        fi
+        if is_fedora || is_suse; then
             sudo systemctl enable rabbitmq-server
         fi
     fi
diff --git a/lib/swift b/lib/swift
index 1187846dfc..6cda9c84b2 100644
--- a/lib/swift
+++ b/lib/swift
@@ -557,7 +557,11 @@ EOF
 
     local swift_log_dir=${SWIFT_DATA_DIR}/logs
     sudo rm -rf ${swift_log_dir}
-    sudo install -d -o ${STACK_USER} -g adm ${swift_log_dir}/hourly
+    local swift_log_group=adm
+    if is_suse; then
+        swift_log_group=root
+    fi
+    sudo install -d -o ${STACK_USER} -g ${swift_log_group} ${swift_log_dir}/hourly
 
     if [[ $SYSLOG != "False" ]]; then
         sed "s,%SWIFT_LOGDIR%,${swift_log_dir}," $FILES/swift/rsyslog.conf | sudo \
diff --git a/stack.sh b/stack.sh
index ba546c0ab1..caef76e18a 100755
--- a/stack.sh
+++ b/stack.sh
@@ -221,7 +221,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (xenial|zesty|artful|stretch|jessie|f25|f26|f27|opensuse-42.2|opensuse-42.3|rhel7) ]]; then
+if [[ ! ${DISTRO} =~ (xenial|zesty|artful|stretch|jessie|f25|f26|f27|opensuse-42.3|opensuse-tumbleweed|rhel7) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"
diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index dbe52782a4..1bd7392b9d 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -129,10 +129,10 @@ get_versions
 
 # Eradicate any and all system packages
 
-# Python in fedora depends on the python-pip package so removing it
+# Python in fedora/suse depends on the python-pip package so removing it
 # results in a nonfunctional system. pip on fedora installs to /usr so pip
 # can safely override the system pip for all versions of fedora
-if ! is_fedora ; then
+if ! is_fedora  && ! is_suse; then
     uninstall_package python-pip
     uninstall_package python3-pip
 fi

From 1c9f1bf41435dc79234c5fef33b144453d423bd5 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Mon, 12 Mar 2018 06:14:09 +0000
Subject: [PATCH 1300/2409] Updated from generate-devstack-plugins-list

Change-Id: I5147dda76b476a6d3caf977077f41f904b304059
---
 doc/source/plugin-registry.rst | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 591e226645..04b7698fbd 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -31,12 +31,12 @@ barbican                               `git://git.openstack.org/openstack/barbic
 bilean                                 `git://git.openstack.org/openstack/bilean <https://git.openstack.org/cgit/openstack/bilean>`__
 blazar                                 `git://git.openstack.org/openstack/blazar <https://git.openstack.org/cgit/openstack/blazar>`__
 broadview-collector                    `git://git.openstack.org/openstack/broadview-collector <https://git.openstack.org/cgit/openstack/broadview-collector>`__
+castellan-ui                           `git://git.openstack.org/openstack/castellan-ui <https://git.openstack.org/cgit/openstack/castellan-ui>`__
 ceilometer                             `git://git.openstack.org/openstack/ceilometer <https://git.openstack.org/cgit/openstack/ceilometer>`__
 ceilometer-powervm                     `git://git.openstack.org/openstack/ceilometer-powervm <https://git.openstack.org/cgit/openstack/ceilometer-powervm>`__
 cloudkitty                             `git://git.openstack.org/openstack/cloudkitty <https://git.openstack.org/cgit/openstack/cloudkitty>`__
 collectd-ceilometer-plugin             `git://git.openstack.org/openstack/collectd-ceilometer-plugin <https://git.openstack.org/cgit/openstack/collectd-ceilometer-plugin>`__
 congress                               `git://git.openstack.org/openstack/congress <https://git.openstack.org/cgit/openstack/congress>`__
-cue                                    `git://git.openstack.org/openstack/cue <https://git.openstack.org/cgit/openstack/cue>`__
 cyborg                                 `git://git.openstack.org/openstack/cyborg <https://git.openstack.org/cgit/openstack/cyborg>`__
 designate                              `git://git.openstack.org/openstack/designate <https://git.openstack.org/cgit/openstack/designate>`__
 devstack-plugin-additional-pkg-repos   `git://git.openstack.org/openstack/devstack-plugin-additional-pkg-repos <https://git.openstack.org/cgit/openstack/devstack-plugin-additional-pkg-repos>`__
@@ -71,7 +71,6 @@ ironic                                 `git://git.openstack.org/openstack/ironic
 ironic-inspector                       `git://git.openstack.org/openstack/ironic-inspector <https://git.openstack.org/cgit/openstack/ironic-inspector>`__
 ironic-staging-drivers                 `git://git.openstack.org/openstack/ironic-staging-drivers <https://git.openstack.org/cgit/openstack/ironic-staging-drivers>`__
 ironic-ui                              `git://git.openstack.org/openstack/ironic-ui <https://git.openstack.org/cgit/openstack/ironic-ui>`__
-k8s-cloud-provider                     `git://git.openstack.org/openstack/k8s-cloud-provider <https://git.openstack.org/cgit/openstack/k8s-cloud-provider>`__
 karbor                                 `git://git.openstack.org/openstack/karbor <https://git.openstack.org/cgit/openstack/karbor>`__
 karbor-dashboard                       `git://git.openstack.org/openstack/karbor-dashboard <https://git.openstack.org/cgit/openstack/karbor-dashboard>`__
 keystone                               `git://git.openstack.org/openstack/keystone <https://git.openstack.org/cgit/openstack/keystone>`__

From db5a5b3c20b4dfeb2325594e700adb3b98d7d8fd Mon Sep 17 00:00:00 2001
From: Sam Betts <sam@code-smash.net>
Date: Mon, 12 Mar 2018 10:34:01 +0000
Subject: [PATCH 1301/2409] Remove use of git -C option from tempest venv
 creation

The -C option is not available in git versions older than "1.8.5" which
are still shipped by several distributions including centos 7.

Due to this incompatibility the patch has broken third party CI for
Cisco on Ironic.

Change-Id: I09a6f83f8b2fee870e6e1c50cbfdf2da4d70dfb2
---
 lib/tempest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index ab1d63980b..f60b477c72 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -556,7 +556,7 @@ function configure_tempest {
     fi
 
     # The requirements might be on a different branch, while tempest needs master requirements.
-    git -C $REQUIREMENTS_DIR show master:upper-constraints.txt > u-c-m.txt
+    (cd $REQUIREMENTS_DIR && git show master:upper-constraints.txt) > u-c-m.txt
     tox -evenv-tempest -- pip install -c u-c-m.txt -r requirements.txt
 
     # Auth:

From dc78ef8880b65f56abb0e0c2b80c25d9a0a495e1 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Mon, 12 Mar 2018 14:48:53 +0000
Subject: [PATCH 1302/2409] Save rc from stack.sh in run-devstack role

Avoid overriding the failure state of stack.sh by the trailing echo
command.

Change-Id: I74820709edc98f67ff1a0c620ce5db3a3571b7f5
---
 roles/run-devstack/tasks/main.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/roles/run-devstack/tasks/main.yaml b/roles/run-devstack/tasks/main.yaml
index 1ff82950e4..f58b31d477 100644
--- a/roles/run-devstack/tasks/main.yaml
+++ b/roles/run-devstack/tasks/main.yaml
@@ -2,7 +2,9 @@
   shell:
     cmd: |
       ./stack.sh 2>&1
+      rc=$?
       echo "*** FINISHED ***"
+      exit $rc
   args:
     chdir: "{{devstack_base_dir}}/devstack"
   become: true

From c81947a37d06fa07a53a891750e4864b89622e58 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <sfinucan@redhat.com>
Date: Tue, 23 Jan 2018 09:30:31 +0000
Subject: [PATCH 1303/2409] Remove remnants of SCREEN_LOGDIR

These appear to have been missed in commit 'cdba1b371'.

Change-Id: Ibb7fd7a0d54750c16360dfceb8e6b024ed8f504e
---
 clean.sh | 3 ---
 stackrc  | 1 -
 2 files changed, 4 deletions(-)

diff --git a/clean.sh b/clean.sh
index 2333596c1f..a29ebd94f0 100755
--- a/clean.sh
+++ b/clean.sh
@@ -122,9 +122,6 @@ fi
 if [[ -n "$LOGDIR" ]] && [[ -d "$LOGDIR" ]]; then
     sudo rm -rf $LOGDIR
 fi
-if [[ -n "$SCREEN_LOGDIR" ]] && [[ -d "$SCREEN_LOGDIR" ]]; then
-    sudo rm -rf $SCREEN_LOGDIR
-fi
 
 # Clean out the sytemd user unit files if systemd was used.
 if [[ "$USE_SYSTEMD" = "True" ]]; then
diff --git a/stackrc b/stackrc
index 59442529f4..e8c35f423e 100644
--- a/stackrc
+++ b/stackrc
@@ -949,7 +949,6 @@ if [[ -z "${LOGDIR:-}" ]]; then
 fi
 
 # ``LOGDIR`` is always set at this point so it is not useful as a 'enable' for service logs
-# ``SCREEN_LOGDIR`` may be set, it is useful to enable the compat symlinks
 
 # System-wide ulimit file descriptors override
 ULIMIT_NOFILE=${ULIMIT_NOFILE:-2048}

From 165199eebdef5d43bdc34683bdad9054f8c897d0 Mon Sep 17 00:00:00 2001
From: Ivan Kolodyazhny <e0ne@e0ne.info>
Date: Mon, 6 Nov 2017 18:17:39 +0200
Subject: [PATCH 1304/2409] Remove default value for Cinder Auth Strategy

Cinder supports both noauth and keystone auth mode. So now we can
configure this value via local.conf:

[[post-config|$CINDER_CONF]]
[DEFAULT]
auth_strategy = noauth

Change-Id: I1e434362117ab30dae71a8f3a80bc139e78f51bc
---
 lib/cinder | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 655908c2e4..b67fe261be 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -227,7 +227,6 @@ function configure_cinder {
 
     configure_auth_token_middleware $CINDER_CONF cinder $CINDER_AUTH_CACHE_DIR
 
-    iniset $CINDER_CONF DEFAULT auth_strategy keystone
     iniset $CINDER_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
 
     iniset $CINDER_CONF DEFAULT iscsi_helper "$CINDER_ISCSI_HELPER"
@@ -529,7 +528,17 @@ function create_volume_types {
         local be be_name
         for be in ${CINDER_ENABLED_BACKENDS//,/ }; do
             be_name=${be##*:}
-            openstack --os-region-name="$REGION_NAME" volume type create --property volume_backend_name="${be_name}" ${be_name}
+            # NOTE (e0ne): openstack client doesn't work with cinder in noauth mode
+            if is_service_enabled keystone; then
+                openstack --os-region-name="$REGION_NAME" volume type create --property volume_backend_name="${be_name}" ${be_name}
+            else
+                # TODO (e0ne): use openstack client once it will support cinder in noauth mode:
+                # https://bugs.launchpad.net/python-cinderclient/+bug/1755279
+                local cinder_url
+                cinder_url=$CINDER_SERVICE_PROTOCOL://$SERVICE_HOST:$CINDER_SERVICE_PORT/v3
+                OS_USER_ID=$OS_USERNAME OS_PROJECT_ID=$OS_PROJECT_NAME cinder --os-auth-type noauth --os-endpoint=$cinder_url type-create ${be_name}
+                OS_USER_ID=$OS_USERNAME OS_PROJECT_ID=$OS_PROJECT_NAME cinder --os-auth-type noauth --os-endpoint=$cinder_url type-key ${be_name} set volume_backend_name=${be_name}
+            fi
         done
     fi
 }

From e6faf84ec347470b32362098e69fe2b1844d3fed Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Tue, 13 Mar 2018 12:21:34 +0000
Subject: [PATCH 1305/2409] Revert to using neutron-legacy based services

The patch to remove the use of the test-matrix [0] also switched from
using the neutron-legacy based service names (q-*) to the new neutron-*
names. However it turns out that the new implementation is not yet working
properly for most neutron-consuming projects, so we switch back to the
previous situation for now.

[0] https://review.openstack.org/546765

Change-Id: Id6de87211d6c4ea8fd14aa9203d8d5b17e9e2f04
---
 .zuul.yaml | 20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 5fda6b155b..4636b8cd81 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -280,12 +280,20 @@
         n-sch: true
         placement-api: true
         # Neutron services
-        neutron-api: true
-        neutron-agent: true
-        neutron-dhcp: true
-        neutron-l3: true
-        neutron-metadata-agent: true
-        neutron-metering: true
+        # We need to keep using the neutron-legacy based services for
+        # now until all issues with the new lib/neutron code are solved
+        q-agt: true
+        q-dhcp: true
+        q-l3: true
+        q-meta: true
+        q-metering: true
+        q-svc: true
+        # neutron-api: true
+        # neutron-agent: true
+        # neutron-dhcp: true
+        # neutron-l3: true
+        # neutron-metadata-agent: true
+        # neutron-metering: true
         # Swift services
         s-account: true
         s-container: true

From cb1448495b3c8ea63febeeda862040447839f716 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Tue, 6 Mar 2018 19:22:59 +0000
Subject: [PATCH 1306/2409] Add bionic as supported distro

Add the upcoming release Ubuntu 18.04 Bionic Beaver to the list of
supported distros. Drop the now unsupported 17.04 (zesty) instead.

Change-Id: Iea0b4bfdc510797f7886fac96eff6fdfb730252d
---
 stack.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index badc1a1047..ce6e6fe83d 100755
--- a/stack.sh
+++ b/stack.sh
@@ -221,7 +221,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (xenial|zesty|artful|stretch|jessie|f25|f26|f27|opensuse-42.3|opensuse-tumbleweed|rhel7) ]]; then
+if [[ ! ${DISTRO} =~ (xenial|artful|bionic|stretch|jessie|f25|f26|f27|opensuse-42.3|opensuse-tumbleweed|rhel7) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From 18abffb72b514e0b364f54459df62c2ebc12d4bf Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Wed, 14 Mar 2018 20:09:14 -0400
Subject: [PATCH 1307/2409] Mention test-config phase in config docs

I had to dig into the stack.sh code to figure out why
my tempest.conf post-config wasn't work, and it's because
post-config isn't the thing to use to configure tempest,
test-config is.

Change-Id: Ic5bbe36b5d44880d0a3a602f653b4f61fd89e9c8
Related-Bug: #1755947
---
 doc/source/configuration.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 1d02395058..fc0a620441 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -41,6 +41,7 @@ The defined phases are:
 -  **extra** - runs after services are started and before any files in
    ``extra.d`` are executed
 -  **post-extra** - runs after files in ``extra.d`` are executed
+-  **test-config** - runs after tempest (and plugins) are configured
 
 The file is processed strictly in sequence; meta-sections may be
 specified more than once but if any settings are duplicated the last to

From 1ab9a2d144ee1229cdd52c0a074931c719bc7ba0 Mon Sep 17 00:00:00 2001
From: Felipe Monteiro <felipe.monteiro@att.com>
Date: Fri, 16 Mar 2018 02:02:12 +0000
Subject: [PATCH 1308/2409] Add project_tags identity feature flag

This PS adds the project_tags identity feature flag which allows
identity v3 project tags API functionality to be enabled for
releases after Pike. Once Pike is no longer supported in Tempest
this feature flag can be removed.

Depends-On: Ibaec1df79c9ac69c65cf5075c3519092bc609546
Change-Id: Iec6b34c10ea1bd7103720c773b48ce130643115d
---
 lib/tempest | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index f60b477c72..0605ffb082 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -299,6 +299,10 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG identity-feature-enabled domain_specific_drivers True
     fi
 
+    # TODO(felipemonteiro): Remove this once Tempest no longer supports Pike
+    # as this is supported in Queens and beyond.
+    iniset $TEMPEST_CONFIG identity-feature-enabled project_tags True
+
     # Image
     # We want to be able to override this variable in the gate to avoid
     # doing an external HTTP fetch for this test.

From 34e09dd3a90e7782a96c5a500368cad04f553e1c Mon Sep 17 00:00:00 2001
From: Luigi Toscano <ltoscano@redhat.com>
Date: Sun, 18 Mar 2018 17:56:27 +0100
Subject: [PATCH 1309/2409] Fix devstack job: the dict name is
 devstack_local_conf

It looks like a typo.

Change-Id: Id017b169f25a7589da3eca509c28f5d867fd5962
---
 .zuul.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 4636b8cd81..07d8f48cff 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -249,7 +249,7 @@
         SERVICE_HOST: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}"
         HOST_IP: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}"
         PUBLIC_BRIDGE_MTU: "{{ external_bridge_mtu }}"
-      devstack_localconf:
+      devstack_local_conf:
         post-config:
           $NEUTRON_CONF:
             DEFAULT:

From 23df4da0d4e61e2149e0ec164d0bad02fc8a3f07 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Mon, 19 Mar 2018 14:27:01 -0400
Subject: [PATCH 1310/2409] Use Queens UCA

This updates the UCA usage from Pike to Queens. As a result,
the various volume multiattach checks can also be removed
because the Queens UCA has libvirt 4.0.0.

Change-Id: Icb971831c8d4fe5f940d9e7993d53f1c3765e30f
---
 stackrc              |  7 +------
 tools/fixup_stuff.sh | 13 ++++---------
 2 files changed, 5 insertions(+), 15 deletions(-)

diff --git a/stackrc b/stackrc
index e8c35f423e..d3ea33ef44 100644
--- a/stackrc
+++ b/stackrc
@@ -625,12 +625,7 @@ VIRT_DRIVER=${VIRT_DRIVER:-$DEFAULT_VIRT_DRIVER}
 case "$VIRT_DRIVER" in
     ironic|libvirt)
         LIBVIRT_TYPE=${LIBVIRT_TYPE:-kvm}
-        # If ENABLE_VOLUME_MULTIATTACH is True, the Ubuntu Cloud Archive can't
-        # be used until it provides libvirt>=3.10, and with older versions of
-        # Ubuntu the group is "libvirtd".
-        # TODO(mriedem): Remove the ENABLE_VOLUME_MULTIATTACH check when
-        # UCA has libvirt>=3.10.
-        if [[ "$os_VENDOR" =~ (Debian|Ubuntu) && "${ENABLE_VOLUME_MULTIATTACH}" == "False" ]]; then
+        if [[ "$os_VENDOR" =~ (Debian|Ubuntu) ]]; then
             # The groups change with newer libvirt. Older Ubuntu used
             # 'libvirtd', but now uses libvirt like Debian. Do a quick check
             # to see if libvirtd group already exists to handle grenade's case.
diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index 90b2c8bf1f..914793245e 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -77,28 +77,23 @@ function fixup_keystone {
 # Make it possible to switch this based on an environment variable as
 # libvirt 2.5.0 doesn't handle nested virtualization quite well and this
 # is required for the trove development environment.
-# The Pike UCA has qemu 2.10 but libvirt 3.6, therefore if
-# ENABLE_VOLUME_MULTIATTACH is True, we can't use the Pike UCA
-# because multiattach won't work with those package versions.
-# We can remove this check when the UCA has libvirt>=3.10.
 function fixup_uca {
-    if [[ "${ENABLE_UBUNTU_CLOUD_ARCHIVE}" == "False" || "$DISTRO" != "xenial" || \
-            "${ENABLE_VOLUME_MULTIATTACH}" == "True" ]]; then
+    if [[ "${ENABLE_UBUNTU_CLOUD_ARCHIVE}" == "False" || "$DISTRO" != "xenial" ]]; then
         return
     fi
 
     # This pulls in apt-add-repository
     install_package "software-properties-common"
-    # Use UCA for newer libvirt. Should give us libvirt 2.5.0.
+    # Use UCA for newer libvirt.
     if [[ -f /etc/ci/mirror_info.sh ]] ; then
         # If we are on a nodepool provided host and it has told us about where
         # we can find local mirrors then use that mirror.
         source /etc/ci/mirror_info.sh
 
-        sudo apt-add-repository -y "deb $NODEPOOL_UCA_MIRROR xenial-updates/pike main"
+        sudo apt-add-repository -y "deb $NODEPOOL_UCA_MIRROR xenial-updates/queens main"
     else
         # Otherwise use upstream UCA
-        sudo add-apt-repository -y cloud-archive:pike
+        sudo add-apt-repository -y cloud-archive:queens
     fi
 
     # Disable use of libvirt wheel since a cached wheel build might be

From 6f27fca4a76aceaadab3776c87c48743671ce502 Mon Sep 17 00:00:00 2001
From: "James E. Blair" <jeblair@redhat.com>
Date: Tue, 21 Nov 2017 17:05:43 -0800
Subject: [PATCH 1311/2409] Zuul: support plugin dependencies

Change-Id: I81302e8988fe6498fea9f08ed66f5d0cc1fce161
---
 .gitignore                                    |   1 +
 .../library/devstack_local_conf.py            | 219 +++++++++++++-----
 .../write-devstack-local-conf/library/test.py | 166 +++++++++++++
 .../write-devstack-local-conf/tasks/main.yaml |   1 +
 tests/test_write_devstack_local_conf_role.sh  |   9 +
 5 files changed, 341 insertions(+), 55 deletions(-)
 create mode 100644 roles/write-devstack-local-conf/library/test.py
 create mode 100755 tests/test_write_devstack_local_conf_role.sh

diff --git a/.gitignore b/.gitignore
index d2c127d099..8553b3f849 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,6 +3,7 @@
 *.log
 *.log.[1-9]
 *.pem
+*.pyc
 .localrc.auto
 .localrc.password
 .prereqs
diff --git a/roles/write-devstack-local-conf/library/devstack_local_conf.py b/roles/write-devstack-local-conf/library/devstack_local_conf.py
index 55ba4afb69..746f54f921 100644
--- a/roles/write-devstack-local-conf/library/devstack_local_conf.py
+++ b/roles/write-devstack-local-conf/library/devstack_local_conf.py
@@ -14,16 +14,69 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+import os
 import re
 
 
-class VarGraph(object):
+class DependencyGraph(object):
     # This is based on the JobGraph from Zuul.
 
+    def __init__(self):
+        self._names = set()
+        self._dependencies = {}  # dependent_name -> set(parent_names)
+
+    def add(self, name, dependencies):
+        # Append the dependency information
+        self._dependencies.setdefault(name, set())
+        try:
+            for dependency in dependencies:
+                # Make sure a circular dependency is never created
+                ancestors = self._getParentNamesRecursively(
+                    dependency, soft=True)
+                ancestors.add(dependency)
+                if name in ancestors:
+                    raise Exception("Dependency cycle detected in {}".
+                                    format(name))
+                self._dependencies[name].add(dependency)
+        except Exception:
+            del self._dependencies[name]
+            raise
+
+    def getDependenciesRecursively(self, parent):
+        dependencies = []
+
+        current_dependencies = self._dependencies[parent]
+        for current in current_dependencies:
+            if current not in dependencies:
+                dependencies.append(current)
+            for dep in self.getDependenciesRecursively(current):
+                if dep not in dependencies:
+                    dependencies.append(dep)
+        return dependencies
+
+    def _getParentNamesRecursively(self, dependent, soft=False):
+        all_parent_items = set()
+        items_to_iterate = set([dependent])
+        while len(items_to_iterate) > 0:
+            current_item = items_to_iterate.pop()
+            current_parent_items = self._dependencies.get(current_item)
+            if current_parent_items is None:
+                if soft:
+                    current_parent_items = set()
+                else:
+                    raise Exception("Dependent item {} not found: ".format(
+                                    dependent))
+            new_parent_items = current_parent_items - all_parent_items
+            items_to_iterate |= new_parent_items
+            all_parent_items |= new_parent_items
+        return all_parent_items
+
+
+class VarGraph(DependencyGraph):
     def __init__(self, vars):
+        super(VarGraph, self).__init__()
         self.vars = {}
         self._varnames = set()
-        self._dependencies = {}  # dependent_var_name -> set(parent_var_names)
         for k, v in vars.items():
             self._varnames.add(k)
         for k, v in vars.items():
@@ -38,28 +91,21 @@ def _addVar(self, key, value):
             raise Exception("Variable {} already added".format(key))
         self.vars[key] = value
         # Append the dependency information
-        self._dependencies.setdefault(key, set())
+        dependencies = set()
+        for dependency in self.getDependencies(value):
+            if dependency == key:
+                # A variable is allowed to reference itself; no
+                # dependency link needed in that case.
+                continue
+            if dependency not in self._varnames:
+                # It's not necessary to create a link for an
+                # external variable.
+                continue
+            dependencies.add(dependency)
         try:
-            for dependency in self.getDependencies(value):
-                if dependency == key:
-                    # A variable is allowed to reference itself; no
-                    # dependency link needed in that case.
-                    continue
-                if dependency not in self._varnames:
-                    # It's not necessary to create a link for an
-                    # external variable.
-                    continue
-                # Make sure a circular dependency is never created
-                ancestor_vars = self._getParentVarNamesRecursively(
-                    dependency, soft=True)
-                ancestor_vars.add(dependency)
-                if any((key == anc_var) for anc_var in ancestor_vars):
-                    raise Exception("Dependency cycle detected in var {}".
-                                    format(key))
-                self._dependencies[key].add(dependency)
+            self.add(key, dependencies)
         except Exception:
             del self.vars[key]
-            del self._dependencies[key]
             raise
 
     def getVars(self):
@@ -67,48 +113,105 @@ def getVars(self):
         keys = sorted(self.vars.keys())
         seen = set()
         for key in keys:
-            dependencies = self.getDependentVarsRecursively(key)
+            dependencies = self.getDependenciesRecursively(key)
             for var in dependencies + [key]:
                 if var not in seen:
                     ret.append((var, self.vars[var]))
                     seen.add(var)
         return ret
 
-    def getDependentVarsRecursively(self, parent_var):
-        dependent_vars = []
-
-        current_dependent_vars = self._dependencies[parent_var]
-        for current_var in current_dependent_vars:
-            if current_var not in dependent_vars:
-                dependent_vars.append(current_var)
-            for dep in self.getDependentVarsRecursively(current_var):
-                if dep not in dependent_vars:
-                    dependent_vars.append(dep)
-        return dependent_vars
-
-    def _getParentVarNamesRecursively(self, dependent_var, soft=False):
-        all_parent_vars = set()
-        vars_to_iterate = set([dependent_var])
-        while len(vars_to_iterate) > 0:
-            current_var = vars_to_iterate.pop()
-            current_parent_vars = self._dependencies.get(current_var)
-            if current_parent_vars is None:
-                if soft:
-                    current_parent_vars = set()
-                else:
-                    raise Exception("Dependent var {} not found: ".format(
-                                    dependent_var))
-            new_parent_vars = current_parent_vars - all_parent_vars
-            vars_to_iterate |= new_parent_vars
-            all_parent_vars |= new_parent_vars
-        return all_parent_vars
+
+class PluginGraph(DependencyGraph):
+    def __init__(self, base_dir, plugins):
+        super(PluginGraph, self).__init__()
+        # The dependency trees expressed by all the plugins we found
+        # (which may be more than those the job is using).
+        self._plugin_dependencies = {}
+        self.loadPluginNames(base_dir)
+
+        self.plugins = {}
+        self._pluginnames = set()
+        for k, v in plugins.items():
+            self._pluginnames.add(k)
+        for k, v in plugins.items():
+            self._addPlugin(k, str(v))
+
+    def loadPluginNames(self, base_dir):
+        if base_dir is None:
+            return
+        git_roots = []
+        for root, dirs, files in os.walk(base_dir):
+            if '.git' not in dirs:
+                continue
+            # Don't go deeper than git roots
+            dirs[:] = []
+            git_roots.append(root)
+        for root in git_roots:
+            devstack = os.path.join(root, 'devstack')
+            if not (os.path.exists(devstack) and os.path.isdir(devstack)):
+                continue
+            settings = os.path.join(devstack, 'settings')
+            if not (os.path.exists(settings) and os.path.isfile(settings)):
+                continue
+            self.loadDevstackPluginInfo(settings)
+
+    define_re = re.compile(r'^define_plugin\s+(\w+).*')
+    require_re = re.compile(r'^plugin_requires\s+(\w+)\s+(\w+).*')
+    def loadDevstackPluginInfo(self, fn):
+        name = None
+        reqs = set()
+        with open(fn) as f:
+            for line in f:
+                m = self.define_re.match(line)
+                if m:
+                    name = m.group(1)
+                m = self.require_re.match(line)
+                if m:
+                    if name == m.group(1):
+                        reqs.add(m.group(2))
+        if name and reqs:
+            self._plugin_dependencies[name] = reqs
+
+    def getDependencies(self, value):
+        return self._plugin_dependencies.get(value, [])
+
+    def _addPlugin(self, key, value):
+        if key in self.plugins:
+            raise Exception("Plugin {} already added".format(key))
+        self.plugins[key] = value
+        # Append the dependency information
+        dependencies = set()
+        for dependency in self.getDependencies(key):
+            if dependency == key:
+                continue
+            dependencies.add(dependency)
+        try:
+            self.add(key, dependencies)
+        except Exception:
+            del self.plugins[key]
+            raise
+
+    def getPlugins(self):
+        ret = []
+        keys = sorted(self.plugins.keys())
+        seen = set()
+        for key in keys:
+            dependencies = self.getDependenciesRecursively(key)
+            for plugin in dependencies + [key]:
+                if plugin not in seen:
+                    ret.append((plugin, self.plugins[plugin]))
+                    seen.add(plugin)
+        return ret
 
 
 class LocalConf(object):
 
-    def __init__(self, localrc, localconf, base_services, services, plugins):
+    def __init__(self, localrc, localconf, base_services, services, plugins,
+                 base_dir):
         self.localrc = []
         self.meta_sections = {}
+        self.plugin_deps = {}
+        self.base_dir = base_dir
         if plugins:
             self.handle_plugins(plugins)
         if services or base_services:
@@ -119,7 +222,8 @@ def __init__(self, localrc, localconf, base_services, services, plugins):
             self.handle_localconf(localconf)
 
     def handle_plugins(self, plugins):
-        for k, v in plugins.items():
+        pg = PluginGraph(self.base_dir, plugins)
+        for k, v in pg.getPlugins():
             if v:
                 self.localrc.append('enable_plugin {} {}'.format(k, v))
 
@@ -171,6 +275,7 @@ def main():
             services=dict(type='dict'),
             localrc=dict(type='dict'),
             local_conf=dict(type='dict'),
+            base_dir=dict(type='path'),
             path=dict(type='str'),
         )
     )
@@ -180,14 +285,18 @@ def main():
                    p.get('local_conf'),
                    p.get('base_services'),
                    p.get('services'),
-                   p.get('plugins'))
+                   p.get('plugins'),
+                   p.get('base_dir'))
     lc.write(p['path'])
 
     module.exit_json()
 
 
-from ansible.module_utils.basic import *  # noqa
-from ansible.module_utils.basic import AnsibleModule
+try:
+    from ansible.module_utils.basic import *  # noqa
+    from ansible.module_utils.basic import AnsibleModule
+except ImportError:
+    pass
 
 if __name__ == '__main__':
     main()
diff --git a/roles/write-devstack-local-conf/library/test.py b/roles/write-devstack-local-conf/library/test.py
new file mode 100644
index 0000000000..843ca6e9fd
--- /dev/null
+++ b/roles/write-devstack-local-conf/library/test.py
@@ -0,0 +1,166 @@
+# Copyright (C) 2017 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+#
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import os
+import shutil
+import tempfile
+import unittest
+
+from devstack_local_conf import LocalConf
+from collections import OrderedDict
+
+class TestDevstackLocalConf(unittest.TestCase):
+    def setUp(self):
+        self.tmpdir = tempfile.mkdtemp()
+
+    def tearDown(self):
+        shutil.rmtree(self.tmpdir)
+
+    def test_plugins(self):
+        "Test that plugins without dependencies work"
+        localrc = {'test_localrc': '1'}
+        local_conf = {'install':
+                      {'nova.conf':
+                       {'main':
+                        {'test_conf': '2'}}}}
+        services = {'cinder': True}
+        # We use ordereddict here to make sure the plugins are in the
+        # *wrong* order for testing.
+        plugins = OrderedDict([
+            ('bar', 'git://git.openstack.org/openstack/bar-plugin'),
+            ('foo', 'git://git.openstack.org/openstack/foo-plugin'),
+            ('baz', 'git://git.openstack.org/openstack/baz-plugin'),
+            ])
+        p = dict(localrc=localrc,
+                 local_conf=local_conf,
+                 base_services=[],
+                 services=services,
+                 plugins=plugins,
+                 base_dir='./test',
+                 path=os.path.join(self.tmpdir, 'test.local.conf'))
+        lc = LocalConf(p.get('localrc'),
+                       p.get('local_conf'),
+                       p.get('base_services'),
+                       p.get('services'),
+                       p.get('plugins'),
+                       p.get('base_dir'))
+        lc.write(p['path'])
+
+        plugins = []
+        with open(p['path']) as f:
+            for line in f:
+                if line.startswith('enable_plugin'):
+                    plugins.append(line.split()[1])
+        self.assertEqual(['bar', 'baz', 'foo'], plugins)
+
+    def test_plugin_deps(self):
+        "Test that plugins with dependencies work"
+        os.makedirs(os.path.join(self.tmpdir, 'foo-plugin', 'devstack'))
+        os.makedirs(os.path.join(self.tmpdir, 'foo-plugin', '.git'))
+        os.makedirs(os.path.join(self.tmpdir, 'bar-plugin', 'devstack'))
+        os.makedirs(os.path.join(self.tmpdir, 'bar-plugin', '.git'))
+        with open(os.path.join(
+                self.tmpdir,
+                'foo-plugin', 'devstack', 'settings'), 'w') as f:
+            f.write('define_plugin foo\n')
+        with open(os.path.join(
+                self.tmpdir,
+                'bar-plugin', 'devstack', 'settings'), 'w') as f:
+            f.write('define_plugin bar\n')
+            f.write('plugin_requires bar foo\n')
+
+        localrc = {'test_localrc': '1'}
+        local_conf = {'install':
+                      {'nova.conf':
+                       {'main':
+                        {'test_conf': '2'}}}}
+        services = {'cinder': True}
+        # We use ordereddict here to make sure the plugins are in the
+        # *wrong* order for testing.
+        plugins = OrderedDict([
+            ('bar', 'git://git.openstack.org/openstack/bar-plugin'),
+            ('foo', 'git://git.openstack.org/openstack/foo-plugin'),
+            ])
+        p = dict(localrc=localrc,
+                 local_conf=local_conf,
+                 base_services=[],
+                 services=services,
+                 plugins=plugins,
+                 base_dir=self.tmpdir,
+                 path=os.path.join(self.tmpdir, 'test.local.conf'))
+        lc = LocalConf(p.get('localrc'),
+                       p.get('local_conf'),
+                       p.get('base_services'),
+                       p.get('services'),
+                       p.get('plugins'),
+                       p.get('base_dir'))
+        lc.write(p['path'])
+
+        plugins = []
+        with open(p['path']) as f:
+            for line in f:
+                if line.startswith('enable_plugin'):
+                    plugins.append(line.split()[1])
+        self.assertEqual(['foo', 'bar'], plugins)
+
+    def test_plugin_circular_deps(self):
+        "Test that plugins with circular dependencies fail"
+        os.makedirs(os.path.join(self.tmpdir, 'foo-plugin', 'devstack'))
+        os.makedirs(os.path.join(self.tmpdir, 'foo-plugin', '.git'))
+        os.makedirs(os.path.join(self.tmpdir, 'bar-plugin', 'devstack'))
+        os.makedirs(os.path.join(self.tmpdir, 'bar-plugin', '.git'))
+        with open(os.path.join(
+                self.tmpdir,
+                'foo-plugin', 'devstack', 'settings'), 'w') as f:
+            f.write('define_plugin foo\n')
+            f.write('plugin_requires foo bar\n')
+        with open(os.path.join(
+                self.tmpdir,
+                'bar-plugin', 'devstack', 'settings'), 'w') as f:
+            f.write('define_plugin bar\n')
+            f.write('plugin_requires bar foo\n')
+
+        localrc = {'test_localrc': '1'}
+        local_conf = {'install':
+                      {'nova.conf':
+                       {'main':
+                        {'test_conf': '2'}}}}
+        services = {'cinder': True}
+        # We use ordereddict here to make sure the plugins are in the
+        # *wrong* order for testing.
+        plugins = OrderedDict([
+            ('bar', 'git://git.openstack.org/openstack/bar-plugin'),
+            ('foo', 'git://git.openstack.org/openstack/foo-plugin'),
+            ])
+        p = dict(localrc=localrc,
+                 local_conf=local_conf,
+                 base_services=[],
+                 services=services,
+                 plugins=plugins,
+                 base_dir=self.tmpdir,
+                 path=os.path.join(self.tmpdir, 'test.local.conf'))
+        with self.assertRaises(Exception):
+            lc = LocalConf(p.get('localrc'),
+                           p.get('local_conf'),
+                           p.get('base_services'),
+                           p.get('services'),
+                           p.get('plugins'),
+                           p.get('base_dir'))
+            lc.write(p['path'])
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/roles/write-devstack-local-conf/tasks/main.yaml b/roles/write-devstack-local-conf/tasks/main.yaml
index cc21426b89..2a9f8985fc 100644
--- a/roles/write-devstack-local-conf/tasks/main.yaml
+++ b/roles/write-devstack-local-conf/tasks/main.yaml
@@ -8,3 +8,4 @@
     services: "{{ devstack_services|default(omit) }}"
     localrc: "{{ devstack_localrc|default(omit) }}"
     local_conf: "{{ devstack_local_conf|default(omit) }}"
+    base_dir: "{{ devstack_base_dir|default(omit) }}"
diff --git a/tests/test_write_devstack_local_conf_role.sh b/tests/test_write_devstack_local_conf_role.sh
new file mode 100755
index 0000000000..b2bc0a2c46
--- /dev/null
+++ b/tests/test_write_devstack_local_conf_role.sh
@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+
+TOP=$(cd $(dirname "$0")/.. && pwd)
+
+# Import common functions
+source $TOP/functions
+source $TOP/tests/unittest.sh
+
+python ./roles/write-devstack-local-conf/library/test.py

From 236250f1c3e9f328f0dc23ab168afbcfa639a33b Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Fri, 23 Mar 2018 08:27:57 -0500
Subject: [PATCH 1312/2409] Rename python-openstacksdk to openstacksdk

Change-Id: Ia77163f330f674146b369dfebea56bd97820057e
Depends-On: https://review.openstack.org/554662
---
 doc/source/plugin-registry.rst |  2 +-
 inc/python                     |  6 ------
 lib/libraries                  |  2 +-
 stackrc                        | 10 +++++-----
 tests/test_libs_from_pypi.sh   |  2 +-
 5 files changed, 8 insertions(+), 14 deletions(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 04b7698fbd..a5d3ff28c6 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -147,13 +147,13 @@ oaktree                                `git://git.openstack.org/openstack/oaktre
 octavia                                `git://git.openstack.org/openstack/octavia <https://git.openstack.org/cgit/openstack/octavia>`__
 octavia-dashboard                      `git://git.openstack.org/openstack/octavia-dashboard <https://git.openstack.org/cgit/openstack/octavia-dashboard>`__
 omni                                   `git://git.openstack.org/openstack/omni <https://git.openstack.org/cgit/openstack/omni>`__
+openstacksdk                           `git://git.openstack.org/openstack/openstacksdk <https://git.openstack.org/cgit/openstack/openstacksdk>`__
 os-xenapi                              `git://git.openstack.org/openstack/os-xenapi <https://git.openstack.org/cgit/openstack/os-xenapi>`__
 osprofiler                             `git://git.openstack.org/openstack/osprofiler <https://git.openstack.org/cgit/openstack/osprofiler>`__
 oswin-tempest-plugin                   `git://git.openstack.org/openstack/oswin-tempest-plugin <https://git.openstack.org/cgit/openstack/oswin-tempest-plugin>`__
 panko                                  `git://git.openstack.org/openstack/panko <https://git.openstack.org/cgit/openstack/panko>`__
 patrole                                `git://git.openstack.org/openstack/patrole <https://git.openstack.org/cgit/openstack/patrole>`__
 picasso                                `git://git.openstack.org/openstack/picasso <https://git.openstack.org/cgit/openstack/picasso>`__
-python-openstacksdk                    `git://git.openstack.org/openstack/python-openstacksdk <https://git.openstack.org/cgit/openstack/python-openstacksdk>`__
 qinling                                `git://git.openstack.org/openstack/qinling <https://git.openstack.org/cgit/openstack/qinling>`__
 rally                                  `git://git.openstack.org/openstack/rally <https://git.openstack.org/cgit/openstack/rally>`__
 rally-openstack                        `git://git.openstack.org/openstack/rally-openstack <https://git.openstack.org/cgit/openstack/rally-openstack>`__
diff --git a/inc/python b/inc/python
index e074ea498f..ec4233b156 100644
--- a/inc/python
+++ b/inc/python
@@ -411,12 +411,6 @@ function use_library_from_git {
 function lib_installed_from_git {
     local name=$1
     local safe_name
-    # TODO(mordred) This is a special case for python-openstacksdk, where the
-    # repo name and the pip name do not match. We should either add systemic
-    # support for providing aliases, or we should rename the git repo.
-    if [[ $name == 'python-openstacksdk' ]] ; then
-        name=openstacksdk
-    fi
     safe_name=$(python -c "from pkg_resources import safe_name; \
         print(safe_name('${name}'))")
     # Note "pip freeze" doesn't always work here, because it tries to
diff --git a/lib/libraries b/lib/libraries
index 6d52f642a1..52ec784d3b 100644
--- a/lib/libraries
+++ b/lib/libraries
@@ -28,6 +28,7 @@ GITDIR["cliff"]=$DEST/cliff
 GITDIR["cursive"]=$DEST/cursive
 GITDIR["debtcollector"]=$DEST/debtcollector
 GITDIR["futurist"]=$DEST/futurist
+GITDIR["openstacksdk"]=$DEST/openstacksdk
 GITDIR["os-client-config"]=$DEST/os-client-config
 GITDIR["osc-lib"]=$DEST/osc-lib
 GITDIR["osc-placement"]=$DEST/osc-placement
@@ -51,7 +52,6 @@ GITDIR["oslo.versionedobjects"]=$DEST/oslo.versionedobjects
 GITDIR["oslo.vmware"]=$DEST/oslo.vmware
 GITDIR["osprofiler"]=$DEST/osprofiler
 GITDIR["pycadf"]=$DEST/pycadf
-GITDIR["python-openstacksdk"]=$DEST/python-openstacksdk
 GITDIR["stevedore"]=$DEST/stevedore
 GITDIR["taskflow"]=$DEST/taskflow
 GITDIR["tooz"]=$DEST/tooz
diff --git a/stackrc b/stackrc
index e8c35f423e..f05bc6ec3a 100644
--- a/stackrc
+++ b/stackrc
@@ -133,7 +133,7 @@ export USE_PYTHON3=$(trueorfalse False USE_PYTHON3)
 # base name of the directory from which they are installed. See
 # enable_python3_package to edit this variable and use_python3_for to
 # test membership.
-export ENABLED_PYTHON3_PACKAGES="nova,glance,cinder,uwsgi,python-openstackclient,python-openstacksdk"
+export ENABLED_PYTHON3_PACKAGES="nova,glance,cinder,uwsgi,python-openstackclient,openstacksdk"
 
 # Explicitly list services not to run under Python 3. See
 # disable_python3_package to edit this variable.
@@ -525,6 +525,10 @@ GITREPO["ceilometermiddleware"]=${CEILOMETERMIDDLEWARE_REPO:-${GIT_BASE}/opensta
 GITBRANCH["ceilometermiddleware"]=${CEILOMETERMIDDLEWARE_BRANCH:-$TARGET_BRANCH}
 GITDIR["ceilometermiddleware"]=$DEST/ceilometermiddleware
 
+# openstacksdk OpenStack Python SDK
+GITREPO["openstacksdk"]=${OPENSTACKSDK_REPO:-${GIT_BASE}/openstack/openstacksdk.git}
+GITBRANCH["openstacksdk"]=${OPENSTACKSDK_BRANCH:-$TARGET_BRANCH}
+
 # os-brick library to manage local volume attaches
 GITREPO["os-brick"]=${OS_BRICK_REPO:-${GIT_BASE}/openstack/os-brick.git}
 GITBRANCH["os-brick"]=${OS_BRICK_BRANCH:-$TARGET_BRANCH}
@@ -542,10 +546,6 @@ GITBRANCH["os-vif"]=${OS_VIF_BRANCH:-$TARGET_BRANCH}
 GITREPO["osc-lib"]=${OSC_LIB_REPO:-${GIT_BASE}/openstack/osc-lib.git}
 GITBRANCH["osc-lib"]=${OSC_LIB_BRANCH:-$TARGET_BRANCH}
 
-# python-openstacksdk OpenStack Python SDK
-GITREPO["python-openstacksdk"]=${OPENSTACKSDK_REPO:-${GIT_BASE}/openstack/python-openstacksdk.git}
-GITBRANCH["python-openstacksdk"]=${OPENSTACKSDK_BRANCH:-$TARGET_BRANCH}
-
 # ironic common lib
 GITREPO["ironic-lib"]=${IRONIC_LIB_REPO:-${GIT_BASE}/openstack/ironic-lib.git}
 GITBRANCH["ironic-lib"]=${IRONIC_LIB_BRANCH:-$TARGET_BRANCH}
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index a544b56577..c3b4457171 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -38,7 +38,7 @@ ALL_LIBS+=" oslo.versionedobjects oslo.vmware keystonemiddleware"
 ALL_LIBS+=" oslo.serialization"
 ALL_LIBS+=" python-openstackclient osc-lib osc-placement"
 ALL_LIBS+=" os-client-config oslo.rootwrap"
-ALL_LIBS+=" oslo.i18n oslo.utils python-openstacksdk python-swiftclient"
+ALL_LIBS+=" oslo.i18n oslo.utils openstacksdk python-swiftclient"
 ALL_LIBS+=" python-neutronclient tooz ceilometermiddleware oslo.policy"
 ALL_LIBS+=" debtcollector os-brick os-traits automaton futurist oslo.service"
 ALL_LIBS+=" oslo.cache oslo.reports osprofiler cursive"

From 63beab524368875820db453c244468105584bc85 Mon Sep 17 00:00:00 2001
From: Huan Xiong <huan.xiong@hxt-semitech.com>
Date: Fri, 23 Mar 2018 14:42:37 +0000
Subject: [PATCH 1313/2409] init_cinder() shouldn't always create
 DEFAULT_VOLUME_GROUP_NAME

DEFAULT_VOLUME_GROUP_NAME volume group is LVM ephemeral storage used by
Nova. It is created by init_nova() if user sets NOVA_BACKEND to "LVM".
However, init_cinder() is also hardcoded to create it, based on the
asumption that CINDER_ENABLED_BACKENDS includes it. That assumption
doesn't hold for the current code. What's more important, even if user
wants to use DEFAULT_VOLUME_GROUP_NAME as one of cinder backends and
adds it to CINDER_ENABLED_BACKENDS, the current code in init_cinder()
are general enough and should work fine. This change removes relevant
code in init_cinder(). It also moves DEFAULT_VOLUME_GROUP_NAME clean-up
code from unstack.sh to cleanup_nova().

Change-Id: I53762f8eda6256f962cc4e1f1098406879bbcf5c
---
 lib/cinder | 4 ----
 lib/nova   | 4 ++++
 unstack.sh | 4 ----
 3 files changed, 4 insertions(+), 8 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 3a8097f894..e0b8971dcb 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -420,10 +420,6 @@ function init_cinder {
             be_type=${be%%:*}
             be_name=${be##*:}
             if type init_cinder_backend_${be_type} >/dev/null 2>&1; then
-                # Always init the default volume group for lvm.
-                if [[ "$be_type" == "lvm" ]]; then
-                    init_default_lvm_volume_group
-                fi
                 init_cinder_backend_${be_type} ${be_name}
             fi
         done
diff --git a/lib/nova b/lib/nova
index 56e309333b..ee682db86a 100644
--- a/lib/nova
+++ b/lib/nova
@@ -264,6 +264,10 @@ function cleanup_nova {
     stop_process "n-api-meta"
     remove_uwsgi_config "$NOVA_UWSGI_CONF" "$NOVA_UWSGI"
     remove_uwsgi_config "$NOVA_METADATA_UWSGI_CONF" "$NOVA_METADATA_UWSGI"
+
+    if [[ "$NOVA_BACKEND" == "LVM" ]]; then
+        clean_lvm_volume_group $DEFAULT_VOLUME_GROUP_NAME
+    fi
 }
 
 # configure_nova() - Set config files, create data dirs, etc
diff --git a/unstack.sh b/unstack.sh
index ccea0ef585..cfbf22e0fa 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -175,9 +175,5 @@ fi
 # enabled backends. So if Cinder is enabled, and installed successfully we are
 # sure lvm2 (lvremove, /etc/lvm/lvm.conf, etc.) is here.
 if is_service_enabled cinder && is_package_installed lvm2; then
-    # Using /bin/true here indicates a BUG - maybe the
-    # DEFAULT_VOLUME_GROUP_NAME doesn't exist?  We should
-    # isolate this further down in lib/cinder cleanup.
-    clean_lvm_volume_group $DEFAULT_VOLUME_GROUP_NAME || /bin/true
     clean_lvm_filter
 fi

From 2b3bb30d9906f70894a1945956fb8216cd929ad0 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Fri, 23 Mar 2018 19:56:26 -0400
Subject: [PATCH 1314/2409] Only sync the local cell in superconductor mode

When nova-manage db sync runs on cell1 in superconductor
mode, the [api_database]/connection config option isn't
set in the config file on purpose so the cell can't
reach the API database.

As a result, the db sync on the cell config can't hit
the API DB to sync cell0, which is not something we need
here anyway, but it results in an error message.

This tells the cell config db sync to just run it on the
cell database and not try to sync cell0.

Change-Id: Iac092762decd6de9e90e264f2998d255e8e40d00
---
 lib/nova | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index 56e309333b..2c5307ccec 100644
--- a/lib/nova
+++ b/lib/nova
@@ -734,7 +734,7 @@ function init_nova {
         # (Re)create nova databases
         for i in $(seq 1 $NOVA_NUM_CELLS); do
             recreate_database nova_cell${i}
-            $NOVA_BIN_DIR/nova-manage --config-file $(conductor_conf $i) db sync
+            $NOVA_BIN_DIR/nova-manage --config-file $(conductor_conf $i) db sync --local_cell
         done
 
         # Migrate nova and nova_cell0 databases.

From 3e813ae7c3a74f1e7069c57a311c454a8570ee92 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Sat, 24 Mar 2018 06:13:44 +0000
Subject: [PATCH 1315/2409] Updated from generate-devstack-plugins-list

Change-Id: I64ec2bd77785744df7791c13ea2b3065a781db3e
---
 doc/source/plugin-registry.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index a5d3ff28c6..c21e0efcc8 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -35,7 +35,7 @@ castellan-ui                           `git://git.openstack.org/openstack/castel
 ceilometer                             `git://git.openstack.org/openstack/ceilometer <https://git.openstack.org/cgit/openstack/ceilometer>`__
 ceilometer-powervm                     `git://git.openstack.org/openstack/ceilometer-powervm <https://git.openstack.org/cgit/openstack/ceilometer-powervm>`__
 cloudkitty                             `git://git.openstack.org/openstack/cloudkitty <https://git.openstack.org/cgit/openstack/cloudkitty>`__
-collectd-ceilometer-plugin             `git://git.openstack.org/openstack/collectd-ceilometer-plugin <https://git.openstack.org/cgit/openstack/collectd-ceilometer-plugin>`__
+collectd-openstack-plugins             `git://git.openstack.org/openstack/collectd-openstack-plugins <https://git.openstack.org/cgit/openstack/collectd-openstack-plugins>`__
 congress                               `git://git.openstack.org/openstack/congress <https://git.openstack.org/cgit/openstack/congress>`__
 cyborg                                 `git://git.openstack.org/openstack/cyborg <https://git.openstack.org/cgit/openstack/cyborg>`__
 designate                              `git://git.openstack.org/openstack/designate <https://git.openstack.org/cgit/openstack/designate>`__

From b8fcb2594cbee90c559bfc68840ac4380c8567c7 Mon Sep 17 00:00:00 2001
From: esberglu <esberglu@us.ibm.com>
Date: Wed, 21 Mar 2018 11:04:37 -0500
Subject: [PATCH 1316/2409] Update default ETCD_VERSION to latest 3.2 etcd
 release

This updates the default ETCD_VERSION to the latest 3.2 etcd release,
v3.2.17.  3.2 is chosen as it is packaged in bionic and fedora; we
hope to move to packaged versions for distros that support it in due
course.

This version supports arm64 and ppc64le which were not supported by the
previous default, v3.1.10.

We have removed the override to tarballs.o.o, as these files are now
cached as described in [1]

[1] http://lists.openstack.org/pipermail/openstack-infra/2018-March/005871.html

Depends-On: https://review.openstack.org/556688
Change-Id: I5103b4331a8d7c5660848fc148ebe4139ce6dad9
---
 .zuul.yaml |  5 -----
 stackrc    | 10 +++++-----
 2 files changed, 5 insertions(+), 10 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 07d8f48cff..bbcdfef977 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -116,10 +116,6 @@
         ERROR_ON_CLONE: true
         # Gate jobs can't deal with nested virt. Disable it.
         LIBVIRT_TYPE: qemu
-        # NOTE(dims): etcd 3.x is not available in debian/ubuntu
-        # etc. As a stop gap measure, devstack uses wget to download
-        # from the location below for all the CI jobs.
-        ETCD_DOWNLOAD_URL: http://tarballs.openstack.org/etcd/
       devstack_services:
         # Ignore any default set by devstack. Emit a "disable_all_services".
         base: false
@@ -183,7 +179,6 @@
           NOVNC_FROM_PACKAGE: true
           ERROR_ON_CLONE: true
           LIBVIRT_TYPE: qemu
-          ETCD_DOWNLOAD_URL: http://tarballs.openstack.org/etcd/
         devstack_services:
           base: false
     pre-run: playbooks/pre.yaml
diff --git a/stackrc b/stackrc
index e8c35f423e..9c98bc983d 100644
--- a/stackrc
+++ b/stackrc
@@ -737,11 +737,11 @@ fi
 EXTRA_CACHE_URLS=""
 
 # etcd3 defaults
-ETCD_VERSION=${ETCD_VERSION:-v3.1.10}
-ETCD_SHA256_AMD64=${ETCD_SHA256_AMD64:-"2d335f298619c6fb02b1124773a56966e448ad9952b26fea52909da4fe80d2be"}
-# NOTE(sdague): etcd v3.1.10 doesn't have anything for these architectures, though 3.2.x does.
-ETCD_SHA256_ARM64=${ETCD_SHA256_ARM64:-""}
-ETCD_SHA256_PPC64=${ETCD_SHA256_PPC64:-""}
+ETCD_VERSION=${ETCD_VERSION:-v3.2.17}
+ETCD_SHA256_AMD64=${ETCD_SHA256_AMD64:-"0a75e794502e2e76417b19da2807a9915fa58dcbf0985e397741d570f4f305cd"}
+ETCD_SHA256_ARM64=${ETCD_SHA256_ARM64:-"0ab4621c44c79d17d94e43bd184d0f23b763a3669056ce4ae2d0b2942410a98f"}
+ETCD_SHA256_PPC64=${ETCD_SHA256_PPC64:-"69e1279c4a2a52256b78d2a8dd23346ac46b836e678b971a459f2afaef3c275e"}
+# etcd v3.3.2 doesn't have anything for s390x
 ETCD_SHA256_S390X=${ETCD_SHA256_S390X:-""}
 # Make sure etcd3 downloads the correct architecture
 if is_arch "x86_64"; then

From 40a58d0525d493ab6ec11fda5d123d11a7437308 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Wed, 28 Mar 2018 06:36:09 +0000
Subject: [PATCH 1317/2409] Updated from generate-devstack-plugins-list

Change-Id: I35e087b203f463532788284227fddd233cb6ba0d
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index c21e0efcc8..01ba9d1eac 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -75,6 +75,7 @@ karbor                                 `git://git.openstack.org/openstack/karbor
 karbor-dashboard                       `git://git.openstack.org/openstack/karbor-dashboard <https://git.openstack.org/cgit/openstack/karbor-dashboard>`__
 keystone                               `git://git.openstack.org/openstack/keystone <https://git.openstack.org/cgit/openstack/keystone>`__
 kingbird                               `git://git.openstack.org/openstack/kingbird <https://git.openstack.org/cgit/openstack/kingbird>`__
+kolla-cli                              `git://git.openstack.org/openstack/kolla-cli <https://git.openstack.org/cgit/openstack/kolla-cli>`__
 kuryr-kubernetes                       `git://git.openstack.org/openstack/kuryr-kubernetes <https://git.openstack.org/cgit/openstack/kuryr-kubernetes>`__
 kuryr-libnetwork                       `git://git.openstack.org/openstack/kuryr-libnetwork <https://git.openstack.org/cgit/openstack/kuryr-libnetwork>`__
 kuryr-tempest-plugin                   `git://git.openstack.org/openstack/kuryr-tempest-plugin <https://git.openstack.org/cgit/openstack/kuryr-tempest-plugin>`__

From aab248bc89b11aa527ebf185ec4b12a2e951b11c Mon Sep 17 00:00:00 2001
From: Dean Troyer <dtroyer@gmail.com>
Date: Wed, 28 Mar 2018 10:05:05 -0500
Subject: [PATCH 1318/2409] Another openstacksdk rename fix

Missed one, this is blocking OSc's functional-tips tests

Change-Id: Iecf848c1791b1f204b0867e9da3e2ed994f02da3
---
 lib/libraries | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/libraries b/lib/libraries
index 52ec784d3b..b4f3c31d5e 100644
--- a/lib/libraries
+++ b/lib/libraries
@@ -91,6 +91,7 @@ function install_libs {
     _install_lib_from_source "cursive"
     _install_lib_from_source "debtcollector"
     _install_lib_from_source "futurist"
+    _install_lib_from_source "openstacksdk"
     _install_lib_from_source "osc-lib"
     _install_lib_from_source "osc-placement"
     _install_lib_from_source "os-client-config"
@@ -114,7 +115,6 @@ function install_libs {
     _install_lib_from_source "oslo.vmware"
     _install_lib_from_source "osprofiler"
     _install_lib_from_source "pycadf"
-    _install_lib_from_source "python-openstacksdk"
     _install_lib_from_source "stevedore"
     _install_lib_from_source "taskflow"
     _install_lib_from_source "tooz"

From d9060111d9496306c90e0349f4df1167e9b01ad5 Mon Sep 17 00:00:00 2001
From: Tony Breeds <tony@bakeyournoodle.com>
Date: Thu, 29 Mar 2018 12:10:28 +1100
Subject: [PATCH 1319/2409] [trivial] Comment fix

In I5103b4331a8d7c5660848fc148ebe4139ce6dad9 it was noted that the
comment was wrong.  While this has no functional impact let's clean it
up while it's fresh.

Change-Id: Ia6cf8125214c69f8289fa7cff948afc10801ed2f
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index e4e76249a1..166b7cf1bb 100644
--- a/stackrc
+++ b/stackrc
@@ -741,7 +741,7 @@ ETCD_VERSION=${ETCD_VERSION:-v3.2.17}
 ETCD_SHA256_AMD64=${ETCD_SHA256_AMD64:-"0a75e794502e2e76417b19da2807a9915fa58dcbf0985e397741d570f4f305cd"}
 ETCD_SHA256_ARM64=${ETCD_SHA256_ARM64:-"0ab4621c44c79d17d94e43bd184d0f23b763a3669056ce4ae2d0b2942410a98f"}
 ETCD_SHA256_PPC64=${ETCD_SHA256_PPC64:-"69e1279c4a2a52256b78d2a8dd23346ac46b836e678b971a459f2afaef3c275e"}
-# etcd v3.3.2 doesn't have anything for s390x
+# etcd v3.2.x doesn't have anything for s390x
 ETCD_SHA256_S390X=${ETCD_SHA256_S390X:-""}
 # Make sure etcd3 downloads the correct architecture
 if is_arch "x86_64"; then

From d6558b885785f6634d493e31000fb34c35e1213d Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Sat, 31 Mar 2018 06:11:19 +0000
Subject: [PATCH 1320/2409] Updated from generate-devstack-plugins-list

Change-Id: I12b31df6f53926dd79a6094ca998957f485e8133
---
 doc/source/plugin-registry.rst | 1 -
 1 file changed, 1 deletion(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 01ba9d1eac..c21e0efcc8 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -75,7 +75,6 @@ karbor                                 `git://git.openstack.org/openstack/karbor
 karbor-dashboard                       `git://git.openstack.org/openstack/karbor-dashboard <https://git.openstack.org/cgit/openstack/karbor-dashboard>`__
 keystone                               `git://git.openstack.org/openstack/keystone <https://git.openstack.org/cgit/openstack/keystone>`__
 kingbird                               `git://git.openstack.org/openstack/kingbird <https://git.openstack.org/cgit/openstack/kingbird>`__
-kolla-cli                              `git://git.openstack.org/openstack/kolla-cli <https://git.openstack.org/cgit/openstack/kolla-cli>`__
 kuryr-kubernetes                       `git://git.openstack.org/openstack/kuryr-kubernetes <https://git.openstack.org/cgit/openstack/kuryr-kubernetes>`__
 kuryr-libnetwork                       `git://git.openstack.org/openstack/kuryr-libnetwork <https://git.openstack.org/cgit/openstack/kuryr-libnetwork>`__
 kuryr-tempest-plugin                   `git://git.openstack.org/openstack/kuryr-tempest-plugin <https://git.openstack.org/cgit/openstack/kuryr-tempest-plugin>`__

From a62ede7d5034185a85c8ee99a916f41c0f2bde75 Mon Sep 17 00:00:00 2001
From: Paul Belanger <pabelanger@redhat.com>
Date: Wed, 14 Mar 2018 11:58:56 -0400
Subject: [PATCH 1321/2409] Use NOVA_BIN_DIR / SWIFT_BIN_DIR for binaries

Fix a few path issues where we didn't properly use NOVA_BIN_DIR /
SWIFT_BIN_DIR.

This is part of the effort to start using a virtualenv for openstack
services.

Change-Id: I6eb383db65cc902c67c43e5cb1a16a9716a914b2
Signed-off-by: Paul Belanger <pabelanger@redhat.com>
---
 lib/nova  |  8 ++++----
 lib/swift | 45 ++++++++++++++++++++++-----------------------
 2 files changed, 26 insertions(+), 27 deletions(-)

diff --git a/lib/nova b/lib/nova
index 56e309333b..2eef8c411f 100644
--- a/lib/nova
+++ b/lib/nova
@@ -685,7 +685,7 @@ function init_nova_cells {
         $NOVA_BIN_DIR/nova-manage cell create --name=child --cell_type=child --username=$RABBIT_USERID --hostname=$RABBIT_HOST --port=5672 --password=$RABBIT_PASSWORD --virtual_host=child_cell --woffset=0 --wscale=1
 
         # Creates the single cells v2 cell for the child cell (v1) nova db.
-        nova-manage --config-file $NOVA_CELLS_CONF cell_v2 create_cell \
+        $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CELLS_CONF cell_v2 create_cell \
             --transport-url $(get_transport_url child_cell) --name 'cell1'
     fi
 }
@@ -729,7 +729,7 @@ function init_nova {
         # this needs to come after the api_db sync happens. We also want to run
         # this before the db sync below since that will migrate both the nova
         # and nova_cell0 databases.
-        nova-manage cell_v2 map_cell0 --database_connection `database_connection_url nova_cell0`
+        $NOVA_BIN_DIR/nova-manage cell_v2 map_cell0 --database_connection `database_connection_url nova_cell0`
 
         # (Re)create nova databases
         for i in $(seq 1 $NOVA_NUM_CELLS); do
@@ -750,7 +750,7 @@ function init_nova {
 
         # create the cell1 cell for the main nova db where the hosts live
         for i in $(seq 1 $NOVA_NUM_CELLS); do
-            nova-manage --config-file $NOVA_CONF --config-file $(conductor_conf $i) cell_v2 create_cell --name "cell$i"
+            $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF --config-file $(conductor_conf $i) cell_v2 create_cell --name "cell$i"
         done
     fi
 
@@ -1015,7 +1015,7 @@ function start_nova {
     if is_service_enabled n-api; then
         # dump the cell mapping to ensure life is good
         echo "Dumping cells_v2 mapping"
-        nova-manage cell_v2 list_cells --verbose
+        $NOVA_BIN_DIR/nova-manage cell_v2 list_cells --verbose
     fi
 }
 
diff --git a/lib/swift b/lib/swift
index 6cda9c84b2..933af1005b 100644
--- a/lib/swift
+++ b/lib/swift
@@ -37,6 +37,7 @@ fi
 
 # Set up default directories
 GITDIR["python-swiftclient"]=$DEST/python-swiftclient
+SWIFT_DIR=$DEST/swift
 
 # Swift virtual environment
 if [[ ${USE_VENV} = True ]]; then
@@ -46,8 +47,6 @@ else
     SWIFT_BIN_DIR=$(get_python_exec_prefix)
 fi
 
-
-SWIFT_DIR=$DEST/swift
 SWIFT_AUTH_CACHE_DIR=${SWIFT_AUTH_CACHE_DIR:-/var/cache/swift}
 SWIFT_APACHE_WSGI_DIR=${SWIFT_APACHE_WSGI_DIR:-/var/www/swift}
 SWIFT3_DIR=$DEST/swift3
@@ -341,7 +340,7 @@ function configure_swift {
     local user_group
 
     # Make sure to kill all swift processes first
-    swift-init --run-dir=${SWIFT_DATA_DIR}/run all stop || true
+    $SWIFT_BIN_DIR/swift-init --run-dir=${SWIFT_DATA_DIR}/run all stop || true
 
     sudo install -d -o ${STACK_USER} ${SWIFT_CONF_DIR}
     sudo install -d -o ${STACK_USER} ${SWIFT_CONF_DIR}/{object,container,account}-server
@@ -704,7 +703,7 @@ function create_swift_accounts {
 function init_swift {
     local node_number
     # Make sure to kill all swift processes first
-    swift-init --run-dir=${SWIFT_DATA_DIR}/run all stop || true
+    $SWIFT_BIN_DIR/swift-init --run-dir=${SWIFT_DATA_DIR}/run all stop || true
 
     # Forcibly re-create the backing filesystem
     create_swift_disk
@@ -715,9 +714,9 @@ function init_swift {
 
         rm -f *.builder *.ring.gz backups/*.builder backups/*.ring.gz
 
-        swift-ring-builder object.builder create ${SWIFT_PARTITION_POWER_SIZE} ${SWIFT_REPLICAS} 1
-        swift-ring-builder container.builder create ${SWIFT_PARTITION_POWER_SIZE} ${SWIFT_REPLICAS} 1
-        swift-ring-builder account.builder create ${SWIFT_PARTITION_POWER_SIZE} ${SWIFT_REPLICAS} 1
+        $SWIFT_BIN_DIR/swift-ring-builder object.builder create ${SWIFT_PARTITION_POWER_SIZE} ${SWIFT_REPLICAS} 1
+        $SWIFT_BIN_DIR/swift-ring-builder container.builder create ${SWIFT_PARTITION_POWER_SIZE} ${SWIFT_REPLICAS} 1
+        $SWIFT_BIN_DIR/swift-ring-builder account.builder create ${SWIFT_PARTITION_POWER_SIZE} ${SWIFT_REPLICAS} 1
 
         # The ring will be created on each node, and because the order of
         # nodes is identical we can use a seed for rebalancing, making it
@@ -728,26 +727,26 @@ function init_swift {
             node_number=1
 
             for node in ${SWIFT_STORAGE_IPS}; do
-                swift-ring-builder object.builder add z${node_number}-${node}:${OBJECT_PORT_BASE}/sdb1 1
-                swift-ring-builder container.builder add z${node_number}-${node}:${CONTAINER_PORT_BASE}/sdb1 1
-                swift-ring-builder account.builder add z${node_number}-${node}:${ACCOUNT_PORT_BASE}/sdb1 1
+                $SWIFT_BIN_DIR/swift-ring-builder object.builder add z${node_number}-${node}:${OBJECT_PORT_BASE}/sdb1 1
+                $SWIFT_BIN_DIR/swift-ring-builder container.builder add z${node_number}-${node}:${CONTAINER_PORT_BASE}/sdb1 1
+                $SWIFT_BIN_DIR/swift-ring-builder account.builder add z${node_number}-${node}:${ACCOUNT_PORT_BASE}/sdb1 1
                 let "node_number=node_number+1"
             done
 
         else
 
             for node_number in ${SWIFT_REPLICAS_SEQ}; do
-                swift-ring-builder object.builder add z${node_number}-${SWIFT_SERVICE_LOCAL_HOST}:$(( OBJECT_PORT_BASE + 10 * (node_number - 1) ))/sdb1 1
-                swift-ring-builder container.builder add z${node_number}-${SWIFT_SERVICE_LOCAL_HOST}:$(( CONTAINER_PORT_BASE + 10 * (node_number - 1) ))/sdb1 1
-                swift-ring-builder account.builder add z${node_number}-${SWIFT_SERVICE_LOCAL_HOST}:$(( ACCOUNT_PORT_BASE + 10 * (node_number - 1) ))/sdb1 1
+                $SWIFT_BIN_DIR/swift-ring-builder object.builder add z${node_number}-${SWIFT_SERVICE_LOCAL_HOST}:$(( OBJECT_PORT_BASE + 10 * (node_number - 1) ))/sdb1 1
+                $SWIFT_BIN_DIR/swift-ring-builder container.builder add z${node_number}-${SWIFT_SERVICE_LOCAL_HOST}:$(( CONTAINER_PORT_BASE + 10 * (node_number - 1) ))/sdb1 1
+                $SWIFT_BIN_DIR/swift-ring-builder account.builder add z${node_number}-${SWIFT_SERVICE_LOCAL_HOST}:$(( ACCOUNT_PORT_BASE + 10 * (node_number - 1) ))/sdb1 1
             done
         fi
 
         # We use a seed for rebalancing. Doing this allows us to create
         # identical rings on multiple nodes if SWIFT_STORAGE_IPS is the same
-        swift-ring-builder object.builder rebalance 42
-        swift-ring-builder container.builder rebalance 42
-        swift-ring-builder account.builder rebalance 42
+        $SWIFT_BIN_DIR/swift-ring-builder object.builder rebalance 42
+        $SWIFT_BIN_DIR/swift-ring-builder container.builder rebalance 42
+        $SWIFT_BIN_DIR/swift-ring-builder account.builder rebalance 42
     } && popd >/dev/null
 
     # Create cache dir
@@ -803,7 +802,7 @@ function start_swift {
         # Apache should serve the "PACO" a.k.a "main" services
         restart_apache_server
         # The rest of the services should be started in backgroud
-        swift-init --run-dir=${SWIFT_DATA_DIR}/run rest start
+        $SWIFT_BIN_DIR/swift-init --run-dir=${SWIFT_DATA_DIR}/run rest start
         return 0
     fi
 
@@ -827,7 +826,7 @@ function start_swift {
         done
 
         if [[ "$SWIFT_START_ALL_SERVICES" == "True" ]]; then
-            swift-init --run-dir=${SWIFT_DATA_DIR}/run rest start
+            $SWIFT_BIN_DIR/swift-init --run-dir=${SWIFT_DATA_DIR}/run rest start
         else
             # The container-sync daemon is strictly needed to pass the container
             # sync Tempest tests.
@@ -835,8 +834,8 @@ function start_swift {
             run_process s-container-sync "$SWIFT_BIN_DIR/swift-container-sync ${SWIFT_CONF_DIR}/container-server/1.conf"
         fi
     else
-        swift-init --run-dir=${SWIFT_DATA_DIR}/run all restart || true
-        swift-init --run-dir=${SWIFT_DATA_DIR}/run proxy stop || true
+        $SWIFT_BIN_DIR/swift-init --run-dir=${SWIFT_DATA_DIR}/run all restart || true
+        $SWIFT_BIN_DIR/swift-init --run-dir=${SWIFT_DATA_DIR}/run proxy stop || true
     fi
 
     if is_service_enabled tls-proxy; then
@@ -863,12 +862,12 @@ function stop_swift {
     local type
 
     if [ "$SWIFT_USE_MOD_WSGI" == "True" ]; then
-        swift-init --run-dir=${SWIFT_DATA_DIR}/run rest stop && return 0
+        $SWIFT_BIN_DIR/swift-init --run-dir=${SWIFT_DATA_DIR}/run rest stop && return 0
     fi
 
     # screen normally killed by ``unstack.sh``
-    if type -p swift-init >/dev/null; then
-        swift-init --run-dir=${SWIFT_DATA_DIR}/run all stop || true
+    if type -p $SWIFT_BIN_DIR/swift-init >/dev/null; then
+        $SWIFT_BIN_DIR/swift-init --run-dir=${SWIFT_DATA_DIR}/run all stop || true
     fi
     # Dump all of the servers
     # Maintain the iteration as stop_process() has some desirable side-effects

From 87c0de5240d33cf053815d90ba8e766958f412bb Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Tue, 3 Apr 2018 15:16:30 +0000
Subject: [PATCH 1322/2409] Export OS_CACERT after sourcing .stackenv file

This makes sure that it is available to subprocesses like the other
authentication data.

Change-Id: I513b7c2620b171ce20a1ceb5536226f3a69f2b82
Closes-Bug: 1760901
---
 openrc | 1 +
 1 file changed, 1 insertion(+)

diff --git a/openrc b/openrc
index 37724c552e..01ec6c6114 100644
--- a/openrc
+++ b/openrc
@@ -29,6 +29,7 @@ source $RC_DIR/stackrc
 # Load the last env variables if available
 if [[ -r $RC_DIR/.stackenv ]]; then
     source $RC_DIR/.stackenv
+    export OS_CACERT
 fi
 
 # Get some necessary configuration

From 4d7e33757670890ec2c8a862d504c018df744f1c Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Wed, 15 Nov 2017 09:45:56 -0600
Subject: [PATCH 1323/2409] Extract a devstack-minimal base job

For folks who are doing functional testing with less than the full set
of normal base services. Should be a no-op/ignorable for most people.

Change-Id: If14ee018c01995e0a5b6bcdaac9ddc8810c6d503
---
 .zuul.yaml | 53 ++++++++++++++++++++++++++++++++++++++++-------------
 1 file changed, 40 insertions(+), 13 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index b7724816cb..880658b504 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -199,8 +199,47 @@
       - ^.*/locale/.*po$
 
 - job:
-    name: devstack
+    name: devstack-minimal
     parent: devstack-base
+    description: |
+      Minimal devstack base job, intended for use by jobs that need
+      less than the normal minimum set of required-projects.
+    nodeset: openstack-single-node
+    required-projects:
+      - openstack/requirements
+    vars:
+      devstack_localrc:
+        # Multinode specific settings
+        SERVICE_HOST: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}"
+        HOST_IP: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}"
+        PUBLIC_BRIDGE_MTU: "{{ external_bridge_mtu }}"
+      devstack_services:
+        # Shared services
+        dstat: true
+        etcd3: true
+        mysql: true
+        peakmem_tracker: true
+        rabbit: true
+    group-vars:
+      subnode:
+        devstack_services:
+          # Shared services
+          dstat: true
+          peakmem_tracker: true
+        devstack_localrc:
+          # Multinode specific settings
+          HOST_IP: "{{ hostvars[inventory_hostname]['nodepool']['private_ipv4'] }}"
+          SERVICE_HOST: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}"
+          PUBLIC_BRIDGE_MTU: "{{ external_bridge_mtu }}"
+          # Subnode specific settings
+          DATABASE_TYPE: mysql
+          RABBIT_HOST: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}"
+          DATABASE_HOST: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}"
+
+
+- job:
+    name: devstack
+    parent: devstack-minimal
     description: |
       Base devstack job for integration gate.
 
@@ -231,7 +270,6 @@
       - openstack/keystone
       - openstack/neutron
       - openstack/nova
-      - openstack/requirements
       - openstack/swift
     timeout: 7200
     vars:
@@ -245,10 +283,6 @@
         NOVA_VNC_ENABLED: true
         VNCSERVER_LISTEN: 0.0.0.0
         VNCSERVER_PROXYCLIENT_ADDRESS: "{{ hostvars[inventory_hostname]['nodepool']['private_ipv4'] }}"
-        # Multinode specific settings
-        SERVICE_HOST: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}"
-        HOST_IP: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}"
-        PUBLIC_BRIDGE_MTU: "{{ external_bridge_mtu }}"
       devstack_local_conf:
         post-config:
           $NEUTRON_CONF:
@@ -339,16 +373,9 @@
           # integrated gate, so specifying the services has not effect.
           # ceilometer-*: false
         devstack_localrc:
-          # Multinode specific settings
-          HOST_IP: "{{ hostvars[inventory_hostname]['nodepool']['private_ipv4'] }}"
-          SERVICE_HOST: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}"
-          PUBLIC_BRIDGE_MTU: "{{ external_bridge_mtu }}"
           # Subnode specific settings
-          DATABASE_TYPE: mysql
           GLANCE_HOSTPORT: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}:9292"
           Q_HOST: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}"
-          RABBIT_HOST: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}"
-          DATABASE_HOST: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}"
 
 - job:
     name: devstack-multinode

From f3f7c079257701efcc3eb50125e09171ad88811e Mon Sep 17 00:00:00 2001
From: Lance Bragstad <lbragstad@gmail.com>
Date: Fri, 30 Mar 2018 20:56:04 +0000
Subject: [PATCH 1324/2409] Add documention for setting up LDAP

Devstack supports deploying an LDAP server and configuring keystone
to use it, but we didn't have any documentation for it. This commit
adds some basic documentation that should help developers setup
LDAP-backed development environments.

Change-Id: I8ba07d73f52cb7f575ff2953977e9fdcade92d83
---
 doc/source/guides.rst                    |   6 +
 doc/source/guides/devstack-with-ldap.rst | 174 +++++++++++++++++++++++
 2 files changed, 180 insertions(+)
 create mode 100644 doc/source/guides/devstack-with-ldap.rst

diff --git a/doc/source/guides.rst b/doc/source/guides.rst
index c2c7b9163a..82e0dd6ac6 100644
--- a/doc/source/guides.rst
+++ b/doc/source/guides.rst
@@ -20,6 +20,7 @@ Walk through various setups used by stackers
    guides/devstack-with-nested-kvm
    guides/nova
    guides/devstack-with-lbaas-v2
+   guides/devstack-with-ldap
 
 All-In-One Single VM
 --------------------
@@ -66,3 +67,8 @@ Nova and devstack
 --------------------------------
 
 Guide to working with nova features :doc:`Nova and devstack <guides/nova>`.
+
+Deploying DevStack with LDAP
+----------------------------
+
+Guide to setting up :doc:`DevStack with LDAP <guides/devstack-with-ldap>`.
diff --git a/doc/source/guides/devstack-with-ldap.rst b/doc/source/guides/devstack-with-ldap.rst
new file mode 100644
index 0000000000..ec411419b5
--- /dev/null
+++ b/doc/source/guides/devstack-with-ldap.rst
@@ -0,0 +1,174 @@
+============================
+Deploying DevStack with LDAP
+============================
+
+The OpenStack Identity service has the ability to integrate with LDAP. The goal
+of this guide is to walk you through setting up an LDAP-backed OpenStack
+development environment.
+
+Introduction
+============
+
+LDAP support in keystone is read-only. You can use it to back an entire
+OpenStack deployment to a single LDAP server, or you can use it to back
+separate LDAP servers to specific keystone domains. Users within those domains
+will can authenticate against keystone, assume role assignments, and interact
+with other OpenStack services.
+
+Configuration
+=============
+
+To deploy an OpenLDAP server, make sure ``ldap`` is added to the list of
+``ENABLED_SERVICES``::
+
+    enable_service ldap
+
+Devstack will require a password to set up an LDAP administrator. This
+administrative user is also the bind user specified in keystone's configuration
+files, similar to a ``keystone`` user for MySQL databases.
+
+Devstack will prompt you for a password when running ``stack.sh`` if
+``LDAP_PASSWORD`` is not set. You can add the following to your
+``local.conf``::
+
+    LDAP_PASSWORD=super_secret_password
+
+At this point, devstack should have everything it needs to deploy OpenLDAP,
+bootstrap it with a minimal set of users, and configure it to back to a domain
+in keystone::
+
+    ./stack.sh
+
+Once ``stack.sh`` completes, you should have a running keystone deployment with
+a basic set of users. It is important to note that not all users will live
+within LDAP. Instead, keystone will back different domains to different
+identity sources. For example, the ``default`` domain will be backed by MySQL.
+This is usually where you'll find your administrative and services users. If
+you query keystone for a list of domains, you should see a domain called
+``Users``. This domain is set up by devstack and points to OpenLDAP.
+
+User Management
+===============
+
+Initially, there will only be two users in the LDAP server. The ``Manager``
+user is used by keystone to talk to OpenLDAP. The ``demo`` user is a generic
+user that you should be able to see if you query keystone for users within the
+``Users`` domain. Both of these users were added to LDAP using basic LDAP
+utilities installed by devstack (e.g. ``ldap-utils``) and LDIFs. The LDIFs used
+to create these users can be found in ``devstack/files/ldap/``.
+
+Listing Users
+-------------
+
+To list all users in LDAP directly, you can use ``ldapsearch`` with the LDAP
+user bootstrapped by devstack::
+
+    ldapsearch -x -w LDAP_PASSWORD -D cn=Manager,dc=openstack,dc=org \
+        -H ldap://localhost -b dc=openstack,dc=org
+
+As you can see, devstack creates an OpenStack domain called ``openstack.org``
+as a container for the ``Manager`` and ``demo`` users.
+
+Creating Users
+--------------
+
+Since keystone's LDAP integration is read-only, users must be added directly to
+LDAP. Users added directly to OpenLDAP will automatically be placed into the
+``Users`` domain.
+
+LDIFs can be used to add users via the command line. The following is an
+example LDIF that can be used to create a new LDAP user, let's call it
+``peter.ldif.in``::
+
+    dn: cn=peter,ou=Users,dc=openstack,dc=org
+    cn: peter
+    displayName: Peter Quill
+    givenName: Peter Quill
+    mail: starlord@openstack.org
+    objectClass: inetOrgPerson
+    objectClass: top
+    sn: peter
+    uid: peter
+    userPassword: im-a-better-pilot-than-rocket
+
+Now, we use the ``Manager`` user to create a user for Peter in LDAP::
+
+    ldapadd -x -w LDAP_PASSWORD -D cn=Manager,dc=openstack,dc=org \
+        -H ldap://localhost -c -f peter.ldif.in
+
+We should be able to assign Peter roles on projects. After Peter has some level
+of authorization, he should be able to login to Horizon by specifying the
+``Users`` domain and using his ``peter`` username and password. Authorization
+can be given to Peter by creating a project within the ``Users`` domain and
+giving him a role assignment on that project::
+
+    $ openstack project create --domain Users awesome-mix-vol-1
+    +-------------+----------------------------------+
+    | Field       | Value                            |
+    +-------------+----------------------------------+
+    | description |                                  |
+    | domain_id   | 61a2de23107c46bea2d758167af707b9 |
+    | enabled     | True                             |
+    | id          | 7d422396d54945cdac8fe1e8e32baec4 |
+    | is_domain   | False                            |
+    | name        | awesome-mix-vol-1                |
+    | parent_id   | 61a2de23107c46bea2d758167af707b9 |
+    | tags        | []                               |
+    +-------------+----------------------------------+
+    $ openstack role add --user peter --user-domain Users \
+          --project awesome-mix-vol-1 --project-domain Users admin
+
+
+Deleting Users
+--------------
+
+We can use the same basic steps to remove users from LDAP, but instead of using
+LDIFs, we can just pass the ``dn`` of the user we want to delete::
+
+    ldapdelete -x -w LDAP_PASSWORD -D cn=Manager,dc=openstack,dc=org \
+        -H ldap://localhost cn=peter,ou=Users,dc=openstack,dc=org
+
+Group Management
+================
+
+Like users, groups are considered specific identities. This means that groups
+also fall under the same read-only constraints as users and they can be managed
+directly with LDAP in the same way users are with LDIFs.
+
+Adding Groups
+-------------
+
+Let's define a specific group with the following LDIF::
+
+    dn: cn=guardians,ou=UserGroups,dc=openstack,dc=org
+    objectClass: groupOfNames
+    cn: guardians
+    description: Guardians of the Galaxy
+    member: cn=peter,dc=openstack,dc=org
+    member: cn=gamora,dc=openstack,dc=org
+    member: cn=drax,dc=openstack,dc=org
+    member: cn=rocket,dc=openstack,dc=org
+    member: cn=groot,dc=openstack,dc=org
+
+We can create the group using the same ``ldapadd`` command as we did with
+users::
+
+    ldapadd -x -w LDAP_PASSWORD -D cn=Manager,dc=openstack,dc=org \
+        -H ldap://localhost -c -f guardian-group.ldif.in
+
+If we check the group membership in Horizon, we'll see that only Peter is a
+member of the ``guardians`` group, despite the whole crew being specified in
+the LDIF. Once those accounts are created in LDAP, they will automatically be
+added to the ``guardians`` group. They will also assume any role assignments
+given to the ``guardians`` group.
+
+Deleting Groups
+---------------
+
+Just like users, groups can be deleted using the ``dn``::
+
+    ldapdelete -x -w LDAP_PASSWORD -D cn=Manager,dc=openstack,dc=org \
+        -H ldap://localhost cn=guardians,ou=UserGroups,dc=openstack,dc=org
+
+Note that this operation will not remove users within that group. It will only
+remove the group itself and the memberships any users had with that group.

From 295610c89edc60faba1f5d8d80f40ab00b73a39c Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Tue, 20 Mar 2018 10:54:39 -0400
Subject: [PATCH 1325/2409] Remove [placement]/os_region_name usage

The [placement]/os_region_name config option is deprecated
and no longer required to be set (the default is fine for
devstack) with the dependent nova change.

Depends-On: I973180d6a384b32838ab61d4e6aaf73c255fd116

Change-Id: I6379acf179ed511f1cdadbd7fb09e2454182a5d3
---
 lib/placement | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/placement b/lib/placement
index 1d68f8a185..2343ac9f2a 100644
--- a/lib/placement
+++ b/lib/placement
@@ -112,7 +112,6 @@ function configure_placement_nova_compute {
     iniset $conf placement user_domain_name "$SERVICE_DOMAIN_NAME"
     iniset $conf placement project_name "$SERVICE_TENANT_NAME"
     iniset $conf placement project_domain_name "$SERVICE_DOMAIN_NAME"
-    iniset $conf placement os_region_name "$REGION_NAME"
     # TODO(cdent): auth_strategy, which is common to see in these
     # blocks is not currently used here. For the time being the
     # placement api uses the auth_strategy configuration setting

From c77c9497a5ef79dab74e23a21783044241fe1670 Mon Sep 17 00:00:00 2001
From: David Rabel <rabel@b1-systems.de>
Date: Thu, 5 Apr 2018 20:56:22 +0200
Subject: [PATCH 1326/2409] Fix indentation in devstack-with-lbaas-v2

guides/devstack-with-lbaas-v2 contained an indentation misstake,
that formatted some of the text unintentionally as quotations.

Change-Id: Ibbad4974c45f028d3de461ba69e0cea837d9c871
---
 doc/source/guides/devstack-with-lbaas-v2.rst | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/doc/source/guides/devstack-with-lbaas-v2.rst b/doc/source/guides/devstack-with-lbaas-v2.rst
index 7dee520a23..df3c7ce2ac 100644
--- a/doc/source/guides/devstack-with-lbaas-v2.rst
+++ b/doc/source/guides/devstack-with-lbaas-v2.rst
@@ -15,7 +15,7 @@ make sure it is updated. Install git and any other developer tools you find usef
 
 Install devstack
 
-  ::
+::
 
     git clone https://git.openstack.org/openstack-dev/devstack
     cd devstack
@@ -23,7 +23,7 @@ Install devstack
 
 Edit your ``local.conf`` to look like
 
-  ::
+::
 
     [[local|localrc]]
     # Load the external LBaaS plugin.
@@ -60,7 +60,7 @@ Edit your ``local.conf`` to look like
 
 Run stack.sh and do some sanity checks
 
-  ::
+::
 
     ./stack.sh
     . ./openrc
@@ -69,7 +69,7 @@ Run stack.sh and do some sanity checks
 
 Create two nova instances that we can use as test http servers:
 
-  ::
+::
 
     #create nova instances on private network
     nova boot --image $(nova image-list | awk '/ cirros-.*-x86_64-uec / {print $2}') --flavor 1 --nic net-id=$(openstack network list | awk '/ private / {print $2}') node1
@@ -83,7 +83,7 @@ Create two nova instances that we can use as test http servers:
 
 Set up a simple web server on each of these instances. ssh into each instance (username 'cirros', password 'cubswin:)') and run
 
- ::
+::
 
     MYIP=$(ifconfig eth0|grep 'inet addr'|awk -F: '{print $2}'| awk '{print $1}')
     while true; do echo -e "HTTP/1.0 200 OK\r\n\r\nWelcome to $MYIP" | sudo nc -l -p 80 ; done&
@@ -91,7 +91,7 @@ Set up a simple web server on each of these instances. ssh into each instance (u
 Phase 2: Create your load balancers
 ------------------------------------
 
- ::
+::
 
     neutron lbaas-loadbalancer-create --name lb1 private-subnet
     neutron lbaas-loadbalancer-show lb1  # Wait for the provisioning_status to be ACTIVE.

From 931f82dc291dae10b9a484f25e044aed788311e1 Mon Sep 17 00:00:00 2001
From: Colleen Murphy <colleen@gazlene.net>
Date: Sun, 18 Feb 2018 14:11:10 +0100
Subject: [PATCH 1327/2409] Enable tempest tests for application credentials

In Queens and later, the application credentials feature is available on
keystone and enabled by default. It should be tested in devstack.

Depends-on: https://review.openstack.org/545627
Change-Id: I4b0dc823487e79df16e1e603012ba4a7dc438389
---
 lib/tempest | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index 0605ffb082..9de9b91870 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -303,6 +303,10 @@ function configure_tempest {
     # as this is supported in Queens and beyond.
     iniset $TEMPEST_CONFIG identity-feature-enabled project_tags True
 
+    # In Queens and later, application credentials are enabled by default
+    # so remove this once Tempest no longer supports Pike.
+    iniset $TEMPEST_CONFIG identity-feature-enabled application_credentials True
+
     # Image
     # We want to be able to override this variable in the gate to avoid
     # doing an external HTTP fetch for this test.

From 486057f3391ce3a262f8226f7652ed14b3b444f3 Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Wed, 21 Mar 2018 13:59:18 +0100
Subject: [PATCH 1328/2409] Start OVS as root on Tumblweed to workaround
 bsc#1085971

There is currently a OVS 2.9.0 update in Tumbleweed that
fails to start as it is having a race with systemd on creating
the home directory. Workaround is to run it as root for now.

Change-Id: Ief610c6473834b02a1d644d8f50d11138a48e6e6
---
 lib/neutron_plugins/ovs_base | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/ovs_base b/lib/neutron_plugins/ovs_base
index 50b9ae506b..36e2ed2ca2 100644
--- a/lib/neutron_plugins/ovs_base
+++ b/lib/neutron_plugins/ovs_base
@@ -72,7 +72,14 @@ function _neutron_ovs_base_install_agent_packages {
         if [[ $DISTRO == "sle12" ]] && [[ $os_RELEASE -lt 12.2 ]]; then
             restart_service openvswitch-switch
         else
-            restart_service openvswitch
+            # workaround for https://bugzilla.suse.com/show_bug.cgi?id=1085971
+            if [[ $DISTRO =~ "tumbleweed" ]]; then
+                sudo sed -i -e "s,^OVS_USER_ID=.*,OVS_USER_ID='root:root'," /etc/sysconfig/openvswitch
+            fi
+            restart_service openvswitch || {
+                journalctl -xe || :
+                systemctl status openvswitch
+            }
         fi
     fi
 }

From c114449bdb6fc8c4ede2b7845aa2ba049bdc332f Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Wed, 11 Apr 2018 21:33:50 +0200
Subject: [PATCH 1329/2409] Switch to mkisofs for openSUSE distributions

In Tumbleweed genisoimage was dropped in favor of cdrtools,
so installing that no longer works. We can however install
mkisofs directly and switch to that as that is also available
in Leap 42.3 and Leap 15.0+ family distros.

Also drop dependency on libmysqlclient-devel which appears
unnecessary (and is no longer available with mariadb 10.2+)

Change-Id: Ie8402204b6cdf94c21865caba116d3fd1298c5ad
---
 files/rpms-suse/general | 1 -
 files/rpms-suse/n-cpu   | 2 +-
 files/rpms-suse/nova    | 2 +-
 lib/nova                | 6 ++++++
 4 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/files/rpms-suse/general b/files/rpms-suse/general
index 0b69cb1c01..b870d72149 100644
--- a/files/rpms-suse/general
+++ b/files/rpms-suse/general
@@ -11,7 +11,6 @@ graphviz # docs
 iputils
 libffi-devel  # pyOpenSSL
 libjpeg8-devel # Pillow 3.0.0
-libmysqlclient-devel # MySQL-python
 libopenssl-devel # to rebuild pyOpenSSL if needed
 libxslt-devel  # lxml
 lsof # useful when debugging
diff --git a/files/rpms-suse/n-cpu b/files/rpms-suse/n-cpu
index 9ece11534d..d0c572e97d 100644
--- a/files/rpms-suse/n-cpu
+++ b/files/rpms-suse/n-cpu
@@ -1,7 +1,7 @@
 cryptsetup
-genisoimage
 libosinfo
 lvm2
+mkisofs
 open-iscsi
 sg3_utils
 # Stuff for diablo volumes
diff --git a/files/rpms-suse/nova b/files/rpms-suse/nova
index ae115d2138..4103a407d2 100644
--- a/files/rpms-suse/nova
+++ b/files/rpms-suse/nova
@@ -4,7 +4,6 @@ dnsmasq
 dnsmasq-utils # dist:opensuse-12.3,opensuse-13.1
 ebtables
 gawk
-genisoimage # required for config_drive
 iptables
 iputils
 kpartx
@@ -12,6 +11,7 @@ kvm # NOPRIME
 libvirt # NOPRIME
 libvirt-python # NOPRIME
 mariadb # NOPRIME
+mkisofs # required for config_drive
 parted
 polkit
 # qemu as fallback if kvm cannot be used
diff --git a/lib/nova b/lib/nova
index 2eef8c411f..939806ff95 100644
--- a/lib/nova
+++ b/lib/nova
@@ -506,6 +506,12 @@ function create_nova_conf {
     if [ "$FORCE_CONFIG_DRIVE" != "False" ]; then
         iniset $NOVA_CONF DEFAULT force_config_drive "$FORCE_CONFIG_DRIVE"
     fi
+
+    # nova defaults to genisoimage but only mkisofs is available for 15.0+
+    if is_suse; then
+        iniset $NOVA_CONF DEFAULT mkisofs_cmd /usr/bin/mkisofs
+    fi
+
     # Format logging
     setup_logging $NOVA_CONF
 

From dc5d88bc0b2233ee8490d31ce67d6a8f6e503b23 Mon Sep 17 00:00:00 2001
From: Daniel Mellado <dmellado@redhat.com>
Date: Thu, 12 Apr 2018 11:41:59 -0400
Subject: [PATCH 1330/2409] Apply contraints to tempest plugins

This commit applies the constraints for the tempest plugin installation
so they won't go over the upper reqs.

Closes-Bug: 1763436
Change-Id: I5cf91157bbdae79dec01d5b3db32efea21f1b2b7
---
 lib/tempest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index 0605ffb082..2321cd5a56 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -646,7 +646,7 @@ function install_tempest {
 function install_tempest_plugins {
     pushd $TEMPEST_DIR
     if [[ $TEMPEST_PLUGINS != 0 ]] ; then
-        tox -evenv-tempest -- pip install $TEMPEST_PLUGINS
+        tox -evenv-tempest -- pip install -c $REQUIREMENTS_DIR/upper-constraints.txt $TEMPEST_PLUGINS
         echo "Checking installed Tempest plugins:"
         tox -evenv-tempest -- tempest list-plugins
     fi

From f99d1771ba1882dfbb69186212a197edae3ef02c Mon Sep 17 00:00:00 2001
From: Hongbin Lu <hongbin034@gmail.com>
Date: Sat, 14 Apr 2018 19:33:15 +0000
Subject: [PATCH 1331/2409] Do not use pip 10 or higher

It looks pip 10 failed the uninstallation of distutils installed
packages. This patch temporarily cap the version of pip to work-around.

Closes-Bug: #1763966
Change-Id: I8bf80efc04883cd754c19bea0303064080112c6e
---
 tools/cap-pip.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/cap-pip.txt b/tools/cap-pip.txt
index c280267641..f5278d7c86 100644
--- a/tools/cap-pip.txt
+++ b/tools/cap-pip.txt
@@ -1 +1 @@
-pip!=8
+pip!=8,<10

From e1edde38edb697f56e111f55e5992e7bf22f6284 Mon Sep 17 00:00:00 2001
From: "James E. Blair" <jeblair@redhat.com>
Date: Fri, 2 Mar 2018 15:05:14 +0000
Subject: [PATCH 1332/2409] Automatically set LIBS_FROM_GIT based on required
 projects

If a project shows up in zuul's required-projects list, add it
to LIBS_FROM_GIT automatically.  This way, when a user specifies
that a job requires a zuul-project, it gets used in testing, but
otherwise, it doesn't (pypi is used instead).

Also add information about what happens behind the scenes for both
LIBS_FROM_GIT and plugin dependencies.

This moves the check performed in check_libs_from_git to
a helper function which is installed for most kinds of
installations.  This means that if someone sets LIBS_FROM_GIT to
"foobar", devstack won't error anymore, as nothing is going to
try to install foobar, therefore the check won't run on that.
However, as we move to automated generation of the local config,
that error is not likely to happen.  This check was originally
added due to an error in the upper-constraints file (where a
constraint name did not match a package name).  This location of
the check would still catch that type of error.

Change-Id: Ifcf3ad008cf42d3d4762cfb3b6c31c93cfeb40db
---
 inc/python                                    | 23 ++----
 roles/write-devstack-local-conf/README.rst    | 12 +++
 .../library/devstack_local_conf.py            | 29 ++++++--
 .../write-devstack-local-conf/library/test.py | 74 +++++++++++++++++--
 .../write-devstack-local-conf/tasks/main.yaml |  1 +
 stack.sh                                      |  5 --
 6 files changed, 110 insertions(+), 34 deletions(-)

diff --git a/inc/python b/inc/python
index e074ea498f..37b4617777 100644
--- a/inc/python
+++ b/inc/python
@@ -435,22 +435,6 @@ function lib_installed_from_git {
     [[ -n $(pip list --format=columns 2>/dev/null | awk "/^$safe_name/ {print \$3}") ]]
 }
 
-# check that everything that's in LIBS_FROM_GIT was actually installed
-# correctly, this helps double check issues with library fat fingering.
-function check_libs_from_git {
-    local lib=""
-    local not_installed=""
-    for lib in $(echo ${LIBS_FROM_GIT} | tr "," " "); do
-        if ! lib_installed_from_git "$lib"; then
-            not_installed+=" $lib"
-        fi
-    done
-    # if anything is not installed, say what it is.
-    if [[ -n "$not_installed" ]]; then
-        die $LINENO "The following LIBS_FROM_GIT were not installed correct: $not_installed"
-    fi
-}
-
 # setup a library by name. If we are trying to use the library from
 # git, we'll do a git based install, otherwise we'll punt and the
 # library should be installed by a requirements pull from another
@@ -561,6 +545,13 @@ function _setup_package_with_constraints_edit {
 
     setup_package $project_dir "$flags" $extras
 
+    # If this project is in LIBS_FROM_GIT, verify it was actually installed
+    # correctly.  This helps catch errors caused by constraints mismatches.
+    if use_library_from_git "$project_dir"; then
+        if ! lib_installed_from_git "$project_dir"; then
+            die $LINENO "The following LIBS_FROM_GIT was not installed correctly: $project_dir"
+        fi
+    fi
 }
 
 # ``pip install -e`` the package, which processes the dependencies
diff --git a/roles/write-devstack-local-conf/README.rst b/roles/write-devstack-local-conf/README.rst
index 73f9f0d6fd..bfce9c98cd 100644
--- a/roles/write-devstack-local-conf/README.rst
+++ b/roles/write-devstack-local-conf/README.rst
@@ -20,6 +20,14 @@ Write the local.conf file for use by devstack
    bash shell variables, and will be ordered so that variables used by
    later entries appear first.
 
+   As a special case, the variable ``LIBS_FROM_GIT`` will be
+   constructed automatically from the projects which appear in the
+   ``required-projects`` list defined by the job.  To instruct
+   devstack to install a library from source rather than pypi, simply
+   add that library to the job's ``required-projects`` list.  To
+   override the automatically-generated value, set ``LIBS_FROM_GIT``
+   in ``devstack_localrc`` to the desired value.
+
 .. zuul:rolevar:: devstack_local_conf
    :type: dict
 
@@ -75,3 +83,7 @@ Write the local.conf file for use by devstack
    A dictionary mapping a plugin name to a git repo location.  If the
    location is a non-empty string, then an ``enable_plugin`` line will
    be emmitted for the plugin name.
+
+   If a plugin declares a dependency on another plugin (via
+   ``plugin_requires`` in the plugin's settings file), this role will
+   automatically emit ``enable_plugin`` lines in the correct order.
diff --git a/roles/write-devstack-local-conf/library/devstack_local_conf.py b/roles/write-devstack-local-conf/library/devstack_local_conf.py
index 746f54f921..9728fef37b 100644
--- a/roles/write-devstack-local-conf/library/devstack_local_conf.py
+++ b/roles/write-devstack-local-conf/library/devstack_local_conf.py
@@ -207,17 +207,17 @@ def getPlugins(self):
 class LocalConf(object):
 
     def __init__(self, localrc, localconf, base_services, services, plugins,
-                 base_dir):
+                 base_dir, projects):
         self.localrc = []
         self.meta_sections = {}
         self.plugin_deps = {}
         self.base_dir = base_dir
+        self.projects = projects
         if plugins:
             self.handle_plugins(plugins)
         if services or base_services:
             self.handle_services(base_services, services or {})
-        if localrc:
-            self.handle_localrc(localrc)
+        self.handle_localrc(localrc)
         if localconf:
             self.handle_localconf(localconf)
 
@@ -241,9 +241,22 @@ def handle_services(self, base_services, services):
                 self.localrc.append('enable_service {}'.format(k))
 
     def handle_localrc(self, localrc):
-        vg = VarGraph(localrc)
-        for k, v in vg.getVars():
-            self.localrc.append('{}={}'.format(k, v))
+        lfg = False
+        if localrc:
+            vg = VarGraph(localrc)
+            for k, v in vg.getVars():
+                self.localrc.append('{}={}'.format(k, v))
+                if k == 'LIBS_FROM_GIT':
+                    lfg = True
+
+        if not lfg and self.projects:
+            required_projects = []
+            for project_name, project_info in self.projects.items():
+                if project_info.get('required'):
+                    required_projects.append(project_info['short_name'])
+            if required_projects:
+                self.localrc.append('LIBS_FROM_GIT={}'.format(
+                    ','.join(required_projects)))
 
     def handle_localconf(self, localconf):
         for phase, phase_data in localconf.items():
@@ -277,6 +290,7 @@ def main():
             local_conf=dict(type='dict'),
             base_dir=dict(type='path'),
             path=dict(type='str'),
+            projects=dict(type='dict'),
         )
     )
 
@@ -286,7 +300,8 @@ def main():
                    p.get('base_services'),
                    p.get('services'),
                    p.get('plugins'),
-                   p.get('base_dir'))
+                   p.get('base_dir'),
+                   p.get('projects'))
     lc.write(p['path'])
 
     module.exit_json()
diff --git a/roles/write-devstack-local-conf/library/test.py b/roles/write-devstack-local-conf/library/test.py
index 843ca6e9fd..7ccb68f08d 100644
--- a/roles/write-devstack-local-conf/library/test.py
+++ b/roles/write-devstack-local-conf/library/test.py
@@ -56,7 +56,8 @@ def test_plugins(self):
                        p.get('base_services'),
                        p.get('services'),
                        p.get('plugins'),
-                       p.get('base_dir'))
+                       p.get('base_dir'),
+                       p.get('projects'))
         lc.write(p['path'])
 
         plugins = []
@@ -66,6 +67,7 @@ def test_plugins(self):
                     plugins.append(line.split()[1])
         self.assertEqual(['bar', 'baz', 'foo'], plugins)
 
+
     def test_plugin_deps(self):
         "Test that plugins with dependencies work"
         os.makedirs(os.path.join(self.tmpdir, 'foo-plugin', 'devstack'))
@@ -101,20 +103,80 @@ def test_plugin_deps(self):
                  plugins=plugins,
                  base_dir=self.tmpdir,
                  path=os.path.join(self.tmpdir, 'test.local.conf'))
+
+    def test_libs_from_git(self):
+        "Test that LIBS_FROM_GIT is auto-generated"
+        projects = {
+            'git.openstack.org/openstack/nova': {
+                'required': True,
+                'short_name': 'nova',
+            },
+            'git.openstack.org/openstack/oslo.messaging': {
+                'required': True,
+                'short_name': 'oslo.messaging',
+            },
+            'git.openstack.org/openstack/devstack-plugin': {
+                'required': False,
+                'short_name': 'devstack-plugin',
+            },
+        }
+        p = dict(base_services=[],
+                 base_dir='./test',
+                 path=os.path.join(self.tmpdir, 'test.local.conf'),
+                 projects=projects)
         lc = LocalConf(p.get('localrc'),
                        p.get('local_conf'),
                        p.get('base_services'),
                        p.get('services'),
                        p.get('plugins'),
-                       p.get('base_dir'))
+                       p.get('base_dir'),
+                       p.get('projects'))
         lc.write(p['path'])
 
-        plugins = []
+        lfg = None
         with open(p['path']) as f:
             for line in f:
-                if line.startswith('enable_plugin'):
-                    plugins.append(line.split()[1])
-        self.assertEqual(['foo', 'bar'], plugins)
+                if line.startswith('LIBS_FROM_GIT'):
+                    lfg = line.strip().split('=')[1]
+        self.assertEqual('nova,oslo.messaging', lfg)
+
+    def test_overridelibs_from_git(self):
+        "Test that LIBS_FROM_GIT can be overridden"
+        localrc = {'LIBS_FROM_GIT': 'oslo.db'}
+        projects = {
+            'git.openstack.org/openstack/nova': {
+                'required': True,
+                'short_name': 'nova',
+            },
+            'git.openstack.org/openstack/oslo.messaging': {
+                'required': True,
+                'short_name': 'oslo.messaging',
+            },
+            'git.openstack.org/openstack/devstack-plugin': {
+                'required': False,
+                'short_name': 'devstack-plugin',
+            },
+        }
+        p = dict(localrc=localrc,
+                 base_services=[],
+                 base_dir='./test',
+                 path=os.path.join(self.tmpdir, 'test.local.conf'),
+                 projects=projects)
+        lc = LocalConf(p.get('localrc'),
+                       p.get('local_conf'),
+                       p.get('base_services'),
+                       p.get('services'),
+                       p.get('plugins'),
+                       p.get('base_dir'),
+                       p.get('projects'))
+        lc.write(p['path'])
+
+        lfg = None
+        with open(p['path']) as f:
+            for line in f:
+                if line.startswith('LIBS_FROM_GIT'):
+                    lfg = line.strip().split('=')[1]
+        self.assertEqual('oslo.db', lfg)
 
     def test_plugin_circular_deps(self):
         "Test that plugins with circular dependencies fail"
diff --git a/roles/write-devstack-local-conf/tasks/main.yaml b/roles/write-devstack-local-conf/tasks/main.yaml
index 2a9f8985fc..a294cae608 100644
--- a/roles/write-devstack-local-conf/tasks/main.yaml
+++ b/roles/write-devstack-local-conf/tasks/main.yaml
@@ -9,3 +9,4 @@
     localrc: "{{ devstack_localrc|default(omit) }}"
     local_conf: "{{ devstack_local_conf|default(omit) }}"
     base_dir: "{{ devstack_base_dir|default(omit) }}"
+    projects: "{{ zuul.projects }}"
diff --git a/stack.sh b/stack.sh
index 9b496c0e20..5643b4db1b 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1402,11 +1402,6 @@ fi
 # Check the status of running services
 service_check
 
-# ensure that all the libraries we think we installed from git,
-# actually were.
-check_libs_from_git
-
-
 # Configure nova cellsv2
 # ----------------------
 

From fe628b9fb2e9511e78a7dc6883fa1d4766413a54 Mon Sep 17 00:00:00 2001
From: Lance Bragstad <lbragstad@gmail.com>
Date: Tue, 17 Apr 2018 17:01:46 +0000
Subject: [PATCH 1333/2409] Remove the sample configuration file for keystone

This commit just makes sure that the configuration file for keystone
exists on the system. We use iniset to actually populate the values
we want before we run keystone anyway.

This results in a cleaner configuration file that isn't bloated with
comments and help text.

Change-Id: I7a1f879e9e242a11e2c4663ec116e33da28db7f5
---
 lib/keystone | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 714f089cca..696e351ab0 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -202,7 +202,7 @@ function configure_keystone {
     sudo install -d -o $STACK_USER $KEYSTONE_CONF_DIR
 
     if [[ "$KEYSTONE_CONF_DIR" != "$KEYSTONE_DIR/etc" ]]; then
-        install -m 600 $KEYSTONE_DIR/etc/keystone.conf.sample $KEYSTONE_CONF
+        install -m 600 /dev/null $KEYSTONE_CONF
         if [[ -f "$KEYSTONE_DIR/etc/keystone-paste.ini" ]]; then
             cp -p "$KEYSTONE_DIR/etc/keystone-paste.ini" "$KEYSTONE_PASTE_INI"
         fi
@@ -220,7 +220,7 @@ function configure_keystone {
         inidelete $KEYSTONE_PASTE_INI composite:admin \\/v2.0
     fi
 
-    # Rewrite stock ``keystone.conf``
+    # Populate ``keystone.conf``
     if is_service_enabled ldap; then
         iniset $KEYSTONE_CONF identity domain_config_dir "$KEYSTONE_CONF_DIR/domains"
         iniset $KEYSTONE_CONF identity domain_specific_drivers_enabled "True"

From afe141401997db054cd9987ca17d989415c65ad4 Mon Sep 17 00:00:00 2001
From: Andrea Frittoli <andrea.frittoli@gmail.com>
Date: Fri, 20 Apr 2018 13:36:22 +0100
Subject: [PATCH 1334/2409] Ensure passwordless ssh with stack between nodes

For compute migration to work, the stack user needs to be configured
with passwordless ssh between all hosts involved in the migration.

Reuse the build ssh-key for this, which is already distributed for
user root.

Depends-on: https://review.openstack.org/563584

Change-Id: Id07f55fea06509466add35315c135dbfba6aa714
---
 roles/orchestrate-devstack/tasks/main.yaml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/roles/orchestrate-devstack/tasks/main.yaml b/roles/orchestrate-devstack/tasks/main.yaml
index 12db58c520..f747943f3c 100644
--- a/roles/orchestrate-devstack/tasks/main.yaml
+++ b/roles/orchestrate-devstack/tasks/main.yaml
@@ -6,6 +6,12 @@
 - name: Setup devstack on sub-nodes
   block:
 
+  - name: Distribute the build sshkey for the user "stack"
+    include_role:
+      name: copy-build-sshkey
+    vars:
+      copy_sshkey_target_user: 'stack'
+
   - name: Sync CA data to subnodes (when any)
     # Only do this if the tls-proxy service is defined and enabled
     include_role:

From 05da9a9b1e86babe829c1c2349fa7e9838095ee8 Mon Sep 17 00:00:00 2001
From: "Andrea Frittoli (andreaf)" <andrea.frittoli@gmail.com>
Date: Wed, 25 Apr 2018 13:52:44 +0100
Subject: [PATCH 1335/2409] Enable nova VNC configuration on the subnode

The n-novnc service only runs on the controller node, however novnc
settings must be enabled on both nodes for vnc to work, since both
hosts are compute hosts.

Change-Id: Icc29441f507e6e4df9fd900eb7f35b0862f52043
---
 .zuul.yaml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index a979fa4fbb..609f0feea4 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -277,7 +277,7 @@
         DEBUG_LIBVIRT_COREDUMPS: True
         NOVA_VNC_ENABLED: true
         VNCSERVER_LISTEN: 0.0.0.0
-        VNCSERVER_PROXYCLIENT_ADDRESS: "{{ hostvars[inventory_hostname]['nodepool']['private_ipv4'] }}"
+        VNCSERVER_PROXYCLIENT_ADDRESS: $HOST_IP
       devstack_local_conf:
         post-config:
           $NEUTRON_CONF:
@@ -371,6 +371,9 @@
           # Subnode specific settings
           GLANCE_HOSTPORT: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}:9292"
           Q_HOST: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}"
+          NOVA_VNC_ENABLED: true
+          VNCSERVER_LISTEN: 0.0.0.0
+          VNCSERVER_PROXYCLIENT_ADDRESS: $HOST_IP
 
 - job:
     name: devstack-multinode

From e8bad5cd6a65821c54d66bbc5f7ba17091439d34 Mon Sep 17 00:00:00 2001
From: Chris Dent <cdent@anticdent.org>
Date: Wed, 25 Apr 2018 13:01:03 +0100
Subject: [PATCH 1336/2409] Init placement before nova

With change I7e1e89cd66397883453935dcf7172d977bf82e84 the placement
service may optionally use its own database. In order for this to
work, however, the ordering of how both nova and placement are
configured and initialized in stack.sh requires careful control.

* nova.conf must be created first
* then placement must make some adjustments to it
* then lib/placement needs to create the placement database
* before nova does a database sync (of both databases)

Otherwise, when the placement_database/connection is defined, the nova
db_sync command will fail because the placement database does not yet
exist. If we try to do a sync before the nova_api database is created
_that_ sync will fail.

This patch adjusts the ordering and also removes a comment that will
no longer be true when I7e1e89cd66397883453935dcf7172d977bf82e84 is
merged.

Change-Id: Id5b5911c04d198fe7b94c7d827afeb5cdf43a076
---
 lib/placement |  8 +++-----
 stack.sh      | 14 +++++++++-----
 2 files changed, 12 insertions(+), 10 deletions(-)

diff --git a/lib/placement b/lib/placement
index 1d68f8a185..d70596734c 100644
--- a/lib/placement
+++ b/lib/placement
@@ -44,8 +44,6 @@ PLACEMENT_UWSGI_CONF=$PLACEMENT_CONF_DIR/placement-uwsgi.ini
 
 # The placement service can optionally use a separate database
 # connection. Set PLACEMENT_DB_ENABLED to True to use it.
-# NOTE(cdent): This functionality depends on some code that is not
-# yet merged in nova but is coming soon.
 PLACEMENT_DB_ENABLED=$(trueorfalse False PLACEMENT_DB_ENABLED)
 
 if is_service_enabled tls-proxy; then
@@ -152,9 +150,9 @@ function create_placement_accounts {
 function init_placement {
     if [ "$PLACEMENT_DB_ENABLED" != False ]; then
         recreate_database placement
-        time_start "dbsync"
-        $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF api_db sync
-        time_stop "dbsync"
+        # Database migration will be handled when nova does an api_db sync
+        # TODO(cdent): When placement is extracted we'll do our own sync
+        # here.
     fi
     create_placement_accounts
 }
diff --git a/stack.sh b/stack.sh
index 6899fa0d8b..30f24b6a3f 100755
--- a/stack.sh
+++ b/stack.sh
@@ -894,6 +894,8 @@ if is_service_enabled neutron; then
     stack_install_service neutron
 fi
 
+# Nova configuration is used by placement so we need to create nova.conf
+# first.
 if is_service_enabled nova; then
     # Compute service
     stack_install_service nova
@@ -1184,6 +1186,13 @@ if is_service_enabled cinder; then
     init_cinder
 fi
 
+# Placement Service
+# ---------------
+
+if is_service_enabled placement; then
+    echo_summary "Configuring placement"
+    init_placement
+fi
 
 # Compute Service
 # ---------------
@@ -1202,11 +1211,6 @@ if is_service_enabled nova; then
     init_nova_cells
 fi
 
-if is_service_enabled placement; then
-    echo_summary "Configuring placement"
-    init_placement
-fi
-
 
 # Extras Configuration
 # ====================

From ed2d491960138f92e819b6f6ed9dd5eb99d4a54f Mon Sep 17 00:00:00 2001
From: melanie witt <melwittt@gmail.com>
Date: Tue, 18 Jul 2017 22:29:41 +0000
Subject: [PATCH 1337/2409] Run console proxies per cell instead of globally

Along with converting to the database backend for console token auth,
the console proxies need to run per cell instead of globally. This way,
the instance UUID isn't needed in the access url as users will be
handed an access url local to the cell their instances is in. With
console proxies sharded across cells, a large cloud will no longer have
a bottleneck of one console proxy for the entire deployment.

This also disables the novnc tempest tests with a TODO to re-enable
them once the nova patch series that converts from the nova-consoleauth
backend -> cell database backend lands.

Change-Id: I67894a31b887a93de26f3d2d8a1fa84be5b9ea89
---
 lib/nova    | 62 ++++++++++++++++++++++++++++++++++++++++++++++++-----
 lib/tempest |  9 +++++++-
 2 files changed, 65 insertions(+), 6 deletions(-)

diff --git a/lib/nova b/lib/nova
index fea2b8509a..3a00ab376c 100644
--- a/lib/nova
+++ b/lib/nova
@@ -921,11 +921,46 @@ function start_nova_rest {
         run_process n-api-meta "$NOVA_BIN_DIR/uwsgi --procname-prefix nova-api-meta --ini $NOVA_METADATA_UWSGI_CONF"
     fi
 
-    run_process n-novnc "$NOVA_BIN_DIR/nova-novncproxy --config-file $api_cell_conf --web $NOVNC_WEB_DIR"
-    run_process n-xvnc "$NOVA_BIN_DIR/nova-xvpvncproxy --config-file $api_cell_conf"
-    run_process n-spice "$NOVA_BIN_DIR/nova-spicehtml5proxy --config-file $api_cell_conf --web $SPICE_WEB_DIR"
+    # nova-consoleauth always runs globally
     run_process n-cauth "$NOVA_BIN_DIR/nova-consoleauth --config-file $api_cell_conf"
-    run_process n-sproxy "$NOVA_BIN_DIR/nova-serialproxy --config-file $api_cell_conf"
+
+    export PATH=$old_path
+}
+
+function enable_nova_console_proxies {
+    for i in $(seq 1 $NOVA_NUM_CELLS); do
+        for srv in n-novnc n-xvnc n-spice n-sproxy; do
+            if is_service_enabled $srv; then
+                enable_service ${srv}-cell${i}
+            fi
+        done
+    done
+}
+
+function start_nova_console_proxies {
+    # Hack to set the path for rootwrap
+    local old_path=$PATH
+    # This is needed to find the nova conf
+    export PATH=$NOVA_BIN_DIR:$PATH
+
+    local api_cell_conf=$NOVA_CONF
+    # console proxies run globally for singleconductor, else they run per cell
+    if [[ "${CELLSV2_SETUP}" == "singleconductor" ]]; then
+        run_process n-novnc "$NOVA_BIN_DIR/nova-novncproxy --config-file $api_cell_conf --web $NOVNC_WEB_DIR"
+        run_process n-xvnc "$NOVA_BIN_DIR/nova-xvpvncproxy --config-file $api_cell_conf"
+        run_process n-spice "$NOVA_BIN_DIR/nova-spicehtml5proxy --config-file $api_cell_conf --web $SPICE_WEB_DIR"
+        run_process n-sproxy "$NOVA_BIN_DIR/nova-serialproxy --config-file $api_cell_conf"
+    else
+        enable_nova_console_proxies
+        for i in $(seq 1 $NOVA_NUM_CELLS); do
+            local conf
+            conf=$(conductor_conf $i)
+            run_process n-novnc-cell${i} "$NOVA_BIN_DIR/nova-novncproxy --config-file $conf --web $NOVNC_WEB_DIR"
+            run_process n-xvnc-cell${i} "$NOVA_BIN_DIR/nova-xvpvncproxy --config-file $conf"
+            run_process n-spice-cell${i} "$NOVA_BIN_DIR/nova-spicehtml5proxy --config-file $conf --web $SPICE_WEB_DIR"
+            run_process n-sproxy-cell${i} "$NOVA_BIN_DIR/nova-serialproxy --config-file $conf"
+        done
+    fi
 
     export PATH=$old_path
 }
@@ -985,6 +1020,7 @@ function start_nova {
     # this catches the cells v1 case early
     _set_singleconductor
     start_nova_rest
+    start_nova_console_proxies
     start_nova_conductor
     start_nova_compute
     if is_service_enabled n-api; then
@@ -1010,11 +1046,26 @@ function stop_nova_compute {
 
 function stop_nova_rest {
     # Kill the non-compute nova processes
-    for serv in n-api n-api-meta n-net n-sch n-novnc n-xvnc n-cauth n-spice n-cell n-cell n-sproxy; do
+    for serv in n-api n-api-meta n-net n-sch n-cauth n-cell n-cell; do
         stop_process $serv
     done
 }
 
+function stop_nova_console_proxies {
+    if [[ "${CELLSV2_SETUP}" == "singleconductor" ]]; then
+        for srv in n-novnc n-xvnc n-spice n-sproxy; do
+            stop_process $srv
+        done
+    else
+        enable_nova_console_proxies
+        for i in $(seq 1 $NOVA_NUM_CELLS); do
+            for srv in n-novnc n-xvnc n-spice n-sproxy; do
+                stop_process ${srv}-cell${i}
+            done
+        done
+    fi
+}
+
 function stop_nova_conductor {
     if [[ "${CELLSV2_SETUP}" == "singleconductor" ]]; then
         stop_process n-cond
@@ -1032,6 +1083,7 @@ function stop_nova_conductor {
 # stop_nova() - Stop running processes
 function stop_nova {
     stop_nova_rest
+    stop_nova_console_proxies
     stop_nova_conductor
     stop_nova_compute
 }
diff --git a/lib/tempest b/lib/tempest
index 3b39dae422..d22bb95e14 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -386,7 +386,14 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG compute-feature-enabled volume_multiattach True
     fi
 
-    if is_service_enabled n-novnc; then
+    # TODO(melwitt): If we're running per-cell console proxies, the novnc tests
+    # won't work until the nova patch series lands that converts from the
+    # nova-consoleauth backend -> cell database backend. So disable them unless
+    # we're running Cells v1. Cells v1 will never support the cell database
+    # backend, so it will always run with a global nova-consoleauth.
+    # Once the patch that converts from the nova-consoleauth backend -> cell
+    # database backend lands, we can re-enable the novnc tests for Cells v2.
+    if is_service_enabled n-novnc && is_service_enabled n-cell; then
         iniset $TEMPEST_CONFIG compute-feature-enabled vnc_console True
     fi
 

From 6645cf7a26428f3af1e4739ac29c6a90b67f99dc Mon Sep 17 00:00:00 2001
From: melanie witt <melwittt@gmail.com>
Date: Wed, 13 Dec 2017 23:59:09 +0000
Subject: [PATCH 1338/2409] Re-enable novnc tempest tests

Once the nova patch series that converts from the nova-consoleauth
backend -> cell database backend lands, we can re-enable the novnc
tests in tempest.

Depends-On: If1b6e5f20d2ea82d94f5f0550f13189fc9bc16c4

Change-Id: I2939191a1c3ce49fa2104b4ffdf795fc416a1c33
---
 lib/tempest | 9 +--------
 1 file changed, 1 insertion(+), 8 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index d22bb95e14..3b39dae422 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -386,14 +386,7 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG compute-feature-enabled volume_multiattach True
     fi
 
-    # TODO(melwitt): If we're running per-cell console proxies, the novnc tests
-    # won't work until the nova patch series lands that converts from the
-    # nova-consoleauth backend -> cell database backend. So disable them unless
-    # we're running Cells v1. Cells v1 will never support the cell database
-    # backend, so it will always run with a global nova-consoleauth.
-    # Once the patch that converts from the nova-consoleauth backend -> cell
-    # database backend lands, we can re-enable the novnc tests for Cells v2.
-    if is_service_enabled n-novnc && is_service_enabled n-cell; then
+    if is_service_enabled n-novnc; then
         iniset $TEMPEST_CONFIG compute-feature-enabled vnc_console True
     fi
 

From 69057d46556db95267a4bc4156dadc88b5064ab9 Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Tue, 1 May 2018 05:57:21 -0500
Subject: [PATCH 1339/2409] Register versioned endpoint for block-storage
 service

cinder does not yet support operations without project_id in the url.
The unversioned endpoint is not a usable endpoint for a user that
requests the block-storage service. Although it would be lovely to have
the block-storage service have the unversioned endpoint in the catalog,
we need to get project-id out of the urls first.

Change-Id: I4246708b6ea31496ba4d565ab422abc76f730ee7
Needed-By: https://review.openstack.org/564494
---
 lib/cinder | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 3a8097f894..f6cad9d9f2 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -349,7 +349,7 @@ function create_cinder_accounts {
             get_or_create_endpoint \
                 "block-storage" \
                 "$REGION_NAME" \
-                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/"
+                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v3/\$(project_id)s"
 
             get_or_create_endpoint \
                 "volume" \
@@ -371,7 +371,7 @@ function create_cinder_accounts {
             get_or_create_endpoint \
                 "block-storage" \
                 "$REGION_NAME" \
-                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST/volume/"
+                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST/volume/v3/\$(project_id)s"
 
             get_or_create_endpoint \
                 "volume" \

From 7e36ded0cff9d753c1bfa4ae05d5c97ccf0dd957 Mon Sep 17 00:00:00 2001
From: Artom Lifshitz <alifshit@redhat.com>
Date: Wed, 2 May 2018 10:38:57 -0400
Subject: [PATCH 1340/2409] docs: Add placement-client to compute's
 ENABLED_SERVICES

In a multinode setup, the compute node needs to report to the
placement service. If it does not do so, it effectively does not exist
from the scheduler's point of view. This patch adds placement-client
to the compute node's ENABLED_SERVICES so that this can happen.

Change-Id: Ibfcd84e4626301bcdea70f719ade7f8365d03497
---
 doc/source/guides/neutron.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index 1b8dccd7f3..7f360c63cc 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -244,7 +244,7 @@ The host `devstack-2` has a very minimal `local.conf`.
 
     ## Neutron options
     PUBLIC_INTERFACE=eth0
-    ENABLED_SERVICES=n-cpu,rabbit,q-agt
+    ENABLED_SERVICES=n-cpu,rabbit,q-agt,placement-client
 
 Network traffic from `eth0` on the compute nodes is then NAT'd by the
 controller node that runs Neutron's `neutron-l3-agent` and provides L3

From 59e6ff10ce65509beefb3fdee7aa0c8ca966a8a9 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Wed, 2 May 2018 11:45:09 -0400
Subject: [PATCH 1341/2409] Remove IRONIC_USE_RESOURCE_CLASSES check

Nova has dropped support for non-resource class
baremetal scheduling, so the IRONIC_USE_RESOURCE_CLASSES
flag is no longer useful and has been removed.

Depends-On: https://review.openstack.org/565805/
Change-Id: Ib2e6c96409c98877f6a43b76f176c1420d2d415e
---
 lib/nova_plugins/hypervisor-ironic | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/lib/nova_plugins/hypervisor-ironic b/lib/nova_plugins/hypervisor-ironic
index c91f70b9bb..49110a8643 100644
--- a/lib/nova_plugins/hypervisor-ironic
+++ b/lib/nova_plugins/hypervisor-ironic
@@ -42,14 +42,6 @@ function configure_nova_hypervisor {
     iniset $NOVA_CONF DEFAULT compute_driver ironic.IronicDriver
     iniset $NOVA_CONF DEFAULT firewall_driver $LIBVIRT_FIREWALL_DRIVER
 
-    if [[ "$IRONIC_USE_RESOURCE_CLASSES" == "False" ]]; then
-        iniset $NOVA_CONF DEFAULT scheduler_host_manager ironic_host_manager
-        iniset $NOVA_CONF filter_scheduler use_baremetal_filters True
-        iniset $NOVA_CONF filter_scheduler host_subset_size 999
-        iniset $NOVA_CONF DEFAULT ram_allocation_ratio 1.0
-        iniset $NOVA_CONF DEFAULT reserved_host_memory_mb 0
-    fi
-
     # ironic section
     iniset $NOVA_CONF ironic auth_type password
     iniset $NOVA_CONF ironic username admin

From bed03ea77a93ad09ce8f06a467d5de02ef48e603 Mon Sep 17 00:00:00 2001
From: Paul Belanger <pabelanger@redhat.com>
Date: Tue, 1 May 2018 21:36:37 -0400
Subject: [PATCH 1342/2409] Switch to fedora-latest for nodeset name

To help avoid the amount zuul.yaml chrun when we bring a new version
of fedora online, switch to using fedora-latest. As of writing,
fedora-28 is the latest release which we update our testing for.

Also add fedora-28 support to stash.sh and remove fedora-25 /
fedora-26 as they are EOL.

Change-Id: I3d716554e8f270f4434cc9cac3408f8e890e0665
Depends-On: https://review.openstack.org/565758/
Signed-off-by: Paul Belanger <pabelanger@redhat.com>
---
 .zuul.yaml | 18 ++++++++++++++----
 stack.sh   |  2 +-
 2 files changed, 15 insertions(+), 5 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index a979fa4fbb..87eb8c5c8d 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -48,6 +48,16 @@
         nodes:
           - controller
 
+- nodeset:
+    name: devstack-single-node-fedora-latest
+    nodes:
+      - name: controller
+        label: fedora-28
+    groups:
+      - name: tempest
+        nodes:
+          - controller
+
 - nodeset:
     name: openstack-two-node
     nodes:
@@ -406,10 +416,10 @@
     voting: false
 
 - job:
-    name: devstack-platform-fedora-27
+    name: devstack-platform-fedora-latest
     parent: tempest-full
-    description: Fedora 27 platform test
-    nodeset: devstack-single-node-fedora-27
+    description: Fedora latest platform test
+    nodeset: devstack-single-node-fedora-latest
     voting: false
 
 - job:
@@ -482,7 +492,7 @@
         - devstack-platform-centos-7
         - devstack-platform-opensuse-423
         - devstack-platform-opensuse-tumbleweed
-        - devstack-platform-fedora-27
+        - devstack-platform-fedora-latest
         - devstack-multinode
         - devstack-unit-tests
     gate:
diff --git a/stack.sh b/stack.sh
index 6899fa0d8b..2528e2b46b 100755
--- a/stack.sh
+++ b/stack.sh
@@ -221,7 +221,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (xenial|artful|bionic|stretch|jessie|f25|f26|f27|opensuse-42.3|opensuse-tumbleweed|rhel7) ]]; then
+if [[ ! ${DISTRO} =~ (xenial|artful|bionic|stretch|jessie|f27|f28|opensuse-42.3|opensuse-tumbleweed|rhel7) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From 12579c3db7b28381c8ec97945aa23ee02d54d22b Mon Sep 17 00:00:00 2001
From: melanie witt <melwittt@gmail.com>
Date: Sat, 5 May 2018 23:55:32 +0000
Subject: [PATCH 1343/2409] Set console proxy configuration according to cells
 v2 setup

Change 969239029d4a13956747e6e0b850d6c6ab4035f0 completed the
conversion of console token authorization storage from the
nova-consoleauth service to the database backend. With this change,
console proxies need to be configured on a per cell basis instead
of globally.

There was a devstack change 6645cf7a26428f3af1e4739ac29c6a90b67f99dc
following it that re-enabled the novnc tempest tests, but the nova-next
job that runs the console proxies with TLS is *not* part of the normal
set of jobs that run on devstack changes (it's in the experimental
queue), so it was able to merge without the nova-next job passing.

This configures the nova console proxies in the per cell configuration
file if cells v2 is configured for multiple cells in order to pass the
nova-next job.

Closes-Bug: #1769286

Change-Id: Ic4fff4c59eda43dd1bc6e7b645b513b46b57c235
---
 lib/nova | 119 ++++++++++++++++++++++++++++++++-----------------------
 1 file changed, 69 insertions(+), 50 deletions(-)

diff --git a/lib/nova b/lib/nova
index 1489298ad2..0182996713 100644
--- a/lib/nova
+++ b/lib/nova
@@ -524,52 +524,6 @@ function create_nova_conf {
         iniset $NOVA_CONF DEFAULT notify_on_state_change "vm_and_task_state"
     fi
 
-    # All nova-compute workers need to know the vnc configuration options
-    # These settings don't hurt anything if n-xvnc and n-novnc are disabled
-    if is_service_enabled n-cpu; then
-        NOVNCPROXY_URL=${NOVNCPROXY_URL:-"http://$SERVICE_HOST:6080/vnc_auto.html"}
-        iniset $NOVA_CONF vnc novncproxy_base_url "$NOVNCPROXY_URL"
-        XVPVNCPROXY_URL=${XVPVNCPROXY_URL:-"http://$SERVICE_HOST:6081/console"}
-        iniset $NOVA_CONF vnc xvpvncproxy_base_url "$XVPVNCPROXY_URL"
-        SPICEHTML5PROXY_URL=${SPICEHTML5PROXY_URL:-"http://$SERVICE_HOST:6082/spice_auto.html"}
-        iniset $NOVA_CONF spice html5proxy_base_url "$SPICEHTML5PROXY_URL"
-    fi
-
-    if is_service_enabled n-novnc || is_service_enabled n-xvnc || [ "$NOVA_VNC_ENABLED" != False ]; then
-        # Address on which instance vncservers will listen on compute hosts.
-        # For multi-host, this should be the management ip of the compute host.
-        VNCSERVER_LISTEN=${VNCSERVER_LISTEN=$NOVA_SERVICE_LOCAL_HOST}
-        VNCSERVER_PROXYCLIENT_ADDRESS=${VNCSERVER_PROXYCLIENT_ADDRESS=$NOVA_SERVICE_LOCAL_HOST}
-        iniset $NOVA_CONF vnc server_listen "$VNCSERVER_LISTEN"
-        iniset $NOVA_CONF vnc server_proxyclient_address "$VNCSERVER_PROXYCLIENT_ADDRESS"
-        iniset $NOVA_CONF vnc novncproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
-        iniset $NOVA_CONF vnc xvpvncproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
-
-        if is_nova_console_proxy_compute_tls_enabled ; then
-            iniset $NOVA_CONF vnc auth_schemes "vencrypt"
-            iniset $NOVA_CONF vnc vencrypt_client_key "/etc/pki/nova-novnc/client-key.pem"
-            iniset $NOVA_CONF vnc vencrypt_client_cert "/etc/pki/nova-novnc/client-cert.pem"
-            iniset $NOVA_CONF vnc vencrypt_ca_certs "/etc/pki/nova-novnc/ca-cert.pem"
-
-            sudo mkdir -p /etc/pki/nova-novnc
-            deploy_int_CA /etc/pki/nova-novnc/ca-cert.pem
-            deploy_int_cert /etc/pki/nova-novnc/client-cert.pem /etc/pki/nova-novnc/client-key.pem
-        fi
-    else
-        iniset $NOVA_CONF vnc enabled false
-    fi
-
-    if is_service_enabled n-spice; then
-        # Address on which instance spiceservers will listen on compute hosts.
-        # For multi-host, this should be the management ip of the compute host.
-        SPICESERVER_PROXYCLIENT_ADDRESS=${SPICESERVER_PROXYCLIENT_ADDRESS=$NOVA_SERVICE_LOCAL_HOST}
-        SPICESERVER_LISTEN=${SPICESERVER_LISTEN=$NOVA_SERVICE_LOCAL_HOST}
-        iniset $NOVA_CONF spice enabled true
-        iniset $NOVA_CONF spice server_listen "$SPICESERVER_LISTEN"
-        iniset $NOVA_CONF spice server_proxyclient_address "$SPICESERVER_PROXYCLIENT_ADDRESS"
-        iniset $NOVA_CONF spice html5proxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
-    fi
-
     # Set the oslo messaging driver to the typical default. This does not
     # enable notifications, but it will allow them to function when enabled.
     iniset $NOVA_CONF oslo_messaging_notifications driver "messagingv2"
@@ -588,10 +542,6 @@ function create_nova_conf {
         iniset $NOVA_CONF oslo_middleware enable_proxy_headers_parsing True
     fi
 
-    if is_service_enabled n-sproxy; then
-        iniset $NOVA_CONF serial_console serialproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
-        iniset $NOVA_CONF serial_console enabled True
-    fi
     iniset $NOVA_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
 
     # Setup logging for nova-dhcpbridge command line
@@ -641,6 +591,75 @@ function create_nova_conf {
             setup_logging $conf
         done
     fi
+
+    # Console proxy configuration has to go after conductor configuration
+    # because the per cell config file nova_cellN.conf is cleared out as part
+    # of conductor configuration.
+    if [[ "${CELLSV2_SETUP}" == "singleconductor" ]]; then
+        configure_console_proxies
+    else
+        for i in $(seq 1 $NOVA_NUM_CELLS); do
+            local conf
+            conf=$(conductor_conf $i)
+            configure_console_proxies $conf
+        done
+    fi
+}
+
+function configure_console_proxies {
+    # Use the provided config file path or default to $NOVA_CONF.
+    local conf=${1:-$NOVA_CONF}
+
+    # All nova-compute workers need to know the vnc configuration options
+    # These settings don't hurt anything if n-xvnc and n-novnc are disabled
+    if is_service_enabled n-cpu; then
+        NOVNCPROXY_URL=${NOVNCPROXY_URL:-"http://$SERVICE_HOST:6080/vnc_auto.html"}
+        iniset $conf vnc novncproxy_base_url "$NOVNCPROXY_URL"
+        XVPVNCPROXY_URL=${XVPVNCPROXY_URL:-"http://$SERVICE_HOST:6081/console"}
+        iniset $conf vnc xvpvncproxy_base_url "$XVPVNCPROXY_URL"
+        SPICEHTML5PROXY_URL=${SPICEHTML5PROXY_URL:-"http://$SERVICE_HOST:6082/spice_auto.html"}
+        iniset $conf spice html5proxy_base_url "$SPICEHTML5PROXY_URL"
+    fi
+
+    if is_service_enabled n-novnc || is_service_enabled n-xvnc || [ "$NOVA_VNC_ENABLED" != False ]; then
+        # Address on which instance vncservers will listen on compute hosts.
+        # For multi-host, this should be the management ip of the compute host.
+        VNCSERVER_LISTEN=${VNCSERVER_LISTEN=$NOVA_SERVICE_LOCAL_HOST}
+        VNCSERVER_PROXYCLIENT_ADDRESS=${VNCSERVER_PROXYCLIENT_ADDRESS=$NOVA_SERVICE_LOCAL_HOST}
+        iniset $conf vnc server_listen "$VNCSERVER_LISTEN"
+        iniset $conf vnc server_proxyclient_address "$VNCSERVER_PROXYCLIENT_ADDRESS"
+        iniset $conf vnc novncproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
+        iniset $conf vnc xvpvncproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
+
+        if is_nova_console_proxy_compute_tls_enabled ; then
+            iniset $conf vnc auth_schemes "vencrypt"
+            iniset $conf vnc vencrypt_client_key "/etc/pki/nova-novnc/client-key.pem"
+            iniset $conf vnc vencrypt_client_cert "/etc/pki/nova-novnc/client-cert.pem"
+            iniset $conf vnc vencrypt_ca_certs "/etc/pki/nova-novnc/ca-cert.pem"
+
+            sudo mkdir -p /etc/pki/nova-novnc
+            deploy_int_CA /etc/pki/nova-novnc/ca-cert.pem
+            deploy_int_cert /etc/pki/nova-novnc/client-cert.pem /etc/pki/nova-novnc/client-key.pem
+        fi
+    else
+        iniset $conf vnc enabled false
+    fi
+
+    if is_service_enabled n-spice; then
+        # Address on which instance spiceservers will listen on compute hosts.
+        # For multi-host, this should be the management ip of the compute host.
+        SPICESERVER_PROXYCLIENT_ADDRESS=${SPICESERVER_PROXYCLIENT_ADDRESS=$NOVA_SERVICE_LOCAL_HOST}
+        SPICESERVER_LISTEN=${SPICESERVER_LISTEN=$NOVA_SERVICE_LOCAL_HOST}
+        iniset $conf spice enabled true
+        iniset $conf spice server_listen "$SPICESERVER_LISTEN"
+        iniset $conf spice server_proxyclient_address "$SPICESERVER_PROXYCLIENT_ADDRESS"
+        iniset $conf spice html5proxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
+    fi
+
+    if is_service_enabled n-sproxy; then
+        iniset $conf serial_console serialproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
+        iniset $conf serial_console enabled True
+    fi
 }
 
 function init_nova_service_user_conf {

From f774ecf4f9f44b38f345bb614b72c83b3ec15136 Mon Sep 17 00:00:00 2001
From: Matt Smith <mss@datera.io>
Date: Mon, 7 May 2018 16:43:56 -0500
Subject: [PATCH 1344/2409] Changing openrc default Cinder API version to v3

* v3 is a superset of v2 and has been the defacto Cinder version for
several years now.
* Devstack installs Cinder v3 API by default, so the default environment
variables should reflect this.

Change-Id: I86e1ae4e020e2be043cf8e190d7959b65b6c093c
---
 openrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/openrc b/openrc
index 37724c552e..cc8cad406c 100644
--- a/openrc
+++ b/openrc
@@ -108,5 +108,5 @@ fi
 
 # Currently cinderclient needs you to specify the *volume api* version. This
 # needs to match the config of your catalog returned by Keystone.
-export CINDER_VERSION=${CINDER_VERSION:-2}
+export CINDER_VERSION=${CINDER_VERSION:-3}
 export OS_VOLUME_API_VERSION=${OS_VOLUME_API_VERSION:-$CINDER_VERSION}

From b89bfa21b0e144d8160478b54a45a1087ea3e1df Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Tue, 8 May 2018 06:12:17 +0000
Subject: [PATCH 1345/2409] Updated from generate-devstack-plugins-list

Change-Id: I202b685740fe2b4ea53d115524d3bad01b038af6
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index c21e0efcc8..92c63800b9 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -163,6 +163,7 @@ scalpels                               `git://git.openstack.org/openstack/scalpe
 searchlight                            `git://git.openstack.org/openstack/searchlight <https://git.openstack.org/cgit/openstack/searchlight>`__
 searchlight-ui                         `git://git.openstack.org/openstack/searchlight-ui <https://git.openstack.org/cgit/openstack/searchlight-ui>`__
 senlin                                 `git://git.openstack.org/openstack/senlin <https://git.openstack.org/cgit/openstack/senlin>`__
+slogging                               `git://git.openstack.org/openstack/slogging <https://git.openstack.org/cgit/openstack/slogging>`__
 solum                                  `git://git.openstack.org/openstack/solum <https://git.openstack.org/cgit/openstack/solum>`__
 stackube                               `git://git.openstack.org/openstack/stackube <https://git.openstack.org/cgit/openstack/stackube>`__
 storlets                               `git://git.openstack.org/openstack/storlets <https://git.openstack.org/cgit/openstack/storlets>`__

From 827f6c1a4a8af662eba038da0fd0ab5eab1305c8 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Thu, 10 May 2018 06:19:41 +0000
Subject: [PATCH 1346/2409] Updated from generate-devstack-plugins-list

Change-Id: I3695c066799fb14f63050bf1ec05301b1d132d5d
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 92c63800b9..9b2cb7eec1 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -26,6 +26,7 @@ Plugin Name                            URL
 ====================================== ===
 almanach                               `git://git.openstack.org/openstack/almanach <https://git.openstack.org/cgit/openstack/almanach>`__
 aodh                                   `git://git.openstack.org/openstack/aodh <https://git.openstack.org/cgit/openstack/aodh>`__
+apmec                                  `git://git.openstack.org/openstack/apmec <https://git.openstack.org/cgit/openstack/apmec>`__
 astara                                 `git://git.openstack.org/openstack/astara <https://git.openstack.org/cgit/openstack/astara>`__
 barbican                               `git://git.openstack.org/openstack/barbican <https://git.openstack.org/cgit/openstack/barbican>`__
 bilean                                 `git://git.openstack.org/openstack/bilean <https://git.openstack.org/cgit/openstack/bilean>`__

From 65ad79409537a76aec5cdba4360094a3047a025d Mon Sep 17 00:00:00 2001
From: melanie witt <melwittt@gmail.com>
Date: Wed, 9 May 2018 17:55:40 +0000
Subject: [PATCH 1347/2409] Configure console proxy settings for nova-cpu.conf

Change 12579c3db7b28381c8ec97945aa23ee02d54d22b moved console-related
settings from the global nova.conf to the per cell nova_cellN.conf
because of a recent change in nova that moved console token
authorizations from the nova-consoleauth service backend to the
database backend and thus changed the deployment layout requirements
from global console proxies to per cell console proxies.

The change erroneously also removed console configuration settings from
the nova-compute config file nova-cpu.conf because the nova-cpu.conf
begins as a copy of the global nova.conf.

This adds configuration of console proxies to the nova-cpu.conf in the
start_nova_compute routine. The settings have also been split up to
clarify which settings are used by the console proxy and which settings
are used by nova-compute.

Closes-Bug: #1770143

Change-Id: I2a98795674183e2c05c29e15a3a3bad1a22c0891
---
 lib/nova | 54 +++++++++++++++++++++++++++++++++++-------------------
 1 file changed, 35 insertions(+), 19 deletions(-)

diff --git a/lib/nova b/lib/nova
index 0182996713..b0af48aec4 100644
--- a/lib/nova
+++ b/lib/nova
@@ -606,19 +606,16 @@ function create_nova_conf {
     fi
 }
 
-function configure_console_proxies {
-    # Use the provided config file path or default to $NOVA_CONF.
-    local conf=${1:-$NOVA_CONF}
-
+function configure_console_compute {
     # All nova-compute workers need to know the vnc configuration options
     # These settings don't hurt anything if n-xvnc and n-novnc are disabled
     if is_service_enabled n-cpu; then
         NOVNCPROXY_URL=${NOVNCPROXY_URL:-"http://$SERVICE_HOST:6080/vnc_auto.html"}
-        iniset $conf vnc novncproxy_base_url "$NOVNCPROXY_URL"
+        iniset $NOVA_CPU_CONF vnc novncproxy_base_url "$NOVNCPROXY_URL"
         XVPVNCPROXY_URL=${XVPVNCPROXY_URL:-"http://$SERVICE_HOST:6081/console"}
-        iniset $conf vnc xvpvncproxy_base_url "$XVPVNCPROXY_URL"
+        iniset $NOVA_CPU_CONF vnc xvpvncproxy_base_url "$XVPVNCPROXY_URL"
         SPICEHTML5PROXY_URL=${SPICEHTML5PROXY_URL:-"http://$SERVICE_HOST:6082/spice_auto.html"}
-        iniset $conf spice html5proxy_base_url "$SPICEHTML5PROXY_URL"
+        iniset $NOVA_CPU_CONF spice html5proxy_base_url "$SPICEHTML5PROXY_URL"
     fi
 
     if is_service_enabled n-novnc || is_service_enabled n-xvnc || [ "$NOVA_VNC_ENABLED" != False ]; then
@@ -626,8 +623,32 @@ function configure_console_proxies {
         # For multi-host, this should be the management ip of the compute host.
         VNCSERVER_LISTEN=${VNCSERVER_LISTEN=$NOVA_SERVICE_LOCAL_HOST}
         VNCSERVER_PROXYCLIENT_ADDRESS=${VNCSERVER_PROXYCLIENT_ADDRESS=$NOVA_SERVICE_LOCAL_HOST}
-        iniset $conf vnc server_listen "$VNCSERVER_LISTEN"
-        iniset $conf vnc server_proxyclient_address "$VNCSERVER_PROXYCLIENT_ADDRESS"
+        iniset $NOVA_CPU_CONF vnc server_listen "$VNCSERVER_LISTEN"
+        iniset $NOVA_CPU_CONF vnc server_proxyclient_address "$VNCSERVER_PROXYCLIENT_ADDRESS"
+    else
+        iniset $NOVA_CPU_CONF vnc enabled false
+    fi
+
+    if is_service_enabled n-spice; then
+        # Address on which instance spiceservers will listen on compute hosts.
+        # For multi-host, this should be the management ip of the compute host.
+        SPICESERVER_PROXYCLIENT_ADDRESS=${SPICESERVER_PROXYCLIENT_ADDRESS=$NOVA_SERVICE_LOCAL_HOST}
+        SPICESERVER_LISTEN=${SPICESERVER_LISTEN=$NOVA_SERVICE_LOCAL_HOST}
+        iniset $NOVA_CPU_CONF spice enabled true
+        iniset $NOVA_CPU_CONF spice server_listen "$SPICESERVER_LISTEN"
+        iniset $NOVA_CPU_CONF spice server_proxyclient_address "$SPICESERVER_PROXYCLIENT_ADDRESS"
+    fi
+
+    if is_service_enabled n-sproxy; then
+        iniset $NOVA_CPU_CONF serial_console enabled True
+    fi
+}
+
+function configure_console_proxies {
+    # Use the provided config file path or default to $NOVA_CONF.
+    local conf=${1:-$NOVA_CONF}
+
+    if is_service_enabled n-novnc || is_service_enabled n-xvnc || [ "$NOVA_VNC_ENABLED" != False ]; then
         iniset $conf vnc novncproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
         iniset $conf vnc xvpvncproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
 
@@ -641,24 +662,14 @@ function configure_console_proxies {
             deploy_int_CA /etc/pki/nova-novnc/ca-cert.pem
             deploy_int_cert /etc/pki/nova-novnc/client-cert.pem /etc/pki/nova-novnc/client-key.pem
         fi
-    else
-        iniset $conf vnc enabled false
     fi
 
     if is_service_enabled n-spice; then
-        # Address on which instance spiceservers will listen on compute hosts.
-        # For multi-host, this should be the management ip of the compute host.
-        SPICESERVER_PROXYCLIENT_ADDRESS=${SPICESERVER_PROXYCLIENT_ADDRESS=$NOVA_SERVICE_LOCAL_HOST}
-        SPICESERVER_LISTEN=${SPICESERVER_LISTEN=$NOVA_SERVICE_LOCAL_HOST}
-        iniset $conf spice enabled true
-        iniset $conf spice server_listen "$SPICESERVER_LISTEN"
-        iniset $conf spice server_proxyclient_address "$SPICESERVER_PROXYCLIENT_ADDRESS"
         iniset $conf spice html5proxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
     fi
 
     if is_service_enabled n-sproxy; then
         iniset $conf serial_console serialproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
-        iniset $conf serial_console enabled True
     fi
 }
 
@@ -911,6 +922,11 @@ function start_nova_compute {
         iniset_rpc_backend nova $NOVA_CPU_CONF DEFAULT "nova_cell${NOVA_CPU_CELL}"
     fi
 
+    # Console proxies were configured earlier in create_nova_conf. Now that the
+    # nova-cpu.conf has been created, configure the console settings required
+    # by the compute process.
+    configure_console_compute
+
     if [[ "$VIRT_DRIVER" = 'libvirt' ]]; then
         # The group **$LIBVIRT_GROUP** is added to the current user in this script.
         # ``sg`` is used in run_process to execute nova-compute as a member of the

From a99ab7002cfea539e035e203c0d05415fac3eb6a Mon Sep 17 00:00:00 2001
From: Jakub Libosvar <libosvar@redhat.com>
Date: Mon, 14 May 2018 16:12:52 +0200
Subject: [PATCH 1348/2409] neutron: Use openvswitch firewall driver by default

openvswitch firewall has been in Neutron tree since Newton and has gone
through lots of improvements since including simple upgrade path from
the iptables hybrid driver.

We have a tempest job running in Neutron tree with openvswitch firewall
that's been voting and stable for a while. For neutron_tempest_plugin,
we have had the openvswitch firewall in use since the beginning.

This patch proposes openvswitch firewall driver to become a default
driver for openvswitch agent deployments.

Change-Id: If26d0180e459210511f25f1faa83dd8ccea25ff4
---
 lib/neutron                  | 4 ++--
 lib/neutron_plugins/ovs_base | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index cef8d1f2ae..3cad80a414 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -220,8 +220,8 @@ function configure_neutron_new {
         if [[ $NEUTRON_AGENT == "linuxbridge" ]]; then
             iniset $NEUTRON_CORE_PLUGIN_CONF securitygroup firewall_driver iptables
             iniset $NEUTRON_CORE_PLUGIN_CONF vxlan local_ip $HOST_IP
-        else
-            iniset $NEUTRON_CORE_PLUGIN_CONF securitygroup firewall_driver iptables_hybrid
+        elif [[ $NEUTRON_AGENT == "openvswitch" ]]; then
+            iniset $NEUTRON_CORE_PLUGIN_CONF securitygroup firewall_driver openvswitch
             iniset $NEUTRON_CORE_PLUGIN_CONF ovs local_ip $HOST_IP
 
             if [[ "$NEUTRON_DISTRIBUTED_ROUTING" = "True" ]]; then
diff --git a/lib/neutron_plugins/ovs_base b/lib/neutron_plugins/ovs_base
index 36e2ed2ca2..523024e2fe 100644
--- a/lib/neutron_plugins/ovs_base
+++ b/lib/neutron_plugins/ovs_base
@@ -86,7 +86,7 @@ function _neutron_ovs_base_install_agent_packages {
 
 function _neutron_ovs_base_configure_firewall_driver {
     if [[ "$Q_USE_SECGROUP" == "True" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver iptables_hybrid
+        iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver openvswitch
         if ! running_in_container; then
             enable_kernel_bridge_firewall
         fi

From 306fca807bbe69d104aeb3a135eceb18d47e7f93 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Mon, 14 May 2018 11:31:54 -0400
Subject: [PATCH 1349/2409] Add dosfstools to files

dosfstools provides mkfs.vfat which is needed if n-cpu is
configured with 'config_drive_format=vfat'.

Change-Id: If1e1537a079e71847d91ae03ed0c18290a467c4e
Related-Bug: #1770640
---
 files/debs/n-cpu      | 1 +
 files/rpms-suse/n-cpu | 1 +
 files/rpms/n-cpu      | 1 +
 3 files changed, 3 insertions(+)

diff --git a/files/debs/n-cpu b/files/debs/n-cpu
index d8bbf59d07..636644f10d 100644
--- a/files/debs/n-cpu
+++ b/files/debs/n-cpu
@@ -1,4 +1,5 @@
 cryptsetup
+dosfstools
 genisoimage
 gir1.2-libosinfo-1.0
 lvm2 # NOPRIME
diff --git a/files/rpms-suse/n-cpu b/files/rpms-suse/n-cpu
index d0c572e97d..c11e9f0763 100644
--- a/files/rpms-suse/n-cpu
+++ b/files/rpms-suse/n-cpu
@@ -1,4 +1,5 @@
 cryptsetup
+dosfstools
 libosinfo
 lvm2
 mkisofs
diff --git a/files/rpms/n-cpu b/files/rpms/n-cpu
index 26c5ced196..68e5472685 100644
--- a/files/rpms/n-cpu
+++ b/files/rpms/n-cpu
@@ -1,4 +1,5 @@
 cryptsetup
+dosfstools
 genisoimage
 iscsi-initiator-utils
 libosinfo

From f8755bd468cae234ca7acca018ccee31f0e474b2 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Wed, 16 May 2018 14:40:01 +0000
Subject: [PATCH 1350/2409] Allow plugins to override initial network creation

The same code is already in place for the new lib/neutron library, allow
this functionality to be used also when the neutron legacy services are
still being deployed. This was mangled in [0].

[0] I868afeb065d80d8ccd57630b90658e330ab94251

Change-Id: I7214c4893943fbfbeb42ad140f433eecd6c3e9f0
---
 stack.sh | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index 2528e2b46b..446d894f8a 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1315,7 +1315,14 @@ fi
 # Once neutron agents are started setup initial network elements
 if is_service_enabled q-svc && [[ "$NEUTRON_CREATE_INITIAL_NETWORKS" == "True" ]]; then
     echo_summary "Creating initial neutron network elements"
-    create_neutron_initial_network
+    # Here's where plugins can wire up their own networks instead
+    # of the code in lib/neutron_plugins/services/l3
+    if type -p neutron_plugin_create_initial_networks > /dev/null; then
+        neutron_plugin_create_initial_networks
+    else
+        create_neutron_initial_network
+    fi
+
 fi
 
 if is_service_enabled nova; then

From 1fccf0b3391ca9d60fa47cc2f9f7ccbae841d483 Mon Sep 17 00:00:00 2001
From: Sumit Jamgade <sjamgade@suse.com>
Date: Thu, 24 May 2018 16:24:00 +0200
Subject: [PATCH 1351/2409] swift expects an internal client config to start

using the sample form the source

Change-Id: I01874b650cd5d662ca2feabe58cc880155c9421e
---
 lib/swift | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/swift b/lib/swift
index 933af1005b..762f1dd8fc 100644
--- a/lib/swift
+++ b/lib/swift
@@ -368,6 +368,7 @@ function configure_swift {
 
     SWIFT_CONFIG_PROXY_SERVER=${SWIFT_CONF_DIR}/proxy-server.conf
     cp ${SWIFT_DIR}/etc/proxy-server.conf-sample ${SWIFT_CONFIG_PROXY_SERVER}
+    cp ${SWIFT_DIR}/etc/internal-client.conf-sample ${SWIFT_CONF_DIR}/internal-client.conf
 
     # To run container sync feature introduced in Swift ver 1.12.0,
     # container sync "realm" is added in container-sync-realms.conf

From 43f25c0fc3bee28ccd50b1bd6c40046b5cd12b4f Mon Sep 17 00:00:00 2001
From: Stephen Finucane <sfinucan@redhat.com>
Date: Thu, 31 May 2018 14:49:59 +0100
Subject: [PATCH 1352/2409] doc: Describe running a command as a separate group

Some commands must be run as a separate group to work. Users can use the
'sg' tool to do this.

This may be assumed knowledge for many users but it's helpful to note in
this, the definitive resource for DevStack's systemd integration.

Change-Id: I271c1d21b44fa972c152780c1caa01c21c265159
Signed-off-by: Stephen Finucane <sfinucan@redhat.com>
---
 doc/source/systemd.rst | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/doc/source/systemd.rst b/doc/source/systemd.rst
index 9cc401771a..1bc9911879 100644
--- a/doc/source/systemd.rst
+++ b/doc/source/systemd.rst
@@ -152,6 +152,19 @@ Invoke the command manually::
 
   /usr/local/bin/nova-scheduler --config-file /etc/nova/nova.conf
 
+Some executables, such as :program:`nova-compute`, will need to be executed
+with a particular group. This will be shown in the systemd unit file::
+
+  sudo systemctl cat devstack@n-cpu.service | grep Group
+
+::
+
+  Group = libvirt
+
+Use the :program:`sg` tool to execute the command as this group::
+
+  sg libvirt -c '/usr/local/bin/nova-compute --config-file /etc/nova/nova-cpu.conf'
+
 Using remote-pdb
 ----------------
 

From 0f4af398a98e7a9e742162910135e300521ea026 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Sat, 2 Jun 2018 09:34:20 -0400
Subject: [PATCH 1353/2409] Set workers=$API_WORKERS in glance-registry.conf

We use $API_WORKERS to throttle the number of workers
in other services but were not doing it for g-reg for
some reason, which by default will run ncpu workers
up to a limit of 8.

Change-Id: Idc81ce05546e6d625c10e2229256eafbe7c057a5
Closes-Bug: #1774781
---
 lib/glance | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/glance b/lib/glance
index 6a0e719cad..528a05fcf8 100644
--- a/lib/glance
+++ b/lib/glance
@@ -114,6 +114,7 @@ function configure_glance {
     # Set non-default configuration options for registry
     iniset $GLANCE_REGISTRY_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
     iniset $GLANCE_REGISTRY_CONF DEFAULT bind_host $GLANCE_SERVICE_LISTEN_ADDRESS
+    iniset $GLANCE_REGISTRY_CONF DEFAULT workers $API_WORKERS
     local dburl
     dburl=`database_connection_url glance`
     iniset $GLANCE_REGISTRY_CONF database connection $dburl

From 5e832d3061a9edd77dff6b9a051df7f116104ea2 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Sat, 2 Jun 2018 12:40:58 -0400
Subject: [PATCH 1354/2409] Modernize VIRT_DRIVER=fake usage

This makes three changes:

1. The quota options set when using the fake
   virt driver have been renamed so we're getting
   deprecation warnings on using the old names.
   Rather than set each quota limit value individually,
   we can just use the noop quota driver for the same
   effect.

2. The enabled_filters list for the scheduler was last
   updated when using the fake virt driver back in Juno
   via Ic7ec87e4d497d9db58eec93f2b304fe9770a2bbc - with
   the Placement service, we don't need the CoreFilter,
   RamFilter or DiskFilter. Also, in general, we just
   don't need to hard-code a list of scheduler filters
   when using the fake virt driver. If one needs to set
   their own scheduler filter list, they can do so using
   the $FILTERS variable (or post-config for nova.conf).

3. The largeops job, which ran the Tempest scenario tests,
   has been gone for a few years now, as have the Tempest
   scenario tests, so the API_WORKERS modification when
   using the fake virt driver should be removed. If we had
   a CI job like the largeops job today, we would set the
   worker config via the job rather than in devstack.

Change-Id: I8d2bb2af40b5db8a555482a0852b1604aec29f15
---
 lib/nova_plugins/hypervisor-fake | 13 +------------
 stackrc                          |  7 +------
 2 files changed, 2 insertions(+), 18 deletions(-)

diff --git a/lib/nova_plugins/hypervisor-fake b/lib/nova_plugins/hypervisor-fake
index 49c8dee83a..87ee49fa4b 100644
--- a/lib/nova_plugins/hypervisor-fake
+++ b/lib/nova_plugins/hypervisor-fake
@@ -38,18 +38,7 @@ function cleanup_nova_hypervisor {
 function configure_nova_hypervisor {
     iniset $NOVA_CONF DEFAULT compute_driver "fake.FakeDriver"
     # Disable arbitrary limits
-    iniset $NOVA_CONF DEFAULT quota_instances -1
-    iniset $NOVA_CONF DEFAULT quota_cores -1
-    iniset $NOVA_CONF DEFAULT quota_ram -1
-    iniset $NOVA_CONF DEFAULT quota_floating_ips -1
-    iniset $NOVA_CONF DEFAULT quota_fixed_ips -1
-    iniset $NOVA_CONF DEFAULT quota_metadata_items -1
-    iniset $NOVA_CONF DEFAULT quota_injected_files -1
-    iniset $NOVA_CONF DEFAULT quota_injected_file_path_length -1
-    iniset $NOVA_CONF DEFAULT quota_security_groups -1
-    iniset $NOVA_CONF DEFAULT quota_security_group_rules -1
-    iniset $NOVA_CONF DEFAULT quota_key_pairs -1
-    iniset $NOVA_CONF filter_scheduler enabled_filters "RetryFilter,AvailabilityZoneFilter,ComputeFilter,ComputeCapabilitiesFilter,ImagePropertiesFilter,CoreFilter,RamFilter,DiskFilter"
+    iniset $NOVA_CONF quota driver nova.quota.NoopQuotaDriver
 }
 
 # install_nova_hypervisor() - Install external components
diff --git a/stackrc b/stackrc
index 3c4e4370e8..6c4d7d6848 100644
--- a/stackrc
+++ b/stackrc
@@ -800,12 +800,7 @@ SERVICE_PROTOCOL=${SERVICE_PROTOCOL:-http}
 # the memory used where there are a large number of CPUs present
 # (the default number of workers for many services is the number of CPUs)
 # Also sets the minimum number of workers to 2.
-if [[ "$VIRT_DRIVER" = 'fake' ]]; then
-    # we need more workers for the large ops job
-    API_WORKERS=${API_WORKERS:=$(( ($(nproc)/2)<2 ? 2 : ($(nproc)/2) ))}
-else
-    API_WORKERS=${API_WORKERS:=$(( ($(nproc)/4)<2 ? 2 : ($(nproc)/4) ))}
-fi
+API_WORKERS=${API_WORKERS:=$(( ($(nproc)/4)<2 ? 2 : ($(nproc)/4) ))}
 
 # Service startup timeout
 SERVICE_TIMEOUT=${SERVICE_TIMEOUT:-60}

From c7c67658c1daa40bfcdddfc99d1e05a70d205e66 Mon Sep 17 00:00:00 2001
From: Luigi Toscano <ltoscano@redhat.com>
Date: Mon, 4 Jun 2018 10:59:57 +0200
Subject: [PATCH 1355/2409] iniset: fix handling of keys with spaces

Ceph for example uses them. Creation already worked, but not
updates of existing keys.

Closes-Bug: 1774956

Change-Id: I20cb61c08079b9cd9ad56ac875525abf1442bff6
---
 inc/ini-config           |  2 +-
 tests/test_ini_config.sh | 22 ++++++++++++++++++++--
 2 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/inc/ini-config b/inc/ini-config
index 68d48d197b..6fe7788158 100644
--- a/inc/ini-config
+++ b/inc/ini-config
@@ -200,7 +200,7 @@ $option = $value
         local sep
         sep=$(echo -ne "\x01")
         # Replace it
-        $sudo sed -i -e '/^\['${section}'\]/,/^\[.*\]/ s'${sep}'^\('${option}'[ \t]*=[ \t]*\).*$'${sep}'\1'"${value}"${sep} "$file"
+        $sudo sed -i -e '/^\['${section}'\]/,/^\[.*\]/ s'${sep}'^\('"${option}"'[ \t]*=[ \t]*\).*$'${sep}'\1'"${value}"${sep} "$file"
     fi
     $xtrace
 }
diff --git a/tests/test_ini_config.sh b/tests/test_ini_config.sh
index a5e110736e..f7dc89a28d 100755
--- a/tests/test_ini_config.sh
+++ b/tests/test_ini_config.sh
@@ -44,6 +44,9 @@ empty =
 multi = foo1
 multi = foo2
 
+[key_with_spaces]
+rgw special key = something
+
 # inidelete(a)
 [del_separate_options]
 a=b
@@ -82,8 +85,9 @@ fi
 
 # test iniget_sections
 VAL=$(iniget_sections "${TEST_INI}")
-assert_equal "$VAL" "default aaa bbb ccc ddd eee del_separate_options \
-del_same_option del_missing_option del_missing_option_multi del_no_options"
+assert_equal "$VAL" "default aaa bbb ccc ddd eee key_with_spaces \
+del_separate_options del_same_option del_missing_option \
+del_missing_option_multi del_no_options"
 
 # Test with missing arguments
 BEFORE=$(cat ${TEST_INI})
@@ -209,6 +213,20 @@ iniset $SUDO_ARG ${INI_TMP_ETC_DIR}/test.new.ini test foo bar
 VAL=$(iniget ${INI_TMP_ETC_DIR}/test.new.ini test foo)
 assert_equal "$VAL" "bar" "iniset created file"
 
+# test creation of keys with spaces
+iniset ${SUDO_ARG} ${TEST_INI} key_with_spaces "rgw another key" somethingelse
+VAL=$(iniget ${TEST_INI} key_with_spaces "rgw another key")
+assert_equal "$VAL" "somethingelse" "iniset created a key with spaces"
+
+# test update of keys with spaces
+iniset ${SUDO_ARG} ${TEST_INI} key_with_spaces "rgw special key" newvalue
+VAL=$(iniget ${TEST_INI} key_with_spaces "rgw special key")
+assert_equal "$VAL" "newvalue" "iniset updated a key with spaces"
+
+inidelete ${SUDO_ARG} ${TEST_INI} key_with_spaces "rgw another key"
+VAL=$(iniget ${TEST_INI} key_with_spaces "rgw another key")
+assert_empty VAL "inidelete removed a key with spaces"
+
 $SUDO rm -rf ${INI_TMP_DIR}
 
 report_results

From 51aec325e6252703371ab001bea0853af05ca2d8 Mon Sep 17 00:00:00 2001
From: qingszhao <zhao.daqing@99cloud.net>
Date: Tue, 12 Jun 2018 08:25:20 +0800
Subject: [PATCH 1356/2409] fix tox python3 overrides

We want to default to running all tox environments under python 3, so
set the basepython value in each environment.

We do not want to specify a minor version number, because we do not
want to have to update the file every time we upgrade python.

We do not want to set the override once in testenv, because that
breaks the more specific versions used in default environments like
py35 and py36.

Change-Id: Id83cb3cdd62517045c45388f88cb3de0e3d75da1
---
 tox.ini | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/tox.ini b/tox.ini
index 74436b0f26..f643fdb930 100644
--- a/tox.ini
+++ b/tox.ini
@@ -8,6 +8,7 @@ usedevelop = False
 install_command = pip install {opts} {packages}
 
 [testenv:bashate]
+basepython = python3
 # if you want to test out some changes you have made to bashate
 # against devstack, just set BASHATE_INSTALL_PATH=/path/... to your
 # modified bashate tree
@@ -34,6 +35,7 @@ commands = bash -c "find {toxinidir}             \
          -print0 | xargs -0 bashate -v -iE006 -eE005,E042"
 
 [testenv:docs]
+basepython = python3
 deps = -r{toxinidir}/doc/requirements.txt
 whitelist_externals = bash
 setenv =
@@ -42,5 +44,6 @@ commands =
   python setup.py build_sphinx
 
 [testenv:venv]
+basepython = python3
 deps = -r{toxinidir}/doc/requirements.txt
 commands = {posargs}

From 0417858afa5cb65726579640231019de2215e530 Mon Sep 17 00:00:00 2001
From: Doug Hellmann <doug@doughellmann.com>
Date: Tue, 12 Jun 2018 15:37:00 -0400
Subject: [PATCH 1357/2409] fix typo in python3_version

The function was using an undefined variable to show the version of
python3 being used.

Change-Id: Ibc956975d620ed5174de8823f9c202a680c56aaf
Signed-off-by: Doug Hellmann <doug@doughellmann.com>
---
 functions-common | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index b1b0995a79..25e28bd74a 100644
--- a/functions-common
+++ b/functions-common
@@ -2128,7 +2128,7 @@ function python_version {
 function python3_version {
     local python3_version
     python3_version=$(_get_python_version python3)
-    echo "python${python_version}"
+    echo "python${python3_version}"
 }
 
 

From 7f33552d347f400fc1f2c290da3d3fa863197cee Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Thu, 14 Jun 2018 21:11:10 +1000
Subject: [PATCH 1358/2409] Switch to dnf when it exists

This has all been around for a *long* time, like when dnf was a weird
new thing.  Now it's the opposite and yum is a weird old thing :)
Choose it by default for platforms with it (Fedora, for now).

Change-Id: Id2bd7d145354b996de31944929fd0267ec24a08e
---
 stackrc | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/stackrc b/stackrc
index 3c4e4370e8..66d6f238a5 100644
--- a/stackrc
+++ b/stackrc
@@ -819,11 +819,14 @@ SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT=${SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT:-5}
 # Service graceful shutdown timeout
 WORKER_TIMEOUT=${WORKER_TIMEOUT:-90}
 
-# Support alternative yum -- in future Fedora 'dnf' will become the
-# only supported installer, but for now 'yum' and 'dnf' are both
-# available in parallel with compatible CLIs.  Allow manual switching
-# till we get to the point we need to handle this automatically
-YUM=${YUM:-yum}
+# Choose DNF on RedHat/Fedora platforms with it, or otherwise default
+# to YUM.  Can remove this when only dnf is supported (i.e. centos7
+# disappears)
+if [[ -e /usr/bin/dnf ]]; then
+    YUM=${YUM:-dnf}
+else
+    YUM=${YUM:-yum}
+fi
 
 # Common Configuration
 # --------------------

From 8e5f8c29b27c8dc83da31fbce5d92a173b91ba10 Mon Sep 17 00:00:00 2001
From: "James E. Blair" <jeblair@redhat.com>
Date: Fri, 15 Jun 2018 10:10:35 -0700
Subject: [PATCH 1359/2409] Add the project under test to LIBS_FROM_GIT

This automatically always adds the project under test to LIBS_FROM_GIT
which effectively makes the normal "tempest full" job the same as the
"forward testing" job when it is applied to a library repo.

Change-Id: Ibbdd8a86e0ff55f67bef73e08e693b34a61b24df
---
 roles/write-devstack-local-conf/README.rst    | 11 ++++++-----
 .../library/devstack_local_conf.py            | 19 +++++++++++++------
 .../write-devstack-local-conf/library/test.py | 17 ++++++++++++-----
 .../write-devstack-local-conf/tasks/main.yaml |  1 +
 4 files changed, 32 insertions(+), 16 deletions(-)

diff --git a/roles/write-devstack-local-conf/README.rst b/roles/write-devstack-local-conf/README.rst
index bfce9c98cd..e9739cdea8 100644
--- a/roles/write-devstack-local-conf/README.rst
+++ b/roles/write-devstack-local-conf/README.rst
@@ -22,11 +22,12 @@ Write the local.conf file for use by devstack
 
    As a special case, the variable ``LIBS_FROM_GIT`` will be
    constructed automatically from the projects which appear in the
-   ``required-projects`` list defined by the job.  To instruct
-   devstack to install a library from source rather than pypi, simply
-   add that library to the job's ``required-projects`` list.  To
-   override the automatically-generated value, set ``LIBS_FROM_GIT``
-   in ``devstack_localrc`` to the desired value.
+   ``required-projects`` list defined by the job plus the project of
+   the change under test.  To instruct devstack to install a library
+   from source rather than pypi, simply add that library to the job's
+   ``required-projects`` list.  To override the
+   automatically-generated value, set ``LIBS_FROM_GIT`` in
+   ``devstack_localrc`` to the desired value.
 
 .. zuul:rolevar:: devstack_local_conf
    :type: dict
diff --git a/roles/write-devstack-local-conf/library/devstack_local_conf.py b/roles/write-devstack-local-conf/library/devstack_local_conf.py
index 9728fef37b..bba7e31f96 100644
--- a/roles/write-devstack-local-conf/library/devstack_local_conf.py
+++ b/roles/write-devstack-local-conf/library/devstack_local_conf.py
@@ -207,12 +207,13 @@ def getPlugins(self):
 class LocalConf(object):
 
     def __init__(self, localrc, localconf, base_services, services, plugins,
-                 base_dir, projects):
+                 base_dir, projects, project):
         self.localrc = []
         self.meta_sections = {}
         self.plugin_deps = {}
         self.base_dir = base_dir
         self.projects = projects
+        self.project = project
         if plugins:
             self.handle_plugins(plugins)
         if services or base_services:
@@ -249,11 +250,15 @@ def handle_localrc(self, localrc):
                 if k == 'LIBS_FROM_GIT':
                     lfg = True
 
-        if not lfg and self.projects:
+        if not lfg and (self.projects or self.project):
             required_projects = []
-            for project_name, project_info in self.projects.items():
-                if project_info.get('required'):
-                    required_projects.append(project_info['short_name'])
+            if self.projects:
+                for project_name, project_info in self.projects.items():
+                    if project_info.get('required'):
+                        required_projects.append(project_info['short_name'])
+            if self.project:
+                if self.project['short_name'] not in required_projects:
+                    required_projects.append(self.project['short_name'])
             if required_projects:
                 self.localrc.append('LIBS_FROM_GIT={}'.format(
                     ','.join(required_projects)))
@@ -291,6 +296,7 @@ def main():
             base_dir=dict(type='path'),
             path=dict(type='str'),
             projects=dict(type='dict'),
+            project=dict(type='dict'),
         )
     )
 
@@ -301,7 +307,8 @@ def main():
                    p.get('services'),
                    p.get('plugins'),
                    p.get('base_dir'),
-                   p.get('projects'))
+                   p.get('projects'),
+                   p.get('project'))
     lc.write(p['path'])
 
     module.exit_json()
diff --git a/roles/write-devstack-local-conf/library/test.py b/roles/write-devstack-local-conf/library/test.py
index 7ccb68f08d..791552d1ad 100644
--- a/roles/write-devstack-local-conf/library/test.py
+++ b/roles/write-devstack-local-conf/library/test.py
@@ -57,7 +57,8 @@ def test_plugins(self):
                        p.get('services'),
                        p.get('plugins'),
                        p.get('base_dir'),
-                       p.get('projects'))
+                       p.get('projects'),
+                       p.get('project'))
         lc.write(p['path'])
 
         plugins = []
@@ -120,17 +121,22 @@ def test_libs_from_git(self):
                 'short_name': 'devstack-plugin',
             },
         }
+        project = {
+            'short_name': 'glance',
+        }
         p = dict(base_services=[],
                  base_dir='./test',
                  path=os.path.join(self.tmpdir, 'test.local.conf'),
-                 projects=projects)
+                 projects=projects,
+                 project=project)
         lc = LocalConf(p.get('localrc'),
                        p.get('local_conf'),
                        p.get('base_services'),
                        p.get('services'),
                        p.get('plugins'),
                        p.get('base_dir'),
-                       p.get('projects'))
+                       p.get('projects'),
+                       p.get('project'))
         lc.write(p['path'])
 
         lfg = None
@@ -138,7 +144,7 @@ def test_libs_from_git(self):
             for line in f:
                 if line.startswith('LIBS_FROM_GIT'):
                     lfg = line.strip().split('=')[1]
-        self.assertEqual('nova,oslo.messaging', lfg)
+        self.assertEqual('nova,oslo.messaging,glance', lfg)
 
     def test_overridelibs_from_git(self):
         "Test that LIBS_FROM_GIT can be overridden"
@@ -168,7 +174,8 @@ def test_overridelibs_from_git(self):
                        p.get('services'),
                        p.get('plugins'),
                        p.get('base_dir'),
-                       p.get('projects'))
+                       p.get('projects'),
+                       p.get('project'))
         lc.write(p['path'])
 
         lfg = None
diff --git a/roles/write-devstack-local-conf/tasks/main.yaml b/roles/write-devstack-local-conf/tasks/main.yaml
index a294cae608..9a6b083a2f 100644
--- a/roles/write-devstack-local-conf/tasks/main.yaml
+++ b/roles/write-devstack-local-conf/tasks/main.yaml
@@ -10,3 +10,4 @@
     local_conf: "{{ devstack_local_conf|default(omit) }}"
     base_dir: "{{ devstack_base_dir|default(omit) }}"
     projects: "{{ zuul.projects }}"
+    project: "{{ zuul.project }}"
\ No newline at end of file

From a7d0c6fa2c443b2b4b5f4680faff09c6b2bd00d2 Mon Sep 17 00:00:00 2001
From: Lance Bragstad <lbragstad@gmail.com>
Date: Mon, 18 Jun 2018 15:06:48 +0000
Subject: [PATCH 1360/2409] Use `member` instead of `Member`

Keystone now provides a set of default roles in addition to `admin`
by default [0]. This is done during the `keystone-manage bootstrap`
process.

This change aligns the `Member` role override from devstack with the
`member` role provided from keystone.

[0] https://review.openstack.org/#/c/572243/

Change-Id: I3da3530aa73a8a1500116bcefdcba7b947d5e05e
Closes-Bug: 1777359
---
 lib/horizon  |  2 +-
 lib/keystone | 29 ++++++++++-------------------
 2 files changed, 11 insertions(+), 20 deletions(-)

diff --git a/lib/horizon b/lib/horizon
index fab41bbeca..293a627c78 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -87,7 +87,7 @@ function configure_horizon {
     _horizon_config_set $local_settings "" WEBROOT \"$HORIZON_APACHE_ROOT/\"
 
     _horizon_config_set $local_settings "" COMPRESS_OFFLINE True
-    _horizon_config_set $local_settings "" OPENSTACK_KEYSTONE_DEFAULT_ROLE \"Member\"
+    _horizon_config_set $local_settings "" OPENSTACK_KEYSTONE_DEFAULT_ROLE \"member\"
 
     _horizon_config_set $local_settings "" OPENSTACK_HOST \"${KEYSTONE_SERVICE_HOST}\"
 
diff --git a/lib/keystone b/lib/keystone
index 696e351ab0..7978feaf16 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -309,30 +309,32 @@ function configure_keystone {
 # service              --         --
 # --                   --         service
 # --                   --         ResellerAdmin
-# --                   --         Member
+# --                   --         member
 # demo                 admin      admin
-# demo                 demo       Member, anotherrole
+# demo                 demo       member, anotherrole
 # alt_demo             admin      admin
-# alt_demo             alt_demo   Member, anotherrole
-# invisible_to_admin   demo       Member
+# alt_demo             alt_demo   member, anotherrole
+# invisible_to_admin   demo       member
 
 # Group                Users            Roles                 Project
 # ------------------------------------------------------------------
 # admins               admin            admin                 admin
-# nonadmins            demo, alt_demo   Member, anotherrole   demo, alt_demo
+# nonadmins            demo, alt_demo   member, anotherrole   demo, alt_demo
 
 
 # Migrated from keystone_data.sh
 function create_keystone_accounts {
 
-    # The keystone bootstrapping process (performed via keystone-manage bootstrap)
-    # creates an admin user, admin role and admin project. As a sanity check
-    # we exercise the CLI to retrieve the IDs for these values.
+    # The keystone bootstrapping process (performed via keystone-manage
+    # bootstrap) creates an admin user, admin role, member role, and admin
+    # project. As a sanity check we exercise the CLI to retrieve the IDs for
+    # these values.
     local admin_project
     admin_project=$(openstack project show "admin" -f value -c id)
     local admin_user
     admin_user=$(openstack user show "admin" -f value -c id)
     local admin_role="admin"
+    local member_role="member"
 
     get_or_add_user_domain_role $admin_role $admin_user default
 
@@ -349,17 +351,6 @@ function create_keystone_accounts {
     # role is also configurable in swift-proxy.conf
     get_or_create_role ResellerAdmin
 
-    # The Member role is used by Horizon and Swift so we need to keep it:
-    local member_role="member"
-
-    # Capital Member role is legacy hard coded in Horizon / Swift
-    # configs. Keep it around.
-    get_or_create_role "Member"
-
-    # The reality is that the rest of the roles listed below honestly
-    # should work by symbolic names.
-    get_or_create_role $member_role
-
     # another_role demonstrates that an arbitrary role may be created and used
     # TODO(sleepsonthefloor): show how this can be used for rbac in the future!
     local another_role="anotherrole"

From e95f2a36645b58b172855213cb8311a3486bfcd9 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Mon, 18 Jun 2018 16:17:29 -0400
Subject: [PATCH 1361/2409] Configure [neutron] in nova_cell*.conf

The nova-conductor service running in the cell
needs to be configured to talk to neutron for
things like deallocating networks during server
build failure. This changes the configure_neutron_nova
flows such that the top-level nova.conf is configured
as before, but we also configure each nova_cell*.conf
cell conductor config files to also be able to talk
to neutron.

Change-Id: Ic5e17298996b5fb085272425bb3b68583247aa34
Closes-Bug: #1777505
---
 lib/neutron               | 48 ++++++++++++++++++++++++++-------------
 lib/neutron-legacy        | 31 +++++++++++++------------
 lib/neutron_plugins/nuage |  5 ++--
 3 files changed, 51 insertions(+), 33 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 3cad80a414..b857e3120d 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -325,25 +325,27 @@ function configure_neutron_rootwrap {
 }
 
 # Make Neutron-required changes to nova.conf
+# Takes a single argument which is the config file to update.
 function configure_neutron_nova_new {
-    iniset $NOVA_CONF DEFAULT use_neutron True
-    iniset $NOVA_CONF neutron auth_type "password"
-    iniset $NOVA_CONF neutron auth_url "$KEYSTONE_SERVICE_URI"
-    iniset $NOVA_CONF neutron username neutron
-    iniset $NOVA_CONF neutron password "$SERVICE_PASSWORD"
-    iniset $NOVA_CONF neutron user_domain_name "Default"
-    iniset $NOVA_CONF neutron project_name "$SERVICE_TENANT_NAME"
-    iniset $NOVA_CONF neutron project_domain_name "Default"
-    iniset $NOVA_CONF neutron auth_strategy $NEUTRON_AUTH_STRATEGY
-    iniset $NOVA_CONF neutron region_name "$REGION_NAME"
-
-    iniset $NOVA_CONF DEFAULT firewall_driver nova.virt.firewall.NoopFirewallDriver
+    local conf="$1"
+    iniset $conf DEFAULT use_neutron True
+    iniset $conf neutron auth_type "password"
+    iniset $conf neutron auth_url "$KEYSTONE_SERVICE_URI"
+    iniset $conf neutron username neutron
+    iniset $conf neutron password "$SERVICE_PASSWORD"
+    iniset $conf neutron user_domain_name "Default"
+    iniset $conf neutron project_name "$SERVICE_TENANT_NAME"
+    iniset $conf neutron project_domain_name "Default"
+    iniset $conf neutron auth_strategy $NEUTRON_AUTH_STRATEGY
+    iniset $conf neutron region_name "$REGION_NAME"
+
+    iniset $conf DEFAULT firewall_driver nova.virt.firewall.NoopFirewallDriver
 
     # optionally set options in nova_conf
-    neutron_plugin_create_nova_conf
+    neutron_plugin_create_nova_conf $conf
 
     if is_service_enabled neutron-metadata-agent; then
-        iniset $NOVA_CONF neutron service_metadata_proxy "True"
+        iniset $conf neutron service_metadata_proxy "True"
     fi
 
 }
@@ -568,9 +570,23 @@ function configure_neutron {
 function configure_neutron_nova {
     if is_neutron_legacy_enabled; then
         # Call back to old function
-        create_nova_conf_neutron "$@"
+        create_nova_conf_neutron $NOVA_CONF
+        if [[ "${CELLSV2_SETUP}" == "superconductor" ]]; then
+            for i in $(seq 1 $NOVA_NUM_CELLS); do
+                local conf
+                conf=$(conductor_conf $i)
+                create_nova_conf_neutron $conf
+            done
+        fi
     else
-        configure_neutron_nova_new "$@"
+        configure_neutron_nova_new $NOVA_CONF
+        if [[ "${CELLSV2_SETUP}" == "superconductor" ]]; then
+            for i in $(seq 1 $NOVA_NUM_CELLS); do
+                local conf
+                conf=$(conductor_conf $i)
+                configure_neutron_nova_new $conf
+            done
+        fi
     fi
 }
 
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 0cd7e31d39..2e8992de61 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -366,31 +366,32 @@ function configure_mutnauq {
 }
 
 function create_nova_conf_neutron {
-    iniset $NOVA_CONF DEFAULT use_neutron True
-    iniset $NOVA_CONF neutron auth_type "password"
-    iniset $NOVA_CONF neutron auth_url "$KEYSTONE_AUTH_URI"
-    iniset $NOVA_CONF neutron username "$Q_ADMIN_USERNAME"
-    iniset $NOVA_CONF neutron password "$SERVICE_PASSWORD"
-    iniset $NOVA_CONF neutron user_domain_name "$SERVICE_DOMAIN_NAME"
-    iniset $NOVA_CONF neutron project_name "$SERVICE_PROJECT_NAME"
-    iniset $NOVA_CONF neutron project_domain_name "$SERVICE_DOMAIN_NAME"
-    iniset $NOVA_CONF neutron auth_strategy "$Q_AUTH_STRATEGY"
-    iniset $NOVA_CONF neutron region_name "$REGION_NAME"
+    local conf="$1"
+    iniset $conf DEFAULT use_neutron True
+    iniset $conf neutron auth_type "password"
+    iniset $conf neutron auth_url "$KEYSTONE_AUTH_URI"
+    iniset $conf neutron username "$Q_ADMIN_USERNAME"
+    iniset $conf neutron password "$SERVICE_PASSWORD"
+    iniset $conf neutron user_domain_name "$SERVICE_DOMAIN_NAME"
+    iniset $conf neutron project_name "$SERVICE_PROJECT_NAME"
+    iniset $conf neutron project_domain_name "$SERVICE_DOMAIN_NAME"
+    iniset $conf neutron auth_strategy "$Q_AUTH_STRATEGY"
+    iniset $conf neutron region_name "$REGION_NAME"
 
     if [[ "$Q_USE_SECGROUP" == "True" ]]; then
         LIBVIRT_FIREWALL_DRIVER=nova.virt.firewall.NoopFirewallDriver
-        iniset $NOVA_CONF DEFAULT firewall_driver $LIBVIRT_FIREWALL_DRIVER
+        iniset $conf DEFAULT firewall_driver $LIBVIRT_FIREWALL_DRIVER
     fi
 
     # optionally set options in nova_conf
-    neutron_plugin_create_nova_conf
+    neutron_plugin_create_nova_conf $conf
 
     if is_service_enabled q-meta; then
-        iniset $NOVA_CONF neutron service_metadata_proxy "True"
+        iniset $conf neutron service_metadata_proxy "True"
     fi
 
-    iniset $NOVA_CONF DEFAULT vif_plugging_is_fatal "$VIF_PLUGGING_IS_FATAL"
-    iniset $NOVA_CONF DEFAULT vif_plugging_timeout "$VIF_PLUGGING_TIMEOUT"
+    iniset $conf DEFAULT vif_plugging_is_fatal "$VIF_PLUGGING_IS_FATAL"
+    iniset $conf DEFAULT vif_plugging_timeout "$VIF_PLUGGING_TIMEOUT"
 }
 
 # create_mutnauq_accounts() - Set up common required neutron accounts
diff --git a/lib/neutron_plugins/nuage b/lib/neutron_plugins/nuage
index 1c04aaac9a..f39c7c4f5b 100644
--- a/lib/neutron_plugins/nuage
+++ b/lib/neutron_plugins/nuage
@@ -8,10 +8,11 @@ _XTRACE_NEUTRON_NU=$(set +o | grep xtrace)
 set +o xtrace
 
 function neutron_plugin_create_nova_conf {
+    local conf="$1"
     NOVA_OVS_BRIDGE=${NOVA_OVS_BRIDGE:-"br-int"}
-    iniset $NOVA_CONF neutron ovs_bridge $NOVA_OVS_BRIDGE
+    iniset $conf neutron ovs_bridge $NOVA_OVS_BRIDGE
     LIBVIRT_FIREWALL_DRIVER=nova.virt.firewall.NoopFirewallDriver
-    iniset $NOVA_CONF DEFAULT firewall_driver $LIBVIRT_FIREWALL_DRIVER
+    iniset $conf DEFAULT firewall_driver $LIBVIRT_FIREWALL_DRIVER
 }
 
 function neutron_plugin_install_agent_packages {

From 2f5771541209b6016c07c25d6808e1e3162f9d3b Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 22 Jun 2018 15:17:05 +1000
Subject: [PATCH 1362/2409] Remove old packages from rpms/horizon

I'm not sure what the history of the (capital-D) Django package or
pyxattr; they've been there for a long time and should just be
installed like other dependencies these days.

Change-Id: I423230cc5cbb13d2cfb7b926a9571a8157ce5c46
---
 files/rpms/horizon | 2 --
 1 file changed, 2 deletions(-)

diff --git a/files/rpms/horizon b/files/rpms/horizon
index fa5601a95f..a88552bc84 100644
--- a/files/rpms/horizon
+++ b/files/rpms/horizon
@@ -1,4 +1,2 @@
-Django
 httpd # NOPRIME
 mod_wsgi  # NOPRIME
-pyxattr

From 53e9aca6ce196d874b96829c32b51f8112174d69 Mon Sep 17 00:00:00 2001
From: Sumit Jamgade <sjamgade@suse.com>
Date: Wed, 13 Jun 2018 17:30:41 +0200
Subject: [PATCH 1363/2409] install and start elasticsearch on openSUSE

this will allow install and start of elasticsearch on openSUSE based
distributions

Change-Id: I4d778c260247e73b500ca7d17835655c21941541
---
 pkg/elasticsearch.sh | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/pkg/elasticsearch.sh b/pkg/elasticsearch.sh
index fefd454312..afbf11de3d 100755
--- a/pkg/elasticsearch.sh
+++ b/pkg/elasticsearch.sh
@@ -37,7 +37,7 @@ function wget_elasticsearch {
 function download_elasticsearch {
     if is_ubuntu; then
         wget_elasticsearch elasticsearch-${ELASTICSEARCH_VERSION}.deb
-    elif is_fedora; then
+    elif is_fedora || is_suse; then
         wget_elasticsearch elasticsearch-${ELASTICSEARCH_VERSION}.noarch.rpm
     fi
 }
@@ -61,6 +61,9 @@ function start_elasticsearch {
     elif is_fedora; then
         sudo /bin/systemctl start elasticsearch.service
         _check_elasticsearch_ready
+    elif is_suse; then
+        sudo /usr/bin/systemctl start elasticsearch.service
+        _check_elasticsearch_ready
     else
         echo "Unsupported architecture...can not start elasticsearch."
     fi
@@ -71,6 +74,8 @@ function stop_elasticsearch {
         sudo /etc/init.d/elasticsearch stop
     elif is_fedora; then
         sudo /bin/systemctl stop elasticsearch.service
+    elif is_suse ; then
+        sudo /usr/bin/systemctl stop elasticsearch.service
     else
         echo "Unsupported architecture...can not stop elasticsearch."
     fi
@@ -92,6 +97,11 @@ function install_elasticsearch {
         yum_install ${FILES}/elasticsearch-${ELASTICSEARCH_VERSION}.noarch.rpm
         sudo /bin/systemctl daemon-reload
         sudo /bin/systemctl enable elasticsearch.service
+    elif is_suse; then
+        is_package_installed java-1_8_0-openjdk-headless || install_package java-1_8_0-openjdk-headless
+        zypper_install --no-gpg-checks ${FILES}/elasticsearch-${ELASTICSEARCH_VERSION}.noarch.rpm
+        sudo /usr/bin/systemctl daemon-reload
+        sudo /usr/bin/systemctl enable elasticsearch.service
     else
         echo "Unsupported install of elasticsearch on this architecture."
     fi
@@ -103,6 +113,8 @@ function uninstall_elasticsearch {
             sudo apt-get purge elasticsearch
         elif is_fedora; then
             sudo yum remove elasticsearch
+        elif is_suse; then
+            sudo zypper rm elasticsearch
         else
             echo "Unsupported install of elasticsearch on this architecture."
         fi

From 78dff2852b4070168e103976aa3e7d72beb098b0 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 22 Jun 2018 22:17:00 +1000
Subject: [PATCH 1364/2409] Update all rpms for Fedora 28

Bring along the required rpms for the ride on Fedora 28 (we really
should find a way to maybe do f* or something to avoid this
... consider it a todo :)

Change-Id: I37fd38de9baab478c86d23ea2cebca59dc8a5ed1
---
 files/rpms/cinder  | 4 ++--
 files/rpms/general | 4 ++--
 files/rpms/nova    | 2 +-
 files/rpms/swift   | 2 +-
 4 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/files/rpms/cinder b/files/rpms/cinder
index e6addc62aa..058c2354dc 100644
--- a/files/rpms/cinder
+++ b/files/rpms/cinder
@@ -1,5 +1,5 @@
 iscsi-initiator-utils
 lvm2
 qemu-img
-scsi-target-utils # not:rhel7,f25,f26,f27 NOPRIME
-targetcli # dist:rhel7,f25,f26,f27 NOPRIME
+scsi-target-utils # not:rhel7,f25,f26,f27,f28 NOPRIME
+targetcli # dist:rhel7,f25,f26,f27,f28 NOPRIME
diff --git a/files/rpms/general b/files/rpms/general
index 5d9a4ad5a5..c7863e4320 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -9,9 +9,9 @@ git-core
 graphviz # needed only for docs
 httpd
 httpd-devel
-iptables-services  # NOPRIME f25,f26,f27
+iptables-services  # NOPRIME f25,f26,f27,f28
 java-1.7.0-openjdk-headless  # NOPRIME rhel7
-java-1.8.0-openjdk-headless  # NOPRIME f25,f26,f27
+java-1.8.0-openjdk-headless  # NOPRIME f25,f26,f27,f28
 libffi-devel
 libjpeg-turbo-devel # Pillow 3.0.0
 libxml2-devel # lxml
diff --git a/files/rpms/nova b/files/rpms/nova
index 9fb7282df5..4140cd7bae 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -7,7 +7,7 @@ gawk
 genisoimage # required for config_drive
 iptables
 iputils
-kernel-modules # dist:f25,f26,f27
+kernel-modules # dist:f25,f26,f27,f28
 kpartx
 libxml2-python
 m2crypto
diff --git a/files/rpms/swift b/files/rpms/swift
index be0db140e3..f2f5de69b0 100644
--- a/files/rpms/swift
+++ b/files/rpms/swift
@@ -2,7 +2,7 @@ curl
 liberasurecode-devel
 memcached
 pyxattr
-rsync-daemon # dist:f25,f26,f27
+rsync-daemon # dist:f25,f26,f27,f28
 sqlite
 xfsprogs
 xinetd

From e63859362487856f1f53c173909cb8aa3bb55bab Mon Sep 17 00:00:00 2001
From: Lucas Alvares Gomes <lucasagomes@gmail.com>
Date: Thu, 28 Jun 2018 11:00:28 +0100
Subject: [PATCH 1365/2409] Make configure_neutron_nova_new and
 create_nova_conf_neutron param optional

The commit e95f2a36645b58b172855213cb8311a3486bfcd9 broke
networking-ovn (and potentially other ml2 drivers) by making the config
parameter mandatory. It doesn't need to be.

Change-Id: I0d5738ac3a6d27ddb7655835d77689409a6ff6f4
---
 lib/neutron        | 5 +++--
 lib/neutron-legacy | 2 +-
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index b857e3120d..9f9b132377 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -325,9 +325,10 @@ function configure_neutron_rootwrap {
 }
 
 # Make Neutron-required changes to nova.conf
-# Takes a single argument which is the config file to update.
+# Takes a single optional argument which is the config file to update,
+# if not passed $NOVA_CONF is used.
 function configure_neutron_nova_new {
-    local conf="$1"
+    local conf=${1:-$NOVA_CONF}
     iniset $conf DEFAULT use_neutron True
     iniset $conf neutron auth_type "password"
     iniset $conf neutron auth_url "$KEYSTONE_SERVICE_URI"
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 2e8992de61..bee032a704 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -366,7 +366,7 @@ function configure_mutnauq {
 }
 
 function create_nova_conf_neutron {
-    local conf="$1"
+    local conf=${1:-$NOVA_CONF}
     iniset $conf DEFAULT use_neutron True
     iniset $conf neutron auth_type "password"
     iniset $conf neutron auth_url "$KEYSTONE_AUTH_URI"

From 6f38cf4ad846f394489334caae7a38b8e49b646c Mon Sep 17 00:00:00 2001
From: Prabhat Ranjan <pranjank@in.ibm.com>
Date: Fri, 16 Mar 2018 16:33:46 +0530
Subject: [PATCH 1366/2409] Fix wait_for_compute to work for modified compute
 host name

When we change the name of compute host then devstack is breaking
because it is using default host name from host.

How to change compute host name in local.conf
[[post-config|$NOVA_CONF]]
[DEFAULT]
host = foo

Change-Id: I4d4392f1f58f0431b10764610668565af88d392f
Signed-off-by: Prabhat Ranjan <pranjank@in.ibm.com>
---
 functions | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/functions b/functions
index 24994c0470..f63595d433 100644
--- a/functions
+++ b/functions
@@ -441,7 +441,12 @@ EOF
 function wait_for_compute {
     local timeout=$1
     local rval=0
+    local compute_hostname
     time_start "wait_for_service"
+    compute_hostname=$(iniget $NOVA_CONF DEFAULT host)
+    if [[ -z $compute_hostname ]]; then
+        compute_hostname=$(hostname)
+    fi
     timeout $timeout bash -x <<EOF || rval=$?
         ID=""
         while [[ "\$ID" == "" ]]; do
@@ -450,7 +455,7 @@ function wait_for_compute {
                 # When using the fake driver the compute hostnames have a suffix of 1 to NUMBER_FAKE_NOVA_COMPUTE
                 ID=\$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" compute service list --host `hostname`1 --service nova-compute -c ID -f value)
             else
-                ID=\$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" compute service list --host `hostname` --service nova-compute -c ID -f value)
+                ID=\$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" compute service list --host "$compute_hostname" --service nova-compute -c ID -f value)
             fi
         done
 EOF

From 16d46483dd83dd4117fd4980208910d4be6a2c8e Mon Sep 17 00:00:00 2001
From: Morgan Fainberg <morgan.fainberg@gmail.com>
Date: Tue, 3 Jul 2018 07:14:16 -0700
Subject: [PATCH 1367/2409] Keystone no longer uses paste-ini

With the move to flask, Keystone does not utilize paste-ini. This
patchset removes the paste-ini support from devstack for Keystone.

Change-Id: I8dd629937c9178660992fd648175dbef80ffa3c2
---
 lib/keystone | 17 -----------------
 1 file changed, 17 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 7978feaf16..28603257dd 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -49,7 +49,6 @@ fi
 
 KEYSTONE_CONF_DIR=${KEYSTONE_CONF_DIR:-/etc/keystone}
 KEYSTONE_CONF=$KEYSTONE_CONF_DIR/keystone.conf
-KEYSTONE_PASTE_INI=${KEYSTONE_PASTE_INI:-$KEYSTONE_CONF_DIR/keystone-paste.ini}
 KEYSTONE_PUBLIC_UWSGI_CONF=$KEYSTONE_CONF_DIR/keystone-uwsgi-public.ini
 KEYSTONE_ADMIN_UWSGI_CONF=$KEYSTONE_CONF_DIR/keystone-uwsgi-admin.ini
 KEYSTONE_PUBLIC_UWSGI=$KEYSTONE_BIN_DIR/keystone-wsgi-public
@@ -203,23 +202,7 @@ function configure_keystone {
 
     if [[ "$KEYSTONE_CONF_DIR" != "$KEYSTONE_DIR/etc" ]]; then
         install -m 600 /dev/null $KEYSTONE_CONF
-        if [[ -f "$KEYSTONE_DIR/etc/keystone-paste.ini" ]]; then
-            cp -p "$KEYSTONE_DIR/etc/keystone-paste.ini" "$KEYSTONE_PASTE_INI"
-        fi
     fi
-    if [[ -f "$KEYSTONE_PASTE_INI" ]]; then
-        iniset "$KEYSTONE_CONF" paste_deploy config_file "$KEYSTONE_PASTE_INI"
-    else
-        # compatibility with mixed cfg and paste.deploy configuration
-        KEYSTONE_PASTE_INI="$KEYSTONE_CONF"
-    fi
-
-    if [ "$ENABLE_IDENTITY_V2" == "False" ]; then
-        # Only Identity v3 API should be available; then disable v2 pipelines
-        inidelete $KEYSTONE_PASTE_INI composite:main \\/v2.0
-        inidelete $KEYSTONE_PASTE_INI composite:admin \\/v2.0
-    fi
-
     # Populate ``keystone.conf``
     if is_service_enabled ldap; then
         iniset $KEYSTONE_CONF identity domain_config_dir "$KEYSTONE_CONF_DIR/domains"

From 19eefe5e61187bab5fb893d51e0f771101441b4a Mon Sep 17 00:00:00 2001
From: Sylvain Afchain <safchain@gmail.com>
Date: Wed, 4 Jul 2018 17:59:34 +0200
Subject: [PATCH 1368/2409] Increase the Elasticsearch service timeout

On some slow system with recent version of
Elasticsearch we saw that the service
becomes ready after more than 1 minute.

Change-Id: Id2b21ab24a96d10fffdcccd652a7d3ec4e8ce39c
---
 pkg/elasticsearch.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkg/elasticsearch.sh b/pkg/elasticsearch.sh
index afbf11de3d..bd4415315f 100755
--- a/pkg/elasticsearch.sh
+++ b/pkg/elasticsearch.sh
@@ -49,7 +49,7 @@ function configure_elasticsearch {
 
 function _check_elasticsearch_ready {
     # poll elasticsearch to see if it's started
-    if ! wait_for_service 30 http://localhost:9200; then
+    if ! wait_for_service 120 http://localhost:9200; then
         die $LINENO "Maximum timeout reached. Could not connect to ElasticSearch"
     fi
 }

From c3a33fb6911a5618eb1dc2e7448652ab844a191a Mon Sep 17 00:00:00 2001
From: Maxim Nestratov <mnestratov@virtuozzo.com>
Date: Wed, 4 Jul 2018 22:07:20 +0300
Subject: [PATCH 1369/2409] Fix Virtuozzo CI

Don't specify hypervisor_type=vz property for hds images as nova
now reports only really connected hypervisors and not all supported
by a compute host

Change-Id: Ibec0856519ffe593d44d123f3b401eae19f7d95a
---
 functions | 1 -
 1 file changed, 1 deletion(-)

diff --git a/functions b/functions
index f63595d433..051c8160f7 100644
--- a/functions
+++ b/functions
@@ -282,7 +282,6 @@ function upload_image {
             image create \
             "$image_name" --public \
             --container-format=bare --disk-format=ploop \
-            --property hypervisor_type=vz \
             --property vm_mode=$vm_mode < "${image}"
         return
     fi

From c58c5d60ce5fc1a0c8bee3eb3ba4da790ba92475 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Tue, 10 Jul 2018 06:24:09 +0000
Subject: [PATCH 1370/2409] Updated from generate-devstack-plugins-list

Change-Id: Ief0f093a0612e89d07469cb9d0201556e455dfa5
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 9b2cb7eec1..2d5259d51e 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -60,6 +60,7 @@ drbd-devstack                          `git://git.openstack.org/openstack/drbd-d
 ec2-api                                `git://git.openstack.org/openstack/ec2-api <https://git.openstack.org/cgit/openstack/ec2-api>`__
 freezer                                `git://git.openstack.org/openstack/freezer <https://git.openstack.org/cgit/openstack/freezer>`__
 freezer-api                            `git://git.openstack.org/openstack/freezer-api <https://git.openstack.org/cgit/openstack/freezer-api>`__
+freezer-tempest-plugin                 `git://git.openstack.org/openstack/freezer-tempest-plugin <https://git.openstack.org/cgit/openstack/freezer-tempest-plugin>`__
 freezer-web-ui                         `git://git.openstack.org/openstack/freezer-web-ui <https://git.openstack.org/cgit/openstack/freezer-web-ui>`__
 fuxi                                   `git://git.openstack.org/openstack/fuxi <https://git.openstack.org/cgit/openstack/fuxi>`__
 gce-api                                `git://git.openstack.org/openstack/gce-api <https://git.openstack.org/cgit/openstack/gce-api>`__

From ef3571338ababf4627c32118fc082f195a9e136c Mon Sep 17 00:00:00 2001
From: Paul Belanger <pabelanger@redhat.com>
Date: Tue, 10 Jul 2018 14:22:48 -0400
Subject: [PATCH 1371/2409] use fqdn for zuul projects

When setting up a 3pci zuul, there is an edge case where a downstream
zuul may already have openstack/foo projects, eg:
review.rdoproject.org/openstack/foo.  In this case, if openstack
projects are not namespaced to include the connection information zuul
gets confused and complains.  We can avoid this by using the fqdn for
git.o.o for devstack jobs and both upstream and downstream zuul will
properly use the correct connection.

Change-Id: I01419ea9f51ce7491aa319b6240aec9c0d4f2356
Signed-off-by: Paul Belanger <pabelanger@redhat.com>
---
 .zuul.yaml | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index c8bb337d2f..57cbf88e1d 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -103,10 +103,10 @@
       job.group-vars.peers, which is what is used by multi node jobs for subnode
       nodes (everything but the controller).
     required-projects:
-      - openstack-dev/devstack
+      - git.openstack.org/openstack-dev/devstack
     roles:
-      - zuul: openstack-infra/devstack-gate
-      - zuul: openstack-infra/openstack-zuul-jobs
+      - zuul: git.openstack.org/openstack-infra/devstack-gate
+      - zuul: git.openstack.org/openstack-infra/openstack-zuul-jobs
     vars:
       devstack_localrc:
         DATABASE_PASSWORD: secretdatabase
@@ -211,7 +211,7 @@
       less than the normal minimum set of required-projects.
     nodeset: openstack-single-node
     required-projects:
-      - openstack/requirements
+      - git.openstack.org/openstack/requirements
     vars:
       devstack_localrc:
         # Multinode specific settings
@@ -270,12 +270,12 @@
       and extended.
     nodeset: openstack-single-node
     required-projects:
-      - openstack/cinder
-      - openstack/glance
-      - openstack/keystone
-      - openstack/neutron
-      - openstack/nova
-      - openstack/swift
+      - git.openstack.org/openstack/cinder
+      - git.openstack.org/openstack/glance
+      - git.openstack.org/openstack/keystone
+      - git.openstack.org/openstack/neutron
+      - git.openstack.org/openstack/nova
+      - git.openstack.org/openstack/swift
     timeout: 7200
     vars:
       devstack_localrc:

From 274287598252b04f0ddf9741d7145a71cbb953a1 Mon Sep 17 00:00:00 2001
From: ghanshyam <gmann@ghanshyammann.com>
Date: Tue, 10 Jul 2018 09:21:46 +0000
Subject: [PATCH 1372/2409] Cleanup keystone's removed config options

token.provider.drvier.uuid and token.driver
has been removed from keystone[1].

Devstack has reference/setting of those config
options which is confusing for user and it can
lead to import error like[2]

This commit cleanup the devstack bits of removed
config options.

bp removed-as-of-rocky

[1] https://blueprints.launchpad.net/keystone/+spec/removed-as-of-rocky

[2] http://paste.openstack.org/show/725391/

Change-Id: I29b3b356622c485c4c1046679234a38e7b645071
---
 lib/keystone | 13 ++-----------
 1 file changed, 2 insertions(+), 11 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 28603257dd..57cb24d4cb 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -63,9 +63,6 @@ else
     KEYSTONE_DEPLOY=mod_wsgi
 fi
 
-# Select the token persistence backend driver
-KEYSTONE_TOKEN_BACKEND=${KEYSTONE_TOKEN_BACKEND:-sql}
-
 # Select the Identity backend driver
 KEYSTONE_IDENTITY_BACKEND=${KEYSTONE_IDENTITY_BACKEND:-sql}
 
@@ -79,7 +76,8 @@ KEYSTONE_ROLE_BACKEND=${KEYSTONE_ROLE_BACKEND:-sql}
 KEYSTONE_RESOURCE_BACKEND=${KEYSTONE_RESOURCE_BACKEND:-sql}
 
 # Select Keystone's token provider (and format)
-# Choose from 'uuid', 'pki', 'pkiz', or 'fernet'
+# Refer keystone doc for supported token provider:
+# https://docs.openstack.org/keystone/latest/admin/token-provider.html
 KEYSTONE_TOKEN_FORMAT=${KEYSTONE_TOKEN_FORMAT:-fernet}
 KEYSTONE_TOKEN_FORMAT=$(echo ${KEYSTONE_TOKEN_FORMAT} | tr '[:upper:]' '[:lower:]')
 
@@ -245,8 +243,6 @@ function configure_keystone {
 
     iniset $KEYSTONE_CONF database connection `database_connection_url keystone`
 
-    iniset $KEYSTONE_CONF token driver "$KEYSTONE_TOKEN_BACKEND"
-
     # Set up logging
     if [ "$SYSLOG" != "False" ]; then
         iniset $KEYSTONE_CONF DEFAULT use_syslog "True"
@@ -443,11 +439,6 @@ function init_keystone {
     $KEYSTONE_BIN_DIR/keystone-manage --config-file $KEYSTONE_CONF db_sync
     time_stop "dbsync"
 
-    if [[ "$KEYSTONE_TOKEN_FORMAT" == "pki" || "$KEYSTONE_TOKEN_FORMAT" == "pkiz" ]]; then
-        # Set up certificates
-        rm -rf $KEYSTONE_CONF_DIR/ssl
-        $KEYSTONE_BIN_DIR/keystone-manage --config-file $KEYSTONE_CONF pki_setup
-    fi
     if [[ "$KEYSTONE_TOKEN_FORMAT" == "fernet" ]]; then
         rm -rf "$KEYSTONE_CONF_DIR/fernet-keys/"
         $KEYSTONE_BIN_DIR/keystone-manage --config-file $KEYSTONE_CONF fernet_setup

From 3b5477d6356a62d7d64a519a4b1ac99309d251c0 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Thu, 12 Jul 2018 06:17:32 +0000
Subject: [PATCH 1373/2409] Updated from generate-devstack-plugins-list

Change-Id: I8f702373c76953a0a29285f410d368c975ba4024
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 2d5259d51e..7ad65f741b 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -100,6 +100,7 @@ monasca-tempest-plugin                 `git://git.openstack.org/openstack/monasc
 monasca-transform                      `git://git.openstack.org/openstack/monasca-transform <https://git.openstack.org/cgit/openstack/monasca-transform>`__
 murano                                 `git://git.openstack.org/openstack/murano <https://git.openstack.org/cgit/openstack/murano>`__
 networking-6wind                       `git://git.openstack.org/openstack/networking-6wind <https://git.openstack.org/cgit/openstack/networking-6wind>`__
+networking-ansible                     `git://git.openstack.org/openstack/networking-ansible <https://git.openstack.org/cgit/openstack/networking-ansible>`__
 networking-arista                      `git://git.openstack.org/openstack/networking-arista <https://git.openstack.org/cgit/openstack/networking-arista>`__
 networking-bagpipe                     `git://git.openstack.org/openstack/networking-bagpipe <https://git.openstack.org/cgit/openstack/networking-bagpipe>`__
 networking-baremetal                   `git://git.openstack.org/openstack/networking-baremetal <https://git.openstack.org/cgit/openstack/networking-baremetal>`__

From e484f3b1c8086567ce5dc1e55ee503def8e5b429 Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Tue, 10 Jul 2018 16:28:44 +0200
Subject: [PATCH 1374/2409] Remove devstack exercises

These seem to be not run for quite some time and they don't
succeed anymore - drop the code to avoid somebody accidentally
running it and wondering. A good example of "if it isn't tested
its broken".

Depends-On: https://review.openstack.org/583146
Depends-On: https://review.openstack.org/583147

Change-Id: I99e8a5ca2925217a5a2401984f3f4f6f032017be
---
 HACKING.rst                          |  86 -----
 doc/source/configuration.rst         |  41 +--
 doc/source/guides/single-machine.rst |   4 -
 doc/source/overview.rst              |   8 -
 exercise.sh                          |  74 -----
 exerciserc                           |  26 --
 exercises/aggregates.sh              | 150 ---------
 exercises/boot_from_volume.sh        | 224 -------------
 exercises/client-args.sh             | 174 ----------
 exercises/client-env.sh              | 171 ----------
 exercises/floating_ips.sh            | 216 -------------
 exercises/neutron-adv-test.sh        | 466 ---------------------------
 exercises/sec_groups.sh              |  81 -----
 exercises/swift.sh                   |  69 ----
 exercises/volumes.sh                 | 225 -------------
 15 files changed, 1 insertion(+), 2014 deletions(-)
 delete mode 100755 exercise.sh
 delete mode 100644 exerciserc
 delete mode 100755 exercises/aggregates.sh
 delete mode 100755 exercises/boot_from_volume.sh
 delete mode 100755 exercises/client-args.sh
 delete mode 100755 exercises/client-env.sh
 delete mode 100755 exercises/floating_ips.sh
 delete mode 100755 exercises/neutron-adv-test.sh
 delete mode 100755 exercises/sec_groups.sh
 delete mode 100755 exercises/swift.sh
 delete mode 100755 exercises/volumes.sh

diff --git a/HACKING.rst b/HACKING.rst
index d5d6fbcf02..38e2dac131 100644
--- a/HACKING.rst
+++ b/HACKING.rst
@@ -50,10 +50,6 @@ level.
 ``tools/build_docs.sh`` is used to generate the HTML versions of the
 DevStack scripts.  A complete doc build can be run with ``tox -edocs``.
 
-``exercises`` - Contains the test scripts used to sanity-check and
-demonstrate some OpenStack functions. These scripts know how to exit
-early or skip services that are not enabled.
-
 ``extras.d`` - Contains the dispatch scripts called by the hooks in
 ``stack.sh``, ``unstack.sh`` and ``clean.sh``. See :doc:`the plugins
 docs <plugins>` for more information.
@@ -183,88 +179,6 @@ The complete docs build is also handled with <code>tox -edocs</code> per the
 OpenStack project standard.
 
 
-Exercises
----------
-
-The scripts in the exercises directory are meant to 1) perform basic operational
-checks on certain aspects of OpenStack; and b) document the use of the
-OpenStack command-line clients.
-
-In addition to the guidelines above, exercise scripts MUST follow the structure
-outlined here.  ``swift.sh`` is perhaps the clearest example of these guidelines.
-These scripts are executed serially by ``exercise.sh`` in testing situations.
-
-* Begin and end with a banner that stands out in a sea of script logs to aid
-  in debugging failures, particularly in automated testing situations.  If the
-  end banner is not displayed, the script ended prematurely and can be assumed
-  to have failed.
-
-  ::
-
-    echo "**************************************************"
-    echo "Begin DevStack Exercise: $0"
-    echo "**************************************************"
-    ...
-    set +o xtrace
-    echo "**************************************************"
-    echo "End DevStack Exercise: $0"
-    echo "**************************************************"
-
-* The scripts will generally have the shell ``xtrace`` attribute set to display
-  the actual commands being executed, and the ``errexit`` attribute set to exit
-  the script on non-zero exit codes::
-
-    # This script exits on an error so that errors don't compound and you see
-    # only the first error that occurred.
-    set -o errexit
-
-    # Print the commands being run so that we can see the command that triggers
-    # an error.  It is also useful for following as the install occurs.
-    set -o xtrace
-
-* Settings and configuration are stored in ``exerciserc``, which must be
-  sourced after ``openrc`` or ``stackrc``::
-
-    # Import exercise configuration
-    source $TOP_DIR/exerciserc
-
-* There are a couple of helper functions in the common ``functions`` sub-script
-  that will check for non-zero exit codes and unset environment variables and
-  print a message and exit the script.  These should be called after most client
-  commands that are not otherwise checked to short-circuit long timeouts
-  (instance boot failure, for example)::
-
-    swift post $CONTAINER
-    die_if_error "Failure creating container $CONTAINER"
-
-    FLOATING_IP=`euca-allocate-address | cut -f2`
-    die_if_not_set FLOATING_IP "Failure allocating floating IP"
-
-* If you want an exercise to be skipped when for example a service wasn't
-  enabled for the exercise to be run, you can exit your exercise with the
-  special exitcode 55 and it will be detected as skipped.
-
-* The exercise scripts should only use the various OpenStack client binaries to
-  interact with OpenStack.  This specifically excludes any ``*-manage`` tools
-  as those assume direct access to configuration and databases, as well as direct
-  database access from the exercise itself.
-
-* If specific configuration needs to be present for the exercise to complete,
-  it should be staged in ``stack.sh``, or called from ``stack.sh``.
-
-* The ``OS_*`` environment variables should be the only ones used for all
-  authentication to OpenStack clients as documented in the CLIAuth_ wiki page.
-
-.. _CLIAuth: https://wiki.openstack.org/CLIAuth
-
-* The exercise MUST clean up after itself if successful.  If it is not successful,
-  it is assumed that state will be left behind; this allows a chance for developers
-  to look around and attempt to debug the problem.  The exercise SHOULD clean up
-  or graciously handle possible artifacts left over from previous runs if executed
-  again.  It is acceptable to require a reboot or even a re-install of DevStack
-  to restore a clean test environment.
-
-
 Bash Style Guidelines
 ~~~~~~~~~~~~~~~~~~~~~
 DevStack defines a bash set of best practices for maintaining large
diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 7efe4d6eee..46e50df6bb 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -665,8 +665,7 @@ following to your ``localrc`` section:
     enable_service n-cell
 
 Be aware that there are some features currently missing in cells, one
-notable one being security groups.  The exercises have been patched to
-disable functionality not supported by cells.
+notable one being security groups.
 
 Cinder
 ~~~~~~
@@ -729,44 +728,6 @@ use the v3 API. It is possible to setup keystone without v2 API, by doing:
 
     ENABLE_IDENTITY_V2=False
 
-Exercises
-~~~~~~~~~
-
-``exerciserc`` is used to configure settings for the exercise scripts.
-The values shown below are the default values. These can all be
-overridden by setting them in the ``localrc`` section.
-
-* Max time to wait while vm goes from build to active state
-
-    ::
-
-        ACTIVE_TIMEOUT==30
-
-* Max time to wait for proper IP association and dis-association.
-
-    ::
-
-        ASSOCIATE_TIMEOUT=15
-
-* Max time till the vm is bootable
-
-    ::
-
-        BOOT_TIMEOUT=30
-
-* Max time from run instance command until it is running
-
-    ::
-
-        RUNNING_TIMEOUT=$(($BOOT_TIMEOUT + $ACTIVE_TIMEOUT))
-
-* Max time to wait for a vm to terminate
-
-    ::
-
-        TERMINATE_TIMEOUT=30
-
-
 .. _arch-configuration:
 
 Architectures
diff --git a/doc/source/guides/single-machine.rst b/doc/source/guides/single-machine.rst
index 48a4fa8b12..515ea9a9ee 100644
--- a/doc/source/guides/single-machine.rst
+++ b/doc/source/guides/single-machine.rst
@@ -127,7 +127,3 @@ computers on the local network. In this example that would be
 http://192.168.1.201/ for the dashboard (aka Horizon). Launch VMs and if
 you give them floating IPs and security group access those VMs will be
 accessible from other machines on your network.
-
-Some examples of using the OpenStack command-line clients ``nova`` and
-``glance`` are in the shakedown scripts in ``devstack/exercises``.
-``exercise.sh`` will run all of those scripts and report on the results.
diff --git a/doc/source/overview.rst b/doc/source/overview.rst
index 814a2b148b..2479cd0bc8 100644
--- a/doc/source/overview.rst
+++ b/doc/source/overview.rst
@@ -75,11 +75,3 @@ Node Configurations
 
 -  single node
 -  multi-node configurations as are tested by the gate
-
-Exercises
----------
-
-The DevStack exercise scripts are no longer used as integration and gate
-testing as that job has transitioned to Tempest. They are still
-maintained as a demonstrations of using OpenStack from the command line
-and for quick operational testing.
diff --git a/exercise.sh b/exercise.sh
deleted file mode 100755
index 90670333a1..0000000000
--- a/exercise.sh
+++ /dev/null
@@ -1,74 +0,0 @@
-#!/usr/bin/env bash
-
-# **exercise.sh**
-
-# Keep track of the current DevStack directory.
-TOP_DIR=$(cd $(dirname "$0") && pwd)
-
-# Import common functions
-source $TOP_DIR/functions
-
-# Load local configuration
-source $TOP_DIR/stackrc
-
-# Run everything in the exercises/ directory that isn't explicitly disabled
-
-# comma separated list of script basenames to skip
-# to refrain from exercising foo.sh use ``SKIP_EXERCISES=foo``
-SKIP_EXERCISES=${SKIP_EXERCISES:-""}
-
-# comma separated list of script basenames to run
-# to run only foo.sh use ``RUN_EXERCISES=foo``
-basenames=${RUN_EXERCISES:-""}
-
-EXERCISE_DIR=$TOP_DIR/exercises
-
-if [[ -z "${basenames}" ]]; then
-    # Locate the scripts we should run
-    basenames=$(for b in `ls $EXERCISE_DIR/*.sh`; do basename $b .sh; done)
-else
-    # If ``RUN_EXERCISES`` was specified, ignore ``SKIP_EXERCISES``.
-    SKIP_EXERCISES=
-fi
-
-# Track the state of each script
-passes=""
-failures=""
-skips=""
-
-# Loop over each possible script (by basename)
-for script in $basenames; do
-    if [[ ,$SKIP_EXERCISES, =~ ,$script, ]]; then
-        skips="$skips $script"
-    else
-        echo "====================================================================="
-        echo Running $script
-        echo "====================================================================="
-        $EXERCISE_DIR/$script.sh
-        exitcode=$?
-        if [[ $exitcode == 55 ]]; then
-            skips="$skips $script"
-        elif [[ $exitcode -ne 0 ]]; then
-            failures="$failures $script"
-        else
-            passes="$passes $script"
-        fi
-    fi
-done
-
-# Output status of exercise run
-echo "====================================================================="
-for script in $skips; do
-    echo SKIP $script
-done
-for script in $passes; do
-    echo PASS $script
-done
-for script in $failures; do
-    echo FAILED $script
-done
-echo "====================================================================="
-
-if [[ -n "$failures" ]]; then
-    exit 1
-fi
diff --git a/exerciserc b/exerciserc
deleted file mode 100644
index 978e0b3791..0000000000
--- a/exerciserc
+++ /dev/null
@@ -1,26 +0,0 @@
-#!/usr/bin/env bash
-#
-# source exerciserc
-#
-# Configure the DevStack exercise scripts
-# For best results, source this _after_ stackrc/localrc as it will set
-# values only if they are not already set.
-
-# Max time to wait while vm goes from build to active state
-export ACTIVE_TIMEOUT=${ACTIVE_TIMEOUT:-30}
-
-# Max time to wait for proper IP association and dis-association.
-export ASSOCIATE_TIMEOUT=${ASSOCIATE_TIMEOUT:-15}
-
-# Max time till the vm is bootable
-export BOOT_TIMEOUT=${BOOT_TIMEOUT:-30}
-
-# Max time from run instance command until it is running
-export RUNNING_TIMEOUT=${RUNNING_TIMEOUT:-$(($BOOT_TIMEOUT + $ACTIVE_TIMEOUT))}
-
-# Max time to wait for a vm to terminate
-export TERMINATE_TIMEOUT=${TERMINATE_TIMEOUT:-30}
-
-# The size of the volume we want to boot from; some storage back-ends
-# do not allow a disk resize, so it's important that this can be tuned
-export DEFAULT_VOLUME_SIZE=${DEFAULT_VOLUME_SIZE:-1}
diff --git a/exercises/aggregates.sh b/exercises/aggregates.sh
deleted file mode 100755
index 8cbca54fb2..0000000000
--- a/exercises/aggregates.sh
+++ /dev/null
@@ -1,150 +0,0 @@
-#!/usr/bin/env bash
-
-# **aggregates.sh**
-
-# This script demonstrates how to use host aggregates:
-#
-# *  Create an Aggregate
-# *  Updating Aggregate details
-# *  Testing Aggregate metadata
-# *  Testing Aggregate delete
-# *  Testing General Aggregates (https://blueprints.launchpad.net/nova/+spec/general-host-aggregates)
-# *  Testing add/remove hosts (with one host)
-
-echo "**************************************************"
-echo "Begin DevStack Exercise: $0"
-echo "**************************************************"
-
-# This script exits on an error so that errors don't compound and you see
-# only the first error that occurred.
-set -o errexit
-
-# Print the commands being run so that we can see the command that triggers
-# an error.  It is also useful for following as the install occurs.
-set -o xtrace
-
-
-# Settings
-# ========
-
-# Keep track of the current directory
-EXERCISE_DIR=$(cd $(dirname "$0") && pwd)
-TOP_DIR=$(cd $EXERCISE_DIR/..; pwd)
-
-# Test as the admin user
-# note this imports stackrc/functions, etc
-. $TOP_DIR/openrc admin admin
-
-# Import exercise configuration
-source $TOP_DIR/exerciserc
-
-# If nova api is not enabled we exit with exitcode 55 so that
-# the exercise is skipped
-is_service_enabled n-api || exit 55
-
-# Cells does not support aggregates.
-is_service_enabled n-cell && exit 55
-
-# Create an aggregate
-# ===================
-
-AGGREGATE_NAME=test_aggregate_$RANDOM
-AGGREGATE2_NAME=test_aggregate_$RANDOM
-AGGREGATE_A_ZONE=nova
-
-function exit_if_aggregate_present {
-    aggregate_name=$1
-
-    if [ $(nova aggregate-list | grep -c " $aggregate_name ") == 0 ]; then
-        echo "SUCCESS $aggregate_name not present"
-    else
-        die $LINENO "found aggregate: $aggregate_name"
-        exit -1
-    fi
-}
-
-exit_if_aggregate_present $AGGREGATE_NAME
-
-AGGREGATE_ID=$(nova aggregate-create $AGGREGATE_NAME $AGGREGATE_A_ZONE | grep " $AGGREGATE_NAME " | get_field 1)
-die_if_not_set $LINENO AGGREGATE_ID "Failure creating AGGREGATE_ID for $AGGREGATE_NAME $AGGREGATE_A_ZONE"
-
-AGGREGATE2_ID=$(nova aggregate-create $AGGREGATE2_NAME $AGGREGATE_A_ZONE | grep " $AGGREGATE2_NAME " | get_field 1)
-die_if_not_set $LINENO AGGREGATE2_ID "Fail creating AGGREGATE2_ID for $AGGREGATE2_NAME $AGGREGATE_A_ZONE"
-
-# check aggregate created
-nova aggregate-list | grep -q " $AGGREGATE_NAME " || die $LINENO "Aggregate $AGGREGATE_NAME not created"
-
-
-# Ensure creating a duplicate fails
-# =================================
-
-if nova aggregate-create $AGGREGATE_NAME $AGGREGATE_A_ZONE; then
-    die $LINENO "could create duplicate aggregate"
-fi
-
-
-# Test aggregate-update (and aggregate-details)
-# =============================================
-AGGREGATE_NEW_NAME=test_aggregate_$RANDOM
-
-nova aggregate-update $AGGREGATE_ID $AGGREGATE_NEW_NAME
-nova aggregate-details $AGGREGATE_ID | grep $AGGREGATE_NEW_NAME
-nova aggregate-details $AGGREGATE_ID | grep $AGGREGATE_A_ZONE
-
-nova aggregate-update $AGGREGATE_ID $AGGREGATE_NAME $AGGREGATE_A_ZONE
-nova aggregate-details $AGGREGATE_ID | grep $AGGREGATE_NAME
-nova aggregate-details $AGGREGATE_ID | grep $AGGREGATE_A_ZONE
-
-
-# Test aggregate-set-metadata
-# ===========================
-META_DATA_1_KEY=asdf
-META_DATA_2_KEY=foo
-META_DATA_3_KEY=bar
-
-#ensure no additional metadata is set
-nova aggregate-details $AGGREGATE_ID | egrep "\|[{u ]*'availability_zone.+$AGGREGATE_A_ZONE'[ }]*\|"
-
-nova aggregate-set-metadata $AGGREGATE_ID ${META_DATA_1_KEY}=123
-nova aggregate-details $AGGREGATE_ID | grep $META_DATA_1_KEY
-nova aggregate-details $AGGREGATE_ID | grep 123
-
-nova aggregate-set-metadata $AGGREGATE_ID ${META_DATA_2_KEY}=456
-nova aggregate-details $AGGREGATE_ID | grep $META_DATA_1_KEY
-nova aggregate-details $AGGREGATE_ID | grep $META_DATA_2_KEY
-
-nova aggregate-set-metadata $AGGREGATE_ID $META_DATA_2_KEY ${META_DATA_3_KEY}=789
-nova aggregate-details $AGGREGATE_ID | grep $META_DATA_1_KEY
-nova aggregate-details $AGGREGATE_ID | grep $META_DATA_3_KEY
-
-nova aggregate-details $AGGREGATE_ID | grep $META_DATA_2_KEY && die $LINENO "ERROR metadata was not cleared"
-
-nova aggregate-set-metadata $AGGREGATE_ID $META_DATA_3_KEY $META_DATA_1_KEY
-nova aggregate-details $AGGREGATE_ID | egrep "\|[{u ]*'availability_zone.+$AGGREGATE_A_ZONE'[ }]*\|"
-
-
-# Test aggregate-add/remove-host
-# ==============================
-if [ "$VIRT_DRIVER" == "xenserver" ]; then
-    echo "TODO(johngarbutt) add tests for add/remove host from pool aggregate"
-fi
-FIRST_HOST=$(nova host-list | grep compute | get_field 1 | head -1)
-# Make sure can add two aggregates to same host
-nova aggregate-add-host $AGGREGATE_ID $FIRST_HOST
-nova aggregate-add-host $AGGREGATE2_ID $FIRST_HOST
-if nova aggregate-add-host $AGGREGATE2_ID $FIRST_HOST; then
-    die $LINENO "could add duplicate host to single aggregate"
-fi
-nova aggregate-remove-host $AGGREGATE2_ID $FIRST_HOST
-nova aggregate-remove-host $AGGREGATE_ID $FIRST_HOST
-
-# Test aggregate-delete
-# =====================
-nova aggregate-delete $AGGREGATE_ID
-nova aggregate-delete $AGGREGATE2_ID
-exit_if_aggregate_present $AGGREGATE_NAME
-
-set +o xtrace
-echo "**************************************************"
-echo "End DevStack Exercise: $0"
-echo "**************************************************"
diff --git a/exercises/boot_from_volume.sh b/exercises/boot_from_volume.sh
deleted file mode 100755
index 7478bdf138..0000000000
--- a/exercises/boot_from_volume.sh
+++ /dev/null
@@ -1,224 +0,0 @@
-#!/usr/bin/env bash
-
-# **boot_from_volume.sh**
-
-# This script demonstrates how to boot from a volume.  It does the following:
-#
-# *  Create a bootable volume
-# *  Boot a volume-backed instance
-
-echo "*********************************************************************"
-echo "Begin DevStack Exercise: $0"
-echo "*********************************************************************"
-
-# This script exits on an error so that errors don't compound and you see
-# only the first error that occurred.
-set -o errexit
-
-# Print the commands being run so that we can see the command that triggers
-# an error.  It is also useful for following as the install occurs.
-set -o xtrace
-
-
-# Settings
-# ========
-
-# Keep track of the current directory
-EXERCISE_DIR=$(cd $(dirname "$0") && pwd)
-TOP_DIR=$(cd $EXERCISE_DIR/..; pwd)
-
-# Import common functions
-source $TOP_DIR/functions
-
-# Import project functions
-source $TOP_DIR/lib/cinder
-source $TOP_DIR/lib/neutron
-source $TOP_DIR/lib/neutron-legacy
-
-# Import configuration
-source $TOP_DIR/openrc
-
-# Import exercise configuration
-source $TOP_DIR/exerciserc
-
-# If cinder is not enabled we exit with exitcode 55 so that
-# the exercise is skipped
-is_service_enabled cinder || exit 55
-
-# Ironic does not support boot from volume.
-[ "$VIRT_DRIVER" == "ironic" ] && exit 55
-
-# Instance type to create
-DEFAULT_INSTANCE_TYPE=${DEFAULT_INSTANCE_TYPE:-m1.tiny}
-
-# Boot this image, use first AMI image if unset
-DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-ami}
-
-# Security group name
-SECGROUP=${SECGROUP:-boot_secgroup}
-
-# Instance and volume names
-VM_NAME=${VM_NAME:-ex-bfv-inst}
-VOL_NAME=${VOL_NAME:-ex-vol-bfv}
-
-
-# Launching a server
-# ==================
-
-# List servers for project:
-nova list
-
-# Images
-# ------
-
-# List the images available
-openstack image list
-
-# Grab the id of the image to launch
-IMAGE=$(openstack image list | egrep " $DEFAULT_IMAGE_NAME " | get_field 1)
-die_if_not_set $LINENO IMAGE "Failure getting image $DEFAULT_IMAGE_NAME"
-
-# Security Groups
-# ---------------
-
-# List security groups
-nova secgroup-list
-
-if is_service_enabled n-cell; then
-    # Cells does not support security groups, so force the use of "default"
-    SECGROUP="default"
-    echo "Using the default security group because of Cells."
-else
-    # Create a secgroup
-    if ! nova secgroup-list | grep -q $SECGROUP; then
-        nova secgroup-create $SECGROUP "$SECGROUP description"
-        if ! timeout $ASSOCIATE_TIMEOUT sh -c "while ! nova secgroup-list | grep -q $SECGROUP; do sleep 1; done"; then
-            echo "Security group not created"
-            exit 1
-        fi
-    fi
-fi
-
-# Configure Security Group Rules
-if ! nova secgroup-list-rules $SECGROUP | grep -q icmp; then
-    nova secgroup-add-rule $SECGROUP icmp -1 -1 0.0.0.0/0
-fi
-if ! nova secgroup-list-rules $SECGROUP | grep -q " tcp .* 22 "; then
-    nova secgroup-add-rule $SECGROUP tcp 22 22 0.0.0.0/0
-fi
-
-# List secgroup rules
-nova secgroup-list-rules $SECGROUP
-
-# Set up instance
-# ---------------
-
-# List flavors
-nova flavor-list
-
-# Select a flavor
-INSTANCE_TYPE=$(nova flavor-list | grep $DEFAULT_INSTANCE_TYPE | get_field 1)
-if [[ -z "$INSTANCE_TYPE" ]]; then
-    # grab the first flavor in the list to launch if default doesn't exist
-    INSTANCE_TYPE=$(nova flavor-list | head -n 4 | tail -n 1 | get_field 1)
-fi
-
-# Clean-up from previous runs
-nova delete $VM_NAME || true
-if ! timeout $ACTIVE_TIMEOUT sh -c "while nova show $VM_NAME; do sleep 1; done"; then
-    echo "server didn't terminate!"
-    exit 1
-fi
-
-# Setup Keypair
-KEY_NAME=test_key
-KEY_FILE=key.pem
-nova keypair-delete $KEY_NAME || true
-nova keypair-add $KEY_NAME > $KEY_FILE
-chmod 600 $KEY_FILE
-
-# Set up volume
-# -------------
-
-# Delete any old volume
-cinder delete $VOL_NAME || true
-if ! timeout $ACTIVE_TIMEOUT sh -c "while cinder list | grep $VOL_NAME; do sleep 1; done"; then
-    echo "Volume $VOL_NAME not deleted"
-    exit 1
-fi
-
-# Create the bootable volume
-start_time=$(date +%s)
-cinder create --image-id $IMAGE --display-name=$VOL_NAME --display-description "test bootable volume: $VOL_NAME" $DEFAULT_VOLUME_SIZE || \
-    die $LINENO "Failure creating volume $VOL_NAME"
-if ! timeout $ACTIVE_TIMEOUT sh -c "while ! cinder list | grep $VOL_NAME | grep available; do sleep 1; done"; then
-    echo "Volume $VOL_NAME not created"
-    exit 1
-fi
-end_time=$(date +%s)
-echo "Completed cinder create in $((end_time - start_time)) seconds"
-
-# Get volume ID
-VOL_ID=$(cinder list | grep $VOL_NAME  | get_field 1)
-die_if_not_set $LINENO VOL_ID "Failure retrieving volume ID for $VOL_NAME"
-
-# Boot instance
-# -------------
-
-# Boot using the --block-device-mapping param. The format of mapping is:
-# <dev_name>=<id>:<type>:<size(GB)>:<delete_on_terminate>
-# Leaving the middle two fields blank appears to do-the-right-thing
-VM_UUID=$(nova boot --flavor $INSTANCE_TYPE --image $IMAGE --block-device-mapping vda=$VOL_ID --security-groups=$SECGROUP --key-name $KEY_NAME $VM_NAME | grep ' id ' | get_field 2)
-die_if_not_set $LINENO VM_UUID "Failure launching $VM_NAME"
-
-# Check that the status is active within ACTIVE_TIMEOUT seconds
-if ! timeout $ACTIVE_TIMEOUT sh -c "while ! nova show $VM_UUID | grep status | grep -q ACTIVE; do sleep 1; done"; then
-    echo "server didn't become active!"
-    exit 1
-fi
-
-# Get the instance IP
-IP=$(get_instance_ip $VM_UUID $PRIVATE_NETWORK_NAME)
-
-die_if_not_set $LINENO IP "Failure retrieving IP address"
-
-# Private IPs can be pinged in single node deployments
-ping_check $IP $BOOT_TIMEOUT "$PRIVATE_NETWORK_NAME"
-
-# Clean up
-# --------
-
-# Delete volume backed instance
-nova delete $VM_UUID || die $LINENO "Failure deleting instance $VM_NAME"
-if ! timeout $TERMINATE_TIMEOUT sh -c "while nova list | grep -q $VM_UUID; do sleep 1; done"; then
-    echo "Server $VM_NAME not deleted"
-    exit 1
-fi
-
-# Wait for volume to be released
-if ! timeout $ACTIVE_TIMEOUT sh -c "while ! cinder list | grep $VOL_NAME | grep available; do sleep 1; done"; then
-    echo "Volume $VOL_NAME not released"
-    exit 1
-fi
-
-# Delete volume
-start_time=$(date +%s)
-cinder delete $VOL_ID || die $LINENO "Failure deleting volume $VOLUME_NAME"
-if ! timeout $ACTIVE_TIMEOUT sh -c "while cinder list | grep $VOL_NAME; do sleep 1; done"; then
-    echo "Volume $VOL_NAME not deleted"
-    exit 1
-fi
-end_time=$(date +%s)
-echo "Completed cinder delete in $((end_time - start_time)) seconds"
-
-if [[ $SECGROUP = "default" ]] ; then
-    echo "Skipping deleting default security group"
-else
-    # Delete secgroup
-    nova secgroup-delete $SECGROUP || die $LINENO "Failure deleting security group $SECGROUP"
-fi
-
-set +o xtrace
-echo "*********************************************************************"
-echo "SUCCESS: End DevStack Exercise: $0"
-echo "*********************************************************************"
diff --git a/exercises/client-args.sh b/exercises/client-args.sh
deleted file mode 100755
index b380968da8..0000000000
--- a/exercises/client-args.sh
+++ /dev/null
@@ -1,174 +0,0 @@
-#!/usr/bin/env bash
-
-# **client-args.sh**
-
-# Test OpenStack client authentication arguments handling
-
-echo "*********************************************************************"
-echo "Begin DevStack Exercise: $0"
-echo "*********************************************************************"
-
-# This script exits on an error so that errors don't compound and you see
-# only the first error that occurred.
-set -o errexit
-
-# Print the commands being run so that we can see the command that triggers
-# an error.  It is also useful for following as the install occurs.
-set -o xtrace
-
-
-# Settings
-# ========
-
-# Keep track of the current directory
-EXERCISE_DIR=$(cd $(dirname "$0") && pwd)
-TOP_DIR=$(cd $EXERCISE_DIR/..; pwd)
-
-# Import common functions
-source $TOP_DIR/functions
-
-# Import configuration
-source $TOP_DIR/openrc
-
-# Import exercise configuration
-source $TOP_DIR/exerciserc
-
-# Unset all of the known NOVA_* vars
-unset NOVA_API_KEY
-unset NOVA_ENDPOINT_NAME
-unset NOVA_PASSWORD
-unset NOVA_PROJECT_ID
-unset NOVA_REGION_NAME
-unset NOVA_URL
-unset NOVA_USERNAME
-
-# Save the known variables for later
-export x_PROJECT_NAME=$OS_PROJECT_NAME
-export x_USERNAME=$OS_USERNAME
-export x_PASSWORD=$OS_PASSWORD
-export x_AUTH_URL=$OS_AUTH_URL
-
-# Unset the usual variables to force argument processing
-unset OS_PROJECT_NAME
-unset OS_USERNAME
-unset OS_PASSWORD
-unset OS_AUTH_URL
-
-# Common authentication args
-PROJECT_ARG="--os-project-name=$x_PROJECT_NAME"
-ARGS="--os-username=$x_USERNAME --os-password=$x_PASSWORD --os-auth-url=$x_AUTH_URL"
-
-# Set global return
-RETURN=0
-
-# Keystone client
-# ---------------
-if [[ "$ENABLED_SERVICES" =~ "key" ]]; then
-    if [[ "$SKIP_EXERCISES" =~ "key" ]]; then
-        STATUS_KEYSTONE="Skipped"
-    else
-        echo -e "\nTest Keystone"
-        if openstack $PROJECT_ARG $ARGS catalog show identity; then
-            STATUS_KEYSTONE="Succeeded"
-        else
-            STATUS_KEYSTONE="Failed"
-            RETURN=1
-        fi
-    fi
-fi
-
-# Nova client
-# -----------
-
-if [[ "$ENABLED_SERVICES" =~ "n-api" ]]; then
-    if [[ "$SKIP_EXERCISES" =~ "n-api" ]]; then
-        STATUS_NOVA="Skipped"
-    else
-        # Test OSAPI
-        echo -e "\nTest Nova"
-        if nova $PROJECT_ARG $ARGS flavor-list; then
-            STATUS_NOVA="Succeeded"
-        else
-            STATUS_NOVA="Failed"
-            RETURN=1
-        fi
-    fi
-fi
-
-# Cinder client
-# -------------
-
-if [[ "$ENABLED_SERVICES" =~ "c-api" ]]; then
-    if [[ "$SKIP_EXERCISES" =~ "c-api" ]]; then
-        STATUS_CINDER="Skipped"
-    else
-        echo -e "\nTest Cinder"
-        if cinder $PROJECT_ARG $ARGS list; then
-            STATUS_CINDER="Succeeded"
-        else
-            STATUS_CINDER="Failed"
-            RETURN=1
-        fi
-    fi
-fi
-
-# Glance client
-# -------------
-
-if [[ "$ENABLED_SERVICES" =~ "g-api" ]]; then
-    if [[ "$SKIP_EXERCISES" =~ "g-api" ]]; then
-        STATUS_GLANCE="Skipped"
-    else
-        echo -e "\nTest Glance"
-        if openstack $PROJECT_ARG $ARGS image list; then
-            STATUS_GLANCE="Succeeded"
-        else
-            STATUS_GLANCE="Failed"
-            RETURN=1
-        fi
-    fi
-fi
-
-# Swift client
-# ------------
-
-if [[ "$ENABLED_SERVICES" =~ "swift" || "$ENABLED_SERVICES" =~ "s-proxy" ]]; then
-    if [[ "$SKIP_EXERCISES" =~ "swift" ]]; then
-        STATUS_SWIFT="Skipped"
-    else
-        echo -e "\nTest Swift"
-        if swift $PROJECT_ARG $ARGS stat; then
-            STATUS_SWIFT="Succeeded"
-        else
-            STATUS_SWIFT="Failed"
-            RETURN=1
-        fi
-    fi
-fi
-
-set +o xtrace
-
-
-# Results
-# =======
-
-function report {
-    if [[ -n "$2" ]]; then
-        echo "$1: $2"
-    fi
-}
-
-echo -e "\n"
-report "Keystone" $STATUS_KEYSTONE
-report "Nova" $STATUS_NOVA
-report "Cinder" $STATUS_CINDER
-report "Glance" $STATUS_GLANCE
-report "Swift" $STATUS_SWIFT
-
-if (( $RETURN == 0 )); then
-    echo "*********************************************************************"
-    echo "SUCCESS: End DevStack Exercise: $0"
-    echo "*********************************************************************"
-fi
-
-exit $RETURN
diff --git a/exercises/client-env.sh b/exercises/client-env.sh
deleted file mode 100755
index fff04df9f2..0000000000
--- a/exercises/client-env.sh
+++ /dev/null
@@ -1,171 +0,0 @@
-#!/usr/bin/env bash
-
-# **client-env.sh**
-
-# Test OpenStack client environment variable handling
-
-echo "*********************************************************************"
-echo "Begin DevStack Exercise: $0"
-echo "*********************************************************************"
-
-# This script exits on an error so that errors don't compound and you see
-# only the first error that occurred.
-set -o errexit
-
-# Print the commands being run so that we can see the command that triggers
-# an error.  It is also useful for following as the install occurs.
-set -o xtrace
-
-
-# Settings
-# ========
-
-# Keep track of the current directory
-EXERCISE_DIR=$(cd $(dirname "$0") && pwd)
-TOP_DIR=$(cd $EXERCISE_DIR/..; pwd)
-
-# Import common functions
-source $TOP_DIR/functions
-
-# Import configuration
-source $TOP_DIR/openrc admin
-
-# Import exercise configuration
-source $TOP_DIR/exerciserc
-
-# Unset all of the known NOVA_* vars
-unset NOVA_API_KEY
-unset NOVA_ENDPOINT_NAME
-unset NOVA_PASSWORD
-unset NOVA_PROJECT_ID
-unset NOVA_REGION_NAME
-unset NOVA_URL
-unset NOVA_USERNAME
-
-for i in OS_TENANT_NAME OS_USERNAME OS_PASSWORD OS_AUTH_URL; do
-    is_set $i
-    if [[ $? -ne 0 ]]; then
-        echo "$i expected to be set"
-        ABORT=1
-    fi
-done
-if [[ -n "$ABORT" ]]; then
-    exit 1
-fi
-
-# Set global return
-RETURN=0
-
-# Keystone client
-# ---------------
-if [[ "$ENABLED_SERVICES" =~ "key" ]]; then
-    if [[ "$SKIP_EXERCISES" =~ "key" ]]; then
-        STATUS_KEYSTONE="Skipped"
-    else
-        echo -e "\nTest Keystone"
-        if openstack endpoint show identity; then
-            STATUS_KEYSTONE="Succeeded"
-        else
-            STATUS_KEYSTONE="Failed"
-            RETURN=1
-        fi
-    fi
-fi
-
-# Nova client
-# -----------
-
-if [[ "$ENABLED_SERVICES" =~ "n-api" ]]; then
-    if [[ "$SKIP_EXERCISES" =~ "n-api" ]]; then
-        STATUS_NOVA="Skipped"
-    else
-        # Test OSAPI
-        echo -e "\nTest Nova"
-        if nova flavor-list; then
-            STATUS_NOVA="Succeeded"
-        else
-            STATUS_NOVA="Failed"
-            RETURN=1
-        fi
-
-    fi
-fi
-
-# Cinder client
-# -------------
-
-if [[ "$ENABLED_SERVICES" =~ "c-api" ]]; then
-    if [[ "$SKIP_EXERCISES" =~ "c-api" ]]; then
-        STATUS_CINDER="Skipped"
-    else
-        echo -e "\nTest Cinder"
-        if cinder list; then
-            STATUS_CINDER="Succeeded"
-        else
-            STATUS_CINDER="Failed"
-            RETURN=1
-        fi
-    fi
-fi
-
-# Glance client
-# -------------
-
-if [[ "$ENABLED_SERVICES" =~ "g-api" ]]; then
-    if [[ "$SKIP_EXERCISES" =~ "g-api" ]]; then
-        STATUS_GLANCE="Skipped"
-    else
-        echo -e "\nTest Glance"
-        if openstack image list; then
-            STATUS_GLANCE="Succeeded"
-        else
-            STATUS_GLANCE="Failed"
-            RETURN=1
-        fi
-    fi
-fi
-
-# Swift client
-# ------------
-
-
-if [[ "$ENABLED_SERVICES" =~ "swift" || "$ENABLED_SERVICES" =~ "s-proxy" ]]; then
-    if [[ "$SKIP_EXERCISES" =~ "swift" ]]; then
-        STATUS_SWIFT="Skipped"
-    else
-        echo -e "\nTest Swift"
-        if swift stat; then
-            STATUS_SWIFT="Succeeded"
-        else
-            STATUS_SWIFT="Failed"
-            RETURN=1
-        fi
-    fi
-fi
-
-set +o xtrace
-
-
-# Results
-# =======
-
-function report {
-    if [[ -n "$2" ]]; then
-        echo "$1: $2"
-    fi
-}
-
-echo -e "\n"
-report "Keystone" $STATUS_KEYSTONE
-report "Nova" $STATUS_NOVA
-report "Cinder" $STATUS_CINDER
-report "Glance" $STATUS_GLANCE
-report "Swift" $STATUS_SWIFT
-
-if (( $RETURN == 0 )); then
-    echo "*********************************************************************"
-    echo "SUCCESS: End DevStack Exercise: $0"
-    echo "*********************************************************************"
-fi
-
-exit $RETURN
diff --git a/exercises/floating_ips.sh b/exercises/floating_ips.sh
deleted file mode 100755
index 5abc7137b3..0000000000
--- a/exercises/floating_ips.sh
+++ /dev/null
@@ -1,216 +0,0 @@
-#!/usr/bin/env bash
-
-# **floating_ips.sh** - using the cloud can be fun
-
-# Test instance connectivity with the ``nova`` command from ``python-novaclient``
-
-echo "*********************************************************************"
-echo "Begin DevStack Exercise: $0"
-echo "*********************************************************************"
-
-# This script exits on an error so that errors don't compound and you see
-# only the first error that occurred.
-set -o errexit
-
-# Print the commands being run so that we can see the command that triggers
-# an error.  It is also useful for following as the install occurs.
-set -o xtrace
-
-
-# Settings
-# ========
-
-# Keep track of the current directory
-EXERCISE_DIR=$(cd $(dirname "$0") && pwd)
-TOP_DIR=$(cd $EXERCISE_DIR/..; pwd)
-
-# Import common functions
-source $TOP_DIR/functions
-
-# Import configuration
-source $TOP_DIR/openrc
-
-# Import project functions
-source $TOP_DIR/lib/neutron
-source $TOP_DIR/lib/neutron-legacy
-
-# Import exercise configuration
-source $TOP_DIR/exerciserc
-
-# If nova api is not enabled we exit with exitcode 55 so that
-# the exercise is skipped
-is_service_enabled n-api || exit 55
-
-# Instance type to create
-DEFAULT_INSTANCE_TYPE=${DEFAULT_INSTANCE_TYPE:-m1.tiny}
-
-# Boot this image, use first AMI image if unset
-DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-ami}
-
-# Security group name
-SECGROUP=${SECGROUP:-test_secgroup}
-
-# Default floating IP pool name
-DEFAULT_FLOATING_POOL=${DEFAULT_FLOATING_POOL:-public}
-
-# Additional floating IP pool and range
-TEST_FLOATING_POOL=${TEST_FLOATING_POOL:-test}
-
-# Instance name
-VM_NAME="ex-float"
-
-# Cells does not support floating ips API calls
-is_service_enabled n-cell && exit 55
-
-# Launching a server
-# ==================
-
-# List servers for tenant:
-nova list
-
-# Images
-# ------
-
-# List the images available
-openstack image list
-
-# Grab the id of the image to launch
-IMAGE=$(openstack image list | egrep " $DEFAULT_IMAGE_NAME " | get_field 1)
-die_if_not_set $LINENO IMAGE "Failure getting image $DEFAULT_IMAGE_NAME"
-
-# Security Groups
-# ---------------
-
-# List security groups
-nova secgroup-list
-
-# Create a secgroup
-if ! nova secgroup-list | grep -q $SECGROUP; then
-    nova secgroup-create $SECGROUP "$SECGROUP description"
-    if ! timeout $ASSOCIATE_TIMEOUT sh -c "while ! nova secgroup-list | grep -q $SECGROUP; do sleep 1; done"; then
-        die $LINENO "Security group not created"
-    fi
-fi
-
-# Configure Security Group Rules
-if ! nova secgroup-list-rules $SECGROUP | grep -q icmp; then
-    nova secgroup-add-rule $SECGROUP icmp -1 -1 0.0.0.0/0
-fi
-if ! nova secgroup-list-rules $SECGROUP | grep -q " tcp .* 22 "; then
-    nova secgroup-add-rule $SECGROUP tcp 22 22 0.0.0.0/0
-fi
-
-# List secgroup rules
-nova secgroup-list-rules $SECGROUP
-
-# Set up instance
-# ---------------
-
-# List flavors
-nova flavor-list
-
-# Select a flavor
-INSTANCE_TYPE=$(nova flavor-list | grep $DEFAULT_INSTANCE_TYPE | get_field 1)
-if [[ -z "$INSTANCE_TYPE" ]]; then
-    # grab the first flavor in the list to launch if default doesn't exist
-    INSTANCE_TYPE=$(nova flavor-list | head -n 4 | tail -n 1 | get_field 1)
-    die_if_not_set $LINENO INSTANCE_TYPE "Failure retrieving INSTANCE_TYPE"
-fi
-
-# Clean-up from previous runs
-nova delete $VM_NAME || true
-if ! timeout $ACTIVE_TIMEOUT sh -c "while nova show $VM_NAME; do sleep 1; done"; then
-    die $LINENO "server didn't terminate!"
-    exit 1
-fi
-
-# Boot instance
-# -------------
-
-VM_UUID=$(nova boot --flavor $INSTANCE_TYPE --image $IMAGE --security-groups=$SECGROUP $VM_NAME | grep ' id ' | get_field 2)
-die_if_not_set $LINENO VM_UUID "Failure launching $VM_NAME"
-
-# Check that the status is active within ACTIVE_TIMEOUT seconds
-if ! timeout $ACTIVE_TIMEOUT sh -c "while ! nova show $VM_UUID | grep status | grep -q ACTIVE; do sleep 1; done"; then
-    die $LINENO "server didn't become active!"
-fi
-
-# Get the instance IP
-IP=$(get_instance_ip $VM_UUID $PRIVATE_NETWORK_NAME)
-die_if_not_set $LINENO IP "Failure retrieving IP address"
-
-# Private IPs can be pinged in single node deployments
-ping_check $IP $BOOT_TIMEOUT "$PRIVATE_NETWORK_NAME"
-
-# Floating IPs
-# ------------
-
-# Allocate a floating IP from the default pool
-FLOATING_IP=$(nova floating-ip-create | grep $DEFAULT_FLOATING_POOL | get_field 1)
-die_if_not_set $LINENO FLOATING_IP "Failure creating floating IP from pool $DEFAULT_FLOATING_POOL"
-
-# List floating addresses
-if ! timeout $ASSOCIATE_TIMEOUT sh -c "while ! nova floating-ip-list | grep -q $FLOATING_IP; do sleep 1; done"; then
-    die $LINENO "Floating IP not allocated"
-fi
-
-# Add floating IP to our server
-nova add-floating-ip $VM_UUID $FLOATING_IP || \
-    die $LINENO "Failure adding floating IP $FLOATING_IP to $VM_NAME"
-
-# Test we can ping our floating IP within ASSOCIATE_TIMEOUT seconds
-ping_check $FLOATING_IP $ASSOCIATE_TIMEOUT "$PUBLIC_NETWORK_NAME"
-
-if ! is_service_enabled neutron; then
-    # Allocate an IP from second floating pool
-    TEST_FLOATING_IP=$(nova floating-ip-create $TEST_FLOATING_POOL | grep $TEST_FLOATING_POOL | get_field 1)
-    die_if_not_set $LINENO TEST_FLOATING_IP "Failure creating floating IP in $TEST_FLOATING_POOL"
-
-    # list floating addresses
-    if ! timeout $ASSOCIATE_TIMEOUT sh -c "while ! nova floating-ip-list | grep $TEST_FLOATING_POOL | grep -q $TEST_FLOATING_IP; do sleep 1; done"; then
-        die $LINENO "Floating IP not allocated"
-    fi
-fi
-
-# Dis-allow icmp traffic (ping)
-nova secgroup-delete-rule $SECGROUP icmp -1 -1 0.0.0.0/0 || \
-    die $LINENO "Failure deleting security group rule from $SECGROUP"
-
-if ! timeout $ASSOCIATE_TIMEOUT sh -c "while nova secgroup-list-rules $SECGROUP | grep -q icmp; do sleep 1; done"; then
-    die $LINENO "Security group rule not deleted from $SECGROUP"
-fi
-
-# FIXME (anthony): make xs support security groups
-if [ "$VIRT_DRIVER" != "ironic" -a "$VIRT_DRIVER" != "xenserver" -a "$VIRT_DRIVER" != "openvz" ]; then
-    # Test we can aren't able to ping our floating ip within ASSOCIATE_TIMEOUT seconds
-    ping_check $FLOATING_IP $ASSOCIATE_TIMEOUT "$PUBLIC_NETWORK_NAME" Fail
-fi
-
-# Clean up
-# --------
-
-if ! is_service_enabled neutron; then
-    # Delete second floating IP
-    nova floating-ip-delete $TEST_FLOATING_IP || \
-        die $LINENO "Failure deleting floating IP $TEST_FLOATING_IP"
-fi
-
-# Delete the floating ip
-nova floating-ip-delete $FLOATING_IP || \
-    die $LINENO "Failure deleting floating IP $FLOATING_IP"
-
-# Delete instance
-nova delete $VM_UUID || die $LINENO "Failure deleting instance $VM_NAME"
-# Wait for termination
-if ! timeout $TERMINATE_TIMEOUT sh -c "while nova list | grep -q $VM_UUID; do sleep 1; done"; then
-    die $LINENO "Server $VM_NAME not deleted"
-fi
-
-# Delete secgroup
-nova secgroup-delete $SECGROUP || \
-    die $LINENO "Failure deleting security group $SECGROUP"
-
-set +o xtrace
-echo "*********************************************************************"
-echo "SUCCESS: End DevStack Exercise: $0"
-echo "*********************************************************************"
diff --git a/exercises/neutron-adv-test.sh b/exercises/neutron-adv-test.sh
deleted file mode 100755
index e8c8f62140..0000000000
--- a/exercises/neutron-adv-test.sh
+++ /dev/null
@@ -1,466 +0,0 @@
-#!/usr/bin/env bash
-#
-# Copyright 2012, Cisco Systems
-# Copyright 2012, VMware, Inc.
-# Copyright 2012, NTT MCL, Inc.
-#
-# Please direct any questions to dedutta@cisco.com, dwendlandt@vmware.com, nachi@nttmcl.com
-#
-# **neutron-adv-test.sh**
-
-# Perform integration testing of Nova and other components with Neutron.
-
-echo "*********************************************************************"
-echo "Begin DevStack Exercise: $0"
-echo "*********************************************************************"
-
-# This script exits on an error so that errors don't compound and you see
-# only the first error that occurred.
-
-set -o errtrace
-
-# Print the commands being run so that we can see the command that triggers
-# an error.  It is also useful for following as the install occurs.
-set -o xtrace
-
-# Environment
-# -----------
-
-# Keep track of the current directory
-EXERCISE_DIR=$(cd $(dirname "$0") && pwd)
-TOP_DIR=$(cd $EXERCISE_DIR/..; pwd)
-
-# Import common functions
-source $TOP_DIR/functions
-
-# Import configuration
-source $TOP_DIR/openrc
-
-# Import neutron functions
-source $TOP_DIR/lib/neutron
-source $TOP_DIR/lib/neutron-legacy
-
-# If neutron is not enabled we exit with exitcode 55, which means exercise is skipped.
-neutron_plugin_check_adv_test_requirements || exit 55
-
-# Import exercise configuration
-source $TOP_DIR/exerciserc
-
-# Neutron Settings
-# ----------------
-
-PROJECTS="DEMO1"
-# TODO (nati)_Test public network
-#PROJECTS="DEMO1,DEMO2"
-
-PUBLIC_NAME="admin"
-DEMO1_NAME="demo1"
-DEMO2_NAME="demo2"
-
-PUBLIC_NUM_NET=1
-DEMO1_NUM_NET=1
-DEMO2_NUM_NET=2
-
-PUBLIC_NET1_CIDR="200.0.0.0/24"
-DEMO1_NET1_CIDR="10.10.0.0/24"
-DEMO2_NET1_CIDR="10.20.0.0/24"
-DEMO2_NET2_CIDR="10.20.1.0/24"
-
-PUBLIC_NET1_GATEWAY="200.0.0.1"
-DEMO1_NET1_GATEWAY="10.10.0.1"
-DEMO2_NET1_GATEWAY="10.20.0.1"
-DEMO2_NET2_GATEWAY="10.20.1.1"
-
-PUBLIC_NUM_VM=1
-DEMO1_NUM_VM=1
-DEMO2_NUM_VM=2
-
-PUBLIC_VM1_NET='admin-net1'
-DEMO1_VM1_NET='demo1-net1'
-# Multinic settings. But this is fail without nic setting in OS image
-DEMO2_VM1_NET='demo2-net1'
-DEMO2_VM2_NET='demo2-net2'
-
-PUBLIC_NUM_ROUTER=1
-DEMO1_NUM_ROUTER=1
-DEMO2_NUM_ROUTER=1
-
-PUBLIC_ROUTER1_NET="admin-net1"
-DEMO1_ROUTER1_NET="demo1-net1"
-DEMO2_ROUTER1_NET="demo2-net1"
-
-# Various functions
-# -----------------
-
-function foreach_project {
-    COMMAND=$1
-    for PROJECT in ${PROJECTS//,/ };do
-        eval ${COMMAND//%PROJECT%/$PROJECT}
-    done
-}
-
-function foreach_project_resource {
-    COMMAND=$1
-    RESOURCE=$2
-    for PROJECT in ${PROJECTS//,/ };do
-        eval 'NUM=$'"${PROJECT}_NUM_$RESOURCE"
-        for i in `seq $NUM`;do
-            local COMMAND_LOCAL=${COMMAND//%PROJECT%/$PROJECT}
-            COMMAND_LOCAL=${COMMAND_LOCAL//%NUM%/$i}
-            eval $COMMAND_LOCAL
-        done
-    done
-}
-
-function foreach_project_vm {
-    COMMAND=$1
-    foreach_project_resource "$COMMAND" 'VM'
-}
-
-function foreach_project_net {
-    COMMAND=$1
-    foreach_project_resource "$COMMAND" 'NET'
-}
-
-function get_image_id {
-    local IMAGE_ID
-    IMAGE_ID=$(openstack image list | egrep " $DEFAULT_IMAGE_NAME " | get_field 1)
-    die_if_not_set $LINENO IMAGE_ID "Failure retrieving IMAGE_ID"
-    echo "$IMAGE_ID"
-}
-
-function get_project_id {
-    local PROJECT_NAME=$1
-    local PROJECT_ID
-    PROJECT_ID=`openstack project list | grep " $PROJECT_NAME " | head -n 1 | get_field 1`
-    die_if_not_set $LINENO PROJECT_ID "Failure retrieving PROJECT_ID for $PROJECT_NAME"
-    echo "$PROJECT_ID"
-}
-
-function get_user_id {
-    local USER_NAME=$1
-    local USER_ID
-    USER_ID=`openstack user list | grep $USER_NAME | awk '{print $2}'`
-    die_if_not_set $LINENO USER_ID "Failure retrieving USER_ID for $USER_NAME"
-    echo "$USER_ID"
-}
-
-function get_role_id {
-    local ROLE_NAME=$1
-    local ROLE_ID
-    ROLE_ID=`openstack role assignment list | grep $ROLE_NAME | awk '{print $2}'`
-    die_if_not_set $LINENO ROLE_ID "Failure retrieving ROLE_ID for $ROLE_NAME"
-    echo "$ROLE_ID"
-}
-
-function get_network_id {
-    local NETWORK_NAME="$1"
-    local NETWORK_ID
-    NETWORK_ID=`openstack network show -f value -c id $NETWORK_NAME`
-    echo $NETWORK_ID
-}
-
-function get_flavor_id {
-    local INSTANCE_TYPE=$1
-    local FLAVOR_ID
-    FLAVOR_ID=`nova flavor-list | grep $INSTANCE_TYPE | awk '{print $2}'`
-    die_if_not_set $LINENO FLAVOR_ID "Failure retrieving FLAVOR_ID for $INSTANCE_TYPE"
-    echo "$FLAVOR_ID"
-}
-
-function confirm_server_active {
-    local VM_UUID=$1
-    if ! timeout $ACTIVE_TIMEOUT sh -c "while ! nova show $VM_UUID | grep status | grep -q ACTIVE; do sleep 1; done"; then
-        echo "server '$VM_UUID' did not become active!"
-        false
-    fi
-}
-
-function neutron_debug_admin {
-    local os_username=$OS_USERNAME
-    local os_project_id=$OS_PROJECT_ID
-    source $TOP_DIR/openrc admin admin
-    neutron-debug $@
-    source $TOP_DIR/openrc $os_username $os_project_id
-}
-
-function add_project {
-    openstack project create $1
-    openstack user create $2 --password ${ADMIN_PASSWORD} --project $1
-    openstack role add Member --project $1 --user $2
-}
-
-function remove_project {
-    local PROJECT=$1
-    local PROJECT_ID
-    PROJECT_ID=$(get_project_id $PROJECT)
-    openstack project delete $PROJECT_ID
-}
-
-function remove_user {
-    local USER=$1
-    local USER_ID
-    USER_ID=$(get_user_id $USER)
-    openstack user delete $USER_ID
-}
-
-function create_projects {
-    source $TOP_DIR/openrc admin admin
-    add_project demo1 demo1 demo1
-    add_project demo2 demo2 demo2
-    source $TOP_DIR/openrc demo demo
-}
-
-function delete_projects_and_users {
-    source $TOP_DIR/openrc admin admin
-    remove_user demo1
-    remove_project demo1
-    remove_user demo2
-    remove_project demo2
-    echo "removed all projects"
-    source $TOP_DIR/openrc demo demo
-}
-
-function create_network {
-    local PROJECT=$1
-    local GATEWAY=$2
-    local CIDR=$3
-    local NUM=$4
-    local EXTRA=$5
-    local NET_NAME="${PROJECT}-net$NUM"
-    local ROUTER_NAME="${PROJECT}-router${NUM}"
-    source $TOP_DIR/openrc admin admin
-    local PROJECT_ID
-    PROJECT_ID=$(get_project_id $PROJECT)
-    source $TOP_DIR/openrc $PROJECT $PROJECT
-    local NET_ID
-    NET_ID=$(openstack network create --project $PROJECT_ID $NET_NAME $EXTRA| grep ' id ' | awk '{print $4}' )
-    die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PROJECT_ID $NET_NAME $EXTRA"
-    openstack subnet create --ip-version 4 --project $PROJECT_ID --gateway $GATEWAY --subnet-pool None --network $NET_ID --subnet-range $CIDR "${NET_NAME}_subnet"
-    neutron_debug_admin probe-create --device-owner compute $NET_ID
-    source $TOP_DIR/openrc demo demo
-}
-
-function create_networks {
-    foreach_project_net 'create_network ${%PROJECT%_NAME} ${%PROJECT%_NET%NUM%_GATEWAY} ${%PROJECT%_NET%NUM%_CIDR} %NUM% ${%PROJECT%_NET%NUM%_EXTRA}'
-    #TODO(nati) test security group function
-    # allow ICMP for both project's security groups
-    #source $TOP_DIR/openrc demo1 demo1
-    #$NOVA secgroup-add-rule default icmp -1 -1 0.0.0.0/0
-    #source $TOP_DIR/openrc demo2 demo2
-    #$NOVA secgroup-add-rule default icmp -1 -1 0.0.0.0/0
-}
-
-function create_vm {
-    local PROJECT=$1
-    local NUM=$2
-    local NET_NAMES=$3
-    source $TOP_DIR/openrc $PROJECT $PROJECT
-    local NIC=""
-    for NET_NAME in ${NET_NAMES//,/ };do
-        NIC="$NIC --nic net-id="`get_network_id $NET_NAME`
-    done
-    #TODO (nati) Add multi-nic test
-    #TODO (nati) Add public-net test
-    local VM_UUID
-    VM_UUID=`nova boot --flavor $(get_flavor_id m1.tiny) \
-        --image $(get_image_id) \
-        $NIC \
-        $PROJECT-server$NUM | grep ' id ' | cut -d"|" -f3 | sed 's/ //g'`
-    die_if_not_set $LINENO VM_UUID "Failure launching $PROJECT-server$NUM"
-    confirm_server_active $VM_UUID
-}
-
-function create_vms {
-    foreach_project_vm 'create_vm ${%PROJECT%_NAME} %NUM% ${%PROJECT%_VM%NUM%_NET}'
-}
-
-function ping_ip {
-    # Test agent connection.  Assumes namespaces are disabled, and
-    # that DHCP is in use, but not L3
-    local VM_NAME=$1
-    local NET_NAME=$2
-    IP=$(get_instance_ip $VM_NAME $NET_NAME)
-    ping_check $IP $BOOT_TIMEOUT $NET_NAME
-}
-
-function check_vm {
-    local PROJECT=$1
-    local NUM=$2
-    local VM_NAME="$PROJECT-server$NUM"
-    local NET_NAME=$3
-    source $TOP_DIR/openrc $PROJECT $PROJECT
-    ping_ip $VM_NAME $NET_NAME
-    # TODO (nati) test ssh connection
-    # TODO (nati) test inter connection between vm
-    # TODO (nati) test dhcp host routes
-    # TODO (nati) test multi-nic
-}
-
-function check_vms {
-    foreach_project_vm 'check_vm ${%PROJECT%_NAME} %NUM% ${%PROJECT%_VM%NUM%_NET}'
-}
-
-function shutdown_vm {
-    local PROJECT=$1
-    local NUM=$2
-    source $TOP_DIR/openrc $PROJECT $PROJECT
-    VM_NAME=${PROJECT}-server$NUM
-    nova delete $VM_NAME
-}
-
-function shutdown_vms {
-    foreach_project_vm 'shutdown_vm ${%PROJECT%_NAME} %NUM%'
-    if ! timeout $TERMINATE_TIMEOUT sh -c "while nova list | grep -q ACTIVE; do sleep 1; done"; then
-        die $LINENO "Some VMs failed to shutdown"
-    fi
-}
-
-function delete_network {
-    local PROJECT=$1
-    local NUM=$2
-    local NET_NAME="${PROJECT}-net$NUM"
-    source $TOP_DIR/openrc admin admin
-    local PROJECT_ID
-    PROJECT_ID=$(get_project_id $PROJECT)
-    #TODO(nati) comment out until l3-agent merged
-    #for res in port subnet net router;do
-    for net_id in `openstack network list -c ID -c Name | grep $NET_NAME | awk '{print $2}'`;do
-        delete_probe $net_id
-        openstack subnet list | grep $net_id | awk '{print $2}' | xargs -I% openstack subnet delete %
-        openstack network delete $net_id
-    done
-    source $TOP_DIR/openrc demo demo
-}
-
-function delete_networks {
-    foreach_project_net 'delete_network ${%PROJECT%_NAME} %NUM%'
-    # TODO(nati) add secuirty group check after it is implemented
-    # source $TOP_DIR/openrc demo1 demo1
-    # nova secgroup-delete-rule default icmp -1 -1 0.0.0.0/0
-    # source $TOP_DIR/openrc demo2 demo2
-    # nova secgroup-delete-rule default icmp -1 -1 0.0.0.0/0
-}
-
-function create_all {
-    create_projects
-    create_networks
-    create_vms
-}
-
-function delete_all {
-    shutdown_vms
-    delete_networks
-    delete_projects_and_users
-}
-
-function all {
-    create_all
-    check_vms
-    delete_all
-}
-
-# Test functions
-# --------------
-
-function test_functions {
-    IMAGE=$(get_image_id)
-    echo $IMAGE
-
-    PROJECT_ID=$(get_project_id demo)
-    echo $PROJECT_ID
-
-    FLAVOR_ID=$(get_flavor_id m1.tiny)
-    echo $FLAVOR_ID
-
-    NETWORK_ID=$(get_network_id admin)
-    echo $NETWORK_ID
-}
-
-# Usage and main
-# --------------
-
-function usage {
-    echo "$0: [-h]"
-    echo "  -h, --help              Display help message"
-    echo "  -t, --project            Create projects"
-    echo "  -n, --net               Create networks"
-    echo "  -v, --vm                Create vms"
-    echo "  -c, --check             Check connection"
-    echo "  -x, --delete-projects    Delete projects"
-    echo "  -y, --delete-nets       Delete networks"
-    echo "  -z, --delete-vms        Delete vms"
-    echo "  -T, --test              Test functions"
-}
-
-function main {
-
-    echo Description
-
-    if [ $# -eq 0 ] ; then
-        # if no args are provided, run all tests
-        all
-    else
-
-        while [ "$1" != "" ]; do
-            case $1 in
-                -h | --help )   usage
-                                exit
-                                ;;
-                -n | --net )    create_networks
-                                exit
-                                ;;
-                -v | --vm )     create_vms
-                                exit
-                                ;;
-                -t | --project ) create_projects
-                                exit
-                                ;;
-                -c | --check )   check_vms
-                                exit
-                                ;;
-                -T | --test )   test_functions
-                                exit
-                                ;;
-                -x | --delete-projects ) delete_projects_and_users
-                                exit
-                                ;;
-                -y | --delete-nets ) delete_networks
-                                exit
-                                ;;
-                -z | --delete-vms ) shutdown_vms
-                                exit
-                                ;;
-                -a | --all )    all
-                                exit
-                                ;;
-                * )             usage
-                                exit 1
-            esac
-            shift
-        done
-    fi
-}
-
-trap failed ERR
-function failed {
-    local r=$?
-    set +o errtrace
-    set +o xtrace
-    echo "Failed to execute"
-    echo "Starting cleanup..."
-    delete_all
-    echo "Finished cleanup"
-    exit $r
-}
-
-# Kick off script
-# ---------------
-
-echo $*
-main $*
-
-set +o xtrace
-echo "*********************************************************************"
-echo "SUCCESS: End DevStack Exercise: $0"
-echo "*********************************************************************"
diff --git a/exercises/sec_groups.sh b/exercises/sec_groups.sh
deleted file mode 100755
index 2f78e393eb..0000000000
--- a/exercises/sec_groups.sh
+++ /dev/null
@@ -1,81 +0,0 @@
-#!/usr/bin/env bash
-
-# **sec_groups.sh**
-
-# Test security groups via the command line
-
-echo "*********************************************************************"
-echo "Begin DevStack Exercise: $0"
-echo "*********************************************************************"
-
-# This script exits on an error so that errors don't compound and you see
-# only the first error that occurred.
-set -o errexit
-
-# Print the commands being run so that we can see the command that triggers
-# an error.  It is also useful for following as the install occurs.
-set -o xtrace
-
-
-# Settings
-# ========
-
-# Keep track of the current directory
-EXERCISE_DIR=$(cd $(dirname "$0") && pwd)
-TOP_DIR=$(cd $EXERCISE_DIR/..; pwd)
-
-# Import common functions
-source $TOP_DIR/functions
-
-# Import configuration
-source $TOP_DIR/openrc
-
-# Import exercise configuration
-source $TOP_DIR/exerciserc
-
-# If nova api is not enabled we exit with exitcode 55 so that
-# the exercise is skipped
-is_service_enabled n-api || exit 55
-
-
-# Testing Security Groups
-# =======================
-
-# List security groups
-nova secgroup-list
-
-# Create random name for new sec group and create secgroup of said name
-SEC_GROUP_NAME="ex-secgroup-$(openssl rand -hex 4)"
-nova secgroup-create $SEC_GROUP_NAME 'a test security group'
-
-# Add some rules to the secgroup
-RULES_TO_ADD=( 22 3389 5900 )
-
-for RULE in "${RULES_TO_ADD[@]}"; do
-    nova secgroup-add-rule $SEC_GROUP_NAME tcp $RULE $RULE 0.0.0.0/0
-done
-
-# Check to make sure rules were added
-SEC_GROUP_RULES=( $(nova secgroup-list-rules $SEC_GROUP_NAME | grep -v \- | grep -v 'Source Group' | cut -d '|' -f3 | tr -d ' ') )
-die_if_not_set $LINENO SEC_GROUP_RULES "Failure retrieving SEC_GROUP_RULES for $SEC_GROUP_NAME"
-for i in "${RULES_TO_ADD[@]}"; do
-    skip=
-    for j in "${SEC_GROUP_RULES[@]}"; do
-        [[ $i == $j ]] && { skip=1; break; }
-    done
-    [[ -n $skip ]] || exit 1
-done
-
-# Delete rules and secgroup
-for RULE in "${RULES_TO_ADD[@]}"; do
-    nova secgroup-delete-rule $SEC_GROUP_NAME tcp $RULE $RULE 0.0.0.0/0
-done
-
-# Delete secgroup
-nova secgroup-delete $SEC_GROUP_NAME || \
-    die $LINENO "Failure deleting security group $SEC_GROUP_NAME"
-
-set +o xtrace
-echo "*********************************************************************"
-echo "SUCCESS: End DevStack Exercise: $0"
-echo "*********************************************************************"
diff --git a/exercises/swift.sh b/exercises/swift.sh
deleted file mode 100755
index 8aa376b8a7..0000000000
--- a/exercises/swift.sh
+++ /dev/null
@@ -1,69 +0,0 @@
-#!/usr/bin/env bash
-
-# **swift.sh**
-
-# Test swift via the ``python-openstackclient`` command line
-
-echo "*********************************************************************"
-echo "Begin DevStack Exercise: $0"
-echo "*********************************************************************"
-
-# This script exits on an error so that errors don't compound and you see
-# only the first error that occurred.
-set -o errexit
-
-# Print the commands being run so that we can see the command that triggers
-# an error.  It is also useful for following as the install occurs.
-set -o xtrace
-
-
-# Settings
-# ========
-
-# Keep track of the current directory
-EXERCISE_DIR=$(cd $(dirname "$0") && pwd)
-TOP_DIR=$(cd $EXERCISE_DIR/..; pwd)
-
-# Import common functions
-source $TOP_DIR/functions
-
-# Import configuration
-source $TOP_DIR/openrc
-
-# Import exercise configuration
-source $TOP_DIR/exerciserc
-
-# If swift is not enabled we exit with exitcode 55 which mean
-# exercise is skipped.
-is_service_enabled s-proxy || exit 55
-
-# Container name
-CONTAINER=ex-swift
-OBJECT=/etc/issue
-
-
-# Testing Swift
-# =============
-
-# Check if we have to swift via keystone
-openstack object store account show || die $LINENO "Failure getting account status"
-
-# We start by creating a test container
-openstack container create $CONTAINER || die $LINENO "Failure creating container $CONTAINER"
-
-# add a file into it.
-openstack object create $CONTAINER $OBJECT || die $LINENO "Failure uploading file to container $CONTAINER"
-
-# list the objects
-openstack object list $CONTAINER || die $LINENO "Failure listing contents of container $CONTAINER"
-
-# delete the object first
-openstack object delete $CONTAINER $OBJECT || die $LINENO "Failure deleting object $OBJECT in container $CONTAINER"
-
-# delete the container
-openstack container delete $CONTAINER || die $LINENO "Failure deleting container $CONTAINER"
-
-set +o xtrace
-echo "*********************************************************************"
-echo "SUCCESS: End DevStack Exercise: $0"
-echo "*********************************************************************"
diff --git a/exercises/volumes.sh b/exercises/volumes.sh
deleted file mode 100755
index e7c3560894..0000000000
--- a/exercises/volumes.sh
+++ /dev/null
@@ -1,225 +0,0 @@
-#!/usr/bin/env bash
-
-# **volumes.sh**
-
-# Test cinder volumes with the ``cinder`` command from ``python-cinderclient``
-
-echo "*********************************************************************"
-echo "Begin DevStack Exercise: $0"
-echo "*********************************************************************"
-
-# This script exits on an error so that errors don't compound and you see
-# only the first error that occurred.
-set -o errexit
-
-# Print the commands being run so that we can see the command that triggers
-# an error.  It is also useful for following as the install occurs.
-set -o xtrace
-
-
-# Settings
-# ========
-
-# Keep track of the current directory
-EXERCISE_DIR=$(cd $(dirname "$0") && pwd)
-TOP_DIR=$(cd $EXERCISE_DIR/..; pwd)
-
-# Import common functions
-source $TOP_DIR/functions
-
-# Import configuration
-source $TOP_DIR/openrc
-
-# Import project functions
-source $TOP_DIR/lib/cinder
-source $TOP_DIR/lib/neutron
-source $TOP_DIR/lib/neutron-legacy
-
-# Import exercise configuration
-source $TOP_DIR/exerciserc
-
-# If cinder is not enabled we exit with exitcode 55 which mean
-# exercise is skipped.
-is_service_enabled cinder || exit 55
-
-# Ironic does not currently support volume attachment.
-[ "$VIRT_DRIVER" == "ironic" ] && exit 55
-
-# Instance type to create
-DEFAULT_INSTANCE_TYPE=${DEFAULT_INSTANCE_TYPE:-m1.tiny}
-
-# Boot this image, use first AMI image if unset
-DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-ami}
-
-# Security group name
-SECGROUP=${SECGROUP:-vol_secgroup}
-
-# Instance and volume names
-VM_NAME=${VM_NAME:-ex-vol-inst}
-VOL_NAME="ex-vol-$(openssl rand -hex 4)"
-
-
-# Launching a server
-# ==================
-
-# List servers for tenant:
-nova list
-
-# Images
-# ------
-
-# List the images available
-openstack image list
-
-# Grab the id of the image to launch
-IMAGE=$(openstack image list | egrep " $DEFAULT_IMAGE_NAME " | get_field 1)
-die_if_not_set $LINENO IMAGE "Failure getting image $DEFAULT_IMAGE_NAME"
-
-# Security Groups
-# ---------------
-
-# List security groups
-nova secgroup-list
-
-if is_service_enabled n-cell; then
-    # Cells does not support security groups, so force the use of "default"
-    SECGROUP="default"
-    echo "Using the default security group because of Cells."
-else
-    # Create a secgroup
-    if ! nova secgroup-list | grep -q $SECGROUP; then
-        nova secgroup-create $SECGROUP "$SECGROUP description"
-        if ! timeout $ASSOCIATE_TIMEOUT sh -c "while ! nova secgroup-list | grep -q $SECGROUP; do sleep 1; done"; then
-            echo "Security group not created"
-            exit 1
-        fi
-    fi
-fi
-
-# Configure Security Group Rules
-if ! nova secgroup-list-rules $SECGROUP | grep -q icmp; then
-    nova secgroup-add-rule $SECGROUP icmp -1 -1 0.0.0.0/0
-fi
-if ! nova secgroup-list-rules $SECGROUP | grep -q " tcp .* 22 "; then
-    nova secgroup-add-rule $SECGROUP tcp 22 22 0.0.0.0/0
-fi
-
-# List secgroup rules
-nova secgroup-list-rules $SECGROUP
-
-# Set up instance
-# ---------------
-
-# List flavors
-nova flavor-list
-
-# Select a flavor
-INSTANCE_TYPE=$(nova flavor-list | grep $DEFAULT_INSTANCE_TYPE | get_field 1)
-if [[ -z "$INSTANCE_TYPE" ]]; then
-    # grab the first flavor in the list to launch if default doesn't exist
-    INSTANCE_TYPE=$(nova flavor-list | head -n 4 | tail -n 1 | get_field 1)
-    die_if_not_set $LINENO INSTANCE_TYPE "Failure retrieving INSTANCE_TYPE"
-fi
-
-# Clean-up from previous runs
-nova delete $VM_NAME || true
-if ! timeout $ACTIVE_TIMEOUT sh -c "while nova show $VM_NAME; do sleep 1; done"; then
-    die $LINENO "server didn't terminate!"
-fi
-
-# Boot instance
-# -------------
-
-VM_UUID=$(nova boot --flavor $INSTANCE_TYPE --image $IMAGE --security-groups=$SECGROUP $VM_NAME | grep ' id ' | get_field 2)
-die_if_not_set $LINENO VM_UUID "Failure launching $VM_NAME"
-
-# Check that the status is active within ACTIVE_TIMEOUT seconds
-if ! timeout $ACTIVE_TIMEOUT sh -c "while ! nova show $VM_UUID | grep status | grep -q ACTIVE; do sleep 1; done"; then
-    die $LINENO "server didn't become active!"
-fi
-
-# Get the instance IP
-IP=$(get_instance_ip $VM_UUID $PRIVATE_NETWORK_NAME)
-
-die_if_not_set $LINENO IP "Failure retrieving IP address"
-
-# Private IPs can be pinged in single node deployments
-ping_check $IP $BOOT_TIMEOUT "$PRIVATE_NETWORK_NAME"
-
-# Volumes
-# -------
-
-# Verify it doesn't exist
-if [[ -n $(cinder list | grep $VOL_NAME | head -1 | get_field 2) ]]; then
-    die $LINENO "Volume $VOL_NAME already exists"
-fi
-
-# Create a new volume
-start_time=$(date +%s)
-cinder create --display-name $VOL_NAME --display-description "test volume: $VOL_NAME" $DEFAULT_VOLUME_SIZE || \
-    die $LINENO "Failure creating volume $VOL_NAME"
-if ! timeout $ACTIVE_TIMEOUT sh -c "while ! cinder list | grep $VOL_NAME | grep available; do sleep 1; done"; then
-    die $LINENO "Volume $VOL_NAME not created"
-fi
-end_time=$(date +%s)
-echo "Completed cinder create in $((end_time - start_time)) seconds"
-
-# Get volume ID
-VOL_ID=$(cinder list | grep $VOL_NAME | head -1 | get_field 1)
-die_if_not_set $LINENO VOL_ID "Failure retrieving volume ID for $VOL_NAME"
-
-# Attach to server
-DEVICE=/dev/vdb
-start_time=$(date +%s)
-nova volume-attach $VM_UUID $VOL_ID $DEVICE || \
-    die $LINENO "Failure attaching volume $VOL_NAME to $VM_NAME"
-if ! timeout $ACTIVE_TIMEOUT sh -c "while ! cinder list | grep $VOL_NAME | grep in-use; do sleep 1; done"; then
-    die $LINENO "Volume $VOL_NAME not attached to $VM_NAME"
-fi
-end_time=$(date +%s)
-echo "Completed volume-attach in $((end_time - start_time)) seconds"
-
-VOL_ATTACH=$(cinder list | grep $VOL_NAME | head -1 | get_field -1)
-die_if_not_set $LINENO VOL_ATTACH "Failure retrieving $VOL_NAME status"
-if [[ "$VOL_ATTACH" != $VM_UUID ]]; then
-    die $LINENO "Volume not attached to correct instance"
-fi
-
-# Clean up
-# --------
-
-# Detach volume
-start_time=$(date +%s)
-nova volume-detach $VM_UUID $VOL_ID || die $LINENO "Failure detaching volume $VOL_NAME from $VM_NAME"
-if ! timeout $ACTIVE_TIMEOUT sh -c "while ! cinder list | grep $VOL_NAME | grep available; do sleep 1; done"; then
-    die $LINENO "Volume $VOL_NAME not detached from $VM_NAME"
-fi
-end_time=$(date +%s)
-echo "Completed volume-detach in $((end_time - start_time)) seconds"
-
-# Delete volume
-start_time=$(date +%s)
-cinder delete $VOL_ID || die $LINENO "Failure deleting volume $VOL_NAME"
-if ! timeout $ACTIVE_TIMEOUT sh -c "while cinder list | grep $VOL_NAME; do sleep 1; done"; then
-    die $LINENO "Volume $VOL_NAME not deleted"
-fi
-end_time=$(date +%s)
-echo "Completed cinder delete in $((end_time - start_time)) seconds"
-
-# Delete instance
-nova delete $VM_UUID || die $LINENO "Failure deleting instance $VM_NAME"
-if ! timeout $TERMINATE_TIMEOUT sh -c "while nova list | grep -q $VM_UUID; do sleep 1; done"; then
-    die $LINENO "Server $VM_NAME not deleted"
-fi
-
-if [[ $SECGROUP = "default" ]] ; then
-    echo "Skipping deleting default security group"
-else
-    # Delete secgroup
-    nova secgroup-delete $SECGROUP || die $LINENO "Failure deleting security group $SECGROUP"
-fi
-
-set +o xtrace
-echo "*********************************************************************"
-echo "SUCCESS: End DevStack Exercise: $0"
-echo "*********************************************************************"

From 3cdff78fbac6a88c4864d4effa8126610bcce2fd Mon Sep 17 00:00:00 2001
From: Felipe Monteiro <felipe.monteiro@att.com>
Date: Mon, 9 Jul 2018 20:25:08 +0100
Subject: [PATCH 1375/2409] Rename "Member" role in tempest_roles to "member"

Recently, Keystone renamed "Member" role to "member"
(case-sensitive) with https://review.openstack.org/#/c/572243/14

Case-sensitivity role requirement in Keystone was recently
formalized with https://review.openstack.org/#/c/576640/

From the above reference:

"Role names are case-insensitive. for example, when keystone
bootstraps default roles, it creates `admin`, `member`, and
`reader`. If another role `Member` (note the upper case 'M') is
created, keystone will return a `409` Conflict since it considers
the name "Member" == "member". Note that case is preserved in these
cases."

It follows that Tempest should use "member" role by default.

Change-Id: Iebf04fdb4c195b6779c74f66da3f7822cf174494
---
 lib/tempest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index 60f571ceb3..a0f9dd8778 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -581,7 +581,7 @@ function configure_tempest {
     tox -evenv-tempest -- pip install -c u-c-m.txt -r requirements.txt
 
     # Auth:
-    iniset $TEMPEST_CONFIG auth tempest_roles "Member"
+    iniset $TEMPEST_CONFIG auth tempest_roles "member"
     if [[ $TEMPEST_USE_TEST_ACCOUNTS == "True" ]]; then
         if [[ $TEMPEST_HAS_ADMIN == "True" ]]; then
             tox -evenv-tempest -- tempest-account-generator -c $TEMPEST_CONFIG --os-username $admin_username --os-password "$password" --os-tenant-name $admin_project_name -r $TEMPEST_CONCURRENCY --with-admin etc/accounts.yaml

From 31c7d5c796fac2d3d67e893388166f7cf26c6a33 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Mon, 23 Jul 2018 09:25:08 -0400
Subject: [PATCH 1376/2409] cinder: configure backup_swift_url in subnodes

The tempest-multinode-full job is running the c-bak
service on the subnode where swift isn't running, and
because of the "is_enabled_service swift" check, cinder
on the subnode wasn't getting configured to talk to
swift so the c-bak service was down. Since chances are
good that we're running swift, just configure cinder
to always use it.

Change-Id: I86b090967dadeeefc017ff0311beeea9441b6ba6
Closes-Bug: #1783128
---
 lib/cinder | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/lib/cinder b/lib/cinder
index 92d0295b5b..664f423c73 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -268,7 +268,12 @@ function configure_cinder {
         configure_cinder_image_volume_cache
     fi
 
-    if is_service_enabled swift; then
+    if is_service_enabled c-bak; then
+        # NOTE(mriedem): The default backup driver uses swift and if we're
+        # on a subnode we might not know if swift is enabled, but chances are
+        # good that it is on the controller so configure the backup service
+        # to use it. If we want to configure the backup service to use
+        # a non-swift driver, we'll likely need environment variables.
         iniset $CINDER_CONF DEFAULT backup_swift_url "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$SWIFT_DEFAULT_BIND_PORT/v1/AUTH_"
     fi
 

From 1481322d7466c2b53a6144963663173ff0404422 Mon Sep 17 00:00:00 2001
From: Matthew Edmonds <edmondsw@us.ibm.com>
Date: Fri, 27 Jul 2018 15:48:38 -0400
Subject: [PATCH 1377/2409] Correct neutron docs

The neutron guide refers to ENABLE_PROJECT_VLANS and
PROJECT_VLAN_RANGE but these are not present/checked in the code,
which uses ENABLE_TENANT_VLANS and TENANT_VLAN_RANGE. This
corrects the documentation to match.

Change-Id: I204356c861157e9fab357bb4dde55185bf18a707
---
 doc/source/guides/neutron.rst | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index 7f360c63cc..12c6d6902d 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -376,8 +376,8 @@ controller node.
 
         ## Neutron options
         Q_USE_SECGROUP=True
-        ENABLE_PROJECT_VLANS=True
-        PROJECT_VLAN_RANGE=3001:4000
+        ENABLE_TENANT_VLANS=True
+        TENANT_VLAN_RANGE=3001:4000
         PHYSICAL_NETWORK=default
         OVS_PHYSICAL_BRIDGE=br-ex
 

From 66b361b53884ef1755d18cbab1b6898ebd78caa1 Mon Sep 17 00:00:00 2001
From: Kevin Benton <kevin@benton.pub>
Date: Tue, 13 Jun 2017 00:31:01 -0700
Subject: [PATCH 1378/2409] WSGI Neutron integration

This patch provides a new mechanism to deploy Neutron using
WSGI script. This also starts a Neutron RPC server process
when the Neutron API is loaded via a WSGI entry point to
serve the agents.

Co-Authored-By: Victor Morales <victor.morales@intel.com>
Co-Authored-By: Nguyen Phuong An <AnNP@vn.fujitsu.com>

Change-Id: I16a199b04858bfc03ef50d9883154dba8b0d66ea
Depends-On: https://review.openstack.org/#/c/580049/
Partially-implements: blueprint run-in-wsgi-server
---
 .zuul.yaml                    | 13 ++++++++
 files/apache-neutron.template | 36 ++++++++++++++++++++
 lib/neutron                   | 63 ++++++++++++++++++++++++++++-------
 lib/neutron-legacy            | 51 ++++++++++++++++++++++------
 4 files changed, 140 insertions(+), 23 deletions(-)
 create mode 100644 files/apache-neutron.template

diff --git a/.zuul.yaml b/.zuul.yaml
index 57cbf88e1d..67ffe0805b 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -511,6 +511,16 @@
     #    changes to devstack w/o gating on it for all devstack changes.
     # * nova-next: maintained by nova for unreleased/undefaulted
     #    things like cellsv2 and placement-api
+    # * neutron-fullstack-with-uwsgi: maintained by neutron for fullstack test
+    #    when neutron-api is served by uwsgi, it's in exprimental for testing.
+    #    the next cycle we can remove this  job if things turn out to be
+    #    stable enough.
+    # * neutron-functional-with-uwsgi: maintained by neutron for functional
+    #    test. Next cycle we can remove this one if things turn out to be
+    #    stable engouh with uwsgi.
+    # * neutron-tempest-with-uwsgi: maintained by neutron for tempest test.
+    #    Next cycle we can remove this if everything run out stable enough.
+
     experimental:
       jobs:
         - nova-cells-v1:
@@ -518,3 +528,6 @@
               - ^.*\.rst$
               - ^doc/.*$
         - nova-next
+        - neutron-fullstack-with-uwsgi
+        - neutron-functional-with-uwsgi
+        - neutron-tempest-with-uwsgi
\ No newline at end of file
diff --git a/files/apache-neutron.template b/files/apache-neutron.template
new file mode 100644
index 0000000000..c7796b93bf
--- /dev/null
+++ b/files/apache-neutron.template
@@ -0,0 +1,36 @@
+Listen %PUBLICPORT%
+LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\" %D(us)" neutron_combined
+
+<Directory %NEUTRON_BIN%>
+    Require all granted
+</Directory>
+
+<VirtualHost *:%PUBLICPORT%>
+    WSGIDaemonProcess neutron-server processes=%APIWORKERS% threads=1 user=%USER% display-name=%{GROUP} %VIRTUALENV%
+    WSGIProcessGroup neutron-server
+    WSGIScriptAlias / %NEUTRON_BIN%/neutron-api
+    WSGIApplicationGroup %{GLOBAL}
+    WSGIPassAuthorization On
+    ErrorLogFormat "%M"
+    ErrorLog /var/log/%APACHE_NAME%/neutron.log
+    CustomLog /var/log/%APACHE_NAME%/neutron_access.log neutron_combined
+    %SSLENGINE%
+    %SSLCERTFILE%
+    %SSLKEYFILE%
+</VirtualHost>
+
+
+%SSLLISTEN%<VirtualHost *:443>
+%SSLLISTEN%    %SSLENGINE%
+%SSLLISTEN%    %SSLCERTFILE%
+%SSLLISTEN%    %SSLKEYFILE%
+%SSLLISTEN%</VirtualHost>
+
+Alias /networking %NEUTRON_BIN%/neutron-api
+<Location /networking>
+    SetHandler wsgi-script
+    Options +ExecCGI
+    WSGIProcessGroup neutron-server
+    WSGIApplicationGroup %{GLOBAL}
+    WSGIPassAuthorization On
+</Location>
diff --git a/lib/neutron b/lib/neutron
index 9f9b132377..4847e87f2f 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -28,6 +28,12 @@ set +o xtrace
 # Set up default directories
 GITDIR["python-neutronclient"]=$DEST/python-neutronclient
 
+# NEUTRON_DEPLOY_MOD_WSGI defines how neutron is deployed, allowed values:
+# - False (default) : Run neutron under Eventlet
+# - True : Run neutron under uwsgi
+# TODO(annp): Switching to uwsgi in next cycle if things turn out to be stable
+# enough
+NEUTRON_DEPLOY_MOD_WSGI=${NEUTRON_DEPLOY_MOD_WSGI:-False}
 NEUTRON_AGENT=${NEUTRON_AGENT:-openvswitch}
 NEUTRON_DIR=$DEST/neutron
 NEUTRON_AUTH_CACHE_DIR=${NEUTRON_AUTH_CACHE_DIR:-/var/cache/neutron}
@@ -58,6 +64,8 @@ NEUTRON_CREATE_INITIAL_NETWORKS=${NEUTRON_CREATE_INITIAL_NETWORKS:-True}
 NEUTRON_STATE_PATH=${NEUTRON_STATE_PATH:=$DATA_DIR/neutron}
 NEUTRON_AUTH_CACHE_DIR=${NEUTRON_AUTH_CACHE_DIR:-/var/cache/neutron}
 
+NEUTRON_UWSGI_CONF=$NEUTRON_CONF_DIR/neutron-api-uwsgi.ini
+
 # By default, use the ML2 plugin
 NEUTRON_CORE_PLUGIN=${NEUTRON_CORE_PLUGIN:-ml2}
 NEUTRON_CORE_PLUGIN_CONF_FILENAME=${NEUTRON_CORE_PLUGIN_CONF_FILENAME:-ml2_conf.ini}
@@ -286,7 +294,7 @@ function configure_neutron_new {
     # Format logging
     setup_logging $NEUTRON_CONF
 
-    if is_service_enabled tls-proxy; then
+    if is_service_enabled tls-proxy && [ "$NEUTRON_DEPLOY_MOD_WSGI" == "False" ]; then
         # Set the service port for a proxy to take the original
         iniset $NEUTRON_CONF DEFAULT bind_port "$NEUTRON_SERVICE_PORT_INT"
         iniset $NEUTRON_CONF oslo_middleware enable_proxy_headers_parsing True
@@ -357,6 +365,15 @@ function configure_neutron_nova_new {
 
 # create_neutron_accounts() - Create required service accounts
 function create_neutron_accounts_new {
+    local neutron_url
+
+    if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
+        neutron_url=$NEUTRON_SERVICE_PROTOCOL://$NEUTRON_SERVICE_HOST/networking/
+    else
+        neutron_url=$NEUTRON_SERVICE_PROTOCOL://$NEUTRON_SERVICE_HOST:$NEUTRON_SERVICE_PORT/
+    fi
+
+
     if [[ "$ENABLED_SERVICES" =~ "neutron-api" ]]; then
 
         create_service_user "neutron"
@@ -364,8 +381,7 @@ function create_neutron_accounts_new {
         neutron_service=$(get_or_create_service "neutron" \
             "network" "Neutron Service")
         get_or_create_endpoint $neutron_service \
-            "$REGION_NAME" \
-            "$NEUTRON_SERVICE_PROTOCOL://$NEUTRON_SERVICE_HOST:$NEUTRON_SERVICE_PORT/"
+            "$REGION_NAME" "$neutron_url"
     fi
 }
 
@@ -427,6 +443,7 @@ function install_neutronclient {
 function start_neutron_api {
     local service_port=$NEUTRON_SERVICE_PORT
     local service_protocol=$NEUTRON_SERVICE_PROTOCOL
+    local neutron_url
     if is_service_enabled tls-proxy; then
         service_port=$NEUTRON_SERVICE_PORT_INT
         service_protocol="http"
@@ -440,17 +457,24 @@ function start_neutron_api {
         opts+=" --config-file $cfg_file"
     done
 
-    # Start the Neutron service
-    # TODO(sc68cal) Stop hard coding this
-    run_process neutron-api "$NEUTRON_BIN_DIR/neutron-server $opts"
-
-    if ! wait_for_service $SERVICE_TIMEOUT $service_protocol://$NEUTRON_SERVICE_HOST:$service_port; then
-        die $LINENO "neutron-api did not start"
+    if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
+        run_process neutron-api "$NEUTRON_BIN_DIR/uwsgi --procname-prefix neutron-api --ini $NEUTRON_UWSGI_CONF"
+        neutron_url=$service_protocol://$NEUTRON_SERVICE_HOST/networking/
+        enable_service neutron-rpc-server
+        run_process neutron-rpc-server "$NEUTRON_BIN_DIR/neutron-rpc-server $opts"
+    else
+        # Start the Neutron service
+        # TODO(sc68cal) Stop hard coding this
+        run_process neutron-api "$NEUTRON_BIN_DIR/neutron-server $opts"
+        neutron_url=$service_protocol://$NEUTRON_SERVICE_HOST:$service_port
+        # Start proxy if enabled
+        if is_service_enabled tls-proxy; then
+            start_tls_proxy neutron '*' $NEUTRON_SERVICE_PORT $NEUTRON_SERVICE_HOST $NEUTRON_SERVICE_PORT_INT
+        fi
     fi
 
-    # Start proxy if enabled
-    if is_service_enabled tls-proxy; then
-        start_tls_proxy neutron '*' $NEUTRON_SERVICE_PORT $NEUTRON_SERVICE_HOST $NEUTRON_SERVICE_PORT_INT
+    if ! wait_for_service $SERVICE_TIMEOUT $neutron_url; then
+        die $LINENO "neutron-api did not start"
     fi
 }
 
@@ -497,6 +521,10 @@ function stop_neutron_new {
         stop_process $serv
     done
 
+    if is_service_enabled neutron-rpc-server; then
+        stop_process neutron-rpc-server
+    fi
+
     if is_service_enabled neutron-dhcp; then
         stop_process neutron-dhcp
         pid=$(ps aux | awk '/[d]nsmasq.+interface=(tap|ns-)/ { print $2 }')
@@ -551,6 +579,13 @@ function neutron_deploy_rootwrap_filters_new {
 # neutron-legacy is removed.
 # TODO(sc68cal) Remove when neutron-legacy is no more.
 function cleanup_neutron {
+    if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
+        stop_process neutron-api
+        stop_process neutron-rpc-server
+        remove_uwsgi_config "$NEUTRON_UWSGI_CONF" "$NEUTRON_BIN_DIR/neutron-api"
+        sudo rm -f $(apache_site_config_for neutron-api)
+    fi
+
     if is_neutron_legacy_enabled; then
         # Call back to old function
         cleanup_mutnauq "$@"
@@ -566,6 +601,10 @@ function configure_neutron {
     else
         configure_neutron_new "$@"
     fi
+
+    if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
+        write_uwsgi_config "$NEUTRON_UWSGI_CONF" "$NEUTRON_BIN_DIR/neutron-api" "/networking"
+    fi
 }
 
 function configure_neutron_nova {
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 15bcfe36b9..9330b23802 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -86,6 +86,15 @@ NEUTRON_CONF_DIR=/etc/neutron
 NEUTRON_CONF=$NEUTRON_CONF_DIR/neutron.conf
 export NEUTRON_TEST_CONFIG_FILE=${NEUTRON_TEST_CONFIG_FILE:-"$NEUTRON_CONF_DIR/debug.ini"}
 
+# NEUTRON_DEPLOY_MOD_WSGI defines how neutron is deployed, allowed values:
+# - False (default) : Run neutron under Eventlet
+# - True : Run neutron under uwsgi
+# TODO(annp): Switching to uwsgi in next cycle if things turn out to be stable
+# enough
+NEUTRON_DEPLOY_MOD_WSGI=${NEUTRON_DEPLOY_MOD_WSGI:-False}
+
+NEUTRON_UWSGI_CONF=$NEUTRON_CONF_DIR/neutron-api-uwsgi.ini
+
 # Agent binaries.  Note, binary paths for other agents are set in per-service
 # scripts in lib/neutron_plugins/services/
 AGENT_DHCP_BINARY="$NEUTRON_BIN_DIR/neutron-dhcp-agent"
@@ -402,6 +411,13 @@ function create_nova_conf_neutron {
 
 # Migrated from keystone_data.sh
 function create_mutnauq_accounts {
+    local neutron_url
+    if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
+        neutron_url=$Q_PROTOCOL://$SERVICE_HOST/networking/
+    else
+        neutron_url=$Q_PROTOCOL://$SERVICE_HOST:$Q_PORT/
+    fi
+
     if [[ "$ENABLED_SERVICES" =~ "q-svc" ]]; then
 
         create_service_user "neutron"
@@ -409,8 +425,7 @@ function create_mutnauq_accounts {
         get_or_create_service "neutron" "network" "Neutron Service"
         get_or_create_endpoint \
             "network" \
-            "$REGION_NAME" \
-            "$Q_PROTOCOL://$SERVICE_HOST:$Q_PORT/"
+            "$REGION_NAME" "$neutron_url"
     fi
 }
 
@@ -460,6 +475,7 @@ function start_neutron_service_and_check {
     local service_port=$Q_PORT
     local service_protocol=$Q_PROTOCOL
     local cfg_file_options
+    local neutron_url
 
     cfg_file_options="$(determine_config_files neutron-server)"
 
@@ -468,16 +484,24 @@ function start_neutron_service_and_check {
         service_protocol="http"
     fi
     # Start the Neutron service
-    run_process q-svc "$NEUTRON_BIN_DIR/neutron-server $cfg_file_options"
+    if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
+        enable_service neutron-api
+        run_process neutron-api "$NEUTRON_BIN_DIR/uwsgi --procname-prefix neutron-api --ini $NEUTRON_UWSGI_CONF"
+        neutron_url=$Q_PROTOCOL://$Q_HOST/networking/
+        enable_service neutron-rpc-server
+        run_process neutron-rpc-server "$NEUTRON_BIN_DIR/neutron-rpc-server $cfg_file_options"
+    else
+        run_process q-svc "$NEUTRON_BIN_DIR/neutron-server $cfg_file_options"
+        neutron_url=$service_protocol://$Q_HOST:$service_port
+        # Start proxy if enabled
+        if is_service_enabled tls-proxy; then
+            start_tls_proxy neutron '*' $Q_PORT $Q_HOST $Q_PORT_INT
+        fi
+    fi
     echo "Waiting for Neutron to start..."
 
-    local testcmd="wget ${ssl_ca} --no-proxy -q -O- $service_protocol://$Q_HOST:$service_port"
+    local testcmd="wget ${ssl_ca} --no-proxy -q -O- $neutron_url"
     test_with_retry "$testcmd" "Neutron did not start" $SERVICE_TIMEOUT
-
-    # Start proxy if enabled
-    if is_service_enabled tls-proxy; then
-        start_tls_proxy neutron '*' $Q_PORT $Q_HOST $Q_PORT_INT
-    fi
 }
 
 # Control of the l2 agent is separated out to make it easier to test partial
@@ -532,7 +556,12 @@ function stop_mutnauq_other {
         [ ! -z "$pid" ] && sudo kill -9 $pid
     fi
 
-    stop_process q-svc
+    if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
+        stop_process neutron-rpc-server
+        stop_process neutron-api
+    else
+        stop_process q-svc
+    fi
 
     if is_service_enabled q-l3; then
         sudo pkill -f "radvd -C $DATA_DIR/neutron/ra"
@@ -715,7 +744,7 @@ function _configure_neutron_common {
     # Format logging
     setup_logging $NEUTRON_CONF
 
-    if is_service_enabled tls-proxy; then
+    if is_service_enabled tls-proxy && [ "$NEUTRON_DEPLOY_MOD_WSGI" == "False" ]; then
         # Set the service port for a proxy to take the original
         iniset $NEUTRON_CONF DEFAULT bind_port "$Q_PORT_INT"
         iniset $NEUTRON_CONF oslo_middleware enable_proxy_headers_parsing True

From ed6e1d0996a910eca42a202f17dfeee53d250c00 Mon Sep 17 00:00:00 2001
From: Lance Bragstad <lbragstad@gmail.com>
Date: Wed, 1 Aug 2018 18:03:44 +0000
Subject: [PATCH 1379/2409] Set transport_url in proper keystone config section

The RPC transport_url for keystone was being set in the DEFAULT
section, even though keystone doesn't do anything with it. Instead,
keystone leans on the [oslo_messaging_notification] section from
oslo.messaging to register the transport_url option.

This change sets the transport_url in the proper section instead of
using the DEFAULT section.

Change-Id: I11590d0175da7ea310d5529f2d7c0bf8d7fb25b3
---
 lib/keystone | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/keystone b/lib/keystone
index 57cb24d4cb..02e28222b7 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -217,7 +217,7 @@ function configure_keystone {
     iniset $KEYSTONE_CONF cache backend "dogpile.cache.memcached"
     iniset $KEYSTONE_CONF cache memcache_servers localhost:11211
 
-    iniset_rpc_backend keystone $KEYSTONE_CONF
+    iniset_rpc_backend keystone $KEYSTONE_CONF oslo_messaging_notifications
 
     local service_port=$KEYSTONE_SERVICE_PORT
     local auth_port=$KEYSTONE_AUTH_PORT

From b73fb370511563b5607db149dae66e33333dd445 Mon Sep 17 00:00:00 2001
From: Paul Belanger <pabelanger@redhat.com>
Date: Thu, 2 Aug 2018 16:15:52 -0400
Subject: [PATCH 1380/2409] Remove devstack-single-node-fedora-27

There is no projects using this and allows openstack-infra to delete
fedora-27 images.

Change-Id: I37d482dd2b5e099c370ab693ff430cb9c56360f8
Depends-On: https://review.openstack.org/588369
Signed-off-by: Paul Belanger <pabelanger@redhat.com>
---
 .zuul.yaml | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 57cbf88e1d..99ab20d3d0 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -38,16 +38,6 @@
         nodes:
           - controller
 
-- nodeset:
-    name: devstack-single-node-fedora-27
-    nodes:
-      - name: controller
-        label: fedora-27
-    groups:
-      - name: tempest
-        nodes:
-          - controller
-
 - nodeset:
     name: devstack-single-node-fedora-latest
     nodes:

From 11b8649e839f55b1d7e17fa3636f7b160e6c5d22 Mon Sep 17 00:00:00 2001
From: ghanshyam <gmann@ghanshyammann.com>
Date: Tue, 7 Aug 2018 08:37:24 +0000
Subject: [PATCH 1381/2409] Fix TEMPEST_AUTH_VERSION comparision condition for
 identity v2

TEMPEST_AUTH_VERSION should be 'v3' or 'v2' not 'v2.0'.
To disable the identity v2 admin tests TEMPEST_AUTH_VERSION is
being compared with 'v2.0' which is incorrect.

Change-Id: I5f7e3bcf733edbbee06016bcad4845dda552815e
---
 lib/tempest | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 60f571ceb3..f83476d42f 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -279,8 +279,8 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG identity-feature-enabled api_v2 False
     fi
     iniset $TEMPEST_CONFIG identity auth_version ${TEMPEST_AUTH_VERSION:-v3}
-    if [[ "$TEMPEST_AUTH_VERSION" != "v2.0" ]]; then
-        # we're going to disable v2 admin unless we're using v2.0 by default.
+    if [[ "$TEMPEST_AUTH_VERSION" != "v2" ]]; then
+        # we're going to disable v2 admin unless we're using v2 by default.
         iniset $TEMPEST_CONFIG identity-feature-enabled api_v2_admin False
     fi
 

From 59f50c7967de9274d4c125e40fee8b2bfbe9cfc7 Mon Sep 17 00:00:00 2001
From: zhubx007 <zhu.boxiang@99cloud.net>
Date: Mon, 23 Jul 2018 11:42:07 +0800
Subject: [PATCH 1382/2409] BUG Fix: add sudo to run command arping

Set 'PUBLIC_INTERFACE' in local.conf, so the code will
be entered into _move_neutron_addresses_route of
neutron-legacy.

But if lack of sudo to run command arping, the information
"arping: socket: Operation not permitted" occurs. So add
'sudo' for 'ARP_CMD' of lib/neutron-legacy.

Change-Id: I8ac8a9bc2bbba049c45b28bf9b93d9a10e398fe6
Closes-Bug: #1783046
---
 lib/neutron-legacy | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 9330b23802..be5b73ffa6 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -633,7 +633,7 @@ function _move_neutron_addresses_route {
             IP_UP="sudo ip link set $to_intf up"
             if [[ "$af" == "inet" ]]; then
                 IP=$(echo $IP_BRD | awk '{ print $1; exit }' | grep -o -E '(.*)/' | cut -d "/" -f1)
-                ARP_CMD="arping -A -c 3 -w 4.5 -I $to_intf $IP "
+                ARP_CMD="sudo arping -A -c 3 -w 4.5 -I $to_intf $IP "
             fi
         fi
 

From 70be0d14a62680f415daf6e15af6dd01f38749fe Mon Sep 17 00:00:00 2001
From: Michal Rostecki <mrostecki@suse.de>
Date: Thu, 9 Aug 2018 15:19:17 +0200
Subject: [PATCH 1383/2409] gitignore: Ignore all log files

Before this change, only *.log and *.log.[0-9] patterns were
ignored, which was not enough. Examples of file names which were
not ignored:

    devstack.log.2018-08-09-100547
    wget-log
    wget-log.1

Patterns *.log.* and *-log.* work for every log file generated by
devstack.

Change-Id: I6f0de5de74f196ab9df66cf3f2f969e53da01c22
Signed-off-by: Michal Rostecki <mrostecki@suse.de>
---
 .gitignore | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index 8553b3f849..e5e1f6aba0 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,7 +1,9 @@
 *~
 .*.sw?
 *.log
-*.log.[1-9]
+*-log
+*.log.*
+*-log.*
 *.pem
 *.pyc
 .localrc.auto

From 2c42fd09d555981234fd88b9522c366e42e4e7c6 Mon Sep 17 00:00:00 2001
From: Chang Liu <liuchang77@chinaunicom.cn>
Date: Fri, 3 Aug 2018 16:15:20 +0800
Subject: [PATCH 1384/2409] Modified the description of the doc directory

In the latest version of Contributing to
DevStack manual.There are a few words to
say that "tools/build_docs.sh is used to
generate the HTML versions of the DevStack
scripts".But build_docs.sh is not there
since Newton version.So I delete it for
good.

Change-Id: I69f7aa23e1efd8f8a63aa79628e67378d524e173
---
 HACKING.rst | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/HACKING.rst b/HACKING.rst
index d5d6fbcf02..ce1c1b5416 100644
--- a/HACKING.rst
+++ b/HACKING.rst
@@ -47,8 +47,7 @@ The DevStack repo generally keeps all of the primary scripts at the root
 level.
 
 ``doc`` - Contains the Sphinx source for the documentation.
-``tools/build_docs.sh`` is used to generate the HTML versions of the
-DevStack scripts.  A complete doc build can be run with ``tox -edocs``.
+A complete doc build can be run with ``tox -edocs``.
 
 ``exercises`` - Contains the test scripts used to sanity-check and
 demonstrate some OpenStack functions. These scripts know how to exit

From 7711d7f196e946b0cf9a091fd6be0cf35e48fd31 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Thu, 16 Aug 2018 06:13:29 +0000
Subject: [PATCH 1385/2409] Updated from generate-devstack-plugins-list

Change-Id: I610cf0be64cfcfba754e629e2a62e8dc2cb99ddf
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 7ad65f741b..9ef2a32c88 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -158,6 +158,7 @@ panko                                  `git://git.openstack.org/openstack/panko
 patrole                                `git://git.openstack.org/openstack/patrole <https://git.openstack.org/cgit/openstack/patrole>`__
 picasso                                `git://git.openstack.org/openstack/picasso <https://git.openstack.org/cgit/openstack/picasso>`__
 qinling                                `git://git.openstack.org/openstack/qinling <https://git.openstack.org/cgit/openstack/qinling>`__
+qinling-dashboard                      `git://git.openstack.org/openstack/qinling-dashboard <https://git.openstack.org/cgit/openstack/qinling-dashboard>`__
 rally                                  `git://git.openstack.org/openstack/rally <https://git.openstack.org/cgit/openstack/rally>`__
 rally-openstack                        `git://git.openstack.org/openstack/rally-openstack <https://git.openstack.org/cgit/openstack/rally-openstack>`__
 sahara                                 `git://git.openstack.org/openstack/sahara <https://git.openstack.org/cgit/openstack/sahara>`__

From c617d476c2f6d7b86553e9a0cb5c9b229dc5e3af Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Thu, 23 Aug 2018 06:11:41 +0000
Subject: [PATCH 1386/2409] Updated from generate-devstack-plugins-list

Change-Id: Ice486739c1dfbcbf61db178be64075164e9f7ed5
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 9ef2a32c88..f0c6238e0b 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -171,6 +171,7 @@ slogging                               `git://git.openstack.org/openstack/sloggi
 solum                                  `git://git.openstack.org/openstack/solum <https://git.openstack.org/cgit/openstack/solum>`__
 stackube                               `git://git.openstack.org/openstack/stackube <https://git.openstack.org/cgit/openstack/stackube>`__
 storlets                               `git://git.openstack.org/openstack/storlets <https://git.openstack.org/cgit/openstack/storlets>`__
+stx-config                             `git://git.openstack.org/openstack/stx-config <https://git.openstack.org/cgit/openstack/stx-config>`__
 tacker                                 `git://git.openstack.org/openstack/tacker <https://git.openstack.org/cgit/openstack/tacker>`__
 tap-as-a-service                       `git://git.openstack.org/openstack/tap-as-a-service <https://git.openstack.org/cgit/openstack/tap-as-a-service>`__
 tap-as-a-service-dashboard             `git://git.openstack.org/openstack/tap-as-a-service-dashboard <https://git.openstack.org/cgit/openstack/tap-as-a-service-dashboard>`__

From e5cac49b04084407432b60c5670c25961bd7302a Mon Sep 17 00:00:00 2001
From: ghanshyam <gmann@ghanshyammann.com>
Date: Fri, 24 Aug 2018 10:38:01 +0000
Subject: [PATCH 1387/2409] Update branches for stable/rocky

Change-Id: Ia6de4b83f56c5ac0af19b0ca4f12aa4d47fd963a
---
 stackrc                      |  2 +-
 tests/test_libs_from_pypi.sh | 12 ------------
 2 files changed, 1 insertion(+), 13 deletions(-)

diff --git a/stackrc b/stackrc
index 2088bf45a3..2c464bd6be 100644
--- a/stackrc
+++ b/stackrc
@@ -15,7 +15,7 @@ source $RC_DIR/functions
 
 # Set the target branch. This is used so that stable branching
 # does not need to update each repo below.
-TARGET_BRANCH=master
+TARGET_BRANCH=stable/rocky
 
 # Cycle trailing projects need to branch later than the others.
 TRAILING_TARGET_BRANCH=master
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index c3b4457171..da2d970482 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -95,19 +95,7 @@ function test_libs_exist {
     echo "test_libs_exist PASSED"
 }
 
-function test_branch_master {
-    for lib in $ALL_LIBS; do
-        if [[ ${GITBRANCH[$lib]} != "master" ]]; then
-            echo "GITBRANCH for $lib not master (${GITBRANCH[$lib]})"
-            exit 1
-        fi
-    done
-
-    echo "test_branch_master PASSED"
-}
-
 set -o errexit
 
 test_libs_exist
-test_branch_master
 test_all_libs_upto_date

From ef72d1ea77e2d5b8f210f222bcaf41b0fc7520e2 Mon Sep 17 00:00:00 2001
From: ghanshyam <gmann@ghanshyammann.com>
Date: Fri, 24 Aug 2018 10:44:54 +0000
Subject: [PATCH 1388/2409] Update DEVSTACK_SERIES to stein

stable/rocky branch has been created now and
current master is for stein.

Change-Id: Id5d75e7a8a38a749f387f3ba670e3d2c10cb9719
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 2088bf45a3..34bd6771a6 100644
--- a/stackrc
+++ b/stackrc
@@ -258,7 +258,7 @@ REQUIREMENTS_DIR=$DEST/requirements
 # Setting the variable to 'ALL' will activate the download for all
 # libraries.
 
-DEVSTACK_SERIES="rocky"
+DEVSTACK_SERIES="stein"
 
 ##############
 #

From 57bc01b3202e14ce8b722f7fcebddc8c8ae2159e Mon Sep 17 00:00:00 2001
From: "Jens Harbott (frickler)" <j.harbott@x-ion.de>
Date: Mon, 27 Aug 2018 13:23:18 +0000
Subject: [PATCH 1389/2409] Revert "Update branches for stable/rocky"

This reverts commit e5cac49b04084407432b60c5670c25961bd7302a.

Change-Id: Ieceb5030a6c21378adcb9bf9c51cd862e0b0d01a
---
 stackrc                      |  2 +-
 tests/test_libs_from_pypi.sh | 12 ++++++++++++
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 2c464bd6be..2088bf45a3 100644
--- a/stackrc
+++ b/stackrc
@@ -15,7 +15,7 @@ source $RC_DIR/functions
 
 # Set the target branch. This is used so that stable branching
 # does not need to update each repo below.
-TARGET_BRANCH=stable/rocky
+TARGET_BRANCH=master
 
 # Cycle trailing projects need to branch later than the others.
 TRAILING_TARGET_BRANCH=master
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index da2d970482..c3b4457171 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -95,7 +95,19 @@ function test_libs_exist {
     echo "test_libs_exist PASSED"
 }
 
+function test_branch_master {
+    for lib in $ALL_LIBS; do
+        if [[ ${GITBRANCH[$lib]} != "master" ]]; then
+            echo "GITBRANCH for $lib not master (${GITBRANCH[$lib]})"
+            exit 1
+        fi
+    done
+
+    echo "test_branch_master PASSED"
+}
+
 set -o errexit
 
 test_libs_exist
+test_branch_master
 test_all_libs_upto_date

From 6465219ec39ea3ec75e796b3bd80b96550470546 Mon Sep 17 00:00:00 2001
From: Lenny Verkhovsky <lennyb@mellanox.com>
Date: Wed, 29 Aug 2018 16:41:04 +0300
Subject: [PATCH 1390/2409] Fixed git show for upper-constraints.txt in
 lib/tempest

Change-Id: Id133108e0436018be81fca74a15ff29a4fe2e796
Closes-Bug: #1789643
---
 lib/tempest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index 0605ffb082..6da2330738 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -560,7 +560,7 @@ function configure_tempest {
     fi
 
     # The requirements might be on a different branch, while tempest needs master requirements.
-    (cd $REQUIREMENTS_DIR && git show master:upper-constraints.txt) > u-c-m.txt
+    (cd $REQUIREMENTS_DIR && git show origin/master:upper-constraints.txt) > u-c-m.txt
     tox -evenv-tempest -- pip install -c u-c-m.txt -r requirements.txt
 
     # Auth:

From 41fe3ebd4b1570c83ddf45cb8c240528aa06a56c Mon Sep 17 00:00:00 2001
From: Akihiro Motoki <amotoki@gmail.com>
Date: Sat, 8 Sep 2018 18:32:25 +0000
Subject: [PATCH 1391/2409] Update horizon wsgi wrapper to the recommended one

During Rocky cycle, horizon updates the path of the wsgi wrapper
to the one recommended by Django [1]. The old path will be dropped
in the T release.

[1] https://review.openstack.org/#/c/561802/

Related-Bug: #1763204
Change-Id: Ie942518b587d193a7de55ffcc0a2848406146eb2
---
 files/apache-horizon.template | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/files/apache-horizon.template b/files/apache-horizon.template
index bfd75678e3..efcfc0360b 100644
--- a/files/apache-horizon.template
+++ b/files/apache-horizon.template
@@ -1,5 +1,5 @@
 <VirtualHost *:80>
-    WSGIScriptAlias %WEBROOT% %HORIZON_DIR%/openstack_dashboard/wsgi/django.wsgi
+    WSGIScriptAlias %WEBROOT% %HORIZON_DIR%/openstack_dashboard/wsgi.py
     WSGIDaemonProcess horizon user=%USER% group=%GROUP% processes=3 threads=10 home=%HORIZON_DIR% display-name=%{GROUP}
     WSGIApplicationGroup %{GLOBAL}
 

From a0d1016e5540791d63a09a80a49181c08725f011 Mon Sep 17 00:00:00 2001
From: Doug Hellmann <doug@doughellmann.com>
Date: Sat, 8 Sep 2018 22:50:06 -0400
Subject: [PATCH 1392/2409] import zuul job settings from project-config

This is a mechanically generated patch to complete step 1 of moving
the zuul job settings out of project-config and into each project
repository.

Because there will be a separate patch on each branch, the branch
specifiers for branch-specific jobs have been removed.

Because this patch is generated by a script, there may be some
cosmetic changes to the layout of the YAML file(s) as the contents are
normalized.

See the python3-first goal document for details:
https://governance.openstack.org/tc/goals/stein/python3-first.html

Change-Id: I9169d41d790ae874af29c8ceccf0c55ab0df7727
Story: #2002586
Task: #24327
---
 .zuul.yaml | 165 +++++++++++++++++++++++++++++++++++++++--------------
 1 file changed, 121 insertions(+), 44 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index feafa0c2e2..68b20930ea 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -120,46 +120,46 @@
         # Ignore any default set by devstack. Emit a "disable_all_services".
         base: false
       zuul_copy_output:
-        '{{ devstack_conf_dir }}/local.conf': 'logs'
-        '{{ devstack_conf_dir }}/localrc': 'logs'
-        '{{ devstack_conf_dir }}/.localrc.auto': 'logs'
-        '{{ devstack_conf_dir }}/.stackenv': 'logs'
-        '{{ devstack_log_dir }}/dstat-csv.log': 'logs'
-        '{{ devstack_log_dir }}/devstacklog.txt': 'logs'
-        '{{ devstack_log_dir }}/devstacklog.txt.summary': 'logs'
-        '{{ devstack_full_log}}': 'logs'
-        '{{ stage_dir }}/verify_tempest_conf.log': 'logs'
-        '{{ stage_dir }}/apache': 'logs'
-        '{{ stage_dir }}/apache_config': 'logs'
-        '{{ stage_dir }}/etc': 'logs'
-        '/var/log/rabbitmq': 'logs'
-        '/var/log/postgresql': 'logs'
-        '/var/log/mysql.err': 'logs'
-        '/var/log/mysql.log': 'logs'
-        '/var/log/libvirt': 'logs'
-        '/etc/sudoers': 'logs'
-        '/etc/sudoers.d': 'logs'
-        '{{ stage_dir }}/iptables.txt': 'logs'
-        '{{ stage_dir }}/df.txt': 'logs'
-        '{{ stage_dir }}/pip2-freeze.txt': 'logs'
-        '{{ stage_dir }}/pip3-freeze.txt': 'logs'
-        '{{ stage_dir }}/dpkg-l.txt': 'logs'
-        '{{ stage_dir }}/rpm-qa.txt': 'logs'
-        '{{ stage_dir }}/core': 'logs'
-        '{{ stage_dir }}/listen53.txt': 'logs'
-        '{{ stage_dir }}/deprecations.log': 'logs'
-        '/var/log/ceph': 'logs'
-        '/var/log/openvswitch': 'logs'
-        '/var/log/glusterfs': 'logs'
-        '/etc/glusterfs/glusterd.vol': 'logs'
-        '/etc/resolv.conf': 'logs'
-        '/var/log/unbound.log': 'logs'
+        '{{ devstack_conf_dir }}/local.conf': logs
+        '{{ devstack_conf_dir }}/localrc': logs
+        '{{ devstack_conf_dir }}/.localrc.auto': logs
+        '{{ devstack_conf_dir }}/.stackenv': logs
+        '{{ devstack_log_dir }}/dstat-csv.log': logs
+        '{{ devstack_log_dir }}/devstacklog.txt': logs
+        '{{ devstack_log_dir }}/devstacklog.txt.summary': logs
+        '{{ devstack_full_log}}': logs
+        '{{ stage_dir }}/verify_tempest_conf.log': logs
+        '{{ stage_dir }}/apache': logs
+        '{{ stage_dir }}/apache_config': logs
+        '{{ stage_dir }}/etc': logs
+        /var/log/rabbitmq: logs
+        /var/log/postgresql: logs
+        /var/log/mysql.err: logs
+        /var/log/mysql.log: logs
+        /var/log/libvirt: logs
+        /etc/sudoers: logs
+        /etc/sudoers.d: logs
+        '{{ stage_dir }}/iptables.txt': logs
+        '{{ stage_dir }}/df.txt': logs
+        '{{ stage_dir }}/pip2-freeze.txt': logs
+        '{{ stage_dir }}/pip3-freeze.txt': logs
+        '{{ stage_dir }}/dpkg-l.txt': logs
+        '{{ stage_dir }}/rpm-qa.txt': logs
+        '{{ stage_dir }}/core': logs
+        '{{ stage_dir }}/listen53.txt': logs
+        '{{ stage_dir }}/deprecations.log': logs
+        /var/log/ceph: logs
+        /var/log/openvswitch: logs
+        /var/log/glusterfs: logs
+        /etc/glusterfs/glusterd.vol: logs
+        /etc/resolv.conf: logs
+        /var/log/unbound.log: logs
       extensions_to_txt:
-        conf: True
-        log: True
-        localrc: True
-        stackenv: True
-        auto: True
+        conf: true
+        log: true
+        localrc: true
+        stackenv: true
+        auto: true
     group-vars:
       subnode:
         devstack_localrc:
@@ -207,7 +207,7 @@
         # Multinode specific settings
         SERVICE_HOST: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}"
         HOST_IP: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}"
-        PUBLIC_BRIDGE_MTU: "{{ external_bridge_mtu }}"
+        PUBLIC_BRIDGE_MTU: '{{ external_bridge_mtu }}'
       devstack_services:
         # Shared services
         dstat: true
@@ -225,7 +225,7 @@
           # Multinode specific settings
           HOST_IP: "{{ hostvars[inventory_hostname]['nodepool']['private_ipv4'] }}"
           SERVICE_HOST: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}"
-          PUBLIC_BRIDGE_MTU: "{{ external_bridge_mtu }}"
+          PUBLIC_BRIDGE_MTU: '{{ external_bridge_mtu }}'
           # Subnode specific settings
           DATABASE_TYPE: mysql
           RABBIT_HOST: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}"
@@ -274,7 +274,7 @@
         SWIFT_START_ALL_SERVICES: false
         SWIFT_HASH: 1234123412341234
         CINDER_PERIODIC_INTERVAL: 10
-        DEBUG_LIBVIRT_COREDUMPS: True
+        DEBUG_LIBVIRT_COREDUMPS: true
         NOVA_VNC_ENABLED: true
         VNCSERVER_LISTEN: 0.0.0.0
         VNCSERVER_PROXYCLIENT_ADDRESS: $HOST_IP
@@ -282,7 +282,7 @@
         post-config:
           $NEUTRON_CONF:
             DEFAULT:
-              global_physnet_mtu: "{{ external_bridge_mtu }}"
+              global_physnet_mtu: '{{ external_bridge_mtu }}'
       devstack_services:
         # Core services enabled for this branch.
         # This list replaces the test-matrix.
@@ -479,6 +479,10 @@
     run: playbooks/unit-tests/run.yaml
 
 - project:
+    templates:
+      - integrated-gate
+      - integrated-gate-py35
+      - publish-openstack-sphinx-docs
     check:
       jobs:
         - devstack
@@ -488,10 +492,48 @@
         - devstack-platform-fedora-latest
         - devstack-multinode
         - devstack-unit-tests
+        - openstack-tox-bashate
+        - ironic-tempest-dsvm-ipa-wholedisk-bios-agent_ipmitool-tinyipa:
+            voting: false
+        - legacy-swift-dsvm-functional:
+            voting: false
+            irrelevant-files:
+              - ^.*\.rst$
+              - ^doc/.*$
+        - neutron-grenade:
+            irrelevant-files:
+              - ^.*\.rst$
+              - ^doc/.*$
+        - neutron-grenade-multinode:
+            irrelevant-files:
+              - ^.*\.rst$
+              - ^doc/.*$
+        - neutron-tempest-linuxbridge:
+            irrelevant-files:
+              - ^.*\.rst$
+              - ^doc/.*$
+        - tempest-multinode-full:
+            voting: false
+            irrelevant-files:
+              - ^.*\.rst$
+              - ^doc/.*$
     gate:
       jobs:
         - devstack
         - devstack-unit-tests
+        - openstack-tox-bashate
+        - neutron-grenade-multinode:
+            irrelevant-files:
+              - ^.*\.rst$
+              - ^doc/.*$
+        - neutron-tempest-linuxbridge:
+            irrelevant-files:
+              - ^.*\.rst$
+              - ^doc/.*$
+        - neutron-grenade:
+            irrelevant-files:
+              - ^.*\.rst$
+              - ^doc/.*$
     # Please add a note on each job and conditions for the job not
     # being experimental any more, so we can keep this list somewhat
     # pruned.
@@ -520,4 +562,39 @@
         - nova-next
         - neutron-fullstack-with-uwsgi
         - neutron-functional-with-uwsgi
-        - neutron-tempest-with-uwsgi
\ No newline at end of file
+        - neutron-tempest-with-uwsgi
+        - legacy-tempest-dsvm-full-devstack-plugin-ceph:
+            irrelevant-files:
+              - ^.*\.rst$
+              - ^doc/.*$
+        - legacy-tempest-dsvm-py35-full-devstack-plugin-ceph:
+            irrelevant-files:
+              - ^.*\.rst$
+              - ^doc/.*$
+        - neutron-tempest-dvr:
+            irrelevant-files:
+              - ^.*\.rst$
+              - ^doc/.*$
+        - legacy-tempest-dsvm-neutron-dvr-multinode-full:
+            irrelevant-files:
+              - ^.*\.rst$
+              - ^doc/.*$
+        - neutron-tempest-dvr-ha-multinode-full:
+            irrelevant-files:
+              - ^.*\.rst$
+              - ^doc/.*$
+        - legacy-tempest-dsvm-lvm-multibackend:
+            irrelevant-files:
+              - ^.*\.rst$
+              - ^doc/.*$
+        - legacy-tempest-dsvm-neutron-pg-full:
+            irrelevant-files:
+              - ^.*\.rst$
+              - ^doc/.*$
+    periodic:
+      jobs:
+        - legacy-periodic-tempest-dsvm-oslo-latest-full-master:
+            irrelevant-files:
+              - ^.*\.rst$
+              - ^doc/.*$
+

From 53db72c6c64229db62649fc31965e024fbfec365 Mon Sep 17 00:00:00 2001
From: Doug Hellmann <doug@doughellmann.com>
Date: Sat, 8 Sep 2018 22:53:59 -0400
Subject: [PATCH 1393/2409] switch documentation job to new PTI

This is a mechanically generated patch to switch the documentation
jobs to use the new PTI versions of the jobs as part of the
python3-first goal.

See the python3-first goal document for details:
https://governance.openstack.org/tc/goals/stein/python3-first.html

Change-Id: I338fc71919a41ec890bcb5edd0552ec7eb680eb5
Story: #2002586
Task: #24327
---
 .zuul.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 68b20930ea..88cb7a18c4 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -482,7 +482,7 @@
     templates:
       - integrated-gate
       - integrated-gate-py35
-      - publish-openstack-sphinx-docs
+      - publish-openstack-docs-pti
     check:
       jobs:
         - devstack

From 770690eda1c4578dcca5c5cdfed6688e7e084b24 Mon Sep 17 00:00:00 2001
From: Steve Kowalik <steven@wedontsleep.org>
Date: Mon, 10 Sep 2018 16:17:54 -0600
Subject: [PATCH 1394/2409] Remove cgroup natty or less block

Given that Natty and other releases that don't use cgroups have been out
of support in Ubuntu for years now, it's high time we removed the
special case code block that sets up the cgroup mount.

Change-Id: I5403a4b1b64a95236b4dfcb66c35c594a3460cca
---
 lib/nova | 11 -----------
 1 file changed, 11 deletions(-)

diff --git a/lib/nova b/lib/nova
index 5e157c5f11..8609956400 100644
--- a/lib/nova
+++ b/lib/nova
@@ -303,17 +303,6 @@ function configure_nova {
             # to simulate multiple systems.
             if [[ "$LIBVIRT_TYPE" == "lxc" ]]; then
                 if is_ubuntu; then
-                    if [[ ! "$DISTRO" > natty ]]; then
-                        local cgline="none /cgroup cgroup cpuacct,memory,devices,cpu,freezer,blkio 0 0"
-                        sudo mkdir -p /cgroup
-                        if ! grep -q cgroup /etc/fstab; then
-                            echo "$cgline" | sudo tee -a /etc/fstab
-                        fi
-                        if ! mount -n | grep -q cgroup; then
-                            sudo mount /cgroup
-                        fi
-                    fi
-
                     # enable nbd for lxc unless you're using an lvm backend
                     # otherwise you can't boot instances
                     if [[ "$NOVA_BACKEND" != "LVM" ]]; then

From b4b6789848b485c6bbdc8cabab5134f0cc2a3828 Mon Sep 17 00:00:00 2001
From: Andreas Jaeger <aj@suse.com>
Date: Mon, 10 Sep 2018 18:40:41 +0200
Subject: [PATCH 1395/2409] Follow job renames

the swift and devstack-plugin-ceph jobs have been renamed, follow rename
and use in-repo jobs.

Depends-On: https://review.openstack.org/543048
Change-Id: Idccc21e47b2cc04e5eeab4db7f7fb7cf156f8049
---
 .zuul.yaml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 88cb7a18c4..7fa8d2a4e9 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -495,7 +495,7 @@
         - openstack-tox-bashate
         - ironic-tempest-dsvm-ipa-wholedisk-bios-agent_ipmitool-tinyipa:
             voting: false
-        - legacy-swift-dsvm-functional:
+        - swift-dsvm-functional:
             voting: false
             irrelevant-files:
               - ^.*\.rst$
@@ -563,11 +563,11 @@
         - neutron-fullstack-with-uwsgi
         - neutron-functional-with-uwsgi
         - neutron-tempest-with-uwsgi
-        - legacy-tempest-dsvm-full-devstack-plugin-ceph:
+        - devstack-plugin-ceph-tempest:
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
-        - legacy-tempest-dsvm-py35-full-devstack-plugin-ceph:
+        - devstack-plugin-ceph-tempest-py3:
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$

From 6403b1447fd9e1bcb6fc6f3ebb77d9abd9b776fc Mon Sep 17 00:00:00 2001
From: Andreas Jaeger <aj@suse.com>
Date: Wed, 12 Sep 2018 11:37:48 +0200
Subject: [PATCH 1396/2409] Remove master only job

legacy-periodic-tempest-dsvm-oslo-latest-full-master
runs only on master, remove it. This needs to stay in project-config.

Change-Id: I81e66ddb0976bb4bb7a7cd8efbbae3bda551191d
---
 .zuul.yaml | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 88cb7a18c4..36e25fc681 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -591,10 +591,3 @@
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
-    periodic:
-      jobs:
-        - legacy-periodic-tempest-dsvm-oslo-latest-full-master:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
-

From 147388466daef8e6589013d9bae684f9f8b8c57a Mon Sep 17 00:00:00 2001
From: Andrea Frittoli <andrea.frittoli@gmail.com>
Date: Thu, 13 Sep 2018 17:50:29 +0200
Subject: [PATCH 1397/2409] Setup branch in setup-devstack-source-dirs

Allow the setup-devstack-source-dirs role to accept a target role
to be setup - when available - for the repos.

Change-Id: Iebcba0d4be6d9d71b783e10a82c35a406afbd6bf
---
 roles/setup-devstack-source-dirs/README.rst   |  5 ++++
 .../tasks/main.yaml                           | 29 +++++++++++++++++++
 2 files changed, 34 insertions(+)

diff --git a/roles/setup-devstack-source-dirs/README.rst b/roles/setup-devstack-source-dirs/README.rst
index 4ebf8399c2..4129eae383 100644
--- a/roles/setup-devstack-source-dirs/README.rst
+++ b/roles/setup-devstack-source-dirs/README.rst
@@ -9,3 +9,8 @@ into it.
    :default: /opt/stack
 
    The devstack base directory.
+
+ .. zuul:rolevar:: devstack_branch
+    :default: None
+
+    The target branch to be setup (where available).
diff --git a/roles/setup-devstack-source-dirs/tasks/main.yaml b/roles/setup-devstack-source-dirs/tasks/main.yaml
index e6bbae23b7..c196c37e09 100644
--- a/roles/setup-devstack-source-dirs/tasks/main.yaml
+++ b/roles/setup-devstack-source-dirs/tasks/main.yaml
@@ -12,6 +12,35 @@
   with_items: '{{ found_repos.files }}'
   become: yes
 
+- name: Setup refspec for repos into devstack working directory
+  shell:
+    # Copied almost "as-is" from devstack-gate setup-workspace function
+    # but removing the dependency on functions.sh
+    # TODO this should be rewritten as a python module.
+    cmd: |
+      cd {{ devstack_base_dir }}/{{ item.path | basename }}
+      base_branch={{ devstack_sources_branch }}
+      if git branch -a | grep "$base_branch" > /dev/null ; then
+          git checkout $base_branch
+      elif [[ "$base_branch" == stable/* ]]; then
+          # Look for an eol tag for the stable branch.
+          eol_tag=${base_branch#stable/}-eol
+          if git tag -l |grep $eol_tag >/dev/null; then
+              git checkout $eol_tag
+              git reset --hard $eol_tag
+              if ! git clean -x -f -d -q ; then
+                  sleep 1
+                  git clean -x -f -d -q
+              fi
+          fi
+      else
+          git checkout master
+      fi
+  args:
+    executable: /bin/bash
+  with_items: '{{ found_repos.files }}'
+  when: devstack_sources_branch is defined
+
 - name: Set ownership of repos
   file:
     path: '{{ devstack_base_dir }}'

From 5ed05394ffddcd7db278db7c30b1315dcd37f724 Mon Sep 17 00:00:00 2001
From: melissaml <ma.lei@99cloud.net>
Date: Thu, 20 Sep 2018 10:45:10 +0800
Subject: [PATCH 1398/2409] fix a typo

Change-Id: I3cc4633b125ef3c5be40dd444cad78a888f832e4
---
 lib/neutron_plugins/bigswitch_floodlight | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/bigswitch_floodlight b/lib/neutron_plugins/bigswitch_floodlight
index 52c6ad58b5..d3f5bd5752 100644
--- a/lib/neutron_plugins/bigswitch_floodlight
+++ b/lib/neutron_plugins/bigswitch_floodlight
@@ -1,6 +1,6 @@
 #!/bin/bash
 #
-# Neuton Big Switch/FloodLight plugin
+# Neutron Big Switch/FloodLight plugin
 # ------------------------------------
 
 # Save trace setting

From dae1041c9412e76927614dcd1e1b3bc5600692d3 Mon Sep 17 00:00:00 2001
From: Lajos Katona <lajos.katona@ericsson.com>
Date: Fri, 21 Sep 2018 10:51:47 +0200
Subject: [PATCH 1399/2409] doc: Add USE_PYTHON3 to configuration guide

Change-Id: I8b6743c1dbdc00001691b2727bd0c344fb6ccd51
---
 doc/source/configuration.rst | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 46e50df6bb..022e6ba529 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -446,6 +446,16 @@ Python bindings added when they are enabled.
 
      ADDITIONAL_VENV_PACKAGES="python-foo, python-bar"
 
+Use python3
+------------
+
+By default ``stack.sh`` uses python2 (the exact version set by the
+``PYTHON2_VERSION``). This can be overriden so devstack will run
+python3 (the exact version set by ``PYTHON3_VERSION``).
+
+  ::
+
+     USE_PYTHON3=True
 
 A clean install every time
 --------------------------

From b38cb6d084ea2c38bc0de1b2d385935552b2bbfd Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Mon, 24 Sep 2018 06:19:33 +0000
Subject: [PATCH 1400/2409] Updated from generate-devstack-plugins-list

Change-Id: I4dba3ebf78333524185e84f94a2e7d52ad05a968
---
 doc/source/plugin-registry.rst | 1 -
 1 file changed, 1 deletion(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index f0c6238e0b..2361b4b54c 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -62,7 +62,6 @@ freezer                                `git://git.openstack.org/openstack/freeze
 freezer-api                            `git://git.openstack.org/openstack/freezer-api <https://git.openstack.org/cgit/openstack/freezer-api>`__
 freezer-tempest-plugin                 `git://git.openstack.org/openstack/freezer-tempest-plugin <https://git.openstack.org/cgit/openstack/freezer-tempest-plugin>`__
 freezer-web-ui                         `git://git.openstack.org/openstack/freezer-web-ui <https://git.openstack.org/cgit/openstack/freezer-web-ui>`__
-fuxi                                   `git://git.openstack.org/openstack/fuxi <https://git.openstack.org/cgit/openstack/fuxi>`__
 gce-api                                `git://git.openstack.org/openstack/gce-api <https://git.openstack.org/cgit/openstack/gce-api>`__
 glare                                  `git://git.openstack.org/openstack/glare <https://git.openstack.org/cgit/openstack/glare>`__
 group-based-policy                     `git://git.openstack.org/openstack/group-based-policy <https://git.openstack.org/cgit/openstack/group-based-policy>`__

From 61f6cafed7030a70e76b1836fba2390a22b052dd Mon Sep 17 00:00:00 2001
From: aojeagarcia <aojeagarcia@suse.com>
Date: Mon, 24 Sep 2018 12:34:15 +0200
Subject: [PATCH 1401/2409] Switch to lioadm in openSUSE distros

This patch switches the CINDER_ISCSI_HELPER from tgtadm
to lioadm in openSUSE distros, as it increase the performance
and reduce the flakiness on some tests.

Change-Id: Ic3ee9c6baabe20f8f4d14246f6e29808796a5db9
Signed-off-by: aojeagarcia <aojeagarcia@suse.com>
---
 lib/cinder | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 664f423c73..76bf928413 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -96,9 +96,9 @@ CINDER_VOLUME_CLEAR=$(echo ${CINDER_VOLUME_CLEAR} | tr '[:upper:]' '[:lower:]')
 # https://bugs.launchpad.net/cinder/+bug/1180976
 CINDER_PERIODIC_INTERVAL=${CINDER_PERIODIC_INTERVAL:-60}
 
-# Centos7 switched to using LIO and that's all that's supported,
-# although the tgt bits are in EPEL we don't want that for CI
-if is_fedora; then
+# Centos7 and OpenSUSE switched to using LIO and that's all that's supported,
+# although the tgt bits are in EPEL and OpenSUSE we don't want that for CI
+if is_fedora || is_suse; then
     CINDER_ISCSI_HELPER=${CINDER_ISCSI_HELPER:-lioadm}
     if [[ ${CINDER_ISCSI_HELPER} != "lioadm" ]]; then
         die "lioadm is the only valid Cinder target_helper config on this platform"

From 4e16c3dd5f4c5740ab92facf2083282440df9ac0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pawe=C5=82=20Suder?= <pawel@suder.info>
Date: Wed, 26 Sep 2018 15:52:13 +0200
Subject: [PATCH 1402/2409] Fix common systemd pitfalls die msg

That change introduces correct way of generating msg
for die in common systemd pitfalls.

Co-Authored-By: Szymon Datko <szymon.datko@corp.ovh.com>
Co-Authored-By: Piotr Bielak <piotr.bielak@corp.ovh.com>
Change-Id: I28aebffce6c5561360a9e44c1abc44b709054c30
---
 functions-common | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/functions-common b/functions-common
index fae936a3d0..d83cd4c3bb 100644
--- a/functions-common
+++ b/functions-common
@@ -1439,7 +1439,7 @@ function _common_systemd_pitfalls {
     # do some sanity checks on $cmd to see things we don't expect to work
 
     if [[ "$cmd" =~ "sudo" ]]; then
-        local msg=<<EOF
+        read -r -d '' msg << EOF || true  # read returns 1 for EOF, but it is ok here
 You are trying to use run_process with sudo, this is not going to work under systemd.
 
 If you need to run a service as a user other than $STACK_USER call it with:
@@ -1450,7 +1450,7 @@ EOF
     fi
 
     if [[ ! "$cmd" =~ ^/ ]]; then
-        local msg=<<EOF
+        read -r -d '' msg << EOF || true  # read returns 1 for EOF, but it is ok here
 The cmd="$cmd" does not start with an absolute path. It will fail to
 start under systemd.
 

From faaf96bfb15c5f4c45a72b149dc6fe1e1f907a71 Mon Sep 17 00:00:00 2001
From: Hongbin Lu <hongbin.lu@huawei.com>
Date: Thu, 20 Sep 2018 17:16:23 +0000
Subject: [PATCH 1403/2409] remove external_network_bridge option

The external_network_bridge option is deprecated/legacy and being
removed from neutron (see I07474713206c218710544ad98c08caaa37dbf53a).
This patch removes the external_network_bridge option iniset from
devstack scripts.

Change-Id: I4d9641cc9bb83719c9af1edabb89a63c4c2b1d96
---
 lib/neutron                  | 3 ---
 lib/neutron_plugins/ovs_base | 4 ----
 2 files changed, 7 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 4847e87f2f..4e9691dfc0 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -95,9 +95,6 @@ NEUTRON_ROOTWRAP_CONF_FILE=$NEUTRON_CONF_DIR/rootwrap.conf
 NEUTRON_ROOTWRAP_CMD="$NEUTRON_ROOTWRAP $NEUTRON_ROOTWRAP_CONF_FILE"
 NEUTRON_ROOTWRAP_DAEMON_CMD="$NEUTRON_ROOTWRAP-daemon $NEUTRON_ROOTWRAP_CONF_FILE"
 
-# This is needed because _neutron_ovs_base_configure_l3_agent will set
-# external_network_bridge
-Q_USE_PROVIDERNET_FOR_PUBLIC=${Q_USE_PROVIDERNET_FOR_PUBLIC:-True}
 # This is needed because _neutron_ovs_base_configure_l3_agent uses it to create
 # an external network bridge
 PUBLIC_BRIDGE=${PUBLIC_BRIDGE:-br-ex}
diff --git a/lib/neutron_plugins/ovs_base b/lib/neutron_plugins/ovs_base
index 523024e2fe..558a7d5d07 100644
--- a/lib/neutron_plugins/ovs_base
+++ b/lib/neutron_plugins/ovs_base
@@ -96,10 +96,6 @@ function _neutron_ovs_base_configure_firewall_driver {
 }
 
 function _neutron_ovs_base_configure_l3_agent {
-    if [ "$Q_USE_PROVIDERNET_FOR_PUBLIC" != "True" ]; then
-        iniset $Q_L3_CONF_FILE DEFAULT external_network_bridge $PUBLIC_BRIDGE
-    fi
-
     neutron-ovs-cleanup --config-file $NEUTRON_CONF
     if [[ "$Q_USE_PUBLIC_VETH" = "True" ]]; then
         ip link show $Q_PUBLIC_VETH_INT > /dev/null 2>&1 ||

From d543ecb737507cae19d5e9d4b4c9fe1265ffbb6f Mon Sep 17 00:00:00 2001
From: Goutham Pacha Ravi <gouthampravi@gmail.com>
Date: Thu, 27 Sep 2018 09:59:24 -0700
Subject: [PATCH 1404/2409] Add a Bionic Beaver nodeset

I'm switching tempest/dsvm jobs to run on
Ubuntu 18.04 LTS (Bionic Beaver) on openstack/manila,
and I believe this nodeset can be here
so other projects can use it too.

Change-Id: Ib8279cde3e14d5378f27254188ee14dbb0800428
Needed-By: https://review.openstack.org/#/c/604929/
---
 .zuul.yaml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index 9d73bede54..94da654193 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -8,6 +8,16 @@
         nodes:
           - controller
 
+- nodeset:
+    name: openstack-single-node-bionic
+    nodes:
+      - name: controller
+        label: ubuntu-bionic
+    groups:
+      - name: tempest
+        nodes:
+          - controller
+
 - nodeset:
     name: devstack-single-node-centos-7
     nodes:

From 991b1f13f0aed578dccec2e761be69005357444f Mon Sep 17 00:00:00 2001
From: melanie witt <melwittt@gmail.com>
Date: Thu, 27 Sep 2018 18:30:38 +0000
Subject: [PATCH 1405/2409] Update cinder backup_driver to full class name

Legacy backup service support was recently dropped from cinder in
change I3ada2dee1857074746b1893b82dd5f6641c6e579 and we need to
adjust how we set the config option in devstack accordingly. This
updates the backup_driver option to specify a full class name instead
of only the module name.

Closes-Bug: #1794859

Change-Id: I3a72f38b564b8b83b233fccba7685833b6394d45
---
 lib/cinder_backends/ceph | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/cinder_backends/ceph b/lib/cinder_backends/ceph
index 00a0bb3b3d..33c9706d3d 100644
--- a/lib/cinder_backends/ceph
+++ b/lib/cinder_backends/ceph
@@ -65,7 +65,7 @@ function configure_cinder_backend_ceph {
         sudo ceph -c ${CEPH_CONF_FILE} auth get-or-create client.${CINDER_BAK_CEPH_USER} mon "allow r" osd "allow class-read object_prefix rbd_children, allow rwx pool=${CINDER_BAK_CEPH_POOL}, allow rwx pool=${CINDER_CEPH_POOL}" | sudo tee ${CEPH_CONF_DIR}/ceph.client.${CINDER_BAK_CEPH_USER}.keyring
         sudo chown $(whoami):$(whoami) ${CEPH_CONF_DIR}/ceph.client.${CINDER_BAK_CEPH_USER}.keyring
 
-        iniset $CINDER_CONF DEFAULT backup_driver "cinder.backup.drivers.ceph"
+        iniset $CINDER_CONF DEFAULT backup_driver "cinder.backup.drivers.ceph.CephBackupDriver"
         iniset $CINDER_CONF DEFAULT backup_ceph_conf "$CEPH_CONF_FILE"
         iniset $CINDER_CONF DEFAULT backup_ceph_pool "$CINDER_BAK_CEPH_POOL"
         iniset $CINDER_CONF DEFAULT backup_ceph_user "$CINDER_BAK_CEPH_USER"

From 866efef17af8f0d04240bf05714cb12452185822 Mon Sep 17 00:00:00 2001
From: aojeagarcia <aojeagarcia@suse.com>
Date: Fri, 28 Sep 2018 10:43:46 +0200
Subject: [PATCH 1406/2409] Allow ipv6 ECMP in devstack

It turns out that a host can have multiple valid default gateways,
something that's not common in ipv4.

This patches add supports for multiple default gateways in ipv6
environments.

Closes-Bug: #1786259

Change-Id: I30bf655f7160dd19c427ee79acdf145671a3e520
Signed-off-by: aojeagarcia <aojeagarcia@suse.com>
---
 lib/neutron_plugins/services/l3 | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 9be32b79aa..ec289f6656 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -103,7 +103,7 @@ SUBNETPOOL_SIZE_V6=${SUBNETPOOL_SIZE_V6:-64}
 default_v4_route_devs=$(ip -4 route | grep ^default | awk '{print $5}')
 die_if_not_set $LINENO default_v4_route_devs "Failure retrieving default IPv4 route devices"
 
-default_v6_route_devs=$(ip -6 route | grep ^default | awk '{print $5}')
+default_v6_route_devs=$(ip -6 route list match default table all | grep via | awk '{print $5}')
 
 function _determine_config_l3 {
     local opts="--config-file $NEUTRON_CONF --config-file $Q_L3_CONF_FILE"
@@ -395,6 +395,10 @@ function _neutron_configure_router_v6 {
 
     # This logic is specific to using the l3-agent for layer 3
     if is_service_enabled q-l3 || is_service_enabled neutron-l3; then
+        # Ensure IPv6 forwarding is enabled on the host
+        sudo sysctl -w net.ipv6.conf.all.forwarding=1
+        # if the Linux host considers itself to be a router then it will
+        # ignore all router advertisements
         # Ensure IPv6 RAs are accepted on interfaces with a default route.
         # This is needed for neutron-based devstack clouds to work in
         # IPv6-only clouds in the gate. Please do not remove this without
@@ -405,8 +409,6 @@ function _neutron_configure_router_v6 {
             # device name would be reinterpreted as a slash, causing an error.
             sudo sysctl -w net/ipv6/conf/$d/accept_ra=2
         done
-        # Ensure IPv6 forwarding is enabled on the host
-        sudo sysctl -w net.ipv6.conf.all.forwarding=1
         # Configure and enable public bridge
         # Override global IPV6_ROUTER_GW_IP with the true value from neutron
         IPV6_ROUTER_GW_IP=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" port list -c 'Fixed IP Addresses' | grep $ipv6_pub_subnet_id | awk -F'ip_address' '{ print $2 }' | cut -f2 -d\' | tr '\n' ' ')

From e991f7da457e0f1343ca13e8adeb0f6334b04990 Mon Sep 17 00:00:00 2001
From: imacdonn <iain.macdonnell@oracle.com>
Date: Thu, 4 Oct 2018 19:41:59 +0000
Subject: [PATCH 1407/2409] Use bash-style test for Fedora version

Old-style test fails on Ubuntu when python3 enabled, with:

.../devstack/inc/python: line 52: [: 16.04: integer expression expected

Use bash-style test, which doesn't attempt to evaluate the RHS if the
LHS evaluates to false

Change-Id: If18031ab98c9060e5825c3a8d3c647bd3705cd9c
Closes-Bug: #1796174
---
 inc/python | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/inc/python b/inc/python
index 96be107dfa..d8b8169fa1 100644
--- a/inc/python
+++ b/inc/python
@@ -49,7 +49,7 @@ function get_python_exec_prefix {
     fi
     $xtrace
 
-    if python3_enabled && [ "$os_VENDOR" = "Fedora" -a $os_RELEASE -gt 26 ]; then
+    if python3_enabled && [[ "$os_VENDOR" == "Fedora" && $os_RELEASE -gt 26 ]]; then
         # Default Python 3 install prefix changed to /usr/local in Fedora 27:
         # https://fedoraproject.org/wiki/Changes/Making_sudo_pip_safe
         echo "/usr/local/bin"

From 9a543a81acb808e4275765da7ff0f613109b6603 Mon Sep 17 00:00:00 2001
From: aojeagarcia <aojeagarcia@suse.com>
Date: Fri, 28 Sep 2018 08:55:49 +0200
Subject: [PATCH 1408/2409] Don't use ipv6 for DNS SAN fields with python3

Python2 match routines for x509 fields are broken and have to use
the DNS field for ip addresses.

The problem is that if you use ipv6 addresses in the DNS field,
urllib3 fails when trying to encode it.

Since python3 match routines for x509 fields are correct, this patch
disables the hack for python3, encoding the ip address in the
corresponding field only of the certificate.

Partial-Bug: #1794929
Depends-On: https://review.openstack.org/#/c/608468

Change-Id: I7b9cb15ccfa181648afb12be51ee48bed14f9156
Signed-off-by: aojeagarcia <aojeagarcia@suse.com>
---
 lib/tls | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/lib/tls b/lib/tls
index e3ed3cc2ac..217f40e3a5 100644
--- a/lib/tls
+++ b/lib/tls
@@ -227,9 +227,13 @@ function init_CA {
 function init_cert {
     if [[ ! -r $DEVSTACK_CERT ]]; then
         if [[ -n "$TLS_IP" ]]; then
-            # Lie to let incomplete match routines work
-            # see https://bugs.python.org/issue23239
-            TLS_IP="DNS:$TLS_IP,IP:$TLS_IP"
+            if python3_enabled; then
+                TLS_IP="IP:$TLS_IP"
+            else
+                # Lie to let incomplete match routines work with python2
+                # see https://bugs.python.org/issue23239
+                TLS_IP="DNS:$TLS_IP,IP:$TLS_IP"
+            fi
         fi
         make_cert $INT_CA_DIR $DEVSTACK_CERT_NAME $DEVSTACK_HOSTNAME "$TLS_IP"
 

From e8a6a0261c8118e8f89b51f1e31015a236a0fba3 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 8 Oct 2018 15:20:34 +1100
Subject: [PATCH 1409/2409] Quote error messages

As a follow-on to I28aebffce6c5561360a9e44c1abc44b709054c30; make sure
we quote the error messages on the way through so they retain their
newlines.

Change-Id: I493317948264941b4788b100a0b0bc13d2698acf
---
 functions-common | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/functions-common b/functions-common
index d83cd4c3bb..038e9adf3d 100644
--- a/functions-common
+++ b/functions-common
@@ -228,9 +228,9 @@ function err {
     xtrace=$(set +o | grep xtrace)
     set +o xtrace
     local msg="[ERROR] ${BASH_SOURCE[2]}:$1 $2"
-    echo $msg 1>&2;
+    echo "$msg" 1>&2;
     if [[ -n ${LOGDIR} ]]; then
-        echo $msg >> "${LOGDIR}/error.log"
+        echo "$msg" >> "${LOGDIR}/error.log"
     fi
     $xtrace
     return $exitcode
@@ -283,7 +283,7 @@ function warn {
     xtrace=$(set +o | grep xtrace)
     set +o xtrace
     local msg="[WARNING] ${BASH_SOURCE[2]}:$1 $2"
-    echo $msg
+    echo "$msg"
     $xtrace
     return $exitcode
 }
@@ -1442,11 +1442,11 @@ function _common_systemd_pitfalls {
         read -r -d '' msg << EOF || true  # read returns 1 for EOF, but it is ok here
 You are trying to use run_process with sudo, this is not going to work under systemd.
 
-If you need to run a service as a user other than $STACK_USER call it with:
+If you need to run a service as a user other than \$STACK_USER call it with:
 
    run_process \$name \$cmd \$group \$user
 EOF
-        die $LINENO $msg
+        die $LINENO "$msg"
     fi
 
     if [[ ! "$cmd" =~ ^/ ]]; then
@@ -1456,7 +1456,7 @@ start under systemd.
 
 Please update your run_process stanza to have an absolute path.
 EOF
-        die $LINENO $msg
+        die $LINENO "$msg"
     fi
 
 }

From eb7d1ad198276821c3037cb6a23f995537572dcd Mon Sep 17 00:00:00 2001
From: aojeagarcia <aojeagarcia@suse.com>
Date: Mon, 24 Sep 2018 10:17:16 +0200
Subject: [PATCH 1410/2409] Disable apparmor for openSUSE distros

Dnsmasq and haproxy are used frequently by neutron and nova, apparmor
profiles can block some operations and the deployed cloud can't
work properly so some tests are going to fail.

Some openSUSE distros has apparmor enabled by default so we need to
disable it.

Change-Id: I30fda684effb09810643e58bf0b31a73d7d9b378
Signed-off-by: aojeagarcia <aojeagarcia@suse.com>
---
 tools/fixup_stuff.sh | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index 914793245e..a939e30b02 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -205,6 +205,19 @@ function fixup_fedora {
     fi
 }
 
+function fixup_suse {
+    if ! is_suse; then
+        return
+    fi
+
+    # Disable apparmor profiles in openSUSE distros
+    # to avoid issues with haproxy and dnsmasq
+    if [ -x /usr/sbin/aa-enabled ] && sudo /usr/sbin/aa-enabled -q; then
+        sudo systemctl disable apparmor
+        sudo /usr/sbin/aa-teardown
+    fi
+}
+
 # The version of pip(1.5.4) supported by python-virtualenv(1.11.4) has
 # connection issues under proxy so re-install the latest version using
 # pip. To avoid having pip's virtualenv overwritten by the distro's
@@ -239,5 +252,6 @@ function fixup_all {
     fixup_uca
     fixup_python_packages
     fixup_fedora
+    fixup_suse
     fixup_virtualenv
 }

From 297a50ac86e597cb31c7f4347925ad0e5984960f Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Wed, 20 Jun 2018 11:08:54 +0200
Subject: [PATCH 1411/2409] Convert to openSUSE Leap 15.0 platform testing

Leap 15.0 has been released May 25th, 2018 (see
https://en.opensuse.org/Portal:15.0 ) and we'd like to
transition devstack against it and remove Leap 42.3 from
the testing matrix. Leap 15.0 is newer than Leap 42.3 as
the numbering schema of openSUSE was changed.

Co-Authored-By: Antonio Ojea <itsuugo@gmail.com>

Change-Id: I078f9a2580160c564c33e575008516f5e92239d6
---
 .zuul.yaml          | 12 ++++++------
 functions-common    |  8 +++++---
 lib/databases/mysql |  2 +-
 stack.sh            |  3 ++-
 4 files changed, 14 insertions(+), 11 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 9d73bede54..87b8049403 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -19,10 +19,10 @@
           - controller
 
 - nodeset:
-    name: devstack-single-node-opensuse-423
+    name: devstack-single-node-opensuse-150
     nodes:
       - name: controller
-        label: opensuse-423
+        label: opensuse-150
     groups:
       - name: tempest
         nodes:
@@ -395,10 +395,10 @@
     voting: false
 
 - job:
-    name: devstack-platform-opensuse-423
+    name: devstack-platform-opensuse-150
     parent: tempest-full
-    description: openSUSE 43.2 platform test
-    nodeset: devstack-single-node-opensuse-423
+    description: openSUSE 15.0 platform test
+    nodeset: devstack-single-node-opensuse-150
     voting: false
 
 - job:
@@ -487,7 +487,7 @@
       jobs:
         - devstack
         - devstack-platform-centos-7
-        - devstack-platform-opensuse-423
+        - devstack-platform-opensuse-150
         - devstack-platform-opensuse-tumbleweed
         - devstack-platform-fedora-latest
         - devstack-multinode
diff --git a/functions-common b/functions-common
index fae936a3d0..fa571aecfd 100644
--- a/functions-common
+++ b/functions-common
@@ -374,8 +374,10 @@ function GetDistro {
     elif [[ "$os_VENDOR" =~ (openSUSE) ]]; then
         DISTRO="opensuse-$os_RELEASE"
         # Tumbleweed uses "n/a" as a codename, and the release is a datestring
-        # like 20180218, so not very useful.
-        [ "$os_CODENAME" = "n/a" ] && DISTRO="opensuse-tumbleweed"
+        # like 20180218, so not very useful. Leap however uses a release
+        # with a "dot", so for example 15.0
+        [ "$os_CODENAME" = "n/a" -a "$os_RELEASE" = "${os_RELEASE/\./}" ] && \
+            DISTRO="opensuse-tumbleweed"
     elif [[ "$os_VENDOR" =~ (SUSE LINUX) ]]; then
         # just use major release
         DISTRO="sle${os_RELEASE%.*}"
@@ -1376,7 +1378,7 @@ function zypper_install {
     [[ "$(id -u)" = "0" ]] && sudo="env"
     $sudo http_proxy="${http_proxy:-}" https_proxy="${https_proxy:-}" \
         no_proxy="${no_proxy:-}" \
-        zypper --non-interactive install --auto-agree-with-licenses "$@"
+        zypper --non-interactive install --auto-agree-with-licenses --no-recommends "$@"
 }
 
 function write_user_unit_file {
diff --git a/lib/databases/mysql b/lib/databases/mysql
index cf61056389..ac0c083c91 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -16,7 +16,7 @@ MYSQL_DRIVER=${MYSQL_DRIVER:-PyMySQL}
 register_database mysql
 
 MYSQL_SERVICE_NAME=mysql
-if is_fedora && ! is_oraclelinux; then
+if is_suse || is_fedora && ! is_oraclelinux; then
     MYSQL_SERVICE_NAME=mariadb
 fi
 
diff --git a/stack.sh b/stack.sh
index 56e00bfb67..be3c4be147 100755
--- a/stack.sh
+++ b/stack.sh
@@ -221,7 +221,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (xenial|artful|bionic|stretch|jessie|f27|f28|opensuse-42.3|opensuse-tumbleweed|rhel7) ]]; then
+if [[ ! ${DISTRO} =~ (xenial|artful|bionic|stretch|jessie|f27|f28|opensuse-42.3|opensuse-15.0|opensuse-tumbleweed|rhel7) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"
@@ -1137,6 +1137,7 @@ if is_service_enabled neutron; then
     echo_summary "Configuring Neutron"
 
     configure_neutron
+
     # Run init_neutron only on the node hosting the Neutron API server
     if is_service_enabled $DATABASE_BACKENDS && is_service_enabled neutron; then
         init_neutron

From 35485ca21f13788958a636829e135ee639881a76 Mon Sep 17 00:00:00 2001
From: ghanshyam <gmann@ghanshyammann.com>
Date: Tue, 9 Oct 2018 07:39:07 +0000
Subject: [PATCH 1412/2409] Remove setting of unnecessary tempest config
 options

Tempest have removed the volume-feature-enabled.api_v1
config options[1] and modified the default value of
volume-feature-enabled.api_v3 to True.

These config options not needed to be set from devstack
side.

[1] https://review.openstack.org/#/c/573135/

Change-Id: Ic35cf4482ab4d3c2e69348ec92568e68f6ea74ee
---
 lib/tempest | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 3fefa5b320..fba8826a2d 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -456,9 +456,6 @@ function configure_tempest {
         TEMPEST_EXTEND_ATTACHED_VOLUME=${TEMPEST_EXTEND_ATTACHED_VOLUME:-True}
     fi
     iniset $TEMPEST_CONFIG volume-feature-enabled extend_attached_volume $(trueorfalse False TEMPEST_EXTEND_ATTACHED_VOLUME)
-    # TODO(ameade): Remove the api_v3 flag when Mitaka and Liberty are end of life.
-    iniset $TEMPEST_CONFIG volume-feature-enabled api_v3 True
-    iniset $TEMPEST_CONFIG volume-feature-enabled api_v1 $(trueorfalse False TEMPEST_VOLUME_API_V1)
     local tempest_volume_min_microversion=${TEMPEST_VOLUME_MIN_MICROVERSION:-None}
     local tempest_volume_max_microversion=${TEMPEST_VOLUME_MAX_MICROVERSION:-"latest"}
     # Reset microversions to None where v2 is running which does not support microversion.

From da863fab1d54f285fdf964c7d09602e4801b627d Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Wed, 10 Oct 2018 06:20:08 +0000
Subject: [PATCH 1413/2409] Updated from generate-devstack-plugins-list

Change-Id: I53db3e407e9495cbff758e823ea95485c888e706
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 2361b4b54c..0ebd0c32a1 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -171,6 +171,7 @@ solum                                  `git://git.openstack.org/openstack/solum
 stackube                               `git://git.openstack.org/openstack/stackube <https://git.openstack.org/cgit/openstack/stackube>`__
 storlets                               `git://git.openstack.org/openstack/storlets <https://git.openstack.org/cgit/openstack/storlets>`__
 stx-config                             `git://git.openstack.org/openstack/stx-config <https://git.openstack.org/cgit/openstack/stx-config>`__
+stx-fault                              `git://git.openstack.org/openstack/stx-fault <https://git.openstack.org/cgit/openstack/stx-fault>`__
 tacker                                 `git://git.openstack.org/openstack/tacker <https://git.openstack.org/cgit/openstack/tacker>`__
 tap-as-a-service                       `git://git.openstack.org/openstack/tap-as-a-service <https://git.openstack.org/cgit/openstack/tap-as-a-service>`__
 tap-as-a-service-dashboard             `git://git.openstack.org/openstack/tap-as-a-service-dashboard <https://git.openstack.org/cgit/openstack/tap-as-a-service-dashboard>`__

From 0d91c29d9e363ac09d98d17bae90da1acd5ee66a Mon Sep 17 00:00:00 2001
From: aojeagarcia <aojeagarcia@suse.com>
Date: Mon, 8 Oct 2018 16:43:19 +0200
Subject: [PATCH 1414/2409] Add devstack ipv6 jobs

We can see that there is more demand on using ipv6 as the underlay
infrastructure to deploy new services, and OpenStack should be ready for
that.

These devstack ipv6 jobs are based on the work started by Jens Harbott in
https://review.openstack.org/#/c/608168/

Change-Id: I55bd067487665e5026e82a0737cb0f38a69499fb
Signed-off-by: aojeagarcia <aojeagarcia@suse.com>
---
 .zuul.yaml | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index 9d73bede54..6e6d458d0c 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -375,6 +375,19 @@
           VNCSERVER_LISTEN: 0.0.0.0
           VNCSERVER_PROXYCLIENT_ADDRESS: $HOST_IP
 
+- job:
+    name: devstack-ipv6
+    parent: devstack
+    description: |
+      Devstack single node job for integration gate with IPv6.
+    vars:
+      devstack_localrc:
+        SERVICE_IP_VERSION: 6
+        SERVICE_HOST: ""
+        # IPv6 and certificates known issue with python2
+        # https://bugs.launchpad.net/devstack/+bug/1794929
+        USE_PYTHON3: true
+
 - job:
     name: devstack-multinode
     parent: devstack
@@ -486,6 +499,8 @@
     check:
       jobs:
         - devstack
+        - devstack-ipv6:
+            voting: false
         - devstack-platform-centos-7
         - devstack-platform-opensuse-423
         - devstack-platform-opensuse-tumbleweed

From e9f3988a57498f8593ff51055be212402fec60ce Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Thu, 11 Oct 2018 07:02:16 +0000
Subject: [PATCH 1415/2409] Updated from generate-devstack-plugins-list

Change-Id: Iae7700901060efa7687138dc6adf93604afa3ef6
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 0ebd0c32a1..b6b4058223 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -65,6 +65,7 @@ freezer-web-ui                         `git://git.openstack.org/openstack/freeze
 gce-api                                `git://git.openstack.org/openstack/gce-api <https://git.openstack.org/cgit/openstack/gce-api>`__
 glare                                  `git://git.openstack.org/openstack/glare <https://git.openstack.org/cgit/openstack/glare>`__
 group-based-policy                     `git://git.openstack.org/openstack/group-based-policy <https://git.openstack.org/cgit/openstack/group-based-policy>`__
+gyan                                   `git://git.openstack.org/openstack/gyan <https://git.openstack.org/cgit/openstack/gyan>`__
 heat                                   `git://git.openstack.org/openstack/heat <https://git.openstack.org/cgit/openstack/heat>`__
 heat-dashboard                         `git://git.openstack.org/openstack/heat-dashboard <https://git.openstack.org/cgit/openstack/heat-dashboard>`__
 horizon-mellanox                       `git://git.openstack.org/openstack/horizon-mellanox <https://git.openstack.org/cgit/openstack/horizon-mellanox>`__

From 7d0003ef7ed2c2609ffe6782e0ce6147f9c9a3bf Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Thu, 11 Oct 2018 08:59:26 -0700
Subject: [PATCH 1416/2409] Make sure nova-compute is not configured with
 database access

Apparently we're inheriting some database config from the main file,
which should not be set for nova-compute. If we're properly in superconductor
mode where we have a dedicated config for compute, remove those lines
if present.

Closes-Bug: #1797413

Change-Id: I4820abe57a023050dd8d067c77e26028801ff288
---
 lib/nova | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/nova b/lib/nova
index 5e157c5f11..8b49116147 100644
--- a/lib/nova
+++ b/lib/nova
@@ -922,6 +922,9 @@ function start_nova_compute {
         # RPC, we also disable track_instance_changes.
         iniset $NOVA_CPU_CONF filter_scheduler track_instance_changes False
         iniset_rpc_backend nova $NOVA_CPU_CONF DEFAULT "nova_cell${NOVA_CPU_CELL}"
+        # Make sure we nuke any database config
+        inidelete $NOVA_CPU_CONF database connection
+        inidelete $NOVA_CPU_CONF api_database connection
     fi
 
     # Console proxies were configured earlier in create_nova_conf. Now that the

From 2c90239acc840659d8ae08e66be01917a2395bac Mon Sep 17 00:00:00 2001
From: Andreas Jaeger <aj@suse.com>
Date: Fri, 12 Oct 2018 10:09:17 +0200
Subject: [PATCH 1417/2409] Use tempest-pg-full

The legacy job legacy-tempest-dsvm-neutron-pg-full is now named
tempest-pg-full - using the new tempest and Zuul v3 frameworks.

Change experimental job to use new job.

Change-Id: If16397724fb4facd2a0db8148bdf7ba427ca10b6
Depends-On: https://review.openstack.org/609530
---
 .zuul.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index c21fc9e2bd..8520f21353 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -597,7 +597,7 @@
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
-        - legacy-tempest-dsvm-neutron-pg-full:
+        - tempest-pg-full:
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$

From 1c75d2f06c03b0ed0517b499674d36052bcc3793 Mon Sep 17 00:00:00 2001
From: Laura Sofia Enriquez <lsofia.enriquez@gmail.com>
Date: Thu, 11 Oct 2018 19:13:17 -0300
Subject: [PATCH 1418/2409] Fedora version updated in Devstack doc

Docs say that you require Fedora 24/25 to run Devstack, but Devstack
is working in newer versions. Update document to say that Fedora 28
can be used instead.

Closes-Bug: #1797239

Change-Id: Ie5227db9943e5ddb93cd37440165eabbae22f4fc
Signed-off-by: Laura Sofia Enriquez <lsofia.enriquez@gmail.com>
---
 doc/source/index.rst | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/doc/source/index.rst b/doc/source/index.rst
index 2ff4ff088a..fcf1e82d34 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -39,8 +39,9 @@ Install Linux
 -------------
 
 Start with a clean and minimal install of a Linux system. Devstack
-attempts to support Ubuntu 16.04/17.04, Fedora 24/25, CentOS/RHEL 7,
-as well as Debian and OpenSUSE.
+attempts to support the two latest LTS releases of Ubuntu, the
+latest/current Fedora version, CentOS/RHEL 7, as well as Debian and
+OpenSUSE.
 
 If you do not have a preference, Ubuntu 16.04 is the most tested, and
 will probably go the smoothest.

From 99cd16574604fc36e4fa9a8264100fe2ef17c808 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Thu, 18 Oct 2018 06:18:46 +0000
Subject: [PATCH 1419/2409] Updated from generate-devstack-plugins-list

Change-Id: I2ba736a97377ba1823b3d48983ebf6e4640c72aa
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index b6b4058223..00c1255e2a 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -173,6 +173,7 @@ stackube                               `git://git.openstack.org/openstack/stacku
 storlets                               `git://git.openstack.org/openstack/storlets <https://git.openstack.org/cgit/openstack/storlets>`__
 stx-config                             `git://git.openstack.org/openstack/stx-config <https://git.openstack.org/cgit/openstack/stx-config>`__
 stx-fault                              `git://git.openstack.org/openstack/stx-fault <https://git.openstack.org/cgit/openstack/stx-fault>`__
+stx-update                             `git://git.openstack.org/openstack/stx-update <https://git.openstack.org/cgit/openstack/stx-update>`__
 tacker                                 `git://git.openstack.org/openstack/tacker <https://git.openstack.org/cgit/openstack/tacker>`__
 tap-as-a-service                       `git://git.openstack.org/openstack/tap-as-a-service <https://git.openstack.org/cgit/openstack/tap-as-a-service>`__
 tap-as-a-service-dashboard             `git://git.openstack.org/openstack/tap-as-a-service-dashboard <https://git.openstack.org/cgit/openstack/tap-as-a-service-dashboard>`__

From 606e6bc446a421646b84ae7c143dbfb76cb416da Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Thu, 25 Oct 2018 06:29:11 +0000
Subject: [PATCH 1420/2409] Updated from generate-devstack-plugins-list

Change-Id: Ie132b6898b44d24e71aa2f3534931ffac2a9efa1
---
 doc/source/plugin-registry.rst | 1 -
 1 file changed, 1 deletion(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 00c1255e2a..b02061ed50 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -27,7 +27,6 @@ Plugin Name                            URL
 almanach                               `git://git.openstack.org/openstack/almanach <https://git.openstack.org/cgit/openstack/almanach>`__
 aodh                                   `git://git.openstack.org/openstack/aodh <https://git.openstack.org/cgit/openstack/aodh>`__
 apmec                                  `git://git.openstack.org/openstack/apmec <https://git.openstack.org/cgit/openstack/apmec>`__
-astara                                 `git://git.openstack.org/openstack/astara <https://git.openstack.org/cgit/openstack/astara>`__
 barbican                               `git://git.openstack.org/openstack/barbican <https://git.openstack.org/cgit/openstack/barbican>`__
 bilean                                 `git://git.openstack.org/openstack/bilean <https://git.openstack.org/cgit/openstack/bilean>`__
 blazar                                 `git://git.openstack.org/openstack/blazar <https://git.openstack.org/cgit/openstack/blazar>`__

From 7ddd733b7251259ddd67b93be6305380582f7ce7 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Wed, 9 May 2018 06:36:38 +0000
Subject: [PATCH 1421/2409] Drop devstack-platform-opensuse-tumbleweed

Builds of opensuse-tumbleweed nodes are currently failing, so these jobs
are receiving NODE_FAILURE.

Change-Id: I3c2d73a150df009e7dadc76277be36eb72e0dfa7
---
 .zuul.yaml | 18 ------------------
 1 file changed, 18 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 6682142ed2..7ac30d8284 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -38,16 +38,6 @@
         nodes:
           - controller
 
-- nodeset:
-    name: devstack-single-node-opensuse-tumbleweed
-    nodes:
-      - name: controller
-        label: opensuse-tumbleweed
-    groups:
-      - name: tempest
-        nodes:
-          - controller
-
 - nodeset:
     name: devstack-single-node-fedora-latest
     nodes:
@@ -424,13 +414,6 @@
     nodeset: devstack-single-node-opensuse-150
     voting: false
 
-- job:
-    name: devstack-platform-opensuse-tumbleweed
-    parent: tempest-full
-    description: openSUSE Tumbleweed platform test
-    nodeset: devstack-single-node-opensuse-tumbleweed
-    voting: false
-
 - job:
     name: devstack-platform-fedora-latest
     parent: tempest-full
@@ -513,7 +496,6 @@
             voting: false
         - devstack-platform-centos-7
         - devstack-platform-opensuse-150
-        - devstack-platform-opensuse-tumbleweed
         - devstack-platform-fedora-latest
         - devstack-multinode
         - devstack-unit-tests

From 0d4c9c9fa37c6f47523359044e5f65629321ff6d Mon Sep 17 00:00:00 2001
From: Attila Fazekas <afazekas@redhat.com>
Date: Mon, 10 Sep 2018 15:52:46 -0600
Subject: [PATCH 1422/2409] Have lib/tempest to create shared network

In order to make sure not possible to introduce a change in tempest
which breaks the shared network compatibility.

Depends-On: I6e3e53c4ac26b4fef09fefb9c590dfa91f577565

Change-Id: Ib2e7096175c991acf35de04e840ac188752d3c17
---
 lib/tempest | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index fba8826a2d..84177e82f2 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -242,6 +242,9 @@ function configure_tempest {
     # and the public_network_id should not be set.
     if [[ "$NEUTRON_CREATE_INITIAL_NETWORKS" == "True" ]] && is_networking_extension_supported 'external-net'; then
         public_network_id=$(openstack network show -f value -c id $PUBLIC_NETWORK_NAME)
+        # make sure shared network presence does not confuses the tempest tests
+        openstack network create --share shared
+        openstack subnet create --description shared-subnet --subnet-range ${TEMPEST_SHARED_POOL:-192.168.233.0/24} --network shared shared-subnet
     fi
 
     iniset $TEMPEST_CONFIG DEFAULT use_syslog $SYSLOG

From 994e82e57f78a4c302d620e44bcdda36c4c0d5f0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20Dulko?= <mdulko@redhat.com>
Date: Fri, 19 Oct 2018 12:08:12 +0200
Subject: [PATCH 1423/2409] Update ETCD_DOWNLOAD_URL

Looks like https://github.com/coreos/etcd is redirecting to
https://github.com/etcd-io/etcd, so let's use that official address as
the download URL.

Change-Id: I39355b4deb17ae11927a5339e73fb8ec3a274cf7
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 34bd6771a6..5dd5602be6 100644
--- a/stackrc
+++ b/stackrc
@@ -763,7 +763,7 @@ else
 fi
 ETCD_PORT=${ETCD_PORT:-2379}
 ETCD_PEER_PORT=${ETCD_PEER_PORT:-2380}
-ETCD_DOWNLOAD_URL=${ETCD_DOWNLOAD_URL:-https://github.com/coreos/etcd/releases/download}
+ETCD_DOWNLOAD_URL=${ETCD_DOWNLOAD_URL:-https://github.com/etcd-io/etcd/releases/download}
 ETCD_NAME=etcd-$ETCD_VERSION-linux-$ETCD_ARCH
 ETCD_DOWNLOAD_FILE=$ETCD_NAME.tar.gz
 ETCD_DOWNLOAD_LOCATION=$ETCD_DOWNLOAD_URL/$ETCD_VERSION/$ETCD_DOWNLOAD_FILE

From e3e9ea299601665a295e31a98e90dd9587165850 Mon Sep 17 00:00:00 2001
From: Derek Higgins <derekh@redhat.com>
Date: Fri, 9 Nov 2018 15:43:13 +0000
Subject: [PATCH 1424/2409] Revert "remove external_network_bridge option"

This reverts commit faaf96bfb15c5f4c45a72b149dc6fe1e1f907a71.

Ironic jobs were still using this option, it needs to be
switched to an alternative first.

Change-Id: I1683d7cfa81f5fe2497cc7045e87f8b20fed4968
---
 lib/neutron                  | 3 +++
 lib/neutron_plugins/ovs_base | 4 ++++
 2 files changed, 7 insertions(+)

diff --git a/lib/neutron b/lib/neutron
index 4e9691dfc0..4847e87f2f 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -95,6 +95,9 @@ NEUTRON_ROOTWRAP_CONF_FILE=$NEUTRON_CONF_DIR/rootwrap.conf
 NEUTRON_ROOTWRAP_CMD="$NEUTRON_ROOTWRAP $NEUTRON_ROOTWRAP_CONF_FILE"
 NEUTRON_ROOTWRAP_DAEMON_CMD="$NEUTRON_ROOTWRAP-daemon $NEUTRON_ROOTWRAP_CONF_FILE"
 
+# This is needed because _neutron_ovs_base_configure_l3_agent will set
+# external_network_bridge
+Q_USE_PROVIDERNET_FOR_PUBLIC=${Q_USE_PROVIDERNET_FOR_PUBLIC:-True}
 # This is needed because _neutron_ovs_base_configure_l3_agent uses it to create
 # an external network bridge
 PUBLIC_BRIDGE=${PUBLIC_BRIDGE:-br-ex}
diff --git a/lib/neutron_plugins/ovs_base b/lib/neutron_plugins/ovs_base
index 558a7d5d07..523024e2fe 100644
--- a/lib/neutron_plugins/ovs_base
+++ b/lib/neutron_plugins/ovs_base
@@ -96,6 +96,10 @@ function _neutron_ovs_base_configure_firewall_driver {
 }
 
 function _neutron_ovs_base_configure_l3_agent {
+    if [ "$Q_USE_PROVIDERNET_FOR_PUBLIC" != "True" ]; then
+        iniset $Q_L3_CONF_FILE DEFAULT external_network_bridge $PUBLIC_BRIDGE
+    fi
+
     neutron-ovs-cleanup --config-file $NEUTRON_CONF
     if [[ "$Q_USE_PUBLIC_VETH" = "True" ]]; then
         ip link show $Q_PUBLIC_VETH_INT > /dev/null 2>&1 ||

From 0f5a20fb79380806b7fd81d9e6d9c8afcd7dfbed Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Thu, 22 Nov 2018 06:19:15 +0000
Subject: [PATCH 1425/2409] Updated from generate-devstack-plugins-list

Change-Id: I992065186ed4a4c5811a7c82ac09a0bc85ca11e8
---
 doc/source/plugin-registry.rst | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index b02061ed50..7ed24638fd 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -172,6 +172,8 @@ stackube                               `git://git.openstack.org/openstack/stacku
 storlets                               `git://git.openstack.org/openstack/storlets <https://git.openstack.org/cgit/openstack/storlets>`__
 stx-config                             `git://git.openstack.org/openstack/stx-config <https://git.openstack.org/cgit/openstack/stx-config>`__
 stx-fault                              `git://git.openstack.org/openstack/stx-fault <https://git.openstack.org/cgit/openstack/stx-fault>`__
+stx-integ                              `git://git.openstack.org/openstack/stx-integ <https://git.openstack.org/cgit/openstack/stx-integ>`__
+stx-nfv                                `git://git.openstack.org/openstack/stx-nfv <https://git.openstack.org/cgit/openstack/stx-nfv>`__
 stx-update                             `git://git.openstack.org/openstack/stx-update <https://git.openstack.org/cgit/openstack/stx-update>`__
 tacker                                 `git://git.openstack.org/openstack/tacker <https://git.openstack.org/cgit/openstack/tacker>`__
 tap-as-a-service                       `git://git.openstack.org/openstack/tap-as-a-service <https://git.openstack.org/cgit/openstack/tap-as-a-service>`__

From 8d1b20b4c2334dc3045cea93441568657869f6d1 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Thu, 22 Nov 2018 13:17:01 +0000
Subject: [PATCH 1426/2409] Enable universe repository on Ubuntu

The universe repository is not enabled when installing Ubuntu from an
ISO (at least for Bionic). This leads to some errors during the devstack
run that are not seen when running based on a cloud image which has that
repo enabled by default. Enable that repository unconditionally, the
operation is idempotent.

Change-Id: Ifcb7ecd78fb25ca2136f5848c19b74500e520873
Closes-Bug: 1792936
---
 tools/fixup_stuff.sh | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index a939e30b02..4513af0a64 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -69,21 +69,29 @@ function fixup_keystone {
     fi
 }
 
-# Ubuntu Cloud Archive
-#---------------------
+# Ubuntu Repositories
+#--------------------
 # We've found that Libvirt on Xenial is flaky and crashes enough to be
 # a regular top e-r bug. Opt into Ubuntu Cloud Archive if on Xenial to
 # get newer Libvirt.
 # Make it possible to switch this based on an environment variable as
 # libvirt 2.5.0 doesn't handle nested virtualization quite well and this
 # is required for the trove development environment.
-function fixup_uca {
-    if [[ "${ENABLE_UBUNTU_CLOUD_ARCHIVE}" == "False" || "$DISTRO" != "xenial" ]]; then
+# Also enable universe since it is missing when installing from ISO.
+function fixup_ubuntu {
+    if [[ "$DISTRO" != "xenial" && "$DISTRO" != "bionic" ]]; then
         return
     fi
 
     # This pulls in apt-add-repository
     install_package "software-properties-common"
+
+    # Enable universe
+    sudo add-apt-repository -y universe
+
+    if [[ "${ENABLE_UBUNTU_CLOUD_ARCHIVE}" == "False" || "$DISTRO" != "xenial" ]]; then
+        return
+    fi
     # Use UCA for newer libvirt.
     if [[ -f /etc/ci/mirror_info.sh ]] ; then
         # If we are on a nodepool provided host and it has told us about where
@@ -249,7 +257,7 @@ function fixup_virtualenv {
 
 function fixup_all {
     fixup_keystone
-    fixup_uca
+    fixup_ubuntu
     fixup_python_packages
     fixup_fedora
     fixup_suse

From 80769c5714770c02c300ac9f3e9c06a44791dbfc Mon Sep 17 00:00:00 2001
From: Akihiro Motoki <amotoki@gmail.com>
Date: Fri, 23 Nov 2018 05:18:40 +0900
Subject: [PATCH 1427/2409] Migration logic for neutron policy-in-code

Neutron is in a process to migrate to policy-in-code.
DevStack needs to be able to handle both cases with and
without policy.json in the neutron repo.

Note that nova assumes neutron API access with admin
so user_name:neutron needs to be included in context_is_admin
to make DevStack work properly. Hopefully this can be cleanup
but this is a separate topic from policy-in-code.

Needed-By: https://review.openstack.org/#/c/585037/
Change-Id: Id1b0600d92e839ade1790a15c372e82e8e16ee9f
---
 lib/neutron        | 9 +++++++--
 lib/neutron-legacy | 9 +++++++--
 2 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 4847e87f2f..62f7366e7e 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -183,9 +183,14 @@ function configure_neutron_new {
     # Neutron API server & Neutron plugin
     if is_service_enabled neutron-api; then
         local policy_file=$NEUTRON_CONF_DIR/policy.json
-        cp $NEUTRON_DIR/etc/policy.json $policy_file
         # Allow neutron user to administer neutron to match neutron account
-        sed -i 's/"context_is_admin":  "role:admin"/"context_is_admin":  "role:admin or user_name:neutron"/g' $policy_file
+        # NOTE(amotoki): This is required for nova works correctly with neutron.
+        if [ -f $NEUTRON_DIR/etc/policy.json ]; then
+            cp $NEUTRON_DIR/etc/policy.json $policy_file
+            sed -i 's/"context_is_admin":  "role:admin"/"context_is_admin":  "role:admin or user_name:neutron"/g' $policy_file
+        else
+            echo '{"context_is_admin":  "role:admin or user_name:neutron"}' > $policy_file
+        fi
 
         cp $NEUTRON_DIR/etc/api-paste.ini $NEUTRON_CONF_DIR/api-paste.ini
 
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index be5b73ffa6..2fdb6db6f6 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -699,10 +699,15 @@ function _configure_neutron_common {
     cp $NEUTRON_DIR/etc/neutron.conf.sample $NEUTRON_CONF
 
     Q_POLICY_FILE=$NEUTRON_CONF_DIR/policy.json
-    cp $NEUTRON_DIR/etc/policy.json $Q_POLICY_FILE
 
     # allow neutron user to administer neutron to match neutron account
-    sed -i 's/"context_is_admin":  "role:admin"/"context_is_admin":  "role:admin or user_name:neutron"/g' $Q_POLICY_FILE
+    # NOTE(amotoki): This is required for nova works correctly with neutron.
+    if [ -f $NEUTRON_DIR/etc/policy.json ]; then
+        cp $NEUTRON_DIR/etc/policy.json $Q_POLICY_FILE
+        sed -i 's/"context_is_admin":  "role:admin"/"context_is_admin":  "role:admin or user_name:neutron"/g' $Q_POLICY_FILE
+    else
+        echo '{"context_is_admin":  "role:admin or user_name:neutron"}' > $Q_POLICY_FILE
+    fi
 
     # Set plugin-specific variables ``Q_DB_NAME``, ``Q_PLUGIN_CLASS``.
     # For main plugin config file, set ``Q_PLUGIN_CONF_PATH``, ``Q_PLUGIN_CONF_FILENAME``.

From 67394b02417802842021fdef95f68edbf723eb71 Mon Sep 17 00:00:00 2001
From: Andreas Jaeger <aj@suse.com>
Date: Sat, 24 Nov 2018 10:14:46 +0100
Subject: [PATCH 1428/2409] Remove is_in_projects_txt

This function is nowhere used as confirmed by codesearch:
http://codesearch.openstack.org/?q=is_in_projects_txt&i=nope&files=&repos=

We can remove the function.

Note that usage of this function was removed in change
I843208e2e982eb04931b76f5cb4bd219fbcd70de in 2015.

This came up in context of https://review.openstack.org/619089 where
requirements/projects.txt is getting removed.

Change-Id: I487d3f9e340bd45e83245b9ca91e8e3b5ac3ae02
---
 inc/python | 11 -----------
 1 file changed, 11 deletions(-)

diff --git a/inc/python b/inc/python
index d8b8169fa1..5fb7245623 100644
--- a/inc/python
+++ b/inc/python
@@ -490,17 +490,6 @@ function setup_develop {
     _setup_package_with_constraints_edit $project_dir -e $extras
 }
 
-# determine if a project as specified by directory is in
-# projects.txt. This will not be an exact match because we throw away
-# the namespacing when we clone, but it should be good enough in all
-# practical ways.
-function is_in_projects_txt {
-    local project_dir=$1
-    local project_name
-    project_name=$(basename $project_dir)
-    grep -q "/$project_name\$" $REQUIREMENTS_DIR/projects.txt
-}
-
 # ``pip install -e`` the package, which processes the dependencies
 # using pip before running `setup.py develop`
 #

From 23d33a8b5bc945bd98c8fffe86b38f97247afbd9 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Wed, 21 Nov 2018 12:10:32 -0500
Subject: [PATCH 1429/2409] Set non-0 disk sizes for tempest flavors

Nova change https://review.openstack.org/603910/ is
going to change the default rule on policy
os_compute_api:servers:create:zero_disk_flavor to
admin-only, which will prevent non-admins from
creating image-backed servers with a flavor that
has disk=0 since it's a potential security exposure.

Therefore we need the test flavors that are created
for tempest to use non-0 disk values. Since the flavor_ref
and flavor_ref_alt can be aligned to the image_ref and
image_ref_alt in tempest.conf, we get the image sizes
from glance (in bytes) and convert those to GiB disk
sizes for each flavor, respectively. Since we're using
Cirros images by default, we need to make sure to round
up otherwise we'd still have a 0-disk flavor.

There are lots of ways the math could be done here
using numfmt, bash, awk, bc, etc, but it's simplest to
write and probably easiest to read by using python for
the size conversion code.

Change-Id: I537c299b0cd400982189f35b31df74755422737e
Related-Bug: #1739646
---
 lib/tempest | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index fba8826a2d..7526d3bb4e 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -102,6 +102,14 @@ function remove_disabled_extensions {
     remove_disabled_services "$extensions_list" "$disabled_exts"
 }
 
+# image_size_in_gib - converts an image size from bytes to GiB, rounded up
+# Takes an image ID parameter as input
+function image_size_in_gib {
+    local size
+    size=$(openstack image show $1 -c size -f value)
+    echo $size | python -c "import math; print int(math.ceil(float(int(raw_input()) / 1024.0 ** 3)))"
+}
+
 # configure_tempest() - Set config files, create data dirs, etc
 function configure_tempest {
     if [[ "$INSTALL_TEMPEST" == "True" ]]; then
@@ -125,6 +133,7 @@ function configure_tempest {
     local public_network_id
     local public_router_id
     local ssh_connect_method="floating"
+    local disk
 
     # Save IFS
     ifs=$IFS
@@ -190,11 +199,15 @@ function configure_tempest {
         available_flavors=$(nova flavor-list)
         if  [[ -z "$DEFAULT_INSTANCE_TYPE" ]]; then
             if [[ ! ( $available_flavors =~ 'm1.nano' ) ]]; then
-                openstack flavor create --id 42 --ram 64 --disk 0 --vcpus 1 m1.nano
+                # Determine the flavor disk size based on the image size.
+                disk=$(image_size_in_gib $image_uuid)
+                openstack flavor create --id 42 --ram 64 --disk $disk --vcpus 1 m1.nano
             fi
             flavor_ref=42
             if [[ ! ( $available_flavors =~ 'm1.micro' ) ]]; then
-                openstack flavor create --id 84 --ram 128 --disk 0 --vcpus 1 m1.micro
+                # Determine the alt flavor disk size based on the alt image size.
+                disk=$(image_size_in_gib $image_uuid_alt)
+                openstack flavor create --id 84 --ram 128 --disk $disk --vcpus 1 m1.micro
             fi
             flavor_ref_alt=84
         else

From 78a564bb0304b6f930e1491e7e116a0a0f6d9ab6 Mon Sep 17 00:00:00 2001
From: Chris Dent <cdent@anticdent.org>
Date: Fri, 5 Oct 2018 10:17:56 +0100
Subject: [PATCH 1430/2409] Use openstack/placement instead of
 placement-in-nova

We introduce and set PLACEMENT_REPO, add a placement-manage command
to sync database tables (see one of the commits on which this
depends), use /etc/placement/placement.conf for config, and put the
uwsgi config file (pointing to placement-api instead of
nova-placement-api) in /etc/placement.

openstack/placement is also added to the required-projects in
the devstack zuul job.

Change-Id: I0b217e7a8c68a637b7a3445f6c44b7574117e320
---
 .zuul.yaml    |  5 ++--
 lib/placement | 81 ++++++++++++++++++++++++++-------------------------
 stack.sh      |  2 --
 stackrc       |  4 +++
 4 files changed, 48 insertions(+), 44 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 7ac30d8284..38e663e933 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -241,8 +241,8 @@
       This base job can be used for single node and multinode devstack jobs.
 
       With a single node nodeset, this job sets up an "all-in-one" (aio)
-      devstack with the six OpenStack services included in the devstack tree:
-      keystone, glance, cinder, neutron, nova and swift.
+      devstack with the seven OpenStack services included in the devstack tree:
+      keystone, glance, cinder, neutron, nova, placement, and swift.
 
       With a two node nodeset, this job sets up an aio + compute node.
       The controller can be customised using host-vars.controller, the
@@ -265,6 +265,7 @@
       - git.openstack.org/openstack/keystone
       - git.openstack.org/openstack/neutron
       - git.openstack.org/openstack/nova
+      - git.openstack.org/openstack/placement
       - git.openstack.org/openstack/swift
     timeout: 7200
     vars:
diff --git a/lib/placement b/lib/placement
index a1602bab90..409ebecc4a 100644
--- a/lib/placement
+++ b/lib/placement
@@ -3,9 +3,6 @@
 # lib/placement
 # Functions to control the configuration and operation of the **Placement** service
 #
-# Currently the placement service is embedded in nova. Eventually we
-# expect this to change so this file is started as a separate entity
-# despite making use of some *NOVA* variables and files.
 
 # Dependencies:
 #
@@ -29,23 +26,21 @@ set +o xtrace
 # Defaults
 # --------
 
-PLACEMENT_CONF_DIR=/etc/nova
-PLACEMENT_CONF=$PLACEMENT_CONF_DIR/nova.conf
-PLACEMENT_AUTH_STRATEGY=${PLACEMENT_AUTH_STRATEGY:-placement}
-# Nova virtual environment
+PLACEMENT_DIR=$DEST/placement
+PLACEMENT_CONF_DIR=/etc/placement
+PLACEMENT_CONF=$PLACEMENT_CONF_DIR/placement.conf
+PLACEMENT_AUTH_CACHE_DIR=${PLACEMENT_AUTH_CACHE_DIR:-/var/cache/placement}
+PLACEMENT_AUTH_STRATEGY=${PLACEMENT_AUTH_STRATEGY:-keystone}
+# Placement virtual environment
 if [[ ${USE_VENV} = True ]]; then
-    PROJECT_VENV["nova"]=${NOVA_DIR}.venv
-    PLACEMENT_BIN_DIR=${PROJECT_VENV["nova"]}/bin
+    PROJECT_VENV["placement"]=${PLACEMENT_DIR}.venv
+    PLACEMENT_BIN_DIR=${PROJECT_VENV["placement"]}/bin
 else
     PLACEMENT_BIN_DIR=$(get_python_exec_prefix)
 fi
-PLACEMENT_UWSGI=$PLACEMENT_BIN_DIR/nova-placement-api
+PLACEMENT_UWSGI=$PLACEMENT_BIN_DIR/placement-api
 PLACEMENT_UWSGI_CONF=$PLACEMENT_CONF_DIR/placement-uwsgi.ini
 
-# The placement service can optionally use a separate database
-# connection. Set PLACEMENT_DB_ENABLED to True to use it.
-PLACEMENT_DB_ENABLED=$(trueorfalse False PLACEMENT_DB_ENABLED)
-
 if is_service_enabled tls-proxy; then
     PLACEMENT_SERVICE_PROTOCOL="https"
 fi
@@ -70,27 +65,26 @@ function cleanup_placement {
     sudo rm -f $(apache_site_config_for nova-placement-api)
     sudo rm -f $(apache_site_config_for placement-api)
     remove_uwsgi_config "$PLACEMENT_UWSGI_CONF" "$PLACEMENT_UWSGI"
+    sudo rm -f $PLACEMENT_AUTH_CACHE_DIR/*
 }
 
 # _config_placement_apache_wsgi() - Set WSGI config files
 function _config_placement_apache_wsgi {
     local placement_api_apache_conf
     local venv_path=""
-    local nova_bin_dir=""
-    nova_bin_dir=$(get_python_exec_prefix)
+    local placement_bin_dir=""
+    placement_bin_dir=$(get_python_exec_prefix)
     placement_api_apache_conf=$(apache_site_config_for placement-api)
 
-    # reuse nova's venv if there is one as placement code lives
-    # there
     if [[ ${USE_VENV} = True ]]; then
-        venv_path="python-path=${PROJECT_VENV["nova"]}/lib/$(python_version)/site-packages"
-        nova_bin_dir=${PROJECT_VENV["nova"]}/bin
+        venv_path="python-path=${PROJECT_VENV["placement"]}/lib/$(python_version)/site-packages"
+        placement_bin_dir=${PROJECT_VENV["placement"]}/bin
     fi
 
     sudo cp $FILES/apache-placement-api.template $placement_api_apache_conf
     sudo sed -e "
         s|%APACHE_NAME%|$APACHE_NAME|g;
-        s|%PUBLICWSGI%|$nova_bin_dir/nova-placement-api|g;
+        s|%PUBLICWSGI%|$placement_bin_dir/placement-api|g;
         s|%SSLENGINE%|$placement_ssl|g;
         s|%SSLCERTFILE%|$placement_certfile|g;
         s|%SSLKEYFILE%|$placement_keyfile|g;
@@ -110,19 +104,23 @@ function configure_placement_nova_compute {
     iniset $conf placement user_domain_name "$SERVICE_DOMAIN_NAME"
     iniset $conf placement project_name "$SERVICE_TENANT_NAME"
     iniset $conf placement project_domain_name "$SERVICE_DOMAIN_NAME"
-    # TODO(cdent): auth_strategy, which is common to see in these
-    # blocks is not currently used here. For the time being the
-    # placement api uses the auth_strategy configuration setting
-    # established by the nova api. This avoids, for the time, being,
-    # creating redundant configuration items that are just used for
-    # testing.
+    iniset $conf placement auth_strategy $PLACEMENT_AUTH_STRATEGY
+}
+
+# create_placement_conf() - Write confg
+function create_placement_conf {
+    rm -f $PLACEMENT_CONF
+    iniset $PLACEMENT_CONF placement_database connection `database_connection_url placement`
+    iniset $PLACEMENT_CONF DEFAULT debug "$ENABLE_DEBUG_LOG_LEVEL"
+    iniset $PLACEMENT_CONF api auth_strategy $PLACEMENT_AUTH_STRATEGY
+    configure_auth_token_middleware $PLACEMENT_CONF placement $PLACEMENT_AUTH_CACHE_DIR
+    setup_logging $PLACEMENT_CONF
 }
 
 # configure_placement() - Set config files, create data dirs, etc
 function configure_placement {
-    if [ "$PLACEMENT_DB_ENABLED" != False ]; then
-        iniset $PLACEMENT_CONF placement_database connection `database_connection_url placement`
-    fi
+    sudo install -d -o $STACK_USER $PLACEMENT_CONF_DIR
+    create_placement_conf
 
     if [[ "$WSGI_MODE" == "uwsgi" ]]; then
         write_uwsgi_config "$PLACEMENT_UWSGI_CONF" "$PLACEMENT_UWSGI" "/placement"
@@ -143,25 +141,28 @@ function create_placement_accounts {
         "$placement_api_url"
 }
 
+# create_placement_cache_dir() - Create directories for keystone cache
+function create_placement_cache_dir {
+    # Create cache dir
+    sudo install -d -o $STACK_USER $PLACEMENT_AUTH_CACHE_DIR
+    rm -f $PLACEMENT_AUTH_CACHE_DIR/*
+}
+
 # init_placement() - Create service user and endpoints
-# If PLACEMENT_DB_ENABLED is true, create the separate placement db
-# using, for now, the api_db migrations.
 function init_placement {
-    if [ "$PLACEMENT_DB_ENABLED" != False ]; then
-        recreate_database placement
-        # Database migration will be handled when nova does an api_db sync
-        # TODO(cdent): When placement is extracted we'll do our own sync
-        # here.
-    fi
+    recreate_database placement
+    $PLACEMENT_BIN_DIR/placement-manage db sync
     create_placement_accounts
+    create_placement_cache_dir
 }
 
 # install_placement() - Collect source and prepare
 function install_placement {
     install_apache_wsgi
     # Install the openstackclient placement client plugin for CLI
-    # TODO(mriedem): Use pip_install_gr once osc-placement is in g-r.
-    pip_install osc-placement
+    pip_install_gr osc-placement
+    git_clone $PLACEMENT_REPO $PLACEMENT_DIR $PLACEMENT_BRANCH
+    setup_develop $PLACEMENT_DIR
 }
 
 # start_placement_api() - Start the API processes ahead of other things
diff --git a/stack.sh b/stack.sh
index be3c4be147..497c8bc479 100755
--- a/stack.sh
+++ b/stack.sh
@@ -894,8 +894,6 @@ if is_service_enabled neutron; then
     stack_install_service neutron
 fi
 
-# Nova configuration is used by placement so we need to create nova.conf
-# first.
 if is_service_enabled nova; then
     # Compute service
     stack_install_service nova
diff --git a/stackrc b/stackrc
index 34bd6771a6..746372d123 100644
--- a/stackrc
+++ b/stackrc
@@ -298,6 +298,10 @@ NOVA_BRANCH=${NOVA_BRANCH:-$TARGET_BRANCH}
 SWIFT_REPO=${SWIFT_REPO:-${GIT_BASE}/openstack/swift.git}
 SWIFT_BRANCH=${SWIFT_BRANCH:-$TARGET_BRANCH}
 
+# placement service
+PLACEMENT_REPO=${PLACEMENT_REPO:-${GIT_BASE}/openstack/placement.git}
+PLACEMENT_BRANCH=${PLACEMENT_BRANCH:-$TARGET_BRANCH}
+
 ##############
 #
 #  Testing Components

From 3027c20545688a39c1db84a83e0e8252d238603c Mon Sep 17 00:00:00 2001
From: Chris Dent <cdent@anticdent.org>
Date: Tue, 20 Nov 2018 22:18:26 +0000
Subject: [PATCH 1431/2409] Address nits on lib/placement for extracted
 placement

Earlier review [1] suggested some cleanups which have been
done here:

* Removing a redundant call from cleanup_placement
* Fixing a typo in a comment

[1] https://review.openstack.org/#/c/600162/15/lib/placement

Change-Id: I8abd2f02b123c6c1937c026ff13eb4e600de3202
---
 lib/placement | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/lib/placement b/lib/placement
index 409ebecc4a..da69e39264 100644
--- a/lib/placement
+++ b/lib/placement
@@ -62,7 +62,6 @@ function is_placement_enabled {
 # cleanup_placement() - Remove residual data files, anything left over from previous
 # runs that a clean run would need to clean up
 function cleanup_placement {
-    sudo rm -f $(apache_site_config_for nova-placement-api)
     sudo rm -f $(apache_site_config_for placement-api)
     remove_uwsgi_config "$PLACEMENT_UWSGI_CONF" "$PLACEMENT_UWSGI"
     sudo rm -f $PLACEMENT_AUTH_CACHE_DIR/*
@@ -107,7 +106,7 @@ function configure_placement_nova_compute {
     iniset $conf placement auth_strategy $PLACEMENT_AUTH_STRATEGY
 }
 
-# create_placement_conf() - Write confg
+# create_placement_conf() - Write config
 function create_placement_conf {
     rm -f $PLACEMENT_CONF
     iniset $PLACEMENT_CONF placement_database connection `database_connection_url placement`

From a6017b6eec743981fdbc9b50bf6b6752d1c86c0d Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Tue, 16 Oct 2018 13:57:23 +0000
Subject: [PATCH 1432/2409] Add openstack-single-node-xenial nodeset

Allow other jobs to explicitly require a node running Xenial. This seems
clearer than having a generic openstack-single-node nodeset which
implicitly uses Xenial.

Change-Id: I013fb8abd4e6ab6539bd9410acbc8446e57ec70c
---
 .zuul.yaml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index 7ac30d8284..f3fc87f23f 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -18,6 +18,16 @@
         nodes:
           - controller
 
+- nodeset:
+    name: openstack-single-node-xenial
+    nodes:
+      - name: controller
+        label: ubuntu-xenial
+    groups:
+      - name: tempest
+        nodes:
+          - controller
+
 - nodeset:
     name: devstack-single-node-centos-7
     nodes:

From 4727aaa742e142427cc5138fe09b3c69c559b5e5 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Tue, 16 Oct 2018 13:57:23 +0000
Subject: [PATCH 1433/2409] Switch devstack jobs to run on Bionic

Switch the nodesets that devstack job run on from Xenial to Bionic,
i.e. the latest Ubuntu LTS release. Keep variants running on Xenial
in order to make sure that we stay backwards compatible while we keep
running Xenial jobs on the older stable branches.

Change-Id: I8749ed24d5f451d29f767ebb2761abd743b7d306
---
 .zuul.yaml | 95 ++++++++++++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 92 insertions(+), 3 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index f3fc87f23f..a1c570b78f 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -88,6 +88,66 @@
         nodes:
           - compute1
 
+- nodeset:
+    name: openstack-two-node-bionic
+    nodes:
+      - name: controller
+        label: ubuntu-bionic
+      - name: compute1
+        label: ubuntu-bionic
+    groups:
+      # Node where tests are executed and test results collected
+      - name: tempest
+        nodes:
+          - controller
+      # Nodes running the compute service
+      - name: compute
+        nodes:
+          - controller
+          - compute1
+      # Nodes that are not the controller
+      - name: subnode
+        nodes:
+          - compute1
+      # Switch node for multinode networking setup
+      - name: switch
+        nodes:
+          - controller
+      # Peer nodes for multinode networking setup
+      - name: peers
+        nodes:
+          - compute1
+
+- nodeset:
+    name: openstack-two-node-xenial
+    nodes:
+      - name: controller
+        label: ubuntu-xenial
+      - name: compute1
+        label: ubuntu-xenial
+    groups:
+      # Node where tests are executed and test results collected
+      - name: tempest
+        nodes:
+          - controller
+      # Nodes running the compute service
+      - name: compute
+        nodes:
+          - controller
+          - compute1
+      # Nodes that are not the controller
+      - name: subnode
+        nodes:
+          - compute1
+      # Switch node for multinode networking setup
+      - name: switch
+        nodes:
+          - controller
+      # Peer nodes for multinode networking setup
+      - name: peers
+        nodes:
+          - compute1
+
 - job:
     name: devstack-base
     parent: multinode
@@ -209,7 +269,7 @@
     description: |
       Minimal devstack base job, intended for use by jobs that need
       less than the normal minimum set of required-projects.
-    nodeset: openstack-single-node
+    nodeset: openstack-single-node-bionic
     required-projects:
       - git.openstack.org/openstack/requirements
     vars:
@@ -268,7 +328,6 @@
 
       The run playbook consists of a single role, so it can be easily rewritten
       and extended.
-    nodeset: openstack-single-node
     required-projects:
       - git.openstack.org/openstack/cinder
       - git.openstack.org/openstack/glance
@@ -398,14 +457,31 @@
         # https://bugs.launchpad.net/devstack/+bug/1794929
         USE_PYTHON3: true
 
+- job:
+    name: devstack-xenial
+    parent: devstack
+    nodeset: openstack-single-node-xenial
+    description: |
+      Simple singlenode test to verify functionality on devstack
+      side running on Xenial.
+
 - job:
     name: devstack-multinode
     parent: devstack
-    nodeset: openstack-two-node
+    nodeset: openstack-two-node-bionic
     description: |
       Simple multinode test to verify multinode functionality on devstack side.
       This is not meant to be used as a parent job.
 
+- job:
+    name: devstack-multinode-xenial
+    parent: devstack
+    nodeset: openstack-two-node-xenial
+    description: |
+      Simple multinode test to verify multinode functionality on devstack
+      side running on Xenial.
+      This is not meant to be used as a parent job.
+
 # NOTE(ianw) Platform tests have traditionally been non-voting because
 # we often have to rush things through devstack to stabilise the gate,
 # and these platforms don't have the round-the-clock support to avoid
@@ -431,6 +507,13 @@
     nodeset: devstack-single-node-fedora-latest
     voting: false
 
+- job:
+    name: devstack-platform-xenial
+    parent: tempest-full
+    description: Ubuntu Xenial platform test
+    nodeset: openstack-single-node-xenial
+    voting: false
+
 - job:
     name: devstack-tox-base
     parent: devstack
@@ -502,12 +585,15 @@
     check:
       jobs:
         - devstack
+        - devstack-xenial
         - devstack-ipv6:
             voting: false
         - devstack-platform-centos-7
         - devstack-platform-opensuse-150
         - devstack-platform-fedora-latest
+        - devstack-platform-xenial
         - devstack-multinode
+        - devstack-multinode-xenial
         - devstack-unit-tests
         - openstack-tox-bashate
         - ironic-tempest-dsvm-ipa-wholedisk-bios-agent_ipmitool-tinyipa:
@@ -537,6 +623,9 @@
     gate:
       jobs:
         - devstack
+        - devstack-xenial
+        - devstack-multinode
+        - devstack-multinode-xenial
         - devstack-unit-tests
         - openstack-tox-bashate
         - neutron-grenade-multinode:

From 3492feeedda7accb58a179c64932d4b6d154473a Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Fri, 30 Nov 2018 13:57:17 +0000
Subject: [PATCH 1434/2409] Use trueorfalse for NEUTRON_DEPLOY_MOD_WSGI

Current code assumes the variable is being set to either "True" or
"False", which will lead to weird errors if it is being set to something
like "true" instead.

Change-Id: I88983c9150efad882cd867c2d14d86ba6b2522c9
---
 lib/neutron        | 2 +-
 lib/neutron-legacy | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 4847e87f2f..5ef9280981 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -33,7 +33,7 @@ GITDIR["python-neutronclient"]=$DEST/python-neutronclient
 # - True : Run neutron under uwsgi
 # TODO(annp): Switching to uwsgi in next cycle if things turn out to be stable
 # enough
-NEUTRON_DEPLOY_MOD_WSGI=${NEUTRON_DEPLOY_MOD_WSGI:-False}
+NEUTRON_DEPLOY_MOD_WSGI=$(trueorfalse False NEUTRON_DEPLOY_MOD_WSGI)
 NEUTRON_AGENT=${NEUTRON_AGENT:-openvswitch}
 NEUTRON_DIR=$DEST/neutron
 NEUTRON_AUTH_CACHE_DIR=${NEUTRON_AUTH_CACHE_DIR:-/var/cache/neutron}
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index be5b73ffa6..9513667dfe 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -91,7 +91,7 @@ export NEUTRON_TEST_CONFIG_FILE=${NEUTRON_TEST_CONFIG_FILE:-"$NEUTRON_CONF_DIR/d
 # - True : Run neutron under uwsgi
 # TODO(annp): Switching to uwsgi in next cycle if things turn out to be stable
 # enough
-NEUTRON_DEPLOY_MOD_WSGI=${NEUTRON_DEPLOY_MOD_WSGI:-False}
+NEUTRON_DEPLOY_MOD_WSGI=$(trueorfalse False NEUTRON_DEPLOY_MOD_WSGI)
 
 NEUTRON_UWSGI_CONF=$NEUTRON_CONF_DIR/neutron-api-uwsgi.ini
 

From 0137703825ea5f493e7486e19c2d83b328ca2998 Mon Sep 17 00:00:00 2001
From: Tim Burke <tim.burke@gmail.com>
Date: Fri, 30 Nov 2018 14:40:12 -0800
Subject: [PATCH 1435/2409] Allow IP-based subject alt names

... even when no other subject alt names provided

Previously, a non-voting job in barbican's gate would fail with something like

  X509 V3 routines:X509V3_parse_list:invalid null name:v3_utl.c:319:
  X509 V3 routines:DO_EXT_NCONF:invalid extension string:v3_conf.c:140:name=subjectAltName,section=DNS:pykmip-server,,IP:198.72.124.103
  X509 V3 routines:X509V3_EXT_nconf:error in extension:v3_conf.c:95:name=subjectAltName, value=DNS:pykmip-server,,IP:198.72.124.103

because we'd have an invalid empty string.

Change-Id: I5459b8976539924cd6cc6c1e681b6753a76b804c
---
 lib/tls | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/lib/tls b/lib/tls
index 217f40e3a5..9b55099e43 100644
--- a/lib/tls
+++ b/lib/tls
@@ -252,7 +252,11 @@ function make_cert {
 
     if [ "$common_name" != "$SERVICE_HOST" ]; then
         if is_ipv4_address "$SERVICE_HOST" ; then
-            alt_names="$alt_names,IP:$SERVICE_HOST"
+            if [[ -z "$alt_names" ]]; then
+                alt_names="IP:$SERVICE_HOST"
+            else
+                alt_names="$alt_names,IP:$SERVICE_HOST"
+            fi
         fi
     fi
 

From d1fe5ad507c6dcb6955d66fab0b6bc9fb59a80f2 Mon Sep 17 00:00:00 2001
From: qingszhao <zhao.daqing@99cloud.net>
Date: Tue, 4 Dec 2018 13:03:28 +0000
Subject: [PATCH 1436/2409] Change openstack-dev to openstack-discuss

Mailinglists have been updated. Openstack-discuss replaces openstack-dev.

Change-Id: Id639a45680b149ca1ffe8e91fcdea713576b355d
---
 setup.cfg | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/setup.cfg b/setup.cfg
index fcd2b13f41..825d386026 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -4,7 +4,7 @@ summary = OpenStack DevStack
 description-file =
     README.rst
 author = OpenStack
-author-email = openstack-dev@lists.openstack.org
+author-email = openstack-discuss@lists.openstack.org
 home-page = https://docs.openstack.org/devstack/latest
 classifier =
     Intended Audience :: Developers

From d2a927264aa71e3103a9b265f1e0d9911fd4653e Mon Sep 17 00:00:00 2001
From: Carlos Goncalves <cgoncalves@redhat.com>
Date: Tue, 4 Dec 2018 21:59:55 +0100
Subject: [PATCH 1437/2409] Enable the SCL repository for CentOS

Enable the Software Collections (SCL) repository for CentOS. This
repository includes useful software (e.g. the Go Toolset) which is not
present in the main repository.

For example, Octavia uses a Go based testing tool and its CentOS-based
jobs got broken now with the update to CentOS 7.6 which no longer
provides golang.

Change-Id: Ic68a6d6cd7da41510e624b6bea7976d9a960af98
---
 stack.sh | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/stack.sh b/stack.sh
index 497c8bc479..144c233f05 100755
--- a/stack.sh
+++ b/stack.sh
@@ -335,6 +335,13 @@ function _install_rdo {
     # no-op on other platforms.
     sudo yum-config-manager --enable rhel-7-server-optional-rpms
 
+    # Enable the Software Collections (SCL) repository for CentOS.
+    # This repository includes useful software (e.g. the Go Toolset)
+    # which is not present in the main repository.
+    if [[ "$os_VENDOR" =~ (CentOS) ]]; then
+        yum_install centos-release-scl
+    fi
+
     if is_oraclelinux; then
         sudo yum-config-manager --enable ol7_optional_latest ol7_addons ol7_MySQL56
     fi

From 14a22dff3429b9bf237dcd6d92572f2e53b76d9a Mon Sep 17 00:00:00 2001
From: ghanshyam <gmann@ghanshyammann.com>
Date: Thu, 6 Dec 2018 10:23:51 +0000
Subject: [PATCH 1438/2409] Fix README for rolevar name
 'devstack_sources_branch'

This commit fixes the name of role in README file
- https://review.openstack.org/#/c/549517

Change-Id: I0b7ada56339e5e3ff461c2b62e27f226720bb52f
---
 roles/setup-devstack-source-dirs/README.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roles/setup-devstack-source-dirs/README.rst b/roles/setup-devstack-source-dirs/README.rst
index 4129eae383..49d22c3c64 100644
--- a/roles/setup-devstack-source-dirs/README.rst
+++ b/roles/setup-devstack-source-dirs/README.rst
@@ -10,7 +10,7 @@ into it.
 
    The devstack base directory.
 
- .. zuul:rolevar:: devstack_branch
+ .. zuul:rolevar:: devstack_sources_branch
     :default: None
 
     The target branch to be setup (where available).

From 5a9e32afeb723dac3f0111b96cea7da77cdc722e Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Fri, 7 Dec 2018 10:26:18 -0500
Subject: [PATCH 1439/2409] Update comment about nova-cells-v1 job

Nova is moving nova-cells-v1 to its experimental
queue set of jobs so the comment in devstack should
be updated.

Depends-On: https://review.openstack.org/623538

Change-Id: Iefbaa9b809d1426640cbd47a42213f28c9ec5ff3
Related-Bug: #1807407
---
 .zuul.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 21d1a97046..4f91b5b997 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -557,7 +557,7 @@
     # pruned.
     #
     # * nova-cells-v1: maintained by nova for cells v1 (nova-cells service);
-    #    nova gates on this job, it's in experimental for testing cells v1
+    #    it's in experimental here (and in nova) for testing cells v1
     #    changes to devstack w/o gating on it for all devstack changes.
     # * nova-next: maintained by nova for unreleased/undefaulted
     #    things like cellsv2 and placement-api

From e344c97c0eb93e1d96ca8ebe250bb08d227ef5ac Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Fri, 7 Dec 2018 14:49:15 -0800
Subject: [PATCH 1440/2409] Set apache proxy-initial-not-pooled env var

We've run into what appears to be a race with apache trying to reuse a
pooled connection to a backend when that pool connection is closing.
This leads to errors like:

  [Fri Dec 07 21:44:10.752362 2018] [proxy_http:error] [pid 19073:tid 139654393218816] (20014)Internal error (specific information not available): [client 104.130.127.213:45408] AH01102: error reading status line from remote server 127.0.0.1:60999
  [Fri Dec 07 21:44:10.752405 2018] [proxy:error] [pid 19073:tid 139654393218816] [client 104.130.127.213:45408] AH00898: Error reading from remote server returned by /image/v2/images/ec31a4fd-e22b-4e97-8c6c-1ef330823fc1/file

According to the internets this can be addressed (at the cost of some
performance) by setting the proxy-initial-not-pooled env var for mod
proxy. From the mod_proxy docs:

  If this variable is set, no pooled connection will be reused if the client
  request is the initial request on the frontend connection. This avoids the
  "proxy: error reading status line from remote server" error message caused
  by the race condition that the backend server closed the pooled connection
  after the connection check by the proxy and before data sent by the proxy
  reached the backend. It has to be kept in mind that setting this variable
  downgrades performance, especially with HTTP/1.0 clients.

Closes-Bug: #1807518

Change-Id: I374deddefaa033de858b7bc15f893bf731ad7ff2
---
 lib/tls | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/tls b/lib/tls
index 217f40e3a5..0032449e13 100644
--- a/lib/tls
+++ b/lib/tls
@@ -547,6 +547,9 @@ $listen_string
     LimitRequestFieldSize $f_header_size
     RequestHeader set X-Forwarded-Proto "https"
 
+    # Avoid races (at the cost of performance) to re-use a pooled connection
+    # where the connection is closed (bug 1807518).
+    SetEnv proxy-initial-not-pooled
     <Location />
         ProxyPass http://$b_host:$b_port/ retry=0 nocanon
         ProxyPassReverse http://$b_host:$b_port/

From 2dad33b4ba43c30b5c06bd52248fcdd49aeb2ad5 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Tue, 11 Dec 2018 06:11:25 +0000
Subject: [PATCH 1441/2409] Updated from generate-devstack-plugins-list

Change-Id: Ia5998eaec8f470ec584079f4639a84b2bf1430e1
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 7ed24638fd..02d6911d4b 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -180,6 +180,7 @@ tap-as-a-service                       `git://git.openstack.org/openstack/tap-as
 tap-as-a-service-dashboard             `git://git.openstack.org/openstack/tap-as-a-service-dashboard <https://git.openstack.org/cgit/openstack/tap-as-a-service-dashboard>`__
 tatu                                   `git://git.openstack.org/openstack/tatu <https://git.openstack.org/cgit/openstack/tatu>`__
 telemetry-tempest-plugin               `git://git.openstack.org/openstack/telemetry-tempest-plugin <https://git.openstack.org/cgit/openstack/telemetry-tempest-plugin>`__
+tobiko                                 `git://git.openstack.org/openstack/tobiko <https://git.openstack.org/cgit/openstack/tobiko>`__
 tricircle                              `git://git.openstack.org/openstack/tricircle <https://git.openstack.org/cgit/openstack/tricircle>`__
 trio2o                                 `git://git.openstack.org/openstack/trio2o <https://git.openstack.org/cgit/openstack/trio2o>`__
 trove                                  `git://git.openstack.org/openstack/trove <https://git.openstack.org/cgit/openstack/trove>`__

From 0ce6ae813707678541697b2ffe24056f0f8e26b7 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Tue, 21 Nov 2017 11:55:57 +0000
Subject: [PATCH 1442/2409] Update cirros version

This is the next release in the 0.3.x stable series, containing a fix
for getting out of disk errors when cirros reads metadata from a
config-drive[0].

[0] https://bugs.launchpad.net/cirros/+bug/1808119

Change-Id: Id2f20ebafdd78c2dadf81b8f80f22e7bd6db7755
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index ffe405012d..d520f2f2e9 100644
--- a/stackrc
+++ b/stackrc
@@ -668,7 +668,7 @@ ENABLE_UBUNTU_CLOUD_ARCHIVE=$(trueorfalse True ENABLE_UBUNTU_CLOUD_ARCHIVE)
 #IMAGE_URLS="http://smoser.brickies.net/ubuntu/ttylinux-uec/ttylinux-uec-amd64-11.2_2.6.35-15_1.tar.gz" # old ttylinux-uec image
 #IMAGE_URLS="http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img" # cirros full disk image
 
-CIRROS_VERSION=${CIRROS_VERSION:-"0.3.5"}
+CIRROS_VERSION=${CIRROS_VERSION:-"0.3.6"}
 CIRROS_ARCH=${CIRROS_ARCH:-"x86_64"}
 
 # Set default image based on ``VIRT_DRIVER`` and ``LIBVIRT_TYPE``, either of

From 584979ce2eeb0c2e590a996657e601bfd5543eee Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Thu, 13 Dec 2018 08:22:12 -0500
Subject: [PATCH 1443/2409] docs: cleanup install docs

This does a few things to the home page and all-in-one single
machine install guide:

* Uses code blocks for formatting
* Adds the customary "$" to the console blocks in the
  all-in-one single machine install guide
* Instructs to use "sudo su stack" and adds a note about
  "sudo visudo" in the all-in-one single machine doc
* Creates a symbolic link to the sample local.conf and links to
  it from the install guide (note that local.conf might be old
  by now)
* Fixes the .gitignore file to only ignore local.conf in the root
  of the repository, otherwise it would ignore local.conf everywhere
  including the samples and doc/source/assets directories.

Change-Id: I50ae7bd32c4c1caa2ac8551fc54b31dd2dfae568
---
 .gitignore                           |  2 +-
 doc/source/assets/local.conf         |  1 +
 doc/source/guides/single-machine.rst | 35 +++++++++++++++++-----------
 doc/source/index.rst                 | 16 ++++++++-----
 4 files changed, 34 insertions(+), 20 deletions(-)
 create mode 120000 doc/source/assets/local.conf

diff --git a/.gitignore b/.gitignore
index e5e1f6aba0..956e13e21c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -28,7 +28,7 @@ files/get-pip.py*
 files/ir-deploy*
 files/ironic-inspector*
 files/etcd*
-local.conf
+^local.conf
 local.sh
 localrc
 proto
diff --git a/doc/source/assets/local.conf b/doc/source/assets/local.conf
new file mode 120000
index 0000000000..cfc2a4e9d8
--- /dev/null
+++ b/doc/source/assets/local.conf
@@ -0,0 +1 @@
+../../../samples/local.conf
\ No newline at end of file
diff --git a/doc/source/guides/single-machine.rst b/doc/source/guides/single-machine.rst
index 515ea9a9ee..168172c630 100644
--- a/doc/source/guides/single-machine.rst
+++ b/doc/source/guides/single-machine.rst
@@ -45,31 +45,37 @@ We need to add a user to install DevStack. (if you created a user during
 install you can skip this step and just give the user sudo privileges
 below)
 
-::
+.. code-block:: console
 
-    useradd -s /bin/bash -d /opt/stack -m stack
+    $ sudo useradd -s /bin/bash -d /opt/stack -m stack
 
 Since this user will be making many changes to your system, it will need
 to have sudo privileges:
 
-::
+.. code-block:: console
 
-    apt-get install sudo -y || yum install -y sudo
-    echo "stack ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers
+    $ apt-get install sudo -y || yum install -y sudo
+    $ echo "stack ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers
+
+.. note:: On some systems you may need to use ``sudo visudo``.
 
 From here on you should use the user you created. **Logout** and
-**login** as that user.
+**login** as that user:
+
+.. code-block:: console
+
+    $ sudo su stack && cd ~
 
 Download DevStack
 -----------------
 
 We'll grab the latest version of DevStack via https:
 
-::
+.. code-block:: console
 
-    sudo apt-get install git -y || sudo yum install -y git
-    git clone https://git.openstack.org/openstack-dev/devstack
-    cd devstack
+    $ sudo apt-get install git -y || sudo yum install -y git
+    $ git clone https://git.openstack.org/openstack-dev/devstack
+    $ cd devstack
 
 Run DevStack
 ------------
@@ -97,7 +103,7 @@ do the following:
 
 ``local.conf`` should look something like this:
 
-::
+.. code-block:: ini
 
     [[local|localrc]]
     FLOATING_RANGE=192.168.1.224/27
@@ -109,11 +115,14 @@ do the following:
     RABBIT_PASSWORD=flopsymopsy
     SERVICE_PASSWORD=iheartksl
 
+.. note:: There is a sample :download:`local.conf </assets/local.conf>` file
+    under the *samples* directory in the devstack repository.
+
 Run DevStack:
 
-::
+.. code-block:: console
 
-    ./stack.sh
+    $ ./stack.sh
 
 A seemingly endless stream of activity ensues. When complete you will
 see a summary of ``stack.sh``'s work, including the relevant URLs,
diff --git a/doc/source/index.rst b/doc/source/index.rst
index fcf1e82d34..6c42a5b4e9 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -55,14 +55,14 @@ are usually fine).
 
 You can quickly create a separate `stack` user to run DevStack with
 
-::
+.. code-block:: console
 
    $ sudo useradd -s /bin/bash -d /opt/stack -m stack
 
 Since this user will be making many changes to your system, it should
 have sudo privileges:
 
-::
+.. code-block:: console
 
     $ echo "stack ALL=(ALL) NOPASSWD: ALL" | sudo tee /etc/sudoers.d/stack
     $ sudo su - stack
@@ -70,7 +70,7 @@ have sudo privileges:
 Download DevStack
 -----------------
 
-::
+.. code-block:: console
 
    $ git clone https://git.openstack.org/openstack-dev/devstack
    $ cd devstack
@@ -83,7 +83,8 @@ Create a local.conf
 
 Create a ``local.conf`` file with 4 passwords preset at the root of the
 devstack git repo.
-::
+
+.. code-block:: ini
 
    [[local|localrc]]
    ADMIN_PASSWORD=secret
@@ -93,12 +94,15 @@ devstack git repo.
 
 This is the minimum required config to get started with DevStack.
 
+.. note:: There is a sample :download:`local.conf </assets/local.conf>` file
+    under the *samples* directory in the devstack repository.
+
 Start the install
 -----------------
 
-::
+.. code-block:: console
 
-   ./stack.sh
+   $ ./stack.sh
 
 This will take a 15 - 20 minutes, largely depending on the speed of
 your internet connection. Many git trees and packages will be

From e0b375c8ce77ca256d108b2c558d57e17efab4f7 Mon Sep 17 00:00:00 2001
From: Akihiro Motoki <amotoki@gmail.com>
Date: Fri, 14 Dec 2018 17:29:27 +0900
Subject: [PATCH 1444/2409] Use volume v3 API in clouds.yaml by default

Volume API v2 has been deprecated for a long time.
There is no reason to use volume v2 in clouds.yaml by default.

This commit also drops "--os-identity-api-version 3" from
write_clouds_yaml in functions -common as "3" is the default value
of tools/update_clouds_yaml.py. They are hardcoded in DevStack
so there is no reason to pass it.

Change-Id: Ie84026a3d19f7711fc781b7012355096c7ff6b5a
---
 functions-common            | 3 ---
 tools/update_clouds_yaml.py | 2 +-
 2 files changed, 1 insertion(+), 4 deletions(-)

diff --git a/functions-common b/functions-common
index af95bfb879..9be1513b5d 100644
--- a/functions-common
+++ b/functions-common
@@ -92,7 +92,6 @@ function write_clouds_yaml {
         --file $CLOUDS_YAML \
         --os-cloud devstack \
         --os-region-name $REGION_NAME \
-        --os-identity-api-version 3 \
         $CA_CERT_ARG \
         --os-auth-url $KEYSTONE_SERVICE_URI \
         --os-username demo \
@@ -104,7 +103,6 @@ function write_clouds_yaml {
         --file $CLOUDS_YAML \
         --os-cloud devstack-alt \
         --os-region-name $REGION_NAME \
-        --os-identity-api-version 3 \
         $CA_CERT_ARG \
         --os-auth-url $KEYSTONE_SERVICE_URI \
         --os-username alt_demo \
@@ -116,7 +114,6 @@ function write_clouds_yaml {
         --file $CLOUDS_YAML \
         --os-cloud devstack-admin \
         --os-region-name $REGION_NAME \
-        --os-identity-api-version 3 \
         $CA_CERT_ARG \
         --os-auth-url $KEYSTONE_SERVICE_URI \
         --os-username admin \
diff --git a/tools/update_clouds_yaml.py b/tools/update_clouds_yaml.py
index eb7265f76c..3aad0e0a29 100755
--- a/tools/update_clouds_yaml.py
+++ b/tools/update_clouds_yaml.py
@@ -83,7 +83,7 @@ def main():
     parser.add_argument('--os-cloud', required=True)
     parser.add_argument('--os-region-name', default='RegionOne')
     parser.add_argument('--os-identity-api-version', default='3')
-    parser.add_argument('--os-volume-api-version', default='2')
+    parser.add_argument('--os-volume-api-version', default='3')
     parser.add_argument('--os-cacert')
     parser.add_argument('--os-auth-url', required=True)
     parser.add_argument('--os-username', required=True)

From 93a94f503b058a1452cc8b1eef389cbec5975863 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Fri, 14 Dec 2018 06:39:59 -0800
Subject: [PATCH 1445/2409] Enable direct-io on LVM loop devices

This enables direct-io on the loop devices that we create for LVM backing
stores. The goal here is to reduce the buffer cache overhead involved with
loop mounting a very large file on a filesystem, as well as potentially
providing a little more block-device-like behavior for things that expect
them. We are hoping this will address some of the very long LVM calls that
cinder does, which randomly take a very long time, causing timeouts.

The loop direct-io support was added in kernel 4.4.0, which was xenial,
but the losetup binary does not have the required flag. Thus, this patch
checks the "losetup -h" output for the flag before deciding to enable it.

Change-Id: Idc69cf3598d6ed6646c0145733c90ad0b1b60883
---
 lib/lvm | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/lib/lvm b/lib/lvm
index f0471816bf..d9e78a016f 100644
--- a/lib/lvm
+++ b/lib/lvm
@@ -99,8 +99,15 @@ function _create_lvm_volume_group {
     if ! sudo vgs $vg; then
         # Only create if the file doesn't already exists
         [[ -f $backing_file ]] || truncate -s $size $backing_file
+
+        local directio=""
+        # Check to see if we can do direct-io
+        if losetup -h | grep -q direct-io; then
+            directio="--direct-io=on"
+        fi
+
         local vg_dev
-        vg_dev=`sudo losetup -f --show $backing_file`
+        vg_dev=$(sudo losetup -f --show $directio $backing_file)
 
         # Only create volume group if it doesn't already exist
         if ! sudo vgs $vg; then

From 16fe9646486d0b621c7fb2c15ffec0c004508f73 Mon Sep 17 00:00:00 2001
From: Pavlo Shchelokovskyy <shchelokovskyy@gmail.com>
Date: Tue, 18 Dec 2018 09:01:36 +0000
Subject: [PATCH 1446/2409] Ignore local.conf in root of repo

gitignore is not parsing regex, only shell globs,
so '^' has no meaning, and local.conf is being thus tracked.

This patch properly ignores only local.conf in root of repo but still
tracks samples/local.conf and others.

Change-Id: I93ef778f1f3ee8101ce21cce377f7b527b7153f3
---
 .gitignore | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index 956e13e21c..8fe56ad6ab 100644
--- a/.gitignore
+++ b/.gitignore
@@ -28,7 +28,7 @@ files/get-pip.py*
 files/ir-deploy*
 files/ironic-inspector*
 files/etcd*
-^local.conf
+/local.conf
 local.sh
 localrc
 proto

From b3ee6f46153c46e46493f187b3b246e2229ce208 Mon Sep 17 00:00:00 2001
From: Riccardo Pittau <elfosardo@gmail.com>
Date: Tue, 18 Dec 2018 11:19:59 +0100
Subject: [PATCH 1447/2409] Correcting typo in plugins section

Fixing the example of the plugin's name as the last component
of the git repo path should be foo.

Change-Id: I2f12d4d26993ec192517de7f5541c4219ee59ed9
---
 doc/source/plugins.rst | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/source/plugins.rst b/doc/source/plugins.rst
index 89b9381813..c69472955c 100644
--- a/doc/source/plugins.rst
+++ b/doc/source/plugins.rst
@@ -58,7 +58,7 @@ directory. Inside this directory there can be 3 files.
   plugin's name, which is the name that should be used by users on
   "enable_plugin" lines.  It should generally be the last component of
   the git repo path (e.g., if the plugin's repo is
-  openstack/devstack-foo, then the name here should be "foo") ::
+  openstack/foo, then the name here should be "foo") ::
 
     define_plugin <YOUR PLUGIN>
 
@@ -148,7 +148,7 @@ An example plugin would look something as follows.
 
 ``devstack/settings``::
 
-    # settings file for template
+  # settings file for template
   enable_service template
 
 

From dc33485ff28989db389b57a7d1a9bce97259ad12 Mon Sep 17 00:00:00 2001
From: ghanshyam <gmann@ghanshyammann.com>
Date: Wed, 19 Dec 2018 04:23:30 +0000
Subject: [PATCH 1448/2409] Use renamed template 'integrated-gate-py3'

'integrated-gate-py35' template is going to be
renamed to 'integrated-gate-py3' in https://review.openstack.org/#/c/626078/

Integrated jobs are running on Bionic now where python 3.6 is available.
Which means gate jobs in 'integrated-gate-py35' template are
running on python 3.6 not on 3.5 which makes this template name confusing.

depends on commit rename the 'integrated-gate-py35' to 'integrated-gate-py3'
so that it can convey that template will use available python 3 version
in used distro. For example: 3.5 in xenial and 3.6 in bionic and so on.

This commit starts using the new template name so that old
template name can be removed.

Depends-On: https://review.openstack.org/#/c/626078/
Change-Id: I07048817eb826337dd5bd89a97711bb9d43495cf
---
 .zuul.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 9aafcdbb84..02d3df9b9c 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -581,7 +581,7 @@
 - project:
     templates:
       - integrated-gate
-      - integrated-gate-py35
+      - integrated-gate-py3
       - publish-openstack-docs-pti
     check:
       jobs:

From 7bb5fff85c0f7b4131bc669abe99c04391682a91 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Wed, 19 Dec 2018 14:16:41 +1100
Subject: [PATCH 1449/2409] setup-devstack-source-dirs: also copy github
 libraries

This will help us use standard mechanisms to install libraries that
Zuul has cloned from github

Change-Id: I8ecfeeba9133ce175fb72fc59be696879013d927
---
 .../tasks/main.yaml                           | 26 ++++++++++++++++++-
 1 file changed, 25 insertions(+), 1 deletion(-)

diff --git a/roles/setup-devstack-source-dirs/tasks/main.yaml b/roles/setup-devstack-source-dirs/tasks/main.yaml
index c196c37e09..dfa934f68b 100644
--- a/roles/setup-devstack-source-dirs/tasks/main.yaml
+++ b/roles/setup-devstack-source-dirs/tasks/main.yaml
@@ -1,4 +1,4 @@
-- name: Find all source repos used by this job
+- name: Find all OpenStack source repos used by this job
   find:
     paths:
       - src/git.openstack.org/openstack
@@ -12,6 +12,30 @@
   with_items: '{{ found_repos.files }}'
   become: yes
 
+# Github projects are github.com/username/repo (username might be a
+# top-level project too), so we have to do a two-step swizzle to just
+# get the full repo path (ansible's find module doesn't help with this
+# :/)
+- name: Find top level github projects
+  find:
+    paths:
+      - src/github.com
+    file_type: directory
+  register: found_github_projects
+
+- name: Find actual github repos
+  find:
+    paths: '{{ found_github_projects.files | map(attribute="path") | list }}'
+    file_type: directory
+  register: found_github_repos
+  when: found_github_projects.files
+
+- name: Copy github repos into devstack working directory
+  command: rsync -a {{ item.path }} {{ devstack_base_dir }}
+  with_items: '{{ found_github_repos.files }}'
+  become: yes
+  when: found_github_projects.files
+
 - name: Setup refspec for repos into devstack working directory
   shell:
     # Copied almost "as-is" from devstack-gate setup-workspace function

From 15b6ac98cb932488bce77b267f0f27903f0d47d0 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Tue, 21 Nov 2017 11:55:57 +0000
Subject: [PATCH 1450/2409] Update default cirros version

Cirros has a new release 0.4.0, which fixes a couple of issues.

Change-Id: I419348f1784600e3989c8e86a99c04b24f3610c4
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 8463313625..4b94386521 100644
--- a/stackrc
+++ b/stackrc
@@ -685,7 +685,7 @@ ENABLE_UBUNTU_CLOUD_ARCHIVE=$(trueorfalse True ENABLE_UBUNTU_CLOUD_ARCHIVE)
 #IMAGE_URLS="http://smoser.brickies.net/ubuntu/ttylinux-uec/ttylinux-uec-amd64-11.2_2.6.35-15_1.tar.gz" # old ttylinux-uec image
 #IMAGE_URLS="http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img" # cirros full disk image
 
-CIRROS_VERSION=${CIRROS_VERSION:-"0.3.6"}
+CIRROS_VERSION=${CIRROS_VERSION:-"0.4.0"}
 CIRROS_ARCH=${CIRROS_ARCH:-"x86_64"}
 
 # Set default image based on ``VIRT_DRIVER`` and ``LIBVIRT_TYPE``, either of

From 6a7e3ec6479097f4918eb66d25b52cfa46953dec Mon Sep 17 00:00:00 2001
From: npraveen35 <npraveen35@gmail.com>
Date: Thu, 20 Dec 2018 18:25:36 +0530
Subject: [PATCH 1451/2409] typo fixed

Change-Id: Id777576d8876d7ba257f0243f3b4ce5756dd9b58
---
 clean.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/clean.sh b/clean.sh
index a29ebd94f0..d6c6b40608 100755
--- a/clean.sh
+++ b/clean.sh
@@ -123,7 +123,7 @@ if [[ -n "$LOGDIR" ]] && [[ -d "$LOGDIR" ]]; then
     sudo rm -rf $LOGDIR
 fi
 
-# Clean out the sytemd user unit files if systemd was used.
+# Clean out the systemd user unit files if systemd was used.
 if [[ "$USE_SYSTEMD" = "True" ]]; then
     sudo find $SYSTEMD_DIR -type f -name '*devstack@*service' -delete
     # Make systemd aware of the deletion.

From 119ee66cded7d6e1ed04419a00e59c269eea1c54 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20Dulko?= <mdulko@redhat.com>
Date: Thu, 20 Dec 2018 18:55:29 +0100
Subject: [PATCH 1452/2409] Log debug on etcd if $ENABLE_DEBUG_LOG_LEVEL is on

Change-Id: I452a2e4882377d165e3c28fcec18e237e45db8a4
---
 lib/etcd3 | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/etcd3 b/lib/etcd3
index 26d07fd19e..c65a522267 100644
--- a/lib/etcd3
+++ b/lib/etcd3
@@ -46,6 +46,9 @@ function start_etcd3 {
         cmd+=" --listen-peer-urls http://0.0.0.0:$ETCD_PEER_PORT "
     fi
     cmd+=" --listen-client-urls http://$SERVICE_HOST:$ETCD_PORT"
+    if [ "$ENABLE_DEBUG_LOG_LEVEL" == "True" ]; then
+        cmd+=" --debug"
+    fi
 
     local unitfile="$SYSTEMD_DIR/$ETCD_SYSTEMD_SERVICE"
     write_user_unit_file $ETCD_SYSTEMD_SERVICE "$cmd" "" "root"

From 8e802da4069349a2f6ccdef348999304669a6cbe Mon Sep 17 00:00:00 2001
From: Lance Bragstad <lbragstad@gmail.com>
Date: Fri, 4 Jan 2019 15:21:43 +0000
Subject: [PATCH 1453/2409] Cleanup LDAP integration guide

This commit fixes a grammar issue in the LDAP integration guide
and it adds prompts to the command-line examples to be more
explicit about where or how commands are being run.

Change-Id: Ic6a5adfbcf2841656929e6c3875889a31d314089
---
 doc/source/guides/devstack-with-ldap.rst | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/doc/source/guides/devstack-with-ldap.rst b/doc/source/guides/devstack-with-ldap.rst
index ec411419b5..4c54723c71 100644
--- a/doc/source/guides/devstack-with-ldap.rst
+++ b/doc/source/guides/devstack-with-ldap.rst
@@ -12,14 +12,14 @@ Introduction
 LDAP support in keystone is read-only. You can use it to back an entire
 OpenStack deployment to a single LDAP server, or you can use it to back
 separate LDAP servers to specific keystone domains. Users within those domains
-will can authenticate against keystone, assume role assignments, and interact
-with other OpenStack services.
+can authenticate against keystone, assume role assignments, and interact with
+other OpenStack services.
 
 Configuration
 =============
 
 To deploy an OpenLDAP server, make sure ``ldap`` is added to the list of
-``ENABLED_SERVICES``::
+``ENABLED_SERVICES`` in the ``local.conf`` file::
 
     enable_service ldap
 
@@ -35,9 +35,9 @@ Devstack will prompt you for a password when running ``stack.sh`` if
 
 At this point, devstack should have everything it needs to deploy OpenLDAP,
 bootstrap it with a minimal set of users, and configure it to back to a domain
-in keystone::
+in keystone. You can do this by running the ``stack.sh`` script::
 
-    ./stack.sh
+    $ ./stack.sh
 
 Once ``stack.sh`` completes, you should have a running keystone deployment with
 a basic set of users. It is important to note that not all users will live
@@ -63,7 +63,7 @@ Listing Users
 To list all users in LDAP directly, you can use ``ldapsearch`` with the LDAP
 user bootstrapped by devstack::
 
-    ldapsearch -x -w LDAP_PASSWORD -D cn=Manager,dc=openstack,dc=org \
+    $ ldapsearch -x -w LDAP_PASSWORD -D cn=Manager,dc=openstack,dc=org \
         -H ldap://localhost -b dc=openstack,dc=org
 
 As you can see, devstack creates an OpenStack domain called ``openstack.org``
@@ -93,7 +93,7 @@ example LDIF that can be used to create a new LDAP user, let's call it
 
 Now, we use the ``Manager`` user to create a user for Peter in LDAP::
 
-    ldapadd -x -w LDAP_PASSWORD -D cn=Manager,dc=openstack,dc=org \
+    $ ldapadd -x -w LDAP_PASSWORD -D cn=Manager,dc=openstack,dc=org \
         -H ldap://localhost -c -f peter.ldif.in
 
 We should be able to assign Peter roles on projects. After Peter has some level
@@ -125,7 +125,7 @@ Deleting Users
 We can use the same basic steps to remove users from LDAP, but instead of using
 LDIFs, we can just pass the ``dn`` of the user we want to delete::
 
-    ldapdelete -x -w LDAP_PASSWORD -D cn=Manager,dc=openstack,dc=org \
+    $ ldapdelete -x -w LDAP_PASSWORD -D cn=Manager,dc=openstack,dc=org \
         -H ldap://localhost cn=peter,ou=Users,dc=openstack,dc=org
 
 Group Management
@@ -153,7 +153,7 @@ Let's define a specific group with the following LDIF::
 We can create the group using the same ``ldapadd`` command as we did with
 users::
 
-    ldapadd -x -w LDAP_PASSWORD -D cn=Manager,dc=openstack,dc=org \
+    $ ldapadd -x -w LDAP_PASSWORD -D cn=Manager,dc=openstack,dc=org \
         -H ldap://localhost -c -f guardian-group.ldif.in
 
 If we check the group membership in Horizon, we'll see that only Peter is a
@@ -167,7 +167,7 @@ Deleting Groups
 
 Just like users, groups can be deleted using the ``dn``::
 
-    ldapdelete -x -w LDAP_PASSWORD -D cn=Manager,dc=openstack,dc=org \
+    $ ldapdelete -x -w LDAP_PASSWORD -D cn=Manager,dc=openstack,dc=org \
         -H ldap://localhost cn=guardians,ou=UserGroups,dc=openstack,dc=org
 
 Note that this operation will not remove users within that group. It will only

From 5d7d891380f569deaf403aae46a9354eb0243999 Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Mon, 3 Dec 2018 14:21:06 +0000
Subject: [PATCH 1454/2409] Drop the deprecated and now removed barrier XFS
 mount options

Both barrier and nobarrier were deprecated with the 4.10 kernel [1] and
then removed [2] with the 4.19 kernel as now used by Fedora >= 28. Both
should be safe to drop at this point.

[1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4cf4573
[2] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1c02d50

Change-Id: I6871a7765e3e04122d8d546f43d36bb8415383fc
---
 functions | 2 +-
 lib/swift | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/functions b/functions
index 051c8160f7..187ad2311d 100644
--- a/functions
+++ b/functions
@@ -739,7 +739,7 @@ function create_disk {
 
     # Mount the disk with mount options to make it as efficient as possible
     if ! egrep -q ${storage_data_dir} /proc/mounts; then
-        sudo mount -t xfs -o loop,noatime,nodiratime,nobarrier,logbufs=8  \
+        sudo mount -t xfs -o loop,noatime,nodiratime,logbufs=8  \
             ${disk_image} ${storage_data_dir}
     fi
 }
diff --git a/lib/swift b/lib/swift
index 3b3e608e80..e2ee0cb470 100644
--- a/lib/swift
+++ b/lib/swift
@@ -607,7 +607,7 @@ function create_swift_disk {
     # Mount the disk with mount options to make it as efficient as possible
     mkdir -p ${SWIFT_DATA_DIR}/drives/sdb1
     if ! egrep -q ${SWIFT_DATA_DIR}/drives/sdb1 /proc/mounts; then
-        sudo mount -t xfs -o loop,noatime,nodiratime,nobarrier,logbufs=8  \
+        sudo mount -t xfs -o loop,noatime,nodiratime,logbufs=8  \
             ${SWIFT_DISK_IMAGE} ${SWIFT_DATA_DIR}/drives/sdb1
     fi
 

From 77866259e4204eb08afd55e8a29994ad49c58e0b Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Fri, 7 Dec 2018 18:52:16 +0000
Subject: [PATCH 1455/2409] Update supported Fedora releases

Fedora 27 has now hit EOL [1] while Fedora 29 has been released [2].

[1] https://fedoramagazine.org/fedora-27-end-of-life/
[2] https://fedoramagazine.org/announcing-fedora-29/

Change-Id: I12e287e36f01581f1c7145545ab05be527ed15c6
---
 stack.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index 144c233f05..54a4f985bd 100755
--- a/stack.sh
+++ b/stack.sh
@@ -221,7 +221,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (xenial|artful|bionic|stretch|jessie|f27|f28|opensuse-42.3|opensuse-15.0|opensuse-tumbleweed|rhel7) ]]; then
+if [[ ! ${DISTRO} =~ (xenial|artful|bionic|stretch|jessie|f28|f29|opensuse-42.3|opensuse-15.0|opensuse-tumbleweed|rhel7) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From 5690582073756bdc156550b90a8e284a8d4e0e5f Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Tue, 8 Jan 2019 15:29:16 +0000
Subject: [PATCH 1456/2409] Add devstack-system-admin for system scoped actions

Keystone is moving more things to require a system scoped token to
work. Getting one of those requires that domain and project information
are not set.

Change-Id: I2e1640e9f9ef6cdf56bef49d1ae8f0591570c3e6
---
 functions-common            | 11 +++++++++++
 tools/update_clouds_yaml.py | 14 +++++++++++---
 2 files changed, 22 insertions(+), 3 deletions(-)

diff --git a/functions-common b/functions-common
index 9be1513b5d..e5962db42b 100644
--- a/functions-common
+++ b/functions-common
@@ -120,6 +120,17 @@ function write_clouds_yaml {
         --os-password $ADMIN_PASSWORD \
         --os-project-name admin
 
+    # admin with a system-scoped token -> devstack-system
+    $PYTHON $TOP_DIR/tools/update_clouds_yaml.py \
+        --file $CLOUDS_YAML \
+        --os-cloud devstack-system-admin \
+        --os-region-name $REGION_NAME \
+        $CA_CERT_ARG \
+        --os-auth-url $KEYSTONE_SERVICE_URI \
+        --os-username admin \
+        --os-password $ADMIN_PASSWORD \
+        --os-system-scope all
+
     # CLean up any old clouds.yaml files we had laying around
     rm -f $(eval echo ~"$STACK_USER")/.config/openstack/clouds.yaml
 }
diff --git a/tools/update_clouds_yaml.py b/tools/update_clouds_yaml.py
index 3aad0e0a29..9187c664d0 100755
--- a/tools/update_clouds_yaml.py
+++ b/tools/update_clouds_yaml.py
@@ -41,12 +41,19 @@ def __init__(self, args):
                 'auth_url': args.os_auth_url,
                 'username': args.os_username,
                 'password': args.os_password,
-                'project_name': args.os_project_name,
             },
         }
-        if args.os_identity_api_version == '3':
+        if args.os_project_name and args.os_system_scope:
+            print(
+                "WARNING: os_project_name and os_system_scope were both"
+                " given. os_system_scope will take priority.")
+        if args.os_project_name and not args.os_system_scope:
+            self._cloud_data['auth']['project_name'] = args.os_project_name
+        if args.os_identity_api_version == '3' and not args.os_system_scope:
             self._cloud_data['auth']['user_domain_id'] = 'default'
             self._cloud_data['auth']['project_domain_id'] = 'default'
+        if args.os_system_scope:
+            self._cloud_data['auth']['system_scope'] = args.os_system_scope
         if args.os_cacert:
             self._cloud_data['cacert'] = args.os_cacert
 
@@ -88,7 +95,8 @@ def main():
     parser.add_argument('--os-auth-url', required=True)
     parser.add_argument('--os-username', required=True)
     parser.add_argument('--os-password', required=True)
-    parser.add_argument('--os-project-name', required=True)
+    parser.add_argument('--os-project-name')
+    parser.add_argument('--os-system-scope')
 
     args = parser.parse_args()
 

From 6d103a7ff845076da984afbd317cd8cf4504fb7a Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Wed, 19 Dec 2018 11:53:16 +0000
Subject: [PATCH 1457/2409] Fix testing for the write-devstack-local-conf role

The test_plugin_deps function in the test code for the
write-devstack-local-conf role was missing the import part of actually
executing the code under test and asserting the expected result.

Change-Id: I125870b13d2581cdec0dede11157b19b702565cd
---
 roles/write-devstack-local-conf/library/test.py | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/roles/write-devstack-local-conf/library/test.py b/roles/write-devstack-local-conf/library/test.py
index 791552d1ad..65d327b267 100644
--- a/roles/write-devstack-local-conf/library/test.py
+++ b/roles/write-devstack-local-conf/library/test.py
@@ -104,6 +104,22 @@ def test_plugin_deps(self):
                  plugins=plugins,
                  base_dir=self.tmpdir,
                  path=os.path.join(self.tmpdir, 'test.local.conf'))
+        lc = LocalConf(p.get('localrc'),
+                       p.get('local_conf'),
+                       p.get('base_services'),
+                       p.get('services'),
+                       p.get('plugins'),
+                       p.get('base_dir'),
+                       p.get('projects'),
+                       p.get('project'))
+        lc.write(p['path'])
+
+        plugins = []
+        with open(p['path']) as f:
+            for line in f:
+                if line.startswith('enable_plugin'):
+                    plugins.append(line.split()[1])
+        self.assertEqual(['foo', 'bar'], plugins)
 
     def test_libs_from_git(self):
         "Test that LIBS_FROM_GIT is auto-generated"

From 0b855007f8d44662ad4fd52bda7df85f94b241c2 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Wed, 19 Dec 2018 12:20:51 +0000
Subject: [PATCH 1458/2409] Allow plugin names to contain non-letter characters

There are already devstack plugins that contain a hyphen in the name,
like `networking-baremetal`. In order to allow ordering for these to
work properly, amend the regexes we are using to match any
non-whitespace characters instead of only alphanumerics.

Amend the test to cover this use case.

Change-Id: I91093a424f8d5e8007f140083e1ea36a81fe849f
Closes-Bug: 1809016
---
 .../library/devstack_local_conf.py                   |  4 ++--
 roles/write-devstack-local-conf/library/test.py      | 12 ++++++------
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/roles/write-devstack-local-conf/library/devstack_local_conf.py b/roles/write-devstack-local-conf/library/devstack_local_conf.py
index bba7e31f96..b1ad2dd4b4 100644
--- a/roles/write-devstack-local-conf/library/devstack_local_conf.py
+++ b/roles/write-devstack-local-conf/library/devstack_local_conf.py
@@ -155,8 +155,8 @@ def loadPluginNames(self, base_dir):
                 continue
             self.loadDevstackPluginInfo(settings)
 
-    define_re = re.compile(r'^define_plugin\s+(\w+).*')
-    require_re = re.compile(r'^plugin_requires\s+(\w+)\s+(\w+).*')
+    define_re = re.compile(r'^define_plugin\s+(\S+).*')
+    require_re = re.compile(r'^plugin_requires\s+(\S+)\s+(\S+).*')
     def loadDevstackPluginInfo(self, fn):
         name = None
         reqs = set()
diff --git a/roles/write-devstack-local-conf/library/test.py b/roles/write-devstack-local-conf/library/test.py
index 65d327b267..88d404b856 100644
--- a/roles/write-devstack-local-conf/library/test.py
+++ b/roles/write-devstack-local-conf/library/test.py
@@ -78,12 +78,12 @@ def test_plugin_deps(self):
         with open(os.path.join(
                 self.tmpdir,
                 'foo-plugin', 'devstack', 'settings'), 'w') as f:
-            f.write('define_plugin foo\n')
+            f.write('define_plugin foo-plugin\n')
         with open(os.path.join(
                 self.tmpdir,
                 'bar-plugin', 'devstack', 'settings'), 'w') as f:
-            f.write('define_plugin bar\n')
-            f.write('plugin_requires bar foo\n')
+            f.write('define_plugin bar-plugin\n')
+            f.write('plugin_requires bar-plugin foo-plugin\n')
 
         localrc = {'test_localrc': '1'}
         local_conf = {'install':
@@ -94,8 +94,8 @@ def test_plugin_deps(self):
         # We use ordereddict here to make sure the plugins are in the
         # *wrong* order for testing.
         plugins = OrderedDict([
-            ('bar', 'git://git.openstack.org/openstack/bar-plugin'),
-            ('foo', 'git://git.openstack.org/openstack/foo-plugin'),
+            ('bar-plugin', 'git://git.openstack.org/openstack/bar-plugin'),
+            ('foo-plugin', 'git://git.openstack.org/openstack/foo-plugin'),
             ])
         p = dict(localrc=localrc,
                  local_conf=local_conf,
@@ -119,7 +119,7 @@ def test_plugin_deps(self):
             for line in f:
                 if line.startswith('enable_plugin'):
                     plugins.append(line.split()[1])
-        self.assertEqual(['foo', 'bar'], plugins)
+        self.assertEqual(['foo-plugin', 'bar-plugin'], plugins)
 
     def test_libs_from_git(self):
         "Test that LIBS_FROM_GIT is auto-generated"

From 36377f63e348200cd091b702c74350062a69fff9 Mon Sep 17 00:00:00 2001
From: Doug Hellmann <doug@doughellmann.com>
Date: Tue, 4 Dec 2018 11:33:03 -0500
Subject: [PATCH 1459/2409] install under python3 by default when enabled

Remove the requirement that services explicitly enable python3 support
in order to be tested under python3 when running with python3
enabled. Keep the enable_python3_package() function for backwards
compatibility, for now, since it is called in some devstack plugins.

Explicitly add swift to the set of packages that should not be installed
using python3 by default until full support is available.

Change-Id: I8ab0a7c242bbf5bf3f091f5a85a98e2f4543f856
Signed-off-by: Doug Hellmann <doug@doughellmann.com>
---
 inc/python           | 39 +++++++++++----------------------------
 stackrc              |  8 +-------
 tests/test_python.sh |  7 +------
 3 files changed, 13 insertions(+), 41 deletions(-)

diff --git a/inc/python b/inc/python
index 5fb7245623..f1df101939 100644
--- a/inc/python
+++ b/inc/python
@@ -115,13 +115,12 @@ function check_python3_support_for_package_remote {
     echo $classifier
 }
 
-# python3_enabled_for() checks if the service(s) specified as arguments are
-# enabled by the user in ``ENABLED_PYTHON3_PACKAGES``.
+# python3_enabled_for() assumes the service(s) specified as arguments are
+# enabled for python 3 unless explicitly disabled. See python3_disabled_for().
 #
 # Multiple services specified as arguments are ``OR``'ed together; the test
 # is a short-circuit boolean, i.e it returns on the first match.
 #
-# Uses global ``ENABLED_PYTHON3_PACKAGES``
 # python3_enabled_for dir [dir ...]
 function python3_enabled_for {
     local xtrace
@@ -132,7 +131,9 @@ function python3_enabled_for {
     local dirs=$@
     local dir
     for dir in ${dirs}; do
-        [[ ,${ENABLED_PYTHON3_PACKAGES}, =~ ,${dir}, ]] && enabled=0
+        if ! python3_disabled_for "${dir}"; then
+            enabled=0
+        fi
     done
 
     $xtrace
@@ -163,42 +164,29 @@ function python3_disabled_for {
     return $enabled
 }
 
-# enable_python3_package() adds the repositories passed as argument to the
-# ``ENABLED_PYTHON3_PACKAGES`` list, if they are not already present.
+# enable_python3_package() -- no-op for backwards compatibility
 #
 # For example:
 #   enable_python3_package nova
 #
-# Uses global ``ENABLED_PYTHON3_PACKAGES``
 # enable_python3_package dir [dir ...]
 function enable_python3_package {
     local xtrace
     xtrace=$(set +o | grep xtrace)
     set +o xtrace
 
-    local tmpsvcs="${ENABLED_PYTHON3_PACKAGES}"
-    local python3
-    for dir in $@; do
-        if [[ ,${DISABLED_PYTHON3_PACKAGES}, =~ ,${dir}, ]]; then
-            warn $LINENO "Attempt to enable_python3_package ${dir} when it has been disabled"
-            continue
-        fi
-        if ! python3_enabled_for $dir; then
-            tmpsvcs+=",$dir"
-        fi
-    done
-    ENABLED_PYTHON3_PACKAGES=$(_cleanup_service_list "$tmpsvcs")
+    echo "It is no longer necessary to call enable_python3_package()."
 
     $xtrace
 }
 
-# disable_python3_package() prepares the services passed as argument to be
-# removed from the ``ENABLED_PYTHON3_PACKAGES`` list, if they are present.
+# disable_python3_package() adds the services passed as argument to
+# the ``DISABLED_PYTHON3_PACKAGES`` list.
 #
 # For example:
 #   disable_python3_package swift
 #
-# Uses globals ``ENABLED_PYTHON3_PACKAGES`` and ``DISABLED_PYTHON3_PACKAGES``
+# Uses global ``DISABLED_PYTHON3_PACKAGES``
 # disable_python3_package dir [dir ...]
 function disable_python3_package {
     local xtrace
@@ -206,16 +194,11 @@ function disable_python3_package {
     set +o xtrace
 
     local disabled_svcs="${DISABLED_PYTHON3_PACKAGES}"
-    local enabled_svcs=",${ENABLED_PYTHON3_PACKAGES},"
     local dir
     for dir in $@; do
         disabled_svcs+=",$dir"
-        if python3_enabled_for $dir; then
-            enabled_svcs=${enabled_svcs//,$dir,/,}
-        fi
     done
     DISABLED_PYTHON3_PACKAGES=$(_cleanup_service_list "$disabled_svcs")
-    ENABLED_PYTHON3_PACKAGES=$(_cleanup_service_list "$enabled_svcs")
 
     $xtrace
 }
@@ -295,7 +278,7 @@ function pip_install {
                 if python3_disabled_for ${package_dir##*/}; then
                     echo "Explicitly using $PYTHON2_VERSION version to install $package_dir based on DISABLED_PYTHON3_PACKAGES"
                 elif python3_enabled_for ${package_dir##*/}; then
-                    echo "Explicitly using $PYTHON3_VERSION version to install $package_dir based on ENABLED_PYTHON3_PACKAGES"
+                    echo "Using $PYTHON3_VERSION version to install $package_dir based on default behavior"
                     sudo_pip="$sudo_pip LC_ALL=en_US.UTF-8"
                     cmd_pip=$(get_pip_command $PYTHON3_VERSION)
                 elif [[ -d "$package_dir" ]]; then
diff --git a/stackrc b/stackrc
index 8463313625..8f66ba7975 100644
--- a/stackrc
+++ b/stackrc
@@ -129,15 +129,9 @@ fi
 # Control whether Python 3 should be used at all.
 export USE_PYTHON3=$(trueorfalse False USE_PYTHON3)
 
-# Control whether Python 3 is enabled for specific services by the
-# base name of the directory from which they are installed. See
-# enable_python3_package to edit this variable and use_python3_for to
-# test membership.
-export ENABLED_PYTHON3_PACKAGES="nova,glance,cinder,uwsgi,python-openstackclient,openstacksdk"
-
 # Explicitly list services not to run under Python 3. See
 # disable_python3_package to edit this variable.
-export DISABLED_PYTHON3_PACKAGES=""
+export DISABLED_PYTHON3_PACKAGES="swift"
 
 # When Python 3 is supported by an application, adding the specific
 # version of Python 3 to this variable will install the app using that
diff --git a/tests/test_python.sh b/tests/test_python.sh
index 8652798778..1f5453c4c7 100755
--- a/tests/test_python.sh
+++ b/tests/test_python.sh
@@ -12,14 +12,9 @@ source $TOP/tests/unittest.sh
 echo "Testing Python 3 functions"
 
 # Initialize variables manipulated by functions under test.
-export ENABLED_PYTHON3_PACKAGES=""
 export DISABLED_PYTHON3_PACKAGES=""
 
-assert_false "should not be enabled yet" python3_enabled_for testpackage1
-
-enable_python3_package testpackage1
-assert_equal "$ENABLED_PYTHON3_PACKAGES" "testpackage1"  "unexpected result"
-assert_true "should be enabled" python3_enabled_for testpackage1
+assert_true "should be enabled by default" python3_enabled_for testpackage1
 
 assert_false "should not be disabled yet" python3_disabled_for testpackage2
 

From bab27cbff1431ebd9f72e595e86b5a1e902092f0 Mon Sep 17 00:00:00 2001
From: Iury Gregory Melo Ferreira <imelofer@redhat.com>
Date: Wed, 9 Jan 2019 15:55:47 +0100
Subject: [PATCH 1460/2409] Rename ironic job name to match zuulv3

Depends-On: https://review.openstack.org/#/c/629173/
Change-Id: Ifa8d075729c6347ecda41c79e4de09c71483b4c6
---
 .zuul.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 02d3df9b9c..afe400e1a4 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -597,7 +597,7 @@
         - devstack-multinode-xenial
         - devstack-unit-tests
         - openstack-tox-bashate
-        - ironic-tempest-dsvm-ipa-wholedisk-bios-agent_ipmitool-tinyipa:
+        - ironic-tempest-ipa-wholedisk-bios-agent_ipmitool-tinyipa:
             voting: false
         - swift-dsvm-functional:
             voting: false

From 772ade5368ff124d219f9e55b61bb9bc763e47a7 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Fri, 11 Jan 2019 06:04:41 +0000
Subject: [PATCH 1461/2409] Updated from generate-devstack-plugins-list

Change-Id: I3b4c7e73b0f84f0604fa5e06e612a5bd775d7b02
---
 doc/source/plugin-registry.rst | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 02d6911d4b..9901c1ca39 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -150,6 +150,7 @@ octavia                                `git://git.openstack.org/openstack/octavi
 octavia-dashboard                      `git://git.openstack.org/openstack/octavia-dashboard <https://git.openstack.org/cgit/openstack/octavia-dashboard>`__
 omni                                   `git://git.openstack.org/openstack/omni <https://git.openstack.org/cgit/openstack/omni>`__
 openstacksdk                           `git://git.openstack.org/openstack/openstacksdk <https://git.openstack.org/cgit/openstack/openstacksdk>`__
+os-faults                              `git://git.openstack.org/openstack/os-faults <https://git.openstack.org/cgit/openstack/os-faults>`__
 os-xenapi                              `git://git.openstack.org/openstack/os-xenapi <https://git.openstack.org/cgit/openstack/os-xenapi>`__
 osprofiler                             `git://git.openstack.org/openstack/osprofiler <https://git.openstack.org/cgit/openstack/osprofiler>`__
 oswin-tempest-plugin                   `git://git.openstack.org/openstack/oswin-tempest-plugin <https://git.openstack.org/cgit/openstack/oswin-tempest-plugin>`__
@@ -173,6 +174,7 @@ storlets                               `git://git.openstack.org/openstack/storle
 stx-config                             `git://git.openstack.org/openstack/stx-config <https://git.openstack.org/cgit/openstack/stx-config>`__
 stx-fault                              `git://git.openstack.org/openstack/stx-fault <https://git.openstack.org/cgit/openstack/stx-fault>`__
 stx-integ                              `git://git.openstack.org/openstack/stx-integ <https://git.openstack.org/cgit/openstack/stx-integ>`__
+stx-metal                              `git://git.openstack.org/openstack/stx-metal <https://git.openstack.org/cgit/openstack/stx-metal>`__
 stx-nfv                                `git://git.openstack.org/openstack/stx-nfv <https://git.openstack.org/cgit/openstack/stx-nfv>`__
 stx-update                             `git://git.openstack.org/openstack/stx-update <https://git.openstack.org/cgit/openstack/stx-update>`__
 tacker                                 `git://git.openstack.org/openstack/tacker <https://git.openstack.org/cgit/openstack/tacker>`__

From 698796f1aeb0d9a559488bad9f1d03e4941b061e Mon Sep 17 00:00:00 2001
From: Yi Wang <yi.c.wang@intel.com>
Date: Fri, 14 Dec 2018 10:35:26 +0800
Subject: [PATCH 1462/2409] Fix an issue in iniset function

Given the file to be configured, if user "stack" even doesn't have
read access, the result of configuration is not expected. iniset with
"-sudo" option will always create the section and the option which we
want to configure for each calling, no matter whether this section and
this option exist in the file or not. The root cause is the calling of
grep and ini_has_option in iniset don't use the "sudo" option.

Change-Id: I9d21322046b7be411c4c7c28fefc24894fa2e131
Signed-off-by: Yi Wang <yi.c.wang@intel.com>
---
 inc/ini-config           | 17 ++++++++++++-----
 tests/test_ini_config.sh |  4 ++--
 2 files changed, 14 insertions(+), 7 deletions(-)

diff --git a/inc/ini-config b/inc/ini-config
index 6fe7788158..79936823d2 100644
--- a/inc/ini-config
+++ b/inc/ini-config
@@ -88,17 +88,22 @@ function iniget_multiline {
 }
 
 # Determinate is the given option present in the INI file
-# ini_has_option config-file section option
+# ini_has_option [-sudo] config-file section option
 function ini_has_option {
     local xtrace
     xtrace=$(set +o | grep xtrace)
     set +o xtrace
+    local sudo=""
+    if [ $1 == "-sudo" ]; then
+        sudo="sudo "
+        shift
+    fi
     local file=$1
     local section=$2
     local option=$3
     local line
 
-    line=$(sed -ne "/^\[$section\]/,/^\[.*\]/ { /^$option[ \t]*=/ p; }" "$file")
+    line=$($sudo sed -ne "/^\[$section\]/,/^\[.*\]/ { /^$option[ \t]*=/ p; }" "$file")
     $xtrace
     [ -n "$line" ]
 }
@@ -173,8 +178,10 @@ function iniset {
     xtrace=$(set +o | grep xtrace)
     set +o xtrace
     local sudo=""
+    local sudo_option=""
     if [ $1 == "-sudo" ]; then
         sudo="sudo "
+        sudo_option="-sudo "
         shift
     fi
     local file=$1
@@ -187,11 +194,11 @@ function iniset {
         return
     fi
 
-    if ! grep -q "^\[$section\]" "$file" 2>/dev/null; then
+    if ! $sudo grep -q "^\[$section\]" "$file" 2>/dev/null; then
         # Add section at the end
         echo -e "\n[$section]" | $sudo tee --append "$file" > /dev/null
     fi
-    if ! ini_has_option "$file" "$section" "$option"; then
+    if ! ini_has_option $sudo_option "$file" "$section" "$option"; then
         # Add it
         $sudo sed -i -e "/^\[$section\]/ a\\
 $option = $value
@@ -228,7 +235,7 @@ function iniset_multiline {
         # the reverse order. Do a reverse here to keep the original order.
         values="$v ${values}"
     done
-    if ! grep -q "^\[$section\]" "$file"; then
+    if ! $sudo grep -q "^\[$section\]" "$file"; then
         # Add section at the end
         echo -e "\n[$section]" | $sudo tee --append "$file" > /dev/null
     else
diff --git a/tests/test_ini_config.sh b/tests/test_ini_config.sh
index f7dc89a28d..6ed1647f34 100755
--- a/tests/test_ini_config.sh
+++ b/tests/test_ini_config.sh
@@ -125,14 +125,14 @@ VAL=$(iniget ${TEST_INI} bbb handlers)
 assert_equal "$VAL" "33,44" "inset at EOF"
 
 # test empty option
-if ini_has_option ${TEST_INI} ddd empty; then
+if ini_has_option ${SUDO_ARG} ${TEST_INI} ddd empty; then
     passed "ini_has_option: ddd.empty present"
 else
     failed "ini_has_option failed: ddd.empty not found"
 fi
 
 # test non-empty option
-if ini_has_option ${TEST_INI} bbb handlers; then
+if ini_has_option ${SUDO_ARG} ${TEST_INI} bbb handlers; then
     passed "ini_has_option: bbb.handlers present"
 else
     failed "ini_has_option failed: bbb.handlers not found"

From 58243f6203f3385039fe7124b037d5abf7e1d59e Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Thu, 13 Dec 2018 14:05:53 +1100
Subject: [PATCH 1463/2409] Add options for development bindep install

This adds a -bindep option to the key development library install
functions.  With this option the bindep.txt file will be referenced
and the relevant packages installed.

Change-Id: I856f1f59fca49b6020920d8f859b797f3b904300
---
 functions-common | 29 +++++++++++++++++++++
 inc/python       | 67 ++++++++++++++++++++++++++++++++++++++----------
 stack.sh         |  5 ++++
 stackrc          |  7 +++++
 4 files changed, 95 insertions(+), 13 deletions(-)

diff --git a/functions-common b/functions-common
index af95bfb879..6651cc2661 100644
--- a/functions-common
+++ b/functions-common
@@ -1381,6 +1381,35 @@ function zypper_install {
         zypper --non-interactive install --auto-agree-with-licenses --no-recommends "$@"
 }
 
+# Run bindep and install packages it outputs
+#
+# Usage:
+#  install_bindep <path-to-bindep.txt> [profile,profile]
+#
+# Note unlike the bindep command itself, profile(s) specified should
+# be a single, comma-separated string, no spaces.
+function install_bindep {
+    local file=$1
+    local profiles=${2:-""}
+    local pkgs
+
+    if [[ ! -f $file ]]; then
+        die $LINENO "Can not find bindep file: $file"
+    fi
+
+    # converting here makes it much easier to work with passing
+    # arguments
+    profiles=${profiles/,/ /}
+
+    # Note bindep returns 1 when packages need to be installed, so we
+    # have to ignore it's return for "-e"
+    pkgs=$($DEST/bindep-venv/bin/bindep -b --file $file $profiles || true)
+
+    if [[ -n "${pkgs}" ]]; then
+        install_package ${pkgs}
+    fi
+}
+
 function write_user_unit_file {
     local service=$1
     local command="$2"
diff --git a/inc/python b/inc/python
index 5fb7245623..d4237674ed 100644
--- a/inc/python
+++ b/inc/python
@@ -445,7 +445,14 @@ function setup_lib {
 # another project.
 #
 # use this for non namespaced libraries
+#
+# setup_dev_lib [-bindep] <name>
 function setup_dev_lib {
+    local bindep
+    if [[ $1 == -bindep* ]]; then
+        bindep="${1}"
+        shift
+    fi
     local name=$1
     local dir=${GITDIR[$name]}
     if python3_enabled; then
@@ -455,10 +462,10 @@ function setup_dev_lib {
         # of Python.
         echo "Installing $name again without Python 3 enabled"
         USE_PYTHON3=False
-        setup_develop $dir
+        setup_develop $bindep $dir
         USE_PYTHON3=True
     fi
-    setup_develop $dir
+    setup_develop $bindep $dir
 }
 
 # this should be used if you want to install globally, all libraries should
@@ -469,11 +476,17 @@ function setup_dev_lib {
 # extras: comma-separated list of optional dependencies to install
 #         (e.g., ldap,memcache).
 #         See https://docs.openstack.org/pbr/latest/user/using.html#extra-requirements
+# bindep: Set "-bindep" as first argument to install bindep.txt packages
 # The command is like "pip install <project_dir>[<extras>]"
 function setup_install {
+    local bindep
+    if [[ $1 == -bindep* ]]; then
+        bindep="${1}"
+        shift
+    fi
     local project_dir=$1
     local extras=$2
-    _setup_package_with_constraints_edit $project_dir "" $extras
+    _setup_package_with_constraints_edit $bindep $project_dir "" $extras
 }
 
 # this should be used for projects which run services, like all services
@@ -485,9 +498,14 @@ function setup_install {
 #         See https://docs.openstack.org/pbr/latest/user/using.html#extra-requirements
 # The command is like "pip install -e <project_dir>[<extras>]"
 function setup_develop {
+    local bindep
+    if [[ $1 == -bindep* ]]; then
+        bindep="${1}"
+        shift
+    fi
     local project_dir=$1
     local extras=$2
-    _setup_package_with_constraints_edit $project_dir -e $extras
+    _setup_package_with_constraints_edit $bindep $project_dir -e $extras
 }
 
 # ``pip install -e`` the package, which processes the dependencies
@@ -506,6 +524,11 @@ function setup_develop {
 #         See https://docs.openstack.org/pbr/latest/user/using.html#extra-requirements
 # The command is like "pip install <flags> <project_dir>[<extras>]"
 function _setup_package_with_constraints_edit {
+    local bindep
+    if [[ $1 == -bindep* ]]; then
+        bindep="${1}"
+        shift
+    fi
     local project_dir=$1
     local flags=$2
     local extras=$3
@@ -526,7 +549,7 @@ function _setup_package_with_constraints_edit {
             "$flags file://$project_dir#egg=$name"
     fi
 
-    setup_package $project_dir "$flags" $extras
+    setup_package $bindep $project_dir "$flags" $extras
 
     # If this project is in LIBS_FROM_GIT, verify it was actually installed
     # correctly.  This helps catch errors caused by constraints mismatches.
@@ -538,17 +561,30 @@ function _setup_package_with_constraints_edit {
 }
 
 # ``pip install -e`` the package, which processes the dependencies
-# using pip before running `setup.py develop`
+# using pip before running `setup.py develop`.  The command is like
+# "pip install <flags> <project_dir>[<extras>]"
 #
 # Uses globals ``STACK_USER``
-# setup_package project_dir [flags] [extras]
-# project_dir: directory of project repo (e.g., /opt/stack/keystone)
-# flags: pip CLI options/flags
-# extras: comma-separated list of optional dependencies to install
-#         (e.g., ldap,memcache).
-#         See https://docs.openstack.org/pbr/latest/user/using.html#extra-requirements
-# The command is like "pip install <flags> <project_dir>[<extras>]"
+#
+# Usage:
+#  setup_package [-bindep[=profile,profile]] <project_dir> <flags> [extras]
+#
+# -bindep     : Use bindep to install dependencies; select extra profiles
+#               as comma separated arguments after "="
+# project_dir : directory of project repo (e.g., /opt/stack/keystone)
+# flags       : pip CLI options/flags
+# extras      : comma-separated list of optional dependencies to install
+#               (e.g., ldap,memcache).
+#               See https://docs.openstack.org/pbr/latest/user/using.html#extra-requirements
 function setup_package {
+    local bindep=0
+    local bindep_flag=""
+    local bindep_profiles=""
+    if [[ $1 == -bindep* ]]; then
+        bindep=1
+        IFS="=" read bindep_flag bindep_profiles <<< ${1}
+        shift
+    fi
     local project_dir=$1
     local flags=$2
     local extras=$3
@@ -564,6 +600,11 @@ function setup_package {
         extras="[$extras]"
     fi
 
+    # install any bindep packages
+    if [[ $bindep == 1 ]]; then
+        install_bindep $project_dir/bindep.txt $bindep_profiles
+    fi
+
     pip_install $flags "$project_dir$extras"
     # ensure that further actions can do things like setup.py sdist
     if [[ "$flags" == "-e" ]]; then
diff --git a/stack.sh b/stack.sh
index 144c233f05..ad1359e926 100755
--- a/stack.sh
+++ b/stack.sh
@@ -801,6 +801,11 @@ fi
 # Install required infra support libraries
 install_infra
 
+# Install bindep
+$VIRTUALENV_CMD $DEST/bindep-venv
+# TODO(ianw) : optionally install from zuul checkout?
+$DEST/bindep-venv/bin/pip install bindep
+
 # Extras Pre-install
 # ------------------
 # Phase: pre-install
diff --git a/stackrc b/stackrc
index 170d3b648f..c8e6c67909 100644
--- a/stackrc
+++ b/stackrc
@@ -149,6 +149,13 @@ export PYTHON3_VERSION=${PYTHON3_VERSION:-${_DEFAULT_PYTHON3_VERSION:-3.5}}
 _DEFAULT_PYTHON2_VERSION="$(_get_python_version python2)"
 export PYTHON2_VERSION=${PYTHON2_VERSION:-${_DEFAULT_PYTHON2_VERSION:-2.7}}
 
+# Create a virtualenv with this
+if [[ ${USE_PYTHON3} == True ]]; then
+    export VIRTUALENV_CMD="python3 -m venv"
+else
+    export VIRTUALENV_CMD="virtualenv "
+fi
+
 # allow local overrides of env variables, including repo config
 if [[ -f $RC_DIR/localrc ]]; then
     # Old-style user-supplied config

From 16a10d7435be54c97982b93bbc07686ebeb536ac Mon Sep 17 00:00:00 2001
From: Chris Dent <cdent@anticdent.org>
Date: Mon, 14 Jan 2019 17:16:01 +0000
Subject: [PATCH 1464/2409] Configure nova's use of placement more correctly

This change addresses a few inconsistencies in how nova processes
are configured to speak to the placement service.

The initial inspiration was that region_name was not being set in the
[placement] section, despite $REGION_NAME being used when setting
the endpoint in the catalog. That's fixed.

While fixing that two other issues became clear:

* Configuring nova process to use placement should happen in lib/nova
  not lib/placement so the function has been moved.
* auth_strategy is not relevant in the [placement] section of a
  nova process

The name of the function is maintained, in case there are plugins which
call it, but a comment is added to indicate that other services besides
nova compute (such as the cell conductor) may use the function.

Change-Id: I4a46b6460596e9a445bd90de2d52dbb71fb963df
---
 lib/nova      | 15 +++++++++++++++
 lib/placement | 13 -------------
 2 files changed, 15 insertions(+), 13 deletions(-)

diff --git a/lib/nova b/lib/nova
index d1d0b3c16b..182ae1efef 100644
--- a/lib/nova
+++ b/lib/nova
@@ -597,6 +597,21 @@ function create_nova_conf {
     fi
 }
 
+# Configure access to placement from a nova service, usually
+# compute, but sometimes conductor.
+function configure_placement_nova_compute {
+    # Use the provided config file path or default to $NOVA_CONF.
+    local conf=${1:-$NOVA_CONF}
+    iniset $conf placement auth_type "password"
+    iniset $conf placement auth_url "$KEYSTONE_SERVICE_URI"
+    iniset $conf placement username placement
+    iniset $conf placement password "$SERVICE_PASSWORD"
+    iniset $conf placement user_domain_name "$SERVICE_DOMAIN_NAME"
+    iniset $conf placement project_name "$SERVICE_TENANT_NAME"
+    iniset $conf placement project_domain_name "$SERVICE_DOMAIN_NAME"
+    iniset $conf placement region_name "$REGION_NAME"
+}
+
 function configure_console_compute {
     # All nova-compute workers need to know the vnc configuration options
     # These settings don't hurt anything if n-xvnc and n-novnc are disabled
diff --git a/lib/placement b/lib/placement
index da69e39264..a89cd26939 100644
--- a/lib/placement
+++ b/lib/placement
@@ -93,19 +93,6 @@ function _config_placement_apache_wsgi {
     " -i $placement_api_apache_conf
 }
 
-function configure_placement_nova_compute {
-    # Use the provided config file path or default to $NOVA_CONF.
-    local conf=${1:-$NOVA_CONF}
-    iniset $conf placement auth_type "password"
-    iniset $conf placement auth_url "$KEYSTONE_SERVICE_URI"
-    iniset $conf placement username placement
-    iniset $conf placement password "$SERVICE_PASSWORD"
-    iniset $conf placement user_domain_name "$SERVICE_DOMAIN_NAME"
-    iniset $conf placement project_name "$SERVICE_TENANT_NAME"
-    iniset $conf placement project_domain_name "$SERVICE_DOMAIN_NAME"
-    iniset $conf placement auth_strategy $PLACEMENT_AUTH_STRATEGY
-}
-
 # create_placement_conf() - Write config
 function create_placement_conf {
     rm -f $PLACEMENT_CONF

From fa9aadfdd8c5f67a47f5a4abafbae0671283affa Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 15 Jan 2019 18:31:05 +1100
Subject: [PATCH 1465/2409] Install from bindep.txt in plugins

This allows plugins to specify their binary dependencies in bindep
format.

Some thinking on the implementation: this is in contrast to the
files/[deb|rpm] installation, which is called from the external
install_prereqs.sh script.  This script being an externally callable
entry-point is really an artifact of the days when we would build
snapshot images for CI and wanted to pre-cache downloads.  These days
we use the mirror system to keep packages close to CI nodes.  Thus
rather than expand install_prereqs.sh to also be installing
virtualenvs and python dependencies, this seems to fit better as a
separate internal phase of stack.sh.

Documentation is updated

Change-Id: Icbdfbf97c17c906a7ae86f43e80eb2c445816228
---
 doc/source/plugins.rst | 56 ++++++++++++++++++++++++++++++++++++------
 functions-common       | 24 ++++++++++++++++++
 stack.sh               |  7 ++++++
 3 files changed, 80 insertions(+), 7 deletions(-)

diff --git a/doc/source/plugins.rst b/doc/source/plugins.rst
index 89b9381813..de7bdf22b0 100644
--- a/doc/source/plugins.rst
+++ b/doc/source/plugins.rst
@@ -222,14 +222,20 @@ dependency mechanism is beyond the scope of the current work.
 System Packages
 ===============
 
-Devstack provides a framework for getting packages installed at an early
-phase of its execution. These packages may be defined in a plugin as files
-that contain new-line separated lists of packages required by the plugin
 
-Supported packaging systems include apt and yum across multiple distributions.
-To enable a plugin to hook into this and install package dependencies, packages
-may be listed at the following locations in the top-level of the plugin
-repository:
+
+Devstack based
+--------------
+
+Devstack provides a custom framework for getting packages installed at
+an early phase of its execution.  These packages may be defined in a
+plugin as files that contain new-line separated lists of packages
+required by the plugin
+
+Supported packaging systems include apt and yum across multiple
+distributions.  To enable a plugin to hook into this and install
+package dependencies, packages may be listed at the following
+locations in the top-level of the plugin repository:
 
 - ``./devstack/files/debs/$plugin_name`` - Packages to install when running
   on Ubuntu, Debian or Linux Mint.
@@ -240,6 +246,42 @@ repository:
 - ``./devstack/files/rpms-suse/$plugin_name`` - Packages to install when
   running on SUSE Linux or openSUSE.
 
+Although there a no plans to remove this method of installing
+packages, plugins should consider it deprecated for ``bindep`` support
+described below.
+
+bindep
+------
+
+The `bindep <https://docs.openstack.org/infra/bindep>`__ project has
+become the defacto standard for OpenStack projects to specify binary
+dependencies.
+
+A plugin may provide a ``./devstack/files/bindep.txt`` file, which
+will be called with the *default* profile to install packages.  For
+details on the syntax, etc. see the bindep documentation.
+
+It is also possible to use the ``bindep.txt`` of projects that are
+being installed from source with the ``-bindep`` flag available in
+install functions.  For example
+
+.. code-block:: bash
+
+  if use_library_from_git "diskimage-builder"; then
+     GITREPO["diskimage-builder"]=$DISKIMAGE_BUILDER_REPO_URL
+     GITDIR["diskimage-builder"]=$DEST/diskimage-builder
+     GITBRANCH["diskimage-builder"]=$DISKIMAGE_BUILDER_REPO_REF
+     git_clone_by_name "diskimage-builder"
+     setup_dev_lib -bindep "diskimage-builder"
+  fi
+
+will result in any packages required by the ``bindep.txt`` of the
+``diskimage-builder`` project being installed.  Note however that jobs
+that switch projects between source and released/pypi installs
+(e.g. with a ``foo-dsvm`` and a ``foo-dsvm-src`` test to cover both
+released dependencies and master versions) will have to deal with
+``bindep.txt`` being unavailable without the source directory.
+
 
 Using Plugins in the OpenStack Gate
 ===================================
diff --git a/functions-common b/functions-common
index 6651cc2661..2a5d13998a 100644
--- a/functions-common
+++ b/functions-common
@@ -1248,6 +1248,30 @@ function get_plugin_packages {
     $xtrace
 }
 
+# Search plugins for a bindep.txt file
+#
+# Uses globals ``BINDEP_CMD``, ``GITDIR``, ``DEVSTACK_PLUGINS``
+#
+# Note this is only valid after BINDEP_CMD is setup in stack.sh, and
+# is thus not really intended to be called externally.
+function _get_plugin_bindep_packages {
+    local xtrace
+    xtrace=$(set +o | grep xtrace)
+    set +o xtrace
+
+    local bindep_file
+    local packages
+
+    for plugin in ${DEVSTACK_PLUGINS//,/ }; do
+        bindep_file=${GITDIR[$plugin]}/devstack/files/bindep.txt
+        if [[ -f ${bindep_file} ]]; then
+            packages+=$($BINDEP_CMD -b --file ${bindep_file} || true)
+        fi
+    done
+    echo "${packages}"
+    $xtrace
+}
+
 # Distro-agnostic package installer
 # Uses globals ``NO_UPDATE_REPOS``, ``REPOS_UPDATED``, ``RETRY_UPDATE``
 # install_package package [package ...]
diff --git a/stack.sh b/stack.sh
index ad1359e926..95e4df4277 100755
--- a/stack.sh
+++ b/stack.sh
@@ -805,6 +805,13 @@ install_infra
 $VIRTUALENV_CMD $DEST/bindep-venv
 # TODO(ianw) : optionally install from zuul checkout?
 $DEST/bindep-venv/bin/pip install bindep
+export BINDEP_CMD=${DEST}/bindep-venv/bin/bindep
+
+# Install packages as defined in plugin bindep.txt files
+pkgs="$( _get_plugin_bindep_packages )"
+if [[ -n "${pkgs}" ]]; then
+    install_package ${pkgs}
+fi
 
 # Extras Pre-install
 # ------------------

From 82537871376afe98a286e1ba424cf192ae60869a Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Fri, 18 Jan 2019 10:42:13 -0500
Subject: [PATCH 1466/2409] Restrict database access to nova-compute in
 singleconductor mode

Change I4820abe57a023050dd8d067c77e26028801ff288 removed access
to the database for the nova-compute process but only in
superconductor mode. Grenade runs in singleconductor mode though
so we are getting tracebacks in nova-compute logs during grenade
runs because nova-compute is running with nova.conf which is
configured with access to the nova API database.

This change handles removing database access for nova-compute
generically to cover both the singleconductor and superconductor
cases.

Change-Id: I81301eeecc7669a169deeb1e2c5d298a595aab94
Closes-Bug: #1812398
---
 lib/nova | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/lib/nova b/lib/nova
index d1d0b3c16b..199550bf03 100644
--- a/lib/nova
+++ b/lib/nova
@@ -897,25 +897,26 @@ function start_nova_compute {
         local compute_cell_conf=$NOVA_CONF
     fi
 
+    cp $compute_cell_conf $NOVA_CPU_CONF
+
     if [[ "${CELLSV2_SETUP}" == "singleconductor" ]]; then
         # NOTE(danms): Grenade doesn't setup multi-cell rabbit, so
         # skip these bits and use the normal config.
-        NOVA_CPU_CONF=$compute_cell_conf
         echo "Skipping multi-cell conductor fleet setup"
     else
         # "${CELLSV2_SETUP}" is "superconductor"
-        cp $compute_cell_conf $NOVA_CPU_CONF
         # FIXME(danms): Should this be configurable?
         iniset $NOVA_CPU_CONF workarounds disable_group_policy_check_upcall True
         # Since the nova-compute service cannot reach nova-scheduler over
         # RPC, we also disable track_instance_changes.
         iniset $NOVA_CPU_CONF filter_scheduler track_instance_changes False
         iniset_rpc_backend nova $NOVA_CPU_CONF DEFAULT "nova_cell${NOVA_CPU_CELL}"
-        # Make sure we nuke any database config
-        inidelete $NOVA_CPU_CONF database connection
-        inidelete $NOVA_CPU_CONF api_database connection
     fi
 
+    # Make sure we nuke any database config
+    inidelete $NOVA_CPU_CONF database connection
+    inidelete $NOVA_CPU_CONF api_database connection
+
     # Console proxies were configured earlier in create_nova_conf. Now that the
     # nova-cpu.conf has been created, configure the console settings required
     # by the compute process.

From 29ab9b8e3065488842a2477a8a8c48020d955094 Mon Sep 17 00:00:00 2001
From: Luigi Toscano <ltoscano@redhat.com>
Date: Tue, 22 Jan 2019 16:23:42 +0100
Subject: [PATCH 1467/2409] Always start iscsid for nova-compute

Recently iscsid was disabled by default on Ubuntu 18.04 (bionic),
and it may be on Xenial too, see:

https://bugs.launchpad.net/ubuntu/+source/open-iscsi/+bug/1755858

On a local Bionic deployment with Python 3, the lack of iscsid makes
nova-compute fail with an exception when trying to attach a volume:

Invalid input received: Connector doesn't have required information: initiator

Asking for the service to be started even if it is already running should not
hurt, so remove the check for the distribution.

This does not seem to be an issue on CentOS 7 (but Python 2) where
the socket activation of iscsid seems to work, so maybe there is
another way to make this working. Also, the service could be
enabled, not just started.

Change-Id: Ifa995dcf8eb930e959f54e96af6f5fce3eac28ae
---
 lib/nova | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/lib/nova b/lib/nova
index 199550bf03..0b08c0ac6c 100644
--- a/lib/nova
+++ b/lib/nova
@@ -327,10 +327,8 @@ function configure_nova {
                 sudo chown -R $STACK_USER $NOVA_INSTANCES_PATH
             fi
         fi
-        if is_suse; then
-            # iscsid is not started by default
-            start_service iscsid
-        fi
+        # ensure that iscsid is started, even when disabled by default
+        start_service iscsid
     fi
 
     # Rebuild the config file from scratch

From 6757a9c5dec32f39b984ceaaa0eb9e903602769a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20Dulko?= <mdulko@redhat.com>
Date: Fri, 21 Dec 2018 13:17:05 +0100
Subject: [PATCH 1468/2409] Add option to place etcd data dir on RAM disk

Seems like for etcd-heavy services like Kubernetes, the fsync
performance of gate VM's are too low [1]. This commit implements an
option to put etcd data directory on RAM disk (tmpfs) to work this
around.

[1] http://lists.openstack.org/pipermail/openstack-discuss/2019-January/001849.html

Change-Id: I5a17099cb9d6941b1a009dc82daefd2c7946d892
---
 lib/etcd3 | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/lib/etcd3 b/lib/etcd3
index c65a522267..0748ea01ee 100644
--- a/lib/etcd3
+++ b/lib/etcd3
@@ -27,6 +27,10 @@ set +o xtrace
 ETCD_DATA_DIR="$DATA_DIR/etcd"
 ETCD_SYSTEMD_SERVICE="devstack@etcd.service"
 ETCD_BIN_DIR="$DEST/bin"
+# Option below will mount ETCD_DATA_DIR as ramdisk, which is useful to run
+# etcd-heavy services in the gate VM's, e.g. Kubernetes.
+ETCD_USE_RAMDISK=$(trueorfalse False ETCD_USE_RAMDISK)
+ETCD_RAMDISK_MB=${ETCD_RAMDISK_MB:-512}
 
 if is_ubuntu ; then
     UBUNTU_RELEASE_BASE_NUM=`lsb_release -r | awk '{print $2}' | cut -d '.' -f 1`
@@ -89,6 +93,9 @@ function cleanup_etcd3 {
 
     $SYSTEMCTL daemon-reload
 
+    if [[ "$ETCD_USE_RAMDISK" == "True" ]]; then
+        sudo umount $ETCD_DATA_DIR
+    fi
     sudo rm -rf $ETCD_DATA_DIR
 }
 
@@ -98,6 +105,9 @@ function install_etcd3 {
     # Create the necessary directories
     sudo mkdir -p $ETCD_BIN_DIR
     sudo mkdir -p $ETCD_DATA_DIR
+    if [[ "$ETCD_USE_RAMDISK" == "True" ]]; then
+        sudo mount -t tmpfs -o nodev,nosuid,size=${ETCD_RAMDISK_MB}M tmpfs $ETCD_DATA_DIR
+    fi
 
     # Download and cache the etcd tgz for subsequent use
     local etcd_file

From 8b9864d7bf2eaad3c42030cf8e7a2a0b764dc552 Mon Sep 17 00:00:00 2001
From: Michael Johnson <johnsomor@gmail.com>
Date: Thu, 24 Jan 2019 10:49:35 -0800
Subject: [PATCH 1469/2409] Update the devstack LBaaS guide for Octavia

The existing devstack guide for load balancing is out of date.
This patch updates the guide to reflect the current way to install
devstack with the Octavia plugin(s).

Change-Id: Id48b70b50e44ec7b965d969b2d93f77543d7364c
---
 doc/source/guides/devstack-with-lbaas-v2.rst | 113 +++++++++++++------
 1 file changed, 76 insertions(+), 37 deletions(-)

diff --git a/doc/source/guides/devstack-with-lbaas-v2.rst b/doc/source/guides/devstack-with-lbaas-v2.rst
index df3c7ce2ac..b1d88cb35c 100644
--- a/doc/source/guides/devstack-with-lbaas-v2.rst
+++ b/doc/source/guides/devstack-with-lbaas-v2.rst
@@ -1,39 +1,54 @@
-Configure Load-Balancer Version 2
-=================================
+Devstack with Octavia Load Balancing
+====================================
 
-Starting in the OpenStack Liberty release, the
-`neutron LBaaS v2 API <https://developer.openstack.org/api-ref/network/v2/index.html>`_
-is now stable while the LBaaS v1 API has been deprecated.  The LBaaS v2 reference
-driver is based on Octavia.
+Starting with the OpenStack Pike release, Octavia is now a standalone service
+providing load balancing services for OpenStack.
 
+This guide will show you how to create a devstack with `Octavia API`_ enabled.
+
+.. _Octavia API: https://developer.openstack.org/api-ref/load-balancer/v2/index.html
 
 Phase 1: Create DevStack + 2 nova instances
 --------------------------------------------
 
 First, set up a vm of your choice with at least 8 GB RAM and 16 GB disk space,
-make sure it is updated. Install git and any other developer tools you find useful.
+make sure it is updated. Install git and any other developer tools you find
+useful.
 
 Install devstack
 
 ::
 
     git clone https://git.openstack.org/openstack-dev/devstack
-    cd devstack
+    cd devstack/tools
+    sudo ./create-stack-user.sh
+    cd ../..
+    sudo mv devstack /opt/stack
+    sudo chown -R stack.stack /opt/stack/devstack
 
+This will clone the current devstack code locally, then setup the "stack"
+account that devstack services will run under. Finally, it will move devstack
+into its default location in /opt/stack/devstack.
 
-Edit your ``local.conf`` to look like
+Edit your ``/opt/stack/devstack/local.conf`` to look like
 
 ::
 
     [[local|localrc]]
-    # Load the external LBaaS plugin.
-    enable_plugin neutron-lbaas https://git.openstack.org/openstack/neutron-lbaas
     enable_plugin octavia https://git.openstack.org/openstack/octavia
+    # If you are enabling horizon, include the octavia dashboard
+    # enable_plugin octavia-dashboard https://git.openstack.org/openstack/octavia-dashboard.git
+    # If you are enabling barbican for TLS offload in Octavia, include it here.
+    # enable_plugin barbican https://github.com/openstack/barbican.git
+
+    # If you have python3 available:
+    # USE_PYTHON3=True
 
     # ===== BEGIN localrc =====
     DATABASE_PASSWORD=password
     ADMIN_PASSWORD=password
     SERVICE_PASSWORD=password
+    SERVICE_TOKEN=password
     RABBIT_PASSWORD=password
     # Enable Logging
     LOGFILE=$DEST/logs/stack.sh.log
@@ -41,27 +56,30 @@ Edit your ``local.conf`` to look like
     LOG_COLOR=True
     # Pre-requisite
     ENABLED_SERVICES=rabbit,mysql,key
-    # Horizon
-    ENABLED_SERVICES+=,horizon
+    # Horizon - enable for the OpenStack web GUI
+    # ENABLED_SERVICES+=,horizon
     # Nova
-    ENABLED_SERVICES+=,n-api,n-cpu,n-cond,n-sch
+    ENABLED_SERVICES+=,n-api,n-crt,n-obj,n-cpu,n-cond,n-sch,n-api-meta,n-sproxy
+    ENABLED_SERVICES+=,placement-api,placement-client
     # Glance
     ENABLED_SERVICES+=,g-api,g-reg
     # Neutron
-    ENABLED_SERVICES+=,q-svc,q-agt,q-dhcp,q-l3,q-meta
-    # Enable LBaaS v2
-    ENABLED_SERVICES+=,q-lbaasv2
+    ENABLED_SERVICES+=,q-svc,q-agt,q-dhcp,q-l3,q-meta,neutron
     ENABLED_SERVICES+=,octavia,o-cw,o-hk,o-hm,o-api
     # Cinder
     ENABLED_SERVICES+=,c-api,c-vol,c-sch
     # Tempest
     ENABLED_SERVICES+=,tempest
+    # Barbican - Optionally used for TLS offload in Octavia
+    # ENABLED_SERVICES+=,barbican
     # ===== END localrc =====
 
 Run stack.sh and do some sanity checks
 
 ::
 
+    sudo su - stack
+    cd /opt/stack/devstack
     ./stack.sh
     . ./openrc
 
@@ -72,38 +90,59 @@ Create two nova instances that we can use as test http servers:
 ::
 
     #create nova instances on private network
-    nova boot --image $(nova image-list | awk '/ cirros-.*-x86_64-uec / {print $2}') --flavor 1 --nic net-id=$(openstack network list | awk '/ private / {print $2}') node1
-    nova boot --image $(nova image-list | awk '/ cirros-.*-x86_64-uec / {print $2}') --flavor 1 --nic net-id=$(openstack network list | awk '/ private / {print $2}') node2
-    nova list # should show the nova instances just created
+    openstack server create --image $(openstack image list | awk '/ cirros-.*-x86_64-.* / {print $2}') --flavor 1 --nic net-id=$(openstack network list | awk '/ private / {print $2}') node1
+    openstack server creeate --image $(openstack image list | awk '/ cirros-.*-x86_64-.* / {print $2}') --flavor 1 --nic net-id=$(openstack network list | awk '/ private / {print $2}') node2
+    openstack server list # should show the nova instances just created
 
     #add secgroup rules to allow ssh etc..
     openstack security group rule create default --protocol icmp
     openstack security group rule create default --protocol tcp --dst-port 22:22
     openstack security group rule create default --protocol tcp --dst-port 80:80
 
-Set up a simple web server on each of these instances. ssh into each instance (username 'cirros', password 'cubswin:)') and run
+Set up a simple web server on each of these instances. ssh into each instance (username 'cirros', password 'cubswin:)' or 'gocubsgo') and run
 
 ::
 
     MYIP=$(ifconfig eth0|grep 'inet addr'|awk -F: '{print $2}'| awk '{print $1}')
     while true; do echo -e "HTTP/1.0 200 OK\r\n\r\nWelcome to $MYIP" | sudo nc -l -p 80 ; done&
 
-Phase 2: Create your load balancers
-------------------------------------
+Phase 2: Create your load balancer
+----------------------------------
+
+Make sure you have the 'openstack loadbalancer' commands:
 
 ::
 
-    neutron lbaas-loadbalancer-create --name lb1 private-subnet
-    neutron lbaas-loadbalancer-show lb1  # Wait for the provisioning_status to be ACTIVE.
-    neutron lbaas-listener-create --loadbalancer lb1 --protocol HTTP --protocol-port 80 --name listener1
-    sleep 10  # Sleep since LBaaS actions can take a few seconds depending on the environment.
-    neutron lbaas-pool-create --lb-algorithm ROUND_ROBIN --listener listener1 --protocol HTTP --name pool1
-    sleep 10
-    neutron lbaas-member-create  --subnet private-subnet --address 10.0.0.3 --protocol-port 80 pool1
-    sleep 10
-    neutron lbaas-member-create  --subnet private-subnet --address 10.0.0.5 --protocol-port 80 pool1
-
-Please note here that the "10.0.0.3" and "10.0.0.5" in the above commands are the IPs of the nodes
-(in my test run-thru, they were actually 10.2 and 10.4), and the address of the created LB will be
-reported as "vip_address" from the lbaas-loadbalancer-create, and a quick test of that LB is
-"curl that-lb-ip", which should alternate between showing the IPs of the two nodes.
+    pip install python-octaviaclient
+
+Create your load balancer:
+
+::
+
+    openstack loadbalancer create --name lb1 --vip-subnet-id private-subnet
+    openstack loadbalancer show lb1  # Wait for the provisioning_status to be ACTIVE.
+    openstack loadbalancer listener create --protocol HTTP --protocol-port 80 --name listener1 lb1
+    openstack loadbalancer show lb1  # Wait for the provisioning_status to be ACTIVE.
+    openstack loadbalancer pool create --lb-algorithm ROUND_ROBIN --listener listener1 --protocol HTTP --name pool1
+    openstack loadbalancer show lb1  # Wait for the provisioning_status to be ACTIVE.
+    openstack loadbalancer healthmonitor create --delay 5 --timeout 2 --max-retries 1 --type HTTP pool1
+    openstack loadbalancer show lb1  # Wait for the provisioning_status to be ACTIVE.
+    openstack loadbalancer member create --subnet-id private-subnet --address <web server 1 address> --protocol-port 80 pool1
+    openstack loadbalancer show lb1  # Wait for the provisioning_status to be ACTIVE.
+    openstack loadbalancer member create --subnet-id private-subnet --address <web server 2 address> --protocol-port 80 pool1
+
+Please note: The <web server # address> fields are the IP addresses of the nova
+servers created in Phase 1.
+Also note, using the API directly you can do all of the above commands in one
+API call.
+
+Phase 3: Test your load balancer
+--------------------------------
+
+::
+
+    openstack loadbalancer show lb1 # Note the vip_address
+    curl http://<vip_address>
+    curl http://<vip_address>
+
+This should show the "Welcome to <IP>" message from each member server.

From d6bbeabb5c5c35eb9ada92656c9b65fbef8aff07 Mon Sep 17 00:00:00 2001
From: Adam Spiers <aspiers@suse.com>
Date: Wed, 23 Jan 2019 19:31:53 +0000
Subject: [PATCH 1470/2409] Fix installation of mkisofs on SUSE Linux
 Enterprise 12

It's provided by the cdrkit-cdrtools-compat package.

Change-Id: I4b57e03391d47bed777016ab1d735b8ba4aa5ceb
---
 files/rpms-suse/n-cpu | 3 ++-
 files/rpms-suse/nova  | 4 +++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/files/rpms-suse/n-cpu b/files/rpms-suse/n-cpu
index c11e9f0763..9c724cb9d8 100644
--- a/files/rpms-suse/n-cpu
+++ b/files/rpms-suse/n-cpu
@@ -1,8 +1,9 @@
+cdrkit-cdrtools-compat # dist:sle12
 cryptsetup
 dosfstools
 libosinfo
 lvm2
-mkisofs
+mkisofs # not:sle12
 open-iscsi
 sg3_utils
 # Stuff for diablo volumes
diff --git a/files/rpms-suse/nova b/files/rpms-suse/nova
index 4103a407d2..1d5812146b 100644
--- a/files/rpms-suse/nova
+++ b/files/rpms-suse/nova
@@ -1,3 +1,4 @@
+cdrkit-cdrtools-compat # dist:sle12
 conntrack-tools
 curl
 dnsmasq
@@ -11,7 +12,8 @@ kvm # NOPRIME
 libvirt # NOPRIME
 libvirt-python # NOPRIME
 mariadb # NOPRIME
-mkisofs # required for config_drive
+# mkisofs is required for config_drive
+mkisofs # not:sle12
 parted
 polkit
 # qemu as fallback if kvm cannot be used

From bc2a88d1f493f4f0784650e5ac959e8677495669 Mon Sep 17 00:00:00 2001
From: Adam Spiers <aspiers@suse.com>
Date: Thu, 24 Jan 2019 18:57:33 +0000
Subject: [PATCH 1471/2409] On SUSE-based systems, check whether we have
 mariadb or mysql service

Older mariadb packages on SLES 12 provided mysql.service.  The newer
ones on SLES 12 and 15 use mariadb.service; they also provide a
mysql.service symlink for backwards-compatibility, but let's not rely
on that.

Change-Id: Ife6bd007ba30af0b77d44832b19d518034bdb12b
---
 lib/databases/mysql | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/lib/databases/mysql b/lib/databases/mysql
index ac0c083c91..4d0f5f3e45 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -16,7 +16,13 @@ MYSQL_DRIVER=${MYSQL_DRIVER:-PyMySQL}
 register_database mysql
 
 MYSQL_SERVICE_NAME=mysql
-if is_suse || is_fedora && ! is_oraclelinux; then
+if is_fedora && ! is_oraclelinux; then
+    MYSQL_SERVICE_NAME=mariadb
+elif is_suse && systemctl list-unit-files | grep -q 'mariadb\.service'; then
+    # Older mariadb packages on SLES 12 provided mysql.service.  The
+    # newer ones on SLES 12 and 15 use mariadb.service; they also
+    # provide a mysql.service symlink for backwards-compatibility, but
+    # let's not rely on that.
     MYSQL_SERVICE_NAME=mariadb
 fi
 

From bbb6b0c2409278a4c9266c39bd1f5d91f7066bb8 Mon Sep 17 00:00:00 2001
From: Adam Spiers <aspiers@suse.com>
Date: Fri, 25 Jan 2019 00:29:42 +0000
Subject: [PATCH 1472/2409] Fix version comparison for SUSE Linux Enterprise 12

The version comparison introduced in
I5152f2585c3d4d18853988d6290039d6b1713b99 was broken, because it tried
to use bash's -lt operator for floating point comparison, but bash
only supports integer arithmetic.

So instead use devstack's vercmp() function.

Change-Id: I8aac71c5bb6c2e82479d62831ea0672ba6a9a534
---
 lib/neutron_plugins/ovs_base | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/ovs_base b/lib/neutron_plugins/ovs_base
index 523024e2fe..fbe4c92139 100644
--- a/lib/neutron_plugins/ovs_base
+++ b/lib/neutron_plugins/ovs_base
@@ -69,7 +69,7 @@ function _neutron_ovs_base_install_agent_packages {
         restart_service openvswitch
         sudo systemctl enable openvswitch
     elif is_suse; then
-        if [[ $DISTRO == "sle12" ]] && [[ $os_RELEASE -lt 12.2 ]]; then
+        if [[ $DISTRO == "sle12" ]] && vercmp "$os_RELEASE" "<" "12.2" ; then
             restart_service openvswitch-switch
         else
             # workaround for https://bugzilla.suse.com/show_bug.cgi?id=1085971

From 96269d8e758e168fb857fca6e96cbd9a50628ac0 Mon Sep 17 00:00:00 2001
From: Brian Rosmaita <rosmaita.fossdev@gmail.com>
Date: Mon, 17 Dec 2018 10:38:42 -0500
Subject: [PATCH 1473/2409] Change config-file to config-dir for g-api start

The glance-api service may use multiple config files, so
tell oslo.config about the config dir instead of a specific
config file when the service is started.

Change-Id: Iad3602d209cbb31e10683c67e1fd6b465d19f560
Partial-bug: #1805765
---
 lib/glance | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/glance b/lib/glance
index 94f6a22931..b1c8c4dacc 100644
--- a/lib/glance
+++ b/lib/glance
@@ -345,7 +345,7 @@ function start_glance {
     if [[ "$WSGI_MODE" == "uwsgi" ]]; then
         run_process g-api "$GLANCE_BIN_DIR/uwsgi --procname-prefix glance-api --ini $GLANCE_UWSGI_CONF"
     else
-        run_process g-api "$GLANCE_BIN_DIR/glance-api --config-file=$GLANCE_CONF_DIR/glance-api.conf"
+        run_process g-api "$GLANCE_BIN_DIR/glance-api --config-dir=$GLANCE_CONF_DIR"
     fi
 
     echo "Waiting for g-api ($GLANCE_SERVICE_HOST) to start..."

From ee4b6a0128bad7ae64e9ae7a9c79470585e93dc6 Mon Sep 17 00:00:00 2001
From: Sean Mooney <work@seanmooney.info>
Date: Tue, 29 Jan 2019 18:17:30 +0000
Subject: [PATCH 1474/2409] set owner and group to no for
 fetch-devstack-log-dir

As the user on the node under test may not exist on
the zuul executor node we do not copy the log owner
or group to avoid the rsync task failing when it
tries to chown the files.

Change-Id: I500cf3692a4d27b0c2a0a4f5586580d180a8778e
---
 roles/fetch-devstack-log-dir/tasks/main.yaml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/roles/fetch-devstack-log-dir/tasks/main.yaml b/roles/fetch-devstack-log-dir/tasks/main.yaml
index 5a198b21b4..276c4e0eb5 100644
--- a/roles/fetch-devstack-log-dir/tasks/main.yaml
+++ b/roles/fetch-devstack-log-dir/tasks/main.yaml
@@ -1,5 +1,10 @@
+# as the user in the guest may not exist on the executor
+# we do not preserve the group or owner of the copied logs.
+
 - name: Collect devstack logs
   synchronize:
     dest: "{{ zuul.executor.log_root }}/{{ inventory_hostname }}"
     mode: pull
     src: "{{ devstack_base_dir }}/logs"
+    group: no
+    owner: no

From b6f04ca5c9c09db2d567ecbf7fad757158fd0aba Mon Sep 17 00:00:00 2001
From: Adam Spiers <aspiers@suse.com>
Date: Wed, 23 Jan 2019 18:55:16 +0000
Subject: [PATCH 1475/2409] Fix distro detection for SUSE Linux Enterprise

On SUSE Linux Enterprise distributions, lsb_release -i typically
returns "SUSE" not "SUSE LINUX" as the vendor string.

To avoid duplication of the same regular expressions in multiple
places, add is_opensuse() and is_sle() helper functions, and modify
is_suse to invoke those.

This may also be helpful in the future for distinguishing some corner
cases where things are handled differently between openSUSE and SLE.

Change-Id: I43bf163bc963758ddbb6289928837f5f6512f265
---
 functions-common | 25 ++++++++++++++++++++++---
 1 file changed, 22 insertions(+), 3 deletions(-)

diff --git a/functions-common b/functions-common
index e5962db42b..28b12b270b 100644
--- a/functions-common
+++ b/functions-common
@@ -379,14 +379,14 @@ function GetDistro {
     elif [[ "$os_VENDOR" =~ (Fedora) ]]; then
         # For Fedora, just use 'f' and the release
         DISTRO="f$os_RELEASE"
-    elif [[ "$os_VENDOR" =~ (openSUSE) ]]; then
+    elif is_opensuse; then
         DISTRO="opensuse-$os_RELEASE"
         # Tumbleweed uses "n/a" as a codename, and the release is a datestring
         # like 20180218, so not very useful. Leap however uses a release
         # with a "dot", so for example 15.0
         [ "$os_CODENAME" = "n/a" -a "$os_RELEASE" = "${os_RELEASE/\./}" ] && \
             DISTRO="opensuse-tumbleweed"
-    elif [[ "$os_VENDOR" =~ (SUSE LINUX) ]]; then
+    elif is_suse_linux_enterprise; then
         # just use major release
         DISTRO="sle${os_RELEASE%.*}"
     elif [[ "$os_VENDOR" =~ (Red.*Hat) || \
@@ -460,11 +460,30 @@ function is_fedora {
 # (openSUSE, SLE).
 # is_suse
 function is_suse {
+    is_opensuse || is_suse_linux_enterprise
+}
+
+
+# Determine if current distribution is an openSUSE distribution
+# is_opensuse
+function is_opensuse {
+    if [[ -z "$os_VENDOR" ]]; then
+        GetOSVersion
+    fi
+
+    [[ "$os_VENDOR" =~ (openSUSE) ]]
+}
+
+
+# Determine if current distribution is a SUSE Linux Enterprise (SLE)
+# distribution
+# is_suse_linux_enterprise
+function is_suse_linux_enterprise {
     if [[ -z "$os_VENDOR" ]]; then
         GetOSVersion
     fi
 
-    [[ "$os_VENDOR" =~ (openSUSE) || "$os_VENDOR" == "SUSE LINUX" ]]
+    [[ "$os_VENDOR" =~ (^SUSE) ]]
 }
 
 

From ec8285271e0c0b7c97fb6cd8816eca8ad844c5bd Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Wed, 30 Jan 2019 20:48:18 -0500
Subject: [PATCH 1476/2409] Change "Options pimp your stack" heading in
 multinode docs

Uses a less offensive and arguably better understood section
header in the multinode docs.

Change-Id: Ie6fd58e9abd5c1ce88d88ac55419807790f61851
Closes-Bug: #1810317
---
 doc/source/guides/multinode-lab.rst | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
index b4e2891c10..33820daec0 100644
--- a/doc/source/guides/multinode-lab.rst
+++ b/doc/source/guides/multinode-lab.rst
@@ -240,8 +240,8 @@ this when it runs but there are times it needs to still be done by hand:
     sudo rm -rf /etc/libvirt/qemu/inst*
     sudo virsh list | grep inst | awk '{print $1}' | xargs -n1 virsh destroy
 
-Options pimp your stack
-=======================
+Going further
+=============
 
 Additional Users
 ----------------

From 1516e720ce1d6eb6eca38feb1ca18dc7fc8c105c Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Tue, 5 Feb 2019 11:21:39 -0500
Subject: [PATCH 1477/2409] Set ETCD_USE_RAMDISK=True by default

Cinder and etcd are enabled by default and by default
cinder uses etcd as a distributed lock manager with
tooz as an intermediary. We see a lot of ToozConnectionErrors [1]
in the cinder logs when etcd is backed up [2] which results in
cinder operations timing out causing test failures, like
when a volume is not deleted within a given time.

This changes ETCD_USE_RAMDISK=True by default to try and
alleviate some of the pressure. An alternative is if we know
we're in a single-node job we could just not use a DLM for
Cinder.

[1] http://status.openstack.org/elastic-recheck/#1810526
[2] etcd[26824]: sync duration of 12.076762123s, expected less than 1s

Change-Id: I5f82aa40e9d84114e7b7b5cf19ec4942d6552490
Partial-Bug: #1810526
---
 lib/etcd3 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/etcd3 b/lib/etcd3
index 0748ea01ee..4f3a7a4349 100644
--- a/lib/etcd3
+++ b/lib/etcd3
@@ -29,7 +29,7 @@ ETCD_SYSTEMD_SERVICE="devstack@etcd.service"
 ETCD_BIN_DIR="$DEST/bin"
 # Option below will mount ETCD_DATA_DIR as ramdisk, which is useful to run
 # etcd-heavy services in the gate VM's, e.g. Kubernetes.
-ETCD_USE_RAMDISK=$(trueorfalse False ETCD_USE_RAMDISK)
+ETCD_USE_RAMDISK=$(trueorfalse True ETCD_USE_RAMDISK)
 ETCD_RAMDISK_MB=${ETCD_RAMDISK_MB:-512}
 
 if is_ubuntu ; then

From 4a3cc1ce341eca821ddf004ca484bd827d060507 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Wed, 30 Jan 2019 20:50:47 -0500
Subject: [PATCH 1478/2409] Remove hard-coded VOLUME_BACKING_FILE_SIZE from
 multinode docs

The default for VOLUME_BACKING_FILE_SIZE changes over time
and the docs referencing it are clearly not keeping pace so
rather than hard-code a default in the docs just remove it
since the doc already mentions the variable used to set that
size.

Change-Id: I4242584d13250872250689863d1b70c68594eefe
---
 doc/source/guides/multinode-lab.rst | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
index 33820daec0..7978cd86ea 100644
--- a/doc/source/guides/multinode-lab.rst
+++ b/doc/source/guides/multinode-lab.rst
@@ -302,10 +302,10 @@ Volumes
 
 DevStack will automatically use an existing LVM volume group named
 ``stack-volumes`` to store cloud-created volumes. If ``stack-volumes``
-doesn't exist, DevStack will set up a 10Gb loop-mounted file to contain
-it. This obviously limits the number and size of volumes that can be
-created inside OpenStack. The size can be overridden by setting
-``VOLUME_BACKING_FILE_SIZE`` in ``local.conf``.
+doesn't exist, DevStack will set up a loop-mounted file to contain
+it.  If the default size is insufficient for the number and size of volumes
+required, it can be overridden by setting ``VOLUME_BACKING_FILE_SIZE`` in
+``local.conf`` (sizes given in ``truncate`` compatible format, e.g. ``24G``).
 
 ``stack-volumes`` can be pre-created on any physical volume supported by
 Linux's LVM. The name of the volume group can be changed by setting

From b43810a36635f1d0fe9291b157506fcf20272adf Mon Sep 17 00:00:00 2001
From: Brian Rosmaita <rosmaita.fossdev@gmail.com>
Date: Thu, 7 Feb 2019 16:46:49 -0500
Subject: [PATCH 1479/2409] Glance should not reference Cinder v1

Cinder v1 was removed over a year ago.  Change the cinder template
URLs devstack defines in the glance-api.conf to use cinder v3
instead.

Change-Id: I4a68dc0b53631be0708e7411c37619dd6dfd4fa6
---
 lib/glance | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/glance b/lib/glance
index 94f6a22931..8001157e58 100644
--- a/lib/glance
+++ b/lib/glance
@@ -236,8 +236,8 @@ function configure_glance {
         CINDER_SERVICE_HOST=${CINDER_SERVICE_HOST:-$SERVICE_HOST}
         CINDER_SERVICE_PORT=${CINDER_SERVICE_PORT:-8776}
 
-        iniset $GLANCE_API_CONF DEFAULT cinder_endpoint_template "https://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/%(project_id)s"
-        iniset $GLANCE_CACHE_CONF DEFAULT cinder_endpoint_template "https://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/%(project_id)s"
+        iniset $GLANCE_API_CONF DEFAULT cinder_endpoint_template "https://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v3/%(project_id)s"
+        iniset $GLANCE_CACHE_CONF DEFAULT cinder_endpoint_template "https://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v3/%(project_id)s"
     fi
 
     if [[ "$WSGI_MODE" == "uwsgi" ]]; then

From bfd2a54c13b8f3235991e534d5aa822be2aeaf19 Mon Sep 17 00:00:00 2001
From: Attila Fazekas <afazekas@redhat.com>
Date: Fri, 8 Feb 2019 14:49:16 -0500
Subject: [PATCH 1480/2409] Stop creating the cinderv1 endpoint

The cinder v1 api is disabled by default,
the catalog entry is confusing.

Change-Id: Ifea283d8aff9f7a70b68d601c5225c3d4fe250e6
---
 lib/cinder | 11 -----------
 1 file changed, 11 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 76bf928413..d69b21efd0 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -349,18 +349,12 @@ function create_cinder_accounts {
 
         # block-storage is the official service type
         get_or_create_service "cinder" "block-storage" "Cinder Volume Service"
-        get_or_create_service "cinder" "volume" "Cinder Volume Service"
         if [ "$CINDER_USE_MOD_WSGI" == "False" ]; then
             get_or_create_endpoint \
                 "block-storage" \
                 "$REGION_NAME" \
                 "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v3/\$(project_id)s"
 
-            get_or_create_endpoint \
-                "volume" \
-                "$REGION_NAME" \
-                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v1/\$(project_id)s"
-
             get_or_create_service "cinderv2" "volumev2" "Cinder Volume Service V2"
             get_or_create_endpoint \
                 "volumev2" \
@@ -378,11 +372,6 @@ function create_cinder_accounts {
                 "$REGION_NAME" \
                 "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST/volume/v3/\$(project_id)s"
 
-            get_or_create_endpoint \
-                "volume" \
-                "$REGION_NAME" \
-                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST/volume/v1/\$(project_id)s"
-
             get_or_create_service "cinderv2" "volumev2" "Cinder Volume Service V2"
             get_or_create_endpoint \
                 "volumev2" \

From e729976c82791c513feedd51c9c2c45d79b09f61 Mon Sep 17 00:00:00 2001
From: Nguyen Hai <nguyentrihai93@gmail.com>
Date: Wed, 13 Feb 2019 15:04:02 +0900
Subject: [PATCH 1481/2409] Add placement as default project in index webpage

Change-Id: I101ade5368fbdf108906e89e1c3ba03a46cd6f35
---
 doc/source/index.rst    | 4 ++--
 doc/source/overview.rst | 3 ++-
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/doc/source/index.rst b/doc/source/index.rst
index 6c42a5b4e9..9186f6dba7 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -114,8 +114,8 @@ Profit!
 You now have a working DevStack! Congrats!
 
 Your devstack will have installed ``keystone``, ``glance``, ``nova``,
-``cinder``, ``neutron``, and ``horizon``. Floating IPs will be
-available, guests have access to the external world.
+``placement``, ``cinder``, ``neutron``, and ``horizon``. Floating IPs
+will be available, guests have access to the external world.
 
 You can access horizon to experience the web interface to
 OpenStack, and manage vms, networks, volumes, and images from
diff --git a/doc/source/overview.rst b/doc/source/overview.rst
index 2479cd0bc8..a609333289 100644
--- a/doc/source/overview.rst
+++ b/doc/source/overview.rst
@@ -64,7 +64,8 @@ Services
 
 The default services configured by DevStack are Identity (keystone),
 Object Storage (swift), Image Service (glance), Block Storage
-(cinder), Compute (nova), Networking (neutron), Dashboard (horizon)
+(cinder), Compute (nova), Placement (placement),
+Networking (neutron), Dashboard (horizon).
 
 Additional services not included directly in DevStack can be tied in to
 ``stack.sh`` using the :doc:`plugin mechanism <plugins>` to call

From 72f632222f6d90d3545b5d7ca48297da4218e2ea Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 19 Feb 2019 14:06:18 +1100
Subject: [PATCH 1482/2409] Update cirros256 flavor to have some disk

It seems nova has changed defaults on who can create zero-sized disk
instances [1] and now some devstack jobs, like nodepool's, can't
create cirros images using this flavor.  It seems the easiest thing to
do is just to bump it up.

[1] https://review.openstack.org/#/c/603910/

Change-Id: I1172d4775d608568ccbeb27e2975d83add892ea9
---
 lib/nova | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index 6c9b944ba0..033ebf3697 100644
--- a/lib/nova
+++ b/lib/nova
@@ -1167,7 +1167,7 @@ function create_flavors {
     if is_service_enabled n-api; then
         if ! openstack --os-region-name="$REGION_NAME" flavor list | grep -q ds512M; then
             # Note that danms hates these flavors and apologizes for sdague
-            openstack --os-region-name="$REGION_NAME" flavor create --id c1 --ram 256 --disk 0 --vcpus 1 cirros256
+            openstack --os-region-name="$REGION_NAME" flavor create --id c1 --ram 256 --disk 1 --vcpus 1 cirros256
             openstack --os-region-name="$REGION_NAME" flavor create --id d1 --ram 512 --disk 5 --vcpus 1 ds512M
             openstack --os-region-name="$REGION_NAME" flavor create --id d2 --ram 1024 --disk 10 --vcpus 1 ds1G
             openstack --os-region-name="$REGION_NAME" flavor create --id d3 --ram 2048 --disk 10 --vcpus 2 ds2G

From f0dc93dcb4bc69442733056e88de9aff0f890664 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 20 Apr 2018 10:42:07 +1000
Subject: [PATCH 1483/2409] Workaround pip10 uninstall of packages

As noted in comments, this is a hack to get pip10 to overwrite some
package installed libraries.

Change-Id: Iea24a3ea915e13f7e0882144028ec5ff5bfdfae1
---
 tools/fixup_stuff.sh | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index a939e30b02..1ff7bfa516 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -202,7 +202,19 @@ function fixup_fedora {
             # install requests with the bundled urllib3 to avoid conflicts
             pip_install --upgrade --force-reinstall requests
         fi
+
     fi
+
+    # Since pip10, pip will refuse to uninstall files from packages
+    # that were created with distutils (rather than more modern
+    # setuptools).  This is because it technically doesn't have a
+    # manifest of what to remove.  However, in most cases, simply
+    # overwriting works.  So this hacks around those packages that
+    # have been dragged in by some other system dependency
+    sudo rm -rf /usr/lib/python2.7/site-packages/enum34*.egg-info
+    sudo rm -rf /usr/lib/python2.7/site-packages/ipaddress*.egg-info
+    sudo rm -rf /usr/lib/python2.7/site-packages/ply-*.egg-info
+    sudo rm -rf /usr/lib/python2.7/site-packages/typing-*.egg-info
 }
 
 function fixup_suse {

From 543aed422fd89875113861e6a554da7980f8dd4f Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 20 Apr 2018 15:22:47 +1000
Subject: [PATCH 1484/2409] Don't install numpy packages

numpy is a python requirement of the websockify package (it appears
there was some disucssion over *removing* this in [1], but did not
happen).  Possibly these packages were installed a long time ago
before wheel support as it was taking a long time to build.  But we
have wheels today, and later versions than the distro provides are
being dragged in anyway.  Remove all distro installs.

[1] https://github.com/novnc/websockify/pull/163

Change-Id: I322dd9e1a07d8ce03c26cf3fcccebd6e21282fe4
---
 files/rpms-suse/n-novnc | 1 -
 files/rpms-suse/n-spice | 1 -
 files/rpms/n-novnc      | 1 -
 files/rpms/n-spice      | 1 -
 files/rpms/nova         | 1 -
 5 files changed, 5 deletions(-)
 delete mode 100644 files/rpms-suse/n-novnc
 delete mode 100644 files/rpms-suse/n-spice
 delete mode 100644 files/rpms/n-novnc
 delete mode 100644 files/rpms/n-spice

diff --git a/files/rpms-suse/n-novnc b/files/rpms-suse/n-novnc
deleted file mode 100644
index c8722b9f66..0000000000
--- a/files/rpms-suse/n-novnc
+++ /dev/null
@@ -1 +0,0 @@
-python-numpy
diff --git a/files/rpms-suse/n-spice b/files/rpms-suse/n-spice
deleted file mode 100644
index c8722b9f66..0000000000
--- a/files/rpms-suse/n-spice
+++ /dev/null
@@ -1 +0,0 @@
-python-numpy
diff --git a/files/rpms/n-novnc b/files/rpms/n-novnc
deleted file mode 100644
index 24ce15ab7e..0000000000
--- a/files/rpms/n-novnc
+++ /dev/null
@@ -1 +0,0 @@
-numpy
diff --git a/files/rpms/n-spice b/files/rpms/n-spice
deleted file mode 100644
index 24ce15ab7e..0000000000
--- a/files/rpms/n-spice
+++ /dev/null
@@ -1 +0,0 @@
-numpy
diff --git a/files/rpms/nova b/files/rpms/nova
index 4140cd7bae..8d73644025 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -13,7 +13,6 @@ libxml2-python
 m2crypto
 mysql-devel
 mysql-server # NOPRIME
-numpy # needed by websockify for spice console
 parted
 polkit
 rabbitmq-server # NOPRIME

From 29771c1c1e09e6bf2cad0f67cf4c176735f5ac0a Mon Sep 17 00:00:00 2001
From: Luigi Toscano <ltoscano@redhat.com>
Date: Thu, 21 Feb 2019 10:36:18 +0100
Subject: [PATCH 1485/2409] Remove the usage of read_password from library
 files

The read_password function is defined inside stack.sh
and it cannot be used inside the "public library interface"
provided by DevStack.

Move the calls found inside library files to stack.sh,
following the same pattern of the other calls to read_password.

Change-Id: I8adc6723b677dfac2bef735f660e056c498bf773
---
 lib/database                          |  2 --
 lib/nova_plugins/hypervisor-xenserver |  1 -
 stack.sh                              | 19 ++++++++++++++++++-
 3 files changed, 18 insertions(+), 4 deletions(-)

diff --git a/lib/database b/lib/database
index 0d720527df..7940cf2208 100644
--- a/lib/database
+++ b/lib/database
@@ -87,8 +87,6 @@ function initialize_database_backends {
 
     if [ -n "$MYSQL_PASSWORD" ]; then
         DATABASE_PASSWORD=$MYSQL_PASSWORD
-    else
-        read_password DATABASE_PASSWORD "ENTER A PASSWORD TO USE FOR THE DATABASE."
     fi
 
     # We configure Nova, Horizon, Glance and Keystone to use MySQL as their
diff --git a/lib/nova_plugins/hypervisor-xenserver b/lib/nova_plugins/hypervisor-xenserver
index 6f79e4ff7c..cd4d3caa84 100644
--- a/lib/nova_plugins/hypervisor-xenserver
+++ b/lib/nova_plugins/hypervisor-xenserver
@@ -59,7 +59,6 @@ function configure_nova_hypervisor {
         die $LINENO "os-xenapi plugin is not specified. Please enable this plugin in local.conf"
     fi
 
-    read_password XENAPI_PASSWORD "ENTER A PASSWORD TO USE FOR XEN."
     iniset $NOVA_CONF DEFAULT compute_driver "xenapi.XenAPIDriver"
     iniset $NOVA_CONF xenserver connection_url "$XENAPI_CONNECTION_URL"
     iniset $NOVA_CONF xenserver connection_username "$XENAPI_USER"
diff --git a/stack.sh b/stack.sh
index 022d5b9438..8d4042dc23 100755
--- a/stack.sh
+++ b/stack.sh
@@ -691,7 +691,14 @@ function read_password {
 # The available database backends are listed in ``DATABASE_BACKENDS`` after
 # ``lib/database`` is sourced. ``mysql`` is the default.
 
-initialize_database_backends && echo "Using $DATABASE_TYPE database backend" || echo "No database enabled"
+if initialize_database_backends; then
+    echo "Using $DATABASE_TYPE database backend"
+    # Last chance for the database password. This must be handled here
+    # because read_password is not a library function.
+    read_password DATABASE_PASSWORD "ENTER A PASSWORD TO USE FOR THE DATABASE."
+else
+    echo "No database enabled"
+fi
 
 
 # Queue Configuration
@@ -729,6 +736,16 @@ if is_service_enabled keystone; then
 fi
 
 
+# Nova
+# -----
+
+if is_service_enabled nova && [[ "$VIRT_DRIVER" == 'xenserver' ]]; then
+    # Look for the backend password here because read_password
+    # is not a library function.
+    read_password XENAPI_PASSWORD "ENTER A PASSWORD TO USE FOR XEN."
+fi
+
+
 # Swift
 # -----
 

From cf7fc9c757a53113405e8f52af1020e5d21b04fe Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Mon, 25 Feb 2019 10:46:52 +0100
Subject: [PATCH 1486/2409] Add 3 nodes nodeset based on Ubuntu bionic

It is needed for example in neutron-tempest-dvr-ha-multinode-full
job.

Change-Id: I1b9dbb256e338d7018adb8b2ee97999ebd8eda44
Related-Bug: #1804844
---
 .zuul.yaml | 35 +++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index afe400e1a4..ce1a300237 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -148,6 +148,41 @@
         nodes:
           - compute1
 
+- nodeset:
+    name: openstack-three-node-bionic
+    nodes:
+      - name: controller
+        label: ubuntu-bionic
+      - name: compute1
+        label: ubuntu-bionic
+      - name: compute2
+        label: ubuntu-bionic
+    groups:
+      # Node where tests are executed and test results collected
+      - name: tempest
+        nodes:
+          - controller
+      # Nodes running the compute service
+      - name: compute
+        nodes:
+          - controller
+          - compute1
+          - compute2
+      # Nodes that are not the controller
+      - name: subnode
+        nodes:
+          - compute1
+          - compute2
+      # Switch node for multinode networking setup
+      - name: switch
+        nodes:
+          - controller
+      # Peer nodes for multinode networking setup
+      - name: peers
+        nodes:
+          - compute1
+          - compute2
+
 - job:
     name: devstack-base
     parent: multinode

From 0d83e09464551a8eb4ee5c66dc82de7053b14d70 Mon Sep 17 00:00:00 2001
From: ghanshyam <gmann@ghanshyammann.com>
Date: Wed, 27 Feb 2019 11:10:05 +0000
Subject: [PATCH 1487/2409] Use master upper-constraints when installing
 tempest plugins

when tempst venv is build, it use the master upper_contraint[1]
but when we install tempest plugin, it use branch upper_contraint.

This leads to mismatch the dependency version between tempest and required
tempest plugins setup.

Current flow after this change is:

1. install tempest form master (until you explicitly change TEMPEST_BRANCH
   which is default to master in all stable branch). It applies the upper_constraint
   from the stable branch but that will be overridden in step2
2. configure tempest, here the created venv will install all dependency with
   master's upper_constraint.
3. install tempest plugins in same venv created above. Now tempest plugin
   will also use the master upper_constraint.

With this tempest venv which has all enabled plugin will be contsraint with
master.

[1] https://github.com/openstack-dev/devstack/blob/72f632222f6d90d3545b5d7ca48297da4218e2ea/lib/tempest#L590

Change-Id: I89314e8391e8f26c622fc090cbe27997b3cf049a
Closes-Bug: #1816022
---
 lib/tempest | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index 7526d3bb4e..1e344c8567 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -673,7 +673,9 @@ function install_tempest {
 function install_tempest_plugins {
     pushd $TEMPEST_DIR
     if [[ $TEMPEST_PLUGINS != 0 ]] ; then
-        tox -evenv-tempest -- pip install -c $REQUIREMENTS_DIR/upper-constraints.txt $TEMPEST_PLUGINS
+        # The requirements might be on a different branch, while tempest & tempest plugins needs master requirements.
+        (cd $REQUIREMENTS_DIR && git show master:upper-constraints.txt) > u-c-m.txt
+        tox -evenv-tempest -- pip install -c u-c-m.txt $TEMPEST_PLUGINS
         echo "Checking installed Tempest plugins:"
         tox -evenv-tempest -- tempest list-plugins
     fi

From 55f172961a2b5422baa6ce3d9e46989c7902bbd1 Mon Sep 17 00:00:00 2001
From: Hongbin Lu <hongbin.lu@huawei.com>
Date: Tue, 20 Nov 2018 19:22:01 +0000
Subject: [PATCH 1488/2409] Revert "Revert "remove external_network_bridge
 option""

This reverts commit e3e9ea299601665a295e31a98e90dd9587165850.

Change-Id: I23e1b98bd2839b79226b55700ee404a8fda83f83
---
 lib/neutron                  | 3 ---
 lib/neutron_plugins/ovs_base | 4 ----
 2 files changed, 7 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 62f7366e7e..b2414cfb1b 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -95,9 +95,6 @@ NEUTRON_ROOTWRAP_CONF_FILE=$NEUTRON_CONF_DIR/rootwrap.conf
 NEUTRON_ROOTWRAP_CMD="$NEUTRON_ROOTWRAP $NEUTRON_ROOTWRAP_CONF_FILE"
 NEUTRON_ROOTWRAP_DAEMON_CMD="$NEUTRON_ROOTWRAP-daemon $NEUTRON_ROOTWRAP_CONF_FILE"
 
-# This is needed because _neutron_ovs_base_configure_l3_agent will set
-# external_network_bridge
-Q_USE_PROVIDERNET_FOR_PUBLIC=${Q_USE_PROVIDERNET_FOR_PUBLIC:-True}
 # This is needed because _neutron_ovs_base_configure_l3_agent uses it to create
 # an external network bridge
 PUBLIC_BRIDGE=${PUBLIC_BRIDGE:-br-ex}
diff --git a/lib/neutron_plugins/ovs_base b/lib/neutron_plugins/ovs_base
index fbe4c92139..2e63fe3c7b 100644
--- a/lib/neutron_plugins/ovs_base
+++ b/lib/neutron_plugins/ovs_base
@@ -96,10 +96,6 @@ function _neutron_ovs_base_configure_firewall_driver {
 }
 
 function _neutron_ovs_base_configure_l3_agent {
-    if [ "$Q_USE_PROVIDERNET_FOR_PUBLIC" != "True" ]; then
-        iniset $Q_L3_CONF_FILE DEFAULT external_network_bridge $PUBLIC_BRIDGE
-    fi
-
     neutron-ovs-cleanup --config-file $NEUTRON_CONF
     if [[ "$Q_USE_PUBLIC_VETH" = "True" ]]; then
         ip link show $Q_PUBLIC_VETH_INT > /dev/null 2>&1 ||

From 30d48ff88782347e5deb31369aa228f7345cfc6f Mon Sep 17 00:00:00 2001
From: Lance Bragstad <lbragstad@gmail.com>
Date: Wed, 12 Dec 2018 19:41:36 +0000
Subject: [PATCH 1489/2409] Remove admin_domain_scope tempest setting

Keystone is currently working through a bunch of changes to add proper
system, domain, and project scope support for its API. This includes
implementing ``admin``, ``member``, and ``reader`` roles for system,
domain, and project assignments. More informaiton on those specific
changes can be found here:

  https://review.openstack.org/#/q/(status:open+OR+status:closed)+project:openstack/keystone+branch:master+topic:implement-default-roles

One thing that was uncovered in implementing that support for the
project API was that setting tempest
``CONF.identity.admin_domain_scope = True`` meant domain admins of one
domain would be able to list projects in other domains, highlighted in
the following patch:

  https://review.openstack.org/#/c/624218/2

This commit doesn't set this option and assumes the proper
domain-scoping behavior being built into keystone natively.

Change-Id: I12a57cc43de0b17eababa19b7b94de5277689f82
Related-Bug: 1750660
---
 lib/tempest | 2 --
 1 file changed, 2 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 7526d3bb4e..e3ad7fed6a 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -276,8 +276,6 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG identity user_lockout_failure_attempts $KEYSTONE_LOCKOUT_FAILURE_ATTEMPTS
     iniset $TEMPEST_CONFIG identity user_lockout_duration $KEYSTONE_LOCKOUT_DURATION
     iniset $TEMPEST_CONFIG identity user_unique_last_password_count $KEYSTONE_UNIQUE_LAST_PASSWORD_COUNT
-    # Use domain scoped tokens for admin v3 tests, v3 dynamic credentials of v3 account generation
-    iniset $TEMPEST_CONFIG identity admin_domain_scope True
     if [[ "$TEMPEST_HAS_ADMIN" == "True" ]]; then
         iniset $TEMPEST_CONFIG auth admin_username $admin_username
         iniset $TEMPEST_CONFIG auth admin_password "$password"

From 8c5486993dec738a3e83746af2d62bdba648c999 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <sfinucan@redhat.com>
Date: Fri, 11 May 2018 16:12:17 +0530
Subject: [PATCH 1490/2409] Bump noVNC to 1.0.0

This introduces a breaking change in the URLs used to access the console
[1]. This is updated in both the documentation and linked nova change.

[1] https://github.com/novnc/noVNC/commit/83391ffc

Change-Id: I14a0be0034f4a76ab37eb90325967500c3bf1ff9
Depends-On: I9a50a111ff4911f4364a1b24d646095c72af3d2c
Related-bug: #1682020
---
 doc/source/guides/multinode-lab.rst |  2 +-
 lib/nova                            | 11 ++++++++++-
 stackrc                             |  2 +-
 3 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
index 7978cd86ea..5f5bb846eb 100644
--- a/doc/source/guides/multinode-lab.rst
+++ b/doc/source/guides/multinode-lab.rst
@@ -177,7 +177,7 @@ machines, create a ``local.conf`` with:
     GLANCE_HOSTPORT=$SERVICE_HOST:9292
     ENABLED_SERVICES=n-cpu,q-agt,n-api-meta,c-vol,placement-client
     NOVA_VNC_ENABLED=True
-    NOVNCPROXY_URL="http://$SERVICE_HOST:6080/vnc_auto.html"
+    NOVNCPROXY_URL="http://$SERVICE_HOST:6080/vnc_lite.html"
     VNCSERVER_LISTEN=$HOST_IP
     VNCSERVER_PROXYCLIENT_ADDRESS=$VNCSERVER_LISTEN
 
diff --git a/lib/nova b/lib/nova
index 033ebf3697..c892c96fce 100644
--- a/lib/nova
+++ b/lib/nova
@@ -614,7 +614,16 @@ function configure_console_compute {
     # All nova-compute workers need to know the vnc configuration options
     # These settings don't hurt anything if n-xvnc and n-novnc are disabled
     if is_service_enabled n-cpu; then
-        NOVNCPROXY_URL=${NOVNCPROXY_URL:-"http://$SERVICE_HOST:6080/vnc_auto.html"}
+        if [ "$NOVNC_FROM_PACKAGE" == "True" ]; then
+            # Use the old URL when installing novnc packages.
+            NOVNCPROXY_URL=${NOVNCPROXY_URL:-"http://$SERVICE_HOST:6080/vnc_auto.html"}
+        elif vercmp ${NOVNC_BRANCH} "<" "1.0.0"; then
+             # Use the old URL when installing older novnc source.
+            NOVNCPROXY_URL=${NOVNCPROXY_URL:-"http://$SERVICE_HOST:6080/vnc_auto.html"}
+        else
+            # Use the new URL when building >=v1.0.0 from source.
+            NOVNCPROXY_URL=${NOVNCPROXY_URL:-"http://$SERVICE_HOST:6080/vnc_lite.html"}
+        fi
         iniset $NOVA_CPU_CONF vnc novncproxy_base_url "$NOVNCPROXY_URL"
         XVPVNCPROXY_URL=${XVPVNCPROXY_URL:-"http://$SERVICE_HOST:6081/console"}
         iniset $NOVA_CPU_CONF vnc xvpvncproxy_base_url "$XVPVNCPROXY_URL"
diff --git a/stackrc b/stackrc
index 53868f3d9d..2705c327fa 100644
--- a/stackrc
+++ b/stackrc
@@ -608,7 +608,7 @@ IRONIC_PYTHON_AGENT_BRANCH=${IRONIC_PYTHON_AGENT_BRANCH:-$TARGET_BRANCH}
 
 # a websockets/html5 or flash powered VNC console for vm instances
 NOVNC_REPO=${NOVNC_REPO:-https://github.com/novnc/noVNC.git}
-NOVNC_BRANCH=${NOVNC_BRANCH:-stable/v0.6}
+NOVNC_BRANCH=${NOVNC_BRANCH:-v1.0.0}
 
 # a websockets/html5 or flash powered SPICE console for vm instances
 SPICE_REPO=${SPICE_REPO:-http://anongit.freedesktop.org/git/spice/spice-html5.git}

From c759706686abb421879148410adced34e44333f2 Mon Sep 17 00:00:00 2001
From: Sean Mooney <work@seanmooney.info>
Date: Thu, 28 Feb 2019 11:20:36 +0000
Subject: [PATCH 1491/2409] support python 3 on centos 7

when installing with python 3.6 on centos7 pip installs
packages to /usr/local/bin as it does on new versions
of fedora.

this change updates the check to include centos

Change-Id: I7d16194d6ba1391ca31251d5b50cbb8de033fc38
---
 inc/python | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/inc/python b/inc/python
index ec7eb5b9bb..419d5c5701 100644
--- a/inc/python
+++ b/inc/python
@@ -49,7 +49,8 @@ function get_python_exec_prefix {
     fi
     $xtrace
 
-    if python3_enabled && [[ "$os_VENDOR" == "Fedora" && $os_RELEASE -gt 26 ]]; then
+    if python3_enabled && [[ "$os_VENDOR" == "CentOS" ]] || \
+    [[ "$os_VENDOR" == "Fedora" && $os_RELEASE -gt 26 ]]; then
         # Default Python 3 install prefix changed to /usr/local in Fedora 27:
         # https://fedoraproject.org/wiki/Changes/Making_sudo_pip_safe
         echo "/usr/local/bin"

From 36773b262e79c1eb66432cc19862f2097d94ec65 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Thu, 28 Feb 2019 17:30:47 -0500
Subject: [PATCH 1492/2409] Document the wonders of scale testing nova with the
 fake driver

Devstack has some little known variables for running nova
with the fake compute driver and running several nova-compute
services on a single host, which can be useful for testing
move operations and scale testing of controller services like
nova-api and nova-scheduler.

This adds documentation about the fake virt driver and related
variables and scaling considerations when using them.

Change-Id: Ic89d463d0f3f180b323edd6e2c8ff0404638ef07
---
 doc/source/guides/nova.rst | 66 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 66 insertions(+)

diff --git a/doc/source/guides/nova.rst b/doc/source/guides/nova.rst
index 0f105d7c58..65491d13e8 100644
--- a/doc/source/guides/nova.rst
+++ b/doc/source/guides/nova.rst
@@ -68,3 +68,69 @@ These config options are defined in `nova.conf.serial_console
 For more information on OpenStack configuration see the `OpenStack
 Compute Service Configuration Reference
 <https://docs.openstack.org/nova/latest/admin/configuration/index.html>`_
+
+
+Fake virt driver
+================
+
+Nova has a `fake virt driver`_ which can be used for scale testing the control
+plane services or testing "move" operations between fake compute nodes, for
+example cold/live migration, evacuate and unshelve.
+
+The fake virt driver does not communicate with any hypervisor, it just reports
+some fake resource inventory values and keeps track of the state of the
+"guests" created, moved and deleted. It is not feature-complete with the
+compute API but is good enough for most API testing, and is also used within
+the nova functional tests themselves so is fairly robust.
+
+.. _fake virt driver: http://git.openstack.org/cgit/openstack/nova/tree/nova/virt/fake.py
+
+Configuration
+-------------
+
+Set the following in your devstack ``local.conf``:
+
+.. code-block:: ini
+
+  [[local|localrc]]
+  VIRT_DRIVER=fake
+  NUMBER_FAKE_NOVA_COMPUTE=<number>
+
+The ``NUMBER_FAKE_NOVA_COMPUTE`` variable controls the number of fake
+``nova-compute`` services to run and defaults to 1.
+
+When ``VIRT_DRIVER=fake`` is used, devstack will disable quota checking in
+nova and neutron automatically. However, other services, like cinder, will
+still enforce quota limits by default.
+
+Scaling
+-------
+
+The actual value to use for ``NUMBER_FAKE_NOVA_COMPUTE`` depends on factors
+such as:
+
+* The size of the host (physical or virtualized) on which devstack is running.
+* The number of API workers. By default, devstack will run ``max($nproc/2, 2)``
+  workers per API service. If you are running several fake compute services on
+  a single host, then consider setting ``API_WORKERS=1`` in ``local.conf``.
+
+In addition, while quota will be disabled in neutron, there is no fake ML2
+backend for neutron so creating fake VMs will still result in real ports being
+created. To create servers without networking, you can specify ``--nic=none``
+when creating the server, for example:
+
+.. code-block:: shell
+
+  $ openstack --os-compute-api-version 2.37 server create --flavor cirros256 \
+      --image cirros-0.3.5-x86_64-disk --nic none --wait test-server
+
+.. note:: ``--os-compute-api-version`` greater than or equal to 2.37 is
+          required to use ``--nic=none``.
+
+To avoid overhead from other services which you may not need, disable them in
+your ``local.conf``, for example:
+
+.. code-block:: ini
+
+  disable_service horizon
+  disable_service tempest

From 56946cfc5f88d8df3b4b9a1a2530ce2cc9a68cde Mon Sep 17 00:00:00 2001
From: Nate Johnston <nate.johnston@redhat.com>
Date: Mon, 12 Nov 2018 11:17:07 -0500
Subject: [PATCH 1493/2409] Replace deprecated brctl with ip commands

The bridge-utils package has been deprecated for some time now [1] and
'brctl' does not exist on some more recent distros like Fedora 28.
Replace references to brctl with the proper ip commands.

Calls to "brctl show" are not being replaced with calls to "bridge link"
because the output format is very different and in testing some bridges
were not listed.  So the simpler method of consulting /sys/class/net is
used.

In worlddump.py we try running both because failures are handled
gracefully by _dump_cmd(), as well as "ip link show type bridge" for
additional info.

[1] https://lwn.net/Articles/703776/ for example

Change-Id: Ie4c8ad6ce4a09c38023c9e4ec7834c249403145f
Partial-Bug: #1801919
---
 doc/source/guides/multinode-lab.rst   | 11 -----------
 lib/neutron_plugins/linuxbridge_agent | 16 +++++++++-------
 tools/worlddump.py                    |  2 ++
 3 files changed, 11 insertions(+), 18 deletions(-)

diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
index b4e2891c10..05dd36edc0 100644
--- a/doc/source/guides/multinode-lab.rst
+++ b/doc/source/guides/multinode-lab.rst
@@ -369,17 +369,6 @@ To pull glance, OpenStack Image service, from an experimental fork:
 Notes stuff you might need to know
 ==================================
 
-Reset the Bridge
-----------------
-
-How to reset the bridge configuration:
-
-::
-
-    sudo brctl delif br100 eth0.926
-    sudo ip link set dev br100 down
-    sudo brctl delbr br100
-
 Set MySQL Password
 ------------------
 
diff --git a/lib/neutron_plugins/linuxbridge_agent b/lib/neutron_plugins/linuxbridge_agent
index f2302e37bf..fa3f86203d 100644
--- a/lib/neutron_plugins/linuxbridge_agent
+++ b/lib/neutron_plugins/linuxbridge_agent
@@ -8,21 +8,23 @@ _XTRACE_NEUTRON_LB=$(set +o | grep xtrace)
 set +o xtrace
 
 function neutron_lb_cleanup {
-    sudo ip link set $PUBLIC_BRIDGE down
-    sudo brctl delbr $PUBLIC_BRIDGE
+    sudo ip link delete $PUBLIC_BRIDGE
 
+    bridge_list=`ls /sys/class/net/*/bridge/bridge_id 2>/dev/null | cut -f5 -d/`
+    if [[ -z "$bridge_list" ]]; then
+        return
+    fi
     if [[ "$Q_ML2_TENANT_NETWORK_TYPE" = "vxlan" ]]; then
-        for port in $(sudo brctl show | grep -o -e [a-zA-Z\-]*tap[0-9a-f\-]* -e vxlan-[0-9a-f\-]*); do
+        for port in $(echo $bridge_list | grep -o -e [a-zA-Z\-]*tap[0-9a-f\-]* -e vxlan-[0-9a-f\-]*); do
             sudo ip link delete $port
         done
     elif [[ "$Q_ML2_TENANT_NETWORK_TYPE" = "vlan" ]]; then
-        for port in $(sudo brctl show | grep -o -e [a-zA-Z\-]*tap[0-9a-f\-]* -e ${LB_PHYSICAL_INTERFACE}\.[0-9a-f\-]*); do
+        for port in $(echo $bridge_list | grep -o -e [a-zA-Z\-]*tap[0-9a-f\-]* -e ${LB_PHYSICAL_INTERFACE}\.[0-9a-f\-]*); do
             sudo ip link delete $port
         done
     fi
-    for bridge in $(sudo brctl show |grep -o -e brq[0-9a-f\-]*); do
-        sudo ip link set $bridge down
-        sudo brctl delbr $bridge
+    for bridge in $(echo $bridge_list |grep -o -e brq[0-9a-f\-]*); do
+        sudo ip link delete $bridge
     done
 }
 
diff --git a/tools/worlddump.py b/tools/worlddump.py
index 750608210a..88af19d2e3 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -163,7 +163,9 @@ def _netns_list():
 def network_dump():
     _header("Network Dump")
 
+    _dump_cmd("bridge link")
     _dump_cmd("brctl show")
+    _dump_cmd("ip link show type bridge")
     ip_cmds = ["neigh", "addr", "link", "route"]
     for cmd in ip_cmds + ['netns']:
         _dump_cmd("ip %s" % cmd)

From 5488336545ddc2dadadfae61a0367074cc16e5e2 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Sat, 2 Mar 2019 06:14:21 +0000
Subject: [PATCH 1494/2409] Updated from generate-devstack-plugins-list

Change-Id: I3a9cbc9186b7555227f0ddef3da134e98b6cfc15
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 9901c1ca39..ee278c7150 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -161,6 +161,7 @@ qinling                                `git://git.openstack.org/openstack/qinlin
 qinling-dashboard                      `git://git.openstack.org/openstack/qinling-dashboard <https://git.openstack.org/cgit/openstack/qinling-dashboard>`__
 rally                                  `git://git.openstack.org/openstack/rally <https://git.openstack.org/cgit/openstack/rally>`__
 rally-openstack                        `git://git.openstack.org/openstack/rally-openstack <https://git.openstack.org/cgit/openstack/rally-openstack>`__
+rsd-virt-for-nova                      `git://git.openstack.org/openstack/rsd-virt-for-nova <https://git.openstack.org/cgit/openstack/rsd-virt-for-nova>`__
 sahara                                 `git://git.openstack.org/openstack/sahara <https://git.openstack.org/cgit/openstack/sahara>`__
 sahara-dashboard                       `git://git.openstack.org/openstack/sahara-dashboard <https://git.openstack.org/cgit/openstack/sahara-dashboard>`__
 scalpels                               `git://git.openstack.org/openstack/scalpels <https://git.openstack.org/cgit/openstack/scalpels>`__

From 8b003e0ed2f41fb1ab0007c969bba33c5701f625 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 4 Mar 2019 16:50:42 +1100
Subject: [PATCH 1495/2409] Switch GIT_BASE to https://

Infra are looking at implementing gitea for serving git, but this does
not have a git protocol handler ATM.  Switch GIT_BASE, and some
testing, to https:// to be in a better position to handle this.

Change-Id: I97a7b0de7b1ec2dd15d15c58699a631b09273df1
Story: #2004627
Task: #29701
---
 roles/write-devstack-local-conf/library/test.py | 14 +++++++-------
 stackrc                                         |  3 +--
 2 files changed, 8 insertions(+), 9 deletions(-)

diff --git a/roles/write-devstack-local-conf/library/test.py b/roles/write-devstack-local-conf/library/test.py
index 88d404b856..45fae3da28 100644
--- a/roles/write-devstack-local-conf/library/test.py
+++ b/roles/write-devstack-local-conf/library/test.py
@@ -40,9 +40,9 @@ def test_plugins(self):
         # We use ordereddict here to make sure the plugins are in the
         # *wrong* order for testing.
         plugins = OrderedDict([
-            ('bar', 'git://git.openstack.org/openstack/bar-plugin'),
-            ('foo', 'git://git.openstack.org/openstack/foo-plugin'),
-            ('baz', 'git://git.openstack.org/openstack/baz-plugin'),
+            ('bar', 'https://git.openstack.org/openstack/bar-plugin'),
+            ('foo', 'https://git.openstack.org/openstack/foo-plugin'),
+            ('baz', 'https://git.openstack.org/openstack/baz-plugin'),
             ])
         p = dict(localrc=localrc,
                  local_conf=local_conf,
@@ -94,8 +94,8 @@ def test_plugin_deps(self):
         # We use ordereddict here to make sure the plugins are in the
         # *wrong* order for testing.
         plugins = OrderedDict([
-            ('bar-plugin', 'git://git.openstack.org/openstack/bar-plugin'),
-            ('foo-plugin', 'git://git.openstack.org/openstack/foo-plugin'),
+            ('bar-plugin', 'https://git.openstack.org/openstack/bar-plugin'),
+            ('foo-plugin', 'https://git.openstack.org/openstack/foo-plugin'),
             ])
         p = dict(localrc=localrc,
                  local_conf=local_conf,
@@ -227,8 +227,8 @@ def test_plugin_circular_deps(self):
         # We use ordereddict here to make sure the plugins are in the
         # *wrong* order for testing.
         plugins = OrderedDict([
-            ('bar', 'git://git.openstack.org/openstack/bar-plugin'),
-            ('foo', 'git://git.openstack.org/openstack/foo-plugin'),
+            ('bar', 'https://git.openstack.org/openstack/bar-plugin'),
+            ('foo', 'https://git.openstack.org/openstack/foo-plugin'),
             ])
         p = dict(localrc=localrc,
                  local_conf=local_conf,
diff --git a/stackrc b/stackrc
index 53868f3d9d..652f2de0d5 100644
--- a/stackrc
+++ b/stackrc
@@ -237,8 +237,7 @@ WSGI_MODE=${WSGI_MODE:-"uwsgi"}
 # ------------
 
 # Base GIT Repo URL
-# Another option is https://git.openstack.org
-GIT_BASE=${GIT_BASE:-git://git.openstack.org}
+GIT_BASE=${GIT_BASE:-https://git.openstack.org}
 
 # The location of REQUIREMENTS once cloned
 REQUIREMENTS_DIR=$DEST/requirements

From 6509fd334e0956dc44870d19a80381578e3e3574 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 4 Mar 2019 17:26:20 +1100
Subject: [PATCH 1496/2409] Remove git:// openstack references

This updates various parts of documentation to use https, rather than
git, which is not implemented by gitea

Change-Id: I8d2a93128dcdaba0a00b43d18652781733f90cf0
Story: #2004627
Task: #29701
---
 README.rst                              |   2 +-
 doc/source/guides/neutron.rst           |   4 +-
 doc/source/plugin-registry.rst          | 352 ++++++++++++------------
 doc/source/plugins.rst                  |   4 +-
 tools/generate-devstack-plugins-list.sh |   4 +-
 5 files changed, 183 insertions(+), 183 deletions(-)

diff --git a/README.rst b/README.rst
index 6885546c94..ad7ede45c5 100644
--- a/README.rst
+++ b/README.rst
@@ -38,7 +38,7 @@ You can also pick specific OpenStack project releases by setting the appropriate
 `stackrc` for the default set).  Usually just before a release there will be
 milestone-proposed branches that need to be tested::
 
-    GLANCE_REPO=git://git.openstack.org/openstack/glance.git
+    GLANCE_REPO=https://git.openstack.org/openstack/glance.git
     GLANCE_BRANCH=milestone-proposed
 
 Start A Dev Cloud
diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index 12c6d6902d..80b2f85285 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -567,7 +567,7 @@ you do not require them.
     Q_ML2_PLUGIN_MECHANISM_DRIVERS=macvtap
     Q_USE_PROVIDER_NETWORKING=True
 
-    enable_plugin neutron git://git.openstack.org/openstack/neutron
+    enable_plugin neutron https://git.openstack.org/openstack/neutron
 
     ## MacVTap agent options
     Q_AGENT=macvtap
@@ -622,7 +622,7 @@ For the MacVTap compute node, use this local.conf:
 
     # Services that a compute node runs
     disable_all_services
-    enable_plugin neutron git://git.openstack.org/openstack/neutron
+    enable_plugin neutron https://git.openstack.org/openstack/neutron
     ENABLED_SERVICES+=n-cpu,q-agt
 
     ## MacVTap agent options
diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index ee278c7150..9338d18819 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -24,182 +24,182 @@ official OpenStack projects.
 ====================================== ===
 Plugin Name                            URL
 ====================================== ===
-almanach                               `git://git.openstack.org/openstack/almanach <https://git.openstack.org/cgit/openstack/almanach>`__
-aodh                                   `git://git.openstack.org/openstack/aodh <https://git.openstack.org/cgit/openstack/aodh>`__
-apmec                                  `git://git.openstack.org/openstack/apmec <https://git.openstack.org/cgit/openstack/apmec>`__
-barbican                               `git://git.openstack.org/openstack/barbican <https://git.openstack.org/cgit/openstack/barbican>`__
-bilean                                 `git://git.openstack.org/openstack/bilean <https://git.openstack.org/cgit/openstack/bilean>`__
-blazar                                 `git://git.openstack.org/openstack/blazar <https://git.openstack.org/cgit/openstack/blazar>`__
-broadview-collector                    `git://git.openstack.org/openstack/broadview-collector <https://git.openstack.org/cgit/openstack/broadview-collector>`__
-castellan-ui                           `git://git.openstack.org/openstack/castellan-ui <https://git.openstack.org/cgit/openstack/castellan-ui>`__
-ceilometer                             `git://git.openstack.org/openstack/ceilometer <https://git.openstack.org/cgit/openstack/ceilometer>`__
-ceilometer-powervm                     `git://git.openstack.org/openstack/ceilometer-powervm <https://git.openstack.org/cgit/openstack/ceilometer-powervm>`__
-cloudkitty                             `git://git.openstack.org/openstack/cloudkitty <https://git.openstack.org/cgit/openstack/cloudkitty>`__
-collectd-openstack-plugins             `git://git.openstack.org/openstack/collectd-openstack-plugins <https://git.openstack.org/cgit/openstack/collectd-openstack-plugins>`__
-congress                               `git://git.openstack.org/openstack/congress <https://git.openstack.org/cgit/openstack/congress>`__
-cyborg                                 `git://git.openstack.org/openstack/cyborg <https://git.openstack.org/cgit/openstack/cyborg>`__
-designate                              `git://git.openstack.org/openstack/designate <https://git.openstack.org/cgit/openstack/designate>`__
-devstack-plugin-additional-pkg-repos   `git://git.openstack.org/openstack/devstack-plugin-additional-pkg-repos <https://git.openstack.org/cgit/openstack/devstack-plugin-additional-pkg-repos>`__
-devstack-plugin-amqp1                  `git://git.openstack.org/openstack/devstack-plugin-amqp1 <https://git.openstack.org/cgit/openstack/devstack-plugin-amqp1>`__
-devstack-plugin-bdd                    `git://git.openstack.org/openstack/devstack-plugin-bdd <https://git.openstack.org/cgit/openstack/devstack-plugin-bdd>`__
-devstack-plugin-ceph                   `git://git.openstack.org/openstack/devstack-plugin-ceph <https://git.openstack.org/cgit/openstack/devstack-plugin-ceph>`__
-devstack-plugin-container              `git://git.openstack.org/openstack/devstack-plugin-container <https://git.openstack.org/cgit/openstack/devstack-plugin-container>`__
-devstack-plugin-glusterfs              `git://git.openstack.org/openstack/devstack-plugin-glusterfs <https://git.openstack.org/cgit/openstack/devstack-plugin-glusterfs>`__
-devstack-plugin-hdfs                   `git://git.openstack.org/openstack/devstack-plugin-hdfs <https://git.openstack.org/cgit/openstack/devstack-plugin-hdfs>`__
-devstack-plugin-kafka                  `git://git.openstack.org/openstack/devstack-plugin-kafka <https://git.openstack.org/cgit/openstack/devstack-plugin-kafka>`__
-devstack-plugin-libvirt-qemu           `git://git.openstack.org/openstack/devstack-plugin-libvirt-qemu <https://git.openstack.org/cgit/openstack/devstack-plugin-libvirt-qemu>`__
-devstack-plugin-mariadb                `git://git.openstack.org/openstack/devstack-plugin-mariadb <https://git.openstack.org/cgit/openstack/devstack-plugin-mariadb>`__
-devstack-plugin-nfs                    `git://git.openstack.org/openstack/devstack-plugin-nfs <https://git.openstack.org/cgit/openstack/devstack-plugin-nfs>`__
-devstack-plugin-pika                   `git://git.openstack.org/openstack/devstack-plugin-pika <https://git.openstack.org/cgit/openstack/devstack-plugin-pika>`__
-devstack-plugin-sheepdog               `git://git.openstack.org/openstack/devstack-plugin-sheepdog <https://git.openstack.org/cgit/openstack/devstack-plugin-sheepdog>`__
-devstack-plugin-vmax                   `git://git.openstack.org/openstack/devstack-plugin-vmax <https://git.openstack.org/cgit/openstack/devstack-plugin-vmax>`__
-devstack-plugin-zmq                    `git://git.openstack.org/openstack/devstack-plugin-zmq <https://git.openstack.org/cgit/openstack/devstack-plugin-zmq>`__
-dragonflow                             `git://git.openstack.org/openstack/dragonflow <https://git.openstack.org/cgit/openstack/dragonflow>`__
-drbd-devstack                          `git://git.openstack.org/openstack/drbd-devstack <https://git.openstack.org/cgit/openstack/drbd-devstack>`__
-ec2-api                                `git://git.openstack.org/openstack/ec2-api <https://git.openstack.org/cgit/openstack/ec2-api>`__
-freezer                                `git://git.openstack.org/openstack/freezer <https://git.openstack.org/cgit/openstack/freezer>`__
-freezer-api                            `git://git.openstack.org/openstack/freezer-api <https://git.openstack.org/cgit/openstack/freezer-api>`__
-freezer-tempest-plugin                 `git://git.openstack.org/openstack/freezer-tempest-plugin <https://git.openstack.org/cgit/openstack/freezer-tempest-plugin>`__
-freezer-web-ui                         `git://git.openstack.org/openstack/freezer-web-ui <https://git.openstack.org/cgit/openstack/freezer-web-ui>`__
-gce-api                                `git://git.openstack.org/openstack/gce-api <https://git.openstack.org/cgit/openstack/gce-api>`__
-glare                                  `git://git.openstack.org/openstack/glare <https://git.openstack.org/cgit/openstack/glare>`__
-group-based-policy                     `git://git.openstack.org/openstack/group-based-policy <https://git.openstack.org/cgit/openstack/group-based-policy>`__
-gyan                                   `git://git.openstack.org/openstack/gyan <https://git.openstack.org/cgit/openstack/gyan>`__
-heat                                   `git://git.openstack.org/openstack/heat <https://git.openstack.org/cgit/openstack/heat>`__
-heat-dashboard                         `git://git.openstack.org/openstack/heat-dashboard <https://git.openstack.org/cgit/openstack/heat-dashboard>`__
-horizon-mellanox                       `git://git.openstack.org/openstack/horizon-mellanox <https://git.openstack.org/cgit/openstack/horizon-mellanox>`__
-ironic                                 `git://git.openstack.org/openstack/ironic <https://git.openstack.org/cgit/openstack/ironic>`__
-ironic-inspector                       `git://git.openstack.org/openstack/ironic-inspector <https://git.openstack.org/cgit/openstack/ironic-inspector>`__
-ironic-staging-drivers                 `git://git.openstack.org/openstack/ironic-staging-drivers <https://git.openstack.org/cgit/openstack/ironic-staging-drivers>`__
-ironic-ui                              `git://git.openstack.org/openstack/ironic-ui <https://git.openstack.org/cgit/openstack/ironic-ui>`__
-karbor                                 `git://git.openstack.org/openstack/karbor <https://git.openstack.org/cgit/openstack/karbor>`__
-karbor-dashboard                       `git://git.openstack.org/openstack/karbor-dashboard <https://git.openstack.org/cgit/openstack/karbor-dashboard>`__
-keystone                               `git://git.openstack.org/openstack/keystone <https://git.openstack.org/cgit/openstack/keystone>`__
-kingbird                               `git://git.openstack.org/openstack/kingbird <https://git.openstack.org/cgit/openstack/kingbird>`__
-kuryr-kubernetes                       `git://git.openstack.org/openstack/kuryr-kubernetes <https://git.openstack.org/cgit/openstack/kuryr-kubernetes>`__
-kuryr-libnetwork                       `git://git.openstack.org/openstack/kuryr-libnetwork <https://git.openstack.org/cgit/openstack/kuryr-libnetwork>`__
-kuryr-tempest-plugin                   `git://git.openstack.org/openstack/kuryr-tempest-plugin <https://git.openstack.org/cgit/openstack/kuryr-tempest-plugin>`__
-magnum                                 `git://git.openstack.org/openstack/magnum <https://git.openstack.org/cgit/openstack/magnum>`__
-magnum-ui                              `git://git.openstack.org/openstack/magnum-ui <https://git.openstack.org/cgit/openstack/magnum-ui>`__
-manila                                 `git://git.openstack.org/openstack/manila <https://git.openstack.org/cgit/openstack/manila>`__
-manila-ui                              `git://git.openstack.org/openstack/manila-ui <https://git.openstack.org/cgit/openstack/manila-ui>`__
-masakari                               `git://git.openstack.org/openstack/masakari <https://git.openstack.org/cgit/openstack/masakari>`__
-meteos                                 `git://git.openstack.org/openstack/meteos <https://git.openstack.org/cgit/openstack/meteos>`__
-meteos-ui                              `git://git.openstack.org/openstack/meteos-ui <https://git.openstack.org/cgit/openstack/meteos-ui>`__
-mistral                                `git://git.openstack.org/openstack/mistral <https://git.openstack.org/cgit/openstack/mistral>`__
-mixmatch                               `git://git.openstack.org/openstack/mixmatch <https://git.openstack.org/cgit/openstack/mixmatch>`__
-mogan                                  `git://git.openstack.org/openstack/mogan <https://git.openstack.org/cgit/openstack/mogan>`__
-mogan-ui                               `git://git.openstack.org/openstack/mogan-ui <https://git.openstack.org/cgit/openstack/mogan-ui>`__
-monasca-analytics                      `git://git.openstack.org/openstack/monasca-analytics <https://git.openstack.org/cgit/openstack/monasca-analytics>`__
-monasca-api                            `git://git.openstack.org/openstack/monasca-api <https://git.openstack.org/cgit/openstack/monasca-api>`__
-monasca-ceilometer                     `git://git.openstack.org/openstack/monasca-ceilometer <https://git.openstack.org/cgit/openstack/monasca-ceilometer>`__
-monasca-events-api                     `git://git.openstack.org/openstack/monasca-events-api <https://git.openstack.org/cgit/openstack/monasca-events-api>`__
-monasca-log-api                        `git://git.openstack.org/openstack/monasca-log-api <https://git.openstack.org/cgit/openstack/monasca-log-api>`__
-monasca-tempest-plugin                 `git://git.openstack.org/openstack/monasca-tempest-plugin <https://git.openstack.org/cgit/openstack/monasca-tempest-plugin>`__
-monasca-transform                      `git://git.openstack.org/openstack/monasca-transform <https://git.openstack.org/cgit/openstack/monasca-transform>`__
-murano                                 `git://git.openstack.org/openstack/murano <https://git.openstack.org/cgit/openstack/murano>`__
-networking-6wind                       `git://git.openstack.org/openstack/networking-6wind <https://git.openstack.org/cgit/openstack/networking-6wind>`__
-networking-ansible                     `git://git.openstack.org/openstack/networking-ansible <https://git.openstack.org/cgit/openstack/networking-ansible>`__
-networking-arista                      `git://git.openstack.org/openstack/networking-arista <https://git.openstack.org/cgit/openstack/networking-arista>`__
-networking-bagpipe                     `git://git.openstack.org/openstack/networking-bagpipe <https://git.openstack.org/cgit/openstack/networking-bagpipe>`__
-networking-baremetal                   `git://git.openstack.org/openstack/networking-baremetal <https://git.openstack.org/cgit/openstack/networking-baremetal>`__
-networking-bgpvpn                      `git://git.openstack.org/openstack/networking-bgpvpn <https://git.openstack.org/cgit/openstack/networking-bgpvpn>`__
-networking-brocade                     `git://git.openstack.org/openstack/networking-brocade <https://git.openstack.org/cgit/openstack/networking-brocade>`__
-networking-calico                      `git://git.openstack.org/openstack/networking-calico <https://git.openstack.org/cgit/openstack/networking-calico>`__
-networking-cisco                       `git://git.openstack.org/openstack/networking-cisco <https://git.openstack.org/cgit/openstack/networking-cisco>`__
-networking-cumulus                     `git://git.openstack.org/openstack/networking-cumulus <https://git.openstack.org/cgit/openstack/networking-cumulus>`__
-networking-dpm                         `git://git.openstack.org/openstack/networking-dpm <https://git.openstack.org/cgit/openstack/networking-dpm>`__
-networking-fortinet                    `git://git.openstack.org/openstack/networking-fortinet <https://git.openstack.org/cgit/openstack/networking-fortinet>`__
-networking-generic-switch              `git://git.openstack.org/openstack/networking-generic-switch <https://git.openstack.org/cgit/openstack/networking-generic-switch>`__
-networking-hpe                         `git://git.openstack.org/openstack/networking-hpe <https://git.openstack.org/cgit/openstack/networking-hpe>`__
-networking-huawei                      `git://git.openstack.org/openstack/networking-huawei <https://git.openstack.org/cgit/openstack/networking-huawei>`__
-networking-hyperv                      `git://git.openstack.org/openstack/networking-hyperv <https://git.openstack.org/cgit/openstack/networking-hyperv>`__
-networking-infoblox                    `git://git.openstack.org/openstack/networking-infoblox <https://git.openstack.org/cgit/openstack/networking-infoblox>`__
-networking-l2gw                        `git://git.openstack.org/openstack/networking-l2gw <https://git.openstack.org/cgit/openstack/networking-l2gw>`__
-networking-lagopus                     `git://git.openstack.org/openstack/networking-lagopus <https://git.openstack.org/cgit/openstack/networking-lagopus>`__
-networking-midonet                     `git://git.openstack.org/openstack/networking-midonet <https://git.openstack.org/cgit/openstack/networking-midonet>`__
-networking-mlnx                        `git://git.openstack.org/openstack/networking-mlnx <https://git.openstack.org/cgit/openstack/networking-mlnx>`__
-networking-nec                         `git://git.openstack.org/openstack/networking-nec <https://git.openstack.org/cgit/openstack/networking-nec>`__
-networking-odl                         `git://git.openstack.org/openstack/networking-odl <https://git.openstack.org/cgit/openstack/networking-odl>`__
-networking-onos                        `git://git.openstack.org/openstack/networking-onos <https://git.openstack.org/cgit/openstack/networking-onos>`__
-networking-opencontrail                `git://git.openstack.org/openstack/networking-opencontrail <https://git.openstack.org/cgit/openstack/networking-opencontrail>`__
-networking-ovn                         `git://git.openstack.org/openstack/networking-ovn <https://git.openstack.org/cgit/openstack/networking-ovn>`__
-networking-ovs-dpdk                    `git://git.openstack.org/openstack/networking-ovs-dpdk <https://git.openstack.org/cgit/openstack/networking-ovs-dpdk>`__
-networking-plumgrid                    `git://git.openstack.org/openstack/networking-plumgrid <https://git.openstack.org/cgit/openstack/networking-plumgrid>`__
-networking-powervm                     `git://git.openstack.org/openstack/networking-powervm <https://git.openstack.org/cgit/openstack/networking-powervm>`__
-networking-sfc                         `git://git.openstack.org/openstack/networking-sfc <https://git.openstack.org/cgit/openstack/networking-sfc>`__
-networking-spp                         `git://git.openstack.org/openstack/networking-spp <https://git.openstack.org/cgit/openstack/networking-spp>`__
-networking-vpp                         `git://git.openstack.org/openstack/networking-vpp <https://git.openstack.org/cgit/openstack/networking-vpp>`__
-networking-vsphere                     `git://git.openstack.org/openstack/networking-vsphere <https://git.openstack.org/cgit/openstack/networking-vsphere>`__
-neutron                                `git://git.openstack.org/openstack/neutron <https://git.openstack.org/cgit/openstack/neutron>`__
-neutron-classifier                     `git://git.openstack.org/openstack/neutron-classifier <https://git.openstack.org/cgit/openstack/neutron-classifier>`__
-neutron-dynamic-routing                `git://git.openstack.org/openstack/neutron-dynamic-routing <https://git.openstack.org/cgit/openstack/neutron-dynamic-routing>`__
-neutron-fwaas                          `git://git.openstack.org/openstack/neutron-fwaas <https://git.openstack.org/cgit/openstack/neutron-fwaas>`__
-neutron-fwaas-dashboard                `git://git.openstack.org/openstack/neutron-fwaas-dashboard <https://git.openstack.org/cgit/openstack/neutron-fwaas-dashboard>`__
-neutron-lbaas                          `git://git.openstack.org/openstack/neutron-lbaas <https://git.openstack.org/cgit/openstack/neutron-lbaas>`__
-neutron-lbaas-dashboard                `git://git.openstack.org/openstack/neutron-lbaas-dashboard <https://git.openstack.org/cgit/openstack/neutron-lbaas-dashboard>`__
-neutron-tempest-plugin                 `git://git.openstack.org/openstack/neutron-tempest-plugin <https://git.openstack.org/cgit/openstack/neutron-tempest-plugin>`__
-neutron-vpnaas                         `git://git.openstack.org/openstack/neutron-vpnaas <https://git.openstack.org/cgit/openstack/neutron-vpnaas>`__
-neutron-vpnaas-dashboard               `git://git.openstack.org/openstack/neutron-vpnaas-dashboard <https://git.openstack.org/cgit/openstack/neutron-vpnaas-dashboard>`__
-nova-dpm                               `git://git.openstack.org/openstack/nova-dpm <https://git.openstack.org/cgit/openstack/nova-dpm>`__
-nova-lxd                               `git://git.openstack.org/openstack/nova-lxd <https://git.openstack.org/cgit/openstack/nova-lxd>`__
-nova-mksproxy                          `git://git.openstack.org/openstack/nova-mksproxy <https://git.openstack.org/cgit/openstack/nova-mksproxy>`__
-nova-powervm                           `git://git.openstack.org/openstack/nova-powervm <https://git.openstack.org/cgit/openstack/nova-powervm>`__
-oaktree                                `git://git.openstack.org/openstack/oaktree <https://git.openstack.org/cgit/openstack/oaktree>`__
-octavia                                `git://git.openstack.org/openstack/octavia <https://git.openstack.org/cgit/openstack/octavia>`__
-octavia-dashboard                      `git://git.openstack.org/openstack/octavia-dashboard <https://git.openstack.org/cgit/openstack/octavia-dashboard>`__
-omni                                   `git://git.openstack.org/openstack/omni <https://git.openstack.org/cgit/openstack/omni>`__
-openstacksdk                           `git://git.openstack.org/openstack/openstacksdk <https://git.openstack.org/cgit/openstack/openstacksdk>`__
-os-faults                              `git://git.openstack.org/openstack/os-faults <https://git.openstack.org/cgit/openstack/os-faults>`__
-os-xenapi                              `git://git.openstack.org/openstack/os-xenapi <https://git.openstack.org/cgit/openstack/os-xenapi>`__
-osprofiler                             `git://git.openstack.org/openstack/osprofiler <https://git.openstack.org/cgit/openstack/osprofiler>`__
-oswin-tempest-plugin                   `git://git.openstack.org/openstack/oswin-tempest-plugin <https://git.openstack.org/cgit/openstack/oswin-tempest-plugin>`__
-panko                                  `git://git.openstack.org/openstack/panko <https://git.openstack.org/cgit/openstack/panko>`__
-patrole                                `git://git.openstack.org/openstack/patrole <https://git.openstack.org/cgit/openstack/patrole>`__
-picasso                                `git://git.openstack.org/openstack/picasso <https://git.openstack.org/cgit/openstack/picasso>`__
-qinling                                `git://git.openstack.org/openstack/qinling <https://git.openstack.org/cgit/openstack/qinling>`__
-qinling-dashboard                      `git://git.openstack.org/openstack/qinling-dashboard <https://git.openstack.org/cgit/openstack/qinling-dashboard>`__
-rally                                  `git://git.openstack.org/openstack/rally <https://git.openstack.org/cgit/openstack/rally>`__
-rally-openstack                        `git://git.openstack.org/openstack/rally-openstack <https://git.openstack.org/cgit/openstack/rally-openstack>`__
-rsd-virt-for-nova                      `git://git.openstack.org/openstack/rsd-virt-for-nova <https://git.openstack.org/cgit/openstack/rsd-virt-for-nova>`__
-sahara                                 `git://git.openstack.org/openstack/sahara <https://git.openstack.org/cgit/openstack/sahara>`__
-sahara-dashboard                       `git://git.openstack.org/openstack/sahara-dashboard <https://git.openstack.org/cgit/openstack/sahara-dashboard>`__
-scalpels                               `git://git.openstack.org/openstack/scalpels <https://git.openstack.org/cgit/openstack/scalpels>`__
-searchlight                            `git://git.openstack.org/openstack/searchlight <https://git.openstack.org/cgit/openstack/searchlight>`__
-searchlight-ui                         `git://git.openstack.org/openstack/searchlight-ui <https://git.openstack.org/cgit/openstack/searchlight-ui>`__
-senlin                                 `git://git.openstack.org/openstack/senlin <https://git.openstack.org/cgit/openstack/senlin>`__
-slogging                               `git://git.openstack.org/openstack/slogging <https://git.openstack.org/cgit/openstack/slogging>`__
-solum                                  `git://git.openstack.org/openstack/solum <https://git.openstack.org/cgit/openstack/solum>`__
-stackube                               `git://git.openstack.org/openstack/stackube <https://git.openstack.org/cgit/openstack/stackube>`__
-storlets                               `git://git.openstack.org/openstack/storlets <https://git.openstack.org/cgit/openstack/storlets>`__
-stx-config                             `git://git.openstack.org/openstack/stx-config <https://git.openstack.org/cgit/openstack/stx-config>`__
-stx-fault                              `git://git.openstack.org/openstack/stx-fault <https://git.openstack.org/cgit/openstack/stx-fault>`__
-stx-integ                              `git://git.openstack.org/openstack/stx-integ <https://git.openstack.org/cgit/openstack/stx-integ>`__
-stx-metal                              `git://git.openstack.org/openstack/stx-metal <https://git.openstack.org/cgit/openstack/stx-metal>`__
-stx-nfv                                `git://git.openstack.org/openstack/stx-nfv <https://git.openstack.org/cgit/openstack/stx-nfv>`__
-stx-update                             `git://git.openstack.org/openstack/stx-update <https://git.openstack.org/cgit/openstack/stx-update>`__
-tacker                                 `git://git.openstack.org/openstack/tacker <https://git.openstack.org/cgit/openstack/tacker>`__
-tap-as-a-service                       `git://git.openstack.org/openstack/tap-as-a-service <https://git.openstack.org/cgit/openstack/tap-as-a-service>`__
-tap-as-a-service-dashboard             `git://git.openstack.org/openstack/tap-as-a-service-dashboard <https://git.openstack.org/cgit/openstack/tap-as-a-service-dashboard>`__
-tatu                                   `git://git.openstack.org/openstack/tatu <https://git.openstack.org/cgit/openstack/tatu>`__
-telemetry-tempest-plugin               `git://git.openstack.org/openstack/telemetry-tempest-plugin <https://git.openstack.org/cgit/openstack/telemetry-tempest-plugin>`__
-tobiko                                 `git://git.openstack.org/openstack/tobiko <https://git.openstack.org/cgit/openstack/tobiko>`__
-tricircle                              `git://git.openstack.org/openstack/tricircle <https://git.openstack.org/cgit/openstack/tricircle>`__
-trio2o                                 `git://git.openstack.org/openstack/trio2o <https://git.openstack.org/cgit/openstack/trio2o>`__
-trove                                  `git://git.openstack.org/openstack/trove <https://git.openstack.org/cgit/openstack/trove>`__
-trove-dashboard                        `git://git.openstack.org/openstack/trove-dashboard <https://git.openstack.org/cgit/openstack/trove-dashboard>`__
-valet                                  `git://git.openstack.org/openstack/valet <https://git.openstack.org/cgit/openstack/valet>`__
-vitrage                                `git://git.openstack.org/openstack/vitrage <https://git.openstack.org/cgit/openstack/vitrage>`__
-vitrage-dashboard                      `git://git.openstack.org/openstack/vitrage-dashboard <https://git.openstack.org/cgit/openstack/vitrage-dashboard>`__
-vitrage-tempest-plugin                 `git://git.openstack.org/openstack/vitrage-tempest-plugin <https://git.openstack.org/cgit/openstack/vitrage-tempest-plugin>`__
-vmware-nsx                             `git://git.openstack.org/openstack/vmware-nsx <https://git.openstack.org/cgit/openstack/vmware-nsx>`__
-vmware-vspc                            `git://git.openstack.org/openstack/vmware-vspc <https://git.openstack.org/cgit/openstack/vmware-vspc>`__
-watcher                                `git://git.openstack.org/openstack/watcher <https://git.openstack.org/cgit/openstack/watcher>`__
-watcher-dashboard                      `git://git.openstack.org/openstack/watcher-dashboard <https://git.openstack.org/cgit/openstack/watcher-dashboard>`__
-zaqar                                  `git://git.openstack.org/openstack/zaqar <https://git.openstack.org/cgit/openstack/zaqar>`__
-zaqar-ui                               `git://git.openstack.org/openstack/zaqar-ui <https://git.openstack.org/cgit/openstack/zaqar-ui>`__
-zun                                    `git://git.openstack.org/openstack/zun <https://git.openstack.org/cgit/openstack/zun>`__
-zun-ui                                 `git://git.openstack.org/openstack/zun-ui <https://git.openstack.org/cgit/openstack/zun-ui>`__
+almanach                               `https://git.openstack.org/openstack/almanach <https://git.openstack.org/cgit/openstack/almanach>`__
+aodh                                   `https://git.openstack.org/openstack/aodh <https://git.openstack.org/cgit/openstack/aodh>`__
+apmec                                  `https://git.openstack.org/openstack/apmec <https://git.openstack.org/cgit/openstack/apmec>`__
+barbican                               `https://git.openstack.org/openstack/barbican <https://git.openstack.org/cgit/openstack/barbican>`__
+bilean                                 `https://git.openstack.org/openstack/bilean <https://git.openstack.org/cgit/openstack/bilean>`__
+blazar                                 `https://git.openstack.org/openstack/blazar <https://git.openstack.org/cgit/openstack/blazar>`__
+broadview-collector                    `https://git.openstack.org/openstack/broadview-collector <https://git.openstack.org/cgit/openstack/broadview-collector>`__
+castellan-ui                           `https://git.openstack.org/openstack/castellan-ui <https://git.openstack.org/cgit/openstack/castellan-ui>`__
+ceilometer                             `https://git.openstack.org/openstack/ceilometer <https://git.openstack.org/cgit/openstack/ceilometer>`__
+ceilometer-powervm                     `https://git.openstack.org/openstack/ceilometer-powervm <https://git.openstack.org/cgit/openstack/ceilometer-powervm>`__
+cloudkitty                             `https://git.openstack.org/openstack/cloudkitty <https://git.openstack.org/cgit/openstack/cloudkitty>`__
+collectd-openstack-plugins             `https://git.openstack.org/openstack/collectd-openstack-plugins <https://git.openstack.org/cgit/openstack/collectd-openstack-plugins>`__
+congress                               `https://git.openstack.org/openstack/congress <https://git.openstack.org/cgit/openstack/congress>`__
+cyborg                                 `https://git.openstack.org/openstack/cyborg <https://git.openstack.org/cgit/openstack/cyborg>`__
+designate                              `https://git.openstack.org/openstack/designate <https://git.openstack.org/cgit/openstack/designate>`__
+devstack-plugin-additional-pkg-repos   `https://git.openstack.org/openstack/devstack-plugin-additional-pkg-repos <https://git.openstack.org/cgit/openstack/devstack-plugin-additional-pkg-repos>`__
+devstack-plugin-amqp1                  `https://git.openstack.org/openstack/devstack-plugin-amqp1 <https://git.openstack.org/cgit/openstack/devstack-plugin-amqp1>`__
+devstack-plugin-bdd                    `https://git.openstack.org/openstack/devstack-plugin-bdd <https://git.openstack.org/cgit/openstack/devstack-plugin-bdd>`__
+devstack-plugin-ceph                   `https://git.openstack.org/openstack/devstack-plugin-ceph <https://git.openstack.org/cgit/openstack/devstack-plugin-ceph>`__
+devstack-plugin-container              `https://git.openstack.org/openstack/devstack-plugin-container <https://git.openstack.org/cgit/openstack/devstack-plugin-container>`__
+devstack-plugin-glusterfs              `https://git.openstack.org/openstack/devstack-plugin-glusterfs <https://git.openstack.org/cgit/openstack/devstack-plugin-glusterfs>`__
+devstack-plugin-hdfs                   `https://git.openstack.org/openstack/devstack-plugin-hdfs <https://git.openstack.org/cgit/openstack/devstack-plugin-hdfs>`__
+devstack-plugin-kafka                  `https://git.openstack.org/openstack/devstack-plugin-kafka <https://git.openstack.org/cgit/openstack/devstack-plugin-kafka>`__
+devstack-plugin-libvirt-qemu           `https://git.openstack.org/openstack/devstack-plugin-libvirt-qemu <https://git.openstack.org/cgit/openstack/devstack-plugin-libvirt-qemu>`__
+devstack-plugin-mariadb                `https://git.openstack.org/openstack/devstack-plugin-mariadb <https://git.openstack.org/cgit/openstack/devstack-plugin-mariadb>`__
+devstack-plugin-nfs                    `https://git.openstack.org/openstack/devstack-plugin-nfs <https://git.openstack.org/cgit/openstack/devstack-plugin-nfs>`__
+devstack-plugin-pika                   `https://git.openstack.org/openstack/devstack-plugin-pika <https://git.openstack.org/cgit/openstack/devstack-plugin-pika>`__
+devstack-plugin-sheepdog               `https://git.openstack.org/openstack/devstack-plugin-sheepdog <https://git.openstack.org/cgit/openstack/devstack-plugin-sheepdog>`__
+devstack-plugin-vmax                   `https://git.openstack.org/openstack/devstack-plugin-vmax <https://git.openstack.org/cgit/openstack/devstack-plugin-vmax>`__
+devstack-plugin-zmq                    `https://git.openstack.org/openstack/devstack-plugin-zmq <https://git.openstack.org/cgit/openstack/devstack-plugin-zmq>`__
+dragonflow                             `https://git.openstack.org/openstack/dragonflow <https://git.openstack.org/cgit/openstack/dragonflow>`__
+drbd-devstack                          `https://git.openstack.org/openstack/drbd-devstack <https://git.openstack.org/cgit/openstack/drbd-devstack>`__
+ec2-api                                `https://git.openstack.org/openstack/ec2-api <https://git.openstack.org/cgit/openstack/ec2-api>`__
+freezer                                `https://git.openstack.org/openstack/freezer <https://git.openstack.org/cgit/openstack/freezer>`__
+freezer-api                            `https://git.openstack.org/openstack/freezer-api <https://git.openstack.org/cgit/openstack/freezer-api>`__
+freezer-tempest-plugin                 `https://git.openstack.org/openstack/freezer-tempest-plugin <https://git.openstack.org/cgit/openstack/freezer-tempest-plugin>`__
+freezer-web-ui                         `https://git.openstack.org/openstack/freezer-web-ui <https://git.openstack.org/cgit/openstack/freezer-web-ui>`__
+gce-api                                `https://git.openstack.org/openstack/gce-api <https://git.openstack.org/cgit/openstack/gce-api>`__
+glare                                  `https://git.openstack.org/openstack/glare <https://git.openstack.org/cgit/openstack/glare>`__
+group-based-policy                     `https://git.openstack.org/openstack/group-based-policy <https://git.openstack.org/cgit/openstack/group-based-policy>`__
+gyan                                   `https://git.openstack.org/openstack/gyan <https://git.openstack.org/cgit/openstack/gyan>`__
+heat                                   `https://git.openstack.org/openstack/heat <https://git.openstack.org/cgit/openstack/heat>`__
+heat-dashboard                         `https://git.openstack.org/openstack/heat-dashboard <https://git.openstack.org/cgit/openstack/heat-dashboard>`__
+horizon-mellanox                       `https://git.openstack.org/openstack/horizon-mellanox <https://git.openstack.org/cgit/openstack/horizon-mellanox>`__
+ironic                                 `https://git.openstack.org/openstack/ironic <https://git.openstack.org/cgit/openstack/ironic>`__
+ironic-inspector                       `https://git.openstack.org/openstack/ironic-inspector <https://git.openstack.org/cgit/openstack/ironic-inspector>`__
+ironic-staging-drivers                 `https://git.openstack.org/openstack/ironic-staging-drivers <https://git.openstack.org/cgit/openstack/ironic-staging-drivers>`__
+ironic-ui                              `https://git.openstack.org/openstack/ironic-ui <https://git.openstack.org/cgit/openstack/ironic-ui>`__
+karbor                                 `https://git.openstack.org/openstack/karbor <https://git.openstack.org/cgit/openstack/karbor>`__
+karbor-dashboard                       `https://git.openstack.org/openstack/karbor-dashboard <https://git.openstack.org/cgit/openstack/karbor-dashboard>`__
+keystone                               `https://git.openstack.org/openstack/keystone <https://git.openstack.org/cgit/openstack/keystone>`__
+kingbird                               `https://git.openstack.org/openstack/kingbird <https://git.openstack.org/cgit/openstack/kingbird>`__
+kuryr-kubernetes                       `https://git.openstack.org/openstack/kuryr-kubernetes <https://git.openstack.org/cgit/openstack/kuryr-kubernetes>`__
+kuryr-libnetwork                       `https://git.openstack.org/openstack/kuryr-libnetwork <https://git.openstack.org/cgit/openstack/kuryr-libnetwork>`__
+kuryr-tempest-plugin                   `https://git.openstack.org/openstack/kuryr-tempest-plugin <https://git.openstack.org/cgit/openstack/kuryr-tempest-plugin>`__
+magnum                                 `https://git.openstack.org/openstack/magnum <https://git.openstack.org/cgit/openstack/magnum>`__
+magnum-ui                              `https://git.openstack.org/openstack/magnum-ui <https://git.openstack.org/cgit/openstack/magnum-ui>`__
+manila                                 `https://git.openstack.org/openstack/manila <https://git.openstack.org/cgit/openstack/manila>`__
+manila-ui                              `https://git.openstack.org/openstack/manila-ui <https://git.openstack.org/cgit/openstack/manila-ui>`__
+masakari                               `https://git.openstack.org/openstack/masakari <https://git.openstack.org/cgit/openstack/masakari>`__
+meteos                                 `https://git.openstack.org/openstack/meteos <https://git.openstack.org/cgit/openstack/meteos>`__
+meteos-ui                              `https://git.openstack.org/openstack/meteos-ui <https://git.openstack.org/cgit/openstack/meteos-ui>`__
+mistral                                `https://git.openstack.org/openstack/mistral <https://git.openstack.org/cgit/openstack/mistral>`__
+mixmatch                               `https://git.openstack.org/openstack/mixmatch <https://git.openstack.org/cgit/openstack/mixmatch>`__
+mogan                                  `https://git.openstack.org/openstack/mogan <https://git.openstack.org/cgit/openstack/mogan>`__
+mogan-ui                               `https://git.openstack.org/openstack/mogan-ui <https://git.openstack.org/cgit/openstack/mogan-ui>`__
+monasca-analytics                      `https://git.openstack.org/openstack/monasca-analytics <https://git.openstack.org/cgit/openstack/monasca-analytics>`__
+monasca-api                            `https://git.openstack.org/openstack/monasca-api <https://git.openstack.org/cgit/openstack/monasca-api>`__
+monasca-ceilometer                     `https://git.openstack.org/openstack/monasca-ceilometer <https://git.openstack.org/cgit/openstack/monasca-ceilometer>`__
+monasca-events-api                     `https://git.openstack.org/openstack/monasca-events-api <https://git.openstack.org/cgit/openstack/monasca-events-api>`__
+monasca-log-api                        `https://git.openstack.org/openstack/monasca-log-api <https://git.openstack.org/cgit/openstack/monasca-log-api>`__
+monasca-tempest-plugin                 `https://git.openstack.org/openstack/monasca-tempest-plugin <https://git.openstack.org/cgit/openstack/monasca-tempest-plugin>`__
+monasca-transform                      `https://git.openstack.org/openstack/monasca-transform <https://git.openstack.org/cgit/openstack/monasca-transform>`__
+murano                                 `https://git.openstack.org/openstack/murano <https://git.openstack.org/cgit/openstack/murano>`__
+networking-6wind                       `https://git.openstack.org/openstack/networking-6wind <https://git.openstack.org/cgit/openstack/networking-6wind>`__
+networking-ansible                     `https://git.openstack.org/openstack/networking-ansible <https://git.openstack.org/cgit/openstack/networking-ansible>`__
+networking-arista                      `https://git.openstack.org/openstack/networking-arista <https://git.openstack.org/cgit/openstack/networking-arista>`__
+networking-bagpipe                     `https://git.openstack.org/openstack/networking-bagpipe <https://git.openstack.org/cgit/openstack/networking-bagpipe>`__
+networking-baremetal                   `https://git.openstack.org/openstack/networking-baremetal <https://git.openstack.org/cgit/openstack/networking-baremetal>`__
+networking-bgpvpn                      `https://git.openstack.org/openstack/networking-bgpvpn <https://git.openstack.org/cgit/openstack/networking-bgpvpn>`__
+networking-brocade                     `https://git.openstack.org/openstack/networking-brocade <https://git.openstack.org/cgit/openstack/networking-brocade>`__
+networking-calico                      `https://git.openstack.org/openstack/networking-calico <https://git.openstack.org/cgit/openstack/networking-calico>`__
+networking-cisco                       `https://git.openstack.org/openstack/networking-cisco <https://git.openstack.org/cgit/openstack/networking-cisco>`__
+networking-cumulus                     `https://git.openstack.org/openstack/networking-cumulus <https://git.openstack.org/cgit/openstack/networking-cumulus>`__
+networking-dpm                         `https://git.openstack.org/openstack/networking-dpm <https://git.openstack.org/cgit/openstack/networking-dpm>`__
+networking-fortinet                    `https://git.openstack.org/openstack/networking-fortinet <https://git.openstack.org/cgit/openstack/networking-fortinet>`__
+networking-generic-switch              `https://git.openstack.org/openstack/networking-generic-switch <https://git.openstack.org/cgit/openstack/networking-generic-switch>`__
+networking-hpe                         `https://git.openstack.org/openstack/networking-hpe <https://git.openstack.org/cgit/openstack/networking-hpe>`__
+networking-huawei                      `https://git.openstack.org/openstack/networking-huawei <https://git.openstack.org/cgit/openstack/networking-huawei>`__
+networking-hyperv                      `https://git.openstack.org/openstack/networking-hyperv <https://git.openstack.org/cgit/openstack/networking-hyperv>`__
+networking-infoblox                    `https://git.openstack.org/openstack/networking-infoblox <https://git.openstack.org/cgit/openstack/networking-infoblox>`__
+networking-l2gw                        `https://git.openstack.org/openstack/networking-l2gw <https://git.openstack.org/cgit/openstack/networking-l2gw>`__
+networking-lagopus                     `https://git.openstack.org/openstack/networking-lagopus <https://git.openstack.org/cgit/openstack/networking-lagopus>`__
+networking-midonet                     `https://git.openstack.org/openstack/networking-midonet <https://git.openstack.org/cgit/openstack/networking-midonet>`__
+networking-mlnx                        `https://git.openstack.org/openstack/networking-mlnx <https://git.openstack.org/cgit/openstack/networking-mlnx>`__
+networking-nec                         `https://git.openstack.org/openstack/networking-nec <https://git.openstack.org/cgit/openstack/networking-nec>`__
+networking-odl                         `https://git.openstack.org/openstack/networking-odl <https://git.openstack.org/cgit/openstack/networking-odl>`__
+networking-onos                        `https://git.openstack.org/openstack/networking-onos <https://git.openstack.org/cgit/openstack/networking-onos>`__
+networking-opencontrail                `https://git.openstack.org/openstack/networking-opencontrail <https://git.openstack.org/cgit/openstack/networking-opencontrail>`__
+networking-ovn                         `https://git.openstack.org/openstack/networking-ovn <https://git.openstack.org/cgit/openstack/networking-ovn>`__
+networking-ovs-dpdk                    `https://git.openstack.org/openstack/networking-ovs-dpdk <https://git.openstack.org/cgit/openstack/networking-ovs-dpdk>`__
+networking-plumgrid                    `https://git.openstack.org/openstack/networking-plumgrid <https://git.openstack.org/cgit/openstack/networking-plumgrid>`__
+networking-powervm                     `https://git.openstack.org/openstack/networking-powervm <https://git.openstack.org/cgit/openstack/networking-powervm>`__
+networking-sfc                         `https://git.openstack.org/openstack/networking-sfc <https://git.openstack.org/cgit/openstack/networking-sfc>`__
+networking-spp                         `https://git.openstack.org/openstack/networking-spp <https://git.openstack.org/cgit/openstack/networking-spp>`__
+networking-vpp                         `https://git.openstack.org/openstack/networking-vpp <https://git.openstack.org/cgit/openstack/networking-vpp>`__
+networking-vsphere                     `https://git.openstack.org/openstack/networking-vsphere <https://git.openstack.org/cgit/openstack/networking-vsphere>`__
+neutron                                `https://git.openstack.org/openstack/neutron <https://git.openstack.org/cgit/openstack/neutron>`__
+neutron-classifier                     `https://git.openstack.org/openstack/neutron-classifier <https://git.openstack.org/cgit/openstack/neutron-classifier>`__
+neutron-dynamic-routing                `https://git.openstack.org/openstack/neutron-dynamic-routing <https://git.openstack.org/cgit/openstack/neutron-dynamic-routing>`__
+neutron-fwaas                          `https://git.openstack.org/openstack/neutron-fwaas <https://git.openstack.org/cgit/openstack/neutron-fwaas>`__
+neutron-fwaas-dashboard                `https://git.openstack.org/openstack/neutron-fwaas-dashboard <https://git.openstack.org/cgit/openstack/neutron-fwaas-dashboard>`__
+neutron-lbaas                          `https://git.openstack.org/openstack/neutron-lbaas <https://git.openstack.org/cgit/openstack/neutron-lbaas>`__
+neutron-lbaas-dashboard                `https://git.openstack.org/openstack/neutron-lbaas-dashboard <https://git.openstack.org/cgit/openstack/neutron-lbaas-dashboard>`__
+neutron-tempest-plugin                 `https://git.openstack.org/openstack/neutron-tempest-plugin <https://git.openstack.org/cgit/openstack/neutron-tempest-plugin>`__
+neutron-vpnaas                         `https://git.openstack.org/openstack/neutron-vpnaas <https://git.openstack.org/cgit/openstack/neutron-vpnaas>`__
+neutron-vpnaas-dashboard               `https://git.openstack.org/openstack/neutron-vpnaas-dashboard <https://git.openstack.org/cgit/openstack/neutron-vpnaas-dashboard>`__
+nova-dpm                               `https://git.openstack.org/openstack/nova-dpm <https://git.openstack.org/cgit/openstack/nova-dpm>`__
+nova-lxd                               `https://git.openstack.org/openstack/nova-lxd <https://git.openstack.org/cgit/openstack/nova-lxd>`__
+nova-mksproxy                          `https://git.openstack.org/openstack/nova-mksproxy <https://git.openstack.org/cgit/openstack/nova-mksproxy>`__
+nova-powervm                           `https://git.openstack.org/openstack/nova-powervm <https://git.openstack.org/cgit/openstack/nova-powervm>`__
+oaktree                                `https://git.openstack.org/openstack/oaktree <https://git.openstack.org/cgit/openstack/oaktree>`__
+octavia                                `https://git.openstack.org/openstack/octavia <https://git.openstack.org/cgit/openstack/octavia>`__
+octavia-dashboard                      `https://git.openstack.org/openstack/octavia-dashboard <https://git.openstack.org/cgit/openstack/octavia-dashboard>`__
+omni                                   `https://git.openstack.org/openstack/omni <https://git.openstack.org/cgit/openstack/omni>`__
+openstacksdk                           `https://git.openstack.org/openstack/openstacksdk <https://git.openstack.org/cgit/openstack/openstacksdk>`__
+os-faults                              `https://git.openstack.org/openstack/os-faults <https://git.openstack.org/cgit/openstack/os-faults>`__
+os-xenapi                              `https://git.openstack.org/openstack/os-xenapi <https://git.openstack.org/cgit/openstack/os-xenapi>`__
+osprofiler                             `https://git.openstack.org/openstack/osprofiler <https://git.openstack.org/cgit/openstack/osprofiler>`__
+oswin-tempest-plugin                   `https://git.openstack.org/openstack/oswin-tempest-plugin <https://git.openstack.org/cgit/openstack/oswin-tempest-plugin>`__
+panko                                  `https://git.openstack.org/openstack/panko <https://git.openstack.org/cgit/openstack/panko>`__
+patrole                                `https://git.openstack.org/openstack/patrole <https://git.openstack.org/cgit/openstack/patrole>`__
+picasso                                `https://git.openstack.org/openstack/picasso <https://git.openstack.org/cgit/openstack/picasso>`__
+qinling                                `https://git.openstack.org/openstack/qinling <https://git.openstack.org/cgit/openstack/qinling>`__
+qinling-dashboard                      `https://git.openstack.org/openstack/qinling-dashboard <https://git.openstack.org/cgit/openstack/qinling-dashboard>`__
+rally                                  `https://git.openstack.org/openstack/rally <https://git.openstack.org/cgit/openstack/rally>`__
+rally-openstack                        `https://git.openstack.org/openstack/rally-openstack <https://git.openstack.org/cgit/openstack/rally-openstack>`__
+rsd-virt-for-nova                      `https://git.openstack.org/openstack/rsd-virt-for-nova <https://git.openstack.org/cgit/openstack/rsd-virt-for-nova>`__
+sahara                                 `https://git.openstack.org/openstack/sahara <https://git.openstack.org/cgit/openstack/sahara>`__
+sahara-dashboard                       `https://git.openstack.org/openstack/sahara-dashboard <https://git.openstack.org/cgit/openstack/sahara-dashboard>`__
+scalpels                               `https://git.openstack.org/openstack/scalpels <https://git.openstack.org/cgit/openstack/scalpels>`__
+searchlight                            `https://git.openstack.org/openstack/searchlight <https://git.openstack.org/cgit/openstack/searchlight>`__
+searchlight-ui                         `https://git.openstack.org/openstack/searchlight-ui <https://git.openstack.org/cgit/openstack/searchlight-ui>`__
+senlin                                 `https://git.openstack.org/openstack/senlin <https://git.openstack.org/cgit/openstack/senlin>`__
+slogging                               `https://git.openstack.org/openstack/slogging <https://git.openstack.org/cgit/openstack/slogging>`__
+solum                                  `https://git.openstack.org/openstack/solum <https://git.openstack.org/cgit/openstack/solum>`__
+stackube                               `https://git.openstack.org/openstack/stackube <https://git.openstack.org/cgit/openstack/stackube>`__
+storlets                               `https://git.openstack.org/openstack/storlets <https://git.openstack.org/cgit/openstack/storlets>`__
+stx-config                             `https://git.openstack.org/openstack/stx-config <https://git.openstack.org/cgit/openstack/stx-config>`__
+stx-fault                              `https://git.openstack.org/openstack/stx-fault <https://git.openstack.org/cgit/openstack/stx-fault>`__
+stx-integ                              `https://git.openstack.org/openstack/stx-integ <https://git.openstack.org/cgit/openstack/stx-integ>`__
+stx-metal                              `https://git.openstack.org/openstack/stx-metal <https://git.openstack.org/cgit/openstack/stx-metal>`__
+stx-nfv                                `https://git.openstack.org/openstack/stx-nfv <https://git.openstack.org/cgit/openstack/stx-nfv>`__
+stx-update                             `https://git.openstack.org/openstack/stx-update <https://git.openstack.org/cgit/openstack/stx-update>`__
+tacker                                 `https://git.openstack.org/openstack/tacker <https://git.openstack.org/cgit/openstack/tacker>`__
+tap-as-a-service                       `https://git.openstack.org/openstack/tap-as-a-service <https://git.openstack.org/cgit/openstack/tap-as-a-service>`__
+tap-as-a-service-dashboard             `https://git.openstack.org/openstack/tap-as-a-service-dashboard <https://git.openstack.org/cgit/openstack/tap-as-a-service-dashboard>`__
+tatu                                   `https://git.openstack.org/openstack/tatu <https://git.openstack.org/cgit/openstack/tatu>`__
+telemetry-tempest-plugin               `https://git.openstack.org/openstack/telemetry-tempest-plugin <https://git.openstack.org/cgit/openstack/telemetry-tempest-plugin>`__
+tobiko                                 `https://git.openstack.org/openstack/tobiko <https://git.openstack.org/cgit/openstack/tobiko>`__
+tricircle                              `https://git.openstack.org/openstack/tricircle <https://git.openstack.org/cgit/openstack/tricircle>`__
+trio2o                                 `https://git.openstack.org/openstack/trio2o <https://git.openstack.org/cgit/openstack/trio2o>`__
+trove                                  `https://git.openstack.org/openstack/trove <https://git.openstack.org/cgit/openstack/trove>`__
+trove-dashboard                        `https://git.openstack.org/openstack/trove-dashboard <https://git.openstack.org/cgit/openstack/trove-dashboard>`__
+valet                                  `https://git.openstack.org/openstack/valet <https://git.openstack.org/cgit/openstack/valet>`__
+vitrage                                `https://git.openstack.org/openstack/vitrage <https://git.openstack.org/cgit/openstack/vitrage>`__
+vitrage-dashboard                      `https://git.openstack.org/openstack/vitrage-dashboard <https://git.openstack.org/cgit/openstack/vitrage-dashboard>`__
+vitrage-tempest-plugin                 `https://git.openstack.org/openstack/vitrage-tempest-plugin <https://git.openstack.org/cgit/openstack/vitrage-tempest-plugin>`__
+vmware-nsx                             `https://git.openstack.org/openstack/vmware-nsx <https://git.openstack.org/cgit/openstack/vmware-nsx>`__
+vmware-vspc                            `https://git.openstack.org/openstack/vmware-vspc <https://git.openstack.org/cgit/openstack/vmware-vspc>`__
+watcher                                `https://git.openstack.org/openstack/watcher <https://git.openstack.org/cgit/openstack/watcher>`__
+watcher-dashboard                      `https://git.openstack.org/openstack/watcher-dashboard <https://git.openstack.org/cgit/openstack/watcher-dashboard>`__
+zaqar                                  `https://git.openstack.org/openstack/zaqar <https://git.openstack.org/cgit/openstack/zaqar>`__
+zaqar-ui                               `https://git.openstack.org/openstack/zaqar-ui <https://git.openstack.org/cgit/openstack/zaqar-ui>`__
+zun                                    `https://git.openstack.org/openstack/zun <https://git.openstack.org/cgit/openstack/zun>`__
+zun-ui                                 `https://git.openstack.org/openstack/zun-ui <https://git.openstack.org/cgit/openstack/zun-ui>`__
 ====================================== ===
 
 
diff --git a/doc/source/plugins.rst b/doc/source/plugins.rst
index c69472955c..b1f2397454 100644
--- a/doc/source/plugins.rst
+++ b/doc/source/plugins.rst
@@ -99,7 +99,7 @@ They are added in the following format::
 
 An example would be as follows::
 
-  enable_plugin ec2-api git://git.openstack.org/openstack/ec2-api
+  enable_plugin ec2-api https://git.openstack.org/openstack/ec2-api
 
 plugin.sh contract
 ==================
@@ -277,7 +277,7 @@ be needed in your ``jenkins/jobs/<project>.yaml`` definition in
   # note the actual url here is somewhat irrelevant because it
   # caches in nodepool, however make it a valid url for
   # documentation purposes.
-  export DEVSTACK_LOCAL_CONFIG="enable_plugin ec2-api git://git.openstack.org/openstack/ec2-api"
+  export DEVSTACK_LOCAL_CONFIG="enable_plugin ec2-api https://git.openstack.org/openstack/ec2-api"
 
 See Also
 ========
diff --git a/tools/generate-devstack-plugins-list.sh b/tools/generate-devstack-plugins-list.sh
index 95f13318b8..27c9c4118e 100755
--- a/tools/generate-devstack-plugins-list.sh
+++ b/tools/generate-devstack-plugins-list.sh
@@ -65,7 +65,7 @@ name_col_len=$(( name_col_len + 2 ))
 # ====================== ===
 # Plugin Name            URL
 # ====================== ===
-# foobar                 `git://... <http://...>`__
+# foobar                 `https://... <https://...>`__
 # ...
 
 printf "\n\n"
@@ -74,7 +74,7 @@ printf "%-${name_col_len}s %s\n" "Plugin Name" "URL"
 title_underline ${name_col_len}
 
 for plugin in ${sorted_plugins}; do
-    giturl="git://git.openstack.org/openstack/${plugin}"
+    giturl="https://git.openstack.org/openstack/${plugin}"
     gitlink="https://git.openstack.org/cgit/openstack/${plugin}"
     printf "%-${name_col_len}s %s\n" "${plugin}" "\`${giturl} <${gitlink}>\`__"
 done

From 363acd9d3d83af2ab088d84b069c1ffba2512e3b Mon Sep 17 00:00:00 2001
From: Eric Harney <eharney@redhat.com>
Date: Mon, 4 Mar 2019 17:50:47 -0500
Subject: [PATCH 1497/2409] Cinder: install targetcli-fb for Bionic

The "targetcli" package no longer exists
in Bionic and has been superseded by
"targetcli-fb".

Change-Id: I99e4e8ad8fbb6e7c86571af8b0c222dafacf6447
---
 lib/cinder | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/lib/cinder b/lib/cinder
index d69b21efd0..48f3e45c55 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -434,7 +434,11 @@ function install_cinder {
     if [[ "$CINDER_ISCSI_HELPER" == "tgtadm" ]]; then
         install_package tgt
     elif [[ "$CINDER_ISCSI_HELPER" == "lioadm" ]]; then
-        install_package targetcli
+        if [[ ${DISTRO} == "bionic" ]]; then
+            install_package targetcli-fb
+        else
+            install_package targetcli
+        fi
     fi
 }
 

From 4eb455aa287155646f78a4621365b37f9df30793 Mon Sep 17 00:00:00 2001
From: Kashyap Chamarthy <kchamart@redhat.com>
Date: Fri, 22 Feb 2019 20:11:35 +0100
Subject: [PATCH 1498/2409] Capture the content of 'audit.log' file

On CentOS/ Fedora machines, this can be useful when QEMU silently fails
to start up due to SELinux denials.  For Debian-based machines, which
use AppAromor, DevStack already captures the output of 'kern.log' (via
`journalctl -t kernel` redirected into 'syslog.txt.gz').

Change-Id: I231b22664f0944b905e00568759785615a1d47c3
Acked-by: Clark Bolyan <clark.boylan@gmail.com>
Signed-off-by: Kashyap Chamarthy <kchamart@redhat.com>
---
 .zuul.yaml                                |  1 +
 roles/capture-system-logs/tasks/main.yaml | 11 +++++++++++
 2 files changed, 12 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index afe400e1a4..8ede2fce80 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -218,6 +218,7 @@
         '{{ stage_dir }}/core': logs
         '{{ stage_dir }}/listen53.txt': logs
         '{{ stage_dir }}/deprecations.log': logs
+        '{{ stage_dir }}/audit.log': logs
         /var/log/ceph: logs
         /var/log/openvswitch: logs
         /var/log/glusterfs: logs
diff --git a/roles/capture-system-logs/tasks/main.yaml b/roles/capture-system-logs/tasks/main.yaml
index de4f8eda08..905806d529 100644
--- a/roles/capture-system-logs/tasks/main.yaml
+++ b/roles/capture-system-logs/tasks/main.yaml
@@ -19,6 +19,17 @@
           rpm -qa | sort > {{ stage_dir }}/rpm-qa.txt
       fi
 
+      # NOTE(kchamart) The 'audit.log' can be useful in cases when QEMU
+      # failed to start due to denials from SELinux — useful for CentOS
+      # and Fedora machines.  For Ubuntu (which runs AppArmor), DevStack
+      # already captures the contents of /var/log/kern.log (via
+      # `journalctl -t kernel` redirected into syslog.txt.gz), which
+      # contains AppArmor-related messages.
+      if [ -f /var/log/audit/audit.log ] ; then
+          sudo cp /var/log/audit/audit.log {{stage_dir }}/audit.log &&
+          chmod +r {{ stage_dir }}/audit.log;
+      fi
+
       # gzip and save any coredumps in /var/core
       if [ -d /var/core ]; then
           sudo gzip -r /var/core

From 676957ffcff78e790134776f71035a3b14974896 Mon Sep 17 00:00:00 2001
From: Hongbin Lu <hongbin034@gmail.com>
Date: Sun, 10 Mar 2019 14:55:48 +0000
Subject: [PATCH 1499/2409] Update etcd version to 3.3.12

The default version is 3.2.17 which seems to be too old.
Some external tools are not compatible with this old version.
For example, kubeadm cannot support external etcd version that is
older than 3.2.18.

This commit update the etcd version to 3.3.12 wich is the current
latest version.

Change-Id: Icfabbe580bb83a3babb98cc9fdbfb8eb388dc108
---
 stackrc | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/stackrc b/stackrc
index 53868f3d9d..d104beaa6c 100644
--- a/stackrc
+++ b/stackrc
@@ -737,10 +737,10 @@ fi
 EXTRA_CACHE_URLS=""
 
 # etcd3 defaults
-ETCD_VERSION=${ETCD_VERSION:-v3.2.17}
-ETCD_SHA256_AMD64=${ETCD_SHA256_AMD64:-"0a75e794502e2e76417b19da2807a9915fa58dcbf0985e397741d570f4f305cd"}
-ETCD_SHA256_ARM64=${ETCD_SHA256_ARM64:-"0ab4621c44c79d17d94e43bd184d0f23b763a3669056ce4ae2d0b2942410a98f"}
-ETCD_SHA256_PPC64=${ETCD_SHA256_PPC64:-"69e1279c4a2a52256b78d2a8dd23346ac46b836e678b971a459f2afaef3c275e"}
+ETCD_VERSION=${ETCD_VERSION:-v3.3.12}
+ETCD_SHA256_AMD64=${ETCD_SHA256_AMD64:-"dc5d82df095dae0a2970e4d870b6929590689dd707ae3d33e7b86da0f7f211b6"}
+ETCD_SHA256_ARM64=${ETCD_SHA256_ARM64:-"170b848ac1a071fe7d495d404a868a2c0090750b2944f8a260ef1c6125b2b4f4"}
+ETCD_SHA256_PPC64=${ETCD_SHA256_PPC64:-"77f807b1b51abbf51e020bb05bdb8ce088cb58260fcd22749ea32eee710463d3"}
 # etcd v3.2.x doesn't have anything for s390x
 ETCD_SHA256_S390X=${ETCD_SHA256_S390X:-""}
 # Make sure etcd3 downloads the correct architecture

From 610927f4255f0ed4877a3e85d628202e4af2f7d4 Mon Sep 17 00:00:00 2001
From: Luigi Toscano <ltoscano@redhat.com>
Date: Tue, 26 Feb 2019 18:39:51 +0100
Subject: [PATCH 1500/2409] zuul job: write the enable_plugin lines last

Plugins must be the last items in the local.conf file
otherwise the configuration set in the rest of the file
is not applied to them (for example a different value of DEST.)

Change-Id: Ia001badca179c3f3436d5ecd26b0755a3f3a3078
---
 .../library/devstack_local_conf.py                         | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/roles/write-devstack-local-conf/library/devstack_local_conf.py b/roles/write-devstack-local-conf/library/devstack_local_conf.py
index b1ad2dd4b4..1366a2274e 100644
--- a/roles/write-devstack-local-conf/library/devstack_local_conf.py
+++ b/roles/write-devstack-local-conf/library/devstack_local_conf.py
@@ -214,11 +214,14 @@ def __init__(self, localrc, localconf, base_services, services, plugins,
         self.base_dir = base_dir
         self.projects = projects
         self.project = project
-        if plugins:
-            self.handle_plugins(plugins)
         if services or base_services:
             self.handle_services(base_services, services or {})
         self.handle_localrc(localrc)
+        # Plugins must be the last items in localrc, otherwise
+        # the configuration lines which follows them in the file are
+        # not applied to the plugins (for example, the value of DEST.)
+        if plugins:
+            self.handle_plugins(plugins)
         if localconf:
             self.handle_localconf(localconf)
 

From 70d043dd6039fb55aa9d40d593839037bb8c43cf Mon Sep 17 00:00:00 2001
From: Luigi Toscano <ltoscano@redhat.com>
Date: Tue, 12 Mar 2019 22:25:44 +0100
Subject: [PATCH 1501/2409] zuul: new variable to easily populate
 TEMPEST_PLUGINS

TEMPEST_PLUGINS contains the list of the tempest plugins installed
alongside tempest by lib/tempest.
If TEMPEST_PLUGINS is not explicitly set, the new tempest_plugins
variable is used to fill it by combining its items with
the base devstack path.

Change-Id: I9f1fa2755e16871ff9d6ba33fdeaf3023eedf8d4
---
 doc/source/zuul_ci_jobs_migration.rst         |  3 +-
 roles/write-devstack-local-conf/README.rst    |  9 ++
 .../library/devstack_local_conf.py            | 26 ++++-
 .../write-devstack-local-conf/library/test.py | 98 ++++++++++++-------
 .../write-devstack-local-conf/tasks/main.yaml |  3 +-
 5 files changed, 96 insertions(+), 43 deletions(-)

diff --git a/doc/source/zuul_ci_jobs_migration.rst b/doc/source/zuul_ci_jobs_migration.rst
index c00f06e41a..633f951d3d 100644
--- a/doc/source/zuul_ci_jobs_migration.rst
+++ b/doc/source/zuul_ci_jobs_migration.rst
@@ -102,7 +102,6 @@ job.parent.
         tox_envlist: 'all'
         devstack_localrc:
           KURYR_K8S_API_PORT: 8080
-          TEMPEST_PLUGINS: '/opt/stack/kuryr-tempest-plugin'
         devstack_services:
           kubernetes-api: true
           kubernetes-controller-manager: true
@@ -114,6 +113,8 @@ job.parent.
           kuryr-kubernetes: https://git.openstack.org/openstack/kuryr
           devstack-plugin-container: https://git.openstack.org/openstack/devstack-plugin-container
           neutron-lbaas: https://git.openstack.org/openstack/neutron-lbaas
+        tempest_plugins:
+          - kuryr-tempest-plugin
         (...)
 
 Job variables
diff --git a/roles/write-devstack-local-conf/README.rst b/roles/write-devstack-local-conf/README.rst
index e9739cdea8..d0a51e77c2 100644
--- a/roles/write-devstack-local-conf/README.rst
+++ b/roles/write-devstack-local-conf/README.rst
@@ -88,3 +88,12 @@ Write the local.conf file for use by devstack
    If a plugin declares a dependency on another plugin (via
    ``plugin_requires`` in the plugin's settings file), this role will
    automatically emit ``enable_plugin`` lines in the correct order.
+
+.. zuul:rolevar:: tempest_plugins
+   :type: list
+
+   A list of tempest plugins which are installed alongside tempest.
+
+   The list of values will be combined with the base devstack directory
+   and used to populate the ``TEMPEST_PLUGINS`` variable. If the variable
+   already exists, its value is *not* changed.
diff --git a/roles/write-devstack-local-conf/library/devstack_local_conf.py b/roles/write-devstack-local-conf/library/devstack_local_conf.py
index 1366a2274e..8df8dea6dd 100644
--- a/roles/write-devstack-local-conf/library/devstack_local_conf.py
+++ b/roles/write-devstack-local-conf/library/devstack_local_conf.py
@@ -207,13 +207,15 @@ def getPlugins(self):
 class LocalConf(object):
 
     def __init__(self, localrc, localconf, base_services, services, plugins,
-                 base_dir, projects, project):
+                 base_dir, projects, project, tempest_plugins):
         self.localrc = []
+        self.warnings = []
         self.meta_sections = {}
         self.plugin_deps = {}
         self.base_dir = base_dir
         self.projects = projects
         self.project = project
+        self.tempest_plugins = tempest_plugins
         if services or base_services:
             self.handle_services(base_services, services or {})
         self.handle_localrc(localrc)
@@ -246,12 +248,15 @@ def handle_services(self, base_services, services):
 
     def handle_localrc(self, localrc):
         lfg = False
+        tp = False
         if localrc:
             vg = VarGraph(localrc)
             for k, v in vg.getVars():
                 self.localrc.append('{}={}'.format(k, v))
                 if k == 'LIBS_FROM_GIT':
                     lfg = True
+                elif k == 'TEMPEST_PLUGINS':
+                    tp = True
 
         if not lfg and (self.projects or self.project):
             required_projects = []
@@ -266,6 +271,19 @@ def handle_localrc(self, localrc):
                 self.localrc.append('LIBS_FROM_GIT={}'.format(
                     ','.join(required_projects)))
 
+        if self.tempest_plugins:
+            if not tp:
+                tp_dirs = []
+                for tempest_plugin in self.tempest_plugins:
+                    tp_dirs.append(os.path.join(self.base_dir, tempest_plugin))
+                self.localrc.append('TEMPEST_PLUGINS="{}"'.format(
+                        ' '.join(tp_dirs)))
+            else:
+                self.warnings.append('TEMPEST_PLUGINS already defined ({}),'
+                                     'requested value {} ignored'.format(
+                                         tp, self.tempest_plugins))
+
+
     def handle_localconf(self, localconf):
         for phase, phase_data in localconf.items():
             for fn, fn_data in phase_data.items():
@@ -300,6 +318,7 @@ def main():
             path=dict(type='str'),
             projects=dict(type='dict'),
             project=dict(type='dict'),
+            tempest_plugins=dict(type='list'),
         )
     )
 
@@ -311,10 +330,11 @@ def main():
                    p.get('plugins'),
                    p.get('base_dir'),
                    p.get('projects'),
-                   p.get('project'))
+                   p.get('project'),
+                   p.get('tempest_plugins'))
     lc.write(p['path'])
 
-    module.exit_json()
+    module.exit_json(warnings=lc.warnings)
 
 
 try:
diff --git a/roles/write-devstack-local-conf/library/test.py b/roles/write-devstack-local-conf/library/test.py
index 88d404b856..377c6930b8 100644
--- a/roles/write-devstack-local-conf/library/test.py
+++ b/roles/write-devstack-local-conf/library/test.py
@@ -23,6 +23,20 @@
 from collections import OrderedDict
 
 class TestDevstackLocalConf(unittest.TestCase):
+
+    @staticmethod
+    def _init_localconf(p):
+        lc = LocalConf(p.get('localrc'),
+                       p.get('local_conf'),
+                       p.get('base_services'),
+                       p.get('services'),
+                       p.get('plugins'),
+                       p.get('base_dir'),
+                       p.get('projects'),
+                       p.get('project'),
+                       p.get('tempest_plugins'))
+        return lc
+
     def setUp(self):
         self.tmpdir = tempfile.mkdtemp()
 
@@ -51,14 +65,7 @@ def test_plugins(self):
                  plugins=plugins,
                  base_dir='./test',
                  path=os.path.join(self.tmpdir, 'test.local.conf'))
-        lc = LocalConf(p.get('localrc'),
-                       p.get('local_conf'),
-                       p.get('base_services'),
-                       p.get('services'),
-                       p.get('plugins'),
-                       p.get('base_dir'),
-                       p.get('projects'),
-                       p.get('project'))
+        lc = self._init_localconf(p)
         lc.write(p['path'])
 
         plugins = []
@@ -104,14 +111,7 @@ def test_plugin_deps(self):
                  plugins=plugins,
                  base_dir=self.tmpdir,
                  path=os.path.join(self.tmpdir, 'test.local.conf'))
-        lc = LocalConf(p.get('localrc'),
-                       p.get('local_conf'),
-                       p.get('base_services'),
-                       p.get('services'),
-                       p.get('plugins'),
-                       p.get('base_dir'),
-                       p.get('projects'),
-                       p.get('project'))
+        lc = self._init_localconf(p)
         lc.write(p['path'])
 
         plugins = []
@@ -145,14 +145,7 @@ def test_libs_from_git(self):
                  path=os.path.join(self.tmpdir, 'test.local.conf'),
                  projects=projects,
                  project=project)
-        lc = LocalConf(p.get('localrc'),
-                       p.get('local_conf'),
-                       p.get('base_services'),
-                       p.get('services'),
-                       p.get('plugins'),
-                       p.get('base_dir'),
-                       p.get('projects'),
-                       p.get('project'))
+        lc = self._init_localconf(p)
         lc.write(p['path'])
 
         lfg = None
@@ -184,14 +177,7 @@ def test_overridelibs_from_git(self):
                  base_dir='./test',
                  path=os.path.join(self.tmpdir, 'test.local.conf'),
                  projects=projects)
-        lc = LocalConf(p.get('localrc'),
-                       p.get('local_conf'),
-                       p.get('base_services'),
-                       p.get('services'),
-                       p.get('plugins'),
-                       p.get('base_dir'),
-                       p.get('projects'),
-                       p.get('project'))
+        lc = self._init_localconf(p)
         lc.write(p['path'])
 
         lfg = None
@@ -238,14 +224,50 @@ def test_plugin_circular_deps(self):
                  base_dir=self.tmpdir,
                  path=os.path.join(self.tmpdir, 'test.local.conf'))
         with self.assertRaises(Exception):
-            lc = LocalConf(p.get('localrc'),
-                           p.get('local_conf'),
-                           p.get('base_services'),
-                           p.get('services'),
-                           p.get('plugins'),
-                           p.get('base_dir'))
+            lc = self._init_localconf(p)
             lc.write(p['path'])
 
+    def _find_tempest_plugins_value(self, file_path):
+        tp = None
+        with open(file_path) as f:
+            for line in f:
+                if line.startswith('TEMPEST_PLUGINS'):
+                    found = line.strip().split('=')[1]
+                    self.assertIsNone(tp,
+                        "TEMPEST_PLUGIN ({}) found again ({})".format(
+                            tp, found))
+                    tp = found
+        return tp
+
+    def test_tempest_plugins(self):
+        "Test that TEMPEST_PLUGINS is correctly populated."
+        p = dict(base_services=[],
+                 base_dir='./test',
+                 path=os.path.join(self.tmpdir, 'test.local.conf'),
+                 tempest_plugins=['heat-tempest-plugin', 'sahara-tests'])
+        lc = self._init_localconf(p)
+        lc.write(p['path'])
+
+        tp = self._find_tempest_plugins_value(p['path'])
+        self.assertEqual('"./test/heat-tempest-plugin ./test/sahara-tests"', tp)
+        self.assertEqual(len(lc.warnings), 0)
+
+    def test_tempest_plugins_not_overridden(self):
+        """Test that the existing value of TEMPEST_PLUGINS is not overridden
+        by the user-provided value, but a warning is emitted."""
+        localrc = {'TEMPEST_PLUGINS': 'someplugin'}
+        p = dict(localrc=localrc,
+                 base_services=[],
+                 base_dir='./test',
+                 path=os.path.join(self.tmpdir, 'test.local.conf'),
+                 tempest_plugins=['heat-tempest-plugin', 'sahara-tests'])
+        lc = self._init_localconf(p)
+        lc.write(p['path'])
+
+        tp = self._find_tempest_plugins_value(p['path'])
+        self.assertEqual('someplugin', tp)
+        self.assertEqual(len(lc.warnings), 1)
+
 
 if __name__ == '__main__':
     unittest.main()
diff --git a/roles/write-devstack-local-conf/tasks/main.yaml b/roles/write-devstack-local-conf/tasks/main.yaml
index 9a6b083a2f..bfd086034b 100644
--- a/roles/write-devstack-local-conf/tasks/main.yaml
+++ b/roles/write-devstack-local-conf/tasks/main.yaml
@@ -10,4 +10,5 @@
     local_conf: "{{ devstack_local_conf|default(omit) }}"
     base_dir: "{{ devstack_base_dir|default(omit) }}"
     projects: "{{ zuul.projects }}"
-    project: "{{ zuul.project }}"
\ No newline at end of file
+    project: "{{ zuul.project }}"
+    tempest_plugins: "{{ tempest_plugins|default(omit) }}"

From deadc7c439f1126ba986b9c4f3c4d0b6d7774016 Mon Sep 17 00:00:00 2001
From: whoami-rajat <rajatdhasmana@gmail.com>
Date: Thu, 14 Mar 2019 11:01:18 +0530
Subject: [PATCH 1502/2409] Fix : sort variables fetched from env list

In bionic, when exporting env variables, the env list displays
variables in unsorted format.
While fetching we are getting 'https_proxy' before 'http_proxy'
which is failing in comparison to our expected values[1].
This patch sorts the variables fetched from env.

[1] http://logs.openstack.org/30/643130/3/check/devstack-unit-tests/effbf7a/job-output.txt.gz#_2019-03-13_23_12_35_465026

Change-Id: Ie504eabf0d3fec1b97bc711e2702c06bcf75d158
---
 tests/test_functions.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/test_functions.sh b/tests/test_functions.sh
index adf20cdb80..08143d2a68 100755
--- a/tests/test_functions.sh
+++ b/tests/test_functions.sh
@@ -272,7 +272,7 @@ function test_export_proxy_variables {
 
     export_proxy_variables
     expected=$(echo -e "http_proxy=$http_proxy\nhttps_proxy=$https_proxy\nno_proxy=$no_proxy")
-    results=$(env | egrep '(http(s)?|no)_proxy=')
+    results=$(env | egrep '(http(s)?|no)_proxy=' | sort)
     if [[ $expected = $results ]]; then
         passed "OK: Proxy variables are exported when proxy variables are set"
     else

From f28c75f87abdda00dcfc2f673816728676313c95 Mon Sep 17 00:00:00 2001
From: whoami-rajat <rajatdhasmana@gmail.com>
Date: Wed, 13 Mar 2019 23:41:05 +0530
Subject: [PATCH 1503/2409] Cinder: create target directory for targetcli-fb
 package

While installing 'targetcli-fb' on bionic, a dependent package
'python-rtslib-fb' requires (but doesn't create) /etc/target
and fails[1] when this directory not found.
This patch creates the required directory.

[1] http://logs.openstack.org/26/641926/1/check/cinder-tempest-dsvm-lvm-lio-barbican/8f95df1/logs/devstacklog.txt.gz#_2019-03-13_03_36_44_623

Related-bug: #1819819
Change-Id: I7efefead873037da4aaacbdc6284458bdaad0f6b
---
 lib/cinder | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/cinder b/lib/cinder
index 48f3e45c55..047b25b3c5 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -435,6 +435,9 @@ function install_cinder {
         install_package tgt
     elif [[ "$CINDER_ISCSI_HELPER" == "lioadm" ]]; then
         if [[ ${DISTRO} == "bionic" ]]; then
+            # TODO(frickler): Workaround for https://launchpad.net/bugs/1819819
+            sudo mkdir -p /etc/target
+
             install_package targetcli-fb
         else
             install_package targetcli

From bcd8a50cc688ee39b4b998efe959e35c4c5b1408 Mon Sep 17 00:00:00 2001
From: Vlad Gridin <vladyslav.gridin@nuagenetworks.net>
Date: Thu, 14 Mar 2019 14:40:55 +0100
Subject: [PATCH 1504/2409] Fix installing tempest plugins

When running stack.sh locally on stable branches
with tempest enabled and TEMPEST_PLUGINS set,
devstack will try to fetch master branch of requirements
and that fails if branch is not tracked.

Change-Id: Ia1ae6869a8fede2af5cd7c875e0946b6a75eb518
Closes-Bug: #1820051
---
 lib/tempest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index 1e344c8567..0e8bfe7404 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -674,7 +674,7 @@ function install_tempest_plugins {
     pushd $TEMPEST_DIR
     if [[ $TEMPEST_PLUGINS != 0 ]] ; then
         # The requirements might be on a different branch, while tempest & tempest plugins needs master requirements.
-        (cd $REQUIREMENTS_DIR && git show master:upper-constraints.txt) > u-c-m.txt
+        (cd $REQUIREMENTS_DIR && git show origin/master:upper-constraints.txt) > u-c-m.txt
         tox -evenv-tempest -- pip install -c u-c-m.txt $TEMPEST_PLUGINS
         echo "Checking installed Tempest plugins:"
         tox -evenv-tempest -- tempest list-plugins

From ddb6179b0479ea9478cf2a146fe9b0d7592acaec Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Tue, 19 Mar 2019 15:04:12 -0400
Subject: [PATCH 1505/2409] Ease python 3 classifier check in
 check_python3_support_for_package_local

This makes the grep match in check_python3_support_for_package_local
the same as check_python3_support_for_package_remote.

Change I0349de2026c49279ba7f262d5e86d37018d66326 in grenade started
setting the PYTHON3_VERSION variable, and then we recently started
using bionic nodes everywhere which means we're running python 3.6.

The etcd3gw package has a python 3 and 3.5 classifier, but not 3.6:

https://pypi.org/project/etcd3gw/

The pip_install function code that is dealing with installing py3
packages is hitting a problem installing etcd3gw if the package is
local because of the more restrictive grep in the
check_python3_support_for_package_local function, and since
PYTHON3_VERSION=3.6 now, we don't install from py3 and install
etcd3gw on python 2.7 which makes services like cinder-volume and
cinder-backup, which use etcd3gw, fail when they are running under
python 3 (they get module import errors).

This simply removes the $ restriction on the grep. Looking at the
change that added those local/remote functions:

  I243ea4b76f0d5ef57a03b5b0798a05468ee6de9b

There is no explanation for the difference, it just said:

  Also, since not many packages are classified correctly, fallback
  to looking for just "Programming Language :: Python :: 3" and
  log a message for the package to highlight the problem.

So that's what this change does.

Note that alternatives would be:

1. Update the etcd3gw package to add the 3.6 classifier and do
   a release (this should probably happen anyway).

2. Add etcd3gw to ENABLED_PYTHON3_PACKAGES but that would be a
   short-term hack workaround.

Change-Id: Icd3768870ba0f1659bb2e6f002043d975047b73e
Closes-Bug: #1820892
---
 inc/python | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/inc/python b/inc/python
index 419d5c5701..0926330fdf 100644
--- a/inc/python
+++ b/inc/python
@@ -101,7 +101,7 @@ function check_python3_support_for_package_local {
     cd $name
     set +e
     classifier=$(python setup.py --classifiers \
-        | grep 'Programming Language :: Python :: 3$')
+        | grep 'Programming Language :: Python :: 3')
     set -e
     echo $classifier
 }
@@ -297,6 +297,8 @@ function pip_install {
                             echo "Automatically using $PYTHON3_VERSION version to install $package_dir based on local package settings"
                             sudo_pip="$sudo_pip LC_ALL=en_US.UTF-8"
                             cmd_pip=$(get_pip_command $PYTHON3_VERSION)
+                        else
+                            echo "WARNING: Did not find python 3 classifier for local package $package_dir"
                         fi
                     fi
                 else
@@ -307,6 +309,8 @@ function pip_install {
                         echo "Automatically using $PYTHON3_VERSION version to install $package based on remote package settings"
                         sudo_pip="$sudo_pip LC_ALL=en_US.UTF-8"
                         cmd_pip=$(get_pip_command $PYTHON3_VERSION)
+                    else
+                        echo "WARNING: Did not find python 3 classifier for remote package $package_dir"
                     fi
                 fi
             fi

From 245445b1bd35e580259f4decd9b0b047fe728794 Mon Sep 17 00:00:00 2001
From: Brian Haley <bhaley@redhat.com>
Date: Thu, 21 Mar 2019 11:40:17 -0400
Subject: [PATCH 1506/2409] Use L3RouterPlugin alias

The 'router' alias for the L3RouterPlugin has been in
setup.cfg for a while, let's use it.

Change-Id: Ifa196bd33959f1425df9a34cdab4acf4c3b8071b
---
 lib/neutron_plugins/ml2 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/ml2 b/lib/neutron_plugins/ml2
index c5a4c02cc5..127d46bcd7 100644
--- a/lib/neutron_plugins/ml2
+++ b/lib/neutron_plugins/ml2
@@ -44,7 +44,7 @@ fi
 # L3 Plugin to load for ML2
 # For some flat network environment, they not want to extend L3 plugin.
 # Make sure it is able to set empty to ML2_L3_PLUGIN.
-ML2_L3_PLUGIN=${ML2_L3_PLUGIN-neutron.services.l3_router.l3_router_plugin.L3RouterPlugin}
+ML2_L3_PLUGIN=${ML2_L3_PLUGIN-router}
 
 function populate_ml2_config {
     CONF=$1

From a30dd1cc96a75d565ae924e4698c4208150e5564 Mon Sep 17 00:00:00 2001
From: Lenny Verkhovsky <lennyb@mellanox.com>
Date: Thu, 14 Mar 2019 13:19:36 +0200
Subject: [PATCH 1507/2409] Fixed support python 2 on Fedora 27

I7d16194d6ba1391ca31251d5b50cbb8de033fc38 added wrong behavour
on Fedora > 26 and Centos 7 when python3 disabled
pip should install packages in /usr/bin

Closes-Bug: #1820070
Change-Id: I3a8efbc8eb6e311db9c7347577c5d2047ba523a9
---
 inc/python | 13 +++----------
 1 file changed, 3 insertions(+), 10 deletions(-)

diff --git a/inc/python b/inc/python
index 419d5c5701..ba2048dd84 100644
--- a/inc/python
+++ b/inc/python
@@ -49,16 +49,9 @@ function get_python_exec_prefix {
     fi
     $xtrace
 
-    if python3_enabled && [[ "$os_VENDOR" == "CentOS" ]] || \
-    [[ "$os_VENDOR" == "Fedora" && $os_RELEASE -gt 26 ]]; then
-        # Default Python 3 install prefix changed to /usr/local in Fedora 27:
-        # https://fedoraproject.org/wiki/Changes/Making_sudo_pip_safe
-        echo "/usr/local/bin"
-    elif is_fedora || is_suse; then
-        echo "/usr/bin"
-    else
-        echo "/usr/local/bin"
-    fi
+    local PYTHON_PATH=/usr/local/bin
+    ( is_fedora && ! python3_enabled ) || is_suse && PYTHON_PATH=/usr/bin
+    echo $PYTHON_PATH
 }
 
 # Wrapper for ``pip install`` that only installs versions of libraries

From e2853bf2d0a2e63d53d0f2d0cb21fd406f6289b0 Mon Sep 17 00:00:00 2001
From: melanie witt <melwittt@gmail.com>
Date: Wed, 13 Mar 2019 13:16:51 +0000
Subject: [PATCH 1508/2409] Set ownership of /etc/pki/<console> files for TLS

OpenSSL 1.0.2 generates key files with default permissions: 644 and the
files are copied to the /etc/pki/* directories with sudo.

When the default CI node Ubuntu version was changed from Xenial =>
Bionic we changed from OpenSSL 1.0.2 => 1.1.0. And OpenSSL 1.1.0
generates key files with default permissions: 600. When we copy the key
file to /etc/pki/* using sudo, it becomes owned by root and then the
console-related users are unable to read it.

This sets the ownership of the /etc/pki/<console> files to the
user:group intended to read them.

Closes-Bug: #1819794

Change-Id: I437a46c875cf633272e8cad0811e5557f2ac3641
---
 lib/nova                           | 16 ++++++++++++++++
 lib/nova_plugins/functions-libvirt |  8 +++++++-
 2 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index 033ebf3697..137a249c65 100644
--- a/lib/nova
+++ b/lib/nova
@@ -665,6 +665,22 @@ function configure_console_proxies {
             sudo mkdir -p /etc/pki/nova-novnc
             deploy_int_CA /etc/pki/nova-novnc/ca-cert.pem
             deploy_int_cert /etc/pki/nova-novnc/client-cert.pem /etc/pki/nova-novnc/client-key.pem
+            # OpenSSL 1.1.0 generates the key file with permissions: 600, by
+            # default, and the deploy_int* methods use 'sudo cp' to copy the
+            # files, making them owned by root:root.
+            # Change ownership of everything under /etc/pki/nova-novnc to
+            # $STACK_USER:$(id -g ${STACK_USER}) so that $STACK_USER can read
+            # the key file.
+            sudo chown -R $STACK_USER:$(id -g ${STACK_USER}) /etc/pki/nova-novnc
+            # This is needed to enable TLS in the proxy itself, example log:
+            # WebSocket server settings:
+            #   - Listen on 0.0.0.0:6080
+            #   - Flash security policy server
+            #   - Web server (no directory listings). Web root: /usr/share/novnc
+            #   - SSL/TLS support
+            #   - proxying from 0.0.0.0:6080 to None:None
+            iniset $conf DEFAULT key "/etc/pki/nova-novnc/client-key.pem"
+            iniset $conf DEFAULT cert "/etc/pki/nova-novnc/client-cert.pem"
         fi
     fi
 
diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index fcb4777997..463986944f 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -155,9 +155,15 @@ EOF
             echo "vnc_tls_x509_verify = 1" | sudo tee -a $QEMU_CONF
 
             sudo mkdir -p /etc/pki/libvirt-vnc
-            sudo chown libvirt-qemu:libvirt-qemu /etc/pki/libvirt-vnc
             deploy_int_CA /etc/pki/libvirt-vnc/ca-cert.pem
             deploy_int_cert /etc/pki/libvirt-vnc/server-cert.pem /etc/pki/libvirt-vnc/server-key.pem
+            # OpenSSL 1.1.0 generates the key file with permissions: 600, by
+            # default and the deploy_int* methods use 'sudo cp' to copy the
+            # files, making them owned by root:root.
+            # Change ownership of everything under /etc/pki/libvirt-vnc to
+            # libvirt-qemu:libvirt-qemu so that libvirt-qemu can read the key
+            # file.
+            sudo chown -R libvirt-qemu:libvirt-qemu /etc/pki/libvirt-vnc
         fi
     fi
 

From 315bc13595bf1ebae205f462fc6078f9fc3c840b Mon Sep 17 00:00:00 2001
From: ghanshyam <gmann@ghanshyammann.com>
Date: Tue, 26 Mar 2019 18:47:06 +0000
Subject: [PATCH 1509/2409] Update DEVSTACK_SERIES to train

stable/stein branch has been created now and
current master is for train.

Change-Id: I119f0388891db44c9753e49cedfeb32c74f2a40d
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index c6304bba94..2924d3956c 100644
--- a/stackrc
+++ b/stackrc
@@ -258,7 +258,7 @@ REQUIREMENTS_DIR=$DEST/requirements
 # Setting the variable to 'ALL' will activate the download for all
 # libraries.
 
-DEVSTACK_SERIES="stein"
+DEVSTACK_SERIES="train"
 
 ##############
 #

From e769348882ea3e6b4465e3a6af72029633b2485e Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 11 Feb 2019 12:26:03 +1100
Subject: [PATCH 1510/2409] Quote devstack_localrc arguments

If you have

 devstack_localrc:
   ARGUMENT: "argument with spaces"

The quotes get lost during YAML processing and the resulting file has

  ARGUMENT=argument with spaces

which is a shell error.

Quote all arguments to avoid this sort of thing.

Change-Id: Ia63a53d745dfea7262bcdb5d46425f431c3ccfe5
---
 .../write-devstack-local-conf/library/devstack_local_conf.py  | 2 +-
 roles/write-devstack-local-conf/library/test.py               | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/roles/write-devstack-local-conf/library/devstack_local_conf.py b/roles/write-devstack-local-conf/library/devstack_local_conf.py
index 8df8dea6dd..3a8cd588b9 100644
--- a/roles/write-devstack-local-conf/library/devstack_local_conf.py
+++ b/roles/write-devstack-local-conf/library/devstack_local_conf.py
@@ -252,7 +252,7 @@ def handle_localrc(self, localrc):
         if localrc:
             vg = VarGraph(localrc)
             for k, v in vg.getVars():
-                self.localrc.append('{}={}'.format(k, v))
+                self.localrc.append('{}="{}"'.format(k, v))
                 if k == 'LIBS_FROM_GIT':
                     lfg = True
                 elif k == 'TEMPEST_PLUGINS':
diff --git a/roles/write-devstack-local-conf/library/test.py b/roles/write-devstack-local-conf/library/test.py
index 2900949105..22bf2da55d 100644
--- a/roles/write-devstack-local-conf/library/test.py
+++ b/roles/write-devstack-local-conf/library/test.py
@@ -185,7 +185,7 @@ def test_overridelibs_from_git(self):
             for line in f:
                 if line.startswith('LIBS_FROM_GIT'):
                     lfg = line.strip().split('=')[1]
-        self.assertEqual('oslo.db', lfg)
+        self.assertEqual('"oslo.db"', lfg)
 
     def test_plugin_circular_deps(self):
         "Test that plugins with circular dependencies fail"
@@ -265,7 +265,7 @@ def test_tempest_plugins_not_overridden(self):
         lc.write(p['path'])
 
         tp = self._find_tempest_plugins_value(p['path'])
-        self.assertEqual('someplugin', tp)
+        self.assertEqual('"someplugin"', tp)
         self.assertEqual(len(lc.warnings), 1)
 
 

From 59ce1d902e2137bb7346a0d1f223e0ce1cb83216 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 11 Feb 2019 12:27:10 +1100
Subject: [PATCH 1511/2409] Export all journal logs

Currently we only export the devstack@ services, and then separately
export the kernel & sudo logs to syslog.txt.

This leaves a lot of logs potentially behind in the journal for
various daemons.  Just export the whole lot.

Using this output is currently very opaque and makes use of systemd
export tools that are very un-discoverable.  Add a README that will
appear alongside the journal explaining how to actually use it.  This
is a template as it would be nice to put into things like the list of
services that are in the journal, or maybe other magic.

Also make sure we export the logs since the start timestamp; currently
during a full run we drop the initial logs.

Change-Id: Id2626f9113d82c6d524039acda8a8ec74afb2081
---
 roles/export-devstack-journal/README.rst      | 14 +++---
 roles/export-devstack-journal/tasks/main.yaml | 45 +++++++++++++------
 .../templates/devstack.journal.README.txt.j2  | 33 ++++++++++++++
 3 files changed, 73 insertions(+), 19 deletions(-)
 create mode 100644 roles/export-devstack-journal/templates/devstack.journal.README.txt.j2

diff --git a/roles/export-devstack-journal/README.rst b/roles/export-devstack-journal/README.rst
index a34e0706a9..9e3c919627 100644
--- a/roles/export-devstack-journal/README.rst
+++ b/roles/export-devstack-journal/README.rst
@@ -1,11 +1,15 @@
 Export journal files from devstack services
 
-Export the systemd journal for every devstack service in native
-journal format as well as text.  Also, export a syslog-style file with
-kernal and sudo messages.
+This performs a number of logging collection services
 
-Writes the output to the ``logs/`` subdirectory of
-``stage_dir``.
+* Export the systemd journal in native format
+* For every devstack service, export logs to text in a file named
+  ``screen-*`` to maintain legacy compatability when devstack services
+  used to run in a screen session and were logged separately.
+* Export a syslog-style file with kernel and sudo messages for legacy
+  compatability.
+
+Writes the output to the ``logs/`` subdirectory of ``stage_dir``.
 
 **Role Variables**
 
diff --git a/roles/export-devstack-journal/tasks/main.yaml b/roles/export-devstack-journal/tasks/main.yaml
index 6e760c1f6f..cbec4447b8 100644
--- a/roles/export-devstack-journal/tasks/main.yaml
+++ b/roles/export-devstack-journal/tasks/main.yaml
@@ -6,32 +6,49 @@
     state: directory
     owner: "{{ ansible_user }}"
 
-# TODO: convert this to ansible
-- name: Export journal files
+- name: Export legacy stack screen log files
   become: true
   shell:
     cmd: |
       u=""
       name=""
-      for u in `systemctl list-unit-files | grep devstack | awk '{print $1}'`; do
+      for u in $(systemctl list-unit-files | grep devstack | awk '{print $1}'); do
         name=$(echo $u | sed 's/devstack@/screen-/' | sed 's/\.service//')
         journalctl -o short-precise --unit $u | gzip - > {{ stage_dir }}/logs/$name.txt.gz
       done
 
-      # Export the journal in export format to make it downloadable
-      # for later searching. It can then be rewritten to a journal native
-      # format locally using systemd-journal-remote. This makes a class of
-      # debugging much easier. We don't do the native conversion here as
-      # some distros do not package that tooling.
-      journalctl -u 'devstack@*' -o export | \
-          xz --threads=0 - > {{ stage_dir }}/logs/devstack.journal.xz
-
-      # The journal contains everything running under systemd, we'll
-      # build an old school version of the syslog with just the
-      # kernel and sudo messages.
+- name: Export legacy syslog.txt
+  become: true
+  shell:
+    # The journal contains everything running under systemd, we'll
+    # build an old school version of the syslog with just the
+    # kernel and sudo messages.
+    cmd: |
       journalctl \
           -t kernel \
           -t sudo \
           --no-pager \
           --since="$(cat {{ devstack_base_dir }}/log-start-timestamp.txt)" \
         | gzip - > {{ stage_dir }}/logs/syslog.txt.gz
+
+# TODO: convert this to ansible
+#  - make a list of the above units
+#  - iterate the list here
+- name: Export journal
+  become: true
+  shell:
+    # Export the journal in export format to make it downloadable
+    # for later searching. It can then be rewritten to a journal native
+    # format locally using systemd-journal-remote. This makes a class of
+    # debugging much easier. We don't do the native conversion here as
+    # some distros do not package that tooling.
+    cmd: |
+      journalctl -o export \
+          --since="$(cat {{ devstack_base_dir }}/log-start-timestamp.txt)" \
+        | xz --threads=0 - > {{ stage_dir }}/logs/devstack.journal.xz
+
+- name: Save journal README
+  become: true
+  template:
+    src: devstack.journal.README.txt.j2
+    dest: '{{ stage_dir }}/logs/devstack.journal.README.txt'
diff --git a/roles/export-devstack-journal/templates/devstack.journal.README.txt.j2 b/roles/export-devstack-journal/templates/devstack.journal.README.txt.j2
new file mode 100644
index 0000000000..598eb7f3db
--- /dev/null
+++ b/roles/export-devstack-journal/templates/devstack.journal.README.txt.j2
@@ -0,0 +1,33 @@
+Devstack systemd journal
+========================
+
+The devstack.journal file is a copy of the systemd journal during the
+devstack run.
+
+To use it, you will need to convert it so journalctl can read it
+locally.  After downloading the file:
+
+ $ /lib/systemd/systemd-journal-remote <(xzcat ./devstack.journal.xz) -o output.journal
+
+Note this binary is not in the regular path.  On Debian/Ubuntu
+platforms, you will need to have the "sytemd-journal-remote" package
+installed.
+
+It should result in something like:
+
+ Finishing after writing <large number> entries
+
+You can then use journalctl to examine this file.  For example, to see
+all devstack services try:
+
+ $ journalctl --file ./output.journal -u 'devstack@*'
+
+To see just cinder API server logs restrict the match with
+
+ $ journalctl --file ./output.journal -u 'devstack@c-api'
+
+There may be many types of logs available in the journal, a command like
+
+ $ journalctl --file ./output.journal --output=json-pretty | grep "_SYSTEMD_UNIT" | sort -u
+
+can help you find interesting things to filter on.
\ No newline at end of file

From 2bbc9bbbb8616711a0a52540f9a35d4394f0d0ad Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 11 Feb 2019 12:25:38 +1100
Subject: [PATCH 1512/2409] Add service to tcpdump during run

This adds a service to run a tcpdump during the run.  This can be
useful to capture various network traffic for post analysis.

There didn't seem to quite be an appropriate place to document it, so
a new debugging file is started, with some terse explaination of our
various system-wide debugging services.

Change-Id: I09aaa57611c5047d09a9bce7932d34e9d50b30e6
---
 .zuul.yaml               |  1 +
 doc/source/debugging.rst | 46 ++++++++++++++++++++++++++++++++++++++++
 lib/tcpdump              | 43 +++++++++++++++++++++++++++++++++++++
 stack.sh                 |  7 ++++++
 4 files changed, 97 insertions(+)
 create mode 100644 doc/source/debugging.rst
 create mode 100644 lib/tcpdump

diff --git a/.zuul.yaml b/.zuul.yaml
index 7ee759818e..62e875350d 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -232,6 +232,7 @@
         '{{ devstack_log_dir }}/dstat-csv.log': logs
         '{{ devstack_log_dir }}/devstacklog.txt': logs
         '{{ devstack_log_dir }}/devstacklog.txt.summary': logs
+        '{{ devstack_log_dir }}/tcpdump.pcap': logs
         '{{ devstack_full_log}}': logs
         '{{ stage_dir }}/verify_tempest_conf.log': logs
         '{{ stage_dir }}/apache': logs
diff --git a/doc/source/debugging.rst b/doc/source/debugging.rst
new file mode 100644
index 0000000000..fd0d9cdf74
--- /dev/null
+++ b/doc/source/debugging.rst
@@ -0,0 +1,46 @@
+=====================
+System-wide debugging
+=====================
+
+A lot can go wrong during a devstack run, and there are a few inbuilt
+tools to help you.
+
+dstat
+-----
+
+Enable the ``dstat`` service to produce performance logs during the
+devstack run.  These will be logged to the journal and also as a CSV
+file.
+
+memory_tracker
+--------------
+
+The ``memory_tracker`` service periodically monitors RAM usage and
+provides consumption output when available memory is seen to be
+falling (i.e. processes are consuming memory).  It also provides
+output showing locked (unswappable) memory.
+
+tcpdump
+-------
+
+Enable the ``tcpdump`` service to run a background tcpdump.  You must
+set the ``TCPDUMP_ARGS`` variable to something suitable (there is no
+default).  For example, to trace iSCSI communication during a job in
+the OpenStack gate and copy the result into the log output, you might
+use:
+
+.. code-block:: yaml
+
+   job:
+     name: devstack-job
+     parent: devstack
+     vars:
+       devstack_services:
+         tcpdump: true
+       devstack_localrc:
+         TCPDUMP_ARGS: "-i any tcp port 3260"
+       zuul_copy_output:
+         '{{ devstack_log_dir }}/tcpdump.pcap': logs
+
+
+
diff --git a/lib/tcpdump b/lib/tcpdump
new file mode 100644
index 0000000000..16e8269d02
--- /dev/null
+++ b/lib/tcpdump
@@ -0,0 +1,43 @@
+#!/bin/bash
+#
+# lib/tcpdump
+# Functions to start and stop a tcpdump
+
+# Dependencies:
+#
+# - ``functions`` file
+
+# ``stack.sh`` calls the entry points in this order:
+#
+# - start_tcpdump
+# - stop_tcpdump
+
+# Save trace setting
+_XTRACE_TCPDUMP=$(set +o | grep xtrace)
+set +o xtrace
+
+TCPDUMP_OUTPUT=${TCPDUMP_OUTPUT:-$LOGDIR/tcpdump.pcap}
+
+# e.g. for iscsi
+#  "-i any tcp port 3260"
+TCPDUMP_ARGS=${TCPDUMP_ARGS:-""}
+
+# start_tcpdump() - Start running processes
+function start_tcpdump {
+    # Run a tcpdump with given arguments and save the packet capture
+    if is_service_enabled tcpdump; then
+        if [[ -z "${TCPDUMP_ARGS}" ]]; then
+            die $LINENO "The tcpdump service requires TCPDUMP_ARGS to be set"
+        fi
+        touch ${TCPDUMP_OUTPUT}
+        run_process tcpdump "/usr/sbin/tcpdump -w $TCPDUMP_OUTPUT $TCPDUMP_ARGS" root root
+    fi
+}
+
+# stop_tcpdump() stop tcpdump process
+function stop_tcpdump {
+    stop_process tcpdump
+}
+
+# Restore xtrace
+$_XTRACE_TCPDUMP
diff --git a/stack.sh b/stack.sh
index 022d5b9438..dfc9d24f51 100755
--- a/stack.sh
+++ b/stack.sh
@@ -614,6 +614,7 @@ source $TOP_DIR/lib/swift
 source $TOP_DIR/lib/neutron
 source $TOP_DIR/lib/ldap
 source $TOP_DIR/lib/dstat
+source $TOP_DIR/lib/tcpdump
 source $TOP_DIR/lib/etcd3
 
 # Extras Source
@@ -1053,6 +1054,12 @@ fi
 # A better kind of sysstat, with the top process per time slice
 start_dstat
 
+# Run a background tcpdump for debugging
+# Note: must set TCPDUMP_ARGS with the enabled service
+if is_service_enabled tcpdump; then
+    start_tcpdump
+fi
+
 # Etcd
 # -----
 

From 8213d7c03990c8134cbe12bb6c7dac32bb7a0c50 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 11 Feb 2019 12:28:15 +1100
Subject: [PATCH 1513/2409] Add ISCSI_DEBUG option

This option adds a systemd override to start the iscsi daemon with
debugging enabled.

Change-Id: Ie27991776aa07a695026036e47513221220332a0
---
 lib/nova | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index 7c6f8cd465..dee798cd5e 100644
--- a/lib/nova
+++ b/lib/nova
@@ -183,6 +183,10 @@ TEST_FLOATING_RANGE=${TEST_FLOATING_RANGE:-192.168.253.0/29}
 # and Glance.
 NOVA_USE_SERVICE_TOKEN=$(trueorfalse False NOVA_USE_SERVICE_TOKEN)
 
+# Enable debugging levels for iscsid service (goes from 0-8)
+ISCSID_DEBUG=$(trueorfalse False ISCSID_DEBUG)
+ISCSID_DEBUG_LEVEL=${ISCSID_DEBUG_LEVEL:-4}
+
 # Functions
 # ---------
 
@@ -327,8 +331,22 @@ function configure_nova {
                 sudo chown -R $STACK_USER $NOVA_INSTANCES_PATH
             fi
         fi
+
+        if [[ ${ISCSID_DEBUG} == "True" ]]; then
+            # Install an override that starts iscsid with debugging
+            # enabled.
+            cat > /tmp/iscsid.override <<EOF
+[Service]
+ExecStart=
+ExecStart=/usr/sbin/iscsid -d${ISCSID_DEBUG_LEVEL}
+EOF
+            sudo mkdir -p /etc/systemd/system/iscsid.service.d
+            sudo mv /tmp/iscsid.override /etc/systemd/system/iscsid.service.d/override.conf
+            sudo systemctl daemon-reload
+        fi
+
         # ensure that iscsid is started, even when disabled by default
-        start_service iscsid
+        restart_service iscsid
     fi
 
     # Rebuild the config file from scratch

From 1124a055711c01ad61da8063de47eed9d9acffeb Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 11 Feb 2019 13:35:43 +1100
Subject: [PATCH 1514/2409] Handle pcp-dstat transition

dstat is Python 2, never going to be updated and effectively
abandonded.  The replacement is pcp-dstat [1] which is mostly
compatible, with a few differences.  As distro start transitioning
(Fedora has), just drop the unsupported args for now.

[1] https://pcp.io/man/man1/pcp-dstat.1.html

Change-Id: Ibec8a37cb18a14656d97e2096c66bc8b21406068
---
 tools/dstat.sh | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/tools/dstat.sh b/tools/dstat.sh
index 01c6d9b7e9..e6cbb0f21c 100755
--- a/tools/dstat.sh
+++ b/tools/dstat.sh
@@ -12,8 +12,17 @@
 # Retrieve log directory as argument from calling script.
 LOGDIR=$1
 
+DSTAT_TOP_OPTS="--top-cpu-adv --top-io-adv --top-mem"
+if dstat --version | grep -q 'pcp-dstat' ; then
+    # dstat is unmaintained, and moving to a plugin of performance
+    # co-pilot.  Fedora 29 for example has rolled this out.  It's
+    # mostly compatible, except for a few options which are not
+    # implemented (yet?)
+    DSTAT_TOP_OPTS=""
+fi
+
 # Command line arguments for primary DStat process.
-DSTAT_OPTS="-tcmndrylpg --top-cpu-adv --top-io-adv --top-mem --swap --tcp"
+DSTAT_OPTS="-tcmndrylpg ${DSTAT_TOP_OPTS} --swap --tcp"
 
 # Command-line arguments for secondary background DStat process.
 DSTAT_CSV_OPTS="-tcmndrylpg --tcp --output $LOGDIR/dstat-csv.log"

From 7224a6b54d4114d1b82a63e702586951860bab95 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Mon, 1 Apr 2019 11:16:53 +0000
Subject: [PATCH 1515/2409] Update docs index page

- Switch from proposing Ubuntu 16.04 to 18.04 as the most tested
  platform.
- Make it clearer that creating an additional "stack" user is
  optional when running on a cloud image, as this step often leads
  to errors for new users.
- Fix some minor nits along the way.

Change-Id: I39aef1a230b668b932b1681fcd0deeb423b411f1
---
 doc/source/index.rst | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/doc/source/index.rst b/doc/source/index.rst
index 9186f6dba7..1ea1c5ddae 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -38,22 +38,23 @@ Quick Start
 Install Linux
 -------------
 
-Start with a clean and minimal install of a Linux system. Devstack
+Start with a clean and minimal install of a Linux system. DevStack
 attempts to support the two latest LTS releases of Ubuntu, the
 latest/current Fedora version, CentOS/RHEL 7, as well as Debian and
 OpenSUSE.
 
-If you do not have a preference, Ubuntu 16.04 is the most tested, and
-will probably go the smoothest.
+If you do not have a preference, Ubuntu 18.04 (Bionic Beaver) is the
+most tested, and will probably go the smoothest.
 
-Add Stack User
---------------
+Add Stack User (optional)
+-------------------------
 
-Devstack should be run as a non-root user with sudo enabled
+DevStack should be run as a non-root user with sudo enabled
 (standard logins to cloud images such as "ubuntu" or "cloud-user"
 are usually fine).
 
-You can quickly create a separate `stack` user to run DevStack with
+If you are not using a cloud image, you can create a separate `stack` user
+to run DevStack with
 
 .. code-block:: console
 
@@ -76,12 +77,12 @@ Download DevStack
    $ cd devstack
 
 The ``devstack`` repo contains a script that installs OpenStack and
-templates for configuration files
+templates for configuration files.
 
 Create a local.conf
 -------------------
 
-Create a ``local.conf`` file with 4 passwords preset at the root of the
+Create a ``local.conf`` file with four passwords preset at the root of the
 devstack git repo.
 
 .. code-block:: ini

From 7f0b4f3001575d1419c5020e007ce2c841c88f2f Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Mon, 1 Apr 2019 11:43:28 +0000
Subject: [PATCH 1516/2409] Fix double quoting issue when writing localconf

When [0] introduced quoting all arguments, it broke existing consumers
that already quote their value themselves. Fix this by avoiding to add
additional quotes to the value when it already starts with a double
quote.

[0] https://review.openstack.org/636078

Change-Id: I92146e04731efc6dcc632ae6c3a7c374e783cdba
Closes-Bug: 1822453
---
 .../library/devstack_local_conf.py             |  6 +++++-
 .../write-devstack-local-conf/library/test.py  | 18 ++++++++++++++++++
 2 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/roles/write-devstack-local-conf/library/devstack_local_conf.py b/roles/write-devstack-local-conf/library/devstack_local_conf.py
index 3a8cd588b9..2f97d0e355 100644
--- a/roles/write-devstack-local-conf/library/devstack_local_conf.py
+++ b/roles/write-devstack-local-conf/library/devstack_local_conf.py
@@ -252,7 +252,11 @@ def handle_localrc(self, localrc):
         if localrc:
             vg = VarGraph(localrc)
             for k, v in vg.getVars():
-                self.localrc.append('{}="{}"'.format(k, v))
+                # Avoid double quoting
+                if len(v) and v[0]=='"':
+                    self.localrc.append('{}={}'.format(k, v))
+                else:
+                    self.localrc.append('{}="{}"'.format(k, v))
                 if k == 'LIBS_FROM_GIT':
                     lfg = True
                 elif k == 'TEMPEST_PLUGINS':
diff --git a/roles/write-devstack-local-conf/library/test.py b/roles/write-devstack-local-conf/library/test.py
index 22bf2da55d..7c526b34c8 100644
--- a/roles/write-devstack-local-conf/library/test.py
+++ b/roles/write-devstack-local-conf/library/test.py
@@ -187,6 +187,24 @@ def test_overridelibs_from_git(self):
                     lfg = line.strip().split('=')[1]
         self.assertEqual('"oslo.db"', lfg)
 
+    def test_avoid_double_quote(self):
+        "Test that there a no duplicated quotes"
+        localrc = {'TESTVAR': '"quoted value"'}
+        p = dict(localrc=localrc,
+                 base_services=[],
+                 base_dir='./test',
+                 path=os.path.join(self.tmpdir, 'test.local.conf'),
+                 projects={})
+        lc = self._init_localconf(p)
+        lc.write(p['path'])
+
+        testvar = None
+        with open(p['path']) as f:
+            for line in f:
+                if line.startswith('TESTVAR'):
+                    testvar = line.strip().split('=')[1]
+        self.assertEqual('"quoted value"', testvar)
+
     def test_plugin_circular_deps(self):
         "Test that plugins with circular dependencies fail"
         os.makedirs(os.path.join(self.tmpdir, 'foo-plugin', 'devstack'))

From e03bcb2c8b8f1ee1cbef579454a30776e43175b3 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Mon, 1 Apr 2019 12:19:45 -0400
Subject: [PATCH 1517/2409] Remove crusty old python 3 package version logic

If we are running with python3, just assume that any
package that is not blacklisted is available for py3
and just attempt to install it and let pip sort it out
whether it gets installed from a local or remote package.

Change-Id: Ic05d183e489320f6dfc721575d47e7e4d661f87c
Closes-Bug: #1820892
---
 inc/python | 70 ++++--------------------------------------------------
 1 file changed, 5 insertions(+), 65 deletions(-)

diff --git a/inc/python b/inc/python
index e2a042e452..19e1228d23 100644
--- a/inc/python
+++ b/inc/python
@@ -81,34 +81,6 @@ function pip_install_gr_extras {
     pip_install $clean_name[$extras]
 }
 
-# Determine the python versions supported by a package
-function get_python_versions_for_package {
-    local name=$1
-    cd $name && python setup.py --classifiers \
-        | grep 'Language' | cut -f5 -d: | grep '\.' | tr '\n' ' '
-}
-
-# Check for python3 classifier in local directory
-function check_python3_support_for_package_local {
-    local name=$1
-    cd $name
-    set +e
-    classifier=$(python setup.py --classifiers \
-        | grep 'Programming Language :: Python :: 3')
-    set -e
-    echo $classifier
-}
-
-# Check for python3 classifier on pypi
-function check_python3_support_for_package_remote {
-    local name=$1
-    set +e
-    classifier=$(curl -s -L "https://pypi.python.org/pypi/$name/json" \
-        | grep '"Programming Language :: Python :: 3"')
-    set -e
-    echo $classifier
-}
-
 # python3_enabled_for() assumes the service(s) specified as arguments are
 # enabled for python 3 unless explicitly disabled. See python3_disabled_for().
 #
@@ -259,52 +231,20 @@ function pip_install {
             cmd_pip=$(get_pip_command $PYTHON2_VERSION)
             local sudo_pip="sudo -H"
             if python3_enabled; then
-                # Look at the package classifiers to find the python
-                # versions supported, and if we find the version of
-                # python3 we've been told to use, use that instead of the
-                # default pip
-                local python_versions
-
                 # Special case some services that have experimental
                 # support for python3 in progress, but don't claim support
                 # in their classifier
                 echo "Check python version for : $package_dir"
                 if python3_disabled_for ${package_dir##*/}; then
                     echo "Explicitly using $PYTHON2_VERSION version to install $package_dir based on DISABLED_PYTHON3_PACKAGES"
-                elif python3_enabled_for ${package_dir##*/}; then
+                else
+                    # For everything that is not explicitly blacklisted with
+                    # DISABLED_PYTHON3_PACKAGES, assume it supports python3
+                    # and we will let pip sort out the install, regardless of
+                    # the package being local or remote.
                     echo "Using $PYTHON3_VERSION version to install $package_dir based on default behavior"
                     sudo_pip="$sudo_pip LC_ALL=en_US.UTF-8"
                     cmd_pip=$(get_pip_command $PYTHON3_VERSION)
-                elif [[ -d "$package_dir" ]]; then
-                    python_versions=$(get_python_versions_for_package $package_dir)
-                    if [[ $python_versions =~ $PYTHON3_VERSION ]]; then
-                        echo "Automatically using $PYTHON3_VERSION version to install $package_dir based on classifiers"
-                        sudo_pip="$sudo_pip LC_ALL=en_US.UTF-8"
-                        cmd_pip=$(get_pip_command $PYTHON3_VERSION)
-                    else
-                        # The package may not have yet advertised python3.5
-                        # support so check for just python3 classifier and log
-                        # a warning.
-                        python3_classifier=$(check_python3_support_for_package_local $package_dir)
-                        if [[ ! -z "$python3_classifier" ]]; then
-                            echo "Automatically using $PYTHON3_VERSION version to install $package_dir based on local package settings"
-                            sudo_pip="$sudo_pip LC_ALL=en_US.UTF-8"
-                            cmd_pip=$(get_pip_command $PYTHON3_VERSION)
-                        else
-                            echo "WARNING: Did not find python 3 classifier for local package $package_dir"
-                        fi
-                    fi
-                else
-                    # Check pypi as we don't have the package on disk
-                    package=$(echo $package_dir | grep -o '^[.a-zA-Z0-9_-]*')
-                    python3_classifier=$(check_python3_support_for_package_remote $package)
-                    if [[ ! -z "$python3_classifier" ]]; then
-                        echo "Automatically using $PYTHON3_VERSION version to install $package based on remote package settings"
-                        sudo_pip="$sudo_pip LC_ALL=en_US.UTF-8"
-                        cmd_pip=$(get_pip_command $PYTHON3_VERSION)
-                    else
-                        echo "WARNING: Did not find python 3 classifier for remote package $package_dir"
-                    fi
                 fi
             fi
         fi

From 3ffc00940fdfddbef2c3bd4bc2298104ab606504 Mon Sep 17 00:00:00 2001
From: Luigi Toscano <ltoscano@redhat.com>
Date: Tue, 2 Apr 2019 12:28:31 +0200
Subject: [PATCH 1518/2409] sync-devstack-data: new argument
 devstack_data_base_dir

When the role is used by grenade, the data directory is shared among
different devstack executions, and the base directory is different,
for example: /opt/stack/data vs /opt/stack/{old,new}.
The new devstack_data_base_dir parameter allows user to specify
a base directory for the data/ directory which is unrelated
to the devstack directory. The default value is devstack_base_dir,
so the default behavior is unchanged.

Change-Id: Ie69b7b51947cbf1a8b31d2701783de2fb56a2d33
---
 roles/sync-devstack-data/README.rst         |  7 +++++++
 roles/sync-devstack-data/defaults/main.yaml |  1 +
 roles/sync-devstack-data/tasks/main.yaml    | 12 ++++++------
 3 files changed, 14 insertions(+), 6 deletions(-)

diff --git a/roles/sync-devstack-data/README.rst b/roles/sync-devstack-data/README.rst
index 500e8cccc4..388625c893 100644
--- a/roles/sync-devstack-data/README.rst
+++ b/roles/sync-devstack-data/README.rst
@@ -10,3 +10,10 @@ subnodes.
    :default: /opt/stack
 
    The devstack base directory.
+
+.. zuul:rolevar:: devstack_data_base_dir
+   :default: {{ devstack_base_dir }}
+
+   The devstack base directory for data/.
+   Useful for example when multiple executions of devstack (i.e. grenade)
+   share the same data directory.
diff --git a/roles/sync-devstack-data/defaults/main.yaml b/roles/sync-devstack-data/defaults/main.yaml
index fea05c8146..6b5017b811 100644
--- a/roles/sync-devstack-data/defaults/main.yaml
+++ b/roles/sync-devstack-data/defaults/main.yaml
@@ -1 +1,2 @@
 devstack_base_dir: /opt/stack
+devstack_data_base_dir: "{{ devstack_base_dir }}"
diff --git a/roles/sync-devstack-data/tasks/main.yaml b/roles/sync-devstack-data/tasks/main.yaml
index 46000159d4..e62be87ccd 100644
--- a/roles/sync-devstack-data/tasks/main.yaml
+++ b/roles/sync-devstack-data/tasks/main.yaml
@@ -1,7 +1,7 @@
 - name: Ensure the data folder exists
   become: true
   file:
-    path: "{{ devstack_base_dir }}/data"
+    path: "{{ devstack_data_base_dir }}/data"
     state: directory
     owner: stack
     group: stack
@@ -11,7 +11,7 @@
 - name: Ensure the CA folder exists
   become: true
   file:
-    path: "{{ devstack_base_dir }}/data/CA"
+    path: "{{ devstack_data_base_dir }}/data/CA"
     state: directory
     owner: stack
     group: stack
@@ -25,8 +25,8 @@
     dest: "{{ zuul.executor.work_root }}/{{ item | basename }}"
     mode: pull
   with_items:
-    - "{{ devstack_base_dir }}/data/ca-bundle.pem"
-    - "{{ devstack_base_dir }}/data/CA"
+    - "{{ devstack_data_base_dir }}/data/ca-bundle.pem"
+    - "{{ devstack_data_base_dir }}/data/CA"
   when: inventory_hostname == 'controller'
 
 - name: Push the CA certificate
@@ -34,7 +34,7 @@
   become_user: stack
   synchronize:
     src: "{{ zuul.executor.work_root }}/ca-bundle.pem"
-    dest: "{{ devstack_base_dir }}/data/ca-bundle.pem"
+    dest: "{{ devstack_data_base_dir }}/data/ca-bundle.pem"
     mode: push
   when: 'inventory_hostname in groups["subnode"]|default([])'
 
@@ -43,6 +43,6 @@
   become_user: stack
   synchronize:
     src: "{{ zuul.executor.work_root }}/CA/"
-    dest: "{{ devstack_base_dir }}/data/"
+    dest: "{{ devstack_data_base_dir }}/data/"
     mode: push
   when: 'inventory_hostname in groups["subnode"]|default([])'

From d5a68a6b7039a66455d7e320379a6b0b3879891c Mon Sep 17 00:00:00 2001
From: melanie witt <melwittt@gmail.com>
Date: Tue, 2 Apr 2019 22:52:23 +0000
Subject: [PATCH 1519/2409] Configure console proxy ports in nova_cellN.conf

We're able to run multiple cells in devstack by setting the variable
NOVA_NUM_CELLS in the devstack local.conf. Since we run console
proxies per cell, we will start two console proxies if
NOVA_NUM_CELLS=2. However, we've not been configuring the console
proxy ports in the nova_cellN.conf files, so an attempt to start
more than one will result in a port conflict and failure to start
the subsequent console proxy services with error:

  ERROR nova error: [Errno 98] Address already in use

This adds configuration of the console proxy ports based on an offset
while looping across NOVA_NUM_CELLS. The base port values are taken
from the config option defaults in the nova code: nova/conf/vnc.py,
nova/conf/spice.py, and nova/conf/serial_console.py.

Closes-Bug: #1822873

Change-Id: I8934d0b9392f2976347391c8a650ad260f337762
---
 lib/nova | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index dee798cd5e..1b5132b018 100644
--- a/lib/nova
+++ b/lib/nova
@@ -607,8 +607,10 @@ function create_nova_conf {
     else
         for i in $(seq 1 $NOVA_NUM_CELLS); do
             local conf
+            local offset
             conf=$(conductor_conf $i)
-            configure_console_proxies $conf
+            offset=$((i - 1))
+            configure_console_proxies $conf $offset
         done
     fi
 }
@@ -678,10 +680,17 @@ function configure_console_compute {
 function configure_console_proxies {
     # Use the provided config file path or default to $NOVA_CONF.
     local conf=${1:-$NOVA_CONF}
+    local offset=${2:-0}
+    # Stagger the offset based on the total number of possible console proxies
+    # (novnc, xvpvnc, spice, serial) so that their ports will not collide if
+    # all are enabled.
+    offset=$((offset * 4))
 
     if is_service_enabled n-novnc || is_service_enabled n-xvnc || [ "$NOVA_VNC_ENABLED" != False ]; then
         iniset $conf vnc novncproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
+        iniset $conf vnc novncproxy_port $((6080 + offset))
         iniset $conf vnc xvpvncproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
+        iniset $conf vnc xvpvncproxy_port $((6081 + offset))
 
         if is_nova_console_proxy_compute_tls_enabled ; then
             iniset $conf vnc auth_schemes "vencrypt"
@@ -713,10 +722,12 @@ function configure_console_proxies {
 
     if is_service_enabled n-spice; then
         iniset $conf spice html5proxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
+        iniset $conf spice html5proxy_port $((6082 + offset))
     fi
 
     if is_service_enabled n-sproxy; then
         iniset $conf serial_console serialproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
+        iniset $conf serial_console serialproxy_port $((6083 + offset))
     fi
 }
 

From 5fcb4447cf601905a795064e67cfb479c0af67a1 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Thu, 14 Feb 2019 12:56:48 +0000
Subject: [PATCH 1520/2409] Make most platform jobs run with python3

python2.7 will be EOL soon, let's test on python3 instead.
Exclude CentOS 7, as there is no python3 easily available.

Change-Id: I24d8812c0c37b6d376fd5ae38067513bb62a2804
---
 .zuul.yaml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index afe400e1a4..17723e7dd0 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -496,21 +496,21 @@
 
 - job:
     name: devstack-platform-opensuse-150
-    parent: tempest-full
+    parent: tempest-full-py3
     description: openSUSE 15.0 platform test
     nodeset: devstack-single-node-opensuse-150
     voting: false
 
 - job:
     name: devstack-platform-fedora-latest
-    parent: tempest-full
+    parent: tempest-full-py3
     description: Fedora latest platform test
     nodeset: devstack-single-node-fedora-latest
     voting: false
 
 - job:
     name: devstack-platform-xenial
-    parent: tempest-full
+    parent: tempest-full-py3
     description: Ubuntu Xenial platform test
     nodeset: openstack-single-node-xenial
     voting: false

From cc072fd32f72d4f05257d0b0c8c7c41fa1178f52 Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Wed, 31 May 2017 20:27:59 -0700
Subject: [PATCH 1521/2409] Run devstack CA and cert setup early

Previously apache was configured and restarted before we configured
the CA and certs. In most cases this is fine because those specific
vhosts didn't use tls. However, if you had previously run devstack
and had leftover vhosts and an unconfigured CA or certs devstack would
fail.

This is a small corner case, but its simple to address by moving CA and
cert setup up in stack.sh to before we do anything related to web
servers.

Change-Id: I31dbaf9471088b9faff26c7b790da6f6feebb2d5
---
 stack.sh | 19 ++++++++++++-------
 1 file changed, 12 insertions(+), 7 deletions(-)

diff --git a/stack.sh b/stack.sh
index dfc9d24f51..0d7e623c78 100755
--- a/stack.sh
+++ b/stack.sh
@@ -833,6 +833,18 @@ if is_service_enabled etcd3; then
     install_etcd3
 fi
 
+# Setup TLS certs
+# ---------------
+
+# Do this early, before any webservers are set up to ensure
+# we don't run into problems with missing certs when apache
+# is restarted.
+if is_service_enabled tls-proxy; then
+    configure_CA
+    init_CA
+    init_cert
+fi
+
 # Check Out and Install Source
 # ----------------------------
 
@@ -857,13 +869,6 @@ if is_service_enabled neutron nova horizon; then
     install_neutronclient
 fi
 
-# Setup TLS certs
-if is_service_enabled tls-proxy; then
-    configure_CA
-    init_CA
-    init_cert
-fi
-
 # Install middleware
 install_keystonemiddleware
 

From 1348ac990df40c504056a235156979629b844e8a Mon Sep 17 00:00:00 2001
From: Akihiro Motoki <amotoki@gmail.com>
Date: Thu, 4 Apr 2019 22:30:24 +0900
Subject: [PATCH 1522/2409] stack.sh: Clear OpenStack related envvars

stack.sh usually fails when it is started in a shell session
where OpenStack related environment variables OS_* are set.
Most common failure scenarios are failures in keystone operations.

This commits clears OpenStack related environment variables
at the begining of stack.sh.

Change-Id: I3a924a0586dc9bb28f3bf3e151e100c24015efe5
---
 stack.sh | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/stack.sh b/stack.sh
index dfc9d24f51..396d742c72 100755
--- a/stack.sh
+++ b/stack.sh
@@ -60,6 +60,9 @@ unset LANGUAGE
 LC_ALL=en_US.utf8
 export LC_ALL
 
+# Clear all OpenStack related envvars
+unset `env | grep -E '^OS_' | cut -d = -f 1`
+
 # Make sure umask is sane
 umask 022
 

From 56af9229a04b29c1ac70099e8361cec423096e99 Mon Sep 17 00:00:00 2001
From: Trinh Nguyen <dangtrinhnt@gmail.com>
Date: Fri, 14 Dec 2018 17:27:46 +0900
Subject: [PATCH 1523/2409] Remove pkg/elasticsearch.sh

The pkg/elasticsearch.sh is only used by Panko but Panko has
moved the script to its own repository [1].

[1] https://review.openstack.org/#/c/643262/

Change-Id: I0ce40f4299246b68624abd2072c2abce06f1e70b
Signed-off-by: Trinh Nguyen <dangtrinhnt@gmail.com>
---
 pkg/elasticsearch.sh | 148 -------------------------------------------
 1 file changed, 148 deletions(-)
 delete mode 100755 pkg/elasticsearch.sh

diff --git a/pkg/elasticsearch.sh b/pkg/elasticsearch.sh
deleted file mode 100755
index bd4415315f..0000000000
--- a/pkg/elasticsearch.sh
+++ /dev/null
@@ -1,148 +0,0 @@
-#!/bin/bash -xe
-
-# basic reference point for things like filecache
-#
-# TODO(sdague): once we have a few of these I imagine the download
-# step can probably be factored out to something nicer
-TOP_DIR=$(cd $(dirname "$0")/.. && pwd)
-FILES=$TOP_DIR/files
-source $TOP_DIR/stackrc
-
-# Package source and version, all pkg files are expected to have
-# something like this, as well as a way to override them.
-ELASTICSEARCH_VERSION=${ELASTICSEARCH_VERSION:-1.7.5}
-ELASTICSEARCH_BASEURL=${ELASTICSEARCH_BASEURL:-https://download.elasticsearch.org/elasticsearch/elasticsearch}
-
-# Elastic search actual implementation
-function wget_elasticsearch {
-    local file=${1}
-
-    if [ ! -f ${FILES}/${file} ]; then
-        wget $ELASTICSEARCH_BASEURL/${file} -O ${FILES}/${file}
-    fi
-
-    if [ ! -f ${FILES}/${file}.sha1.txt ]; then
-        wget $ELASTICSEARCH_BASEURL/${file}.sha1.txt -O ${FILES}/${file}.sha1.txt
-    fi
-
-    pushd ${FILES};  sha1sum ${file} > ${file}.sha1.gen;  popd
-
-    if ! diff ${FILES}/${file}.sha1.gen ${FILES}/${file}.sha1.txt; then
-        echo "Invalid elasticsearch download. Could not install."
-        return 1
-    fi
-    return 0
-}
-
-function download_elasticsearch {
-    if is_ubuntu; then
-        wget_elasticsearch elasticsearch-${ELASTICSEARCH_VERSION}.deb
-    elif is_fedora || is_suse; then
-        wget_elasticsearch elasticsearch-${ELASTICSEARCH_VERSION}.noarch.rpm
-    fi
-}
-
-function configure_elasticsearch {
-    # currently a no op
-    :
-}
-
-function _check_elasticsearch_ready {
-    # poll elasticsearch to see if it's started
-    if ! wait_for_service 120 http://localhost:9200; then
-        die $LINENO "Maximum timeout reached. Could not connect to ElasticSearch"
-    fi
-}
-
-function start_elasticsearch {
-    if is_ubuntu; then
-        sudo /etc/init.d/elasticsearch start
-        _check_elasticsearch_ready
-    elif is_fedora; then
-        sudo /bin/systemctl start elasticsearch.service
-        _check_elasticsearch_ready
-    elif is_suse; then
-        sudo /usr/bin/systemctl start elasticsearch.service
-        _check_elasticsearch_ready
-    else
-        echo "Unsupported architecture...can not start elasticsearch."
-    fi
-}
-
-function stop_elasticsearch {
-    if is_ubuntu; then
-        sudo /etc/init.d/elasticsearch stop
-    elif is_fedora; then
-        sudo /bin/systemctl stop elasticsearch.service
-    elif is_suse ; then
-        sudo /usr/bin/systemctl stop elasticsearch.service
-    else
-        echo "Unsupported architecture...can not stop elasticsearch."
-    fi
-}
-
-function install_elasticsearch {
-    pip_install_gr elasticsearch
-    if is_package_installed elasticsearch; then
-        echo "Note: elasticsearch was already installed."
-        return
-    fi
-    if is_ubuntu; then
-        is_package_installed default-jre-headless || install_package default-jre-headless
-
-        sudo dpkg -i ${FILES}/elasticsearch-${ELASTICSEARCH_VERSION}.deb
-        sudo update-rc.d elasticsearch defaults 95 10
-    elif is_fedora; then
-        is_package_installed java-1.8.0-openjdk-headless || install_package java-1.8.0-openjdk-headless
-        yum_install ${FILES}/elasticsearch-${ELASTICSEARCH_VERSION}.noarch.rpm
-        sudo /bin/systemctl daemon-reload
-        sudo /bin/systemctl enable elasticsearch.service
-    elif is_suse; then
-        is_package_installed java-1_8_0-openjdk-headless || install_package java-1_8_0-openjdk-headless
-        zypper_install --no-gpg-checks ${FILES}/elasticsearch-${ELASTICSEARCH_VERSION}.noarch.rpm
-        sudo /usr/bin/systemctl daemon-reload
-        sudo /usr/bin/systemctl enable elasticsearch.service
-    else
-        echo "Unsupported install of elasticsearch on this architecture."
-    fi
-}
-
-function uninstall_elasticsearch {
-    if is_package_installed elasticsearch; then
-        if is_ubuntu; then
-            sudo apt-get purge elasticsearch
-        elif is_fedora; then
-            sudo yum remove elasticsearch
-        elif is_suse; then
-            sudo zypper rm elasticsearch
-        else
-            echo "Unsupported install of elasticsearch on this architecture."
-        fi
-    fi
-}
-
-# The PHASE dispatcher. All pkg files are expected to basically cargo
-# cult the case statement.
-PHASE=$1
-echo "Phase is $PHASE"
-
-case $PHASE in
-    download)
-        download_elasticsearch
-        ;;
-    install)
-        install_elasticsearch
-        ;;
-    configure)
-        configure_elasticsearch
-        ;;
-    start)
-        start_elasticsearch
-        ;;
-    stop)
-        stop_elasticsearch
-        ;;
-    uninstall)
-        uninstall_elasticsearch
-        ;;
-esac

From 70f5d91a616931790eea7e19028e1d097645ab3b Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Fri, 12 Apr 2019 06:14:57 +0000
Subject: [PATCH 1524/2409] Updated from generate-devstack-plugins-list

Change-Id: Id100f77027445edf849cc295ecebb31c79601b40
---
 doc/source/plugin-registry.rst | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 9338d18819..f3aa1bffcc 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -34,6 +34,7 @@ broadview-collector                    `https://git.openstack.org/openstack/broa
 castellan-ui                           `https://git.openstack.org/openstack/castellan-ui <https://git.openstack.org/cgit/openstack/castellan-ui>`__
 ceilometer                             `https://git.openstack.org/openstack/ceilometer <https://git.openstack.org/cgit/openstack/ceilometer>`__
 ceilometer-powervm                     `https://git.openstack.org/openstack/ceilometer-powervm <https://git.openstack.org/cgit/openstack/ceilometer-powervm>`__
+cinderlib                              `https://git.openstack.org/openstack/cinderlib <https://git.openstack.org/cgit/openstack/cinderlib>`__
 cloudkitty                             `https://git.openstack.org/openstack/cloudkitty <https://git.openstack.org/cgit/openstack/cloudkitty>`__
 collectd-openstack-plugins             `https://git.openstack.org/openstack/collectd-openstack-plugins <https://git.openstack.org/cgit/openstack/collectd-openstack-plugins>`__
 congress                               `https://git.openstack.org/openstack/congress <https://git.openstack.org/cgit/openstack/congress>`__
@@ -82,6 +83,7 @@ kuryr-tempest-plugin                   `https://git.openstack.org/openstack/kury
 magnum                                 `https://git.openstack.org/openstack/magnum <https://git.openstack.org/cgit/openstack/magnum>`__
 magnum-ui                              `https://git.openstack.org/openstack/magnum-ui <https://git.openstack.org/cgit/openstack/magnum-ui>`__
 manila                                 `https://git.openstack.org/openstack/manila <https://git.openstack.org/cgit/openstack/manila>`__
+manila-tempest-plugin                  `https://git.openstack.org/openstack/manila-tempest-plugin <https://git.openstack.org/cgit/openstack/manila-tempest-plugin>`__
 manila-ui                              `https://git.openstack.org/openstack/manila-ui <https://git.openstack.org/cgit/openstack/manila-ui>`__
 masakari                               `https://git.openstack.org/openstack/masakari <https://git.openstack.org/cgit/openstack/masakari>`__
 meteos                                 `https://git.openstack.org/openstack/meteos <https://git.openstack.org/cgit/openstack/meteos>`__
@@ -174,6 +176,7 @@ stackube                               `https://git.openstack.org/openstack/stac
 storlets                               `https://git.openstack.org/openstack/storlets <https://git.openstack.org/cgit/openstack/storlets>`__
 stx-config                             `https://git.openstack.org/openstack/stx-config <https://git.openstack.org/cgit/openstack/stx-config>`__
 stx-fault                              `https://git.openstack.org/openstack/stx-fault <https://git.openstack.org/cgit/openstack/stx-fault>`__
+stx-ha                                 `https://git.openstack.org/openstack/stx-ha <https://git.openstack.org/cgit/openstack/stx-ha>`__
 stx-integ                              `https://git.openstack.org/openstack/stx-integ <https://git.openstack.org/cgit/openstack/stx-integ>`__
 stx-metal                              `https://git.openstack.org/openstack/stx-metal <https://git.openstack.org/cgit/openstack/stx-metal>`__
 stx-nfv                                `https://git.openstack.org/openstack/stx-nfv <https://git.openstack.org/cgit/openstack/stx-nfv>`__

From 28a62242843ff45315f4918062ed654a3f3e3b31 Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Wed, 6 Dec 2017 09:21:43 -0600
Subject: [PATCH 1525/2409] Add openstacksdk functional job to devstack
 pipelines

openstacksdk gates on the new-style devstack functional base jobs. It
serves as a good test case to make sure the functional base jobs don't
break.

Change-Id: I817639ed30cda8ea51d156872a14bbcf10a4e63d
---
 .zuul.yaml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index 9aafcdbb84..7c2a9d5073 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -621,6 +621,10 @@
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
+        - openstacksdk-functional-devstack:
+            irrelevant-files:
+              - ^.*\.rst$
+              - ^doc/.*$
     gate:
       jobs:
         - devstack
@@ -641,6 +645,10 @@
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
+        - openstacksdk-functional-devstack:
+            irrelevant-files:
+              - ^.*\.rst$
+              - ^doc/.*$
     # Please add a note on each job and conditions for the job not
     # being experimental any more, so we can keep this list somewhat
     # pruned.

From 7fbc70e2cb17b89259efb70ddcc8bb98ddd844e5 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Mon, 15 Apr 2019 06:24:44 +0000
Subject: [PATCH 1526/2409] Updated from generate-devstack-plugins-list

Change-Id: I2798fe053669be212c47ee9c579ca4f6262af5a1
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index f3aa1bffcc..93c16f454c 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -123,6 +123,7 @@ networking-midonet                     `https://git.openstack.org/openstack/netw
 networking-mlnx                        `https://git.openstack.org/openstack/networking-mlnx <https://git.openstack.org/cgit/openstack/networking-mlnx>`__
 networking-nec                         `https://git.openstack.org/openstack/networking-nec <https://git.openstack.org/cgit/openstack/networking-nec>`__
 networking-odl                         `https://git.openstack.org/openstack/networking-odl <https://git.openstack.org/cgit/openstack/networking-odl>`__
+networking-omnipath                    `https://git.openstack.org/openstack/networking-omnipath <https://git.openstack.org/cgit/openstack/networking-omnipath>`__
 networking-onos                        `https://git.openstack.org/openstack/networking-onos <https://git.openstack.org/cgit/openstack/networking-onos>`__
 networking-opencontrail                `https://git.openstack.org/openstack/networking-opencontrail <https://git.openstack.org/cgit/openstack/networking-opencontrail>`__
 networking-ovn                         `https://git.openstack.org/openstack/networking-ovn <https://git.openstack.org/cgit/openstack/networking-ovn>`__

From 10f44098825d1d13452117dc5ee31e3e895b495f Mon Sep 17 00:00:00 2001
From: Colleen Murphy <colleen@gazlene.net>
Date: Thu, 28 Feb 2019 23:44:14 +0100
Subject: [PATCH 1527/2409] Add hack to fix ply installation on opensuse

The python3-ply package is indirectly a dependency of dhcp-client, which
is not exactly an optional package. Pip >=10 refuses to install ply from
global-requirements with this distro package is installed, so our only
option is to remove it manually.

Change-Id: I377fdd4a581eb4b6275584d92cafc0b783fe3b84
---
 tools/fixup_stuff.sh | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index 1ff7bfa516..748223902c 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -228,6 +228,14 @@ function fixup_suse {
         sudo systemctl disable apparmor
         sudo /usr/sbin/aa-teardown
     fi
+
+    # Since pip10, pip will refuse to uninstall files from packages
+    # that were created with distutils (rather than more modern
+    # setuptools).  This is because it technically doesn't have a
+    # manifest of what to remove.  However, in most cases, simply
+    # overwriting works.  So this hacks around those packages that
+    # have been dragged in by some other system dependency
+    sudo rm -rf /usr/lib/python3.6/site-packages/ply-*.egg-info
 }
 
 # The version of pip(1.5.4) supported by python-virtualenv(1.11.4) has

From a9a51ca6382eb01c99fce51084f64a69f4c7d58a Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Mon, 15 Apr 2019 23:54:31 +0200
Subject: [PATCH 1528/2409] Fix is_neutron_legacy_enabled function

This function will now first filter out all "neutron-" strings from
DISABLED_SERVICES list before looking for "neutron" string in it.

Change-Id: I5cab6a3be553713e1257599fb72042c6001f2672
Close-Bug: #1824884
---
 lib/neutron | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/neutron b/lib/neutron
index 1066d8e342..947c491ec1 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -117,7 +117,9 @@ function is_neutron_enabled {
 # Test if any Neutron services are enabled
 # is_neutron_enabled
 function is_neutron_legacy_enabled {
-    [[ ,${DISABLED_SERVICES} =~ ,"neutron" ]] && return 1
+    # first we need to remove all "neutron-" from DISABLED_SERVICES list
+    disabled_services_copy=$(echo $DISABLED_SERVICES | sed 's/neutron-//g')
+    [[ ,${disabled_services_copy} =~ ,"neutron" ]] && return 1
     [[ ,${ENABLED_SERVICES} =~ ,"q-" ]] && return 0
     return 1
 }

From a13474fd7892312ef42a211c344d8c785f9a5f93 Mon Sep 17 00:00:00 2001
From: Erik Olof Gunnar Andersson <eandersson@blizzard.com>
Date: Thu, 18 Apr 2019 12:18:23 -0700
Subject: [PATCH 1529/2409] Add region_name to ironic compute configuration

We should always pass on a region when talking to
ironic. This will also help detect and test issues
specific to regions.

Change-Id: Iaab3c1bcedc5aaa2106c0758cbb43bade3de2cf5
---
 lib/nova_plugins/hypervisor-ironic | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/nova_plugins/hypervisor-ironic b/lib/nova_plugins/hypervisor-ironic
index 49110a8643..1279256055 100644
--- a/lib/nova_plugins/hypervisor-ironic
+++ b/lib/nova_plugins/hypervisor-ironic
@@ -50,6 +50,7 @@ function configure_nova_hypervisor {
     iniset $NOVA_CONF ironic project_domain_id default
     iniset $NOVA_CONF ironic user_domain_id default
     iniset $NOVA_CONF ironic project_name demo
+    iniset $NOVA_CONF ironic region_name $REGION_NAME
 
     iniset $NOVA_CONF ironic api_max_retries 300
     iniset $NOVA_CONF ironic api_retry_interval 5

From 666f5491b67e32b5f0e0f7a9eb5dc6ad72a1fd72 Mon Sep 17 00:00:00 2001
From: OpenDev Sysadmins <openstack-infra@lists.openstack.org>
Date: Fri, 19 Apr 2019 19:43:10 +0000
Subject: [PATCH 1530/2409] OpenDev Migration Patch

This commit was bulk generated and pushed by the OpenDev sysadmins
as a part of the Git hosting and code review systems migration
detailed in these mailing list posts:

http://lists.openstack.org/pipermail/openstack-discuss/2019-March/003603.html
http://lists.openstack.org/pipermail/openstack-discuss/2019-April/004920.html

Attempts have been made to correct repository namespaces and
hostnames based on simple pattern matching, but it's possible some
were updated incorrectly or missed entirely. Please reach out to us
via the contact information listed at https://opendev.org/ with any
questions you may have.
---
 .gitreview                                    |  4 ++--
 .zuul.yaml                                    | 22 +++++++++----------
 .../tasks/main.yaml                           |  6 ++---
 3 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/.gitreview b/.gitreview
index 570d31a987..e1bf63ba7a 100644
--- a/.gitreview
+++ b/.gitreview
@@ -1,4 +1,4 @@
 [gerrit]
-host=review.openstack.org
+host=review.opendev.org
 port=29418
-project=openstack-dev/devstack.git
+project=openstack/devstack.git
diff --git a/.zuul.yaml b/.zuul.yaml
index c20f55cb4a..8c0ce2f2ba 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -198,10 +198,10 @@
       job.group-vars.peers, which is what is used by multi node jobs for subnode
       nodes (everything but the controller).
     required-projects:
-      - git.openstack.org/openstack-dev/devstack
+      - opendev.org/openstack/devstack
     roles:
-      - zuul: git.openstack.org/openstack-infra/devstack-gate
-      - zuul: git.openstack.org/openstack-infra/openstack-zuul-jobs
+      - zuul: opendev.org/openstack/devstack-gate
+      - zuul: opendev.org/openstack/openstack-zuul-jobs
     vars:
       devstack_localrc:
         DATABASE_PASSWORD: secretdatabase
@@ -308,7 +308,7 @@
       less than the normal minimum set of required-projects.
     nodeset: openstack-single-node-bionic
     required-projects:
-      - git.openstack.org/openstack/requirements
+      - opendev.org/openstack/requirements
     vars:
       devstack_localrc:
         # Multinode specific settings
@@ -366,13 +366,13 @@
       The run playbook consists of a single role, so it can be easily rewritten
       and extended.
     required-projects:
-      - git.openstack.org/openstack/cinder
-      - git.openstack.org/openstack/glance
-      - git.openstack.org/openstack/keystone
-      - git.openstack.org/openstack/neutron
-      - git.openstack.org/openstack/nova
-      - git.openstack.org/openstack/placement
-      - git.openstack.org/openstack/swift
+      - opendev.org/openstack/cinder
+      - opendev.org/openstack/glance
+      - opendev.org/openstack/keystone
+      - opendev.org/openstack/neutron
+      - opendev.org/openstack/nova
+      - opendev.org/openstack/placement
+      - opendev.org/openstack/swift
     timeout: 7200
     vars:
       devstack_localrc:
diff --git a/roles/setup-devstack-source-dirs/tasks/main.yaml b/roles/setup-devstack-source-dirs/tasks/main.yaml
index dfa934f68b..f6d52ab3ad 100644
--- a/roles/setup-devstack-source-dirs/tasks/main.yaml
+++ b/roles/setup-devstack-source-dirs/tasks/main.yaml
@@ -1,9 +1,9 @@
 - name: Find all OpenStack source repos used by this job
   find:
     paths:
-      - src/git.openstack.org/openstack
-      - src/git.openstack.org/openstack-dev
-      - src/git.openstack.org/openstack-infra
+      - src/opendev.org/openstack
+      - src/opendev.org/openstack-dev
+      - src/opendev.org/openstack-infra
     file_type: directory
   register: found_repos
 

From e7f3d91a7ddb0a1d01a4394f42feb51ffc3b9b43 Mon Sep 17 00:00:00 2001
From: Dean Troyer <dtroyer@gmail.com>
Date: Sat, 20 Apr 2019 09:11:58 -0500
Subject: [PATCH 1531/2409] Update repo namespace search list

With the new namespaces we have to look around a bit more to find
repos top copy into the DevStack working directory. Add:

* starlingx/
* x/
* zuul/

Depends-On: https://review.opendev.org/653988
Change-Id: I8a55522a5fee46f415f0c0ce580ded3476133460
Signed-off-by: Dean Troyer <dtroyer@gmail.com>
---
 roles/setup-devstack-source-dirs/tasks/main.yaml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/roles/setup-devstack-source-dirs/tasks/main.yaml b/roles/setup-devstack-source-dirs/tasks/main.yaml
index f6d52ab3ad..1e5ce660f3 100644
--- a/roles/setup-devstack-source-dirs/tasks/main.yaml
+++ b/roles/setup-devstack-source-dirs/tasks/main.yaml
@@ -4,6 +4,9 @@
       - src/opendev.org/openstack
       - src/opendev.org/openstack-dev
       - src/opendev.org/openstack-infra
+      - src/opendev.org/starlingx
+      - src/opendev.org/x
+      - src/opendev.org/zuul
     file_type: directory
   register: found_repos
 

From dc9ba8b8aee4022ef1598cd0d8cfd7dfe34a4b6b Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Tue, 23 Apr 2019 13:02:00 +0000
Subject: [PATCH 1532/2409] Add opendev to repo search list

glean is in opendev and is used by nodepool devstack jobs.

Change-Id: I38dfd7cc531b20b26862193be14f4ebb53352efa
---
 roles/setup-devstack-source-dirs/tasks/main.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/roles/setup-devstack-source-dirs/tasks/main.yaml b/roles/setup-devstack-source-dirs/tasks/main.yaml
index 1e5ce660f3..160757ede9 100644
--- a/roles/setup-devstack-source-dirs/tasks/main.yaml
+++ b/roles/setup-devstack-source-dirs/tasks/main.yaml
@@ -1,6 +1,7 @@
 - name: Find all OpenStack source repos used by this job
   find:
     paths:
+      - src/opendev.org/opendev
       - src/opendev.org/openstack
       - src/opendev.org/openstack-dev
       - src/opendev.org/openstack-infra

From 4705861dd01fdb37bde2a9432571501599d20766 Mon Sep 17 00:00:00 2001
From: Artom Lifshitz <alifshit@redhat.com>
Date: Wed, 23 May 2018 10:08:56 -0400
Subject: [PATCH 1533/2409] Explicitly set scheduler_available_filters

Tempest's scheduler_available_filters has a special 'all' value that
is understood to mean 'all filters are enabled' by various tempest
tests. However, what it really means is 'the default nova filters are
enabled.' In an effort to help clean that up, this patch explicitly
sets scheduler_available_filters to nova's $FILTERS. Because $FILTERS
is now used in both lib/nova and lib/tempest, it is renamed
$NOVA_FILTERS.

Change-Id: I6ffc1e9989cd61d666f9c1db9c94fbabd7151918
Related-bug: 1628443
---
 lib/nova    | 6 +++---
 lib/tempest | 5 +++++
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/lib/nova b/lib/nova
index 5e157c5f11..0003179a4d 100644
--- a/lib/nova
+++ b/lib/nova
@@ -103,9 +103,9 @@ FORCE_CONFIG_DRIVE=${FORCE_CONFIG_DRIVE:-"False"}
 # should work in most cases.
 SCHEDULER=${SCHEDULER:-filter_scheduler}
 
-# The following FILTERS contains SameHostFilter and DifferentHostFilter with
+# The following NOVA_FILTERS contains SameHostFilter and DifferentHostFilter with
 # the default filters.
-FILTERS="RetryFilter,AvailabilityZoneFilter,ComputeFilter,ComputeCapabilitiesFilter,ImagePropertiesFilter,ServerGroupAntiAffinityFilter,ServerGroupAffinityFilter,SameHostFilter,DifferentHostFilter"
+NOVA_FILTERS="RetryFilter,AvailabilityZoneFilter,ComputeFilter,ComputeCapabilitiesFilter,ImagePropertiesFilter,ServerGroupAntiAffinityFilter,ServerGroupAffinityFilter,SameHostFilter,DifferentHostFilter"
 
 QEMU_CONF=/etc/libvirt/qemu.conf
 
@@ -423,7 +423,7 @@ function create_nova_conf {
     iniset $NOVA_CONF wsgi api_paste_config "$NOVA_API_PASTE_INI"
     iniset $NOVA_CONF DEFAULT rootwrap_config "$NOVA_CONF_DIR/rootwrap.conf"
     iniset $NOVA_CONF scheduler driver "$SCHEDULER"
-    iniset $NOVA_CONF filter_scheduler enabled_filters "$FILTERS"
+    iniset $NOVA_CONF filter_scheduler enabled_filters "$NOVA_FILTERS"
     if [[ $SCHEDULER == "filter_scheduler" ]]; then
         iniset $NOVA_CONF scheduler workers "$API_WORKERS"
     fi
diff --git a/lib/tempest b/lib/tempest
index 60f571ceb3..b8b313eb30 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -372,6 +372,11 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG compute-feature-enabled block_migration_for_live_migration ${USE_BLOCK_MIGRATION_FOR_LIVE_MIGRATION:-False}
     iniset $TEMPEST_CONFIG compute-feature-enabled live_migrate_back_and_forth ${LIVE_MIGRATE_BACK_AND_FORTH:-False}
     iniset $TEMPEST_CONFIG compute-feature-enabled attach_encrypted_volume ${ATTACH_ENCRYPTED_VOLUME_AVAILABLE:-True}
+
+    if [[ -n "$NOVA_FILTERS" ]]; then
+        iniset $TEMPEST_CONFIG compute-feature-enabled scheduler_enabled_filters ${NOVA_FILTERS}
+    fi
+
     if is_service_enabled n-cell; then
         # Cells doesn't support shelving/unshelving
         iniset $TEMPEST_CONFIG compute-feature-enabled shelve False

From 62e27d3b1c81cd8a45ee6a8e77dce9f68fc9ea1a Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Tue, 23 Apr 2019 13:44:37 -0400
Subject: [PATCH 1534/2409] Remove n-obj from zuul and docs

n-obj hasn't been around for many years and devstack
doesn't use it anymore anyway so this just cleans up
some vestigial use of the old service.

Change-Id: I04b2d2dc2b4e49fab90f5ef94f4e087e969aa24b
---
 .zuul.yaml                                   | 1 -
 doc/source/guides/devstack-with-lbaas-v2.rst | 2 +-
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 8c0ce2f2ba..60e3a14f14 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -412,7 +412,6 @@
         n-cond: true
         n-cpu: true
         n-novnc: true
-        n-obj: true
         n-sch: true
         placement-api: true
         # Neutron services
diff --git a/doc/source/guides/devstack-with-lbaas-v2.rst b/doc/source/guides/devstack-with-lbaas-v2.rst
index b1d88cb35c..a27a4d20b4 100644
--- a/doc/source/guides/devstack-with-lbaas-v2.rst
+++ b/doc/source/guides/devstack-with-lbaas-v2.rst
@@ -59,7 +59,7 @@ Edit your ``/opt/stack/devstack/local.conf`` to look like
     # Horizon - enable for the OpenStack web GUI
     # ENABLED_SERVICES+=,horizon
     # Nova
-    ENABLED_SERVICES+=,n-api,n-crt,n-obj,n-cpu,n-cond,n-sch,n-api-meta,n-sproxy
+    ENABLED_SERVICES+=,n-api,n-crt,n-cpu,n-cond,n-sch,n-api-meta,n-sproxy
     ENABLED_SERVICES+=,placement-api,placement-client
     # Glance
     ENABLED_SERVICES+=,g-api,g-reg

From 87daf8abe64f9b51fb840a455088b18fd0a791ff Mon Sep 17 00:00:00 2001
From: Brian Rosmaita <rosmaita.fossdev@gmail.com>
Date: Mon, 15 Apr 2019 12:00:07 -0400
Subject: [PATCH 1535/2409] End support for changing cinder periodic_interval

Support for changing the cinder periodic_interval config option
was added way back in havana as a workaround for bug #1180976
by change I20e52e66fcc94b224476cdd14c88bd6981b4e617.  As the fix
for that bug does not require modifying this config value, and
such modification may have unintentional adverse effects, end
the support.

Change-Id: I1ef1fe564123216b19582262726cdb1078b7650e
Partial-bug: #1824837
---
 .zuul.yaml | 1 -
 lib/cinder | 9 ---------
 2 files changed, 10 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 8c0ce2f2ba..785cf910d6 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -380,7 +380,6 @@
         SWIFT_REPLICAS: 1
         SWIFT_START_ALL_SERVICES: false
         SWIFT_HASH: 1234123412341234
-        CINDER_PERIODIC_INTERVAL: 10
         DEBUG_LIBVIRT_COREDUMPS: true
         NOVA_VNC_ENABLED: true
         VNCSERVER_LISTEN: 0.0.0.0
diff --git a/lib/cinder b/lib/cinder
index 047b25b3c5..ed8349aad6 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -88,14 +88,6 @@ CINDER_ENABLED_BACKENDS=${CINDER_ENABLED_BACKENDS:-lvm:lvmdriver-1}
 CINDER_VOLUME_CLEAR=${CINDER_VOLUME_CLEAR:-${CINDER_VOLUME_CLEAR_DEFAULT:-zero}}
 CINDER_VOLUME_CLEAR=$(echo ${CINDER_VOLUME_CLEAR} | tr '[:upper:]' '[:lower:]')
 
-# Cinder reports allocations back to the scheduler on periodic intervals
-# it turns out we can get an "out of space" issue when we run tests too
-# quickly just because cinder didn't realize we'd freed up resources.
-# Make this configurable so that devstack-gate/tempest can set it to
-# less than the 60 second default
-# https://bugs.launchpad.net/cinder/+bug/1180976
-CINDER_PERIODIC_INTERVAL=${CINDER_PERIODIC_INTERVAL:-60}
-
 # Centos7 and OpenSUSE switched to using LIO and that's all that's supported,
 # although the tgt bits are in EPEL and OpenSUSE we don't want that for CI
 if is_fedora || is_suse; then
@@ -237,7 +229,6 @@ function configure_cinder {
     iniset $CINDER_CONF DEFAULT osapi_volume_listen $CINDER_SERVICE_LISTEN_ADDRESS
     iniset $CINDER_CONF DEFAULT state_path $CINDER_STATE_PATH
     iniset $CINDER_CONF oslo_concurrency lock_path $CINDER_STATE_PATH
-    iniset $CINDER_CONF DEFAULT periodic_interval $CINDER_PERIODIC_INTERVAL
     iniset $CINDER_CONF DEFAULT my_ip "$HOST_IP"
 
     iniset $CINDER_CONF key_manager backend cinder.keymgr.conf_key_mgr.ConfKeyManager

From 5fe60c1a342f78482042f34f9a6d1a6739cbb1b7 Mon Sep 17 00:00:00 2001
From: ZhongShengping <chdzsp@163.com>
Date: Tue, 30 Apr 2019 10:12:51 +0800
Subject: [PATCH 1536/2409] Option "lock_path" from group "DEFAULT" is
 deprecated

Option "lock_path" from group "DEFAULT" is deprecated. Use option
"lock_path" from group "oslo_concurrency".

Change-Id: I7c7501a4a351155eeba77bb7cd43c8d6f5ea73bc
---
 lib/glance | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/glance b/lib/glance
index 65487cb444..d630c9a3b0 100644
--- a/lib/glance
+++ b/lib/glance
@@ -130,7 +130,7 @@ function configure_glance {
     iniset $GLANCE_API_CONF database connection $dburl
     iniset $GLANCE_API_CONF DEFAULT use_syslog $SYSLOG
     iniset $GLANCE_API_CONF DEFAULT image_cache_dir $GLANCE_CACHE_DIR/
-    iniset $GLANCE_API_CONF DEFAULT lock_path $GLANCE_LOCK_DIR
+    iniset $GLANCE_API_CONF oslo_concurrency lock_path $GLANCE_LOCK_DIR
     iniset $GLANCE_API_CONF paste_deploy flavor keystone+cachemanagement
     configure_auth_token_middleware $GLANCE_API_CONF glance $GLANCE_AUTH_CACHE_DIR/api
     iniset $GLANCE_API_CONF oslo_messaging_notifications driver messagingv2

From 9e3b3bf5244e0b62cd4ab9914c622e81ba08f4c8 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Tue, 4 Sep 2018 16:51:45 -0400
Subject: [PATCH 1537/2409] Add nova-status upgrade check call post-deploy

Once nova is setup and n-cpu on the host is reporting
a service record and discovered (the host is mapping in
the API DB), we should run the nova-status upgrade check
to verify the deployment.

Change-Id: I9683bf94233ebacb3057ce159cb3dc53aa55a2f4
Related-Bug: #1790721
---
 stack.sh | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/stack.sh b/stack.sh
index 4f6e5b6da1..b06f7bdcc1 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1442,6 +1442,12 @@ if is_service_enabled n-api; then
         # environment is up.
         echo_summary "SKIPPING Cell setup because n-cpu is not enabled. You will have to do this manually before you have a working environment."
     fi
+    # Run the nova-status upgrade check command which can also be used
+    # to verify the base install. Note that this is good enough in a
+    # single node deployment, but in a multi-node setup it won't verify
+    # any subnodes - that would have to be driven from whatever tooling
+    # is deploying the subnodes, e.g. the zuul v3 devstack-multinode job.
+    $NOVA_BIN_DIR/nova-status --config-file $NOVA_CONF upgrade check
 fi
 
 # Run local script

From 070e4ee65e73584bae5fdb23135abb972baf8ae9 Mon Sep 17 00:00:00 2001
From: Kota Tsuyuzaki <tsuyuzaki.kota@lab.ntt.co.jp>
Date: Thu, 13 Sep 2018 03:08:19 +0900
Subject: [PATCH 1538/2409] Deprecate swift3, use s3api in Swift repo

swift3 is no longer actively maintained in the upstream.
That has been moved to Swift repository as s3api so we should
use s3api middleware instead. As well as swift3, s3token is
also maintained in Swift upstream.

Change-Id: I4582d81da066ab53e6f11ad1df7af91425f2b0ca
---
 doc/source/configuration.rst |  4 ++--
 lib/nova                     |  2 +-
 lib/swift                    | 32 +++++++++-----------------------
 stack.sh                     |  6 ++----
 stackrc                      |  4 ----
 5 files changed, 14 insertions(+), 34 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 022e6ba529..9ca8441263 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -627,8 +627,8 @@ used when adding nodes to the Swift rings.
 Swift S3
 ++++++++
 
-If you are enabling ``swift3`` in ``ENABLED_SERVICES`` DevStack will
-install the swift3 middleware emulation. Swift will be configured to
+If you are enabling ``s3api`` in ``ENABLED_SERVICES`` DevStack will
+install the s3api middleware emulation. Swift will be configured to
 act as a S3 endpoint for Keystone so effectively replacing the
 ``nova-objectstore``.
 
diff --git a/lib/nova b/lib/nova
index 1fb50dfd76..4653d693eb 100644
--- a/lib/nova
+++ b/lib/nova
@@ -403,7 +403,7 @@ function create_nova_accounts {
     fi
 
     # S3
-    if is_service_enabled swift3; then
+    if is_service_enabled s3api; then
         get_or_create_service "s3" "s3" "S3"
         get_or_create_endpoint \
             "s3" \
diff --git a/lib/swift b/lib/swift
index e2ee0cb470..d9a7878652 100644
--- a/lib/swift
+++ b/lib/swift
@@ -49,7 +49,6 @@ fi
 
 SWIFT_AUTH_CACHE_DIR=${SWIFT_AUTH_CACHE_DIR:-/var/cache/swift}
 SWIFT_APACHE_WSGI_DIR=${SWIFT_APACHE_WSGI_DIR:-/var/www/swift}
-SWIFT3_DIR=$DEST/swift3
 
 SWIFT_SERVICE_PROTOCOL=${SWIFT_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 SWIFT_DEFAULT_BIND_PORT=${SWIFT_DEFAULT_BIND_PORT:-8080}
@@ -68,8 +67,8 @@ SWIFT_DISK_IMAGE=${SWIFT_DATA_DIR}/drives/images/swift.img
 # Default is ``/etc/swift``.
 SWIFT_CONF_DIR=${SWIFT_CONF_DIR:-/etc/swift}
 
-if is_service_enabled s-proxy && is_service_enabled swift3; then
-    # If we are using ``swift3``, we can default the S3 port to swift instead
+if is_service_enabled s-proxy && is_service_enabled s3api; then
+    # If we are using ``s3api``, we can default the S3 port to swift instead
     # of nova-objectstore
     S3_SERVICE_PORT=${S3_SERVICE_PORT:-$SWIFT_DEFAULT_BIND_PORT}
 fi
@@ -423,16 +422,19 @@ function configure_swift {
     iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:proxy-logging reveal_sensitive_prefix ${SWIFT_LOG_TOKEN_LENGTH}
 
     # By default Swift will be installed with Keystone and tempauth middleware
-    # and add the swift3 middleware if its configured for it. The token for
+    # and add the s3api middleware if its configured for it. The token for
     # tempauth would be prefixed with the reseller_prefix setting `TEMPAUTH_` the
     # token for keystoneauth would have the standard reseller_prefix `AUTH_`
-    if is_service_enabled swift3;then
-        swift_pipeline+=" swift3 s3token "
+    if is_service_enabled s3api;then
+        swift_pipeline+=" s3api"
     fi
-
     if is_service_enabled keystone; then
+        if is_service_enabled s3api;then
+            swift_pipeline+=" s3token"
+        fi
         swift_pipeline+=" authtoken keystoneauth"
     fi
+
     swift_pipeline+=" tempauth "
 
     sed -i "/^pipeline/ { s/tempauth/${swift_pipeline} ${SWIFT_EXTRAS_MIDDLEWARE}/ ;}" ${SWIFT_CONFIG_PROXY_SERVER}
@@ -467,22 +469,6 @@ function configure_swift {
     # Allow both reseller prefixes to be used with domain_remap
     iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:domain_remap reseller_prefixes "AUTH, TEMPAUTH"
 
-    if is_service_enabled swift3; then
-        cat <<EOF >>${SWIFT_CONFIG_PROXY_SERVER}
-[filter:s3token]
-paste.filter_factory = keystonemiddleware.s3_token:filter_factory
-auth_uri = ${KEYSTONE_AUTH_URI}
-cafile = ${SSL_BUNDLE_FILE}
-admin_user = swift
-admin_tenant_name = ${SERVICE_PROJECT_NAME}
-admin_password = ${SERVICE_PASSWORD}
-
-[filter:swift3]
-use = egg:swift3#swift3
-location = ${REGION_NAME}
-EOF
-    fi
-
     cp ${SWIFT_DIR}/etc/swift.conf-sample ${SWIFT_CONF_DIR}/swift.conf
     iniset ${SWIFT_CONF_DIR}/swift.conf swift-hash swift_hash_path_suffix ${SWIFT_HASH}
     iniset ${SWIFT_CONF_DIR}/swift.conf swift-constraints max_header_size ${SWIFT_MAX_HEADER_SIZE}
diff --git a/stack.sh b/stack.sh
index 4f6e5b6da1..cebd959ebc 100755
--- a/stack.sh
+++ b/stack.sh
@@ -889,12 +889,10 @@ if is_service_enabled swift; then
     stack_install_service swift
     configure_swift
 
-    # swift3 middleware to provide S3 emulation to Swift
-    if is_service_enabled swift3; then
+    # s3api middleware to provide S3 emulation to Swift
+    if is_service_enabled s3api; then
         # Replace the nova-objectstore port by the swift port
         S3_SERVICE_PORT=8080
-        git_clone $SWIFT3_REPO $SWIFT3_DIR $SWIFT3_BRANCH
-        setup_develop $SWIFT3_DIR
     fi
 fi
 
diff --git a/stackrc b/stackrc
index 2924d3956c..2291e3c3d8 100644
--- a/stackrc
+++ b/stackrc
@@ -520,10 +520,6 @@ GITBRANCH["glance_store"]=${GLANCE_STORE_BRANCH:-$TARGET_BRANCH}
 GITREPO["keystonemiddleware"]=${KEYSTONEMIDDLEWARE_REPO:-${GIT_BASE}/openstack/keystonemiddleware.git}
 GITBRANCH["keystonemiddleware"]=${KEYSTONEMIDDLEWARE_BRANCH:-$TARGET_BRANCH}
 
-# s3 support for swift
-SWIFT3_REPO=${SWIFT3_REPO:-${GIT_BASE}/openstack/swift3.git}
-SWIFT3_BRANCH=${SWIFT3_BRANCH:-$TARGET_BRANCH}
-
 # ceilometer middleware
 GITREPO["ceilometermiddleware"]=${CEILOMETERMIDDLEWARE_REPO:-${GIT_BASE}/openstack/ceilometermiddleware.git}
 GITBRANCH["ceilometermiddleware"]=${CEILOMETERMIDDLEWARE_BRANCH:-$TARGET_BRANCH}

From 8b8158ed8f2f448a214ce3b1978b9cb5b039f6ed Mon Sep 17 00:00:00 2001
From: Rodolfo Alonso Hernandez <ralonsoh@redhat.com>
Date: Fri, 5 Apr 2019 11:30:14 +0000
Subject: [PATCH 1539/2409] "raw_input()" deprecated in Python3

Built-in function "raw_input()" is deprecated in favor of "input()" [1].

[1] https://www.python.org/dev/peps/pep-3111/

Change-Id: I31c4c59373a2ad04987da3daffb3eed50916a6db
Closes-Bug: #1823321
---
 lib/tempest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index 8c6fa01c45..95b138c6bf 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -107,7 +107,7 @@ function remove_disabled_extensions {
 function image_size_in_gib {
     local size
     size=$(openstack image show $1 -c size -f value)
-    echo $size | python -c "import math; print int(math.ceil(float(int(raw_input()) / 1024.0 ** 3)))"
+    echo $size | python -c "import math; import six; print(int(math.ceil(float(int(six.moves.input()) / 1024.0 ** 3))))"
 }
 
 # configure_tempest() - Set config files, create data dirs, etc

From 9bf7e2654124205cd71343c2af175d730c634ab7 Mon Sep 17 00:00:00 2001
From: Swaminathan Vasudevan <SVasudevan@suse.com>
Date: Thu, 2 May 2019 13:45:46 -0700
Subject: [PATCH 1540/2409] DVR-Enable ARP Responder when DVR and L2pop is
 enabled

This patch enables ARP Responder with DVR routers along with
l2pop in devstack.

Related-Bug: #1774459

Change-Id: I82f628c32f6e38c2419b6ffe90d9f9adf96777b1
---
 lib/neutron             | 1 +
 lib/neutron_plugins/ml2 | 1 +
 2 files changed, 2 insertions(+)

diff --git a/lib/neutron b/lib/neutron
index 1066d8e342..17ffce7cb5 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -237,6 +237,7 @@ function configure_neutron_new {
             if [[ "$NEUTRON_DISTRIBUTED_ROUTING" = "True" ]]; then
                 iniset $NEUTRON_CORE_PLUGIN_CONF agent l2_population True
                 iniset $NEUTRON_CORE_PLUGIN_CONF agent enable_distributed_routing True
+                iniset $NEUTRON_CORE_PLUGIN_CONF agent arp_responder True
             fi
         fi
 
diff --git a/lib/neutron_plugins/ml2 b/lib/neutron_plugins/ml2
index c5a4c02cc5..a7466833e1 100644
--- a/lib/neutron_plugins/ml2
+++ b/lib/neutron_plugins/ml2
@@ -147,6 +147,7 @@ function neutron_plugin_configure_service {
         populate_ml2_config /$Q_PLUGIN_CONF_FILE agent l2_population=True
         populate_ml2_config /$Q_PLUGIN_CONF_FILE agent tunnel_types=vxlan
         populate_ml2_config /$Q_PLUGIN_CONF_FILE agent enable_distributed_routing=True
+        populate_ml2_config /$Q_PLUGIN_CONF_FILE agent arp_responder=True
     fi
 }
 

From 4db9d567d19759ee090e506adf7ad77d8e64e452 Mon Sep 17 00:00:00 2001
From: Tom Barron <tpb@dyncloud.net>
Date: Wed, 9 Jan 2019 08:43:52 -0500
Subject: [PATCH 1541/2409] Safety check for python version in get_pip_command

We know empirically that some legacy gate jobs pass and appear
to be running with python3 but actually pip was invoked with
PYTHON3_VERSION unset so that they are actually ran with python2
packages.

As a followup to this discussion [1], add a safety check in the
get_pip_command function to ensure that a python version has been
set when it is invoked.

[1] https://review.openstack.org/#/c/622415/4/inc/python@283

Change-Id: I3a08406fb7d68282c6b98abb33a625821510046a
---
 inc/python | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/inc/python b/inc/python
index 19e1228d23..0e575ae9e9 100644
--- a/inc/python
+++ b/inc/python
@@ -29,6 +29,10 @@ declare -A -g PROJECT_VENV
 # get_pip_command
 function get_pip_command {
     local version="$1"
+    if [ -z "$version" ]; then
+        die $LINENO "pip python version is not set."
+    fi
+
     # NOTE(dhellmann): I don't know if we actually get a pip3.4-python
     # under any circumstances.
     which pip${version} || which pip${version}-python

From f745a0a7aa8cc86a02cd43012b307bb65df5b1aa Mon Sep 17 00:00:00 2001
From: Lucas Xu <hanxu@redhat.com>
Date: Thu, 30 May 2019 20:49:29 +0000
Subject: [PATCH 1542/2409] Fix Typo on Devstack-with-lbaas-v2.rst

Change "creeate" to "create" in thie CLI

Change-Id: Ic9997ad2b852ae25b28c5ad7481fad188b632a50
---
 doc/source/guides/devstack-with-lbaas-v2.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/guides/devstack-with-lbaas-v2.rst b/doc/source/guides/devstack-with-lbaas-v2.rst
index a27a4d20b4..db138ae2c5 100644
--- a/doc/source/guides/devstack-with-lbaas-v2.rst
+++ b/doc/source/guides/devstack-with-lbaas-v2.rst
@@ -91,7 +91,7 @@ Create two nova instances that we can use as test http servers:
 
     #create nova instances on private network
     openstack server create --image $(openstack image list | awk '/ cirros-.*-x86_64-.* / {print $2}') --flavor 1 --nic net-id=$(openstack network list | awk '/ private / {print $2}') node1
-    openstack server creeate --image $(openstack image list | awk '/ cirros-.*-x86_64-.* / {print $2}') --flavor 1 --nic net-id=$(openstack network list | awk '/ private / {print $2}') node2
+    openstack server create --image $(openstack image list | awk '/ cirros-.*-x86_64-.* / {print $2}') --flavor 1 --nic net-id=$(openstack network list | awk '/ private / {print $2}') node2
     openstack server list # should show the nova instances just created
 
     #add secgroup rules to allow ssh etc..

From 4b8cba77fe3444c925b5e4fe39743d54b0243eef Mon Sep 17 00:00:00 2001
From: Stephen Finucane <sfinucan@redhat.com>
Date: Tue, 21 May 2019 14:17:11 +0100
Subject: [PATCH 1543/2409] Remove n-cells, n-net and n-cauth

Remove nova cells v1 support, which also allows/necessitates removing
support for nova networks (which was only supported with cells v1) and
nova-consoleauth (which was required by cells v1 but is unnecessary
otherwise).

The Depends-On isn't really necessary, but it's here to make sure this
doesn't merge until we _really_ have killed cells v1.

I honestly expected this patch would be bigger.

Change-Id: I90316208d1af42c1659d3bee386f95e38aaf2c56
Signed-off-by: Stephen Finucane <sfinucan@redhat.com>
Depends-On: Ib0e0b708c46e4330e51f8f8fdfbb02d45aaf0f44
---
 .zuul.yaml                            |  10 +-
 HACKING.rst                           |   4 +-
 doc/source/configuration.rst          |  14 ---
 doc/source/guides/multinode-lab.rst   |   6 -
 doc/source/guides/single-machine.rst  |   9 +-
 files/rpms/nova                       |   2 +-
 functions                             |   7 +-
 functions-common                      |   5 -
 lib/neutron-legacy                    |   2 -
 lib/nova                              | 168 ++------------------------
 lib/nova_plugins/hypervisor-xenserver |   3 -
 lib/tempest                           |  23 +---
 stack.sh                              |  29 +----
 stackrc                               |   3 +-
 14 files changed, 23 insertions(+), 262 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 60e3a14f14..9996f5aba7 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -408,7 +408,6 @@
         # Nova services
         n-api: true
         n-api-meta: true
-        n-cauth: true
         n-cond: true
         n-cpu: true
         n-novnc: true
@@ -689,11 +688,8 @@
     # being experimental any more, so we can keep this list somewhat
     # pruned.
     #
-    # * nova-cells-v1: maintained by nova for cells v1 (nova-cells service);
-    #    it's in experimental here (and in nova) for testing cells v1
-    #    changes to devstack w/o gating on it for all devstack changes.
     # * nova-next: maintained by nova for unreleased/undefaulted
-    #    things like cellsv2 and placement-api
+    #    things
     # * neutron-fullstack-with-uwsgi: maintained by neutron for fullstack test
     #    when neutron-api is served by uwsgi, it's in exprimental for testing.
     #    the next cycle we can remove this  job if things turn out to be
@@ -706,10 +702,6 @@
 
     experimental:
       jobs:
-        - nova-cells-v1:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
         - nova-next
         - neutron-fullstack-with-uwsgi
         - neutron-functional-with-uwsgi
diff --git a/HACKING.rst b/HACKING.rst
index 3853eed9a1..968306a2c4 100644
--- a/HACKING.rst
+++ b/HACKING.rst
@@ -145,8 +145,8 @@ follows:
 * Global configuration that may be referenced in ``local.conf``, i.e. ``DEST``, ``DATA_DIR``
 * Global service configuration like ``ENABLED_SERVICES``
 * Variables used by multiple services that do not have a clear owner, i.e.
-  ``VOLUME_BACKING_FILE_SIZE`` (nova-compute, nova-volumes and cinder) or
-  ``PUBLIC_NETWORK_NAME`` (nova-network and neutron)
+  ``VOLUME_BACKING_FILE_SIZE`` (nova-compute and cinder) or
+  ``PUBLIC_NETWORK_NAME`` (only neutron but formerly nova-network too)
 * Variables that can not be cleanly declared in a project file due to
   dependency ordering, i.e. the order of sourcing the project files can
   not be changed for other reasons but the earlier file needs to dereference a
diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 9ca8441263..5e8004dc44 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -663,20 +663,6 @@ Xenserver
 If you would like to use Xenserver as the hypervisor, please refer to
 the instructions in ``./tools/xen/README.md``.
 
-Cells
-~~~~~
-
-`Cells <https://wiki.openstack.org/wiki/Blueprint-nova-compute-cells>`__ is
-an alternative scaling option.  To setup a cells environment add the
-following to your ``localrc`` section:
-
-::
-
-    enable_service n-cell
-
-Be aware that there are some features currently missing in cells, one
-notable one being security groups.
-
 Cinder
 ~~~~~~
 
diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
index c3574ac593..3c4acc8c7c 100644
--- a/doc/source/guides/multinode-lab.rst
+++ b/doc/source/guides/multinode-lab.rst
@@ -120,11 +120,8 @@ cluster controller's DevStack in ``local.conf``:
 
     [[local|localrc]]
     HOST_IP=192.168.42.11
-    FLAT_INTERFACE=eth0
     FIXED_RANGE=10.4.128.0/20
-    FIXED_NETWORK_SIZE=4096
     FLOATING_RANGE=192.168.42.128/25
-    MULTI_HOST=1
     LOGFILE=/opt/stack/logs/stack.sh.log
     ADMIN_PASSWORD=labstack
     DATABASE_PASSWORD=supersecret
@@ -160,11 +157,8 @@ machines, create a ``local.conf`` with:
 
     [[local|localrc]]
     HOST_IP=192.168.42.12 # change this per compute node
-    FLAT_INTERFACE=eth0
     FIXED_RANGE=10.4.128.0/20
-    FIXED_NETWORK_SIZE=4096
     FLOATING_RANGE=192.168.42.128/25
-    MULTI_HOST=1
     LOGFILE=/opt/stack/logs/stack.sh.log
     ADMIN_PASSWORD=labstack
     DATABASE_PASSWORD=supersecret
diff --git a/doc/source/guides/single-machine.rst b/doc/source/guides/single-machine.rst
index 168172c630..cfbd6b1884 100644
--- a/doc/source/guides/single-machine.rst
+++ b/doc/source/guides/single-machine.rst
@@ -87,11 +87,8 @@ do the following:
 -  Set ``FLOATING_RANGE`` to a range not used on the local network, i.e.
    192.168.1.224/27. This configures IP addresses ending in 225-254 to
    be used as floating IPs.
--  Set ``FIXED_RANGE`` and ``FIXED_NETWORK_SIZE`` to configure the
-   internal address space used by the instances.
--  Set ``FLAT_INTERFACE`` to the Ethernet interface that connects the
-   host to your local network. This is the interface that should be
-   configured with the static IP address mentioned above.
+-  Set ``FIXED_RANGE`` to configure the internal address space used by the
+   instances.
 -  Set the administrative password. This password is used for the
    **admin** and **demo** accounts set up as OpenStack users.
 -  Set the MySQL administrative password. The default here is a random
@@ -108,8 +105,6 @@ do the following:
     [[local|localrc]]
     FLOATING_RANGE=192.168.1.224/27
     FIXED_RANGE=10.11.12.0/24
-    FIXED_NETWORK_SIZE=256
-    FLAT_INTERFACE=eth0
     ADMIN_PASSWORD=supersecret
     DATABASE_PASSWORD=iheartdatabases
     RABBIT_PASSWORD=flopsymopsy
diff --git a/files/rpms/nova b/files/rpms/nova
index 8d73644025..f69fc373d7 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -1,6 +1,6 @@
 conntrack-tools
 curl
-dnsmasq # for nova-network
+dnsmasq # for q-dhcp
 dnsmasq-utils # for dhcp_release
 ebtables
 gawk
diff --git a/functions b/functions
index 187ad2311d..93035673b5 100644
--- a/functions
+++ b/functions
@@ -469,7 +469,7 @@ EOF
 
 
 # ping check
-# Uses globals ``ENABLED_SERVICES``, ``TOP_DIR``, ``MULTI_HOST``, ``PRIVATE_NETWORK``
+# Uses globals ``ENABLED_SERVICES``, ``TOP_DIR``, ``PRIVATE_NETWORK``
 # ping_check <ip> [boot-timeout] [from_net] [expected]
 function ping_check {
     local ip=$1
@@ -483,12 +483,9 @@ function ping_check {
     # if we don't specify a from_net we're expecting things to work
     # fine from our local box.
     if [[ -n "$from_net" ]]; then
+        # TODO(stephenfin): Is there any way neutron could be disabled now?
         if is_service_enabled neutron; then
             ping_cmd="$TOP_DIR/tools/ping_neutron.sh $from_net"
-        elif [[ "$MULTI_HOST" = "True" && "$from_net" = "$PRIVATE_NETWORK_NAME" ]]; then
-            # there is no way to address the multihost / private case, bail here for compatibility.
-            # TODO: remove this cruft and redo code to handle this at the caller level.
-            return
         fi
     fi
 
diff --git a/functions-common b/functions-common
index bace9e00e6..922ff6fa5f 100644
--- a/functions-common
+++ b/functions-common
@@ -1929,10 +1929,6 @@ function enable_service {
 #   For backward compatibility if we have **swift** in ENABLED_SERVICES all the
 #   **s-** services will be enabled. This will be deprecated in the future.
 #
-# Cells within nova is enabled if **n-cell** is in ``ENABLED_SERVICES``.
-# We also need to make sure to treat **n-cell-region** and **n-cell-child**
-# as enabled in this case.
-#
 # Uses global ``ENABLED_SERVICES``
 # is_service_enabled service [service ...]
 function is_service_enabled {
@@ -1955,7 +1951,6 @@ function is_service_enabled {
         # TODO(dtroyer): Remove these legacy special-cases after the is_XXX_enabled()
         #                are implemented
 
-        [[ ${service} == n-cell-* && ,${ENABLED_SERVICES} =~ ,"n-cell" ]] && enabled=0
         [[ ${service} == n-cpu-* && ,${ENABLED_SERVICES} =~ ,"n-cpu" ]] && enabled=0
         [[ ${service} == "nova" && ,${ENABLED_SERVICES} =~ ,"n-" ]] && enabled=0
         [[ ${service} == "glance" && ,${ENABLED_SERVICES} =~ ,"g-" ]] && enabled=0
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 82571151e4..87edc5ab81 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -50,8 +50,6 @@
 # See "Neutron Network Configuration" below for additional variables
 # that must be set in localrc for connectivity across hosts with
 # Neutron.
-#
-# With Neutron networking the NETWORK_MANAGER variable is ignored.
 
 # Settings
 # --------
diff --git a/lib/nova b/lib/nova
index 6ce1dcc4cc..2efe7cb9b4 100644
--- a/lib/nova
+++ b/lib/nova
@@ -50,11 +50,9 @@ NOVA_AUTH_CACHE_DIR=${NOVA_AUTH_CACHE_DIR:-/var/cache/nova}
 
 NOVA_CONF_DIR=/etc/nova
 NOVA_CONF=$NOVA_CONF_DIR/nova.conf
-NOVA_CELLS_CONF=$NOVA_CONF_DIR/nova-cells.conf
 NOVA_COND_CONF=$NOVA_CONF_DIR/nova.conf
 NOVA_CPU_CONF=$NOVA_CONF_DIR/nova-cpu.conf
 NOVA_FAKE_CONF=$NOVA_CONF_DIR/nova-fake.conf
-NOVA_CELLS_DB=${NOVA_CELLS_DB:-nova_cell}
 NOVA_API_DB=${NOVA_API_DB:-nova_api}
 NOVA_UWSGI=$NOVA_BIN_DIR/nova-api-wsgi
 NOVA_METADATA_UWSGI=$NOVA_BIN_DIR/nova-metadata-wsgi
@@ -111,7 +109,6 @@ QEMU_CONF=/etc/libvirt/qemu.conf
 
 # Set default defaults here as some hypervisor drivers override these
 PUBLIC_INTERFACE_DEFAULT=br100
-FLAT_NETWORK_BRIDGE_DEFAULT=br100
 # Set ``GUEST_INTERFACE_DEFAULT`` to some interface on the box so that
 # the default isn't completely crazy. This will match ``eth*``, ``em*``, or
 # the new ``p*`` interfaces, then basically picks the first
@@ -137,44 +134,6 @@ if is_service_enabled nova && [[ -r $NOVA_PLUGINS/hypervisor-$VIRT_DRIVER ]]; th
     source $NOVA_PLUGINS/hypervisor-$VIRT_DRIVER
 fi
 
-
-# Nova Network Configuration
-# --------------------------
-
-NETWORK_MANAGER=${NETWORK_MANAGER:-${NET_MAN:-FlatDHCPManager}}
-
-VLAN_INTERFACE=${VLAN_INTERFACE:-$GUEST_INTERFACE_DEFAULT}
-FLAT_NETWORK_BRIDGE=${FLAT_NETWORK_BRIDGE:-$FLAT_NETWORK_BRIDGE_DEFAULT}
-
-# If you are using the FlatDHCP network mode on multiple hosts, set the
-# ``FLAT_INTERFACE`` variable but make sure that the interface doesn't already
-# have an IP or you risk breaking things.
-#
-# **DHCP Warning**:  If your flat interface device uses DHCP, there will be a
-# hiccup while the network is moved from the flat interface to the flat network
-# bridge.  This will happen when you launch your first instance.  Upon launch
-# you will lose all connectivity to the node, and the VM launch will probably
-# fail.
-#
-# If you are running on a single node and don't need to access the VMs from
-# devices other than that node, you can set ``FLAT_INTERFACE=``
-# This will stop nova from bridging any interfaces into ``FLAT_NETWORK_BRIDGE``.
-FLAT_INTERFACE=${FLAT_INTERFACE:-$GUEST_INTERFACE_DEFAULT}
-
-# ``MULTI_HOST`` is a mode where each compute node runs its own network node.  This
-# allows network operations and routing for a VM to occur on the server that is
-# running the VM - removing a SPOF and bandwidth bottleneck.
-MULTI_HOST=$(trueorfalse False MULTI_HOST)
-
-# ``NOVA_ALLOW_MOVE_TO_SAME_HOST`` can be set to False in multi node DevStack,
-# where there are at least two nova-computes.
-NOVA_ALLOW_MOVE_TO_SAME_HOST=$(trueorfalse True NOVA_ALLOW_MOVE_TO_SAME_HOST)
-
-# Test floating pool and range are used for testing.  They are defined
-# here until the admin APIs can replace nova-manage
-TEST_FLOATING_POOL=${TEST_FLOATING_POOL:-test}
-TEST_FLOATING_RANGE=${TEST_FLOATING_RANGE:-192.168.253.0/29}
-
 # Other Nova configurations
 # ----------------------------
 
@@ -183,6 +142,10 @@ TEST_FLOATING_RANGE=${TEST_FLOATING_RANGE:-192.168.253.0/29}
 # and Glance.
 NOVA_USE_SERVICE_TOKEN=$(trueorfalse False NOVA_USE_SERVICE_TOKEN)
 
+# ``NOVA_ALLOW_MOVE_TO_SAME_HOST`` can be set to False in multi node DevStack,
+# where there are at least two nova-computes.
+NOVA_ALLOW_MOVE_TO_SAME_HOST=$(trueorfalse True NOVA_ALLOW_MOVE_TO_SAME_HOST)
+
 # Enable debugging levels for iscsid service (goes from 0-8)
 ISCSID_DEBUG=$(trueorfalse False ISCSID_DEBUG)
 ISCSID_DEBUG_LEVEL=${ISCSID_DEBUG_LEVEL:-4}
@@ -198,13 +161,6 @@ function is_nova_enabled {
     return 1
 }
 
-# Test if any Nova Cell services are enabled
-# is_nova_enabled
-function is_n-cell_enabled {
-    [[ ,${ENABLED_SERVICES} =~ ,"n-cell" ]] && return 0
-    return 1
-}
-
 # is_nova_console_proxy_compute_tls_enabled() - Test if the Nova Console Proxy
 # service has TLS enabled
 function is_nova_console_proxy_compute_tls_enabled {
@@ -501,10 +457,6 @@ function create_nova_conf {
     if [ -n "$NOVA_INSTANCES_PATH" ]; then
         iniset $NOVA_CONF DEFAULT instances_path "$NOVA_INSTANCES_PATH"
     fi
-    if [ "$MULTI_HOST" != "False" ]; then
-        iniset $NOVA_CONF DEFAULT multi_host "True"
-        iniset $NOVA_CONF DEFAULT send_arp_for_ha "True"
-    fi
     if [ "$SYSLOG" != "False" ]; then
         iniset $NOVA_CONF DEFAULT use_syslog "True"
     fi
@@ -551,21 +503,6 @@ function create_nova_conf {
 
     iniset $NOVA_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
 
-    # Setup logging for nova-dhcpbridge command line
-    sudo cp "$NOVA_CONF" "$NOVA_CONF_DIR/nova-dhcpbridge.conf"
-
-    if is_service_enabled n-net; then
-        local service="n-dhcp"
-        local logfile="${service}.log.${CURRENT_LOG_TIME}"
-        local real_logfile="${LOGDIR}/${logfile}"
-        if [[ -n ${LOGDIR} ]]; then
-            bash -c "cd '$LOGDIR' && ln -sf '$logfile' ${service}.log"
-            iniset "$NOVA_CONF_DIR/nova-dhcpbridge.conf" DEFAULT log_file "$real_logfile"
-        fi
-
-        iniset $NOVA_CONF DEFAULT dhcpbridge_flagfile "$NOVA_CONF_DIR/nova-dhcpbridge.conf"
-    fi
-
     if [ "$NOVA_USE_SERVICE_TOKEN" == "True" ]; then
         init_nova_service_user_conf
     fi
@@ -748,42 +685,6 @@ function conductor_conf {
     echo "${NOVA_CONF_DIR}/nova_cell${cell}.conf"
 }
 
-function init_nova_cells {
-    if is_service_enabled n-cell; then
-        cp $NOVA_CONF $NOVA_CELLS_CONF
-        iniset $NOVA_CELLS_CONF database connection `database_connection_url $NOVA_CELLS_DB`
-        rpc_backend_add_vhost child_cell
-        iniset_rpc_backend nova $NOVA_CELLS_CONF DEFAULT child_cell
-        iniset $NOVA_CELLS_CONF DEFAULT dhcpbridge_flagfile $NOVA_CELLS_CONF
-        iniset $NOVA_CELLS_CONF cells enable True
-        iniset $NOVA_CELLS_CONF cells cell_type compute
-        iniset $NOVA_CELLS_CONF cells name child
-
-        iniset $NOVA_CONF cells enable True
-        iniset $NOVA_CONF cells cell_type api
-        iniset $NOVA_CONF cells name region
-
-        if is_service_enabled n-api-meta; then
-            NOVA_ENABLED_APIS=$(echo $NOVA_ENABLED_APIS | sed "s/,metadata//")
-            iniset $NOVA_CONF DEFAULT enabled_apis $NOVA_ENABLED_APIS
-            iniset $NOVA_CELLS_CONF DEFAULT enabled_apis metadata
-        fi
-
-        # Cells v1 conductor should be the nova-cells.conf
-        NOVA_COND_CONF=$NOVA_CELLS_CONF
-
-        time_start "dbsync"
-        $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CELLS_CONF db sync
-        time_stop "dbsync"
-        $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CELLS_CONF cell create --name=region --cell_type=parent --username=$RABBIT_USERID --hostname=$RABBIT_HOST --port=5672 --password=$RABBIT_PASSWORD --virtual_host=/ --woffset=0 --wscale=1
-        $NOVA_BIN_DIR/nova-manage cell create --name=child --cell_type=child --username=$RABBIT_USERID --hostname=$RABBIT_HOST --port=5672 --password=$RABBIT_PASSWORD --virtual_host=child_cell --woffset=0 --wscale=1
-
-        # Creates the single cells v2 cell for the child cell (v1) nova db.
-        $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CELLS_CONF cell_v2 create_cell \
-            --transport-url $(get_transport_url child_cell) --name 'cell1'
-    fi
-}
-
 # create_nova_cache_dir() - Part of the init_nova() process
 function create_nova_cache_dir {
     # Create cache dir
@@ -791,18 +692,6 @@ function create_nova_cache_dir {
     rm -f $NOVA_AUTH_CACHE_DIR/*
 }
 
-function create_nova_conf_nova_network {
-    local public_interface=${PUBLIC_INTERFACE:-$PUBLIC_INTERFACE_DEFAULT}
-    iniset $NOVA_CONF DEFAULT network_manager "nova.network.manager.$NETWORK_MANAGER"
-    iniset $NOVA_CONF DEFAULT public_interface "$public_interface"
-    iniset $NOVA_CONF DEFAULT vlan_interface "$VLAN_INTERFACE"
-    iniset $NOVA_CONF DEFAULT flat_network_bridge "$FLAT_NETWORK_BRIDGE"
-    if [ -n "$FLAT_INTERFACE" ]; then
-        iniset $NOVA_CONF DEFAULT flat_interface "$FLAT_INTERFACE"
-    fi
-    iniset $NOVA_CONF DEFAULT use_neutron False
-}
-
 # create_nova_keys_dir() - Part of the init_nova() process
 function create_nova_keys_dir {
     # Create keys dir
@@ -834,10 +723,6 @@ function init_nova {
         # Migrate nova and nova_cell0 databases.
         $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF db sync
 
-        if is_service_enabled n-cell; then
-            recreate_database $NOVA_CELLS_DB
-        fi
-
         # Run online migrations on the new databases
         # Needed for flavor conversion
         $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF db online_data_migrations
@@ -942,15 +827,6 @@ function start_nova_api {
     export PATH=$old_path
 }
 
-# Detect and setup conditions under which singleconductor setup is
-# needed. Notably cellsv1.
-function _set_singleconductor {
-    # NOTE(danms): Don't setup conductor fleet for cellsv1
-    if is_service_enabled n-cell; then
-        CELLSV2_SETUP="singleconductor"
-    fi
-}
-
 
 # start_nova_compute() - Start the compute process
 function start_nova_compute {
@@ -958,11 +834,7 @@ function start_nova_compute {
     local old_path=$PATH
     export PATH=$NOVA_BIN_DIR:$PATH
 
-    if is_service_enabled n-cell; then
-        local compute_cell_conf=$NOVA_CELLS_CONF
-    else
-        local compute_cell_conf=$NOVA_CONF
-    fi
+    local compute_cell_conf=$NOVA_CONF
 
     cp $compute_cell_conf $NOVA_CPU_CONF
 
@@ -1025,22 +897,7 @@ function start_nova_rest {
     export PATH=$NOVA_BIN_DIR:$PATH
 
     local api_cell_conf=$NOVA_CONF
-    if is_service_enabled n-cell; then
-        local compute_cell_conf=$NOVA_CELLS_CONF
-    else
-        local compute_cell_conf=$NOVA_CONF
-    fi
-
-    # ``run_process`` checks ``is_service_enabled``, it is not needed here
-    run_process n-cell-region "$NOVA_BIN_DIR/nova-cells --config-file $api_cell_conf"
-    run_process n-cell-child "$NOVA_BIN_DIR/nova-cells --config-file $compute_cell_conf"
-
-    if is_service_enabled n-net; then
-        if ! running_in_container; then
-            enable_kernel_bridge_firewall
-        fi
-    fi
-    run_process n-net "$NOVA_BIN_DIR/nova-network --config-file $compute_cell_conf"
+    local compute_cell_conf=$NOVA_CONF
 
     run_process n-sch "$NOVA_BIN_DIR/nova-scheduler --config-file $compute_cell_conf"
     if [ "$NOVA_USE_MOD_WSGI" == "False" ]; then
@@ -1049,9 +906,6 @@ function start_nova_rest {
         run_process n-api-meta "$NOVA_BIN_DIR/uwsgi --procname-prefix nova-api-meta --ini $NOVA_METADATA_UWSGI_CONF"
     fi
 
-    # nova-consoleauth always runs globally
-    run_process n-cauth "$NOVA_BIN_DIR/nova-consoleauth --config-file $api_cell_conf"
-
     export PATH=$old_path
 }
 
@@ -1129,11 +983,7 @@ function is_nova_ready {
     # happen between here and the script ending. However, in multinode
     # tests this can very often not be the case. So ensure that the
     # compute is up before we move on.
-    if is_service_enabled n-cell; then
-        # cells v1 can't complete the check below because it munges
-        # hostnames with cell information (grumble grumble).
-        return
-    fi
+
     # TODO(sdague): honestly, this probably should be a plug point for
     # an external system.
     if [[ "$VIRT_DRIVER" == 'xenserver' ]]; then
@@ -1145,8 +995,6 @@ function is_nova_ready {
 }
 
 function start_nova {
-    # this catches the cells v1 case early
-    _set_singleconductor
     start_nova_rest
     start_nova_console_proxies
     start_nova_conductor
@@ -1174,7 +1022,7 @@ function stop_nova_compute {
 
 function stop_nova_rest {
     # Kill the non-compute nova processes
-    for serv in n-api n-api-meta n-net n-sch n-cauth n-cell n-cell; do
+    for serv in n-api n-api-meta n-sch; do
         stop_process $serv
     done
 }
diff --git a/lib/nova_plugins/hypervisor-xenserver b/lib/nova_plugins/hypervisor-xenserver
index 6f79e4ff7c..2fdbde1df8 100644
--- a/lib/nova_plugins/hypervisor-xenserver
+++ b/lib/nova_plugins/hypervisor-xenserver
@@ -24,9 +24,6 @@ set +o xtrace
 # Defaults
 # --------
 
-# Allow ``build_domU.sh`` to specify the flat network bridge via kernel args
-FLAT_NETWORK_BRIDGE_DEFAULT=$(sed -e 's/.* flat_network_bridge=\([[:alnum:]]*\).*$/\1/g' /proc/cmdline)
-
 VNCSERVER_PROXYCLIENT_ADDRESS=${VNCSERVER_PROXYCLIENT_ADDRESS=169.254.0.1}
 
 
diff --git a/lib/tempest b/lib/tempest
index 95b138c6bf..9f1b677eba 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -342,7 +342,7 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG compute flavor_ref $flavor_ref
     iniset $TEMPEST_CONFIG compute flavor_ref_alt $flavor_ref_alt
     iniset $TEMPEST_CONFIG validation connect_method $ssh_connect_method
-    if ! is_service_enabled n-cell && ! is_service_enabled neutron; then
+    if ! is_service_enabled neutron; then
         iniset $TEMPEST_CONFIG compute fixed_network_name $PRIVATE_NETWORK_NAME
     fi
 
@@ -391,24 +391,6 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG compute-feature-enabled scheduler_enabled_filters ${NOVA_FILTERS}
     fi
 
-    if is_service_enabled n-cell; then
-        # Cells doesn't support shelving/unshelving
-        iniset $TEMPEST_CONFIG compute-feature-enabled shelve False
-        # Cells doesn't support hot-plugging virtual interfaces.
-        iniset $TEMPEST_CONFIG compute-feature-enabled interface_attach False
-        # Cells v1 doesn't support the rescue/unrescue tests in Tempest
-        iniset $TEMPEST_CONFIG compute-feature-enabled rescue False
-
-        if  [[ -z "$DEFAULT_INSTANCE_TYPE" ]]; then
-            # Cells supports resize but does not currently work with devstack
-            # because of the custom flavors created for Tempest runs which are
-            # not in the cells database.
-            # TODO(mriedem): work on adding a nova-manage command to sync
-            # flavors into the cells database.
-            iniset $TEMPEST_CONFIG compute-feature-enabled resize False
-        fi
-    fi
-
     if [[ $ENABLE_VOLUME_MULTIATTACH == "True" ]]; then
         iniset $TEMPEST_CONFIG compute-feature-enabled volume_multiattach True
     fi
@@ -554,8 +536,7 @@ function configure_tempest {
             iniset $TEMPEST_CONFIG compute-feature-enabled shelve False
             iniset $TEMPEST_CONFIG compute-feature-enabled snapshot False
             iniset $TEMPEST_CONFIG compute-feature-enabled suspend False
-        elif ! is_service_enabled n-cell; then
-            # cells v1 does not support swapping volumes
+        else
             iniset $TEMPEST_CONFIG compute-feature-enabled swap_volume True
         fi
     fi
diff --git a/stack.sh b/stack.sh
index fa5b43ce38..7230c1f5cf 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1167,10 +1167,11 @@ if is_service_enabled neutron; then
     fi
 fi
 
+
 # Nova
 # ----
 
-if is_service_enabled n-net q-dhcp; then
+if is_service_enabled q-dhcp; then
     # Delete traces of nova networks from prior runs
     # Do not kill any dnsmasq instance spawned by NetworkManager
     netman_pid=$(pidof NetworkManager || true)
@@ -1182,12 +1183,6 @@ if is_service_enabled n-net q-dhcp; then
 
     clean_iptables
 
-    if is_service_enabled n-net; then
-        rm -rf ${NOVA_STATE_PATH}/networks
-        sudo mkdir -p ${NOVA_STATE_PATH}/networks
-        safe_chown -R ${STACK_USER} ${NOVA_STATE_PATH}/networks
-    fi
-
     # Force IP forwarding on, just in case
     sudo sysctl -w net.ipv4.ip_forward=1
 fi
@@ -1226,13 +1221,11 @@ if is_service_enabled nova; then
     init_nova
 
     # Additional Nova configuration that is dependent on other services
+    # TODO(stephenfin): Is it possible for neutron to *not* be enabled now? If
+    # not, remove the if here
     if is_service_enabled neutron; then
         configure_neutron_nova
-    elif is_service_enabled n-net; then
-        create_nova_conf_nova_network
     fi
-
-    init_nova_cells
 fi
 
 
@@ -1314,20 +1307,6 @@ elif is_service_enabled q-svc; then
     echo_summary "Starting Neutron"
     configure_neutron_after_post_config
     start_neutron_service_and_check
-elif is_service_enabled $DATABASE_BACKENDS && is_service_enabled n-net; then
-    NM_CONF=${NOVA_CONF}
-    if is_service_enabled n-cell; then
-        NM_CONF=${NOVA_CELLS_CONF}
-    fi
-
-    # Create a small network
-    $NOVA_BIN_DIR/nova-manage --config-file $NM_CONF network create "$PRIVATE_NETWORK_NAME" $FIXED_RANGE 1 $FIXED_NETWORK_SIZE $NETWORK_CREATE_ARGS
-
-    # Create some floating ips
-    $NOVA_BIN_DIR/nova-manage --config-file $NM_CONF floating create $FLOATING_RANGE --pool=$PUBLIC_NETWORK_NAME
-
-    # Create a second pool
-    $NOVA_BIN_DIR/nova-manage --config-file $NM_CONF floating create --ip_range=$TEST_FLOATING_RANGE --pool=$TEST_FLOATING_POOL
 fi
 
 # Start placement before any of the service that are likely to want
diff --git a/stackrc b/stackrc
index 2291e3c3d8..3432fb6228 100644
--- a/stackrc
+++ b/stackrc
@@ -65,7 +65,7 @@ if ! isset ENABLED_SERVICES ; then
     # Keystone - nothing works without keystone
     ENABLED_SERVICES=key
     # Nova - services to support libvirt based openstack clouds
-    ENABLED_SERVICES+=,n-api,n-cpu,n-cond,n-sch,n-novnc,n-cauth,n-api-meta
+    ENABLED_SERVICES+=,n-api,n-cpu,n-cond,n-sch,n-novnc,n-api-meta
     # Placement service needed for Nova
     ENABLED_SERVICES+=,placement-api,placement-client
     # Glance services needed for Nova
@@ -846,7 +846,6 @@ ENABLE_DEBUG_LOG_LEVEL=$(trueorfalse True ENABLE_DEBUG_LOG_LEVEL)
 FLOATING_RANGE=${FLOATING_RANGE:-172.24.4.0/24}
 IPV4_ADDRS_SAFE_TO_USE=${IPV4_ADDRS_SAFE_TO_USE:-10.0.0.0/22}
 FIXED_RANGE=${FIXED_RANGE:-$IPV4_ADDRS_SAFE_TO_USE}
-FIXED_NETWORK_SIZE=${FIXED_NETWORK_SIZE:-256}
 HOST_IP_IFACE=${HOST_IP_IFACE:-}
 HOST_IP=${HOST_IP:-}
 HOST_IPV6=${HOST_IPV6:-}

From 283e86fbb59aa11afb21b916d3a106e442baee0e Mon Sep 17 00:00:00 2001
From: Stephen Finucane <sfinucan@redhat.com>
Date: Wed, 22 May 2019 10:38:28 +0100
Subject: [PATCH 1544/2409] nova: Set '[neutron] default_floating_pool' instead

In change I2ce8ff3d7c33a402b8af50182ec01f512859c388, we duplicated the
'default_floating_pool' option, found in the '[DEFAULT]' group, to the
'[neutron]' group. This allowed us to continue with our deprecation
plans for the former option, which should be retired along with
nova-network.

Update the nova lib module so it'll set the new option, we can safely
assume to be the correct one now that we've removed support for cells v1
and nova-network.

Change-Id: If9a02b640e6c2e1300c7b11b7552ba13c1496d79
Signed-off-by: Stephen Finucane <sfinucan@redhat.com>
---
 lib/nova | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index 2efe7cb9b4..eebf170509 100644
--- a/lib/nova
+++ b/lib/nova
@@ -388,7 +388,7 @@ function create_nova_conf {
     if [[ $SCHEDULER == "filter_scheduler" ]]; then
         iniset $NOVA_CONF scheduler workers "$API_WORKERS"
     fi
-    iniset $NOVA_CONF DEFAULT default_floating_pool "$PUBLIC_NETWORK_NAME"
+    iniset $NOVA_CONF neutron default_floating_pool "$PUBLIC_NETWORK_NAME"
     if [[ $SERVICE_IP_VERSION == 6 ]]; then
         iniset $NOVA_CONF DEFAULT my_ip "$HOST_IPV6"
         iniset $NOVA_CONF DEFAULT use_ipv6 "True"

From a23e4153ef6711ebddc05290bb19c4c2d4fc2c18 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <sfinucan@redhat.com>
Date: Wed, 22 May 2019 10:46:02 +0100
Subject: [PATCH 1545/2409] nova: Stop setting '[DEFAULT] use_ipv6'

Change I188fc2cd1b26fe7a71804f7e7d66b111d6f15e30 in nova stopped us
respecting this when generating the network templates injected into
instances on boot. With the removal of nova-network, there is no longer
any other reason to set this.

Change-Id: I925b7c6c23133cd5a835960f4507c979f615d78e
Signed-off-by: Stephen Finucane <sfinucan@redhat.com>
---
 lib/nova | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index eebf170509..69364909ba 100644
--- a/lib/nova
+++ b/lib/nova
@@ -391,7 +391,6 @@ function create_nova_conf {
     iniset $NOVA_CONF neutron default_floating_pool "$PUBLIC_NETWORK_NAME"
     if [[ $SERVICE_IP_VERSION == 6 ]]; then
         iniset $NOVA_CONF DEFAULT my_ip "$HOST_IPV6"
-        iniset $NOVA_CONF DEFAULT use_ipv6 "True"
     else
         iniset $NOVA_CONF DEFAULT my_ip "$HOST_IP"
     fi

From 1b15176b0598f00c442c3b40985df30204dc6963 Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Fri, 31 May 2019 16:23:57 +0200
Subject: [PATCH 1546/2409] Use neutron-legacy on subnodes in devstack zuul job

There are still some issues with lib/neutron thus neutron-legacy is used
on controller node in multinode jobs and in single node jobs.
But in "group-vars" in devstack job it was configured to use
lib/neutron which can cause some problems in multinode jobs.

So lets switch to neutron-legacy on subnodes also until lib/neutron
will be ready to use everywhere.

Change-Id: I0d7f9f2baaee2836a719f199939156bd4f53f778
---
 .zuul.yaml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 60e3a14f14..34ee8cda91 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -460,7 +460,10 @@
           n-cpu: true
           placement-client: true
           # Neutron services
-          neutron-agent: true
+          # We need to keep using the neutron-legacy based services for
+          # now until all issues with the new lib/neutron code are solved
+          q-agt: true
+          # neutron-agent: true
           # Cinder services
           c-bak: true
           c-vol: true

From 16395949385356c4ab3c82227cd6c6a92496d356 Mon Sep 17 00:00:00 2001
From: shenjiatong <yshxxsjt715@gmail.com>
Date: Mon, 3 Jun 2019 10:52:01 +0800
Subject: [PATCH 1547/2409] remove duplicate entries under title guides in
 table of contents

right now, there are duplicate titles under contents --> guides
as shown in https://docs.openstack.org/devstack/latest/, although
they will forward to different pages, it is still a little confusing
for users. This change will hide toctree in guides.rst and users could
click links in page to jump to detail page to read more.

Change-Id: I2f3abeca7f56a3aedeabb48630ed2c61635b93cd
---
 doc/source/guides.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/guides.rst b/doc/source/guides.rst
index 82e0dd6ac6..ca134c4520 100644
--- a/doc/source/guides.rst
+++ b/doc/source/guides.rst
@@ -10,6 +10,7 @@ Walk through various setups used by stackers
 
 .. toctree::
    :glob:
+   :hidden:
    :maxdepth: 1
 
    guides/single-vm

From 5e2d0e0bb5beffc23087383e7923dabaa2004a98 Mon Sep 17 00:00:00 2001
From: Alex Monk <krenair@gmail.com>
Date: Tue, 4 Jun 2019 01:21:44 +0100
Subject: [PATCH 1548/2409] Permit use of sudo-ldap instead of sudo package

If the sudo-ldap package is providing the sudo command instead of the plain
sudo package, accept that instead of breaking the system and requiring direct
root login intervention to fix things.

Change-Id: I45d7e4617bd59e72b4f0bf2e91750a6830e2a010
---
 stack.sh                   | 2 +-
 tools/create-stack-user.sh | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/stack.sh b/stack.sh
index fa5b43ce38..9b3097ba23 100755
--- a/stack.sh
+++ b/stack.sh
@@ -247,7 +247,7 @@ disable_negated_services
 # --------------
 
 # We're not as **root** so make sure ``sudo`` is available
-is_package_installed sudo || install_package sudo
+is_package_installed sudo || is_package_installed sudo-ldap || install_package sudo
 
 # UEC images ``/etc/sudoers`` does not have a ``#includedir``, add one
 sudo grep -q "^#includedir.*/etc/sudoers.d" /etc/sudoers ||
diff --git a/tools/create-stack-user.sh b/tools/create-stack-user.sh
index c0b7ac70aa..919cacb036 100755
--- a/tools/create-stack-user.sh
+++ b/tools/create-stack-user.sh
@@ -32,7 +32,7 @@ GetDistro
 source $TOP_DIR/stackrc
 
 # Give the non-root user the ability to run as **root** via ``sudo``
-is_package_installed sudo || install_package sudo
+is_package_installed sudo || is_package_installed sudo-ldap || install_package sudo
 
 [[ -z "$STACK_USER" ]] && die "STACK_USER is not set. Exiting."
 

From fc207050988e236c32b0736f44c6bf2883cea95f Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Wed, 5 Jun 2019 08:24:45 +0000
Subject: [PATCH 1549/2409] Add setting of placement microversion on tempest
 conf

Tempest not support placement microversion setting so that
test can call APIs with specific placement microversion.

This commit adds the setting of placement API microversion on
Tempest conf.

Change-Id: Ie04aa993ec7a1495740d9267b076a40f4291e25e
---
 lib/tempest | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index 9f1b677eba..6afed0eaf1 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -513,6 +513,24 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG volume storage_protocol "$TEMPEST_STORAGE_PROTOCOL"
     fi
 
+    # Placement Features
+    # Set the microversion range for placement.
+    # Setting [None, latest] range of microversion which allow Tempest to run all microversions tests.
+    # NOTE- To avoid microversion tests failure on stable branch, we need to change "tempest_placement_max_microversion"
+    #       for stable branch on each release which should be changed from "latest" to max supported version of that release.
+    local tempest_placement_min_microversion=${TEMPEST_PLACEMENT_MIN_MICROVERSION:-None}
+    local tempest_placement_max_microversion=${TEMPEST_PLACEMENT_MAX_MICROVERSION:-"latest"}
+    if [ "$tempest_placement_min_microversion" == "None" ]; then
+        inicomment $TEMPEST_CONFIG placement min_microversion
+    else
+        iniset $TEMPEST_CONFIG placement min_microversion $tempest_placement_min_microversion
+    fi
+    if [ "$tempest_placement_max_microversion" == "None" ]; then
+        inicomment $TEMPEST_CONFIG placement max_microversion
+    else
+        iniset $TEMPEST_CONFIG placement max_microversion $tempest_placement_max_microversion
+    fi
+
     # Baremetal
     if [ "$VIRT_DRIVER" = "ironic" ] ; then
         iniset $TEMPEST_CONFIG compute-feature-enabled change_password False

From 58abccb89f46576b573733fd424056b2f5a0203d Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Fri, 24 May 2019 15:09:01 -0400
Subject: [PATCH 1550/2409] Add nova-multi-cell job to experimental queue

Nova has had a multi-cell job (nova-multi-cell) since the
Train release but is currently non-voting in the check queue
for nova changes. This change adds the job to the experimental
queue for devstack changes so we can test changes to devstack
and make sure they work for the multi-cell job.

Change-Id: Icf31baf6fd4313aec5ecfb9e8f9cbcef1ff7f61d
---
 .zuul.yaml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index 3c516dd350..2dd0b9f4ef 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -701,9 +701,12 @@
     #    stable engouh with uwsgi.
     # * neutron-tempest-with-uwsgi: maintained by neutron for tempest test.
     #    Next cycle we can remove this if everything run out stable enough.
+    # * nova-multi-cell: maintained by nova and currently non-voting in the
+    #    check queue for nova changes but relies on devstack configuration
 
     experimental:
       jobs:
+        - nova-multi-cell
         - nova-next
         - neutron-fullstack-with-uwsgi
         - neutron-functional-with-uwsgi

From 6e5b1384665c0c039222ff6cbea5a120e60e89d1 Mon Sep 17 00:00:00 2001
From: Julia Kreger <juliaashleykreger@gmail.com>
Date: Wed, 9 Jan 2019 17:00:45 -0800
Subject: [PATCH 1551/2409] Enable vlan networking for newer neutron plugin

Ironic's CI makes extensive use of VLAN based networking
and the newer neutron plugin hardcodes the tenant networking
type to vxlan which is naturally problematic. It also lacks the
ability to set the necessary constraints for vlan networking
which are added for vxlan networking.

This patch enables the type of tenant networking to be defined
as vlan, and enables for a physical network vlan range mapping
setting to be configured which is required for a vlan to be
allocated upon network creation.

Change-Id: I55874c1ce82898e9dfb81505d8f3b14abde33579
---
 lib/neutron | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 947c491ec1..763a906e52 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -100,6 +100,17 @@ NEUTRON_ROOTWRAP_DAEMON_CMD="$NEUTRON_ROOTWRAP-daemon $NEUTRON_ROOTWRAP_CONF_FIL
 PUBLIC_BRIDGE=${PUBLIC_BRIDGE:-br-ex}
 PUBLIC_BRIDGE_MTU=${PUBLIC_BRIDGE_MTU:-1500}
 
+# Network type - default vxlan, however enables vlan based jobs to override
+# using the legacy environment variable as well as a new variable in greater
+# alignment with the naming scheme of this plugin.
+NEUTRON_TENANT_NETWORK_TYPE=${NEUTRON_TENANT_NETWORK_TYPE:-vxlan}
+
+NEUTRON_TENANT_VLAN_RANGE=${NEUTRON_TENANT_VLAN_RANGE:-${TENANT_VLAN_RANGE:-100:150}}
+
+# Physical network for VLAN network usage.
+NEUTRON_PHYSICAL_NETWORK=${NEUTRON_PHYSICAL_NETWORK:-}
+
+
 # Additional neutron api config files
 declare -a -g _NEUTRON_SERVER_EXTRA_CONF_FILES_ABS
 
@@ -203,9 +214,8 @@ function configure_neutron_new {
         configure_auth_token_middleware $NEUTRON_CONF neutron $NEUTRON_AUTH_CACHE_DIR keystone_authtoken
         configure_auth_token_middleware $NEUTRON_CONF nova $NEUTRON_AUTH_CACHE_DIR nova
 
-        # Configure VXLAN
-        # TODO(sc68cal) not hardcode?
-        iniset $NEUTRON_CORE_PLUGIN_CONF ml2 tenant_network_types vxlan
+        # Configure tenant network type
+        iniset $NEUTRON_CORE_PLUGIN_CONF ml2 tenant_network_types $NEUTRON_TENANT_NETWORK_TYPE
 
         local mech_drivers="openvswitch"
         if [[ "$NEUTRON_DISTRIBUTED_ROUTING" = "True" ]]; then
@@ -217,6 +227,9 @@ function configure_neutron_new {
 
         iniset $NEUTRON_CORE_PLUGIN_CONF ml2_type_vxlan vni_ranges 1001:2000
         iniset $NEUTRON_CORE_PLUGIN_CONF ml2_type_flat flat_networks public
+        if [[ "$NEUTRON_TENANT_NETWORK_TYPE" =~ "vlan" ]] && [[ "$NEUTRON_PHYSICAL_NETWORK" != "" ]]; then
+            iniset $NEUTRON_CORE_PLUGIN_CONF ml2_type_vlan network_vlan_ranges ${NEUTRON_PHYSICAL_NETWORK}:${NEUTRON_TENANT_VLAN_RANGE}
+        fi
         if [[ "$NEUTRON_PORT_SECURITY" = "True" ]]; then
             neutron_ml2_extension_driver_add port_security
         fi

From b57757ae14a54e78ebd533198564d24af77c51da Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Mon, 3 Jun 2019 16:08:09 -0400
Subject: [PATCH 1552/2409] Add NOVA_NOTIFICATION_FORMAT variable

Nova change https://review.opendev.org/603079/ changed the
default configuration to send only unversioned notfications rather
than both versioned and unversioned notifications. This could break
unsuspecting downstream projects (like Watcher) whose CI jobs are
not explicitly configuring nova for the types of notifications
they need but are just relying on getting both per the previous
default of the config option.

This adds a variable which defaults to "unversioned" to match the
nova default but allows downstream CI jobs to easily configure
another value.

Needed by https://review.opendev.org/663332/

Change-Id: Ied9d50b07c368d5c2be658c744f340a8d1ee41e0
---
 lib/nova | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/lib/nova b/lib/nova
index 6ce1dcc4cc..7d66b68cfb 100644
--- a/lib/nova
+++ b/lib/nova
@@ -187,6 +187,10 @@ NOVA_USE_SERVICE_TOKEN=$(trueorfalse False NOVA_USE_SERVICE_TOKEN)
 ISCSID_DEBUG=$(trueorfalse False ISCSID_DEBUG)
 ISCSID_DEBUG_LEVEL=${ISCSID_DEBUG_LEVEL:-4}
 
+# Format for notifications. Nova defaults to "unversioned" since Train.
+# Other options include "versioned" and "both".
+NOVA_NOTIFICATION_FORMAT=${NOVA_NOTIFICATION_FORMAT:-unversioned}
+
 # Functions
 # ---------
 
@@ -535,6 +539,7 @@ function create_nova_conf {
     # enable notifications, but it will allow them to function when enabled.
     iniset $NOVA_CONF oslo_messaging_notifications driver "messagingv2"
     iniset $NOVA_CONF oslo_messaging_notifications transport_url $(get_notification_url)
+    iniset $NOVA_CONF notifications notification_format "$NOVA_NOTIFICATION_FORMAT"
     iniset_rpc_backend nova $NOVA_CONF
 
     iniset $NOVA_CONF DEFAULT osapi_compute_workers "$API_WORKERS"

From 5b8656e748dca1c822556b27f51d67ab238e0721 Mon Sep 17 00:00:00 2001
From: Kenichi Omichi <ken-oomichi@wx.jp.nec.com>
Date: Tue, 18 Jun 2019 23:38:28 +0000
Subject: [PATCH 1553/2409] Remove RetryFilter from config

Since Ic0a03e89903bf925638fa26cca3dac7db710dca3 RetryFilter has been
deprecated. So we should not enable the RetryFilter on our tests.

Change-Id: I48c2c4d0714f582af8948dc88b48df1c2c62fcd2
---
 lib/nova | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index 8220e0f10b..0a091e3e60 100644
--- a/lib/nova
+++ b/lib/nova
@@ -103,7 +103,7 @@ SCHEDULER=${SCHEDULER:-filter_scheduler}
 
 # The following NOVA_FILTERS contains SameHostFilter and DifferentHostFilter with
 # the default filters.
-NOVA_FILTERS="RetryFilter,AvailabilityZoneFilter,ComputeFilter,ComputeCapabilitiesFilter,ImagePropertiesFilter,ServerGroupAntiAffinityFilter,ServerGroupAffinityFilter,SameHostFilter,DifferentHostFilter"
+NOVA_FILTERS="AvailabilityZoneFilter,ComputeFilter,ComputeCapabilitiesFilter,ImagePropertiesFilter,ServerGroupAntiAffinityFilter,ServerGroupAffinityFilter,SameHostFilter,DifferentHostFilter"
 
 QEMU_CONF=/etc/libvirt/qemu.conf
 

From f7302e1af10938a0ffc259ab9bfd3919693fe36b Mon Sep 17 00:00:00 2001
From: Sean McGinnis <sean.mcginnis@gmail.com>
Date: Wed, 19 Jun 2019 11:49:40 -0500
Subject: [PATCH 1554/2409] Fix configuration doc block formatting

Many of the code blocks in the configuration documentation had extra
leading spaces. This resulted in the blocks being both code block
formatted as well as blockquoted in the output.

This patch removes leading spaces and some minor cleanup to get the
formatted output correct.

Change-Id: Ic4dfb49c547d51e16b673bc88d7b2b1a907e3258
Signed-off-by: Sean McGinnis <sean.mcginnis@gmail.com>
---
 doc/source/configuration.rst | 146 +++++++++++++++--------------------
 1 file changed, 63 insertions(+), 83 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 5e8004dc44..098e994ccd 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -224,25 +224,22 @@ check out. These may be overridden in ``local.conf`` to pull source
 from a different repo for testing, such as a Gerrit branch
 proposal. ``GIT_BASE`` points to the primary repository server.
 
-    ::
+::
 
-        NOVA_REPO=$GIT_BASE/openstack/nova.git
-        NOVA_BRANCH=master
+    NOVA_REPO=$GIT_BASE/openstack/nova.git
+    NOVA_BRANCH=master
 
 To pull a branch directly from Gerrit, get the repo and branch from
-the Gerrit review page:
-
-    ::
-
-        git fetch https://review.openstack.org/p/openstack/nova refs/changes/50/5050/1 && git checkout FETCH_HEAD
+the Gerrit review page::
 
-    The repo is the stanza following ``fetch`` and the branch is the
-    stanza following that:
+    git fetch https://review.openstack.org/p/openstack/nova \
+        refs/changes/50/5050/1 && git checkout FETCH_HEAD
 
-    ::
+The repo is the stanza following ``fetch`` and the branch is the
+stanza following that::
 
-        NOVA_REPO=https://review.openstack.org/p/openstack/nova
-        NOVA_BRANCH=refs/changes/50/5050/1
+    NOVA_REPO=https://review.openstack.org/p/openstack/nova
+    NOVA_BRANCH=refs/changes/50/5050/1
 
 
 Installation Directory
@@ -255,9 +252,9 @@ By setting it early in the ``localrc`` section you can reference it in
 later variables.  It can be useful to set it even though it is not
 changed from the default value.
 
-    ::
+::
 
-        DEST=/opt/stack
+    DEST=/opt/stack
 
 Logging
 -------
@@ -271,21 +268,21 @@ runs. It can be sent to a file in addition to the console by setting
 timestamp will be appended to the given filename for each run of
 ``stack.sh``.
 
-    ::
+::
 
-        LOGFILE=$DEST/logs/stack.sh.log
+    LOGFILE=$DEST/logs/stack.sh.log
 
 Old log files are cleaned automatically if ``LOGDAYS`` is set to the
 number of days of old log files to keep.
 
-    ::
+::
 
-        LOGDAYS=1
+    LOGDAYS=1
 
 Some coloring is used during the DevStack runs to make it easier to
 see what is going on. This can be disabled with::
 
-        LOG_COLOR=False
+    LOG_COLOR=False
 
 When using the logfile, by default logs are sent to the console and
 the file.  You can set ``VERBOSE`` to ``false`` if you only wish the
@@ -317,12 +314,12 @@ Example Logging Configuration
 For example, non-interactive installs probably wish to save output to
 a file, keep service logs and disable color in the stored files.
 
-   ::
+::
 
-       [[local|localrc]]
-       DEST=/opt/stack/
-       LOGFILE=$LOGDIR/stack.sh.log
-       LOG_COLOR=False
+   [[local|localrc]]
+   DEST=/opt/stack/
+   LOGFILE=$LOGDIR/stack.sh.log
+   LOG_COLOR=False
 
 Database Backend
 ----------------
@@ -330,12 +327,10 @@ Database Backend
 Multiple database backends are available. The available databases are defined
 in the lib/databases directory.
 ``mysql`` is the default database, choose a different one by putting the
-following in the ``localrc`` section:
-
-   ::
+following in the ``localrc`` section::
 
-      disable_service mysql
-      enable_service postgresql
+  disable_service mysql
+  enable_service postgresql
 
 ``mysql`` is the default database.
 
@@ -347,11 +342,9 @@ backends may be available via external plugins.  Enabling or disabling
 RabbitMQ is handled via the usual service functions and
 ``ENABLED_SERVICES``.
 
-Example disabling RabbitMQ in ``local.conf``:
+Example disabling RabbitMQ in ``local.conf``::
 
-::
-
-    disable_service rabbit
+  disable_service rabbit
 
 
 Apache Frontend
@@ -370,34 +363,23 @@ override toggle available that can be set in your ``local.conf``.
 
 Keystone is run under Apache with ``mod_wsgi`` by default.
 
-Example (Keystone)
-
-::
+Example (Keystone)::
 
     KEYSTONE_USE_MOD_WSGI="True"
 
-Example (Nova):
-
-::
+Example (Nova)::
 
     NOVA_USE_MOD_WSGI="True"
 
-Example (Swift):
-
-::
+Example (Swift)::
 
     SWIFT_USE_MOD_WSGI="True"
 
-Example (Heat):
-
-::
+Example (Heat)::
 
     HEAT_USE_MOD_WSGI="True"
 
-
-Example (Cinder):
-
-::
+Example (Cinder)::
 
     CINDER_USE_MOD_WSGI="True"
 
@@ -413,9 +395,9 @@ system you can have devstack install it from upstream, or from local
 git trees by specifying it in ``LIBS_FROM_GIT``.  Multiple libraries
 can be specified as a comma separated list.
 
-   ::
+::
 
-      LIBS_FROM_GIT=python-keystoneclient,oslo.config
+  LIBS_FROM_GIT=python-keystoneclient,oslo.config
 
 Setting the variable to ``ALL`` will activate the download for all
 libraries.
@@ -431,9 +413,9 @@ Each entry in the ``PROJECT_VENV`` array contains the directory name
 of a venv to be used for the project.  The array index is the project
 name.  Multiple projects can use the same venv if desired.
 
-  ::
+::
 
-    PROJECT_VENV["glance"]=${GLANCE_DIR}.venv
+  PROJECT_VENV["glance"]=${GLANCE_DIR}.venv
 
 ``ADDITIONAL_VENV_PACKAGES`` is a comma-separated list of additional
 packages to be installed into each venv.  Often projects will not have
@@ -442,9 +424,9 @@ are 'optional' requirements, i.e. only needed for certain
 configurations.  By default, the enabled databases will have their
 Python bindings added when they are enabled.
 
-  ::
+::
 
-     ADDITIONAL_VENV_PACKAGES="python-foo, python-bar"
+  ADDITIONAL_VENV_PACKAGES="python-foo, python-bar"
 
 Use python3
 ------------
@@ -453,9 +435,9 @@ By default ``stack.sh`` uses python2 (the exact version set by the
 ``PYTHON2_VERSION``). This can be overriden so devstack will run
 python3 (the exact version set by ``PYTHON3_VERSION``).
 
-  ::
+::
 
-     USE_PYTHON3=True
+  USE_PYTHON3=True
 
 A clean install every time
 --------------------------
@@ -465,9 +447,9 @@ exist in ``$DEST``. ``stack.sh`` will freshen each repo on each run if
 ``RECLONE`` is set to ``yes``. This avoids having to manually remove
 repos in order to get the current branch from ``$GIT_BASE``.
 
-    ::
+::
 
-        RECLONE=yes
+  RECLONE=yes
 
 Upgrade packages installed by pip
 ---------------------------------
@@ -478,9 +460,9 @@ requirement. If ``PIP_UPGRADE`` is set to ``True`` then existing
 required Python packages will be upgraded to the most recent version
 that matches requirements.
 
-    ::
+::
 
-        PIP_UPGRADE=True
+  PIP_UPGRADE=True
 
 Guest Images
 ------------
@@ -494,11 +476,11 @@ their testing-requirements in ``stack.sh``.  Setting
 these default images; in that case, you will want to populate
 ``IMAGE_URLS`` with sufficient images to satisfy testing-requirements.
 
-    ::
+::
 
-        DOWNLOAD_DEFAULT_IMAGES=False
-        IMAGE_URLS="http://foo.bar.com/image.qcow,"
-        IMAGE_URLS+="http://foo.bar.com/image2.qcow"
+  DOWNLOAD_DEFAULT_IMAGES=False
+  IMAGE_URLS="http://foo.bar.com/image.qcow,"
+  IMAGE_URLS+="http://foo.bar.com/image2.qcow"
 
 
 Instance Type
@@ -517,9 +499,9 @@ KVM on Power with QEMU 2.4 requires 512 MB to load the firmware -
 running instances on ppc64/ppc64le can choose one of the default
 created flavors as follows:
 
-    ::
+::
 
-        DEFAULT_INSTANCE_TYPE=m1.tiny
+  DEFAULT_INSTANCE_TYPE=m1.tiny
 
 
 IP Version
@@ -530,19 +512,19 @@ IPv4, IPv6, or dual-stack self-service project data-network by with
 either ``IP_VERSION=4``, ``IP_VERSION=6``, or ``IP_VERSION=4+6``
 respectively.
 
-    ::
+::
 
-        IP_VERSION=4+6
+  IP_VERSION=4+6
 
 The following optional variables can be used to alter the default IPv6
 behavior:
 
-    ::
+::
 
-        IPV6_RA_MODE=slaac
-        IPV6_ADDRESS_MODE=slaac
-        IPV6_ADDRS_SAFE_TO_USE=fd$IPV6_GLOBAL_ID::/56
-        IPV6_PRIVATE_NETWORK_GATEWAY=fd$IPV6_GLOBAL_ID::1
+  IPV6_RA_MODE=slaac
+  IPV6_ADDRESS_MODE=slaac
+  IPV6_ADDRS_SAFE_TO_USE=fd$IPV6_GLOBAL_ID::/56
+  IPV6_PRIVATE_NETWORK_GATEWAY=fd$IPV6_GLOBAL_ID::1
 
 *Note*: ``IPV6_ADDRS_SAFE_TO_USE`` and ``IPV6_PRIVATE_NETWORK_GATEWAY``
 can be configured with any valid IPv6 prefix. The default values make
@@ -565,11 +547,9 @@ address.
 
 The default value for this setting is ``4``.  Dual-mode support, for
 example ``4+6`` is not currently supported.  ``HOST_IPV6`` can
-optionally be used to alter the default IPv6 address
-
-    ::
+optionally be used to alter the default IPv6 address::
 
-        HOST_IPV6=${some_local_ipv6_address}
+  HOST_IPV6=${some_local_ipv6_address}
 
 Multi-node setup
 ~~~~~~~~~~~~~~~~
@@ -671,11 +651,11 @@ set by ``VOLUME_GROUP_NAME``, the logical volume name prefix is set with
 ``VOLUME_NAME_PREFIX`` and the size of the volume backing file is set
 with ``VOLUME_BACKING_FILE_SIZE``.
 
-    ::
+::
 
-        VOLUME_GROUP_NAME="stack-volumes"
-        VOLUME_NAME_PREFIX="volume-"
-        VOLUME_BACKING_FILE_SIZE=24G
+  VOLUME_GROUP_NAME="stack-volumes"
+  VOLUME_NAME_PREFIX="volume-"
+  VOLUME_BACKING_FILE_SIZE=24G
 
 
 Keystone

From d5634c4723df4f6b597578a8588ad3730e4b5bbc Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 4 Jun 2019 17:30:13 +1000
Subject: [PATCH 1555/2409] Fix plugin doc generation for opendev transition

Update the server to opendev and update paths for gitea, along with
any other references.

Switch to a blacklist where we just remove stackforge; this leaves all
the new namespaces like x/ and starlingx/ being checked.

Use a common session for checking for the plugin file which makes it a
*lot* faster.

Remove unsed "plugins" array variable

Regenerate the file

Change-Id: Ie3e615ba352a389da22e129c5c67cf6abd8cfdc8
---
 doc/source/plugin-registry.rst          | 369 ++++++++++++------------
 tools/generate-devstack-plugins-list.py |  25 +-
 tools/generate-devstack-plugins-list.sh |  10 +-
 3 files changed, 204 insertions(+), 200 deletions(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 93c16f454c..ea8c31807d 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -21,189 +21,190 @@ available DevStack plugins.  This includes, but is not limited to,
 official OpenStack projects.
 
 
-====================================== ===
-Plugin Name                            URL
-====================================== ===
-almanach                               `https://git.openstack.org/openstack/almanach <https://git.openstack.org/cgit/openstack/almanach>`__
-aodh                                   `https://git.openstack.org/openstack/aodh <https://git.openstack.org/cgit/openstack/aodh>`__
-apmec                                  `https://git.openstack.org/openstack/apmec <https://git.openstack.org/cgit/openstack/apmec>`__
-barbican                               `https://git.openstack.org/openstack/barbican <https://git.openstack.org/cgit/openstack/barbican>`__
-bilean                                 `https://git.openstack.org/openstack/bilean <https://git.openstack.org/cgit/openstack/bilean>`__
-blazar                                 `https://git.openstack.org/openstack/blazar <https://git.openstack.org/cgit/openstack/blazar>`__
-broadview-collector                    `https://git.openstack.org/openstack/broadview-collector <https://git.openstack.org/cgit/openstack/broadview-collector>`__
-castellan-ui                           `https://git.openstack.org/openstack/castellan-ui <https://git.openstack.org/cgit/openstack/castellan-ui>`__
-ceilometer                             `https://git.openstack.org/openstack/ceilometer <https://git.openstack.org/cgit/openstack/ceilometer>`__
-ceilometer-powervm                     `https://git.openstack.org/openstack/ceilometer-powervm <https://git.openstack.org/cgit/openstack/ceilometer-powervm>`__
-cinderlib                              `https://git.openstack.org/openstack/cinderlib <https://git.openstack.org/cgit/openstack/cinderlib>`__
-cloudkitty                             `https://git.openstack.org/openstack/cloudkitty <https://git.openstack.org/cgit/openstack/cloudkitty>`__
-collectd-openstack-plugins             `https://git.openstack.org/openstack/collectd-openstack-plugins <https://git.openstack.org/cgit/openstack/collectd-openstack-plugins>`__
-congress                               `https://git.openstack.org/openstack/congress <https://git.openstack.org/cgit/openstack/congress>`__
-cyborg                                 `https://git.openstack.org/openstack/cyborg <https://git.openstack.org/cgit/openstack/cyborg>`__
-designate                              `https://git.openstack.org/openstack/designate <https://git.openstack.org/cgit/openstack/designate>`__
-devstack-plugin-additional-pkg-repos   `https://git.openstack.org/openstack/devstack-plugin-additional-pkg-repos <https://git.openstack.org/cgit/openstack/devstack-plugin-additional-pkg-repos>`__
-devstack-plugin-amqp1                  `https://git.openstack.org/openstack/devstack-plugin-amqp1 <https://git.openstack.org/cgit/openstack/devstack-plugin-amqp1>`__
-devstack-plugin-bdd                    `https://git.openstack.org/openstack/devstack-plugin-bdd <https://git.openstack.org/cgit/openstack/devstack-plugin-bdd>`__
-devstack-plugin-ceph                   `https://git.openstack.org/openstack/devstack-plugin-ceph <https://git.openstack.org/cgit/openstack/devstack-plugin-ceph>`__
-devstack-plugin-container              `https://git.openstack.org/openstack/devstack-plugin-container <https://git.openstack.org/cgit/openstack/devstack-plugin-container>`__
-devstack-plugin-glusterfs              `https://git.openstack.org/openstack/devstack-plugin-glusterfs <https://git.openstack.org/cgit/openstack/devstack-plugin-glusterfs>`__
-devstack-plugin-hdfs                   `https://git.openstack.org/openstack/devstack-plugin-hdfs <https://git.openstack.org/cgit/openstack/devstack-plugin-hdfs>`__
-devstack-plugin-kafka                  `https://git.openstack.org/openstack/devstack-plugin-kafka <https://git.openstack.org/cgit/openstack/devstack-plugin-kafka>`__
-devstack-plugin-libvirt-qemu           `https://git.openstack.org/openstack/devstack-plugin-libvirt-qemu <https://git.openstack.org/cgit/openstack/devstack-plugin-libvirt-qemu>`__
-devstack-plugin-mariadb                `https://git.openstack.org/openstack/devstack-plugin-mariadb <https://git.openstack.org/cgit/openstack/devstack-plugin-mariadb>`__
-devstack-plugin-nfs                    `https://git.openstack.org/openstack/devstack-plugin-nfs <https://git.openstack.org/cgit/openstack/devstack-plugin-nfs>`__
-devstack-plugin-pika                   `https://git.openstack.org/openstack/devstack-plugin-pika <https://git.openstack.org/cgit/openstack/devstack-plugin-pika>`__
-devstack-plugin-sheepdog               `https://git.openstack.org/openstack/devstack-plugin-sheepdog <https://git.openstack.org/cgit/openstack/devstack-plugin-sheepdog>`__
-devstack-plugin-vmax                   `https://git.openstack.org/openstack/devstack-plugin-vmax <https://git.openstack.org/cgit/openstack/devstack-plugin-vmax>`__
-devstack-plugin-zmq                    `https://git.openstack.org/openstack/devstack-plugin-zmq <https://git.openstack.org/cgit/openstack/devstack-plugin-zmq>`__
-dragonflow                             `https://git.openstack.org/openstack/dragonflow <https://git.openstack.org/cgit/openstack/dragonflow>`__
-drbd-devstack                          `https://git.openstack.org/openstack/drbd-devstack <https://git.openstack.org/cgit/openstack/drbd-devstack>`__
-ec2-api                                `https://git.openstack.org/openstack/ec2-api <https://git.openstack.org/cgit/openstack/ec2-api>`__
-freezer                                `https://git.openstack.org/openstack/freezer <https://git.openstack.org/cgit/openstack/freezer>`__
-freezer-api                            `https://git.openstack.org/openstack/freezer-api <https://git.openstack.org/cgit/openstack/freezer-api>`__
-freezer-tempest-plugin                 `https://git.openstack.org/openstack/freezer-tempest-plugin <https://git.openstack.org/cgit/openstack/freezer-tempest-plugin>`__
-freezer-web-ui                         `https://git.openstack.org/openstack/freezer-web-ui <https://git.openstack.org/cgit/openstack/freezer-web-ui>`__
-gce-api                                `https://git.openstack.org/openstack/gce-api <https://git.openstack.org/cgit/openstack/gce-api>`__
-glare                                  `https://git.openstack.org/openstack/glare <https://git.openstack.org/cgit/openstack/glare>`__
-group-based-policy                     `https://git.openstack.org/openstack/group-based-policy <https://git.openstack.org/cgit/openstack/group-based-policy>`__
-gyan                                   `https://git.openstack.org/openstack/gyan <https://git.openstack.org/cgit/openstack/gyan>`__
-heat                                   `https://git.openstack.org/openstack/heat <https://git.openstack.org/cgit/openstack/heat>`__
-heat-dashboard                         `https://git.openstack.org/openstack/heat-dashboard <https://git.openstack.org/cgit/openstack/heat-dashboard>`__
-horizon-mellanox                       `https://git.openstack.org/openstack/horizon-mellanox <https://git.openstack.org/cgit/openstack/horizon-mellanox>`__
-ironic                                 `https://git.openstack.org/openstack/ironic <https://git.openstack.org/cgit/openstack/ironic>`__
-ironic-inspector                       `https://git.openstack.org/openstack/ironic-inspector <https://git.openstack.org/cgit/openstack/ironic-inspector>`__
-ironic-staging-drivers                 `https://git.openstack.org/openstack/ironic-staging-drivers <https://git.openstack.org/cgit/openstack/ironic-staging-drivers>`__
-ironic-ui                              `https://git.openstack.org/openstack/ironic-ui <https://git.openstack.org/cgit/openstack/ironic-ui>`__
-karbor                                 `https://git.openstack.org/openstack/karbor <https://git.openstack.org/cgit/openstack/karbor>`__
-karbor-dashboard                       `https://git.openstack.org/openstack/karbor-dashboard <https://git.openstack.org/cgit/openstack/karbor-dashboard>`__
-keystone                               `https://git.openstack.org/openstack/keystone <https://git.openstack.org/cgit/openstack/keystone>`__
-kingbird                               `https://git.openstack.org/openstack/kingbird <https://git.openstack.org/cgit/openstack/kingbird>`__
-kuryr-kubernetes                       `https://git.openstack.org/openstack/kuryr-kubernetes <https://git.openstack.org/cgit/openstack/kuryr-kubernetes>`__
-kuryr-libnetwork                       `https://git.openstack.org/openstack/kuryr-libnetwork <https://git.openstack.org/cgit/openstack/kuryr-libnetwork>`__
-kuryr-tempest-plugin                   `https://git.openstack.org/openstack/kuryr-tempest-plugin <https://git.openstack.org/cgit/openstack/kuryr-tempest-plugin>`__
-magnum                                 `https://git.openstack.org/openstack/magnum <https://git.openstack.org/cgit/openstack/magnum>`__
-magnum-ui                              `https://git.openstack.org/openstack/magnum-ui <https://git.openstack.org/cgit/openstack/magnum-ui>`__
-manila                                 `https://git.openstack.org/openstack/manila <https://git.openstack.org/cgit/openstack/manila>`__
-manila-tempest-plugin                  `https://git.openstack.org/openstack/manila-tempest-plugin <https://git.openstack.org/cgit/openstack/manila-tempest-plugin>`__
-manila-ui                              `https://git.openstack.org/openstack/manila-ui <https://git.openstack.org/cgit/openstack/manila-ui>`__
-masakari                               `https://git.openstack.org/openstack/masakari <https://git.openstack.org/cgit/openstack/masakari>`__
-meteos                                 `https://git.openstack.org/openstack/meteos <https://git.openstack.org/cgit/openstack/meteos>`__
-meteos-ui                              `https://git.openstack.org/openstack/meteos-ui <https://git.openstack.org/cgit/openstack/meteos-ui>`__
-mistral                                `https://git.openstack.org/openstack/mistral <https://git.openstack.org/cgit/openstack/mistral>`__
-mixmatch                               `https://git.openstack.org/openstack/mixmatch <https://git.openstack.org/cgit/openstack/mixmatch>`__
-mogan                                  `https://git.openstack.org/openstack/mogan <https://git.openstack.org/cgit/openstack/mogan>`__
-mogan-ui                               `https://git.openstack.org/openstack/mogan-ui <https://git.openstack.org/cgit/openstack/mogan-ui>`__
-monasca-analytics                      `https://git.openstack.org/openstack/monasca-analytics <https://git.openstack.org/cgit/openstack/monasca-analytics>`__
-monasca-api                            `https://git.openstack.org/openstack/monasca-api <https://git.openstack.org/cgit/openstack/monasca-api>`__
-monasca-ceilometer                     `https://git.openstack.org/openstack/monasca-ceilometer <https://git.openstack.org/cgit/openstack/monasca-ceilometer>`__
-monasca-events-api                     `https://git.openstack.org/openstack/monasca-events-api <https://git.openstack.org/cgit/openstack/monasca-events-api>`__
-monasca-log-api                        `https://git.openstack.org/openstack/monasca-log-api <https://git.openstack.org/cgit/openstack/monasca-log-api>`__
-monasca-tempest-plugin                 `https://git.openstack.org/openstack/monasca-tempest-plugin <https://git.openstack.org/cgit/openstack/monasca-tempest-plugin>`__
-monasca-transform                      `https://git.openstack.org/openstack/monasca-transform <https://git.openstack.org/cgit/openstack/monasca-transform>`__
-murano                                 `https://git.openstack.org/openstack/murano <https://git.openstack.org/cgit/openstack/murano>`__
-networking-6wind                       `https://git.openstack.org/openstack/networking-6wind <https://git.openstack.org/cgit/openstack/networking-6wind>`__
-networking-ansible                     `https://git.openstack.org/openstack/networking-ansible <https://git.openstack.org/cgit/openstack/networking-ansible>`__
-networking-arista                      `https://git.openstack.org/openstack/networking-arista <https://git.openstack.org/cgit/openstack/networking-arista>`__
-networking-bagpipe                     `https://git.openstack.org/openstack/networking-bagpipe <https://git.openstack.org/cgit/openstack/networking-bagpipe>`__
-networking-baremetal                   `https://git.openstack.org/openstack/networking-baremetal <https://git.openstack.org/cgit/openstack/networking-baremetal>`__
-networking-bgpvpn                      `https://git.openstack.org/openstack/networking-bgpvpn <https://git.openstack.org/cgit/openstack/networking-bgpvpn>`__
-networking-brocade                     `https://git.openstack.org/openstack/networking-brocade <https://git.openstack.org/cgit/openstack/networking-brocade>`__
-networking-calico                      `https://git.openstack.org/openstack/networking-calico <https://git.openstack.org/cgit/openstack/networking-calico>`__
-networking-cisco                       `https://git.openstack.org/openstack/networking-cisco <https://git.openstack.org/cgit/openstack/networking-cisco>`__
-networking-cumulus                     `https://git.openstack.org/openstack/networking-cumulus <https://git.openstack.org/cgit/openstack/networking-cumulus>`__
-networking-dpm                         `https://git.openstack.org/openstack/networking-dpm <https://git.openstack.org/cgit/openstack/networking-dpm>`__
-networking-fortinet                    `https://git.openstack.org/openstack/networking-fortinet <https://git.openstack.org/cgit/openstack/networking-fortinet>`__
-networking-generic-switch              `https://git.openstack.org/openstack/networking-generic-switch <https://git.openstack.org/cgit/openstack/networking-generic-switch>`__
-networking-hpe                         `https://git.openstack.org/openstack/networking-hpe <https://git.openstack.org/cgit/openstack/networking-hpe>`__
-networking-huawei                      `https://git.openstack.org/openstack/networking-huawei <https://git.openstack.org/cgit/openstack/networking-huawei>`__
-networking-hyperv                      `https://git.openstack.org/openstack/networking-hyperv <https://git.openstack.org/cgit/openstack/networking-hyperv>`__
-networking-infoblox                    `https://git.openstack.org/openstack/networking-infoblox <https://git.openstack.org/cgit/openstack/networking-infoblox>`__
-networking-l2gw                        `https://git.openstack.org/openstack/networking-l2gw <https://git.openstack.org/cgit/openstack/networking-l2gw>`__
-networking-lagopus                     `https://git.openstack.org/openstack/networking-lagopus <https://git.openstack.org/cgit/openstack/networking-lagopus>`__
-networking-midonet                     `https://git.openstack.org/openstack/networking-midonet <https://git.openstack.org/cgit/openstack/networking-midonet>`__
-networking-mlnx                        `https://git.openstack.org/openstack/networking-mlnx <https://git.openstack.org/cgit/openstack/networking-mlnx>`__
-networking-nec                         `https://git.openstack.org/openstack/networking-nec <https://git.openstack.org/cgit/openstack/networking-nec>`__
-networking-odl                         `https://git.openstack.org/openstack/networking-odl <https://git.openstack.org/cgit/openstack/networking-odl>`__
-networking-omnipath                    `https://git.openstack.org/openstack/networking-omnipath <https://git.openstack.org/cgit/openstack/networking-omnipath>`__
-networking-onos                        `https://git.openstack.org/openstack/networking-onos <https://git.openstack.org/cgit/openstack/networking-onos>`__
-networking-opencontrail                `https://git.openstack.org/openstack/networking-opencontrail <https://git.openstack.org/cgit/openstack/networking-opencontrail>`__
-networking-ovn                         `https://git.openstack.org/openstack/networking-ovn <https://git.openstack.org/cgit/openstack/networking-ovn>`__
-networking-ovs-dpdk                    `https://git.openstack.org/openstack/networking-ovs-dpdk <https://git.openstack.org/cgit/openstack/networking-ovs-dpdk>`__
-networking-plumgrid                    `https://git.openstack.org/openstack/networking-plumgrid <https://git.openstack.org/cgit/openstack/networking-plumgrid>`__
-networking-powervm                     `https://git.openstack.org/openstack/networking-powervm <https://git.openstack.org/cgit/openstack/networking-powervm>`__
-networking-sfc                         `https://git.openstack.org/openstack/networking-sfc <https://git.openstack.org/cgit/openstack/networking-sfc>`__
-networking-spp                         `https://git.openstack.org/openstack/networking-spp <https://git.openstack.org/cgit/openstack/networking-spp>`__
-networking-vpp                         `https://git.openstack.org/openstack/networking-vpp <https://git.openstack.org/cgit/openstack/networking-vpp>`__
-networking-vsphere                     `https://git.openstack.org/openstack/networking-vsphere <https://git.openstack.org/cgit/openstack/networking-vsphere>`__
-neutron                                `https://git.openstack.org/openstack/neutron <https://git.openstack.org/cgit/openstack/neutron>`__
-neutron-classifier                     `https://git.openstack.org/openstack/neutron-classifier <https://git.openstack.org/cgit/openstack/neutron-classifier>`__
-neutron-dynamic-routing                `https://git.openstack.org/openstack/neutron-dynamic-routing <https://git.openstack.org/cgit/openstack/neutron-dynamic-routing>`__
-neutron-fwaas                          `https://git.openstack.org/openstack/neutron-fwaas <https://git.openstack.org/cgit/openstack/neutron-fwaas>`__
-neutron-fwaas-dashboard                `https://git.openstack.org/openstack/neutron-fwaas-dashboard <https://git.openstack.org/cgit/openstack/neutron-fwaas-dashboard>`__
-neutron-lbaas                          `https://git.openstack.org/openstack/neutron-lbaas <https://git.openstack.org/cgit/openstack/neutron-lbaas>`__
-neutron-lbaas-dashboard                `https://git.openstack.org/openstack/neutron-lbaas-dashboard <https://git.openstack.org/cgit/openstack/neutron-lbaas-dashboard>`__
-neutron-tempest-plugin                 `https://git.openstack.org/openstack/neutron-tempest-plugin <https://git.openstack.org/cgit/openstack/neutron-tempest-plugin>`__
-neutron-vpnaas                         `https://git.openstack.org/openstack/neutron-vpnaas <https://git.openstack.org/cgit/openstack/neutron-vpnaas>`__
-neutron-vpnaas-dashboard               `https://git.openstack.org/openstack/neutron-vpnaas-dashboard <https://git.openstack.org/cgit/openstack/neutron-vpnaas-dashboard>`__
-nova-dpm                               `https://git.openstack.org/openstack/nova-dpm <https://git.openstack.org/cgit/openstack/nova-dpm>`__
-nova-lxd                               `https://git.openstack.org/openstack/nova-lxd <https://git.openstack.org/cgit/openstack/nova-lxd>`__
-nova-mksproxy                          `https://git.openstack.org/openstack/nova-mksproxy <https://git.openstack.org/cgit/openstack/nova-mksproxy>`__
-nova-powervm                           `https://git.openstack.org/openstack/nova-powervm <https://git.openstack.org/cgit/openstack/nova-powervm>`__
-oaktree                                `https://git.openstack.org/openstack/oaktree <https://git.openstack.org/cgit/openstack/oaktree>`__
-octavia                                `https://git.openstack.org/openstack/octavia <https://git.openstack.org/cgit/openstack/octavia>`__
-octavia-dashboard                      `https://git.openstack.org/openstack/octavia-dashboard <https://git.openstack.org/cgit/openstack/octavia-dashboard>`__
-omni                                   `https://git.openstack.org/openstack/omni <https://git.openstack.org/cgit/openstack/omni>`__
-openstacksdk                           `https://git.openstack.org/openstack/openstacksdk <https://git.openstack.org/cgit/openstack/openstacksdk>`__
-os-faults                              `https://git.openstack.org/openstack/os-faults <https://git.openstack.org/cgit/openstack/os-faults>`__
-os-xenapi                              `https://git.openstack.org/openstack/os-xenapi <https://git.openstack.org/cgit/openstack/os-xenapi>`__
-osprofiler                             `https://git.openstack.org/openstack/osprofiler <https://git.openstack.org/cgit/openstack/osprofiler>`__
-oswin-tempest-plugin                   `https://git.openstack.org/openstack/oswin-tempest-plugin <https://git.openstack.org/cgit/openstack/oswin-tempest-plugin>`__
-panko                                  `https://git.openstack.org/openstack/panko <https://git.openstack.org/cgit/openstack/panko>`__
-patrole                                `https://git.openstack.org/openstack/patrole <https://git.openstack.org/cgit/openstack/patrole>`__
-picasso                                `https://git.openstack.org/openstack/picasso <https://git.openstack.org/cgit/openstack/picasso>`__
-qinling                                `https://git.openstack.org/openstack/qinling <https://git.openstack.org/cgit/openstack/qinling>`__
-qinling-dashboard                      `https://git.openstack.org/openstack/qinling-dashboard <https://git.openstack.org/cgit/openstack/qinling-dashboard>`__
-rally                                  `https://git.openstack.org/openstack/rally <https://git.openstack.org/cgit/openstack/rally>`__
-rally-openstack                        `https://git.openstack.org/openstack/rally-openstack <https://git.openstack.org/cgit/openstack/rally-openstack>`__
-rsd-virt-for-nova                      `https://git.openstack.org/openstack/rsd-virt-for-nova <https://git.openstack.org/cgit/openstack/rsd-virt-for-nova>`__
-sahara                                 `https://git.openstack.org/openstack/sahara <https://git.openstack.org/cgit/openstack/sahara>`__
-sahara-dashboard                       `https://git.openstack.org/openstack/sahara-dashboard <https://git.openstack.org/cgit/openstack/sahara-dashboard>`__
-scalpels                               `https://git.openstack.org/openstack/scalpels <https://git.openstack.org/cgit/openstack/scalpels>`__
-searchlight                            `https://git.openstack.org/openstack/searchlight <https://git.openstack.org/cgit/openstack/searchlight>`__
-searchlight-ui                         `https://git.openstack.org/openstack/searchlight-ui <https://git.openstack.org/cgit/openstack/searchlight-ui>`__
-senlin                                 `https://git.openstack.org/openstack/senlin <https://git.openstack.org/cgit/openstack/senlin>`__
-slogging                               `https://git.openstack.org/openstack/slogging <https://git.openstack.org/cgit/openstack/slogging>`__
-solum                                  `https://git.openstack.org/openstack/solum <https://git.openstack.org/cgit/openstack/solum>`__
-stackube                               `https://git.openstack.org/openstack/stackube <https://git.openstack.org/cgit/openstack/stackube>`__
-storlets                               `https://git.openstack.org/openstack/storlets <https://git.openstack.org/cgit/openstack/storlets>`__
-stx-config                             `https://git.openstack.org/openstack/stx-config <https://git.openstack.org/cgit/openstack/stx-config>`__
-stx-fault                              `https://git.openstack.org/openstack/stx-fault <https://git.openstack.org/cgit/openstack/stx-fault>`__
-stx-ha                                 `https://git.openstack.org/openstack/stx-ha <https://git.openstack.org/cgit/openstack/stx-ha>`__
-stx-integ                              `https://git.openstack.org/openstack/stx-integ <https://git.openstack.org/cgit/openstack/stx-integ>`__
-stx-metal                              `https://git.openstack.org/openstack/stx-metal <https://git.openstack.org/cgit/openstack/stx-metal>`__
-stx-nfv                                `https://git.openstack.org/openstack/stx-nfv <https://git.openstack.org/cgit/openstack/stx-nfv>`__
-stx-update                             `https://git.openstack.org/openstack/stx-update <https://git.openstack.org/cgit/openstack/stx-update>`__
-tacker                                 `https://git.openstack.org/openstack/tacker <https://git.openstack.org/cgit/openstack/tacker>`__
-tap-as-a-service                       `https://git.openstack.org/openstack/tap-as-a-service <https://git.openstack.org/cgit/openstack/tap-as-a-service>`__
-tap-as-a-service-dashboard             `https://git.openstack.org/openstack/tap-as-a-service-dashboard <https://git.openstack.org/cgit/openstack/tap-as-a-service-dashboard>`__
-tatu                                   `https://git.openstack.org/openstack/tatu <https://git.openstack.org/cgit/openstack/tatu>`__
-telemetry-tempest-plugin               `https://git.openstack.org/openstack/telemetry-tempest-plugin <https://git.openstack.org/cgit/openstack/telemetry-tempest-plugin>`__
-tobiko                                 `https://git.openstack.org/openstack/tobiko <https://git.openstack.org/cgit/openstack/tobiko>`__
-tricircle                              `https://git.openstack.org/openstack/tricircle <https://git.openstack.org/cgit/openstack/tricircle>`__
-trio2o                                 `https://git.openstack.org/openstack/trio2o <https://git.openstack.org/cgit/openstack/trio2o>`__
-trove                                  `https://git.openstack.org/openstack/trove <https://git.openstack.org/cgit/openstack/trove>`__
-trove-dashboard                        `https://git.openstack.org/openstack/trove-dashboard <https://git.openstack.org/cgit/openstack/trove-dashboard>`__
-valet                                  `https://git.openstack.org/openstack/valet <https://git.openstack.org/cgit/openstack/valet>`__
-vitrage                                `https://git.openstack.org/openstack/vitrage <https://git.openstack.org/cgit/openstack/vitrage>`__
-vitrage-dashboard                      `https://git.openstack.org/openstack/vitrage-dashboard <https://git.openstack.org/cgit/openstack/vitrage-dashboard>`__
-vitrage-tempest-plugin                 `https://git.openstack.org/openstack/vitrage-tempest-plugin <https://git.openstack.org/cgit/openstack/vitrage-tempest-plugin>`__
-vmware-nsx                             `https://git.openstack.org/openstack/vmware-nsx <https://git.openstack.org/cgit/openstack/vmware-nsx>`__
-vmware-vspc                            `https://git.openstack.org/openstack/vmware-vspc <https://git.openstack.org/cgit/openstack/vmware-vspc>`__
-watcher                                `https://git.openstack.org/openstack/watcher <https://git.openstack.org/cgit/openstack/watcher>`__
-watcher-dashboard                      `https://git.openstack.org/openstack/watcher-dashboard <https://git.openstack.org/cgit/openstack/watcher-dashboard>`__
-zaqar                                  `https://git.openstack.org/openstack/zaqar <https://git.openstack.org/cgit/openstack/zaqar>`__
-zaqar-ui                               `https://git.openstack.org/openstack/zaqar-ui <https://git.openstack.org/cgit/openstack/zaqar-ui>`__
-zun                                    `https://git.openstack.org/openstack/zun <https://git.openstack.org/cgit/openstack/zun>`__
-zun-ui                                 `https://git.openstack.org/openstack/zun-ui <https://git.openstack.org/cgit/openstack/zun-ui>`__
-====================================== ===
+======================================== ===
+Plugin Name                              URL
+======================================== ===
+openstack/aodh                           `https://opendev.org/openstack/aodh <https://opendev.org/openstack/aodh>`__
+openstack/barbican                       `https://opendev.org/openstack/barbican <https://opendev.org/openstack/barbican>`__
+openstack/blazar                         `https://opendev.org/openstack/blazar <https://opendev.org/openstack/blazar>`__
+openstack/ceilometer                     `https://opendev.org/openstack/ceilometer <https://opendev.org/openstack/ceilometer>`__
+openstack/ceilometer-powervm             `https://opendev.org/openstack/ceilometer-powervm <https://opendev.org/openstack/ceilometer-powervm>`__
+openstack/cinderlib                      `https://opendev.org/openstack/cinderlib <https://opendev.org/openstack/cinderlib>`__
+openstack/cloudkitty                     `https://opendev.org/openstack/cloudkitty <https://opendev.org/openstack/cloudkitty>`__
+openstack/congress                       `https://opendev.org/openstack/congress <https://opendev.org/openstack/congress>`__
+openstack/cyborg                         `https://opendev.org/openstack/cyborg <https://opendev.org/openstack/cyborg>`__
+openstack/designate                      `https://opendev.org/openstack/designate <https://opendev.org/openstack/designate>`__
+openstack/devstack-plugin-amqp1          `https://opendev.org/openstack/devstack-plugin-amqp1 <https://opendev.org/openstack/devstack-plugin-amqp1>`__
+openstack/devstack-plugin-ceph           `https://opendev.org/openstack/devstack-plugin-ceph <https://opendev.org/openstack/devstack-plugin-ceph>`__
+openstack/devstack-plugin-container      `https://opendev.org/openstack/devstack-plugin-container <https://opendev.org/openstack/devstack-plugin-container>`__
+openstack/devstack-plugin-kafka          `https://opendev.org/openstack/devstack-plugin-kafka <https://opendev.org/openstack/devstack-plugin-kafka>`__
+openstack/devstack-plugin-pika           `https://opendev.org/openstack/devstack-plugin-pika <https://opendev.org/openstack/devstack-plugin-pika>`__
+openstack/devstack-plugin-zmq            `https://opendev.org/openstack/devstack-plugin-zmq <https://opendev.org/openstack/devstack-plugin-zmq>`__
+openstack/dragonflow                     `https://opendev.org/openstack/dragonflow <https://opendev.org/openstack/dragonflow>`__
+openstack/ec2-api                        `https://opendev.org/openstack/ec2-api <https://opendev.org/openstack/ec2-api>`__
+openstack/freezer                        `https://opendev.org/openstack/freezer <https://opendev.org/openstack/freezer>`__
+openstack/freezer-api                    `https://opendev.org/openstack/freezer-api <https://opendev.org/openstack/freezer-api>`__
+openstack/freezer-tempest-plugin         `https://opendev.org/openstack/freezer-tempest-plugin <https://opendev.org/openstack/freezer-tempest-plugin>`__
+openstack/freezer-web-ui                 `https://opendev.org/openstack/freezer-web-ui <https://opendev.org/openstack/freezer-web-ui>`__
+openstack/heat                           `https://opendev.org/openstack/heat <https://opendev.org/openstack/heat>`__
+openstack/heat-dashboard                 `https://opendev.org/openstack/heat-dashboard <https://opendev.org/openstack/heat-dashboard>`__
+openstack/ironic                         `https://opendev.org/openstack/ironic <https://opendev.org/openstack/ironic>`__
+openstack/ironic-inspector               `https://opendev.org/openstack/ironic-inspector <https://opendev.org/openstack/ironic-inspector>`__
+openstack/ironic-ui                      `https://opendev.org/openstack/ironic-ui <https://opendev.org/openstack/ironic-ui>`__
+openstack/karbor                         `https://opendev.org/openstack/karbor <https://opendev.org/openstack/karbor>`__
+openstack/karbor-dashboard               `https://opendev.org/openstack/karbor-dashboard <https://opendev.org/openstack/karbor-dashboard>`__
+openstack/keystone                       `https://opendev.org/openstack/keystone <https://opendev.org/openstack/keystone>`__
+openstack/kuryr-kubernetes               `https://opendev.org/openstack/kuryr-kubernetes <https://opendev.org/openstack/kuryr-kubernetes>`__
+openstack/kuryr-libnetwork               `https://opendev.org/openstack/kuryr-libnetwork <https://opendev.org/openstack/kuryr-libnetwork>`__
+openstack/kuryr-tempest-plugin           `https://opendev.org/openstack/kuryr-tempest-plugin <https://opendev.org/openstack/kuryr-tempest-plugin>`__
+openstack/magnum                         `https://opendev.org/openstack/magnum <https://opendev.org/openstack/magnum>`__
+openstack/magnum-ui                      `https://opendev.org/openstack/magnum-ui <https://opendev.org/openstack/magnum-ui>`__
+openstack/manila                         `https://opendev.org/openstack/manila <https://opendev.org/openstack/manila>`__
+openstack/manila-tempest-plugin          `https://opendev.org/openstack/manila-tempest-plugin <https://opendev.org/openstack/manila-tempest-plugin>`__
+openstack/manila-ui                      `https://opendev.org/openstack/manila-ui <https://opendev.org/openstack/manila-ui>`__
+openstack/masakari                       `https://opendev.org/openstack/masakari <https://opendev.org/openstack/masakari>`__
+openstack/mistral                        `https://opendev.org/openstack/mistral <https://opendev.org/openstack/mistral>`__
+openstack/monasca-analytics              `https://opendev.org/openstack/monasca-analytics <https://opendev.org/openstack/monasca-analytics>`__
+openstack/monasca-api                    `https://opendev.org/openstack/monasca-api <https://opendev.org/openstack/monasca-api>`__
+openstack/monasca-ceilometer             `https://opendev.org/openstack/monasca-ceilometer <https://opendev.org/openstack/monasca-ceilometer>`__
+openstack/monasca-events-api             `https://opendev.org/openstack/monasca-events-api <https://opendev.org/openstack/monasca-events-api>`__
+openstack/monasca-log-api                `https://opendev.org/openstack/monasca-log-api <https://opendev.org/openstack/monasca-log-api>`__
+openstack/monasca-tempest-plugin         `https://opendev.org/openstack/monasca-tempest-plugin <https://opendev.org/openstack/monasca-tempest-plugin>`__
+openstack/monasca-transform              `https://opendev.org/openstack/monasca-transform <https://opendev.org/openstack/monasca-transform>`__
+openstack/murano                         `https://opendev.org/openstack/murano <https://opendev.org/openstack/murano>`__
+openstack/networking-bagpipe             `https://opendev.org/openstack/networking-bagpipe <https://opendev.org/openstack/networking-bagpipe>`__
+openstack/networking-baremetal           `https://opendev.org/openstack/networking-baremetal <https://opendev.org/openstack/networking-baremetal>`__
+openstack/networking-bgpvpn              `https://opendev.org/openstack/networking-bgpvpn <https://opendev.org/openstack/networking-bgpvpn>`__
+openstack/networking-calico              `https://opendev.org/openstack/networking-calico <https://opendev.org/openstack/networking-calico>`__
+openstack/networking-generic-switch      `https://opendev.org/openstack/networking-generic-switch <https://opendev.org/openstack/networking-generic-switch>`__
+openstack/networking-hyperv              `https://opendev.org/openstack/networking-hyperv <https://opendev.org/openstack/networking-hyperv>`__
+openstack/networking-l2gw                `https://opendev.org/openstack/networking-l2gw <https://opendev.org/openstack/networking-l2gw>`__
+openstack/networking-midonet             `https://opendev.org/openstack/networking-midonet <https://opendev.org/openstack/networking-midonet>`__
+openstack/networking-odl                 `https://opendev.org/openstack/networking-odl <https://opendev.org/openstack/networking-odl>`__
+openstack/networking-onos                `https://opendev.org/openstack/networking-onos <https://opendev.org/openstack/networking-onos>`__
+openstack/networking-ovn                 `https://opendev.org/openstack/networking-ovn <https://opendev.org/openstack/networking-ovn>`__
+openstack/networking-powervm             `https://opendev.org/openstack/networking-powervm <https://opendev.org/openstack/networking-powervm>`__
+openstack/networking-sfc                 `https://opendev.org/openstack/networking-sfc <https://opendev.org/openstack/networking-sfc>`__
+openstack/neutron                        `https://opendev.org/openstack/neutron <https://opendev.org/openstack/neutron>`__
+openstack/neutron-dynamic-routing        `https://opendev.org/openstack/neutron-dynamic-routing <https://opendev.org/openstack/neutron-dynamic-routing>`__
+openstack/neutron-fwaas                  `https://opendev.org/openstack/neutron-fwaas <https://opendev.org/openstack/neutron-fwaas>`__
+openstack/neutron-fwaas-dashboard        `https://opendev.org/openstack/neutron-fwaas-dashboard <https://opendev.org/openstack/neutron-fwaas-dashboard>`__
+openstack/neutron-tempest-plugin         `https://opendev.org/openstack/neutron-tempest-plugin <https://opendev.org/openstack/neutron-tempest-plugin>`__
+openstack/neutron-vpnaas                 `https://opendev.org/openstack/neutron-vpnaas <https://opendev.org/openstack/neutron-vpnaas>`__
+openstack/neutron-vpnaas-dashboard       `https://opendev.org/openstack/neutron-vpnaas-dashboard <https://opendev.org/openstack/neutron-vpnaas-dashboard>`__
+openstack/nova-powervm                   `https://opendev.org/openstack/nova-powervm <https://opendev.org/openstack/nova-powervm>`__
+openstack/octavia                        `https://opendev.org/openstack/octavia <https://opendev.org/openstack/octavia>`__
+openstack/octavia-dashboard              `https://opendev.org/openstack/octavia-dashboard <https://opendev.org/openstack/octavia-dashboard>`__
+openstack/openstacksdk                   `https://opendev.org/openstack/openstacksdk <https://opendev.org/openstack/openstacksdk>`__
+openstack/os-loganalyze                  `https://opendev.org/openstack/os-loganalyze <https://opendev.org/openstack/os-loganalyze>`__
+openstack/osprofiler                     `https://opendev.org/openstack/osprofiler <https://opendev.org/openstack/osprofiler>`__
+openstack/oswin-tempest-plugin           `https://opendev.org/openstack/oswin-tempest-plugin <https://opendev.org/openstack/oswin-tempest-plugin>`__
+openstack/panko                          `https://opendev.org/openstack/panko <https://opendev.org/openstack/panko>`__
+openstack/patrole                        `https://opendev.org/openstack/patrole <https://opendev.org/openstack/patrole>`__
+openstack/qinling                        `https://opendev.org/openstack/qinling <https://opendev.org/openstack/qinling>`__
+openstack/qinling-dashboard              `https://opendev.org/openstack/qinling-dashboard <https://opendev.org/openstack/qinling-dashboard>`__
+openstack/rally                          `https://opendev.org/openstack/rally <https://opendev.org/openstack/rally>`__
+openstack/rally-openstack                `https://opendev.org/openstack/rally-openstack <https://opendev.org/openstack/rally-openstack>`__
+openstack/sahara                         `https://opendev.org/openstack/sahara <https://opendev.org/openstack/sahara>`__
+openstack/sahara-dashboard               `https://opendev.org/openstack/sahara-dashboard <https://opendev.org/openstack/sahara-dashboard>`__
+openstack/searchlight                    `https://opendev.org/openstack/searchlight <https://opendev.org/openstack/searchlight>`__
+openstack/searchlight-ui                 `https://opendev.org/openstack/searchlight-ui <https://opendev.org/openstack/searchlight-ui>`__
+openstack/senlin                         `https://opendev.org/openstack/senlin <https://opendev.org/openstack/senlin>`__
+openstack/shade                          `https://opendev.org/openstack/shade <https://opendev.org/openstack/shade>`__
+openstack/solum                          `https://opendev.org/openstack/solum <https://opendev.org/openstack/solum>`__
+openstack/storlets                       `https://opendev.org/openstack/storlets <https://opendev.org/openstack/storlets>`__
+openstack/tacker                         `https://opendev.org/openstack/tacker <https://opendev.org/openstack/tacker>`__
+openstack/telemetry-tempest-plugin       `https://opendev.org/openstack/telemetry-tempest-plugin <https://opendev.org/openstack/telemetry-tempest-plugin>`__
+openstack/tricircle                      `https://opendev.org/openstack/tricircle <https://opendev.org/openstack/tricircle>`__
+openstack/trove                          `https://opendev.org/openstack/trove <https://opendev.org/openstack/trove>`__
+openstack/trove-dashboard                `https://opendev.org/openstack/trove-dashboard <https://opendev.org/openstack/trove-dashboard>`__
+openstack/vitrage                        `https://opendev.org/openstack/vitrage <https://opendev.org/openstack/vitrage>`__
+openstack/vitrage-dashboard              `https://opendev.org/openstack/vitrage-dashboard <https://opendev.org/openstack/vitrage-dashboard>`__
+openstack/vitrage-tempest-plugin         `https://opendev.org/openstack/vitrage-tempest-plugin <https://opendev.org/openstack/vitrage-tempest-plugin>`__
+openstack/watcher                        `https://opendev.org/openstack/watcher <https://opendev.org/openstack/watcher>`__
+openstack/watcher-dashboard              `https://opendev.org/openstack/watcher-dashboard <https://opendev.org/openstack/watcher-dashboard>`__
+openstack/zaqar                          `https://opendev.org/openstack/zaqar <https://opendev.org/openstack/zaqar>`__
+openstack/zaqar-ui                       `https://opendev.org/openstack/zaqar-ui <https://opendev.org/openstack/zaqar-ui>`__
+openstack/zun                            `https://opendev.org/openstack/zun <https://opendev.org/openstack/zun>`__
+openstack/zun-ui                         `https://opendev.org/openstack/zun-ui <https://opendev.org/openstack/zun-ui>`__
+performa/os-faults                       `https://opendev.org/performa/os-faults <https://opendev.org/performa/os-faults>`__
+starlingx/config                         `https://opendev.org/starlingx/config <https://opendev.org/starlingx/config>`__
+starlingx/fault                          `https://opendev.org/starlingx/fault <https://opendev.org/starlingx/fault>`__
+starlingx/ha                             `https://opendev.org/starlingx/ha <https://opendev.org/starlingx/ha>`__
+starlingx/integ                          `https://opendev.org/starlingx/integ <https://opendev.org/starlingx/integ>`__
+starlingx/metal                          `https://opendev.org/starlingx/metal <https://opendev.org/starlingx/metal>`__
+starlingx/nfv                            `https://opendev.org/starlingx/nfv <https://opendev.org/starlingx/nfv>`__
+starlingx/update                         `https://opendev.org/starlingx/update <https://opendev.org/starlingx/update>`__
+x/almanach                               `https://opendev.org/x/almanach <https://opendev.org/x/almanach>`__
+x/apmec                                  `https://opendev.org/x/apmec <https://opendev.org/x/apmec>`__
+x/bilean                                 `https://opendev.org/x/bilean <https://opendev.org/x/bilean>`__
+x/broadview-collector                    `https://opendev.org/x/broadview-collector <https://opendev.org/x/broadview-collector>`__
+x/collectd-openstack-plugins             `https://opendev.org/x/collectd-openstack-plugins <https://opendev.org/x/collectd-openstack-plugins>`__
+x/devstack-plugin-additional-pkg-repos   `https://opendev.org/x/devstack-plugin-additional-pkg-repos <https://opendev.org/x/devstack-plugin-additional-pkg-repos>`__
+x/devstack-plugin-bdd                    `https://opendev.org/x/devstack-plugin-bdd <https://opendev.org/x/devstack-plugin-bdd>`__
+x/devstack-plugin-glusterfs              `https://opendev.org/x/devstack-plugin-glusterfs <https://opendev.org/x/devstack-plugin-glusterfs>`__
+x/devstack-plugin-hdfs                   `https://opendev.org/x/devstack-plugin-hdfs <https://opendev.org/x/devstack-plugin-hdfs>`__
+x/devstack-plugin-libvirt-qemu           `https://opendev.org/x/devstack-plugin-libvirt-qemu <https://opendev.org/x/devstack-plugin-libvirt-qemu>`__
+x/devstack-plugin-mariadb                `https://opendev.org/x/devstack-plugin-mariadb <https://opendev.org/x/devstack-plugin-mariadb>`__
+x/devstack-plugin-nfs                    `https://opendev.org/x/devstack-plugin-nfs <https://opendev.org/x/devstack-plugin-nfs>`__
+x/devstack-plugin-sheepdog               `https://opendev.org/x/devstack-plugin-sheepdog <https://opendev.org/x/devstack-plugin-sheepdog>`__
+x/devstack-plugin-vmax                   `https://opendev.org/x/devstack-plugin-vmax <https://opendev.org/x/devstack-plugin-vmax>`__
+x/drbd-devstack                          `https://opendev.org/x/drbd-devstack <https://opendev.org/x/drbd-devstack>`__
+x/fenix                                  `https://opendev.org/x/fenix <https://opendev.org/x/fenix>`__
+x/gce-api                                `https://opendev.org/x/gce-api <https://opendev.org/x/gce-api>`__
+x/glare                                  `https://opendev.org/x/glare <https://opendev.org/x/glare>`__
+x/group-based-policy                     `https://opendev.org/x/group-based-policy <https://opendev.org/x/group-based-policy>`__
+x/gyan                                   `https://opendev.org/x/gyan <https://opendev.org/x/gyan>`__
+x/horizon-mellanox                       `https://opendev.org/x/horizon-mellanox <https://opendev.org/x/horizon-mellanox>`__
+x/ironic-staging-drivers                 `https://opendev.org/x/ironic-staging-drivers <https://opendev.org/x/ironic-staging-drivers>`__
+x/kingbird                               `https://opendev.org/x/kingbird <https://opendev.org/x/kingbird>`__
+x/meteos                                 `https://opendev.org/x/meteos <https://opendev.org/x/meteos>`__
+x/meteos-ui                              `https://opendev.org/x/meteos-ui <https://opendev.org/x/meteos-ui>`__
+x/mixmatch                               `https://opendev.org/x/mixmatch <https://opendev.org/x/mixmatch>`__
+x/mogan                                  `https://opendev.org/x/mogan <https://opendev.org/x/mogan>`__
+x/mogan-ui                               `https://opendev.org/x/mogan-ui <https://opendev.org/x/mogan-ui>`__
+x/networking-6wind                       `https://opendev.org/x/networking-6wind <https://opendev.org/x/networking-6wind>`__
+x/networking-ansible                     `https://opendev.org/x/networking-ansible <https://opendev.org/x/networking-ansible>`__
+x/networking-arista                      `https://opendev.org/x/networking-arista <https://opendev.org/x/networking-arista>`__
+x/networking-brocade                     `https://opendev.org/x/networking-brocade <https://opendev.org/x/networking-brocade>`__
+x/networking-cisco                       `https://opendev.org/x/networking-cisco <https://opendev.org/x/networking-cisco>`__
+x/networking-cumulus                     `https://opendev.org/x/networking-cumulus <https://opendev.org/x/networking-cumulus>`__
+x/networking-dpm                         `https://opendev.org/x/networking-dpm <https://opendev.org/x/networking-dpm>`__
+x/networking-fortinet                    `https://opendev.org/x/networking-fortinet <https://opendev.org/x/networking-fortinet>`__
+x/networking-hpe                         `https://opendev.org/x/networking-hpe <https://opendev.org/x/networking-hpe>`__
+x/networking-huawei                      `https://opendev.org/x/networking-huawei <https://opendev.org/x/networking-huawei>`__
+x/networking-infoblox                    `https://opendev.org/x/networking-infoblox <https://opendev.org/x/networking-infoblox>`__
+x/networking-lagopus                     `https://opendev.org/x/networking-lagopus <https://opendev.org/x/networking-lagopus>`__
+x/networking-mlnx                        `https://opendev.org/x/networking-mlnx <https://opendev.org/x/networking-mlnx>`__
+x/networking-nec                         `https://opendev.org/x/networking-nec <https://opendev.org/x/networking-nec>`__
+x/networking-omnipath                    `https://opendev.org/x/networking-omnipath <https://opendev.org/x/networking-omnipath>`__
+x/networking-opencontrail                `https://opendev.org/x/networking-opencontrail <https://opendev.org/x/networking-opencontrail>`__
+x/networking-ovs-dpdk                    `https://opendev.org/x/networking-ovs-dpdk <https://opendev.org/x/networking-ovs-dpdk>`__
+x/networking-plumgrid                    `https://opendev.org/x/networking-plumgrid <https://opendev.org/x/networking-plumgrid>`__
+x/networking-spp                         `https://opendev.org/x/networking-spp <https://opendev.org/x/networking-spp>`__
+x/networking-vpp                         `https://opendev.org/x/networking-vpp <https://opendev.org/x/networking-vpp>`__
+x/networking-vsphere                     `https://opendev.org/x/networking-vsphere <https://opendev.org/x/networking-vsphere>`__
+x/neutron-classifier                     `https://opendev.org/x/neutron-classifier <https://opendev.org/x/neutron-classifier>`__
+x/nova-dpm                               `https://opendev.org/x/nova-dpm <https://opendev.org/x/nova-dpm>`__
+x/nova-lxd                               `https://opendev.org/x/nova-lxd <https://opendev.org/x/nova-lxd>`__
+x/nova-mksproxy                          `https://opendev.org/x/nova-mksproxy <https://opendev.org/x/nova-mksproxy>`__
+x/oaktree                                `https://opendev.org/x/oaktree <https://opendev.org/x/oaktree>`__
+x/omni                                   `https://opendev.org/x/omni <https://opendev.org/x/omni>`__
+x/os-xenapi                              `https://opendev.org/x/os-xenapi <https://opendev.org/x/os-xenapi>`__
+x/picasso                                `https://opendev.org/x/picasso <https://opendev.org/x/picasso>`__
+x/rsd-virt-for-nova                      `https://opendev.org/x/rsd-virt-for-nova <https://opendev.org/x/rsd-virt-for-nova>`__
+x/scalpels                               `https://opendev.org/x/scalpels <https://opendev.org/x/scalpels>`__
+x/slogging                               `https://opendev.org/x/slogging <https://opendev.org/x/slogging>`__
+x/stackube                               `https://opendev.org/x/stackube <https://opendev.org/x/stackube>`__
+x/tap-as-a-service                       `https://opendev.org/x/tap-as-a-service <https://opendev.org/x/tap-as-a-service>`__
+x/tap-as-a-service-dashboard             `https://opendev.org/x/tap-as-a-service-dashboard <https://opendev.org/x/tap-as-a-service-dashboard>`__
+x/tatu                                   `https://opendev.org/x/tatu <https://opendev.org/x/tatu>`__
+x/tobiko                                 `https://opendev.org/x/tobiko <https://opendev.org/x/tobiko>`__
+x/trio2o                                 `https://opendev.org/x/trio2o <https://opendev.org/x/trio2o>`__
+x/valet                                  `https://opendev.org/x/valet <https://opendev.org/x/valet>`__
+x/vmware-nsx                             `https://opendev.org/x/vmware-nsx <https://opendev.org/x/vmware-nsx>`__
+x/vmware-vspc                            `https://opendev.org/x/vmware-vspc <https://opendev.org/x/vmware-vspc>`__
+zuul/nodepool                            `https://opendev.org/zuul/nodepool <https://opendev.org/zuul/nodepool>`__
+======================================== ===
 
 
diff --git a/tools/generate-devstack-plugins-list.py b/tools/generate-devstack-plugins-list.py
index 56f12e7ab6..580560ccab 100644
--- a/tools/generate-devstack-plugins-list.py
+++ b/tools/generate-devstack-plugins-list.py
@@ -23,13 +23,14 @@
 #     working directory
 #   * network access to https://git.openstack.org/cgit
 
+import functools
 import logging
 import json
 import requests
 
 logging.basicConfig(level=logging.DEBUG)
 
-url = 'https://review.openstack.org/projects/'
+url = 'https://review.opendev.org/projects/'
 
 # This is what a project looks like
 '''
@@ -39,26 +40,30 @@
   },
 '''
 
-def is_in_openstack_namespace(proj):
-    # only interested in openstack namespace (e.g. not retired
+def is_in_wanted_namespace(proj):
+    # only interested in openstack or x namespace (e.g. not retired
     # stackforge, etc)
-    return proj.startswith('openstack/')
+    if proj.startswith('stackforge/') or \
+       proj.startswith('stackforge-attic/'):
+        return False
+    else:
+        return True
 
 # Check if this project has a plugin file
-def has_devstack_plugin(proj):
+def has_devstack_plugin(session, proj):
     # Don't link in the deb packaging repos
     if "openstack/deb-" in proj:
         return False
-    r = requests.get("https://git.openstack.org/cgit/%s/plain/devstack/plugin.sh" % proj)
+    r = session.get("https://opendev.org/%s/raw/branch/master/devstack/plugin.sh" % proj)
     return r.status_code == 200
 
 logging.debug("Getting project list from %s" % url)
 r = requests.get(url)
-projects = sorted(filter(is_in_openstack_namespace, json.loads(r.text[4:])))
+projects = sorted(filter(is_in_wanted_namespace, json.loads(r.text[4:])))
 logging.debug("Found %d projects" % len(projects))
 
-found_plugins = filter(has_devstack_plugin, projects)
+s = requests.Session()
+found_plugins = filter(functools.partial(has_devstack_plugin, s), projects)
 
 for project in found_plugins:
-    # strip of openstack/
-    print(project[10:])
+    print(project)
diff --git a/tools/generate-devstack-plugins-list.sh b/tools/generate-devstack-plugins-list.sh
index 27c9c4118e..a3aa7ba63d 100755
--- a/tools/generate-devstack-plugins-list.sh
+++ b/tools/generate-devstack-plugins-list.sh
@@ -28,9 +28,9 @@
 #   * the environment variable git_dir pointing to the location
 #   * of said git repositories
 #   ) OR (
-#   * network access to the review.openstack.org Gerrit API
+#   * network access to the review.opendev.org Gerrit API
 #     working directory
-#   * network access to https://git.openstack.org/cgit
+#   * network access to https://opendev.org
 #   ))
 #
 # If a file named data/devstack-plugins-registry.header or
@@ -50,8 +50,6 @@ function title_underline {
 }
 
 (
-declare -A plugins
-
 if [[ -r data/devstack-plugins-registry.header ]]; then
     cat data/devstack-plugins-registry.header
 fi
@@ -74,8 +72,8 @@ printf "%-${name_col_len}s %s\n" "Plugin Name" "URL"
 title_underline ${name_col_len}
 
 for plugin in ${sorted_plugins}; do
-    giturl="https://git.openstack.org/openstack/${plugin}"
-    gitlink="https://git.openstack.org/cgit/openstack/${plugin}"
+    giturl="https://opendev.org/${plugin}"
+    gitlink="https://opendev.org/${plugin}"
     printf "%-${name_col_len}s %s\n" "${plugin}" "\`${giturl} <${gitlink}>\`__"
 done
 

From 371a25328525ac16677ad721f725e81628f9d941 Mon Sep 17 00:00:00 2001
From: Mark McClain <mark@mcclain.xyz>
Date: Tue, 7 May 2019 12:12:29 -0400
Subject: [PATCH 1556/2409] Change the GIT_BASE default to https://opendev.org

Change-Id: Ifcfce490edb3d77e4e436e002d35bc909e1a057c
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 3432fb6228..4fc31a3d39 100644
--- a/stackrc
+++ b/stackrc
@@ -237,7 +237,7 @@ WSGI_MODE=${WSGI_MODE:-"uwsgi"}
 # ------------
 
 # Base GIT Repo URL
-GIT_BASE=${GIT_BASE:-https://git.openstack.org}
+GIT_BASE=${GIT_BASE:-https://opendev.org}
 
 # The location of REQUIREMENTS once cloned
 REQUIREMENTS_DIR=$DEST/requirements

From 9b6d2f20b47523ddc51349943dd76bb76d1c58d8 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Tue, 18 Jun 2019 10:43:16 -0400
Subject: [PATCH 1557/2409] Update (git|review).openstack.org links to opendev

This updates links going to git.openstack.org and review.openstack.org
to go to their respective opendev locations to avoid redirects.

Change-Id: I78e3bb5303718962f591117f9c0ee11f2314b128
Closes-Bug: #1833256
---
 HACKING.rst                                  |  4 ++--
 README.rst                                   |  2 +-
 doc/source/configuration.rst                 |  6 +++---
 doc/source/faq.rst                           |  3 +--
 doc/source/guides/devstack-with-lbaas-v2.rst |  6 +++---
 doc/source/guides/lxc.rst                    |  2 +-
 doc/source/guides/multinode-lab.rst          |  2 +-
 doc/source/guides/neutron.rst                |  4 ++--
 doc/source/guides/nova.rst                   |  2 +-
 doc/source/guides/single-machine.rst         |  2 +-
 doc/source/guides/single-vm.rst              |  2 +-
 doc/source/index.rst                         |  5 ++---
 doc/source/plugins.rst                       | 15 +++++++++++----
 doc/source/zuul_ci_jobs_migration.rst        | 10 +++++-----
 inc/python                                   |  2 +-
 tools/fixup_stuff.sh                         |  2 +-
 tools/generate-devstack-plugins-list.py      |  4 ++--
 tools/install_pip.sh                         |  2 +-
 18 files changed, 40 insertions(+), 35 deletions(-)

diff --git a/HACKING.rst b/HACKING.rst
index 968306a2c4..f6951064ae 100644
--- a/HACKING.rst
+++ b/HACKING.rst
@@ -11,7 +11,7 @@ Shell script was chosen because it best illustrates the steps used to
 set up and interact with OpenStack components.
 
 DevStack's official repository is located on git.openstack.org at
-https://git.openstack.org/openstack-dev/devstack.  Besides the master branch that
+https://opendev.org/openstack/devstack.  Besides the master branch that
 tracks the OpenStack trunk branches a separate branch is maintained for all
 OpenStack releases starting with Diablo (stable/diablo).
 
@@ -26,7 +26,7 @@ __ lp_
 .. _lp: https://launchpad.net/~devstack
 
 The `Gerrit review
-queue <https://review.openstack.org/#/q/project:openstack-dev/devstack,n,z>`__
+queue <https://review.opendev.org/#/q/project:openstack/devstack>`__
 is used for all commits.
 
 The primary script in DevStack is ``stack.sh``, which performs the bulk of the
diff --git a/README.rst b/README.rst
index ad7ede45c5..f3a585a926 100644
--- a/README.rst
+++ b/README.rst
@@ -38,7 +38,7 @@ You can also pick specific OpenStack project releases by setting the appropriate
 `stackrc` for the default set).  Usually just before a release there will be
 milestone-proposed branches that need to be tested::
 
-    GLANCE_REPO=https://git.openstack.org/openstack/glance.git
+    GLANCE_REPO=https://opendev.org/openstack/glance.git
     GLANCE_BRANCH=milestone-proposed
 
 Start A Dev Cloud
diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 098e994ccd..0105d5e636 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -205,7 +205,7 @@ Historical Notes
 Historically DevStack obtained all local configuration and
 customizations from a ``localrc`` file.  In Oct 2013 the
 ``local.conf`` configuration method was introduced (in `review 46768
-<https://review.openstack.org/#/c/46768/>`__) to simplify this
+<https://review.opendev.org/#/c/46768/>`__) to simplify this
 process.
 
 Configuration Notes
@@ -232,13 +232,13 @@ proposal. ``GIT_BASE`` points to the primary repository server.
 To pull a branch directly from Gerrit, get the repo and branch from
 the Gerrit review page::
 
-    git fetch https://review.openstack.org/p/openstack/nova \
+    git fetch https://review.opendev.org/openstack/nova \
         refs/changes/50/5050/1 && git checkout FETCH_HEAD
 
 The repo is the stanza following ``fetch`` and the branch is the
 stanza following that::
 
-    NOVA_REPO=https://review.openstack.org/p/openstack/nova
+    NOVA_REPO=https://review.opendev.org/openstack/nova
     NOVA_BRANCH=refs/changes/50/5050/1
 
 
diff --git a/doc/source/faq.rst b/doc/source/faq.rst
index efb315cbee..8214de0f6a 100644
--- a/doc/source/faq.rst
+++ b/doc/source/faq.rst
@@ -80,8 +80,7 @@ I'd like to help!
 ~~~~~~~~~~~~~~~~~
 
 That isn't a question, but please do! The source for DevStack is at
-`git.openstack.org
-<https://git.openstack.org/cgit/openstack-dev/devstack>`__ and bug
+`opendev.org <https://opendev.org/openstack/devstack>`__ and bug
 reports go to `LaunchPad
 <https://bugs.launchpad.net/devstack/>`__. Contributions follow the
 usual process as described in the `developer guide
diff --git a/doc/source/guides/devstack-with-lbaas-v2.rst b/doc/source/guides/devstack-with-lbaas-v2.rst
index db138ae2c5..07a9bb33cc 100644
--- a/doc/source/guides/devstack-with-lbaas-v2.rst
+++ b/doc/source/guides/devstack-with-lbaas-v2.rst
@@ -19,7 +19,7 @@ Install devstack
 
 ::
 
-    git clone https://git.openstack.org/openstack-dev/devstack
+    git clone https://opendev.org/openstack/devstack
     cd devstack/tools
     sudo ./create-stack-user.sh
     cd ../..
@@ -35,9 +35,9 @@ Edit your ``/opt/stack/devstack/local.conf`` to look like
 ::
 
     [[local|localrc]]
-    enable_plugin octavia https://git.openstack.org/openstack/octavia
+    enable_plugin octavia https://opendev.org/openstack/octavia
     # If you are enabling horizon, include the octavia dashboard
-    # enable_plugin octavia-dashboard https://git.openstack.org/openstack/octavia-dashboard.git
+    # enable_plugin octavia-dashboard https://opendev.org/openstack/octavia-dashboard.git
     # If you are enabling barbican for TLS offload in Octavia, include it here.
     # enable_plugin barbican https://github.com/openstack/barbican.git
 
diff --git a/doc/source/guides/lxc.rst b/doc/source/guides/lxc.rst
index 9549ed2974..dcaa4166c4 100644
--- a/doc/source/guides/lxc.rst
+++ b/doc/source/guides/lxc.rst
@@ -105,7 +105,7 @@ The commands in this section should all be run inside your container.
 
    ::
 
-       git clone https://git.openstack.org/openstack-dev/devstack
+       git clone https://opendev.org/openstack/devstack
 
 #. Configure
 
diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
index 3c4acc8c7c..15f02a0e5e 100644
--- a/doc/source/guides/multinode-lab.rst
+++ b/doc/source/guides/multinode-lab.rst
@@ -103,7 +103,7 @@ Grab the latest version of DevStack:
 
 ::
 
-    git clone https://git.openstack.org/openstack-dev/devstack
+    git clone https://opendev.org/openstack/devstack
     cd devstack
 
 Up to this point all of the steps apply to each node in the cluster.
diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index 80b2f85285..2c25a1c350 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -567,7 +567,7 @@ you do not require them.
     Q_ML2_PLUGIN_MECHANISM_DRIVERS=macvtap
     Q_USE_PROVIDER_NETWORKING=True
 
-    enable_plugin neutron https://git.openstack.org/openstack/neutron
+    enable_plugin neutron https://opendev.org/openstack/neutron
 
     ## MacVTap agent options
     Q_AGENT=macvtap
@@ -622,7 +622,7 @@ For the MacVTap compute node, use this local.conf:
 
     # Services that a compute node runs
     disable_all_services
-    enable_plugin neutron https://git.openstack.org/openstack/neutron
+    enable_plugin neutron https://opendev.org/openstack/neutron
     ENABLED_SERVICES+=n-cpu,q-agt
 
     ## MacVTap agent options
diff --git a/doc/source/guides/nova.rst b/doc/source/guides/nova.rst
index 65491d13e8..2271e2321b 100644
--- a/doc/source/guides/nova.rst
+++ b/doc/source/guides/nova.rst
@@ -83,7 +83,7 @@ some fake resource inventory values and keeps track of the state of the
 compute API but is good enough for most API testing, and is also used within
 the nova functional tests themselves so is fairly robust.
 
-.. _fake virt driver: http://git.openstack.org/cgit/openstack/nova/tree/nova/virt/fake.py
+.. _fake virt driver: https://opendev.org/openstack/nova/src/branch/master/nova/virt/fake.py
 
 Configuration
 -------------
diff --git a/doc/source/guides/single-machine.rst b/doc/source/guides/single-machine.rst
index cfbd6b1884..a0e97edb37 100644
--- a/doc/source/guides/single-machine.rst
+++ b/doc/source/guides/single-machine.rst
@@ -74,7 +74,7 @@ We'll grab the latest version of DevStack via https:
 .. code-block:: console
 
     $ sudo apt-get install git -y || sudo yum install -y git
-    $ git clone https://git.openstack.org/openstack-dev/devstack
+    $ git clone https://opendev.org/openstack/devstack
     $ cd devstack
 
 Run DevStack
diff --git a/doc/source/guides/single-vm.rst b/doc/source/guides/single-vm.rst
index 45b8f2dd89..8ebf2a638d 100644
--- a/doc/source/guides/single-vm.rst
+++ b/doc/source/guides/single-vm.rst
@@ -60,7 +60,7 @@ passed as the user-data file when booting the VM.
             DEBIAN_FRONTEND=noninteractive sudo apt-get install -qqy git || sudo yum install -qy git
             sudo chown stack:stack /home/stack
             cd /home/stack
-            git clone https://git.openstack.org/openstack-dev/devstack
+            git clone https://opendev.org/openstack/devstack
             cd devstack
             echo '[[local|localrc]]' > local.conf
             echo ADMIN_PASSWORD=password >> local.conf
diff --git a/doc/source/index.rst b/doc/source/index.rst
index 1ea1c5ddae..8f958585ee 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -23,8 +23,7 @@ everything from git master.  It is used interactively as a development
 environment and as the basis for much of the OpenStack project's
 functional testing.
 
-The source is available at
-`<https://git.openstack.org/cgit/openstack-dev/devstack>`__.
+The source is available at `<https://opendev.org/openstack/devstack>`__.
 
 .. warning::
 
@@ -73,7 +72,7 @@ Download DevStack
 
 .. code-block:: console
 
-   $ git clone https://git.openstack.org/openstack-dev/devstack
+   $ git clone https://opendev.org/openstack/devstack
    $ cd devstack
 
 The ``devstack`` repo contains a script that installs OpenStack and
diff --git a/doc/source/plugins.rst b/doc/source/plugins.rst
index b1f2397454..09ba980548 100644
--- a/doc/source/plugins.rst
+++ b/doc/source/plugins.rst
@@ -99,7 +99,7 @@ They are added in the following format::
 
 An example would be as follows::
 
-  enable_plugin ec2-api https://git.openstack.org/openstack/ec2-api
+  enable_plugin ec2-api https://opendev.org/openstack/ec2-api
 
 plugin.sh contract
 ==================
@@ -264,10 +264,12 @@ integration of alternate RPC systems (e.g. zmq, qpid). In these cases
 the best practice is to build a dedicated
 ``openstack/devstack-plugin-FOO`` project.
 
+Legacy project-config jobs
+--------------------------
+
 To enable a plugin to be used in a gate job, the following lines will
 be needed in your ``jenkins/jobs/<project>.yaml`` definition in
-`project-config
-<http://git.openstack.org/cgit/openstack-infra/project-config/>`_::
+`project-config <https://opendev.org/openstack/project-config/>`_::
 
   # Because we are testing a non standard project, add the
   # our project repository. This makes zuul do the right
@@ -277,7 +279,12 @@ be needed in your ``jenkins/jobs/<project>.yaml`` definition in
   # note the actual url here is somewhat irrelevant because it
   # caches in nodepool, however make it a valid url for
   # documentation purposes.
-  export DEVSTACK_LOCAL_CONFIG="enable_plugin ec2-api https://git.openstack.org/openstack/ec2-api"
+  export DEVSTACK_LOCAL_CONFIG="enable_plugin ec2-api https://opendev.org/openstack/ec2-api"
+
+Zuul v3 jobs
+------------
+
+See the ``devstack_plugins`` example in :doc:`zuul_ci_jobs_migration`.
 
 See Also
 ========
diff --git a/doc/source/zuul_ci_jobs_migration.rst b/doc/source/zuul_ci_jobs_migration.rst
index 633f951d3d..dbb79893db 100644
--- a/doc/source/zuul_ci_jobs_migration.rst
+++ b/doc/source/zuul_ci_jobs_migration.rst
@@ -28,7 +28,7 @@ sahara Tempest plugin repo:
 
 .. code:: yaml
 
-  # In http://git.openstack.org/cgit/openstack/sahara-tests/tree/.zuul.yaml:
+  # In https://opendev.org/openstack/sahara-tests/src/branch/master/.zuul.yaml:
   - job:
       name: sahara-tests-tempest
       description: |
@@ -86,7 +86,7 @@ job.parent.
 
 .. code:: yaml
 
-  # https://git.openstack.org/cgit/openstack/kuryr-kubernetes/tree/.zuul.yaml:
+  # https://opendev.org/openstack/kuryr-kubernetes/src/branch/master/.zuul.d/base.yaml:
   - job:
       name: kuryr-kubernetes-tempest-base
       parent: devstack-tempest
@@ -110,9 +110,9 @@ job.parent.
           kuryr-kubernetes: true
           (...)
         devstack_plugins:
-          kuryr-kubernetes: https://git.openstack.org/openstack/kuryr
-          devstack-plugin-container: https://git.openstack.org/openstack/devstack-plugin-container
-          neutron-lbaas: https://git.openstack.org/openstack/neutron-lbaas
+          kuryr-kubernetes: https://opendev.org/openstack/kuryr
+          devstack-plugin-container: https://opendev.org/openstack/devstack-plugin-container
+          neutron-lbaas: https://opendev.org/openstack/neutron-lbaas
         tempest_plugins:
           - kuryr-tempest-plugin
         (...)
diff --git a/inc/python b/inc/python
index 0e575ae9e9..ea8ff67e08 100644
--- a/inc/python
+++ b/inc/python
@@ -346,7 +346,7 @@ function lib_installed_from_git {
     # The best option seems to be to use "pip list" which will tell
     # you the path an editable install was installed from; for example
     # in response to something like
-    #  pip install -e 'git+http://git.openstack.org/openstack-dev/bashate#egg=bashate'
+    #  pip install -e 'git+https://opendev.org/openstack/bashate#egg=bashate'
     # pip list --format columns shows
     #  bashate 0.5.2.dev19 /tmp/env/src/bashate
     # Thus we check the third column to see if we're installed from
diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index 748223902c..1fa053f457 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -255,7 +255,7 @@ function fixup_suse {
 # looking for the mirror config script before doing this, and just
 # skip it if so.
 
-# [1] https://git.openstack.org/cgit/openstack/diskimage-builder/tree/ \
+# [1] https://opendev.org/openstack/diskimage-builder/src/branch/master/ \
 #        diskimage_builder/elements/pip-and-virtualenv/ \
 #            install.d/pip-and-virtualenv-source-install/04-install-pip
 # [2] https://bugzilla.redhat.com/show_bug.cgi?id=1477823
diff --git a/tools/generate-devstack-plugins-list.py b/tools/generate-devstack-plugins-list.py
index 580560ccab..11062eab2b 100644
--- a/tools/generate-devstack-plugins-list.py
+++ b/tools/generate-devstack-plugins-list.py
@@ -19,9 +19,9 @@
 #
 # In order to function correctly, the environment in which the
 # script runs must have
-#   * network access to the review.openstack.org Gerrit API
+#   * network access to the review.opendev.org Gerrit API
 #     working directory
-#   * network access to https://git.openstack.org/cgit
+#   * network access to https://opendev.org/
 
 import functools
 import logging
diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index 1bd7392b9d..2b6aa4c2e8 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -35,7 +35,7 @@ FILES=$TOP_DIR/files
 # done by openstack-infra diskimage-builder elements as part of image
 # preparation [1].  This prevents any network access, which can be
 # unreliable in CI situations.
-# [1] http://git.openstack.org/cgit/openstack-infra/project-config/tree/nodepool/elements/cache-devstack/source-repository-pip
+# [1] https://opendev.org/openstack/project-config/src/branch/master/nodepool/elements/cache-devstack/source-repository-pip
 
 PIP_GET_PIP_URL=${PIP_GET_PIP_URL:-"https://bootstrap.pypa.io/get-pip.py"}
 LOCAL_PIP="$FILES/$(basename $PIP_GET_PIP_URL)"

From 99e7445fb245deaa67d831a23c4e4ee21c13c855 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Fri, 21 Jun 2019 09:38:24 -0400
Subject: [PATCH 1558/2409] Adjust repo namespace for pbr

This is a follow up for change Ifcfce490edb3d77e4e436e002d35bc909e1a057c
where the GIT_BASE was changed to the opendev URL to avoid redirects.
The pbr namespace in stackrc was old and still getting redirected and
this change fixes that.

Change-Id: Ib444e928fa2ca7650670f97be6927202333a1dd7
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 4fc31a3d39..2661b5fa0b 100644
--- a/stackrc
+++ b/stackrc
@@ -498,7 +498,7 @@ GITREPO["tooz"]=${TOOZ_REPO:-${GIT_BASE}/openstack/tooz.git}
 GITBRANCH["tooz"]=${TOOZ_BRANCH:-$TARGET_BRANCH}
 
 # pbr drives the setuptools configs
-GITREPO["pbr"]=${PBR_REPO:-${GIT_BASE}/openstack-dev/pbr.git}
+GITREPO["pbr"]=${PBR_REPO:-${GIT_BASE}/openstack/pbr.git}
 GITBRANCH["pbr"]=${PBR_BRANCH:-$TARGET_BRANCH}
 
 

From 52c2886f7ede0e47f53b65fd1fd30f7d6ca7c086 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Thu, 20 Jun 2019 07:42:31 +0000
Subject: [PATCH 1559/2409] Add capability of adding additional network API
 extensions

Currently, devstack has NETWORK_API_EXTENSIONS var to define
the network API extensions. NETWORK_API_EXTENSIONS is defaulted
to 'all' for master and hard coded list of extensions per release.
Zuul jobs of network extensions (for example neutron-fwaas) need
add the some extra extensions in the default list. To do so, they
need to duplicate all the defaults extensions and then add the extra
extensions. Much difficult situation is when defaults extensions list
vary from release to release so they have to keep updating the
NETWORK_API_EXTENSIONS per release.

This commit defines a new var ADDITIONAL_NETWORK_API_EXTENSIONS which
will take extra extensions and append into the default list. This way
Zuul jobs do not need to duplicate the default extensions.

Change-Id: I7270c9b9e047a851970439522c0356c9089a5b74
---
 lib/tempest | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index 9f1b677eba..3eb9803f6d 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -618,6 +618,9 @@ function configure_tempest {
         # Remove disabled extensions
         network_api_extensions=$(remove_disabled_extensions $network_api_extensions $DISABLE_NETWORK_API_EXTENSIONS)
     fi
+    if [[ -n "$ADDITIONAL_NETWORK_API_EXTENSIONS" ]] && [[ "$network_api_extensions" != "all" ]]; then
+        network_api_extensions+=",$ADDITIONAL_NETWORK_API_EXTENSIONS"
+    fi
     iniset $TEMPEST_CONFIG network-feature-enabled api_extensions $network_api_extensions
     # Swift API Extensions
     local object_storage_api_extensions=${OBJECT_STORAGE_API_EXTENSIONS:-"all"}

From 8ab64b3236c93c8449edf80165017898b83f1269 Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Fri, 17 Nov 2017 19:52:29 +0100
Subject: [PATCH 1560/2409] Drop signing_dir option from
 configure_auth_token_middleware

This is no longer being used due to Keystone PKI tokens no longer
being implemented.

In order to not break backward compatibility we create a new function
that is to be used instead and deprecate the old one. Modify the old
function to ignore the 3rd argument and display a deprecation warning.
Adjust callers to no longer create and set that directory, calling the
new function instead.

Change-Id: Id0dec1ba72467cce5cacfcfdb2bc0af2bd3a3610
---
 lib/cinder         | 13 ++-----------
 lib/glance         | 24 +++---------------------
 lib/keystone       | 17 +++++++++++------
 lib/neutron        | 17 +++--------------
 lib/neutron-legacy | 14 ++------------
 lib/nova           | 13 ++-----------
 lib/placement      | 12 +-----------
 lib/swift          |  7 +------
 8 files changed, 25 insertions(+), 92 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index ed8349aad6..32e38c44da 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -51,7 +51,6 @@ else
 fi
 
 CINDER_STATE_PATH=${CINDER_STATE_PATH:=$DATA_DIR/cinder}
-CINDER_AUTH_CACHE_DIR=${CINDER_AUTH_CACHE_DIR:-/var/cache/cinder}
 
 CINDER_CONF_DIR=/etc/cinder
 CINDER_CONF=$CINDER_CONF_DIR/cinder.conf
@@ -217,7 +216,7 @@ function configure_cinder {
     inicomment $CINDER_API_PASTE_INI filter:authtoken admin_password
     inicomment $CINDER_API_PASTE_INI filter:authtoken signing_dir
 
-    configure_auth_token_middleware $CINDER_CONF cinder $CINDER_AUTH_CACHE_DIR
+    configure_keystone_authtoken_middleware $CINDER_CONF cinder
 
     iniset $CINDER_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
 
@@ -314,7 +313,7 @@ function configure_cinder {
     fi
 
     # Set nova credentials (used for os-assisted-snapshots)
-    configure_auth_token_middleware $CINDER_CONF nova $CINDER_AUTH_CACHE_DIR nova
+    configure_keystone_authtoken_middleware $CINDER_CONF nova nova
     iniset $CINDER_CONF nova region_name "$REGION_NAME"
     iniset $CINDER_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
 
@@ -380,13 +379,6 @@ function create_cinder_accounts {
     fi
 }
 
-# create_cinder_cache_dir() - Part of the init_cinder() process
-function create_cinder_cache_dir {
-    # Create cache dir
-    sudo install -d -o $STACK_USER $CINDER_AUTH_CACHE_DIR
-    rm -f $CINDER_AUTH_CACHE_DIR/*
-}
-
 # init_cinder() - Initialize database and volume group
 function init_cinder {
     if is_service_enabled $DATABASE_BACKENDS; then
@@ -415,7 +407,6 @@ function init_cinder {
     fi
 
     mkdir -p $CINDER_STATE_PATH/volumes
-    create_cinder_cache_dir
 }
 
 # install_cinder() - Collect source and prepare
diff --git a/lib/glance b/lib/glance
index d630c9a3b0..54d3276433 100644
--- a/lib/glance
+++ b/lib/glance
@@ -44,7 +44,6 @@ fi
 GLANCE_CACHE_DIR=${GLANCE_CACHE_DIR:=$DATA_DIR/glance/cache}
 GLANCE_IMAGE_DIR=${GLANCE_IMAGE_DIR:=$DATA_DIR/glance/images}
 GLANCE_LOCK_DIR=${GLANCE_LOCK_DIR:=$DATA_DIR/glance/locks}
-GLANCE_AUTH_CACHE_DIR=${GLANCE_AUTH_CACHE_DIR:-/var/cache/glance}
 
 GLANCE_CONF_DIR=${GLANCE_CONF_DIR:-/etc/glance}
 GLANCE_METADEF_DIR=$GLANCE_CONF_DIR/metadefs
@@ -97,20 +96,14 @@ function is_glance_enabled {
 # cleanup_glance() - Remove residual data files, anything left over from previous
 # runs that a clean run would need to clean up
 function cleanup_glance {
-    # kill instances (nova)
     # delete image files (glance)
-    sudo rm -rf $GLANCE_CACHE_DIR $GLANCE_IMAGE_DIR $GLANCE_AUTH_CACHE_DIR
+    sudo rm -rf $GLANCE_CACHE_DIR $GLANCE_IMAGE_DIR
 }
 
 # configure_glance() - Set config files, create data dirs, etc
 function configure_glance {
     sudo install -d -o $STACK_USER $GLANCE_CONF_DIR $GLANCE_METADEF_DIR
 
-    # We run this here as this configures cache dirs for the auth middleware
-    # which is used in the api server and not in the registry. The api
-    # Server is configured through this function and not init_glance.
-    create_glance_cache_dir
-
     # Set non-default configuration options for registry
     iniset $GLANCE_REGISTRY_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
     iniset $GLANCE_REGISTRY_CONF DEFAULT bind_host $GLANCE_SERVICE_LISTEN_ADDRESS
@@ -120,7 +113,7 @@ function configure_glance {
     iniset $GLANCE_REGISTRY_CONF database connection $dburl
     iniset $GLANCE_REGISTRY_CONF DEFAULT use_syslog $SYSLOG
     iniset $GLANCE_REGISTRY_CONF paste_deploy flavor keystone
-    configure_auth_token_middleware $GLANCE_REGISTRY_CONF glance $GLANCE_AUTH_CACHE_DIR/registry
+    configure_keystone_authtoken_middleware $GLANCE_REGISTRY_CONF glance
     iniset $GLANCE_REGISTRY_CONF oslo_messaging_notifications driver messagingv2
     iniset_rpc_backend glance $GLANCE_REGISTRY_CONF
     iniset $GLANCE_REGISTRY_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
@@ -132,7 +125,7 @@ function configure_glance {
     iniset $GLANCE_API_CONF DEFAULT image_cache_dir $GLANCE_CACHE_DIR/
     iniset $GLANCE_API_CONF oslo_concurrency lock_path $GLANCE_LOCK_DIR
     iniset $GLANCE_API_CONF paste_deploy flavor keystone+cachemanagement
-    configure_auth_token_middleware $GLANCE_API_CONF glance $GLANCE_AUTH_CACHE_DIR/api
+    configure_keystone_authtoken_middleware $GLANCE_API_CONF glance
     iniset $GLANCE_API_CONF oslo_messaging_notifications driver messagingv2
     iniset_rpc_backend glance $GLANCE_API_CONF
     if [ "$VIRT_DRIVER" = 'xenserver' ]; then
@@ -279,23 +272,12 @@ function create_glance_accounts {
     fi
 }
 
-# create_glance_cache_dir() - Part of the configure_glance() process
-function create_glance_cache_dir {
-    # Create cache dir
-    sudo install -d -o $STACK_USER $GLANCE_AUTH_CACHE_DIR/api $GLANCE_AUTH_CACHE_DIR/registry $GLANCE_AUTH_CACHE_DIR/search $GLANCE_AUTH_CACHE_DIR/artifact
-    rm -f $GLANCE_AUTH_CACHE_DIR/api/* $GLANCE_AUTH_CACHE_DIR/registry/* $GLANCE_AUTH_CACHE_DIR/search/* $GLANCE_AUTH_CACHE_DIR/artifact/*
-}
-
 # init_glance() - Initialize databases, etc.
 function init_glance {
     # Delete existing images
     rm -rf $GLANCE_IMAGE_DIR
     mkdir -p $GLANCE_IMAGE_DIR
 
-    # Delete existing cache
-    rm -rf $GLANCE_CACHE_DIR
-    mkdir -p $GLANCE_CACHE_DIR
-
     # (Re)create glance database
     recreate_database glance
 
diff --git a/lib/keystone b/lib/keystone
index 02e28222b7..5bd552f557 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -397,18 +397,17 @@ function create_service_user {
     fi
 }
 
-# Configure the service to use the auth token middleware.
+# Configure a service to use the auth token middleware.
 #
-# configure_auth_token_middleware conf_file admin_user signing_dir [section]
+# configure_keystone_authtoken_middleware conf_file admin_user IGNORED [section]
 #
 # section defaults to keystone_authtoken, which is where auth_token looks in
 # the .conf file. If the paste config file is used (api-paste.ini) then
 # provide the section name for the auth_token filter.
-function configure_auth_token_middleware {
+function configure_keystone_authtoken_middleware {
     local conf_file=$1
     local admin_user=$2
-    local signing_dir=$3
-    local section=${4:-keystone_authtoken}
+    local section=${3:-keystone_authtoken}
 
     iniset $conf_file $section auth_type password
     iniset $conf_file $section auth_url $KEYSTONE_SERVICE_URI
@@ -419,10 +418,16 @@ function configure_auth_token_middleware {
     iniset $conf_file $section project_domain_name "$SERVICE_DOMAIN_NAME"
 
     iniset $conf_file $section cafile $SSL_BUNDLE_FILE
-    iniset $conf_file $section signing_dir $signing_dir
     iniset $conf_file $section memcached_servers localhost:11211
 }
 
+# configure_auth_token_middleware conf_file admin_user IGNORED [section]
+# TODO(frickler): old function for backwards compatibility, remove in U cycle
+function configure_auth_token_middleware {
+    echo "WARNING: configure_auth_token_middleware is deprecated, use configure_keystone_authtoken_middleware instead"
+    configure_keystone_authtoken_middleware $1 $2 $4
+}
+
 # init_keystone() - Initialize databases, etc.
 function init_keystone {
     if is_service_enabled ldap; then
diff --git a/lib/neutron b/lib/neutron
index 947c491ec1..e1fd10ce1f 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -36,7 +36,6 @@ GITDIR["python-neutronclient"]=$DEST/python-neutronclient
 NEUTRON_DEPLOY_MOD_WSGI=$(trueorfalse False NEUTRON_DEPLOY_MOD_WSGI)
 NEUTRON_AGENT=${NEUTRON_AGENT:-openvswitch}
 NEUTRON_DIR=$DEST/neutron
-NEUTRON_AUTH_CACHE_DIR=${NEUTRON_AUTH_CACHE_DIR:-/var/cache/neutron}
 
 NEUTRON_DISTRIBUTED_ROUTING=$(trueorfalse False NEUTRON_DISTRIBUTED_ROUTING)
 # Distributed Virtual Router (DVR) configuration
@@ -62,7 +61,6 @@ NEUTRON_AGENT_CONF=$NEUTRON_CONF_DIR/
 NEUTRON_CREATE_INITIAL_NETWORKS=${NEUTRON_CREATE_INITIAL_NETWORKS:-True}
 
 NEUTRON_STATE_PATH=${NEUTRON_STATE_PATH:=$DATA_DIR/neutron}
-NEUTRON_AUTH_CACHE_DIR=${NEUTRON_AUTH_CACHE_DIR:-/var/cache/neutron}
 
 NEUTRON_UWSGI_CONF=$NEUTRON_CONF_DIR/neutron-api-uwsgi.ini
 
@@ -200,8 +198,8 @@ function configure_neutron_new {
         iniset $NEUTRON_CONF DEFAULT router_distributed $NEUTRON_DISTRIBUTED_ROUTING
 
         iniset $NEUTRON_CONF DEFAULT auth_strategy $NEUTRON_AUTH_STRATEGY
-        configure_auth_token_middleware $NEUTRON_CONF neutron $NEUTRON_AUTH_CACHE_DIR keystone_authtoken
-        configure_auth_token_middleware $NEUTRON_CONF nova $NEUTRON_AUTH_CACHE_DIR nova
+        configure_keystone_authtoken_middleware $NEUTRON_CONF neutron
+        configure_keystone_authtoken_middleware $NEUTRON_CONF nova nova
 
         # Configure VXLAN
         # TODO(sc68cal) not hardcode?
@@ -292,7 +290,7 @@ function configure_neutron_new {
 
         # TODO(dtroyer): remove the v2.0 hard code below
         iniset $NEUTRON_META_CONF DEFAULT auth_url $KEYSTONE_SERVICE_URI
-        configure_auth_token_middleware $NEUTRON_META_CONF neutron $NEUTRON_AUTH_CACHE_DIR DEFAULT
+        configure_keystone_authtoken_middleware $NEUTRON_META_CONF neutron DEFAULT
     fi
 
     # Format logging
@@ -389,13 +387,6 @@ function create_neutron_accounts_new {
     fi
 }
 
-# create_neutron_cache_dir() - Part of the init_neutron() process
-function create_neutron_cache_dir {
-    # Create cache dir
-    sudo install -d -o $STACK_USER $NEUTRON_AUTH_CACHE_DIR
-    rm -f $NEUTRON_AUTH_CACHE_DIR/*
-}
-
 # init_neutron() - Initialize databases, etc.
 function init_neutron_new {
 
@@ -405,8 +396,6 @@ function init_neutron_new {
     # Run Neutron db migrations
     $NEUTRON_BIN_DIR/neutron-db-manage upgrade heads
     time_stop "dbsync"
-
-    create_neutron_cache_dir
 }
 
 # install_neutron() - Collect source and prepare
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 87edc5ab81..dbd6e2c06b 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -71,7 +71,6 @@ GITDIR["python-neutronclient"]=$DEST/python-neutronclient
 
 NEUTRON_DIR=$DEST/neutron
 NEUTRON_FWAAS_DIR=$DEST/neutron-fwaas
-NEUTRON_AUTH_CACHE_DIR=${NEUTRON_AUTH_CACHE_DIR:-/var/cache/neutron}
 
 # Support entry points installation of console scripts
 if [[ -d $NEUTRON_DIR/bin/neutron-server ]]; then
@@ -841,13 +840,13 @@ function _configure_neutron_service {
     iniset $NEUTRON_CONF DEFAULT allow_overlapping_ips $Q_ALLOW_OVERLAPPING_IP
 
     iniset $NEUTRON_CONF DEFAULT auth_strategy $Q_AUTH_STRATEGY
-    _neutron_setup_keystone $NEUTRON_CONF keystone_authtoken
+    configure_keystone_authtoken_middleware $NEUTRON_CONF $Q_ADMIN_USERNAME
 
     # Configuration for neutron notifications to nova.
     iniset $NEUTRON_CONF DEFAULT notify_nova_on_port_status_changes $Q_NOTIFY_NOVA_PORT_STATUS_CHANGES
     iniset $NEUTRON_CONF DEFAULT notify_nova_on_port_data_changes $Q_NOTIFY_NOVA_PORT_DATA_CHANGES
 
-    configure_auth_token_middleware $NEUTRON_CONF nova $NEUTRON_AUTH_CACHE_DIR nova
+    configure_keystone_authtoken_middleware $NEUTRON_CONF nova nova
 
     # Configure plugin
     neutron_plugin_configure_service
@@ -933,15 +932,6 @@ function _neutron_setup_rootwrap {
     fi
 }
 
-# Configures keystone integration for neutron service
-function _neutron_setup_keystone {
-    local conf_file=$1
-    local section=$2
-
-    create_neutron_cache_dir
-    configure_auth_token_middleware $conf_file $Q_ADMIN_USERNAME $NEUTRON_AUTH_CACHE_DIR $section
-}
-
 function _neutron_setup_interface_driver {
 
     # ovs_use_veth needs to be set before the plugin configuration
diff --git a/lib/nova b/lib/nova
index 8220e0f10b..a394a64eef 100644
--- a/lib/nova
+++ b/lib/nova
@@ -46,7 +46,6 @@ fi
 NOVA_STATE_PATH=${NOVA_STATE_PATH:=$DATA_DIR/nova}
 # INSTANCES_PATH is the previous name for this
 NOVA_INSTANCES_PATH=${NOVA_INSTANCES_PATH:=${INSTANCES_PATH:=$NOVA_STATE_PATH/instances}}
-NOVA_AUTH_CACHE_DIR=${NOVA_AUTH_CACHE_DIR:-/var/cache/nova}
 
 NOVA_CONF_DIR=/etc/nova
 NOVA_CONF=$NOVA_CONF_DIR/nova.conf
@@ -215,7 +214,7 @@ function cleanup_nova {
         sudo rm -rf $NOVA_INSTANCES_PATH/*
     fi
 
-    sudo rm -rf $NOVA_STATE_PATH $NOVA_AUTH_CACHE_DIR
+    sudo rm -rf $NOVA_STATE_PATH
 
     # NOTE(dtroyer): This really should be called from here but due to the way
     #                nova abuses the _cleanup() function we're moving it
@@ -443,7 +442,7 @@ function create_nova_conf {
             iniset $NOVA_CONF DEFAULT osapi_compute_link_prefix $NOVA_SERVICE_PROTOCOL://$NOVA_SERVICE_HOST:$NOVA_SERVICE_PORT
         fi
 
-        configure_auth_token_middleware $NOVA_CONF nova $NOVA_AUTH_CACHE_DIR
+        configure_keystone_authtoken_middleware $NOVA_CONF nova
     fi
 
     if is_service_enabled cinder; then
@@ -690,13 +689,6 @@ function conductor_conf {
     echo "${NOVA_CONF_DIR}/nova_cell${cell}.conf"
 }
 
-# create_nova_cache_dir() - Part of the init_nova() process
-function create_nova_cache_dir {
-    # Create cache dir
-    sudo install -d -o $STACK_USER $NOVA_AUTH_CACHE_DIR
-    rm -f $NOVA_AUTH_CACHE_DIR/*
-}
-
 # create_nova_keys_dir() - Part of the init_nova() process
 function create_nova_keys_dir {
     # Create keys dir
@@ -738,7 +730,6 @@ function init_nova {
         done
     fi
 
-    create_nova_cache_dir
     create_nova_keys_dir
 
     if [[ "$NOVA_BACKEND" == "LVM" ]]; then
diff --git a/lib/placement b/lib/placement
index a89cd26939..785b0ddfca 100644
--- a/lib/placement
+++ b/lib/placement
@@ -29,7 +29,6 @@ set +o xtrace
 PLACEMENT_DIR=$DEST/placement
 PLACEMENT_CONF_DIR=/etc/placement
 PLACEMENT_CONF=$PLACEMENT_CONF_DIR/placement.conf
-PLACEMENT_AUTH_CACHE_DIR=${PLACEMENT_AUTH_CACHE_DIR:-/var/cache/placement}
 PLACEMENT_AUTH_STRATEGY=${PLACEMENT_AUTH_STRATEGY:-keystone}
 # Placement virtual environment
 if [[ ${USE_VENV} = True ]]; then
@@ -64,7 +63,6 @@ function is_placement_enabled {
 function cleanup_placement {
     sudo rm -f $(apache_site_config_for placement-api)
     remove_uwsgi_config "$PLACEMENT_UWSGI_CONF" "$PLACEMENT_UWSGI"
-    sudo rm -f $PLACEMENT_AUTH_CACHE_DIR/*
 }
 
 # _config_placement_apache_wsgi() - Set WSGI config files
@@ -99,7 +97,7 @@ function create_placement_conf {
     iniset $PLACEMENT_CONF placement_database connection `database_connection_url placement`
     iniset $PLACEMENT_CONF DEFAULT debug "$ENABLE_DEBUG_LOG_LEVEL"
     iniset $PLACEMENT_CONF api auth_strategy $PLACEMENT_AUTH_STRATEGY
-    configure_auth_token_middleware $PLACEMENT_CONF placement $PLACEMENT_AUTH_CACHE_DIR
+    configure_keystone_authtoken_middleware $PLACEMENT_CONF placement
     setup_logging $PLACEMENT_CONF
 }
 
@@ -127,19 +125,11 @@ function create_placement_accounts {
         "$placement_api_url"
 }
 
-# create_placement_cache_dir() - Create directories for keystone cache
-function create_placement_cache_dir {
-    # Create cache dir
-    sudo install -d -o $STACK_USER $PLACEMENT_AUTH_CACHE_DIR
-    rm -f $PLACEMENT_AUTH_CACHE_DIR/*
-}
-
 # init_placement() - Create service user and endpoints
 function init_placement {
     recreate_database placement
     $PLACEMENT_BIN_DIR/placement-manage db sync
     create_placement_accounts
-    create_placement_cache_dir
 }
 
 # install_placement() - Collect source and prepare
diff --git a/lib/swift b/lib/swift
index d9a7878652..5be9e3575e 100644
--- a/lib/swift
+++ b/lib/swift
@@ -47,7 +47,6 @@ else
     SWIFT_BIN_DIR=$(get_python_exec_prefix)
 fi
 
-SWIFT_AUTH_CACHE_DIR=${SWIFT_AUTH_CACHE_DIR:-/var/cache/swift}
 SWIFT_APACHE_WSGI_DIR=${SWIFT_APACHE_WSGI_DIR:-/var/www/swift}
 
 SWIFT_SERVICE_PROTOCOL=${SWIFT_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
@@ -452,7 +451,7 @@ function configure_swift {
     iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:authtoken log_name swift
 
     iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:authtoken paste.filter_factory keystonemiddleware.auth_token:filter_factory
-    configure_auth_token_middleware $SWIFT_CONFIG_PROXY_SERVER swift $SWIFT_AUTH_CACHE_DIR filter:authtoken
+    configure_keystone_authtoken_middleware $SWIFT_CONFIG_PROXY_SERVER swift filter:authtoken
     iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:authtoken delay_auth_decision 1
     iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:authtoken cache swift.cache
     iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:authtoken include_service_catalog False
@@ -735,10 +734,6 @@ function init_swift {
         $SWIFT_BIN_DIR/swift-ring-builder container.builder rebalance 42
         $SWIFT_BIN_DIR/swift-ring-builder account.builder rebalance 42
     } && popd >/dev/null
-
-    # Create cache dir
-    sudo install -d -o ${STACK_USER} $SWIFT_AUTH_CACHE_DIR
-    rm -f $SWIFT_AUTH_CACHE_DIR/*
 }
 
 function install_swift {

From 8b31dce38b630ba3ed1883bcf91a90d296ae44f2 Mon Sep 17 00:00:00 2001
From: Carlos Goncalves <cgoncalves@redhat.com>
Date: Fri, 21 Jun 2019 13:13:40 +0200
Subject: [PATCH 1561/2409] Fix rdo-release install

The URL for rdo-release package is version-less and redirects to latest
stable version. This becomes problematic when stacking older stable
versions as dependencies might not be met or newer and incompatibile
ones might get installed.

Closes-Bug: #1833696

Change-Id: Icb07dcb4c9a3950a3c31a3a8dcb8d0b4c713fdb1
---
 stack.sh | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index 9bda79a36b..80a7d0e7f5 100755
--- a/stack.sh
+++ b/stack.sh
@@ -331,7 +331,13 @@ function _install_rdo {
     # Per the point above, it's a bunch of repos so starts getting a
     # little messy...
     if ! is_package_installed rdo-release ; then
-        yum_install https://rdoproject.org/repos/rdo-release.rpm
+        if [[ "$TARGET_BRANCH" == "master" ]]; then
+            yum_install https://rdoproject.org/repos/rdo-release.rpm
+        else
+            # Get latest rdo-release-$rdo_release RPM package version
+            rdo_release=$(echo $TARGET_BRANCH | sed "s|stable/||g")
+            yum_install https://rdoproject.org/repos/openstack-$rdo_release/rdo-release-$rdo_release.rpm
+        fi
     fi
 
     # Also enable optional for RHEL7 proper.  Note this is a silent

From 45ded1cca01bfa31dcb3ad1591125e4890d6f562 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Wed, 3 Jul 2019 06:12:23 +0000
Subject: [PATCH 1562/2409] Updated from generate-devstack-plugins-list

Change-Id: I1b4c9571b8f3dece270865fb336e73aca3a36a76
---
 doc/source/plugin-registry.rst | 1 -
 1 file changed, 1 deletion(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index ea8c31807d..1c1c5a5a25 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -204,7 +204,6 @@ x/trio2o                                 `https://opendev.org/x/trio2o <https://
 x/valet                                  `https://opendev.org/x/valet <https://opendev.org/x/valet>`__
 x/vmware-nsx                             `https://opendev.org/x/vmware-nsx <https://opendev.org/x/vmware-nsx>`__
 x/vmware-vspc                            `https://opendev.org/x/vmware-vspc <https://opendev.org/x/vmware-vspc>`__
-zuul/nodepool                            `https://opendev.org/zuul/nodepool <https://opendev.org/zuul/nodepool>`__
 ======================================== ===
 
 

From d7d902f6b60298d56359a07a63b2355373e54956 Mon Sep 17 00:00:00 2001
From: melanie witt <melwittt@gmail.com>
Date: Fri, 24 May 2019 20:09:28 +0000
Subject: [PATCH 1563/2409] Configure console proxy ports in nova-cpu.conf

In change I8934d0b9392f2976347391c8a650ad260f337762, we began
configuring console proxy ports for multiple cells in the nova
controller config files to avoid "Address already in use" errors from
port collisions when running multiple cells on a single host.

This correspondingly configures the console proxy ports in the nova
compute config file based on what cell we're in, according to the
NOVA_CPU_CELL variable.

The base_url config for serial console is also added where the default
was previously used. The url is taken from the config option default in
the nova code: nova/conf/serial_console.py [1].

[1] https://github.com/openstack/nova/blob/8f00b5d/nova/conf/serial_console.py#L54

Change-Id: Id885fc5a769bce8111f1052a1b55d26be817c890
Closes-Bug: #1830417
---
 lib/nova | 24 ++++++++++++++++++------
 1 file changed, 18 insertions(+), 6 deletions(-)

diff --git a/lib/nova b/lib/nova
index a394a64eef..18e7a7d98a 100644
--- a/lib/nova
+++ b/lib/nova
@@ -572,23 +572,34 @@ function configure_placement_nova_compute {
 }
 
 function configure_console_compute {
+    # If we are running multiple cells (and thus multiple console proxies) on a
+    # single host, we offset the ports to avoid collisions.  We need to
+    # correspondingly configure the console proxy port for nova-compute and we
+    # can use the NOVA_CPU_CELL variable to know which cell we are for
+    # calculating the offset.
+    # Stagger the offset based on the total number of possible console proxies
+    # (novnc, xvpvnc, spice, serial) so that their ports will not collide if
+    # all are enabled.
+    local offset
+    offset=$(((NOVA_CPU_CELL - 1) * 4))
+
     # All nova-compute workers need to know the vnc configuration options
     # These settings don't hurt anything if n-xvnc and n-novnc are disabled
     if is_service_enabled n-cpu; then
         if [ "$NOVNC_FROM_PACKAGE" == "True" ]; then
             # Use the old URL when installing novnc packages.
-            NOVNCPROXY_URL=${NOVNCPROXY_URL:-"http://$SERVICE_HOST:6080/vnc_auto.html"}
+            NOVNCPROXY_URL=${NOVNCPROXY_URL:-"http://$SERVICE_HOST:$((6080 + offset))/vnc_auto.html"}
         elif vercmp ${NOVNC_BRANCH} "<" "1.0.0"; then
-             # Use the old URL when installing older novnc source.
-            NOVNCPROXY_URL=${NOVNCPROXY_URL:-"http://$SERVICE_HOST:6080/vnc_auto.html"}
+            # Use the old URL when installing older novnc source.
+            NOVNCPROXY_URL=${NOVNCPROXY_URL:-"http://$SERVICE_HOST:$((6080 + offset))/vnc_auto.html"}
         else
             # Use the new URL when building >=v1.0.0 from source.
-            NOVNCPROXY_URL=${NOVNCPROXY_URL:-"http://$SERVICE_HOST:6080/vnc_lite.html"}
+            NOVNCPROXY_URL=${NOVNCPROXY_URL:-"http://$SERVICE_HOST:$((6080 + offset))/vnc_lite.html"}
         fi
         iniset $NOVA_CPU_CONF vnc novncproxy_base_url "$NOVNCPROXY_URL"
-        XVPVNCPROXY_URL=${XVPVNCPROXY_URL:-"http://$SERVICE_HOST:6081/console"}
+        XVPVNCPROXY_URL=${XVPVNCPROXY_URL:-"http://$SERVICE_HOST:$((6081 + offset))/console"}
         iniset $NOVA_CPU_CONF vnc xvpvncproxy_base_url "$XVPVNCPROXY_URL"
-        SPICEHTML5PROXY_URL=${SPICEHTML5PROXY_URL:-"http://$SERVICE_HOST:6082/spice_auto.html"}
+        SPICEHTML5PROXY_URL=${SPICEHTML5PROXY_URL:-"http://$SERVICE_HOST:$((6082 + offset))/spice_auto.html"}
         iniset $NOVA_CPU_CONF spice html5proxy_base_url "$SPICEHTML5PROXY_URL"
     fi
 
@@ -615,6 +626,7 @@ function configure_console_compute {
 
     if is_service_enabled n-sproxy; then
         iniset $NOVA_CPU_CONF serial_console enabled True
+        iniset $NOVA_CPU_CONF serial_console base_url "ws://$SERVICE_HOST:$((6083 + offset))/"
     fi
 }
 

From 3446481a23d2c878297b4f535c7b9b44d07ed5fb Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Wed, 3 Jul 2019 13:16:04 +0000
Subject: [PATCH 1564/2409] Update docs about python-systemd pkg

The package has been renamed in order to avoid the namespace collision
with systemd, update our doc accordingly.

Change-Id: I1b9a434d9bb6a7d9dc38ef965017ed9f8773d595
Closes-Bug: 1825949
---
 doc/source/systemd.rst | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/doc/source/systemd.rst b/doc/source/systemd.rst
index 1bc9911879..7168768504 100644
--- a/doc/source/systemd.rst
+++ b/doc/source/systemd.rst
@@ -208,7 +208,8 @@ into the ``systemd`` namespace, which can cause some issues.
   the one you want.
 - ``systemd`` - a python 3 only library, not what you want.
 - ``python-systemd`` - another library you don't want. Installing it
-  on a system will break ansible's ability to run.
+  on a system will break ansible's ability to run. The package has now
+  been renamed to ``cysystemd``, which avoids the namespace collision.
 
 
 If we were using user units, the ``[Service]`` - ``Group=`` parameter

From 70fca49de75a77fd766d5b72f8757e4f7c0a7a48 Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Wed, 26 Jun 2019 09:57:02 +0200
Subject: [PATCH 1565/2409] Add and switch to the newly created opensuse-15
 nodeset

opensuse-150 nodeset is referring to openSUSE 15.0, which is still in
maintenance but openSUSE 15.1 has been released already. "opensuse-15"
is going to refer to the "latest openSUSE 15.x" build released and
working for OpenStack going forward, so add this nodeset and use
it by default going forward.

Change-Id: Ic3f4d6998a66da5226bc95088d7e3c83dfe737ce
---
 .zuul.yaml | 12 ++++++------
 stack.sh   |  2 +-
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 3c516dd350..bcfd0c1a48 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -39,10 +39,10 @@
           - controller
 
 - nodeset:
-    name: devstack-single-node-opensuse-150
+    name: devstack-single-node-opensuse-15
     nodes:
       - name: controller
-        label: opensuse-150
+        label: opensuse-15
     groups:
       - name: tempest
         nodes:
@@ -532,10 +532,10 @@
     voting: false
 
 - job:
-    name: devstack-platform-opensuse-150
+    name: devstack-platform-opensuse-15
     parent: tempest-full-py3
-    description: openSUSE 15.0 platform test
-    nodeset: devstack-single-node-opensuse-150
+    description: openSUSE 15.x platform test
+    nodeset: devstack-single-node-opensuse-15
     voting: false
 
 - job:
@@ -627,7 +627,7 @@
         - devstack-ipv6:
             voting: false
         - devstack-platform-centos-7
-        - devstack-platform-opensuse-150
+        - devstack-platform-opensuse-15
         - devstack-platform-fedora-latest
         - devstack-platform-xenial
         - devstack-multinode
diff --git a/stack.sh b/stack.sh
index 9bda79a36b..20938ada94 100755
--- a/stack.sh
+++ b/stack.sh
@@ -224,7 +224,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (xenial|artful|bionic|stretch|jessie|f28|f29|opensuse-42.3|opensuse-15.0|opensuse-tumbleweed|rhel7) ]]; then
+if [[ ! ${DISTRO} =~ (xenial|artful|bionic|stretch|jessie|f28|f29|opensuse-15.0|opensuse-15.1|opensuse-tumbleweed|rhel7) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From 705e9cb5dc8b63c902f588d29271686501be0c6e Mon Sep 17 00:00:00 2001
From: Vanou Ishii <ishii.vanou@fujitsu.com>
Date: Tue, 2 Jul 2019 00:40:24 -0400
Subject: [PATCH 1566/2409] Fix error in configure_nova_hypervisor with
 hardware Ironic node

Trying to deploy OpenStack environment consisting of ironic nova
hypervisor & hardware Ironic node (not VM Ironic node) with devstack
got failed.

Devstack error says error occurred while calling configure_libvirt
in configure_nova_hypervisor. This happens because libvirt related
packages are not installed when specifying "VIRT_DRIVER=ironic"
and "IRONIC_IS_HARDWARE=True".

To fix this problem, this commit add "if" statement to check
Ironic node is hardware or not using "is_ironic_hardware" function
in "function-common" file.

Change-Id: I1113478175fadec79d0f8bf6ae842ed86e5e686b
Closes-Bug: #1834985
---
 lib/nova_plugins/hypervisor-ironic | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/nova_plugins/hypervisor-ironic b/lib/nova_plugins/hypervisor-ironic
index 1279256055..9bc04e2122 100644
--- a/lib/nova_plugins/hypervisor-ironic
+++ b/lib/nova_plugins/hypervisor-ironic
@@ -36,7 +36,9 @@ function cleanup_nova_hypervisor {
 
 # configure_nova_hypervisor - Set config files, create data dirs, etc
 function configure_nova_hypervisor {
-    configure_libvirt
+    if ! is_ironic_hardware; then
+        configure_libvirt
+    fi
     LIBVIRT_FIREWALL_DRIVER=${LIBVIRT_FIREWALL_DRIVER:-"nova.virt.firewall.NoopFirewallDriver"}
 
     iniset $NOVA_CONF DEFAULT compute_driver ironic.IronicDriver

From 764ccd07a7f30ecf6549bad618bc05ffb97fae35 Mon Sep 17 00:00:00 2001
From: Tim Burke <tim.burke@gmail.com>
Date: Thu, 11 Jul 2019 09:47:48 -0700
Subject: [PATCH 1567/2409] Remove Swift from default DISABLED_PYTHON3_PACKAGES

As of https://review.opendev.org/#/c/653548/ this is no longer
necessary.

Change-Id: Iab43d77c3444fa97f3339f0e5fa4ad24e87e3fd6
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 2661b5fa0b..4ac8c0338e 100644
--- a/stackrc
+++ b/stackrc
@@ -131,7 +131,7 @@ export USE_PYTHON3=$(trueorfalse False USE_PYTHON3)
 
 # Explicitly list services not to run under Python 3. See
 # disable_python3_package to edit this variable.
-export DISABLED_PYTHON3_PACKAGES="swift"
+export DISABLED_PYTHON3_PACKAGES=""
 
 # When Python 3 is supported by an application, adding the specific
 # version of Python 3 to this variable will install the app using that

From d51baee40d0e50675d8055cab67b262ef0fc9f1f Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Fri, 12 Jul 2019 11:51:17 -0400
Subject: [PATCH 1568/2409] Add NOVA_SHUTDOWN_TIMEOUT variable

This adds a variable to control the [DEFAULT]/shutdown_timeout
config in nova to control whether or not a guest should have
a graceful shutdown of the OS or if it should just stop
immediately (no timeout). Since devstack uses CirrOS images
by default, the default value for the NOVA_SHUTDOWN_TIMEOUT
variable is 0 which should speed up tempest runs. The default
in nova.conf [1] is 60 seconds.

[1] https://docs.openstack.org/nova/latest/configuration/config.html#DEFAULT.shutdown_timeout

Change-Id: Ida83f70a1c4e61e5248f2bd42b4c24f7ac6d2310
Related-Bug: #1829896
---
 lib/nova | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lib/nova b/lib/nova
index 29bce5a819..f423b570cd 100644
--- a/lib/nova
+++ b/lib/nova
@@ -153,6 +153,11 @@ ISCSID_DEBUG_LEVEL=${ISCSID_DEBUG_LEVEL:-4}
 # Other options include "versioned" and "both".
 NOVA_NOTIFICATION_FORMAT=${NOVA_NOTIFICATION_FORMAT:-unversioned}
 
+# Timeout for servers to gracefully shutdown the OS during operations
+# like shelve, rescue, stop, rebuild. Defaults to 0 since the default
+# image in devstack is CirrOS.
+NOVA_SHUTDOWN_TIMEOUT=${NOVA_SHUTDOWN_TIMEOUT:-0}
+
 # Functions
 # ---------
 
@@ -401,6 +406,7 @@ function create_nova_conf {
     iniset $NOVA_CONF DEFAULT instance_name_template "${INSTANCE_NAME_PREFIX}%08x"
     iniset $NOVA_CONF DEFAULT osapi_compute_listen "$NOVA_SERVICE_LISTEN_ADDRESS"
     iniset $NOVA_CONF DEFAULT metadata_listen "$NOVA_SERVICE_LISTEN_ADDRESS"
+    iniset $NOVA_CONF DEFAULT shutdown_timeout $NOVA_SHUTDOWN_TIMEOUT
 
     iniset $NOVA_CONF key_manager backend nova.keymgr.conf_key_mgr.ConfKeyManager
 

From dc01a8ab63aff1be170fb59c293ed4bddd03749a Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Sun, 14 Jul 2019 22:33:13 +0200
Subject: [PATCH 1569/2409] Switch TLS tests to TLSv1.2+ only

This would more likely match a relevant production deployment.

Change-Id: I4ee2ff0c00a8e33fd069a782b32eed5fef62c01b
---
 files/apache-keystone.template | 1 +
 files/apache-neutron.template  | 1 +
 lib/tls                        | 1 +
 3 files changed, 3 insertions(+)

diff --git a/files/apache-keystone.template b/files/apache-keystone.template
index 128436027d..480fe06a9c 100644
--- a/files/apache-keystone.template
+++ b/files/apache-keystone.template
@@ -38,6 +38,7 @@ LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\" %D(us)"
 %SSLLISTEN%    %SSLENGINE%
 %SSLLISTEN%    %SSLCERTFILE%
 %SSLLISTEN%    %SSLKEYFILE%
+%SSLLISTEN%    SSLProtocol -all +TLSv1.3 +TLSv1.2
 %SSLLISTEN%</VirtualHost>
 
 Alias /identity %KEYSTONE_BIN%/keystone-wsgi-public
diff --git a/files/apache-neutron.template b/files/apache-neutron.template
index c7796b93bf..358e87f5da 100644
--- a/files/apache-neutron.template
+++ b/files/apache-neutron.template
@@ -24,6 +24,7 @@ LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\" %D(us)"
 %SSLLISTEN%    %SSLENGINE%
 %SSLLISTEN%    %SSLCERTFILE%
 %SSLLISTEN%    %SSLKEYFILE%
+%SSLLISTEN%    SSLProtocol -all +TLSv1.3 +TLSv1.2
 %SSLLISTEN%</VirtualHost>
 
 Alias /networking %NEUTRON_BIN%/neutron-api
diff --git a/lib/tls b/lib/tls
index 0032449e13..6f2a65a75b 100644
--- a/lib/tls
+++ b/lib/tls
@@ -536,6 +536,7 @@ $listen_string
 <VirtualHost $f_host:$f_port>
     SSLEngine On
     SSLCertificateFile $DEVSTACK_CERT
+    SSLProtocol -all +TLSv1.3 +TLSv1.2
 
     # Disable KeepAlive to fix bug #1630664 a.k.a the
     # ('Connection aborted.', BadStatusLine("''",)) error

From 4106e46b2ed042ebeec533ac9022baa5d623ae06 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Wed, 24 Jul 2019 06:12:42 +0000
Subject: [PATCH 1570/2409] Updated from generate-devstack-plugins-list

Change-Id: Ie46214ed8a5a5887f04805b9157b76ebf44f9616
---
 doc/source/plugin-registry.rst | 1 -
 1 file changed, 1 deletion(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 1c1c5a5a25..5cbe4ed505 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -186,7 +186,6 @@ x/networking-vpp                         `https://opendev.org/x/networking-vpp <
 x/networking-vsphere                     `https://opendev.org/x/networking-vsphere <https://opendev.org/x/networking-vsphere>`__
 x/neutron-classifier                     `https://opendev.org/x/neutron-classifier <https://opendev.org/x/neutron-classifier>`__
 x/nova-dpm                               `https://opendev.org/x/nova-dpm <https://opendev.org/x/nova-dpm>`__
-x/nova-lxd                               `https://opendev.org/x/nova-lxd <https://opendev.org/x/nova-lxd>`__
 x/nova-mksproxy                          `https://opendev.org/x/nova-mksproxy <https://opendev.org/x/nova-mksproxy>`__
 x/oaktree                                `https://opendev.org/x/oaktree <https://opendev.org/x/oaktree>`__
 x/omni                                   `https://opendev.org/x/omni <https://opendev.org/x/omni>`__

From 420d3df48125a276974741a4f14a50df55184b8d Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Thu, 25 Jul 2019 06:48:39 +0000
Subject: [PATCH 1571/2409] Make 'devstack-ipv6' job as voting

'devstack-ipv6' job set the devstack to deploy
the services on IPv6. As part of community goal
'Support IPv6-Only Deployments'[1], this is going
to be the base job for all project specific or tempest
IPv6 jobs. Running this as voting make sure any devstack
setting or changes would not break the IPv6 jobs.

Story: #2005477
Task: #35923

[1] https://storyboard.openstack.org/#!/story/2005477

Change-Id: Id6580e8b29b6b04e34c2c1eca3125fa08920eb1d
---
 .zuul.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 2dd0b9f4ef..ee855bdf7f 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -624,8 +624,7 @@
       jobs:
         - devstack
         - devstack-xenial
-        - devstack-ipv6:
-            voting: false
+        - devstack-ipv6
         - devstack-platform-centos-7
         - devstack-platform-opensuse-150
         - devstack-platform-fedora-latest
@@ -666,6 +665,7 @@
       jobs:
         - devstack
         - devstack-xenial
+        - devstack-ipv6
         - devstack-multinode
         - devstack-multinode-xenial
         - devstack-unit-tests

From b0b80d76e1b8787fbfa66aedaf700c2abe44e22d Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Wed, 24 Jul 2019 10:31:27 +0000
Subject: [PATCH 1572/2409] Remove VNC server listen addresses seeting to IPv4
 from base job

'devstack' job set the VNC listen addresses 'VNCSERVER_LISTEN' and
'VNCSERVER_PROXYCLIENT_ADDRESS' IPv4 which makes 'devstack-ipv6' job
to either unset those or set for IPv6 values.

Let's remove the setting of those in base job and let lib/nova
set based on configured ip version from job.

'devstack-ipv6' base job will be used to define the IPv6-only jobs
on Tempest and project side gate.

Change-Id: Iea469128b15298aee61245e702d20603c8d376fb
Story: #2005477
Task: #35923
---
 .zuul.yaml | 4 ----
 lib/nova   | 4 ++--
 2 files changed, 2 insertions(+), 6 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index ee855bdf7f..048d69d3e0 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -382,8 +382,6 @@
         SWIFT_HASH: 1234123412341234
         DEBUG_LIBVIRT_COREDUMPS: true
         NOVA_VNC_ENABLED: true
-        VNCSERVER_LISTEN: 0.0.0.0
-        VNCSERVER_PROXYCLIENT_ADDRESS: $HOST_IP
       devstack_local_conf:
         post-config:
           $NEUTRON_CONF:
@@ -479,8 +477,6 @@
           GLANCE_HOSTPORT: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}:9292"
           Q_HOST: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}"
           NOVA_VNC_ENABLED: true
-          VNCSERVER_LISTEN: 0.0.0.0
-          VNCSERVER_PROXYCLIENT_ADDRESS: $HOST_IP
 
 - job:
     name: devstack-ipv6
diff --git a/lib/nova b/lib/nova
index f423b570cd..7b364a6b36 100644
--- a/lib/nova
+++ b/lib/nova
@@ -601,8 +601,8 @@ function configure_console_compute {
     if is_service_enabled n-novnc || is_service_enabled n-xvnc || [ "$NOVA_VNC_ENABLED" != False ]; then
         # Address on which instance vncservers will listen on compute hosts.
         # For multi-host, this should be the management ip of the compute host.
-        VNCSERVER_LISTEN=${VNCSERVER_LISTEN=$NOVA_SERVICE_LOCAL_HOST}
-        VNCSERVER_PROXYCLIENT_ADDRESS=${VNCSERVER_PROXYCLIENT_ADDRESS=$NOVA_SERVICE_LOCAL_HOST}
+        VNCSERVER_LISTEN=${VNCSERVER_LISTEN:-$NOVA_SERVICE_LOCAL_HOST}
+        VNCSERVER_PROXYCLIENT_ADDRESS=${VNCSERVER_PROXYCLIENT_ADDRESS:-$NOVA_SERVICE_LOCAL_HOST}
         iniset $NOVA_CPU_CONF vnc server_listen "$VNCSERVER_LISTEN"
         iniset $NOVA_CPU_CONF vnc server_proxyclient_address "$VNCSERVER_PROXYCLIENT_ADDRESS"
     else

From 352d58a7afd9e2261e639af78e4fb4c99d8f9f81 Mon Sep 17 00:00:00 2001
From: Graham Hayes <graham.hayes@hp.com>
Date: Mon, 20 Jul 2015 16:28:52 +0100
Subject: [PATCH 1573/2409] Only modify folders created by devstack

running chown and chmod on files and folders not created by
devstack causes a few issues:

* On nfs mounted directories it can take an extremely
  long time to chown -R some of the git repos, especially
  if any tox commands have been ran in the host
* chown can cause the host files to get into a weird state
  if nfs is set up wrong.

If files and folders are pre-existing we should assume
they are in the correct state, and not modify them.

Fix setup-devstack-log-dir to create the logs directory with
correct permissions in the first place.

Change-Id: I5ebdaded3ffd0a5bc70c5e9ab5b18daefb358f58
Signed-off-by: Graham Hayes <gr@ham.ie>
---
 roles/setup-devstack-log-dir/tasks/main.yaml |  3 +++
 roles/sync-devstack-data/tasks/main.yaml     | 11 +++++++++++
 stack.sh                                     | 17 +++++++++++------
 3 files changed, 25 insertions(+), 6 deletions(-)

diff --git a/roles/setup-devstack-log-dir/tasks/main.yaml b/roles/setup-devstack-log-dir/tasks/main.yaml
index b9f38dfacb..d8e8cfe70a 100644
--- a/roles/setup-devstack-log-dir/tasks/main.yaml
+++ b/roles/setup-devstack-log-dir/tasks/main.yaml
@@ -2,4 +2,7 @@
   file:
     path: '{{ devstack_base_dir }}/logs'
     state: directory
+    mode: 0755
+    owner: stack
+    group: stack
   become: yes
diff --git a/roles/sync-devstack-data/tasks/main.yaml b/roles/sync-devstack-data/tasks/main.yaml
index e62be87ccd..a1d37c3951 100644
--- a/roles/sync-devstack-data/tasks/main.yaml
+++ b/roles/sync-devstack-data/tasks/main.yaml
@@ -46,3 +46,14 @@
     dest: "{{ devstack_data_base_dir }}/data/"
     mode: push
   when: 'inventory_hostname in groups["subnode"]|default([])'
+
+- name: Ensure the data folder and subfolders have the correct permissions
+  become: true
+  file:
+    path: "{{ devstack_data_base_dir }}/data"
+    state: directory
+    owner: stack
+    group: stack
+    mode: 0755
+    recurse: yes
+  when: 'inventory_hostname in groups["subnode"]|default([])'
diff --git a/stack.sh b/stack.sh
index c0216f4ce9..3c316448e1 100755
--- a/stack.sh
+++ b/stack.sh
@@ -365,9 +365,12 @@ DEST=${DEST:-/opt/stack}
 
 # Create the destination directory and ensure it is writable by the user
 # and read/executable by everybody for daemons (e.g. apache run for horizon)
-sudo mkdir -p $DEST
-safe_chown -R $STACK_USER $DEST
-safe_chmod 0755 $DEST
+# If directory exists do not modify the permissions.
+if [[ ! -d $DEST ]]; then
+    sudo mkdir -p $DEST
+    safe_chown -R $STACK_USER $DEST
+    safe_chmod 0755 $DEST
+fi
 
 # Destination path for devstack logs
 if [[ -n ${LOGDIR:-} ]]; then
@@ -376,9 +379,11 @@ fi
 
 # Destination path for service data
 DATA_DIR=${DATA_DIR:-${DEST}/data}
-sudo mkdir -p $DATA_DIR
-safe_chown -R $STACK_USER $DATA_DIR
-safe_chmod 0755 $DATA_DIR
+if [[ ! -d $DATA_DIR ]]; then
+    sudo mkdir -p $DATA_DIR
+    safe_chown -R $STACK_USER $DATA_DIR
+    safe_chmod 0755 $DATA_DIR
+fi
 
 # Configure proper hostname
 # Certain services such as rabbitmq require that the local hostname resolves

From 97096e0a29fca0bc5194a8b5d7950bc244963267 Mon Sep 17 00:00:00 2001
From: Jan Gutter <jan.gutter@netronome.com>
Date: Fri, 26 Jul 2019 17:46:44 +0200
Subject: [PATCH 1574/2409] Fix benign epmd@0.0.0.0.socket failure

* The restart loop for rabbitmq-server can trigger socket activation
  of epmd without rabbitmq-server running. This can lead to 'systemctl
  status' reporting 'State: degraded' with no simple way to reset to
  'State: running'.
* It's important to note that this socket activation failure is benign
  and is not an indicator of system failure.

Change-Id: Iede4f5ebeffb59644dee4a17b6331b3cdd04d146
Signed-off-by: Jan Gutter <jan.gutter@netronome.com>
---
 lib/rpc_backend | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/lib/rpc_backend b/lib/rpc_backend
index 1c7c82fcd3..743b4ae170 100644
--- a/lib/rpc_backend
+++ b/lib/rpc_backend
@@ -66,7 +66,12 @@ EOF
             sudo systemctl restart epmd.socket epmd.service
         fi
         if is_fedora || is_suse; then
-            sudo systemctl enable rabbitmq-server
+            # NOTE(jangutter): If rabbitmq is not running (as in a fresh
+            # install) then rabbit_setuser triggers epmd@0.0.0.0.socket with
+            # socket activation. This fails the first time and does not get
+            # cleared. It is benign, but the workaround is to start rabbitmq a
+            # bit earlier for RPM based distros.
+            sudo systemctl --now enable rabbitmq-server
         fi
     fi
 }

From 0fc6b2c5a87a1884bf3cff086081b3a253cd9302 Mon Sep 17 00:00:00 2001
From: Andreas Jaeger <aj@suse.com>
Date: Tue, 30 Jul 2019 17:52:55 +0200
Subject: [PATCH 1575/2409] Update api-ref location

The api documentation is now published on docs.openstack.org instead
of developer.openstack.org. Update all links that are changed to the
new location.

Note that redirects will be set up as well but let's point now to the
new location.

For details, see:
http://lists.openstack.org/pipermail/openstack-discuss/2019-July/007828.html

Change-Id: I8a6c3403192d1416cb66cc9e92ec827b339f1270
---
 doc/source/guides/devstack-with-lbaas-v2.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/guides/devstack-with-lbaas-v2.rst b/doc/source/guides/devstack-with-lbaas-v2.rst
index 07a9bb33cc..1cd85b4de9 100644
--- a/doc/source/guides/devstack-with-lbaas-v2.rst
+++ b/doc/source/guides/devstack-with-lbaas-v2.rst
@@ -6,7 +6,7 @@ providing load balancing services for OpenStack.
 
 This guide will show you how to create a devstack with `Octavia API`_ enabled.
 
-.. _Octavia API: https://developer.openstack.org/api-ref/load-balancer/v2/index.html
+.. _Octavia API: https://docs.openstack.org/api-ref/load-balancer/v2/index.html
 
 Phase 1: Create DevStack + 2 nova instances
 --------------------------------------------

From a54919180b1316b998739f8b2ba0cc4b79c6b759 Mon Sep 17 00:00:00 2001
From: Brian Haley <bhaley@redhat.com>
Date: Wed, 31 Jul 2019 12:18:39 -0400
Subject: [PATCH 1576/2409] Un-quote metadata address if it is IPv6

In lib/neutron-legacy, the Nova metadata host address is
un-quoted if it is IPv6, i.e. 2001:db8::1, not [2001:db8::1].
We should be doing the same in lib/neutron.

Change-Id: I80c96603a41ef9d289712ef15b464859aa9257be
---
 lib/neutron | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/neutron b/lib/neutron
index a6504e8dc2..0d23d97fcf 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -54,6 +54,7 @@ NEUTRON_DHCP_BINARY="neutron-dhcp-agent"
 NEUTRON_CONF_DIR=/etc/neutron
 NEUTRON_CONF=$NEUTRON_CONF_DIR/neutron.conf
 NEUTRON_META_CONF=$NEUTRON_CONF_DIR/metadata_agent.ini
+NEUTRON_META_DATA_HOST=${NEUTRON_META_DATA_HOST:-$(ipv6_unquote $SERVICE_HOST)}
 
 NEUTRON_DHCP_CONF=$NEUTRON_CONF_DIR/dhcp_agent.ini
 NEUTRON_L3_CONF=$NEUTRON_CONF_DIR/l3_agent.ini
@@ -296,7 +297,7 @@ function configure_neutron_new {
         cp $NEUTRON_DIR/etc/metadata_agent.ini.sample $NEUTRON_META_CONF
 
         iniset $NEUTRON_META_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-        iniset $NEUTRON_META_CONF DEFAULT nova_metadata_host $SERVICE_HOST
+        iniset $NEUTRON_META_CONF DEFAULT nova_metadata_host $NEUTRON_META_DATA_HOST
         iniset $NEUTRON_META_CONF DEFAULT metadata_workers $API_WORKERS
         # TODO(ihrachys) do we really need to set rootwrap for metadata agent?
         configure_root_helper_options $NEUTRON_META_CONF

From 99bcaf5721b89a7e74b6ac8888d82e3f83b04ef4 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Wed, 31 Jul 2019 12:39:49 +0000
Subject: [PATCH 1577/2409] Add 'tempest-ipv6-only' job on devstack gate

We recently added the 'tempest-ipv6-only' job on
tempest side which will use the devstack base job
'devstack-ipv6' job and add more verification and testing
for IPv6 deployment.

Let's add that job on devstack gate also to avoid any
break due to devstack changes.

Change-Id: Ib2c85ec262b027351872e2b5a39b06a4ba1b880a
Story: #2005477
Task: #35923
---
 .zuul.yaml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index 875aed390e..9853798963 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -657,6 +657,10 @@
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
+        - tempest-ipv6-only:
+            irrelevant-files:
+              - ^.*\.rst$
+              - ^doc/.*$
     gate:
       jobs:
         - devstack
@@ -682,6 +686,10 @@
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
+        - tempest-ipv6-only:
+            irrelevant-files:
+              - ^.*\.rst$
+              - ^doc/.*$
     # Please add a note on each job and conditions for the job not
     # being experimental any more, so we can keep this list somewhat
     # pruned.

From d33cdd01f83b891b010e0fd238f1816910f3fd77 Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Thu, 1 Aug 2019 14:58:37 +0200
Subject: [PATCH 1578/2409] Add options to configure cache in nova

This patch adds new options:
* CACHE_BACKEND - with default "dogpile.cache.memcached"
* MEMCACHE_SERVERS - with default "localhost:1121"

to add possibility to configure various backends as cache in
Nova and Keystone.
It also adds options:
* KEYSTONE_ENABLE_CACHE - True by default
* NOVA_ENABLE_CACHE - True by default

To make possibility to enable and disable cache in those projects'
config files.

Default values configured there are the same as before were
hardcoded for Keystone config.

Nova has also enabled this cache by default.

Change-Id: I9082be077b59acd3a39910fa64e29147cb5c2dd7
Closes-Bug: #1836642
---
 lib/keystone |  9 ++++++---
 lib/nova     | 12 ++++++++++--
 stackrc      |  4 ++++
 3 files changed, 20 insertions(+), 5 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 5bd552f557..9ceb829264 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -131,6 +131,9 @@ KEYSTONE_UNIQUE_LAST_PASSWORD_COUNT=${KEYSTONE_UNIQUE_LAST_PASSWORD_COUNT:-2}
 # however may not be suitable for real production.
 KEYSTONE_PASSWORD_HASH_ROUNDS=${KEYSTONE_PASSWORD_HASH_ROUNDS:-4}
 
+# Cache settings
+KEYSTONE_ENABLE_CACHE=${KEYSTONE_ENABLE_CACHE:-True}
+
 # Functions
 # ---------
 
@@ -213,9 +216,9 @@ function configure_keystone {
     iniset $KEYSTONE_CONF resource driver "$KEYSTONE_RESOURCE_BACKEND"
 
     # Enable caching
-    iniset $KEYSTONE_CONF cache enabled "True"
-    iniset $KEYSTONE_CONF cache backend "dogpile.cache.memcached"
-    iniset $KEYSTONE_CONF cache memcache_servers localhost:11211
+    iniset $KEYSTONE_CONF cache enabled $KEYSTONE_ENABLE_CACHE
+    iniset $KEYSTONE_CONF cache backend $CACHE_BACKEND
+    iniset $KEYSTONE_CONF cache memcache_servers $MEMCACHE_SERVERS
 
     iniset_rpc_backend keystone $KEYSTONE_CONF oslo_messaging_notifications
 
diff --git a/lib/nova b/lib/nova
index e3f8655b1a..0a2becb0dc 100644
--- a/lib/nova
+++ b/lib/nova
@@ -91,6 +91,7 @@ NOVA_SERVICE_PROTOCOL=${NOVA_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 NOVA_SERVICE_LOCAL_HOST=${NOVA_SERVICE_LOCAL_HOST:-$SERVICE_LOCAL_HOST}
 NOVA_SERVICE_LISTEN_ADDRESS=${NOVA_SERVICE_LISTEN_ADDRESS:-$(ipv6_unquote $SERVICE_LISTEN_ADDRESS)}
 METADATA_SERVICE_PORT=${METADATA_SERVICE_PORT:-8775}
+NOVA_ENABLE_CACHE=${NOVA_ENABLE_CACHE:-True}
 
 # Option to enable/disable config drive
 # NOTE: Set ``FORCE_CONFIG_DRIVE="False"`` to turn OFF config drive
@@ -416,8 +417,8 @@ function create_nova_conf {
         iniset $NOVA_CONF DEFAULT bindir "/usr/bin"
     fi
 
-    # only setup database connections if there are services that
-    # require them running on the host. The ensures that n-cpu doesn't
+    # only setup database connections and cache backend if there are services
+    # that require them running on the host. The ensures that n-cpu doesn't
     # leak a need to use the db in a multinode scenario.
     if is_service_enabled n-api n-cond n-sched; then
         # If we're in multi-tier cells mode, we want our control services pointing
@@ -434,6 +435,13 @@ function create_nova_conf {
 
         iniset $NOVA_CONF database connection `database_connection_url $db`
         iniset $NOVA_CONF api_database connection `database_connection_url nova_api`
+
+        # Cache related settings
+        # Those settings aren't really needed in n-cpu thus it is configured
+        # only on nodes which runs controller services
+        iniset $NOVA_CONF cache enabled $NOVA_ENABLE_CACHE
+        iniset $NOVA_CONF cache backend $CACHE_BACKEND
+        iniset $NOVA_CONF cache memcache_servers $MEMCACHE_SERVERS
     fi
 
     if is_service_enabled n-api; then
diff --git a/stackrc b/stackrc
index 4ac8c0338e..10117f2700 100644
--- a/stackrc
+++ b/stackrc
@@ -770,6 +770,10 @@ ETCD_DOWNLOAD_LOCATION=$ETCD_DOWNLOAD_URL/$ETCD_VERSION/$ETCD_DOWNLOAD_FILE
 # etcd is always required, so place it into list of pre-cached downloads
 EXTRA_CACHE_URLS+=",$ETCD_DOWNLOAD_LOCATION"
 
+# Cache settings
+CACHE_BACKEND=${CACHE_BACKEND:-"dogpile.cache.memcached"}
+MEMCACHE_SERVERS=${MEMCACHE_SERVERS:-"localhost:11211"}
+
 # Detect duplicate values in IMAGE_URLS
 for image_url in ${IMAGE_URLS//,/ }; do
     if [ $(echo "$IMAGE_URLS" | grep -o -F "$image_url" | wc -l) -gt 1 ]; then

From 474f535a14598133728fedda884b437b1ce6e5e2 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Thu, 8 Aug 2019 09:15:11 +1000
Subject: [PATCH 1579/2409] oscwrap: make a little quieter

A huge part of the logs is irrelevant bash aliases captured by the
openstack client timing wrapper from the run of "openstack complete",
which is only helpful on interactive systems where you'll interact
with the command line.  Call it directly to avoid capturing the logs.

While we're here, turn off tracing inside the oscwrap function, which
is called frequently.  It's not useful for debugging.

Change-Id: I1cb5399fe7ee6f0e547a9cfff70396aa2007632e
---
 functions-common | 5 +++++
 stack.sh         | 5 ++++-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index e234523fdd..a13d611415 100644
--- a/functions-common
+++ b/functions-common
@@ -2354,6 +2354,10 @@ function time_stop {
 }
 
 function oscwrap {
+    local xtrace
+    xtrace=$(set +o | grep xtrace)
+    set +o xtrace
+
     local out
     local rc
     local start
@@ -2368,6 +2372,7 @@ function oscwrap {
     echo $((end - start)) >> $OSCWRAP_TIMER_FILE
 
     echo "$out"
+    $xtrace
     return $rc
 }
 
diff --git a/stack.sh b/stack.sh
index 3c316448e1..a19799501b 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1475,7 +1475,10 @@ fi
 # ===============
 
 # Prepare bash completion for OSC
-openstack complete | sudo tee /etc/bash_completion.d/osc.bash_completion > /dev/null
+# Note we use "command" to avoid the timing wrapper
+# which isn't relevant here and floods logs
+command openstack complete \
+    | sudo tee /etc/bash_completion.d/osc.bash_completion > /dev/null
 
 # If cinder is configured, set global_filter for PV devices
 if is_service_enabled cinder; then

From 6c7337e80ee10ed180df284e492d36fa1f60ebc2 Mon Sep 17 00:00:00 2001
From: Adam Spiers <aspiers@suse.com>
Date: Wed, 7 Aug 2019 14:34:56 +0100
Subject: [PATCH 1580/2409] Make stop/disable of apparmor work on all SLE
 systems

The existing code to disable apparmor on SUSE systems only worked for
recent openSUSE / SLE releases.  On SLE12 (at least), aa-enabled and
aa-teardown are not available, so instead use systemd's interface for
stop/disable.  However on newer releases, systemctl stop apparmor is a
no-op:

    https://www.suse.com/releasenotes/x86_64/SUSE-SLES/15/#fate-325343
    https://gitlab.com/apparmor/apparmor/merge_requests/81
    https://build.opensuse.org/package/view_file/openSUSE:Leap:15.2/apparmor/apparmor.service?expand=1

So we still need to call aa-teardown if it's available.

Change-Id: I8d99c8d743cc1935324e2e4fcb67efaa5241199e
---
 tools/fixup_stuff.sh | 20 ++++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index 037928f298..d7b824c048 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -230,12 +230,24 @@ function fixup_suse {
         return
     fi
 
-    # Disable apparmor profiles in openSUSE distros
-    # to avoid issues with haproxy and dnsmasq
-    if [ -x /usr/sbin/aa-enabled ] && sudo /usr/sbin/aa-enabled -q; then
-        sudo systemctl disable apparmor
+    # Deactivate and disable apparmor profiles in openSUSE and SLE
+    # distros to avoid issues with haproxy and dnsmasq.  In newer
+    # releases, systemctl stop apparmor is actually a no-op, so we
+    # have to use aa-teardown to make sure we've deactivated the
+    # profiles:
+    #
+    # https://www.suse.com/releasenotes/x86_64/SUSE-SLES/15/#fate-325343
+    # https://gitlab.com/apparmor/apparmor/merge_requests/81
+    # https://build.opensuse.org/package/view_file/openSUSE:Leap:15.2/apparmor/apparmor.service?expand=1
+    if sudo systemctl is-active -q apparmor; then
+        sudo systemctl stop apparmor
+    fi
+    if [ -x /usr/sbin/aa-teardown ]; then
         sudo /usr/sbin/aa-teardown
     fi
+    if sudo systemctl is-enabled -q apparmor; then
+        sudo systemctl disable apparmor
+    fi
 
     # Since pip10, pip will refuse to uninstall files from packages
     # that were created with distutils (rather than more modern

From 0a3288c1b40a4338df351a3fef9a346e78e12191 Mon Sep 17 00:00:00 2001
From: melanie witt <melwittt@gmail.com>
Date: Fri, 9 Aug 2019 15:57:50 +0000
Subject: [PATCH 1581/2409] Set console server host/address in nova-cpu.conf
 for multi-host

Currently, the console server host and listen address on the compute
host is always being set to localhost. This works fine in a single
node all-in-one deployment, but will not work properly when
nova-compute is running on a separate host in a multi-node deployment.

This sets the console server host and listen address on the compute
host to the nova host IP and service listen address instead of the
localhost.

Co-Authored-By: Matt Riedemann <mriedem.os@gmail.com>

Closes-Bug: #1669468

Change-Id: Id8b0b4159b98c7ff3c85ec3daa03d556d9897ce9
---
 lib/nova | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/lib/nova b/lib/nova
index 7cc408d764..fb106d7e29 100644
--- a/lib/nova
+++ b/lib/nova
@@ -88,7 +88,6 @@ NOVA_SERVICE_HOST=${NOVA_SERVICE_HOST:-$SERVICE_HOST}
 NOVA_SERVICE_PORT=${NOVA_SERVICE_PORT:-8774}
 NOVA_SERVICE_PORT_INT=${NOVA_SERVICE_PORT_INT:-18774}
 NOVA_SERVICE_PROTOCOL=${NOVA_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
-NOVA_SERVICE_LOCAL_HOST=${NOVA_SERVICE_LOCAL_HOST:-$SERVICE_LOCAL_HOST}
 NOVA_SERVICE_LISTEN_ADDRESS=${NOVA_SERVICE_LISTEN_ADDRESS:-$(ipv6_unquote $SERVICE_LISTEN_ADDRESS)}
 METADATA_SERVICE_PORT=${METADATA_SERVICE_PORT:-8775}
 NOVA_ENABLE_CACHE=${NOVA_ENABLE_CACHE:-True}
@@ -597,6 +596,11 @@ function configure_console_compute {
     local offset
     offset=$(((NOVA_CPU_CELL - 1) * 4))
 
+    # Use the host IP instead of the service host because for multi-node, the
+    # service host will be the controller only.
+    local default_proxyclient_addr
+    default_proxyclient_addr=$(iniget $NOVA_CPU_CONF DEFAULT my_ip)
+
     # All nova-compute workers need to know the vnc configuration options
     # These settings don't hurt anything if n-xvnc and n-novnc are disabled
     if is_service_enabled n-cpu; then
@@ -620,8 +624,8 @@ function configure_console_compute {
     if is_service_enabled n-novnc || is_service_enabled n-xvnc || [ "$NOVA_VNC_ENABLED" != False ]; then
         # Address on which instance vncservers will listen on compute hosts.
         # For multi-host, this should be the management ip of the compute host.
-        VNCSERVER_LISTEN=${VNCSERVER_LISTEN:-$NOVA_SERVICE_LOCAL_HOST}
-        VNCSERVER_PROXYCLIENT_ADDRESS=${VNCSERVER_PROXYCLIENT_ADDRESS:-$NOVA_SERVICE_LOCAL_HOST}
+        VNCSERVER_LISTEN=${VNCSERVER_LISTEN:-$NOVA_SERVICE_LISTEN_ADDRESS}
+        VNCSERVER_PROXYCLIENT_ADDRESS=${VNCSERVER_PROXYCLIENT_ADDRESS:-$default_proxyclient_addr}
         iniset $NOVA_CPU_CONF vnc server_listen "$VNCSERVER_LISTEN"
         iniset $NOVA_CPU_CONF vnc server_proxyclient_address "$VNCSERVER_PROXYCLIENT_ADDRESS"
     else
@@ -631,8 +635,8 @@ function configure_console_compute {
     if is_service_enabled n-spice; then
         # Address on which instance spiceservers will listen on compute hosts.
         # For multi-host, this should be the management ip of the compute host.
-        SPICESERVER_PROXYCLIENT_ADDRESS=${SPICESERVER_PROXYCLIENT_ADDRESS=$NOVA_SERVICE_LOCAL_HOST}
-        SPICESERVER_LISTEN=${SPICESERVER_LISTEN=$NOVA_SERVICE_LOCAL_HOST}
+        SPICESERVER_PROXYCLIENT_ADDRESS=${SPICESERVER_PROXYCLIENT_ADDRESS:-$default_proxyclient_addr}
+        SPICESERVER_LISTEN=${SPICESERVER_LISTEN:-$NOVA_SERVICE_LISTEN_ADDRESS}
         iniset $NOVA_CPU_CONF spice enabled true
         iniset $NOVA_CPU_CONF spice server_listen "$SPICESERVER_LISTEN"
         iniset $NOVA_CPU_CONF spice server_proxyclient_address "$SPICESERVER_PROXYCLIENT_ADDRESS"

From 8dd89e52d04da2230914deceaee7c4d41e73ccc2 Mon Sep 17 00:00:00 2001
From: Andreas Jaeger <aj@suse.com>
Date: Sun, 11 Aug 2019 16:00:12 +0200
Subject: [PATCH 1582/2409] Update docs building

Switch to "modern" way of building docs using sphinx-build directly,
remove now unsed parts from setup.cfg.

Upgrade to openstackdocstheme 1.20 and remove obsolete variables from
conf.py.

Convert external links to internal RST links so that Sphinx can verify
that they are correct.

Replace redirected links with new targets.

Use opendev.org instead of github.com where appropriate.

Change-Id: Iedcc008b170821aa74acefc02ec6a243a0dc307c
---
 HACKING.rst                                  |  2 +-
 doc/requirements.txt                         |  2 +-
 doc/source/conf.py                           | 26 ++++----------------
 doc/source/configuration.rst                 |  4 ++-
 doc/source/guides/devstack-with-lbaas-v2.rst |  2 +-
 doc/source/guides/nova.rst                   |  4 +--
 doc/source/guides/single-vm.rst              |  2 +-
 doc/source/plugins.rst                       |  2 +-
 doc/source/systemd.rst                       |  2 +-
 doc/source/zuul_ci_jobs_migration.rst        |  2 +-
 setup.cfg                                    |  9 -------
 tools/xen/README.md                          |  2 +-
 tox.ini                                      |  3 ++-
 13 files changed, 20 insertions(+), 42 deletions(-)

diff --git a/HACKING.rst b/HACKING.rst
index f6951064ae..f0bb269cb3 100644
--- a/HACKING.rst
+++ b/HACKING.rst
@@ -189,7 +189,7 @@ to enforce basic guidelines, similar to pep8 and flake8 tools for Python. The
 list below is not complete for what bashate checks, nor is it all checked
 by bashate.  So many lines of code, so little time.
 
-.. _bashate: https://pypi.python.org/pypi/bashate
+.. _bashate: https://pypi.org/project/bashate/
 
 Whitespace Rules
 ----------------
diff --git a/doc/requirements.txt b/doc/requirements.txt
index f65e9dfece..fffb83d96b 100644
--- a/doc/requirements.txt
+++ b/doc/requirements.txt
@@ -3,7 +3,7 @@ pbr>=2.0.0,!=2.1.0
 Pygments
 docutils
 sphinx>=1.6.2
-openstackdocstheme>=1.11.0
+openstackdocstheme>=1.20.0
 nwdiag
 blockdiag
 sphinxcontrib-blockdiag
diff --git a/doc/source/conf.py b/doc/source/conf.py
index e9708fae1d..9059f8c678 100644
--- a/doc/source/conf.py
+++ b/doc/source/conf.py
@@ -11,9 +11,6 @@
 # All configuration values have a default; values that are commented out
 # serve to show the default.
 
-import sys
-import os
-
 # If extensions (or modules to document with autodoc) are in another directory,
 # add these directories to sys.path here. If the directory is relative to the
 # documentation root, use os.path.abspath to make it absolute, like shown here.
@@ -26,13 +23,16 @@
 
 # Add any Sphinx extension module names here, as strings. They can be extensions
 # coming with Sphinx (named 'sphinx.ext.*') or your custom ones.
-extensions = [ 'sphinx.ext.autodoc', 'zuul_sphinx', 'openstackdocstheme', 'sphinxcontrib.blockdiag', 'sphinxcontrib.nwdiag' ]
+extensions = [ 'sphinx.ext.autodoc',
+               'zuul_sphinx',
+               'openstackdocstheme',
+               'sphinxcontrib.blockdiag',
+               'sphinxcontrib.nwdiag' ]
 
 # openstackdocstheme options
 repository_name = 'openstack-dev/devstack'
 bug_project = 'devstack'
 bug_tag = ''
-html_last_updated_fmt = '%Y-%m-%d %H:%M'
 
 todo_include_todos = True
 
@@ -119,11 +119,6 @@
 # pixels large.
 #html_favicon = None
 
-# If not '', a 'Last updated on:' timestamp is inserted at every page bottom,
-# using the given strftime format.
-git_cmd = "git log --pretty=format:'%ad, commit %h' --date=local -n1"
-html_last_updated_fmt = os.popen(git_cmd).read()
-
 # If true, SmartyPants will be used to convert quotes and dashes to
 # typographically correct entities.
 #html_use_smartypants = True
@@ -167,17 +162,6 @@
 
 # -- Options for LaTeX output --------------------------------------------------
 
-latex_elements = {
-# The paper size ('letterpaper' or 'a4paper').
-#'papersize': 'letterpaper',
-
-# The font size ('10pt', '11pt' or '12pt').
-#'pointsize': '10pt',
-
-# Additional stuff for the LaTeX preamble.
-#'preamble': '',
-}
-
 # Grouping the document tree into LaTeX files. List of tuples
 # (source start file, target name, title, author, documentclass [howto/manual]).
 latex_documents = [
diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 0105d5e636..45f4ffe6e9 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -259,6 +259,8 @@ changed from the default value.
 Logging
 -------
 
+.. _enable_logging:
+
 Enable Logging
 ~~~~~~~~~~~~~~
 
@@ -495,7 +497,7 @@ should be specified in the configuration file so Tempest selects the
 default flavors instead.
 
 KVM on Power with QEMU 2.4 requires 512 MB to load the firmware -
-`QEMU 2.4 - PowerPC <http://wiki.qemu.org/ChangeLog/2.4>`__ so users
+`QEMU 2.4 - PowerPC <https://wiki.qemu.org/ChangeLog/2.4>`__ so users
 running instances on ppc64/ppc64le can choose one of the default
 created flavors as follows:
 
diff --git a/doc/source/guides/devstack-with-lbaas-v2.rst b/doc/source/guides/devstack-with-lbaas-v2.rst
index 1cd85b4de9..669a70d0bb 100644
--- a/doc/source/guides/devstack-with-lbaas-v2.rst
+++ b/doc/source/guides/devstack-with-lbaas-v2.rst
@@ -39,7 +39,7 @@ Edit your ``/opt/stack/devstack/local.conf`` to look like
     # If you are enabling horizon, include the octavia dashboard
     # enable_plugin octavia-dashboard https://opendev.org/openstack/octavia-dashboard.git
     # If you are enabling barbican for TLS offload in Octavia, include it here.
-    # enable_plugin barbican https://github.com/openstack/barbican.git
+    # enable_plugin barbican https://opendev.org/openstack/barbican
 
     # If you have python3 available:
     # USE_PYTHON3=True
diff --git a/doc/source/guides/nova.rst b/doc/source/guides/nova.rst
index 2271e2321b..5b427972c4 100644
--- a/doc/source/guides/nova.rst
+++ b/doc/source/guides/nova.rst
@@ -10,7 +10,7 @@ nova-serialproxy
 ================
 
 In Juno, nova implemented a `spec
-<http://specs.openstack.org/openstack/nova-specs/specs/juno/implemented/serial-ports.html>`_
+<https://specs.openstack.org/openstack/nova-specs/specs/juno/implemented/serial-ports.html>`_
 to allow read/write access to the serial console of an instance via
 `nova-serialproxy
 <https://docs.openstack.org/nova/latest/cli/nova-serialproxy.html>`_.
@@ -63,7 +63,7 @@ The service can be enabled by adding ``n-sproxy`` to
 Enabling the service is enough to be functional for a single machine DevStack.
 
 These config options are defined in `nova.conf.serial_console
-<https://github.com/openstack/nova/blob/master/nova/conf/serial_console.py>`_.
+<https://opendev.org/openstack/nova/src/master/nova/conf/serial_console.py>`_.
 
 For more information on OpenStack configuration see the `OpenStack
 Compute Service Configuration Reference
diff --git a/doc/source/guides/single-vm.rst b/doc/source/guides/single-vm.rst
index 8ebf2a638d..7dac18b333 100644
--- a/doc/source/guides/single-vm.rst
+++ b/doc/source/guides/single-vm.rst
@@ -78,7 +78,7 @@ As DevStack will refuse to run as root, this configures ``cloud-init``
 to create a non-root user and run the ``start.sh`` script as that user.
 
 If you are using cloud-init and you have not
-`enabled custom logging <../configuration.html#enable-logging>`_ of the stack
+:ref:`enabled custom logging <enable_logging>` of the stack
 output, then the stack output can be found in
 ``/var/log/cloud-init-output.log`` by default.
 
diff --git a/doc/source/plugins.rst b/doc/source/plugins.rst
index 2484569d35..a18a786c49 100644
--- a/doc/source/plugins.rst
+++ b/doc/source/plugins.rst
@@ -332,6 +332,6 @@ See Also
 ========
 
 For additional inspiration on devstack plugins you can check out the
-`Plugin Registry <plugin-registry.html>`_.
+:doc:`Plugin Registry <plugin-registry>`.
 
 .. _service types authority: https://specs.openstack.org/openstack/service-types-authority/
diff --git a/doc/source/systemd.rst b/doc/source/systemd.rst
index 1bc9911879..15b3f75660 100644
--- a/doc/source/systemd.rst
+++ b/doc/source/systemd.rst
@@ -194,7 +194,7 @@ Telnet to that port to enter the pdb session::
 
 See the `remote-pdb`_ home page for more options.
 
-.. _`remote-pdb`: https://pypi.python.org/pypi/remote-pdb
+.. _`remote-pdb`: https://pypi.org/project/remote-pdb/
 
 Known Issues
 ============
diff --git a/doc/source/zuul_ci_jobs_migration.rst b/doc/source/zuul_ci_jobs_migration.rst
index dbb79893db..ed97d4cf34 100644
--- a/doc/source/zuul_ci_jobs_migration.rst
+++ b/doc/source/zuul_ci_jobs_migration.rst
@@ -190,7 +190,7 @@ DEVSTACK_GATE_NET_OVERLAY                       zuul-jobs     A bridge called
                                                               br-infra is set up for
                                                               all jobs that inherit
                                                               from multinode with
-                                                              a dedicated `bridge role <https://docs.openstack.org/infra/zuul-jobs/roles.html#role-multi-node-bridge>`_.
+                                                              a dedicated `bridge role <https://zuul-ci.org/docs/zuul-jobs/general-roles.html#role-multi-node-bridge>`_.
 DEVSTACK_GATE_FEATURE_MATRIX                    devstack-gate ``test_matrix_features``
                                                               variable of the
                                                               test-matrix role in
diff --git a/setup.cfg b/setup.cfg
index 825d386026..4e27ad80d8 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -11,14 +11,5 @@ classifier =
     License :: OSI Approved :: Apache Software License
     Operating System :: POSIX :: Linux
 
-[build_sphinx]
-all_files = 1
-build-dir = doc/build
-source-dir = doc/source
-warning-is-error = 1
-
-[pbr]
-warnerrors = True
-
 [wheel]
 universal = 1
diff --git a/tools/xen/README.md b/tools/xen/README.md
index 22263bb074..287301156e 100644
--- a/tools/xen/README.md
+++ b/tools/xen/README.md
@@ -1,3 +1,3 @@
 Note: XenServer relative tools have been moved to `os-xenapi`_ and be maintained there.
 
-.. _os-xenapi: https://github.com/openstack/os-xenapi/
+.. _os-xenapi: https://opendev.org/x/os-xenapi/
diff --git a/tox.ini b/tox.ini
index f643fdb930..d81107fe1a 100644
--- a/tox.ini
+++ b/tox.ini
@@ -41,7 +41,8 @@ whitelist_externals = bash
 setenv =
   TOP_DIR={toxinidir}
 commands =
-  python setup.py build_sphinx
+  sphinx-build -W -b html -d doc/build/doctrees doc/source doc/build/html
+
 
 [testenv:venv]
 basepython = python3

From 0fe25e31a8ff40d76279e55c731fd31a93f0d21c Mon Sep 17 00:00:00 2001
From: Julia Kreger <jkreger@gmail.com>
Date: Thu, 20 Jun 2019 20:39:53 -0700
Subject: [PATCH 1583/2409] Add the IPv6 IP to the TLS cert

For some crazy reason, we've forgotten about trying
to use IPv6 addresses directly with the SSL certificates.

So lets add some logic so clients can connect directly
with the v6 IP.

Change-Id: Ie8b8a2d99945f028bebe805b83bfd863b7b72d57
---
 lib/tls | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/tls b/lib/tls
index 0032449e13..65ffeb937d 100644
--- a/lib/tls
+++ b/lib/tls
@@ -234,6 +234,9 @@ function init_cert {
                 # see https://bugs.python.org/issue23239
                 TLS_IP="DNS:$TLS_IP,IP:$TLS_IP"
             fi
+            if [[ -n "$HOST_IPV6" ]]; then
+                TLS_IP="$TLS_IP,IP:$HOST_IPV6"
+            fi
         fi
         make_cert $INT_CA_DIR $DEVSTACK_CERT_NAME $DEVSTACK_HOSTNAME "$TLS_IP"
 

From d3a2fcf48597ab7486a193567a02e650188370dc Mon Sep 17 00:00:00 2001
From: Andreas Jaeger <aj@suse.com>
Date: Tue, 13 Aug 2019 19:27:06 +0200
Subject: [PATCH 1584/2409] Use list tables

Reformat overlong table into a list-table to make it easier to edit.
The change contains no wording changes besides giving titles to the
list-tables.

Fix formatting for setup-devstack-source-dirs so that the variable does
not get displayed with a grey bar at
https://docs.openstack.org/devstack/latest/zuul_roles.html#role-setup-devstack-source-dirs

Change-Id: I7378d46c507b1d86f1d5319655a55f2a8c5a8f60
---
 doc/source/zuul_ci_jobs_migration.rst       | 256 +++++++++++---------
 roles/setup-devstack-source-dirs/README.rst |   6 +-
 2 files changed, 143 insertions(+), 119 deletions(-)

diff --git a/doc/source/zuul_ci_jobs_migration.rst b/doc/source/zuul_ci_jobs_migration.rst
index ed97d4cf34..17e7e16fb7 100644
--- a/doc/source/zuul_ci_jobs_migration.rst
+++ b/doc/source/zuul_ci_jobs_migration.rst
@@ -180,123 +180,147 @@ the same or a similar behaviour in Zuul v3 jobs. For localrc settings,
 devstack-gate defined a default value. In ansible jobs the default is either the
 value defined in the parent job, or the default from DevStack, if any.
 
-==============================================  ============= ==================
-DevStack gate flag                              Repo          New implementation
-==============================================  ============= ==================
-OVERRIDE_ZUUL_BRANCH                            zuul          override-checkout:
-                                                              [branch]
-                                                              in the job definition.
-DEVSTACK_GATE_NET_OVERLAY                       zuul-jobs     A bridge called
-                                                              br-infra is set up for
-                                                              all jobs that inherit
-                                                              from multinode with
-                                                              a dedicated `bridge role <https://zuul-ci.org/docs/zuul-jobs/general-roles.html#role-multi-node-bridge>`_.
-DEVSTACK_GATE_FEATURE_MATRIX                    devstack-gate ``test_matrix_features``
-                                                              variable of the
-                                                              test-matrix role in
-                                                              devstack-gate. This
-                                                              is a temporary
-                                                              solution, feature
-                                                              matrix will go away.
-                                                              In the future services
-                                                              will be defined in
-                                                              jobs only.
-DEVSTACK_CINDER_VOLUME_CLEAR                    devstack      *CINDER_VOLUME_CLEAR: true/false*
-                                                              in devstack_localrc
-                                                              in the job vars.
-DEVSTACK_GATE_NEUTRON                           devstack      True by default. To
-                                                              disable, disable all
-                                                              neutron services in
-                                                              devstack_services in
-                                                              the job definition.
-DEVSTACK_GATE_CONFIGDRIVE                       devstack      *FORCE_CONFIG_DRIVE: true/false*
-                                                              in devstack_localrc
-                                                              in the job vars.
-DEVSTACK_GATE_INSTALL_TESTONLY                  devstack      *INSTALL_TESTONLY_PACKAGES: true/false*
-                                                              in devstack_localrc
-                                                              in the job vars.
-DEVSTACK_GATE_VIRT_DRIVER                       devstack      *VIRT_DRIVER: [virt driver]*
-                                                              in devstack_localrc
-                                                              in the job vars.
-DEVSTACK_GATE_LIBVIRT_TYPE                      devstack      *LIBVIRT_TYPE: [libvirt type]*
-                                                              in devstack_localrc
-                                                              in the job vars.
-DEVSTACK_GATE_TEMPEST                           devstack      Defined by the job
-                                                tempest       that is used. The
-                                                              ``devstack`` job only
-                                                              runs devstack.
-                                                              The ``devstack-tempest``
-                                                              one triggers a Tempest
-                                                              run as well.
-DEVSTACK_GATE_TEMPEST_FULL                      tempest       *tox_envlist: full*
-                                                              in the job vars.
-DEVSTACK_GATE_TEMPEST_ALL                       tempest       *tox_envlist: all*
-                                                              in the job vars.
-DEVSTACK_GATE_TEMPEST_ALL_PLUGINS               tempest       *tox_envlist: all-plugin*
-                                                              in the job vars.
-DEVSTACK_GATE_TEMPEST_SCENARIOS                 tempest       *tox_envlist: scenario*
-                                                              in the job vars.
-TEMPEST_CONCURRENCY                             tempest       *tempest_concurrency: [value]*
-                                                              in the job vars. This
-                                                              is available only on
-                                                              jobs that inherit from
-                                                              ``devstack-tempest``
-                                                              down.
-DEVSTACK_GATE_TEMPEST_NOTESTS                   tempest       *tox_envlist: venv-tempest*
-                                                              in the job vars. This
-                                                              will create Tempest
-                                                              virtual environment
-                                                              but run no tests.
-DEVSTACK_GATE_SMOKE_SERIAL                      tempest       *tox_envlist: smoke-serial*
-                                                              in the job vars.
-DEVSTACK_GATE_TEMPEST_DISABLE_TENANT_ISOLATION  tempest       *tox_envlist: full-serial*
-                                                              in the job vars.
-                                                              *TEMPEST_ALLOW_TENANT_ISOLATION: false*
-                                                              in devstack_localrc in
-                                                              the job vars.
-==============================================  ============= ==================
+.. list-table:: **DevStack Gate Flags**
+   :widths: 20 10 60
+   :header-rows: 1
+
+   * - DevStack gate flag
+     - Repo
+     - New implementation
+   * - OVERRIDE_ZUUL_BRANCH
+     - zuul
+     - override-checkout: [branch] in the job definition.
+   * - DEVSTACK_GATE_NET_OVERLAY
+     - zuul-jobs
+     - A bridge called br-infra is set up for all jobs that inherit
+       from multinode with a dedicated `bridge role
+       <https://zuul-ci.org/docs/zuul-jobs/general-roles.html#role-multi-node-bridge>`_.
+   * - DEVSTACK_GATE_FEATURE_MATRIX
+     - devstack-gate
+     - ``test_matrix_features`` variable of the test-matrix role in
+       devstack-gate. This is a temporary solution, feature matrix
+       will go away. In the future services will be defined in jobs
+       only.
+   * - DEVSTACK_CINDER_VOLUME_CLEAR
+     - devstack
+     - *CINDER_VOLUME_CLEAR: true/false* in devstack_localrc in the
+       job vars.
+   * - DEVSTACK_GATE_NEUTRON
+     - devstack
+     - True by default. To disable, disable all neutron services in
+       devstack_services in the job definition.
+   * - DEVSTACK_GATE_CONFIGDRIVE
+     - devstack
+     - *FORCE_CONFIG_DRIVE: true/false* in devstack_localrc in the job
+       vars.
+   * - DEVSTACK_GATE_INSTALL_TESTONLY
+     - devstack
+     - *INSTALL_TESTONLY_PACKAGES: true/false* in devstack_localrc in
+       the job vars.
+   * - DEVSTACK_GATE_VIRT_DRIVER
+     - devstack
+     - *VIRT_DRIVER: [virt driver]* in devstack_localrc in the job
+       vars.
+   * - DEVSTACK_GATE_LIBVIRT_TYPE
+     - devstack
+     - *LIBVIRT_TYPE: [libvirt type]* in devstack_localrc in the job
+       vars.
+   * - DEVSTACK_GATE_TEMPEST
+     - devstack and tempest
+     - Defined by the job that is used. The ``devstack`` job only runs
+       devstack. The ``devstack-tempest`` one triggers a Tempest run
+       as well.
+   * - DEVSTACK_GATE_TEMPEST_FULL
+     - tempest
+     - *tox_envlist: full* in the job vars.
+   * - DEVSTACK_GATE_TEMPEST_ALL
+     - tempest
+     - *tox_envlist: all* in the job vars.
+   * - DEVSTACK_GATE_TEMPEST_ALL_PLUGINS
+     - tempest
+     - *tox_envlist: all-plugin* in the job vars.
+   * - DEVSTACK_GATE_TEMPEST_SCENARIOS
+     - tempest
+     - *tox_envlist: scenario* in the job vars.
+   * - TEMPEST_CONCURRENCY
+     - tempest
+     - *tempest_concurrency: [value]* in the job vars. This is
+       available only on jobs that inherit from ``devstack-tempest``
+       down.
+   * - DEVSTACK_GATE_TEMPEST_NOTESTS
+     - tempest
+     - *tox_envlist: venv-tempest* in the job vars. This will create
+       Tempest virtual environment but run no tests.
+   * - DEVSTACK_GATE_SMOKE_SERIAL
+     - tempest
+     - *tox_envlist: smoke-serial* in the job vars.
+   * - DEVSTACK_GATE_TEMPEST_DISABLE_TENANT_ISOLATION
+     - tempest
+     - *tox_envlist: full-serial* in the job vars.
+       *TEMPEST_ALLOW_TENANT_ISOLATION: false* in devstack_localrc in
+       the job vars.
+
 
 The following flags have not been migrated yet or are legacy and won't be
 migrated at all.
 
-=====================================  ======  ==========================
-DevStack gate flag                     Status  Details
-=====================================  ======  ==========================
-DEVSTACK_GATE_TOPOLOGY                 WIP     The topology depends on the base
-                                               job that is used and more
-                                               specifically on the nodeset
-                                               attached to it. The new job
-                                               format allows project to define
-                                               the variables to be passed to
-                                               every node/node-group that exists
-                                               in the topology. Named topologies
-                                               that include the nodeset and the
-                                               matching variables can be defined
-                                               in the form of base jobs.
-DEVSTACK_GATE_GRENADE                  TBD     Grenade Zuul V3 jobs will be
-                                               hosted in the grenade repo.
-GRENADE_BASE_BRANCH                    TBD     Grenade Zuul V3 jobs will be
-                                               hosted in the grenade repo.
-DEVSTACK_GATE_NEUTRON_DVR              TBD     Depends on multinode support.
-DEVSTACK_GATE_EXERCISES                TBD     Can be done on request.
-DEVSTACK_GATE_IRONIC                   TBD     This will probably be implemented
-                                               on ironic side.
-DEVSTACK_GATE_IRONIC_DRIVER            TBD     This will probably be implemented
-                                               on ironic side.
-DEVSTACK_GATE_IRONIC_BUILD_RAMDISK     TBD     This will probably be implemented
-                                               on ironic side.
-DEVSTACK_GATE_POSTGRES                 Legacy  This flag exists in d-g but the
-                                               only thing that it does is
-                                               capture postgres logs. This is
-                                               already supported by the roles in
-                                               post, so the flag is useless in
-                                               the new jobs. postgres itself can
-                                               be enabled via the
-                                               devstack_service job variable.
-DEVSTACK_GATE_ZEROMQ                   Legacy  This has no effect in d-g.
-DEVSTACK_GATE_MQ_DRIVER                Legacy  This has no effect in d-g.
-DEVSTACK_GATE_TEMPEST_STRESS_ARGS      Legacy  Stress is not in Tempest anymore.
-DEVSTACK_GATE_TEMPEST_HEAT_SLOW        Legacy  This is not used anywhere.
-DEVSTACK_GATE_CELLS                    Legacy  This has no effect in d-g.
-DEVSTACK_GATE_NOVA_API_METADATA_SPLIT  Legacy  This has no effect in d-g.
-=====================================  ======  ==========================
+.. list-table:: **Not Migrated DevStack Gate Flags**
+   :widths: 20 10 60
+   :header-rows: 1
+
+   * - DevStack gate flag
+     - Status
+     - Details
+   * - DEVSTACK_GATE_TOPOLOGY
+     - WIP
+     - The topology depends on the base job that is used and more
+       specifically on the nodeset attached to it. The new job format
+       allows project to define the variables to be passed to every
+       node/node-group that exists in the topology. Named topologies
+       that include the nodeset and the matching variables can be
+       defined in the form of base jobs.
+   * - DEVSTACK_GATE_GRENADE
+     - TBD
+     - Grenade Zuul V3 jobs will be hosted in the grenade repo.
+   * - GRENADE_BASE_BRANCH
+     - TBD
+     - Grenade Zuul V3 jobs will be hosted in the grenade repo.
+   * - DEVSTACK_GATE_NEUTRON_DVR
+     - TBD
+     - Depends on multinode support.
+   * - DEVSTACK_GATE_EXERCISES
+     - TBD
+     - Can be done on request.
+   * - DEVSTACK_GATE_IRONIC
+     - TBD
+     - This will probably be implemented on ironic side.
+   * - DEVSTACK_GATE_IRONIC_DRIVER
+     - TBD
+     - This will probably be implemented on ironic side.
+   * - DEVSTACK_GATE_IRONIC_BUILD_RAMDISK
+     - TBD
+     - This will probably be implemented on ironic side.
+   * - DEVSTACK_GATE_POSTGRES
+     - Legacy
+     - This flag exists in d-g but the only thing that it does is
+       capture postgres logs. This is already supported by the roles
+       in post, so the flag is useless in the new jobs. postgres
+       itself can be enabled via the devstack_service job variable.
+   * - DEVSTACK_GATE_ZEROMQ
+     - Legacy
+     - This has no effect in d-g.
+   * - DEVSTACK_GATE_MQ_DRIVER
+     - Legacy
+     - This has no effect in d-g.
+   * - DEVSTACK_GATE_TEMPEST_STRESS_ARGS
+     - Legacy
+     - Stress is not in Tempest anymore.
+   * - DEVSTACK_GATE_TEMPEST_HEAT_SLOW
+     - Legacy
+     - This is not used anywhere.
+   * - DEVSTACK_GATE_CELLS
+     - Legacy
+     - This has no effect in d-g.
+   * - DEVSTACK_GATE_NOVA_API_METADATA_SPLIT
+     - Legacy
+     - This has no effect in d-g.
diff --git a/roles/setup-devstack-source-dirs/README.rst b/roles/setup-devstack-source-dirs/README.rst
index 49d22c3c64..0aa048b7d2 100644
--- a/roles/setup-devstack-source-dirs/README.rst
+++ b/roles/setup-devstack-source-dirs/README.rst
@@ -10,7 +10,7 @@ into it.
 
    The devstack base directory.
 
- .. zuul:rolevar:: devstack_sources_branch
-    :default: None
+.. zuul:rolevar:: devstack_sources_branch
+   :default: None
 
-    The target branch to be setup (where available).
+   The target branch to be setup (where available).

From 005004eded47ee840b78e6e0c94701c5bd253816 Mon Sep 17 00:00:00 2001
From: Brian Haley <bhaley@redhat.com>
Date: Fri, 31 May 2019 13:50:55 -0400
Subject: [PATCH 1585/2409] Switch to fedora-29 for fedora-latest nodeset

F28 is EOL as of 5.29.19, so change to use fedora-29
and remove it from stack.sh.

Depends-on: https://review.opendev.org/#/c/662538/
Change-Id: I5ebdb68fcd01a1e63be4b3c0735a274783aad818
---
 .zuul.yaml | 2 +-
 stack.sh   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 9853798963..a01e405f0b 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -52,7 +52,7 @@
     name: devstack-single-node-fedora-latest
     nodes:
       - name: controller
-        label: fedora-28
+        label: fedora-29
     groups:
       - name: tempest
         nodes:
diff --git a/stack.sh b/stack.sh
index 3c316448e1..10f3dc2b28 100755
--- a/stack.sh
+++ b/stack.sh
@@ -224,7 +224,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (xenial|artful|bionic|stretch|jessie|f28|f29|opensuse-15.0|opensuse-15.1|opensuse-tumbleweed|rhel7) ]]; then
+if [[ ! ${DISTRO} =~ (xenial|artful|bionic|stretch|jessie|f29|opensuse-15.0|opensuse-15.1|opensuse-tumbleweed|rhel7) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From 5a30480ce188b4846a2f5c86ca38331b635d5b3b Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Fri, 16 Aug 2019 09:57:59 +0000
Subject: [PATCH 1586/2409] Update HACKING doc

Some minor updates.

Change-Id: I0d4e20e394f0fa420e896e0b1a90872ccf909b58
---
 HACKING.rst | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/HACKING.rst b/HACKING.rst
index f6951064ae..78462c29bd 100644
--- a/HACKING.rst
+++ b/HACKING.rst
@@ -10,7 +10,7 @@ and so is limited to Bash (version 4 and up) and compatible shells.
 Shell script was chosen because it best illustrates the steps used to
 set up and interact with OpenStack components.
 
-DevStack's official repository is located on git.openstack.org at
+DevStack's official repository is located on opendev.org at
 https://opendev.org/openstack/devstack.  Besides the master branch that
 tracks the OpenStack trunk branches a separate branch is maintained for all
 OpenStack releases starting with Diablo (stable/diablo).
@@ -23,7 +23,7 @@ __ contribute_
 .. _contribute: https://docs.openstack.org/infra/manual/developers.html
 
 __ lp_
-.. _lp: https://launchpad.net/~devstack
+.. _lp: https://launchpad.net/devstack
 
 The `Gerrit review
 queue <https://review.opendev.org/#/q/project:openstack/devstack>`__
@@ -163,7 +163,7 @@ Documentation
 
 The DevStack repo now contains all of the static pages of devstack.org in
 the ``doc/source`` directory. The OpenStack CI system rebuilds the docs after every
-commit and updates devstack.org (now a redirect to docs.openstack.org/developer/devstack).
+commit and updates devstack.org (now a redirect to https://docs.openstack.org/devstack/latest/).
 
 All of the scripts are processed with shocco_ to render them with the comments
 as text describing the script below.  For this reason we tend to be a little

From d331fa7a2d027e98c08aba442c05ba54abc7d6d8 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Mon, 29 Jul 2019 10:42:24 +0000
Subject: [PATCH 1587/2409] Set cinder's my_ip based on SERVICE_IP_VERSION
 value

Devstack's lib/cinder set the my_ip on cinder side but it
hard-code it with HOST_IP[1]. It is no issue for IPv4 env
but when you build or run the IPv6 job then this ip is left
to set with IPv6. my_ip should be set to HOST_IP or HOST_IPV6
based on SERVICE_IP_VERSION value.

As part of Train community goal 'Support IPv6-Only Deployments',
we will expand the 'devstack-tempest-ipv6' job to do IPv6-only
deployments verification so we need fix the the my_ip setting.

Closes-Bug: #1838250

Depends-On: https://review.opendev.org/#/c/677524/

[1]https://github.com/openstack/devstack/blob/6aeaceb0c4ef078d028fb6605cac2a37444097d8/lib/cinder#L231

Change-Id: I71c74e46467a5d3c1bf9c7d683f364cba7cf9d80
---
 lib/cinder | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 32e38c44da..fd960535d9 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -228,8 +228,11 @@ function configure_cinder {
     iniset $CINDER_CONF DEFAULT osapi_volume_listen $CINDER_SERVICE_LISTEN_ADDRESS
     iniset $CINDER_CONF DEFAULT state_path $CINDER_STATE_PATH
     iniset $CINDER_CONF oslo_concurrency lock_path $CINDER_STATE_PATH
-    iniset $CINDER_CONF DEFAULT my_ip "$HOST_IP"
-
+    if [[ $SERVICE_IP_VERSION == 6 ]]; then
+        iniset $CINDER_CONF DEFAULT my_ip "$HOST_IPV6"
+    else
+        iniset $CINDER_CONF DEFAULT my_ip "$HOST_IP"
+    fi
     iniset $CINDER_CONF key_manager backend cinder.keymgr.conf_key_mgr.ConfKeyManager
     iniset $CINDER_CONF key_manager fixed_key $(openssl rand -hex 16)
 

From f1a794e1326b79aa5c5e67530f2169479b9bf1f2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Harald=20Jens=C3=A5s?= <hjensas@redhat.com>
Date: Wed, 21 Aug 2019 10:49:57 +0200
Subject: [PATCH 1588/2409] flat_networks - Don't hardcode public network name

Use the PUBLIC_NETWORK_NAME variable instead of hardcoding
it when setting the [ml2_type_flat]/flat_networks option.

Change-Id: I8bfc37089ec90eb06ee41d85744dad0f3f734c16
---
 lib/neutron | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron b/lib/neutron
index 0d23d97fcf..ea20e04d08 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -225,7 +225,7 @@ function configure_neutron_new {
         iniset $NEUTRON_CORE_PLUGIN_CONF ml2 mechanism_drivers $mech_drivers
 
         iniset $NEUTRON_CORE_PLUGIN_CONF ml2_type_vxlan vni_ranges 1001:2000
-        iniset $NEUTRON_CORE_PLUGIN_CONF ml2_type_flat flat_networks public
+        iniset $NEUTRON_CORE_PLUGIN_CONF ml2_type_flat flat_networks $PUBLIC_NETWORK_NAME
         if [[ "$NEUTRON_TENANT_NETWORK_TYPE" =~ "vlan" ]] && [[ "$NEUTRON_PHYSICAL_NETWORK" != "" ]]; then
             iniset $NEUTRON_CORE_PLUGIN_CONF ml2_type_vlan network_vlan_ranges ${NEUTRON_PHYSICAL_NETWORK}:${NEUTRON_TENANT_VLAN_RANGE}
         fi

From e273c0433f40ba581703dae4378a74af40410c9f Mon Sep 17 00:00:00 2001
From: Eric Fried <openstack@fried.cc>
Date: Tue, 13 Aug 2019 14:28:24 -0500
Subject: [PATCH 1589/2409] Set ksa retry conf options for n-cpu [ironic]

We're trying to get nova to talk to ironic through openstacksdk and need
to be able to specify retry limits/intervals there. We could reuse the
existing conf options, but better to support the standard ones exposed
from keystoneauth1 via [1] and [2].

Note that these will be ignored unless you have keystoneauth1 3.15.0
(for [1]) or 3.16.0 ([1] and [2]) and are building your adapter using
ksa-derived conf options (see the Needed-By).

Needed-By: https://review.opendev.org/642899

[1] https://review.opendev.org/#/c/666287/
[2] https://review.opendev.org/#/c/672930/

Change-Id: I79c416e25d635b0ffa419640b4bd91e36f78b1ab
---
 lib/nova_plugins/hypervisor-ironic | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lib/nova_plugins/hypervisor-ironic b/lib/nova_plugins/hypervisor-ironic
index 9bc04e2122..adcc278812 100644
--- a/lib/nova_plugins/hypervisor-ironic
+++ b/lib/nova_plugins/hypervisor-ironic
@@ -54,8 +54,14 @@ function configure_nova_hypervisor {
     iniset $NOVA_CONF ironic project_name demo
     iniset $NOVA_CONF ironic region_name $REGION_NAME
 
+    # These are used with crufty legacy ironicclient
     iniset $NOVA_CONF ironic api_max_retries 300
     iniset $NOVA_CONF ironic api_retry_interval 5
+    # These are used with shiny new openstacksdk
+    iniset $NOVA_CONF ironic connect_retries 300
+    iniset $NOVA_CONF ironic connect_retry_delay 5
+    iniset $NOVA_CONF ironic status_code_retries 300
+    iniset $NOVA_CONF ironic status_code_retry_delay 5
 }
 
 # install_nova_hypervisor() - Install external components

From 2468ceaa724aa5c8c44fb87ae223eb6687ff85f2 Mon Sep 17 00:00:00 2001
From: Eric Fried <openstack@fried.cc>
Date: Thu, 25 Jul 2019 13:18:58 -0500
Subject: [PATCH 1590/2409] Merge (don't overwrite) $NOVA_CPU_CONF

Per the referenced bug, $NOVA_CPU_CONF was previously being initialized
by copying $NOVA_CONF, thereby trashing any values already configured in
$NOVA_CPU_CONF.

With this commit, we merge the values from $NOVA_CPU_CONF in after the
copy.

Note that this makes use of the merge_config_file function, which is
defined in inc/meta-config, which wasn't being sourced from every code
path that hit start_nova_compute; so this commit also moves that import
from stack.sh to functions (next to the other imports from inc/, which
makes sense anyway).

Change-Id: Id3e2baa2221e13f512f8dcf1248e1e15b6a7597f
Closes-Bug: #1802143
---
 functions | 1 +
 lib/nova  | 3 +++
 stack.sh  | 3 ---
 3 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/functions b/functions
index 93035673b5..f33fd25fee 100644
--- a/functions
+++ b/functions
@@ -18,6 +18,7 @@ declare -r -g _DEVSTACK_FUNCTIONS=1
 FUNC_DIR=$(cd $(dirname "${BASH_SOURCE:-$0}") && pwd)
 source ${FUNC_DIR}/functions-common
 source ${FUNC_DIR}/inc/ini-config
+source ${FUNC_DIR}/inc/meta-config
 source ${FUNC_DIR}/inc/python
 source ${FUNC_DIR}/inc/rootwrap
 
diff --git a/lib/nova b/lib/nova
index f423b570cd..1ec1a785e6 100644
--- a/lib/nova
+++ b/lib/nova
@@ -838,7 +838,10 @@ function start_nova_compute {
 
     local compute_cell_conf=$NOVA_CONF
 
+    # Bug #1802143: $NOVA_CPU_CONF is constructed by first copying $NOVA_CONF...
     cp $compute_cell_conf $NOVA_CPU_CONF
+    # ...and then adding/overriding anything explicitly set in $NOVA_CPU_CONF
+    merge_config_file $TOP_DIR/local.conf post-config '$NOVA_CPU_CONF'
 
     if [[ "${CELLSV2_SETUP}" == "singleconductor" ]]; then
         # NOTE(danms): Grenade doesn't setup multi-cell rabbit, so
diff --git a/stack.sh b/stack.sh
index b8d597e11c..01469688eb 100755
--- a/stack.sh
+++ b/stack.sh
@@ -167,9 +167,6 @@ LAST_SPINNER_PID=""
 # Import common functions
 source $TOP_DIR/functions
 
-# Import config functions
-source $TOP_DIR/inc/meta-config
-
 # Import 'public' stack.sh functions
 source $TOP_DIR/lib/stack
 

From f92c346131db2c89b930b1a23f8489419a2217dc Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Thu, 22 Aug 2019 12:15:09 -0400
Subject: [PATCH 1591/2409] Fix MySQL log collection

The mysql logs weren't being copied to logs and published.

Change-Id: I20740b468e4b310ac07e77f3930cae92026942fb
---
 .zuul.yaml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 9853798963..1b43611358 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -240,8 +240,7 @@
         '{{ stage_dir }}/etc': logs
         /var/log/rabbitmq: logs
         /var/log/postgresql: logs
-        /var/log/mysql.err: logs
-        /var/log/mysql.log: logs
+        /var/log/mysql: logs
         /var/log/libvirt: logs
         /etc/sudoers: logs
         /etc/sudoers.d: logs

From 28c498150d89a8a414a50ad307a79b764514e424 Mon Sep 17 00:00:00 2001
From: Szymon Datko <szymon.datko@corp.ovh.com>
Date: Thu, 22 Aug 2019 15:39:53 +0200
Subject: [PATCH 1592/2409] Select proper flavor_ref_alt for Tempest
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Currently if user selects the default instance type for Tempest
tests, some of resize-related tests may fail due to resize attempt
into flavor with smaller disk size. It is because there is just
simple check if flavor_ref and flavor_ref_alt (IDs) aren't the same.
To ensure resize is really possible, there shall be additional
verification introduced.

Co-Authored-By: Michał Madarasz <michal.madarasz@corp.ovh.com>
Change-Id: Iaa1bfa9cb76cbe54be658d2d70d97d99e7fb5be9
---
 lib/tempest | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index 4a192a0790..96c9ced14a 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -130,6 +130,8 @@ function configure_tempest {
     local available_flavors
     local flavors_ref
     local flavor_lines
+    local flavor_ref_size
+    local flavor_ref_alt_size
     local public_network_id
     local public_router_id
     local ssh_connect_method="floating"
@@ -233,11 +235,24 @@ function configure_tempest {
             fi
             flavor_ref=${flavors[0]}
             flavor_ref_alt=$flavor_ref
+            flavor_ref_size=$(openstack flavor show --format value --column disk "${flavor_ref}")
 
             # Ensure ``flavor_ref`` and ``flavor_ref_alt`` have different values.
             # Some resize instance in tempest tests depends on this.
             for f in ${flavors[@]:1}; do
                 if [[ "$f" != "$flavor_ref" ]]; then
+                    #
+                    # NOTE(sdatko): Resize is only possible when target flavor
+                    #               is not smaller than the original one. For
+                    #               Tempest tests, in case there was a bigger
+                    #               flavor selected as default, e.g. m1.small,
+                    #               we need to perform additional check.
+                    #
+                    flavor_ref_alt_size=$(openstack flavor show --format value --column disk "${f}")
+                    if [[ "${flavor_ref_alt_size}" -lt "${flavor_ref_size}" ]]; then
+                        continue
+                    fi
+
                     flavor_ref_alt=$f
                     break
                 fi

From 168ca7f0a474f1207ee01dab0ca2e70f34783e9c Mon Sep 17 00:00:00 2001
From: Stephen Finucane <sfinucan@redhat.com>
Date: Mon, 26 Aug 2019 10:11:03 +0100
Subject: [PATCH 1593/2409] Remove deprecated PostgreSQL database driver

This was deprecated for removal in Pike. It's probably time to drop it.
Note that the 'postgresql-devel'/'postgresql-server-dev-all' packages
are retained since some packages still include 'psycopg2' in their
general requirements.

Change-Id: I51e8354e99972757253ce259e6c03c91da24398c
Signed-off-by: Stephen Finucane <sfinucan@redhat.com>
---
 doc/source/configuration.rst          |  22 ++---
 doc/source/zuul_ci_jobs_migration.rst |   5 +-
 functions                             |   3 +-
 lib/databases/postgresql              | 137 --------------------------
 stack.sh                              |   9 +-
 unstack.sh                            |   4 -
 6 files changed, 14 insertions(+), 166 deletions(-)
 delete mode 100644 lib/databases/postgresql

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 45f4ffe6e9..62571e0760 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -326,29 +326,23 @@ a file, keep service logs and disable color in the stored files.
 Database Backend
 ----------------
 
-Multiple database backends are available. The available databases are defined
-in the lib/databases directory.
-``mysql`` is the default database, choose a different one by putting the
-following in the ``localrc`` section::
+Support for the MySQL database backend is included. Addition database backends
+may be available via external plugins. Enabling of disabling MySQL is handled
+via the usual service functions and ``ENABLED_SERVICES``. For example, to
+disable MySQL in ``local.conf``::
 
   disable_service mysql
-  enable_service postgresql
-
-``mysql`` is the default database.
 
 RPC Backend
 -----------
 
-Support for a RabbitMQ RPC backend is included. Additional RPC
-backends may be available via external plugins.  Enabling or disabling
-RabbitMQ is handled via the usual service functions and
-``ENABLED_SERVICES``.
-
-Example disabling RabbitMQ in ``local.conf``::
+Support for a RabbitMQ RPC backend is included. Additional RPC backends may be
+available via external plugins.  Enabling or disabling RabbitMQ is handled via
+the usual service functions and ``ENABLED_SERVICES``. For example, to disable
+RabbitMQ in ``local.conf``::
 
   disable_service rabbit
 
-
 Apache Frontend
 ---------------
 
diff --git a/doc/source/zuul_ci_jobs_migration.rst b/doc/source/zuul_ci_jobs_migration.rst
index 17e7e16fb7..66f8251039 100644
--- a/doc/source/zuul_ci_jobs_migration.rst
+++ b/doc/source/zuul_ci_jobs_migration.rst
@@ -302,10 +302,7 @@ migrated at all.
      - This will probably be implemented on ironic side.
    * - DEVSTACK_GATE_POSTGRES
      - Legacy
-     - This flag exists in d-g but the only thing that it does is
-       capture postgres logs. This is already supported by the roles
-       in post, so the flag is useless in the new jobs. postgres
-       itself can be enabled via the devstack_service job variable.
+     - This has no effect in d-g.
    * - DEVSTACK_GATE_ZEROMQ
      - Legacy
      - This has no effect in d-g.
diff --git a/functions b/functions
index f33fd25fee..8eeb03203e 100644
--- a/functions
+++ b/functions
@@ -400,7 +400,8 @@ function upload_image {
 # initialized yet, just save the configuration selection and call back later
 # to validate it.
 #
-# ``$1`` - the name of the database backend to use (mysql, postgresql, ...)
+# ``$1`` - the name of the database backend to use (only mysql is currently
+# supported)
 function use_database {
     if [[ -z "$DATABASE_BACKENDS" ]]; then
         # No backends registered means this is likely called from ``localrc``
diff --git a/lib/databases/postgresql b/lib/databases/postgresql
deleted file mode 100644
index 618834b550..0000000000
--- a/lib/databases/postgresql
+++ /dev/null
@@ -1,137 +0,0 @@
-#!/bin/bash
-#
-# lib/databases/postgresql
-# Functions to control the configuration and operation of the **PostgreSQL** database backend
-
-# Dependencies:
-#
-# - DATABASE_{HOST,USER,PASSWORD} must be defined
-
-# Save trace setting
-_XTRACE_PG=$(set +o | grep xtrace)
-set +o xtrace
-
-
-MAX_DB_CONNECTIONS=${MAX_DB_CONNECTIONS:-200}
-
-
-register_database postgresql
-
-
-# Functions
-# ---------
-
-function get_database_type_postgresql {
-    echo postgresql
-}
-
-# Get rid of everything enough to cleanly change database backends
-function cleanup_database_postgresql {
-    stop_service postgresql
-    if is_ubuntu; then
-        # Get ruthless with mysql
-        apt_get purge -y postgresql*
-        return
-    elif is_fedora || is_suse; then
-        uninstall_package postgresql-server
-    else
-        return
-    fi
-}
-
-function recreate_database_postgresql {
-    local db=$1
-    # Avoid unsightly error when calling dropdb when the database doesn't exist
-    psql -h$DATABASE_HOST -U$DATABASE_USER -dtemplate1 -c "DROP DATABASE IF EXISTS $db"
-    createdb -h $DATABASE_HOST -U$DATABASE_USER -l C -T template0 -E utf8 $db
-}
-
-function configure_database_postgresql {
-    local pg_conf pg_dir pg_hba check_role version
-    echo_summary "Configuring and starting PostgreSQL"
-    if is_fedora; then
-        pg_hba=/var/lib/pgsql/data/pg_hba.conf
-        pg_conf=/var/lib/pgsql/data/postgresql.conf
-        if ! sudo [ -e $pg_hba ]; then
-            sudo postgresql-setup initdb
-        fi
-    elif is_ubuntu; then
-        version=`psql --version | cut -d ' ' -f3 | cut -d. -f1-2`
-        if vercmp $version '>=' 9.3; then
-            if [ -z "`pg_lsclusters -h`" ]; then
-                echo 'No PostgreSQL clusters exist; will create one'
-                sudo pg_createcluster $version main --start
-            fi
-        fi
-        pg_dir=`find /etc/postgresql -name pg_hba.conf|xargs dirname`
-        pg_hba=$pg_dir/pg_hba.conf
-        pg_conf=$pg_dir/postgresql.conf
-    elif is_suse; then
-        pg_hba=/var/lib/pgsql/data/pg_hba.conf
-        pg_conf=/var/lib/pgsql/data/postgresql.conf
-        # initdb is called when postgresql is first started
-        sudo [ -e $pg_hba ] || start_service postgresql
-    else
-        exit_distro_not_supported "postgresql configuration"
-    fi
-    # Listen on all addresses
-    sudo sed -i "/listen_addresses/s/.*/listen_addresses = '*'/" $pg_conf
-    # Set max_connections
-    sudo sed -i "/max_connections/s/.*/max_connections = $MAX_DB_CONNECTIONS/" $pg_conf
-    # Do password auth from all IPv4 clients
-    sudo sed -i "/^host/s/all\s\+127.0.0.1\/32\s\+ident/$DATABASE_USER\t0.0.0.0\/0\tpassword/" $pg_hba
-    # Do password auth for all IPv6 clients
-    sudo sed -i "/^host/s/all\s\+::1\/128\s\+ident/$DATABASE_USER\t::0\/0\tpassword/" $pg_hba
-    restart_service postgresql
-
-    # Create the role if it's not here or else alter it.
-    check_role=$(sudo -u root sudo -u postgres -i psql -t -c "SELECT 'HERE' from pg_roles where rolname='$DATABASE_USER'")
-    if [[ ${check_role} == *HERE ]];then
-        sudo -u root sudo -u postgres -i psql -c "ALTER ROLE $DATABASE_USER WITH SUPERUSER LOGIN PASSWORD '$DATABASE_PASSWORD'"
-    else
-        sudo -u root sudo -u postgres -i psql -c "CREATE ROLE $DATABASE_USER WITH SUPERUSER LOGIN PASSWORD '$DATABASE_PASSWORD'"
-    fi
-}
-
-function install_database_postgresql {
-    echo_summary "Installing postgresql"
-    deprecated "Use of postgresql in devstack is deprecated, and will be removed during the Pike cycle"
-    local pgpass=$HOME/.pgpass
-    if [[ ! -e $pgpass ]]; then
-        cat <<EOF > $pgpass
-*:*:*:$DATABASE_USER:$DATABASE_PASSWORD
-EOF
-        chmod 0600 $pgpass
-    else
-        sed -i "s/:root:\w\+/:root:$DATABASE_PASSWORD/" $pgpass
-    fi
-    if is_ubuntu; then
-        install_package postgresql
-    elif is_fedora || is_suse; then
-        install_package postgresql-server
-        if is_fedora; then
-            sudo systemctl enable postgresql
-        fi
-    else
-        exit_distro_not_supported "postgresql installation"
-    fi
-}
-
-function install_database_python_postgresql {
-    # Install Python client module
-    pip_install_gr psycopg2
-    ADDITIONAL_VENV_PACKAGES+=",psycopg2"
-}
-
-function database_connection_url_postgresql {
-    local db=$1
-    echo "$BASE_SQL_CONN/$db?client_encoding=utf8"
-}
-
-
-# Restore xtrace
-$_XTRACE_PG
-
-# Local variables:
-# mode: shell-script
-# End:
diff --git a/stack.sh b/stack.sh
index 9982c353c0..5064d5db1d 100755
--- a/stack.sh
+++ b/stack.sh
@@ -695,14 +695,11 @@ function read_password {
 # Database Configuration
 # ----------------------
 
-# To select between database backends, add the following to ``local.conf``:
+# DevStack provides a MySQL database backend. Additional backends may be
+# provided by external plugins and can be enabled using the usual service
+# functions and ``ENABLED_SERVICES``. For example, to disable MySQL:
 #
 #    disable_service mysql
-#    enable_service postgresql
-#
-# The available database backends are listed in ``DATABASE_BACKENDS`` after
-# ``lib/database`` is sourced. ``mysql`` is the default.
-
 if initialize_database_backends; then
     echo "Using $DATABASE_TYPE database backend"
     # Last chance for the database password. This must be handled here
diff --git a/unstack.sh b/unstack.sh
index ccea0ef585..07dc2b1418 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -147,10 +147,6 @@ if [[ -n "$UNSTACK_ALL" ]]; then
         stop_service mysql
     fi
 
-    if is_service_enabled postgresql; then
-        stop_service postgresql
-    fi
-
     # Stop rabbitmq-server
     if is_service_enabled rabbit; then
         stop_service rabbitmq-server

From 951e14d6dd534236e2710a48fb3d86d66f5c0228 Mon Sep 17 00:00:00 2001
From: Bharat Kunwar <brtknr@bath.edu>
Date: Thu, 8 Aug 2019 16:20:19 +0000
Subject: [PATCH 1594/2409] Fix default security group in samples/local.sh

The script currently complains about multiple default security groups. This
obtains the default and uses it when creating security group rules.

Change-Id: I81e59eae5df79889ed1fb02d45af26e3a55aa0e9
---
 samples/local.sh | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/samples/local.sh b/samples/local.sh
index 9cd0bdcc17..a1c5c8143b 100755
--- a/samples/local.sh
+++ b/samples/local.sh
@@ -41,6 +41,13 @@ if is_service_enabled nova; then
         fi
     done
 
+    # Update security default group
+    # -----------------------------
+
+    # Add tcp/22 and icmp to default security group
+    default=$(openstack security group list -f value -c ID)
+    openstack security group rule create $default --protocol tcp --dst-port 22
+    openstack security group rule create $default --protocol icmp
 
     # Create A Flavor
     # ---------------
@@ -57,12 +64,4 @@ if is_service_enabled nova; then
         openstack flavor create $MI_NAME --id 6 --ram 128 --disk 0 --vcpus 1
     fi
 
-
-    # Other Uses
-    # ----------
-
-    # Add tcp/22 and icmp to default security group
-    openstack security group rule create --project $OS_PROJECT_NAME default --protocol tcp --ingress --dst-port 22
-    openstack security group rule create --project $OS_PROJECT_NAME default --protocol icmp
-
 fi

From 16bccbcea410ce426f83b5086424080b5bfaf925 Mon Sep 17 00:00:00 2001
From: Peter Penchev <openstack-dev@storpool.com>
Date: Mon, 9 Sep 2019 15:14:11 +0300
Subject: [PATCH 1595/2409] Revert "install LIBS_FROM_GIT using python 2 and 3
 where appropriate"

All the OpenStack projects should be able to run under Python 3 now so
the fallback installation of the Python 2 libraries should not be
needed any longer. This also avoids the problem of script files
installed by the libraries sometimes being overwritten by the Python 2
version leading to incorrect execution later, as discussed in
http://lists.openstack.org/pipermail/openstack-discuss/2019-September/009226.html

This reverts commit a2eb89417fbb6d61526b1819cbe3d0a60537eedd.

Change-Id: I1cdb7e4a209872f1620be556b7278879a4b86df5
---
 inc/python | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/inc/python b/inc/python
index ea8ff67e08..81b6a960a4 100644
--- a/inc/python
+++ b/inc/python
@@ -380,16 +380,6 @@ function setup_dev_lib {
     fi
     local name=$1
     local dir=${GITDIR[$name]}
-    if python3_enabled; then
-        # Turn off Python 3 mode and install the package again,
-        # forcing a Python 2 installation. This ensures that all libs
-        # being used for development are installed under both versions
-        # of Python.
-        echo "Installing $name again without Python 3 enabled"
-        USE_PYTHON3=False
-        setup_develop $bindep $dir
-        USE_PYTHON3=True
-    fi
     setup_develop $bindep $dir
 }
 

From ce396d374bc00f21671bcdae30e12c44cd1ef1eb Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Thu, 5 Sep 2019 08:51:33 +0000
Subject: [PATCH 1596/2409] Fix worlddump log collection

All credit for figuring this out goes to frickler (and that was the hard
bit so thank you!). The worlddump files were not being collected because
they weren't in our log collection list. Add worlddump to this list
so that we collect these files.

One thing that makes this slightly complicated is the worlddump files
are named with a timestamp and we can't have globs in our collection
list. To address this we create a copy of the file with a -latest.txt
suffix. This gives us a deterministic file name for log collection
without using globs.

Note we do not use a symlink here because some jobs gzip their log files
(breaking symlinks) and others do not. This makes it painful to always
have a valid link. Not having a valid link can break log collection.

Hardlinks may be another option but simply making a copy is easier to
manage as you don't have to worry about links preexisting and the
dumpfiles are not that large.

Change-Id: I96ae5f5290546ad25ca434c1106c01354d2d053c
---
 .zuul.yaml         | 1 +
 tools/worlddump.py | 9 +++++++++
 2 files changed, 10 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index 1b43611358..197942906f 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -233,6 +233,7 @@
         '{{ devstack_log_dir }}/devstacklog.txt': logs
         '{{ devstack_log_dir }}/devstacklog.txt.summary': logs
         '{{ devstack_log_dir }}/tcpdump.pcap': logs
+        '{{ devstack_log_dir }}/worlddump-latest.txt': logs
         '{{ devstack_full_log}}': logs
         '{{ stage_dir }}/verify_tempest_conf.log': logs
         '{{ stage_dir }}/apache': logs
diff --git a/tools/worlddump.py b/tools/worlddump.py
index 88af19d2e3..d1453ca076 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -25,6 +25,7 @@
 import fnmatch
 import os
 import os.path
+import shutil
 import subprocess
 import sys
 
@@ -248,6 +249,14 @@ def main():
         compute_consoles()
         guru_meditation_reports()
         var_core()
+    # Singular name for ease of log retrieval
+    copyname = os.path.join(opts.dir, 'worlddump')
+    if opts.name:
+        copyname += '-' + opts.name
+    copyname += '-latest.txt'
+    # We make a full copy to deal with jobs that may or may not
+    # gzip logs breaking symlinks.
+    shutil.copyfile(fname, copyname)
 
 
 if __name__ == '__main__':

From ba50347526ea76b501dacf774ea6f0997361358c Mon Sep 17 00:00:00 2001
From: Artem Goncharov <artem.goncharov@gmail.com>
Date: Wed, 21 Nov 2018 15:28:27 +0100
Subject: [PATCH 1597/2409] Update for f29

In Fedora 29 dstat was merged with pcp-system-tools (see
https://pagure.io/fesco/issue/1956)

Work around a iscsi bug with external packages until we can get the
package fixed.

Obsolete F27

Change-Id: I2f16658c5a3e22cac70912a0f3ad65cdd7071a1e
---
 files/rpms/cinder  |  4 ++--
 files/rpms/dstat   |  3 ++-
 files/rpms/general |  4 ++--
 files/rpms/nova    |  2 +-
 files/rpms/swift   |  2 +-
 lib/nova           | 10 ++++++++++
 6 files changed, 18 insertions(+), 7 deletions(-)

diff --git a/files/rpms/cinder b/files/rpms/cinder
index 058c2354dc..e6b33dcc5e 100644
--- a/files/rpms/cinder
+++ b/files/rpms/cinder
@@ -1,5 +1,5 @@
 iscsi-initiator-utils
 lvm2
 qemu-img
-scsi-target-utils # not:rhel7,f25,f26,f27,f28 NOPRIME
-targetcli # dist:rhel7,f25,f26,f27,f28 NOPRIME
+scsi-target-utils # not:rhel7,f25,f26,f27,f28,f29 NOPRIME
+targetcli # dist:rhel7,f25,f26,f27,f28,f29 NOPRIME
diff --git a/files/rpms/dstat b/files/rpms/dstat
index 0d9da4434f..b058c277cb 100644
--- a/files/rpms/dstat
+++ b/files/rpms/dstat
@@ -1,2 +1,3 @@
-dstat
+dstat # not:f29
+pcp-system-tools # dist:f29
 python-psutil
diff --git a/files/rpms/general b/files/rpms/general
index c7863e4320..5bf1e9ac90 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -9,9 +9,9 @@ git-core
 graphviz # needed only for docs
 httpd
 httpd-devel
-iptables-services  # NOPRIME f25,f26,f27,f28
+iptables-services  # NOPRIME f25,f26,f27,f28,f29
 java-1.7.0-openjdk-headless  # NOPRIME rhel7
-java-1.8.0-openjdk-headless  # NOPRIME f25,f26,f27,f28
+java-1.8.0-openjdk-headless  # NOPRIME f25,f26,f27,f28,f29
 libffi-devel
 libjpeg-turbo-devel # Pillow 3.0.0
 libxml2-devel # lxml
diff --git a/files/rpms/nova b/files/rpms/nova
index f69fc373d7..639d793756 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -7,7 +7,7 @@ gawk
 genisoimage # required for config_drive
 iptables
 iputils
-kernel-modules # dist:f25,f26,f27,f28
+kernel-modules # dist:f25,f26,f27,f28,f29
 kpartx
 libxml2-python
 m2crypto
diff --git a/files/rpms/swift b/files/rpms/swift
index f2f5de69b0..be524d1367 100644
--- a/files/rpms/swift
+++ b/files/rpms/swift
@@ -2,7 +2,7 @@ curl
 liberasurecode-devel
 memcached
 pyxattr
-rsync-daemon # dist:f25,f26,f27,f28
+rsync-daemon # dist:f25,f26,f27,f28,f29
 sqlite
 xfsprogs
 xinetd
diff --git a/lib/nova b/lib/nova
index 22f0706b3d..c8e6164916 100644
--- a/lib/nova
+++ b/lib/nova
@@ -296,6 +296,16 @@ function configure_nova {
             fi
         fi
 
+        if is_fedora; then
+            # There is an iscsi-initiator bug where it inserts
+            # different whitespace that causes a bunch of output
+            # matching to fail.  We have not been able to get
+            # fixed, yet :/  Exists in fedora 29 & 30
+            #  https://bugzilla.redhat.com/show_bug.cgi?id=1676365
+            sudo dnf copr enable -y iwienand/iscsi-initiator-utils
+            sudo dnf update -y
+        fi
+
         if [[ ${ISCSID_DEBUG} == "True" ]]; then
             # Install an override that starts iscsid with debugging
             # enabled.

From 0c9a6cab9118fd4ebcdb5277ccf66756fe4f2ec8 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Thu, 19 Sep 2019 13:57:43 +0000
Subject: [PATCH 1598/2409] Enable accept_ra before enabling forwarding

We need to enable accept_ra before we enable forwarding, otherwise
existing addresses and routes may get dropped until the next RA is
received, possibly causing connection errors in the meantime.

Change-Id: I1fdeede59547de896ed89222ecf121fd9e6b810d
---
 lib/neutron_plugins/services/l3 | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index ec289f6656..69536bbe58 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -395,8 +395,6 @@ function _neutron_configure_router_v6 {
 
     # This logic is specific to using the l3-agent for layer 3
     if is_service_enabled q-l3 || is_service_enabled neutron-l3; then
-        # Ensure IPv6 forwarding is enabled on the host
-        sudo sysctl -w net.ipv6.conf.all.forwarding=1
         # if the Linux host considers itself to be a router then it will
         # ignore all router advertisements
         # Ensure IPv6 RAs are accepted on interfaces with a default route.
@@ -409,6 +407,8 @@ function _neutron_configure_router_v6 {
             # device name would be reinterpreted as a slash, causing an error.
             sudo sysctl -w net/ipv6/conf/$d/accept_ra=2
         done
+        # Ensure IPv6 forwarding is enabled on the host
+        sudo sysctl -w net.ipv6.conf.all.forwarding=1
         # Configure and enable public bridge
         # Override global IPV6_ROUTER_GW_IP with the true value from neutron
         IPV6_ROUTER_GW_IP=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" port list -c 'Fixed IP Addresses' | grep $ipv6_pub_subnet_id | awk -F'ip_address' '{ print $2 }' | cut -f2 -d\' | tr '\n' ' ')

From 1a46c898db9c16173013d95e2bc954992121077c Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 20 Sep 2019 08:11:08 +1000
Subject: [PATCH 1599/2409] Restrict iscsi package hack to Fedora

I forgot in I2f16658c5a3e22cac70912a0f3ad65cdd7071a1e that "is_fedora"
matches rhel/centos for historical reasons.  Restrict the install to
just the Fedora platforms by checking DISTRO matches

Change-Id: Ica4a690a4f2894a03ceb8557a947ed2ea4a60e53
---
 lib/nova | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/nova b/lib/nova
index c8e6164916..c41f881fa1 100644
--- a/lib/nova
+++ b/lib/nova
@@ -296,11 +296,11 @@ function configure_nova {
             fi
         fi
 
-        if is_fedora; then
+        if is_fedora && [[ $DISTRO =~ f[0-9][0-9] ]]; then
             # There is an iscsi-initiator bug where it inserts
             # different whitespace that causes a bunch of output
             # matching to fail.  We have not been able to get
-            # fixed, yet :/  Exists in fedora 29 & 30
+            # fixed, yet :/  Exists in fedora 29 & 30 at least
             #  https://bugzilla.redhat.com/show_bug.cgi?id=1676365
             sudo dnf copr enable -y iwienand/iscsi-initiator-utils
             sudo dnf update -y

From 893817d30af5edded6cae9005ac6f00712fd787d Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Wed, 25 Sep 2019 08:30:07 +1000
Subject: [PATCH 1600/2409] generate-devstack-plugins-list: Retry on
 opendev.org 500

A 500 error from gitea can occasionally show up as a project dropping
their devstack plugin (I543faced83a685d48706d004ae49800abfb89dc5).

To avoid noise in the proposal jobs, implement a small retry loop for
500 errors.

Change-Id: Ide23e4de819a2c751d887eeaa7f0b9d0437f8e2c
---
 tools/generate-devstack-plugins-list.py | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/tools/generate-devstack-plugins-list.py b/tools/generate-devstack-plugins-list.py
index 11062eab2b..d39b8018ae 100644
--- a/tools/generate-devstack-plugins-list.py
+++ b/tools/generate-devstack-plugins-list.py
@@ -28,6 +28,9 @@
 import json
 import requests
 
+from requests.adapters import HTTPAdapter
+from requests.packages.urllib3.util.retry import Retry
+
 logging.basicConfig(level=logging.DEBUG)
 
 url = 'https://review.opendev.org/projects/'
@@ -63,6 +66,12 @@ def has_devstack_plugin(session, proj):
 logging.debug("Found %d projects" % len(projects))
 
 s = requests.Session()
+# sometimes gitea gives us a 500 error; retry sanely
+#  https://stackoverflow.com/a/35636367
+retries = Retry(total=3, backoff_factor=1,
+                status_forcelist=[ 500 ])
+s.mount('https://', HTTPAdapter(max_retries=retries))
+
 found_plugins = filter(functools.partial(has_devstack_plugin, s), projects)
 
 for project in found_plugins:

From c6f588df02bfc01bde463cb63f19f90a5935839b Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Wed, 25 Sep 2019 10:31:09 -0400
Subject: [PATCH 1601/2409] Fix target branch for pbr and diskimage-builder

The target branch was centralized in change
I82aa19e739eeda3721bac1cb5153ad0bf2d1125a but there
are two issues, pbr and diskimage-builder are using
TARGET_BRANCH which gets changed to stable/* for
each openstack stable branch that gets created for
devstack, e.g. I861068ae1a9902cef61c52c70dda7bb42f4371a0,
but pbr and diskimage-builder don't have stable branches
so they should be using BRANCHLESS_TARGET_BRANCH i.e. master.

Change-Id: I47ac7a7e194ca6d613d0ccaebfd557346644c2df
---
 stackrc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/stackrc b/stackrc
index 10117f2700..4b049413be 100644
--- a/stackrc
+++ b/stackrc
@@ -499,7 +499,7 @@ GITBRANCH["tooz"]=${TOOZ_BRANCH:-$TARGET_BRANCH}
 
 # pbr drives the setuptools configs
 GITREPO["pbr"]=${PBR_REPO:-${GIT_BASE}/openstack/pbr.git}
-GITBRANCH["pbr"]=${PBR_BRANCH:-$TARGET_BRANCH}
+GITBRANCH["pbr"]=${PBR_BRANCH:-$BRANCHLESS_TARGET_BRANCH}
 
 
 ##################
@@ -554,7 +554,7 @@ GITDIR["ironic-lib"]=$DEST/ironic-lib
 
 # diskimage-builder tool
 GITREPO["diskimage-builder"]=${DIB_REPO:-${GIT_BASE}/openstack/diskimage-builder.git}
-GITBRANCH["diskimage-builder"]=${DIB_BRANCH:-$TARGET_BRANCH}
+GITBRANCH["diskimage-builder"]=${DIB_BRANCH:-$BRANCHLESS_TARGET_BRANCH}
 GITDIR["diskimage-builder"]=$DEST/diskimage-builder
 
 # neutron-lib library containing neutron stable non-REST interfaces

From 6eb2c5990d738612c4cec34daeb673092303a50a Mon Sep 17 00:00:00 2001
From: Colleen Murphy <colleen.murphy@suse.de>
Date: Wed, 25 Sep 2019 12:51:23 -0700
Subject: [PATCH 1602/2409] Fix six package on opensuse for pip 10

openSUE Leap 15.0 and 15.1 both provide python3-six version 1.11.0.
Since version 1.12.0 was released, pip>=10 recognizes the version
difference and tries to uninstall the distro-provided version and fails.
This change adds another hack to remove the egg-info file for the six
library so that pip can manage it directly. We also have to wait to
install os-testr until after the fixup has happened since trying to
install it triggers the issue.

Change-Id: I4649abe06b5893a5251bfcdd4234abccde6ceda2
---
 stack.sh             | 6 +++---
 tools/fixup_stuff.sh | 1 +
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/stack.sh b/stack.sh
index 11783fd5bc..b7b37e2cf6 100755
--- a/stack.sh
+++ b/stack.sh
@@ -796,9 +796,6 @@ if [[ "$OFFLINE" != "True" ]]; then
     PYPI_ALTERNATIVE_URL=${PYPI_ALTERNATIVE_URL:-""} $TOP_DIR/tools/install_pip.sh
 fi
 
-# Install subunit for the subunit output stream
-pip_install -U os-testr
-
 TRACK_DEPENDS=${TRACK_DEPENDS:-False}
 
 # Install Python packages into a virtualenv so that we can track them
@@ -816,6 +813,9 @@ fi
 source $TOP_DIR/tools/fixup_stuff.sh
 fixup_all
 
+# Install subunit for the subunit output stream
+pip_install -U os-testr
+
 if [[ "$USE_SYSTEMD" == "True" ]]; then
     pip_install_gr systemd-python
     # the default rate limit of 1000 messages / 30 seconds is not
diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index d7b824c048..d2989379fe 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -256,6 +256,7 @@ function fixup_suse {
     # overwriting works.  So this hacks around those packages that
     # have been dragged in by some other system dependency
     sudo rm -rf /usr/lib/python3.6/site-packages/ply-*.egg-info
+    sudo rm -rf /usr/lib/python3.6/site-packages/six-*.egg-info
 }
 
 # The version of pip(1.5.4) supported by python-virtualenv(1.11.4) has

From 12e5ddcc2d0058ead4de76053db698ed21d4e813 Mon Sep 17 00:00:00 2001
From: Masayuki Igawa <masayuki@igawa.io>
Date: Wed, 25 Sep 2019 12:23:16 +0900
Subject: [PATCH 1603/2409] Add PDF documentation build

This commit adds PDF documentation build target 'pdf-docs' that will
build PDF versions of our docs. As per the Train community goal:

 https://governance.openstack.org/tc/goals/selected/train/pdf-doc-generation.html

Change-Id: Iecb0fe5b957af7dae66bea04dfbd9c2fb4f74a99
Story: #2006070
Task: #35456
---
 doc/source/conf.py   | 2 +-
 doc/source/index.rst | 9 ++++-----
 tox.ini              | 8 ++++++++
 3 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/doc/source/conf.py b/doc/source/conf.py
index 9059f8c678..56043ba6f7 100644
--- a/doc/source/conf.py
+++ b/doc/source/conf.py
@@ -165,7 +165,7 @@
 # Grouping the document tree into LaTeX files. List of tuples
 # (source start file, target name, title, author, documentclass [howto/manual]).
 latex_documents = [
-  ('index', 'DevStack-doc.tex', u'DevStack Docs',
+  ('index', 'doc-devstack.tex', u'DevStack Docs',
    u'OpenStack DevStack Team', 'manual'),
 ]
 
diff --git a/doc/source/index.rst b/doc/source/index.rst
index 8f958585ee..6694022316 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -11,9 +11,8 @@
    and how to go beyond this setup. Both should be a set of quick
    links to other documents to let people explore from there.
 
-==========
- DevStack
-==========
+DevStack
+========
 
 .. image:: assets/images/logo-blue.png
 
@@ -32,7 +31,7 @@ The source is available at `<https://opendev.org/openstack/devstack>`__.
    are dedicated to this purpose.
 
 Quick Start
-===========
++++++++++++
 
 Install Linux
 -------------
@@ -153,7 +152,7 @@ with devstack, and help us by :doc:`contributing to the project
 <hacking>`.
 
 Contents
---------
+++++++++
 
 .. toctree::
    :glob:
diff --git a/tox.ini b/tox.ini
index d81107fe1a..26baa2a1c5 100644
--- a/tox.ini
+++ b/tox.ini
@@ -43,6 +43,14 @@ setenv =
 commands =
   sphinx-build -W -b html -d doc/build/doctrees doc/source doc/build/html
 
+[testenv:pdf-docs]
+basepython = python3
+deps = {[testenv:docs]deps}
+whitelist_externals =
+   make
+commands =
+   sphinx-build -W -b latex doc/source doc/build/pdf
+   make -C doc/build/pdf
 
 [testenv:venv]
 basepython = python3

From 594885c80864710846f4fed35f19dc30a060f446 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Fri, 27 Sep 2019 16:45:09 -0400
Subject: [PATCH 1604/2409] Centralize and configure nova with cinder service
 user access

Since Queens [1] nova has been able to be configured with
cinder service user credentials for operating on cinder
resources without a user auth token similar to things nova
needs to do without a user auth token for working with neutron
and placement resources.

This change:

- centralizes the nova [cinder] section configuration
- adds the necessary auth configuration

Needed by: https://review.opendev.org/549130/

[1] I3c35bba43fee81baebe8261f546c1424ce3a3383

Change-Id: I5640ee431f6856853f6b00ec7ed1ea21d05117dd
---
 lib/nova | 31 ++++++++++++++++++++++++-------
 1 file changed, 24 insertions(+), 7 deletions(-)

diff --git a/lib/nova b/lib/nova
index c41f881fa1..33d0a9f8a8 100644
--- a/lib/nova
+++ b/lib/nova
@@ -468,11 +468,7 @@ function create_nova_conf {
     fi
 
     if is_service_enabled cinder; then
-        if is_service_enabled tls-proxy; then
-            CINDER_SERVICE_HOST=${CINDER_SERVICE_HOST:-$SERVICE_HOST}
-            CINDER_SERVICE_PORT=${CINDER_SERVICE_PORT:-8776}
-            iniset $NOVA_CONF cinder cafile $SSL_BUNDLE_FILE
-        fi
+        configure_cinder_access
     fi
 
     if [ -n "$NOVA_STATE_PATH" ]; then
@@ -520,8 +516,6 @@ function create_nova_conf {
     # don't let the conductor get out of control now that we're using a pure python db driver
     iniset $NOVA_CONF conductor workers "$API_WORKERS"
 
-    iniset $NOVA_CONF cinder os_region_name "$REGION_NAME"
-
     if is_service_enabled tls-proxy; then
         iniset $NOVA_CONF DEFAULT glance_protocol https
         iniset $NOVA_CONF oslo_middleware enable_proxy_headers_parsing True
@@ -593,6 +587,29 @@ function configure_placement_nova_compute {
     iniset $conf placement region_name "$REGION_NAME"
 }
 
+# Configure access to cinder.
+function configure_cinder_access {
+    iniset $NOVA_CONF cinder os_region_name "$REGION_NAME"
+    iniset $NOVA_CONF cinder auth_type "password"
+    iniset $NOVA_CONF cinder auth_url "$KEYSTONE_SERVICE_URI"
+    # NOTE(mriedem): This looks a bit weird but we use the nova user here
+    # since it has the admin role and the cinder user does not. This is
+    # similar to using the nova user in init_nova_service_user_conf. We need
+    # to use a user with the admin role for background tasks in nova to
+    # be able to GET block-storage API resources owned by another project
+    # since cinder has low-level "is_admin" checks in its DB API.
+    iniset $NOVA_CONF cinder username nova
+    iniset $NOVA_CONF cinder password "$SERVICE_PASSWORD"
+    iniset $NOVA_CONF cinder user_domain_name "$SERVICE_DOMAIN_NAME"
+    iniset $NOVA_CONF cinder project_name "$SERVICE_TENANT_NAME"
+    iniset $NOVA_CONF cinder project_domain_name "$SERVICE_DOMAIN_NAME"
+    if is_service_enabled tls-proxy; then
+        CINDER_SERVICE_HOST=${CINDER_SERVICE_HOST:-$SERVICE_HOST}
+        CINDER_SERVICE_PORT=${CINDER_SERVICE_PORT:-8776}
+        iniset $NOVA_CONF cinder cafile $SSL_BUNDLE_FILE
+    fi
+}
+
 function configure_console_compute {
     # If we are running multiple cells (and thus multiple console proxies) on a
     # single host, we offset the ports to avoid collisions.  We need to

From c67a689fe56f55fa3cd288fba76f88d3aa5b9b8d Mon Sep 17 00:00:00 2001
From: Luigi Toscano <ltoscano@redhat.com>
Date: Tue, 1 Oct 2019 20:14:22 +0200
Subject: [PATCH 1605/2409] Ensure that the zuul home can be traversed

The default permissions for the zuul home directory
are not the same in the various distributions.
As /home/zuul contains the sources, a 700 default may be
problematic when accessing those files, so make sure
that the executable permissions are set.

Closes-Bug: 1846251
Change-Id: Ic9769e56274d7205844b86d3b5200a6415e4acad
---
 playbooks/pre.yaml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/playbooks/pre.yaml b/playbooks/pre.yaml
index 4689a6354f..60f365aa7a 100644
--- a/playbooks/pre.yaml
+++ b/playbooks/pre.yaml
@@ -1,5 +1,12 @@
 - hosts: all
   pre_tasks:
+    - name: Fix the permissions of the zuul home directory
+      # Make sure that the zuul home can be traversed,
+      # so that all users can access the sources placed there.
+      # Some distributions create it with 700 by default.
+      file:
+        path: "{{ ansible_user_dir }}"
+        mode: a+x
     - name: Gather minimum local MTU
       set_fact:
         local_mtu: >

From deb3ff50f15bc89921ea548f5b53d49492c5ee65 Mon Sep 17 00:00:00 2001
From: Akihiro Motoki <amotoki@gmail.com>
Date: Wed, 24 Jul 2019 17:08:44 +0900
Subject: [PATCH 1606/2409] lib/horizon: no need to specify keystone v3 to API
 version

keystone v3 is the default API version in horizon now,
so there is no need to specify it in local_settings.py explicitly.

This commit also makes minor changes in lib/horizon
_horizon_config_set().

* Do not insert a blank line after each setting.
* Use the local variable $file to specify the target file
  consistently.

Change-Id: I5faea3e1f357726a256d2b48fc1afeabfead4998
---
 lib/horizon | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/lib/horizon b/lib/horizon
index 293a627c78..b2bf7bcb49 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -43,8 +43,8 @@ function _horizon_config_set {
     local value=$4
 
     if [ -z "$section" ]; then
-        sed -e "/^$option/d" -i $local_settings
-        echo -e "\n$option=$value" >> $file
+        sed -e "/^$option/d" -i $file
+        echo "$option = $value" >> $file
     elif grep -q "^$section" $file; then
         local line
         line=$(sed -ne "/^$section/,/^}/ { /^ *'$option':/ p; }" $file)
@@ -84,6 +84,9 @@ function configure_horizon {
     local local_settings=$HORIZON_DIR/openstack_dashboard/local/local_settings.py
     cp $HORIZON_SETTINGS $local_settings
 
+    # Ensure local_setting.py file ends with EOL (newline)
+    echo >> $local_settings
+
     _horizon_config_set $local_settings "" WEBROOT \"$HORIZON_APACHE_ROOT/\"
 
     _horizon_config_set $local_settings "" COMPRESS_OFFLINE True
@@ -91,7 +94,6 @@ function configure_horizon {
 
     _horizon_config_set $local_settings "" OPENSTACK_HOST \"${KEYSTONE_SERVICE_HOST}\"
 
-    _horizon_config_set $local_settings "" OPENSTACK_API_VERSIONS {\"identity\":3}
     _horizon_config_set $local_settings "" OPENSTACK_KEYSTONE_URL "\"${KEYSTONE_SERVICE_URI}/v3\""
 
     # note(trebskit): if HOST_IP points at non-localhost ip address, horizon cannot be accessed

From 5c6b3c32791f6a1b6e3646e739d41ae86d866d45 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 4 Oct 2019 09:31:53 +1000
Subject: [PATCH 1607/2409] Add override variable for LIBVIRT_TYPE

Allow jobs to set LIBVIRT_TYPE, but retain the current default.  This
is for testing nested virt.

Change-Id: Ife215db3f59f011574a50b0d1cbd5565a7408dfe
---
 .zuul.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index f7594d4ddc..cc94369988 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -219,8 +219,8 @@
         VERBOSE_NO_TIMESTAMP: true
         NOVNC_FROM_PACKAGE: true
         ERROR_ON_CLONE: true
-        # Gate jobs can't deal with nested virt. Disable it.
-        LIBVIRT_TYPE: qemu
+        # Gate jobs can't deal with nested virt. Disable it by default.
+        LIBVIRT_TYPE: '{{ devstack_libvirt_type | default("qemu") }}'
       devstack_services:
         # Ignore any default set by devstack. Emit a "disable_all_services".
         base: false

From dad5665036c83dfc25de28fe82ad7831b6f0915c Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Mon, 7 Oct 2019 17:21:46 +0000
Subject: [PATCH 1608/2409] Update DEVSTACK_SERIES to ussuri

stable/train branch has been created now and
current master is for ussuri.

Change-Id: I2bb84cb4b32e344572a7c3e6f300c1aa19e486df
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 10117f2700..e8ee4e09bd 100644
--- a/stackrc
+++ b/stackrc
@@ -258,7 +258,7 @@ REQUIREMENTS_DIR=$DEST/requirements
 # Setting the variable to 'ALL' will activate the download for all
 # libraries.
 
-DEVSTACK_SERIES="train"
+DEVSTACK_SERIES="ussuri"
 
 ##############
 #

From 8c86e5a53e1c77fc17df7d979f6435b534021d13 Mon Sep 17 00:00:00 2001
From: Eric Harney <eharney@redhat.com>
Date: Thu, 17 Oct 2019 15:42:41 -0400
Subject: [PATCH 1609/2409] Cinder: only set volume_clear for LVM

This only applies to the LVM driver (when using
thick provisioning), and doesn't have any effect on
other backends like NFS, so only write the conf entry
for LVM.

Change-Id: I722ba2fa0010d9887ed9b7fdd9e050cd4694768e
---
 lib/cinder              | 3 ---
 lib/cinder_backends/lvm | 2 +-
 2 files changed, 1 insertion(+), 4 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index fd960535d9..2e6e97a006 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -250,9 +250,6 @@ function configure_cinder {
                 default_name=$be_name
             fi
             enabled_backends+=$be_name,
-
-            iniset $CINDER_CONF $be_name volume_clear $CINDER_VOLUME_CLEAR
-
         done
         iniset $CINDER_CONF DEFAULT enabled_backends ${enabled_backends%,*}
         if [[ -n "$default_name" ]]; then
diff --git a/lib/cinder_backends/lvm b/lib/cinder_backends/lvm
index 497081c9e4..e03ef14c55 100644
--- a/lib/cinder_backends/lvm
+++ b/lib/cinder_backends/lvm
@@ -52,7 +52,7 @@ function configure_cinder_backend_lvm {
     iniset $CINDER_CONF $be_name volume_group $VOLUME_GROUP_NAME-$be_name
     iniset $CINDER_CONF $be_name target_helper "$CINDER_ISCSI_HELPER"
     iniset $CINDER_CONF $be_name lvm_type "$CINDER_LVM_TYPE"
-
+    iniset $CINDER_CONF $be_name volume_clear "$CINDER_VOLUME_CLEAR"
 }
 
 # init_cinder_backend_lvm - Initialize volume group

From b14665f0dde0d0862d8755a796b9f680e42f790b Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Thu, 17 Oct 2019 19:34:05 +0000
Subject: [PATCH 1610/2409] Revert "Remove deprecated PostgreSQL database
 driver"

This reverts commit 168ca7f0a474f1207ee01dab0ca2e70f34783e9c.

Removing postgresql support from devstack was unnecessary
since it's not broken and not causing maintenance issues
as far as I know. The commit being reverted said that pg
support was deprecated in Pike but nothing in the docs or
commit message refer to official deprecation of postgres
support in devstack or openstack in general. Not to mention
that there are still postgres-based jobs that will no
longer work *and* the notification to the mailing list about
doing this happened *after* it was already done [1] leaving
stakeholders with no time to reply.

[1] http://lists.openstack.org/pipermail/openstack-discuss/2019-October/010196.html

Change-Id: Ie7036d37d79e6aba462b7c97f917e2e7aed108f9
---
 doc/source/configuration.rst          |  22 +++--
 doc/source/zuul_ci_jobs_migration.rst |   5 +-
 functions                             |   3 +-
 lib/databases/postgresql              | 137 ++++++++++++++++++++++++++
 stack.sh                              |   9 +-
 unstack.sh                            |   4 +
 6 files changed, 166 insertions(+), 14 deletions(-)
 create mode 100644 lib/databases/postgresql

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 62571e0760..45f4ffe6e9 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -326,23 +326,29 @@ a file, keep service logs and disable color in the stored files.
 Database Backend
 ----------------
 
-Support for the MySQL database backend is included. Addition database backends
-may be available via external plugins. Enabling of disabling MySQL is handled
-via the usual service functions and ``ENABLED_SERVICES``. For example, to
-disable MySQL in ``local.conf``::
+Multiple database backends are available. The available databases are defined
+in the lib/databases directory.
+``mysql`` is the default database, choose a different one by putting the
+following in the ``localrc`` section::
 
   disable_service mysql
+  enable_service postgresql
+
+``mysql`` is the default database.
 
 RPC Backend
 -----------
 
-Support for a RabbitMQ RPC backend is included. Additional RPC backends may be
-available via external plugins.  Enabling or disabling RabbitMQ is handled via
-the usual service functions and ``ENABLED_SERVICES``. For example, to disable
-RabbitMQ in ``local.conf``::
+Support for a RabbitMQ RPC backend is included. Additional RPC
+backends may be available via external plugins.  Enabling or disabling
+RabbitMQ is handled via the usual service functions and
+``ENABLED_SERVICES``.
+
+Example disabling RabbitMQ in ``local.conf``::
 
   disable_service rabbit
 
+
 Apache Frontend
 ---------------
 
diff --git a/doc/source/zuul_ci_jobs_migration.rst b/doc/source/zuul_ci_jobs_migration.rst
index 66f8251039..17e7e16fb7 100644
--- a/doc/source/zuul_ci_jobs_migration.rst
+++ b/doc/source/zuul_ci_jobs_migration.rst
@@ -302,7 +302,10 @@ migrated at all.
      - This will probably be implemented on ironic side.
    * - DEVSTACK_GATE_POSTGRES
      - Legacy
-     - This has no effect in d-g.
+     - This flag exists in d-g but the only thing that it does is
+       capture postgres logs. This is already supported by the roles
+       in post, so the flag is useless in the new jobs. postgres
+       itself can be enabled via the devstack_service job variable.
    * - DEVSTACK_GATE_ZEROMQ
      - Legacy
      - This has no effect in d-g.
diff --git a/functions b/functions
index 8eeb03203e..f33fd25fee 100644
--- a/functions
+++ b/functions
@@ -400,8 +400,7 @@ function upload_image {
 # initialized yet, just save the configuration selection and call back later
 # to validate it.
 #
-# ``$1`` - the name of the database backend to use (only mysql is currently
-# supported)
+# ``$1`` - the name of the database backend to use (mysql, postgresql, ...)
 function use_database {
     if [[ -z "$DATABASE_BACKENDS" ]]; then
         # No backends registered means this is likely called from ``localrc``
diff --git a/lib/databases/postgresql b/lib/databases/postgresql
new file mode 100644
index 0000000000..618834b550
--- /dev/null
+++ b/lib/databases/postgresql
@@ -0,0 +1,137 @@
+#!/bin/bash
+#
+# lib/databases/postgresql
+# Functions to control the configuration and operation of the **PostgreSQL** database backend
+
+# Dependencies:
+#
+# - DATABASE_{HOST,USER,PASSWORD} must be defined
+
+# Save trace setting
+_XTRACE_PG=$(set +o | grep xtrace)
+set +o xtrace
+
+
+MAX_DB_CONNECTIONS=${MAX_DB_CONNECTIONS:-200}
+
+
+register_database postgresql
+
+
+# Functions
+# ---------
+
+function get_database_type_postgresql {
+    echo postgresql
+}
+
+# Get rid of everything enough to cleanly change database backends
+function cleanup_database_postgresql {
+    stop_service postgresql
+    if is_ubuntu; then
+        # Get ruthless with mysql
+        apt_get purge -y postgresql*
+        return
+    elif is_fedora || is_suse; then
+        uninstall_package postgresql-server
+    else
+        return
+    fi
+}
+
+function recreate_database_postgresql {
+    local db=$1
+    # Avoid unsightly error when calling dropdb when the database doesn't exist
+    psql -h$DATABASE_HOST -U$DATABASE_USER -dtemplate1 -c "DROP DATABASE IF EXISTS $db"
+    createdb -h $DATABASE_HOST -U$DATABASE_USER -l C -T template0 -E utf8 $db
+}
+
+function configure_database_postgresql {
+    local pg_conf pg_dir pg_hba check_role version
+    echo_summary "Configuring and starting PostgreSQL"
+    if is_fedora; then
+        pg_hba=/var/lib/pgsql/data/pg_hba.conf
+        pg_conf=/var/lib/pgsql/data/postgresql.conf
+        if ! sudo [ -e $pg_hba ]; then
+            sudo postgresql-setup initdb
+        fi
+    elif is_ubuntu; then
+        version=`psql --version | cut -d ' ' -f3 | cut -d. -f1-2`
+        if vercmp $version '>=' 9.3; then
+            if [ -z "`pg_lsclusters -h`" ]; then
+                echo 'No PostgreSQL clusters exist; will create one'
+                sudo pg_createcluster $version main --start
+            fi
+        fi
+        pg_dir=`find /etc/postgresql -name pg_hba.conf|xargs dirname`
+        pg_hba=$pg_dir/pg_hba.conf
+        pg_conf=$pg_dir/postgresql.conf
+    elif is_suse; then
+        pg_hba=/var/lib/pgsql/data/pg_hba.conf
+        pg_conf=/var/lib/pgsql/data/postgresql.conf
+        # initdb is called when postgresql is first started
+        sudo [ -e $pg_hba ] || start_service postgresql
+    else
+        exit_distro_not_supported "postgresql configuration"
+    fi
+    # Listen on all addresses
+    sudo sed -i "/listen_addresses/s/.*/listen_addresses = '*'/" $pg_conf
+    # Set max_connections
+    sudo sed -i "/max_connections/s/.*/max_connections = $MAX_DB_CONNECTIONS/" $pg_conf
+    # Do password auth from all IPv4 clients
+    sudo sed -i "/^host/s/all\s\+127.0.0.1\/32\s\+ident/$DATABASE_USER\t0.0.0.0\/0\tpassword/" $pg_hba
+    # Do password auth for all IPv6 clients
+    sudo sed -i "/^host/s/all\s\+::1\/128\s\+ident/$DATABASE_USER\t::0\/0\tpassword/" $pg_hba
+    restart_service postgresql
+
+    # Create the role if it's not here or else alter it.
+    check_role=$(sudo -u root sudo -u postgres -i psql -t -c "SELECT 'HERE' from pg_roles where rolname='$DATABASE_USER'")
+    if [[ ${check_role} == *HERE ]];then
+        sudo -u root sudo -u postgres -i psql -c "ALTER ROLE $DATABASE_USER WITH SUPERUSER LOGIN PASSWORD '$DATABASE_PASSWORD'"
+    else
+        sudo -u root sudo -u postgres -i psql -c "CREATE ROLE $DATABASE_USER WITH SUPERUSER LOGIN PASSWORD '$DATABASE_PASSWORD'"
+    fi
+}
+
+function install_database_postgresql {
+    echo_summary "Installing postgresql"
+    deprecated "Use of postgresql in devstack is deprecated, and will be removed during the Pike cycle"
+    local pgpass=$HOME/.pgpass
+    if [[ ! -e $pgpass ]]; then
+        cat <<EOF > $pgpass
+*:*:*:$DATABASE_USER:$DATABASE_PASSWORD
+EOF
+        chmod 0600 $pgpass
+    else
+        sed -i "s/:root:\w\+/:root:$DATABASE_PASSWORD/" $pgpass
+    fi
+    if is_ubuntu; then
+        install_package postgresql
+    elif is_fedora || is_suse; then
+        install_package postgresql-server
+        if is_fedora; then
+            sudo systemctl enable postgresql
+        fi
+    else
+        exit_distro_not_supported "postgresql installation"
+    fi
+}
+
+function install_database_python_postgresql {
+    # Install Python client module
+    pip_install_gr psycopg2
+    ADDITIONAL_VENV_PACKAGES+=",psycopg2"
+}
+
+function database_connection_url_postgresql {
+    local db=$1
+    echo "$BASE_SQL_CONN/$db?client_encoding=utf8"
+}
+
+
+# Restore xtrace
+$_XTRACE_PG
+
+# Local variables:
+# mode: shell-script
+# End:
diff --git a/stack.sh b/stack.sh
index c652f65403..b7b37e2cf6 100755
--- a/stack.sh
+++ b/stack.sh
@@ -695,11 +695,14 @@ function read_password {
 # Database Configuration
 # ----------------------
 
-# DevStack provides a MySQL database backend. Additional backends may be
-# provided by external plugins and can be enabled using the usual service
-# functions and ``ENABLED_SERVICES``. For example, to disable MySQL:
+# To select between database backends, add the following to ``local.conf``:
 #
 #    disable_service mysql
+#    enable_service postgresql
+#
+# The available database backends are listed in ``DATABASE_BACKENDS`` after
+# ``lib/database`` is sourced. ``mysql`` is the default.
+
 if initialize_database_backends; then
     echo "Using $DATABASE_TYPE database backend"
     # Last chance for the database password. This must be handled here
diff --git a/unstack.sh b/unstack.sh
index 07dc2b1418..ccea0ef585 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -147,6 +147,10 @@ if [[ -n "$UNSTACK_ALL" ]]; then
         stop_service mysql
     fi
 
+    if is_service_enabled postgresql; then
+        stop_service postgresql
+    fi
+
     # Stop rabbitmq-server
     if is_service_enabled rabbit; then
         stop_service rabbitmq-server

From a676c4029e46743ccf2e81ebd17cd306ffc4960d Mon Sep 17 00:00:00 2001
From: Armando Migliaccio <armamig@gmail.com>
Date: Wed, 2 Aug 2017 16:46:35 +0000
Subject: [PATCH 1611/2409] Revert "Generate deprecation warning for
 postgresql"

Based on resolution [1], there's no clear indication that next
steps involve the removal of the DB from Devstack or from the gate.

[1] I332cef8ec4539520adcf37c6d2ea11488289fcfd

This reverts commit d9aaae95f2b84170bf35e037715e4963d89f940c.

Change-Id: I8410d65c0e0b24035aa035fac7560a686d53ec50
---
 lib/databases/postgresql | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/databases/postgresql b/lib/databases/postgresql
index 618834b550..1f347f5548 100644
--- a/lib/databases/postgresql
+++ b/lib/databases/postgresql
@@ -95,7 +95,6 @@ function configure_database_postgresql {
 
 function install_database_postgresql {
     echo_summary "Installing postgresql"
-    deprecated "Use of postgresql in devstack is deprecated, and will be removed during the Pike cycle"
     local pgpass=$HOME/.pgpass
     if [[ ! -e $pgpass ]]; then
         cat <<EOF > $pgpass

From 1d378dcf6d3699d99838050cc804c64a1862ba8f Mon Sep 17 00:00:00 2001
From: melanie witt <melwittt@gmail.com>
Date: Wed, 23 Oct 2019 04:20:23 +0000
Subject: [PATCH 1612/2409] Remove n-novnc service requirement for TLS
 configuration

When configuring TLS between the console proxy (where the n-novnc
service runs) and the compute host, some configuration for QEMU needs
to be done on the compute host. The existing code for this requires the
n-novnc service to be running, which it is in a single node all-in-one
deployment. However, when running in a multinode deployment, the
n-novnc service runs only on the controller and not on the subnode.
Yet, we need to configure QEMU on the subnode compute host as well.

This removes the n-novnc service requirement to enable TLS QEMU
configuration to occur on a compute subnode in a multinode deployment.

Closes-Bug: #1849418

Change-Id: I8b6970e91ad7f52ff489cb9f776ca216d8f86aa4
---
 lib/nova_plugins/functions-libvirt | 28 +++++++++++++---------------
 1 file changed, 13 insertions(+), 15 deletions(-)

diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index 463986944f..914ee7bcf7 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -150,21 +150,19 @@ EOF
     fi
 
     if is_nova_console_proxy_compute_tls_enabled ; then
-        if is_service_enabled n-novnc ; then
-            echo "vnc_tls = 1" | sudo tee -a $QEMU_CONF
-            echo "vnc_tls_x509_verify = 1" | sudo tee -a $QEMU_CONF
-
-            sudo mkdir -p /etc/pki/libvirt-vnc
-            deploy_int_CA /etc/pki/libvirt-vnc/ca-cert.pem
-            deploy_int_cert /etc/pki/libvirt-vnc/server-cert.pem /etc/pki/libvirt-vnc/server-key.pem
-            # OpenSSL 1.1.0 generates the key file with permissions: 600, by
-            # default and the deploy_int* methods use 'sudo cp' to copy the
-            # files, making them owned by root:root.
-            # Change ownership of everything under /etc/pki/libvirt-vnc to
-            # libvirt-qemu:libvirt-qemu so that libvirt-qemu can read the key
-            # file.
-            sudo chown -R libvirt-qemu:libvirt-qemu /etc/pki/libvirt-vnc
-        fi
+        echo "vnc_tls = 1" | sudo tee -a $QEMU_CONF
+        echo "vnc_tls_x509_verify = 1" | sudo tee -a $QEMU_CONF
+
+        sudo mkdir -p /etc/pki/libvirt-vnc
+        deploy_int_CA /etc/pki/libvirt-vnc/ca-cert.pem
+        deploy_int_cert /etc/pki/libvirt-vnc/server-cert.pem /etc/pki/libvirt-vnc/server-key.pem
+        # OpenSSL 1.1.0 generates the key file with permissions: 600, by
+        # default and the deploy_int* methods use 'sudo cp' to copy the
+        # files, making them owned by root:root.
+        # Change ownership of everything under /etc/pki/libvirt-vnc to
+        # libvirt-qemu:libvirt-qemu so that libvirt-qemu can read the key
+        # file.
+        sudo chown -R libvirt-qemu:libvirt-qemu /etc/pki/libvirt-vnc
     fi
 
     # Service needs to be started on redhat/fedora -- do a restart for

From da18895162bababea638b3f28c76cb9766e821b6 Mon Sep 17 00:00:00 2001
From: Brian Haley <bhaley@redhat.com>
Date: Thu, 31 Oct 2019 14:49:23 -0400
Subject: [PATCH 1613/2409] Fix brctl calls

Some distros no longer ship brctl, iproute2 should be used
in its place. The linuxbridge agent plugin script was still
using it, as was worlddump, which generates this warning on
a failure:

    Running devstack worlddump.py
    /bin/sh: 1: brctl: not found

Conditionalizing worlddump based on whether brctl is installed
to make this go away.

Change-Id: Iafbf4038bab08c261d45d117b12d4629ba32d65e
---
 lib/neutron_plugins/linuxbridge_agent | 2 +-
 tools/worlddump.py                    | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/lib/neutron_plugins/linuxbridge_agent b/lib/neutron_plugins/linuxbridge_agent
index fa3f86203d..1f1b0e8e52 100644
--- a/lib/neutron_plugins/linuxbridge_agent
+++ b/lib/neutron_plugins/linuxbridge_agent
@@ -48,7 +48,7 @@ function neutron_plugin_configure_dhcp_agent {
 
 function neutron_plugin_configure_l3_agent {
     local conf_file=$1
-    sudo brctl addbr $PUBLIC_BRIDGE
+    sudo ip link add $PUBLIC_BRIDGE type bridge
     set_mtu $PUBLIC_BRIDGE $PUBLIC_BRIDGE_MTU
 }
 
diff --git a/tools/worlddump.py b/tools/worlddump.py
index d1453ca076..d5ff5d1ab5 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -165,7 +165,8 @@ def network_dump():
     _header("Network Dump")
 
     _dump_cmd("bridge link")
-    _dump_cmd("brctl show")
+    if _find_cmd("brctl"):
+        _dump_cmd("brctl show")
     _dump_cmd("ip link show type bridge")
     ip_cmds = ["neigh", "addr", "link", "route"]
     for cmd in ip_cmds + ['netns']:

From 6c15c38f1a9e8e833a29637598f373d7ea29bc62 Mon Sep 17 00:00:00 2001
From: Flavio Fernandes <flaviof@redhat.com>
Date: Wed, 6 Nov 2019 07:11:33 -0500
Subject: [PATCH 1614/2409] stackrc: Make REQUIREMENTS_DIR configurable

In cases where global REQUIREMENTS_DIR is set, use it
instead of overwriting it. This is particularly needed
in cases where users of pip_install wrapper have the
upper-constraints.txt at another location.

Change-Id: I34e9f94548c575e1af5bca9655a3b7d1915375a8
Signed-off-by: Flavio Fernandes <flaviof@redhat.com>
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 3fcdadffa3..0f80143f39 100644
--- a/stackrc
+++ b/stackrc
@@ -240,7 +240,7 @@ WSGI_MODE=${WSGI_MODE:-"uwsgi"}
 GIT_BASE=${GIT_BASE:-https://opendev.org}
 
 # The location of REQUIREMENTS once cloned
-REQUIREMENTS_DIR=$DEST/requirements
+REQUIREMENTS_DIR=${REQUIREMENTS_DIR:-$DEST/requirements}
 
 # Which libraries should we install from git instead of using released
 # versions on pypi?

From 0e02e7fd55276678ba839a098896b6142363147c Mon Sep 17 00:00:00 2001
From: Zane Bitter <zbitter@redhat.com>
Date: Thu, 14 Nov 2019 14:01:27 -0500
Subject: [PATCH 1615/2409] Don't install glance default policy

With Glance defining default policies in code, it's no longer necessary
to install policy.json from the repo.

Change-Id: I9f9160f5a2bf9fd77fb3807e12de219b7a49952d
Depends-On: https://review.opendev.org/693129
---
 lib/glance | 2 --
 1 file changed, 2 deletions(-)

diff --git a/lib/glance b/lib/glance
index 54d3276433..740bcabf6a 100644
--- a/lib/glance
+++ b/lib/glance
@@ -52,7 +52,6 @@ GLANCE_API_CONF=$GLANCE_CONF_DIR/glance-api.conf
 GLANCE_REGISTRY_PASTE_INI=$GLANCE_CONF_DIR/glance-registry-paste.ini
 GLANCE_API_PASTE_INI=$GLANCE_CONF_DIR/glance-api-paste.ini
 GLANCE_CACHE_CONF=$GLANCE_CONF_DIR/glance-cache.conf
-GLANCE_POLICY_JSON=$GLANCE_CONF_DIR/policy.json
 GLANCE_SCHEMA_JSON=$GLANCE_CONF_DIR/schema-image.json
 GLANCE_SWIFT_STORE_CONF=$GLANCE_CONF_DIR/glance-swift-store.conf
 GLANCE_IMAGE_IMPORT_CONF=$GLANCE_CONF_DIR/glance-image-import.conf
@@ -220,7 +219,6 @@ function configure_glance {
     iniset $GLANCE_IMAGE_IMPORT_CONF inject_metadata_properties ignore_user_roles admin
     iniset $GLANCE_IMAGE_IMPORT_CONF inject_metadata_properties inject
 
-    cp -p $GLANCE_DIR/etc/policy.json $GLANCE_POLICY_JSON
     cp -p $GLANCE_DIR/etc/schema-image.json $GLANCE_SCHEMA_JSON
 
     cp -p $GLANCE_DIR/etc/metadefs/*.json $GLANCE_METADEF_DIR

From 277f29f68300a5598c02f48ebeb4039528435774 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Tue, 19 Nov 2019 10:09:11 +0000
Subject: [PATCH 1616/2409] Drop centos7 platform job

The centos7 job is running with python2, which is no longer supported by
nova, so we can drop it in master.

Change-Id: Id9ef507dd6f4226d65c6ed3043666b0aa6a3bd1c
---
 .zuul.yaml | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index cc94369988..13b98eb923 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -520,13 +520,6 @@
 # we often have to rush things through devstack to stabilise the gate,
 # and these platforms don't have the round-the-clock support to avoid
 # becoming blockers in that situation.
-- job:
-    name: devstack-platform-centos-7
-    parent: tempest-full
-    description: Centos 7 platform test
-    nodeset: devstack-single-node-centos-7
-    voting: false
-
 - job:
     name: devstack-platform-opensuse-15
     parent: tempest-full-py3
@@ -621,7 +614,6 @@
         - devstack
         - devstack-xenial
         - devstack-ipv6
-        - devstack-platform-centos-7
         - devstack-platform-opensuse-15
         - devstack-platform-fedora-latest
         - devstack-platform-xenial

From 2d112db86b1b6861f6b4844bef324bda3a89248b Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Thu, 14 Nov 2019 11:35:29 +0100
Subject: [PATCH 1617/2409] Drop old neutron-grenade job

This job is still running python 2.7. As we are dropping py2 support in
Ussuri cycle, lets drop this job now.
There is same job called "grenade-py3" which runs on python 3 already
and this will be now used in project's CI.

Depends-On: https://review.opendev.org/#/c/695036/

Change-Id: I5cd8e137a3ae06e49a4351629c5eb207c4e6bf1a
---
 .zuul.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index cc94369988..7c32298a7a 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -636,7 +636,7 @@
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
-        - neutron-grenade:
+        - grenade-py3:
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
@@ -678,7 +678,7 @@
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
-        - neutron-grenade:
+        - grenade-py3:
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$

From 39082a3b4ede7ba84fcc01a6d00e9cd66e2f582d Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Tue, 2 Apr 2019 11:03:06 +0000
Subject: [PATCH 1618/2409] Handle localrc early enough in stackrc

We need to source the environment overrides before they get evaluated.
Otherwise e.g. USE_PYTHON3 is factually being ignored for some settings.

Also fix creating python3 venvs by using the "virtualenv" command for
that task.

Change-Id: I16c78a7fef80372d9a1684c3256c5b50b052ecae
---
 stackrc | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/stackrc b/stackrc
index 3fcdadffa3..ab55e13512 100644
--- a/stackrc
+++ b/stackrc
@@ -89,6 +89,15 @@ ENABLE_HTTPD_MOD_WSGI_SERVICES=True
 # Set the default Nova APIs to enable
 NOVA_ENABLED_APIS=osapi_compute,metadata
 
+# allow local overrides of env variables, including repo config
+if [[ -f $RC_DIR/localrc ]]; then
+    # Old-style user-supplied config
+    source $RC_DIR/localrc
+elif [[ -f $RC_DIR/.localrc.auto ]]; then
+    # New-style user-supplied config extracted from local.conf
+    source $RC_DIR/.localrc.auto
+fi
+
 # CELLSV2_SETUP - how we should configure services with cells v2
 #
 # - superconductor - this is one conductor for the api services, and
@@ -145,20 +154,11 @@ export PYTHON2_VERSION=${PYTHON2_VERSION:-${_DEFAULT_PYTHON2_VERSION:-2.7}}
 
 # Create a virtualenv with this
 if [[ ${USE_PYTHON3} == True ]]; then
-    export VIRTUALENV_CMD="python3 -m venv"
+    export VIRTUALENV_CMD="virtualenv -p python3"
 else
     export VIRTUALENV_CMD="virtualenv "
 fi
 
-# allow local overrides of env variables, including repo config
-if [[ -f $RC_DIR/localrc ]]; then
-    # Old-style user-supplied config
-    source $RC_DIR/localrc
-elif [[ -f $RC_DIR/.localrc.auto ]]; then
-    # New-style user-supplied config extracted from local.conf
-    source $RC_DIR/.localrc.auto
-fi
-
 # Default for log coloring is based on interactive-or-not.
 # Baseline assumption is that non-interactive invocations are for CI,
 # where logs are to be presented as browsable text files; hence color

From 48b519b5c62be33388b76fd25eebb5673d1e2c18 Mon Sep 17 00:00:00 2001
From: Matt Riedemann <mriedem.os@gmail.com>
Date: Mon, 1 Apr 2019 12:22:42 -0400
Subject: [PATCH 1619/2409] Change USE_PYTHON3=True by default

Since Stein, gate jobs have been using bionic nodes so they
are running with python 3.6, so it makes sense to also default
devstack itself to run with python3 by default.

Depends-On: https://review.opendev.org/688731

Change-Id: I52b03caee0ba700da3a15035201ea6cd91baa06b
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index ab55e13512..c796f3ae26 100644
--- a/stackrc
+++ b/stackrc
@@ -136,7 +136,7 @@ if [[ -r $RC_DIR/.localrc.password ]]; then
 fi
 
 # Control whether Python 3 should be used at all.
-export USE_PYTHON3=$(trueorfalse False USE_PYTHON3)
+export USE_PYTHON3=$(trueorfalse True USE_PYTHON3)
 
 # Explicitly list services not to run under Python 3. See
 # disable_python3_package to edit this variable.

From 279a7589b03db69fd1b85d947cd0171dacef94ee Mon Sep 17 00:00:00 2001
From: "Jens Harbott (frickler)" <j.harbott@x-ion.de>
Date: Mon, 16 Apr 2018 12:08:30 +0000
Subject: [PATCH 1620/2409] Revert "Do not use pip 10 or higher"

This reverts commit f99d1771ba1882dfbb69186212a197edae3ef02c.

Added workarounds that might want to get split into their own patch
before merging:

- Don't install python-psutil
- Don't run peakmem_tracker

Change-Id: If4fb16555e15082a4d97cffdf3cfa608a682997d
---
 .zuul.yaml            | 4 ----
 files/debs/dstat      | 1 -
 files/rpms-suse/dstat | 1 -
 files/rpms/dstat      | 1 -
 tools/cap-pip.txt     | 1 -
 tools/install_pip.sh  | 6 +++---
 6 files changed, 3 insertions(+), 11 deletions(-)
 delete mode 100644 tools/cap-pip.txt

diff --git a/.zuul.yaml b/.zuul.yaml
index 7c32298a7a..19dee584fc 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -320,14 +320,12 @@
         dstat: true
         etcd3: true
         mysql: true
-        peakmem_tracker: true
         rabbit: true
     group-vars:
       subnode:
         devstack_services:
           # Shared services
           dstat: true
-          peakmem_tracker: true
         devstack_localrc:
           # Multinode specific settings
           HOST_IP: "{{ hostvars[inventory_hostname]['nodepool']['private_ipv4'] }}"
@@ -394,7 +392,6 @@
         dstat: true
         etcd3: true
         mysql: true
-        peakmem_tracker: true
         rabbit: true
         tls-proxy: true
         # Keystone services
@@ -450,7 +447,6 @@
           # This list replaces the test-matrix.
           # Shared services
           dstat: true
-          peakmem_tracker: true
           tls-proxy: true
           # Nova services
           n-cpu: true
diff --git a/files/debs/dstat b/files/debs/dstat
index 0d9da4434f..2b643b8b1b 100644
--- a/files/debs/dstat
+++ b/files/debs/dstat
@@ -1,2 +1 @@
 dstat
-python-psutil
diff --git a/files/rpms-suse/dstat b/files/rpms-suse/dstat
index 0d9da4434f..2b643b8b1b 100644
--- a/files/rpms-suse/dstat
+++ b/files/rpms-suse/dstat
@@ -1,2 +1 @@
 dstat
-python-psutil
diff --git a/files/rpms/dstat b/files/rpms/dstat
index b058c277cb..d7b272a93b 100644
--- a/files/rpms/dstat
+++ b/files/rpms/dstat
@@ -1,3 +1,2 @@
 dstat # not:f29
 pcp-system-tools # dist:f29
-python-psutil
diff --git a/tools/cap-pip.txt b/tools/cap-pip.txt
deleted file mode 100644
index f5278d7c86..0000000000
--- a/tools/cap-pip.txt
+++ /dev/null
@@ -1 +0,0 @@
-pip!=8,<10
diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index 2b6aa4c2e8..dcd546629f 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -89,9 +89,9 @@ function install_get_pip {
             die $LINENO "Download of get-pip.py failed"
         touch $LOCAL_PIP.downloaded
     fi
-    sudo -H -E python $LOCAL_PIP -c $TOOLS_DIR/cap-pip.txt
-    if python3_enabled; then
-        sudo -H -E python${PYTHON3_VERSION} $LOCAL_PIP -c $TOOLS_DIR/cap-pip.txt
+    sudo -H -E python${PYTHON3_VERSION} $LOCAL_PIP
+    if ! python3_enabled; then
+        sudo -H -E python $LOCAL_PIP
     fi
 }
 

From 2e6677869925c86c01cae883b3dde6cccad81d30 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Wed, 20 Nov 2019 10:41:34 +1100
Subject: [PATCH 1621/2409] Drop Xenial support

With the goals of Ussuri being Python 3.6 [1], the python 3.5
environment on Xenial is too old.  Remove testing and the most obvious
bits of support from devstack.

Also drop claimed support for artful, which is long EOL.

[1] https://governance.openstack.org/tc/reference/runtimes/ussuri.html

Change-Id: Iefcca99904dde76b34efbbfc0e04515dfa5a09e5
---
 .zuul.yaml                         | 29 -------------------------
 files/debs/nova                    |  5 ++---
 lib/nova_plugins/functions-libvirt | 18 +++------------
 stack.sh                           |  4 ++--
 stackrc                            |  3 ---
 tools/fixup_stuff.sh               | 35 ++----------------------------
 6 files changed, 9 insertions(+), 85 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index cc94369988..8f64620426 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -491,14 +491,6 @@
         # https://bugs.launchpad.net/devstack/+bug/1794929
         USE_PYTHON3: true
 
-- job:
-    name: devstack-xenial
-    parent: devstack
-    nodeset: openstack-single-node-xenial
-    description: |
-      Simple singlenode test to verify functionality on devstack
-      side running on Xenial.
-
 - job:
     name: devstack-multinode
     parent: devstack
@@ -507,15 +499,6 @@
       Simple multinode test to verify multinode functionality on devstack side.
       This is not meant to be used as a parent job.
 
-- job:
-    name: devstack-multinode-xenial
-    parent: devstack
-    nodeset: openstack-two-node-xenial
-    description: |
-      Simple multinode test to verify multinode functionality on devstack
-      side running on Xenial.
-      This is not meant to be used as a parent job.
-
 # NOTE(ianw) Platform tests have traditionally been non-voting because
 # we often have to rush things through devstack to stabilise the gate,
 # and these platforms don't have the round-the-clock support to avoid
@@ -541,13 +524,6 @@
     nodeset: devstack-single-node-fedora-latest
     voting: false
 
-- job:
-    name: devstack-platform-xenial
-    parent: tempest-full-py3
-    description: Ubuntu Xenial platform test
-    nodeset: openstack-single-node-xenial
-    voting: false
-
 - job:
     name: devstack-tox-base
     parent: devstack
@@ -619,14 +595,11 @@
     check:
       jobs:
         - devstack
-        - devstack-xenial
         - devstack-ipv6
         - devstack-platform-centos-7
         - devstack-platform-opensuse-15
         - devstack-platform-fedora-latest
-        - devstack-platform-xenial
         - devstack-multinode
-        - devstack-multinode-xenial
         - devstack-unit-tests
         - openstack-tox-bashate
         - ironic-tempest-ipa-wholedisk-bios-agent_ipmitool-tinyipa:
@@ -664,10 +637,8 @@
     gate:
       jobs:
         - devstack
-        - devstack-xenial
         - devstack-ipv6
         - devstack-multinode
-        - devstack-multinode-xenial
         - devstack-unit-tests
         - openstack-tox-bashate
         - neutron-grenade-multinode:
diff --git a/files/debs/nova b/files/debs/nova
index 5e14aec836..e5110e9c75 100644
--- a/files/debs/nova
+++ b/files/debs/nova
@@ -10,9 +10,8 @@ iputils-arping
 kpartx
 libjs-jquery-tablesorter # Needed for coverage html reports
 libmysqlclient-dev
-libvirt-bin # dist:xenial NOPRIME
-libvirt-clients # not:xenial NOPRIME
-libvirt-daemon-system # not:xenial NOPRIME
+libvirt-clients # NOPRIME
+libvirt-daemon-system # NOPRIME
 libvirt-dev # NOPRIME
 mysql-server # NOPRIME
 parted
diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index 914ee7bcf7..35666393ca 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -24,17 +24,10 @@ DEBUG_LIBVIRT=$(trueorfalse True DEBUG_LIBVIRT)
 # Currently fairly specific to OpenStackCI hosts
 DEBUG_LIBVIRT_COREDUMPS=$(trueorfalse False DEBUG_LIBVIRT_COREDUMPS)
 
-# Only Xenial is left with libvirt-bin.  Everywhere else is libvirtd
-if is_ubuntu && [ ${DISTRO} == "xenial" ]; then
-    LIBVIRT_DAEMON=libvirt-bin
-else
-    LIBVIRT_DAEMON=libvirtd
-fi
-
 # Enable coredumps for libvirt
 #  Bug: https://bugs.launchpad.net/nova/+bug/1643911
 function _enable_coredump {
-    local confdir=/etc/systemd/system/${LIBVIRT_DAEMON}.service.d
+    local confdir=/etc/systemd/system/libvirtd.service.d
     local conffile=${confdir}/coredump.conf
 
     # Create a coredump directory, and instruct the kernel to save to
@@ -61,12 +54,7 @@ EOF
 function install_libvirt {
 
     if is_ubuntu; then
-        install_package qemu-system
-        if [[ ${DISTRO} == "xenial" ]]; then
-            install_package libvirt-bin libvirt-dev
-        else
-            install_package libvirt-clients libvirt-daemon-system libvirt-dev
-        fi
+        install_package qemu-system libvirt-clients libvirt-daemon-system libvirt-dev
         # uninstall in case the libvirt version changed
         pip_uninstall libvirt-python
         pip_install_gr libvirt-python
@@ -167,7 +155,7 @@ EOF
 
     # Service needs to be started on redhat/fedora -- do a restart for
     # sanity after fiddling the config.
-    restart_service $LIBVIRT_DAEMON
+    restart_service libvirtd
 
     # Restart virtlogd companion service to ensure it is running properly
     #  https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1577455
diff --git a/stack.sh b/stack.sh
index b7b37e2cf6..d0206ebac0 100755
--- a/stack.sh
+++ b/stack.sh
@@ -12,7 +12,7 @@
 # a multi-node developer install.
 
 # To keep this script simple we assume you are running on a recent **Ubuntu**
-# (16.04 Xenial or newer), **Fedora** (F24 or newer), or **CentOS/RHEL**
+# (Bionic or newer), **Fedora** (F24 or newer), or **CentOS/RHEL**
 # (7 or newer) machine. (It may work on other platforms but support for those
 # platforms is left to those who added them to DevStack.) It should work in
 # a VM or physical server. Additionally, we maintain a list of ``deb`` and
@@ -221,7 +221,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (xenial|artful|bionic|stretch|jessie|f29|opensuse-15.0|opensuse-15.1|opensuse-tumbleweed|rhel7) ]]; then
+if [[ ! ${DISTRO} =~ (bionic|stretch|jessie|f29|opensuse-15.0|opensuse-15.1|opensuse-tumbleweed|rhel7) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"
diff --git a/stackrc b/stackrc
index 3fcdadffa3..15150df43b 100644
--- a/stackrc
+++ b/stackrc
@@ -656,9 +656,6 @@ case "$VIRT_DRIVER" in
         ;;
 esac
 
-# By default, devstack will use Ubuntu Cloud Archive.
-ENABLE_UBUNTU_CLOUD_ARCHIVE=$(trueorfalse True ENABLE_UBUNTU_CLOUD_ARCHIVE)
-
 # Images
 # ------
 
diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index d2989379fe..eb8a76f276 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -71,15 +71,9 @@ function fixup_keystone {
 
 # Ubuntu Repositories
 #--------------------
-# We've found that Libvirt on Xenial is flaky and crashes enough to be
-# a regular top e-r bug. Opt into Ubuntu Cloud Archive if on Xenial to
-# get newer Libvirt.
-# Make it possible to switch this based on an environment variable as
-# libvirt 2.5.0 doesn't handle nested virtualization quite well and this
-# is required for the trove development environment.
-# Also enable universe since it is missing when installing from ISO.
+# Enable universe for bionic since it is missing when installing from ISO.
 function fixup_ubuntu {
-    if [[ "$DISTRO" != "xenial" && "$DISTRO" != "bionic" ]]; then
+    if [[ "$DISTRO" != "bionic" ]]; then
         return
     fi
 
@@ -88,31 +82,6 @@ function fixup_ubuntu {
 
     # Enable universe
     sudo add-apt-repository -y universe
-
-    if [[ "${ENABLE_UBUNTU_CLOUD_ARCHIVE}" == "False" || "$DISTRO" != "xenial" ]]; then
-        return
-    fi
-    # Use UCA for newer libvirt.
-    if [[ -f /etc/ci/mirror_info.sh ]] ; then
-        # If we are on a nodepool provided host and it has told us about where
-        # we can find local mirrors then use that mirror.
-        source /etc/ci/mirror_info.sh
-
-        sudo apt-add-repository -y "deb $NODEPOOL_UCA_MIRROR xenial-updates/queens main"
-    else
-        # Otherwise use upstream UCA
-        sudo add-apt-repository -y cloud-archive:queens
-    fi
-
-    # Disable use of libvirt wheel since a cached wheel build might be
-    # against older libvirt binary.  Particularly a problem if using
-    # the openstack wheel mirrors, but can hit locally too.
-    # TODO(clarkb) figure out how to use upstream wheel again.
-    iniset -sudo /etc/pip.conf "global" "no-binary" "libvirt-python"
-
-    # Force update our APT repos, since we added UCA above.
-    REPOS_UPDATED=False
-    apt_get_update
 }
 
 # Python Packages

From 8579f583077e5df3358605e4cdfe418b1d46f53b Mon Sep 17 00:00:00 2001
From: Rodolfo Alonso Hernandez <ralonsoh@redhat.com>
Date: Mon, 4 Nov 2019 11:37:54 +0000
Subject: [PATCH 1622/2409] Dump the upper constraints for tempest in a
 temporary file

This will avoid the creation of an unneeded file in the "tempest"
repository directory.

TrivialFix

Change-Id: Id3f46b3537cd3232cb29c42808bde44c667565f1
---
 lib/tempest | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 96c9ced14a..ea5033a29d 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -607,8 +607,11 @@ function configure_tempest {
     fi
 
     # The requirements might be on a different branch, while tempest needs master requirements.
-    (cd $REQUIREMENTS_DIR && git show origin/master:upper-constraints.txt) > u-c-m.txt
-    tox -evenv-tempest -- pip install -c u-c-m.txt -r requirements.txt
+    local tmp_u_c_m
+    tmp_u_c_m=$(mktemp -t tempest_u_c_m.XXXXXXXXXX)
+    (cd $REQUIREMENTS_DIR && git show origin/master:upper-constraints.txt) > $tmp_u_c_m
+    tox -evenv-tempest -- pip install -c $tmp_u_c_m -r requirements.txt
+    rm -f $tmp_u_c_m
 
     # Auth:
     iniset $TEMPEST_CONFIG auth tempest_roles "member"
@@ -697,8 +700,11 @@ function install_tempest_plugins {
     pushd $TEMPEST_DIR
     if [[ $TEMPEST_PLUGINS != 0 ]] ; then
         # The requirements might be on a different branch, while tempest & tempest plugins needs master requirements.
-        (cd $REQUIREMENTS_DIR && git show origin/master:upper-constraints.txt) > u-c-m.txt
-        tox -evenv-tempest -- pip install -c u-c-m.txt $TEMPEST_PLUGINS
+        local tmp_u_c_m
+        tmp_u_c_m=$(mktemp -t tempest_u_c_m.XXXXXXXXXX)
+        (cd $REQUIREMENTS_DIR && git show origin/master:upper-constraints.txt) > $tmp_u_c_m
+        tox -evenv-tempest -- pip install -c $tmp_u_c_m $TEMPEST_PLUGINS
+        rm -f $tmp_u_c_m
         echo "Checking installed Tempest plugins:"
         tox -evenv-tempest -- tempest list-plugins
     fi

From d54a1c6869653c4af1d0dbd76e31b20879c675b5 Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Tue, 10 Sep 2019 12:05:06 +0200
Subject: [PATCH 1623/2409] Add possibility to configure manually
 MYSQL_SERVICE_NAME

This variable can be now set in Devstack's config file and in
such case Devstack will not set it automatically to value most
likely correct for the distro.
By default this value is empty string and in such case Devstack
will work in exactly same way as it was before this patch and
will determine automatically what name should be used there.

In addition in case of Ubuntu package $MYSQL_SERVICE_NAME-server
will be now installed instead of mysql-server always.
This will allow to easy configure e.g. CI job which will run using
Mariadb instead of Mysql on Ubuntu.

Change-Id: I25af0b54ad235b08c6c399b4125c737acf57ee2e
---
 lib/databases/mysql | 44 ++++++++++++++++++++++++++++++++------------
 1 file changed, 32 insertions(+), 12 deletions(-)

diff --git a/lib/databases/mysql b/lib/databases/mysql
index 4d0f5f3e45..4e3cc72bdb 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -15,15 +15,17 @@ MYSQL_DRIVER=${MYSQL_DRIVER:-PyMySQL}
 
 register_database mysql
 
-MYSQL_SERVICE_NAME=mysql
-if is_fedora && ! is_oraclelinux; then
-    MYSQL_SERVICE_NAME=mariadb
-elif is_suse && systemctl list-unit-files | grep -q 'mariadb\.service'; then
-    # Older mariadb packages on SLES 12 provided mysql.service.  The
-    # newer ones on SLES 12 and 15 use mariadb.service; they also
-    # provide a mysql.service symlink for backwards-compatibility, but
-    # let's not rely on that.
-    MYSQL_SERVICE_NAME=mariadb
+if [[ -z "$MYSQL_SERVICE_NAME" ]]; then
+    MYSQL_SERVICE_NAME=mysql
+    if is_fedora && ! is_oraclelinux; then
+        MYSQL_SERVICE_NAME=mariadb
+    elif is_suse && systemctl list-unit-files | grep -q 'mariadb\.service'; then
+        # Older mariadb packages on SLES 12 provided mysql.service.  The
+        # newer ones on SLES 12 and 15 use mariadb.service; they also
+        # provide a mysql.service symlink for backwards-compatibility, but
+        # let's not rely on that.
+        MYSQL_SERVICE_NAME=mariadb
+    fi
 fi
 
 # Functions
@@ -92,8 +94,23 @@ function configure_database_mysql {
     # because the package might have been installed already.
     sudo mysqladmin -u root password $DATABASE_PASSWORD || true
 
+    # In case of Mariadb, giving hostname in arguments causes permission
+    # problems as it expects connection through socket
+    if is_ubuntu && [ "$MYSQL_SERVICE_NAME" == "mariadb" ]; then
+        local cmd_args="-uroot -p$DATABASE_PASSWORD "
+    else
+        local cmd_args="-uroot -p$DATABASE_PASSWORD -h127.0.0.1 "
+    fi
+
+    # In mariadb e.g. on Ubuntu socket plugin is used for authentication
+    # as root so it works only as sudo. To restore old "mysql like" behaviour,
+    # we need to change auth plugin for root user
+    if [ "$MYSQL_SERVICE_NAME" == "mariadb" ]; then
+        sudo mysql $cmd_args -e "UPDATE mysql.user SET plugin='' WHERE user='$DATABASE_USER' AND host='localhost';"
+        sudo mysql $cmd_args -e "FLUSH PRIVILEGES;"
+    fi
     # Update the DB to give user '$DATABASE_USER'@'%' full control of the all databases:
-    sudo mysql -uroot -p$DATABASE_PASSWORD -h127.0.0.1 -e "GRANT ALL PRIVILEGES ON *.* TO '$DATABASE_USER'@'%' identified by '$DATABASE_PASSWORD';"
+    sudo mysql $cmd_args -e "GRANT ALL PRIVILEGES ON *.* TO '$DATABASE_USER'@'%' identified by '$DATABASE_PASSWORD';"
 
     # Now update ``my.cnf`` for some local needs and restart the mysql service
 
@@ -148,8 +165,11 @@ MYSQL_PRESEED
 [client]
 user=$DATABASE_USER
 password=$DATABASE_PASSWORD
-host=$MYSQL_HOST
 EOF
+
+        if ! is_ubuntu || [ "$MYSQL_SERVICE_NAME" != "mariadb" ]; then
+            echo "host=$MYSQL_HOST" >> $HOME/.my.cnf
+        fi
         chmod 0600 $HOME/.my.cnf
     fi
     # Install mysql-server
@@ -159,7 +179,7 @@ EOF
         install_package mariadb-server
         sudo systemctl enable $MYSQL_SERVICE_NAME
     elif is_ubuntu; then
-        install_package mysql-server
+        install_package $MYSQL_SERVICE_NAME-server
     else
         exit_distro_not_supported "mysql installation"
     fi

From 40f7579bb8ebd8082dc5f55785c0ae4644b062ec Mon Sep 17 00:00:00 2001
From: Lucas Alvares Gomes <lucasagomes@gmail.com>
Date: Tue, 26 Nov 2019 15:20:03 +0000
Subject: [PATCH 1624/2409] lib/tempest: Do not rely on six for
 image_size_in_gib

input() should work on both python versions for what we need. I
understand the concern about eval() on python2 but, in the case it's
used we should be fine, plus, python2 is being removed from OpenStack
projects.

Change-Id: I86a7c31374986f81132bc4f49aee0a76b90e6553
Signed-off-by: Lucas Alvares Gomes <lucasagomes@gmail.com>
---
 lib/tempest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index 96c9ced14a..7d0a98275f 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -107,7 +107,7 @@ function remove_disabled_extensions {
 function image_size_in_gib {
     local size
     size=$(openstack image show $1 -c size -f value)
-    echo $size | python -c "import math; import six; print(int(math.ceil(float(int(six.moves.input()) / 1024.0 ** 3))))"
+    echo $size | python3 -c "import math; print(int(math.ceil(float(int(input()) / 1024.0 ** 3))))"
 }
 
 # configure_tempest() - Set config files, create data dirs, etc

From 7ddbece508413592cbb7540408b3edbf04ca8d04 Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Tue, 3 Dec 2019 14:35:03 -0800
Subject: [PATCH 1625/2409] Enable libvirt virtio rng device

We've seen jobs where tests fail due to what appears to be rng
starvation. Enable virtio rng device to try and alleviate this.

Change-Id: I70d800cdc45b6008f775110f22c0000736421529
---
 functions   |  6 +++---
 lib/nova    | 20 ++++++++++----------
 lib/tempest |  4 ++--
 3 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/functions b/functions
index f33fd25fee..8ea634e753 100644
--- a/functions
+++ b/functions
@@ -292,7 +292,7 @@ function upload_image {
     local disk_format=""
     local container_format=""
     local unpack=""
-    local img_property=""
+    local img_property="--property hw_rng_model=virtio"
     case "$image_fname" in
         *.tar.gz|*.tgz)
             # Extract ami and aki files
@@ -364,11 +364,11 @@ function upload_image {
     esac
 
     if is_arch "ppc64le" || is_arch "ppc64" || is_arch "ppc"; then
-        img_property="--property hw_cdrom_bus=scsi --property os_command_line=console=hvc0"
+        img_property="$img_property --property hw_cdrom_bus=scsi --property os_command_line=console=hvc0"
     fi
 
     if is_arch "aarch64"; then
-        img_property="--property hw_machine_type=virt --property hw_cdrom_bus=scsi --property hw_scsi_model=virtio-scsi --property os_command_line='console=ttyAMA0'"
+        img_property="$img_property --property hw_machine_type=virt --property hw_cdrom_bus=scsi --property hw_scsi_model=virtio-scsi --property os_command_line='console=ttyAMA0'"
     fi
 
     if [ "$container_format" = "bare" ]; then
diff --git a/lib/nova b/lib/nova
index c41f881fa1..58a236a525 100644
--- a/lib/nova
+++ b/lib/nova
@@ -1107,19 +1107,19 @@ function create_flavors {
     if is_service_enabled n-api; then
         if ! openstack --os-region-name="$REGION_NAME" flavor list | grep -q ds512M; then
             # Note that danms hates these flavors and apologizes for sdague
-            openstack --os-region-name="$REGION_NAME" flavor create --id c1 --ram 256 --disk 1 --vcpus 1 cirros256
-            openstack --os-region-name="$REGION_NAME" flavor create --id d1 --ram 512 --disk 5 --vcpus 1 ds512M
-            openstack --os-region-name="$REGION_NAME" flavor create --id d2 --ram 1024 --disk 10 --vcpus 1 ds1G
-            openstack --os-region-name="$REGION_NAME" flavor create --id d3 --ram 2048 --disk 10 --vcpus 2 ds2G
-            openstack --os-region-name="$REGION_NAME" flavor create --id d4 --ram 4096 --disk 20 --vcpus 4 ds4G
+            openstack --os-region-name="$REGION_NAME" flavor create --id c1 --ram 256 --disk 1 --vcpus 1 --property hw_rng:allowed=True cirros256
+            openstack --os-region-name="$REGION_NAME" flavor create --id d1 --ram 512 --disk 5 --vcpus 1 --property hw_rng:allowed=True ds512M
+            openstack --os-region-name="$REGION_NAME" flavor create --id d2 --ram 1024 --disk 10 --vcpus 1 --property hw_rng:allowed=True ds1G
+            openstack --os-region-name="$REGION_NAME" flavor create --id d3 --ram 2048 --disk 10 --vcpus 2 --property hw_rng:allowed=True ds2G
+            openstack --os-region-name="$REGION_NAME" flavor create --id d4 --ram 4096 --disk 20 --vcpus 4 --property hw_rng:allowed=True ds4G
         fi
 
         if ! openstack --os-region-name="$REGION_NAME" flavor list | grep -q m1.tiny; then
-            openstack --os-region-name="$REGION_NAME" flavor create --id 1 --ram 512 --disk 1 --vcpus 1 m1.tiny
-            openstack --os-region-name="$REGION_NAME" flavor create --id 2 --ram 2048 --disk 20 --vcpus 1 m1.small
-            openstack --os-region-name="$REGION_NAME" flavor create --id 3 --ram 4096 --disk 40 --vcpus 2 m1.medium
-            openstack --os-region-name="$REGION_NAME" flavor create --id 4 --ram 8192 --disk 80 --vcpus 4 m1.large
-            openstack --os-region-name="$REGION_NAME" flavor create --id 5 --ram 16384 --disk 160 --vcpus 8 m1.xlarge
+            openstack --os-region-name="$REGION_NAME" flavor create --id 1 --ram 512 --disk 1 --vcpus 1 --property hw_rng:allowed=True m1.tiny
+            openstack --os-region-name="$REGION_NAME" flavor create --id 2 --ram 2048 --disk 20 --vcpus 1 --property hw_rng:allowed=True m1.small
+            openstack --os-region-name="$REGION_NAME" flavor create --id 3 --ram 4096 --disk 40 --vcpus 2 --property hw_rng:allowed=True m1.medium
+            openstack --os-region-name="$REGION_NAME" flavor create --id 4 --ram 8192 --disk 80 --vcpus 4 --property hw_rng:allowed=True m1.large
+            openstack --os-region-name="$REGION_NAME" flavor create --id 5 --ram 16384 --disk 160 --vcpus 8 --property hw_rng:allowed=True m1.xlarge
         fi
     fi
 }
diff --git a/lib/tempest b/lib/tempest
index 96c9ced14a..1bb9b52645 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -203,13 +203,13 @@ function configure_tempest {
             if [[ ! ( $available_flavors =~ 'm1.nano' ) ]]; then
                 # Determine the flavor disk size based on the image size.
                 disk=$(image_size_in_gib $image_uuid)
-                openstack flavor create --id 42 --ram 64 --disk $disk --vcpus 1 m1.nano
+                openstack flavor create --id 42 --ram 64 --disk $disk --vcpus 1 --property hw_rng:allowed=True m1.nano
             fi
             flavor_ref=42
             if [[ ! ( $available_flavors =~ 'm1.micro' ) ]]; then
                 # Determine the alt flavor disk size based on the alt image size.
                 disk=$(image_size_in_gib $image_uuid_alt)
-                openstack flavor create --id 84 --ram 128 --disk $disk --vcpus 1 m1.micro
+                openstack flavor create --id 84 --ram 128 --disk $disk --vcpus 1 --property hw_rng:allowed=True m1.micro
             fi
             flavor_ref_alt=84
         else

From ede8b1269cb03178c31f700200309dd76b00dd5a Mon Sep 17 00:00:00 2001
From: YAMAMOTO Takashi <yamamoto@midokura.com>
Date: Mon, 9 Dec 2019 14:21:21 +0900
Subject: [PATCH 1626/2409] mysql: Don't bother to change auth plugin on centos

This partially reverts the previous change [1], which
broke networking-midonet jobs.

[1] https://review.opendev.org/#/c/681201/

Closes-Bug: #1855516
Change-Id: I0255c6acce72a8376dbc6d8f8d0314a7dabf019c
---
 lib/databases/mysql | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/databases/mysql b/lib/databases/mysql
index 4e3cc72bdb..420a86e04e 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -105,7 +105,7 @@ function configure_database_mysql {
     # In mariadb e.g. on Ubuntu socket plugin is used for authentication
     # as root so it works only as sudo. To restore old "mysql like" behaviour,
     # we need to change auth plugin for root user
-    if [ "$MYSQL_SERVICE_NAME" == "mariadb" ]; then
+    if is_ubuntu && [ "$MYSQL_SERVICE_NAME" == "mariadb" ]; then
         sudo mysql $cmd_args -e "UPDATE mysql.user SET plugin='' WHERE user='$DATABASE_USER' AND host='localhost';"
         sudo mysql $cmd_args -e "FLUSH PRIVILEGES;"
     fi

From f7a7076facbe8ef7c77863abf977af5cdafdeb6e Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Wed, 11 Dec 2019 09:51:58 +0100
Subject: [PATCH 1627/2409] Include dnsmasq-utils package on all Ubuntu
 versions

This package provides dhcp_release tool but in files/debs/neutron-common
it was listed to be installed only on Ubuntu Precise.
The same file is also in Nova's packages but there is no restriction to
Ubuntu Precise only there.
So on all Neutron jobs it was fine but on Ironic's job where Nova
wasn't enabled, this package was not installed and caused problems
in Neutron DHCP agent.

Change-Id: Idd0711cfe6d43f21754a2f0c230cd094ea33cb27
Closes-Bug: #1855910
---
 files/debs/neutron-common | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/files/debs/neutron-common b/files/debs/neutron-common
index e30f678f7a..b269f6330b 100644
--- a/files/debs/neutron-common
+++ b/files/debs/neutron-common
@@ -1,6 +1,6 @@
 acl
 dnsmasq-base
-dnsmasq-utils # for dhcp_release only available in dist:precise
+dnsmasq-utils # for dhcp_release
 ebtables
 haproxy # to serve as metadata proxy inside router/dhcp namespaces
 iptables

From d6a7b73fc8d01d8118031f086d0ad20ab6186059 Mon Sep 17 00:00:00 2001
From: Lenny Verkhovsky <lennyb@mellanox.com>
Date: Tue, 12 Nov 2019 15:54:32 +0200
Subject: [PATCH 1628/2409] Create OVS bridge even if OVS_BRIDGE_MAPPINGS is
 not empty

in complex cases when mapping is defined in local.conf OVS bridge
can be created automatically.

Change-Id: I2e5e1068e77291d1d199cd698cec4946480c7601
---
 lib/neutron_plugins/openvswitch_agent | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/lib/neutron_plugins/openvswitch_agent b/lib/neutron_plugins/openvswitch_agent
index b65a2587c2..100961196d 100644
--- a/lib/neutron_plugins/openvswitch_agent
+++ b/lib/neutron_plugins/openvswitch_agent
@@ -41,8 +41,10 @@ function neutron_plugin_configure_plugin_agent {
     # Setup physical network bridge mappings.  Override
     # ``OVS_VLAN_RANGES`` and ``OVS_BRIDGE_MAPPINGS`` in ``localrc`` for more
     # complex physical network configurations.
-    if [[ "$OVS_BRIDGE_MAPPINGS" == "" ]] && [[ "$PHYSICAL_NETWORK" != "" ]] && [[ "$OVS_PHYSICAL_BRIDGE" != "" ]]; then
-        OVS_BRIDGE_MAPPINGS=$PHYSICAL_NETWORK:$OVS_PHYSICAL_BRIDGE
+    if [[ "$PHYSICAL_NETWORK" != "" ]] && [[ "$OVS_PHYSICAL_BRIDGE" != "" ]]; then
+        if [[ "$OVS_BRIDGE_MAPPINGS" == "" ]]; then
+            OVS_BRIDGE_MAPPINGS=$PHYSICAL_NETWORK:$OVS_PHYSICAL_BRIDGE
+        fi
 
         # Configure bridge manually with physical interface as port for multi-node
         _neutron_ovs_base_add_bridge $OVS_PHYSICAL_BRIDGE

From 56b2e7fe8b676d0fd94f511529c731d9a6af5c4a Mon Sep 17 00:00:00 2001
From: Eyal <eyal.bar-ilan@nokia.com>
Date: Thu, 19 Dec 2019 13:32:55 +0200
Subject: [PATCH 1629/2409] fix a command typo

Change-Id: I01787641c887bfc0f4620b90b4ff488958dac53e
---
 .../templates/devstack.journal.README.txt.j2                    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roles/export-devstack-journal/templates/devstack.journal.README.txt.j2 b/roles/export-devstack-journal/templates/devstack.journal.README.txt.j2
index 598eb7f3db..fe36653102 100644
--- a/roles/export-devstack-journal/templates/devstack.journal.README.txt.j2
+++ b/roles/export-devstack-journal/templates/devstack.journal.README.txt.j2
@@ -10,7 +10,7 @@ locally.  After downloading the file:
  $ /lib/systemd/systemd-journal-remote <(xzcat ./devstack.journal.xz) -o output.journal
 
 Note this binary is not in the regular path.  On Debian/Ubuntu
-platforms, you will need to have the "sytemd-journal-remote" package
+platforms, you will need to have the "systemd-journal-remote" package
 installed.
 
 It should result in something like:

From f0dd9996cc635709276f51e4d94c5ebbf5d5b49f Mon Sep 17 00:00:00 2001
From: ghanshyam <gmann@ghanshyammann.com>
Date: Mon, 26 Nov 2018 07:38:54 +0000
Subject: [PATCH 1630/2409] Fix DevStack to configure tempest's
 service_availability

Tempest's service_availability config option includes all the service
availability which is further used by tests to take decision of skip
or run the test.

For example, [service_availability].nova is true then, compute test will run
or if [service_availability].aodh is false then, all aodh related tests either
in aodh tempest plugin or any other plugins will be skipped.

Now question is what is the best way to set the each service availability for
tempest or tempest plugins tests. We have 2 category of service here-
1. Service tested by Tempest (nova, cinder, keystone, glance, swift, neutron)
   (let's say type1 service)
2. Services tested by Tempest plugins (all other than above list)
   (let's say type2 service)

We need the standard way to set both type of service so that we can maintain
the setting of service_availability config options in consistent way.

As discussed on bug#1743688/ and review https://review.openstack.org/#/c/536723/,
we will use devstack lib/tempest to set the type1 service which is services test
owned by Tempest and type2 service setting will be done by devstack plugins of
those service.

For example - [service_availability].ironic will be set by ironic's devstack plugin.
because that is best place we know ironic is installed and available.

To do that we need:
1. Add setting of [service_availability].* in devstack plugins
2. Remove setting of type2 service from devstack lib/tempest

This commit does the second part and all depends-on patches handle the first part.

Related-Bug: #1743688

Change-Id: If3aec9fd1c61e2bb53233be437b97b811dc82414
---
 lib/tempest | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index fba8826a2d..00e946e549 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -543,11 +543,15 @@ function configure_tempest {
 
     # ``service_available``
     #
-    # this tempest service list needs to be all the services that
-    # tempest supports, otherwise we can have an erroneous set of
+    # this tempest service list needs to be the services that
+    # tempest own, otherwise we can have an erroneous set of
     # defaults (something defaulting true in Tempest, but not listed here).
+    # services tested by tempest plugins needs to be set on service devstack
+    # plugin side as devstack cannot keep track of all the tempest plugins
+    # services. Refer Bug#1743688 for more details.
+    # 'horizon' is also kept here as no devtack plugin for horizon.
     local service
-    local tempest_services="key,glance,nova,neutron,cinder,swift,heat,ceilometer,horizon,sahara,ironic,trove"
+    local tempest_services="key,glance,nova,neutron,cinder,swift,horizon"
     for service in ${tempest_services//,/ }; do
         if is_service_enabled $service ; then
             iniset $TEMPEST_CONFIG service_available $service "True"

From 7634c780027ad05e416c2a0c5ac688751aba4be6 Mon Sep 17 00:00:00 2001
From: Soniya Vyas <svyas@redhat.com>
Date: Thu, 26 Dec 2019 16:59:56 +0530
Subject: [PATCH 1631/2409] Removal of deprecated command and deprecated
 optional argument

lib/tempest uses 'tempest-account-generator'
which is deprecated 4 years back.
In addition to above, lib/tempest also uses
'os-tenant-name' which is also deprecated.

Use of 'tempest account-generator' and
'os-project-name' should be done now.

Signed-off by: Soniya Vyas<svyas@redhat.com>
Change-Id: I624e1dc57a3d3533322fb298c01f70241d0400ed
---
 lib/tempest | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index a91fe01fa3..ce0886bbd9 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -617,9 +617,9 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG auth tempest_roles "member"
     if [[ $TEMPEST_USE_TEST_ACCOUNTS == "True" ]]; then
         if [[ $TEMPEST_HAS_ADMIN == "True" ]]; then
-            tox -evenv-tempest -- tempest-account-generator -c $TEMPEST_CONFIG --os-username $admin_username --os-password "$password" --os-tenant-name $admin_project_name -r $TEMPEST_CONCURRENCY --with-admin etc/accounts.yaml
+            tox -evenv-tempest -- tempest account-generator -c $TEMPEST_CONFIG --os-username $admin_username --os-password "$password" --os-project-name $admin_project_name -r $TEMPEST_CONCURRENCY --with-admin etc/accounts.yaml
         else
-            tox -evenv-tempest -- tempest-account-generator -c $TEMPEST_CONFIG --os-username $admin_username --os-password "$password" --os-tenant-name $admin_project_name -r $TEMPEST_CONCURRENCY etc/accounts.yaml
+            tox -evenv-tempest -- tempest account-generator -c $TEMPEST_CONFIG --os-username $admin_username --os-password "$password" --os-project-name $admin_project_name -r $TEMPEST_CONCURRENCY etc/accounts.yaml
         fi
         iniset $TEMPEST_CONFIG auth use_dynamic_credentials False
         iniset $TEMPEST_CONFIG auth test_accounts_file "etc/accounts.yaml"

From f8aa74bc045110b1ea53f3e358836b4b76faeb92 Mon Sep 17 00:00:00 2001
From: Colleen Murphy <colleen.murphy@suse.com>
Date: Fri, 27 Dec 2019 09:30:57 -0800
Subject: [PATCH 1632/2409] Enable access rules tempest tests

In Train, the access rules API was introduced in keystone. This change
enables testing it in tempest.

Depends-on: https://review.opendev.org/699519
Change-Id: I2af21868cbf584a6881c6208bc2afc3bdb323ab9
---
 lib/tempest | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index a91fe01fa3..c8a1ea0ec7 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -336,6 +336,10 @@ function configure_tempest {
     # so remove this once Tempest no longer supports Pike.
     iniset $TEMPEST_CONFIG identity-feature-enabled application_credentials True
 
+    # In Train and later, access rules for application credentials are enabled
+    # by default so remove this once Tempest no longer supports Stein.
+    iniset $TEMPEST_CONFIG identity-feature-enabled access_rules True
+
     # Image
     # We want to be able to override this variable in the gate to avoid
     # doing an external HTTP fetch for this test.

From 4143ce6fc95ccd9bde88c22baaa3eeaba58183f8 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 13 Jan 2020 16:05:11 +1100
Subject: [PATCH 1633/2409] Create virtualenv with abstracted VIRTUALENV_CMD

Just calling "virtualenv" makes a Python 2 based environment;
setuptools just dropped Python 2 support (as Python 2 reached EOL in
Jan 2020) so this has now become a breakage.

Although the Python 2 path won't work, use the abstracted command.
This should stop us having to revisit this for any future cleanups (or
switing to venv, etc).

Change-Id: I531e971b78491a9276753c0d86b04c4adbd224aa
---
 lib/infra | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/infra b/lib/infra
index cf003cce01..b983f2b739 100644
--- a/lib/infra
+++ b/lib/infra
@@ -29,7 +29,7 @@ GITDIR["pbr"]=$DEST/pbr
 # install_infra() - Collect source and prepare
 function install_infra {
     local PIP_VIRTUAL_ENV="$REQUIREMENTS_DIR/.venv"
-    [ ! -d $PIP_VIRTUAL_ENV ] && virtualenv $PIP_VIRTUAL_ENV
+    [ ! -d $PIP_VIRTUAL_ENV ] && ${VIRTUALENV_CMD} $PIP_VIRTUAL_ENV
     # We don't care about testing git pbr in the requirements venv.
     PIP_VIRTUAL_ENV=$PIP_VIRTUAL_ENV pip_install -U pbr
     PIP_VIRTUAL_ENV=$PIP_VIRTUAL_ENV pip_install $REQUIREMENTS_DIR

From bcb2c30c317834f62cab470dc0b58670d945a6ef Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 13 Jan 2020 16:31:20 +1100
Subject: [PATCH 1634/2409] Remove TRACK_DEPENDS

This was added in 2012 with I89677fd54635e82b10ab674ddeb9ffb3f1a755f0,
but I can not see it being used anywhere currently.

It's use of virtualenv's has become problematic in a python2
deprecated world, but since it is not used, remove it to avoid further
confusion.

Change-Id: I65d44d24f449436ca6229928eee2c5a021793055
---
 functions-common |  8 +-------
 inc/python       | 51 ++++++++++++++++++++----------------------------
 stack.sh         | 24 -----------------------
 3 files changed, 22 insertions(+), 61 deletions(-)

diff --git a/functions-common b/functions-common
index a13d611415..6be07b42bb 100644
--- a/functions-common
+++ b/functions-common
@@ -27,7 +27,6 @@
 # - ``RECLONE``
 # - ``REQUIREMENTS_DIR``
 # - ``STACK_USER``
-# - ``TRACK_DEPENDS``
 # - ``http_proxy``, ``https_proxy``, ``no_proxy``
 #
 
@@ -44,7 +43,6 @@ declare -A -g GITREPO
 declare -A -g GITBRANCH
 declare -A -g GITDIR
 
-TRACK_DEPENDS=${TRACK_DEPENDS:-False}
 KILL_PATH="$(which kill)"
 
 # Save these variables to .stackenv
@@ -2075,11 +2073,7 @@ function _safe_permission_operation {
         return 0
     fi
 
-    if [[ $TRACK_DEPENDS = True ]]; then
-        sudo_cmd="env"
-    else
-        sudo_cmd="sudo"
-    fi
+    sudo_cmd="sudo"
 
     $xtrace
     $sudo_cmd $@
diff --git a/inc/python b/inc/python
index 81b6a960a4..fd43cef932 100644
--- a/inc/python
+++ b/inc/python
@@ -175,7 +175,7 @@ function disable_python3_package {
 
 # Wrapper for ``pip install`` to set cache and proxy environment variables
 # Uses globals ``OFFLINE``, ``PIP_VIRTUAL_ENV``,
-# ``PIP_UPGRADE``, ``TRACK_DEPENDS``, ``*_proxy``,
+# ``PIP_UPGRADE``, ``*_proxy``,
 # Usage:
 #  pip_install pip_arguments
 function pip_install {
@@ -219,37 +219,28 @@ function pip_install {
     # this works (for now...)
     local package_dir=${!#%\[*\]}
 
-    if [[ $TRACK_DEPENDS = True && ! "$@" =~ virtualenv ]]; then
-        # TRACK_DEPENDS=True installation creates a circular dependency when
-        # we attempt to install virtualenv into a virtualenv, so we must global
-        # that installation.
-        source $DEST/.venv/bin/activate
-        local cmd_pip=$DEST/.venv/bin/pip
+    if [[ -n ${PIP_VIRTUAL_ENV:=} && -d ${PIP_VIRTUAL_ENV} ]]; then
+        local cmd_pip=$PIP_VIRTUAL_ENV/bin/pip
         local sudo_pip="env"
     else
-        if [[ -n ${PIP_VIRTUAL_ENV:=} && -d ${PIP_VIRTUAL_ENV} ]]; then
-            local cmd_pip=$PIP_VIRTUAL_ENV/bin/pip
-            local sudo_pip="env"
-        else
-            local cmd_pip
-            cmd_pip=$(get_pip_command $PYTHON2_VERSION)
-            local sudo_pip="sudo -H"
-            if python3_enabled; then
-                # Special case some services that have experimental
-                # support for python3 in progress, but don't claim support
-                # in their classifier
-                echo "Check python version for : $package_dir"
-                if python3_disabled_for ${package_dir##*/}; then
-                    echo "Explicitly using $PYTHON2_VERSION version to install $package_dir based on DISABLED_PYTHON3_PACKAGES"
-                else
-                    # For everything that is not explicitly blacklisted with
-                    # DISABLED_PYTHON3_PACKAGES, assume it supports python3
-                    # and we will let pip sort out the install, regardless of
-                    # the package being local or remote.
-                    echo "Using $PYTHON3_VERSION version to install $package_dir based on default behavior"
-                    sudo_pip="$sudo_pip LC_ALL=en_US.UTF-8"
-                    cmd_pip=$(get_pip_command $PYTHON3_VERSION)
-                fi
+        local cmd_pip
+        cmd_pip=$(get_pip_command $PYTHON2_VERSION)
+        local sudo_pip="sudo -H"
+        if python3_enabled; then
+            # Special case some services that have experimental
+            # support for python3 in progress, but don't claim support
+            # in their classifier
+            echo "Check python version for : $package_dir"
+            if python3_disabled_for ${package_dir##*/}; then
+                echo "Explicitly using $PYTHON2_VERSION version to install $package_dir based on DISABLED_PYTHON3_PACKAGES"
+            else
+                # For everything that is not explicitly blacklisted with
+                # DISABLED_PYTHON3_PACKAGES, assume it supports python3
+                # and we will let pip sort out the install, regardless of
+                # the package being local or remote.
+                echo "Using $PYTHON3_VERSION version to install $package_dir based on default behavior"
+                sudo_pip="$sudo_pip LC_ALL=en_US.UTF-8"
+                cmd_pip=$(get_pip_command $PYTHON3_VERSION)
             fi
         fi
     fi
diff --git a/stack.sh b/stack.sh
index d0206ebac0..089510fa48 100755
--- a/stack.sh
+++ b/stack.sh
@@ -796,19 +796,6 @@ if [[ "$OFFLINE" != "True" ]]; then
     PYPI_ALTERNATIVE_URL=${PYPI_ALTERNATIVE_URL:-""} $TOP_DIR/tools/install_pip.sh
 fi
 
-TRACK_DEPENDS=${TRACK_DEPENDS:-False}
-
-# Install Python packages into a virtualenv so that we can track them
-if [[ $TRACK_DEPENDS = True ]]; then
-    echo_summary "Installing Python packages into a virtualenv $DEST/.venv"
-    pip_install -U virtualenv
-
-    rm -rf $DEST/.venv
-    virtualenv --system-site-packages $DEST/.venv
-    source $DEST/.venv/bin/activate
-    $DEST/.venv/bin/pip freeze > $DEST/requires-pre-pip
-fi
-
 # Do the ugly hacks for broken packages and distros
 source $TOP_DIR/tools/fixup_stuff.sh
 fixup_all
@@ -997,17 +984,6 @@ fi
 # osc commands. Alias dies with stack.sh.
 install_oscwrap
 
-if [[ $TRACK_DEPENDS = True ]]; then
-    $DEST/.venv/bin/pip freeze > $DEST/requires-post-pip
-    if ! diff -Nru $DEST/requires-pre-pip $DEST/requires-post-pip > $DEST/requires.diff; then
-        echo "Detect some changes for installed packages of pip, in depend tracking mode"
-        cat $DEST/requires.diff
-    fi
-    echo "Ran stack.sh in depend tracking mode, bailing out now"
-    exit 0
-fi
-
-
 # Syslog
 # ------
 

From d02fa6f856ac5951b8a879c23b57d5a752f28918 Mon Sep 17 00:00:00 2001
From: Sean Mooney <work@seanmooney.info>
Date: Tue, 14 Jan 2020 15:47:51 +0000
Subject: [PATCH 1635/2409] do not gzip legacy service logs

This change removes the .gz extension from the
service and syslog logs exported via journalctl.
This change nolonger gzip compresses the exported
logs so that they can be rendered in the browser
directly when served from swift.

Change-Id: I4557a737cb13b9c2406056be08ab8a32ddd45162
---
 roles/export-devstack-journal/tasks/main.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/roles/export-devstack-journal/tasks/main.yaml b/roles/export-devstack-journal/tasks/main.yaml
index cbec4447b8..ef839edaaf 100644
--- a/roles/export-devstack-journal/tasks/main.yaml
+++ b/roles/export-devstack-journal/tasks/main.yaml
@@ -14,7 +14,7 @@
       name=""
       for u in $(systemctl list-unit-files | grep devstack | awk '{print $1}'); do
         name=$(echo $u | sed 's/devstack@/screen-/' | sed 's/\.service//')
-        journalctl -o short-precise --unit $u | gzip - > {{ stage_dir }}/logs/$name.txt.gz
+        journalctl -o short-precise --unit $u  > {{ stage_dir }}/logs/$name.txt
       done
 
 - name: Export legacy syslog.txt
@@ -29,7 +29,7 @@
           -t sudo \
           --no-pager \
           --since="$(cat {{ devstack_base_dir }}/log-start-timestamp.txt)" \
-        | gzip - > {{ stage_dir }}/logs/syslog.txt.gz
+         > {{ stage_dir }}/logs/syslog.txt
 
 # TODO: convert this to ansible
 #  - make a list of the above units

From 85c5ec11c9526e0429163db5701d3ea8c096a324 Mon Sep 17 00:00:00 2001
From: Akihiro Motoki <amotoki@gmail.com>
Date: Wed, 15 Jan 2020 10:58:29 +0900
Subject: [PATCH 1636/2409] Cleanup VM instances during unstack

Currently VMs created by a previous DevStack run still exists even
after re-run stack.sh. This leads to a failure in launching a VM after
the second run of stack.sh. We need to check the reason of the failure
by nova compute log and clean up remaining VMs. It is annoying.

IIRC we cleaned up existing VMs. While I failed to identify which commit
changed this behavior, I believe it is worth recovering it.

This commit changes unstack.sh to call cleanup_nova. cleanup_cinder()
already cleans up LVM volumes and some of them may be used by VMs,
so I believe it is reasonable to clean up VMs in unstack.sh.

Change-Id: I9fcbc5105e443037fada1ef6a76a078145964256
---
 unstack.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/unstack.sh b/unstack.sh
index ccea0ef585..276111edb9 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -99,6 +99,7 @@ run_phase unstack
 
 if is_service_enabled nova; then
     stop_nova
+    cleanup_nova
 fi
 
 if is_service_enabled placement; then

From d8dec362baa2bf7f6ffe1c47352fdbe032eaf20a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rados=C5=82aw=20Piliszek?= <radoslaw.piliszek@gmail.com>
Date: Wed, 15 Jan 2020 18:30:36 +0100
Subject: [PATCH 1637/2409] Run Glance initialization when Glance is enabled,
 not just registry

Per [1] Glance registry should not be required to run since Queens.

[1] https://specs.openstack.org/openstack/glance-specs/specs/queens/approved/glance/deprecate-registry.html

Change-Id: I5477c8769ff4ae151d4d6ccb5e5d8dd5788909b0
Closes-bug: #1859847
---
 stack.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/stack.sh b/stack.sh
index 089510fa48..dee84fa8e2 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1155,7 +1155,7 @@ fi
 # Glance
 # ------
 
-if is_service_enabled g-reg; then
+if is_glance_enabled; then
     echo_summary "Configuring Glance"
     init_glance
 fi
@@ -1280,7 +1280,7 @@ fi
 # scripts as userdata.
 # See https://help.ubuntu.com/community/CloudInit for more on ``cloud-init``
 
-if is_service_enabled g-reg; then
+if is_glance_enabled; then
 
     echo_summary "Uploading images"
 

From d7dfcdb4674daae8a294848b1de6fa87c5d7d4eb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rados=C5=82aw=20Piliszek?= <radoslaw.piliszek@gmail.com>
Date: Wed, 15 Jan 2020 18:36:20 +0100
Subject: [PATCH 1638/2409] Stop enabling g-reg by default

Per [1] Glance registry should not be required to run since Queens.

[1] https://specs.openstack.org/openstack/glance-specs/specs/queens/approved/glance/deprecate-registry.html

Change-Id: I93325cbd26dbc6a30062d9ba83acab248897b18e
Depends-on: https://review.opendev.org/702707
Related-bug: #1859847
---
 .zuul.yaml | 1 -
 stackrc    | 2 +-
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index cbb9d99866..08513c23e9 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -401,7 +401,6 @@
         key: true
         # Glance services
         g-api: true
-        g-reg: true
         # Nova services
         n-api: true
         n-api-meta: true
diff --git a/stackrc b/stackrc
index 2d3a599a36..9fd7f75335 100644
--- a/stackrc
+++ b/stackrc
@@ -69,7 +69,7 @@ if ! isset ENABLED_SERVICES ; then
     # Placement service needed for Nova
     ENABLED_SERVICES+=,placement-api,placement-client
     # Glance services needed for Nova
-    ENABLED_SERVICES+=,g-api,g-reg
+    ENABLED_SERVICES+=,g-api
     # Cinder
     ENABLED_SERVICES+=,c-sch,c-api,c-vol
     # Neutron

From 248d4bb8d2205de38e56ef1f92a4bf0870400a85 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <sfinucan@redhat.com>
Date: Thu, 28 Nov 2019 12:57:12 +0000
Subject: [PATCH 1639/2409] Stop configuring '[DEFAULT] firewall_driver' for
 nova

This option has default to the 'NoopFirewallDriver' for some time and
will soon be removed. Stop configuring it entirely.

Change-Id: I4dbc0015cf26d7edf51d0d5fd978ccd3a1ad1b79
Signed-off-by: Stephen Finucane <sfinucan@redhat.com>
---
 lib/neutron                           | 2 --
 lib/neutron-legacy                    | 5 -----
 lib/neutron_plugins/nuage             | 2 --
 lib/nova_plugins/hypervisor-ironic    | 2 --
 lib/nova_plugins/hypervisor-libvirt   | 2 --
 lib/nova_plugins/hypervisor-openvz    | 2 --
 lib/nova_plugins/hypervisor-xenserver | 3 ---
 7 files changed, 18 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 888b5e864e..a86d83e170 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -365,8 +365,6 @@ function configure_neutron_nova_new {
     iniset $conf neutron auth_strategy $NEUTRON_AUTH_STRATEGY
     iniset $conf neutron region_name "$REGION_NAME"
 
-    iniset $conf DEFAULT firewall_driver nova.virt.firewall.NoopFirewallDriver
-
     # optionally set options in nova_conf
     neutron_plugin_create_nova_conf $conf
 
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index dbd6e2c06b..f0bdcf1da7 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -384,11 +384,6 @@ function create_nova_conf_neutron {
     iniset $conf neutron auth_strategy "$Q_AUTH_STRATEGY"
     iniset $conf neutron region_name "$REGION_NAME"
 
-    if [[ "$Q_USE_SECGROUP" == "True" ]]; then
-        LIBVIRT_FIREWALL_DRIVER=nova.virt.firewall.NoopFirewallDriver
-        iniset $conf DEFAULT firewall_driver $LIBVIRT_FIREWALL_DRIVER
-    fi
-
     # optionally set options in nova_conf
     neutron_plugin_create_nova_conf $conf
 
diff --git a/lib/neutron_plugins/nuage b/lib/neutron_plugins/nuage
index f39c7c4f5b..8c75e15048 100644
--- a/lib/neutron_plugins/nuage
+++ b/lib/neutron_plugins/nuage
@@ -11,8 +11,6 @@ function neutron_plugin_create_nova_conf {
     local conf="$1"
     NOVA_OVS_BRIDGE=${NOVA_OVS_BRIDGE:-"br-int"}
     iniset $conf neutron ovs_bridge $NOVA_OVS_BRIDGE
-    LIBVIRT_FIREWALL_DRIVER=nova.virt.firewall.NoopFirewallDriver
-    iniset $conf DEFAULT firewall_driver $LIBVIRT_FIREWALL_DRIVER
 }
 
 function neutron_plugin_install_agent_packages {
diff --git a/lib/nova_plugins/hypervisor-ironic b/lib/nova_plugins/hypervisor-ironic
index adcc278812..113e2a75ea 100644
--- a/lib/nova_plugins/hypervisor-ironic
+++ b/lib/nova_plugins/hypervisor-ironic
@@ -39,10 +39,8 @@ function configure_nova_hypervisor {
     if ! is_ironic_hardware; then
         configure_libvirt
     fi
-    LIBVIRT_FIREWALL_DRIVER=${LIBVIRT_FIREWALL_DRIVER:-"nova.virt.firewall.NoopFirewallDriver"}
 
     iniset $NOVA_CONF DEFAULT compute_driver ironic.IronicDriver
-    iniset $NOVA_CONF DEFAULT firewall_driver $LIBVIRT_FIREWALL_DRIVER
 
     # ironic section
     iniset $NOVA_CONF ironic auth_type password
diff --git a/lib/nova_plugins/hypervisor-libvirt b/lib/nova_plugins/hypervisor-libvirt
index 3d676b9b8d..7d3ace8c1c 100644
--- a/lib/nova_plugins/hypervisor-libvirt
+++ b/lib/nova_plugins/hypervisor-libvirt
@@ -45,8 +45,6 @@ function configure_nova_hypervisor {
     iniset $NOVA_CONF libvirt live_migration_uri "qemu+ssh://$STACK_USER@%s/system"
     iniset $NOVA_CONF DEFAULT default_ephemeral_format "ext4"
     iniset $NOVA_CONF DEFAULT compute_driver "libvirt.LibvirtDriver"
-    LIBVIRT_FIREWALL_DRIVER=${LIBVIRT_FIREWALL_DRIVER:-"nova.virt.libvirt.firewall.IptablesFirewallDriver"}
-    iniset $NOVA_CONF DEFAULT firewall_driver "$LIBVIRT_FIREWALL_DRIVER"
     # Power architecture currently does not support graphical consoles.
     if is_arch "ppc64"; then
         iniset $NOVA_CONF vnc enabled "false"
diff --git a/lib/nova_plugins/hypervisor-openvz b/lib/nova_plugins/hypervisor-openvz
index 58ab5c11ac..57dc45c1c5 100644
--- a/lib/nova_plugins/hypervisor-openvz
+++ b/lib/nova_plugins/hypervisor-openvz
@@ -38,8 +38,6 @@ function cleanup_nova_hypervisor {
 function configure_nova_hypervisor {
     iniset $NOVA_CONF DEFAULT compute_driver "openvz.OpenVzDriver"
     iniset $NOVA_CONF DEFAULT connection_type "openvz"
-    LIBVIRT_FIREWALL_DRIVER=${LIBVIRT_FIREWALL_DRIVER:-"nova.virt.libvirt.firewall.IptablesFirewallDriver"}
-    iniset $NOVA_CONF DEFAULT firewall_driver "$LIBVIRT_FIREWALL_DRIVER"
 }
 
 # install_nova_hypervisor() - Install external components
diff --git a/lib/nova_plugins/hypervisor-xenserver b/lib/nova_plugins/hypervisor-xenserver
index ccab18dc97..511ec1bc09 100644
--- a/lib/nova_plugins/hypervisor-xenserver
+++ b/lib/nova_plugins/hypervisor-xenserver
@@ -61,9 +61,6 @@ function configure_nova_hypervisor {
     iniset $NOVA_CONF xenserver connection_username "$XENAPI_USER"
     iniset $NOVA_CONF xenserver connection_password "$XENAPI_PASSWORD"
     iniset $NOVA_CONF DEFAULT flat_injected "False"
-    # Need to avoid crash due to new firewall support
-    XEN_FIREWALL_DRIVER=${XEN_FIREWALL_DRIVER:-"nova.virt.firewall.IptablesFirewallDriver"}
-    iniset $NOVA_CONF DEFAULT firewall_driver "$XEN_FIREWALL_DRIVER"
 
     local dom0_ip
     dom0_ip=$(echo "$XENAPI_CONNECTION_URL" | cut -d "/" -f 3-)

From f9ff151549bfa57cfeec524cf06ae3d65c8ab0a8 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <sfinucan@redhat.com>
Date: Thu, 16 Jan 2020 10:52:52 +0000
Subject: [PATCH 1640/2409] Stop configuring '[DEFAULT] use_neutron' for nova

This has now been removed and even prior to removal defaulted to True.

Change-Id: I847a873d833a4dbee96afa1d2726fea2b8045eeb
Signed-off-by: Stephen Finucane <sfinucan@redhat.com>
---
 lib/neutron        | 1 -
 lib/neutron-legacy | 1 -
 2 files changed, 2 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index a86d83e170..9e6a80cf08 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -354,7 +354,6 @@ function configure_neutron_rootwrap {
 # if not passed $NOVA_CONF is used.
 function configure_neutron_nova_new {
     local conf=${1:-$NOVA_CONF}
-    iniset $conf DEFAULT use_neutron True
     iniset $conf neutron auth_type "password"
     iniset $conf neutron auth_url "$KEYSTONE_SERVICE_URI"
     iniset $conf neutron username neutron
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index f0bdcf1da7..3d39d41b7e 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -373,7 +373,6 @@ function configure_mutnauq {
 
 function create_nova_conf_neutron {
     local conf=${1:-$NOVA_CONF}
-    iniset $conf DEFAULT use_neutron True
     iniset $conf neutron auth_type "password"
     iniset $conf neutron auth_url "$KEYSTONE_AUTH_URI"
     iniset $conf neutron username "$Q_ADMIN_USERNAME"

From ec3543a02883c3d9b288128e0a6cb941315e72cc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rados=C5=82aw=20Piliszek?= <radoslaw.piliszek@gmail.com>
Date: Thu, 16 Jan 2020 19:58:37 +0100
Subject: [PATCH 1641/2409] Init Glance database only on the node with the
 database backend

Since [1] Glance init depends on either g-api or g-reg being
enabled.
This broke multinode g-api deployments with singlenode database
backend.
This commit aligns Glance with other services w.r.t when to
apply database init.

[1] d8dec362baa2bf7f6ffe1c47352fdbe032eaf20a

Change-Id: Idc07764d6ba3a828f19691f56c73cbe9179c2673
Closes-bug: #1860021
---
 lib/glance | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/lib/glance b/lib/glance
index 740bcabf6a..b4cab2ad74 100644
--- a/lib/glance
+++ b/lib/glance
@@ -276,16 +276,18 @@ function init_glance {
     rm -rf $GLANCE_IMAGE_DIR
     mkdir -p $GLANCE_IMAGE_DIR
 
-    # (Re)create glance database
-    recreate_database glance
+    if is_service_enabled $DATABASE_BACKENDS; then
+        # (Re)create glance database
+        recreate_database glance
 
-    time_start "dbsync"
-    # Migrate glance database
-    $GLANCE_BIN_DIR/glance-manage --config-file $GLANCE_CONF_DIR/glance-api.conf db_sync
+        time_start "dbsync"
+        # Migrate glance database
+        $GLANCE_BIN_DIR/glance-manage --config-file $GLANCE_CONF_DIR/glance-api.conf db_sync
 
-    # Load metadata definitions
-    $GLANCE_BIN_DIR/glance-manage --config-file $GLANCE_CONF_DIR/glance-api.conf db_load_metadefs
-    time_stop "dbsync"
+        # Load metadata definitions
+        $GLANCE_BIN_DIR/glance-manage --config-file $GLANCE_CONF_DIR/glance-api.conf db_load_metadefs
+        time_stop "dbsync"
+    fi
 }
 
 # install_glanceclient() - Collect source and prepare

From 6b6bdc7111aa6f953a29c5ffc8854039336ce660 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <sfinucan@redhat.com>
Date: Wed, 9 Oct 2019 16:13:20 +0100
Subject: [PATCH 1642/2409] inc/python: Remove ability to mark packages as
 non-Python3

Everything in OpenStack *must* be Python 3 supporting now, which means
it's time to remove the functionality that allows us to blacklist
packages that didn't support Python 3.

Change-Id: I7c8cf538ec88bd4056b0109f19671e3d65f5da3a
Signed-off-by: Stephen Finucane <sfinucan@redhat.com>
---
 inc/python           | 80 +++-----------------------------------------
 stackrc              |  4 ---
 tests/test_python.sh | 25 --------------
 3 files changed, 5 insertions(+), 104 deletions(-)
 delete mode 100755 tests/test_python.sh

diff --git a/inc/python b/inc/python
index fd43cef932..32dd72594f 100644
--- a/inc/python
+++ b/inc/python
@@ -85,60 +85,8 @@ function pip_install_gr_extras {
     pip_install $clean_name[$extras]
 }
 
-# python3_enabled_for() assumes the service(s) specified as arguments are
-# enabled for python 3 unless explicitly disabled. See python3_disabled_for().
-#
-# Multiple services specified as arguments are ``OR``'ed together; the test
-# is a short-circuit boolean, i.e it returns on the first match.
-#
-# python3_enabled_for dir [dir ...]
-function python3_enabled_for {
-    local xtrace
-    xtrace=$(set +o | grep xtrace)
-    set +o xtrace
-
-    local enabled=1
-    local dirs=$@
-    local dir
-    for dir in ${dirs}; do
-        if ! python3_disabled_for "${dir}"; then
-            enabled=0
-        fi
-    done
-
-    $xtrace
-    return $enabled
-}
-
-# python3_disabled_for() checks if the service(s) specified as arguments are
-# disabled by the user in ``DISABLED_PYTHON3_PACKAGES``.
-#
-# Multiple services specified as arguments are ``OR``'ed together; the test
-# is a short-circuit boolean, i.e it returns on the first match.
-#
-# Uses global ``DISABLED_PYTHON3_PACKAGES``
-# python3_disabled_for dir [dir ...]
-function python3_disabled_for {
-    local xtrace
-    xtrace=$(set +o | grep xtrace)
-    set +o xtrace
-
-    local enabled=1
-    local dirs=$@
-    local dir
-    for dir in ${dirs}; do
-        [[ ,${DISABLED_PYTHON3_PACKAGES}, =~ ,${dir}, ]] && enabled=0
-    done
-
-    $xtrace
-    return $enabled
-}
-
 # enable_python3_package() -- no-op for backwards compatibility
 #
-# For example:
-#   enable_python3_package nova
-#
 # enable_python3_package dir [dir ...]
 function enable_python3_package {
     local xtrace
@@ -150,25 +98,15 @@ function enable_python3_package {
     $xtrace
 }
 
-# disable_python3_package() adds the services passed as argument to
-# the ``DISABLED_PYTHON3_PACKAGES`` list.
-#
-# For example:
-#   disable_python3_package swift
+# disable_python3_package() -- no-op for backwards compatibility
 #
-# Uses global ``DISABLED_PYTHON3_PACKAGES``
 # disable_python3_package dir [dir ...]
 function disable_python3_package {
     local xtrace
     xtrace=$(set +o | grep xtrace)
     set +o xtrace
 
-    local disabled_svcs="${DISABLED_PYTHON3_PACKAGES}"
-    local dir
-    for dir in $@; do
-        disabled_svcs+=",$dir"
-    done
-    DISABLED_PYTHON3_PACKAGES=$(_cleanup_service_list "$disabled_svcs")
+    echo "It is no longer possible to call disable_python3_package()."
 
     $xtrace
 }
@@ -231,17 +169,9 @@ function pip_install {
             # support for python3 in progress, but don't claim support
             # in their classifier
             echo "Check python version for : $package_dir"
-            if python3_disabled_for ${package_dir##*/}; then
-                echo "Explicitly using $PYTHON2_VERSION version to install $package_dir based on DISABLED_PYTHON3_PACKAGES"
-            else
-                # For everything that is not explicitly blacklisted with
-                # DISABLED_PYTHON3_PACKAGES, assume it supports python3
-                # and we will let pip sort out the install, regardless of
-                # the package being local or remote.
-                echo "Using $PYTHON3_VERSION version to install $package_dir based on default behavior"
-                sudo_pip="$sudo_pip LC_ALL=en_US.UTF-8"
-                cmd_pip=$(get_pip_command $PYTHON3_VERSION)
-            fi
+            echo "Using $PYTHON3_VERSION version to install $package_dir based on default behavior"
+            sudo_pip="$sudo_pip LC_ALL=en_US.UTF-8"
+            cmd_pip=$(get_pip_command $PYTHON3_VERSION)
         fi
     fi
 
diff --git a/stackrc b/stackrc
index 9fd7f75335..b31fb395c7 100644
--- a/stackrc
+++ b/stackrc
@@ -138,10 +138,6 @@ fi
 # Control whether Python 3 should be used at all.
 export USE_PYTHON3=$(trueorfalse True USE_PYTHON3)
 
-# Explicitly list services not to run under Python 3. See
-# disable_python3_package to edit this variable.
-export DISABLED_PYTHON3_PACKAGES=""
-
 # When Python 3 is supported by an application, adding the specific
 # version of Python 3 to this variable will install the app using that
 # version of the interpreter instead of 2.7.
diff --git a/tests/test_python.sh b/tests/test_python.sh
deleted file mode 100755
index 1f5453c4c7..0000000000
--- a/tests/test_python.sh
+++ /dev/null
@@ -1,25 +0,0 @@
-#!/usr/bin/env bash
-
-# Tests for DevStack INI functions
-
-TOP=$(cd $(dirname "$0")/.. && pwd)
-
-source $TOP/functions-common
-source $TOP/inc/python
-
-source $TOP/tests/unittest.sh
-
-echo "Testing Python 3 functions"
-
-# Initialize variables manipulated by functions under test.
-export DISABLED_PYTHON3_PACKAGES=""
-
-assert_true "should be enabled by default" python3_enabled_for testpackage1
-
-assert_false "should not be disabled yet" python3_disabled_for testpackage2
-
-disable_python3_package testpackage2
-assert_equal "$DISABLED_PYTHON3_PACKAGES" "testpackage2"  "unexpected result"
-assert_true "should be disabled" python3_disabled_for testpackage2
-
-report_results

From 98f3bbe509c2de9efaf4f3fc1b5dbc42d7a67987 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <sfinucan@redhat.com>
Date: Fri, 17 Jan 2020 17:41:22 +0000
Subject: [PATCH 1643/2409] Revert "Stop enabling g-reg by default"

This reverts commit d7dfcdb4674daae8a294848b1de6fa87c5d7d4eb. A
subsquent change that depends on this,
d8dec362baa2bf7f6ffe1c47352fdbe032eaf20a, has knock on effects for
devstack-gate and needs to be reverted. Revert this first.

Change-Id: Ic5402f57052648e10eacf3c3de67d2cdd2d42f63
Signed-off-by: Stephen Finucane <sfinucan@redhat.com>
Partial-bug: #1860021
---
 .zuul.yaml | 1 +
 stackrc    | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 08513c23e9..cbb9d99866 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -401,6 +401,7 @@
         key: true
         # Glance services
         g-api: true
+        g-reg: true
         # Nova services
         n-api: true
         n-api-meta: true
diff --git a/stackrc b/stackrc
index 9fd7f75335..2d3a599a36 100644
--- a/stackrc
+++ b/stackrc
@@ -69,7 +69,7 @@ if ! isset ENABLED_SERVICES ; then
     # Placement service needed for Nova
     ENABLED_SERVICES+=,placement-api,placement-client
     # Glance services needed for Nova
-    ENABLED_SERVICES+=,g-api
+    ENABLED_SERVICES+=,g-api,g-reg
     # Cinder
     ENABLED_SERVICES+=,c-sch,c-api,c-vol
     # Neutron

From 48d1f028c43dd26aab852715e451e1ec08421a2f Mon Sep 17 00:00:00 2001
From: Stephen Finucane <sfinucan@redhat.com>
Date: Fri, 17 Jan 2020 17:23:11 +0000
Subject: [PATCH 1644/2409] Revert "Run Glance initialization when Glance is
 enabled, not just registry"

This reverts commit d8dec362baa2bf7f6ffe1c47352fdbe032eaf20a. This has
knock on effects for devstack-gate, which configures g-api on subnodes
node but not mysql, resulting in failures. A longer term fix would be to
either a) stop configuring g-api on subnodes if we can determine it's
not necessary or b) only configure the database if on the main node.
However, both options are subject to debate so for now just unclog the
gate.

Change-Id: I58baa3b6c63c648836ae8152c2d6d7ceff11a388
Signed-off-by: Stephen Finucane <sfinucan@redhat.com>
Closes-bug: #1860021
---
 stack.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/stack.sh b/stack.sh
index dee84fa8e2..089510fa48 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1155,7 +1155,7 @@ fi
 # Glance
 # ------
 
-if is_glance_enabled; then
+if is_service_enabled g-reg; then
     echo_summary "Configuring Glance"
     init_glance
 fi
@@ -1280,7 +1280,7 @@ fi
 # scripts as userdata.
 # See https://help.ubuntu.com/community/CloudInit for more on ``cloud-init``
 
-if is_glance_enabled; then
+if is_service_enabled g-reg; then
 
     echo_summary "Uploading images"
 

From 8dd6f153d6b8dfd8ae976e7f1c9df06019a159b9 Mon Sep 17 00:00:00 2001
From: Carlos Goncalves <cgoncalves@redhat.com>
Date: Mon, 20 Jan 2020 07:24:17 +0100
Subject: [PATCH 1645/2409] Add LIBVIRT_CPU_MODE to set CPU mode

In same cases, the hypervisor presents to the guest OS a named CPU model
is similar to the host CPU and adds extra features to approximate the
host model. However, this does not guarantee all features will be
precisely match.

This patch adds LIBVIRT_CPU_MODE to allow users to define the CPU mode
they want to use, for example "host-passthrough".

Change-Id: I83792c776b50d1d22584be2a37cc6a166f09c72b
---
 lib/nova                            | 1 +
 lib/nova_plugins/hypervisor-libvirt | 2 +-
 stackrc                             | 1 +
 3 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index 7557a51196..0893ed7084 100644
--- a/lib/nova
+++ b/lib/nova
@@ -259,6 +259,7 @@ function configure_nova {
                 if [ ! -e /dev/kvm ]; then
                     echo "WARNING: Switching to QEMU"
                     LIBVIRT_TYPE=qemu
+                    LIBVIRT_CPU_MODE=none
                     if which selinuxenabled >/dev/null 2>&1 && selinuxenabled; then
                         # https://bugzilla.redhat.com/show_bug.cgi?id=753589
                         sudo setsebool virt_use_execmem on
diff --git a/lib/nova_plugins/hypervisor-libvirt b/lib/nova_plugins/hypervisor-libvirt
index 7d3ace8c1c..d1b3d784b7 100644
--- a/lib/nova_plugins/hypervisor-libvirt
+++ b/lib/nova_plugins/hypervisor-libvirt
@@ -39,7 +39,7 @@ function cleanup_nova_hypervisor {
 function configure_nova_hypervisor {
     configure_libvirt
     iniset $NOVA_CONF libvirt virt_type "$LIBVIRT_TYPE"
-    iniset $NOVA_CONF libvirt cpu_mode "none"
+    iniset $NOVA_CONF libvirt cpu_mode "$LIBVIRT_CPU_MODE"
     # Do not enable USB tablet input devices to avoid QEMU CPU overhead.
     iniset $NOVA_CONF DEFAULT pointer_model "ps2mouse"
     iniset $NOVA_CONF libvirt live_migration_uri "qemu+ssh://$STACK_USER@%s/system"
diff --git a/stackrc b/stackrc
index 2d3a599a36..d581e48530 100644
--- a/stackrc
+++ b/stackrc
@@ -625,6 +625,7 @@ VIRT_DRIVER=${VIRT_DRIVER:-$DEFAULT_VIRT_DRIVER}
 case "$VIRT_DRIVER" in
     ironic|libvirt)
         LIBVIRT_TYPE=${LIBVIRT_TYPE:-kvm}
+        LIBVIRT_CPU_MODE=${LIBVIRT_CPU_MODE:-none}
         if [[ "$os_VENDOR" =~ (Debian|Ubuntu) ]]; then
             # The groups change with newer libvirt. Older Ubuntu used
             # 'libvirtd', but now uses libvirt like Debian. Do a quick check

From 2e45f2c267c9ababdbdfc4c505b329398391c5f9 Mon Sep 17 00:00:00 2001
From: Ghanshyam <gmann@ghanshyammann.com>
Date: Sat, 18 Jan 2020 19:59:29 -0600
Subject: [PATCH 1646/2409] Adding nova-live-migration job in devstack gate

nova-live-migration is legacy job and  and rely on
devstack-gate + devstack setting so any change in devstack can
break it. Example bug: 1860021

We can remove this job once it is migrated to zuulv3 native.

Change-Id: Ie34d4dc1ab30ced8161796fe32628db07de86cc9
Related-bug: #1860021
---
 .zuul.yaml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index e86805f13d..3468f69e28 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -622,6 +622,15 @@
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
+        # NOTE(gmann): Remove this job from devstack pipeline once it is
+        # migrated to zuulv3 native. This is legacy job and rely on
+        # devstack-gate + devstack setting so any change in devstack can
+        # break it.
+        - nova-live-migration:
+            voting: false
+            irrelevant-files:
+              - ^.*\.rst$
+              - ^doc/.*$
     gate:
       jobs:
         - devstack

From e18325ca67dcb70b01a29563432291e1baf9f46e Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <j.harbott@x-ion.de>
Date: Wed, 22 Jan 2020 05:54:06 +0000
Subject: [PATCH 1647/2409] Fix pip uncap fallout for nova and barbican

Need to make PyYAML overridable on Ubuntu, it is a dependency for e.g.
cloud-init, so we cannot remove it.

Depends-On: https://review.opendev.org/703792
Change-Id: I4423dfb2c30299903b52a2bb06d846dd487f5b8b
---
 tools/fixup_stuff.sh | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index eb8a76f276..7e5ae75831 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -82,6 +82,14 @@ function fixup_ubuntu {
 
     # Enable universe
     sudo add-apt-repository -y universe
+
+    # Since pip10, pip will refuse to uninstall files from packages
+    # that were created with distutils (rather than more modern
+    # setuptools).  This is because it technically doesn't have a
+    # manifest of what to remove.  However, in most cases, simply
+    # overwriting works.  So this hacks around those packages that
+    # have been dragged in by some other system dependency
+    sudo rm -f /usr/lib/python3/dist-packages/PyYAML-*.egg-info
 }
 
 # Python Packages

From 09e860fc2c306774076c1814ba3ab7c44404066d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rados=C5=82aw=20Piliszek?= <radoslaw.piliszek@gmail.com>
Date: Sun, 19 Jan 2020 12:41:14 +0100
Subject: [PATCH 1648/2409] Run Glance initialization when Glance is enabled,
 not just registry (v2)

Per [1] Glance registry should not be required to run since Queens.

v2 improves on v1 [2] (now reverted [3]) by applying minor comments
from reviews so far and ensuring nova-live-migration job does not see
a change in behavior and hence does not break [4].
[5] tried to fix the issue but it did only partially, regarding
the database but not the image upload [6].
This patch ensures double cirros image upload does not happen as well.

[1] https://specs.openstack.org/openstack/glance-specs/specs/queens/approved/glance/deprecate-registry.html
[2] https://review.opendev.org/702707
[3] https://review.opendev.org/703131
[4] https://bugs.launchpad.net/devstack/+bug/1860021
[5] https://review.opendev.org/702960
[6] https://bugs.launchpad.net/devstack/+bug/1860021/comments/16

Change-Id: I61538acd6bd4c7b3da26c4084225b220d7d1aa2c
Closes-bug: #1859847
Related-bug: #1860021
---
 lib/glance | 18 ++++++++----------
 stack.sh   |  7 ++++---
 2 files changed, 12 insertions(+), 13 deletions(-)

diff --git a/lib/glance b/lib/glance
index b4cab2ad74..740bcabf6a 100644
--- a/lib/glance
+++ b/lib/glance
@@ -276,18 +276,16 @@ function init_glance {
     rm -rf $GLANCE_IMAGE_DIR
     mkdir -p $GLANCE_IMAGE_DIR
 
-    if is_service_enabled $DATABASE_BACKENDS; then
-        # (Re)create glance database
-        recreate_database glance
+    # (Re)create glance database
+    recreate_database glance
 
-        time_start "dbsync"
-        # Migrate glance database
-        $GLANCE_BIN_DIR/glance-manage --config-file $GLANCE_CONF_DIR/glance-api.conf db_sync
+    time_start "dbsync"
+    # Migrate glance database
+    $GLANCE_BIN_DIR/glance-manage --config-file $GLANCE_CONF_DIR/glance-api.conf db_sync
 
-        # Load metadata definitions
-        $GLANCE_BIN_DIR/glance-manage --config-file $GLANCE_CONF_DIR/glance-api.conf db_load_metadefs
-        time_stop "dbsync"
-    fi
+    # Load metadata definitions
+    $GLANCE_BIN_DIR/glance-manage --config-file $GLANCE_CONF_DIR/glance-api.conf db_load_metadefs
+    time_stop "dbsync"
 }
 
 # install_glanceclient() - Collect source and prepare
diff --git a/stack.sh b/stack.sh
index 089510fa48..fe71eae36c 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1155,7 +1155,8 @@ fi
 # Glance
 # ------
 
-if is_service_enabled g-reg; then
+# NOTE(yoctozepto): limited to node hosting the database which is the controller
+if is_service_enabled $DATABASE_BACKENDS && is_service_enabled glance; then
     echo_summary "Configuring Glance"
     init_glance
 fi
@@ -1280,8 +1281,8 @@ fi
 # scripts as userdata.
 # See https://help.ubuntu.com/community/CloudInit for more on ``cloud-init``
 
-if is_service_enabled g-reg; then
-
+# NOTE(yoctozepto): limited to node hosting the database which is the controller
+if is_service_enabled $DATABASE_BACKENDS && is_service_enabled glance; then
     echo_summary "Uploading images"
 
     for image_url in ${IMAGE_URLS//,/ }; do

From 89cb80d2120a7247dcc8b1f6a073cf9c9e488806 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rados=C5=82aw=20Piliszek?= <radoslaw.piliszek@gmail.com>
Date: Sat, 18 Jan 2020 15:41:17 +0000
Subject: [PATCH 1649/2409] Revert "Revert "Stop enabling g-reg by default""

This reverts commit 98f3bbe509c2de9efaf4f3fc1b5dbc42d7a67987.

This is no longer necessary as proper fix [1]
is now applied.

[1] https://review.opendev.org/703288

Change-Id: Ibc40f79b1daf30246ed24790e9b305caea497cb2
Related-bug: #1859847
Related-bug: #1860021
---
 .zuul.yaml | 1 -
 stackrc    | 2 +-
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 3468f69e28..130b84a149 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -398,7 +398,6 @@
         key: true
         # Glance services
         g-api: true
-        g-reg: true
         # Nova services
         n-api: true
         n-api-meta: true
diff --git a/stackrc b/stackrc
index 412aca8f07..b31fb395c7 100644
--- a/stackrc
+++ b/stackrc
@@ -69,7 +69,7 @@ if ! isset ENABLED_SERVICES ; then
     # Placement service needed for Nova
     ENABLED_SERVICES+=,placement-api,placement-client
     # Glance services needed for Nova
-    ENABLED_SERVICES+=,g-api,g-reg
+    ENABLED_SERVICES+=,g-api
     # Cinder
     ENABLED_SERVICES+=,c-sch,c-api,c-vol
     # Neutron

From 78cf6f642aea91385dfbe6e1fa594e9f5373e69c Mon Sep 17 00:00:00 2001
From: Terry Wilson <twilson@redhat.com>
Date: Tue, 15 Oct 2019 19:45:09 +0000
Subject: [PATCH 1650/2409] Always install python3 and its dev package

Some distros do not install python3/python3-devel with the minimal
install. F29 doesn't install -devel, and neither Centos 7 or 8
install either. This patch ensures that these packages get installed.

Ideally, PYTHON3_VERSION would be set *after* ensuring that python3
was installed, but it gets a little tricky with all of the includes.
This sets it to 3.6 as nothing uses 3.5 anymore.

Change-Id: I7bdfc408b7c18273639ec26eade475856ac43593
---
 inc/python | 2 ++
 stack.sh   | 5 ++++-
 stackrc    | 2 +-
 3 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/inc/python b/inc/python
index 32dd72594f..bf3aacaf8f 100644
--- a/inc/python
+++ b/inc/python
@@ -463,6 +463,8 @@ function install_python3 {
         apt_get install python${PYTHON3_VERSION} python${PYTHON3_VERSION}-dev
     elif is_suse; then
         install_package python3-devel python3-dbm
+    elif is_fedora; then
+        install_package python3 python3-devel
     fi
 }
 
diff --git a/stack.sh b/stack.sh
index 089510fa48..de1499ddd6 100755
--- a/stack.sh
+++ b/stack.sh
@@ -415,8 +415,11 @@ fi
 
 # Ensure python is installed
 # --------------------------
-is_package_installed python || install_package python
+install_python3
 
+if ! python3_enabled; then
+    is_package_installed python || install_package python
+fi
 
 # Configure Logging
 # -----------------
diff --git a/stackrc b/stackrc
index 412aca8f07..6cc328ea60 100644
--- a/stackrc
+++ b/stackrc
@@ -142,7 +142,7 @@ export USE_PYTHON3=$(trueorfalse True USE_PYTHON3)
 # version of Python 3 to this variable will install the app using that
 # version of the interpreter instead of 2.7.
 _DEFAULT_PYTHON3_VERSION="$(_get_python_version python3)"
-export PYTHON3_VERSION=${PYTHON3_VERSION:-${_DEFAULT_PYTHON3_VERSION:-3.5}}
+export PYTHON3_VERSION=${PYTHON3_VERSION:-${_DEFAULT_PYTHON3_VERSION:-3.6}}
 
 # Just to be more explicit on the Python 2 version to use.
 _DEFAULT_PYTHON2_VERSION="$(_get_python_version python2)"

From afd346a0a10d016e6ab95bdba3932eb6df8f636b Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Thu, 23 Jan 2020 13:13:05 +1100
Subject: [PATCH 1651/2409] devstack-plugins-list: skip openstack/openstack

The proposal job to update the plugin list has been failing for a long
time as it gets a 500 error from gitea on the openstack/openstack
repo.  This is an odd "superrepo" with all projects as submodules;
thus openstack/openstack/devstack is actually a project, not the
directory with a plugin in it.

Skip this repo (gitea shouldn't return a 500, but that's another
thing...)

Regenerate the list manually for this run.

Change-Id: I6ed65bcb720d4cb10702cbf66106120e001ec35f
---
 doc/source/plugin-registry.rst          | 2 +-
 tools/generate-devstack-plugins-list.py | 9 +++++++--
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 5cbe4ed505..904400ece6 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -147,7 +147,6 @@ x/devstack-plugin-hdfs                   `https://opendev.org/x/devstack-plugin-
 x/devstack-plugin-libvirt-qemu           `https://opendev.org/x/devstack-plugin-libvirt-qemu <https://opendev.org/x/devstack-plugin-libvirt-qemu>`__
 x/devstack-plugin-mariadb                `https://opendev.org/x/devstack-plugin-mariadb <https://opendev.org/x/devstack-plugin-mariadb>`__
 x/devstack-plugin-nfs                    `https://opendev.org/x/devstack-plugin-nfs <https://opendev.org/x/devstack-plugin-nfs>`__
-x/devstack-plugin-sheepdog               `https://opendev.org/x/devstack-plugin-sheepdog <https://opendev.org/x/devstack-plugin-sheepdog>`__
 x/devstack-plugin-vmax                   `https://opendev.org/x/devstack-plugin-vmax <https://opendev.org/x/devstack-plugin-vmax>`__
 x/drbd-devstack                          `https://opendev.org/x/drbd-devstack <https://opendev.org/x/drbd-devstack>`__
 x/fenix                                  `https://opendev.org/x/fenix <https://opendev.org/x/fenix>`__
@@ -203,6 +202,7 @@ x/trio2o                                 `https://opendev.org/x/trio2o <https://
 x/valet                                  `https://opendev.org/x/valet <https://opendev.org/x/valet>`__
 x/vmware-nsx                             `https://opendev.org/x/vmware-nsx <https://opendev.org/x/vmware-nsx>`__
 x/vmware-vspc                            `https://opendev.org/x/vmware-vspc <https://opendev.org/x/vmware-vspc>`__
+x/whitebox-tempest-plugin                `https://opendev.org/x/whitebox-tempest-plugin <https://opendev.org/x/whitebox-tempest-plugin>`__
 ======================================== ===
 
 
diff --git a/tools/generate-devstack-plugins-list.py b/tools/generate-devstack-plugins-list.py
index d39b8018ae..3ac9c4d9aa 100644
--- a/tools/generate-devstack-plugins-list.py
+++ b/tools/generate-devstack-plugins-list.py
@@ -45,9 +45,14 @@
 
 def is_in_wanted_namespace(proj):
     # only interested in openstack or x namespace (e.g. not retired
-    # stackforge, etc)
+    # stackforge, etc).
+    #
+    # openstack/openstack "super-repo" of openstack projects as
+    # submodules, that can cause gitea to 500 timeout and thus stop
+    # this script.  Skip it.
     if proj.startswith('stackforge/') or \
-       proj.startswith('stackforge-attic/'):
+       proj.startswith('stackforge-attic/') or \
+       proj == "openstack/openstack":
         return False
     else:
         return True

From 97d857593759f96f036a7e0a528cb6f2159e0fc7 Mon Sep 17 00:00:00 2001
From: Sean McGinnis <sean.mcginnis@gmail.com>
Date: Thu, 19 Dec 2019 07:38:45 -0600
Subject: [PATCH 1652/2409] Remove Sheepdog plugin information

The Sheepdog project has been defunct for awhile now, and the Sheepdog
driver and os-brick connector is now being removed from Cinder. This
cleans up plugin references for the driver.

Change-Id: Ieb2d9cf653b2d3a4af30cab26b8428a7c7edff98
Signed-off-by: Sean McGinnis <sean.mcginnis@gmail.com>
---
 lib/cinder_plugins/sheepdog | 41 -------------------------------------
 1 file changed, 41 deletions(-)
 delete mode 100644 lib/cinder_plugins/sheepdog

diff --git a/lib/cinder_plugins/sheepdog b/lib/cinder_plugins/sheepdog
deleted file mode 100644
index 558de46c6d..0000000000
--- a/lib/cinder_plugins/sheepdog
+++ /dev/null
@@ -1,41 +0,0 @@
-#!/bin/bash
-#
-# lib/cinder_plugins/sheepdog
-# Configure the sheepdog driver
-
-# Enable with:
-#
-#   CINDER_DRIVER=sheepdog
-
-# Dependencies:
-#
-# - ``functions`` file
-# - ``cinder`` configurations
-
-# configure_cinder_driver - make configuration changes, including those to other services
-
-# Save trace setting
-_XTRACE_CINDER_SHEEPDOG=$(set +o | grep xtrace)
-set +o xtrace
-
-
-# Defaults
-# --------
-
-# Set up default directories
-
-
-# Entry Points
-# ------------
-
-# configure_cinder_driver - Set config files, create data dirs, etc
-function configure_cinder_driver {
-    iniset $CINDER_CONF DEFAULT volume_driver "cinder.volume.drivers.sheepdog.SheepdogDriver"
-}
-
-# Restore xtrace
-$_XTRACE_CINDER_SHEEPDOG
-
-# Local variables:
-# mode: shell-script
-# End:

From 6808a3468dd157f9f0676f972aea54add4e33063 Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <j.harbott@x-ion.de>
Date: Mon, 20 Jan 2020 15:52:33 +0000
Subject: [PATCH 1653/2409] Clean up remainders of USE_SYSTEMD and logging
 setup

We dropped the ability to override USE_SYSTEMD to False when we deleted
screen support in [0], so we can also clean up any conditionals based
on it.

Also clean up the logging setup functions, dropping local vars for
parameters that we don't actually support anymore.

[0] I8c27182f60b0f5310b3a8bf5feb02beb7ffbb26a

Change-Id: I5cbce9f2c42e111761e8689447b3f8cbb7ea2eb5
---
 clean.sh  | 10 ++++------
 functions | 43 ++++++++++++++++---------------------------
 stack.sh  | 25 ++++++++++---------------
 stackrc   |  4 +---
 4 files changed, 31 insertions(+), 51 deletions(-)

diff --git a/clean.sh b/clean.sh
index d6c6b40608..685a719cfb 100755
--- a/clean.sh
+++ b/clean.sh
@@ -123,12 +123,10 @@ if [[ -n "$LOGDIR" ]] && [[ -d "$LOGDIR" ]]; then
     sudo rm -rf $LOGDIR
 fi
 
-# Clean out the systemd user unit files if systemd was used.
-if [[ "$USE_SYSTEMD" = "True" ]]; then
-    sudo find $SYSTEMD_DIR -type f -name '*devstack@*service' -delete
-    # Make systemd aware of the deletion.
-    $SYSTEMCTL daemon-reload
-fi
+# Clean out the systemd unit files.
+sudo find $SYSTEMD_DIR -type f -name '*devstack@*service' -delete
+# Make systemd aware of the deletion.
+$SYSTEMCTL daemon-reload
 
 # Clean up venvs
 DIRS_TO_CLEAN="$WHEELHOUSE ${PROJECT_VENV[@]} .config/openstack"
diff --git a/functions b/functions
index 8ea634e753..6da6bc52fa 100644
--- a/functions
+++ b/functions
@@ -635,40 +635,29 @@ function vercmp {
 # This sets up defaults we like in devstack for logging for tracking
 # down issues, and makes sure everything is done the same between
 # projects.
+# NOTE(jh): Historically this function switched between three different
+# functions: setup_systemd_logging, setup_colorized_logging and
+# setup_standard_logging_identity. Since we always run with systemd now,
+# this could be cleaned up, but the other functions may still be in use
+# by plugins. Since deprecations haven't worked in the past, we'll just
+# leave them in place.
 function setup_logging {
-    local conf_file=$1
-    local other_cond=${2:-"False"}
-    if [[ "$USE_SYSTEMD" == "True" ]]; then
-        setup_systemd_logging $conf_file
-    elif [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ] && [ "$other_cond" == "False" ]; then
-        setup_colorized_logging $conf_file
-    else
-        setup_standard_logging_identity $conf_file
-    fi
+    setup_systemd_logging $1
 }
 
 # This function sets log formatting options for colorizing log
 # output to stdout. It is meant to be called by lib modules.
-# The last two parameters are optional and can be used to specify
-# non-default value for project and user format variables.
-# Defaults are respectively 'project_name' and 'user_name'
-#
-# setup_colorized_logging something.conf SOMESECTION
 function setup_colorized_logging {
     local conf_file=$1
-    local conf_section="DEFAULT"
-    local project_var="project_name"
-    local user_var="user_name"
     # Add color to logging output
-    iniset $conf_file $conf_section logging_context_format_string "%(asctime)s.%(msecs)03d %(color)s%(levelname)s %(name)s [%(request_id)s %("$project_var")s %("$user_var")s%(color)s] %(instance)s%(color)s%(message)s"
-    iniset $conf_file $conf_section logging_default_format_string "%(asctime)s.%(msecs)03d %(color)s%(levelname)s %(name)s [-%(color)s] %(instance)s%(color)s%(message)s"
-    iniset $conf_file $conf_section logging_debug_format_suffix "from (pid=%(process)d) %(funcName)s %(pathname)s:%(lineno)d"
-    iniset $conf_file $conf_section logging_exception_prefix "%(color)s%(asctime)s.%(msecs)03d TRACE %(name)s %(instance)s"
+    iniset $conf_file DEFAULT logging_context_format_string "%(asctime)s.%(msecs)03d %(color)s%(levelname)s %(name)s [%(request_id)s %(project_name)s %(user_name)s%(color)s] %(instance)s%(color)s%(message)s"
+    iniset $conf_file DEFAULT logging_default_format_string "%(asctime)s.%(msecs)03d %(color)s%(levelname)s %(name)s [-%(color)s] %(instance)s%(color)s%(message)s"
+    iniset $conf_file DEFAULT logging_debug_format_suffix "from (pid=%(process)d) %(funcName)s %(pathname)s:%(lineno)d"
+    iniset $conf_file DEFAULT logging_exception_prefix "%(color)s%(asctime)s.%(msecs)03d TRACE %(name)s %(instance)s"
 }
 
 function setup_systemd_logging {
     local conf_file=$1
-    local conf_section="DEFAULT"
     # NOTE(sdague): this is a nice to have, and means we're using the
     # native systemd path, which provides for things like search on
     # request-id. However, there may be an eventlet interaction here,
@@ -676,16 +665,16 @@ function setup_systemd_logging {
     USE_JOURNAL=$(trueorfalse False USE_JOURNAL)
     local pidstr=""
     if [[ "$USE_JOURNAL" == "True" ]]; then
-        iniset $conf_file $conf_section use_journal "True"
+        iniset $conf_file DEFAULT use_journal "True"
         # if we are using the journal directly, our process id is already correct
     else
         pidstr="(pid=%(process)d) "
     fi
-    iniset $conf_file $conf_section logging_debug_format_suffix "{{${pidstr}%(funcName)s %(pathname)s:%(lineno)d}}"
+    iniset $conf_file DEFAULT logging_debug_format_suffix "{{${pidstr}%(funcName)s %(pathname)s:%(lineno)d}}"
 
-    iniset $conf_file $conf_section logging_context_format_string "%(color)s%(levelname)s %(name)s [%(global_request_id)s %(request_id)s %(project_name)s %(user_name)s%(color)s] %(instance)s%(color)s%(message)s"
-    iniset $conf_file $conf_section logging_default_format_string "%(color)s%(levelname)s %(name)s [-%(color)s] %(instance)s%(color)s%(message)s"
-    iniset $conf_file $conf_section logging_exception_prefix "ERROR %(name)s %(instance)s"
+    iniset $conf_file DEFAULT logging_context_format_string "%(color)s%(levelname)s %(name)s [%(global_request_id)s %(request_id)s %(project_name)s %(user_name)s%(color)s] %(instance)s%(color)s%(message)s"
+    iniset $conf_file DEFAULT logging_default_format_string "%(color)s%(levelname)s %(name)s [-%(color)s] %(instance)s%(color)s%(message)s"
+    iniset $conf_file DEFAULT logging_exception_prefix "ERROR %(name)s %(instance)s"
 }
 
 function setup_standard_logging_identity {
diff --git a/stack.sh b/stack.sh
index 089510fa48..f00bceb21d 100755
--- a/stack.sh
+++ b/stack.sh
@@ -803,13 +803,11 @@ fixup_all
 # Install subunit for the subunit output stream
 pip_install -U os-testr
 
-if [[ "$USE_SYSTEMD" == "True" ]]; then
-    pip_install_gr systemd-python
-    # the default rate limit of 1000 messages / 30 seconds is not
-    # sufficient given how verbose our logging is.
-    iniset -sudo /etc/systemd/journald.conf "Journal" "RateLimitBurst" "0"
-    sudo systemctl restart systemd-journald
-fi
+pip_install_gr systemd-python
+# the default rate limit of 1000 messages / 30 seconds is not
+# sufficient given how verbose our logging is.
+iniset -sudo /etc/systemd/journald.conf "Journal" "RateLimitBurst" "0"
+sudo systemctl restart systemd-journald
 
 # Virtual Environment
 # -------------------
@@ -1521,14 +1519,11 @@ if [[ -n "$DEPRECATED_TEXT" ]]; then
     echo
 fi
 
-# If USE_SYSTEMD is enabled, tell the user about using it.
-if [[ "$USE_SYSTEMD" == "True" ]]; then
-    echo
-    echo "Services are running under systemd unit files."
-    echo "For more information see: "
-    echo "https://docs.openstack.org/devstack/latest/systemd.html"
-    echo
-fi
+echo
+echo "Services are running under systemd unit files."
+echo "For more information see: "
+echo "https://docs.openstack.org/devstack/latest/systemd.html"
+echo
 
 # Useful info on current state
 cat /etc/devstack-version
diff --git a/stackrc b/stackrc
index 2d3a599a36..6d8f594309 100644
--- a/stackrc
+++ b/stackrc
@@ -109,9 +109,7 @@ CELLSV2_SETUP=${CELLSV2_SETUP:-"superconductor"}
 # Set the root URL for Horizon
 HORIZON_APACHE_ROOT="/dashboard"
 
-# Whether to use SYSTEMD to manage services, we only do this from
-# Queens forward.
-USE_SYSTEMD="True"
+# Whether to use user specific units for running services or global ones.
 USER_UNITS=$(trueorfalse False USER_UNITS)
 if [[ "$USER_UNITS" == "True" ]]; then
     SYSTEMD_DIR="$HOME/.local/share/systemd/user"

From 29bf8523965b504624f9450f3dffe863994b4077 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rados=C5=82aw=20Piliszek?= <radoslaw.piliszek@gmail.com>
Date: Fri, 24 Jan 2020 11:52:13 +0100
Subject: [PATCH 1654/2409] Do not try finding pip for python2 when not
 required

[1] stopped installing pip for py2 when py3 is being used.

This patch makes sure we check only for py3 pip then.

Also removed some no-longer-relevant comment and
made uninstall behave the same.

Check for pip>=6 removed too.

See also [2].

[1] 279a7589b03db69fd1b85d947cd0171dacef94ee
[2] http://lists.openstack.org/pipermail/openstack-discuss/2020-January/012182.html

Change-Id: I36ee53e57e468d760b80a7e621b90899867a8efd
---
 inc/python | 27 ++++++++++-----------------
 1 file changed, 10 insertions(+), 17 deletions(-)

diff --git a/inc/python b/inc/python
index 32dd72594f..37e8399f4a 100644
--- a/inc/python
+++ b/inc/python
@@ -162,16 +162,14 @@ function pip_install {
         local sudo_pip="env"
     else
         local cmd_pip
-        cmd_pip=$(get_pip_command $PYTHON2_VERSION)
         local sudo_pip="sudo -H"
         if python3_enabled; then
-            # Special case some services that have experimental
-            # support for python3 in progress, but don't claim support
-            # in their classifier
-            echo "Check python version for : $package_dir"
-            echo "Using $PYTHON3_VERSION version to install $package_dir based on default behavior"
+            echo "Using python $PYTHON3_VERSION to install $package_dir because python3_enabled=True"
             sudo_pip="$sudo_pip LC_ALL=en_US.UTF-8"
             cmd_pip=$(get_pip_command $PYTHON3_VERSION)
+        else
+            echo "Using python $PYTHON2_VERSION to install $package_dir because python3_enabled=False"
+            cmd_pip=$(get_pip_command $PYTHON2_VERSION)
         fi
     fi
 
@@ -179,16 +177,6 @@ function pip_install {
     # Always apply constraints
     cmd_pip="$cmd_pip -c $REQUIREMENTS_DIR/upper-constraints.txt"
 
-    # FIXME(dhellmann): Need to force multiple versions of pip for
-    # packages like setuptools?
-    local pip_version
-    pip_version=$(python -c "import pip; \
-                        print(pip.__version__.split('.')[0])")
-    if (( pip_version<6 )); then
-        die $LINENO "Currently installed pip version ${pip_version} does not" \
-            "meet minimum requirements (>=6)."
-    fi
-
     $xtrace
 
     # Also install test requirements
@@ -225,8 +213,13 @@ function pip_uninstall {
         local sudo_pip="env"
     else
         local cmd_pip
-        cmd_pip=$(get_pip_command $PYTHON2_VERSION)
         local sudo_pip="sudo -H"
+        if python3_enabled; then
+            sudo_pip="$sudo_pip LC_ALL=en_US.UTF-8"
+            cmd_pip=$(get_pip_command $PYTHON3_VERSION)
+        else
+            cmd_pip=$(get_pip_command $PYTHON2_VERSION)
+        fi
     fi
     # don't error if we can't uninstall, it might not be there
     $sudo_pip $cmd_pip uninstall -y $name || /bin/true

From 4dc02f97e7a750bf97ec71ce7fedd49e96dc5bdb Mon Sep 17 00:00:00 2001
From: Witek Bedyk <witold.bedyk@suse.com>
Date: Fri, 24 Jan 2020 18:52:25 +0100
Subject: [PATCH 1655/2409] Remove fixup_python_packages

The hack has be around for pip 1.4.1 and older. It should be safe to
remove it by now. In fact it causes problems in my Ubutu Bionic VM when
trying to overwrite httplib2 library installed from the distro package.

Change-Id: I34b826f4e8f10f8d44b888120f19fcc7ba501b3d
---
 tools/fixup_stuff.sh | 37 -------------------------------------
 1 file changed, 37 deletions(-)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index 7e5ae75831..a5c1667518 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -5,16 +5,6 @@
 # fixup_stuff.sh
 #
 # All distro and package specific hacks go in here
-#
-# - prettytable 0.7.2 permissions are 600 in the package and
-#   pip 1.4 doesn't fix it (1.3 did)
-#
-# - httplib2 0.8 permissions are 600 in the package and
-#   pip 1.4 doesn't fix it (1.3 did)
-#
-# - Fedora:
-#   - set selinux not enforcing
-#   - uninstall firewalld (f20 only)
 
 
 # If ``TOP_DIR`` is set we're being sourced rather than running stand-alone
@@ -101,32 +91,6 @@ function get_package_path {
     echo $(python -c "import os; import $package; print(os.path.split(os.path.realpath($package.__file__))[0])")
 }
 
-
-# Pre-install affected packages so we can fix the permissions
-# These can go away once we are confident that pip 1.4.1+ is available everywhere
-
-function fixup_python_packages {
-    # Fix prettytable 0.7.2 permissions
-    # Don't specify --upgrade so we use the existing package if present
-    pip_install 'prettytable>=0.7'
-    PACKAGE_DIR=$(get_package_path prettytable)
-    # Only fix version 0.7.2
-    dir=$(echo $PACKAGE_DIR/prettytable-0.7.2*)
-    if [[ -d $dir ]]; then
-        sudo chmod +r $dir/*
-    fi
-
-    # Fix httplib2 0.8 permissions
-    # Don't specify --upgrade so we use the existing package if present
-    pip_install httplib2
-    PACKAGE_DIR=$(get_package_path httplib2)
-    # Only fix version 0.8
-    dir=$(echo $PACKAGE_DIR-0.8*)
-    if [[ -d $dir ]]; then
-        sudo chmod +r $dir/*
-    fi
-}
-
 function fixup_fedora {
     if ! is_fedora; then
         return
@@ -268,7 +232,6 @@ function fixup_virtualenv {
 function fixup_all {
     fixup_keystone
     fixup_ubuntu
-    fixup_python_packages
     fixup_fedora
     fixup_suse
     fixup_virtualenv

From 19e4d972884e422d691c4cc1fe9e7ed3a03a2c01 Mon Sep 17 00:00:00 2001
From: Federico Ressi <fressi@redhat.com>
Date: Fri, 24 Jan 2020 11:44:46 +0100
Subject: [PATCH 1656/2409] Install psutil required by tools/mlock_report.py
 script

'tools/mlock_report.py' script requires 'psutil' package to be
installed. This ensures it is done before memory_peak service is
started.

Partial-Bug: #1860753
Change-Id: I7b2b6eaf9856c6057e1a4a0054d15074150a6cb6
---
 lib/dstat | 9 +++++++++
 stack.sh  | 7 +++++++
 2 files changed, 16 insertions(+)

diff --git a/lib/dstat b/lib/dstat
index fe38d75585..f5bd2bb948 100644
--- a/lib/dstat
+++ b/lib/dstat
@@ -9,6 +9,7 @@
 
 # ``stack.sh`` calls the entry points in this order:
 #
+# - install_dstat
 # - start_dstat
 # - stop_dstat
 
@@ -16,6 +17,14 @@
 _XTRACE_DSTAT=$(set +o | grep xtrace)
 set +o xtrace
 
+# install_dstat() - Install prerequisites for dstat services
+function install_dstat {
+    if is_service_enabled memory_tracker; then
+        # Install python libraries required by tools/mlock_report.py
+        pip_install_gr psutil
+    fi
+}
+
 # start_dstat() - Start running processes
 function start_dstat {
     # A better kind of sysstat, with the top process per time slice
diff --git a/stack.sh b/stack.sh
index fe71eae36c..2a6e470f7e 100755
--- a/stack.sh
+++ b/stack.sh
@@ -867,6 +867,13 @@ if is_service_enabled tls-proxy; then
     init_cert
 fi
 
+# Dstat
+# -----
+
+# Install dstat services prerequisites
+install_dstat
+
+
 # Check Out and Install Source
 # ----------------------------
 

From e727dd56821231677e398133a3f991dcc3931ff4 Mon Sep 17 00:00:00 2001
From: Witek Bedyk <witold.bedyk@suse.com>
Date: Mon, 27 Jan 2020 16:00:12 +0100
Subject: [PATCH 1657/2409] Remove conflicting packages in Ubuntu

Following packages conflict with pip installed versions:
* httplib2
* pyasn1-modules

Change-Id: Ic4f70f839765e67394509cc543560aac7f50e287
---
 tools/fixup_stuff.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index a5c1667518..ae555d5861 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -79,6 +79,8 @@ function fixup_ubuntu {
     # manifest of what to remove.  However, in most cases, simply
     # overwriting works.  So this hacks around those packages that
     # have been dragged in by some other system dependency
+    sudo rm -f /usr/lib/python3/dist-packages/httplib2-*.egg-info
+    sudo rm -f /usr/lib/python3/dist-packages/pyasn1_modules-*.egg-info
     sudo rm -f /usr/lib/python3/dist-packages/PyYAML-*.egg-info
 }
 

From 169f5dee475f49ca18cd5f803287797a6c1ee5c0 Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Mon, 6 Jan 2020 13:45:33 +0000
Subject: [PATCH 1658/2409] libvirt: Support the use of the virt-preview repo
 when using Fedora

The virt-preview repo provides the latest rawhide versions of QEMU,
Libvirt and other virt tools for older releases of Fedora. This repo is
extremely useful when testing features in OpenStack that rely on these
latest builds well in advance of them landing in full Fedora, CentOS or
RHEL releases.

This change adds a ``ENABLE_FEDORA_VIRT_PREVIEW_REPO`` configurable
to control when this repo is enabled and used when deploying on Fedora.

Change-Id: I5c3e1b7b632fd73310c462530990cdb0e0c0ceea
---
 lib/nova_plugins/functions-libvirt | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index 35666393ca..03df258e03 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -24,6 +24,10 @@ DEBUG_LIBVIRT=$(trueorfalse True DEBUG_LIBVIRT)
 # Currently fairly specific to OpenStackCI hosts
 DEBUG_LIBVIRT_COREDUMPS=$(trueorfalse False DEBUG_LIBVIRT_COREDUMPS)
 
+# Enable the Fedora Virtualization Preview Copr repo that provides the latest
+# rawhide builds of QEMU, Libvirt and other virt tools.
+ENABLE_FEDORA_VIRT_PREVIEW_REPO=$(trueorfalse False ENABLE_FEDORA_VIRT_PREVIEW_REPO)
+
 # Enable coredumps for libvirt
 #  Bug: https://bugs.launchpad.net/nova/+bug/1643911
 function _enable_coredump {
@@ -61,6 +65,12 @@ function install_libvirt {
         #pip_install_gr <there-si-no-guestfs-in-pypi>
     elif is_fedora || is_suse; then
 
+        # Optionally enable the virt-preview repo when on Fedora
+        if [[ $DISTRO =~ f[0-9][0-9] ]] && [[ ${ENABLE_FEDORA_VIRT_PREVIEW_REPO} == "True" ]]; then
+            # https://copr.fedorainfracloud.org/coprs/g/virtmaint-sig/virt-preview/
+            sudo dnf copr enable -y @virtmaint-sig/virt-preview
+        fi
+
         # Note that in CentOS/RHEL this needs to come from the RDO
         # repositories (qemu-kvm-ev ... which provides this package)
         # as the base system version is too old.  We should have

From f6597b1b461b758c3984ad607d3a9559d273a66d Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <j.harbott@x-ion.de>
Date: Wed, 29 Jan 2020 15:46:35 +0000
Subject: [PATCH 1659/2409] Undeprecate neutron-legacy scripts

Work on the new neutron scripts has stalled and they aren't in a useable
state yet. Given the ongoing decline in contributions, let us
acknowledge this and undeprecate the neutron-legacy scripts so that
people can continue to use them without feeling guilty about it.

Change-Id: I4bce19da861abf18ddb89d82fd312c5e49a4ee7c
---
 .zuul.yaml         | 15 +++------------
 lib/neutron-legacy |  2 --
 2 files changed, 3 insertions(+), 14 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 130b84a149..7801297557 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -405,22 +405,15 @@
         n-cpu: true
         n-novnc: true
         n-sch: true
+        # Placement service
         placement-api: true
         # Neutron services
-        # We need to keep using the neutron-legacy based services for
-        # now until all issues with the new lib/neutron code are solved
         q-agt: true
         q-dhcp: true
         q-l3: true
         q-meta: true
         q-metering: true
         q-svc: true
-        # neutron-api: true
-        # neutron-agent: true
-        # neutron-dhcp: true
-        # neutron-l3: true
-        # neutron-metadata-agent: true
-        # neutron-metering: true
         # Swift services
         s-account: true
         s-container: true
@@ -449,12 +442,10 @@
           tls-proxy: true
           # Nova services
           n-cpu: true
+          # Placement services
           placement-client: true
           # Neutron services
-          # We need to keep using the neutron-legacy based services for
-          # now until all issues with the new lib/neutron code are solved
           q-agt: true
-          # neutron-agent: true
           # Cinder services
           c-bak: true
           c-vol: true
@@ -464,7 +455,7 @@
           # s-*: false
           horizon: false
           tempest: false
-          # Test matrix emits ceilometer but ceilomenter is not installed in the
+          # Test matrix emits ceilometer but ceilometer is not installed in the
           # integrated gate, so specifying the services has not effect.
           # ceilometer-*: false
         devstack_localrc:
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 3d39d41b7e..8fb8858eb8 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -58,8 +58,6 @@
 # Neutron Network Configuration
 # -----------------------------
 
-deprecated "Using lib/neutron-legacy is deprecated, and it will be removed in the future"
-
 if is_service_enabled tls-proxy; then
     Q_PROTOCOL="https"
 fi

From e1c0406d10380f6ad3620fa9e12df8499a1010ac Mon Sep 17 00:00:00 2001
From: Ghanshyam <gmann@ghanshyammann.com>
Date: Wed, 29 Jan 2020 15:39:17 -0600
Subject: [PATCH 1660/2409] Support TEMPEST_BRANCH with tag name

TEMPEST_BRANCH which is mostly set as master so
that Tempest master is run to test the env. With
stable branch going to EM state and Tempest master
might not work due to incompatibility of code or
requirements. In that case we pin the Tempest so that
older Tempest can be used for their testing.

Till now for ocata, pike and, queens we used the gerrit style
ref to pin the Tempest which is not preferred way. We should be
able to use the tag name on TEMPEST_BRANCH.

This commit explicitly checkout the tag set in TEMPEST_BRANCH
as git_clone does not checkout the tag directly until RECLONE
is true or tempest dir does not exist.

After this stable branch or job can set the tag directly with name.
For exmaple: TEMPEST_BRANCH=23.0.0.

Change-Id: Ic777e4b56c4932dde135ac909cb5c6f4a7d5cc78
---
 lib/tempest | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index ce0886bbd9..ec61c184a0 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -686,6 +686,11 @@ function install_tempest {
     git_clone $TEMPEST_REPO $TEMPEST_DIR $TEMPEST_BRANCH
     pip_install 'tox!=2.8.0'
     pushd $TEMPEST_DIR
+    # NOTE(gmann): checkout the TEMPEST_BRANCH in case TEMPEST_BRANCH
+    # is tag name not master. git_clone would not checkout tag because
+    # TEMPEST_DIR already exist until RECLONE is true.
+    git checkout $TEMPEST_BRANCH
+
     tox -r --notest -efull
     # NOTE(mtreinish) Respect constraints in the tempest full venv, things that
     # are using a tox job other than full will not be respecting constraints but

From 3555b48ff45a109e6456923d597fa174084387ab Mon Sep 17 00:00:00 2001
From: Federico Ressi <fressi@redhat.com>
Date: Fri, 24 Jan 2020 06:49:03 +0100
Subject: [PATCH 1661/2409] Switch to python3 for memory_peak service

When starting 'memory_peak' service is using python command instead of
python3, while psutil (required package) is most probably being
installed into the python3 environment (as we are dropping python2.7
support).

Closes-Bug: #1860753
Change-Id: Ia2b7e2e33d784560443131e2965f520b361a54e3
---
 tools/memory_tracker.sh | 2 +-
 tools/mlock_report.py   | 2 --
 2 files changed, 1 insertion(+), 3 deletions(-)
 mode change 100755 => 100644 tools/mlock_report.py

diff --git a/tools/memory_tracker.sh b/tools/memory_tracker.sh
index 63f25ca2de..6c36534f01 100755
--- a/tools/memory_tracker.sh
+++ b/tools/memory_tracker.sh
@@ -14,7 +14,7 @@
 
 set -o errexit
 
-PYTHON=${PYTHON:-python}
+PYTHON=${PYTHON:-python3}
 
 # time to sleep between checks
 SLEEP_TIME=20
diff --git a/tools/mlock_report.py b/tools/mlock_report.py
old mode 100755
new mode 100644
index 07716b04d6..b15a0bf80b
--- a/tools/mlock_report.py
+++ b/tools/mlock_report.py
@@ -1,5 +1,3 @@
-#!/usr/bin/env python
-
 # This tool lists processes that lock memory pages from swapping to disk.
 
 import re

From 7611d3dfd2e1f68bf11027756fd5b217d5ae9640 Mon Sep 17 00:00:00 2001
From: Carlos Camacho <ccamacho@redhat.com>
Date: Thu, 30 Jan 2020 14:39:51 +0100
Subject: [PATCH 1662/2409] Add -r option when removing egg-info files/folders

We are hitting this error:
+ tools/fixup_stuff.sh:fixup_ubuntu:82 :
    sudo rm -f /usr/lib/python3/dist-packages/httplib2-0.11.3.egg-info
rm: cannot remove
    '/usr/lib/python3/dist-packages/httplib2-0.11.3.egg-info': Is a directory

This patch adds the -r option to allow removing folders.

Change-Id: Ib7bb8b0a3dcf747bcc06da1a2fb17fa9d8808484
---
 tools/fixup_stuff.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index ae555d5861..15b3ab767d 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -79,9 +79,9 @@ function fixup_ubuntu {
     # manifest of what to remove.  However, in most cases, simply
     # overwriting works.  So this hacks around those packages that
     # have been dragged in by some other system dependency
-    sudo rm -f /usr/lib/python3/dist-packages/httplib2-*.egg-info
-    sudo rm -f /usr/lib/python3/dist-packages/pyasn1_modules-*.egg-info
-    sudo rm -f /usr/lib/python3/dist-packages/PyYAML-*.egg-info
+    sudo rm -rf /usr/lib/python3/dist-packages/httplib2-*.egg-info
+    sudo rm -rf /usr/lib/python3/dist-packages/pyasn1_modules-*.egg-info
+    sudo rm -rf /usr/lib/python3/dist-packages/PyYAML-*.egg-info
 }
 
 # Python Packages

From 64b3c5f468110e00a30216186e590e87f81bc328 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Fri, 14 Feb 2020 11:07:30 -0600
Subject: [PATCH 1663/2409] Drop the tempest-full py2 job

We have dropped the tempest-full from
Tempest gate and made this to run on py2
explicitly which is nothing but for stable gates.
- I75868d5c9b6630fe78958ff89e58a0aced09a6b3

This job is not supposed to run on ussuri onwards master
gate as everything will be python3-only.

Change-Id: I372bde6a1753884efaf15da5fab48f1bddb4dab5
---
 .zuul.yaml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 130b84a149..40978e6bc2 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -577,7 +577,6 @@
 
 - project:
     templates:
-      - integrated-gate
       - integrated-gate-py3
       - publish-openstack-docs-pti
     check:

From d05efc6ae92cea0a86ea5b0a848a99b5f8d51870 Mon Sep 17 00:00:00 2001
From: Andreas Jaeger <aj@suse.com>
Date: Mon, 17 Feb 2020 12:32:12 +0100
Subject: [PATCH 1664/2409] Remove networking-calico from plugin-registry.rst

Networking-calico has been removed from openstack repositories, remove
it from docs.

Change-Id: I58d2964ee52d66fe89aa84c1d88c4d8d4d349b0d
---
 doc/source/plugin-registry.rst | 1 -
 1 file changed, 1 deletion(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 904400ece6..652bf0b1cc 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -75,7 +75,6 @@ openstack/murano                         `https://opendev.org/openstack/murano <
 openstack/networking-bagpipe             `https://opendev.org/openstack/networking-bagpipe <https://opendev.org/openstack/networking-bagpipe>`__
 openstack/networking-baremetal           `https://opendev.org/openstack/networking-baremetal <https://opendev.org/openstack/networking-baremetal>`__
 openstack/networking-bgpvpn              `https://opendev.org/openstack/networking-bgpvpn <https://opendev.org/openstack/networking-bgpvpn>`__
-openstack/networking-calico              `https://opendev.org/openstack/networking-calico <https://opendev.org/openstack/networking-calico>`__
 openstack/networking-generic-switch      `https://opendev.org/openstack/networking-generic-switch <https://opendev.org/openstack/networking-generic-switch>`__
 openstack/networking-hyperv              `https://opendev.org/openstack/networking-hyperv <https://opendev.org/openstack/networking-hyperv>`__
 openstack/networking-l2gw                `https://opendev.org/openstack/networking-l2gw <https://opendev.org/openstack/networking-l2gw>`__

From 2dcbc28abab7eb51b9e3fd549fab49d42c48e90f Mon Sep 17 00:00:00 2001
From: Federico Ressi <fressi@redhat.com>
Date: Wed, 5 Feb 2020 11:29:51 +0100
Subject: [PATCH 1665/2409] Install versioned python RPMs on RedHat distros

Set default python3 version as 3 for cases python3
is not installed before running DevStack.

Implements installation of required python3x package
for RedHat family distros with package name depending on
configurable ${PYTHON3_VERSION}. Examples:

  3 => python3 python3-devel (default one)
  3.6 => python36 python36-devel
  3.7 => python37 python37-devel

This should help in situations where there are more
than one python available for given platform and
DevStack is asked to pick one by its full 3.x version

Change-Id: I49d86bc9193165e0a41e8e8720be37d81a4e7ee0
---
 inc/python | 6 +++++-
 stackrc    | 2 +-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/inc/python b/inc/python
index 9d9f38b5a9..cf61389709 100644
--- a/inc/python
+++ b/inc/python
@@ -457,7 +457,11 @@ function install_python3 {
     elif is_suse; then
         install_package python3-devel python3-dbm
     elif is_fedora; then
-        install_package python3 python3-devel
+        if [ "$os_VENDOR" = "Fedora" ]; then
+            install_package python${PYTHON3_VERSION//.}
+        else
+            install_package python${PYTHON3_VERSION//.} python${PYTHON3_VERSION//.}-devel
+        fi
     fi
 }
 
diff --git a/stackrc b/stackrc
index e11a34c8cc..4e33b6838f 100644
--- a/stackrc
+++ b/stackrc
@@ -142,7 +142,7 @@ export USE_PYTHON3=$(trueorfalse True USE_PYTHON3)
 # version of Python 3 to this variable will install the app using that
 # version of the interpreter instead of 2.7.
 _DEFAULT_PYTHON3_VERSION="$(_get_python_version python3)"
-export PYTHON3_VERSION=${PYTHON3_VERSION:-${_DEFAULT_PYTHON3_VERSION:-3.6}}
+export PYTHON3_VERSION=${PYTHON3_VERSION:-${_DEFAULT_PYTHON3_VERSION:-3}}
 
 # Just to be more explicit on the Python 2 version to use.
 _DEFAULT_PYTHON2_VERSION="$(_get_python_version python2)"

From 21a10d3499abd6e9cd1950b3615502bef5ad6b45 Mon Sep 17 00:00:00 2001
From: Federico Ressi <fressi@redhat.com>
Date: Fri, 31 Jan 2020 07:43:30 +0100
Subject: [PATCH 1666/2409] Use python3 as default python command

After Python 2 is getting unsupported, new distros
like CentOS 8 and RHEL8 have stopped providing 'python'
package forcing user to decide which alternative to
use by installing 'python2' or 'python3.x' package
and then setting python alternative.

This change is intended to make using python3 command as
much as possible and use it as default 'python' alternative
where needed.

The final goals motivating this change are:
 - stop using python2 as much as possible
 - help adding support for CentOS 8 and RHEL8

Change-Id: I1e90db987c0bfa6206c211e066be03ea8738ad3f
---
 inc/python                              | 25 +++++++++++++++++++++++++
 stack.sh                                | 19 ++++++++-----------
 tests/test_worlddump.sh                 |  2 +-
 tools/generate-devstack-plugins-list.py |  2 +-
 tools/install_prereqs.sh                |  6 ------
 tools/outfilter.py                      |  4 ++--
 tools/update_clouds_yaml.py             |  2 +-
 tools/worlddump.py                      | 25 ++++++++++++++++++-------
 8 files changed, 56 insertions(+), 29 deletions(-)
 mode change 100755 => 100644 tools/outfilter.py
 mode change 100755 => 100644 tools/worlddump.py

diff --git a/inc/python b/inc/python
index cf61389709..52ad56520a 100644
--- a/inc/python
+++ b/inc/python
@@ -450,6 +450,31 @@ function python3_enabled {
     fi
 }
 
+# Provide requested python version and sets PYTHON variable
+function install_python {
+    # NOTE: install_python function should finally just do what install_python3
+    # does as soon Python 2 support has been dropped
+    if python3_enabled; then
+        install_python3
+        export PYTHON=$(which python${PYTHON3_VERSION} 2>/dev/null ||
+                        which python3 2>/dev/null)
+        if [[ "${DISTRO}" =~ (rhel8) ]]; then
+            # Use Python 3 as default python command so that we have only one
+            # python alternative to use on the system for either python and
+            # python3
+            sudo alternatives --set python "${PYTHON}"
+        else
+            # Install anyway Python 2 for legacy scripts that still requires
+            # python instead of python3 command
+            install_package python
+        fi
+    else
+        echo "WARNING - Python 2 support has been deprecated in favor of Python 3"
+        install_package python
+        export PYTHON=$(which python 2>/dev/null)
+    fi
+}
+
 # Install python3 packages
 function install_python3 {
     if is_ubuntu; then
diff --git a/stack.sh b/stack.sh
index 0f9d57bc9a..7119e5f648 100755
--- a/stack.sh
+++ b/stack.sh
@@ -415,11 +415,8 @@ fi
 
 # Ensure python is installed
 # --------------------------
-install_python3
+install_python
 
-if ! python3_enabled; then
-    is_package_installed python || install_package python
-fi
 
 # Configure Logging
 # -----------------
@@ -497,14 +494,14 @@ if [[ -n "$LOGFILE" ]]; then
             _of_args="$_of_args --no-timestamp"
         fi
         # Set fd 1 and 2 to write the log file
-        exec 1> >( $TOP_DIR/tools/outfilter.py $_of_args -o "${LOGFILE}" ) 2>&1
+        exec 1> >( $PYTHON $TOP_DIR/tools/outfilter.py $_of_args -o "${LOGFILE}" ) 2>&1
         # Set fd 6 to summary log file
-        exec 6> >( $TOP_DIR/tools/outfilter.py -o "${SUMFILE}" )
+        exec 6> >( $PYTHON $TOP_DIR/tools/outfilter.py -o "${SUMFILE}" )
     else
         # Set fd 1 and 2 to primary logfile
-        exec 1> >( $TOP_DIR/tools/outfilter.py -o "${LOGFILE}" ) 2>&1
+        exec 1> >( $PYTHON $TOP_DIR/tools/outfilter.py -o "${LOGFILE}" ) 2>&1
         # Set fd 6 to summary logfile and stdout
-        exec 6> >( $TOP_DIR/tools/outfilter.py -v -o "${SUMFILE}" >&3 )
+        exec 6> >( $PYTHON $TOP_DIR/tools/outfilter.py -v -o "${SUMFILE}" >&3 )
     fi
 
     echo_summary "stack.sh log $LOGFILE"
@@ -521,7 +518,7 @@ else
         exec 1>/dev/null 2>&1
     fi
     # Always send summary fd to original stdout
-    exec 6> >( $TOP_DIR/tools/outfilter.py -v >&3 )
+    exec 6> >( $PYTHON $TOP_DIR/tools/outfilter.py -v >&3 )
 fi
 
 # Basic test for ``$DEST`` path permissions (fatal on error unless skipped)
@@ -557,9 +554,9 @@ function exit_trap {
             generate-subunit $DEVSTACK_START_TIME $SECONDS 'fail' >> ${SUBUNIT_OUTPUT}
         fi
         if [[ -z $LOGDIR ]]; then
-            $TOP_DIR/tools/worlddump.py
+            ${PYTHON} $TOP_DIR/tools/worlddump.py
         else
-            $TOP_DIR/tools/worlddump.py -d $LOGDIR
+            ${PYTHON} $TOP_DIR/tools/worlddump.py -d $LOGDIR
         fi
     else
         # If we error before we've installed os-testr, this will fail.
diff --git a/tests/test_worlddump.sh b/tests/test_worlddump.sh
index f407d407c0..919652536d 100755
--- a/tests/test_worlddump.sh
+++ b/tests/test_worlddump.sh
@@ -8,7 +8,7 @@ source $TOP/tests/unittest.sh
 
 OUT_DIR=$(mktemp -d)
 
-$TOP/tools/worlddump.py -d $OUT_DIR
+${PYTHON} $TOP/tools/worlddump.py -d $OUT_DIR
 
 if [[ $? -ne 0 ]]; then
     fail "worlddump failed"
diff --git a/tools/generate-devstack-plugins-list.py b/tools/generate-devstack-plugins-list.py
index 3ac9c4d9aa..1cacd06bf8 100644
--- a/tools/generate-devstack-plugins-list.py
+++ b/tools/generate-devstack-plugins-list.py
@@ -1,4 +1,4 @@
-#! /usr/bin/env python
+#! /usr/bin/env python3
 
 # Copyright 2016 Hewlett Packard Enterprise Development Company, L.P.
 #
diff --git a/tools/install_prereqs.sh b/tools/install_prereqs.sh
index da59093581..a7c03d26cd 100755
--- a/tools/install_prereqs.sh
+++ b/tools/install_prereqs.sh
@@ -81,12 +81,6 @@ if [[ -n "$SYSLOG" && "$SYSLOG" != "False" ]]; then
     fi
 fi
 
-if python3_enabled; then
-    install_python3
-    export PYTHON=$(which python${PYTHON3_VERSION} 2>/dev/null || which python3 2>/dev/null)
-else
-    export PYTHON=$(which python 2>/dev/null)
-fi
 
 # Mark end of run
 # ---------------
diff --git a/tools/outfilter.py b/tools/outfilter.py
old mode 100755
new mode 100644
index cf091247d0..e910f79ff2
--- a/tools/outfilter.py
+++ b/tools/outfilter.py
@@ -1,5 +1,5 @@
-#!/usr/bin/env python
-#
+#!/usr/bin/env python3
+
 # Copyright 2014 Hewlett-Packard Development Company, L.P.
 #
 # Licensed under the Apache License, Version 2.0 (the "License"); you may
diff --git a/tools/update_clouds_yaml.py b/tools/update_clouds_yaml.py
index 9187c664d0..7be995e8f3 100755
--- a/tools/update_clouds_yaml.py
+++ b/tools/update_clouds_yaml.py
@@ -1,4 +1,4 @@
-#!/usr/bin/env python
+#!/usr/bin/env python3
 
 # Licensed under the Apache License, Version 2.0 (the "License"); you may
 # not use this file except in compliance with the License. You may obtain
diff --git a/tools/worlddump.py b/tools/worlddump.py
old mode 100755
new mode 100644
index d5ff5d1ab5..1e6e176210
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -1,4 +1,4 @@
-#!/usr/bin/env python
+#!/usr/bin/env python3
 #
 # Copyright 2014 Hewlett-Packard Development Company, L.P.
 #
@@ -23,8 +23,8 @@
 import datetime
 from distutils import spawn
 import fnmatch
+import io
 import os
-import os.path
 import shutil
 import subprocess
 import sys
@@ -109,9 +109,10 @@ def _bridge_list():
 # This method gets max version searching 'OpenFlow versions 0x1:0x'.
 # And return a version value converted to an integer type.
 def _get_ofp_version():
-    process = subprocess.Popen(['ovs-ofctl', '--version'], stdout=subprocess.PIPE)
+    process = subprocess.Popen(['ovs-ofctl', '--version'],
+                               stdout=subprocess.PIPE)
     stdout, _ = process.communicate()
-    find_str = 'OpenFlow versions 0x1:0x'
+    find_str = b'OpenFlow versions 0x1:0x'
     offset = stdout.find(find_str)
     return int(stdout[offset + len(find_str):-1]) - 1
 
@@ -206,7 +207,7 @@ def process_list():
 
 def compute_consoles():
     _header("Compute consoles")
-    for root, dirnames, filenames in os.walk('/opt/stack'):
+    for root, _, filenames in os.walk('/opt/stack'):
         for filename in fnmatch.filter(filenames, 'console.log'):
             fullpath = os.path.join(root, filename)
             _dump_cmd("sudo cat %s" % fullpath)
@@ -234,12 +235,22 @@ def var_core():
         # tools out there that can do that sort of thing though.
         _dump_cmd("ls -ltrah /var/core")
 
+
+def disable_stdio_buffering():
+    # re-open STDOUT as binary, then wrap it in a
+    # TextIOWrapper, and write through everything.
+    binary_stdout = io.open(sys.stdout.fileno(), 'wb', 0)
+    sys.stdout = io.TextIOWrapper(binary_stdout, write_through=True)
+
+
 def main():
     opts = get_options()
     fname = filename(opts.dir, opts.name)
     print("World dumping... see %s for details" % fname)
-    sys.stdout = os.fdopen(sys.stdout.fileno(), 'w', 0)
-    with open(fname, 'w') as f:
+
+    disable_stdio_buffering()
+
+    with io.open(fname, 'w') as f:
         os.dup2(f.fileno(), sys.stdout.fileno())
         disk_space()
         process_list()

From 64ae08383a137d8b7fd18a8d8bc5c0fc191a186d Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <j.harbott@x-ion.de>
Date: Wed, 12 Feb 2020 10:04:50 +0000
Subject: [PATCH 1667/2409] Amend python pkgs for debian-based distros

Drop python2 packages that are no longer needed. Replace other py2 pkgs
with their py3 variant.

Change-Id: Id5fc11d1ae0a7daf439c7d72f831f298f5d0ce31
---
 files/debs/general        | 3 ---
 files/debs/keystone       | 2 +-
 files/debs/ldap           | 2 +-
 files/debs/n-cpu          | 2 +-
 files/debs/neutron-common | 2 +-
 files/debs/nova           | 2 +-
 6 files changed, 5 insertions(+), 8 deletions(-)

diff --git a/files/debs/general b/files/debs/general
index df872a0a6c..9f9d57cefb 100644
--- a/files/debs/general
+++ b/files/debs/general
@@ -27,9 +27,6 @@ openssh-server
 openssl
 pkg-config
 psmisc
-python2.7
-python-dev
-python-gdbm # needed for testr
 tar
 tcpdump
 unzip
diff --git a/files/debs/keystone b/files/debs/keystone
index fd0317b9b6..1cfa6ffa38 100644
--- a/files/debs/keystone
+++ b/files/debs/keystone
@@ -2,5 +2,5 @@ libkrb5-dev
 libldap2-dev
 libsasl2-dev
 memcached
-python-mysqldb
+python3-mysqldb
 sqlite3
diff --git a/files/debs/ldap b/files/debs/ldap
index aa3a934d95..54896bb845 100644
--- a/files/debs/ldap
+++ b/files/debs/ldap
@@ -1,3 +1,3 @@
 ldap-utils
-python-ldap
+python3-ldap
 slapd
diff --git a/files/debs/n-cpu b/files/debs/n-cpu
index 636644f10d..54d6fa3fd1 100644
--- a/files/debs/n-cpu
+++ b/files/debs/n-cpu
@@ -5,7 +5,7 @@ gir1.2-libosinfo-1.0
 lvm2 # NOPRIME
 netcat-openbsd
 open-iscsi
-python-guestfs # NOPRIME
+python3-guestfs # NOPRIME
 qemu-utils
 sg3-utils
 sysfsutils
diff --git a/files/debs/neutron-common b/files/debs/neutron-common
index b269f6330b..e548396cd7 100644
--- a/files/debs/neutron-common
+++ b/files/debs/neutron-common
@@ -9,7 +9,7 @@ iputils-ping
 libmysqlclient-dev
 mysql-server #NOPRIME
 postgresql-server-dev-all
-python-mysqldb
+python3-mysqldb
 rabbitmq-server # NOPRIME
 radvd # NOPRIME
 sqlite3
diff --git a/files/debs/nova b/files/debs/nova
index e5110e9c75..dce8f6ac89 100644
--- a/files/debs/nova
+++ b/files/debs/nova
@@ -16,7 +16,7 @@ libvirt-dev # NOPRIME
 mysql-server # NOPRIME
 parted
 pm-utils
-python-mysqldb
+python3-mysqldb
 qemu # dist:wheezy,jessie NOPRIME
 qemu-kvm # NOPRIME
 rabbitmq-server # NOPRIME

From 08d84bc47f7341e64d6dd33f6f6a515f92840ac4 Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <j.harbott@x-ion.de>
Date: Wed, 12 Feb 2020 10:07:36 +0000
Subject: [PATCH 1668/2409] Make database code work with mysql8

The GRANT command in mysql8 can no longer create a user implicitly.
Split that part into a dedicated CREATE USER command.

Also drop disabling the query_cache, it is off by default for some time
and the option got removed in mysql8.

Change-Id: I31bcc285ff8e373abbacb303c1269857c9cfa9ed
---
 lib/databases/mysql | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/databases/mysql b/lib/databases/mysql
index 420a86e04e..e5865f2a69 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -109,8 +109,10 @@ function configure_database_mysql {
         sudo mysql $cmd_args -e "UPDATE mysql.user SET plugin='' WHERE user='$DATABASE_USER' AND host='localhost';"
         sudo mysql $cmd_args -e "FLUSH PRIVILEGES;"
     fi
+    # Create DB user if it does not already exist
+    sudo mysql $cmd_args -e "CREATE USER IF NOT EXISTS '$DATABASE_USER'@'%' identified by '$DATABASE_PASSWORD';"
     # Update the DB to give user '$DATABASE_USER'@'%' full control of the all databases:
-    sudo mysql $cmd_args -e "GRANT ALL PRIVILEGES ON *.* TO '$DATABASE_USER'@'%' identified by '$DATABASE_PASSWORD';"
+    sudo mysql $cmd_args -e "GRANT ALL PRIVILEGES ON *.* TO '$DATABASE_USER'@'%';"
 
     # Now update ``my.cnf`` for some local needs and restart the mysql service
 
@@ -120,8 +122,6 @@ function configure_database_mysql {
     iniset -sudo $my_conf mysqld sql_mode TRADITIONAL
     iniset -sudo $my_conf mysqld default-storage-engine InnoDB
     iniset -sudo $my_conf mysqld max_connections 1024
-    iniset -sudo $my_conf mysqld query_cache_type OFF
-    iniset -sudo $my_conf mysqld query_cache_size 0
 
     if [[ "$DATABASE_QUERY_LOGGING" == "True" ]]; then
         echo_summary "Enabling MySQL query logging"

From 79ffa1f04f00eaaa12fada6715738468a04ba8a8 Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Wed, 5 Feb 2020 15:54:00 +0000
Subject: [PATCH 1669/2409] Fedora: Always install python3-devel

With the recent switch to py3 we need to ensure python3-devel is
installed on Fedora >= 29 before pip installing any dependencies.

Change-Id: I21417687db5b3827c5272ed22f6dc95db13f2870
---
 files/rpms/general | 1 +
 1 file changed, 1 insertion(+)

diff --git a/files/rpms/general b/files/rpms/general
index 5bf1e9ac90..15d329dfd4 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -27,6 +27,7 @@ pkgconfig
 postgresql-devel  # psycopg2
 psmisc
 pyOpenSSL # version in pip uses too much memory
+python3-devel # f29,f30
 python-devel
 redhat-rpm-config # missing dep for gcc hardening flags, see rhbz#1217376
 systemd-devel # for systemd-python

From f1966d77630e62cb415a1c3bcb221897d3e7a1c6 Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Thu, 6 Feb 2020 16:20:37 +0000
Subject: [PATCH 1670/2409] Add Fedora 30 as a supported distro

With Fedora 29 now officially EOL [1] we need to start the move to 30. A
later change will remove f29 support from devstack entirely once
fedora-latest moves to the based f30 image.

[1] https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org/thread/VUK3CJ5LO4ROUH3JTCDVHYAVVYAOCU62/

Change-Id: If87fe93757129f931a3417fc6275ffad280cdf46
---
 files/rpms/cinder  | 4 ++--
 files/rpms/dstat   | 4 ++--
 files/rpms/general | 4 ++--
 files/rpms/nova    | 2 +-
 files/rpms/swift   | 2 +-
 stack.sh           | 2 +-
 6 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/files/rpms/cinder b/files/rpms/cinder
index e6b33dcc5e..ef810cf93d 100644
--- a/files/rpms/cinder
+++ b/files/rpms/cinder
@@ -1,5 +1,5 @@
 iscsi-initiator-utils
 lvm2
 qemu-img
-scsi-target-utils # not:rhel7,f25,f26,f27,f28,f29 NOPRIME
-targetcli # dist:rhel7,f25,f26,f27,f28,f29 NOPRIME
+scsi-target-utils # not:rhel7,f25,f26,f27,f28,f29,f30 NOPRIME
+targetcli # dist:rhel7,f25,f26,f27,f28,f29,f30 NOPRIME
diff --git a/files/rpms/dstat b/files/rpms/dstat
index d7b272a93b..ad5196617f 100644
--- a/files/rpms/dstat
+++ b/files/rpms/dstat
@@ -1,2 +1,2 @@
-dstat # not:f29
-pcp-system-tools # dist:f29
+dstat # not:f29,f30
+pcp-system-tools # dist:f29,f30
diff --git a/files/rpms/general b/files/rpms/general
index 15d329dfd4..279546fa60 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -9,9 +9,9 @@ git-core
 graphviz # needed only for docs
 httpd
 httpd-devel
-iptables-services  # NOPRIME f25,f26,f27,f28,f29
+iptables-services  # NOPRIME f25,f26,f27,f28,f29,f30
 java-1.7.0-openjdk-headless  # NOPRIME rhel7
-java-1.8.0-openjdk-headless  # NOPRIME f25,f26,f27,f28,f29
+java-1.8.0-openjdk-headless  # NOPRIME f25,f26,f27,f28,f29,f30
 libffi-devel
 libjpeg-turbo-devel # Pillow 3.0.0
 libxml2-devel # lxml
diff --git a/files/rpms/nova b/files/rpms/nova
index 639d793756..6c3e47870c 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -7,7 +7,7 @@ gawk
 genisoimage # required for config_drive
 iptables
 iputils
-kernel-modules # dist:f25,f26,f27,f28,f29
+kernel-modules # dist:f25,f26,f27,f28,f29,f30
 kpartx
 libxml2-python
 m2crypto
diff --git a/files/rpms/swift b/files/rpms/swift
index be524d1367..8aed8a4033 100644
--- a/files/rpms/swift
+++ b/files/rpms/swift
@@ -2,7 +2,7 @@ curl
 liberasurecode-devel
 memcached
 pyxattr
-rsync-daemon # dist:f25,f26,f27,f28,f29
+rsync-daemon # dist:f25,f26,f27,f28,f29,f30
 sqlite
 xfsprogs
 xinetd
diff --git a/stack.sh b/stack.sh
index 7119e5f648..ce4fc7560a 100755
--- a/stack.sh
+++ b/stack.sh
@@ -221,7 +221,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (bionic|stretch|jessie|f29|opensuse-15.0|opensuse-15.1|opensuse-tumbleweed|rhel7) ]]; then
+if [[ ! ${DISTRO} =~ (bionic|stretch|jessie|f29|f30|opensuse-15.0|opensuse-15.1|opensuse-tumbleweed|rhel7) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From c6f53dacd275d97cc32a5dd4258e2a86fc05d168 Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Fri, 7 Feb 2020 10:37:08 +0000
Subject: [PATCH 1671/2409] nova: Use iscsi-initiator-utils 2.1.0 on Fedora 30
 and 31

I2f16658c5a3e22cac70912a0f3ad65cdd7071a1e worked around an open-iscsi
bug that remains unpatched in Fedora 30 and 31 by using a private copr
repo with the patch applied. Rawhide has finally been rebased to 2.1.0
where this issue and many others have been resolved.

We can now use a new repo that has been built for Fedora 30 and 31 that
provides this rebased package that we can either use until the rebase is
backported to 31 and 30 or 32 is supported.

Change-Id: I5ba5885bd9c784949602aeb4ddff9d75fecc6b3d
---
 lib/nova | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index 0893ed7084..3f108a4a97 100644
--- a/lib/nova
+++ b/lib/nova
@@ -297,7 +297,7 @@ function configure_nova {
             fi
         fi
 
-        if is_fedora && [[ $DISTRO =~ f[0-9][0-9] ]]; then
+        if is_fedora && [[ $DISTRO =~ f29 ]]; then
             # There is an iscsi-initiator bug where it inserts
             # different whitespace that causes a bunch of output
             # matching to fail.  We have not been able to get
@@ -305,6 +305,12 @@ function configure_nova {
             #  https://bugzilla.redhat.com/show_bug.cgi?id=1676365
             sudo dnf copr enable -y iwienand/iscsi-initiator-utils
             sudo dnf update -y
+        elif is_fedora && [[ $DISTRO =~ f3[0-1] ]]; then
+            # For f30 and f31 use the rebased 2.1.0 version of the package. We
+            # can't use this above as f29 is EOL and as a result we can't
+            # rebuild packages in copr for it.
+            sudo dnf copr enable -y lyarwood/iscsi-initiator-utils
+            sudo dnf update -y
         fi
 
         if [[ ${ISCSID_DEBUG} == "True" ]]; then

From 1d1f53ddc1f70fbf0a3605031c1ffbbcb6f18002 Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Thu, 6 Feb 2020 14:37:26 +0000
Subject: [PATCH 1672/2409] Use fedora-30 as the fedora-latest image

With the open-iscsi rebase we should now be able to move the
fedora-latest job to fedora 30 ahead of the removal of support for 29.

Change-Id: Ia80f03f275e595d3b26b52b3478f303036d59438
---
 .zuul.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 40978e6bc2..7a7d56fd4c 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -52,7 +52,7 @@
     name: devstack-single-node-fedora-latest
     nodes:
       - name: controller
-        label: fedora-29
+        label: fedora-30
     groups:
       - name: tempest
         nodes:

From 347abd41ce860e1f33dd3870ddc54431c6427d10 Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Fri, 7 Feb 2020 14:34:29 +0000
Subject: [PATCH 1673/2409] Drop Fedora 29 support

With fedora-latest now using Fedora 30 images and Fedora 29 itself EOL
we can now remove support for it from devstack. This change also cleans
up references to earlier Fedora releases under files/rpms/.

Change-Id: I24332f7016ebb549ea678acf677c477b55ec4d4b
---
 files/rpms/cinder  |  4 ++--
 files/rpms/dstat   |  4 ++--
 files/rpms/general |  6 +++---
 files/rpms/nova    |  2 +-
 files/rpms/swift   |  2 +-
 lib/nova           | 14 ++------------
 stack.sh           |  2 +-
 7 files changed, 12 insertions(+), 22 deletions(-)

diff --git a/files/rpms/cinder b/files/rpms/cinder
index ef810cf93d..e1e1f6c5c0 100644
--- a/files/rpms/cinder
+++ b/files/rpms/cinder
@@ -1,5 +1,5 @@
 iscsi-initiator-utils
 lvm2
 qemu-img
-scsi-target-utils # not:rhel7,f25,f26,f27,f28,f29,f30 NOPRIME
-targetcli # dist:rhel7,f25,f26,f27,f28,f29,f30 NOPRIME
+scsi-target-utils # not:rhel7,f30 NOPRIME
+targetcli # dist:rhel7,f30 NOPRIME
diff --git a/files/rpms/dstat b/files/rpms/dstat
index ad5196617f..e63af317fd 100644
--- a/files/rpms/dstat
+++ b/files/rpms/dstat
@@ -1,2 +1,2 @@
-dstat # not:f29,f30
-pcp-system-tools # dist:f29,f30
+dstat # not:f30
+pcp-system-tools # dist:f30
diff --git a/files/rpms/general b/files/rpms/general
index 279546fa60..e3d20b3360 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -9,9 +9,9 @@ git-core
 graphviz # needed only for docs
 httpd
 httpd-devel
-iptables-services  # NOPRIME f25,f26,f27,f28,f29,f30
+iptables-services  # NOPRIME f30
 java-1.7.0-openjdk-headless  # NOPRIME rhel7
-java-1.8.0-openjdk-headless  # NOPRIME f25,f26,f27,f28,f29,f30
+java-1.8.0-openjdk-headless  # NOPRIME f30
 libffi-devel
 libjpeg-turbo-devel # Pillow 3.0.0
 libxml2-devel # lxml
@@ -27,7 +27,7 @@ pkgconfig
 postgresql-devel  # psycopg2
 psmisc
 pyOpenSSL # version in pip uses too much memory
-python3-devel # f29,f30
+python3-devel # f30
 python-devel
 redhat-rpm-config # missing dep for gcc hardening flags, see rhbz#1217376
 systemd-devel # for systemd-python
diff --git a/files/rpms/nova b/files/rpms/nova
index 6c3e47870c..c590378677 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -7,7 +7,7 @@ gawk
 genisoimage # required for config_drive
 iptables
 iputils
-kernel-modules # dist:f25,f26,f27,f28,f29,f30
+kernel-modules # dist:f30
 kpartx
 libxml2-python
 m2crypto
diff --git a/files/rpms/swift b/files/rpms/swift
index 8aed8a4033..eb94d14339 100644
--- a/files/rpms/swift
+++ b/files/rpms/swift
@@ -2,7 +2,7 @@ curl
 liberasurecode-devel
 memcached
 pyxattr
-rsync-daemon # dist:f25,f26,f27,f28,f29,f30
+rsync-daemon # dist:f30
 sqlite
 xfsprogs
 xinetd
diff --git a/lib/nova b/lib/nova
index 3f108a4a97..a842a61fd0 100644
--- a/lib/nova
+++ b/lib/nova
@@ -297,18 +297,8 @@ function configure_nova {
             fi
         fi
 
-        if is_fedora && [[ $DISTRO =~ f29 ]]; then
-            # There is an iscsi-initiator bug where it inserts
-            # different whitespace that causes a bunch of output
-            # matching to fail.  We have not been able to get
-            # fixed, yet :/  Exists in fedora 29 & 30 at least
-            #  https://bugzilla.redhat.com/show_bug.cgi?id=1676365
-            sudo dnf copr enable -y iwienand/iscsi-initiator-utils
-            sudo dnf update -y
-        elif is_fedora && [[ $DISTRO =~ f3[0-1] ]]; then
-            # For f30 and f31 use the rebased 2.1.0 version of the package. We
-            # can't use this above as f29 is EOL and as a result we can't
-            # rebuild packages in copr for it.
+        if is_fedora && [[ $DISTRO =~ f3[0-1] ]]; then
+            # For f30 and f31 use the rebased 2.1.0 version of the package.
             sudo dnf copr enable -y lyarwood/iscsi-initiator-utils
             sudo dnf update -y
         fi
diff --git a/stack.sh b/stack.sh
index ce4fc7560a..9879bd43d4 100755
--- a/stack.sh
+++ b/stack.sh
@@ -221,7 +221,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (bionic|stretch|jessie|f29|f30|opensuse-15.0|opensuse-15.1|opensuse-tumbleweed|rhel7) ]]; then
+if [[ ! ${DISTRO} =~ (bionic|stretch|jessie|f30|opensuse-15.0|opensuse-15.1|opensuse-tumbleweed|rhel7) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From 8d4ae4ffc4a351a72a24bdf5fe6f7ac17445985a Mon Sep 17 00:00:00 2001
From: LuyaoZhong <luyao.zhong@intel.com>
Date: Wed, 19 Feb 2020 08:16:03 +0000
Subject: [PATCH 1674/2409] bug-fix: 'bytes' type in python3 cause command fail

'str' type in python2 is 'bytes' type in python3,
when use python3, we will get a prefix 'b':

sudo ip netns exec b'qrouter-39cc2b45-a27c-49c5-94a6-26443a49ac63' ip
neigh
--------------------------------------------------------------------------
*** Failed to run 'sudo ip netns exec
b'qrouter-39cc2b45-a27c-49c5-94a6-26443a49ac63' ip neigh': Command 'sudo
ip netns exec b'qrouter-39cc2b45-a27c-49c5-94a6-26443a49ac63' ip neigh'
returned non-zero exit status 1.

The message above is raised by running tools/worlddump.py with python3.

Change-Id: Ic254af86fa27729839f00c0ad4a5bbbc9e545a09
---
 tools/worlddump.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
 mode change 100644 => 100755 tools/worlddump.py

diff --git a/tools/worlddump.py b/tools/worlddump.py
old mode 100644
new mode 100755
index 1e6e176210..b21ed0c861
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -174,7 +174,7 @@ def network_dump():
         _dump_cmd("ip %s" % cmd)
     for netns_ in _netns_list():
         for cmd in ip_cmds:
-            args = {'netns': netns_, 'cmd': cmd}
+            args = {'netns': bytes.decode(netns_), 'cmd': cmd}
             _dump_cmd('sudo ip netns exec %(netns)s ip %(cmd)s' % args)
 
 
@@ -195,7 +195,7 @@ def ovs_dump():
     _dump_cmd("sudo ovs-vsctl show")
     for ofctl_cmd in ofctl_cmds:
         for bridge in bridges:
-            args = {'vers': vers, 'cmd': ofctl_cmd, 'bridge': bridge}
+            args = {'vers': vers, 'cmd': ofctl_cmd, 'bridge': bytes.decode(bridge)}
             _dump_cmd("sudo ovs-ofctl --protocols=%(vers)s %(cmd)s %(bridge)s" % args)
 
 

From b4375af841c635209e4cd751d63123005745797a Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Mon, 6 Jan 2020 13:57:20 +0000
Subject: [PATCH 1675/2409] zuul: Add a
 devstack-platform-fedora-latest-virt-preview job

Building on I5c3e1b7b632fd73310c462530990cdb0e0c0ceea we can now add a
Fedora job using the virt-preview repo that will be used by Nova's
experimental queue.

Change-Id: Iad9d64912bb07f307e4897ece1621f275f1d5211
---
 .zuul.yaml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index 7a7d56fd4c..65b9b0c75b 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -512,6 +512,16 @@
     nodeset: devstack-single-node-fedora-latest
     voting: false
 
+- job:
+    name: devstack-platform-fedora-latest-virt-preview
+    parent: tempest-full-py3
+    description: Fedora latest platform test using the virt-preview repo.
+    nodeset: devstack-single-node-fedora-latest
+    voting: false
+    vars:
+      devstack_localrc:
+        ENABLE_FEDORA_VIRT_PREVIEW_REPO: true
+
 - job:
     name: devstack-tox-base
     parent: devstack

From 96ddc69a2ef5caea7621d3b94d4fa2b0ef10977b Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Tue, 28 Jan 2020 14:04:02 +0000
Subject: [PATCH 1676/2409] zuul: Add the fedora-latest-virt-preview job to the
 experimental queue

Allowing the job to be tested outside of openstack/nova's own
experimental queue.

Change-Id: Ib07d9522d1cb6e288edb7f78ee1960ab48d89d76
---
 .zuul.yaml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index 65b9b0c75b..62cda04ac0 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -683,6 +683,10 @@
     #    Next cycle we can remove this if everything run out stable enough.
     # * nova-multi-cell: maintained by nova and currently non-voting in the
     #    check queue for nova changes but relies on devstack configuration
+    # * devstack-platform-fedora-latest-virt-preview: Maintained by lyarwood
+    #    for Nova to allow early testing of the latest versions of Libvirt and
+    #    QEMU. Should only graduate out of experimental if it ever moves into
+    #    the check queue for Nova.
 
     experimental:
       jobs:
@@ -719,3 +723,4 @@
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
+        - devstack-platform-fedora-latest-virt-preview

From 1e6b06ede00eca1087520abae8266142573733e3 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Fri, 21 Feb 2020 06:12:07 +0000
Subject: [PATCH 1677/2409] Updated from generate-devstack-plugins-list

Change-Id: I543faced83a685d48706d004ae49800abfb89dc5
---
 doc/source/plugin-registry.rst | 1 -
 1 file changed, 1 deletion(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 652bf0b1cc..1dc91ea33d 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -102,7 +102,6 @@ openstack/panko                          `https://opendev.org/openstack/panko <h
 openstack/patrole                        `https://opendev.org/openstack/patrole <https://opendev.org/openstack/patrole>`__
 openstack/qinling                        `https://opendev.org/openstack/qinling <https://opendev.org/openstack/qinling>`__
 openstack/qinling-dashboard              `https://opendev.org/openstack/qinling-dashboard <https://opendev.org/openstack/qinling-dashboard>`__
-openstack/rally                          `https://opendev.org/openstack/rally <https://opendev.org/openstack/rally>`__
 openstack/rally-openstack                `https://opendev.org/openstack/rally-openstack <https://opendev.org/openstack/rally-openstack>`__
 openstack/sahara                         `https://opendev.org/openstack/sahara <https://opendev.org/openstack/sahara>`__
 openstack/sahara-dashboard               `https://opendev.org/openstack/sahara-dashboard <https://opendev.org/openstack/sahara-dashboard>`__

From 6f91da9a2d0639daad3a6e1bce328c4c730511f9 Mon Sep 17 00:00:00 2001
From: Abhishek Kekane <akekane@redhat.com>
Date: Thu, 17 Oct 2019 09:02:41 +0000
Subject: [PATCH 1678/2409] Glance: Add support to configure multiple file
 stores

From Train release Glance has added support [0][1] to configure multiple stores
of same or different types. This patch enables developers to configure
multiple file stores for glance. In order to configure multiple file stores
user need to set below options in local.conf

GLANCE_ENABLE_MULTIPLE_STORES=True/False
To enable multiple stores of glance.

GLANCE_MULTIPLE_FILE_STORES=veryfast,fast,cheap,verycheap,slow,veryslow
Comma separated list of store identifiers.

GLANCE_DEFAULT_BACKEND=fast
Default glance store in which image should be stored if store identifier not
specified explicilty. Should be one of the store identifier from
GLANCE_MULTIPLE_FILE_STORES config option.

NOTE: This support is added so that we can start adding tempest/CI tests for
glance multiple stores.

[0] 515412b59f5b3af07a1787b9f8e85a4d656d3e1c
[1] https://docs.openstack.org/glance/train/admin/multistores.html

Change-Id: I494f77555cfe9115356ce0ee75c7d7f192141447
---
 lib/glance | 60 ++++++++++++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 58 insertions(+), 2 deletions(-)

diff --git a/lib/glance b/lib/glance
index 740bcabf6a..e8f846fbb9 100644
--- a/lib/glance
+++ b/lib/glance
@@ -41,9 +41,29 @@ else
     GLANCE_BIN_DIR=$(get_python_exec_prefix)
 fi
 
+# Glance multi-store configuration
+# Boolean flag to enable multiple store configuration for glance
+GLANCE_ENABLE_MULTIPLE_STORES=$(trueorfalse False GLANCE_ENABLE_MULTIPLE_STORES)
+
+# Comma separated list for configuring multiple file stores of glance,
+# for example; GLANCE_MULTIPLE_FILE_STORES = fast,cheap,slow
+GLANCE_MULTIPLE_FILE_STORES=${GLANCE_MULTIPLE_FILE_STORES:-fast}
+
+# Default store/backend for glance, must be one of the store specified
+# in GLANCE_MULTIPLE_FILE_STORES option.
+GLANCE_DEFAULT_BACKEND=${GLANCE_DEFAULT_BACKEND:-fast}
+
 GLANCE_CACHE_DIR=${GLANCE_CACHE_DIR:=$DATA_DIR/glance/cache}
+
+# File path for each store specified in GLANCE_MULTIPLE_FILE_STORES, the store
+# identifier will be appended to this path at runtime. If GLANCE_MULTIPLE_FILE_STORES
+# has fast,cheap specified then filepath will be generated like $DATA_DIR/glance/fast
+# and $DATA_DIR/glance/cheap.
+GLANCE_MULTISTORE_FILE_IMAGE_DIR=${GLANCE_MULTISTORE_FILE_IMAGE_DIR:=$DATA_DIR/glance}
 GLANCE_IMAGE_DIR=${GLANCE_IMAGE_DIR:=$DATA_DIR/glance/images}
 GLANCE_LOCK_DIR=${GLANCE_LOCK_DIR:=$DATA_DIR/glance/locks}
+GLANCE_STAGING_DIR=${GLANCE_MULTISTORE_FILE_IMAGE_DIR:=$DATA_DIR/os_glance_staging_store}
+GLANCE_TASKS_DIR=${GLANCE_MULTISTORE_FILE_IMAGE_DIR:=$DATA_DIR/os_glance_tasks_store}
 
 GLANCE_CONF_DIR=${GLANCE_CONF_DIR:-/etc/glance}
 GLANCE_METADEF_DIR=$GLANCE_CONF_DIR/metadefs
@@ -97,6 +117,18 @@ function is_glance_enabled {
 function cleanup_glance {
     # delete image files (glance)
     sudo rm -rf $GLANCE_CACHE_DIR $GLANCE_IMAGE_DIR
+
+    # Cleanup multiple stores directories
+    if [[ "$GLANCE_ENABLE_MULTIPLE_STORES" == "True" ]]; then
+        local store file_dir
+        for store in $(echo $GLANCE_MULTIPLE_FILE_STORES | tr "," "\n"); do
+            file_dir="${GLANCE_MULTISTORE_FILE_IMAGE_DIR}/${store}/"
+            sudo rm -rf $file_dir
+        done
+
+        # Cleanup reserved stores directories
+        sudo rm -rf $GLANCE_STAGING_DIR $GLANCE_TASKS_DIR
+    fi
 }
 
 # configure_glance() - Set config files, create data dirs, etc
@@ -117,6 +149,16 @@ function configure_glance {
     iniset_rpc_backend glance $GLANCE_REGISTRY_CONF
     iniset $GLANCE_REGISTRY_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
 
+    # Configure multiple stores
+    if [[ "$GLANCE_ENABLE_MULTIPLE_STORES" == "True" ]]; then
+        local store enabled_backends
+        enabled_backends=""
+        for store in $(echo $GLANCE_MULTIPLE_FILE_STORES | tr "," "\n"); do
+            enabled_backends+="${store}:file,"
+        done
+        iniset $GLANCE_API_CONF DEFAULT enabled_backends ${enabled_backends::-1}
+    fi
+
     # Set non-default configuration options for the API server
     iniset $GLANCE_API_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
     iniset $GLANCE_API_CONF database connection $dburl
@@ -141,8 +183,21 @@ function configure_glance {
         iniset $GLANCE_API_CONF DEFAULT enable_v1_api False
     fi
 
-    # Store specific configs
-    iniset $GLANCE_API_CONF glance_store filesystem_store_datadir $GLANCE_IMAGE_DIR/
+    # Glance multiple store Store specific configs
+    if [[ "$GLANCE_ENABLE_MULTIPLE_STORES" == "True" ]]; then
+        iniset $GLANCE_API_CONF glance_store default_backend $GLANCE_DEFAULT_BACKEND
+        local store
+        for store in $(echo $GLANCE_MULTIPLE_FILE_STORES | tr "," "\n"); do
+            iniset $GLANCE_API_CONF $store filesystem_store_datadir "${GLANCE_MULTISTORE_FILE_IMAGE_DIR}/${store}/"
+        done
+
+        # Glance configure reserved stores
+        iniset $GLANCE_API_CONF os_glance_staging_store filesystem_store_datadir "${GLANCE_MULTISTORE_FILE_IMAGE_DIR}/os_glance_staging_store/"
+        iniset $GLANCE_API_CONF os_glance_tasks_store filesystem_store_datadir "${GLANCE_MULTISTORE_FILE_IMAGE_DIR}/os_glance_tasks_store/"
+    else
+        # Store specific configs
+        iniset $GLANCE_API_CONF glance_store filesystem_store_datadir $GLANCE_IMAGE_DIR/
+    fi
     iniset $GLANCE_API_CONF DEFAULT registry_host $(ipv6_unquote $GLANCE_SERVICE_HOST)
 
     # CORS feature support - to allow calls from Horizon by default
@@ -152,6 +207,7 @@ function configure_glance {
         iniset $GLANCE_API_CONF cors allowed_origin "http://$SERVICE_HOST"
     fi
 
+    # No multiple stores for swift yet
     # Store the images in swift if enabled.
     if is_service_enabled s-proxy; then
         iniset $GLANCE_API_CONF glance_store default_store swift

From 2b6c2b41a03d1bb5de5df0ad7b84a2bbbbd76430 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Fri, 28 Feb 2020 06:11:43 +0000
Subject: [PATCH 1679/2409] Updated from generate-devstack-plugins-list

Change-Id: I03cd12d5b2de5c2ff4ee92d66a631da34d4255c5
---
 doc/source/plugin-registry.rst | 1 -
 1 file changed, 1 deletion(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 1dc91ea33d..6f79102aef 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -139,7 +139,6 @@ x/bilean                                 `https://opendev.org/x/bilean <https://
 x/broadview-collector                    `https://opendev.org/x/broadview-collector <https://opendev.org/x/broadview-collector>`__
 x/collectd-openstack-plugins             `https://opendev.org/x/collectd-openstack-plugins <https://opendev.org/x/collectd-openstack-plugins>`__
 x/devstack-plugin-additional-pkg-repos   `https://opendev.org/x/devstack-plugin-additional-pkg-repos <https://opendev.org/x/devstack-plugin-additional-pkg-repos>`__
-x/devstack-plugin-bdd                    `https://opendev.org/x/devstack-plugin-bdd <https://opendev.org/x/devstack-plugin-bdd>`__
 x/devstack-plugin-glusterfs              `https://opendev.org/x/devstack-plugin-glusterfs <https://opendev.org/x/devstack-plugin-glusterfs>`__
 x/devstack-plugin-hdfs                   `https://opendev.org/x/devstack-plugin-hdfs <https://opendev.org/x/devstack-plugin-hdfs>`__
 x/devstack-plugin-libvirt-qemu           `https://opendev.org/x/devstack-plugin-libvirt-qemu <https://opendev.org/x/devstack-plugin-libvirt-qemu>`__

From 5837ce504bf546b9e4489c0046cb5b25c656e01c Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Fri, 28 Feb 2020 10:47:42 +0000
Subject: [PATCH 1680/2409] zuul: Remove devstack-plugin-ceph-tempest job

This job is now failing 100% of the time on master since the EOL of py2:

https://zuul.opendev.org/t/openstack/builds?job_name=devstack-plugin-ceph-tempest&branch=master

Change-Id: I0bb03190f39b5ae5494b2d10a0e819013d60bddf
---
 .zuul.yaml | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 62cda04ac0..26b57a20d0 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -695,10 +695,6 @@
         - neutron-fullstack-with-uwsgi
         - neutron-functional-with-uwsgi
         - neutron-tempest-with-uwsgi
-        - devstack-plugin-ceph-tempest:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
         - devstack-plugin-ceph-tempest-py3:
             irrelevant-files:
               - ^.*\.rst$

From 4361ef1eb871c85ef6f05fdd8cd26c25e76c4c8e Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Wed, 11 Dec 2019 17:53:44 +0000
Subject: [PATCH 1681/2409] tempest: Enable stable_rescue tests with Libvirt

Enable the compute feature for stable device rescue on all but LXC and
Xen virt_types.

Depends-On: https://review.opendev.org/#/c/700812/
Depends-On: https://review.opendev.org/#/c/700813/
Change-Id: Icfc717b4932be050a169fc00dae720d29a6497f7
---
 lib/tempest | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/tempest b/lib/tempest
index 525abcb582..6e87e54801 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -570,6 +570,7 @@ function configure_tempest {
             iniset $TEMPEST_CONFIG compute-feature-enabled snapshot False
             iniset $TEMPEST_CONFIG compute-feature-enabled suspend False
         else
+            iniset $TEMPEST_CONFIG compute-feature-enabled stable_rescue True
             iniset $TEMPEST_CONFIG compute-feature-enabled swap_volume True
         fi
     fi

From d0886f1ee9cd342d9d3dac0e3c9ee407dee3e697 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Thu, 5 Mar 2020 06:13:02 +0000
Subject: [PATCH 1682/2409] Updated from generate-devstack-plugins-list

Change-Id: I92025c92bae7a673aae16192cfe892f3bdee269f
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 6f79102aef..0d0a4208dd 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -50,6 +50,7 @@ openstack/heat                           `https://opendev.org/openstack/heat <ht
 openstack/heat-dashboard                 `https://opendev.org/openstack/heat-dashboard <https://opendev.org/openstack/heat-dashboard>`__
 openstack/ironic                         `https://opendev.org/openstack/ironic <https://opendev.org/openstack/ironic>`__
 openstack/ironic-inspector               `https://opendev.org/openstack/ironic-inspector <https://opendev.org/openstack/ironic-inspector>`__
+openstack/ironic-prometheus-exporter     `https://opendev.org/openstack/ironic-prometheus-exporter <https://opendev.org/openstack/ironic-prometheus-exporter>`__
 openstack/ironic-ui                      `https://opendev.org/openstack/ironic-ui <https://opendev.org/openstack/ironic-ui>`__
 openstack/karbor                         `https://opendev.org/openstack/karbor <https://opendev.org/openstack/karbor>`__
 openstack/karbor-dashboard               `https://opendev.org/openstack/karbor-dashboard <https://opendev.org/openstack/karbor-dashboard>`__

From e87428908ad2217e6bf4ac483c234891f535f4ec Mon Sep 17 00:00:00 2001
From: Lucas Alvares Gomes <lucasagomes@gmail.com>
Date: Wed, 11 Dec 2019 15:17:58 +0000
Subject: [PATCH 1683/2409] Add "OVN" debs and rpms package files

The networking-ovn code is being moved into the neutron repository as
part of the effort [0].

This change is needed so we are able to install OVN from packages
when running the networking-ovn functional tests along with
the Neutron ones (see [1]). In the old networking-ovn repository we did
compile OVN from source instead of installing it from packages but
that took time. We want to do better in the Neutron repository.

[0] https://blueprints.launchpad.net/neutron/+spec/neutron-ovn-merge
[1] https://review.opendev.org/#/c/697440/

Change-Id: I92ab727d9954eb729c41b9a67ecb60b56883097b
Signed-off-by: Lucas Alvares Gomes <lucasagomes@gmail.com>
---
 files/debs/ovn | 3 +++
 files/rpms/ovn | 3 +++
 2 files changed, 6 insertions(+)
 create mode 100644 files/debs/ovn
 create mode 100644 files/rpms/ovn

diff --git a/files/debs/ovn b/files/debs/ovn
new file mode 100644
index 0000000000..81eea5e633
--- /dev/null
+++ b/files/debs/ovn
@@ -0,0 +1,3 @@
+ovn-central
+ovn-controller-vtep
+ovn-host
diff --git a/files/rpms/ovn b/files/rpms/ovn
new file mode 100644
index 0000000000..698e57b0de
--- /dev/null
+++ b/files/rpms/ovn
@@ -0,0 +1,3 @@
+ovn-central
+ovn-host
+ovn-vtep

From d22a8bcb1fdcc8d6ddbd59c8ae0223a3eb33c2ed Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Sun, 15 Mar 2020 18:22:45 -0500
Subject: [PATCH 1684/2409] Use py3 version of Tempest Multinode job

tempest-multinode-full is py2 job and not needed to
run on ussuri onwards. Chaning this to its py3
version tempest-multinode-full-py3

Change-Id: Iff271eabcf1a39d6bf6c1fcd55ff2749cab2373f
---
 .zuul.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 26b57a20d0..0efca8c6c8 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -617,7 +617,7 @@
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
-        - tempest-multinode-full:
+        - tempest-multinode-full-py3:
             voting: false
             irrelevant-files:
               - ^.*\.rst$

From 5ae8a3504ce0619eda5fceaa638b01ba123e5e14 Mon Sep 17 00:00:00 2001
From: Mohammed Naser <mnaser@vexxhost.com>
Date: Tue, 17 Mar 2020 20:54:07 -0400
Subject: [PATCH 1685/2409] Drop DEVSTACK_GATE_FEATURE_MATRIX

DEVSTACK_GATE_FEATURE_MATRIX seems to be an old legacy thing that
is no longer being used.  It currently prevents using the jobs in
openstack/devstack without adding openstack/devstack-gate for the
role.

Change-Id: Iab9b4862c01043d2c158398bac4b3b289a0adba0
---
 doc/source/zuul_ci_jobs_migration.rst | 6 ------
 playbooks/pre.yaml                    | 1 -
 2 files changed, 7 deletions(-)

diff --git a/doc/source/zuul_ci_jobs_migration.rst b/doc/source/zuul_ci_jobs_migration.rst
index 17e7e16fb7..c43603ea17 100644
--- a/doc/source/zuul_ci_jobs_migration.rst
+++ b/doc/source/zuul_ci_jobs_migration.rst
@@ -195,12 +195,6 @@ value defined in the parent job, or the default from DevStack, if any.
      - A bridge called br-infra is set up for all jobs that inherit
        from multinode with a dedicated `bridge role
        <https://zuul-ci.org/docs/zuul-jobs/general-roles.html#role-multi-node-bridge>`_.
-   * - DEVSTACK_GATE_FEATURE_MATRIX
-     - devstack-gate
-     - ``test_matrix_features`` variable of the test-matrix role in
-       devstack-gate. This is a temporary solution, feature matrix
-       will go away. In the future services will be defined in jobs
-       only.
    * - DEVSTACK_CINDER_VOLUME_CLEAR
      - devstack
      - *CINDER_VOLUME_CLEAR: true/false* in devstack_localrc in the
diff --git a/playbooks/pre.yaml b/playbooks/pre.yaml
index 60f365aa7a..ff97a1f501 100644
--- a/playbooks/pre.yaml
+++ b/playbooks/pre.yaml
@@ -26,7 +26,6 @@
       set_fact:
         external_bridge_mtu: "{{ local_mtu | int - 50 }}"
   roles:
-    - test-matrix
     - configure-swap
     - setup-stack-user
     - setup-tempest-user

From 90f0baf3cb84118e51bc5990ba6885f07b679090 Mon Sep 17 00:00:00 2001
From: ushen <yshxxsjt715@gmail.com>
Date: Wed, 18 Mar 2020 20:08:16 +0800
Subject: [PATCH 1686/2409] Bring back load balance v2 guide

Previous commit forgets to add an entry for load
balancer version 2. This ps brings them back.

Change-Id: Idac09e8259d58ed130b79b40528f733708000da7
---
 doc/source/guides.rst | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/doc/source/guides.rst b/doc/source/guides.rst
index ca134c4520..e7ec629962 100644
--- a/doc/source/guides.rst
+++ b/doc/source/guides.rst
@@ -69,6 +69,11 @@ Nova and devstack
 
 Guide to working with nova features :doc:`Nova and devstack <guides/nova>`.
 
+Configure Load-Balancer Version 2
+-----------------------------------
+
+Guide on :doc:`Configure Load-Balancer Version 2 <guides/devstack-with-lbaas-v2>`.
+
 Deploying DevStack with LDAP
 ----------------------------
 

From 7db34f6caeec6293a87661202484fcff6dc04325 Mon Sep 17 00:00:00 2001
From: Mohammed Naser <mnaser@vexxhost.com>
Date: Wed, 18 Mar 2020 15:35:27 -0400
Subject: [PATCH 1687/2409] Use MEMCACHE_SERVERS in
 configure_keystone_authtoken_middleware

The function was using a hard coded value of localhost:11211 when
we have an option MEMCACHE_SERVERS that can be defined and used
inside DevStack.

Change-Id: I4947928fe406a9844d5bdaa3c826d273952fa097
---
 lib/keystone | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/keystone b/lib/keystone
index 9ceb829264..366e6c7054 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -421,7 +421,7 @@ function configure_keystone_authtoken_middleware {
     iniset $conf_file $section project_domain_name "$SERVICE_DOMAIN_NAME"
 
     iniset $conf_file $section cafile $SSL_BUNDLE_FILE
-    iniset $conf_file $section memcached_servers localhost:11211
+    iniset $conf_file $section memcached_servers $MEMCACHE_SERVERS
 }
 
 # configure_auth_token_middleware conf_file admin_user IGNORED [section]

From 4af912d88953f406f4c3275de8c6ad370aade8ab Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Fri, 20 Mar 2020 08:33:13 +0000
Subject: [PATCH 1688/2409] Updated from generate-devstack-plugins-list

Change-Id: I86601bc3bf114583ccad7a301af4e5b71e3ba2bf
---
 doc/source/plugin-registry.rst | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 0d0a4208dd..0c29bb2a91 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -38,6 +38,7 @@ openstack/devstack-plugin-amqp1          `https://opendev.org/openstack/devstack
 openstack/devstack-plugin-ceph           `https://opendev.org/openstack/devstack-plugin-ceph <https://opendev.org/openstack/devstack-plugin-ceph>`__
 openstack/devstack-plugin-container      `https://opendev.org/openstack/devstack-plugin-container <https://opendev.org/openstack/devstack-plugin-container>`__
 openstack/devstack-plugin-kafka          `https://opendev.org/openstack/devstack-plugin-kafka <https://opendev.org/openstack/devstack-plugin-kafka>`__
+openstack/devstack-plugin-open-cas       `https://opendev.org/openstack/devstack-plugin-open-cas <https://opendev.org/openstack/devstack-plugin-open-cas>`__
 openstack/devstack-plugin-pika           `https://opendev.org/openstack/devstack-plugin-pika <https://opendev.org/openstack/devstack-plugin-pika>`__
 openstack/devstack-plugin-zmq            `https://opendev.org/openstack/devstack-plugin-zmq <https://opendev.org/openstack/devstack-plugin-zmq>`__
 openstack/dragonflow                     `https://opendev.org/openstack/dragonflow <https://opendev.org/openstack/dragonflow>`__
@@ -99,6 +100,7 @@ openstack/openstacksdk                   `https://opendev.org/openstack/openstac
 openstack/os-loganalyze                  `https://opendev.org/openstack/os-loganalyze <https://opendev.org/openstack/os-loganalyze>`__
 openstack/osprofiler                     `https://opendev.org/openstack/osprofiler <https://opendev.org/openstack/osprofiler>`__
 openstack/oswin-tempest-plugin           `https://opendev.org/openstack/oswin-tempest-plugin <https://opendev.org/openstack/oswin-tempest-plugin>`__
+openstack/ovn-octavia-provider           `https://opendev.org/openstack/ovn-octavia-provider <https://opendev.org/openstack/ovn-octavia-provider>`__
 openstack/panko                          `https://opendev.org/openstack/panko <https://opendev.org/openstack/panko>`__
 openstack/patrole                        `https://opendev.org/openstack/patrole <https://opendev.org/openstack/patrole>`__
 openstack/qinling                        `https://opendev.org/openstack/qinling <https://opendev.org/openstack/qinling>`__

From 37659927923473c13f4bec88855205d0ee28bcfb Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Sat, 21 Mar 2020 06:15:49 +0000
Subject: [PATCH 1689/2409] Updated from generate-devstack-plugins-list

Change-Id: Ide7724ed3b4b5bb709b7dd79a367a5d2420bcda2
---
 doc/source/plugin-registry.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 0c29bb2a91..e92929a809 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -38,6 +38,7 @@ openstack/devstack-plugin-amqp1          `https://opendev.org/openstack/devstack
 openstack/devstack-plugin-ceph           `https://opendev.org/openstack/devstack-plugin-ceph <https://opendev.org/openstack/devstack-plugin-ceph>`__
 openstack/devstack-plugin-container      `https://opendev.org/openstack/devstack-plugin-container <https://opendev.org/openstack/devstack-plugin-container>`__
 openstack/devstack-plugin-kafka          `https://opendev.org/openstack/devstack-plugin-kafka <https://opendev.org/openstack/devstack-plugin-kafka>`__
+openstack/devstack-plugin-nfs            `https://opendev.org/openstack/devstack-plugin-nfs <https://opendev.org/openstack/devstack-plugin-nfs>`__
 openstack/devstack-plugin-open-cas       `https://opendev.org/openstack/devstack-plugin-open-cas <https://opendev.org/openstack/devstack-plugin-open-cas>`__
 openstack/devstack-plugin-pika           `https://opendev.org/openstack/devstack-plugin-pika <https://opendev.org/openstack/devstack-plugin-pika>`__
 openstack/devstack-plugin-zmq            `https://opendev.org/openstack/devstack-plugin-zmq <https://opendev.org/openstack/devstack-plugin-zmq>`__
@@ -146,7 +147,6 @@ x/devstack-plugin-glusterfs              `https://opendev.org/x/devstack-plugin-
 x/devstack-plugin-hdfs                   `https://opendev.org/x/devstack-plugin-hdfs <https://opendev.org/x/devstack-plugin-hdfs>`__
 x/devstack-plugin-libvirt-qemu           `https://opendev.org/x/devstack-plugin-libvirt-qemu <https://opendev.org/x/devstack-plugin-libvirt-qemu>`__
 x/devstack-plugin-mariadb                `https://opendev.org/x/devstack-plugin-mariadb <https://opendev.org/x/devstack-plugin-mariadb>`__
-x/devstack-plugin-nfs                    `https://opendev.org/x/devstack-plugin-nfs <https://opendev.org/x/devstack-plugin-nfs>`__
 x/devstack-plugin-vmax                   `https://opendev.org/x/devstack-plugin-vmax <https://opendev.org/x/devstack-plugin-vmax>`__
 x/drbd-devstack                          `https://opendev.org/x/drbd-devstack <https://opendev.org/x/drbd-devstack>`__
 x/fenix                                  `https://opendev.org/x/fenix <https://opendev.org/x/fenix>`__

From c26dfb0d6f165a567925390ac9c6f6ac32742fee Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Wed, 25 Mar 2020 08:32:26 -0500
Subject: [PATCH 1690/2409] Run pip check at end of devstack

The new pip depsolver is coming this summer. Until it's ready,
run pip check at the end of devstack to make sure we're not
somehow installing conflicting package versions. We shouldn't
be, because of constraints, but if we are, better to know and
start figuring it out.

Change-Id: Id98f0848ff5a252d93e5f8029df2d069924d603f
---
 inc/python | 24 ++++++++++++++++++++++++
 stack.sh   |  3 +++
 2 files changed, 27 insertions(+)

diff --git a/inc/python b/inc/python
index 52ad56520a..20f3c6040c 100644
--- a/inc/python
+++ b/inc/python
@@ -111,6 +111,30 @@ function disable_python3_package {
     $xtrace
 }
 
+
+function pip_check {
+    time_start "pip_check"
+
+    if [[ -n ${PIP_VIRTUAL_ENV:=} && -d ${PIP_VIRTUAL_ENV} ]]; then
+        local cmd_pip=$PIP_VIRTUAL_ENV/bin/pip
+    else
+        local cmd_pip
+        if python3_enabled; then
+            echo "Using python $PYTHON3_VERSION to check pip install because python3_enabled=True"
+            cmd_pip=$(get_pip_command $PYTHON3_VERSION)
+        else
+            echo "Using python $PYTHON2_VERSION to check pip install because python3_enabled=False"
+            cmd_pip=$(get_pip_command $PYTHON2_VERSION)
+        fi
+    fi
+
+    $cmd_pip check
+    result=$?
+
+    time_stop "pip_check"
+    return $result
+}
+
 # Wrapper for ``pip install`` to set cache and proxy environment variables
 # Uses globals ``OFFLINE``, ``PIP_VIRTUAL_ENV``,
 # ``PIP_UPGRADE``, ``*_proxy``,
diff --git a/stack.sh b/stack.sh
index 9879bd43d4..352112a4af 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1421,6 +1421,9 @@ fi
 # Check the status of running services
 service_check
 
+# Run pip check to make sure we're forward compatible with the pip depsolver.
+pip_check
+
 # Configure nova cellsv2
 # ----------------------
 

From c2830fb26759678b1bfe90a77aa5c149599d6705 Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Fri, 27 Mar 2020 11:08:27 -0500
Subject: [PATCH 1691/2409] Revert "Run pip check at end of devstack"

This reverts commit 79b8e79488a6268f37244188ab831e99a99648c8.

This is breaking things in various jobs, most notably because
we do not put constraints on linters - but we install
test-requirements which then can conflict with each other.

Change-Id: Ibc5603c61b38ce44db58fb27a27352f59123ad09
---
 inc/python | 24 ------------------------
 stack.sh   |  3 ---
 2 files changed, 27 deletions(-)

diff --git a/inc/python b/inc/python
index 20f3c6040c..52ad56520a 100644
--- a/inc/python
+++ b/inc/python
@@ -111,30 +111,6 @@ function disable_python3_package {
     $xtrace
 }
 
-
-function pip_check {
-    time_start "pip_check"
-
-    if [[ -n ${PIP_VIRTUAL_ENV:=} && -d ${PIP_VIRTUAL_ENV} ]]; then
-        local cmd_pip=$PIP_VIRTUAL_ENV/bin/pip
-    else
-        local cmd_pip
-        if python3_enabled; then
-            echo "Using python $PYTHON3_VERSION to check pip install because python3_enabled=True"
-            cmd_pip=$(get_pip_command $PYTHON3_VERSION)
-        else
-            echo "Using python $PYTHON2_VERSION to check pip install because python3_enabled=False"
-            cmd_pip=$(get_pip_command $PYTHON2_VERSION)
-        fi
-    fi
-
-    $cmd_pip check
-    result=$?
-
-    time_stop "pip_check"
-    return $result
-}
-
 # Wrapper for ``pip install`` to set cache and proxy environment variables
 # Uses globals ``OFFLINE``, ``PIP_VIRTUAL_ENV``,
 # ``PIP_UPGRADE``, ``*_proxy``,
diff --git a/stack.sh b/stack.sh
index 352112a4af..9879bd43d4 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1421,9 +1421,6 @@ fi
 # Check the status of running services
 service_check
 
-# Run pip check to make sure we're forward compatible with the pip depsolver.
-pip_check
-
 # Configure nova cellsv2
 # ----------------------
 

From 09b5b05c471985ad53c4b321e993101f007ee915 Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Fri, 27 Mar 2020 11:22:39 -0500
Subject: [PATCH 1692/2409] Stop installing test-requirements with projects

This is a test of installing openstack and then seeing if it works.
OpenStack components do not need test-requirements to operate,
that's why they are test-requirements.

Additionally, as we look forward to depsolver pip, this is going
to screw us because we don't apply constraints to linters, which
are expressed in - you guessed it, test-requirements.

Change-Id: I8f24b839bf42e2fb9803dc7df3a30ae20cf264eb
---
 inc/python | 9 +--------
 1 file changed, 1 insertion(+), 8 deletions(-)

diff --git a/inc/python b/inc/python
index 52ad56520a..30b9a30eca 100644
--- a/inc/python
+++ b/inc/python
@@ -179,13 +179,6 @@ function pip_install {
 
     $xtrace
 
-    # Also install test requirements
-    local install_test_reqs=""
-    local test_req="${package_dir}/test-requirements.txt"
-    if [[ -e "$test_req" ]]; then
-        install_test_reqs="-r $test_req"
-    fi
-
     # adding SETUPTOOLS_SYS_PATH_TECHNIQUE is a workaround to keep
     # the same behaviour of setuptools before version 25.0.0.
     # related issue: https://github.com/pypa/pip/issues/3874
@@ -195,7 +188,7 @@ function pip_install {
         no_proxy="${no_proxy:-}" \
         PIP_FIND_LINKS=$PIP_FIND_LINKS \
         SETUPTOOLS_SYS_PATH_TECHNIQUE=rewrite \
-        $cmd_pip $upgrade $install_test_reqs \
+        $cmd_pip $upgrade \
         $@
     result=$?
 

From aa71ebf92c7bb7144ae64551ad649054f4797a0b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rados=C5=82aw=20Piliszek?= <radoslaw.piliszek@gmail.com>
Date: Mon, 30 Mar 2020 12:06:30 +0200
Subject: [PATCH 1693/2409] Test also swift-dsvm-functional-py3

Swift keeps testing py2 but we should keep both in shape.

To fix stestr on py2:
Depends-on: https://review.opendev.org/715942

Change-Id: I616e39c64e22d467d7186dba98226cc5beef23ea
---
 .zuul.yaml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 0efca8c6c8..cc97b89980 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -602,9 +602,12 @@
             voting: false
         - swift-dsvm-functional:
             voting: false
-            irrelevant-files:
+            irrelevant-files: &dsvm-irrelevant-files
               - ^.*\.rst$
               - ^doc/.*$
+        - swift-dsvm-functional-py3:
+            voting: false
+            irrelevant-files: *dsvm-irrelevant-files
         - grenade-py3:
             irrelevant-files:
               - ^.*\.rst$

From be26306b4ab470e65cc93305453d2945aa33bf78 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rados=C5=82aw=20Piliszek?= <radoslaw.piliszek@gmail.com>
Date: Mon, 30 Mar 2020 09:56:53 +0200
Subject: [PATCH 1694/2409] Support extras in Glance Store install

Recent change to devstack dropped installing test-requirements [1]
However, this caused gate failures due to lack of glance-store
deps for cinder and swift support.

This patch makes devstack install relevant extras depending on
enabled features.

Additionally, relevant functions are added/fixed to make this
possible.

glance-store = glance_store (for gerrit search match)

[1] https://review.opendev.org/715469

Change-Id: I0bf5792a6058b52936115b515ea8360f6264a7c9
---
 inc/python | 32 +++++++++++++++++++++++++++-----
 lib/glance | 15 ++++++++++++++-
 2 files changed, 41 insertions(+), 6 deletions(-)

diff --git a/inc/python b/inc/python
index 30b9a30eca..dd77296049 100644
--- a/inc/python
+++ b/inc/python
@@ -21,6 +21,14 @@ set +o xtrace
 # project.  A null value installs to the system Python directories.
 declare -A -g PROJECT_VENV
 
+# Utility Functions
+# =================
+
+# Joins bash array of extras with commas as expected by other functions
+function join_extras {
+    local IFS=","
+    echo "$*"
+}
 
 # Python Functions
 # ================
@@ -80,9 +88,9 @@ function pip_install_gr {
 function pip_install_gr_extras {
     local name=$1
     local extras=$2
-    local clean_name
-    clean_name=$(get_from_global_requirements $name)
-    pip_install $clean_name[$extras]
+    local version_constraints
+    version_constraints=$(get_version_constraints_from_global_requirements $name)
+    pip_install $name[$extras]$version_constraints
 }
 
 # enable_python3_package() -- no-op for backwards compatibility
@@ -230,6 +238,19 @@ function get_from_global_requirements {
     echo $required_pkg
 }
 
+# get only version constraints of a package from global requirements file
+# get_version_constraints_from_global_requirements <package>
+function get_version_constraints_from_global_requirements {
+    local package=$1
+    local required_pkg_version_constraint
+    # drop the package name from output (\K)
+    required_pkg_version_constraint=$(grep -i -h -o -P "^${package}\K.*" $REQUIREMENTS_DIR/global-requirements.txt | cut -d\# -f1)
+    if [[ $required_pkg_version_constraint == ""  ]]; then
+        die $LINENO "Can't find package $package in requirements"
+    fi
+    echo $required_pkg_version_constraint
+}
+
 # should we use this library from their git repo, or should we let it
 # get pulled in via pip dependencies.
 function use_library_from_git {
@@ -278,7 +299,7 @@ function setup_lib {
 #
 # use this for non namespaced libraries
 #
-# setup_dev_lib [-bindep] <name>
+# setup_dev_lib [-bindep] <name> [<extras>]
 function setup_dev_lib {
     local bindep
     if [[ $1 == -bindep* ]]; then
@@ -287,7 +308,8 @@ function setup_dev_lib {
     fi
     local name=$1
     local dir=${GITDIR[$name]}
-    setup_develop $bindep $dir
+    local extras=$2
+    setup_develop $bindep $dir $extras
 }
 
 # this should be used if you want to install globally, all libraries should
diff --git a/lib/glance b/lib/glance
index e8f846fbb9..9398bd2daf 100644
--- a/lib/glance
+++ b/lib/glance
@@ -355,11 +355,24 @@ function install_glanceclient {
 
 # install_glance() - Collect source and prepare
 function install_glance {
+    local glance_store_extras=()
+
+    if is_service_enabled cinder; then
+        glance_store_extras=("cinder" "${glance_store_extras[@]}")
+    fi
+
+    if is_service_enabled swift; then
+        glance_store_extras=("swift" "${glance_store_extras[@]}")
+    fi
+
     # Install glance_store from git so we make sure we're testing
     # the latest code.
     if use_library_from_git "glance_store"; then
         git_clone_by_name "glance_store"
-        setup_dev_lib "glance_store"
+        setup_dev_lib "glance_store" $(join_extras "${glance_store_extras[@]}")
+    else
+        # we still need to pass extras
+        pip_install_gr_extras glance-store $(join_extras "${glance_store_extras[@]}")
     fi
 
     git_clone $GLANCE_REPO $GLANCE_DIR $GLANCE_BRANCH

From 1587ba1bd59fe0115c273ee2382bf627fce937a3 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Thu, 12 Mar 2020 15:13:37 +1100
Subject: [PATCH 1695/2409] Remove fixup_virtualenv

This first came in with Id749c37ab7fefa96b35f11816b56b9def5ef4b08.  It
talks about ancient versions of pip; can't see we need it any more.

Change-Id: I9d4831955070990a81a809d988612d9d5b1aa672
---
 tools/fixup_stuff.sh | 30 ------------------------------
 1 file changed, 30 deletions(-)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index 15b3ab767d..6c7123374b 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -202,39 +202,9 @@ function fixup_suse {
     sudo rm -rf /usr/lib/python3.6/site-packages/six-*.egg-info
 }
 
-# The version of pip(1.5.4) supported by python-virtualenv(1.11.4) has
-# connection issues under proxy so re-install the latest version using
-# pip. To avoid having pip's virtualenv overwritten by the distro's
-# package (e.g. due to installing a distro package with a dependency
-# on python-virtualenv), first install the distro python-virtualenv
-# to satisfy any dependencies then use pip to overwrite it.
-
-# ... but, for infra builds, the pip-and-virtualenv [1] element has
-# already done this to ensure the latest pip, virtualenv and
-# setuptools on the base image for all platforms.  It has also added
-# the packages to the yum/dnf ignore list to prevent them being
-# overwritten with old versions.  F26 and dnf 2.0 has changed
-# behaviour that means re-installing python-virtualenv fails [2].
-# Thus we do a quick check if we're in the infra environment by
-# looking for the mirror config script before doing this, and just
-# skip it if so.
-
-# [1] https://opendev.org/openstack/diskimage-builder/src/branch/master/ \
-#        diskimage_builder/elements/pip-and-virtualenv/ \
-#            install.d/pip-and-virtualenv-source-install/04-install-pip
-# [2] https://bugzilla.redhat.com/show_bug.cgi?id=1477823
-
-function fixup_virtualenv {
-    if [[ ! -f /etc/ci/mirror_info.sh ]]; then
-        install_package python-virtualenv
-        pip_install -U --force-reinstall virtualenv
-    fi
-}
-
 function fixup_all {
     fixup_keystone
     fixup_ubuntu
     fixup_fedora
     fixup_suse
-    fixup_virtualenv
 }

From 7a2c1c2b1b4eead11168a9e635be3e0d883a7c5f Mon Sep 17 00:00:00 2001
From: Witek Bedyk <witold.bedyk@suse.com>
Date: Tue, 31 Mar 2020 16:43:38 +0200
Subject: [PATCH 1696/2409] Add python3-dev package for Debian based distros

When stacking outside of Zuul CI the wheels have to be built locally and
python3-dev package is required.

Story: 2007491
Task: 39213

Change-Id: I0960269d5cf193c9ececc5490485522c74646382
---
 files/debs/general | 1 +
 1 file changed, 1 insertion(+)

diff --git a/files/debs/general b/files/debs/general
index 9f9d57cefb..ac297435db 100644
--- a/files/debs/general
+++ b/files/debs/general
@@ -27,6 +27,7 @@ openssh-server
 openssl
 pkg-config
 psmisc
+python3-dev
 tar
 tcpdump
 unzip

From 497caf015729d451428d5b608853741689f153b3 Mon Sep 17 00:00:00 2001
From: Colleen Murphy <colleen.murphy@suse.com>
Date: Fri, 3 Apr 2020 10:14:07 -0700
Subject: [PATCH 1697/2409] Fix opensuse trusted certificates

There's a bug[1] with the combination of the p11-kit and
ca-certificates-mozilla packages available on the latest built
opensuse-15 node in nodepool (which has not been rebuilt for weeks due
to a separate issue[2]) which causes the standard CA bundle to not be
installed correctly and causes jobs that call to external HTTPS services
to fail. Upgrading both packages in sync fixes the issue.

[1] https://bugzilla.suse.com/show_bug.cgi?id=1154871
[2] http://bugzilla.suse.com/show_bug.cgi?id=1166139

Change-Id: Ia8fdfe12fd9089e178adcb2b5eec997eebada262
Needed-by: https://review.opendev.org/713566
---
 tools/fixup_stuff.sh | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index 15b3ab767d..5d3f610173 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -200,6 +200,11 @@ function fixup_suse {
     # have been dragged in by some other system dependency
     sudo rm -rf /usr/lib/python3.6/site-packages/ply-*.egg-info
     sudo rm -rf /usr/lib/python3.6/site-packages/six-*.egg-info
+
+    # Ensure trusted CA certificates are up to date
+    # See https://bugzilla.suse.com/show_bug.cgi?id=1154871
+    # May be removed once a new opensuse-15 image is available in nodepool
+    sudo zypper up -y p11-kit ca-certificates-mozilla
 }
 
 # The version of pip(1.5.4) supported by python-virtualenv(1.11.4) has

From e16e925e120100156a08a0436040f42b901b361a Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Thu, 9 Apr 2020 11:00:28 +0100
Subject: [PATCH 1698/2409] Fedora: Do not start the lvmetad service after
 Fedora 30

This deprecated service has been removed from lvm2 in Fedora 31:

https://src.fedoraproject.org/rpms/lvm2/c/0469456b352530d9f507f2515e674bfb03671f48

Change-Id: I06d572a72969c5e5e8e038caef19e358e4f97b2b
---
 lib/lvm | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/lib/lvm b/lib/lvm
index d9e78a016f..92265f2af2 100644
--- a/lib/lvm
+++ b/lib/lvm
@@ -124,13 +124,15 @@ function init_lvm_volume_group {
     local vg=$1
     local size=$2
 
-    # Start the lvmetad and tgtd services
-    if is_fedora || is_suse; then
+    # Start the lvmetad on f30 (dropped from f31) or SUSE
+    if [[ $DISTRO =~ f30 ]] || is_suse; then
         # services is not started by default
         start_service lvm2-lvmetad
-        if [ "$CINDER_ISCSI_HELPER" = "tgtadm" ]; then
-            start_service tgtd
-        fi
+    fi
+
+    # Start the tgtd service on Fedora and SUSE if tgtadm is used
+    if  is_fedora || is_suse  && [[ "$CINDER_ISCSI_HELPER" = "tgtadm" ]]; then
+        start_service tgtd
     fi
 
     # Start with a clean volume group

From e6852eadb192365093e8ef738cff87fe60e8434a Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Thu, 12 Mar 2020 15:18:11 +1100
Subject: [PATCH 1699/2409] Use venv for VIRTUALENV_CMD

Using venv, which is part of python3, we avoid an extra dependency on
the virtualenv package.  For Debuntu, which splits this out into a
separate package, add this to debs/general.

This is part of the infra efforts to ship "plain" nodes without any
dependencies installed.  While devstack can re-install virtualenv, we
don't need any features it provides and it means one less dependency.

Change-Id: I3c323640f288e57581a4eb8adba2a08d0b0cbd8f
---
 files/debs/general | 1 +
 stackrc            | 3 ++-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/files/debs/general b/files/debs/general
index ac297435db..fe0061337a 100644
--- a/files/debs/general
+++ b/files/debs/general
@@ -28,6 +28,7 @@ openssl
 pkg-config
 psmisc
 python3-dev
+python3-venv
 tar
 tcpdump
 unzip
diff --git a/stackrc b/stackrc
index 4e33b6838f..17641c343d 100644
--- a/stackrc
+++ b/stackrc
@@ -150,7 +150,8 @@ export PYTHON2_VERSION=${PYTHON2_VERSION:-${_DEFAULT_PYTHON2_VERSION:-2.7}}
 
 # Create a virtualenv with this
 if [[ ${USE_PYTHON3} == True ]]; then
-    export VIRTUALENV_CMD="virtualenv -p python3"
+    # Use the built-in venv to avoid more dependencies
+    export VIRTUALENV_CMD="python3 -m venv"
 else
     export VIRTUALENV_CMD="virtualenv "
 fi

From e0da11cec5324cc4c100f6e22b83f1addde06ce7 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Tue, 14 Apr 2020 06:10:51 +0000
Subject: [PATCH 1700/2409] Updated from generate-devstack-plugins-list

Change-Id: I0c3950729380646e1a98a90ee82e8562cc8c33c1
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index e92929a809..70c18a88b1 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -97,6 +97,7 @@ openstack/neutron-vpnaas-dashboard       `https://opendev.org/openstack/neutron-
 openstack/nova-powervm                   `https://opendev.org/openstack/nova-powervm <https://opendev.org/openstack/nova-powervm>`__
 openstack/octavia                        `https://opendev.org/openstack/octavia <https://opendev.org/openstack/octavia>`__
 openstack/octavia-dashboard              `https://opendev.org/openstack/octavia-dashboard <https://opendev.org/openstack/octavia-dashboard>`__
+openstack/octavia-tempest-plugin         `https://opendev.org/openstack/octavia-tempest-plugin <https://opendev.org/openstack/octavia-tempest-plugin>`__
 openstack/openstacksdk                   `https://opendev.org/openstack/openstacksdk <https://opendev.org/openstack/openstacksdk>`__
 openstack/os-loganalyze                  `https://opendev.org/openstack/os-loganalyze <https://opendev.org/openstack/os-loganalyze>`__
 openstack/osprofiler                     `https://opendev.org/openstack/osprofiler <https://opendev.org/openstack/osprofiler>`__

From f9e81d34382083732b02b0cda87331e20e04d48d Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Sun, 12 Apr 2020 11:29:59 +0100
Subject: [PATCH 1701/2409] Fedora: Update required RPMs for Fedora 31

This includes the addition of the python3-virtualenv package required to
provide the virtualenv binary that is no longer present in the image.

Change-Id: Ie8e66d8b9f93063b97f88f41a626daddf235339b
---
 files/rpms/cinder  | 4 ++--
 files/rpms/dstat   | 4 ++--
 files/rpms/general | 7 ++++---
 files/rpms/nova    | 2 +-
 files/rpms/swift   | 2 +-
 5 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/files/rpms/cinder b/files/rpms/cinder
index e1e1f6c5c0..a8201ea38b 100644
--- a/files/rpms/cinder
+++ b/files/rpms/cinder
@@ -1,5 +1,5 @@
 iscsi-initiator-utils
 lvm2
 qemu-img
-scsi-target-utils # not:rhel7,f30 NOPRIME
-targetcli # dist:rhel7,f30 NOPRIME
+scsi-target-utils # not:rhel7,f30,f31 NOPRIME
+targetcli # dist:rhel7,f30,f31 NOPRIME
diff --git a/files/rpms/dstat b/files/rpms/dstat
index e63af317fd..a091cceb3a 100644
--- a/files/rpms/dstat
+++ b/files/rpms/dstat
@@ -1,2 +1,2 @@
-dstat # not:f30
-pcp-system-tools # dist:f30
+dstat # not:f30,f31
+pcp-system-tools # dist:f30,f31
diff --git a/files/rpms/general b/files/rpms/general
index e3d20b3360..361416a910 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -9,9 +9,9 @@ git-core
 graphviz # needed only for docs
 httpd
 httpd-devel
-iptables-services  # NOPRIME f30
+iptables-services  # NOPRIME f30,f31
 java-1.7.0-openjdk-headless  # NOPRIME rhel7
-java-1.8.0-openjdk-headless  # NOPRIME f30
+java-1.8.0-openjdk-headless  # NOPRIME f30,f31
 libffi-devel
 libjpeg-turbo-devel # Pillow 3.0.0
 libxml2-devel # lxml
@@ -27,7 +27,8 @@ pkgconfig
 postgresql-devel  # psycopg2
 psmisc
 pyOpenSSL # version in pip uses too much memory
-python3-devel # f30
+python3-devel # dist:f30,f31
+python3-virtualenv # dist:f31
 python-devel
 redhat-rpm-config # missing dep for gcc hardening flags, see rhbz#1217376
 systemd-devel # for systemd-python
diff --git a/files/rpms/nova b/files/rpms/nova
index c590378677..0f3d10f53a 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -7,7 +7,7 @@ gawk
 genisoimage # required for config_drive
 iptables
 iputils
-kernel-modules # dist:f30
+kernel-modules # dist:f30,f31
 kpartx
 libxml2-python
 m2crypto
diff --git a/files/rpms/swift b/files/rpms/swift
index eb94d14339..745cc2e09a 100644
--- a/files/rpms/swift
+++ b/files/rpms/swift
@@ -2,7 +2,7 @@ curl
 liberasurecode-devel
 memcached
 pyxattr
-rsync-daemon # dist:f30
+rsync-daemon # dist:f30,f31
 sqlite
 xfsprogs
 xinetd

From c36e51b0ae541a983eb917a8746d07d10c723e40 Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Thu, 9 Apr 2020 11:17:03 +0100
Subject: [PATCH 1702/2409] Fedora: Mark Fedora 31 as supported and use within
 fedora-latest

Change-Id: I06235eb5bf722e6f3ab05da577fa0f00638c87b1
---
 .zuul.yaml | 2 +-
 stack.sh   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index cc97b89980..48c2d0d798 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -52,7 +52,7 @@
     name: devstack-single-node-fedora-latest
     nodes:
       - name: controller
-        label: fedora-30
+        label: fedora-31
     groups:
       - name: tempest
         nodes:
diff --git a/stack.sh b/stack.sh
index 9879bd43d4..4e1134b7e3 100755
--- a/stack.sh
+++ b/stack.sh
@@ -221,7 +221,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (bionic|stretch|jessie|f30|opensuse-15.0|opensuse-15.1|opensuse-tumbleweed|rhel7) ]]; then
+if [[ ! ${DISTRO} =~ (bionic|stretch|jessie|f30|f31|opensuse-15.0|opensuse-15.1|opensuse-tumbleweed|rhel7) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From c287e7ec3c22a9b4c2d89c1e36a6383b351f9b17 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Wed, 11 Dec 2019 16:55:41 +1100
Subject: [PATCH 1703/2409] Remove CentOS 7 as supported environment

We do not support CentOS 7 on master branch due to no Python 3 or
ongoing eco-system (i.e. RDO) support; see
Id9ef507dd6f4226d65c6ed3043666b0aa6a3bd1c.

Change-Id: If98581708568e7a8d15e6edc588a008df0cac0fb
---
 stack.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index 4e1134b7e3..0f1ddb1b3f 100755
--- a/stack.sh
+++ b/stack.sh
@@ -221,7 +221,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (bionic|stretch|jessie|f30|f31|opensuse-15.0|opensuse-15.1|opensuse-tumbleweed|rhel7) ]]; then
+if [[ ! ${DISTRO} =~ (bionic|stretch|jessie|f30|f31|opensuse-15.0|opensuse-15.1|opensuse-tumbleweed) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From 9b8b7021d0a8c7647b47e74a2cd4163a663acd40 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Thu, 16 Apr 2020 13:03:56 +1000
Subject: [PATCH 1704/2409] Fedora: install python3-libguestfs

All platforms are python3 now

Change-Id: Ie9f4c7e52f23a45bb8cf70a5fddf1b21a40d7000
---
 lib/nova_plugins/hypervisor-libvirt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova_plugins/hypervisor-libvirt b/lib/nova_plugins/hypervisor-libvirt
index d1b3d784b7..b0ae29e39b 100644
--- a/lib/nova_plugins/hypervisor-libvirt
+++ b/lib/nova_plugins/hypervisor-libvirt
@@ -117,7 +117,7 @@ function install_nova_hypervisor {
             # Workaround for missing dependencies in python-libguestfs
             install_package python-libguestfs guestfs-data augeas augeas-lenses
         elif is_fedora; then
-            install_package python-libguestfs
+            install_package python3-libguestfs
         fi
     fi
 }

From ad1635147c51f0b0e8264dd32d3be9461519e87d Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Mon, 8 Jul 2019 13:17:39 +0100
Subject: [PATCH 1705/2409] Bump noVNC to 1.1.0

v1.1.0 was released over a year ago now so move to it ahead of 1.2.0.

Change-Id: I13c5638f320b18c4f6f945528352471d2bb31313
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 17641c343d..70007a9a80 100644
--- a/stackrc
+++ b/stackrc
@@ -600,7 +600,7 @@ IRONIC_PYTHON_AGENT_BRANCH=${IRONIC_PYTHON_AGENT_BRANCH:-$TARGET_BRANCH}
 
 # a websockets/html5 or flash powered VNC console for vm instances
 NOVNC_REPO=${NOVNC_REPO:-https://github.com/novnc/noVNC.git}
-NOVNC_BRANCH=${NOVNC_BRANCH:-v1.0.0}
+NOVNC_BRANCH=${NOVNC_BRANCH:-v1.1.0}
 
 # a websockets/html5 or flash powered SPICE console for vm instances
 SPICE_REPO=${SPICE_REPO:-http://anongit.freedesktop.org/git/spice/spice-html5.git}

From 3cd41019b048349b42ec62d5602beb89bed9e975 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Thu, 16 Apr 2020 13:06:07 +1000
Subject: [PATCH 1706/2409] lib/tls: use python3 to run inline script

We only need to run this fixup for the active python now we are 3 only.

Change-Id: I7616e5ee5693b2890fb7f6bd9052890a82904c22
---
 lib/tls  | 3 +--
 stack.sh | 3 ---
 2 files changed, 1 insertion(+), 5 deletions(-)

diff --git a/lib/tls b/lib/tls
index 65ffeb937d..d05536b45d 100644
--- a/lib/tls
+++ b/lib/tls
@@ -369,8 +369,7 @@ function deploy_int_CA {
 function fix_system_ca_bundle_path {
     if is_service_enabled tls-proxy; then
         local capath
-        local python_cmd=${1:-python}
-        capath=$($python_cmd -c $'try:\n from requests import certs\n print (certs.where())\nexcept ImportError: pass')
+        capath=$(python3 -c $'try:\n from requests import certs\n print (certs.where())\nexcept ImportError: pass')
 
         if [[ ! $capath == "" && ! $capath =~ ^/etc/.* && ! -L $capath ]]; then
             if is_fedora; then
diff --git a/stack.sh b/stack.sh
index 0f1ddb1b3f..b59af404a4 100755
--- a/stack.sh
+++ b/stack.sh
@@ -968,9 +968,6 @@ fi
 
 if is_service_enabled tls-proxy; then
     fix_system_ca_bundle_path
-    if python3_enabled ; then
-        fix_system_ca_bundle_path python3
-    fi
 fi
 
 # Extras Install

From 812e7846c99e6e4445fdd115a6440fe999730bc1 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 17 Apr 2020 09:25:22 +1000
Subject: [PATCH 1707/2409] Cleanup rpm-distro mariadb install

We have lib/databases/mysql which is installing databases, remove it
from the bulk package lists.

Split is_fedora (fedora & centos8 -- soon) to install mariadb-server
and mariadb-devel to retain status-quo.

On suse this seems to be a meta-package

 'mariadb-server' not found in package names. Trying capabilities.

so split that out.  It seems it has never been installing the -devel
package, and things work (presumably clients are coming from wheels so
don't need to build against it).

Change-Id: I86433318e8f76c40c5c792b795411a5c9d8351d3
---
 files/rpms-suse/neutron-common | 1 -
 files/rpms-suse/nova           | 1 -
 files/rpms/general             | 1 -
 lib/databases/mysql            | 5 ++++-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/files/rpms-suse/neutron-common b/files/rpms-suse/neutron-common
index d1cc73f115..e3799a9353 100644
--- a/files/rpms-suse/neutron-common
+++ b/files/rpms-suse/neutron-common
@@ -5,7 +5,6 @@ ebtables
 haproxy # to serve as metadata proxy inside router/dhcp namespaces
 iptables
 iputils
-mariadb # NOPRIME
 rabbitmq-server # NOPRIME
 radvd # NOPRIME
 sqlite3
diff --git a/files/rpms-suse/nova b/files/rpms-suse/nova
index 1d5812146b..9923760750 100644
--- a/files/rpms-suse/nova
+++ b/files/rpms-suse/nova
@@ -11,7 +11,6 @@ kpartx
 kvm # NOPRIME
 libvirt # NOPRIME
 libvirt-python # NOPRIME
-mariadb # NOPRIME
 # mkisofs is required for config_drive
 mkisofs # not:sle12
 parted
diff --git a/files/rpms/general b/files/rpms/general
index 361416a910..b150a570b4 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -17,7 +17,6 @@ libjpeg-turbo-devel # Pillow 3.0.0
 libxml2-devel # lxml
 libxslt-devel # lxml
 libyaml-devel
-mariadb-devel  # MySQL-python
 net-tools
 openssh-server
 openssl
diff --git a/lib/databases/mysql b/lib/databases/mysql
index e5865f2a69..d4969d713c 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -175,7 +175,10 @@ EOF
     # Install mysql-server
     if is_oraclelinux; then
         install_package mysql-community-server
-    elif is_fedora || is_suse; then
+    elif is_fedora; then
+        install_package mariadb-server mariadb-devel
+        sudo systemctl enable $MYSQL_SERVICE_NAME
+    elif is_suse; then
         install_package mariadb-server
         sudo systemctl enable $MYSQL_SERVICE_NAME
     elif is_ubuntu; then

From 39bc71cedd96b45caec6e92dc8228da1cc3b1643 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Thu, 16 Apr 2020 11:53:11 +1000
Subject: [PATCH 1708/2409] libs/rpms : update for CentOS 7 removal

With the removal of CentOS 7, we can re-evaluate the rpm
installations.

We should not need virtualenv after https://review.opendev.org/712609

There should be no need for python-devel as we're python3

pyOpenSSL was added to workaround memory issues in
9e98f9435ec36f2fffed0ac368befd520f07e0e1 (2015) ... I think we've
moved on.

pyxattr is not a package; remove it.

I don't see we need packaged m2crypto, which isn't a package on CentOS
8.  nor libxml2-python; these days it has wheels which should work
with the normal installation process.

centos8 has:

 * targetcli
 * pcp-system-tools (and no dstat)
 * iptables-services
 * java-1.8.0-openjdk-headless
 * kernel-modules
 * rsync-daemon

just as all supported fedora's do, so we can remove any matching here.

Change-Id: I542c426a67a98f331d2a29bacd220af81fab8cc4
---
 files/rpms/cinder         |  3 +--
 files/rpms/dstat          |  3 +--
 files/rpms/general        | 10 +++-------
 files/rpms/neutron-common |  2 --
 files/rpms/nova           |  6 +-----
 files/rpms/swift          |  3 +--
 6 files changed, 7 insertions(+), 20 deletions(-)

diff --git a/files/rpms/cinder b/files/rpms/cinder
index a8201ea38b..c21ea08e89 100644
--- a/files/rpms/cinder
+++ b/files/rpms/cinder
@@ -1,5 +1,4 @@
 iscsi-initiator-utils
 lvm2
 qemu-img
-scsi-target-utils # not:rhel7,f30,f31 NOPRIME
-targetcli # dist:rhel7,f30,f31 NOPRIME
+targetcli
diff --git a/files/rpms/dstat b/files/rpms/dstat
index a091cceb3a..6524bed607 100644
--- a/files/rpms/dstat
+++ b/files/rpms/dstat
@@ -1,2 +1 @@
-dstat # not:f30,f31
-pcp-system-tools # dist:f30,f31
+pcp-system-tools
diff --git a/files/rpms/general b/files/rpms/general
index b150a570b4..ff77ce05af 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -9,9 +9,8 @@ git-core
 graphviz # needed only for docs
 httpd
 httpd-devel
-iptables-services  # NOPRIME f30,f31
-java-1.7.0-openjdk-headless  # NOPRIME rhel7
-java-1.8.0-openjdk-headless  # NOPRIME f30,f31
+iptables-services
+java-1.8.0-openjdk-headless
 libffi-devel
 libjpeg-turbo-devel # Pillow 3.0.0
 libxml2-devel # lxml
@@ -25,10 +24,7 @@ pcre-devel # for python-pcre
 pkgconfig
 postgresql-devel  # psycopg2
 psmisc
-pyOpenSSL # version in pip uses too much memory
-python3-devel # dist:f30,f31
-python3-virtualenv # dist:f31
-python-devel
+python3-devel
 redhat-rpm-config # missing dep for gcc hardening flags, see rhbz#1217376
 systemd-devel # for systemd-python
 tar
diff --git a/files/rpms/neutron-common b/files/rpms/neutron-common
index 0cc8d11ceb..fe25f57ea6 100644
--- a/files/rpms/neutron-common
+++ b/files/rpms/neutron-common
@@ -5,8 +5,6 @@ ebtables
 haproxy # to serve as metadata proxy inside router/dhcp namespaces
 iptables
 iputils
-mysql-devel
-mysql-server # NOPRIME
 openvswitch # NOPRIME
 rabbitmq-server # NOPRIME
 radvd # NOPRIME
diff --git a/files/rpms/nova b/files/rpms/nova
index 0f3d10f53a..2218330230 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -7,12 +7,8 @@ gawk
 genisoimage # required for config_drive
 iptables
 iputils
-kernel-modules # dist:f30,f31
+kernel-modules
 kpartx
-libxml2-python
-m2crypto
-mysql-devel
-mysql-server # NOPRIME
 parted
 polkit
 rabbitmq-server # NOPRIME
diff --git a/files/rpms/swift b/files/rpms/swift
index 745cc2e09a..376c6f3df7 100644
--- a/files/rpms/swift
+++ b/files/rpms/swift
@@ -1,8 +1,7 @@
 curl
 liberasurecode-devel
 memcached
-pyxattr
-rsync-daemon # dist:f30,f31
+rsync-daemon
 sqlite
 xfsprogs
 xinetd

From f70cb70acb8050c49dd4cf5f3e4f7c70ba2d978d Mon Sep 17 00:00:00 2001
From: Bharat Kunwar <bharat@stackhpc.com>
Date: Mon, 20 Apr 2020 09:53:25 +0000
Subject: [PATCH 1709/2409] Support upload of qcow2.xz image format

Some images come in *.xz format [1] and this needs to be
uncompressed before being uploaded.

[1] https://builds.coreos.fedoraproject.org/prod/streams/stable/builds/31.20200323.3.2/x86_64/fedora-coreos-31.20200323.3.2-openstack.x86_64.qcow2.xz

Change-Id: I11f8484ba939c4b2c0a98aa08ef7db730baf71e8
---
 functions | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/functions b/functions
index 8ea634e753..0d27515c20 100644
--- a/functions
+++ b/functions
@@ -341,6 +341,12 @@ function upload_image {
             disk_format=qcow2
             container_format=bare
             ;;
+        *.qcow2.xz)
+            image_name=$(basename "$image" ".qcow2.xz")
+            disk_format=qcow2
+            container_format=bare
+            unpack=unxz
+            ;;
         *.raw)
             image_name=$(basename "$image" ".raw")
             disk_format=raw
@@ -376,6 +382,16 @@ function upload_image {
             openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name" $img_property --public --container-format=$container_format --disk-format $disk_format < <(zcat --force "${image}")
         elif [ "$unpack" = "bunzip2" ]; then
             openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name" $img_property --public --container-format=$container_format --disk-format $disk_format < <(bunzip2 -cdk "${image}")
+        elif [ "$unpack" = "unxz" ]; then
+            # NOTE(brtknr): unxz the file first and cleanup afterwards to
+            # prevent timeout while Glance tries to upload image (e.g. to Swift).
+            local tmp_dir
+            local image_path
+            tmp_dir=$(mktemp -d)
+            image_path="$tmp_dir/$image_name"
+            unxz -cv "${image}" > "$image_path"
+            openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name" $img_property --public --container-format=$container_format --disk-format $disk_format --file "$image_path"
+            rm -rf $tmp_dir
         else
             openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name" $img_property --public --container-format=$container_format --disk-format $disk_format < "${image}"
         fi

From 4578f98944efac5ef0c2c1476d26efd5c880e367 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Sun, 19 Apr 2020 17:54:56 -0500
Subject: [PATCH 1710/2409] [ussuri][goal] Update contributor documentation

This patch updates/adds the contributor documentation to follow
the guidelines of the Ussuri cycle community goal[1].

[1] https://governance.openstack.org/tc/goals/selected/ussuri/project-ptl-and-contrib-docs.html
Story: #2007236
Task: #38554

Change-Id: I870955fda7ee6e0d7809faa309bbc31c2ddd653a
---
 CONTRIBUTING.rst                        | 19 +++++++++
 doc/source/contributor/contributing.rst | 56 +++++++++++++++++++++++++
 doc/source/index.rst                    |  7 ++++
 3 files changed, 82 insertions(+)
 create mode 100644 CONTRIBUTING.rst
 create mode 100644 doc/source/contributor/contributing.rst

diff --git a/CONTRIBUTING.rst b/CONTRIBUTING.rst
new file mode 100644
index 0000000000..bb511656f1
--- /dev/null
+++ b/CONTRIBUTING.rst
@@ -0,0 +1,19 @@
+The source repository for this project can be found at:
+
+   https://opendev.org/openstack/devstack
+
+Pull requests submitted through GitHub are not monitored.
+
+To start contributing to OpenStack, follow the steps in the contribution guide
+to set up and use Gerrit:
+
+   https://docs.openstack.org/contributors/code-and-documentation/quick-start.html
+
+Bugs should be filed on Launchpad:
+
+   https://bugs.launchpad.net/devstack
+
+For more specific information about contributing to this repository, see the
+Devstack contributor guide:
+
+   https://docs.openstack.org/devstack/latest/contributor/contributing.html
diff --git a/doc/source/contributor/contributing.rst b/doc/source/contributor/contributing.rst
new file mode 100644
index 0000000000..5e0df569f7
--- /dev/null
+++ b/doc/source/contributor/contributing.rst
@@ -0,0 +1,56 @@
+============================
+So You Want to Contribute...
+============================
+
+For general information on contributing to OpenStack, please check out the
+`contributor guide <https://docs.openstack.org/contributors/>`_ to get started.
+It covers all the basics that are common to all OpenStack projects: the accounts
+you need, the basics of interacting with our Gerrit review system, how we
+communicate as a community, etc.
+
+Below will cover the more project specific information you need to get started
+with Devstack.
+
+Communication
+~~~~~~~~~~~~~
+* IRC channel ``#openstack-qa`` at FreeNode
+* Mailing list (prefix subjects with ``[qa][devstack]`` for faster responses)
+  http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-discuss
+
+Contacting the Core Team
+~~~~~~~~~~~~~~~~~~~~~~~~
+Please refer to the `Devstack Core Team
+<https://review.opendev.org/#/admin/groups/50,members>`_ contacts.
+
+New Feature Planning
+~~~~~~~~~~~~~~~~~~~~
+If you want to propose a new feature please read `Feature Proposal Process`_
+Devstack features are tracked on `Launchpad BP <https://blueprints.launchpad.net/devstack>`_.
+
+Task Tracking
+~~~~~~~~~~~~~
+We track our tasks in `Launchpad <https://bugs.launchpad.net/devstack>`_.
+
+Reporting a Bug
+~~~~~~~~~~~~~~~
+You found an issue and want to make sure we are aware of it? You can do so on
+`Launchpad <https://bugs.launchpad.net/devstack/+filebug>`__.
+More info about Launchpad usage can be found on `OpenStack docs page
+<https://docs.openstack.org/contributors/common/task-tracking.html#launchpad>`_
+
+Getting Your Patch Merged
+~~~~~~~~~~~~~~~~~~~~~~~~~
+All changes proposed to the Devstack require two ``Code-Review +2`` votes from
+Devstack core reviewers before one of the core reviewers can approve the patch
+by giving ``Workflow +1`` vote. One exception is for patches to unblock the gate
+which can be approved by single core reviewers.
+
+Project Team Lead Duties
+~~~~~~~~~~~~~~~~~~~~~~~~
+All common PTL duties are enumerated in the `PTL guide
+<https://docs.openstack.org/project-team-guide/ptl.html>`_.
+
+The Release Process for QA is documented in `QA Release Process
+<https://wiki.openstack.org/wiki/QA/releases>`_.
+
+.. _Feature Proposal Process: https://wiki.openstack.org/wiki/QA#Feature_Proposal_.26_Design_discussions
diff --git a/doc/source/index.rst b/doc/source/index.rst
index 6694022316..7923cb88c7 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -151,6 +151,13 @@ Get :doc:`the big picture <overview>` of what we are trying to do
 with devstack, and help us by :doc:`contributing to the project
 <hacking>`.
 
+If you are a new contributor to devstack please refer: :doc:`contributor/contributing`
+
+.. toctree::
+   :hidden:
+
+   contributor/contributing
+
 Contents
 ++++++++
 

From 332992ace2bcb2a4d94c0ae3ccbc7c3a2a7bcb38 Mon Sep 17 00:00:00 2001
From: Mohammed Naser <mnaser@vexxhost.com>
Date: Sun, 26 Apr 2020 12:39:05 -0400
Subject: [PATCH 1711/2409] setup-devstack-source-dirs: add var for paths

The paths for the devstack source directories are currently hardcoded,
this patch allows overriding that list.

Change-Id: I2b673b0d110d84658b89bb14663584330deaf3aa
---
 roles/setup-devstack-source-dirs/defaults/main.yaml | 8 ++++++++
 roles/setup-devstack-source-dirs/tasks/main.yaml    | 9 +--------
 2 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/roles/setup-devstack-source-dirs/defaults/main.yaml b/roles/setup-devstack-source-dirs/defaults/main.yaml
index fea05c8146..77a74d7b89 100644
--- a/roles/setup-devstack-source-dirs/defaults/main.yaml
+++ b/roles/setup-devstack-source-dirs/defaults/main.yaml
@@ -1 +1,9 @@
 devstack_base_dir: /opt/stack
+devstack_source_dirs:
+  - src/opendev.org/opendev
+  - src/opendev.org/openstack
+  - src/opendev.org/openstack-dev
+  - src/opendev.org/openstack-infra
+  - src/opendev.org/starlingx
+  - src/opendev.org/x
+  - src/opendev.org/zuul
diff --git a/roles/setup-devstack-source-dirs/tasks/main.yaml b/roles/setup-devstack-source-dirs/tasks/main.yaml
index 160757ede9..294c29cd29 100644
--- a/roles/setup-devstack-source-dirs/tasks/main.yaml
+++ b/roles/setup-devstack-source-dirs/tasks/main.yaml
@@ -1,13 +1,6 @@
 - name: Find all OpenStack source repos used by this job
   find:
-    paths:
-      - src/opendev.org/opendev
-      - src/opendev.org/openstack
-      - src/opendev.org/openstack-dev
-      - src/opendev.org/openstack-infra
-      - src/opendev.org/starlingx
-      - src/opendev.org/x
-      - src/opendev.org/zuul
+    paths: "{{ devstack_source_dirs }}"
     file_type: directory
   register: found_repos
 

From ccc58267257f48501030ad7e3c4b18a7435f9a1c Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Mon, 27 Apr 2020 06:13:34 +0000
Subject: [PATCH 1712/2409] Updated from generate-devstack-plugins-list

Change-Id: I04b13cb0114233afca9aa7987144bd69d6d0f185
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 70c18a88b1..42c5fc1324 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -138,6 +138,7 @@ starlingx/integ                          `https://opendev.org/starlingx/integ <h
 starlingx/metal                          `https://opendev.org/starlingx/metal <https://opendev.org/starlingx/metal>`__
 starlingx/nfv                            `https://opendev.org/starlingx/nfv <https://opendev.org/starlingx/nfv>`__
 starlingx/update                         `https://opendev.org/starlingx/update <https://opendev.org/starlingx/update>`__
+vexxhost/openstack-operator              `https://opendev.org/vexxhost/openstack-operator <https://opendev.org/vexxhost/openstack-operator>`__
 x/almanach                               `https://opendev.org/x/almanach <https://opendev.org/x/almanach>`__
 x/apmec                                  `https://opendev.org/x/apmec <https://opendev.org/x/apmec>`__
 x/bilean                                 `https://opendev.org/x/bilean <https://opendev.org/x/bilean>`__

From bc86e82a61d9aa74e6f455bb47003a96c548b2fc Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Mon, 27 Apr 2020 12:03:38 -0500
Subject: [PATCH 1713/2409] Update DEVSTACK_SERIES to victoria

stable/ussuri branch has been created now and
current master is for victoria.

Change-Id: I10bd20adf6ce43c6c73acaa646d425c6df6da199
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 17641c343d..c8c2738fef 100644
--- a/stackrc
+++ b/stackrc
@@ -255,7 +255,7 @@ REQUIREMENTS_DIR=${REQUIREMENTS_DIR:-$DEST/requirements}
 # Setting the variable to 'ALL' will activate the download for all
 # libraries.
 
-DEVSTACK_SERIES="ussuri"
+DEVSTACK_SERIES="victoria"
 
 ##############
 #

From 1147300b9c572a19cf4c70ad3ba1fab7ccb965cc Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Thu, 30 Apr 2020 10:09:47 +1000
Subject: [PATCH 1714/2409] Remove bridge-utils/brctl usage

This package isn't available on some distributions hasn't been
required in Neutron for several years
If679e79fa3242ee1cd8610b5525deca35b41c87e.  Remove it.

Change-Id: I7308a885c1d084efe2f0b9f542443d35966140ed
---
 files/debs/general                    | 1 -
 files/rpms-suse/general               | 1 -
 files/rpms/general                    | 1 -
 lib/neutron_plugins/linuxbridge_agent | 2 +-
 tools/worlddump.py                    | 2 --
 5 files changed, 1 insertion(+), 6 deletions(-)

diff --git a/files/debs/general b/files/debs/general
index fe0061337a..2d8cd80473 100644
--- a/files/debs/general
+++ b/files/debs/general
@@ -1,7 +1,6 @@
 apache2
 apache2-dev
 bc
-bridge-utils
 bsdmainutils
 curl
 default-jre-headless  # NOPRIME
diff --git a/files/rpms-suse/general b/files/rpms-suse/general
index b870d72149..0af2b5b169 100644
--- a/files/rpms-suse/general
+++ b/files/rpms-suse/general
@@ -1,7 +1,6 @@
 apache2
 apache2-devel
 bc
-bridge-utils
 ca-certificates-mozilla
 curl
 gcc
diff --git a/files/rpms/general b/files/rpms/general
index ff77ce05af..303510cbd9 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -1,5 +1,4 @@
 bc
-bridge-utils
 curl
 dbus
 gcc
diff --git a/lib/neutron_plugins/linuxbridge_agent b/lib/neutron_plugins/linuxbridge_agent
index 1f1b0e8e52..bdeaf0f3c6 100644
--- a/lib/neutron_plugins/linuxbridge_agent
+++ b/lib/neutron_plugins/linuxbridge_agent
@@ -38,7 +38,7 @@ function neutron_plugin_create_nova_conf {
 }
 
 function neutron_plugin_install_agent_packages {
-    install_package bridge-utils
+    :
 }
 
 function neutron_plugin_configure_dhcp_agent {
diff --git a/tools/worlddump.py b/tools/worlddump.py
index b21ed0c861..0a4df52337 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -166,8 +166,6 @@ def network_dump():
     _header("Network Dump")
 
     _dump_cmd("bridge link")
-    if _find_cmd("brctl"):
-        _dump_cmd("brctl show")
     _dump_cmd("ip link show type bridge")
     ip_cmds = ["neigh", "addr", "link", "route"]
     for cmd in ip_cmds + ['netns']:

From 36705b52336a442dc05d9874638d269834ff93b7 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Thu, 9 Apr 2020 11:00:28 +0100
Subject: [PATCH 1715/2409] CentOS 8 support

This adds support for CentOS 8

Change-Id: If7ddbd6655086657db03074a27a2d47053fd88e0
---
 .zuul.yaml | 19 ++++++++++++
 stack.sh   | 85 +++++++++++++++---------------------------------------
 2 files changed, 43 insertions(+), 61 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 48c2d0d798..4a54a3a070 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -38,6 +38,16 @@
         nodes:
           - controller
 
+- nodeset:
+    name: devstack-single-node-centos-8
+    nodes:
+      - name: controller
+        label: centos-8
+    groups:
+      - name: tempest
+        nodes:
+          - controller
+
 - nodeset:
     name: devstack-single-node-opensuse-15
     nodes:
@@ -498,6 +508,14 @@
 # we often have to rush things through devstack to stabilise the gate,
 # and these platforms don't have the round-the-clock support to avoid
 # becoming blockers in that situation.
+- job:
+    name: devstack-platform-centos-8
+    parent: tempest-full-py3
+    description: Centos 8 platform test
+    nodeset: devstack-single-node-centos-8
+    voting: false
+    timeout: 9000
+
 - job:
     name: devstack-platform-opensuse-15
     parent: tempest-full-py3
@@ -595,6 +613,7 @@
         - devstack-ipv6
         - devstack-platform-opensuse-15
         - devstack-platform-fedora-latest
+        - devstack-platform-centos-8
         - devstack-multinode
         - devstack-unit-tests
         - openstack-tox-bashate
diff --git a/stack.sh b/stack.sh
index b59af404a4..aa898de9fb 100755
--- a/stack.sh
+++ b/stack.sh
@@ -221,7 +221,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (bionic|stretch|jessie|f30|f31|opensuse-15.0|opensuse-15.1|opensuse-tumbleweed) ]]; then
+if [[ ! ${DISTRO} =~ (bionic|stretch|jessie|f30|f31|opensuse-15.0|opensuse-15.1|opensuse-tumbleweed|rhel8) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"
@@ -290,67 +290,20 @@ function _install_epel {
         uninstall_package epel-release || true
     fi
 
-    # This trick installs the latest epel-release from a bootstrap
-    # repo, then removes itself (as epel-release installed the
-    # "real" repo).
-    #
-    # You would think that rather than this, you could use
-    # $releasever directly in .repo file we create below.  However
-    # RHEL gives a $releasever of "6Server" which breaks the path;
-    # see https://bugzilla.redhat.com/show_bug.cgi?id=1150759
-    cat <<EOF | sudo tee /etc/yum.repos.d/epel-bootstrap.repo
-[epel-bootstrap]
-name=Bootstrap EPEL
-mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=epel-7&arch=\$basearch
-failovermethod=priority
-enabled=0
-gpgcheck=0
-EOF
-    # Enable a bootstrap repo.  It is removed after finishing
-    # the epel-release installation.
-    is_package_installed yum-utils || install_package yum-utils
-    sudo yum-config-manager --enable epel-bootstrap
-    yum_install epel-release || \
-        die $LINENO "Error installing EPEL repo, cannot continue"
-    sudo rm -f /etc/yum.repos.d/epel-bootstrap.repo
+    # epel-release is in extras repo which is enabled by default
+    install_package epel-release
+
+    # RDO repos are not tested with epel and may have incompatibilities so
+    # let's limit the packages fetched from epel to the ones not in RDO repos.
+    sudo yum-config-manager --save --setopt=includepkgs=debootstrap,dpkg epel
 }
 
 function _install_rdo {
-    # There are multiple options for this, including using CloudSIG
-    # repositories (centos-release-*), trunk versions, etc.  Since
-    # we're not interested in the actual openstack distributions
-    # (since we're using git to run!) but only peripherial packages
-    # like kvm or ovs, this has been reliable.
-
-    # TODO(ianw): figure out how to best mirror -- probably use infra
-    # mirror RDO reverse proxy.  We could either have test
-    # infrastructure set it up disabled like EPEL, or fiddle it here.
-    # Per the point above, it's a bunch of repos so starts getting a
-    # little messy...
-    if ! is_package_installed rdo-release ; then
-        if [[ "$TARGET_BRANCH" == "master" ]]; then
-            yum_install https://rdoproject.org/repos/rdo-release.rpm
-        else
-            # Get latest rdo-release-$rdo_release RPM package version
-            rdo_release=$(echo $TARGET_BRANCH | sed "s|stable/||g")
-            yum_install https://rdoproject.org/repos/openstack-$rdo_release/rdo-release-$rdo_release.rpm
-        fi
-    fi
-
-    # Also enable optional for RHEL7 proper.  Note this is a silent
-    # no-op on other platforms.
-    sudo yum-config-manager --enable rhel-7-server-optional-rpms
-
-    # Enable the Software Collections (SCL) repository for CentOS.
-    # This repository includes useful software (e.g. the Go Toolset)
-    # which is not present in the main repository.
-    if [[ "$os_VENDOR" =~ (CentOS) ]]; then
-        yum_install centos-release-scl
-    fi
-
-    if is_oraclelinux; then
-        sudo yum-config-manager --enable ol7_optional_latest ol7_addons ol7_MySQL56
-    fi
+    # NOTE(ianw) 2020-04-30 : when we have future branches, we
+    # probably want to install the relevant branch RDO release as
+    # well.  But for now it's all master.
+    sudo dnf -y install https://rdoproject.org/repos/rdo-release.el8.rpm
+    sudo dnf -y update
 }
 
 
@@ -395,15 +348,19 @@ fi
 # to speed things up
 SKIP_EPEL_INSTALL=$(trueorfalse False SKIP_EPEL_INSTALL)
 
-if [[ $DISTRO == "rhel7" ]]; then
+if [[ $DISTRO == "rhel8" ]]; then
     # If we have /etc/ci/mirror_info.sh assume we're on a OpenStack CI
     # node, where EPEL is installed (but disabled) and already
     # pointing at our internal mirror
     if [[ -f /etc/ci/mirror_info.sh ]]; then
         SKIP_EPEL_INSTALL=True
-        sudo yum-config-manager --enable epel
+        sudo dnf config-manager --set-enabled epel
     fi
 
+    # PowerTools repo provides libyaml-devel required by devstack itself and
+    # EPEL packages assume that the PowerTools repository is enable.
+    sudo dnf config-manager --set-enabled PowerTools
+
     if [[ ${SKIP_EPEL_INSTALL} != True ]]; then
         _install_epel
     fi
@@ -411,6 +368,12 @@ if [[ $DISTRO == "rhel7" ]]; then
     # available in RDO repositories (e.g. OVS, or later versions of
     # kvm) to run.
     _install_rdo
+
+    # NOTE(cgoncalves): workaround RHBZ#1154272
+    # dnf fails for non-privileged users when expired_repos.json doesn't exist.
+    # RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1154272
+    # Patch: https://github.com/rpm-software-management/dnf/pull/1448
+    echo "[]" | sudo tee /var/cache/dnf/expired_repos.json
 fi
 
 # Ensure python is installed

From 67fd81a484b2e9153e39d583c03ffc929ef6703e Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Thu, 30 Apr 2020 09:24:04 +1000
Subject: [PATCH 1716/2409] Cleanup yum things

We no longer support platforms with Yum on master.  Cleanup old
references and convert to dnf.

We don't need any of the failure wrapper stuff as dnf runs in strict
mode by default.

There seem to be a few callers out there, so we'll leave it called
yum_install for now.

Change-Id: Ie71a48fd85b00a97a14bf260cd013b18af4cce06
---
 functions-common | 50 +++++++-----------------------------------------
 stack.sh         |  9 +--------
 stackrc          |  9 ---------
 3 files changed, 8 insertions(+), 60 deletions(-)

diff --git a/functions-common b/functions-common
index 6be07b42bb..f50ff56c7d 100644
--- a/functions-common
+++ b/functions-common
@@ -329,9 +329,6 @@ function _ensure_lsb_release {
         sudo zypper -n install lsb-release
     elif [[ -x $(command -v dnf 2>/dev/null) ]]; then
         sudo dnf install -y redhat-lsb-core
-    elif [[ -x $(command -v yum 2>/dev/null) ]]; then
-        # all rh patforms (fedora, centos, rhel) have this pkg
-        sudo yum install -y redhat-lsb-core
     else
         die $LINENO "Unable to find or auto-install lsb_release"
     fi
@@ -1361,7 +1358,7 @@ function uninstall_package {
     if is_ubuntu; then
         apt_get purge "$@"
     elif is_fedora; then
-        sudo ${YUM:-yum} remove -y "$@" ||:
+        sudo dnf remove -y "$@" ||:
     elif is_suse; then
         sudo zypper remove -y "$@" ||:
     else
@@ -1369,8 +1366,11 @@ function uninstall_package {
     fi
 }
 
-# Wrapper for ``yum`` to set proxy environment variables
-# Uses globals ``OFFLINE``, ``*_proxy``, ``YUM``
+# Wrapper for ``dnf`` to set proxy environment variables
+# Uses globals ``OFFLINE``, ``*_proxy``
+# The name is kept for backwards compatability with external
+# callers, despite none of our supported platforms using yum
+# any more.
 # yum_install package [package ...]
 function yum_install {
     local result parse_yum_result
@@ -1378,44 +1378,8 @@ function yum_install {
     [[ "$OFFLINE" = "True" ]] && return
 
     time_start "yum_install"
-
-    # This is a bit tricky, because yum -y assumes missing or failed
-    # packages are OK (see [1]).  We want devstack to stop if we are
-    # installing missing packages.
-    #
-    # Thus we manually match on the output (stack.sh runs in a fixed
-    # locale, so lang shouldn't change).
-    #
-    # If yum returns !0, we echo the result as "YUM_FAILED" and return
-    # that from the awk (we're subverting -e with this trick).
-    # Otherwise we use awk to look for failure strings and return "2"
-    # to indicate a terminal failure.
-    #
-    # [1] https://bugzilla.redhat.com/show_bug.cgi?id=965567
-    parse_yum_result='              \
-        BEGIN { result=0 }          \
-        /^YUM_FAILED/ { result=$2 } \
-        /^No package/ { result=2 }  \
-        /^Failed:/    { result=2 }  \
-        //{ print }                 \
-        END { exit result }'
-    (sudo_with_proxies "${YUM:-yum}" install -y "$@" 2>&1 || echo YUM_FAILED $?) \
-        | awk "$parse_yum_result" && result=$? || result=$?
-
+    sudo_with_proxies dnf install -y "$@"
     time_stop "yum_install"
-
-    # if we return 1, then the wrapper functions will run an update
-    # and try installing the package again as a defense against bad
-    # mirrors.  This can hide failures, especially when we have
-    # packages that are in the "Failed:" section because their rpm
-    # install scripts failed to run correctly (in this case, the
-    # package looks installed, so when the retry happens we just think
-    # the package is OK, and incorrectly continue on).
-    if [ "$result" == 2 ]; then
-        die "Detected fatal package install failure"
-    fi
-
-    return "$result"
 }
 
 # zypper wrapper to set arguments correctly
diff --git a/stack.sh b/stack.sh
index aa898de9fb..eac8079029 100755
--- a/stack.sh
+++ b/stack.sh
@@ -283,19 +283,12 @@ fi
 # to pick up required packages.
 
 function _install_epel {
-    # NOTE: We always remove and install latest -- some environments
-    # use snapshot images, and if EPEL version updates they break
-    # unless we update them to latest version.
-    if sudo yum repolist enabled epel | grep -q 'epel'; then
-        uninstall_package epel-release || true
-    fi
-
     # epel-release is in extras repo which is enabled by default
     install_package epel-release
 
     # RDO repos are not tested with epel and may have incompatibilities so
     # let's limit the packages fetched from epel to the ones not in RDO repos.
-    sudo yum-config-manager --save --setopt=includepkgs=debootstrap,dpkg epel
+    sudo dnf config-manager --save --setopt=includepkgs=debootstrap,dpkg epel
 }
 
 function _install_rdo {
diff --git a/stackrc b/stackrc
index cf501bb374..b189e206e1 100644
--- a/stackrc
+++ b/stackrc
@@ -813,15 +813,6 @@ SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT=${SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT:-5}
 # Service graceful shutdown timeout
 WORKER_TIMEOUT=${WORKER_TIMEOUT:-90}
 
-# Choose DNF on RedHat/Fedora platforms with it, or otherwise default
-# to YUM.  Can remove this when only dnf is supported (i.e. centos7
-# disappears)
-if [[ -e /usr/bin/dnf ]]; then
-    YUM=${YUM:-dnf}
-else
-    YUM=${YUM:-yum}
-fi
-
 # Common Configuration
 # --------------------
 

From c104afec7dd72edfd909847bee9c14eaf077a28b Mon Sep 17 00:00:00 2001
From: Andreas Jaeger <aj@suse.com>
Date: Mon, 4 May 2020 08:21:02 +0200
Subject: [PATCH 1717/2409] Switch to new grenade job name

The integrated gate template (integrated-gate-py3) has been switched
to the new grenade name (grenade-py3 -> grenade). This repo uses the
template but also has for irrelevant files an extra entry.

Rename the job following the template change to avoid duplicate
grenade runs.

Details:
- http://lists.openstack.org/pipermail/openstack-discuss/2020-May/014602.html

Depends-On: https://review.opendev.org/725148
Change-Id: I73e67c0e01ca231678903b2460dab672f17251e3
---
 .zuul.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 4a54a3a070..602975a165 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -627,7 +627,7 @@
         - swift-dsvm-functional-py3:
             voting: false
             irrelevant-files: *dsvm-irrelevant-files
-        - grenade-py3:
+        - grenade:
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
@@ -676,7 +676,7 @@
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
-        - grenade-py3:
+        - grenade:
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$

From 53c2f6fe23318d16f311fde58901ad12e37049a0 Mon Sep 17 00:00:00 2001
From: Andreas Jaeger <aj@suse.com>
Date: Sat, 9 May 2020 13:30:10 +0200
Subject: [PATCH 1718/2409] Cleanup py27 support

This repo is now testing only with Python 3, so let's make
a few cleanups:
- Remove obsolete section from setup.cfg
- Use newer openstackdocstheme and Sphinx version for python 3
- Remove install_command from tox.ini, the default is fine
- Move basepython into testenv
- Update bashate version

Change-Id: I3d78b3787af2efce831d223dbcab6cf84c358028
---
 doc/requirements.txt | 4 ++--
 setup.cfg            | 3 ---
 tox.ini              | 8 ++------
 3 files changed, 4 insertions(+), 11 deletions(-)

diff --git a/doc/requirements.txt b/doc/requirements.txt
index fffb83d96b..6ca2d60eaa 100644
--- a/doc/requirements.txt
+++ b/doc/requirements.txt
@@ -2,8 +2,8 @@ pbr>=2.0.0,!=2.1.0
 
 Pygments
 docutils
-sphinx>=1.6.2
-openstackdocstheme>=1.20.0
+sphinx>=2.0.0,!=2.1.0
+openstackdocstheme>=2.0.0
 nwdiag
 blockdiag
 sphinxcontrib-blockdiag
diff --git a/setup.cfg b/setup.cfg
index 4e27ad80d8..146f010243 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -10,6 +10,3 @@ classifier =
     Intended Audience :: Developers
     License :: OSI Approved :: Apache Software License
     Operating System :: POSIX :: Linux
-
-[wheel]
-universal = 1
diff --git a/tox.ini b/tox.ini
index 26baa2a1c5..ed28636d3a 100644
--- a/tox.ini
+++ b/tox.ini
@@ -5,15 +5,14 @@ envlist = bashate
 
 [testenv]
 usedevelop = False
-install_command = pip install {opts} {packages}
+basepython = python3
 
 [testenv:bashate]
-basepython = python3
 # if you want to test out some changes you have made to bashate
 # against devstack, just set BASHATE_INSTALL_PATH=/path/... to your
 # modified bashate tree
 deps =
-   {env:BASHATE_INSTALL_PATH:bashate==0.5.1}
+   {env:BASHATE_INSTALL_PATH:bashate==2.0.0}
 whitelist_externals = bash
 commands = bash -c "find {toxinidir}             \
          -not \( -type d -name .?\* -prune \)    \
@@ -35,7 +34,6 @@ commands = bash -c "find {toxinidir}             \
          -print0 | xargs -0 bashate -v -iE006 -eE005,E042"
 
 [testenv:docs]
-basepython = python3
 deps = -r{toxinidir}/doc/requirements.txt
 whitelist_externals = bash
 setenv =
@@ -44,7 +42,6 @@ commands =
   sphinx-build -W -b html -d doc/build/doctrees doc/source doc/build/html
 
 [testenv:pdf-docs]
-basepython = python3
 deps = {[testenv:docs]deps}
 whitelist_externals =
    make
@@ -53,6 +50,5 @@ commands =
    make -C doc/build/pdf
 
 [testenv:venv]
-basepython = python3
 deps = -r{toxinidir}/doc/requirements.txt
 commands = {posargs}

From 551848dd696b32a48946b6f0a22079d57907a27c Mon Sep 17 00:00:00 2001
From: Kevin Zhao <kevin.zhao@linaro.org>
Date: Mon, 27 Apr 2020 08:39:37 +0800
Subject: [PATCH 1719/2409] Fix devstack default settings in aarch64

1. Lack qemu-efi in ubuntu
2. Lack edk2.git-aarch64 in Fedora/Centos
3. Remove NOVNC disable.

Change-Id: Ifbd0c386df6b28bc64cef20cab8e08f99a85c782
Signed-off-by: Kevin Zhao <kevin.zhao@linaro.org>
---
 lib/nova_plugins/functions-libvirt  | 7 +++++++
 lib/nova_plugins/hypervisor-libvirt | 2 --
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index 03df258e03..d3827c30dd 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -59,6 +59,9 @@ function install_libvirt {
 
     if is_ubuntu; then
         install_package qemu-system libvirt-clients libvirt-daemon-system libvirt-dev
+        if is_arch "aarch64"; then
+            install_package qemu-efi
+        fi
         # uninstall in case the libvirt version changed
         pip_uninstall libvirt-python
         pip_install_gr libvirt-python
@@ -78,6 +81,10 @@ function install_libvirt {
         install_package qemu-kvm
 
         install_package libvirt libvirt-devel
+        if is_arch "aarch64"; then
+            install_package edk2.git-aarch64
+        fi
+
         pip_uninstall libvirt-python
         pip_install_gr libvirt-python
     fi
diff --git a/lib/nova_plugins/hypervisor-libvirt b/lib/nova_plugins/hypervisor-libvirt
index b0ae29e39b..b25bc0c367 100644
--- a/lib/nova_plugins/hypervisor-libvirt
+++ b/lib/nova_plugins/hypervisor-libvirt
@@ -52,8 +52,6 @@ function configure_nova_hypervisor {
 
     # arm64-specific configuration
     if is_arch "aarch64"; then
-        # arm64 architecture currently does not support graphical consoles.
-        iniset $NOVA_CONF vnc enabled "false"
         iniset $NOVA_CONF libvirt cpu_mode "host-passthrough"
     fi
 

From 782efb0f8a0b6c64e5b6a317ff5bf905e51da850 Mon Sep 17 00:00:00 2001
From: Colleen Murphy <colleen.murphy@suse.com>
Date: Mon, 11 May 2020 18:28:32 -0700
Subject: [PATCH 1720/2409] Fix pip distro package removal for focal

Ubuntu Focal doesn't have python-pip, only python3-pip. Trying to
uninstall a package that apt doesn't know about (installed or
uninstalled) results in a nonzero exit code so devstack fails. This
patch makes the package removal safer for both python2 and python3 cases
by checking first if the package exists.

Change-Id: I3b1118888cb0617ffb99b72c7e9a32308033783e
---
 tools/install_pip.sh | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index dcd546629f..5eb538ce84 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -133,8 +133,12 @@ get_versions
 # results in a nonfunctional system. pip on fedora installs to /usr so pip
 # can safely override the system pip for all versions of fedora
 if ! is_fedora  && ! is_suse; then
-    uninstall_package python-pip
-    uninstall_package python3-pip
+    if is_package_installed python-pip ; then
+        uninstall_package python-pip
+    fi
+    if is_package_installed python3-pip ; then
+        uninstall_package python3-pip
+    fi
 fi
 
 install_get_pip

From 8fd45dec50ca8872bf07563dcb41cffca3683965 Mon Sep 17 00:00:00 2001
From: Luigi Toscano <ltoscano@redhat.com>
Date: Tue, 12 May 2020 12:00:20 +0200
Subject: [PATCH 1721/2409] New TEMPEST_VOLUME_REVERT_TO_SNAPSHOT setting

Follow the pattern of the other configuration keys. The new variables
allows tests to enable/disable volume revert tests provided
by cinder-tempest-plugin.

Revert-to-snapshot was introduced in pike, and so the tests.

Change-Id: If137f201c2f646703f5a1ff96e71e48caed63b67
---
 lib/tempest | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index 6e87e54801..37b22065b4 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -472,6 +472,11 @@ function configure_tempest {
         TEMPEST_EXTEND_ATTACHED_VOLUME=${TEMPEST_EXTEND_ATTACHED_VOLUME:-True}
     fi
     iniset $TEMPEST_CONFIG volume-feature-enabled extend_attached_volume $(trueorfalse False TEMPEST_EXTEND_ATTACHED_VOLUME)
+    # Only turn on TEMPEST_VOLUME_REVERT_TO_SNAPSHOT by default for "lvm" backends
+    if [[ "$CINDER_ENABLED_BACKENDS" == *"lvm"* ]]; then
+        TEMPEST_VOLUME_REVERT_TO_SNAPSHOT=${TEMPEST_VOLUME_REVERT_TO_SNAPSHOT:-True}
+    fi
+    iniset $TEMPEST_CONFIG volume-feature-enabled volume_revert $(trueorfalse False TEMPEST_VOLUME_REVERT_TO_SNAPSHOT)
     local tempest_volume_min_microversion=${TEMPEST_VOLUME_MIN_MICROVERSION:-None}
     local tempest_volume_max_microversion=${TEMPEST_VOLUME_MAX_MICROVERSION:-"latest"}
     # Reset microversions to None where v2 is running which does not support microversion.

From 9cbd02d8c8a99612862ccd1c20e199797c6bcb47 Mon Sep 17 00:00:00 2001
From: Vladislav Kuzmin <vkuzmin@mirantis.com>
Date: Wed, 20 May 2020 12:14:04 +0400
Subject: [PATCH 1722/2409] Enable certificate check for glance_store+swift

Disable insecure option for glance_store with
swift backend when tls is enabled.
Specify swift_store_cacert option.

Change-Id: Ia1e8f596c95dd7b6e63cb21a94c8316dc71bf945
---
 lib/glance | 14 ++++----------
 1 file changed, 4 insertions(+), 10 deletions(-)

diff --git a/lib/glance b/lib/glance
index 9398bd2daf..3f72c0b8bc 100644
--- a/lib/glance
+++ b/lib/glance
@@ -212,25 +212,19 @@ function configure_glance {
     if is_service_enabled s-proxy; then
         iniset $GLANCE_API_CONF glance_store default_store swift
         iniset $GLANCE_API_CONF glance_store swift_store_create_container_on_put True
-        if python3_enabled; then
-            iniset $GLANCE_API_CONF glance_store swift_store_auth_insecure True
-        fi
 
         iniset $GLANCE_API_CONF glance_store swift_store_config_file $GLANCE_SWIFT_STORE_CONF
         iniset $GLANCE_API_CONF glance_store default_swift_reference ref1
         iniset $GLANCE_API_CONF glance_store stores "file, http, swift"
+        if is_service_enabled tls-proxy; then
+            iniset $GLANCE_API_CONF glance_store swift_store_cacert $SSL_BUNDLE_FILE
+        fi
         iniset $GLANCE_API_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
 
         iniset $GLANCE_SWIFT_STORE_CONF ref1 user $SERVICE_PROJECT_NAME:glance-swift
 
         iniset $GLANCE_SWIFT_STORE_CONF ref1 key $SERVICE_PASSWORD
-        if python3_enabled; then
-            # NOTE(dims): Currently the glance_store+swift does not support either an insecure flag
-            # or ability to specify the CACERT. So fallback to http:// url
-            iniset $GLANCE_SWIFT_STORE_CONF ref1 auth_address ${KEYSTONE_SERVICE_URI/https/http}/v3
-        else
-            iniset $GLANCE_SWIFT_STORE_CONF ref1 auth_address $KEYSTONE_SERVICE_URI/v3
-        fi
+        iniset $GLANCE_SWIFT_STORE_CONF ref1 auth_address $KEYSTONE_SERVICE_URI/v3
         iniset $GLANCE_SWIFT_STORE_CONF ref1 auth_version 3
     fi
 

From 54edc7aeef97df768477b5fa14f8fc45266a9c2e Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Fri, 22 May 2020 13:03:15 +0100
Subject: [PATCH 1723/2409] tempest: Increase m1.nano and m1.micro RAM by 64MB
 to avoid tmpfs exhaustion

tmpfs exhaustion has long been suspected as the root issue behind
failures to load ssh keys and other metadata from local config drives as
documented in bug #1808010. This can also lead to failures fetching
metadata from n-metadata-api leaving Tempest unable to SSH into
instances.

This change increases the RAM of the m1.nano and m1.micro flavors by
64MB to hopefully avoid these errors going forward. This is also ahead
of our eventual upgrade to Cirros 0.5.0 where 128MB becomes a
requirement.

Related-Bug: #1808010
Change-Id: I4b597579cf89939955d3c110c0bd58ca05de61f0
---
 lib/tempest | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 37b22065b4..05fcb1f1f3 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -203,13 +203,13 @@ function configure_tempest {
             if [[ ! ( $available_flavors =~ 'm1.nano' ) ]]; then
                 # Determine the flavor disk size based on the image size.
                 disk=$(image_size_in_gib $image_uuid)
-                openstack flavor create --id 42 --ram 64 --disk $disk --vcpus 1 --property hw_rng:allowed=True m1.nano
+                openstack flavor create --id 42 --ram 128 --disk $disk --vcpus 1 --property hw_rng:allowed=True m1.nano
             fi
             flavor_ref=42
             if [[ ! ( $available_flavors =~ 'm1.micro' ) ]]; then
                 # Determine the alt flavor disk size based on the alt image size.
                 disk=$(image_size_in_gib $image_uuid_alt)
-                openstack flavor create --id 84 --ram 128 --disk $disk --vcpus 1 --property hw_rng:allowed=True m1.micro
+                openstack flavor create --id 84 --ram 192 --disk $disk --vcpus 1 --property hw_rng:allowed=True m1.micro
             fi
             flavor_ref_alt=84
         else

From 7f1a8c1c3edb532c1cc69fba74055ba58117b21c Mon Sep 17 00:00:00 2001
From: Andreas Jaeger <aj@suse.com>
Date: Tue, 19 May 2020 08:40:52 +0200
Subject: [PATCH 1724/2409] Switch to newer openstackdocstheme version

Switch to openstackdocstheme 2.2.1 version. Using
this version will allow especially:
* Linking from HTML to PDF document
* Allow parallel building of documents
* Fix some rendering problems

Update Sphinx version as well.

Set openstackdocs_pdf_link to link to PDF file. Note that
the link to the published document only works on docs.openstack.org
where the PDF file is placed in the top-level html directory. The
site-preview places the PDF in a pdf directory.

Set openstackdocs_auto_version to not auto-version the documents.

Set openstackdocs_auto_name to use 'project' as name.

openstackdocstheme renames some variables, so follow the renames
before the next release removes them. A couple of variables are also
not needed anymore, remove them.

Change pygments_style to 'native' since old theme version always used
'native' and the theme now respects the setting and using 'sphinx' can
lead to some strange rendering.

See also
http://lists.openstack.org/pipermail/openstack-discuss/2020-May/014971.html

Change-Id: I26887b175b9c1ced7347289b7d5d4f57a20ec36a
---
 doc/requirements.txt |  4 ++--
 doc/source/conf.py   | 14 ++++++++++----
 2 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/doc/requirements.txt b/doc/requirements.txt
index 6ca2d60eaa..ffce3ff74c 100644
--- a/doc/requirements.txt
+++ b/doc/requirements.txt
@@ -2,8 +2,8 @@ pbr>=2.0.0,!=2.1.0
 
 Pygments
 docutils
-sphinx>=2.0.0,!=2.1.0
-openstackdocstheme>=2.0.0
+sphinx>=2.0.0,!=2.1.0 # BSD
+openstackdocstheme>=2.2.1 # Apache-2.0
 nwdiag
 blockdiag
 sphinxcontrib-blockdiag
diff --git a/doc/source/conf.py b/doc/source/conf.py
index 56043ba6f7..2e17da17f8 100644
--- a/doc/source/conf.py
+++ b/doc/source/conf.py
@@ -30,9 +30,15 @@
                'sphinxcontrib.nwdiag' ]
 
 # openstackdocstheme options
-repository_name = 'openstack-dev/devstack'
-bug_project = 'devstack'
-bug_tag = ''
+openstackdocs_repo_name = 'openstack-dev/devstack'
+openstackdocs_pdf_link = True
+openstackdocs_bug_project = 'devstack'
+openstackdocs_bug_tag = ''
+openstackdocs_auto_name = False
+# This repo is not tagged, so don't set versions
+openstackdocs_auto_version = False
+version = ''
+release = ''
 
 todo_include_todos = True
 
@@ -81,7 +87,7 @@
 show_authors = False
 
 # The name of the Pygments (syntax highlighting) style to use.
-pygments_style = 'sphinx'
+pygments_style = 'native'
 
 # A list of ignored prefixes for module index sorting.
 modindex_common_prefix = ['DevStack-doc.']

From e726ecb537ee09187169902f19840ab432eeb5ae Mon Sep 17 00:00:00 2001
From: Riccardo Pittau <elfosardo@gmail.com>
Date: Thu, 14 May 2020 11:35:03 +0200
Subject: [PATCH 1725/2409] Remove sgabios.bin workaround

The bug has been fixed since a while, also in recent distributions,
for example Ubuntu 20.04, the sgabios.bin ROM is provided directly
by qemu-system-data as an actual file under /usr/share/qemu and
it conflicts with the one provided by sgabios, so removing the
workaround is actually needed to prevent failures.

Change-Id: Ib5f23dbd8839a0927418692054f4ed4abd76babc
---
 lib/nova_plugins/hypervisor-ironic | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/lib/nova_plugins/hypervisor-ironic b/lib/nova_plugins/hypervisor-ironic
index 113e2a75ea..b147c4327a 100644
--- a/lib/nova_plugins/hypervisor-ironic
+++ b/lib/nova_plugins/hypervisor-ironic
@@ -68,13 +68,6 @@ function install_nova_hypervisor {
         return
     fi
     install_libvirt
-    if [[ "$IRONIC_VM_LOG_CONSOLE" == "True" ]] && is_ubuntu; then
-        # Ubuntu packaging+apparmor issue prevents libvirt from loading
-        # the ROM from /usr/share/misc.  Workaround by installing it directly
-        # to a directory that it can read from. (LP: #1393548)
-        sudo rm -rf /usr/share/qemu/sgabios.bin
-        sudo cp /usr/share/misc/sgabios.bin /usr/share/qemu/sgabios.bin
-    fi
 }
 
 # start_nova_hypervisor - Start any required external services

From 7a0fa4fd9e5db7253fee0820fc002703d43bca3c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20J=C3=B3zefczyk?= <mjozefcz@redhat.com>
Date: Thu, 5 Mar 2020 16:55:50 +0100
Subject: [PATCH 1726/2409] Update cirros image to cirros-0.5.1
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

New cirros with recent fixes for metadata service
has been released. [1]
Let's update the image version in gate.

This also includes a fix to pass image name to SDK tests.

[1] https://github.com/cirros-dev/cirros/pull/11/commits/e40bcd2964aa496a9d03e1aaf95cf7a86938f129

Change-Id: I6ccd646f1c22a99bed0bebf6e363d2190241b667
Co-authored-by: Radosław Piliszek <radoslaw.piliszek@gmail.com>
---
 functions-common | 5 +++++
 stackrc          | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index f50ff56c7d..dea5aa93a8 100644
--- a/functions-common
+++ b/functions-common
@@ -129,6 +129,11 @@ function write_clouds_yaml {
         --os-password $ADMIN_PASSWORD \
         --os-system-scope all
 
+    cat >> $CLOUDS_YAML <<EOF
+functional:
+  image_name: $DEFAULT_IMAGE_NAME
+EOF
+
     # CLean up any old clouds.yaml files we had laying around
     rm -f $(eval echo ~"$STACK_USER")/.config/openstack/clouds.yaml
 }
diff --git a/stackrc b/stackrc
index b189e206e1..f898e8e229 100644
--- a/stackrc
+++ b/stackrc
@@ -676,7 +676,7 @@ esac
 #IMAGE_URLS="http://smoser.brickies.net/ubuntu/ttylinux-uec/ttylinux-uec-amd64-11.2_2.6.35-15_1.tar.gz" # old ttylinux-uec image
 #IMAGE_URLS="http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img" # cirros full disk image
 
-CIRROS_VERSION=${CIRROS_VERSION:-"0.4.0"}
+CIRROS_VERSION=${CIRROS_VERSION:-"0.5.1"}
 CIRROS_ARCH=${CIRROS_ARCH:-"x86_64"}
 
 # Set default image based on ``VIRT_DRIVER`` and ``LIBVIRT_TYPE``, either of

From 5b48e362af72bfc960d64c2a69b005856af47863 Mon Sep 17 00:00:00 2001
From: Tim Burke <tim.burke@gmail.com>
Date: Tue, 26 May 2020 16:21:45 -0700
Subject: [PATCH 1727/2409] swift: Fix s3api/keystone interaction

For a long time, swift3 recommended a pipeline like

   ... swift3 s3token authtoken keystoneauth ...

This led to inefficiencies where the proxy would first contact Keystone
to validate the S3 signature and issue a token, then contact Keystone
*again* to validate the token ID that was just issued.

After s3token moved into the swift3 repo, it was improved to be able
to put all of the headers into the WSGI environment that Swift's
keystoneauth middleware expected and the recommended pipeline was
changed to something like

   ... authtoken s3api s3token keystoneauth ...

At the time, the old order would still work, it would just be less
efficient. When support was added for Keystone v3, however, the new
order became mandatory.

All of that happened before swift3 moved back into Swift as s3api, but
the pipeline placement problems are the same: Keystone users won't be
able to use the S3 api with the current order.

Change-Id: Id0659f109cc2fc12ddb371df0b26812ba8c442d9
Related-Change: I21e38884a2aefbb94b76c76deccd815f01db7362
Related-Change: Ic9af387b9192f285f0f486e7171eefb23968007e
---
 lib/swift | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/swift b/lib/swift
index 5be9e3575e..b6c06c57bd 100644
--- a/lib/swift
+++ b/lib/swift
@@ -428,10 +428,11 @@ function configure_swift {
         swift_pipeline+=" s3api"
     fi
     if is_service_enabled keystone; then
+        swift_pipeline+=" authtoken"
         if is_service_enabled s3api;then
             swift_pipeline+=" s3token"
         fi
-        swift_pipeline+=" authtoken keystoneauth"
+        swift_pipeline+=" keystoneauth"
     fi
 
     swift_pipeline+=" tempauth "

From 6681a1f12651d7ee3930051e905d305042c93363 Mon Sep 17 00:00:00 2001
From: Tim Burke <tim.burke@gmail.com>
Date: Tue, 26 May 2020 20:11:24 -0700
Subject: [PATCH 1728/2409] swift: Configure s3token appropriately

We need an appropriate auth_uri for s3token to be able to contact
Keystone.

Since tempauth is always enabled, we want to delay the auth decision
until after tempauth has had a chance to try.

Change-Id: Ie4ff33a617b9dc74d51d037ec8ebd0d9787dd76d
---
 lib/swift | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/swift b/lib/swift
index b6c06c57bd..3c121ca6ec 100644
--- a/lib/swift
+++ b/lib/swift
@@ -431,6 +431,8 @@ function configure_swift {
         swift_pipeline+=" authtoken"
         if is_service_enabled s3api;then
             swift_pipeline+=" s3token"
+            iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:s3token auth_uri ${KEYSTONE_AUTH_URI_V3}
+            iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:s3token delay_auth_decision true
         fi
         swift_pipeline+=" keystoneauth"
     fi

From 65102e772e0fdbd5d3b0ac5eebb3179b461d6db0 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <sfinucan@redhat.com>
Date: Wed, 27 May 2020 14:24:09 +0100
Subject: [PATCH 1729/2409] nova: Remove configuration of '[scheduler] driver'

This option was deprecated in Ussuri [1] as nova no longer provided any
schedulers aside from the filter scheduler and the existence of
third-party schedulers was very unlikely. Stop configuring this and
simply use the default.

[1] https://review.opendev.org/#/c/707225/

Change-Id: Iabdd1d00e00ee269334f0fe0db265a97207e2dc6
Signed-off-by: Stephen Finucane <sfinucan@redhat.com>
---
 lib/nova | 9 +--------
 1 file changed, 1 insertion(+), 8 deletions(-)

diff --git a/lib/nova b/lib/nova
index a842a61fd0..4da0462dae 100644
--- a/lib/nova
+++ b/lib/nova
@@ -96,10 +96,6 @@ NOVA_ENABLE_CACHE=${NOVA_ENABLE_CACHE:-True}
 # NOTE: Set ``FORCE_CONFIG_DRIVE="False"`` to turn OFF config drive
 FORCE_CONFIG_DRIVE=${FORCE_CONFIG_DRIVE:-"False"}
 
-# Nova supports pluggable schedulers.  The default ``FilterScheduler``
-# should work in most cases.
-SCHEDULER=${SCHEDULER:-filter_scheduler}
-
 # The following NOVA_FILTERS contains SameHostFilter and DifferentHostFilter with
 # the default filters.
 NOVA_FILTERS="AvailabilityZoneFilter,ComputeFilter,ComputeCapabilitiesFilter,ImagePropertiesFilter,ServerGroupAntiAffinityFilter,ServerGroupAffinityFilter,SameHostFilter,DifferentHostFilter"
@@ -398,11 +394,8 @@ function create_nova_conf {
     fi
     iniset $NOVA_CONF wsgi api_paste_config "$NOVA_API_PASTE_INI"
     iniset $NOVA_CONF DEFAULT rootwrap_config "$NOVA_CONF_DIR/rootwrap.conf"
-    iniset $NOVA_CONF scheduler driver "$SCHEDULER"
     iniset $NOVA_CONF filter_scheduler enabled_filters "$NOVA_FILTERS"
-    if [[ $SCHEDULER == "filter_scheduler" ]]; then
-        iniset $NOVA_CONF scheduler workers "$API_WORKERS"
-    fi
+    iniset $NOVA_CONF scheduler workers "$API_WORKERS"
     iniset $NOVA_CONF neutron default_floating_pool "$PUBLIC_NETWORK_NAME"
     if [[ $SERVICE_IP_VERSION == 6 ]]; then
         iniset $NOVA_CONF DEFAULT my_ip "$HOST_IPV6"

From 90c6c65987341c4f21595439be0afbc314067a3c Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Fri, 29 May 2020 06:06:08 +0000
Subject: [PATCH 1730/2409] Updated from generate-devstack-plugins-list

Change-Id: I77d03c088a6b5019ac69048becfff3f24573a0b3
---
 doc/source/plugin-registry.rst | 2 --
 1 file changed, 2 deletions(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 42c5fc1324..05a19ac4fc 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -31,7 +31,6 @@ openstack/ceilometer                     `https://opendev.org/openstack/ceilomet
 openstack/ceilometer-powervm             `https://opendev.org/openstack/ceilometer-powervm <https://opendev.org/openstack/ceilometer-powervm>`__
 openstack/cinderlib                      `https://opendev.org/openstack/cinderlib <https://opendev.org/openstack/cinderlib>`__
 openstack/cloudkitty                     `https://opendev.org/openstack/cloudkitty <https://opendev.org/openstack/cloudkitty>`__
-openstack/congress                       `https://opendev.org/openstack/congress <https://opendev.org/openstack/congress>`__
 openstack/cyborg                         `https://opendev.org/openstack/cyborg <https://opendev.org/openstack/cyborg>`__
 openstack/designate                      `https://opendev.org/openstack/designate <https://opendev.org/openstack/designate>`__
 openstack/devstack-plugin-amqp1          `https://opendev.org/openstack/devstack-plugin-amqp1 <https://opendev.org/openstack/devstack-plugin-amqp1>`__
@@ -84,7 +83,6 @@ openstack/networking-l2gw                `https://opendev.org/openstack/networki
 openstack/networking-midonet             `https://opendev.org/openstack/networking-midonet <https://opendev.org/openstack/networking-midonet>`__
 openstack/networking-odl                 `https://opendev.org/openstack/networking-odl <https://opendev.org/openstack/networking-odl>`__
 openstack/networking-onos                `https://opendev.org/openstack/networking-onos <https://opendev.org/openstack/networking-onos>`__
-openstack/networking-ovn                 `https://opendev.org/openstack/networking-ovn <https://opendev.org/openstack/networking-ovn>`__
 openstack/networking-powervm             `https://opendev.org/openstack/networking-powervm <https://opendev.org/openstack/networking-powervm>`__
 openstack/networking-sfc                 `https://opendev.org/openstack/networking-sfc <https://opendev.org/openstack/networking-sfc>`__
 openstack/neutron                        `https://opendev.org/openstack/neutron <https://opendev.org/openstack/neutron>`__

From de41a18909a98b695642d0c4abc24d3d755cd8ff Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <j.harbott@x-ion.de>
Date: Fri, 29 May 2020 07:23:48 +0000
Subject: [PATCH 1731/2409] Update distros on the docs start page

Centos 7 is no longer supported, replace with Centos 8. Also Debian
hasn't been working for some time and progress in fixing it has stalled,
so drop it for now.

Change-Id: Ic1513b20f296978bca095c7aa79f022d7d9ab7ac
Closes-Bug: 1881183
---
 doc/source/index.rst | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/doc/source/index.rst b/doc/source/index.rst
index 7923cb88c7..8b8acde38c 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -38,8 +38,7 @@ Install Linux
 
 Start with a clean and minimal install of a Linux system. DevStack
 attempts to support the two latest LTS releases of Ubuntu, the
-latest/current Fedora version, CentOS/RHEL 7, as well as Debian and
-OpenSUSE.
+latest/current Fedora version, CentOS/RHEL 8 and OpenSUSE.
 
 If you do not have a preference, Ubuntu 18.04 (Bionic Beaver) is the
 most tested, and will probably go the smoothest.

From 312517d5101206b33d3c395d27ec93d385b7fd24 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 22 Jun 2018 22:23:29 +1000
Subject: [PATCH 1732/2409] Use uwsgi binary from path

All these uwsgi invocations assume that the uwsgi binary is in the
same directory as their project binaries are installed into (probably
/usr/bin).  That may not be correct -- for example if using a packaged
uwsgi on Fedora the binary will live in /usr/sbin/uwsgi (not /usr/bin
where the project files from pip are).

Switch invocations to just find it in the path.

Change-Id: I298e3374e9c84e209ffcabbaaacda17f8df19f4f
---
 lib/cinder         | 2 +-
 lib/glance         | 2 +-
 lib/keystone       | 2 +-
 lib/neutron        | 2 +-
 lib/neutron-legacy | 2 +-
 lib/nova           | 4 ++--
 lib/placement      | 2 +-
 7 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index fd960535d9..c2e55f9173 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -492,7 +492,7 @@ function start_cinder {
                 start_tls_proxy cinder '*' $CINDER_SERVICE_PORT $CINDER_SERVICE_HOST $CINDER_SERVICE_PORT_INT
             fi
         else
-            run_process "c-api" "$CINDER_BIN_DIR/uwsgi --procname-prefix cinder-api --ini $CINDER_UWSGI_CONF"
+            run_process "c-api" "$(which uwsgi) --procname-prefix cinder-api --ini $CINDER_UWSGI_CONF"
             cinder_url=$service_protocol://$SERVICE_HOST/volume/v3
         fi
     fi
diff --git a/lib/glance b/lib/glance
index 9398bd2daf..8ee422df43 100644
--- a/lib/glance
+++ b/lib/glance
@@ -392,7 +392,7 @@ function start_glance {
 
     run_process g-reg "$GLANCE_BIN_DIR/glance-registry --config-file=$GLANCE_CONF_DIR/glance-registry.conf"
     if [[ "$WSGI_MODE" == "uwsgi" ]]; then
-        run_process g-api "$GLANCE_BIN_DIR/uwsgi --procname-prefix glance-api --ini $GLANCE_UWSGI_CONF"
+        run_process g-api "$(which uwsgi) --procname-prefix glance-api --ini $GLANCE_UWSGI_CONF"
     else
         run_process g-api "$GLANCE_BIN_DIR/glance-api --config-dir=$GLANCE_CONF_DIR"
     fi
diff --git a/lib/keystone b/lib/keystone
index 366e6c7054..d2f72a37fe 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -523,7 +523,7 @@ function start_keystone {
         enable_apache_site keystone
         restart_apache_server
     else # uwsgi
-        run_process keystone "$KEYSTONE_BIN_DIR/uwsgi --procname-prefix keystone --ini $KEYSTONE_PUBLIC_UWSGI_CONF" ""
+        run_process keystone "$(which uwsgi) --procname-prefix keystone --ini $KEYSTONE_PUBLIC_UWSGI_CONF" ""
     fi
 
     echo "Waiting for keystone to start..."
diff --git a/lib/neutron b/lib/neutron
index 9e6a80cf08..885df97f7c 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -463,7 +463,7 @@ function start_neutron_api {
     done
 
     if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
-        run_process neutron-api "$NEUTRON_BIN_DIR/uwsgi --procname-prefix neutron-api --ini $NEUTRON_UWSGI_CONF"
+        run_process neutron-api "$(which uwsgi) --procname-prefix neutron-api --ini $NEUTRON_UWSGI_CONF"
         neutron_url=$service_protocol://$NEUTRON_SERVICE_HOST/networking/
         enable_service neutron-rpc-server
         run_process neutron-rpc-server "$NEUTRON_BIN_DIR/neutron-rpc-server $opts"
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 3d39d41b7e..4ddc05f2fe 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -477,7 +477,7 @@ function start_neutron_service_and_check {
     # Start the Neutron service
     if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
         enable_service neutron-api
-        run_process neutron-api "$NEUTRON_BIN_DIR/uwsgi --procname-prefix neutron-api --ini $NEUTRON_UWSGI_CONF"
+        run_process neutron-api "$(which uwsgi) --procname-prefix neutron-api --ini $NEUTRON_UWSGI_CONF"
         neutron_url=$Q_PROTOCOL://$Q_HOST/networking/
         enable_service neutron-rpc-server
         run_process neutron-rpc-server "$NEUTRON_BIN_DIR/neutron-rpc-server $cfg_file_options"
diff --git a/lib/nova b/lib/nova
index a842a61fd0..c7ffe7f4b3 100644
--- a/lib/nova
+++ b/lib/nova
@@ -864,7 +864,7 @@ function start_nova_api {
             start_tls_proxy nova '*' $NOVA_SERVICE_PORT $NOVA_SERVICE_HOST $NOVA_SERVICE_PORT_INT
         fi
     else
-        run_process "n-api" "$NOVA_BIN_DIR/uwsgi --procname-prefix nova-api --ini $NOVA_UWSGI_CONF"
+        run_process "n-api" "$(which uwsgi) --procname-prefix nova-api --ini $NOVA_UWSGI_CONF"
         nova_url=$service_protocol://$SERVICE_HOST/compute/v2.1/
     fi
 
@@ -955,7 +955,7 @@ function start_nova_rest {
     if [ "$NOVA_USE_MOD_WSGI" == "False" ]; then
         run_process n-api-meta "$NOVA_BIN_DIR/nova-api-metadata --config-file $compute_cell_conf"
     else
-        run_process n-api-meta "$NOVA_BIN_DIR/uwsgi --procname-prefix nova-api-meta --ini $NOVA_METADATA_UWSGI_CONF"
+        run_process n-api-meta "$(which uwsgi) --procname-prefix nova-api-meta --ini $NOVA_METADATA_UWSGI_CONF"
     fi
 
     export PATH=$old_path
diff --git a/lib/placement b/lib/placement
index 785b0ddfca..2a449bfa90 100644
--- a/lib/placement
+++ b/lib/placement
@@ -144,7 +144,7 @@ function install_placement {
 # start_placement_api() - Start the API processes ahead of other things
 function start_placement_api {
     if [[ "$WSGI_MODE" == "uwsgi" ]]; then
-        run_process "placement-api" "$PLACEMENT_BIN_DIR/uwsgi --procname-prefix placement --ini $PLACEMENT_UWSGI_CONF"
+        run_process "placement-api" "$(which uwsgi) --procname-prefix placement --ini $PLACEMENT_UWSGI_CONF"
     else
         enable_apache_site placement-api
         restart_apache_server

From 076c9f1b4bf405994f311aaf4aba3ab179f178e3 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Thu, 3 May 2018 16:13:38 +1000
Subject: [PATCH 1733/2409] Don't install uwsgi for keystone

This is already unconditionally installed via install_apache_uwsgi in
stack.sh; we don't need to install it again in keystone.  Since we
need workarounds on some platforms (see
I3bc5260e77cebe852cc8d70d9eddf84ef71d74bb) we only want to do this in
one place.

Change-Id: I40d84cbdf68cf6bb5cba143b6c0c126cdb8a84d4
---
 lib/keystone | 2 --
 1 file changed, 2 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index d2f72a37fe..1910f348b7 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -504,8 +504,6 @@ function install_keystone {
 
     if [ "$KEYSTONE_DEPLOY" == "mod_wsgi" ]; then
         install_apache_wsgi
-    elif [ "$KEYSTONE_DEPLOY" == "uwsgi" ]; then
-        pip_install uwsgi
     fi
 }
 

From 4f2a6171056f9dc3adaaf6752f559bd95a586428 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Herv=C3=A9=20Beraud?= <hberaud@redhat.com>
Date: Tue, 2 Jun 2020 20:10:56 +0200
Subject: [PATCH 1734/2409] Stop to use the __future__ module.

The __future__ module [1] was used in this context to ensure compatibility
between python 2 and python 3.

We previously dropped the support of python 2.7 [2] and now we only support
python 3 so we don't need to continue to use this module and the imports
listed below.

Imports commonly used and their related PEPs:
- `division` is related to PEP 238 [3]
- `print_function` is related to PEP 3105 [4]
- `unicode_literals` is related to PEP 3112 [5]
- `with_statement` is related to PEP 343 [6]
- `absolute_import` is related to PEP 328 [7]

[1] https://docs.python.org/3/library/__future__.html
[2] https://governance.openstack.org/tc/goals/selected/ussuri/drop-py27.html
[3] https://www.python.org/dev/peps/pep-0238
[4] https://www.python.org/dev/peps/pep-3105
[5] https://www.python.org/dev/peps/pep-3112
[6] https://www.python.org/dev/peps/pep-0343
[7] https://www.python.org/dev/peps/pep-0328

Change-Id: Icf8bd00b271f44b6bb0c932d6d49fe6de8a22537
---
 tools/worlddump.py | 2 --
 1 file changed, 2 deletions(-)

diff --git a/tools/worlddump.py b/tools/worlddump.py
index 0a4df52337..6a618f5ee6 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -17,8 +17,6 @@
 
 """Dump the state of the world for post mortem."""
 
-from __future__ import print_function
-
 import argparse
 import datetime
 from distutils import spawn

From c3db92b9d74704f5bf171a50103f5735e411222b Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <tkajinam@redhat.com>
Date: Thu, 4 Jun 2020 23:57:18 +0900
Subject: [PATCH 1735/2409] Doc: g-reg is no longer required

The glance-registry service was deprecated in Queeens release, and
no longer required.

Change-Id: I0d2b4604cd39d5131410b8038f92057128ca7b75
---
 doc/source/guides/devstack-with-lbaas-v2.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/guides/devstack-with-lbaas-v2.rst b/doc/source/guides/devstack-with-lbaas-v2.rst
index 669a70d0bb..7fde6f14f8 100644
--- a/doc/source/guides/devstack-with-lbaas-v2.rst
+++ b/doc/source/guides/devstack-with-lbaas-v2.rst
@@ -62,7 +62,7 @@ Edit your ``/opt/stack/devstack/local.conf`` to look like
     ENABLED_SERVICES+=,n-api,n-crt,n-cpu,n-cond,n-sch,n-api-meta,n-sproxy
     ENABLED_SERVICES+=,placement-api,placement-client
     # Glance
-    ENABLED_SERVICES+=,g-api,g-reg
+    ENABLED_SERVICES+=,g-api
     # Neutron
     ENABLED_SERVICES+=,q-svc,q-agt,q-dhcp,q-l3,q-meta,neutron
     ENABLED_SERVICES+=,octavia,o-cw,o-hk,o-hm,o-api

From c3b58f5335fb3545bf49b5d542ef9ed702de43c8 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Mon, 8 Jun 2020 11:58:29 +0200
Subject: [PATCH 1736/2409] Fix typos in networking document

The FLOATING_RANGE variable should specify the network address of the
used prefix for clarity.

Change-Id: I547bd42d8bdc5f0f2001d47f2d5b43729773b1bc
Closes-Bug: 1870204
---
 doc/source/networking.rst | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/source/networking.rst b/doc/source/networking.rst
index 74010cd01a..e65c7ef195 100644
--- a/doc/source/networking.rst
+++ b/doc/source/networking.rst
@@ -40,7 +40,7 @@ updates. Tempest tests will work in this environment.
 Locally Accessible Guests
 =========================
 
-If you want to make you guests accessible from other machines on your
+If you want to make your guests accessible from other machines on your
 network, we have to connect ``br-ex`` to a physical interface.
 
 Dedicated Guest Interface
@@ -81,7 +81,7 @@ of addresses, and have them all exactly correct.
    [[local|localrc]]
    PUBLIC_INTERFACE=eth0
    HOST_IP=10.42.0.52
-   FLOATING_RANGE=10.42.0.52/24
+   FLOATING_RANGE=10.42.0.0/24
    PUBLIC_NETWORK_GATEWAY=10.42.0.1
    Q_FLOATING_ALLOCATION_POOL=start=10.42.0.250,end=10.42.0.254
 

From 729546a1adfa10c8591e834cc85004d977e1c3dd Mon Sep 17 00:00:00 2001
From: Martin Kopec <mkopec@redhat.com>
Date: Thu, 12 Mar 2020 10:03:38 +0000
Subject: [PATCH 1737/2409] Remove tempest deprecated img_dir option

Tempest option scenario.img_dir has been deprecated more than 4 years, it's
time to remove it from devstack.
img_file option should contain the full path to the image.
This patch removes setting of img_dir option and makes img_file
one contain the full path of an image.

Change-Id: I71102095f3603915f0bc7d21f2e18c4eac4e95ec
Depends-On: https://review.opendev.org/#/c/710996/
Related-Bug: #1393881
---
 lib/tempest | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 05fcb1f1f3..0d6bdc9dbc 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -433,8 +433,7 @@ function configure_tempest {
         SCENARIO_IMAGE_DIR=${SCENARIO_IMAGE_DIR:-$FILES}
         SCENARIO_IMAGE_FILE=$DEFAULT_IMAGE_FILE_NAME
     fi
-    iniset $TEMPEST_CONFIG scenario img_dir $SCENARIO_IMAGE_DIR
-    iniset $TEMPEST_CONFIG scenario img_file $SCENARIO_IMAGE_FILE
+    iniset $TEMPEST_CONFIG scenario img_file $SCENARIO_IMAGE_DIR/$SCENARIO_IMAGE_FILE
 
     # If using provider networking, use the physical network for validation rather than private
     TEMPEST_SSH_NETWORK_NAME=$PRIVATE_NETWORK_NAME

From 84737ebd96327310ec5f8f7c312aeae12cbeb234 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Mon, 15 Jun 2020 09:48:46 +0200
Subject: [PATCH 1738/2409] Work around uwsgi breakage

uwsgi broke installation from source with their latest release [0].
Since we want to move away from source installation anyway, make
grenade based jobs non-voting for the moment so that we can backport
[1] properly.

[0] https://bugs.launchpad.net/bugs/1883468
[1] https://review.opendev.org/577955

Related-Bug: 1883468
Change-Id: I8e47bb7c70031a4df7f1af6b811df4c6cc784b2a
---
 .zuul.yaml | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 602975a165..0dc5f3e09d 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -628,10 +628,12 @@
             voting: false
             irrelevant-files: *dsvm-irrelevant-files
         - grenade:
+            voting: false
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
         - neutron-grenade-multinode:
+            voting: false
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
@@ -668,18 +670,18 @@
         - devstack-multinode
         - devstack-unit-tests
         - openstack-tox-bashate
-        - neutron-grenade-multinode:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
+        # - neutron-grenade-multinode:
+        #     irrelevant-files:
+        #       - ^.*\.rst$
+        #       - ^doc/.*$
         - neutron-tempest-linuxbridge:
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
-        - grenade:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
+        # - grenade:
+        #     irrelevant-files:
+        #       - ^.*\.rst$
+        #       - ^doc/.*$
         - openstacksdk-functional-devstack:
             irrelevant-files:
               - ^.*\.rst$

From 2d903568ed4158aa668bbda6986307a8780c71a4 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Thu, 3 May 2018 10:51:30 +1000
Subject: [PATCH 1739/2409] Use packaged uwsgi on Fedora and Ubuntu

Building uwsgi from source was a workaround that was introduced a long
time ago, it doesn't seem like it is needed anymore and will actually
fail for Ubuntu 20.04.

Also it doesn't match what will happen for most real-world
installations, so let's try to get back to using distro packages. We'll
still use the source install for RHEL/Centos, it remains to be tested
whether we can get back to using distro versions there, too.

Change-Id: I82f539bfa533349293dd5a8ce309c9cc0ffb0393
---
 lib/apache | 68 +++++++++++++++++++++++++++++++++++++-----------------
 1 file changed, 47 insertions(+), 21 deletions(-)

diff --git a/lib/apache b/lib/apache
index 84cec73234..a31188bebb 100644
--- a/lib/apache
+++ b/lib/apache
@@ -82,26 +82,52 @@ function install_apache_uwsgi {
         apxs="apxs"
     fi
 
-    # Ubuntu xenial is back level on uwsgi so the proxy doesn't
-    # actually work. Hence we have to build from source for now.
+    # This varies based on packaged/installed.  If we've
+    # pip_installed, then the pip setup will only build a "python"
+    # module that will be either python2 or python3 depending on what
+    # it was built with.
     #
-    # Centos 7 actually has the module in epel, but there was a big
-    # push to disable epel by default. As such, compile from source
-    # there as well.
-
-    local dir
-    dir=$(mktemp -d)
-    pushd $dir
-    pip_install uwsgi
-    pip download uwsgi -c $REQUIREMENTS_DIR/upper-constraints.txt
-    local uwsgi
-    uwsgi=$(ls uwsgi*)
-    tar xvf $uwsgi
-    cd uwsgi*/apache2
-    sudo $apxs -i -c mod_proxy_uwsgi.c
-    popd
-    # delete the temp directory
-    sudo rm -rf $dir
+    # For package installs, the distro ships both plugins and you need
+    # to select the right one ... it will not be autodetected.
+    if python3_enabled; then
+        UWSGI_PYTHON_PLUGIN=python3
+    else
+        UWSGI_PYTHON_PLUGIN=python
+    fi
+
+    if is_ubuntu; then
+        install_package uwsgi \
+                        uwsgi-plugin-python \
+                        uwsgi-plugin-python3 \
+                        libapache2-mod-proxy-uwsgi
+    elif [[ $os_VENDOR == "Fedora" ]]; then
+        # Note httpd comes with mod_proxy_uwsgi and it is loaded by
+        # default; the mod_proxy_uwsgi package actually conflicts now.
+        # See:
+        #  https://bugzilla.redhat.com/show_bug.cgi?id=1574335
+        #
+        # Thus there is nothing else to do after this install
+        install_package uwsgi \
+                        uwsgi-plugin-python3
+    else
+        # Centos actually has the module in epel, but there was a big
+        # push to disable epel by default. As such, compile from source
+        # there.
+        local dir
+        dir=$(mktemp -d)
+        pushd $dir
+        pip_install uwsgi
+        pip download uwsgi -c $REQUIREMENTS_DIR/upper-constraints.txt
+        local uwsgi
+        uwsgi=$(ls uwsgi*)
+        tar xvf $uwsgi
+        cd uwsgi*/apache2
+        sudo $apxs -i -c mod_proxy_uwsgi.c
+        popd
+        # delete the temp directory
+        sudo rm -rf $dir
+        UWSGI_PYTHON_PLUGIN=python
+    fi
 
     if is_ubuntu || is_suse ; then
         # we've got to enable proxy and proxy_uwsgi for this to work
@@ -265,7 +291,7 @@ function write_uwsgi_config {
     # configured after graceful shutdown
     iniset "$file" uwsgi worker-reload-mercy $WORKER_TIMEOUT
     iniset "$file" uwsgi enable-threads true
-    iniset "$file" uwsgi plugins python
+    iniset "$file" uwsgi plugins http,${UWSGI_PYTHON_PLUGIN}
     # uwsgi recommends this to prevent thundering herd on accept.
     iniset "$file" uwsgi thunder-lock true
     # Set hook to trigger graceful shutdown on SIGTERM
@@ -318,7 +344,7 @@ function write_local_uwsgi_http_config {
     iniset "$file" uwsgi die-on-term true
     iniset "$file" uwsgi exit-on-reload false
     iniset "$file" uwsgi enable-threads true
-    iniset "$file" uwsgi plugins python
+    iniset "$file" uwsgi plugins http,${UWSGI_PYTHON_PLUGIN}
     # uwsgi recommends this to prevent thundering herd on accept.
     iniset "$file" uwsgi thunder-lock true
     # Set hook to trigger graceful shutdown on SIGTERM

From a267c5f477d4b037a9f466305db8c8b93e105204 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Mon, 15 Jun 2020 09:53:27 +0200
Subject: [PATCH 1740/2409] Revert "Work around uwsgi breakage"

This reverts commit 84737ebd96327310ec5f8f7c312aeae12cbeb234.

Change-Id: I1544c1ad9cfe3ff199153736acadba0761b51fc4
---
 .zuul.yaml | 18 ++++++++----------
 1 file changed, 8 insertions(+), 10 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 0dc5f3e09d..602975a165 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -628,12 +628,10 @@
             voting: false
             irrelevant-files: *dsvm-irrelevant-files
         - grenade:
-            voting: false
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
         - neutron-grenade-multinode:
-            voting: false
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
@@ -670,18 +668,18 @@
         - devstack-multinode
         - devstack-unit-tests
         - openstack-tox-bashate
-        # - neutron-grenade-multinode:
-        #     irrelevant-files:
-        #       - ^.*\.rst$
-        #       - ^doc/.*$
+        - neutron-grenade-multinode:
+            irrelevant-files:
+              - ^.*\.rst$
+              - ^doc/.*$
         - neutron-tempest-linuxbridge:
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
-        # - grenade:
-        #     irrelevant-files:
-        #       - ^.*\.rst$
-        #       - ^doc/.*$
+        - grenade:
+            irrelevant-files:
+              - ^.*\.rst$
+              - ^doc/.*$
         - openstacksdk-functional-devstack:
             irrelevant-files:
               - ^.*\.rst$

From 10c3ffd26557f1921841e456b003a77f6fb11948 Mon Sep 17 00:00:00 2001
From: Andreas Jaeger <aj@suse.com>
Date: Mon, 15 Jun 2020 10:03:42 +0200
Subject: [PATCH 1741/2409] Handle uwsgi install for openSUSE

Add packages for openSUSE distribution for installation of uwsgi.

Change-Id: I2ce8959460a79b6472bd9dd59edd7d94eccbacf5
---
 lib/apache | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/apache b/lib/apache
index a31188bebb..41c2e3d8dd 100644
--- a/lib/apache
+++ b/lib/apache
@@ -109,6 +109,10 @@ function install_apache_uwsgi {
         # Thus there is nothing else to do after this install
         install_package uwsgi \
                         uwsgi-plugin-python3
+    elif [[ $os_VENDOR =~ openSUSE ]]; then
+        install_package uwsgi \
+                        uwsgi-python3 \
+                        apache2-mod_uwsgi
     else
         # Centos actually has the module in epel, but there was a big
         # push to disable epel by default. As such, compile from source

From 66c812d392a922a5b76780a515b0a065b6fa7cdf Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Tue, 16 Jun 2020 12:13:45 +0200
Subject: [PATCH 1742/2409] Remove neutron-fwaas from the jobs' required
 project

Neutron-fwaas is going to be deprecated in master branch with [1].

[1] https://review.opendev.org/#/c/735828/

Change-Id: I513ef36e681fc3f9e5aa9f81c9aedba716366729
---
 doc/source/plugin-registry.rst | 2 --
 stackrc                        | 4 ----
 2 files changed, 6 deletions(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 05a19ac4fc..3ab4db43ea 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -87,8 +87,6 @@ openstack/networking-powervm             `https://opendev.org/openstack/networki
 openstack/networking-sfc                 `https://opendev.org/openstack/networking-sfc <https://opendev.org/openstack/networking-sfc>`__
 openstack/neutron                        `https://opendev.org/openstack/neutron <https://opendev.org/openstack/neutron>`__
 openstack/neutron-dynamic-routing        `https://opendev.org/openstack/neutron-dynamic-routing <https://opendev.org/openstack/neutron-dynamic-routing>`__
-openstack/neutron-fwaas                  `https://opendev.org/openstack/neutron-fwaas <https://opendev.org/openstack/neutron-fwaas>`__
-openstack/neutron-fwaas-dashboard        `https://opendev.org/openstack/neutron-fwaas-dashboard <https://opendev.org/openstack/neutron-fwaas-dashboard>`__
 openstack/neutron-tempest-plugin         `https://opendev.org/openstack/neutron-tempest-plugin <https://opendev.org/openstack/neutron-tempest-plugin>`__
 openstack/neutron-vpnaas                 `https://opendev.org/openstack/neutron-vpnaas <https://opendev.org/openstack/neutron-vpnaas>`__
 openstack/neutron-vpnaas-dashboard       `https://opendev.org/openstack/neutron-vpnaas-dashboard <https://opendev.org/openstack/neutron-vpnaas-dashboard>`__
diff --git a/stackrc b/stackrc
index 07c4c4b472..e323cee843 100644
--- a/stackrc
+++ b/stackrc
@@ -281,10 +281,6 @@ KEYSTONE_BRANCH=${KEYSTONE_BRANCH:-$TARGET_BRANCH}
 NEUTRON_REPO=${NEUTRON_REPO:-${GIT_BASE}/openstack/neutron.git}
 NEUTRON_BRANCH=${NEUTRON_BRANCH:-$TARGET_BRANCH}
 
-# neutron fwaas service
-NEUTRON_FWAAS_REPO=${NEUTRON_FWAAS_REPO:-${GIT_BASE}/openstack/neutron-fwaas.git}
-NEUTRON_FWAAS_BRANCH=${NEUTRON_FWAAS_BRANCH:-$TARGET_BRANCH}
-
 # compute service
 NOVA_REPO=${NOVA_REPO:-${GIT_BASE}/openstack/nova.git}
 NOVA_BRANCH=${NOVA_BRANCH:-$TARGET_BRANCH}

From 0ae5787611897a81d894d0f53b1ed63c452fe5ee Mon Sep 17 00:00:00 2001
From: Abhishek Kekane <akekane@redhat.com>
Date: Mon, 17 Feb 2020 06:11:15 +0000
Subject: [PATCH 1743/2409] Remove glance registry configuration

Glance has deprecated registry serivce for long and now efforts are placed to
remove the registry code from the glance repo.

To avoid regression on other projects, gate jobs etc. removing
configuring registry service from the devstack.

Change-Id: I6a7be6bdc97acc43c8e985060aeea05d92642e80
---
 lib/glance | 40 +---------------------------------------
 1 file changed, 1 insertion(+), 39 deletions(-)

diff --git a/lib/glance b/lib/glance
index 8ee422df43..fee2cfd80f 100644
--- a/lib/glance
+++ b/lib/glance
@@ -67,9 +67,7 @@ GLANCE_TASKS_DIR=${GLANCE_MULTISTORE_FILE_IMAGE_DIR:=$DATA_DIR/os_glance_tasks_s
 
 GLANCE_CONF_DIR=${GLANCE_CONF_DIR:-/etc/glance}
 GLANCE_METADEF_DIR=$GLANCE_CONF_DIR/metadefs
-GLANCE_REGISTRY_CONF=$GLANCE_CONF_DIR/glance-registry.conf
 GLANCE_API_CONF=$GLANCE_CONF_DIR/glance-api.conf
-GLANCE_REGISTRY_PASTE_INI=$GLANCE_CONF_DIR/glance-registry-paste.ini
 GLANCE_API_PASTE_INI=$GLANCE_CONF_DIR/glance-api-paste.ini
 GLANCE_CACHE_CONF=$GLANCE_CONF_DIR/glance-cache.conf
 GLANCE_SCHEMA_JSON=$GLANCE_CONF_DIR/schema-image.json
@@ -88,8 +86,6 @@ GLANCE_SERVICE_PORT=${GLANCE_SERVICE_PORT:-9292}
 GLANCE_SERVICE_PORT_INT=${GLANCE_SERVICE_PORT_INT:-19292}
 GLANCE_HOSTPORT=${GLANCE_HOSTPORT:-$GLANCE_SERVICE_HOST:$GLANCE_SERVICE_PORT}
 GLANCE_SERVICE_PROTOCOL=${GLANCE_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
-GLANCE_REGISTRY_PORT=${GLANCE_REGISTRY_PORT:-9191}
-GLANCE_REGISTRY_PORT_INT=${GLANCE_REGISTRY_PORT_INT:-19191}
 GLANCE_UWSGI=$GLANCE_BIN_DIR/glance-wsgi-api
 GLANCE_UWSGI_CONF=$GLANCE_CONF_DIR/glance-uwsgi.ini
 # If wsgi mode is uwsgi run glance under uwsgi, else default to eventlet
@@ -135,31 +131,10 @@ function cleanup_glance {
 function configure_glance {
     sudo install -d -o $STACK_USER $GLANCE_CONF_DIR $GLANCE_METADEF_DIR
 
-    # Set non-default configuration options for registry
-    iniset $GLANCE_REGISTRY_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-    iniset $GLANCE_REGISTRY_CONF DEFAULT bind_host $GLANCE_SERVICE_LISTEN_ADDRESS
-    iniset $GLANCE_REGISTRY_CONF DEFAULT workers $API_WORKERS
+    # Set non-default configuration options for the API server
     local dburl
     dburl=`database_connection_url glance`
-    iniset $GLANCE_REGISTRY_CONF database connection $dburl
-    iniset $GLANCE_REGISTRY_CONF DEFAULT use_syslog $SYSLOG
-    iniset $GLANCE_REGISTRY_CONF paste_deploy flavor keystone
-    configure_keystone_authtoken_middleware $GLANCE_REGISTRY_CONF glance
-    iniset $GLANCE_REGISTRY_CONF oslo_messaging_notifications driver messagingv2
-    iniset_rpc_backend glance $GLANCE_REGISTRY_CONF
-    iniset $GLANCE_REGISTRY_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
-
-    # Configure multiple stores
-    if [[ "$GLANCE_ENABLE_MULTIPLE_STORES" == "True" ]]; then
-        local store enabled_backends
-        enabled_backends=""
-        for store in $(echo $GLANCE_MULTIPLE_FILE_STORES | tr "," "\n"); do
-            enabled_backends+="${store}:file,"
-        done
-        iniset $GLANCE_API_CONF DEFAULT enabled_backends ${enabled_backends::-1}
-    fi
 
-    # Set non-default configuration options for the API server
     iniset $GLANCE_API_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
     iniset $GLANCE_API_CONF database connection $dburl
     iniset $GLANCE_API_CONF DEFAULT use_syslog $SYSLOG
@@ -198,7 +173,6 @@ function configure_glance {
         # Store specific configs
         iniset $GLANCE_API_CONF glance_store filesystem_store_datadir $GLANCE_IMAGE_DIR/
     fi
-    iniset $GLANCE_API_CONF DEFAULT registry_host $(ipv6_unquote $GLANCE_SERVICE_HOST)
 
     # CORS feature support - to allow calls from Horizon by default
     if [ -n "$GLANCE_CORS_ALLOWED_ORIGIN" ]; then
@@ -240,21 +214,13 @@ function configure_glance {
 
     if is_service_enabled tls-proxy; then
         iniset $GLANCE_API_CONF DEFAULT bind_port $GLANCE_SERVICE_PORT_INT
-        iniset $GLANCE_REGISTRY_CONF DEFAULT bind_port $GLANCE_REGISTRY_PORT_INT
 
         iniset $GLANCE_API_CONF keystone_authtoken identity_uri $KEYSTONE_AUTH_URI
-        iniset $GLANCE_REGISTRY_CONF keystone_authtoken identity_uri $KEYSTONE_AUTH_URI
-    fi
-
-    if is_service_enabled tls-proxy; then
-        iniset $GLANCE_API_CONF DEFAULT registry_client_protocol https
     fi
 
     # Format logging
     setup_logging $GLANCE_API_CONF
-    setup_logging $GLANCE_REGISTRY_CONF
 
-    cp -p $GLANCE_DIR/etc/glance-registry-paste.ini $GLANCE_REGISTRY_PASTE_INI
     cp -p $GLANCE_DIR/etc/glance-api-paste.ini $GLANCE_API_PASTE_INI
 
     # Set non-default configuration options for the glance-cache
@@ -265,7 +231,6 @@ function configure_glance {
     iniset $GLANCE_CACHE_CONF DEFAULT admin_tenant_name $SERVICE_PROJECT_NAME
     iniset $GLANCE_CACHE_CONF DEFAULT admin_user glance
     iniset $GLANCE_CACHE_CONF DEFAULT admin_password $SERVICE_PASSWORD
-    iniset $GLANCE_CACHE_CONF DEFAULT registry_host $(ipv6_unquote $GLANCE_SERVICE_HOST)
 
     # Store specific confs
     iniset $GLANCE_CACHE_CONF glance_store filesystem_store_datadir $GLANCE_IMAGE_DIR/
@@ -387,10 +352,8 @@ function start_glance {
         if [[ "$WSGI_MODE" != "uwsgi" ]]; then
             start_tls_proxy glance-service '*' $GLANCE_SERVICE_PORT $GLANCE_SERVICE_HOST $GLANCE_SERVICE_PORT_INT
         fi
-        start_tls_proxy glance-registry '*' $GLANCE_REGISTRY_PORT $GLANCE_SERVICE_HOST $GLANCE_REGISTRY_PORT_INT
     fi
 
-    run_process g-reg "$GLANCE_BIN_DIR/glance-registry --config-file=$GLANCE_CONF_DIR/glance-registry.conf"
     if [[ "$WSGI_MODE" == "uwsgi" ]]; then
         run_process g-api "$(which uwsgi) --procname-prefix glance-api --ini $GLANCE_UWSGI_CONF"
     else
@@ -406,7 +369,6 @@ function start_glance {
 # stop_glance() - Stop running processes
 function stop_glance {
     stop_process g-api
-    stop_process g-reg
 }
 
 # Restore xtrace

From 744f50b970bf10f06e9d52de0b57d74ddcb18467 Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Tue, 16 Jun 2020 22:28:28 +0200
Subject: [PATCH 1744/2409] Add neutron-ovn-tempest-ovs-release job to the
 check queue

During the Victoria cycle we plan to switch default Neutron backend in
Devstack from OVS to OVN.
As first step before we will start discussion about this change with
whole community, we want to add tempest ovn based neutron job to
the devstack check queue so that we can keep verifying that with
devstack changes.

Change-Id: I8484baa7398b28ed5ef62f86b55022c7d8703f56
---
 .zuul.yaml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index 8c18e7155d..e30bf22ff5 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -632,6 +632,11 @@
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
+        - neutron-ovn-tempest-ovs-release:
+            voting: false
+            irrelevant-files:
+              - ^.*\.rst$
+              - ^doc/.*$
         - tempest-multinode-full-py3:
             voting: false
             irrelevant-files:

From c2c2b6b415a4289ab740e7506f68e820ecbc5818 Mon Sep 17 00:00:00 2001
From: Federico Ressi <fressi@redhat.com>
Date: Mon, 15 Jun 2020 12:48:38 +0200
Subject: [PATCH 1745/2409] Handle uwsgi install for CentOS/RHEL

Change-Id: Ifa876b3e5f89258f40055fa7ce03f5e9c601771c
---
 lib/apache | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/lib/apache b/lib/apache
index 41c2e3d8dd..a3e9f95d4e 100644
--- a/lib/apache
+++ b/lib/apache
@@ -100,7 +100,7 @@ function install_apache_uwsgi {
                         uwsgi-plugin-python \
                         uwsgi-plugin-python3 \
                         libapache2-mod-proxy-uwsgi
-    elif [[ $os_VENDOR == "Fedora" ]]; then
+    elif is_fedora; then
         # Note httpd comes with mod_proxy_uwsgi and it is loaded by
         # default; the mod_proxy_uwsgi package actually conflicts now.
         # See:
@@ -114,9 +114,7 @@ function install_apache_uwsgi {
                         uwsgi-python3 \
                         apache2-mod_uwsgi
     else
-        # Centos actually has the module in epel, but there was a big
-        # push to disable epel by default. As such, compile from source
-        # there.
+        # Compile uwsgi from source.
         local dir
         dir=$(mktemp -d)
         pushd $dir

From 264d2a2e5fecd7ae94a4a71087ca93ea9cc25109 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Fri, 19 Jun 2020 10:31:38 -0500
Subject: [PATCH 1746/2409] Move process-stackviz role from Tempest to Devstack

process-stackviz role currently defined in Tempest repo[1] and used
in tempest jobs. Issue with having it in branchless Tempest is that any
fix in that role cannot be backported to older Tempest. Also stackviz is
not Tempest things it is only used by Tempest jobs.

Stackviz can be considered as a service similar to Tempest so inatlling it in
Devstack side make sense. Also that will give us advantage to handle the
branch specific fixes or backpoting the fixes.

This can solve the current issues we are facing on rocky branch
- https://zuul.opendev.org/t/openstack/build/c1e2da80537448bfb24331fb4198a931/console#4/0/29/controller

[1] https://opendev.org/openstack/tempest/src/branch/master/roles/process-stackviz

Change-Id: I0ba1fd05c6391cd8bb978119ecfbb891def2d497
---
 roles/process-stackviz/README.rst         | 22 +++++++
 roles/process-stackviz/defaults/main.yaml |  3 +
 roles/process-stackviz/tasks/main.yaml    | 70 +++++++++++++++++++++++
 3 files changed, 95 insertions(+)
 create mode 100644 roles/process-stackviz/README.rst
 create mode 100644 roles/process-stackviz/defaults/main.yaml
 create mode 100644 roles/process-stackviz/tasks/main.yaml

diff --git a/roles/process-stackviz/README.rst b/roles/process-stackviz/README.rst
new file mode 100644
index 0000000000..a8447d2355
--- /dev/null
+++ b/roles/process-stackviz/README.rst
@@ -0,0 +1,22 @@
+Generate stackviz report.
+
+Generate stackviz report using subunit and dstat data, using
+the stackviz archive embedded in test images.
+
+**Role Variables**
+
+.. zuul:rolevar:: devstack_base_dir
+   :default: /opt/stack
+
+   The devstack base directory.
+
+.. zuul:rolevar:: stage_dir
+   :default: "{{ ansible_user_dir }}"
+
+   The stage directory where the input data can be found and
+   the output will be produced.
+
+.. zuul:rolevar:: zuul_work_dir
+   :default: {{ devstack_base_dir }}/tempest
+
+   Directory to work in. It has to be a fully qualified path.
diff --git a/roles/process-stackviz/defaults/main.yaml b/roles/process-stackviz/defaults/main.yaml
new file mode 100644
index 0000000000..f3bc32b149
--- /dev/null
+++ b/roles/process-stackviz/defaults/main.yaml
@@ -0,0 +1,3 @@
+devstack_base_dir: /opt/stack
+stage_dir: "{{ ansible_user_dir }}"
+zuul_work_dir: "{{ devstack_base_dir }}/tempest"
diff --git a/roles/process-stackviz/tasks/main.yaml b/roles/process-stackviz/tasks/main.yaml
new file mode 100644
index 0000000000..c51c66cdb3
--- /dev/null
+++ b/roles/process-stackviz/tasks/main.yaml
@@ -0,0 +1,70 @@
+- name: Devstack checks if stackviz archive exists
+  stat:
+    path: "/opt/cache/files/stackviz-latest.tar.gz"
+  register: stackviz_archive
+
+- debug:
+    msg: "Stackviz archive could not be found in /opt/cache/files/stackviz-latest.tar.gz"
+  when: not stackviz_archive.stat.exists
+
+- name: Check if subunit data exists
+  stat:
+    path: "{{ zuul_work_dir }}/testrepository.subunit"
+  register: subunit_input
+
+- debug:
+    msg: "Subunit file could not be found at {{ zuul_work_dir }}/testrepository.subunit"
+  when: not subunit_input.stat.exists
+
+- name: Install stackviz
+  when:
+    - stackviz_archive.stat.exists
+    - subunit_input.stat.exists
+  block:
+    - include_role:
+        name: ensure-pip
+
+    - pip:
+        name: "file://{{ stackviz_archive.stat.path }}"
+        virtualenv: /tmp/stackviz
+        virtualenv_command: '{{ ensure_pip_virtualenv_command }}'
+        extra_args: -U
+
+- name: Deploy stackviz static html+js
+  command: cp -pR /tmp/stackviz/share/stackviz-html {{ stage_dir }}/stackviz
+  when:
+    - stackviz_archive.stat.exists
+    - subunit_input.stat.exists
+
+- name: Check if dstat data exists
+  stat:
+    path: "{{ devstack_base_dir }}/logs/dstat-csv.log"
+  register: dstat_input
+  when:
+    - stackviz_archive.stat.exists
+    - subunit_input.stat.exists
+
+- name: Run stackviz with dstat
+  shell: |
+    cat {{ subunit_input.stat.path }} | \
+      /tmp/stackviz/bin/stackviz-export \
+        --dstat "{{ devstack_base_dir }}/logs/dstat-csv.log" \
+        --env --stdin \
+        {{ stage_dir }}/stackviz/data
+  when:
+    - stackviz_archive.stat.exists
+    - subunit_input.stat.exists
+    - dstat_input.stat.exists
+  failed_when: False
+
+- name: Run stackviz without dstat
+  shell: |
+    cat {{ subunit_input.stat.path }} | \
+      /tmp/stackviz/bin/stackviz-export \
+        --env --stdin \
+        {{ stage_dir }}/stackviz/data
+  when:
+    - stackviz_archive.stat.exists
+    - subunit_input.stat.exists
+    - not dstat_input.stat.exists
+  failed_when: False

From f1ed7c77c50ac28cb58c9f7ed885c6a3e0a75403 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Thu, 11 Jun 2020 05:51:26 +0000
Subject: [PATCH 1747/2409] Use python3 pip module instead of pip binary

Focal only provides a pip3 binary, no pip3.8. Instead of working around
that with a symlink, use the module instead.

Add version information output for this variant.

Change-Id: I7af194ecc40e4d43c10ce067a661bb6ab4ca37d4
---
 files/debs/general   |  1 +
 files/rpms/general   |  1 +
 inc/python           |  4 ++--
 tools/install_pip.sh | 17 +++++++++++------
 4 files changed, 15 insertions(+), 8 deletions(-)

diff --git a/files/debs/general b/files/debs/general
index 2d8cd80473..4bf1ff4039 100644
--- a/files/debs/general
+++ b/files/debs/general
@@ -27,6 +27,7 @@ openssl
 pkg-config
 psmisc
 python3-dev
+python3-pip
 python3-venv
 tar
 tcpdump
diff --git a/files/rpms/general b/files/rpms/general
index 303510cbd9..c42ce529e7 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -24,6 +24,7 @@ pkgconfig
 postgresql-devel  # psycopg2
 psmisc
 python3-devel
+python3-pip
 redhat-rpm-config # missing dep for gcc hardening flags, see rhbz#1217376
 systemd-devel # for systemd-python
 tar
diff --git a/inc/python b/inc/python
index dd77296049..08f9959d5c 100644
--- a/inc/python
+++ b/inc/python
@@ -174,7 +174,7 @@ function pip_install {
         if python3_enabled; then
             echo "Using python $PYTHON3_VERSION to install $package_dir because python3_enabled=True"
             sudo_pip="$sudo_pip LC_ALL=en_US.UTF-8"
-            cmd_pip=$(get_pip_command $PYTHON3_VERSION)
+            cmd_pip="python$PYTHON3_VERSION -m pip"
         else
             echo "Using python $PYTHON2_VERSION to install $package_dir because python3_enabled=False"
             cmd_pip=$(get_pip_command $PYTHON2_VERSION)
@@ -217,7 +217,7 @@ function pip_uninstall {
         local sudo_pip="sudo -H"
         if python3_enabled; then
             sudo_pip="$sudo_pip LC_ALL=en_US.UTF-8"
-            cmd_pip=$(get_pip_command $PYTHON3_VERSION)
+            cmd_pip="python$PYTHON3_VERSION -m pip"
         else
             cmd_pip=$(get_pip_command $PYTHON2_VERSION)
         fi
diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index 5eb538ce84..517669e282 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -5,7 +5,7 @@
 # Update pip and friends to a known common version
 
 # Assumptions:
-# - if USE_PYTHON3=True, PYTHON3_VERSION refers to a version already installed
+# - PYTHON3_VERSION refers to a version already installed
 
 set -o errexit
 
@@ -53,6 +53,8 @@ function get_versions {
     else
         echo "pip: Not Installed"
     fi
+    # Show python3 module version
+    python${PYTHON3_VERSION} -m pip --version
 }
 
 
@@ -125,7 +127,14 @@ function configure_pypi_alternative_url {
 # Show starting versions
 get_versions
 
-# Do pip
+if [[ -n $PYPI_ALTERNATIVE_URL ]]; then
+    configure_pypi_alternative_url
+fi
+
+# Just use system pkgs on Focal
+if [[ "$DISTRO" == focal ]]; then
+    exit 0
+fi
 
 # Eradicate any and all system packages
 
@@ -143,10 +152,6 @@ fi
 
 install_get_pip
 
-if [[ -n $PYPI_ALTERNATIVE_URL ]]; then
-    configure_pypi_alternative_url
-fi
-
 set -x
 
 # Note setuptools is part of requirements.txt and we want to make sure

From 3480093b937b45e05f12d2af9df26d076f05067e Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <j.harbott@x-ion.de>
Date: Thu, 13 Feb 2020 09:38:35 +0000
Subject: [PATCH 1748/2409] Make devstack run on focal (Ubuntu LTS 20.04)

- Add a nodeset and a platform job
- Drop uwsgi-py2 pkg that no longer exists
- Blacklist tests that are currently failing

Change-Id: Ib4416dc2f5e003fd770f5240a8f78213c56af8e6
---
 .zuul.yaml | 19 +++++++++++++++++++
 lib/apache |  9 +++++----
 stack.sh   |  2 +-
 3 files changed, 25 insertions(+), 5 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index f3610afba0..5cb99ab6b6 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -8,6 +8,16 @@
         nodes:
           - controller
 
+- nodeset:
+    name: openstack-single-node-focal
+    nodes:
+      - name: controller
+        label: ubuntu-focal
+    groups:
+      - name: tempest
+        nodes:
+          - controller
+
 - nodeset:
     name: openstack-single-node-bionic
     nodes:
@@ -512,6 +522,14 @@
     parent: tempest-full-py3
     description: openSUSE 15.x platform test
     nodeset: devstack-single-node-opensuse-15
+
+- job:
+    name: devstack-platform-focal
+    parent: tempest-full-py3
+    description: Ubuntu Focal Fossa platform test
+    nodeset: openstack-single-node-focal
+    vars:
+      tempest_black_regex: "(tempest.api.compute.volumes.test_attach_volume.AttachVolumeMultiAttachTest.test_resize_server_with_multiattached_volume|tempest.api.compute.servers.test_server_rescue_negative.ServerRescueNegativeTestJSON|tempest.api.compute.servers.test_server_rescue.ServerStableDeviceRescueTest.test_stable_device_rescue_disk_virtio_with_volume_attached)"
     voting: false
 
 - job:
@@ -605,6 +623,7 @@
         - devstack-platform-opensuse-15
         - devstack-platform-fedora-latest
         - devstack-platform-centos-8
+        - devstack-platform-focal
         - devstack-multinode
         - devstack-unit-tests
         - openstack-tox-bashate
diff --git a/lib/apache b/lib/apache
index a3e9f95d4e..a5fbf75374 100644
--- a/lib/apache
+++ b/lib/apache
@@ -96,10 +96,11 @@ function install_apache_uwsgi {
     fi
 
     if is_ubuntu; then
-        install_package uwsgi \
-                        uwsgi-plugin-python \
-                        uwsgi-plugin-python3 \
-                        libapache2-mod-proxy-uwsgi
+        local pkg_list="uwsgi uwsgi-plugin-python3 libapache2-mod-proxy-uwsgi"
+        if "$DISTRO" == 'bionic'; then
+            pkg_list="${pkg_list} uwsgi-plugin-python"
+        fi
+        install_package ${pkg_list}
     elif is_fedora; then
         # Note httpd comes with mod_proxy_uwsgi and it is loaded by
         # default; the mod_proxy_uwsgi package actually conflicts now.
diff --git a/stack.sh b/stack.sh
index 80c6d4dd39..fa27743bb3 100755
--- a/stack.sh
+++ b/stack.sh
@@ -221,7 +221,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (bionic|stretch|jessie|f30|f31|opensuse-15.0|opensuse-15.1|opensuse-tumbleweed|rhel8) ]]; then
+if [[ ! ${DISTRO} =~ (bionic|focal|stretch|jessie|f30|f31|opensuse-15.0|opensuse-15.1|opensuse-tumbleweed|rhel8) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From cd57449c9f5d8f0ecac59da359108fdba80a31f7 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Tue, 23 Jun 2020 08:08:13 +0200
Subject: [PATCH 1749/2409] Stop claiming to support Debian distros

We haven't had a working job for stretch or jessie in years, attempts
to get things fixed have been dropped, set let's be honest and drop
those from our support list.

Change-Id: Ia6152be79f8044f7ff039ec0911ad4938d6271f4
---
 files/debs/nova | 1 -
 stack.sh        | 2 +-
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/files/debs/nova b/files/debs/nova
index dce8f6ac89..a7aebbf946 100644
--- a/files/debs/nova
+++ b/files/debs/nova
@@ -17,7 +17,6 @@ mysql-server # NOPRIME
 parted
 pm-utils
 python3-mysqldb
-qemu # dist:wheezy,jessie NOPRIME
 qemu-kvm # NOPRIME
 rabbitmq-server # NOPRIME
 socat # used by ajaxterm
diff --git a/stack.sh b/stack.sh
index fa27743bb3..709b97b0ef 100755
--- a/stack.sh
+++ b/stack.sh
@@ -221,7 +221,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (bionic|focal|stretch|jessie|f30|f31|opensuse-15.0|opensuse-15.1|opensuse-tumbleweed|rhel8) ]]; then
+if [[ ! ${DISTRO} =~ (bionic|focal|f30|f31|opensuse-15.0|opensuse-15.1|opensuse-tumbleweed|rhel8) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From 8b099c408b995ed65323a8cb58437b25cf374d5e Mon Sep 17 00:00:00 2001
From: Sean McGinnis <sean.mcginnis@gmail.com>
Date: Tue, 23 Jun 2020 10:30:20 -0500
Subject: [PATCH 1750/2409] Remove dragonflow reference

Dragonflow was retired in 2018 and is now being retired. This removes a
documentation reference to it.

Change-Id: I24ab79482306a7c816b5242a981f1b508ff8f6ec
Signed-off-by: Sean McGinnis <sean.mcginnis@gmail.com>
---
 doc/source/plugin-registry.rst | 1 -
 1 file changed, 1 deletion(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 3ab4db43ea..eda5773a25 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -41,7 +41,6 @@ openstack/devstack-plugin-nfs            `https://opendev.org/openstack/devstack
 openstack/devstack-plugin-open-cas       `https://opendev.org/openstack/devstack-plugin-open-cas <https://opendev.org/openstack/devstack-plugin-open-cas>`__
 openstack/devstack-plugin-pika           `https://opendev.org/openstack/devstack-plugin-pika <https://opendev.org/openstack/devstack-plugin-pika>`__
 openstack/devstack-plugin-zmq            `https://opendev.org/openstack/devstack-plugin-zmq <https://opendev.org/openstack/devstack-plugin-zmq>`__
-openstack/dragonflow                     `https://opendev.org/openstack/dragonflow <https://opendev.org/openstack/dragonflow>`__
 openstack/ec2-api                        `https://opendev.org/openstack/ec2-api <https://opendev.org/openstack/ec2-api>`__
 openstack/freezer                        `https://opendev.org/openstack/freezer <https://opendev.org/openstack/freezer>`__
 openstack/freezer-api                    `https://opendev.org/openstack/freezer-api <https://opendev.org/openstack/freezer-api>`__

From ca486c5259277db72c73c661ef3e9620a3b65d49 Mon Sep 17 00:00:00 2001
From: Rodolfo Alonso Hernandez <ralonsoh@redhat.com>
Date: Thu, 25 Jun 2020 18:22:28 +0000
Subject: [PATCH 1751/2409] Provide integer number to arping "-w" parameter

Some arping versions only accept an integer number for the
"deadline" (-w) parameter.

Change-Id: Ie21c9b5820262d049c0fcd8147d85cc110d88272
Closes-Bug: #1885169
---
 lib/neutron-legacy | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index bb1536aa9c..275dbf17e5 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -622,7 +622,7 @@ function _move_neutron_addresses_route {
             IP_UP="sudo ip link set $to_intf up"
             if [[ "$af" == "inet" ]]; then
                 IP=$(echo $IP_BRD | awk '{ print $1; exit }' | grep -o -E '(.*)/' | cut -d "/" -f1)
-                ARP_CMD="sudo arping -A -c 3 -w 4.5 -I $to_intf $IP "
+                ARP_CMD="sudo arping -A -c 3 -w 5 -I $to_intf $IP "
             fi
         fi
 

From 02da0c40f9511d0f52964e35145819bf9fc1eeff Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Thu, 25 Jun 2020 20:03:22 -0500
Subject: [PATCH 1752/2409] Add focal nodeset

This commit adds the focal nodeset for
multinode so that those can be used for
projects side jobs or testing.

We need to define these as first step to avoid
any conflict on nodeset name if project started
defining these.
Example: three node focal nodeset is already
defined in x/tobiko, fixing the same in depends on.
-I30a6bb63269f031a74f9bff6c765d59d91088797

Depends-On: https://review.opendev.org/#/c/738128/

Change-Id: I5ce49f7a7d52d00555c14b08864bc8975956b20c
Story: #2007865
Task: #40212
---
 .zuul.yaml | 65 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 65 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index 5cb99ab6b6..f78f3f54c7 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -108,6 +108,36 @@
         nodes:
           - compute1
 
+- nodeset:
+    name: openstack-two-node-focal
+    nodes:
+      - name: controller
+        label: ubuntu-focal
+      - name: compute1
+        label: ubuntu-focal
+    groups:
+      # Node where tests are executed and test results collected
+      - name: tempest
+        nodes:
+          - controller
+      # Nodes running the compute service
+      - name: compute
+        nodes:
+          - controller
+          - compute1
+      # Nodes that are not the controller
+      - name: subnode
+        nodes:
+          - compute1
+      # Switch node for multinode networking setup
+      - name: switch
+        nodes:
+          - controller
+      # Peer nodes for multinode networking setup
+      - name: peers
+        nodes:
+          - compute1
+
 - nodeset:
     name: openstack-two-node-bionic
     nodes:
@@ -168,6 +198,41 @@
         nodes:
           - compute1
 
+- nodeset:
+    name: openstack-three-node-focal
+    nodes:
+      - name: controller
+        label: ubuntu-focal
+      - name: compute1
+        label: ubuntu-focal
+      - name: compute2
+        label: ubuntu-focal
+    groups:
+      # Node where tests are executed and test results collected
+      - name: tempest
+        nodes:
+          - controller
+      # Nodes running the compute service
+      - name: compute
+        nodes:
+          - controller
+          - compute1
+          - compute2
+      # Nodes that are not the controller
+      - name: subnode
+        nodes:
+          - compute1
+          - compute2
+      # Switch node for multinode networking setup
+      - name: switch
+        nodes:
+          - controller
+      # Peer nodes for multinode networking setup
+      - name: peers
+        nodes:
+          - compute1
+          - compute2
+
 - nodeset:
     name: openstack-three-node-bionic
     nodes:

From 32c00890ed5f296ccb829196accfb437dbed8f6f Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Wed, 10 Apr 2019 10:33:39 +0000
Subject: [PATCH 1753/2409] Prepare for dropping keystone admin endpoint

Keystone no longer has any special functionality hidden behind the admin
endpoint. Stop referencing it in consumers, so it can later be dropped
completely.

Change-Id: I04a5d77908005268cc7c59e7e9ddeea70f6732e2
---
 functions-common                   | 2 +-
 lib/glance                         | 5 ++---
 lib/keystone                       | 4 ++--
 lib/neutron-legacy                 | 2 +-
 lib/nova_plugins/hypervisor-ironic | 2 +-
 lib/swift                          | 2 +-
 openrc                             | 4 ++--
 stack.sh                           | 2 +-
 8 files changed, 11 insertions(+), 12 deletions(-)

diff --git a/functions-common b/functions-common
index dea5aa93a8..6595c3de53 100644
--- a/functions-common
+++ b/functions-common
@@ -47,7 +47,7 @@ KILL_PATH="$(which kill)"
 
 # Save these variables to .stackenv
 STACK_ENV_VARS="BASE_SQL_CONN DATA_DIR DEST ENABLED_SERVICES HOST_IP \
-    KEYSTONE_AUTH_URI KEYSTONE_SERVICE_URI \
+    KEYSTONE_SERVICE_URI \
     LOGFILE OS_CACERT SERVICE_HOST STACK_USER TLS_IP \
     HOST_IPV6 SERVICE_IP_VERSION"
 
diff --git a/lib/glance b/lib/glance
index 4fa1b6a4e3..6d252e317c 100644
--- a/lib/glance
+++ b/lib/glance
@@ -208,8 +208,7 @@ function configure_glance {
 
     if is_service_enabled tls-proxy; then
         iniset $GLANCE_API_CONF DEFAULT bind_port $GLANCE_SERVICE_PORT_INT
-
-        iniset $GLANCE_API_CONF keystone_authtoken identity_uri $KEYSTONE_AUTH_URI
+        iniset $GLANCE_API_CONF keystone_authtoken identity_uri $KEYSTONE_SERVICE_URI
     fi
 
     # Format logging
@@ -221,7 +220,7 @@ function configure_glance {
     iniset $GLANCE_CACHE_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
     iniset $GLANCE_CACHE_CONF DEFAULT use_syslog $SYSLOG
     iniset $GLANCE_CACHE_CONF DEFAULT image_cache_dir $GLANCE_CACHE_DIR/
-    iniset $GLANCE_CACHE_CONF DEFAULT auth_url $KEYSTONE_AUTH_URI
+    iniset $GLANCE_CACHE_CONF DEFAULT auth_url $KEYSTONE_SERVICE_URI
     iniset $GLANCE_CACHE_CONF DEFAULT admin_tenant_name $SERVICE_PROJECT_NAME
     iniset $GLANCE_CACHE_CONF DEFAULT admin_user glance
     iniset $GLANCE_CACHE_CONF DEFAULT admin_password $SERVICE_PASSWORD
diff --git a/lib/keystone b/lib/keystone
index 1910f348b7..d4c7b063bb 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -115,7 +115,7 @@ KEYSTONE_SERVICE_URI=${KEYSTONE_SERVICE_PROTOCOL}://${KEYSTONE_SERVICE_HOST}/ide
 KEYSTONE_AUTH_URI=$KEYSTONE_SERVICE_URI
 
 # V3 URIs
-KEYSTONE_AUTH_URI_V3=$KEYSTONE_AUTH_URI/v3
+KEYSTONE_AUTH_URI_V3=$KEYSTONE_SERVICE_URI/v3
 KEYSTONE_SERVICE_URI_V3=$KEYSTONE_SERVICE_URI/v3
 
 # Security compliance
@@ -413,6 +413,7 @@ function configure_keystone_authtoken_middleware {
     local section=${3:-keystone_authtoken}
 
     iniset $conf_file $section auth_type password
+    iniset $conf_file $section interface public
     iniset $conf_file $section auth_url $KEYSTONE_SERVICE_URI
     iniset $conf_file $section username $admin_user
     iniset $conf_file $section password $SERVICE_PASSWORD
@@ -561,7 +562,6 @@ function stop_keystone {
 # - ``KEYSTONE_BIN_DIR``
 # - ``ADMIN_PASSWORD``
 # - ``IDENTITY_API_VERSION``
-# - ``KEYSTONE_AUTH_URI``
 # - ``REGION_NAME``
 # - ``KEYSTONE_SERVICE_PROTOCOL``
 # - ``KEYSTONE_SERVICE_HOST``
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index bb1536aa9c..5e4251f9f6 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -372,7 +372,7 @@ function configure_mutnauq {
 function create_nova_conf_neutron {
     local conf=${1:-$NOVA_CONF}
     iniset $conf neutron auth_type "password"
-    iniset $conf neutron auth_url "$KEYSTONE_AUTH_URI"
+    iniset $conf neutron auth_url "$KEYSTONE_SERVICE_URI"
     iniset $conf neutron username "$Q_ADMIN_USERNAME"
     iniset $conf neutron password "$SERVICE_PASSWORD"
     iniset $conf neutron user_domain_name "$SERVICE_DOMAIN_NAME"
diff --git a/lib/nova_plugins/hypervisor-ironic b/lib/nova_plugins/hypervisor-ironic
index b147c4327a..bda6ef6998 100644
--- a/lib/nova_plugins/hypervisor-ironic
+++ b/lib/nova_plugins/hypervisor-ironic
@@ -46,7 +46,7 @@ function configure_nova_hypervisor {
     iniset $NOVA_CONF ironic auth_type password
     iniset $NOVA_CONF ironic username admin
     iniset $NOVA_CONF ironic password $ADMIN_PASSWORD
-    iniset $NOVA_CONF ironic auth_url $KEYSTONE_AUTH_URI
+    iniset $NOVA_CONF ironic auth_url $KEYSTONE_SERVICE_URI
     iniset $NOVA_CONF ironic project_domain_id default
     iniset $NOVA_CONF ironic user_domain_id default
     iniset $NOVA_CONF ironic project_name demo
diff --git a/lib/swift b/lib/swift
index 3c121ca6ec..a981dfc10a 100644
--- a/lib/swift
+++ b/lib/swift
@@ -527,7 +527,7 @@ function configure_swift {
         else
             iniset ${testfile} func_test auth_port 80
         fi
-        iniset ${testfile} func_test auth_uri ${KEYSTONE_AUTH_URI}
+        iniset ${testfile} func_test auth_uri ${KEYSTONE_SERVICE_URI}
         if [[ "$auth_vers" == "3" ]]; then
             iniset ${testfile} func_test auth_prefix /identity/v3/
         else
diff --git a/openrc b/openrc
index 99d3351d53..beeaebea42 100644
--- a/openrc
+++ b/openrc
@@ -87,9 +87,9 @@ export OS_AUTH_TYPE=password
 
 # If you don't have a working .stackenv, this is the backup position
 KEYSTONE_BACKUP=$SERVICE_PROTOCOL://$SERVICE_HOST:5000
-KEYSTONE_AUTH_URI=${KEYSTONE_AUTH_URI:-$KEYSTONE_BACKUP}
+KEYSTONE_SERVICE_URI=${KEYSTONE_SERVICE_URI:-$KEYSTONE_BACKUP}
 
-export OS_AUTH_URL=${OS_AUTH_URL:-$KEYSTONE_AUTH_URI}
+export OS_AUTH_URL=${OS_AUTH_URL:-$KEYSTONE_SERVICE_URI}
 
 # Currently, in order to use openstackclient with Identity API v3,
 # we need to set the domain which the user and project belong to.
diff --git a/stack.sh b/stack.sh
index 709b97b0ef..37e75185f1 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1053,7 +1053,7 @@ cat > $TOP_DIR/userrc_early <<EOF
 
 # Set up password auth credentials now that Keystone is bootstrapped
 export OS_IDENTITY_API_VERSION=3
-export OS_AUTH_URL=$KEYSTONE_AUTH_URI
+export OS_AUTH_URL=$KEYSTONE_SERVICE_URI
 export OS_USERNAME=admin
 export OS_USER_DOMAIN_ID=default
 export OS_PASSWORD=$ADMIN_PASSWORD

From f6286cb586eb1f861866bfdf85c4f873c79fd592 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Sat, 13 Jun 2020 11:40:09 +0200
Subject: [PATCH 1754/2409] Drop keystone dedicated ports

Those historic references to port 5000 and 35357 aren't being used
anymore for some time, so let us drop them.

Clean up some python2/3 wording along the way.

No longer mention Identity API v2, which is also a thing of the past.

Change-Id: Iafff097eee082f24ea2ae27ad038ad115aa36c61
---
 doc/source/configuration.rst   | 22 ++++---------
 files/apache-keystone.template | 30 -----------------
 lib/keystone                   | 59 +++-------------------------------
 openrc                         |  2 +-
 tools/create_userrc.sh         |  2 +-
 tools/fixup_stuff.sh           | 34 --------------------
 6 files changed, 12 insertions(+), 137 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 45f4ffe6e9..67c3b8a7d1 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -137,7 +137,7 @@ OS\_AUTH\_URL
 
     ::
 
-        OS_AUTH_URL=http://$SERVICE_HOST:5000/v3.0
+        OS_AUTH_URL=http://$SERVICE_HOST/identity/v3.0
 
 KEYSTONECLIENT\_DEBUG, NOVACLIENT\_DEBUG
     Set command-line client log level to ``DEBUG``. These are commented
@@ -430,16 +430,16 @@ Python bindings added when they are enabled.
 
   ADDITIONAL_VENV_PACKAGES="python-foo, python-bar"
 
-Use python3
+Use python2
 ------------
 
-By default ``stack.sh`` uses python2 (the exact version set by the
-``PYTHON2_VERSION``). This can be overriden so devstack will run
-python3 (the exact version set by ``PYTHON3_VERSION``).
+By default ``stack.sh`` uses python3 (the exact version set by the
+``PYTHON3_VERSION``). This can be overriden so devstack will run
+python2 (the exact version set by ``PYTHON2_VERSION``).
 
 ::
 
-  USE_PYTHON3=True
+  USE_PYTHON3=False
 
 A clean install every time
 --------------------------
@@ -696,16 +696,6 @@ KEYSTONE_REGION_NAME to specify the region of Keystone service.
 KEYSTONE_REGION_NAME has a default value the same as REGION_NAME thus we omit
 it in the configuration of RegionOne.
 
-Disabling Identity API v2
-+++++++++++++++++++++++++
-
-The Identity API v2 is deprecated as of Mitaka and it is recommended to only
-use the v3 API. It is possible to setup keystone without v2 API, by doing:
-
-::
-
-    ENABLE_IDENTITY_V2=False
-
 .. _arch-configuration:
 
 Architectures
diff --git a/files/apache-keystone.template b/files/apache-keystone.template
index 128436027d..cf26c216f5 100644
--- a/files/apache-keystone.template
+++ b/files/apache-keystone.template
@@ -1,39 +1,9 @@
-Listen %PUBLICPORT%
-Listen %ADMINPORT%
 LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\" %D(us)" keystone_combined
 
 <Directory %KEYSTONE_BIN%>
     Require all granted
 </Directory>
 
-<VirtualHost *:%PUBLICPORT%>
-    WSGIDaemonProcess keystone-public processes=3 threads=1 user=%USER% display-name=%{GROUP} %VIRTUALENV%
-    WSGIProcessGroup keystone-public
-    WSGIScriptAlias / %KEYSTONE_BIN%/keystone-wsgi-public
-    WSGIApplicationGroup %{GLOBAL}
-    WSGIPassAuthorization On
-    ErrorLogFormat "%M"
-    ErrorLog /var/log/%APACHE_NAME%/keystone.log
-    CustomLog /var/log/%APACHE_NAME%/keystone_access.log keystone_combined
-    %SSLENGINE%
-    %SSLCERTFILE%
-    %SSLKEYFILE%
-</VirtualHost>
-
-<VirtualHost *:%ADMINPORT%>
-    WSGIDaemonProcess keystone-admin processes=3 threads=1 user=%USER% display-name=%{GROUP} %VIRTUALENV%
-    WSGIProcessGroup keystone-admin
-    WSGIScriptAlias / %KEYSTONE_BIN%/keystone-wsgi-admin
-    WSGIApplicationGroup %{GLOBAL}
-    WSGIPassAuthorization On
-    ErrorLogFormat "%M"
-    ErrorLog /var/log/%APACHE_NAME%/keystone.log
-    CustomLog /var/log/%APACHE_NAME%/keystone_access.log keystone_combined
-    %SSLENGINE%
-    %SSLCERTFILE%
-    %SSLKEYFILE%
-</VirtualHost>
-
 %SSLLISTEN%<VirtualHost *:443>
 %SSLLISTEN%    %SSLENGINE%
 %SSLLISTEN%    %SSLCERTFILE%
diff --git a/lib/keystone b/lib/keystone
index d4c7b063bb..29407a0e69 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -83,14 +83,10 @@ KEYSTONE_TOKEN_FORMAT=$(echo ${KEYSTONE_TOKEN_FORMAT} | tr '[:upper:]' '[:lower:
 
 # Set Keystone interface configuration
 KEYSTONE_AUTH_HOST=${KEYSTONE_AUTH_HOST:-$SERVICE_HOST}
-KEYSTONE_AUTH_PORT=${KEYSTONE_AUTH_PORT:-35357}
-KEYSTONE_AUTH_PORT_INT=${KEYSTONE_AUTH_PORT_INT:-35358}
 KEYSTONE_AUTH_PROTOCOL=${KEYSTONE_AUTH_PROTOCOL:-$SERVICE_PROTOCOL}
 
 # Public facing bits
 KEYSTONE_SERVICE_HOST=${KEYSTONE_SERVICE_HOST:-$SERVICE_HOST}
-KEYSTONE_SERVICE_PORT=${KEYSTONE_SERVICE_PORT:-5000}
-KEYSTONE_SERVICE_PORT_INT=${KEYSTONE_SERVICE_PORT_INT:-5001}
 KEYSTONE_SERVICE_PROTOCOL=${KEYSTONE_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 
 # Bind hosts
@@ -170,22 +166,14 @@ function _config_keystone_apache_wsgi {
     local keystone_ssl=""
     local keystone_certfile=""
     local keystone_keyfile=""
-    local keystone_service_port=$KEYSTONE_SERVICE_PORT
-    local keystone_auth_port=$KEYSTONE_AUTH_PORT
     local venv_path=""
 
-    if is_service_enabled tls-proxy; then
-        keystone_service_port=$KEYSTONE_SERVICE_PORT_INT
-        keystone_auth_port=$KEYSTONE_AUTH_PORT_INT
-    fi
     if [[ ${USE_VENV} = True ]]; then
         venv_path="python-path=${PROJECT_VENV["keystone"]}/lib/$(python_version)/site-packages"
     fi
 
     sudo cp $FILES/apache-keystone.template $keystone_apache_conf
     sudo sed -e "
-        s|%PUBLICPORT%|$keystone_service_port|g;
-        s|%ADMINPORT%|$keystone_auth_port|g;
         s|%APACHE_NAME%|$APACHE_NAME|g;
         s|%SSLLISTEN%|$keystone_ssl_listen|g;
         s|%SSLENGINE%|$keystone_ssl|g;
@@ -222,21 +210,8 @@ function configure_keystone {
 
     iniset_rpc_backend keystone $KEYSTONE_CONF oslo_messaging_notifications
 
-    local service_port=$KEYSTONE_SERVICE_PORT
-    local auth_port=$KEYSTONE_AUTH_PORT
-
-    if is_service_enabled tls-proxy; then
-        # Set the service ports for a proxy to take the originals
-        service_port=$KEYSTONE_SERVICE_PORT_INT
-        auth_port=$KEYSTONE_AUTH_PORT_INT
-    fi
-
     # Override the endpoints advertised by keystone (the public_endpoint and
-    # admin_endpoint) so that clients use the correct endpoint. By default, the
-    # keystone server uses the public_port and admin_port which isn't going to
-    # work when you want to use a different port (in the case of proxy), or you
-    # don't want the port (in the case of putting keystone on a path in
-    # apache).
+    # admin_endpoint) so that clients use the correct endpoint.
     iniset $KEYSTONE_CONF DEFAULT public_endpoint $KEYSTONE_SERVICE_URI
     iniset $KEYSTONE_CONF DEFAULT admin_endpoint $KEYSTONE_AUTH_URI
 
@@ -270,12 +245,6 @@ function configure_keystone {
 
     iniset $KEYSTONE_CONF credential key_repository "$KEYSTONE_CONF_DIR/credential-keys/"
 
-    # Configure the project created by the 'keystone-manage bootstrap' as the cloud-admin project.
-    # The users from this project are globally admin as before, but it also
-    # allows policy changes in order to clarify the adminess scope.
-    #iniset $KEYSTONE_CONF resource admin_project_domain_name Default
-    #iniset $KEYSTONE_CONF resource admin_project_name admin
-
     if [[ "$KEYSTONE_SECURITY_COMPLIANCE_ENABLED" = True ]]; then
         iniset $KEYSTONE_CONF security_compliance lockout_failure_attempts $KEYSTONE_LOCKOUT_FAILURE_ATTEMPTS
         iniset $KEYSTONE_CONF security_compliance lockout_duration $KEYSTONE_LOCKOUT_DURATION
@@ -510,14 +479,6 @@ function install_keystone {
 
 # start_keystone() - Start running processes
 function start_keystone {
-    # Get right service port for testing
-    local service_port=$KEYSTONE_SERVICE_PORT
-    local auth_protocol=$KEYSTONE_AUTH_PROTOCOL
-    if is_service_enabled tls-proxy; then
-        service_port=$KEYSTONE_SERVICE_PORT_INT
-        auth_protocol="http"
-    fi
-
     if [ "$KEYSTONE_DEPLOY" == "mod_wsgi" ]; then
         enable_apache_site keystone
         restart_apache_server
@@ -526,23 +487,13 @@ function start_keystone {
     fi
 
     echo "Waiting for keystone to start..."
-    # Check that the keystone service is running. Even if the tls tunnel
-    # should be enabled, make sure the internal port is checked using
-    # unencryted traffic at this point.
-    # If running in Apache, use the path rather than port.
-
+    # Check that the keystone service is running.
     local service_uri=$auth_protocol://$KEYSTONE_SERVICE_HOST/identity/v$IDENTITY_API_VERSION/
 
     if ! wait_for_service $SERVICE_TIMEOUT $service_uri; then
         die $LINENO "keystone did not start"
     fi
 
-    # Start proxies if enabled
-    if is_service_enabled tls-proxy; then
-        start_tls_proxy keystone-service '*' $KEYSTONE_SERVICE_PORT $KEYSTONE_SERVICE_HOST $KEYSTONE_SERVICE_PORT_INT
-        start_tls_proxy keystone-auth '*' $KEYSTONE_AUTH_PORT $KEYSTONE_AUTH_HOST $KEYSTONE_AUTH_PORT_INT
-    fi
-
     # (re)start memcached to make sure we have a clean memcache.
     restart_service memcached
 }
@@ -561,11 +512,9 @@ function stop_keystone {
 # This function uses the following GLOBAL variables:
 # - ``KEYSTONE_BIN_DIR``
 # - ``ADMIN_PASSWORD``
-# - ``IDENTITY_API_VERSION``
+# - ``KEYSTONE_AUTH_URI``
 # - ``REGION_NAME``
-# - ``KEYSTONE_SERVICE_PROTOCOL``
-# - ``KEYSTONE_SERVICE_HOST``
-# - ``KEYSTONE_SERVICE_PORT``
+# - ``KEYSTONE_SERVICE_URI``
 function bootstrap_keystone {
     $KEYSTONE_BIN_DIR/keystone-manage bootstrap \
         --bootstrap-username admin \
diff --git a/openrc b/openrc
index beeaebea42..28f388be4c 100644
--- a/openrc
+++ b/openrc
@@ -86,7 +86,7 @@ export OS_AUTH_TYPE=password
 #
 
 # If you don't have a working .stackenv, this is the backup position
-KEYSTONE_BACKUP=$SERVICE_PROTOCOL://$SERVICE_HOST:5000
+KEYSTONE_BACKUP=$SERVICE_PROTOCOL://$SERVICE_HOST/identity
 KEYSTONE_SERVICE_URI=${KEYSTONE_SERVICE_URI:-$KEYSTONE_BACKUP}
 
 export OS_AUTH_URL=${OS_AUTH_URL:-$KEYSTONE_SERVICE_URI}
diff --git a/tools/create_userrc.sh b/tools/create_userrc.sh
index f4a4edcbe2..c7bea4ac08 100755
--- a/tools/create_userrc.sh
+++ b/tools/create_userrc.sh
@@ -152,7 +152,7 @@ if [ -z "$OS_USERNAME" ]; then
 fi
 
 if [ -z "$OS_AUTH_URL" ]; then
-    export OS_AUTH_URL=http://localhost:5000/v3/
+    export OS_AUTH_URL=http://localhost/identity/v3/
 fi
 
 if [ -z "$OS_USER_DOMAIN_ID" -a -z "$OS_USER_DOMAIN_NAME" ]; then
diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index e1409291b9..2ac8a47ca7 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -26,39 +26,6 @@ if [[ -z "$TOP_DIR" ]]; then
     FILES=$TOP_DIR/files
 fi
 
-# Keystone Port Reservation
-# -------------------------
-# Reserve and prevent ``KEYSTONE_AUTH_PORT`` and ``KEYSTONE_AUTH_PORT_INT`` from
-# being used as ephemeral ports by the system. The default(s) are 35357 and
-# 35358 which are in the Linux defined ephemeral port range (in disagreement
-# with the IANA ephemeral port range). This is a workaround for bug #1253482
-# where Keystone will try and bind to the port and the port will already be
-# in use as an ephemeral port by another process. This places an explicit
-# exception into the Kernel for the Keystone AUTH ports.
-function fixup_keystone {
-    keystone_ports=${KEYSTONE_AUTH_PORT:-35357},${KEYSTONE_AUTH_PORT_INT:-35358}
-
-    # Only do the reserved ports when available, on some system (like containers)
-    # where it's not exposed we are almost pretty sure these ports would be
-    # exclusive for our DevStack.
-    if sysctl net.ipv4.ip_local_reserved_ports >/dev/null 2>&1; then
-        # Get any currently reserved ports, strip off leading whitespace
-        reserved_ports=$(sysctl net.ipv4.ip_local_reserved_ports | awk -F'=' '{print $2;}' | sed 's/^ //')
-
-        if [[ -z "${reserved_ports}" ]]; then
-            # If there are no currently reserved ports, reserve the keystone ports
-            sudo sysctl -w net.ipv4.ip_local_reserved_ports=${keystone_ports}
-        else
-            # If there are currently reserved ports, keep those and also reserve the
-            # Keystone specific ports. Duplicate reservations are merged into a single
-            # reservation (or range) automatically by the kernel.
-            sudo sysctl -w net.ipv4.ip_local_reserved_ports=${keystone_ports},${reserved_ports}
-        fi
-    else
-        echo_summary "WARNING: unable to reserve keystone ports"
-    fi
-}
-
 # Ubuntu Repositories
 #--------------------
 # Enable universe for bionic since it is missing when installing from ISO.
@@ -208,7 +175,6 @@ function fixup_suse {
 }
 
 function fixup_all {
-    fixup_keystone
     fixup_ubuntu
     fixup_fedora
     fixup_suse

From d7a82f41e469fc51fb021184c1fa6c98da428411 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Tue, 23 Jun 2020 10:21:09 +0200
Subject: [PATCH 1755/2409] Drop support for python2

python2 is EOL, let's move on and only support python3.

Change-Id: Ieffda4edea9cc19484c04420ed703f7141ef9f15
---
 .zuul.yaml                                   |  3 --
 doc/source/configuration.rst                 | 11 ----
 doc/source/guides/devstack-with-lbaas-v2.rst |  3 --
 inc/python                                   | 55 ++++----------------
 lib/apache                                   | 16 ++----
 lib/tls                                      |  8 +--
 stackrc                                      | 20 +++----
 tools/install_pip.sh                         |  6 ---
 8 files changed, 21 insertions(+), 101 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index f78f3f54c7..5ae14708e1 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -558,9 +558,6 @@
       devstack_localrc:
         SERVICE_IP_VERSION: 6
         SERVICE_HOST: ""
-        # IPv6 and certificates known issue with python2
-        # https://bugs.launchpad.net/devstack/+bug/1794929
-        USE_PYTHON3: true
 
 - job:
     name: devstack-multinode
diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 67c3b8a7d1..ec4a9c84e4 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -430,17 +430,6 @@ Python bindings added when they are enabled.
 
   ADDITIONAL_VENV_PACKAGES="python-foo, python-bar"
 
-Use python2
-------------
-
-By default ``stack.sh`` uses python3 (the exact version set by the
-``PYTHON3_VERSION``). This can be overriden so devstack will run
-python2 (the exact version set by ``PYTHON2_VERSION``).
-
-::
-
-  USE_PYTHON3=False
-
 A clean install every time
 --------------------------
 
diff --git a/doc/source/guides/devstack-with-lbaas-v2.rst b/doc/source/guides/devstack-with-lbaas-v2.rst
index 7fde6f14f8..5d96ca7d74 100644
--- a/doc/source/guides/devstack-with-lbaas-v2.rst
+++ b/doc/source/guides/devstack-with-lbaas-v2.rst
@@ -41,9 +41,6 @@ Edit your ``/opt/stack/devstack/local.conf`` to look like
     # If you are enabling barbican for TLS offload in Octavia, include it here.
     # enable_plugin barbican https://opendev.org/openstack/barbican
 
-    # If you have python3 available:
-    # USE_PYTHON3=True
-
     # ===== BEGIN localrc =====
     DATABASE_PASSWORD=password
     ADMIN_PASSWORD=password
diff --git a/inc/python b/inc/python
index 08f9959d5c..727d52cd5b 100644
--- a/inc/python
+++ b/inc/python
@@ -62,7 +62,7 @@ function get_python_exec_prefix {
     $xtrace
 
     local PYTHON_PATH=/usr/local/bin
-    ( is_fedora && ! python3_enabled ) || is_suse && PYTHON_PATH=/usr/bin
+    is_suse && PYTHON_PATH=/usr/bin
     echo $PYTHON_PATH
 }
 
@@ -169,16 +169,9 @@ function pip_install {
         local cmd_pip=$PIP_VIRTUAL_ENV/bin/pip
         local sudo_pip="env"
     else
-        local cmd_pip
-        local sudo_pip="sudo -H"
-        if python3_enabled; then
-            echo "Using python $PYTHON3_VERSION to install $package_dir because python3_enabled=True"
-            sudo_pip="$sudo_pip LC_ALL=en_US.UTF-8"
-            cmd_pip="python$PYTHON3_VERSION -m pip"
-        else
-            echo "Using python $PYTHON2_VERSION to install $package_dir because python3_enabled=False"
-            cmd_pip=$(get_pip_command $PYTHON2_VERSION)
-        fi
+        local cmd_pip="python$PYTHON3_VERSION -m pip"
+        local sudo_pip="sudo -H LC_ALL=en_US.UTF-8"
+        echo "Using python $PYTHON3_VERSION to install $package_dir"
     fi
 
     cmd_pip="$cmd_pip install"
@@ -213,14 +206,8 @@ function pip_uninstall {
         local cmd_pip=$PIP_VIRTUAL_ENV/bin/pip
         local sudo_pip="env"
     else
-        local cmd_pip
-        local sudo_pip="sudo -H"
-        if python3_enabled; then
-            sudo_pip="$sudo_pip LC_ALL=en_US.UTF-8"
-            cmd_pip="python$PYTHON3_VERSION -m pip"
-        else
-            cmd_pip=$(get_pip_command $PYTHON2_VERSION)
-        fi
+        local cmd_pip="python$PYTHON3_VERSION -m pip"
+        local sudo_pip="sudo -H LC_ALL=en_US.UTF-8"
     fi
     # don't error if we can't uninstall, it might not be there
     $sudo_pip $cmd_pip uninstall -y $name || /bin/true
@@ -457,37 +444,15 @@ function setup_package {
 }
 
 # Report whether python 3 should be used
+# TODO(frickler): drop this once all legacy uses are removed
 function python3_enabled {
-    if [[ $USE_PYTHON3 == "True" ]]; then
-        return 0
-    else
-        return 1
-    fi
+    return 1
 }
 
 # Provide requested python version and sets PYTHON variable
 function install_python {
-    # NOTE: install_python function should finally just do what install_python3
-    # does as soon Python 2 support has been dropped
-    if python3_enabled; then
-        install_python3
-        export PYTHON=$(which python${PYTHON3_VERSION} 2>/dev/null ||
-                        which python3 2>/dev/null)
-        if [[ "${DISTRO}" =~ (rhel8) ]]; then
-            # Use Python 3 as default python command so that we have only one
-            # python alternative to use on the system for either python and
-            # python3
-            sudo alternatives --set python "${PYTHON}"
-        else
-            # Install anyway Python 2 for legacy scripts that still requires
-            # python instead of python3 command
-            install_package python
-        fi
-    else
-        echo "WARNING - Python 2 support has been deprecated in favor of Python 3"
-        install_package python
-        export PYTHON=$(which python 2>/dev/null)
-    fi
+    install_python3
+    export PYTHON=$(which python${PYTHON3_VERSION} 2>/dev/null)
 }
 
 # Install python3 packages
diff --git a/lib/apache b/lib/apache
index a5fbf75374..cc282006df 100644
--- a/lib/apache
+++ b/lib/apache
@@ -89,11 +89,7 @@ function install_apache_uwsgi {
     #
     # For package installs, the distro ships both plugins and you need
     # to select the right one ... it will not be autodetected.
-    if python3_enabled; then
-        UWSGI_PYTHON_PLUGIN=python3
-    else
-        UWSGI_PYTHON_PLUGIN=python
-    fi
+    UWSGI_PYTHON_PLUGIN=python3
 
     if is_ubuntu; then
         local pkg_list="uwsgi uwsgi-plugin-python3 libapache2-mod-proxy-uwsgi"
@@ -150,14 +146,10 @@ function install_apache_wsgi {
     if is_ubuntu; then
         # Install apache2, which is NOPRIME'd
         install_package apache2
-        if python3_enabled; then
-            if is_package_installed libapache2-mod-wsgi; then
-                uninstall_package libapache2-mod-wsgi
-            fi
-            install_package libapache2-mod-wsgi-py3
-        else
-            install_package libapache2-mod-wsgi
+        if is_package_installed libapache2-mod-wsgi; then
+            uninstall_package libapache2-mod-wsgi
         fi
+        install_package libapache2-mod-wsgi-py3
     elif is_fedora; then
         sudo rm -f /etc/httpd/conf.d/000-*
         install_package httpd mod_wsgi
diff --git a/lib/tls b/lib/tls
index d05536b45d..baafb59c8b 100644
--- a/lib/tls
+++ b/lib/tls
@@ -227,13 +227,7 @@ function init_CA {
 function init_cert {
     if [[ ! -r $DEVSTACK_CERT ]]; then
         if [[ -n "$TLS_IP" ]]; then
-            if python3_enabled; then
-                TLS_IP="IP:$TLS_IP"
-            else
-                # Lie to let incomplete match routines work with python2
-                # see https://bugs.python.org/issue23239
-                TLS_IP="DNS:$TLS_IP,IP:$TLS_IP"
-            fi
+            TLS_IP="IP:$TLS_IP"
             if [[ -n "$HOST_IPV6" ]]; then
                 TLS_IP="$TLS_IP,IP:$HOST_IPV6"
             fi
diff --git a/stackrc b/stackrc
index e323cee843..4ffd537ef4 100644
--- a/stackrc
+++ b/stackrc
@@ -134,25 +134,17 @@ if [[ -r $RC_DIR/.localrc.password ]]; then
 fi
 
 # Control whether Python 3 should be used at all.
-export USE_PYTHON3=$(trueorfalse True USE_PYTHON3)
+# TODO(frickler): Drop this when all consumers are fixed
+export USE_PYTHON3=True
 
-# When Python 3 is supported by an application, adding the specific
-# version of Python 3 to this variable will install the app using that
-# version of the interpreter instead of 2.7.
+# Adding the specific version of Python 3 to this variable will install
+# the app using that version of the interpreter instead of just 3.
 _DEFAULT_PYTHON3_VERSION="$(_get_python_version python3)"
 export PYTHON3_VERSION=${PYTHON3_VERSION:-${_DEFAULT_PYTHON3_VERSION:-3}}
 
-# Just to be more explicit on the Python 2 version to use.
-_DEFAULT_PYTHON2_VERSION="$(_get_python_version python2)"
-export PYTHON2_VERSION=${PYTHON2_VERSION:-${_DEFAULT_PYTHON2_VERSION:-2.7}}
-
 # Create a virtualenv with this
-if [[ ${USE_PYTHON3} == True ]]; then
-    # Use the built-in venv to avoid more dependencies
-    export VIRTUALENV_CMD="python3 -m venv"
-else
-    export VIRTUALENV_CMD="virtualenv "
-fi
+# Use the built-in venv to avoid more dependencies
+export VIRTUALENV_CMD="python3 -m venv"
 
 # Default for log coloring is based on interactive-or-not.
 # Baseline assumption is that non-interactive invocations are for CI,
diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index 517669e282..f3fd1e2498 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -92,9 +92,6 @@ function install_get_pip {
         touch $LOCAL_PIP.downloaded
     fi
     sudo -H -E python${PYTHON3_VERSION} $LOCAL_PIP
-    if ! python3_enabled; then
-        sudo -H -E python $LOCAL_PIP
-    fi
 }
 
 
@@ -142,9 +139,6 @@ fi
 # results in a nonfunctional system. pip on fedora installs to /usr so pip
 # can safely override the system pip for all versions of fedora
 if ! is_fedora  && ! is_suse; then
-    if is_package_installed python-pip ; then
-        uninstall_package python-pip
-    fi
     if is_package_installed python3-pip ; then
         uninstall_package python3-pip
     fi

From ee5cf747d8826b9f9dbf565a7a9ba2c1e25f068a Mon Sep 17 00:00:00 2001
From: Brian Rosmaita <rosmaita.fossdev@gmail.com>
Date: Thu, 12 Dec 2019 15:52:22 -0500
Subject: [PATCH 1756/2409] Remove GLANCE_V1_ENABLED option

This option sets enable_v1_api in glance-api.conf, a setting that
was removed by change Ia086230cc8c92f7b7dfd5b001923110d5bc55d4d
in July 2018, so remove the devstack option from lib/glance.

It occurs in two other places:

This option is used in lib/cinder to set an option that was removed
from Cinder by change Ice379db9ae83420bacf9e96e242c7515930eae86 in
Queens, so remove the related code.

When this option is False, it is used in lib/tempest to set
[image-feature-enabled]/api_v1 to False in the tempest config file.
However, the default value of ths setting has been False since
change Iab3a209c744375bf2618afc00a3f7731b62f557e in Sept 2018,
so remove the related code.

Change-Id: I4b18a0a388ed7e7a392fabeac613778e0d23dee7
---
 lib/cinder  | 4 ----
 lib/glance  | 7 -------
 lib/tempest | 5 -----
 3 files changed, 16 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index c2e55f9173..b1ed593080 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -311,10 +311,6 @@ function configure_cinder {
         iniset $CINDER_CONF DEFAULT glance_ca_certificates_file $SSL_BUNDLE_FILE
     fi
 
-    if [ "$GLANCE_V1_ENABLED" != "True" ]; then
-        iniset $CINDER_CONF DEFAULT glance_api_version 2
-    fi
-
     # Set nova credentials (used for os-assisted-snapshots)
     configure_keystone_authtoken_middleware $CINDER_CONF nova nova
     iniset $CINDER_CONF nova region_name "$REGION_NAME"
diff --git a/lib/glance b/lib/glance
index 4fa1b6a4e3..97af6e691d 100644
--- a/lib/glance
+++ b/lib/glance
@@ -73,7 +73,6 @@ GLANCE_CACHE_CONF=$GLANCE_CONF_DIR/glance-cache.conf
 GLANCE_SCHEMA_JSON=$GLANCE_CONF_DIR/schema-image.json
 GLANCE_SWIFT_STORE_CONF=$GLANCE_CONF_DIR/glance-swift-store.conf
 GLANCE_IMAGE_IMPORT_CONF=$GLANCE_CONF_DIR/glance-image-import.conf
-GLANCE_V1_ENABLED=${GLANCE_V1_ENABLED:-False}
 
 if is_service_enabled tls-proxy; then
     GLANCE_SERVICE_PROTOCOL="https"
@@ -152,12 +151,6 @@ function configure_glance {
         iniset $GLANCE_API_CONF DEFAULT disk_formats "ami,ari,aki,vhd,vmdk,raw,qcow2,vdi,iso,ploop"
     fi
 
-    # NOTE(flaper87): To uncomment as soon as all services consuming Glance are
-    # able to consume V2 entirely.
-    if [ "$GLANCE_V1_ENABLED" != "True" ]; then
-        iniset $GLANCE_API_CONF DEFAULT enable_v1_api False
-    fi
-
     # Glance multiple store Store specific configs
     if [[ "$GLANCE_ENABLE_MULTIPLE_STORES" == "True" ]]; then
         iniset $GLANCE_API_CONF glance_store default_backend $GLANCE_DEFAULT_BACKEND
diff --git a/lib/tempest b/lib/tempest
index 05fcb1f1f3..1ce2350620 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -346,11 +346,6 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG image disk_formats "ami,ari,aki,vhd,raw,iso"
     fi
 
-    # Image Features
-    if [ "$GLANCE_V1_ENABLED" != "True" ]; then
-        iniset $TEMPEST_CONFIG image-feature-enabled api_v1 False
-    fi
-
     # Compute
     iniset $TEMPEST_CONFIG compute image_ref $image_uuid
     iniset $TEMPEST_CONFIG compute image_ref_alt $image_uuid_alt

From bde1804ee98d2bf1e3bd9e04c11dde53cbff119f Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Thu, 25 Jun 2020 20:19:03 -0500
Subject: [PATCH 1757/2409] Switch devstack base job to Ubuntu Focal

As per Victoria cycle testing runtime[1], we need
to test upstream CI/CD on Ubuntu 20.04(Focal). TC is
in the process of defining this as a community goal[2]

By moving the devstack base job to Ubuntu focal, all project side job
or devstack-tempest job will automatically migrate to the new distro
until they override the nodeset.

As devstack is branched, all the stable jobs derived from devstack jobs will
keep working on Bionic.

[1] https://governance.openstack.org/tc/reference/runtimes/victoria.html
[2] https://governance.openstack.org/tc/goals/proposed/migrate-ci-cd-jobs-to-ubuntu-focal.html

Depends-On: https://review.opendev.org/#/c/738328/

Story: #2007865
Task: #40212

Change-Id: I63e69e898376e728eaf6d857426276fc93a1a0e3
---
 .zuul.yaml | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index f78f3f54c7..cf56eae0e4 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -391,7 +391,7 @@
     description: |
       Minimal devstack base job, intended for use by jobs that need
       less than the normal minimum set of required-projects.
-    nodeset: openstack-single-node-bionic
+    nodeset: openstack-single-node-focal
     required-projects:
       - opendev.org/openstack/requirements
     vars:
@@ -565,7 +565,7 @@
 - job:
     name: devstack-multinode
     parent: devstack
-    nodeset: openstack-two-node-bionic
+    nodeset: openstack-two-node-focal
     description: |
       Simple multinode test to verify multinode functionality on devstack side.
       This is not meant to be used as a parent job.
@@ -589,12 +589,10 @@
     nodeset: devstack-single-node-opensuse-15
 
 - job:
-    name: devstack-platform-focal
+    name: devstack-platform-bionic
     parent: tempest-full-py3
-    description: Ubuntu Focal Fossa platform test
-    nodeset: openstack-single-node-focal
-    vars:
-      tempest_black_regex: "(tempest.api.compute.volumes.test_attach_volume.AttachVolumeMultiAttachTest.test_resize_server_with_multiattached_volume|tempest.api.compute.servers.test_server_rescue_negative.ServerRescueNegativeTestJSON|tempest.api.compute.servers.test_server_rescue.ServerStableDeviceRescueTest.test_stable_device_rescue_disk_virtio_with_volume_attached)"
+    description: Ubuntu Bionic platform test
+    nodeset: openstack-single-node-bionic
     voting: false
 
 - job:
@@ -688,7 +686,7 @@
         - devstack-platform-opensuse-15
         - devstack-platform-fedora-latest
         - devstack-platform-centos-8
-        - devstack-platform-focal
+        - devstack-platform-bionic
         - devstack-multinode
         - devstack-unit-tests
         - openstack-tox-bashate

From b066707d641696487fbd78773f191e2cfb4345f0 Mon Sep 17 00:00:00 2001
From: Xinliang Liu <xinliang.liu@linaro.org>
Date: Sun, 28 Jun 2020 08:55:28 +0000
Subject: [PATCH 1758/2409] Fix targetcli install error on ubuntu focal

No targetcli package on Ubuntu Focal, it should use targetcli-fb also
when "$CINDER_ISCSI_HELPER" == "lioadm".

Although Xenial only has targetcli, but Xenial is dropped from CI. And
starting from bionic, Ubuntu uses targetcli-fb to replace targetcli. So
here we can use is_ubuntu to make ubuntu use targetcli-fb.

Change-Id: I6d35b6651d486e716980dcd9f4d693bed560463a
---
 lib/cinder | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/cinder b/lib/cinder
index c2e55f9173..b1e3d0d408 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -419,7 +419,7 @@ function install_cinder {
     if [[ "$CINDER_ISCSI_HELPER" == "tgtadm" ]]; then
         install_package tgt
     elif [[ "$CINDER_ISCSI_HELPER" == "lioadm" ]]; then
-        if [[ ${DISTRO} == "bionic" ]]; then
+        if is_ubuntu; then
             # TODO(frickler): Workaround for https://launchpad.net/bugs/1819819
             sudo mkdir -p /etc/target
 

From 59519ca5cc92d2d34363f2644e54fc4d7934a1b4 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Mon, 29 Jun 2020 10:24:21 +0200
Subject: [PATCH 1759/2409] Make opensuse platform job non-voting again

The non-voting flag was accidentally dropped in [0].

[0] Ib4416dc2f5e003fd770f5240a8f78213c56af8e6

Change-Id: If9519f1ac9afd66553e1c1410fdc16369f166b98
---
 .zuul.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index f78f3f54c7..4142d465bb 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -587,6 +587,7 @@
     parent: tempest-full-py3
     description: openSUSE 15.x platform test
     nodeset: devstack-single-node-opensuse-15
+    voting: false
 
 - job:
     name: devstack-platform-focal

From 3cbb33e5c6068d80c50f64a543550611eca8309a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rados=C5=82aw=20Piliszek?= <radoslaw.piliszek@gmail.com>
Date: Tue, 30 Jun 2020 17:52:10 +0200
Subject: [PATCH 1760/2409] Fix python3_enable to return true

Recent regression spotted by Dmitry Tantsur.
DevStack dropped Py2 support but the now-unused-in-devstack
python3_enable got its result nastily inversed.

Change-Id: I4b37cc847a24705c4955cec2e6e45f0514705f1b
---
 inc/python | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/inc/python b/inc/python
index 727d52cd5b..f98d28d995 100644
--- a/inc/python
+++ b/inc/python
@@ -446,7 +446,7 @@ function setup_package {
 # Report whether python 3 should be used
 # TODO(frickler): drop this once all legacy uses are removed
 function python3_enabled {
-    return 1
+    return 0
 }
 
 # Provide requested python version and sets PYTHON variable

From 1e26508983a1ebf2c23560395ffca8b1f6f79462 Mon Sep 17 00:00:00 2001
From: Hirotaka Wakabayashi <hiwkby@yahoo.com>
Date: Thu, 2 Jul 2020 06:19:21 +0000
Subject: [PATCH 1761/2409] Use python3-mod-wsgi instead of mod_wsgi on CentOS8

This fixes a stack.sh execution error on CentOS8. We should use
python3-mod_wsgi instead of mod_wsgi since mod_wsgi is replaced by
python3-mod_wsgi. The following change may affect this issue.
https://git.centos.org/rpms/mod_wsgi/c/4a746b53e9e3fef74b227e016e785449160871b8?branch=c8s

Change-Id: I5344ecf519e1a79091b6158c2d711d09b21fae0c
Closes-Bug: #1885645
---
 lib/apache | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/apache b/lib/apache
index cc282006df..a121fb0e6f 100644
--- a/lib/apache
+++ b/lib/apache
@@ -152,7 +152,7 @@ function install_apache_wsgi {
         install_package libapache2-mod-wsgi-py3
     elif is_fedora; then
         sudo rm -f /etc/httpd/conf.d/000-*
-        install_package httpd mod_wsgi
+        install_package httpd python3-mod_wsgi
         # For consistency with Ubuntu, switch to the worker mpm, as
         # the default is event
         sudo sed -i '/mod_mpm_prefork.so/s/^/#/g' /etc/httpd/conf.modules.d/00-mpm.conf

From 8956006e519022bc9640476674e638c7dd080478 Mon Sep 17 00:00:00 2001
From: Xinliang Liu <xinliang.liu@linaro.org>
Date: Thu, 2 Jul 2020 08:31:10 +0000
Subject: [PATCH 1762/2409] Fix string comparison

String comparison should be included with square brackets.

Change-Id: I9a4fab7848e5dba8a5b3b09a75e7aac213368706
---
 lib/apache | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/apache b/lib/apache
index cc282006df..6670219a51 100644
--- a/lib/apache
+++ b/lib/apache
@@ -93,7 +93,7 @@ function install_apache_uwsgi {
 
     if is_ubuntu; then
         local pkg_list="uwsgi uwsgi-plugin-python3 libapache2-mod-proxy-uwsgi"
-        if "$DISTRO" == 'bionic'; then
+        if [[ "$DISTRO" == 'bionic' ]]; then
             pkg_list="${pkg_list} uwsgi-plugin-python"
         fi
         install_package ${pkg_list}

From f8dbfd394a826779f3af403fd5316b9d86492802 Mon Sep 17 00:00:00 2001
From: Abhishek Kekane <akekane@redhat.com>
Date: Mon, 6 Jul 2020 18:42:30 +0000
Subject: [PATCH 1763/2409] Revert "Drop keystone dedicated ports"

This reverts commit f6286cb586eb1f861866bfdf85c4f873c79fd592.

This patch is blocking glance as it needs mod_wsgi to perform new import workflow.

Change-Id: I4475247dfe986114d37678b3d3d552c0c7d02ddc
---
 doc/source/configuration.rst   | 12 ++++++-
 files/apache-keystone.template | 30 +++++++++++++++++
 lib/keystone                   | 59 +++++++++++++++++++++++++++++++---
 openrc                         |  2 +-
 tools/create_userrc.sh         |  2 +-
 tools/fixup_stuff.sh           | 34 ++++++++++++++++++++
 6 files changed, 132 insertions(+), 7 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index ec4a9c84e4..22f5999174 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -137,7 +137,7 @@ OS\_AUTH\_URL
 
     ::
 
-        OS_AUTH_URL=http://$SERVICE_HOST/identity/v3.0
+        OS_AUTH_URL=http://$SERVICE_HOST:5000/v3.0
 
 KEYSTONECLIENT\_DEBUG, NOVACLIENT\_DEBUG
     Set command-line client log level to ``DEBUG``. These are commented
@@ -685,6 +685,16 @@ KEYSTONE_REGION_NAME to specify the region of Keystone service.
 KEYSTONE_REGION_NAME has a default value the same as REGION_NAME thus we omit
 it in the configuration of RegionOne.
 
+Disabling Identity API v2
++++++++++++++++++++++++++
+
+The Identity API v2 is deprecated as of Mitaka and it is recommended to only
+use the v3 API. It is possible to setup keystone without v2 API, by doing:
+
+::
+
+    ENABLE_IDENTITY_V2=False
+
 .. _arch-configuration:
 
 Architectures
diff --git a/files/apache-keystone.template b/files/apache-keystone.template
index cf26c216f5..128436027d 100644
--- a/files/apache-keystone.template
+++ b/files/apache-keystone.template
@@ -1,9 +1,39 @@
+Listen %PUBLICPORT%
+Listen %ADMINPORT%
 LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\" %D(us)" keystone_combined
 
 <Directory %KEYSTONE_BIN%>
     Require all granted
 </Directory>
 
+<VirtualHost *:%PUBLICPORT%>
+    WSGIDaemonProcess keystone-public processes=3 threads=1 user=%USER% display-name=%{GROUP} %VIRTUALENV%
+    WSGIProcessGroup keystone-public
+    WSGIScriptAlias / %KEYSTONE_BIN%/keystone-wsgi-public
+    WSGIApplicationGroup %{GLOBAL}
+    WSGIPassAuthorization On
+    ErrorLogFormat "%M"
+    ErrorLog /var/log/%APACHE_NAME%/keystone.log
+    CustomLog /var/log/%APACHE_NAME%/keystone_access.log keystone_combined
+    %SSLENGINE%
+    %SSLCERTFILE%
+    %SSLKEYFILE%
+</VirtualHost>
+
+<VirtualHost *:%ADMINPORT%>
+    WSGIDaemonProcess keystone-admin processes=3 threads=1 user=%USER% display-name=%{GROUP} %VIRTUALENV%
+    WSGIProcessGroup keystone-admin
+    WSGIScriptAlias / %KEYSTONE_BIN%/keystone-wsgi-admin
+    WSGIApplicationGroup %{GLOBAL}
+    WSGIPassAuthorization On
+    ErrorLogFormat "%M"
+    ErrorLog /var/log/%APACHE_NAME%/keystone.log
+    CustomLog /var/log/%APACHE_NAME%/keystone_access.log keystone_combined
+    %SSLENGINE%
+    %SSLCERTFILE%
+    %SSLKEYFILE%
+</VirtualHost>
+
 %SSLLISTEN%<VirtualHost *:443>
 %SSLLISTEN%    %SSLENGINE%
 %SSLLISTEN%    %SSLCERTFILE%
diff --git a/lib/keystone b/lib/keystone
index 29407a0e69..d4c7b063bb 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -83,10 +83,14 @@ KEYSTONE_TOKEN_FORMAT=$(echo ${KEYSTONE_TOKEN_FORMAT} | tr '[:upper:]' '[:lower:
 
 # Set Keystone interface configuration
 KEYSTONE_AUTH_HOST=${KEYSTONE_AUTH_HOST:-$SERVICE_HOST}
+KEYSTONE_AUTH_PORT=${KEYSTONE_AUTH_PORT:-35357}
+KEYSTONE_AUTH_PORT_INT=${KEYSTONE_AUTH_PORT_INT:-35358}
 KEYSTONE_AUTH_PROTOCOL=${KEYSTONE_AUTH_PROTOCOL:-$SERVICE_PROTOCOL}
 
 # Public facing bits
 KEYSTONE_SERVICE_HOST=${KEYSTONE_SERVICE_HOST:-$SERVICE_HOST}
+KEYSTONE_SERVICE_PORT=${KEYSTONE_SERVICE_PORT:-5000}
+KEYSTONE_SERVICE_PORT_INT=${KEYSTONE_SERVICE_PORT_INT:-5001}
 KEYSTONE_SERVICE_PROTOCOL=${KEYSTONE_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 
 # Bind hosts
@@ -166,14 +170,22 @@ function _config_keystone_apache_wsgi {
     local keystone_ssl=""
     local keystone_certfile=""
     local keystone_keyfile=""
+    local keystone_service_port=$KEYSTONE_SERVICE_PORT
+    local keystone_auth_port=$KEYSTONE_AUTH_PORT
     local venv_path=""
 
+    if is_service_enabled tls-proxy; then
+        keystone_service_port=$KEYSTONE_SERVICE_PORT_INT
+        keystone_auth_port=$KEYSTONE_AUTH_PORT_INT
+    fi
     if [[ ${USE_VENV} = True ]]; then
         venv_path="python-path=${PROJECT_VENV["keystone"]}/lib/$(python_version)/site-packages"
     fi
 
     sudo cp $FILES/apache-keystone.template $keystone_apache_conf
     sudo sed -e "
+        s|%PUBLICPORT%|$keystone_service_port|g;
+        s|%ADMINPORT%|$keystone_auth_port|g;
         s|%APACHE_NAME%|$APACHE_NAME|g;
         s|%SSLLISTEN%|$keystone_ssl_listen|g;
         s|%SSLENGINE%|$keystone_ssl|g;
@@ -210,8 +222,21 @@ function configure_keystone {
 
     iniset_rpc_backend keystone $KEYSTONE_CONF oslo_messaging_notifications
 
+    local service_port=$KEYSTONE_SERVICE_PORT
+    local auth_port=$KEYSTONE_AUTH_PORT
+
+    if is_service_enabled tls-proxy; then
+        # Set the service ports for a proxy to take the originals
+        service_port=$KEYSTONE_SERVICE_PORT_INT
+        auth_port=$KEYSTONE_AUTH_PORT_INT
+    fi
+
     # Override the endpoints advertised by keystone (the public_endpoint and
-    # admin_endpoint) so that clients use the correct endpoint.
+    # admin_endpoint) so that clients use the correct endpoint. By default, the
+    # keystone server uses the public_port and admin_port which isn't going to
+    # work when you want to use a different port (in the case of proxy), or you
+    # don't want the port (in the case of putting keystone on a path in
+    # apache).
     iniset $KEYSTONE_CONF DEFAULT public_endpoint $KEYSTONE_SERVICE_URI
     iniset $KEYSTONE_CONF DEFAULT admin_endpoint $KEYSTONE_AUTH_URI
 
@@ -245,6 +270,12 @@ function configure_keystone {
 
     iniset $KEYSTONE_CONF credential key_repository "$KEYSTONE_CONF_DIR/credential-keys/"
 
+    # Configure the project created by the 'keystone-manage bootstrap' as the cloud-admin project.
+    # The users from this project are globally admin as before, but it also
+    # allows policy changes in order to clarify the adminess scope.
+    #iniset $KEYSTONE_CONF resource admin_project_domain_name Default
+    #iniset $KEYSTONE_CONF resource admin_project_name admin
+
     if [[ "$KEYSTONE_SECURITY_COMPLIANCE_ENABLED" = True ]]; then
         iniset $KEYSTONE_CONF security_compliance lockout_failure_attempts $KEYSTONE_LOCKOUT_FAILURE_ATTEMPTS
         iniset $KEYSTONE_CONF security_compliance lockout_duration $KEYSTONE_LOCKOUT_DURATION
@@ -479,6 +510,14 @@ function install_keystone {
 
 # start_keystone() - Start running processes
 function start_keystone {
+    # Get right service port for testing
+    local service_port=$KEYSTONE_SERVICE_PORT
+    local auth_protocol=$KEYSTONE_AUTH_PROTOCOL
+    if is_service_enabled tls-proxy; then
+        service_port=$KEYSTONE_SERVICE_PORT_INT
+        auth_protocol="http"
+    fi
+
     if [ "$KEYSTONE_DEPLOY" == "mod_wsgi" ]; then
         enable_apache_site keystone
         restart_apache_server
@@ -487,13 +526,23 @@ function start_keystone {
     fi
 
     echo "Waiting for keystone to start..."
-    # Check that the keystone service is running.
+    # Check that the keystone service is running. Even if the tls tunnel
+    # should be enabled, make sure the internal port is checked using
+    # unencryted traffic at this point.
+    # If running in Apache, use the path rather than port.
+
     local service_uri=$auth_protocol://$KEYSTONE_SERVICE_HOST/identity/v$IDENTITY_API_VERSION/
 
     if ! wait_for_service $SERVICE_TIMEOUT $service_uri; then
         die $LINENO "keystone did not start"
     fi
 
+    # Start proxies if enabled
+    if is_service_enabled tls-proxy; then
+        start_tls_proxy keystone-service '*' $KEYSTONE_SERVICE_PORT $KEYSTONE_SERVICE_HOST $KEYSTONE_SERVICE_PORT_INT
+        start_tls_proxy keystone-auth '*' $KEYSTONE_AUTH_PORT $KEYSTONE_AUTH_HOST $KEYSTONE_AUTH_PORT_INT
+    fi
+
     # (re)start memcached to make sure we have a clean memcache.
     restart_service memcached
 }
@@ -512,9 +561,11 @@ function stop_keystone {
 # This function uses the following GLOBAL variables:
 # - ``KEYSTONE_BIN_DIR``
 # - ``ADMIN_PASSWORD``
-# - ``KEYSTONE_AUTH_URI``
+# - ``IDENTITY_API_VERSION``
 # - ``REGION_NAME``
-# - ``KEYSTONE_SERVICE_URI``
+# - ``KEYSTONE_SERVICE_PROTOCOL``
+# - ``KEYSTONE_SERVICE_HOST``
+# - ``KEYSTONE_SERVICE_PORT``
 function bootstrap_keystone {
     $KEYSTONE_BIN_DIR/keystone-manage bootstrap \
         --bootstrap-username admin \
diff --git a/openrc b/openrc
index 28f388be4c..beeaebea42 100644
--- a/openrc
+++ b/openrc
@@ -86,7 +86,7 @@ export OS_AUTH_TYPE=password
 #
 
 # If you don't have a working .stackenv, this is the backup position
-KEYSTONE_BACKUP=$SERVICE_PROTOCOL://$SERVICE_HOST/identity
+KEYSTONE_BACKUP=$SERVICE_PROTOCOL://$SERVICE_HOST:5000
 KEYSTONE_SERVICE_URI=${KEYSTONE_SERVICE_URI:-$KEYSTONE_BACKUP}
 
 export OS_AUTH_URL=${OS_AUTH_URL:-$KEYSTONE_SERVICE_URI}
diff --git a/tools/create_userrc.sh b/tools/create_userrc.sh
index c7bea4ac08..f4a4edcbe2 100755
--- a/tools/create_userrc.sh
+++ b/tools/create_userrc.sh
@@ -152,7 +152,7 @@ if [ -z "$OS_USERNAME" ]; then
 fi
 
 if [ -z "$OS_AUTH_URL" ]; then
-    export OS_AUTH_URL=http://localhost/identity/v3/
+    export OS_AUTH_URL=http://localhost:5000/v3/
 fi
 
 if [ -z "$OS_USER_DOMAIN_ID" -a -z "$OS_USER_DOMAIN_NAME" ]; then
diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index 2ac8a47ca7..e1409291b9 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -26,6 +26,39 @@ if [[ -z "$TOP_DIR" ]]; then
     FILES=$TOP_DIR/files
 fi
 
+# Keystone Port Reservation
+# -------------------------
+# Reserve and prevent ``KEYSTONE_AUTH_PORT`` and ``KEYSTONE_AUTH_PORT_INT`` from
+# being used as ephemeral ports by the system. The default(s) are 35357 and
+# 35358 which are in the Linux defined ephemeral port range (in disagreement
+# with the IANA ephemeral port range). This is a workaround for bug #1253482
+# where Keystone will try and bind to the port and the port will already be
+# in use as an ephemeral port by another process. This places an explicit
+# exception into the Kernel for the Keystone AUTH ports.
+function fixup_keystone {
+    keystone_ports=${KEYSTONE_AUTH_PORT:-35357},${KEYSTONE_AUTH_PORT_INT:-35358}
+
+    # Only do the reserved ports when available, on some system (like containers)
+    # where it's not exposed we are almost pretty sure these ports would be
+    # exclusive for our DevStack.
+    if sysctl net.ipv4.ip_local_reserved_ports >/dev/null 2>&1; then
+        # Get any currently reserved ports, strip off leading whitespace
+        reserved_ports=$(sysctl net.ipv4.ip_local_reserved_ports | awk -F'=' '{print $2;}' | sed 's/^ //')
+
+        if [[ -z "${reserved_ports}" ]]; then
+            # If there are no currently reserved ports, reserve the keystone ports
+            sudo sysctl -w net.ipv4.ip_local_reserved_ports=${keystone_ports}
+        else
+            # If there are currently reserved ports, keep those and also reserve the
+            # Keystone specific ports. Duplicate reservations are merged into a single
+            # reservation (or range) automatically by the kernel.
+            sudo sysctl -w net.ipv4.ip_local_reserved_ports=${keystone_ports},${reserved_ports}
+        fi
+    else
+        echo_summary "WARNING: unable to reserve keystone ports"
+    fi
+}
+
 # Ubuntu Repositories
 #--------------------
 # Enable universe for bionic since it is missing when installing from ISO.
@@ -175,6 +208,7 @@ function fixup_suse {
 }
 
 function fixup_all {
+    fixup_keystone
     fixup_ubuntu
     fixup_fedora
     fixup_suse

From 6184dea966d56f13f15d926dbb09e527ae3ba39e Mon Sep 17 00:00:00 2001
From: Rui Zang <rui.zang@intel.com>
Date: Mon, 6 Jul 2020 23:47:56 -0700
Subject: [PATCH 1764/2409] Remove n-api-metadata service from compute nodes

Starting up n-api-metadata service on every compute nodes does
not solve the problem of isolated networks (no route to metadata
service). It all depends on how 'enable_isolated_metadata' and
related options (e.g. force_metadata) are set in dhcp agent and
what is configured for the 'nova_metadata_host' option of q-meta
service. Having a global n-api-metadata service in the control
node is sufficient for a mult-node lab setup.
Besides, the n-api-metadata services on compute nodes are not
really working due to https://bugs.launchpad.net/nova/+bug/1815082

Change-Id: Ib8691c3eeee59758fbd98989d9460f1458ea422f
Related-Bug: 1815082
---
 doc/source/guides/multinode-lab.rst | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
index 15f02a0e5e..c0b3f58157 100644
--- a/doc/source/guides/multinode-lab.rst
+++ b/doc/source/guides/multinode-lab.rst
@@ -169,17 +169,12 @@ machines, create a ``local.conf`` with:
     MYSQL_HOST=$SERVICE_HOST
     RABBIT_HOST=$SERVICE_HOST
     GLANCE_HOSTPORT=$SERVICE_HOST:9292
-    ENABLED_SERVICES=n-cpu,q-agt,n-api-meta,c-vol,placement-client
+    ENABLED_SERVICES=n-cpu,q-agt,c-vol,placement-client
     NOVA_VNC_ENABLED=True
     NOVNCPROXY_URL="http://$SERVICE_HOST:6080/vnc_lite.html"
     VNCSERVER_LISTEN=$HOST_IP
     VNCSERVER_PROXYCLIENT_ADDRESS=$VNCSERVER_LISTEN
 
-**Note:** the ``n-api-meta`` service is a version of the api server
-that only serves the metadata service. It's needed because the
-computes created won't have a routing path to the metadata service on
-the controller.
-
 Fire up OpenStack:
 
 ::

From 95634d990572fdaf94e199e06a2b3b04f7c27b3a Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Thu, 21 Feb 2019 12:24:17 +0000
Subject: [PATCH 1765/2409] Re-enable memory_tracker

The old peakmem_tracker service has been disabled in [0], now enable
the replacement memory_tracker.

Also fail when the old service is still configured, otherwise
consumers might never notice.

Depends-On: https://review.opendev.org/739995
Change-Id: I583caf3f36a8ff41d7d4106dabc6c5f24243085e
---
 .zuul.yaml | 4 ++++
 lib/dstat  | 6 +++---
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 43e5d4cf8a..256ede98a6 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -404,6 +404,7 @@
         # Shared services
         dstat: true
         etcd3: true
+        memory_tracker: true
         mysql: true
         rabbit: true
     group-vars:
@@ -411,6 +412,7 @@
         devstack_services:
           # Shared services
           dstat: true
+          memory_tracker: true
         devstack_localrc:
           # Multinode specific settings
           HOST_IP: "{{ hostvars[inventory_hostname]['nodepool']['private_ipv4'] }}"
@@ -476,6 +478,7 @@
         # Shared services
         dstat: true
         etcd3: true
+        memory_tracker: true
         mysql: true
         rabbit: true
         tls-proxy: true
@@ -524,6 +527,7 @@
           # This list replaces the test-matrix.
           # Shared services
           dstat: true
+          memory_tracker: true
           tls-proxy: true
           # Nova services
           n-cpu: true
diff --git a/lib/dstat b/lib/dstat
index f5bd2bb948..eb03ae0fb2 100644
--- a/lib/dstat
+++ b/lib/dstat
@@ -35,10 +35,10 @@ function start_dstat {
     # to your localrc
     run_process memory_tracker "$TOP_DIR/tools/memory_tracker.sh" "" "root"
 
-    # remove support for the old name when it's no longer used (sometime in Queens)
+    # TODO(jh): Fail when using the old service name otherwise consumers might
+    # never notice that is has been removed.
     if is_service_enabled peakmem_tracker; then
-        deprecated "Use of peakmem_tracker in devstack is deprecated, use memory_tracker instead"
-        run_process peakmem_tracker "$TOP_DIR/tools/memory_tracker.sh" "" "root"
+        die $LINENO "The peakmem_tracker service has been removed, use memory_tracker instead"
     fi
 }
 

From 0cbbefc0cb6f58b09a722d1230e7ae86113b2989 Mon Sep 17 00:00:00 2001
From: Luigi Toscano <ltoscano@redhat.com>
Date: Fri, 10 Jul 2020 13:21:45 +0200
Subject: [PATCH 1766/2409] zuul: clean up some legacy jobs

Replace legacy-tempest-dsvm-lvm-multibackend with its native version,
cinder-tempest-lvm-multibackend.

Remove legacy-tempest-dsvm-neutron-dvr-multinode-full, which was defined
as an experimental job in neutron and removed during the ussuri lifecycle.
See https://review.opendev.org/#/c/693630/

Change-Id: I76d1efaa3a6c1fe9825e8457438f514114b2ecad
---
 .zuul.yaml | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 43e5d4cf8a..fc3c4704d9 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -803,15 +803,11 @@
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
-        - legacy-tempest-dsvm-neutron-dvr-multinode-full:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
         - neutron-tempest-dvr-ha-multinode-full:
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
-        - legacy-tempest-dsvm-lvm-multibackend:
+        - cinder-tempest-lvm-multibackend:
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$

From 73ad9760a384e3f872de07a174440fe8e3b174ec Mon Sep 17 00:00:00 2001
From: Abhishek Kekane <akekane@redhat.com>
Date: Tue, 16 Jun 2020 15:20:48 +0000
Subject: [PATCH 1767/2409] Use glance import workflow for creating image

Added new boolean option 'GLANCE_USE_IMPORT_WORKFLOW' default to False.
If this parameter set in local.conf as True then devstack will use the
new import workflow to create the image.

In order to use new import workflow of glance;
user need to set below options in local.conf

GLANCE_USE_IMPORT_WORKFLOW=True

Note that the import workflow does not work in uwsgi because of
some fundamental restrictions it has. Thus, devstack must be configured
with WSGI_MODE=mod_wsgi, otherwise glance will not be able to process
the imports. The new helper function will abort to avoid in that case
to avoid the image never being moved to "active" state by an import
task that will never be executed.

Co-Authored-By: Abhishek Kekane <akekane@redhat.com>
Co-Authored-By: Dan Smith <dansmith@redhat.com>
Needed-By: https://review.opendev.org/#/c/734184
Change-Id: I1306fe816b7a3eca1e2312c0c454be3d81118eca
---
 functions  | 79 ++++++++++++++++++++++++++++++++++--------------------
 lib/glance |  2 ++
 2 files changed, 52 insertions(+), 29 deletions(-)

diff --git a/functions b/functions
index 24700153a9..2d60a0821f 100644
--- a/functions
+++ b/functions
@@ -77,6 +77,41 @@ function get_extra_file {
     fi
 }
 
+# Upload an image to glance using the configured mechanism
+#
+# Arguments:
+#  image name
+#  container format
+#  disk format
+#  path to image file
+#  optional properties (format of propname=value)
+#
+function _upload_image {
+    local image_name="$1"
+    shift
+    local container="$1"
+    shift
+    local disk="$1"
+    shift
+    local image="$1"
+    shift
+    local properties
+    local useimport
+
+    for prop in $*; do
+        properties+=" --property $prop"
+    done
+
+    if [[ "$GLANCE_USE_IMPORT_WORKFLOW" == "True" ]]; then
+        if [[ "$WSGI_MODE" != "uwsgi" ]]; then
+            useimport="--import"
+        else
+            echo "*** Unable to use glance import workflow because WSGI_MODE=uwsgi! ***"
+        fi
+    fi
+
+    openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name" --public --container-format "$container" --disk-format "$disk" $useimport $properties < "${image}"
+}
 
 # Retrieve an image from a URL and upload into Glance.
 # Uses the following variables:
@@ -118,7 +153,7 @@ function upload_image {
     # OpenVZ-format images are provided as .tar.gz, but not decompressed prior to loading
     if [[ "$image_url" =~ 'openvz' ]]; then
         image_name="${image_fname%.tar.gz}"
-        openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name" --public --container-format ami --disk-format ami < "${image}"
+        _upload_image "$image_name" ami ami "$image"
         return
     fi
 
@@ -232,7 +267,8 @@ function upload_image {
         vmdk_adapter_type="${props[1]:-$vmdk_adapter_type}"
         vmdk_net_adapter="${props[2]:-$vmdk_net_adapter}"
 
-        openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name" --public --container-format bare --disk-format vmdk --property vmware_disktype="$vmdk_disktype" --property vmware_adaptertype="$vmdk_adapter_type" --property hw_vif_model="$vmdk_net_adapter" < "${image}"
+        _upload_image "$image_name" bare vmdk "$image" vmware_disktype="$vmdk_disktype" vmware_adaptertype="$vmdk_adapter_type" hw_vif_model="$vmdk_net_adapter"
+
         return
     fi
 
@@ -246,14 +282,9 @@ function upload_image {
             # Nova defaults to PV for all VHD images, but
             # the glance setting is needed for booting
             # directly from volume.
-            force_vm_mode="--property vm_mode=xen"
+            force_vm_mode="vm_mode=xen"
         fi
-        openstack \
-            --os-cloud=devstack-admin --os-region-name="$REGION_NAME" \
-            image create \
-            "$image_name" --public \
-            --container-format=ovf --disk-format=vhd \
-            $force_vm_mode < "${image}"
+        _upload_image "$image_name" ovf vhd "$image" $force_vm_mode
         return
     fi
 
@@ -262,12 +293,7 @@ function upload_image {
     # Setting metadata, so PV mode is used.
     if [[ "$image_url" =~ '.xen-raw.tgz' ]]; then
         image_name="${image_fname%.xen-raw.tgz}"
-        openstack \
-            --os-cloud=devstack-admin --os-region-name="$REGION_NAME" \
-            image create \
-            "$image_name" --public \
-            --container-format=tgz --disk-format=raw \
-            --property vm_mode=xen < "${image}"
+        _upload_image "$image_name" tgz raw "$image" vm_mode=xen
         return
     fi
 
@@ -278,12 +304,7 @@ function upload_image {
             die $LINENO "Unknown vm_mode=${vm_mode} for Virtuozzo image"
         fi
 
-        openstack \
-            --os-cloud=devstack-admin --os-region-name="$REGION_NAME" \
-            image create \
-            "$image_name" --public \
-            --container-format=bare --disk-format=ploop \
-            --property vm_mode=$vm_mode < "${image}"
+        _upload_image "$image_name" bare ploop "$image" vm_mode=$vm_mode
         return
     fi
 
@@ -292,7 +313,7 @@ function upload_image {
     local disk_format=""
     local container_format=""
     local unpack=""
-    local img_property="--property hw_rng_model=virtio"
+    local img_property="hw_rng_model=virtio"
     case "$image_fname" in
         *.tar.gz|*.tgz)
             # Extract ami and aki files
@@ -370,18 +391,18 @@ function upload_image {
     esac
 
     if is_arch "ppc64le" || is_arch "ppc64" || is_arch "ppc"; then
-        img_property="$img_property --property hw_cdrom_bus=scsi --property os_command_line=console=hvc0"
+        img_property="$img_property hw_cdrom_bus=scsi os_command_line=console=hvc0"
     fi
 
     if is_arch "aarch64"; then
-        img_property="$img_property --property hw_machine_type=virt --property hw_cdrom_bus=scsi --property hw_scsi_model=virtio-scsi --property os_command_line='console=ttyAMA0'"
+        img_property="$img_property hw_machine_type=virt hw_cdrom_bus=scsi hw_scsi_model=virtio-scsi os_command_line='console=ttyAMA0'"
     fi
 
     if [ "$container_format" = "bare" ]; then
         if [ "$unpack" = "zcat" ]; then
-            openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name" $img_property --public --container-format=$container_format --disk-format $disk_format < <(zcat --force "${image}")
+            _upload_image "$image_name" $container_format $disk_format <(zcat --force "$image") $img_property
         elif [ "$unpack" = "bunzip2" ]; then
-            openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name" $img_property --public --container-format=$container_format --disk-format $disk_format < <(bunzip2 -cdk "${image}")
+            _upload_image "$image_name" $container_format $disk_format <(bunzip2 -cdk "$image") $img_property
         elif [ "$unpack" = "unxz" ]; then
             # NOTE(brtknr): unxz the file first and cleanup afterwards to
             # prevent timeout while Glance tries to upload image (e.g. to Swift).
@@ -390,10 +411,10 @@ function upload_image {
             tmp_dir=$(mktemp -d)
             image_path="$tmp_dir/$image_name"
             unxz -cv "${image}" > "$image_path"
-            openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name" $img_property --public --container-format=$container_format --disk-format $disk_format --file "$image_path"
+            _upload_image "$image_name" $container_format $disk_format "$image_path" $img_property
             rm -rf $tmp_dir
         else
-            openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name" $img_property --public --container-format=$container_format --disk-format $disk_format < "${image}"
+            _upload_image "$image_name" $container_format $disk_format "$image" $img_property
         fi
     else
         # Use glance client to add the kernel the root filesystem.
@@ -406,7 +427,7 @@ function upload_image {
         if [ -n "$ramdisk" ]; then
             ramdisk_id=$(openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name-ramdisk" $img_property --public --container-format ari --disk-format ari < "$ramdisk" | grep ' id ' | get_field 2)
         fi
-        openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "${image_name%.img}" $img_property --public --container-format ami --disk-format ami ${kernel_id:+--property kernel_id=$kernel_id} ${ramdisk_id:+--property ramdisk_id=$ramdisk_id} < "${image}"
+        _upload_image "${image_name%.img}" ami ami "$image" ${kernel_id:+ kernel_id=$kernel_id} ${ramdisk_id:+ ramdisk_id=$ramdisk_id} $img_property
     fi
 }
 
diff --git a/lib/glance b/lib/glance
index b9c23aad74..bbabb96f0f 100644
--- a/lib/glance
+++ b/lib/glance
@@ -65,6 +65,8 @@ GLANCE_LOCK_DIR=${GLANCE_LOCK_DIR:=$DATA_DIR/glance/locks}
 GLANCE_STAGING_DIR=${GLANCE_MULTISTORE_FILE_IMAGE_DIR:=$DATA_DIR/os_glance_staging_store}
 GLANCE_TASKS_DIR=${GLANCE_MULTISTORE_FILE_IMAGE_DIR:=$DATA_DIR/os_glance_tasks_store}
 
+GLANCE_USE_IMPORT_WORKFLOW=$(trueorfalse False GLANCE_USE_IMPORT_WORKFLOW)
+
 GLANCE_CONF_DIR=${GLANCE_CONF_DIR:-/etc/glance}
 GLANCE_METADEF_DIR=$GLANCE_CONF_DIR/metadefs
 GLANCE_API_CONF=$GLANCE_CONF_DIR/glance-api.conf

From 09eea0b20bf750baa10b4edb5cd52e31b19a4a3a Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Thu, 9 Jul 2020 08:31:51 -0700
Subject: [PATCH 1768/2409] Make Glance standalone-ness a separate flag

Full Glance functionality requires Glance being run in a configuration
where it can spawn long-running task threads. The default uwsgi mode
does not allow this, and the current workaround is to set WSGI_MODE
to something other than uwsgi to get the devstack code to deploy
Glance as a standalone service. Since this affects the entire rest of
the deployment, this patch separates out a flag to control this behavior
specifically for Glance. When WSGI_MODE=uwsgi, control of the Glance
deployment mechanism is allowed via GLANCE_STANDALONE=True|False. If
WSGI_MODE!= uwsgi then we deploy standalone Glance anyway.

Change-Id: I79068ce0bd7414bc48ff534ee22f0de5d7b091cb
---
 functions  |  4 ++--
 lib/apache | 19 +++++++++++++++++++
 lib/glance | 12 ++++++++++--
 3 files changed, 31 insertions(+), 4 deletions(-)

diff --git a/functions b/functions
index 2d60a0821f..9b0ea671f5 100644
--- a/functions
+++ b/functions
@@ -103,10 +103,10 @@ function _upload_image {
     done
 
     if [[ "$GLANCE_USE_IMPORT_WORKFLOW" == "True" ]]; then
-        if [[ "$WSGI_MODE" != "uwsgi" ]]; then
+        if [[ "$GLANCE_STANDALONE" == "True" ]]; then
             useimport="--import"
         else
-            echo "*** Unable to use glance import workflow because WSGI_MODE=uwsgi! ***"
+            echo "*** Unable to use glance import workflow because glance is not standalone! ***"
         fi
     fi
 
diff --git a/lib/apache b/lib/apache
index 6670219a51..2e0a2495f5 100644
--- a/lib/apache
+++ b/lib/apache
@@ -372,6 +372,25 @@ function write_local_uwsgi_http_config {
     restart_apache_server
 }
 
+# Write a straight-through proxy for a service that runs locally and just needs
+# to be reachable via the main http proxy at $loc
+function write_local_proxy_http_config {
+    local name=$1
+    local url=$2
+    local loc=$3
+    local apache_conf
+    apache_conf=$(apache_site_config_for $name)
+
+    enable_apache_mod proxy
+    enable_apache_mod proxy_http
+
+    echo "KeepAlive Off" | sudo tee $apache_conf
+    echo "SetEnv proxy-sendchunked 1" | sudo tee -a $apache_conf
+    echo "ProxyPass \"${loc}\" \"$url\" retry=0 " | sudo tee -a $apache_conf
+    enable_apache_site $name
+    restart_apache_server
+}
+
 function remove_uwsgi_config {
     local file=$1
     local wsgi=$2
diff --git a/lib/glance b/lib/glance
index bbabb96f0f..eebaec2a33 100644
--- a/lib/glance
+++ b/lib/glance
@@ -55,6 +55,13 @@ GLANCE_DEFAULT_BACKEND=${GLANCE_DEFAULT_BACKEND:-fast}
 
 GLANCE_CACHE_DIR=${GLANCE_CACHE_DIR:=$DATA_DIR/glance/cache}
 
+# Full Glance functionality requires running in standalone mode. If we are
+# not in uwsgi mode, then we are standalone, otherwise allow separate control.
+if [[ "$WSGI_MODE" != "uwsgi" ]]; then
+    GLANCE_STANDALONE=True
+fi
+GLANCE_STANDALONE=${GLANCE_STANDALONE:-False}
+
 # File path for each store specified in GLANCE_MULTIPLE_FILE_STORES, the store
 # identifier will be appended to this path at runtime. If GLANCE_MULTIPLE_FILE_STORES
 # has fast,cheap specified then filepath will be generated like $DATA_DIR/glance/fast
@@ -240,9 +247,10 @@ function configure_glance {
         iniset $GLANCE_CACHE_CONF DEFAULT cinder_endpoint_template "https://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v3/%(project_id)s"
     fi
 
-    if [[ "$WSGI_MODE" == "uwsgi" ]]; then
+    if [[ "$GLANCE_STANDALONE" == False ]]; then
         write_local_uwsgi_http_config "$GLANCE_UWSGI_CONF" "$GLANCE_UWSGI" "/image"
     else
+        write_local_proxy_http_config glance "http://$GLANCE_SERVICE_HOST:$GLANCE_SERVICE_PORT_INT" "/image"
         iniset $GLANCE_API_CONF DEFAULT bind_host $GLANCE_SERVICE_LISTEN_ADDRESS
         iniset $GLANCE_API_CONF DEFAULT workers "$API_WORKERS"
     fi
@@ -342,7 +350,7 @@ function start_glance {
         fi
     fi
 
-    if [[ "$WSGI_MODE" == "uwsgi" ]]; then
+    if [[ "$GLANCE_STANDALONE" == False ]]; then
         run_process g-api "$(which uwsgi) --procname-prefix glance-api --ini $GLANCE_UWSGI_CONF"
     else
         run_process g-api "$GLANCE_BIN_DIR/glance-api --config-dir=$GLANCE_CONF_DIR"

From 2614c1bba103cb88c9a88a1dfe9c6af7ccc1cc55 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Wed, 15 Jul 2020 14:41:38 -0700
Subject: [PATCH 1769/2409] Fix ami/aki image create use of $img_property

This abstracts out the conversion of key=value,... property lists to a function
and makes both _upload_image() and the two ami/aki image create calls use it. The
move to bare key=value properties introduced a regression for ami/aki where
the --property flag stopped being passed to osc in that case.

Change-Id: Idf7fdfe3f5800f79f6c48f9d9606a7b53436a730
---
 functions | 21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/functions b/functions
index 9b0ea671f5..e687a9848d 100644
--- a/functions
+++ b/functions
@@ -77,6 +77,19 @@ function get_extra_file {
     fi
 }
 
+# Generate image property arguments for OSC
+#
+# Arguments: properties, one per, like propname=value
+#
+# Result is --property propname1=value1 --property propname2=value2
+function _image_properties_to_arg {
+    local result=""
+    for property in $*; do
+        result+=" --property $property"
+    done
+    echo $result
+}
+
 # Upload an image to glance using the configured mechanism
 #
 # Arguments:
@@ -98,9 +111,7 @@ function _upload_image {
     local properties
     local useimport
 
-    for prop in $*; do
-        properties+=" --property $prop"
-    done
+    properties=$(_image_properties_to_arg $*)
 
     if [[ "$GLANCE_USE_IMPORT_WORKFLOW" == "True" ]]; then
         if [[ "$GLANCE_STANDALONE" == "True" ]]; then
@@ -422,10 +433,10 @@ function upload_image {
         # kernel for use when uploading the root filesystem.
         local kernel_id="" ramdisk_id="";
         if [ -n "$kernel" ]; then
-            kernel_id=$(openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name-kernel" $img_property --public --container-format aki --disk-format aki < "$kernel" | grep ' id ' | get_field 2)
+            kernel_id=$(openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name-kernel" $(_image_properties_to_arg $img_property) --public --container-format aki --disk-format aki < "$kernel" | grep ' id ' | get_field 2)
         fi
         if [ -n "$ramdisk" ]; then
-            ramdisk_id=$(openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name-ramdisk" $img_property --public --container-format ari --disk-format ari < "$ramdisk" | grep ' id ' | get_field 2)
+            ramdisk_id=$(openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name-ramdisk" $(_image_properties_to_arg $img_property) --public --container-format ari --disk-format ari < "$ramdisk" | grep ' id ' | get_field 2)
         fi
         _upload_image "${image_name%.img}" ami ami "$image" ${kernel_id:+ kernel_id=$kernel_id} ${ramdisk_id:+ ramdisk_id=$ramdisk_id} $img_property
     fi

From 49ad4850c8d5be9c90b10f118853e0288997405d Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Wed, 15 Jul 2020 14:54:22 -0700
Subject: [PATCH 1770/2409] Only set hw_rng_model by default if we're on
 libvirt

This makes no sense to set on _every_ devstack deployment, only
if we are using libvirt qemu or kvm. Make it conditional.

Change-Id: I860e899274646ff73b8f084a0583325239aee9cc
---
 functions | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/functions b/functions
index e687a9848d..c34e4874b3 100644
--- a/functions
+++ b/functions
@@ -324,7 +324,16 @@ function upload_image {
     local disk_format=""
     local container_format=""
     local unpack=""
-    local img_property="hw_rng_model=virtio"
+    local img_property=""
+
+    # NOTE(danms): If we're on libvirt/qemu or libvirt/kvm, set the hw_rng_model
+    # to libvirt in the image properties.
+    if [[ "$VIRT_DRIVER" == "libvirt" ]]; then
+        if [[ "$LIBVIRT_TYPE" == "qemu" || "$LIBVIRT_TYPE" == "kvm" ]]; then
+            img_property="hw_rng_model=virtio"
+        fi
+    fi
+
     case "$image_fname" in
         *.tar.gz|*.tgz)
             # Extract ami and aki files

From cc0821a5867358b34d7a9c156d02bd19b2f46dec Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Wed, 15 Jul 2020 08:44:00 -0700
Subject: [PATCH 1771/2409] Default Glance to standalone mode

A whole set of Glance functionality is not usable under uwsgi, including any
of the more powerful async import, customization, and copying functions.
In order to facilitate writing and running tempest tests for these features
in all environments covered by the various jobs across all the projects that
include Glance, we should default to this deployment method.

It is still possible to deploy glance in uwsgi mode by setting the flag to
False, and we can do that for some jobs to make sure that it continues to
work. However, the default should be what we expect deployers will use,
which is standalone mode.

Depends-On: https://review.opendev.org/741479
Change-Id: I141acab2a07a4eebd8d850f900058bc8cbf9c7bf
---
 lib/glance | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/glance b/lib/glance
index eebaec2a33..e941168d32 100644
--- a/lib/glance
+++ b/lib/glance
@@ -60,7 +60,7 @@ GLANCE_CACHE_DIR=${GLANCE_CACHE_DIR:=$DATA_DIR/glance/cache}
 if [[ "$WSGI_MODE" != "uwsgi" ]]; then
     GLANCE_STANDALONE=True
 fi
-GLANCE_STANDALONE=${GLANCE_STANDALONE:-False}
+GLANCE_STANDALONE=${GLANCE_STANDALONE:-True}
 
 # File path for each store specified in GLANCE_MULTIPLE_FILE_STORES, the store
 # identifier will be appended to this path at runtime. If GLANCE_MULTIPLE_FILE_STORES

From 442c57e16855863346806bd6b21e82515158b9e8 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Thu, 16 Jul 2020 10:41:13 -0700
Subject: [PATCH 1772/2409] Disable all import methods if glance is not
 standalone

Glance should not be exposing import methods that cannot work via its
API, but it does today. In order for tempest (et al) to be able to
properly detect whether import is possible, we must configure the
import methods in standalone mode, or disable them in wsgi mode. The
referenced Glance patch will make this a requirement.

Change-Id: I3bf3498d83607c5e98b70877c061dc54fc3c0a6e
Needed-By: https://review.opendev.org/#/c/741497/
---
 lib/glance | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/lib/glance b/lib/glance
index e941168d32..0f7cd61d72 100644
--- a/lib/glance
+++ b/lib/glance
@@ -183,6 +183,11 @@ function configure_glance {
         iniset $GLANCE_API_CONF cors allowed_origin "http://$SERVICE_HOST"
     fi
 
+    if [[ "$GLANCE_STANDALONE" == "False" ]]; then
+        # NOTE(danms): Do not advertise import methods if we are running in WSGI mode
+        iniset $GLANCE_API_CONF enabled_import_methods []
+    fi
+
     # No multiple stores for swift yet
     # Store the images in swift if enabled.
     if is_service_enabled s-proxy; then

From f2577fc574d2d8299b3cfff458702321aca57e44 Mon Sep 17 00:00:00 2001
From: Abhishek Kekane <akekane@redhat.com>
Date: Fri, 17 Jul 2020 08:19:40 +0000
Subject: [PATCH 1773/2409] Add missing glance multi-store configurations

While removing registry [1] we by mistake removed some code related to
multiple store configuration for glance. This must be happened during
resolving merged conflicts.

Adding it back.

[1] https://review.opendev.org/708062

Change-Id: I2b84f7b7c51b7b20765a06b48c75006fd2e8ab71
---
 lib/glance | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/lib/glance b/lib/glance
index eebaec2a33..6c9c0dff71 100644
--- a/lib/glance
+++ b/lib/glance
@@ -143,6 +143,16 @@ function configure_glance {
     local dburl
     dburl=`database_connection_url glance`
 
+    # Configure multiple stores
+    if [[ "$GLANCE_ENABLE_MULTIPLE_STORES" == "True" ]]; then
+        local store enabled_backends
+        enabled_backends=""
+        for store in $(echo $GLANCE_MULTIPLE_FILE_STORES | tr "," "\n"); do
+            enabled_backends+="${store}:file,"
+        done
+        iniset $GLANCE_API_CONF DEFAULT enabled_backends ${enabled_backends::-1}
+    fi
+
     iniset $GLANCE_API_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
     iniset $GLANCE_API_CONF database connection $dburl
     iniset $GLANCE_API_CONF DEFAULT use_syslog $SYSLOG

From fcbf3e976c8fa80099698693d37afa81058803c7 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Fri, 17 Jul 2020 10:14:14 -0700
Subject: [PATCH 1774/2409] Fix glance standalone when tls-proxy is disabled
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We always want to start glance on the internal port now,
regardless of whether or not tls-proxy is in use, because we
write_local_proxy_http_config() for the standalone case.

Change-Id: I47dea645d4a852e02e25af0e1df9c28fec92c42a
Co-Authored-By: Radosław Piliszek <radoslaw.piliszek@gmail.com>
---
 lib/glance | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/glance b/lib/glance
index e941168d32..f08e2ed7ab 100644
--- a/lib/glance
+++ b/lib/glance
@@ -252,6 +252,7 @@ function configure_glance {
     else
         write_local_proxy_http_config glance "http://$GLANCE_SERVICE_HOST:$GLANCE_SERVICE_PORT_INT" "/image"
         iniset $GLANCE_API_CONF DEFAULT bind_host $GLANCE_SERVICE_LISTEN_ADDRESS
+        iniset $GLANCE_API_CONF DEFAULT bind_port $GLANCE_SERVICE_PORT_INT
         iniset $GLANCE_API_CONF DEFAULT workers "$API_WORKERS"
     fi
 }

From 7700d5a825e48ea5f536e580df5c769a7224afcc Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Mon, 20 Jul 2020 17:01:41 -0700
Subject: [PATCH 1775/2409] Fix setting enabled_import_methods if glance is
 standalone

I forgot to update devstack with the section name when I did Grenade.

Change-Id: I928072e935e7a7ec24609cdc4522c96f65d3ba3b
---
 lib/glance | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/glance b/lib/glance
index 5fc7a7f0c3..3e5ebde935 100644
--- a/lib/glance
+++ b/lib/glance
@@ -195,7 +195,7 @@ function configure_glance {
 
     if [[ "$GLANCE_STANDALONE" == "False" ]]; then
         # NOTE(danms): Do not advertise import methods if we are running in WSGI mode
-        iniset $GLANCE_API_CONF enabled_import_methods []
+        iniset $GLANCE_API_CONF DEFAULT enabled_import_methods []
     fi
 
     # No multiple stores for swift yet

From 33f8f6e68419702df3cb4b8d8af2f6587ebae527 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Tue, 21 Jul 2020 19:41:48 -0700
Subject: [PATCH 1776/2409] Remove standalone requirement for glance import

As of the referenced patch in glance, we can do import in wsgi mode.
Also remove the enforcement that import methods are disabled.

Change-Id: I8da4b4ad6105bb64c4045ca80db9742591d01564
Depends-On: https://review.opendev.org/#/c/742065
---
 functions  | 6 +-----
 lib/glance | 5 -----
 2 files changed, 1 insertion(+), 10 deletions(-)

diff --git a/functions b/functions
index c34e4874b3..cc1ca6cb25 100644
--- a/functions
+++ b/functions
@@ -114,11 +114,7 @@ function _upload_image {
     properties=$(_image_properties_to_arg $*)
 
     if [[ "$GLANCE_USE_IMPORT_WORKFLOW" == "True" ]]; then
-        if [[ "$GLANCE_STANDALONE" == "True" ]]; then
-            useimport="--import"
-        else
-            echo "*** Unable to use glance import workflow because glance is not standalone! ***"
-        fi
+        useimport="--import"
     fi
 
     openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name" --public --container-format "$container" --disk-format "$disk" $useimport $properties < "${image}"
diff --git a/lib/glance b/lib/glance
index 3e5ebde935..2118636a46 100644
--- a/lib/glance
+++ b/lib/glance
@@ -193,11 +193,6 @@ function configure_glance {
         iniset $GLANCE_API_CONF cors allowed_origin "http://$SERVICE_HOST"
     fi
 
-    if [[ "$GLANCE_STANDALONE" == "False" ]]; then
-        # NOTE(danms): Do not advertise import methods if we are running in WSGI mode
-        iniset $GLANCE_API_CONF DEFAULT enabled_import_methods []
-    fi
-
     # No multiple stores for swift yet
     # Store the images in swift if enabled.
     if is_service_enabled s-proxy; then

From 32d5b1ea2f7908b3558dd38d32553abeaf5db40b Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Wed, 22 Jul 2020 20:52:48 -0500
Subject: [PATCH 1777/2409] Enable image import test

If glance is in standalone mode, image import works
fine so enable the tempest tests. Once we will have image
import or other async tasks working with glance under uwsgi
then we can remove this flag and run import tests by default.

Depends-On: https://review.opendev.org/#/c/741425/
Change-Id: I853e8a3815187f0aa8f05c70488ec948a97e55a6
---
 lib/tempest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index 47bdc22311..125749b314 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -345,7 +345,7 @@ function configure_tempest {
     if [ "$VIRT_DRIVER" = "xenserver" ]; then
         iniset $TEMPEST_CONFIG image disk_formats "ami,ari,aki,vhd,raw,iso"
     fi
-
+    iniset $TEMPEST_CONFIG image-feature-enabled import_image $GLANCE_USE_IMPORT_WORKFLOW
     # Compute
     iniset $TEMPEST_CONFIG compute image_ref $image_uuid
     iniset $TEMPEST_CONFIG compute image_ref_alt $image_uuid_alt

From dd3731c86a13334125715e44880491042526227c Mon Sep 17 00:00:00 2001
From: Sean McGinnis <sean.mcginnis@gmail.com>
Date: Tue, 28 Jul 2020 08:51:41 -0500
Subject: [PATCH 1778/2409] Install bindep packages when installing lib from
 src

Most libs maintain their own system packages in a local bindep.txt file.
We don't currently use those when installing packages from source, which
can result in broken package installs.

This adds a flag to always attempt to install bindep packages if the
bindep.txt file exists. If a file cannot be found, it will just emit a
warning and carry on.

Change-Id: Ia0570f837b8af1c3fee0a314b026a4a7ed27e6a9
Signed-off-by: Sean McGinnis <sean.mcginnis@gmail.com>
---
 functions-common | 3 ++-
 lib/libraries    | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/functions-common b/functions-common
index 6595c3de53..d99ad9212f 100644
--- a/functions-common
+++ b/functions-common
@@ -1412,7 +1412,8 @@ function install_bindep {
     local pkgs
 
     if [[ ! -f $file ]]; then
-        die $LINENO "Can not find bindep file: $file"
+        warn $LINENO "Can not find bindep file: $file"
+        return
     fi
 
     # converting here makes it much easier to work with passing
diff --git a/lib/libraries b/lib/libraries
index b4f3c31d5e..c7aa8151ae 100644
--- a/lib/libraries
+++ b/lib/libraries
@@ -72,7 +72,7 @@ function _install_lib_from_source {
     local name=$1
     if use_library_from_git "$name"; then
         git_clone_by_name "$name"
-        setup_dev_lib "$name"
+        setup_dev_lib -bindep "$name"
     fi
 }
 

From 587e0a3510ea3b40abbdffcd1fe3204e416c4bc9 Mon Sep 17 00:00:00 2001
From: Carlos Goncalves <cgoncalves@redhat.com>
Date: Sat, 1 Aug 2020 21:47:55 +0200
Subject: [PATCH 1779/2409] Fix is_fedora RHEL 8 detection

While RHEL 7 is detected as RedHatEnterpriseServer, RHEL 8 is
RedHatEnterprise.

  $ lsb_release -i -s
  RedHatEnterprise

Change-Id: I3d750d808c6ebea9c230f0508cdbc016415b9922
---
 functions-common | 1 +
 1 file changed, 1 insertion(+)

diff --git a/functions-common b/functions-common
index d99ad9212f..acb3a6c920 100644
--- a/functions-common
+++ b/functions-common
@@ -451,6 +451,7 @@ function is_fedora {
 
     [ "$os_VENDOR" = "Fedora" ] || [ "$os_VENDOR" = "Red Hat" ] || \
         [ "$os_VENDOR" = "RedHatEnterpriseServer" ] || \
+        [ "$os_VENDOR" = "RedHatEnterprise" ] || \
         [ "$os_VENDOR" = "CentOS" ] || [ "$os_VENDOR" = "OracleServer" ] || \
         [ "$os_VENDOR" = "Virtuozzo" ]
 }

From 04fdd8c9eb37a34bb3155bee1f9d21c5dfb0d794 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Sun, 2 Aug 2020 13:13:00 +0200
Subject: [PATCH 1780/2409] Fix propose-updates job

We need to use python3, our deps are no longer installed in python.

Includes the current set of updates to the plugin registry.

Change-Id: I4753ddf60ed066cc11fa74dbbd63210dbad733a8
---
 doc/source/plugin-registry.rst          | 4 +---
 tools/generate-devstack-plugins-list.sh | 2 +-
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index eda5773a25..4e7c2d7b2f 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -81,7 +81,6 @@ openstack/networking-hyperv              `https://opendev.org/openstack/networki
 openstack/networking-l2gw                `https://opendev.org/openstack/networking-l2gw <https://opendev.org/openstack/networking-l2gw>`__
 openstack/networking-midonet             `https://opendev.org/openstack/networking-midonet <https://opendev.org/openstack/networking-midonet>`__
 openstack/networking-odl                 `https://opendev.org/openstack/networking-odl <https://opendev.org/openstack/networking-odl>`__
-openstack/networking-onos                `https://opendev.org/openstack/networking-onos <https://opendev.org/openstack/networking-onos>`__
 openstack/networking-powervm             `https://opendev.org/openstack/networking-powervm <https://opendev.org/openstack/networking-powervm>`__
 openstack/networking-sfc                 `https://opendev.org/openstack/networking-sfc <https://opendev.org/openstack/networking-sfc>`__
 openstack/neutron                        `https://opendev.org/openstack/neutron <https://opendev.org/openstack/neutron>`__
@@ -113,7 +112,6 @@ openstack/solum                          `https://opendev.org/openstack/solum <h
 openstack/storlets                       `https://opendev.org/openstack/storlets <https://opendev.org/openstack/storlets>`__
 openstack/tacker                         `https://opendev.org/openstack/tacker <https://opendev.org/openstack/tacker>`__
 openstack/telemetry-tempest-plugin       `https://opendev.org/openstack/telemetry-tempest-plugin <https://opendev.org/openstack/telemetry-tempest-plugin>`__
-openstack/tricircle                      `https://opendev.org/openstack/tricircle <https://opendev.org/openstack/tricircle>`__
 openstack/trove                          `https://opendev.org/openstack/trove <https://opendev.org/openstack/trove>`__
 openstack/trove-dashboard                `https://opendev.org/openstack/trove-dashboard <https://opendev.org/openstack/trove-dashboard>`__
 openstack/vitrage                        `https://opendev.org/openstack/vitrage <https://opendev.org/openstack/vitrage>`__
@@ -121,6 +119,7 @@ openstack/vitrage-dashboard              `https://opendev.org/openstack/vitrage-
 openstack/vitrage-tempest-plugin         `https://opendev.org/openstack/vitrage-tempest-plugin <https://opendev.org/openstack/vitrage-tempest-plugin>`__
 openstack/watcher                        `https://opendev.org/openstack/watcher <https://opendev.org/openstack/watcher>`__
 openstack/watcher-dashboard              `https://opendev.org/openstack/watcher-dashboard <https://opendev.org/openstack/watcher-dashboard>`__
+openstack/whitebox-tempest-plugin        `https://opendev.org/openstack/whitebox-tempest-plugin <https://opendev.org/openstack/whitebox-tempest-plugin>`__
 openstack/zaqar                          `https://opendev.org/openstack/zaqar <https://opendev.org/openstack/zaqar>`__
 openstack/zaqar-ui                       `https://opendev.org/openstack/zaqar-ui <https://opendev.org/openstack/zaqar-ui>`__
 openstack/zun                            `https://opendev.org/openstack/zun <https://opendev.org/openstack/zun>`__
@@ -199,7 +198,6 @@ x/trio2o                                 `https://opendev.org/x/trio2o <https://
 x/valet                                  `https://opendev.org/x/valet <https://opendev.org/x/valet>`__
 x/vmware-nsx                             `https://opendev.org/x/vmware-nsx <https://opendev.org/x/vmware-nsx>`__
 x/vmware-vspc                            `https://opendev.org/x/vmware-vspc <https://opendev.org/x/vmware-vspc>`__
-x/whitebox-tempest-plugin                `https://opendev.org/x/whitebox-tempest-plugin <https://opendev.org/x/whitebox-tempest-plugin>`__
 ======================================== ===
 
 
diff --git a/tools/generate-devstack-plugins-list.sh b/tools/generate-devstack-plugins-list.sh
index a3aa7ba63d..3307943df9 100755
--- a/tools/generate-devstack-plugins-list.sh
+++ b/tools/generate-devstack-plugins-list.sh
@@ -54,7 +54,7 @@ if [[ -r data/devstack-plugins-registry.header ]]; then
     cat data/devstack-plugins-registry.header
 fi
 
-sorted_plugins=$(python tools/generate-devstack-plugins-list.py)
+sorted_plugins=$(python3 tools/generate-devstack-plugins-list.py)
 
 # find the length of the name column & pad
 name_col_len=$(echo "${sorted_plugins}" | wc -L)

From 1d468d45dbb330c31c28e54d9c9abe5f8ec394ba Mon Sep 17 00:00:00 2001
From: Lucas Alvares Gomes <lucasagomes@gmail.com>
Date: Tue, 9 Jun 2020 14:35:52 +0100
Subject: [PATCH 1781/2409] [OVN] Move OVN module from Neutron to DevStack

As part of the Victoria PTG the Neutron team entertained the idea of
having the OVN driver as the default backend in DevStack (this hasn't
yet being decided by the community, this will be discussed within this
cycle).

For this to happen, we also would need to move the module that configures
OVN to the DevStack repository. This is what this patch is doing.

Note that we are updating the lib/neutron-legacy module instead of
lib/neutron in this patch, this is because as part of the PTG the
Neutron team has decided to un-deprecate the neutron-legacy module since
the "new" lib/neutron module is broken and nobody is current working on
it (also all services uses neutron-legacy).

Also, the ovsdbapp has been added to the ALL_LIBS list because a gate
job in the ovsdbapp project repository relies on installing the library
from source instead of pip to run.

Depends-On: https://review.opendev.org/#/c/740663/
Change-Id: Ib4194329474e8d68a90886d2a04f027eecd741df
Signed-off-by: Lucas Alvares Gomes <lucasagomes@gmail.com>
---
 lib/neutron-legacy            |  36 ++
 lib/neutron_plugins/ml2       |  12 +-
 lib/neutron_plugins/ovn_agent | 724 ++++++++++++++++++++++++++++++++++
 stack.sh                      |   5 +
 stackrc                       |   5 +
 tests/test_libs_from_pypi.sh  |   2 +-
 6 files changed, 777 insertions(+), 7 deletions(-)
 create mode 100644 lib/neutron_plugins/ovn_agent

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 59649ef84a..363c62e4c2 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -362,6 +362,14 @@ function configure_mutnauq {
         _configure_neutron_ceilometer_notifications
     fi
 
+    if [[ $Q_AGENT == "ovn" ]]; then
+        configure_ovn
+        if is_service_enabled q-port-forwarding neutron-port-forwarding; then
+            configure_port_forwarding
+        fi
+        configure_ovn_plugin
+    fi
+
     iniset $NEUTRON_CONF DEFAULT api_workers "$API_WORKERS"
     # devstack is not a tool for running uber scale OpenStack
     # clouds, therefore running without a dedicated RPC worker
@@ -438,6 +446,10 @@ function install_mutnauq {
 
     git_clone $NEUTRON_REPO $NEUTRON_DIR $NEUTRON_BRANCH
     setup_develop $NEUTRON_DIR
+
+    if [[ $Q_AGENT == "ovn" ]]; then
+        install_ovn
+    fi
 }
 
 # install_neutron_agent_packages() - Collect source and prepare
@@ -459,6 +471,22 @@ function configure_neutron_after_post_config {
     fi
 }
 
+# Start running OVN processes
+function start_ovn_services {
+    if [[ $Q_AGENT == "ovn" ]]; then
+        init_ovn
+        start_ovn
+        if [[ "$OVN_L3_CREATE_PUBLIC_NETWORK" == "True" ]]; then
+            if [[ "$NEUTRON_CREATE_INITIAL_NETWORKS" != "True" ]]; then
+                echo "OVN_L3_CREATE_PUBLIC_NETWORK=True is being ignored "
+                echo "because NEUTRON_CREATE_INITIAL_NETWORKS is set to False"
+            else
+                create_public_bridge
+            fi
+        fi
+    fi
+}
+
 # Start running processes
 function start_neutron_service_and_check {
     local service_port=$Q_PORT
@@ -575,6 +603,10 @@ function stop_mutnauq_other {
 function stop_mutnauq {
     stop_mutnauq_other
     stop_mutnauq_l2_agent
+
+    if [[ $Q_AGENT == "ovn" ]]; then
+        stop_ovn
+    fi
 }
 
 # _move_neutron_addresses_route() - Move the primary IP to the OVS bridge
@@ -668,6 +700,10 @@ function cleanup_mutnauq {
     for ns in $(sudo ip netns list | grep -o -E '(qdhcp|qrouter|fip|snat)-[0-9a-f-]*'); do
         sudo ip netns delete ${ns}
     done
+
+    if [[ $Q_AGENT == "ovn" ]]; then
+        cleanup_ovn
+    fi
 }
 
 
diff --git a/lib/neutron_plugins/ml2 b/lib/neutron_plugins/ml2
index 497b6c6bdc..ae4b251d83 100644
--- a/lib/neutron_plugins/ml2
+++ b/lib/neutron_plugins/ml2
@@ -7,6 +7,12 @@
 _XTRACE_NEUTRON_ML2=$(set +o | grep xtrace)
 set +o xtrace
 
+# Default openvswitch L2 agent
+Q_AGENT=${Q_AGENT:-openvswitch}
+if [ -f $TOP_DIR/lib/neutron_plugins/${Q_AGENT}_agent ]; then
+    source $TOP_DIR/lib/neutron_plugins/${Q_AGENT}_agent
+fi
+
 # Enable this to simply and quickly enable tunneling with ML2.
 # Select either 'gre', 'vxlan', or 'gre,vxlan'
 Q_ML2_TENANT_NETWORK_TYPE=${Q_ML2_TENANT_NETWORK_TYPE:-"vxlan"}
@@ -17,12 +23,6 @@ elif [[ "$ENABLE_TENANT_TUNNELS" == "True" ]]; then
     Q_TUNNEL_TYPES=gre
 fi
 
-# Default openvswitch L2 agent
-Q_AGENT=${Q_AGENT:-openvswitch}
-if [ -f $TOP_DIR/lib/neutron_plugins/${Q_AGENT}_agent ]; then
-    source $TOP_DIR/lib/neutron_plugins/${Q_AGENT}_agent
-fi
-
 # List of MechanismDrivers to load
 Q_ML2_PLUGIN_MECHANISM_DRIVERS=${Q_ML2_PLUGIN_MECHANISM_DRIVERS:-openvswitch,linuxbridge}
 # Default GRE TypeDriver options
diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
new file mode 100644
index 0000000000..e29b84fa48
--- /dev/null
+++ b/lib/neutron_plugins/ovn_agent
@@ -0,0 +1,724 @@
+#!/bin/bash
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+#
+
+# Global Sources
+# --------------
+
+# There are some ovs functions OVN depends on that must be sourced from
+# the ovs neutron plugins.
+source ${TOP_DIR}/lib/neutron_plugins/ovs_base
+source ${TOP_DIR}/lib/neutron_plugins/openvswitch_agent
+
+# Load devstack ovs base functions
+source $NEUTRON_DIR/devstack/lib/ovs
+
+
+# Defaults
+# --------
+
+# Set variables for building OVN from source
+OVN_REPO=${OVN_REPO:-https://github.com/ovn-org/ovn.git}
+OVN_REPO_NAME=$(basename ${OVN_REPO} | cut -f1 -d'.')
+OVN_REPO_NAME=${OVN_REPO_NAME:-ovn}
+OVN_BRANCH=${OVN_BRANCH:-v20.06.1}
+# The commit removing OVN bits from the OVS tree, it is the commit that is not
+# present in OVN tree and is used to distinguish if OVN is part of OVS or not.
+# https://github.com/openvswitch/ovs/commit/05bf1dbb98b0635a51f75e268ef8aed27601401d
+OVN_SPLIT_HASH=05bf1dbb98b0635a51f75e268ef8aed27601401d
+
+if is_service_enabled tls-proxy; then
+    OVN_PROTO=ssl
+else
+    OVN_PROTO=tcp
+fi
+
+# How to connect to ovsdb-server hosting the OVN SB database.
+OVN_SB_REMOTE=${OVN_SB_REMOTE:-$OVN_PROTO:$SERVICE_HOST:6642}
+
+# How to connect to ovsdb-server hosting the OVN NB database
+OVN_NB_REMOTE=${OVN_NB_REMOTE:-$OVN_PROTO:$SERVICE_HOST:6641}
+
+# ml2/config for neutron_sync_mode
+OVN_NEUTRON_SYNC_MODE=${OVN_NEUTRON_SYNC_MODE:-log}
+
+# Configured DNS servers to be used with internal_dns extension, only
+# if the subnet DNS is not configured.
+OVN_DNS_SERVERS=${OVN_DNS_SERVERS:-8.8.8.8}
+
+# The type of OVN L3 Scheduler to use. The OVN L3 Scheduler determines the
+# hypervisor/chassis where a routers gateway should be hosted in OVN. The
+# default OVN L3 scheduler is leastloaded
+OVN_L3_SCHEDULER=${OVN_L3_SCHEDULER:-leastloaded}
+
+# A UUID to uniquely identify this system.  If one is not specified, a random
+# one will be generated.  A randomly generated UUID will be saved in a file
+# 'ovn-uuid' so that the same one will be re-used if you re-run DevStack.
+OVN_UUID=${OVN_UUID:-}
+
+# Whether or not to build the openvswitch kernel module from ovs.  This is required
+# unless the distro kernel includes ovs+conntrack support.
+OVN_BUILD_MODULES=$(trueorfalse False OVN_BUILD_MODULES)
+
+# Whether or not to install the ovs python module from ovs source.  This can be
+# used to test and validate new ovs python features.  This should only be used
+# for development purposes since the ovs python version is controlled by OpenStack
+# requirements.
+OVN_INSTALL_OVS_PYTHON_MODULE=$(trueorfalse False OVN_INSTALL_OVS_PYTHON_MODULE)
+
+# GENEVE overlay protocol overhead. Defaults to 38 bytes plus the IP version
+# overhead (20 bytes for IPv4 (default) or 40 bytes for IPv6) which is determined
+# based on the ML2 overlay_ip_version option. The ML2 framework will use this to
+# configure the MTU DHCP option.
+OVN_GENEVE_OVERHEAD=${OVN_GENEVE_OVERHEAD:-38}
+
+# The log level of the OVN databases (north and south)
+OVN_DBS_LOG_LEVEL=${OVN_DBS_LOG_LEVEL:-info}
+
+OVN_META_CONF=$NEUTRON_CONF_DIR/neutron_ovn_metadata_agent.ini
+OVN_META_DATA_HOST=${OVN_META_DATA_HOST:-$(ipv6_unquote $SERVICE_HOST)}
+
+OVSDB_SERVER_LOCAL_HOST=$SERVICE_LOCAL_HOST
+
+OVN_IGMP_SNOOPING_ENABLE=$(trueorfalse False OVN_IGMP_SNOOPING_ENABLE)
+
+OVS_PREFIX=/usr/local
+OVS_SBINDIR=$OVS_PREFIX/sbin
+OVS_BINDIR=$OVS_PREFIX/bin
+OVS_RUNDIR=$OVS_PREFIX/var/run/openvswitch
+OVS_SHAREDIR=$OVS_PREFIX/share/openvswitch
+OVS_SCRIPTDIR=$OVS_SHAREDIR/scripts
+OVS_DATADIR=$DATA_DIR/ovs
+
+OVN_DATADIR=$DATA_DIR/ovn
+OVN_SHAREDIR=$OVS_PREFIX/share/ovn
+OVN_SCRIPTDIR=$OVN_SHAREDIR/scripts
+OVN_RUNDIR=$OVS_PREFIX/var/run/ovn
+
+NEUTRON_OVN_BIN_DIR=$(get_python_exec_prefix)
+NEUTRON_OVN_METADATA_BINARY="neutron-ovn-metadata-agent"
+
+STACK_GROUP="$( id --group --name "$STACK_USER" )"
+
+# Defaults Overwrite
+# ------------------
+
+Q_ML2_PLUGIN_MECHANISM_DRIVERS=${Q_ML2_PLUGIN_MECHANISM_DRIVERS:-ovn,logger}
+Q_ML2_PLUGIN_TYPE_DRIVERS=${Q_ML2_PLUGIN_TYPE_DRIVERS:-local,flat,vlan,geneve}
+Q_ML2_TENANT_NETWORK_TYPE=${Q_ML2_TENANT_NETWORK_TYPE:-"geneve"}
+Q_ML2_PLUGIN_GENEVE_TYPE_OPTIONS=${Q_ML2_PLUGIN_GENEVE_TYPE_OPTIONS:-"vni_ranges=1:65536"}
+Q_ML2_PLUGIN_EXT_DRIVERS=${Q_ML2_PLUGIN_EXT_DRIVERS:-port_security,dns,qos}
+# this one allows empty:
+ML2_L3_PLUGIN=${ML2_L3_PLUGIN-"ovn-router"}
+
+
+# Utility Functions
+# -----------------
+
+function use_new_ovn_repository {
+    if [ -z "$is_new_ovn" ]; then
+        local ovs_repo_dir=$DEST/$OVS_REPO_NAME
+        if [ ! -d $ovs_repo_dir ]; then
+            clone_repository $OVS_REPO $ovs_repo_dir $OVS_BRANCH
+        fi
+        # Check the split commit exists in the current branch
+        pushd $ovs_repo_dir
+        git log $OVS_BRANCH --pretty=format:"%H" | grep -q $OVN_SPLIT_HASH
+        is_new_ovn=$?
+        popd
+    fi
+    return $is_new_ovn
+}
+
+# NOTE(rtheis): Function copied from DevStack _neutron_ovs_base_setup_bridge
+# and _neutron_ovs_base_add_bridge with the call to neutron-ovs-cleanup
+# removed. The call is not relevant for OVN, as it is specific to the use
+# of Neutron's OVS agent and hangs when running stack.sh because
+# neutron-ovs-cleanup uses the OVSDB native interface.
+function ovn_base_setup_bridge {
+    local bridge=$1
+    local addbr_cmd="ovs-vsctl --no-wait -- --may-exist add-br $bridge -- set bridge $bridge protocols=OpenFlow13,OpenFlow15"
+
+    if [ "$OVS_DATAPATH_TYPE" != "system" ] ; then
+        addbr_cmd="$addbr_cmd -- set Bridge $bridge datapath_type=${OVS_DATAPATH_TYPE}"
+    fi
+
+    $addbr_cmd
+    ovs-vsctl --no-wait br-set-external-id $bridge bridge-id $bridge
+}
+
+function _start_process {
+    $SYSTEMCTL daemon-reload
+    $SYSTEMCTL enable $1
+    $SYSTEMCTL restart $1
+}
+
+function _run_process {
+    local service=$1
+    local cmd="$2"
+    local stop_cmd="$3"
+    local group=$4
+    local user=${5:-$STACK_USER}
+
+    local systemd_service="devstack@$service.service"
+    local unit_file="$SYSTEMD_DIR/$systemd_service"
+    local environment="OVN_RUNDIR=$OVS_RUNDIR OVN_DBDIR=$OVN_DATADIR OVN_LOGDIR=$LOGDIR OVS_RUNDIR=$OVS_RUNDIR OVS_DBDIR=$OVS_DATADIR OVS_LOGDIR=$LOGDIR"
+
+    echo "Starting $service executed command": $cmd
+
+    write_user_unit_file $systemd_service "$cmd" "$group" "$user"
+    iniset -sudo $unit_file "Service" "Type" "forking"
+    iniset -sudo $unit_file "Service" "RemainAfterExit" "yes"
+    iniset -sudo $unit_file "Service" "KillMode" "mixed"
+    iniset -sudo $unit_file "Service" "LimitNOFILE" "65536"
+    iniset -sudo $unit_file "Service" "Environment" "$environment"
+    if [ -n "$stop_cmd" ]; then
+        iniset -sudo $unit_file "Service" "ExecStop" "$stop_cmd"
+    fi
+
+    _start_process $systemd_service
+
+    local testcmd="test -e $OVS_RUNDIR/$service.pid"
+    test_with_retry "$testcmd" "$service did not start" $SERVICE_TIMEOUT 1
+    sudo ovs-appctl -t $service vlog/set console:off syslog:info file:info
+}
+
+function clone_repository {
+    local repo=$1
+    local dir=$2
+    local branch=$3
+    # Set ERROR_ON_CLONE to false to avoid the need of having the
+    # repositories like OVN and OVS in the required_projects of the job
+    # definition.
+    ERROR_ON_CLONE=false git_clone $repo $dir $branch
+}
+
+function get_ext_gw_interface {
+    # Get ext_gw_interface depending on value of Q_USE_PUBLIC_VETH
+    # This function is copied directly from the devstack neutron-legacy script
+    if [[ "$Q_USE_PUBLIC_VETH" == "True" ]]; then
+        echo $Q_PUBLIC_VETH_EX
+    else
+        # Disable in-band as we are going to use local port
+        # to communicate with VMs
+        sudo ovs-vsctl set Bridge $PUBLIC_BRIDGE \
+            other_config:disable-in-band=true
+        echo $PUBLIC_BRIDGE
+    fi
+}
+
+function create_public_bridge {
+    # Create the public bridge that OVN will use
+    # This logic is based on the devstack neutron-legacy _neutron_configure_router_v4 and _v6
+    local ext_gw_ifc
+    ext_gw_ifc=$(get_ext_gw_interface)
+
+    ovs-vsctl --may-exist add-br $ext_gw_ifc -- set bridge $ext_gw_ifc protocols=OpenFlow13,OpenFlow15
+    ovs-vsctl set open . external-ids:ovn-bridge-mappings=$PHYSICAL_NETWORK:$ext_gw_ifc
+    if [ -n "$FLOATING_RANGE" ]; then
+        local cidr_len=${FLOATING_RANGE#*/}
+        sudo ip addr flush dev $ext_gw_ifc
+        sudo ip addr add $PUBLIC_NETWORK_GATEWAY/$cidr_len dev $ext_gw_ifc
+    fi
+
+    # Ensure IPv6 RAs are accepted on the interface with the default route.
+    # This is needed for neutron-based devstack clouds to work in
+    # IPv6-only clouds in the gate. Please do not remove this without
+    # talking to folks in Infra. This fix is based on a devstack fix for
+    # neutron L3 agent: https://review.openstack.org/#/c/359490/.
+    default_route_dev=$(ip route | grep ^default | awk '{print $5}')
+    sudo sysctl -w net.ipv6.conf.$default_route_dev.accept_ra=2
+
+    sudo sysctl -w net.ipv6.conf.all.forwarding=1
+    if [ -n "$IPV6_PUBLIC_RANGE" ]; then
+        local ipv6_cidr_len=${IPV6_PUBLIC_RANGE#*/}
+        sudo ip -6 addr flush dev $ext_gw_ifc
+        sudo ip -6 addr add $IPV6_PUBLIC_NETWORK_GATEWAY/$ipv6_cidr_len dev $ext_gw_ifc
+    fi
+
+    sudo ip link set $ext_gw_ifc up
+}
+
+function _disable_libvirt_apparmor {
+    if ! sudo aa-status --enabled ; then
+        return 0
+    fi
+    # NOTE(arosen): This is used as a work around to allow newer versions
+    # of libvirt to work with ovs configured ports. See LP#1466631.
+    # requires the apparmor-utils
+    install_package apparmor-utils
+    # disables apparmor for libvirtd
+    sudo aa-complain /etc/apparmor.d/usr.sbin.libvirtd
+}
+
+
+# OVN compilation functions
+# -------------------------
+
+
+# compile_ovn() - Compile OVN from source and load needed modules
+#                 Accepts three parameters:
+#                   - first optional is False by default and means that
+#                     modules are built and installed.
+#                   - second optional parameter defines prefix for
+#                     ovn compilation
+#                   - third optional parameter defines localstatedir for
+#                     ovn single machine runtime
+function compile_ovn {
+    local build_modules=${1:-False}
+    local prefix=$2
+    local localstatedir=$3
+
+    if [ -n "$prefix" ]; then
+        prefix="--prefix=$prefix"
+    fi
+
+    if [ -n "$localstatedir" ]; then
+        localstatedir="--localstatedir=$localstatedir"
+    fi
+
+    clone_repository $OVN_REPO $DEST/$OVN_REPO_NAME $OVN_BRANCH
+    pushd $DEST/$OVN_REPO_NAME
+
+    if [ ! -f configure ] ; then
+        ./boot.sh
+    fi
+
+    if [ ! -f config.status ] || [ configure -nt config.status ] ; then
+        ./configure --with-ovs-source=$DEST/$OVS_REPO_NAME $prefix $localstatedir
+    fi
+    make -j$(($(nproc) + 1))
+    sudo make install
+    popd
+}
+
+
+# OVN Neutron driver functions
+# ----------------------------
+
+# OVN service sanity check
+function ovn_sanity_check {
+    if is_service_enabled q-agt neutron-agt; then
+        die $LINENO "The q-agt/neutron-agt service must be disabled with OVN."
+    elif is_service_enabled q-l3 neutron-l3; then
+        die $LINENO "The q-l3/neutron-l3 service must be disabled with OVN."
+    elif is_service_enabled q-svc neutron-api && [[ ! $Q_ML2_PLUGIN_MECHANISM_DRIVERS =~ "ovn" ]]; then
+        die $LINENO "OVN needs to be enabled in \$Q_ML2_PLUGIN_MECHANISM_DRIVERS"
+    elif is_service_enabled q-svc neutron-api && [[ ! $Q_ML2_PLUGIN_TYPE_DRIVERS =~ "geneve" ]]; then
+        die $LINENO "Geneve needs to be enabled in \$Q_ML2_PLUGIN_TYPE_DRIVERS to be used with OVN"
+    fi
+}
+
+# install_ovn() - Collect source and prepare
+function install_ovn {
+    echo "Installing OVN and dependent packages"
+
+    # Check the OVN configuration
+    ovn_sanity_check
+
+    # If OVS is already installed, remove it, because we're about to re-install
+    # it from source.
+    for package in openvswitch openvswitch-switch openvswitch-common; do
+        if is_package_installed $package ; then
+            uninstall_package $package
+        fi
+    done
+
+    # Install tox, used to generate the config (see devstack/override-defaults)
+    pip_install tox
+    remove_ovs_packages
+    sudo rm -f $OVS_RUNDIR/*
+
+    compile_ovs $OVN_BUILD_MODULES
+    if use_new_ovn_repository; then
+        compile_ovn $OVN_BUILD_MODULES
+    fi
+
+    # Ensure that the OVS commands are accessible in the PATH
+    OVS_BINDIR=${OVS_BINDIR:-/usr/local/bin}
+    export PATH=$OVS_BINDIR:$PATH
+
+    sudo mkdir -p $OVS_RUNDIR
+    sudo chown $(whoami) $OVS_RUNDIR
+    sudo mkdir -p $OVS_PREFIX/var/log/openvswitch
+    sudo chown $(whoami) $OVS_PREFIX/var/log/openvswitch
+    sudo mkdir -p $OVS_PREFIX/var/log/ovn
+    sudo chown $(whoami) $OVS_PREFIX/var/log/ovn
+
+    # Archive log files and create new
+    local log_archive_dir=$LOGDIR/archive
+    mkdir -p $log_archive_dir
+    for logfile in ovs-vswitchd.log ovn-northd.log ovn-controller.log ovn-controller-vtep.log ovs-vtep.log ovsdb-server.log ovsdb-server-nb.log ovsdb-server-sb.log; do
+        if [ -f "$LOGDIR/$logfile" ] ; then
+            mv "$LOGDIR/$logfile"  "$log_archive_dir/$logfile.${CURRENT_LOG_TIME}"
+        fi
+    done
+
+    # Install ovsdbapp from source if requested
+    if use_library_from_git "ovsdbapp"; then
+        git_clone_by_name "ovsdbapp"
+        setup_dev_lib "ovsdbapp"
+    fi
+
+    # Install ovs python module from ovs source.
+    if [[ "$OVN_INSTALL_OVS_PYTHON_MODULE" == "True" ]]; then
+        sudo pip uninstall -y ovs
+        # Clone the OVS repository if it's not yet present
+        clone_repository $OVS_REPO $DEST/$OVS_REPO_NAME $OVS_BRANCH
+        sudo pip install -e $DEST/$OVS_REPO_NAME/python
+    fi
+}
+
+# filter_network_api_extensions() - Remove non-supported API extensions by
+# the OVN driver from the list of enabled API extensions
+function filter_network_api_extensions {
+    SUPPORTED_NETWORK_API_EXTENSIONS=$($PYTHON -c \
+        'from neutron.common.ovn import extensions ;\
+        print(",".join(extensions.ML2_SUPPORTED_API_EXTENSIONS))')
+    SUPPORTED_NETWORK_API_EXTENSIONS=$SUPPORTED_NETWORK_API_EXTENSIONS,$($PYTHON -c \
+        'from neutron.common.ovn import extensions ;\
+        print(",".join(extensions.ML2_SUPPORTED_API_EXTENSIONS_OVN_L3))')
+    if is_service_enabled q-qos neutron-qos ; then
+        SUPPORTED_NETWORK_API_EXTENSIONS="$SUPPORTED_NETWORK_API_EXTENSIONS,qos"
+    fi
+    NETWORK_API_EXTENSIONS=${NETWORK_API_EXTENSIONS:-$SUPPORTED_NETWORK_API_EXTENSIONS}
+    extensions=$(echo $NETWORK_API_EXTENSIONS | tr ', ' '\n' | sort -u)
+    supported_ext=$(echo $SUPPORTED_NETWORK_API_EXTENSIONS | tr ', ' '\n' | sort -u)
+    enabled_ext=$(comm -12 <(echo -e "$extensions") <(echo -e "$supported_ext"))
+    disabled_ext=$(comm -3 <(echo -e "$extensions") <(echo -e "$enabled_ext"))
+
+    # Log a message in case some extensions had to be disabled because
+    # they are not supported by the OVN driver
+    if [ ! -z "$disabled_ext" ]; then
+        _disabled=$(echo $disabled_ext | tr ' ' ',')
+        echo "The folling network API extensions have been disabled because they are not supported by OVN: $_disabled"
+    fi
+
+    # Export the final list of extensions that have been enabled and are
+    # supported by OVN
+    export NETWORK_API_EXTENSIONS=$(echo $enabled_ext | tr ' ' ',')
+}
+
+function configure_ovn_plugin {
+    echo "Configuring Neutron for OVN"
+
+    if is_service_enabled q-svc ; then
+        filter_network_api_extensions
+        populate_ml2_config /$Q_PLUGIN_CONF_FILE ml2_type_geneve max_header_size=$OVN_GENEVE_OVERHEAD
+        populate_ml2_config /$Q_PLUGIN_CONF_FILE ovn ovn_nb_connection="$OVN_NB_REMOTE"
+        populate_ml2_config /$Q_PLUGIN_CONF_FILE ovn ovn_sb_connection="$OVN_SB_REMOTE"
+        if is_service_enabled tls-proxy; then
+            populate_ml2_config /$Q_PLUGIN_CONF_FILE ovn ovn_sb_ca_cert="$INT_CA_DIR/ca-chain.pem"
+            populate_ml2_config /$Q_PLUGIN_CONF_FILE ovn ovn_sb_certificate="$INT_CA_DIR/$DEVSTACK_CERT_NAME.crt"
+            populate_ml2_config /$Q_PLUGIN_CONF_FILE ovn ovn_sb_private_key="$INT_CA_DIR/private/$DEVSTACK_CERT_NAME.key"
+            populate_ml2_config /$Q_PLUGIN_CONF_FILE ovn ovn_nb_ca_cert="$INT_CA_DIR/ca-chain.pem"
+            populate_ml2_config /$Q_PLUGIN_CONF_FILE ovn ovn_nb_certificate="$INT_CA_DIR/$DEVSTACK_CERT_NAME.crt"
+            populate_ml2_config /$Q_PLUGIN_CONF_FILE ovn ovn_nb_private_key="$INT_CA_DIR/private/$DEVSTACK_CERT_NAME.key"
+        fi
+        populate_ml2_config /$Q_PLUGIN_CONF_FILE ovn neutron_sync_mode="$OVN_NEUTRON_SYNC_MODE"
+        populate_ml2_config /$Q_PLUGIN_CONF_FILE ovn ovn_l3_scheduler="$OVN_L3_SCHEDULER"
+        populate_ml2_config /$Q_PLUGIN_CONF_FILE securitygroup enable_security_group="$Q_USE_SECGROUP"
+        inicomment /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver
+
+        if is_service_enabled q-ovn-metadata-agent; then
+            populate_ml2_config /$Q_PLUGIN_CONF_FILE ovn ovn_metadata_enabled=True
+        else
+            populate_ml2_config /$Q_PLUGIN_CONF_FILE ovn ovn_metadata_enabled=False
+        fi
+
+        if is_service_enabled q-dns neutron-dns ; then
+            iniset $NEUTRON_CONF DEFAULT dns_domain openstackgate.local
+            populate_ml2_config /$Q_PLUGIN_CONF_FILE ovn dns_servers="$OVN_DNS_SERVERS"
+        fi
+
+        iniset $NEUTRON_CONF ovs igmp_snooping_enable $OVN_IGMP_SNOOPING_ENABLE
+    fi
+
+    if is_service_enabled q-dhcp neutron-dhcp ; then
+        iniset $NEUTRON_CONF DEFAULT dhcp_agent_notification True
+    else
+        iniset $NEUTRON_CONF DEFAULT dhcp_agent_notification False
+    fi
+
+    if is_service_enabled n-api-meta ; then
+        if is_service_enabled q-ovn-metadata-agent ; then
+            iniset $NOVA_CONF neutron service_metadata_proxy True
+        fi
+    fi
+}
+
+function configure_ovn {
+    echo "Configuring OVN"
+
+    if [ -z "$OVN_UUID" ] ; then
+        if [ -f ./ovn-uuid ] ; then
+            OVN_UUID=$(cat ovn-uuid)
+        else
+            OVN_UUID=$(uuidgen)
+            echo $OVN_UUID > ovn-uuid
+        fi
+    fi
+
+    # Metadata
+    if is_service_enabled q-ovn-metadata-agent && is_service_enabled ovn-controller; then
+        sudo install -d -o $STACK_USER $NEUTRON_CONF_DIR
+
+        mkdir -p $NEUTRON_DIR/etc/neutron/plugins/ml2
+        (cd $NEUTRON_DIR && exec ./tools/generate_config_file_samples.sh)
+
+        cp $NEUTRON_DIR/etc/neutron_ovn_metadata_agent.ini.sample $OVN_META_CONF
+        configure_root_helper_options $OVN_META_CONF
+
+        iniset $OVN_META_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
+        iniset $OVN_META_CONF DEFAULT nova_metadata_host $OVN_META_DATA_HOST
+        iniset $OVN_META_CONF DEFAULT metadata_workers $API_WORKERS
+        iniset $OVN_META_CONF DEFAULT state_path $NEUTRON_STATE_PATH
+        iniset $OVN_META_CONF ovs ovsdb_connection unix:$OVS_RUNDIR/db.sock
+        iniset $OVN_META_CONF ovn ovn_sb_connection $OVN_SB_REMOTE
+        if is_service_enabled tls-proxy; then
+            iniset $OVN_META_CONF ovn \
+                ovn_sb_ca_cert $INT_CA_DIR/ca-chain.pem
+            iniset $OVN_META_CONF ovn \
+                ovn_sb_certificate $INT_CA_DIR/$DEVSTACK_CERT_NAME.crt
+            iniset $OVN_META_CONF ovn \
+                ovn_sb_private_key $INT_CA_DIR/private/$DEVSTACK_CERT_NAME.key
+        fi
+    fi
+}
+
+function init_ovn {
+    # clean up from previous (possibly aborted) runs
+    # create required data files
+
+    # Assumption: this is a dedicated test system and there is nothing important
+    # in the ovn, ovn-nb, or ovs databases.  We're going to trash them and
+    # create new ones on each devstack run.
+
+    _disable_libvirt_apparmor
+
+    mkdir -p $OVN_DATADIR
+    mkdir -p $OVS_DATADIR
+
+    rm -f $OVS_DATADIR/*.db
+    rm -f $OVS_DATADIR/.*.db.~lock~
+    rm -f $OVN_DATADIR/*.db
+    rm -f $OVN_DATADIR/.*.db.~lock~
+}
+
+function _start_ovs {
+    echo "Starting OVS"
+    if is_service_enabled ovn-controller ovn-controller-vtep ovn-northd; then
+        # ovsdb-server and ovs-vswitchd are used privately in OVN as openvswitch service names.
+        enable_service ovsdb-server
+        enable_service ovs-vswitchd
+
+        if [ ! -f $OVS_DATADIR/conf.db ]; then
+            ovsdb-tool create $OVS_DATADIR/conf.db $OVS_SHAREDIR/vswitch.ovsschema
+        fi
+
+        if is_service_enabled ovn-controller-vtep; then
+            if [ ! -f $OVS_DATADIR/vtep.db ]; then
+                ovsdb-tool create $OVS_DATADIR/vtep.db $OVS_SHAREDIR/vtep.ovsschema
+            fi
+        fi
+
+        local dbcmd="$OVS_SBINDIR/ovsdb-server --remote=punix:$OVS_RUNDIR/db.sock --remote=ptcp:6640:$OVSDB_SERVER_LOCAL_HOST --pidfile --detach --log-file"
+        dbcmd+=" --remote=db:Open_vSwitch,Open_vSwitch,manager_options"
+        if is_service_enabled ovn-controller-vtep; then
+            dbcmd+=" --remote=db:hardware_vtep,Global,managers $OVS_DATADIR/vtep.db"
+        fi
+        dbcmd+=" $OVS_DATADIR/conf.db"
+        _run_process ovsdb-server "$dbcmd"
+
+        echo "Configuring OVSDB"
+        if is_service_enabled tls-proxy; then
+            ovs-vsctl --no-wait set-ssl \
+                $INT_CA_DIR/private/$DEVSTACK_CERT_NAME.key \
+                $INT_CA_DIR/$DEVSTACK_CERT_NAME.crt \
+                $INT_CA_DIR/ca-chain.pem
+        fi
+        ovs-vsctl --no-wait set open_vswitch . system-type="devstack"
+        ovs-vsctl --no-wait set open_vswitch . external-ids:system-id="$OVN_UUID"
+        ovs-vsctl --no-wait set open_vswitch . external-ids:ovn-remote="$OVN_SB_REMOTE"
+        ovs-vsctl --no-wait set open_vswitch . external-ids:ovn-bridge="br-int"
+        ovs-vsctl --no-wait set open_vswitch . external-ids:ovn-encap-type="geneve"
+        ovs-vsctl --no-wait set open_vswitch . external-ids:ovn-encap-ip="$HOST_IP"
+        # Select this chassis to host gateway routers
+        if [[ "$ENABLE_CHASSIS_AS_GW" == "True" ]]; then
+            ovs-vsctl --no-wait set open_vswitch . external-ids:ovn-cms-options="enable-chassis-as-gw"
+        fi
+
+        # Note: ovn-controller will create and configure br-int once it is started.
+        # So, no need to create it now because nothing depends on that bridge here.
+
+        local ovscmd="$OVS_SBINDIR/ovs-vswitchd --log-file --pidfile --detach"
+        _run_process ovs-vswitchd "$ovscmd" "" "$STACK_GROUP" "root"
+
+        if is_provider_network || [[ $Q_USE_PROVIDERNET_FOR_PUBLIC == "True" ]]; then
+            ovn_base_setup_bridge $OVS_PHYSICAL_BRIDGE
+            ovs-vsctl set open . external-ids:ovn-bridge-mappings=${PHYSICAL_NETWORK}:${OVS_PHYSICAL_BRIDGE}
+        fi
+
+        if is_service_enabled ovn-controller-vtep ; then
+            ovn_base_setup_bridge br-v
+            vtep-ctl add-ps br-v
+            vtep-ctl set Physical_Switch br-v tunnel_ips=$HOST_IP
+
+            enable_service ovs-vtep
+            local vtepcmd="$OVS_SCRIPTDIR/ovs-vtep --log-file --pidfile --detach br-v"
+            _run_process ovs-vtep "$vtepcmd" "" "$STACK_GROUP" "root"
+
+            vtep-ctl set-manager tcp:$HOST_IP:6640
+        fi
+    fi
+}
+
+function _start_ovn_services {
+    _start_process "devstack@ovsdb-server.service"
+    _start_process "devstack@ovs-vswitchd.service"
+
+    if is_service_enabled ovs-vtep ; then
+        _start_process "devstack@ovs-vtep.service"
+    fi
+    if is_service_enabled ovn-northd ; then
+        _start_process "devstack@ovn-northd.service"
+    fi
+    if is_service_enabled ovn-controller ; then
+        _start_process "devstack@ovn-controller.service"
+    fi
+    if is_service_enabled ovn-controller-vtep ; then
+        _start_process "devstack@ovn-controller-vtep.service"
+    fi
+    if is_service_enabled q-ovn-metadata-agent; then
+        _start_process "devstack@q-ovn-metadata-agent.service"
+    fi
+}
+
+# start_ovn() - Start running processes, including screen
+function start_ovn {
+    echo "Starting OVN"
+
+    _start_ovs
+
+    local SCRIPTDIR=$OVN_SCRIPTDIR
+    if ! use_new_ovn_repository; then
+        SCRIPTDIR=$OVS_SCRIPTDIR
+    fi
+
+    if is_service_enabled ovn-northd ; then
+        if is_service_enabled tls-proxy; then
+            local tls_args="\
+                --ovn-nb-db-ssl-ca-cert=$INT_CA_DIR/ca-chain.pem \
+                --ovn-nb-db-ssl-cert=$INT_CA_DIR/$DEVSTACK_CERT_NAME.crt \
+                --ovn-nb-db-ssl-key=$INT_CA_DIR/private/$DEVSTACK_CERT_NAME.key \
+                --ovn-sb-db-ssl-ca-cert=$INT_CA_DIR/ca-chain.pem \
+                --ovn-sb-db-ssl-cert=$INT_CA_DIR/$DEVSTACK_CERT_NAME.crt \
+                --ovn-sb-db-ssl-key=$INT_CA_DIR/private/$DEVSTACK_CERT_NAME.key \
+                "
+        else
+            local tls_args=""
+        fi
+        local cmd="/bin/bash $SCRIPTDIR/ovn-ctl --no-monitor $tls_args start_northd"
+        local stop_cmd="/bin/bash $SCRIPTDIR/ovn-ctl stop_northd"
+
+        _run_process ovn-northd "$cmd" "$stop_cmd"
+        ovn-nbctl --db=unix:$OVS_RUNDIR/ovnnb_db.sock set-connection p${OVN_PROTO}:6641:$SERVICE_LISTEN_ADDRESS -- set connection . inactivity_probe=60000
+        ovn-sbctl --db=unix:$OVS_RUNDIR/ovnsb_db.sock set-connection p${OVN_PROTO}:6642:$SERVICE_LISTEN_ADDRESS -- set connection . inactivity_probe=60000
+        sudo ovs-appctl -t $OVS_RUNDIR/ovnnb_db.ctl vlog/set console:off syslog:$OVN_DBS_LOG_LEVEL file:$OVN_DBS_LOG_LEVEL
+        sudo ovs-appctl -t $OVS_RUNDIR/ovnsb_db.ctl vlog/set console:off syslog:$OVN_DBS_LOG_LEVEL file:$OVN_DBS_LOG_LEVEL
+    fi
+
+    if is_service_enabled ovn-controller ; then
+        local cmd="/bin/bash $SCRIPTDIR/ovn-ctl --no-monitor start_controller"
+        local stop_cmd="/bin/bash $SCRIPTDIR/ovn-ctl stop_controller"
+
+        _run_process ovn-controller "$cmd" "$stop_cmd" "$STACK_GROUP" "root"
+    fi
+
+    if is_service_enabled ovn-controller-vtep ; then
+        local cmd="$OVS_BINDIR/ovn-controller-vtep --log-file --pidfile --detach --ovnsb-db=$OVN_SB_REMOTE"
+
+        _run_process ovn-controller-vtep "$cmd" "" "$STACK_GROUP" "root"
+    fi
+
+    if is_service_enabled q-ovn-metadata-agent; then
+        run_process q-ovn-metadata-agent "$NEUTRON_OVN_BIN_DIR/$NEUTRON_OVN_METADATA_BINARY --config-file $OVN_META_CONF"
+        # Format logging
+        setup_logging $OVN_META_CONF
+    fi
+
+    # NOTE(lucasagomes): To keep things simpler, let's reuse the same
+    # RUNDIR for both OVS and OVN. This way we avoid having to specify the
+    # --db option in the ovn-{n,s}bctl commands while playing with DevStack
+    if use_new_ovn_repository; then
+        sudo ln -s $OVS_RUNDIR $OVN_RUNDIR
+    fi
+
+    _start_ovn_services
+}
+
+function _stop_ovs_dp {
+    sudo ovs-dpctl dump-dps | sudo xargs -n1 ovs-dpctl del-dp
+    modprobe -q -r vport_geneve vport_vxlan openvswitch || true
+}
+
+function stop_ovn {
+    if is_service_enabled q-ovn-metadata-agent; then
+        sudo pkill -9 -f haproxy || :
+        stop_process neutron-ovn-metadata-agent
+    fi
+    if is_service_enabled ovn-controller-vtep ; then
+        stop_process ovn-controller-vtep
+    fi
+    if is_service_enabled ovn-controller ; then
+        stop_process ovn-controller
+    fi
+    if is_service_enabled ovn-northd ; then
+        stop_process ovn-northd
+    fi
+    if is_service_enabled ovs-vtep ; then
+        stop_process ovs-vtep
+    fi
+
+    stop_process ovs-vswitchd
+    stop_process ovsdb-server
+
+    _stop_ovs_dp
+}
+
+function _cleanup {
+    local path=${1:-$DEST/$OVN_REPO_NAME}
+    pushd $path
+    cd $path
+    sudo make uninstall
+    sudo make distclean
+    popd
+}
+
+# cleanup_ovn() - Remove residual data files, anything left over from previous
+# runs that a clean run would need to clean up
+function cleanup_ovn {
+    local ovn_path=$DEST/$OVN_REPO_NAME
+    local ovs_path=$DEST/$OVS_REPO_NAME
+
+    if [ -d $ovn_path ]; then
+        _cleanup $ovn_path
+    fi
+
+    if [ -d $ovs_path ]; then
+        _cleanup $ovs_path
+    fi
+
+    sudo rm -f $OVN_RUNDIR
+}
diff --git a/stack.sh b/stack.sh
index 85640d5390..ba9da638a8 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1267,6 +1267,11 @@ if is_service_enabled n-api; then
     start_nova_api
 fi
 
+if is_service_enabled ovn-controller ovn-controller-vtep; then
+    echo_summary "Starting OVN services"
+    start_ovn_services
+fi
+
 if is_service_enabled neutron-api; then
     echo_summary "Starting Neutron"
     start_neutron_api
diff --git a/stackrc b/stackrc
index 4ffd537ef4..bf1ad3d85d 100644
--- a/stackrc
+++ b/stackrc
@@ -549,6 +549,11 @@ GITDIR["neutron-lib"]=$DEST/neutron-lib
 GITREPO["os-traits"]=${OS_TRAITS_REPO:-${GIT_BASE}/openstack/os-traits.git}
 GITBRANCH["os-traits"]=${OS_TRAITS_BRANCH:-$TARGET_BRANCH}
 
+# ovsdbapp used by neutron
+GITREPO["ovsdbapp"]=${OVSDBAPP_REPO:-${GIT_BASE}/openstack/ovsdbapp.git}
+GITBRANCH["ovsdbapp"]=${OVSDBAPP_BRANCH:-$TARGET_BRANCH}
+GITDIR["ovsdbapp"]=$DEST/ovsdbapp
+
 ##################
 #
 #  TripleO / Heat Agent Components
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index c3b4457171..ab7583d042 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -44,7 +44,7 @@ ALL_LIBS+=" debtcollector os-brick os-traits automaton futurist oslo.service"
 ALL_LIBS+=" oslo.cache oslo.reports osprofiler cursive"
 ALL_LIBS+=" keystoneauth ironic-lib neutron-lib oslo.privsep"
 ALL_LIBS+=" diskimage-builder os-vif python-brick-cinderclient-ext"
-ALL_LIBS+=" castellan python-barbicanclient"
+ALL_LIBS+=" castellan python-barbicanclient ovsdbapp"
 
 # Generate the above list with
 # echo ${!GITREPO[@]}

From 52e52d8937e8e57b2bc16f67c3651a358fa6fb77 Mon Sep 17 00:00:00 2001
From: Luigi Toscano <ltoscano@redhat.com>
Date: Thu, 13 Aug 2020 09:55:08 +0200
Subject: [PATCH 1782/2409] Add a dependency file for os-brick (and add lsscsi)

There are a few dependencies which are really os-brick-specific.
They are listed in its bindep.txt file, but os-brick is usually
installed from pip, so its bindep.txt file is not available.

As those dependencies are needed by the various services
which use os-brick, move them to their own dependency file
(with the addition of the new lsscsi, required by the next
os-brick stable release) and make sure that file is parsed
when installing the services which require os-brick.

Side note: there should be a way to avoid this duplication
also for pip-installed libraries (normal services can use
files/ or even bindep, but in this case the source is not always
available), (temporarily?) duplicate them, as it has been
the case for the other os-brick dependencies already listed here.

Change-Id: I9ab6e215dbef9ebdb1946da2f9a40ce020ecc95b
---
 files/debs/cinder        | 2 --
 files/debs/os-brick      | 3 +++
 files/rpms-suse/cinder   | 1 -
 files/rpms-suse/os-brick | 2 ++
 files/rpms/cinder        | 1 -
 files/rpms/os-brick      | 2 ++
 functions-common         | 9 +++++++++
 7 files changed, 16 insertions(+), 4 deletions(-)
 create mode 100644 files/debs/os-brick
 create mode 100644 files/rpms-suse/os-brick
 create mode 100644 files/rpms/os-brick

diff --git a/files/debs/cinder b/files/debs/cinder
index c1b79fda47..5d390e24bf 100644
--- a/files/debs/cinder
+++ b/files/debs/cinder
@@ -1,6 +1,4 @@
 lvm2
-open-iscsi
-open-iscsi-utils # Deprecated since quantal dist:precise
 qemu-utils
 tgt # NOPRIME
 thin-provisioning-tools
diff --git a/files/debs/os-brick b/files/debs/os-brick
new file mode 100644
index 0000000000..4148b0c421
--- /dev/null
+++ b/files/debs/os-brick
@@ -0,0 +1,3 @@
+lsscsi
+open-iscsi
+open-iscsi-utils # Deprecated since quantal dist:precise
diff --git a/files/rpms-suse/cinder b/files/rpms-suse/cinder
index 189a232fa7..b39cc79a27 100644
--- a/files/rpms-suse/cinder
+++ b/files/rpms-suse/cinder
@@ -1,4 +1,3 @@
 lvm2
-open-iscsi
 qemu-tools
 tgt # NOPRIME
diff --git a/files/rpms-suse/os-brick b/files/rpms-suse/os-brick
new file mode 100644
index 0000000000..67b33a9861
--- /dev/null
+++ b/files/rpms-suse/os-brick
@@ -0,0 +1,2 @@
+lsscsi
+open-iscsi
diff --git a/files/rpms/cinder b/files/rpms/cinder
index c21ea08e89..375f93e090 100644
--- a/files/rpms/cinder
+++ b/files/rpms/cinder
@@ -1,4 +1,3 @@
-iscsi-initiator-utils
 lvm2
 qemu-img
 targetcli
diff --git a/files/rpms/os-brick b/files/rpms/os-brick
new file mode 100644
index 0000000000..14ff870557
--- /dev/null
+++ b/files/rpms/os-brick
@@ -0,0 +1,2 @@
+iscsi-initiator-utils
+lsscsi
diff --git a/functions-common b/functions-common
index d99ad9212f..549f7e8cdc 100644
--- a/functions-common
+++ b/functions-common
@@ -1219,10 +1219,16 @@ function get_packages {
             if [[ ! $file_to_parse =~ $package_dir/glance ]]; then
                 file_to_parse="${file_to_parse} ${package_dir}/glance"
             fi
+            if [[ ! $file_to_parse =~ $package_dir/os-brick ]]; then
+                file_to_parse="${file_to_parse} ${package_dir}/os-brick"
+            fi
         elif [[ $service == c-* ]]; then
             if [[ ! $file_to_parse =~ $package_dir/cinder ]]; then
                 file_to_parse="${file_to_parse} ${package_dir}/cinder"
             fi
+            if [[ ! $file_to_parse =~ $package_dir/os-brick ]]; then
+                file_to_parse="${file_to_parse} ${package_dir}/os-brick"
+            fi
         elif [[ $service == s-* ]]; then
             if [[ ! $file_to_parse =~ $package_dir/swift ]]; then
                 file_to_parse="${file_to_parse} ${package_dir}/swift"
@@ -1231,6 +1237,9 @@ function get_packages {
             if [[ ! $file_to_parse =~ $package_dir/nova ]]; then
                 file_to_parse="${file_to_parse} ${package_dir}/nova"
             fi
+            if [[ ! $file_to_parse =~ $package_dir/os-brick ]]; then
+                file_to_parse="${file_to_parse} ${package_dir}/os-brick"
+            fi
         elif [[ $service == g-* ]]; then
             if [[ ! $file_to_parse =~ $package_dir/glance ]]; then
                 file_to_parse="${file_to_parse} ${package_dir}/glance"

From 6fba3fdfa1e4d15c8e6128a3a426e499b221d2d2 Mon Sep 17 00:00:00 2001
From: Luigi Toscano <ltoscano@redhat.com>
Date: Tue, 18 Aug 2020 22:29:49 +0200
Subject: [PATCH 1783/2409] New get-devstack-os-environment role

The role reads the OS_* variables set by devstack through openrc
for the specified user and project and exports them as
the os_env_vars fact. It is meant to be used as a porting aid
for the jobs of the non-unified *clients only.

This is useful to run functional tests against the generated
environment. A slightly less generic version of this role
is currently used by python-cinderclient and python-novaclient
(get-os-environment).

In order to make this more useful, call it from
devstack-tox-functional and derived jobs. The role
execution is disabled by default and it can be enabled
by setting openrc_enable_export: true.

Change-Id: I15f5a187dbc54c82e8f4a08b4bb58d56e0d66961
---
 playbooks/tox/run-both.yaml                   |  4 +-
 playbooks/tox/run.yaml                        |  4 +-
 roles/get-devstack-os-environment/README.rst  | 40 +++++++++++++++++++
 .../defaults/main.yaml                        |  5 +++
 .../tasks/main.yaml                           | 14 +++++++
 5 files changed, 65 insertions(+), 2 deletions(-)
 create mode 100644 roles/get-devstack-os-environment/README.rst
 create mode 100644 roles/get-devstack-os-environment/defaults/main.yaml
 create mode 100644 roles/get-devstack-os-environment/tasks/main.yaml

diff --git a/playbooks/tox/run-both.yaml b/playbooks/tox/run-both.yaml
index e85c2eee96..0528b46f00 100644
--- a/playbooks/tox/run-both.yaml
+++ b/playbooks/tox/run-both.yaml
@@ -7,4 +7,6 @@
       bindep_dir: "{{ zuul_work_dir }}"
     - test-setup
     - ensure-tox
-    - tox
+    - get-devstack-os-environment
+    - role: tox
+      tox_environment: "{{ os_env_vars|default({}) }}"
diff --git a/playbooks/tox/run.yaml b/playbooks/tox/run.yaml
index 22f82096c7..6e549d3655 100644
--- a/playbooks/tox/run.yaml
+++ b/playbooks/tox/run.yaml
@@ -1,3 +1,5 @@
 - hosts: all
   roles:
-    - tox
+    - get-devstack-os-environment
+    - role: tox
+      tox_environment: "{{ os_env_vars|default({}) }}"
diff --git a/roles/get-devstack-os-environment/README.rst b/roles/get-devstack-os-environment/README.rst
new file mode 100644
index 0000000000..68ddce8b5a
--- /dev/null
+++ b/roles/get-devstack-os-environment/README.rst
@@ -0,0 +1,40 @@
+Reads the OS_* variables set by devstack through openrc
+for the specified user and project and exports them as
+the os_env_vars fact.
+
+**WARNING**: this role is meant to be used as porting aid
+for the non-unified python-<service>client jobs which
+are already around, as those clients do not use clouds.yaml
+as openstackclient does.
+When those clients and their jobs are deprecated and removed,
+or anyway when the new code is able to read from clouds.yaml
+directly, this role should be removed as well.
+
+
+**Role Variables**
+
+.. zuul:rolevar:: devstack_base_dir
+   :default: /opt/stack
+
+   The devstack base directory.
+
+.. zuul:rolevar:: openrc_file
+   :default: {{ devstack_base_dir }}/devstack/openrc
+
+   The location of the generated openrc file.
+
+.. zuul:rolevar:: openrc_user
+   :default: admin
+
+   The user whose credentials should be retrieved.
+
+.. zuul:rolevar:: openrc_project
+   :default: admin
+
+   The project (which openrc_user is part of) whose
+   access data should be retrieved.
+
+.. zuul:rolevar:: openrc_enable_export
+   :default: false
+
+   Set it to true to export os_env_vars.
diff --git a/roles/get-devstack-os-environment/defaults/main.yaml b/roles/get-devstack-os-environment/defaults/main.yaml
new file mode 100644
index 0000000000..73ecfe920c
--- /dev/null
+++ b/roles/get-devstack-os-environment/defaults/main.yaml
@@ -0,0 +1,5 @@
+devstack_base_dir: "/opt/stack"
+openrc_file: "{{ devstack_base_dir }}/devstack/openrc"
+openrc_user: admin
+openrc_project: admin
+openrc_enable_export: false
diff --git a/roles/get-devstack-os-environment/tasks/main.yaml b/roles/get-devstack-os-environment/tasks/main.yaml
new file mode 100644
index 0000000000..8c8df7f96d
--- /dev/null
+++ b/roles/get-devstack-os-environment/tasks/main.yaml
@@ -0,0 +1,14 @@
+- when: openrc_enable_export
+  block:
+    - name: Extract the OS_ environment variables
+      shell:
+        cmd: |
+          source {{ openrc_file }} {{ openrc_user }} {{ openrc_project }} &>/dev/null
+          env | awk -F= 'BEGIN {print "---" } /^OS_/ { print "  "$1": \""$2"\""} '
+      args:
+        executable: "/bin/bash"
+      register: env_os
+
+    - name: Save the OS_ environment variables as a fact
+      set_fact:
+        os_env_vars: "{{ env_os.stdout|from_yaml }}"

From b9fe9c74f68f1881c0602748301ec6b68ed508d6 Mon Sep 17 00:00:00 2001
From: Carlos Goncalves <cgoncalves@redhat.com>
Date: Thu, 20 Aug 2020 14:42:55 +0200
Subject: [PATCH 1784/2409] Make PyYAML overridable on Red Hat family distros

This patch fixes an early stack issue where the following error message
would be presented:

ERROR: Cannot uninstall 'PyYAML'. It is a distutils installed project
and thus we cannot accurately determine which files belong to it which
would lead to only a partial uninstall.

We also drop references to removal of Python 2 library egg infos now
that Python 2 is EOL.

Closes-Bug: #1892363
Change-Id: I2876ee58ab6b73682869d6b4e684e10ac5e56ad9
---
 tools/fixup_stuff.sh | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index e1409291b9..bf31dcbebb 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -162,10 +162,7 @@ function fixup_fedora {
     # manifest of what to remove.  However, in most cases, simply
     # overwriting works.  So this hacks around those packages that
     # have been dragged in by some other system dependency
-    sudo rm -rf /usr/lib/python2.7/site-packages/enum34*.egg-info
-    sudo rm -rf /usr/lib/python2.7/site-packages/ipaddress*.egg-info
-    sudo rm -rf /usr/lib/python2.7/site-packages/ply-*.egg-info
-    sudo rm -rf /usr/lib/python2.7/site-packages/typing-*.egg-info
+    sudo rm -rf /usr/lib64/python3*/site-packages/PyYAML-*.egg-info
 }
 
 function fixup_suse {

From f0c12bd4b54eec793cd73e0bf4d07dc2d7fee4ea Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Wed, 24 Jun 2020 07:26:35 +0200
Subject: [PATCH 1785/2409] Further py2 cleanup for Fedora

Change-Id: I2433e2ed067f866751bf49983c0a7efce4be8900
---
 tools/fixup_stuff.sh | 32 --------------------------------
 1 file changed, 32 deletions(-)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index bf31dcbebb..441075ddcb 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -87,12 +87,6 @@ function fixup_ubuntu {
 # Python Packages
 # ---------------
 
-# get_package_path python-package    # in import notation
-function get_package_path {
-    local package=$1
-    echo $(python -c "import os; import $package; print(os.path.split(os.path.realpath($package.__file__))[0])")
-}
-
 function fixup_fedora {
     if ! is_fedora; then
         return
@@ -130,32 +124,6 @@ function fixup_fedora {
         fi
     fi
 
-    if  [[ "$os_VENDOR" == "Fedora" ]] && [[ "$os_RELEASE" -ge "22" ]]; then
-        # requests ships vendored version of chardet/urllib3, but on
-        # fedora these are symlinked back to the primary versions to
-        # avoid duplication of code on disk.  This is fine when
-        # maintainers keep things in sync, but since devstack takes
-        # over and installs later versions via pip we can end up with
-        # incompatible versions.
-        #
-        # The rpm package is not removed to preserve the dependent
-        # packages like cloud-init; rather we remove the symlinks and
-        # force a re-install of requests so the vendored versions it
-        # wants are present.
-        #
-        # Realted issues:
-        # https://bugs.launchpad.net/glance/+bug/1476770
-        # https://bugzilla.redhat.com/show_bug.cgi?id=1253823
-
-        base_path=$(get_package_path requests)/packages
-        if [ -L $base_path/chardet -o -L $base_path/urllib3 ]; then
-            sudo rm -f $base_path/{chardet,urllib3}
-            # install requests with the bundled urllib3 to avoid conflicts
-            pip_install --upgrade --force-reinstall requests
-        fi
-
-    fi
-
     # Since pip10, pip will refuse to uninstall files from packages
     # that were created with distutils (rather than more modern
     # setuptools).  This is because it technically doesn't have a

From e7625fc72cbbbfaf37a6682166bc2180d4e50855 Mon Sep 17 00:00:00 2001
From: Lucas Alvares Gomes <lucasagomes@gmail.com>
Date: Wed, 26 Aug 2020 09:46:35 +0100
Subject: [PATCH 1786/2409] [OVN] Follow up of OVN module migration to DevStack

This patch is a follow-up of Ib4194329474e8d68a90886d2a04f027eecd741df.

This patch removes the configure_port_forwarding call from the
neutron-legacy module because port forwarding (just like other
extensions such as DNS, QOS, etc...) are already enabled in the
plugin.sh file in the neutron repository [0]. The
configure_port_forwarding method itself is also defined in the neutron
repository so calling it here may result in a failure in case the plugin
is not enabled.

We are also removing the "dns" extensions from the default
Q_ML2_PLUGIN_EXT_DRIVERS variable because this extension conflicts with
the default DNS extensions that is enabled by Neutron when
q-dns/neutron-dns service is enabled (also in [0]). The LP for this
conflict problem is: https://bugs.launchpad.net/neutron/+bug/1887163.

[0]
https://github.com/openstack/neutron/blob/945a244588b81064e4301b6f055a3c90f472bd7e/devstack/plugin.sh#L101-L103

Change-Id: Iafb9e45520798b2a612192cfc6cca28501465862
Signed-off-by: Lucas Alvares Gomes <lucasagomes@gmail.com>
---
 lib/neutron-legacy            | 3 ---
 lib/neutron_plugins/ovn_agent | 2 +-
 2 files changed, 1 insertion(+), 4 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 363c62e4c2..2906f15736 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -364,9 +364,6 @@ function configure_mutnauq {
 
     if [[ $Q_AGENT == "ovn" ]]; then
         configure_ovn
-        if is_service_enabled q-port-forwarding neutron-port-forwarding; then
-            configure_port_forwarding
-        fi
         configure_ovn_plugin
     fi
 
diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index e29b84fa48..f647f85c3d 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -118,7 +118,7 @@ Q_ML2_PLUGIN_MECHANISM_DRIVERS=${Q_ML2_PLUGIN_MECHANISM_DRIVERS:-ovn,logger}
 Q_ML2_PLUGIN_TYPE_DRIVERS=${Q_ML2_PLUGIN_TYPE_DRIVERS:-local,flat,vlan,geneve}
 Q_ML2_TENANT_NETWORK_TYPE=${Q_ML2_TENANT_NETWORK_TYPE:-"geneve"}
 Q_ML2_PLUGIN_GENEVE_TYPE_OPTIONS=${Q_ML2_PLUGIN_GENEVE_TYPE_OPTIONS:-"vni_ranges=1:65536"}
-Q_ML2_PLUGIN_EXT_DRIVERS=${Q_ML2_PLUGIN_EXT_DRIVERS:-port_security,dns,qos}
+Q_ML2_PLUGIN_EXT_DRIVERS=${Q_ML2_PLUGIN_EXT_DRIVERS:-port_security,qos}
 # this one allows empty:
 ML2_L3_PLUGIN=${ML2_L3_PLUGIN-"ovn-router"}
 

From 18b4251bf4f689923a19bf7fbc50d5c2ea422b21 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Mon, 31 Aug 2020 16:22:57 +1000
Subject: [PATCH 1787/2409] Use SETUPTOOLS_USE_DISTUTILS=stdlib for global pip
 installs

A new setuptools release has changed the way pip installs are done,
see [0]. With this change we switch back to using the distro
method for global pip installs.

Temporarily make grenade jobs non-voting in order to allow this
patch to be backported.

[0] http://lists.openstack.org/pipermail/openstack-discuss/2020-August/016905.html

Change-Id: I5d8aa0e58e0409c54451b51de5eb70ba9a68d849
---
 .zuul.yaml | 18 ++++++++++--------
 inc/python |  8 +++++++-
 2 files changed, 17 insertions(+), 9 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index d387b0dd50..acf26e2ca8 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -705,10 +705,12 @@
             voting: false
             irrelevant-files: *dsvm-irrelevant-files
         - grenade:
+            voting: false
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
         - neutron-grenade-multinode:
+            voting: false
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
@@ -750,18 +752,18 @@
         - devstack-multinode
         - devstack-unit-tests
         - openstack-tox-bashate
-        - neutron-grenade-multinode:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
+        # - neutron-grenade-multinode:
+        #     irrelevant-files:
+        #       - ^.*\.rst$
+        #       - ^doc/.*$
         - neutron-tempest-linuxbridge:
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
-        - grenade:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
+        # - grenade:
+        #     irrelevant-files:
+        #       - ^.*\.rst$
+        #       - ^doc/.*$
         - openstacksdk-functional-devstack:
             irrelevant-files:
               - ^.*\.rst$
diff --git a/inc/python b/inc/python
index f98d28d995..8941fd038d 100644
--- a/inc/python
+++ b/inc/python
@@ -170,7 +170,13 @@ function pip_install {
         local sudo_pip="env"
     else
         local cmd_pip="python$PYTHON3_VERSION -m pip"
-        local sudo_pip="sudo -H LC_ALL=en_US.UTF-8"
+        # See
+        #  https://github.com/pypa/setuptools/issues/2232
+        #  http://lists.openstack.org/pipermail/openstack-discuss/2020-August/016905.html
+        # this makes setuptools >=50 use the platform distutils.
+        # We only want to do this on global pip installs, not if
+        # installing in a virtualenv
+        local sudo_pip="sudo -H LC_ALL=en_US.UTF-8 SETUPTOOLS_USE_DISTUTILS=stdlib "
         echo "Using python $PYTHON3_VERSION to install $package_dir"
     fi
 

From cb8a4a6882b0cf89590cd169c6dce2c01c1dee9f Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Tue, 1 Sep 2020 14:04:00 +0200
Subject: [PATCH 1788/2409] Make grenade jobs voting again

This reverts the changes made to the zuul config in [0]. Since the
backports to the stable branches have been merged, the jobs can be
voting again.

[0] I5d8aa0e58e0409c54451b51de5eb70ba9a68d849

Change-Id: I3f5972e05faea8f11d7e87f3f8b05e4979e6c328
---
 .zuul.yaml | 18 ++++++++----------
 1 file changed, 8 insertions(+), 10 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index acf26e2ca8..d387b0dd50 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -705,12 +705,10 @@
             voting: false
             irrelevant-files: *dsvm-irrelevant-files
         - grenade:
-            voting: false
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
         - neutron-grenade-multinode:
-            voting: false
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
@@ -752,18 +750,18 @@
         - devstack-multinode
         - devstack-unit-tests
         - openstack-tox-bashate
-        # - neutron-grenade-multinode:
-        #     irrelevant-files:
-        #       - ^.*\.rst$
-        #       - ^doc/.*$
+        - neutron-grenade-multinode:
+            irrelevant-files:
+              - ^.*\.rst$
+              - ^doc/.*$
         - neutron-tempest-linuxbridge:
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
-        # - grenade:
-        #     irrelevant-files:
-        #       - ^.*\.rst$
-        #       - ^doc/.*$
+        - grenade:
+            irrelevant-files:
+              - ^.*\.rst$
+              - ^doc/.*$
         - openstacksdk-functional-devstack:
             irrelevant-files:
               - ^.*\.rst$

From ae21b3556ff215c0f73bc0ebbc90d72fa59a3459 Mon Sep 17 00:00:00 2001
From: Sean Mooney <work@seanmooney.info>
Date: Tue, 1 Sep 2020 14:11:45 +0000
Subject: [PATCH 1789/2409] move cleanup of pyc files

Previously pyc files were only cleaned if clean.sh was run.
with this change a new clean_pyc_files function was introduced
with the logic that was previously in clean.sh but it is now
invoked from unstack.sh

With the previous behavior you could not stack with horizon
enabled then unstack and stack again due to the presence of pyc
files that were owned by root.

By moving the clean to unstack in stead of clean.sh you can
now stack, unstack and stack again without hitting the pyc issue.
since unstack is invoked by clean the existing clean.sh behavior has
not changed in practice except for the fact the pyc files are
removed sooner in the process.

This change also removes support for findutils < 4.2.3
Ubuntu 12.04 and CentOS 6 both have 4.4.2 since they were
released 8 years ago and are now EOL its fair to assume
that all modern distros have 4.2.3+
https://repology.org/project/findutils/versions

Change-Id: I13c9aad9be7e0930a0d875b7d382090caf0b8982
---
 clean.sh         | 9 ---------
 functions-common | 7 +++++++
 unstack.sh       | 2 ++
 3 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/clean.sh b/clean.sh
index 685a719cfb..cb0a8b4bef 100755
--- a/clean.sh
+++ b/clean.sh
@@ -145,12 +145,3 @@ done
 
 rm -rf ~/.config/openstack
 
-# Clean up all *.pyc files
-if [[ -n "$DEST" ]] && [[ -d "$DEST" ]]; then
-    find_version=`find --version | awk '{ print $NF; exit}'`
-    if vercmp "$find_version" "<" "4.2.3" ; then
-        sudo find $DEST -name "*.pyc" -print0 | xargs -0 rm
-    else
-        sudo find $DEST -name "*.pyc" -delete
-    fi
-fi
diff --git a/functions-common b/functions-common
index ffbd631fb2..547f6df038 100644
--- a/functions-common
+++ b/functions-common
@@ -2415,6 +2415,13 @@ function time_totals {
     $xtrace
 }
 
+function clean_pyc_files {
+    # Clean up all *.pyc files
+    if [[ -n "$DEST" ]] && [[ -d "$DEST" ]]; then
+        sudo find $DEST -name "*.pyc" -delete
+    fi
+}
+
 # Restore xtrace
 $_XTRACE_FUNCTIONS_COMMON
 
diff --git a/unstack.sh b/unstack.sh
index 276111edb9..3197cf136f 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -182,3 +182,5 @@ if is_service_enabled cinder && is_package_installed lvm2; then
     clean_lvm_volume_group $DEFAULT_VOLUME_GROUP_NAME || /bin/true
     clean_lvm_filter
 fi
+
+clean_pyc_files

From 7f7f488bc385dd707a3a6d8dae7859bbe72182e5 Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Thu, 20 Aug 2020 09:27:01 +0100
Subject: [PATCH 1790/2409] Bionic: Enable Train UCA for updated QEMU and
 libvirt

This is will allow the openstack/nova project to facilitate a minimum
required version bump of QEMU and libvirt within the libvirt virt driver
in I8e349849db0b1a540d295c903f1470917b82fd97 ahead of the planned switch
to focal later in Victoria.

Change-Id: I85eb45632ff229676f7c29708f4a7cc64b3d90e3
---
 tools/fixup_stuff.sh | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index bf31dcbebb..550239a2d9 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -73,6 +73,18 @@ function fixup_ubuntu {
     # Enable universe
     sudo add-apt-repository -y universe
 
+    if [[ -f /etc/ci/mirror_info.sh ]] ; then
+        # If we are on a nodepool provided host and it has told us about
+        # where we can find local mirrors then use that mirror.
+        source /etc/ci/mirror_info.sh
+        sudo apt-add-repository -y "deb $NODEPOOL_UCA_MIRROR bionic-updates/train main"
+    else
+        # Enable UCA:train for updated versions of QEMU and libvirt
+        sudo add-apt-repository -y cloud-archive:train
+    fi
+    REPOS_UPDATED=False
+    apt_get_update
+
     # Since pip10, pip will refuse to uninstall files from packages
     # that were created with distutils (rather than more modern
     # setuptools).  This is because it technically doesn't have a

From 7ba26f5cf97b39bd0ddb53248ae4676866c10824 Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Thu, 17 Sep 2020 11:13:52 +0200
Subject: [PATCH 1791/2409] Add possibility to not compile ovs and ovn if
 that's disabled

There is flag Q_BUILD_OVS_FROM_GIT which can be used to not compile
ovs from source.
But this wasn't respected in the ovn_agent's module in install_ovn
function which was always installing from source ovn and ovs.
We need to disable that e.g. on grenade jobs when new version is
installed.

Change-Id: I7d3f92365e880191dcfe7c618a6f79d5f741144f
---
 lib/neutron_plugins/ovn_agent | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index f647f85c3d..84df9181ea 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -28,6 +28,8 @@ source $NEUTRON_DIR/devstack/lib/ovs
 # Defaults
 # --------
 
+Q_BUILD_OVS_FROM_GIT=$(trueorfalse True Q_BUILD_OVS_FROM_GIT)
+
 # Set variables for building OVN from source
 OVN_REPO=${OVN_REPO:-https://github.com/ovn-org/ovn.git}
 OVN_REPO_NAME=$(basename ${OVN_REPO} | cut -f1 -d'.')
@@ -322,6 +324,11 @@ function ovn_sanity_check {
 
 # install_ovn() - Collect source and prepare
 function install_ovn {
+    if [[ "$Q_BUILD_OVS_FROM_GIT" == "False" ]]; then
+        echo "Installation of OVS from source disabled."
+        return 0
+    fi
+
     echo "Installing OVN and dependent packages"
 
     # Check the OVN configuration

From 848aaf83edf66e0c5671b8e9e74414ee70fdba0e Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Fri, 4 Sep 2020 10:29:19 -0500
Subject: [PATCH 1792/2409] Add nova-ceph-multistore job in devstack gate

nova-ceph-multistore is defined in nova side to test the
glance multistore on ceph and it is voting on nova gate.

There are other multistore testing enhancement going on for
example- https://review.opendev.org/#/c/743800/. so to avoid
any regression, let's run exiting mutistore job on devstack
gate too.

Change-Id: Ie82b4057463df4b6138c53b14a582bd84866aebd
---
 .zuul.yaml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index d387b0dd50..9ae5f3f804 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -734,6 +734,10 @@
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
+        - nova-ceph-multistore:
+            irrelevant-files:
+              - ^.*\.rst$
+              - ^doc/.*$
         # NOTE(gmann): Remove this job from devstack pipeline once it is
         # migrated to zuulv3 native. This is legacy job and rely on
         # devstack-gate + devstack setting so any change in devstack can
@@ -770,6 +774,10 @@
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
+        - nova-ceph-multistore:
+            irrelevant-files:
+              - ^.*\.rst$
+              - ^doc/.*$
     # Please add a note on each job and conditions for the job not
     # being experimental any more, so we can keep this list somewhat
     # pruned.

From 057aaa6ec90d037661ec88ef8af2b477e28411b4 Mon Sep 17 00:00:00 2001
From: Abhishek Kekane <akekane@redhat.com>
Date: Wed, 29 Jul 2020 07:37:16 +0000
Subject: [PATCH 1793/2409] Configure cinder store for glance

This patch will enable user to configure single cinder store as well as
multiple cinder stores for glance. Below are the parameters needs to be
added in local.conf.

A. For single store
USE_CINDER_FOR_GLANCE=True

B. For Multiple stores
USE_CINDER_FOR_GLANCE=True
GLANCE_ENABLE_MULTIPLE_STORES=True
CINDER_ENABLED_BACKENDS=${CINDER_ENABLED_BACKENDS:-lvm:lvmdriver-1,lvm:lvmdriver-2,nfs:nfsdriver-1,ceph:cephdriver-1}
GLANCE_CINDER_DEFAULT_BACKEND=lvmdriver-1

enable_plugin devstack-plugin-nfs https://opendev.org/openstack/devstack-plugin-nfs
enable_plugin devstack-plugin-ceph https://opendev.org/openstack/devstack-plugin-ceph

NOTE:
GLANCE_CINDER_DEFAULT_BACKEND should be one of the value from CINDER_ENABLED_BACKENDS.
If you need to configure nfs and ceph backend for cinder then you need to add respective plugins in
local.conf file.
If GLANCE_ENABLE_MULTIPLE_STORES is True then it will not configure
swift store for glance even if it is enabled in local.conf file.

Needed-by: https://review.opendev.org/#/c/750018
Change-Id: Id0d63c4ea41cce389eee8dc9a96913a7d427f186
---
 lib/glance | 192 +++++++++++++++++++++++++++++++++++++++++------------
 stack.sh   |  60 +++++++++--------
 2 files changed, 184 insertions(+), 68 deletions(-)

diff --git a/lib/glance b/lib/glance
index 2118636a46..a848fc7abe 100644
--- a/lib/glance
+++ b/lib/glance
@@ -41,6 +41,16 @@ else
     GLANCE_BIN_DIR=$(get_python_exec_prefix)
 fi
 
+# Cinder for Glance
+USE_CINDER_FOR_GLANCE=$(trueorfalse False USE_CINDER_FOR_GLANCE)
+# GLANCE_CINDER_DEFAULT_BACKEND should be one of the values
+# from CINDER_ENABLED_BACKENDS
+GLANCE_CINDER_DEFAULT_BACKEND=${GLANCE_CINDER_DEFAULT_BACKEND:-lvmdriver-1}
+GLANCE_STORE_ROOTWRAP_BASE_DIR=/usr/local/etc/glance
+# NOTE (abhishekk): For opensuse data files are stored in different directory
+if is_opensuse; then
+    GLANCE_STORE_ROOTWRAP_BASE_DIR=/usr/etc/glance
+fi
 # Glance multi-store configuration
 # Boolean flag to enable multiple store configuration for glance
 GLANCE_ENABLE_MULTIPLE_STORES=$(trueorfalse False GLANCE_ENABLE_MULTIPLE_STORES)
@@ -68,6 +78,7 @@ GLANCE_STANDALONE=${GLANCE_STANDALONE:-True}
 # and $DATA_DIR/glance/cheap.
 GLANCE_MULTISTORE_FILE_IMAGE_DIR=${GLANCE_MULTISTORE_FILE_IMAGE_DIR:=$DATA_DIR/glance}
 GLANCE_IMAGE_DIR=${GLANCE_IMAGE_DIR:=$DATA_DIR/glance/images}
+GLANCE_NFS_MOUNTPOINT=$GLANCE_IMAGE_DIR/mnt
 GLANCE_LOCK_DIR=${GLANCE_LOCK_DIR:=$DATA_DIR/glance/locks}
 GLANCE_STAGING_DIR=${GLANCE_MULTISTORE_FILE_IMAGE_DIR:=$DATA_DIR/os_glance_staging_store}
 GLANCE_TASKS_DIR=${GLANCE_MULTISTORE_FILE_IMAGE_DIR:=$DATA_DIR/os_glance_tasks_store}
@@ -135,6 +146,122 @@ function cleanup_glance {
     fi
 }
 
+# Set multiple cinder store related config options for each of the cinder store
+#
+function configure_multiple_cinder_stores {
+
+    local be be_name be_type enabled_backends
+    for be in ${CINDER_ENABLED_BACKENDS//,/ }; do
+        be_type=${be%%:*}
+        be_name=${be##*:}
+        enabled_backends+="${be_name}:cinder,"
+
+        set_common_cinder_store_params $be_name
+        iniset $GLANCE_API_CONF $be_name cinder_volume_type ${be_name}
+        if [[ "$be_type" == "nfs" ]]; then
+            mkdir -p "$GLANCE_NFS_MOUNTPOINT"
+            iniset $GLANCE_API_CONF $be_name cinder_mount_point_base "$GLANCE_NFS_MOUNTPOINT"
+        fi
+    done
+    iniset $GLANCE_API_CONF DEFAULT enabled_backends ${enabled_backends::-1}
+    iniset $GLANCE_API_CONF glance_store default_backend $GLANCE_CINDER_DEFAULT_BACKEND
+}
+
+# Set common cinder store options to given config section
+#
+# Arguments:
+# config_section
+#
+function set_common_cinder_store_params {
+    local config_section="$1"
+    iniset $GLANCE_API_CONF $config_section cinder_store_auth_address $KEYSTONE_SERVICE_URI_V3
+    iniset $GLANCE_API_CONF $config_section cinder_store_user_name glance
+    iniset $GLANCE_API_CONF $config_section cinder_store_password $SERVICE_PASSWORD
+    iniset $GLANCE_API_CONF $config_section cinder_store_project_name $SERVICE_PROJECT_NAME
+}
+
+# Configure multiple file stores options for each file store
+#
+# Arguments:
+#
+function configure_multiple_file_stores {
+    local store enabled_backends
+    enabled_backends=""
+    for store in $(echo $GLANCE_MULTIPLE_FILE_STORES | tr "," "\n"); do
+        enabled_backends+="${store}:file,"
+    done
+    iniset $GLANCE_API_CONF DEFAULT enabled_backends ${enabled_backends::-1}
+
+    # Glance multiple store Store specific configs
+    iniset $GLANCE_API_CONF glance_store default_backend $GLANCE_DEFAULT_BACKEND
+    local store
+    for store in $(echo $glance_multiple_file_stores | tr "," "\n"); do
+        iniset $GLANCE_API_CONF $store filesystem_store_datadir "${GLANCE_MULTISTORE_FILE_IMAGE_DIR}/${store}/"
+    done
+}
+
+# Set reserved stores for glance
+function configure_reserved_stores {
+    iniset $GLANCE_API_CONF os_glance_staging_store filesystem_store_datadir "${GLANCE_MULTISTORE_FILE_IMAGE_DIR}/os_glance_staging_store/"
+    iniset $GLANCE_API_CONF os_glance_tasks_store filesystem_store_datadir "${GLANCE_MULTISTORE_FILE_IMAGE_DIR}/os_glance_tasks_store/"
+}
+
+# Copy rootwrap file from glance_store/etc/glance to /etc/glance
+#
+# Arguments:
+# source_path Source path to copy rootwrap files from
+#
+function copy_rootwrap {
+    local source_path="$1"
+    # Make glance configuration directory if it is not exists
+    sudo install -d -o $STACK_USER $GLANCE_CONF_DIR
+    cp -r $source_path/rootwrap.* $GLANCE_CONF_DIR/
+}
+
+# Set glance_store related config options
+#
+# Arguments:
+# USE_CINDER_FOR_GLANCE
+# GLANCE_ENABLE_MULTIPLE_STORES
+#
+function configure_glance_store {
+    local use_cinder_for_glance="$1"
+    local glance_enable_multiple_stores="$2"
+    local be
+
+    if [[ "$glance_enable_multiple_stores" == "False" ]]; then
+        # Configure traditional glance_store
+        if [[ "$use_cinder_for_glance" == "True" ]]; then
+            # set common glance_store parameters
+            iniset $GLANCE_API_CONF glance_store stores "cinder,file,http"
+            iniset $GLANCE_API_CONF glance_store default_store cinder
+
+            # set cinder related store parameters
+            set_common_cinder_store_params glance_store
+            # set nfs mount_point dir
+            for be in ${CINDER_ENABLED_BACKENDS//,/ }; do
+                local be_name=${be##*:}
+                if [[ "$be_name" == "nfs" ]]; then
+                    mkdir -p $GLANCE_NFS_MOUNTPOINT
+                    iniset $GLANCE_API_CONF glance_store cinder_mount_point_base $GLANCE_NFS_MOUNTPOINT
+                fi
+            done
+        fi
+        # Store specific configs
+        iniset $GLANCE_API_CONF glance_store filesystem_store_datadir $GLANCE_IMAGE_DIR/
+    else
+        if [[ "$use_cinder_for_glance" == "True" ]]; then
+            # Configure multiple cinder stores for glance
+            configure_multiple_cinder_stores
+        else
+            # Configure multiple file stores for glance
+            configure_multiple_file_stores
+        fi
+        # Configure reserved stores
+        configure_reserved_stores
+    fi
+}
+
 # configure_glance() - Set config files, create data dirs, etc
 function configure_glance {
     sudo install -d -o $STACK_USER $GLANCE_CONF_DIR $GLANCE_METADEF_DIR
@@ -143,16 +270,6 @@ function configure_glance {
     local dburl
     dburl=`database_connection_url glance`
 
-    # Configure multiple stores
-    if [[ "$GLANCE_ENABLE_MULTIPLE_STORES" == "True" ]]; then
-        local store enabled_backends
-        enabled_backends=""
-        for store in $(echo $GLANCE_MULTIPLE_FILE_STORES | tr "," "\n"); do
-            enabled_backends+="${store}:file,"
-        done
-        iniset $GLANCE_API_CONF DEFAULT enabled_backends ${enabled_backends::-1}
-    fi
-
     iniset $GLANCE_API_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
     iniset $GLANCE_API_CONF database connection $dburl
     iniset $GLANCE_API_CONF DEFAULT use_syslog $SYSLOG
@@ -170,21 +287,8 @@ function configure_glance {
         iniset $GLANCE_API_CONF DEFAULT disk_formats "ami,ari,aki,vhd,vmdk,raw,qcow2,vdi,iso,ploop"
     fi
 
-    # Glance multiple store Store specific configs
-    if [[ "$GLANCE_ENABLE_MULTIPLE_STORES" == "True" ]]; then
-        iniset $GLANCE_API_CONF glance_store default_backend $GLANCE_DEFAULT_BACKEND
-        local store
-        for store in $(echo $GLANCE_MULTIPLE_FILE_STORES | tr "," "\n"); do
-            iniset $GLANCE_API_CONF $store filesystem_store_datadir "${GLANCE_MULTISTORE_FILE_IMAGE_DIR}/${store}/"
-        done
-
-        # Glance configure reserved stores
-        iniset $GLANCE_API_CONF os_glance_staging_store filesystem_store_datadir "${GLANCE_MULTISTORE_FILE_IMAGE_DIR}/os_glance_staging_store/"
-        iniset $GLANCE_API_CONF os_glance_tasks_store filesystem_store_datadir "${GLANCE_MULTISTORE_FILE_IMAGE_DIR}/os_glance_tasks_store/"
-    else
-        # Store specific configs
-        iniset $GLANCE_API_CONF glance_store filesystem_store_datadir $GLANCE_IMAGE_DIR/
-    fi
+    # Configure glance_store
+    configure_glance_store $USE_CINDER_FOR_GLANCE $GLANCE_ENABLE_MULTIPLE_STORES
 
     # CORS feature support - to allow calls from Horizon by default
     if [ -n "$GLANCE_CORS_ALLOWED_ORIGIN" ]; then
@@ -194,24 +298,26 @@ function configure_glance {
     fi
 
     # No multiple stores for swift yet
-    # Store the images in swift if enabled.
-    if is_service_enabled s-proxy; then
-        iniset $GLANCE_API_CONF glance_store default_store swift
-        iniset $GLANCE_API_CONF glance_store swift_store_create_container_on_put True
-
-        iniset $GLANCE_API_CONF glance_store swift_store_config_file $GLANCE_SWIFT_STORE_CONF
-        iniset $GLANCE_API_CONF glance_store default_swift_reference ref1
-        iniset $GLANCE_API_CONF glance_store stores "file, http, swift"
-        if is_service_enabled tls-proxy; then
-            iniset $GLANCE_API_CONF glance_store swift_store_cacert $SSL_BUNDLE_FILE
+    if [[ "$GLANCE_ENABLE_MULTIPLE_STORES" == "False" ]]; then
+        # Store the images in swift if enabled.
+        if is_service_enabled s-proxy; then
+            iniset $GLANCE_API_CONF glance_store default_store swift
+            iniset $GLANCE_API_CONF glance_store swift_store_create_container_on_put True
+
+            iniset $GLANCE_API_CONF glance_store swift_store_config_file $GLANCE_SWIFT_STORE_CONF
+            iniset $GLANCE_API_CONF glance_store default_swift_reference ref1
+            iniset $GLANCE_API_CONF glance_store stores "file, http, swift"
+            if is_service_enabled tls-proxy; then
+                iniset $GLANCE_API_CONF glance_store swift_store_cacert $SSL_BUNDLE_FILE
+            fi
+            iniset $GLANCE_API_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
+
+            iniset $GLANCE_SWIFT_STORE_CONF ref1 user $SERVICE_PROJECT_NAME:glance-swift
+
+            iniset $GLANCE_SWIFT_STORE_CONF ref1 key $SERVICE_PASSWORD
+            iniset $GLANCE_SWIFT_STORE_CONF ref1 auth_address $KEYSTONE_SERVICE_URI/v3
+            iniset $GLANCE_SWIFT_STORE_CONF ref1 auth_version 3
         fi
-        iniset $GLANCE_API_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
-
-        iniset $GLANCE_SWIFT_STORE_CONF ref1 user $SERVICE_PROJECT_NAME:glance-swift
-
-        iniset $GLANCE_SWIFT_STORE_CONF ref1 key $SERVICE_PASSWORD
-        iniset $GLANCE_SWIFT_STORE_CONF ref1 auth_address $KEYSTONE_SERVICE_URI/v3
-        iniset $GLANCE_SWIFT_STORE_CONF ref1 auth_version 3
     fi
 
     # We need to tell glance what it's public endpoint is so that the version
@@ -342,9 +448,11 @@ function install_glance {
     if use_library_from_git "glance_store"; then
         git_clone_by_name "glance_store"
         setup_dev_lib "glance_store" $(join_extras "${glance_store_extras[@]}")
+        copy_rootwrap ${DEST}/glance_store/etc/glance
     else
         # we still need to pass extras
         pip_install_gr_extras glance-store $(join_extras "${glance_store_extras[@]}")
+        copy_rootwrap $GLANCE_STORE_ROOTWRAP_BASE_DIR
     fi
 
     git_clone $GLANCE_REPO $GLANCE_DIR $GLANCE_BRANCH
diff --git a/stack.sh b/stack.sh
index ba9da638a8..b7ecb643cb 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1222,32 +1222,6 @@ if is_service_enabled swift; then
     start_swift
 fi
 
-# Launch the Glance services
-if is_service_enabled glance; then
-    echo_summary "Starting Glance"
-    start_glance
-fi
-
-
-# Install Images
-# ==============
-
-# Upload an image to Glance.
-#
-# The default image is CirrOS, a small testing image which lets you login as **root**
-# CirrOS has a ``cloud-init`` analog supporting login via keypair and sending
-# scripts as userdata.
-# See https://help.ubuntu.com/community/CloudInit for more on ``cloud-init``
-
-# NOTE(yoctozepto): limited to node hosting the database which is the controller
-if is_service_enabled $DATABASE_BACKENDS && is_service_enabled glance; then
-    echo_summary "Uploading images"
-
-    for image_url in ${IMAGE_URLS//,/ }; do
-        upload_image $image_url
-    done
-fi
-
 # NOTE(lyarwood): By default use a single hardcoded fixed_key across devstack
 # deployments.  This ensures the keys match across nova and cinder across all
 # hosts.
@@ -1315,6 +1289,40 @@ if is_service_enabled cinder; then
     create_volume_types
 fi
 
+# This sleep is required for cinder volume service to become active and
+# publish capabilities to cinder scheduler before creating the image-volume
+if [[ "$USE_CINDER_FOR_GLANCE" == "True" ]]; then
+    sleep 30
+fi
+
+# Launch the Glance services
+# NOTE (abhishekk): We need to start glance api service only after cinder
+# service has started as on glance startup glance-api queries cinder for
+# validating volume_type configured for cinder store of glance.
+if is_service_enabled glance; then
+    echo_summary "Starting Glance"
+    start_glance
+fi
+
+# Install Images
+# ==============
+
+# Upload an image to Glance.
+#
+# The default image is CirrOS, a small testing image which lets you login as **root**
+# CirrOS has a ``cloud-init`` analog supporting login via keypair and sending
+# scripts as userdata.
+# See https://help.ubuntu.com/community/CloudInit for more on ``cloud-init``
+
+# NOTE(yoctozepto): limited to node hosting the database which is the controller
+if is_service_enabled $DATABASE_BACKENDS && is_service_enabled glance; then
+    echo_summary "Uploading images"
+
+    for image_url in ${IMAGE_URLS//,/ }; do
+        upload_image $image_url
+    done
+fi
+
 
 if is_service_enabled horizon; then
     echo_summary "Starting Horizon"

From 4a1186aa90570b9c25782b423c5abe31da0e9033 Mon Sep 17 00:00:00 2001
From: Alexandre Arents <alexandre.arents@corp.ovh.com>
Date: Thu, 17 Sep 2020 12:50:53 +0000
Subject: [PATCH 1794/2409] tempest: Enable shelve_migrate tests with Libvirt

Enable the compute feature for shelve_migrate on all but LXC and
Xen virt_types.

Related-Bug: #1732428
Depends-On: https://review.opendev.org/#/c/696084/
Change-Id: I31cd00c9117607682213cfa0399709e560f4ad0d
---
 lib/tempest | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/tempest b/lib/tempest
index 125749b314..58588b7663 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -569,6 +569,7 @@ function configure_tempest {
             iniset $TEMPEST_CONFIG compute-feature-enabled snapshot False
             iniset $TEMPEST_CONFIG compute-feature-enabled suspend False
         else
+            iniset $TEMPEST_CONFIG compute-feature-enabled shelve_migrate True
             iniset $TEMPEST_CONFIG compute-feature-enabled stable_rescue True
             iniset $TEMPEST_CONFIG compute-feature-enabled swap_volume True
         fi

From fa5742f8e1d95802cf8c623e29fcbc4931903b68 Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Tue, 8 Sep 2020 09:38:14 +0100
Subject: [PATCH 1795/2409] Add Fedora 32 to supported list and use as
 fedora-latest

This includes a workaround to a known dnsmasq >= 2.81 issue that
results in unanswered DHCP requests from instances as documented in the
following Neutron bug:

dnsmasq >= 2.81 not responding to DHCP requests with current q-dhcp configs
https://bugs.launchpad.net/neutron/+bug/1896945

For the time being we will attempt to downgrade to 2.80 to avoid this.

Related-Bug: #1896945
Change-Id: I3a760c43956221424926bd9dad0ebe9b28ae2b52
---
 .zuul.yaml           | 2 +-
 stack.sh             | 2 +-
 tools/fixup_stuff.sh | 7 +++++++
 3 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 9105d7e27c..94410b42e4 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -72,7 +72,7 @@
     name: devstack-single-node-fedora-latest
     nodes:
       - name: controller
-        label: fedora-31
+        label: fedora-32
     groups:
       - name: tempest
         nodes:
diff --git a/stack.sh b/stack.sh
index ba9da638a8..5f9b553536 100755
--- a/stack.sh
+++ b/stack.sh
@@ -221,7 +221,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (bionic|focal|f30|f31|opensuse-15.0|opensuse-15.1|opensuse-tumbleweed|rhel8) ]]; then
+if [[ ! ${DISTRO} =~ (bionic|focal|f30|f31|f32|opensuse-15.0|opensuse-15.1|opensuse-tumbleweed|rhel8) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"
diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index c0e07dd51c..a3bda2b74f 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -143,6 +143,13 @@ function fixup_fedora {
     # overwriting works.  So this hacks around those packages that
     # have been dragged in by some other system dependency
     sudo rm -rf /usr/lib64/python3*/site-packages/PyYAML-*.egg-info
+
+    # NOTE(lyarwood): Workaround a known issue on Fedora with dnsmasq >= 2.81
+    # by downgrading to 2.80 for the time being.
+    # https://bugs.launchpad.net/neutron/+bug/1896945
+    if [[ "$DISTRO" == "f32" ]] && [[ $(rpm --queryformat %{VERSION} -q dnsmasq) != "2.80" ]]; then
+        sudo dnf downgrade dnsmasq-2.80 -y
+    fi
 }
 
 function fixup_suse {

From f966e287396538a563d80827dc7b77438e32eb6c Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Thu, 24 Sep 2020 14:47:39 +0100
Subject: [PATCH 1796/2409] Remove Fedora 30 support

Fedora 30 hit EOL earlier in the year and can be removed from devstack.

https://en.wikipedia.org/wiki/Fedora_version_history#Version_history

Change-Id: I47452700d520a544c93c0c187143ec763f026612
---
 lib/lvm  | 6 ------
 lib/nova | 4 ++--
 stack.sh | 2 +-
 3 files changed, 3 insertions(+), 9 deletions(-)

diff --git a/lib/lvm b/lib/lvm
index 92265f2af2..b826c1bc63 100644
--- a/lib/lvm
+++ b/lib/lvm
@@ -124,12 +124,6 @@ function init_lvm_volume_group {
     local vg=$1
     local size=$2
 
-    # Start the lvmetad on f30 (dropped from f31) or SUSE
-    if [[ $DISTRO =~ f30 ]] || is_suse; then
-        # services is not started by default
-        start_service lvm2-lvmetad
-    fi
-
     # Start the tgtd service on Fedora and SUSE if tgtadm is used
     if  is_fedora || is_suse  && [[ "$CINDER_ISCSI_HELPER" = "tgtadm" ]]; then
         start_service tgtd
diff --git a/lib/nova b/lib/nova
index c1354e79a9..9d7bbd8fca 100644
--- a/lib/nova
+++ b/lib/nova
@@ -293,8 +293,8 @@ function configure_nova {
             fi
         fi
 
-        if is_fedora && [[ $DISTRO =~ f3[0-1] ]]; then
-            # For f30 and f31 use the rebased 2.1.0 version of the package.
+        if is_fedora && [[ $DISTRO =~ f31] ]]; then
+            # For f31 use the rebased 2.1.0 version of the package.
             sudo dnf copr enable -y lyarwood/iscsi-initiator-utils
             sudo dnf update -y
         fi
diff --git a/stack.sh b/stack.sh
index 5f9b553536..139e754a63 100755
--- a/stack.sh
+++ b/stack.sh
@@ -221,7 +221,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (bionic|focal|f30|f31|f32|opensuse-15.0|opensuse-15.1|opensuse-tumbleweed|rhel8) ]]; then
+if [[ ! ${DISTRO} =~ (bionic|focal|f31|f32|opensuse-15.0|opensuse-15.1|opensuse-tumbleweed|rhel8) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From 471f1625bb3ae9b11d9da69404f945a19d8b010a Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Sat, 26 Sep 2020 15:15:42 -0700
Subject: [PATCH 1797/2409] Update opensuse version

Nova has newer qemu requirements which needs opensuse 15.2 to meet. The
infra opensuse 15 images are 15.2 now to accomodate that. Update
opensuse's supported version to match.

Change-Id: I6f3c5234920b185b2b0cd9c358371402f7a7b922
---
 stack.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index 139e754a63..14968386ea 100755
--- a/stack.sh
+++ b/stack.sh
@@ -221,7 +221,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (bionic|focal|f31|f32|opensuse-15.0|opensuse-15.1|opensuse-tumbleweed|rhel8) ]]; then
+if [[ ! ${DISTRO} =~ (bionic|focal|f31|f32|opensuse-15.2|opensuse-tumbleweed|rhel8) ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From 155109df89b07f90c99ce5c6acb32c78b58cf9de Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Fri, 24 Jul 2020 06:49:01 -0700
Subject: [PATCH 1798/2409] Change glance default back to WSGI mode

The situation around glance under WSGI has changed a lot in a week.
We can now run tasks and imports under WSGI, so let's switch the
default back so that glance is consistent (by default) with the
other projects.

Change-Id: I3ae285b2ac4972c0b8abaccfc7c0ede0e1c49bf1
---
 lib/glance | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/glance b/lib/glance
index a848fc7abe..c2a8b7492e 100644
--- a/lib/glance
+++ b/lib/glance
@@ -70,7 +70,7 @@ GLANCE_CACHE_DIR=${GLANCE_CACHE_DIR:=$DATA_DIR/glance/cache}
 if [[ "$WSGI_MODE" != "uwsgi" ]]; then
     GLANCE_STANDALONE=True
 fi
-GLANCE_STANDALONE=${GLANCE_STANDALONE:-True}
+GLANCE_STANDALONE=${GLANCE_STANDALONE:-False}
 
 # File path for each store specified in GLANCE_MULTIPLE_FILE_STORES, the store
 # identifier will be appended to this path at runtime. If GLANCE_MULTIPLE_FILE_STORES

From 29efb7282296c183d5036bc64451a9469a053056 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Wed, 30 Sep 2020 11:06:04 -0500
Subject: [PATCH 1799/2409] Update DEVSTACK_SERIES to wallaby

stable/victoria branch has been created now and
current master is for wallaby.

Change-Id: I5f5b233127d6ef24452fcd05db990f9ddc244dc4
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index bf1ad3d85d..a36f8970e6 100644
--- a/stackrc
+++ b/stackrc
@@ -245,7 +245,7 @@ REQUIREMENTS_DIR=${REQUIREMENTS_DIR:-$DEST/requirements}
 # Setting the variable to 'ALL' will activate the download for all
 # libraries.
 
-DEVSTACK_SERIES="victoria"
+DEVSTACK_SERIES="wallaby"
 
 ##############
 #

From 8e74a617df7d53732c1ef395a97479ce58122731 Mon Sep 17 00:00:00 2001
From: Riccardo Pittau <elfosardo@gmail.com>
Date: Fri, 10 Apr 2020 10:48:15 +0200
Subject: [PATCH 1800/2409] Move supported distros to variable

Improve redability of the distro check using a variable to
store supported distributions.

Change-Id: Iffa1619065358d459bd04523b7eeae9049f8f2f0
---
 stack.sh | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index 3b2a331dea..bb4dfa2561 100755
--- a/stack.sh
+++ b/stack.sh
@@ -221,7 +221,9 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-if [[ ! ${DISTRO} =~ (bionic|focal|f31|f32|opensuse-15.2|opensuse-tumbleweed|rhel8) ]]; then
+SUPPORTED_DISTROS="bionic|focal|f31|f32|opensuse-15.2|opensuse-tumbleweed|rhel8"
+
+if [[ ! ${DISTRO} =~ $SUPPORTED_DISTROS ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
     if [[ "$FORCE" != "yes" ]]; then
         die $LINENO "If you wish to run this script anyway run with FORCE=yes"

From 3ebb95f9b5e82256e66fcedb23f8f0740349c898 Mon Sep 17 00:00:00 2001
From: Dan Radez <dradez@redhat.com>
Date: Fri, 2 Oct 2020 09:46:31 -0400
Subject: [PATCH 1801/2409] Removing fixup for f32 + dnsmasq 2.81

workaround reported https://bugs.launchpad.net/neutron/+bug/1896945
fixed by https://review.opendev.org/#/c/755356/

Change-Id: I86a0be548e344ed4e95eab7212ba432bf570d2ae
---
 tools/fixup_stuff.sh | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index a3bda2b74f..c0e07dd51c 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -143,13 +143,6 @@ function fixup_fedora {
     # overwriting works.  So this hacks around those packages that
     # have been dragged in by some other system dependency
     sudo rm -rf /usr/lib64/python3*/site-packages/PyYAML-*.egg-info
-
-    # NOTE(lyarwood): Workaround a known issue on Fedora with dnsmasq >= 2.81
-    # by downgrading to 2.80 for the time being.
-    # https://bugs.launchpad.net/neutron/+bug/1896945
-    if [[ "$DISTRO" == "f32" ]] && [[ $(rpm --queryformat %{VERSION} -q dnsmasq) != "2.80" ]]; then
-        sudo dnf downgrade dnsmasq-2.80 -y
-    fi
 }
 
 function fixup_suse {

From 906d824a1985332949090583fdc3f4a5ce30125a Mon Sep 17 00:00:00 2001
From: Luigi Toscano <ltoscano@redhat.com>
Date: Sun, 11 Oct 2020 21:59:07 +0200
Subject: [PATCH 1802/2409] Fix: do not lose the tox_environment value in func
 tests

The current code always overrides tox_environment when running
functional tests, but the correct behavior is to add
the discovered environment variables to tox_environments,
while keeping the user-specified value for it.

The current behavior breaks the devstack-tox-functional children
jobs, like openstacksdk-functional-devstack-ironic, which set
tox_environment.

Change-Id: I5dc9054a1495ca0ef7745c08316441ab153956f4
---
 playbooks/tox/run-both.yaml                          | 3 +--
 playbooks/tox/run.yaml                               | 3 +--
 roles/get-devstack-os-environment/defaults/main.yaml | 1 +
 roles/get-devstack-os-environment/tasks/main.yaml    | 4 ++--
 4 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/playbooks/tox/run-both.yaml b/playbooks/tox/run-both.yaml
index 0528b46f00..e4043d8231 100644
--- a/playbooks/tox/run-both.yaml
+++ b/playbooks/tox/run-both.yaml
@@ -8,5 +8,4 @@
     - test-setup
     - ensure-tox
     - get-devstack-os-environment
-    - role: tox
-      tox_environment: "{{ os_env_vars|default({}) }}"
+    - tox
diff --git a/playbooks/tox/run.yaml b/playbooks/tox/run.yaml
index 6e549d3655..0d065c6ca2 100644
--- a/playbooks/tox/run.yaml
+++ b/playbooks/tox/run.yaml
@@ -1,5 +1,4 @@
 - hosts: all
   roles:
     - get-devstack-os-environment
-    - role: tox
-      tox_environment: "{{ os_env_vars|default({}) }}"
+    - tox
diff --git a/roles/get-devstack-os-environment/defaults/main.yaml b/roles/get-devstack-os-environment/defaults/main.yaml
index 73ecfe920c..f68ea560d0 100644
--- a/roles/get-devstack-os-environment/defaults/main.yaml
+++ b/roles/get-devstack-os-environment/defaults/main.yaml
@@ -3,3 +3,4 @@ openrc_file: "{{ devstack_base_dir }}/devstack/openrc"
 openrc_user: admin
 openrc_project: admin
 openrc_enable_export: false
+tox_environment: {}
diff --git a/roles/get-devstack-os-environment/tasks/main.yaml b/roles/get-devstack-os-environment/tasks/main.yaml
index 8c8df7f96d..b2c5e93ed4 100644
--- a/roles/get-devstack-os-environment/tasks/main.yaml
+++ b/roles/get-devstack-os-environment/tasks/main.yaml
@@ -9,6 +9,6 @@
         executable: "/bin/bash"
       register: env_os
 
-    - name: Save the OS_ environment variables as a fact
+    - name: Append the the OS_ environment variables to tox_environment
       set_fact:
-        os_env_vars: "{{ env_os.stdout|from_yaml }}"
+        tox_environment: "{{ env_os.stdout|from_yaml|default({})|combine(tox_environment) }}"

From 0545b48f3b14f2951033b5e09db3190a95cf3527 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Tue, 13 Oct 2020 16:06:44 +0200
Subject: [PATCH 1803/2409] Add IPv6 route information to worlddump

The "ip route" command only outputs IPv4 routes, add a command to also
show IPv6 route information.

Drop output from "ip link" as that information is contained within the
"ip addr" output already.

Change-Id: Iae87f43c4b1c57f07de041e823da9d350c670389
---
 tools/worlddump.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/worlddump.py b/tools/worlddump.py
index 6a618f5ee6..5a264d2508 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -165,7 +165,7 @@ def network_dump():
 
     _dump_cmd("bridge link")
     _dump_cmd("ip link show type bridge")
-    ip_cmds = ["neigh", "addr", "link", "route"]
+    ip_cmds = ["neigh", "addr", "route", "route -6"]
     for cmd in ip_cmds + ['netns']:
         _dump_cmd("ip %s" % cmd)
     for netns_ in _netns_list():

From b107f9cf18c8112cce3f796995f3a5691be56259 Mon Sep 17 00:00:00 2001
From: "Walter A. Boring IV" <waboring@hemna.com>
Date: Mon, 1 Jul 2019 16:19:12 -0700
Subject: [PATCH 1804/2409] Add support for ceph_iscsi cinder driver

This patch adds support to configure the new ceph iscsi driver

Depends-On: https://review.opendev.org/#/c/662829/
Depends-On:https://review.opendev.org/668667
Change-Id: Ica180e00dedb8e7ed60e27e3f4841faa8fef938c
---
 lib/cinder_backends/ceph_iscsi | 56 ++++++++++++++++++++++++++++++++++
 1 file changed, 56 insertions(+)
 create mode 100644 lib/cinder_backends/ceph_iscsi

diff --git a/lib/cinder_backends/ceph_iscsi b/lib/cinder_backends/ceph_iscsi
new file mode 100644
index 0000000000..94412e0da6
--- /dev/null
+++ b/lib/cinder_backends/ceph_iscsi
@@ -0,0 +1,56 @@
+#!/bin/bash
+#
+# lib/cinder_backends/ceph_iscsi
+# Configure the ceph_iscsi backend
+
+# Enable with:
+#
+#   CINDER_ENABLED_BACKENDS+=,ceph_iscsi:ceph_iscsi
+#
+# Optional paramteters:
+#   CEPH_ISCSI_API_URL=<url to the rbd-target-api service>
+#
+# Dependencies:
+#
+# - ``functions`` file
+# - ``cinder`` configurations
+
+# configure_ceph_backend_ceph_iscsi - called from configure_cinder()
+
+
+# Save trace setting
+_XTRACE_CINDER_CEPH_ISCSI=$(set +o | grep xtrace)
+set +o xtrace
+
+# Entry Points
+# ------------
+
+# configure_cinder_backend_ceph_iscsi - Set config files, create data dirs, etc
+# configure_cinder_backend_ceph_iscsi $name
+function configure_cinder_backend_ceph_iscsi {
+    local be_name=$1
+
+    CEPH_ISCSI_API_URL=${CEPH_ISCSI_API_URL:-http://$CEPH_ISCSI_API_HOST:$CEPH_ISCSI_API_PORT}
+
+    iniset $CINDER_CONF $be_name volume_backend_name $be_name
+    iniset $CINDER_CONF $be_name volume_driver "cinder.volume.drivers.ceph.rbd_iscsi.RBDISCSIDriver"
+    iniset $CINDER_CONF $be_name rbd_ceph_conf "$CEPH_CONF_FILE"
+    iniset $CINDER_CONF $be_name rbd_pool "$CINDER_CEPH_POOL"
+    iniset $CINDER_CONF $be_name rbd_user "$CINDER_CEPH_USER"
+    iniset $CINDER_CONF $be_name rbd_iscsi_api_user "$CEPH_ISCSI_API_USER"
+    iniset $CINDER_CONF $be_name rbd_iscsi_api_password "$CEPH_ISCSI_API_PASSWORD"
+    iniset $CINDER_CONF $be_name rbd_iscsi_api_url "$CEPH_ISCSI_API_URL"
+    iniset $CINDER_CONF $be_name rbd_iscsi_target_iqn "$CEPH_ISCSI_TARGET_IQN"
+    iniset $CINDER_CONF $be_name rbd_flatten_volume_from_snapshot False
+    iniset $CINDER_CONF $be_name rbd_max_clone_depth 5
+    iniset $CINDER_CONF DEFAULT glance_api_version 2
+
+    pip_install rbd-iscsi-client
+}
+
+# Restore xtrace
+$_XTRACE_CINDER_CEPH_ISCSI
+
+# Local variables:
+# mode: shell-script
+# End:

From 7de6e0b2eca9ac661a92badef4488d8d6380b06f Mon Sep 17 00:00:00 2001
From: Sean Mooney <work@seanmooney.info>
Date: Wed, 21 Oct 2020 13:59:50 +0100
Subject: [PATCH 1805/2409] fix ipv6 flag order in worlddump

this change corrects the flag order from 'route -6'
to '-6 route' as the -6 flag is an option when used with
ip is an argument to the the ip command and not the route
subcommand.

-6 is accpeted as an argument to the standalone 'route'
commannd but not 'ip route' subcommand.

Change-Id: Ic2ae472e42b7b455693d0aade48dc5109e1f21ba
---
 tools/worlddump.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/worlddump.py b/tools/worlddump.py
index 5a264d2508..22770f15b6 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -165,7 +165,7 @@ def network_dump():
 
     _dump_cmd("bridge link")
     _dump_cmd("ip link show type bridge")
-    ip_cmds = ["neigh", "addr", "route", "route -6"]
+    ip_cmds = ["neigh", "addr", "route", "-6 route"]
     for cmd in ip_cmds + ['netns']:
         _dump_cmd("ip %s" % cmd)
     for netns_ in _netns_list():

From 6ecfe67d8e8166a3dc42332ba8d1615be6a14a68 Mon Sep 17 00:00:00 2001
From: Lucas Alvares Gomes <lucasagomes@gmail.com>
Date: Wed, 23 Sep 2020 11:54:19 +0100
Subject: [PATCH 1806/2409] Configure os-vif ovsdb_connection

This patch set the os-vif "ovsdb_connection" configuration option so it
can connect to the local OVSDB. By default, this option points to
tcp:127.0.0.1:6640 and would fail if SERVICE_IP_VERSION == 6.

Also, if SERVICE_IP_VERSION is an IPv6 address, it should be wraped with
square brackets for it to work.

Change-Id: Ie6eec4e140c7464936cf0b0c6307026a94c9f4ee
Signed-off-by: Lucas Alvares Gomes <lucasagomes@gmail.com>
---
 lib/neutron_plugins/ovn_agent | 5 ++++-
 lib/nova                      | 5 +++++
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index 84df9181ea..b7330db9db 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -91,7 +91,10 @@ OVN_DBS_LOG_LEVEL=${OVN_DBS_LOG_LEVEL:-info}
 OVN_META_CONF=$NEUTRON_CONF_DIR/neutron_ovn_metadata_agent.ini
 OVN_META_DATA_HOST=${OVN_META_DATA_HOST:-$(ipv6_unquote $SERVICE_HOST)}
 
-OVSDB_SERVER_LOCAL_HOST=$SERVICE_LOCAL_HOST
+export OVSDB_SERVER_LOCAL_HOST=$SERVICE_LOCAL_HOST
+if [[ "$SERVICE_IP_VERSION" == 6 ]]; then
+    OVSDB_SERVER_LOCAL_HOST=[$OVSDB_SERVER_LOCAL_HOST]
+fi
 
 OVN_IGMP_SNOOPING_ENABLE=$(trueorfalse False OVN_IGMP_SNOOPING_ENABLE)
 
diff --git a/lib/nova b/lib/nova
index 9d7bbd8fca..d7426039c4 100644
--- a/lib/nova
+++ b/lib/nova
@@ -906,6 +906,11 @@ function start_nova_compute {
     # by the compute process.
     configure_console_compute
 
+    # Configure the OVSDB connection for os-vif
+    if [ -n "$OVSDB_SERVER_LOCAL_HOST" ]; then
+        iniset $NOVA_CPU_CONF os_vif_ovs ovsdb_connection "tcp:$OVSDB_SERVER_LOCAL_HOST:6640"
+    fi
+
     if [[ "$VIRT_DRIVER" = 'libvirt' ]]; then
         # The group **$LIBVIRT_GROUP** is added to the current user in this script.
         # ``sg`` is used in run_process to execute nova-compute as a member of the

From 3f28c272d0a3ae78329c81227a66c703d6a489d7 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Wed, 28 Oct 2020 13:05:14 +0000
Subject: [PATCH 1807/2409] Remove deprecated tail_log function

This function has been deprecated for a long time, let's finally
remove it. It is only generating a warning anyway.

Change-Id: I7bd440adf2ce8283e3ad3d5d09e6b2b877e2b42e
---
 functions-common | 4 ----
 lib/placement    | 1 -
 lib/tls          | 8 --------
 3 files changed, 13 deletions(-)

diff --git a/functions-common b/functions-common
index 547f6df038..13749214ba 100644
--- a/functions-common
+++ b/functions-common
@@ -1609,10 +1609,6 @@ function service_check {
 }
 
 
-function tail_log {
-    deprecated "With the removal of screen support, tail_log is deprecated and will be removed after Queens"
-}
-
 # Plugin Functions
 # =================
 
diff --git a/lib/placement b/lib/placement
index 2a449bfa90..b7798669a1 100644
--- a/lib/placement
+++ b/lib/placement
@@ -148,7 +148,6 @@ function start_placement_api {
     else
         enable_apache_site placement-api
         restart_apache_server
-        tail_log placement-api /var/log/$APACHE_NAME/placement-api.log
     fi
 
     echo "Waiting for placement-api to start..."
diff --git a/lib/tls b/lib/tls
index 861496d092..b3cc0b4159 100644
--- a/lib/tls
+++ b/lib/tls
@@ -570,14 +570,6 @@ EOF
     restart_apache_server
 }
 
-# Follow TLS proxy
-function follow_tls_proxy {
-    sudo touch /var/log/$APACHE_NAME/tls-proxy_error.log
-    tail_log tls-error /var/log/$APACHE_NAME/tls-proxy_error.log
-    sudo touch /var/log/$APACHE_NAME/tls-proxy_access.log
-    tail_log tls-proxy /var/log/$APACHE_NAME/tls-proxy_access.log
-}
-
 # Cleanup Functions
 # =================
 

From 47f76acbbac350ea18df6a9463876d38c3a13539 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Thu, 29 Oct 2020 10:42:38 +0000
Subject: [PATCH 1808/2409] Determine default IPv4 route device only when
 needed

Sometimes instances don't have an IPv4 default route, so only check for
it when we actually need it. In a followup patch we could extend the
code to check for an IPv6 default route instead or in addition.

Related-Bug: 1902002
Change-Id: Ie6cd241721f6b1f8e030960921a696939b2dab10
---
 lib/neutron-legacy | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 2906f15736..436b0e3364 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -226,15 +226,17 @@ PHYSICAL_NETWORK=${PHYSICAL_NETWORK:-public}
 # Example: ``OVS_PHYSICAL_BRIDGE=br-eth1``
 OVS_PHYSICAL_BRIDGE=${OVS_PHYSICAL_BRIDGE:-br-ex}
 
-default_route_dev=$(ip route | grep ^default | awk '{print $5}')
-die_if_not_set $LINENO default_route_dev "Failure retrieving default route device"
 # With the linuxbridge agent, if using VLANs for tenant networks,
 # or if using flat or VLAN provider networks, set in ``localrc`` to
 # the name of the network interface to use for the physical
 # network.
 #
 # Example: ``LB_PHYSICAL_INTERFACE=eth1``
-LB_PHYSICAL_INTERFACE=${LB_PHYSICAL_INTERFACE:-$default_route_dev}
+if [[ $Q_AGENT == "linuxbridge" && -z ${LB_PHYSICAL_INTERFACE} ]]; then
+    default_route_dev=$(ip route | grep ^default | awk '{print $5}')
+    die_if_not_set $LINENO default_route_dev "Failure retrieving default route device"
+    LB_PHYSICAL_INTERFACE=$default_route_dev
+fi
 
 # When Neutron tunnels are enabled it is needed to specify the
 # IP address of the end point in the local server. This IP is set

From 2bb62b43bf8b3d95e199b111d8f6de01890c0536 Mon Sep 17 00:00:00 2001
From: Brian Haley <bhaley@redhat.com>
Date: Fri, 6 Nov 2020 17:34:53 -0500
Subject: [PATCH 1809/2409] Decrease MTU to account for IPv6 header

(MTU - 50) only supports VxLAN over IPv4, decrease it
to support IPv6 as well, which is 20 bytes larger.

Change-Id: I0cf258770f628c1b4fb590bd274b5433fbcc1450
---
 playbooks/pre.yaml | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/playbooks/pre.yaml b/playbooks/pre.yaml
index ff97a1f501..68cb1d8c7a 100644
--- a/playbooks/pre.yaml
+++ b/playbooks/pre.yaml
@@ -19,12 +19,13 @@
           {% endfor -%}
           {{- mtus|min -}}
     - name: Calculate external_bridge_mtu
-      # 50 bytes is overhead for vxlan (which is greater than GRE
+      # 30 bytes is overhead for vxlan (which is greater than GRE
       # allowing us to use either overlay option with this MTU.
+      # 40 bytes is overhead for IPv6, which will also support an IPv4 overlay.
       # TODO(andreaf) This should work, but it may have to be reconcilied with
       # the MTU setting used by the multinode setup roles in multinode pre.yaml
       set_fact:
-        external_bridge_mtu: "{{ local_mtu | int - 50 }}"
+        external_bridge_mtu: "{{ local_mtu | int - 30 - 40 }}"
   roles:
     - configure-swap
     - setup-stack-user

From efc04eec00bef94059a0e5b6f457263fc84876c1 Mon Sep 17 00:00:00 2001
From: Nate Johnston <nate.johnston@redhat.com>
Date: Tue, 3 Nov 2020 10:04:26 -0500
Subject: [PATCH 1810/2409] Look for ipv6 routes so ipv6-only jobs will not
 fail

For change 739139 [1] PS 12, the
neutron-tempest-plugin-scenario-linuxbridge died in devstack with
"/opt/stack/devstack/functions-common:237 Failure retrieving default
route device", which comes from
"/opt/stack/devstack/lib/neutron-legacy:237:die_if_not_set".

Looking at the worlddump.txt for that job [2] I see that there is a
default ipv6 route; the vm was not configured with ipv4 networking.

    ip route
    --------

    ip -6 route
    -----------

    ::1 dev lo proto kernel metric 256 pref medium
    2607:ff68:100:54::/64 dev ens3 proto kernel metric 256 expires 86380sec pref medium
    fe80::/64 dev ens3 proto kernel metric 256 pref medium
    default via fe80::f816:3eff:fe77:b05c dev ens3 proto ra metric 1024 expires 280sec hoplimit 64 pref medium

Looking at the devstack code that throws the error [3] it looks like
it only looks for a default route in the output of `ip route`, which
does not include ipv6 information.  This change should look in both
the ipv4 and ipv6 route table.  A similar check in the L3 setup code
is also updated.

[1] https://review.opendev.org/#/c/739139/
[2] https://d4eb7e3efe98cba79a4b-f4d168cdb20f40841821e4b213645c0f.ssl.cf2.rackcdn.com/739139/12/gate/neutron-tempest-plugin-scenario-linuxbridge/9a6b4f7/controller/logs/worlddump-latest.txt
[3] https://opendev.org/openstack/devstack/src/branch/master/lib/neutron-legacy#L236

Closes-Bug: #1902002
Change-Id: I839e8c222368df98fec308cf41248a9dd0a8c187
---
 lib/neutron-legacy              | 2 +-
 lib/neutron_plugins/services/l3 | 1 -
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 436b0e3364..791ff18b10 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -233,7 +233,7 @@ OVS_PHYSICAL_BRIDGE=${OVS_PHYSICAL_BRIDGE:-br-ex}
 #
 # Example: ``LB_PHYSICAL_INTERFACE=eth1``
 if [[ $Q_AGENT == "linuxbridge" && -z ${LB_PHYSICAL_INTERFACE} ]]; then
-    default_route_dev=$(ip route | grep ^default | awk '{print $5}')
+    default_route_dev=$( (ip route; ip -6 route) | grep ^default | head -n 1 | awk '{print $5}')
     die_if_not_set $LINENO default_route_dev "Failure retrieving default route device"
     LB_PHYSICAL_INTERFACE=$default_route_dev
 fi
diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 69536bbe58..75a3567096 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -101,7 +101,6 @@ SUBNETPOOL_SIZE_V4=${SUBNETPOOL_SIZE_V4:-26}
 SUBNETPOOL_SIZE_V6=${SUBNETPOOL_SIZE_V6:-64}
 
 default_v4_route_devs=$(ip -4 route | grep ^default | awk '{print $5}')
-die_if_not_set $LINENO default_v4_route_devs "Failure retrieving default IPv4 route devices"
 
 default_v6_route_devs=$(ip -6 route list match default table all | grep via | awk '{print $5}')
 

From 6766f71d62af10f8b59b5f829a49752775e9dabe Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Fri, 24 Jul 2020 15:44:34 -0700
Subject: [PATCH 1811/2409] Make create_disk() persistent

Right now a system configured with the ceph plugin will not survive
a reboot because the backing disk we create and mount isn't mounted
at startup, preventing ceph from starting and the rest of nova/glance
from working.

This makes create_disk() idempotently write an fstab rule for the
disk we make, and adds a destroy_disk() handler for cleanup.

Change-Id: I50cd4234f51a335af25be756bd2459dca5aa343c
---
 clean.sh  |  2 ++
 functions | 34 +++++++++++++++++++++++++++++-----
 2 files changed, 31 insertions(+), 5 deletions(-)

diff --git a/clean.sh b/clean.sh
index cb0a8b4bef..4cebf1d9ea 100755
--- a/clean.sh
+++ b/clean.sh
@@ -145,3 +145,5 @@ done
 
 rm -rf ~/.config/openstack
 
+# Clear any fstab entries made
+sudo sed -i '/.*comment=devstack-.*/ d' /etc/fstab
diff --git a/functions b/functions
index cc1ca6cb25..e679b0f9bc 100644
--- a/functions
+++ b/functions
@@ -751,12 +751,13 @@ if ! function_exists echo_nolog; then
 fi
 
 
-# create_disk - Create backing disk
+# create_disk - Create, configure, and mount a backing disk
 function create_disk {
     local node_number
     local disk_image=${1}
     local storage_data_dir=${2}
     local loopback_disk_size=${3}
+    local key
 
     # Create a loopback disk and format it to XFS.
     if [[ -e ${disk_image} ]]; then
@@ -777,11 +778,34 @@ function create_disk {
     # Swift and Ceph.
     sudo mkfs.xfs -f -i size=1024 ${disk_image}
 
-    # Mount the disk with mount options to make it as efficient as possible
-    if ! egrep -q ${storage_data_dir} /proc/mounts; then
-        sudo mount -t xfs -o loop,noatime,nodiratime,logbufs=8  \
-            ${disk_image} ${storage_data_dir}
+    # Unmount the target, if mounted
+    if egrep -q $storage_data_dir /proc/mounts; then
+        sudo umount $storage_data_dir
     fi
+
+    # Clear any old fstab rules, install a new one for this disk, and mount it
+    key=$(echo $disk_image | sed 's#/.##')
+    key="devstack-$key"
+    sudo sed -i '/.*comment=$key.*/ d' /etc/fstab
+    echo "$disk_image $storage_data_dir xfs loop,noatime,nodiratime,logbufs=8,comment=$key 0 0" | sudo tee -a /etc/fstab
+    sudo mount -v $storage_data_dir
+}
+
+# Unmount, de-configure, and destroy a backing disk
+function destroy_disk {
+    local disk_image=$1
+    local storage_data_dir=$2
+
+    # Unmount the target, if mounted
+    if egrep -q $storage_data_dir /proc/mounts; then
+        sudo umount $storage_data_dir
+    fi
+
+    # Clear any fstab rules
+    sed -i '/.*comment=$key.*/ d' /etc/fstab
+
+    # Delete the file
+    sudo rm $disk_image
 }
 
 

From d7d87b0202212e21727f6ced4a1eaa38a66808dd Mon Sep 17 00:00:00 2001
From: Weronika Sikora <weronika.sikora@corp.ovh.com>
Date: Wed, 18 Sep 2019 13:45:53 +0000
Subject: [PATCH 1812/2409] Set image_alt_ssh_user during stack

At this moment, only image_ssh_user is present in the config
of Tempest. It's set to cirros by default and used for
SSH connections in tests. However, several tests build
instances with image_ref_alt, but still use image_ssh_user to
connect, which results in failure if image_ref_alt is set to
a non-cirros image. They should use image_alt_ssh_user instead,
which can be set to whichever user the image_ref_alt needs in
either local.conf or during plugin installation.

Change-Id: I899909fb71a9862c891e94ba54c6a8fa137f9769
Partial-Bug: #1844535
---
 lib/tempest | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index 9f2ec30cb9..c55531b72e 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -27,6 +27,7 @@
 # - ``USE_BLOCK_MIGRATION_FOR_LIVE_MIGRATION``
 # - ``DEFAULT_INSTANCE_TYPE``
 # - ``DEFAULT_INSTANCE_USER``
+# - ``DEFAULT_INSTANCE_ALT_USER``
 # - ``CINDER_ENABLED_BACKENDS``
 # - ``NOVA_ALLOW_DUPLICATE_NETWORKS``
 #
@@ -443,7 +444,8 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG validation run_validation ${TEMPEST_RUN_VALIDATION:-True}
     iniset $TEMPEST_CONFIG validation ip_version_for_ssh 4
     iniset $TEMPEST_CONFIG validation ssh_timeout $BUILD_TIMEOUT
-    iniset $TEMPEST_CONFIG validation image_ssh_user ${DEFAULT_INSTANCE_USER:-cirros}
+    iniset $TEMPEST_CONFIG validation image_ssh_user ${DEFAULT_INSTANCE_USER:=cirros}
+    iniset $TEMPEST_CONFIG validation image_alt_ssh_user ${DEFAULT_INSTANCE_ALT_USER:-$DEFAULT_INSTANCE_USER}
     iniset $TEMPEST_CONFIG validation network_for_ssh $TEMPEST_SSH_NETWORK_NAME
 
     # Volume

From 6c03a85d8bebffb17ec923d9f94a499dd8c4854b Mon Sep 17 00:00:00 2001
From: Sean Mooney <work@seanmooney.info>
Date: Tue, 10 Nov 2020 14:10:11 +0000
Subject: [PATCH 1813/2409] enable ussuri cloud archive on ubuntu bionic

This change updates bionic installs to use the
ussuri cloud archive to enable the use of libvirt 6.0.0.
This is required to prevent a libvirt bug that causes intermittent
failures for the tempest test_live_block_migration_paused testcase.

Change-Id: I9c395c2b5fdfe6ad9a43477280e88e9a9b34f057
Related-Bug: 1901739
---
 tools/fixup_stuff.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index c0e07dd51c..cd7ee59c1d 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -77,10 +77,10 @@ function fixup_ubuntu {
         # If we are on a nodepool provided host and it has told us about
         # where we can find local mirrors then use that mirror.
         source /etc/ci/mirror_info.sh
-        sudo apt-add-repository -y "deb $NODEPOOL_UCA_MIRROR bionic-updates/train main"
+        sudo apt-add-repository -y "deb $NODEPOOL_UCA_MIRROR bionic-updates/ussuri main"
     else
-        # Enable UCA:train for updated versions of QEMU and libvirt
-        sudo add-apt-repository -y cloud-archive:train
+        # Enable UCA:ussuri for updated versions of QEMU and libvirt
+        sudo add-apt-repository -y cloud-archive:ussuri
     fi
     REPOS_UPDATED=False
     apt_get_update

From 7a5fda83264575aebe52b62e27aae1a0398be4da Mon Sep 17 00:00:00 2001
From: Victoria Martinez de la Cruz <victoria@redhat.com>
Date: Fri, 13 Nov 2020 12:56:00 -0300
Subject: [PATCH 1814/2409] [CI] Copy /etc/ceph output to logs

Change-Id: I91317c7d4972f07f741cdde2f406e290bb65467b
---
 .zuul.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index d387b0dd50..ec827c289c 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -340,6 +340,7 @@
         '{{ stage_dir }}/listen53.txt': logs
         '{{ stage_dir }}/deprecations.log': logs
         '{{ stage_dir }}/audit.log': logs
+        /etc/ceph: logs
         /var/log/ceph: logs
         /var/log/openvswitch: logs
         /var/log/glusterfs: logs

From cdc2e9f656089217d28d0fff8d614dc84b755e2c Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Thu, 19 Nov 2020 09:17:37 +0000
Subject: [PATCH 1815/2409] zuul: Remove nova-live-migration from check queue

As documented in the associated TODO this job can be removed now that it
has been migrated to zuulv3 by Ib342e2d3c395830b4667a60de7e492d3b9de2f0a.

Change-Id: Id7c0fd8eec09386cd638956a46c1f75844194b9d
---
 .zuul.yaml | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index e71ac8d8c3..c1406716fe 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -737,15 +737,6 @@
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
-        # NOTE(gmann): Remove this job from devstack pipeline once it is
-        # migrated to zuulv3 native. This is legacy job and rely on
-        # devstack-gate + devstack setting so any change in devstack can
-        # break it.
-        - nova-live-migration:
-            voting: false
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
     gate:
       jobs:
         - devstack

From 7a3a7ce876a37376fe0dca7278e41a4f46867daa Mon Sep 17 00:00:00 2001
From: Elod Illes <elod.illes@est.tech>
Date: Mon, 30 Nov 2020 18:30:02 +0100
Subject: [PATCH 1816/2409] Workaround for new pip 20.3 behavior

This patch caps pip version during bootstrap to avoid the issue:

"ERROR: Links are not allowed as constraints"

A proper fix would be to adapt to new pip behavior.

Depends-On: https://review.opendev.org/764811
Change-Id: I1feed4573820436f91f8f654cc189fa3a21956fd
---
 tools/cap-pip.txt    | 1 +
 tools/install_pip.sh | 4 +++-
 2 files changed, 4 insertions(+), 1 deletion(-)
 create mode 100644 tools/cap-pip.txt

diff --git a/tools/cap-pip.txt b/tools/cap-pip.txt
new file mode 100644
index 0000000000..8ee551b261
--- /dev/null
+++ b/tools/cap-pip.txt
@@ -0,0 +1 @@
+pip<20.3
diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index f3fd1e2498..9afd2e53c2 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -91,7 +91,9 @@ function install_get_pip {
             die $LINENO "Download of get-pip.py failed"
         touch $LOCAL_PIP.downloaded
     fi
-    sudo -H -E python${PYTHON3_VERSION} $LOCAL_PIP
+    # TODO: remove the trailing pip constraint when a proper fix
+    # arrives for bug https://bugs.launchpad.net/devstack/+bug/1906322
+    sudo -H -E python${PYTHON3_VERSION} $LOCAL_PIP -c $TOOLS_DIR/cap-pip.txt
 }
 
 

From e7c017bd8998d9cc8c4712efe992239c73f340d1 Mon Sep 17 00:00:00 2001
From: Sean Mooney <work@seanmooney.info>
Date: Wed, 9 Dec 2020 23:53:12 +0000
Subject: [PATCH 1817/2409] fix is_fedora for centos 8 stream

When deploying on the centos 8 stream variant
the output of "lsb_release -i -s" is
CentOSStream instead of CentOS

This breaks the is_fedora function in devstack
preventing package installation and removal.

Change-Id: I39ccefbd06f46adf5077f8d8001f37d3b190f040
---
 functions-common | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/functions-common b/functions-common
index 13749214ba..87d8c64804 100644
--- a/functions-common
+++ b/functions-common
@@ -452,8 +452,8 @@ function is_fedora {
     [ "$os_VENDOR" = "Fedora" ] || [ "$os_VENDOR" = "Red Hat" ] || \
         [ "$os_VENDOR" = "RedHatEnterpriseServer" ] || \
         [ "$os_VENDOR" = "RedHatEnterprise" ] || \
-        [ "$os_VENDOR" = "CentOS" ] || [ "$os_VENDOR" = "OracleServer" ] || \
-        [ "$os_VENDOR" = "Virtuozzo" ]
+        [ "$os_VENDOR" = "CentOS" ] || [ "$os_VENDOR" = "CentOSStream" ] || \
+        [ "$os_VENDOR" = "OracleServer" ] || [ "$os_VENDOR" = "Virtuozzo" ]
 }
 
 

From 89acae97791a4f23a8b7e9550450cb4a3b986b01 Mon Sep 17 00:00:00 2001
From: Masayuki Igawa <masayuki@igawa.io>
Date: Wed, 16 Dec 2020 09:12:40 +0900
Subject: [PATCH 1818/2409] Use python3-guestfs in Ubuntu

This commit makes to use python3-guestfs instead of python-guestfs in
Ubuntu because python-guestfs package is not provided in focal[1][2].
This causes errors in some gate job if `ENABLE_FILE_INJECTION` is true
like the following.

```
...
Package python-guestfs is not available, but is referred to by another package.
This may mean that the package is missing, has been obsoleted, or
is only available from another source
However the following packages replace it:
  python3-guestfs

E: Package 'python-guestfs' has no installation candidate
...
```
http://paste.openstack.org/show/801073/

[1] https://packages.ubuntu.com/search?lang=en&keywords=python3-guestfs
[2] https://packages.ubuntu.com/search?lang=en&suite=default&arch=any&searchon=names&keywords=python-guestfs

Change-Id: Iffe60aa0351b732d543927afa1f1e846ba2a89fd
---
 lib/nova_plugins/hypervisor-libvirt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova_plugins/hypervisor-libvirt b/lib/nova_plugins/hypervisor-libvirt
index b25bc0c367..321775d324 100644
--- a/lib/nova_plugins/hypervisor-libvirt
+++ b/lib/nova_plugins/hypervisor-libvirt
@@ -100,7 +100,7 @@ function install_nova_hypervisor {
 
     if [[ "$ENABLE_FILE_INJECTION" == "True" ]] ; then
         if is_ubuntu; then
-            install_package python-guestfs
+            install_package python3-guestfs
             # NOTE(andreaf) Ubuntu kernel can only be read by root, which breaks libguestfs:
             # https://bugs.launchpad.net/ubuntu/+source/linux/+bug/759725)
             INSTALLED_KERNELS="$(ls /boot/vmlinuz-*)"

From e651d9ef8840bb7dd497b557125ce1cd5290993d Mon Sep 17 00:00:00 2001
From: Lucas Alvares Gomes <lucasagomes@gmail.com>
Date: Thu, 19 Nov 2020 14:50:01 +0000
Subject: [PATCH 1819/2409] [OVN] Use OVN from packages

This patch changes the OVN module from DevStack to allow for using the
OSapackaged version of OVN instead of compiling it from source.

A new variable called OVN_BUILD_FROM_SOURCE has been introduced and when
set to False (the default value) OVN will then use the packaged version
for setting up DevStack.

Note, in the stop_ovn() function, the OVN metadata agent service name
was wrong and the service wasn't being stopped as part of ./unstack.sh.
This patch also fixed it as well.

Change-Id: Ib41e3b486550200572afd6b3ba783d7644d70d44
Signed-off-by: Lucas Alvares Gomes <lucasagomes@gmail.com>
Co-Authored-By: Slawek Kaplonski <skaplons@redhat.com>
---
 lib/neutron_plugins/ovn_agent | 262 +++++++++++++++++++++-------------
 tools/fixup_stuff.sh          |   8 ++
 2 files changed, 172 insertions(+), 98 deletions(-)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index b7330db9db..b661f593a4 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -72,6 +72,7 @@ OVN_UUID=${OVN_UUID:-}
 # Whether or not to build the openvswitch kernel module from ovs.  This is required
 # unless the distro kernel includes ovs+conntrack support.
 OVN_BUILD_MODULES=$(trueorfalse False OVN_BUILD_MODULES)
+OVN_BUILD_FROM_SOURCE=$(trueorfalse False OVN_BUILD_FROM_SOURCE)
 
 # Whether or not to install the ovs python module from ovs source.  This can be
 # used to test and validate new ovs python features.  This should only be used
@@ -98,7 +99,10 @@ fi
 
 OVN_IGMP_SNOOPING_ENABLE=$(trueorfalse False OVN_IGMP_SNOOPING_ENABLE)
 
-OVS_PREFIX=/usr/local
+OVS_PREFIX=
+if [[ "$OVN_BUILD_FROM_SOURCE" == "True" ]]; then
+    OVS_PREFIX=/usr/local
+fi
 OVS_SBINDIR=$OVS_PREFIX/sbin
 OVS_BINDIR=$OVS_PREFIX/bin
 OVS_RUNDIR=$OVS_PREFIX/var/run/openvswitch
@@ -116,6 +120,24 @@ NEUTRON_OVN_METADATA_BINARY="neutron-ovn-metadata-agent"
 
 STACK_GROUP="$( id --group --name "$STACK_USER" )"
 
+OVN_NORTHD_SERVICE=ovn-northd.service
+if is_ubuntu; then
+    # The ovn-central.service file on Ubuntu is responsible for starting
+    # ovn-northd and the OVN DBs (on CentOS this is done by ovn-northd.service)
+    OVN_NORTHD_SERVICE=ovn-central.service
+fi
+OVSDB_SERVER_SERVICE=ovsdb-server.service
+OVS_VSWITCHD_SERVICE=ovs-vswitchd.service
+OVN_CONTROLLER_SERVICE=ovn-controller.service
+OVN_CONTROLLER_VTEP_SERVICE=ovn-controller-vtep.service
+if [[ "$OVN_BUILD_FROM_SOURCE" == "True" ]]; then
+    OVSDB_SERVER_SERVICE=devstack@ovsdb-server.service
+    OVS_VSWITCHD_SERVICE=devstack@ovs-vswitchd.service
+    OVN_NORTHD_SERVICE=devstack@ovn-northd.service
+    OVN_CONTROLLER_SERVICE=devstack@ovn-controller.service
+    OVN_CONTROLLER_VTEP_SERVICE=devstack@ovn-controller-vtep.service
+fi
+
 # Defaults Overwrite
 # ------------------
 
@@ -131,10 +153,26 @@ ML2_L3_PLUGIN=${ML2_L3_PLUGIN-"ovn-router"}
 # Utility Functions
 # -----------------
 
+function wait_for_sock_file {
+    local count=0
+    while [ ! -S $1 ]; do
+        sleep 1
+        count=$((count+1))
+        if [ "$count" -gt 5 ]; then
+            die $LINENO "Socket $1 not found"
+        fi
+    done
+}
+
 function use_new_ovn_repository {
     if [ -z "$is_new_ovn" ]; then
         local ovs_repo_dir=$DEST/$OVS_REPO_NAME
         if [ ! -d $ovs_repo_dir ]; then
+            git_timed clone $OVS_REPO $ovs_repo_dir
+            pushd $ovs_repo_dir
+            git checkout $OVS_BRANCH
+            popd
+        else
             clone_repository $OVS_REPO $ovs_repo_dir $OVS_BRANCH
         fi
         # Check the split commit exists in the current branch
@@ -153,14 +191,14 @@ function use_new_ovn_repository {
 # neutron-ovs-cleanup uses the OVSDB native interface.
 function ovn_base_setup_bridge {
     local bridge=$1
-    local addbr_cmd="ovs-vsctl --no-wait -- --may-exist add-br $bridge -- set bridge $bridge protocols=OpenFlow13,OpenFlow15"
+    local addbr_cmd="sudo ovs-vsctl --no-wait -- --may-exist add-br $bridge -- set bridge $bridge protocols=OpenFlow13,OpenFlow15"
 
     if [ "$OVS_DATAPATH_TYPE" != "system" ] ; then
         addbr_cmd="$addbr_cmd -- set Bridge $bridge datapath_type=${OVS_DATAPATH_TYPE}"
     fi
 
     $addbr_cmd
-    ovs-vsctl --no-wait br-set-external-id $bridge bridge-id $bridge
+    sudo ovs-vsctl --no-wait br-set-external-id $bridge bridge-id $bridge
 }
 
 function _start_process {
@@ -229,8 +267,8 @@ function create_public_bridge {
     local ext_gw_ifc
     ext_gw_ifc=$(get_ext_gw_interface)
 
-    ovs-vsctl --may-exist add-br $ext_gw_ifc -- set bridge $ext_gw_ifc protocols=OpenFlow13,OpenFlow15
-    ovs-vsctl set open . external-ids:ovn-bridge-mappings=$PHYSICAL_NETWORK:$ext_gw_ifc
+    sudo ovs-vsctl --may-exist add-br $ext_gw_ifc -- set bridge $ext_gw_ifc protocols=OpenFlow13,OpenFlow15
+    sudo ovs-vsctl set open . external-ids:ovn-bridge-mappings=$PHYSICAL_NETWORK:$ext_gw_ifc
     if [ -n "$FLOATING_RANGE" ]; then
         local cidr_len=${FLOATING_RANGE#*/}
         sudo ip addr flush dev $ext_gw_ifc
@@ -337,35 +375,46 @@ function install_ovn {
     # Check the OVN configuration
     ovn_sanity_check
 
-    # If OVS is already installed, remove it, because we're about to re-install
-    # it from source.
-    for package in openvswitch openvswitch-switch openvswitch-common; do
-        if is_package_installed $package ; then
-            uninstall_package $package
-        fi
-    done
-
     # Install tox, used to generate the config (see devstack/override-defaults)
     pip_install tox
-    remove_ovs_packages
-    sudo rm -f $OVS_RUNDIR/*
 
-    compile_ovs $OVN_BUILD_MODULES
-    if use_new_ovn_repository; then
-        compile_ovn $OVN_BUILD_MODULES
+    sudo mkdir -p $OVS_RUNDIR
+    sudo chown $(whoami) $OVS_RUNDIR
+    # NOTE(lucasagomes): To keep things simpler, let's reuse the same
+    # RUNDIR for both OVS and OVN. This way we avoid having to specify the
+    # --db option in the ovn-{n,s}bctl commands while playing with DevStack
+    sudo ln -s $OVS_RUNDIR $OVN_RUNDIR
+
+    if [[ "$OVN_BUILD_FROM_SOURCE" == "True" ]]; then
+        # If OVS is already installed, remove it, because we're about to
+        # re-install it from source.
+        for package in openvswitch openvswitch-switch openvswitch-common; do
+            if is_package_installed $package ; then
+                uninstall_package $package
+            fi
+        done
+
+        remove_ovs_packages
+        sudo rm -f $OVS_RUNDIR/*
+
+        compile_ovs $OVN_BUILD_MODULES
+        if use_new_ovn_repository; then
+            compile_ovn $OVN_BUILD_MODULES
+        fi
+
+        sudo mkdir -p $OVS_PREFIX/var/log/openvswitch
+        sudo chown $(whoami) $OVS_PREFIX/var/log/openvswitch
+        sudo mkdir -p $OVS_PREFIX/var/log/ovn
+        sudo chown $(whoami) $OVS_PREFIX/var/log/ovn
+    else
+        fixup_ovn_centos
+        install_package $(get_packages openvswitch)
+        install_package $(get_packages ovn)
     fi
 
     # Ensure that the OVS commands are accessible in the PATH
-    OVS_BINDIR=${OVS_BINDIR:-/usr/local/bin}
     export PATH=$OVS_BINDIR:$PATH
 
-    sudo mkdir -p $OVS_RUNDIR
-    sudo chown $(whoami) $OVS_RUNDIR
-    sudo mkdir -p $OVS_PREFIX/var/log/openvswitch
-    sudo chown $(whoami) $OVS_PREFIX/var/log/openvswitch
-    sudo mkdir -p $OVS_PREFIX/var/log/ovn
-    sudo chown $(whoami) $OVS_PREFIX/var/log/ovn
-
     # Archive log files and create new
     local log_archive_dir=$LOGDIR/archive
     mkdir -p $log_archive_dir
@@ -494,7 +543,7 @@ function configure_ovn {
         iniset $OVN_META_CONF DEFAULT nova_metadata_host $OVN_META_DATA_HOST
         iniset $OVN_META_CONF DEFAULT metadata_workers $API_WORKERS
         iniset $OVN_META_CONF DEFAULT state_path $NEUTRON_STATE_PATH
-        iniset $OVN_META_CONF ovs ovsdb_connection unix:$OVS_RUNDIR/db.sock
+        iniset $OVN_META_CONF ovs ovsdb_connection tcp:$OVSDB_SERVER_LOCAL_HOST:6640
         iniset $OVN_META_CONF ovn ovn_sb_connection $OVN_SB_REMOTE
         if is_service_enabled tls-proxy; then
             iniset $OVN_META_CONF ovn \
@@ -533,51 +582,58 @@ function _start_ovs {
         enable_service ovsdb-server
         enable_service ovs-vswitchd
 
-        if [ ! -f $OVS_DATADIR/conf.db ]; then
-            ovsdb-tool create $OVS_DATADIR/conf.db $OVS_SHAREDIR/vswitch.ovsschema
-        fi
+        if [[ "$OVN_BUILD_FROM_SOURCE" == "True" ]]; then
+            if [ ! -f $OVS_DATADIR/conf.db ]; then
+                ovsdb-tool create $OVS_DATADIR/conf.db $OVS_SHAREDIR/vswitch.ovsschema
+            fi
 
-        if is_service_enabled ovn-controller-vtep; then
-            if [ ! -f $OVS_DATADIR/vtep.db ]; then
-                ovsdb-tool create $OVS_DATADIR/vtep.db $OVS_SHAREDIR/vtep.ovsschema
+            if is_service_enabled ovn-controller-vtep; then
+                if [ ! -f $OVS_DATADIR/vtep.db ]; then
+                    ovsdb-tool create $OVS_DATADIR/vtep.db $OVS_SHAREDIR/vtep.ovsschema
+                fi
             fi
-        fi
 
-        local dbcmd="$OVS_SBINDIR/ovsdb-server --remote=punix:$OVS_RUNDIR/db.sock --remote=ptcp:6640:$OVSDB_SERVER_LOCAL_HOST --pidfile --detach --log-file"
-        dbcmd+=" --remote=db:Open_vSwitch,Open_vSwitch,manager_options"
-        if is_service_enabled ovn-controller-vtep; then
-            dbcmd+=" --remote=db:hardware_vtep,Global,managers $OVS_DATADIR/vtep.db"
+            local dbcmd="$OVS_SBINDIR/ovsdb-server --remote=punix:$OVS_RUNDIR/db.sock --remote=ptcp:6640:$OVSDB_SERVER_LOCAL_HOST --pidfile --detach --log-file"
+            dbcmd+=" --remote=db:Open_vSwitch,Open_vSwitch,manager_options"
+            if is_service_enabled ovn-controller-vtep; then
+                dbcmd+=" --remote=db:hardware_vtep,Global,managers $OVS_DATADIR/vtep.db"
+            fi
+            dbcmd+=" $OVS_DATADIR/conf.db"
+            _run_process ovsdb-server "$dbcmd"
+
+            # Note: ovn-controller will create and configure br-int once it is started.
+            # So, no need to create it now because nothing depends on that bridge here.
+            local ovscmd="$OVS_SBINDIR/ovs-vswitchd --log-file --pidfile --detach"
+            _run_process ovs-vswitchd "$ovscmd" "" "$STACK_GROUP" "root"
+        else
+            _start_process "$OVSDB_SERVER_SERVICE"
+            _start_process "$OVS_VSWITCHD_SERVICE"
         fi
-        dbcmd+=" $OVS_DATADIR/conf.db"
-        _run_process ovsdb-server "$dbcmd"
 
         echo "Configuring OVSDB"
         if is_service_enabled tls-proxy; then
-            ovs-vsctl --no-wait set-ssl \
+            sudo ovs-vsctl --no-wait set-ssl \
                 $INT_CA_DIR/private/$DEVSTACK_CERT_NAME.key \
                 $INT_CA_DIR/$DEVSTACK_CERT_NAME.crt \
                 $INT_CA_DIR/ca-chain.pem
         fi
-        ovs-vsctl --no-wait set open_vswitch . system-type="devstack"
-        ovs-vsctl --no-wait set open_vswitch . external-ids:system-id="$OVN_UUID"
-        ovs-vsctl --no-wait set open_vswitch . external-ids:ovn-remote="$OVN_SB_REMOTE"
-        ovs-vsctl --no-wait set open_vswitch . external-ids:ovn-bridge="br-int"
-        ovs-vsctl --no-wait set open_vswitch . external-ids:ovn-encap-type="geneve"
-        ovs-vsctl --no-wait set open_vswitch . external-ids:ovn-encap-ip="$HOST_IP"
+
+        sudo ovs-vsctl --no-wait set-manager ptcp:6640:$OVSDB_SERVER_LOCAL_HOST
+        sudo ovs-vsctl --no-wait set open_vswitch . system-type="devstack"
+        sudo ovs-vsctl --no-wait set open_vswitch . external-ids:system-id="$OVN_UUID"
+        sudo ovs-vsctl --no-wait set open_vswitch . external-ids:ovn-remote="$OVN_SB_REMOTE"
+        sudo ovs-vsctl --no-wait set open_vswitch . external-ids:ovn-bridge="br-int"
+        sudo ovs-vsctl --no-wait set open_vswitch . external-ids:ovn-encap-type="geneve"
+        sudo ovs-vsctl --no-wait set open_vswitch . external-ids:ovn-encap-ip="$HOST_IP"
+        sudo ovs-vsctl --no-wait set open_vswitch . external-ids:hostname="$LOCAL_HOSTNAME"
         # Select this chassis to host gateway routers
         if [[ "$ENABLE_CHASSIS_AS_GW" == "True" ]]; then
-            ovs-vsctl --no-wait set open_vswitch . external-ids:ovn-cms-options="enable-chassis-as-gw"
+            sudo ovs-vsctl --no-wait set open_vswitch . external-ids:ovn-cms-options="enable-chassis-as-gw"
         fi
 
-        # Note: ovn-controller will create and configure br-int once it is started.
-        # So, no need to create it now because nothing depends on that bridge here.
-
-        local ovscmd="$OVS_SBINDIR/ovs-vswitchd --log-file --pidfile --detach"
-        _run_process ovs-vswitchd "$ovscmd" "" "$STACK_GROUP" "root"
-
         if is_provider_network || [[ $Q_USE_PROVIDERNET_FOR_PUBLIC == "True" ]]; then
             ovn_base_setup_bridge $OVS_PHYSICAL_BRIDGE
-            ovs-vsctl set open . external-ids:ovn-bridge-mappings=${PHYSICAL_NETWORK}:${OVS_PHYSICAL_BRIDGE}
+            sudo ovs-vsctl set open . external-ids:ovn-bridge-mappings=${PHYSICAL_NETWORK}:${OVS_PHYSICAL_BRIDGE}
         fi
 
         if is_service_enabled ovn-controller-vtep ; then
@@ -595,20 +651,20 @@ function _start_ovs {
 }
 
 function _start_ovn_services {
-    _start_process "devstack@ovsdb-server.service"
-    _start_process "devstack@ovs-vswitchd.service"
+    _start_process "$OVSDB_SERVER_SERVICE"
+    _start_process "$OVS_VSWITCHD_SERVICE"
 
-    if is_service_enabled ovs-vtep ; then
-        _start_process "devstack@ovs-vtep.service"
-    fi
     if is_service_enabled ovn-northd ; then
-        _start_process "devstack@ovn-northd.service"
+        _start_process "$OVN_NORTHD_SERVICE"
     fi
     if is_service_enabled ovn-controller ; then
-        _start_process "devstack@ovn-controller.service"
+        _start_process "$OVN_CONTROLLER_SERVICE"
     fi
     if is_service_enabled ovn-controller-vtep ; then
-        _start_process "devstack@ovn-controller-vtep.service"
+        _start_process "$OVN_CONTROLLER_VTEP_SERVICE"
+    fi
+    if is_service_enabled ovs-vtep ; then
+        _start_process "devstack@ovs-vtep.service"
     fi
     if is_service_enabled q-ovn-metadata-agent; then
         _start_process "devstack@q-ovn-metadata-agent.service"
@@ -627,39 +683,47 @@ function start_ovn {
     fi
 
     if is_service_enabled ovn-northd ; then
-        if is_service_enabled tls-proxy; then
-            local tls_args="\
-                --ovn-nb-db-ssl-ca-cert=$INT_CA_DIR/ca-chain.pem \
-                --ovn-nb-db-ssl-cert=$INT_CA_DIR/$DEVSTACK_CERT_NAME.crt \
-                --ovn-nb-db-ssl-key=$INT_CA_DIR/private/$DEVSTACK_CERT_NAME.key \
-                --ovn-sb-db-ssl-ca-cert=$INT_CA_DIR/ca-chain.pem \
-                --ovn-sb-db-ssl-cert=$INT_CA_DIR/$DEVSTACK_CERT_NAME.crt \
-                --ovn-sb-db-ssl-key=$INT_CA_DIR/private/$DEVSTACK_CERT_NAME.key \
-                "
+        if [[ "$OVN_BUILD_FROM_SOURCE" == "True" ]]; then
+            local cmd="/bin/bash $SCRIPTDIR/ovn-ctl --no-monitor start_northd"
+            local stop_cmd="/bin/bash $SCRIPTDIR/ovn-ctl stop_northd"
+
+            _run_process ovn-northd "$cmd" "$stop_cmd"
         else
-            local tls_args=""
+            _start_process "$OVN_NORTHD_SERVICE"
         fi
-        local cmd="/bin/bash $SCRIPTDIR/ovn-ctl --no-monitor $tls_args start_northd"
-        local stop_cmd="/bin/bash $SCRIPTDIR/ovn-ctl stop_northd"
 
-        _run_process ovn-northd "$cmd" "$stop_cmd"
-        ovn-nbctl --db=unix:$OVS_RUNDIR/ovnnb_db.sock set-connection p${OVN_PROTO}:6641:$SERVICE_LISTEN_ADDRESS -- set connection . inactivity_probe=60000
-        ovn-sbctl --db=unix:$OVS_RUNDIR/ovnsb_db.sock set-connection p${OVN_PROTO}:6642:$SERVICE_LISTEN_ADDRESS -- set connection . inactivity_probe=60000
+        # Wait for the service to be ready
+        wait_for_sock_file $OVS_RUNDIR/ovnnb_db.sock
+        wait_for_sock_file $OVS_RUNDIR/ovnsb_db.sock
+
+        if is_service_enabled tls-proxy; then
+            sudo ovn-nbctl --db=unix:$OVS_RUNDIR/ovnnb_db.sock set-ssl $INT_CA_DIR/private/$DEVSTACK_CERT_NAME.key $INT_CA_DIR/$DEVSTACK_CERT_NAME.crt $INT_CA_DIR/ca-chain.pem
+            sudo ovn-sbctl --db=unix:$OVS_RUNDIR/ovnsb_db.sock set-ssl $INT_CA_DIR/private/$DEVSTACK_CERT_NAME.key $INT_CA_DIR/$DEVSTACK_CERT_NAME.crt $INT_CA_DIR/ca-chain.pem
+        fi
+        sudo ovn-nbctl --db=unix:$OVS_RUNDIR/ovnnb_db.sock set-connection p${OVN_PROTO}:6641:$SERVICE_LISTEN_ADDRESS -- set connection . inactivity_probe=60000
+        sudo ovn-sbctl --db=unix:$OVS_RUNDIR/ovnsb_db.sock set-connection p${OVN_PROTO}:6642:$SERVICE_LISTEN_ADDRESS -- set connection . inactivity_probe=60000
         sudo ovs-appctl -t $OVS_RUNDIR/ovnnb_db.ctl vlog/set console:off syslog:$OVN_DBS_LOG_LEVEL file:$OVN_DBS_LOG_LEVEL
         sudo ovs-appctl -t $OVS_RUNDIR/ovnsb_db.ctl vlog/set console:off syslog:$OVN_DBS_LOG_LEVEL file:$OVN_DBS_LOG_LEVEL
     fi
 
     if is_service_enabled ovn-controller ; then
-        local cmd="/bin/bash $SCRIPTDIR/ovn-ctl --no-monitor start_controller"
-        local stop_cmd="/bin/bash $SCRIPTDIR/ovn-ctl stop_controller"
+        if [[ "$OVN_BUILD_FROM_SOURCE" == "True" ]]; then
+            local cmd="/bin/bash $SCRIPTDIR/ovn-ctl --no-monitor start_controller"
+            local stop_cmd="/bin/bash $SCRIPTDIR/ovn-ctl stop_controller"
 
-        _run_process ovn-controller "$cmd" "$stop_cmd" "$STACK_GROUP" "root"
+            _run_process ovn-controller "$cmd" "$stop_cmd" "$STACK_GROUP" "root"
+        else
+            _start_process "$OVN_CONTROLLER_SERVICE"
+        fi
     fi
 
     if is_service_enabled ovn-controller-vtep ; then
-        local cmd="$OVS_BINDIR/ovn-controller-vtep --log-file --pidfile --detach --ovnsb-db=$OVN_SB_REMOTE"
-
-        _run_process ovn-controller-vtep "$cmd" "" "$STACK_GROUP" "root"
+        if [[ "$OVN_BUILD_FROM_SOURCE" == "True" ]]; then
+            local cmd="$OVS_BINDIR/ovn-controller-vtep --log-file --pidfile --detach --ovnsb-db=$OVN_SB_REMOTE"
+            _run_process ovn-controller-vtep "$cmd" "" "$STACK_GROUP" "root"
+        else
+            _start_process "$OVN_CONTROLLER_VTEP_SERVICE"
+        fi
     fi
 
     if is_service_enabled q-ovn-metadata-agent; then
@@ -668,13 +732,6 @@ function start_ovn {
         setup_logging $OVN_META_CONF
     fi
 
-    # NOTE(lucasagomes): To keep things simpler, let's reuse the same
-    # RUNDIR for both OVS and OVN. This way we avoid having to specify the
-    # --db option in the ovn-{n,s}bctl commands while playing with DevStack
-    if use_new_ovn_repository; then
-        sudo ln -s $OVS_RUNDIR $OVN_RUNDIR
-    fi
-
     _start_ovn_services
 }
 
@@ -683,26 +740,35 @@ function _stop_ovs_dp {
     modprobe -q -r vport_geneve vport_vxlan openvswitch || true
 }
 
+function _stop_process {
+    local service=$1
+    echo "Stopping process $service"
+    if $SYSTEMCTL is-enabled $service; then
+        $SYSTEMCTL stop $service
+        $SYSTEMCTL disable $service
+    fi
+}
+
 function stop_ovn {
     if is_service_enabled q-ovn-metadata-agent; then
         sudo pkill -9 -f haproxy || :
-        stop_process neutron-ovn-metadata-agent
+        _stop_process "devstack@q-ovn-metadata-agent.service"
     fi
     if is_service_enabled ovn-controller-vtep ; then
-        stop_process ovn-controller-vtep
+        _stop_process "$OVN_CONTROLLER_VTEP_SERVICE"
     fi
     if is_service_enabled ovn-controller ; then
-        stop_process ovn-controller
+        _stop_process "$OVN_CONTROLLER_SERVICE"
     fi
     if is_service_enabled ovn-northd ; then
-        stop_process ovn-northd
+        _stop_process "$OVN_NORTHD_SERVICE"
     fi
     if is_service_enabled ovs-vtep ; then
-        stop_process ovs-vtep
+        _stop_process "devstack@ovs-vtep.service"
     fi
 
-    stop_process ovs-vswitchd
-    stop_process ovsdb-server
+    _stop_process "$OVS_VSWITCHD_SERVICE"
+    _stop_process "$OVSDB_SERVER_SERVICE"
 
     _stop_ovs_dp
 }
diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index cd7ee59c1d..25f726892f 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -184,6 +184,14 @@ function fixup_suse {
     sudo zypper up -y p11-kit ca-certificates-mozilla
 }
 
+function fixup_ovn_centos {
+    if [[ $os_VENDOR != "CentOS" ]]; then
+        return
+    fi
+    # OVN packages are part of this release for CentOS
+    yum_install centos-release-openstack-victoria
+}
+
 function fixup_all {
     fixup_keystone
     fixup_ubuntu

From 04b0b61557f7dad6c32b566255c21a36e4b0aefa Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Tue, 22 Dec 2020 12:23:56 -0600
Subject: [PATCH 1820/2409] Install swift keystone extras requirements

Since the introduction of I8f24b839bf42e2fb9803dc7df3a30ae20cf264
s-proxy is no longer able to launch as keystonemiddleware (listed under
test-requirements.txt) has not been installed.

keystonemiddleware is listed as extras requirements in swift
- https://github.com/openstack/swift/blob/e0d46d77fa740768f1dd5b989a63be85ff1fec20/setup.cfg#L79

Let's install swift keystone extra requirements also.

Closes-Bug: #1909018
Change-Id: I02c692e95d70017eea03d82d75ae6c5e87bde8b1
---
 lib/swift | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/swift b/lib/swift
index a981dfc10a..790fb99442 100644
--- a/lib/swift
+++ b/lib/swift
@@ -741,7 +741,9 @@ function init_swift {
 
 function install_swift {
     git_clone $SWIFT_REPO $SWIFT_DIR $SWIFT_BRANCH
-    setup_develop $SWIFT_DIR
+    # keystonemiddleware needs to be installed via keystone extras as defined
+    # in setup.cfg, see bug #1909018 for more details.
+    setup_develop $SWIFT_DIR keystone
     if [ "$SWIFT_USE_MOD_WSGI" == "True" ]; then
         install_apache_wsgi
     fi

From fc41717222da029274236714f1447fcba1277b06 Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Wed, 23 Dec 2020 10:52:20 +0000
Subject: [PATCH 1821/2409] cinder: Double [DEFAULT]/rpc_response_timeout to
 120

Bug #1873234 documents a number of CI failures caused by RPC requests
from c-api to c-vol timing out due to `lvchange` taking longer than the
default rpc_response_timeout of 60 seconds to complete.

While the underlying reason for the slowness should be investigated by
the cinder team a trivial workaround to the fallout created by these
timeouts is to simply double the client RPC timeout used by c-api,
allowing c-vol to return and overall the request to succeed.

Change-Id: I53dc0ae10af6aa13f1349b58373932eb6a15ab02
Related-Bug: #1873234
---
 lib/cinder | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/lib/cinder b/lib/cinder
index b892b91791..6c97e114a6 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -236,6 +236,11 @@ function configure_cinder {
     iniset $CINDER_CONF key_manager backend cinder.keymgr.conf_key_mgr.ConfKeyManager
     iniset $CINDER_CONF key_manager fixed_key $(openssl rand -hex 16)
 
+    # Avoid RPC timeouts in slow CI and test environments by doubling the
+    # default response timeout set by RPC clients. See bug #1873234 for more
+    # details and example failures.
+    iniset $CINDER_CONF DEFAULT rpc_response_timeout 120
+
     if is_service_enabled c-vol && [[ -n "$CINDER_ENABLED_BACKENDS" ]]; then
         local enabled_backends=""
         local default_name=""

From 7e3428b9872d5b4b01ee10f2d29c55e7e2accbbd Mon Sep 17 00:00:00 2001
From: Federico Ressi <fressi@redhat.com>
Date: Fri, 11 Dec 2020 15:40:32 +0100
Subject: [PATCH 1822/2409] Install systemd-python from distribution package

CentOS 8 support start to fail because of an issue [1]
compiling systemd python binding modules.
Let install it from distribution packages as documented by
python-systemd project Web page [2]

[1] https://bugzilla.redhat.com/show_bug.cgi?id=1862714
[2] https://github.com/systemd/python-systemd

Closes-Bug: #1908386
Change-Id: Ic7cfd72ce1b875e75b1cdbdd44a902b25d51abb8
---
 doc/source/systemd.rst  | 25 -------------------------
 files/debs/general      |  1 +
 files/rpms-suse/general |  2 +-
 files/rpms/general      |  2 +-
 stack.sh                |  1 -
 5 files changed, 3 insertions(+), 28 deletions(-)

diff --git a/doc/source/systemd.rst b/doc/source/systemd.rst
index 4f83b36f92..78535202d8 100644
--- a/doc/source/systemd.rst
+++ b/doc/source/systemd.rst
@@ -196,31 +196,6 @@ See the `remote-pdb`_ home page for more options.
 
 .. _`remote-pdb`: https://pypi.org/project/remote-pdb/
 
-Known Issues
-============
-
-Be careful about systemd python libraries. There are 3 of them on
-pypi, and they are all very different. They unfortunately all install
-into the ``systemd`` namespace, which can cause some issues.
-
-- ``systemd-python`` - this is the upstream maintained library, it has
-  a version number like systemd itself (currently ``234``). This is
-  the one you want.
-- ``systemd`` - a python 3 only library, not what you want.
-- ``python-systemd`` - another library you don't want. Installing it
-  on a system will break ansible's ability to run. The package has now
-  been renamed to ``cysystemd``, which avoids the namespace collision.
-
-
-If we were using user units, the ``[Service]`` - ``Group=`` parameter
-doesn't seem to work with user units, even though the documentation
-says that it should. This means that we will need to do an explicit
-``/usr/bin/sg``. This has the downside of making the SYSLOG_IDENTIFIER
-be ``sg``. We can explicitly set that with ``SyslogIdentifier=``, but
-it's really unfortunate that we're going to need this work
-around. This is currently not a problem because we're only using
-system units.
-
 Future Work
 ===========
 
diff --git a/files/debs/general b/files/debs/general
index 4bf1ff4039..d64417f1b7 100644
--- a/files/debs/general
+++ b/files/debs/general
@@ -28,6 +28,7 @@ pkg-config
 psmisc
 python3-dev
 python3-pip
+python3-systemd
 python3-venv
 tar
 tcpdump
diff --git a/files/rpms-suse/general b/files/rpms-suse/general
index 0af2b5b169..0de0876dcd 100644
--- a/files/rpms-suse/general
+++ b/files/rpms-suse/general
@@ -20,10 +20,10 @@ openssl
 pcre-devel # python-pcre
 postgresql-devel  # psycopg2
 psmisc
+python3-systemd
 python-cmd2 # dist:opensuse-12.3
 python-devel  # pyOpenSSL
 python-xml
-systemd-devel # for systemd-python
 tar
 tcpdump
 unzip
diff --git a/files/rpms/general b/files/rpms/general
index c42ce529e7..cfcd7ff261 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -25,8 +25,8 @@ postgresql-devel  # psycopg2
 psmisc
 python3-devel
 python3-pip
+python3-systemd
 redhat-rpm-config # missing dep for gcc hardening flags, see rhbz#1217376
-systemd-devel # for systemd-python
 tar
 tcpdump
 unzip
diff --git a/stack.sh b/stack.sh
index bb4dfa2561..036afd7b00 100755
--- a/stack.sh
+++ b/stack.sh
@@ -761,7 +761,6 @@ fixup_all
 # Install subunit for the subunit output stream
 pip_install -U os-testr
 
-pip_install_gr systemd-python
 # the default rate limit of 1000 messages / 30 seconds is not
 # sufficient given how verbose our logging is.
 iniset -sudo /etc/systemd/journald.conf "Journal" "RateLimitBurst" "0"

From 36a575b036e55c31ab624447c5d73bc56408a672 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Fri, 13 Nov 2020 06:57:33 -0800
Subject: [PATCH 1823/2409] Clean up create_disk() a little

The create_disk() helper had some redundant checks and dead code. This
refactors it to put all the stale cleanup at the top, and groups the
new actions together with more relevant comments to make it easier
to understand.

Change-Id: I1f6218a1994e66786ed9a8065e30bcceec7b8956
---
 functions | 33 ++++++++++++++-------------------
 1 file changed, 14 insertions(+), 19 deletions(-)

diff --git a/functions b/functions
index e679b0f9bc..fc87a5512d 100644
--- a/functions
+++ b/functions
@@ -759,16 +759,14 @@ function create_disk {
     local loopback_disk_size=${3}
     local key
 
-    # Create a loopback disk and format it to XFS.
-    if [[ -e ${disk_image} ]]; then
-        if egrep -q ${storage_data_dir} /proc/mounts; then
-            sudo umount ${storage_data_dir}
-            sudo rm -f ${disk_image}
-        fi
-    fi
+    key=$(echo $disk_image | sed 's#/.##')
+    key="devstack-$key"
 
-    sudo mkdir -p ${storage_data_dir}/drives/images
+    destroy_disk $disk_image $storage_data_dir
 
+    # Create an empty file of the correct size (and ensure the
+    # directory structure up to that path exists)
+    sudo mkdir -p $(dirname ${disk_image})
     sudo truncate -s ${loopback_disk_size} ${disk_image}
 
     # Make a fresh XFS filesystem. Use bigger inodes so xattr can fit in
@@ -778,16 +776,9 @@ function create_disk {
     # Swift and Ceph.
     sudo mkfs.xfs -f -i size=1024 ${disk_image}
 
-    # Unmount the target, if mounted
-    if egrep -q $storage_data_dir /proc/mounts; then
-        sudo umount $storage_data_dir
-    fi
-
-    # Clear any old fstab rules, install a new one for this disk, and mount it
-    key=$(echo $disk_image | sed 's#/.##')
-    key="devstack-$key"
-    sudo sed -i '/.*comment=$key.*/ d' /etc/fstab
+    # Install a new loopback fstab entry for this disk image, and mount it
     echo "$disk_image $storage_data_dir xfs loop,noatime,nodiratime,logbufs=8,comment=$key 0 0" | sudo tee -a /etc/fstab
+    sudo mkdir -p $storage_data_dir
     sudo mount -v $storage_data_dir
 }
 
@@ -795,6 +786,10 @@ function create_disk {
 function destroy_disk {
     local disk_image=$1
     local storage_data_dir=$2
+    local key
+
+    key=$(echo $disk_image | sed 's#/.##')
+    key="devstack-$key"
 
     # Unmount the target, if mounted
     if egrep -q $storage_data_dir /proc/mounts; then
@@ -802,10 +797,10 @@ function destroy_disk {
     fi
 
     # Clear any fstab rules
-    sed -i '/.*comment=$key.*/ d' /etc/fstab
+    sudo sed -i '/.*comment=$key.*/ d' /etc/fstab
 
     # Delete the file
-    sudo rm $disk_image
+    sudo rm -f $disk_image
 }
 
 

From b37240382dc300f30efd83894fb0a9077e98d0ec Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Fri, 8 Jan 2021 09:41:56 +0100
Subject: [PATCH 1824/2409] Drop opensuse platform job

It has been broken for over a month. Feel free to revert in combination
with a fix, better with a commitment to keep the job in working shape
permanently.

Change-Id: I2604374c23716d56de29e16a459b7c7f45b84891
---
 .zuul.yaml | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index c1406716fe..bf32af070e 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -584,13 +584,6 @@
     voting: false
     timeout: 9000
 
-- job:
-    name: devstack-platform-opensuse-15
-    parent: tempest-full-py3
-    description: openSUSE 15.x platform test
-    nodeset: devstack-single-node-opensuse-15
-    voting: false
-
 - job:
     name: devstack-platform-bionic
     parent: tempest-full-py3
@@ -686,7 +679,6 @@
       jobs:
         - devstack
         - devstack-ipv6
-        - devstack-platform-opensuse-15
         - devstack-platform-fedora-latest
         - devstack-platform-centos-8
         - devstack-platform-bionic

From edee6dc341e40939360b36ce9fd09052dea1ee4d Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Tue, 12 Jan 2021 14:04:38 -0800
Subject: [PATCH 1825/2409] Add debug helper script

I'm not sure if others will find this useful, but I use this
script to run pieces of devstack while trying to write/debug
things. It saves me a lot of time being able to get to some
project-lib function without a full clean/re-stack.

Figured I'd share in case it's worth putting into the tree.

Change-Id: I9a92fa71d34f50c2f5ba7d11c1a45301bd4478bf
---
 tools/debug_function.sh | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)
 create mode 100755 tools/debug_function.sh

diff --git a/tools/debug_function.sh b/tools/debug_function.sh
new file mode 100755
index 0000000000..68bd85dc61
--- /dev/null
+++ b/tools/debug_function.sh
@@ -0,0 +1,24 @@
+#!/bin/bash
+
+# This is a small helper to speed development and debug with devstack.
+# It is intended to help you run a single function in a project module
+# without having to re-stack.
+#
+# For example, to run the just start_glance function, do this:
+#
+#   ./tools/debug_function.sh glance start_glance
+
+if [ ! -f "lib/$1" ]; then
+    echo "Usage: $0 [project] [function] [function...]"
+fi
+
+source stackrc
+source lib/$1
+shift
+set -x
+while [ "$1" ]; do
+    echo ==== Running $1 ====
+    $1
+    echo ==== Done with $1 ====
+    shift
+done

From bcd0acf6c0b5d6501e91133c3a937b3fc40f7122 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Wed, 13 Jan 2021 12:28:18 -0800
Subject: [PATCH 1826/2409] Also cap pip in tempest tox venv

I am still unable to stack because of pip 20.3, but this time
because of the tempest venv build. This forces it to the same
capped pip, which further works around the problem.

Change-Id: Icfaaefe1aa576733764b393cba96d276c9b1cf68
Related-Bug: #1906367
---
 lib/tempest | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index 552e1c22a3..8ee986d555 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -703,6 +703,9 @@ function install_tempest {
     git checkout $TEMPEST_BRANCH
 
     tox -r --notest -efull
+    # TODO: remove the trailing pip constraint when a proper fix
+    # arrives for bug https://bugs.launchpad.net/devstack/+bug/1906322
+    $TEMPEST_DIR/.tox/tempest/bin/pip install -U -r $RC_DIR/tools/cap-pip.txt
     # NOTE(mtreinish) Respect constraints in the tempest full venv, things that
     # are using a tox job other than full will not be respecting constraints but
     # running pip install -U on tempest requirements

From ed164289a57549fb2b2404fc77052bb09ceb5105 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Mon, 18 Jan 2021 09:57:00 -0800
Subject: [PATCH 1827/2409] Always verify os_glance reserved namespace

On master, we should always enable tempest's verification of Glance's
os_glance namespace enforcement.

Change-Id: Ia71878e6c53ee683a868112959876798e946e2ce
Depends-On: https://review.opendev.org/c/openstack/glance/+/771070
---
 lib/tempest | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/tempest b/lib/tempest
index 552e1c22a3..b2047000e0 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -351,6 +351,7 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG image disk_formats "ami,ari,aki,vhd,raw,iso"
     fi
     iniset $TEMPEST_CONFIG image-feature-enabled import_image $GLANCE_USE_IMPORT_WORKFLOW
+    iniset $TEMPEST_CONFIG image-feature-enabled os_glance_reserved True
     # Compute
     iniset $TEMPEST_CONFIG compute image_ref $image_uuid
     iniset $TEMPEST_CONFIG compute image_ref_alt $image_uuid_alt

From eef2a0d751f4d53fb7b475e69e229cb541f7af2c Mon Sep 17 00:00:00 2001
From: Vanou Ishii <ishii.vanou@fujitsu.com>
Date: Wed, 20 Jan 2021 14:15:57 +0900
Subject: [PATCH 1828/2409] Fix Early Use of die function in stack.sh

This commit fixes use of die function before it's defined.
die function can be used after sourcing $TOP_DIR/functions chain-
sources $TOP_DIR/functions-common.
Because fixed portion of stack.sh checks existence of $TOP_DIR/inc
and sourcing $TOP_DIR/function chain source $TOP_DIR/inc, this commit
uses echo & exit command instead of die function.

Closes-Bug: #1913021
Change-Id: I5ec174cf7b02269525b1bfd0bfa94ea889d16fce
---
 stack.sh | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/stack.sh b/stack.sh
index 036afd7b00..c334159550 100755
--- a/stack.sh
+++ b/stack.sh
@@ -96,19 +96,25 @@ fi
 # templates and other useful files in the ``files`` subdirectory
 FILES=$TOP_DIR/files
 if [ ! -d $FILES ]; then
-    die $LINENO "missing devstack/files"
+    set +o xtrace
+    echo "missing devstack/files"
+    exit 1
 fi
 
 # ``stack.sh`` keeps function libraries here
 # Make sure ``$TOP_DIR/inc`` directory is present
 if [ ! -d $TOP_DIR/inc ]; then
-    die $LINENO "missing devstack/inc"
+    set +o xtrace
+    echo "missing devstack/inc"
+    exit 1
 fi
 
 # ``stack.sh`` keeps project libraries here
 # Make sure ``$TOP_DIR/lib`` directory is present
 if [ ! -d $TOP_DIR/lib ]; then
-    die $LINENO "missing devstack/lib"
+    set +o xtrace
+    echo "missing devstack/lib"
+    exit 1
 fi
 
 # Check if run in POSIX shell

From b4bba2f2c817dd5c7594e8c7950021969704db5d Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Thu, 4 Feb 2021 23:24:17 +0000
Subject: [PATCH 1829/2409] Increase volumes quota for service project

If we are backing glance with cinder, we will use more volumes and
if timing is right, we will clash with other tests and be unable
to create what we need. If we are backing glance with cinder, we
should increase the volumes quota, which this patch does (to 50 from
a default of 10).

Closes-Bug: #1914665
Change-Id: I2ad1c4d21f996ee1a9ce29ba4f1a4b8f5720f8fb
---
 lib/cinder | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/lib/cinder b/lib/cinder
index 6c97e114a6..33deff61f2 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -539,6 +539,14 @@ function create_volume_types {
                 OS_USER_ID=$OS_USERNAME OS_PROJECT_ID=$OS_PROJECT_NAME cinder --os-auth-type noauth --os-endpoint=$cinder_url type-key ${be_name} set volume_backend_name=${be_name}
             fi
         done
+
+        # Increase quota for the service project if glance is using cinder,
+        # since it's likely to occasionally go above the default 10 in parallel
+        # test execution.
+        if [[ "$USE_CINDER_FOR_GLANCE" == "True" ]]; then
+            openstack --os-region-name="$REGION_NAME" \
+                      quota set --volumes 50 "$SERVICE_PROJECT_NAME"
+        fi
     fi
 }
 

From a2273cc4c86348d0dd17ff8c64b2f1edeb620225 Mon Sep 17 00:00:00 2001
From: Flavio Fernandes <flaviof@redhat.com>
Date: Sat, 6 Feb 2021 16:23:36 -0500
Subject: [PATCH 1830/2409] [OVN] Support for network-logging config

This patchset adds configuration support for network logging
when the OVN driver is enabled.

Depends-On: https://review.opendev.org/768129
Change-Id: I6fc0973bedfd1dcc72b01981cd64f9283662d37c
Signed-off-by: Flavio Fernandes <flaviof@redhat.com>
---
 lib/neutron_plugins/ovn_agent | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index b661f593a4..f2baf4a08d 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -149,6 +149,9 @@ Q_ML2_PLUGIN_EXT_DRIVERS=${Q_ML2_PLUGIN_EXT_DRIVERS:-port_security,qos}
 # this one allows empty:
 ML2_L3_PLUGIN=${ML2_L3_PLUGIN-"ovn-router"}
 
+Q_LOG_DRIVER_RATE_LIMIT=${Q_LOG_DRIVER_RATE_LIMIT:-100}
+Q_LOG_DRIVER_BURST_LIMIT=${Q_LOG_DRIVER_BURST_LIMIT:-25}
+Q_LOG_DRIVER_LOG_BASE=${Q_LOG_DRIVER_LOG_BASE:-acl_log_meter}
 
 # Utility Functions
 # -----------------
@@ -490,6 +493,12 @@ function configure_ovn_plugin {
         populate_ml2_config /$Q_PLUGIN_CONF_FILE securitygroup enable_security_group="$Q_USE_SECGROUP"
         inicomment /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver
 
+        if is_service_enabled q-log neutron-log; then
+            populate_ml2_config /$Q_PLUGIN_CONF_FILE network_log rate_limit="$Q_LOG_DRIVER_RATE_LIMIT"
+            populate_ml2_config /$Q_PLUGIN_CONF_FILE network_log burst_limit="$Q_LOG_DRIVER_BURST_LIMIT"
+            inicomment /$Q_PLUGIN_CONF_FILE network_log local_output_log_base="$Q_LOG_DRIVER_LOG_BASE"
+        fi
+
         if is_service_enabled q-ovn-metadata-agent; then
             populate_ml2_config /$Q_PLUGIN_CONF_FILE ovn ovn_metadata_enabled=True
         else

From 30d9bf9a6d8af9590b04caa3757956522f2004d4 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Tue, 19 Jan 2021 12:10:52 -0800
Subject: [PATCH 1831/2409] Async task support

We have a *ton* of stuff in devstack that is very linear, specifically
the ten-ish minutes we spend loading osc to run a single API command
against something. We also generate configs, sync databases, and other
things that use one core of our worker and make our runtime longer
than it really needs to be.

The idea in this patch is to make it super simple to run some things
in the background and then wait for them to finish before proceeding
to something that will require them to be done. This avoids the
interleaving you would expect by redirecting the async tasks to a log
file, and then cat'ing that log file synchronously during the wait
operation. The per-task log file remains so it's easier to examine
it in isolation.

Multiple people have reported between 22-30% improvement in the
time it takes to stack with this. More can be done, but what is here
already makes a significant difference.

Change-Id: I270a910b531641b023c13f75dfedca057a1f1031
---
 .zuul.yaml             |  12 +++
 clean.sh               |   2 +-
 extras.d/80-tempest.sh |   3 +-
 functions              |   1 +
 inc/async              | 225 +++++++++++++++++++++++++++++++++++++++++
 lib/keystone           |  40 ++++----
 lib/nova               |  29 +++---
 stack.sh               |  46 ++++++---
 unstack.sh             |   1 +
 9 files changed, 315 insertions(+), 44 deletions(-)
 create mode 100644 inc/async

diff --git a/.zuul.yaml b/.zuul.yaml
index c1406716fe..7b0696bcd7 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -598,6 +598,17 @@
     nodeset: openstack-single-node-bionic
     voting: false
 
+- job:
+    name: devstack-async
+    parent: tempest-full-py3
+    description: Async mode enabled
+    voting: false
+    vars:
+      devstack_localrc:
+        DEVSTACK_PARALLEL: True
+      zuul_copy_output:
+        /opt/stack/async: logs
+
 - job:
     name: devstack-platform-fedora-latest
     parent: tempest-full-py3
@@ -690,6 +701,7 @@
         - devstack-platform-fedora-latest
         - devstack-platform-centos-8
         - devstack-platform-bionic
+        - devstack-async
         - devstack-multinode
         - devstack-unit-tests
         - openstack-tox-bashate
diff --git a/clean.sh b/clean.sh
index 4cebf1d9ea..870dfd4313 100755
--- a/clean.sh
+++ b/clean.sh
@@ -113,7 +113,7 @@ cleanup_rpc_backend
 cleanup_database
 
 # Clean out data and status
-sudo rm -rf $DATA_DIR $DEST/status
+sudo rm -rf $DATA_DIR $DEST/status $DEST/async
 
 # Clean out the log file and log directories
 if [[ -n "$LOGFILE" ]] && [[ -f "$LOGFILE" ]]; then
diff --git a/extras.d/80-tempest.sh b/extras.d/80-tempest.sh
index 15ecfe39eb..06c73ec763 100644
--- a/extras.d/80-tempest.sh
+++ b/extras.d/80-tempest.sh
@@ -6,7 +6,7 @@ if is_service_enabled tempest; then
         source $TOP_DIR/lib/tempest
     elif [[ "$1" == "stack" && "$2" == "install" ]]; then
         echo_summary "Installing Tempest"
-        install_tempest
+        async_runfunc install_tempest
     elif [[ "$1" == "stack" && "$2" == "post-config" ]]; then
         # Tempest config must come after layer 2 services are running
         :
@@ -17,6 +17,7 @@ if is_service_enabled tempest; then
         # local.conf Tempest option overrides
         :
     elif [[ "$1" == "stack" && "$2" == "test-config" ]]; then
+        async_wait install_tempest
         echo_summary "Initializing Tempest"
         configure_tempest
         echo_summary "Installing Tempest Plugins"
diff --git a/functions b/functions
index fc87a5512d..89bbab2085 100644
--- a/functions
+++ b/functions
@@ -21,6 +21,7 @@ source ${FUNC_DIR}/inc/ini-config
 source ${FUNC_DIR}/inc/meta-config
 source ${FUNC_DIR}/inc/python
 source ${FUNC_DIR}/inc/rootwrap
+source ${FUNC_DIR}/inc/async
 
 # Save trace setting
 _XTRACE_FUNCTIONS=$(set +o | grep xtrace)
diff --git a/inc/async b/inc/async
new file mode 100644
index 0000000000..d29168f2f5
--- /dev/null
+++ b/inc/async
@@ -0,0 +1,225 @@
+#!/bin/bash
+#
+# Symbolic asynchronous tasks for devstack
+#
+# Usage:
+#
+#  async_runfunc my_shell_func foo bar baz
+#
+#  ... do other stuff ...
+#
+#  async_wait my_shell_func
+#
+
+DEVSTACK_PARALLEL=$(trueorfalse False DEVSTACK_PARALLEL)
+_ASYNC_BG_TIME=0
+
+# Keep track of how much total time was spent in background tasks
+# Takes a job runtime in ms.
+function _async_incr_bg_time {
+    local elapsed_ms="$1"
+    _ASYNC_BG_TIME=$(($_ASYNC_BG_TIME + $elapsed_ms))
+}
+
+# Get the PID of a named future to wait on
+function async_pidof {
+    local name="$1"
+    local inifile="${DEST}/async/${name}.ini"
+
+    if [ -f "$inifile" ]; then
+        iniget $inifile job pid
+    else
+        echo 'UNKNOWN'
+        return 1
+    fi
+}
+
+# Log a message about a job. If the message contains "%command" then the
+# full command line of the job will be substituted in the output
+function async_log {
+    local name="$1"
+    shift
+    local message="$*"
+    local inifile=${DEST}/async/${name}.ini
+    local pid
+    local command
+
+    pid=$(iniget $inifile job pid)
+    command=$(iniget $inifile job command | tr '#' '-')
+    message=$(echo "$message" | sed "s#%command#$command#g")
+
+    echo "[Async ${name}:${pid}]: $message"
+}
+
+# Inner function that actually runs the requested task. We wrap it like this
+# just so we can emit a finish message as soon as the work is done, to make
+# it easier to find the tracking just before an error.
+function async_inner {
+    local name="$1"
+    local rc
+    shift
+    set -o xtrace
+    if $* >${DEST}/async/${name}.log 2>&1; then
+        rc=0
+        set +o xtrace
+        async_log "$name" "finished successfully"
+    else
+        rc=$?
+        set +o xtrace
+        async_log "$name" "FAILED with rc $rc"
+    fi
+    iniset ${DEST}/async/${name}.ini job end_time $(date "+%s%3N")
+    return $rc
+}
+
+# Run something async. Takes a symbolic name and a list of arguments of
+# what to run. Ideally this would be rarely used and async_runfunc() would
+# be used everywhere for readability.
+#
+# This spawns the work in a background worker, records a "future" to be
+# collected by a later call to async_wait()
+function async_run {
+    local xtrace
+    xtrace=$(set +o | grep xtrace)
+    set +o xtrace
+
+    local name="$1"
+    shift
+    local inifile=${DEST}/async/${name}.ini
+
+    touch $inifile
+    iniset $inifile job command "$*"
+    iniset $inifile job start_time $(date +%s%3N)
+
+    if [[ "$DEVSTACK_PARALLEL" = "True" ]]; then
+        async_inner $name $* &
+        iniset $inifile job pid $!
+        async_log "$name" "running: %command"
+        $xtrace
+    else
+        iniset $inifile job pid "self"
+        async_log "$name" "Running synchronously: %command"
+        $xtrace
+        $*
+        return $?
+    fi
+}
+
+# Shortcut for running a shell function async. Uses the function name as the
+# async name.
+function async_runfunc {
+    async_run $1 $*
+}
+
+# Wait for an async future to complete. May return immediately if already
+# complete, or of the future has already been waited on (avoid this). May
+# block until the future completes.
+function async_wait {
+    local xtrace
+    xtrace=$(set +o | grep xtrace)
+    set +o xtrace
+
+    local pid rc running inifile runtime
+    rc=0
+    for name in $*; do
+        running=$(ls ${DEST}/async/*.ini 2>/dev/null | wc -l)
+        inifile="${DEST}/async/${name}.ini"
+
+        if pid=$(async_pidof "$name"); then
+            async_log "$name" "Waiting for completion of %command" \
+                      "($running other jobs running)"
+            time_start async_wait
+            if [[ "$pid" != "self" ]]; then
+                # Do not actually call wait if we ran synchronously
+                if wait $pid; then
+                    rc=0
+                else
+                    rc=$?
+                fi
+                cat ${DEST}/async/${name}.log
+            fi
+            time_stop async_wait
+            local start_time
+            local end_time
+            start_time=$(iniget $inifile job start_time)
+            end_time=$(iniget $inifile job end_time)
+            _async_incr_bg_time $(($end_time - $start_time))
+            runtime=$((($end_time - $start_time) / 1000))
+            async_log "$name" "finished %command with result" \
+                      "$rc in $runtime seconds"
+            rm -f $inifile
+            if [ $rc -ne 0 ]; then
+                echo Stopping async wait due to error: $*
+                break
+            fi
+        else
+            # This could probably be removed - it is really just here
+            # to help notice if you wait for something by the wrong
+            # name, but it also shows up for things we didn't start
+            # because they were not enabled.
+            echo Not waiting for async task $name that we never started or \
+                 has already been waited for
+        fi
+    done
+
+    $xtrace
+    return $rc
+}
+
+# Check for uncollected futures and wait on them
+function async_cleanup {
+    local name
+
+    if [[ "$DEVSTACK_PARALLEL" != "True" ]]; then
+        return 0
+    fi
+
+    for inifile in $(find ${DEST}/async -name '*.ini'); do
+        name=$(basename $pidfile .ini)
+        echo "WARNING: uncollected async future $name"
+        async_wait $name || true
+    done
+}
+
+# Make sure our async dir is created and clean
+function async_init {
+    local async_dir=${DEST}/async
+
+    # Clean any residue if present from previous runs
+    rm -Rf $async_dir
+
+    # Make sure we have a state directory
+    mkdir -p $async_dir
+}
+
+function async_print_timing {
+    local bg_time_minus_wait
+    local elapsed_time
+    local serial_time
+    local speedup
+
+    if [[ "$DEVSTACK_PARALLEL" != "True" ]]; then
+        return 0
+    fi
+
+    # The logic here is: All the background task time would be
+    # serialized if we did not do them in the background. So we can
+    # add that to the elapsed time for the whole run. However, time we
+    # spend waiting for async things to finish adds to the elapsed
+    # time, but is time where we're not doing anything useful. Thus,
+    # we substract that from the would-be-serialized time.
+
+    bg_time_minus_wait=$((\
+            ($_ASYNC_BG_TIME - ${_TIME_TOTAL[async_wait]}) / 1000))
+    elapsed_time=$(($(date "+%s") - $_TIME_BEGIN))
+    serial_time=$(($elapsed_time + $bg_time_minus_wait))
+
+    echo
+    echo "================="
+    echo " Async summary"
+    echo "================="
+    echo " Time spent in the background minus waits: $bg_time_minus_wait sec"
+    echo " Elapsed time: $elapsed_time sec"
+    echo " Time if we did everything serially: $serial_time sec"
+    echo " Speedup: " $(echo | awk "{print $serial_time / $elapsed_time}")
+}
diff --git a/lib/keystone b/lib/keystone
index d4c7b063bb..66e867ca68 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -318,25 +318,25 @@ function create_keystone_accounts {
     local admin_role="admin"
     local member_role="member"
 
-    get_or_add_user_domain_role $admin_role $admin_user default
+    async_run ks-domain-role get_or_add_user_domain_role $admin_role $admin_user default
 
     # Create service project/role
     get_or_create_domain "$SERVICE_DOMAIN_NAME"
-    get_or_create_project "$SERVICE_PROJECT_NAME" "$SERVICE_DOMAIN_NAME"
+    async_run ks-project get_or_create_project "$SERVICE_PROJECT_NAME" "$SERVICE_DOMAIN_NAME"
 
     # Service role, so service users do not have to be admins
-    get_or_create_role service
+    async_run ks-service get_or_create_role service
 
     # The ResellerAdmin role is used by Nova and Ceilometer so we need to keep it.
     # The admin role in swift allows a user to act as an admin for their project,
     # but ResellerAdmin is needed for a user to act as any project. The name of this
     # role is also configurable in swift-proxy.conf
-    get_or_create_role ResellerAdmin
+    async_run ks-reseller get_or_create_role ResellerAdmin
 
     # another_role demonstrates that an arbitrary role may be created and used
     # TODO(sleepsonthefloor): show how this can be used for rbac in the future!
     local another_role="anotherrole"
-    get_or_create_role $another_role
+    async_run ks-anotherrole get_or_create_role $another_role
 
     # invisible project - admin can't see this one
     local invis_project
@@ -349,10 +349,12 @@ function create_keystone_accounts {
     demo_user=$(get_or_create_user "demo" \
         "$ADMIN_PASSWORD" "default" "demo@example.com")
 
-    get_or_add_user_project_role $member_role $demo_user $demo_project
-    get_or_add_user_project_role $admin_role $admin_user $demo_project
-    get_or_add_user_project_role $another_role $demo_user $demo_project
-    get_or_add_user_project_role $member_role $demo_user $invis_project
+    async_wait ks-{domain-role,domain,project,service,reseller,anotherrole}
+
+    async_run ks-demo-member get_or_add_user_project_role $member_role $demo_user $demo_project
+    async_run ks-demo-admin get_or_add_user_project_role $admin_role $admin_user $demo_project
+    async_run ks-demo-another get_or_add_user_project_role $another_role $demo_user $demo_project
+    async_run ks-demo-invis get_or_add_user_project_role $member_role $demo_user $invis_project
 
     # alt_demo
     local alt_demo_project
@@ -361,9 +363,9 @@ function create_keystone_accounts {
     alt_demo_user=$(get_or_create_user "alt_demo" \
         "$ADMIN_PASSWORD" "default" "alt_demo@example.com")
 
-    get_or_add_user_project_role $member_role $alt_demo_user $alt_demo_project
-    get_or_add_user_project_role $admin_role $admin_user $alt_demo_project
-    get_or_add_user_project_role $another_role $alt_demo_user $alt_demo_project
+    async_run ks-alt-member get_or_add_user_project_role $member_role $alt_demo_user $alt_demo_project
+    async_run ks-alt-admin get_or_add_user_project_role $admin_role $admin_user $alt_demo_project
+    async_run ks-alt-another get_or_add_user_project_role $another_role $alt_demo_user $alt_demo_project
 
     # groups
     local admin_group
@@ -373,11 +375,15 @@ function create_keystone_accounts {
     non_admin_group=$(get_or_create_group "nonadmins" \
         "default" "non-admin group")
 
-    get_or_add_group_project_role $member_role $non_admin_group $demo_project
-    get_or_add_group_project_role $another_role $non_admin_group $demo_project
-    get_or_add_group_project_role $member_role $non_admin_group $alt_demo_project
-    get_or_add_group_project_role $another_role $non_admin_group $alt_demo_project
-    get_or_add_group_project_role $admin_role $admin_group $admin_project
+    async_run ks-group-memberdemo get_or_add_group_project_role $member_role $non_admin_group $demo_project
+    async_run ks-group-anotherdemo get_or_add_group_project_role $another_role $non_admin_group $demo_project
+    async_run ks-group-memberalt get_or_add_group_project_role $member_role $non_admin_group $alt_demo_project
+    async_run ks-group-anotheralt get_or_add_group_project_role $another_role $non_admin_group $alt_demo_project
+    async_run ks-group-admin get_or_add_group_project_role $admin_role $admin_group $admin_project
+
+    async_wait ks-demo-{member,admin,another,invis}
+    async_wait ks-alt-{member,admin,another}
+    async_wait ks-group-{memberdemo,anotherdemo,memberalt,anotheralt,admin}
 
     if is_service_enabled ldap; then
         create_ldap_domain
diff --git a/lib/nova b/lib/nova
index d7426039c4..0a28cd97aa 100644
--- a/lib/nova
+++ b/lib/nova
@@ -741,31 +741,36 @@ function create_nova_keys_dir {
     sudo install -d -o $STACK_USER ${NOVA_STATE_PATH} ${NOVA_STATE_PATH}/keys
 }
 
+function init_nova_db {
+    local dbname="$1"
+    local conffile="$2"
+    recreate_database $dbname
+    $NOVA_BIN_DIR/nova-manage --config-file $conffile db sync --local_cell
+}
+
 # init_nova() - Initialize databases, etc.
 function init_nova {
     # All nova components talk to a central database.
     # Only do this step once on the API node for an entire cluster.
     if is_service_enabled $DATABASE_BACKENDS && is_service_enabled n-api; then
+        # (Re)create nova databases
+        async_run nova-cell-0 init_nova_db nova_cell0 $NOVA_CONF
+        for i in $(seq 1 $NOVA_NUM_CELLS); do
+            async_run nova-cell-$i init_nova_db nova_cell${i} $(conductor_conf $i)
+        done
+
         recreate_database $NOVA_API_DB
         $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF api_db sync
 
-        recreate_database nova_cell0
-
         # map_cell0 will create the cell mapping record in the nova_api DB so
-        # this needs to come after the api_db sync happens. We also want to run
-        # this before the db sync below since that will migrate both the nova
-        # and nova_cell0 databases.
+        # this needs to come after the api_db sync happens.
         $NOVA_BIN_DIR/nova-manage cell_v2 map_cell0 --database_connection `database_connection_url nova_cell0`
 
-        # (Re)create nova databases
-        for i in $(seq 1 $NOVA_NUM_CELLS); do
-            recreate_database nova_cell${i}
-            $NOVA_BIN_DIR/nova-manage --config-file $(conductor_conf $i) db sync --local_cell
+        # Wait for DBs to finish from above
+        for i in $(seq 0 $NOVA_NUM_CELLS); do
+            async_wait nova-cell-$i
         done
 
-        # Migrate nova and nova_cell0 databases.
-        $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF db sync
-
         # Run online migrations on the new databases
         # Needed for flavor conversion
         $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF db online_data_migrations
diff --git a/stack.sh b/stack.sh
index 036afd7b00..dcfef6db48 100755
--- a/stack.sh
+++ b/stack.sh
@@ -330,6 +330,9 @@ if [[ ! -d $DATA_DIR ]]; then
     safe_chmod 0755 $DATA_DIR
 fi
 
+# Create and/or clean the async state directory
+async_init
+
 # Configure proper hostname
 # Certain services such as rabbitmq require that the local hostname resolves
 # correctly.  Make sure it exists in /etc/hosts so that is always true.
@@ -1082,19 +1085,19 @@ if is_service_enabled keystone; then
 
     create_keystone_accounts
     if is_service_enabled nova; then
-        create_nova_accounts
+        async_runfunc create_nova_accounts
     fi
     if is_service_enabled glance; then
-        create_glance_accounts
+        async_runfunc create_glance_accounts
     fi
     if is_service_enabled cinder; then
-        create_cinder_accounts
+        async_runfunc create_cinder_accounts
     fi
     if is_service_enabled neutron; then
-        create_neutron_accounts
+        async_runfunc create_neutron_accounts
     fi
     if is_service_enabled swift; then
-        create_swift_accounts
+        async_runfunc create_swift_accounts
     fi
 
 fi
@@ -1107,9 +1110,11 @@ write_clouds_yaml
 
 if is_service_enabled horizon; then
     echo_summary "Configuring Horizon"
-    configure_horizon
+    async_runfunc configure_horizon
 fi
 
+async_wait create_nova_accounts create_glance_accounts create_cinder_accounts
+async_wait create_neutron_accounts create_swift_accounts configure_horizon
 
 # Glance
 # ------
@@ -1117,7 +1122,7 @@ fi
 # NOTE(yoctozepto): limited to node hosting the database which is the controller
 if is_service_enabled $DATABASE_BACKENDS && is_service_enabled glance; then
     echo_summary "Configuring Glance"
-    init_glance
+    async_runfunc init_glance
 fi
 
 
@@ -1131,7 +1136,7 @@ if is_service_enabled neutron; then
 
     # Run init_neutron only on the node hosting the Neutron API server
     if is_service_enabled $DATABASE_BACKENDS && is_service_enabled neutron; then
-        init_neutron
+        async_runfunc init_neutron
     fi
 fi
 
@@ -1161,7 +1166,7 @@ fi
 
 if is_service_enabled swift; then
     echo_summary "Configuring Swift"
-    init_swift
+    async_runfunc init_swift
 fi
 
 
@@ -1170,7 +1175,7 @@ fi
 
 if is_service_enabled cinder; then
     echo_summary "Configuring Cinder"
-    init_cinder
+    async_runfunc init_cinder
 fi
 
 # Placement Service
@@ -1178,9 +1183,16 @@ fi
 
 if is_service_enabled placement; then
     echo_summary "Configuring placement"
-    init_placement
+    async_runfunc init_placement
 fi
 
+# Wait for neutron and placement before starting nova
+async_wait init_neutron
+async_wait init_placement
+async_wait init_glance
+async_wait init_swift
+async_wait init_cinder
+
 # Compute Service
 # ---------------
 
@@ -1192,7 +1204,7 @@ if is_service_enabled nova; then
     # TODO(stephenfin): Is it possible for neutron to *not* be enabled now? If
     # not, remove the if here
     if is_service_enabled neutron; then
-        configure_neutron_nova
+        async_runfunc configure_neutron_nova
     fi
 fi
 
@@ -1236,6 +1248,8 @@ if is_service_enabled cinder; then
     iniset $CINDER_CONF key_manager fixed_key "$FIXED_KEY"
 fi
 
+async_wait configure_neutron_nova
+
 # Launch the nova-api and wait for it to answer before continuing
 if is_service_enabled n-api; then
     echo_summary "Starting Nova API"
@@ -1282,7 +1296,7 @@ fi
 if is_service_enabled nova; then
     echo_summary "Starting Nova"
     start_nova
-    create_flavors
+    async_runfunc create_flavors
 fi
 if is_service_enabled cinder; then
     echo_summary "Starting Cinder"
@@ -1331,6 +1345,8 @@ if is_service_enabled horizon; then
     start_horizon
 fi
 
+async_wait create_flavors
+
 
 # Create account rc files
 # =======================
@@ -1467,8 +1483,12 @@ else
     exec 1>&3
 fi
 
+# Make sure we didn't leak any background tasks
+async_cleanup
+
 # Dump out the time totals
 time_totals
+async_print_timing
 
 # Using the cloud
 # ===============
diff --git a/unstack.sh b/unstack.sh
index 3197cf136f..d9dca7c107 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -184,3 +184,4 @@ if is_service_enabled cinder && is_package_installed lvm2; then
 fi
 
 clean_pyc_files
+rm -Rf $DEST/async

From e11d367d8e31a4875301e2e890fa8ffede270ec2 Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Wed, 30 Sep 2020 13:06:39 +0100
Subject: [PATCH 1832/2409] orchestrate-devstack: Copy controller ceph.conf and
 keyrings to subnode

This change introduces a basic role to copy the contents of /etc/ceph
between the controller and subnodes during orchestrate-devstack allowing
a multinode ceph job to be introduced by
I9ffdff44a3ad42ebdf26ab72e24dfe3b12b1ef8b.

Note that this role is only used when devstack-plugin-ceph is enabled.

Change-Id: I324c0f35db34f8540ca164bf8c6e3dea67c5b1b4
---
 roles/orchestrate-devstack/tasks/main.yaml        |  5 +++++
 .../sync-controller-ceph-conf-and-keys/README.rst |  3 +++
 .../tasks/main.yaml                               | 15 +++++++++++++++
 3 files changed, 23 insertions(+)
 create mode 100644 roles/sync-controller-ceph-conf-and-keys/README.rst
 create mode 100644 roles/sync-controller-ceph-conf-and-keys/tasks/main.yaml

diff --git a/roles/orchestrate-devstack/tasks/main.yaml b/roles/orchestrate-devstack/tasks/main.yaml
index f747943f3c..2b8ae01a62 100644
--- a/roles/orchestrate-devstack/tasks/main.yaml
+++ b/roles/orchestrate-devstack/tasks/main.yaml
@@ -18,6 +18,11 @@
       name: sync-devstack-data
     when: devstack_services['tls-proxy']|default(false)
 
+  - name: Sync controller ceph.conf and key rings to subnode
+    include_role:
+      name: sync-controller-ceph-conf-and-keys
+    when: devstack_plugins is defined and 'devstack-plugin-ceph' in devstack_plugins
+
   - name: Run devstack on the sub-nodes
     include_role:
       name: run-devstack
diff --git a/roles/sync-controller-ceph-conf-and-keys/README.rst b/roles/sync-controller-ceph-conf-and-keys/README.rst
new file mode 100644
index 0000000000..e3d2bb42a4
--- /dev/null
+++ b/roles/sync-controller-ceph-conf-and-keys/README.rst
@@ -0,0 +1,3 @@
+Sync ceph config and keys between controller and subnodes
+
+Simply copy the contents of /etc/ceph on the controller to subnodes.
diff --git a/roles/sync-controller-ceph-conf-and-keys/tasks/main.yaml b/roles/sync-controller-ceph-conf-and-keys/tasks/main.yaml
new file mode 100644
index 0000000000..71ece579e6
--- /dev/null
+++ b/roles/sync-controller-ceph-conf-and-keys/tasks/main.yaml
@@ -0,0 +1,15 @@
+- name: Ensure /etc/ceph exists on subnode
+  become: true
+  file:
+    path: /etc/ceph
+    state: directory
+
+- name: Copy /etc/ceph from controller to subnode
+  become: true
+  synchronize:
+    owner: yes
+    group: yes
+    perms: yes
+    src: /etc/ceph/
+    dest: /etc/ceph/
+  delegate_to: controller

From b516efedf973d290c22c9279cf83d2dd47dc37fc Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Mon, 15 Feb 2021 10:11:43 +0000
Subject: [PATCH 1833/2409] nova: Default NOVA_USE_SERVICE_TOKEN to True

Introduced in devstack by I2d7348c4a72af96c0ed2ef6c0ab75d16e9aec8fc and
long tested by nova-next this enabled by most deployment tools by
default now and should be enabled by default in devstack.

Change-Id: Ia76b96fe87d99560db947a59cd0660aab9b05335
---
 lib/nova | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index 0a28cd97aa..1999753a8c 100644
--- a/lib/nova
+++ b/lib/nova
@@ -135,7 +135,7 @@ fi
 # ``NOVA_USE_SERVICE_TOKEN`` is a mode where service token is passed along with
 # user token while communicating to external RESP API's like Neutron, Cinder
 # and Glance.
-NOVA_USE_SERVICE_TOKEN=$(trueorfalse False NOVA_USE_SERVICE_TOKEN)
+NOVA_USE_SERVICE_TOKEN=$(trueorfalse True NOVA_USE_SERVICE_TOKEN)
 
 # ``NOVA_ALLOW_MOVE_TO_SAME_HOST`` can be set to False in multi node DevStack,
 # where there are at least two nova-computes.

From 57b092dbceb95ed03f8d33f64a5cc60eabd57e50 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Mon, 8 Feb 2021 11:37:38 -0600
Subject: [PATCH 1834/2409] Stop configure 'member' role in tempest_roles

Config option auth.tempest_roles is used to set the
extra roles to all dynamic cred tests users.
- https://opendev.org/openstack/tempest/src/commit/9b6f441fdc2a970410ea631dc1318896349e010f/tempest/common/credentials_factory.py#L82

Devstack set the 'member' role in CONF.auth.tempest_roles
- https://opendev.org/openstack/devstack/src/commit/556f84aea90c572873fc9834292635b41e590224/lib/tempest#L628

This cause issue if any tests testing for speciifc rols and want
to exclude the 'member' role, basically this bug
- https://bugs.launchpad.net/devstack/+bug/1915740

Also with 'member' role assigned by default, Tempest will not be
able to test the secure RBAC new default 'reader' role.

Let's remove  this role assignment now and let test congfigure what
they want.

Closes-Bug: #1915740

Change-Id: I0b6ab9fb943c7b0925a0a0d2490a8bcdfa76cedc
---
 lib/tempest | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index 8ee986d555..04540e5ea8 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -625,7 +625,6 @@ function configure_tempest {
     rm -f $tmp_u_c_m
 
     # Auth:
-    iniset $TEMPEST_CONFIG auth tempest_roles "member"
     if [[ $TEMPEST_USE_TEST_ACCOUNTS == "True" ]]; then
         if [[ $TEMPEST_HAS_ADMIN == "True" ]]; then
             tox -evenv-tempest -- tempest account-generator -c $TEMPEST_CONFIG --os-username $admin_username --os-password "$password" --os-project-name $admin_project_name -r $TEMPEST_CONCURRENCY --with-admin etc/accounts.yaml

From 48b7633ae84c5be77c6415d7f95ca696e4c0a2b6 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Tue, 16 Feb 2021 14:14:23 -0800
Subject: [PATCH 1835/2409] Fix nova db dependency

When I reordered the nova database creation for better performance
and cleaner arrangement, I broke the non-standard arrangement where
the super and cell conductors are squashed together. In devstack,
this is implemented by pointing the controllers at cell1 in the
config, which makes it hard to create and sync the databases in the
natural order. This manifested in a failure when running in this
mode (which apparently Trove is).

As a quick fix, this special-cases the setup for cell0 if that mode
is enabled. I will follow this up with a cleaner refactor of all that
stuff so this hack isn't required, but that will take a bit longer.

Change-Id: I5385157c281beb041bf67cba546be20cf9497cbe
---
 lib/nova | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index 0a28cd97aa..6913040d26 100644
--- a/lib/nova
+++ b/lib/nova
@@ -754,7 +754,17 @@ function init_nova {
     # Only do this step once on the API node for an entire cluster.
     if is_service_enabled $DATABASE_BACKENDS && is_service_enabled n-api; then
         # (Re)create nova databases
-        async_run nova-cell-0 init_nova_db nova_cell0 $NOVA_CONF
+        if [[ "$CELLSV2_SETUP" == "singleconductor" ]]; then
+            # If we are doing singleconductor mode, we have some strange
+            # interdependencies. in that the main config refers to cell1
+            # instead of cell0. In that case, just make sure the cell0 database
+            # is created before we need it below, but don't db_sync it until
+            # after the cellN databases are there.
+            recreate_database nova_cell0
+        else
+            async_run nova-cell-0 init_nova_db nova_cell0 $NOVA_CONF
+        fi
+
         for i in $(seq 1 $NOVA_NUM_CELLS); do
             async_run nova-cell-$i init_nova_db nova_cell${i} $(conductor_conf $i)
         done
@@ -771,6 +781,11 @@ function init_nova {
             async_wait nova-cell-$i
         done
 
+        if [[ "$CELLSV2_SETUP" == "singleconductor" ]]; then
+            # We didn't db sync cell0 above, so run it now
+            $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF db sync
+        fi
+
         # Run online migrations on the new databases
         # Needed for flavor conversion
         $NOVA_BIN_DIR/nova-manage --config-file $NOVA_CONF db online_data_migrations

From f361122798b9e3163790bee81abfa0486746fa8a Mon Sep 17 00:00:00 2001
From: Pierre Riteau <pierre@stackhpc.com>
Date: Wed, 17 Feb 2021 17:43:13 +0100
Subject: [PATCH 1836/2409] Fix DevStack setup on CentOS 8.3

CentOS 8.3 changed the name of the PowerTools repository to powertools:
https://wiki.centos.org/Manuals/ReleaseNotes/CentOS8.2011#Yum_repo_file_and_repoid_changes

With this repository disabled, DevStack fails to install libyaml-devel,
which causes a failure to install many packages. In my environment
DevStack stopped with an error caused by a missing wget.

Keep the command using the old repository name, for compatibility with
older CentOS releases.

Change-Id: I5541a8aee8467abf10ce8a10d770618bdd693f02
---
 stack.sh | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/stack.sh b/stack.sh
index d3c1476429..6375c8e5e0 100755
--- a/stack.sh
+++ b/stack.sh
@@ -365,6 +365,9 @@ if [[ $DISTRO == "rhel8" ]]; then
     # EPEL packages assume that the PowerTools repository is enable.
     sudo dnf config-manager --set-enabled PowerTools
 
+    # CentOS 8.3 changed the repository name to lower case.
+    sudo dnf config-manager --set-enabled powertools
+
     if [[ ${SKIP_EPEL_INSTALL} != True ]]; then
         _install_epel
     fi

From 3bdc8f66ad243f7487ba494e6a71f63c4965413a Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Tue, 9 Feb 2021 12:56:34 -0600
Subject: [PATCH 1837/2409] Add a variable to configure the Tempest venv upper
 constraints

We use Tempest master for testing the supported stable
branches so using master upper constraints works fine but
when we need to use old Tempest in the below cases then master
upper constraints do not work and devstack will not be
able to install Tempest in vnenv:

- Testing Extended Maintenance branch
- Testing py2.7 jobs until stable/train with in-tree tempest plugins

This commit adds a variable to set the compatible upper constraint
to use for Tempest's old version.

Few of the current failure which can be fixed by this new configurable var:
- networking-generic-switch-tempest-dlm-python2
  - https://zuul.opendev.org/t/openstack/build/ebcf3d68d62c4af3a43a222aa9ce5556
- devstack-platform-xenial on stable/steinand stable/train
  - https://zuul.opendev.org/t/openstack/build/37ffc1af6f3f4b44b5ca8cbfa27068ac

Change-Id: I5b2217d85e6871ca3f7a3f6f859fdce9a50d3946
---
 lib/tempest | 28 +++++++++++++++++++++++-----
 stackrc     |  1 +
 2 files changed, 24 insertions(+), 5 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 8ee986d555..77197c2a28 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -111,6 +111,21 @@ function image_size_in_gib {
     echo $size | python3 -c "import math; print(int(math.ceil(float(int(input()) / 1024.0 ** 3))))"
 }
 
+function set_tempest_venv_constraints {
+    local tmp_c
+    tmp_c=$1
+    if [[ $TEMPEST_VENV_UPPER_CONSTRAINTS == "master" ]]; then
+        (cd $REQUIREMENTS_DIR && git show origin/master:upper-constraints.txt) > $tmp_c
+    else
+        echo "Using $TEMPEST_VENV_UPPER_CONSTRAINTS constraints in Tempest virtual env."
+        cat $TEMPEST_VENV_UPPER_CONSTRAINTS > $tmp_c
+        # NOTE: setting both tox env var and once Tempest start using new var
+        # TOX_CONSTRAINTS_FILE then we can remove the old one.
+        export UPPER_CONSTRAINTS_FILE=$TEMPEST_VENV_UPPER_CONSTRAINTS
+        export TOX_CONSTRAINTS_FILE=$TEMPEST_VENV_UPPER_CONSTRAINTS
+    fi
+}
+
 # configure_tempest() - Set config files, create data dirs, etc
 function configure_tempest {
     if [[ "$INSTALL_TEMPEST" == "True" ]]; then
@@ -617,10 +632,9 @@ function configure_tempest {
         tox -revenv-tempest --notest
     fi
 
-    # The requirements might be on a different branch, while tempest needs master requirements.
     local tmp_u_c_m
     tmp_u_c_m=$(mktemp -t tempest_u_c_m.XXXXXXXXXX)
-    (cd $REQUIREMENTS_DIR && git show origin/master:upper-constraints.txt) > $tmp_u_c_m
+    set_tempest_venv_constraints $tmp_u_c_m
     tox -evenv-tempest -- pip install -c $tmp_u_c_m -r requirements.txt
     rm -f $tmp_u_c_m
 
@@ -702,6 +716,10 @@ function install_tempest {
     # TEMPEST_DIR already exist until RECLONE is true.
     git checkout $TEMPEST_BRANCH
 
+    local tmp_u_c_m
+    tmp_u_c_m=$(mktemp -t tempest_u_c_m.XXXXXXXXXX)
+    set_tempest_venv_constraints $tmp_u_c_m
+
     tox -r --notest -efull
     # TODO: remove the trailing pip constraint when a proper fix
     # arrives for bug https://bugs.launchpad.net/devstack/+bug/1906322
@@ -709,8 +727,9 @@ function install_tempest {
     # NOTE(mtreinish) Respect constraints in the tempest full venv, things that
     # are using a tox job other than full will not be respecting constraints but
     # running pip install -U on tempest requirements
-    $TEMPEST_DIR/.tox/tempest/bin/pip install -c $REQUIREMENTS_DIR/upper-constraints.txt -r requirements.txt
+    $TEMPEST_DIR/.tox/tempest/bin/pip install -c $tmp_u_c_m -r requirements.txt
     PROJECT_VENV["tempest"]=${TEMPEST_DIR}/.tox/tempest
+    rm -f $tmp_u_c_m
     popd
 }
 
@@ -718,10 +737,9 @@ function install_tempest {
 function install_tempest_plugins {
     pushd $TEMPEST_DIR
     if [[ $TEMPEST_PLUGINS != 0 ]] ; then
-        # The requirements might be on a different branch, while tempest & tempest plugins needs master requirements.
         local tmp_u_c_m
         tmp_u_c_m=$(mktemp -t tempest_u_c_m.XXXXXXXXXX)
-        (cd $REQUIREMENTS_DIR && git show origin/master:upper-constraints.txt) > $tmp_u_c_m
+        set_tempest_venv_constraints $tmp_u_c_m
         tox -evenv-tempest -- pip install -c $tmp_u_c_m $TEMPEST_PLUGINS
         rm -f $tmp_u_c_m
         echo "Checking installed Tempest plugins:"
diff --git a/stackrc b/stackrc
index a36f8970e6..244acbbbb0 100644
--- a/stackrc
+++ b/stackrc
@@ -298,6 +298,7 @@ REQUIREMENTS_BRANCH=${REQUIREMENTS_BRANCH:-$TARGET_BRANCH}
 # Tempest test suite
 TEMPEST_REPO=${TEMPEST_REPO:-${GIT_BASE}/openstack/tempest.git}
 TEMPEST_BRANCH=${TEMPEST_BRANCH:-$BRANCHLESS_TARGET_BRANCH}
+TEMPEST_VENV_UPPER_CONSTRAINTS=${TEMPEST_VENV_UPPER_CONSTRAINTS:-master}
 
 
 ##############

From 8903d8c1e211607ce6bf86ff974f90717e8e2cac Mon Sep 17 00:00:00 2001
From: Lucas Alvares Gomes <lucasagomes@gmail.com>
Date: Fri, 15 Jan 2021 09:26:44 +0000
Subject: [PATCH 1838/2409] [OVN] Fix Fedora/CentOS OVN configuration

When installing OVN from packages, the rpm for Fedora / CentOS pre set
some configurations that conflicts with the post configuration done by
DevStack.

This patch fixes this problem by erasing the pre-set configuration from
the packages and leaving it to DevStack to configure OVN for its use
(just like we would do when compiling it from source).

Change-Id: I9c18023c9aa79c0633748a6169f4f283e9d74ef0
Signed-off-by: Lucas Alvares Gomes <lucasagomes@gmail.com>
---
 lib/neutron_plugins/ovn_agent | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index b661f593a4..0a8ca9761f 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -529,6 +529,14 @@ function configure_ovn {
         fi
     fi
 
+    # Erase the pre-set configurations from packages. DevStack will
+    # configure OVS and OVN accordingly for its use.
+    if [[ "$OVN_BUILD_FROM_SOURCE" == "False" ]] && is_fedora; then
+        sudo truncate -s 0 /etc/openvswitch/default.conf
+        sudo truncate -s 0 /etc/sysconfig/openvswitch
+        sudo truncate -s 0 /etc/sysconfig/ovn
+    fi
+
     # Metadata
     if is_service_enabled q-ovn-metadata-agent && is_service_enabled ovn-controller; then
         sudo install -d -o $STACK_USER $NEUTRON_CONF_DIR

From 8f3e51d79f392151023f3853a6c8a3f7b868ecfa Mon Sep 17 00:00:00 2001
From: Stephen Finucane <sfinucan@redhat.com>
Date: Tue, 2 Mar 2021 16:18:48 +0000
Subject: [PATCH 1839/2409] nova: Die if console TLS enabled with tls-proxy

We require the 'tls-proxy' service to set up certificates for us. Hard
fail if 'NOVA_CONSOLE_PROXY_COMPUTE_TLS' is enabled but the 'tls-proxy'
service is not.

Change-Id: I52fec12b78ecd8f76f835551ccb84dfb1d5b3d8a
Signed-off-by: Stephen Finucane <sfinucan@redhat.com>
---
 lib/nova | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/lib/nova b/lib/nova
index 6913040d26..28d3ba45d7 100644
--- a/lib/nova
+++ b/lib/nova
@@ -83,6 +83,11 @@ fi
 # services and the compute node
 NOVA_CONSOLE_PROXY_COMPUTE_TLS=${NOVA_CONSOLE_PROXY_COMPUTE_TLS:-False}
 
+# Validate configuration
+if ! is_service_enabled tls-proxy && [ "$NOVA_CONSOLE_PROXY_COMPUTE_TLS" == "True" ]; then
+    die $LINENO "enabling TLS for the console proxy requires the tls-proxy service"
+fi
+
 # Public facing bits
 NOVA_SERVICE_HOST=${NOVA_SERVICE_HOST:-$SERVICE_HOST}
 NOVA_SERVICE_PORT=${NOVA_SERVICE_PORT:-8774}

From f548ce4816b58d7e65d64fc22a1066f1aea63824 Mon Sep 17 00:00:00 2001
From: Akihiro Motoki <amotoki@gmail.com>
Date: Thu, 4 Mar 2021 10:31:30 +0900
Subject: [PATCH 1840/2409] Allow to install os-ken from git repo

os-ken is used by neutron ML2/OVS agent.
We need to install os-ken from source to test os-ken changes
against neutron. We already have tempest-integrated-networking job
in os-ken repo but it turns out it consumes os-ken from PyPI :-(

Change-Id: Ibcff212591e9fed25f1316403627269d81455b09
---
 lib/neutron_plugins/openvswitch_agent | 4 ++++
 stackrc                               | 5 +++++
 tests/test_libs_from_pypi.sh          | 2 +-
 3 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/openvswitch_agent b/lib/neutron_plugins/openvswitch_agent
index 100961196d..7fed8bf853 100644
--- a/lib/neutron_plugins/openvswitch_agent
+++ b/lib/neutron_plugins/openvswitch_agent
@@ -15,6 +15,10 @@ function neutron_plugin_create_nova_conf {
 
 function neutron_plugin_install_agent_packages {
     _neutron_ovs_base_install_agent_packages
+    if use_library_from_git "os-ken"; then
+        git_clone_by_name "os-ken"
+        setup_dev_lib "os-ken"
+    fi
 }
 
 function neutron_plugin_configure_dhcp_agent {
diff --git a/stackrc b/stackrc
index a36f8970e6..2b1511d04f 100644
--- a/stackrc
+++ b/stackrc
@@ -554,6 +554,11 @@ GITREPO["ovsdbapp"]=${OVSDBAPP_REPO:-${GIT_BASE}/openstack/ovsdbapp.git}
 GITBRANCH["ovsdbapp"]=${OVSDBAPP_BRANCH:-$TARGET_BRANCH}
 GITDIR["ovsdbapp"]=$DEST/ovsdbapp
 
+# os-ken used by neutron
+GITREPO["os-ken"]=${OS_KEN_REPO:-${GIT_BASE}/openstack/os-ken.git}
+GITBRANCH["os-ken"]=${OS_KEN_BRANCH:-$TARGET_BRANCH}
+GITDIR["os-ken"]=$DEST/os-ken
+
 ##################
 #
 #  TripleO / Heat Agent Components
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index ab7583d042..5b53389073 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -44,7 +44,7 @@ ALL_LIBS+=" debtcollector os-brick os-traits automaton futurist oslo.service"
 ALL_LIBS+=" oslo.cache oslo.reports osprofiler cursive"
 ALL_LIBS+=" keystoneauth ironic-lib neutron-lib oslo.privsep"
 ALL_LIBS+=" diskimage-builder os-vif python-brick-cinderclient-ext"
-ALL_LIBS+=" castellan python-barbicanclient ovsdbapp"
+ALL_LIBS+=" castellan python-barbicanclient ovsdbapp os-ken"
 
 # Generate the above list with
 # echo ${!GITREPO[@]}

From 3c6d1059298788d4ce35845fdb1bef2938046702 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <sfinucan@redhat.com>
Date: Tue, 2 Mar 2021 16:35:47 +0000
Subject: [PATCH 1841/2409] nova: Remove nova-xvpvncproxy

This was removed this service from nova in Ussuri [1]. There's no need
to keep this around.

[1] I2f7f2379d0cd54e4d0a91008ddb44858cfc5a4cf

Change-Id: Idc95c6467a8c6e0c0ed07a6458425ff0a10ff995
Signed-off-by: Stephen Finucane <sfinucan@redhat.com>
---
 lib/nova | 34 ++++++++++++++--------------------
 1 file changed, 14 insertions(+), 20 deletions(-)

diff --git a/lib/nova b/lib/nova
index 28d3ba45d7..caa778060f 100644
--- a/lib/nova
+++ b/lib/nova
@@ -612,10 +612,10 @@ function configure_console_compute {
     # can use the NOVA_CPU_CELL variable to know which cell we are for
     # calculating the offset.
     # Stagger the offset based on the total number of possible console proxies
-    # (novnc, xvpvnc, spice, serial) so that their ports will not collide if
+    # (novnc, spice, serial) so that their ports will not collide if
     # all are enabled.
     local offset
-    offset=$(((NOVA_CPU_CELL - 1) * 4))
+    offset=$(((NOVA_CPU_CELL - 1) * 3))
 
     # Use the host IP instead of the service host because for multi-node, the
     # service host will be the controller only.
@@ -623,7 +623,7 @@ function configure_console_compute {
     default_proxyclient_addr=$(iniget $NOVA_CPU_CONF DEFAULT my_ip)
 
     # All nova-compute workers need to know the vnc configuration options
-    # These settings don't hurt anything if n-xvnc and n-novnc are disabled
+    # These settings don't hurt anything if n-novnc is disabled
     if is_service_enabled n-cpu; then
         if [ "$NOVNC_FROM_PACKAGE" == "True" ]; then
             # Use the old URL when installing novnc packages.
@@ -636,13 +636,11 @@ function configure_console_compute {
             NOVNCPROXY_URL=${NOVNCPROXY_URL:-"http://$SERVICE_HOST:$((6080 + offset))/vnc_lite.html"}
         fi
         iniset $NOVA_CPU_CONF vnc novncproxy_base_url "$NOVNCPROXY_URL"
-        XVPVNCPROXY_URL=${XVPVNCPROXY_URL:-"http://$SERVICE_HOST:$((6081 + offset))/console"}
-        iniset $NOVA_CPU_CONF vnc xvpvncproxy_base_url "$XVPVNCPROXY_URL"
-        SPICEHTML5PROXY_URL=${SPICEHTML5PROXY_URL:-"http://$SERVICE_HOST:$((6082 + offset))/spice_auto.html"}
+        SPICEHTML5PROXY_URL=${SPICEHTML5PROXY_URL:-"http://$SERVICE_HOST:$((6081 + offset))/spice_auto.html"}
         iniset $NOVA_CPU_CONF spice html5proxy_base_url "$SPICEHTML5PROXY_URL"
     fi
 
-    if is_service_enabled n-novnc || is_service_enabled n-xvnc || [ "$NOVA_VNC_ENABLED" != False ]; then
+    if is_service_enabled n-novnc || [ "$NOVA_VNC_ENABLED" != False ]; then
         # Address on which instance vncservers will listen on compute hosts.
         # For multi-host, this should be the management ip of the compute host.
         VNCSERVER_LISTEN=${VNCSERVER_LISTEN:-$NOVA_SERVICE_LISTEN_ADDRESS}
@@ -665,7 +663,7 @@ function configure_console_compute {
 
     if is_service_enabled n-sproxy; then
         iniset $NOVA_CPU_CONF serial_console enabled True
-        iniset $NOVA_CPU_CONF serial_console base_url "ws://$SERVICE_HOST:$((6083 + offset))/"
+        iniset $NOVA_CPU_CONF serial_console base_url "ws://$SERVICE_HOST:$((6082 + offset))/"
     fi
 }
 
@@ -674,15 +672,13 @@ function configure_console_proxies {
     local conf=${1:-$NOVA_CONF}
     local offset=${2:-0}
     # Stagger the offset based on the total number of possible console proxies
-    # (novnc, xvpvnc, spice, serial) so that their ports will not collide if
+    # (novnc, spice, serial) so that their ports will not collide if
     # all are enabled.
-    offset=$((offset * 4))
+    offset=$((offset * 3))
 
-    if is_service_enabled n-novnc || is_service_enabled n-xvnc || [ "$NOVA_VNC_ENABLED" != False ]; then
+    if is_service_enabled n-novnc || [ "$NOVA_VNC_ENABLED" != False ]; then
         iniset $conf vnc novncproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
         iniset $conf vnc novncproxy_port $((6080 + offset))
-        iniset $conf vnc xvpvncproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
-        iniset $conf vnc xvpvncproxy_port $((6081 + offset))
 
         if is_nova_console_proxy_compute_tls_enabled ; then
             iniset $conf vnc auth_schemes "vencrypt"
@@ -714,12 +710,12 @@ function configure_console_proxies {
 
     if is_service_enabled n-spice; then
         iniset $conf spice html5proxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
-        iniset $conf spice html5proxy_port $((6082 + offset))
+        iniset $conf spice html5proxy_port $((6081 + offset))
     fi
 
     if is_service_enabled n-sproxy; then
         iniset $conf serial_console serialproxy_host "$NOVA_SERVICE_LISTEN_ADDRESS"
-        iniset $conf serial_console serialproxy_port $((6083 + offset))
+        iniset $conf serial_console serialproxy_port $((6082 + offset))
     fi
 }
 
@@ -986,7 +982,7 @@ function start_nova_rest {
 
 function enable_nova_console_proxies {
     for i in $(seq 1 $NOVA_NUM_CELLS); do
-        for srv in n-novnc n-xvnc n-spice n-sproxy; do
+        for srv in n-novnc n-spice n-sproxy; do
             if is_service_enabled $srv; then
                 enable_service ${srv}-cell${i}
             fi
@@ -1004,7 +1000,6 @@ function start_nova_console_proxies {
     # console proxies run globally for singleconductor, else they run per cell
     if [[ "${CELLSV2_SETUP}" == "singleconductor" ]]; then
         run_process n-novnc "$NOVA_BIN_DIR/nova-novncproxy --config-file $api_cell_conf --web $NOVNC_WEB_DIR"
-        run_process n-xvnc "$NOVA_BIN_DIR/nova-xvpvncproxy --config-file $api_cell_conf"
         run_process n-spice "$NOVA_BIN_DIR/nova-spicehtml5proxy --config-file $api_cell_conf --web $SPICE_WEB_DIR"
         run_process n-sproxy "$NOVA_BIN_DIR/nova-serialproxy --config-file $api_cell_conf"
     else
@@ -1013,7 +1008,6 @@ function start_nova_console_proxies {
             local conf
             conf=$(conductor_conf $i)
             run_process n-novnc-cell${i} "$NOVA_BIN_DIR/nova-novncproxy --config-file $conf --web $NOVNC_WEB_DIR"
-            run_process n-xvnc-cell${i} "$NOVA_BIN_DIR/nova-xvpvncproxy --config-file $conf"
             run_process n-spice-cell${i} "$NOVA_BIN_DIR/nova-spicehtml5proxy --config-file $conf --web $SPICE_WEB_DIR"
             run_process n-sproxy-cell${i} "$NOVA_BIN_DIR/nova-serialproxy --config-file $conf"
         done
@@ -1104,13 +1098,13 @@ function stop_nova_rest {
 
 function stop_nova_console_proxies {
     if [[ "${CELLSV2_SETUP}" == "singleconductor" ]]; then
-        for srv in n-novnc n-xvnc n-spice n-sproxy; do
+        for srv in n-novnc n-spice n-sproxy; do
             stop_process $srv
         done
     else
         enable_nova_console_proxies
         for i in $(seq 1 $NOVA_NUM_CELLS); do
-            for srv in n-novnc n-xvnc n-spice n-sproxy; do
+            for srv in n-novnc n-spice n-sproxy; do
                 stop_process ${srv}-cell${i}
             done
         done

From 970891a4ef863344fb1425727b3c3bf91b1c8bb5 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <sfinucan@redhat.com>
Date: Tue, 2 Mar 2021 16:45:39 +0000
Subject: [PATCH 1842/2409] Remove references to XenAPI driver

The XenAPI driver was removed during the Victoria release [1], while the
libvirt+xen driver has been removed in the Wallaby release [2]. Remove
references to Xen from DevStack since its all a no-op now.

[1] I42b302afbb1cfede7a0f7b16485a596cd70baf17
[2] I73305e82da5d8da548961b801a8e75fb0e8c4cf1

Change-Id: If7055feb88391f496a5e5e4c72008bf0050c5356
Signed-off-by: Stephen Finucane <sfinucan@redhat.com>
---
 HACKING.rst                           |   3 +-
 MAINTAINERS.rst                       |   4 -
 doc/source/configuration.rst          |   6 --
 doc/source/plugins.rst                |   2 +-
 functions                             |  25 ------
 functions-common                      |   2 -
 lib/cinder_plugins/XenAPINFS          |  46 -----------
 lib/glance                            |   4 -
 lib/nova                              |   8 --
 lib/nova_plugins/hypervisor-xenserver | 107 --------------------------
 lib/tempest                           |  14 +---
 stack.sh                              |  10 ---
 stackrc                               |  17 +---
 tools/image_list.sh                   |   2 +-
 tools/uec/meta.py                     |  42 ----------
 tools/xen/README.md                   |   3 -
 16 files changed, 6 insertions(+), 289 deletions(-)
 delete mode 100644 lib/cinder_plugins/XenAPINFS
 delete mode 100644 lib/nova_plugins/hypervisor-xenserver
 delete mode 100644 tools/uec/meta.py
 delete mode 100644 tools/xen/README.md

diff --git a/HACKING.rst b/HACKING.rst
index f55aed8a07..0c4de303ce 100644
--- a/HACKING.rst
+++ b/HACKING.rst
@@ -74,8 +74,7 @@ of test of specific fragile functions in the ``functions`` and
 
 ``tools`` - Contains a collection of stand-alone scripts. While these
 may reference the top-level DevStack configuration they can generally be
-run alone. There are also some sub-directories to support specific
-environments such as XenServer.
+run alone.
 
 
 Scripts
diff --git a/MAINTAINERS.rst b/MAINTAINERS.rst
index d4968a6051..3cf61a6875 100644
--- a/MAINTAINERS.rst
+++ b/MAINTAINERS.rst
@@ -77,10 +77,6 @@ SUSE
 Tempest
 ~~~~~~~
 
-Xen
-~~~
-* Bob Ball <bob.ball@citrix.com>
-
 Zaqar (Marconi)
 ~~~~~~~~~~~~~~~
 
diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 22f5999174..2d0c894530 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -628,12 +628,6 @@ outside of tox. If you would like to install it add the following to your
     INSTALL_TEMPEST=True
 
 
-Xenserver
-~~~~~~~~~
-
-If you would like to use Xenserver as the hypervisor, please refer to
-the instructions in ``./tools/xen/README.md``.
-
 Cinder
 ~~~~~~
 
diff --git a/doc/source/plugins.rst b/doc/source/plugins.rst
index a18a786c49..7d70d74dd0 100644
--- a/doc/source/plugins.rst
+++ b/doc/source/plugins.rst
@@ -241,7 +241,7 @@ locations in the top-level of the plugin repository:
   on Ubuntu, Debian or Linux Mint.
 
 - ``./devstack/files/rpms/$plugin_name`` - Packages to install when running
-  on Red Hat, Fedora, CentOS or XenServer.
+  on Red Hat, Fedora, or CentOS.
 
 - ``./devstack/files/rpms-suse/$plugin_name`` - Packages to install when
   running on SUSE Linux or openSUSE.
diff --git a/functions b/functions
index 89bbab2085..ccca5cda51 100644
--- a/functions
+++ b/functions
@@ -280,31 +280,6 @@ function upload_image {
         return
     fi
 
-    # XenServer-vhd-ovf-format images are provided as .vhd.tgz
-    # and should not be decompressed prior to loading
-    if [[ "$image_url" =~ '.vhd.tgz' ]]; then
-        image_name="${image_fname%.vhd.tgz}"
-        local force_vm_mode=""
-        if [[ "$image_name" =~ 'cirros' ]]; then
-            # Cirros VHD image currently only boots in PV mode.
-            # Nova defaults to PV for all VHD images, but
-            # the glance setting is needed for booting
-            # directly from volume.
-            force_vm_mode="vm_mode=xen"
-        fi
-        _upload_image "$image_name" ovf vhd "$image" $force_vm_mode
-        return
-    fi
-
-    # .xen-raw.tgz suggests a Xen capable raw image inside a tgz.
-    # and should not be decompressed prior to loading.
-    # Setting metadata, so PV mode is used.
-    if [[ "$image_url" =~ '.xen-raw.tgz' ]]; then
-        image_name="${image_fname%.xen-raw.tgz}"
-        _upload_image "$image_name" tgz raw "$image" vm_mode=xen
-        return
-    fi
-
     if [[ "$image_url" =~ '.hds' ]]; then
         image_name="${image_fname%.hds}"
         vm_mode=${image_name##*-}
diff --git a/functions-common b/functions-common
index 87d8c64804..340da754a2 100644
--- a/functions-common
+++ b/functions-common
@@ -397,8 +397,6 @@ function GetDistro {
         # Drop the . release as we assume it's compatible
         # XXX re-evaluate when we get RHEL10
         DISTRO="rhel${os_RELEASE::1}"
-    elif [[ "$os_VENDOR" =~ (XenServer) ]]; then
-        DISTRO="xs${os_RELEASE%.*}"
     else
         # We can't make a good choice here.  Setting a sensible DISTRO
         # is part of the problem, but not the major issue -- we really
diff --git a/lib/cinder_plugins/XenAPINFS b/lib/cinder_plugins/XenAPINFS
deleted file mode 100644
index 92135e7c4f..0000000000
--- a/lib/cinder_plugins/XenAPINFS
+++ /dev/null
@@ -1,46 +0,0 @@
-#!/bin/bash
-#
-# lib/cinder_plugins/XenAPINFS
-# Configure the XenAPINFS driver
-
-# Enable with:
-#
-#   CINDER_DRIVER=XenAPINFS
-
-# Dependencies:
-#
-# - ``functions`` file
-# - ``cinder`` configurations
-
-# configure_cinder_driver - make configuration changes, including those to other services
-
-# Save trace setting
-_XTRACE_CINDER_XENAPINFS=$(set +o | grep xtrace)
-set +o xtrace
-
-
-# Defaults
-# --------
-
-# Set up default directories
-
-
-# Entry Points
-# ------------
-
-# configure_cinder_driver - Set config files, create data dirs, etc
-function configure_cinder_driver {
-    iniset $CINDER_CONF DEFAULT volume_driver "cinder.volume.drivers.xenapi.sm.XenAPINFSDriver"
-    iniset $CINDER_CONF DEFAULT xenapi_connection_url "$CINDER_XENAPI_CONNECTION_URL"
-    iniset $CINDER_CONF DEFAULT xenapi_connection_username "$CINDER_XENAPI_CONNECTION_USERNAME"
-    iniset $CINDER_CONF DEFAULT xenapi_connection_password "$CINDER_XENAPI_CONNECTION_PASSWORD"
-    iniset $CINDER_CONF DEFAULT xenapi_nfs_server "$CINDER_XENAPI_NFS_SERVER"
-    iniset $CINDER_CONF DEFAULT xenapi_nfs_serverpath "$CINDER_XENAPI_NFS_SERVERPATH"
-}
-
-# Restore xtrace
-$_XTRACE_CINDER_XENAPINFS
-
-# Local variables:
-# mode: shell-script
-# End:
diff --git a/lib/glance b/lib/glance
index c2a8b7492e..fcf778d3f6 100644
--- a/lib/glance
+++ b/lib/glance
@@ -279,10 +279,6 @@ function configure_glance {
     configure_keystone_authtoken_middleware $GLANCE_API_CONF glance
     iniset $GLANCE_API_CONF oslo_messaging_notifications driver messagingv2
     iniset_rpc_backend glance $GLANCE_API_CONF
-    if [ "$VIRT_DRIVER" = 'xenserver' ]; then
-        iniset $GLANCE_API_CONF DEFAULT container_formats "ami,ari,aki,bare,ovf,tgz"
-        iniset $GLANCE_API_CONF DEFAULT disk_formats "ami,ari,aki,vhd,raw,iso"
-    fi
     if [ "$VIRT_DRIVER" = 'libvirt' ] && [ "$LIBVIRT_TYPE" = 'parallels' ]; then
         iniset $GLANCE_API_CONF DEFAULT disk_formats "ami,ari,aki,vhd,vmdk,raw,qcow2,vdi,iso,ploop"
     fi
diff --git a/lib/nova b/lib/nova
index caa778060f..216c3cff9e 100644
--- a/lib/nova
+++ b/lib/nova
@@ -1052,14 +1052,6 @@ function is_nova_ready {
     # happen between here and the script ending. However, in multinode
     # tests this can very often not be the case. So ensure that the
     # compute is up before we move on.
-
-    # TODO(sdague): honestly, this probably should be a plug point for
-    # an external system.
-    if [[ "$VIRT_DRIVER" == 'xenserver' ]]; then
-        # xenserver encodes information in the hostname of the compute
-        # because of the dom0/domU split. Just ignore for now.
-        return
-    fi
     wait_for_compute $NOVA_READY_TIMEOUT
 }
 
diff --git a/lib/nova_plugins/hypervisor-xenserver b/lib/nova_plugins/hypervisor-xenserver
deleted file mode 100644
index 511ec1bc09..0000000000
--- a/lib/nova_plugins/hypervisor-xenserver
+++ /dev/null
@@ -1,107 +0,0 @@
-#!/bin/bash
-#
-# lib/nova_plugins/hypervisor-xenserver
-# Configure the XenServer hypervisor
-
-# Enable with:
-# VIRT_DRIVER=xenserver
-
-# Dependencies:
-# ``functions`` file
-# ``nova`` configuration
-
-# install_nova_hypervisor - install any external requirements
-# configure_nova_hypervisor - make configuration changes, including those to other services
-# start_nova_hypervisor - start any external services
-# stop_nova_hypervisor - stop any external services
-# cleanup_nova_hypervisor - remove transient data and cache
-
-# Save trace setting
-_XTRACE_XENSERVER=$(set +o | grep xtrace)
-set +o xtrace
-
-
-# Defaults
-# --------
-
-VNCSERVER_PROXYCLIENT_ADDRESS=${VNCSERVER_PROXYCLIENT_ADDRESS=169.254.0.1}
-
-
-# Entry Points
-# ------------
-
-# clean_nova_hypervisor - Clean up an installation
-function cleanup_nova_hypervisor {
-    # This function intentionally left blank
-    :
-}
-
-# configure_nova_hypervisor - Set config files, create data dirs, etc
-function configure_nova_hypervisor {
-    if [ -z "$XENAPI_CONNECTION_URL" ]; then
-        die $LINENO "XENAPI_CONNECTION_URL is not specified"
-    fi
-
-    # Check os-xenapi plugin is enabled
-    local plugins="${DEVSTACK_PLUGINS}"
-    local plugin
-    local found=0
-    for plugin in ${plugins//,/ }; do
-        if [[ "$plugin" = "os-xenapi" ]]; then
-            found=1
-            break
-        fi
-    done
-    if [[ $found -ne 1 ]]; then
-        die $LINENO "os-xenapi plugin is not specified. Please enable this plugin in local.conf"
-    fi
-
-    iniset $NOVA_CONF DEFAULT compute_driver "xenapi.XenAPIDriver"
-    iniset $NOVA_CONF xenserver connection_url "$XENAPI_CONNECTION_URL"
-    iniset $NOVA_CONF xenserver connection_username "$XENAPI_USER"
-    iniset $NOVA_CONF xenserver connection_password "$XENAPI_PASSWORD"
-    iniset $NOVA_CONF DEFAULT flat_injected "False"
-
-    local dom0_ip
-    dom0_ip=$(echo "$XENAPI_CONNECTION_URL" | cut -d "/" -f 3-)
-
-    local ssh_dom0
-    ssh_dom0="sudo -u $DOMZERO_USER ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null root@$dom0_ip"
-
-    # install console logrotate script
-    tar -czf - -C $NOVA_DIR/tools/xenserver/ rotate_xen_guest_logs.sh |
-        $ssh_dom0 'tar -xzf - -C /root/ && chmod +x /root/rotate_xen_guest_logs.sh && mkdir -p /var/log/xen/guest'
-
-    # Create a cron job that will rotate guest logs
-    $ssh_dom0 crontab - << CRONTAB
-* * * * * /root/rotate_xen_guest_logs.sh >/dev/null 2>&1
-CRONTAB
-
-}
-
-# install_nova_hypervisor() - Install external components
-function install_nova_hypervisor {
-    # xenapi functionality is now included in os-xenapi library which houses the plugin
-    # so this function intentionally left blank
-    :
-}
-
-# start_nova_hypervisor - Start any required external services
-function start_nova_hypervisor {
-    # This function intentionally left blank
-    :
-}
-
-# stop_nova_hypervisor - Stop any external services
-function stop_nova_hypervisor {
-    # This function intentionally left blank
-    :
-}
-
-
-# Restore xtrace
-$_XTRACE_XENSERVER
-
-# Local variables:
-# mode: shell-script
-# End:
diff --git a/lib/tempest b/lib/tempest
index 8a5b785927..9ccd19b505 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -347,9 +347,6 @@ function configure_tempest {
     if [[ ! -z "$TEMPEST_HTTP_IMAGE" ]]; then
         iniset $TEMPEST_CONFIG image http_image $TEMPEST_HTTP_IMAGE
     fi
-    if [ "$VIRT_DRIVER" = "xenserver" ]; then
-        iniset $TEMPEST_CONFIG image disk_formats "ami,ari,aki,vhd,raw,iso"
-    fi
     iniset $TEMPEST_CONFIG image-feature-enabled import_image $GLANCE_USE_IMPORT_WORKFLOW
     iniset $TEMPEST_CONFIG image-feature-enabled os_glance_reserved True
     # Compute
@@ -425,15 +422,8 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG network-feature-enabled port_security $NEUTRON_PORT_SECURITY
 
     # Scenario
-    if [ "$VIRT_DRIVER" = "xenserver" ]; then
-        SCENARIO_IMAGE_DIR=${SCENARIO_IMAGE_DIR:-$FILES}
-        SCENARIO_IMAGE_FILE="cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.vhd.tgz"
-        iniset $TEMPEST_CONFIG scenario img_disk_format vhd
-        iniset $TEMPEST_CONFIG scenario img_container_format ovf
-    else
-        SCENARIO_IMAGE_DIR=${SCENARIO_IMAGE_DIR:-$FILES}
-        SCENARIO_IMAGE_FILE=$DEFAULT_IMAGE_FILE_NAME
-    fi
+    SCENARIO_IMAGE_DIR=${SCENARIO_IMAGE_DIR:-$FILES}
+    SCENARIO_IMAGE_FILE=$DEFAULT_IMAGE_FILE_NAME
     iniset $TEMPEST_CONFIG scenario img_file $SCENARIO_IMAGE_DIR/$SCENARIO_IMAGE_FILE
 
     # If using provider networking, use the physical network for validation rather than private
diff --git a/stack.sh b/stack.sh
index 6375c8e5e0..ca9ecfa213 100755
--- a/stack.sh
+++ b/stack.sh
@@ -718,16 +718,6 @@ if is_service_enabled keystone; then
 fi
 
 
-# Nova
-# -----
-
-if is_service_enabled nova && [[ "$VIRT_DRIVER" == 'xenserver' ]]; then
-    # Look for the backend password here because read_password
-    # is not a library function.
-    read_password XENAPI_PASSWORD "ENTER A PASSWORD TO USE FOR XEN."
-fi
-
-
 # Swift
 # -----
 
diff --git a/stackrc b/stackrc
index a36f8970e6..205481be08 100644
--- a/stackrc
+++ b/stackrc
@@ -605,10 +605,8 @@ ENABLE_VOLUME_MULTIATTACH=$(trueorfalse False ENABLE_VOLUME_MULTIATTACH)
 
 # Nova hypervisor configuration.  We default to libvirt with **kvm** but will
 # drop back to **qemu** if we are unable to load the kvm module.  ``stack.sh`` can
-# also install an **LXC**, **OpenVZ** or **XenAPI** based system.  If xenserver-core
-# is installed, the default will be XenAPI
+# also install an **LXC** or **OpenVZ** based system.
 DEFAULT_VIRT_DRIVER=libvirt
-is_package_installed xenserver-core && DEFAULT_VIRT_DRIVER=xenserver
 VIRT_DRIVER=${VIRT_DRIVER:-$DEFAULT_VIRT_DRIVER}
 case "$VIRT_DRIVER" in
     ironic|libvirt)
@@ -633,14 +631,6 @@ case "$VIRT_DRIVER" in
     fake)
         NUMBER_FAKE_NOVA_COMPUTE=${NUMBER_FAKE_NOVA_COMPUTE:-1}
         ;;
-    xenserver)
-        # Xen config common to nova and neutron
-        XENAPI_USER=${XENAPI_USER:-"root"}
-        # This user will be used for dom0 - domU communication
-        #   should be able to log in to dom0 without a password
-        #   will be used to install the plugins
-        DOMZERO_USER=${DOMZERO_USER:-"domzero"}
-        ;;
     *)
         ;;
 esac
@@ -695,11 +685,6 @@ if [[ "$DOWNLOAD_DEFAULT_IMAGES" == "True" ]]; then
             DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-0.3.2-i386-disk.vmdk}
             DEFAULT_IMAGE_FILE_NAME=${DEFAULT_IMAGE_FILE_NAME:-$DEFAULT_IMAGE_NAME}
             IMAGE_URLS+="http://partnerweb.vmware.com/programs/vmdkimage/${DEFAULT_IMAGE_FILE_NAME}";;
-        xenserver)
-            DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-0.3.5-x86_64-disk}
-            DEFAULT_IMAGE_FILE_NAME=${DEFAULT_IMAGE_NAME:-cirros-0.3.5-x86_64-disk.vhd.tgz}
-            IMAGE_URLS+="http://ca.downloads.xensource.com/OpenStack/cirros-0.3.5-x86_64-disk.vhd.tgz"
-            IMAGE_URLS+=",http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-x86_64-uec.tar.gz";;
         fake)
             # Use the same as the default for libvirt
             DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk}
diff --git a/tools/image_list.sh b/tools/image_list.sh
index 3a27c4acfd..81231be9f3 100755
--- a/tools/image_list.sh
+++ b/tools/image_list.sh
@@ -22,7 +22,7 @@ source $TOP_DIR/functions
 
 # Possible virt drivers, if we have more, add them here. Always keep
 # dummy in the end position to trigger the fall through case.
-DRIVERS="openvz ironic libvirt vsphere xenserver dummy"
+DRIVERS="openvz ironic libvirt vsphere dummy"
 
 # Extra variables to trigger getting additional images.
 export ENABLED_SERVICES="h-api,tr-api"
diff --git a/tools/uec/meta.py b/tools/uec/meta.py
deleted file mode 100644
index 1d994a60d6..0000000000
--- a/tools/uec/meta.py
+++ /dev/null
@@ -1,42 +0,0 @@
-#    Licensed under the Apache License, Version 2.0 (the "License"); you may
-#    not use this file except in compliance with the License. You may obtain
-#    a copy of the License at
-#
-#         http://www.apache.org/licenses/LICENSE-2.0
-#
-#    Unless required by applicable law or agreed to in writing, software
-#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-#    License for the specific language governing permissions and limitations
-#    under the License.
-
-import BaseHTTPServer
-import SimpleHTTPServer
-import sys
-
-
-def main(host, port, HandlerClass=SimpleHTTPServer.SimpleHTTPRequestHandler,
-         ServerClass=BaseHTTPServer.HTTPServer, protocol="HTTP/1.0"):
-    """simple http server that listens on a give address:port."""
-
-    server_address = (host, port)
-
-    HandlerClass.protocol_version = protocol
-    httpd = ServerClass(server_address, HandlerClass)
-
-    sa = httpd.socket.getsockname()
-    print("Serving HTTP on", sa[0], "port", sa[1], "...")
-    httpd.serve_forever()
-
-if __name__ == '__main__':
-    if sys.argv[1:]:
-        address = sys.argv[1]
-    else:
-        address = '0.0.0.0'
-    if ':' in address:
-        host, port = address.split(':')
-    else:
-        host = address
-        port = 8080
-
-    main(host, int(port))
diff --git a/tools/xen/README.md b/tools/xen/README.md
deleted file mode 100644
index 287301156e..0000000000
--- a/tools/xen/README.md
+++ /dev/null
@@ -1,3 +0,0 @@
-Note: XenServer relative tools have been moved to `os-xenapi`_ and be maintained there.
-
-.. _os-xenapi: https://opendev.org/x/os-xenapi/

From 3948fcb03c96bacc0c620de5b2c18a475e7afef2 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <sfinucan@redhat.com>
Date: Tue, 2 Mar 2021 16:51:49 +0000
Subject: [PATCH 1843/2409] Remove MAINTAINERS.rst

This file is mega out-of-date and no longer helpful. Remove it.

Change-Id: Ic7e215c3e48a9c453d19355ad7d683494811d2af
Signed-off-by: Stephen Finucane <sfinucan@redhat.com>
---
 HACKING.rst     |  3 --
 MAINTAINERS.rst | 88 -------------------------------------------------
 2 files changed, 91 deletions(-)
 delete mode 100644 MAINTAINERS.rst

diff --git a/HACKING.rst b/HACKING.rst
index 0c4de303ce..6a91e0a6a8 100644
--- a/HACKING.rst
+++ b/HACKING.rst
@@ -274,9 +274,6 @@ your change
   even years from now -- why we were motivated to make a change at the
   time.
 
-* **Reviewers** -- please see ``MAINTAINERS.rst`` for a list of people
-  that should be added to reviews of various sub-systems.
-
 
 Making Changes, Testing, and CI
 -------------------------------
diff --git a/MAINTAINERS.rst b/MAINTAINERS.rst
deleted file mode 100644
index 3cf61a6875..0000000000
--- a/MAINTAINERS.rst
+++ /dev/null
@@ -1,88 +0,0 @@
-MAINTAINERS
-===========
-
-
-Overview
---------
-
-The following is a list of people known to have interests in
-particular areas or sub-systems of devstack.
-
-It is a rather general guide intended to help seed the initial
-reviewers list of a change.  A +1 on a review from someone identified
-as being a maintainer of its affected area is a very positive flag to
-the core team for the veracity of the change.
-
-The ``devstack-core`` group can still be added to all reviews.
-
-
-Format
-~~~~~~
-
-The format of the file is the name of the maintainer and their
-gerrit-registered email.
-
-
-Maintainers
------------
-
-.. contents:: :local:
-
-
-Ceph
-~~~~
-
-* Sebastien Han <sebastien.han@enovance.com>
-
-Cinder
-~~~~~~
-
-Fedora/CentOS/RHEL
-~~~~~~~~~~~~~~~~~~
-
-* Ian Wienand <iwienand@redhat.com>
-
-Neutron
-~~~~~~~
-
-MidoNet
-~~~~~~~
-
-* Jaume Devesa <devvesa@gmail.com>
-* Ryu Ishimoto <ryu@midokura.com>
-* YAMAMOTO Takashi <yamamoto@midokura.com>
-
-OpenDaylight
-~~~~~~~~~~~~
-
-* Kyle Mestery <mestery@mestery.com>
-
-OpenFlow Agent (ofagent)
-~~~~~~~~~~~~~~~~~~~~~~~~
-
-* YAMAMOTO Takashi <yamamoto@valinux.co.jp>
-* Fumihiko Kakuma <kakuma@valinux.co.jp>
-
-Swift
-~~~~~
-
-* Chmouel Boudjnah <chmouel@enovance.com>
-
-SUSE
-~~~~
-
-* Ralf Haferkamp <rhafer@suse.de>
-* Vincent Untz <vuntz@suse.com>
-
-Tempest
-~~~~~~~
-
-Zaqar (Marconi)
-~~~~~~~~~~~~~~~
-
-* Flavio Percoco <flaper87@gmail.com>
-* Malini Kamalambal <malini.kamalambal@rackspace.com>
-
-Oracle Linux
-~~~~~~~~~~~~
-* Wiekus Beukes <wiekus.beukes@oracle.com>

From 9dc2b88eb42a5f98f43bc8ad3dfa3962a4d44d74 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Fri, 5 Mar 2021 09:32:19 -0600
Subject: [PATCH 1844/2409] Add enforce_scope setting support for keystone

Keystone-tempest-plugin has implemented the secure RBAC
tests and enabling the enforce_scope via keystone devstack
plugin. Doing those setting in devstack will help to manage
easily and in central place also avoid restarting the api
service.

Change-Id: I30da189474476d3397152a0a15c2e30a62d712ad
---
 lib/keystone | 11 +++++++++++
 lib/tempest  | 10 ++++++++++
 2 files changed, 21 insertions(+)

diff --git a/lib/keystone b/lib/keystone
index 66e867ca68..e282db0bfa 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -134,6 +134,12 @@ KEYSTONE_PASSWORD_HASH_ROUNDS=${KEYSTONE_PASSWORD_HASH_ROUNDS:-4}
 # Cache settings
 KEYSTONE_ENABLE_CACHE=${KEYSTONE_ENABLE_CACHE:-True}
 
+# Flag to set the oslo_policy.enforce_scope. This is used to switch
+# the Identity API policies to start checking the scope of token. By Default,
+# this flag is False.
+# For more detail: https://docs.openstack.org/oslo.policy/latest/configuration/index.html#oslo_policy.enforce_scope
+KEYSTONE_ENFORCE_SCOPE=$(trueorfalse False KEYSTONE_ENFORCE_SCOPE)
+
 # Functions
 # ---------
 
@@ -281,6 +287,11 @@ function configure_keystone {
         iniset $KEYSTONE_CONF security_compliance lockout_duration $KEYSTONE_LOCKOUT_DURATION
         iniset $KEYSTONE_CONF security_compliance unique_last_password_count $KEYSTONE_UNIQUE_LAST_PASSWORD_COUNT
     fi
+    if [[ "$KEYSTONE_ENFORCE_SCOPE" == True ]] ; then
+        iniset $KEYSTONE_CONF oslo_policy enforce_scope true
+        iniset $KEYSTONE_CONF oslo_policy enforce_new_defaults true
+        iniset $KEYSTONE_CONF oslo_policy policy_file policy.yaml
+    fi
 }
 
 # create_keystone_accounts() - Sets up common required keystone accounts
diff --git a/lib/tempest b/lib/tempest
index 8a5b785927..f210e4014b 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -601,6 +601,16 @@ function configure_tempest {
         fi
     done
 
+    # ``enforce_scope``
+    # If services enable the enforce_scope for their policy
+    # we need to enable the same on Tempest side so that
+    # test can be run with scoped token.
+    if [[ "$KEYSTONE_ENFORCE_SCOPE" == True ]] ; then
+        iniset $TEMPEST_CONFIG enforce_scope keystone true
+        iniset $TEMPEST_CONFIG auth admin_system 'all'
+        iniset $TEMPEST_CONFIG auth admin_project_name ''
+    fi
+
     if [ "$VIRT_DRIVER" = "libvirt" ] && [ "$LIBVIRT_TYPE" = "lxc" ]; then
         # libvirt-lxc does not support boot from volume or attaching volumes
         # so basically anything with cinder is out of the question.

From 8c93049220bd3551b53513426c5a7bfdb7bac1d9 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Fri, 5 Mar 2021 09:40:39 -0600
Subject: [PATCH 1845/2409] Add enforce_scope setting support for Glance

Glance started moving to new RBAC and glance-tempest-plugin
and Tempest need to set few configuration to enable the
scope checks on glance side and so does on Temepst side to tell
glance is ready with scope checks so that test can be run with
scoped token.

Change-Id: I09f513d08212bc80a3a86a750b29b1c6625d2f89
---
 lib/glance  | 12 ++++++++++++
 lib/tempest |  1 +
 2 files changed, 13 insertions(+)

diff --git a/lib/glance b/lib/glance
index c2a8b7492e..fd2f2cb902 100644
--- a/lib/glance
+++ b/lib/glance
@@ -85,6 +85,12 @@ GLANCE_TASKS_DIR=${GLANCE_MULTISTORE_FILE_IMAGE_DIR:=$DATA_DIR/os_glance_tasks_s
 
 GLANCE_USE_IMPORT_WORKFLOW=$(trueorfalse False GLANCE_USE_IMPORT_WORKFLOW)
 
+# Flag to set the oslo_policy.enforce_scope. This is used to switch
+# the Image API policies to start checking the scope of token. By Default,
+# this flag is False.
+# For more detail: https://docs.openstack.org/oslo.policy/latest/configuration/index.html#oslo_policy.enforce_scope
+GLANCE_ENFORCE_SCOPE=$(trueorfalse False GLANCE_ENFORCE_SCOPE)
+
 GLANCE_CONF_DIR=${GLANCE_CONF_DIR:-/etc/glance}
 GLANCE_METADEF_DIR=$GLANCE_CONF_DIR/metadefs
 GLANCE_API_CONF=$GLANCE_CONF_DIR/glance-api.conf
@@ -371,6 +377,12 @@ function configure_glance {
         iniset $GLANCE_API_CONF DEFAULT bind_port $GLANCE_SERVICE_PORT_INT
         iniset $GLANCE_API_CONF DEFAULT workers "$API_WORKERS"
     fi
+
+    if [[ "$GLANCE_ENFORCE_SCOPE" == True ]] ; then
+        iniset $GLANCE_API_CONF oslo_policy enforce_scope true
+        iniset $GLANCE_API_CONF oslo_policy enforce_new_defaults true
+        iniset $GLANCE_API_CONF DEFAULT enforce_secure_rbac true
+    fi
 }
 
 # create_glance_accounts() - Set up common required glance accounts
diff --git a/lib/tempest b/lib/tempest
index f210e4014b..0a9f800bcc 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -610,6 +610,7 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG auth admin_system 'all'
         iniset $TEMPEST_CONFIG auth admin_project_name ''
     fi
+    iniset $TEMPEST_CONFIG enforce_scope glance "$GLANCE_ENFORCE_SCOPE"
 
     if [ "$VIRT_DRIVER" = "libvirt" ] && [ "$LIBVIRT_TYPE" = "lxc" ]; then
         # libvirt-lxc does not support boot from volume or attaching volumes

From bd0d0fde24a5654507e02d32eea7ea0c1fc46821 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Sat, 6 Mar 2021 17:23:39 -0600
Subject: [PATCH 1846/2409] Add enforce_scope setting support for Cinder

Conder started moving to new RBAC and cinder-tempest-plugin
and Tempest need to set few configuration to enable the
scope checks on cinder side and on Temepst side to tell
cinder is all configured with scope checks and test can be run with
scoped token.

Change-Id: Ic7cd919c000c4e7b9a3a06638a5bd87b1617e749
---
 lib/cinder  | 11 +++++++++++
 lib/tempest |  2 ++
 2 files changed, 13 insertions(+)

diff --git a/lib/cinder b/lib/cinder
index 33deff61f2..da6f32728e 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -125,6 +125,12 @@ CINDER_IMG_CACHE_SIZE_COUNT=${CINDER_IMG_CACHE_SIZE_COUNT:-}
 # enable the cache for all cinder backends.
 CINDER_CACHE_ENABLED_FOR_BACKENDS=${CINDER_CACHE_ENABLED_FOR_BACKENDS:-$CINDER_ENABLED_BACKENDS}
 
+# Flag to set the oslo_policy.enforce_scope. This is used to switch
+# the  Volume API policies to start checking the scope of token. by default,
+# this flag is False.
+# For more detail: https://docs.openstack.org/oslo.policy/latest/configuration/index.html#oslo_policy.enforce_scope
+CINDER_ENFORCE_SCOPE=$(trueorfalse False CINDER_ENFORCE_SCOPE)
+
 # Functions
 # ---------
 
@@ -326,6 +332,11 @@ function configure_cinder {
     elif is_service_enabled etcd3; then
         iniset $CINDER_CONF coordination backend_url "etcd3+http://${SERVICE_HOST}:$ETCD_PORT"
     fi
+
+    if [[ "$CINDER_ENFORCE_SCOPE" == True ]] ; then
+        iniset $CINDER_CONF oslo_policy enforce_scope true
+        iniset $CINDER_CONF oslo_policy enforce_new_defaults true
+    fi
 }
 
 # create_cinder_accounts() - Set up common required cinder accounts
diff --git a/lib/tempest b/lib/tempest
index f210e4014b..238e25f07b 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -611,6 +611,8 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG auth admin_project_name ''
     fi
 
+    iniset $TEMPEST_CONFIG enforce_scope cinder "$CINDER_ENFORCE_SCOPE"
+
     if [ "$VIRT_DRIVER" = "libvirt" ] && [ "$LIBVIRT_TYPE" = "lxc" ]; then
         # libvirt-lxc does not support boot from volume or attaching volumes
         # so basically anything with cinder is out of the question.

From 38fed19acc2aa232503f91424d6c732ed8c7ed3a Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Mon, 8 Mar 2021 08:50:53 +0000
Subject: [PATCH 1847/2409] Update Cirros to 0.5.2

This release [1] includes a single fix [2] pulling in the ahci module
which is required by Iad1adbc23b31dd54a96299e7a8a4b622c15eed8d, a
nova-next change introducing q35 testing to the job.

This depends on the following change caching the image within the CI
host image:

Depends-On: https://review.opendev.org/c/openstack/project-config/+/779178/

[1] https://github.com/cirros-dev/cirros/releases/tag/0.5.2
[2] https://github.com/cirros-dev/cirros/pull/65

Change-Id: I12e0bdb3699e5343592ab834468ba6b2fcdcaaf4
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 205481be08..1bcc302846 100644
--- a/stackrc
+++ b/stackrc
@@ -657,7 +657,7 @@ esac
 #IMAGE_URLS="http://smoser.brickies.net/ubuntu/ttylinux-uec/ttylinux-uec-amd64-11.2_2.6.35-15_1.tar.gz" # old ttylinux-uec image
 #IMAGE_URLS="http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img" # cirros full disk image
 
-CIRROS_VERSION=${CIRROS_VERSION:-"0.5.1"}
+CIRROS_VERSION=${CIRROS_VERSION:-"0.5.2"}
 CIRROS_ARCH=${CIRROS_ARCH:-"x86_64"}
 
 # Set default image based on ``VIRT_DRIVER`` and ``LIBVIRT_TYPE``, either of

From 802259a49656170108dd79559166ad89c49e2ef7 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Tue, 12 Jan 2021 22:55:57 +0000
Subject: [PATCH 1848/2409] Simulate a remote/standalone g-api worker

In order to be able to test glance's distributed import function,
we need to have multiple workers in an arrangement like they
would be if one was on another host (potentially at another site).
This extra worker must be separate from the default image service
in order to repeatedly hit one and then the other to test cross-
service interactions.

This allows you to enable_service g-api-r, which will clone the main
g-api service, modify it to run on a different port, and start it.
The service will be registered in the catalog as image_remote.

Depends-On: https://review.opendev.org/c/openstack/glance/+/769976
Change-Id: I0e2bb5412701d515153c023873addb9d7abdb8a4
---
 lib/glance  | 71 ++++++++++++++++++++++++++++++++++++++++++++++++++++-
 lib/tempest |  5 ++++
 2 files changed, 75 insertions(+), 1 deletion(-)

diff --git a/lib/glance b/lib/glance
index c2a8b7492e..cf66023f5c 100644
--- a/lib/glance
+++ b/lib/glance
@@ -131,7 +131,7 @@ function is_glance_enabled {
 # runs that a clean run would need to clean up
 function cleanup_glance {
     # delete image files (glance)
-    sudo rm -rf $GLANCE_CACHE_DIR $GLANCE_IMAGE_DIR
+    sudo rm -rf $GLANCE_CACHE_DIR $GLANCE_IMAGE_DIR $(glance_remote_conf '')
 
     # Cleanup multiple stores directories
     if [[ "$GLANCE_ENABLE_MULTIPLE_STORES" == "True" ]]; then
@@ -365,6 +365,11 @@ function configure_glance {
 
     if [[ "$GLANCE_STANDALONE" == False ]]; then
         write_local_uwsgi_http_config "$GLANCE_UWSGI_CONF" "$GLANCE_UWSGI" "/image"
+        # Grab our uwsgi listen address and use that to fill out our
+        # worker_self_reference_url config
+        iniset $GLANCE_API_CONF DEFAULT worker_self_reference_url \
+               $(awk '-F= ' '/^http-socket/ { print "http://"$2}' \
+                    $GLANCE_UWSGI_CONF)
     else
         write_local_proxy_http_config glance "http://$GLANCE_SERVICE_HOST:$GLANCE_SERVICE_PORT_INT" "/image"
         iniset $GLANCE_API_CONF DEFAULT bind_host $GLANCE_SERVICE_LISTEN_ADDRESS
@@ -460,6 +465,64 @@ function install_glance {
     setup_develop $GLANCE_DIR
 }
 
+# glance_remote_conf() - Return the path to an alternate config file for
+#                        the remote glance clone
+function glance_remote_conf {
+    echo "$(dirname ${GLANCE_CONF_DIR})/glance-remote/"$(basename "$1")
+}
+
+# start_glance_remote_clone() - Clone the regular glance api worker
+function start_glance_remote_clone {
+    local glance_remote_conf glance_remote_port
+
+    glance_remote_conf_dir=$(glance_remote_conf '')
+    glance_remote_port=$(get_random_port)
+
+    # Clone the existing ready-to-go glance-api setup
+    sudo rm -Rf $glance_remote_conf_dir
+    sudo cp -r "$GLANCE_CONF_DIR" $glance_remote_conf_dir
+    sudo chown $STACK_USER -R $glance_remote_conf_dir
+
+    # Point this worker at different data dirs
+    remote_data="${DATA_DIR}/glance-remote"
+    mkdir -p $remote_data/os_glance_tasks_store \
+          $remote_data/os_glance_staging_store
+    iniset $(glance_remote_conf 'glance-api.conf') os_glance_staging_store \
+           filesystem_store_datadir ${remote_data}/os_glance_staging_store
+    iniset $(glance_remote_conf 'glance-api.conf') os_glance_tasks_store \
+           filesystem_store_datadir ${remote_data}/os_glance_tasks_store
+
+    # Change our uwsgi to our new port
+    sed -ri "s/^(http-socket.*):[0-9]+/\1:$glance_remote_port/" \
+        $(glance_remote_conf $GLANCE_UWSGI_CONF)
+
+    # Update the self-reference url with our new port
+    iniset $(glance_remote_conf $GLANCE_API_CONF) DEFAULT \
+           worker_self_reference_url \
+           $(awk '-F= ' '/^http-socket/ { print "http://"$2 }' \
+                $(glance_remote_conf $GLANCE_UWSGI_CONF))
+
+    # We need to create the systemd service for the clone, but then
+    # change it to include an Environment line to point the WSGI app
+    # at the alternate config directory.
+    write_uwsgi_user_unit_file devstack@g-api-r.service "$(which uwsgi) \
+                               --procname-prefix \
+                               glance-api-remote \
+                               --ini $(glance_remote_conf $GLANCE_UWSGI_CONF)" \
+                               "" "$STACK_USER"
+    iniset -sudo ${SYSTEMD_DIR}/devstack@g-api-r.service \
+           "Service" "Environment" "OS_GLANCE_CONFIG_DIR=$glance_remote_conf_dir"
+
+    # Reload and restart with the new config
+    $SYSTEMCTL daemon-reload
+    $SYSTEMCTL restart devstack@g-api-r
+
+    get_or_create_service glance_remote image_remote "Alternate glance"
+    get_or_create_endpoint image_remote $REGION_NAME \
+                $(awk '-F= ' '/^http-socket/ { print "http://"$2 }' \
+                    $(glance_remote_conf $GLANCE_UWSGI_CONF))
+}
+
 # start_glance() - Start running processes
 function start_glance {
     local service_protocol=$GLANCE_SERVICE_PROTOCOL
@@ -475,6 +538,11 @@ function start_glance {
         run_process g-api "$GLANCE_BIN_DIR/glance-api --config-dir=$GLANCE_CONF_DIR"
     fi
 
+    if is_service_enabled g-api-r; then
+        echo "Starting the g-api-r clone service..."
+        start_glance_remote_clone
+    fi
+
     echo "Waiting for g-api ($GLANCE_SERVICE_HOST) to start..."
     if ! wait_for_service $SERVICE_TIMEOUT $GLANCE_URL; then
         die $LINENO "g-api did not start"
@@ -484,6 +552,7 @@ function start_glance {
 # stop_glance() - Stop running processes
 function stop_glance {
     stop_process g-api
+    stop_process g-api-r
 }
 
 # Restore xtrace
diff --git a/lib/tempest b/lib/tempest
index 8eab4f5ef2..7e7f0ab7a9 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -352,6 +352,11 @@ function configure_tempest {
     fi
     iniset $TEMPEST_CONFIG image-feature-enabled import_image $GLANCE_USE_IMPORT_WORKFLOW
     iniset $TEMPEST_CONFIG image-feature-enabled os_glance_reserved True
+    if is_service_enabled g-api-r; then
+        iniset $TEMPEST_CONFIG image alternate_image_endpoint \
+               "image_remote"
+    fi
+
     # Compute
     iniset $TEMPEST_CONFIG compute image_ref $image_uuid
     iniset $TEMPEST_CONFIG compute image_ref_alt $image_uuid_alt

From 61b4fbf143b96365fa85456246bcadcaab3d76be Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Tue, 9 Mar 2021 08:05:37 -0800
Subject: [PATCH 1849/2409] Address feedback from glance-remote patch

This cleans up some of the quote and variable handling that was
pointed out in review of the previous patch. This is non-critical,
so I'm putting it in a subsequent patch to avoid disturbing the
careful alignment of patches across three projects that are mostly
approved.

Change-Id: I9b281efd74ba5cd78f97b84e5704b41fd040e481
---
 lib/glance  | 40 ++++++++++++++++++++++------------------
 lib/tempest |  3 +--
 2 files changed, 23 insertions(+), 20 deletions(-)

diff --git a/lib/glance b/lib/glance
index cf66023f5c..3fb61b0268 100644
--- a/lib/glance
+++ b/lib/glance
@@ -130,8 +130,9 @@ function is_glance_enabled {
 # cleanup_glance() - Remove residual data files, anything left over from previous
 # runs that a clean run would need to clean up
 function cleanup_glance {
-    # delete image files (glance)
-    sudo rm -rf $GLANCE_CACHE_DIR $GLANCE_IMAGE_DIR $(glance_remote_conf '')
+    # delete image files (glance) and all of the glance-remote temporary
+    # storage
+    sudo rm -rf $GLANCE_CACHE_DIR $GLANCE_IMAGE_DIR "${DATA_DIR}/glance-remote"
 
     # Cleanup multiple stores directories
     if [[ "$GLANCE_ENABLE_MULTIPLE_STORES" == "True" ]]; then
@@ -468,39 +469,41 @@ function install_glance {
 # glance_remote_conf() - Return the path to an alternate config file for
 #                        the remote glance clone
 function glance_remote_conf {
-    echo "$(dirname ${GLANCE_CONF_DIR})/glance-remote/"$(basename "$1")
+    echo $(dirname "${GLANCE_CONF_DIR}")/glance-remote/$(basename "$1")
 }
 
 # start_glance_remote_clone() - Clone the regular glance api worker
 function start_glance_remote_clone {
-    local glance_remote_conf glance_remote_port
+    local glance_remote_conf_dir glance_remote_port remote_data
+    local glance_remote_uwsgi
 
-    glance_remote_conf_dir=$(glance_remote_conf '')
+    glance_remote_conf_dir="$(glance_remote_conf "")"
     glance_remote_port=$(get_random_port)
+    glance_remote_uwsgi="$(glance_remote_conf $GLANCE_UWSGI_CONF)"
 
     # Clone the existing ready-to-go glance-api setup
-    sudo rm -Rf $glance_remote_conf_dir
-    sudo cp -r "$GLANCE_CONF_DIR" $glance_remote_conf_dir
-    sudo chown $STACK_USER -R $glance_remote_conf_dir
+    sudo rm -Rf "$glance_remote_conf_dir"
+    sudo cp -r "$GLANCE_CONF_DIR" "$glance_remote_conf_dir"
+    sudo chown $STACK_USER -R "$glance_remote_conf_dir"
 
     # Point this worker at different data dirs
     remote_data="${DATA_DIR}/glance-remote"
     mkdir -p $remote_data/os_glance_tasks_store \
-          $remote_data/os_glance_staging_store
-    iniset $(glance_remote_conf 'glance-api.conf') os_glance_staging_store \
-           filesystem_store_datadir ${remote_data}/os_glance_staging_store
-    iniset $(glance_remote_conf 'glance-api.conf') os_glance_tasks_store \
-           filesystem_store_datadir ${remote_data}/os_glance_tasks_store
+          "${remote_data}/os_glance_staging_store"
+    iniset $(glance_remote_conf "$GLANCE_API_CONF") os_glance_staging_store \
+           filesystem_store_datadir "${remote_data}/os_glance_staging_store"
+    iniset $(glance_remote_conf "$GLANCE_API_CONF") os_glance_tasks_store \
+           filesystem_store_datadir "${remote_data}/os_glance_tasks_store"
 
     # Change our uwsgi to our new port
     sed -ri "s/^(http-socket.*):[0-9]+/\1:$glance_remote_port/" \
-        $(glance_remote_conf $GLANCE_UWSGI_CONF)
+        "$glance_remote_uwsgi"
 
     # Update the self-reference url with our new port
     iniset $(glance_remote_conf $GLANCE_API_CONF) DEFAULT \
            worker_self_reference_url \
            $(awk '-F= ' '/^http-socket/ { print "http://"$2 }' \
-                $(glance_remote_conf $GLANCE_UWSGI_CONF))
+                    "$glance_remote_uwsgi")
 
     # We need to create the systemd service for the clone, but then
     # change it to include an Environment line to point the WSGI app
@@ -508,10 +511,11 @@ function start_glance_remote_clone {
     write_uwsgi_user_unit_file devstack@g-api-r.service "$(which uwsgi) \
                                --procname-prefix \
                                glance-api-remote \
-                               --ini $(glance_remote_conf $GLANCE_UWSGI_CONF)" \
+                               --ini $glance_remote_uwsgi" \
                                "" "$STACK_USER"
     iniset -sudo ${SYSTEMD_DIR}/devstack@g-api-r.service \
-           "Service" "Environment" "OS_GLANCE_CONFIG_DIR=$glance_remote_conf_dir"
+           "Service" "Environment" \
+           "OS_GLANCE_CONFIG_DIR=$glance_remote_conf_dir"
 
     # Reload and restart with the new config
     $SYSTEMCTL daemon-reload
@@ -520,7 +524,7 @@ function start_glance_remote_clone {
     get_or_create_service glance_remote image_remote "Alternate glance"
     get_or_create_endpoint image_remote $REGION_NAME \
                 $(awk '-F= ' '/^http-socket/ { print "http://"$2 }' \
-                    $(glance_remote_conf $GLANCE_UWSGI_CONF))
+                    $glance_remote_uwsgi)
 }
 
 # start_glance() - Start running processes
diff --git a/lib/tempest b/lib/tempest
index 7e7f0ab7a9..bbd23bb63e 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -353,8 +353,7 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG image-feature-enabled import_image $GLANCE_USE_IMPORT_WORKFLOW
     iniset $TEMPEST_CONFIG image-feature-enabled os_glance_reserved True
     if is_service_enabled g-api-r; then
-        iniset $TEMPEST_CONFIG image alternate_image_endpoint \
-               "image_remote"
+        iniset $TEMPEST_CONFIG image alternate_image_endpoint image_remote
     fi
 
     # Compute

From af79a934ef057ea6ef7690894d58d21f7818979e Mon Sep 17 00:00:00 2001
From: Brian Haley <bhaley@redhat.com>
Date: Mon, 15 Mar 2021 12:20:42 -0400
Subject: [PATCH 1850/2409] Use 'ip addr replace' in OVN code

Instead of doing a flush/add, use replace like the ML2/OVS
code does. Should have the same behavior of not failing if
the address is already present.

Change-Id: If9d8a848b079ccb8c0c9b8e6fb708107aa0d46c7
---
 lib/neutron_plugins/ovn_agent | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index b661f593a4..abc9c63614 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -271,8 +271,7 @@ function create_public_bridge {
     sudo ovs-vsctl set open . external-ids:ovn-bridge-mappings=$PHYSICAL_NETWORK:$ext_gw_ifc
     if [ -n "$FLOATING_RANGE" ]; then
         local cidr_len=${FLOATING_RANGE#*/}
-        sudo ip addr flush dev $ext_gw_ifc
-        sudo ip addr add $PUBLIC_NETWORK_GATEWAY/$cidr_len dev $ext_gw_ifc
+        sudo ip addr replace $PUBLIC_NETWORK_GATEWAY/$cidr_len dev $ext_gw_ifc
     fi
 
     # Ensure IPv6 RAs are accepted on the interface with the default route.
@@ -286,8 +285,7 @@ function create_public_bridge {
     sudo sysctl -w net.ipv6.conf.all.forwarding=1
     if [ -n "$IPV6_PUBLIC_RANGE" ]; then
         local ipv6_cidr_len=${IPV6_PUBLIC_RANGE#*/}
-        sudo ip -6 addr flush dev $ext_gw_ifc
-        sudo ip -6 addr add $IPV6_PUBLIC_NETWORK_GATEWAY/$ipv6_cidr_len dev $ext_gw_ifc
+        sudo ip -6 addr replace $IPV6_PUBLIC_NETWORK_GATEWAY/$ipv6_cidr_len dev $ext_gw_ifc
     fi
 
     sudo ip link set $ext_gw_ifc up

From 1ed276c17791dba1f0b7ef4446d0efe09135553b Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Thu, 11 Mar 2021 13:10:28 +0100
Subject: [PATCH 1851/2409] Use (or set properly) system-id generated by
 openvswitch

In case when OVN_UUID isn't set by user, and it isn't stored
in /etc/openvswith/system-id.conf file, Devstack will reuse it.
If it's not, it will generate and store it in the
/etc/openvswitch/system-id.conf file so it can be set to same value
after openvswitch will be e.g. restarted.

In case when OVN_UUID is set by user, it will be also saved in
/etc/openvswitch/system-id.conf file to make it persistent when e.g
openvswitch will be restarted.

Closes-Bug: #1918656
Change-Id: I8e3b05f3ab83e204bc1ce895baec0e1ba515895b
---
 lib/neutron_plugins/ovn_agent | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index b661f593a4..c6ac16d007 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -66,7 +66,9 @@ OVN_L3_SCHEDULER=${OVN_L3_SCHEDULER:-leastloaded}
 
 # A UUID to uniquely identify this system.  If one is not specified, a random
 # one will be generated.  A randomly generated UUID will be saved in a file
-# 'ovn-uuid' so that the same one will be re-used if you re-run DevStack.
+# $OVS_SYSCONFDIR/system-id.conf (typically /etc/openvswitch/system-id.conf)
+# so that the same one will be re-used if you re-run DevStack or restart
+# Open vSwitch service.
 OVN_UUID=${OVN_UUID:-}
 
 # Whether or not to build the openvswitch kernel module from ovs.  This is required
@@ -109,6 +111,7 @@ OVS_RUNDIR=$OVS_PREFIX/var/run/openvswitch
 OVS_SHAREDIR=$OVS_PREFIX/share/openvswitch
 OVS_SCRIPTDIR=$OVS_SHAREDIR/scripts
 OVS_DATADIR=$DATA_DIR/ovs
+OVS_SYSCONFDIR=${OVS_SYSCONFDIR:-/etc/openvswitch}
 
 OVN_DATADIR=$DATA_DIR/ovn
 OVN_SHAREDIR=$OVS_PREFIX/share/ovn
@@ -521,11 +524,17 @@ function configure_ovn {
     echo "Configuring OVN"
 
     if [ -z "$OVN_UUID" ] ; then
-        if [ -f ./ovn-uuid ] ; then
-            OVN_UUID=$(cat ovn-uuid)
+        if [ -f $OVS_SYSCONFDIR/system-id.conf ]; then
+            OVN_UUID=$(cat $OVS_SYSCONFDIR/system-id.conf)
         else
             OVN_UUID=$(uuidgen)
-            echo $OVN_UUID > ovn-uuid
+            echo $OVN_UUID | sudo tee $OVS_SYSCONFDIR/system-id.conf
+        fi
+    else
+        local ovs_uuid
+        ovs_uuid=$(cat $OVS_SYSCONFDIR/system-id.conf)
+        if [ "$ovs_uuid" != $OVN_UUID ]; then
+            echo $OVN_UUID | sudo tee $OVS_SYSCONFDIR/system-id.conf
         fi
     fi
 

From 30819e66ddad5b57b726684e62b511a938aaea98 Mon Sep 17 00:00:00 2001
From: Rodolfo Alonso Hernandez <ralonsoh@redhat.com>
Date: Mon, 22 Mar 2021 07:14:50 +0000
Subject: [PATCH 1852/2409] Set default OVS_SYSCONFDIR value depending on
 OVS_PREFIX

When OVN is built from source, the value of OVS_PREFIX is set to
"/usr/local". All other paths referring to OVS should be prefixed
with this value.

Closes-Bug: #1920634
Related-Bug: #1918656

Change-Id: I9a45a5379d1c47cdf67b9c6d3d0409a88501e61e
---
 lib/neutron_plugins/ovn_agent | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index 97c20fcda1..2f6d1ab10d 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -111,7 +111,7 @@ OVS_RUNDIR=$OVS_PREFIX/var/run/openvswitch
 OVS_SHAREDIR=$OVS_PREFIX/share/openvswitch
 OVS_SCRIPTDIR=$OVS_SHAREDIR/scripts
 OVS_DATADIR=$DATA_DIR/ovs
-OVS_SYSCONFDIR=${OVS_SYSCONFDIR:-/etc/openvswitch}
+OVS_SYSCONFDIR=${OVS_SYSCONFDIR:-$OVS_PREFIX/etc/openvswitch}
 
 OVN_DATADIR=$DATA_DIR/ovn
 OVN_SHAREDIR=$OVS_PREFIX/share/ovn

From 84b328c814fd5be8af53738128aa3f5ef75ca3c7 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Fri, 26 Mar 2021 07:17:42 -0700
Subject: [PATCH 1853/2409] Default to parallel execution

Several jobs have been running in parallel since the late Wallaby
cycle, and other developers have had it enabled locally. I have heard
no async-related stability or debug-ability complaints thus far.
I think that we should convert the default to parallel early in the
Xena cycle in an attempt to spread the speed improvements across the
board, while also collecting data on a wider set of configurations.

Change-Id: I83d56c9363d481bb6d5921f5e1f9b024f136044b
---
 inc/async | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/inc/async b/inc/async
index d29168f2f5..c63bc2045a 100644
--- a/inc/async
+++ b/inc/async
@@ -11,7 +11,7 @@
 #  async_wait my_shell_func
 #
 
-DEVSTACK_PARALLEL=$(trueorfalse False DEVSTACK_PARALLEL)
+DEVSTACK_PARALLEL=$(trueorfalse True DEVSTACK_PARALLEL)
 _ASYNC_BG_TIME=0
 
 # Keep track of how much total time was spent in background tasks

From d207ba9015f3210812468bfbf7d06b1491392554 Mon Sep 17 00:00:00 2001
From: Toshiaki Takahashi <ts-takahashi@nec.com>
Date: Wed, 23 Dec 2020 17:40:57 +0000
Subject: [PATCH 1854/2409] Move gawk into general for post-config

Devstack script for setting post-config needs gawk.
So this patch moves gawk from files/*/nova into files/*/general.

Closes-Bug: #1909041
Change-Id: I06a1a5524f146a8d7337963e846b5a6b7561be13
---
 files/debs/general      | 1 +
 files/debs/nova         | 1 -
 files/rpms-suse/general | 1 +
 files/rpms-suse/nova    | 1 -
 files/rpms/general      | 1 +
 files/rpms/nova         | 1 -
 6 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/files/debs/general b/files/debs/general
index d64417f1b7..7e481b4072 100644
--- a/files/debs/general
+++ b/files/debs/general
@@ -5,6 +5,7 @@ bsdmainutils
 curl
 default-jre-headless  # NOPRIME
 g++
+gawk
 gcc
 gettext  # used for compiling message catalogs
 git
diff --git a/files/debs/nova b/files/debs/nova
index a7aebbf946..e19441453b 100644
--- a/files/debs/nova
+++ b/files/debs/nova
@@ -3,7 +3,6 @@ curl
 dnsmasq-base
 dnsmasq-utils # for dhcp_release
 ebtables
-gawk
 genisoimage # required for config_drive
 iptables
 iputils-arping
diff --git a/files/rpms-suse/general b/files/rpms-suse/general
index 0de0876dcd..f63611025c 100644
--- a/files/rpms-suse/general
+++ b/files/rpms-suse/general
@@ -3,6 +3,7 @@ apache2-devel
 bc
 ca-certificates-mozilla
 curl
+gawk
 gcc
 gcc-c++
 git-core
diff --git a/files/rpms-suse/nova b/files/rpms-suse/nova
index 9923760750..1cc2f62ea5 100644
--- a/files/rpms-suse/nova
+++ b/files/rpms-suse/nova
@@ -4,7 +4,6 @@ curl
 dnsmasq
 dnsmasq-utils # dist:opensuse-12.3,opensuse-13.1
 ebtables
-gawk
 iptables
 iputils
 kpartx
diff --git a/files/rpms/general b/files/rpms/general
index cfcd7ff261..33da0a5385 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -1,6 +1,7 @@
 bc
 curl
 dbus
+gawk
 gcc
 gcc-c++
 gettext  # used for compiling message catalogs
diff --git a/files/rpms/nova b/files/rpms/nova
index 2218330230..8ea8ccc5ca 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -3,7 +3,6 @@ curl
 dnsmasq # for q-dhcp
 dnsmasq-utils # for dhcp_release
 ebtables
-gawk
 genisoimage # required for config_drive
 iptables
 iputils

From 01a84d2d03cd871fb8734d5fdc9d149b9487e3e4 Mon Sep 17 00:00:00 2001
From: Hironori Shiina <shiina.hironori@jp.fujitsu.com>
Date: Mon, 11 Jan 2021 13:42:46 -0500
Subject: [PATCH 1855/2409] Configure Cinder backup driver

This patch adds a new environment variable, CINDER_BACKUP_DRIVER for
configuring cinder backup driver used when c-bak service is enabled.
This gets cinder backup driver configurable with a similar pattern to
cinder backends. Although the current configurable backup drivers don't
need cleanup functions, the interface for cleanup is prepared for the
future.

The following backup drivers can be configured:
  swift:
  This is the default backup driver.
  ceph:
  This already can be configured if ceph backend driver is enabled. For
  backward compatibility, ceph backup driver is used if ceph backend
  driver is enabled and no backup driver is specified.
  s3_swift:
  The s3 backup driver gets configurable with this patch. By specifying
  's3_swift', the driver is configured for swift s3api.

In the future, lib/cinder_backups/s3 should be created separatedly for
external S3 compatible storage. This file will just set given parameters
such as a URL and credentials.

Change-Id: I356c224d938e1aa59c8589387a03682b3ec6e23d
---
 lib/cinder                  | 45 ++++++++++++++++++++++++-----
 lib/cinder_backends/ceph    | 32 ---------------------
 lib/cinder_backups/ceph     | 57 +++++++++++++++++++++++++++++++++++++
 lib/cinder_backups/s3_swift | 45 +++++++++++++++++++++++++++++
 lib/cinder_backups/swift    | 38 +++++++++++++++++++++++++
 5 files changed, 178 insertions(+), 39 deletions(-)
 create mode 100644 lib/cinder_backups/ceph
 create mode 100644 lib/cinder_backups/s3_swift
 create mode 100644 lib/cinder_backups/swift

diff --git a/lib/cinder b/lib/cinder
index 6c97e114a6..14ab291f8a 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -31,6 +31,7 @@ set +o xtrace
 CINDER_DRIVER=${CINDER_DRIVER:-default}
 CINDER_PLUGINS=$TOP_DIR/lib/cinder_plugins
 CINDER_BACKENDS=$TOP_DIR/lib/cinder_backends
+CINDER_BACKUPS=$TOP_DIR/lib/cinder_backups
 
 # grab plugin config if specified via cinder_driver
 if [[ -r $CINDER_PLUGINS/$CINDER_DRIVER ]]; then
@@ -98,6 +99,16 @@ else
     CINDER_ISCSI_HELPER=${CINDER_ISCSI_HELPER:-tgtadm}
 fi
 
+# For backward compatibility
+# Before CINDER_BACKUP_DRIVER was introduced, ceph backup driver was configured
+# along with ceph backend driver.
+if [[ -z "${CINDER_BACKUP_DRIVER}" && "$CINDER_ENABLED_BACKENDS" =~ "ceph" ]]; then
+    CINDER_BACKUP_DRIVER=ceph
+fi
+
+# Supported backup drivers are in lib/cinder_backups
+CINDER_BACKUP_DRIVER=${CINDER_BACKUP_DRIVER:-swift}
+
 # Toggle for deploying Cinder under a wsgi server. Legacy mod_wsgi
 # reference should be cleaned up to more accurately refer to uwsgi.
 CINDER_USE_MOD_WSGI=${CINDER_USE_MOD_WSGI:-True}
@@ -113,6 +124,15 @@ if is_service_enabled c-vol && [[ -n "$CINDER_ENABLED_BACKENDS" ]]; then
     done
 fi
 
+# Source the backup driver
+if is_service_enabled c-bak && [[ -n "$CINDER_BACKUP_DRIVER" ]]; then
+    if [[ -r $CINDER_BACKUPS/$CINDER_BACKUP_DRIVER ]]; then
+        source $CINDER_BACKUPS/$CINDER_BACKUP_DRIVER
+    else
+        die "cinder backup driver $CINDER_BACKUP_DRIVER is not supported"
+    fi
+fi
+
 # Environment variables to configure the image-volume cache
 CINDER_IMG_CACHE_ENABLED=${CINDER_IMG_CACHE_ENABLED:-True}
 
@@ -189,6 +209,12 @@ function cleanup_cinder {
         done
     fi
 
+    if is_service_enabled c-bak && [[ -n "$CINDER_BACKUP_DRIVER" ]]; then
+        if type cleanup_cinder_backup_$CINDER_BACKUP_DRIVER >/dev/null 2>&1; then
+            cleanup_cinder_backup_$CINDER_BACKUP_DRIVER
+        fi
+    fi
+
     stop_process "c-api"
     remove_uwsgi_config "$CINDER_UWSGI_CONF" "$CINDER_UWSGI"
 }
@@ -266,13 +292,12 @@ function configure_cinder {
         configure_cinder_image_volume_cache
     fi
 
-    if is_service_enabled c-bak; then
-        # NOTE(mriedem): The default backup driver uses swift and if we're
-        # on a subnode we might not know if swift is enabled, but chances are
-        # good that it is on the controller so configure the backup service
-        # to use it. If we want to configure the backup service to use
-        # a non-swift driver, we'll likely need environment variables.
-        iniset $CINDER_CONF DEFAULT backup_swift_url "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$SWIFT_DEFAULT_BIND_PORT/v1/AUTH_"
+    if is_service_enabled c-bak && [[ -n "$CINDER_BACKUP_DRIVER" ]]; then
+        if type configure_cinder_backup_$CINDER_BACKUP_DRIVER >/dev/null 2>&1; then
+            configure_cinder_backup_$CINDER_BACKUP_DRIVER
+        else
+            die "configure_cinder_backup_$CINDER_BACKUP_DRIVER doesn't exist in $CINDER_BACKUPS/$CINDER_BACKUP_DRIVER"
+        fi
     fi
 
     if is_service_enabled ceilometer; then
@@ -410,6 +435,12 @@ function init_cinder {
         done
     fi
 
+    if is_service_enabled c-bak && [[ -n "$CINDER_BACKUP_DRIVER" ]]; then
+        if type init_cinder_backup_$CINDER_BACKUP_DRIVER >/dev/null 2>&1; then
+            init_cinder_backup_$CINDER_BACKUP_DRIVER
+        fi
+    fi
+
     mkdir -p $CINDER_STATE_PATH/volumes
 }
 
diff --git a/lib/cinder_backends/ceph b/lib/cinder_backends/ceph
index 33c9706d3d..0b465730c0 100644
--- a/lib/cinder_backends/ceph
+++ b/lib/cinder_backends/ceph
@@ -6,12 +6,6 @@
 # Enable with:
 #
 #   CINDER_ENABLED_BACKENDS+=,ceph:ceph
-#
-# Optional parameters:
-#   CINDER_BAK_CEPH_POOL=<pool-name>
-#   CINDER_BAK_CEPH_USER=<user>
-#   CINDER_BAK_CEPH_POOL_PG=<pg-num>
-#   CINDER_BAK_CEPH_POOL_PGP=<pgp-num>
 
 # Dependencies:
 #
@@ -29,11 +23,6 @@ set +o xtrace
 # Defaults
 # --------
 
-CINDER_BAK_CEPH_POOL=${CINDER_BAK_CEPH_POOL:-backups}
-CINDER_BAK_CEPH_POOL_PG=${CINDER_BAK_CEPH_POOL_PG:-8}
-CINDER_BAK_CEPH_POOL_PGP=${CINDER_BAK_CEPH_POOL_PGP:-8}
-CINDER_BAK_CEPH_USER=${CINDER_BAK_CEPH_USER:-cinder-bak}
-
 
 # Entry Points
 # ------------
@@ -52,27 +41,6 @@ function configure_cinder_backend_ceph {
     iniset $CINDER_CONF $be_name rbd_flatten_volume_from_snapshot False
     iniset $CINDER_CONF $be_name rbd_max_clone_depth 5
     iniset $CINDER_CONF DEFAULT glance_api_version 2
-
-    if is_service_enabled c-bak; then
-        sudo ceph -c ${CEPH_CONF_FILE} osd pool create ${CINDER_BAK_CEPH_POOL} ${CINDER_BAK_CEPH_POOL_PG} ${CINDER_BAK_CEPH_POOL_PGP}
-        if [ "$REMOTE_CEPH" = "False" ]; then
-            # Configure Cinder backup service options, ceph pool, ceph user and ceph key
-            sudo ceph -c ${CEPH_CONF_FILE} osd pool set ${CINDER_BAK_CEPH_POOL} size ${CEPH_REPLICAS}
-            if [[ $CEPH_REPLICAS -ne 1 ]]; then
-                sudo ceph -c ${CEPH_CONF_FILE} osd pool set ${CINDER_BAK_CEPH_POOL} crush_ruleset ${RULE_ID}
-            fi
-        fi
-        sudo ceph -c ${CEPH_CONF_FILE} auth get-or-create client.${CINDER_BAK_CEPH_USER} mon "allow r" osd "allow class-read object_prefix rbd_children, allow rwx pool=${CINDER_BAK_CEPH_POOL}, allow rwx pool=${CINDER_CEPH_POOL}" | sudo tee ${CEPH_CONF_DIR}/ceph.client.${CINDER_BAK_CEPH_USER}.keyring
-        sudo chown $(whoami):$(whoami) ${CEPH_CONF_DIR}/ceph.client.${CINDER_BAK_CEPH_USER}.keyring
-
-        iniset $CINDER_CONF DEFAULT backup_driver "cinder.backup.drivers.ceph.CephBackupDriver"
-        iniset $CINDER_CONF DEFAULT backup_ceph_conf "$CEPH_CONF_FILE"
-        iniset $CINDER_CONF DEFAULT backup_ceph_pool "$CINDER_BAK_CEPH_POOL"
-        iniset $CINDER_CONF DEFAULT backup_ceph_user "$CINDER_BAK_CEPH_USER"
-        iniset $CINDER_CONF DEFAULT backup_ceph_stripe_unit 0
-        iniset $CINDER_CONF DEFAULT backup_ceph_stripe_count 0
-        iniset $CINDER_CONF DEFAULT restore_discard_excess_bytes True
-    fi
 }
 
 # Restore xtrace
diff --git a/lib/cinder_backups/ceph b/lib/cinder_backups/ceph
new file mode 100644
index 0000000000..26136bef96
--- /dev/null
+++ b/lib/cinder_backups/ceph
@@ -0,0 +1,57 @@
+#!/bin/bash
+#
+# lib/cinder_backups/ceph
+# Configure the ceph backup driver
+
+# Enable with:
+#
+#   CINDER_BACKUP_DRIVER=ceph
+
+# Dependencies:
+#
+# - ``functions`` file
+# - ``cinder`` configurations
+
+# Save trace setting
+_XTRACE_CINDER_CEPH=$(set +o | grep xtrace)
+set +o xtrace
+
+# Defaults
+# --------
+
+CINDER_BAK_CEPH_POOL=${CINDER_BAK_CEPH_POOL:-backups}
+CINDER_BAK_CEPH_POOL_PG=${CINDER_BAK_CEPH_POOL_PG:-8}
+CINDER_BAK_CEPH_POOL_PGP=${CINDER_BAK_CEPH_POOL_PGP:-8}
+CINDER_BAK_CEPH_USER=${CINDER_BAK_CEPH_USER:-cinder-bak}
+
+
+function configure_cinder_backup_ceph {
+    sudo ceph -c ${CEPH_CONF_FILE} osd pool create ${CINDER_BAK_CEPH_POOL} ${CINDER_BAK_CEPH_POOL_PG} ${CINDER_BAK_CEPH_POOL_PGP}
+    if [ "$REMOTE_CEPH" = "False" ]; then
+        # Configure Cinder backup service options, ceph pool, ceph user and ceph key
+        sudo ceph -c ${CEPH_CONF_FILE} osd pool set ${CINDER_BAK_CEPH_POOL} size ${CEPH_REPLICAS}
+        if [[ $CEPH_REPLICAS -ne 1 ]]; then
+            sudo ceph -c ${CEPH_CONF_FILE} osd pool set ${CINDER_BAK_CEPH_POOL} crush_ruleset ${RULE_ID}
+        fi
+    fi
+    sudo ceph -c ${CEPH_CONF_FILE} auth get-or-create client.${CINDER_BAK_CEPH_USER} mon "allow r" osd "allow class-read object_prefix rbd_children, allow rwx pool=${CINDER_BAK_CEPH_POOL}, allow rwx pool=${CINDER_CEPH_POOL}" | sudo tee ${CEPH_CONF_DIR}/ceph.client.${CINDER_BAK_CEPH_USER}.keyring
+    sudo chown $(whoami):$(whoami) ${CEPH_CONF_DIR}/ceph.client.${CINDER_BAK_CEPH_USER}.keyring
+
+    iniset $CINDER_CONF DEFAULT backup_driver "cinder.backup.drivers.ceph.CephBackupDriver"
+    iniset $CINDER_CONF DEFAULT backup_ceph_conf "$CEPH_CONF_FILE"
+    iniset $CINDER_CONF DEFAULT backup_ceph_pool "$CINDER_BAK_CEPH_POOL"
+    iniset $CINDER_CONF DEFAULT backup_ceph_user "$CINDER_BAK_CEPH_USER"
+    iniset $CINDER_CONF DEFAULT backup_ceph_stripe_unit 0
+    iniset $CINDER_CONF DEFAULT backup_ceph_stripe_count 0
+    iniset $CINDER_CONF DEFAULT restore_discard_excess_bytes True
+}
+
+# init_cinder_backup_ceph: nothing to do
+# cleanup_cinder_backup_ceph: nothing to do
+
+# Restore xtrace
+$_XTRACE_CINDER_CEPH
+
+# Local variables:
+# mode: shell-script
+# End:
diff --git a/lib/cinder_backups/s3_swift b/lib/cinder_backups/s3_swift
new file mode 100644
index 0000000000..6fb248606e
--- /dev/null
+++ b/lib/cinder_backups/s3_swift
@@ -0,0 +1,45 @@
+#!/bin/bash
+#
+# lib/cinder_backups/s3_swift
+# Configure the s3 backup driver with swift s3api
+#
+# TODO: create lib/cinder_backup/s3 for external s3 compatible storage
+
+# Enable with:
+#
+#   CINDER_BACKUP_DRIVER=s3_swift
+#   enable_service s3api s-proxy s-object s-container s-account
+
+# Dependencies:
+#
+# - ``functions`` file
+# - ``cinder`` configurations
+
+# Save trace setting
+_XTRACE_CINDER_S3_SWIFT=$(set +o | grep xtrace)
+set +o xtrace
+
+function configure_cinder_backup_s3_swift {
+    # This configuration requires swift and s3api. If we're
+    # on a subnode we might not know if they are enabled
+    iniset $CINDER_CONF DEFAULT backup_driver "cinder.backup.drivers.s3.S3BackupDriver"
+    iniset $CINDER_CONF DEFAULT backup_s3_endpoint_url "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$S3_SERVICE_PORT"
+}
+
+function init_cinder_backup_s3_swift {
+    openstack ec2 credential create
+    iniset $CINDER_CONF DEFAULT backup_s3_store_access_key "$(openstack ec2 credential list -c Access -f value)"
+    iniset $CINDER_CONF DEFAULT backup_s3_store_secret_key "$(openstack ec2 credential list -c Secret -f value)"
+    if is_service_enabled tls-proxy; then
+        iniset $CINDER_CONF DEFAULT backup_s3_ca_cert_file "$SSL_BUNDLE_FILE"
+    fi
+}
+
+# cleanup_cinder_backup_s3_swift: nothing to do
+
+# Restore xtrace
+$_XTRACE_CINDER_S3_SWIFT
+
+# Local variables:
+# mode: shell-script
+# End:
diff --git a/lib/cinder_backups/swift b/lib/cinder_backups/swift
new file mode 100644
index 0000000000..d7c977e1e3
--- /dev/null
+++ b/lib/cinder_backups/swift
@@ -0,0 +1,38 @@
+#!/bin/bash
+#
+# lib/cinder_backups/swift
+# Configure the swift backup driver
+
+# Enable with:
+#
+#   CINDER_BACKUP_DRIVER=swift
+
+# Dependencies:
+#
+# - ``functions`` file
+# - ``cinder`` configurations
+
+# Save trace setting
+_XTRACE_CINDER_SWIFT=$(set +o | grep xtrace)
+set +o xtrace
+
+
+function configure_cinder_backup_swift {
+    # NOTE(mriedem): The default backup driver uses swift and if we're
+    # on a subnode we might not know if swift is enabled, but chances are
+    # good that it is on the controller so configure the backup service
+    # to use it.
+    iniset $CINDER_CONF DEFAULT backup_driver "cinder.backup.drivers.swift.SwiftBackupDriver"
+    iniset $CINDER_CONF DEFAULT backup_swift_url "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$SWIFT_DEFAULT_BIND_PORT/v1/AUTH_"
+}
+
+# init_cinder_backup_swift: nothing to do
+# cleanup_cinder_backup_swift: nothing to do
+
+
+# Restore xtrace
+$_XTRACE_CINDER_SWIFT
+
+# Local variables:
+# mode: shell-script
+# End:

From 110b9a9b1b05d9163a674e5bcc05fcd8d48cb5bf Mon Sep 17 00:00:00 2001
From: Nobuhiro MIKI <nmiki@yahoo-corp.jp>
Date: Thu, 1 Apr 2021 11:00:25 +0900
Subject: [PATCH 1856/2409] Fix typo in multinode-lab document

Signed-off-by: Nobuhiro MIKI <nmiki@yahoo-corp.jp>
Change-Id: I1b6100d6b8231f1f96a7768e26ab83f010f1e4dc
---
 doc/source/guides/multinode-lab.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
index c0b3f58157..dc3568a845 100644
--- a/doc/source/guides/multinode-lab.rst
+++ b/doc/source/guides/multinode-lab.rst
@@ -395,7 +395,7 @@ SSH keys need to be exchanged between each compute node:
 
 3. Verify that login via ssh works without a password::
 
-        ssh -i /root/.ssh/id_rsa.pub stack@DESTINATION
+        ssh -i /root/.ssh/id_rsa stack@DESTINATION
 
 In essence, this means that every compute node's root user's public RSA key
 must exist in every other compute node's stack user's authorized_keys file and

From 362641b1b8b0596371f13db8448ab0f43bd53482 Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Fri, 19 Mar 2021 10:33:24 +0000
Subject: [PATCH 1857/2409] cinder: Increase VOLUME_BACKING_FILE_SIZE

As reported in bug #1920136 the tempest-integrated-compute job has
started to see insufficient free virtual space errors being reported by
c-sch and c-vol when creating volumes. This change simply increases the
default size of the underlying LVM PV used to host these volumes within
the default LVM/iSCSI c-vol backend deployed by devstack.

Change-Id: I965d4a485215ac482403f1e83609452550dfd860
Closes-Bug: #1920136
---
 stackrc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/stackrc b/stackrc
index 648a028beb..81e0f12866 100644
--- a/stackrc
+++ b/stackrc
@@ -758,8 +758,8 @@ for image_url in ${IMAGE_URLS//,/ }; do
     fi
 done
 
-# 24Gb default volume backing file size
-VOLUME_BACKING_FILE_SIZE=${VOLUME_BACKING_FILE_SIZE:-24G}
+# 30Gb default volume backing file size
+VOLUME_BACKING_FILE_SIZE=${VOLUME_BACKING_FILE_SIZE:-30G}
 
 # Prefixes for volume and instance names
 VOLUME_NAME_PREFIX=${VOLUME_NAME_PREFIX:-volume-}

From 25d37efb9154f2f08e094f4dda3366a7bcd0af31 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Tue, 6 Apr 2021 10:35:19 -0500
Subject: [PATCH 1858/2409] Update DEVSTACK_SERIES to xena

stable/wallaby branch has been created now and
current master is for xena.

Change-Id: I42f67361fe50795d929752434342effddf123486
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 648a028beb..9630221f4e 100644
--- a/stackrc
+++ b/stackrc
@@ -245,7 +245,7 @@ REQUIREMENTS_DIR=${REQUIREMENTS_DIR:-$DEST/requirements}
 # Setting the variable to 'ALL' will activate the download for all
 # libraries.
 
-DEVSTACK_SERIES="wallaby"
+DEVSTACK_SERIES="xena"
 
 ##############
 #

From 6f2c807bfade2a218636e0ca441de45c5662aca0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rados=C5=82aw=20Piliszek?= <radoslaw.piliszek@gmail.com>
Date: Tue, 6 Apr 2021 14:15:34 +0000
Subject: [PATCH 1859/2409] gzip, not xz

xz may cause POST_FAILUREs due to memory pressure [1].

[1] http://lists.openstack.org/pipermail/openstack-discuss/2021-April/021609.html

Change-Id: I2ea3175ecf2508b62640bfffdd798d7072e55550
---
 roles/export-devstack-journal/tasks/main.yaml                   | 2 +-
 .../templates/devstack.journal.README.txt.j2                    | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/roles/export-devstack-journal/tasks/main.yaml b/roles/export-devstack-journal/tasks/main.yaml
index ef839edaaf..db38b10a44 100644
--- a/roles/export-devstack-journal/tasks/main.yaml
+++ b/roles/export-devstack-journal/tasks/main.yaml
@@ -45,7 +45,7 @@
     cmd: |
       journalctl -o export \
           --since="$(cat {{ devstack_base_dir }}/log-start-timestamp.txt)" \
-        | xz --threads=0 - > {{ stage_dir }}/logs/devstack.journal.xz
+        | gzip > {{ stage_dir }}/logs/devstack.journal.gz
 
 - name: Save journal README
   become: true
diff --git a/roles/export-devstack-journal/templates/devstack.journal.README.txt.j2 b/roles/export-devstack-journal/templates/devstack.journal.README.txt.j2
index fe36653102..30519f63d7 100644
--- a/roles/export-devstack-journal/templates/devstack.journal.README.txt.j2
+++ b/roles/export-devstack-journal/templates/devstack.journal.README.txt.j2
@@ -7,7 +7,7 @@ devstack run.
 To use it, you will need to convert it so journalctl can read it
 locally.  After downloading the file:
 
- $ /lib/systemd/systemd-journal-remote <(xzcat ./devstack.journal.xz) -o output.journal
+ $ /lib/systemd/systemd-journal-remote <(zcat ./devstack.journal.gz) -o output.journal
 
 Note this binary is not in the regular path.  On Debian/Ubuntu
 platforms, you will need to have the "systemd-journal-remote" package

From 448db9ec41930d13a785c553e09a34417507f594 Mon Sep 17 00:00:00 2001
From: Francesco Pantano <fpantano@redhat.com>
Date: Fri, 19 Feb 2021 13:25:10 +0100
Subject: [PATCH 1860/2409] Rely on ceph.conf settings when cinder backup pool
 is created

Ceph adds the osd pool default size option on ceph.conf via [1];
this means we don't need to specify the size of this pool if
the same value (same variable) is used (CEPH_REPLICAS).
This change is an attempt of removing the size setting, relying
on the implicit declaration of the value provided by ceph.conf.

[1] https://github.com/openstack/devstack-plugin-ceph/blob/master/devstack/lib/ceph#L425

Change-Id: I5fa2105ceb3b97a4e38926d76c1e4028f1108d4a
---
 lib/cinder_backups/ceph | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/lib/cinder_backups/ceph b/lib/cinder_backups/ceph
index 26136bef96..e4003c0720 100644
--- a/lib/cinder_backups/ceph
+++ b/lib/cinder_backups/ceph
@@ -27,12 +27,8 @@ CINDER_BAK_CEPH_USER=${CINDER_BAK_CEPH_USER:-cinder-bak}
 
 function configure_cinder_backup_ceph {
     sudo ceph -c ${CEPH_CONF_FILE} osd pool create ${CINDER_BAK_CEPH_POOL} ${CINDER_BAK_CEPH_POOL_PG} ${CINDER_BAK_CEPH_POOL_PGP}
-    if [ "$REMOTE_CEPH" = "False" ]; then
-        # Configure Cinder backup service options, ceph pool, ceph user and ceph key
-        sudo ceph -c ${CEPH_CONF_FILE} osd pool set ${CINDER_BAK_CEPH_POOL} size ${CEPH_REPLICAS}
-        if [[ $CEPH_REPLICAS -ne 1 ]]; then
-            sudo ceph -c ${CEPH_CONF_FILE} osd pool set ${CINDER_BAK_CEPH_POOL} crush_ruleset ${RULE_ID}
-        fi
+    if [[ "$REMOTE_CEPH" = "False" && "$CEPH_REPLICAS" -ne 1 ]]; then
+        sudo ceph -c ${CEPH_CONF_FILE} osd pool set ${CINDER_BAK_CEPH_POOL} crush_ruleset ${RULE_ID}
     fi
     sudo ceph -c ${CEPH_CONF_FILE} auth get-or-create client.${CINDER_BAK_CEPH_USER} mon "allow r" osd "allow class-read object_prefix rbd_children, allow rwx pool=${CINDER_BAK_CEPH_POOL}, allow rwx pool=${CINDER_CEPH_POOL}" | sudo tee ${CEPH_CONF_DIR}/ceph.client.${CINDER_BAK_CEPH_USER}.keyring
     sudo chown $(whoami):$(whoami) ${CEPH_CONF_DIR}/ceph.client.${CINDER_BAK_CEPH_USER}.keyring

From 580fec54c3a970de80ab66b3decca69704ff1179 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Thu, 8 Apr 2021 11:03:37 -0500
Subject: [PATCH 1861/2409] Make stackviz tasks not to fail jobs

Due to issue on stckviz side, job start
failing with POST_FAILURE. If we fix the
issue still we need to wait for periodic job
periodic-package-stackviz-element to publish
the latest tarball on https://tarballs.openstack.org/stackviz/dist/.

Let's not fail the job for any issue occur during
stackviz processing.

Closes-Bug: 1863161

Change-Id: Ifee04f28ecee52e74803f1623aba5cfe5ee5ec90
---
 roles/process-stackviz/tasks/main.yaml | 125 +++++++++++++------------
 1 file changed, 64 insertions(+), 61 deletions(-)

diff --git a/roles/process-stackviz/tasks/main.yaml b/roles/process-stackviz/tasks/main.yaml
index c51c66cdb3..3ba3d9c2e6 100644
--- a/roles/process-stackviz/tasks/main.yaml
+++ b/roles/process-stackviz/tasks/main.yaml
@@ -1,70 +1,73 @@
-- name: Devstack checks if stackviz archive exists
-  stat:
-    path: "/opt/cache/files/stackviz-latest.tar.gz"
-  register: stackviz_archive
+- name: Process Stackviz
+  block:
 
-- debug:
-    msg: "Stackviz archive could not be found in /opt/cache/files/stackviz-latest.tar.gz"
-  when: not stackviz_archive.stat.exists
+  - name: Devstack checks if stackviz archive exists
+    stat:
+      path: "/opt/cache/files/stackviz-latest.tar.gz"
+    register: stackviz_archive
 
-- name: Check if subunit data exists
-  stat:
-    path: "{{ zuul_work_dir }}/testrepository.subunit"
-  register: subunit_input
+  - debug:
+      msg: "Stackviz archive could not be found in /opt/cache/files/stackviz-latest.tar.gz"
+    when: not stackviz_archive.stat.exists
 
-- debug:
-    msg: "Subunit file could not be found at {{ zuul_work_dir }}/testrepository.subunit"
-  when: not subunit_input.stat.exists
+  - name: Check if subunit data exists
+    stat:
+      path: "{{ zuul_work_dir }}/testrepository.subunit"
+    register: subunit_input
 
-- name: Install stackviz
-  when:
-    - stackviz_archive.stat.exists
-    - subunit_input.stat.exists
-  block:
-    - include_role:
-        name: ensure-pip
+  - debug:
+      msg: "Subunit file could not be found at {{ zuul_work_dir }}/testrepository.subunit"
+    when: not subunit_input.stat.exists
+
+  - name: Install stackviz
+    when:
+      - stackviz_archive.stat.exists
+      - subunit_input.stat.exists
+    block:
+      - include_role:
+          name: ensure-pip
+
+      - pip:
+          name: "file://{{ stackviz_archive.stat.path }}"
+          virtualenv: /tmp/stackviz
+          virtualenv_command: '{{ ensure_pip_virtualenv_command }}'
+          extra_args: -U
 
-    - pip:
-        name: "file://{{ stackviz_archive.stat.path }}"
-        virtualenv: /tmp/stackviz
-        virtualenv_command: '{{ ensure_pip_virtualenv_command }}'
-        extra_args: -U
+  - name: Deploy stackviz static html+js
+    command: cp -pR /tmp/stackviz/share/stackviz-html {{ stage_dir }}/stackviz
+    when:
+      - stackviz_archive.stat.exists
+      - subunit_input.stat.exists
 
-- name: Deploy stackviz static html+js
-  command: cp -pR /tmp/stackviz/share/stackviz-html {{ stage_dir }}/stackviz
-  when:
-    - stackviz_archive.stat.exists
-    - subunit_input.stat.exists
+  - name: Check if dstat data exists
+    stat:
+      path: "{{ devstack_base_dir }}/logs/dstat-csv.log"
+    register: dstat_input
+    when:
+      - stackviz_archive.stat.exists
+      - subunit_input.stat.exists
 
-- name: Check if dstat data exists
-  stat:
-    path: "{{ devstack_base_dir }}/logs/dstat-csv.log"
-  register: dstat_input
-  when:
-    - stackviz_archive.stat.exists
-    - subunit_input.stat.exists
+  - name: Run stackviz with dstat
+    shell: |
+      cat {{ subunit_input.stat.path }} | \
+        /tmp/stackviz/bin/stackviz-export \
+          --dstat "{{ devstack_base_dir }}/logs/dstat-csv.log" \
+          --env --stdin \
+          {{ stage_dir }}/stackviz/data
+    when:
+      - stackviz_archive.stat.exists
+      - subunit_input.stat.exists
+      - dstat_input.stat.exists
 
-- name: Run stackviz with dstat
-  shell: |
-    cat {{ subunit_input.stat.path }} | \
-      /tmp/stackviz/bin/stackviz-export \
-        --dstat "{{ devstack_base_dir }}/logs/dstat-csv.log" \
-        --env --stdin \
-        {{ stage_dir }}/stackviz/data
-  when:
-    - stackviz_archive.stat.exists
-    - subunit_input.stat.exists
-    - dstat_input.stat.exists
-  failed_when: False
+  - name: Run stackviz without dstat
+    shell: |
+      cat {{ subunit_input.stat.path }} | \
+        /tmp/stackviz/bin/stackviz-export \
+          --env --stdin \
+          {{ stage_dir }}/stackviz/data
+    when:
+      - stackviz_archive.stat.exists
+      - subunit_input.stat.exists
+      - not dstat_input.stat.exists
 
-- name: Run stackviz without dstat
-  shell: |
-    cat {{ subunit_input.stat.path }} | \
-      /tmp/stackviz/bin/stackviz-export \
-        --env --stdin \
-        {{ stage_dir }}/stackviz/data
-  when:
-    - stackviz_archive.stat.exists
-    - subunit_input.stat.exists
-    - not dstat_input.stat.exists
-  failed_when: False
+  ignore_errors: yes

From aa5c38727b314b03cd7ab69612435aa206bd5e2c Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Wed, 14 Apr 2021 14:27:32 -0700
Subject: [PATCH 1862/2409] Work around CHILD_MAX bash limitation for async

Apparently bash (via POSIX) only guarantees a small (32ish) number of
children can be started and their statuses retrieved at any given
point. On larger jobs with lots of plugins and additional work, we
may go over that limit, especially for long-lived children, such
as the install_tempest task.

This works around that issue by creating a fifo for each child at
spawn time. When the child is complete, it will block on a read
against that fifo (and thus not exit). When the parent goes to wait
on the child, it first writes to that fifo, unblocking the child so
that it can exit near the time we go to wait.

Closes-Bug: #1923728
Change-Id: Id755bdb1e7f1664ec08742d034c174e87a3d2902
---
 inc/async | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/inc/async b/inc/async
index c63bc2045a..11bcdfa39e 100644
--- a/inc/async
+++ b/inc/async
@@ -57,6 +57,7 @@ function async_log {
 function async_inner {
     local name="$1"
     local rc
+    local fifo=${DEST}/async/${name}.fifo
     shift
     set -o xtrace
     if $* >${DEST}/async/${name}.log 2>&1; then
@@ -69,6 +70,8 @@ function async_inner {
         async_log "$name" "FAILED with rc $rc"
     fi
     iniset ${DEST}/async/${name}.ini job end_time $(date "+%s%3N")
+    # Block on the fifo until we are signaled to exit by the main process
+    cat $fifo
     return $rc
 }
 
@@ -86,12 +89,14 @@ function async_run {
     local name="$1"
     shift
     local inifile=${DEST}/async/${name}.ini
+    local fifo=${DEST}/async/${name}.fifo
 
     touch $inifile
     iniset $inifile job command "$*"
     iniset $inifile job start_time $(date +%s%3N)
 
     if [[ "$DEVSTACK_PARALLEL" = "True" ]]; then
+        mkfifo $fifo
         async_inner $name $* &
         iniset $inifile job pid $!
         async_log "$name" "running: %command"
@@ -119,17 +124,23 @@ function async_wait {
     xtrace=$(set +o | grep xtrace)
     set +o xtrace
 
-    local pid rc running inifile runtime
+    local pid rc running inifile runtime fifo
     rc=0
     for name in $*; do
         running=$(ls ${DEST}/async/*.ini 2>/dev/null | wc -l)
         inifile="${DEST}/async/${name}.ini"
+        fifo=${DEST}/async/${name}.fifo
 
         if pid=$(async_pidof "$name"); then
             async_log "$name" "Waiting for completion of %command" \
                       "($running other jobs running)"
             time_start async_wait
             if [[ "$pid" != "self" ]]; then
+                # Signal the child to go ahead and exit since we are about to
+                # wait for it to collect its status.
+                echo "Signaling exit"
+                echo WAKEUP > $fifo
+                echo "Signaled"
                 # Do not actually call wait if we ran synchronously
                 if wait $pid; then
                     rc=0
@@ -137,6 +148,7 @@ function async_wait {
                     rc=$?
                 fi
                 cat ${DEST}/async/${name}.log
+                rm -f $fifo
             fi
             time_stop async_wait
             local start_time

From 51e384554b4653a05abea435432431cdca4728fb Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Wed, 14 Apr 2021 07:23:10 -0700
Subject: [PATCH 1863/2409] Add some debug to async_wait failures

This dumps some data in the case where we fail to wait for a child
pid to help debug what is going on. This also cleans up a few review
comments from the actual fix.

Change-Id: I7b58ce0cf2b41bdffa448973edb4c992fe5f730c
Related-Bug: #1923728
---
 inc/async | 31 +++++++++++++++++++++++++------
 1 file changed, 25 insertions(+), 6 deletions(-)

diff --git a/inc/async b/inc/async
index 11bcdfa39e..56338f5343 100644
--- a/inc/async
+++ b/inc/async
@@ -48,7 +48,7 @@ function async_log {
     command=$(iniget $inifile job command | tr '#' '-')
     message=$(echo "$message" | sed "s#%command#$command#g")
 
-    echo "[Async ${name}:${pid}]: $message"
+    echo "[$BASHPID Async ${name}:${pid}]: $message"
 }
 
 # Inner function that actually runs the requested task. We wrap it like this
@@ -57,7 +57,7 @@ function async_log {
 function async_inner {
     local name="$1"
     local rc
-    local fifo=${DEST}/async/${name}.fifo
+    local fifo="${DEST}/async/${name}.fifo"
     shift
     set -o xtrace
     if $* >${DEST}/async/${name}.log 2>&1; then
@@ -116,6 +116,24 @@ function async_runfunc {
     async_run $1 $*
 }
 
+# Dump some information to help debug a failed wait
+function async_wait_dump {
+    local failpid=$1
+
+    echo "=== Wait failure dump from $BASHPID ==="
+    echo "Processes:"
+    ps -f
+    echo "Waiting jobs:"
+    for name in $(ls ${DEST}/async/*.ini); do
+        echo "Job $name :"
+        cat "$name"
+    done
+    echo "Failed PID status:"
+    sudo cat /proc/$failpid/status
+    sudo cat /proc/$failpid/cmdline
+    echo "=== End wait failure dump ==="
+}
+
 # Wait for an async future to complete. May return immediately if already
 # complete, or of the future has already been waited on (avoid this). May
 # block until the future completes.
@@ -129,18 +147,18 @@ function async_wait {
     for name in $*; do
         running=$(ls ${DEST}/async/*.ini 2>/dev/null | wc -l)
         inifile="${DEST}/async/${name}.ini"
-        fifo=${DEST}/async/${name}.fifo
+        fifo="${DEST}/async/${name}.fifo"
 
         if pid=$(async_pidof "$name"); then
             async_log "$name" "Waiting for completion of %command" \
-                      "($running other jobs running)"
+                      "running on PID $pid ($running other jobs running)"
             time_start async_wait
             if [[ "$pid" != "self" ]]; then
                 # Signal the child to go ahead and exit since we are about to
                 # wait for it to collect its status.
-                echo "Signaling exit"
+                async_log "$name" "Signaling child to exit"
                 echo WAKEUP > $fifo
-                echo "Signaled"
+                async_log "$name" "Signaled"
                 # Do not actually call wait if we ran synchronously
                 if wait $pid; then
                     rc=0
@@ -161,6 +179,7 @@ function async_wait {
                       "$rc in $runtime seconds"
             rm -f $inifile
             if [ $rc -ne 0 ]; then
+                async_wait_dump $pid
                 echo Stopping async wait due to error: $*
                 break
             fi

From d04e795b316f5be466532e60104a983bf6419716 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rados=C5=82aw=20Piliszek?= <radoslaw.piliszek@gmail.com>
Date: Mon, 19 Apr 2021 06:52:30 +0000
Subject: [PATCH 1864/2409] [TrivialFix] Delete symlink apts-debs

Follow up on old I0416180db5b6add996ce5b48c6966c1b68adbcb0

Change-Id: If2f6166cf7c585bf303d0f6c28a2745d85eabbed
---
 files/apts | 1 -
 1 file changed, 1 deletion(-)
 delete mode 120000 files/apts

diff --git a/files/apts b/files/apts
deleted file mode 120000
index ef926de053..0000000000
--- a/files/apts
+++ /dev/null
@@ -1 +0,0 @@
-debs/
\ No newline at end of file

From c062792709def9ef10ddac68867e1b7bf9009435 Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Tue, 9 Mar 2021 22:36:57 +0000
Subject: [PATCH 1865/2409] cinder: Default CINDER_ISCSI_HELPER to lioadm

As outlined in bug #1917750 the use of tgtadm in multinode environments
with multiple c-vol services can cause volumes to use duplicate WWNs.

This has been shown to cause some encrypted volume test failures as
os-brick returns a /dev/disk/by-id path to n-cpu that can point to the
wrong underlying volume when multiple volumes with the same WWN are
connected to a host.

There is also some speculation that the duplicate WWNs are also causing
libvirt to fail to detach volumes from instances but as yet this has not
been proven.

This change aims to avoid all of the above by switching the default of
CINDER_ISCSI_HELPER to lioadm for all deployments instead of just EL and
SUSE based deployments.

The Bionic platform job however is pinned to tgtadm as there issues
installing python3-rtslib-fb.

Closes-Bug: #1917750
Change-Id: If5c860d1e69aaef9a9236303c370479a7714ad43
---
 .zuul.yaml |  3 +++
 lib/cinder | 10 +++++-----
 2 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 67d4c24000..00129b5ca4 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -590,6 +590,9 @@
     description: Ubuntu Bionic platform test
     nodeset: openstack-single-node-bionic
     voting: false
+    vars:
+      devstack_localrc:
+        CINDER_ISCSI_HELPER: tgtadm
 
 - job:
     name: devstack-async
diff --git a/lib/cinder b/lib/cinder
index f20631b56c..9c8d85cf59 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -88,15 +88,15 @@ CINDER_ENABLED_BACKENDS=${CINDER_ENABLED_BACKENDS:-lvm:lvmdriver-1}
 CINDER_VOLUME_CLEAR=${CINDER_VOLUME_CLEAR:-${CINDER_VOLUME_CLEAR_DEFAULT:-zero}}
 CINDER_VOLUME_CLEAR=$(echo ${CINDER_VOLUME_CLEAR} | tr '[:upper:]' '[:lower:]')
 
-# Centos7 and OpenSUSE switched to using LIO and that's all that's supported,
-# although the tgt bits are in EPEL and OpenSUSE we don't want that for CI
+# Default to lioadm
+CINDER_ISCSI_HELPER=${CINDER_ISCSI_HELPER:-lioadm}
+
+# EL and SUSE should only use lioadm, we continue to allow Ubuntu based
+# deployments to use tgtadm for specific jobs in the cinder-tempest-plugin
 if is_fedora || is_suse; then
-    CINDER_ISCSI_HELPER=${CINDER_ISCSI_HELPER:-lioadm}
     if [[ ${CINDER_ISCSI_HELPER} != "lioadm" ]]; then
         die "lioadm is the only valid Cinder target_helper config on this platform"
     fi
-else
-    CINDER_ISCSI_HELPER=${CINDER_ISCSI_HELPER:-tgtadm}
 fi
 
 # For backward compatibility

From 0386c1cda61b57da3aedde05e317137c354fb4d9 Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Wed, 28 Apr 2021 09:26:23 +0100
Subject: [PATCH 1866/2409] cinder: Default CINDER_ISCSI_HELPER to tgtadm on
 Bionic

If5c860d1e69aaef9a9236303c370479a7714ad43 attempted to move this default
to lioadm while pinning certain Bionic based jobs to tgtadm.

Unfortunately it missed the legacy dsvm based jobs within various
projects that do not inherit from the devstack-platform-bionic base job
and that are also not covered by devstack's gate.

This change simply forces CINDER_ISCSI_HELPER to tgtadm on Bionic based
hosts to ensure it is always used.

Closes-Bug: #1926411
Change-Id: Ib4b38b45f25575c92fb09b8e97fa1b24af0cc06a
---
 lib/cinder | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 9c8d85cf59..34d618674e 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -91,8 +91,13 @@ CINDER_VOLUME_CLEAR=$(echo ${CINDER_VOLUME_CLEAR} | tr '[:upper:]' '[:lower:]')
 # Default to lioadm
 CINDER_ISCSI_HELPER=${CINDER_ISCSI_HELPER:-lioadm}
 
-# EL and SUSE should only use lioadm, we continue to allow Ubuntu based
-# deployments to use tgtadm for specific jobs in the cinder-tempest-plugin
+# Bionic needs to default to tgtadm until support is dropped within devstack
+# as the rtslib-fb-targetctl service doesn't start after installing lioadm.
+if is_ubuntu && [[ "$DISTRO" == "bionic" ]]; then
+    CINDER_ISCSI_HELPER=tgtadm
+fi
+
+# EL and SUSE should only use lioadm
 if is_fedora || is_suse; then
     if [[ ${CINDER_ISCSI_HELPER} != "lioadm" ]]; then
         die "lioadm is the only valid Cinder target_helper config on this platform"

From b02a43291cc5e2d5677ecbb80c0fd608d67a1374 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 27 Nov 2018 12:59:04 +1100
Subject: [PATCH 1867/2409] Handle disappearing pids in mlock_report.py

If a pid disappears on us while we're reading, we should just continue
on.

EnvironmentError is just an alias for OSError since Python 3.3, so use
the latter name. [0]

[0] https://docs.python.org/3/library/exceptions.html#OSError

Change-Id: I3a25cca328e1469f72c84a118a9691c1c0258bc4
Closes-Bug: #1926434
---
 tools/mlock_report.py | 22 ++++++++++++----------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/tools/mlock_report.py b/tools/mlock_report.py
index b15a0bf80b..1b081bbe6f 100644
--- a/tools/mlock_report.py
+++ b/tools/mlock_report.py
@@ -24,17 +24,19 @@ def _get_report():
         # iterate over the /proc/%pid/status files manually
         try:
             s = open("%s/%d/status" % (psutil.PROCFS_PATH, proc.pid), 'r')
-        except EnvironmentError:
+            with s:
+                for line in s:
+                    result = LCK_SUMMARY_REGEX.search(line)
+                    if result:
+                        locked = int(result.group('locked'))
+                        if locked:
+                            mlock_users.append({'name': proc.name(),
+                                                'pid': proc.pid,
+                                                'locked': locked})
+        except OSError:
+            # pids can disappear, we're ok with that
             continue
-        with s:
-            for line in s:
-                result = LCK_SUMMARY_REGEX.search(line)
-                if result:
-                    locked = int(result.group('locked'))
-                    if locked:
-                        mlock_users.append({'name': proc.name(),
-                                            'pid': proc.pid,
-                                            'locked': locked})
+
 
     # produce a single line log message with per process mlock stats
     if mlock_users:

From 7ad4cd07c8bf4f302acc4fc6684e362309332c9d Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Thu, 29 Apr 2021 09:24:38 -0500
Subject: [PATCH 1868/2409] Drop Bionic support

Since victoria cycle, we have moved upstream testing to
Ubuntu Focal (20.04) and so does no Bionic distro in
Xena cycle testing runtime[1]. Grenade jobs also started
running on Focal since victoria was released.

Only thing left was legacy jobs which were not migrated to
Ubuntu Focal in Victoria and as per another community-wide
goal[2], all the lgeacy jobs were suppsoed to be migrated
to zuulv3 native jobs in victoria cycle itself. One of the
pending job was in nova (nova-grenade-multinode) which is also
migrated to zuulv3 native now
- https://review.opendev.org/c/openstack/nova/+/778885

If there is any job running on bionic, we strongly recommend
to migrate it to Ubuntu Focal.

[1] https://governance.openstack.org/tc/reference/runtimes/xena.html
[2] https://governance.openstack.org/tc/goals/selected/victoria/native-zuulv3-jobs.html

Change-Id: I39e38e4a6c2e52dd3822c9fdea354258359a9f53
---
 .zuul.yaml           | 11 -----------
 lib/apache           |  3 ---
 lib/cinder           |  6 ------
 stack.sh             |  2 +-
 tools/fixup_stuff.sh | 38 --------------------------------------
 5 files changed, 1 insertion(+), 59 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 00129b5ca4..b65aeec4dd 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -584,16 +584,6 @@
     voting: false
     timeout: 9000
 
-- job:
-    name: devstack-platform-bionic
-    parent: tempest-full-py3
-    description: Ubuntu Bionic platform test
-    nodeset: openstack-single-node-bionic
-    voting: false
-    vars:
-      devstack_localrc:
-        CINDER_ISCSI_HELPER: tgtadm
-
 - job:
     name: devstack-async
     parent: tempest-full-py3
@@ -695,7 +685,6 @@
         - devstack-ipv6
         - devstack-platform-fedora-latest
         - devstack-platform-centos-8
-        - devstack-platform-bionic
         - devstack-async
         - devstack-multinode
         - devstack-unit-tests
diff --git a/lib/apache b/lib/apache
index 870a65a9d2..04259ba31f 100644
--- a/lib/apache
+++ b/lib/apache
@@ -93,9 +93,6 @@ function install_apache_uwsgi {
 
     if is_ubuntu; then
         local pkg_list="uwsgi uwsgi-plugin-python3 libapache2-mod-proxy-uwsgi"
-        if [[ "$DISTRO" == 'bionic' ]]; then
-            pkg_list="${pkg_list} uwsgi-plugin-python"
-        fi
         install_package ${pkg_list}
     elif is_fedora; then
         # Note httpd comes with mod_proxy_uwsgi and it is loaded by
diff --git a/lib/cinder b/lib/cinder
index 34d618674e..7d6e843a3d 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -91,12 +91,6 @@ CINDER_VOLUME_CLEAR=$(echo ${CINDER_VOLUME_CLEAR} | tr '[:upper:]' '[:lower:]')
 # Default to lioadm
 CINDER_ISCSI_HELPER=${CINDER_ISCSI_HELPER:-lioadm}
 
-# Bionic needs to default to tgtadm until support is dropped within devstack
-# as the rtslib-fb-targetctl service doesn't start after installing lioadm.
-if is_ubuntu && [[ "$DISTRO" == "bionic" ]]; then
-    CINDER_ISCSI_HELPER=tgtadm
-fi
-
 # EL and SUSE should only use lioadm
 if is_fedora || is_suse; then
     if [[ ${CINDER_ISCSI_HELPER} != "lioadm" ]]; then
diff --git a/stack.sh b/stack.sh
index ca9ecfa213..9d854da581 100755
--- a/stack.sh
+++ b/stack.sh
@@ -227,7 +227,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-SUPPORTED_DISTROS="bionic|focal|f31|f32|opensuse-15.2|opensuse-tumbleweed|rhel8"
+SUPPORTED_DISTROS="focal|f31|f32|opensuse-15.2|opensuse-tumbleweed|rhel8"
 
 if [[ ! ${DISTRO} =~ $SUPPORTED_DISTROS ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index 25f726892f..19219435ad 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -59,43 +59,6 @@ function fixup_keystone {
     fi
 }
 
-# Ubuntu Repositories
-#--------------------
-# Enable universe for bionic since it is missing when installing from ISO.
-function fixup_ubuntu {
-    if [[ "$DISTRO" != "bionic" ]]; then
-        return
-    fi
-
-    # This pulls in apt-add-repository
-    install_package "software-properties-common"
-
-    # Enable universe
-    sudo add-apt-repository -y universe
-
-    if [[ -f /etc/ci/mirror_info.sh ]] ; then
-        # If we are on a nodepool provided host and it has told us about
-        # where we can find local mirrors then use that mirror.
-        source /etc/ci/mirror_info.sh
-        sudo apt-add-repository -y "deb $NODEPOOL_UCA_MIRROR bionic-updates/ussuri main"
-    else
-        # Enable UCA:ussuri for updated versions of QEMU and libvirt
-        sudo add-apt-repository -y cloud-archive:ussuri
-    fi
-    REPOS_UPDATED=False
-    apt_get_update
-
-    # Since pip10, pip will refuse to uninstall files from packages
-    # that were created with distutils (rather than more modern
-    # setuptools).  This is because it technically doesn't have a
-    # manifest of what to remove.  However, in most cases, simply
-    # overwriting works.  So this hacks around those packages that
-    # have been dragged in by some other system dependency
-    sudo rm -rf /usr/lib/python3/dist-packages/httplib2-*.egg-info
-    sudo rm -rf /usr/lib/python3/dist-packages/pyasn1_modules-*.egg-info
-    sudo rm -rf /usr/lib/python3/dist-packages/PyYAML-*.egg-info
-}
-
 # Python Packages
 # ---------------
 
@@ -194,7 +157,6 @@ function fixup_ovn_centos {
 
 function fixup_all {
     fixup_keystone
-    fixup_ubuntu
     fixup_fedora
     fixup_suse
 }

From 06b7352478170521a07875154eef317bde0c5321 Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Thu, 29 Apr 2021 11:46:35 -0700
Subject: [PATCH 1869/2409] Fix async race updating nova configs

The configure_neutron_nova function updates nova configs. While that is
still running we separately update nova configs in stack.sh. This can
result in unexpected configs (that don't work). Fix this by waiting for
configure_neutron_nova to complete its work before we do nova config
updates directly in stack.sh.

For specifics we say that:

  [neutron]
  project_domain_name = Default

was missing from both nova.conf and nova-cpu.conf and instances could
not be created because keystone complained about not finding domain in
project. The strong suspicion here is that on some systems
configure_neutron_nova would write out project_domain_name while the
stack.sh inisets were running resulting in stack.sh overwriting the
project_domain_name content.

One theory is that disabling swift makes this problem more likely as
there is swift work in the middle of the async period. This is supported
by the fact that our job that hits this problem does indeed disable
swift.

Change-Id: I0961d882d555a21233c6b4fbfc077cfe33b88499
---
 stack.sh | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/stack.sh b/stack.sh
index ca9ecfa213..163fc5b370 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1238,17 +1238,21 @@ fi
 # deployments.  This ensures the keys match across nova and cinder across all
 # hosts.
 FIXED_KEY=${FIXED_KEY:-bae3516cc1c0eb18b05440eba8012a4a880a2ee04d584a9c1579445e675b12defdc716ec}
-if is_service_enabled nova; then
-    iniset $NOVA_CONF key_manager fixed_key "$FIXED_KEY"
-    iniset $NOVA_CPU_CONF key_manager fixed_key "$FIXED_KEY"
-fi
-
 if is_service_enabled cinder; then
     iniset $CINDER_CONF key_manager fixed_key "$FIXED_KEY"
 fi
 
 async_wait configure_neutron_nova
 
+# NOTE(clarkb): This must come after async_wait configure_neutron_nova because
+# configure_neutron_nova modifies $NOVA_CONF and $NOVA_CPU_CONF as well. If
+# we don't wait then these two ini updates race either other and can result
+# in unexpected configs.
+if is_service_enabled nova; then
+    iniset $NOVA_CONF key_manager fixed_key "$FIXED_KEY"
+    iniset $NOVA_CPU_CONF key_manager fixed_key "$FIXED_KEY"
+fi
+
 # Launch the nova-api and wait for it to answer before continuing
 if is_service_enabled n-api; then
     echo_summary "Starting Nova API"

From 5c304d817682d6c807b532b50a2f105479ac3fa2 Mon Sep 17 00:00:00 2001
From: Lucas Alvares Gomes <lucasagomes@gmail.com>
Date: Thu, 11 Jun 2020 11:00:56 +0100
Subject: [PATCH 1870/2409] Change Neutron's default ML2 driver to OVN

As part of the Victoria PTG the Neutron community [0] agreed on changing
the default backend driver from ML2/OVS to ML2/OVN in DevStack. A lot of
changes have been submitted towards this goal including but not limted
to:

* Moving the OVN module to DevStack:
  https://review.opendev.org/c/openstack/devstack/+/734621

* Updating the OVN module to use distro packages instead of compiling
  OVN from source: https://review.opendev.org/c/openstack/devstack/+/763402o

And now this patch is changing the the actual Q_AGENT,
Q_ML2_TENANT_NETWORK_TYPE and Q_ML2_PLUGIN_MECHANISM_DRIVERS values in
devstack to what is expected by OVN as well as updating the Zuul
templates to enable the OVN services.

[0] https://etherpad.opendev.org/p/neutron-victoria-ptg

Change-Id: I92054ce9d2ab7a42746ed5dececef583b0f8a833
Signed-off-by: Lucas Alvares Gomes <lucasagomes@gmail.com>
---
 .zuul.yaml              | 35 +++++++++++++++++++++++++++--------
 lib/neutron_plugins/ml2 |  6 +++---
 2 files changed, 30 insertions(+), 11 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 00129b5ca4..e133bfacd7 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -468,6 +468,10 @@
         SWIFT_HASH: 1234123412341234
         DEBUG_LIBVIRT_COREDUMPS: true
         NOVA_VNC_ENABLED: true
+        OVN_L3_CREATE_PUBLIC_NETWORK: true
+        OVN_DBS_LOG_LEVEL: dbg
+        ENABLE_CHASSIS_AS_GW: true
+        Q_USE_PROVIDERNET_FOR_PUBLIC: true
       devstack_local_conf:
         post-config:
           $NEUTRON_CONF:
@@ -477,7 +481,11 @@
         # Core services enabled for this branch.
         # This list replaces the test-matrix.
         # Shared services
-        dstat: true
+        #
+        # NOTE(lucasagomes): disable dstat until bug
+        # https://bugs.launchpad.net/ubuntu/+source/dstat/+bug/1866619 is
+        # fixed. Also see: https://bugs.launchpad.net/neutron/+bug/1898863
+        dstat: false
         etcd3: true
         memory_tracker: true
         mysql: true
@@ -496,13 +504,14 @@
         n-sch: true
         # Placement service
         placement-api: true
+        # OVN services
+        ovn-controller: true
+        ovn-northd: true
+        ovs-vswitchd: true
+        ovsdb-server: true
         # Neutron services
-        q-agt: true
-        q-dhcp: true
-        q-l3: true
-        q-meta: true
-        q-metering: true
         q-svc: true
+        q-ovn-metadata-agent: true
         # Swift services
         s-account: true
         s-container: true
@@ -527,15 +536,24 @@
           # Core services enabled for this branch.
           # This list replaces the test-matrix.
           # Shared services
-          dstat: true
+          #
+          # NOTE(lucasagomes): disable dstat until bug
+          # https://bugs.launchpad.net/ubuntu/+source/dstat/+bug/1866619 is
+          # fixed. Also see: https://bugs.launchpad.net/neutron/+bug/1898863
+          dstat: false
           memory_tracker: true
           tls-proxy: true
           # Nova services
           n-cpu: true
           # Placement services
           placement-client: true
+          # OVN services
+          ovn-controller: true
+          ovn-northd: false
+          ovs-vswitchd: true
+          ovsdb-server: true
           # Neutron services
-          q-agt: true
+          q-ovn-metadata-agent: true
           # Cinder services
           c-bak: true
           c-vol: true
@@ -549,6 +567,7 @@
           # integrated gate, so specifying the services has not effect.
           # ceilometer-*: false
         devstack_localrc:
+          ENABLE_CHASSIS_AS_GW: false
           # Subnode specific settings
           GLANCE_HOSTPORT: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}:9292"
           Q_HOST: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}"
diff --git a/lib/neutron_plugins/ml2 b/lib/neutron_plugins/ml2
index ae4b251d83..a58ba5cbcd 100644
--- a/lib/neutron_plugins/ml2
+++ b/lib/neutron_plugins/ml2
@@ -8,14 +8,14 @@ _XTRACE_NEUTRON_ML2=$(set +o | grep xtrace)
 set +o xtrace
 
 # Default openvswitch L2 agent
-Q_AGENT=${Q_AGENT:-openvswitch}
+Q_AGENT=${Q_AGENT:-ovn}
 if [ -f $TOP_DIR/lib/neutron_plugins/${Q_AGENT}_agent ]; then
     source $TOP_DIR/lib/neutron_plugins/${Q_AGENT}_agent
 fi
 
 # Enable this to simply and quickly enable tunneling with ML2.
 # Select either 'gre', 'vxlan', or 'gre,vxlan'
-Q_ML2_TENANT_NETWORK_TYPE=${Q_ML2_TENANT_NETWORK_TYPE:-"vxlan"}
+Q_ML2_TENANT_NETWORK_TYPE=${Q_ML2_TENANT_NETWORK_TYPE:-"geneve"}
 # This has to be set here since the agent will set this in the config file
 if [[ "$Q_ML2_TENANT_NETWORK_TYPE" == "gre" || "$Q_ML2_TENANT_NETWORK_TYPE" == "vxlan" ]]; then
     Q_TUNNEL_TYPES=$Q_ML2_TENANT_NETWORK_TYPE
@@ -24,7 +24,7 @@ elif [[ "$ENABLE_TENANT_TUNNELS" == "True" ]]; then
 fi
 
 # List of MechanismDrivers to load
-Q_ML2_PLUGIN_MECHANISM_DRIVERS=${Q_ML2_PLUGIN_MECHANISM_DRIVERS:-openvswitch,linuxbridge}
+Q_ML2_PLUGIN_MECHANISM_DRIVERS=${Q_ML2_PLUGIN_MECHANISM_DRIVERS:-ovn}
 # Default GRE TypeDriver options
 Q_ML2_PLUGIN_GRE_TYPE_OPTIONS=${Q_ML2_PLUGIN_GRE_TYPE_OPTIONS:-tunnel_id_ranges=$TENANT_TUNNEL_RANGES}
 # Default VXLAN TypeDriver options

From 69a66fb62bcb77145b6eec21fc2d56d40a861d0d Mon Sep 17 00:00:00 2001
From: Lucas Alvares Gomes <lucasagomes@gmail.com>
Date: Tue, 11 May 2021 11:04:32 +0100
Subject: [PATCH 1871/2409] Fix docs job

Sphinx 4.0.0 added a new dependency [0] which is causing the job to fail
at the moment.

This patch fix the problem by adding UC to the docs jobs.

[0] https://www.sphinx-doc.org/en/master/changes.html (LaTeX: add
tex-gyre font dependency)

Change-Id: I28019331017405c06577ada88f8e9f6d9a2afc23
Signed-off-by: Lucas Alvares Gomes <lucasagomes@gmail.com>
---
 tox.ini | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/tox.ini b/tox.ini
index ed28636d3a..5bb2268c4f 100644
--- a/tox.ini
+++ b/tox.ini
@@ -34,7 +34,9 @@ commands = bash -c "find {toxinidir}             \
          -print0 | xargs -0 bashate -v -iE006 -eE005,E042"
 
 [testenv:docs]
-deps = -r{toxinidir}/doc/requirements.txt
+deps =
+  -c{env:TOX_CONSTRAINTS_FILE:https://releases.openstack.org/constraints/upper/master}
+  -r{toxinidir}/doc/requirements.txt
 whitelist_externals = bash
 setenv =
   TOP_DIR={toxinidir}

From 230f5c434c800c94935d5cd0dcfc1bd18329759f Mon Sep 17 00:00:00 2001
From: Anand Bhat <anandgvbhat@gmail.com>
Date: Wed, 12 May 2021 16:53:15 +0530
Subject: [PATCH 1872/2409] Changed minversion in tox to 3.18.0

The patch bumps min version of tox to 3.18.0 python in order to
replace tox's whitelist_externals by allowlist_externals option:
https://github.com/tox-dev/tox/blob/master/docs/changelog.rst#v3180-2020-07-23

Change-Id: Id8bdda703afc39d352e3a53877318dc30d91a5f7
---
 tox.ini | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/tox.ini b/tox.ini
index 5bb2268c4f..ec764abc87 100644
--- a/tox.ini
+++ b/tox.ini
@@ -1,5 +1,5 @@
 [tox]
-minversion = 1.6
+minversion = 3.18.0
 skipsdist = True
 envlist = bashate
 
@@ -13,7 +13,7 @@ basepython = python3
 # modified bashate tree
 deps =
    {env:BASHATE_INSTALL_PATH:bashate==2.0.0}
-whitelist_externals = bash
+allowlist_externals = bash
 commands = bash -c "find {toxinidir}             \
          -not \( -type d -name .?\* -prune \)    \
          -not \( -type d -name doc -prune \)     \
@@ -37,7 +37,7 @@ commands = bash -c "find {toxinidir}             \
 deps =
   -c{env:TOX_CONSTRAINTS_FILE:https://releases.openstack.org/constraints/upper/master}
   -r{toxinidir}/doc/requirements.txt
-whitelist_externals = bash
+allowlist_externals = bash
 setenv =
   TOP_DIR={toxinidir}
 commands =
@@ -45,7 +45,7 @@ commands =
 
 [testenv:pdf-docs]
 deps = {[testenv:docs]deps}
-whitelist_externals =
+allowlist_externals =
    make
 commands =
    sphinx-build -W -b latex doc/source doc/build/pdf

From ff073a5643f01dda3200d2ce426f23dc24e28b8f Mon Sep 17 00:00:00 2001
From: Ghanshyam <gmann@ghanshyammann.com>
Date: Thu, 13 May 2021 16:25:17 +0000
Subject: [PATCH 1873/2409] Revert "Change Neutron's default ML2 driver to OVN"

This reverts commit 5c304d817682d6c807b532b50a2f105479ac3fa2.

Reason for revert: There are more things to fix/move like done in 791085 and 791282 Also let's change all required default in devstack scripts instead of devstack's zuul job side. Basically do this change without any change in .zuul.yaml

Change-Id: Ie0f59d1b9a4b97ad9fd8131819054dfb616f31fd
---
 .zuul.yaml              | 35 ++++++++---------------------------
 lib/neutron_plugins/ml2 |  6 +++---
 2 files changed, 11 insertions(+), 30 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index e133bfacd7..00129b5ca4 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -468,10 +468,6 @@
         SWIFT_HASH: 1234123412341234
         DEBUG_LIBVIRT_COREDUMPS: true
         NOVA_VNC_ENABLED: true
-        OVN_L3_CREATE_PUBLIC_NETWORK: true
-        OVN_DBS_LOG_LEVEL: dbg
-        ENABLE_CHASSIS_AS_GW: true
-        Q_USE_PROVIDERNET_FOR_PUBLIC: true
       devstack_local_conf:
         post-config:
           $NEUTRON_CONF:
@@ -481,11 +477,7 @@
         # Core services enabled for this branch.
         # This list replaces the test-matrix.
         # Shared services
-        #
-        # NOTE(lucasagomes): disable dstat until bug
-        # https://bugs.launchpad.net/ubuntu/+source/dstat/+bug/1866619 is
-        # fixed. Also see: https://bugs.launchpad.net/neutron/+bug/1898863
-        dstat: false
+        dstat: true
         etcd3: true
         memory_tracker: true
         mysql: true
@@ -504,14 +496,13 @@
         n-sch: true
         # Placement service
         placement-api: true
-        # OVN services
-        ovn-controller: true
-        ovn-northd: true
-        ovs-vswitchd: true
-        ovsdb-server: true
         # Neutron services
+        q-agt: true
+        q-dhcp: true
+        q-l3: true
+        q-meta: true
+        q-metering: true
         q-svc: true
-        q-ovn-metadata-agent: true
         # Swift services
         s-account: true
         s-container: true
@@ -536,24 +527,15 @@
           # Core services enabled for this branch.
           # This list replaces the test-matrix.
           # Shared services
-          #
-          # NOTE(lucasagomes): disable dstat until bug
-          # https://bugs.launchpad.net/ubuntu/+source/dstat/+bug/1866619 is
-          # fixed. Also see: https://bugs.launchpad.net/neutron/+bug/1898863
-          dstat: false
+          dstat: true
           memory_tracker: true
           tls-proxy: true
           # Nova services
           n-cpu: true
           # Placement services
           placement-client: true
-          # OVN services
-          ovn-controller: true
-          ovn-northd: false
-          ovs-vswitchd: true
-          ovsdb-server: true
           # Neutron services
-          q-ovn-metadata-agent: true
+          q-agt: true
           # Cinder services
           c-bak: true
           c-vol: true
@@ -567,7 +549,6 @@
           # integrated gate, so specifying the services has not effect.
           # ceilometer-*: false
         devstack_localrc:
-          ENABLE_CHASSIS_AS_GW: false
           # Subnode specific settings
           GLANCE_HOSTPORT: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}:9292"
           Q_HOST: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}"
diff --git a/lib/neutron_plugins/ml2 b/lib/neutron_plugins/ml2
index a58ba5cbcd..ae4b251d83 100644
--- a/lib/neutron_plugins/ml2
+++ b/lib/neutron_plugins/ml2
@@ -8,14 +8,14 @@ _XTRACE_NEUTRON_ML2=$(set +o | grep xtrace)
 set +o xtrace
 
 # Default openvswitch L2 agent
-Q_AGENT=${Q_AGENT:-ovn}
+Q_AGENT=${Q_AGENT:-openvswitch}
 if [ -f $TOP_DIR/lib/neutron_plugins/${Q_AGENT}_agent ]; then
     source $TOP_DIR/lib/neutron_plugins/${Q_AGENT}_agent
 fi
 
 # Enable this to simply and quickly enable tunneling with ML2.
 # Select either 'gre', 'vxlan', or 'gre,vxlan'
-Q_ML2_TENANT_NETWORK_TYPE=${Q_ML2_TENANT_NETWORK_TYPE:-"geneve"}
+Q_ML2_TENANT_NETWORK_TYPE=${Q_ML2_TENANT_NETWORK_TYPE:-"vxlan"}
 # This has to be set here since the agent will set this in the config file
 if [[ "$Q_ML2_TENANT_NETWORK_TYPE" == "gre" || "$Q_ML2_TENANT_NETWORK_TYPE" == "vxlan" ]]; then
     Q_TUNNEL_TYPES=$Q_ML2_TENANT_NETWORK_TYPE
@@ -24,7 +24,7 @@ elif [[ "$ENABLE_TENANT_TUNNELS" == "True" ]]; then
 fi
 
 # List of MechanismDrivers to load
-Q_ML2_PLUGIN_MECHANISM_DRIVERS=${Q_ML2_PLUGIN_MECHANISM_DRIVERS:-ovn}
+Q_ML2_PLUGIN_MECHANISM_DRIVERS=${Q_ML2_PLUGIN_MECHANISM_DRIVERS:-openvswitch,linuxbridge}
 # Default GRE TypeDriver options
 Q_ML2_PLUGIN_GRE_TYPE_OPTIONS=${Q_ML2_PLUGIN_GRE_TYPE_OPTIONS:-tunnel_id_ranges=$TENANT_TUNNEL_RANGES}
 # Default VXLAN TypeDriver options

From c19c1262c8b81f1cc543eafb9e5c3a34c4b632fe Mon Sep 17 00:00:00 2001
From: Lucas Alvares Gomes <lucasagomes@gmail.com>
Date: Mon, 17 May 2021 13:54:10 +0100
Subject: [PATCH 1874/2409] Replace dstat with pcp-dstat

The dstat project is no longer maintained.

The pcp-dstat package installs a dstat command so no further updates to
the scripts should be needed.

Change-Id: Ied8c9d29bed4f887c364db7080a0f2a0c02328af
Signed-off-by: Lucas Alvares Gomes <lucasagomes@gmail.com>
---
 files/debs/dstat | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/files/debs/dstat b/files/debs/dstat
index 2b643b8b1b..40d00f4aa4 100644
--- a/files/debs/dstat
+++ b/files/debs/dstat
@@ -1 +1,2 @@
-dstat
+dstat # dist:bionic
+pcp

From 6e9f7c25704afb5bcc33c6f17a01f62068664e40 Mon Sep 17 00:00:00 2001
From: Brian Rosmaita <rosmaita.fossdev@gmail.com>
Date: Tue, 13 Oct 2020 14:20:38 -0400
Subject: [PATCH 1875/2409] Support optimized cinder backend for glance

When Glance is configured with a cinder glance_store, Cinder can be
configured to allow cloning of image data directly in the backend
instead of transferring data through Glance.  Expose these
configuration options in devstack to facilitate testing this feature.

Adds:
- CINDER_ALLOWED_DIRECT_URL_SCHEMES
- GLANCE_SHOW_DIRECT_URL
- GLANCE_SHOW_MULTIPLE_LOCATIONS

Change-Id: Iee619b443088fd77cf7b1a48563203bdf4a93a39
---
 lib/cinder | 19 +++++++++++++++++++
 lib/glance | 15 +++++++++++++++
 2 files changed, 34 insertions(+)

diff --git a/lib/cinder b/lib/cinder
index cfa3693f03..fca01a2140 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -104,6 +104,22 @@ if is_fedora || is_suse; then
     fi
 fi
 
+# When Cinder is used as a backend for Glance, it can be configured to clone
+# the volume containing image data directly in the backend instead of
+# transferring data from volume to volume.  Value is a comma separated list of
+# schemes (currently only 'file' and 'cinder' are supported).  The default
+# configuration in Cinder is empty (that is, do not use this feature).  NOTE:
+# to use this feature you must also enable GLANCE_SHOW_DIRECT_URL and/or
+# GLANCE_SHOW_MULTIPLE_LOCATIONS for glance-api.conf.
+CINDER_ALLOWED_DIRECT_URL_SCHEMES=${CINDER_ALLOWED_DIRECT_URL_SCHEMES:-}
+if [[ -n "$CINDER_ALLOWED_DIRECT_URL_SCHEMES" ]]; then
+    if [[ "${GLANCE_SHOW_DIRECT_URL:-False}" != "True" \
+            && "${GLANCE_SHOW_MULTIPLE_LOCATIONS:-False}" != "True" ]]; then
+        warn $LINENO "CINDER_ALLOWED_DIRECT_URL_SCHEMES is set, but neither \
+GLANCE_SHOW_DIRECT_URL nor GLANCE_SHOW_MULTIPLE_LOCATIONS is True"
+    fi
+fi
+
 # For backward compatibility
 # Before CINDER_BACKUP_DRIVER was introduced, ceph backup driver was configured
 # along with ceph backend driver.
@@ -266,6 +282,9 @@ function configure_cinder {
     fi
     iniset $CINDER_CONF key_manager backend cinder.keymgr.conf_key_mgr.ConfKeyManager
     iniset $CINDER_CONF key_manager fixed_key $(openssl rand -hex 16)
+    if [[ -n "$CINDER_ALLOWED_DIRECT_URL_SCHEMES" ]]; then
+        iniset $CINDER_CONF DEFAULT allowed_direct_url_schemes $CINDER_ALLOWED_DIRECT_URL_SCHEMES
+    fi
 
     # Avoid RPC timeouts in slow CI and test environments by doubling the
     # default response timeout set by RPC clients. See bug #1873234 for more
diff --git a/lib/glance b/lib/glance
index e789affaf1..118fa7c863 100644
--- a/lib/glance
+++ b/lib/glance
@@ -51,6 +51,18 @@ GLANCE_STORE_ROOTWRAP_BASE_DIR=/usr/local/etc/glance
 if is_opensuse; then
     GLANCE_STORE_ROOTWRAP_BASE_DIR=/usr/etc/glance
 fi
+# When Cinder is used as a glance store, you can optionally configure cinder to
+# optimize bootable volume creation by allowing volumes to be cloned directly
+# in the backend instead of transferring data via Glance.  To use this feature,
+# set CINDER_ALLOWED_DIRECT_URL_SCHEMES for cinder.conf and enable
+# GLANCE_SHOW_DIRECT_URL and/or GLANCE_SHOW_MULTIPLE_LOCATIONS for Glance.  The
+# default value for both of these is False, because for some backends they
+# present a grave security risk (though not for Cinder, because all that's
+# exposed is the volume_id where the image data is stored.)  See OSSN-0065 for
+# more information: https://wiki.openstack.org/wiki/OSSN/OSSN-0065
+GLANCE_SHOW_DIRECT_URL=$(trueorfalse False GLANCE_SHOW_DIRECT_URL)
+GLANCE_SHOW_MULTIPLE_LOCATIONS=$(trueorfalse False GLANCE_SHOW_MULTIPLE_LOCATIONS)
+
 # Glance multi-store configuration
 # Boolean flag to enable multiple store configuration for glance
 GLANCE_ENABLE_MULTIPLE_STORES=$(trueorfalse False GLANCE_ENABLE_MULTIPLE_STORES)
@@ -283,6 +295,9 @@ function configure_glance {
     if [ "$VIRT_DRIVER" = 'libvirt' ] && [ "$LIBVIRT_TYPE" = 'parallels' ]; then
         iniset $GLANCE_API_CONF DEFAULT disk_formats "ami,ari,aki,vhd,vmdk,raw,qcow2,vdi,iso,ploop"
     fi
+    # Only use these if you know what you are doing!  See OSSN-0065
+    iniset $GLANCE_API_CONF DEFAULT show_image_direct_url $GLANCE_SHOW_DIRECT_URL
+    iniset $GLANCE_API_CONF DEFAULT show_multiple_locations $GLANCE_SHOW_MULTIPLE_LOCATIONS
 
     # Configure glance_store
     configure_glance_store $USE_CINDER_FOR_GLANCE $GLANCE_ENABLE_MULTIPLE_STORES

From 35cec0d7c0857d76d3ea0b52b97f2a166c04c13e Mon Sep 17 00:00:00 2001
From: Brian Rosmaita <rosmaita.fossdev@gmail.com>
Date: Mon, 17 May 2021 18:58:59 -0400
Subject: [PATCH 1876/2409] Remove Block Storage API v2 support

The Block Storage API v2 was deprecated in Pike by change
I913c44799cddc37c3342729ec0ef34068db5b2d4 and is (finally)
being removed in Xena [0].  So remove v2 support from devstack.

[0] https://wiki.openstack.org/wiki/CinderXenaPTGSummary#Removing_the_Block_Storage_API_v2

Depends-on: https://review.opendev.org/c/openstack/devstack/+/792048
Change-Id: I856d78648d28ac4cad0fb212bef1ae6ad32fca90
---
 lib/cinder  | 12 ------------
 lib/tempest | 13 -------------
 2 files changed, 25 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index cfa3693f03..dab2aea1c6 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -376,12 +376,6 @@ function create_cinder_accounts {
                 "$REGION_NAME" \
                 "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v3/\$(project_id)s"
 
-            get_or_create_service "cinderv2" "volumev2" "Cinder Volume Service V2"
-            get_or_create_endpoint \
-                "volumev2" \
-                "$REGION_NAME" \
-                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v2/\$(project_id)s"
-
             get_or_create_service "cinderv3" "volumev3" "Cinder Volume Service V3"
             get_or_create_endpoint \
                 "volumev3" \
@@ -393,12 +387,6 @@ function create_cinder_accounts {
                 "$REGION_NAME" \
                 "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST/volume/v3/\$(project_id)s"
 
-            get_or_create_service "cinderv2" "volumev2" "Cinder Volume Service V2"
-            get_or_create_endpoint \
-                "volumev2" \
-                "$REGION_NAME" \
-                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST/volume/v2/\$(project_id)s"
-
             get_or_create_service "cinderv3" "volumev3" "Cinder Volume Service V3"
             get_or_create_endpoint \
                 "volumev3" \
diff --git a/lib/tempest b/lib/tempest
index 29a62290ce..d835c68d4a 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -459,13 +459,6 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG validation network_for_ssh $TEMPEST_SSH_NETWORK_NAME
 
     # Volume
-    # Set the service catalog entry for Tempest to run on. Typically
-    # used to try different Volume API version targets. The tempest
-    # default it to 'volumev3'(v3 APIs endpoint) , so only set this
-    # if you want to change it.
-    if [[ -n "$TEMPEST_VOLUME_TYPE" ]]; then
-        iniset $TEMPEST_CONFIG volume catalog_type $TEMPEST_VOLUME_TYPE
-    fi
     # Only turn on TEMPEST_VOLUME_MANAGE_SNAPSHOT by default for "lvm" backends
     if [[ "$CINDER_ENABLED_BACKENDS" == *"lvm"* ]]; then
         TEMPEST_VOLUME_MANAGE_SNAPSHOT=${TEMPEST_VOLUME_MANAGE_SNAPSHOT:-True}
@@ -489,12 +482,6 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG volume-feature-enabled volume_revert $(trueorfalse False TEMPEST_VOLUME_REVERT_TO_SNAPSHOT)
     local tempest_volume_min_microversion=${TEMPEST_VOLUME_MIN_MICROVERSION:-None}
     local tempest_volume_max_microversion=${TEMPEST_VOLUME_MAX_MICROVERSION:-"latest"}
-    # Reset microversions to None where v2 is running which does not support microversion.
-    # Both "None" means no microversion testing.
-    if [[ "$TEMPEST_VOLUME_TYPE" == "volumev2" ]]; then
-        tempest_volume_min_microversion=None
-        tempest_volume_max_microversion=None
-    fi
     if [ "$tempest_volume_min_microversion" == "None" ]; then
         inicomment $TEMPEST_CONFIG volume min_microversion
     else

From 2a9673f0278699d03931d69b4da22e9709300026 Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Wed, 19 May 2021 10:22:18 -0400
Subject: [PATCH 1877/2409] docs: recommend Ubuntu 20.04 instead of Bionic

Bionic support was dropped in I39e38e4a6c2e52dd3822c9fdea354258359a9f53.

Change-Id: I765aac352590fd2f74d3fd90676d6d098548e6b8
---
 doc/source/index.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/index.rst b/doc/source/index.rst
index 8b8acde38c..9f477ab911 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -40,7 +40,7 @@ Start with a clean and minimal install of a Linux system. DevStack
 attempts to support the two latest LTS releases of Ubuntu, the
 latest/current Fedora version, CentOS/RHEL 8 and OpenSUSE.
 
-If you do not have a preference, Ubuntu 18.04 (Bionic Beaver) is the
+If you do not have a preference, Ubuntu 20.04 (Focal Fossa) is the
 most tested, and will probably go the smoothest.
 
 Add Stack User (optional)

From f0736406f5ce055072a62a62fe9fdc7cead49671 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Tue, 18 May 2021 17:15:30 -0500
Subject: [PATCH 1878/2409] Fix unit test to use python3 command

unit test jobs staretd to run on ubuntu-focal now
and failing for using 'python' command.

Change-Id: Ie002faf4c96ac7f207207a481c057b8df0289e6c
---
 tests/test_write_devstack_local_conf_role.sh | 2 +-
 tests/unittest.sh                            | 2 ++
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/tests/test_write_devstack_local_conf_role.sh b/tests/test_write_devstack_local_conf_role.sh
index b2bc0a2c46..71d8d51614 100755
--- a/tests/test_write_devstack_local_conf_role.sh
+++ b/tests/test_write_devstack_local_conf_role.sh
@@ -6,4 +6,4 @@ TOP=$(cd $(dirname "$0")/.. && pwd)
 source $TOP/functions
 source $TOP/tests/unittest.sh
 
-python ./roles/write-devstack-local-conf/library/test.py
+${PYTHON} $TOP/roles/write-devstack-local-conf/library/test.py
diff --git a/tests/unittest.sh b/tests/unittest.sh
index 3703ece91d..fced2abe65 100644
--- a/tests/unittest.sh
+++ b/tests/unittest.sh
@@ -17,6 +17,8 @@ ERROR=0
 PASS=0
 FAILED_FUNCS=""
 
+export PYTHON=$(which python3 2>/dev/null)
+
 # pass a test, printing out MSG
 #  usage: passed message
 function passed {

From e38a39ad404637ca1649cea072883aa0a4592c4f Mon Sep 17 00:00:00 2001
From: Lucas Alvares Gomes <lucasagomes@gmail.com>
Date: Fri, 14 May 2021 09:14:24 +0100
Subject: [PATCH 1879/2409] Change default network backend driver to ML2/OVN

This patch is changing the default network backend driver in DevStack to
OVN.

This is a long effort from the Neutron community that has been
discussed on previous PTGs and agreed upon.

A similar patch to this one [0] have been merged in the past but got
reverted [1] because it did break some zuul jobs. This one also include
fixes for such jobs and was verified at [2]

[0] https://review.opendev.org/c/openstack/devstack/+/735097
[1] https://review.opendev.org/c/openstack/neutron/+/775632
[2] https://review.opendev.org/c/zuul/zuul-jobs/+/791117

Change-Id: I8c2be82f33ed9f6c36f5509b3b210ee1a38e87ca
Signed-off-by: Lucas Alvares Gomes <lucasagomes@gmail.com>
---
 .zuul.yaml                    | 20 ++++++++++++++------
 lib/neutron_plugins/ml2       | 11 ++++++-----
 lib/neutron_plugins/ovn_agent | 18 +++++++++++++-----
 stackrc                       |  4 +++-
 4 files changed, 36 insertions(+), 17 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index b65aeec4dd..4ca0257cc6 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -468,6 +468,8 @@
         SWIFT_HASH: 1234123412341234
         DEBUG_LIBVIRT_COREDUMPS: true
         NOVA_VNC_ENABLED: true
+        OVN_L3_CREATE_PUBLIC_NETWORK: true
+        OVN_DBS_LOG_LEVEL: dbg
       devstack_local_conf:
         post-config:
           $NEUTRON_CONF:
@@ -496,13 +498,14 @@
         n-sch: true
         # Placement service
         placement-api: true
+        # OVN services
+        ovn-controller: true
+        ovn-northd: true
+        ovs-vswitchd: true
+        ovsdb-server: true
         # Neutron services
-        q-agt: true
-        q-dhcp: true
-        q-l3: true
-        q-meta: true
-        q-metering: true
         q-svc: true
+        q-ovn-metadata-agent: true
         # Swift services
         s-account: true
         s-container: true
@@ -534,8 +537,12 @@
           n-cpu: true
           # Placement services
           placement-client: true
+          # OVN services
+          ovn-controller: true
+          ovs-vswitchd: true
+          ovsdb-server: true
           # Neutron services
-          q-agt: true
+          q-ovn-metadata-agent: true
           # Cinder services
           c-bak: true
           c-vol: true
@@ -553,6 +560,7 @@
           GLANCE_HOSTPORT: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}:9292"
           Q_HOST: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}"
           NOVA_VNC_ENABLED: true
+          ENABLE_CHASSIS_AS_GW: false
 
 - job:
     name: devstack-ipv6
diff --git a/lib/neutron_plugins/ml2 b/lib/neutron_plugins/ml2
index ae4b251d83..e1f868f0a7 100644
--- a/lib/neutron_plugins/ml2
+++ b/lib/neutron_plugins/ml2
@@ -7,15 +7,16 @@
 _XTRACE_NEUTRON_ML2=$(set +o | grep xtrace)
 set +o xtrace
 
-# Default openvswitch L2 agent
-Q_AGENT=${Q_AGENT:-openvswitch}
+# Default OVN L2 agent
+Q_AGENT=${Q_AGENT:-ovn}
 if [ -f $TOP_DIR/lib/neutron_plugins/${Q_AGENT}_agent ]; then
     source $TOP_DIR/lib/neutron_plugins/${Q_AGENT}_agent
 fi
 
 # Enable this to simply and quickly enable tunneling with ML2.
-# Select either 'gre', 'vxlan', or 'gre,vxlan'
-Q_ML2_TENANT_NETWORK_TYPE=${Q_ML2_TENANT_NETWORK_TYPE:-"vxlan"}
+# For ML2/OVS select either 'gre', 'vxlan', or 'gre,vxlan'.
+# For ML2/OVN use 'geneve'.
+Q_ML2_TENANT_NETWORK_TYPE=${Q_ML2_TENANT_NETWORK_TYPE:-"geneve"}
 # This has to be set here since the agent will set this in the config file
 if [[ "$Q_ML2_TENANT_NETWORK_TYPE" == "gre" || "$Q_ML2_TENANT_NETWORK_TYPE" == "vxlan" ]]; then
     Q_TUNNEL_TYPES=$Q_ML2_TENANT_NETWORK_TYPE
@@ -24,7 +25,7 @@ elif [[ "$ENABLE_TENANT_TUNNELS" == "True" ]]; then
 fi
 
 # List of MechanismDrivers to load
-Q_ML2_PLUGIN_MECHANISM_DRIVERS=${Q_ML2_PLUGIN_MECHANISM_DRIVERS:-openvswitch,linuxbridge}
+Q_ML2_PLUGIN_MECHANISM_DRIVERS=${Q_ML2_PLUGIN_MECHANISM_DRIVERS:-ovn}
 # Default GRE TypeDriver options
 Q_ML2_PLUGIN_GRE_TYPE_OPTIONS=${Q_ML2_PLUGIN_GRE_TYPE_OPTIONS:-tunnel_id_ranges=$TENANT_TUNNEL_RANGES}
 # Default VXLAN TypeDriver options
diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index e4d0d75230..4af1340a26 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -21,10 +21,6 @@
 source ${TOP_DIR}/lib/neutron_plugins/ovs_base
 source ${TOP_DIR}/lib/neutron_plugins/openvswitch_agent
 
-# Load devstack ovs base functions
-source $NEUTRON_DIR/devstack/lib/ovs
-
-
 # Defaults
 # --------
 
@@ -88,12 +84,18 @@ OVN_INSTALL_OVS_PYTHON_MODULE=$(trueorfalse False OVN_INSTALL_OVS_PYTHON_MODULE)
 # configure the MTU DHCP option.
 OVN_GENEVE_OVERHEAD=${OVN_GENEVE_OVERHEAD:-38}
 
-# The log level of the OVN databases (north and south)
+# The log level of the OVN databases (north and south).
+# Supported log levels are: off, emer, err, warn, info or dbg.
+# More information about log levels can be found at
+# http://www.openvswitch.org/support/dist-docs/ovs-appctl.8.txt
 OVN_DBS_LOG_LEVEL=${OVN_DBS_LOG_LEVEL:-info}
 
 OVN_META_CONF=$NEUTRON_CONF_DIR/neutron_ovn_metadata_agent.ini
 OVN_META_DATA_HOST=${OVN_META_DATA_HOST:-$(ipv6_unquote $SERVICE_HOST)}
 
+# If True (default) the node will be considered a gateway node.
+ENABLE_CHASSIS_AS_GW=$(trueorfalse True ENABLE_CHASSIS_AS_GW)
+
 export OVSDB_SERVER_LOCAL_HOST=$SERVICE_LOCAL_HOST
 if [[ "$SERVICE_IP_VERSION" == 6 ]]; then
     OVSDB_SERVER_LOCAL_HOST=[$OVSDB_SERVER_LOCAL_HOST]
@@ -171,6 +173,9 @@ function wait_for_sock_file {
 }
 
 function use_new_ovn_repository {
+    if [[ "$OVN_BUILD_FROM_SOURCE" == "False" ]]; then
+        return 0
+    fi
     if [ -z "$is_new_ovn" ]; then
         local ovs_repo_dir=$DEST/$OVS_REPO_NAME
         if [ ! -d $ovs_repo_dir ]; then
@@ -390,6 +395,9 @@ function install_ovn {
     sudo ln -s $OVS_RUNDIR $OVN_RUNDIR
 
     if [[ "$OVN_BUILD_FROM_SOURCE" == "True" ]]; then
+        # Load devstack ovs base functions
+        source $NEUTRON_DIR/devstack/lib/ovs
+
         # If OVS is already installed, remove it, because we're about to
         # re-install it from source.
         for package in openvswitch openvswitch-switch openvswitch-common; do
diff --git a/stackrc b/stackrc
index 196f61fa3c..05016594eb 100644
--- a/stackrc
+++ b/stackrc
@@ -72,8 +72,10 @@ if ! isset ENABLED_SERVICES ; then
     ENABLED_SERVICES+=,g-api
     # Cinder
     ENABLED_SERVICES+=,c-sch,c-api,c-vol
+    # OVN
+    ENABLED_SERVICES+=,ovn-controller,ovn-northd,ovs-vswitchd,ovsdb-server
     # Neutron
-    ENABLED_SERVICES+=,q-svc,q-dhcp,q-meta,q-agt,q-l3
+    ENABLED_SERVICES+=,q-svc,q-ovn-metadata-agent
     # Dashboard
     ENABLED_SERVICES+=,horizon
     # Additional services

From ddb66f2344b933f278b0b52be3ca59a4c511ab14 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rados=C5=82aw=20Piliszek?= <radoslaw.piliszek@gmail.com>
Date: Sat, 18 Jul 2020 12:18:39 +0200
Subject: [PATCH 1880/2409] [CI] Add no-tls-proxy job

Some gates run devstack like this and it follows different code
paths.
Let's ensure we don't break it now and then.

Change-Id: I6ee1bfc30bced53f6d7fb841e01714069919fd88
Reference: http://lists.openstack.org/pipermail/openstack-discuss/2020-July/015997.html
Reference: http://eavesdrop.openstack.org/meetings/qa/2021/qa.2021-05-11-14.00.log.html
---
 .zuul.yaml | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index b65aeec4dd..1ede4448a0 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -595,6 +595,17 @@
       zuul_copy_output:
         /opt/stack/async: logs
 
+- job:
+    name: devstack-no-tls-proxy
+    parent: tempest-full-py3
+    description: |
+      Tempest job with tls-proxy off.
+
+      Some gates run devstack like this and it follows different code paths.
+    vars:
+      devstack_services:
+        tls-proxy: false
+
 - job:
     name: devstack-platform-fedora-latest
     parent: tempest-full-py3
@@ -814,3 +825,7 @@
               - ^.*\.rst$
               - ^doc/.*$
         - devstack-platform-fedora-latest-virt-preview
+        - devstack-no-tls-proxy
+    periodic:
+      jobs:
+        - devstack-no-tls-proxy

From 7604e085b4542c50aefc9c23aa339958757a5770 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Tue, 25 May 2021 13:06:14 -0500
Subject: [PATCH 1881/2409] Pin nodeset for unit test job

devstack unit test job does not set any nodeset
and so does use default nodeset defined in base jobs
in opendev. When opendev switches the default nodeset to
the latest distro version, devstack unit test job can start
failing. Example:

- https://review.opendev.org/q/I01408f2f2959b0788fe712ac268a526502226ee9
- https://review.opendev.org/q/Ib1ea47bc7384e1f579cb08c779a32151fccd6845

To avoid such a situation in future, let's set the working nodeset
for this job also so that when we cut the stable branch we can
run it on the working distro version.

Change-Id: I302140778fedf08bc8ba72c453837fa7b8f8f9ae
---
 .zuul.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index 4ca0257cc6..9a559ef776 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -676,6 +676,7 @@
 
 - job:
     name: devstack-unit-tests
+    nodeset: ubuntu-focal
     description: |
       Runs unit tests on devstack project.
 

From 22038a9a8c4418d6d49bed83024a3cd97e627860 Mon Sep 17 00:00:00 2001
From: Lucas Alvares Gomes <lucasagomes@gmail.com>
Date: Thu, 27 May 2021 13:44:20 +0100
Subject: [PATCH 1882/2409] [OVN] Configure public bridge enabled by default

This patch makes the OVN_L3_CREATE_PUBLIC_NETWORK configuration True by
default. This option makes the OVN lib in DevStack create & configure
the external bridge, matching the same behavior from the OVS driver
in DevStack.

Change-Id: Icda53b95fdc3c169ac48a6ec4343c87ba404baa4
Signed-off-by: Lucas Alvares Gomes <lucasagomes@gmail.com>
---
 .zuul.yaml                    | 1 -
 lib/neutron_plugins/ovn_agent | 1 +
 2 files changed, 1 insertion(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 6484b2a6ce..5bc6a8b424 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -468,7 +468,6 @@
         SWIFT_HASH: 1234123412341234
         DEBUG_LIBVIRT_COREDUMPS: true
         NOVA_VNC_ENABLED: true
-        OVN_L3_CREATE_PUBLIC_NETWORK: true
         OVN_DBS_LOG_LEVEL: dbg
       devstack_local_conf:
         post-config:
diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index 4af1340a26..f12e6a491d 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -95,6 +95,7 @@ OVN_META_DATA_HOST=${OVN_META_DATA_HOST:-$(ipv6_unquote $SERVICE_HOST)}
 
 # If True (default) the node will be considered a gateway node.
 ENABLE_CHASSIS_AS_GW=$(trueorfalse True ENABLE_CHASSIS_AS_GW)
+OVN_L3_CREATE_PUBLIC_NETWORK=$(trueorfalse True OVN_L3_CREATE_PUBLIC_NETWORK)
 
 export OVSDB_SERVER_LOCAL_HOST=$SERVICE_LOCAL_HOST
 if [[ "$SERVICE_IP_VERSION" == 6 ]]; then

From 77835633c5d1daba37f453c5bf7c84fad0f2d68e Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Thu, 13 May 2021 13:14:42 +1000
Subject: [PATCH 1883/2409] OVN : include source compliation functions

This patch moves the OVS compilation module from Neutron into DevStack.
It also renamed it to "ovs_source" to highlight its function, and the
include has been moved to where the rest of the includes are located.

Although this module is not required since by default DevStack installs
OVS/OVN from the host OS packages instead of compiling from source,
this is a nice to have as it avoids having bits and pieces of the code
scattered around multiple repositories.

Co-Authored-By: Lucas Alvares Gomes <lucasagomes@gmail.com>
Change-Id: I39ec9ce0a91bea05cf8c446a9767ab879ac8e8f3
---
 lib/neutron_plugins/ovn_agent  |   6 +-
 lib/neutron_plugins/ovs_source | 215 +++++++++++++++++++++++++++++++++
 2 files changed, 218 insertions(+), 3 deletions(-)
 create mode 100644 lib/neutron_plugins/ovs_source

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index 4af1340a26..71a4c60129 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -21,6 +21,9 @@
 source ${TOP_DIR}/lib/neutron_plugins/ovs_base
 source ${TOP_DIR}/lib/neutron_plugins/openvswitch_agent
 
+# Load devstack ovs compliation and loading functions
+source ${TOP_DIR}/lib/neutron_plugins/ovs_source
+
 # Defaults
 # --------
 
@@ -395,9 +398,6 @@ function install_ovn {
     sudo ln -s $OVS_RUNDIR $OVN_RUNDIR
 
     if [[ "$OVN_BUILD_FROM_SOURCE" == "True" ]]; then
-        # Load devstack ovs base functions
-        source $NEUTRON_DIR/devstack/lib/ovs
-
         # If OVS is already installed, remove it, because we're about to
         # re-install it from source.
         for package in openvswitch openvswitch-switch openvswitch-common; do
diff --git a/lib/neutron_plugins/ovs_source b/lib/neutron_plugins/ovs_source
new file mode 100644
index 0000000000..294171f18b
--- /dev/null
+++ b/lib/neutron_plugins/ovs_source
@@ -0,0 +1,215 @@
+#!/bin/bash
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+# Defaults
+# --------
+
+# Set variables for building OVS from source
+OVS_REPO=${OVS_REPO:-https://github.com/openvswitch/ovs.git}
+OVS_REPO_NAME=$(basename ${OVS_REPO} | cut -f1 -d'.')
+OVS_REPO_NAME=${OVS_REPO_NAME:-ovs}
+OVS_BRANCH=${OVS_BRANCH:-0047ca3a0290f1ef954f2c76b31477cf4b9755f5}
+
+# Functions
+
+# load_module() - Load module using modprobe module given by argument and dies
+#                 on failure
+#               - fatal argument is optional and says whether function should
+#                 exit if module can't be loaded
+function load_module {
+    local module=$1
+    local fatal=$2
+
+    if [ "$(trueorfalse True fatal)" == "True" ]; then
+        sudo modprobe $module || (dmesg && die $LINENO "FAILED TO LOAD $module")
+    else
+        sudo modprobe $module || (echo "FAILED TO LOAD $module" && dmesg)
+    fi
+}
+
+# prepare_for_compilation() - Fetch ovs git repository and install packages needed for
+#                             compilation.
+function prepare_for_ovs_compilation {
+    local build_modules=${1:-False}
+    OVS_DIR=$DEST/$OVS_REPO_NAME
+
+    if [ ! -d $OVS_DIR ] ; then
+        # We can't use git_clone here because we want to ignore ERROR_ON_CLONE
+        git_timed clone $OVS_REPO $OVS_DIR
+        cd $OVS_DIR
+        git checkout $OVS_BRANCH
+    else
+        # Even though the directory already exists, call git_clone to update it
+        # if needed based on the RECLONE option
+        git_clone $OVS_REPO $OVS_DIR $OVS_BRANCH
+        cd $OVS_DIR
+    fi
+
+    # TODO: Can you create package list files like you can inside devstack?
+    install_package autoconf automake libtool gcc patch make
+
+    # If build_modules is False, we don't need to install the kernel-*
+    # packages. Just return.
+    if [[ "$build_modules" == "False" ]]; then
+        return
+    fi
+
+    KERNEL_VERSION=`uname -r`
+    if is_fedora ; then
+        # is_fedora covers Fedora, RHEL, CentOS, etc...
+        if [[ "$os_VENDOR" == "Fedora" ]]; then
+            install_package elfutils-libelf-devel
+            KERNEL_VERSION=`echo $KERNEL_VERSION | cut --delimiter='-' --field 1`
+        elif [[ ${KERNEL_VERSION:0:2} != "3." ]]; then
+            # dash is illegal character in rpm version so replace
+            # them with underscore like it is done in the kernel
+            # https://github.com/torvalds/linux/blob/master/scripts/package/mkspec#L25
+            # but only for latest series of the kernel, not 3.x
+
+            KERNEL_VERSION=`echo $KERNEL_VERSION | tr - _`
+        fi
+
+        echo NOTE: if kernel-devel-$KERNEL_VERSION or kernel-headers-$KERNEL_VERSION installation
+        echo failed, please, provide a repository with the package, or yum update / reboot
+        echo your machine to get the latest kernel.
+
+        install_package kernel-devel-$KERNEL_VERSION
+        install_package kernel-headers-$KERNEL_VERSION
+
+    elif is_ubuntu ; then
+        install_package linux-headers-$KERNEL_VERSION
+    fi
+}
+
+# load_ovs_kernel_modules() - load openvswitch kernel module
+function load_ovs_kernel_modules {
+    load_module openvswitch
+    load_module vport-geneve False
+    dmesg | tail
+}
+
+# reload_ovs_kernel_modules() - reload openvswitch kernel module
+function reload_ovs_kernel_modules {
+    set +e
+    ovs_system=$(sudo ovs-dpctl dump-dps | grep ovs-system)
+    if [ -n "$ovs_system" ]; then
+        sudo ovs-dpctl del-dp ovs-system
+    fi
+    set -e
+    sudo modprobe -r vport_geneve
+    sudo modprobe -r openvswitch
+    load_ovs_kernel_modules
+}
+
+# compile_ovs() - Compile OVS from source and load needed modules.
+#                 Accepts two parameters:
+#                   - first one is False by default and means that modules are not built and installed.
+#                   - second optional parameter defines prefix for ovs compilation
+#                   - third optional parameter defines localstatedir for ovs single machine runtime
+#                 Env variables OVS_REPO_NAME, OVS_REPO and OVS_BRANCH must be set
+function compile_ovs {
+    local _pwd=$PWD
+    local build_modules=${1:-False}
+    local prefix=$2
+    local localstatedir=$3
+
+    if [ -n "$prefix" ]; then
+        prefix="--prefix=$prefix"
+    fi
+
+    if [ -n "$localstatedir" ]; then
+        localstatedir="--localstatedir=$localstatedir"
+    fi
+
+    prepare_for_ovs_compilation $build_modules
+
+    KERNEL_VERSION=$(uname -r)
+    major_version=$(echo "${KERNEL_VERSION}" | cut -d '.' -f1)
+    patch_level=$(echo "${KERNEL_VERSION}" | cut -d '.' -f2)
+    if [ "${major_version}" -gt 5 ] || [ "${major_version}" == 5 ] && [ "${patch_level}" -gt 5 ]; then
+        echo "NOTE: KERNEL VERSION is ${KERNEL_VERSION} and OVS doesn't support compiling "
+        echo "Kernel module for version higher than 5.5. Skipping module compilation..."
+        build_modules="False"
+    fi
+
+    if [ ! -f configure ] ; then
+        ./boot.sh
+    fi
+    if [ ! -f config.status ] || [ configure -nt config.status ] ; then
+        if [[ "$build_modules" == "True" ]]; then
+            ./configure $prefix $localstatedir --with-linux=/lib/modules/$(uname -r)/build
+        else
+            ./configure $prefix $localstatedir
+        fi
+    fi
+    make -j$(($(nproc) + 1))
+    sudo make install
+    if [[ "$build_modules" == "True" ]]; then
+        sudo make INSTALL_MOD_DIR=kernel/net/openvswitch modules_install
+        reload_ovs_kernel_modules
+    else
+        load_ovs_kernel_modules
+    fi
+
+    cd $_pwd
+}
+
+# action_service - call an action over openvswitch service
+#                  Accepts one parameter that can be either
+#                  'start', 'restart' and 'stop'.
+function action_openvswitch {
+    local action=$1
+
+    if is_ubuntu; then
+        ${action}_service openvswitch-switch
+    elif is_fedora; then
+        ${action}_service openvswitch
+    elif is_suse; then
+        if [[ $DISTRO == "sle12" ]] && [[ $os_RELEASE -lt 12.2 ]]; then
+            ${action}_service openvswitch-switch
+        else
+            ${action}_service openvswitch
+        fi
+    fi
+}
+
+# start_new_ovs() - removes old ovs database, creates a new one and starts ovs
+function start_new_ovs {
+    sudo rm -f /etc/openvswitch/conf.db /etc/openvswitch/.conf.db~lock~
+    sudo /usr/share/openvswitch/scripts/ovs-ctl start
+}
+
+# stop_new_ovs() - stops ovs
+function stop_new_ovs {
+    local ovs_ctl='/usr/share/openvswitch/scripts/ovs-ctl'
+
+    if [ -x $ovs_ctl ] ; then
+        sudo $ovs_ctl stop
+    fi
+}
+
+# remove_ovs_packages() - removes old ovs packages from the system
+function remove_ovs_packages {
+    for package in openvswitch openvswitch-switch openvswitch-common; do
+        if is_package_installed $package; then
+            uninstall_package $package
+        fi
+    done
+}
+
+
+# load_conntrack_gre_module() - loads nf_conntrack_proto_gre kernel module
+function load_conntrack_gre_module {
+    sudo modprobe nf_conntrack_proto_gre
+}

From 58f6048dd488664aab6ae42efeb9deb90b051acf Mon Sep 17 00:00:00 2001
From: Anand Bhat <anandgvbhat@gmail.com>
Date: Fri, 28 May 2021 11:36:23 +0530
Subject: [PATCH 1884/2409] setup.cfg: Replace dashes with underscores

Setuptools v54.1.0 introduces a warning that the use of dash-separated
options in 'setup.cfg' will not be supported in a future version [1].
Get ahead of the issue by replacing the dashes with underscores. Without
this, we see 'UserWarning' messages like the following on new enough
versions of setuptools:

  UserWarning: Usage of dash-separated 'description-file' will not be
  supported in future versions. Please use the underscore name
  'description_file' instead

[1] https://github.com/pypa/setuptools/commit/a2e9ae4cb

Change-Id: I6b8e791c06319fa5fa0935337520c36800b1abd6
---
 setup.cfg | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/setup.cfg b/setup.cfg
index 146f010243..a4e621f6df 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -1,11 +1,11 @@
 [metadata]
 name = DevStack
 summary = OpenStack DevStack
-description-file =
+description_file =
     README.rst
 author = OpenStack
-author-email = openstack-discuss@lists.openstack.org
-home-page = https://docs.openstack.org/devstack/latest
+author_email = openstack-discuss@lists.openstack.org
+home_page = https://docs.openstack.org/devstack/latest
 classifier =
     Intended Audience :: Developers
     License :: OSI Approved :: Apache Software License

From 8ea11c2947753f988979330ecc5fab2a6362881c Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Mon, 31 May 2021 15:04:29 -0500
Subject: [PATCH 1885/2409] Update IRC network to OFTC

Change-Id: I260d9e65782add011f00d9087e0a5ac71e2be324
---
 doc/source/contributor/contributing.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/contributor/contributing.rst b/doc/source/contributor/contributing.rst
index 5e0df569f7..4de238fbf8 100644
--- a/doc/source/contributor/contributing.rst
+++ b/doc/source/contributor/contributing.rst
@@ -13,7 +13,7 @@ with Devstack.
 
 Communication
 ~~~~~~~~~~~~~
-* IRC channel ``#openstack-qa`` at FreeNode
+* IRC channel ``#openstack-qa`` at OFTC.
 * Mailing list (prefix subjects with ``[qa][devstack]`` for faster responses)
   http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-discuss
 

From 949f5ada608961fd05435e01bd9d06757b6c62c5 Mon Sep 17 00:00:00 2001
From: Gregory Thiemonge <gthiemon@redhat.com>
Date: Mon, 15 Mar 2021 18:25:04 +0100
Subject: [PATCH 1886/2409] Add route to IPv6 private subnets in ML2/OVN

Enable IPv6 private subnet routing in ML2/OVN, it uses the behavior that
already exists in ML2/OVS: add a route from the devstack node to the
CIDRs of the default IPv6 subnet pool. Any IPv6 subnet created using the
default subnet pool and plugged into the default router is reachable
from the host (ex: ipv6-private-subnet).

Change-Id: I02ca1d94e9f4d5ad4a06182f5ac9a2434941cf08
---
 lib/neutron_plugins/services/l3 | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 75a3567096..5d339a00aa 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -392,8 +392,8 @@ function _neutron_configure_router_v6 {
         openstack --os-cloud devstack-admin --os-region "$REGION_NAME" router set --external-gateway $EXT_NET_ID $ROUTER_ID
     fi
 
-    # This logic is specific to using the l3-agent for layer 3
-    if is_service_enabled q-l3 || is_service_enabled neutron-l3; then
+    # This logic is specific to using OVN or the l3-agent for layer 3
+    if ([[ $Q_AGENT == "ovn" ]] && is_service_enabled q-svc neutron-server) || is_service_enabled q-l3 neutron-l3; then
         # if the Linux host considers itself to be a router then it will
         # ignore all router advertisements
         # Ensure IPv6 RAs are accepted on interfaces with a default route.
@@ -420,6 +420,11 @@ function _neutron_configure_router_v6 {
 
             # Configure interface for public bridge
             sudo ip -6 addr replace $ipv6_ext_gw_ip/$ipv6_cidr_len dev $ext_gw_interface
+            # Any IPv6 private subnet that uses the default IPV6 subnet pool
+            # and that is plugged into the default router (Q_ROUTER_NAME) will
+            # be reachable from the devstack node (ex: ipv6-private-subnet).
+            # Some scenario tests (such as octavia-tempest-plugin) rely heavily
+            # on this feature.
             local replace_range=${SUBNETPOOL_PREFIX_V6}
             if [[ -z "${SUBNETPOOL_V6_ID}" ]]; then
                 replace_range=${FIXED_RANGE_V6}

From cbc0b64a343e31506b43a9395e6a77fcfd6eb70b Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Thu, 3 Jun 2021 06:14:05 +0000
Subject: [PATCH 1887/2409] Updated from generate-devstack-plugins-list

Change-Id: I2d5b0c59d5dd33f639ec685b16768325d67e9dbf
---
 doc/source/plugin-registry.rst | 22 +++++-----------------
 1 file changed, 5 insertions(+), 17 deletions(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 4e7c2d7b2f..691fffa846 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -24,6 +24,8 @@ official OpenStack projects.
 ======================================== ===
 Plugin Name                              URL
 ======================================== ===
+inspur/venus                             `https://opendev.org/inspur/venus <https://opendev.org/inspur/venus>`__
+inspur/venus-dashboard                   `https://opendev.org/inspur/venus-dashboard <https://opendev.org/inspur/venus-dashboard>`__
 openstack/aodh                           `https://opendev.org/openstack/aodh <https://opendev.org/openstack/aodh>`__
 openstack/barbican                       `https://opendev.org/openstack/barbican <https://opendev.org/openstack/barbican>`__
 openstack/blazar                         `https://opendev.org/openstack/blazar <https://opendev.org/openstack/blazar>`__
@@ -39,21 +41,18 @@ openstack/devstack-plugin-container      `https://opendev.org/openstack/devstack
 openstack/devstack-plugin-kafka          `https://opendev.org/openstack/devstack-plugin-kafka <https://opendev.org/openstack/devstack-plugin-kafka>`__
 openstack/devstack-plugin-nfs            `https://opendev.org/openstack/devstack-plugin-nfs <https://opendev.org/openstack/devstack-plugin-nfs>`__
 openstack/devstack-plugin-open-cas       `https://opendev.org/openstack/devstack-plugin-open-cas <https://opendev.org/openstack/devstack-plugin-open-cas>`__
-openstack/devstack-plugin-pika           `https://opendev.org/openstack/devstack-plugin-pika <https://opendev.org/openstack/devstack-plugin-pika>`__
-openstack/devstack-plugin-zmq            `https://opendev.org/openstack/devstack-plugin-zmq <https://opendev.org/openstack/devstack-plugin-zmq>`__
 openstack/ec2-api                        `https://opendev.org/openstack/ec2-api <https://opendev.org/openstack/ec2-api>`__
 openstack/freezer                        `https://opendev.org/openstack/freezer <https://opendev.org/openstack/freezer>`__
 openstack/freezer-api                    `https://opendev.org/openstack/freezer-api <https://opendev.org/openstack/freezer-api>`__
 openstack/freezer-tempest-plugin         `https://opendev.org/openstack/freezer-tempest-plugin <https://opendev.org/openstack/freezer-tempest-plugin>`__
 openstack/freezer-web-ui                 `https://opendev.org/openstack/freezer-web-ui <https://opendev.org/openstack/freezer-web-ui>`__
+openstack/glance                         `https://opendev.org/openstack/glance <https://opendev.org/openstack/glance>`__
 openstack/heat                           `https://opendev.org/openstack/heat <https://opendev.org/openstack/heat>`__
 openstack/heat-dashboard                 `https://opendev.org/openstack/heat-dashboard <https://opendev.org/openstack/heat-dashboard>`__
 openstack/ironic                         `https://opendev.org/openstack/ironic <https://opendev.org/openstack/ironic>`__
 openstack/ironic-inspector               `https://opendev.org/openstack/ironic-inspector <https://opendev.org/openstack/ironic-inspector>`__
 openstack/ironic-prometheus-exporter     `https://opendev.org/openstack/ironic-prometheus-exporter <https://opendev.org/openstack/ironic-prometheus-exporter>`__
 openstack/ironic-ui                      `https://opendev.org/openstack/ironic-ui <https://opendev.org/openstack/ironic-ui>`__
-openstack/karbor                         `https://opendev.org/openstack/karbor <https://opendev.org/openstack/karbor>`__
-openstack/karbor-dashboard               `https://opendev.org/openstack/karbor-dashboard <https://opendev.org/openstack/karbor-dashboard>`__
 openstack/keystone                       `https://opendev.org/openstack/keystone <https://opendev.org/openstack/keystone>`__
 openstack/kuryr-kubernetes               `https://opendev.org/openstack/kuryr-kubernetes <https://opendev.org/openstack/kuryr-kubernetes>`__
 openstack/kuryr-libnetwork               `https://opendev.org/openstack/kuryr-libnetwork <https://opendev.org/openstack/kuryr-libnetwork>`__
@@ -65,21 +64,15 @@ openstack/manila-tempest-plugin          `https://opendev.org/openstack/manila-t
 openstack/manila-ui                      `https://opendev.org/openstack/manila-ui <https://opendev.org/openstack/manila-ui>`__
 openstack/masakari                       `https://opendev.org/openstack/masakari <https://opendev.org/openstack/masakari>`__
 openstack/mistral                        `https://opendev.org/openstack/mistral <https://opendev.org/openstack/mistral>`__
-openstack/monasca-analytics              `https://opendev.org/openstack/monasca-analytics <https://opendev.org/openstack/monasca-analytics>`__
 openstack/monasca-api                    `https://opendev.org/openstack/monasca-api <https://opendev.org/openstack/monasca-api>`__
-openstack/monasca-ceilometer             `https://opendev.org/openstack/monasca-ceilometer <https://opendev.org/openstack/monasca-ceilometer>`__
 openstack/monasca-events-api             `https://opendev.org/openstack/monasca-events-api <https://opendev.org/openstack/monasca-events-api>`__
-openstack/monasca-log-api                `https://opendev.org/openstack/monasca-log-api <https://opendev.org/openstack/monasca-log-api>`__
 openstack/monasca-tempest-plugin         `https://opendev.org/openstack/monasca-tempest-plugin <https://opendev.org/openstack/monasca-tempest-plugin>`__
-openstack/monasca-transform              `https://opendev.org/openstack/monasca-transform <https://opendev.org/openstack/monasca-transform>`__
 openstack/murano                         `https://opendev.org/openstack/murano <https://opendev.org/openstack/murano>`__
 openstack/networking-bagpipe             `https://opendev.org/openstack/networking-bagpipe <https://opendev.org/openstack/networking-bagpipe>`__
 openstack/networking-baremetal           `https://opendev.org/openstack/networking-baremetal <https://opendev.org/openstack/networking-baremetal>`__
 openstack/networking-bgpvpn              `https://opendev.org/openstack/networking-bgpvpn <https://opendev.org/openstack/networking-bgpvpn>`__
 openstack/networking-generic-switch      `https://opendev.org/openstack/networking-generic-switch <https://opendev.org/openstack/networking-generic-switch>`__
 openstack/networking-hyperv              `https://opendev.org/openstack/networking-hyperv <https://opendev.org/openstack/networking-hyperv>`__
-openstack/networking-l2gw                `https://opendev.org/openstack/networking-l2gw <https://opendev.org/openstack/networking-l2gw>`__
-openstack/networking-midonet             `https://opendev.org/openstack/networking-midonet <https://opendev.org/openstack/networking-midonet>`__
 openstack/networking-odl                 `https://opendev.org/openstack/networking-odl <https://opendev.org/openstack/networking-odl>`__
 openstack/networking-powervm             `https://opendev.org/openstack/networking-powervm <https://opendev.org/openstack/networking-powervm>`__
 openstack/networking-sfc                 `https://opendev.org/openstack/networking-sfc <https://opendev.org/openstack/networking-sfc>`__
@@ -93,19 +86,13 @@ openstack/octavia                        `https://opendev.org/openstack/octavia
 openstack/octavia-dashboard              `https://opendev.org/openstack/octavia-dashboard <https://opendev.org/openstack/octavia-dashboard>`__
 openstack/octavia-tempest-plugin         `https://opendev.org/openstack/octavia-tempest-plugin <https://opendev.org/openstack/octavia-tempest-plugin>`__
 openstack/openstacksdk                   `https://opendev.org/openstack/openstacksdk <https://opendev.org/openstack/openstacksdk>`__
-openstack/os-loganalyze                  `https://opendev.org/openstack/os-loganalyze <https://opendev.org/openstack/os-loganalyze>`__
 openstack/osprofiler                     `https://opendev.org/openstack/osprofiler <https://opendev.org/openstack/osprofiler>`__
 openstack/oswin-tempest-plugin           `https://opendev.org/openstack/oswin-tempest-plugin <https://opendev.org/openstack/oswin-tempest-plugin>`__
 openstack/ovn-octavia-provider           `https://opendev.org/openstack/ovn-octavia-provider <https://opendev.org/openstack/ovn-octavia-provider>`__
-openstack/panko                          `https://opendev.org/openstack/panko <https://opendev.org/openstack/panko>`__
 openstack/patrole                        `https://opendev.org/openstack/patrole <https://opendev.org/openstack/patrole>`__
-openstack/qinling                        `https://opendev.org/openstack/qinling <https://opendev.org/openstack/qinling>`__
-openstack/qinling-dashboard              `https://opendev.org/openstack/qinling-dashboard <https://opendev.org/openstack/qinling-dashboard>`__
 openstack/rally-openstack                `https://opendev.org/openstack/rally-openstack <https://opendev.org/openstack/rally-openstack>`__
 openstack/sahara                         `https://opendev.org/openstack/sahara <https://opendev.org/openstack/sahara>`__
 openstack/sahara-dashboard               `https://opendev.org/openstack/sahara-dashboard <https://opendev.org/openstack/sahara-dashboard>`__
-openstack/searchlight                    `https://opendev.org/openstack/searchlight <https://opendev.org/openstack/searchlight>`__
-openstack/searchlight-ui                 `https://opendev.org/openstack/searchlight-ui <https://opendev.org/openstack/searchlight-ui>`__
 openstack/senlin                         `https://opendev.org/openstack/senlin <https://opendev.org/openstack/senlin>`__
 openstack/shade                          `https://opendev.org/openstack/shade <https://opendev.org/openstack/shade>`__
 openstack/solum                          `https://opendev.org/openstack/solum <https://opendev.org/openstack/solum>`__
@@ -143,6 +130,7 @@ x/devstack-plugin-glusterfs              `https://opendev.org/x/devstack-plugin-
 x/devstack-plugin-hdfs                   `https://opendev.org/x/devstack-plugin-hdfs <https://opendev.org/x/devstack-plugin-hdfs>`__
 x/devstack-plugin-libvirt-qemu           `https://opendev.org/x/devstack-plugin-libvirt-qemu <https://opendev.org/x/devstack-plugin-libvirt-qemu>`__
 x/devstack-plugin-mariadb                `https://opendev.org/x/devstack-plugin-mariadb <https://opendev.org/x/devstack-plugin-mariadb>`__
+x/devstack-plugin-tobiko                 `https://opendev.org/x/devstack-plugin-tobiko <https://opendev.org/x/devstack-plugin-tobiko>`__
 x/devstack-plugin-vmax                   `https://opendev.org/x/devstack-plugin-vmax <https://opendev.org/x/devstack-plugin-vmax>`__
 x/drbd-devstack                          `https://opendev.org/x/drbd-devstack <https://opendev.org/x/drbd-devstack>`__
 x/fenix                                  `https://opendev.org/x/fenix <https://opendev.org/x/fenix>`__
@@ -169,6 +157,7 @@ x/networking-fortinet                    `https://opendev.org/x/networking-forti
 x/networking-hpe                         `https://opendev.org/x/networking-hpe <https://opendev.org/x/networking-hpe>`__
 x/networking-huawei                      `https://opendev.org/x/networking-huawei <https://opendev.org/x/networking-huawei>`__
 x/networking-infoblox                    `https://opendev.org/x/networking-infoblox <https://opendev.org/x/networking-infoblox>`__
+x/networking-l2gw                        `https://opendev.org/x/networking-l2gw <https://opendev.org/x/networking-l2gw>`__
 x/networking-lagopus                     `https://opendev.org/x/networking-lagopus <https://opendev.org/x/networking-lagopus>`__
 x/networking-mlnx                        `https://opendev.org/x/networking-mlnx <https://opendev.org/x/networking-mlnx>`__
 x/networking-nec                         `https://opendev.org/x/networking-nec <https://opendev.org/x/networking-nec>`__
@@ -193,7 +182,6 @@ x/stackube                               `https://opendev.org/x/stackube <https:
 x/tap-as-a-service                       `https://opendev.org/x/tap-as-a-service <https://opendev.org/x/tap-as-a-service>`__
 x/tap-as-a-service-dashboard             `https://opendev.org/x/tap-as-a-service-dashboard <https://opendev.org/x/tap-as-a-service-dashboard>`__
 x/tatu                                   `https://opendev.org/x/tatu <https://opendev.org/x/tatu>`__
-x/tobiko                                 `https://opendev.org/x/tobiko <https://opendev.org/x/tobiko>`__
 x/trio2o                                 `https://opendev.org/x/trio2o <https://opendev.org/x/trio2o>`__
 x/valet                                  `https://opendev.org/x/valet <https://opendev.org/x/valet>`__
 x/vmware-nsx                             `https://opendev.org/x/vmware-nsx <https://opendev.org/x/vmware-nsx>`__

From 4e916aeb060ecf99203f297a0ff726a65d27f50e Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Mon, 26 Apr 2021 08:52:23 -0700
Subject: [PATCH 1888/2409] Configure glance unified limit quotas

This makes us configure limits for glance and enable enforcement.

Depends-On: https://review.opendev.org/c/openstack/glance/+/794247
Change-Id: If58d8474cae95b1be3044bd52010b8288a7f5fcc
---
 lib/glance | 45 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 45 insertions(+)

diff --git a/lib/glance b/lib/glance
index e789affaf1..fd2e0afcc1 100644
--- a/lib/glance
+++ b/lib/glance
@@ -84,6 +84,7 @@ GLANCE_STAGING_DIR=${GLANCE_MULTISTORE_FILE_IMAGE_DIR:=$DATA_DIR/os_glance_stagi
 GLANCE_TASKS_DIR=${GLANCE_MULTISTORE_FILE_IMAGE_DIR:=$DATA_DIR/os_glance_tasks_store}
 
 GLANCE_USE_IMPORT_WORKFLOW=$(trueorfalse False GLANCE_USE_IMPORT_WORKFLOW)
+GLANCE_ENABLE_QUOTAS=$(trueorfalse True GLANCE_ENABLE_QUOTAS)
 
 GLANCE_CONF_DIR=${GLANCE_CONF_DIR:-/etc/glance}
 GLANCE_METADEF_DIR=$GLANCE_CONF_DIR/metadefs
@@ -263,6 +264,45 @@ function configure_glance_store {
     fi
 }
 
+function configure_glance_quotas {
+
+    # NOTE(danms): We need to have some of the OS_ things unset in
+    # order to use system scope, which is required for creating these
+    # limits. This is a hack, but I dunno how else to get osc to use
+    # system scope.
+
+    bash -c "unset OS_USERNAME OS_TENANT_NAME OS_PROJECT_NAME;
+        openstack --os-cloud devstack-system-admin registered limit create \
+                --service glance --default-limit 1000 --region $REGION_NAME \
+                image_size_total; \
+        openstack --os-cloud devstack-system-admin registered limit create \
+                --service glance --default-limit 1000 --region $REGION_NAME \
+                image_stage_total; \
+        openstack --os-cloud devstack-system-admin registered limit create \
+                --service glance --default-limit 100 --region $REGION_NAME \
+                image_count_total; \
+        openstack --os-cloud devstack-system-admin registered limit create \
+                --service glance --default-limit 100 --region $REGION_NAME \
+                image_count_uploading"
+
+    # Tell glance to use these limits
+    iniset $GLANCE_API_CONF DEFAULT use_keystone_limits True
+
+    # Configure oslo_limit so it can talk to keystone
+    iniset $GLANCE_API_CONF oslo_limit user_domain_name $SERVICE_DOMAIN_NAME
+    iniset $GLANCE_API_CONF oslo_limit password $SERVICE_PASSWORD
+    iniset $GLANCE_API_CONF oslo_limit username glance
+    iniset $GLANCE_API_CONF oslo_limit auth_type password
+    iniset $GLANCE_API_CONF oslo_limit auth_url $KEYSTONE_SERVICE_URI
+    iniset $GLANCE_API_CONF oslo_limit system_scope "'all'"
+    iniset $GLANCE_API_CONF oslo_limit endpoint_id \
+           $(openstack endpoint list --service glance -f value -c ID)
+
+    # Allow the glance service user to read quotas
+    openstack role add --user glance --user-domain Default --system all \
+              reader
+}
+
 # configure_glance() - Set config files, create data dirs, etc
 function configure_glance {
     sudo install -d -o $STACK_USER $GLANCE_CONF_DIR $GLANCE_METADEF_DIR
@@ -403,6 +443,11 @@ function create_glance_accounts {
         service_domain_id=$(get_or_create_domain $SERVICE_DOMAIN_NAME)
         iniset $GLANCE_SWIFT_STORE_CONF ref1 project_domain_id $service_domain_id
         iniset $GLANCE_SWIFT_STORE_CONF ref1 user_domain_id $service_domain_id
+
+        if [[ "$GLANCE_ENABLE_QUOTAS" = True ]]; then
+            configure_glance_quotas
+        fi
+
     fi
 }
 

From 6843bc798c3fe5f17286e1c07ede95171bb49a25 Mon Sep 17 00:00:00 2001
From: Monty Taylor <mordred@inaugust.com>
Date: Fri, 14 May 2021 14:51:51 -0500
Subject: [PATCH 1889/2409] Temporary add feature pragma

OpenStackSDK has a feature branch "feature/r1" as a preparation for the
R1.0 release. Due to different branch naming functional tests with
devstack are not running. Add temporarily (for the duration of the
feature branch) pragma to the zuul.yaml to allow Zuul run functional
tests. It will be dropped once SDK gets next major release.

Change-Id: I671b589150fe731125e16316a994a5942219920b
---
 .zuul.yaml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index 00129b5ca4..9a675c64ce 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -1,3 +1,10 @@
+- pragma:
+   # NOTE(gtema): this is required for the changes in SDK feature/r1 branch to
+   # be using devstack
+   # TODO(gtema): delete this once r1 branch is merged into master
+    implied-branches:
+      - feature/r1
+
 - nodeset:
     name: openstack-single-node
     nodes:

From 3ad1661384636eee78a4bf5196812b6223e1b0a6 Mon Sep 17 00:00:00 2001
From: Ghanshyam <gmann@ghanshyammann.com>
Date: Fri, 4 Jun 2021 21:32:17 +0000
Subject: [PATCH 1890/2409] Revert "Temporary add feature pragma"

This reverts commit 6843bc798c3fe5f17286e1c07ede95171bb49a25.

Reason for revert: not sure why but this end up disabling the integration job on check pipeline,

Change-Id: Icfaf8ea17b3ce2e405414c23f8075b18d297bf8b
example: latest recheck on PS12 check pipeline job for neutron - https://review.opendev.org/c/openstack/neutron/+/790060
---
 .zuul.yaml | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 9a675c64ce..00129b5ca4 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -1,10 +1,3 @@
-- pragma:
-   # NOTE(gtema): this is required for the changes in SDK feature/r1 branch to
-   # be using devstack
-   # TODO(gtema): delete this once r1 branch is merged into master
-    implied-branches:
-      - feature/r1
-
 - nodeset:
     name: openstack-single-node
     nodes:

From 96509ea025459ac077d2c85289da7725c53235cf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rados=C5=82aw=20Piliszek?= <radoslaw.piliszek@gmail.com>
Date: Wed, 21 Oct 2020 20:33:08 +0200
Subject: [PATCH 1891/2409] Check centos-8-stream

CentOS Stream 8 (aka CentOS 8 Stream) is the currently
supported runtime platform. [0]

Some background history:
The Manila team has asked QA to test centos-8-stream
in the common gate.
A bit later it turned out the point releases of CentOS 8 (aka
CentOS Linux 8) will stop happening entirely by the end of 2021.
[1]

Includes a workaround to the edk2-ovmf issue on CentOS Stream 8
x86_64.

[0] https://governance.openstack.org/tc/reference/runtimes/xena.html
[1] https://lists.centos.org/pipermail/centos-devel/2020-December/075451.html

Change-Id: Iee5a262af757f27f79ba1d6f790e949427dca190
---
 .zuul.yaml                         | 19 +++++++++++++++++++
 lib/nova_plugins/functions-libvirt | 12 +++++++++++-
 2 files changed, 30 insertions(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 5bc6a8b424..e45ff8febc 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -58,6 +58,16 @@
         nodes:
           - controller
 
+- nodeset:
+    name: devstack-single-node-centos-8-stream
+    nodes:
+      - name: controller
+        label: centos-8-stream
+    groups:
+      - name: tempest
+        nodes:
+          - controller
+
 - nodeset:
     name: devstack-single-node-opensuse-15
     nodes:
@@ -591,6 +601,14 @@
     voting: false
     timeout: 9000
 
+- job:
+    name: devstack-platform-centos-8-stream
+    parent: tempest-full-py3
+    description: CentOS 8 Stream platform test
+    nodeset: devstack-single-node-centos-8-stream
+    voting: false
+    timeout: 9000
+
 - job:
     name: devstack-async
     parent: tempest-full-py3
@@ -704,6 +722,7 @@
         - devstack-ipv6
         - devstack-platform-fedora-latest
         - devstack-platform-centos-8
+        - devstack-platform-centos-8-stream
         - devstack-async
         - devstack-multinode
         - devstack-unit-tests
diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index d3827c30dd..58adde7cd4 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -81,7 +81,17 @@ function install_libvirt {
         install_package qemu-kvm
 
         install_package libvirt libvirt-devel
-        if is_arch "aarch64"; then
+        if is_arch "x86_64"; then
+            # NOTE(yoctozepto): recent edk2-ovmf on CentOS Stream 8 x86_64 started failing with
+            # "libvirt.libvirtError: internal error: unknown feature amd-sev-es",
+            # so reinstall a known working version until the relevant bugs get fixed:
+            #   * https://bugzilla.redhat.com/show_bug.cgi?id=1961558
+            #   * https://bugzilla.redhat.com/show_bug.cgi?id=1961562
+            # TODO(yoctozepto): Remove this code when the time is right.
+            if [ "$os_VENDOR" = "CentOSStream" ]; then
+                install_package edk2-ovmf-20200602gitca407c7246bf-4.el8
+            fi
+        elif is_arch "aarch64"; then
             install_package edk2.git-aarch64
         fi
 

From 81937a230a8adb5c028db5a9ba9abf59b122a2ac Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rados=C5=82aw=20Piliszek?= <radoslaw.piliszek@gmail.com>
Date: Mon, 7 Jun 2021 17:28:38 +0000
Subject: [PATCH 1892/2409] [CI] Drop CentOS Linux 8 job and nodeset

CentOS Stream 8 (aka CentOS 8 Stream) is the currently
supported runtime platform. [0]

DevStack works with CentOS Stream only now. [1]

The only usage of the nodeset being dropped is handled by the
Depends-On.

[0] https://governance.openstack.org/tc/reference/runtimes/xena.html
[1] https://review.opendev.org/c/openstack/devstack/+/759122

Depends-On: https://review.opendev.org/c/openstack/cinder-tempest-plugin/+/795159
Change-Id: Ic0f696b46dce3dba529b53a8f9de8cda6b913c7b
---
 .zuul.yaml | 19 -------------------
 1 file changed, 19 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index e45ff8febc..74223d44f5 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -48,16 +48,6 @@
         nodes:
           - controller
 
-- nodeset:
-    name: devstack-single-node-centos-8
-    nodes:
-      - name: controller
-        label: centos-8
-    groups:
-      - name: tempest
-        nodes:
-          - controller
-
 - nodeset:
     name: devstack-single-node-centos-8-stream
     nodes:
@@ -593,14 +583,6 @@
 # we often have to rush things through devstack to stabilise the gate,
 # and these platforms don't have the round-the-clock support to avoid
 # becoming blockers in that situation.
-- job:
-    name: devstack-platform-centos-8
-    parent: tempest-full-py3
-    description: Centos 8 platform test
-    nodeset: devstack-single-node-centos-8
-    voting: false
-    timeout: 9000
-
 - job:
     name: devstack-platform-centos-8-stream
     parent: tempest-full-py3
@@ -721,7 +703,6 @@
         - devstack
         - devstack-ipv6
         - devstack-platform-fedora-latest
-        - devstack-platform-centos-8
         - devstack-platform-centos-8-stream
         - devstack-async
         - devstack-multinode

From 2fb8c7a5eea6f9321eef36fb9b8fd8e55465c91e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rados=C5=82aw=20Piliszek?= <radoslaw.piliszek@gmail.com>
Date: Mon, 7 Jun 2021 17:44:54 +0000
Subject: [PATCH 1893/2409] Move verify-ipv6-only-deployments

from Tempest to DevStack as it tests DevStack side of things and
is useful for projects not using Tempest.

Verbatim copy except for the devstack- prefix and the /devstack/
path.

Change-Id: Ie166730843f874b9c99e37244e460d7ad33b7eeb
---
 .../README.rst                                | 16 ++++
 .../defaults/main.yaml                        |  1 +
 .../tasks/main.yaml                           |  4 +
 tools/verify-ipv6-only-deployments.sh         | 92 +++++++++++++++++++
 4 files changed, 113 insertions(+)
 create mode 100644 roles/devstack-ipv6-only-deployments-verification/README.rst
 create mode 100644 roles/devstack-ipv6-only-deployments-verification/defaults/main.yaml
 create mode 100644 roles/devstack-ipv6-only-deployments-verification/tasks/main.yaml
 create mode 100755 tools/verify-ipv6-only-deployments.sh

diff --git a/roles/devstack-ipv6-only-deployments-verification/README.rst b/roles/devstack-ipv6-only-deployments-verification/README.rst
new file mode 100644
index 0000000000..400a8da222
--- /dev/null
+++ b/roles/devstack-ipv6-only-deployments-verification/README.rst
@@ -0,0 +1,16 @@
+Verify the IPv6-only deployments
+
+This role needs to be invoked from a playbook that
+run tests. This role verifies the IPv6 setting on
+devstack side and devstack deploy services on IPv6.
+This role is invoked before tests are run so that
+if any missing IPv6 setting or deployments can fail
+the job early.
+
+
+**Role Variables**
+
+.. zuul:rolevar:: devstack_base_dir
+   :default: /opt/stack
+
+   The devstack base directory.
diff --git a/roles/devstack-ipv6-only-deployments-verification/defaults/main.yaml b/roles/devstack-ipv6-only-deployments-verification/defaults/main.yaml
new file mode 100644
index 0000000000..fea05c8146
--- /dev/null
+++ b/roles/devstack-ipv6-only-deployments-verification/defaults/main.yaml
@@ -0,0 +1 @@
+devstack_base_dir: /opt/stack
diff --git a/roles/devstack-ipv6-only-deployments-verification/tasks/main.yaml b/roles/devstack-ipv6-only-deployments-verification/tasks/main.yaml
new file mode 100644
index 0000000000..59d3b79bc1
--- /dev/null
+++ b/roles/devstack-ipv6-only-deployments-verification/tasks/main.yaml
@@ -0,0 +1,4 @@
+- name: Verify the ipv6-only deployments
+  become: true
+  become_user: stack
+  shell: "{{ devstack_base_dir }}/devstack/tools/verify-ipv6-only-deployments.sh"
diff --git a/tools/verify-ipv6-only-deployments.sh b/tools/verify-ipv6-only-deployments.sh
new file mode 100755
index 0000000000..2596395165
--- /dev/null
+++ b/tools/verify-ipv6-only-deployments.sh
@@ -0,0 +1,92 @@
+#!/bin/bash
+#
+#
+# NOTE(gmann): This script is used in 'devstack-tempest-ipv6' zuul job to verify that
+# services are deployed on IPv6 properly or not. This will capture if any devstck or devstack
+# plugins are missing the required setting to listen on IPv6 address. This is run as part of
+# run phase of zuul job and before test run. Child job of 'devstack-tempest-ipv6'
+# can expand the IPv6 verification specific to project by defining the new post-run script which
+# will run along with this base script.
+# If there are more common verification for IPv6 then we can always extent this script.
+
+# Keep track of the DevStack directory
+TOP_DIR=$(cd $(dirname "$0")/../../devstack && pwd)
+source $TOP_DIR/stackrc
+source $TOP_DIR/openrc admin admin
+
+function verify_devstack_ipv6_setting {
+    local _service_host=''
+    _service_host=$(echo $SERVICE_HOST | tr -d [])
+    local _host_ipv6=''
+    _host_ipv6=$(echo $HOST_IPV6 | tr -d [])
+    local _service_listen_address=''
+    _service_listen_address=$(echo $SERVICE_LISTEN_ADDRESS | tr -d [])
+    local _service_local_host=''
+    _service_local_host=$(echo $SERVICE_LOCAL_HOST | tr -d [])
+    if [[ "$SERVICE_IP_VERSION" != 6 ]]; then
+        echo $SERVICE_IP_VERSION "SERVICE_IP_VERSION is not set to 6 which is must for devstack to deploy services with IPv6 address."
+        exit 1
+    fi
+    is_service_host_ipv6=$(python3 -c 'import oslo_utils.netutils as nutils; print(nutils.is_valid_ipv6("'$_service_host'"))')
+    if [[ "$is_service_host_ipv6" != "True" ]]; then
+        echo $SERVICE_HOST "SERVICE_HOST is not ipv6 which means devstack cannot deploy services on IPv6 address."
+        exit 1
+    fi
+    is_host_ipv6=$(python3 -c 'import oslo_utils.netutils as nutils; print(nutils.is_valid_ipv6("'$_host_ipv6'"))')
+    if [[ "$is_host_ipv6" != "True" ]]; then
+        echo $HOST_IPV6 "HOST_IPV6 is not ipv6 which means devstack cannot deploy services on IPv6 address."
+        exit 1
+    fi
+    is_service_listen_address=$(python3 -c 'import oslo_utils.netutils as nutils; print(nutils.is_valid_ipv6("'$_service_listen_address'"))')
+    if [[ "$is_service_listen_address" != "True" ]]; then
+        echo $SERVICE_LISTEN_ADDRESS "SERVICE_LISTEN_ADDRESS is not ipv6 which means devstack cannot deploy services on IPv6 address."
+        exit 1
+    fi
+    is_service_local_host=$(python3 -c 'import oslo_utils.netutils as nutils; print(nutils.is_valid_ipv6("'$_service_local_host'"))')
+    if [[ "$is_service_local_host" != "True" ]]; then
+        echo $SERVICE_LOCAL_HOST "SERVICE_LOCAL_HOST is not ipv6 which means devstack cannot deploy services on IPv6 address."
+        exit 1
+    fi
+    echo "Devstack is properly configured with IPv6"
+    echo "SERVICE_IP_VERSION: " $SERVICE_IP_VERSION "HOST_IPV6: " $HOST_IPV6 "SERVICE_HOST: " $SERVICE_HOST "SERVICE_LISTEN_ADDRESS: " $SERVICE_LISTEN_ADDRESS "SERVICE_LOCAL_HOST: " $SERVICE_LOCAL_HOST
+}
+
+function sanity_check_system_ipv6_enabled {
+    system_ipv6_enabled=$(python3 -c 'import oslo_utils.netutils as nutils; print(nutils.is_ipv6_enabled())')
+    if [[ $system_ipv6_enabled != "True" ]]; then
+        echo "IPv6 is disabled in system"
+        exit 1
+    fi
+    echo "IPv6 is enabled in system"
+}
+
+function verify_service_listen_address_is_ipv6 {
+    local endpoints_verified=False
+    local all_ipv6=True
+    endpoints=$(openstack endpoint list -f value -c URL)
+    for endpoint in ${endpoints}; do
+        local endpoint_address=''
+        endpoint_address=$(echo "$endpoint" | awk -F/ '{print $3}' | awk -F] '{print $1}')
+        endpoint_address=$(echo $endpoint_address | tr -d [])
+        local is_endpoint_ipv6=''
+        is_endpoint_ipv6=$(python3 -c 'import oslo_utils.netutils as nutils; print(nutils.is_valid_ipv6("'$endpoint_address'"))')
+        if [[ "$is_endpoint_ipv6" != "True" ]]; then
+            all_ipv6=False
+            echo $endpoint ": This is not ipv6 endpoint which means corresponding service is not listening on IPv6 address."
+            continue
+        fi
+        endpoints_verified=True
+    done
+    if [[ "$all_ipv6" == "False"  ]] || [[ "$endpoints_verified" == "False" ]]; then
+        exit 1
+    fi
+    echo "All services deployed by devstack is on IPv6 endpoints"
+    echo $endpoints
+}
+
+#First thing to verify if system has IPv6 enabled or not
+sanity_check_system_ipv6_enabled
+#Verify whether devstack is configured properly with IPv6 setting
+verify_devstack_ipv6_setting
+#Get all registrfed endpoints by devstack in keystone and verify that each endpoints address is IPv6.
+verify_service_listen_address_is_ipv6

From 95298788085de38342e789bf10c35849c7117dfc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rados=C5=82aw=20Piliszek?= <radoslaw.piliszek@gmail.com>
Date: Tue, 8 Jun 2021 16:19:40 +0000
Subject: [PATCH 1894/2409] [OVN] Set up routing on public bridge like OVS did

This fixes various reported and unreported issues with the new
behaviour.

Removes code repetition as well to pay off some technical debt.

Closes-Bug: #1930360
Change-Id: I726c532e96ca434520838ae8a35d5b88b6dd337b
---
 lib/neutron_plugins/ovn_agent   | 42 ++-------------------------------
 lib/neutron_plugins/services/l3 |  6 ++---
 2 files changed, 5 insertions(+), 43 deletions(-)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index 948fede3b9..cfcb01ee91 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -262,48 +262,10 @@ function clone_repository {
     ERROR_ON_CLONE=false git_clone $repo $dir $branch
 }
 
-function get_ext_gw_interface {
-    # Get ext_gw_interface depending on value of Q_USE_PUBLIC_VETH
-    # This function is copied directly from the devstack neutron-legacy script
-    if [[ "$Q_USE_PUBLIC_VETH" == "True" ]]; then
-        echo $Q_PUBLIC_VETH_EX
-    else
-        # Disable in-band as we are going to use local port
-        # to communicate with VMs
-        sudo ovs-vsctl set Bridge $PUBLIC_BRIDGE \
-            other_config:disable-in-band=true
-        echo $PUBLIC_BRIDGE
-    fi
-}
-
 function create_public_bridge {
     # Create the public bridge that OVN will use
-    # This logic is based on the devstack neutron-legacy _neutron_configure_router_v4 and _v6
-    local ext_gw_ifc
-    ext_gw_ifc=$(get_ext_gw_interface)
-
-    sudo ovs-vsctl --may-exist add-br $ext_gw_ifc -- set bridge $ext_gw_ifc protocols=OpenFlow13,OpenFlow15
-    sudo ovs-vsctl set open . external-ids:ovn-bridge-mappings=$PHYSICAL_NETWORK:$ext_gw_ifc
-    if [ -n "$FLOATING_RANGE" ]; then
-        local cidr_len=${FLOATING_RANGE#*/}
-        sudo ip addr replace $PUBLIC_NETWORK_GATEWAY/$cidr_len dev $ext_gw_ifc
-    fi
-
-    # Ensure IPv6 RAs are accepted on the interface with the default route.
-    # This is needed for neutron-based devstack clouds to work in
-    # IPv6-only clouds in the gate. Please do not remove this without
-    # talking to folks in Infra. This fix is based on a devstack fix for
-    # neutron L3 agent: https://review.openstack.org/#/c/359490/.
-    default_route_dev=$(ip route | grep ^default | awk '{print $5}')
-    sudo sysctl -w net.ipv6.conf.$default_route_dev.accept_ra=2
-
-    sudo sysctl -w net.ipv6.conf.all.forwarding=1
-    if [ -n "$IPV6_PUBLIC_RANGE" ]; then
-        local ipv6_cidr_len=${IPV6_PUBLIC_RANGE#*/}
-        sudo ip -6 addr replace $IPV6_PUBLIC_NETWORK_GATEWAY/$ipv6_cidr_len dev $ext_gw_ifc
-    fi
-
-    sudo ip link set $ext_gw_ifc up
+    sudo ovs-vsctl --may-exist add-br $PUBLIC_BRIDGE -- set bridge $PUBLIC_BRIDGE protocols=OpenFlow13,OpenFlow15
+    sudo ovs-vsctl set open . external-ids:ovn-bridge-mappings=$PHYSICAL_NETWORK:$PUBLIC_BRIDGE
 }
 
 function _disable_libvirt_apparmor {
diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 5d339a00aa..b6bc02818c 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -343,8 +343,8 @@ function _neutron_configure_router_v4 {
     # Configure the external network as the default router gateway
     openstack --os-cloud devstack-admin --os-region "$REGION_NAME" router set --external-gateway $EXT_NET_ID $ROUTER_ID
 
-    # This logic is specific to using the l3-agent for layer 3
-    if is_service_enabled q-l3 || is_service_enabled neutron-l3;  then
+    # This logic is specific to using OVN or the l3-agent for layer 3
+    if ([[ $Q_AGENT == "ovn" ]] && [[ "$OVN_L3_CREATE_PUBLIC_NETWORK" == "True" ]] && is_service_enabled q-svc neutron-server) || is_service_enabled q-l3 neutron-l3; then
         # Configure and enable public bridge
         local ext_gw_interface="none"
         if is_neutron_ovs_base_plugin; then
@@ -393,7 +393,7 @@ function _neutron_configure_router_v6 {
     fi
 
     # This logic is specific to using OVN or the l3-agent for layer 3
-    if ([[ $Q_AGENT == "ovn" ]] && is_service_enabled q-svc neutron-server) || is_service_enabled q-l3 neutron-l3; then
+    if ([[ $Q_AGENT == "ovn" ]] && [[ "$OVN_L3_CREATE_PUBLIC_NETWORK" == "True" ]] && is_service_enabled q-svc neutron-server) || is_service_enabled q-l3 neutron-l3; then
         # if the Linux host considers itself to be a router then it will
         # ignore all router advertisements
         # Ensure IPv6 RAs are accepted on interfaces with a default route.

From 5a684eb51b4c18aee2051c5a7c703f50bbcc41ca Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Wed, 9 Jun 2021 09:37:34 +0200
Subject: [PATCH 1895/2409] Drop broute from ebtables_dump

This table is no longer present on most installations, drop it
from the list to avoid error messages during log collection
that people mistake to be the real error why devstack is failing.

This may lose some debugging information in edge cases, but I
think the improvement of the general user experience is more
important.

Change-Id: Ibb9b247a018a788c8c4b40487762319fe470bf0f
Closes-Bug: 1885198
---
 tools/worlddump.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/worlddump.py b/tools/worlddump.py
index 22770f15b6..e2921737db 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -134,7 +134,7 @@ def disk_space():
 
 
 def ebtables_dump():
-    tables = ['filter', 'nat', 'broute']
+    tables = ['filter', 'nat']
     _header("EB Tables Dump")
     if not _find_cmd('ebtables'):
         return

From 20d6a21e8a1daed9eee0a8413217b2f8e4e863dd Mon Sep 17 00:00:00 2001
From: Mohammed Naser <mnaser@vexxhost.com>
Date: Wed, 9 Jun 2021 14:20:01 -0400
Subject: [PATCH 1896/2409] Switch fedora-latest to use fedora-34

Fedora 32 is now EOL, we should test against the newly released
version of Fedora which is 34.

Depends-On: https://review.opendev.org/c/openstack/project-config/+/795604
Change-Id: I10d868aca20d1a10d3e7fcfeb78f6fda4c896ee8
---
 .zuul.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 74223d44f5..968d79f76a 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -72,7 +72,7 @@
     name: devstack-single-node-fedora-latest
     nodes:
       - name: controller
-        label: fedora-32
+        label: fedora-34
     groups:
       - name: tempest
         nodes:

From 89baa314c1408251abd9f4d61d9cf5e5c945bc4e Mon Sep 17 00:00:00 2001
From: Artem Goncharov <Artem.goncharov@gmail.com>
Date: Fri, 11 Jun 2021 16:59:52 +0200
Subject: [PATCH 1897/2409] Temporary add feature pragma

OpenStackSDK has a feature branch "feature/r1" as a preparation for the
R1.0 release. Due to different branch naming functional tests with
devstack are not running. Add temporarily (for the duration of the
feature branch) pragma to the zuul.yaml to allow Zuul run functional
tests. It will be dropped once SDK gets next major release.
Previous attemp didn't work well for other projects, therefore
explicitly include master as well.

Change-Id: I3a5722873f395bc52cc55a0fd6bcea0ebe3b74fc
---
 .zuul.yaml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index 74223d44f5..3c490ff180 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -1,3 +1,11 @@
+- pragma:
+   # NOTE(gtema): this is required for the changes in SDK feature/r1 branch to
+   # be using devstack
+   # TODO(gtema): delete this once r1 branch is merged into master
+    implied-branches:
+      - master
+      - feature/r1
+
 - nodeset:
     name: openstack-single-node
     nodes:

From 6af3cb9eb273c127c20bc07f65c9a5d7f8ba95cd Mon Sep 17 00:00:00 2001
From: Julia Kreger <juliaashleykreger@gmail.com>
Date: Thu, 11 Mar 2021 11:28:47 -0800
Subject: [PATCH 1898/2409] nova ironic-hypevisor - support scoped auth config

The Secure RBAC effort has updated Ironic such that it
can support a mode where it is scope enforcing for all
interactions with the API. Due to the design, and operating
nature of Ironic's API, services speaking with it must
authenticate with a system scope to have a full picture
of the universe.

In this case, we need to update the nova configuration
accordingly such that the compute service understands
how to talk to ironic so that it can see the nodes under
management.

Ironic will likely update this again at a later point in
time to enable a "hybrid" mixed-mode as the operating model
and related permissions *should* allow nova to use a project
scoped "owner" account with Ironic, in order to access
and command nodes to deploy. But at this time, we're
focusing on the exclusive operating mode.

Change-Id: I1946725ce08c495178c419eaf38829f921c91bbe
Needed-By: https://review.opendev.org/c/openstack/ironic/+/778957
---
 functions-common                   | 5 +++++
 lib/nova_plugins/hypervisor-ironic | 9 ++++++---
 2 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/functions-common b/functions-common
index 340da754a2..11679e4aa3 100644
--- a/functions-common
+++ b/functions-common
@@ -1037,6 +1037,11 @@ function is_ironic_hardware {
     return 1
 }
 
+function is_ironic_enforce_scope {
+    is_service_enabled ironic && [[ "$IRONIC_ENFORCE_SCOPE" == "True" ]] && return 0
+    return 1
+}
+
 
 # Package Functions
 # =================
diff --git a/lib/nova_plugins/hypervisor-ironic b/lib/nova_plugins/hypervisor-ironic
index bda6ef6998..f058e9bb53 100644
--- a/lib/nova_plugins/hypervisor-ironic
+++ b/lib/nova_plugins/hypervisor-ironic
@@ -47,9 +47,13 @@ function configure_nova_hypervisor {
     iniset $NOVA_CONF ironic username admin
     iniset $NOVA_CONF ironic password $ADMIN_PASSWORD
     iniset $NOVA_CONF ironic auth_url $KEYSTONE_SERVICE_URI
-    iniset $NOVA_CONF ironic project_domain_id default
+    if is_ironic_enforce_scope; then
+        iniset $NOVA_CONF ironic system_scope all
+    else
+        iniset $NOVA_CONF ironic project_domain_id default
+        iniset $NOVA_CONF ironic project_name demo
+    fi
     iniset $NOVA_CONF ironic user_domain_id default
-    iniset $NOVA_CONF ironic project_name demo
     iniset $NOVA_CONF ironic region_name $REGION_NAME
 
     # These are used with crufty legacy ironicclient
@@ -82,7 +86,6 @@ function stop_nova_hypervisor {
     :
 }
 
-
 # Restore xtrace
 $_XTRACE_HYP_IRONIC
 

From 808331488dc16afdf9bd4c2c3103a4a8fc9a6209 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rados=C5=82aw=20Piliszek?= <radoslaw.piliszek@gmail.com>
Date: Fri, 18 Jun 2021 12:06:02 +0000
Subject: [PATCH 1899/2409] Revert edk2 workaround

It is not needed anymore.

Change-Id: I706a33b0a7c737a23b9a7270af1e53e5de83c66f
---
 lib/nova_plugins/functions-libvirt | 12 +-----------
 1 file changed, 1 insertion(+), 11 deletions(-)

diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index 58adde7cd4..d3827c30dd 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -81,17 +81,7 @@ function install_libvirt {
         install_package qemu-kvm
 
         install_package libvirt libvirt-devel
-        if is_arch "x86_64"; then
-            # NOTE(yoctozepto): recent edk2-ovmf on CentOS Stream 8 x86_64 started failing with
-            # "libvirt.libvirtError: internal error: unknown feature amd-sev-es",
-            # so reinstall a known working version until the relevant bugs get fixed:
-            #   * https://bugzilla.redhat.com/show_bug.cgi?id=1961558
-            #   * https://bugzilla.redhat.com/show_bug.cgi?id=1961562
-            # TODO(yoctozepto): Remove this code when the time is right.
-            if [ "$os_VENDOR" = "CentOSStream" ]; then
-                install_package edk2-ovmf-20200602gitca407c7246bf-4.el8
-            fi
-        elif is_arch "aarch64"; then
+        if is_arch "aarch64"; then
             install_package edk2.git-aarch64
         fi
 

From 5344885a61fe39565692014c15e0b4fb1055c835 Mon Sep 17 00:00:00 2001
From: Sean Mooney <work@seanmooney.info>
Date: Thu, 17 Jun 2021 12:37:35 +0100
Subject: [PATCH 1900/2409] os_vif: Add support for configuring os_vif_ovs
 plugin

This change add an os-vif lib that declares two new variables
OS_VIF_OVS_OVSDB_INTERFACE and OS_VIF_OVS_ISOLATE_VIF

The former is introduced to workaround bug #1929446 which cause the nova
and neutron agents to periodically block waiting for ovs to respond.

OS_VIF_OVS_ISOLATE_VIF is added to address bug #1734320 when using
ml2/ovs vif isolation should always be used to prevent cross tenant
traffic during a live migration.  This makes devstack more closely
mirror reality by enabling it when ml2/ovs is used and disabling it
otherwise.

Related-Bug: #1734320
Related-Bug: #1929446
Related-Bug: #1912310
Change-Id: I88254c6e22b52585506ee4907c1c03b8d4f2dac7
---
 lib/os-vif | 29 +++++++++++++++++++++++++++++
 stack.sh   |  6 ++++++
 2 files changed, 35 insertions(+)
 create mode 100644 lib/os-vif

diff --git a/lib/os-vif b/lib/os-vif
new file mode 100644
index 0000000000..865645c0d5
--- /dev/null
+++ b/lib/os-vif
@@ -0,0 +1,29 @@
+#!/bin/bash
+
+# support vsctl or native.
+# until bug #1929446 is resolved we override the os-vif default
+# and fall back to the legacy "vsctl" driver.
+OS_VIF_OVS_OVSDB_INTERFACE=${OS_VIF_OVS_OVSDB_INTERFACE:="vsctl"}
+
+function is_ml2_ovs {
+    if [[ "${Q_AGENT}" == "openvswitch" ]]; then
+        echo "True"
+    fi
+    echo "False"
+}
+
+# This should be true for any ml2/ovs job but should be set to false for
+# all other ovs based jobs e.g. ml2/ovn
+OS_VIF_OVS_ISOLATE_VIF=${OS_VIF_OVS_ISOLATE_VIF:=$(is_ml2_ovs)}
+OS_VIF_OVS_ISOLATE_VIF=$(trueorfalse False OS_VIF_OVS_ISOLATE_VIF)
+
+function configure_os_vif {
+    if [[ -e ${NOVA_CONF} ]]; then
+        iniset ${NOVA_CONF} os_vif_ovs ovsdb_interface ${OS_VIF_OVS_OVSDB_INTERFACE}
+        iniset ${NOVA_CONF} os_vif_ovs isolate_vif ${OS_VIF_OVS_ISOLATE_VIF}
+    fi
+    if [[ -e ${NEUTRON_CONF} ]]; then
+        iniset ${NEUTRON_CONF} os_vif_ovs ovsdb_interface ${OS_VIF_OVS_OVSDB_INTERFACE}
+        iniset ${NEUTRON_CONF} os_vif_ovs isolate_vif ${OS_VIF_OVS_ISOLATE_VIF}
+    fi
+}
diff --git a/stack.sh b/stack.sh
index 6858ab8c42..44f1c8fa01 100755
--- a/stack.sh
+++ b/stack.sh
@@ -597,6 +597,7 @@ source $TOP_DIR/lib/ldap
 source $TOP_DIR/lib/dstat
 source $TOP_DIR/lib/tcpdump
 source $TOP_DIR/lib/etcd3
+source $TOP_DIR/lib/os-vif
 
 # Extras Source
 # --------------
@@ -1159,6 +1160,11 @@ if is_service_enabled q-dhcp; then
     sudo sysctl -w net.ipv4.ip_forward=1
 fi
 
+# os-vif
+# ------
+if is_service_enabled nova neutron; then
+    configure_os_vif
+fi
 
 # Storage Service
 # ---------------

From 7befae663c6aa99343cb2c90e74ee2e3bc676559 Mon Sep 17 00:00:00 2001
From: Gregory Thiemonge <gthiemon@redhat.com>
Date: Sat, 19 Jun 2021 13:24:00 +0200
Subject: [PATCH 1901/2409] Delay horizon startup

Move the 'Starting Horizon' task after the end of the wait for
create_flavors.
The start_horizon function restarts the httpd server, the openstack
services are unavailable during a short period of time, so the
"openstack flavor create" calls might fail randomly.

Closes-Bug: #1932580
Change-Id: I32ee7457586e3de8ba4dfce3b1a12025f9776542
---
 stack.sh | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/stack.sh b/stack.sh
index 6858ab8c42..ef1ad3d26a 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1341,6 +1341,7 @@ if is_service_enabled $DATABASE_BACKENDS && is_service_enabled glance; then
     done
 fi
 
+async_wait create_flavors
 
 if is_service_enabled horizon; then
     echo_summary "Starting Horizon"
@@ -1348,8 +1349,6 @@ if is_service_enabled horizon; then
     start_horizon
 fi
 
-async_wait create_flavors
-
 
 # Create account rc files
 # =======================

From a5d52831dc4d357906f5514943e17ab535e9e578 Mon Sep 17 00:00:00 2001
From: Gregory Thiemonge <gthiemon@redhat.com>
Date: Fri, 18 Jun 2021 13:53:21 +0200
Subject: [PATCH 1902/2409] Fix updating setuptools in Centos

In RHEL-based distributions, updating setuptools using pip removes the
files from the python3-setuptools RPM. It breaks some tools such as
semanage (which is used by diskimage-builder) that use the -s flag of
the python interpreter (don't import modules from /usr/local).
This commit reinstalls python3-setuptools to fix those applications.

Change-Id: Ib44857e83f75acf37823fae912960a801c83cf7f
---
 tools/fixup_stuff.sh | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index 19219435ad..060abb1605 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -106,6 +106,16 @@ function fixup_fedora {
     # overwriting works.  So this hacks around those packages that
     # have been dragged in by some other system dependency
     sudo rm -rf /usr/lib64/python3*/site-packages/PyYAML-*.egg-info
+
+    # After updating setuptools based on the requirements, the files from the
+    # python3-setuptools RPM are deleted, it breaks some tools such as semanage
+    # (used in diskimage-builder) that use the -s flag of the python
+    # interpreter, enforcing the use of the packages from /usr/lib.
+    # Importing setuptools/pkg_resources in a such environment fails.
+    # Enforce the package re-installation to fix those applications.
+    if is_package_installed python3-setuptools; then
+        sudo dnf reinstall -y python3-setuptools
+    fi
 }
 
 function fixup_suse {

From 5c9affdd9a2baff2166146f4743fe75009b32eab Mon Sep 17 00:00:00 2001
From: Julia Kreger <juliaashleykreger@gmail.com>
Date: Fri, 12 Mar 2021 11:19:52 -0800
Subject: [PATCH 1903/2409] Use specific credentials for tempest plugin setup

The tempest plugin expects the classic environment variables
to be present for credentials to access the cloud, but this is
wrong in cases where we're trying to setup system
scoped services and need to remove the environment variables
that was being used.

Instead, change the plugin to use the os-cloud entry definitions,
and specifically in this case devstack-admin which makes sense
until we begin to start to make tempest itself scope aware.

We likely will want to change the environment variables from being
registered in devstack at some point and completely shift towards
passing an-os-cloud parameter, but that is outside the scope of
this change as doing so will likely break all plugins.

Change-Id: I8d4ec68f116eea07bc7346f939e134fa2e655eac
---
 lib/tempest | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index d835c68d4a..545018b4a4 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -107,7 +107,7 @@ function remove_disabled_extensions {
 # Takes an image ID parameter as input
 function image_size_in_gib {
     local size
-    size=$(openstack image show $1 -c size -f value)
+    size=$(openstack --os-cloud devstack-admin image show $1 -c size -f value)
     echo $size | python3 -c "import math; print(int(math.ceil(float(int(input()) / 1024.0 ** 3))))"
 }
 
@@ -173,7 +173,7 @@ function configure_tempest {
                 image_uuid_alt="$IMAGE_UUID"
             fi
             images+=($IMAGE_UUID)
-        done < <(openstack image list --property status=active | awk -F'|' '!/^(+--)|ID|aki|ari/ { print $3,$2 }')
+        done < <(openstack --os-cloud devstack-admin image list --property status=active | awk -F'|' '!/^(+--)|ID|aki|ari/ { print $3,$2 }')
 
         case "${#images[*]}" in
             0)
@@ -209,23 +209,23 @@ function configure_tempest {
     local alt_username=${ALT_USERNAME:-alt_demo}
     local alt_project_name=${ALT_TENANT_NAME:-alt_demo}
     local admin_project_id
-    admin_project_id=$(openstack project list | awk "/ admin / { print \$2 }")
+    admin_project_id=$(openstack --os-cloud devstack-admin project list | awk "/ admin / { print \$2 }")
 
     if is_service_enabled nova; then
         # If ``DEFAULT_INSTANCE_TYPE`` is not declared, use the new behavior
         # Tempest creates its own instance types
-        available_flavors=$(nova flavor-list)
+        available_flavors=$(openstack --os-cloud devstack-admin flavor list)
         if  [[ -z "$DEFAULT_INSTANCE_TYPE" ]]; then
             if [[ ! ( $available_flavors =~ 'm1.nano' ) ]]; then
                 # Determine the flavor disk size based on the image size.
                 disk=$(image_size_in_gib $image_uuid)
-                openstack flavor create --id 42 --ram 128 --disk $disk --vcpus 1 --property hw_rng:allowed=True m1.nano
+                openstack --os-cloud devstack-admin flavor create --id 42 --ram 128 --disk $disk --vcpus 1 --property hw_rng:allowed=True m1.nano
             fi
             flavor_ref=42
             if [[ ! ( $available_flavors =~ 'm1.micro' ) ]]; then
                 # Determine the alt flavor disk size based on the alt image size.
                 disk=$(image_size_in_gib $image_uuid_alt)
-                openstack flavor create --id 84 --ram 192 --disk $disk --vcpus 1 --property hw_rng:allowed=True m1.micro
+                openstack --os-cloud devstack-admin flavor create --id 84 --ram 192 --disk $disk --vcpus 1 --property hw_rng:allowed=True m1.micro
             fi
             flavor_ref_alt=84
         else
@@ -251,7 +251,7 @@ function configure_tempest {
             fi
             flavor_ref=${flavors[0]}
             flavor_ref_alt=$flavor_ref
-            flavor_ref_size=$(openstack flavor show --format value --column disk "${flavor_ref}")
+            flavor_ref_size=$(openstack --os-cloud devstack-admin flavor show --format value --column disk "${flavor_ref}")
 
             # Ensure ``flavor_ref`` and ``flavor_ref_alt`` have different values.
             # Some resize instance in tempest tests depends on this.
@@ -264,7 +264,7 @@ function configure_tempest {
                     #               flavor selected as default, e.g. m1.small,
                     #               we need to perform additional check.
                     #
-                    flavor_ref_alt_size=$(openstack flavor show --format value --column disk "${f}")
+                    flavor_ref_alt_size=$(openstack --os-cloud devstack-admin flavor show --format value --column disk "${f}")
                     if [[ "${flavor_ref_alt_size}" -lt "${flavor_ref_size}" ]]; then
                         continue
                     fi
@@ -285,10 +285,10 @@ function configure_tempest {
     # If NEUTRON_CREATE_INITIAL_NETWORKS is not true, there is no network created
     # and the public_network_id should not be set.
     if [[ "$NEUTRON_CREATE_INITIAL_NETWORKS" == "True" ]] && is_networking_extension_supported 'external-net'; then
-        public_network_id=$(openstack network show -f value -c id $PUBLIC_NETWORK_NAME)
+        public_network_id=$(openstack --os-cloud devstack-admin network show -f value -c id $PUBLIC_NETWORK_NAME)
         # make sure shared network presence does not confuses the tempest tests
-        openstack network create --share shared
-        openstack subnet create --description shared-subnet --subnet-range ${TEMPEST_SHARED_POOL:-192.168.233.0/24} --network shared shared-subnet
+        openstack --os-cloud devstack-admin network create --share shared
+        openstack --os-cloud devstack-admin subnet create --description shared-subnet --subnet-range ${TEMPEST_SHARED_POOL:-192.168.233.0/24} --network shared shared-subnet
     fi
 
     iniset $TEMPEST_CONFIG DEFAULT use_syslog $SYSLOG

From bf13075632b076d19b22f347aaa52cba7dcb7169 Mon Sep 17 00:00:00 2001
From: Rodolfo Alonso Hernandez <ralonsoh@redhat.com>
Date: Wed, 23 Jun 2021 13:02:57 +0000
Subject: [PATCH 1904/2409] Make explicit the network backend used in the CI
 jobs

All Neutron CI jobs (except for unit, functional and fullstack jobs),
have explicitly defined the network backend used:
- linuxbridge
- ovs
- ovn

That was discussed and approved during the Neutron CI meetings [1].

[1]https://meetings.opendev.org/meetings/neutron_ci/2021/neutron_ci.2021-06-15-15.00.log.html

Depends-On: https://review.opendev.org/c/openstack/neutron/+/797051
Change-Id: Ib14542311e9b1d49829bef54f433b8a04709a9fd
---
 .zuul.yaml | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 3c490ff180..f8435a55e4 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -730,11 +730,11 @@
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
-        - neutron-grenade-multinode:
+        - neutron-ovs-grenade-multinode:
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
-        - neutron-tempest-linuxbridge:
+        - neutron-linuxbridge-tempest:
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
@@ -767,11 +767,11 @@
         - devstack-multinode
         - devstack-unit-tests
         - openstack-tox-bashate
-        - neutron-grenade-multinode:
+        - neutron-ovs-grenade-multinode:
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
-        - neutron-tempest-linuxbridge:
+        - neutron-linuxbridge-tempest:
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
@@ -824,11 +824,11 @@
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
-        - neutron-tempest-dvr:
+        - neutron-ovs-tempest-dvr:
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
-        - neutron-tempest-dvr-ha-multinode-full:
+        - neutron-ovs-tempest-dvr-ha-multinode-full:
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$

From 2175ff31085972911d155144e02fb178cafaa638 Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Fri, 25 Jun 2021 10:59:29 +0100
Subject: [PATCH 1905/2409] zuul: Add /etc/libvirt to log collection

Useful when debugging libvirtd issues such as bug #1912310.

Related-Bug: #1912310
Change-Id: Ic8504bd61316e44215672cc44436a3b9a19e114d
---
 .zuul.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index 3c490ff180..b189849655 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -336,6 +336,7 @@
         /var/log/postgresql: logs
         /var/log/mysql: logs
         /var/log/libvirt: logs
+        /etc/libvirt: logs
         /etc/sudoers: logs
         /etc/sudoers.d: logs
         '{{ stage_dir }}/iptables.txt': logs

From f0bf2bdff12b66eefbb2eae83e919611eb7cc76d Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Tue, 29 Jun 2021 09:18:47 +0100
Subject: [PATCH 1906/2409] libvirt: Stop installing python bindings from pip

As set out in bug #1933096 these bindings are dynamically built against
the version of libvirt present in the environment at build time.

As a result using a pre-built wheel can cause AttributeError's when the
bindings have previously been built elsewhere against an older version
of libvirt installed on the host. This is currently the case in CentOS 8
stream based CI jobs where we try to use 7.4.0 bindings that appear to
be built against libvirt <= 6.10 leading to bug #1933096.

This change seeks to avoid this by installing the bindings from packages
that will always be built against the correct corresponding version of
libvirt.

Change-Id: I76184c17a776c4e1ecaab9549d9d36c8c07c60fa
Closes-Bug: #1933096
---
 lib/nova_plugins/functions-libvirt | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index d3827c30dd..e9ceae4dea 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -58,13 +58,10 @@ EOF
 function install_libvirt {
 
     if is_ubuntu; then
-        install_package qemu-system libvirt-clients libvirt-daemon-system libvirt-dev
+        install_package qemu-system libvirt-clients libvirt-daemon-system libvirt-dev python3-libvirt
         if is_arch "aarch64"; then
             install_package qemu-efi
         fi
-        # uninstall in case the libvirt version changed
-        pip_uninstall libvirt-python
-        pip_install_gr libvirt-python
         #pip_install_gr <there-si-no-guestfs-in-pypi>
     elif is_fedora || is_suse; then
 
@@ -79,14 +76,11 @@ function install_libvirt {
         # as the base system version is too old.  We should have
         # pre-installed these
         install_package qemu-kvm
+        install_package libvirt libvirt-devel python3-libvirt
 
-        install_package libvirt libvirt-devel
         if is_arch "aarch64"; then
             install_package edk2.git-aarch64
         fi
-
-        pip_uninstall libvirt-python
-        pip_install_gr libvirt-python
     fi
 
     if [[ $DEBUG_LIBVIRT_COREDUMPS == True ]]; then

From 1ab63132df6831bdf7ce180cf7923540305dcd02 Mon Sep 17 00:00:00 2001
From: Przemyslaw Szczerbik <przemyslaw.szczerbik@est.tech>
Date: Tue, 6 Jul 2021 14:26:40 +0200
Subject: [PATCH 1907/2409] Allow to install os-resource-classes from git repo

Example local.conf config snippet:

LIBS_FROM_GIT="os-resource-classes"
OS_RESOURCE_CLASSES_REPO="${LOCAL_GIT_BASE}/os-resource-classes"
OS_RESOURCE_CLASSES_BRANCH="dev_branch"

Closes-Bug: #1934784
Change-Id: I972a2a49aa816433152e5cfac4f672c0465d083f
---
 lib/libraries                | 2 ++
 stackrc                      | 4 ++++
 tests/test_libs_from_pypi.sh | 2 +-
 3 files changed, 7 insertions(+), 1 deletion(-)
 mode change 100644 => 100755 lib/libraries
 mode change 100644 => 100755 stackrc

diff --git a/lib/libraries b/lib/libraries
old mode 100644
new mode 100755
index c7aa8151ae..67ff21f41a
--- a/lib/libraries
+++ b/lib/libraries
@@ -59,6 +59,7 @@ GITDIR["tooz"]=$DEST/tooz
 # Non oslo libraries are welcomed below as well, this prevents
 # duplication of this code.
 GITDIR["os-brick"]=$DEST/os-brick
+GITDIR["os-resource-classes"]=$DEST/os-resource-classes
 GITDIR["os-traits"]=$DEST/os-traits
 
 # Support entry points installation of console scripts
@@ -122,6 +123,7 @@ function install_libs {
     #
     # os-traits for nova
     _install_lib_from_source "os-brick"
+    _install_lib_from_source "os-resource-classes"
     _install_lib_from_source "os-traits"
     #
     # python client libraries we might need from git can go here
diff --git a/stackrc b/stackrc
old mode 100644
new mode 100755
index 05016594eb..620b1fc04d
--- a/stackrc
+++ b/stackrc
@@ -548,6 +548,10 @@ GITREPO["neutron-lib"]=${NEUTRON_LIB_REPO:-${GIT_BASE}/openstack/neutron-lib.git
 GITBRANCH["neutron-lib"]=${NEUTRON_LIB_BRANCH:-$TARGET_BRANCH}
 GITDIR["neutron-lib"]=$DEST/neutron-lib
 
+# os-resource-classes library containing a list of standardized resource classes for OpenStack
+GITREPO["os-resource-classes"]=${OS_RESOURCE_CLASSES_REPO=:-${GIT_BASE}/openstack/os-resource-classes.git}
+GITBRANCH["os-resource-classes"]=${OS_RESOURCE_CLASSES_BRANCH:-$TARGET_BRANCH}
+
 # os-traits library for resource provider traits in the placement service
 GITREPO["os-traits"]=${OS_TRAITS_REPO:-${GIT_BASE}/openstack/os-traits.git}
 GITBRANCH["os-traits"]=${OS_TRAITS_BRANCH:-$TARGET_BRANCH}
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index 5b53389073..ce1b34461c 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -44,7 +44,7 @@ ALL_LIBS+=" debtcollector os-brick os-traits automaton futurist oslo.service"
 ALL_LIBS+=" oslo.cache oslo.reports osprofiler cursive"
 ALL_LIBS+=" keystoneauth ironic-lib neutron-lib oslo.privsep"
 ALL_LIBS+=" diskimage-builder os-vif python-brick-cinderclient-ext"
-ALL_LIBS+=" castellan python-barbicanclient ovsdbapp os-ken"
+ALL_LIBS+=" castellan python-barbicanclient ovsdbapp os-ken os-resource-classes"
 
 # Generate the above list with
 # echo ${!GITREPO[@]}

From 6f4eafb823e498a8d5eb344376c41f5bec8a1b04 Mon Sep 17 00:00:00 2001
From: zenkuro <zenkuro@protonmail.com>
Date: Thu, 15 Jul 2021 19:24:28 +0300
Subject: [PATCH 1908/2409] Added AlmaLinux to CentOS 8 family

Change-Id: I9fb6f010842a495c838d468b47dc5081596f41a2
---
 functions-common | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/functions-common b/functions-common
index 11679e4aa3..40567f8e1d 100644
--- a/functions-common
+++ b/functions-common
@@ -391,6 +391,7 @@ function GetDistro {
         DISTRO="sle${os_RELEASE%.*}"
     elif [[ "$os_VENDOR" =~ (Red.*Hat) || \
         "$os_VENDOR" =~ (CentOS) || \
+        "$os_VENDOR" =~ (AlmaLinux) || \
         "$os_VENDOR" =~ (Scientific) || \
         "$os_VENDOR" =~ (OracleServer) || \
         "$os_VENDOR" =~ (Virtuozzo) ]]; then
@@ -451,6 +452,7 @@ function is_fedora {
         [ "$os_VENDOR" = "RedHatEnterpriseServer" ] || \
         [ "$os_VENDOR" = "RedHatEnterprise" ] || \
         [ "$os_VENDOR" = "CentOS" ] || [ "$os_VENDOR" = "CentOSStream" ] || \
+        [ "$os_VENDOR" = "AlmaLinux" ] || \
         [ "$os_VENDOR" = "OracleServer" ] || [ "$os_VENDOR" = "Virtuozzo" ]
 }
 

From 5a642450d6ac94ff1ea2bea3e7ce3887ca79dcc4 Mon Sep 17 00:00:00 2001
From: Julia Kreger <juliaashleykreger@gmail.com>
Date: Mon, 19 Jul 2021 07:01:29 -0700
Subject: [PATCH 1909/2409] Provide override for glance image size limit

The glance image size limitation was added and unfortuantely
does prevent larger images from being uploaded to glance. In the
case of all baremetal testing, this value is realistically smaller
than stock "cloud" images which support booting to baremetal with
often requisite firmware blobs, which forces some images over 1GB
in size.

Adds GLANCE_LIMIT_IMAGE_SIZE_TOTAL which allows users who need
larger images to be able to override the default while still
enabling limits enforcement in their deployment. The default
value is 1000.

Change-Id: Id425aa546f1a5973bae8be9c017782d18f0b4a47
---
 lib/glance | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/lib/glance b/lib/glance
index fd2e0afcc1..b132f37834 100644
--- a/lib/glance
+++ b/lib/glance
@@ -108,6 +108,10 @@ GLANCE_HOSTPORT=${GLANCE_HOSTPORT:-$GLANCE_SERVICE_HOST:$GLANCE_SERVICE_PORT}
 GLANCE_SERVICE_PROTOCOL=${GLANCE_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 GLANCE_UWSGI=$GLANCE_BIN_DIR/glance-wsgi-api
 GLANCE_UWSGI_CONF=$GLANCE_CONF_DIR/glance-uwsgi.ini
+
+# Glance default limit for Devstack
+GLANCE_LIMIT_IMAGE_SIZE_TOTAL=${GLANCE_LIMIT_IMAGE_SIZE_TOTAL:-1000}
+
 # If wsgi mode is uwsgi run glance under uwsgi, else default to eventlet
 # TODO(mtreinish): Remove the eventlet path here and in all the similar
 # conditionals below after the Pike release
@@ -273,11 +277,11 @@ function configure_glance_quotas {
 
     bash -c "unset OS_USERNAME OS_TENANT_NAME OS_PROJECT_NAME;
         openstack --os-cloud devstack-system-admin registered limit create \
-                --service glance --default-limit 1000 --region $REGION_NAME \
-                image_size_total; \
+                --service glance --default-limit $GLANCE_LIMIT_IMAGE_SIZE_TOTAL \
+                --region $REGION_NAME image_size_total; \
         openstack --os-cloud devstack-system-admin registered limit create \
-                --service glance --default-limit 1000 --region $REGION_NAME \
-                image_stage_total; \
+                --service glance --default-limit $GLANCE_LIMIT_IMAGE_SIZE_TOTAL \
+                --region $REGION_NAME image_stage_total; \
         openstack --os-cloud devstack-system-admin registered limit create \
                 --service glance --default-limit 100 --region $REGION_NAME \
                 image_count_total; \

From c8b66ff33e14c8339c8146d3116b9ff672f912ec Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Mon, 19 Jul 2021 11:14:18 -0700
Subject: [PATCH 1910/2409] Add configuration notes about glance limits

Change-Id: I21a43584116f4b719cf99d3942044cbf13fefb9a
---
 doc/source/configuration.rst | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 2d0c894530..67456142de 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -689,6 +689,24 @@ use the v3 API. It is possible to setup keystone without v2 API, by doing:
 
     ENABLE_IDENTITY_V2=False
 
+
+Glance
+++++++
+
+The default image size quota of 1GiB may be too small if larger images
+are to be used. Change the default at setup time with:
+
+::
+
+    GLANCE_LIMIT_IMAGE_SIZE_TOTAL=5000
+
+or at runtime via:
+
+::
+
+    openstack --os-cloud devstack-system-admin registered limit update \
+      --service glance --default-limit 5000 --region RegionOne image_size_total
+
 .. _arch-configuration:
 
 Architectures

From 71bd10e45197a405cd497c8923db7442bde14a95 Mon Sep 17 00:00:00 2001
From: Pavan Kesava Rao <pkesavar@redhat.com>
Date: Mon, 19 Jul 2021 13:33:42 -0400
Subject: [PATCH 1911/2409] Enable tempest tests for hostname sanitization

Starting Wallaby release, nova sanitizes instance hostnames having
freeform characters with dashes. It should be tested in Devstack.

Depends-On: https://review.opendev.org/c/openstack/tempest/+/795699
Change-Id: I54794e58b67620c36e8f2966ec3b62dd24da745b
---
 lib/tempest | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index 4eacfa09ca..095361d4f4 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -419,6 +419,9 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG compute-feature-enabled live_migrate_back_and_forth ${LIVE_MIGRATE_BACK_AND_FORTH:-False}
     iniset $TEMPEST_CONFIG compute-feature-enabled attach_encrypted_volume ${ATTACH_ENCRYPTED_VOLUME_AVAILABLE:-True}
 
+    # Starting Wallaby, nova sanitizes instance hostnames having freeform characters with dashes
+    iniset $TEMPEST_CONFIG compute-feature-enabled hostname_fqdn_sanitization True
+
     if [[ -n "$NOVA_FILTERS" ]]; then
         iniset $TEMPEST_CONFIG compute-feature-enabled scheduler_enabled_filters ${NOVA_FILTERS}
     fi

From 524487728e85388c73ececae3f2eb272321cffc7 Mon Sep 17 00:00:00 2001
From: Marek Tamaskovic <mtamasko@redhat.com>
Date: Wed, 28 Jul 2021 16:54:50 +0200
Subject: [PATCH 1912/2409] Fix opening shell as user 'stack'

The usage of sudo with su is not recommended. It results in incosnistent
environment variables. Instead use just sudo with appropriate arguments.
The argument '-u stack' specifies that the sudo will execute as user 'stack'.
The last argument '-i' will launch an interactive shell.

Closes-Bug: #1938148

Change-Id: I42387660480377cdf9a0b04f190e7e1f21fb354f
---
 doc/source/index.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/index.rst b/doc/source/index.rst
index 9f477ab911..08ce4cb061 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -63,7 +63,7 @@ have sudo privileges:
 .. code-block:: console
 
     $ echo "stack ALL=(ALL) NOPASSWD: ALL" | sudo tee /etc/sudoers.d/stack
-    $ sudo su - stack
+    $ sudo -u stack -i
 
 Download DevStack
 -----------------

From 0456baaee5309431cd1f88ba4a0ceaa7f050b743 Mon Sep 17 00:00:00 2001
From: yatinkarel <ykarel@redhat.com>
Date: Fri, 30 Jul 2021 19:29:57 +0530
Subject: [PATCH 1913/2409] Fix Usage of rdo-release rpm

rdo-release.el8.rpm rpm points to latest RDO release,
so use it for master, for stable releases use corresponding
release rpm.

Change-Id: I508eceb00d7501ffcfac73d7bc2272badb241494
---
 stack.sh | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/stack.sh b/stack.sh
index c439a7217f..e3d67f571f 100755
--- a/stack.sh
+++ b/stack.sh
@@ -300,10 +300,14 @@ function _install_epel {
 }
 
 function _install_rdo {
-    # NOTE(ianw) 2020-04-30 : when we have future branches, we
-    # probably want to install the relevant branch RDO release as
-    # well.  But for now it's all master.
-    sudo dnf -y install https://rdoproject.org/repos/rdo-release.el8.rpm
+    if [[ "$TARGET_BRANCH" == "master" ]]; then
+        # rdo-release.el8.rpm points to latest RDO release, use that for master
+        sudo dnf -y install https://rdoproject.org/repos/rdo-release.el8.rpm
+    else
+        # For stable branches use corresponding release rpm
+        rdo_release=$(echo $TARGET_BRANCH | sed "s|stable/||g")
+        sudo dnf -y install https://rdoproject.org/repos/openstack-${rdo_release}/rdo-release-${rdo_release}.el8.rpm
+    fi
     sudo dnf -y update
 }
 

From ba68a49598309c5f6c5e4a0ec9d2b13b8229eee0 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Sat, 31 Jul 2021 06:13:46 +0000
Subject: [PATCH 1914/2409] Updated from generate-devstack-plugins-list

Change-Id: I062b9a121c79650973c8d8d975e1c723d5798777
---
 doc/source/plugin-registry.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 691fffa846..490132e0d7 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -98,6 +98,7 @@ openstack/shade                          `https://opendev.org/openstack/shade <h
 openstack/solum                          `https://opendev.org/openstack/solum <https://opendev.org/openstack/solum>`__
 openstack/storlets                       `https://opendev.org/openstack/storlets <https://opendev.org/openstack/storlets>`__
 openstack/tacker                         `https://opendev.org/openstack/tacker <https://opendev.org/openstack/tacker>`__
+openstack/tap-as-a-service               `https://opendev.org/openstack/tap-as-a-service <https://opendev.org/openstack/tap-as-a-service>`__
 openstack/telemetry-tempest-plugin       `https://opendev.org/openstack/telemetry-tempest-plugin <https://opendev.org/openstack/telemetry-tempest-plugin>`__
 openstack/trove                          `https://opendev.org/openstack/trove <https://opendev.org/openstack/trove>`__
 openstack/trove-dashboard                `https://opendev.org/openstack/trove-dashboard <https://opendev.org/openstack/trove-dashboard>`__
@@ -179,7 +180,6 @@ x/rsd-virt-for-nova                      `https://opendev.org/x/rsd-virt-for-nov
 x/scalpels                               `https://opendev.org/x/scalpels <https://opendev.org/x/scalpels>`__
 x/slogging                               `https://opendev.org/x/slogging <https://opendev.org/x/slogging>`__
 x/stackube                               `https://opendev.org/x/stackube <https://opendev.org/x/stackube>`__
-x/tap-as-a-service                       `https://opendev.org/x/tap-as-a-service <https://opendev.org/x/tap-as-a-service>`__
 x/tap-as-a-service-dashboard             `https://opendev.org/x/tap-as-a-service-dashboard <https://opendev.org/x/tap-as-a-service-dashboard>`__
 x/tatu                                   `https://opendev.org/x/tatu <https://opendev.org/x/tatu>`__
 x/trio2o                                 `https://opendev.org/x/trio2o <https://opendev.org/x/trio2o>`__

From f44aa0c55a81e24a8ad321c0c741939e86705e09 Mon Sep 17 00:00:00 2001
From: Brian Rosmaita <rosmaita.fossdev@gmail.com>
Date: Wed, 4 Aug 2021 18:27:48 -0400
Subject: [PATCH 1915/2409] Allow cinder default quotas configuration

The default cinder quotas for volumes, backups, or snapshots may
be too low for highly concurrent testing, so make these configurable
in devstack.

Change-Id: Ie3cf3239b48f9905f5760ad0166eea954ecf5eed
---
 doc/source/configuration.rst | 6 ++++++
 lib/cinder                   | 5 +++++
 2 files changed, 11 insertions(+)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 67456142de..8244525075 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -642,6 +642,12 @@ with ``VOLUME_BACKING_FILE_SIZE``.
   VOLUME_NAME_PREFIX="volume-"
   VOLUME_BACKING_FILE_SIZE=24G
 
+When running highly concurrent tests, the default per-project quotas
+for volumes, backups, or snapshots may be too small.  These can be
+adjusted by setting ``CINDER_QUOTA_VOLUMES``, ``CINDER_QUOTA_BACKUPS``,
+or ``CINDER_QUOTA_SNAPSHOTS`` to the desired value.  (The default for
+each is 10.)
+
 
 Keystone
 ~~~~~~~~
diff --git a/lib/cinder b/lib/cinder
index 7f2f29f892..9235428335 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -267,6 +267,11 @@ function configure_cinder {
     iniset $CINDER_CONF key_manager backend cinder.keymgr.conf_key_mgr.ConfKeyManager
     iniset $CINDER_CONF key_manager fixed_key $(openssl rand -hex 16)
 
+    # set default quotas
+    iniset $CINDER_CONF DEFAULT quota_volumes ${CINDER_QUOTA_VOLUMES:-10}
+    iniset $CINDER_CONF DEFAULT quota_backups ${CINDER_QUOTA_BACKUPS:-10}
+    iniset $CINDER_CONF DEFAULT quota_snapshots ${CINDER_QUOTA_SNAPSHOTS:-10}
+
     # Avoid RPC timeouts in slow CI and test environments by doubling the
     # default response timeout set by RPC clients. See bug #1873234 for more
     # details and example failures.

From ac1b723c20fb67aaecd43cd08c6eee88c5f339f2 Mon Sep 17 00:00:00 2001
From: Roman Dobosz <gryf73@gmail.com>
Date: Fri, 6 Aug 2021 12:52:01 +0200
Subject: [PATCH 1916/2409] Fix displaying usage for make_cert.sh

Now, if no arguments are passed to make_cert.sh script, it will fail on:

  tools/make_cert.sh: line 30: [: missing `]'

and might go on with generating certs depending on the bash settings.
It is fixed within this patch.

Change-Id: I62bf9c972ebd1644da622439e05114f245f20809
---
 tools/make_cert.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/tools/make_cert.sh b/tools/make_cert.sh
index e91464fc0f..0212d0033a 100755
--- a/tools/make_cert.sh
+++ b/tools/make_cert.sh
@@ -27,7 +27,7 @@ function usage {
 }
 
 CN=$1
-if [ -z "$CN" ]]; then
+if [ -z "$CN" ]; then
     usage
 fi
 ORG_UNIT_NAME=${2:-$ORG_UNIT_NAME}
@@ -52,5 +52,5 @@ init_CA
 make_cert $INT_CA_DIR $DEVSTACK_CERT_NAME $DEVSTACK_HOSTNAME
 
 # Create a cert bundle
-cat $INT_CA_DIR/private/$DEVSTACK_CERT_NAME.key $INT_CA_DIR/$DEVSTACK_CERT_NAME.crt $INT_CA_DIR/cacert.pem >$DEVSTACK_CERT
-
+cat $INT_CA_DIR/private/$DEVSTACK_CERT_NAME.key \
+    $INT_CA_DIR/$DEVSTACK_CERT_NAME.crt $INT_CA_DIR/cacert.pem >$DEVSTACK_CERT

From 6b9a5646225a766f6240e2a1a93a92b82e088aa0 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Wed, 28 Jul 2021 11:19:57 +1000
Subject: [PATCH 1917/2409] Revert "Workaround for new pip 20.3 behavior"

This reverts commit 7a3a7ce876a37376fe0dca7278e41a4f46867daa and
bcd0acf6c0b5d6501e91133c3a937b3fc40f7122 and part of
f1ed7c77c50ac28cb58c9f7ed885c6a3e0a75403 which all cap our pip
installs.

Given the pip ecosystem can often incorporate major changes, tracking
upstream at least generally gives us one problem at a time to solve
rather than trying to handle version jumps when LTS distros update.

The new dependency resolver included some changes that disallow
setting URL's like "file:///path/to/project#egg=project" in
constraints.  Apparently the fact it used to work was an accident of
the requires/constraints mechanism; it does make some sense as the URL
doesn't really have a version-number that the resolver can put in an
ordering graph.

The _setup_package_with_constraints_edit function comment highlights
what this is trying to do

 # Updates the constraints from REQUIREMENTS_DIR to reflect the
 # future installed state of this package. This ensures when we
 # install this package we get the from source version.

In other words; if constraints has "foo==1.2.3" and Zuul has checked
out "foo" for testing, we have to make sure pip doesn't choose version
1.2.3 from pypi.

It seems like removing the entry from upper-requirements.txt is the
important part; adding the URL path to the on-disk version was just
something that seemed to work at the time, but isn't really necessary.
We will install the package in question which will be the latest
version (from Zuul checkout) and without the package in
upper-requirements.txt nothing will try and downgrade it.

Therefore the solution proposed here is to remove the adding of the
URL parts.

This allows us to uncap pip and restore testing with the new
dependency resolver.

Closes-Bug: #1906322
Change-Id: Ib9ba52147199a9d6d0293182d5db50c4a567d677
---
 inc/python           |  7 ++++---
 lib/tempest          |  3 ---
 tools/cap-pip.txt    |  1 -
 tools/fixup_stuff.sh | 15 +++++++++++++++
 tools/install_pip.sh |  9 +--------
 5 files changed, 20 insertions(+), 15 deletions(-)
 delete mode 100644 tools/cap-pip.txt

diff --git a/inc/python b/inc/python
index 8941fd038d..9382d352dc 100644
--- a/inc/python
+++ b/inc/python
@@ -378,12 +378,13 @@ function _setup_package_with_constraints_edit {
     project_dir=$(cd $project_dir && pwd)
 
     if [ -n "$REQUIREMENTS_DIR" ]; then
-        # Constrain this package to this project directory from here on out.
+        # Remove this package from constraints before we install it.
+        # That way, later installs won't "downgrade" the install from
+        # source we are about to do.
         local name
         name=$(awk '/^name.*=/ {print $3}' $project_dir/setup.cfg)
         $REQUIREMENTS_DIR/.venv/bin/edit-constraints \
-            $REQUIREMENTS_DIR/upper-constraints.txt -- $name \
-            "$flags file://$project_dir#egg=$name"
+            $REQUIREMENTS_DIR/upper-constraints.txt -- $name
     fi
 
     setup_package $bindep $project_dir "$flags" $extras
diff --git a/lib/tempest b/lib/tempest
index 3fa7ce0fb2..a1c02ef183 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -718,9 +718,6 @@ function install_tempest {
     set_tempest_venv_constraints $tmp_u_c_m
 
     tox -r --notest -efull
-    # TODO: remove the trailing pip constraint when a proper fix
-    # arrives for bug https://bugs.launchpad.net/devstack/+bug/1906322
-    $TEMPEST_DIR/.tox/tempest/bin/pip install -U -r $RC_DIR/tools/cap-pip.txt
     # NOTE(mtreinish) Respect constraints in the tempest full venv, things that
     # are using a tox job other than full will not be respecting constraints but
     # running pip install -U on tempest requirements
diff --git a/tools/cap-pip.txt b/tools/cap-pip.txt
deleted file mode 100644
index 8ee551b261..0000000000
--- a/tools/cap-pip.txt
+++ /dev/null
@@ -1 +0,0 @@
-pip<20.3
diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index 19219435ad..8a2c337fc4 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -155,8 +155,23 @@ function fixup_ovn_centos {
     yum_install centos-release-openstack-victoria
 }
 
+function fixup_ubuntu {
+    if ! is_ubuntu; then
+        return
+    fi
+
+    # Since pip10, pip will refuse to uninstall files from packages
+    # that were created with distutils (rather than more modern
+    # setuptools).  This is because it technically doesn't have a
+    # manifest of what to remove.  However, in most cases, simply
+    # overwriting works.  So this hacks around those packages that
+    # have been dragged in by some other system dependency
+    sudo rm -rf /usr/lib/python3/dist-packages/PyYAML-*.egg-info
+}
+
 function fixup_all {
     fixup_keystone
+    fixup_ubuntu
     fixup_fedora
     fixup_suse
 }
diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index 9afd2e53c2..0082e9f73c 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -91,9 +91,7 @@ function install_get_pip {
             die $LINENO "Download of get-pip.py failed"
         touch $LOCAL_PIP.downloaded
     fi
-    # TODO: remove the trailing pip constraint when a proper fix
-    # arrives for bug https://bugs.launchpad.net/devstack/+bug/1906322
-    sudo -H -E python${PYTHON3_VERSION} $LOCAL_PIP -c $TOOLS_DIR/cap-pip.txt
+    sudo -H -E python${PYTHON3_VERSION} $LOCAL_PIP
 }
 
 
@@ -130,11 +128,6 @@ if [[ -n $PYPI_ALTERNATIVE_URL ]]; then
     configure_pypi_alternative_url
 fi
 
-# Just use system pkgs on Focal
-if [[ "$DISTRO" == focal ]]; then
-    exit 0
-fi
-
 # Eradicate any and all system packages
 
 # Python in fedora/suse depends on the python-pip package so removing it

From 2df2aa01584fb2a26112c60f0a16869e233cb7ee Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 10 Aug 2021 13:50:08 +1000
Subject: [PATCH 1918/2409] install_pip: don't fail when not installed

On some platforms, "python -m pip" isn't available.  Currently this is
run undconditionally from the "get_versions" function; remove the call.

Change-Id: I91d6c66d055f02fa7b4368593b629933f82d8117
---
 tools/install_pip.sh | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index 0082e9f73c..eb0f6eba48 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -46,15 +46,13 @@ echo "Distro: $DISTRO"
 function get_versions {
     # FIXME(dhellmann): Deal with multiple python versions here? This
     # is just used for reporting, so maybe not?
-    PIP=$(which pip 2>/dev/null || which pip-python 2>/dev/null || true)
+    PIP=$(which pip 2>/dev/null || which pip-python 2>/dev/null || which pip3 2>/dev/null || true)
     if [[ -n $PIP ]]; then
         PIP_VERSION=$($PIP --version | awk '{ print $2}')
         echo "pip: $PIP_VERSION"
     else
         echo "pip: Not Installed"
     fi
-    # Show python3 module version
-    python${PYTHON3_VERSION} -m pip --version
 }
 
 

From 26bd94b45efb63683072006e4281dd34a313d881 Mon Sep 17 00:00:00 2001
From: Ghanshyam <gmann@ghanshyammann.com>
Date: Tue, 10 Aug 2021 14:49:54 +0000
Subject: [PATCH 1919/2409] Revert "Add enforce_scope setting support for
 keystone"

This reverts commit 9dc2b88eb42a5f98f43bc8ad3dfa3962a4d44d74.

Reason for revert: Devstack creation/setup the things are not yet moved to scope tokens so we need to wait for that first and then do the scope check enable globally.

Change-Id: If0368aca39c1325bf90abd23831118b89e746222
---
 lib/keystone | 11 -----------
 lib/tempest  |  9 ---------
 2 files changed, 20 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index e282db0bfa..66e867ca68 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -134,12 +134,6 @@ KEYSTONE_PASSWORD_HASH_ROUNDS=${KEYSTONE_PASSWORD_HASH_ROUNDS:-4}
 # Cache settings
 KEYSTONE_ENABLE_CACHE=${KEYSTONE_ENABLE_CACHE:-True}
 
-# Flag to set the oslo_policy.enforce_scope. This is used to switch
-# the Identity API policies to start checking the scope of token. By Default,
-# this flag is False.
-# For more detail: https://docs.openstack.org/oslo.policy/latest/configuration/index.html#oslo_policy.enforce_scope
-KEYSTONE_ENFORCE_SCOPE=$(trueorfalse False KEYSTONE_ENFORCE_SCOPE)
-
 # Functions
 # ---------
 
@@ -287,11 +281,6 @@ function configure_keystone {
         iniset $KEYSTONE_CONF security_compliance lockout_duration $KEYSTONE_LOCKOUT_DURATION
         iniset $KEYSTONE_CONF security_compliance unique_last_password_count $KEYSTONE_UNIQUE_LAST_PASSWORD_COUNT
     fi
-    if [[ "$KEYSTONE_ENFORCE_SCOPE" == True ]] ; then
-        iniset $KEYSTONE_CONF oslo_policy enforce_scope true
-        iniset $KEYSTONE_CONF oslo_policy enforce_new_defaults true
-        iniset $KEYSTONE_CONF oslo_policy policy_file policy.yaml
-    fi
 }
 
 # create_keystone_accounts() - Sets up common required keystone accounts
diff --git a/lib/tempest b/lib/tempest
index 3fa7ce0fb2..d39fa1c52b 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -600,15 +600,6 @@ function configure_tempest {
         fi
     done
 
-    # ``enforce_scope``
-    # If services enable the enforce_scope for their policy
-    # we need to enable the same on Tempest side so that
-    # test can be run with scoped token.
-    if [[ "$KEYSTONE_ENFORCE_SCOPE" == True ]] ; then
-        iniset $TEMPEST_CONFIG enforce_scope keystone true
-        iniset $TEMPEST_CONFIG auth admin_system 'all'
-        iniset $TEMPEST_CONFIG auth admin_project_name ''
-    fi
     iniset $TEMPEST_CONFIG enforce_scope glance "$GLANCE_ENFORCE_SCOPE"
 
     iniset $TEMPEST_CONFIG enforce_scope cinder "$CINDER_ENFORCE_SCOPE"

From 00ac547acacc9fef86f9045a979adf523ab7617b Mon Sep 17 00:00:00 2001
From: Abhishek Kekane <akekane@redhat.com>
Date: Mon, 9 Aug 2021 05:54:32 +0000
Subject: [PATCH 1920/2409] Glance remote worker should use own cache directory

Earlier glance remote worker was using same cache directory used by
glance worker. Ideally both should use their own cache directory.

This patch makes provision for the same by setting different path
for image_cache_dir config option.

Change-Id: If2627e9c212fd765b96d925046c04e9cb1001c3d
---
 lib/glance | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/lib/glance b/lib/glance
index cd26d97dc4..6848aa3c1b 100644
--- a/lib/glance
+++ b/lib/glance
@@ -552,6 +552,11 @@ function start_glance_remote_clone {
     iniset $(glance_remote_conf "$GLANCE_API_CONF") os_glance_tasks_store \
            filesystem_store_datadir "${remote_data}/os_glance_tasks_store"
 
+    # Point this worker to use different cache dir
+    mkdir -p "$remote_data/cache"
+    iniset $(glance_remote_conf "$GLANCE_API_CONF") DEFAULT \
+           image_cache_dir "${remote_data}/cache"
+
     # Change our uwsgi to our new port
     sed -ri "s/^(http-socket.*):[0-9]+/\1:$glance_remote_port/" \
         "$glance_remote_uwsgi"

From a20971850afb555ee4b04068a39a67a533b69901 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 10 Aug 2021 14:11:12 +1000
Subject: [PATCH 1921/2409] install_pip: Use packaged pip on Fedora

This uses the python3-pip package for Fedora but maintains the status
quo for existing distributions (i.e. for Suse we run get-pip.py but
don't uninstall, and for everything else we uninstall python3-pip and
run get-pip.py to be running the latest pip).

As noted inline, installing get-pip.py over Fedora 34's package no
longer works, and likely won't ever work again.  Unlike the LTS
distributions, the Fedora pip should be more up-to-date, so I think
it's best we just avoid any package overwrites.

Change-Id: I84129aadfcf585bb150a3daa39616246d3d84bbd
---
 tools/install_pip.sh | 28 ++++++++++++++++++++--------
 1 file changed, 20 insertions(+), 8 deletions(-)

diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index eb0f6eba48..7ecea4e821 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -126,19 +126,31 @@ if [[ -n $PYPI_ALTERNATIVE_URL ]]; then
     configure_pypi_alternative_url
 fi
 
-# Eradicate any and all system packages
-
-# Python in fedora/suse depends on the python-pip package so removing it
-# results in a nonfunctional system. pip on fedora installs to /usr so pip
-# can safely override the system pip for all versions of fedora
-if ! is_fedora  && ! is_suse; then
+if is_fedora && [[ ${DISTRO} == f* ]]; then
+    # get-pip.py will not install over the python3-pip package in
+    # Fedora 34 any more.
+    #  https://bugzilla.redhat.com/show_bug.cgi?id=1988935
+    #  https://github.com/pypa/pip/issues/9904
+    # You can still install using get-pip.py if python3-pip is *not*
+    # installed; this *should* remain separate under /usr/local and not break
+    # if python3-pip is later installed.
+    # For general sanity, we just use the packaged pip.  It should be
+    # recent enough anyway.
+    install_package python3-pip
+elif is_fedora || is_suse; then
+    # Python in suse/centos depends on the python-pip package; because
+    # of the split "system-python" uninstalling python3-pip also
+    # uninstalls the user python3 package which is bad and leaves us
+    # without a python to use.  Just install over.
+    install_get_pip
+else
+    # Remove packaged pip, and install the latest upstream.
     if is_package_installed python3-pip ; then
         uninstall_package python3-pip
     fi
+    install_get_pip
 fi
 
-install_get_pip
-
 set -x
 
 # Note setuptools is part of requirements.txt and we want to make sure

From 156ccbad85f30cd4c9c33d30b612b3151d542f8e Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 10 Aug 2021 14:19:28 +1000
Subject: [PATCH 1922/2409] Add Fedora 34 support

* update the support distro filter

* don't install xinetd which doesn't exist in F34 any more.  I think
  there is probably a bit more to do with swift ring-server but that
  can be a problem for another time.

* remove old F31 workaround

Change-Id:If2f74f146a166b9721540aaf3f1f9fce3030525c
---
 files/rpms/swift | 2 +-
 lib/nova         | 6 ------
 stack.sh         | 2 +-
 3 files changed, 2 insertions(+), 8 deletions(-)

diff --git a/files/rpms/swift b/files/rpms/swift
index 376c6f3df7..18c957c08a 100644
--- a/files/rpms/swift
+++ b/files/rpms/swift
@@ -4,4 +4,4 @@ memcached
 rsync-daemon
 sqlite
 xfsprogs
-xinetd
+xinetd # not:f34
diff --git a/lib/nova b/lib/nova
index 930529a433..de91517add 100644
--- a/lib/nova
+++ b/lib/nova
@@ -298,12 +298,6 @@ function configure_nova {
             fi
         fi
 
-        if is_fedora && [[ $DISTRO =~ f31] ]]; then
-            # For f31 use the rebased 2.1.0 version of the package.
-            sudo dnf copr enable -y lyarwood/iscsi-initiator-utils
-            sudo dnf update -y
-        fi
-
         if [[ ${ISCSID_DEBUG} == "True" ]]; then
             # Install an override that starts iscsid with debugging
             # enabled.
diff --git a/stack.sh b/stack.sh
index c439a7217f..47d6dc718a 100755
--- a/stack.sh
+++ b/stack.sh
@@ -227,7 +227,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-SUPPORTED_DISTROS="focal|f31|f32|opensuse-15.2|opensuse-tumbleweed|rhel8"
+SUPPORTED_DISTROS="focal|f34|opensuse-15.2|opensuse-tumbleweed|rhel8"
 
 if [[ ! ${DISTRO} =~ $SUPPORTED_DISTROS ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"

From 8dac135cb89fa5d27d7af344703db0a20cf550e1 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Wed, 11 Aug 2021 14:56:05 +1000
Subject: [PATCH 1923/2409] Simplify pip install

The uninstall here has been around since
Ibb4b42119dc2e51577c77bbbbffb110863e5324d.  At the time, there might
have been conflicts between packaged and installed pip.  We don't need
it today; get-pip.py keeps itself separate enough in /usr/local on all
platforms.  Thus we can also remove the suse/centos special-casing.

python3-pip is in the RPM list so we don't need to
re-install for Fedora.

Add a note on why we are over-installing pip.

Remove some old setuptools workarounds that are commented out.

Change-Id: Ie3cb81a8ff71cf4b81e23831c380f83b0381de71
---
 stack.sh             | 14 +++++++++++++-
 tools/install_pip.sh | 22 ++--------------------
 2 files changed, 15 insertions(+), 21 deletions(-)

diff --git a/stack.sh b/stack.sh
index 47d6dc718a..1aa96c9d49 100755
--- a/stack.sh
+++ b/stack.sh
@@ -752,7 +752,19 @@ git_clone $REQUIREMENTS_REPO $REQUIREMENTS_DIR $REQUIREMENTS_BRANCH
 echo_summary "Installing package prerequisites"
 source $TOP_DIR/tools/install_prereqs.sh
 
-# Configure an appropriate Python environment
+# Configure an appropriate Python environment.
+#
+# NOTE(ianw) 2021-08-11 : We install the latest pip here because pip
+# is very active and changes are not generally reflected in the LTS
+# distros.  This often involves important things like dependency or
+# conflict resolution, and has often been required because the
+# complicated constraints etc. used by openstack have tickled bugs in
+# distro versions of pip.  We want to find these problems as they
+# happen, rather than years later when we try to update our LTS
+# distro.  Whilst it is clear that global installations of upstream
+# pip are less and less common, with virtualenv's being the general
+# approach now; there are a lot of devstack plugins that assume a
+# global install environment.
 if [[ "$OFFLINE" != "True" ]]; then
     PYPI_ALTERNATIVE_URL=${PYPI_ALTERNATIVE_URL:-""} $TOP_DIR/tools/install_pip.sh
 fi
diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index 7ecea4e821..a80c178f2a 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -111,14 +111,6 @@ function configure_pypi_alternative_url {
 
 }
 
-# Setuptools 8 implements PEP 440, and 8.0.4 adds a warning triggered any time
-# pkg_resources inspects the list of installed Python packages if there are
-# non-compliant version numbers in the egg-info (for example, from distro
-# system packaged Python libraries). This is off by default after 8.2 but can
-# be enabled by uncommenting the lines below.
-#PYTHONWARNINGS=$PYTHONWARNINGS,always::RuntimeWarning:pkg_resources
-#export PYTHONWARNINGS
-
 # Show starting versions
 get_versions
 
@@ -135,19 +127,9 @@ if is_fedora && [[ ${DISTRO} == f* ]]; then
     # installed; this *should* remain separate under /usr/local and not break
     # if python3-pip is later installed.
     # For general sanity, we just use the packaged pip.  It should be
-    # recent enough anyway.
-    install_package python3-pip
-elif is_fedora || is_suse; then
-    # Python in suse/centos depends on the python-pip package; because
-    # of the split "system-python" uninstalling python3-pip also
-    # uninstalls the user python3 package which is bad and leaves us
-    # without a python to use.  Just install over.
-    install_get_pip
+    # recent enough anyway.  This is included via rpms/general
+    continue
 else
-    # Remove packaged pip, and install the latest upstream.
-    if is_package_installed python3-pip ; then
-        uninstall_package python3-pip
-    fi
     install_get_pip
 fi
 

From 6fecfd4fff79620596db45c9d22f8ec63a0d5522 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Wed, 11 Aug 2021 10:32:42 -0500
Subject: [PATCH 1924/2409] Add devstack-enforce-scope job to enable the rbac
 scope checks

keystone has system scope feature implemented since
queens release. Now Devstack also started moving towards the new RBAC.

This commit adds a new job 'devstack-enforce-scope' which enable the
scope checks on service side and see if devstack setting are fine or not.

This job will be expanded to enable the scope checks for the other service
also once they start supporting the system scope.

This will help us to test the scope check setting.

Change-Id: Ie9cd9c7e7cd8fdf8c8930e59ae9d297f86eb9a95
---
 .zuul.yaml | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index 8c275d84dc..517e12bc1c 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -580,6 +580,17 @@
         SERVICE_IP_VERSION: 6
         SERVICE_HOST: ""
 
+- job:
+    name: devstack-enforce-scope
+    parent: devstack
+    description: |
+      This job runs the devstack with scope checks enabled.
+    vars:
+      devstack_localrc:
+        # Keep enabeling the services here to run with system scope
+        CINDER_ENFORCE_SCOPE: true
+        GLANCE_ENFORCE_SCOPE: true
+
 - job:
     name: devstack-multinode
     parent: devstack
@@ -711,6 +722,7 @@
       jobs:
         - devstack
         - devstack-ipv6
+        - devstack-enforce-scope
         - devstack-platform-fedora-latest
         - devstack-platform-centos-8-stream
         - devstack-async
@@ -765,6 +777,7 @@
       jobs:
         - devstack
         - devstack-ipv6
+        - devstack-enforce-scope
         - devstack-multinode
         - devstack-unit-tests
         - openstack-tox-bashate

From 60b5538c337dfa3c8f60fecdc64e671acd1f1cbe Mon Sep 17 00:00:00 2001
From: yatinkarel <ykarel@redhat.com>
Date: Fri, 6 Aug 2021 12:49:33 +0530
Subject: [PATCH 1925/2409] Set swap size to 4G for c8 jobs

Tempest is failing randomly with different reasons
as mentioned in the bug, updating swap size those
issues are not seen.

Before [1] default swap size used to be 8GB but was dropped
to 1G so need to configure it in required job itself.

Did couple of tests in [2] and with 4GB+ swap jobs are
running green. On investigation found that with qemu-5
both Ubuntu and CentOS jobs have memory crunch, currently
Ubuntu jobs are not impacted as they are running with
qemu-4.

[1] https://review.opendev.org/c/openstack/openstack-zuul-jobs/+/750941
[2] https://review.opendev.org/c/openstack/devstack/+/803144

Closes-Bug: #1938914
Change-Id: I57910b5fde5ddf2bd37d93e06c1aff77c6e231e9
---
 .zuul.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index 8c275d84dc..1295fed457 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -599,6 +599,8 @@
     nodeset: devstack-single-node-centos-8-stream
     voting: false
     timeout: 9000
+    vars:
+      configure_swap_size: 4096
 
 - job:
     name: devstack-async

From 26f814921898390eb263f1060fb99cddae1accdc Mon Sep 17 00:00:00 2001
From: Grzegorz Grasza <xek@redhat.com>
Date: Mon, 16 Aug 2021 10:36:03 +0200
Subject: [PATCH 1926/2409] Use MDB backend in Ubuntu

The MDB backend is the default in Ubuntu and specifying
HDB in debconf doesn't change it to HDB.

Closes-Bug: #1939700
Change-Id: If98f7fc8395678365fb73f0c5cd926cef083e470
---
 files/ldap/manager.ldif.in | 2 +-
 lib/ldap                   | 6 +++++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/files/ldap/manager.ldif.in b/files/ldap/manager.ldif.in
index 2f1f1395ee..d3b9be8b6e 100644
--- a/files/ldap/manager.ldif.in
+++ b/files/ldap/manager.ldif.in
@@ -1,4 +1,4 @@
-dn: olcDatabase={${LDAP_OLCDB_NUMBER}}hdb,cn=config
+dn: olcDatabase={${LDAP_OLCDB_NUMBER}}${LDAP_OLCDB_TYPE},cn=config
 changetype: modify
 replace: olcSuffix
 olcSuffix: ${BASE_DN}
diff --git a/lib/ldap b/lib/ldap
index 5a53d0eaee..ea5faa1fe9 100644
--- a/lib/ldap
+++ b/lib/ldap
@@ -33,14 +33,17 @@ LDAP_SERVICE_NAME=slapd
 
 if is_ubuntu; then
     LDAP_OLCDB_NUMBER=1
+    LDAP_OLCDB_TYPE=mdb
     LDAP_ROOTPW_COMMAND=replace
 elif is_fedora; then
     LDAP_OLCDB_NUMBER=2
+    LDAP_OLCDB_TYPE=hdb
     LDAP_ROOTPW_COMMAND=add
 elif is_suse; then
     # SUSE has slappasswd in /usr/sbin/
     PATH=$PATH:/usr/sbin/
     LDAP_OLCDB_NUMBER=1
+    LDAP_OLCDB_TYPE=hdb
     LDAP_ROOTPW_COMMAND=add
     LDAP_SERVICE_NAME=ldap
 fi
@@ -56,6 +59,7 @@ function _ldap_varsubst {
     local slappass=$2
     sed -e "
         s|\${LDAP_OLCDB_NUMBER}|$LDAP_OLCDB_NUMBER|
+        s|\${LDAP_OLCDB_TYPE}|$LDAP_OLCDB_TYPE|
         s|\${SLAPPASS}|$slappass|
         s|\${LDAP_ROOTPW_COMMAND}|$LDAP_ROOTPW_COMMAND|
         s|\${BASE_DC}|$LDAP_BASE_DC|
@@ -157,7 +161,7 @@ function configure_ldap {
     slapd slapd/dump_database_destdir string /var/backups/slapd-VERSION
     slapd slapd/domain string Users
     slapd shared/organization string $LDAP_DOMAIN
-    slapd slapd/backend string HDB
+    slapd slapd/backend string ${LDAP_OLCDB_TYPE^^}
     slapd slapd/purge_database boolean true
     slapd slapd/move_old_database boolean true
     slapd slapd/allow_ldap_v2 boolean false

From ed323805f26e51438fd08d6d51882d758551924c Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Tue, 17 Aug 2021 08:45:02 -0500
Subject: [PATCH 1927/2409] make swift-dsvm-functional job as voting

swift-dsvm-functional job test swift under python3 and
voting on swift gate whihc means this is a stable job now,
let's make this voting to devstack gate too.

Removing swift-dsvm-functional-py3 job as it does not exist anymore
after- https://review.opendev.org/c/openstack/swift/+/731318

swift-dsvm-functional itself is py3 job now.

Change-Id: I58847f74306194eaad132680815101a134fb4022
---
 .zuul.yaml | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 517e12bc1c..772cc7b2d7 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -731,14 +731,7 @@
         - openstack-tox-bashate
         - ironic-tempest-ipa-wholedisk-bios-agent_ipmitool-tinyipa:
             voting: false
-        - swift-dsvm-functional:
-            voting: false
-            irrelevant-files: &dsvm-irrelevant-files
-              - ^.*\.rst$
-              - ^doc/.*$
-        - swift-dsvm-functional-py3:
-            voting: false
-            irrelevant-files: *dsvm-irrelevant-files
+        - swift-dsvm-functional
         - grenade:
             irrelevant-files:
               - ^.*\.rst$
@@ -789,6 +782,7 @@
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
+        - swift-dsvm-functional
         - grenade:
             irrelevant-files:
               - ^.*\.rst$

From 31f0418bad5a9542a38e8200131adf4ace08e01a Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Tue, 17 Aug 2021 08:49:28 -0500
Subject: [PATCH 1928/2409] Make Ironic job as voting

ironic-tempest-ipa-wholedisk-bios-agent_ipmitool-tinyipa
job is voting on Ironic and neutron gate which mean it is
stable enough and make sense to make it voting on devstack gate too.

ironic-tempest-ipa-wholedisk-bios-agent_ipmitool-tinyipa is alias
job of ironic-tempest-bios-ipmi-direct-tinyipa so using the original
job instead of alias
- https://opendev.org/openstack/ironic/src/branch/master/zuul.d/ironic-jobs.yaml#L784

Change-Id: I95c67ad69e6eae6a72d25a851a71b7de85e56fd2
---
 .zuul.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 772cc7b2d7..f98107cb3f 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -729,8 +729,7 @@
         - devstack-multinode
         - devstack-unit-tests
         - openstack-tox-bashate
-        - ironic-tempest-ipa-wholedisk-bios-agent_ipmitool-tinyipa:
-            voting: false
+        - ironic-tempest-bios-ipmi-direct-tinyipa
         - swift-dsvm-functional
         - grenade:
             irrelevant-files:
@@ -782,6 +781,7 @@
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
+        - ironic-tempest-bios-ipmi-direct-tinyipa
         - swift-dsvm-functional
         - grenade:
             irrelevant-files:

From 8b8a4c75b72eb44dd5c11950951cf6e6d9a1d778 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rados=C5=82aw=20Piliszek?= <radoslaw.piliszek@gmail.com>
Date: Wed, 18 Aug 2021 15:00:09 +0000
Subject: [PATCH 1929/2409] Remove libvirt-python from upper-constraints

... when installed from distribution.

This is mostly to fix Ironic's gate as their ecosystem is too
broad and complex to quickly remove libvirt-python from all
possible requirements.txt

More details inline.

See also: https://review.opendev.org/c/openstack/devstack/+/798514
aka f0bf2bdff12b66eefbb2eae83e919611eb7cc76d

Change-Id: Ic44daf15e952bbe3c424984ffb2474261e68008f
---
 lib/nova_plugins/functions-libvirt | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index e9ceae4dea..63882e05fe 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -56,6 +56,17 @@ EOF
 
 # Installs required distro-specific libvirt packages.
 function install_libvirt {
+    # NOTE(yoctozepto): The common consensus [1] is that libvirt-python should
+    # be installed from distro packages. However, various projects might be
+    # trying to ensure it is installed using pip AND use upper-constraints
+    # with that, causing pip to try to upgrade it and to fail.
+    # The following line removes libvirt-python from upper-constraints and
+    # avoids the situation described above. Now only if installed packages
+    # explicitly depend on a newer (or, in general, incompatible) libvirt-python
+    # version, will pip try to reinstall it.
+    # [1] https://review.opendev.org/c/openstack/devstack/+/798514
+    $REQUIREMENTS_DIR/.venv/bin/edit-constraints \
+            $REQUIREMENTS_DIR/upper-constraints.txt -- libvirt-python
 
     if is_ubuntu; then
         install_package qemu-system libvirt-clients libvirt-daemon-system libvirt-dev python3-libvirt

From 1e86a25cc28e34d7f73a4c6ccbbc3fc667598d50 Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Thu, 19 Aug 2021 14:24:28 +0100
Subject: [PATCH 1930/2409] nova: Enable apic removal workaround for bug
 #1939108 when using QEMU

This change enables [workarounds]libvirt_disable_apic when devstack is
deployed using the libvirt virt driver and qemu virt type in an effort
to avoid issues outlined in bug #1939108 caused by the older kernel
currently used in Cirros 0.5.2.

Depends-On: https://review.opendev.org/c/openstack/nova/+/766043
Closes-Bug: #1939108
Change-Id: Ibb6c34133bb1c95ef11cc59d9b12a0f65502c61b
---
 lib/nova | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/lib/nova b/lib/nova
index de91517add..f4f4797b86 100644
--- a/lib/nova
+++ b/lib/nova
@@ -926,6 +926,11 @@ function start_nova_compute {
         iniset $NOVA_CPU_CONF os_vif_ovs ovsdb_connection "tcp:$OVSDB_SERVER_LOCAL_HOST:6640"
     fi
 
+    # Workaround bug #1939108
+    if [[ "$VIRT_DRIVER" == "libvirt" && "$LIBVIRT_TYPE" == "qemu" ]]; then
+        iniset $NOVA_CPU_CONF workarounds libvirt_disable_apic True
+    fi
+
     if [[ "$VIRT_DRIVER" = 'libvirt' ]]; then
         # The group **$LIBVIRT_GROUP** is added to the current user in this script.
         # ``sg`` is used in run_process to execute nova-compute as a member of the

From 14b7fc500367a24ed995d6598738c6f42dfe49ad Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Fri, 20 Aug 2021 06:13:36 +0000
Subject: [PATCH 1931/2409] Updated from generate-devstack-plugins-list

Change-Id: I924cdf727818b33d71fe71ac110f224164c6b453
---
 doc/source/plugin-registry.rst | 1 -
 1 file changed, 1 deletion(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 490132e0d7..4364dd9c72 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -46,7 +46,6 @@ openstack/freezer                        `https://opendev.org/openstack/freezer
 openstack/freezer-api                    `https://opendev.org/openstack/freezer-api <https://opendev.org/openstack/freezer-api>`__
 openstack/freezer-tempest-plugin         `https://opendev.org/openstack/freezer-tempest-plugin <https://opendev.org/openstack/freezer-tempest-plugin>`__
 openstack/freezer-web-ui                 `https://opendev.org/openstack/freezer-web-ui <https://opendev.org/openstack/freezer-web-ui>`__
-openstack/glance                         `https://opendev.org/openstack/glance <https://opendev.org/openstack/glance>`__
 openstack/heat                           `https://opendev.org/openstack/heat <https://opendev.org/openstack/heat>`__
 openstack/heat-dashboard                 `https://opendev.org/openstack/heat-dashboard <https://opendev.org/openstack/heat-dashboard>`__
 openstack/ironic                         `https://opendev.org/openstack/ironic <https://opendev.org/openstack/ironic>`__

From 25f84277eab5291aa0fa8c12ac39a69594611e08 Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <tkajinam@redhat.com>
Date: Sat, 21 Aug 2021 21:38:43 +0900
Subject: [PATCH 1932/2409] swift: Fix the empty gid option in rsyncd.conf

This change fixes the empty value set to the gid option in rsyncd.conf,
which was caused by reference to the invalid USER_GROUP variable, and
ensures the option is set to the group which STACK_USER belongs to.

This also fixes duplicate declaration of the local user_group variable.

Closes-Bug: #1940742
Change-Id: Ifd0a5ef0bc5f3647f43b169df1f7176393971853
---
 lib/swift | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/lib/swift b/lib/swift
index 790fb99442..98852415da 100644
--- a/lib/swift
+++ b/lib/swift
@@ -335,7 +335,6 @@ function configure_swift {
     local node_number
     local swift_node_config
     local swift_log_dir
-    local user_group
 
     # Make sure to kill all swift processes first
     $SWIFT_BIN_DIR/swift-init --run-dir=${SWIFT_DATA_DIR}/run all stop || true
@@ -353,7 +352,7 @@ function configure_swift {
     # partitions (which make more sense when you have a multi-node
     # setup) we configure it with our version of rsync.
     sed -e "
-        s/%GROUP%/${USER_GROUP}/;
+        s/%GROUP%/$(id -g -n ${STACK_USER})/;
         s/%USER%/${STACK_USER}/;
         s,%SWIFT_DATA_DIR%,$SWIFT_DATA_DIR,;
     " $FILES/swift/rsyncd.conf | sudo tee /etc/rsyncd.conf

From b1a89eb80be83fe8c47eeb0431d85a8452e3c70b Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Thu, 26 Aug 2021 21:42:32 +0200
Subject: [PATCH 1933/2409] Configure access to physical network also with
 ML2/OVN backend

Neutron L3 module in Devstack has way to conigure access to physical
network on the node. It can put physical interface to the physical
bridge or, in case when such physical device isn't set, it creates
NAT rule in iptables.

There was missing the same operation for ML2/OVN backend as L3 agent is
not used there at all.

This patch adds the same to be done in both L3 agent and ovn_agent
modules.

Closes-Bug: #1939627
Change-Id: I9e558d1d5d3edbce9e7a025ba3c11267f1579820
---
 lib/neutron-legacy              | 21 +++++++++++++++++++++
 lib/neutron_plugins/ovn_agent   |  1 +
 lib/neutron_plugins/services/l3 | 16 +---------------
 3 files changed, 23 insertions(+), 15 deletions(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 791ff18b10..31968498de 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -663,6 +663,27 @@ function _move_neutron_addresses_route {
     fi
 }
 
+# _configure_public_network_connectivity() - Configures connectivity to the
+# external network using $PUBLIC_INTERFACE or NAT on the single interface
+# machines
+function _configure_public_network_connectivity {
+    # If we've given a PUBLIC_INTERFACE to take over, then we assume
+    # that we can own the whole thing, and privot it into the OVS
+    # bridge. If we are not, we're probably on a single interface
+    # machine, and we just setup NAT so that fixed guests can get out.
+    if [[ -n "$PUBLIC_INTERFACE" ]]; then
+        _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" True False "inet"
+
+        if [[ $(ip -f inet6 a s dev "$PUBLIC_INTERFACE" | grep -c 'global') != 0 ]]; then
+            _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" False False "inet6"
+        fi
+    else
+        for d in $default_v4_route_devs; do
+            sudo iptables -t nat -A POSTROUTING -o $d -s $FLOATING_RANGE -j MASQUERADE
+        done
+    fi
+}
+
 # cleanup_mutnauq() - Remove residual data files, anything left over from previous
 # runs that a clean run would need to clean up
 function cleanup_mutnauq {
diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index cfcb01ee91..1f737fb58b 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -266,6 +266,7 @@ function create_public_bridge {
     # Create the public bridge that OVN will use
     sudo ovs-vsctl --may-exist add-br $PUBLIC_BRIDGE -- set bridge $PUBLIC_BRIDGE protocols=OpenFlow13,OpenFlow15
     sudo ovs-vsctl set open . external-ids:ovn-bridge-mappings=$PHYSICAL_NETWORK:$PUBLIC_BRIDGE
+    _configure_public_network_connectivity
 }
 
 function _disable_libvirt_apparmor {
diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index b6bc02818c..98b96ac06c 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -123,21 +123,7 @@ function _configure_neutron_l3_agent {
 
     neutron_plugin_configure_l3_agent $Q_L3_CONF_FILE
 
-    # If we've given a PUBLIC_INTERFACE to take over, then we assume
-    # that we can own the whole thing, and privot it into the OVS
-    # bridge. If we are not, we're probably on a single interface
-    # machine, and we just setup NAT so that fixed guests can get out.
-    if [[ -n "$PUBLIC_INTERFACE" ]]; then
-        _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" True False "inet"
-
-        if [[ $(ip -f inet6 a s dev "$PUBLIC_INTERFACE" | grep -c 'global') != 0 ]]; then
-            _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" False False "inet6"
-        fi
-    else
-        for d in $default_v4_route_devs; do
-            sudo iptables -t nat -A POSTROUTING -o $d -s $FLOATING_RANGE -j MASQUERADE
-        done
-    fi
+    _configure_public_network_connectivity
 }
 
 # Explicitly set router id in l3 agent configuration

From a38d41ed9222c32eb7058f91b004b2ec16cd19e4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rados=C5=82aw=20Piliszek?= <radoslaw.piliszek@gmail.com>
Date: Wed, 8 Sep 2021 07:51:47 +0000
Subject: [PATCH 1934/2409] Drop dep on libmysqlclient-dev

It was required to build MySQL-python bindings but, for some time,
we test and rely solely on PyMySQL which is pure Python and hence
does not require this dep.

This package is going away as distros move towards MariaDB.

Change-Id: I6004ccf28a23009a0fc07bfc9458b59a927b969a
---
 files/debs/general        | 1 -
 files/debs/neutron-common | 1 -
 files/debs/nova           | 1 -
 3 files changed, 3 deletions(-)

diff --git a/files/debs/general b/files/debs/general
index 7e481b4072..364f3cc6e2 100644
--- a/files/debs/general
+++ b/files/debs/general
@@ -14,7 +14,6 @@ iputils-ping
 libapache2-mod-proxy-uwsgi
 libffi-dev # for pyOpenSSL
 libjpeg-dev # Pillow 3.0.0
-libmysqlclient-dev  # MySQL-python
 libpcre3-dev # for python-pcre
 libpq-dev  # psycopg2
 libssl-dev # for pyOpenSSL
diff --git a/files/debs/neutron-common b/files/debs/neutron-common
index e548396cd7..f6afc5bf55 100644
--- a/files/debs/neutron-common
+++ b/files/debs/neutron-common
@@ -6,7 +6,6 @@ haproxy # to serve as metadata proxy inside router/dhcp namespaces
 iptables
 iputils-arping
 iputils-ping
-libmysqlclient-dev
 mysql-server #NOPRIME
 postgresql-server-dev-all
 python3-mysqldb
diff --git a/files/debs/nova b/files/debs/nova
index e19441453b..0194f00f2c 100644
--- a/files/debs/nova
+++ b/files/debs/nova
@@ -8,7 +8,6 @@ iptables
 iputils-arping
 kpartx
 libjs-jquery-tablesorter # Needed for coverage html reports
-libmysqlclient-dev
 libvirt-clients # NOPRIME
 libvirt-daemon-system # NOPRIME
 libvirt-dev # NOPRIME

From 6c8bd96f72eb913be5b1de5758b15f828fca5912 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Thu, 9 Sep 2021 06:10:23 +0000
Subject: [PATCH 1935/2409] Updated from generate-devstack-plugins-list

Change-Id: If2ea45a2cc7993a9a80187092f2750496e7c8ab7
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 4364dd9c72..7c8d2b8aac 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -112,6 +112,7 @@ openstack/zaqar-ui                       `https://opendev.org/openstack/zaqar-ui
 openstack/zun                            `https://opendev.org/openstack/zun <https://opendev.org/openstack/zun>`__
 openstack/zun-ui                         `https://opendev.org/openstack/zun-ui <https://opendev.org/openstack/zun-ui>`__
 performa/os-faults                       `https://opendev.org/performa/os-faults <https://opendev.org/performa/os-faults>`__
+skyline/skyline-apiserver                `https://opendev.org/skyline/skyline-apiserver <https://opendev.org/skyline/skyline-apiserver>`__
 starlingx/config                         `https://opendev.org/starlingx/config <https://opendev.org/starlingx/config>`__
 starlingx/fault                          `https://opendev.org/starlingx/fault <https://opendev.org/starlingx/fault>`__
 starlingx/ha                             `https://opendev.org/starlingx/ha <https://opendev.org/starlingx/ha>`__

From c9f3e5bdd76430a7c14b9f02c3f8ba47214037ae Mon Sep 17 00:00:00 2001
From: Brian Haley <haleyb.dev@gmail.com>
Date: Thu, 16 Sep 2021 11:43:03 -0400
Subject: [PATCH 1936/2409] Fix stackrc os-resource-classes typo

Attempting to use LIBS_FROM_GIT="ALL" results in a failure
due to a typo in stackrc for os-resource-classes repo.

  Cloning into '/opt/stack/os-resource-classes'...
  fatal: protocol ':-https' is not supported
  <snip>
  [ERROR] /opt/stack/devstack/functions-common:629 git call failed: [git clone :-https://opendev.org/openstack/os-resource-classes.git /opt/stack/os-resource-classes --branch master]

Remove the extraneous '='.

Change-Id: I21f86324dc15fe808b38e366f7af18c96fd3890c
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 620b1fc04d..16aa93ac94 100755
--- a/stackrc
+++ b/stackrc
@@ -549,7 +549,7 @@ GITBRANCH["neutron-lib"]=${NEUTRON_LIB_BRANCH:-$TARGET_BRANCH}
 GITDIR["neutron-lib"]=$DEST/neutron-lib
 
 # os-resource-classes library containing a list of standardized resource classes for OpenStack
-GITREPO["os-resource-classes"]=${OS_RESOURCE_CLASSES_REPO=:-${GIT_BASE}/openstack/os-resource-classes.git}
+GITREPO["os-resource-classes"]=${OS_RESOURCE_CLASSES_REPO:-${GIT_BASE}/openstack/os-resource-classes.git}
 GITBRANCH["os-resource-classes"]=${OS_RESOURCE_CLASSES_BRANCH:-$TARGET_BRANCH}
 
 # os-traits library for resource provider traits in the placement service

From 8d1bfcacf8ffc73f0aa8c8a8a9e0fee447a1c116 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Fri, 24 Sep 2021 18:01:09 -0500
Subject: [PATCH 1937/2409] Update DEVSTACK_SERIES to yoga

stable/xena branch has been created now and
current master is for yoga.

Change-Id: I0c7809bdac6482bb947f394b0c2535fabb4cf067
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 16aa93ac94..3dc800af2d 100755
--- a/stackrc
+++ b/stackrc
@@ -247,7 +247,7 @@ REQUIREMENTS_DIR=${REQUIREMENTS_DIR:-$DEST/requirements}
 # Setting the variable to 'ALL' will activate the download for all
 # libraries.
 
-DEVSTACK_SERIES="xena"
+DEVSTACK_SERIES="yoga"
 
 ##############
 #

From 65b46a503a720f2438a6dc73c6f4670cdf89442f Mon Sep 17 00:00:00 2001
From: Rajat Dhasmana <rajatdhasmana@gmail.com>
Date: Tue, 28 Sep 2021 03:08:10 -0400
Subject: [PATCH 1938/2409] Remove cinder from service names

In devstack job, cinder is not a valid service name and logs error
in gate[1] so remove it.

2021-09-28 05:44:47.791807 | controller | + functions-common:service_check:1603      :   for service in ${ENABLED_SERVICES//,/ }
2021-09-28 05:44:47.795506 | controller | + functions-common:service_check:1605      :   sudo systemctl is-enabled devstack@cinder.service
2021-09-28 05:44:47.809647 | controller | Failed to get unit file state for devstack@cinder.service: No such file or directory

[1] https://e978bdcfc0235dcd9417-6560bc3b6382c1d289b358872777ca09.ssl.cf1.rackcdn.com/801989/7/check/tempest-integrated-storage/779d1e7/job-output.txt

Change-Id: I7ca105201d82b72c7e56778425d3bce7c76047db
---
 .zuul.yaml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index d1e356f4ea..25cbf923f8 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -524,7 +524,6 @@
         c-bak: true
         c-sch: true
         c-vol: true
-        cinder: true
         # Services we don't need.
         # This section is not really needed, it's for readability.
         horizon: false

From 56e75e4aef3ea42d13b192e805c48357b0071239 Mon Sep 17 00:00:00 2001
From: Jens Harbott <frickler@offenerstapel.de>
Date: Tue, 28 Sep 2021 20:02:34 +0200
Subject: [PATCH 1939/2409] Fix uwsgi config for trailing slashes

The apache mod_proxy documentation[0] says that trailing slashes need to
match for the ProxyPass statement. Since adding a slash to the redirected
url would break things that need to access endpoints like /identity
without anything added, we need to drop the trailing slash for the
target URL. See [1] for the discussion of the CVE fix that changed the
previous behavior.

[0] https://httpd.apache.org/docs/trunk/mod/mod_proxy.html#proxypass
[1] https://bugs.launchpad.net/ubuntu/+source/apache2/+bug/1945274

Depends-On: https://review.opendev.org/c/openstack/devstack/+/811389
Change-Id: Ia6b1a41957833fba87a2e6f048d2483267632385
---
 lib/apache | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/apache b/lib/apache
index 04259ba31f..4bea07dc55 100644
--- a/lib/apache
+++ b/lib/apache
@@ -303,7 +303,7 @@ function write_uwsgi_config {
         apache_conf=$(apache_site_config_for $name)
         iniset "$file" uwsgi socket "$socket"
         iniset "$file" uwsgi chmod-socket 666
-        echo "ProxyPass \"${url}\" \"unix:${socket}|uwsgi://uwsgi-uds-${name}/\" retry=0 " | sudo tee -a $apache_conf
+        echo "ProxyPass \"${url}\" \"unix:${socket}|uwsgi://uwsgi-uds-${name}\" retry=0 " | sudo tee -a $apache_conf
         enable_apache_site $name
         restart_apache_server
     fi

From 982b03c605bc06e0bf9a03ff576995816155c64e Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Thu, 30 Sep 2021 13:08:35 +0100
Subject: [PATCH 1940/2409] zuul: Remove dedicated devstack-async job

I83d56c9363d481bb6d5921f5e1f9b024f136044b switched the default of
DEVSTACK_PARALLEL over to True so this dedicated job is no longer
required as *all* jobs should now be using it.

Change-Id: I0f475ab177c2cd49eeb6be861cdd11581e8e0b97
---
 .zuul.yaml | 12 ------------
 1 file changed, 12 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index d1e356f4ea..ab2f80ae1b 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -613,17 +613,6 @@
     vars:
       configure_swap_size: 4096
 
-- job:
-    name: devstack-async
-    parent: tempest-full-py3
-    description: Async mode enabled
-    voting: false
-    vars:
-      devstack_localrc:
-        DEVSTACK_PARALLEL: True
-      zuul_copy_output:
-        /opt/stack/async: logs
-
 - job:
     name: devstack-no-tls-proxy
     parent: tempest-full-py3
@@ -727,7 +716,6 @@
         - devstack-enforce-scope
         - devstack-platform-fedora-latest
         - devstack-platform-centos-8-stream
-        - devstack-async
         - devstack-multinode
         - devstack-unit-tests
         - openstack-tox-bashate

From c7791301be5e19ec7a84dffbf62c40e805483f43 Mon Sep 17 00:00:00 2001
From: melanie witt <melwittt@gmail.com>
Date: Fri, 1 Oct 2021 17:24:10 +0000
Subject: [PATCH 1941/2409] Enable oslo.limit to be installed from git repo

oslo.limit isn't currently in the list of libraries that can be
installed from a git repo via LIBS_FROM_GIT.

This adds oslo.limit to enable integrated testing against unmerged
oslo.limit changes.

Change-Id: I26cc567fdf4c84014040ae586bbb029b8de7a236
---
 lib/libraries                | 2 ++
 stackrc                      | 4 ++++
 tests/test_libs_from_pypi.sh | 1 +
 3 files changed, 7 insertions(+)

diff --git a/lib/libraries b/lib/libraries
index 67ff21f41a..9ea32304fc 100755
--- a/lib/libraries
+++ b/lib/libraries
@@ -38,6 +38,7 @@ GITDIR["oslo.config"]=$DEST/oslo.config
 GITDIR["oslo.context"]=$DEST/oslo.context
 GITDIR["oslo.db"]=$DEST/oslo.db
 GITDIR["oslo.i18n"]=$DEST/oslo.i18n
+GITDIR["oslo.limit"]=$DEST/oslo.limit
 GITDIR["oslo.log"]=$DEST/oslo.log
 GITDIR["oslo.messaging"]=$DEST/oslo.messaging
 GITDIR["oslo.middleware"]=$DEST/oslo.middleware
@@ -102,6 +103,7 @@ function install_libs {
     _install_lib_from_source "oslo.context"
     _install_lib_from_source "oslo.db"
     _install_lib_from_source "oslo.i18n"
+    _install_lib_from_source "oslo.limit"
     _install_lib_from_source "oslo.log"
     _install_lib_from_source "oslo.messaging"
     _install_lib_from_source "oslo.middleware"
diff --git a/stackrc b/stackrc
index 3dc800af2d..e0d71dfa49 100755
--- a/stackrc
+++ b/stackrc
@@ -415,6 +415,10 @@ GITBRANCH["oslo.db"]=${OSLODB_BRANCH:-$TARGET_BRANCH}
 GITREPO["oslo.i18n"]=${OSLOI18N_REPO:-${GIT_BASE}/openstack/oslo.i18n.git}
 GITBRANCH["oslo.i18n"]=${OSLOI18N_BRANCH:-$TARGET_BRANCH}
 
+# oslo.limit
+GITREPO["oslo.limit"]=${OSLOLIMIT_REPO:-${GIT_BASE}/openstack/oslo.limit.git}
+GITBRANCH["oslo.limit"]=${OSLOLIMIT_BRANCH:-$TARGET_BRANCH}
+
 # oslo.log
 GITREPO["oslo.log"]=${OSLOLOG_REPO:-${GIT_BASE}/openstack/oslo.log.git}
 GITBRANCH["oslo.log"]=${OSLOLOG_BRANCH:-$TARGET_BRANCH}
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index ce1b34461c..839e3a1328 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -45,6 +45,7 @@ ALL_LIBS+=" oslo.cache oslo.reports osprofiler cursive"
 ALL_LIBS+=" keystoneauth ironic-lib neutron-lib oslo.privsep"
 ALL_LIBS+=" diskimage-builder os-vif python-brick-cinderclient-ext"
 ALL_LIBS+=" castellan python-barbicanclient ovsdbapp os-ken os-resource-classes"
+ALL_LIBS+=" oslo.limit"
 
 # Generate the above list with
 # echo ${!GITREPO[@]}

From 959a7c262a65296a404252f8ec2014237196710d Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Sun, 2 May 2021 09:29:15 +0200
Subject: [PATCH 1942/2409] Enable running on Debian Bullseye
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Some adaption in database handling is all that is missing. Also add a
platform job that tests this.

Co-Authored-By: Radosław Piliszek <radoslaw.piliszek@gmail.com>
Change-Id: I6dd3e48444dd415d84df5e7f5c74540847cdd6db
---
 .zuul.yaml          | 54 +++++++++++++++++++++++++++++++++++++++++++++
 lib/databases/mysql |  4 +++-
 stack.sh            |  2 +-
 3 files changed, 58 insertions(+), 2 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index ab2f80ae1b..721897e9e5 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -86,6 +86,16 @@
         nodes:
           - controller
 
+- nodeset:
+    name: devstack-single-node-debian-bullseye
+    nodes:
+      - name: controller
+        label: debian-bullseye
+    groups:
+      - name: tempest
+        nodes:
+          - controller
+
 - nodeset:
     name: openstack-two-node
     nodes:
@@ -613,6 +623,49 @@
     vars:
       configure_swap_size: 4096
 
+- job:
+    name: devstack-platform-debian-bullseye
+    parent: tempest-full-py3
+    description: Debian Bullseye platform test
+    nodeset: devstack-single-node-debian-bullseye
+    voting: false
+    timeout: 9000
+    vars:
+      # NOTE(yoctozepto): With concurrency equal 2, there is a random event
+      # that this job will run out of memory at some point.
+      tempest_concurrency: 1
+      # NOTE(yoctozepto): Debian Bullseye does not yet offer OVN. Switch to OVS
+      # for the time being.
+      devstack_localrc:
+        Q_AGENT: openvswitch
+        Q_ML2_PLUGIN_MECHANISM_DRIVERS: openvswitch
+        Q_ML2_TENANT_NETWORK_TYPE: vxlan
+      devstack_services:
+        # Disable OVN services
+        ovn-northd: false
+        ovn-controller: false
+        ovs-vswitchd: false
+        ovsdb-server: false
+        # Disable Neutron ML2/OVN services
+        q-ovn-metadata-agent: false
+        # Enable Neutron ML2/OVS services
+        q-agt: true
+        q-dhcp: true
+        q-l3: true
+        q-meta: true
+        q-metering: true
+    group-vars:
+      subnode:
+        devstack_services:
+          # Disable OVN services
+          ovn-controller: false
+          ovs-vswitchd: false
+          ovsdb-server: false
+          # Disable Neutron ML2/OVN services
+          q-ovn-metadata-agent: false
+          # Enable Neutron ML2/OVS services
+          q-agt: true
+
 - job:
     name: devstack-no-tls-proxy
     parent: tempest-full-py3
@@ -716,6 +769,7 @@
         - devstack-enforce-scope
         - devstack-platform-fedora-latest
         - devstack-platform-centos-8-stream
+        - devstack-platform-debian-bullseye
         - devstack-multinode
         - devstack-unit-tests
         - openstack-tox-bashate
diff --git a/lib/databases/mysql b/lib/databases/mysql
index d4969d713c..d0fa1199a7 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -25,6 +25,8 @@ if [[ -z "$MYSQL_SERVICE_NAME" ]]; then
         # provide a mysql.service symlink for backwards-compatibility, but
         # let's not rely on that.
         MYSQL_SERVICE_NAME=mariadb
+    elif [[ "$DISTRO" == "bullseye" ]]; then
+        MYSQL_SERVICE_NAME=mariadb
     fi
 fi
 
@@ -105,7 +107,7 @@ function configure_database_mysql {
     # In mariadb e.g. on Ubuntu socket plugin is used for authentication
     # as root so it works only as sudo. To restore old "mysql like" behaviour,
     # we need to change auth plugin for root user
-    if is_ubuntu && [ "$MYSQL_SERVICE_NAME" == "mariadb" ]; then
+    if is_ubuntu && [[ "$DISTRO" != "bullseye" ]] && [ "$MYSQL_SERVICE_NAME" == "mariadb" ]; then
         sudo mysql $cmd_args -e "UPDATE mysql.user SET plugin='' WHERE user='$DATABASE_USER' AND host='localhost';"
         sudo mysql $cmd_args -e "FLUSH PRIVILEGES;"
     fi
diff --git a/stack.sh b/stack.sh
index 48f61fb3af..8a8e3ea6be 100755
--- a/stack.sh
+++ b/stack.sh
@@ -227,7 +227,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-SUPPORTED_DISTROS="focal|f34|opensuse-15.2|opensuse-tumbleweed|rhel8"
+SUPPORTED_DISTROS="bullseye|focal|f34|opensuse-15.2|opensuse-tumbleweed|rhel8"
 
 if [[ ! ${DISTRO} =~ $SUPPORTED_DISTROS ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"

From 714826d1a27085ba2384ca495c876588d77f0d27 Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Mon, 4 Oct 2021 18:07:17 +0100
Subject: [PATCH 1943/2409] nova: Ensure each compute uses a unique iSCSI
 initiator

The current initiator name embedded in our CI images is not unique at
present and can often cause failures during live migrations with
attached volumes. This change ensures the name is unique by running
iscsi-iname again and overwriting the existing name.

We could potentially do this during the image build process itself but
given that devstack systems are not supposed to be multi-purpose this
should be safe to do during the devstack run.

Closes-Bug: #1945983
Change-Id: I9ed26a17858df96c04be9ae52bf2e33e023869a5
---
 lib/nova | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/nova b/lib/nova
index f4f4797b86..bbb1039199 100644
--- a/lib/nova
+++ b/lib/nova
@@ -298,6 +298,9 @@ function configure_nova {
             fi
         fi
 
+        # Ensure each compute host uses a unique iSCSI initiator
+        echo InitiatorName=$(iscsi-iname) | sudo tee /etc/iscsi/initiatorname.iscsi
+
         if [[ ${ISCSID_DEBUG} == "True" ]]; then
             # Install an override that starts iscsid with debugging
             # enabled.

From bfc79dc98bfe68e22d3a58099bf550eda1a90a67 Mon Sep 17 00:00:00 2001
From: Michal Berger <michallinuxstuff@gmail.com>
Date: Tue, 5 Oct 2021 15:40:20 +0200
Subject: [PATCH 1944/2409] tools: Fix use of continue

continue is not used in a proper context here (outside of loop). Use
null cmd instead to simply fall through the pip installation.

Signed-off-by: Michal Berger <michallinuxstuff@gmail.com>
Change-Id: Iaea2e5c0177b475edf19d08d71933a74debbb5d9
---
 tools/install_pip.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index a80c178f2a..c72dc89a55 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -128,7 +128,7 @@ if is_fedora && [[ ${DISTRO} == f* ]]; then
     # if python3-pip is later installed.
     # For general sanity, we just use the packaged pip.  It should be
     # recent enough anyway.  This is included via rpms/general
-    continue
+    : # Simply fall through
 else
     install_get_pip
 fi

From f758b60a4b70261393242b932063d2b6d705594c Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Wed, 6 Oct 2021 12:02:22 +0200
Subject: [PATCH 1945/2409] Rehome functions to enable Neutron's Trunk service
 plugin

Those functions were part of the neutron devstack plugin but we
discussed on the neutron team meeting [1] to move it to the Devstack
repo as it's mature enough now.

[1] https://meetings.opendev.org/meetings/networking/2021/networking.2021-10-05-14.00.log.html#l-156

Change-Id: I35446adad1d8a7fed142d834de20c48b611015a5
---
 lib/neutron-legacy                 | 9 +++++++++
 lib/neutron_plugins/services/trunk | 5 +++++
 2 files changed, 14 insertions(+)
 create mode 100644 lib/neutron_plugins/services/trunk

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 31968498de..7b20a96ed7 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -275,6 +275,10 @@ source $TOP_DIR/lib/neutron_plugins/services/metering
 
 # L3 Service functions
 source $TOP_DIR/lib/neutron_plugins/services/l3
+
+# Additional Neutron service plugins
+source $TOP_DIR/lib/neutron_plugins/services/trunk
+
 # Use security group or not
 if has_neutron_plugin_security_group; then
     Q_USE_SECGROUP=${Q_USE_SECGROUP:-True}
@@ -369,6 +373,11 @@ function configure_mutnauq {
         configure_ovn_plugin
     fi
 
+    # Configure Neutron's advanced services
+    if is_service_enabled q-trunk neutron-trunk; then
+        configure_trunk_extension
+    fi
+
     iniset $NEUTRON_CONF DEFAULT api_workers "$API_WORKERS"
     # devstack is not a tool for running uber scale OpenStack
     # clouds, therefore running without a dedicated RPC worker
diff --git a/lib/neutron_plugins/services/trunk b/lib/neutron_plugins/services/trunk
new file mode 100644
index 0000000000..8e0f6944cf
--- /dev/null
+++ b/lib/neutron_plugins/services/trunk
@@ -0,0 +1,5 @@
+#!/bin/bash
+
+function configure_trunk_extension {
+    neutron_service_plugin_class_add "trunk"
+}

From 61a37bff9a35337f5924ca7cc61c76e42e55d787 Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Fri, 8 Oct 2021 10:59:09 +0200
Subject: [PATCH 1946/2409] Further fixup for Ubuntu cloud images

The official Ubuntu cloud images have some further python pkgs
preinstalled that conflict with our requirements. Allow to
overwrite them.

Signed-off-by: Dr. Jens Harbott <harbott@osism.tech>
Closes-Bug: 1871485
Change-Id: I793c250cae5e7b9bc835b7016d790d1f9ae8a7f3
---
 tools/fixup_stuff.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index 8a2c337fc4..197a12d8f5 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -167,6 +167,8 @@ function fixup_ubuntu {
     # overwriting works.  So this hacks around those packages that
     # have been dragged in by some other system dependency
     sudo rm -rf /usr/lib/python3/dist-packages/PyYAML-*.egg-info
+    sudo rm -rf /usr/lib/python3/dist-packages/pyasn1_modules-*.egg-info
+    sudo rm -rf /usr/lib/python3/dist-packages/simplejson-*.egg-info
 }
 
 function fixup_all {

From b4e683e6b9a442ed9c37407cbc85288fe92aa85c Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Tue, 5 Oct 2021 20:44:57 +0200
Subject: [PATCH 1947/2409] Don't fail if there is no nf_conntrack_proto_gre
 module available

It may be that it is already compiled in the kernel so there is no
need to load kernel module in such case.

Change-Id: Ie1d32e3fd529e13958857cb3ced6710eebde1e4d
---
 lib/neutron_plugins/ovs_source | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/ovs_source b/lib/neutron_plugins/ovs_source
index 294171f18b..08951d175d 100644
--- a/lib/neutron_plugins/ovs_source
+++ b/lib/neutron_plugins/ovs_source
@@ -211,5 +211,5 @@ function remove_ovs_packages {
 
 # load_conntrack_gre_module() - loads nf_conntrack_proto_gre kernel module
 function load_conntrack_gre_module {
-    sudo modprobe nf_conntrack_proto_gre
+    load_module nf_conntrack_proto_gre False
 }

From 84901f563ef6b5d93a00a89f9cdb41a0380d493e Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Fri, 15 Oct 2021 15:04:49 +0200
Subject: [PATCH 1948/2409] Create clouds.yaml early enough

When using glance limits, the create_glance_accounts call needs access
to the devstack-system-admin cloud definition, so we need to create
the clouds.yaml file before that step.

Change-Id: Ie6d807c46b88b16b316aa166870a6a13f2bb346d
Signed-off-by: Dr. Jens Harbott <harbott@osism.tech>
---
 stack.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/stack.sh b/stack.sh
index 48f61fb3af..979867895f 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1090,6 +1090,9 @@ fi
 
 source $TOP_DIR/userrc_early
 
+# Write a clouds.yaml file
+write_clouds_yaml
+
 if is_service_enabled keystone; then
     echo_summary "Starting Keystone"
 
@@ -1118,9 +1121,6 @@ if is_service_enabled keystone; then
 
 fi
 
-# Write a clouds.yaml file
-write_clouds_yaml
-
 # Horizon
 # -------
 

From c027ddd3f895802f5cab37d2cb04162686a3a3cb Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Sat, 16 Oct 2021 06:26:49 +0000
Subject: [PATCH 1949/2409] Updated from generate-devstack-plugins-list

Change-Id: I1abc356970a7f2427bc9683a7e64e54ab52a7651
---
 doc/source/plugin-registry.rst | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 7c8d2b8aac..3edd708d8b 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -24,8 +24,6 @@ official OpenStack projects.
 ======================================== ===
 Plugin Name                              URL
 ======================================== ===
-inspur/venus                             `https://opendev.org/inspur/venus <https://opendev.org/inspur/venus>`__
-inspur/venus-dashboard                   `https://opendev.org/inspur/venus-dashboard <https://opendev.org/inspur/venus-dashboard>`__
 openstack/aodh                           `https://opendev.org/openstack/aodh <https://opendev.org/openstack/aodh>`__
 openstack/barbican                       `https://opendev.org/openstack/barbican <https://opendev.org/openstack/barbican>`__
 openstack/blazar                         `https://opendev.org/openstack/blazar <https://opendev.org/openstack/blazar>`__
@@ -101,6 +99,8 @@ openstack/tap-as-a-service               `https://opendev.org/openstack/tap-as-a
 openstack/telemetry-tempest-plugin       `https://opendev.org/openstack/telemetry-tempest-plugin <https://opendev.org/openstack/telemetry-tempest-plugin>`__
 openstack/trove                          `https://opendev.org/openstack/trove <https://opendev.org/openstack/trove>`__
 openstack/trove-dashboard                `https://opendev.org/openstack/trove-dashboard <https://opendev.org/openstack/trove-dashboard>`__
+openstack/venus                          `https://opendev.org/openstack/venus <https://opendev.org/openstack/venus>`__
+openstack/venus-dashboard                `https://opendev.org/openstack/venus-dashboard <https://opendev.org/openstack/venus-dashboard>`__
 openstack/vitrage                        `https://opendev.org/openstack/vitrage <https://opendev.org/openstack/vitrage>`__
 openstack/vitrage-dashboard              `https://opendev.org/openstack/vitrage-dashboard <https://opendev.org/openstack/vitrage-dashboard>`__
 openstack/vitrage-tempest-plugin         `https://opendev.org/openstack/vitrage-tempest-plugin <https://opendev.org/openstack/vitrage-tempest-plugin>`__

From ee1c614eda833b38ad0d526b4b1e493dfe5968be Mon Sep 17 00:00:00 2001
From: Jens Harbott <frickler@offenerstapel.de>
Date: Sat, 16 Oct 2021 17:33:12 +0200
Subject: [PATCH 1950/2409] Fix use of yaml.load()

The use of this function has been deprecated for a long time[0]. With
PyYAML==6.0 the call is now failing, so replace it with the safe
version.

[0] https://msg.pyyaml.org/load

Signed-off-by: Jens Harbott <frickler@offenerstapel.de>
Change-Id: I7a170262b50a5c80a516095b872d52e1bea5479d
---
 tools/update_clouds_yaml.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/update_clouds_yaml.py b/tools/update_clouds_yaml.py
index 7be995e8f3..74dcdb2a07 100755
--- a/tools/update_clouds_yaml.py
+++ b/tools/update_clouds_yaml.py
@@ -65,7 +65,7 @@ def run(self):
     def _read_clouds(self):
         try:
             with open(self._clouds_path) as clouds_file:
-                self._clouds = yaml.load(clouds_file)
+                self._clouds = yaml.safe_load(clouds_file)
         except IOError:
             # The user doesn't have a clouds.yaml file.
             print("The user clouds.yaml file didn't exist.")

From c2491bac9d3b3f0446e67b4ea960cb88da9aec0e Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Sun, 14 Jun 2020 18:06:23 +0200
Subject: [PATCH 1951/2409] Stop creating a keystone admin site

Keystone no longer has any special functionality hidden behind the admin
site. KEYSTONE_AUTH_URI which used to point to the admin site has long
ago been changed to be a copy of KEYSTONE_SERVICE_URI, which points to
the public site.

Drop all KEYSTONE_AUTH_* variables except KEYSTONE_AUTH_URI which may
still be in use in some plugins.

This also allows to finally drop the fixup_keystone() function.

Change-Id: I549f3cadc27d137e014241cdd47e90267859c848
---
 doc/source/configuration.rst   |  1 -
 files/apache-keystone.template | 25 -------------------------
 lib/keystone                   | 32 ++++----------------------------
 lib/swift                      |  4 ++--
 stack.sh                       |  4 ++--
 tools/fixup_stuff.sh           | 34 ----------------------------------
 6 files changed, 8 insertions(+), 92 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 67456142de..d1144ae9ed 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -666,7 +666,6 @@ In RegionTwo:
 
     disable_service horizon
     KEYSTONE_SERVICE_HOST=<KEYSTONE_IP_ADDRESS_FROM_REGION_ONE>
-    KEYSTONE_AUTH_HOST=<KEYSTONE_IP_ADDRESS_FROM_REGION_ONE>
     REGION_NAME=RegionTwo
     KEYSTONE_REGION_NAME=RegionOne
 
diff --git a/files/apache-keystone.template b/files/apache-keystone.template
index 128436027d..1a353e5f4a 100644
--- a/files/apache-keystone.template
+++ b/files/apache-keystone.template
@@ -1,5 +1,4 @@
 Listen %PUBLICPORT%
-Listen %ADMINPORT%
 LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\" %D(us)" keystone_combined
 
 <Directory %KEYSTONE_BIN%>
@@ -20,20 +19,6 @@ LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\" %D(us)"
     %SSLKEYFILE%
 </VirtualHost>
 
-<VirtualHost *:%ADMINPORT%>
-    WSGIDaemonProcess keystone-admin processes=3 threads=1 user=%USER% display-name=%{GROUP} %VIRTUALENV%
-    WSGIProcessGroup keystone-admin
-    WSGIScriptAlias / %KEYSTONE_BIN%/keystone-wsgi-admin
-    WSGIApplicationGroup %{GLOBAL}
-    WSGIPassAuthorization On
-    ErrorLogFormat "%M"
-    ErrorLog /var/log/%APACHE_NAME%/keystone.log
-    CustomLog /var/log/%APACHE_NAME%/keystone_access.log keystone_combined
-    %SSLENGINE%
-    %SSLCERTFILE%
-    %SSLKEYFILE%
-</VirtualHost>
-
 %SSLLISTEN%<VirtualHost *:443>
 %SSLLISTEN%    %SSLENGINE%
 %SSLLISTEN%    %SSLCERTFILE%
@@ -49,13 +34,3 @@ Alias /identity %KEYSTONE_BIN%/keystone-wsgi-public
     WSGIApplicationGroup %{GLOBAL}
     WSGIPassAuthorization On
 </Location>
-
-Alias /identity_admin %KEYSTONE_BIN%/keystone-wsgi-admin
-<Location /identity_admin>
-    SetHandler wsgi-script
-    Options +ExecCGI
-
-    WSGIProcessGroup keystone-admin
-    WSGIApplicationGroup %{GLOBAL}
-    WSGIPassAuthorization On
-</Location>
diff --git a/lib/keystone b/lib/keystone
index 66e867ca68..096bafb41f 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -50,9 +50,7 @@ fi
 KEYSTONE_CONF_DIR=${KEYSTONE_CONF_DIR:-/etc/keystone}
 KEYSTONE_CONF=$KEYSTONE_CONF_DIR/keystone.conf
 KEYSTONE_PUBLIC_UWSGI_CONF=$KEYSTONE_CONF_DIR/keystone-uwsgi-public.ini
-KEYSTONE_ADMIN_UWSGI_CONF=$KEYSTONE_CONF_DIR/keystone-uwsgi-admin.ini
 KEYSTONE_PUBLIC_UWSGI=$KEYSTONE_BIN_DIR/keystone-wsgi-public
-KEYSTONE_ADMIN_UWSGI=$KEYSTONE_BIN_DIR/keystone-wsgi-admin
 
 # KEYSTONE_DEPLOY defines how keystone is deployed, allowed values:
 # - mod_wsgi : Run keystone under Apache HTTPd mod_wsgi
@@ -81,21 +79,12 @@ KEYSTONE_RESOURCE_BACKEND=${KEYSTONE_RESOURCE_BACKEND:-sql}
 KEYSTONE_TOKEN_FORMAT=${KEYSTONE_TOKEN_FORMAT:-fernet}
 KEYSTONE_TOKEN_FORMAT=$(echo ${KEYSTONE_TOKEN_FORMAT} | tr '[:upper:]' '[:lower:]')
 
-# Set Keystone interface configuration
-KEYSTONE_AUTH_HOST=${KEYSTONE_AUTH_HOST:-$SERVICE_HOST}
-KEYSTONE_AUTH_PORT=${KEYSTONE_AUTH_PORT:-35357}
-KEYSTONE_AUTH_PORT_INT=${KEYSTONE_AUTH_PORT_INT:-35358}
-KEYSTONE_AUTH_PROTOCOL=${KEYSTONE_AUTH_PROTOCOL:-$SERVICE_PROTOCOL}
-
 # Public facing bits
 KEYSTONE_SERVICE_HOST=${KEYSTONE_SERVICE_HOST:-$SERVICE_HOST}
 KEYSTONE_SERVICE_PORT=${KEYSTONE_SERVICE_PORT:-5000}
 KEYSTONE_SERVICE_PORT_INT=${KEYSTONE_SERVICE_PORT_INT:-5001}
 KEYSTONE_SERVICE_PROTOCOL=${KEYSTONE_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 
-# Bind hosts
-KEYSTONE_ADMIN_BIND_HOST=${KEYSTONE_ADMIN_BIND_HOST:-$KEYSTONE_SERVICE_HOST}
-
 # Set the project for service accounts in Keystone
 SERVICE_DOMAIN_NAME=${SERVICE_DOMAIN_NAME:-Default}
 SERVICE_PROJECT_NAME=${SERVICE_PROJECT_NAME:-service}
@@ -106,7 +95,6 @@ SERVICE_TENANT_NAME=${SERVICE_PROJECT_NAME:-service}
 
 # if we are running with SSL use https protocols
 if is_service_enabled tls-proxy; then
-    KEYSTONE_AUTH_PROTOCOL="https"
     KEYSTONE_SERVICE_PROTOCOL="https"
 fi
 
@@ -154,11 +142,8 @@ function cleanup_keystone {
         sudo rm -f $(apache_site_config_for keystone)
     else
         stop_process "keystone"
-        # TODO: remove admin at pike-2
         remove_uwsgi_config "$KEYSTONE_PUBLIC_UWSGI_CONF" "$KEYSTONE_PUBLIC_UWSGI"
-        remove_uwsgi_config "$KEYSTONE_ADMIN_UWSGI_CONF" "$KEYSTONE_ADMIN_UWSGI"
         sudo rm -f $(apache_site_config_for keystone-wsgi-public)
-        sudo rm -f $(apache_site_config_for keystone-wsgi-admin)
     fi
 }
 
@@ -171,12 +156,10 @@ function _config_keystone_apache_wsgi {
     local keystone_certfile=""
     local keystone_keyfile=""
     local keystone_service_port=$KEYSTONE_SERVICE_PORT
-    local keystone_auth_port=$KEYSTONE_AUTH_PORT
     local venv_path=""
 
     if is_service_enabled tls-proxy; then
         keystone_service_port=$KEYSTONE_SERVICE_PORT_INT
-        keystone_auth_port=$KEYSTONE_AUTH_PORT_INT
     fi
     if [[ ${USE_VENV} = True ]]; then
         venv_path="python-path=${PROJECT_VENV["keystone"]}/lib/$(python_version)/site-packages"
@@ -185,7 +168,6 @@ function _config_keystone_apache_wsgi {
     sudo cp $FILES/apache-keystone.template $keystone_apache_conf
     sudo sed -e "
         s|%PUBLICPORT%|$keystone_service_port|g;
-        s|%ADMINPORT%|$keystone_auth_port|g;
         s|%APACHE_NAME%|$APACHE_NAME|g;
         s|%SSLLISTEN%|$keystone_ssl_listen|g;
         s|%SSLENGINE%|$keystone_ssl|g;
@@ -223,12 +205,10 @@ function configure_keystone {
     iniset_rpc_backend keystone $KEYSTONE_CONF oslo_messaging_notifications
 
     local service_port=$KEYSTONE_SERVICE_PORT
-    local auth_port=$KEYSTONE_AUTH_PORT
 
     if is_service_enabled tls-proxy; then
         # Set the service ports for a proxy to take the originals
         service_port=$KEYSTONE_SERVICE_PORT_INT
-        auth_port=$KEYSTONE_AUTH_PORT_INT
     fi
 
     # Override the endpoints advertised by keystone (the public_endpoint and
@@ -238,7 +218,7 @@ function configure_keystone {
     # don't want the port (in the case of putting keystone on a path in
     # apache).
     iniset $KEYSTONE_CONF DEFAULT public_endpoint $KEYSTONE_SERVICE_URI
-    iniset $KEYSTONE_CONF DEFAULT admin_endpoint $KEYSTONE_AUTH_URI
+    iniset $KEYSTONE_CONF DEFAULT admin_endpoint $KEYSTONE_SERVICE_URI
 
     if [[ "$KEYSTONE_TOKEN_FORMAT" != "" ]]; then
         iniset $KEYSTONE_CONF token provider $KEYSTONE_TOKEN_FORMAT
@@ -261,7 +241,6 @@ function configure_keystone {
         _config_keystone_apache_wsgi
     else # uwsgi
         write_uwsgi_config "$KEYSTONE_PUBLIC_UWSGI_CONF" "$KEYSTONE_PUBLIC_UWSGI" "/identity"
-        write_uwsgi_config "$KEYSTONE_ADMIN_UWSGI_CONF" "$KEYSTONE_ADMIN_UWSGI" "/identity_admin"
     fi
 
     iniset $KEYSTONE_CONF DEFAULT max_token_size 16384
@@ -518,7 +497,7 @@ function install_keystone {
 function start_keystone {
     # Get right service port for testing
     local service_port=$KEYSTONE_SERVICE_PORT
-    local auth_protocol=$KEYSTONE_AUTH_PROTOCOL
+    local auth_protocol=$KEYSTONE_SERVICE_PROTOCOL
     if is_service_enabled tls-proxy; then
         service_port=$KEYSTONE_SERVICE_PORT_INT
         auth_protocol="http"
@@ -546,7 +525,6 @@ function start_keystone {
     # Start proxies if enabled
     if is_service_enabled tls-proxy; then
         start_tls_proxy keystone-service '*' $KEYSTONE_SERVICE_PORT $KEYSTONE_SERVICE_HOST $KEYSTONE_SERVICE_PORT_INT
-        start_tls_proxy keystone-auth '*' $KEYSTONE_AUTH_PORT $KEYSTONE_AUTH_HOST $KEYSTONE_AUTH_PORT_INT
     fi
 
     # (re)start memcached to make sure we have a clean memcache.
@@ -569,9 +547,7 @@ function stop_keystone {
 # - ``ADMIN_PASSWORD``
 # - ``IDENTITY_API_VERSION``
 # - ``REGION_NAME``
-# - ``KEYSTONE_SERVICE_PROTOCOL``
-# - ``KEYSTONE_SERVICE_HOST``
-# - ``KEYSTONE_SERVICE_PORT``
+# - ``KEYSTONE_SERVICE_URI``
 function bootstrap_keystone {
     $KEYSTONE_BIN_DIR/keystone-manage bootstrap \
         --bootstrap-username admin \
@@ -580,7 +556,7 @@ function bootstrap_keystone {
         --bootstrap-role-name admin \
         --bootstrap-service-name keystone \
         --bootstrap-region-id "$REGION_NAME" \
-        --bootstrap-admin-url "$KEYSTONE_AUTH_URI" \
+        --bootstrap-admin-url "$KEYSTONE_SERVICE_URI" \
         --bootstrap-public-url "$KEYSTONE_SERVICE_URI"
 }
 
diff --git a/lib/swift b/lib/swift
index 98852415da..b376993150 100644
--- a/lib/swift
+++ b/lib/swift
@@ -430,7 +430,7 @@ function configure_swift {
         swift_pipeline+=" authtoken"
         if is_service_enabled s3api;then
             swift_pipeline+=" s3token"
-            iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:s3token auth_uri ${KEYSTONE_AUTH_URI_V3}
+            iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:s3token auth_uri ${KEYSTONE_SERVICE_URI_V3}
             iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:s3token delay_auth_decision true
         fi
         swift_pipeline+=" keystoneauth"
@@ -521,7 +521,7 @@ function configure_swift {
         local auth_vers
         auth_vers=$(iniget ${testfile} func_test auth_version)
         iniset ${testfile} func_test auth_host ${KEYSTONE_SERVICE_HOST}
-        if [[ "$KEYSTONE_AUTH_PROTOCOL" == "https" ]]; then
+        if [[ "$KEYSTONE_SERVICE_PROTOCOL" == "https" ]]; then
             iniset ${testfile} func_test auth_port 443
         else
             iniset ${testfile} func_test auth_port 80
diff --git a/stack.sh b/stack.sh
index 48f61fb3af..fc26e21627 100755
--- a/stack.sh
+++ b/stack.sh
@@ -876,7 +876,7 @@ fi
 install_keystonemiddleware
 
 if is_service_enabled keystone; then
-    if [ "$KEYSTONE_AUTH_HOST" == "$SERVICE_HOST" ]; then
+    if [ "$KEYSTONE_SERVICE_HOST" == "$SERVICE_HOST" ]; then
         stack_install_service keystone
         configure_keystone
     fi
@@ -1093,7 +1093,7 @@ source $TOP_DIR/userrc_early
 if is_service_enabled keystone; then
     echo_summary "Starting Keystone"
 
-    if [ "$KEYSTONE_AUTH_HOST" == "$SERVICE_HOST" ]; then
+    if [ "$KEYSTONE_SERVICE_HOST" == "$SERVICE_HOST" ]; then
         init_keystone
         start_keystone
         bootstrap_keystone
diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index 71fba2e2a6..fe5dafa994 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -26,39 +26,6 @@ if [[ -z "$TOP_DIR" ]]; then
     FILES=$TOP_DIR/files
 fi
 
-# Keystone Port Reservation
-# -------------------------
-# Reserve and prevent ``KEYSTONE_AUTH_PORT`` and ``KEYSTONE_AUTH_PORT_INT`` from
-# being used as ephemeral ports by the system. The default(s) are 35357 and
-# 35358 which are in the Linux defined ephemeral port range (in disagreement
-# with the IANA ephemeral port range). This is a workaround for bug #1253482
-# where Keystone will try and bind to the port and the port will already be
-# in use as an ephemeral port by another process. This places an explicit
-# exception into the Kernel for the Keystone AUTH ports.
-function fixup_keystone {
-    keystone_ports=${KEYSTONE_AUTH_PORT:-35357},${KEYSTONE_AUTH_PORT_INT:-35358}
-
-    # Only do the reserved ports when available, on some system (like containers)
-    # where it's not exposed we are almost pretty sure these ports would be
-    # exclusive for our DevStack.
-    if sysctl net.ipv4.ip_local_reserved_ports >/dev/null 2>&1; then
-        # Get any currently reserved ports, strip off leading whitespace
-        reserved_ports=$(sysctl net.ipv4.ip_local_reserved_ports | awk -F'=' '{print $2;}' | sed 's/^ //')
-
-        if [[ -z "${reserved_ports}" ]]; then
-            # If there are no currently reserved ports, reserve the keystone ports
-            sudo sysctl -w net.ipv4.ip_local_reserved_ports=${keystone_ports}
-        else
-            # If there are currently reserved ports, keep those and also reserve the
-            # Keystone specific ports. Duplicate reservations are merged into a single
-            # reservation (or range) automatically by the kernel.
-            sudo sysctl -w net.ipv4.ip_local_reserved_ports=${keystone_ports},${reserved_ports}
-        fi
-    else
-        echo_summary "WARNING: unable to reserve keystone ports"
-    fi
-}
-
 # Python Packages
 # ---------------
 
@@ -182,7 +149,6 @@ function fixup_ubuntu {
 }
 
 function fixup_all {
-    fixup_keystone
     fixup_ubuntu
     fixup_fedora
     fixup_suse

From eb37657d8e34e1d0f8ee639c3953a752ba615d8d Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Wed, 24 Feb 2021 10:04:31 +0100
Subject: [PATCH 1952/2409] Make creation of keystone admin endpoint optional

The keystone admin endpoint technically isn't different any longer from
the other keystone endpoints in v3 of the API. However, some
applications like heat are still relying on it to exist.

So we make the creation of the admin endpoint during bootstrap optional
here, with the intention to change the default to False once all jobs
that still need this are modified to explicitly require it.

Change-Id: I7ab12141c558186e397c174c248a613d1810011b
---
 lib/keystone | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/lib/keystone b/lib/keystone
index 096bafb41f..f8b5ccb009 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -122,6 +122,9 @@ KEYSTONE_PASSWORD_HASH_ROUNDS=${KEYSTONE_PASSWORD_HASH_ROUNDS:-4}
 # Cache settings
 KEYSTONE_ENABLE_CACHE=${KEYSTONE_ENABLE_CACHE:-True}
 
+# Whether to create a keystone admin endpoint for legacy applications
+KEYSTONE_ADMIN_ENDPOINT=$(trueorfalse True KEYSTONE_ADMIN_ENDPOINT)
+
 # Functions
 # ---------
 
@@ -556,8 +559,16 @@ function bootstrap_keystone {
         --bootstrap-role-name admin \
         --bootstrap-service-name keystone \
         --bootstrap-region-id "$REGION_NAME" \
-        --bootstrap-admin-url "$KEYSTONE_SERVICE_URI" \
         --bootstrap-public-url "$KEYSTONE_SERVICE_URI"
+    if [ "$KEYSTONE_ADMIN_ENDPOINT" == "True" ]; then
+        openstack endpoint create --region "$REGION_NAME" \
+            --os-username admin \
+            --os-user-domain-id default \
+            --os-password "$ADMIN_PASSWORD" \
+            --os-project-name admin \
+            --os-project-domain-id default \
+            keystone admin "$KEYSTONE_SERVICE_URI"
+    fi
 }
 
 # create_ldap_domain() - Create domain file and initialize domain with a user

From b538b3267cec11f0b345ce101607bbd36ada8f32 Mon Sep 17 00:00:00 2001
From: Jens Harbott <j.harbott@x-ion.de>
Date: Wed, 24 Feb 2021 10:24:03 +0100
Subject: [PATCH 1953/2409] Switch off creating a keystone admin endpoint by
 default

With the depending patch, the endpoint will still be created for
heat tests, so we can turn it off for everyone else.

Depends-On: https://review.opendev.org/c/openstack/openstacksdk/+/777343
Change-Id: I0dc7d6cedd07e942b9f23b26a785b386aff41fbc
---
 lib/keystone | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/keystone b/lib/keystone
index f8b5ccb009..0609abd289 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -123,7 +123,7 @@ KEYSTONE_PASSWORD_HASH_ROUNDS=${KEYSTONE_PASSWORD_HASH_ROUNDS:-4}
 KEYSTONE_ENABLE_CACHE=${KEYSTONE_ENABLE_CACHE:-True}
 
 # Whether to create a keystone admin endpoint for legacy applications
-KEYSTONE_ADMIN_ENDPOINT=$(trueorfalse True KEYSTONE_ADMIN_ENDPOINT)
+KEYSTONE_ADMIN_ENDPOINT=$(trueorfalse False KEYSTONE_ADMIN_ENDPOINT)
 
 # Functions
 # ---------

From 4aa27976ebb2e4a4dc95a20f96e5d8f25b1ac10d Mon Sep 17 00:00:00 2001
From: Tristan Cacqueray <tdecacqu@redhat.com>
Date: Tue, 19 Oct 2021 21:47:27 +0000
Subject: [PATCH 1954/2409] [ci] Remove the implied-branches pragma

This change enables using devstack job with custom branche names.

Change-Id: I95c368f05042a6f8f208988af9a6d89a522a5526
---
 .zuul.yaml | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index b756db3b22..d114053d26 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -1,11 +1,3 @@
-- pragma:
-   # NOTE(gtema): this is required for the changes in SDK feature/r1 branch to
-   # be using devstack
-   # TODO(gtema): delete this once r1 branch is merged into master
-    implied-branches:
-      - master
-      - feature/r1
-
 - nodeset:
     name: openstack-single-node
     nodes:

From e06d954229fc4fca827105f5bb0809a19075d590 Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Thu, 21 Oct 2021 08:15:12 -0700
Subject: [PATCH 1955/2409] Use Nehalem CPU model by default

CentOS/RHEL 9 are being compiled for the x86_64-v2 architecture which is
newer than the qemu default of qemu64. This means that for devstack to
boot these instances we need a newer CPU model. Nehalem is apparently
the oldest model that works for x86_64-v2 and is expected to work on
Intel and AMD cpus with kvm or qemu. Switch devstack to this model by
default.

Note that we cannot use host-passthrough or host-model because we want
to support live migration between devstack deployed nova-compute
instances and even within the CI instances that we get the host CPUs can
differ.

Also, we should run this change against as many clouds as possible to
ensure that the newer model works across all of our clouds. There is
some fear that the virtual CPUs presented to us in some clouds may not
be able to run these newer CPU models.

Change-Id: Ibd6e11b59f3c8655bc60ace7383a08458b2177f2
---
 lib/nova                            | 3 ++-
 lib/nova_plugins/hypervisor-libvirt | 3 +++
 stackrc                             | 3 ++-
 3 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/lib/nova b/lib/nova
index bbb1039199..9aae2c4a9c 100644
--- a/lib/nova
+++ b/lib/nova
@@ -260,7 +260,8 @@ function configure_nova {
                 if [ ! -e /dev/kvm ]; then
                     echo "WARNING: Switching to QEMU"
                     LIBVIRT_TYPE=qemu
-                    LIBVIRT_CPU_MODE=none
+                    LIBVIRT_CPU_MODE=custom
+                    LIBVIRT_CPU_MODEL=Nehalem
                     if which selinuxenabled >/dev/null 2>&1 && selinuxenabled; then
                         # https://bugzilla.redhat.com/show_bug.cgi?id=753589
                         sudo setsebool virt_use_execmem on
diff --git a/lib/nova_plugins/hypervisor-libvirt b/lib/nova_plugins/hypervisor-libvirt
index 321775d324..c1cd132548 100644
--- a/lib/nova_plugins/hypervisor-libvirt
+++ b/lib/nova_plugins/hypervisor-libvirt
@@ -40,6 +40,9 @@ function configure_nova_hypervisor {
     configure_libvirt
     iniset $NOVA_CONF libvirt virt_type "$LIBVIRT_TYPE"
     iniset $NOVA_CONF libvirt cpu_mode "$LIBVIRT_CPU_MODE"
+    if [ "$LIBVIRT_CPU_MODE" == "custom" ] ; then
+        iniset $NOVA_CONF libvirt cpu_model "$LIBVIRT_CPU_MODEL"
+    fi
     # Do not enable USB tablet input devices to avoid QEMU CPU overhead.
     iniset $NOVA_CONF DEFAULT pointer_model "ps2mouse"
     iniset $NOVA_CONF libvirt live_migration_uri "qemu+ssh://$STACK_USER@%s/system"
diff --git a/stackrc b/stackrc
index 3dc800af2d..ebe472c033 100755
--- a/stackrc
+++ b/stackrc
@@ -623,7 +623,8 @@ VIRT_DRIVER=${VIRT_DRIVER:-$DEFAULT_VIRT_DRIVER}
 case "$VIRT_DRIVER" in
     ironic|libvirt)
         LIBVIRT_TYPE=${LIBVIRT_TYPE:-kvm}
-        LIBVIRT_CPU_MODE=${LIBVIRT_CPU_MODE:-none}
+        LIBVIRT_CPU_MODE=${LIBVIRT_CPU_MODE:-custom}
+        LIBVIRT_CPU_MODEL=${LIBVIRT_CPU_MODEL:-Nehalem}
         if [[ "$os_VENDOR" =~ (Debian|Ubuntu) ]]; then
             # The groups change with newer libvirt. Older Ubuntu used
             # 'libvirtd', but now uses libvirt like Debian. Do a quick check

From 7f6d9283b85bb743d3224981c031d331f5e9608a Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Wed, 27 Oct 2021 16:40:30 +0200
Subject: [PATCH 1956/2409] Rehome functions to enable Neutron's placement
 integration

Those functions were part of the neutron devstack plugin but we
discussed it during last PTG [1] and decided to move to the Devstack
repo as plugins which are used by e.g. CI jobs which are defined outside
of the neutron repository.
Placement integration is used e.g. in the tempest-slow job which is
defined in tempest and used by many different OpenStack projects.

[1] https://etherpad.opendev.org/p/neutron-yoga-ptg#L142

Change-Id: Ib86071881f16de1b69c0f9b1b19b6df8b7e66a07
---
 lib/neutron-legacy                     |  4 ++++
 lib/neutron_plugins/services/placement | 21 +++++++++++++++++++++
 2 files changed, 25 insertions(+)
 create mode 100644 lib/neutron_plugins/services/placement

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 7b20a96ed7..b41dfcae42 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -277,6 +277,7 @@ source $TOP_DIR/lib/neutron_plugins/services/metering
 source $TOP_DIR/lib/neutron_plugins/services/l3
 
 # Additional Neutron service plugins
+source $TOP_DIR/lib/neutron_plugins/services/placement
 source $TOP_DIR/lib/neutron_plugins/services/trunk
 
 # Use security group or not
@@ -374,6 +375,9 @@ function configure_mutnauq {
     fi
 
     # Configure Neutron's advanced services
+    if is_service_enabled q-placement neutron-placement; then
+        configure_placement_extension
+    fi
     if is_service_enabled q-trunk neutron-trunk; then
         configure_trunk_extension
     fi
diff --git a/lib/neutron_plugins/services/placement b/lib/neutron_plugins/services/placement
new file mode 100644
index 0000000000..3ec185bae6
--- /dev/null
+++ b/lib/neutron_plugins/services/placement
@@ -0,0 +1,21 @@
+#!/bin/bash
+
+function configure_placement_service_plugin {
+    neutron_service_plugin_class_add "placement"
+}
+
+function configure_placement_neutron {
+    iniset $NEUTRON_CONF placement auth_type "$NEUTRON_PLACEMENT_AUTH_TYPE"
+    iniset $NEUTRON_CONF placement auth_url "$KEYSTONE_SERVICE_URI"
+    iniset $NEUTRON_CONF placement username "$NEUTRON_PLACEMENT_USERNAME"
+    iniset $NEUTRON_CONF placement password "$SERVICE_PASSWORD"
+    iniset $NEUTRON_CONF placement user_domain_name "$SERVICE_DOMAIN_NAME"
+    iniset $NEUTRON_CONF placement project_name "$SERVICE_TENANT_NAME"
+    iniset $NEUTRON_CONF placement project_domain_name "$SERVICE_DOMAIN_NAME"
+    iniset $NEUTRON_CONF placement region_name "$REGION_NAME"
+}
+
+function configure_placement_extension {
+    configure_placement_service_plugin
+    configure_placement_neutron
+}

From 325792d9b9238f9a8b8b493ba50572add99b9d82 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Fri, 15 Oct 2021 15:55:54 -0500
Subject: [PATCH 1957/2409] Clarify error message for ERROR_ON_CLONE=True

If ERROR_ON_CLONE is set to True which is case for
all the devstack based job, devstack does not clone the
repo instead raise error. From current error message, it
is difficult to know that ERROR_ON_CLONE is True until we
traceback the code or check devstack-base job set ERROR_ON_CLONE
to True.

Current error message is like:
-------
+ functions-common:git_clone:560           :   echo
'The /opt/stack/oslo.limit project was not found; if this is a gate job, add'
  The /opt/stack/oslo.limit project was not found; if this is a gate job, add
+ functions-common:git_clone:561           :   echo 'the project to the
 $PROJECTS variable in the job definition.'
the project to the $PROJECTS variable in the job definition.
+ functions-common:git_clone:562           :   die 562 'Cloning not
  allowed in this configuration'
--------

Adding ERROR_ON_CLONE info in error message will help to
know the reason of devstack not cloning the repo.

Change-Id: I9e9852f046fefb299b4ef4446323e9c86437212f
---
 functions-common | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/functions-common b/functions-common
index 11679e4aa3..7a628db737 100644
--- a/functions-common
+++ b/functions-common
@@ -547,7 +547,7 @@ function git_clone {
             if [[ "$ERROR_ON_CLONE" = "True" ]]; then
                 echo "The $git_dest project was not found; if this is a gate job, add"
                 echo "the project to 'required-projects' in the job definition."
-                die $LINENO "Cloning not allowed in this configuration"
+                die $LINENO "ERROR_ON_CLONE is set to True so cloning not allowed in this configuration"
             fi
             git_timed clone $git_clone_flags $git_remote $git_dest
         fi
@@ -559,7 +559,7 @@ function git_clone {
             if [[ "$ERROR_ON_CLONE" = "True" ]]; then
                 echo "The $git_dest project was not found; if this is a gate job, add"
                 echo "the project to the \$PROJECTS variable in the job definition."
-                die $LINENO "Cloning not allowed in this configuration"
+                die $LINENO "ERROR_ON_CLONE is set to True so cloning not allowed in this configuration"
             fi
             # '--branch' can also take tags
             git_timed clone $git_clone_flags $git_remote $git_dest --branch $git_ref

From f8e00b86aee9a8f9646bf5aed2c618843307b963 Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Fri, 29 Oct 2021 14:39:41 +0200
Subject: [PATCH 1958/2409] Run Bullseye with more swap

Since Bullseye like Centos 8 Stream needs more memory due to changed
default settings in newer qemu versions, set the swap size to 4G, which
is the same setting already being used for the CS8 jobs successfully.

Change-Id: I83ea34d6aa647d2ab9d4d78ed354904fce836e68
Signed-off-by: Dr. Jens Harbott <harbott@osism.tech>
---
 .zuul.yaml | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index cbcb8638c4..7a85266eaa 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -630,9 +630,7 @@
     voting: false
     timeout: 9000
     vars:
-      # NOTE(yoctozepto): With concurrency equal 2, there is a random event
-      # that this job will run out of memory at some point.
-      tempest_concurrency: 1
+      configure_swap_size: 4096
       # NOTE(yoctozepto): Debian Bullseye does not yet offer OVN. Switch to OVS
       # for the time being.
       devstack_localrc:

From 021ae0bcc8f67b6fd307aaf3c8ac59ba6cbe23b6 Mon Sep 17 00:00:00 2001
From: Lance Bragstad <lbragstad@gmail.com>
Date: Thu, 11 Mar 2021 15:47:50 +0000
Subject: [PATCH 1959/2409] Update lib/keystone to add more system users

Keystone has supported system-scope since Queens and we already make
sure we create a cloud profile for system-admin in
/etc/openstack/clouds.yaml.

This commit ensures keystone creates a couple of new users to model
system-member and system-reader personas. Doing this by default in
devstack makes it easier for people to use.

We've already taken a similar approach in tempest by setting up the
various system personas for tempest clients to use.

Change-Id: Iceb7c5f517db20072e121dc7538abaa888423c67
---
 functions-common | 53 ++++++++++++++++++++++++++++++++++++++++++++++++
 lib/keystone     | 23 ++++++++++++++++++++-
 2 files changed, 75 insertions(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index 11679e4aa3..111d339372 100644
--- a/functions-common
+++ b/functions-common
@@ -129,6 +129,28 @@ function write_clouds_yaml {
         --os-password $ADMIN_PASSWORD \
         --os-system-scope all
 
+    # system member
+    $PYTHON $TOP_DIR/tools/update_clouds_yaml.py \
+        --file $CLOUDS_YAML \
+        --os-cloud devstack-system-member \
+        --os-region-name $REGION_NAME \
+        $CA_CERT_ARG \
+        --os-auth-url $KEYSTONE_SERVICE_URI \
+        --os-username system_member \
+        --os-password $ADMIN_PASSWORD \
+        --os-system-scope all
+
+    # system reader
+    $PYTHON $TOP_DIR/tools/update_clouds_yaml.py \
+        --file $CLOUDS_YAML \
+        --os-cloud devstack-system-reader \
+        --os-region-name $REGION_NAME \
+        $CA_CERT_ARG \
+        --os-auth-url $KEYSTONE_SERVICE_URI \
+        --os-username system_reader \
+        --os-password $ADMIN_PASSWORD \
+        --os-system-scope all
+
     cat >> $CLOUDS_YAML <<EOF
 functional:
   image_name: $DEFAULT_IMAGE_NAME
@@ -936,6 +958,37 @@ function get_or_add_user_domain_role {
     echo $user_role_id
 }
 
+# Gets or adds user role to system
+# Usage: get_or_add_user_system_role <role> <user> <system> [<user_domain>]
+function get_or_add_user_system_role {
+    local user_role_id
+    local domain_args
+
+    domain_args=$(_get_domain_args $4)
+
+    # Gets user role id
+    user_role_id=$(openstack role assignment list \
+        --role $1 \
+        --user $2 \
+        --system $3 \
+        $domain_args \
+        -f value -c Role)
+    if [[ -z "$user_role_id" ]]; then
+        # Adds role to user and get it
+        openstack role add $1 \
+            --user $2 \
+            --system $3 \
+            $domain_args
+        user_role_id=$(openstack role assignment list \
+            --role $1 \
+            --user $2 \
+            --system $3 \
+            $domain_args \
+            -f value -c Role)
+    fi
+    echo $user_role_id
+}
+
 # Gets or adds group role to project
 # Usage: get_or_add_group_project_role <role> <group> <project>
 function get_or_add_group_project_role {
diff --git a/lib/keystone b/lib/keystone
index 0609abd289..065ca70ec3 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -285,20 +285,28 @@ function configure_keystone {
 # admins               admin            admin                 admin
 # nonadmins            demo, alt_demo   member, anotherrole   demo, alt_demo
 
+# System               User            Roles
+# ------------------------------------------------------------------
+# all                  admin           admin
+# all                  system_reader   reader
+# all                  system_member   member
+
 
 # Migrated from keystone_data.sh
 function create_keystone_accounts {
 
     # The keystone bootstrapping process (performed via keystone-manage
-    # bootstrap) creates an admin user, admin role, member role, and admin
+    # bootstrap) creates an admin user and an admin
     # project. As a sanity check we exercise the CLI to retrieve the IDs for
     # these values.
     local admin_project
     admin_project=$(openstack project show "admin" -f value -c id)
     local admin_user
     admin_user=$(openstack user show "admin" -f value -c id)
+    # These roles are also created during bootstrap but we don't need their IDs
     local admin_role="admin"
     local member_role="member"
+    local reader_role="reader"
 
     async_run ks-domain-role get_or_add_user_domain_role $admin_role $admin_user default
 
@@ -349,6 +357,18 @@ function create_keystone_accounts {
     async_run ks-alt-admin get_or_add_user_project_role $admin_role $admin_user $alt_demo_project
     async_run ks-alt-another get_or_add_user_project_role $another_role $alt_demo_user $alt_demo_project
 
+    # Create two users, give one the member role on the system and the other
+    # the reader role on the system. These two users model system-member and
+    # system-reader personas. The admin user already has the admin role on the
+    # system and we can re-use this user as a system-admin.
+    system_member_user=$(get_or_create_user "system_member" \
+        "$ADMIN_PASSWORD" "default" "system_member@example.com")
+    async_run ks-system-member get_or_add_user_system_role $member_role $system_member_user "all"
+
+    system_reader_user=$(get_or_create_user "system_reader" \
+        "$ADMIN_PASSWORD" "default" "system_reader@example.com")
+    async_run ks-system-reader get_or_add_user_system_role $reader_role $system_reader_user "all"
+
     # groups
     local admin_group
     admin_group=$(get_or_create_group "admins" \
@@ -365,6 +385,7 @@ function create_keystone_accounts {
 
     async_wait ks-demo-{member,admin,another,invis}
     async_wait ks-alt-{member,admin,another}
+    async_wait ks-system-{member,reader}
     async_wait ks-group-{memberdemo,anotherdemo,memberalt,anotheralt,admin}
 
     if is_service_enabled ldap; then

From 95555ba39827e2f3648eb89bde91b1342c493306 Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Wed, 10 Nov 2021 06:22:52 +0100
Subject: [PATCH 1960/2409] Cleanup keystone library

IDENTITY_API_VERSION is hardcoded to 3 in most locations already, drop
the remaining occurrences, but keep the variable definition since some
plugins still depend on it. Drop ENABLE_IDENTITY_V2 which no longer
has any effect.

Amend variable list for bootstrap_keystone().

Signed-off-by: Dr. Jens Harbott <harbott@osism.tech>
Change-Id: I06f476d2105bc6ec2b511fc5effcfcc3973eaf97
---
 doc/source/configuration.rst | 11 -----------
 lib/keystone                 |  4 +---
 openrc                       |  2 +-
 stackrc                      | 18 +++---------------
 4 files changed, 5 insertions(+), 30 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index b4fff4f208..dd8f21faaf 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -684,17 +684,6 @@ KEYSTONE_REGION_NAME to specify the region of Keystone service.
 KEYSTONE_REGION_NAME has a default value the same as REGION_NAME thus we omit
 it in the configuration of RegionOne.
 
-Disabling Identity API v2
-+++++++++++++++++++++++++
-
-The Identity API v2 is deprecated as of Mitaka and it is recommended to only
-use the v3 API. It is possible to setup keystone without v2 API, by doing:
-
-::
-
-    ENABLE_IDENTITY_V2=False
-
-
 Glance
 ++++++
 
diff --git a/lib/keystone b/lib/keystone
index 065ca70ec3..349d2573b6 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -9,7 +9,6 @@
 # - ``tls`` file
 # - ``DEST``, ``STACK_USER``
 # - ``FILES``
-# - ``IDENTITY_API_VERSION``
 # - ``BASE_SQL_CONN``
 # - ``SERVICE_HOST``, ``SERVICE_PROTOCOL``
 # - ``S3_SERVICE_PORT`` (template backend only)
@@ -540,7 +539,7 @@ function start_keystone {
     # unencryted traffic at this point.
     # If running in Apache, use the path rather than port.
 
-    local service_uri=$auth_protocol://$KEYSTONE_SERVICE_HOST/identity/v$IDENTITY_API_VERSION/
+    local service_uri=$auth_protocol://$KEYSTONE_SERVICE_HOST/identity/v3/
 
     if ! wait_for_service $SERVICE_TIMEOUT $service_uri; then
         die $LINENO "keystone did not start"
@@ -569,7 +568,6 @@ function stop_keystone {
 # This function uses the following GLOBAL variables:
 # - ``KEYSTONE_BIN_DIR``
 # - ``ADMIN_PASSWORD``
-# - ``IDENTITY_API_VERSION``
 # - ``REGION_NAME``
 # - ``KEYSTONE_SERVICE_URI``
 function bootstrap_keystone {
diff --git a/openrc b/openrc
index beeaebea42..6d488bb0ba 100644
--- a/openrc
+++ b/openrc
@@ -74,7 +74,7 @@ else
 fi
 
 # Identity API version
-export OS_IDENTITY_API_VERSION=${IDENTITY_API_VERSION:-3}
+export OS_IDENTITY_API_VERSION=3
 
 # Ask keystoneauth1 to use keystone
 export OS_AUTH_TYPE=password
diff --git a/stackrc b/stackrc
index ebe472c033..62749a7005 100755
--- a/stackrc
+++ b/stackrc
@@ -175,21 +175,9 @@ else
     export PS4='+ $(short_source):   '
 fi
 
-# Configure Identity API version: 2.0, 3
-IDENTITY_API_VERSION=${IDENTITY_API_VERSION:-3}
-
-# Set the option ENABLE_IDENTITY_V2 to True. It defines whether the DevStack
-# deployment will be deploying the Identity v2 pipelines. If this option is set
-# to ``False``, DevStack will: i) disable Identity v2; ii) configure Tempest to
-# skip Identity v2 specific tests; and iii) configure Horizon to use Identity
-# v3. When this option is set to ``False``, the option IDENTITY_API_VERSION
-# will to be set to ``3`` in order to make DevStack register the Identity
-# endpoint as v3. This flag is experimental and will be used as basis to
-# identify the projects which still have issues to operate with Identity v3.
-ENABLE_IDENTITY_V2=$(trueorfalse False ENABLE_IDENTITY_V2)
-if [ "$ENABLE_IDENTITY_V2" == "False" ]; then
-    IDENTITY_API_VERSION=3
-fi
+# Configure Identity API version
+# TODO(frickler): Drop this when plugins no longer need it
+IDENTITY_API_VERSION=3
 
 # Enable use of Python virtual environments.  Individual project use of
 # venvs are controlled by the PROJECT_VENV array; every project with

From 9c81321bfc694bd511dee8dd5d04273e368e5545 Mon Sep 17 00:00:00 2001
From: Lance Bragstad <lbragstad@gmail.com>
Date: Thu, 11 Mar 2021 16:29:31 +0000
Subject: [PATCH 1961/2409] Add additional project personas for secure RBAC

This commit formalizes some additional users to act as different project
users and updates clouds.yaml file so they're easy to use.

It creates:

  - a reader on the demo project
  - a reader on the alt_demo project
  - a member on the alt_demo project

With the adoption of secure RBAC personas, these are useful for using
OpenStack APIs as that work continues.

Change-Id: I3237a771275311377313b7d7d80ac059ac69d031
---
 functions-common | 51 +++++++++++++++++++++++++++++++++++++++---------
 lib/keystone     | 32 ++++++++++++++++++++++++------
 2 files changed, 68 insertions(+), 15 deletions(-)

diff --git a/functions-common b/functions-common
index 111d339372..996827f292 100644
--- a/functions-common
+++ b/functions-common
@@ -85,7 +85,7 @@ function write_clouds_yaml {
     if [ -f "$SSL_BUNDLE_FILE" ]; then
         CA_CERT_ARG="--os-cacert $SSL_BUNDLE_FILE"
     fi
-    # demo -> devstack
+    # devstack: user with the member role on demo project
     $PYTHON $TOP_DIR/tools/update_clouds_yaml.py \
         --file $CLOUDS_YAML \
         --os-cloud devstack \
@@ -96,7 +96,18 @@ function write_clouds_yaml {
         --os-password $ADMIN_PASSWORD \
         --os-project-name demo
 
-    # alt_demo -> devstack-alt
+    # devstack-admin: user with the admin role on the admin project
+    $PYTHON $TOP_DIR/tools/update_clouds_yaml.py \
+        --file $CLOUDS_YAML \
+        --os-cloud devstack-admin \
+        --os-region-name $REGION_NAME \
+        $CA_CERT_ARG \
+        --os-auth-url $KEYSTONE_SERVICE_URI \
+        --os-username admin \
+        --os-password $ADMIN_PASSWORD \
+        --os-project-name admin
+
+    # devstack-alt: user with the member role on alt_demo project
     $PYTHON $TOP_DIR/tools/update_clouds_yaml.py \
         --file $CLOUDS_YAML \
         --os-cloud devstack-alt \
@@ -107,18 +118,40 @@ function write_clouds_yaml {
         --os-password $ADMIN_PASSWORD \
         --os-project-name alt_demo
 
-    # admin -> devstack-admin
+    # devstack-alt-member: user with the member role on alt_demo project
     $PYTHON $TOP_DIR/tools/update_clouds_yaml.py \
         --file $CLOUDS_YAML \
-        --os-cloud devstack-admin \
+        --os-cloud devstack-alt-member \
         --os-region-name $REGION_NAME \
         $CA_CERT_ARG \
         --os-auth-url $KEYSTONE_SERVICE_URI \
-        --os-username admin \
+        --os-username alt_demo_member \
         --os-password $ADMIN_PASSWORD \
-        --os-project-name admin
+        --os-project-name alt_demo
+
+    # devstack-alt-reader: user with the reader role on alt_demo project
+    $PYTHON $TOP_DIR/tools/update_clouds_yaml.py \
+        --file $CLOUDS_YAML \
+        --os-cloud devstack-alt-reader \
+        --os-region-name $REGION_NAME \
+        $CA_CERT_ARG \
+        --os-auth-url $KEYSTONE_SERVICE_URI \
+        --os-username alt_demo_reader \
+        --os-password $ADMIN_PASSWORD \
+        --os-project-name alt_demo
+
+    # devstack-reader: user with the reader role on demo project
+    $PYTHON $TOP_DIR/tools/update_clouds_yaml.py \
+        --file $CLOUDS_YAML \
+        --os-cloud devstack-reader \
+        --os-region-name $REGION_NAME \
+        $CA_CERT_ARG \
+        --os-auth-url $KEYSTONE_SERVICE_URI \
+        --os-username demo_reader \
+        --os-password $ADMIN_PASSWORD \
+        --os-project-name demo
 
-    # admin with a system-scoped token -> devstack-system
+    # devstack-system-admin: user with the admin role on the system
     $PYTHON $TOP_DIR/tools/update_clouds_yaml.py \
         --file $CLOUDS_YAML \
         --os-cloud devstack-system-admin \
@@ -129,7 +162,7 @@ function write_clouds_yaml {
         --os-password $ADMIN_PASSWORD \
         --os-system-scope all
 
-    # system member
+    # devstack-system-member: user with the member role on the system
     $PYTHON $TOP_DIR/tools/update_clouds_yaml.py \
         --file $CLOUDS_YAML \
         --os-cloud devstack-system-member \
@@ -140,7 +173,7 @@ function write_clouds_yaml {
         --os-password $ADMIN_PASSWORD \
         --os-system-scope all
 
-    # system reader
+    # devstack-system-reader: user with the reader role on the system
     $PYTHON $TOP_DIR/tools/update_clouds_yaml.py \
         --file $CLOUDS_YAML \
         --os-cloud devstack-system-reader \
diff --git a/lib/keystone b/lib/keystone
index 065ca70ec3..1ae950d0d1 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -346,19 +346,39 @@ function create_keystone_accounts {
     async_run ks-demo-another get_or_add_user_project_role $another_role $demo_user $demo_project
     async_run ks-demo-invis get_or_add_user_project_role $member_role $demo_user $invis_project
 
-    # alt_demo
+    # Create a user to act as a reader on project demo
+    local demo_reader
+    demo_reader=$(get_or_create_user "demo_reader" \
+        "$ADMIN_PASSWORD" "default" "demo_reader@example.com")
+
+    async_run ks-demo-reader get_or_add_user_project_role $reader_role $demo_reader $demo_project
+
+    # Create a different project called alt_demo
     local alt_demo_project
     alt_demo_project=$(get_or_create_project "alt_demo" default)
+    # Create a user to act as member, admin and anotherrole on project alt_demo
     local alt_demo_user
     alt_demo_user=$(get_or_create_user "alt_demo" \
         "$ADMIN_PASSWORD" "default" "alt_demo@example.com")
 
     async_run ks-alt-member get_or_add_user_project_role $member_role $alt_demo_user $alt_demo_project
-    async_run ks-alt-admin get_or_add_user_project_role $admin_role $admin_user $alt_demo_project
+    async_run ks-alt-admin get_or_add_user_project_role $admin_role $alt_demo_user $alt_demo_project
     async_run ks-alt-another get_or_add_user_project_role $another_role $alt_demo_user $alt_demo_project
 
-    # Create two users, give one the member role on the system and the other
-    # the reader role on the system. These two users model system-member and
+    # Create another user to act as a member on project alt_demo
+    local alt_demo_member
+    alt_demo_member=$(get_or_create_user "alt_demo_member" \
+        "$ADMIN_PASSWORD" "default" "alt_demo_member@example.com")
+    async_run ks-alt-member-user get_or_add_user_project_role $member_role $alt_demo_member $alt_demo_project
+
+    # Create another user to act as a reader on project alt_demo
+    local alt_demo_reader
+    alt_demo_reader=$(get_or_create_user "alt_demo_reader" \
+        "$ADMIN_PASSWORD" "default" "alt_demo_reader@example.com")
+    async_run ks-alt-reader-user get_or_add_user_project_role $reader_role $alt_demo_reader $alt_demo_project
+
+    # Create two users, give one the member role on the system and the other the
+    # reader role on the system. These two users model system-member and
     # system-reader personas. The admin user already has the admin role on the
     # system and we can re-use this user as a system-admin.
     system_member_user=$(get_or_create_user "system_member" \
@@ -383,8 +403,8 @@ function create_keystone_accounts {
     async_run ks-group-anotheralt get_or_add_group_project_role $another_role $non_admin_group $alt_demo_project
     async_run ks-group-admin get_or_add_group_project_role $admin_role $admin_group $admin_project
 
-    async_wait ks-demo-{member,admin,another,invis}
-    async_wait ks-alt-{member,admin,another}
+    async_wait ks-demo-{member,admin,another,invis,reader}
+    async_wait ks-alt-{member,admin,another,member-user,reader-user}
     async_wait ks-system-{member,reader}
     async_wait ks-group-{memberdemo,anotherdemo,memberalt,anotheralt,admin}
 

From f9a896c6e6afcf52e9a50613285940c26e353ba3 Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Wed, 27 Oct 2021 16:50:11 +0200
Subject: [PATCH 1962/2409] Rehome functions to enable Neutron's QoS service

Those functions were part of the neutron devstack plugin but we
discussed it during last PTG [1] and decided to move to the Devstack
repo plugins which are used by e.g. CI jobs which are defined outside
of the neutron repository.
QoS service is used e.g. in the tempest-slow job which is
defined in tempest and used by many different OpenStack projects.

[1] https://etherpad.opendev.org/p/neutron-yoga-ptg#L142

Change-Id: I48f65d530db53fe2c94cad57a8072e1158d738b0
---
 lib/neutron-legacy               |  8 ++++++++
 lib/neutron_plugins/services/qos | 30 ++++++++++++++++++++++++++++++
 2 files changed, 38 insertions(+)
 create mode 100644 lib/neutron_plugins/services/qos

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index be29f99024..a3f6f0788d 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -279,6 +279,7 @@ source $TOP_DIR/lib/neutron_plugins/services/l3
 # Additional Neutron service plugins
 source $TOP_DIR/lib/neutron_plugins/services/placement
 source $TOP_DIR/lib/neutron_plugins/services/trunk
+source $TOP_DIR/lib/neutron_plugins/services/qos
 
 # Use security group or not
 if has_neutron_plugin_security_group; then
@@ -381,6 +382,13 @@ function configure_mutnauq {
     if is_service_enabled q-trunk neutron-trunk; then
         configure_trunk_extension
     fi
+    if is_service_enabled q-qos neutron-qos; then
+        configure_qos
+        if is_service_enabled q-l3 neutron-l3; then
+            configure_l3_agent_extension_fip_qos
+            configure_l3_agent_extension_gateway_ip_qos
+        fi
+    fi
 
     iniset $NEUTRON_CONF DEFAULT api_workers "$API_WORKERS"
     # devstack is not a tool for running uber scale OpenStack
diff --git a/lib/neutron_plugins/services/qos b/lib/neutron_plugins/services/qos
new file mode 100644
index 0000000000..af9eb3d5b4
--- /dev/null
+++ b/lib/neutron_plugins/services/qos
@@ -0,0 +1,30 @@
+#!/bin/bash
+
+function configure_qos_service_plugin {
+    neutron_service_plugin_class_add "qos"
+}
+
+
+function configure_qos_core_plugin {
+    configure_qos_$NEUTRON_CORE_PLUGIN
+}
+
+
+function configure_qos_l2_agent {
+    plugin_agent_add_l2_agent_extension "qos"
+}
+
+
+function configure_qos {
+    configure_qos_service_plugin
+    configure_qos_core_plugin
+    configure_qos_l2_agent
+}
+
+function configure_l3_agent_extension_fip_qos {
+    plugin_agent_add_l3_agent_extension "fip_qos"
+}
+
+function configure_l3_agent_extension_gateway_ip_qos {
+    plugin_agent_add_l3_agent_extension "gateway_ip_qos"
+}

From f56f7a557ac4941b5204852f4173db9cf82b4dae Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Tue, 9 Nov 2021 10:57:25 +0100
Subject: [PATCH 1963/2409] Stop creating userrc_early

We can use the devstack-admin cloud configuration everywhere now
and don't need to set environment variables with cloud credentials
any longer.

Fix the swift setup, where some more options need to be explicitly
specified now and the default OS_CLOUD setting overridden.

Signed-off-by: Dr. Jens Harbott <harbott@osism.tech>
Change-Id: I86ffa9cd52454f1c1c72d29b3a0e0caa3e44b829
---
 lib/swift | 15 +++++++++------
 stack.sh  | 28 +++-------------------------
 2 files changed, 12 insertions(+), 31 deletions(-)

diff --git a/lib/swift b/lib/swift
index b376993150..9c13701c6e 100644
--- a/lib/swift
+++ b/lib/swift
@@ -866,12 +866,15 @@ function stop_swift {
 
 function swift_configure_tempurls {
     # note we are using swift credentials!
-    OS_USERNAME=swift \
-    OS_PASSWORD=$SERVICE_PASSWORD \
-    OS_USER_DOMAIN_NAME=$SERVICE_DOMAIN_NAME \
-    OS_PROJECT_NAME=$SERVICE_PROJECT_NAME \
-    OS_PROJECT_DOMAIN_NAME=$SERVICE_DOMAIN_NAME \
-    openstack object store account \
+    openstack --os-cloud "" \
+        --os-region-name $REGION_NAME \
+        --os-auth-url $KEYSTONE_SERVICE_URI \
+        --os-username=swift \
+        --os-password=$SERVICE_PASSWORD \
+        --os-user-domain-name=$SERVICE_DOMAIN_NAME \
+        --os-project-name=$SERVICE_PROJECT_NAME \
+        --os-project-domain-name=$SERVICE_DOMAIN_NAME \
+        object store account \
         set --property "Temp-URL-Key=$SWIFT_TEMPURL_KEY"
 }
 
diff --git a/stack.sh b/stack.sh
index b5ad81b081..ead56e68c0 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1063,35 +1063,13 @@ fi
 # Keystone
 # --------
 
-# Rather than just export these, we write them out to a
-# intermediate userrc file that can also be used to debug if
-# something goes wrong between here and running
-# tools/create_userrc.sh (this script relies on services other
-# than keystone being available, so we can't call it right now)
-cat > $TOP_DIR/userrc_early <<EOF
-# Use this for debugging issues before files in accrc are created
-
-# Set up password auth credentials now that Keystone is bootstrapped
-export OS_IDENTITY_API_VERSION=3
-export OS_AUTH_URL=$KEYSTONE_SERVICE_URI
-export OS_USERNAME=admin
-export OS_USER_DOMAIN_ID=default
-export OS_PASSWORD=$ADMIN_PASSWORD
-export OS_PROJECT_NAME=admin
-export OS_PROJECT_DOMAIN_ID=default
-export OS_REGION_NAME=$KEYSTONE_REGION_NAME
-
-EOF
-
 if is_service_enabled tls-proxy; then
-    echo "export OS_CACERT=$INT_CA_DIR/ca-chain.pem" >> $TOP_DIR/userrc_early
     start_tls_proxy http-services '*' 443 $SERVICE_HOST 80
 fi
 
-source $TOP_DIR/userrc_early
-
-# Write a clouds.yaml file
+# Write a clouds.yaml file and use the devstack-admin cloud
 write_clouds_yaml
+export OS_CLOUD=devstack-admin
 
 if is_service_enabled keystone; then
     echo_summary "Starting Keystone"
@@ -1380,7 +1358,7 @@ fi
 # which is helpful in image bundle steps.
 
 if is_service_enabled nova && is_service_enabled keystone; then
-    USERRC_PARAMS="-PA --target-dir $TOP_DIR/accrc"
+    USERRC_PARAMS="-PA --target-dir $TOP_DIR/accrc --os-password $ADMIN_PASSWORD"
 
     if [ -f $SSL_BUNDLE_FILE ]; then
         USERRC_PARAMS="$USERRC_PARAMS --os-cacert $SSL_BUNDLE_FILE"

From faed11d2a1c9a9bb06ba855d5b551b231dd6bf82 Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Thu, 18 Nov 2021 10:36:57 +0100
Subject: [PATCH 1964/2409] Add missing ml2, L2 and L3 agent functions to
 devstack

Previously those functions were defined in the neutron's devstack plugin
but with [1] we moved qos related code into devstack and we missed about
moving them too.
This is follow up patch to fix that issue.

[1] https://review.opendev.org/c/openstack/devstack/+/815686

Change-Id: Icf459a2f8c6ae3c3cb29b16ba0b92766af41af30
---
 lib/neutron-legacy              | 9 +++++++++
 lib/neutron_plugins/ml2         | 4 ++++
 lib/neutron_plugins/services/l3 | 9 +++++++++
 3 files changed, 22 insertions(+)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index a3f6f0788d..a5a608df72 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -1039,6 +1039,15 @@ function _ssh_check_neutron {
     test_with_retry "$testcmd" "server $ip didn't become ssh-able" $timeout_sec
 }
 
+function plugin_agent_add_l2_agent_extension {
+    local l2_agent_extension=$1
+    if [[ -z "$L2_AGENT_EXTENSIONS" ]]; then
+        L2_AGENT_EXTENSIONS=$l2_agent_extension
+    elif [[ ! ,${L2_AGENT_EXTENSIONS}, =~ ,${l2_agent_extension}, ]]; then
+        L2_AGENT_EXTENSIONS+=",$l2_agent_extension"
+    fi
+}
+
 # Restore xtrace
 $_XTRACE_NEUTRON
 
diff --git a/lib/neutron_plugins/ml2 b/lib/neutron_plugins/ml2
index e1f868f0a7..f00feac6b4 100644
--- a/lib/neutron_plugins/ml2
+++ b/lib/neutron_plugins/ml2
@@ -156,5 +156,9 @@ function has_neutron_plugin_security_group {
     return 0
 }
 
+function configure_qos_ml2 {
+    neutron_ml2_extension_driver_add "qos"
+}
+
 # Restore xtrace
 $_XTRACE_NEUTRON_ML2
diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 98b96ac06c..72f7a32b26 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -427,3 +427,12 @@ function is_networking_extension_supported {
     EXT_LIST=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" extension list --network -c Alias -f value)
     [[ $EXT_LIST =~ $extension ]] && return 0
 }
+
+function plugin_agent_add_l3_agent_extension {
+    local l3_agent_extension=$1
+    if [[ -z "$L3_AGENT_EXTENSIONS" ]]; then
+        L3_AGENT_EXTENSIONS=$l3_agent_extension
+    elif [[ ! ,${L3_AGENT_EXTENSIONS}, =~ ,${l3_agent_extension}, ]]; then
+        L3_AGENT_EXTENSIONS+=",$l3_agent_extension"
+    fi
+}

From c96993d138ea9ba447fc3b3dbbbf4879fd8c20db Mon Sep 17 00:00:00 2001
From: Julia Kreger <juliaashleykreger@gmail.com>
Date: Thu, 18 Nov 2021 10:39:36 -0800
Subject: [PATCH 1965/2409] Make OS_CLOUD be able to be configured

OS_CLOUD is used to communiate to CLI tools what cloud
credentials to utilize.
The change I86ffa9cd52454f1c1c72d29b3a0e0caa3e44b829
unfortunately set an explicit OS_CLOUD account which breaks
any jobs which are expecting a previosuly set OS_CLOUD which
may be different to work. For example, OS_CLOUD being set
as devstack-system-admin to facilitate Secure RBAC testing.

Change-Id: Iee900e552584dda622f57eea3508df48dff2e071
---
 stack.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index ead56e68c0..b5dc0ee05e 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1069,7 +1069,7 @@ fi
 
 # Write a clouds.yaml file and use the devstack-admin cloud
 write_clouds_yaml
-export OS_CLOUD=devstack-admin
+export OS_CLOUD=${OS_CLOUD:-devstack-admin}
 
 if is_service_enabled keystone; then
     echo_summary "Starting Keystone"

From 1d8888dc24143d81c13557ffdfa615052e794ebe Mon Sep 17 00:00:00 2001
From: Lance Bragstad <lbragstad@gmail.com>
Date: Thu, 11 Mar 2021 16:36:28 +0000
Subject: [PATCH 1966/2409] Remove unnecessary member role assignments from
 alt_demo

This user already has the admin role assignment on a project, which
implies the member role, making explicit calls to add the member role
redundant.

Change-Id: I398c5e2f098aeeb896de83872085cbce529a778a
---
 lib/keystone | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 1ae950d0d1..2d48bb10bd 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -342,6 +342,7 @@ function create_keystone_accounts {
     async_wait ks-{domain-role,domain,project,service,reseller,anotherrole}
 
     async_run ks-demo-member get_or_add_user_project_role $member_role $demo_user $demo_project
+
     async_run ks-demo-admin get_or_add_user_project_role $admin_role $admin_user $demo_project
     async_run ks-demo-another get_or_add_user_project_role $another_role $demo_user $demo_project
     async_run ks-demo-invis get_or_add_user_project_role $member_role $demo_user $invis_project
@@ -361,7 +362,6 @@ function create_keystone_accounts {
     alt_demo_user=$(get_or_create_user "alt_demo" \
         "$ADMIN_PASSWORD" "default" "alt_demo@example.com")
 
-    async_run ks-alt-member get_or_add_user_project_role $member_role $alt_demo_user $alt_demo_project
     async_run ks-alt-admin get_or_add_user_project_role $admin_role $alt_demo_user $alt_demo_project
     async_run ks-alt-another get_or_add_user_project_role $another_role $alt_demo_user $alt_demo_project
 
@@ -404,7 +404,7 @@ function create_keystone_accounts {
     async_run ks-group-admin get_or_add_group_project_role $admin_role $admin_group $admin_project
 
     async_wait ks-demo-{member,admin,another,invis,reader}
-    async_wait ks-alt-{member,admin,another,member-user,reader-user}
+    async_wait ks-alt-{admin,another,member-user,reader-user}
     async_wait ks-system-{member,reader}
     async_wait ks-group-{memberdemo,anotherdemo,memberalt,anotheralt,admin}
 

From 65a5db8e3376fbeb6871629cbfe5d77fe848e039 Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <tkajinam@redhat.com>
Date: Mon, 3 May 2021 00:08:15 +0900
Subject: [PATCH 1967/2409] keystone: Dot not set the removed admin_endpoint
 parameter

The admin_endpoint parameter has been removed from keystone[1], and
setting the parameter is no longer effective.

[1] 192cde56e57a06750641b319da8a72cdcaa554d0

Change-Id: I6ae6a3122668551acc018972624e914fcbb79a22
---
 lib/keystone | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 1ae950d0d1..dafe005664 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -214,14 +214,11 @@ function configure_keystone {
         service_port=$KEYSTONE_SERVICE_PORT_INT
     fi
 
-    # Override the endpoints advertised by keystone (the public_endpoint and
-    # admin_endpoint) so that clients use the correct endpoint. By default, the
-    # keystone server uses the public_port and admin_port which isn't going to
-    # work when you want to use a different port (in the case of proxy), or you
-    # don't want the port (in the case of putting keystone on a path in
-    # apache).
+    # Override the endpoints advertised by keystone so that clients use the correct
+    # endpoint. By default, the keystone server uses the public_port which isn't
+    # going to work when you want to use a different port (in the case of proxy),
+    # or you don't want the port (in the case of putting keystone on a path in apache).
     iniset $KEYSTONE_CONF DEFAULT public_endpoint $KEYSTONE_SERVICE_URI
-    iniset $KEYSTONE_CONF DEFAULT admin_endpoint $KEYSTONE_SERVICE_URI
 
     if [[ "$KEYSTONE_TOKEN_FORMAT" != "" ]]; then
         iniset $KEYSTONE_CONF token provider $KEYSTONE_TOKEN_FORMAT

From 6822ff39444f8ebe01084e0d92bc05ac40db8216 Mon Sep 17 00:00:00 2001
From: Gregory Thiemonge <gthiemon@redhat.com>
Date: Wed, 1 Sep 2021 09:36:31 +0200
Subject: [PATCH 1968/2409] Fix OVN DBs cleanup on startup

When initializing OVN, clean up the correct database directory when
using OVN from packages (/var/lib/ovn/ instead of /opt/stack/data/ovn/).
The /opt/stack/data/ovn location is used only when building OVN from
sources, so a fresh devstack deployment with OVN packages may already
have hundreds of existing routers and ports, creating ARP collisions.

Closes-Bug: #1942201
Change-Id: Ic90d4f2f9d8aaef825ea3325c0ad8fef2a1c5e39
---
 lib/neutron_plugins/ovn_agent | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index 1f737fb58b..999851e33d 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -119,7 +119,13 @@ OVS_SCRIPTDIR=$OVS_SHAREDIR/scripts
 OVS_DATADIR=$DATA_DIR/ovs
 OVS_SYSCONFDIR=${OVS_SYSCONFDIR:-$OVS_PREFIX/etc/openvswitch}
 
-OVN_DATADIR=$DATA_DIR/ovn
+if [[ "$OVN_BUILD_FROM_SOURCE" == "True" ]]; then
+    OVN_DATADIR=$DATA_DIR/ovn
+else
+    # When using OVN from packages, the data dir for OVN DBs is
+    # /var/lib/ovn
+    OVN_DATADIR=/var/lib/ovn
+fi
 OVN_SHAREDIR=$OVS_PREFIX/share/ovn
 OVN_SCRIPTDIR=$OVN_SHAREDIR/scripts
 OVN_RUNDIR=$OVS_PREFIX/var/run/ovn
@@ -562,13 +568,13 @@ function init_ovn {
 
     _disable_libvirt_apparmor
 
-    mkdir -p $OVN_DATADIR
+    sudo mkdir -p $OVN_DATADIR
     mkdir -p $OVS_DATADIR
 
     rm -f $OVS_DATADIR/*.db
     rm -f $OVS_DATADIR/.*.db.~lock~
-    rm -f $OVN_DATADIR/*.db
-    rm -f $OVN_DATADIR/.*.db.~lock~
+    sudo rm -f $OVN_DATADIR/*.db
+    sudo rm -f $OVN_DATADIR/.*.db.~lock~
 }
 
 function _start_ovs {

From c20cd8ed9d0294e99293cdcb5eea0885a5a12573 Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <tkajinam@redhat.com>
Date: Wed, 24 Nov 2021 01:35:29 +0900
Subject: [PATCH 1969/2409] cinder-backup: Ensure ca cert is defined when
 tls-proxy is enabled

Change-Id: Id679eb7061d8e609ce76fbb5b720a041990e8e86
---
 lib/cinder_backups/swift | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/cinder_backups/swift b/lib/cinder_backups/swift
index d7c977e1e3..c7ec306246 100644
--- a/lib/cinder_backups/swift
+++ b/lib/cinder_backups/swift
@@ -24,6 +24,9 @@ function configure_cinder_backup_swift {
     # to use it.
     iniset $CINDER_CONF DEFAULT backup_driver "cinder.backup.drivers.swift.SwiftBackupDriver"
     iniset $CINDER_CONF DEFAULT backup_swift_url "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$SWIFT_DEFAULT_BIND_PORT/v1/AUTH_"
+    if is_service_enabled tls-proxy; then
+        iniset $CINDER_CONF DEFAULT backup_swift_ca_cert_file $SSL_BUNDLE_FILE
+    fi
 }
 
 # init_cinder_backup_swift: nothing to do

From afd0f84eae75fd5a5a7611cb6e8368ef7b845211 Mon Sep 17 00:00:00 2001
From: Lance Bragstad <lbragstad@gmail.com>
Date: Mon, 8 Nov 2021 19:53:40 +0000
Subject: [PATCH 1970/2409] Remove unnecessary unset for project-scoped token
 in glance

Before, we needed to unset a couple of parameters that would make the
client return a project-scoped token instead of a system-scoped token,
which we need when interacting with registered limits in keystone.

This commit removes those unsets since we no longer source those
variables by default. This commit also cleans up some of the redundant
parameters in the registered limit calls, like region.

Change-Id: I1af8a168a29e895d57504d41e30efea271ea232d
---
 lib/glance | 29 +++++++++++------------------
 1 file changed, 11 insertions(+), 18 deletions(-)

diff --git a/lib/glance b/lib/glance
index f18bea9ccb..4c2755f76f 100644
--- a/lib/glance
+++ b/lib/glance
@@ -288,24 +288,17 @@ function configure_glance_store {
 
 function configure_glance_quotas {
 
-    # NOTE(danms): We need to have some of the OS_ things unset in
-    # order to use system scope, which is required for creating these
-    # limits. This is a hack, but I dunno how else to get osc to use
-    # system scope.
-
-    bash -c "unset OS_USERNAME OS_TENANT_NAME OS_PROJECT_NAME;
-        openstack --os-cloud devstack-system-admin registered limit create \
-                --service glance --default-limit $GLANCE_LIMIT_IMAGE_SIZE_TOTAL \
-                --region $REGION_NAME image_size_total; \
-        openstack --os-cloud devstack-system-admin registered limit create \
-                --service glance --default-limit $GLANCE_LIMIT_IMAGE_SIZE_TOTAL \
-                --region $REGION_NAME image_stage_total; \
-        openstack --os-cloud devstack-system-admin registered limit create \
-                --service glance --default-limit 100 --region $REGION_NAME \
-                image_count_total; \
-        openstack --os-cloud devstack-system-admin registered limit create \
-                --service glance --default-limit 100 --region $REGION_NAME \
-                image_count_uploading"
+    # Registered limit resources in keystone are system-specific resources.
+    # Make sure we use a system-scoped token to interact with this API.
+
+    openstack --os-cloud devstack-system-admin registered limit create --service glance \
+        --default-limit $GLANCE_LIMIT_IMAGE_SIZE_TOTAL --region $REGION_NAME image_size_total
+    openstack --os-cloud devstack-system-admin registered limit create --service glance \
+        --default-limit $GLANCE_LIMIT_IMAGE_SIZE_TOTAL --region $REGION_NAME image_stage_total
+    openstack --os-cloud devstack-system-admin registered limit create --service glance \
+        --default-limit 100 --region $REGION_NAME image_count_total
+    openstack --os-cloud devstack-system-admin registered limit create --service glance \
+        --default-limit 100 --region $REGION_NAME image_count_uploading
 
     # Tell glance to use these limits
     iniset $GLANCE_API_CONF DEFAULT use_keystone_limits True

From b575af0cfe8aac71825b406394e9927a33ca51bd Mon Sep 17 00:00:00 2001
From: yatinkarel <ykarel@redhat.com>
Date: Fri, 26 Nov 2021 12:44:41 +0530
Subject: [PATCH 1971/2409] Do not use sudo with OVN_DATADIR when building from
 source

Jobs with OVN_BUILD_FROMS_SOURCE=True are broken
since [1] as ovn nortd not starting due to permission
issues. Fix it by not using sudo for creating OVN_DATADIR
when building from source.

[1] https://review.opendev.org/c/openstack/devstack/+/806858

Closes-Bug: #1952393
Change-Id: I00f0c8c8173b4d8270fbb3e6079d0d8b332e9de5
---
 lib/neutron_plugins/ovn_agent | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index 999851e33d..56686f2741 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -568,7 +568,11 @@ function init_ovn {
 
     _disable_libvirt_apparmor
 
-    sudo mkdir -p $OVN_DATADIR
+    if [[ "$OVN_BUILD_FROM_SOURCE" == "True" ]]; then
+        mkdir -p $OVN_DATADIR
+    else
+        sudo mkdir -p $OVN_DATADIR
+    fi
     mkdir -p $OVS_DATADIR
 
     rm -f $OVS_DATADIR/*.db

From bd68251463b2a86e07643387b56deca53a90f3c5 Mon Sep 17 00:00:00 2001
From: Roman Dobosz <gryf73@gmail.com>
Date: Fri, 26 Nov 2021 15:34:50 +0100
Subject: [PATCH 1972/2409] Change a way for creating data dir in case of OVN.

Calculate the sudo usage with local variable.

Change-Id: I39dff770ff296dc06395acdb430a9cfe1722a30f
---
 lib/neutron_plugins/ovn_agent | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index 56686f2741..3fc38288f1 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -567,12 +567,13 @@ function init_ovn {
     # create new ones on each devstack run.
 
     _disable_libvirt_apparmor
+    local mkdir_cmd="mkdir -p ${OVN_DATADIR}"
 
-    if [[ "$OVN_BUILD_FROM_SOURCE" == "True" ]]; then
-        mkdir -p $OVN_DATADIR
-    else
-        sudo mkdir -p $OVN_DATADIR
+    if [[ "$OVN_BUILD_FROM_SOURCE" == "False" ]]; then
+        mkdir_cmd="sudo ${mkdir_cmd}"
     fi
+
+    $mkdir_cmd
     mkdir -p $OVS_DATADIR
 
     rm -f $OVS_DATADIR/*.db

From 5ea4c3c18c558ec1fa37e0dd9b28ce66c3da1130 Mon Sep 17 00:00:00 2001
From: Alfredo Moralejo <amoralej@redhat.com>
Date: Tue, 16 Nov 2021 15:13:03 +0100
Subject: [PATCH 1973/2409] Support CentOS Stream 9

This patch includes changes required to run devstack on CentOS Stream 9
which has been already published in official repos by CentOS team [1]:

- Add RDO deps repository for CS9.
- remove xinetd package from installation for swift. Note that
  rsync-daemon is installed which should work fine.
- Replace genisoimage by xorriso in CS9.
- Use /etc/os-release to identify the distro in CS9 as it doesn't
  provide lsb_release command.
- Use pip from rpm package instead of from get-pip.py as done in Fedora.
- Add non-voting job devstack-platform-centos-9-stream to the check
  pipeline.

Change-Id: Ic67cddabd5069211dc0611994b8b8360bcd61bef
---
 .zuul.yaml           | 21 +++++++++++++++++++++
 files/rpms/ceph      |  2 +-
 files/rpms/n-cpu     |  3 ++-
 files/rpms/nova      |  3 ++-
 files/rpms/swift     |  2 +-
 functions-common     | 17 ++++++++++++-----
 lib/nova             |  3 ++-
 stack.sh             | 24 ++++++++++++++++--------
 tools/install_pip.sh |  2 +-
 9 files changed, 58 insertions(+), 19 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 7a85266eaa..3945faf82e 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -66,6 +66,16 @@
         nodes:
           - controller
 
+- nodeset:
+    name: devstack-single-node-centos-9-stream
+    nodes:
+      - name: controller
+        label: centos-9-stream
+    groups:
+      - name: tempest
+        nodes:
+          - controller
+
 - nodeset:
     name: devstack-single-node-opensuse-15
     nodes:
@@ -622,6 +632,16 @@
     vars:
       configure_swap_size: 4096
 
+- job:
+    name: devstack-platform-centos-9-stream
+    parent: tempest-full-py3
+    description: CentOS 9 Stream platform test
+    nodeset: devstack-single-node-centos-9-stream
+    voting: false
+    timeout: 9000
+    vars:
+      configure_swap_size: 4096
+
 - job:
     name: devstack-platform-debian-bullseye
     parent: tempest-full-py3
@@ -766,6 +786,7 @@
         - devstack-enforce-scope
         - devstack-platform-fedora-latest
         - devstack-platform-centos-8-stream
+        - devstack-platform-centos-9-stream
         - devstack-platform-debian-bullseye
         - devstack-multinode
         - devstack-unit-tests
diff --git a/files/rpms/ceph b/files/rpms/ceph
index 64befc5f00..33a55f80ea 100644
--- a/files/rpms/ceph
+++ b/files/rpms/ceph
@@ -1,3 +1,3 @@
 ceph    # NOPRIME
-redhat-lsb-core
+redhat-lsb-core # not:rhel9
 xfsprogs
diff --git a/files/rpms/n-cpu b/files/rpms/n-cpu
index 68e5472685..7ce5a72d6b 100644
--- a/files/rpms/n-cpu
+++ b/files/rpms/n-cpu
@@ -1,9 +1,10 @@
 cryptsetup
 dosfstools
-genisoimage
+genisoimage # not:rhel9
 iscsi-initiator-utils
 libosinfo
 lvm2
 sg3_utils
 # Stuff for diablo volumes
 sysfsutils
+xorriso # not:rhel8
diff --git a/files/rpms/nova b/files/rpms/nova
index 8ea8ccc5ca..9522e5729d 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -3,7 +3,7 @@ curl
 dnsmasq # for q-dhcp
 dnsmasq-utils # for dhcp_release
 ebtables
-genisoimage # required for config_drive
+genisoimage # not:rhel9 required for config_drive
 iptables
 iputils
 kernel-modules
@@ -13,3 +13,4 @@ polkit
 rabbitmq-server # NOPRIME
 sqlite
 sudo
+xorriso # not:rhel8
diff --git a/files/rpms/swift b/files/rpms/swift
index 18c957c08a..b6009a321e 100644
--- a/files/rpms/swift
+++ b/files/rpms/swift
@@ -4,4 +4,4 @@ memcached
 rsync-daemon
 sqlite
 xfsprogs
-xinetd # not:f34
+xinetd # not:f34,rhel9
diff --git a/functions-common b/functions-common
index b1ca6ad3c0..bd029dd700 100644
--- a/functions-common
+++ b/functions-common
@@ -368,12 +368,19 @@ function _ensure_lsb_release {
 #  - os_VENDOR
 #  - os_PACKAGE
 function GetOSVersion {
-    # We only support distros that provide a sane lsb_release
-    _ensure_lsb_release
+    # CentOS Stream 9 does not provide lsb_release
+    source /etc/os-release
+    if [[ "${ID}${VERSION}" == "centos9" ]]; then
+        os_RELEASE=${VERSION_ID}
+        os_CODENAME="n/a"
+        os_VENDOR=$(echo $NAME | tr -d '[:space:]')
+    else
+        _ensure_lsb_release
 
-    os_RELEASE=$(lsb_release -r -s)
-    os_CODENAME=$(lsb_release -c -s)
-    os_VENDOR=$(lsb_release -i -s)
+        os_RELEASE=$(lsb_release -r -s)
+        os_CODENAME=$(lsb_release -c -s)
+        os_VENDOR=$(lsb_release -i -s)
+    fi
 
     if [[ $os_VENDOR =~ (Debian|Ubuntu|LinuxMint) ]]; then
         os_PACKAGE="deb"
diff --git a/lib/nova b/lib/nova
index 9aae2c4a9c..31b7642efc 100644
--- a/lib/nova
+++ b/lib/nova
@@ -479,7 +479,8 @@ function create_nova_conf {
     fi
 
     # nova defaults to genisoimage but only mkisofs is available for 15.0+
-    if is_suse; then
+    # rhel provides mkisofs symlink to genisoimage or xorriso appropiately
+    if is_suse || is_fedora; then
         iniset $NOVA_CONF DEFAULT mkisofs_cmd /usr/bin/mkisofs
     fi
 
diff --git a/stack.sh b/stack.sh
index b5ad81b081..fa4e7e9006 100755
--- a/stack.sh
+++ b/stack.sh
@@ -227,7 +227,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-SUPPORTED_DISTROS="bullseye|focal|f34|opensuse-15.2|opensuse-tumbleweed|rhel8"
+SUPPORTED_DISTROS="bullseye|focal|f34|opensuse-15.2|opensuse-tumbleweed|rhel8|rhel9"
 
 if [[ ! ${DISTRO} =~ $SUPPORTED_DISTROS ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
@@ -300,13 +300,17 @@ function _install_epel {
 }
 
 function _install_rdo {
-    if [[ "$TARGET_BRANCH" == "master" ]]; then
-        # rdo-release.el8.rpm points to latest RDO release, use that for master
-        sudo dnf -y install https://rdoproject.org/repos/rdo-release.el8.rpm
-    else
-        # For stable branches use corresponding release rpm
-        rdo_release=$(echo $TARGET_BRANCH | sed "s|stable/||g")
-        sudo dnf -y install https://rdoproject.org/repos/openstack-${rdo_release}/rdo-release-${rdo_release}.el8.rpm
+    if [[ $DISTRO == "rhel8" ]]; then
+        if [[ "$TARGET_BRANCH" == "master" ]]; then
+            # rdo-release.el8.rpm points to latest RDO release, use that for master
+            sudo dnf -y install https://rdoproject.org/repos/rdo-release.el8.rpm
+        else
+            # For stable branches use corresponding release rpm
+            rdo_release=$(echo $TARGET_BRANCH | sed "s|stable/||g")
+            sudo dnf -y install https://rdoproject.org/repos/openstack-${rdo_release}/rdo-release-${rdo_release}.el8.rpm
+        fi
+    elif [[ $DISTRO == "rhel9" ]]; then
+        sudo curl -L -o /etc/yum.repos.d/delorean-deps.repo http://trunk.rdoproject.org/centos9-master/delorean-deps.repo
     fi
     sudo dnf -y update
 }
@@ -385,6 +389,10 @@ if [[ $DISTRO == "rhel8" ]]; then
     # RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1154272
     # Patch: https://github.com/rpm-software-management/dnf/pull/1448
     echo "[]" | sudo tee /var/cache/dnf/expired_repos.json
+elif [[ $DISTRO == "rhel9" ]]; then
+    sudo dnf config-manager --set-enabled crb
+    # rabbitmq and other packages are provided by RDO repositories.
+    _install_rdo
 fi
 
 # Ensure python is installed
diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index c72dc89a55..259375a150 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -118,7 +118,7 @@ if [[ -n $PYPI_ALTERNATIVE_URL ]]; then
     configure_pypi_alternative_url
 fi
 
-if is_fedora && [[ ${DISTRO} == f* ]]; then
+if is_fedora && [[ ${DISTRO} == f* || ${DISTRO} == rhel9 ]]; then
     # get-pip.py will not install over the python3-pip package in
     # Fedora 34 any more.
     #  https://bugzilla.redhat.com/show_bug.cgi?id=1988935

From 31334f9a9b2edbdc4a7b45e2e04aaec827639d62 Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Thu, 4 Nov 2021 18:30:29 +0000
Subject: [PATCH 1974/2409] nova: Use noVNC 1.3.0 when installing from source

Additionally make the repo name lowercase to match the project name in
our zuul config so that jobs can check the repo out.

Change-Id: Ic2d9c4fa837461bbc29e067a81912b5f72efd3ca
---
 lib/nova | 2 +-
 stackrc  | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/nova b/lib/nova
index 9aae2c4a9c..3460c2145a 100644
--- a/lib/nova
+++ b/lib/nova
@@ -831,7 +831,7 @@ function install_nova {
             NOVNC_WEB_DIR=/usr/share/novnc
             install_package novnc
         else
-            NOVNC_WEB_DIR=$DEST/noVNC
+            NOVNC_WEB_DIR=$DEST/novnc
             git_clone $NOVNC_REPO $NOVNC_WEB_DIR $NOVNC_BRANCH
         fi
     fi
diff --git a/stackrc b/stackrc
index 62749a7005..4fc09af9a8 100755
--- a/stackrc
+++ b/stackrc
@@ -590,8 +590,8 @@ IRONIC_PYTHON_AGENT_REPO=${IRONIC_PYTHON_AGENT_REPO:-${GIT_BASE}/openstack/ironi
 IRONIC_PYTHON_AGENT_BRANCH=${IRONIC_PYTHON_AGENT_BRANCH:-$TARGET_BRANCH}
 
 # a websockets/html5 or flash powered VNC console for vm instances
-NOVNC_REPO=${NOVNC_REPO:-https://github.com/novnc/noVNC.git}
-NOVNC_BRANCH=${NOVNC_BRANCH:-v1.1.0}
+NOVNC_REPO=${NOVNC_REPO:-https://github.com/novnc/novnc.git}
+NOVNC_BRANCH=${NOVNC_BRANCH:-v1.3.0}
 
 # a websockets/html5 or flash powered SPICE console for vm instances
 SPICE_REPO=${SPICE_REPO:-http://anongit.freedesktop.org/git/spice/spice-html5.git}

From fc8ef86fbe09a467ee8bcffa79760d3f1e699450 Mon Sep 17 00:00:00 2001
From: Lee Yarwood <lyarwood@redhat.com>
Date: Tue, 9 Mar 2021 17:32:25 +0000
Subject: [PATCH 1975/2409] Only write out uwsgi configs when deploying API
 services

Previously this would always happen for Nova and Cinder even if n-api
and c-api were not enabled on the host respectively.

This change stops this by placing both calls write_uwsgi_config behind
is_service_enabled checks.

Change-Id: I997685da771736dbad79bcfe4b00dbc63bd6d6b6
---
 lib/cinder | 4 +++-
 lib/nova   | 9 +++++++--
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index cefb609676..76314c1d1f 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -353,7 +353,9 @@ function configure_cinder {
     # Format logging
     setup_logging $CINDER_CONF $CINDER_USE_MOD_WSGI
 
-    write_uwsgi_config "$CINDER_UWSGI_CONF" "$CINDER_UWSGI" "/volume"
+    if is_service_enabled c-api; then
+        write_uwsgi_config "$CINDER_UWSGI_CONF" "$CINDER_UWSGI" "/volume"
+    fi
 
     if [[ -r $CINDER_PLUGINS/$CINDER_DRIVER ]]; then
         configure_cinder_driver
diff --git a/lib/nova b/lib/nova
index 9aae2c4a9c..8109446572 100644
--- a/lib/nova
+++ b/lib/nova
@@ -488,8 +488,13 @@ function create_nova_conf {
 
     iniset $NOVA_CONF upgrade_levels compute "auto"
 
-    write_uwsgi_config "$NOVA_UWSGI_CONF" "$NOVA_UWSGI" "/compute"
-    write_uwsgi_config "$NOVA_METADATA_UWSGI_CONF" "$NOVA_METADATA_UWSGI" "" "$SERVICE_LISTEN_ADDRESS:${METADATA_SERVICE_PORT}"
+    if is_service_enabled n-api; then
+        write_uwsgi_config "$NOVA_UWSGI_CONF" "$NOVA_UWSGI" "/compute"
+    fi
+
+    if is_service_enabled n-api-meta; then
+        write_uwsgi_config "$NOVA_METADATA_UWSGI_CONF" "$NOVA_METADATA_UWSGI" "" "$SERVICE_LISTEN_ADDRESS:${METADATA_SERVICE_PORT}"
+    fi
 
     if is_service_enabled ceilometer; then
         iniset $NOVA_CONF DEFAULT instance_usage_audit "True"

From 418535883763cb31e54ab3882ee3eacc42afd4f3 Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Tue, 6 Jul 2021 12:05:31 +0200
Subject: [PATCH 1976/2409] Install OVS from source when it was configured like
 that

Function _neutron_ovs_base_install_agent_packages always tried to
install openvswitch from packages and start it using systemd units.
That was failing when ovs was expected to be installed from source.
This patch fixes that.

Change-Id: Iae8625dd800d30061ea3dbed9eb0dfbe16f21572
---
 lib/neutron_plugins/ovn_agent  | 13 +++------
 lib/neutron_plugins/ovs_base   | 49 +++++++++++++++++++++-------------
 lib/neutron_plugins/ovs_source |  1 +
 3 files changed, 35 insertions(+), 28 deletions(-)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index 1f737fb58b..c0bba2c370 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -24,11 +24,6 @@ source ${TOP_DIR}/lib/neutron_plugins/openvswitch_agent
 # Load devstack ovs compliation and loading functions
 source ${TOP_DIR}/lib/neutron_plugins/ovs_source
 
-# Defaults
-# --------
-
-Q_BUILD_OVS_FROM_GIT=$(trueorfalse True Q_BUILD_OVS_FROM_GIT)
-
 # Set variables for building OVN from source
 OVN_REPO=${OVN_REPO:-https://github.com/ovn-org/ovn.git}
 OVN_REPO_NAME=$(basename ${OVN_REPO} | cut -f1 -d'.')
@@ -74,6 +69,9 @@ OVN_UUID=${OVN_UUID:-}
 # unless the distro kernel includes ovs+conntrack support.
 OVN_BUILD_MODULES=$(trueorfalse False OVN_BUILD_MODULES)
 OVN_BUILD_FROM_SOURCE=$(trueorfalse False OVN_BUILD_FROM_SOURCE)
+if [[ "$OVN_BUILD_FROM_SOURCE" == "True" ]]; then
+    Q_BUILD_OVS_FROM_GIT=True
+fi
 
 # Whether or not to install the ovs python module from ovs source.  This can be
 # used to test and validate new ovs python features.  This should only be used
@@ -341,11 +339,6 @@ function ovn_sanity_check {
 
 # install_ovn() - Collect source and prepare
 function install_ovn {
-    if [[ "$Q_BUILD_OVS_FROM_GIT" == "False" ]]; then
-        echo "Installation of OVS from source disabled."
-        return 0
-    fi
-
     echo "Installing OVN and dependent packages"
 
     # Check the OVN configuration
diff --git a/lib/neutron_plugins/ovs_base b/lib/neutron_plugins/ovs_base
index 2e63fe3c7b..8acf586189 100644
--- a/lib/neutron_plugins/ovs_base
+++ b/lib/neutron_plugins/ovs_base
@@ -7,6 +7,12 @@
 _XTRACE_NEUTRON_OVS_BASE=$(set +o | grep xtrace)
 set +o xtrace
 
+# Load devstack ovs compliation and loading functions
+source ${TOP_DIR}/lib/neutron_plugins/ovs_source
+
+# Defaults
+# --------
+
 OVS_BRIDGE=${OVS_BRIDGE:-br-int}
 # OVS recognize default 'system' datapath or 'netdev' for userspace datapath
 OVS_DATAPATH_TYPE=${OVS_DATAPATH_TYPE:-system}
@@ -60,26 +66,33 @@ function _neutron_ovs_base_install_ubuntu_dkms {
 }
 
 function _neutron_ovs_base_install_agent_packages {
-    # Install deps
-    install_package $(get_packages "openvswitch")
-    if is_ubuntu; then
-        _neutron_ovs_base_install_ubuntu_dkms
-        restart_service openvswitch-switch
-    elif is_fedora; then
-        restart_service openvswitch
-        sudo systemctl enable openvswitch
-    elif is_suse; then
-        if [[ $DISTRO == "sle12" ]] && vercmp "$os_RELEASE" "<" "12.2" ; then
+    if [ "$Q_BUILD_OVS_FROM_GIT" == "True" ]; then
+        remove_ovs_packages
+        compile_ovs False /usr /var
+        load_conntrack_gre_module
+        start_new_ovs
+    else
+        # Install deps
+        install_package $(get_packages "openvswitch")
+        if is_ubuntu; then
+            _neutron_ovs_base_install_ubuntu_dkms
             restart_service openvswitch-switch
-        else
-            # workaround for https://bugzilla.suse.com/show_bug.cgi?id=1085971
-            if [[ $DISTRO =~ "tumbleweed" ]]; then
-                sudo sed -i -e "s,^OVS_USER_ID=.*,OVS_USER_ID='root:root'," /etc/sysconfig/openvswitch
+        elif is_fedora; then
+            restart_service openvswitch
+            sudo systemctl enable openvswitch
+        elif is_suse; then
+            if [[ $DISTRO == "sle12" ]] && vercmp "$os_RELEASE" "<" "12.2" ; then
+                restart_service openvswitch-switch
+            else
+                # workaround for https://bugzilla.suse.com/show_bug.cgi?id=1085971
+                if [[ $DISTRO =~ "tumbleweed" ]]; then
+                    sudo sed -i -e "s,^OVS_USER_ID=.*,OVS_USER_ID='root:root'," /etc/sysconfig/openvswitch
+                fi
+                restart_service openvswitch || {
+                    journalctl -xe || :
+                    systemctl status openvswitch
+                }
             fi
-            restart_service openvswitch || {
-                journalctl -xe || :
-                systemctl status openvswitch
-            }
         fi
     fi
 }
diff --git a/lib/neutron_plugins/ovs_source b/lib/neutron_plugins/ovs_source
index 08951d175d..9c87dce551 100644
--- a/lib/neutron_plugins/ovs_source
+++ b/lib/neutron_plugins/ovs_source
@@ -14,6 +14,7 @@
 
 # Defaults
 # --------
+Q_BUILD_OVS_FROM_GIT=$(trueorfalse False Q_BUILD_OVS_FROM_GIT)
 
 # Set variables for building OVS from source
 OVS_REPO=${OVS_REPO:-https://github.com/openvswitch/ovs.git}

From c3b7051387d4332f956148c5676383499fa31859 Mon Sep 17 00:00:00 2001
From: Ade Lee <alee@redhat.com>
Date: Fri, 6 Aug 2021 14:26:37 -0400
Subject: [PATCH 1977/2409] Add option to set chap algorithms for iscsid for
 FIPS

The default CHAP algorithm for iscsid is md5, which is disallowed
under fips.  We will set the chap algorithm to "SHA3-256,SHA256",
which should work under all configurations.

Change-Id: Ide186fb53b3f9826ff602cb7fb797f245a15033a
---
 lib/nova | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/nova b/lib/nova
index 5fcccffec1..1420183a19 100644
--- a/lib/nova
+++ b/lib/nova
@@ -315,6 +315,10 @@ EOF
             sudo systemctl daemon-reload
         fi
 
+        # set chap algorithms.  The default chap_algorithm is md5 which will
+        # not work under FIPS
+        iniset -sudo /etc/iscsi/iscsid.conf DEFAULT "node.session.auth.chap_algs" "SHA3-256,SHA256"
+
         # ensure that iscsid is started, even when disabled by default
         restart_service iscsid
     fi

From 24b65adc9cedff9c7a8ab412fb39613ef5d4a627 Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Tue, 22 Jun 2021 15:31:46 +0200
Subject: [PATCH 1978/2409] Deploy Neutron with enforced new RBAC rules

This patch adds new config option NEUTRON_ENFORCE_NEW_DEFAULTS which
if set to True will deploy Neutron with enforce new rbac defaults and
scopes.
It will also use SYSTEM_ADMIN user to interact with Neutron where it is
needed.

Depends-On: https://review.opendev.org/c/openstack/neutron/+/798821

Change-Id: I14d934f0deced34d74003b92824cad3c44ec4f5e
---
 .zuul.yaml                      |  1 +
 lib/neutron                     | 19 ++++++++++
 lib/neutron-legacy              | 18 ++++++++++
 lib/neutron_plugins/services/l3 | 62 +++++++++++++++++++++------------
 lib/tempest                     | 10 ++++--
 5 files changed, 85 insertions(+), 25 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 3945faf82e..b5ab1277b6 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -609,6 +609,7 @@
         # Keep enabeling the services here to run with system scope
         CINDER_ENFORCE_SCOPE: true
         GLANCE_ENFORCE_SCOPE: true
+        NEUTRON_ENFORCE_SCOPE: true
 
 - job:
     name: devstack-multinode
diff --git a/lib/neutron b/lib/neutron
index 885df97f7c..15d548e33d 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -37,6 +37,11 @@ NEUTRON_DEPLOY_MOD_WSGI=$(trueorfalse False NEUTRON_DEPLOY_MOD_WSGI)
 NEUTRON_AGENT=${NEUTRON_AGENT:-openvswitch}
 NEUTRON_DIR=$DEST/neutron
 
+# If NEUTRON_ENFORCE_SCOPE == True, it will set "enforce_scope"
+# and "enforce_new_defaults" to True in the Neutron's config to enforce usage
+# of the new RBAC policies and scopes.
+NEUTRON_ENFORCE_SCOPE=$(trueorfalse False NEUTRON_ENFORCE_SCOPE)
+
 NEUTRON_DISTRIBUTED_ROUTING=$(trueorfalse False NEUTRON_DISTRIBUTED_ROUTING)
 # Distributed Virtual Router (DVR) configuration
 # Can be:
@@ -232,6 +237,7 @@ function configure_neutron_new {
         if [[ "$NEUTRON_PORT_SECURITY" = "True" ]]; then
             neutron_ml2_extension_driver_add port_security
         fi
+        configure_rbac_policies
     fi
 
     # Neutron OVS or LB agent
@@ -612,6 +618,19 @@ function configure_neutron {
     fi
 }
 
+# configure_rbac_policies() - Configure Neutron to enforce new RBAC
+# policies and scopes if NEUTRON_ENFORCE_SCOPE == True
+function configure_rbac_policies {
+    if [ "$NEUTRON_ENFORCE_SCOPE" == "True" ]; then
+        iniset $NEUTRON_CONF oslo_policy enforce_new_defaults True
+        iniset $NEUTRON_CONF oslo_policy enforce_scope True
+    else
+        iniset $NEUTRON_CONF oslo_policy enforce_new_defaults False
+        iniset $NEUTRON_CONF oslo_policy enforce_scope False
+    fi
+}
+
+
 function configure_neutron_nova {
     if is_neutron_legacy_enabled; then
         # Call back to old function
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index a5a608df72..b906a1b2ff 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -90,6 +90,11 @@ NEUTRON_DEPLOY_MOD_WSGI=$(trueorfalse False NEUTRON_DEPLOY_MOD_WSGI)
 
 NEUTRON_UWSGI_CONF=$NEUTRON_CONF_DIR/neutron-api-uwsgi.ini
 
+# If NEUTRON_ENFORCE_SCOPE == True, it will set "enforce_scope"
+# and "enforce_new_defaults" to True in the Neutron's config to enforce usage
+# of the new RBAC policies and scopes.
+NEUTRON_ENFORCE_SCOPE=$(trueorfalse False NEUTRON_ENFORCE_SCOPE)
+
 # Agent binaries.  Note, binary paths for other agents are set in per-service
 # scripts in lib/neutron_plugins/services/
 AGENT_DHCP_BINARY="$NEUTRON_BIN_DIR/neutron-dhcp-agent"
@@ -489,6 +494,19 @@ function configure_neutron_after_post_config {
     if [[ $Q_SERVICE_PLUGIN_CLASSES != '' ]]; then
         iniset $NEUTRON_CONF DEFAULT service_plugins $Q_SERVICE_PLUGIN_CLASSES
     fi
+    configure_rbac_policies
+}
+
+# configure_rbac_policies() - Configure Neutron to enforce new RBAC
+# policies and scopes if NEUTRON_ENFORCE_SCOPE == True
+function configure_rbac_policies {
+    if [ "$NEUTRON_ENFORCE_SCOPE" == "True" ]; then
+        iniset $NEUTRON_CONF oslo_policy enforce_new_defaults True
+        iniset $NEUTRON_CONF oslo_policy enforce_scope True
+    else
+        iniset $NEUTRON_CONF oslo_policy enforce_new_defaults False
+        iniset $NEUTRON_CONF oslo_policy enforce_scope False
+    fi
 }
 
 # Start running OVN processes
diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 72f7a32b26..ccb5398f75 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -100,6 +100,11 @@ SUBNETPOOL_PREFIX_V6=${SUBNETPOOL_PREFIX_V6:-$IPV6_ADDRS_SAFE_TO_USE}
 SUBNETPOOL_SIZE_V4=${SUBNETPOOL_SIZE_V4:-26}
 SUBNETPOOL_SIZE_V6=${SUBNETPOOL_SIZE_V6:-64}
 
+NEUTRON_ADMIN_CLOUD_NAME="devstack-admin"
+if [ "$NEUTRON_ENFORCE_SCOPE" == "True" ]; then
+    NEUTRON_ADMIN_CLOUD_NAME="devstack-system-admin"
+fi
+
 default_v4_route_devs=$(ip -4 route | grep ^default | awk '{print $5}')
 
 default_v6_route_devs=$(ip -6 route list match default table all | grep via | awk '{print $5}')
@@ -151,6 +156,10 @@ function create_neutron_initial_network {
     project_id=$(openstack project list | grep " demo " | get_field 1)
     die_if_not_set $LINENO project_id "Failure retrieving project_id for demo"
 
+    local admin_project_id
+    admin_project_id=$(openstack project list | grep " admin " | get_field 1)
+    die_if_not_set $LINENO admin_project_id "Failure retrieving project_id for admin"
+
     # Allow drivers that need to create an initial network to do so here
     if type -p neutron_plugin_create_initial_network_profile > /dev/null; then
         neutron_plugin_create_initial_network_profile $PHYSICAL_NETWORK
@@ -159,10 +168,10 @@ function create_neutron_initial_network {
     if is_networking_extension_supported "auto-allocated-topology"; then
         if [[ "$USE_SUBNETPOOL" == "True" ]]; then
             if [[ "$IP_VERSION" =~ 4.* ]]; then
-                SUBNETPOOL_V4_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet pool create $SUBNETPOOL_NAME_V4 --default-prefix-length $SUBNETPOOL_SIZE_V4 --pool-prefix $SUBNETPOOL_PREFIX_V4 --share --default -f value -c id)
+                SUBNETPOOL_V4_ID=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" subnet pool create $SUBNETPOOL_NAME_V4 --project "$admin_project_id" --default-prefix-length $SUBNETPOOL_SIZE_V4 --pool-prefix $SUBNETPOOL_PREFIX_V4 --share --default -f value -c id)
             fi
             if [[ "$IP_VERSION" =~ .*6 ]]; then
-                SUBNETPOOL_V6_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet pool create $SUBNETPOOL_NAME_V6 --default-prefix-length $SUBNETPOOL_SIZE_V6 --pool-prefix $SUBNETPOOL_PREFIX_V6 --share --default -f value -c id)
+                SUBNETPOOL_V6_ID=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" subnet pool create $SUBNETPOOL_NAME_V6 --project "$admin_project_id" --default-prefix-length $SUBNETPOOL_SIZE_V6 --pool-prefix $SUBNETPOOL_PREFIX_V6 --share --default -f value -c id)
             fi
         fi
     fi
@@ -170,14 +179,14 @@ function create_neutron_initial_network {
     if is_provider_network; then
         die_if_not_set $LINENO PHYSICAL_NETWORK "You must specify the PHYSICAL_NETWORK"
         die_if_not_set $LINENO PROVIDER_NETWORK_TYPE "You must specify the PROVIDER_NETWORK_TYPE"
-        NET_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" network create $PHYSICAL_NETWORK --project $project_id --provider-network-type $PROVIDER_NETWORK_TYPE --provider-physical-network "$PHYSICAL_NETWORK" ${SEGMENTATION_ID:+--provider-segment $SEGMENTATION_ID} --share | grep ' id ' | get_field 2)
+        NET_ID=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" network create $PHYSICAL_NETWORK --project $project_id --provider-network-type $PROVIDER_NETWORK_TYPE --provider-physical-network "$PHYSICAL_NETWORK" ${SEGMENTATION_ID:+--provider-segment $SEGMENTATION_ID} --share | grep ' id ' | get_field 2)
         die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PHYSICAL_NETWORK $project_id"
 
         if [[ "$IP_VERSION" =~ 4.* ]]; then
             if [ -z $SUBNETPOOL_V4_ID ]; then
                 fixed_range_v4=$FIXED_RANGE
             fi
-            SUBNET_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet create --project $project_id --ip-version 4 ${ALLOCATION_POOL:+--allocation-pool $ALLOCATION_POOL} $PROVIDER_SUBNET_NAME --gateway $NETWORK_GATEWAY ${SUBNETPOOL_V4_ID:+--subnet-pool $SUBNETPOOL_V4_ID} --network $NET_ID ${fixed_range_v4:+--subnet-range $fixed_range_v4} | grep ' id ' | get_field 2)
+            SUBNET_ID=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" subnet create --project $project_id --ip-version 4 ${ALLOCATION_POOL:+--allocation-pool $ALLOCATION_POOL} $PROVIDER_SUBNET_NAME --gateway $NETWORK_GATEWAY ${SUBNETPOOL_V4_ID:+--subnet-pool $SUBNETPOOL_V4_ID} --network $NET_ID ${fixed_range_v4:+--subnet-range $fixed_range_v4} | grep ' id ' | get_field 2)
             die_if_not_set $LINENO SUBNET_ID "Failure creating SUBNET_ID for $PROVIDER_SUBNET_NAME $project_id"
         fi
 
@@ -187,7 +196,7 @@ function create_neutron_initial_network {
             if [ -z $SUBNETPOOL_V6_ID ]; then
                 fixed_range_v6=$IPV6_PROVIDER_FIXED_RANGE
             fi
-            IPV6_SUBNET_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet create --project $project_id --ip-version 6 --gateway $IPV6_PROVIDER_NETWORK_GATEWAY $IPV6_PROVIDER_SUBNET_NAME ${SUBNETPOOL_V6_ID:+--subnet-pool $SUBNETPOOL_V6_ID} --network $NET_ID ${fixed_range_v6:+--subnet-range $fixed_range_v6} | grep ' id ' | get_field 2)
+            IPV6_SUBNET_ID=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" subnet create --project $project_id --ip-version 6 --gateway $IPV6_PROVIDER_NETWORK_GATEWAY $IPV6_PROVIDER_SUBNET_NAME ${SUBNETPOOL_V6_ID:+--subnet-pool $SUBNETPOOL_V6_ID} --network $NET_ID ${fixed_range_v6:+--subnet-range $fixed_range_v6} | grep ' id ' | get_field 2)
             die_if_not_set $LINENO IPV6_SUBNET_ID "Failure creating IPV6_SUBNET_ID for $IPV6_PROVIDER_SUBNET_NAME $project_id"
         fi
 
@@ -197,7 +206,7 @@ function create_neutron_initial_network {
             sudo ip link set $PUBLIC_INTERFACE up
         fi
     else
-        NET_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" network create --project $project_id "$PRIVATE_NETWORK_NAME" | grep ' id ' | get_field 2)
+        NET_ID=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" network create --project $project_id "$PRIVATE_NETWORK_NAME" | grep ' id ' | get_field 2)
         die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PRIVATE_NETWORK_NAME $project_id"
 
         if [[ "$IP_VERSION" =~ 4.* ]]; then
@@ -215,11 +224,11 @@ function create_neutron_initial_network {
         # Create a router, and add the private subnet as one of its interfaces
         if [[ "$Q_L3_ROUTER_PER_TENANT" == "True" ]]; then
             # create a tenant-owned router.
-            ROUTER_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" router create --project $project_id $Q_ROUTER_NAME | grep ' id ' | get_field 2)
+            ROUTER_ID=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" router create --project $project_id $Q_ROUTER_NAME | grep ' id ' | get_field 2)
             die_if_not_set $LINENO ROUTER_ID "Failure creating ROUTER_ID for $project_id $Q_ROUTER_NAME"
         else
             # Plugin only supports creating a single router, which should be admin owned.
-            ROUTER_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" router create $Q_ROUTER_NAME | grep ' id ' | get_field 2)
+            ROUTER_ID=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" router create $Q_ROUTER_NAME --project $admin_project_id | grep ' id ' | get_field 2)
             die_if_not_set $LINENO ROUTER_ID "Failure creating ROUTER_ID for $Q_ROUTER_NAME"
         fi
 
@@ -229,9 +238,9 @@ function create_neutron_initial_network {
         fi
         # Create an external network, and a subnet. Configure the external network as router gw
         if [ "$Q_USE_PROVIDERNET_FOR_PUBLIC" = "True" ]; then
-            EXT_NET_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" network create "$PUBLIC_NETWORK_NAME" $EXTERNAL_NETWORK_FLAGS --provider-network-type ${PUBLIC_PROVIDERNET_TYPE:-flat} ${PUBLIC_PROVIDERNET_SEGMENTATION_ID:+--provider-segment $PUBLIC_PROVIDERNET_SEGMENTATION_ID} --provider-physical-network ${PUBLIC_PHYSICAL_NETWORK} | grep ' id ' | get_field 2)
+            EXT_NET_ID=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" network create "$PUBLIC_NETWORK_NAME" $EXTERNAL_NETWORK_FLAGS --provider-network-type ${PUBLIC_PROVIDERNET_TYPE:-flat} ${PUBLIC_PROVIDERNET_SEGMENTATION_ID:+--provider-segment $PUBLIC_PROVIDERNET_SEGMENTATION_ID} --provider-physical-network ${PUBLIC_PHYSICAL_NETWORK} --project $admin_project_id | grep ' id ' | get_field 2)
         else
-            EXT_NET_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" network create "$PUBLIC_NETWORK_NAME" $EXTERNAL_NETWORK_FLAGS | grep ' id ' | get_field 2)
+            EXT_NET_ID=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" network create "$PUBLIC_NETWORK_NAME" $EXTERNAL_NETWORK_FLAGS --project $admin_project_id | grep ' id ' | get_field 2)
         fi
         die_if_not_set $LINENO EXT_NET_ID "Failure creating EXT_NET_ID for $PUBLIC_NETWORK_NAME"
 
@@ -258,11 +267,12 @@ function _neutron_create_private_subnet_v4 {
     if [[ -n "$NETWORK_GATEWAY" ]]; then
         subnet_params+="--gateway $NETWORK_GATEWAY "
     fi
+
     subnet_params+="${SUBNETPOOL_V4_ID:+--subnet-pool $SUBNETPOOL_V4_ID} "
     subnet_params+="${fixed_range_v4:+--subnet-range $fixed_range_v4} "
     subnet_params+="--network $NET_ID $PRIVATE_SUBNET_NAME"
     local subnet_id
-    subnet_id=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet create $subnet_params | grep ' id ' | get_field 2)
+    subnet_id=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" subnet create $subnet_params | grep ' id ' | get_field 2)
     die_if_not_set $LINENO subnet_id "Failure creating private IPv4 subnet for $project_id"
     echo $subnet_id
 }
@@ -285,14 +295,17 @@ function _neutron_create_private_subnet_v6 {
     subnet_params+="${fixed_range_v6:+--subnet-range $fixed_range_v6} "
     subnet_params+="$ipv6_modes --network $NET_ID $IPV6_PRIVATE_SUBNET_NAME "
     local ipv6_subnet_id
-    ipv6_subnet_id=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet create $subnet_params | grep ' id ' | get_field 2)
+    ipv6_subnet_id=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" subnet create $subnet_params | grep ' id ' | get_field 2)
     die_if_not_set $LINENO ipv6_subnet_id "Failure creating private IPv6 subnet for $project_id"
     echo $ipv6_subnet_id
 }
 
 # Create public IPv4 subnet
 function _neutron_create_public_subnet_v4 {
-    local subnet_params="--ip-version 4 "
+    local admin_project_id
+    admin_project_id=$(openstack project list | grep " admin " | get_field 1)
+    die_if_not_set $LINENO admin_project_id "Failure retrieving project_id for admin"
+    local subnet_params="--ip-version 4 --project $admin_project_id"
     subnet_params+="${Q_FLOATING_ALLOCATION_POOL:+--allocation-pool $Q_FLOATING_ALLOCATION_POOL} "
     if [[ -n "$PUBLIC_NETWORK_GATEWAY" ]]; then
         subnet_params+="--gateway $PUBLIC_NETWORK_GATEWAY "
@@ -300,26 +313,29 @@ function _neutron_create_public_subnet_v4 {
     subnet_params+="--network $EXT_NET_ID --subnet-range $FLOATING_RANGE --no-dhcp "
     subnet_params+="$PUBLIC_SUBNET_NAME"
     local id_and_ext_gw_ip
-    id_and_ext_gw_ip=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet create $subnet_params | grep -e 'gateway_ip' -e ' id ')
+    id_and_ext_gw_ip=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" subnet create $subnet_params | grep -e 'gateway_ip' -e ' id ')
     die_if_not_set $LINENO id_and_ext_gw_ip "Failure creating public IPv4 subnet"
     echo $id_and_ext_gw_ip
 }
 
 # Create public IPv6 subnet
 function _neutron_create_public_subnet_v6 {
-    local subnet_params="--ip-version 6 "
+    local admin_project_id
+    admin_project_id=$(openstack project list | grep " admin " | get_field 1)
+    die_if_not_set $LINENO admin_project_id "Failure retrieving project_id for admin"
+    local subnet_params="--ip-version 6 --project $admin_project_id "
     subnet_params+="--gateway $IPV6_PUBLIC_NETWORK_GATEWAY "
     subnet_params+="--network $EXT_NET_ID --subnet-range $IPV6_PUBLIC_RANGE --no-dhcp "
     subnet_params+="$IPV6_PUBLIC_SUBNET_NAME"
     local ipv6_id_and_ext_gw_ip
-    ipv6_id_and_ext_gw_ip=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet create $subnet_params | grep -e 'gateway_ip' -e ' id ')
+    ipv6_id_and_ext_gw_ip=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" subnet create $subnet_params | grep -e 'gateway_ip' -e ' id ')
     die_if_not_set $LINENO ipv6_id_and_ext_gw_ip "Failure creating an IPv6 public subnet"
     echo $ipv6_id_and_ext_gw_ip
 }
 
 # Configure neutron router for IPv4 public access
 function _neutron_configure_router_v4 {
-    openstack --os-cloud devstack-admin --os-region "$REGION_NAME" router add subnet $ROUTER_ID $SUBNET_ID
+    openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" router add subnet $ROUTER_ID $SUBNET_ID
     # Create a public subnet on the external network
     local id_and_ext_gw_ip
     id_and_ext_gw_ip=$(_neutron_create_public_subnet_v4 $EXT_NET_ID)
@@ -327,7 +343,7 @@ function _neutron_configure_router_v4 {
     ext_gw_ip=$(echo $id_and_ext_gw_ip  | get_field 2)
     PUB_SUBNET_ID=$(echo $id_and_ext_gw_ip | get_field 5)
     # Configure the external network as the default router gateway
-    openstack --os-cloud devstack-admin --os-region "$REGION_NAME" router set --external-gateway $EXT_NET_ID $ROUTER_ID
+    openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" router set --external-gateway $EXT_NET_ID $ROUTER_ID
 
     # This logic is specific to using OVN or the l3-agent for layer 3
     if ([[ $Q_AGENT == "ovn" ]] && [[ "$OVN_L3_CREATE_PUBLIC_NETWORK" == "True" ]] && is_service_enabled q-svc neutron-server) || is_service_enabled q-l3 neutron-l3; then
@@ -354,7 +370,7 @@ function _neutron_configure_router_v4 {
                 sudo ip addr add $ext_gw_ip/$cidr_len dev $ext_gw_interface
                 sudo ip link set $ext_gw_interface up
             fi
-            ROUTER_GW_IP=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" port list -c 'Fixed IP Addresses' --device-owner network:router_gateway | awk -F'ip_address'  '{ print $2 }' | cut -f2 -d\' | tr '\n' ' ')
+            ROUTER_GW_IP=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" port list -c 'Fixed IP Addresses' --device-owner network:router_gateway | awk -F'ip_address'  '{ print $2 }' | cut -f2 -d\' | tr '\n' ' ')
             die_if_not_set $LINENO ROUTER_GW_IP "Failure retrieving ROUTER_GW_IP"
         fi
         _neutron_set_router_id
@@ -363,7 +379,7 @@ function _neutron_configure_router_v4 {
 
 # Configure neutron router for IPv6 public access
 function _neutron_configure_router_v6 {
-    openstack --os-cloud devstack-admin --os-region "$REGION_NAME" router add subnet $ROUTER_ID $IPV6_SUBNET_ID
+    openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" router add subnet $ROUTER_ID $IPV6_SUBNET_ID
     # Create a public subnet on the external network
     local ipv6_id_and_ext_gw_ip
     ipv6_id_and_ext_gw_ip=$(_neutron_create_public_subnet_v6 $EXT_NET_ID)
@@ -375,7 +391,7 @@ function _neutron_configure_router_v6 {
     # If the external network has not already been set as the default router
     # gateway when configuring an IPv4 public subnet, do so now
     if [[ "$IP_VERSION" == "6" ]]; then
-        openstack --os-cloud devstack-admin --os-region "$REGION_NAME" router set --external-gateway $EXT_NET_ID $ROUTER_ID
+        openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" router set --external-gateway $EXT_NET_ID $ROUTER_ID
     fi
 
     # This logic is specific to using OVN or the l3-agent for layer 3
@@ -396,7 +412,7 @@ function _neutron_configure_router_v6 {
         sudo sysctl -w net.ipv6.conf.all.forwarding=1
         # Configure and enable public bridge
         # Override global IPV6_ROUTER_GW_IP with the true value from neutron
-        IPV6_ROUTER_GW_IP=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" port list -c 'Fixed IP Addresses' | grep $ipv6_pub_subnet_id | awk -F'ip_address' '{ print $2 }' | cut -f2 -d\' | tr '\n' ' ')
+        IPV6_ROUTER_GW_IP=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" port list -c 'Fixed IP Addresses' | grep $ipv6_pub_subnet_id | awk -F'ip_address' '{ print $2 }' | cut -f2 -d\' | tr '\n' ' ')
         die_if_not_set $LINENO IPV6_ROUTER_GW_IP "Failure retrieving IPV6_ROUTER_GW_IP"
 
         if is_neutron_ovs_base_plugin; then
@@ -424,7 +440,7 @@ function _neutron_configure_router_v6 {
 function is_networking_extension_supported {
     local extension=$1
     # TODO(sc68cal) cache this instead of calling every time
-    EXT_LIST=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" extension list --network -c Alias -f value)
+    EXT_LIST=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" extension list --network -c Alias -f value)
     [[ $EXT_LIST =~ $extension ]] && return 0
 }
 
diff --git a/lib/tempest b/lib/tempest
index 8fd54c5d5e..ab802171d1 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -90,6 +90,10 @@ TEMPEST_USE_TEST_ACCOUNTS=$(trueorfalse False TEMPEST_USE_TEST_ACCOUNTS)
 # it will run tempest with
 TEMPEST_CONCURRENCY=${TEMPEST_CONCURRENCY:-$(nproc)}
 
+NEUTRON_ADMIN_CLOUD_NAME="devstack-admin"
+if [ "$NEUTRON_ENFORCE_SCOPE" == "True" ]; then
+    NEUTRON_ADMIN_CLOUD_NAME="devstack-system-admin"
+fi
 
 # Functions
 # ---------
@@ -287,8 +291,8 @@ function configure_tempest {
     if [[ "$NEUTRON_CREATE_INITIAL_NETWORKS" == "True" ]] && is_networking_extension_supported 'external-net'; then
         public_network_id=$(openstack --os-cloud devstack-admin network show -f value -c id $PUBLIC_NETWORK_NAME)
         # make sure shared network presence does not confuses the tempest tests
-        openstack --os-cloud devstack-admin network create --share shared
-        openstack --os-cloud devstack-admin subnet create --description shared-subnet --subnet-range ${TEMPEST_SHARED_POOL:-192.168.233.0/24} --network shared shared-subnet
+        openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" network create --share shared --project "$admin_project_id"
+        openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" subnet create --description shared-subnet --subnet-range ${TEMPEST_SHARED_POOL:-192.168.233.0/24} --network shared shared-subnet --project "$admin_project_id"
     fi
 
     iniset $TEMPEST_CONFIG DEFAULT use_syslog $SYSLOG
@@ -443,6 +447,8 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG network-feature-enabled ipv6_subnet_attributes "$IPV6_SUBNET_ATTRIBUTES_ENABLED"
     iniset $TEMPEST_CONFIG network-feature-enabled port_security $NEUTRON_PORT_SECURITY
 
+    iniset $TEMPEST_CONFIG enforce_scope neutron "$NEUTRON_ENFORCE_SCOPE"
+
     # Scenario
     SCENARIO_IMAGE_DIR=${SCENARIO_IMAGE_DIR:-$FILES}
     SCENARIO_IMAGE_FILE=$DEFAULT_IMAGE_FILE_NAME

From 7880ba665e2d594b2eabb0533e6dca52e042ca50 Mon Sep 17 00:00:00 2001
From: Kevin Zhao <kevin.zhao@linaro.org>
Date: Wed, 31 Mar 2021 04:58:28 +0000
Subject: [PATCH 1979/2409] openEuler 20.03 LTS SP2 support

openEuler is an open-source Linux based operating system. The current
openEuler kernel is based on Linux and supports multi arch, such as X86_64
and aarch64. It fully unleashes the potential of computing chips. As an
efficient, stable, and secure open-source OS built by global open-source
contributors, openEuler applies to database, big data, cloud computing,
and AI scenarios. openEuler is using RPM for package management.

Note:
Currently there is no available package for uwsgi-plugin-python3 and ovn, so that
openEuler needs manually install them from source.

Website: https://www.openeuler.org/en/

Change-Id: I169a0017998054604a63ac6c177d0f43f8a32ba6
Co-Authored-By: wangxiyuan <wangxiyuan1007@gmail.com>
Signed-off-by: Kevin Zhao <kevin.zhao@linaro.org>
---
 .zuul.yaml                             | 25 +++++++++++++++++++++++++
 doc/source/index.rst                   |  2 +-
 files/rpms/ceph                        |  2 +-
 files/rpms/general                     |  4 +++-
 files/rpms/nova                        |  2 +-
 files/rpms/swift                       |  2 +-
 functions-common                       | 14 ++++++++++++--
 lib/apache                             | 16 +++-------------
 lib/nova_plugins/functions-libvirt     |  2 +-
 roles/apache-logs-conf/tasks/main.yaml |  1 +
 stack.sh                               |  8 +++++++-
 tools/fixup_stuff.sh                   | 24 ++++++++++++++++++++++++
 12 files changed, 80 insertions(+), 22 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 3945faf82e..a4385572bc 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -106,6 +106,16 @@
         nodes:
           - controller
 
+- nodeset:
+    name: devstack-single-node-openeuler-20.03-sp2
+    nodes:
+      - name: controller
+        label: openEuler-20-03-LTS-SP2
+    groups:
+      - name: tempest
+        nodes:
+          - controller
+
 - nodeset:
     name: openstack-two-node
     nodes:
@@ -683,6 +693,20 @@
           # Enable Neutron ML2/OVS services
           q-agt: true
 
+- job:
+    name: devstack-platform-openEuler-20.03-SP2
+    parent: tempest-full-py3
+    description: openEuler 20.03 SP2 platform test
+    nodeset: devstack-single-node-openeuler-20.03-sp2
+    voting: false
+    timeout: 9000
+    vars:
+      configure_swap_size: 4096
+      devstack_localrc:
+        # NOTE(wxy):  OVN package is not supported by openEuler yet. Build it
+        # from source instead.
+        OVN_BUILD_FROM_SOURCE: True
+
 - job:
     name: devstack-no-tls-proxy
     parent: tempest-full-py3
@@ -788,6 +812,7 @@
         - devstack-platform-centos-8-stream
         - devstack-platform-centos-9-stream
         - devstack-platform-debian-bullseye
+        - devstack-platform-openEuler-20.03-SP2
         - devstack-multinode
         - devstack-unit-tests
         - openstack-tox-bashate
diff --git a/doc/source/index.rst b/doc/source/index.rst
index 08ce4cb061..feb50ce4e9 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -38,7 +38,7 @@ Install Linux
 
 Start with a clean and minimal install of a Linux system. DevStack
 attempts to support the two latest LTS releases of Ubuntu, the
-latest/current Fedora version, CentOS/RHEL 8 and OpenSUSE.
+latest/current Fedora version, CentOS/RHEL 8, OpenSUSE and openEuler.
 
 If you do not have a preference, Ubuntu 20.04 (Focal Fossa) is the
 most tested, and will probably go the smoothest.
diff --git a/files/rpms/ceph b/files/rpms/ceph
index 33a55f80ea..93b5746aa6 100644
--- a/files/rpms/ceph
+++ b/files/rpms/ceph
@@ -1,3 +1,3 @@
 ceph    # NOPRIME
-redhat-lsb-core # not:rhel9
+redhat-lsb-core # not:rhel9,openEuler-20.03
 xfsprogs
diff --git a/files/rpms/general b/files/rpms/general
index 33da0a5385..163a7c8f24 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -16,6 +16,7 @@ libjpeg-turbo-devel # Pillow 3.0.0
 libxml2-devel # lxml
 libxslt-devel # lxml
 libyaml-devel
+make # dist:openEuler-20.03
 net-tools
 openssh-server
 openssl
@@ -27,7 +28,8 @@ psmisc
 python3-devel
 python3-pip
 python3-systemd
-redhat-rpm-config # missing dep for gcc hardening flags, see rhbz#1217376
+redhat-rpm-config # not:openEuler-20.03    missing dep for gcc hardening flags, see rhbz#1217376
+systemd-devel # dist:openEuler-20.03
 tar
 tcpdump
 unzip
diff --git a/files/rpms/nova b/files/rpms/nova
index 9522e5729d..9e8621c628 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -6,7 +6,7 @@ ebtables
 genisoimage # not:rhel9 required for config_drive
 iptables
 iputils
-kernel-modules
+kernel-modules # not:openEuler-20.03
 kpartx
 parted
 polkit
diff --git a/files/rpms/swift b/files/rpms/swift
index b6009a321e..faf0a3175a 100644
--- a/files/rpms/swift
+++ b/files/rpms/swift
@@ -1,5 +1,5 @@
 curl
-liberasurecode-devel
+liberasurecode-devel # not:openEuler-20.03
 memcached
 rsync-daemon
 sqlite
diff --git a/functions-common b/functions-common
index 80f43554d0..e593328f37 100644
--- a/functions-common
+++ b/functions-common
@@ -388,7 +388,7 @@ function _ensure_lsb_release {
     elif [[ -x $(command -v zypper 2>/dev/null) ]]; then
         sudo zypper -n install lsb-release
     elif [[ -x $(command -v dnf 2>/dev/null) ]]; then
-        sudo dnf install -y redhat-lsb-core
+        sudo dnf install -y redhat-lsb-core || sudo dnf install -y openeuler-lsb
     else
         die $LINENO "Unable to find or auto-install lsb_release"
     fi
@@ -459,6 +459,10 @@ function GetDistro {
         # Drop the . release as we assume it's compatible
         # XXX re-evaluate when we get RHEL10
         DISTRO="rhel${os_RELEASE::1}"
+    elif [[ "$os_VENDOR" =~ (openEuler) ]]; then
+        # The DISTRO here is `openEuler-20.03`. While, actually only openEuler
+        # 20.03 LTS SP2 is fully tested. Other SP version maybe have bugs.
+        DISTRO="openEuler-$os_RELEASE"
     else
         # We can't make a good choice here.  Setting a sensible DISTRO
         # is part of the problem, but not the major issue -- we really
@@ -510,6 +514,7 @@ function is_fedora {
     fi
 
     [ "$os_VENDOR" = "Fedora" ] || [ "$os_VENDOR" = "Red Hat" ] || \
+        [ "$os_VENDOR" = "openEuler" ] || \
         [ "$os_VENDOR" = "RedHatEnterpriseServer" ] || \
         [ "$os_VENDOR" = "RedHatEnterprise" ] || \
         [ "$os_VENDOR" = "CentOS" ] || [ "$os_VENDOR" = "CentOSStream" ] || \
@@ -558,7 +563,12 @@ function is_ubuntu {
     [ "$os_PACKAGE" = "deb" ]
 }
 
-
+function is_openeuler {
+    if [[ -z "$os_PACKAGE" ]]; then
+        GetOSVersion
+    fi
+    [ "$os_VENDOR" = "openEuler" ]
+}
 # Git Functions
 # =============
 
diff --git a/lib/apache b/lib/apache
index 4bea07dc55..cbe61adf34 100644
--- a/lib/apache
+++ b/lib/apache
@@ -82,19 +82,10 @@ function install_apache_uwsgi {
         apxs="apxs"
     fi
 
-    # This varies based on packaged/installed.  If we've
-    # pip_installed, then the pip setup will only build a "python"
-    # module that will be either python2 or python3 depending on what
-    # it was built with.
-    #
-    # For package installs, the distro ships both plugins and you need
-    # to select the right one ... it will not be autodetected.
-    UWSGI_PYTHON_PLUGIN=python3
-
     if is_ubuntu; then
         local pkg_list="uwsgi uwsgi-plugin-python3 libapache2-mod-proxy-uwsgi"
         install_package ${pkg_list}
-    elif is_fedora; then
+    elif is_fedora && ! is_openeuler; then
         # Note httpd comes with mod_proxy_uwsgi and it is loaded by
         # default; the mod_proxy_uwsgi package actually conflicts now.
         # See:
@@ -122,7 +113,6 @@ function install_apache_uwsgi {
         popd
         # delete the temp directory
         sudo rm -rf $dir
-        UWSGI_PYTHON_PLUGIN=python
     fi
 
     if is_ubuntu || is_suse ; then
@@ -283,7 +273,7 @@ function write_uwsgi_config {
     # configured after graceful shutdown
     iniset "$file" uwsgi worker-reload-mercy $WORKER_TIMEOUT
     iniset "$file" uwsgi enable-threads true
-    iniset "$file" uwsgi plugins http,${UWSGI_PYTHON_PLUGIN}
+    iniset "$file" uwsgi plugins http,python3
     # uwsgi recommends this to prevent thundering herd on accept.
     iniset "$file" uwsgi thunder-lock true
     # Set hook to trigger graceful shutdown on SIGTERM
@@ -336,7 +326,7 @@ function write_local_uwsgi_http_config {
     iniset "$file" uwsgi die-on-term true
     iniset "$file" uwsgi exit-on-reload false
     iniset "$file" uwsgi enable-threads true
-    iniset "$file" uwsgi plugins http,${UWSGI_PYTHON_PLUGIN}
+    iniset "$file" uwsgi plugins http,python3
     # uwsgi recommends this to prevent thundering herd on accept.
     iniset "$file" uwsgi thunder-lock true
     # Set hook to trigger graceful shutdown on SIGTERM
diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index 63882e05fe..3e7d2801d6 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -90,7 +90,7 @@ function install_libvirt {
         install_package libvirt libvirt-devel python3-libvirt
 
         if is_arch "aarch64"; then
-            install_package edk2.git-aarch64
+            install_package edk2-aarch64
         fi
     fi
 
diff --git a/roles/apache-logs-conf/tasks/main.yaml b/roles/apache-logs-conf/tasks/main.yaml
index bd64574c9b..6b7ea37857 100644
--- a/roles/apache-logs-conf/tasks/main.yaml
+++ b/roles/apache-logs-conf/tasks/main.yaml
@@ -64,6 +64,7 @@
       'Debian': '/etc/apache2/sites-enabled/'
       'Suse': '/etc/apache2/conf.d/'
       'RedHat': '/etc/httpd/conf.d/'
+      'openEuler': '/etc/httpd/conf.d/'
 
 - name: Discover configurations
   find:
diff --git a/stack.sh b/stack.sh
index a10e6eff25..cb16fda998 100755
--- a/stack.sh
+++ b/stack.sh
@@ -227,7 +227,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-SUPPORTED_DISTROS="bullseye|focal|f34|opensuse-15.2|opensuse-tumbleweed|rhel8|rhel9"
+SUPPORTED_DISTROS="bullseye|focal|f34|opensuse-15.2|opensuse-tumbleweed|rhel8|rhel9|openEuler-20.03"
 
 if [[ ! ${DISTRO} =~ $SUPPORTED_DISTROS ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
@@ -278,6 +278,12 @@ chmod 0440 $TEMPFILE
 sudo chown root:root $TEMPFILE
 sudo mv $TEMPFILE /etc/sudoers.d/50_stack_sh
 
+# TODO(wxy): Currently some base packages are not installed by default in
+# openEuler. Remove the code below once the packaged are installed by default
+# in the future.
+if [[ $DISTRO == "openEuler-20.03" ]]; then
+    install_package hostname
+fi
 
 # Configure Distro Repositories
 # -----------------------------
diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index fe5dafa994..750849db68 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -148,8 +148,32 @@ function fixup_ubuntu {
     sudo rm -rf /usr/lib/python3/dist-packages/simplejson-*.egg-info
 }
 
+function fixup_openeuler {
+    if ! is_openeuler; then
+        return
+    fi
+
+    if is_arch "x86_64"; then
+        arch="x86_64"
+    elif is_arch "aarch64"; then
+        arch="aarch64"
+    fi
+
+    # Some packages' version in openEuler are too old, use the newer ones we
+    # provide in oepkg. (oepkg is an openEuler third part yum repo which is
+    # endorsed by openEuler community)
+    (echo '[openstack-ci]'
+    echo 'name=openstack'
+    echo 'baseurl=https://repo.oepkgs.net/openEuler/rpm/openEuler-20.03-LTS-SP2/budding-openeuler/openstack-master-ci/'$arch'/'
+    echo 'enabled=1'
+    echo 'gpgcheck=0') | sudo tee -a /etc/yum.repos.d/openstack-master.repo > /dev/null
+
+    yum_install liberasurecode-devel
+}
+
 function fixup_all {
     fixup_ubuntu
     fixup_fedora
     fixup_suse
+    fixup_openeuler
 }

From 588894753971c32f6fff9b2158c3427b012cf9ec Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Wed, 22 Dec 2021 16:00:29 +0100
Subject: [PATCH 1980/2409] Clean up compile_ovn function's parameters

That function was accepting 3 positional arguments and first
of them was boolean value "build_modules" which isn't used anywhere in
that function.
So this patch cleans it a bit by removing that not used parameter.

Change-Id: I5c57b9116338a63b7bfb170c02e33bb4eae725da
---
 lib/neutron_plugins/ovn_agent | 13 +++++--------
 1 file changed, 5 insertions(+), 8 deletions(-)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index 3fc38288f1..099b639458 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -294,16 +294,13 @@ function _disable_libvirt_apparmor {
 
 # compile_ovn() - Compile OVN from source and load needed modules
 #                 Accepts three parameters:
-#                   - first optional is False by default and means that
-#                     modules are built and installed.
-#                   - second optional parameter defines prefix for
+#                   - first optional parameter defines prefix for
 #                     ovn compilation
-#                   - third optional parameter defines localstatedir for
+#                   - second optional parameter defines localstatedir for
 #                     ovn single machine runtime
 function compile_ovn {
-    local build_modules=${1:-False}
-    local prefix=$2
-    local localstatedir=$3
+    local prefix=$1
+    local localstatedir=$2
 
     if [ -n "$prefix" ]; then
         prefix="--prefix=$prefix"
@@ -381,7 +378,7 @@ function install_ovn {
 
         compile_ovs $OVN_BUILD_MODULES
         if use_new_ovn_repository; then
-            compile_ovn $OVN_BUILD_MODULES
+            compile_ovn
         fi
 
         sudo mkdir -p $OVS_PREFIX/var/log/openvswitch

From 353c3f9cb1e70929898116b0b6c0020c43d93aea Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Thu, 23 Dec 2021 12:01:44 +0100
Subject: [PATCH 1981/2409] Fix stacking without preconfigured
 DATABASE_PASSWORD

When we need to read a DATABASE_PASSWORD from the user, make sure we
actually use it in our database URLs.

Signed-off-by: Dr. Jens Harbott <harbott@osism.tech>
Change-Id: I5ebf6b0280e82f2c87a63cbee7a9957c6bd26898
---
 lib/database | 6 ++++--
 stack.sh     | 2 ++
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/lib/database b/lib/database
index 7940cf2208..78563f6f6d 100644
--- a/lib/database
+++ b/lib/database
@@ -89,6 +89,10 @@ function initialize_database_backends {
         DATABASE_PASSWORD=$MYSQL_PASSWORD
     fi
 
+    return 0
+}
+
+function define_database_baseurl {
     # We configure Nova, Horizon, Glance and Keystone to use MySQL as their
     # database server.  While they share a single server, each has their own
     # database and tables.
@@ -100,8 +104,6 @@ function initialize_database_backends {
 
     # NOTE: Don't specify ``/db`` in this string so we can use it for multiple services
     BASE_SQL_CONN=${BASE_SQL_CONN:-$(get_database_type_$DATABASE_TYPE)://$DATABASE_USER:$DATABASE_PASSWORD@$DATABASE_HOST}
-
-    return 0
 }
 
 # Recreate a given database
diff --git a/stack.sh b/stack.sh
index a10e6eff25..6b5625e922 100755
--- a/stack.sh
+++ b/stack.sh
@@ -691,6 +691,8 @@ if initialize_database_backends; then
     # Last chance for the database password. This must be handled here
     # because read_password is not a library function.
     read_password DATABASE_PASSWORD "ENTER A PASSWORD TO USE FOR THE DATABASE."
+
+    define_database_baseurl
 else
     echo "No database enabled"
 fi

From 134205c1388ac69169698ff2fe36cba23044ff62 Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Thu, 23 Dec 2021 12:26:36 +0100
Subject: [PATCH 1982/2409] Don't enable the dstat service in CI jobs

We still are seeing regular job failures because the pcp package fails
to install. Assume that we can still enable it on demand when someone
needs to debug specific job issues, let us just disable it by default.

Related-Bug: 1943184
Signed-off-by: Dr. Jens Harbott <harbott@osism.tech>
Change-Id: I32ef8038e21c818623db9389588b3c6d3f98dcad
---
 .zuul.yaml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index b5ab1277b6..e5ef7ee080 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -432,7 +432,7 @@
         PUBLIC_BRIDGE_MTU: '{{ external_bridge_mtu }}'
       devstack_services:
         # Shared services
-        dstat: true
+        dstat: false
         etcd3: true
         memory_tracker: true
         mysql: true
@@ -441,7 +441,7 @@
       subnode:
         devstack_services:
           # Shared services
-          dstat: true
+          dstat: false
           memory_tracker: true
         devstack_localrc:
           # Multinode specific settings
@@ -507,7 +507,7 @@
         # Core services enabled for this branch.
         # This list replaces the test-matrix.
         # Shared services
-        dstat: true
+        dstat: false
         etcd3: true
         memory_tracker: true
         mysql: true
@@ -557,7 +557,7 @@
           # Core services enabled for this branch.
           # This list replaces the test-matrix.
           # Shared services
-          dstat: true
+          dstat: false
           memory_tracker: true
           tls-proxy: true
           # Nova services

From 05e622ead243325658ae5aff5b5b53ce60135c57 Mon Sep 17 00:00:00 2001
From: yatinkarel <ykarel@redhat.com>
Date: Wed, 29 Dec 2021 12:30:01 +0530
Subject: [PATCH 1983/2409] Use upper-constraints from in review changes

Currently upper-constraints.txt is not getting used
from in-review changes of requirements project and
leading to merge of broken requirements[1].

Use master branch to fetch constraints instead of
the remote branch.

[1] https://review.opendev.org/c/openstack/requirements/+/822575

Depends-On: https://review.opendev.org/c/openstack/requirements/+/823128
Change-Id: I5d42ac6b54bf20804d7e5faa39d1289102318b64
---
 lib/tempest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index ab802171d1..bdbd3caec8 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -119,7 +119,7 @@ function set_tempest_venv_constraints {
     local tmp_c
     tmp_c=$1
     if [[ $TEMPEST_VENV_UPPER_CONSTRAINTS == "master" ]]; then
-        (cd $REQUIREMENTS_DIR && git show origin/master:upper-constraints.txt) > $tmp_c
+        (cd $REQUIREMENTS_DIR && git show master:upper-constraints.txt) > $tmp_c
     else
         echo "Using $TEMPEST_VENV_UPPER_CONSTRAINTS constraints in Tempest virtual env."
         cat $TEMPEST_VENV_UPPER_CONSTRAINTS > $tmp_c

From c1a75c6a504d720e9d46f924f5c3da07fddfee72 Mon Sep 17 00:00:00 2001
From: Miguel Lavalle <mlavalle@redhat.com>
Date: Fri, 31 Dec 2021 16:14:23 -0600
Subject: [PATCH 1984/2409] Fix mysqladmin failure for Fedora 34 and mariadb

mysqladmin is incorrectly installed in Fedora 34 with mariadb. This
causes the failure of Zuul Fedora based jobs. The issue is a conflict
between mariadb and community mysql that is described in [1] and [2].

The workaround is to explicitly install package "mariadb"

Also configure an increased swap size like for the other platform jobs
in order to avoid OOM issues.

[1] https://bugzilla.redhat.com/show_bug.cgi?id=2026933
[2] https://lists.launchpad.net/maria-discuss/msg06179.html

Closes-Bug: #1956116
Change-Id: Icf6d7e1af5130689ea10b29d37cc9b188b2c9754
---
 .zuul.yaml          | 3 +++
 lib/databases/mysql | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 2c55b545e0..272018fa06 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -725,6 +725,8 @@
     description: Fedora latest platform test
     nodeset: devstack-single-node-fedora-latest
     voting: false
+    vars:
+      configure_swap_size: 4096
 
 - job:
     name: devstack-platform-fedora-latest-virt-preview
@@ -733,6 +735,7 @@
     nodeset: devstack-single-node-fedora-latest
     voting: false
     vars:
+      configure_swap_size: 4096
       devstack_localrc:
         ENABLE_FEDORA_VIRT_PREVIEW_REPO: true
 
diff --git a/lib/databases/mysql b/lib/databases/mysql
index d0fa1199a7..8edbf8c4a4 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -178,7 +178,7 @@ EOF
     if is_oraclelinux; then
         install_package mysql-community-server
     elif is_fedora; then
-        install_package mariadb-server mariadb-devel
+        install_package mariadb-server mariadb-devel mariadb
         sudo systemctl enable $MYSQL_SERVICE_NAME
     elif is_suse; then
         install_package mariadb-server

From 2ef4a4c8516bc6373bc7f4cafee62db715144952 Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Mon, 3 Jan 2022 15:13:44 +0100
Subject: [PATCH 1985/2409] Fix tempest upper-constraints

When deploying devstack in a stable branch, the master branch is
available locally only in a CI environment where Zuul prepares all
available branches. For a non-CI deployment we need to stick to using
the remote branch as was the case before [0].

While the situation on the master branch isn't really broken, we apply
the fix here anyway so that future stable branches are created in a
working state.

[0] I5d42ac6b54bf20804d7e5faa39d1289102318b64

Closes-Bug: #1956219
Signed-off-by: Dr. Jens Harbott <harbott@osism.tech>
Change-Id: Ib7719cb2d48b34db70f885e0afe77d904abba3b5
---
 lib/tempest | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index bdbd3caec8..adffeda371 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -119,7 +119,9 @@ function set_tempest_venv_constraints {
     local tmp_c
     tmp_c=$1
     if [[ $TEMPEST_VENV_UPPER_CONSTRAINTS == "master" ]]; then
-        (cd $REQUIREMENTS_DIR && git show master:upper-constraints.txt) > $tmp_c
+        (cd $REQUIREMENTS_DIR &&
+            git show master:upper-constraints.txt 2>/dev/null ||
+            git show origin/master:upper-constraints.txt) > $tmp_c
     else
         echo "Using $TEMPEST_VENV_UPPER_CONSTRAINTS constraints in Tempest virtual env."
         cat $TEMPEST_VENV_UPPER_CONSTRAINTS > $tmp_c

From 4448f243f396c502e34fda5bb148ba0224f934e7 Mon Sep 17 00:00:00 2001
From: Eduardo Santos <eduardo.experimental@gmail.com>
Date: Thu, 6 Jan 2022 14:03:16 -0300
Subject: [PATCH 1986/2409] Fix public subnet creation command

There was no space after the --project option in the command that
creates the public subnet, thus if any option follows, the option itself
will be parsed as part of the value passed to the --project option. This
change just adds the missing space.

Change-Id: I1e7375578342a82717222e902fcd65a4a62e33a7
---
 lib/neutron_plugins/services/l3 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index ccb5398f75..a8844c475e 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -305,7 +305,7 @@ function _neutron_create_public_subnet_v4 {
     local admin_project_id
     admin_project_id=$(openstack project list | grep " admin " | get_field 1)
     die_if_not_set $LINENO admin_project_id "Failure retrieving project_id for admin"
-    local subnet_params="--ip-version 4 --project $admin_project_id"
+    local subnet_params="--ip-version 4 --project $admin_project_id "
     subnet_params+="${Q_FLOATING_ALLOCATION_POOL:+--allocation-pool $Q_FLOATING_ALLOCATION_POOL} "
     if [[ -n "$PUBLIC_NETWORK_GATEWAY" ]]; then
         subnet_params+="--gateway $PUBLIC_NETWORK_GATEWAY "

From ac958698d0e29cc0bc4bbad4476fc7bc01ed870d Mon Sep 17 00:00:00 2001
From: Ade Lee <alee@redhat.com>
Date: Wed, 5 Jan 2022 16:23:46 -0500
Subject: [PATCH 1987/2409] Only set chap algorithms if not openeuler

For some reason, setting the CHAPAlgorithms as in c3b705138
breaks OpenEuler.  Making this conditional so that tests continue
to pass.

Change-Id: Iaa740ecfbb9173dd97e90485bad88225caedb523
---
 lib/nova | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/lib/nova b/lib/nova
index 5a12da6731..4f98d4d52c 100644
--- a/lib/nova
+++ b/lib/nova
@@ -320,8 +320,12 @@ EOF
         fi
 
         # set chap algorithms.  The default chap_algorithm is md5 which will
-        # not work under FIPS
-        iniset -sudo /etc/iscsi/iscsid.conf DEFAULT "node.session.auth.chap_algs" "SHA3-256,SHA256"
+        # not work under FIPS.
+        # FIXME(alee) For some reason, this breaks openeuler.  Openeuler devs should weigh in
+        # and determine the correct solution for openeuler here
+        if ! is_openeuler; then
+            iniset -sudo /etc/iscsi/iscsid.conf DEFAULT "node.session.auth.chap_algs" "SHA3-256,SHA256"
+        fi
 
         # ensure that iscsid is started, even when disabled by default
         restart_service iscsid

From 807330ac370e8d0130cea2a99363cd3299422837 Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Fri, 7 Jan 2022 11:40:54 +0100
Subject: [PATCH 1988/2409] Fix cloning requirements when GIT_DEPTH is set

We always need the master branch of requirements in order to be able to
install tempest with it, so override GIT_DEPTH when cloning that repo.

Closes-Bug: 1956616
Change-Id: Id0b409bfadd73f2c30314724178d6e199121050b
Signed-off-by: Dr. Jens Harbott <harbott@osism.tech>
---
 stack.sh | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index 0659212ab3..c92cc79b40 100755
--- a/stack.sh
+++ b/stack.sh
@@ -765,7 +765,9 @@ save_stackenv $LINENO
 # Bring down global requirements before any use of pip_install. This is
 # necessary to ensure that the constraints file is in place before we
 # attempt to apply any constraints to pip installs.
-git_clone $REQUIREMENTS_REPO $REQUIREMENTS_DIR $REQUIREMENTS_BRANCH
+# We always need the master branch in addition to any stable branch, so
+# override GIT_DEPTH here.
+GIT_DEPTH=0 git_clone $REQUIREMENTS_REPO $REQUIREMENTS_DIR $REQUIREMENTS_BRANCH
 
 # Install package requirements
 # Source it so the entire environment is available

From cc6e20b24d22475720f7b938aa08edf9ee7514fb Mon Sep 17 00:00:00 2001
From: Carlos Camacho <carloscamachoucv@gmail.com>
Date: Fri, 7 Jan 2022 15:30:56 +0100
Subject: [PATCH 1989/2409] Allow skip the database server installation

This patch allows to skip the installation
of the database backend packages (MySQL or Postgres)
with the introduction of the INSTALL_DATABASE_SERVER_PACKAGES
variable (defaulted to True).
This is useful in such environments that do not require
to install the MySQL/Postgres server packages directly but using
a container serving that purpose, for those cases all the
remaining steps should be executed just skipping the
packages install.

Change-Id: I26628a31fdda3ce95ed04a2b7ae7b132c288581f
---
 lib/databases/mysql      | 27 +++++++++++++++------------
 lib/databases/postgresql | 20 +++++++++++---------
 2 files changed, 26 insertions(+), 21 deletions(-)

diff --git a/lib/databases/mysql b/lib/databases/mysql
index 8edbf8c4a4..30e4b7c496 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -12,6 +12,7 @@ _XTRACE_DB_MYSQL=$(set +o | grep xtrace)
 set +o xtrace
 
 MYSQL_DRIVER=${MYSQL_DRIVER:-PyMySQL}
+INSTALL_DATABASE_SERVER_PACKAGES=$(trueorfalse True INSTALL_DATABASE_SERVER_PACKAGES)
 
 register_database mysql
 
@@ -175,18 +176,20 @@ EOF
         chmod 0600 $HOME/.my.cnf
     fi
     # Install mysql-server
-    if is_oraclelinux; then
-        install_package mysql-community-server
-    elif is_fedora; then
-        install_package mariadb-server mariadb-devel mariadb
-        sudo systemctl enable $MYSQL_SERVICE_NAME
-    elif is_suse; then
-        install_package mariadb-server
-        sudo systemctl enable $MYSQL_SERVICE_NAME
-    elif is_ubuntu; then
-        install_package $MYSQL_SERVICE_NAME-server
-    else
-        exit_distro_not_supported "mysql installation"
+    if [[ "$INSTALL_DATABASE_SERVER_PACKAGES" == "True" ]]; then
+        if is_oraclelinux; then
+            install_package mysql-community-server
+        elif is_fedora; then
+            install_package mariadb-server mariadb-devel mariadb
+            sudo systemctl enable $MYSQL_SERVICE_NAME
+        elif is_suse; then
+            install_package mariadb-server
+            sudo systemctl enable $MYSQL_SERVICE_NAME
+        elif is_ubuntu; then
+            install_package $MYSQL_SERVICE_NAME-server
+        else
+            exit_distro_not_supported "mysql installation"
+        fi
     fi
 }
 
diff --git a/lib/databases/postgresql b/lib/databases/postgresql
index 1f347f5548..4f0a5a0a4c 100644
--- a/lib/databases/postgresql
+++ b/lib/databases/postgresql
@@ -13,7 +13,7 @@ set +o xtrace
 
 
 MAX_DB_CONNECTIONS=${MAX_DB_CONNECTIONS:-200}
-
+INSTALL_DATABASE_SERVER_PACKAGES=$(trueorfalse True INSTALL_DATABASE_SERVER_PACKAGES)
 
 register_database postgresql
 
@@ -104,15 +104,17 @@ EOF
     else
         sed -i "s/:root:\w\+/:root:$DATABASE_PASSWORD/" $pgpass
     fi
-    if is_ubuntu; then
-        install_package postgresql
-    elif is_fedora || is_suse; then
-        install_package postgresql-server
-        if is_fedora; then
-            sudo systemctl enable postgresql
+    if [[ "$INSTALL_DATABASE_SERVER_PACKAGES" == "True" ]]; then
+        if is_ubuntu; then
+            install_package postgresql
+        elif is_fedora || is_suse; then
+            install_package postgresql-server
+            if is_fedora; then
+                sudo systemctl enable postgresql
+            fi
+        else
+            exit_distro_not_supported "postgresql installation"
         fi
-    else
-        exit_distro_not_supported "postgresql installation"
     fi
 }
 

From c994dc4de23620f74b750932e060306a27193add Mon Sep 17 00:00:00 2001
From: elajkat <lajos.katona@est.tech>
Date: Thu, 6 Jan 2022 11:28:55 +0100
Subject: [PATCH 1990/2409] Deprecate lib/neutron

lib/neutron-legacy was recently undeprecated (see [0]), Openstack CI
uses neutron-legacy and latest work was done in it also.
To avoid double maintenance lib/neutron can be deprecated.

For latest discussion see [1] and [2].

[0]: https://review.opendev.org/c/openstack/devstack/+/704829
[1]: https://meetings.opendev.org/meetings/networking/2022/networking.2022-01-04-14.04.log.html#l-52
[2]: https://meetings.opendev.org/irclogs/%23openstack-qa/%23openstack-qa.2022-01-05.log.html#t2022-01-05T15:57:37

Related-Bug: #1955765
Change-Id: I3fc328b7f47ccd7c1a97cceeea98fb2fbd609017
---
 lib/neutron | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/lib/neutron b/lib/neutron
index 15d548e33d..e7719d4ebc 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -146,6 +146,7 @@ fi
 # cleanup_neutron() - Remove residual data files, anything left over from previous
 # runs that a clean run would need to clean up
 function cleanup_neutron_new {
+    deprecated "Using lib/neutron is deprecated, and it will be removed in AA release!"
     source $TOP_DIR/lib/neutron_plugins/${NEUTRON_AGENT}_agent
     if is_neutron_ovs_base_plugin; then
         neutron_ovs_base_cleanup
@@ -169,6 +170,7 @@ function configure_root_helper_options {
 
 # configure_neutron() - Set config files, create data dirs, etc
 function configure_neutron_new {
+    deprecated "Using lib/neutron is deprecated, and it will be removed in AA release!"
     sudo install -d -o $STACK_USER $NEUTRON_CONF_DIR
 
     (cd $NEUTRON_DIR && exec ./tools/generate_config_file_samples.sh)
@@ -359,6 +361,7 @@ function configure_neutron_rootwrap {
 # Takes a single optional argument which is the config file to update,
 # if not passed $NOVA_CONF is used.
 function configure_neutron_nova_new {
+    deprecated "Using lib/neutron is deprecated, and it will be removed in AA release!"
     local conf=${1:-$NOVA_CONF}
     iniset $conf neutron auth_type "password"
     iniset $conf neutron auth_url "$KEYSTONE_SERVICE_URI"
@@ -385,6 +388,7 @@ function configure_neutron_nova_new {
 
 # create_neutron_accounts() - Create required service accounts
 function create_neutron_accounts_new {
+    deprecated "Using lib/neutron is deprecated, and it will be removed in AA release!"
     local neutron_url
 
     if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
@@ -408,6 +412,7 @@ function create_neutron_accounts_new {
 # init_neutron() - Initialize databases, etc.
 function init_neutron_new {
 
+    deprecated "Using lib/neutron is deprecated, and it will be removed in AA release!"
     recreate_database neutron
 
     time_start "dbsync"
@@ -418,6 +423,7 @@ function init_neutron_new {
 
 # install_neutron() - Collect source and prepare
 function install_neutron_new {
+    deprecated "Using lib/neutron is deprecated, and it will be removed in AA release!"
     git_clone $NEUTRON_REPO $NEUTRON_DIR $NEUTRON_BRANCH
     setup_develop $NEUTRON_DIR
 
@@ -491,6 +497,7 @@ function start_neutron_api {
 
 # start_neutron() - Start running processes
 function start_neutron_new {
+    deprecated "Using lib/neutron is deprecated, and it will be removed in AA release!"
     # Start up the neutron agents if enabled
     # TODO(sc68cal) Make this pluggable so different DevStack plugins for different Neutron plugins
     # can resolve the $NEUTRON_AGENT_BINARY
@@ -528,6 +535,7 @@ function start_neutron_new {
 
 # stop_neutron() - Stop running processes
 function stop_neutron_new {
+    deprecated "Using lib/neutron is deprecated, and it will be removed in AA release!"
     for serv in neutron-api neutron-agent neutron-l3; do
         stop_process $serv
     done
@@ -550,6 +558,7 @@ function stop_neutron_new {
 
 # neutron_service_plugin_class_add() - add service plugin class
 function neutron_service_plugin_class_add_new {
+    deprecated "Using lib/neutron is deprecated, and it will be removed in AA release!"
     local service_plugin_class=$1
     local plugins=""
 
@@ -574,11 +583,13 @@ function _neutron_ml2_extension_driver_add {
 }
 
 function neutron_server_config_add_new {
+    deprecated "Using lib/neutron is deprecated, and it will be removed in AA release!"
     _NEUTRON_SERVER_EXTRA_CONF_FILES_ABS+=($1)
 }
 
 # neutron_deploy_rootwrap_filters() - deploy rootwrap filters
 function neutron_deploy_rootwrap_filters_new {
+    deprecated "Using lib/neutron is deprecated, and it will be removed in AA release!"
     local srcdir=$1
     sudo install -d -o root -g root -m 755 $NEUTRON_CONF_DIR/rootwrap.d
     sudo install -o root -g root -m 644 $srcdir/etc/neutron/rootwrap.d/*.filters $NEUTRON_CONF_DIR/rootwrap.d

From d5d0bed479497560489983ae1fc80444b44fe029 Mon Sep 17 00:00:00 2001
From: yatinkarel <ykarel@redhat.com>
Date: Mon, 17 Jan 2022 12:04:16 +0530
Subject: [PATCH 1991/2409] Workaround CentOS 8-stream bug until fixed

Recent iputils release in CentOS 8-stream causing
ping failures with non root user. This needs a fix
in systemd package as mentioned in the Related Bugs,
until it's fixed and is in 8-stream mirrors let's
workaround it by setting net.ipv4.ping_group_range
setting manually.

Related-Bug: #1957941
Related-Bug: rhbz#2037807
Change-Id: I0d8dac910647968b625020c2a94e626ba5255058
---
 tools/fixup_stuff.sh | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index 750849db68..f24ac40ad5 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -83,6 +83,11 @@ function fixup_fedora {
     if is_package_installed python3-setuptools; then
         sudo dnf reinstall -y python3-setuptools
     fi
+    # Workaround CentOS 8-stream iputils and systemd Bug
+    # https://bugzilla.redhat.com/show_bug.cgi?id=2037807
+    if [[ $os_VENDOR == "CentOSStream" && $os_RELEASE -eq 8 ]]; then
+        sudo sysctl -w net.ipv4.ping_group_range='0 2147483647'
+    fi
 }
 
 function fixup_suse {

From 0a31630323cc172561d6544c8bee50004538cfb2 Mon Sep 17 00:00:00 2001
From: Pierre Riteau <pierre@stackhpc.com>
Date: Fri, 21 Jan 2022 10:07:07 +0100
Subject: [PATCH 1992/2409] Adapt compute node local.conf to OVN

The default Neutron configuration is now using OVN, but the multinode
lab was using an incompatible configuration:

    The q-agt/neutron-agt service must be disabled with OVN.

Change-Id: I518a739a3daac941880463cde6b47951331d0911
---
 doc/source/guides/multinode-lab.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
index c0b3f58157..f62e7a969c 100644
--- a/doc/source/guides/multinode-lab.rst
+++ b/doc/source/guides/multinode-lab.rst
@@ -169,7 +169,7 @@ machines, create a ``local.conf`` with:
     MYSQL_HOST=$SERVICE_HOST
     RABBIT_HOST=$SERVICE_HOST
     GLANCE_HOSTPORT=$SERVICE_HOST:9292
-    ENABLED_SERVICES=n-cpu,q-agt,c-vol,placement-client
+    ENABLED_SERVICES=n-cpu,c-vol,placement-client,ovn-controller,ovs-vswitchd,ovsdb-server,q-ovn-metadata-agent
     NOVA_VNC_ENABLED=True
     NOVNCPROXY_URL="http://$SERVICE_HOST:6080/vnc_lite.html"
     VNCSERVER_LISTEN=$HOST_IP

From d6909e41af4b776e68fb133a31ff086fdaff38ff Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Sat, 22 Jan 2022 13:54:12 +0100
Subject: [PATCH 1993/2409] Use distro pip on Ubuntu

Running get-pip.py fails on Ubuntu when running twice, e.g. after a
unstack/stack cycle. Just use distro pip instead.

Closes-Bug: #1957048
Signed-off-by: Dr. Jens Harbott <harbott@osism.tech>
Change-Id: I87a8d53ed8860dd017a6c826dee6b6f4baef3c96
---
 tools/install_pip.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index 259375a150..5d73a1f0d8 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -129,6 +129,8 @@ if is_fedora && [[ ${DISTRO} == f* || ${DISTRO} == rhel9 ]]; then
     # For general sanity, we just use the packaged pip.  It should be
     # recent enough anyway.  This is included via rpms/general
     : # Simply fall through
+elif is_ubuntu; then
+    : # pip on Ubuntu 20.04 is new enough, too
 else
     install_get_pip
 fi

From ae40825df618a6b8164be8345f5cc1b11a2dc614 Mon Sep 17 00:00:00 2001
From: Grzegorz Grasza <xek@redhat.com>
Date: Tue, 26 Oct 2021 10:37:07 +0200
Subject: [PATCH 1994/2409] Use devstack-system-admin for keystone objects
 creation

This is needed so we can set keystone into enforcing secure RBAC.
This also adjusts lib/glance, which already partially used
devstack-system-admin.

Change-Id: I6df8ad23a3077a8420340167a748ae23ad094962
---
 functions-common | 46 +++++++++++++++++++++++-----------------------
 lib/glance       |  6 +++---
 2 files changed, 26 insertions(+), 26 deletions(-)

diff --git a/functions-common b/functions-common
index 7042408f40..7a83b4bc5c 100644
--- a/functions-common
+++ b/functions-common
@@ -867,10 +867,10 @@ function get_or_create_domain {
     # Gets domain id
     domain_id=$(
         # Gets domain id
-        openstack domain show $1 \
+        openstack --os-cloud devstack-system-admin domain show $1 \
             -f value -c id 2>/dev/null ||
         # Creates new domain
-        openstack domain create $1 \
+        openstack --os-cloud devstack-system-admin domain create $1 \
             --description "$2" \
             -f value -c id
     )
@@ -885,7 +885,7 @@ function get_or_create_group {
     # Gets group id
     group_id=$(
         # Creates new group with --or-show
-        openstack group create $1 \
+        openstack --os-cloud devstack-system-admin group create $1 \
             --domain $2 --description "$desc" --or-show \
             -f value -c id
     )
@@ -904,7 +904,7 @@ function get_or_create_user {
     # Gets user id
     user_id=$(
         # Creates new user with --or-show
-        openstack user create \
+        openstack --os-cloud devstack-system-admin user create \
             $1 \
             --password "$2" \
             --domain=$3 \
@@ -921,7 +921,7 @@ function get_or_create_project {
     local project_id
     project_id=$(
         # Creates new project with --or-show
-        openstack project create $1 \
+        openstack --os-cloud devstack-system-admin project create $1 \
             --domain=$2 \
             --or-show -f value -c id
     )
@@ -934,7 +934,7 @@ function get_or_create_role {
     local role_id
     role_id=$(
         # Creates role with --or-show
-        openstack role create $1 \
+        openstack --os-cloud devstack-system-admin role create $1 \
             --or-show -f value -c id
     )
     echo $role_id
@@ -964,7 +964,7 @@ function get_or_add_user_project_role {
     domain_args=$(_get_domain_args $4 $5)
 
     # Gets user role id
-    user_role_id=$(openstack role assignment list \
+    user_role_id=$(openstack --os-cloud devstack-system-admin role assignment list \
         --role $1 \
         --user $2 \
         --project $3 \
@@ -972,11 +972,11 @@ function get_or_add_user_project_role {
         | grep '^|\s[a-f0-9]\+' | get_field 1)
     if [[ -z "$user_role_id" ]]; then
         # Adds role to user and get it
-        openstack role add $1 \
+        openstack --os-cloud devstack-system-admin role add $1 \
             --user $2 \
             --project $3 \
             $domain_args
-        user_role_id=$(openstack role assignment list \
+        user_role_id=$(openstack --os-cloud devstack-system-admin role assignment list \
             --role $1 \
             --user $2 \
             --project $3 \
@@ -991,17 +991,17 @@ function get_or_add_user_project_role {
 function get_or_add_user_domain_role {
     local user_role_id
     # Gets user role id
-    user_role_id=$(openstack role assignment list \
+    user_role_id=$(openstack --os-cloud devstack-system-admin role assignment list \
         --role $1 \
         --user $2 \
         --domain $3 \
         | grep '^|\s[a-f0-9]\+' | get_field 1)
     if [[ -z "$user_role_id" ]]; then
         # Adds role to user and get it
-        openstack role add $1 \
+        openstack --os-cloud devstack-system-admin role add $1 \
             --user $2 \
             --domain $3
-        user_role_id=$(openstack role assignment list \
+        user_role_id=$(openstack --os-cloud devstack-system-admin role assignment list \
             --role $1 \
             --user $2 \
             --domain $3 \
@@ -1019,7 +1019,7 @@ function get_or_add_user_system_role {
     domain_args=$(_get_domain_args $4)
 
     # Gets user role id
-    user_role_id=$(openstack role assignment list \
+    user_role_id=$(openstack --os-cloud devstack-system-admin role assignment list \
         --role $1 \
         --user $2 \
         --system $3 \
@@ -1027,11 +1027,11 @@ function get_or_add_user_system_role {
         -f value -c Role)
     if [[ -z "$user_role_id" ]]; then
         # Adds role to user and get it
-        openstack role add $1 \
+        openstack --os-cloud devstack-system-admin role add $1 \
             --user $2 \
             --system $3 \
             $domain_args
-        user_role_id=$(openstack role assignment list \
+        user_role_id=$(openstack --os-cloud devstack-system-admin role assignment list \
             --role $1 \
             --user $2 \
             --system $3 \
@@ -1046,17 +1046,17 @@ function get_or_add_user_system_role {
 function get_or_add_group_project_role {
     local group_role_id
     # Gets group role id
-    group_role_id=$(openstack role assignment list \
+    group_role_id=$(openstack --os-cloud devstack-system-admin role assignment list \
         --role $1 \
         --group $2 \
         --project $3 \
         -f value)
     if [[ -z "$group_role_id" ]]; then
         # Adds role to group and get it
-        openstack role add $1 \
+        openstack --os-cloud devstack-system-admin role add $1 \
             --group $2 \
             --project $3
-        group_role_id=$(openstack role assignment list \
+        group_role_id=$(openstack --os-cloud devstack-system-admin role assignment list \
             --role $1 \
             --group $2 \
             --project $3 \
@@ -1072,9 +1072,9 @@ function get_or_create_service {
     # Gets service id
     service_id=$(
         # Gets service id
-        openstack service show $2 -f value -c id 2>/dev/null ||
+        openstack --os-cloud devstack-system-admin service show $2 -f value -c id 2>/dev/null ||
         # Creates new service if not exists
-        openstack service create \
+        openstack --os-cloud devstack-system-admin service create \
             $2 \
             --name $1 \
             --description="$3" \
@@ -1087,14 +1087,14 @@ function get_or_create_service {
 # Usage: _get_or_create_endpoint_with_interface <service> <interface> <url> <region>
 function _get_or_create_endpoint_with_interface {
     local endpoint_id
-    endpoint_id=$(openstack endpoint list \
+    endpoint_id=$(openstack --os-cloud devstack-system-admin endpoint list \
         --service $1 \
         --interface $2 \
         --region $4 \
         -c ID -f value)
     if [[ -z "$endpoint_id" ]]; then
         # Creates new endpoint
-        endpoint_id=$(openstack endpoint create \
+        endpoint_id=$(openstack --os-cloud devstack-system-admin endpoint create \
             $1 $2 $3 --region $4 -f value -c id)
     fi
 
@@ -1128,7 +1128,7 @@ function get_or_create_endpoint {
 # Get a URL from the identity service
 # Usage: get_endpoint_url <service> <interface>
 function get_endpoint_url {
-    echo $(openstack endpoint list \
+    echo $(openstack --os-cloud devstack-system-admin endpoint list \
             --service $1 --interface $2 \
             -c URL -f value)
 }
diff --git a/lib/glance b/lib/glance
index 4c2755f76f..9bba938b9d 100644
--- a/lib/glance
+++ b/lib/glance
@@ -311,11 +311,11 @@ function configure_glance_quotas {
     iniset $GLANCE_API_CONF oslo_limit auth_url $KEYSTONE_SERVICE_URI
     iniset $GLANCE_API_CONF oslo_limit system_scope "'all'"
     iniset $GLANCE_API_CONF oslo_limit endpoint_id \
-           $(openstack endpoint list --service glance -f value -c ID)
+           $(openstack --os-cloud devstack-system-admin endpoint list --service glance -f value -c ID)
 
     # Allow the glance service user to read quotas
-    openstack role add --user glance --user-domain Default --system all \
-              reader
+    openstack --os-cloud devstack-system-admin role add --user glance --user-domain Default \
+        --system all reader
 }
 
 # configure_glance() - Set config files, create data dirs, etc

From 5f5002a3781e255a16711f99cb784a28d6f27258 Mon Sep 17 00:00:00 2001
From: Grzegorz Grasza <xek@redhat.com>
Date: Tue, 26 Oct 2021 10:50:37 +0200
Subject: [PATCH 1995/2409] Revert "Revert "Add enforce_scope setting support
 for keystone""

This reverts commit 26bd94b45efb63683072006e4281dd34a313d881.

Reason for revert: Devstack keystone creation/setup are moved to
scope tokens, so we can reintroduce the scope check enable.

Change-Id: I6e1c261196dbcaf632748fb6f04e0867648b76c7
---
 lib/keystone | 11 +++++++++++
 lib/tempest  |  9 +++++++++
 2 files changed, 20 insertions(+)

diff --git a/lib/keystone b/lib/keystone
index b953972dd3..a4c8a52121 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -124,6 +124,12 @@ KEYSTONE_ENABLE_CACHE=${KEYSTONE_ENABLE_CACHE:-True}
 # Whether to create a keystone admin endpoint for legacy applications
 KEYSTONE_ADMIN_ENDPOINT=$(trueorfalse False KEYSTONE_ADMIN_ENDPOINT)
 
+# Flag to set the oslo_policy.enforce_scope. This is used to switch
+# the Identity API policies to start checking the scope of token. By Default,
+# this flag is False.
+# For more detail: https://docs.openstack.org/oslo.policy/latest/configuration/index.html#oslo_policy.enforce_scope
+KEYSTONE_ENFORCE_SCOPE=$(trueorfalse False KEYSTONE_ENFORCE_SCOPE)
+
 # Functions
 # ---------
 
@@ -259,6 +265,11 @@ function configure_keystone {
         iniset $KEYSTONE_CONF security_compliance lockout_duration $KEYSTONE_LOCKOUT_DURATION
         iniset $KEYSTONE_CONF security_compliance unique_last_password_count $KEYSTONE_UNIQUE_LAST_PASSWORD_COUNT
     fi
+    if [[ "$KEYSTONE_ENFORCE_SCOPE" == True ]] ; then
+        iniset $KEYSTONE_CONF oslo_policy enforce_scope true
+        iniset $KEYSTONE_CONF oslo_policy enforce_new_defaults true
+        iniset $KEYSTONE_CONF oslo_policy policy_file policy.yaml
+    fi
 }
 
 # create_keystone_accounts() - Sets up common required keystone accounts
diff --git a/lib/tempest b/lib/tempest
index adffeda371..9d5e1fce9f 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -608,6 +608,15 @@ function configure_tempest {
         fi
     done
 
+    # ``enforce_scope``
+    # If services enable the enforce_scope for their policy
+    # we need to enable the same on Tempest side so that
+    # test can be run with scoped token.
+    if [[ "$KEYSTONE_ENFORCE_SCOPE" == True ]] ; then
+        iniset $TEMPEST_CONFIG enforce_scope keystone true
+        iniset $TEMPEST_CONFIG auth admin_system 'all'
+        iniset $TEMPEST_CONFIG auth admin_project_name ''
+    fi
     iniset $TEMPEST_CONFIG enforce_scope glance "$GLANCE_ENFORCE_SCOPE"
 
     iniset $TEMPEST_CONFIG enforce_scope cinder "$CINDER_ENFORCE_SCOPE"

From be7b5bf671b4cdc082fb9b7bb73ec55cab0054dd Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Thu, 27 Jan 2022 16:04:32 +0100
Subject: [PATCH 1996/2409] Disable enforcing scopes in Neutron temporary

After patch [1] was merged in Neutron, enforcing scopes there
is broken.
So lets disable it temporary to unblock Devstack's gate for now.

[1] https://review.opendev.org/c/openstack/neutron/+/821208

Related-Bug: #1959196
Change-Id: I24da6f3897a638749d16f738329a873a5f9a291d
---
 .zuul.yaml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 248a56beb9..5a58d743fe 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -619,7 +619,9 @@
         # Keep enabeling the services here to run with system scope
         CINDER_ENFORCE_SCOPE: true
         GLANCE_ENFORCE_SCOPE: true
-        NEUTRON_ENFORCE_SCOPE: true
+        # TODO(slaweq): Enable enforce scopes in Neutron when bug
+        # https://bugs.launchpad.net/neutron/+bug/1959196 will be fixed
+        # NEUTRON_ENFORCE_SCOPE: true
 
 - job:
     name: devstack-multinode

From 1fd45940f370dc3aab6a5e9492c36e735f673c8a Mon Sep 17 00:00:00 2001
From: Ade Lee <alee@redhat.com>
Date: Tue, 25 Jan 2022 16:44:36 -0500
Subject: [PATCH 1997/2409] Add openstack-two-node-centos-8-stream

This will allow multinode FIPS testing

Change-Id: I82b3b8fe56275aed72e13f6d1bd9170c50e5da0d
---
 .zuul.yaml | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index 248a56beb9..ea7708f751 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -146,6 +146,36 @@
         nodes:
           - compute1
 
+- nodeset:
+    name: openstack-two-node-centos-8-stream
+    nodes:
+      - name: controller
+        label: centos-8-stream
+      - name: compute1
+        label: centos-8-stream
+    groups:
+      # Node where tests are executed and test results collected
+      - name: tempest
+        nodes:
+          - controller
+      # Nodes running the compute service
+      - name: compute
+        nodes:
+          - controller
+          - compute1
+      # Nodes that are not the controller
+      - name: subnode
+        nodes:
+          - compute1
+      # Switch node for multinode networking setup
+      - name: switch
+        nodes:
+          - controller
+      # Peer nodes for multinode networking setup
+      - name: peers
+        nodes:
+          - compute1
+
 - nodeset:
     name: openstack-two-node-focal
     nodes:

From 14a0c09001e8e2304eff4918206163cc7e6db1eb Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Fri, 28 Jan 2022 09:44:40 +0100
Subject: [PATCH 1998/2409] Fix deployment of Neutron with enforced scopes

After patch [1] new RBAC policies changed in the way that SYSTEM_ADMIN
user isn't anymore allowed to e.g. create resources in behalf of some
projects. Now PROJECT_ADMIN needs to create such resources instead.
So this patch basically reverts most of the changes which were done
in [2] some time ago.
It also introduces new entry in the clouds.yaml file -
"devstack-admin-demo" which is "admin" user in the "demo" project as
it's needed to create some resouces in the demo project now.

Additionally, because of bug [3] this patch changes way how IPv6
external gateway IP is found using Neutron API. This change may be
reverted in the future when bug [3] will be fixed.

[1] https://review.opendev.org/c/openstack/neutron/+/821208
[2] https://review.opendev.org/c/openstack/devstack/+/797450
[3] https://bugs.launchpad.net/neutron/+bug/1959332

Depends-On: https://review.opendev.org/c/openstack/neutron/+/826828

Closes-Bug: #1959196
Change-Id: I32a6e8b9b59269a8699644b563657363425f7174
---
 functions-common                | 11 +++++
 lib/neutron_plugins/services/l3 | 73 ++++++++++++++-------------------
 lib/tempest                     |  9 +---
 3 files changed, 44 insertions(+), 49 deletions(-)

diff --git a/functions-common b/functions-common
index 7042408f40..b407ca5fe6 100644
--- a/functions-common
+++ b/functions-common
@@ -107,6 +107,17 @@ function write_clouds_yaml {
         --os-password $ADMIN_PASSWORD \
         --os-project-name admin
 
+    # devstack-admin-demo: user with the admin role on the demo project
+    $PYTHON $TOP_DIR/tools/update_clouds_yaml.py \
+        --file $CLOUDS_YAML \
+        --os-cloud devstack-admin-demo \
+        --os-region-name $REGION_NAME \
+        $CA_CERT_ARG \
+        --os-auth-url $KEYSTONE_SERVICE_URI \
+        --os-username admin \
+        --os-password $ADMIN_PASSWORD \
+        --os-project-name demo
+
     # devstack-alt: user with the member role on alt_demo project
     $PYTHON $TOP_DIR/tools/update_clouds_yaml.py \
         --file $CLOUDS_YAML \
diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index a8844c475e..cd98115746 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -100,11 +100,6 @@ SUBNETPOOL_PREFIX_V6=${SUBNETPOOL_PREFIX_V6:-$IPV6_ADDRS_SAFE_TO_USE}
 SUBNETPOOL_SIZE_V4=${SUBNETPOOL_SIZE_V4:-26}
 SUBNETPOOL_SIZE_V6=${SUBNETPOOL_SIZE_V6:-64}
 
-NEUTRON_ADMIN_CLOUD_NAME="devstack-admin"
-if [ "$NEUTRON_ENFORCE_SCOPE" == "True" ]; then
-    NEUTRON_ADMIN_CLOUD_NAME="devstack-system-admin"
-fi
-
 default_v4_route_devs=$(ip -4 route | grep ^default | awk '{print $5}')
 
 default_v6_route_devs=$(ip -6 route list match default table all | grep via | awk '{print $5}')
@@ -156,10 +151,6 @@ function create_neutron_initial_network {
     project_id=$(openstack project list | grep " demo " | get_field 1)
     die_if_not_set $LINENO project_id "Failure retrieving project_id for demo"
 
-    local admin_project_id
-    admin_project_id=$(openstack project list | grep " admin " | get_field 1)
-    die_if_not_set $LINENO admin_project_id "Failure retrieving project_id for admin"
-
     # Allow drivers that need to create an initial network to do so here
     if type -p neutron_plugin_create_initial_network_profile > /dev/null; then
         neutron_plugin_create_initial_network_profile $PHYSICAL_NETWORK
@@ -168,10 +159,10 @@ function create_neutron_initial_network {
     if is_networking_extension_supported "auto-allocated-topology"; then
         if [[ "$USE_SUBNETPOOL" == "True" ]]; then
             if [[ "$IP_VERSION" =~ 4.* ]]; then
-                SUBNETPOOL_V4_ID=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" subnet pool create $SUBNETPOOL_NAME_V4 --project "$admin_project_id" --default-prefix-length $SUBNETPOOL_SIZE_V4 --pool-prefix $SUBNETPOOL_PREFIX_V4 --share --default -f value -c id)
+                SUBNETPOOL_V4_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet pool create $SUBNETPOOL_NAME_V4 --default-prefix-length $SUBNETPOOL_SIZE_V4 --pool-prefix $SUBNETPOOL_PREFIX_V4 --share --default -f value -c id)
             fi
             if [[ "$IP_VERSION" =~ .*6 ]]; then
-                SUBNETPOOL_V6_ID=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" subnet pool create $SUBNETPOOL_NAME_V6 --project "$admin_project_id" --default-prefix-length $SUBNETPOOL_SIZE_V6 --pool-prefix $SUBNETPOOL_PREFIX_V6 --share --default -f value -c id)
+                SUBNETPOOL_V6_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet pool create $SUBNETPOOL_NAME_V6 --default-prefix-length $SUBNETPOOL_SIZE_V6 --pool-prefix $SUBNETPOOL_PREFIX_V6 --share --default -f value -c id)
             fi
         fi
     fi
@@ -179,14 +170,14 @@ function create_neutron_initial_network {
     if is_provider_network; then
         die_if_not_set $LINENO PHYSICAL_NETWORK "You must specify the PHYSICAL_NETWORK"
         die_if_not_set $LINENO PROVIDER_NETWORK_TYPE "You must specify the PROVIDER_NETWORK_TYPE"
-        NET_ID=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" network create $PHYSICAL_NETWORK --project $project_id --provider-network-type $PROVIDER_NETWORK_TYPE --provider-physical-network "$PHYSICAL_NETWORK" ${SEGMENTATION_ID:+--provider-segment $SEGMENTATION_ID} --share | grep ' id ' | get_field 2)
+        NET_ID=$(openstack --os-cloud devstack-admin-demo --os-region "$REGION_NAME" network create $PHYSICAL_NETWORK --provider-network-type $PROVIDER_NETWORK_TYPE --provider-physical-network "$PHYSICAL_NETWORK" ${SEGMENTATION_ID:+--provider-segment $SEGMENTATION_ID} --share | grep ' id ' | get_field 2)
         die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PHYSICAL_NETWORK $project_id"
 
         if [[ "$IP_VERSION" =~ 4.* ]]; then
             if [ -z $SUBNETPOOL_V4_ID ]; then
                 fixed_range_v4=$FIXED_RANGE
             fi
-            SUBNET_ID=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" subnet create --project $project_id --ip-version 4 ${ALLOCATION_POOL:+--allocation-pool $ALLOCATION_POOL} $PROVIDER_SUBNET_NAME --gateway $NETWORK_GATEWAY ${SUBNETPOOL_V4_ID:+--subnet-pool $SUBNETPOOL_V4_ID} --network $NET_ID ${fixed_range_v4:+--subnet-range $fixed_range_v4} | grep ' id ' | get_field 2)
+            SUBNET_ID=$(openstack --os-cloud devstack --os-region "$REGION_NAME" subnet create --ip-version 4 ${ALLOCATION_POOL:+--allocation-pool $ALLOCATION_POOL} $PROVIDER_SUBNET_NAME --gateway $NETWORK_GATEWAY ${SUBNETPOOL_V4_ID:+--subnet-pool $SUBNETPOOL_V4_ID} --network $NET_ID ${fixed_range_v4:+--subnet-range $fixed_range_v4} | grep ' id ' | get_field 2)
             die_if_not_set $LINENO SUBNET_ID "Failure creating SUBNET_ID for $PROVIDER_SUBNET_NAME $project_id"
         fi
 
@@ -196,7 +187,7 @@ function create_neutron_initial_network {
             if [ -z $SUBNETPOOL_V6_ID ]; then
                 fixed_range_v6=$IPV6_PROVIDER_FIXED_RANGE
             fi
-            IPV6_SUBNET_ID=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" subnet create --project $project_id --ip-version 6 --gateway $IPV6_PROVIDER_NETWORK_GATEWAY $IPV6_PROVIDER_SUBNET_NAME ${SUBNETPOOL_V6_ID:+--subnet-pool $SUBNETPOOL_V6_ID} --network $NET_ID ${fixed_range_v6:+--subnet-range $fixed_range_v6} | grep ' id ' | get_field 2)
+            IPV6_SUBNET_ID=$(openstack --os-cloud devstack --os-region "$REGION_NAME" subnet create --ip-version 6 --gateway $IPV6_PROVIDER_NETWORK_GATEWAY $IPV6_PROVIDER_SUBNET_NAME ${SUBNETPOOL_V6_ID:+--subnet-pool $SUBNETPOOL_V6_ID} --network $NET_ID ${fixed_range_v6:+--subnet-range $fixed_range_v6} | grep ' id ' | get_field 2)
             die_if_not_set $LINENO IPV6_SUBNET_ID "Failure creating IPV6_SUBNET_ID for $IPV6_PROVIDER_SUBNET_NAME $project_id"
         fi
 
@@ -206,7 +197,7 @@ function create_neutron_initial_network {
             sudo ip link set $PUBLIC_INTERFACE up
         fi
     else
-        NET_ID=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" network create --project $project_id "$PRIVATE_NETWORK_NAME" | grep ' id ' | get_field 2)
+        NET_ID=$(openstack --os-cloud devstack --os-region "$REGION_NAME" network create "$PRIVATE_NETWORK_NAME" | grep ' id ' | get_field 2)
         die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PRIVATE_NETWORK_NAME $project_id"
 
         if [[ "$IP_VERSION" =~ 4.* ]]; then
@@ -224,11 +215,11 @@ function create_neutron_initial_network {
         # Create a router, and add the private subnet as one of its interfaces
         if [[ "$Q_L3_ROUTER_PER_TENANT" == "True" ]]; then
             # create a tenant-owned router.
-            ROUTER_ID=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" router create --project $project_id $Q_ROUTER_NAME | grep ' id ' | get_field 2)
+            ROUTER_ID=$(openstack --os-cloud devstack --os-region "$REGION_NAME" router create $Q_ROUTER_NAME | grep ' id ' | get_field 2)
             die_if_not_set $LINENO ROUTER_ID "Failure creating ROUTER_ID for $project_id $Q_ROUTER_NAME"
         else
             # Plugin only supports creating a single router, which should be admin owned.
-            ROUTER_ID=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" router create $Q_ROUTER_NAME --project $admin_project_id | grep ' id ' | get_field 2)
+            ROUTER_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" router create $Q_ROUTER_NAME | grep ' id ' | get_field 2)
             die_if_not_set $LINENO ROUTER_ID "Failure creating ROUTER_ID for $Q_ROUTER_NAME"
         fi
 
@@ -238,9 +229,9 @@ function create_neutron_initial_network {
         fi
         # Create an external network, and a subnet. Configure the external network as router gw
         if [ "$Q_USE_PROVIDERNET_FOR_PUBLIC" = "True" ]; then
-            EXT_NET_ID=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" network create "$PUBLIC_NETWORK_NAME" $EXTERNAL_NETWORK_FLAGS --provider-network-type ${PUBLIC_PROVIDERNET_TYPE:-flat} ${PUBLIC_PROVIDERNET_SEGMENTATION_ID:+--provider-segment $PUBLIC_PROVIDERNET_SEGMENTATION_ID} --provider-physical-network ${PUBLIC_PHYSICAL_NETWORK} --project $admin_project_id | grep ' id ' | get_field 2)
+            EXT_NET_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" network create "$PUBLIC_NETWORK_NAME" $EXTERNAL_NETWORK_FLAGS --provider-network-type ${PUBLIC_PROVIDERNET_TYPE:-flat} ${PUBLIC_PROVIDERNET_SEGMENTATION_ID:+--provider-segment $PUBLIC_PROVIDERNET_SEGMENTATION_ID} --provider-physical-network ${PUBLIC_PHYSICAL_NETWORK} | grep ' id ' | get_field 2)
         else
-            EXT_NET_ID=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" network create "$PUBLIC_NETWORK_NAME" $EXTERNAL_NETWORK_FLAGS --project $admin_project_id | grep ' id ' | get_field 2)
+            EXT_NET_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" network create "$PUBLIC_NETWORK_NAME" $EXTERNAL_NETWORK_FLAGS | grep ' id ' | get_field 2)
         fi
         die_if_not_set $LINENO EXT_NET_ID "Failure creating EXT_NET_ID for $PUBLIC_NETWORK_NAME"
 
@@ -262,8 +253,7 @@ function _neutron_create_private_subnet_v4 {
     if [ -z $SUBNETPOOL_V4_ID ]; then
         fixed_range_v4=$FIXED_RANGE
     fi
-    local subnet_params="--project $project_id "
-    subnet_params+="--ip-version 4 "
+    local subnet_params="--ip-version 4 "
     if [[ -n "$NETWORK_GATEWAY" ]]; then
         subnet_params+="--gateway $NETWORK_GATEWAY "
     fi
@@ -272,7 +262,7 @@ function _neutron_create_private_subnet_v4 {
     subnet_params+="${fixed_range_v4:+--subnet-range $fixed_range_v4} "
     subnet_params+="--network $NET_ID $PRIVATE_SUBNET_NAME"
     local subnet_id
-    subnet_id=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" subnet create $subnet_params | grep ' id ' | get_field 2)
+    subnet_id=$(openstack --os-cloud devstack-admin-demo --os-region "$REGION_NAME" subnet create $subnet_params | grep ' id ' | get_field 2)
     die_if_not_set $LINENO subnet_id "Failure creating private IPv4 subnet for $project_id"
     echo $subnet_id
 }
@@ -286,8 +276,7 @@ function _neutron_create_private_subnet_v6 {
     if [ -z $SUBNETPOOL_V6_ID ]; then
         fixed_range_v6=$FIXED_RANGE_V6
     fi
-    local subnet_params="--project $project_id "
-    subnet_params+="--ip-version 6 "
+    local subnet_params="--ip-version 6 "
     if [[ -n "$IPV6_PRIVATE_NETWORK_GATEWAY" ]]; then
         subnet_params+="--gateway $IPV6_PRIVATE_NETWORK_GATEWAY "
     fi
@@ -295,17 +284,14 @@ function _neutron_create_private_subnet_v6 {
     subnet_params+="${fixed_range_v6:+--subnet-range $fixed_range_v6} "
     subnet_params+="$ipv6_modes --network $NET_ID $IPV6_PRIVATE_SUBNET_NAME "
     local ipv6_subnet_id
-    ipv6_subnet_id=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" subnet create $subnet_params | grep ' id ' | get_field 2)
+    ipv6_subnet_id=$(openstack --os-cloud devstack-admin-demo --os-region "$REGION_NAME" subnet create $subnet_params | grep ' id ' | get_field 2)
     die_if_not_set $LINENO ipv6_subnet_id "Failure creating private IPv6 subnet for $project_id"
     echo $ipv6_subnet_id
 }
 
 # Create public IPv4 subnet
 function _neutron_create_public_subnet_v4 {
-    local admin_project_id
-    admin_project_id=$(openstack project list | grep " admin " | get_field 1)
-    die_if_not_set $LINENO admin_project_id "Failure retrieving project_id for admin"
-    local subnet_params="--ip-version 4 --project $admin_project_id "
+    local subnet_params="--ip-version 4 "
     subnet_params+="${Q_FLOATING_ALLOCATION_POOL:+--allocation-pool $Q_FLOATING_ALLOCATION_POOL} "
     if [[ -n "$PUBLIC_NETWORK_GATEWAY" ]]; then
         subnet_params+="--gateway $PUBLIC_NETWORK_GATEWAY "
@@ -313,29 +299,26 @@ function _neutron_create_public_subnet_v4 {
     subnet_params+="--network $EXT_NET_ID --subnet-range $FLOATING_RANGE --no-dhcp "
     subnet_params+="$PUBLIC_SUBNET_NAME"
     local id_and_ext_gw_ip
-    id_and_ext_gw_ip=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" subnet create $subnet_params | grep -e 'gateway_ip' -e ' id ')
+    id_and_ext_gw_ip=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet create $subnet_params | grep -e 'gateway_ip' -e ' id ')
     die_if_not_set $LINENO id_and_ext_gw_ip "Failure creating public IPv4 subnet"
     echo $id_and_ext_gw_ip
 }
 
 # Create public IPv6 subnet
 function _neutron_create_public_subnet_v6 {
-    local admin_project_id
-    admin_project_id=$(openstack project list | grep " admin " | get_field 1)
-    die_if_not_set $LINENO admin_project_id "Failure retrieving project_id for admin"
-    local subnet_params="--ip-version 6 --project $admin_project_id "
+    local subnet_params="--ip-version 6 "
     subnet_params+="--gateway $IPV6_PUBLIC_NETWORK_GATEWAY "
     subnet_params+="--network $EXT_NET_ID --subnet-range $IPV6_PUBLIC_RANGE --no-dhcp "
     subnet_params+="$IPV6_PUBLIC_SUBNET_NAME"
     local ipv6_id_and_ext_gw_ip
-    ipv6_id_and_ext_gw_ip=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" subnet create $subnet_params | grep -e 'gateway_ip' -e ' id ')
+    ipv6_id_and_ext_gw_ip=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet create $subnet_params | grep -e 'gateway_ip' -e ' id ')
     die_if_not_set $LINENO ipv6_id_and_ext_gw_ip "Failure creating an IPv6 public subnet"
     echo $ipv6_id_and_ext_gw_ip
 }
 
 # Configure neutron router for IPv4 public access
 function _neutron_configure_router_v4 {
-    openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" router add subnet $ROUTER_ID $SUBNET_ID
+    openstack --os-cloud devstack-admin-demo --os-region "$REGION_NAME" router add subnet $ROUTER_ID $SUBNET_ID
     # Create a public subnet on the external network
     local id_and_ext_gw_ip
     id_and_ext_gw_ip=$(_neutron_create_public_subnet_v4 $EXT_NET_ID)
@@ -343,7 +326,7 @@ function _neutron_configure_router_v4 {
     ext_gw_ip=$(echo $id_and_ext_gw_ip  | get_field 2)
     PUB_SUBNET_ID=$(echo $id_and_ext_gw_ip | get_field 5)
     # Configure the external network as the default router gateway
-    openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" router set --external-gateway $EXT_NET_ID $ROUTER_ID
+    openstack --os-cloud devstack-admin-demo --os-region "$REGION_NAME" router set --external-gateway $EXT_NET_ID $ROUTER_ID
 
     # This logic is specific to using OVN or the l3-agent for layer 3
     if ([[ $Q_AGENT == "ovn" ]] && [[ "$OVN_L3_CREATE_PUBLIC_NETWORK" == "True" ]] && is_service_enabled q-svc neutron-server) || is_service_enabled q-l3 neutron-l3; then
@@ -370,7 +353,7 @@ function _neutron_configure_router_v4 {
                 sudo ip addr add $ext_gw_ip/$cidr_len dev $ext_gw_interface
                 sudo ip link set $ext_gw_interface up
             fi
-            ROUTER_GW_IP=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" port list -c 'Fixed IP Addresses' --device-owner network:router_gateway | awk -F'ip_address'  '{ print $2 }' | cut -f2 -d\' | tr '\n' ' ')
+            ROUTER_GW_IP=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" port list -c 'Fixed IP Addresses' --device-owner network:router_gateway | awk -F'ip_address'  '{ print $2 }' | cut -f2 -d\' | tr '\n' ' ')
             die_if_not_set $LINENO ROUTER_GW_IP "Failure retrieving ROUTER_GW_IP"
         fi
         _neutron_set_router_id
@@ -379,7 +362,7 @@ function _neutron_configure_router_v4 {
 
 # Configure neutron router for IPv6 public access
 function _neutron_configure_router_v6 {
-    openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" router add subnet $ROUTER_ID $IPV6_SUBNET_ID
+    openstack --os-cloud devstack-admin-demo --os-region "$REGION_NAME" router add subnet $ROUTER_ID $IPV6_SUBNET_ID
     # Create a public subnet on the external network
     local ipv6_id_and_ext_gw_ip
     ipv6_id_and_ext_gw_ip=$(_neutron_create_public_subnet_v6 $EXT_NET_ID)
@@ -391,7 +374,7 @@ function _neutron_configure_router_v6 {
     # If the external network has not already been set as the default router
     # gateway when configuring an IPv4 public subnet, do so now
     if [[ "$IP_VERSION" == "6" ]]; then
-        openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" router set --external-gateway $EXT_NET_ID $ROUTER_ID
+        openstack --os-cloud devstack-admin-demo --os-region "$REGION_NAME" router set --external-gateway $EXT_NET_ID $ROUTER_ID
     fi
 
     # This logic is specific to using OVN or the l3-agent for layer 3
@@ -412,7 +395,13 @@ function _neutron_configure_router_v6 {
         sudo sysctl -w net.ipv6.conf.all.forwarding=1
         # Configure and enable public bridge
         # Override global IPV6_ROUTER_GW_IP with the true value from neutron
-        IPV6_ROUTER_GW_IP=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" port list -c 'Fixed IP Addresses' | grep $ipv6_pub_subnet_id | awk -F'ip_address' '{ print $2 }' | cut -f2 -d\' | tr '\n' ' ')
+        # NOTE(slaweq): when enforce scopes is enabled in Neutron, router's
+        # gateway ports aren't visible in API because such ports don't belongs
+        # to any tenant. Because of that, at least temporary we need to find
+        # IPv6 address of the router's gateway in a bit different way.
+        # It can be reverted when bug
+        # https://bugs.launchpad.net/neutron/+bug/1959332 will be fixed
+        IPV6_ROUTER_GW_IP=$(openstack --os-cloud devstack-admin-demo --os-region "$REGION_NAME" router show $ROUTER_ID -c external_gateway_info -f json | grep -C 1 $ipv6_pub_subnet_id | grep ip_address | awk '{print $2}' | tr -d '"')
         die_if_not_set $LINENO IPV6_ROUTER_GW_IP "Failure retrieving IPV6_ROUTER_GW_IP"
 
         if is_neutron_ovs_base_plugin; then
@@ -440,7 +429,7 @@ function _neutron_configure_router_v6 {
 function is_networking_extension_supported {
     local extension=$1
     # TODO(sc68cal) cache this instead of calling every time
-    EXT_LIST=$(openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" extension list --network -c Alias -f value)
+    EXT_LIST=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" extension list --network -c Alias -f value)
     [[ $EXT_LIST =~ $extension ]] && return 0
 }
 
diff --git a/lib/tempest b/lib/tempest
index adffeda371..9ca06acabf 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -90,11 +90,6 @@ TEMPEST_USE_TEST_ACCOUNTS=$(trueorfalse False TEMPEST_USE_TEST_ACCOUNTS)
 # it will run tempest with
 TEMPEST_CONCURRENCY=${TEMPEST_CONCURRENCY:-$(nproc)}
 
-NEUTRON_ADMIN_CLOUD_NAME="devstack-admin"
-if [ "$NEUTRON_ENFORCE_SCOPE" == "True" ]; then
-    NEUTRON_ADMIN_CLOUD_NAME="devstack-system-admin"
-fi
-
 # Functions
 # ---------
 
@@ -293,8 +288,8 @@ function configure_tempest {
     if [[ "$NEUTRON_CREATE_INITIAL_NETWORKS" == "True" ]] && is_networking_extension_supported 'external-net'; then
         public_network_id=$(openstack --os-cloud devstack-admin network show -f value -c id $PUBLIC_NETWORK_NAME)
         # make sure shared network presence does not confuses the tempest tests
-        openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" network create --share shared --project "$admin_project_id"
-        openstack --os-cloud "$NEUTRON_ADMIN_CLOUD_NAME" --os-region "$REGION_NAME" subnet create --description shared-subnet --subnet-range ${TEMPEST_SHARED_POOL:-192.168.233.0/24} --network shared shared-subnet --project "$admin_project_id"
+        openstack --os-cloud devstack-admin --os-region "$REGION_NAME" network create --share shared
+        openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet create --description shared-subnet --subnet-range ${TEMPEST_SHARED_POOL:-192.168.233.0/24} --network shared shared-subnet
     fi
 
     iniset $TEMPEST_CONFIG DEFAULT use_syslog $SYSLOG

From 081c9b716fc742ffc12263e46ae499d7a1f65a7e Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Fri, 28 Jan 2022 09:52:28 +0100
Subject: [PATCH 1999/2409] Revert "Disable enforcing scopes in Neutron
 temporary"

This reverts commit be7b5bf671b4cdc082fb9b7bb73ec55cab0054dd.

As related bug is fixed, lets enabled scope enforcement in Neutron
again.

Related-bug: #1959196
Change-Id: I72db7ef533e78a10734d105e6a0debef288e41a1
---
 .zuul.yaml | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 5a58d743fe..248a56beb9 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -619,9 +619,7 @@
         # Keep enabeling the services here to run with system scope
         CINDER_ENFORCE_SCOPE: true
         GLANCE_ENFORCE_SCOPE: true
-        # TODO(slaweq): Enable enforce scopes in Neutron when bug
-        # https://bugs.launchpad.net/neutron/+bug/1959196 will be fixed
-        # NEUTRON_ENFORCE_SCOPE: true
+        NEUTRON_ENFORCE_SCOPE: true
 
 - job:
     name: devstack-multinode

From 099a048fb933649606e58310e8e705e7c7e29cd7 Mon Sep 17 00:00:00 2001
From: melanie witt <melwittt@gmail.com>
Date: Thu, 6 May 2021 00:09:33 +0000
Subject: [PATCH 2000/2409] Configure nova unified limits quotas

This enables the configuration of nova to use unified limits in
keystone and enforcement in oslo.limit.

Related to blueprint unified-limits-nova

Depends-On: https://review.opendev.org/c/openstack/nova/+/715271

Change-Id: Ifdef3510bc7da3098a71739814e35dbaf612ae34
---
 lib/nova | 66 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 66 insertions(+)

diff --git a/lib/nova b/lib/nova
index 930529a433..9039c6b454 100644
--- a/lib/nova
+++ b/lib/nova
@@ -159,6 +159,9 @@ NOVA_NOTIFICATION_FORMAT=${NOVA_NOTIFICATION_FORMAT:-unversioned}
 # image in devstack is CirrOS.
 NOVA_SHUTDOWN_TIMEOUT=${NOVA_SHUTDOWN_TIMEOUT:-0}
 
+# Whether to use Keystone unified limits instead of legacy quota limits.
+NOVA_USE_UNIFIED_LIMITS=$(trueorfalse False NOVA_USE_UNIFIED_LIMITS)
+
 # Functions
 # ---------
 
@@ -384,6 +387,13 @@ function create_nova_accounts {
             "http://$SERVICE_HOST:$S3_SERVICE_PORT" \
             "http://$SERVICE_HOST:$S3_SERVICE_PORT"
     fi
+
+    # Unified limits
+    if is_service_enabled n-api; then
+        if [[ "$NOVA_USE_UNIFIED_LIMITS" = True ]]; then
+            configure_nova_unified_limits
+        fi
+    fi
 }
 
 # create_nova_conf() - Create a new nova.conf file
@@ -719,6 +729,62 @@ function configure_console_proxies {
     fi
 }
 
+function configure_nova_unified_limits {
+    # Default limits. Mirror the config-based default values.
+    # Note: disk quota is new in nova as of unified limits.
+    bash -c "unset OS_USERNAME OS_TENANT_NAME OS_PROJECT_NAME;
+        openstack --os-cloud devstack-system-admin registered limit create \
+                    --service nova --default-limit 10 --region $REGION_NAME \
+                    servers; \
+        openstack --os-cloud devstack-system-admin registered limit create \
+                    --service nova --default-limit 20 --region $REGION_NAME \
+                    class:VCPU; \
+        openstack --os-cloud devstack-system-admin registered limit create \
+                    --service nova --default-limit $((50 * 1024)) --region $REGION_NAME \
+                    class:MEMORY_MB; \
+        openstack --os-cloud devstack-system-admin registered limit create \
+                    --service nova --default-limit 20 --region $REGION_NAME \
+                    class:DISK_GB; \
+        openstack --os-cloud devstack-system-admin registered limit create \
+                    --service nova --default-limit 128 --region $REGION_NAME \
+                    server_metadata_items; \
+        openstack --os-cloud devstack-system-admin registered limit create \
+                    --service nova --default-limit 5 --region $REGION_NAME \
+                    server_injected_files; \
+        openstack --os-cloud devstack-system-admin registered limit create \
+                    --service nova --default-limit 10240 --region $REGION_NAME \
+                    server_injected_file_content_bytes; \
+        openstack --os-cloud devstack-system-admin registered limit create \
+                    --service nova --default-limit 255 --region $REGION_NAME \
+                    server_injected_file_path_bytes; \
+        openstack --os-cloud devstack-system-admin registered limit create \
+                    --service nova --default-limit 100 --region $REGION_NAME \
+                    server_key_pairs; \
+        openstack --os-cloud devstack-system-admin registered limit create \
+                    --service nova --default-limit 10 --region $REGION_NAME \
+                    server_groups; \
+        openstack --os-cloud devstack-system-admin registered limit create \
+                    --service nova --default-limit 10 --region $REGION_NAME \
+                    server_group_members"
+
+    # Tell nova to use these limits
+    iniset $NOVA_CONF quota driver "nova.quota.UnifiedLimitsDriver"
+
+    # Configure oslo_limit so it can talk to keystone
+    iniset $NOVA_CONF oslo_limit user_domain_name $SERVICE_DOMAIN_NAME
+    iniset $NOVA_CONF oslo_limit password $SERVICE_PASSWORD
+    iniset $NOVA_CONF oslo_limit username nova
+    iniset $NOVA_CONF oslo_limit auth_type password
+    iniset $NOVA_CONF oslo_limit auth_url $KEYSTONE_SERVICE_URI
+    iniset $NOVA_CONF oslo_limit system_scope "'all'"
+    iniset $NOVA_CONF oslo_limit endpoint_id \
+           $(openstack endpoint list --service nova -f value -c ID)
+
+    # Allow the nova service user to read quotas
+    openstack role add --user nova --user-domain Default --system all \
+              reader
+}
+
 function init_nova_service_user_conf {
     iniset $NOVA_CONF service_user send_service_user_token True
     iniset $NOVA_CONF service_user auth_type password

From a756f4b9681d429f2612164eb01d57c800ff2d2a Mon Sep 17 00:00:00 2001
From: Rodolfo Alonso Hernandez <ralonsoh@redhat.com>
Date: Mon, 31 Jan 2022 16:38:31 +0000
Subject: [PATCH 2001/2409] Add python3.6 pip support

Since pip v22, python3.6 is not supported (the minimum version is
python3.7). This patch adds the reference for the pip3.6 URL to be
used instead of the default one.

Closes-Bug: #1959600
Change-Id: Iab2c391d5388461fe9e9037cee81884ce8032e72
---
 tools/install_pip.sh | 31 ++++++++++++++++++++-----------
 1 file changed, 20 insertions(+), 11 deletions(-)

diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index 5d73a1f0d8..e9c52eacb7 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -38,7 +38,7 @@ FILES=$TOP_DIR/files
 # [1] https://opendev.org/openstack/project-config/src/branch/master/nodepool/elements/cache-devstack/source-repository-pip
 
 PIP_GET_PIP_URL=${PIP_GET_PIP_URL:-"https://bootstrap.pypa.io/get-pip.py"}
-LOCAL_PIP="$FILES/$(basename $PIP_GET_PIP_URL)"
+PIP_GET_PIP36_URL=${PIP_GET_PIP36_URL:-"https://bootstrap.pypa.io/pip/3.6/get-pip.py"}
 
 GetDistro
 echo "Distro: $DISTRO"
@@ -57,12 +57,21 @@ function get_versions {
 
 
 function install_get_pip {
+    if [[ "$PYTHON3_VERSION" = "3.6" ]]; then
+        _pip_url=$PIP_GET_PIP36_URL
+        _local_pip="$FILES/$(basename $_pip_url)-py36"
+    else
+        _pip_url=$PIP_GET_PIP_URL
+        _local_pip="$FILES/$(basename $_pip_url)"
+    fi
+
+
     # If get-pip.py isn't python, delete it. This was probably an
     # outage on the server.
-    if [[ -r $LOCAL_PIP ]]; then
-        if ! head -1 $LOCAL_PIP | grep -q '#!/usr/bin/env python'; then
-            echo "WARNING: Corrupt $LOCAL_PIP found removing"
-            rm $LOCAL_PIP
+    if [[ -r $_local_pip ]]; then
+        if ! head -1 $_local_pip | grep -q '#!/usr/bin/env python'; then
+            echo "WARNING: Corrupt $_local_pip found removing"
+            rm $_local_pip
         fi
     fi
 
@@ -76,20 +85,20 @@ function install_get_pip {
     # Thus we use curl's "-z" feature to always check the modified
     # since and only download if a new version is out -- but only if
     # it seems we downloaded the file originally.
-    if [[ ! -r $LOCAL_PIP || -r $LOCAL_PIP.downloaded ]]; then
+    if [[ ! -r $_local_pip || -r $_local_pip.downloaded ]]; then
         # only test freshness if LOCAL_PIP is actually there,
         # otherwise we generate a scary warning.
         local timecond=""
-        if [[ -r $LOCAL_PIP ]]; then
-            timecond="-z $LOCAL_PIP"
+        if [[ -r $_local_pip ]]; then
+            timecond="-z $_local_pip"
         fi
 
         curl -f --retry 6 --retry-delay 5 \
-            $timecond -o $LOCAL_PIP $PIP_GET_PIP_URL || \
+            $timecond -o $_local_pip $_pip_url || \
             die $LINENO "Download of get-pip.py failed"
-        touch $LOCAL_PIP.downloaded
+        touch $_local_pip.downloaded
     fi
-    sudo -H -E python${PYTHON3_VERSION} $LOCAL_PIP
+    sudo -H -E python${PYTHON3_VERSION} $_local_pip
 }
 
 

From 85c7d8db4eef2e367a7466a39b4f1fba7a983eef Mon Sep 17 00:00:00 2001
From: Sean Mooney <work@seanmooney.info>
Date: Fri, 4 Feb 2022 08:29:32 +0000
Subject: [PATCH 2002/2409] revert stackrc execute permissions

This change reverts the execute permissions from
stackrc which is not meant to be run as a script but sourced
as part of stack.sh

Change-Id: I9a05051e5a297cfaf78d097fa5f90a7c5fd254a6
---
 stackrc | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 mode change 100755 => 100644 stackrc

diff --git a/stackrc b/stackrc
old mode 100755
new mode 100644

From 343e35162798af4c0399f2f7c0a733c568782686 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Thu, 3 Feb 2022 11:19:08 +1100
Subject: [PATCH 2003/2409] Bump fedora-latest to F35

Generally this is straight forward, but Horizon has a dependency issue
with pyScss (described in [1]) so it is disabled, for now.

[1] https://bugs.launchpad.net/horizon/+bug/1960204

Co-Authored-By: Dr. Jens Harbott <harbott@osism.tech>
Depends-On: https://review.opendev.org/c/openstack/devstack/+/827578
Change-Id: I7c4bf0945f9ac5bd563fe0a698c09b8571c97c5e
---
 .zuul.yaml       | 6 +++++-
 files/rpms/swift | 2 +-
 lib/apache       | 7 ++++++-
 stack.sh         | 2 +-
 4 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 5a58d743fe..3278eeb9e0 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -90,7 +90,7 @@
     name: devstack-single-node-fedora-latest
     nodes:
       - name: controller
-        label: fedora-34
+        label: fedora-35
     groups:
       - name: tempest
         nodes:
@@ -729,6 +729,10 @@
     voting: false
     vars:
       configure_swap_size: 4096
+      # Python 3.10 dependency issues; see
+      # https://bugs.launchpad.net/horizon/+bug/1960204
+      devstack_services:
+        horizon: false
 
 - job:
     name: devstack-platform-fedora-latest-virt-preview
diff --git a/files/rpms/swift b/files/rpms/swift
index faf0a3175a..a838d7839e 100644
--- a/files/rpms/swift
+++ b/files/rpms/swift
@@ -4,4 +4,4 @@ memcached
 rsync-daemon
 sqlite
 xfsprogs
-xinetd # not:f34,rhel9
+xinetd # not:f35,rhel9
diff --git a/lib/apache b/lib/apache
index cbe61adf34..f29c7ea2cb 100644
--- a/lib/apache
+++ b/lib/apache
@@ -85,7 +85,12 @@ function install_apache_uwsgi {
     if is_ubuntu; then
         local pkg_list="uwsgi uwsgi-plugin-python3 libapache2-mod-proxy-uwsgi"
         install_package ${pkg_list}
-    elif is_fedora && ! is_openeuler; then
+    # NOTE(ianw) 2022-02-03 : Fedora 35 needs to skip this and fall
+    # into the install-from-source because the upstream packages
+    # didn't fix Python 3.10 compatibility before release.  Should be
+    # fixed in uwsgi 4.9.0; can remove this when packages available
+    # or we drop this release
+    elif is_fedora && ! is_openeuler && ! [[ $DISTRO =~ f35 ]]; then
         # Note httpd comes with mod_proxy_uwsgi and it is loaded by
         # default; the mod_proxy_uwsgi package actually conflicts now.
         # See:
diff --git a/stack.sh b/stack.sh
index c92cc79b40..0082b99f11 100755
--- a/stack.sh
+++ b/stack.sh
@@ -227,7 +227,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-SUPPORTED_DISTROS="bullseye|focal|f34|opensuse-15.2|opensuse-tumbleweed|rhel8|rhel9|openEuler-20.03"
+SUPPORTED_DISTROS="bullseye|focal|f35|opensuse-15.2|opensuse-tumbleweed|rhel8|rhel9|openEuler-20.03"
 
 if [[ ! ${DISTRO} =~ $SUPPORTED_DISTROS ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"

From accd99e7cddabb60633bf7e8f8832c961a2805f4 Mon Sep 17 00:00:00 2001
From: Jakob Meng <jakobmeng@web.de>
Date: Tue, 8 Feb 2022 11:05:14 +0100
Subject: [PATCH 2004/2409] Made LVM backing disk persistent

Previously, loop devices for LVM volume groups backing files were not
created after reboots, causing e.g. Cinder to fail with messages such
as

  ERROR cinder.service [-] Manager for service cinder-volume
  devstack@lvmdriver-1 is reporting problems, not sending
  heartbeat. Service will appear "down".

Now, we use systemd services to manage loop devices for backing files.

Change-Id: I27ec027834966e44aa9a99999358f5b4debc43e0
---
 files/lvm-backing-file.template | 16 +++++++++++
 lib/lvm                         | 49 ++++++++++++++++++---------------
 2 files changed, 43 insertions(+), 22 deletions(-)
 create mode 100644 files/lvm-backing-file.template

diff --git a/files/lvm-backing-file.template b/files/lvm-backing-file.template
new file mode 100644
index 0000000000..dc519d7745
--- /dev/null
+++ b/files/lvm-backing-file.template
@@ -0,0 +1,16 @@
+[Unit]
+Description=Activate LVM backing file %BACKING_FILE%
+DefaultDependencies=no
+After=systemd-udev-settle.service
+Before=lvm2-activation-early.service
+Wants=systemd-udev-settle.service
+
+[Service]
+ExecStart=/sbin/losetup --find --show %DIRECTIO% %BACKING_FILE%
+ExecStop=/bin/sh -c '/sbin/losetup -d $$(/sbin/losetup --associated %BACKING_FILE% -O NAME -n)'
+RemainAfterExit=yes
+Type=oneshot
+
+[Install]
+WantedBy=local-fs.target
+Also=systemd-udev-settle.service
diff --git a/lib/lvm b/lib/lvm
index b826c1bc63..d3f6bf1792 100644
--- a/lib/lvm
+++ b/lib/lvm
@@ -53,28 +53,10 @@ function _remove_lvm_volume_group {
     sudo vgremove -f $vg
 }
 
-# _clean_lvm_backing_file() removes the backing file of the
-# volume group
-#
-# Usage: _clean_lvm_backing_file() $backing_file
-function _clean_lvm_backing_file {
-    local backing_file=$1
-
-    # If the backing physical device is a loop device, it was probably setup by DevStack
-    if [[ -n "$backing_file" ]] && [[ -e "$backing_file" ]]; then
-        local vg_dev
-        vg_dev=$(sudo losetup -j $backing_file | awk -F':' '/'$BACKING_FILE_SUFFIX'/ { print $1}')
-        if [[ -n "$vg_dev" ]]; then
-            sudo losetup -d $vg_dev
-        fi
-        rm -f $backing_file
-    fi
-}
-
 # clean_lvm_volume_group() cleans up the volume group and removes the
 # backing file
 #
-# Usage: clean_lvm_volume_group $vg
+# Usage: clean_lvm_volume_group() $vg
 function clean_lvm_volume_group {
     local vg=$1
 
@@ -83,11 +65,22 @@ function clean_lvm_volume_group {
     # if there is no logical volume left, it's safe to attempt a cleanup
     # of the backing file
     if [[ -z "$(sudo lvs --noheadings -o lv_name $vg 2>/dev/null)" ]]; then
-        _clean_lvm_backing_file $DATA_DIR/$vg$BACKING_FILE_SUFFIX
+        local backing_file=$DATA_DIR/$vg$BACKING_FILE_SUFFIX
+
+        if [[ -n "$vg$BACKING_FILE_SUFFIX" ]] && \
+           [[ -e "/etc/systemd/system/$vg$BACKING_FILE_SUFFIX.service" ]]; then
+            sudo systemctl disable --now $vg$BACKING_FILE_SUFFIX.service
+            sudo rm -f /etc/systemd/system/$vg$BACKING_FILE_SUFFIX.service
+            sudo systemctl daemon-reload
+        fi
+
+        # If the backing physical device is a loop device, it was probably setup by DevStack
+        if [[ -n "$backing_file" ]] && [[ -e "$backing_file" ]]; then
+            rm -f $backing_file
+        fi
     fi
 }
 
-
 # _create_lvm_volume_group creates default volume group
 #
 # Usage: _create_lvm_volume_group() $vg $size
@@ -106,8 +99,20 @@ function _create_lvm_volume_group {
             directio="--direct-io=on"
         fi
 
+        # Only create systemd service if it doesn't already exists
+        if [[ ! -e "/etc/systemd/system/$vg$BACKING_FILE_SUFFIX.service" ]]; then
+            sed -e "
+                s|%DIRECTIO%|${directio}|g;
+                s|%BACKING_FILE%|${backing_file}|g;
+            " $FILES/lvm-backing-file.template | sudo tee \
+                /etc/systemd/system/$vg$BACKING_FILE_SUFFIX.service
+
+            sudo systemctl daemon-reload
+            sudo systemctl enable --now $vg$BACKING_FILE_SUFFIX.service
+        fi
+
         local vg_dev
-        vg_dev=$(sudo losetup -f --show $directio $backing_file)
+        vg_dev=$(sudo losetup --associated $backing_file -O NAME -n)
 
         # Only create volume group if it doesn't already exist
         if ! sudo vgs $vg; then

From 8c6710326eaf8114b579720185161091a0a9f38c Mon Sep 17 00:00:00 2001
From: Rodolfo Alonso Hernandez <ralonsoh@redhat.com>
Date: Wed, 9 Feb 2022 18:01:46 +0000
Subject: [PATCH 2005/2409] Fix installation with OVN backend and compilation

This patch fixes several issues related to the installation with
OVN backend with the OVS/OVN compilation enabled.

The OVS/OVN local directories prefix, when both services are compiled,
is now "/usr/local".

The "ovn_agent._run_process" function is calling "ovs-appctl" to
configure the logging settings of several services. Instead of
using the service name, the ctl socket file is used instead. That
is more robust and does not fail in systems with previous
installations.

Closes-Bug: #1960514

Change-Id: I69de5333393957593db6e05495f0c3c758efefdf
---
 lib/neutron_plugins/ovn_agent  | 7 ++++++-
 lib/neutron_plugins/ovs_base   | 2 +-
 lib/neutron_plugins/ovs_source | 4 ++--
 3 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index 09b28b6c3f..927896b70b 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -253,7 +253,12 @@ function _run_process {
 
     local testcmd="test -e $OVS_RUNDIR/$service.pid"
     test_with_retry "$testcmd" "$service did not start" $SERVICE_TIMEOUT 1
-    sudo ovs-appctl -t $service vlog/set console:off syslog:info file:info
+    local service_ctl_file
+    service_ctl_file=$(ls $OVS_RUNDIR | grep $service | grep ctl)
+    if [ -z "$service_ctl_file" ]; then
+        die $LINENO "ctl file for service $service is not present."
+    fi
+    sudo ovs-appctl -t $OVS_RUNDIR/$service_ctl_file vlog/set console:off syslog:info file:info
 }
 
 function clone_repository {
diff --git a/lib/neutron_plugins/ovs_base b/lib/neutron_plugins/ovs_base
index 8acf586189..cc41a8cd46 100644
--- a/lib/neutron_plugins/ovs_base
+++ b/lib/neutron_plugins/ovs_base
@@ -68,7 +68,7 @@ function _neutron_ovs_base_install_ubuntu_dkms {
 function _neutron_ovs_base_install_agent_packages {
     if [ "$Q_BUILD_OVS_FROM_GIT" == "True" ]; then
         remove_ovs_packages
-        compile_ovs False /usr /var
+        compile_ovs False /usr/local /var
         load_conntrack_gre_module
         start_new_ovs
     else
diff --git a/lib/neutron_plugins/ovs_source b/lib/neutron_plugins/ovs_source
index 9c87dce551..9ae5555afb 100644
--- a/lib/neutron_plugins/ovs_source
+++ b/lib/neutron_plugins/ovs_source
@@ -188,12 +188,12 @@ function action_openvswitch {
 # start_new_ovs() - removes old ovs database, creates a new one and starts ovs
 function start_new_ovs {
     sudo rm -f /etc/openvswitch/conf.db /etc/openvswitch/.conf.db~lock~
-    sudo /usr/share/openvswitch/scripts/ovs-ctl start
+    sudo /usr/local/share/openvswitch/scripts/ovs-ctl start
 }
 
 # stop_new_ovs() - stops ovs
 function stop_new_ovs {
-    local ovs_ctl='/usr/share/openvswitch/scripts/ovs-ctl'
+    local ovs_ctl='/usr/local/share/openvswitch/scripts/ovs-ctl'
 
     if [ -x $ovs_ctl ] ; then
         sudo $ovs_ctl stop

From 17b1999eabab92a7820a2900853dc23d7150dbe9 Mon Sep 17 00:00:00 2001
From: Sean Mooney <work@seanmooney.info>
Date: Wed, 9 Feb 2022 22:14:24 +0000
Subject: [PATCH 2006/2409] Default CIRROS_ARCH to host arch

This change use uname -m to get the portable host arch and uses that
as a new default. on x86_64 hosts this should result in no visable change
in behavior however on a non x86 host it will cause devstack to attempt
to download a cirros image that matches the host.

Change-Id: I6d1495a23400ef4cf496302028324fa5794dd45f
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 681e9dee38..e48fd81d16 100644
--- a/stackrc
+++ b/stackrc
@@ -663,7 +663,7 @@ esac
 #IMAGE_URLS="http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img" # cirros full disk image
 
 CIRROS_VERSION=${CIRROS_VERSION:-"0.5.2"}
-CIRROS_ARCH=${CIRROS_ARCH:-"x86_64"}
+CIRROS_ARCH=${CIRROS_ARCH:-$(uname -m)}
 
 # Set default image based on ``VIRT_DRIVER`` and ``LIBVIRT_TYPE``, either of
 # which may be set in ``local.conf``.  Also allow ``DEFAULT_IMAGE_NAME`` and

From ef6fac7959b257bb08ff3014e9cbf9cbc6b28ec3 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Wed, 16 Feb 2022 02:16:15 +0000
Subject: [PATCH 2007/2409] Updated from generate-devstack-plugins-list

Change-Id: If1b667cd4af88511cb1672645a980c9c4fc557ae
---
 doc/source/plugin-registry.rst | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 3edd708d8b..6850553b52 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -75,6 +75,7 @@ openstack/networking-powervm             `https://opendev.org/openstack/networki
 openstack/networking-sfc                 `https://opendev.org/openstack/networking-sfc <https://opendev.org/openstack/networking-sfc>`__
 openstack/neutron                        `https://opendev.org/openstack/neutron <https://opendev.org/openstack/neutron>`__
 openstack/neutron-dynamic-routing        `https://opendev.org/openstack/neutron-dynamic-routing <https://opendev.org/openstack/neutron-dynamic-routing>`__
+openstack/neutron-fwaas-dashboard        `https://opendev.org/openstack/neutron-fwaas-dashboard <https://opendev.org/openstack/neutron-fwaas-dashboard>`__
 openstack/neutron-tempest-plugin         `https://opendev.org/openstack/neutron-tempest-plugin <https://opendev.org/openstack/neutron-tempest-plugin>`__
 openstack/neutron-vpnaas                 `https://opendev.org/openstack/neutron-vpnaas <https://opendev.org/openstack/neutron-vpnaas>`__
 openstack/neutron-vpnaas-dashboard       `https://opendev.org/openstack/neutron-vpnaas-dashboard <https://opendev.org/openstack/neutron-vpnaas-dashboard>`__
@@ -92,6 +93,7 @@ openstack/sahara                         `https://opendev.org/openstack/sahara <
 openstack/sahara-dashboard               `https://opendev.org/openstack/sahara-dashboard <https://opendev.org/openstack/sahara-dashboard>`__
 openstack/senlin                         `https://opendev.org/openstack/senlin <https://opendev.org/openstack/senlin>`__
 openstack/shade                          `https://opendev.org/openstack/shade <https://opendev.org/openstack/shade>`__
+openstack/skyline-apiserver              `https://opendev.org/openstack/skyline-apiserver <https://opendev.org/openstack/skyline-apiserver>`__
 openstack/solum                          `https://opendev.org/openstack/solum <https://opendev.org/openstack/solum>`__
 openstack/storlets                       `https://opendev.org/openstack/storlets <https://opendev.org/openstack/storlets>`__
 openstack/tacker                         `https://opendev.org/openstack/tacker <https://opendev.org/openstack/tacker>`__
@@ -112,7 +114,6 @@ openstack/zaqar-ui                       `https://opendev.org/openstack/zaqar-ui
 openstack/zun                            `https://opendev.org/openstack/zun <https://opendev.org/openstack/zun>`__
 openstack/zun-ui                         `https://opendev.org/openstack/zun-ui <https://opendev.org/openstack/zun-ui>`__
 performa/os-faults                       `https://opendev.org/performa/os-faults <https://opendev.org/performa/os-faults>`__
-skyline/skyline-apiserver                `https://opendev.org/skyline/skyline-apiserver <https://opendev.org/skyline/skyline-apiserver>`__
 starlingx/config                         `https://opendev.org/starlingx/config <https://opendev.org/starlingx/config>`__
 starlingx/fault                          `https://opendev.org/starlingx/fault <https://opendev.org/starlingx/fault>`__
 starlingx/ha                             `https://opendev.org/starlingx/ha <https://opendev.org/starlingx/ha>`__

From c0882aeaae8ebdc692f2f0e005f8795bbb6c3d53 Mon Sep 17 00:00:00 2001
From: Victor Morales <chipahuac@hotmail.com>
Date: Wed, 16 Feb 2022 18:15:12 -0800
Subject: [PATCH 2008/2409] Add rsync deb package for swift

The rsync debian package is required for swift service. This
requirement has been covered by rpms but not for deb packages.

Change-Id: Iefd1302be9c7fd80e037bbae3638602d6d823580
---
 files/debs/swift | 1 +
 1 file changed, 1 insertion(+)

diff --git a/files/debs/swift b/files/debs/swift
index 4b8ac3d793..67c6c8ddb4 100644
--- a/files/debs/swift
+++ b/files/debs/swift
@@ -2,5 +2,6 @@ curl
 liberasurecode-dev
 make
 memcached
+rsync
 sqlite3
 xfsprogs

From e30620e9a62cd1243bded2b922b21c269d801aa6 Mon Sep 17 00:00:00 2001
From: Jakob Meng <jakobmeng@web.de>
Date: Fri, 4 Feb 2022 20:55:48 +0100
Subject: [PATCH 2009/2409] Made Swift backing disk persistent

Previously, Swift's backing disk were not be mounted after reboots,
causing swift-proxy-server service to fail with cryptic error
messages such as 'proxy-server: ERROR Insufficient Storage'. Now,
we use 	Dan Smith' create_disk function from functions to create
the backing disk for us and add it to /etc/fstab.

Change-Id: I9cbccc87bc94a55b58e9badf3fdb127d6f1cf599
---
 lib/swift | 32 ++++----------------------------
 1 file changed, 4 insertions(+), 28 deletions(-)

diff --git a/lib/swift b/lib/swift
index 9c13701c6e..ba92f3dcc3 100644
--- a/lib/swift
+++ b/lib/swift
@@ -179,12 +179,9 @@ function is_swift_enabled {
 # cleanup_swift() - Remove residual data files
 function cleanup_swift {
     rm -f ${SWIFT_CONF_DIR}{*.builder,*.ring.gz,backups/*.builder,backups/*.ring.gz}
-    if egrep -q ${SWIFT_DATA_DIR}/drives/sdb1 /proc/mounts; then
-        sudo umount ${SWIFT_DATA_DIR}/drives/sdb1
-    fi
-    if [[ -e ${SWIFT_DISK_IMAGE} ]]; then
-        rm ${SWIFT_DISK_IMAGE}
-    fi
+
+    destroy_disk ${SWIFT_DISK_IMAGE} ${SWIFT_DATA_DIR}/drives/sdb1
+
     rm -rf ${SWIFT_DATA_DIR}/run/
     if [ "$SWIFT_USE_MOD_WSGI" == "True" ]; then
         _cleanup_swift_apache_wsgi
@@ -575,28 +572,7 @@ function create_swift_disk {
     sudo install -d -o ${STACK_USER} -g ${user_group} ${SWIFT_DATA_DIR}/{drives,cache,run,logs}
 
     # Create a loopback disk and format it to XFS.
-    if [[ -e ${SWIFT_DISK_IMAGE} ]]; then
-        if egrep -q ${SWIFT_DATA_DIR}/drives/sdb1 /proc/mounts; then
-            sudo umount ${SWIFT_DATA_DIR}/drives/sdb1
-            sudo rm -f ${SWIFT_DISK_IMAGE}
-        fi
-    fi
-
-    mkdir -p ${SWIFT_DATA_DIR}/drives/images
-    sudo touch ${SWIFT_DISK_IMAGE}
-    sudo chown ${STACK_USER}: ${SWIFT_DISK_IMAGE}
-
-    truncate -s ${SWIFT_LOOPBACK_DISK_SIZE} ${SWIFT_DISK_IMAGE}
-
-    # Make a fresh XFS filesystem
-    /sbin/mkfs.xfs -f -i size=1024  ${SWIFT_DISK_IMAGE}
-
-    # Mount the disk with mount options to make it as efficient as possible
-    mkdir -p ${SWIFT_DATA_DIR}/drives/sdb1
-    if ! egrep -q ${SWIFT_DATA_DIR}/drives/sdb1 /proc/mounts; then
-        sudo mount -t xfs -o loop,noatime,nodiratime,logbufs=8  \
-            ${SWIFT_DISK_IMAGE} ${SWIFT_DATA_DIR}/drives/sdb1
-    fi
+    create_disk ${SWIFT_DISK_IMAGE} ${SWIFT_DATA_DIR}/drives/sdb1 ${SWIFT_LOOPBACK_DISK_SIZE}
 
     # Create a link to the above mount and
     # create all of the directories needed to emulate a few different servers

From a2ff7545366b1be960c1175b47e20c5845c3a6e2 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Wed, 2 Mar 2022 02:13:44 +0000
Subject: [PATCH 2010/2409] Updated from generate-devstack-plugins-list

Change-Id: Iff2bf021edee9be3bae21b67e66fe07c552f3a05
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 6850553b52..2e8e8f53d7 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -75,6 +75,7 @@ openstack/networking-powervm             `https://opendev.org/openstack/networki
 openstack/networking-sfc                 `https://opendev.org/openstack/networking-sfc <https://opendev.org/openstack/networking-sfc>`__
 openstack/neutron                        `https://opendev.org/openstack/neutron <https://opendev.org/openstack/neutron>`__
 openstack/neutron-dynamic-routing        `https://opendev.org/openstack/neutron-dynamic-routing <https://opendev.org/openstack/neutron-dynamic-routing>`__
+openstack/neutron-fwaas                  `https://opendev.org/openstack/neutron-fwaas <https://opendev.org/openstack/neutron-fwaas>`__
 openstack/neutron-fwaas-dashboard        `https://opendev.org/openstack/neutron-fwaas-dashboard <https://opendev.org/openstack/neutron-fwaas-dashboard>`__
 openstack/neutron-tempest-plugin         `https://opendev.org/openstack/neutron-tempest-plugin <https://opendev.org/openstack/neutron-tempest-plugin>`__
 openstack/neutron-vpnaas                 `https://opendev.org/openstack/neutron-vpnaas <https://opendev.org/openstack/neutron-vpnaas>`__

From 2c96180ac8482d912c487c18d400f418bf933cab Mon Sep 17 00:00:00 2001
From: melanie witt <melwittt@gmail.com>
Date: Thu, 3 Mar 2022 23:54:49 +0000
Subject: [PATCH 2011/2409] Clean up unified limits configuration for nova and
 glance

This is a followup for change Ifdef3510bc7da3098a71739814e35dbaf612ae34
which added configuration of unified limits for nova. This removes an
unnecessary wrapper unsetting of OS_ env variables, unnecessary quoting
on an iniset config value, and a hardcoding of user domain. The glance
code from which the nova code was originally copied is also cleaned up.

Change-Id: I4921af5cc0f624dd5aa848533f7049ee816be593
---
 lib/glance |  6 ++---
 lib/nova   | 67 +++++++++++++++++++++++-------------------------------
 2 files changed, 32 insertions(+), 41 deletions(-)

diff --git a/lib/glance b/lib/glance
index 9bba938b9d..b94c06dc93 100644
--- a/lib/glance
+++ b/lib/glance
@@ -309,13 +309,13 @@ function configure_glance_quotas {
     iniset $GLANCE_API_CONF oslo_limit username glance
     iniset $GLANCE_API_CONF oslo_limit auth_type password
     iniset $GLANCE_API_CONF oslo_limit auth_url $KEYSTONE_SERVICE_URI
-    iniset $GLANCE_API_CONF oslo_limit system_scope "'all'"
+    iniset $GLANCE_API_CONF oslo_limit system_scope all
     iniset $GLANCE_API_CONF oslo_limit endpoint_id \
            $(openstack --os-cloud devstack-system-admin endpoint list --service glance -f value -c ID)
 
     # Allow the glance service user to read quotas
-    openstack --os-cloud devstack-system-admin role add --user glance --user-domain Default \
-        --system all reader
+    openstack --os-cloud devstack-system-admin role add --user glance \
+        --user-domain $SERVICE_DOMAIN_NAME --system all reader
 }
 
 # configure_glance() - Set config files, create data dirs, etc
diff --git a/lib/nova b/lib/nova
index 90289b139a..509cba6ff2 100644
--- a/lib/nova
+++ b/lib/nova
@@ -746,42 +746,33 @@ function configure_console_proxies {
 }
 
 function configure_nova_unified_limits {
-    # Default limits. Mirror the config-based default values.
+    # Registered limit resources in keystone are system-specific resources.
+    # Make sure we use a system-scoped token to interact with this API.
+
+    # Default limits here mirror the legacy config-based default values.
     # Note: disk quota is new in nova as of unified limits.
-    bash -c "unset OS_USERNAME OS_TENANT_NAME OS_PROJECT_NAME;
-        openstack --os-cloud devstack-system-admin registered limit create \
-                    --service nova --default-limit 10 --region $REGION_NAME \
-                    servers; \
-        openstack --os-cloud devstack-system-admin registered limit create \
-                    --service nova --default-limit 20 --region $REGION_NAME \
-                    class:VCPU; \
-        openstack --os-cloud devstack-system-admin registered limit create \
-                    --service nova --default-limit $((50 * 1024)) --region $REGION_NAME \
-                    class:MEMORY_MB; \
-        openstack --os-cloud devstack-system-admin registered limit create \
-                    --service nova --default-limit 20 --region $REGION_NAME \
-                    class:DISK_GB; \
-        openstack --os-cloud devstack-system-admin registered limit create \
-                    --service nova --default-limit 128 --region $REGION_NAME \
-                    server_metadata_items; \
-        openstack --os-cloud devstack-system-admin registered limit create \
-                    --service nova --default-limit 5 --region $REGION_NAME \
-                    server_injected_files; \
-        openstack --os-cloud devstack-system-admin registered limit create \
-                    --service nova --default-limit 10240 --region $REGION_NAME \
-                    server_injected_file_content_bytes; \
-        openstack --os-cloud devstack-system-admin registered limit create \
-                    --service nova --default-limit 255 --region $REGION_NAME \
-                    server_injected_file_path_bytes; \
-        openstack --os-cloud devstack-system-admin registered limit create \
-                    --service nova --default-limit 100 --region $REGION_NAME \
-                    server_key_pairs; \
-        openstack --os-cloud devstack-system-admin registered limit create \
-                    --service nova --default-limit 10 --region $REGION_NAME \
-                    server_groups; \
-        openstack --os-cloud devstack-system-admin registered limit create \
-                    --service nova --default-limit 10 --region $REGION_NAME \
-                    server_group_members"
+    openstack --os-cloud devstack-system-admin registered limit create \
+        --service nova --default-limit 10 --region $REGION_NAME servers
+    openstack --os-cloud devstack-system-admin registered limit create \
+        --service nova --default-limit 20 --region $REGION_NAME class:VCPU
+    openstack --os-cloud devstack-system-admin registered limit create \
+        --service nova --default-limit $((50 * 1024)) --region $REGION_NAME class:MEMORY_MB
+    openstack --os-cloud devstack-system-admin registered limit create \
+        --service nova --default-limit 20 --region $REGION_NAME class:DISK_GB
+    openstack --os-cloud devstack-system-admin registered limit create \
+        --service nova --default-limit 128 --region $REGION_NAME server_metadata_items
+    openstack --os-cloud devstack-system-admin registered limit create \
+        --service nova --default-limit 5 --region $REGION_NAME server_injected_files
+    openstack --os-cloud devstack-system-admin registered limit create \
+        --service nova --default-limit 10240 --region $REGION_NAME server_injected_file_content_bytes
+    openstack --os-cloud devstack-system-admin registered limit create \
+        --service nova --default-limit 255 --region $REGION_NAME server_injected_file_path_bytes
+    openstack --os-cloud devstack-system-admin registered limit create \
+        --service nova --default-limit 100 --region $REGION_NAME server_key_pairs
+    openstack --os-cloud devstack-system-admin registered limit create \
+        --service nova --default-limit 10 --region $REGION_NAME server_groups
+    openstack --os-cloud devstack-system-admin registered limit create \
+        --service nova --default-limit 10 --region $REGION_NAME server_group_members
 
     # Tell nova to use these limits
     iniset $NOVA_CONF quota driver "nova.quota.UnifiedLimitsDriver"
@@ -792,13 +783,13 @@ function configure_nova_unified_limits {
     iniset $NOVA_CONF oslo_limit username nova
     iniset $NOVA_CONF oslo_limit auth_type password
     iniset $NOVA_CONF oslo_limit auth_url $KEYSTONE_SERVICE_URI
-    iniset $NOVA_CONF oslo_limit system_scope "'all'"
+    iniset $NOVA_CONF oslo_limit system_scope all
     iniset $NOVA_CONF oslo_limit endpoint_id \
            $(openstack endpoint list --service nova -f value -c ID)
 
     # Allow the nova service user to read quotas
-    openstack role add --user nova --user-domain Default --system all \
-              reader
+    openstack --os-cloud devstack-system-admin role add --user nova \
+        --user-domain $SERVICE_DOMAIN_NAME --system all reader
 }
 
 function init_nova_service_user_conf {

From 13e8db5a6f44a8f537988a102f9869e725bb97bb Mon Sep 17 00:00:00 2001
From: Sean Mooney <work@seanmooney.info>
Date: Wed, 9 Mar 2022 20:17:31 +0000
Subject: [PATCH 2012/2409] ignore failures to copy the devstack cache

If the ci images do not have any cached data
we should ignore any error when trying to copying it.
This is requried when using unmodified cloud images.

Change-Id: Ia6e94fc01343d0c292b1477905f8a96a6b43bcf8
---
 roles/setup-devstack-cache/tasks/main.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/roles/setup-devstack-cache/tasks/main.yaml b/roles/setup-devstack-cache/tasks/main.yaml
index 84f33f0e16..3adff17d5d 100644
--- a/roles/setup-devstack-cache/tasks/main.yaml
+++ b/roles/setup-devstack-cache/tasks/main.yaml
@@ -2,6 +2,7 @@
   # This uses hard links to avoid using extra space.
   command: "find {{ devstack_cache_dir }}/files -mindepth 1 -maxdepth 1 -exec cp -l {} {{ devstack_base_dir }}/devstack/files/ ;"
   become: true
+  ignore_errors: yes
 
 - name: Set ownership of cached files
   file:

From 35bc600da17c7342345fa9c4d0b8078a8388fad1 Mon Sep 17 00:00:00 2001
From: Michael Johnson <johnsomor@gmail.com>
Date: Mon, 28 Feb 2022 18:42:34 +0000
Subject: [PATCH 2013/2409] Fix tls-proxy on newer versions of openssl

Newer versions of openssl (CentOS9Stream for example) do not like using sha1.
Devstack will fail on these systems[1] with the following error:
801B93DCE77F0000:error:03000098:digital envelope routines:do_sigver_init:invalid digest:crypto/evp/m_sigver.c:333:
This patch updates the tls-proxy code in devstack to use sha256 instead of sha1 which allows devstack to complete when tls-proxy is enabled.

[1] https://zuul.opendev.org/t/openstack/build/1d90b22a39c74e24a8390861b3c5f957/log/job-output.txt#5535

Closes-Bug: #1962600

Change-Id: I71e1371affe32f070167037b0109a489d196bd31
---
 lib/tls | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/tls b/lib/tls
index b3cc0b4159..5a7f5ae324 100644
--- a/lib/tls
+++ b/lib/tls
@@ -169,7 +169,7 @@ default_md              = default
 
 [ req ]
 default_bits            = 1024
-default_md              = sha1
+default_md              = sha256
 
 prompt                  = no
 distinguished_name      = req_distinguished_name
@@ -261,7 +261,7 @@ function make_cert {
     if [ ! -r "$ca_dir/$cert_name.crt" ]; then
         # Generate a signing request
         $OPENSSL req \
-            -sha1 \
+            -sha256 \
             -newkey rsa \
             -nodes \
             -keyout $ca_dir/private/$cert_name.key \
@@ -301,7 +301,7 @@ function make_int_CA {
     if [ ! -r "$ca_dir/cacert.pem" ]; then
         # Create a signing certificate request
         $OPENSSL req -config $ca_dir/ca.conf \
-            -sha1 \
+            -sha256 \
             -newkey rsa \
             -nodes \
             -keyout $ca_dir/private/cacert.key \

From 7943a92bdbdd2a3b2f75fe66ee8c69db65147692 Mon Sep 17 00:00:00 2001
From: Brian Haley <haleyb.dev@gmail.com>
Date: Mon, 14 Mar 2022 13:53:41 -0400
Subject: [PATCH 2014/2409] Do not use hardcoded IPv4 localhost value

There are a couple of places that still use a hardcoded
127.0.0.1 value, even if devstack is run with
SERVICE_IP_VERSION=6 in local.conf. While things still
work, SERVICE_LOCAL_HOST should be used instead since
everything else could be using IPv6.

Change-Id: I2dd9247a4ac19f565d4d5ecb2e1490501fda8bca
---
 lib/apache          |  9 +++++++--
 lib/databases/mysql | 14 +++++++++-----
 2 files changed, 16 insertions(+), 7 deletions(-)

diff --git a/lib/apache b/lib/apache
index f29c7ea2cb..02827d1f1b 100644
--- a/lib/apache
+++ b/lib/apache
@@ -27,6 +27,11 @@ set +o xtrace
 APACHE_USER=${APACHE_USER:-$STACK_USER}
 APACHE_GROUP=${APACHE_GROUP:-$(id -gn $APACHE_USER)}
 
+APACHE_LOCAL_HOST=$SERVICE_LOCAL_HOST
+if [[ "$SERVICE_IP_VERSION" == 6 ]]; then
+    APACHE_LOCAL_HOST=[$APACHE_LOCAL_HOST]
+fi
+
 
 # Set up apache name and configuration directory
 # Note that APACHE_CONF_DIR is really more accurately apache's vhost
@@ -323,7 +328,7 @@ function write_local_uwsgi_http_config {
     rm -rf $file
     iniset "$file" uwsgi wsgi-file "$wsgi"
     port=$(get_random_port)
-    iniset "$file" uwsgi http-socket "127.0.0.1:$port"
+    iniset "$file" uwsgi http-socket "$APACHE_LOCAL_HOST:$port"
     iniset "$file" uwsgi processes $API_WORKERS
     # This is running standalone
     iniset "$file" uwsgi master true
@@ -359,7 +364,7 @@ function write_local_uwsgi_http_config {
     apache_conf=$(apache_site_config_for $name)
     echo "KeepAlive Off" | sudo tee $apache_conf
     echo "SetEnv proxy-sendchunked 1" | sudo tee -a $apache_conf
-    echo "ProxyPass \"${url}\" \"http://127.0.0.1:$port\" retry=0 " | sudo tee -a $apache_conf
+    echo "ProxyPass \"${url}\" \"http://$APACHE_LOCAL_HOST:$port\" retry=0 " | sudo tee -a $apache_conf
     enable_apache_site $name
     restart_apache_server
 }
diff --git a/lib/databases/mysql b/lib/databases/mysql
index 30e4b7c496..0f45273d4b 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -86,10 +86,16 @@ function configure_database_mysql {
         exit_distro_not_supported "mysql configuration"
     fi
 
-    # Start mysql-server
+    # Change bind-address from localhost (127.0.0.1) to any (::)
+    iniset -sudo $my_conf mysqld bind-address "$(ipv6_unquote $SERVICE_LISTEN_ADDRESS)"
+
+    # (Re)Start mysql-server
     if is_fedora || is_suse; then
         # service is not started by default
         start_service $MYSQL_SERVICE_NAME
+    elif is_ubuntu; then
+        # required since bind-address could have changed above
+        restart_service $MYSQL_SERVICE_NAME
     fi
 
     # Set the root password - only works the first time. For Ubuntu, we already
@@ -102,7 +108,7 @@ function configure_database_mysql {
     if is_ubuntu && [ "$MYSQL_SERVICE_NAME" == "mariadb" ]; then
         local cmd_args="-uroot -p$DATABASE_PASSWORD "
     else
-        local cmd_args="-uroot -p$DATABASE_PASSWORD -h127.0.0.1 "
+        local cmd_args="-uroot -p$DATABASE_PASSWORD -h$SERVICE_LOCAL_HOST "
     fi
 
     # In mariadb e.g. on Ubuntu socket plugin is used for authentication
@@ -119,9 +125,7 @@ function configure_database_mysql {
 
     # Now update ``my.cnf`` for some local needs and restart the mysql service
 
-    # Change bind-address from localhost (127.0.0.1) to any (::) and
-    # set default db type to InnoDB
-    iniset -sudo $my_conf mysqld bind-address "$(ipv6_unquote $SERVICE_LISTEN_ADDRESS)"
+    # Set default db type to InnoDB
     iniset -sudo $my_conf mysqld sql_mode TRADITIONAL
     iniset -sudo $my_conf mysqld default-storage-engine InnoDB
     iniset -sudo $my_conf mysqld max_connections 1024

From 369042b74fe07e6f0f471fd50d7108586d55b97a Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Mon, 21 Mar 2022 15:29:38 -0500
Subject: [PATCH 2015/2409] Make centos-9-stream job voting

bug#1960346 is fixed by the below series
- https://review.opendev.org/q/(topic:bug/1960346+OR+topic:wait_until_sshable_pingable)+status:merged
and now centos-9-stream job is passing and made voting
on tempest gate.

This commit makes devstack centos9 steam platform job
as voting and add it gate pipeline too.

Change-Id: Ic35420c5d58926ae90a136045a1558112accc533
---
 .zuul.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index fc80e6c413..067d3f5b08 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -678,7 +678,6 @@
     parent: tempest-full-py3
     description: CentOS 9 Stream platform test
     nodeset: devstack-single-node-centos-9-stream
-    voting: false
     timeout: 9000
     vars:
       configure_swap_size: 4096
@@ -894,6 +893,7 @@
       jobs:
         - devstack
         - devstack-ipv6
+        - devstack-platform-centos-9-stream
         - devstack-enforce-scope
         - devstack-multinode
         - devstack-unit-tests

From cebd00aa0468a084d21fc6f43ed7d4c15db878f5 Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Thu, 17 Feb 2022 11:57:30 +0100
Subject: [PATCH 2016/2409] Clean usage of project_id in the Neutron's L3
 service module

After patch [1] project_id in that module is no longer needed as to make
it working with new secure RBAC policies we had to hardcode "demo"
project to be used always.
This is small follow-up patch with cleaning after [1].

[1] https://review.opendev.org/c/openstack/devstack/+/826851/

Change-Id: Iddf9692817c91807fc3269547910e4f83585f07f
---
 lib/neutron_plugins/services/l3 | 26 ++++++++++----------------
 1 file changed, 10 insertions(+), 16 deletions(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index cd98115746..c0d74c7728 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -147,10 +147,6 @@ function _neutron_get_ext_gw_interface {
 }
 
 function create_neutron_initial_network {
-    local project_id
-    project_id=$(openstack project list | grep " demo " | get_field 1)
-    die_if_not_set $LINENO project_id "Failure retrieving project_id for demo"
-
     # Allow drivers that need to create an initial network to do so here
     if type -p neutron_plugin_create_initial_network_profile > /dev/null; then
         neutron_plugin_create_initial_network_profile $PHYSICAL_NETWORK
@@ -171,14 +167,14 @@ function create_neutron_initial_network {
         die_if_not_set $LINENO PHYSICAL_NETWORK "You must specify the PHYSICAL_NETWORK"
         die_if_not_set $LINENO PROVIDER_NETWORK_TYPE "You must specify the PROVIDER_NETWORK_TYPE"
         NET_ID=$(openstack --os-cloud devstack-admin-demo --os-region "$REGION_NAME" network create $PHYSICAL_NETWORK --provider-network-type $PROVIDER_NETWORK_TYPE --provider-physical-network "$PHYSICAL_NETWORK" ${SEGMENTATION_ID:+--provider-segment $SEGMENTATION_ID} --share | grep ' id ' | get_field 2)
-        die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PHYSICAL_NETWORK $project_id"
+        die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PHYSICAL_NETWORK"
 
         if [[ "$IP_VERSION" =~ 4.* ]]; then
             if [ -z $SUBNETPOOL_V4_ID ]; then
                 fixed_range_v4=$FIXED_RANGE
             fi
             SUBNET_ID=$(openstack --os-cloud devstack --os-region "$REGION_NAME" subnet create --ip-version 4 ${ALLOCATION_POOL:+--allocation-pool $ALLOCATION_POOL} $PROVIDER_SUBNET_NAME --gateway $NETWORK_GATEWAY ${SUBNETPOOL_V4_ID:+--subnet-pool $SUBNETPOOL_V4_ID} --network $NET_ID ${fixed_range_v4:+--subnet-range $fixed_range_v4} | grep ' id ' | get_field 2)
-            die_if_not_set $LINENO SUBNET_ID "Failure creating SUBNET_ID for $PROVIDER_SUBNET_NAME $project_id"
+            die_if_not_set $LINENO SUBNET_ID "Failure creating SUBNET_ID for $PROVIDER_SUBNET_NAME"
         fi
 
         if [[ "$IP_VERSION" =~ .*6 ]]; then
@@ -188,7 +184,7 @@ function create_neutron_initial_network {
                 fixed_range_v6=$IPV6_PROVIDER_FIXED_RANGE
             fi
             IPV6_SUBNET_ID=$(openstack --os-cloud devstack --os-region "$REGION_NAME" subnet create --ip-version 6 --gateway $IPV6_PROVIDER_NETWORK_GATEWAY $IPV6_PROVIDER_SUBNET_NAME ${SUBNETPOOL_V6_ID:+--subnet-pool $SUBNETPOOL_V6_ID} --network $NET_ID ${fixed_range_v6:+--subnet-range $fixed_range_v6} | grep ' id ' | get_field 2)
-            die_if_not_set $LINENO IPV6_SUBNET_ID "Failure creating IPV6_SUBNET_ID for $IPV6_PROVIDER_SUBNET_NAME $project_id"
+            die_if_not_set $LINENO IPV6_SUBNET_ID "Failure creating IPV6_SUBNET_ID for $IPV6_PROVIDER_SUBNET_NAME"
         fi
 
         if [[ $Q_AGENT == "openvswitch" ]]; then
@@ -198,16 +194,16 @@ function create_neutron_initial_network {
         fi
     else
         NET_ID=$(openstack --os-cloud devstack --os-region "$REGION_NAME" network create "$PRIVATE_NETWORK_NAME" | grep ' id ' | get_field 2)
-        die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PRIVATE_NETWORK_NAME $project_id"
+        die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PRIVATE_NETWORK_NAME"
 
         if [[ "$IP_VERSION" =~ 4.* ]]; then
             # Create IPv4 private subnet
-            SUBNET_ID=$(_neutron_create_private_subnet_v4 $project_id)
+            SUBNET_ID=$(_neutron_create_private_subnet_v4)
         fi
 
         if [[ "$IP_VERSION" =~ .*6 ]]; then
             # Create IPv6 private subnet
-            IPV6_SUBNET_ID=$(_neutron_create_private_subnet_v6 $project_id)
+            IPV6_SUBNET_ID=$(_neutron_create_private_subnet_v6)
         fi
     fi
 
@@ -216,11 +212,11 @@ function create_neutron_initial_network {
         if [[ "$Q_L3_ROUTER_PER_TENANT" == "True" ]]; then
             # create a tenant-owned router.
             ROUTER_ID=$(openstack --os-cloud devstack --os-region "$REGION_NAME" router create $Q_ROUTER_NAME | grep ' id ' | get_field 2)
-            die_if_not_set $LINENO ROUTER_ID "Failure creating ROUTER_ID for $project_id $Q_ROUTER_NAME"
+            die_if_not_set $LINENO ROUTER_ID "Failure creating router $Q_ROUTER_NAME"
         else
             # Plugin only supports creating a single router, which should be admin owned.
             ROUTER_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" router create $Q_ROUTER_NAME | grep ' id ' | get_field 2)
-            die_if_not_set $LINENO ROUTER_ID "Failure creating ROUTER_ID for $Q_ROUTER_NAME"
+            die_if_not_set $LINENO ROUTER_ID "Failure creating router $Q_ROUTER_NAME"
         fi
 
         EXTERNAL_NETWORK_FLAGS="--external"
@@ -249,7 +245,6 @@ function create_neutron_initial_network {
 
 # Create private IPv4 subnet
 function _neutron_create_private_subnet_v4 {
-    local project_id=$1
     if [ -z $SUBNETPOOL_V4_ID ]; then
         fixed_range_v4=$FIXED_RANGE
     fi
@@ -263,13 +258,12 @@ function _neutron_create_private_subnet_v4 {
     subnet_params+="--network $NET_ID $PRIVATE_SUBNET_NAME"
     local subnet_id
     subnet_id=$(openstack --os-cloud devstack-admin-demo --os-region "$REGION_NAME" subnet create $subnet_params | grep ' id ' | get_field 2)
-    die_if_not_set $LINENO subnet_id "Failure creating private IPv4 subnet for $project_id"
+    die_if_not_set $LINENO subnet_id "Failure creating private IPv4 subnet"
     echo $subnet_id
 }
 
 # Create private IPv6 subnet
 function _neutron_create_private_subnet_v6 {
-    local project_id=$1
     die_if_not_set $LINENO IPV6_RA_MODE "IPV6 RA Mode not set"
     die_if_not_set $LINENO IPV6_ADDRESS_MODE "IPV6 Address Mode not set"
     local ipv6_modes="--ipv6-ra-mode $IPV6_RA_MODE --ipv6-address-mode $IPV6_ADDRESS_MODE"
@@ -285,7 +279,7 @@ function _neutron_create_private_subnet_v6 {
     subnet_params+="$ipv6_modes --network $NET_ID $IPV6_PRIVATE_SUBNET_NAME "
     local ipv6_subnet_id
     ipv6_subnet_id=$(openstack --os-cloud devstack-admin-demo --os-region "$REGION_NAME" subnet create $subnet_params | grep ' id ' | get_field 2)
-    die_if_not_set $LINENO ipv6_subnet_id "Failure creating private IPv6 subnet for $project_id"
+    die_if_not_set $LINENO ipv6_subnet_id "Failure creating private IPv6 subnet"
     echo $ipv6_subnet_id
 }
 

From 189c7ff14222fe365a7376e7ef7171bfb2c74b24 Mon Sep 17 00:00:00 2001
From: Martin Kopec <mkopec@redhat.com>
Date: Fri, 25 Mar 2022 14:06:52 +0100
Subject: [PATCH 2017/2409] Update DEVSTACK_SERIES to zed

stable/yoga branch has been created now and
current master is for zed.

Change-Id: I8743a3440a0ce96acb24b34971548b43ae7c8d4c
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index e48fd81d16..d22fa88373 100644
--- a/stackrc
+++ b/stackrc
@@ -235,7 +235,7 @@ REQUIREMENTS_DIR=${REQUIREMENTS_DIR:-$DEST/requirements}
 # Setting the variable to 'ALL' will activate the download for all
 # libraries.
 
-DEVSTACK_SERIES="yoga"
+DEVSTACK_SERIES="zed"
 
 ##############
 #

From 8dc342d400e4e19541bdd0627a746052875364c3 Mon Sep 17 00:00:00 2001
From: zhouyanbing <zhouyanbing.zhou@huawei.com>
Date: Sat, 26 Mar 2022 10:44:40 +0800
Subject: [PATCH 2018/2409] remove unuseful local variable define

the local varibale: api_cell_conf in start_nova_rest function
is unuseful, so remove it now.

Change-Id: I0019ce807cf3905ee246b684fce2abcb46336306
---
 lib/nova | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index 509cba6ff2..4c14374d0f 100644
--- a/lib/nova
+++ b/lib/nova
@@ -1045,7 +1045,6 @@ function start_nova_rest {
     local old_path=$PATH
     export PATH=$NOVA_BIN_DIR:$PATH
 
-    local api_cell_conf=$NOVA_CONF
     local compute_cell_conf=$NOVA_CONF
 
     run_process n-sch "$NOVA_BIN_DIR/nova-scheduler --config-file $compute_cell_conf"

From 5c51a95d10ba886fc9136e804844f60bc71aecf9 Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Mon, 28 Mar 2022 14:00:54 +0200
Subject: [PATCH 2019/2409] Drop setup.py and setup.cfg

devstack isn't a python project, these were introduced only for docs
building and made redundant with [0]. We can remove them now.

[0] Iedcc008b170821aa74acefc02ec6a243a0dc307c

Signed-off-by: Dr. Jens Harbott <harbott@osism.tech>
Change-Id: I90ca1c6918c016d10c579fbae49d13fff1ed59af
---
 setup.cfg | 12 ------------
 setup.py  | 22 ----------------------
 2 files changed, 34 deletions(-)
 delete mode 100644 setup.cfg
 delete mode 100755 setup.py

diff --git a/setup.cfg b/setup.cfg
deleted file mode 100644
index a4e621f6df..0000000000
--- a/setup.cfg
+++ /dev/null
@@ -1,12 +0,0 @@
-[metadata]
-name = DevStack
-summary = OpenStack DevStack
-description_file =
-    README.rst
-author = OpenStack
-author_email = openstack-discuss@lists.openstack.org
-home_page = https://docs.openstack.org/devstack/latest
-classifier =
-    Intended Audience :: Developers
-    License :: OSI Approved :: Apache Software License
-    Operating System :: POSIX :: Linux
diff --git a/setup.py b/setup.py
deleted file mode 100755
index 70c2b3f32b..0000000000
--- a/setup.py
+++ /dev/null
@@ -1,22 +0,0 @@
-#!/usr/bin/env python
-# Copyright (c) 2013 Hewlett-Packard Development Company, L.P.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#    http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-# implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# THIS FILE IS MANAGED BY THE GLOBAL REQUIREMENTS REPO - DO NOT EDIT
-import setuptools
-
-setuptools.setup(
-    setup_requires=['pbr'],
-    pbr=True)

From 45b029064f3f9ebb94cca97e572d9c0500abe21f Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Fri, 25 Mar 2022 22:23:04 -0500
Subject: [PATCH 2020/2409] Move openEuler job to experimental pipeline

OpenEuler job fails 100% of the time. As discussed in QA meeting,
we agreed to move OpenEuler job to experimental pipeline.
- https://meetings.opendev.org/meetings/qa/2022/qa.2022-03-22-15.00.log.html#l-76

Once it is fixed, we can think of adding back to regular pipeline.

Change-Id: I831889a09fabe5bed5522d17e352ec8009eac321
---
 .zuul.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 067d3f5b08..0dda2624d2 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -849,7 +849,6 @@
         - devstack-platform-centos-8-stream
         - devstack-platform-centos-9-stream
         - devstack-platform-debian-bullseye
-        - devstack-platform-openEuler-20.03-SP2
         - devstack-multinode
         - devstack-unit-tests
         - openstack-tox-bashate
@@ -948,6 +947,7 @@
 
     experimental:
       jobs:
+        - devstack-platform-openEuler-20.03-SP2
         - nova-multi-cell
         - nova-next
         - neutron-fullstack-with-uwsgi

From f4a703661ebea05690fadf93fd13df6e54a49b59 Mon Sep 17 00:00:00 2001
From: afariasa <afariasa@redhat.com>
Date: Wed, 6 Apr 2022 15:23:11 +0000
Subject: [PATCH 2021/2409] Add OpenStack two nodes nodeset for Centos 9

Change-Id: I01c8e5e0e88d0dcfe778f19548a2e268406ef6bf
---
 .zuul.yaml | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index 0dda2624d2..1c517f1def 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -176,6 +176,36 @@
         nodes:
           - compute1
 
+- nodeset:
+    name: openstack-two-node-centos-9-stream
+    nodes:
+      - name: controller
+        label: centos-9-stream
+      - name: compute1
+        label: centos-9-stream
+    groups:
+      # Node where tests are executed and test results collected
+      - name: tempest
+        nodes:
+          - controller
+      # Nodes running the compute service
+      - name: compute
+        nodes:
+          - controller
+          - compute1
+      # Nodes that are not the controller
+      - name: subnode
+        nodes:
+          - compute1
+      # Switch node for multinode networking setup
+      - name: switch
+        nodes:
+          - controller
+      # Peer nodes for multinode networking setup
+      - name: peers
+        nodes:
+          - compute1
+
 - nodeset:
     name: openstack-two-node-focal
     nodes:

From eca9783a0ad9c7d7e2e8267457be8d4dd8b55502 Mon Sep 17 00:00:00 2001
From: Sean Mooney <work@seanmooney.info>
Date: Wed, 9 Mar 2022 23:26:13 +0000
Subject: [PATCH 2022/2409] ensure /usr/local/bin in in path

osc is typicaly installed in /usr/local/bin
to avoid command not found errors when invoking osc
in devstack ensure that /usr/local/bin is included
in the PATH.

Change-Id: I605fbc4b131149bf5d1b6307b360fe365c680b1a
---
 stack.sh | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index 0082b99f11..6e9ced985e 100755
--- a/stack.sh
+++ b/stack.sh
@@ -67,7 +67,9 @@ unset `env | grep -E '^OS_' | cut -d = -f 1`
 umask 022
 
 # Not all distros have sbin in PATH for regular users.
-PATH=$PATH:/usr/local/sbin:/usr/sbin:/sbin
+# osc will normally be installed at /usr/local/bin/openstack so ensure
+# /usr/local/bin is also in the path
+PATH=$PATH:/usr/local/bin:/usr/local/sbin:/usr/sbin:/sbin
 
 # Keep track of the DevStack directory
 TOP_DIR=$(cd $(dirname "$0") && pwd)

From bfbd2be00b38fbc4a5fd082cf44e0fdf06cc5330 Mon Sep 17 00:00:00 2001
From: Artur Angiel <arturangiel@gmail.com>
Date: Sun, 10 Apr 2022 11:31:21 +0200
Subject: [PATCH 2023/2409] Added recursive for deletion of $OVN_RUNDIR

After ./unstack.sh trying to 'enable_plugin venus https://opendev.org/openstack/venus' gived following error:

+lib/neutron_plugins/ovn_agent:install_ovn:363  sudo ln -s /var/run/openvswitch /var/run/ovn
ln: failed to create symbolic link '/var/run/ovn/openvswitch': File exists

which led to:

+lib/neutron_plugins/ovn_agent:cleanup_ovn:801  sudo rm -f /var/run/ovn
rm: cannot remove '/var/run/ovn': Is a directory

Change-Id: I1cafdc0c71093ed7249bb9748b57d51110986686
---
 lib/neutron_plugins/ovn_agent | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index 927896b70b..2938f472bc 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -798,5 +798,5 @@ function cleanup_ovn {
         _cleanup $ovs_path
     fi
 
-    sudo rm -f $OVN_RUNDIR
+    sudo rm -rf $OVN_RUNDIR
 }

From 676dcaf94487665882be048cfe1f3206d6807e0f Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Wed, 13 Apr 2022 15:04:46 +1000
Subject: [PATCH 2024/2409] Mark our source trees as safe for git to use as
 other users

git commit [1] introduced a new behaviour to work around a CVE that
disallows any git operations in directories not owned by the current
user.

This may seem unrelated to installation, but it plays havoc with PBR,
which calls out to git to get to get revision history.  So if you are
"pip install"-ing from a source tree you don't own, the PBR git calls
in that tree now fail and the install blows up.

This plays havoc with our model.  Firstly, we checkout all code as
"stack" then install it globally with "sudo" (i.e. root) -- which
breaks.  We also have cases of essentially the opposite -- checkouts
we have installed as root, but then run tox in them as a regular user;
tox wants to install the source in its venv but now we have another
user conflict.

This uses the only available configuration option to avoid that by
globally setting the source directories we clone as safe.  This is an
encroachment of the global system for sure, but is about the only
switch available at the moment.  For discussion of other approaches,
see [2].

Related-Bug: https://bugs.launchpad.net/devstack/+bug/1968798

[1] https://github.com/git/git/commit/8959555cee7ec045958f9b6dd62e541affb7e7d9
[2] https://review.opendev.org/c/openstack/devstack/+/837636

Change-Id: Ib9896a99b6d6c4d359ee412743ce30512b3c4fb7
---
 functions-common | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/functions-common b/functions-common
index b2cf9d99c6..ddef2e4980 100644
--- a/functions-common
+++ b/functions-common
@@ -673,6 +673,13 @@ function git_clone {
         fi
     fi
 
+    # NOTE(ianw) 2022-04-13 : commit [1] has broken many assumptions
+    # about how we clone and work with repos.  Mark them safe globally
+    # as a work-around.
+    #
+    # [1] https://github.com/git/git/commit/8959555cee7ec045958f9b6dd62e541affb7e7d9
+    sudo git config --global --add safe.directory ${git_dest}
+
     # print out the results so we know what change was used in the logs
     cd $git_dest
     git show --oneline | head -1

From 4baeb3b51fcb6196fa311f823ad3f0ac13ccf341 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Wed, 13 Apr 2022 13:44:07 -0700
Subject: [PATCH 2025/2409] Write safe.directory items to system git config

This is necessary for more consistent behavior across multiple
distro versions. Apparently somewhere along the way, git started
looking at the current user's home directory instead of $HOME.

Related-Bug: https://bugs.launchpad.net/devstack/+bug/1968798

Change-Id: I941ef5ea90970a0901236afe81c551aaf24ac1d8
---
 functions-common | 7 ++++++-
 unstack.sh       | 5 +++++
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index ddef2e4980..8651604b79 100644
--- a/functions-common
+++ b/functions-common
@@ -677,8 +677,13 @@ function git_clone {
     # about how we clone and work with repos.  Mark them safe globally
     # as a work-around.
     #
+    # NOTE(danms): On bionic (and likely others) git-config may write
+    # ~stackuser/.gitconfig if not run with sudo -H. Using --system
+    # writes these changes to /etc/gitconfig which is more
+    # discoverable anyway.
+    #
     # [1] https://github.com/git/git/commit/8959555cee7ec045958f9b6dd62e541affb7e7d9
-    sudo git config --global --add safe.directory ${git_dest}
+    sudo git config --system --add safe.directory ${git_dest}
 
     # print out the results so we know what change was used in the logs
     cd $git_dest
diff --git a/unstack.sh b/unstack.sh
index 4b57b6e344..813f9a8117 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -181,3 +181,8 @@ fi
 
 clean_pyc_files
 rm -Rf $DEST/async
+
+# Clean any safe.directory items we wrote into the global
+# gitconfig. We can identify the relevant ones by checking that they
+# point to somewhere in our $DEST directory.
+sudo sed -i "/directory=${DEST}/ d" /etc/gitconfig

From 28bed125a2555fb3da778898d6ae310175972d3c Mon Sep 17 00:00:00 2001
From: Mohammed Naser <mnaser@vexxhost.com>
Date: Wed, 20 Apr 2022 15:11:39 -0400
Subject: [PATCH 2026/2409] nova: unset cpu_model on aarch64

Without this, running DevStack on an `aarch64` environment will end
up in cpu_model set to "Nehalem" and cpu_mode set to "host-passthrough"
which does not work.

This patch drops that value under aarch64 environments.

Change-Id: I30be5a388dda5ccf08718670dbb14a28a4a8a8eb
---
 lib/nova_plugins/hypervisor-libvirt | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/nova_plugins/hypervisor-libvirt b/lib/nova_plugins/hypervisor-libvirt
index c1cd132548..6c6f4c4261 100644
--- a/lib/nova_plugins/hypervisor-libvirt
+++ b/lib/nova_plugins/hypervisor-libvirt
@@ -56,6 +56,10 @@ function configure_nova_hypervisor {
     # arm64-specific configuration
     if is_arch "aarch64"; then
         iniset $NOVA_CONF libvirt cpu_mode "host-passthrough"
+        # NOTE(mnaser): We cannot have `cpu_model` set if the `cpu_mode` is
+        #               set to `host-passthrough`, or `nova-compute` refuses to
+        #               start.
+        inidelete $NOVA_CONF libvirt cpu_model
     fi
 
     if isset ENABLE_FILE_INJECTION; then

From 7fa24750a676a44ab224206cc13096f904057d44 Mon Sep 17 00:00:00 2001
From: Mohammed Naser <mnaser@vexxhost.com>
Date: Wed, 20 Apr 2022 15:42:43 -0400
Subject: [PATCH 2027/2409] ovn: use bundled ovs

We are using the latest OVS, however, OVN needs to build using the
OVS submodule since some of the signatures don't work[1].

[1]: https://github.com/ovn-org/ovn/issues/128

Change-Id: I3ad7e5e80f1141c3d94f7ce7c8b8f8fdb9fb7c3c
---
 lib/neutron_plugins/ovn_agent | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index 927896b70b..bf1b23a82b 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -320,8 +320,24 @@ function compile_ovn {
         ./boot.sh
     fi
 
+    # NOTE(mnaser): OVN requires that you build using the OVS from the
+    #               submodule.
+    #
+    #               https://github.com/ovn-org/ovn/blob/3fb397b63663297acbcbf794e1233951222ae5af/Documentation/intro/install/general.rst#bootstrapping
+    #               https://github.com/ovn-org/ovn/issues/128
+    git submodule update --init
+    pushd ovs
+    if [ ! -f configure ] ; then
+        ./boot.sh
+    fi
+    if [ ! -f config.status ] || [ configure -nt config.status ] ; then
+        ./configure
+    fi
+    make -j$(($(nproc) + 1))
+    popd
+
     if [ ! -f config.status ] || [ configure -nt config.status ] ; then
-        ./configure --with-ovs-source=$DEST/$OVS_REPO_NAME $prefix $localstatedir
+        ./configure $prefix $localstatedir
     fi
     make -j$(($(nproc) + 1))
     sudo make install

From c2772c2984e4f29aa6032725e4f7d8680a54ed19 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Fri, 8 Apr 2022 08:48:49 -0700
Subject: [PATCH 2028/2409] Gather performance data after tempest

This makes us gather a bunch of consistent statistics after we run
tempest that can be use to measure the impact of a given change. These
are stable metrics such as "number of DB queries made" and "how much
memory is each service using after a tempest run."

Note that this will always run after devstack to generate the JSON
file, but there are two things that control its completeness:

 - MYSQL_GATHER_PERFORMANCE must be enabled to get per-db stats
 - Unless tls-proxy is enabled, we will only get API stats for keystone

Change-Id: Ie3b1504256dc1c9c6b59634e86fa98494bcb07b1
---
 .zuul.yaml                                    |   1 +
 lib/databases/mysql                           |   9 +
 playbooks/post.yaml                           |   3 +
 roles/capture-performance-data/README.rst     |  25 +++
 .../defaults/main.yaml                        |   3 +
 .../capture-performance-data/tasks/main.yaml  |  15 ++
 stackrc                                       |   4 +
 tools/get-stats.py                            | 155 ++++++++++++++++++
 8 files changed, 215 insertions(+)
 create mode 100644 roles/capture-performance-data/README.rst
 create mode 100644 roles/capture-performance-data/defaults/main.yaml
 create mode 100644 roles/capture-performance-data/tasks/main.yaml
 create mode 100755 tools/get-stats.py

diff --git a/.zuul.yaml b/.zuul.yaml
index 0dda2624d2..329cb527f3 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -389,6 +389,7 @@
         '{{ devstack_log_dir }}/worlddump-latest.txt': logs
         '{{ devstack_full_log}}': logs
         '{{ stage_dir }}/verify_tempest_conf.log': logs
+        '{{ stage_dir }}/performance.json': logs
         '{{ stage_dir }}/apache': logs
         '{{ stage_dir }}/apache_config': logs
         '{{ stage_dir }}/etc': logs
diff --git a/lib/databases/mysql b/lib/databases/mysql
index 0f45273d4b..6b3ea0287c 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -150,6 +150,15 @@ function configure_database_mysql {
         iniset -sudo $my_conf mysqld log-queries-not-using-indexes 1
     fi
 
+    if [[ "$MYSQL_GATHER_PERFORMANCE" == "True" ]]; then
+        echo "enabling MySQL performance_schema items"
+        # Enable long query history
+        iniset -sudo $my_conf mysqld \
+               performance-schema-consumer-events-statements-history-long TRUE
+        iniset -sudo $my_conf mysqld \
+               performance_schema_events_stages_history_long_size 1000000
+    fi
+
     restart_service $MYSQL_SERVICE_NAME
 }
 
diff --git a/playbooks/post.yaml b/playbooks/post.yaml
index 9e66f20e9e..d8d5f6833c 100644
--- a/playbooks/post.yaml
+++ b/playbooks/post.yaml
@@ -20,6 +20,9 @@
   roles:
     - export-devstack-journal
     - apache-logs-conf
+    # This should run as early as possible to make sure we don't skew
+    # the post-tempest results with other activities.
+    - capture-performance-data
     - devstack-project-conf
     # capture-system-logs should be the last role before stage-output
     - capture-system-logs
diff --git a/roles/capture-performance-data/README.rst b/roles/capture-performance-data/README.rst
new file mode 100644
index 0000000000..b7a37c223f
--- /dev/null
+++ b/roles/capture-performance-data/README.rst
@@ -0,0 +1,25 @@
+Generate performance logs for staging
+
+Captures usage information from mysql, systemd, apache logs, and other
+parts of the system and generates a performance.json file in the
+staging directory.
+
+**Role Variables**
+
+.. zuul:rolevar:: stage_dir
+   :default: {{ ansible_user_dir }}
+
+   The base stage directory
+
+.. zuul:rolevar:: devstack_conf_dir
+   :default: /opt/stack
+
+   The base devstack destination directory
+
+.. zuul:rolevar:: debian_suse_apache_deref_logs
+
+   The apache logs found in the debian/suse locations
+
+.. zuul:rolevar:: redhat_apache_deref_logs
+
+   The apache logs found in the redhat locations
diff --git a/roles/capture-performance-data/defaults/main.yaml b/roles/capture-performance-data/defaults/main.yaml
new file mode 100644
index 0000000000..7bd79f4c4f
--- /dev/null
+++ b/roles/capture-performance-data/defaults/main.yaml
@@ -0,0 +1,3 @@
+devstack_base_dir: /opt/stack
+devstack_conf_dir: "{{ devstack_base_dir }}"
+stage_dir: "{{ ansible_user_dir }}"
diff --git a/roles/capture-performance-data/tasks/main.yaml b/roles/capture-performance-data/tasks/main.yaml
new file mode 100644
index 0000000000..2d2cfe4b8b
--- /dev/null
+++ b/roles/capture-performance-data/tasks/main.yaml
@@ -0,0 +1,15 @@
+- name: Generate statistics
+  shell:
+    executable: /bin/bash
+    cmd: |
+      source {{ devstack_conf_dir }}/stackrc
+      python3 {{ devstack_conf_dir }}/tools/get-stats.py \
+        --db-user="$DATABASE_USER" \
+        --db-pass="$DATABASE_PASSWORD" \
+        --db-host="$DATABASE_HOST" \
+        {{ apache_logs }} > {{ stage_dir }}/performance.json
+  vars:
+    apache_logs: >-
+      {% for i in debian_suse_apache_deref_logs.results | default([]) + redhat_apache_deref_logs.results | default([]) %}
+      --apache-log="{{ i.stat.path }}"
+      {% endfor %}
diff --git a/stackrc b/stackrc
index d22fa88373..c3254dcce4 100644
--- a/stackrc
+++ b/stackrc
@@ -193,6 +193,10 @@ ADDITIONAL_VENV_PACKAGES=${ADITIONAL_VENV_PACKAGES:-""}
 # (currently only implemented for MySQL backend)
 DATABASE_QUERY_LOGGING=$(trueorfalse False DATABASE_QUERY_LOGGING)
 
+# This can be used to turn on various non-default items in the
+# performance_schema that are of interest to us
+MYSQL_GATHER_PERFORMANCE=$(trueorfalse True MYSQL_GATHER_PERFORMANCE)
+
 # Set a timeout for git operations.  If git is still running when the
 # timeout expires, the command will be retried up to 3 times.  This is
 # in the format for timeout(1);
diff --git a/tools/get-stats.py b/tools/get-stats.py
new file mode 100755
index 0000000000..dc0bd0f9e5
--- /dev/null
+++ b/tools/get-stats.py
@@ -0,0 +1,155 @@
+#!/usr/bin/python3
+
+import argparse
+import datetime
+import glob
+import itertools
+import json
+import os
+import psutil
+import re
+import socket
+import subprocess
+import sys
+import pymysql
+
+# https://www.elastic.co/blog/found-crash-elasticsearch#mapping-explosion
+
+
+def tryint(value):
+    try:
+        return int(value)
+    except (ValueError, TypeError):
+        return value
+
+
+def get_service_stats(service):
+    stats = {'MemoryCurrent': 0}
+    output = subprocess.check_output(['/usr/bin/systemctl', 'show', service] +
+                                     ['-p%s' % stat for stat in stats])
+    for line in output.decode().split('\n'):
+        if not line:
+            continue
+        stat, val = line.split('=')
+        stats[stat] = int(val)
+
+    return stats
+
+
+def get_services_stats():
+    services = [os.path.basename(s) for s in
+                glob.glob('/etc/systemd/system/devstack@*.service')]
+    return [dict(service=service, **get_service_stats(service))
+            for service in services]
+
+
+def get_process_stats(proc):
+    cmdline = proc.cmdline()
+    if 'python' in cmdline[0]:
+        cmdline = cmdline[1:]
+    return {'cmd': cmdline[0],
+            'pid': proc.pid,
+            'args': ' '.join(cmdline[1:]),
+            'rss': proc.memory_info().rss}
+
+
+def get_processes_stats(matches):
+    me = os.getpid()
+    procs = psutil.process_iter()
+
+    def proc_matches(proc):
+        return me != proc.pid and any(
+            re.search(match, ' '.join(proc.cmdline()))
+            for match in matches)
+
+    return [
+        get_process_stats(proc)
+        for proc in procs
+        if proc_matches(proc)]
+
+
+def get_db_stats(host, user, passwd):
+    dbs = []
+    db = pymysql.connect(host=host, user=user, password=passwd,
+                         database='performance_schema',
+                         cursorclass=pymysql.cursors.DictCursor)
+    with db:
+        with db.cursor() as cur:
+            cur.execute(
+                'SELECT COUNT(*) AS queries,current_schema AS db FROM '
+                'events_statements_history_long GROUP BY current_schema')
+            for row in cur:
+                dbs.append({k: tryint(v) for k, v in row.items()})
+    return dbs
+
+
+def get_http_stats_for_log(logfile):
+    stats = {}
+    for line in open(logfile).readlines():
+        m = re.search('"([A-Z]+) /([^" ]+)( HTTP/1.1)?" ([0-9]{3}) ([0-9]+)',
+                      line)
+        if m:
+            method = m.group(1)
+            path = m.group(2)
+            status = m.group(4)
+            size = int(m.group(5))
+
+            try:
+                service, rest = path.split('/', 1)
+            except ValueError:
+                # Root calls like "GET /identity"
+                service = path
+                rest = ''
+
+            stats.setdefault(service, {'largest': 0})
+            stats[service].setdefault(method, 0)
+            stats[service][method] += 1
+            stats[service]['largest'] = max(stats[service]['largest'], size)
+
+    # Flatten this for ES
+    return [{'service': service, 'log': os.path.basename(logfile),
+             **vals}
+            for service, vals in stats.items()]
+
+
+def get_http_stats(logfiles):
+    return list(itertools.chain.from_iterable(get_http_stats_for_log(log)
+                                              for log in logfiles))
+
+
+def get_report_info():
+    return {
+        'timestamp': datetime.datetime.now().isoformat(),
+        'hostname': socket.gethostname(),
+    }
+
+
+if __name__ == '__main__':
+    process_defaults = ['privsep', 'mysqld', 'erlang', 'etcd']
+    parser = argparse.ArgumentParser()
+    parser.add_argument('--db-user', default='root',
+                        help=('MySQL user for collecting stats '
+                              '(default: "root")'))
+    parser.add_argument('--db-pass', default=None,
+                        help='MySQL password for db-user')
+    parser.add_argument('--db-host', default='localhost',
+                        help='MySQL hostname')
+    parser.add_argument('--apache-log', action='append', default=[],
+                        help='Collect API call stats from this apache log')
+    parser.add_argument('--process', action='append',
+                        default=process_defaults,
+                        help=('Include process stats for this cmdline regex '
+                              '(default is %s)' % ','.join(process_defaults)))
+    args = parser.parse_args()
+
+    data = {
+        'services': get_services_stats(),
+        'db': args.db_pass and get_db_stats(args.db_host,
+                                            args.db_user,
+                                            args.db_pass) or [],
+        'processes': get_processes_stats(args.process),
+        'api': get_http_stats(args.apache_log),
+        'report': get_report_info(),
+    }
+
+    print(json.dumps(data, indent=2))

From 4423450eb334aad6f889ddae2ab9b9a2a2197a4a Mon Sep 17 00:00:00 2001
From: Zhou Yanbing <zhouyanbing.zhou@huawei.com>
Date: Thu, 21 Apr 2022 15:00:41 +0800
Subject: [PATCH 2029/2409] modify the sample value of LOGDAYS

the value of LOGDAYS in samples/local.conf is 2, so change the
value in the comment and the sample value in the document to
be consistent with it.

Change-Id: I5822bbf1d6ad347c67c886be1e3325113d079114
---
 doc/source/configuration.rst | 2 +-
 samples/local.conf           | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index dd8f21faaf..40a8725b8d 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -279,7 +279,7 @@ number of days of old log files to keep.
 
 ::
 
-    LOGDAYS=1
+    LOGDAYS=2
 
 Some coloring is used during the DevStack runs to make it easier to
 see what is going on. This can be disabled with::
diff --git a/samples/local.conf b/samples/local.conf
index 8b76137c38..55b729809d 100644
--- a/samples/local.conf
+++ b/samples/local.conf
@@ -49,7 +49,7 @@ SERVICE_PASSWORD=$ADMIN_PASSWORD
 # path of the destination log file.  A timestamp will be appended to the given name.
 LOGFILE=$DEST/logs/stack.sh.log
 
-# Old log files are automatically removed after 7 days to keep things neat.  Change
+# Old log files are automatically removed after 2 days to keep things neat.  Change
 # the number of days by setting ``LOGDAYS``.
 LOGDAYS=2
 

From af75f689fa5d03446593c3b4c7724f0922f0f19a Mon Sep 17 00:00:00 2001
From: Sean Mooney <work@seanmooney.info>
Date: Thu, 14 Apr 2022 21:48:38 +0100
Subject: [PATCH 2030/2409] install mod_ssl on centos 9 stream by default

This change adds mod_ssl to the default set of rpms installed
on rpm based distros.

this is required if the tls-proxy service is enabled
for multi node centos based jobs.

Change-Id: I52652de88352094c824da68e5baf7db4c17cb027
---
 files/rpms/general | 1 +
 1 file changed, 1 insertion(+)

diff --git a/files/rpms/general b/files/rpms/general
index 163a7c8f24..668705b1c3 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -17,6 +17,7 @@ libxml2-devel # lxml
 libxslt-devel # lxml
 libyaml-devel
 make # dist:openEuler-20.03
+mod_ssl # required for tls-proxy on centos 9 stream computes
 net-tools
 openssh-server
 openssl

From 7191c5e7e7edb1e2f28c0ce71294f61b409cf16b Mon Sep 17 00:00:00 2001
From: Balazs Gibizer <gibi@redhat.com>
Date: Fri, 22 Apr 2022 12:01:13 +0200
Subject: [PATCH 2031/2409] Use proper sed separator for paths

I941ef5ea90970a0901236afe81c551aaf24ac1d8 added a sed command that
should match and delete path values but used '/' as sed separator. This
leads to error in unstack.sh runs when the path also contains '/':

+./unstack.sh:main:188 sudo sed -i '/directory=/opt/stack/ d' /etc/gitconfig
sed: -e expression #1, char 13: unknown command: `o'

So this patch replace '/' separator with '+'.

Change-Id: I06811c0d9ee7ecddf84ef1c6dd6cff5129dbf4b1
---
 unstack.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/unstack.sh b/unstack.sh
index 813f9a8117..a36af3fb59 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -185,4 +185,4 @@ rm -Rf $DEST/async
 # Clean any safe.directory items we wrote into the global
 # gitconfig. We can identify the relevant ones by checking that they
 # point to somewhere in our $DEST directory.
-sudo sed -i "/directory=${DEST}/ d" /etc/gitconfig
+sudo sed -i "\+directory = ${DEST}+ d" /etc/gitconfig

From c6dfd169aeb3fbf2ba73ad8403cc1feb7c6ecf76 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Mon, 25 Apr 2022 15:19:06 -0500
Subject: [PATCH 2032/2409] Drop centos 8 stream testing

In Zed cycle testing runtime, we are targetting the centos 9 stream
- https://governance.openstack.org/tc/reference/runtimes/zed.html

With dropping the python 3.6 support, project started adding python 3.8
as minimum, example nova:
- https://github.com/openstack/nova/blob/56b5aed08c6a3ed81b78dc216f0165ebfe3c3350/setup.cfg#L13

with that, centos 8 stream job is failing 100%
- https://zuul.openstack.org/build/970d029dc96742c3aa0f6932a35e97cf
- https://zuul.openstack.org/builds?job_name=devstack-platform-centos-8-stream&skip=0

This commit drops centos-8-stream testing so that we focus on centos-9-stream.

Change-Id: I045e67b1ca79aba1b2a7be9f88d7804c69c6d781
---
 .zuul.yaml | 51 ---------------------------------------------------
 1 file changed, 51 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 8fd4d0212c..a437c1cc02 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -56,16 +56,6 @@
         nodes:
           - controller
 
-- nodeset:
-    name: devstack-single-node-centos-8-stream
-    nodes:
-      - name: controller
-        label: centos-8-stream
-    groups:
-      - name: tempest
-        nodes:
-          - controller
-
 - nodeset:
     name: devstack-single-node-centos-9-stream
     nodes:
@@ -146,36 +136,6 @@
         nodes:
           - compute1
 
-- nodeset:
-    name: openstack-two-node-centos-8-stream
-    nodes:
-      - name: controller
-        label: centos-8-stream
-      - name: compute1
-        label: centos-8-stream
-    groups:
-      # Node where tests are executed and test results collected
-      - name: tempest
-        nodes:
-          - controller
-      # Nodes running the compute service
-      - name: compute
-        nodes:
-          - controller
-          - compute1
-      # Nodes that are not the controller
-      - name: subnode
-        nodes:
-          - compute1
-      # Switch node for multinode networking setup
-      - name: switch
-        nodes:
-          - controller
-      # Peer nodes for multinode networking setup
-      - name: peers
-        nodes:
-          - compute1
-
 - nodeset:
     name: openstack-two-node-centos-9-stream
     nodes:
@@ -694,16 +654,6 @@
 # we often have to rush things through devstack to stabilise the gate,
 # and these platforms don't have the round-the-clock support to avoid
 # becoming blockers in that situation.
-- job:
-    name: devstack-platform-centos-8-stream
-    parent: tempest-full-py3
-    description: CentOS 8 Stream platform test
-    nodeset: devstack-single-node-centos-8-stream
-    voting: false
-    timeout: 9000
-    vars:
-      configure_swap_size: 4096
-
 - job:
     name: devstack-platform-centos-9-stream
     parent: tempest-full-py3
@@ -877,7 +827,6 @@
         - devstack-ipv6
         - devstack-enforce-scope
         - devstack-platform-fedora-latest
-        - devstack-platform-centos-8-stream
         - devstack-platform-centos-9-stream
         - devstack-platform-debian-bullseye
         - devstack-multinode

From 8615563df47261d9c6dab7c5badbceb399d0e14d Mon Sep 17 00:00:00 2001
From: Grzegorz Grasza <xek@redhat.com>
Date: Mon, 18 Oct 2021 16:52:06 +0200
Subject: [PATCH 2033/2409] Global option for enforcing scope (ENFORCE_SCOPE)

This updates each devstack service library, to use it as the
default value for service-specific RBAC configuration.

Change-Id: I41061d042206c411ee3dd94ce91098e612af7ae7
---
 .zuul.yaml         |  5 +----
 functions-common   |  2 +-
 lib/cinder         |  2 +-
 lib/glance         |  2 +-
 lib/keystone       |  2 +-
 lib/neutron        |  2 +-
 lib/neutron-legacy |  2 +-
 lib/tempest        | 11 ++++++++---
 stackrc            |  4 ++++
 9 files changed, 19 insertions(+), 13 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index fc80e6c413..0f047166fa 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -646,10 +646,7 @@
       This job runs the devstack with scope checks enabled.
     vars:
       devstack_localrc:
-        # Keep enabeling the services here to run with system scope
-        CINDER_ENFORCE_SCOPE: true
-        GLANCE_ENFORCE_SCOPE: true
-        NEUTRON_ENFORCE_SCOPE: true
+        ENFORCE_SCOPE: true
 
 - job:
     name: devstack-multinode
diff --git a/functions-common b/functions-common
index b2cf9d99c6..603e7d896d 100644
--- a/functions-common
+++ b/functions-common
@@ -1154,7 +1154,7 @@ function is_ironic_hardware {
 }
 
 function is_ironic_enforce_scope {
-    is_service_enabled ironic && [[ "$IRONIC_ENFORCE_SCOPE" == "True" ]] && return 0
+    is_service_enabled ironic && [[ "$IRONIC_ENFORCE_SCOPE" == "True" || "$ENFORCE_SCOPE" == "True" ]] && return 0
     return 1
 }
 
diff --git a/lib/cinder b/lib/cinder
index b029fa0db4..52818a81eb 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -380,7 +380,7 @@ function configure_cinder {
         iniset $CINDER_CONF coordination backend_url "etcd3+http://${SERVICE_HOST}:$ETCD_PORT"
     fi
 
-    if [[ "$CINDER_ENFORCE_SCOPE" == True ]] ; then
+    if [[ "$CINDER_ENFORCE_SCOPE" == True || "$ENFORCE_SCOPE" == True ]] ; then
         iniset $CINDER_CONF oslo_policy enforce_scope true
         iniset $CINDER_CONF oslo_policy enforce_new_defaults true
     fi
diff --git a/lib/glance b/lib/glance
index 9bba938b9d..04b901181c 100644
--- a/lib/glance
+++ b/lib/glance
@@ -432,7 +432,7 @@ function configure_glance {
         iniset $GLANCE_API_CONF DEFAULT workers "$API_WORKERS"
     fi
 
-    if [[ "$GLANCE_ENFORCE_SCOPE" == True ]] ; then
+    if [[ "$GLANCE_ENFORCE_SCOPE" == True || "$ENFORCE_SCOPE" == True ]] ; then
         iniset $GLANCE_API_CONF oslo_policy enforce_scope true
         iniset $GLANCE_API_CONF oslo_policy enforce_new_defaults true
         iniset $GLANCE_API_CONF DEFAULT enforce_secure_rbac true
diff --git a/lib/keystone b/lib/keystone
index a4c8a52121..80a136f78d 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -265,7 +265,7 @@ function configure_keystone {
         iniset $KEYSTONE_CONF security_compliance lockout_duration $KEYSTONE_LOCKOUT_DURATION
         iniset $KEYSTONE_CONF security_compliance unique_last_password_count $KEYSTONE_UNIQUE_LAST_PASSWORD_COUNT
     fi
-    if [[ "$KEYSTONE_ENFORCE_SCOPE" == True ]] ; then
+    if [[ "$KEYSTONE_ENFORCE_SCOPE" == True || "$ENFORCE_SCOPE" == True ]] ; then
         iniset $KEYSTONE_CONF oslo_policy enforce_scope true
         iniset $KEYSTONE_CONF oslo_policy enforce_new_defaults true
         iniset $KEYSTONE_CONF oslo_policy policy_file policy.yaml
diff --git a/lib/neutron b/lib/neutron
index e7719d4ebc..f24ccfb1a9 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -632,7 +632,7 @@ function configure_neutron {
 # configure_rbac_policies() - Configure Neutron to enforce new RBAC
 # policies and scopes if NEUTRON_ENFORCE_SCOPE == True
 function configure_rbac_policies {
-    if [ "$NEUTRON_ENFORCE_SCOPE" == "True" ]; then
+    if [[ "$NEUTRON_ENFORCE_SCOPE" == "True" || "ENFORCE_SCOPE" == "True" ]]; then
         iniset $NEUTRON_CONF oslo_policy enforce_new_defaults True
         iniset $NEUTRON_CONF oslo_policy enforce_scope True
     else
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index b906a1b2ff..253b457ae1 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -500,7 +500,7 @@ function configure_neutron_after_post_config {
 # configure_rbac_policies() - Configure Neutron to enforce new RBAC
 # policies and scopes if NEUTRON_ENFORCE_SCOPE == True
 function configure_rbac_policies {
-    if [ "$NEUTRON_ENFORCE_SCOPE" == "True" ]; then
+    if [[ "$NEUTRON_ENFORCE_SCOPE" == "True" || "$ENFORCE_SCOPE" == True ]]; then
         iniset $NEUTRON_CONF oslo_policy enforce_new_defaults True
         iniset $NEUTRON_CONF oslo_policy enforce_scope True
     else
diff --git a/lib/tempest b/lib/tempest
index 45046632b4..1fd4184763 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -607,14 +607,19 @@ function configure_tempest {
     # If services enable the enforce_scope for their policy
     # we need to enable the same on Tempest side so that
     # test can be run with scoped token.
-    if [[ "$KEYSTONE_ENFORCE_SCOPE" == True ]] ; then
+    if [[ "$KEYSTONE_ENFORCE_SCOPE" == True || "$ENFORCE_SCOPE" == True ]] ; then
         iniset $TEMPEST_CONFIG enforce_scope keystone true
         iniset $TEMPEST_CONFIG auth admin_system 'all'
         iniset $TEMPEST_CONFIG auth admin_project_name ''
     fi
-    iniset $TEMPEST_CONFIG enforce_scope glance "$GLANCE_ENFORCE_SCOPE"
 
-    iniset $TEMPEST_CONFIG enforce_scope cinder "$CINDER_ENFORCE_SCOPE"
+    if [[ "$GLANCE_ENFORCE_SCOPE" == True || "$ENFORCE_SCOPE" == True ]] ; then
+        iniset $TEMPEST_CONFIG enforce_scope glance true
+    fi
+
+    if [[ "$CINDER_ENFORCE_SCOPE" == True || "$ENFORCE_SCOPE" == True ]] ; then
+        iniset $TEMPEST_CONFIG enforce_scope cinder true
+    fi
 
     if [ "$VIRT_DRIVER" = "libvirt" ] && [ "$LIBVIRT_TYPE" = "lxc" ]; then
         # libvirt-lxc does not support boot from volume or attaching volumes
diff --git a/stackrc b/stackrc
index 681e9dee38..72180d07f2 100644
--- a/stackrc
+++ b/stackrc
@@ -179,6 +179,10 @@ fi
 # TODO(frickler): Drop this when plugins no longer need it
 IDENTITY_API_VERSION=3
 
+# Global option for enforcing scope. If enabled, ENFORCE_SCOPE overrides
+# each services ${SERVICE}_ENFORCE_SCOPE variables
+ENFORCE_SCOPE=$(trueorfalse False ENFORCE_SCOPE)
+
 # Enable use of Python virtual environments.  Individual project use of
 # venvs are controlled by the PROJECT_VENV array; every project with
 # an entry in the array will be installed into the named venv.

From 6964ba4a984691d79cff77506a37d0fa222a5599 Mon Sep 17 00:00:00 2001
From: Julia Kreger <juliaashleykreger@gmail.com>
Date: Mon, 25 Apr 2022 08:48:20 -0700
Subject: [PATCH 2034/2409] Set public bridge up for v6 only configurations

A long time ago, Ironic's IPv6 only job started to fail working with
errors indicated the host was unreacable. Turns out, this was because
the $ext_gw_interface was not being set to up, and thus could
be found in a Down state, and thus the kernel would not accept routes
for it.

Adds an explicit step to turn up the public bridge, much as done in
the IPv4 router plugin code which would also be executed in 4+6.

That being said, Ironic's CI jobs are very intentionally IPv6 only
to ensure that we have no chances of v4 addressing getting used
at any point in time.

This should allow Ironic to return it's IPv6 only CI job back
to the normal check queue, once a ironic plugin issue has been
resolved which was introduced while it was removed.

Change-Id: I121ec8a2e9640b21a7126f2eeb23da36b4aa95bf
---
 lib/neutron_plugins/services/l3 | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index c0d74c7728..fbd4692bba 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -403,7 +403,10 @@ function _neutron_configure_router_v6 {
             ext_gw_interface=$(_neutron_get_ext_gw_interface)
             local ipv6_cidr_len=${IPV6_PUBLIC_RANGE#*/}
 
-            # Configure interface for public bridge
+            # Configure interface for public bridge by setting the interface
+            # to "up" in case the job is running entirely private network based
+            # testing.
+            sudo ip link set $ext_gw_interface up
             sudo ip -6 addr replace $ipv6_ext_gw_ip/$ipv6_cidr_len dev $ext_gw_interface
             # Any IPv6 private subnet that uses the default IPV6 subnet pool
             # and that is plugged into the default router (Q_ROUTER_NAME) will

From bab0c9210371e1cfa321b8528217a7f2e156d7a1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Harald=20Jens=C3=A5s?= <hjensas@redhat.com>
Date: Tue, 26 Apr 2022 15:46:56 +0200
Subject: [PATCH 2035/2409] Use tryint() for stats value

In some cases the value is [not set], in this case
the conversion to integer does not work.

Closes-Bug: #1970431
Change-Id: I74df7d8bc9f5cbe0709a6471cf7639caea0b58e8
---
 tools/get-stats.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/get-stats.py b/tools/get-stats.py
index dc0bd0f9e5..05f088ef8d 100755
--- a/tools/get-stats.py
+++ b/tools/get-stats.py
@@ -31,7 +31,7 @@ def get_service_stats(service):
         if not line:
             continue
         stat, val = line.split('=')
-        stats[stat] = int(val)
+        stats[stat] = tryint(val)
 
     return stats
 

From 1b601c7b1e8a3ec4816cb827ccd8bf909a05debb Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Mon, 25 Apr 2022 07:47:56 -0700
Subject: [PATCH 2036/2409] Tolerate missing deps in get-stats.py

In order to run on systems where not all requirements are present,
we should be tolerant of missing external dependencies, such as
psutil and pymysql. Print a warning (to stderr) and just leave out
those stats in that case.

Also make running the stats collector use ignore_errors:yes to avoid
failures in the future. I think the stats is not critical enough to
fail a job for bugs like this.

Related-Bug: #1970195
Change-Id: I132b0e1f5033c4f109a8b8cc776c0877574c4a49
---
 .../capture-performance-data/tasks/main.yaml  |  1 +
 tools/get-stats.py                            | 24 ++++++++++++++-----
 2 files changed, 19 insertions(+), 6 deletions(-)

diff --git a/roles/capture-performance-data/tasks/main.yaml b/roles/capture-performance-data/tasks/main.yaml
index 2d2cfe4b8b..f9bb0f7851 100644
--- a/roles/capture-performance-data/tasks/main.yaml
+++ b/roles/capture-performance-data/tasks/main.yaml
@@ -13,3 +13,4 @@
       {% for i in debian_suse_apache_deref_logs.results | default([]) + redhat_apache_deref_logs.results | default([]) %}
       --apache-log="{{ i.stat.path }}"
       {% endfor %}
+  ignore_errors: yes
diff --git a/tools/get-stats.py b/tools/get-stats.py
index dc0bd0f9e5..2418c851f9 100755
--- a/tools/get-stats.py
+++ b/tools/get-stats.py
@@ -6,12 +6,24 @@
 import itertools
 import json
 import os
-import psutil
 import re
 import socket
 import subprocess
 import sys
-import pymysql
+
+try:
+    import psutil
+except ImportError:
+    psutil = None
+    print('No psutil, process information will not be included',
+          file=sys.stderr)
+
+try:
+    import pymysql
+except ImportError:
+    pymysql = None
+    print('No pymysql, database information will not be included',
+          file=sys.stderr)
 
 # https://www.elastic.co/blog/found-crash-elasticsearch#mapping-explosion
 
@@ -144,10 +156,10 @@ def get_report_info():
 
     data = {
         'services': get_services_stats(),
-        'db': args.db_pass and get_db_stats(args.db_host,
-                                            args.db_user,
-                                            args.db_pass) or [],
-        'processes': get_processes_stats(args.process),
+        'db': pymysql and args.db_pass and get_db_stats(args.db_host,
+                                                        args.db_user,
+                                                        args.db_pass) or [],
+        'processes': psutil and get_processes_stats(args.process) or [],
         'api': get_http_stats(args.apache_log),
         'report': get_report_info(),
     }

From 42be2425d8782799d3d9f82c6f1789f8b05a4301 Mon Sep 17 00:00:00 2001
From: yatinkarel <ykarel@redhat.com>
Date: Thu, 28 Apr 2022 18:15:50 +0530
Subject: [PATCH 2037/2409] Collect status of all services

Would be helpful in troubleshooting services
which either fails to start or takes time to
start.

Related-Bug: #1970679
Change-Id: Iba2fce5f8b1cd00708f092e6eb5a1fbd96e97da0
---
 .zuul.yaml                                | 1 +
 roles/capture-system-logs/README.rst      | 1 +
 roles/capture-system-logs/tasks/main.yaml | 3 +++
 3 files changed, 5 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index a437c1cc02..2935560951 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -398,6 +398,7 @@
         '{{ stage_dir }}/rpm-qa.txt': logs
         '{{ stage_dir }}/core': logs
         '{{ stage_dir }}/listen53.txt': logs
+        '{{ stage_dir }}/services.txt': logs
         '{{ stage_dir }}/deprecations.log': logs
         '{{ stage_dir }}/audit.log': logs
         /etc/ceph: logs
diff --git a/roles/capture-system-logs/README.rst b/roles/capture-system-logs/README.rst
index c28412457a..1376f63bfc 100644
--- a/roles/capture-system-logs/README.rst
+++ b/roles/capture-system-logs/README.rst
@@ -9,6 +9,7 @@ Stage a number of different logs / reports:
 - coredumps
 - dns resolver
 - listen53
+- services
 - unbound.log
 - deprecation messages
 
diff --git a/roles/capture-system-logs/tasks/main.yaml b/roles/capture-system-logs/tasks/main.yaml
index 905806d529..77b5ec5098 100644
--- a/roles/capture-system-logs/tasks/main.yaml
+++ b/roles/capture-system-logs/tasks/main.yaml
@@ -19,6 +19,9 @@
           rpm -qa | sort > {{ stage_dir }}/rpm-qa.txt
       fi
 
+      # Services status
+      sudo systemctl status --all > services.txt 2>/dev/null
+
       # NOTE(kchamart) The 'audit.log' can be useful in cases when QEMU
       # failed to start due to denials from SELinux — useful for CentOS
       # and Fedora machines.  For Ubuntu (which runs AppArmor), DevStack

From 1baa8905d5a3d677b5298e76621b9e08e0ed0f13 Mon Sep 17 00:00:00 2001
From: yatinkarel <ykarel@redhat.com>
Date: Fri, 6 May 2022 17:53:54 +0530
Subject: [PATCH 2038/2409] Wait for OVN dbs also along with sockets

When OVN is setup from distro packages, the
main service is ovn-central which when restarted,
restarts ovn-northd, ovn nb and db services.

And during the restart ovn dbs(ovnnb_db.db and ovnsb_db.db)
are created, which may sometime takes time as seen with
ubuntu jammy tests[1].

We already checking for socket's file to be available,
let's also check for db files as without it ovn-*ctl
operations succeed but changes are not persisted until
db files are available and changes are lost with the restart.

[1] https://review.opendev.org/c/openstack/devstack/+/839389

Change-Id: I178da7af8cba8bcc8a67174e439df7c0f2c7d4d5
---
 lib/neutron_plugins/ovn_agent | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index 927896b70b..9022f2d382 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -169,6 +169,17 @@ Q_LOG_DRIVER_LOG_BASE=${Q_LOG_DRIVER_LOG_BASE:-acl_log_meter}
 # Utility Functions
 # -----------------
 
+function wait_for_db_file {
+    local count=0
+    while [ ! -f $1 ]; do
+        sleep 1
+        count=$((count+1))
+        if [ "$count" -gt 5 ]; then
+            die $LINENO "DB File $1 not found"
+        fi
+    done
+}
+
 function wait_for_sock_file {
     local count=0
     while [ ! -S $1 ]; do
@@ -695,8 +706,11 @@ function start_ovn {
         fi
 
         # Wait for the service to be ready
+        # Check for socket and db files for both OVN NB and SB
         wait_for_sock_file $OVS_RUNDIR/ovnnb_db.sock
         wait_for_sock_file $OVS_RUNDIR/ovnsb_db.sock
+        wait_for_db_file $OVN_DATADIR/ovnnb_db.db
+        wait_for_db_file $OVN_DATADIR/ovnsb_db.db
 
         if is_service_enabled tls-proxy; then
             sudo ovn-nbctl --db=unix:$OVS_RUNDIR/ovnnb_db.sock set-ssl $INT_CA_DIR/private/$DEVSTACK_CERT_NAME.key $INT_CA_DIR/$DEVSTACK_CERT_NAME.crt $INT_CA_DIR/ca-chain.pem

From 5c765cb8a1866bd3405946d097d7fb06066ae4d4 Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Tue, 26 Apr 2022 13:08:21 +0200
Subject: [PATCH 2039/2409] Add Ubuntu 22.04 LTS (jammy) platform job

The new Ubuntu LTS release has been made last week, start running
devstack on it as a platform job.

Horizon has issues with py310, so gets disabled for now.

Run variants with OVS and OVN(default).

Co-Authored-By: yatinkarel <ykarel@redhat.com>
Signed-off-by: Dr. Jens Harbott <harbott@osism.tech>
Change-Id: I47696273d6b009f754335b44ef3356b4f5115cd8
---
 .zuul.yaml | 76 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 stack.sh   |  2 +-
 2 files changed, 77 insertions(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index a437c1cc02..e87f410202 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -16,6 +16,16 @@
         nodes:
           - controller
 
+- nodeset:
+    name: openstack-single-node-jammy
+    nodes:
+      - name: controller
+        label: ubuntu-jammy
+    groups:
+      - name: tempest
+        nodes:
+          - controller
+
 - nodeset:
     name: openstack-single-node-focal
     nodes:
@@ -718,6 +728,69 @@
         # from source instead.
         OVN_BUILD_FROM_SOURCE: True
 
+- job:
+    name: devstack-platform-ubuntu-jammy
+    parent: tempest-full-py3
+    description: Ubuntu 22.04 LTS (jammy) platform test
+    nodeset: openstack-single-node-jammy
+    timeout: 9000
+    vars:
+      configure_swap_size: 4096
+      devstack_services:
+        # Horizon doesn't like py310
+        horizon: false
+
+- job:
+    name: devstack-platform-ubuntu-jammy-ovn-source
+    parent: devstack-platform-ubuntu-jammy
+    description: Ubuntu 22.04 LTS (jammy) platform test (OVN from source)
+    vars:
+      devstack_localrc:
+        OVN_BUILD_FROM_SOURCE: True
+        OVN_BRANCH: "v21.06.0"
+        OVS_BRANCH: "a4b04276ab5934d087669ff2d191a23931335c87"
+        OVS_SYSCONFDIR: "/usr/local/etc/openvswitch"
+
+- job:
+    name: devstack-platform-ubuntu-jammy-ovs
+    parent: tempest-full-py3
+    description: Ubuntu 22.04 LTS (jammy) platform test (OVS)
+    nodeset: openstack-single-node-jammy
+    timeout: 9000
+    vars:
+      configure_swap_size: 8192
+      devstack_localrc:
+        Q_AGENT: openvswitch
+        Q_ML2_PLUGIN_MECHANISM_DRIVERS: openvswitch
+        Q_ML2_TENANT_NETWORK_TYPE: vxlan
+      devstack_services:
+        # Horizon doesn't like py310
+        horizon: false
+        # Disable OVN services
+        ovn-northd: false
+        ovn-controller: false
+        ovs-vswitchd: false
+        ovsdb-server: false
+        # Disable Neutron ML2/OVN services
+        q-ovn-metadata-agent: false
+        # Enable Neutron ML2/OVS services
+        q-agt: true
+        q-dhcp: true
+        q-l3: true
+        q-meta: true
+        q-metering: true
+    group-vars:
+      subnode:
+        devstack_services:
+          # Disable OVN services
+          ovn-controller: false
+          ovs-vswitchd: false
+          ovsdb-server: false
+          # Disable Neutron ML2/OVN services
+          q-ovn-metadata-agent: false
+          # Enable Neutron ML2/OVS services
+          q-agt: true
+
 - job:
     name: devstack-no-tls-proxy
     parent: tempest-full-py3
@@ -829,6 +902,9 @@
         - devstack-platform-fedora-latest
         - devstack-platform-centos-9-stream
         - devstack-platform-debian-bullseye
+        - devstack-platform-ubuntu-jammy
+        - devstack-platform-ubuntu-jammy-ovn-source
+        - devstack-platform-ubuntu-jammy-ovs
         - devstack-multinode
         - devstack-unit-tests
         - openstack-tox-bashate
diff --git a/stack.sh b/stack.sh
index 6e9ced985e..1970105c1d 100755
--- a/stack.sh
+++ b/stack.sh
@@ -229,7 +229,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-SUPPORTED_DISTROS="bullseye|focal|f35|opensuse-15.2|opensuse-tumbleweed|rhel8|rhel9|openEuler-20.03"
+SUPPORTED_DISTROS="bullseye|focal|jammy|f35|opensuse-15.2|opensuse-tumbleweed|rhel8|rhel9|openEuler-20.03"
 
 if [[ ! ${DISTRO} =~ $SUPPORTED_DISTROS ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"

From fe52d7f0a88de2dc330923cf6cf52c83ccb92bd6 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Thu, 28 Apr 2022 12:34:38 -0700
Subject: [PATCH 2040/2409] Change DB counting mechanism

The mysql performance_schema method for counting per-database queries
is very heavyweight in that it requires full logging (in a table) of
every query. We do hundreds of thousands in the course of a tempest
run, which ends up creating its own performance problem.

This changes the approach we take, which is to bundle a very tiny
sqlalchemy plugin module which counts just what we care about in
a special database.

It is more complex than just enabling the features in mysql, but it
is a massively smaller runtime overhead. It also provides us the
opportunity to easily zero the counters just before a tempest run.

Change-Id: I361bc30bb970cdaf18b966951f217862d302f0b9
---
 lib/databases/mysql            |  28 ++++++--
 stack.sh                       |  13 ++++
 tools/dbcounter/dbcounter.py   | 120 +++++++++++++++++++++++++++++++++
 tools/dbcounter/pyproject.toml |   3 +
 tools/dbcounter/setup.cfg      |  14 ++++
 tools/get-stats.py             |   6 +-
 6 files changed, 173 insertions(+), 11 deletions(-)
 create mode 100644 tools/dbcounter/dbcounter.py
 create mode 100644 tools/dbcounter/pyproject.toml
 create mode 100644 tools/dbcounter/setup.cfg

diff --git a/lib/databases/mysql b/lib/databases/mysql
index 6b3ea0287c..b292da25bd 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -151,12 +151,16 @@ function configure_database_mysql {
     fi
 
     if [[ "$MYSQL_GATHER_PERFORMANCE" == "True" ]]; then
-        echo "enabling MySQL performance_schema items"
-        # Enable long query history
-        iniset -sudo $my_conf mysqld \
-               performance-schema-consumer-events-statements-history-long TRUE
-        iniset -sudo $my_conf mysqld \
-               performance_schema_events_stages_history_long_size 1000000
+        echo "enabling MySQL performance counting"
+
+        # Install our sqlalchemy plugin
+        pip_install ${TOP_DIR}/tools/dbcounter
+
+        # Create our stats database for accounting
+        recreate_database stats
+        mysql -u $DATABASE_USER -p$DATABASE_PASSWORD -h $MYSQL_HOST -e \
+              "CREATE TABLE queries (db VARCHAR(32), op VARCHAR(32),
+                count INT, PRIMARY KEY (db, op)) ENGINE MEMORY" stats
     fi
 
     restart_service $MYSQL_SERVICE_NAME
@@ -218,7 +222,17 @@ function install_database_python_mysql {
 
 function database_connection_url_mysql {
     local db=$1
-    echo "$BASE_SQL_CONN/$db?charset=utf8"
+    local plugin
+
+    # NOTE(danms): We don't enable perf on subnodes yet because the
+    # plugin is not installed there
+    if [[ "$MYSQL_GATHER_PERFORMANCE" == "True" ]]; then
+        if is_service_enabled mysql; then
+            plugin="&plugin=dbcounter"
+        fi
+    fi
+
+    echo "$BASE_SQL_CONN/$db?charset=utf8$plugin"
 }
 
 
diff --git a/stack.sh b/stack.sh
index 6e9ced985e..16dce81d3d 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1512,6 +1512,19 @@ async_cleanup
 time_totals
 async_print_timing
 
+if is_service_enabled mysql; then
+    if [[ "$MYSQL_GATHER_PERFORMANCE" == "True" && "$MYSQL_HOST" ]]; then
+        echo ""
+        echo ""
+        echo "Post-stack database query stats:"
+        mysql -u $DATABASE_USER -p$DATABASE_PASSWORD -h $MYSQL_HOST stats -e \
+              'SELECT * FROM queries' -t 2>/dev/null
+        mysql -u $DATABASE_USER -p$DATABASE_PASSWORD -h $MYSQL_HOST stats -e \
+              'DELETE FROM queries' 2>/dev/null
+    fi
+fi
+
+
 # Using the cloud
 # ===============
 
diff --git a/tools/dbcounter/dbcounter.py b/tools/dbcounter/dbcounter.py
new file mode 100644
index 0000000000..5057f0f393
--- /dev/null
+++ b/tools/dbcounter/dbcounter.py
@@ -0,0 +1,120 @@
+import json
+import logging
+import os
+import threading
+import time
+import queue
+
+import sqlalchemy
+from sqlalchemy.engine import CreateEnginePlugin
+from sqlalchemy import event
+
+# https://docs.sqlalchemy.org/en/14/core/connections.html?
+# highlight=createengineplugin#sqlalchemy.engine.CreateEnginePlugin
+
+LOG = logging.getLogger(__name__)
+
+# The theory of operation here is that we register this plugin with
+# sqlalchemy via an entry_point. It gets loaded by virtue of plugin=
+# being in the database connection URL, which gives us an opportunity
+# to hook the engines that get created.
+#
+# We opportunistically spawn a thread, which we feed "hits" to over a
+# queue, and which occasionally writes those hits to a special
+# database called 'stats'. We access that database with the same user,
+# pass, and host as the main connection URL for simplicity.
+
+
+class LogCursorEventsPlugin(CreateEnginePlugin):
+    def __init__(self, url, kwargs):
+        self.db_name = url.database
+        LOG.info('Registered counter for database %s' % self.db_name)
+        new_url = sqlalchemy.engine.URL.create(url.drivername,
+                                               url.username,
+                                               url.password,
+                                               url.host,
+                                               url.port,
+                                               'stats')
+
+        self.engine = sqlalchemy.create_engine(new_url)
+        self.queue = queue.Queue()
+        self.thread = None
+
+    def engine_created(self, engine):
+        """Hook the engine creation process.
+
+        This is the plug point for the sqlalchemy plugin. Using
+        plugin=$this in the URL causes this method to be called when
+        the engine is created, giving us a chance to hook it below.
+        """
+        event.listen(engine, "before_cursor_execute", self._log_event)
+
+    def ensure_writer_thread(self):
+        self.thread = threading.Thread(target=self.stat_writer, daemon=True)
+        self.thread.start()
+
+    def _log_event(self, conn, cursor, statement, parameters, context,
+                   executemany):
+        """Queue a "hit" for this operation to be recorded.
+
+        Attepts to determine the operation by the first word of the
+        statement, or 'OTHER' if it cannot be determined.
+        """
+
+        # Start our thread if not running. If we were forked after the
+        # engine was created and this plugin was associated, our
+        # writer thread is gone, so respawn.
+        if not self.thread or not self.thread.is_alive():
+            self.ensure_writer_thread()
+
+        try:
+            op = statement.strip().split(' ', 1)[0] or 'OTHER'
+        except Exception:
+            op = 'OTHER'
+
+        self.queue.put((self.db_name, op))
+
+    def do_incr(self, db, op, count):
+        """Increment the counter for (db,op) by count."""
+
+        query = ('INSERT INTO queries (db, op, count) '
+                 '  VALUES (%s, %s, %s) '
+                 '  ON DUPLICATE KEY UPDATE count=count+%s')
+        try:
+            with self.engine.begin() as conn:
+                r = conn.execute(query, (db, op, count, count))
+        except Exception as e:
+            LOG.error('Failed to account for access to database %r: %s',
+                      db, e)
+
+    def stat_writer(self):
+        """Consume messages from the queue and write them in batches.
+
+        This reads "hists" from from a queue fed by _log_event() and
+        writes (db,op)+=count stats to the database after ten seconds
+        of no activity to avoid triggering a write for every SELECT
+        call. Write no less often than every thirty seconds and/or 100
+        pending hits to avoid being starved by constant activity.
+        """
+        LOG.debug('[%i] Writer thread running' % os.getpid())
+        while True:
+            to_write = {}
+            total = 0
+            last = time.time()
+            while time.time() - last < 30 and total < 100:
+                try:
+                    item = self.queue.get(timeout=10)
+                    to_write.setdefault(item, 0)
+                    to_write[item] += 1
+                    total += 1
+                except queue.Empty:
+                    break
+
+            if to_write:
+                LOG.debug('[%i] Writing DB stats %s' % (
+                    os.getpid(),
+                    ','.join(['%s:%s=%i' % (db, op, count)
+                              for (db, op), count in to_write.items()])))
+
+            for (db, op), count in to_write.items():
+                self.do_incr(db, op, count)
diff --git a/tools/dbcounter/pyproject.toml b/tools/dbcounter/pyproject.toml
new file mode 100644
index 0000000000..d74d688997
--- /dev/null
+++ b/tools/dbcounter/pyproject.toml
@@ -0,0 +1,3 @@
+[build-system]
+requires = ["sqlalchemy", "setuptools>=42"]
+build-backend = "setuptools.build_meta"
\ No newline at end of file
diff --git a/tools/dbcounter/setup.cfg b/tools/dbcounter/setup.cfg
new file mode 100644
index 0000000000..f9f26f2175
--- /dev/null
+++ b/tools/dbcounter/setup.cfg
@@ -0,0 +1,14 @@
+[metadata]
+name = dbcounter
+author = Dan Smith
+author_email = dms@danplanet.com
+version = 0.1
+description = A teeny tiny dbcounter plugin for use with devstack
+url = http://github.com/openstack/devstack
+license = Apache
+
+[options]
+modules = dbcounter
+entry_points =
+    [sqlalchemy.plugins]
+    dbcounter = dbcounter:LogCursorEventsPlugin
diff --git a/tools/get-stats.py b/tools/get-stats.py
index 670e723e82..465afcab5a 100755
--- a/tools/get-stats.py
+++ b/tools/get-stats.py
@@ -83,13 +83,11 @@ def proc_matches(proc):
 def get_db_stats(host, user, passwd):
     dbs = []
     db = pymysql.connect(host=host, user=user, password=passwd,
-                         database='performance_schema',
+                         database='stats',
                          cursorclass=pymysql.cursors.DictCursor)
     with db:
         with db.cursor() as cur:
-            cur.execute(
-                'SELECT COUNT(*) AS queries,current_schema AS db FROM '
-                'events_statements_history_long GROUP BY current_schema')
+            cur.execute('SELECT db,op,count FROM queries')
             for row in cur:
                 dbs.append({k: tryint(v) for k, v in row.items()})
     return dbs

From 64d68679d9660e304ab3550929fe9892a124ac6f Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Fri, 22 Apr 2022 07:58:29 -0700
Subject: [PATCH 2041/2409] Improve API log parsing

Two runs of the same job on the same patch can yield quite different
numbers for API calls if we just count the raw calls. Many of these
are tempest polling for resources, which on a slow worker can require
many more calls than a fast one.

Tempest seems to not change its User-Agent string, but the client
libraries do. So, if we ignore the regular "python-urllib" agent
calls, we get a much more stable count of service-to-service API
calls in the performance report.

Note that we were also logging in a different (less-rich) format for
the tls-proxy.log file, which hampers our ability to parse that
data in the same format. This switches it to "combined" which is used
by the access.log and contains more useful information, like the
user-agent, among other things.

Change-Id: I8889c2e53f85c41150e1245dcbe2a79bac702aad
---
 lib/tls            |  2 +-
 tools/get-stats.py | 77 ++++++++++++++++++++++++++++++++++------------
 2 files changed, 58 insertions(+), 21 deletions(-)

diff --git a/lib/tls b/lib/tls
index 5a7f5ae324..b8758cd6d3 100644
--- a/lib/tls
+++ b/lib/tls
@@ -557,7 +557,7 @@ $listen_string
     ErrorLog $APACHE_LOG_DIR/tls-proxy_error.log
     ErrorLogFormat "%{cu}t [%-m:%l] [pid %P:tid %T] %7F: %E: [client\ %a] [frontend\ %A] %M% ,\ referer\ %{Referer}i"
     LogLevel info
-    CustomLog $APACHE_LOG_DIR/tls-proxy_access.log "%{%Y-%m-%d}t %{%T}t.%{msec_frac}t [%l] %a \"%r\" %>s %b"
+    CustomLog $APACHE_LOG_DIR/tls-proxy_access.log combined
 </VirtualHost>
 EOF
     if is_suse ; then
diff --git a/tools/get-stats.py b/tools/get-stats.py
index 465afcab5a..ffe467691c 100755
--- a/tools/get-stats.py
+++ b/tools/get-stats.py
@@ -1,10 +1,12 @@
 #!/usr/bin/python3
 
 import argparse
+import csv
 import datetime
 import glob
 import itertools
 import json
+import logging
 import os
 import re
 import socket
@@ -25,6 +27,8 @@
     print('No pymysql, database information will not be included',
           file=sys.stderr)
 
+LOG = logging.getLogger('perf')
+
 # https://www.elastic.co/blog/found-crash-elasticsearch#mapping-explosion
 
 
@@ -95,26 +99,56 @@ def get_db_stats(host, user, passwd):
 
 def get_http_stats_for_log(logfile):
     stats = {}
-    for line in open(logfile).readlines():
-        m = re.search('"([A-Z]+) /([^" ]+)( HTTP/1.1)?" ([0-9]{3}) ([0-9]+)',
-                      line)
-        if m:
-            method = m.group(1)
-            path = m.group(2)
-            status = m.group(4)
-            size = int(m.group(5))
-
-            try:
-                service, rest = path.split('/', 1)
-            except ValueError:
-                # Root calls like "GET /identity"
-                service = path
-                rest = ''
-
-            stats.setdefault(service, {'largest': 0})
-            stats[service].setdefault(method, 0)
-            stats[service][method] += 1
-            stats[service]['largest'] = max(stats[service]['largest'], size)
+    apache_fields = ('host', 'a', 'b', 'date', 'tz', 'request', 'status',
+                     'length', 'c', 'agent')
+    ignore_agents = ('curl', 'uwsgi', 'nova-status')
+    for line in csv.reader(open(logfile), delimiter=' '):
+        fields = dict(zip(apache_fields, line))
+        if len(fields) != len(apache_fields):
+            # Not a combined access log, so we can bail completely
+            return []
+        try:
+            method, url, http = fields['request'].split(' ')
+        except ValueError:
+            method = url = http = ''
+        if 'HTTP' not in http:
+            # Not a combined access log, so we can bail completely
+            return []
+
+        # Tempest's User-Agent is unchanged, but client libraries and
+        # inter-service API calls use proper strings. So assume
+        # 'python-urllib' is tempest so we can tell it apart.
+        if 'python-urllib' in fields['agent'].lower():
+            agent = 'tempest'
+        else:
+            agent = fields['agent'].split(' ')[0]
+            if agent.startswith('python-'):
+                agent = agent.replace('python-', '')
+            if '/' in agent:
+                agent = agent.split('/')[0]
+
+        if agent in ignore_agents:
+            continue
+
+        try:
+            service, rest = url.strip('/').split('/', 1)
+        except ValueError:
+            # Root calls like "GET /identity"
+            service = url.strip('/')
+            rest = ''
+
+        method_key = '%s-%s' % (agent, method)
+        try:
+            length = int(fields['length'])
+        except ValueError:
+            LOG.warning('[%s] Failed to parse length %r from line %r' % (
+                logfile, fields['length'], line))
+            length = 0
+        stats.setdefault(service, {'largest': 0})
+        stats[service].setdefault(method_key, 0)
+        stats[service][method_key] += 1
+        stats[service]['largest'] = max(stats[service]['largest'],
+                                        length)
 
     # Flatten this for ES
     return [{'service': service, 'log': os.path.basename(logfile),
@@ -131,6 +165,7 @@ def get_report_info():
     return {
         'timestamp': datetime.datetime.now().isoformat(),
         'hostname': socket.gethostname(),
+        'version': 2,
     }
 
 
@@ -152,6 +187,8 @@ def get_report_info():
                               '(default is %s)' % ','.join(process_defaults)))
     args = parser.parse_args()
 
+    logging.basicConfig(level=logging.WARNING)
+
     data = {
         'services': get_services_stats(),
         'db': pymysql and args.db_pass and get_db_stats(args.db_host,

From 92a34dbe951f2ab31fb3432e61cf34db034b0145 Mon Sep 17 00:00:00 2001
From: yatinkarel <ykarel@redhat.com>
Date: Tue, 17 May 2022 20:10:48 +0530
Subject: [PATCH 2042/2409] Configure placement section in neutron conf

Without it segment plugin fails to connect with
placement api. Configure the placement section
if service is deployed.

Closes-Bug: #1973783
Change-Id: Ie7f37770a04f622735cf2263c601257669ab5064
---
 lib/neutron-legacy | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 253b457ae1..88ac991167 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -931,6 +931,9 @@ function _configure_neutron_service {
 
     configure_keystone_authtoken_middleware $NEUTRON_CONF nova nova
 
+    # Configuration for placement client
+    configure_keystone_authtoken_middleware $NEUTRON_CONF placement placement
+
     # Configure plugin
     neutron_plugin_configure_service
 }

From 111a38b4d6e6f61c21570e0adba58f6c59c52900 Mon Sep 17 00:00:00 2001
From: Brian Rosmaita <rosmaita.fossdev@gmail.com>
Date: Fri, 13 May 2022 20:53:26 -0400
Subject: [PATCH 2043/2409] lib/tempest: add wait for Glance image import

Glance image import is asynchronous and may be configured to do image
conversion.  If image import is being used, it's possible that the
tempest configuration code is executed before the import has
completed and there may be no active images yet.  In that case,
we will poll glance every TEMPEST_GLANCE_IMPORT_POLL_INTERVAL seconds
(default: 1) to see if there are TEMPEST_GLANCE_IMAGE_COUNT active
images (default: 1) up to TEMPEST_GLANCE_IMPORT_POLL_LIMIT times
(default: 12).

You can see an example of the issue this patch addresses in real
life:
https://review.opendev.org/c/openstack/glance/+/841278/1#message-456096e48b28e5b866deb8bf53e9258ee08219a0

Change-Id: Ie99f12691d9062611a8930accfa14d9540970cc5
---
 lib/tempest | 73 ++++++++++++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 67 insertions(+), 6 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 1fd4184763..206b37b5bf 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -71,6 +71,17 @@ TEMPEST_VOLUME_VENDOR=${TEMPEST_VOLUME_VENDOR:-$TEMPEST_DEFAULT_VOLUME_VENDOR}
 TEMPEST_DEFAULT_STORAGE_PROTOCOL="iSCSI"
 TEMPEST_STORAGE_PROTOCOL=${TEMPEST_STORAGE_PROTOCOL:-$TEMPEST_DEFAULT_STORAGE_PROTOCOL}
 
+# Glance/Image variables
+# When Glance image import is enabled, image creation is asynchronous and images
+# may not yet be active when tempest looks for them.  In that case, we poll
+# Glance every TEMPEST_GLANCE_IMPORT_POLL_INTERVAL seconds for the number of
+# times specified by TEMPEST_GLANCE_IMPORT_POLL_LIMIT.  If you are importing
+# multiple images, set TEMPEST_GLANCE_IMAGE_COUNT so the poller does not quit
+# too early (though it will not exceed the polling limit).
+TEMPEST_GLANCE_IMPORT_POLL_INTERVAL=${TEMPEST_GLANCE_IMPORT_POLL_INTERVAL:-1}
+TEMPEST_GLANCE_IMPORT_POLL_LIMIT=${TEMPEST_GLANCE_IMPORT_POLL_LIMIT:-12}
+TEMPEST_GLANCE_IMAGE_COUNT=${TEMPEST_GLANCE_IMAGE_COUNT:-1}
+
 # Neutron/Network variables
 IPV6_ENABLED=$(trueorfalse True IPV6_ENABLED)
 IPV6_SUBNET_ATTRIBUTES_ENABLED=$(trueorfalse True IPV6_SUBNET_ATTRIBUTES_ENABLED)
@@ -127,6 +138,48 @@ function set_tempest_venv_constraints {
     fi
 }
 
+# Makes a call to glance to get a list of active images, ignoring
+# ramdisk and kernel images.  Takes 3 arguments, an array and two
+# variables.  The array will contain the list of active image UUIDs;
+# if an image with ``DEFAULT_IMAGE_NAME`` is found, its UUID will be
+# set as the value of *both* other parameters.
+function get_active_images {
+    declare -n img_array=$1
+    declare -n img_id=$2
+    declare -n img_id_alt=$3
+
+    # start with a fresh array in case we are called multiple times
+    img_array=()
+
+    while read -r IMAGE_NAME IMAGE_UUID; do
+        if [ "$IMAGE_NAME" = "$DEFAULT_IMAGE_NAME" ]; then
+            img_id="$IMAGE_UUID"
+            img_id_alt="$IMAGE_UUID"
+        fi
+        img_array+=($IMAGE_UUID)
+    done < <(openstack --os-cloud devstack-admin image list --property status=active | awk -F'|' '!/^(+--)|ID|aki|ari/ { print $3,$2 }')
+}
+
+function poll_glance_images {
+    declare -n image_array=$1
+    declare -n image_id=$2
+    declare -n image_id_alt=$3
+    local -i poll_count
+
+    poll_count=$TEMPEST_GLANCE_IMPORT_POLL_LIMIT
+    while (( poll_count-- > 0 )) ; do
+        sleep $TEMPEST_GLANCE_IMPORT_POLL_INTERVAL
+        get_active_images image_array image_id image_id_alt
+        if (( ${#image_array[*]} >= $TEMPEST_GLANCE_IMAGE_COUNT )) ; then
+            return
+        fi
+    done
+    local msg
+    msg="Polling limit of $TEMPEST_GLANCE_IMPORT_POLL_LIMIT exceeded; "
+    msg+="poll interval was $TEMPEST_GLANCE_IMPORT_POLL_INTERVAL sec"
+    warn $LINENO "$msg"
+}
+
 # configure_tempest() - Set config files, create data dirs, etc
 function configure_tempest {
     if [[ "$INSTALL_TEMPEST" == "True" ]]; then
@@ -168,13 +221,21 @@ function configure_tempest {
     declare -a images
 
     if is_service_enabled glance; then
-        while read -r IMAGE_NAME IMAGE_UUID; do
-            if [ "$IMAGE_NAME" = "$DEFAULT_IMAGE_NAME" ]; then
-                image_uuid="$IMAGE_UUID"
-                image_uuid_alt="$IMAGE_UUID"
+        get_active_images images image_uuid image_uuid_alt
+
+        if (( ${#images[*]} < $TEMPEST_GLANCE_IMAGE_COUNT )); then
+            # Glance image import is asynchronous and may be configured
+            # to do image conversion.  If image import is being used,
+            # it's possible that this code is being executed before the
+            # import has completed and there may be no active images yet.
+            if [[ "$GLANCE_USE_IMPORT_WORKFLOW" == "True" ]]; then
+                poll_glance_images images image_uuid image_uuid_alt
+                if (( ${#images[*]} < $TEMPEST_GLANCE_IMAGE_COUNT )); then
+                    echo "Only found ${#images[*]} image(s), was looking for $TEMPEST_GLANCE_IMAGE_COUNT"
+                    exit 1
+                fi
             fi
-            images+=($IMAGE_UUID)
-        done < <(openstack --os-cloud devstack-admin image list --property status=active | awk -F'|' '!/^(+--)|ID|aki|ari/ { print $3,$2 }')
+        fi
 
         case "${#images[*]}" in
             0)

From 083eeee5af61a19a932138b5035a916c7421beee Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Thu, 19 May 2022 13:55:35 +0200
Subject: [PATCH 2044/2409] Make jammy platform jobs non-voting

We missed to add the jobs to the gate queue and so they have already
regressed before they were actually in place. Make them non-voting for
now until the issues are fixed.

Signed-off-by: Dr. Jens Harbott <harbott@osism.tech>
Change-Id: I5d1f83dfe23747096163076dcf80750585c0260e
---
 .zuul.yaml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index b449ea67be..0e114afb3e 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -731,6 +731,7 @@
     parent: tempest-full-py3
     description: Ubuntu 22.04 LTS (jammy) platform test
     nodeset: openstack-single-node-jammy
+    voting: false
     timeout: 9000
     vars:
       configure_swap_size: 4096
@@ -742,6 +743,7 @@
     name: devstack-platform-ubuntu-jammy-ovn-source
     parent: devstack-platform-ubuntu-jammy
     description: Ubuntu 22.04 LTS (jammy) platform test (OVN from source)
+    voting: false
     vars:
       devstack_localrc:
         OVN_BUILD_FROM_SOURCE: True
@@ -754,6 +756,7 @@
     parent: tempest-full-py3
     description: Ubuntu 22.04 LTS (jammy) platform test (OVS)
     nodeset: openstack-single-node-jammy
+    voting: false
     timeout: 9000
     vars:
       configure_swap_size: 8192

From 560ee16a85b22b4456177d289cf53c31c6a1ca6b Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Thu, 19 May 2022 13:58:11 +0200
Subject: [PATCH 2045/2409] Drop openEuler support

The job is broken since it is running with python3.7 and most services
now require at least python3.8.

Signed-off-by: Dr. Jens Harbott <harbott@osism.tech>
Change-Id: Ie21f71acffabd78c79e2b141951ccf30a5c06445
---
 .zuul.yaml                             | 25 -------------------------
 doc/source/index.rst                   |  2 +-
 files/rpms/ceph                        |  2 +-
 files/rpms/general                     |  4 +---
 files/rpms/nova                        |  2 +-
 files/rpms/swift                       |  2 +-
 functions-common                       | 13 +------------
 lib/apache                             |  2 +-
 lib/nova                               |  6 +-----
 roles/apache-logs-conf/tasks/main.yaml |  1 -
 stack.sh                               |  9 +--------
 tools/fixup_stuff.sh                   | 24 ------------------------
 12 files changed, 9 insertions(+), 83 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index b449ea67be..3beae1f822 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -106,16 +106,6 @@
         nodes:
           - controller
 
-- nodeset:
-    name: devstack-single-node-openeuler-20.03-sp2
-    nodes:
-      - name: controller
-        label: openEuler-20-03-LTS-SP2
-    groups:
-      - name: tempest
-        nodes:
-          - controller
-
 - nodeset:
     name: openstack-two-node
     nodes:
@@ -712,20 +702,6 @@
           # Enable Neutron ML2/OVS services
           q-agt: true
 
-- job:
-    name: devstack-platform-openEuler-20.03-SP2
-    parent: tempest-full-py3
-    description: openEuler 20.03 SP2 platform test
-    nodeset: devstack-single-node-openeuler-20.03-sp2
-    voting: false
-    timeout: 9000
-    vars:
-      configure_swap_size: 4096
-      devstack_localrc:
-        # NOTE(wxy):  OVN package is not supported by openEuler yet. Build it
-        # from source instead.
-        OVN_BUILD_FROM_SOURCE: True
-
 - job:
     name: devstack-platform-ubuntu-jammy
     parent: tempest-full-py3
@@ -1001,7 +977,6 @@
 
     experimental:
       jobs:
-        - devstack-platform-openEuler-20.03-SP2
         - nova-multi-cell
         - nova-next
         - neutron-fullstack-with-uwsgi
diff --git a/doc/source/index.rst b/doc/source/index.rst
index feb50ce4e9..08ce4cb061 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -38,7 +38,7 @@ Install Linux
 
 Start with a clean and minimal install of a Linux system. DevStack
 attempts to support the two latest LTS releases of Ubuntu, the
-latest/current Fedora version, CentOS/RHEL 8, OpenSUSE and openEuler.
+latest/current Fedora version, CentOS/RHEL 8 and OpenSUSE.
 
 If you do not have a preference, Ubuntu 20.04 (Focal Fossa) is the
 most tested, and will probably go the smoothest.
diff --git a/files/rpms/ceph b/files/rpms/ceph
index 93b5746aa6..33a55f80ea 100644
--- a/files/rpms/ceph
+++ b/files/rpms/ceph
@@ -1,3 +1,3 @@
 ceph    # NOPRIME
-redhat-lsb-core # not:rhel9,openEuler-20.03
+redhat-lsb-core # not:rhel9
 xfsprogs
diff --git a/files/rpms/general b/files/rpms/general
index 668705b1c3..7697513149 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -16,7 +16,6 @@ libjpeg-turbo-devel # Pillow 3.0.0
 libxml2-devel # lxml
 libxslt-devel # lxml
 libyaml-devel
-make # dist:openEuler-20.03
 mod_ssl # required for tls-proxy on centos 9 stream computes
 net-tools
 openssh-server
@@ -29,8 +28,7 @@ psmisc
 python3-devel
 python3-pip
 python3-systemd
-redhat-rpm-config # not:openEuler-20.03    missing dep for gcc hardening flags, see rhbz#1217376
-systemd-devel # dist:openEuler-20.03
+redhat-rpm-config # missing dep for gcc hardening flags, see rhbz#1217376
 tar
 tcpdump
 unzip
diff --git a/files/rpms/nova b/files/rpms/nova
index 9e8621c628..9522e5729d 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -6,7 +6,7 @@ ebtables
 genisoimage # not:rhel9 required for config_drive
 iptables
 iputils
-kernel-modules # not:openEuler-20.03
+kernel-modules
 kpartx
 parted
 polkit
diff --git a/files/rpms/swift b/files/rpms/swift
index a838d7839e..7d906aa926 100644
--- a/files/rpms/swift
+++ b/files/rpms/swift
@@ -1,5 +1,5 @@
 curl
-liberasurecode-devel # not:openEuler-20.03
+liberasurecode-devel
 memcached
 rsync-daemon
 sqlite
diff --git a/functions-common b/functions-common
index b660245337..be966e96a6 100644
--- a/functions-common
+++ b/functions-common
@@ -399,7 +399,7 @@ function _ensure_lsb_release {
     elif [[ -x $(command -v zypper 2>/dev/null) ]]; then
         sudo zypper -n install lsb-release
     elif [[ -x $(command -v dnf 2>/dev/null) ]]; then
-        sudo dnf install -y redhat-lsb-core || sudo dnf install -y openeuler-lsb
+        sudo dnf install -y redhat-lsb-core
     else
         die $LINENO "Unable to find or auto-install lsb_release"
     fi
@@ -471,10 +471,6 @@ function GetDistro {
         # Drop the . release as we assume it's compatible
         # XXX re-evaluate when we get RHEL10
         DISTRO="rhel${os_RELEASE::1}"
-    elif [[ "$os_VENDOR" =~ (openEuler) ]]; then
-        # The DISTRO here is `openEuler-20.03`. While, actually only openEuler
-        # 20.03 LTS SP2 is fully tested. Other SP version maybe have bugs.
-        DISTRO="openEuler-$os_RELEASE"
     else
         # We can't make a good choice here.  Setting a sensible DISTRO
         # is part of the problem, but not the major issue -- we really
@@ -526,7 +522,6 @@ function is_fedora {
     fi
 
     [ "$os_VENDOR" = "Fedora" ] || [ "$os_VENDOR" = "Red Hat" ] || \
-        [ "$os_VENDOR" = "openEuler" ] || \
         [ "$os_VENDOR" = "RedHatEnterpriseServer" ] || \
         [ "$os_VENDOR" = "RedHatEnterprise" ] || \
         [ "$os_VENDOR" = "CentOS" ] || [ "$os_VENDOR" = "CentOSStream" ] || \
@@ -576,12 +571,6 @@ function is_ubuntu {
     [ "$os_PACKAGE" = "deb" ]
 }
 
-function is_openeuler {
-    if [[ -z "$os_PACKAGE" ]]; then
-        GetOSVersion
-    fi
-    [ "$os_VENDOR" = "openEuler" ]
-}
 # Git Functions
 # =============
 
diff --git a/lib/apache b/lib/apache
index 02827d1f1b..94f3cfc95a 100644
--- a/lib/apache
+++ b/lib/apache
@@ -95,7 +95,7 @@ function install_apache_uwsgi {
     # didn't fix Python 3.10 compatibility before release.  Should be
     # fixed in uwsgi 4.9.0; can remove this when packages available
     # or we drop this release
-    elif is_fedora && ! is_openeuler && ! [[ $DISTRO =~ f35 ]]; then
+    elif is_fedora && ! [[ $DISTRO =~ f35 ]]; then
         # Note httpd comes with mod_proxy_uwsgi and it is loaded by
         # default; the mod_proxy_uwsgi package actually conflicts now.
         # See:
diff --git a/lib/nova b/lib/nova
index 4c14374d0f..da3a10edd0 100644
--- a/lib/nova
+++ b/lib/nova
@@ -324,11 +324,7 @@ EOF
 
         # set chap algorithms.  The default chap_algorithm is md5 which will
         # not work under FIPS.
-        # FIXME(alee) For some reason, this breaks openeuler.  Openeuler devs should weigh in
-        # and determine the correct solution for openeuler here
-        if ! is_openeuler; then
-            iniset -sudo /etc/iscsi/iscsid.conf DEFAULT "node.session.auth.chap_algs" "SHA3-256,SHA256"
-        fi
+        iniset -sudo /etc/iscsi/iscsid.conf DEFAULT "node.session.auth.chap_algs" "SHA3-256,SHA256"
 
         # ensure that iscsid is started, even when disabled by default
         restart_service iscsid
diff --git a/roles/apache-logs-conf/tasks/main.yaml b/roles/apache-logs-conf/tasks/main.yaml
index 6b7ea37857..bd64574c9b 100644
--- a/roles/apache-logs-conf/tasks/main.yaml
+++ b/roles/apache-logs-conf/tasks/main.yaml
@@ -64,7 +64,6 @@
       'Debian': '/etc/apache2/sites-enabled/'
       'Suse': '/etc/apache2/conf.d/'
       'RedHat': '/etc/httpd/conf.d/'
-      'openEuler': '/etc/httpd/conf.d/'
 
 - name: Discover configurations
   find:
diff --git a/stack.sh b/stack.sh
index e53280e00c..df283bbe50 100755
--- a/stack.sh
+++ b/stack.sh
@@ -229,7 +229,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-SUPPORTED_DISTROS="bullseye|focal|jammy|f35|opensuse-15.2|opensuse-tumbleweed|rhel8|rhel9|openEuler-20.03"
+SUPPORTED_DISTROS="bullseye|focal|jammy|f35|opensuse-15.2|opensuse-tumbleweed|rhel8|rhel9"
 
 if [[ ! ${DISTRO} =~ $SUPPORTED_DISTROS ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
@@ -280,13 +280,6 @@ chmod 0440 $TEMPFILE
 sudo chown root:root $TEMPFILE
 sudo mv $TEMPFILE /etc/sudoers.d/50_stack_sh
 
-# TODO(wxy): Currently some base packages are not installed by default in
-# openEuler. Remove the code below once the packaged are installed by default
-# in the future.
-if [[ $DISTRO == "openEuler-20.03" ]]; then
-    install_package hostname
-fi
-
 # Configure Distro Repositories
 # -----------------------------
 
diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index f24ac40ad5..daa1bc6301 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -153,32 +153,8 @@ function fixup_ubuntu {
     sudo rm -rf /usr/lib/python3/dist-packages/simplejson-*.egg-info
 }
 
-function fixup_openeuler {
-    if ! is_openeuler; then
-        return
-    fi
-
-    if is_arch "x86_64"; then
-        arch="x86_64"
-    elif is_arch "aarch64"; then
-        arch="aarch64"
-    fi
-
-    # Some packages' version in openEuler are too old, use the newer ones we
-    # provide in oepkg. (oepkg is an openEuler third part yum repo which is
-    # endorsed by openEuler community)
-    (echo '[openstack-ci]'
-    echo 'name=openstack'
-    echo 'baseurl=https://repo.oepkgs.net/openEuler/rpm/openEuler-20.03-LTS-SP2/budding-openeuler/openstack-master-ci/'$arch'/'
-    echo 'enabled=1'
-    echo 'gpgcheck=0') | sudo tee -a /etc/yum.repos.d/openstack-master.repo > /dev/null
-
-    yum_install liberasurecode-devel
-}
-
 function fixup_all {
     fixup_ubuntu
     fixup_fedora
     fixup_suse
-    fixup_openeuler
 }

From 50e3c06ec245e8a5e7ca24015b0c152e3bc40a5c Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Thu, 19 May 2022 13:36:43 -0700
Subject: [PATCH 2046/2409] Fix dbcounter installation on Jammy

There are two problems with dbcounter installation on Jammy. The first
is straightforward. We have to use `py_modules` instead of `modules` to
specify the source file. I don't know how this works on other distros
but the docs [0] seem to clearly indicate py_modules does this.

The second issue is quite an issue and requires story time. When
pip/setuptools insteall editable installs (as is done for many of the
openstack projects) it creates an easy-install.pth file that tells the
python interpreter to add the source dirs of those repos to the python
path. Normally these paths are appended to your sys.path. Pip's isolated
build env relies on the assumption that these paths are appeneded to the
path when it santizes sys.path to create the isolated environemnt.

However, when SETUPTOOLS_SYS_PATH_TECHNIQUE is set to rewrite the paths
are not appended and are inserted in the middle. This breaks pip's
isolated build env which broke dbcounter installations. We fix this by
not setting SETUPTOOLS_SYS_PATH_TECHNIQUE to rewrite. Upstream indicates
the reason we set this half a decade ago has since been fixed properly.

The reason Jammy and nothing else breaks is that python3.10 is the first
python version to use pip's isolated build envs by default.

I've locally fiddled with a patch to pip [1] to try and fix this
behavior even when rewrite is set. I don't plan to push this upstream
but it helps to illustrate where the problem lies. If someone else would
like to upstream this feel free.

Finally this change makes the jammy platform job voting again and adds
it to the gate to ensure we don't regress again.

[0] https://docs.python.org/3/distutils/sourcedist.html#specifying-the-files-to-distribute
[1] https://paste.opendev.org/show/bqVAuhgMtVtfYupZK5J6/

Change-Id: I237f5663b0f8b060f6df130de04e17e2b1695f8a
---
 .zuul.yaml                | 2 +-
 inc/python                | 1 -
 tools/dbcounter/setup.cfg | 2 +-
 3 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 0e114afb3e..fc3d76d2b3 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -731,7 +731,6 @@
     parent: tempest-full-py3
     description: Ubuntu 22.04 LTS (jammy) platform test
     nodeset: openstack-single-node-jammy
-    voting: false
     timeout: 9000
     vars:
       configure_swap_size: 4096
@@ -950,6 +949,7 @@
         - devstack
         - devstack-ipv6
         - devstack-platform-centos-9-stream
+        - devstack-platform-ubuntu-jammy
         - devstack-enforce-scope
         - devstack-multinode
         - devstack-unit-tests
diff --git a/inc/python b/inc/python
index 9382d352dc..d032a10eb9 100644
--- a/inc/python
+++ b/inc/python
@@ -194,7 +194,6 @@ function pip_install {
         https_proxy="${https_proxy:-}" \
         no_proxy="${no_proxy:-}" \
         PIP_FIND_LINKS=$PIP_FIND_LINKS \
-        SETUPTOOLS_SYS_PATH_TECHNIQUE=rewrite \
         $cmd_pip $upgrade \
         $@
     result=$?
diff --git a/tools/dbcounter/setup.cfg b/tools/dbcounter/setup.cfg
index f9f26f2175..12300bf619 100644
--- a/tools/dbcounter/setup.cfg
+++ b/tools/dbcounter/setup.cfg
@@ -8,7 +8,7 @@ url = http://github.com/openstack/devstack
 license = Apache
 
 [options]
-modules = dbcounter
+py_modules = dbcounter
 entry_points =
     [sqlalchemy.plugins]
     dbcounter = dbcounter:LogCursorEventsPlugin

From 1d5be95196d31ba1a4ef125f4b06a5730f2af113 Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Mon, 23 May 2022 08:46:05 -0700
Subject: [PATCH 2047/2409] Cleanup comment that should've been removed

The previous change, I237f5663b0f8b060f6df130de04e17e2b1695f8a, removed
a SETUPTOOLS flag, but not the comment explaining why that flag was
previously set. Clean up that comment.

Change-Id: I32b0240fd56310d7f10596aaa8ef432679bfd66a
---
 inc/python | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/inc/python b/inc/python
index d032a10eb9..3eb3efe80e 100644
--- a/inc/python
+++ b/inc/python
@@ -186,9 +186,6 @@ function pip_install {
 
     $xtrace
 
-    # adding SETUPTOOLS_SYS_PATH_TECHNIQUE is a workaround to keep
-    # the same behaviour of setuptools before version 25.0.0.
-    # related issue: https://github.com/pypa/pip/issues/3874
     $sudo_pip \
         http_proxy="${http_proxy:-}" \
         https_proxy="${https_proxy:-}" \

From 1cdf413ac6f993dc2074741be4627acdc3f10304 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Mon, 23 May 2022 13:56:13 -0700
Subject: [PATCH 2048/2409] Do not barf stack trace if stats DB is missing

This can happen if devstack fails to run, but we still run the post
tasks. Also could happen if some sort of hybrid job configuration
does not run all of devstack but we still end up running post jobs.

Just warn to stderr and assume no DB info.

Change-Id: I211a331ab668dbb0ad7882908cca4363f865d924
---
 tools/get-stats.py | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/tools/get-stats.py b/tools/get-stats.py
index ffe467691c..e0c20f2db9 100755
--- a/tools/get-stats.py
+++ b/tools/get-stats.py
@@ -86,9 +86,17 @@ def proc_matches(proc):
 
 def get_db_stats(host, user, passwd):
     dbs = []
-    db = pymysql.connect(host=host, user=user, password=passwd,
-                         database='stats',
-                         cursorclass=pymysql.cursors.DictCursor)
+    try:
+        db = pymysql.connect(host=host, user=user, password=passwd,
+                             database='stats',
+                             cursorclass=pymysql.cursors.DictCursor)
+    except pymysql.err.OperationalError as e:
+        if 'Unknown database' in str(e):
+            print('No stats database; assuming devstack failed',
+                  file=sys.stderr)
+            return []
+        raise
+
     with db:
         with db.cursor() as cur:
             cur.execute('SELECT db,op,count FROM queries')

From c64ea4f213afebd1602d05cdd4d5bc14eaf5356b Mon Sep 17 00:00:00 2001
From: yatinkarel <ykarel@redhat.com>
Date: Wed, 20 Apr 2022 12:30:09 +0530
Subject: [PATCH 2049/2409] Fix doc and user create script to set homedir
 permissions

RHEL based distros set homedir permissions to 700,
and Ubuntu 21.04+ to 750[1], i.e missing executable
permission for group or others, this results into failures
as defined in the below bug.

Since in doc we add useradd command, it's good to
add instructions to fix the permissions there itself
instead of getting failures during installation and then
fixing it.

Also update user create script to fix permissions
by adding executable bit to DEST directory if missing.

[1] https://discourse.ubuntu.com/t/private-home-directories-for-ubuntu-21-04-onwards/19533

Closes-Bug: #1966858
Change-Id: Id2787886433281238eb95ee11a75eddeef514293
---
 doc/source/guides/multinode-lab.rst  | 8 ++++++++
 doc/source/guides/single-machine.rst | 8 ++++++++
 doc/source/index.rst                 | 8 ++++++++
 tools/create-stack-user.sh           | 9 +++++++++
 4 files changed, 33 insertions(+)

diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
index 81c5945307..79a76dedb1 100644
--- a/doc/source/guides/multinode-lab.rst
+++ b/doc/source/guides/multinode-lab.rst
@@ -75,6 +75,14 @@ Otherwise create the stack user:
 
     useradd -s /bin/bash -d /opt/stack -m stack
 
+Ensure home directory for the ``stack`` user has executable permission for all,
+as RHEL based distros create it with ``700`` and Ubuntu 21.04+ with ``750``
+which can cause issues during deployment.
+
+::
+
+    chmod +x /opt/stack
+
 This user will be making many changes to your system during installation
 and operation so it needs to have sudo privileges to root without a
 password:
diff --git a/doc/source/guides/single-machine.rst b/doc/source/guides/single-machine.rst
index a0e97edb37..03d93743f7 100644
--- a/doc/source/guides/single-machine.rst
+++ b/doc/source/guides/single-machine.rst
@@ -49,6 +49,14 @@ below)
 
     $ sudo useradd -s /bin/bash -d /opt/stack -m stack
 
+Ensure home directory for the ``stack`` user has executable permission for all,
+as RHEL based distros create it with ``700`` and Ubuntu 21.04+ with ``750``
+which can cause issues during deployment.
+
+.. code-block:: console
+
+    $ sudo chmod +x /opt/stack
+
 Since this user will be making many changes to your system, it will need
 to have sudo privileges:
 
diff --git a/doc/source/index.rst b/doc/source/index.rst
index feb50ce4e9..a79a7e602c 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -57,6 +57,14 @@ to run DevStack with
 
    $ sudo useradd -s /bin/bash -d /opt/stack -m stack
 
+Ensure home directory for the ``stack`` user has executable permission for all,
+as RHEL based distros create it with ``700`` and Ubuntu 21.04+ with ``750``
+which can cause issues during deployment.
+
+.. code-block:: console
+
+    $ sudo chmod +x /opt/stack
+
 Since this user will be making many changes to your system, it should
 have sudo privileges:
 
diff --git a/tools/create-stack-user.sh b/tools/create-stack-user.sh
index 919cacb036..cb8d7aa328 100755
--- a/tools/create-stack-user.sh
+++ b/tools/create-stack-user.sh
@@ -44,6 +44,15 @@ fi
 if ! getent passwd $STACK_USER >/dev/null; then
     echo "Creating a user called $STACK_USER"
     useradd -g $STACK_USER -s /bin/bash -d $DEST -m $STACK_USER
+    # RHEL based distros create home dir with 700 permissions,
+    # And Ubuntu 21.04+ with 750, i.e missing executable
+    # permission for either group or others
+    # Devstack deploy will have issues with this, fix it by
+    # adding executable permission
+    if [[ $(stat -c '%A' $DEST|grep -o x|wc -l) -lt 3 ]]; then
+        echo "Executable permission missing for $DEST, adding it"
+        chmod +x $DEST
+    fi
 fi
 
 echo "Giving stack user passwordless sudo privileges"

From 599b241d32cd067a9a26c54fe178dd2bd28426d6 Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Thu, 21 Oct 2021 12:07:17 +0200
Subject: [PATCH 2050/2409] Run debian platform job with OVN

Packages for OVN are now available in bullseye, so we can drop the
special handling.

Signed-off-by: Dr. Jens Harbott <harbott@osism.tech>
Change-Id: I5e5c78aa19c5208c207ddcf14e208bae8fbc3c55
---
 .zuul.yaml | 31 -------------------------------
 1 file changed, 31 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 001ac84f12..03553d3b57 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -670,37 +670,6 @@
     timeout: 9000
     vars:
       configure_swap_size: 4096
-      # NOTE(yoctozepto): Debian Bullseye does not yet offer OVN. Switch to OVS
-      # for the time being.
-      devstack_localrc:
-        Q_AGENT: openvswitch
-        Q_ML2_PLUGIN_MECHANISM_DRIVERS: openvswitch
-        Q_ML2_TENANT_NETWORK_TYPE: vxlan
-      devstack_services:
-        # Disable OVN services
-        ovn-northd: false
-        ovn-controller: false
-        ovs-vswitchd: false
-        ovsdb-server: false
-        # Disable Neutron ML2/OVN services
-        q-ovn-metadata-agent: false
-        # Enable Neutron ML2/OVS services
-        q-agt: true
-        q-dhcp: true
-        q-l3: true
-        q-meta: true
-        q-metering: true
-    group-vars:
-      subnode:
-        devstack_services:
-          # Disable OVN services
-          ovn-controller: false
-          ovs-vswitchd: false
-          ovsdb-server: false
-          # Disable Neutron ML2/OVN services
-          q-ovn-metadata-agent: false
-          # Enable Neutron ML2/OVS services
-          q-agt: true
 
 - job:
     name: devstack-platform-ubuntu-jammy

From e85c68e60ff460f0e16eefd5f084862628a3c54d Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Thu, 26 May 2022 09:31:36 -0700
Subject: [PATCH 2051/2409] Add apache2 to the services we collect for memory

Change-Id: Ic6daef5b4df50ce43c6782542cb54c1958e54655
---
 tools/get-stats.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tools/get-stats.py b/tools/get-stats.py
index ffe467691c..80e7c642a2 100755
--- a/tools/get-stats.py
+++ b/tools/get-stats.py
@@ -54,7 +54,8 @@ def get_service_stats(service):
 
 def get_services_stats():
     services = [os.path.basename(s) for s in
-                glob.glob('/etc/systemd/system/devstack@*.service')]
+                glob.glob('/etc/systemd/system/devstack@*.service')] + \
+                ['apache2.service']
     return [dict(service=service, **get_service_stats(service))
             for service in services]
 

From 6dd896feface3d0413437221a63e508b359ed615 Mon Sep 17 00:00:00 2001
From: yatinkarel <ykarel@redhat.com>
Date: Tue, 26 Apr 2022 16:37:07 +0530
Subject: [PATCH 2052/2409] Allow to skip stop of ovn services

Grenade jobs stop services, check fip connectivity
for a nova server and then upgrade to next release.

But since ovn data plane and db services are stopped along
with other services, fip connectivity fails as a result.

We shouldn't stop these services along with other
neutron services. This patch adds a new variable
"SKIP_STOP_OVN" which can be used by grenade jobs
to skip stop of ovn services.

This will also fix the ovn grenade jobs.

Also source fixup_stuff.sh so function fixup_ovn_centos
is available. It's already sourced in stack.sh but
that's not used in grenade run.

Change-Id: I94818a19f19973779cb2e11753d2881d54dfa3bc
---
 lib/neutron-legacy            | 5 ++++-
 lib/neutron_plugins/ovn_agent | 2 ++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 88ac991167..e9b55b6b02 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -138,6 +138,9 @@ Q_NOTIFY_NOVA_PORT_DATA_CHANGES=${Q_NOTIFY_NOVA_PORT_DATA_CHANGES:-True}
 VIF_PLUGGING_IS_FATAL=${VIF_PLUGGING_IS_FATAL:-True}
 VIF_PLUGGING_TIMEOUT=${VIF_PLUGGING_TIMEOUT:-300}
 
+# Allow to skip stopping of OVN services
+SKIP_STOP_OVN=${SKIP_STOP_OVN:-False}
+
 # The directory which contains files for Q_PLUGIN_EXTRA_CONF_FILES.
 # /etc/neutron is assumed by many of devstack plugins.  Do not change.
 _Q_PLUGIN_EXTRA_CONF_PATH=/etc/neutron
@@ -638,7 +641,7 @@ function stop_mutnauq {
     stop_mutnauq_other
     stop_mutnauq_l2_agent
 
-    if [[ $Q_AGENT == "ovn" ]]; then
+    if [[ $Q_AGENT == "ovn" && $SKIP_STOP_OVN != "True" ]]; then
         stop_ovn
     fi
 }
diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index 9022f2d382..dfd55deae5 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -395,6 +395,8 @@ function install_ovn {
         sudo mkdir -p $OVS_PREFIX/var/log/ovn
         sudo chown $(whoami) $OVS_PREFIX/var/log/ovn
     else
+        # Load fixup_ovn_centos
+        source ${TOP_DIR}/tools/fixup_stuff.sh
         fixup_ovn_centos
         install_package $(get_packages openvswitch)
         install_package $(get_packages ovn)

From 35fb53423a68f8d156693ae79c1c6950538a33b7 Mon Sep 17 00:00:00 2001
From: yatinkarel <ykarel@redhat.com>
Date: Fri, 3 Jun 2022 10:10:50 +0530
Subject: [PATCH 2053/2409] [ironic][swift]Temporary add sha1 to
 allowed_digests

Swift removed sha1 from supported digests with [1] and
that broked ironic tinyipa job. Temorary add sha1 to
allowed_digests until it's fixed in ironic.

[1] https://review.opendev.org/c/openstack/swift/+/525771

Story: 2010068
Task: 45539
Change-Id: I68dfc472ce901058b6a7d691c98ed1641d431e54
---
 lib/swift | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/lib/swift b/lib/swift
index ba92f3dcc3..251c4625b5 100644
--- a/lib/swift
+++ b/lib/swift
@@ -402,6 +402,11 @@ function configure_swift {
     # Versioned Writes
     iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:versioned_writes allow_versioned_writes true
 
+    # Add sha1 temporary https://storyboard.openstack.org/#!/story/2010068
+    if [[ "$SWIFT_ENABLE_TEMPURLS" == "True" ]]; then
+        iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:tempurl allowed_digests "sha1 sha256 sha512"
+    fi
+
     # Configure Ceilometer
     if is_service_enabled ceilometer; then
         iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:ceilometer "set log_level" "WARN"

From f7d87aa433d344f5db0201aca047a987cba3a0af Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Thu, 2 Jun 2022 11:08:32 -0700
Subject: [PATCH 2054/2409] Capture QEMU core dumps when possible

Some of the hardest-to-debug issues are qemu crashes deep in a nova
workflow that can't be reproduced locally. This adds a post task to
the playbook so that we capture the most recent qemu core dump, if
there is one.

Change-Id: I48a2ea883325ca920b7e7909edad53a9832fb319
---
 .zuul.yaml          | 1 +
 playbooks/post.yaml | 6 ++++++
 2 files changed, 7 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index 001ac84f12..fdcee59bc5 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -377,6 +377,7 @@
         '{{ devstack_log_dir }}/devstacklog.txt.summary': logs
         '{{ devstack_log_dir }}/tcpdump.pcap': logs
         '{{ devstack_log_dir }}/worlddump-latest.txt': logs
+        '{{ devstack_log_dir }}/qemu.coredump': logs
         '{{ devstack_full_log}}': logs
         '{{ stage_dir }}/verify_tempest_conf.log': logs
         '{{ stage_dir }}/performance.json': logs
diff --git a/playbooks/post.yaml b/playbooks/post.yaml
index d8d5f6833c..0047d78ea5 100644
--- a/playbooks/post.yaml
+++ b/playbooks/post.yaml
@@ -17,6 +17,12 @@
         dest: "{{ stage_dir }}/verify_tempest_conf.log"
         state: hard
       when: tempest_log.stat.exists
+    - name: Capture most recent qemu crash dump, if any
+      shell:
+        executable: /bin/bash
+        cmd: |
+          coredumpctl -o {{ devstack_log_dir }}/qemu.coredump dump /usr/bin/qemu-system-x86_64
+      ignore_errors: yes
   roles:
     - export-devstack-journal
     - apache-logs-conf

From 96dbf55016a22dc121589a70181e5c7e7e55f8c0 Mon Sep 17 00:00:00 2001
From: Francesco Pantano <fpantano@redhat.com>
Date: Fri, 18 Mar 2022 10:56:31 +0100
Subject: [PATCH 2055/2409] Do not create cinder backup pool and key when
 cephadm is used

When cephadm is used, if ENABLE_CEPH_C_BAK is True both pool and
key are created by devstack-plugin-ceph. This piece of code can
still stay here to make sure the cinder config is properly built.

Change-Id: I799521f008123b8e42b2021c1c11d374b834bec3
---
 lib/cinder_backups/ceph | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/lib/cinder_backups/ceph b/lib/cinder_backups/ceph
index e4003c0720..4b180490d7 100644
--- a/lib/cinder_backups/ceph
+++ b/lib/cinder_backups/ceph
@@ -26,12 +26,15 @@ CINDER_BAK_CEPH_USER=${CINDER_BAK_CEPH_USER:-cinder-bak}
 
 
 function configure_cinder_backup_ceph {
-    sudo ceph -c ${CEPH_CONF_FILE} osd pool create ${CINDER_BAK_CEPH_POOL} ${CINDER_BAK_CEPH_POOL_PG} ${CINDER_BAK_CEPH_POOL_PGP}
-    if [[ "$REMOTE_CEPH" = "False" && "$CEPH_REPLICAS" -ne 1 ]]; then
-        sudo ceph -c ${CEPH_CONF_FILE} osd pool set ${CINDER_BAK_CEPH_POOL} crush_ruleset ${RULE_ID}
+    # Execute this part only when cephadm is not used
+    if [[ "$CEPHADM_DEPLOY" = "False" ]]; then
+        sudo ceph -c ${CEPH_CONF_FILE} osd pool create ${CINDER_BAK_CEPH_POOL} ${CINDER_BAK_CEPH_POOL_PG} ${CINDER_BAK_CEPH_POOL_PGP}
+        if [[ "$REMOTE_CEPH" = "False" && "$CEPH_REPLICAS" -ne 1 ]]; then
+            sudo ceph -c ${CEPH_CONF_FILE} osd pool set ${CINDER_BAK_CEPH_POOL} crush_ruleset ${RULE_ID}
+        fi
+        sudo ceph -c ${CEPH_CONF_FILE} auth get-or-create client.${CINDER_BAK_CEPH_USER} mon "allow r" osd "allow class-read object_prefix rbd_children, allow rwx pool=${CINDER_BAK_CEPH_POOL}, allow rwx pool=${CINDER_CEPH_POOL}" | sudo tee ${CEPH_CONF_DIR}/ceph.client.${CINDER_BAK_CEPH_USER}.keyring
+        sudo chown $(whoami):$(whoami) ${CEPH_CONF_DIR}/ceph.client.${CINDER_BAK_CEPH_USER}.keyring
     fi
-    sudo ceph -c ${CEPH_CONF_FILE} auth get-or-create client.${CINDER_BAK_CEPH_USER} mon "allow r" osd "allow class-read object_prefix rbd_children, allow rwx pool=${CINDER_BAK_CEPH_POOL}, allow rwx pool=${CINDER_CEPH_POOL}" | sudo tee ${CEPH_CONF_DIR}/ceph.client.${CINDER_BAK_CEPH_USER}.keyring
-    sudo chown $(whoami):$(whoami) ${CEPH_CONF_DIR}/ceph.client.${CINDER_BAK_CEPH_USER}.keyring
 
     iniset $CINDER_CONF DEFAULT backup_driver "cinder.backup.drivers.ceph.CephBackupDriver"
     iniset $CINDER_CONF DEFAULT backup_ceph_conf "$CEPH_CONF_FILE"

From c869d59857c636d21ecd0329023038b24252627d Mon Sep 17 00:00:00 2001
From: Brian Haley <bhaley@redhat.com>
Date: Fri, 28 Feb 2020 14:55:08 -0500
Subject: [PATCH 2056/2409] Add support for IPv6 tunnel endpoints

Currently, neutron tunnel endpoints must be IPv4 addresses,
i.e. $HOST_IP, although IPv6 endpoints are supported by most
drivers.

Create a TUNNEL_IP_VERSION variable to choose which host IP
to use, either HOST_IP or HOST_IPV6, and configure it in the
OVS and Linuxbridge agent driver files. The default is still
IPv4, but it can be over-ridden by specifying TUNNEL_ENDPOINT_IP
accordingly.

This behaves similar to the SERVICE_IP_VERSION option, which
can either be set to 4 or 6, but not 4+6 - the tunnel overhead
should be consistent on all systems in order not to have MTU
issues.

Must set the ML2 overlay_ip_version config option to match
else agent tunnel sync RPC will not work.

Must set the OVN external_ids:ovn-encap-ip config option to
the correct address.

Updated 'devstack-ipv6-only' job definition and verification role
that will set all services and tunnels to use IPv6 addresses.

Closes-bug: #1619476

Change-Id: I6034278dfc17b55d7863bc4db541bbdaa983a686
---
 .zuul.yaml                                    |  4 ++-
 doc/source/configuration.rst                  | 25 ++++++++++++++++--
 functions-common                              |  2 +-
 lib/neutron                                   |  5 ++--
 lib/neutron-legacy                            |  7 -----
 lib/neutron_plugins/ml2                       |  1 +
 lib/neutron_plugins/ovn_agent                 |  6 +++--
 .../README.rst                                | 10 +++----
 stackrc                                       | 26 +++++++++++++++++++
 tools/verify-ipv6-only-deployments.sh         | 25 +++++++++++++-----
 10 files changed, 84 insertions(+), 27 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 001ac84f12..7322f78963 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -625,11 +625,13 @@
     name: devstack-ipv6
     parent: devstack
     description: |
-      Devstack single node job for integration gate with IPv6.
+      Devstack single node job for integration gate with IPv6,
+      all services and tunnels using IPv6 addresses.
     vars:
       devstack_localrc:
         SERVICE_IP_VERSION: 6
         SERVICE_HOST: ""
+        TUNNEL_IP_VERSION: 6
 
 - job:
     name: devstack-enforce-scope
diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 40a8725b8d..757b4001d9 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -521,8 +521,8 @@ behavior:
 can be configured with any valid IPv6 prefix. The default values make
 use of an auto-generated ``IPV6_GLOBAL_ID`` to comply with RFC4193.
 
-Service Version
-~~~~~~~~~~~~~~~
+Service IP Version
+~~~~~~~~~~~~~~~~~~
 
 DevStack can enable service operation over either IPv4 or IPv6 by
 setting ``SERVICE_IP_VERSION`` to either ``SERVICE_IP_VERSION=4`` or
@@ -542,6 +542,27 @@ optionally be used to alter the default IPv6 address::
 
   HOST_IPV6=${some_local_ipv6_address}
 
+Tunnel IP Version
+~~~~~~~~~~~~~~~~~
+
+DevStack can enable tunnel operation over either IPv4 or IPv6 by
+setting ``TUNNEL_IP_VERSION`` to either ``TUNNEL_IP_VERSION=4`` or
+``TUNNEL_IP_VERSION=6`` respectively.
+
+When set to ``4`` Neutron will use an IPv4 address for tunnel endpoints,
+for example, ``HOST_IP``.
+
+When set to ``6`` Neutron will use an IPv6 address for tunnel endpoints,
+for example, ``HOST_IPV6``.
+
+The default value for this setting is ``4``.  Dual-mode support, for
+example ``4+6`` is not supported, as this value must match the address
+family of the local tunnel endpoint IP(v6) address.
+
+The value of ``TUNNEL_IP_VERSION`` has a direct relationship to the
+setting of ``TUNNEL_ENDPOINT_IP``, which will default to ``HOST_IP``
+when set to ``4``, and ``HOST_IPV6`` when set to ``6``.
+
 Multi-node setup
 ~~~~~~~~~~~~~~~~
 
diff --git a/functions-common b/functions-common
index be966e96a6..f299ef1cc9 100644
--- a/functions-common
+++ b/functions-common
@@ -49,7 +49,7 @@ KILL_PATH="$(which kill)"
 STACK_ENV_VARS="BASE_SQL_CONN DATA_DIR DEST ENABLED_SERVICES HOST_IP \
     KEYSTONE_SERVICE_URI \
     LOGFILE OS_CACERT SERVICE_HOST STACK_USER TLS_IP \
-    HOST_IPV6 SERVICE_IP_VERSION"
+    HOST_IPV6 SERVICE_IP_VERSION TUNNEL_ENDPOINT_IP TUNNEL_IP_VERSION"
 
 
 # Saves significant environment variables to .stackenv for later use
diff --git a/lib/neutron b/lib/neutron
index f24ccfb1a9..1b78493919 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -230,6 +230,7 @@ function configure_neutron_new {
             mech_drivers+=",linuxbridge"
         fi
         iniset $NEUTRON_CORE_PLUGIN_CONF ml2 mechanism_drivers $mech_drivers
+        iniset $NEUTRON_CORE_PLUGIN_CONF ml2 overlay_ip_version $TUNNEL_IP_VERSION
 
         iniset $NEUTRON_CORE_PLUGIN_CONF ml2_type_vxlan vni_ranges 1001:2000
         iniset $NEUTRON_CORE_PLUGIN_CONF ml2_type_flat flat_networks $PUBLIC_NETWORK_NAME
@@ -251,10 +252,10 @@ function configure_neutron_new {
         # Configure the neutron agent
         if [[ $NEUTRON_AGENT == "linuxbridge" ]]; then
             iniset $NEUTRON_CORE_PLUGIN_CONF securitygroup firewall_driver iptables
-            iniset $NEUTRON_CORE_PLUGIN_CONF vxlan local_ip $HOST_IP
+            iniset $NEUTRON_CORE_PLUGIN_CONF vxlan local_ip $TUNNEL_ENDPOINT_IP
         elif [[ $NEUTRON_AGENT == "openvswitch" ]]; then
             iniset $NEUTRON_CORE_PLUGIN_CONF securitygroup firewall_driver openvswitch
-            iniset $NEUTRON_CORE_PLUGIN_CONF ovs local_ip $HOST_IP
+            iniset $NEUTRON_CORE_PLUGIN_CONF ovs local_ip $TUNNEL_ENDPOINT_IP
 
             if [[ "$NEUTRON_DISTRIBUTED_ROUTING" = "True" ]]; then
                 iniset $NEUTRON_CORE_PLUGIN_CONF agent l2_population True
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index e9b55b6b02..5e6af0f249 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -246,13 +246,6 @@ if [[ $Q_AGENT == "linuxbridge" && -z ${LB_PHYSICAL_INTERFACE} ]]; then
     LB_PHYSICAL_INTERFACE=$default_route_dev
 fi
 
-# When Neutron tunnels are enabled it is needed to specify the
-# IP address of the end point in the local server. This IP is set
-# by default to the same IP address that the HOST IP.
-# This variable can be used to specify a different end point IP address
-# Example: ``TUNNEL_ENDPOINT_IP=1.1.1.1``
-TUNNEL_ENDPOINT_IP=${TUNNEL_ENDPOINT_IP:-$HOST_IP}
-
 # With the openvswitch plugin, set to True in ``localrc`` to enable
 # provider GRE tunnels when ``ENABLE_TENANT_TUNNELS`` is False.
 #
diff --git a/lib/neutron_plugins/ml2 b/lib/neutron_plugins/ml2
index f00feac6b4..7343606aac 100644
--- a/lib/neutron_plugins/ml2
+++ b/lib/neutron_plugins/ml2
@@ -125,6 +125,7 @@ function neutron_plugin_configure_service {
     fi
 
     populate_ml2_config /$Q_PLUGIN_CONF_FILE ml2 mechanism_drivers=$Q_ML2_PLUGIN_MECHANISM_DRIVERS
+    populate_ml2_config /$Q_PLUGIN_CONF_FILE ml2 overlay_ip_version=$TUNNEL_IP_VERSION
 
     if [[ -n "$Q_ML2_PLUGIN_TYPE_DRIVERS" ]]; then
         populate_ml2_config /$Q_PLUGIN_CONF_FILE ml2 type_drivers=$Q_ML2_PLUGIN_TYPE_DRIVERS
diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index dfd55deae5..24bdf92b60 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -99,8 +99,10 @@ ENABLE_CHASSIS_AS_GW=$(trueorfalse True ENABLE_CHASSIS_AS_GW)
 OVN_L3_CREATE_PUBLIC_NETWORK=$(trueorfalse True OVN_L3_CREATE_PUBLIC_NETWORK)
 
 export OVSDB_SERVER_LOCAL_HOST=$SERVICE_LOCAL_HOST
+TUNNEL_IP=$TUNNEL_ENDPOINT_IP
 if [[ "$SERVICE_IP_VERSION" == 6 ]]; then
     OVSDB_SERVER_LOCAL_HOST=[$OVSDB_SERVER_LOCAL_HOST]
+    TUNNEL_IP=[$TUNNEL_IP]
 fi
 
 OVN_IGMP_SNOOPING_ENABLE=$(trueorfalse False OVN_IGMP_SNOOPING_ENABLE)
@@ -639,7 +641,7 @@ function _start_ovs {
         sudo ovs-vsctl --no-wait set open_vswitch . external-ids:ovn-remote="$OVN_SB_REMOTE"
         sudo ovs-vsctl --no-wait set open_vswitch . external-ids:ovn-bridge="br-int"
         sudo ovs-vsctl --no-wait set open_vswitch . external-ids:ovn-encap-type="geneve"
-        sudo ovs-vsctl --no-wait set open_vswitch . external-ids:ovn-encap-ip="$HOST_IP"
+        sudo ovs-vsctl --no-wait set open_vswitch . external-ids:ovn-encap-ip="$TUNNEL_IP"
         sudo ovs-vsctl --no-wait set open_vswitch . external-ids:hostname="$LOCAL_HOSTNAME"
         # Select this chassis to host gateway routers
         if [[ "$ENABLE_CHASSIS_AS_GW" == "True" ]]; then
@@ -654,7 +656,7 @@ function _start_ovs {
         if is_service_enabled ovn-controller-vtep ; then
             ovn_base_setup_bridge br-v
             vtep-ctl add-ps br-v
-            vtep-ctl set Physical_Switch br-v tunnel_ips=$HOST_IP
+            vtep-ctl set Physical_Switch br-v tunnel_ips=$TUNNEL_IP
 
             enable_service ovs-vtep
             local vtepcmd="$OVS_SCRIPTDIR/ovs-vtep --log-file --pidfile --detach br-v"
diff --git a/roles/devstack-ipv6-only-deployments-verification/README.rst b/roles/devstack-ipv6-only-deployments-verification/README.rst
index 400a8da222..3bddf5ea60 100644
--- a/roles/devstack-ipv6-only-deployments-verification/README.rst
+++ b/roles/devstack-ipv6-only-deployments-verification/README.rst
@@ -1,10 +1,10 @@
-Verify the IPv6-only deployments
+Verify all addresses in IPv6-only deployments
 
 This role needs to be invoked from a playbook that
-run tests. This role verifies the IPv6 setting on
-devstack side and devstack deploy services on IPv6.
-This role is invoked before tests are run so that
-if any missing IPv6 setting or deployments can fail
+runs tests. This role verifies the IPv6 settings on the
+devstack side and that devstack deploys with all addresses
+being IPv6. This role is invoked before tests are run so that
+if there is any missing IPv6 setting, deployments can fail
 the job early.
 
 
diff --git a/stackrc b/stackrc
index 0c76de0531..f0039f0043 100644
--- a/stackrc
+++ b/stackrc
@@ -877,6 +877,32 @@ SERVICE_HOST=${SERVICE_HOST:-${DEF_SERVICE_HOST}}
 # This is either 127.0.0.1 for IPv4 or ::1 for IPv6
 SERVICE_LOCAL_HOST=${SERVICE_LOCAL_HOST:-${DEF_SERVICE_LOCAL_HOST}}
 
+# TUNNEL IP version
+# This is the IP version to use for tunnel endpoints
+TUNNEL_IP_VERSION=${TUNNEL_IP_VERSION:-4}
+
+# Validate TUNNEL_IP_VERSION
+if [[ $TUNNEL_IP_VERSION != "4" ]] && [[ $TUNNEL_IP_VERSION != "6" ]]; then
+    die $LINENO "TUNNEL_IP_VERSION must be either 4 or 6"
+fi
+
+if [[ "$TUNNEL_IP_VERSION" == 4 ]]; then
+    DEF_TUNNEL_ENDPOINT_IP=$HOST_IP
+fi
+
+if [[ "$TUNNEL_IP_VERSION" == 6 ]]; then
+    # Only die if the user has not over-ridden the endpoint IP
+    if [[ "$HOST_IPV6" == "" ]] && [[ "$TUNNEL_ENDPOINT_IP" == "" ]]; then
+        die $LINENO "Could not determine host IPv6 address.  See local.conf for suggestions on setting HOST_IPV6."
+    fi
+
+    DEF_TUNNEL_ENDPOINT_IP=$HOST_IPV6
+fi
+
+# Allow the use of an alternate address for tunnel endpoints.
+# Default is dependent on TUNNEL_IP_VERSION above.
+TUNNEL_ENDPOINT_IP=${TUNNEL_ENDPOINT_IP:-${DEF_TUNNEL_ENDPOINT_IP}}
+
 REGION_NAME=${REGION_NAME:-RegionOne}
 
 # Configure services to use syslog instead of writing to individual log files
diff --git a/tools/verify-ipv6-only-deployments.sh b/tools/verify-ipv6-only-deployments.sh
index 2596395165..0f0cba8afe 100755
--- a/tools/verify-ipv6-only-deployments.sh
+++ b/tools/verify-ipv6-only-deployments.sh
@@ -23,32 +23,43 @@ function verify_devstack_ipv6_setting {
     _service_listen_address=$(echo $SERVICE_LISTEN_ADDRESS | tr -d [])
     local _service_local_host=''
     _service_local_host=$(echo $SERVICE_LOCAL_HOST | tr -d [])
+    local _tunnel_endpoint_ip=''
+    _tunnel_endpoint_ip=$(echo $TUNNEL_ENDPOINT_IP | tr -d [])
     if [[ "$SERVICE_IP_VERSION" != 6 ]]; then
         echo $SERVICE_IP_VERSION "SERVICE_IP_VERSION is not set to 6 which is must for devstack to deploy services with IPv6 address."
         exit 1
     fi
+    if [[ "$TUNNEL_IP_VERSION" != 6 ]]; then
+        echo $TUNNEL_IP_VERSION "TUNNEL_IP_VERSION is not set to 6 so TUNNEL_ENDPOINT_IP cannot be an IPv6 address."
+        exit 1
+    fi
     is_service_host_ipv6=$(python3 -c 'import oslo_utils.netutils as nutils; print(nutils.is_valid_ipv6("'$_service_host'"))')
     if [[ "$is_service_host_ipv6" != "True" ]]; then
-        echo $SERVICE_HOST "SERVICE_HOST is not ipv6 which means devstack cannot deploy services on IPv6 address."
+        echo $SERVICE_HOST "SERVICE_HOST is not IPv6 which means devstack cannot deploy services on IPv6 addresses."
         exit 1
     fi
     is_host_ipv6=$(python3 -c 'import oslo_utils.netutils as nutils; print(nutils.is_valid_ipv6("'$_host_ipv6'"))')
     if [[ "$is_host_ipv6" != "True" ]]; then
-        echo $HOST_IPV6 "HOST_IPV6 is not ipv6 which means devstack cannot deploy services on IPv6 address."
+        echo $HOST_IPV6 "HOST_IPV6 is not IPv6 which means devstack cannot deploy services on IPv6 addresses."
         exit 1
     fi
     is_service_listen_address=$(python3 -c 'import oslo_utils.netutils as nutils; print(nutils.is_valid_ipv6("'$_service_listen_address'"))')
     if [[ "$is_service_listen_address" != "True" ]]; then
-        echo $SERVICE_LISTEN_ADDRESS "SERVICE_LISTEN_ADDRESS is not ipv6 which means devstack cannot deploy services on IPv6 address."
+        echo $SERVICE_LISTEN_ADDRESS "SERVICE_LISTEN_ADDRESS is not IPv6 which means devstack cannot deploy services on IPv6 addresses."
         exit 1
     fi
     is_service_local_host=$(python3 -c 'import oslo_utils.netutils as nutils; print(nutils.is_valid_ipv6("'$_service_local_host'"))')
     if [[ "$is_service_local_host" != "True" ]]; then
-        echo $SERVICE_LOCAL_HOST "SERVICE_LOCAL_HOST is not ipv6 which means devstack cannot deploy services on IPv6 address."
+        echo $SERVICE_LOCAL_HOST "SERVICE_LOCAL_HOST is not IPv6 which means devstack cannot deploy services on IPv6 addresses."
+        exit 1
+    fi
+    is_tunnel_endpoint_ip=$(python3 -c 'import oslo_utils.netutils as nutils; print(nutils.is_valid_ipv6("'$_tunnel_endpoint_ip'"))')
+    if [[ "$is_tunnel_endpoint_ip" != "True" ]]; then
+        echo $TUNNEL_ENDPOINT_IP "TUNNEL_ENDPOINT_IP is not IPv6 which means devstack will not deploy with an IPv6 endpoint address."
         exit 1
     fi
     echo "Devstack is properly configured with IPv6"
-    echo "SERVICE_IP_VERSION: " $SERVICE_IP_VERSION "HOST_IPV6: " $HOST_IPV6 "SERVICE_HOST: " $SERVICE_HOST "SERVICE_LISTEN_ADDRESS: " $SERVICE_LISTEN_ADDRESS "SERVICE_LOCAL_HOST: " $SERVICE_LOCAL_HOST
+    echo "SERVICE_IP_VERSION:" $SERVICE_IP_VERSION "HOST_IPV6:" $HOST_IPV6 "SERVICE_HOST:" $SERVICE_HOST "SERVICE_LISTEN_ADDRESS:" $SERVICE_LISTEN_ADDRESS "SERVICE_LOCAL_HOST:" $SERVICE_LOCAL_HOST "TUNNEL_IP_VERSION:" $TUNNEL_IP_VERSION "TUNNEL_ENDPOINT_IP:" $TUNNEL_ENDPOINT_IP
 }
 
 function sanity_check_system_ipv6_enabled {
@@ -72,7 +83,7 @@ function verify_service_listen_address_is_ipv6 {
         is_endpoint_ipv6=$(python3 -c 'import oslo_utils.netutils as nutils; print(nutils.is_valid_ipv6("'$endpoint_address'"))')
         if [[ "$is_endpoint_ipv6" != "True" ]]; then
             all_ipv6=False
-            echo $endpoint ": This is not ipv6 endpoint which means corresponding service is not listening on IPv6 address."
+            echo $endpoint ": This is not an IPv6 endpoint which means corresponding service is not listening on an IPv6 address."
             continue
         fi
         endpoints_verified=True
@@ -80,7 +91,7 @@ function verify_service_listen_address_is_ipv6 {
     if [[ "$all_ipv6" == "False"  ]] || [[ "$endpoints_verified" == "False" ]]; then
         exit 1
     fi
-    echo "All services deployed by devstack is on IPv6 endpoints"
+    echo "All services deployed by devstack are on IPv6 endpoints"
     echo $endpoints
 }
 

From e6e7100e853f2ba06bf2157fd87ae948faba1d1f Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Tue, 7 Jun 2022 10:12:59 +0200
Subject: [PATCH 2057/2409] Don't install pinned setuptools with distro pip

We are seeing failures when using an updated setuptools version
installed together with distro pip on Ubuntu 22.04. Install the version
from u-c only when we are also installing pip from upstream.

Change-Id: Ibb6e9424e5794ccbf9a937d2eecfa3bf60ed312e
---
 tools/install_pip.sh | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index e9c52eacb7..7c5d4c6555 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -139,15 +139,18 @@ if is_fedora && [[ ${DISTRO} == f* || ${DISTRO} == rhel9 ]]; then
     # recent enough anyway.  This is included via rpms/general
     : # Simply fall through
 elif is_ubuntu; then
-    : # pip on Ubuntu 20.04 is new enough, too
+    # pip on Ubuntu 20.04 is new enough, too
+    # drop setuptools from u-c
+    sed -i -e '/setuptools/d' $REQUIREMENTS_DIR/upper-constraints.txt
 else
     install_get_pip
+
+    # Note setuptools is part of requirements.txt and we want to make sure
+    # we obey any versioning as described there.
+    pip_install_gr setuptools
 fi
 
 set -x
 
-# Note setuptools is part of requirements.txt and we want to make sure
-# we obey any versioning as described there.
-pip_install_gr setuptools
 
 get_versions

From d5af514ac9485009229f3b594bccc09e905782fb Mon Sep 17 00:00:00 2001
From: Gorka Eguileor <geguileo@redhat.com>
Date: Wed, 8 Jun 2022 10:19:50 +0200
Subject: [PATCH 2058/2409] Reduce memory consumption in Cinder services

This patch reduces memory usage on the Cinder Volume and Backup services
by tuning glibc.

The specific tuning consist on disabling the per thread arenas and
disabling dynamic thresholds.

The Cinder Backup service suffers from high water mark memory usage and
uses excessive memory.  As an example just after 10 restore operations
the service uses almost 1GB of RAM and does not ever free it afterwards.
With this patch the memory consumption of the service is reduced down to
almost 130MB.  If we add a revert from Cinder (Change-Id
I43a20c8687f12bc52b014611cc6977c4c3ca212c) it goes down to 100MB during
my tests.

This glibc tuning is not applied to all Python services because I
haven't done proper testings on them and at first glance they don't seem
to have such great improvements.

Related-bug: #1908805
Change-Id: Ic9030d01468b3189350f83b04a8d1d346c489d3c
---
 functions-common | 22 ++++++++++++++++++----
 lib/cinder       |  9 +++++++--
 2 files changed, 25 insertions(+), 6 deletions(-)

diff --git a/functions-common b/functions-common
index be966e96a6..0b896dde59 100644
--- a/functions-common
+++ b/functions-common
@@ -1564,6 +1564,7 @@ function write_user_unit_file {
     local command="$2"
     local group=$3
     local user=$4
+    local env_vars="$5"
     local extra=""
     if [[ -n "$group" ]]; then
         extra="Group=$group"
@@ -1577,6 +1578,9 @@ function write_user_unit_file {
     iniset -sudo $unitfile "Service" "KillMode" "process"
     iniset -sudo $unitfile "Service" "TimeoutStopSec" "300"
     iniset -sudo $unitfile "Service" "ExecReload" "$KILL_PATH -HUP \$MAINPID"
+    if [[ -n "$env_vars" ]] ; then
+        iniset -sudo $unitfile "Service" "Environment" "$env_vars"
+    fi
     if [[ -n "$group" ]]; then
         iniset -sudo $unitfile "Service" "Group" "$group"
     fi
@@ -1591,6 +1595,7 @@ function write_uwsgi_user_unit_file {
     local command="$2"
     local group=$3
     local user=$4
+    local env_vars="$5"
     local unitfile="$SYSTEMD_DIR/$service"
     mkdir -p $SYSTEMD_DIR
 
@@ -1605,6 +1610,9 @@ function write_uwsgi_user_unit_file {
     iniset -sudo $unitfile "Service" "NotifyAccess" "all"
     iniset -sudo $unitfile "Service" "RestartForceExitStatus" "100"
 
+    if [[ -n "$env_vars" ]] ; then
+        iniset -sudo $unitfile "Service" "Environment" "$env_vars"
+    fi
     if [[ -n "$group" ]]; then
         iniset -sudo $unitfile "Service" "Group" "$group"
     fi
@@ -1652,10 +1660,14 @@ function _run_under_systemd {
     local systemd_service="devstack@$service.service"
     local group=$3
     local user=${4:-$STACK_USER}
+    if [[ -z "$user" ]]; then
+        user=$STACK_USER
+    fi
+    local env_vars="$5"
     if [[ "$command" =~ "uwsgi" ]] ; then
-        write_uwsgi_user_unit_file $systemd_service "$cmd" "$group" "$user"
+        write_uwsgi_user_unit_file $systemd_service "$cmd" "$group" "$user" "$env_vars"
     else
-        write_user_unit_file $systemd_service "$cmd" "$group" "$user"
+        write_user_unit_file $systemd_service "$cmd" "$group" "$user" "$env_vars"
     fi
 
     $SYSTEMCTL enable $systemd_service
@@ -1676,18 +1688,20 @@ function is_running {
 # If the command includes shell metachatacters (;<>*) it must be run using a shell
 # If an optional group is provided sg will be used to run the
 # command as that group.
-# run_process service "command-line" [group] [user]
+# run_process service "command-line" [group] [user] [env_vars]
+# env_vars must be a space separated list of variable assigments, ie: "A=1 B=2"
 function run_process {
     local service=$1
     local command="$2"
     local group=$3
     local user=$4
+    local env_vars="$5"
 
     local name=$service
 
     time_start "run_process"
     if is_service_enabled $service; then
-        _run_under_systemd "$name" "$command" "$group" "$user"
+        _run_under_systemd "$name" "$command" "$group" "$user" "$env_vars"
     fi
     time_stop "run_process"
 }
diff --git a/lib/cinder b/lib/cinder
index 52818a81eb..ca2c084aff 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -552,8 +552,13 @@ function start_cinder {
     fi
 
     run_process c-sch "$CINDER_BIN_DIR/cinder-scheduler --config-file $CINDER_CONF"
-    run_process c-bak "$CINDER_BIN_DIR/cinder-backup --config-file $CINDER_CONF"
-    run_process c-vol "$CINDER_BIN_DIR/cinder-volume --config-file $CINDER_CONF"
+    # Tune glibc for Python Services using single malloc arena for all threads
+    # and disabling dynamic thresholds to reduce memory usage when using native
+    # threads directly or via eventlet.tpool
+    # https://www.gnu.org/software/libc/manual/html_node/Memory-Allocation-Tunables.html
+    malloc_tuning="MALLOC_ARENA_MAX=1 MALLOC_MMAP_THRESHOLD_=131072 MALLOC_TRIM_THRESHOLD_=262144"
+    run_process c-bak "$CINDER_BIN_DIR/cinder-backup --config-file $CINDER_CONF" "" "" "$malloc_tuning"
+    run_process c-vol "$CINDER_BIN_DIR/cinder-volume --config-file $CINDER_CONF" "" "" "$malloc_tuning"
 
     # NOTE(jdg): For cinder, startup order matters.  To ensure that repor_capabilities is received
     # by the scheduler start the cinder-volume service last (or restart it) after the scheduler

From 8ff52ea12bb855adc9fe26de48b022310c1a5893 Mon Sep 17 00:00:00 2001
From: Martin Kopec <mkopec@redhat.com>
Date: Tue, 21 Jun 2022 17:31:50 +0200
Subject: [PATCH 2059/2409] Mark devstack-platform-centos-9-stream as n-v

Due to the below bug the job has been constantly failing.
Let's make it n-v until the bug is resolved:
  - https://bugs.launchpad.net/neutron/+bug/1979047

Change-Id: Ifc8cc96843a8eac5c98cd1e1f9e4b6287a7f2e7c
---
 .zuul.yaml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 5b93a77017..c3f8914eee 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -661,6 +661,9 @@
     description: CentOS 9 Stream platform test
     nodeset: devstack-single-node-centos-9-stream
     timeout: 9000
+    # TODO(kopecmartin) n-v until the following is resolved:
+    # https://bugs.launchpad.net/neutron/+bug/1979047
+    voting: false
     vars:
       configure_swap_size: 4096
 
@@ -896,7 +899,9 @@
       jobs:
         - devstack
         - devstack-ipv6
-        - devstack-platform-centos-9-stream
+        # TODO(kopecmartin) n-v until the following is resolved:
+        # https://bugs.launchpad.net/neutron/+bug/1979047
+        # - devstack-platform-centos-9-stream
         - devstack-platform-ubuntu-jammy
         - devstack-enforce-scope
         - devstack-multinode

From 8a38a73ddf2930e9662cb22109f4a6ef341476d6 Mon Sep 17 00:00:00 2001
From: Vladislav Belogrudov <v.belogrudov@yadro.com>
Date: Wed, 25 May 2022 12:58:52 +0300
Subject: [PATCH 2060/2409] Correct hostname for OVN agent

Currently Devstack uses short hostname for configuration of OVN.
This leads to inability to start instances (failing port binding)
on hosts with full hostnames (including dots). Open vSwitch expects
hostname in external_ids that corresponds to one returned by
``hostname`` command.

Closes-Bug: #1943631
Change-Id: I15b71a49c482be0c8f15ad834e29ea1b33307c86
---
 lib/neutron_plugins/ovn_agent | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index 24bdf92b60..e8a9babc1c 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -642,7 +642,7 @@ function _start_ovs {
         sudo ovs-vsctl --no-wait set open_vswitch . external-ids:ovn-bridge="br-int"
         sudo ovs-vsctl --no-wait set open_vswitch . external-ids:ovn-encap-type="geneve"
         sudo ovs-vsctl --no-wait set open_vswitch . external-ids:ovn-encap-ip="$TUNNEL_IP"
-        sudo ovs-vsctl --no-wait set open_vswitch . external-ids:hostname="$LOCAL_HOSTNAME"
+        sudo ovs-vsctl --no-wait set open_vswitch . external-ids:hostname=$(hostname)
         # Select this chassis to host gateway routers
         if [[ "$ENABLE_CHASSIS_AS_GW" == "True" ]]; then
             sudo ovs-vsctl --no-wait set open_vswitch . external-ids:ovn-cms-options="enable-chassis-as-gw"

From fe7cfa6b8c7573d643d66d3684de03e4183651bb Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Thu, 23 Jun 2022 09:25:22 -0700
Subject: [PATCH 2061/2409] Avoid including bad service names in perf.json

Some of the API services are not properly mounted under /$service/
in the apache proxy. This patch tries to avoid recording data
for "services" like "v2.0" (in the case of neutron) by only adding
names if they're all letters. A single warning is emitted for any
services excluded by this check.

For the moment this will mean we don't collect data for those services,
but when their devstack API config is fixed, they'll start to show
up.

Change-Id: I41cc300e89a4f97a008a8ba97c91f0980f9b9c3f
---
 tools/get-stats.py | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/tools/get-stats.py b/tools/get-stats.py
index a3ed7f2625..b958af61b2 100755
--- a/tools/get-stats.py
+++ b/tools/get-stats.py
@@ -111,6 +111,7 @@ def get_http_stats_for_log(logfile):
     apache_fields = ('host', 'a', 'b', 'date', 'tz', 'request', 'status',
                      'length', 'c', 'agent')
     ignore_agents = ('curl', 'uwsgi', 'nova-status')
+    ignored_services = set()
     for line in csv.reader(open(logfile), delimiter=' '):
         fields = dict(zip(apache_fields, line))
         if len(fields) != len(apache_fields):
@@ -146,6 +147,10 @@ def get_http_stats_for_log(logfile):
             service = url.strip('/')
             rest = ''
 
+        if not service.isalpha():
+            ignored_services.add(service)
+            continue
+
         method_key = '%s-%s' % (agent, method)
         try:
             length = int(fields['length'])
@@ -159,6 +164,10 @@ def get_http_stats_for_log(logfile):
         stats[service]['largest'] = max(stats[service]['largest'],
                                         length)
 
+    if ignored_services:
+        LOG.warning('Ignored services: %s' % ','.join(
+            sorted(ignored_services)))
+
     # Flatten this for ES
     return [{'service': service, 'log': os.path.basename(logfile),
              **vals}

From ce1ae9ddef4dd05a294dc630bf81b264a4b5a703 Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Wed, 29 Jun 2022 09:56:12 +0200
Subject: [PATCH 2062/2409] Fix missing "$" in the ENFORCE_SCOPE's variable
 name

Because of the missing "$" before ENFORCE_SCOPE in the lib/neutron
module, it was treated as an ENFORCE_SCOPE string instead of variable
and Neutron was deployed always with old defaults and disabled scope
enforcement.

Change-Id: Ibe67fea634c5f7abb521c0369ff30dd5db84db8c
---
 lib/neutron | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron b/lib/neutron
index 1b78493919..2d77df699a 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -633,7 +633,7 @@ function configure_neutron {
 # configure_rbac_policies() - Configure Neutron to enforce new RBAC
 # policies and scopes if NEUTRON_ENFORCE_SCOPE == True
 function configure_rbac_policies {
-    if [[ "$NEUTRON_ENFORCE_SCOPE" == "True" || "ENFORCE_SCOPE" == "True" ]]; then
+    if [[ "$NEUTRON_ENFORCE_SCOPE" == "True" || "$ENFORCE_SCOPE" == "True" ]]; then
         iniset $NEUTRON_CONF oslo_policy enforce_new_defaults True
         iniset $NEUTRON_CONF oslo_policy enforce_scope True
     else

From e1fb94f82a2a5bfdc3a0d56c69455e95e265195e Mon Sep 17 00:00:00 2001
From: Martin Kopec <mkopec@redhat.com>
Date: Wed, 29 Jun 2022 10:43:33 +0200
Subject: [PATCH 2063/2409] Make devstack-platform-debian-bullseye voting

The job has been successfully passing lately, let's make it voting.

Change-Id: Ib3b803a26c8647fd49c89371516c0ac7baba2703
---
 .zuul.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index c3f8914eee..c29cb31f31 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -672,7 +672,6 @@
     parent: tempest-full-py3
     description: Debian Bullseye platform test
     nodeset: devstack-single-node-debian-bullseye
-    voting: false
     timeout: 9000
     vars:
       configure_swap_size: 4096
@@ -902,6 +901,7 @@
         # TODO(kopecmartin) n-v until the following is resolved:
         # https://bugs.launchpad.net/neutron/+bug/1979047
         # - devstack-platform-centos-9-stream
+        - devstack-platform-debian-bullseye
         - devstack-platform-ubuntu-jammy
         - devstack-enforce-scope
         - devstack-multinode

From bd6e5205b115fb0cafed7f50a676699a4b9fc0fe Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Sun, 3 Jul 2022 22:27:15 +0200
Subject: [PATCH 2064/2409] Increase timeout waiting for OVN startup

We see some cases where OVN startup takes much longer than 5 seconds, up
to 28 seconds have been observed, so increase the limit to 40 to be on
the safe side.

Signed-off-by: Dr. Jens Harbott <harbott@osism.tech>
Closes-Bug: 1980421
Change-Id: I6da4a537e6a8d527ff71a821f07164fc7d342882
---
 lib/neutron_plugins/ovn_agent | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index e8a9babc1c..341b84d959 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -176,7 +176,7 @@ function wait_for_db_file {
     while [ ! -f $1 ]; do
         sleep 1
         count=$((count+1))
-        if [ "$count" -gt 5 ]; then
+        if [ "$count" -gt 40 ]; then
             die $LINENO "DB File $1 not found"
         fi
     done
@@ -187,7 +187,7 @@ function wait_for_sock_file {
     while [ ! -S $1 ]; do
         sleep 1
         count=$((count+1))
-        if [ "$count" -gt 5 ]; then
+        if [ "$count" -gt 40 ]; then
             die $LINENO "Socket $1 not found"
         fi
     done

From 85340e77f3d15b77dd0dc7c9df240428bfd2e30f Mon Sep 17 00:00:00 2001
From: Yadnesh Kulkarni <ykulkarn@redhat.com>
Date: Mon, 11 Jul 2022 17:14:40 +0530
Subject: [PATCH 2065/2409] delete __pycache__ directory with sudo privileges

Signed-off-by: Yadnesh Kulkarni <ykulkarn@redhat.com>
Change-Id: I9cf3cd8921347eacc1effb2b197b97bc6ff3e0df
---
 functions-common | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index e16bb27ef5..e5b07514e5 100644
--- a/functions-common
+++ b/functions-common
@@ -646,7 +646,7 @@ function git_clone {
             # remove the existing ignored files (like pyc) as they cause breakage
             # (due to the py files having older timestamps than our pyc, so python
             # thinks the pyc files are correct using them)
-            find $git_dest -name '*.pyc' -delete
+            sudo find $git_dest -name '*.pyc' -delete
 
             # handle git_ref accordingly to type (tag, branch)
             if [[ -n "`git show-ref refs/tags/$git_ref`" ]]; then

From cf0bf746e996b780714a085b0e6f38899c2c832e Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <tkajinam@redhat.com>
Date: Wed, 13 Jul 2022 22:34:47 +0900
Subject: [PATCH 2066/2409] Neutron: Set experimental option to use linuxbridge
 agent

Recently the experimental mechanism has been added to Neutron and now
it requires the [experimental] linuxbridge option when the linuxbridge
mechanism driver is used.

Depends-on: https://review.opendev.org/c/openstack/neutron/+/845181
Change-Id: Ice82a391cda9eb0193f23e6794be7ab3df12c40b
---
 lib/neutron             | 4 ++++
 lib/neutron_plugins/ml2 | 3 +++
 2 files changed, 7 insertions(+)

diff --git a/lib/neutron b/lib/neutron
index 1b78493919..6e787f213a 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -229,6 +229,10 @@ function configure_neutron_new {
         else
             mech_drivers+=",linuxbridge"
         fi
+        if [[ "$mech_drivers" == *"linuxbridge"* ]]; then
+            iniset $NEUTRON_CONF experimental linuxbridge True
+        fi
+
         iniset $NEUTRON_CORE_PLUGIN_CONF ml2 mechanism_drivers $mech_drivers
         iniset $NEUTRON_CORE_PLUGIN_CONF ml2 overlay_ip_version $TUNNEL_IP_VERSION
 
diff --git a/lib/neutron_plugins/ml2 b/lib/neutron_plugins/ml2
index 7343606aac..fa61f1ea30 100644
--- a/lib/neutron_plugins/ml2
+++ b/lib/neutron_plugins/ml2
@@ -125,6 +125,9 @@ function neutron_plugin_configure_service {
     fi
 
     populate_ml2_config /$Q_PLUGIN_CONF_FILE ml2 mechanism_drivers=$Q_ML2_PLUGIN_MECHANISM_DRIVERS
+    if [[ "$Q_ML2_PLUGIN_MECHANISM_DRIVERS" == *"linuxbridge"* ]]; then
+        iniset $NEUTRON_CONF experimental linuxbridge True
+    fi
     populate_ml2_config /$Q_PLUGIN_CONF_FILE ml2 overlay_ip_version=$TUNNEL_IP_VERSION
 
     if [[ -n "$Q_ML2_PLUGIN_TYPE_DRIVERS" ]]; then

From 1a21ccbdf8eb66582a06f181f8c9af1f43bd52f5 Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Fri, 8 Jul 2022 21:57:45 +0200
Subject: [PATCH 2067/2409] Add NEUTRON_ENDPOINT_SERVICE_NAME variable to set
 service name

This option can be used to set name of the service used in the
networking service endpoint URL.

Depends-On: https://review.opendev.org/c/openstack/grenade/+/850306

Change-Id: I9e9a06eadc1604214c627bd3bda010cc00aaf83d
---
 lib/neutron        | 18 +++++++++++++++---
 lib/neutron-legacy | 31 ++++++++++++++++++++++++++++---
 2 files changed, 43 insertions(+), 6 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 6e787f213a..a885fbf16e 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -114,6 +114,12 @@ NEUTRON_TENANT_VLAN_RANGE=${NEUTRON_TENANT_VLAN_RANGE:-${TENANT_VLAN_RANGE:-100:
 # Physical network for VLAN network usage.
 NEUTRON_PHYSICAL_NETWORK=${NEUTRON_PHYSICAL_NETWORK:-}
 
+# The name of the service in the endpoint URL
+NEUTRON_ENDPOINT_SERVICE_NAME=${NEUTRON_ENDPOINT_SERVICE_NAME-"networking"}
+if [[ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" && -z "$NEUTRON_ENDPOINT_SERVICE_NAME" ]]; then
+    NEUTRON_ENDPOINT_SERVICE_NAME="networking"
+fi
+
 
 # Additional neutron api config files
 declare -a -g _NEUTRON_SERVER_EXTRA_CONF_FILES_ABS
@@ -397,10 +403,13 @@ function create_neutron_accounts_new {
     local neutron_url
 
     if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
-        neutron_url=$NEUTRON_SERVICE_PROTOCOL://$NEUTRON_SERVICE_HOST/networking/
+        neutron_url=$NEUTRON_SERVICE_PROTOCOL://$NEUTRON_SERVICE_HOST/
     else
         neutron_url=$NEUTRON_SERVICE_PROTOCOL://$NEUTRON_SERVICE_HOST:$NEUTRON_SERVICE_PORT/
     fi
+    if [ ! -z "$NEUTRON_ENDPOINT_SERVICE_NAME" ]; then
+        neutron_url=$neutron_url$NEUTRON_ENDPOINT_SERVICE_NAME
+    fi
 
 
     if [[ "$ENABLED_SERVICES" =~ "neutron-api" ]]; then
@@ -481,19 +490,22 @@ function start_neutron_api {
 
     if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
         run_process neutron-api "$(which uwsgi) --procname-prefix neutron-api --ini $NEUTRON_UWSGI_CONF"
-        neutron_url=$service_protocol://$NEUTRON_SERVICE_HOST/networking/
+        neutron_url=$service_protocol://$NEUTRON_SERVICE_HOST/
         enable_service neutron-rpc-server
         run_process neutron-rpc-server "$NEUTRON_BIN_DIR/neutron-rpc-server $opts"
     else
         # Start the Neutron service
         # TODO(sc68cal) Stop hard coding this
         run_process neutron-api "$NEUTRON_BIN_DIR/neutron-server $opts"
-        neutron_url=$service_protocol://$NEUTRON_SERVICE_HOST:$service_port
+        neutron_url=$service_protocol://$NEUTRON_SERVICE_HOST:$service_port/
         # Start proxy if enabled
         if is_service_enabled tls-proxy; then
             start_tls_proxy neutron '*' $NEUTRON_SERVICE_PORT $NEUTRON_SERVICE_HOST $NEUTRON_SERVICE_PORT_INT
         fi
     fi
+    if [ ! -z "$NEUTRON_ENDPOINT_SERVICE_NAME" ]; then
+        neutron_url=$neutron_url$NEUTRON_ENDPOINT_SERVICE_NAME
+    fi
 
     if ! wait_for_service $SERVICE_TIMEOUT $neutron_url; then
         die $LINENO "neutron-api did not start"
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 5e6af0f249..1a6995511b 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -145,6 +145,12 @@ SKIP_STOP_OVN=${SKIP_STOP_OVN:-False}
 # /etc/neutron is assumed by many of devstack plugins.  Do not change.
 _Q_PLUGIN_EXTRA_CONF_PATH=/etc/neutron
 
+# The name of the service in the endpoint URL
+NEUTRON_ENDPOINT_SERVICE_NAME=${NEUTRON_ENDPOINT_SERVICE_NAME-"networking"}
+if [[ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" && -z "$NEUTRON_ENDPOINT_SERVICE_NAME" ]]; then
+    NEUTRON_ENDPOINT_SERVICE_NAME="networking"
+fi
+
 # List of config file names in addition to the main plugin config file
 # To add additional plugin config files, use ``neutron_server_config_add``
 # utility function.  For example:
@@ -431,10 +437,13 @@ function create_nova_conf_neutron {
 function create_mutnauq_accounts {
     local neutron_url
     if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
-        neutron_url=$Q_PROTOCOL://$SERVICE_HOST/networking/
+        neutron_url=$Q_PROTOCOL://$SERVICE_HOST/
     else
         neutron_url=$Q_PROTOCOL://$SERVICE_HOST:$Q_PORT/
     fi
+    if [ ! -z "$NEUTRON_ENDPOINT_SERVICE_NAME" ]; then
+        neutron_url=$neutron_url$NEUTRON_ENDPOINT_SERVICE_NAME
+    fi
 
     if [[ "$ENABLED_SERVICES" =~ "q-svc" ]]; then
 
@@ -538,17 +547,20 @@ function start_neutron_service_and_check {
     if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
         enable_service neutron-api
         run_process neutron-api "$(which uwsgi) --procname-prefix neutron-api --ini $NEUTRON_UWSGI_CONF"
-        neutron_url=$Q_PROTOCOL://$Q_HOST/networking/
+        neutron_url=$Q_PROTOCOL://$Q_HOST/
         enable_service neutron-rpc-server
         run_process neutron-rpc-server "$NEUTRON_BIN_DIR/neutron-rpc-server $cfg_file_options"
     else
         run_process q-svc "$NEUTRON_BIN_DIR/neutron-server $cfg_file_options"
-        neutron_url=$service_protocol://$Q_HOST:$service_port
+        neutron_url=$service_protocol://$Q_HOST:$service_port/
         # Start proxy if enabled
         if is_service_enabled tls-proxy; then
             start_tls_proxy neutron '*' $Q_PORT $Q_HOST $Q_PORT_INT
         fi
     fi
+    if [ ! -z "$NEUTRON_ENDPOINT_SERVICE_NAME" ]; then
+        neutron_url=$neutron_url$NEUTRON_ENDPOINT_SERVICE_NAME
+    fi
     echo "Waiting for Neutron to start..."
 
     local testcmd="wget ${ssl_ca} --no-proxy -q -O- $neutron_url"
@@ -905,12 +917,25 @@ function _configure_neutron_plugin_agent {
     neutron_plugin_configure_plugin_agent
 }
 
+function _replace_api_paste_composite {
+    local sep
+    sep=$(echo -ne "\x01")
+    # Replace it
+    $sudo sed -i -e "s/\/\: neutronversions_composite/\/"${NEUTRON_ENDPOINT_SERVICE_NAME}"\/\: neutronversions_composite/" "$Q_API_PASTE_FILE"
+    $sudo sed -i -e "s/\/healthcheck\: healthcheck/\/"${NEUTRON_ENDPOINT_SERVICE_NAME}"\/healthcheck\: healthcheck/" "$Q_API_PASTE_FILE"
+    $sudo sed -i -e "s/\/v2.0\: neutronapi_v2_0/\/"${NEUTRON_ENDPOINT_SERVICE_NAME}"\/v2.0\: neutronapi_v2_0/" "$Q_API_PASTE_FILE"
+}
+
 # _configure_neutron_service() - Set config files for neutron service
 # It is called when q-svc is enabled.
 function _configure_neutron_service {
     Q_API_PASTE_FILE=$NEUTRON_CONF_DIR/api-paste.ini
     cp $NEUTRON_DIR/etc/api-paste.ini $Q_API_PASTE_FILE
 
+    if [[ -n "$NEUTRON_ENDPOINT_SERVICE_NAME" ]]; then
+        _replace_api_paste_composite
+    fi
+
     # Update either configuration file with plugin
     iniset $NEUTRON_CONF DEFAULT core_plugin $Q_PLUGIN_CLASS
 

From facf15626e5776bc64a2f072bdccadbda714a8f2 Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <tkajinam@redhat.com>
Date: Wed, 13 Jul 2022 15:58:42 +0900
Subject: [PATCH 2068/2409] Neutron: Do not set removed allow_overlapping_ips

The parameter has been removed from neutron by [1].

[1] fde91e8059a9a23fb7ece6e3463984329c7ea581

Change-Id: I3b838ea741d19729d6fcf03c0478b1b4d8ec1213
---
 lib/neutron        | 1 -
 lib/neutron-legacy | 1 -
 2 files changed, 2 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 6e787f213a..d4815cd5f8 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -213,7 +213,6 @@ function configure_neutron_new {
         iniset $NEUTRON_CONF DEFAULT core_plugin $NEUTRON_CORE_PLUGIN
 
         iniset $NEUTRON_CONF DEFAULT policy_file $policy_file
-        iniset $NEUTRON_CONF DEFAULT allow_overlapping_ips True
         iniset $NEUTRON_CONF DEFAULT router_distributed $NEUTRON_DISTRIBUTED_ROUTING
 
         iniset $NEUTRON_CONF DEFAULT auth_strategy $NEUTRON_AUTH_STRATEGY
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 5e6af0f249..d21be51dcd 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -916,7 +916,6 @@ function _configure_neutron_service {
 
     iniset $NEUTRON_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
     iniset $NEUTRON_CONF oslo_policy policy_file $Q_POLICY_FILE
-    iniset $NEUTRON_CONF DEFAULT allow_overlapping_ips $Q_ALLOW_OVERLAPPING_IP
 
     iniset $NEUTRON_CONF DEFAULT auth_strategy $Q_AUTH_STRATEGY
     configure_keystone_authtoken_middleware $NEUTRON_CONF $Q_ADMIN_USERNAME

From b70d98fe75621d7c71197f82b9fde630d2fa50b2 Mon Sep 17 00:00:00 2001
From: Martin Kopec <mkopec@redhat.com>
Date: Wed, 20 Jul 2022 14:05:15 +0000
Subject: [PATCH 2069/2409] Fix doc for adding sudo privileges to stack user

Writing NOPASSWD directive into /etc/sudoers was throwing
permission denied errors. This commit writes the directive
to the /etc/sudoers.d/stack file instead.

Closes-Bug: #1981541
Change-Id: If30f01aa5f3a33dda79ff4a6892116511c8e1542
---
 doc/source/guides/multinode-lab.rst  | 2 +-
 doc/source/guides/single-machine.rst | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
index 79a76dedb1..658422b0af 100644
--- a/doc/source/guides/multinode-lab.rst
+++ b/doc/source/guides/multinode-lab.rst
@@ -89,7 +89,7 @@ password:
 
 ::
 
-    echo "stack ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers
+    echo "stack ALL=(ALL) NOPASSWD: ALL" | sudo tee /etc/sudoers.d/stack
 
 From here on use the ``stack`` user. **Logout** and **login** as the
 ``stack`` user.
diff --git a/doc/source/guides/single-machine.rst b/doc/source/guides/single-machine.rst
index 03d93743f7..0529e30f08 100644
--- a/doc/source/guides/single-machine.rst
+++ b/doc/source/guides/single-machine.rst
@@ -63,7 +63,7 @@ to have sudo privileges:
 .. code-block:: console
 
     $ apt-get install sudo -y || yum install -y sudo
-    $ echo "stack ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers
+    $ echo "stack ALL=(ALL) NOPASSWD: ALL" | sudo tee /etc/sudoers.d/stack
 
 .. note:: On some systems you may need to use ``sudo visudo``.
 

From 79bef068b69c7e97a63aaa3e7fae13bcbc649ebd Mon Sep 17 00:00:00 2001
From: Hoai-Thu Vuong <thuvh87@gmail.com>
Date: Tue, 2 Aug 2022 14:41:59 +0700
Subject: [PATCH 2070/2409] remove duplicate line of REGION_NAME

Change-Id: I42b270749f057c5751e809aba282112b990b9f38
---
 stackrc | 2 --
 1 file changed, 2 deletions(-)

diff --git a/stackrc b/stackrc
index f0039f0043..b3130e5f7f 100644
--- a/stackrc
+++ b/stackrc
@@ -903,8 +903,6 @@ fi
 # Default is dependent on TUNNEL_IP_VERSION above.
 TUNNEL_ENDPOINT_IP=${TUNNEL_ENDPOINT_IP:-${DEF_TUNNEL_ENDPOINT_IP}}
 
-REGION_NAME=${REGION_NAME:-RegionOne}
-
 # Configure services to use syslog instead of writing to individual log files
 SYSLOG=$(trueorfalse False SYSLOG)
 SYSLOG_HOST=${SYSLOG_HOST:-$HOST_IP}

From d266c87b1d3ecae1b40589832efc9bf7cf3e524c Mon Sep 17 00:00:00 2001
From: Nobuhiro MIKI <nmiki@yahoo-corp.jp>
Date: Mon, 8 Aug 2022 16:45:31 +0900
Subject: [PATCH 2071/2409] iniset: fix handling of values containg ampersand

Attempting to set a value containing the ampersand
character (&) by iniset would corrupt the value.
So, add an escaping process.

Signed-off-by: Nobuhiro MIKI <nmiki@yahoo-corp.jp>
Closes-Bug: #1983816
Change-Id: Ie2633bacd2d761d110e6cb12f95382325c329415
---
 inc/ini-config           |  3 +++
 tests/test_ini_config.sh | 12 +++++++++++-
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/inc/ini-config b/inc/ini-config
index 79936823d2..f65e42d3a5 100644
--- a/inc/ini-config
+++ b/inc/ini-config
@@ -189,6 +189,9 @@ function iniset {
     local option=$3
     local value=$4
 
+    # Escape the ampersand character (&)
+    value=$(echo $value | sed -e 's/&/\\&/g')
+
     if [[ -z $section || -z $option ]]; then
         $xtrace
         return
diff --git a/tests/test_ini_config.sh b/tests/test_ini_config.sh
index 6ed1647f34..6367cde441 100755
--- a/tests/test_ini_config.sh
+++ b/tests/test_ini_config.sh
@@ -44,6 +44,9 @@ empty =
 multi = foo1
 multi = foo2
 
+[fff]
+ampersand =
+
 [key_with_spaces]
 rgw special key = something
 
@@ -85,7 +88,7 @@ fi
 
 # test iniget_sections
 VAL=$(iniget_sections "${TEST_INI}")
-assert_equal "$VAL" "default aaa bbb ccc ddd eee key_with_spaces \
+assert_equal "$VAL" "default aaa bbb ccc ddd eee fff key_with_spaces \
 del_separate_options del_same_option del_missing_option \
 del_missing_option_multi del_no_options"
 
@@ -124,6 +127,13 @@ iniset ${SUDO_ARG} ${TEST_INI} bbb handlers "33,44"
 VAL=$(iniget ${TEST_INI} bbb handlers)
 assert_equal "$VAL" "33,44" "inset at EOF"
 
+# Test with ampersand in values
+for i in `seq 3`; do
+    iniset ${TEST_INI} fff ampersand '&y'
+done
+VAL=$(iniget ${TEST_INI} fff ampersand)
+assert_equal "$VAL" "&y" "iniset ampersands in option"
+
 # test empty option
 if ini_has_option ${SUDO_ARG} ${TEST_INI} ddd empty; then
     passed "ini_has_option: ddd.empty present"

From 90e5479f382af1a5482f0acccdc36c6d18321634 Mon Sep 17 00:00:00 2001
From: Martin Kopec <mkopec@redhat.com>
Date: Tue, 16 Aug 2022 17:29:16 +0200
Subject: [PATCH 2072/2409] Remove forgotten LinuxMint occurrence

Right now we don't officialy support LinuxMint as our
documentation says [1], it seems LinuxMint is a relict
and got forgotten over time.

This patch removes LinuxMint from the code in order not to
confuse users.

[1] https://docs.openstack.org/devstack/latest/
Closes-Bug: #1983427

Change-Id: Ie1ced25f89389494b28a7b2e9bb1c4273e002dd5
---
 doc/source/plugins.rst | 2 +-
 functions-common       | 7 +++----
 2 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/doc/source/plugins.rst b/doc/source/plugins.rst
index 7d70d74dd0..62dd15bfb1 100644
--- a/doc/source/plugins.rst
+++ b/doc/source/plugins.rst
@@ -238,7 +238,7 @@ package dependencies, packages may be listed at the following
 locations in the top-level of the plugin repository:
 
 - ``./devstack/files/debs/$plugin_name`` - Packages to install when running
-  on Ubuntu, Debian or Linux Mint.
+  on Ubuntu or Debian.
 
 - ``./devstack/files/rpms/$plugin_name`` - Packages to install when running
   on Red Hat, Fedora, or CentOS.
diff --git a/functions-common b/functions-common
index e5b07514e5..92a6678de0 100644
--- a/functions-common
+++ b/functions-common
@@ -426,7 +426,7 @@ function GetOSVersion {
         os_VENDOR=$(lsb_release -i -s)
     fi
 
-    if [[ $os_VENDOR =~ (Debian|Ubuntu|LinuxMint) ]]; then
+    if [[ $os_VENDOR =~ (Debian|Ubuntu) ]]; then
         os_PACKAGE="deb"
     else
         os_PACKAGE="rpm"
@@ -444,9 +444,8 @@ declare -g DISTRO
 
 function GetDistro {
     GetOSVersion
-    if [[ "$os_VENDOR" =~ (Ubuntu) || "$os_VENDOR" =~ (Debian) || \
-            "$os_VENDOR" =~ (LinuxMint) ]]; then
-        # 'Everyone' refers to Ubuntu / Debian / Mint releases by
+    if [[ "$os_VENDOR" =~ (Ubuntu) || "$os_VENDOR" =~ (Debian) ]]; then
+        # 'Everyone' refers to Ubuntu / Debian releases by
         # the code name adjective
         DISTRO=$os_CODENAME
     elif [[ "$os_VENDOR" =~ (Fedora) ]]; then

From fdfc14451afc4d7f78edadb1b26a3a845eace715 Mon Sep 17 00:00:00 2001
From: Eliad Cohen <elicohen@redhat.com>
Date: Tue, 16 Aug 2022 13:00:45 -0400
Subject: [PATCH 2073/2409] Clean up use of get_field

Openstack client can return the id field for create/show commands using
`-f value -c id`. Cleaned up the use of grep 'id' with get_field

Change-Id: I2f4338f30c11e5139cda51c92524782b86f0aacc
---
 functions                       |  4 ++--
 lib/neutron_plugins/services/l3 | 20 ++++++++++----------
 2 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/functions b/functions
index ccca5cda51..7ada0feba7 100644
--- a/functions
+++ b/functions
@@ -414,10 +414,10 @@ function upload_image {
         # kernel for use when uploading the root filesystem.
         local kernel_id="" ramdisk_id="";
         if [ -n "$kernel" ]; then
-            kernel_id=$(openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name-kernel" $(_image_properties_to_arg $img_property) --public --container-format aki --disk-format aki < "$kernel" | grep ' id ' | get_field 2)
+            kernel_id=$(openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name-kernel" $(_image_properties_to_arg $img_property) --public --container-format aki --disk-format aki < "$kernel" -f value -c id)
         fi
         if [ -n "$ramdisk" ]; then
-            ramdisk_id=$(openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name-ramdisk" $(_image_properties_to_arg $img_property) --public --container-format ari --disk-format ari < "$ramdisk" | grep ' id ' | get_field 2)
+            ramdisk_id=$(openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name-ramdisk" $(_image_properties_to_arg $img_property) --public --container-format ari --disk-format ari < "$ramdisk" -f value -c id)
         fi
         _upload_image "${image_name%.img}" ami ami "$image" ${kernel_id:+ kernel_id=$kernel_id} ${ramdisk_id:+ ramdisk_id=$ramdisk_id} $img_property
     fi
diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index fbd4692bba..3dffc33d37 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -166,14 +166,14 @@ function create_neutron_initial_network {
     if is_provider_network; then
         die_if_not_set $LINENO PHYSICAL_NETWORK "You must specify the PHYSICAL_NETWORK"
         die_if_not_set $LINENO PROVIDER_NETWORK_TYPE "You must specify the PROVIDER_NETWORK_TYPE"
-        NET_ID=$(openstack --os-cloud devstack-admin-demo --os-region "$REGION_NAME" network create $PHYSICAL_NETWORK --provider-network-type $PROVIDER_NETWORK_TYPE --provider-physical-network "$PHYSICAL_NETWORK" ${SEGMENTATION_ID:+--provider-segment $SEGMENTATION_ID} --share | grep ' id ' | get_field 2)
+        NET_ID=$(openstack --os-cloud devstack-admin-demo --os-region "$REGION_NAME" network create $PHYSICAL_NETWORK --provider-network-type $PROVIDER_NETWORK_TYPE --provider-physical-network "$PHYSICAL_NETWORK" ${SEGMENTATION_ID:+--provider-segment $SEGMENTATION_ID} --share -f value -c id)
         die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PHYSICAL_NETWORK"
 
         if [[ "$IP_VERSION" =~ 4.* ]]; then
             if [ -z $SUBNETPOOL_V4_ID ]; then
                 fixed_range_v4=$FIXED_RANGE
             fi
-            SUBNET_ID=$(openstack --os-cloud devstack --os-region "$REGION_NAME" subnet create --ip-version 4 ${ALLOCATION_POOL:+--allocation-pool $ALLOCATION_POOL} $PROVIDER_SUBNET_NAME --gateway $NETWORK_GATEWAY ${SUBNETPOOL_V4_ID:+--subnet-pool $SUBNETPOOL_V4_ID} --network $NET_ID ${fixed_range_v4:+--subnet-range $fixed_range_v4} | grep ' id ' | get_field 2)
+            SUBNET_ID=$(openstack --os-cloud devstack --os-region "$REGION_NAME" subnet create --ip-version 4 ${ALLOCATION_POOL:+--allocation-pool $ALLOCATION_POOL} $PROVIDER_SUBNET_NAME --gateway $NETWORK_GATEWAY ${SUBNETPOOL_V4_ID:+--subnet-pool $SUBNETPOOL_V4_ID} --network $NET_ID ${fixed_range_v4:+--subnet-range $fixed_range_v4} -f value -c id)
             die_if_not_set $LINENO SUBNET_ID "Failure creating SUBNET_ID for $PROVIDER_SUBNET_NAME"
         fi
 
@@ -183,7 +183,7 @@ function create_neutron_initial_network {
             if [ -z $SUBNETPOOL_V6_ID ]; then
                 fixed_range_v6=$IPV6_PROVIDER_FIXED_RANGE
             fi
-            IPV6_SUBNET_ID=$(openstack --os-cloud devstack --os-region "$REGION_NAME" subnet create --ip-version 6 --gateway $IPV6_PROVIDER_NETWORK_GATEWAY $IPV6_PROVIDER_SUBNET_NAME ${SUBNETPOOL_V6_ID:+--subnet-pool $SUBNETPOOL_V6_ID} --network $NET_ID ${fixed_range_v6:+--subnet-range $fixed_range_v6} | grep ' id ' | get_field 2)
+            IPV6_SUBNET_ID=$(openstack --os-cloud devstack --os-region "$REGION_NAME" subnet create --ip-version 6 --gateway $IPV6_PROVIDER_NETWORK_GATEWAY $IPV6_PROVIDER_SUBNET_NAME ${SUBNETPOOL_V6_ID:+--subnet-pool $SUBNETPOOL_V6_ID} --network $NET_ID ${fixed_range_v6:+--subnet-range $fixed_range_v6} -f value -c id)
             die_if_not_set $LINENO IPV6_SUBNET_ID "Failure creating IPV6_SUBNET_ID for $IPV6_PROVIDER_SUBNET_NAME"
         fi
 
@@ -193,7 +193,7 @@ function create_neutron_initial_network {
             sudo ip link set $PUBLIC_INTERFACE up
         fi
     else
-        NET_ID=$(openstack --os-cloud devstack --os-region "$REGION_NAME" network create "$PRIVATE_NETWORK_NAME" | grep ' id ' | get_field 2)
+        NET_ID=$(openstack --os-cloud devstack --os-region "$REGION_NAME" network create "$PRIVATE_NETWORK_NAME" -f value -c id)
         die_if_not_set $LINENO NET_ID "Failure creating NET_ID for $PRIVATE_NETWORK_NAME"
 
         if [[ "$IP_VERSION" =~ 4.* ]]; then
@@ -211,11 +211,11 @@ function create_neutron_initial_network {
         # Create a router, and add the private subnet as one of its interfaces
         if [[ "$Q_L3_ROUTER_PER_TENANT" == "True" ]]; then
             # create a tenant-owned router.
-            ROUTER_ID=$(openstack --os-cloud devstack --os-region "$REGION_NAME" router create $Q_ROUTER_NAME | grep ' id ' | get_field 2)
+            ROUTER_ID=$(openstack --os-cloud devstack --os-region "$REGION_NAME" router create $Q_ROUTER_NAME -f value -c id)
             die_if_not_set $LINENO ROUTER_ID "Failure creating router $Q_ROUTER_NAME"
         else
             # Plugin only supports creating a single router, which should be admin owned.
-            ROUTER_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" router create $Q_ROUTER_NAME | grep ' id ' | get_field 2)
+            ROUTER_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" router create $Q_ROUTER_NAME -f value -c id)
             die_if_not_set $LINENO ROUTER_ID "Failure creating router $Q_ROUTER_NAME"
         fi
 
@@ -225,9 +225,9 @@ function create_neutron_initial_network {
         fi
         # Create an external network, and a subnet. Configure the external network as router gw
         if [ "$Q_USE_PROVIDERNET_FOR_PUBLIC" = "True" ]; then
-            EXT_NET_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" network create "$PUBLIC_NETWORK_NAME" $EXTERNAL_NETWORK_FLAGS --provider-network-type ${PUBLIC_PROVIDERNET_TYPE:-flat} ${PUBLIC_PROVIDERNET_SEGMENTATION_ID:+--provider-segment $PUBLIC_PROVIDERNET_SEGMENTATION_ID} --provider-physical-network ${PUBLIC_PHYSICAL_NETWORK} | grep ' id ' | get_field 2)
+            EXT_NET_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" network create "$PUBLIC_NETWORK_NAME" $EXTERNAL_NETWORK_FLAGS --provider-network-type ${PUBLIC_PROVIDERNET_TYPE:-flat} ${PUBLIC_PROVIDERNET_SEGMENTATION_ID:+--provider-segment $PUBLIC_PROVIDERNET_SEGMENTATION_ID} --provider-physical-network ${PUBLIC_PHYSICAL_NETWORK} -f value -c id)
         else
-            EXT_NET_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" network create "$PUBLIC_NETWORK_NAME" $EXTERNAL_NETWORK_FLAGS | grep ' id ' | get_field 2)
+            EXT_NET_ID=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" network create "$PUBLIC_NETWORK_NAME" $EXTERNAL_NETWORK_FLAGS -f value -c id)
         fi
         die_if_not_set $LINENO EXT_NET_ID "Failure creating EXT_NET_ID for $PUBLIC_NETWORK_NAME"
 
@@ -257,7 +257,7 @@ function _neutron_create_private_subnet_v4 {
     subnet_params+="${fixed_range_v4:+--subnet-range $fixed_range_v4} "
     subnet_params+="--network $NET_ID $PRIVATE_SUBNET_NAME"
     local subnet_id
-    subnet_id=$(openstack --os-cloud devstack-admin-demo --os-region "$REGION_NAME" subnet create $subnet_params | grep ' id ' | get_field 2)
+    subnet_id=$(openstack --os-cloud devstack-admin-demo --os-region "$REGION_NAME" subnet create $subnet_params -f value -c id)
     die_if_not_set $LINENO subnet_id "Failure creating private IPv4 subnet"
     echo $subnet_id
 }
@@ -278,7 +278,7 @@ function _neutron_create_private_subnet_v6 {
     subnet_params+="${fixed_range_v6:+--subnet-range $fixed_range_v6} "
     subnet_params+="$ipv6_modes --network $NET_ID $IPV6_PRIVATE_SUBNET_NAME "
     local ipv6_subnet_id
-    ipv6_subnet_id=$(openstack --os-cloud devstack-admin-demo --os-region "$REGION_NAME" subnet create $subnet_params | grep ' id ' | get_field 2)
+    ipv6_subnet_id=$(openstack --os-cloud devstack-admin-demo --os-region "$REGION_NAME" subnet create $subnet_params -f value -c id)
     die_if_not_set $LINENO ipv6_subnet_id "Failure creating private IPv6 subnet"
     echo $ipv6_subnet_id
 }

From ca5f9195610a94ca0a567700a94f9417ca877336 Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Sun, 21 Aug 2022 10:52:41 +0200
Subject: [PATCH 2074/2409] Clean up n-net remnants

In I90316208d1af42c1659d3bee386f95e38aaf2c56 support for nova-network
was removed, but some bits remained, fix this up.

Change-Id: Iba7e1785fd0bdf0a6e94e5e03438fc7634621e49
---
 files/debs/nova      |  2 --
 files/rpms-suse/nova |  2 --
 files/rpms/nova      |  2 --
 lib/nova             | 14 --------------
 stack.sh             | 10 +++-------
 5 files changed, 3 insertions(+), 27 deletions(-)

diff --git a/files/debs/nova b/files/debs/nova
index 0194f00f2c..5c00ad72d9 100644
--- a/files/debs/nova
+++ b/files/debs/nova
@@ -1,7 +1,5 @@
 conntrack
 curl
-dnsmasq-base
-dnsmasq-utils # for dhcp_release
 ebtables
 genisoimage # required for config_drive
 iptables
diff --git a/files/rpms-suse/nova b/files/rpms-suse/nova
index 1cc2f62ea5..082b9aca22 100644
--- a/files/rpms-suse/nova
+++ b/files/rpms-suse/nova
@@ -1,8 +1,6 @@
 cdrkit-cdrtools-compat # dist:sle12
 conntrack-tools
 curl
-dnsmasq
-dnsmasq-utils # dist:opensuse-12.3,opensuse-13.1
 ebtables
 iptables
 iputils
diff --git a/files/rpms/nova b/files/rpms/nova
index 9522e5729d..f2824ee2c4 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -1,7 +1,5 @@
 conntrack-tools
 curl
-dnsmasq # for q-dhcp
-dnsmasq-utils # for dhcp_release
 ebtables
 genisoimage # not:rhel9 required for config_drive
 iptables
diff --git a/lib/nova b/lib/nova
index da3a10edd0..6de1d3382f 100644
--- a/lib/nova
+++ b/lib/nova
@@ -107,20 +107,6 @@ NOVA_FILTERS="AvailabilityZoneFilter,ComputeFilter,ComputeCapabilitiesFilter,Ima
 
 QEMU_CONF=/etc/libvirt/qemu.conf
 
-# Set default defaults here as some hypervisor drivers override these
-PUBLIC_INTERFACE_DEFAULT=br100
-# Set ``GUEST_INTERFACE_DEFAULT`` to some interface on the box so that
-# the default isn't completely crazy. This will match ``eth*``, ``em*``, or
-# the new ``p*`` interfaces, then basically picks the first
-# alphabetically. It's probably wrong, however it's less wrong than
-# always using ``eth0`` which doesn't exist on new Linux distros at all.
-GUEST_INTERFACE_DEFAULT=$(ip link \
-    | grep 'state UP' \
-    | awk '{print $2}' \
-    | sed 's/://' \
-    | grep ^[ep] \
-    | head -1)
-
 # ``NOVA_VNC_ENABLED`` can be used to forcibly enable VNC configuration.
 # In multi-node setups allows compute hosts to not run ``n-novnc``.
 NOVA_VNC_ENABLED=$(trueorfalse False NOVA_VNC_ENABLED)
diff --git a/stack.sh b/stack.sh
index df283bbe50..c99189e6dc 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1152,7 +1152,8 @@ fi
 # ----
 
 if is_service_enabled q-dhcp; then
-    # Delete traces of nova networks from prior runs
+    # TODO(frickler): These are remnants from n-net, check which parts are really
+    # still needed for Neutron.
     # Do not kill any dnsmasq instance spawned by NetworkManager
     netman_pid=$(pidof NetworkManager || true)
     if [ -z "$netman_pid" ]; then
@@ -1212,12 +1213,7 @@ if is_service_enabled nova; then
     echo_summary "Configuring Nova"
     init_nova
 
-    # Additional Nova configuration that is dependent on other services
-    # TODO(stephenfin): Is it possible for neutron to *not* be enabled now? If
-    # not, remove the if here
-    if is_service_enabled neutron; then
-        async_runfunc configure_neutron_nova
-    fi
+    async_runfunc configure_neutron_nova
 fi
 
 

From ccd116d36447ba1c5efad58ee360eb7f276eb7c6 Mon Sep 17 00:00:00 2001
From: Alan Bishop <abishop@redhat.com>
Date: Wed, 10 Aug 2022 10:30:19 -0700
Subject: [PATCH 2075/2409] Cinder: add creator role when barbican is enabled

When barbican is enabled, add the "creator" role to cinder's service
user so that cinder can create secrets. Cinder needs to create
barbican secrets when migrating encryption keys from the legacy
ConfKeyManager to barbican. Cinder also needs to create barbican
secrets in order to support transferring encrypted volumes.

Implements: bp/transfer-encrypted-volume
Depends-On: I216f78e8a300ab3f79bbcbb38110adf2bbec2196
Change-Id: Ia3f414c4b9b0829f60841a6dd63c97a893fdde4d
---
 lib/cinder | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index ca2c084aff..7dd7539eca 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -388,16 +388,24 @@ function configure_cinder {
 
 # create_cinder_accounts() - Set up common required cinder accounts
 
-# Tenant               User       Roles
+# Project              User       Roles
 # ------------------------------------------------------------------
-# service              cinder     admin        # if enabled
+# SERVICE_PROJECT_NAME cinder     service
+# SERVICE_PROJECT_NAME cinder     creator (if Barbican is enabled)
 
 # Migrated from keystone_data.sh
 function create_cinder_accounts {
     # Cinder
     if [[ "$ENABLED_SERVICES" =~ "c-api" ]]; then
 
-        create_service_user "cinder"
+        local extra_role=""
+
+        # cinder needs the "creator" role in order to interact with barbican
+        if is_service_enabled barbican; then
+            extra_role=$(get_or_create_role "creator")
+        fi
+
+        create_service_user "cinder" $extra_role
 
         # block-storage is the official service type
         get_or_create_service "cinder" "block-storage" "Cinder Volume Service"

From e7d2623dca483497ec51c75dfe1b6162801eead0 Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Sun, 21 Aug 2022 12:54:57 +0200
Subject: [PATCH 2076/2409] Clean up neutron cleanup code

neutron-ns-metadata-proxy was dropped from Neutron 5 years ago, no need
to keep trying to kill it.

Change-Id: I20b6d68dd8dde36057a2418bca0841bdea377b07
---
 lib/neutron        | 1 -
 lib/neutron-legacy | 1 -
 2 files changed, 2 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 1f54e0e043..b3e3d72e8c 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -567,7 +567,6 @@ function stop_neutron_new {
     fi
 
     if is_service_enabled neutron-metadata-agent; then
-        sudo pkill -9 -f neutron-ns-metadata-proxy || :
         stop_process neutron-metadata-agent
     fi
 }
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 9229b47988..baf67f209e 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -628,7 +628,6 @@ function stop_mutnauq_other {
     fi
 
     if is_service_enabled q-meta; then
-        sudo pkill -9 -f neutron-ns-metadata-proxy || :
         stop_process q-meta
     fi
 

From b9b6d6b862ce69a875c152ad30da8f4717c75272 Mon Sep 17 00:00:00 2001
From: June Yi <june.yi@samsung.com>
Date: Sat, 2 Jul 2022 13:07:43 +0900
Subject: [PATCH 2077/2409] Respect constraints on tempest venv consistently

In case of online mode, there is a procedure to recreate tempest venv.
For consistency of tempest venv during the entire stack.sh process,
add logic to consider the TEMPEST_VENV_UPPER_CONSTRAINTS option here.

Closes-bug: #1980483
Signed-off-by: June Yi <june.yi@samsung.com>
Change-Id: I0cea282152fd363af8671cab1b5f733ebe2bd4df
---
 lib/tempest | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 206b37b5bf..87a2244784 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -695,13 +695,13 @@ function configure_tempest {
     local tmp_cfg_file
     tmp_cfg_file=$(mktemp)
     cd $TEMPEST_DIR
-    if [[ "$OFFLINE" != "True" ]]; then
-        tox -revenv-tempest --notest
-    fi
 
     local tmp_u_c_m
     tmp_u_c_m=$(mktemp -t tempest_u_c_m.XXXXXXXXXX)
     set_tempest_venv_constraints $tmp_u_c_m
+    if [[ "$OFFLINE" != "True" ]]; then
+        tox -revenv-tempest --notest
+    fi
     tox -evenv-tempest -- pip install -c $tmp_u_c_m -r requirements.txt
     rm -f $tmp_u_c_m
 

From 3de92db6634a6d1455b7211ec869aed35508c58c Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Fri, 26 Aug 2022 12:58:29 +0200
Subject: [PATCH 2078/2409] Fix installation of OVS/OVN from sources

This patch changes user who runs ovsdb-server and ovn-nortd services
to root.
It also adds installation of the libssl dev package before compilation
of the openvswitch if TLS service is enabled.

Co-Authored-By: Fernando Royo <froyo@redhat.com>

Closes-Bug: #1987832
Change-Id: I83fc9250ae5b7c1686938a0dd25d66b40fc6c6aa
---
 lib/neutron_plugins/ovn_agent  | 4 ++--
 lib/neutron_plugins/ovs_source | 6 ++++++
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index 341b84d959..8eb2993b94 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -616,7 +616,7 @@ function _start_ovs {
                 dbcmd+=" --remote=db:hardware_vtep,Global,managers $OVS_DATADIR/vtep.db"
             fi
             dbcmd+=" $OVS_DATADIR/conf.db"
-            _run_process ovsdb-server "$dbcmd"
+            _run_process ovsdb-server "$dbcmd" "" "$STACK_GROUP" "root"
 
             # Note: ovn-controller will create and configure br-int once it is started.
             # So, no need to create it now because nothing depends on that bridge here.
@@ -704,7 +704,7 @@ function start_ovn {
             local cmd="/bin/bash $SCRIPTDIR/ovn-ctl --no-monitor start_northd"
             local stop_cmd="/bin/bash $SCRIPTDIR/ovn-ctl stop_northd"
 
-            _run_process ovn-northd "$cmd" "$stop_cmd"
+            _run_process ovn-northd "$cmd" "$stop_cmd" "$STACK_GROUP" "root"
         else
             _start_process "$OVN_NORTHD_SERVICE"
         fi
diff --git a/lib/neutron_plugins/ovs_source b/lib/neutron_plugins/ovs_source
index 9ae5555afb..164d574c42 100644
--- a/lib/neutron_plugins/ovs_source
+++ b/lib/neutron_plugins/ovs_source
@@ -87,9 +87,15 @@ function prepare_for_ovs_compilation {
 
         install_package kernel-devel-$KERNEL_VERSION
         install_package kernel-headers-$KERNEL_VERSION
+        if is_service_enabled tls-proxy; then
+            install_package openssl-devel
+        fi
 
     elif is_ubuntu ; then
         install_package linux-headers-$KERNEL_VERSION
+        if is_service_enabled tls-proxy; then
+            install_package libssl-dev
+        fi
     fi
 }
 

From 97061c9a1f2a2989e0bacb5f7cc5910c75aaeb44 Mon Sep 17 00:00:00 2001
From: Gorka Eguileor <geguileo@redhat.com>
Date: Thu, 14 Oct 2021 09:55:56 +0200
Subject: [PATCH 2079/2409] Add LVM NVMe support

This patch adds NVMe LVM support to the existing iSCSI LVM configuration
support.

We deprecate the CINDER_ISCSI_HELPER configuration option since we are
no longer limited to iSCSI, and replace it with the CINDER_TARGET_HELPER
option.

The patch also adds another 3 target configuration options:

- CINDER_TARGET_PROTOCOL
- CINDER_TARGET_PREFIX
- CINDER_TARGET_PORT

These options will have different defaults based on the selected target
helper.  For tgtadm and lioadm they'll be iSCSI,
iqn.2010-10.org.openstack:, and 3260 respectively, and for nvmet they'll
be nvmet_rdma, nvme-subsystem-1, and 4420.

Besides nvmet_rdma the CINDER_TARGET_PROTOCOL option can also be set to
nvmet_tcp, and nvmet_fc.

For the RDMA transport protocol devstack will be using Soft-RoCE and
creating a device on top of the network interface.

LVM NVMe-TCP support is added in the dependency mentioned in the footer
and LVM NVMe-FC will be added in later patches (need os-brick and cinder
patches) but the code here should still be valid.

Change-Id: I6578cdc27489b34916cdeb72ba3fdf06ea9d4ad8
---
 doc/source/configuration.rst  | 29 +++++++++++
 lib/cinder                    | 95 +++++++++++++++++++++++++++++------
 lib/cinder_backends/fake_gate |  2 +-
 lib/cinder_backends/lvm       |  5 +-
 lib/lvm                       | 10 ++--
 lib/nova                      | 40 ++++++++++++---
 6 files changed, 154 insertions(+), 27 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 757b4001d9..0d8773fb6a 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -669,6 +669,35 @@ adjusted by setting ``CINDER_QUOTA_VOLUMES``, ``CINDER_QUOTA_BACKUPS``,
 or ``CINDER_QUOTA_SNAPSHOTS`` to the desired value.  (The default for
 each is 10.)
 
+DevStack's Cinder LVM configuration module currently supports both iSCSI and
+NVMe connections, and we can choose which one to use with options
+``CINDER_TARGET_HELPER``, ``CINDER_TARGET_PROTOCOL``, ``CINDER_TARGET_PREFIX``,
+and ``CINDER_TARGET_PORT``.
+
+Defaults use iSCSI with the LIO target manager::
+
+  CINDER_TARGET_HELPER="lioadm"
+  CINDER_TARGET_PROTOCOL="iscsi"
+  CINDER_TARGET_PREFIX="iqn.2010-10.org.openstack:"
+  CINDER_TARGET_PORT=3260
+
+Additionally there are 3 supported transport protocols for NVMe,
+``nvmet_rdma``, ``nvmet_tcp``, and ``nvmet_fc``, and when the ``nvmet`` target
+is selected the protocol, prefix, and port defaults will change to more
+sensible defaults for NVMe::
+
+  CINDER_TARGET_HELPER="nvmet"
+  CINDER_TARGET_PROTOCOL="nvmet_rdma"
+  CINDER_TARGET_PREFIX="nvme-subsystem-1"
+  CINDER_TARGET_PORT=4420
+
+When selecting the RDMA transport protocol DevStack will create on Cinder nodes
+a Software RoCE device on top of the ``HOST_IP_IFACE`` and if it is not defined
+then on top of the interface with IP address ``HOST_IP`` or ``HOST_IPV6``.
+
+This Soft-RoCE device will always be created on the Nova compute side since we
+cannot tell beforehand whether there will be an RDMA connection or not.
+
 
 Keystone
 ~~~~~~~~
diff --git a/lib/cinder b/lib/cinder
index ca2c084aff..bc704c1e5d 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -43,6 +43,13 @@ GITDIR["python-cinderclient"]=$DEST/python-cinderclient
 GITDIR["python-brick-cinderclient-ext"]=$DEST/python-brick-cinderclient-ext
 CINDER_DIR=$DEST/cinder
 
+if [[ $SERVICE_IP_VERSION == 6 ]]; then
+    CINDER_MY_IP="$HOST_IPV6"
+else
+    CINDER_MY_IP="$HOST_IP"
+fi
+
+
 # Cinder virtual environment
 if [[ ${USE_VENV} = True ]]; then
     PROJECT_VENV["cinder"]=${CINDER_DIR}.venv
@@ -88,13 +95,32 @@ CINDER_ENABLED_BACKENDS=${CINDER_ENABLED_BACKENDS:-lvm:lvmdriver-1}
 CINDER_VOLUME_CLEAR=${CINDER_VOLUME_CLEAR:-${CINDER_VOLUME_CLEAR_DEFAULT:-zero}}
 CINDER_VOLUME_CLEAR=$(echo ${CINDER_VOLUME_CLEAR} | tr '[:upper:]' '[:lower:]')
 
-# Default to lioadm
-CINDER_ISCSI_HELPER=${CINDER_ISCSI_HELPER:-lioadm}
+
+if [[ -n "$CINDER_ISCSI_HELPER" ]]; then
+    if [[ -z "$CINDER_TARGET_HELPER" ]]; then
+        deprecated 'Using CINDER_ISCSI_HELPER is deprecated, use CINDER_TARGET_HELPER instead'
+        CINDER_TARGET_HELPER="$CINDER_ISCSI_HELPER"
+    else
+        deprecated 'Deprecated CINDER_ISCSI_HELPER is set, but is being overwritten by CINDER_TARGET_HELPER'
+    fi
+fi
+CINDER_TARGET_HELPER=${CINDER_TARGET_HELPER:-lioadm}
+
+if [[ $CINDER_TARGET_HELPER == 'nvmet' ]]; then
+    CINDER_TARGET_PROTOCOL=${CINDER_TARGET_PROTOCOL:-'nvmet_rdma'}
+    CINDER_TARGET_PREFIX=${CINDER_TARGET_PREFIX:-'nvme-subsystem-1'}
+    CINDER_TARGET_PORT=${CINDER_TARGET_PORT:-4420}
+else
+    CINDER_TARGET_PROTOCOL=${CINDER_TARGET_PROTOCOL:-'iscsi'}
+    CINDER_TARGET_PREFIX=${CINDER_TARGET_PREFIX:-'iqn.2010-10.org.openstack:'}
+    CINDER_TARGET_PORT=${CINDER_TARGET_PORT:-3260}
+fi
+
 
 # EL and SUSE should only use lioadm
 if is_fedora || is_suse; then
-    if [[ ${CINDER_ISCSI_HELPER} != "lioadm" ]]; then
-        die "lioadm is the only valid Cinder target_helper config on this platform"
+    if [[ ${CINDER_TARGET_HELPER} != "lioadm" && ${CINDER_TARGET_HELPER} != 'nvmet' ]]; then
+        die "lioadm and nvmet are the only valid Cinder target_helper config on this platform"
     fi
 fi
 
@@ -187,7 +213,7 @@ function _cinder_cleanup_apache_wsgi {
 function cleanup_cinder {
     # ensure the volume group is cleared up because fails might
     # leave dead volumes in the group
-    if [ "$CINDER_ISCSI_HELPER" = "tgtadm" ]; then
+    if [ "$CINDER_TARGET_HELPER" = "tgtadm" ]; then
         local targets
         targets=$(sudo tgtadm --op show --mode target)
         if [ $? -ne 0 ]; then
@@ -215,8 +241,14 @@ function cleanup_cinder {
         else
             stop_service tgtd
         fi
-    else
+    elif [ "$CINDER_TARGET_HELPER" = "lioadm" ]; then
         sudo cinder-rtstool get-targets | sudo xargs -rn 1 cinder-rtstool delete
+    elif [ "$CINDER_TARGET_HELPER" = "nvmet" ]; then
+        # If we don't disconnect everything vgremove will block
+        sudo nvme disconnect-all
+        sudo nvmetcli clear
+    else
+        die $LINENO "Unknown value \"$CINDER_TARGET_HELPER\" for CINDER_TARGET_HELPER"
     fi
 
     if is_service_enabled c-vol && [[ -n "$CINDER_ENABLED_BACKENDS" ]]; then
@@ -267,7 +299,7 @@ function configure_cinder {
 
     iniset $CINDER_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
 
-    iniset $CINDER_CONF DEFAULT target_helper "$CINDER_ISCSI_HELPER"
+    iniset $CINDER_CONF DEFAULT target_helper "$CINDER_TARGET_HELPER"
     iniset $CINDER_CONF database connection `database_connection_url cinder`
     iniset $CINDER_CONF DEFAULT api_paste_config $CINDER_API_PASTE_INI
     iniset $CINDER_CONF DEFAULT rootwrap_config "$CINDER_CONF_DIR/rootwrap.conf"
@@ -275,11 +307,7 @@ function configure_cinder {
     iniset $CINDER_CONF DEFAULT osapi_volume_listen $CINDER_SERVICE_LISTEN_ADDRESS
     iniset $CINDER_CONF DEFAULT state_path $CINDER_STATE_PATH
     iniset $CINDER_CONF oslo_concurrency lock_path $CINDER_STATE_PATH
-    if [[ $SERVICE_IP_VERSION == 6 ]]; then
-        iniset $CINDER_CONF DEFAULT my_ip "$HOST_IPV6"
-    else
-        iniset $CINDER_CONF DEFAULT my_ip "$HOST_IP"
-    fi
+    iniset $CINDER_CONF DEFAULT my_ip "$CINDER_MY_IP"
     iniset $CINDER_CONF key_manager backend cinder.keymgr.conf_key_mgr.ConfKeyManager
     iniset $CINDER_CONF key_manager fixed_key $(openssl rand -hex 16)
     if [[ -n "$CINDER_ALLOWED_DIRECT_URL_SCHEMES" ]]; then
@@ -465,9 +493,9 @@ function init_cinder {
 function install_cinder {
     git_clone $CINDER_REPO $CINDER_DIR $CINDER_BRANCH
     setup_develop $CINDER_DIR
-    if [[ "$CINDER_ISCSI_HELPER" == "tgtadm" ]]; then
+    if [[ "$CINDER_TARGET_HELPER" == "tgtadm" ]]; then
         install_package tgt
-    elif [[ "$CINDER_ISCSI_HELPER" == "lioadm" ]]; then
+    elif [[ "$CINDER_TARGET_HELPER" == "lioadm" ]]; then
         if is_ubuntu; then
             # TODO(frickler): Workaround for https://launchpad.net/bugs/1819819
             sudo mkdir -p /etc/target
@@ -476,6 +504,43 @@ function install_cinder {
         else
             install_package targetcli
         fi
+    elif [[ "$CINDER_TARGET_HELPER" == "nvmet" ]]; then
+        install_package nvme-cli
+
+        # TODO: Remove manual installation of the dependency when the
+        # requirement is added to nvmetcli:
+        # http://lists.infradead.org/pipermail/linux-nvme/2022-July/033576.html
+        if is_ubuntu; then
+            install_package python3-configshell-fb
+        else
+            install_package python3-configshell
+        fi
+        # Install from source because Ubuntu doesn't have the package and some packaged versions didn't work on Python 3
+        pip_install git+git://git.infradead.org/users/hch/nvmetcli.git
+
+        sudo modprobe nvmet
+        sudo modprobe nvme-fabrics
+
+        if [[ $CINDER_TARGET_PROTOCOL == 'nvmet_rdma' ]]; then
+            install_package rdma-core
+            sudo modprobe nvme-rdma
+
+            # Create the Soft-RoCE device over the networking interface
+            local iface=${HOST_IP_IFACE:-`ip -br -$SERVICE_IP_VERSION a | grep $CINDER_MY_IP | awk '{print $1}'`}
+            if [[ -z "$iface" ]]; then
+                die $LINENO "Cannot find interface to bind Soft-RoCE"
+            fi
+
+            if ! sudo rdma link | grep $iface ; then
+                sudo rdma link add rxe_$iface type rxe netdev $iface
+            fi
+
+        elif [[ $CINDER_TARGET_PROTOCOL == 'nvmet_tcp' ]]; then
+            sudo modprobe nvme-tcp
+
+        else  # 'nvmet_fc'
+            sudo modprobe nvme-fc
+        fi
     fi
 }
 
@@ -512,7 +577,7 @@ function start_cinder {
         service_port=$CINDER_SERVICE_PORT_INT
         service_protocol="http"
     fi
-    if [ "$CINDER_ISCSI_HELPER" = "tgtadm" ]; then
+    if [ "$CINDER_TARGET_HELPER" = "tgtadm" ]; then
         if is_service_enabled c-vol; then
             # Delete any old stack.conf
             sudo rm -f /etc/tgt/conf.d/stack.conf
diff --git a/lib/cinder_backends/fake_gate b/lib/cinder_backends/fake_gate
index 3ffd9a6785..3b9f1d1164 100644
--- a/lib/cinder_backends/fake_gate
+++ b/lib/cinder_backends/fake_gate
@@ -50,7 +50,7 @@ function configure_cinder_backend_lvm {
     iniset $CINDER_CONF $be_name volume_backend_name $be_name
     iniset $CINDER_CONF $be_name volume_driver "cinder.tests.fake_driver.FakeGateDriver"
     iniset $CINDER_CONF $be_name volume_group $VOLUME_GROUP_NAME-$be_name
-    iniset $CINDER_CONF $be_name target_helper "$CINDER_ISCSI_HELPER"
+    iniset $CINDER_CONF $be_name target_helper "$CINDER_TARGET_HELPER"
     iniset $CINDER_CONF $be_name lvm_type "$CINDER_LVM_TYPE"
 
     if [[ "$CINDER_VOLUME_CLEAR" == "non" ]]; then
diff --git a/lib/cinder_backends/lvm b/lib/cinder_backends/lvm
index e03ef14c55..42865119da 100644
--- a/lib/cinder_backends/lvm
+++ b/lib/cinder_backends/lvm
@@ -50,7 +50,10 @@ function configure_cinder_backend_lvm {
     iniset $CINDER_CONF $be_name volume_backend_name $be_name
     iniset $CINDER_CONF $be_name volume_driver "cinder.volume.drivers.lvm.LVMVolumeDriver"
     iniset $CINDER_CONF $be_name volume_group $VOLUME_GROUP_NAME-$be_name
-    iniset $CINDER_CONF $be_name target_helper "$CINDER_ISCSI_HELPER"
+    iniset $CINDER_CONF $be_name target_helper "$CINDER_TARGET_HELPER"
+    iniset $CINDER_CONF $be_name target_protocol "$CINDER_TARGET_PROTOCOL"
+    iniset $CINDER_CONF $be_name target_port "$CINDER_TARGET_PORT"
+    iniset $CINDER_CONF $be_name target_prefix "$CINDER_TARGET_PREFIX"
     iniset $CINDER_CONF $be_name lvm_type "$CINDER_LVM_TYPE"
     iniset $CINDER_CONF $be_name volume_clear "$CINDER_VOLUME_CLEAR"
 }
diff --git a/lib/lvm b/lib/lvm
index d3f6bf1792..57ffb967c3 100644
--- a/lib/lvm
+++ b/lib/lvm
@@ -130,7 +130,7 @@ function init_lvm_volume_group {
     local size=$2
 
     # Start the tgtd service on Fedora and SUSE if tgtadm is used
-    if  is_fedora || is_suse  && [[ "$CINDER_ISCSI_HELPER" = "tgtadm" ]]; then
+    if  is_fedora || is_suse  && [[ "$CINDER_TARGET_HELPER" = "tgtadm" ]]; then
         start_service tgtd
     fi
 
@@ -138,10 +138,14 @@ function init_lvm_volume_group {
     _create_lvm_volume_group $vg $size
 
     # Remove iscsi targets
-    if [ "$CINDER_ISCSI_HELPER" = "lioadm" ]; then
+    if [ "$CINDER_TARGET_HELPER" = "lioadm" ]; then
         sudo cinder-rtstool get-targets | sudo xargs -rn 1 cinder-rtstool delete
-    else
+    elif [ "$CINDER_TARGET_HELPER" = "tgtadm" ]; then
         sudo tgtadm --op show --mode target | awk '/Target/ {print $3}' | sudo xargs -r -n1 tgt-admin --delete
+    elif [ "$CINDER_TARGET_HELPER" = "nvmet" ]; then
+        # If we don't disconnect everything vgremove will block
+        sudo nvme disconnect-all
+        sudo nvmetcli clear
     fi
     _clean_lvm_volume_group $vg
 }
diff --git a/lib/nova b/lib/nova
index da3a10edd0..7902c5fdb9 100644
--- a/lib/nova
+++ b/lib/nova
@@ -97,6 +97,12 @@ NOVA_SERVICE_LISTEN_ADDRESS=${NOVA_SERVICE_LISTEN_ADDRESS:-$(ipv6_unquote $SERVI
 METADATA_SERVICE_PORT=${METADATA_SERVICE_PORT:-8775}
 NOVA_ENABLE_CACHE=${NOVA_ENABLE_CACHE:-True}
 
+if [[ $SERVICE_IP_VERSION == 6 ]]; then
+    NOVA_MY_IP="$HOST_IPV6"
+else
+    NOVA_MY_IP="$HOST_IP"
+fi
+
 # Option to enable/disable config drive
 # NOTE: Set ``FORCE_CONFIG_DRIVE="False"`` to turn OFF config drive
 FORCE_CONFIG_DRIVE=${FORCE_CONFIG_DRIVE:-"False"}
@@ -219,6 +225,9 @@ function cleanup_nova {
         done
         sudo iscsiadm --mode node --op delete || true
 
+        # Disconnect all nvmeof connections
+        sudo nvme disconnect-all || true
+
         # Clean out the instances directory.
         sudo rm -rf $NOVA_INSTANCES_PATH/*
     fi
@@ -306,6 +315,7 @@ function configure_nova {
             fi
         fi
 
+        # Due to cinder bug #1966513 we ALWAYS need an initiator name for LVM
         # Ensure each compute host uses a unique iSCSI initiator
         echo InitiatorName=$(iscsi-iname) | sudo tee /etc/iscsi/initiatorname.iscsi
 
@@ -326,8 +336,28 @@ EOF
         # not work under FIPS.
         iniset -sudo /etc/iscsi/iscsid.conf DEFAULT "node.session.auth.chap_algs" "SHA3-256,SHA256"
 
-        # ensure that iscsid is started, even when disabled by default
-        restart_service iscsid
+        if [[ $CINDER_TARGET_HELPER != 'nvmet' ]]; then
+            # ensure that iscsid is started, even when disabled by default
+            restart_service iscsid
+
+        # For NVMe-oF we need different packages that many not be present
+        else
+            install_package nvme-cli
+            sudo modprobe nvme-fabrics
+
+            # Ensure NVMe is ready and create the Soft-RoCE device over the networking interface
+            if [[ $CINDER_TARGET_PROTOCOL == 'nvmet_rdma' ]]; then
+                sudo modprobe nvme-rdma
+                iface=${HOST_IP_IFACE:-`ip -br -$SERVICE_IP_VERSION a | grep $NOVA_MY_IP | awk '{print $1}'`}
+                if ! sudo rdma link | grep $iface ; then
+                    sudo rdma link add rxe_$iface type rxe netdev $iface
+                fi
+            elif [[ $CINDER_TARGET_PROTOCOL == 'nvmet_tcp' ]]; then
+                sudo modprobe nvme-tcp
+            else  # 'nvmet_fc'
+                sudo modprobe nvme-fc
+            fi
+        fi
     fi
 
     # Rebuild the config file from scratch
@@ -418,11 +448,7 @@ function create_nova_conf {
     iniset $NOVA_CONF filter_scheduler enabled_filters "$NOVA_FILTERS"
     iniset $NOVA_CONF scheduler workers "$API_WORKERS"
     iniset $NOVA_CONF neutron default_floating_pool "$PUBLIC_NETWORK_NAME"
-    if [[ $SERVICE_IP_VERSION == 6 ]]; then
-        iniset $NOVA_CONF DEFAULT my_ip "$HOST_IPV6"
-    else
-        iniset $NOVA_CONF DEFAULT my_ip "$HOST_IP"
-    fi
+    iniset $NOVA_CONF DEFAULT my_ip "$NOVA_MY_IP"
     iniset $NOVA_CONF DEFAULT instance_name_template "${INSTANCE_NAME_PREFIX}%08x"
     iniset $NOVA_CONF DEFAULT osapi_compute_listen "$NOVA_SERVICE_LISTEN_ADDRESS"
     iniset $NOVA_CONF DEFAULT metadata_listen "$NOVA_SERVICE_LISTEN_ADDRESS"

From f49b435e98cd9d119179d98829241954b8d73669 Mon Sep 17 00:00:00 2001
From: Masayuki Igawa <masayuki@igawa.io>
Date: Thu, 22 Sep 2022 11:22:21 +0900
Subject: [PATCH 2080/2409] [Doc] Fix Glance image size limit command

This commit fixes the configuration document which mentions how to
change Glance default image size quota at runtime because we don't have
`openstack registered limit update` command but
`openstack registered limit set` command[1].

[1] https://docs.openstack.org/python-openstackclient/latest/cli/command-objects/registered-limit.html#registered-limit-set

Change-Id: I399685ed1f864f8f1ce7295ed6f83336cfccbd81
---
 doc/source/configuration.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 757b4001d9..d0f2b02419 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -719,7 +719,7 @@ or at runtime via:
 
 ::
 
-    openstack --os-cloud devstack-system-admin registered limit update \
+    openstack --os-cloud devstack-system-admin registered limit set \
       --service glance --default-limit 5000 --region RegionOne image_size_total
 
 .. _arch-configuration:

From 1516997afe888ebc3cd06653a4f29a05bba7b346 Mon Sep 17 00:00:00 2001
From: Tom Weininger <tweining@redhat.com>
Date: Wed, 14 Sep 2022 17:16:00 +0200
Subject: [PATCH 2081/2409] Update user guide for Octavia

Change-Id: I8e3134c3b2d591f7ab72b8040e1b931e967e11be
---
 doc/source/guides.rst                         |   8 +-
 doc/source/guides/devstack-with-lbaas-v2.rst  | 145 ------------------
 .../guides/devstack-with-nested-kvm.rst       |   2 +
 doc/source/guides/devstack-with-octavia.rst   | 144 +++++++++++++++++
 4 files changed, 150 insertions(+), 149 deletions(-)
 delete mode 100644 doc/source/guides/devstack-with-lbaas-v2.rst
 create mode 100644 doc/source/guides/devstack-with-octavia.rst

diff --git a/doc/source/guides.rst b/doc/source/guides.rst
index e7ec629962..e7b46b6e55 100644
--- a/doc/source/guides.rst
+++ b/doc/source/guides.rst
@@ -20,7 +20,7 @@ Walk through various setups used by stackers
    guides/neutron
    guides/devstack-with-nested-kvm
    guides/nova
-   guides/devstack-with-lbaas-v2
+   guides/devstack-with-octavia
    guides/devstack-with-ldap
 
 All-In-One Single VM
@@ -69,10 +69,10 @@ Nova and devstack
 
 Guide to working with nova features :doc:`Nova and devstack <guides/nova>`.
 
-Configure Load-Balancer Version 2
------------------------------------
+Configure Octavia
+-----------------
 
-Guide on :doc:`Configure Load-Balancer Version 2 <guides/devstack-with-lbaas-v2>`.
+Guide on :doc:`Configure Octavia <guides/devstack-with-octavia>`.
 
 Deploying DevStack with LDAP
 ----------------------------
diff --git a/doc/source/guides/devstack-with-lbaas-v2.rst b/doc/source/guides/devstack-with-lbaas-v2.rst
deleted file mode 100644
index 5d96ca7d74..0000000000
--- a/doc/source/guides/devstack-with-lbaas-v2.rst
+++ /dev/null
@@ -1,145 +0,0 @@
-Devstack with Octavia Load Balancing
-====================================
-
-Starting with the OpenStack Pike release, Octavia is now a standalone service
-providing load balancing services for OpenStack.
-
-This guide will show you how to create a devstack with `Octavia API`_ enabled.
-
-.. _Octavia API: https://docs.openstack.org/api-ref/load-balancer/v2/index.html
-
-Phase 1: Create DevStack + 2 nova instances
---------------------------------------------
-
-First, set up a vm of your choice with at least 8 GB RAM and 16 GB disk space,
-make sure it is updated. Install git and any other developer tools you find
-useful.
-
-Install devstack
-
-::
-
-    git clone https://opendev.org/openstack/devstack
-    cd devstack/tools
-    sudo ./create-stack-user.sh
-    cd ../..
-    sudo mv devstack /opt/stack
-    sudo chown -R stack.stack /opt/stack/devstack
-
-This will clone the current devstack code locally, then setup the "stack"
-account that devstack services will run under. Finally, it will move devstack
-into its default location in /opt/stack/devstack.
-
-Edit your ``/opt/stack/devstack/local.conf`` to look like
-
-::
-
-    [[local|localrc]]
-    enable_plugin octavia https://opendev.org/openstack/octavia
-    # If you are enabling horizon, include the octavia dashboard
-    # enable_plugin octavia-dashboard https://opendev.org/openstack/octavia-dashboard.git
-    # If you are enabling barbican for TLS offload in Octavia, include it here.
-    # enable_plugin barbican https://opendev.org/openstack/barbican
-
-    # ===== BEGIN localrc =====
-    DATABASE_PASSWORD=password
-    ADMIN_PASSWORD=password
-    SERVICE_PASSWORD=password
-    SERVICE_TOKEN=password
-    RABBIT_PASSWORD=password
-    # Enable Logging
-    LOGFILE=$DEST/logs/stack.sh.log
-    VERBOSE=True
-    LOG_COLOR=True
-    # Pre-requisite
-    ENABLED_SERVICES=rabbit,mysql,key
-    # Horizon - enable for the OpenStack web GUI
-    # ENABLED_SERVICES+=,horizon
-    # Nova
-    ENABLED_SERVICES+=,n-api,n-crt,n-cpu,n-cond,n-sch,n-api-meta,n-sproxy
-    ENABLED_SERVICES+=,placement-api,placement-client
-    # Glance
-    ENABLED_SERVICES+=,g-api
-    # Neutron
-    ENABLED_SERVICES+=,q-svc,q-agt,q-dhcp,q-l3,q-meta,neutron
-    ENABLED_SERVICES+=,octavia,o-cw,o-hk,o-hm,o-api
-    # Cinder
-    ENABLED_SERVICES+=,c-api,c-vol,c-sch
-    # Tempest
-    ENABLED_SERVICES+=,tempest
-    # Barbican - Optionally used for TLS offload in Octavia
-    # ENABLED_SERVICES+=,barbican
-    # ===== END localrc =====
-
-Run stack.sh and do some sanity checks
-
-::
-
-    sudo su - stack
-    cd /opt/stack/devstack
-    ./stack.sh
-    . ./openrc
-
-    openstack network list  # should show public and private networks
-
-Create two nova instances that we can use as test http servers:
-
-::
-
-    #create nova instances on private network
-    openstack server create --image $(openstack image list | awk '/ cirros-.*-x86_64-.* / {print $2}') --flavor 1 --nic net-id=$(openstack network list | awk '/ private / {print $2}') node1
-    openstack server create --image $(openstack image list | awk '/ cirros-.*-x86_64-.* / {print $2}') --flavor 1 --nic net-id=$(openstack network list | awk '/ private / {print $2}') node2
-    openstack server list # should show the nova instances just created
-
-    #add secgroup rules to allow ssh etc..
-    openstack security group rule create default --protocol icmp
-    openstack security group rule create default --protocol tcp --dst-port 22:22
-    openstack security group rule create default --protocol tcp --dst-port 80:80
-
-Set up a simple web server on each of these instances. ssh into each instance (username 'cirros', password 'cubswin:)' or 'gocubsgo') and run
-
-::
-
-    MYIP=$(ifconfig eth0|grep 'inet addr'|awk -F: '{print $2}'| awk '{print $1}')
-    while true; do echo -e "HTTP/1.0 200 OK\r\n\r\nWelcome to $MYIP" | sudo nc -l -p 80 ; done&
-
-Phase 2: Create your load balancer
-----------------------------------
-
-Make sure you have the 'openstack loadbalancer' commands:
-
-::
-
-    pip install python-octaviaclient
-
-Create your load balancer:
-
-::
-
-    openstack loadbalancer create --name lb1 --vip-subnet-id private-subnet
-    openstack loadbalancer show lb1  # Wait for the provisioning_status to be ACTIVE.
-    openstack loadbalancer listener create --protocol HTTP --protocol-port 80 --name listener1 lb1
-    openstack loadbalancer show lb1  # Wait for the provisioning_status to be ACTIVE.
-    openstack loadbalancer pool create --lb-algorithm ROUND_ROBIN --listener listener1 --protocol HTTP --name pool1
-    openstack loadbalancer show lb1  # Wait for the provisioning_status to be ACTIVE.
-    openstack loadbalancer healthmonitor create --delay 5 --timeout 2 --max-retries 1 --type HTTP pool1
-    openstack loadbalancer show lb1  # Wait for the provisioning_status to be ACTIVE.
-    openstack loadbalancer member create --subnet-id private-subnet --address <web server 1 address> --protocol-port 80 pool1
-    openstack loadbalancer show lb1  # Wait for the provisioning_status to be ACTIVE.
-    openstack loadbalancer member create --subnet-id private-subnet --address <web server 2 address> --protocol-port 80 pool1
-
-Please note: The <web server # address> fields are the IP addresses of the nova
-servers created in Phase 1.
-Also note, using the API directly you can do all of the above commands in one
-API call.
-
-Phase 3: Test your load balancer
---------------------------------
-
-::
-
-    openstack loadbalancer show lb1 # Note the vip_address
-    curl http://<vip_address>
-    curl http://<vip_address>
-
-This should show the "Welcome to <IP>" message from each member server.
diff --git a/doc/source/guides/devstack-with-nested-kvm.rst b/doc/source/guides/devstack-with-nested-kvm.rst
index 3732f06fd8..ba483e9ec9 100644
--- a/doc/source/guides/devstack-with-nested-kvm.rst
+++ b/doc/source/guides/devstack-with-nested-kvm.rst
@@ -1,3 +1,5 @@
+.. _kvm_nested_virt:
+
 =======================================================
 Configure DevStack with KVM-based Nested Virtualization
 =======================================================
diff --git a/doc/source/guides/devstack-with-octavia.rst b/doc/source/guides/devstack-with-octavia.rst
new file mode 100644
index 0000000000..55939f0f12
--- /dev/null
+++ b/doc/source/guides/devstack-with-octavia.rst
@@ -0,0 +1,144 @@
+Devstack with Octavia Load Balancing
+====================================
+
+Starting with the OpenStack Pike release, Octavia is now a standalone service
+providing load balancing services for OpenStack.
+
+This guide will show you how to create a devstack with `Octavia API`_ enabled.
+
+.. _Octavia API: https://docs.openstack.org/api-ref/load-balancer/v2/index.html
+
+Phase 1: Create DevStack + 2 nova instances
+--------------------------------------------
+
+First, set up a VM of your choice with at least 8 GB RAM and 16 GB disk space,
+make sure it is updated. Install git and any other developer tools you find
+useful.
+
+Install devstack::
+
+    git clone https://opendev.org/openstack/devstack
+    cd devstack/tools
+    sudo ./create-stack-user.sh
+    cd ../..
+    sudo mv devstack /opt/stack
+    sudo chown -R stack.stack /opt/stack/devstack
+
+This will clone the current devstack code locally, then setup the "stack"
+account that devstack services will run under. Finally, it will move devstack
+into its default location in /opt/stack/devstack.
+
+Edit your ``/opt/stack/devstack/local.conf`` to look like::
+
+    [[local|localrc]]
+    # ===== BEGIN localrc =====
+    DATABASE_PASSWORD=password
+    ADMIN_PASSWORD=password
+    SERVICE_PASSWORD=password
+    SERVICE_TOKEN=password
+    RABBIT_PASSWORD=password
+    GIT_BASE=https://opendev.org
+    # Optional settings:
+    # OCTAVIA_AMP_BASE_OS=centos
+    # OCTAVIA_AMP_DISTRIBUTION_RELEASE_ID=9-stream
+    # OCTAVIA_AMP_IMAGE_SIZE=3
+    # OCTAVIA_LB_TOPOLOGY=ACTIVE_STANDBY
+    # OCTAVIA_ENABLE_AMPHORAV2_JOBBOARD=True
+    # LIBS_FROM_GIT+=octavia-lib,
+    # Enable Logging
+    LOGFILE=$DEST/logs/stack.sh.log
+    VERBOSE=True
+    LOG_COLOR=True
+    enable_service rabbit
+    enable_plugin neutron $GIT_BASE/openstack/neutron
+    # Octavia supports using QoS policies on the VIP port:
+    enable_service q-qos
+    enable_service placement-api placement-client
+    # Octavia services
+    enable_plugin octavia $GIT_BASE/openstack/octavia master
+    enable_plugin octavia-dashboard $GIT_BASE/openstack/octavia-dashboard
+    enable_plugin ovn-octavia-provider $GIT_BASE/openstack/ovn-octavia-provider
+    enable_plugin octavia-tempest-plugin $GIT_BASE/openstack/octavia-tempest-plugin
+    enable_service octavia o-api o-cw o-hm o-hk o-da
+    # If you are enabling barbican for TLS offload in Octavia, include it here.
+    # enable_plugin barbican $GIT_BASE/openstack/barbican
+    # enable_service barbican
+    # Cinder (optional)
+    disable_service c-api c-vol c-sch
+    # Tempest
+    enable_service tempest
+    # ===== END localrc =====
+
+.. note::
+    For best performance it is highly recommended to use KVM
+    virtualization instead of QEMU.
+    Also make sure nested virtualization is enabled as documented in
+    :ref:`the respective guide <kvm_nested_virt>`.
+    By adding ``LIBVIRT_CPU_MODE="host-passthrough"`` to your
+    ``local.conf`` you enable the guest VMs to make use of all features your
+    host's CPU provides.
+
+Run stack.sh and do some sanity checks::
+
+    sudo su - stack
+    cd /opt/stack/devstack
+    ./stack.sh
+    . ./openrc
+
+    openstack network list  # should show public and private networks
+
+Create two nova instances that we can use as test http servers::
+
+    # create nova instances on private network
+    openstack server create --image $(openstack image list | awk '/ cirros-.*-x86_64-.* / {print $2}') --flavor 1 --nic net-id=$(openstack network list | awk '/ private / {print $2}') node1
+    openstack server create --image $(openstack image list | awk '/ cirros-.*-x86_64-.* / {print $2}') --flavor 1 --nic net-id=$(openstack network list | awk '/ private / {print $2}') node2
+    openstack server list # should show the nova instances just created
+
+    # add secgroup rules to allow ssh etc..
+    openstack security group rule create default --protocol icmp
+    openstack security group rule create default --protocol tcp --dst-port 22:22
+    openstack security group rule create default --protocol tcp --dst-port 80:80
+
+Set up a simple web server on each of these instances. One possibility is to use
+the `Golang test server`_ that is used by the Octavia project for CI testing
+as well.
+Copy the binary to your instances and start it as shown below
+(username 'cirros', password 'gocubsgo')::
+
+    INST_IP=<instance IP>
+    scp -O test_server.bin cirros@${INST_IP}:
+    ssh -f cirros@${INST_IP} ./test_server.bin -id ${INST_IP}
+
+When started this way the test server will respond to HTTP requests with
+its own IP.
+
+Phase 2: Create your load balancer
+----------------------------------
+
+Create your load balancer::
+
+    openstack loadbalancer create --wait --name lb1 --vip-subnet-id private-subnet
+    openstack loadbalancer listener create --wait --protocol HTTP --protocol-port 80 --name listener1 lb1
+    openstack loadbalancer pool create --wait --lb-algorithm ROUND_ROBIN --listener listener1 --protocol HTTP --name pool1
+    openstack loadbalancer healthmonitor create --wait --delay 5 --timeout 2 --max-retries 1 --type HTTP pool1
+    openstack loadbalancer member create --wait --subnet-id private-subnet --address <web server 1 address> --protocol-port 80 pool1
+    openstack loadbalancer member create --wait --subnet-id private-subnet --address <web server 2 address> --protocol-port 80 pool1
+
+Please note: The <web server # address> fields are the IP addresses of the nova
+servers created in Phase 1.
+Also note, using the API directly you can do all of the above commands in one
+API call.
+
+Phase 3: Test your load balancer
+--------------------------------
+
+::
+
+    openstack loadbalancer show lb1 # Note the vip_address
+    curl http://<vip_address>
+    curl http://<vip_address>
+
+This should show the "Welcome to <IP>" message from each member server.
+
+
+.. _Golang test server: https://opendev.org/openstack/octavia-tempest-plugin/src/branch/master/octavia_tempest_plugin/contrib/test_server

From 0d5c8d6643d5f532ec4b0e9f4a588d604db51dba Mon Sep 17 00:00:00 2001
From: Martin Kopec <mkopec@redhat.com>
Date: Wed, 28 Sep 2022 02:13:58 +0200
Subject: [PATCH 2082/2409] Update DEVSTACK_SERIES to 2023.1

stable/zed branch has been created now and
current master is for 2023.1 Antelope.

Change-Id: I6186d01b1bf8548425500cc9feee6ab494a3db03
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index b3130e5f7f..a05d1e5553 100644
--- a/stackrc
+++ b/stackrc
@@ -243,7 +243,7 @@ REQUIREMENTS_DIR=${REQUIREMENTS_DIR:-$DEST/requirements}
 # Setting the variable to 'ALL' will activate the download for all
 # libraries.
 
-DEVSTACK_SERIES="zed"
+DEVSTACK_SERIES="2023.1"
 
 ##############
 #

From 9ece457b7b704d1218f8746829b7950b70e0a406 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Wed, 24 Aug 2022 14:43:00 +1000
Subject: [PATCH 2083/2409] Update to Fedora 36

Update the Fedora job to the latest release nodes

Depends-On: https://review.opendev.org/c/openstack/devstack/+/860634
Change-Id: If2d7f99e3665a2e3df4cf763efc64dd381f02350
---
 .zuul.yaml       | 2 +-
 files/rpms/swift | 2 +-
 lib/apache       | 2 +-
 stack.sh         | 4 ++--
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 6ad7148449..441a9cf1e9 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -82,7 +82,7 @@
     name: devstack-single-node-fedora-latest
     nodes:
       - name: controller
-        label: fedora-35
+        label: fedora-36
     groups:
       - name: tempest
         nodes:
diff --git a/files/rpms/swift b/files/rpms/swift
index 7d906aa926..49a1833dc4 100644
--- a/files/rpms/swift
+++ b/files/rpms/swift
@@ -4,4 +4,4 @@ memcached
 rsync-daemon
 sqlite
 xfsprogs
-xinetd # not:f35,rhel9
+xinetd # not:f36,rhel9
diff --git a/lib/apache b/lib/apache
index 94f3cfc95a..705776c55b 100644
--- a/lib/apache
+++ b/lib/apache
@@ -95,7 +95,7 @@ function install_apache_uwsgi {
     # didn't fix Python 3.10 compatibility before release.  Should be
     # fixed in uwsgi 4.9.0; can remove this when packages available
     # or we drop this release
-    elif is_fedora && ! [[ $DISTRO =~ f35 ]]; then
+    elif is_fedora && ! [[ $DISTRO =~ f36 ]]; then
         # Note httpd comes with mod_proxy_uwsgi and it is loaded by
         # default; the mod_proxy_uwsgi package actually conflicts now.
         # See:
diff --git a/stack.sh b/stack.sh
index c99189e6dc..cc90fca576 100755
--- a/stack.sh
+++ b/stack.sh
@@ -12,7 +12,7 @@
 # a multi-node developer install.
 
 # To keep this script simple we assume you are running on a recent **Ubuntu**
-# (Bionic or newer), **Fedora** (F24 or newer), or **CentOS/RHEL**
+# (Bionic or newer), **Fedora** (F36 or newer), or **CentOS/RHEL**
 # (7 or newer) machine. (It may work on other platforms but support for those
 # platforms is left to those who added them to DevStack.) It should work in
 # a VM or physical server. Additionally, we maintain a list of ``deb`` and
@@ -229,7 +229,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-SUPPORTED_DISTROS="bullseye|focal|jammy|f35|opensuse-15.2|opensuse-tumbleweed|rhel8|rhel9"
+SUPPORTED_DISTROS="bullseye|focal|jammy|f36|opensuse-15.2|opensuse-tumbleweed|rhel8|rhel9"
 
 if [[ ! ${DISTRO} =~ $SUPPORTED_DISTROS ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"

From e3bc6b5f571a5b291617ee5227c153002ef8d9c3 Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 24 Sep 2019 12:44:16 +1000
Subject: [PATCH 2084/2409] get_or_create_domain: simplify with "--or-show"
 argument

Similar to other functions, this uses "--or-show" to avoid double
calls.

Co-Authored-By: Jens Harbott <harbott@osism.tech>
Change-Id: I548f9acd812687838e04b705f86f3b70d2b10caf
---
 functions-common | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/functions-common b/functions-common
index 92a6678de0..ed44186804 100644
--- a/functions-common
+++ b/functions-common
@@ -875,14 +875,9 @@ function policy_add {
 # Usage: get_or_create_domain <name> <description>
 function get_or_create_domain {
     local domain_id
-    # Gets domain id
     domain_id=$(
-        # Gets domain id
-        openstack --os-cloud devstack-system-admin domain show $1 \
-            -f value -c id 2>/dev/null ||
-        # Creates new domain
         openstack --os-cloud devstack-system-admin domain create $1 \
-            --description "$2" \
+            --description "$2" --or-show \
             -f value -c id
     )
     echo $domain_id

From e69b78df6fc48a1e70c180d3878164e416adbbdd Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Tue, 24 Sep 2019 12:51:25 +1000
Subject: [PATCH 2085/2409] Simplify role addtion helper functions

Because adding the role is idempotent, we can save doing the initial
check for role assignment.  Also simplify the output matching by using
osc's filters where appropriate.

Co-Authored-By: Jens Harbott <harbott@osism.tech>
Change-Id: If2a661cc565a43a7821b8f0a10edd97de08eb911
---
 functions-common | 65 ++++++++++++++++++------------------------------
 1 file changed, 24 insertions(+), 41 deletions(-)

diff --git a/functions-common b/functions-common
index ed44186804..e9984fd65e 100644
--- a/functions-common
+++ b/functions-common
@@ -966,29 +966,22 @@ function _get_domain_args {
 # Usage: get_or_add_user_project_role <role> <user> <project> [<user_domain> <project_domain>]
 function get_or_add_user_project_role {
     local user_role_id
+    local domain_args
 
     domain_args=$(_get_domain_args $4 $5)
 
-    # Gets user role id
+    # Note this is idempotent so we are safe across multiple
+    # duplicate calls.
+    openstack --os-cloud devstack-system-admin role add $1 \
+        --user $2 \
+        --project $3 \
+        $domain_args
     user_role_id=$(openstack --os-cloud devstack-system-admin role assignment list \
         --role $1 \
         --user $2 \
         --project $3 \
         $domain_args \
-        | grep '^|\s[a-f0-9]\+' | get_field 1)
-    if [[ -z "$user_role_id" ]]; then
-        # Adds role to user and get it
-        openstack --os-cloud devstack-system-admin role add $1 \
-            --user $2 \
-            --project $3 \
-            $domain_args
-        user_role_id=$(openstack --os-cloud devstack-system-admin role assignment list \
-            --role $1 \
-            --user $2 \
-            --project $3 \
-            $domain_args \
-            | grep '^|\s[a-f0-9]\+' | get_field 1)
-    fi
+        -c Role -f value)
     echo $user_role_id
 }
 
@@ -996,23 +989,18 @@ function get_or_add_user_project_role {
 # Usage: get_or_add_user_domain_role <role> <user> <domain>
 function get_or_add_user_domain_role {
     local user_role_id
-    # Gets user role id
+
+    # Note this is idempotent so we are safe across multiple
+    # duplicate calls.
+    openstack --os-cloud devstack-system-admin role add $1 \
+        --user $2 \
+        --domain $3
     user_role_id=$(openstack --os-cloud devstack-system-admin role assignment list \
         --role $1 \
         --user $2 \
         --domain $3 \
-        | grep '^|\s[a-f0-9]\+' | get_field 1)
-    if [[ -z "$user_role_id" ]]; then
-        # Adds role to user and get it
-        openstack --os-cloud devstack-system-admin role add $1 \
-            --user $2 \
-            --domain $3
-        user_role_id=$(openstack --os-cloud devstack-system-admin role assignment list \
-            --role $1 \
-            --user $2 \
-            --domain $3 \
-            | grep '^|\s[a-f0-9]\+' | get_field 1)
-    fi
+        -c Role -f value)
+
     echo $user_role_id
 }
 
@@ -1051,23 +1039,18 @@ function get_or_add_user_system_role {
 # Usage: get_or_add_group_project_role <role> <group> <project>
 function get_or_add_group_project_role {
     local group_role_id
-    # Gets group role id
+
+    # Note this is idempotent so we are safe across multiple
+    # duplicate calls.
+    openstack role add $1 \
+        --group $2 \
+        --project $3
     group_role_id=$(openstack --os-cloud devstack-system-admin role assignment list \
         --role $1 \
         --group $2 \
         --project $3 \
-        -f value)
-    if [[ -z "$group_role_id" ]]; then
-        # Adds role to group and get it
-        openstack --os-cloud devstack-system-admin role add $1 \
-            --group $2 \
-            --project $3
-        group_role_id=$(openstack --os-cloud devstack-system-admin role assignment list \
-            --role $1 \
-            --group $2 \
-            --project $3 \
-            -f value)
-    fi
+        -f value -c Role)
+
     echo $group_role_id
 }
 

From 2e6756640c8e85cb924f9dfcd968aad303b481b3 Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Thu, 6 Oct 2022 17:24:57 +0200
Subject: [PATCH 2086/2409] Re-enable horizon in jammy-based jobs

The issue that Horizon had with python3.10 has been fixed some time ago,
so we can stop disabling it for those jobs.

Also stop including roles from devstack-gate which we no longer need.

Change-Id: Ia5d0b31561adc5051acd96fcaab183e60c3c2f99
---
 .zuul.yaml | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 6ad7148449..99b48dae45 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -335,7 +335,6 @@
     required-projects:
       - opendev.org/openstack/devstack
     roles:
-      - zuul: opendev.org/openstack/devstack-gate
       - zuul: opendev.org/openstack/openstack-zuul-jobs
     vars:
       devstack_localrc:
@@ -676,9 +675,6 @@
     timeout: 9000
     vars:
       configure_swap_size: 4096
-      devstack_services:
-        # Horizon doesn't like py310
-        horizon: false
 
 - job:
     name: devstack-platform-ubuntu-jammy-ovn-source
@@ -706,8 +702,6 @@
         Q_ML2_PLUGIN_MECHANISM_DRIVERS: openvswitch
         Q_ML2_TENANT_NETWORK_TYPE: vxlan
       devstack_services:
-        # Horizon doesn't like py310
-        horizon: false
         # Disable OVN services
         ovn-northd: false
         ovn-controller: false
@@ -752,10 +746,6 @@
     voting: false
     vars:
       configure_swap_size: 4096
-      # Python 3.10 dependency issues; see
-      # https://bugs.launchpad.net/horizon/+bug/1960204
-      devstack_services:
-        horizon: false
 
 - job:
     name: devstack-platform-fedora-latest-virt-preview

From 7d1ba835c38839a62cee94dc281773b62c554932 Mon Sep 17 00:00:00 2001
From: Masayuki Igawa <masayuki@igawa.io>
Date: Tue, 11 Oct 2022 12:35:18 +0900
Subject: [PATCH 2087/2409] [Doc] Fix tox command option to run smoke tests

This commit fixes the tox command option to run the smoke tests. The
original arguments fail with the error[1], and `-efull` and
`tempest.scenario.test_network_basic_ops` are not for the smoke tests.

[1]
 $ tox -efull tempest.scenario.test_network_basic_ops
 ...
 tempest run: error: unrecognized arguments: tempest.scenario.test_network_basic_ops

Change-Id: I9c3dd9fb4f64bf856c5cab88a2aeaae355c84a65
---
 doc/source/configuration.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 757b4001d9..3191ae824b 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -636,7 +636,7 @@ tests can be run as follows:
 ::
 
     $ cd /opt/stack/tempest
-    $ tox -efull  tempest.scenario.test_network_basic_ops
+    $ tox -e smoke
 
 By default tempest is downloaded and the config file is generated, but the
 tempest package is not installed in the system's global site-packages (the

From 781fbf47b557d92bcb71e60c535f6249e729637d Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Tue, 11 Oct 2022 15:41:02 +0200
Subject: [PATCH 2088/2409] docs: Add warnings about password selection

Some services fail when using special characters in passwords, add some
warnings to our docs.

Closes-Bug: 1744985
Change-Id: I601149e2e7362507b38f01719f7197385a27e0a8
---
 doc/source/configuration.rst         | 3 +++
 doc/source/guides/single-machine.rst | 3 +++
 doc/source/index.rst                 | 5 ++++-
 3 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 757b4001d9..d59c1edafd 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -181,6 +181,9 @@ values that most often need to be set.
 If the ``*_PASSWORD`` variables are not set here you will be prompted to
 enter values for them by ``stack.sh``.
 
+.. warning:: Only use alphanumeric characters in your passwords, as some
+   services fail to work when using special characters.
+
 The network ranges must not overlap with any networks in use on the
 host. Overlap is not uncommon as RFC-1918 'private' ranges are commonly
 used for both the local networking and Nova's fixed and floating ranges.
diff --git a/doc/source/guides/single-machine.rst b/doc/source/guides/single-machine.rst
index 0529e30f08..a4385b5b4b 100644
--- a/doc/source/guides/single-machine.rst
+++ b/doc/source/guides/single-machine.rst
@@ -106,6 +106,9 @@ do the following:
 -  Set the service password. This is used by the OpenStack services
    (Nova, Glance, etc) to authenticate with Keystone.
 
+.. warning:: Only use alphanumeric characters in your passwords, as some
+   services fail to work when using special characters.
+
 ``local.conf`` should look something like this:
 
 .. code-block:: ini
diff --git a/doc/source/index.rst b/doc/source/index.rst
index 0434d68838..ba7ea42943 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -101,7 +101,10 @@ devstack git repo.
 This is the minimum required config to get started with DevStack.
 
 .. note:: There is a sample :download:`local.conf </assets/local.conf>` file
-    under the *samples* directory in the devstack repository.
+   under the *samples* directory in the devstack repository.
+
+.. warning:: Only use alphanumeric characters in your passwords, as some
+   services fail to work when using special characters.
 
 Start the install
 -----------------

From 358987f065af05d166539982c282e2f587b5c952 Mon Sep 17 00:00:00 2001
From: Adrian Fusco Arnejo <afuscoar@redhat.com>
Date: Wed, 31 Aug 2022 19:38:49 +0200
Subject: [PATCH 2089/2409] Adding devstack support for Rocky Linux 9

Adding job and nodeset to run tempest-full-py3 in Rocky Linux 9 instance

Change-Id: I6fb390bfeec436b50a3ddc18d154bbce3f3b1975
---
 .zuul.yaml           | 20 ++++++++++++++++++++
 doc/source/index.rst |  2 +-
 functions-common     |  7 ++++++-
 3 files changed, 27 insertions(+), 2 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index c29cb31f31..8e6f8633ff 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -106,6 +106,16 @@
         nodes:
           - controller
 
+- nodeset:
+    name: devstack-single-node-rockylinux-9
+    nodes:
+      - name: controller
+        label: rockylinux-9
+    groups:
+      - name: tempest
+        nodes:
+          - controller
+
 - nodeset:
     name: openstack-two-node
     nodes:
@@ -676,6 +686,15 @@
     vars:
       configure_swap_size: 4096
 
+- job:
+    name: devstack-platform-rocky-blue-onyx
+    parent: tempest-full-py3
+    description: Rocky Linux 9 Blue Onyx platform test
+    nodeset: devstack-single-node-rockylinux-9
+    timeout: 9000
+    vars:
+      configure_swap_size: 4096
+
 - job:
     name: devstack-platform-ubuntu-jammy
     parent: tempest-full-py3
@@ -852,6 +871,7 @@
         - devstack-platform-fedora-latest
         - devstack-platform-centos-9-stream
         - devstack-platform-debian-bullseye
+        - devstack-platform-rocky-blue-onyx
         - devstack-platform-ubuntu-jammy
         - devstack-platform-ubuntu-jammy-ovn-source
         - devstack-platform-ubuntu-jammy-ovs
diff --git a/doc/source/index.rst b/doc/source/index.rst
index 0434d68838..626d5e1a85 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -38,7 +38,7 @@ Install Linux
 
 Start with a clean and minimal install of a Linux system. DevStack
 attempts to support the two latest LTS releases of Ubuntu, the
-latest/current Fedora version, CentOS/RHEL 8 and OpenSUSE.
+latest/current Fedora version, CentOS/RHEL/Rocky Linux 9 and OpenSUSE.
 
 If you do not have a preference, Ubuntu 20.04 (Focal Fossa) is the
 most tested, and will probably go the smoothest.
diff --git a/functions-common b/functions-common
index 92a6678de0..e27518f559 100644
--- a/functions-common
+++ b/functions-common
@@ -418,6 +418,9 @@ function GetOSVersion {
         os_RELEASE=${VERSION_ID}
         os_CODENAME="n/a"
         os_VENDOR=$(echo $NAME | tr -d '[:space:]')
+    elif [[ "${ID}${VERSION}" =~ "rocky9" ]]; then
+        os_VENDOR="Rocky"
+        os_RELEASE=${VERSION_ID}
     else
         _ensure_lsb_release
 
@@ -466,6 +469,7 @@ function GetDistro {
         "$os_VENDOR" =~ (AlmaLinux) || \
         "$os_VENDOR" =~ (Scientific) || \
         "$os_VENDOR" =~ (OracleServer) || \
+        "$os_VENDOR" =~ (Rocky) || \
         "$os_VENDOR" =~ (Virtuozzo) ]]; then
         # Drop the . release as we assume it's compatible
         # XXX re-evaluate when we get RHEL10
@@ -513,7 +517,7 @@ function is_oraclelinux {
 
 
 # Determine if current distribution is a Fedora-based distribution
-# (Fedora, RHEL, CentOS, etc).
+# (Fedora, RHEL, CentOS, Rocky, etc).
 # is_fedora
 function is_fedora {
     if [[ -z "$os_VENDOR" ]]; then
@@ -523,6 +527,7 @@ function is_fedora {
     [ "$os_VENDOR" = "Fedora" ] || [ "$os_VENDOR" = "Red Hat" ] || \
         [ "$os_VENDOR" = "RedHatEnterpriseServer" ] || \
         [ "$os_VENDOR" = "RedHatEnterprise" ] || \
+        [ "$os_VENDOR" = "Rocky" ] || \
         [ "$os_VENDOR" = "CentOS" ] || [ "$os_VENDOR" = "CentOSStream" ] || \
         [ "$os_VENDOR" = "AlmaLinux" ] || \
         [ "$os_VENDOR" = "OracleServer" ] || [ "$os_VENDOR" = "Virtuozzo" ]

From 71c99655479174750bcedfe458328328a1596766 Mon Sep 17 00:00:00 2001
From: Brian Haley <haleyb.dev@gmail.com>
Date: Wed, 19 Oct 2022 14:08:43 -0400
Subject: [PATCH 2090/2409] Use separate OVS and OVN directories

If stack.sh is run on a system that already has OVN packages
installed, it could fail to find its DB sockets. This is because
the 'ln -s' will place the symlink inside of /var/run/ovn
instead of using a single directory as intended.

Change the code in neutron_plugins/ovn_agent to not make the
symlink and instead use separate directories for OVS and OVN.

Closes-bug: #1980421

Change-Id: Ic28a93bdc3dfe4a6159234baeabd0064db452b07
---
 lib/neutron_plugins/ovn_agent | 43 ++++++++++++++++-------------------
 1 file changed, 20 insertions(+), 23 deletions(-)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index 8eb2993b94..e64224cbaa 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -244,11 +244,12 @@ function _run_process {
     local cmd="$2"
     local stop_cmd="$3"
     local group=$4
-    local user=${5:-$STACK_USER}
+    local user=$5
+    local rundir=${6:-$OVS_RUNDIR}
 
     local systemd_service="devstack@$service.service"
     local unit_file="$SYSTEMD_DIR/$systemd_service"
-    local environment="OVN_RUNDIR=$OVS_RUNDIR OVN_DBDIR=$OVN_DATADIR OVN_LOGDIR=$LOGDIR OVS_RUNDIR=$OVS_RUNDIR OVS_DBDIR=$OVS_DATADIR OVS_LOGDIR=$LOGDIR"
+    local environment="OVN_RUNDIR=$OVN_RUNDIR OVN_DBDIR=$OVN_DATADIR OVN_LOGDIR=$LOGDIR OVS_RUNDIR=$OVS_RUNDIR OVS_DBDIR=$OVS_DATADIR OVS_LOGDIR=$LOGDIR"
 
     echo "Starting $service executed command": $cmd
 
@@ -264,14 +265,14 @@ function _run_process {
 
     _start_process $systemd_service
 
-    local testcmd="test -e $OVS_RUNDIR/$service.pid"
+    local testcmd="test -e $rundir/$service.pid"
     test_with_retry "$testcmd" "$service did not start" $SERVICE_TIMEOUT 1
     local service_ctl_file
-    service_ctl_file=$(ls $OVS_RUNDIR | grep $service | grep ctl)
+    service_ctl_file=$(ls $rundir | grep $service | grep ctl)
     if [ -z "$service_ctl_file" ]; then
         die $LINENO "ctl file for service $service is not present."
     fi
-    sudo ovs-appctl -t $OVS_RUNDIR/$service_ctl_file vlog/set console:off syslog:info file:info
+    sudo ovs-appctl -t $rundir/$service_ctl_file vlog/set console:off syslog:info file:info
 }
 
 function clone_repository {
@@ -370,10 +371,6 @@ function install_ovn {
 
     sudo mkdir -p $OVS_RUNDIR
     sudo chown $(whoami) $OVS_RUNDIR
-    # NOTE(lucasagomes): To keep things simpler, let's reuse the same
-    # RUNDIR for both OVS and OVN. This way we avoid having to specify the
-    # --db option in the ovn-{n,s}bctl commands while playing with DevStack
-    sudo ln -s $OVS_RUNDIR $OVN_RUNDIR
 
     if [[ "$OVN_BUILD_FROM_SOURCE" == "True" ]]; then
         # If OVS is already installed, remove it, because we're about to
@@ -616,12 +613,12 @@ function _start_ovs {
                 dbcmd+=" --remote=db:hardware_vtep,Global,managers $OVS_DATADIR/vtep.db"
             fi
             dbcmd+=" $OVS_DATADIR/conf.db"
-            _run_process ovsdb-server "$dbcmd" "" "$STACK_GROUP" "root"
+            _run_process ovsdb-server "$dbcmd" "" "$STACK_GROUP" "root" "$OVS_RUNDIR"
 
             # Note: ovn-controller will create and configure br-int once it is started.
             # So, no need to create it now because nothing depends on that bridge here.
             local ovscmd="$OVS_SBINDIR/ovs-vswitchd --log-file --pidfile --detach"
-            _run_process ovs-vswitchd "$ovscmd" "" "$STACK_GROUP" "root"
+            _run_process ovs-vswitchd "$ovscmd" "" "$STACK_GROUP" "root" "$OVS_RUNDIR"
         else
             _start_process "$OVSDB_SERVER_SERVICE"
             _start_process "$OVS_VSWITCHD_SERVICE"
@@ -660,7 +657,7 @@ function _start_ovs {
 
             enable_service ovs-vtep
             local vtepcmd="$OVS_SCRIPTDIR/ovs-vtep --log-file --pidfile --detach br-v"
-            _run_process ovs-vtep "$vtepcmd" "" "$STACK_GROUP" "root"
+            _run_process ovs-vtep "$vtepcmd" "" "$STACK_GROUP" "root" "$OVS_RUNDIR"
 
             vtep-ctl set-manager tcp:$HOST_IP:6640
         fi
@@ -704,26 +701,26 @@ function start_ovn {
             local cmd="/bin/bash $SCRIPTDIR/ovn-ctl --no-monitor start_northd"
             local stop_cmd="/bin/bash $SCRIPTDIR/ovn-ctl stop_northd"
 
-            _run_process ovn-northd "$cmd" "$stop_cmd" "$STACK_GROUP" "root"
+            _run_process ovn-northd "$cmd" "$stop_cmd" "$STACK_GROUP" "root" "$OVN_RUNDIR"
         else
             _start_process "$OVN_NORTHD_SERVICE"
         fi
 
         # Wait for the service to be ready
         # Check for socket and db files for both OVN NB and SB
-        wait_for_sock_file $OVS_RUNDIR/ovnnb_db.sock
-        wait_for_sock_file $OVS_RUNDIR/ovnsb_db.sock
+        wait_for_sock_file $OVN_RUNDIR/ovnnb_db.sock
+        wait_for_sock_file $OVN_RUNDIR/ovnsb_db.sock
         wait_for_db_file $OVN_DATADIR/ovnnb_db.db
         wait_for_db_file $OVN_DATADIR/ovnsb_db.db
 
         if is_service_enabled tls-proxy; then
-            sudo ovn-nbctl --db=unix:$OVS_RUNDIR/ovnnb_db.sock set-ssl $INT_CA_DIR/private/$DEVSTACK_CERT_NAME.key $INT_CA_DIR/$DEVSTACK_CERT_NAME.crt $INT_CA_DIR/ca-chain.pem
-            sudo ovn-sbctl --db=unix:$OVS_RUNDIR/ovnsb_db.sock set-ssl $INT_CA_DIR/private/$DEVSTACK_CERT_NAME.key $INT_CA_DIR/$DEVSTACK_CERT_NAME.crt $INT_CA_DIR/ca-chain.pem
+            sudo ovn-nbctl --db=unix:$OVN_RUNDIR/ovnnb_db.sock set-ssl $INT_CA_DIR/private/$DEVSTACK_CERT_NAME.key $INT_CA_DIR/$DEVSTACK_CERT_NAME.crt $INT_CA_DIR/ca-chain.pem
+            sudo ovn-sbctl --db=unix:$OVN_RUNDIR/ovnsb_db.sock set-ssl $INT_CA_DIR/private/$DEVSTACK_CERT_NAME.key $INT_CA_DIR/$DEVSTACK_CERT_NAME.crt $INT_CA_DIR/ca-chain.pem
         fi
-        sudo ovn-nbctl --db=unix:$OVS_RUNDIR/ovnnb_db.sock set-connection p${OVN_PROTO}:6641:$SERVICE_LISTEN_ADDRESS -- set connection . inactivity_probe=60000
-        sudo ovn-sbctl --db=unix:$OVS_RUNDIR/ovnsb_db.sock set-connection p${OVN_PROTO}:6642:$SERVICE_LISTEN_ADDRESS -- set connection . inactivity_probe=60000
-        sudo ovs-appctl -t $OVS_RUNDIR/ovnnb_db.ctl vlog/set console:off syslog:$OVN_DBS_LOG_LEVEL file:$OVN_DBS_LOG_LEVEL
-        sudo ovs-appctl -t $OVS_RUNDIR/ovnsb_db.ctl vlog/set console:off syslog:$OVN_DBS_LOG_LEVEL file:$OVN_DBS_LOG_LEVEL
+        sudo ovn-nbctl --db=unix:$OVN_RUNDIR/ovnnb_db.sock set-connection p${OVN_PROTO}:6641:$SERVICE_LISTEN_ADDRESS -- set connection . inactivity_probe=60000
+        sudo ovn-sbctl --db=unix:$OVN_RUNDIR/ovnsb_db.sock set-connection p${OVN_PROTO}:6642:$SERVICE_LISTEN_ADDRESS -- set connection . inactivity_probe=60000
+        sudo ovs-appctl -t $OVN_RUNDIR/ovnnb_db.ctl vlog/set console:off syslog:$OVN_DBS_LOG_LEVEL file:$OVN_DBS_LOG_LEVEL
+        sudo ovs-appctl -t $OVN_RUNDIR/ovnsb_db.ctl vlog/set console:off syslog:$OVN_DBS_LOG_LEVEL file:$OVN_DBS_LOG_LEVEL
     fi
 
     if is_service_enabled ovn-controller ; then
@@ -731,7 +728,7 @@ function start_ovn {
             local cmd="/bin/bash $SCRIPTDIR/ovn-ctl --no-monitor start_controller"
             local stop_cmd="/bin/bash $SCRIPTDIR/ovn-ctl stop_controller"
 
-            _run_process ovn-controller "$cmd" "$stop_cmd" "$STACK_GROUP" "root"
+            _run_process ovn-controller "$cmd" "$stop_cmd" "$STACK_GROUP" "root" "$OVN_RUNDIR"
         else
             _start_process "$OVN_CONTROLLER_SERVICE"
         fi
@@ -740,7 +737,7 @@ function start_ovn {
     if is_service_enabled ovn-controller-vtep ; then
         if [[ "$OVN_BUILD_FROM_SOURCE" == "True" ]]; then
             local cmd="$OVS_BINDIR/ovn-controller-vtep --log-file --pidfile --detach --ovnsb-db=$OVN_SB_REMOTE"
-            _run_process ovn-controller-vtep "$cmd" "" "$STACK_GROUP" "root"
+            _run_process ovn-controller-vtep "$cmd" "" "$STACK_GROUP" "root" "$OVN_RUNDIR"
         else
             _start_process "$OVN_CONTROLLER_VTEP_SERVICE"
         fi

From 5e7afb779c469f593a1628e8f63c66989b7e2c49 Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Mon, 24 Oct 2022 12:17:48 +0200
Subject: [PATCH 2091/2409] Run dmesg command with sudo

It seems that setting "sysctl kernel.dmesg_restrict" was changed
in Ubuntu 22.04 (Jammy) to "1" and because of that running "dmesg"
command requires now root privileges.

Closes-bug: #1994023

Change-Id: I2adc76e3025fadf994bab2e2e1fd608e688874fc
---
 lib/neutron_plugins/ovs_source | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/neutron_plugins/ovs_source b/lib/neutron_plugins/ovs_source
index 164d574c42..ea71e60e68 100644
--- a/lib/neutron_plugins/ovs_source
+++ b/lib/neutron_plugins/ovs_source
@@ -33,9 +33,9 @@ function load_module {
     local fatal=$2
 
     if [ "$(trueorfalse True fatal)" == "True" ]; then
-        sudo modprobe $module || (dmesg && die $LINENO "FAILED TO LOAD $module")
+        sudo modprobe $module || (sudo dmesg && die $LINENO "FAILED TO LOAD $module")
     else
-        sudo modprobe $module || (echo "FAILED TO LOAD $module" && dmesg)
+        sudo modprobe $module || (echo "FAILED TO LOAD $module" && sudo dmesg)
     fi
 }
 
@@ -103,7 +103,7 @@ function prepare_for_ovs_compilation {
 function load_ovs_kernel_modules {
     load_module openvswitch
     load_module vport-geneve False
-    dmesg | tail
+    sudo dmesg | tail
 }
 
 # reload_ovs_kernel_modules() - reload openvswitch kernel module

From 47a429777ce71e4d69e1894f173cf87e731b3a6e Mon Sep 17 00:00:00 2001
From: Martin Kopec <mkopec@redhat.com>
Date: Fri, 4 Nov 2022 14:31:03 +0100
Subject: [PATCH 2092/2409] Extend single-core-review for non-functional
 changes

Adding a second exception for single-core-review in Devstack
repository - changes which do not affect core functionality, like
f.e. job cleanups, can be reviewed by a single core.

Change-Id: Idb6cefa510fdbfed41379eb410f4884852d1177f
---
 doc/source/contributor/contributing.rst | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/doc/source/contributor/contributing.rst b/doc/source/contributor/contributing.rst
index 4de238fbf8..8b5a85b3df 100644
--- a/doc/source/contributor/contributing.rst
+++ b/doc/source/contributor/contributing.rst
@@ -42,8 +42,9 @@ Getting Your Patch Merged
 ~~~~~~~~~~~~~~~~~~~~~~~~~
 All changes proposed to the Devstack require two ``Code-Review +2`` votes from
 Devstack core reviewers before one of the core reviewers can approve the patch
-by giving ``Workflow +1`` vote. One exception is for patches to unblock the gate
-which can be approved by single core reviewers.
+by giving ``Workflow +1`` vote. There are 2 exceptions, approving patches to
+unblock the gate and patches that do not relate to the Devstack's core logic,
+like for example old job cleanups, can be approved by single core reviewers.
 
 Project Team Lead Duties
 ~~~~~~~~~~~~~~~~~~~~~~~~

From d1c2bf5e7c739bc5a7eeac602b477edb9f6630c2 Mon Sep 17 00:00:00 2001
From: Rodolfo Alonso Hernandez <ralonsoh@redhat.com>
Date: Wed, 2 Nov 2022 16:43:41 +0100
Subject: [PATCH 2093/2409] Add new service "file_tracker"

This new service periodically tracks the file open in the system.

Closes-Bug: #1995502
Change-Id: I02e097fef07655ff571af9f35bf258b2ed975098
---
 .zuul.yaml               |  4 ++++
 doc/source/debugging.rst |  6 +++++
 lib/dstat                |  6 +++++
 tools/file_tracker.sh    | 47 ++++++++++++++++++++++++++++++++++++++++
 4 files changed, 63 insertions(+)
 create mode 100755 tools/file_tracker.sh

diff --git a/.zuul.yaml b/.zuul.yaml
index 6dbb5bacbe..ce38760203 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -469,6 +469,7 @@
         dstat: false
         etcd3: true
         memory_tracker: true
+        file_tracker: true
         mysql: true
         rabbit: true
     group-vars:
@@ -477,6 +478,7 @@
           # Shared services
           dstat: false
           memory_tracker: true
+          file_tracker: true
         devstack_localrc:
           # Multinode specific settings
           HOST_IP: "{{ hostvars[inventory_hostname]['nodepool']['private_ipv4'] }}"
@@ -544,6 +546,7 @@
         dstat: false
         etcd3: true
         memory_tracker: true
+        file_tracker: true
         mysql: true
         rabbit: true
         tls-proxy: true
@@ -593,6 +596,7 @@
           # Shared services
           dstat: false
           memory_tracker: true
+          file_tracker: true
           tls-proxy: true
           # Nova services
           n-cpu: true
diff --git a/doc/source/debugging.rst b/doc/source/debugging.rst
index fd0d9cdf74..3ca0ad94b4 100644
--- a/doc/source/debugging.rst
+++ b/doc/source/debugging.rst
@@ -20,6 +20,12 @@ provides consumption output when available memory is seen to be
 falling (i.e. processes are consuming memory).  It also provides
 output showing locked (unswappable) memory.
 
+file_tracker
+------------
+
+The ``file_tracker`` service periodically monitors the number of
+open files in the system.
+
 tcpdump
 -------
 
diff --git a/lib/dstat b/lib/dstat
index eb03ae0fb2..870c901d2a 100644
--- a/lib/dstat
+++ b/lib/dstat
@@ -40,12 +40,18 @@ function start_dstat {
     if is_service_enabled peakmem_tracker; then
         die $LINENO "The peakmem_tracker service has been removed, use memory_tracker instead"
     fi
+
+    # To enable file_tracker add:
+    #    enable_service file_tracker
+    # to your localrc
+    run_process file_tracker "$TOP_DIR/tools/file_tracker.sh"
 }
 
 # stop_dstat() stop dstat process
 function stop_dstat {
     stop_process dstat
     stop_process memory_tracker
+    stop_process file_tracker
 }
 
 # Restore xtrace
diff --git a/tools/file_tracker.sh b/tools/file_tracker.sh
new file mode 100755
index 0000000000..9c31b30a56
--- /dev/null
+++ b/tools/file_tracker.sh
@@ -0,0 +1,47 @@
+#!/bin/bash
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+set -o errexit
+
+# time to sleep between checks
+SLEEP_TIME=20
+
+function tracker {
+    echo "Number of open files | Number of open files not in use | Maximum number of files allowed to be opened"
+    while true; do
+        cat /proc/sys/fs/file-nr
+        sleep $SLEEP_TIME
+    done
+}
+
+function usage {
+    echo "Usage: $0 [-x] [-s N]" 1>&2
+    exit 1
+}
+
+while getopts ":s:x" opt; do
+    case $opt in
+        s)
+            SLEEP_TIME=$OPTARG
+            ;;
+        x)
+            set -o xtrace
+            ;;
+        *)
+            usage
+            ;;
+    esac
+done
+
+tracker

From a4680766515ed9317b71cfb39cd0d75dc04f3d9c Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Wed, 9 Nov 2022 10:11:46 -0800
Subject: [PATCH 2094/2409] Make debian-bullseye job non-voting

As noted in the QA meeting this week, this job is failing due to
something that seems outside of our control:

https://meetings.opendev.org/meetings/qa/2022/qa.2022-11-08-15.00.log.html

Make it non-voting until that is resolved.

Change-Id: Ia571d1dab45eb1bbb8665373d416515d3c95fb14
---
 .zuul.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index 6dbb5bacbe..1923444601 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -674,6 +674,8 @@
     description: Debian Bullseye platform test
     nodeset: devstack-single-node-debian-bullseye
     timeout: 9000
+    # TODO(danms) n-v until the known issue is resolved
+    voting: false
     vars:
       configure_swap_size: 4096
 

From 97b2a51d6beee4fd58b93027d823d6fd90f5c11f Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Wed, 9 Nov 2022 11:58:37 -0800
Subject: [PATCH 2095/2409] Fix dbcounter install on Debian Bullseye

The dbcounter install on Debian Bullseye is broken in a really fun way.
The problem is that we end up mixing pypi openssl and distro
cryptography under pip and those two versions of libraries are not
compatible.

The reason this happens is that debian's pip package debundles the pip
deps. This splits them out into /usr/share/python-wheels and it will
prefer distro versions of libraries over pypi installed versions of
libraries. But if a pypi version is installed and a distro version is
not then the pypi version is used. If the pypi version of library A does
not work with distro version of library B then debundled pip breaks.
This has happened with crypytography and pyOpenSSL.

This happens because urllib3 (a debundled pip dep) appears to use
pyopenssl conditionally. Novnc depends on python3-cryptography, and
openstack depends on cryptogrpahy from pypi ensuring we get both a
distro and a pypi version installed. However, pyOpenSSL is only pulled
in from pypi via openstack deps. This leaves debundled urllib3
attempting to use pypi pyOpenSSL with distro cryptography and that combo
isn't valid due to an interface change.

To fix this we install python3-openssl ensuring that debundled pip will
use distro pyOpenSSL with distro cryptography making everything happy
again. But we only do this when we install novnc as novnc is what pulls
in distro cryptography in the first place. We can't simply install
python3-openssl on all debuntu platforms because this breaks Ubuntu
Focal in the other direction. On Ubuntu focal distro pip uses distro
pyOpenSSL when no pypi pyOpenSSl is installed (prior to keystone
install) and is not compatible with pypi cryptography.

Honestly, this whole intersection between distro and pypi installs of
cryptography and pyOpenSSL could probably be made cleaner. One option
would be for us to always install the constraints version of both
packages from pypi and the distro pacakges very early in the devstack
run. But that seems far more complicated so I'm not attempting that
here.

Change-Id: I0fc6a8e66e365ac49c6c7ceb4c71c68714b9f541
---
 lib/nova | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index 6de1d3382f..5c619bb762 100644
--- a/lib/nova
+++ b/lib/nova
@@ -885,8 +885,23 @@ function install_nova {
         # a websockets/html5 or flash powered VNC console for vm instances
         NOVNC_FROM_PACKAGE=$(trueorfalse False NOVNC_FROM_PACKAGE)
         if [ "$NOVNC_FROM_PACKAGE" = "True" ]; then
+            # Installing novnc on Debian bullseye breaks the global pip
+            # install. This happens because novnc pulls in distro cryptography
+            # which will be prefered by distro pip, but if anything has
+            # installed pyOpenSSL from pypi (keystone) that is not compatible
+            # with distro cryptography. Fix this by installing
+            # python3-openssl (pyOpenSSL) from the distro which pip will prefer
+            # on Debian. Ubuntu has inverse problems so we only do this for
+            # Debian.
+            local novnc_packages
+            novnc_packages="novnc"
+            GetOSVersion
+            if [[ "$os_VENDOR" = "Debian" ]] ; then
+                novnc_packages="$novnc_packages python3-openssl"
+            fi
+
             NOVNC_WEB_DIR=/usr/share/novnc
-            install_package novnc
+            install_package $novnc_packages
         else
             NOVNC_WEB_DIR=$DEST/novnc
             git_clone $NOVNC_REPO $NOVNC_WEB_DIR $NOVNC_BRANCH

From 857f4993f35fbdc83771b9632d3525766de194a1 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Wed, 19 Oct 2022 20:15:42 -0500
Subject: [PATCH 2096/2409] Add RBAC scope and new defaults setting support for
 Nova & Tempest

Nova is ready with the scope and new defaults as per the new
RBAC design. Adding devstack flag to enable the scope checks
and new defaults enforcement in nova side.

Change-Id: I305ea626a4b622c5534d523f4b619832f9d35f8d
---
 lib/nova    | 10 ++++++++++
 lib/tempest |  4 ++++
 2 files changed, 14 insertions(+)

diff --git a/lib/nova b/lib/nova
index 8e8ea8a175..63c6a86a66 100644
--- a/lib/nova
+++ b/lib/nova
@@ -97,6 +97,12 @@ NOVA_SERVICE_LISTEN_ADDRESS=${NOVA_SERVICE_LISTEN_ADDRESS:-$(ipv6_unquote $SERVI
 METADATA_SERVICE_PORT=${METADATA_SERVICE_PORT:-8775}
 NOVA_ENABLE_CACHE=${NOVA_ENABLE_CACHE:-True}
 
+# Flag to set the oslo_policy.enforce_scope and oslo_policy.enforce_new_defaults.
+# This is used to switch the compute API policies enable the scope and new defaults.
+# By Default, these flag are False.
+# For more detail: https://docs.openstack.org/oslo.policy/latest/configuration/index.html#oslo_policy.enforce_scope
+NOVA_ENFORCE_SCOPE=$(trueorfalse False NOVA_ENFORCE_SCOPE)
+
 if [[ $SERVICE_IP_VERSION == 6 ]]; then
     NOVA_MY_IP="$HOST_IPV6"
 else
@@ -481,6 +487,10 @@ function create_nova_conf {
             NOVA_ENABLED_APIS=$(echo $NOVA_ENABLED_APIS | sed "s/,metadata//")
         fi
         iniset $NOVA_CONF DEFAULT enabled_apis "$NOVA_ENABLED_APIS"
+        if [[ "$NOVA_ENFORCE_SCOPE" == "True" || "$ENFORCE_SCOPE" == "True" ]]; then
+            iniset $NOVA_CONF oslo_policy enforce_new_defaults True
+            iniset $NOVA_CONF oslo_policy enforce_scope True
+        fi
         if is_service_enabled tls-proxy && [ "$NOVA_USE_MOD_WSGI" == "False" ]; then
             # Set the service port for a proxy to take the original
             iniset $NOVA_CONF DEFAULT osapi_compute_listen_port "$NOVA_SERVICE_PORT_INT"
diff --git a/lib/tempest b/lib/tempest
index 87a2244784..b232f24540 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -674,6 +674,10 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG auth admin_project_name ''
     fi
 
+    if [[ "$NOVA_ENFORCE_SCOPE" == True || "$ENFORCE_SCOPE" == True ]] ; then
+        iniset $TEMPEST_CONFIG enforce_scope nova true
+    fi
+
     if [[ "$GLANCE_ENFORCE_SCOPE" == True || "$ENFORCE_SCOPE" == True ]] ; then
         iniset $TEMPEST_CONFIG enforce_scope glance true
     fi

From d00921a57bcd9b408817ac7feddfc49b49b9cea2 Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <frickler@offenerstapel.de>
Date: Mon, 14 Nov 2022 06:50:45 +0000
Subject: [PATCH 2097/2409] Revert "Make debian-bullseye job non-voting"

This reverts commit a4680766515ed9317b71cfb39cd0d75dc04f3d9c.

Reason for revert: Debian job got repaired

Change-Id: I3ef969f6e373de103d26c9282cab94cea7ae87e5
---
 .zuul.yaml | 2 --
 1 file changed, 2 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 1923444601..6dbb5bacbe 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -674,8 +674,6 @@
     description: Debian Bullseye platform test
     nodeset: devstack-single-node-debian-bullseye
     timeout: 9000
-    # TODO(danms) n-v until the known issue is resolved
-    voting: false
     vars:
       configure_swap_size: 4096
 

From 8d299efa4b6346ccfc3c6fcf9cf011b3c884bebc Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Sun, 9 Oct 2022 11:00:07 +0200
Subject: [PATCH 2098/2409] Switch devstack nodeset to Ubuntu 22.04 (jammy)

Depends-On: https://review.opendev.org/c/openstack/devstack-plugin-ceph/+/864948
Change-Id: I26b4784a4d772abbf8572f6273bda37f2fec5336
---
 .zuul.yaml | 54 +++++++++++++++++++++++++++++++++++++++---------------
 1 file changed, 39 insertions(+), 15 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 56acb37a03..76a70dc85c 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -168,6 +168,36 @@
         nodes:
           - compute1
 
+- nodeset:
+    name: openstack-two-node-jammy
+    nodes:
+      - name: controller
+        label: ubuntu-jammy
+      - name: compute1
+        label: ubuntu-jammy
+    groups:
+      # Node where tests are executed and test results collected
+      - name: tempest
+        nodes:
+          - controller
+      # Nodes running the compute service
+      - name: compute
+        nodes:
+          - controller
+          - compute1
+      # Nodes that are not the controller
+      - name: subnode
+        nodes:
+          - compute1
+      # Switch node for multinode networking setup
+      - name: switch
+        nodes:
+          - controller
+      # Peer nodes for multinode networking setup
+      - name: peers
+        nodes:
+          - compute1
+
 - nodeset:
     name: openstack-two-node-focal
     nodes:
@@ -455,7 +485,7 @@
     description: |
       Minimal devstack base job, intended for use by jobs that need
       less than the normal minimum set of required-projects.
-    nodeset: openstack-single-node-focal
+    nodeset: openstack-single-node-jammy
     required-projects:
       - opendev.org/openstack/requirements
     vars:
@@ -526,6 +556,7 @@
       - opendev.org/openstack/swift
     timeout: 7200
     vars:
+      configure_swap_size: 4096
       devstack_localrc:
         # Common OpenStack services settings
         SWIFT_REPLICAS: 1
@@ -651,7 +682,7 @@
 - job:
     name: devstack-multinode
     parent: devstack
-    nodeset: openstack-two-node-focal
+    nodeset: openstack-two-node-jammy
     description: |
       Simple multinode test to verify multinode functionality on devstack side.
       This is not meant to be used as a parent job.
@@ -669,8 +700,6 @@
     # TODO(kopecmartin) n-v until the following is resolved:
     # https://bugs.launchpad.net/neutron/+bug/1979047
     voting: false
-    vars:
-      configure_swap_size: 4096
 
 - job:
     name: devstack-platform-debian-bullseye
@@ -693,13 +722,11 @@
       configure_swap_size: 4096
 
 - job:
-    name: devstack-platform-ubuntu-jammy
+    name: devstack-platform-ubuntu-focal
     parent: tempest-full-py3
-    description: Ubuntu 22.04 LTS (jammy) platform test
-    nodeset: openstack-single-node-jammy
+    description: Ubuntu 20.04 LTS (focal) platform test
+    nodeset: openstack-single-node-focal
     timeout: 9000
-    vars:
-      configure_swap_size: 4096
 
 - job:
     name: devstack-platform-ubuntu-jammy-ovn-source
@@ -769,8 +796,6 @@
     description: Fedora latest platform test
     nodeset: devstack-single-node-fedora-latest
     voting: false
-    vars:
-      configure_swap_size: 4096
 
 - job:
     name: devstack-platform-fedora-latest-virt-preview
@@ -779,7 +804,6 @@
     nodeset: devstack-single-node-fedora-latest
     voting: false
     vars:
-      configure_swap_size: 4096
       devstack_localrc:
         ENABLE_FEDORA_VIRT_PREVIEW_REPO: true
 
@@ -839,7 +863,7 @@
 
 - job:
     name: devstack-unit-tests
-    nodeset: ubuntu-focal
+    nodeset: ubuntu-jammy
     description: |
       Runs unit tests on devstack project.
 
@@ -860,7 +884,7 @@
         - devstack-platform-centos-9-stream
         - devstack-platform-debian-bullseye
         - devstack-platform-rocky-blue-onyx
-        - devstack-platform-ubuntu-jammy
+        - devstack-platform-ubuntu-focal
         - devstack-platform-ubuntu-jammy-ovn-source
         - devstack-platform-ubuntu-jammy-ovs
         - devstack-multinode
@@ -910,7 +934,7 @@
         # https://bugs.launchpad.net/neutron/+bug/1979047
         # - devstack-platform-centos-9-stream
         - devstack-platform-debian-bullseye
-        - devstack-platform-ubuntu-jammy
+        - devstack-platform-ubuntu-focal
         - devstack-enforce-scope
         - devstack-multinode
         - devstack-unit-tests

From 818d1a225d54291d1da1f8011f92affb2998d0e9 Mon Sep 17 00:00:00 2001
From: Martin Kopec <mkopec@redhat.com>
Date: Mon, 28 Nov 2022 11:19:45 +0100
Subject: [PATCH 2099/2409] [doc] Update Ubuntu to 22.04

This updates documentation to reflect the switch to
Ubuntu 22.04 (jammy) in the CI:
https://review.opendev.org/c/openstack/devstack/+/860795

Change-Id: I8bee430029dcc719629bd92451c2791571f8a30c
---
 doc/source/index.rst | 2 +-
 tools/install_pip.sh | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/source/index.rst b/doc/source/index.rst
index ba53c6d279..3f206f411e 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -40,7 +40,7 @@ Start with a clean and minimal install of a Linux system. DevStack
 attempts to support the two latest LTS releases of Ubuntu, the
 latest/current Fedora version, CentOS/RHEL/Rocky Linux 9 and OpenSUSE.
 
-If you do not have a preference, Ubuntu 20.04 (Focal Fossa) is the
+If you do not have a preference, Ubuntu 22.04 (Jammy) is the
 most tested, and will probably go the smoothest.
 
 Add Stack User (optional)
diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index 7c5d4c6555..91b180c06f 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -139,7 +139,7 @@ if is_fedora && [[ ${DISTRO} == f* || ${DISTRO} == rhel9 ]]; then
     # recent enough anyway.  This is included via rpms/general
     : # Simply fall through
 elif is_ubuntu; then
-    # pip on Ubuntu 20.04 is new enough, too
+    # pip on Ubuntu 20.04 and higher is new enough, too
     # drop setuptools from u-c
     sed -i -e '/setuptools/d' $REQUIREMENTS_DIR/upper-constraints.txt
 else

From db3eff7dd27acdc973e8d189bda80d642be92f03 Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <tkajinam@redhat.com>
Date: Wed, 30 Nov 2022 14:03:36 +0900
Subject: [PATCH 2100/2409] Stop setting [ovs_vif_ovs] ovsdb_interface

The option was already deprecated in os-vif 2.2.0[1]. The override is
no longer required since bug 1929446 was already resolved.

[1] https://review.opendev.org/c/openstack/os-vif/+/744816

Related-Bug: #1929446
Change-Id: I5bc55723a178b32d947da2ac91d2f62aa8124990
---
 lib/os-vif | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/lib/os-vif b/lib/os-vif
index 865645c0d5..7c8bee3744 100644
--- a/lib/os-vif
+++ b/lib/os-vif
@@ -1,10 +1,5 @@
 #!/bin/bash
 
-# support vsctl or native.
-# until bug #1929446 is resolved we override the os-vif default
-# and fall back to the legacy "vsctl" driver.
-OS_VIF_OVS_OVSDB_INTERFACE=${OS_VIF_OVS_OVSDB_INTERFACE:="vsctl"}
-
 function is_ml2_ovs {
     if [[ "${Q_AGENT}" == "openvswitch" ]]; then
         echo "True"
@@ -19,11 +14,9 @@ OS_VIF_OVS_ISOLATE_VIF=$(trueorfalse False OS_VIF_OVS_ISOLATE_VIF)
 
 function configure_os_vif {
     if [[ -e ${NOVA_CONF} ]]; then
-        iniset ${NOVA_CONF} os_vif_ovs ovsdb_interface ${OS_VIF_OVS_OVSDB_INTERFACE}
         iniset ${NOVA_CONF} os_vif_ovs isolate_vif ${OS_VIF_OVS_ISOLATE_VIF}
     fi
     if [[ -e ${NEUTRON_CONF} ]]; then
-        iniset ${NEUTRON_CONF} os_vif_ovs ovsdb_interface ${OS_VIF_OVS_OVSDB_INTERFACE}
         iniset ${NEUTRON_CONF} os_vif_ovs isolate_vif ${OS_VIF_OVS_ISOLATE_VIF}
     fi
 }

From 16c2b389ed8efca70fa1e65395becdaea84f8b44 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Wed, 30 Nov 2022 14:24:07 -0600
Subject: [PATCH 2101/2409] Add RBAC scope and new defaults setting support for
 placement

Adding devstack flag to enable and test the Placement API policies
scope and new defaults.

Depends-On: https://review.opendev.org/c/openstack/tempest/+/866212
Change-Id: I6f56fc28f2c1e4cdde946deb2ae06afddf85ff0d
---
 lib/placement | 10 ++++++++++
 lib/tempest   |  4 ++++
 2 files changed, 14 insertions(+)

diff --git a/lib/placement b/lib/placement
index b7798669a1..bc22c564f4 100644
--- a/lib/placement
+++ b/lib/placement
@@ -48,6 +48,12 @@ fi
 PLACEMENT_SERVICE_PROTOCOL=${PLACEMENT_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 PLACEMENT_SERVICE_HOST=${PLACEMENT_SERVICE_HOST:-$SERVICE_HOST}
 
+# Flag to set the oslo_policy.enforce_scope and oslo_policy.enforce_new_defaults.
+# This is used to switch the Placement API policies scope and new defaults.
+# By Default, these flag are False.
+# For more detail: https://docs.openstack.org/oslo.policy/latest/configuration/index.html#oslo_policy.enforce_scope
+PLACEMENT_ENFORCE_SCOPE=$(trueorfalse False PLACEMENT_ENFORCE_SCOPE)
+
 # Functions
 # ---------
 
@@ -111,6 +117,10 @@ function configure_placement {
     else
         _config_placement_apache_wsgi
     fi
+    if [[ "$PLACEMENT_ENFORCE_SCOPE" == "True" || "$ENFORCE_SCOPE" == "True" ]]; then
+        iniset $PLACEMENT_CONF oslo_policy enforce_new_defaults True
+        iniset $PLACEMENT_CONF oslo_policy enforce_scope True
+    fi
 }
 
 # create_placement_accounts() - Set up required placement accounts
diff --git a/lib/tempest b/lib/tempest
index b232f24540..5cd4d18439 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -678,6 +678,10 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG enforce_scope nova true
     fi
 
+    if [[ "$PLACEMENT_ENFORCE_SCOPE" == True || "$ENFORCE_SCOPE" == True ]] ; then
+        iniset $TEMPEST_CONFIG enforce_scope placement true
+    fi
+
     if [[ "$GLANCE_ENFORCE_SCOPE" == True || "$ENFORCE_SCOPE" == True ]] ; then
         iniset $TEMPEST_CONFIG enforce_scope glance true
     fi

From 6440c6d7e69c6726c8d31ea225b90967c50528e8 Mon Sep 17 00:00:00 2001
From: wangxiyuan <wangxiyuan1007@gmail.com>
Date: Fri, 5 Aug 2022 14:18:13 +0800
Subject: [PATCH 2102/2409] Add openEuler 22.03 LTS support

openEuler 20.03 LTS SP2 support was removed from devstack in last
few months due to its python version is too old and the CI job
always fail. And openEuler 20.03 LTS SP2 was out of maintainer in May
2022 by openEuler community.

The newest LTS version was released in March 2022 called 22.03 LTS.
This release will be maintained for at least 2 years. And the python
version is 3.9 which works well for devstack.

This Patch add the openEuler distro support back. And add the related
CI job to make sure its works well.

Change-Id: I99c99d08b4a44d3dc644bd2e56b5ae7f7ee44210
---
 .zuul.yaml                             | 72 ++++++++++++++++++++++++++
 doc/source/index.rst                   |  3 +-
 files/rpms/ceph                        |  2 +-
 files/rpms/general                     |  4 +-
 files/rpms/nova                        |  2 +-
 functions-common                       | 13 ++++-
 lib/apache                             |  2 +-
 lib/nova_plugins/functions-libvirt     |  8 ++-
 roles/apache-logs-conf/tasks/main.yaml |  1 +
 stack.sh                               | 11 +++-
 10 files changed, 109 insertions(+), 9 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 471ca100c8..8e20f6ed34 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -108,6 +108,16 @@
         nodes:
           - controller
 
+- nodeset:
+    name: devstack-single-node-openeuler-22.03
+    nodes:
+      - name: controller
+        label: openEuler-22-03-LTS
+    groups:
+      - name: tempest
+        nodes:
+          - controller
+
 - nodeset:
     name: openstack-two-node
     nodes:
@@ -777,6 +787,62 @@
           # Enable Neutron ML2/OVS services
           q-agt: true
 
+- job:
+    name: devstack-platform-openEuler-22.03-ovn-source
+    parent: tempest-full-py3
+    description: openEuler 22.03 LTS platform test (OVN)
+    nodeset: devstack-single-node-openeuler-22.03
+    voting: false
+    timeout: 9000
+    vars:
+      configure_swap_size: 4096
+      devstack_localrc:
+        # NOTE(wxy):  OVN package is not supported by openEuler yet. Build it
+        # from source instead.
+        OVN_BUILD_FROM_SOURCE: True
+        OVN_BRANCH: "v21.06.0"
+        OVS_BRANCH: "a4b04276ab5934d087669ff2d191a23931335c87"
+        OVS_SYSCONFDIR: "/usr/local/etc/openvswitch"
+
+- job:
+    name: devstack-platform-openEuler-22.03-ovs
+    parent: tempest-full-py3
+    description: openEuler 22.03 LTS platform test (OVS)
+    nodeset: devstack-single-node-openeuler-22.03
+    voting: false
+    timeout: 9000
+    vars:
+      configure_swap_size: 8192
+      devstack_localrc:
+        Q_AGENT: openvswitch
+        Q_ML2_PLUGIN_MECHANISM_DRIVERS: openvswitch
+        Q_ML2_TENANT_NETWORK_TYPE: vxlan
+      devstack_services:
+        # Disable OVN services
+        ovn-northd: false
+        ovn-controller: false
+        ovs-vswitchd: false
+        ovsdb-server: false
+        # Disable Neutron ML2/OVN services
+        q-ovn-metadata-agent: false
+        # Enable Neutron ML2/OVS services
+        q-agt: true
+        q-dhcp: true
+        q-l3: true
+        q-meta: true
+        q-metering: true
+    group-vars:
+      subnode:
+        devstack_services:
+          # Disable OVN services
+          ovn-controller: false
+          ovs-vswitchd: false
+          ovsdb-server: false
+          # Disable Neutron ML2/OVN services
+          q-ovn-metadata-agent: false
+          # Enable Neutron ML2/OVS services
+          q-agt: true
+
 - job:
     name: devstack-no-tls-proxy
     parent: tempest-full-py3
@@ -885,6 +951,8 @@
         - devstack-platform-ubuntu-focal
         - devstack-platform-ubuntu-jammy-ovn-source
         - devstack-platform-ubuntu-jammy-ovs
+        - devstack-platform-openEuler-22.03-ovn-source
+        - devstack-platform-openEuler-22.03-ovs
         - devstack-multinode
         - devstack-unit-tests
         - openstack-tox-bashate
@@ -1017,3 +1085,7 @@
     periodic:
       jobs:
         - devstack-no-tls-proxy
+    periodic-weekly:
+      jobs:
+        - devstack-platform-openEuler-22.03-ovn-source
+        - devstack-platform-openEuler-22.03-ovs
diff --git a/doc/source/index.rst b/doc/source/index.rst
index 3f206f411e..1e932f88a5 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -38,7 +38,8 @@ Install Linux
 
 Start with a clean and minimal install of a Linux system. DevStack
 attempts to support the two latest LTS releases of Ubuntu, the
-latest/current Fedora version, CentOS/RHEL/Rocky Linux 9 and OpenSUSE.
+latest/current Fedora version, CentOS/RHEL/Rocky Linux 9, OpenSUSE and
+openEuler.
 
 If you do not have a preference, Ubuntu 22.04 (Jammy) is the
 most tested, and will probably go the smoothest.
diff --git a/files/rpms/ceph b/files/rpms/ceph
index 33a55f80ea..19f158fd57 100644
--- a/files/rpms/ceph
+++ b/files/rpms/ceph
@@ -1,3 +1,3 @@
 ceph    # NOPRIME
-redhat-lsb-core # not:rhel9
+redhat-lsb-core # not:rhel9,openEuler-22.03
 xfsprogs
diff --git a/files/rpms/general b/files/rpms/general
index 7697513149..b6866de62d 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -26,9 +26,9 @@ pkgconfig
 postgresql-devel  # psycopg2
 psmisc
 python3-devel
-python3-pip
+python3-pip # not:openEuler-22.03
 python3-systemd
-redhat-rpm-config # missing dep for gcc hardening flags, see rhbz#1217376
+redhat-rpm-config # not:openEuler-22.03  missing dep for gcc hardening flags, see rhbz#1217376
 tar
 tcpdump
 unzip
diff --git a/files/rpms/nova b/files/rpms/nova
index f2824ee2c4..e0f13b854a 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -4,7 +4,7 @@ ebtables
 genisoimage # not:rhel9 required for config_drive
 iptables
 iputils
-kernel-modules
+kernel-modules # not:openEuler-22.03
 kpartx
 parted
 polkit
diff --git a/functions-common b/functions-common
index 0aee5d163e..4eed5d8407 100644
--- a/functions-common
+++ b/functions-common
@@ -399,7 +399,7 @@ function _ensure_lsb_release {
     elif [[ -x $(command -v zypper 2>/dev/null) ]]; then
         sudo zypper -n install lsb-release
     elif [[ -x $(command -v dnf 2>/dev/null) ]]; then
-        sudo dnf install -y redhat-lsb-core
+        sudo dnf install -y redhat-lsb-core || sudo dnf install -y openeuler-lsb
     else
         die $LINENO "Unable to find or auto-install lsb_release"
     fi
@@ -474,6 +474,8 @@ function GetDistro {
         # Drop the . release as we assume it's compatible
         # XXX re-evaluate when we get RHEL10
         DISTRO="rhel${os_RELEASE::1}"
+    elif [[ "$os_VENDOR" =~ (openEuler) ]]; then
+        DISTRO="openEuler-$os_RELEASE"
     else
         # We can't make a good choice here.  Setting a sensible DISTRO
         # is part of the problem, but not the major issue -- we really
@@ -525,6 +527,7 @@ function is_fedora {
     fi
 
     [ "$os_VENDOR" = "Fedora" ] || [ "$os_VENDOR" = "Red Hat" ] || \
+        [ "$os_VENDOR" = "openEuler" ] || \
         [ "$os_VENDOR" = "RedHatEnterpriseServer" ] || \
         [ "$os_VENDOR" = "RedHatEnterprise" ] || \
         [ "$os_VENDOR" = "Rocky" ] || \
@@ -575,6 +578,14 @@ function is_ubuntu {
     [ "$os_PACKAGE" = "deb" ]
 }
 
+# Determine if current distribution is an openEuler distribution
+# is_openeuler
+function is_openeuler {
+    if [[ -z "$os_PACKAGE" ]]; then
+        GetOSVersion
+    fi
+    [ "$os_VENDOR" = "openEuler" ]
+}
 # Git Functions
 # =============
 
diff --git a/lib/apache b/lib/apache
index 705776c55b..dd8c9a0f06 100644
--- a/lib/apache
+++ b/lib/apache
@@ -95,7 +95,7 @@ function install_apache_uwsgi {
     # didn't fix Python 3.10 compatibility before release.  Should be
     # fixed in uwsgi 4.9.0; can remove this when packages available
     # or we drop this release
-    elif is_fedora && ! [[ $DISTRO =~ f36 ]]; then
+    elif is_fedora && ! is_openeuler && ! [[ $DISTRO =~ f36 ]]; then
         # Note httpd comes with mod_proxy_uwsgi and it is loaded by
         # default; the mod_proxy_uwsgi package actually conflicts now.
         # See:
diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index 3e7d2801d6..c0e45ebb85 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -82,11 +82,17 @@ function install_libvirt {
             sudo dnf copr enable -y @virtmaint-sig/virt-preview
         fi
 
+        if is_openeuler; then
+            qemu_package=qemu
+        else
+            qemu_package=qemu-kvm
+        fi
+
         # Note that in CentOS/RHEL this needs to come from the RDO
         # repositories (qemu-kvm-ev ... which provides this package)
         # as the base system version is too old.  We should have
         # pre-installed these
-        install_package qemu-kvm
+        install_package $qemu_package
         install_package libvirt libvirt-devel python3-libvirt
 
         if is_arch "aarch64"; then
diff --git a/roles/apache-logs-conf/tasks/main.yaml b/roles/apache-logs-conf/tasks/main.yaml
index bd64574c9b..6b7ea37857 100644
--- a/roles/apache-logs-conf/tasks/main.yaml
+++ b/roles/apache-logs-conf/tasks/main.yaml
@@ -64,6 +64,7 @@
       'Debian': '/etc/apache2/sites-enabled/'
       'Suse': '/etc/apache2/conf.d/'
       'RedHat': '/etc/httpd/conf.d/'
+      'openEuler': '/etc/httpd/conf.d/'
 
 - name: Discover configurations
   find:
diff --git a/stack.sh b/stack.sh
index cc90fca576..28576d1e14 100755
--- a/stack.sh
+++ b/stack.sh
@@ -229,7 +229,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-SUPPORTED_DISTROS="bullseye|focal|jammy|f36|opensuse-15.2|opensuse-tumbleweed|rhel8|rhel9"
+SUPPORTED_DISTROS="bullseye|focal|jammy|f36|opensuse-15.2|opensuse-tumbleweed|rhel8|rhel9|openEuler-22.03"
 
 if [[ ! ${DISTRO} =~ $SUPPORTED_DISTROS ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
@@ -394,6 +394,15 @@ elif [[ $DISTRO == "rhel9" ]]; then
     sudo dnf config-manager --set-enabled crb
     # rabbitmq and other packages are provided by RDO repositories.
     _install_rdo
+elif [[ $DISTRO == "openEuler-22.03" ]]; then
+    # There are some problem in openEuler. We should fix it first. Some required
+    # package/action runs before fixup script. So we can't fix there.
+    #
+    # 1. the hostname package is not installed by default
+    # 2. Some necessary packages are in openstack repo, for example liberasurecode-devel
+    # 3. python3-pip can be uninstalled by `get_pip.py` automaticly.
+    install_package hostname openstack-release-wallaby
+    uninstall_package python3-pip
 fi
 
 # Ensure python is installed

From 0a40648b3884c374e314105c33c2a20c85ab2f7f Mon Sep 17 00:00:00 2001
From: Miguel Lavalle <mlavalle@redhat.com>
Date: Wed, 7 Dec 2022 16:51:28 -0600
Subject: [PATCH 2103/2409] Fix the db user for mariadb in ubuntu 22.04

In Ubuntu 22.04, mariadb version 10.6 is installed. Per [0] and [1]
authentication management was changed in version 10.4. This change
adapts the way the db user is created to the new rules in versions
10.4 and later.

[0] https://mariadb.com/kb/en/authentication-from-mariadb-104/
[1] https://mariadb.org/authentication-in-mariadb-10-4/

Closes-Bug: #1999090
Change-Id: I77a699a9e191eb83628ad5d361282e66744b6e4a
---
 lib/databases/mysql | 29 +++++++++++++++++++++--------
 1 file changed, 21 insertions(+), 8 deletions(-)

diff --git a/lib/databases/mysql b/lib/databases/mysql
index b292da25bd..fbad44e36a 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -100,8 +100,13 @@ function configure_database_mysql {
 
     # Set the root password - only works the first time. For Ubuntu, we already
     # did that with debconf before installing the package, but we still try,
-    # because the package might have been installed already.
-    sudo mysqladmin -u root password $DATABASE_PASSWORD || true
+    # because the package might have been installed already. We don't do this
+    # for Ubuntu 22.04 (jammy) because the authorization model change in
+    # version 10.4 of mariadb. See
+    # https://mariadb.org/authentication-in-mariadb-10-4/
+    if ! (is_ubuntu && [[ "$DISTRO" == "jammy" ]] && [ "$MYSQL_SERVICE_NAME" == "mariadb" ]); then
+        sudo mysqladmin -u root password $DATABASE_PASSWORD || true
+    fi
 
     # In case of Mariadb, giving hostname in arguments causes permission
     # problems as it expects connection through socket
@@ -115,13 +120,21 @@ function configure_database_mysql {
     # as root so it works only as sudo. To restore old "mysql like" behaviour,
     # we need to change auth plugin for root user
     if is_ubuntu && [[ "$DISTRO" != "bullseye" ]] && [ "$MYSQL_SERVICE_NAME" == "mariadb" ]; then
-        sudo mysql $cmd_args -e "UPDATE mysql.user SET plugin='' WHERE user='$DATABASE_USER' AND host='localhost';"
-        sudo mysql $cmd_args -e "FLUSH PRIVILEGES;"
+        if [[ "$DISTRO" == "jammy" ]]; then
+            # For Ubuntu 22.04 (jammy) we follow the model outlined in
+            # https://mariadb.org/authentication-in-mariadb-10-4/
+            sudo mysql -e "ALTER USER $DATABASE_USER@localhost IDENTIFIED VIA mysql_native_password USING PASSWORD('$DATABASE_PASSWORD');"
+        else
+            sudo mysql $cmd_args -e "UPDATE mysql.user SET plugin='' WHERE user='$DATABASE_USER' AND host='localhost';"
+            sudo mysql $cmd_args -e "FLUSH PRIVILEGES;"
+        fi
+    fi
+    if ! (is_ubuntu && [[ "$DISTRO" == "jammy" ]] && [ "$MYSQL_SERVICE_NAME" == "mariadb" ]); then
+        # Create DB user if it does not already exist
+        sudo mysql $cmd_args -e "CREATE USER IF NOT EXISTS '$DATABASE_USER'@'%' identified by '$DATABASE_PASSWORD';"
+        # Update the DB to give user '$DATABASE_USER'@'%' full control of the all databases:
+        sudo mysql $cmd_args -e "GRANT ALL PRIVILEGES ON *.* TO '$DATABASE_USER'@'%';"
     fi
-    # Create DB user if it does not already exist
-    sudo mysql $cmd_args -e "CREATE USER IF NOT EXISTS '$DATABASE_USER'@'%' identified by '$DATABASE_PASSWORD';"
-    # Update the DB to give user '$DATABASE_USER'@'%' full control of the all databases:
-    sudo mysql $cmd_args -e "GRANT ALL PRIVILEGES ON *.* TO '$DATABASE_USER'@'%';"
 
     # Now update ``my.cnf`` for some local needs and restart the mysql service
 

From 30acfc6d14bb42db822352426cc2d4e337717c72 Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Thu, 24 Nov 2022 14:12:08 +0100
Subject: [PATCH 2104/2409] [neutron] Don't configure firewall_driver for core
 ML2 plugin

In the past firewall_driver setting was configured for ML2 plugin
because it was used in the
neutron.agent.securitygroups_rpc.is_firewall_enabled() function but
currently it's not needed anymore as there is other config option
"enable_security_group" for that.

Related-bug: #1996748
Change-Id: I9b09c6afb3f1f1c33d1bdfea52ba6f4c0d0cf2dc
---
 lib/neutron_plugins/ml2 | 13 +------------
 1 file changed, 1 insertion(+), 12 deletions(-)

diff --git a/lib/neutron_plugins/ml2 b/lib/neutron_plugins/ml2
index fa61f1ea30..46edacdc54 100644
--- a/lib/neutron_plugins/ml2
+++ b/lib/neutron_plugins/ml2
@@ -111,18 +111,7 @@ function neutron_plugin_configure_service {
             fi
         fi
     fi
-    # REVISIT(rkukura): Setting firewall_driver here for
-    # neutron.agent.securitygroups_rpc.is_firewall_enabled() which is
-    # used in the server, in case no L2 agent is configured on the
-    # server's node. If an L2 agent is configured, this will get
-    # overridden with the correct driver. The ml2 plugin should
-    # instead use its own config variable to indicate whether security
-    # groups is enabled, and that will need to be set here instead.
-    if [[ "$Q_USE_SECGROUP" == "True" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver neutron.agent.not.a.real.FirewallDriver
-    else
-        iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver neutron.agent.firewall.NoopFirewallDriver
-    fi
+    populate_ml2_config /$Q_PLUGIN_CONF_FILE securitygroup enable_security_group=$Q_USE_SECGROUP
 
     populate_ml2_config /$Q_PLUGIN_CONF_FILE ml2 mechanism_drivers=$Q_ML2_PLUGIN_MECHANISM_DRIVERS
     if [[ "$Q_ML2_PLUGIN_MECHANISM_DRIVERS" == *"linuxbridge"* ]]; then

From 9a1be7794bd3b1b06a89183a800f42f77cd1b1b9 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Thu, 8 Dec 2022 20:24:46 -0600
Subject: [PATCH 2105/2409] Pin tox<4.0.0 for <=stable/zed branch testing

Tox 4.0.0 has some incompatible changes, epecially more
strict on allowlist_externals. Tempest recently changed
allowlist_externals not to be *[1] causing the failure
on jobs where lib/tempest failing to run the tempest
as command in virtual env.

----------
venv: commands[0]> tempest verify-config -uro /tmp/tmp.qH5KgJHTF4
venv: failed with tempest is not allowed, use allowlist_externals to allow it
------

We do not need to test/fix the <=stable/zed branches with tox 4.0.0
and pinning them with the compatible tox version of the time stable
brnaches were releaased is better way.

This commit proposes:
1. Pinning the tox<4.0.0 for <=stable/ze branches testing
2. Workaround to unblock the master gate by pinning it <4.0.0 but
we should make our testing compatible with tox 4.0.0 soon.

Depends-On: https://review.opendev.org/c/openstack/devstack/+/867066

Related-Bug: #1999183

[1] https://review.opendev.org/c/openstack/tempest/+/865314 devstack based job started failing to run tempest command on venv.

Change-Id: I9a138af94dedc0d8ce5a0d519d75779415d3c30b
---
 lib/tempest            | 7 ++++++-
 playbooks/tox/pre.yaml | 8 +++++++-
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index b232f24540..ec2949ac38 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -779,7 +779,12 @@ function configure_tempest {
 # install_tempest() - Collect source and prepare
 function install_tempest {
     git_clone $TEMPEST_REPO $TEMPEST_DIR $TEMPEST_BRANCH
-    pip_install 'tox!=2.8.0'
+    # NOTE(gmann): Pinning tox<4.0.0 for stable/zed and lower. Tox 4.0.0
+    # released after zed was released and has some incompatible changes
+    # and it is ok not to fix the issues caused by tox 4.0.0 in stable
+    # beanches jobs. We can continue testing the stable/zed and lower
+    # branches with tox<4.0.0
+    pip_install 'tox!=2.8.0,<4.0.0'
     pushd $TEMPEST_DIR
     # NOTE(gmann): checkout the TEMPEST_BRANCH in case TEMPEST_BRANCH
     # is tag name not master. git_clone would not checkout tag because
diff --git a/playbooks/tox/pre.yaml b/playbooks/tox/pre.yaml
index d7e4670a80..68d5254251 100644
--- a/playbooks/tox/pre.yaml
+++ b/playbooks/tox/pre.yaml
@@ -5,4 +5,10 @@
       bindep_profile: test
       bindep_dir: "{{ zuul_work_dir }}"
     - test-setup
-    - ensure-tox
+    # NOTE(gmann): Pinning tox<4.0.0 for stable/zed and lower. Tox 4.0.0
+    # released after zed was released and has some incompatible changes
+    # and it is ok not to fix the issues caused by tox 4.0.0 in stable
+    # beanches jobs. We can continue testing the stable/zed and lower
+    # branches with tox<4.0.0
+    - role: ensure-tox
+      ensure_tox_version: "<4"

From a52041cd3f067156e478e355f5712a60e12ce649 Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Fri, 18 Nov 2022 11:39:56 +0100
Subject: [PATCH 2106/2409] Drop lib/neutron module

Module lib/neutron was introduced long time ago as new module to deploy
neutron. It was intended to replace old lib/neutron-legacy module. But
since very long time it wasn't really finished and used by anyone and
lib/neutron-legacy is defacto standard module used by everyone to deploy
neutron with devstack.
In [1] unfinished lib/neutron was deprecated and now it's time to remove
it from the devstack code.

This patch also renames old "lib/neutron-legacy" module to be
"lib/neutron" now.

Previously "old" lib/neutron-legacy module was accepting neutron
services names wit "q-" prefix and "new" lib/neutron module was accepting
services with "neutron-" prefix. Now, as there is only one module it
accepts both prefixes.
For historical reasons and to be consistent with old lib/neutron-legacy
which was widely used everywhere, services will be named with "q-"
prefix but both prefixes will be accepted to enable or disable services.

This patch also moves _configure_neutron_service function to be called
at the end of the "configure_neutron" after all agents and service
plugins are already configured.

[1] https://review.opendev.org/c/openstack/devstack/+/823653

Related-bug: #1996748

Change-Id: Ibf1c8b2ee6b6618f77cd8486e9c687993d7cb4a0
---
 clean.sh                                 |    1 -
 lib/neutron                              | 1438 ++++++++++++++--------
 lib/neutron-legacy                       | 1097 +----------------
 lib/neutron_plugins/README.md            |    2 +-
 lib/neutron_plugins/bigswitch_floodlight |    2 +-
 lib/neutron_plugins/brocade              |    2 +-
 lib/neutron_plugins/linuxbridge_agent    |    2 +-
 lib/neutron_plugins/ml2                  |    2 +-
 lib/neutron_plugins/openvswitch_agent    |    2 +-
 lib/neutron_plugins/ovn_agent            |   18 +-
 lib/neutron_plugins/services/l3          |    4 +-
 lib/neutron_plugins/services/metering    |    2 +-
 lib/neutron_plugins/services/qos         |    2 +-
 lib/tempest                              |    4 +-
 14 files changed, 933 insertions(+), 1645 deletions(-)

diff --git a/clean.sh b/clean.sh
index 870dfd4313..6a31cc624a 100755
--- a/clean.sh
+++ b/clean.sh
@@ -50,7 +50,6 @@ source $TOP_DIR/lib/placement
 source $TOP_DIR/lib/cinder
 source $TOP_DIR/lib/swift
 source $TOP_DIR/lib/neutron
-source $TOP_DIR/lib/neutron-legacy
 
 set -o xtrace
 
diff --git a/lib/neutron b/lib/neutron
index b3e3d72e8c..c8ee8c5e76 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -1,128 +1,311 @@
 #!/bin/bash
 #
 # lib/neutron
-# Install and start **Neutron** network services
+# functions - functions specific to neutron
 
 # Dependencies:
-#
 # ``functions`` file
 # ``DEST`` must be defined
+# ``STACK_USER`` must be defined
 
 # ``stack.sh`` calls the entry points in this order:
 #
-# - is_XXXX_enabled
-# - install_XXXX
-# - configure_XXXX
-# - init_XXXX
-# - start_XXXX
-# - stop_XXXX
-# - cleanup_XXXX
+# - install_neutron_agent_packages
+# - install_neutronclient
+# - install_neutron
+# - install_neutron_third_party
+# - configure_neutron
+# - init_neutron
+# - configure_neutron_third_party
+# - init_neutron_third_party
+# - start_neutron_third_party
+# - create_nova_conf_neutron
+# - configure_neutron_after_post_config
+# - start_neutron_service_and_check
+# - check_neutron_third_party_integration
+# - start_neutron_agents
+# - create_neutron_initial_network
+#
+# ``unstack.sh`` calls the entry points in this order:
+#
+# - stop_neutron
+# - stop_neutron_third_party
+# - cleanup_neutron
 
-# Save trace setting
-XTRACE=$(set +o | grep xtrace)
-set +o xtrace
+# Functions in lib/neutron are classified into the following categories:
+#
+# - entry points (called from stack.sh or unstack.sh)
+# - internal functions
+# - neutron exercises
+# - 3rd party programs
 
-# Defaults
+
+# Neutron Networking
+# ------------------
+
+# Make sure that neutron is enabled in ``ENABLED_SERVICES``.  If you want
+# to run Neutron on this host, make sure that q-svc is also in
+# ``ENABLED_SERVICES``.
+#
+# See "Neutron Network Configuration" below for additional variables
+# that must be set in localrc for connectivity across hosts with
+# Neutron.
+
+# Settings
 # --------
 
+
+# Neutron Network Configuration
+# -----------------------------
+
+if is_service_enabled tls-proxy; then
+    Q_PROTOCOL="https"
+fi
+
+
 # Set up default directories
 GITDIR["python-neutronclient"]=$DEST/python-neutronclient
 
+
+NEUTRON_DIR=$DEST/neutron
+NEUTRON_FWAAS_DIR=$DEST/neutron-fwaas
+
+# Support entry points installation of console scripts
+if [[ -d $NEUTRON_DIR/bin/neutron-server ]]; then
+    NEUTRON_BIN_DIR=$NEUTRON_DIR/bin
+else
+    NEUTRON_BIN_DIR=$(get_python_exec_prefix)
+fi
+
+NEUTRON_CONF_DIR=/etc/neutron
+NEUTRON_CONF=$NEUTRON_CONF_DIR/neutron.conf
+export NEUTRON_TEST_CONFIG_FILE=${NEUTRON_TEST_CONFIG_FILE:-"$NEUTRON_CONF_DIR/debug.ini"}
+
 # NEUTRON_DEPLOY_MOD_WSGI defines how neutron is deployed, allowed values:
 # - False (default) : Run neutron under Eventlet
 # - True : Run neutron under uwsgi
 # TODO(annp): Switching to uwsgi in next cycle if things turn out to be stable
 # enough
 NEUTRON_DEPLOY_MOD_WSGI=$(trueorfalse False NEUTRON_DEPLOY_MOD_WSGI)
-NEUTRON_AGENT=${NEUTRON_AGENT:-openvswitch}
-NEUTRON_DIR=$DEST/neutron
+
+NEUTRON_UWSGI_CONF=$NEUTRON_CONF_DIR/neutron-api-uwsgi.ini
 
 # If NEUTRON_ENFORCE_SCOPE == True, it will set "enforce_scope"
 # and "enforce_new_defaults" to True in the Neutron's config to enforce usage
 # of the new RBAC policies and scopes.
 NEUTRON_ENFORCE_SCOPE=$(trueorfalse False NEUTRON_ENFORCE_SCOPE)
 
-NEUTRON_DISTRIBUTED_ROUTING=$(trueorfalse False NEUTRON_DISTRIBUTED_ROUTING)
-# Distributed Virtual Router (DVR) configuration
-# Can be:
-# - ``legacy``          - No DVR functionality
-# - ``dvr_snat``        - Controller or single node DVR
-# - ``dvr``             - Compute node in multi-node DVR
-# - ``dvr_no_external`` - Compute node in multi-node DVR, no external network
-#
-# Default is 'dvr_snat' since it can handle both DVR and legacy routers
-NEUTRON_DVR_MODE=${NEUTRON_DVR_MODE:-dvr_snat}
-
-NEUTRON_BIN_DIR=$(get_python_exec_prefix)
-NEUTRON_DHCP_BINARY="neutron-dhcp-agent"
-
-NEUTRON_CONF_DIR=/etc/neutron
-NEUTRON_CONF=$NEUTRON_CONF_DIR/neutron.conf
-NEUTRON_META_CONF=$NEUTRON_CONF_DIR/metadata_agent.ini
-NEUTRON_META_DATA_HOST=${NEUTRON_META_DATA_HOST:-$(ipv6_unquote $SERVICE_HOST)}
-
-NEUTRON_DHCP_CONF=$NEUTRON_CONF_DIR/dhcp_agent.ini
-NEUTRON_L3_CONF=$NEUTRON_CONF_DIR/l3_agent.ini
-NEUTRON_AGENT_CONF=$NEUTRON_CONF_DIR/
-NEUTRON_CREATE_INITIAL_NETWORKS=${NEUTRON_CREATE_INITIAL_NETWORKS:-True}
+# Agent binaries.  Note, binary paths for other agents are set in per-service
+# scripts in lib/neutron_plugins/services/
+AGENT_DHCP_BINARY="$NEUTRON_BIN_DIR/neutron-dhcp-agent"
+AGENT_L3_BINARY=${AGENT_L3_BINARY:-"$NEUTRON_BIN_DIR/neutron-l3-agent"}
+AGENT_META_BINARY="$NEUTRON_BIN_DIR/neutron-metadata-agent"
+
+# Agent config files. Note, plugin-specific Q_PLUGIN_CONF_FILE is set and
+# loaded from per-plugin  scripts in lib/neutron_plugins/
+Q_DHCP_CONF_FILE=$NEUTRON_CONF_DIR/dhcp_agent.ini
+# NOTE(slaweq): NEUTRON_DHCP_CONF is used e.g. in neutron repository,
+# it was previously defined in the lib/neutron module which is now deleted.
+NEUTRON_DHCP_CONF=$Q_DHCP_CONF_FILE
+Q_L3_CONF_FILE=$NEUTRON_CONF_DIR/l3_agent.ini
+# NOTE(slaweq): NEUTRON_L3_CONF is used e.g. in neutron repository,
+# it was previously defined in the lib/neutron module which is now deleted.
+NEUTRON_L3_CONF=$Q_L3_CONF_FILE
+Q_META_CONF_FILE=$NEUTRON_CONF_DIR/metadata_agent.ini
+
+# Default name for Neutron database
+Q_DB_NAME=${Q_DB_NAME:-neutron}
+# Default Neutron Plugin
+Q_PLUGIN=${Q_PLUGIN:-ml2}
+# Default Neutron Port
+Q_PORT=${Q_PORT:-9696}
+# Default Neutron Internal Port when using TLS proxy
+Q_PORT_INT=${Q_PORT_INT:-19696}
+# Default Neutron Host
+Q_HOST=${Q_HOST:-$SERVICE_HOST}
+# Default protocol
+Q_PROTOCOL=${Q_PROTOCOL:-$SERVICE_PROTOCOL}
+# Default listen address
+Q_LISTEN_ADDRESS=${Q_LISTEN_ADDRESS:-$(ipv6_unquote $SERVICE_LISTEN_ADDRESS)}
+# Default admin username
+Q_ADMIN_USERNAME=${Q_ADMIN_USERNAME:-neutron}
+# Default auth strategy
+Q_AUTH_STRATEGY=${Q_AUTH_STRATEGY:-keystone}
+# RHEL's support for namespaces requires using veths with ovs
+Q_OVS_USE_VETH=${Q_OVS_USE_VETH:-False}
+Q_USE_ROOTWRAP=${Q_USE_ROOTWRAP:-True}
+Q_USE_ROOTWRAP_DAEMON=$(trueorfalse True Q_USE_ROOTWRAP_DAEMON)
+# Meta data IP
+Q_META_DATA_IP=${Q_META_DATA_IP:-$(ipv6_unquote $SERVICE_HOST)}
+# Allow Overlapping IP among subnets
+Q_ALLOW_OVERLAPPING_IP=${Q_ALLOW_OVERLAPPING_IP:-True}
+Q_NOTIFY_NOVA_PORT_STATUS_CHANGES=${Q_NOTIFY_NOVA_PORT_STATUS_CHANGES:-True}
+Q_NOTIFY_NOVA_PORT_DATA_CHANGES=${Q_NOTIFY_NOVA_PORT_DATA_CHANGES:-True}
+VIF_PLUGGING_IS_FATAL=${VIF_PLUGGING_IS_FATAL:-True}
+VIF_PLUGGING_TIMEOUT=${VIF_PLUGGING_TIMEOUT:-300}
+
+# Allow to skip stopping of OVN services
+SKIP_STOP_OVN=${SKIP_STOP_OVN:-False}
+
+# The directory which contains files for Q_PLUGIN_EXTRA_CONF_FILES.
+# /etc/neutron is assumed by many of devstack plugins.  Do not change.
+_Q_PLUGIN_EXTRA_CONF_PATH=/etc/neutron
 
-NEUTRON_STATE_PATH=${NEUTRON_STATE_PATH:=$DATA_DIR/neutron}
+# The name of the service in the endpoint URL
+NEUTRON_ENDPOINT_SERVICE_NAME=${NEUTRON_ENDPOINT_SERVICE_NAME-"networking"}
+if [[ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" && -z "$NEUTRON_ENDPOINT_SERVICE_NAME" ]]; then
+    NEUTRON_ENDPOINT_SERVICE_NAME="networking"
+fi
 
-NEUTRON_UWSGI_CONF=$NEUTRON_CONF_DIR/neutron-api-uwsgi.ini
+# List of config file names in addition to the main plugin config file
+# To add additional plugin config files, use ``neutron_server_config_add``
+# utility function.  For example:
+#
+#    ``neutron_server_config_add file1``
+#
+# These config files are relative to ``/etc/neutron``.  The above
+# example would specify ``--config-file /etc/neutron/file1`` for
+# neutron server.
+declare -a -g Q_PLUGIN_EXTRA_CONF_FILES
+
+# same as Q_PLUGIN_EXTRA_CONF_FILES, but with absolute path.
+declare -a -g _Q_PLUGIN_EXTRA_CONF_FILES_ABS
+
+
+Q_RR_CONF_FILE=$NEUTRON_CONF_DIR/rootwrap.conf
+if [[ "$Q_USE_ROOTWRAP" == "False" ]]; then
+    Q_RR_COMMAND="sudo"
+else
+    NEUTRON_ROOTWRAP=$(get_rootwrap_location neutron)
+    Q_RR_COMMAND="sudo $NEUTRON_ROOTWRAP $Q_RR_CONF_FILE"
+    if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
+        Q_RR_DAEMON_COMMAND="sudo $NEUTRON_ROOTWRAP-daemon $Q_RR_CONF_FILE"
+    fi
+fi
 
-# By default, use the ML2 plugin
-NEUTRON_CORE_PLUGIN=${NEUTRON_CORE_PLUGIN:-ml2}
-NEUTRON_CORE_PLUGIN_CONF_FILENAME=${NEUTRON_CORE_PLUGIN_CONF_FILENAME:-ml2_conf.ini}
-NEUTRON_CORE_PLUGIN_CONF_PATH=$NEUTRON_CONF_DIR/plugins/$NEUTRON_CORE_PLUGIN
-NEUTRON_CORE_PLUGIN_CONF=$NEUTRON_CORE_PLUGIN_CONF_PATH/$NEUTRON_CORE_PLUGIN_CONF_FILENAME
 
-NEUTRON_METERING_AGENT_CONF_FILENAME=${NEUTRON_METERING_AGENT_CONF_FILENAME:-metering_agent.ini}
-NEUTRON_METERING_AGENT_CONF=$NEUTRON_CONF_DIR/$NEUTRON_METERING_AGENT_CONF_FILENAME
+# Distributed Virtual Router (DVR) configuration
+# Can be:
+# - ``legacy``   - No DVR functionality
+# - ``dvr_snat`` - Controller or single node DVR
+# - ``dvr``      - Compute node in multi-node DVR
+# - ``dvr_no_external`` - Compute node in multi-node DVR, no external network
+#
+Q_DVR_MODE=${Q_DVR_MODE:-legacy}
+if [[ "$Q_DVR_MODE" != "legacy" ]]; then
+    Q_ML2_PLUGIN_MECHANISM_DRIVERS=openvswitch,l2population
+fi
 
-NEUTRON_AGENT_BINARY=${NEUTRON_AGENT_BINARY:-neutron-$NEUTRON_AGENT-agent}
-NEUTRON_L3_BINARY=${NEUTRON_L3_BINARY:-neutron-l3-agent}
-NEUTRON_META_BINARY=${NEUTRON_META_BINARY:-neutron-metadata-agent}
-NEUTRON_METERING_BINARY=${NEUTRON_METERING_BINARY:-neutron-metering-agent}
+# Provider Network Configurations
+# --------------------------------
+
+# The following variables control the Neutron ML2 plugins' allocation
+# of tenant networks and availability of provider networks. If these
+# are not configured in ``localrc``, tenant networks will be local to
+# the host (with no remote connectivity), and no physical resources
+# will be available for the allocation of provider networks.
+
+# To disable tunnels (GRE or VXLAN) for tenant networks,
+# set to False in ``local.conf``.
+# GRE tunnels are only supported by the openvswitch.
+ENABLE_TENANT_TUNNELS=${ENABLE_TENANT_TUNNELS:-True}
+
+# If using GRE, VXLAN or GENEVE tunnels for tenant networks,
+# specify the range of IDs from which tenant networks are
+# allocated. Can be overridden in ``localrc`` if necessary.
+TENANT_TUNNEL_RANGES=${TENANT_TUNNEL_RANGES:-1:1000}
+
+# To use VLANs for tenant networks, set to True in localrc. VLANs
+# are supported by the ML2 plugins, requiring additional configuration
+# described below.
+ENABLE_TENANT_VLANS=${ENABLE_TENANT_VLANS:-False}
+
+# If using VLANs for tenant networks, set in ``localrc`` to specify
+# the range of VLAN VIDs from which tenant networks are
+# allocated. An external network switch must be configured to
+# trunk these VLANs between hosts for multi-host connectivity.
+#
+# Example: ``TENANT_VLAN_RANGE=1000:1999``
+TENANT_VLAN_RANGE=${TENANT_VLAN_RANGE:-}
+
+# If using VLANs for tenant networks, or if using flat or VLAN
+# provider networks, set in ``localrc`` to the name of the physical
+# network, and also configure ``OVS_PHYSICAL_BRIDGE`` for the
+# openvswitch agent or ``LB_PHYSICAL_INTERFACE`` for the linuxbridge
+# agent, as described below.
+#
+# Example: ``PHYSICAL_NETWORK=default``
+PHYSICAL_NETWORK=${PHYSICAL_NETWORK:-public}
+
+# With the openvswitch agent, if using VLANs for tenant networks,
+# or if using flat or VLAN provider networks, set in ``localrc`` to
+# the name of the OVS bridge to use for the physical network. The
+# bridge will be created if it does not already exist, but a
+# physical interface must be manually added to the bridge as a
+# port for external connectivity.
+#
+# Example: ``OVS_PHYSICAL_BRIDGE=br-eth1``
+OVS_PHYSICAL_BRIDGE=${OVS_PHYSICAL_BRIDGE:-br-ex}
 
-# Public facing bits
-if is_service_enabled tls-proxy; then
-    NEUTRON_SERVICE_PROTOCOL="https"
+# With the linuxbridge agent, if using VLANs for tenant networks,
+# or if using flat or VLAN provider networks, set in ``localrc`` to
+# the name of the network interface to use for the physical
+# network.
+#
+# Example: ``LB_PHYSICAL_INTERFACE=eth1``
+if [[ $Q_AGENT == "linuxbridge" && -z ${LB_PHYSICAL_INTERFACE} ]]; then
+    default_route_dev=$( (ip route; ip -6 route) | grep ^default | head -n 1 | awk '{print $5}')
+    die_if_not_set $LINENO default_route_dev "Failure retrieving default route device"
+    LB_PHYSICAL_INTERFACE=$default_route_dev
 fi
-NEUTRON_SERVICE_HOST=${NEUTRON_SERVICE_HOST:-$SERVICE_HOST}
-NEUTRON_SERVICE_PORT=${NEUTRON_SERVICE_PORT:-9696}
-NEUTRON_SERVICE_PORT_INT=${NEUTRON_SERVICE_PORT_INT:-19696}
-NEUTRON_SERVICE_PROTOCOL=${NEUTRON_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 
-NEUTRON_AUTH_STRATEGY=${NEUTRON_AUTH_STRATEGY:-keystone}
-NEUTRON_ROOTWRAP=$(get_rootwrap_location neutron)
-NEUTRON_ROOTWRAP_CONF_FILE=$NEUTRON_CONF_DIR/rootwrap.conf
-NEUTRON_ROOTWRAP_CMD="$NEUTRON_ROOTWRAP $NEUTRON_ROOTWRAP_CONF_FILE"
-NEUTRON_ROOTWRAP_DAEMON_CMD="$NEUTRON_ROOTWRAP-daemon $NEUTRON_ROOTWRAP_CONF_FILE"
+# With the openvswitch plugin, set to True in ``localrc`` to enable
+# provider GRE tunnels when ``ENABLE_TENANT_TUNNELS`` is False.
+#
+# Example: ``OVS_ENABLE_TUNNELING=True``
+OVS_ENABLE_TUNNELING=${OVS_ENABLE_TUNNELING:-$ENABLE_TENANT_TUNNELS}
+
+# Use DHCP agent for providing metadata service in the case of
+# without L3 agent (No Route Agent), set to True in localrc.
+ENABLE_ISOLATED_METADATA=${ENABLE_ISOLATED_METADATA:-False}
+
+# Add a static route as dhcp option, so the request to 169.254.169.254
+# will be able to reach through a route(DHCP agent)
+# This option require ENABLE_ISOLATED_METADATA = True
+ENABLE_METADATA_NETWORK=${ENABLE_METADATA_NETWORK:-False}
+# Neutron plugin specific functions
+# ---------------------------------
+
+# Please refer to ``lib/neutron_plugins/README.md`` for details.
+if [ -f $TOP_DIR/lib/neutron_plugins/$Q_PLUGIN ]; then
+    source $TOP_DIR/lib/neutron_plugins/$Q_PLUGIN
+fi
 
-# This is needed because _neutron_ovs_base_configure_l3_agent uses it to create
-# an external network bridge
-PUBLIC_BRIDGE=${PUBLIC_BRIDGE:-br-ex}
-PUBLIC_BRIDGE_MTU=${PUBLIC_BRIDGE_MTU:-1500}
+# Agent metering service plugin functions
+# -------------------------------------------
 
-# Network type - default vxlan, however enables vlan based jobs to override
-# using the legacy environment variable as well as a new variable in greater
-# alignment with the naming scheme of this plugin.
-NEUTRON_TENANT_NETWORK_TYPE=${NEUTRON_TENANT_NETWORK_TYPE:-vxlan}
+# Hardcoding for 1 service plugin for now
+source $TOP_DIR/lib/neutron_plugins/services/metering
 
-NEUTRON_TENANT_VLAN_RANGE=${NEUTRON_TENANT_VLAN_RANGE:-${TENANT_VLAN_RANGE:-100:150}}
+# L3 Service functions
+source $TOP_DIR/lib/neutron_plugins/services/l3
 
-# Physical network for VLAN network usage.
-NEUTRON_PHYSICAL_NETWORK=${NEUTRON_PHYSICAL_NETWORK:-}
+# Additional Neutron service plugins
+source $TOP_DIR/lib/neutron_plugins/services/placement
+source $TOP_DIR/lib/neutron_plugins/services/trunk
+source $TOP_DIR/lib/neutron_plugins/services/qos
 
-# The name of the service in the endpoint URL
-NEUTRON_ENDPOINT_SERVICE_NAME=${NEUTRON_ENDPOINT_SERVICE_NAME-"networking"}
-if [[ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" && -z "$NEUTRON_ENDPOINT_SERVICE_NAME" ]]; then
-    NEUTRON_ENDPOINT_SERVICE_NAME="networking"
+# Use security group or not
+if has_neutron_plugin_security_group; then
+    Q_USE_SECGROUP=${Q_USE_SECGROUP:-True}
+else
+    Q_USE_SECGROUP=False
 fi
 
+# Save trace setting
+_XTRACE_NEUTRON=$(set +o | grep xtrace)
+set +o xtrace
 
-# Additional neutron api config files
-declare -a -g _NEUTRON_SERVER_EXTRA_CONF_FILES_ABS
 
 # Functions
 # ---------
@@ -136,310 +319,194 @@ function is_neutron_enabled {
 }
 
 # Test if any Neutron services are enabled
-# is_neutron_enabled
+# TODO(slaweq): this is not really needed now and we should remove it as soon
+# as it will not be called from any other Devstack plugins, like e.g. Neutron
+# plugin
 function is_neutron_legacy_enabled {
-    # first we need to remove all "neutron-" from DISABLED_SERVICES list
-    disabled_services_copy=$(echo $DISABLED_SERVICES | sed 's/neutron-//g')
-    [[ ,${disabled_services_copy} =~ ,"neutron" ]] && return 1
-    [[ ,${ENABLED_SERVICES} =~ ,"q-" ]] && return 0
-    return 1
+    return 0
 }
 
-if is_neutron_legacy_enabled; then
-    source $TOP_DIR/lib/neutron-legacy
-fi
-
-# cleanup_neutron() - Remove residual data files, anything left over from previous
-# runs that a clean run would need to clean up
-function cleanup_neutron_new {
-    deprecated "Using lib/neutron is deprecated, and it will be removed in AA release!"
-    source $TOP_DIR/lib/neutron_plugins/${NEUTRON_AGENT}_agent
-    if is_neutron_ovs_base_plugin; then
-        neutron_ovs_base_cleanup
+function _determine_config_server {
+    if [[ "$Q_PLUGIN_EXTRA_CONF_PATH" != '' ]]; then
+        if [[ "$Q_PLUGIN_EXTRA_CONF_PATH" = "$_Q_PLUGIN_EXTRA_CONF_PATH" ]]; then
+            deprecated "Q_PLUGIN_EXTRA_CONF_PATH is deprecated"
+        else
+            die $LINENO "Q_PLUGIN_EXTRA_CONF_PATH is deprecated"
+        fi
     fi
-
-    if [[ $NEUTRON_AGENT == "linuxbridge" ]]; then
-        neutron_lb_cleanup
+    if [[ ${#Q_PLUGIN_EXTRA_CONF_FILES[@]} > 0 ]]; then
+        deprecated "Q_PLUGIN_EXTRA_CONF_FILES is deprecated.  Use neutron_server_config_add instead."
     fi
-    # delete all namespaces created by neutron
-    for ns in $(sudo ip netns list | grep -o -E '(qdhcp|qrouter|qlbaas|fip|snat)-[0-9a-f-]*'); do
-        sudo ip netns delete ${ns}
+    for cfg_file in ${Q_PLUGIN_EXTRA_CONF_FILES[@]}; do
+        _Q_PLUGIN_EXTRA_CONF_FILES_ABS+=($_Q_PLUGIN_EXTRA_CONF_PATH/$cfg_file)
     done
-}
 
-# configure_root_helper_options() - Configure agent rootwrap helper options
-function configure_root_helper_options {
-    local conffile=$1
-    iniset $conffile agent root_helper "sudo $NEUTRON_ROOTWRAP_CMD"
-    iniset $conffile agent root_helper_daemon "sudo $NEUTRON_ROOTWRAP_DAEMON_CMD"
+    local cfg_file
+    local opts="--config-file $NEUTRON_CONF --config-file /$Q_PLUGIN_CONF_FILE"
+    for cfg_file in ${_Q_PLUGIN_EXTRA_CONF_FILES_ABS[@]}; do
+        opts+=" --config-file $cfg_file"
+    done
+    echo "$opts"
 }
 
-# configure_neutron() - Set config files, create data dirs, etc
-function configure_neutron_new {
-    deprecated "Using lib/neutron is deprecated, and it will be removed in AA release!"
-    sudo install -d -o $STACK_USER $NEUTRON_CONF_DIR
-
-    (cd $NEUTRON_DIR && exec ./tools/generate_config_file_samples.sh)
-
-    cp $NEUTRON_DIR/etc/neutron.conf.sample $NEUTRON_CONF
-
-    configure_neutron_rootwrap
-
-    mkdir -p $NEUTRON_CORE_PLUGIN_CONF_PATH
+function _determine_config_l3 {
+    local opts="--config-file $NEUTRON_CONF --config-file $Q_L3_CONF_FILE"
+    echo "$opts"
+}
 
-    # NOTE(yamamoto): A decomposed plugin should prepare the config file in
-    # its devstack plugin.
-    if [ -f $NEUTRON_DIR/etc/neutron/plugins/$NEUTRON_CORE_PLUGIN/$NEUTRON_CORE_PLUGIN_CONF_FILENAME.sample ]; then
-        cp $NEUTRON_DIR/etc/neutron/plugins/$NEUTRON_CORE_PLUGIN/$NEUTRON_CORE_PLUGIN_CONF_FILENAME.sample $NEUTRON_CORE_PLUGIN_CONF
+# For services and agents that require it, dynamically construct a list of
+# --config-file arguments that are passed to the binary.
+function determine_config_files {
+    local opts=""
+    case "$1" in
+        "neutron-server") opts="$(_determine_config_server)" ;;
+        "neutron-l3-agent") opts="$(_determine_config_l3)" ;;
+    esac
+    if [ -z "$opts" ] ; then
+        die $LINENO "Could not determine config files for $1."
     fi
+    echo "$opts"
+}
 
-    iniset $NEUTRON_CONF database connection `database_connection_url neutron`
-    iniset $NEUTRON_CONF DEFAULT state_path $NEUTRON_STATE_PATH
-    iniset $NEUTRON_CONF oslo_concurrency lock_path $NEUTRON_STATE_PATH/lock
-    iniset $NEUTRON_CONF DEFAULT use_syslog $SYSLOG
-
-    iniset $NEUTRON_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-
+# configure_neutron()
+# Set common config for all neutron server and agents.
+function configure_neutron {
+    _configure_neutron_common
     iniset_rpc_backend neutron $NEUTRON_CONF
 
-    # Neutron API server & Neutron plugin
-    if is_service_enabled neutron-api; then
-        local policy_file=$NEUTRON_CONF_DIR/policy.json
-        # Allow neutron user to administer neutron to match neutron account
-        # NOTE(amotoki): This is required for nova works correctly with neutron.
-        if [ -f $NEUTRON_DIR/etc/policy.json ]; then
-            cp $NEUTRON_DIR/etc/policy.json $policy_file
-            sed -i 's/"context_is_admin":  "role:admin"/"context_is_admin":  "role:admin or user_name:neutron"/g' $policy_file
-        else
-            echo '{"context_is_admin":  "role:admin or user_name:neutron"}' > $policy_file
-        fi
-
-        cp $NEUTRON_DIR/etc/api-paste.ini $NEUTRON_CONF_DIR/api-paste.ini
-
-        iniset $NEUTRON_CONF DEFAULT core_plugin $NEUTRON_CORE_PLUGIN
-
-        iniset $NEUTRON_CONF DEFAULT policy_file $policy_file
-        iniset $NEUTRON_CONF DEFAULT router_distributed $NEUTRON_DISTRIBUTED_ROUTING
-
-        iniset $NEUTRON_CONF DEFAULT auth_strategy $NEUTRON_AUTH_STRATEGY
-        configure_keystone_authtoken_middleware $NEUTRON_CONF neutron
-        configure_keystone_authtoken_middleware $NEUTRON_CONF nova nova
-
-        # Configure tenant network type
-        iniset $NEUTRON_CORE_PLUGIN_CONF ml2 tenant_network_types $NEUTRON_TENANT_NETWORK_TYPE
-
-        local mech_drivers="openvswitch"
-        if [[ "$NEUTRON_DISTRIBUTED_ROUTING" = "True" ]]; then
-            mech_drivers+=",l2population"
-        else
-            mech_drivers+=",linuxbridge"
-        fi
-        if [[ "$mech_drivers" == *"linuxbridge"* ]]; then
-            iniset $NEUTRON_CONF experimental linuxbridge True
-        fi
-
-        iniset $NEUTRON_CORE_PLUGIN_CONF ml2 mechanism_drivers $mech_drivers
-        iniset $NEUTRON_CORE_PLUGIN_CONF ml2 overlay_ip_version $TUNNEL_IP_VERSION
-
-        iniset $NEUTRON_CORE_PLUGIN_CONF ml2_type_vxlan vni_ranges 1001:2000
-        iniset $NEUTRON_CORE_PLUGIN_CONF ml2_type_flat flat_networks $PUBLIC_NETWORK_NAME
-        if [[ "$NEUTRON_TENANT_NETWORK_TYPE" =~ "vlan" ]] && [[ "$NEUTRON_PHYSICAL_NETWORK" != "" ]]; then
-            iniset $NEUTRON_CORE_PLUGIN_CONF ml2_type_vlan network_vlan_ranges ${NEUTRON_PHYSICAL_NETWORK}:${NEUTRON_TENANT_VLAN_RANGE}
-        fi
-        if [[ "$NEUTRON_PORT_SECURITY" = "True" ]]; then
-            neutron_ml2_extension_driver_add port_security
-        fi
-        configure_rbac_policies
-    fi
-
-    # Neutron OVS or LB agent
-    if is_service_enabled neutron-agent; then
-        iniset $NEUTRON_CORE_PLUGIN_CONF agent tunnel_types vxlan
-        iniset $NEUTRON_CORE_PLUGIN_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-        configure_root_helper_options $NEUTRON_CORE_PLUGIN_CONF
-
-        # Configure the neutron agent
-        if [[ $NEUTRON_AGENT == "linuxbridge" ]]; then
-            iniset $NEUTRON_CORE_PLUGIN_CONF securitygroup firewall_driver iptables
-            iniset $NEUTRON_CORE_PLUGIN_CONF vxlan local_ip $TUNNEL_ENDPOINT_IP
-        elif [[ $NEUTRON_AGENT == "openvswitch" ]]; then
-            iniset $NEUTRON_CORE_PLUGIN_CONF securitygroup firewall_driver openvswitch
-            iniset $NEUTRON_CORE_PLUGIN_CONF ovs local_ip $TUNNEL_ENDPOINT_IP
-
-            if [[ "$NEUTRON_DISTRIBUTED_ROUTING" = "True" ]]; then
-                iniset $NEUTRON_CORE_PLUGIN_CONF agent l2_population True
-                iniset $NEUTRON_CORE_PLUGIN_CONF agent enable_distributed_routing True
-                iniset $NEUTRON_CORE_PLUGIN_CONF agent arp_responder True
-            fi
-        fi
-
-        if ! running_in_container; then
-            enable_kernel_bridge_firewall
-        fi
+    if is_service_enabled q-metering neutron-metering; then
+        _configure_neutron_metering
     fi
-
-    # DHCP Agent
-    if is_service_enabled neutron-dhcp; then
-        cp $NEUTRON_DIR/etc/dhcp_agent.ini.sample $NEUTRON_DHCP_CONF
-
-        iniset $NEUTRON_DHCP_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-        # make it so we have working DNS from guests
-        iniset $NEUTRON_DHCP_CONF DEFAULT dnsmasq_local_resolv True
-
-        configure_root_helper_options $NEUTRON_DHCP_CONF
-        iniset $NEUTRON_DHCP_CONF DEFAULT interface_driver $NEUTRON_AGENT
-        neutron_plugin_configure_dhcp_agent $NEUTRON_DHCP_CONF
+    if is_service_enabled q-agt neutron-agent; then
+        _configure_neutron_plugin_agent
+    fi
+    if is_service_enabled q-dhcp neutron-dhcp; then
+        _configure_neutron_dhcp_agent
+    fi
+    if is_service_enabled q-l3 neutron-l3; then
+        _configure_neutron_l3_agent
+    fi
+    if is_service_enabled q-meta neutron-metadata-agent; then
+        _configure_neutron_metadata_agent
     fi
 
-    if is_service_enabled neutron-l3; then
-        cp $NEUTRON_DIR/etc/l3_agent.ini.sample $NEUTRON_L3_CONF
-        iniset $NEUTRON_L3_CONF DEFAULT interface_driver $NEUTRON_AGENT
-        neutron_service_plugin_class_add router
-        configure_root_helper_options $NEUTRON_L3_CONF
-        iniset $NEUTRON_L3_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-        neutron_plugin_configure_l3_agent $NEUTRON_L3_CONF
+    if [[ "$Q_DVR_MODE" != "legacy" ]]; then
+        _configure_dvr
+    fi
+    if is_service_enabled ceilometer; then
+        _configure_neutron_ceilometer_notifications
+    fi
 
-        # Configure the neutron agent to serve external network ports
-        if [[ $NEUTRON_AGENT == "linuxbridge" ]]; then
-            iniset $NEUTRON_CORE_PLUGIN_CONF linux_bridge bridge_mappings "$PUBLIC_NETWORK_NAME:$PUBLIC_BRIDGE"
-        else
-            iniset $NEUTRON_CORE_PLUGIN_CONF ovs bridge_mappings "$PUBLIC_NETWORK_NAME:$PUBLIC_BRIDGE"
-        fi
+    if [[ $Q_AGENT == "ovn" ]]; then
+        configure_ovn
+        configure_ovn_plugin
+    fi
 
-        if [[ "$NEUTRON_DISTRIBUTED_ROUTING" = "True" ]]; then
-            iniset $NEUTRON_L3_CONF DEFAULT agent_mode $NEUTRON_DVR_MODE
+    # Configure Neutron's advanced services
+    if is_service_enabled q-placement neutron-placement; then
+        configure_placement_extension
+    fi
+    if is_service_enabled q-trunk neutron-trunk; then
+        configure_trunk_extension
+    fi
+    if is_service_enabled q-qos neutron-qos; then
+        configure_qos
+        if is_service_enabled q-l3 neutron-l3; then
+            configure_l3_agent_extension_fip_qos
+            configure_l3_agent_extension_gateway_ip_qos
         fi
     fi
 
-    # Metadata
-    if is_service_enabled neutron-metadata-agent; then
-        cp $NEUTRON_DIR/etc/metadata_agent.ini.sample $NEUTRON_META_CONF
-
-        iniset $NEUTRON_META_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-        iniset $NEUTRON_META_CONF DEFAULT nova_metadata_host $NEUTRON_META_DATA_HOST
-        iniset $NEUTRON_META_CONF DEFAULT metadata_workers $API_WORKERS
-        # TODO(ihrachys) do we really need to set rootwrap for metadata agent?
-        configure_root_helper_options $NEUTRON_META_CONF
-
-        # TODO(dtroyer): remove the v2.0 hard code below
-        iniset $NEUTRON_META_CONF DEFAULT auth_url $KEYSTONE_SERVICE_URI
-        configure_keystone_authtoken_middleware $NEUTRON_META_CONF neutron DEFAULT
+    # Finally configure Neutron server and core plugin
+    if is_service_enabled q-agt neutron-agent q-svc neutron-api; then
+        _configure_neutron_service
     fi
 
-    # Format logging
-    setup_logging $NEUTRON_CONF
+    iniset $NEUTRON_CONF DEFAULT api_workers "$API_WORKERS"
+    # devstack is not a tool for running uber scale OpenStack
+    # clouds, therefore running without a dedicated RPC worker
+    # for state reports is more than adequate.
+    iniset $NEUTRON_CONF DEFAULT rpc_state_report_workers 0
 
-    if is_service_enabled tls-proxy && [ "$NEUTRON_DEPLOY_MOD_WSGI" == "False" ]; then
-        # Set the service port for a proxy to take the original
-        iniset $NEUTRON_CONF DEFAULT bind_port "$NEUTRON_SERVICE_PORT_INT"
-        iniset $NEUTRON_CONF oslo_middleware enable_proxy_headers_parsing True
-    fi
-
-    # Metering
-    if is_service_enabled neutron-metering; then
-        cp $NEUTRON_DIR/etc/metering_agent.ini.sample $NEUTRON_METERING_AGENT_CONF
-        neutron_service_plugin_class_add metering
+    if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
+        write_uwsgi_config "$NEUTRON_UWSGI_CONF" "$NEUTRON_BIN_DIR/neutron-api" "/networking"
     fi
 }
 
-# configure_neutron_rootwrap() - configure Neutron's rootwrap
-function configure_neutron_rootwrap {
-    # Deploy new rootwrap filters files (owned by root).
-    # Wipe any existing rootwrap.d files first
-    if [[ -d $NEUTRON_CONF_DIR/rootwrap.d ]]; then
-        sudo rm -rf $NEUTRON_CONF_DIR/rootwrap.d
+function configure_neutron_nova {
+    create_nova_conf_neutron $NOVA_CONF
+    if [[ "${CELLSV2_SETUP}" == "superconductor" ]]; then
+        for i in $(seq 1 $NOVA_NUM_CELLS); do
+            local conf
+            conf=$(conductor_conf $i)
+            create_nova_conf_neutron $conf
+        done
     fi
+}
 
-    # Deploy filters to /etc/neutron/rootwrap.d
-    sudo install -d -o root -g root -m 755 $NEUTRON_CONF_DIR/rootwrap.d
-    sudo install -o root -g root -m 644 $NEUTRON_DIR/etc/neutron/rootwrap.d/*.filters $NEUTRON_CONF_DIR/rootwrap.d
-
-    # Set up ``rootwrap.conf``, pointing to ``$NEUTRON_CONF_DIR/rootwrap.d``
-    sudo install -o root -g root -m 644 $NEUTRON_DIR/etc/rootwrap.conf $NEUTRON_CONF_DIR
-    sudo sed -e "s:^filters_path=.*$:filters_path=$NEUTRON_CONF_DIR/rootwrap.d:" -i $NEUTRON_CONF_DIR/rootwrap.conf
-
-    # Set up the rootwrap sudoers for Neutron
-    tempfile=`mktemp`
-    echo "$STACK_USER ALL=(root) NOPASSWD: $NEUTRON_ROOTWRAP_CMD *" >$tempfile
-    echo "$STACK_USER ALL=(root) NOPASSWD: $NEUTRON_ROOTWRAP_DAEMON_CMD" >>$tempfile
-    chmod 0440 $tempfile
-    sudo chown root:root $tempfile
-    sudo mv $tempfile /etc/sudoers.d/neutron-rootwrap
-}
-
-# Make Neutron-required changes to nova.conf
-# Takes a single optional argument which is the config file to update,
-# if not passed $NOVA_CONF is used.
-function configure_neutron_nova_new {
-    deprecated "Using lib/neutron is deprecated, and it will be removed in AA release!"
+function create_nova_conf_neutron {
     local conf=${1:-$NOVA_CONF}
     iniset $conf neutron auth_type "password"
     iniset $conf neutron auth_url "$KEYSTONE_SERVICE_URI"
-    iniset $conf neutron username neutron
+    iniset $conf neutron username "$Q_ADMIN_USERNAME"
     iniset $conf neutron password "$SERVICE_PASSWORD"
-    iniset $conf neutron user_domain_name "Default"
-    iniset $conf neutron project_name "$SERVICE_TENANT_NAME"
-    iniset $conf neutron project_domain_name "Default"
-    iniset $conf neutron auth_strategy $NEUTRON_AUTH_STRATEGY
+    iniset $conf neutron user_domain_name "$SERVICE_DOMAIN_NAME"
+    iniset $conf neutron project_name "$SERVICE_PROJECT_NAME"
+    iniset $conf neutron project_domain_name "$SERVICE_DOMAIN_NAME"
+    iniset $conf neutron auth_strategy "$Q_AUTH_STRATEGY"
     iniset $conf neutron region_name "$REGION_NAME"
 
     # optionally set options in nova_conf
     neutron_plugin_create_nova_conf $conf
 
-    if is_service_enabled neutron-metadata-agent; then
+    if is_service_enabled q-meta neutron-metadata-agent; then
         iniset $conf neutron service_metadata_proxy "True"
     fi
 
+    iniset $conf DEFAULT vif_plugging_is_fatal "$VIF_PLUGGING_IS_FATAL"
+    iniset $conf DEFAULT vif_plugging_timeout "$VIF_PLUGGING_TIMEOUT"
 }
 
+# create_neutron_accounts() - Set up common required neutron accounts
+
 # Tenant               User       Roles
 # ------------------------------------------------------------------
 # service              neutron    admin        # if enabled
 
-# create_neutron_accounts() - Create required service accounts
-function create_neutron_accounts_new {
-    deprecated "Using lib/neutron is deprecated, and it will be removed in AA release!"
+# Migrated from keystone_data.sh
+function create_neutron_accounts {
     local neutron_url
-
     if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
-        neutron_url=$NEUTRON_SERVICE_PROTOCOL://$NEUTRON_SERVICE_HOST/
+        neutron_url=$Q_PROTOCOL://$SERVICE_HOST/
     else
-        neutron_url=$NEUTRON_SERVICE_PROTOCOL://$NEUTRON_SERVICE_HOST:$NEUTRON_SERVICE_PORT/
+        neutron_url=$Q_PROTOCOL://$SERVICE_HOST:$Q_PORT/
     fi
     if [ ! -z "$NEUTRON_ENDPOINT_SERVICE_NAME" ]; then
         neutron_url=$neutron_url$NEUTRON_ENDPOINT_SERVICE_NAME
     fi
 
-
-    if [[ "$ENABLED_SERVICES" =~ "neutron-api" ]]; then
+    if is_service_enabled q-svc neutron-api; then
 
         create_service_user "neutron"
 
-        neutron_service=$(get_or_create_service "neutron" \
-            "network" "Neutron Service")
-        get_or_create_endpoint $neutron_service \
+        get_or_create_service "neutron" "network" "Neutron Service"
+        get_or_create_endpoint \
+            "network" \
             "$REGION_NAME" "$neutron_url"
     fi
 }
 
 # init_neutron() - Initialize databases, etc.
-function init_neutron_new {
-
-    deprecated "Using lib/neutron is deprecated, and it will be removed in AA release!"
-    recreate_database neutron
-
+function init_neutron {
+    recreate_database $Q_DB_NAME
     time_start "dbsync"
     # Run Neutron db migrations
-    $NEUTRON_BIN_DIR/neutron-db-manage upgrade heads
+    $NEUTRON_BIN_DIR/neutron-db-manage --config-file $NEUTRON_CONF --config-file /$Q_PLUGIN_CONF_FILE upgrade head
     time_stop "dbsync"
 }
 
 # install_neutron() - Collect source and prepare
-function install_neutron_new {
-    deprecated "Using lib/neutron is deprecated, and it will be removed in AA release!"
-    git_clone $NEUTRON_REPO $NEUTRON_DIR $NEUTRON_BRANCH
-    setup_develop $NEUTRON_DIR
-
+function install_neutron {
     # Install neutron-lib from git so we make sure we're testing
     # the latest code.
     if use_library_from_git "neutron-lib"; then
@@ -447,17 +514,12 @@ function install_neutron_new {
         setup_dev_lib "neutron-lib"
     fi
 
-    # L3 service requires radvd
-    if is_service_enabled neutron-l3; then
-        install_package radvd
-    fi
+    git_clone $NEUTRON_REPO $NEUTRON_DIR $NEUTRON_BRANCH
+    setup_develop $NEUTRON_DIR
 
-    if is_service_enabled neutron-agent neutron-dhcp neutron-l3; then
-        #TODO(sc68cal) - kind of ugly
-        source $TOP_DIR/lib/neutron_plugins/${NEUTRON_AGENT}_agent
-        neutron_plugin_install_agent_packages
+    if [[ $Q_AGENT == "ovn" ]]; then
+        install_ovn
     fi
-
 }
 
 # install_neutronclient() - Collect source and prepare
@@ -469,152 +531,256 @@ function install_neutronclient {
     fi
 }
 
-# start_neutron_api() - Start the API process ahead of other things
-function start_neutron_api {
-    local service_port=$NEUTRON_SERVICE_PORT
-    local service_protocol=$NEUTRON_SERVICE_PROTOCOL
+# install_neutron_agent_packages() - Collect source and prepare
+function install_neutron_agent_packages {
+    # radvd doesn't come with the OS. Install it if the l3 service is enabled.
+    if is_service_enabled q-l3 neutron-l3; then
+        install_package radvd
+    fi
+    # install packages that are specific to plugin agent(s)
+    if is_service_enabled q-agt neutron-agent q-dhcp neutron-dhcp q-l3 neutron-l3; then
+        neutron_plugin_install_agent_packages
+    fi
+}
+
+# Finish neutron configuration
+function configure_neutron_after_post_config {
+    if [[ $Q_SERVICE_PLUGIN_CLASSES != '' ]]; then
+        iniset $NEUTRON_CONF DEFAULT service_plugins $Q_SERVICE_PLUGIN_CLASSES
+    fi
+    configure_rbac_policies
+}
+
+# configure_rbac_policies() - Configure Neutron to enforce new RBAC
+# policies and scopes if NEUTRON_ENFORCE_SCOPE == True
+function configure_rbac_policies {
+    if [[ "$NEUTRON_ENFORCE_SCOPE" == "True" || "$ENFORCE_SCOPE" == True ]]; then
+        iniset $NEUTRON_CONF oslo_policy enforce_new_defaults True
+        iniset $NEUTRON_CONF oslo_policy enforce_scope True
+    else
+        iniset $NEUTRON_CONF oslo_policy enforce_new_defaults False
+        iniset $NEUTRON_CONF oslo_policy enforce_scope False
+    fi
+}
+
+# Start running OVN processes
+function start_ovn_services {
+    if [[ $Q_AGENT == "ovn" ]]; then
+        init_ovn
+        start_ovn
+        if [[ "$OVN_L3_CREATE_PUBLIC_NETWORK" == "True" ]]; then
+            if [[ "$NEUTRON_CREATE_INITIAL_NETWORKS" != "True" ]]; then
+                echo "OVN_L3_CREATE_PUBLIC_NETWORK=True is being ignored "
+                echo "because NEUTRON_CREATE_INITIAL_NETWORKS is set to False"
+            else
+                create_public_bridge
+            fi
+        fi
+    fi
+}
+
+# Start running processes
+function start_neutron_service_and_check {
+    local service_port=$Q_PORT
+    local service_protocol=$Q_PROTOCOL
+    local cfg_file_options
     local neutron_url
+
+    cfg_file_options="$(determine_config_files neutron-server)"
+
     if is_service_enabled tls-proxy; then
-        service_port=$NEUTRON_SERVICE_PORT_INT
+        service_port=$Q_PORT_INT
         service_protocol="http"
     fi
-
-    local opts=""
-    opts+=" --config-file $NEUTRON_CONF"
-    opts+=" --config-file $NEUTRON_CORE_PLUGIN_CONF"
-    local cfg_file
-    for cfg_file in ${_NEUTRON_SERVER_EXTRA_CONF_FILES_ABS[@]}; do
-        opts+=" --config-file $cfg_file"
-    done
-
+    # Start the Neutron service
     if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
+        enable_service neutron-api
         run_process neutron-api "$(which uwsgi) --procname-prefix neutron-api --ini $NEUTRON_UWSGI_CONF"
-        neutron_url=$service_protocol://$NEUTRON_SERVICE_HOST/
+        neutron_url=$Q_PROTOCOL://$Q_HOST/
         enable_service neutron-rpc-server
-        run_process neutron-rpc-server "$NEUTRON_BIN_DIR/neutron-rpc-server $opts"
+        run_process neutron-rpc-server "$NEUTRON_BIN_DIR/neutron-rpc-server $cfg_file_options"
     else
-        # Start the Neutron service
-        # TODO(sc68cal) Stop hard coding this
-        run_process neutron-api "$NEUTRON_BIN_DIR/neutron-server $opts"
-        neutron_url=$service_protocol://$NEUTRON_SERVICE_HOST:$service_port/
+        run_process q-svc "$NEUTRON_BIN_DIR/neutron-server $cfg_file_options"
+        neutron_url=$service_protocol://$Q_HOST:$service_port/
         # Start proxy if enabled
         if is_service_enabled tls-proxy; then
-            start_tls_proxy neutron '*' $NEUTRON_SERVICE_PORT $NEUTRON_SERVICE_HOST $NEUTRON_SERVICE_PORT_INT
+            start_tls_proxy neutron '*' $Q_PORT $Q_HOST $Q_PORT_INT
         fi
     fi
     if [ ! -z "$NEUTRON_ENDPOINT_SERVICE_NAME" ]; then
         neutron_url=$neutron_url$NEUTRON_ENDPOINT_SERVICE_NAME
     fi
+    echo "Waiting for Neutron to start..."
 
-    if ! wait_for_service $SERVICE_TIMEOUT $neutron_url; then
-        die $LINENO "neutron-api did not start"
-    fi
+    local testcmd="wget ${ssl_ca} --no-proxy -q -O- $neutron_url"
+    test_with_retry "$testcmd" "Neutron did not start" $SERVICE_TIMEOUT
 }
 
-# start_neutron() - Start running processes
-function start_neutron_new {
-    deprecated "Using lib/neutron is deprecated, and it will be removed in AA release!"
-    # Start up the neutron agents if enabled
-    # TODO(sc68cal) Make this pluggable so different DevStack plugins for different Neutron plugins
-    # can resolve the $NEUTRON_AGENT_BINARY
-    if is_service_enabled neutron-agent; then
-        # TODO(ihrachys) stop loading ml2_conf.ini into agents, instead load agent specific files
-        run_process neutron-agent "$NEUTRON_BIN_DIR/$NEUTRON_AGENT_BINARY --config-file $NEUTRON_CONF --config-file $NEUTRON_CORE_PLUGIN_CONF"
-    fi
-    if is_service_enabled neutron-dhcp; then
-        neutron_plugin_configure_dhcp_agent $NEUTRON_DHCP_CONF
-        run_process neutron-dhcp "$NEUTRON_BIN_DIR/$NEUTRON_DHCP_BINARY --config-file $NEUTRON_CONF --config-file $NEUTRON_DHCP_CONF"
-    fi
-    if is_service_enabled neutron-l3; then
-        run_process neutron-l3 "$NEUTRON_BIN_DIR/$NEUTRON_L3_BINARY --config-file $NEUTRON_CONF --config-file $NEUTRON_L3_CONF"
-    fi
-    if is_service_enabled neutron-api && [[ "$NEUTRON_CREATE_INITIAL_NETWORKS" == "True" ]]; then
-        # XXX(sc68cal) - Here's where plugins can wire up their own networks instead
-        # of the code in lib/neutron_plugins/services/l3
-        if type -p neutron_plugin_create_initial_networks > /dev/null; then
-            neutron_plugin_create_initial_networks
-        else
-            # XXX(sc68cal) Load up the built in Neutron networking code and build a topology
-            source $TOP_DIR/lib/neutron_plugins/services/l3
-            # Create the networks using servic
-            create_neutron_initial_network
+function start_neutron {
+    start_l2_agent "$@"
+    start_other_agents "$@"
+}
+
+# Control of the l2 agent is separated out to make it easier to test partial
+# upgrades (everything upgraded except the L2 agent)
+function start_l2_agent {
+    run_process q-agt "$AGENT_BINARY --config-file $NEUTRON_CONF --config-file /$Q_PLUGIN_CONF_FILE"
+
+    if is_provider_network && [[ $Q_AGENT == "openvswitch" ]]; then
+        sudo ovs-vsctl --no-wait -- --may-exist add-port $OVS_PHYSICAL_BRIDGE $PUBLIC_INTERFACE
+        sudo ip link set $OVS_PHYSICAL_BRIDGE up
+        sudo ip link set br-int up
+        sudo ip link set $PUBLIC_INTERFACE up
+        if is_ironic_hardware; then
+            for IP in $(ip addr show dev $PUBLIC_INTERFACE | grep ' inet ' | awk '{print $2}'); do
+                sudo ip addr del $IP dev $PUBLIC_INTERFACE
+                sudo ip addr add $IP dev $OVS_PHYSICAL_BRIDGE
+            done
+            sudo ip route replace $FIXED_RANGE via $NETWORK_GATEWAY dev $OVS_PHYSICAL_BRIDGE
         fi
     fi
-    if is_service_enabled neutron-metadata-agent; then
-        run_process neutron-metadata-agent "$NEUTRON_BIN_DIR/$NEUTRON_META_BINARY --config-file $NEUTRON_CONF --config-file $NEUTRON_META_CONF"
-    fi
+}
 
-    if is_service_enabled neutron-metering; then
-        run_process neutron-metering "$NEUTRON_BIN_DIR/$NEUTRON_METERING_BINARY --config-file $NEUTRON_CONF --config-file $NEUTRON_METERING_AGENT_CONF"
-    fi
+function start_other_agents {
+    run_process q-dhcp "$AGENT_DHCP_BINARY --config-file $NEUTRON_CONF --config-file $Q_DHCP_CONF_FILE"
+
+    run_process q-l3 "$AGENT_L3_BINARY $(determine_config_files neutron-l3-agent)"
+
+    run_process q-meta "$AGENT_META_BINARY --config-file $NEUTRON_CONF --config-file $Q_META_CONF_FILE"
+    run_process q-metering "$AGENT_METERING_BINARY --config-file $NEUTRON_CONF --config-file $METERING_AGENT_CONF_FILENAME"
 }
 
-# stop_neutron() - Stop running processes
-function stop_neutron_new {
-    deprecated "Using lib/neutron is deprecated, and it will be removed in AA release!"
-    for serv in neutron-api neutron-agent neutron-l3; do
-        stop_process $serv
-    done
+# Start running processes, including screen
+function start_neutron_agents {
+    # NOTE(slaweq): it's now just a wrapper for start_neutron function
+    start_neutron "$@"
+}
 
-    if is_service_enabled neutron-rpc-server; then
-        stop_process neutron-rpc-server
-    fi
+function stop_l2_agent {
+    stop_process q-agt
+}
 
-    if is_service_enabled neutron-dhcp; then
-        stop_process neutron-dhcp
+# stop_other() - Stop running processes
+function stop_other {
+    if is_service_enabled q-dhcp neutron-dhcp; then
+        stop_process q-dhcp
         pid=$(ps aux | awk '/[d]nsmasq.+interface=(tap|ns-)/ { print $2 }')
         [ ! -z "$pid" ] && sudo kill -9 $pid
     fi
 
-    if is_service_enabled neutron-metadata-agent; then
-        stop_process neutron-metadata-agent
+    if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
+        stop_process neutron-rpc-server
+        stop_process neutron-api
+    else
+        stop_process q-svc
     fi
-}
 
-# neutron_service_plugin_class_add() - add service plugin class
-function neutron_service_plugin_class_add_new {
-    deprecated "Using lib/neutron is deprecated, and it will be removed in AA release!"
-    local service_plugin_class=$1
-    local plugins=""
+    if is_service_enabled q-l3 neutron-l3; then
+        sudo pkill -f "radvd -C $DATA_DIR/neutron/ra"
+        stop_process q-l3
+    fi
 
-    plugins=$(iniget $NEUTRON_CONF DEFAULT service_plugins)
-    if [ $plugins ]; then
-        plugins+=","
+    if is_service_enabled q-meta neutron-metadata-agent; then
+        stop_process q-meta
+    fi
+
+    if is_service_enabled q-metering neutron-metering; then
+        neutron_metering_stop
+    fi
+
+    if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
+        sudo pkill -9 -f $NEUTRON_ROOTWRAP-daemon || :
     fi
-    plugins+="${service_plugin_class}"
-    iniset $NEUTRON_CONF DEFAULT service_plugins $plugins
 }
 
-function _neutron_ml2_extension_driver_add {
-    local driver=$1
-    local drivers=""
+# stop_neutron() - Stop running processes (non-screen)
+function stop_neutron {
+    stop_other
+    stop_l2_agent
 
-    drivers=$(iniget $NEUTRON_CORE_PLUGIN_CONF ml2 extension_drivers)
-    if [ $drivers ]; then
-        drivers+=","
+    if [[ $Q_AGENT == "ovn" && $SKIP_STOP_OVN != "True" ]]; then
+        stop_ovn
     fi
-    drivers+="${driver}"
-    iniset $NEUTRON_CORE_PLUGIN_CONF ml2 extension_drivers $drivers
 }
 
-function neutron_server_config_add_new {
-    deprecated "Using lib/neutron is deprecated, and it will be removed in AA release!"
-    _NEUTRON_SERVER_EXTRA_CONF_FILES_ABS+=($1)
+# _move_neutron_addresses_route() - Move the primary IP to the OVS bridge
+# on startup, or back to the public interface on cleanup. If no IP is
+# configured on the interface, just add it as a port to the OVS bridge.
+function _move_neutron_addresses_route {
+    local from_intf=$1
+    local to_intf=$2
+    local add_ovs_port=$3
+    local del_ovs_port=$4
+    local af=$5
+
+    if [[ -n "$from_intf" && -n "$to_intf" ]]; then
+        # Remove the primary IP address from $from_intf and add it to $to_intf,
+        # along with the default route, if it exists.  Also, when called
+        # on configure we will also add $from_intf as a port on $to_intf,
+        # assuming it is an OVS bridge.
+
+        local IP_REPLACE=""
+        local IP_DEL=""
+        local IP_UP=""
+        local DEFAULT_ROUTE_GW
+        DEFAULT_ROUTE_GW=$(ip -f $af r | awk "/default.+$from_intf\s/ { print \$3; exit }")
+        local ADD_OVS_PORT=""
+        local DEL_OVS_PORT=""
+        local ARP_CMD=""
+
+        IP_BRD=$(ip -f $af a s dev $from_intf scope global primary | grep inet | awk '{ print $2, $3, $4; exit }')
+
+        if [ "$DEFAULT_ROUTE_GW" != "" ]; then
+            ADD_DEFAULT_ROUTE="sudo ip -f $af r replace default via $DEFAULT_ROUTE_GW dev $to_intf"
+        fi
+
+        if [[ "$add_ovs_port" == "True" ]]; then
+            ADD_OVS_PORT="sudo ovs-vsctl --may-exist add-port $to_intf $from_intf"
+        fi
+
+        if [[ "$del_ovs_port" == "True" ]]; then
+            DEL_OVS_PORT="sudo ovs-vsctl --if-exists del-port $from_intf $to_intf"
+        fi
+
+        if [[ "$IP_BRD" != "" ]]; then
+            IP_DEL="sudo ip addr del $IP_BRD dev $from_intf"
+            IP_REPLACE="sudo ip addr replace $IP_BRD dev $to_intf"
+            IP_UP="sudo ip link set $to_intf up"
+            if [[ "$af" == "inet" ]]; then
+                IP=$(echo $IP_BRD | awk '{ print $1; exit }' | grep -o -E '(.*)/' | cut -d "/" -f1)
+                ARP_CMD="sudo arping -A -c 3 -w 5 -I $to_intf $IP "
+            fi
+        fi
+
+        # The add/del OVS port calls have to happen either before or
+        # after the address is moved in order to not leave it orphaned.
+        $DEL_OVS_PORT; $IP_DEL; $IP_REPLACE; $IP_UP; $ADD_OVS_PORT; $ADD_DEFAULT_ROUTE; $ARP_CMD
+    fi
 }
 
-# neutron_deploy_rootwrap_filters() - deploy rootwrap filters
-function neutron_deploy_rootwrap_filters_new {
-    deprecated "Using lib/neutron is deprecated, and it will be removed in AA release!"
-    local srcdir=$1
-    sudo install -d -o root -g root -m 755 $NEUTRON_CONF_DIR/rootwrap.d
-    sudo install -o root -g root -m 644 $srcdir/etc/neutron/rootwrap.d/*.filters $NEUTRON_CONF_DIR/rootwrap.d
+# _configure_public_network_connectivity() - Configures connectivity to the
+# external network using $PUBLIC_INTERFACE or NAT on the single interface
+# machines
+function _configure_public_network_connectivity {
+    # If we've given a PUBLIC_INTERFACE to take over, then we assume
+    # that we can own the whole thing, and privot it into the OVS
+    # bridge. If we are not, we're probably on a single interface
+    # machine, and we just setup NAT so that fixed guests can get out.
+    if [[ -n "$PUBLIC_INTERFACE" ]]; then
+        _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" True False "inet"
+
+        if [[ $(ip -f inet6 a s dev "$PUBLIC_INTERFACE" | grep -c 'global') != 0 ]]; then
+            _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" False False "inet6"
+        fi
+    else
+        for d in $default_v4_route_devs; do
+            sudo iptables -t nat -A POSTROUTING -o $d -s $FLOATING_RANGE -j MASQUERADE
+        done
+    fi
 }
 
-# Dispatch functions
-# These are needed for compatibility between the old and new implementations
-# where there are function name overlaps.  These will be removed when
-# neutron-legacy is removed.
-# TODO(sc68cal) Remove when neutron-legacy is no more.
+# cleanup_neutron() - Remove residual data files, anything left over from previous
+# runs that a clean run would need to clean up
 function cleanup_neutron {
     if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
         stop_process neutron-api
@@ -623,153 +789,367 @@ function cleanup_neutron {
         sudo rm -f $(apache_site_config_for neutron-api)
     fi
 
-    if is_neutron_legacy_enabled; then
-        # Call back to old function
-        cleanup_mutnauq "$@"
-    else
-        cleanup_neutron_new "$@"
+    if [[ -n "$OVS_PHYSICAL_BRIDGE" ]]; then
+        _move_neutron_addresses_route "$OVS_PHYSICAL_BRIDGE" "$PUBLIC_INTERFACE" False True "inet"
+
+        if [[ $(ip -f inet6 a s dev "$OVS_PHYSICAL_BRIDGE" | grep -c 'global') != 0 ]]; then
+            # ip(8) wants the prefix length when deleting
+            local v6_gateway
+            v6_gateway=$(ip -6 a s dev $OVS_PHYSICAL_BRIDGE | grep $IPV6_PUBLIC_NETWORK_GATEWAY | awk '{ print $2 }')
+            sudo ip -6 addr del $v6_gateway dev $OVS_PHYSICAL_BRIDGE
+            _move_neutron_addresses_route "$OVS_PHYSICAL_BRIDGE" "$PUBLIC_INTERFACE" False False "inet6"
+        fi
+
+        if is_provider_network && is_ironic_hardware; then
+            for IP in $(ip addr show dev $OVS_PHYSICAL_BRIDGE | grep ' inet ' | awk '{print $2}'); do
+                sudo ip addr del $IP dev $OVS_PHYSICAL_BRIDGE
+                sudo ip addr add $IP dev $PUBLIC_INTERFACE
+            done
+            sudo route del -net $FIXED_RANGE gw $NETWORK_GATEWAY dev $OVS_PHYSICAL_BRIDGE
+        fi
     fi
-}
 
-function configure_neutron {
-    if is_neutron_legacy_enabled; then
-        # Call back to old function
-        configure_mutnauq "$@"
-    else
-        configure_neutron_new "$@"
+    if is_neutron_ovs_base_plugin; then
+        neutron_ovs_base_cleanup
     fi
 
-    if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
-        write_uwsgi_config "$NEUTRON_UWSGI_CONF" "$NEUTRON_BIN_DIR/neutron-api" "/networking"
+    if [[ $Q_AGENT == "linuxbridge" ]]; then
+        neutron_lb_cleanup
+    fi
+
+    # delete all namespaces created by neutron
+    for ns in $(sudo ip netns list | grep -o -E '(qdhcp|qrouter|fip|snat)-[0-9a-f-]*'); do
+        sudo ip netns delete ${ns}
+    done
+
+    if [[ $Q_AGENT == "ovn" ]]; then
+        cleanup_ovn
     fi
 }
 
-# configure_rbac_policies() - Configure Neutron to enforce new RBAC
-# policies and scopes if NEUTRON_ENFORCE_SCOPE == True
-function configure_rbac_policies {
-    if [[ "$NEUTRON_ENFORCE_SCOPE" == "True" || "$ENFORCE_SCOPE" == "True" ]]; then
-        iniset $NEUTRON_CONF oslo_policy enforce_new_defaults True
-        iniset $NEUTRON_CONF oslo_policy enforce_scope True
+
+function _create_neutron_conf_dir {
+    # Put config files in ``NEUTRON_CONF_DIR`` for everyone to find
+    sudo install -d -o $STACK_USER $NEUTRON_CONF_DIR
+}
+
+# _configure_neutron_common()
+# Set common config for all neutron server and agents.
+# This MUST be called before other ``_configure_neutron_*`` functions.
+function _configure_neutron_common {
+    _create_neutron_conf_dir
+
+    # Uses oslo config generator to generate core sample configuration files
+    (cd $NEUTRON_DIR && exec ./tools/generate_config_file_samples.sh)
+
+    cp $NEUTRON_DIR/etc/neutron.conf.sample $NEUTRON_CONF
+
+    Q_POLICY_FILE=$NEUTRON_CONF_DIR/policy.json
+
+    # allow neutron user to administer neutron to match neutron account
+    # NOTE(amotoki): This is required for nova works correctly with neutron.
+    if [ -f $NEUTRON_DIR/etc/policy.json ]; then
+        cp $NEUTRON_DIR/etc/policy.json $Q_POLICY_FILE
+        sed -i 's/"context_is_admin":  "role:admin"/"context_is_admin":  "role:admin or user_name:neutron"/g' $Q_POLICY_FILE
     else
-        iniset $NEUTRON_CONF oslo_policy enforce_new_defaults False
-        iniset $NEUTRON_CONF oslo_policy enforce_scope False
+        echo '{"context_is_admin":  "role:admin or user_name:neutron"}' > $Q_POLICY_FILE
+    fi
+
+    # Set plugin-specific variables ``Q_DB_NAME``, ``Q_PLUGIN_CLASS``.
+    # For main plugin config file, set ``Q_PLUGIN_CONF_PATH``, ``Q_PLUGIN_CONF_FILENAME``.
+    neutron_plugin_configure_common
+
+    if [[ "$Q_PLUGIN_CONF_PATH" == '' || "$Q_PLUGIN_CONF_FILENAME" == '' || "$Q_PLUGIN_CLASS" == '' ]]; then
+        die $LINENO "Neutron plugin not set.. exiting"
+    fi
+
+    # If needed, move config file from ``$NEUTRON_DIR/etc/neutron`` to ``NEUTRON_CONF_DIR``
+    mkdir -p /$Q_PLUGIN_CONF_PATH
+    Q_PLUGIN_CONF_FILE=$Q_PLUGIN_CONF_PATH/$Q_PLUGIN_CONF_FILENAME
+    # NOTE(slaweq): NEUTRON_CORE_PLUGIN_CONF is used e.g. in neutron repository,
+    # it was previously defined in the lib/neutron module which is now deleted.
+    NEUTRON_CORE_PLUGIN_CONF=$Q_PLUGIN_CONF_FILE
+    # NOTE(hichihara): Some neutron vendor plugins were already decomposed and
+    # there is no config file in Neutron tree. They should prepare the file in each plugin.
+    if [ -f "$NEUTRON_DIR/$Q_PLUGIN_CONF_FILE.sample" ]; then
+        cp "$NEUTRON_DIR/$Q_PLUGIN_CONF_FILE.sample" /$Q_PLUGIN_CONF_FILE
+    elif [ -f $NEUTRON_DIR/$Q_PLUGIN_CONF_FILE ]; then
+        cp $NEUTRON_DIR/$Q_PLUGIN_CONF_FILE /$Q_PLUGIN_CONF_FILE
+    fi
+
+    iniset $NEUTRON_CONF database connection `database_connection_url $Q_DB_NAME`
+    iniset $NEUTRON_CONF DEFAULT state_path $DATA_DIR/neutron
+    iniset $NEUTRON_CONF DEFAULT use_syslog $SYSLOG
+    iniset $NEUTRON_CONF DEFAULT bind_host $Q_LISTEN_ADDRESS
+    iniset $NEUTRON_CONF oslo_concurrency lock_path $DATA_DIR/neutron/lock
+
+    # NOTE(freerunner): Need to adjust Region Name for nova in multiregion installation
+    iniset $NEUTRON_CONF nova region_name $REGION_NAME
+
+    if [ "$VIRT_DRIVER" = 'fake' ]; then
+        # Disable arbitrary limits
+        iniset $NEUTRON_CONF quotas quota_network -1
+        iniset $NEUTRON_CONF quotas quota_subnet -1
+        iniset $NEUTRON_CONF quotas quota_port -1
+        iniset $NEUTRON_CONF quotas quota_security_group -1
+        iniset $NEUTRON_CONF quotas quota_security_group_rule -1
+    fi
+
+    # Format logging
+    setup_logging $NEUTRON_CONF
+
+    if is_service_enabled tls-proxy && [ "$NEUTRON_DEPLOY_MOD_WSGI" == "False" ]; then
+        # Set the service port for a proxy to take the original
+        iniset $NEUTRON_CONF DEFAULT bind_port "$Q_PORT_INT"
+        iniset $NEUTRON_CONF oslo_middleware enable_proxy_headers_parsing True
     fi
+
+    _neutron_setup_rootwrap
 }
 
+function _configure_neutron_dhcp_agent {
 
-function configure_neutron_nova {
-    if is_neutron_legacy_enabled; then
-        # Call back to old function
-        create_nova_conf_neutron $NOVA_CONF
-        if [[ "${CELLSV2_SETUP}" == "superconductor" ]]; then
-            for i in $(seq 1 $NOVA_NUM_CELLS); do
-                local conf
-                conf=$(conductor_conf $i)
-                create_nova_conf_neutron $conf
-            done
-        fi
-    else
-        configure_neutron_nova_new $NOVA_CONF
-        if [[ "${CELLSV2_SETUP}" == "superconductor" ]]; then
-            for i in $(seq 1 $NOVA_NUM_CELLS); do
-                local conf
-                conf=$(conductor_conf $i)
-                configure_neutron_nova_new $conf
-            done
+    cp $NEUTRON_DIR/etc/dhcp_agent.ini.sample $Q_DHCP_CONF_FILE
+
+    iniset $Q_DHCP_CONF_FILE DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
+    # make it so we have working DNS from guests
+    iniset $Q_DHCP_CONF_FILE DEFAULT dnsmasq_local_resolv True
+    configure_root_helper_options $Q_DHCP_CONF_FILE
+
+    if ! is_service_enabled q-l3 neutron-l3; then
+        if [[ "$ENABLE_ISOLATED_METADATA" = "True" ]]; then
+            iniset $Q_DHCP_CONF_FILE DEFAULT enable_isolated_metadata $ENABLE_ISOLATED_METADATA
+            iniset $Q_DHCP_CONF_FILE DEFAULT enable_metadata_network $ENABLE_METADATA_NETWORK
+        else
+            if [[ "$ENABLE_METADATA_NETWORK" = "True" ]]; then
+                die "$LINENO" "Enable isolated metadata is a must for metadata network"
+            fi
         fi
     fi
+
+    _neutron_setup_interface_driver $Q_DHCP_CONF_FILE
+
+    neutron_plugin_configure_dhcp_agent $Q_DHCP_CONF_FILE
 }
 
-function create_neutron_accounts {
-    if is_neutron_legacy_enabled; then
-        # Call back to old function
-        create_mutnauq_accounts "$@"
-    else
-        create_neutron_accounts_new "$@"
-    fi
+
+function _configure_neutron_metadata_agent {
+    cp $NEUTRON_DIR/etc/metadata_agent.ini.sample $Q_META_CONF_FILE
+
+    iniset $Q_META_CONF_FILE DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
+    iniset $Q_META_CONF_FILE DEFAULT nova_metadata_host $Q_META_DATA_IP
+    iniset $Q_META_CONF_FILE DEFAULT metadata_workers $API_WORKERS
+    configure_root_helper_options $Q_META_CONF_FILE
 }
 
-function init_neutron {
-    if is_neutron_legacy_enabled; then
-        # Call back to old function
-        init_mutnauq "$@"
-    else
-        init_neutron_new "$@"
-    fi
+function _configure_neutron_ceilometer_notifications {
+    iniset $NEUTRON_CONF oslo_messaging_notifications driver messagingv2
 }
 
-function install_neutron {
-    if is_neutron_legacy_enabled; then
-        # Call back to old function
-        install_mutnauq "$@"
-    else
-        install_neutron_new "$@"
+function _configure_neutron_metering {
+    neutron_agent_metering_configure_common
+    neutron_agent_metering_configure_agent
+}
+
+function _configure_dvr {
+    iniset $NEUTRON_CONF DEFAULT router_distributed True
+    iniset $Q_L3_CONF_FILE DEFAULT agent_mode $Q_DVR_MODE
+}
+
+
+# _configure_neutron_plugin_agent() - Set config files for neutron plugin agent
+# It is called when q-agt is enabled.
+function _configure_neutron_plugin_agent {
+    # Specify the default root helper prior to agent configuration to
+    # ensure that an agent's configuration can override the default
+    configure_root_helper_options /$Q_PLUGIN_CONF_FILE
+    iniset $NEUTRON_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
+
+    # Configure agent for plugin
+    neutron_plugin_configure_plugin_agent
+}
+
+function _replace_api_paste_composite {
+    local sep
+    sep=$(echo -ne "\x01")
+    # Replace it
+    $sudo sed -i -e "s/\/\: neutronversions_composite/\/"${NEUTRON_ENDPOINT_SERVICE_NAME}"\/\: neutronversions_composite/" "$Q_API_PASTE_FILE"
+    $sudo sed -i -e "s/\/healthcheck\: healthcheck/\/"${NEUTRON_ENDPOINT_SERVICE_NAME}"\/healthcheck\: healthcheck/" "$Q_API_PASTE_FILE"
+    $sudo sed -i -e "s/\/v2.0\: neutronapi_v2_0/\/"${NEUTRON_ENDPOINT_SERVICE_NAME}"\/v2.0\: neutronapi_v2_0/" "$Q_API_PASTE_FILE"
+}
+
+# _configure_neutron_service() - Set config files for neutron service
+# It is called when q-svc is enabled.
+function _configure_neutron_service {
+    Q_API_PASTE_FILE=$NEUTRON_CONF_DIR/api-paste.ini
+    cp $NEUTRON_DIR/etc/api-paste.ini $Q_API_PASTE_FILE
+
+    if [[ -n "$NEUTRON_ENDPOINT_SERVICE_NAME" ]]; then
+        _replace_api_paste_composite
     fi
+
+    # Update either configuration file with plugin
+    iniset $NEUTRON_CONF DEFAULT core_plugin $Q_PLUGIN_CLASS
+
+    iniset $NEUTRON_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
+    iniset $NEUTRON_CONF oslo_policy policy_file $Q_POLICY_FILE
+
+    iniset $NEUTRON_CONF DEFAULT auth_strategy $Q_AUTH_STRATEGY
+    configure_keystone_authtoken_middleware $NEUTRON_CONF $Q_ADMIN_USERNAME
+
+    # Configuration for neutron notifications to nova.
+    iniset $NEUTRON_CONF DEFAULT notify_nova_on_port_status_changes $Q_NOTIFY_NOVA_PORT_STATUS_CHANGES
+    iniset $NEUTRON_CONF DEFAULT notify_nova_on_port_data_changes $Q_NOTIFY_NOVA_PORT_DATA_CHANGES
+
+    configure_keystone_authtoken_middleware $NEUTRON_CONF nova nova
+
+    # Configuration for placement client
+    configure_keystone_authtoken_middleware $NEUTRON_CONF placement placement
+
+    # Configure plugin
+    neutron_plugin_configure_service
 }
 
+# Utility Functions
+#------------------
+
+# neutron_service_plugin_class_add() - add service plugin class
 function neutron_service_plugin_class_add {
-    if is_neutron_legacy_enabled; then
-        # Call back to old function
-        _neutron_service_plugin_class_add "$@"
-    else
-        neutron_service_plugin_class_add_new "$@"
+    local service_plugin_class=$1
+    if [[ $Q_SERVICE_PLUGIN_CLASSES == '' ]]; then
+        Q_SERVICE_PLUGIN_CLASSES=$service_plugin_class
+    elif [[ ! ,${Q_SERVICE_PLUGIN_CLASSES}, =~ ,${service_plugin_class}, ]]; then
+        Q_SERVICE_PLUGIN_CLASSES="$Q_SERVICE_PLUGIN_CLASSES,$service_plugin_class"
     fi
 }
 
+# neutron_ml2_extension_driver_add() - add ML2 extension driver
 function neutron_ml2_extension_driver_add {
-    if is_neutron_legacy_enabled; then
-        # Call back to old function
-        _neutron_ml2_extension_driver_add_old "$@"
-    else
-        _neutron_ml2_extension_driver_add "$@"
+    local extension=$1
+    if [[ $Q_ML2_PLUGIN_EXT_DRIVERS == '' ]]; then
+        Q_ML2_PLUGIN_EXT_DRIVERS=$extension
+    elif [[ ! ,${Q_ML2_PLUGIN_EXT_DRIVERS}, =~ ,${extension}, ]]; then
+        Q_ML2_PLUGIN_EXT_DRIVERS="$Q_ML2_PLUGIN_EXT_DRIVERS,$extension"
     fi
 }
 
-function install_neutron_agent_packages {
-    if is_neutron_legacy_enabled; then
-        # Call back to old function
-        install_neutron_agent_packages_mutnauq "$@"
-    else
-        :
-    fi
+# neutron_server_config_add() - add server config file
+function neutron_server_config_add {
+    _Q_PLUGIN_EXTRA_CONF_FILES_ABS+=($1)
 }
 
-function neutron_server_config_add {
-    if is_neutron_legacy_enabled; then
-        # Call back to old function
-        mutnauq_server_config_add "$@"
-    else
-        neutron_server_config_add_new "$@"
+# neutron_deploy_rootwrap_filters() - deploy rootwrap filters to $Q_CONF_ROOTWRAP_D (owned by root).
+function neutron_deploy_rootwrap_filters {
+    if [[ "$Q_USE_ROOTWRAP" == "False" ]]; then
+        return
     fi
+    local srcdir=$1
+    sudo install -d -o root -m 755 $Q_CONF_ROOTWRAP_D
+    sudo install -o root -m 644 $srcdir/etc/neutron/rootwrap.d/* $Q_CONF_ROOTWRAP_D/
 }
 
-function start_neutron {
-    if is_neutron_legacy_enabled; then
-        # Call back to old function
-        start_mutnauq_l2_agent "$@"
-        start_mutnauq_other_agents "$@"
+# _neutron_setup_rootwrap() - configure Neutron's rootwrap
+function _neutron_setup_rootwrap {
+    if [[ "$Q_USE_ROOTWRAP" == "False" ]]; then
+        return
+    fi
+    # Wipe any existing ``rootwrap.d`` files first
+    Q_CONF_ROOTWRAP_D=$NEUTRON_CONF_DIR/rootwrap.d
+    if [[ -d $Q_CONF_ROOTWRAP_D ]]; then
+        sudo rm -rf $Q_CONF_ROOTWRAP_D
+    fi
+
+    neutron_deploy_rootwrap_filters $NEUTRON_DIR
+
+    # Set up ``rootwrap.conf``, pointing to ``$NEUTRON_CONF_DIR/rootwrap.d``
+    # location moved in newer versions, prefer new location
+    if test -r $NEUTRON_DIR/etc/neutron/rootwrap.conf; then
+        sudo install -o root -g root -m 644 $NEUTRON_DIR/etc/neutron/rootwrap.conf $Q_RR_CONF_FILE
     else
-        start_neutron_new "$@"
+        sudo install -o root -g root -m 644 $NEUTRON_DIR/etc/rootwrap.conf $Q_RR_CONF_FILE
     fi
+    sudo sed -e "s:^filters_path=.*$:filters_path=$Q_CONF_ROOTWRAP_D:" -i $Q_RR_CONF_FILE
+    sudo sed -e 's:^exec_dirs=\(.*\)$:exec_dirs=\1,/usr/local/bin:' -i $Q_RR_CONF_FILE
+
+    # Specify ``rootwrap.conf`` as first parameter to neutron-rootwrap
+    ROOTWRAP_SUDOER_CMD="$NEUTRON_ROOTWRAP $Q_RR_CONF_FILE *"
+    ROOTWRAP_DAEMON_SUDOER_CMD="$NEUTRON_ROOTWRAP-daemon $Q_RR_CONF_FILE"
+
+    # Set up the rootwrap sudoers for neutron
+    TEMPFILE=`mktemp`
+    echo "$STACK_USER ALL=(root) NOPASSWD: $ROOTWRAP_SUDOER_CMD" >$TEMPFILE
+    echo "$STACK_USER ALL=(root) NOPASSWD: $ROOTWRAP_DAEMON_SUDOER_CMD" >>$TEMPFILE
+    chmod 0440 $TEMPFILE
+    sudo chown root:root $TEMPFILE
+    sudo mv $TEMPFILE /etc/sudoers.d/neutron-rootwrap
+
+    # Update the root_helper
+    configure_root_helper_options $NEUTRON_CONF
 }
 
-function stop_neutron {
-    if is_neutron_legacy_enabled; then
-        # Call back to old function
-        stop_mutnauq "$@"
-    else
-        stop_neutron_new "$@"
+function configure_root_helper_options {
+    local conffile=$1
+    iniset $conffile agent root_helper "$Q_RR_COMMAND"
+    if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
+        iniset $conffile agent root_helper_daemon "$Q_RR_DAEMON_COMMAND"
     fi
 }
 
-function neutron_deploy_rootwrap_filters {
-    if is_neutron_legacy_enabled; then
-        # Call back to old function
-        _neutron_deploy_rootwrap_filters "$@"
-    else
-        neutron_deploy_rootwrap_filters_new "$@"
+function _neutron_setup_interface_driver {
+
+    # ovs_use_veth needs to be set before the plugin configuration
+    # occurs to allow plugins to override the setting.
+    iniset $1 DEFAULT ovs_use_veth $Q_OVS_USE_VETH
+
+    neutron_plugin_setup_interface_driver $1
+}
+# Functions for Neutron Exercises
+#--------------------------------
+
+function delete_probe {
+    local from_net="$1"
+    net_id=`_get_net_id $from_net`
+    probe_id=`neutron-debug --os-tenant-name admin --os-username admin --os-password $ADMIN_PASSWORD probe-list -c id -c network_id | grep $net_id | awk '{print $2}'`
+    neutron-debug --os-tenant-name admin --os-username admin probe-delete $probe_id
+}
+
+function _get_net_id {
+    openstack --os-cloud devstack-admin --os-region-name="$REGION_NAME" --os-project-name admin --os-username admin --os-password $ADMIN_PASSWORD network list | grep $1 | awk '{print $2}'
+}
+
+function _get_probe_cmd_prefix {
+    local from_net="$1"
+    net_id=`_get_net_id $from_net`
+    probe_id=`neutron-debug --os-tenant-name admin --os-username admin --os-password $ADMIN_PASSWORD probe-list -c id -c network_id | grep $net_id | awk '{print $2}' | head -n 1`
+    echo "$Q_RR_COMMAND ip netns exec qprobe-$probe_id"
+}
+
+# ssh check
+function _ssh_check_neutron {
+    local from_net=$1
+    local key_file=$2
+    local ip=$3
+    local user=$4
+    local timeout_sec=$5
+    local probe_cmd = ""
+    probe_cmd=`_get_probe_cmd_prefix $from_net`
+    local testcmd="$probe_cmd ssh -o StrictHostKeyChecking=no -i $key_file ${user}@$ip echo success"
+    test_with_retry "$testcmd" "server $ip didn't become ssh-able" $timeout_sec
+}
+
+function plugin_agent_add_l2_agent_extension {
+    local l2_agent_extension=$1
+    if [[ -z "$L2_AGENT_EXTENSIONS" ]]; then
+        L2_AGENT_EXTENSIONS=$l2_agent_extension
+    elif [[ ! ,${L2_AGENT_EXTENSIONS}, =~ ,${l2_agent_extension}, ]]; then
+        L2_AGENT_EXTENSIONS+=",$l2_agent_extension"
     fi
 }
 
 # Restore xtrace
-$XTRACE
+$_XTRACE_NEUTRON
+
+# Tell emacs to use shell-script-mode
+## Local variables:
+## mode: shell-script
+## End:
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index baf67f209e..e90400fec1 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -1,1097 +1,6 @@
 #!/bin/bash
-#
-# lib/neutron
-# functions - functions specific to neutron
 
-# Dependencies:
-# ``functions`` file
-# ``DEST`` must be defined
-# ``STACK_USER`` must be defined
+# TODO(slaweq): remove that file when other projects, like e.g. Grenade will
+# be using lib/neutron
 
-# ``stack.sh`` calls the entry points in this order:
-#
-# - install_neutron_agent_packages
-# - install_neutronclient
-# - install_neutron
-# - install_neutron_third_party
-# - configure_neutron
-# - init_neutron
-# - configure_neutron_third_party
-# - init_neutron_third_party
-# - start_neutron_third_party
-# - create_nova_conf_neutron
-# - configure_neutron_after_post_config
-# - start_neutron_service_and_check
-# - check_neutron_third_party_integration
-# - start_neutron_agents
-# - create_neutron_initial_network
-#
-# ``unstack.sh`` calls the entry points in this order:
-#
-# - stop_neutron
-# - stop_neutron_third_party
-# - cleanup_neutron
-
-# Functions in lib/neutron are classified into the following categories:
-#
-# - entry points (called from stack.sh or unstack.sh)
-# - internal functions
-# - neutron exercises
-# - 3rd party programs
-
-
-# Neutron Networking
-# ------------------
-
-# Make sure that neutron is enabled in ``ENABLED_SERVICES``.  If you want
-# to run Neutron on this host, make sure that q-svc is also in
-# ``ENABLED_SERVICES``.
-#
-# See "Neutron Network Configuration" below for additional variables
-# that must be set in localrc for connectivity across hosts with
-# Neutron.
-
-# Settings
-# --------
-
-
-# Neutron Network Configuration
-# -----------------------------
-
-if is_service_enabled tls-proxy; then
-    Q_PROTOCOL="https"
-fi
-
-
-# Set up default directories
-GITDIR["python-neutronclient"]=$DEST/python-neutronclient
-
-
-NEUTRON_DIR=$DEST/neutron
-NEUTRON_FWAAS_DIR=$DEST/neutron-fwaas
-
-# Support entry points installation of console scripts
-if [[ -d $NEUTRON_DIR/bin/neutron-server ]]; then
-    NEUTRON_BIN_DIR=$NEUTRON_DIR/bin
-else
-    NEUTRON_BIN_DIR=$(get_python_exec_prefix)
-fi
-
-NEUTRON_CONF_DIR=/etc/neutron
-NEUTRON_CONF=$NEUTRON_CONF_DIR/neutron.conf
-export NEUTRON_TEST_CONFIG_FILE=${NEUTRON_TEST_CONFIG_FILE:-"$NEUTRON_CONF_DIR/debug.ini"}
-
-# NEUTRON_DEPLOY_MOD_WSGI defines how neutron is deployed, allowed values:
-# - False (default) : Run neutron under Eventlet
-# - True : Run neutron under uwsgi
-# TODO(annp): Switching to uwsgi in next cycle if things turn out to be stable
-# enough
-NEUTRON_DEPLOY_MOD_WSGI=$(trueorfalse False NEUTRON_DEPLOY_MOD_WSGI)
-
-NEUTRON_UWSGI_CONF=$NEUTRON_CONF_DIR/neutron-api-uwsgi.ini
-
-# If NEUTRON_ENFORCE_SCOPE == True, it will set "enforce_scope"
-# and "enforce_new_defaults" to True in the Neutron's config to enforce usage
-# of the new RBAC policies and scopes.
-NEUTRON_ENFORCE_SCOPE=$(trueorfalse False NEUTRON_ENFORCE_SCOPE)
-
-# Agent binaries.  Note, binary paths for other agents are set in per-service
-# scripts in lib/neutron_plugins/services/
-AGENT_DHCP_BINARY="$NEUTRON_BIN_DIR/neutron-dhcp-agent"
-AGENT_L3_BINARY=${AGENT_L3_BINARY:-"$NEUTRON_BIN_DIR/neutron-l3-agent"}
-AGENT_META_BINARY="$NEUTRON_BIN_DIR/neutron-metadata-agent"
-
-# Agent config files. Note, plugin-specific Q_PLUGIN_CONF_FILE is set and
-# loaded from per-plugin  scripts in lib/neutron_plugins/
-Q_DHCP_CONF_FILE=$NEUTRON_CONF_DIR/dhcp_agent.ini
-Q_L3_CONF_FILE=$NEUTRON_CONF_DIR/l3_agent.ini
-Q_META_CONF_FILE=$NEUTRON_CONF_DIR/metadata_agent.ini
-
-# Default name for Neutron database
-Q_DB_NAME=${Q_DB_NAME:-neutron}
-# Default Neutron Plugin
-Q_PLUGIN=${Q_PLUGIN:-ml2}
-# Default Neutron Port
-Q_PORT=${Q_PORT:-9696}
-# Default Neutron Internal Port when using TLS proxy
-Q_PORT_INT=${Q_PORT_INT:-19696}
-# Default Neutron Host
-Q_HOST=${Q_HOST:-$SERVICE_HOST}
-# Default protocol
-Q_PROTOCOL=${Q_PROTOCOL:-$SERVICE_PROTOCOL}
-# Default listen address
-Q_LISTEN_ADDRESS=${Q_LISTEN_ADDRESS:-$(ipv6_unquote $SERVICE_LISTEN_ADDRESS)}
-# Default admin username
-Q_ADMIN_USERNAME=${Q_ADMIN_USERNAME:-neutron}
-# Default auth strategy
-Q_AUTH_STRATEGY=${Q_AUTH_STRATEGY:-keystone}
-# RHEL's support for namespaces requires using veths with ovs
-Q_OVS_USE_VETH=${Q_OVS_USE_VETH:-False}
-Q_USE_ROOTWRAP=${Q_USE_ROOTWRAP:-True}
-Q_USE_ROOTWRAP_DAEMON=$(trueorfalse True Q_USE_ROOTWRAP_DAEMON)
-# Meta data IP
-Q_META_DATA_IP=${Q_META_DATA_IP:-$(ipv6_unquote $SERVICE_HOST)}
-# Allow Overlapping IP among subnets
-Q_ALLOW_OVERLAPPING_IP=${Q_ALLOW_OVERLAPPING_IP:-True}
-Q_NOTIFY_NOVA_PORT_STATUS_CHANGES=${Q_NOTIFY_NOVA_PORT_STATUS_CHANGES:-True}
-Q_NOTIFY_NOVA_PORT_DATA_CHANGES=${Q_NOTIFY_NOVA_PORT_DATA_CHANGES:-True}
-VIF_PLUGGING_IS_FATAL=${VIF_PLUGGING_IS_FATAL:-True}
-VIF_PLUGGING_TIMEOUT=${VIF_PLUGGING_TIMEOUT:-300}
-
-# Allow to skip stopping of OVN services
-SKIP_STOP_OVN=${SKIP_STOP_OVN:-False}
-
-# The directory which contains files for Q_PLUGIN_EXTRA_CONF_FILES.
-# /etc/neutron is assumed by many of devstack plugins.  Do not change.
-_Q_PLUGIN_EXTRA_CONF_PATH=/etc/neutron
-
-# The name of the service in the endpoint URL
-NEUTRON_ENDPOINT_SERVICE_NAME=${NEUTRON_ENDPOINT_SERVICE_NAME-"networking"}
-if [[ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" && -z "$NEUTRON_ENDPOINT_SERVICE_NAME" ]]; then
-    NEUTRON_ENDPOINT_SERVICE_NAME="networking"
-fi
-
-# List of config file names in addition to the main plugin config file
-# To add additional plugin config files, use ``neutron_server_config_add``
-# utility function.  For example:
-#
-#    ``neutron_server_config_add file1``
-#
-# These config files are relative to ``/etc/neutron``.  The above
-# example would specify ``--config-file /etc/neutron/file1`` for
-# neutron server.
-declare -a -g Q_PLUGIN_EXTRA_CONF_FILES
-
-# same as Q_PLUGIN_EXTRA_CONF_FILES, but with absolute path.
-declare -a -g _Q_PLUGIN_EXTRA_CONF_FILES_ABS
-
-
-Q_RR_CONF_FILE=$NEUTRON_CONF_DIR/rootwrap.conf
-if [[ "$Q_USE_ROOTWRAP" == "False" ]]; then
-    Q_RR_COMMAND="sudo"
-else
-    NEUTRON_ROOTWRAP=$(get_rootwrap_location neutron)
-    Q_RR_COMMAND="sudo $NEUTRON_ROOTWRAP $Q_RR_CONF_FILE"
-    if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
-        Q_RR_DAEMON_COMMAND="sudo $NEUTRON_ROOTWRAP-daemon $Q_RR_CONF_FILE"
-    fi
-fi
-
-
-# Distributed Virtual Router (DVR) configuration
-# Can be:
-# - ``legacy``   - No DVR functionality
-# - ``dvr_snat`` - Controller or single node DVR
-# - ``dvr``      - Compute node in multi-node DVR
-#
-Q_DVR_MODE=${Q_DVR_MODE:-legacy}
-if [[ "$Q_DVR_MODE" != "legacy" ]]; then
-    Q_ML2_PLUGIN_MECHANISM_DRIVERS=openvswitch,l2population
-fi
-
-# Provider Network Configurations
-# --------------------------------
-
-# The following variables control the Neutron ML2 plugins' allocation
-# of tenant networks and availability of provider networks. If these
-# are not configured in ``localrc``, tenant networks will be local to
-# the host (with no remote connectivity), and no physical resources
-# will be available for the allocation of provider networks.
-
-# To disable tunnels (GRE or VXLAN) for tenant networks,
-# set to False in ``local.conf``.
-# GRE tunnels are only supported by the openvswitch.
-ENABLE_TENANT_TUNNELS=${ENABLE_TENANT_TUNNELS:-True}
-
-# If using GRE, VXLAN or GENEVE tunnels for tenant networks,
-# specify the range of IDs from which tenant networks are
-# allocated. Can be overridden in ``localrc`` if necessary.
-TENANT_TUNNEL_RANGES=${TENANT_TUNNEL_RANGES:-1:1000}
-
-# To use VLANs for tenant networks, set to True in localrc. VLANs
-# are supported by the ML2 plugins, requiring additional configuration
-# described below.
-ENABLE_TENANT_VLANS=${ENABLE_TENANT_VLANS:-False}
-
-# If using VLANs for tenant networks, set in ``localrc`` to specify
-# the range of VLAN VIDs from which tenant networks are
-# allocated. An external network switch must be configured to
-# trunk these VLANs between hosts for multi-host connectivity.
-#
-# Example: ``TENANT_VLAN_RANGE=1000:1999``
-TENANT_VLAN_RANGE=${TENANT_VLAN_RANGE:-}
-
-# If using VLANs for tenant networks, or if using flat or VLAN
-# provider networks, set in ``localrc`` to the name of the physical
-# network, and also configure ``OVS_PHYSICAL_BRIDGE`` for the
-# openvswitch agent or ``LB_PHYSICAL_INTERFACE`` for the linuxbridge
-# agent, as described below.
-#
-# Example: ``PHYSICAL_NETWORK=default``
-PHYSICAL_NETWORK=${PHYSICAL_NETWORK:-public}
-
-# With the openvswitch agent, if using VLANs for tenant networks,
-# or if using flat or VLAN provider networks, set in ``localrc`` to
-# the name of the OVS bridge to use for the physical network. The
-# bridge will be created if it does not already exist, but a
-# physical interface must be manually added to the bridge as a
-# port for external connectivity.
-#
-# Example: ``OVS_PHYSICAL_BRIDGE=br-eth1``
-OVS_PHYSICAL_BRIDGE=${OVS_PHYSICAL_BRIDGE:-br-ex}
-
-# With the linuxbridge agent, if using VLANs for tenant networks,
-# or if using flat or VLAN provider networks, set in ``localrc`` to
-# the name of the network interface to use for the physical
-# network.
-#
-# Example: ``LB_PHYSICAL_INTERFACE=eth1``
-if [[ $Q_AGENT == "linuxbridge" && -z ${LB_PHYSICAL_INTERFACE} ]]; then
-    default_route_dev=$( (ip route; ip -6 route) | grep ^default | head -n 1 | awk '{print $5}')
-    die_if_not_set $LINENO default_route_dev "Failure retrieving default route device"
-    LB_PHYSICAL_INTERFACE=$default_route_dev
-fi
-
-# With the openvswitch plugin, set to True in ``localrc`` to enable
-# provider GRE tunnels when ``ENABLE_TENANT_TUNNELS`` is False.
-#
-# Example: ``OVS_ENABLE_TUNNELING=True``
-OVS_ENABLE_TUNNELING=${OVS_ENABLE_TUNNELING:-$ENABLE_TENANT_TUNNELS}
-
-# Use DHCP agent for providing metadata service in the case of
-# without L3 agent (No Route Agent), set to True in localrc.
-ENABLE_ISOLATED_METADATA=${ENABLE_ISOLATED_METADATA:-False}
-
-# Add a static route as dhcp option, so the request to 169.254.169.254
-# will be able to reach through a route(DHCP agent)
-# This option require ENABLE_ISOLATED_METADATA = True
-ENABLE_METADATA_NETWORK=${ENABLE_METADATA_NETWORK:-False}
-# Neutron plugin specific functions
-# ---------------------------------
-
-# Please refer to ``lib/neutron_plugins/README.md`` for details.
-if [ -f $TOP_DIR/lib/neutron_plugins/$Q_PLUGIN ]; then
-    source $TOP_DIR/lib/neutron_plugins/$Q_PLUGIN
-fi
-
-# Agent metering service plugin functions
-# -------------------------------------------
-
-# Hardcoding for 1 service plugin for now
-source $TOP_DIR/lib/neutron_plugins/services/metering
-
-# L3 Service functions
-source $TOP_DIR/lib/neutron_plugins/services/l3
-
-# Additional Neutron service plugins
-source $TOP_DIR/lib/neutron_plugins/services/placement
-source $TOP_DIR/lib/neutron_plugins/services/trunk
-source $TOP_DIR/lib/neutron_plugins/services/qos
-
-# Use security group or not
-if has_neutron_plugin_security_group; then
-    Q_USE_SECGROUP=${Q_USE_SECGROUP:-True}
-else
-    Q_USE_SECGROUP=False
-fi
-
-# Save trace setting
-_XTRACE_NEUTRON=$(set +o | grep xtrace)
-set +o xtrace
-
-
-# Functions
-# ---------
-
-function _determine_config_server {
-    if [[ "$Q_PLUGIN_EXTRA_CONF_PATH" != '' ]]; then
-        if [[ "$Q_PLUGIN_EXTRA_CONF_PATH" = "$_Q_PLUGIN_EXTRA_CONF_PATH" ]]; then
-            deprecated "Q_PLUGIN_EXTRA_CONF_PATH is deprecated"
-        else
-            die $LINENO "Q_PLUGIN_EXTRA_CONF_PATH is deprecated"
-        fi
-    fi
-    if [[ ${#Q_PLUGIN_EXTRA_CONF_FILES[@]} > 0 ]]; then
-        deprecated "Q_PLUGIN_EXTRA_CONF_FILES is deprecated.  Use neutron_server_config_add instead."
-    fi
-    for cfg_file in ${Q_PLUGIN_EXTRA_CONF_FILES[@]}; do
-        _Q_PLUGIN_EXTRA_CONF_FILES_ABS+=($_Q_PLUGIN_EXTRA_CONF_PATH/$cfg_file)
-    done
-
-    local cfg_file
-    local opts="--config-file $NEUTRON_CONF --config-file /$Q_PLUGIN_CONF_FILE"
-    for cfg_file in ${_Q_PLUGIN_EXTRA_CONF_FILES_ABS[@]}; do
-        opts+=" --config-file $cfg_file"
-    done
-    echo "$opts"
-}
-
-function _determine_config_l3 {
-    local opts="--config-file $NEUTRON_CONF --config-file $Q_L3_CONF_FILE"
-    echo "$opts"
-}
-
-# For services and agents that require it, dynamically construct a list of
-# --config-file arguments that are passed to the binary.
-function determine_config_files {
-    local opts=""
-    case "$1" in
-        "neutron-server") opts="$(_determine_config_server)" ;;
-        "neutron-l3-agent") opts="$(_determine_config_l3)" ;;
-    esac
-    if [ -z "$opts" ] ; then
-        die $LINENO "Could not determine config files for $1."
-    fi
-    echo "$opts"
-}
-
-# configure_mutnauq()
-# Set common config for all neutron server and agents.
-function configure_mutnauq {
-    _configure_neutron_common
-    iniset_rpc_backend neutron $NEUTRON_CONF
-
-    if is_service_enabled q-metering; then
-        _configure_neutron_metering
-    fi
-    if is_service_enabled q-agt q-svc; then
-        _configure_neutron_service
-    fi
-    if is_service_enabled q-agt; then
-        _configure_neutron_plugin_agent
-    fi
-    if is_service_enabled q-dhcp; then
-        _configure_neutron_dhcp_agent
-    fi
-    if is_service_enabled q-l3; then
-        _configure_neutron_l3_agent
-    fi
-    if is_service_enabled q-meta; then
-        _configure_neutron_metadata_agent
-    fi
-
-    if [[ "$Q_DVR_MODE" != "legacy" ]]; then
-        _configure_dvr
-    fi
-    if is_service_enabled ceilometer; then
-        _configure_neutron_ceilometer_notifications
-    fi
-
-    if [[ $Q_AGENT == "ovn" ]]; then
-        configure_ovn
-        configure_ovn_plugin
-    fi
-
-    # Configure Neutron's advanced services
-    if is_service_enabled q-placement neutron-placement; then
-        configure_placement_extension
-    fi
-    if is_service_enabled q-trunk neutron-trunk; then
-        configure_trunk_extension
-    fi
-    if is_service_enabled q-qos neutron-qos; then
-        configure_qos
-        if is_service_enabled q-l3 neutron-l3; then
-            configure_l3_agent_extension_fip_qos
-            configure_l3_agent_extension_gateway_ip_qos
-        fi
-    fi
-
-    iniset $NEUTRON_CONF DEFAULT api_workers "$API_WORKERS"
-    # devstack is not a tool for running uber scale OpenStack
-    # clouds, therefore running without a dedicated RPC worker
-    # for state reports is more than adequate.
-    iniset $NEUTRON_CONF DEFAULT rpc_state_report_workers 0
-}
-
-function create_nova_conf_neutron {
-    local conf=${1:-$NOVA_CONF}
-    iniset $conf neutron auth_type "password"
-    iniset $conf neutron auth_url "$KEYSTONE_SERVICE_URI"
-    iniset $conf neutron username "$Q_ADMIN_USERNAME"
-    iniset $conf neutron password "$SERVICE_PASSWORD"
-    iniset $conf neutron user_domain_name "$SERVICE_DOMAIN_NAME"
-    iniset $conf neutron project_name "$SERVICE_PROJECT_NAME"
-    iniset $conf neutron project_domain_name "$SERVICE_DOMAIN_NAME"
-    iniset $conf neutron auth_strategy "$Q_AUTH_STRATEGY"
-    iniset $conf neutron region_name "$REGION_NAME"
-
-    # optionally set options in nova_conf
-    neutron_plugin_create_nova_conf $conf
-
-    if is_service_enabled q-meta; then
-        iniset $conf neutron service_metadata_proxy "True"
-    fi
-
-    iniset $conf DEFAULT vif_plugging_is_fatal "$VIF_PLUGGING_IS_FATAL"
-    iniset $conf DEFAULT vif_plugging_timeout "$VIF_PLUGGING_TIMEOUT"
-}
-
-# create_mutnauq_accounts() - Set up common required neutron accounts
-
-# Tenant               User       Roles
-# ------------------------------------------------------------------
-# service              neutron    admin        # if enabled
-
-# Migrated from keystone_data.sh
-function create_mutnauq_accounts {
-    local neutron_url
-    if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
-        neutron_url=$Q_PROTOCOL://$SERVICE_HOST/
-    else
-        neutron_url=$Q_PROTOCOL://$SERVICE_HOST:$Q_PORT/
-    fi
-    if [ ! -z "$NEUTRON_ENDPOINT_SERVICE_NAME" ]; then
-        neutron_url=$neutron_url$NEUTRON_ENDPOINT_SERVICE_NAME
-    fi
-
-    if [[ "$ENABLED_SERVICES" =~ "q-svc" ]]; then
-
-        create_service_user "neutron"
-
-        get_or_create_service "neutron" "network" "Neutron Service"
-        get_or_create_endpoint \
-            "network" \
-            "$REGION_NAME" "$neutron_url"
-    fi
-}
-
-# init_mutnauq() - Initialize databases, etc.
-function init_mutnauq {
-    recreate_database $Q_DB_NAME
-    time_start "dbsync"
-    # Run Neutron db migrations
-    $NEUTRON_BIN_DIR/neutron-db-manage --config-file $NEUTRON_CONF --config-file /$Q_PLUGIN_CONF_FILE upgrade head
-    time_stop "dbsync"
-}
-
-# install_mutnauq() - Collect source and prepare
-function install_mutnauq {
-    # Install neutron-lib from git so we make sure we're testing
-    # the latest code.
-    if use_library_from_git "neutron-lib"; then
-        git_clone_by_name "neutron-lib"
-        setup_dev_lib "neutron-lib"
-    fi
-
-    git_clone $NEUTRON_REPO $NEUTRON_DIR $NEUTRON_BRANCH
-    setup_develop $NEUTRON_DIR
-
-    if [[ $Q_AGENT == "ovn" ]]; then
-        install_ovn
-    fi
-}
-
-# install_neutron_agent_packages() - Collect source and prepare
-function install_neutron_agent_packages_mutnauq {
-    # radvd doesn't come with the OS. Install it if the l3 service is enabled.
-    if is_service_enabled q-l3; then
-        install_package radvd
-    fi
-    # install packages that are specific to plugin agent(s)
-    if is_service_enabled q-agt q-dhcp q-l3; then
-        neutron_plugin_install_agent_packages
-    fi
-}
-
-# Finish neutron configuration
-function configure_neutron_after_post_config {
-    if [[ $Q_SERVICE_PLUGIN_CLASSES != '' ]]; then
-        iniset $NEUTRON_CONF DEFAULT service_plugins $Q_SERVICE_PLUGIN_CLASSES
-    fi
-    configure_rbac_policies
-}
-
-# configure_rbac_policies() - Configure Neutron to enforce new RBAC
-# policies and scopes if NEUTRON_ENFORCE_SCOPE == True
-function configure_rbac_policies {
-    if [[ "$NEUTRON_ENFORCE_SCOPE" == "True" || "$ENFORCE_SCOPE" == True ]]; then
-        iniset $NEUTRON_CONF oslo_policy enforce_new_defaults True
-        iniset $NEUTRON_CONF oslo_policy enforce_scope True
-    else
-        iniset $NEUTRON_CONF oslo_policy enforce_new_defaults False
-        iniset $NEUTRON_CONF oslo_policy enforce_scope False
-    fi
-}
-
-# Start running OVN processes
-function start_ovn_services {
-    if [[ $Q_AGENT == "ovn" ]]; then
-        init_ovn
-        start_ovn
-        if [[ "$OVN_L3_CREATE_PUBLIC_NETWORK" == "True" ]]; then
-            if [[ "$NEUTRON_CREATE_INITIAL_NETWORKS" != "True" ]]; then
-                echo "OVN_L3_CREATE_PUBLIC_NETWORK=True is being ignored "
-                echo "because NEUTRON_CREATE_INITIAL_NETWORKS is set to False"
-            else
-                create_public_bridge
-            fi
-        fi
-    fi
-}
-
-# Start running processes
-function start_neutron_service_and_check {
-    local service_port=$Q_PORT
-    local service_protocol=$Q_PROTOCOL
-    local cfg_file_options
-    local neutron_url
-
-    cfg_file_options="$(determine_config_files neutron-server)"
-
-    if is_service_enabled tls-proxy; then
-        service_port=$Q_PORT_INT
-        service_protocol="http"
-    fi
-    # Start the Neutron service
-    if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
-        enable_service neutron-api
-        run_process neutron-api "$(which uwsgi) --procname-prefix neutron-api --ini $NEUTRON_UWSGI_CONF"
-        neutron_url=$Q_PROTOCOL://$Q_HOST/
-        enable_service neutron-rpc-server
-        run_process neutron-rpc-server "$NEUTRON_BIN_DIR/neutron-rpc-server $cfg_file_options"
-    else
-        run_process q-svc "$NEUTRON_BIN_DIR/neutron-server $cfg_file_options"
-        neutron_url=$service_protocol://$Q_HOST:$service_port/
-        # Start proxy if enabled
-        if is_service_enabled tls-proxy; then
-            start_tls_proxy neutron '*' $Q_PORT $Q_HOST $Q_PORT_INT
-        fi
-    fi
-    if [ ! -z "$NEUTRON_ENDPOINT_SERVICE_NAME" ]; then
-        neutron_url=$neutron_url$NEUTRON_ENDPOINT_SERVICE_NAME
-    fi
-    echo "Waiting for Neutron to start..."
-
-    local testcmd="wget ${ssl_ca} --no-proxy -q -O- $neutron_url"
-    test_with_retry "$testcmd" "Neutron did not start" $SERVICE_TIMEOUT
-}
-
-# Control of the l2 agent is separated out to make it easier to test partial
-# upgrades (everything upgraded except the L2 agent)
-function start_mutnauq_l2_agent {
-    run_process q-agt "$AGENT_BINARY --config-file $NEUTRON_CONF --config-file /$Q_PLUGIN_CONF_FILE"
-
-    if is_provider_network && [[ $Q_AGENT == "openvswitch" ]]; then
-        sudo ovs-vsctl --no-wait -- --may-exist add-port $OVS_PHYSICAL_BRIDGE $PUBLIC_INTERFACE
-        sudo ip link set $OVS_PHYSICAL_BRIDGE up
-        sudo ip link set br-int up
-        sudo ip link set $PUBLIC_INTERFACE up
-        if is_ironic_hardware; then
-            for IP in $(ip addr show dev $PUBLIC_INTERFACE | grep ' inet ' | awk '{print $2}'); do
-                sudo ip addr del $IP dev $PUBLIC_INTERFACE
-                sudo ip addr add $IP dev $OVS_PHYSICAL_BRIDGE
-            done
-            sudo ip route replace $FIXED_RANGE via $NETWORK_GATEWAY dev $OVS_PHYSICAL_BRIDGE
-        fi
-    fi
-}
-
-function start_mutnauq_other_agents {
-    run_process q-dhcp "$AGENT_DHCP_BINARY --config-file $NEUTRON_CONF --config-file $Q_DHCP_CONF_FILE"
-
-    run_process q-l3 "$AGENT_L3_BINARY $(determine_config_files neutron-l3-agent)"
-
-    run_process q-meta "$AGENT_META_BINARY --config-file $NEUTRON_CONF --config-file $Q_META_CONF_FILE"
-    run_process q-metering "$AGENT_METERING_BINARY --config-file $NEUTRON_CONF --config-file $METERING_AGENT_CONF_FILENAME"
-}
-
-# Start running processes, including screen
-function start_neutron_agents {
-    # Start up the neutron agents if enabled
-    start_mutnauq_l2_agent
-    start_mutnauq_other_agents
-}
-
-function stop_mutnauq_l2_agent {
-    stop_process q-agt
-}
-
-# stop_mutnauq_other() - Stop running processes
-function stop_mutnauq_other {
-    if is_service_enabled q-dhcp; then
-        stop_process q-dhcp
-        pid=$(ps aux | awk '/[d]nsmasq.+interface=(tap|ns-)/ { print $2 }')
-        [ ! -z "$pid" ] && sudo kill -9 $pid
-    fi
-
-    if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
-        stop_process neutron-rpc-server
-        stop_process neutron-api
-    else
-        stop_process q-svc
-    fi
-
-    if is_service_enabled q-l3; then
-        sudo pkill -f "radvd -C $DATA_DIR/neutron/ra"
-        stop_process q-l3
-    fi
-
-    if is_service_enabled q-meta; then
-        stop_process q-meta
-    fi
-
-    if is_service_enabled q-metering; then
-        neutron_metering_stop
-    fi
-
-    if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
-        sudo pkill -9 -f $NEUTRON_ROOTWRAP-daemon || :
-    fi
-}
-
-# stop_neutron() - Stop running processes (non-screen)
-function stop_mutnauq {
-    stop_mutnauq_other
-    stop_mutnauq_l2_agent
-
-    if [[ $Q_AGENT == "ovn" && $SKIP_STOP_OVN != "True" ]]; then
-        stop_ovn
-    fi
-}
-
-# _move_neutron_addresses_route() - Move the primary IP to the OVS bridge
-# on startup, or back to the public interface on cleanup. If no IP is
-# configured on the interface, just add it as a port to the OVS bridge.
-function _move_neutron_addresses_route {
-    local from_intf=$1
-    local to_intf=$2
-    local add_ovs_port=$3
-    local del_ovs_port=$4
-    local af=$5
-
-    if [[ -n "$from_intf" && -n "$to_intf" ]]; then
-        # Remove the primary IP address from $from_intf and add it to $to_intf,
-        # along with the default route, if it exists.  Also, when called
-        # on configure we will also add $from_intf as a port on $to_intf,
-        # assuming it is an OVS bridge.
-
-        local IP_REPLACE=""
-        local IP_DEL=""
-        local IP_UP=""
-        local DEFAULT_ROUTE_GW
-        DEFAULT_ROUTE_GW=$(ip -f $af r | awk "/default.+$from_intf\s/ { print \$3; exit }")
-        local ADD_OVS_PORT=""
-        local DEL_OVS_PORT=""
-        local ARP_CMD=""
-
-        IP_BRD=$(ip -f $af a s dev $from_intf scope global primary | grep inet | awk '{ print $2, $3, $4; exit }')
-
-        if [ "$DEFAULT_ROUTE_GW" != "" ]; then
-            ADD_DEFAULT_ROUTE="sudo ip -f $af r replace default via $DEFAULT_ROUTE_GW dev $to_intf"
-        fi
-
-        if [[ "$add_ovs_port" == "True" ]]; then
-            ADD_OVS_PORT="sudo ovs-vsctl --may-exist add-port $to_intf $from_intf"
-        fi
-
-        if [[ "$del_ovs_port" == "True" ]]; then
-            DEL_OVS_PORT="sudo ovs-vsctl --if-exists del-port $from_intf $to_intf"
-        fi
-
-        if [[ "$IP_BRD" != "" ]]; then
-            IP_DEL="sudo ip addr del $IP_BRD dev $from_intf"
-            IP_REPLACE="sudo ip addr replace $IP_BRD dev $to_intf"
-            IP_UP="sudo ip link set $to_intf up"
-            if [[ "$af" == "inet" ]]; then
-                IP=$(echo $IP_BRD | awk '{ print $1; exit }' | grep -o -E '(.*)/' | cut -d "/" -f1)
-                ARP_CMD="sudo arping -A -c 3 -w 5 -I $to_intf $IP "
-            fi
-        fi
-
-        # The add/del OVS port calls have to happen either before or
-        # after the address is moved in order to not leave it orphaned.
-        $DEL_OVS_PORT; $IP_DEL; $IP_REPLACE; $IP_UP; $ADD_OVS_PORT; $ADD_DEFAULT_ROUTE; $ARP_CMD
-    fi
-}
-
-# _configure_public_network_connectivity() - Configures connectivity to the
-# external network using $PUBLIC_INTERFACE or NAT on the single interface
-# machines
-function _configure_public_network_connectivity {
-    # If we've given a PUBLIC_INTERFACE to take over, then we assume
-    # that we can own the whole thing, and privot it into the OVS
-    # bridge. If we are not, we're probably on a single interface
-    # machine, and we just setup NAT so that fixed guests can get out.
-    if [[ -n "$PUBLIC_INTERFACE" ]]; then
-        _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" True False "inet"
-
-        if [[ $(ip -f inet6 a s dev "$PUBLIC_INTERFACE" | grep -c 'global') != 0 ]]; then
-            _move_neutron_addresses_route "$PUBLIC_INTERFACE" "$OVS_PHYSICAL_BRIDGE" False False "inet6"
-        fi
-    else
-        for d in $default_v4_route_devs; do
-            sudo iptables -t nat -A POSTROUTING -o $d -s $FLOATING_RANGE -j MASQUERADE
-        done
-    fi
-}
-
-# cleanup_mutnauq() - Remove residual data files, anything left over from previous
-# runs that a clean run would need to clean up
-function cleanup_mutnauq {
-
-    if [[ -n "$OVS_PHYSICAL_BRIDGE" ]]; then
-        _move_neutron_addresses_route "$OVS_PHYSICAL_BRIDGE" "$PUBLIC_INTERFACE" False True "inet"
-
-        if [[ $(ip -f inet6 a s dev "$OVS_PHYSICAL_BRIDGE" | grep -c 'global') != 0 ]]; then
-            # ip(8) wants the prefix length when deleting
-            local v6_gateway
-            v6_gateway=$(ip -6 a s dev $OVS_PHYSICAL_BRIDGE | grep $IPV6_PUBLIC_NETWORK_GATEWAY | awk '{ print $2 }')
-            sudo ip -6 addr del $v6_gateway dev $OVS_PHYSICAL_BRIDGE
-            _move_neutron_addresses_route "$OVS_PHYSICAL_BRIDGE" "$PUBLIC_INTERFACE" False False "inet6"
-        fi
-
-        if is_provider_network && is_ironic_hardware; then
-            for IP in $(ip addr show dev $OVS_PHYSICAL_BRIDGE | grep ' inet ' | awk '{print $2}'); do
-                sudo ip addr del $IP dev $OVS_PHYSICAL_BRIDGE
-                sudo ip addr add $IP dev $PUBLIC_INTERFACE
-            done
-            sudo route del -net $FIXED_RANGE gw $NETWORK_GATEWAY dev $OVS_PHYSICAL_BRIDGE
-        fi
-    fi
-
-    if is_neutron_ovs_base_plugin; then
-        neutron_ovs_base_cleanup
-    fi
-
-    if [[ $Q_AGENT == "linuxbridge" ]]; then
-        neutron_lb_cleanup
-    fi
-
-    # delete all namespaces created by neutron
-    for ns in $(sudo ip netns list | grep -o -E '(qdhcp|qrouter|fip|snat)-[0-9a-f-]*'); do
-        sudo ip netns delete ${ns}
-    done
-
-    if [[ $Q_AGENT == "ovn" ]]; then
-        cleanup_ovn
-    fi
-}
-
-
-function _create_neutron_conf_dir {
-    # Put config files in ``NEUTRON_CONF_DIR`` for everyone to find
-    sudo install -d -o $STACK_USER $NEUTRON_CONF_DIR
-}
-
-# _configure_neutron_common()
-# Set common config for all neutron server and agents.
-# This MUST be called before other ``_configure_neutron_*`` functions.
-function _configure_neutron_common {
-    _create_neutron_conf_dir
-
-    # Uses oslo config generator to generate core sample configuration files
-    (cd $NEUTRON_DIR && exec ./tools/generate_config_file_samples.sh)
-
-    cp $NEUTRON_DIR/etc/neutron.conf.sample $NEUTRON_CONF
-
-    Q_POLICY_FILE=$NEUTRON_CONF_DIR/policy.json
-
-    # allow neutron user to administer neutron to match neutron account
-    # NOTE(amotoki): This is required for nova works correctly with neutron.
-    if [ -f $NEUTRON_DIR/etc/policy.json ]; then
-        cp $NEUTRON_DIR/etc/policy.json $Q_POLICY_FILE
-        sed -i 's/"context_is_admin":  "role:admin"/"context_is_admin":  "role:admin or user_name:neutron"/g' $Q_POLICY_FILE
-    else
-        echo '{"context_is_admin":  "role:admin or user_name:neutron"}' > $Q_POLICY_FILE
-    fi
-
-    # Set plugin-specific variables ``Q_DB_NAME``, ``Q_PLUGIN_CLASS``.
-    # For main plugin config file, set ``Q_PLUGIN_CONF_PATH``, ``Q_PLUGIN_CONF_FILENAME``.
-    neutron_plugin_configure_common
-
-    if [[ "$Q_PLUGIN_CONF_PATH" == '' || "$Q_PLUGIN_CONF_FILENAME" == '' || "$Q_PLUGIN_CLASS" == '' ]]; then
-        die $LINENO "Neutron plugin not set.. exiting"
-    fi
-
-    # If needed, move config file from ``$NEUTRON_DIR/etc/neutron`` to ``NEUTRON_CONF_DIR``
-    mkdir -p /$Q_PLUGIN_CONF_PATH
-    Q_PLUGIN_CONF_FILE=$Q_PLUGIN_CONF_PATH/$Q_PLUGIN_CONF_FILENAME
-    # NOTE(hichihara): Some neutron vendor plugins were already decomposed and
-    # there is no config file in Neutron tree. They should prepare the file in each plugin.
-    if [ -f "$NEUTRON_DIR/$Q_PLUGIN_CONF_FILE.sample" ]; then
-        cp "$NEUTRON_DIR/$Q_PLUGIN_CONF_FILE.sample" /$Q_PLUGIN_CONF_FILE
-    elif [ -f $NEUTRON_DIR/$Q_PLUGIN_CONF_FILE ]; then
-        cp $NEUTRON_DIR/$Q_PLUGIN_CONF_FILE /$Q_PLUGIN_CONF_FILE
-    fi
-
-    iniset $NEUTRON_CONF database connection `database_connection_url $Q_DB_NAME`
-    iniset $NEUTRON_CONF DEFAULT state_path $DATA_DIR/neutron
-    iniset $NEUTRON_CONF DEFAULT use_syslog $SYSLOG
-    iniset $NEUTRON_CONF DEFAULT bind_host $Q_LISTEN_ADDRESS
-    iniset $NEUTRON_CONF oslo_concurrency lock_path $DATA_DIR/neutron/lock
-
-    # NOTE(freerunner): Need to adjust Region Name for nova in multiregion installation
-    iniset $NEUTRON_CONF nova region_name $REGION_NAME
-
-    if [ "$VIRT_DRIVER" = 'fake' ]; then
-        # Disable arbitrary limits
-        iniset $NEUTRON_CONF quotas quota_network -1
-        iniset $NEUTRON_CONF quotas quota_subnet -1
-        iniset $NEUTRON_CONF quotas quota_port -1
-        iniset $NEUTRON_CONF quotas quota_security_group -1
-        iniset $NEUTRON_CONF quotas quota_security_group_rule -1
-    fi
-
-    # Format logging
-    setup_logging $NEUTRON_CONF
-
-    if is_service_enabled tls-proxy && [ "$NEUTRON_DEPLOY_MOD_WSGI" == "False" ]; then
-        # Set the service port for a proxy to take the original
-        iniset $NEUTRON_CONF DEFAULT bind_port "$Q_PORT_INT"
-        iniset $NEUTRON_CONF oslo_middleware enable_proxy_headers_parsing True
-    fi
-
-    _neutron_setup_rootwrap
-}
-
-function _configure_neutron_dhcp_agent {
-
-    cp $NEUTRON_DIR/etc/dhcp_agent.ini.sample $Q_DHCP_CONF_FILE
-
-    iniset $Q_DHCP_CONF_FILE DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-    # make it so we have working DNS from guests
-    iniset $Q_DHCP_CONF_FILE DEFAULT dnsmasq_local_resolv True
-    iniset $Q_DHCP_CONF_FILE AGENT root_helper "$Q_RR_COMMAND"
-    if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
-        iniset $Q_DHCP_CONF_FILE AGENT root_helper_daemon "$Q_RR_DAEMON_COMMAND"
-    fi
-
-    if ! is_service_enabled q-l3; then
-        if [[ "$ENABLE_ISOLATED_METADATA" = "True" ]]; then
-            iniset $Q_DHCP_CONF_FILE DEFAULT enable_isolated_metadata $ENABLE_ISOLATED_METADATA
-            iniset $Q_DHCP_CONF_FILE DEFAULT enable_metadata_network $ENABLE_METADATA_NETWORK
-        else
-            if [[ "$ENABLE_METADATA_NETWORK" = "True" ]]; then
-                die "$LINENO" "Enable isolated metadata is a must for metadata network"
-            fi
-        fi
-    fi
-
-    _neutron_setup_interface_driver $Q_DHCP_CONF_FILE
-
-    neutron_plugin_configure_dhcp_agent $Q_DHCP_CONF_FILE
-}
-
-
-function _configure_neutron_metadata_agent {
-    cp $NEUTRON_DIR/etc/metadata_agent.ini.sample $Q_META_CONF_FILE
-
-    iniset $Q_META_CONF_FILE DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-    iniset $Q_META_CONF_FILE DEFAULT nova_metadata_host $Q_META_DATA_IP
-    iniset $Q_META_CONF_FILE DEFAULT metadata_workers $API_WORKERS
-    iniset $Q_META_CONF_FILE AGENT root_helper "$Q_RR_COMMAND"
-    if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
-        iniset $Q_META_CONF_FILE AGENT root_helper_daemon "$Q_RR_DAEMON_COMMAND"
-    fi
-}
-
-function _configure_neutron_ceilometer_notifications {
-    iniset $NEUTRON_CONF oslo_messaging_notifications driver messagingv2
-}
-
-function _configure_neutron_metering {
-    neutron_agent_metering_configure_common
-    neutron_agent_metering_configure_agent
-}
-
-function _configure_dvr {
-    iniset $NEUTRON_CONF DEFAULT router_distributed True
-    iniset $Q_L3_CONF_FILE DEFAULT agent_mode $Q_DVR_MODE
-}
-
-
-# _configure_neutron_plugin_agent() - Set config files for neutron plugin agent
-# It is called when q-agt is enabled.
-function _configure_neutron_plugin_agent {
-    # Specify the default root helper prior to agent configuration to
-    # ensure that an agent's configuration can override the default
-    iniset /$Q_PLUGIN_CONF_FILE agent root_helper "$Q_RR_COMMAND"
-    if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE  agent root_helper_daemon "$Q_RR_DAEMON_COMMAND"
-    fi
-    iniset $NEUTRON_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-
-    # Configure agent for plugin
-    neutron_plugin_configure_plugin_agent
-}
-
-function _replace_api_paste_composite {
-    local sep
-    sep=$(echo -ne "\x01")
-    # Replace it
-    $sudo sed -i -e "s/\/\: neutronversions_composite/\/"${NEUTRON_ENDPOINT_SERVICE_NAME}"\/\: neutronversions_composite/" "$Q_API_PASTE_FILE"
-    $sudo sed -i -e "s/\/healthcheck\: healthcheck/\/"${NEUTRON_ENDPOINT_SERVICE_NAME}"\/healthcheck\: healthcheck/" "$Q_API_PASTE_FILE"
-    $sudo sed -i -e "s/\/v2.0\: neutronapi_v2_0/\/"${NEUTRON_ENDPOINT_SERVICE_NAME}"\/v2.0\: neutronapi_v2_0/" "$Q_API_PASTE_FILE"
-}
-
-# _configure_neutron_service() - Set config files for neutron service
-# It is called when q-svc is enabled.
-function _configure_neutron_service {
-    Q_API_PASTE_FILE=$NEUTRON_CONF_DIR/api-paste.ini
-    cp $NEUTRON_DIR/etc/api-paste.ini $Q_API_PASTE_FILE
-
-    if [[ -n "$NEUTRON_ENDPOINT_SERVICE_NAME" ]]; then
-        _replace_api_paste_composite
-    fi
-
-    # Update either configuration file with plugin
-    iniset $NEUTRON_CONF DEFAULT core_plugin $Q_PLUGIN_CLASS
-
-    iniset $NEUTRON_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-    iniset $NEUTRON_CONF oslo_policy policy_file $Q_POLICY_FILE
-
-    iniset $NEUTRON_CONF DEFAULT auth_strategy $Q_AUTH_STRATEGY
-    configure_keystone_authtoken_middleware $NEUTRON_CONF $Q_ADMIN_USERNAME
-
-    # Configuration for neutron notifications to nova.
-    iniset $NEUTRON_CONF DEFAULT notify_nova_on_port_status_changes $Q_NOTIFY_NOVA_PORT_STATUS_CHANGES
-    iniset $NEUTRON_CONF DEFAULT notify_nova_on_port_data_changes $Q_NOTIFY_NOVA_PORT_DATA_CHANGES
-
-    configure_keystone_authtoken_middleware $NEUTRON_CONF nova nova
-
-    # Configuration for placement client
-    configure_keystone_authtoken_middleware $NEUTRON_CONF placement placement
-
-    # Configure plugin
-    neutron_plugin_configure_service
-}
-
-# Utility Functions
-#------------------
-
-# _neutron_service_plugin_class_add() - add service plugin class
-function _neutron_service_plugin_class_add {
-    local service_plugin_class=$1
-    if [[ $Q_SERVICE_PLUGIN_CLASSES == '' ]]; then
-        Q_SERVICE_PLUGIN_CLASSES=$service_plugin_class
-    elif [[ ! ,${Q_SERVICE_PLUGIN_CLASSES}, =~ ,${service_plugin_class}, ]]; then
-        Q_SERVICE_PLUGIN_CLASSES="$Q_SERVICE_PLUGIN_CLASSES,$service_plugin_class"
-    fi
-}
-
-# _neutron_ml2_extension_driver_add_old() - add ML2 extension driver
-function _neutron_ml2_extension_driver_add_old {
-    local extension=$1
-    if [[ $Q_ML2_PLUGIN_EXT_DRIVERS == '' ]]; then
-        Q_ML2_PLUGIN_EXT_DRIVERS=$extension
-    elif [[ ! ,${Q_ML2_PLUGIN_EXT_DRIVERS}, =~ ,${extension}, ]]; then
-        Q_ML2_PLUGIN_EXT_DRIVERS="$Q_ML2_PLUGIN_EXT_DRIVERS,$extension"
-    fi
-}
-
-# mutnauq_server_config_add() - add server config file
-function mutnauq_server_config_add {
-    _Q_PLUGIN_EXTRA_CONF_FILES_ABS+=($1)
-}
-
-# _neutron_deploy_rootwrap_filters() - deploy rootwrap filters to $Q_CONF_ROOTWRAP_D (owned by root).
-function _neutron_deploy_rootwrap_filters {
-    if [[ "$Q_USE_ROOTWRAP" == "False" ]]; then
-        return
-    fi
-    local srcdir=$1
-    sudo install -d -o root -m 755 $Q_CONF_ROOTWRAP_D
-    sudo install -o root -m 644 $srcdir/etc/neutron/rootwrap.d/* $Q_CONF_ROOTWRAP_D/
-}
-
-# _neutron_setup_rootwrap() - configure Neutron's rootwrap
-function _neutron_setup_rootwrap {
-    if [[ "$Q_USE_ROOTWRAP" == "False" ]]; then
-        return
-    fi
-    # Wipe any existing ``rootwrap.d`` files first
-    Q_CONF_ROOTWRAP_D=$NEUTRON_CONF_DIR/rootwrap.d
-    if [[ -d $Q_CONF_ROOTWRAP_D ]]; then
-        sudo rm -rf $Q_CONF_ROOTWRAP_D
-    fi
-
-    _neutron_deploy_rootwrap_filters $NEUTRON_DIR
-
-    # Set up ``rootwrap.conf``, pointing to ``$NEUTRON_CONF_DIR/rootwrap.d``
-    # location moved in newer versions, prefer new location
-    if test -r $NEUTRON_DIR/etc/neutron/rootwrap.conf; then
-        sudo install -o root -g root -m 644 $NEUTRON_DIR/etc/neutron/rootwrap.conf $Q_RR_CONF_FILE
-    else
-        sudo install -o root -g root -m 644 $NEUTRON_DIR/etc/rootwrap.conf $Q_RR_CONF_FILE
-    fi
-    sudo sed -e "s:^filters_path=.*$:filters_path=$Q_CONF_ROOTWRAP_D:" -i $Q_RR_CONF_FILE
-    sudo sed -e 's:^exec_dirs=\(.*\)$:exec_dirs=\1,/usr/local/bin:' -i $Q_RR_CONF_FILE
-
-    # Specify ``rootwrap.conf`` as first parameter to neutron-rootwrap
-    ROOTWRAP_SUDOER_CMD="$NEUTRON_ROOTWRAP $Q_RR_CONF_FILE *"
-    ROOTWRAP_DAEMON_SUDOER_CMD="$NEUTRON_ROOTWRAP-daemon $Q_RR_CONF_FILE"
-
-    # Set up the rootwrap sudoers for neutron
-    TEMPFILE=`mktemp`
-    echo "$STACK_USER ALL=(root) NOPASSWD: $ROOTWRAP_SUDOER_CMD" >$TEMPFILE
-    echo "$STACK_USER ALL=(root) NOPASSWD: $ROOTWRAP_DAEMON_SUDOER_CMD" >>$TEMPFILE
-    chmod 0440 $TEMPFILE
-    sudo chown root:root $TEMPFILE
-    sudo mv $TEMPFILE /etc/sudoers.d/neutron-rootwrap
-
-    # Update the root_helper
-    iniset $NEUTRON_CONF agent root_helper "$Q_RR_COMMAND"
-    if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
-        iniset $NEUTRON_CONF agent root_helper_daemon "$Q_RR_DAEMON_COMMAND"
-    fi
-}
-
-function _neutron_setup_interface_driver {
-
-    # ovs_use_veth needs to be set before the plugin configuration
-    # occurs to allow plugins to override the setting.
-    iniset $1 DEFAULT ovs_use_veth $Q_OVS_USE_VETH
-
-    neutron_plugin_setup_interface_driver $1
-}
-# Functions for Neutron Exercises
-#--------------------------------
-
-function delete_probe {
-    local from_net="$1"
-    net_id=`_get_net_id $from_net`
-    probe_id=`neutron-debug --os-tenant-name admin --os-username admin --os-password $ADMIN_PASSWORD probe-list -c id -c network_id | grep $net_id | awk '{print $2}'`
-    neutron-debug --os-tenant-name admin --os-username admin probe-delete $probe_id
-}
-
-function _get_net_id {
-    openstack --os-cloud devstack-admin --os-region-name="$REGION_NAME" --os-project-name admin --os-username admin --os-password $ADMIN_PASSWORD network list | grep $1 | awk '{print $2}'
-}
-
-function _get_probe_cmd_prefix {
-    local from_net="$1"
-    net_id=`_get_net_id $from_net`
-    probe_id=`neutron-debug --os-tenant-name admin --os-username admin --os-password $ADMIN_PASSWORD probe-list -c id -c network_id | grep $net_id | awk '{print $2}' | head -n 1`
-    echo "$Q_RR_COMMAND ip netns exec qprobe-$probe_id"
-}
-
-# ssh check
-function _ssh_check_neutron {
-    local from_net=$1
-    local key_file=$2
-    local ip=$3
-    local user=$4
-    local timeout_sec=$5
-    local probe_cmd = ""
-    probe_cmd=`_get_probe_cmd_prefix $from_net`
-    local testcmd="$probe_cmd ssh -o StrictHostKeyChecking=no -i $key_file ${user}@$ip echo success"
-    test_with_retry "$testcmd" "server $ip didn't become ssh-able" $timeout_sec
-}
-
-function plugin_agent_add_l2_agent_extension {
-    local l2_agent_extension=$1
-    if [[ -z "$L2_AGENT_EXTENSIONS" ]]; then
-        L2_AGENT_EXTENSIONS=$l2_agent_extension
-    elif [[ ! ,${L2_AGENT_EXTENSIONS}, =~ ,${l2_agent_extension}, ]]; then
-        L2_AGENT_EXTENSIONS+=",$l2_agent_extension"
-    fi
-}
-
-# Restore xtrace
-$_XTRACE_NEUTRON
-
-# Tell emacs to use shell-script-mode
-## Local variables:
-## mode: shell-script
-## End:
+source $TOP_DIR/lib/neutron
diff --git a/lib/neutron_plugins/README.md b/lib/neutron_plugins/README.md
index ed40886fda..728aaee85f 100644
--- a/lib/neutron_plugins/README.md
+++ b/lib/neutron_plugins/README.md
@@ -13,7 +13,7 @@ Plugin specific configuration variables should be in this file.
 
 functions
 ---------
-``lib/neutron-legacy`` calls the following functions when the ``$Q_PLUGIN`` is enabled
+``lib/neutron`` calls the following functions when the ``$Q_PLUGIN`` is enabled
 
 * ``neutron_plugin_create_nova_conf`` :
   optionally set options in nova_conf
diff --git a/lib/neutron_plugins/bigswitch_floodlight b/lib/neutron_plugins/bigswitch_floodlight
index d3f5bd5752..84ca7ec42c 100644
--- a/lib/neutron_plugins/bigswitch_floodlight
+++ b/lib/neutron_plugins/bigswitch_floodlight
@@ -67,7 +67,7 @@ function has_neutron_plugin_security_group {
 }
 
 function neutron_plugin_check_adv_test_requirements {
-    is_service_enabled q-agt && is_service_enabled q-dhcp && return 0
+    is_service_enabled q-agt neutron-agent && is_service_enabled q-dhcp neutron-dhcp && return 0
 }
 
 # Restore xtrace
diff --git a/lib/neutron_plugins/brocade b/lib/neutron_plugins/brocade
index 310b72e5ad..96400634af 100644
--- a/lib/neutron_plugins/brocade
+++ b/lib/neutron_plugins/brocade
@@ -72,7 +72,7 @@ function has_neutron_plugin_security_group {
 }
 
 function neutron_plugin_check_adv_test_requirements {
-    is_service_enabled q-agt && is_service_enabled q-dhcp && return 0
+    is_service_enabled q-agt neutron-agent && is_service_enabled q-dhcp neutron-dhcp && return 0
 }
 
 # Restore xtrace
diff --git a/lib/neutron_plugins/linuxbridge_agent b/lib/neutron_plugins/linuxbridge_agent
index bdeaf0f3c6..a392bd0baf 100644
--- a/lib/neutron_plugins/linuxbridge_agent
+++ b/lib/neutron_plugins/linuxbridge_agent
@@ -97,7 +97,7 @@ function neutron_plugin_setup_interface_driver {
 }
 
 function neutron_plugin_check_adv_test_requirements {
-    is_service_enabled q-agt && is_service_enabled q-dhcp && return 0
+    is_service_enabled q-agt neutron-agent && is_service_enabled q-dhcp neutron-dhcp && return 0
 }
 
 # Restore xtrace
diff --git a/lib/neutron_plugins/ml2 b/lib/neutron_plugins/ml2
index 46edacdc54..c2e78c65cc 100644
--- a/lib/neutron_plugins/ml2
+++ b/lib/neutron_plugins/ml2
@@ -67,7 +67,7 @@ function neutron_plugin_configure_common {
     Q_PLUGIN_CLASS="ml2"
     # The ML2 plugin delegates L3 routing/NAT functionality to
     # the L3 service plugin which must therefore be specified.
-    _neutron_service_plugin_class_add $ML2_L3_PLUGIN
+    neutron_service_plugin_class_add $ML2_L3_PLUGIN
 }
 
 function neutron_plugin_configure_service {
diff --git a/lib/neutron_plugins/openvswitch_agent b/lib/neutron_plugins/openvswitch_agent
index 7fed8bf853..6e79984e9b 100644
--- a/lib/neutron_plugins/openvswitch_agent
+++ b/lib/neutron_plugins/openvswitch_agent
@@ -68,7 +68,7 @@ function neutron_plugin_setup_interface_driver {
 }
 
 function neutron_plugin_check_adv_test_requirements {
-    is_service_enabled q-agt && is_service_enabled q-dhcp && return 0
+    is_service_enabled q-agt neutron-agent && is_service_enabled q-dhcp neutron-dhcp && return 0
 }
 
 # Restore xtrace
diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index e64224cbaa..dc8129553c 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -348,7 +348,7 @@ function compile_ovn {
 
 # OVN service sanity check
 function ovn_sanity_check {
-    if is_service_enabled q-agt neutron-agt; then
+    if is_service_enabled q-agt neutron-agent; then
         die $LINENO "The q-agt/neutron-agt service must be disabled with OVN."
     elif is_service_enabled q-l3 neutron-l3; then
         die $LINENO "The q-l3/neutron-l3 service must be disabled with OVN."
@@ -461,7 +461,7 @@ function filter_network_api_extensions {
 function configure_ovn_plugin {
     echo "Configuring Neutron for OVN"
 
-    if is_service_enabled q-svc ; then
+    if is_service_enabled q-svc neutron-api; then
         filter_network_api_extensions
         populate_ml2_config /$Q_PLUGIN_CONF_FILE ml2_type_geneve max_header_size=$OVN_GENEVE_OVERHEAD
         populate_ml2_config /$Q_PLUGIN_CONF_FILE ovn ovn_nb_connection="$OVN_NB_REMOTE"
@@ -485,7 +485,7 @@ function configure_ovn_plugin {
             inicomment /$Q_PLUGIN_CONF_FILE network_log local_output_log_base="$Q_LOG_DRIVER_LOG_BASE"
         fi
 
-        if is_service_enabled q-ovn-metadata-agent; then
+        if is_service_enabled q-ovn-metadata-agent neutron-ovn-metadata-agent; then
             populate_ml2_config /$Q_PLUGIN_CONF_FILE ovn ovn_metadata_enabled=True
         else
             populate_ml2_config /$Q_PLUGIN_CONF_FILE ovn ovn_metadata_enabled=False
@@ -506,7 +506,7 @@ function configure_ovn_plugin {
     fi
 
     if is_service_enabled n-api-meta ; then
-        if is_service_enabled q-ovn-metadata-agent ; then
+        if is_service_enabled q-ovn-metadata-agent neutron-ovn-metadata-agent; then
             iniset $NOVA_CONF neutron service_metadata_proxy True
         fi
     fi
@@ -539,7 +539,7 @@ function configure_ovn {
     fi
 
     # Metadata
-    if is_service_enabled q-ovn-metadata-agent && is_service_enabled ovn-controller; then
+    if is_service_enabled q-ovn-metadata-agent neutron-ovn-metadata-agent && is_service_enabled ovn-controller; then
         sudo install -d -o $STACK_USER $NEUTRON_CONF_DIR
 
         mkdir -p $NEUTRON_DIR/etc/neutron/plugins/ml2
@@ -551,7 +551,7 @@ function configure_ovn {
         iniset $OVN_META_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
         iniset $OVN_META_CONF DEFAULT nova_metadata_host $OVN_META_DATA_HOST
         iniset $OVN_META_CONF DEFAULT metadata_workers $API_WORKERS
-        iniset $OVN_META_CONF DEFAULT state_path $NEUTRON_STATE_PATH
+        iniset $OVN_META_CONF DEFAULT state_path $DATA_DIR/neutron
         iniset $OVN_META_CONF ovs ovsdb_connection tcp:$OVSDB_SERVER_LOCAL_HOST:6640
         iniset $OVN_META_CONF ovn ovn_sb_connection $OVN_SB_REMOTE
         if is_service_enabled tls-proxy; then
@@ -680,7 +680,7 @@ function _start_ovn_services {
     if is_service_enabled ovs-vtep ; then
         _start_process "devstack@ovs-vtep.service"
     fi
-    if is_service_enabled q-ovn-metadata-agent; then
+    if is_service_enabled q-ovn-metadata-agent neutron-ovn-metadata-agent ; then
         _start_process "devstack@q-ovn-metadata-agent.service"
     fi
 }
@@ -743,7 +743,7 @@ function start_ovn {
         fi
     fi
 
-    if is_service_enabled q-ovn-metadata-agent; then
+    if is_service_enabled q-ovn-metadata-agent neutron-ovn-metadata-agent; then
         run_process q-ovn-metadata-agent "$NEUTRON_OVN_BIN_DIR/$NEUTRON_OVN_METADATA_BINARY --config-file $OVN_META_CONF"
         # Format logging
         setup_logging $OVN_META_CONF
@@ -767,7 +767,7 @@ function _stop_process {
 }
 
 function stop_ovn {
-    if is_service_enabled q-ovn-metadata-agent; then
+    if is_service_enabled q-ovn-metadata-agent neutron-ovn-metadata-agent; then
         sudo pkill -9 -f haproxy || :
         _stop_process "devstack@q-ovn-metadata-agent.service"
     fi
diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 3dffc33d37..2bf884a8c4 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -323,7 +323,7 @@ function _neutron_configure_router_v4 {
     openstack --os-cloud devstack-admin-demo --os-region "$REGION_NAME" router set --external-gateway $EXT_NET_ID $ROUTER_ID
 
     # This logic is specific to using OVN or the l3-agent for layer 3
-    if ([[ $Q_AGENT == "ovn" ]] && [[ "$OVN_L3_CREATE_PUBLIC_NETWORK" == "True" ]] && is_service_enabled q-svc neutron-server) || is_service_enabled q-l3 neutron-l3; then
+    if ([[ $Q_AGENT == "ovn" ]] && [[ "$OVN_L3_CREATE_PUBLIC_NETWORK" == "True" ]] && is_service_enabled q-svc neutron-api) || is_service_enabled q-l3 neutron-l3; then
         # Configure and enable public bridge
         local ext_gw_interface="none"
         if is_neutron_ovs_base_plugin; then
@@ -372,7 +372,7 @@ function _neutron_configure_router_v6 {
     fi
 
     # This logic is specific to using OVN or the l3-agent for layer 3
-    if ([[ $Q_AGENT == "ovn" ]] && [[ "$OVN_L3_CREATE_PUBLIC_NETWORK" == "True" ]] && is_service_enabled q-svc neutron-server) || is_service_enabled q-l3 neutron-l3; then
+    if ([[ $Q_AGENT == "ovn" ]] && [[ "$OVN_L3_CREATE_PUBLIC_NETWORK" == "True" ]] && is_service_enabled q-svc neutron-api) || is_service_enabled q-l3 neutron-l3; then
         # if the Linux host considers itself to be a router then it will
         # ignore all router advertisements
         # Ensure IPv6 RAs are accepted on interfaces with a default route.
diff --git a/lib/neutron_plugins/services/metering b/lib/neutron_plugins/services/metering
index 5b32468d21..757a562ee6 100644
--- a/lib/neutron_plugins/services/metering
+++ b/lib/neutron_plugins/services/metering
@@ -12,7 +12,7 @@ AGENT_METERING_BINARY="$NEUTRON_BIN_DIR/neutron-metering-agent"
 METERING_PLUGIN="neutron.services.metering.metering_plugin.MeteringPlugin"
 
 function neutron_agent_metering_configure_common {
-    _neutron_service_plugin_class_add $METERING_PLUGIN
+    neutron_service_plugin_class_add $METERING_PLUGIN
 }
 
 function neutron_agent_metering_configure_agent {
diff --git a/lib/neutron_plugins/services/qos b/lib/neutron_plugins/services/qos
index af9eb3d5b4..c11c315586 100644
--- a/lib/neutron_plugins/services/qos
+++ b/lib/neutron_plugins/services/qos
@@ -6,7 +6,7 @@ function configure_qos_service_plugin {
 
 
 function configure_qos_core_plugin {
-    configure_qos_$NEUTRON_CORE_PLUGIN
+    configure_qos_$Q_PLUGIN
 }
 
 
diff --git a/lib/tempest b/lib/tempest
index eaad6d255e..44a9b6f29f 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -737,12 +737,12 @@ function configure_tempest {
     # Neutron API Extensions
 
     # disable metering if we didn't enable the service
-    if ! is_service_enabled q-metering; then
+    if ! is_service_enabled q-metering neutron-metering; then
         DISABLE_NETWORK_API_EXTENSIONS+=", metering"
     fi
 
     # disable l3_agent_scheduler if we didn't enable L3 agent
-    if ! is_service_enabled q-l3; then
+    if ! is_service_enabled q-l3 neutron-l3; then
         DISABLE_NETWORK_API_EXTENSIONS+=", l3_agent_scheduler"
     fi
 

From aa47cb34ae25b66e46a216e1c9b7b668615b520b Mon Sep 17 00:00:00 2001
From: Rajat Dhasmana <rajatdhasmana@gmail.com>
Date: Tue, 27 Dec 2022 06:11:07 +0000
Subject: [PATCH 2107/2409] Add config options for cinder nfs backend

Currently the cinder nfs backend leaves out few options in a
multi backend deployment. It works in single nfs backend deployment
as devstack-plugin-nfs correctly configures all options[1].
We can clearly see the difference between what devstack-plugin-nfs
configures[1] and what devstack nfs configures[2].

Following options are missing which are added by this patch.
* nas_host
* nas_share_path
* nas_secure_file_operations
* nas_secure_file_permissions
* nfs_snapshot_support

[1] https://github.com/openstack/devstack-plugin-nfs/blob/dd12367f90fc86d42bfebe8a0ebb694dc0308810/devstack/plugin.sh#L60-L68
[2] https://github.com/openstack/devstack/blob/a52041cd3f067156e478e355f5712a60e12ce649/lib/cinder_backends/nfs#L32-L34

Change-Id: I03cad66abb3c6f2ae1d5cf943ac952a30961f783
---
 lib/cinder_backends/nfs | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/lib/cinder_backends/nfs b/lib/cinder_backends/nfs
index 89a37a1f02..f3fcbeff19 100644
--- a/lib/cinder_backends/nfs
+++ b/lib/cinder_backends/nfs
@@ -32,6 +32,15 @@ function configure_cinder_backend_nfs {
     iniset $CINDER_CONF $be_name volume_backend_name $be_name
     iniset $CINDER_CONF $be_name volume_driver "cinder.volume.drivers.nfs.NfsDriver"
     iniset $CINDER_CONF $be_name nfs_shares_config "$CINDER_CONF_DIR/nfs-shares-$be_name.conf"
+    iniset $CINDER_CONF $be_name nas_host localhost
+    iniset $CINDER_CONF $be_name nas_share_path ${NFS_EXPORT_DIR}
+    iniset $CINDER_CONF $be_name nas_secure_file_operations \
+        ${NFS_SECURE_FILE_OPERATIONS}
+    iniset $CINDER_CONF $be_name nas_secure_file_permissions \
+        ${NFS_SECURE_FILE_PERMISSIONS}
+
+    # NFS snapshot support is currently opt-in only.
+    iniset $CINDER_CONF $be_name nfs_snapshot_support True
 
     echo "$CINDER_NFS_SERVERPATH" | tee "$CINDER_CONF_DIR/nfs-shares-$be_name.conf"
 }

From 69d71cfdf9c24d48fbea366714f4595cbd120723 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Tue, 10 Jan 2023 20:13:47 -0600
Subject: [PATCH 2108/2409] Option to disable the scope & new defaults
 enforcement

In this release cycle, a few services are enabling the
enforce scope and new defaults by default. Example Nova:
- https://review.opendev.org/c/openstack/nova/+/866218)

Until the new defaults enalbing by default is not released we
should keep testing the old defaults in existing jobs and we can
add new jobs testing new defautls. To do that we can provide the
way in devstack to keep scope/new defaults disable by default which
can be enabled by setting enforce_scope variable to true.

Once any service release the new defaults enabled by default then
we can switch the bhavior, enable the scope/new defaults by default
and a single job can disbale them to keep testing the old defaults
until service does not remove those.

Change-Id: I5c2ec3e1667172a75e06458f16cf3d57947b2c53
---
 lib/cinder    | 3 +++
 lib/glance    | 4 ++++
 lib/keystone  | 7 ++++++-
 lib/nova      | 3 +++
 lib/placement | 3 +++
 5 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/lib/cinder b/lib/cinder
index bf2fe50e08..2424f928d1 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -411,6 +411,9 @@ function configure_cinder {
     if [[ "$CINDER_ENFORCE_SCOPE" == True || "$ENFORCE_SCOPE" == True ]] ; then
         iniset $CINDER_CONF oslo_policy enforce_scope true
         iniset $CINDER_CONF oslo_policy enforce_new_defaults true
+    else
+        iniset $CINDER_CONF oslo_policy enforce_scope false
+        iniset $CINDER_CONF oslo_policy enforce_new_defaults false
     fi
 }
 
diff --git a/lib/glance b/lib/glance
index ba98f4133e..041acafc92 100644
--- a/lib/glance
+++ b/lib/glance
@@ -436,6 +436,10 @@ function configure_glance {
         iniset $GLANCE_API_CONF oslo_policy enforce_scope true
         iniset $GLANCE_API_CONF oslo_policy enforce_new_defaults true
         iniset $GLANCE_API_CONF DEFAULT enforce_secure_rbac true
+    else
+        iniset $GLANCE_API_CONF oslo_policy enforce_scope false
+        iniset $GLANCE_API_CONF oslo_policy enforce_new_defaults false
+        iniset $GLANCE_API_CONF DEFAULT enforce_secure_rbac false
     fi
 }
 
diff --git a/lib/keystone b/lib/keystone
index 80a136f78d..6cb4aac46a 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -265,10 +265,15 @@ function configure_keystone {
         iniset $KEYSTONE_CONF security_compliance lockout_duration $KEYSTONE_LOCKOUT_DURATION
         iniset $KEYSTONE_CONF security_compliance unique_last_password_count $KEYSTONE_UNIQUE_LAST_PASSWORD_COUNT
     fi
+
+    iniset $KEYSTONE_CONF oslo_policy policy_file policy.yaml
+
     if [[ "$KEYSTONE_ENFORCE_SCOPE" == True || "$ENFORCE_SCOPE" == True ]] ; then
         iniset $KEYSTONE_CONF oslo_policy enforce_scope true
         iniset $KEYSTONE_CONF oslo_policy enforce_new_defaults true
-        iniset $KEYSTONE_CONF oslo_policy policy_file policy.yaml
+    else
+        iniset $KEYSTONE_CONF oslo_policy enforce_scope false
+        iniset $KEYSTONE_CONF oslo_policy enforce_new_defaults false
     fi
 }
 
diff --git a/lib/nova b/lib/nova
index 14eb8fc3da..3aa6b9e3b3 100644
--- a/lib/nova
+++ b/lib/nova
@@ -490,6 +490,9 @@ function create_nova_conf {
         if [[ "$NOVA_ENFORCE_SCOPE" == "True" || "$ENFORCE_SCOPE" == "True" ]]; then
             iniset $NOVA_CONF oslo_policy enforce_new_defaults True
             iniset $NOVA_CONF oslo_policy enforce_scope True
+        else
+            iniset $NOVA_CONF oslo_policy enforce_new_defaults False
+            iniset $NOVA_CONF oslo_policy enforce_scope False
         fi
         if is_service_enabled tls-proxy && [ "$NOVA_USE_MOD_WSGI" == "False" ]; then
             # Set the service port for a proxy to take the original
diff --git a/lib/placement b/lib/placement
index bc22c564f4..c6bf99f868 100644
--- a/lib/placement
+++ b/lib/placement
@@ -120,6 +120,9 @@ function configure_placement {
     if [[ "$PLACEMENT_ENFORCE_SCOPE" == "True" || "$ENFORCE_SCOPE" == "True" ]]; then
         iniset $PLACEMENT_CONF oslo_policy enforce_new_defaults True
         iniset $PLACEMENT_CONF oslo_policy enforce_scope True
+    else
+        iniset $PLACEMENT_CONF oslo_policy enforce_new_defaults False
+        iniset $PLACEMENT_CONF oslo_policy enforce_scope False
     fi
 }
 

From 7fecba2f135f16204050b627bb850a87aa597bad Mon Sep 17 00:00:00 2001
From: yatinkarel <ykarel@redhat.com>
Date: Thu, 12 Jan 2023 17:31:36 +0530
Subject: [PATCH 2109/2409] [OVN] Ensure socket files are absent in init_ovn

Just like we remove db files let's also remove
socket files when initializing ovn. Those will
reappear once service fully restarts along with
db files. Without it we see random issue as
described in the below bug.

Closes-Bug: #2002629
Change-Id: I726a9cac9c805d017273aa79e844724f0d00cdf0
---
 lib/neutron_plugins/ovn_agent | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index dc8129553c..f27777867d 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -587,6 +587,7 @@ function init_ovn {
     rm -f $OVS_DATADIR/.*.db.~lock~
     sudo rm -f $OVN_DATADIR/*.db
     sudo rm -f $OVN_DATADIR/.*.db.~lock~
+    sudo rm -f $OVN_RUNDIR/*.sock
 }
 
 function _start_ovs {

From 5a6f0bbd4c3c3006a50e9e70c81f31ea1fa409c6 Mon Sep 17 00:00:00 2001
From: Rodolfo Alonso Hernandez <ralonsoh@redhat.com>
Date: Sat, 21 Jan 2023 20:21:26 +0100
Subject: [PATCH 2110/2409] Remove the neutron bash completion installation

The python-neutronclient CLI code is going to be removed from this
repository.

Change-Id: I39b3a43a7742481ec6d9501d5459bf0837ba0122
Related-Bug: #2003861
---
 lib/neutron | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/neutron b/lib/neutron
index c8ee8c5e76..9fb09ab9bb 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -527,7 +527,6 @@ function install_neutronclient {
     if use_library_from_git "python-neutronclient"; then
         git_clone_by_name "python-neutronclient"
         setup_dev_lib "python-neutronclient"
-        sudo install -D -m 0644 -o $STACK_USER {${GITDIR["python-neutronclient"]}/tools/,/etc/bash_completion.d/}neutron.bash_completion
     fi
 }
 

From 91efe177b170c3874989affc73842dc4ffbe062d Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Thu, 29 Sep 2022 08:38:24 +0200
Subject: [PATCH 2111/2409] Bump cirros version to 0.6.1

Cirros has made a fresh release, let us use it. Switch the download URLs
to https and drop an old example that no longer is available.

Depends-On: https://review.opendev.org/c/openstack/tempest/+/871271
Change-Id: I1d391b871fc9bfa825db30db9434922226b94d8a
---
 doc/source/guides/nova.rst |  2 +-
 stackrc                    | 15 +++++++--------
 2 files changed, 8 insertions(+), 9 deletions(-)

diff --git a/doc/source/guides/nova.rst b/doc/source/guides/nova.rst
index 5b427972c4..d0fb274c13 100644
--- a/doc/source/guides/nova.rst
+++ b/doc/source/guides/nova.rst
@@ -122,7 +122,7 @@ when creating the server, for example:
 .. code-block:: shell
 
   $ openstack --os-compute-api-version 2.37 server create --flavor cirros256 \
-      --image cirros-0.3.5-x86_64-disk --nic none --wait test-server
+      --image cirros-0.6.1-x86_64-disk --nic none --wait test-server
 
 .. note:: ``--os-compute-api-version`` greater than or equal to 2.37 is
           required to use ``--nic=none``.
diff --git a/stackrc b/stackrc
index b3130e5f7f..a71d843362 100644
--- a/stackrc
+++ b/stackrc
@@ -657,20 +657,19 @@ esac
 #     If the file ends in .tar.gz, uncompress the tarball and and select the first
 #     .img file inside it as the image.  If present, use "*-vmlinuz*" as the kernel
 #     and "*-initrd*" as the ramdisk
-#     example: http://cloud-images.ubuntu.com/releases/precise/release/ubuntu-12.04-server-cloudimg-amd64.tar.gz
+#     example: https://cloud-images.ubuntu.com/releases/jammy/release/ubuntu-22.04-server-cloudimg-amd64.tar.gz
 #  * disk image (*.img,*.img.gz)
 #    if file ends in .img, then it will be uploaded and registered as a to
 #    glance as a disk image.  If it ends in .gz, it is uncompressed first.
 #    example:
-#      http://cloud-images.ubuntu.com/releases/precise/release/ubuntu-12.04-server-cloudimg-armel-disk1.img
-#      http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-rootfs.img.gz
+#      https://cloud-images.ubuntu.com/releases/jammy/release/ubuntu-22.04-server-cloudimg-amd64.img
+#      https://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-rootfs.img.gz
 #  * OpenVZ image:
 #    OpenVZ uses its own format of image, and does not support UEC style images
 
-#IMAGE_URLS="http://smoser.brickies.net/ubuntu/ttylinux-uec/ttylinux-uec-amd64-11.2_2.6.35-15_1.tar.gz" # old ttylinux-uec image
-#IMAGE_URLS="http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img" # cirros full disk image
+#IMAGE_URLS="https://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img" # cirros full disk image
 
-CIRROS_VERSION=${CIRROS_VERSION:-"0.5.2"}
+CIRROS_VERSION=${CIRROS_VERSION:-"0.6.1"}
 CIRROS_ARCH=${CIRROS_ARCH:-$(uname -m)}
 
 # Set default image based on ``VIRT_DRIVER`` and ``LIBVIRT_TYPE``, either of
@@ -687,11 +686,11 @@ if [[ "$DOWNLOAD_DEFAULT_IMAGES" == "True" ]]; then
                 lxc) # the cirros root disk in the uec tarball is empty, so it will not work for lxc
                     DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-rootfs}
                     DEFAULT_IMAGE_FILE_NAME=${DEFAULT_IMAGE_FILE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-rootfs.img.gz}
-                    IMAGE_URLS+="http://download.cirros-cloud.net/${CIRROS_VERSION}/${DEFAULT_IMAGE_FILE_NAME}";;
+                    IMAGE_URLS+="https://download.cirros-cloud.net/${CIRROS_VERSION}/${DEFAULT_IMAGE_FILE_NAME}";;
                 *) # otherwise, use the qcow image
                     DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk}
                     DEFAULT_IMAGE_FILE_NAME=${DEFAULT_IMAGE_FILE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img}
-                    IMAGE_URLS+="http://download.cirros-cloud.net/${CIRROS_VERSION}/${DEFAULT_IMAGE_FILE_NAME}";;
+                    IMAGE_URLS+="https://download.cirros-cloud.net/${CIRROS_VERSION}/${DEFAULT_IMAGE_FILE_NAME}";;
                 esac
             ;;
         vsphere)

From 71c3c40c269a50303247855319d1d3a5d30f6773 Mon Sep 17 00:00:00 2001
From: Bence Romsics <bence.romsics@gmail.com>
Date: Wed, 21 Dec 2022 13:50:54 +0100
Subject: [PATCH 2112/2409] 'sudo pkill -f' should not match the sudo process

pkill already takes care that it does not kill itself, however the
same problem may happen with 'sudo pkill -f' killing sudo. Use one
of the usual regex tricks to avoid that.

Change-Id: Ic6a94f516cbc509a2d77699494aa7bcaecf96ebc
Closes-Bug: #1999395
---
 lib/neutron                   | 4 +++-
 lib/neutron_plugins/ovn_agent | 4 +++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index c8ee8c5e76..0d6a148c8e 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -689,7 +689,9 @@ function stop_other {
     fi
 
     if [[ "$Q_USE_ROOTWRAP_DAEMON" == "True" ]]; then
-        sudo pkill -9 -f $NEUTRON_ROOTWRAP-daemon || :
+        # pkill takes care not to kill itself, but it may kill its parent
+        # sudo unless we use the "ps | grep [f]oo" trick
+        sudo pkill -9 -f "$NEUTRON_ROOTWRAP-[d]aemon" || :
     fi
 }
 
diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index f27777867d..34903924b3 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -769,7 +769,9 @@ function _stop_process {
 
 function stop_ovn {
     if is_service_enabled q-ovn-metadata-agent neutron-ovn-metadata-agent; then
-        sudo pkill -9 -f haproxy || :
+        # pkill takes care not to kill itself, but it may kill its parent
+        # sudo unless we use the "ps | grep [f]oo" trick
+        sudo pkill -9 -f "[h]aproxy" || :
         _stop_process "devstack@q-ovn-metadata-agent.service"
     fi
     if is_service_enabled ovn-controller-vtep ; then

From 7fe998109bda8cdd5cb5ba4a0e02c6c83cb0566d Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Thu, 26 Jan 2023 22:28:07 -0600
Subject: [PATCH 2113/2409] Fix setting the tempest virtual env constraints env
 var

Devstack set the env var TOX_CONSTRAINTS_FILE/UPPER_CONSTRAINTS_FILE
which are used to use the constraints during Tempest virtual env installation.
Those env var are set to non-master constraint when we need to use non-master
constraints but when we need to use the master constraints we do not set/reset
them point to master constraints. This create the issue when running the grenade
job where we run Tempest on the old devstack as well as in the new devstack.
When tempest is installed on old devstack then old tempest is used and it sets
these env var to stable/<branch> constraints (this is the case when old devstack
(the stable branch is in EM phase) uses the old tempest not the master tempest),
all good till now. But the problem comes when in the same grenade script run
upgrade-tempest install the master tempest (when new devstack branches are in
the 'supported' phase and use the master tempest means) and are supposed to use
the master constraints. But the TOX_CONSTRAINTS_FILE/UPPER_CONSTRAINTS_FILE env
var set by old tempest is used by the tempest and due to a mismatch in constraints
it fails.

This happened when we tried to pin the stable/wallaby with Tempest 29.0.0
- https://review.opendev.org/c/openstack/devstack/+/871782

and table/xena grenade job failed (stable/xena use master tempest and supposed
to use master constraints)
- https://zuul.opendev.org/t/openstack/build/fb7b2a8b562c42bab4c741819f5e9732/log/controller/logs/grenade.sh_log.txt#16641

We should set/reset those constraint env var to master constraints if configuration
tell devstack to use the master constraints.

[1] https://github.com/openstack/devstack/blob/71c3c40c269a50303247855319d1d3a5d30f6773/lib/tempest#L124

Closes-Bug: #2003993
Change-Id: I5e938139b47f443a4c358415d0d4dcf6549cd085
---
 lib/tempest | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index 44a9b6f29f..c3d3e9ac30 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -128,6 +128,13 @@ function set_tempest_venv_constraints {
         (cd $REQUIREMENTS_DIR &&
             git show master:upper-constraints.txt 2>/dev/null ||
             git show origin/master:upper-constraints.txt) > $tmp_c
+        # NOTE(gmann): we need to set the below env var pointing to master
+        # constraints even that is what default in tox.ini. Otherwise it can
+        # create the issue for grenade run where old and new devstack can have
+        # different tempest (old and master) to install. For detail problem,
+        # refer to the https://bugs.launchpad.net/devstack/+bug/2003993
+        export UPPER_CONSTRAINTS_FILE=https://releases.openstack.org/constraints/upper/master
+        export TOX_CONSTRAINTS_FILE=https://releases.openstack.org/constraints/upper/master
     else
         echo "Using $TEMPEST_VENV_UPPER_CONSTRAINTS constraints in Tempest virtual env."
         cat $TEMPEST_VENV_UPPER_CONSTRAINTS > $tmp_c

From a84b2091cf2c84eb4b81e542233bf446440e02b1 Mon Sep 17 00:00:00 2001
From: elajkat <lajos.katona@est.tech>
Date: Wed, 17 Nov 2021 11:52:56 +0100
Subject: [PATCH 2114/2409] Rehome functions to enable Neutron's segments
 integration

Those functions were part of the neutron devstack plugin but we
discussed it during last PTG [1] and decided to move to the Devstack
repo as plugins which are used by e.g. CI jobs which are defined outside
of the neutron repository.
Placement integration is used e.g. in the tempest-slow job which is
defined in tempest and used by many different OpenStack projects.

[1] https://etherpad.opendev.org/p/neutron-yoga-ptg#L142

Change-Id: I2c26063896ab2679cffd01227a40a3283caa3b17
---
 lib/neutron                           |  5 +++++
 lib/neutron_plugins/services/segments | 10 ++++++++++
 2 files changed, 15 insertions(+)
 create mode 100644 lib/neutron_plugins/services/segments

diff --git a/lib/neutron b/lib/neutron
index 8708bf43ca..368a1b9c55 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -294,6 +294,7 @@ source $TOP_DIR/lib/neutron_plugins/services/l3
 source $TOP_DIR/lib/neutron_plugins/services/placement
 source $TOP_DIR/lib/neutron_plugins/services/trunk
 source $TOP_DIR/lib/neutron_plugins/services/qos
+source $TOP_DIR/lib/neutron_plugins/services/segments
 
 # Use security group or not
 if has_neutron_plugin_security_group; then
@@ -416,6 +417,10 @@ function configure_neutron {
             configure_l3_agent_extension_gateway_ip_qos
         fi
     fi
+    if is_service_enabled neutron-segments; then
+        configure_placement_neutron
+        configure_segments_extension
+    fi
 
     # Finally configure Neutron server and core plugin
     if is_service_enabled q-agt neutron-agent q-svc neutron-api; then
diff --git a/lib/neutron_plugins/services/segments b/lib/neutron_plugins/services/segments
new file mode 100644
index 0000000000..08936bae49
--- /dev/null
+++ b/lib/neutron_plugins/services/segments
@@ -0,0 +1,10 @@
+#!/bin/bash
+
+function configure_segments_service_plugin {
+    neutron_service_plugin_class_add segments
+}
+
+function configure_segments_extension {
+    configure_segments_service_plugin
+}
+

From 48af5d4b1bf5332c879ee52fb4686874b212697f Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Tue, 14 Feb 2023 17:11:24 +0100
Subject: [PATCH 2115/2409] Make rockylinux job non-voting

It is currently failing, let's unblock the CI until we have a fix.

Change-Id: I7f072ceef57c302eb6ce20e108043d2390e9f481
---
 .zuul.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index 8e20f6ed34..30e53976a5 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -726,6 +726,7 @@
     description: Rocky Linux 9 Blue Onyx platform test
     nodeset: devstack-single-node-rockylinux-9
     timeout: 9000
+    voting: false
     vars:
       configure_swap_size: 4096
 

From fcc525f4fc5022a4b1f4e3d961e1b27cfbfa9d71 Mon Sep 17 00:00:00 2001
From: Gregory Thiemonge <gthiemon@redhat.com>
Date: Thu, 16 Feb 2023 10:26:32 +0100
Subject: [PATCH 2116/2409] Fix rockylinux and make it voting

Some rockylinux deployments have the curl-minimal package installed by
default (the latest GenericCloud image still has the curl package), it
triggers an error when devstack wants to install the curl package.
Fix this issue by swaping curl-minimal with curl before installing base
packages.

Change-Id: I969e8dc22e7d11c9917a843d9245f33a04fe197d
---
 .zuul.yaml | 1 -
 stack.sh   | 7 +++++++
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 30e53976a5..8e20f6ed34 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -726,7 +726,6 @@
     description: Rocky Linux 9 Blue Onyx platform test
     nodeset: devstack-single-node-rockylinux-9
     timeout: 9000
-    voting: false
     vars:
       configure_swap_size: 4096
 
diff --git a/stack.sh b/stack.sh
index 28576d1e14..ccd2d16baa 100755
--- a/stack.sh
+++ b/stack.sh
@@ -394,6 +394,13 @@ elif [[ $DISTRO == "rhel9" ]]; then
     sudo dnf config-manager --set-enabled crb
     # rabbitmq and other packages are provided by RDO repositories.
     _install_rdo
+
+    # Some distributions (Rocky Linux 9) provide curl-minimal instead of curl,
+    # it triggers a conflict when devstack wants to install "curl".
+    # Swap curl-minimal with curl.
+    if is_package_installed curl-minimal; then
+        sudo dnf swap -y curl-minimal curl
+    fi
 elif [[ $DISTRO == "openEuler-22.03" ]]; then
     # There are some problem in openEuler. We should fix it first. Some required
     # package/action runs before fixup script. So we can't fix there.

From ec07b343d25e9964db57ef9c3e2a89deeb5ac56e Mon Sep 17 00:00:00 2001
From: Martin Kopec <mkopec@redhat.com>
Date: Tue, 24 Jan 2023 17:38:45 +0100
Subject: [PATCH 2117/2409] Remove support for opensuse

We haven't been testing the distro for a while in CI, e.g. in
Tempest, the jobs on opensuse15 haven't been executed for a year
now.
Therefore the patch removes opensuse support from devstack.

Closes-Bug: #2002900
Change-Id: I0f5e4c644e2d14d1b8bb5bc0096d1469febe5fcc
---
 doc/source/index.rst                |  3 +-
 doc/source/plugins.rst              |  3 --
 files/rpms-suse/baremetal           |  1 -
 files/rpms-suse/ceph                |  3 --
 files/rpms-suse/cinder              |  3 --
 files/rpms-suse/dstat               |  1 -
 files/rpms-suse/general             | 34 ---------------------
 files/rpms-suse/horizon             |  2 --
 files/rpms-suse/keystone            |  4 ---
 files/rpms-suse/ldap                |  3 --
 files/rpms-suse/n-api               |  1 -
 files/rpms-suse/n-cpu               | 10 ------
 files/rpms-suse/neutron-agent       |  1 -
 files/rpms-suse/neutron-common      | 12 --------
 files/rpms-suse/neutron-l3          |  2 --
 files/rpms-suse/nova                | 21 -------------
 files/rpms-suse/openvswitch         |  3 --
 files/rpms-suse/os-brick            |  2 --
 files/rpms-suse/q-agt               |  1 -
 files/rpms-suse/q-l3                |  1 -
 files/rpms-suse/swift               |  6 ----
 functions-common                    | 47 -----------------------------
 inc/python                          |  4 ---
 lib/apache                          | 25 +++------------
 lib/cinder                          |  9 ++----
 lib/databases/mysql                 | 15 ++-------
 lib/databases/postgresql            |  9 ++----
 lib/glance                          |  4 ---
 lib/horizon                         |  2 +-
 lib/ldap                            | 14 ---------
 lib/lvm                             |  4 +--
 lib/neutron_plugins/ovs_base        | 13 --------
 lib/neutron_plugins/ovs_source      |  6 ----
 lib/nova                            |  6 ++--
 lib/nova_plugins/functions-libvirt  |  6 ++--
 lib/nova_plugins/hypervisor-libvirt |  3 --
 lib/rpc_backend                     | 15 +--------
 lib/swift                           |  3 --
 lib/tls                             | 12 --------
 stack.sh                            |  2 +-
 tests/test_package_ordering.sh      |  2 +-
 tools/fixup_stuff.sh                | 40 ------------------------
 tools/install_prereqs.sh            |  2 --
 43 files changed, 25 insertions(+), 335 deletions(-)
 delete mode 100644 files/rpms-suse/baremetal
 delete mode 100644 files/rpms-suse/ceph
 delete mode 100644 files/rpms-suse/cinder
 delete mode 100644 files/rpms-suse/dstat
 delete mode 100644 files/rpms-suse/general
 delete mode 100644 files/rpms-suse/horizon
 delete mode 100644 files/rpms-suse/keystone
 delete mode 100644 files/rpms-suse/ldap
 delete mode 100644 files/rpms-suse/n-api
 delete mode 100644 files/rpms-suse/n-cpu
 delete mode 100644 files/rpms-suse/neutron-agent
 delete mode 100644 files/rpms-suse/neutron-common
 delete mode 100644 files/rpms-suse/neutron-l3
 delete mode 100644 files/rpms-suse/nova
 delete mode 100644 files/rpms-suse/openvswitch
 delete mode 100644 files/rpms-suse/os-brick
 delete mode 120000 files/rpms-suse/q-agt
 delete mode 120000 files/rpms-suse/q-l3
 delete mode 100644 files/rpms-suse/swift

diff --git a/doc/source/index.rst b/doc/source/index.rst
index 1e932f88a5..ccd0fef330 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -38,8 +38,7 @@ Install Linux
 
 Start with a clean and minimal install of a Linux system. DevStack
 attempts to support the two latest LTS releases of Ubuntu, the
-latest/current Fedora version, CentOS/RHEL/Rocky Linux 9, OpenSUSE and
-openEuler.
+latest/current Fedora version, CentOS/RHEL/Rocky Linux 9 and openEuler.
 
 If you do not have a preference, Ubuntu 22.04 (Jammy) is the
 most tested, and will probably go the smoothest.
diff --git a/doc/source/plugins.rst b/doc/source/plugins.rst
index 62dd15bfb1..dd75b5a22d 100644
--- a/doc/source/plugins.rst
+++ b/doc/source/plugins.rst
@@ -243,9 +243,6 @@ locations in the top-level of the plugin repository:
 - ``./devstack/files/rpms/$plugin_name`` - Packages to install when running
   on Red Hat, Fedora, or CentOS.
 
-- ``./devstack/files/rpms-suse/$plugin_name`` - Packages to install when
-  running on SUSE Linux or openSUSE.
-
 Although there a no plans to remove this method of installing
 packages, plugins should consider it deprecated for ``bindep`` support
 described below.
diff --git a/files/rpms-suse/baremetal b/files/rpms-suse/baremetal
deleted file mode 100644
index 61f73eeae3..0000000000
--- a/files/rpms-suse/baremetal
+++ /dev/null
@@ -1 +0,0 @@
-dnsmasq
diff --git a/files/rpms-suse/ceph b/files/rpms-suse/ceph
deleted file mode 100644
index 8c4955df90..0000000000
--- a/files/rpms-suse/ceph
+++ /dev/null
@@ -1,3 +0,0 @@
-ceph    # NOPRIME
-lsb
-xfsprogs
diff --git a/files/rpms-suse/cinder b/files/rpms-suse/cinder
deleted file mode 100644
index b39cc79a27..0000000000
--- a/files/rpms-suse/cinder
+++ /dev/null
@@ -1,3 +0,0 @@
-lvm2
-qemu-tools
-tgt # NOPRIME
diff --git a/files/rpms-suse/dstat b/files/rpms-suse/dstat
deleted file mode 100644
index 2b643b8b1b..0000000000
--- a/files/rpms-suse/dstat
+++ /dev/null
@@ -1 +0,0 @@
-dstat
diff --git a/files/rpms-suse/general b/files/rpms-suse/general
deleted file mode 100644
index f63611025c..0000000000
--- a/files/rpms-suse/general
+++ /dev/null
@@ -1,34 +0,0 @@
-apache2
-apache2-devel
-bc
-ca-certificates-mozilla
-curl
-gawk
-gcc
-gcc-c++
-git-core
-graphviz # docs
-iputils
-libffi-devel  # pyOpenSSL
-libjpeg8-devel # Pillow 3.0.0
-libopenssl-devel # to rebuild pyOpenSSL if needed
-libxslt-devel  # lxml
-lsof # useful when debugging
-make
-net-tools
-openssh
-openssl
-pcre-devel # python-pcre
-postgresql-devel  # psycopg2
-psmisc
-python3-systemd
-python-cmd2 # dist:opensuse-12.3
-python-devel  # pyOpenSSL
-python-xml
-tar
-tcpdump
-unzip
-util-linux
-wget
-which
-zlib-devel
diff --git a/files/rpms-suse/horizon b/files/rpms-suse/horizon
deleted file mode 100644
index 753ea76e04..0000000000
--- a/files/rpms-suse/horizon
+++ /dev/null
@@ -1,2 +0,0 @@
-apache2-mod_wsgi  # NOPRIME
-apache2  # NOPRIME
diff --git a/files/rpms-suse/keystone b/files/rpms-suse/keystone
deleted file mode 100644
index 66cfc23423..0000000000
--- a/files/rpms-suse/keystone
+++ /dev/null
@@ -1,4 +0,0 @@
-cyrus-sasl-devel
-memcached
-openldap2-devel
-sqlite3
diff --git a/files/rpms-suse/ldap b/files/rpms-suse/ldap
deleted file mode 100644
index 46d26f0796..0000000000
--- a/files/rpms-suse/ldap
+++ /dev/null
@@ -1,3 +0,0 @@
-openldap2
-openldap2-client
-python-ldap
diff --git a/files/rpms-suse/n-api b/files/rpms-suse/n-api
deleted file mode 100644
index 0f08daace3..0000000000
--- a/files/rpms-suse/n-api
+++ /dev/null
@@ -1 +0,0 @@
-python-dateutil
diff --git a/files/rpms-suse/n-cpu b/files/rpms-suse/n-cpu
deleted file mode 100644
index 9c724cb9d8..0000000000
--- a/files/rpms-suse/n-cpu
+++ /dev/null
@@ -1,10 +0,0 @@
-cdrkit-cdrtools-compat # dist:sle12
-cryptsetup
-dosfstools
-libosinfo
-lvm2
-mkisofs # not:sle12
-open-iscsi
-sg3_utils
-# Stuff for diablo volumes
-sysfsutils
diff --git a/files/rpms-suse/neutron-agent b/files/rpms-suse/neutron-agent
deleted file mode 100644
index ea8819e884..0000000000
--- a/files/rpms-suse/neutron-agent
+++ /dev/null
@@ -1 +0,0 @@
-ipset
diff --git a/files/rpms-suse/neutron-common b/files/rpms-suse/neutron-common
deleted file mode 100644
index e3799a9353..0000000000
--- a/files/rpms-suse/neutron-common
+++ /dev/null
@@ -1,12 +0,0 @@
-acl
-dnsmasq
-dnsmasq-utils # dist:opensuse-12.3,opensuse-13.1
-ebtables
-haproxy # to serve as metadata proxy inside router/dhcp namespaces
-iptables
-iputils
-rabbitmq-server # NOPRIME
-radvd # NOPRIME
-sqlite3
-sudo
-vlan
diff --git a/files/rpms-suse/neutron-l3 b/files/rpms-suse/neutron-l3
deleted file mode 100644
index a7a190c063..0000000000
--- a/files/rpms-suse/neutron-l3
+++ /dev/null
@@ -1,2 +0,0 @@
-conntrack-tools
-keepalived
diff --git a/files/rpms-suse/nova b/files/rpms-suse/nova
deleted file mode 100644
index 082b9aca22..0000000000
--- a/files/rpms-suse/nova
+++ /dev/null
@@ -1,21 +0,0 @@
-cdrkit-cdrtools-compat # dist:sle12
-conntrack-tools
-curl
-ebtables
-iptables
-iputils
-kpartx
-kvm # NOPRIME
-libvirt # NOPRIME
-libvirt-python # NOPRIME
-# mkisofs is required for config_drive
-mkisofs # not:sle12
-parted
-polkit
-# qemu as fallback if kvm cannot be used
-qemu # NOPRIME
-rabbitmq-server # NOPRIME
-socat
-sqlite3
-sudo
-vlan
diff --git a/files/rpms-suse/openvswitch b/files/rpms-suse/openvswitch
deleted file mode 100644
index 53f8bb22cf..0000000000
--- a/files/rpms-suse/openvswitch
+++ /dev/null
@@ -1,3 +0,0 @@
-
-openvswitch
-openvswitch-switch
diff --git a/files/rpms-suse/os-brick b/files/rpms-suse/os-brick
deleted file mode 100644
index 67b33a9861..0000000000
--- a/files/rpms-suse/os-brick
+++ /dev/null
@@ -1,2 +0,0 @@
-lsscsi
-open-iscsi
diff --git a/files/rpms-suse/q-agt b/files/rpms-suse/q-agt
deleted file mode 120000
index 99fe353094..0000000000
--- a/files/rpms-suse/q-agt
+++ /dev/null
@@ -1 +0,0 @@
-neutron-agent
\ No newline at end of file
diff --git a/files/rpms-suse/q-l3 b/files/rpms-suse/q-l3
deleted file mode 120000
index 0a5ca2a45f..0000000000
--- a/files/rpms-suse/q-l3
+++ /dev/null
@@ -1 +0,0 @@
-neutron-l3
\ No newline at end of file
diff --git a/files/rpms-suse/swift b/files/rpms-suse/swift
deleted file mode 100644
index 3663b98545..0000000000
--- a/files/rpms-suse/swift
+++ /dev/null
@@ -1,6 +0,0 @@
-curl
-liberasurecode-devel
-memcached
-sqlite3
-xfsprogs
-xinetd
diff --git a/functions-common b/functions-common
index 4eed5d8407..c7a1c6e0bf 100644
--- a/functions-common
+++ b/functions-common
@@ -454,16 +454,6 @@ function GetDistro {
     elif [[ "$os_VENDOR" =~ (Fedora) ]]; then
         # For Fedora, just use 'f' and the release
         DISTRO="f$os_RELEASE"
-    elif is_opensuse; then
-        DISTRO="opensuse-$os_RELEASE"
-        # Tumbleweed uses "n/a" as a codename, and the release is a datestring
-        # like 20180218, so not very useful. Leap however uses a release
-        # with a "dot", so for example 15.0
-        [ "$os_CODENAME" = "n/a" -a "$os_RELEASE" = "${os_RELEASE/\./}" ] && \
-            DISTRO="opensuse-tumbleweed"
-    elif is_suse_linux_enterprise; then
-        # just use major release
-        DISTRO="sle${os_RELEASE%.*}"
     elif [[ "$os_VENDOR" =~ (Red.*Hat) || \
         "$os_VENDOR" =~ (CentOS) || \
         "$os_VENDOR" =~ (AlmaLinux) || \
@@ -537,37 +527,6 @@ function is_fedora {
 }
 
 
-# Determine if current distribution is a SUSE-based distribution
-# (openSUSE, SLE).
-# is_suse
-function is_suse {
-    is_opensuse || is_suse_linux_enterprise
-}
-
-
-# Determine if current distribution is an openSUSE distribution
-# is_opensuse
-function is_opensuse {
-    if [[ -z "$os_VENDOR" ]]; then
-        GetOSVersion
-    fi
-
-    [[ "$os_VENDOR" =~ (openSUSE) ]]
-}
-
-
-# Determine if current distribution is a SUSE Linux Enterprise (SLE)
-# distribution
-# is_suse_linux_enterprise
-function is_suse_linux_enterprise {
-    if [[ -z "$os_VENDOR" ]]; then
-        GetOSVersion
-    fi
-
-    [[ "$os_VENDOR" =~ (^SUSE) ]]
-}
-
-
 # Determine if current distribution is an Ubuntu-based distribution
 # It will also detect non-Ubuntu but Debian-based distros
 # is_ubuntu
@@ -1168,8 +1127,6 @@ function _get_package_dir {
         pkg_dir=$base_dir/debs
     elif is_fedora; then
         pkg_dir=$base_dir/rpms
-    elif is_suse; then
-        pkg_dir=$base_dir/rpms-suse
     else
         exit_distro_not_supported "list of packages"
     fi
@@ -1444,8 +1401,6 @@ function real_install_package {
         apt_get install "$@"
     elif is_fedora; then
         yum_install "$@"
-    elif is_suse; then
-        zypper_install "$@"
     else
         exit_distro_not_supported "installing packages"
     fi
@@ -1487,8 +1442,6 @@ function uninstall_package {
         apt_get purge "$@"
     elif is_fedora; then
         sudo dnf remove -y "$@" ||:
-    elif is_suse; then
-        sudo zypper remove -y "$@" ||:
     else
         exit_distro_not_supported "uninstalling packages"
     fi
diff --git a/inc/python b/inc/python
index 3eb3efe80e..a24f4e910a 100644
--- a/inc/python
+++ b/inc/python
@@ -7,7 +7,6 @@
 # External functions used:
 # - GetOSVersion
 # - is_fedora
-# - is_suse
 # - safe_chown
 
 # Save trace setting
@@ -62,7 +61,6 @@ function get_python_exec_prefix {
     $xtrace
 
     local PYTHON_PATH=/usr/local/bin
-    is_suse && PYTHON_PATH=/usr/bin
     echo $PYTHON_PATH
 }
 
@@ -462,8 +460,6 @@ function install_python {
 function install_python3 {
     if is_ubuntu; then
         apt_get install python${PYTHON3_VERSION} python${PYTHON3_VERSION}-dev
-    elif is_suse; then
-        install_package python3-devel python3-dbm
     elif is_fedora; then
         if [ "$os_VENDOR" = "Fedora" ]; then
             install_package python${PYTHON3_VERSION//.}
diff --git a/lib/apache b/lib/apache
index dd8c9a0f06..4d68b49767 100644
--- a/lib/apache
+++ b/lib/apache
@@ -44,10 +44,6 @@ elif is_fedora; then
     APACHE_NAME=httpd
     APACHE_CONF_DIR=${APACHE_CONF_DIR:-/etc/$APACHE_NAME/conf.d}
     APACHE_SETTINGS_DIR=${APACHE_SETTINGS_DIR:-/etc/$APACHE_NAME/conf.d}
-elif is_suse; then
-    APACHE_NAME=apache2
-    APACHE_CONF_DIR=${APACHE_CONF_DIR:-/etc/$APACHE_NAME/vhosts.d}
-    APACHE_SETTINGS_DIR=${APACHE_SETTINGS_DIR:-/etc/$APACHE_NAME/conf.d}
 fi
 APACHE_LOG_DIR="/var/log/${APACHE_NAME}"
 
@@ -65,11 +61,6 @@ function enable_apache_mod {
             sudo a2enmod $mod
             restart_apache_server
         fi
-    elif is_suse; then
-        if ! a2enmod -q $mod ; then
-            sudo a2enmod $mod
-            restart_apache_server
-        fi
     elif is_fedora; then
         # pass
         true
@@ -104,10 +95,6 @@ function install_apache_uwsgi {
         # Thus there is nothing else to do after this install
         install_package uwsgi \
                         uwsgi-plugin-python3
-    elif [[ $os_VENDOR =~ openSUSE ]]; then
-        install_package uwsgi \
-                        uwsgi-python3 \
-                        apache2-mod_uwsgi
     else
         # Compile uwsgi from source.
         local dir
@@ -125,7 +112,7 @@ function install_apache_uwsgi {
         sudo rm -rf $dir
     fi
 
-    if is_ubuntu || is_suse ; then
+    if is_ubuntu; then
         # we've got to enable proxy and proxy_uwsgi for this to work
         sudo a2enmod proxy
         sudo a2enmod proxy_uwsgi
@@ -155,8 +142,6 @@ function install_apache_wsgi {
         sudo sed -i '/mod_mpm_prefork.so/s/^/#/g' /etc/httpd/conf.modules.d/00-mpm.conf
         sudo sed -i '/mod_mpm_event.so/s/^/#/g' /etc/httpd/conf.modules.d/00-mpm.conf
         sudo sed -i '/mod_mpm_worker.so/s/^#//g' /etc/httpd/conf.modules.d/00-mpm.conf
-    elif is_suse; then
-        install_package apache2 apache2-mod_wsgi
     else
         exit_distro_not_supported "apache wsgi installation"
     fi
@@ -171,7 +156,7 @@ function install_apache_wsgi {
 # recognise it. a2ensite and a2dissite ignore the .conf suffix used as parameter. The default sites'
 # files are 000-default.conf and default-ssl.conf.
 #
-# On Fedora and openSUSE, any file in /etc/httpd/conf.d/ whose name ends with .conf is enabled.
+# On Fedora, any file in /etc/httpd/conf.d/ whose name ends with .conf is enabled.
 #
 # On RHEL and CentOS, things should hopefully work as in Fedora.
 #
@@ -187,7 +172,7 @@ function apache_site_config_for {
     if is_ubuntu; then
         # Ubuntu 14.04 - Apache 2.4
         echo $APACHE_CONF_DIR/${site}.conf
-    elif is_fedora || is_suse; then
+    elif is_fedora; then
         # fedora conf.d is only imported if it ends with .conf so this is approx the same
         local enabled_site_file="$APACHE_CONF_DIR/${site}.conf"
         if [ -f $enabled_site_file ]; then
@@ -205,7 +190,7 @@ function enable_apache_site {
     enable_apache_mod version
     if is_ubuntu; then
         sudo a2ensite ${site}
-    elif is_fedora || is_suse; then
+    elif is_fedora; then
         local enabled_site_file="$APACHE_CONF_DIR/${site}.conf"
         # Do nothing if site already enabled or no site config exists
         if [[ -f ${enabled_site_file}.disabled ]] && [[ ! -f ${enabled_site_file} ]]; then
@@ -219,7 +204,7 @@ function disable_apache_site {
     local site=$@
     if is_ubuntu; then
         sudo a2dissite ${site} || true
-    elif is_fedora || is_suse; then
+    elif is_fedora; then
         local enabled_site_file="$APACHE_CONF_DIR/${site}.conf"
         # Do nothing if no site config exists
         if [[ -f ${enabled_site_file} ]]; then
diff --git a/lib/cinder b/lib/cinder
index 2424f928d1..602e8dad0e 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -117,8 +117,8 @@ else
 fi
 
 
-# EL and SUSE should only use lioadm
-if is_fedora || is_suse; then
+# EL should only use lioadm
+if is_fedora; then
     if [[ ${CINDER_TARGET_HELPER} != "lioadm" && ${CINDER_TARGET_HELPER} != 'nvmet' ]]; then
         die "lioadm and nvmet are the only valid Cinder target_helper config on this platform"
     fi
@@ -595,11 +595,6 @@ function start_cinder {
             _configure_tgt_for_config_d
             if is_ubuntu; then
                 sudo service tgt restart
-            elif is_suse; then
-                # NOTE(dmllr): workaround restart bug
-                # https://bugzilla.suse.com/show_bug.cgi?id=934642
-                stop_service tgtd
-                start_service tgtd
             else
                 restart_service tgtd
             fi
diff --git a/lib/databases/mysql b/lib/databases/mysql
index fbad44e36a..ed8006e7db 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -20,12 +20,6 @@ if [[ -z "$MYSQL_SERVICE_NAME" ]]; then
     MYSQL_SERVICE_NAME=mysql
     if is_fedora && ! is_oraclelinux; then
         MYSQL_SERVICE_NAME=mariadb
-    elif is_suse && systemctl list-unit-files | grep -q 'mariadb\.service'; then
-        # Older mariadb packages on SLES 12 provided mysql.service.  The
-        # newer ones on SLES 12 and 15 use mariadb.service; they also
-        # provide a mysql.service symlink for backwards-compatibility, but
-        # let's not rely on that.
-        MYSQL_SERVICE_NAME=mariadb
     elif [[ "$DISTRO" == "bullseye" ]]; then
         MYSQL_SERVICE_NAME=mariadb
     fi
@@ -54,7 +48,7 @@ function cleanup_database_mysql {
     elif is_oraclelinux; then
         uninstall_package mysql-community-server
         sudo rm -rf /var/lib/mysql
-    elif is_suse || is_fedora; then
+    elif is_fedora; then
         uninstall_package mariadb-server
         sudo rm -rf /var/lib/mysql
     else
@@ -74,7 +68,7 @@ function configure_database_mysql {
 
     if is_ubuntu; then
         my_conf=/etc/mysql/my.cnf
-    elif is_suse || is_oraclelinux; then
+    elif is_oraclelinux; then
         my_conf=/etc/my.cnf
     elif is_fedora; then
         my_conf=/etc/my.cnf
@@ -90,7 +84,7 @@ function configure_database_mysql {
     iniset -sudo $my_conf mysqld bind-address "$(ipv6_unquote $SERVICE_LISTEN_ADDRESS)"
 
     # (Re)Start mysql-server
-    if is_fedora || is_suse; then
+    if is_fedora; then
         # service is not started by default
         start_service $MYSQL_SERVICE_NAME
     elif is_ubuntu; then
@@ -212,9 +206,6 @@ EOF
         elif is_fedora; then
             install_package mariadb-server mariadb-devel mariadb
             sudo systemctl enable $MYSQL_SERVICE_NAME
-        elif is_suse; then
-            install_package mariadb-server
-            sudo systemctl enable $MYSQL_SERVICE_NAME
         elif is_ubuntu; then
             install_package $MYSQL_SERVICE_NAME-server
         else
diff --git a/lib/databases/postgresql b/lib/databases/postgresql
index 4f0a5a0a4c..b21418b75e 100644
--- a/lib/databases/postgresql
+++ b/lib/databases/postgresql
@@ -32,7 +32,7 @@ function cleanup_database_postgresql {
         # Get ruthless with mysql
         apt_get purge -y postgresql*
         return
-    elif is_fedora || is_suse; then
+    elif is_fedora; then
         uninstall_package postgresql-server
     else
         return
@@ -66,11 +66,6 @@ function configure_database_postgresql {
         pg_dir=`find /etc/postgresql -name pg_hba.conf|xargs dirname`
         pg_hba=$pg_dir/pg_hba.conf
         pg_conf=$pg_dir/postgresql.conf
-    elif is_suse; then
-        pg_hba=/var/lib/pgsql/data/pg_hba.conf
-        pg_conf=/var/lib/pgsql/data/postgresql.conf
-        # initdb is called when postgresql is first started
-        sudo [ -e $pg_hba ] || start_service postgresql
     else
         exit_distro_not_supported "postgresql configuration"
     fi
@@ -107,7 +102,7 @@ EOF
     if [[ "$INSTALL_DATABASE_SERVER_PACKAGES" == "True" ]]; then
         if is_ubuntu; then
             install_package postgresql
-        elif is_fedora || is_suse; then
+        elif is_fedora; then
             install_package postgresql-server
             if is_fedora; then
                 sudo systemctl enable postgresql
diff --git a/lib/glance b/lib/glance
index 041acafc92..5aeae16c61 100644
--- a/lib/glance
+++ b/lib/glance
@@ -47,10 +47,6 @@ USE_CINDER_FOR_GLANCE=$(trueorfalse False USE_CINDER_FOR_GLANCE)
 # from CINDER_ENABLED_BACKENDS
 GLANCE_CINDER_DEFAULT_BACKEND=${GLANCE_CINDER_DEFAULT_BACKEND:-lvmdriver-1}
 GLANCE_STORE_ROOTWRAP_BASE_DIR=/usr/local/etc/glance
-# NOTE (abhishekk): For opensuse data files are stored in different directory
-if is_opensuse; then
-    GLANCE_STORE_ROOTWRAP_BASE_DIR=/usr/etc/glance
-fi
 # When Cinder is used as a glance store, you can optionally configure cinder to
 # optimize bootable volume creation by allowing volumes to be cloned directly
 # in the backend instead of transferring data via Glance.  To use this feature,
diff --git a/lib/horizon b/lib/horizon
index b2bf7bcb49..f76f9e557d 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -129,7 +129,7 @@ function configure_horizon {
     if is_ubuntu; then
         disable_apache_site 000-default
         sudo touch $horizon_conf
-    elif is_fedora || is_suse; then
+    elif is_fedora; then
         : # nothing to do
     else
         exit_distro_not_supported "horizon apache configuration"
diff --git a/lib/ldap b/lib/ldap
index ea5faa1fe9..b0195db258 100644
--- a/lib/ldap
+++ b/lib/ldap
@@ -39,13 +39,6 @@ elif is_fedora; then
     LDAP_OLCDB_NUMBER=2
     LDAP_OLCDB_TYPE=hdb
     LDAP_ROOTPW_COMMAND=add
-elif is_suse; then
-    # SUSE has slappasswd in /usr/sbin/
-    PATH=$PATH:/usr/sbin/
-    LDAP_OLCDB_NUMBER=1
-    LDAP_OLCDB_TYPE=hdb
-    LDAP_ROOTPW_COMMAND=add
-    LDAP_SERVICE_NAME=ldap
 fi
 
 
@@ -76,8 +69,6 @@ function cleanup_ldap {
         sudo rm -rf /etc/ldap/ldap.conf /var/lib/ldap
     elif is_fedora; then
         sudo rm -rf /etc/openldap /var/lib/ldap
-    elif is_suse; then
-        sudo rm -rf /var/lib/ldap
     fi
 }
 
@@ -126,11 +117,6 @@ function install_ldap {
         configure_ldap
     elif is_fedora; then
         start_ldap
-    elif is_suse; then
-        _ldap_varsubst $FILES/ldap/suse-base-config.ldif.in >$tmp_ldap_dir/suse-base-config.ldif
-        sudo slapadd -F /etc/openldap/slapd.d/ -bcn=config -l $tmp_ldap_dir/suse-base-config.ldif
-        sudo sed -i '/^OPENLDAP_START_LDAPI=/s/"no"/"yes"/g' /etc/sysconfig/openldap
-        start_ldap
     fi
 
     echo "LDAP_PASSWORD is $LDAP_PASSWORD"
diff --git a/lib/lvm b/lib/lvm
index 57ffb967c3..57d2cd4e62 100644
--- a/lib/lvm
+++ b/lib/lvm
@@ -129,8 +129,8 @@ function init_lvm_volume_group {
     local vg=$1
     local size=$2
 
-    # Start the tgtd service on Fedora and SUSE if tgtadm is used
-    if  is_fedora || is_suse  && [[ "$CINDER_TARGET_HELPER" = "tgtadm" ]]; then
+    # Start the tgtd service on Fedora if tgtadm is used
+    if  is_fedora; then
         start_service tgtd
     fi
 
diff --git a/lib/neutron_plugins/ovs_base b/lib/neutron_plugins/ovs_base
index cc41a8cd46..adabc56412 100644
--- a/lib/neutron_plugins/ovs_base
+++ b/lib/neutron_plugins/ovs_base
@@ -80,19 +80,6 @@ function _neutron_ovs_base_install_agent_packages {
         elif is_fedora; then
             restart_service openvswitch
             sudo systemctl enable openvswitch
-        elif is_suse; then
-            if [[ $DISTRO == "sle12" ]] && vercmp "$os_RELEASE" "<" "12.2" ; then
-                restart_service openvswitch-switch
-            else
-                # workaround for https://bugzilla.suse.com/show_bug.cgi?id=1085971
-                if [[ $DISTRO =~ "tumbleweed" ]]; then
-                    sudo sed -i -e "s,^OVS_USER_ID=.*,OVS_USER_ID='root:root'," /etc/sysconfig/openvswitch
-                fi
-                restart_service openvswitch || {
-                    journalctl -xe || :
-                    systemctl status openvswitch
-                }
-            fi
         fi
     fi
 }
diff --git a/lib/neutron_plugins/ovs_source b/lib/neutron_plugins/ovs_source
index ea71e60e68..288eb1d69b 100644
--- a/lib/neutron_plugins/ovs_source
+++ b/lib/neutron_plugins/ovs_source
@@ -182,12 +182,6 @@ function action_openvswitch {
         ${action}_service openvswitch-switch
     elif is_fedora; then
         ${action}_service openvswitch
-    elif is_suse; then
-        if [[ $DISTRO == "sle12" ]] && [[ $os_RELEASE -lt 12.2 ]]; then
-            ${action}_service openvswitch-switch
-        else
-            ${action}_service openvswitch
-        fi
     fi
 }
 
diff --git a/lib/nova b/lib/nova
index 3aa6b9e3b3..f34e823074 100644
--- a/lib/nova
+++ b/lib/nova
@@ -448,8 +448,8 @@ function create_nova_conf {
 
     iniset $NOVA_CONF key_manager backend nova.keymgr.conf_key_mgr.ConfKeyManager
 
-    if is_fedora || is_suse; then
-        # nova defaults to /usr/local/bin, but fedora and suse pip like to
+    if is_fedora; then
+        # nova defaults to /usr/local/bin, but fedora pip like to
         # install things in /usr/bin
         iniset $NOVA_CONF DEFAULT bindir "/usr/bin"
     fi
@@ -523,7 +523,7 @@ function create_nova_conf {
 
     # nova defaults to genisoimage but only mkisofs is available for 15.0+
     # rhel provides mkisofs symlink to genisoimage or xorriso appropiately
-    if is_suse || is_fedora; then
+    if is_fedora; then
         iniset $NOVA_CONF DEFAULT mkisofs_cmd /usr/bin/mkisofs
     fi
 
diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index c0e45ebb85..799230603c 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -74,7 +74,7 @@ function install_libvirt {
             install_package qemu-efi
         fi
         #pip_install_gr <there-si-no-guestfs-in-pypi>
-    elif is_fedora || is_suse; then
+    elif is_fedora; then
 
         # Optionally enable the virt-preview repo when on Fedora
         if [[ $DISTRO =~ f[0-9][0-9] ]] && [[ ${ENABLE_FEDORA_VIRT_PREVIEW_REPO} == "True" ]]; then
@@ -121,8 +121,8 @@ cgroup_device_acl = [
 EOF
     fi
 
-    if is_fedora || is_suse; then
-        # Starting with fedora 18 and opensuse-12.3 enable stack-user to
+    if is_fedora; then
+        # Starting with fedora 18 enable stack-user to
         # virsh -c qemu:///system by creating a policy-kit rule for
         # stack-user using the new Javascript syntax
         rules_dir=/etc/polkit-1/rules.d
diff --git a/lib/nova_plugins/hypervisor-libvirt b/lib/nova_plugins/hypervisor-libvirt
index c1cd132548..87c3d3addc 100644
--- a/lib/nova_plugins/hypervisor-libvirt
+++ b/lib/nova_plugins/hypervisor-libvirt
@@ -114,9 +114,6 @@ function install_nova_hypervisor {
                     sudo dpkg-statoverride --add --update $STAT_OVERRIDE
                 fi
             done
-        elif is_suse; then
-            # Workaround for missing dependencies in python-libguestfs
-            install_package python-libguestfs guestfs-data augeas augeas-lenses
         elif is_fedora; then
             install_package python3-libguestfs
         fi
diff --git a/lib/rpc_backend b/lib/rpc_backend
index 743b4ae170..bbb41499be 100644
--- a/lib/rpc_backend
+++ b/lib/rpc_backend
@@ -52,20 +52,7 @@ function install_rpc_backend {
     if is_service_enabled rabbit; then
         # Install rabbitmq-server
         install_package rabbitmq-server
-        if is_suse; then
-            install_package rabbitmq-server-plugins
-            # the default systemd socket activation only listens on the loopback interface
-            # which causes rabbitmq to try to start its own epmd
-            sudo mkdir -p /etc/systemd/system/epmd.socket.d
-            cat <<EOF | sudo tee /etc/systemd/system/epmd.socket.d/ports.conf >/dev/null
-[Socket]
-ListenStream=
-ListenStream=[::]:4369
-EOF
-            sudo systemctl daemon-reload
-            sudo systemctl restart epmd.socket epmd.service
-        fi
-        if is_fedora || is_suse; then
+        if is_fedora; then
             # NOTE(jangutter): If rabbitmq is not running (as in a fresh
             # install) then rabbit_setuser triggers epmd@0.0.0.0.socket with
             # socket activation. This fails the first time and does not get
diff --git a/lib/swift b/lib/swift
index 251c4625b5..1ebf073318 100644
--- a/lib/swift
+++ b/lib/swift
@@ -547,9 +547,6 @@ function configure_swift {
     local swift_log_dir=${SWIFT_DATA_DIR}/logs
     sudo rm -rf ${swift_log_dir}
     local swift_log_group=adm
-    if is_suse; then
-        swift_log_group=root
-    fi
     sudo install -d -o ${STACK_USER} -g ${swift_log_group} ${swift_log_dir}/hourly
 
     if [[ $SYSLOG != "False" ]]; then
diff --git a/lib/tls b/lib/tls
index b8758cd6d3..e0c7500b20 100644
--- a/lib/tls
+++ b/lib/tls
@@ -212,9 +212,6 @@ function init_CA {
     if is_fedora; then
         sudo cp $INT_CA_DIR/ca-chain.pem /usr/share/pki/ca-trust-source/anchors/devstack-chain.pem
         sudo update-ca-trust
-    elif is_suse; then
-        sudo cp $INT_CA_DIR/ca-chain.pem /usr/share/pki/trust/anchors/devstack-chain.pem
-        sudo update-ca-certificates
     elif is_ubuntu; then
         sudo cp $INT_CA_DIR/ca-chain.pem /usr/local/share/ca-certificates/devstack-int.crt
         sudo cp $ROOT_CA_DIR/cacert.pem /usr/local/share/ca-certificates/devstack-root.crt
@@ -376,9 +373,6 @@ function fix_system_ca_bundle_path {
             elif is_ubuntu; then
                 sudo rm -f $capath
                 sudo ln -s /etc/ssl/certs/ca-certificates.crt $capath
-            elif is_suse; then
-                sudo rm -f $capath
-                sudo ln -s /etc/ssl/ca-bundle.pem $capath
             else
                 echo "Don't know how to set the CA bundle, expect the install to fail."
             fi
@@ -441,9 +435,6 @@ function enable_mod_ssl {
 
     if is_ubuntu; then
         sudo a2enmod ssl
-    elif is_suse; then
-        sudo a2enmod ssl
-        sudo a2enflag SSL
     elif is_fedora; then
         # Fedora enables mod_ssl by default
         :
@@ -560,9 +551,6 @@ $listen_string
     CustomLog $APACHE_LOG_DIR/tls-proxy_access.log combined
 </VirtualHost>
 EOF
-    if is_suse ; then
-        sudo a2enflag SSL
-    fi
     for mod in headers ssl proxy proxy_http; do
         enable_apache_mod $mod
     done
diff --git a/stack.sh b/stack.sh
index 28576d1e14..8d450aadc1 100755
--- a/stack.sh
+++ b/stack.sh
@@ -229,7 +229,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-SUPPORTED_DISTROS="bullseye|focal|jammy|f36|opensuse-15.2|opensuse-tumbleweed|rhel8|rhel9|openEuler-22.03"
+SUPPORTED_DISTROS="bullseye|focal|jammy|f36|rhel8|rhel9|openEuler-22.03"
 
 if [[ ! ${DISTRO} =~ $SUPPORTED_DISTROS ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
diff --git a/tests/test_package_ordering.sh b/tests/test_package_ordering.sh
index bfc2a1954f..f221c821a0 100755
--- a/tests/test_package_ordering.sh
+++ b/tests/test_package_ordering.sh
@@ -8,7 +8,7 @@ TOP=$(cd $(dirname "$0")/.. && pwd)
 source $TOP/tests/unittest.sh
 
 export LC_ALL=en_US.UTF-8
-PKG_FILES=$(find $TOP/files/debs $TOP/files/rpms $TOP/files/rpms-suse -type f)
+PKG_FILES=$(find $TOP/files/debs $TOP/files/rpms -type f)
 
 TMPDIR=$(mktemp -d)
 
diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index daa1bc6301..0ec426b601 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -90,45 +90,6 @@ function fixup_fedora {
     fi
 }
 
-function fixup_suse {
-    if ! is_suse; then
-        return
-    fi
-
-    # Deactivate and disable apparmor profiles in openSUSE and SLE
-    # distros to avoid issues with haproxy and dnsmasq.  In newer
-    # releases, systemctl stop apparmor is actually a no-op, so we
-    # have to use aa-teardown to make sure we've deactivated the
-    # profiles:
-    #
-    # https://www.suse.com/releasenotes/x86_64/SUSE-SLES/15/#fate-325343
-    # https://gitlab.com/apparmor/apparmor/merge_requests/81
-    # https://build.opensuse.org/package/view_file/openSUSE:Leap:15.2/apparmor/apparmor.service?expand=1
-    if sudo systemctl is-active -q apparmor; then
-        sudo systemctl stop apparmor
-    fi
-    if [ -x /usr/sbin/aa-teardown ]; then
-        sudo /usr/sbin/aa-teardown
-    fi
-    if sudo systemctl is-enabled -q apparmor; then
-        sudo systemctl disable apparmor
-    fi
-
-    # Since pip10, pip will refuse to uninstall files from packages
-    # that were created with distutils (rather than more modern
-    # setuptools).  This is because it technically doesn't have a
-    # manifest of what to remove.  However, in most cases, simply
-    # overwriting works.  So this hacks around those packages that
-    # have been dragged in by some other system dependency
-    sudo rm -rf /usr/lib/python3.6/site-packages/ply-*.egg-info
-    sudo rm -rf /usr/lib/python3.6/site-packages/six-*.egg-info
-
-    # Ensure trusted CA certificates are up to date
-    # See https://bugzilla.suse.com/show_bug.cgi?id=1154871
-    # May be removed once a new opensuse-15 image is available in nodepool
-    sudo zypper up -y p11-kit ca-certificates-mozilla
-}
-
 function fixup_ovn_centos {
     if [[ $os_VENDOR != "CentOS" ]]; then
         return
@@ -156,5 +117,4 @@ function fixup_ubuntu {
 function fixup_all {
     fixup_ubuntu
     fixup_fedora
-    fixup_suse
 }
diff --git a/tools/install_prereqs.sh b/tools/install_prereqs.sh
index a7c03d26cd..f2d57c8451 100755
--- a/tools/install_prereqs.sh
+++ b/tools/install_prereqs.sh
@@ -74,8 +74,6 @@ install_package $PACKAGES
 if [[ -n "$SYSLOG" && "$SYSLOG" != "False" ]]; then
     if is_ubuntu || is_fedora; then
         install_package rsyslog-relp
-    elif is_suse; then
-        install_package rsyslog-module-relp
     else
         exit_distro_not_supported "rsyslog-relp installation"
     fi

From 7567359755a105e7278bbf97541332f28228b87d Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Mon, 13 Feb 2023 14:41:40 +0000
Subject: [PATCH 2118/2409] Try to reduce mysql memory usage

These are a few tweaks I applied to my own memory-constrained cloud
instances that seemed to help. I have lower performance requirements
so this may make things worse and not better, but it's worth seeing
what the impact is. I'll admit to not knowing the full impact of these
as they're mostly collected from various tutorials on lowering memory
usage.

Enable this for now on devstack-multinode

Change-Id: I7b223391d3de01e3e81b02076debd01d9d2f097c
---
 .zuul.yaml          |  3 +++
 lib/databases/mysql | 10 ++++++++++
 stackrc             |  5 +++++
 3 files changed, 18 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index 8e20f6ed34..fa7f180797 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -696,6 +696,9 @@
     description: |
       Simple multinode test to verify multinode functionality on devstack side.
       This is not meant to be used as a parent job.
+    vars:
+      devstack_localrc:
+        MYSQL_REDUCE_MEMORY: true
 
 # NOTE(ianw) Platform tests have traditionally been non-voting because
 # we often have to rush things through devstack to stabilise the gate,
diff --git a/lib/databases/mysql b/lib/databases/mysql
index fbad44e36a..e805b3e73f 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -176,6 +176,16 @@ function configure_database_mysql {
                 count INT, PRIMARY KEY (db, op)) ENGINE MEMORY" stats
     fi
 
+    if [[ "$MYSQL_REDUCE_MEMORY" == "True" ]]; then
+        iniset -sudo $my_conf mysqld read_buffer_size 64K
+        iniset -sudo $my_conf mysqld innodb_buffer_pool_size 16M
+        iniset -sudo $my_conf mysqld thread_stack 192K
+        iniset -sudo $my_conf mysqld thread_cache_size 8
+        iniset -sudo $my_conf mysqld tmp_table_size 8M
+        iniset -sudo $my_conf mysqld sort_buffer_size 8M
+        iniset -sudo $my_conf mysqld max_allowed_packet 8M
+    fi
+
     restart_service $MYSQL_SERVICE_NAME
 }
 
diff --git a/stackrc b/stackrc
index a05d1e5553..442e9a0351 100644
--- a/stackrc
+++ b/stackrc
@@ -201,6 +201,11 @@ DATABASE_QUERY_LOGGING=$(trueorfalse False DATABASE_QUERY_LOGGING)
 # performance_schema that are of interest to us
 MYSQL_GATHER_PERFORMANCE=$(trueorfalse True MYSQL_GATHER_PERFORMANCE)
 
+# This can be used to reduce the amount of memory mysqld uses while running.
+# These are unscientifically determined, and could reduce performance or
+# cause other issues.
+MYSQL_REDUCE_MEMORY=$(trueorfalse False MYSQL_REDUCE_MEMORY)
+
 # Set a timeout for git operations.  If git is still running when the
 # timeout expires, the command will be retried up to 3 times.  This is
 # in the format for timeout(1);

From 37d11d00e56ec6ff402a13a28ec308c13291a937 Mon Sep 17 00:00:00 2001
From: Ghanshyam <gmann@ghanshyammann.com>
Date: Tue, 21 Feb 2023 21:41:40 +0000
Subject: [PATCH 2119/2409] Revert "Bump cirros version to 0.6.1"

This reverts commit 91efe177b170c3874989affc73842dc4ffbe062d.

Reason for revert: it broke tempest-slow job https://9afe3d390e4175b60a80-89b1085289883615a17bd93ef47f6ca9.ssl.cf5.rackcdn.com/871018/13/gate/tempest-slow-py3/d139ae1/testr_results.html

Change-Id: Ib74e51a780d3e8101f4147db9d24eebea4980fb1
---
 doc/source/guides/nova.rst |  2 +-
 stackrc                    | 15 ++++++++-------
 2 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/doc/source/guides/nova.rst b/doc/source/guides/nova.rst
index d0fb274c13..5b427972c4 100644
--- a/doc/source/guides/nova.rst
+++ b/doc/source/guides/nova.rst
@@ -122,7 +122,7 @@ when creating the server, for example:
 .. code-block:: shell
 
   $ openstack --os-compute-api-version 2.37 server create --flavor cirros256 \
-      --image cirros-0.6.1-x86_64-disk --nic none --wait test-server
+      --image cirros-0.3.5-x86_64-disk --nic none --wait test-server
 
 .. note:: ``--os-compute-api-version`` greater than or equal to 2.37 is
           required to use ``--nic=none``.
diff --git a/stackrc b/stackrc
index a71d843362..b3130e5f7f 100644
--- a/stackrc
+++ b/stackrc
@@ -657,19 +657,20 @@ esac
 #     If the file ends in .tar.gz, uncompress the tarball and and select the first
 #     .img file inside it as the image.  If present, use "*-vmlinuz*" as the kernel
 #     and "*-initrd*" as the ramdisk
-#     example: https://cloud-images.ubuntu.com/releases/jammy/release/ubuntu-22.04-server-cloudimg-amd64.tar.gz
+#     example: http://cloud-images.ubuntu.com/releases/precise/release/ubuntu-12.04-server-cloudimg-amd64.tar.gz
 #  * disk image (*.img,*.img.gz)
 #    if file ends in .img, then it will be uploaded and registered as a to
 #    glance as a disk image.  If it ends in .gz, it is uncompressed first.
 #    example:
-#      https://cloud-images.ubuntu.com/releases/jammy/release/ubuntu-22.04-server-cloudimg-amd64.img
-#      https://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-rootfs.img.gz
+#      http://cloud-images.ubuntu.com/releases/precise/release/ubuntu-12.04-server-cloudimg-armel-disk1.img
+#      http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-rootfs.img.gz
 #  * OpenVZ image:
 #    OpenVZ uses its own format of image, and does not support UEC style images
 
-#IMAGE_URLS="https://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img" # cirros full disk image
+#IMAGE_URLS="http://smoser.brickies.net/ubuntu/ttylinux-uec/ttylinux-uec-amd64-11.2_2.6.35-15_1.tar.gz" # old ttylinux-uec image
+#IMAGE_URLS="http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img" # cirros full disk image
 
-CIRROS_VERSION=${CIRROS_VERSION:-"0.6.1"}
+CIRROS_VERSION=${CIRROS_VERSION:-"0.5.2"}
 CIRROS_ARCH=${CIRROS_ARCH:-$(uname -m)}
 
 # Set default image based on ``VIRT_DRIVER`` and ``LIBVIRT_TYPE``, either of
@@ -686,11 +687,11 @@ if [[ "$DOWNLOAD_DEFAULT_IMAGES" == "True" ]]; then
                 lxc) # the cirros root disk in the uec tarball is empty, so it will not work for lxc
                     DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-rootfs}
                     DEFAULT_IMAGE_FILE_NAME=${DEFAULT_IMAGE_FILE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-rootfs.img.gz}
-                    IMAGE_URLS+="https://download.cirros-cloud.net/${CIRROS_VERSION}/${DEFAULT_IMAGE_FILE_NAME}";;
+                    IMAGE_URLS+="http://download.cirros-cloud.net/${CIRROS_VERSION}/${DEFAULT_IMAGE_FILE_NAME}";;
                 *) # otherwise, use the qcow image
                     DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk}
                     DEFAULT_IMAGE_FILE_NAME=${DEFAULT_IMAGE_FILE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img}
-                    IMAGE_URLS+="https://download.cirros-cloud.net/${CIRROS_VERSION}/${DEFAULT_IMAGE_FILE_NAME}";;
+                    IMAGE_URLS+="http://download.cirros-cloud.net/${CIRROS_VERSION}/${DEFAULT_IMAGE_FILE_NAME}";;
                 esac
             ;;
         vsphere)

From 0572d73f8561f3304f897bf9ee2f63c406cc21b7 Mon Sep 17 00:00:00 2001
From: Nobuhiro MIKI <nmiki@yahoo-corp.jp>
Date: Wed, 22 Feb 2023 10:38:49 +0900
Subject: [PATCH 2120/2409] Disable memory_tracker and file_tracker in
 unstask.sh properly

stop_dstat() calls stop_process() for dstat, memory_tracker and
file_tracker respectively. Inside stop_process(), a check for the
existence of the service is performed by is_service_enabled().

So even if we apply this seemingly dangerous commit,
is_service_enabled() is respected, so it's safe.

Closes-Bug: #1998990
Change-Id: Ica58cdb1d60c4c796f582d82ed2cde0be94b1a7e
Signed-off-by: Nobuhiro MIKI <nmiki@yahoo-corp.jp>
---
 unstack.sh | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/unstack.sh b/unstack.sh
index a36af3fb59..33b069b6a3 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -168,9 +168,7 @@ if is_service_enabled etcd3; then
     cleanup_etcd3
 fi
 
-if is_service_enabled dstat; then
-    stop_dstat
-fi
+stop_dstat
 
 # NOTE: Cinder automatically installs the lvm2 package, independently of the
 # enabled backends. So if Cinder is enabled, and installed successfully we are

From 03c3fd763e301077ecfa0a2d3428a091bedd691d Mon Sep 17 00:00:00 2001
From: Yamato Tanaka <yatanaka@redhat.com>
Date: Fri, 10 Feb 2023 19:44:20 +0900
Subject: [PATCH 2121/2409] Support RHEL 9

This patch includes changes required to run devstack on RHEL 9.

- en_US.utf8 is provided by glibc-langpack-en
- iptables command is provided by iptables-nft
- Use /etc/os-release to identify the distro in RHEL 9 as it doesn't
  provide lsb_release command.
- CRB repository name is different from CentOS 9

Change-Id: I8f6d9263b24f9c2cf82e09258e2d14d7766ad337
---
 files/rpms/general | 2 ++
 functions-common   | 5 +++--
 stack.sh           | 3 +++
 3 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/files/rpms/general b/files/rpms/general
index b6866de62d..8a5755cc37 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -6,9 +6,11 @@ gcc
 gcc-c++
 gettext  # used for compiling message catalogs
 git-core
+glibc-langpack-en # dist:rhel9
 graphviz # needed only for docs
 httpd
 httpd-devel
+iptables-nft # dist:rhel9
 iptables-services
 java-1.8.0-openjdk-headless
 libffi-devel
diff --git a/functions-common b/functions-common
index 4eed5d8407..3e07a49e22 100644
--- a/functions-common
+++ b/functions-common
@@ -412,9 +412,9 @@ function _ensure_lsb_release {
 #  - os_VENDOR
 #  - os_PACKAGE
 function GetOSVersion {
-    # CentOS Stream 9 does not provide lsb_release
+    # CentOS Stream 9 and RHEL 9 do not provide lsb_release
     source /etc/os-release
-    if [[ "${ID}${VERSION}" == "centos9" ]]; then
+    if [[ "${ID}${VERSION}" == "centos9" ]] || [[ "${ID}${VERSION}" =~ "rhel9" ]]; then
         os_RELEASE=${VERSION_ID}
         os_CODENAME="n/a"
         os_VENDOR=$(echo $NAME | tr -d '[:space:]')
@@ -530,6 +530,7 @@ function is_fedora {
         [ "$os_VENDOR" = "openEuler" ] || \
         [ "$os_VENDOR" = "RedHatEnterpriseServer" ] || \
         [ "$os_VENDOR" = "RedHatEnterprise" ] || \
+        [ "$os_VENDOR" = "RedHatEnterpriseLinux" ] || \
         [ "$os_VENDOR" = "Rocky" ] || \
         [ "$os_VENDOR" = "CentOS" ] || [ "$os_VENDOR" = "CentOSStream" ] || \
         [ "$os_VENDOR" = "AlmaLinux" ] || \
diff --git a/stack.sh b/stack.sh
index ccd2d16baa..6e7b11a0bc 100755
--- a/stack.sh
+++ b/stack.sh
@@ -391,7 +391,10 @@ if [[ $DISTRO == "rhel8" ]]; then
     # Patch: https://github.com/rpm-software-management/dnf/pull/1448
     echo "[]" | sudo tee /var/cache/dnf/expired_repos.json
 elif [[ $DISTRO == "rhel9" ]]; then
+    # for CentOS Stream 9 repository
     sudo dnf config-manager --set-enabled crb
+    # for RHEL 9 repository
+    sudo dnf config-manager --set-enabled codeready-builder-for-rhel-9-x86_64-rpms
     # rabbitmq and other packages are provided by RDO repositories.
     _install_rdo
 

From f834f9adaf9c228ff4ec6a5e24e6d4cf3ca6a992 Mon Sep 17 00:00:00 2001
From: Michael Johnson <johnsomor@gmail.com>
Date: Mon, 6 Mar 2023 18:47:03 +0000
Subject: [PATCH 2122/2409] Fix NotImplementedError in dbcounter on SQLA 2.x

This patch fixes a NotImplementedError raised in the dbcounter plugin when using SQLAlchemy 2.x. The plugin signature has changed and now requires an "update_url" method as part of the plugin[1].
This patch also updates the do_incr() explicit SQL string to use a TextClause and the new requirement for named bound parameters[2].

Closes-Bug: #2009521

[1] https://docs.sqlalchemy.org/en/20/changelog/migration_14.html#changes-to-createengineplugin
[2] https://docs.sqlalchemy.org/en/20/changelog/migration_20.html#execute-method-more-strict-execution-options-are-more-prominent

Change-Id: Ie5484597057a3306757cc46b657446ad61ac2098
---
 ...ementedError-on-SQLAlchemy-2-21bb6dcdf3ce4225.yaml |  5 +++++
 tools/dbcounter/dbcounter.py                          | 11 +++++++----
 2 files changed, 12 insertions(+), 4 deletions(-)
 create mode 100644 releasenotes/notes/Fix-dbcounter-NotImplementedError-on-SQLAlchemy-2-21bb6dcdf3ce4225.yaml

diff --git a/releasenotes/notes/Fix-dbcounter-NotImplementedError-on-SQLAlchemy-2-21bb6dcdf3ce4225.yaml b/releasenotes/notes/Fix-dbcounter-NotImplementedError-on-SQLAlchemy-2-21bb6dcdf3ce4225.yaml
new file mode 100644
index 0000000000..f815e14ccb
--- /dev/null
+++ b/releasenotes/notes/Fix-dbcounter-NotImplementedError-on-SQLAlchemy-2-21bb6dcdf3ce4225.yaml
@@ -0,0 +1,5 @@
+---
+fixes:
+  - |
+    Fixes a NotImplementedError when using the dbcounter SQLAlchemy plugin on
+    SQLAlchemy 2.x.
diff --git a/tools/dbcounter/dbcounter.py b/tools/dbcounter/dbcounter.py
index 5057f0f393..0ed7bb813a 100644
--- a/tools/dbcounter/dbcounter.py
+++ b/tools/dbcounter/dbcounter.py
@@ -40,6 +40,9 @@ def __init__(self, url, kwargs):
         self.queue = queue.Queue()
         self.thread = None
 
+    def update_url(self, url):
+        return url.difference_update_query(["dbcounter"])
+
     def engine_created(self, engine):
         """Hook the engine creation process.
 
@@ -77,12 +80,12 @@ def _log_event(self, conn, cursor, statement, parameters, context,
     def do_incr(self, db, op, count):
         """Increment the counter for (db,op) by count."""
 
-        query = ('INSERT INTO queries (db, op, count) '
-                 '  VALUES (%s, %s, %s) '
-                 '  ON DUPLICATE KEY UPDATE count=count+%s')
+        query = sqlalchemy.text('INSERT INTO queries (db, op, count) '
+                                '  VALUES (:db, :op, :count) '
+                                '  ON DUPLICATE KEY UPDATE count=count+:count')
         try:
             with self.engine.begin() as conn:
-                r = conn.execute(query, (db, op, count, count))
+                r = conn.execute(query, {'db': db, 'op': op, 'count': count})
         except Exception as e:
             LOG.error('Failed to account for access to database %r: %s',
                       db, e)

From 07a7293721736e1184ae7dc22da33b2ce7babf61 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Fri, 10 Mar 2023 20:30:53 -0600
Subject: [PATCH 2123/2409] Update DEVSTACK_SERIES to 2023.2

stable/2023.1 branch has been created now and
current master is for 2023.2.

Change-Id: Ibd499ac35a38a5c1818c1df6009c5273ef3e90f7
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 442e9a0351..b7ce238366 100644
--- a/stackrc
+++ b/stackrc
@@ -248,7 +248,7 @@ REQUIREMENTS_DIR=${REQUIREMENTS_DIR:-$DEST/requirements}
 # Setting the variable to 'ALL' will activate the download for all
 # libraries.
 
-DEVSTACK_SERIES="2023.1"
+DEVSTACK_SERIES="2023.2"
 
 ##############
 #

From 1898a683be78622445e48f1f071cf7188ab19450 Mon Sep 17 00:00:00 2001
From: Rajat Dhasmana <rajatdhasmana@gmail.com>
Date: Tue, 14 Mar 2023 05:35:33 +0000
Subject: [PATCH 2124/2409] Create multiattach volume type for tempest

Creating multiattach volume is a non-admin operation but creating
multiattach volume type is an admin operation.
Previously cinder allowed creating multiattach volumes without a
volume type but that support is being removed with[1].
The change requires updating tempest tests[2] but some tempest
tests are non-admin, which require admin priviledges to create the
multiattach volume type.
Based on the last discussion with tempest team[3], the proposed
solution is to create a multiattach volume type in devstack,
if ENABLE_VOLUME_MULTIATTACH is True, and use it in tempest
tests. Similar to how admins create multiattach volume types
for non-admin users.

This patch creates a multiattach volume type if
ENABLE_VOLUME_MULTIATTACH is True. Also we set the multiattach
type name as a tempest config option 'volume_type_multiattach'.

[1] https://review.opendev.org/c/openstack/cinder/+/874865
[2] https://review.opendev.org/c/openstack/tempest/+/875372
[3] https://meetings.opendev.org/irclogs/%23openstack-cinder/%23openstack-cinder.2023-03-13.log.html#t2023-03-13T18:47:56

Change-Id: Icd3690565bf7b27898cd206641e612da3993703d
---
 lib/cinder  | 34 +++++++++++++++++++++++-----------
 lib/tempest |  4 ++++
 2 files changed, 27 insertions(+), 11 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 2424f928d1..c50a205f20 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -95,6 +95,7 @@ CINDER_ENABLED_BACKENDS=${CINDER_ENABLED_BACKENDS:-lvm:lvmdriver-1}
 CINDER_VOLUME_CLEAR=${CINDER_VOLUME_CLEAR:-${CINDER_VOLUME_CLEAR_DEFAULT:-zero}}
 CINDER_VOLUME_CLEAR=$(echo ${CINDER_VOLUME_CLEAR} | tr '[:upper:]' '[:lower:]')
 
+VOLUME_TYPE_MULTIATTACH=${VOLUME_TYPE_MULTIATTACH:-multiattach}
 
 if [[ -n "$CINDER_ISCSI_HELPER" ]]; then
     if [[ -z "$CINDER_TARGET_HELPER" ]]; then
@@ -649,6 +650,23 @@ function stop_cinder {
     stop_process c-vol
 }
 
+function create_one_type {
+    type_name=$1
+    property_key=$2
+    property_value=$3
+    # NOTE (e0ne): openstack client doesn't work with cinder in noauth mode
+    if is_service_enabled keystone; then
+        openstack --os-region-name="$REGION_NAME" volume type create --property $property_key="$property_value" $type_name
+    else
+        # TODO (e0ne): use openstack client once it will support cinder in noauth mode:
+        # https://bugs.launchpad.net/python-cinderclient/+bug/1755279
+        local cinder_url
+        cinder_url=$CINDER_SERVICE_PROTOCOL://$SERVICE_HOST:$CINDER_SERVICE_PORT/v3
+        OS_USER_ID=$OS_USERNAME OS_PROJECT_ID=$OS_PROJECT_NAME cinder --os-auth-type noauth --os-endpoint=$cinder_url type-create $type_name
+        OS_USER_ID=$OS_USERNAME OS_PROJECT_ID=$OS_PROJECT_NAME cinder --os-auth-type noauth --os-endpoint=$cinder_url type-key $type_name set $property_key="$property_value"
+    fi
+}
+
 # create_volume_types() - Create Cinder's configured volume types
 function create_volume_types {
     # Create volume types
@@ -656,19 +674,13 @@ function create_volume_types {
         local be be_name
         for be in ${CINDER_ENABLED_BACKENDS//,/ }; do
             be_name=${be##*:}
-            # NOTE (e0ne): openstack client doesn't work with cinder in noauth mode
-            if is_service_enabled keystone; then
-                openstack --os-region-name="$REGION_NAME" volume type create --property volume_backend_name="${be_name}" ${be_name}
-            else
-                # TODO (e0ne): use openstack client once it will support cinder in noauth mode:
-                # https://bugs.launchpad.net/python-cinderclient/+bug/1755279
-                local cinder_url
-                cinder_url=$CINDER_SERVICE_PROTOCOL://$SERVICE_HOST:$CINDER_SERVICE_PORT/v3
-                OS_USER_ID=$OS_USERNAME OS_PROJECT_ID=$OS_PROJECT_NAME cinder --os-auth-type noauth --os-endpoint=$cinder_url type-create ${be_name}
-                OS_USER_ID=$OS_USERNAME OS_PROJECT_ID=$OS_PROJECT_NAME cinder --os-auth-type noauth --os-endpoint=$cinder_url type-key ${be_name} set volume_backend_name=${be_name}
-            fi
+            create_one_type $be_name "volume_backend_name" $be_name
         done
 
+        if [[ $ENABLE_VOLUME_MULTIATTACH == "True" ]]; then
+            create_one_type $VOLUME_TYPE_MULTIATTACH $VOLUME_TYPE_MULTIATTACH "<is> True"
+        fi
+
         # Increase quota for the service project if glance is using cinder,
         # since it's likely to occasionally go above the default 10 in parallel
         # test execution.
diff --git a/lib/tempest b/lib/tempest
index c3d3e9ac30..7da9f17052 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -604,6 +604,10 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG volume storage_protocol "$TEMPEST_STORAGE_PROTOCOL"
     fi
 
+    if [[ $ENABLE_VOLUME_MULTIATTACH == "True" ]]; then
+        iniset $TEMPEST_CONFIG volume volume_type_multiattach $VOLUME_TYPE_MULTIATTACH
+    fi
+
     # Placement Features
     # Set the microversion range for placement.
     # Setting [None, latest] range of microversion which allow Tempest to run all microversions tests.

From 80c3ffe154fd79e03d8c4258b500b77a26efa008 Mon Sep 17 00:00:00 2001
From: Sean Mooney <work@seanmooney.info>
Date: Mon, 27 Mar 2023 20:56:20 +0000
Subject: [PATCH 2125/2409] Fix reboot on fedora like nodes

This change enables httpd in systemd so that it
starts after a reboot and updates how selinux is
disabled to use /etc/selinux/config in addtion
to setenforce.

Change-Id: I5ea8693c0b967937483bd921b1d9984ea14bc723
---
 lib/apache           | 2 ++
 tools/fixup_stuff.sh | 6 ++++++
 2 files changed, 8 insertions(+)

diff --git a/lib/apache b/lib/apache
index dd8c9a0f06..771a7d7ec0 100644
--- a/lib/apache
+++ b/lib/apache
@@ -150,6 +150,8 @@ function install_apache_wsgi {
     elif is_fedora; then
         sudo rm -f /etc/httpd/conf.d/000-*
         install_package httpd python3-mod_wsgi
+        # rpm distros dont enable httpd by default so enable it to support reboots.
+        sudo systemctl enable httpd
         # For consistency with Ubuntu, switch to the worker mpm, as
         # the default is event
         sudo sed -i '/mod_mpm_prefork.so/s/^/#/g' /etc/httpd/conf.modules.d/00-mpm.conf
diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index daa1bc6301..fef47263de 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -36,6 +36,12 @@ function fixup_fedora {
     # Disable selinux to avoid configuring to allow Apache access
     # to Horizon files (LP#1175444)
     if selinuxenabled; then
+        #persit selinux config across reboots
+        cat << EOF | sudo tee /etc/selinux/config
+SELINUX=permissive
+SELINUXTYPE=targeted
+EOF
+        # then disable at runtime
         sudo setenforce 0
     fi
 

From fa42b3ca7bbac7746644693241ea1dd58a4939f0 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Fri, 14 Apr 2023 02:16:59 +0000
Subject: [PATCH 2126/2409] Updated from generate-devstack-plugins-list

Change-Id: I84015f860155e5c8ec3bcf54353d91405a13e549
---
 doc/source/plugin-registry.rst | 1 -
 1 file changed, 1 deletion(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 2e8e8f53d7..b244ca5dd8 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -88,7 +88,6 @@ openstack/openstacksdk                   `https://opendev.org/openstack/openstac
 openstack/osprofiler                     `https://opendev.org/openstack/osprofiler <https://opendev.org/openstack/osprofiler>`__
 openstack/oswin-tempest-plugin           `https://opendev.org/openstack/oswin-tempest-plugin <https://opendev.org/openstack/oswin-tempest-plugin>`__
 openstack/ovn-octavia-provider           `https://opendev.org/openstack/ovn-octavia-provider <https://opendev.org/openstack/ovn-octavia-provider>`__
-openstack/patrole                        `https://opendev.org/openstack/patrole <https://opendev.org/openstack/patrole>`__
 openstack/rally-openstack                `https://opendev.org/openstack/rally-openstack <https://opendev.org/openstack/rally-openstack>`__
 openstack/sahara                         `https://opendev.org/openstack/sahara <https://opendev.org/openstack/sahara>`__
 openstack/sahara-dashboard               `https://opendev.org/openstack/sahara-dashboard <https://opendev.org/openstack/sahara-dashboard>`__

From 42517968ff7bdced07c5bc08b6cb2b8d10d246cc Mon Sep 17 00:00:00 2001
From: yatinkarel <ykarel@redhat.com>
Date: Fri, 14 Apr 2023 19:06:03 +0530
Subject: [PATCH 2127/2409] [ovs] Reload ovs kernel module always

Irrespective of build_modules is True
or False reload ovs modules always.

If ovs is installed from package before(like
with multi-node-bridge role), then installing
ovs from source requires openvswitch kernel
module to be reloaded.

The issue was not seen before jammy as there
module was reloaded when build_modules was set
to True.

Closes-Bug: #2015364
Change-Id: I1785b49b2ef72ca1f817f504d5ea56021410c052
---
 lib/neutron_plugins/ovs_source | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/lib/neutron_plugins/ovs_source b/lib/neutron_plugins/ovs_source
index ea71e60e68..d0ca75334e 100644
--- a/lib/neutron_plugins/ovs_source
+++ b/lib/neutron_plugins/ovs_source
@@ -164,10 +164,8 @@ function compile_ovs {
     sudo make install
     if [[ "$build_modules" == "True" ]]; then
         sudo make INSTALL_MOD_DIR=kernel/net/openvswitch modules_install
-        reload_ovs_kernel_modules
-    else
-        load_ovs_kernel_modules
     fi
+    reload_ovs_kernel_modules
 
     cd $_pwd
 }

From 15b2e429685fc753759ef8f3773ac559424e028f Mon Sep 17 00:00:00 2001
From: Ade Lee <alee@redhat.com>
Date: Tue, 24 Jan 2023 14:44:13 +0100
Subject: [PATCH 2128/2409] Modify devstack-base to allow for fips

devstack-base is changed to descend from
openstack-multinode-fips which is defined in
project-config.

This allows jobs to execute the enable_fips playbook
to enable FIPS mode on the node, but only if they
opt-in by setting enable_fips to True.  Otherwise,
this is a no-op.

Change-Id: I5631281662dbd18056ffba291290ed0978ab937e
---
 .zuul.yaml          |  2 +-
 functions-common    |  5 +++++
 lib/databases/mysql | 11 ++++++++++-
 3 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index fa7f180797..37625f3d11 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -370,7 +370,7 @@
 
 - job:
     name: devstack-base
-    parent: multinode
+    parent: openstack-multinode-fips
     abstract: true
     description: |
       Base abstract Devstack job.
diff --git a/functions-common b/functions-common
index 4eed5d8407..844fffac37 100644
--- a/functions-common
+++ b/functions-common
@@ -2545,6 +2545,11 @@ function clean_pyc_files {
     fi
 }
 
+function is_fips_enabled {
+    fips=`cat /proc/sys/crypto/fips_enabled`
+    [ "$fips" == "1" ]
+}
+
 # Restore xtrace
 $_XTRACE_FUNCTIONS_COMMON
 
diff --git a/lib/databases/mysql b/lib/databases/mysql
index e805b3e73f..bc6ce3d5c2 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -69,7 +69,7 @@ function recreate_database_mysql {
 }
 
 function configure_database_mysql {
-    local my_conf mysql slow_log
+    local my_conf mysql slow_log my_client_conf
     echo_summary "Configuring and starting MySQL"
 
     if is_ubuntu; then
@@ -86,6 +86,15 @@ function configure_database_mysql {
         exit_distro_not_supported "mysql configuration"
     fi
 
+    # Set fips mode on
+    if is_ubuntu; then
+        if is_fips_enabled; then
+            my_client_conf=/etc/mysql/mysql.conf.d/mysql.cnf
+            iniset -sudo $my_client_conf mysql ssl-fips-mode "on"
+            iniset -sudo $my_conf mysqld ssl-fips-mode "on"
+        fi
+    fi
+
     # Change bind-address from localhost (127.0.0.1) to any (::)
     iniset -sudo $my_conf mysqld bind-address "$(ipv6_unquote $SERVICE_LISTEN_ADDRESS)"
 

From 991a2794a3d6424f3b25cde471342846f9876470 Mon Sep 17 00:00:00 2001
From: yatinkarel <ykarel@redhat.com>
Date: Mon, 17 Apr 2023 13:00:21 +0530
Subject: [PATCH 2129/2409] Fix name for neutron tempest uwsgi job

This was renamed long back in [1].

[1] https://review.opendev.org/c/openstack/neutron/+/797051

Change-Id: If11e975fd890f55f99efc2c7d8122256ff831ad8
---
 .zuul.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index fa7f180797..98f3353319 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -1047,7 +1047,7 @@
     # * neutron-functional-with-uwsgi: maintained by neutron for functional
     #    test. Next cycle we can remove this one if things turn out to be
     #    stable engouh with uwsgi.
-    # * neutron-tempest-with-uwsgi: maintained by neutron for tempest test.
+    # * neutron-ovn-tempest-with-uwsgi: maintained by neutron for tempest test.
     #    Next cycle we can remove this if everything run out stable enough.
     # * nova-multi-cell: maintained by nova and currently non-voting in the
     #    check queue for nova changes but relies on devstack configuration
@@ -1062,7 +1062,7 @@
         - nova-next
         - neutron-fullstack-with-uwsgi
         - neutron-functional-with-uwsgi
-        - neutron-tempest-with-uwsgi
+        - neutron-ovn-tempest-with-uwsgi
         - devstack-plugin-ceph-tempest-py3:
             irrelevant-files:
               - ^.*\.rst$

From e8915786e1e007742f47fee507b1b6288b6cedae Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihrachys@redhat.com>
Date: Wed, 19 Apr 2023 16:57:44 -0400
Subject: [PATCH 2130/2409] git: support git checkout for a commit hash

git_clone assumes a branch or a tag is passed as the last argument, and
it fails when a commit hash is passed, as in:

timeout -s SIGINT 0 git clone https://github.com/ovn-org/ovn.git
/opt/stack/ovn --branch 36e3ab9b47e93af0599a818e9d6b2930e49473f0
Cloning into '/opt/stack/ovn'...
fatal: Remote branch 36e3ab9b47e93af0599a818e9d6b2930e49473f0 not found
in upstream origin

Change-Id: Id1328d7cba418fa7c227ae9db4fe83c09fd06035
---
 functions-common | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/functions-common b/functions-common
index c7a1c6e0bf..d8b15024a8 100644
--- a/functions-common
+++ b/functions-common
@@ -609,8 +609,9 @@ function git_clone {
                 echo "the project to the \$PROJECTS variable in the job definition."
                 die $LINENO "ERROR_ON_CLONE is set to True so cloning not allowed in this configuration"
             fi
-            # '--branch' can also take tags
-            git_timed clone $git_clone_flags $git_remote $git_dest --branch $git_ref
+            git_timed clone $git_clone_flags $git_remote $git_dest
+            cd $git_dest
+            git checkout $git_ref
         elif [[ "$RECLONE" = "True" ]]; then
             # if it does exist then simulate what clone does if asked to RECLONE
             cd $git_dest

From b8f228620f6ad038ab8f31db861580f5e664a280 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ren=C3=A9=20Ribaud?= <rribaud@redhat.com>
Date: Mon, 24 Apr 2023 14:22:01 +0200
Subject: [PATCH 2131/2409] Add manila service to configuration

Manila is a service in OpenStack that enables shared filesystems. The
modifications add the manila section in nova configuration files
enabling the virtiofs feature.

Implements: blueprint libvirt-virtiofs-attach-manila-shares
Change-Id: Ia17c7a136cbe83efa1ef4e302d1c404034a50cda
---
 lib/nova | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/lib/nova b/lib/nova
index f34e823074..f5f002dd10 100644
--- a/lib/nova
+++ b/lib/nova
@@ -507,6 +507,10 @@ function create_nova_conf {
         configure_cinder_access
     fi
 
+    if is_service_enabled manila; then
+        configure_manila_access
+    fi
+
     if [ -n "$NOVA_STATE_PATH" ]; then
         iniset $NOVA_CONF DEFAULT state_path "$NOVA_STATE_PATH"
         iniset $NOVA_CONF oslo_concurrency lock_path "$NOVA_STATE_PATH"
@@ -652,6 +656,18 @@ function configure_cinder_access {
     fi
 }
 
+# Configure access to manila.
+function configure_manila_access {
+    iniset $NOVA_CONF manila os_region_name "$REGION_NAME"
+    iniset $NOVA_CONF manila auth_type "password"
+    iniset $NOVA_CONF manila auth_url "$KEYSTONE_SERVICE_URI"
+    iniset $NOVA_CONF manila username nova
+    iniset $NOVA_CONF manila password "$SERVICE_PASSWORD"
+    iniset $NOVA_CONF manila user_domain_name "$SERVICE_DOMAIN_NAME"
+    iniset $NOVA_CONF manila project_name "$SERVICE_TENANT_NAME"
+    iniset $NOVA_CONF manila project_domain_name "$SERVICE_DOMAIN_NAME"
+}
+
 function configure_console_compute {
     # If we are running multiple cells (and thus multiple console proxies) on a
     # single host, we offset the ports to avoid collisions.  We need to

From 6764eab2644b2f76769e4492ab136ff65763d2ef Mon Sep 17 00:00:00 2001
From: Brian Haley <haleyb.dev@gmail.com>
Date: Fri, 12 May 2023 16:34:08 -0400
Subject: [PATCH 2132/2409] Remove usage of neutron-debug since it has been
 removed

The neutron-debug command was deprecated and finally removed,
so tools/ping_neutron.sh can no longer rely on it to create
a probe namespace. Instead, just try and use any namespace
with the network ID in it, since it's either the DHCP (ML2/OVS)
or Metadata (OVN) namespace, which should work just as well.

As this code is rarely (never?) used, this best-effort attempt
is good enough.

Change-Id: I98c992a2a774ef1fb22cee2e90ee342ab2d537ac
Depends-on: https://review.opendev.org/c/openstack/neutron/+/883081
---
 lib/neutron           | 18 ------------------
 tools/ping_neutron.sh | 16 +++++++++++-----
 2 files changed, 11 insertions(+), 23 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 368a1b9c55..a6de7222db 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -1112,24 +1112,6 @@ function _neutron_setup_interface_driver {
 # Functions for Neutron Exercises
 #--------------------------------
 
-function delete_probe {
-    local from_net="$1"
-    net_id=`_get_net_id $from_net`
-    probe_id=`neutron-debug --os-tenant-name admin --os-username admin --os-password $ADMIN_PASSWORD probe-list -c id -c network_id | grep $net_id | awk '{print $2}'`
-    neutron-debug --os-tenant-name admin --os-username admin probe-delete $probe_id
-}
-
-function _get_net_id {
-    openstack --os-cloud devstack-admin --os-region-name="$REGION_NAME" --os-project-name admin --os-username admin --os-password $ADMIN_PASSWORD network list | grep $1 | awk '{print $2}'
-}
-
-function _get_probe_cmd_prefix {
-    local from_net="$1"
-    net_id=`_get_net_id $from_net`
-    probe_id=`neutron-debug --os-tenant-name admin --os-username admin --os-password $ADMIN_PASSWORD probe-list -c id -c network_id | grep $net_id | awk '{print $2}' | head -n 1`
-    echo "$Q_RR_COMMAND ip netns exec qprobe-$probe_id"
-}
-
 # ssh check
 function _ssh_check_neutron {
     local from_net=$1
diff --git a/tools/ping_neutron.sh b/tools/ping_neutron.sh
index 73fe3f3bdf..ab8e8dfca8 100755
--- a/tools/ping_neutron.sh
+++ b/tools/ping_neutron.sh
@@ -30,7 +30,8 @@ ping_neutron.sh <net_name> [ping args]
 
 This provides a wrapper to ping neutron guests that are on isolated
 tenant networks that the caller can't normally reach. It does so by
-creating a network namespace probe.
+using either the DHCP or Metadata network namespace to support both
+ML2/OVS and OVN.
 
 It takes arguments like ping, except the first arg must be the network
 name.
@@ -44,6 +45,12 @@ EOF
     exit 1
 }
 
+# BUG: with duplicate network names, this fails pretty hard since it
+# will just pick the first match.
+function _get_net_id {
+    openstack --os-cloud devstack-admin --os-region-name="$REGION_NAME" --os-project-name admin --os-username admin --os-password $ADMIN_PASSWORD network list | grep $1 | head -n 1 | awk '{print $2}'
+}
+
 NET_NAME=$1
 
 if [[ -z "$NET_NAME" ]]; then
@@ -53,12 +60,11 @@ fi
 
 REMAINING_ARGS="${@:2}"
 
-# BUG: with duplicate network names, this fails pretty hard.
-NET_ID=$(openstack network show -f value -c id "$NET_NAME")
-PROBE_ID=$(neutron-debug probe-list -c id -c network_id | grep "$NET_ID" | awk '{print $2}' | head -n 1)
+NET_ID=`_get_net_id $NET_NAME`
+NET_NS=$(ip netns list | grep "$NET_ID" | head -n 1)
 
 # This runs a command inside the specific netns
-NET_NS_CMD="ip netns exec qprobe-$PROBE_ID"
+NET_NS_CMD="ip netns exec $NET_NS"
 
 PING_CMD="sudo $NET_NS_CMD ping $REMAINING_ARGS"
 echo "Running $PING_CMD"

From bfa43975bca48bb021fb266a206885c5b09f5f45 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Thu, 18 May 2023 12:54:19 -0500
Subject: [PATCH 2133/2409] Enable NOVA_ENFORCE_SCOPE to True by default

Nova antelope release has enabled the RBAC new defaults
by default
- https://review.opendev.org/c/openstack/nova/+/866218

With the latest release of Nova have new defaults enable,
we should test the same by default in devstack. This change
make NOVA_ENFORCE_SCOPE flag to True by default so that every
job will run with Nova new defaults.

As old defaults are still supported (in deprecated way), we will keep
NOVA_ENFORCE_SCOPE flag so that we can have a single job can disable
the new defaults and continue testing the old defaults.

Change-Id: Id56819f03c19a5b7fe30adf799ecd3b8aeb67695
---
 lib/nova | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/nova b/lib/nova
index f34e823074..21067f302b 100644
--- a/lib/nova
+++ b/lib/nova
@@ -98,10 +98,10 @@ METADATA_SERVICE_PORT=${METADATA_SERVICE_PORT:-8775}
 NOVA_ENABLE_CACHE=${NOVA_ENABLE_CACHE:-True}
 
 # Flag to set the oslo_policy.enforce_scope and oslo_policy.enforce_new_defaults.
-# This is used to switch the compute API policies enable the scope and new defaults.
-# By Default, these flag are False.
+# This is used to disable the compute API policies scope and new defaults.
+# By Default, it is True.
 # For more detail: https://docs.openstack.org/oslo.policy/latest/configuration/index.html#oslo_policy.enforce_scope
-NOVA_ENFORCE_SCOPE=$(trueorfalse False NOVA_ENFORCE_SCOPE)
+NOVA_ENFORCE_SCOPE=$(trueorfalse True NOVA_ENFORCE_SCOPE)
 
 if [[ $SERVICE_IP_VERSION == 6 ]]; then
     NOVA_MY_IP="$HOST_IPV6"

From cb1ec1834de0b1eaddb02b7847b21d1d617efb6e Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Thu, 18 May 2023 19:58:41 -0500
Subject: [PATCH 2134/2409] Enable GLANCE_ENFORCE_SCOPE to True by default

Glance antelope release has enabled the RBAC new defaults
by default
- https://review.opendev.org/c/openstack/glance/+/872522

With the latest release of Glance have new defaults enable,
we should test the same by default in devstack. This change
make GLANCE_ENFORCE_SCOPE flag to True by default so that every
job will run with Glance new defaults.

As old defaults are still supported (in deprecated way), we will keep
GLANCE_ENFORCE_SCOPE flag so that we can have a single job can disable
the new defaults and continue testing the old defaults.

Depends-On: https://review.opendev.org/c/openstack/tempest/+/883701

Change-Id: Idde6f3cb766597575ca822f21b4bb3a465e5e753
---
 lib/glance | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/glance b/lib/glance
index 5aeae16c61..430d94d3a4 100644
--- a/lib/glance
+++ b/lib/glance
@@ -95,10 +95,10 @@ GLANCE_USE_IMPORT_WORKFLOW=$(trueorfalse False GLANCE_USE_IMPORT_WORKFLOW)
 GLANCE_ENABLE_QUOTAS=$(trueorfalse True GLANCE_ENABLE_QUOTAS)
 
 # Flag to set the oslo_policy.enforce_scope. This is used to switch
-# the Image API policies to start checking the scope of token. By Default,
-# this flag is False.
+# This is used to disable the Image API policies scope and new defaults.
+# By Default, it is True.
 # For more detail: https://docs.openstack.org/oslo.policy/latest/configuration/index.html#oslo_policy.enforce_scope
-GLANCE_ENFORCE_SCOPE=$(trueorfalse False GLANCE_ENFORCE_SCOPE)
+GLANCE_ENFORCE_SCOPE=$(trueorfalse True GLANCE_ENFORCE_SCOPE)
 
 GLANCE_CONF_DIR=${GLANCE_CONF_DIR:-/etc/glance}
 GLANCE_METADEF_DIR=$GLANCE_CONF_DIR/metadefs

From a2943894031e5b1c7662512d54ffb75a3cd3ca9d Mon Sep 17 00:00:00 2001
From: Martin Kopec <mkopec@redhat.com>
Date: Tue, 25 Apr 2023 21:50:31 +0200
Subject: [PATCH 2135/2409] Set dhcp_client based on cirros version

This change allows us to bump the default cirros version
in devstack. Since cirros version 0.6.0 dhcpcd is the default
dhcp client. The older cirros images used udhcpc client (the only
available client at that time) which is also the default client
in Tempest.
This patch makes devstack configure dhcpcd client in tempest.conf
if cirros >= 0.6.0 is going to be used in scenario tests.

The commit also introduces a new SCENARIO_IMAGE_TYPE option.
It is now a trigger for cirros specific settings, later it might
be used for any other image's settings.

Closes-Bug: #2007973
Change-Id: I2738c3b1d302c6656ce2c209671ea954fbc1b05b
---
 lib/tempest | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index 7da9f17052..9fa989a2f6 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -517,8 +517,19 @@ function configure_tempest {
     # Scenario
     SCENARIO_IMAGE_DIR=${SCENARIO_IMAGE_DIR:-$FILES}
     SCENARIO_IMAGE_FILE=$DEFAULT_IMAGE_FILE_NAME
+    SCENARIO_IMAGE_TYPE=${SCENARIO_IMAGE_TYPE:-cirros}
     iniset $TEMPEST_CONFIG scenario img_file $SCENARIO_IMAGE_DIR/$SCENARIO_IMAGE_FILE
 
+    # since version 0.6.0 cirros uses dhcpcd dhcp client by default, however, cirros, prior to the
+    # version 0.6.0, used udhcpc (the only available client at that time) which is also tempest's default
+    if [[ "$SCENARIO_IMAGE_TYPE" == "cirros" ]]; then
+        # the image is a cirros image
+        # use dhcpcd client when version greater or equal 0.6.0
+        if [[ $(echo $CIRROS_VERSION | tr -d '.') -ge 060 ]]; then
+            iniset $TEMPEST_CONFIG scenario dhcp_client dhcpcd
+        fi
+    fi
+
     # If using provider networking, use the physical network for validation rather than private
     TEMPEST_SSH_NETWORK_NAME=$PRIVATE_NETWORK_NAME
     if is_provider_network; then

From b5f4b1148a3f646a82a759f1dde3da1f74eb803c Mon Sep 17 00:00:00 2001
From: Martin Kopec <mkopec@redhat.com>
Date: Tue, 25 Apr 2023 20:01:42 +0000
Subject: [PATCH 2136/2409] Revert "Revert "Bump cirros version to 0.6.1""

This reverts commit 37d11d00e56ec6ff402a13a28ec308c13291a937.

Reason for revert: reverting this revert as the issue caused by the original patch (before the first revert) is fixed by:
https://review.opendev.org/c/openstack/devstack/+/881504

Therefore we can proceed with the cirros version bump.

Change-Id: I43e2b04a0142c19fb1a79da5a33cc444149e18f1
---
 doc/source/guides/nova.rst |  2 +-
 stackrc                    | 15 +++++++--------
 2 files changed, 8 insertions(+), 9 deletions(-)

diff --git a/doc/source/guides/nova.rst b/doc/source/guides/nova.rst
index 5b427972c4..d0fb274c13 100644
--- a/doc/source/guides/nova.rst
+++ b/doc/source/guides/nova.rst
@@ -122,7 +122,7 @@ when creating the server, for example:
 .. code-block:: shell
 
   $ openstack --os-compute-api-version 2.37 server create --flavor cirros256 \
-      --image cirros-0.3.5-x86_64-disk --nic none --wait test-server
+      --image cirros-0.6.1-x86_64-disk --nic none --wait test-server
 
 .. note:: ``--os-compute-api-version`` greater than or equal to 2.37 is
           required to use ``--nic=none``.
diff --git a/stackrc b/stackrc
index b7ce238366..a17d88ecbd 100644
--- a/stackrc
+++ b/stackrc
@@ -662,20 +662,19 @@ esac
 #     If the file ends in .tar.gz, uncompress the tarball and and select the first
 #     .img file inside it as the image.  If present, use "*-vmlinuz*" as the kernel
 #     and "*-initrd*" as the ramdisk
-#     example: http://cloud-images.ubuntu.com/releases/precise/release/ubuntu-12.04-server-cloudimg-amd64.tar.gz
+#     example: https://cloud-images.ubuntu.com/releases/jammy/release/ubuntu-22.04-server-cloudimg-amd64.tar.gz
 #  * disk image (*.img,*.img.gz)
 #    if file ends in .img, then it will be uploaded and registered as a to
 #    glance as a disk image.  If it ends in .gz, it is uncompressed first.
 #    example:
-#      http://cloud-images.ubuntu.com/releases/precise/release/ubuntu-12.04-server-cloudimg-armel-disk1.img
-#      http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-rootfs.img.gz
+#      https://cloud-images.ubuntu.com/releases/jammy/release/ubuntu-22.04-server-cloudimg-amd64.img
+#      https://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-rootfs.img.gz
 #  * OpenVZ image:
 #    OpenVZ uses its own format of image, and does not support UEC style images
 
-#IMAGE_URLS="http://smoser.brickies.net/ubuntu/ttylinux-uec/ttylinux-uec-amd64-11.2_2.6.35-15_1.tar.gz" # old ttylinux-uec image
-#IMAGE_URLS="http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img" # cirros full disk image
+#IMAGE_URLS="https://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img" # cirros full disk image
 
-CIRROS_VERSION=${CIRROS_VERSION:-"0.5.2"}
+CIRROS_VERSION=${CIRROS_VERSION:-"0.6.1"}
 CIRROS_ARCH=${CIRROS_ARCH:-$(uname -m)}
 
 # Set default image based on ``VIRT_DRIVER`` and ``LIBVIRT_TYPE``, either of
@@ -692,11 +691,11 @@ if [[ "$DOWNLOAD_DEFAULT_IMAGES" == "True" ]]; then
                 lxc) # the cirros root disk in the uec tarball is empty, so it will not work for lxc
                     DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-rootfs}
                     DEFAULT_IMAGE_FILE_NAME=${DEFAULT_IMAGE_FILE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-rootfs.img.gz}
-                    IMAGE_URLS+="http://download.cirros-cloud.net/${CIRROS_VERSION}/${DEFAULT_IMAGE_FILE_NAME}";;
+                    IMAGE_URLS+="https://download.cirros-cloud.net/${CIRROS_VERSION}/${DEFAULT_IMAGE_FILE_NAME}";;
                 *) # otherwise, use the qcow image
                     DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk}
                     DEFAULT_IMAGE_FILE_NAME=${DEFAULT_IMAGE_FILE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img}
-                    IMAGE_URLS+="http://download.cirros-cloud.net/${CIRROS_VERSION}/${DEFAULT_IMAGE_FILE_NAME}";;
+                    IMAGE_URLS+="https://download.cirros-cloud.net/${CIRROS_VERSION}/${DEFAULT_IMAGE_FILE_NAME}";;
                 esac
             ;;
         vsphere)

From 814e659e32a919ea68c29451753aa49c993ce5ed Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Mon, 22 May 2023 10:25:38 -0700
Subject: [PATCH 2137/2409] Default MYSQL_REDUCE_MEMORY=True

We have lots of evidence that this is a net benefit, so enable it
by default instead of everyone having to opt-in.

Change-Id: I66fa1799ff5177c3667630a89e15c072a8bf975a
---
 .zuul.yaml | 3 ---
 stackrc    | 2 +-
 2 files changed, 1 insertion(+), 4 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 316e89ae32..9cad5d4084 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -696,9 +696,6 @@
     description: |
       Simple multinode test to verify multinode functionality on devstack side.
       This is not meant to be used as a parent job.
-    vars:
-      devstack_localrc:
-        MYSQL_REDUCE_MEMORY: true
 
 # NOTE(ianw) Platform tests have traditionally been non-voting because
 # we often have to rush things through devstack to stabilise the gate,
diff --git a/stackrc b/stackrc
index b7ce238366..672679e0b2 100644
--- a/stackrc
+++ b/stackrc
@@ -204,7 +204,7 @@ MYSQL_GATHER_PERFORMANCE=$(trueorfalse True MYSQL_GATHER_PERFORMANCE)
 # This can be used to reduce the amount of memory mysqld uses while running.
 # These are unscientifically determined, and could reduce performance or
 # cause other issues.
-MYSQL_REDUCE_MEMORY=$(trueorfalse False MYSQL_REDUCE_MEMORY)
+MYSQL_REDUCE_MEMORY=$(trueorfalse True MYSQL_REDUCE_MEMORY)
 
 # Set a timeout for git operations.  If git is still running when the
 # timeout expires, the command will be retried up to 3 times.  This is

From a37b6abc8ecab1a32593aecdf8f74d54f3c4adb1 Mon Sep 17 00:00:00 2001
From: Martin Kopec <mkopec@redhat.com>
Date: Fri, 26 May 2023 13:46:42 +0200
Subject: [PATCH 2138/2409] Resolve distutils deprecation warning

The distutils package is deprecated and slated for removal in
Python 3.12. Let's use shutil.which which is also recomended
by PEP 632: https://peps.python.org/pep-0632/#migration-advice

Closes-Bug: #2009229
Change-Id: Ibb2a9731449e765c4a56952a9f02679e9618778b
---
 tools/worlddump.py | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/tools/worlddump.py b/tools/worlddump.py
index e2921737db..aadd33b634 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -19,7 +19,6 @@
 
 import argparse
 import datetime
-from distutils import spawn
 import fnmatch
 import io
 import os
@@ -76,7 +75,7 @@ def _dump_cmd(cmd):
 
 
 def _find_cmd(cmd):
-    if not spawn.find_executable(cmd):
+    if not shutil.which(cmd):
         print("*** %s not found: skipping" % cmd)
         return False
     return True

From b2ad00cb66bd38ec6179d3bd1bf41556b966dc8c Mon Sep 17 00:00:00 2001
From: Alfredo Moralejo <amoralej@redhat.com>
Date: Wed, 24 May 2023 21:03:28 +0200
Subject: [PATCH 2139/2409] Use RDO official CloudSIG mirrors for C9S
 deployments

Instead of using RDO Trunk repo server, CentOS official mirrors provide
a most reliable infrastructure and supports EMS which is required when
enabling FIPS in C9S.

In order to install the rdo-release rpm from repo.fedoraproject.org,
which does not support EMS, I'm using a workaround to wget, which works
with non-EMS servers because it uses gnutls instead of openssl, and
install it locally with rpm.

This is also consistent to CentOS 8 implementatioin.

Closes-Bug: #2020661
Closes-Bug: #2020434
Change-Id: Icd99f467d47aaafaaf3ee8f2a3c4da08842cb672
---
 stack.sh | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index be3c9dda11..1d32ed8156 100755
--- a/stack.sh
+++ b/stack.sh
@@ -311,7 +311,22 @@ function _install_rdo {
             sudo dnf -y install https://rdoproject.org/repos/openstack-${rdo_release}/rdo-release-${rdo_release}.el8.rpm
         fi
     elif [[ $DISTRO == "rhel9" ]]; then
-        sudo curl -L -o /etc/yum.repos.d/delorean-deps.repo http://trunk.rdoproject.org/centos9-master/delorean-deps.repo
+        install_package wget
+        # We need to download rdo-release package using wget as installing with dnf from repo.fedoraproject.org fails in
+        # FIPS enabled systems after https://bugzilla.redhat.com/show_bug.cgi?id=2157951
+        # Until we can pull rdo-release from a server which supports EMS, this workaround is doing wget, which does
+        # not relies on openssl but on gnutls, and then install it locally using rpm
+        TEMPRDODIR=$(mktemp -d)
+        if [[ "$TARGET_BRANCH" == "master" ]]; then
+            # rdo-release.el9.rpm points to latest RDO release, use that for master
+            wget -P $TEMPRDODIR  https://rdoproject.org/repos/rdo-release.el9.rpm
+        else
+            # For stable branches use corresponding release rpm
+            rdo_release=$(echo $TARGET_BRANCH | sed "s|stable/||g")
+            wget -P $TEMPRDODIR https://rdoproject.org/repos/openstack-${rdo_release}/rdo-release-${rdo_release}.el9.rpm
+        fi
+        sudo rpm -ivh $TEMPRDODIR/rdo-release*rpm
+        rm -rf $TEMPRDODIR
     fi
     sudo dnf -y update
 }

From a13201646d7ca50d92c44b73ba3f20bbf0f3f1d3 Mon Sep 17 00:00:00 2001
From: Brian Haley <haleyb.dev@gmail.com>
Date: Tue, 30 May 2023 13:31:05 -0400
Subject: [PATCH 2140/2409] Install systemd-coredump on Debian-based distros

On Debian-based distros, the 'coredumpctl' command is
provided by the systemd-coredump package, which is not
installed by default. On failure, when "post" commands
are executed this error is seen:

  controller | /bin/bash: line 1: coredumpctl: command not found

Install it along with other libvirt packages to avoid
the error.

On Fedora distros it is in the systemd package, so the
problem is not seen since it is always installed.

Change-Id: I6012bd3240d68736a5db8ae49dc32098a086f320
---
 lib/nova_plugins/functions-libvirt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index 799230603c..ba2e98e304 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -69,7 +69,7 @@ function install_libvirt {
             $REQUIREMENTS_DIR/upper-constraints.txt -- libvirt-python
 
     if is_ubuntu; then
-        install_package qemu-system libvirt-clients libvirt-daemon-system libvirt-dev python3-libvirt
+        install_package qemu-system libvirt-clients libvirt-daemon-system libvirt-dev python3-libvirt systemd-coredump
         if is_arch "aarch64"; then
             install_package qemu-efi
         fi

From fbc1865dc4e5b84ebafaf1d30cffc582ae3f0c0f Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Wed, 7 Jun 2023 15:19:37 +0200
Subject: [PATCH 2141/2409] Drop Fedora support

Fedora 36 is EOL, also opendev is dropping support for Fedora images
completely since interest in running jobs on that platform is no longer
existing. CentOS 9 Stream has evolved as replacement platform for new
features.

Only drop the Zuul configuration and the tag in stack.sh for now plus
update some docs. Cleanup of the deployment code will be done in a
second step.

Change-Id: Ica483fde27346e3939b5fc0d7e0a6dfeae0e8d1e
---
 .zuul.yaml              | 33 ---------------------------------
 README.rst              |  8 ++++----
 doc/source/index.rst    |  6 +++---
 doc/source/overview.rst |  5 ++---
 stack.sh                |  4 ++--
 5 files changed, 11 insertions(+), 45 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 9cad5d4084..a7be67153b 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -78,16 +78,6 @@
         nodes:
           - controller
 
-- nodeset:
-    name: devstack-single-node-fedora-latest
-    nodes:
-      - name: controller
-        label: fedora-36
-    groups:
-      - name: tempest
-        nodes:
-          - controller
-
 - nodeset:
     name: devstack-single-node-debian-bullseye
     nodes:
@@ -854,23 +844,6 @@
       devstack_services:
         tls-proxy: false
 
-- job:
-    name: devstack-platform-fedora-latest
-    parent: tempest-full-py3
-    description: Fedora latest platform test
-    nodeset: devstack-single-node-fedora-latest
-    voting: false
-
-- job:
-    name: devstack-platform-fedora-latest-virt-preview
-    parent: tempest-full-py3
-    description: Fedora latest platform test using the virt-preview repo.
-    nodeset: devstack-single-node-fedora-latest
-    voting: false
-    vars:
-      devstack_localrc:
-        ENABLE_FEDORA_VIRT_PREVIEW_REPO: true
-
 - job:
     name: devstack-tox-base
     parent: devstack
@@ -944,7 +917,6 @@
         - devstack
         - devstack-ipv6
         - devstack-enforce-scope
-        - devstack-platform-fedora-latest
         - devstack-platform-centos-9-stream
         - devstack-platform-debian-bullseye
         - devstack-platform-rocky-blue-onyx
@@ -1048,10 +1020,6 @@
     #    Next cycle we can remove this if everything run out stable enough.
     # * nova-multi-cell: maintained by nova and currently non-voting in the
     #    check queue for nova changes but relies on devstack configuration
-    # * devstack-platform-fedora-latest-virt-preview: Maintained by lyarwood
-    #    for Nova to allow early testing of the latest versions of Libvirt and
-    #    QEMU. Should only graduate out of experimental if it ever moves into
-    #    the check queue for Nova.
 
     experimental:
       jobs:
@@ -1080,7 +1048,6 @@
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
-        - devstack-platform-fedora-latest-virt-preview
         - devstack-no-tls-proxy
     periodic:
       jobs:
diff --git a/README.rst b/README.rst
index f3a585a926..86b85da956 100644
--- a/README.rst
+++ b/README.rst
@@ -4,7 +4,7 @@ from git source trees.
 Goals
 =====
 
-* To quickly build dev OpenStack environments in a clean Ubuntu or Fedora
+* To quickly build dev OpenStack environments in a clean Ubuntu or RockyLinux
   environment
 * To describe working configurations of OpenStack (which code branches
   work together?  what do config files look like for those branches?)
@@ -28,9 +28,9 @@ Versions
 The DevStack master branch generally points to trunk versions of OpenStack
 components.  For older, stable versions, look for branches named
 stable/[release] in the DevStack repo.  For example, you can do the
-following to create a Pike OpenStack cloud::
+following to create a Zed OpenStack cloud::
 
-    git checkout stable/pike
+    git checkout stable/zed
     ./stack.sh
 
 You can also pick specific OpenStack project releases by setting the appropriate
@@ -55,7 +55,7 @@ When the script finishes executing, you should be able to access OpenStack
 endpoints, like so:
 
 * Horizon: http://myhost/
-* Keystone: http://myhost/identity/v2.0/
+* Keystone: http://myhost/identity/v3/
 
 We also provide an environment file that you can use to interact with your
 cloud via CLI::
diff --git a/doc/source/index.rst b/doc/source/index.rst
index ccd0fef330..a5a11e251b 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -37,8 +37,8 @@ Install Linux
 -------------
 
 Start with a clean and minimal install of a Linux system. DevStack
-attempts to support the two latest LTS releases of Ubuntu, the
-latest/current Fedora version, CentOS/RHEL/Rocky Linux 9 and openEuler.
+attempts to support the two latest LTS releases of Ubuntu,
+Rocky Linux 9 and openEuler.
 
 If you do not have a preference, Ubuntu 22.04 (Jammy) is the
 most tested, and will probably go the smoothest.
@@ -113,7 +113,7 @@ Start the install
 
    $ ./stack.sh
 
-This will take a 15 - 20 minutes, largely depending on the speed of
+This will take 15 - 30 minutes, largely depending on the speed of
 your internet connection. Many git trees and packages will be
 installed during this process.
 
diff --git a/doc/source/overview.rst b/doc/source/overview.rst
index a609333289..4384081769 100644
--- a/doc/source/overview.rst
+++ b/doc/source/overview.rst
@@ -23,13 +23,12 @@ strategy to include the latest Ubuntu release and the latest RHEL
 release.*
 
 -  Ubuntu: current LTS release plus current development release
--  Fedora: current release plus previous release
--  RHEL/CentOS: current major release
+-  RHEL/CentOS/RockyLinux: current major release
 -  Other OS platforms may continue to be included but the maintenance of
    those platforms shall not be assumed simply due to their presence.
    Having a listed point-of-contact for each additional OS will greatly
    increase its chance of being well-maintained.
--  Patches for Ubuntu and/or Fedora will not be held up due to
+-  Patches for Ubuntu and/or RockyLinux will not be held up due to
    side-effects on other OS platforms.
 
 Databases
diff --git a/stack.sh b/stack.sh
index 1d32ed8156..e9617eee78 100755
--- a/stack.sh
+++ b/stack.sh
@@ -12,7 +12,7 @@
 # a multi-node developer install.
 
 # To keep this script simple we assume you are running on a recent **Ubuntu**
-# (Bionic or newer), **Fedora** (F36 or newer), or **CentOS/RHEL**
+# (Bionic or newer) or **CentOS/RHEL/RockyLinux**
 # (7 or newer) machine. (It may work on other platforms but support for those
 # platforms is left to those who added them to DevStack.) It should work in
 # a VM or physical server. Additionally, we maintain a list of ``deb`` and
@@ -229,7 +229,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-SUPPORTED_DISTROS="bullseye|focal|jammy|f36|rhel8|rhel9|openEuler-22.03"
+SUPPORTED_DISTROS="bullseye|focal|jammy|rhel8|rhel9|openEuler-22.03"
 
 if [[ ! ${DISTRO} =~ $SUPPORTED_DISTROS ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"

From f1c5442becad6fcdfb16676e8bc99835d4a75b22 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Sat, 10 Jun 2023 03:07:59 +0000
Subject: [PATCH 2142/2409] Updated from generate-devstack-plugins-list

Change-Id: Icc3aa69d7bbfa217676402682454cd4b37fb6c29
---
 doc/source/plugin-registry.rst | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index b244ca5dd8..ec502ea252 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -69,10 +69,6 @@ openstack/networking-bagpipe             `https://opendev.org/openstack/networki
 openstack/networking-baremetal           `https://opendev.org/openstack/networking-baremetal <https://opendev.org/openstack/networking-baremetal>`__
 openstack/networking-bgpvpn              `https://opendev.org/openstack/networking-bgpvpn <https://opendev.org/openstack/networking-bgpvpn>`__
 openstack/networking-generic-switch      `https://opendev.org/openstack/networking-generic-switch <https://opendev.org/openstack/networking-generic-switch>`__
-openstack/networking-hyperv              `https://opendev.org/openstack/networking-hyperv <https://opendev.org/openstack/networking-hyperv>`__
-openstack/networking-odl                 `https://opendev.org/openstack/networking-odl <https://opendev.org/openstack/networking-odl>`__
-openstack/networking-powervm             `https://opendev.org/openstack/networking-powervm <https://opendev.org/openstack/networking-powervm>`__
-openstack/networking-sfc                 `https://opendev.org/openstack/networking-sfc <https://opendev.org/openstack/networking-sfc>`__
 openstack/neutron                        `https://opendev.org/openstack/neutron <https://opendev.org/openstack/neutron>`__
 openstack/neutron-dynamic-routing        `https://opendev.org/openstack/neutron-dynamic-routing <https://opendev.org/openstack/neutron-dynamic-routing>`__
 openstack/neutron-fwaas                  `https://opendev.org/openstack/neutron-fwaas <https://opendev.org/openstack/neutron-fwaas>`__

From 39228451b6542ff63f288affbda13897089eb16d Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Thu, 15 Jun 2023 10:46:51 +0200
Subject: [PATCH 2143/2409] Bump default cirros version to 0.6.2

Cirros has made a new release, including a newer kernel that should fix
some issues when using nested virtualization.

Related-Bug: 2023559
Change-Id: I63469371b13801094a3ee1baae6e343999fbefa5
---
 doc/source/guides/nova.rst | 2 +-
 stackrc                    | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/source/guides/nova.rst b/doc/source/guides/nova.rst
index d0fb274c13..705d427e68 100644
--- a/doc/source/guides/nova.rst
+++ b/doc/source/guides/nova.rst
@@ -122,7 +122,7 @@ when creating the server, for example:
 .. code-block:: shell
 
   $ openstack --os-compute-api-version 2.37 server create --flavor cirros256 \
-      --image cirros-0.6.1-x86_64-disk --nic none --wait test-server
+      --image cirros-0.6.2-x86_64-disk --nic none --wait test-server
 
 .. note:: ``--os-compute-api-version`` greater than or equal to 2.37 is
           required to use ``--nic=none``.
diff --git a/stackrc b/stackrc
index 8820c621e5..7160d0a390 100644
--- a/stackrc
+++ b/stackrc
@@ -674,7 +674,7 @@ esac
 
 #IMAGE_URLS="https://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img" # cirros full disk image
 
-CIRROS_VERSION=${CIRROS_VERSION:-"0.6.1"}
+CIRROS_VERSION=${CIRROS_VERSION:-"0.6.2"}
 CIRROS_ARCH=${CIRROS_ARCH:-$(uname -m)}
 
 # Set default image based on ``VIRT_DRIVER`` and ``LIBVIRT_TYPE``, either of

From 7288df34f8513caf6f3985c75855feb572f6b004 Mon Sep 17 00:00:00 2001
From: yatinkarel <ykarel@redhat.com>
Date: Fri, 16 Jun 2023 14:25:33 +0530
Subject: [PATCH 2144/2409] Add 10 second buffer for uwsgi service stop

Default for systemd TimeoutStopSec is 90 seconds
and that is same for default graceful shutdown of
uwsgi service(WORKER_TIMEOUT).

Due to the Related-Bug graceful stop attempt
fails and there is no room for force shutdown.
This patch reduces default for WORKER_TIMEOUT by
10 seconds so there is a buffer to force stop the
service.

Closes-Bug: #2020643
Related-Bug: #2015065
Change-Id: I6aacac94f9697088338b3d2f99d8eaa22c2be67b
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 8820c621e5..7465f54112 100644
--- a/stackrc
+++ b/stackrc
@@ -804,7 +804,7 @@ NOVA_READY_TIMEOUT=${NOVA_READY_TIMEOUT:-$SERVICE_TIMEOUT}
 SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT=${SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT:-5}
 
 # Service graceful shutdown timeout
-WORKER_TIMEOUT=${WORKER_TIMEOUT:-90}
+WORKER_TIMEOUT=${WORKER_TIMEOUT:-80}
 
 # Common Configuration
 # --------------------

From ad029c0e8b66d81889c80d4a68b4654dd169fecf Mon Sep 17 00:00:00 2001
From: Sean Mooney <work@seanmooney.info>
Date: Mon, 26 Jun 2023 10:57:49 +0100
Subject: [PATCH 2145/2409] The AZ filter is deprecated and planned for removal
 this cycle

To facilitate that this change removes it form the default filter
list. By default nova has used placement for AZs so this filter
has not been requried since xena.

Change-Id: Ie5e216dd8c2a7ecf43cc6954ec4f73d4d67b5b3b
---
 lib/nova | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index 21067f302b..abf4eee465 100644
--- a/lib/nova
+++ b/lib/nova
@@ -115,7 +115,7 @@ FORCE_CONFIG_DRIVE=${FORCE_CONFIG_DRIVE:-"False"}
 
 # The following NOVA_FILTERS contains SameHostFilter and DifferentHostFilter with
 # the default filters.
-NOVA_FILTERS="AvailabilityZoneFilter,ComputeFilter,ComputeCapabilitiesFilter,ImagePropertiesFilter,ServerGroupAntiAffinityFilter,ServerGroupAffinityFilter,SameHostFilter,DifferentHostFilter"
+NOVA_FILTERS="ComputeFilter,ComputeCapabilitiesFilter,ImagePropertiesFilter,ServerGroupAntiAffinityFilter,ServerGroupAffinityFilter,SameHostFilter,DifferentHostFilter"
 
 QEMU_CONF=/etc/libvirt/qemu.conf
 

From 4a1b2808af68ab50a15a9c16bfe217fac50bf309 Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Mon, 26 Jun 2023 12:23:58 +0200
Subject: [PATCH 2146/2409] Remove unused file

This was forgotten in [0]

[0] I20501fec140998b91c9ddfd84b7b10168624430a

Change-Id: Iacd86e3953f573a0fc38dc4898aafefccb3a9a79
---
 files/dnsmasq-for-baremetal-from-nova-network.conf | 3 ---
 1 file changed, 3 deletions(-)
 delete mode 100644 files/dnsmasq-for-baremetal-from-nova-network.conf

diff --git a/files/dnsmasq-for-baremetal-from-nova-network.conf b/files/dnsmasq-for-baremetal-from-nova-network.conf
deleted file mode 100644
index 66a375190e..0000000000
--- a/files/dnsmasq-for-baremetal-from-nova-network.conf
+++ /dev/null
@@ -1,3 +0,0 @@
-enable-tftp
-tftp-root=/tftpboot
-dhcp-boot=pxelinux.0

From 27568ea33460b9ea4635a7d0a0bb06d32654150b Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Tue, 27 Jun 2023 02:19:53 +0000
Subject: [PATCH 2147/2409] Updated from generate-devstack-plugins-list

Change-Id: I6fd6a718ce39d849342b30970ca39477ce285374
---
 doc/source/plugin-registry.rst | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index ec502ea252..f54fca92e6 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -69,6 +69,9 @@ openstack/networking-bagpipe             `https://opendev.org/openstack/networki
 openstack/networking-baremetal           `https://opendev.org/openstack/networking-baremetal <https://opendev.org/openstack/networking-baremetal>`__
 openstack/networking-bgpvpn              `https://opendev.org/openstack/networking-bgpvpn <https://opendev.org/openstack/networking-bgpvpn>`__
 openstack/networking-generic-switch      `https://opendev.org/openstack/networking-generic-switch <https://opendev.org/openstack/networking-generic-switch>`__
+openstack/networking-hyperv              `https://opendev.org/openstack/networking-hyperv <https://opendev.org/openstack/networking-hyperv>`__
+openstack/networking-powervm             `https://opendev.org/openstack/networking-powervm <https://opendev.org/openstack/networking-powervm>`__
+openstack/networking-sfc                 `https://opendev.org/openstack/networking-sfc <https://opendev.org/openstack/networking-sfc>`__
 openstack/neutron                        `https://opendev.org/openstack/neutron <https://opendev.org/openstack/neutron>`__
 openstack/neutron-dynamic-routing        `https://opendev.org/openstack/neutron-dynamic-routing <https://opendev.org/openstack/neutron-dynamic-routing>`__
 openstack/neutron-fwaas                  `https://opendev.org/openstack/neutron-fwaas <https://opendev.org/openstack/neutron-fwaas>`__

From e32715b2515fdae523a3d113a881f0a57fff9410 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Thu, 22 Jun 2023 21:10:31 -0500
Subject: [PATCH 2148/2409] Set two different image in tempest irespective of
 DEFAULT_IMAGE_NAME

In current logic to set two different image in Tempest in config
option image_ref and image_ref_alt, we consider if DEFAULT_IMAGE_NAME
is found in glance then set the same image in tempest for those
two config option. This means even we have two different image available
in glance, still we set same image in image_ref as well as image_ref_alt
and all the rebuild tests are rebuilt on the same image.

I could not find any reason why we set same image if DEFAULT_IMAGE_NAME
exist, below are the original change added this logic
- https://review.opendev.org/c/openstack/devstack/+/17553

We had a requirement of test to run on two different images
- https://review.opendev.org/c/openstack/tempest/+/831018

and for that we need to set DEFAULT_IMAGE_NAME to non exist image
name but that broke the Ironic which was reply on the valid name
in DEFAULT_IMAGE_NAME
- https://review.opendev.org/c/openstack/ironic/+/886790

As we do not have any reason not to set two different image
if DEFAULT_IMAGE_NAME is set, I am removing the condition of
DEFAULT_IMAGE_NAME from lib/tempest logic and always set two
different images if they are available.

Depends-On: https://review.opendev.org/c/openstack/tempest/+/886796

Change-Id: I9d215f48d4440f2fa6dcc0d222a10896caf01215
---
 lib/tempest | 21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 9fa989a2f6..4f72a6d174 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -149,11 +149,10 @@ function set_tempest_venv_constraints {
 # ramdisk and kernel images.  Takes 3 arguments, an array and two
 # variables.  The array will contain the list of active image UUIDs;
 # if an image with ``DEFAULT_IMAGE_NAME`` is found, its UUID will be
-# set as the value of *both* other parameters.
+# set as the value img_id ($2) parameters.
 function get_active_images {
     declare -n img_array=$1
     declare -n img_id=$2
-    declare -n img_id_alt=$3
 
     # start with a fresh array in case we are called multiple times
     img_array=()
@@ -161,7 +160,6 @@ function get_active_images {
     while read -r IMAGE_NAME IMAGE_UUID; do
         if [ "$IMAGE_NAME" = "$DEFAULT_IMAGE_NAME" ]; then
             img_id="$IMAGE_UUID"
-            img_id_alt="$IMAGE_UUID"
         fi
         img_array+=($IMAGE_UUID)
     done < <(openstack --os-cloud devstack-admin image list --property status=active | awk -F'|' '!/^(+--)|ID|aki|ari/ { print $3,$2 }')
@@ -170,13 +168,12 @@ function get_active_images {
 function poll_glance_images {
     declare -n image_array=$1
     declare -n image_id=$2
-    declare -n image_id_alt=$3
     local -i poll_count
 
     poll_count=$TEMPEST_GLANCE_IMPORT_POLL_LIMIT
     while (( poll_count-- > 0 )) ; do
         sleep $TEMPEST_GLANCE_IMPORT_POLL_INTERVAL
-        get_active_images image_array image_id image_id_alt
+        get_active_images image_array image_id
         if (( ${#image_array[*]} >= $TEMPEST_GLANCE_IMAGE_COUNT )) ; then
             return
         fi
@@ -228,7 +225,7 @@ function configure_tempest {
     declare -a images
 
     if is_service_enabled glance; then
-        get_active_images images image_uuid image_uuid_alt
+        get_active_images images image_uuid
 
         if (( ${#images[*]} < $TEMPEST_GLANCE_IMAGE_COUNT )); then
             # Glance image import is asynchronous and may be configured
@@ -236,7 +233,7 @@ function configure_tempest {
             # it's possible that this code is being executed before the
             # import has completed and there may be no active images yet.
             if [[ "$GLANCE_USE_IMPORT_WORKFLOW" == "True" ]]; then
-                poll_glance_images images image_uuid image_uuid_alt
+                poll_glance_images images image_uuid
                 if (( ${#images[*]} < $TEMPEST_GLANCE_IMAGE_COUNT )); then
                     echo "Only found ${#images[*]} image(s), was looking for $TEMPEST_GLANCE_IMAGE_COUNT"
                     exit 1
@@ -258,7 +255,15 @@ function configure_tempest {
             *)
                 if [ -z "$image_uuid" ]; then
                     image_uuid=${images[0]}
-                    image_uuid_alt=${images[1]}
+                    if [ -z "$image_uuid_alt" ]; then
+                        image_uuid_alt=${images[1]}
+                    fi
+                elif [ -z "$image_uuid_alt" ]; then
+                    for image in $images; do
+                        if [[ "$image" != "$image_uuid" ]]; then
+                            image_uuid_alt=$image
+                        fi
+                    done
                 fi
                 ;;
         esac

From 58c80b2424623096e4a1f7a901f424be0ce6cb3f Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Tue, 27 Jun 2023 12:16:32 -0700
Subject: [PATCH 2149/2409] nova: Bump timeout-per-gb for BFV rebuild ops

This increases the timeout we use to wait for cinder to perform a
volume reimage. Since devstack is often running on a single machine
with non-production IO performance, we should bump this limit to avoid
hitting it before the rebuild completes.

Change-Id: Ie2663b951acb0c1a65597a39e032948764e6ae6a
---
 lib/nova | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/nova b/lib/nova
index 21067f302b..e60b71c36d 100644
--- a/lib/nova
+++ b/lib/nova
@@ -1036,6 +1036,10 @@ function start_nova_compute {
     # by the compute process.
     configure_console_compute
 
+    # Set rebuild timeout longer for BFV instances because we likely have
+    # slower disk than expected. Default is 20s/GB
+    iniset $NOVA_CPU_CONF DEFAULT reimage_timeout_per_gb 60
+
     # Configure the OVSDB connection for os-vif
     if [ -n "$OVSDB_SERVER_LOCAL_HOST" ]; then
         iniset $NOVA_CPU_CONF os_vif_ovs ovsdb_connection "tcp:$OVSDB_SERVER_LOCAL_HOST:6640"

From 931b45defd07991890707b434638166800ec948a Mon Sep 17 00:00:00 2001
From: yatinkarel <ykarel@redhat.com>
Date: Wed, 19 Jul 2023 12:15:52 +0530
Subject: [PATCH 2150/2409] Handle more than 1 image while configuring tempest

[1] caused a regression causing failures when
more than 1 images are setup. Fixing it by correctly
using the array variable. Also add a break in the
for loop once if condition is met.

[1] https://review.opendev.org/c/openstack/devstack/+/886795

Closes-Bug: #2028123
Change-Id: I4f13c1239312bbcca8c65e875d65d03702161c18
---
 lib/tempest | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index 4f72a6d174..4ba101f218 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -259,9 +259,10 @@ function configure_tempest {
                         image_uuid_alt=${images[1]}
                     fi
                 elif [ -z "$image_uuid_alt" ]; then
-                    for image in $images; do
+                    for image in ${images[@]}; do
                         if [[ "$image" != "$image_uuid" ]]; then
                             image_uuid_alt=$image
+                            break
                         fi
                     done
                 fi

From e261bd809e81c01c153cdcdb50be47ed3c89c46a Mon Sep 17 00:00:00 2001
From: Brian Haley <haleyb.dev@gmail.com>
Date: Wed, 19 Jul 2023 16:04:12 -0400
Subject: [PATCH 2151/2409] Always set image_uuid_alt in configure_tempest()

When there is only a single image, configure_tempest()
needs to always set image_uuid_alt the same as image_uuid,
else it will fail trying to determine the size of the
flavor to use for it later in the function.

Introduced by [0], and subsequent change did not fix it.

[0] https://review.opendev.org/c/openstack/devstack/+/886795

Change-Id: Ibfe99ff732570dbd415772c5625f43e35b68c871
Related-bug: #2028123
---
 lib/tempest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index 4ba101f218..2f62f6ea62 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -249,8 +249,8 @@ function configure_tempest {
             1)
                 if [ -z "$image_uuid" ]; then
                     image_uuid=${images[0]}
-                    image_uuid_alt=${images[0]}
                 fi
+                image_uuid_alt=$image_uuid
                 ;;
             *)
                 if [ -z "$image_uuid" ]; then

From 770352beb05f63fb9192ad488b6b8344fd57c985 Mon Sep 17 00:00:00 2001
From: jskunda <jskunda@redhat.com>
Date: Tue, 18 Jul 2023 09:32:05 +0200
Subject: [PATCH 2152/2409] git: git checkout for a commit hash combinated with
 depth argument

This patch: https://review.opendev.org/c/openstack/devstack/+/882299
provides functionality, that commit hash can be passed as last arugment,
however when GIT_DEPTH is set, it fails, as in:

timeout -s SIGINT 0 git clone https://github.com/ovn-org/ovn.git ./ovn
--depth 1 --branch 03b95a4566a15f7544f4cdf35629dacede4dcf55
fatal: Remote branch 03b95a4566a15f7544f4cdf35629dacede4dcf55
not found in upstream origin

Closes-Bug: #2023020
Change-Id: I748354964a133e028e12458cc9014d6d014cbdb9
---
 functions-common | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/functions-common b/functions-common
index 63144d6ed7..a668d55b8d 100644
--- a/functions-common
+++ b/functions-common
@@ -609,9 +609,10 @@ function git_clone {
                 echo "the project to the \$PROJECTS variable in the job definition."
                 die $LINENO "ERROR_ON_CLONE is set to True so cloning not allowed in this configuration"
             fi
-            git_timed clone $git_clone_flags $git_remote $git_dest
+            git_timed clone --no-checkout $git_clone_flags $git_remote $git_dest
             cd $git_dest
-            git checkout $git_ref
+            git_timed fetch $git_clone_flags origin $git_ref
+            git_timed checkout FETCH_HEAD
         elif [[ "$RECLONE" = "True" ]]; then
             # if it does exist then simulate what clone does if asked to RECLONE
             cd $git_dest

From d115bfd72a61f23bba0eb5d2d82c2ad94eac15e2 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Mon, 31 Jul 2023 07:04:34 -0700
Subject: [PATCH 2153/2409] Reduce the flush frequency of dbcounter plugin

This relaxes the limits for dbcounter to make it flush stats to the
database less often. Currently every thirty seconds or 100 hits, we
write a stats line to the database. In some services (like keystone)
this can trigger more than one write per second because of the
massive number of SELECT calls that service makes.

This removes the hit limit and decreases the mandatory flush interval
to once a minute. Hopefully this will manifest as lower load on the
database triggered by what would be readonly operations.

Change-Id: I43a58532c0541075a2d36408abc50a41f7994bda
---
 tools/dbcounter/dbcounter.py | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/tools/dbcounter/dbcounter.py b/tools/dbcounter/dbcounter.py
index 0ed7bb813a..86e5529c97 100644
--- a/tools/dbcounter/dbcounter.py
+++ b/tools/dbcounter/dbcounter.py
@@ -96,20 +96,18 @@ def stat_writer(self):
         This reads "hists" from from a queue fed by _log_event() and
         writes (db,op)+=count stats to the database after ten seconds
         of no activity to avoid triggering a write for every SELECT
-        call. Write no less often than every thirty seconds and/or 100
-        pending hits to avoid being starved by constant activity.
+        call. Write no less often than every sixty seconds to avoid being
+        starved by constant activity.
         """
         LOG.debug('[%i] Writer thread running' % os.getpid())
         while True:
             to_write = {}
-            total = 0
             last = time.time()
-            while time.time() - last < 30 and total < 100:
+            while time.time() - last < 60:
                 try:
                     item = self.queue.get(timeout=10)
                     to_write.setdefault(item, 0)
                     to_write[item] += 1
-                    total += 1
                 except queue.Empty:
                     break
 

From 7a2021dfa01368a69e1e43785419ac68b62a9b5f Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Wed, 7 Jun 2023 15:30:02 +0200
Subject: [PATCH 2154/2409] Add rocky job to gate

It was made voting some time ago, but we missed also running it in gate.

With that RHEL platform test in place, we can keep c9s permanently
non-voting, which is better suited to match its instability.

Change-Id: I6712ac6dc64e4fe2203b2a5f6a381f6d2150ba0f
---
 .zuul.yaml | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index a7be67153b..948a9af8ca 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -697,8 +697,6 @@
     description: CentOS 9 Stream platform test
     nodeset: devstack-single-node-centos-9-stream
     timeout: 9000
-    # TODO(kopecmartin) n-v until the following is resolved:
-    # https://bugs.launchpad.net/neutron/+bug/1979047
     voting: false
 
 - job:
@@ -968,11 +966,9 @@
       jobs:
         - devstack
         - devstack-ipv6
-        # TODO(kopecmartin) n-v until the following is resolved:
-        # https://bugs.launchpad.net/neutron/+bug/1979047
-        # - devstack-platform-centos-9-stream
         - devstack-platform-debian-bullseye
         - devstack-platform-ubuntu-focal
+        - devstack-platform-rocky-blue-onyx
         - devstack-enforce-scope
         - devstack-multinode
         - devstack-unit-tests

From a40f9cb91fbedddec89f0ffd6c7dd4b3828a232e Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Wed, 4 Apr 2018 14:02:30 -0700
Subject: [PATCH 2155/2409] Add option to install everything in global venvs

Since we are python3 only for openstack we create a single python3
virtualenv to install all the packages into. This gives us the benefits
of installing into a virtualenv while still ensuring coinstallability.
This is a major change and will likely break many things.

There are several reasons for this. The change that started this effort
was pip stopped uninstalling packages which used distutils to generate
their package installation. Many distro packages do this which meant
that pip installed packages and distro packages could not coexist in the
global install space. More recently git has made pip installing repos as
root more difficult due to file ownership concerns.

Currently the switch to the global venv is optional, but if we go down
this path we should very quickly remove the old global installation
method as it has only caused us problems.

Major hurdles we have to get over are convincing rootwrap to trust
binaries in the virtualenvs (so you'll notice we update rootwrap
configs).

Some distros still have issues, keep them using the old setup for now.

Depends-On: https://review.opendev.org/c/openstack/grenade/+/880266
Co-Authored-By: Dr. Jens Harbott <frickler@offenerstapel.de>
Change-Id: If9bc7ba45522189d03f19b86cb681bb150ee2f25
---
 .zuul.yaml                    |  8 ++++++++
 files/apache-horizon.template |  1 +
 functions-common              |  5 +++++
 inc/python                    | 34 +++++++++++++++++++++++++++++++---
 inc/rootwrap                  |  5 +++++
 lib/glance                    |  3 +++
 lib/horizon                   |  6 ++++++
 lib/tls                       |  7 +++++--
 stack.sh                      | 12 ++++++++++++
 stackrc                       |  8 ++++++++
 tools/install_prereqs.sh      |  2 ++
 tools/memory_tracker.sh       |  7 ++++++-
 12 files changed, 92 insertions(+), 6 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index a7be67153b..803db3a3fa 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -700,6 +700,9 @@
     # TODO(kopecmartin) n-v until the following is resolved:
     # https://bugs.launchpad.net/neutron/+bug/1979047
     voting: false
+    vars:
+      devstack_localrc:
+        GLOBAL_VENV: false
 
 - job:
     name: devstack-platform-debian-bullseye
@@ -709,6 +712,9 @@
     timeout: 9000
     vars:
       configure_swap_size: 4096
+      devstack_localrc:
+        # TODO(frickler): drop this once wheel build is fixed
+        MYSQL_GATHER_PERFORMANCE: false
 
 - job:
     name: devstack-platform-rocky-blue-onyx
@@ -718,6 +724,8 @@
     timeout: 9000
     vars:
       configure_swap_size: 4096
+      devstack_localrc:
+        GLOBAL_VENV: false
 
 - job:
     name: devstack-platform-ubuntu-focal
diff --git a/files/apache-horizon.template b/files/apache-horizon.template
index efcfc0360b..da7a7d26c3 100644
--- a/files/apache-horizon.template
+++ b/files/apache-horizon.template
@@ -39,4 +39,5 @@
     CustomLog /var/log/%APACHE_NAME%/horizon_access.log combined
 </VirtualHost>
 
+%WSGIPYTHONHOME%
 WSGISocketPrefix /var/run/%APACHE_NAME%
diff --git a/functions-common b/functions-common
index 5e1aa34279..f752271976 100644
--- a/functions-common
+++ b/functions-common
@@ -1522,6 +1522,7 @@ function write_user_unit_file {
     mkdir -p $SYSTEMD_DIR
 
     iniset -sudo $unitfile "Unit" "Description" "Devstack $service"
+    iniset -sudo $unitfile "Service" "Environment" "\"PATH=$PATH\""
     iniset -sudo $unitfile "Service" "User" "$user"
     iniset -sudo $unitfile "Service" "ExecStart" "$command"
     iniset -sudo $unitfile "Service" "KillMode" "process"
@@ -1549,6 +1550,7 @@ function write_uwsgi_user_unit_file {
     mkdir -p $SYSTEMD_DIR
 
     iniset -sudo $unitfile "Unit" "Description" "Devstack $service"
+    iniset -sudo $unitfile "Service" "Environment" "\"PATH=$PATH\""
     iniset -sudo $unitfile "Service" "SyslogIdentifier" "$service"
     iniset -sudo $unitfile "Service" "User" "$user"
     iniset -sudo $unitfile "Service" "ExecStart" "$command"
@@ -1614,6 +1616,9 @@ function _run_under_systemd {
     fi
     local env_vars="$5"
     if [[ "$command" =~ "uwsgi" ]] ; then
+        if [[ "$GLOBAL_VENV" == "True" ]] ; then
+            cmd="$cmd --venv $DEVSTACK_VENV"
+        fi
         write_uwsgi_user_unit_file $systemd_service "$cmd" "$group" "$user" "$env_vars"
     else
         write_user_unit_file $systemd_service "$cmd" "$group" "$user" "$env_vars"
diff --git a/inc/python b/inc/python
index a24f4e910a..cc6e01fede 100644
--- a/inc/python
+++ b/inc/python
@@ -32,6 +32,23 @@ function join_extras {
 # Python Functions
 # ================
 
+# Setup the global devstack virtualenvs and the associated environment
+# updates.
+function setup_devstack_virtualenv {
+    # We run devstack out of a global virtualenv.
+    if [[ ! -d $DEVSTACK_VENV ]] ; then
+        # Using system site packages to enable nova to use libguestfs.
+        # This package is currently installed via the distro and not
+        # available on pypi.
+        python$PYTHON3_VERSION -m venv --system-site-packages $DEVSTACK_VENV
+        pip_install -U pip
+    fi
+    if [[ ":$PATH:" != *":$DEVSTACK_VENV/bin:"* ]] ; then
+        export PATH="$DEVSTACK_VENV/bin:$PATH"
+        export PYTHON="$DEVSTACK_VENV/bin/python3"
+    fi
+}
+
 # Get the path to the pip command.
 # get_pip_command
 function get_pip_command {
@@ -60,8 +77,11 @@ function get_python_exec_prefix {
     fi
     $xtrace
 
-    local PYTHON_PATH=/usr/local/bin
-    echo $PYTHON_PATH
+    if [[ "$GLOBAL_VENV" == "True" ]] ; then
+        echo "$DEVSTACK_VENV/bin"
+    else
+        echo "/usr/local/bin"
+    fi
 }
 
 # Wrapper for ``pip install`` that only installs versions of libraries
@@ -166,6 +186,14 @@ function pip_install {
     if [[ -n ${PIP_VIRTUAL_ENV:=} && -d ${PIP_VIRTUAL_ENV} ]]; then
         local cmd_pip=$PIP_VIRTUAL_ENV/bin/pip
         local sudo_pip="env"
+    elif [[ "${GLOBAL_VENV}" == "True" && -d ${DEVSTACK_VENV} ]] ; then
+        # We have to check that the DEVSTACK_VENV exists because early
+        # devstack boostrapping needs to operate in a system context
+        # too bootstrap pip. Once pip is bootstrapped we create the
+        # global venv and can start to use it.
+        local cmd_pip=$DEVSTACK_VENV/bin/pip
+        local sudo_pip="env"
+        echo "Using python $PYTHON3_VERSION to install $package_dir"
     else
         local cmd_pip="python$PYTHON3_VERSION -m pip"
         # See
@@ -439,7 +467,7 @@ function setup_package {
 
     pip_install $flags "$project_dir$extras"
     # ensure that further actions can do things like setup.py sdist
-    if [[ "$flags" == "-e" ]]; then
+    if [[ "$flags" == "-e" && "$GLOBAL_VENV" == "False" ]]; then
         safe_chown -R $STACK_USER $1/*.egg-info
     fi
 }
diff --git a/inc/rootwrap b/inc/rootwrap
index 2a6e4b648f..4c65440a4e 100644
--- a/inc/rootwrap
+++ b/inc/rootwrap
@@ -60,6 +60,11 @@ function configure_rootwrap {
     sudo install -o root -g root -m 644 $rootwrap_conf_src_dir/rootwrap.conf /etc/${project}/rootwrap.conf
     sudo sed -e "s:^filters_path=.*$:filters_path=/etc/${project}/rootwrap.d:" -i /etc/${project}/rootwrap.conf
 
+    # Rely on $PATH set by devstack to determine what is safe to execute
+    # by rootwrap rather than use explicit whitelist of paths in
+    # rootwrap.conf
+    sudo sed -e 's/^exec_dirs=.*/#&/' -i /etc/${project}/rootwrap.conf
+
     # Set up the rootwrap sudoers
     local tempfile
     tempfile=$(mktemp)
diff --git a/lib/glance b/lib/glance
index 430d94d3a4..e64f00027e 100644
--- a/lib/glance
+++ b/lib/glance
@@ -47,6 +47,9 @@ USE_CINDER_FOR_GLANCE=$(trueorfalse False USE_CINDER_FOR_GLANCE)
 # from CINDER_ENABLED_BACKENDS
 GLANCE_CINDER_DEFAULT_BACKEND=${GLANCE_CINDER_DEFAULT_BACKEND:-lvmdriver-1}
 GLANCE_STORE_ROOTWRAP_BASE_DIR=/usr/local/etc/glance
+if [[ "$GLOBAL_VENV" == "True" ]] ; then
+    GLANCE_STORE_ROOTWRAP_BASE_DIR=${DEVSTACK_VENV}/etc/glance
+fi
 # When Cinder is used as a glance store, you can optionally configure cinder to
 # optimize bootable volume creation by allowing volumes to be cloned directly
 # in the backend instead of transferring data via Glance.  To use this feature,
diff --git a/lib/horizon b/lib/horizon
index f76f9e557d..611329d619 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -115,6 +115,11 @@ function configure_horizon {
     local horizon_conf
     horizon_conf=$(apache_site_config_for horizon)
 
+    local wsgi_venv_config=""
+    if [[ "$GLOBAL_VENV" == "True" ]] ; then
+        wsgi_venv_config="WSGIPythonHome $DEVSTACK_VENV"
+    fi
+
     # Configure apache to run horizon
     # Set up the django horizon application to serve via apache/wsgi
     sudo sh -c "sed -e \"
@@ -124,6 +129,7 @@ function configure_horizon {
         s,%APACHE_NAME%,$APACHE_NAME,g;
         s,%DEST%,$DEST,g;
         s,%WEBROOT%,$HORIZON_APACHE_ROOT,g;
+        s,%WSGIPYTHONHOME%,$wsgi_venv_config,g;
     \" $FILES/apache-horizon.template >$horizon_conf"
 
     if is_ubuntu; then
diff --git a/lib/tls b/lib/tls
index a1e162d2e2..d35e9e2cee 100644
--- a/lib/tls
+++ b/lib/tls
@@ -364,8 +364,11 @@ function deploy_int_CA {
 function fix_system_ca_bundle_path {
     if is_service_enabled tls-proxy; then
         local capath
-        capath=$(python3 -c $'try:\n from requests import certs\n print (certs.where())\nexcept ImportError: pass')
-
+        if [[ "$GLOBAL_VENV" == "True" ]] ; then
+            capath=$($DEVSTACK_VENV/bin/python3 -c $'try:\n from requests import certs\n print (certs.where())\nexcept ImportError: pass')
+        else
+            capath=$(python3 -c $'try:\n from requests import certs\n print (certs.where())\nexcept ImportError: pass')
+        fi
         if [[ ! $capath == "" && ! $capath =~ ^/etc/.* && ! -L $capath ]]; then
             if is_fedora; then
                 sudo rm -f $capath
diff --git a/stack.sh b/stack.sh
index ad88eab9d5..c8f7c9d79e 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
 
+
 # ``stack.sh`` is an opinionated OpenStack developer installation.  It
 # installs and configures various combinations of **Cinder**, **Glance**,
 # **Horizon**, **Keystone**, **Nova**, **Neutron**, and **Swift**
@@ -824,6 +825,17 @@ fi
 source $TOP_DIR/tools/fixup_stuff.sh
 fixup_all
 
+if [[ "$GLOBAL_VENV" == "True" ]] ; then
+    # TODO(frickler): find a better solution for this
+    sudo ln -sf /opt/stack/data/venv/bin/privsep-helper /usr/local/bin
+    sudo ln -sf /opt/stack/data/venv/bin/cinder-rtstool /usr/local/bin
+    sudo ln -sf /opt/stack/data/venv/bin/openstack /usr/local/bin
+    sudo ln -sf /opt/stack/data/venv/bin/tox /usr/local/bin
+    sudo ln -sf /opt/stack/data/venv/bin/nova-manage /usr/local/bin
+
+    setup_devstack_virtualenv
+fi
+
 # Install subunit for the subunit output stream
 pip_install -U os-testr
 
diff --git a/stackrc b/stackrc
index dcc0ce45e0..0d1880cec9 100644
--- a/stackrc
+++ b/stackrc
@@ -183,6 +183,14 @@ IDENTITY_API_VERSION=3
 # each services ${SERVICE}_ENFORCE_SCOPE variables
 ENFORCE_SCOPE=$(trueorfalse False ENFORCE_SCOPE)
 
+# Devstack supports the use of a global virtualenv. These variables enable
+# and disable this functionality as well as set the path to the virtualenv.
+# Note that the DATA_DIR is selected because grenade testing uses a shared
+# DATA_DIR but different DEST dirs and we don't want two sets of venvs,
+# instead we want one global set.
+GLOBAL_VENV=$(trueorfalse True GLOBAL_VENV)
+DEVSTACK_VENV=${DEVSTACK_VENV:-$DATA_DIR/venv}
+
 # Enable use of Python virtual environments.  Individual project use of
 # venvs are controlled by the PROJECT_VENV array; every project with
 # an entry in the array will be installed into the named venv.
diff --git a/tools/install_prereqs.sh b/tools/install_prereqs.sh
index f2d57c8451..bb470b2927 100755
--- a/tools/install_prereqs.sh
+++ b/tools/install_prereqs.sh
@@ -79,6 +79,8 @@ if [[ -n "$SYSLOG" && "$SYSLOG" != "False" ]]; then
     fi
 fi
 
+# TODO(clarkb) remove these once we are switched to global venv by default
+export PYTHON=$(which python${PYTHON3_VERSION} 2>/dev/null || which python3 2>/dev/null)
 
 # Mark end of run
 # ---------------
diff --git a/tools/memory_tracker.sh b/tools/memory_tracker.sh
index 6c36534f01..2f404c26fb 100755
--- a/tools/memory_tracker.sh
+++ b/tools/memory_tracker.sh
@@ -14,7 +14,12 @@
 
 set -o errexit
 
-PYTHON=${PYTHON:-python3}
+# TODO(frickler): make this use stackrc variables
+if [ -x /opt/stack/data/venv/bin/python ]; then
+    PYTHON=/opt/stack/data/venv/bin/python
+else
+    PYTHON=${PYTHON:-python3}
+fi
 
 # time to sleep between checks
 SLEEP_TIME=20

From 0b79f6f7690773701a37921f626782e528fa9c36 Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Tue, 4 Jul 2023 07:18:01 +0200
Subject: [PATCH 2156/2409] Add debian-bookworm job

Change-Id: Id5e54775e2be38a75db0bd1f55d1d3b5ae7ef71f
---
 .zuul.yaml          | 24 ++++++++++++++++++++++++
 lib/databases/mysql |  5 +++--
 stack.sh            |  2 +-
 3 files changed, 28 insertions(+), 3 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 803db3a3fa..9cc95b607e 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -78,6 +78,16 @@
         nodes:
           - controller
 
+- nodeset:
+    name: devstack-single-node-debian-bookworm
+    nodes:
+      - name: controller
+        label: debian-bookworm
+    groups:
+      - name: tempest
+        nodes:
+          - controller
+
 - nodeset:
     name: devstack-single-node-debian-bullseye
     nodes:
@@ -704,6 +714,19 @@
       devstack_localrc:
         GLOBAL_VENV: false
 
+- job:
+    name: devstack-platform-debian-bookworm
+    parent: tempest-full-py3
+    description: Debian Bookworm platform test
+    nodeset: devstack-single-node-debian-bookworm
+    timeout: 9000
+    voting: false
+    vars:
+      configure_swap_size: 4096
+      devstack_localrc:
+        # TODO(frickler): drop this once wheel build is fixed
+        MYSQL_GATHER_PERFORMANCE: false
+
 - job:
     name: devstack-platform-debian-bullseye
     parent: tempest-full-py3
@@ -926,6 +949,7 @@
         - devstack-ipv6
         - devstack-enforce-scope
         - devstack-platform-centos-9-stream
+        - devstack-platform-debian-bookworm
         - devstack-platform-debian-bullseye
         - devstack-platform-rocky-blue-onyx
         - devstack-platform-ubuntu-focal
diff --git a/lib/databases/mysql b/lib/databases/mysql
index 27d1ec600f..e069e128e9 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -20,7 +20,7 @@ if [[ -z "$MYSQL_SERVICE_NAME" ]]; then
     MYSQL_SERVICE_NAME=mysql
     if is_fedora && ! is_oraclelinux; then
         MYSQL_SERVICE_NAME=mariadb
-    elif [[ "$DISTRO" == "bullseye" ]]; then
+    elif [[ "$DISTRO" =~ bookworm|bullseye ]]; then
         MYSQL_SERVICE_NAME=mariadb
     fi
 fi
@@ -122,7 +122,8 @@ function configure_database_mysql {
     # In mariadb e.g. on Ubuntu socket plugin is used for authentication
     # as root so it works only as sudo. To restore old "mysql like" behaviour,
     # we need to change auth plugin for root user
-    if is_ubuntu && [[ "$DISTRO" != "bullseye" ]] && [ "$MYSQL_SERVICE_NAME" == "mariadb" ]; then
+    # TODO(frickler): simplify this logic
+    if is_ubuntu && [[ ! "$DISTRO" =~ bookworm|bullseye ]] && [ "$MYSQL_SERVICE_NAME" == "mariadb" ]; then
         if [[ "$DISTRO" == "jammy" ]]; then
             # For Ubuntu 22.04 (jammy) we follow the model outlined in
             # https://mariadb.org/authentication-in-mariadb-10-4/
diff --git a/stack.sh b/stack.sh
index c8f7c9d79e..0434001b7a 100755
--- a/stack.sh
+++ b/stack.sh
@@ -230,7 +230,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-SUPPORTED_DISTROS="bullseye|focal|jammy|rhel8|rhel9|openEuler-22.03"
+SUPPORTED_DISTROS="bookworm|bullseye|focal|jammy|rhel8|rhel9|openEuler-22.03"
 
 if [[ ! ${DISTRO} =~ $SUPPORTED_DISTROS ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"

From 113689ee4694de20c019735fdace447225aa18f7 Mon Sep 17 00:00:00 2001
From: yatinkarel <ykarel@redhat.com>
Date: Wed, 2 Aug 2023 12:58:45 +0530
Subject: [PATCH 2157/2409] Woraround systemd issue on CentOS 9-stream

systemd-252-16.el9 introduced a regression
where libvirtd process exits after 120s of
inactivity.
Add a workaround to unset 120s timeout for
libvirtd, the workaround can be removed once
the fix is available in systemd rpm.

Related-Bug: #2029335
Change-Id: Id6db6c17518b54d5fef7c381c509066a569aff6d
---
 tools/fixup_stuff.sh | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index faea44f1e0..80a83bb128 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -94,6 +94,11 @@ EOF
     if [[ $os_VENDOR == "CentOSStream" && $os_RELEASE -eq 8 ]]; then
         sudo sysctl -w net.ipv4.ping_group_range='0 2147483647'
     fi
+    # TODO(ykarel): Workaround for systemd issue, remove once fix is
+    # included in systemd rpm https://bugs.launchpad.net/devstack/+bug/2029335
+    if [[ $os_VENDOR == "CentOSStream" && $os_RELEASE -eq 9 ]]; then
+        echo 'LIBVIRTD_ARGS=""' | sudo tee /etc/sysconfig/libvirtd
+    fi
 }
 
 function fixup_ovn_centos {

From 3832ff52b4445324b58a5da123ef4e3880df1591 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Thu, 3 Aug 2023 09:16:55 -0700
Subject: [PATCH 2158/2409] Add SERVICE_REPORT_INTERVAL knob

Heavily-loaded workers in CI consistently fail to complete the
service checkin task, which is configured for every ten seconds in
nova and cinder. This generates additional load on the database server
as well as consumes a threadpool worker. If we're not making the
deadline, there's really no point in having it be so high. Further,
since the workers must remain up for all the tempest tests we're
running against them, there's really no benefit to a fast-fail
detection.

This sets the report_interval to 120s for nova and cinder, and sets
service_down_time to 6x that value, which is consistent with the
default scale.

Depends-On: https://review.opendev.org/c/openstack/tempest/+/890448
Change-Id: Idd7aa1daf354256b143a3778f161cfc72b318ea5
---
 lib/cinder | 8 ++++++++
 lib/nova   | 8 ++++++++
 2 files changed, 16 insertions(+)

diff --git a/lib/cinder b/lib/cinder
index e37eff4019..f8682d5a71 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -76,6 +76,11 @@ CINDER_SERVICE_PORT_INT=${CINDER_SERVICE_PORT_INT:-18776}
 CINDER_SERVICE_PROTOCOL=${CINDER_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 CINDER_SERVICE_LISTEN_ADDRESS=${CINDER_SERVICE_LISTEN_ADDRESS:-$(ipv6_unquote $SERVICE_LISTEN_ADDRESS)}
 
+# We do not need to report service status every 10s for devstack-like
+# deployments. In the gate this generates extra work for the services and the
+# database which are already taxed.
+CINDER_SERVICE_REPORT_INTERVAL=120
+
 # What type of LVM device should Cinder use for LVM backend
 # Defaults to auto, which will do thin provisioning if it's a fresh
 # volume group, otherwise it will do thick. The other valid choices are
@@ -325,6 +330,9 @@ function configure_cinder {
     # details and example failures.
     iniset $CINDER_CONF DEFAULT rpc_response_timeout 120
 
+    iniset $CINDER_CONF DEFAULT report_interval $CINDER_SERVICE_REPORT_INTERVAL
+    iniset $CINDER_CONF DEFAULT service_down_time $(($CINDER_SERVICE_REPORT_INTERVAL * 6))
+
     if is_service_enabled c-vol && [[ -n "$CINDER_ENABLED_BACKENDS" ]]; then
         local enabled_backends=""
         local default_name=""
diff --git a/lib/nova b/lib/nova
index 888a2e2b25..905788f28f 100644
--- a/lib/nova
+++ b/lib/nova
@@ -75,6 +75,11 @@ NOVA_API_PASTE_INI=${NOVA_API_PASTE_INI:-$NOVA_CONF_DIR/api-paste.ini}
 # mean "use uwsgi" because we'll be always using uwsgi.
 NOVA_USE_MOD_WSGI=${NOVA_USE_MOD_WSGI:-True}
 
+# We do not need to report service status every 10s for devstack-like
+# deployments. In the gate this generates extra work for the services and the
+# database which are already taxed.
+NOVA_SERVICE_REPORT_INTERVAL=120
+
 if is_service_enabled tls-proxy; then
     NOVA_SERVICE_PROTOCOL="https"
 fi
@@ -448,6 +453,9 @@ function create_nova_conf {
 
     iniset $NOVA_CONF key_manager backend nova.keymgr.conf_key_mgr.ConfKeyManager
 
+    iniset $NOVA_CONF DEFAULT report_interval $NOVA_SERVICE_REPORT_INTERVAL
+    iniset $NOVA_CONF DEFAULT service_down_time $(($NOVA_SERVICE_REPORT_INTERVAL * 6))
+
     if is_fedora; then
         # nova defaults to /usr/local/bin, but fedora pip like to
         # install things in /usr/bin

From c3b0b9034e6b35187a125283e55056ae90cbbc4a Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Fri, 4 Aug 2023 06:41:30 -0700
Subject: [PATCH 2159/2409] Disable waiting forever for connpool workers

This will cause apache to no longer wait forever for a connection
pool member to become available before returning 503 to the client.
This may help us determine if some of the timeouts we see when
talking to the services come from an overloaded apache.

Change-Id: Ibc19fc9a53e2330f9aca45f5a10a59c576cb22e6
---
 lib/apache | 6 +++---
 lib/tls    | 4 +++-
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/lib/apache b/lib/apache
index 76eae9c057..cf7215bef2 100644
--- a/lib/apache
+++ b/lib/apache
@@ -290,7 +290,7 @@ function write_uwsgi_config {
         apache_conf=$(apache_site_config_for $name)
         iniset "$file" uwsgi socket "$socket"
         iniset "$file" uwsgi chmod-socket 666
-        echo "ProxyPass \"${url}\" \"unix:${socket}|uwsgi://uwsgi-uds-${name}\" retry=0 " | sudo tee -a $apache_conf
+        echo "ProxyPass \"${url}\" \"unix:${socket}|uwsgi://uwsgi-uds-${name}\" retry=0 acquire=1 " | sudo tee -a $apache_conf
         enable_apache_site $name
         restart_apache_server
     fi
@@ -351,7 +351,7 @@ function write_local_uwsgi_http_config {
     apache_conf=$(apache_site_config_for $name)
     echo "KeepAlive Off" | sudo tee $apache_conf
     echo "SetEnv proxy-sendchunked 1" | sudo tee -a $apache_conf
-    echo "ProxyPass \"${url}\" \"http://$APACHE_LOCAL_HOST:$port\" retry=0 " | sudo tee -a $apache_conf
+    echo "ProxyPass \"${url}\" \"http://$APACHE_LOCAL_HOST:$port\" retry=0 acquire=1 " | sudo tee -a $apache_conf
     enable_apache_site $name
     restart_apache_server
 }
@@ -370,7 +370,7 @@ function write_local_proxy_http_config {
 
     echo "KeepAlive Off" | sudo tee $apache_conf
     echo "SetEnv proxy-sendchunked 1" | sudo tee -a $apache_conf
-    echo "ProxyPass \"${loc}\" \"$url\" retry=0 " | sudo tee -a $apache_conf
+    echo "ProxyPass \"${loc}\" \"$url\" retry=0 acquire=1 " | sudo tee -a $apache_conf
     enable_apache_site $name
     restart_apache_server
 }
diff --git a/lib/tls b/lib/tls
index a1e162d2e2..48e5929a2b 100644
--- a/lib/tls
+++ b/lib/tls
@@ -541,9 +541,11 @@ $listen_string
 
     # Avoid races (at the cost of performance) to re-use a pooled connection
     # where the connection is closed (bug 1807518).
+    # Set acquire=1 to disable waiting for connection pool members so that
+    # we can determine when apache is overloaded (returns 503).
     SetEnv proxy-initial-not-pooled
     <Location />
-        ProxyPass http://$b_host:$b_port/ retry=0 nocanon
+        ProxyPass http://$b_host:$b_port/ retry=0 nocanon acquire=1
         ProxyPassReverse http://$b_host:$b_port/
     </Location>
     ErrorLog $APACHE_LOG_DIR/tls-proxy_error.log

From 0da88c4af096ab95ccf438960433bb113278181e Mon Sep 17 00:00:00 2001
From: Alfredo Moralejo <amoralej@redhat.com>
Date: Mon, 7 Aug 2023 14:13:41 +0200
Subject: [PATCH 2160/2409] Remove wget + rpm workaround to manage repos
 install in CentOS

RDO has moved rdo-release packages to a new infra which supports EMS so
we do not need to wget it and install it using local rpm install.

This partially reverts [1].

[1] https://review.opendev.org/c/openstack/devstack/+/884277/

Change-Id: I189d0c3da0e7b017e2568022c14e6c8fb28251f1
---
 stack.sh | 12 ++----------
 1 file changed, 2 insertions(+), 10 deletions(-)

diff --git a/stack.sh b/stack.sh
index ad88eab9d5..b03c3cda1f 100755
--- a/stack.sh
+++ b/stack.sh
@@ -311,22 +311,14 @@ function _install_rdo {
             sudo dnf -y install https://rdoproject.org/repos/openstack-${rdo_release}/rdo-release-${rdo_release}.el8.rpm
         fi
     elif [[ $DISTRO == "rhel9" ]]; then
-        install_package wget
-        # We need to download rdo-release package using wget as installing with dnf from repo.fedoraproject.org fails in
-        # FIPS enabled systems after https://bugzilla.redhat.com/show_bug.cgi?id=2157951
-        # Until we can pull rdo-release from a server which supports EMS, this workaround is doing wget, which does
-        # not relies on openssl but on gnutls, and then install it locally using rpm
-        TEMPRDODIR=$(mktemp -d)
         if [[ "$TARGET_BRANCH" == "master" ]]; then
             # rdo-release.el9.rpm points to latest RDO release, use that for master
-            wget -P $TEMPRDODIR  https://rdoproject.org/repos/rdo-release.el9.rpm
+            sudo dnf -y install https://rdoproject.org/repos/rdo-release.el9.rpm
         else
             # For stable branches use corresponding release rpm
             rdo_release=$(echo $TARGET_BRANCH | sed "s|stable/||g")
-            wget -P $TEMPRDODIR https://rdoproject.org/repos/openstack-${rdo_release}/rdo-release-${rdo_release}.el9.rpm
+            sudo dnf -y install https://rdoproject.org/repos/openstack-${rdo_release}/rdo-release-${rdo_release}.el9.rpm
         fi
-        sudo rpm -ivh $TEMPRDODIR/rdo-release*rpm
-        rm -rf $TEMPRDODIR
     fi
     sudo dnf -y update
 }

From 4363b0bd84aad8984ee148b3b4868b311e5d855b Mon Sep 17 00:00:00 2001
From: Brian Haley <haleyb.dev@gmail.com>
Date: Tue, 8 Aug 2023 08:38:00 -0400
Subject: [PATCH 2161/2409] Fix $LOGDIR owner to be stack.stack

I have seen this failure in the gate a few times:

[ERROR] /opt/stack/devstack/functions-common:2334 Neutron did not start
/opt/stack/devstack/functions-common: line 310:
  /opt/stack/logs/error.log: Permission denied

So whatever was trying to be written to error.log never
happened. Change to be like other directories in this
file and make the $LOGDIR owner stack.stack.

Change-Id: I673011aba10c8d03234100503ccc5876e75baff2
---
 stack.sh | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index ad88eab9d5..e0caafafa6 100755
--- a/stack.sh
+++ b/stack.sh
@@ -349,7 +349,9 @@ fi
 
 # Destination path for devstack logs
 if [[ -n ${LOGDIR:-} ]]; then
-    mkdir -p $LOGDIR
+    sudo mkdir -p $LOGDIR
+    safe_chown -R $STACK_USER $LOGDIR
+    safe_chmod 0755 $LOGDIR
 fi
 
 # Destination path for service data

From 26b5eddeaaeb3e142d483c12d9a501fdc6abaf10 Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Fri, 11 Aug 2023 21:51:05 +0200
Subject: [PATCH 2162/2409] GLOBAL_VENV: add nova to linked binaries

This is being used in some nova jobs, so we need to add it. Also order
the list of linked binaries to allow easier maintenance.

Change-Id: Ief012f7842d6e14380c9575740d1856bc1f2355e
---
 stack.sh | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/stack.sh b/stack.sh
index c8f7c9d79e..641c3c3b5a 100755
--- a/stack.sh
+++ b/stack.sh
@@ -827,11 +827,12 @@ fixup_all
 
 if [[ "$GLOBAL_VENV" == "True" ]] ; then
     # TODO(frickler): find a better solution for this
-    sudo ln -sf /opt/stack/data/venv/bin/privsep-helper /usr/local/bin
     sudo ln -sf /opt/stack/data/venv/bin/cinder-rtstool /usr/local/bin
+    sudo ln -sf /opt/stack/data/venv/bin/nova /usr/local/bin
+    sudo ln -sf /opt/stack/data/venv/bin/nova-manage /usr/local/bin
     sudo ln -sf /opt/stack/data/venv/bin/openstack /usr/local/bin
+    sudo ln -sf /opt/stack/data/venv/bin/privsep-helper /usr/local/bin
     sudo ln -sf /opt/stack/data/venv/bin/tox /usr/local/bin
-    sudo ln -sf /opt/stack/data/venv/bin/nova-manage /usr/local/bin
 
     setup_devstack_virtualenv
 fi

From 4c45bec6ebb965202d8d7d7832c093f47ecc2910 Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Sat, 12 Aug 2023 11:35:08 +0200
Subject: [PATCH 2163/2409] GLOBAL_VENV: add more binaries

glance and rally binaries are also needed.

Also make sure the cinder-rtstool is only called when cinder is actually
enabled.

Change-Id: I18113eabf2fa83e36bace276883775303f6a1e9a
---
 lib/lvm  | 20 +++++++++++---------
 stack.sh |  2 ++
 2 files changed, 13 insertions(+), 9 deletions(-)

diff --git a/lib/lvm b/lib/lvm
index 57d2cd4e62..162c491f22 100644
--- a/lib/lvm
+++ b/lib/lvm
@@ -137,15 +137,17 @@ function init_lvm_volume_group {
     # Start with a clean volume group
     _create_lvm_volume_group $vg $size
 
-    # Remove iscsi targets
-    if [ "$CINDER_TARGET_HELPER" = "lioadm" ]; then
-        sudo cinder-rtstool get-targets | sudo xargs -rn 1 cinder-rtstool delete
-    elif [ "$CINDER_TARGET_HELPER" = "tgtadm" ]; then
-        sudo tgtadm --op show --mode target | awk '/Target/ {print $3}' | sudo xargs -r -n1 tgt-admin --delete
-    elif [ "$CINDER_TARGET_HELPER" = "nvmet" ]; then
-        # If we don't disconnect everything vgremove will block
-        sudo nvme disconnect-all
-        sudo nvmetcli clear
+    if is_service_enabled cinder; then
+        # Remove iscsi targets
+        if [ "$CINDER_TARGET_HELPER" = "lioadm" ]; then
+            sudo cinder-rtstool get-targets | sudo xargs -rn 1 cinder-rtstool delete
+        elif [ "$CINDER_TARGET_HELPER" = "tgtadm" ]; then
+            sudo tgtadm --op show --mode target | awk '/Target/ {print $3}' | sudo xargs -r -n1 tgt-admin --delete
+        elif [ "$CINDER_TARGET_HELPER" = "nvmet" ]; then
+            # If we don't disconnect everything vgremove will block
+            sudo nvme disconnect-all
+            sudo nvmetcli clear
+        fi
     fi
     _clean_lvm_volume_group $vg
 }
diff --git a/stack.sh b/stack.sh
index 94d586e812..d8b70a2b39 100755
--- a/stack.sh
+++ b/stack.sh
@@ -828,10 +828,12 @@ fixup_all
 if [[ "$GLOBAL_VENV" == "True" ]] ; then
     # TODO(frickler): find a better solution for this
     sudo ln -sf /opt/stack/data/venv/bin/cinder-rtstool /usr/local/bin
+    sudo ln -sf /opt/stack/data/venv/bin/glance /usr/local/bin
     sudo ln -sf /opt/stack/data/venv/bin/nova /usr/local/bin
     sudo ln -sf /opt/stack/data/venv/bin/nova-manage /usr/local/bin
     sudo ln -sf /opt/stack/data/venv/bin/openstack /usr/local/bin
     sudo ln -sf /opt/stack/data/venv/bin/privsep-helper /usr/local/bin
+    sudo ln -sf /opt/stack/data/venv/bin/rally /usr/local/bin
     sudo ln -sf /opt/stack/data/venv/bin/tox /usr/local/bin
 
     setup_devstack_virtualenv

From 08b434e5b06a0f28a1779159df494d27db95704c Mon Sep 17 00:00:00 2001
From: Ghanshyam <gmann@ghanshyammann.com>
Date: Mon, 14 Aug 2023 17:05:45 +0000
Subject: [PATCH 2164/2409] Revert "GLOBAL_VENV: add nova to linked binaries"

This reverts commit 26b5eddeaaeb3e142d483c12d9a501fdc6abaf10.

Reason for revert: nova changed to use osc

- https://review.opendev.org/c/openstack/nova/+/891247/2

Resolving conflict due to
- https://review.opendev.org/c/openstack/devstack/+/891248

Change-Id: I69e179a90a241946b3f426a41c38ae72a66ba6dc
---
 stack.sh | 1 -
 1 file changed, 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index d8b70a2b39..a8f46bfeb9 100755
--- a/stack.sh
+++ b/stack.sh
@@ -829,7 +829,6 @@ if [[ "$GLOBAL_VENV" == "True" ]] ; then
     # TODO(frickler): find a better solution for this
     sudo ln -sf /opt/stack/data/venv/bin/cinder-rtstool /usr/local/bin
     sudo ln -sf /opt/stack/data/venv/bin/glance /usr/local/bin
-    sudo ln -sf /opt/stack/data/venv/bin/nova /usr/local/bin
     sudo ln -sf /opt/stack/data/venv/bin/nova-manage /usr/local/bin
     sudo ln -sf /opt/stack/data/venv/bin/openstack /usr/local/bin
     sudo ln -sf /opt/stack/data/venv/bin/privsep-helper /usr/local/bin

From 220004fb5c529d84e2e8d909db71cf17a00c0815 Mon Sep 17 00:00:00 2001
From: Artom Lifshitz <alifshit@redhat.com>
Date: Wed, 16 Aug 2023 14:08:15 -0400
Subject: [PATCH 2165/2409] Allow others to override
 NOVA_SERVICE_REPORT_INTERVAL

While the patch where this was first introduced and set to 120 [1] is
sensible for the vast majority of jobs, it's conceivable that some
jobs might want a different value.

Specifically, the whitebox-tempest-plugin changes configurations and
restarts Nova services, and to do so it waits for the service status
to update in the API before continuing with the tests. With the report
interval set to 120 and the down time threshold set to 720, the
service would continue showing 'up' in the API long after it was
actually down, causing the wait to time out.

Whitebox is a low-traffic project with only a couple of devstack jobs
that run tempest tests sequentially (concurrency=1). Its CI is also
pretty stable. It seems legitimate for it to keep the old default
values of report_interval and service_down_time.

This patch keeps the 120 default for NOVA_SERVICE_REPORT_INTERVAL, but
makes it configurable by individual jobs. Since the original patch
also introduced CINDER_SERVICE_REPORT_INTERVAL as a constant, make
that configurable as well.

[1] https://review.opendev.org/c/openstack/devstack/+/890439

Needed-by: https://review.opendev.org/c/openstack/whitebox-tempest-plugin/+/891612
Change-Id: I64fa2059537ea072a38fb4900d3c7d2d8f0ce429
---
 lib/cinder | 2 +-
 lib/nova   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index f8682d5a71..768a069a12 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -79,7 +79,7 @@ CINDER_SERVICE_LISTEN_ADDRESS=${CINDER_SERVICE_LISTEN_ADDRESS:-$(ipv6_unquote $S
 # We do not need to report service status every 10s for devstack-like
 # deployments. In the gate this generates extra work for the services and the
 # database which are already taxed.
-CINDER_SERVICE_REPORT_INTERVAL=120
+CINDER_SERVICE_REPORT_INTERVAL=${CINDER_SERVICE_REPORT_INTERVAL:-120}
 
 # What type of LVM device should Cinder use for LVM backend
 # Defaults to auto, which will do thin provisioning if it's a fresh
diff --git a/lib/nova b/lib/nova
index 905788f28f..da3118f4cd 100644
--- a/lib/nova
+++ b/lib/nova
@@ -78,7 +78,7 @@ NOVA_USE_MOD_WSGI=${NOVA_USE_MOD_WSGI:-True}
 # We do not need to report service status every 10s for devstack-like
 # deployments. In the gate this generates extra work for the services and the
 # database which are already taxed.
-NOVA_SERVICE_REPORT_INTERVAL=120
+NOVA_SERVICE_REPORT_INTERVAL=${NOVA_SERVICE_REPORT_INTERVAL:-120}
 
 if is_service_enabled tls-proxy; then
     NOVA_SERVICE_PROTOCOL="https"

From 7c4a955c52ead024ef50f448b3894b5ef362508d Mon Sep 17 00:00:00 2001
From: yatin <ykarel@redhat.com>
Date: Mon, 21 Aug 2023 06:28:30 +0000
Subject: [PATCH 2166/2409] Revert "Woraround systemd issue on CentOS 9-stream"

This reverts commit 113689ee4694de20c019735fdace447225aa18f7.

Reason for revert: systemd-252-17.el9 which includes the fix is now available in CentOS 9-stream repos.

Change-Id: I6fe19838a75a30fd5d2434c03b7f403f1c7e4b50
---
 tools/fixup_stuff.sh | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index 80a83bb128..faea44f1e0 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -94,11 +94,6 @@ EOF
     if [[ $os_VENDOR == "CentOSStream" && $os_RELEASE -eq 8 ]]; then
         sudo sysctl -w net.ipv4.ping_group_range='0 2147483647'
     fi
-    # TODO(ykarel): Workaround for systemd issue, remove once fix is
-    # included in systemd rpm https://bugs.launchpad.net/devstack/+bug/2029335
-    if [[ $os_VENDOR == "CentOSStream" && $os_RELEASE -eq 9 ]]; then
-        echo 'LIBVIRTD_ARGS=""' | sudo tee /etc/sysconfig/libvirtd
-    fi
 }
 
 function fixup_ovn_centos {

From 3a7a3cd8c5a5ac3f1655d6ff17974f8623fb3330 Mon Sep 17 00:00:00 2001
From: Jan Gutter <github@jangutter.com>
Date: Mon, 14 Aug 2023 21:02:04 +0100
Subject: [PATCH 2167/2409] Update etcd version to 3.4.27

* etcd 3.3 is no longer maintained.
* etcd 3.4 removes deprecated interfaces, and clients may
  need updated configs.
* The cinder backend coordination URL needs to explicitly
  specify the version, until tooz can be updated
  https://review.opendev.org/c/openstack/tooz/+/891355
* etcd only supports in-place upgrades between minor
  versions, so any jobs testing upgrades could fail if
  they skip from 3.2 directly to 3.4

Change-Id: Ifcecdffa17a3a2b1075aa503978c44545c4a2a3c
---
 lib/cinder |  4 +++-
 stackrc    | 10 +++++-----
 2 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index f8682d5a71..dad17980bc 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -414,7 +414,9 @@ function configure_cinder {
     if [[ ! -z "$CINDER_COORDINATION_URL" ]]; then
         iniset $CINDER_CONF coordination backend_url "$CINDER_COORDINATION_URL"
     elif is_service_enabled etcd3; then
-        iniset $CINDER_CONF coordination backend_url "etcd3+http://${SERVICE_HOST}:$ETCD_PORT"
+        # NOTE(jan.gutter): api_version can revert to default once tooz is
+        # updated with the etcd v3.4 defaults
+        iniset $CINDER_CONF coordination backend_url "etcd3+http://${SERVICE_HOST}:$ETCD_PORT?api_version=v3"
     fi
 
     if [[ "$CINDER_ENFORCE_SCOPE" == True || "$ENFORCE_SCOPE" == True ]] ; then
diff --git a/stackrc b/stackrc
index 0d1880cec9..2d25e379fd 100644
--- a/stackrc
+++ b/stackrc
@@ -728,11 +728,11 @@ fi
 EXTRA_CACHE_URLS=""
 
 # etcd3 defaults
-ETCD_VERSION=${ETCD_VERSION:-v3.3.12}
-ETCD_SHA256_AMD64=${ETCD_SHA256_AMD64:-"dc5d82df095dae0a2970e4d870b6929590689dd707ae3d33e7b86da0f7f211b6"}
-ETCD_SHA256_ARM64=${ETCD_SHA256_ARM64:-"170b848ac1a071fe7d495d404a868a2c0090750b2944f8a260ef1c6125b2b4f4"}
-ETCD_SHA256_PPC64=${ETCD_SHA256_PPC64:-"77f807b1b51abbf51e020bb05bdb8ce088cb58260fcd22749ea32eee710463d3"}
-# etcd v3.2.x doesn't have anything for s390x
+ETCD_VERSION=${ETCD_VERSION:-v3.4.27}
+ETCD_SHA256_AMD64=${ETCD_SHA256_AMD64:-"a32d21e006252dbc3405b0645ba8468021ed41376974b573285927bf39b39eb9"}
+ETCD_SHA256_ARM64=${ETCD_SHA256_ARM64:-"ed7e257c225b9b9545fac22246b97f4074a4b5109676e92dbaebfb9315b69cc0"}
+ETCD_SHA256_PPC64=${ETCD_SHA256_PPC64:-"eb8825e0bc2cbaf9e55947f5ee373ebc9ca43b6a2ea5ced3b992c81855fff37e"}
+# etcd v3.2.x and later doesn't have anything for s390x
 ETCD_SHA256_S390X=${ETCD_SHA256_S390X:-""}
 # Make sure etcd3 downloads the correct architecture
 if is_arch "x86_64"; then

From 7cd3a8eebe1830f94c02bb6ec010c0365f6ab6f1 Mon Sep 17 00:00:00 2001
From: Martin Kopec <mkopec@redhat.com>
Date: Tue, 22 Aug 2023 20:40:20 +0200
Subject: [PATCH 2168/2409] Set GLOBAL_VENV to false for centos and rocky

As a temporary workaround, let's set the GLOBAL_VENV to false
specifically for centos 9 stream and rocky distros where we
encountered issues after changing the default value
of GLOBAL_VENV to True in Devstack:
https://review.opendev.org/c/openstack/devstack/+/558930

Related-Bug: #2031639
Change-Id: I708b5a81c32b0bd650dcd63a51e16346863a6fc0
---
 .zuul.yaml |  5 -----
 stackrc    | 11 ++++++++++-
 2 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index e65dc5b7cf..8b60fc9936 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -708,9 +708,6 @@
     nodeset: devstack-single-node-centos-9-stream
     timeout: 9000
     voting: false
-    vars:
-      devstack_localrc:
-        GLOBAL_VENV: false
 
 - job:
     name: devstack-platform-debian-bookworm
@@ -745,8 +742,6 @@
     timeout: 9000
     vars:
       configure_swap_size: 4096
-      devstack_localrc:
-        GLOBAL_VENV: false
 
 - job:
     name: devstack-platform-ubuntu-focal
diff --git a/stackrc b/stackrc
index 0d1880cec9..bd4e2f17a2 100644
--- a/stackrc
+++ b/stackrc
@@ -188,9 +188,18 @@ ENFORCE_SCOPE=$(trueorfalse False ENFORCE_SCOPE)
 # Note that the DATA_DIR is selected because grenade testing uses a shared
 # DATA_DIR but different DEST dirs and we don't want two sets of venvs,
 # instead we want one global set.
-GLOBAL_VENV=$(trueorfalse True GLOBAL_VENV)
 DEVSTACK_VENV=${DEVSTACK_VENV:-$DATA_DIR/venv}
 
+# NOTE(kopecmartin): remove this once this is fixed
+# https://bugs.launchpad.net/devstack/+bug/2031639
+# This couldn't go to fixup_stuff as that's called after projects
+# (e.g. certain paths) are set taking GLOBAL_VENV into account
+if [[ "$os_VENDOR" =~ (CentOSStream|Rocky) ]]; then
+    GLOBAL_VENV=$(trueorfalse False GLOBAL_VENV)
+else
+    GLOBAL_VENV=$(trueorfalse True GLOBAL_VENV)
+fi
+
 # Enable use of Python virtual environments.  Individual project use of
 # venvs are controlled by the PROJECT_VENV array; every project with
 # an entry in the array will be installed into the named venv.

From 5a51aa524c1f955a4650099c344756acc6c6b507 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Wed, 23 Aug 2023 10:43:32 -0700
Subject: [PATCH 2169/2409] Fix glance-remote with global venv

The base systemd unit file setup now writes an Environment= line to
the file for the venv. The glance-remote code was setting that to
point at the alternate config location, using iniset which was
clobbering the venv one. Switch to iniadd to fix.

Also, we need to explicitly put the --venv flag into the command since
we write our unit file ourselves. This probably needs a cleanup at
this point, but since the glance gate is blocked, do this for now.

Change-Id: I2bd33de45c41b18ed7d4270a7301b1e322134987
---
 lib/glance | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/lib/glance b/lib/glance
index e64f00027e..3cf8230f41 100644
--- a/lib/glance
+++ b/lib/glance
@@ -584,9 +584,10 @@ function start_glance_remote_clone {
     write_uwsgi_user_unit_file devstack@g-api-r.service "$(which uwsgi) \
                                --procname-prefix \
                                glance-api-remote \
-                               --ini $glance_remote_uwsgi" \
+                               --ini $glance_remote_uwsgi \
+                               --venv $DEVSTACK_VENV" \
                                "" "$STACK_USER"
-    iniset -sudo ${SYSTEMD_DIR}/devstack@g-api-r.service \
+    iniadd -sudo ${SYSTEMD_DIR}/devstack@g-api-r.service \
            "Service" "Environment" \
            "OS_GLANCE_CONFIG_DIR=$glance_remote_conf_dir"
 

From ef53db76d029382dd8b3566224e51351b9d36280 Mon Sep 17 00:00:00 2001
From: melanie witt <melwittt@gmail.com>
Date: Thu, 24 Aug 2023 00:42:19 +0000
Subject: [PATCH 2170/2409] Fix configuration of LVM global_filter

As far as I could tell, the global_filter config added in change
I5d5c48e188cbb9b4208096736807f082bce524e8 wasn't actually making it
into the lvm.conf. Given the volume (or rather LVM volume) related
issues we've been seeing in the gate recently, we can give this a try
to see if the global_filter setting has any positive effect.

This also adds the contents of /etc/lvm/* to the logs collected by the
jobs, so that we can see the LVM config.

Change-Id: I2b39acd352669231d16b5cb2e151f290648355c0
---
 .zuul.yaml | 1 +
 lib/lvm    | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 8b60fc9936..46e1e45e39 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -430,6 +430,7 @@
         /var/log/mysql: logs
         /var/log/libvirt: logs
         /etc/libvirt: logs
+        /etc/lvm: logs
         /etc/sudoers: logs
         /etc/sudoers.d: logs
         '{{ stage_dir }}/iptables.txt': logs
diff --git a/lib/lvm b/lib/lvm
index 162c491f22..b7e84d9505 100644
--- a/lib/lvm
+++ b/lib/lvm
@@ -200,7 +200,7 @@ function set_lvm_filter {
     filter_string=$filter_string$filter_suffix
 
     clean_lvm_filter
-    sudo sed -i "/# global_filter = \[*\]/a\    $global_filter$filter_string" /etc/lvm/lvm.conf
+    sudo sed -i "/# global_filter = \[.*\]/a\        $filter_string" /etc/lvm/lvm.conf
     echo_summary "set lvm.conf device global_filter to: $filter_string"
 }
 

From ffc1b76f64341e18b5a6e60783f1e33297623f99 Mon Sep 17 00:00:00 2001
From: yatinkarel <ykarel@redhat.com>
Date: Mon, 28 Aug 2023 10:52:26 +0530
Subject: [PATCH 2171/2409] [neutron] Rely on PATH env set by devstack

This was missed as part of [1], neutron sets
exec_dirs in rootwrap.conf differently so that
also needs to be fixed.

Without it neutron openvswitch jobs relying on
neutron-keepalived-state-change scripts were
failing when deployed with GLOBAL_VENV=True as
binaries no longer found at /usr/local/bin.

[1] https://review.opendev.org/c/openstack/devstack/+/558930

Closes-Bug: #2031415
Change-Id: I9aa56bff02594f253381ffe47a70949079f4c240
---
 lib/neutron | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/lib/neutron b/lib/neutron
index a6de7222db..e90ada8929 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -1075,7 +1075,10 @@ function _neutron_setup_rootwrap {
         sudo install -o root -g root -m 644 $NEUTRON_DIR/etc/rootwrap.conf $Q_RR_CONF_FILE
     fi
     sudo sed -e "s:^filters_path=.*$:filters_path=$Q_CONF_ROOTWRAP_D:" -i $Q_RR_CONF_FILE
-    sudo sed -e 's:^exec_dirs=\(.*\)$:exec_dirs=\1,/usr/local/bin:' -i $Q_RR_CONF_FILE
+    # Rely on $PATH set by devstack to determine what is safe to execute
+    # by rootwrap rather than use explicit whitelist of paths in
+    # rootwrap.conf
+    sudo sed -e 's/^exec_dirs=.*/#&/' -i $Q_RR_CONF_FILE
 
     # Specify ``rootwrap.conf`` as first parameter to neutron-rootwrap
     ROOTWRAP_SUDOER_CMD="$NEUTRON_ROOTWRAP $Q_RR_CONF_FILE *"

From 427a4e1a9b7f20a8be0ad5091f2229945ce711a8 Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Wed, 7 Jun 2023 15:26:07 +0200
Subject: [PATCH 2172/2409] Drop focal platform job and support

This was dropped in tempest, too[0], and we want to focus on getting and
keeping the jammy job stable.

Still retaining the nodeset definitions until we are sure they are not
needed in other projects.

[0] https://review.opendev.org/c/openstack/tempest/+/884952

Change-Id: Iafb5a939a650b763935d8b7ce7069ac4c6d9a95b
---
 .zuul.yaml | 9 ---------
 stack.sh   | 2 +-
 2 files changed, 1 insertion(+), 10 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 46e1e45e39..356acec479 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -744,13 +744,6 @@
     vars:
       configure_swap_size: 4096
 
-- job:
-    name: devstack-platform-ubuntu-focal
-    parent: tempest-full-py3
-    description: Ubuntu 20.04 LTS (focal) platform test
-    nodeset: openstack-single-node-focal
-    timeout: 9000
-
 - job:
     name: devstack-platform-ubuntu-jammy-ovn-source
     parent: devstack-platform-ubuntu-jammy
@@ -946,7 +939,6 @@
         - devstack-platform-debian-bookworm
         - devstack-platform-debian-bullseye
         - devstack-platform-rocky-blue-onyx
-        - devstack-platform-ubuntu-focal
         - devstack-platform-ubuntu-jammy-ovn-source
         - devstack-platform-ubuntu-jammy-ovs
         - devstack-platform-openEuler-22.03-ovn-source
@@ -995,7 +987,6 @@
         - devstack
         - devstack-ipv6
         - devstack-platform-debian-bullseye
-        - devstack-platform-ubuntu-focal
         - devstack-platform-rocky-blue-onyx
         - devstack-enforce-scope
         - devstack-multinode
diff --git a/stack.sh b/stack.sh
index a8f46bfeb9..c8810cd2f0 100755
--- a/stack.sh
+++ b/stack.sh
@@ -230,7 +230,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-SUPPORTED_DISTROS="bookworm|bullseye|focal|jammy|rhel8|rhel9|openEuler-22.03"
+SUPPORTED_DISTROS="bookworm|bullseye|jammy|rhel8|rhel9|openEuler-22.03"
 
 if [[ ! ${DISTRO} =~ $SUPPORTED_DISTROS ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"

From 16ac21f0da4f1b83963c4beb876f8494d9594b7a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Harald=20Jens=C3=A5s?= <hjensas@redhat.com>
Date: Thu, 31 Aug 2023 15:06:52 +0200
Subject: [PATCH 2173/2409] Add OVN_BRIDGE_MAPPINGS - support extra bridge

Add's the OVN_BRIDGE_MAPPINGS variable to ovn_agent.
Uses the same format as OVS_BRIDGE_MAPPINGS, it defaults
to "$PYSICAL_NETWORK:$PUBLIC_BRIDGE".

This enables use of providernet for public network and
setting up additional bridges, for example a for baremetal.

Example:
  Q_USE_PROVIDER_NETWORKING="True"
  OVS_PHYSICAL_BRIDGE="brbm"
  PHYSICAL_NETWORK="mynetwork"
  PUBLIC_PHYSICAL_NETWORK="public"
  PUBLIC_BRIDGE="br-ex"
  OVN_BRIDGE_MAPPINGS="public:br-ex,mynetwork:brbm"

Change-Id: I37317251bbe95d64de06d6232c2d472a98c0ee4d
---
 lib/neutron                     | 5 +++++
 lib/neutron_plugins/ovn_agent   | 2 +-
 lib/neutron_plugins/services/l3 | 8 +++++++-
 3 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index e90ada8929..ca9b788b2e 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -303,6 +303,11 @@ else
     Q_USE_SECGROUP=False
 fi
 
+# OVN_BRIDGE_MAPPINGS - ovn-bridge-mappings
+# NOTE(hjensas): Initialize after sourcing neutron_plugins/services/l3
+# which initialize PUBLIC_BRIDGE.
+OVN_BRIDGE_MAPPINGS=${OVN_BRIDGE_MAPPINGS:-$PHYSICAL_NETWORK:$PUBLIC_BRIDGE}
+
 # Save trace setting
 _XTRACE_NEUTRON=$(set +o | grep xtrace)
 set +o xtrace
diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index 3526ccd354..c51b708130 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -288,7 +288,7 @@ function clone_repository {
 function create_public_bridge {
     # Create the public bridge that OVN will use
     sudo ovs-vsctl --may-exist add-br $PUBLIC_BRIDGE -- set bridge $PUBLIC_BRIDGE protocols=OpenFlow13,OpenFlow15
-    sudo ovs-vsctl set open . external-ids:ovn-bridge-mappings=$PHYSICAL_NETWORK:$PUBLIC_BRIDGE
+    sudo ovs-vsctl set open . external-ids:ovn-bridge-mappings=${OVN_BRIDGE_MAPPINGS}
     _configure_public_network_connectivity
 }
 
diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index 2bf884a8c4..c6d4663114 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -47,7 +47,8 @@ Q_L3_ROUTER_PER_TENANT=${Q_L3_ROUTER_PER_TENANT:-True}
 # used for the network.  In case of ofagent, you should add the
 # corresponding entry to your OFAGENT_PHYSICAL_INTERFACE_MAPPINGS.
 # For openvswitch agent, you should add the corresponding entry to
-# your OVS_BRIDGE_MAPPINGS.
+# your OVS_BRIDGE_MAPPINGS and for OVN add the corresponding entry
+# to your OVN_BRIDGE_MAPPINGS.
 #
 # eg.  (ofagent)
 #    Q_USE_PROVIDERNET_FOR_PUBLIC=True
@@ -60,6 +61,11 @@ Q_L3_ROUTER_PER_TENANT=${Q_L3_ROUTER_PER_TENANT:-True}
 #    PUBLIC_PHYSICAL_NETWORK=public
 #    OVS_BRIDGE_MAPPINGS=public:br-ex
 #
+# eg.  (ovn agent)
+#    Q_USER_PROVIDERNET_FOR_PUBLIC=True
+#    PUBLIC_PHYSICAL_NETWORK=public
+#    OVN_BRIDGE_MAPPINGS=public:br-ex
+#
 # The provider-network-type defaults to flat, however, the values
 # PUBLIC_PROVIDERNET_TYPE and PUBLIC_PROVIDERNET_SEGMENTATION_ID could
 # be set to specify the parameters for an alternate network type.

From a389128dba4ce7d7051b86f3ac7db4164d24b95f Mon Sep 17 00:00:00 2001
From: Lucas Alvares Gomes <lucasagomes@gmail.com>
Date: Tue, 18 Jul 2023 16:31:28 +0100
Subject: [PATCH 2174/2409] OVN: Let ironic manage the OVN startup in it's
 case.

In order for Ironic perform full testing with devstack, it uses
virtual machines attached to a ovs bridge network to simulate
bare metal machines. This worked great for OVS because often
OVS was already running on the nodes due to the package, and
we could just apply configuration and be done with it when
Ironic's devstack plugin was applying initial configuration and
setting up the test environment.

With OVN, and the requirement of a specific co-installed OVS
version, Ironic has discovered that we cannot perform this same
configuration without having already started OVN during the
initial system setup. Which is fine, but we can't initialize
and start OVN twice. It just doesn't work.

The original form of this patch was proposed by lucasgnomes
in order to validate that we, did, indeed, need to do this
to enable Ironic to successfully test an OVN based
configuration, and is now being revised to handle that case
automatically when Ironic is the selected virt plugin.

Co-Authored-By: Julia Kreger <juliaashleykreger@gmail.com>
Change-Id: Ifbfdaaa97fdbe75ede49dc47235e92a8035d1de6
---
 lib/neutron | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index e90ada8929..5407f8a7b8 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -570,8 +570,15 @@ function configure_rbac_policies {
 # Start running OVN processes
 function start_ovn_services {
     if [[ $Q_AGENT == "ovn" ]]; then
-        init_ovn
-        start_ovn
+        if [ "$VIRT_DRIVER" != 'ironic' ]; then
+            # NOTE(TheJulia): Ironic's devstack plugin needs to perform
+            # additional networking configuration to setup a working test
+            # environment with test virtual machines to emulate baremetal,
+            # which requires OVN to be up and running earlier to complete
+            # that base configuration.
+            init_ovn
+            start_ovn
+        fi
         if [[ "$OVN_L3_CREATE_PUBLIC_NETWORK" == "True" ]]; then
             if [[ "$NEUTRON_CREATE_INITIAL_NETWORKS" != "True" ]]; then
                 echo "OVN_L3_CREATE_PUBLIC_NETWORK=True is being ignored "

From e1297193dcb93acc1f7b89f5fe91babbcc6dda49 Mon Sep 17 00:00:00 2001
From: Jay Faulkner <jay@jvf.cc>
Date: Sun, 10 Sep 2023 16:24:38 -0700
Subject: [PATCH 2175/2409] [nova][ironic] Support configuring 1 shard on n-cpu

Allows for testing of basic sharding configuration.

Change-Id: Idfb2bd1822898d95af8643d69d97d9a76b4d64cc
Needed-By: https://review.opendev.org/c/openstack/ironic/+/894460
---
 functions-common                   | 6 ++++++
 lib/nova_plugins/hypervisor-ironic | 4 ++++
 2 files changed, 10 insertions(+)

diff --git a/functions-common b/functions-common
index f752271976..c57c4cc054 100644
--- a/functions-common
+++ b/functions-common
@@ -1114,6 +1114,12 @@ function is_ironic_enforce_scope {
     return 1
 }
 
+function is_ironic_sharded {
+    # todo(JayF): Support >1 shard with multiple n-cpu instances for each
+    is_service_enabled ironic && [[ "$IRONIC_SHARDS" == "1" ]] && return 0
+    return 1
+}
+
 
 # Package Functions
 # =================
diff --git a/lib/nova_plugins/hypervisor-ironic b/lib/nova_plugins/hypervisor-ironic
index f058e9bb53..9a39c798a8 100644
--- a/lib/nova_plugins/hypervisor-ironic
+++ b/lib/nova_plugins/hypervisor-ironic
@@ -53,6 +53,10 @@ function configure_nova_hypervisor {
         iniset $NOVA_CONF ironic project_domain_id default
         iniset $NOVA_CONF ironic project_name demo
     fi
+    if is_ironic_sharded; then
+        iniset $NOVA_CONF ironic shard $IRONIC_SHARD_1_NAME
+    fi
+
     iniset $NOVA_CONF ironic user_domain_id default
     iniset $NOVA_CONF ironic region_name $REGION_NAME
 

From 290a02d1f80b4de1bdeaaddaef7f59402a767d02 Mon Sep 17 00:00:00 2001
From: Martin Kopec <mkopec@redhat.com>
Date: Tue, 12 Sep 2023 17:32:03 +0200
Subject: [PATCH 2176/2409] Remove openeuler job from periodic and check queue

The openeuler job running version 22.03 fails due to old libvirt.
Nova requires version 7.0.0 or greater.

Related-Bug: #2035224
Change-Id: I4ad6151c3d8555de059c9228253d287aecf9f953
---
 .zuul.yaml | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 356acec479..5a7edd6c93 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -941,8 +941,6 @@
         - devstack-platform-rocky-blue-onyx
         - devstack-platform-ubuntu-jammy-ovn-source
         - devstack-platform-ubuntu-jammy-ovs
-        - devstack-platform-openEuler-22.03-ovn-source
-        - devstack-platform-openEuler-22.03-ovs
         - devstack-multinode
         - devstack-unit-tests
         - openstack-tox-bashate
@@ -1067,7 +1065,3 @@
     periodic:
       jobs:
         - devstack-no-tls-proxy
-    periodic-weekly:
-      jobs:
-        - devstack-platform-openEuler-22.03-ovn-source
-        - devstack-platform-openEuler-22.03-ovs

From d3953db76641e825565390acc6f68501777c0f53 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Tue, 19 Sep 2023 02:15:19 +0000
Subject: [PATCH 2177/2409] Updated from generate-devstack-plugins-list

Change-Id: I18a47f5d604bbb83173151fb0b129deee2fcbe62
---
 doc/source/plugin-registry.rst | 2 --
 1 file changed, 2 deletions(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index f54fca92e6..03c7469c8f 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -69,7 +69,6 @@ openstack/networking-bagpipe             `https://opendev.org/openstack/networki
 openstack/networking-baremetal           `https://opendev.org/openstack/networking-baremetal <https://opendev.org/openstack/networking-baremetal>`__
 openstack/networking-bgpvpn              `https://opendev.org/openstack/networking-bgpvpn <https://opendev.org/openstack/networking-bgpvpn>`__
 openstack/networking-generic-switch      `https://opendev.org/openstack/networking-generic-switch <https://opendev.org/openstack/networking-generic-switch>`__
-openstack/networking-hyperv              `https://opendev.org/openstack/networking-hyperv <https://opendev.org/openstack/networking-hyperv>`__
 openstack/networking-powervm             `https://opendev.org/openstack/networking-powervm <https://opendev.org/openstack/networking-powervm>`__
 openstack/networking-sfc                 `https://opendev.org/openstack/networking-sfc <https://opendev.org/openstack/networking-sfc>`__
 openstack/neutron                        `https://opendev.org/openstack/neutron <https://opendev.org/openstack/neutron>`__
@@ -85,7 +84,6 @@ openstack/octavia-dashboard              `https://opendev.org/openstack/octavia-
 openstack/octavia-tempest-plugin         `https://opendev.org/openstack/octavia-tempest-plugin <https://opendev.org/openstack/octavia-tempest-plugin>`__
 openstack/openstacksdk                   `https://opendev.org/openstack/openstacksdk <https://opendev.org/openstack/openstacksdk>`__
 openstack/osprofiler                     `https://opendev.org/openstack/osprofiler <https://opendev.org/openstack/osprofiler>`__
-openstack/oswin-tempest-plugin           `https://opendev.org/openstack/oswin-tempest-plugin <https://opendev.org/openstack/oswin-tempest-plugin>`__
 openstack/ovn-octavia-provider           `https://opendev.org/openstack/ovn-octavia-provider <https://opendev.org/openstack/ovn-octavia-provider>`__
 openstack/rally-openstack                `https://opendev.org/openstack/rally-openstack <https://opendev.org/openstack/rally-openstack>`__
 openstack/sahara                         `https://opendev.org/openstack/sahara <https://opendev.org/openstack/sahara>`__

From f73d3127832798db8d7830d1456bdedd1a6a6903 Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Wed, 20 Sep 2023 07:04:37 +0200
Subject: [PATCH 2178/2409] CI: Make bookworm platform job voting

It has been very stable for some time and it is going to be a major
platform for the next cycle.

Signed-off-by: Dr. Jens Harbott <harbott@osism.tech>
Change-Id: Id2df9514b41eda0798179157282a8486b1e9ae23
---
 .zuul.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 5a7edd6c93..1d1e3c9807 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -716,7 +716,6 @@
     description: Debian Bookworm platform test
     nodeset: devstack-single-node-debian-bookworm
     timeout: 9000
-    voting: false
     vars:
       configure_swap_size: 4096
       devstack_localrc:
@@ -984,6 +983,7 @@
       jobs:
         - devstack
         - devstack-ipv6
+        - devstack-platform-debian-bookworm
         - devstack-platform-debian-bullseye
         - devstack-platform-rocky-blue-onyx
         - devstack-enforce-scope

From 5441b3df6e534101e66f8187ac9ff2bba2533fb5 Mon Sep 17 00:00:00 2001
From: Jake Yip <jake.yip@ardc.edu.au>
Date: Sat, 10 Jun 2023 00:17:53 +1000
Subject: [PATCH 2179/2409] Use OS_CLOUD in sample local.sh

local.sh, if present, will be executed at the end of stack.sh. The
sample file here is meant to be copied to devstack root if desired.

Unfortunately, due to Change I86ffa9cd52454f1c1c72d29b3a0e0caa3e44b829
changing to use OS_CLOUD in stack.sh, sourcing openrc here will cause
both OS_CLOUD and traditional OS_* env vars to be set, which causes a
conflict.

Change-Id: Id80b46acab7d600ad7394ab5bc1984304825a672
---
 samples/local.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/samples/local.sh b/samples/local.sh
index a1c5c8143b..7e6ae70ad4 100755
--- a/samples/local.sh
+++ b/samples/local.sh
@@ -31,7 +31,7 @@ if is_service_enabled nova; then
     # ``demo``)
 
     # Get OpenStack user auth
-    source $TOP_DIR/openrc
+    export OS_CLOUD=devstack
 
     # Add first keypair found in localhost:$HOME/.ssh
     for i in $HOME/.ssh/id_rsa.pub $HOME/.ssh/id_dsa.pub; do

From 25cd7eb67286ba39060d05b3f3f9e785d125195a Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Thu, 21 Sep 2023 07:12:15 -0700
Subject: [PATCH 2180/2409] Fix g-api-r for non-global venv

This makes the glance-api-remote setup honor the GLOBAL_VENV flag,
and not pass the --venv stuff to uwsgi if it is disabled. This should
fix the glance-multistore-cinder-import-fips job.

Change-Id: I2005da5ced027d273e1f25f47b644fecafffc6c1
---
 lib/glance | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/lib/glance b/lib/glance
index 3cf8230f41..796ebdb68d 100644
--- a/lib/glance
+++ b/lib/glance
@@ -543,7 +543,7 @@ function glance_remote_conf {
 # start_glance_remote_clone() - Clone the regular glance api worker
 function start_glance_remote_clone {
     local glance_remote_conf_dir glance_remote_port remote_data
-    local glance_remote_uwsgi
+    local glance_remote_uwsgi venv
 
     glance_remote_conf_dir="$(glance_remote_conf "")"
     glance_remote_port=$(get_random_port)
@@ -581,11 +581,14 @@ function start_glance_remote_clone {
     # We need to create the systemd service for the clone, but then
     # change it to include an Environment line to point the WSGI app
     # at the alternate config directory.
+    if [[ "$GLOBAL_VENV" == True ]]; then
+        venv="--venv $DEVSTACK_VENV"
+    fi
     write_uwsgi_user_unit_file devstack@g-api-r.service "$(which uwsgi) \
                                --procname-prefix \
                                glance-api-remote \
                                --ini $glance_remote_uwsgi \
-                               --venv $DEVSTACK_VENV" \
+                               $venv" \
                                "" "$STACK_USER"
     iniadd -sudo ${SYSTEMD_DIR}/devstack@g-api-r.service \
            "Service" "Environment" \

From 3d37d13ee7aacd5594b351e324d8780e6d64d61b Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Thu, 28 Sep 2023 11:36:07 -0700
Subject: [PATCH 2181/2409] Update DEVSTACK_SERIES to 2024.1

stable/2023.2 branch has been created now and
current master is for 2024.1

Change-Id: I67eee1ba721a1ad99b3503312acc2f94a52c5552
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index ff30d37721..464e935839 100644
--- a/stackrc
+++ b/stackrc
@@ -265,7 +265,7 @@ REQUIREMENTS_DIR=${REQUIREMENTS_DIR:-$DEST/requirements}
 # Setting the variable to 'ALL' will activate the download for all
 # libraries.
 
-DEVSTACK_SERIES="2023.2"
+DEVSTACK_SERIES="2024.1"
 
 ##############
 #

From 8c25a8586122d5f00bdcec9b6c4826309891ba62 Mon Sep 17 00:00:00 2001
From: Lukas Piwowarski <lpiwowar@redhat.com>
Date: Thu, 5 Oct 2023 08:11:05 +0000
Subject: [PATCH 2182/2409] Add support volume backup_driver config option

The depends-on patch adds a new backup_driver option to tempest.
The goal of this change is to be able to do a proper cleanup of
containers when swift is used as a backup driver.

Thich change makes sure that the new option is properly set to
"swift" when Swift is used as the driver.

Depends-On: https://review.opendev.org/c/openstack/tempest/+/896011/13
Change-Id: I76e7fd712ee352051f8aa2f2912a29abad9ad017
---
 lib/tempest | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index 2f62f6ea62..7b5fde170e 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -29,6 +29,7 @@
 # - ``DEFAULT_INSTANCE_USER``
 # - ``DEFAULT_INSTANCE_ALT_USER``
 # - ``CINDER_ENABLED_BACKENDS``
+# - ``CINDER_BACKUP_DRIVER``
 # - ``NOVA_ALLOW_DUPLICATE_NETWORKS``
 #
 # ``stack.sh`` calls the entry points in this order:
@@ -571,6 +572,9 @@ function configure_tempest {
         TEMPEST_VOLUME_REVERT_TO_SNAPSHOT=${TEMPEST_VOLUME_REVERT_TO_SNAPSHOT:-True}
     fi
     iniset $TEMPEST_CONFIG volume-feature-enabled volume_revert $(trueorfalse False TEMPEST_VOLUME_REVERT_TO_SNAPSHOT)
+    if [[ "$CINDER_BACKUP_DRIVER" == *"swift"* ]]; then
+        iniset $TEMPEST_CONFIG volume backup_driver swift
+    fi
     local tempest_volume_min_microversion=${TEMPEST_VOLUME_MIN_MICROVERSION:-None}
     local tempest_volume_max_microversion=${TEMPEST_VOLUME_MAX_MICROVERSION:-"latest"}
     if [ "$tempest_volume_min_microversion" == "None" ]; then

From ca4d5132e63752878620c4e4f374d98d433b3f52 Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Tue, 10 Oct 2023 09:22:16 +0200
Subject: [PATCH 2183/2409] zuul: Drop neutron-linuxbridge-tempest job

Neutron has deprecated linuxbridge support and is only doing reduced
testing for the neutron-linuxbridge-tempest job, so we need no longer
run it in devstack, even less gate on it.

Signed-off-by: Dr. Jens Harbott <harbott@osism.tech>
Change-Id: Ie1a8f978efe7fc9b037cf6a6b70b67d539d76fd6
---
 .zuul.yaml | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 1d1e3c9807..6ee8177a6d 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -953,10 +953,6 @@
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
-        - neutron-linuxbridge-tempest:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
         - neutron-ovn-tempest-ovs-release:
             voting: false
             irrelevant-files:
@@ -994,10 +990,6 @@
             irrelevant-files:
               - ^.*\.rst$
               - ^doc/.*$
-        - neutron-linuxbridge-tempest:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
         - ironic-tempest-bios-ipmi-direct-tinyipa
         - swift-dsvm-functional
         - grenade:

From 72cf4e60060d8024a9fb79c845babc621f35dd2f Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Thu, 12 Oct 2023 11:08:30 -0700
Subject: [PATCH 2184/2409] Allow forcing nova compute_id

Developers that need to stack and re-stack non-AIO compute-only
environments will want to be able to keep the compute node uuid the
same across runs. This mimics the behavior of a deployment tool that
pre-creates the uuids, so it matches pretty well. Default to the
current behavior of create-on-start, but allow forcing it ahead of
time to something specific.

Change-Id: Icab0b783e2233cad9a93c04758a5bccac0832203
---
 lib/nova | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/lib/nova b/lib/nova
index da3118f4cd..b04f94beef 100644
--- a/lib/nova
+++ b/lib/nova
@@ -58,6 +58,14 @@ NOVA_METADATA_UWSGI=$NOVA_BIN_DIR/nova-metadata-wsgi
 NOVA_UWSGI_CONF=$NOVA_CONF_DIR/nova-api-uwsgi.ini
 NOVA_METADATA_UWSGI_CONF=$NOVA_CONF_DIR/nova-metadata-uwsgi.ini
 
+# Allow forcing the stable compute uuid to something specific. This would be
+# done by deployment tools that pre-allocate the UUIDs, but it is also handy
+# for developers that need to re-stack a compute-only deployment multiple
+# times. Since the DB is non-local and not erased on an unstack, making it
+# stay the same each time is what developers want. Set to a uuid here or
+# leave it blank for default allocate-on-start behavior.
+NOVA_CPU_UUID=""
+
 # The total number of cells we expect. Must be greater than one and doesn't
 # count cell0.
 NOVA_NUM_CELLS=${NOVA_NUM_CELLS:-1}
@@ -1058,6 +1066,10 @@ function start_nova_compute {
         iniset $NOVA_CPU_CONF workarounds libvirt_disable_apic True
     fi
 
+    if [[ "$NOVA_CPU_UUID" ]]; then
+        echo -n $NOVA_CPU_UUID > $NOVA_CONF_DIR/compute_id
+    fi
+
     if [[ "$VIRT_DRIVER" = 'libvirt' ]]; then
         # The group **$LIBVIRT_GROUP** is added to the current user in this script.
         # ``sg`` is used in run_process to execute nova-compute as a member of the

From eb9b08a8833884b7c7c5b55813d7621715fe7adf Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Sat, 14 Oct 2023 02:26:11 +0000
Subject: [PATCH 2185/2409] Updated from generate-devstack-plugins-list

Change-Id: Ieecc17159ac36b65124598c36fc92b77c2a75399
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 03c7469c8f..b2e733337a 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -78,6 +78,7 @@ openstack/neutron-fwaas-dashboard        `https://opendev.org/openstack/neutron-
 openstack/neutron-tempest-plugin         `https://opendev.org/openstack/neutron-tempest-plugin <https://opendev.org/openstack/neutron-tempest-plugin>`__
 openstack/neutron-vpnaas                 `https://opendev.org/openstack/neutron-vpnaas <https://opendev.org/openstack/neutron-vpnaas>`__
 openstack/neutron-vpnaas-dashboard       `https://opendev.org/openstack/neutron-vpnaas-dashboard <https://opendev.org/openstack/neutron-vpnaas-dashboard>`__
+openstack/nova                           `https://opendev.org/openstack/nova <https://opendev.org/openstack/nova>`__
 openstack/nova-powervm                   `https://opendev.org/openstack/nova-powervm <https://opendev.org/openstack/nova-powervm>`__
 openstack/octavia                        `https://opendev.org/openstack/octavia <https://opendev.org/openstack/octavia>`__
 openstack/octavia-dashboard              `https://opendev.org/openstack/octavia-dashboard <https://opendev.org/openstack/octavia-dashboard>`__

From d2acd60870c63b486d4802cc3af0fdb27bd506c7 Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Mon, 16 Oct 2023 15:02:08 +0900
Subject: [PATCH 2186/2409] Horizon: Install pymemcached

... so that we can use PyMemcacheCache backend. The MemcachedCache
backend, which has been used previously, has been removed in recent
Django, and we are switching the default backend in [1].

[1] https://review.opendev.org/c/openstack/horizon/+/891828

Change-Id: Ie1da8970628e34c41721198cdada8c7bb3b26ec0
---
 lib/horizon | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/horizon b/lib/horizon
index 611329d619..6f753f546f 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -169,6 +169,10 @@ function install_horizon {
     # Apache installation, because we mark it NOPRIME
     install_apache_wsgi
 
+    # Install the memcache library so that horizon can use memcached as its
+    # cache backend
+    pip_install_gr pymemcache
+
     git_clone $HORIZON_REPO $HORIZON_DIR $HORIZON_BRANCH
 }
 

From cace4044316befbbef9bcb7af2003f3045350830 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Mon, 23 Oct 2023 11:21:24 -0700
Subject: [PATCH 2187/2409] Fix performance stats gathering for global VENV

Change-Id: I113c571ffddb241b29b1394e181ed0145b3c1e04
---
 roles/capture-performance-data/tasks/main.yaml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/roles/capture-performance-data/tasks/main.yaml b/roles/capture-performance-data/tasks/main.yaml
index f9bb0f7851..51a11b60bc 100644
--- a/roles/capture-performance-data/tasks/main.yaml
+++ b/roles/capture-performance-data/tasks/main.yaml
@@ -3,7 +3,9 @@
     executable: /bin/bash
     cmd: |
       source {{ devstack_conf_dir }}/stackrc
-      python3 {{ devstack_conf_dir }}/tools/get-stats.py \
+      source {{ devstack_conf_dir }}/inc/python
+      setup_devstack_virtualenv
+      $PYTHON {{ devstack_conf_dir }}/tools/get-stats.py \
         --db-user="$DATABASE_USER" \
         --db-pass="$DATABASE_PASSWORD" \
         --db-host="$DATABASE_HOST" \

From 29e73a215557b2d20d0d9611e0d5317e08cf9538 Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Tue, 24 Oct 2023 06:18:22 +0200
Subject: [PATCH 2188/2409] Enable performance collection on Debian

Change-Id: I84f1432262138cc9ff0942e1a2b2abe7447afe34
---
 .zuul.yaml | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 6ee8177a6d..12bef3bff1 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -718,9 +718,6 @@
     timeout: 9000
     vars:
       configure_swap_size: 4096
-      devstack_localrc:
-        # TODO(frickler): drop this once wheel build is fixed
-        MYSQL_GATHER_PERFORMANCE: false
 
 - job:
     name: devstack-platform-debian-bullseye
@@ -730,9 +727,6 @@
     timeout: 9000
     vars:
       configure_swap_size: 4096
-      devstack_localrc:
-        # TODO(frickler): drop this once wheel build is fixed
-        MYSQL_GATHER_PERFORMANCE: false
 
 - job:
     name: devstack-platform-rocky-blue-onyx

From bacb8400942b2ed6b724bdd3d28797896e1054c6 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Wed, 25 Oct 2023 12:52:28 -0700
Subject: [PATCH 2189/2409] Enable NEUTRON_ENFORCE_SCOPE to True by default

Neutron bobcat release has enabled the RBAC new defaults
by default. With the latest release of Neutron have new
defaults enable, we should configure the same by default in
devstack. This change make NEUTRON_ENFORCE_SCOPE flag to
True by default so that every job will run with Neutron
new defaults.

As old defaults are still supported (in deprecated way),
we will keep this flag so that we can have one job disable
it and test the old defaults.

Change-Id: I3361d33885b2e3af7cad0141f9b799b2723ee8a1
---
 lib/neutron | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 808043cebe..3628bfc25e 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -92,8 +92,9 @@ NEUTRON_UWSGI_CONF=$NEUTRON_CONF_DIR/neutron-api-uwsgi.ini
 
 # If NEUTRON_ENFORCE_SCOPE == True, it will set "enforce_scope"
 # and "enforce_new_defaults" to True in the Neutron's config to enforce usage
-# of the new RBAC policies and scopes.
-NEUTRON_ENFORCE_SCOPE=$(trueorfalse False NEUTRON_ENFORCE_SCOPE)
+# of the new RBAC policies and scopes. Set it to False if you do not
+# want to run Neutron with new RBAC.
+NEUTRON_ENFORCE_SCOPE=$(trueorfalse True NEUTRON_ENFORCE_SCOPE)
 
 # Agent binaries.  Note, binary paths for other agents are set in per-service
 # scripts in lib/neutron_plugins/services/

From 67630d4c52aef5ddcb15cff4f3b6594d447e8992 Mon Sep 17 00:00:00 2001
From: Artem Goncharov <artem.goncharov@gmail.com>
Date: Sun, 18 Jun 2023 14:46:06 +0200
Subject: [PATCH 2190/2409] Enable keystone token caching by OSC

SDK uses python keyring library to enable token caching. Normally this
is requiring a proper desktop (interactive) session, but there are some
backend plugins working in non-interactive mode. Store cache in an
unencrypted file on FS (this is not worse than storing passwords in
plaintext).

Change-Id: I42d698f15db5918443073fff8f27b926126d1d0f
---
 functions-common            | 10 +++++++++-
 lib/libraries               |  4 ++++
 tools/update_clouds_yaml.py | 27 ++++++++++++++++++++++-----
 3 files changed, 35 insertions(+), 6 deletions(-)

diff --git a/functions-common b/functions-common
index c57c4cc054..03d7c96417 100644
--- a/functions-common
+++ b/functions-common
@@ -1047,6 +1047,8 @@ function get_or_create_service {
             --description="$3" \
             -f value -c id
     )
+    # Drop cached token to invalidate catalog info in the token
+    remove_token_cache
     echo $service_id
 }
 
@@ -1064,7 +1066,6 @@ function _get_or_create_endpoint_with_interface {
         endpoint_id=$(openstack --os-cloud devstack-system-admin endpoint create \
             $1 $2 $3 --region $4 -f value -c id)
     fi
-
     echo $endpoint_id
 }
 
@@ -1088,6 +1089,8 @@ function get_or_create_endpoint {
     if [[ -n "$5" ]]; then
         _get_or_create_endpoint_with_interface $1 internal $5 $2
     fi
+    # Drop cached token to invalidate catalog info in the token
+    remove_token_cache
     # return the public id to indicate success, and this is the endpoint most likely wanted
     echo $public_id
 }
@@ -2517,6 +2520,11 @@ function is_fips_enabled {
     [ "$fips" == "1" ]
 }
 
+function remove_token_cache {
+    # Remove Keyring cache file
+    rm ~/.local/share/python_keyring/keyring_pass.cfg
+}
+
 # Restore xtrace
 $_XTRACE_FUNCTIONS_COMMON
 
diff --git a/lib/libraries b/lib/libraries
index 9ea32304fc..146434e2b9 100755
--- a/lib/libraries
+++ b/lib/libraries
@@ -138,6 +138,10 @@ function install_libs {
     # doesn't pull in etcd3.
     pip_install etcd3
     pip_install etcd3gw
+
+    # Add libraries required for token caching by OpenStackSDK/CLI
+    pip_install keyring
+    pip_install keyrings.alt
 }
 
 # Restore xtrace
diff --git a/tools/update_clouds_yaml.py b/tools/update_clouds_yaml.py
index 74dcdb2a07..918988245b 100755
--- a/tools/update_clouds_yaml.py
+++ b/tools/update_clouds_yaml.py
@@ -30,7 +30,9 @@ def __init__(self, args):
             self._clouds_path = os.path.expanduser(
                 '~/.config/openstack/clouds.yaml')
             self._create_directory = True
-        self._clouds = {}
+        self._keyringrc_path = os.path.expanduser(
+                '~/.config/python_keyring/keyringrc.cfg')
+        self._config = {}
 
         self._cloud = args.os_cloud
         self._cloud_data = {
@@ -65,14 +67,17 @@ def run(self):
     def _read_clouds(self):
         try:
             with open(self._clouds_path) as clouds_file:
-                self._clouds = yaml.safe_load(clouds_file)
+                self._config = yaml.safe_load(clouds_file)
         except IOError:
             # The user doesn't have a clouds.yaml file.
             print("The user clouds.yaml file didn't exist.")
-            self._clouds = {}
+        if "cache" not in self._config:
+            # Enable auth (and only auth) caching. Currently caching into the
+            # file on FS is configured in `_write_clouds` function.
+            self._config["cache"] = {"auth": True}
 
     def _update_clouds(self):
-        self._clouds.setdefault('clouds', {})[self._cloud] = self._cloud_data
+        self._config.setdefault('clouds', {})[self._cloud] = self._cloud_data
 
     def _write_clouds(self):
 
@@ -81,7 +86,19 @@ def _write_clouds(self):
             os.makedirs(clouds_dir)
 
         with open(self._clouds_path, 'w') as clouds_file:
-            yaml.dump(self._clouds, clouds_file, default_flow_style=False)
+            yaml.dump(self._config, clouds_file, default_flow_style=False)
+
+        # Enable keyring token caching
+        keyringrc_dir = os.path.dirname(self._keyringrc_path)
+        os.makedirs(keyringrc_dir, exist_ok=True)
+
+        # Configure auth caching into the file on FS. We do not bother of any
+        # expiration since SDK is smart enough to reauth once the token becomes
+        # invalid.
+        with open(self._keyringrc_path, 'w') as keyringrc_file:
+            keyringrc_file.write("[backend]\n")
+            keyringrc_file.write(
+                "default-keyring=keyrings.alt.file.PlaintextKeyring\n")
 
 
 def main():

From 5123700ea6fe25164bd51e967ce85aaefb5c364c Mon Sep 17 00:00:00 2001
From: Sean Mooney <work@seanmooney.info>
Date: Thu, 19 Oct 2023 17:04:56 +0000
Subject: [PATCH 2191/2409] ignore dbcounter sub dirs

currently id you run devstack with the dbcounter service enabled
the created subdirs show up in git status

this change justs add them to .gitgnore

Change-Id: Iee48eb4e12ac22734c8a2c1dcbe0b92a0a387eaa
---
 .gitignore | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.gitignore b/.gitignore
index 8fe56ad6ab..ad153f4a07 100644
--- a/.gitignore
+++ b/.gitignore
@@ -38,3 +38,5 @@ stack-screenrc
 userrc_early
 AUTHORS
 ChangeLog
+tools/dbcounter/build/
+tools/dbcounter/dbcounter.egg-info/

From 0f402b8327cc3e501df93c735c1b049361ed3dbb Mon Sep 17 00:00:00 2001
From: tzing <tzing0013@gmail.com>
Date: Mon, 6 Nov 2023 02:24:14 +0000
Subject: [PATCH 2192/2409] Fix openEuler support

openEuler 22.03 LTS support was removed from devstack in last
few months due to its libvirt version is too old and the CI job
always fail.

This Patch add a yum repository for libvirt7.2.0, and add the
related CI job to make sure its works well.

Change-Id: Ic507f165cfa117451283360854c4776a968bbb10
---
 .zuul.yaml | 2 ++
 stack.sh   | 6 +++++-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 12bef3bff1..75930112ca 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -934,6 +934,8 @@
         - devstack-platform-rocky-blue-onyx
         - devstack-platform-ubuntu-jammy-ovn-source
         - devstack-platform-ubuntu-jammy-ovs
+        - devstack-platform-openEuler-22.03-ovn-source
+        - devstack-platform-openEuler-22.03-ovs
         - devstack-multinode
         - devstack-unit-tests
         - openstack-tox-bashate
diff --git a/stack.sh b/stack.sh
index 530fda48aa..dce15ac01c 100755
--- a/stack.sh
+++ b/stack.sh
@@ -421,8 +421,12 @@ elif [[ $DISTRO == "openEuler-22.03" ]]; then
     # 1. the hostname package is not installed by default
     # 2. Some necessary packages are in openstack repo, for example liberasurecode-devel
     # 3. python3-pip can be uninstalled by `get_pip.py` automaticly.
-    install_package hostname openstack-release-wallaby
+    # 4. Ensure wget installation before use
+    install_package hostname openstack-release-wallaby wget
     uninstall_package python3-pip
+
+    # Add yum repository for libvirt7.X
+    sudo wget https://eur.openeuler.openatom.cn/coprs/g/sig-openstack/Libvirt-7.X/repo/openeuler-22.03_LTS/group_sig-openstack-Libvirt-7.X-openeuler-22.03_LTS.repo -O /etc/yum.repos.d/libvirt7.2.0.repo
 fi
 
 # Ensure python is installed

From e7c12616e27ad2987c2dead1e1a413aaa2c632ee Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Tue, 14 Nov 2023 16:27:56 +0100
Subject: [PATCH 2193/2409] Add periodic-weekly pipeline with platform jobs

Originally we only had the openeuler jobs there, but the other platforms
could also do with some regular testing.

Change-Id: I93526a4c592d85acd4debf72eb59e306ab8e6382
---
 .zuul.yaml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index 75930112ca..47466cb3eb 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -1053,3 +1053,13 @@
     periodic:
       jobs:
         - devstack-no-tls-proxy
+    periodic-weekly:
+      jobs:
+        - devstack-platform-centos-9-stream
+        - devstack-platform-debian-bookworm
+        - devstack-platform-debian-bullseye
+        - devstack-platform-rocky-blue-onyx
+        - devstack-platform-ubuntu-jammy-ovn-source
+        - devstack-platform-ubuntu-jammy-ovs
+        - devstack-platform-openEuler-22.03-ovn-source
+        - devstack-platform-openEuler-22.03-ovs

From 82c30cd82ee00012d21bee94dad2bcbc2c047f78 Mon Sep 17 00:00:00 2001
From: yatin <ykarel@redhat.com>
Date: Wed, 15 Nov 2023 12:44:50 +0000
Subject: [PATCH 2194/2409] Revert "Enable keystone token caching by OSC"

This reverts commit 67630d4c52aef5ddcb15cff4f3b6594d447e8992.

Reason for revert: Seeing random failures across jobs as sometimes
'keyring_pass.cfg' gets duplicated keys and that makes executions
of any openstackclient command to fail until the file is removed.
This should be handled before re enabling the token caching again.

Change-Id: I3d2fe53a2e7552ac6304c30aa2fe5be33d77df53
Related-Bug: #2042943
---
 functions-common            | 10 +---------
 lib/libraries               |  4 ----
 tools/update_clouds_yaml.py | 27 +++++----------------------
 3 files changed, 6 insertions(+), 35 deletions(-)

diff --git a/functions-common b/functions-common
index 03d7c96417..c57c4cc054 100644
--- a/functions-common
+++ b/functions-common
@@ -1047,8 +1047,6 @@ function get_or_create_service {
             --description="$3" \
             -f value -c id
     )
-    # Drop cached token to invalidate catalog info in the token
-    remove_token_cache
     echo $service_id
 }
 
@@ -1066,6 +1064,7 @@ function _get_or_create_endpoint_with_interface {
         endpoint_id=$(openstack --os-cloud devstack-system-admin endpoint create \
             $1 $2 $3 --region $4 -f value -c id)
     fi
+
     echo $endpoint_id
 }
 
@@ -1089,8 +1088,6 @@ function get_or_create_endpoint {
     if [[ -n "$5" ]]; then
         _get_or_create_endpoint_with_interface $1 internal $5 $2
     fi
-    # Drop cached token to invalidate catalog info in the token
-    remove_token_cache
     # return the public id to indicate success, and this is the endpoint most likely wanted
     echo $public_id
 }
@@ -2520,11 +2517,6 @@ function is_fips_enabled {
     [ "$fips" == "1" ]
 }
 
-function remove_token_cache {
-    # Remove Keyring cache file
-    rm ~/.local/share/python_keyring/keyring_pass.cfg
-}
-
 # Restore xtrace
 $_XTRACE_FUNCTIONS_COMMON
 
diff --git a/lib/libraries b/lib/libraries
index 146434e2b9..9ea32304fc 100755
--- a/lib/libraries
+++ b/lib/libraries
@@ -138,10 +138,6 @@ function install_libs {
     # doesn't pull in etcd3.
     pip_install etcd3
     pip_install etcd3gw
-
-    # Add libraries required for token caching by OpenStackSDK/CLI
-    pip_install keyring
-    pip_install keyrings.alt
 }
 
 # Restore xtrace
diff --git a/tools/update_clouds_yaml.py b/tools/update_clouds_yaml.py
index 918988245b..74dcdb2a07 100755
--- a/tools/update_clouds_yaml.py
+++ b/tools/update_clouds_yaml.py
@@ -30,9 +30,7 @@ def __init__(self, args):
             self._clouds_path = os.path.expanduser(
                 '~/.config/openstack/clouds.yaml')
             self._create_directory = True
-        self._keyringrc_path = os.path.expanduser(
-                '~/.config/python_keyring/keyringrc.cfg')
-        self._config = {}
+        self._clouds = {}
 
         self._cloud = args.os_cloud
         self._cloud_data = {
@@ -67,17 +65,14 @@ def run(self):
     def _read_clouds(self):
         try:
             with open(self._clouds_path) as clouds_file:
-                self._config = yaml.safe_load(clouds_file)
+                self._clouds = yaml.safe_load(clouds_file)
         except IOError:
             # The user doesn't have a clouds.yaml file.
             print("The user clouds.yaml file didn't exist.")
-        if "cache" not in self._config:
-            # Enable auth (and only auth) caching. Currently caching into the
-            # file on FS is configured in `_write_clouds` function.
-            self._config["cache"] = {"auth": True}
+            self._clouds = {}
 
     def _update_clouds(self):
-        self._config.setdefault('clouds', {})[self._cloud] = self._cloud_data
+        self._clouds.setdefault('clouds', {})[self._cloud] = self._cloud_data
 
     def _write_clouds(self):
 
@@ -86,19 +81,7 @@ def _write_clouds(self):
             os.makedirs(clouds_dir)
 
         with open(self._clouds_path, 'w') as clouds_file:
-            yaml.dump(self._config, clouds_file, default_flow_style=False)
-
-        # Enable keyring token caching
-        keyringrc_dir = os.path.dirname(self._keyringrc_path)
-        os.makedirs(keyringrc_dir, exist_ok=True)
-
-        # Configure auth caching into the file on FS. We do not bother of any
-        # expiration since SDK is smart enough to reauth once the token becomes
-        # invalid.
-        with open(self._keyringrc_path, 'w') as keyringrc_file:
-            keyringrc_file.write("[backend]\n")
-            keyringrc_file.write(
-                "default-keyring=keyrings.alt.file.PlaintextKeyring\n")
+            yaml.dump(self._clouds, clouds_file, default_flow_style=False)
 
 
 def main():

From bb0c273697bf54dd569ad38e459cd161b62f96cb Mon Sep 17 00:00:00 2001
From: elajkat <lajos.katona@est.tech>
Date: Thu, 16 Nov 2023 11:30:04 +0100
Subject: [PATCH 2195/2409] Option for SQLAlchemy and alembic git source

Change-Id: If7ff0075834a1e9cee01713676166e56b797debd
Closes-Bug: #2042941
---
 lib/neutron | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/lib/neutron b/lib/neutron
index 3628bfc25e..bc77f161d7 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -158,6 +158,14 @@ if [[ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" && -z "$NEUTRON_ENDPOINT_SERVICE_NAME
     NEUTRON_ENDPOINT_SERVICE_NAME="networking"
 fi
 
+# Source install libraries
+ALEMBIC_REPO=${ALEMBIC_REPO:-https://github.com/sqlalchemy/alembic.git}
+ALEMBIC_DIR=${ALEMBIC_DIR:-$DEST/alembic}
+ALEMBIC_BRANCH=${ALEMBIC_BRANCH:-main}
+SQLALCHEMY_REPO=${SQLALCHEMY_REPO:-https://github.com/sqlalchemy/sqlalchemy.git}
+SQLALCHEMY_DIR=${SQLALCHEMY_DIR:-$DEST/sqlalchemy}
+SQLALCHEMY_BRANCH=${SQLALCHEMY_BRANCH:-main}
+
 # List of config file names in addition to the main plugin config file
 # To add additional plugin config files, use ``neutron_server_config_add``
 # utility function.  For example:
@@ -525,6 +533,17 @@ function install_neutron {
         setup_dev_lib "neutron-lib"
     fi
 
+    # Install SQLAlchemy and alembic from git when these are required
+    # see https://bugs.launchpad.net/neutron/+bug/2042941
+    if use_library_from_git "sqlalchemy"; then
+        git_clone $SQLALCHEMY_REPO $SQLALCHEMY_DIR $SQLALCHEMY_BRANCH
+        setup_develop $SQLALCHEMY_DIR
+    fi
+    if use_library_from_git "alembic"; then
+        git_clone $ALEMBIC_REPO $ALEMBIC_DIR $ALEMBIC_BRANCH
+        setup_develop $ALEMBIC_DIR
+    fi
+
     git_clone $NEUTRON_REPO $NEUTRON_DIR $NEUTRON_BRANCH
     setup_develop $NEUTRON_DIR
 

From 2211c778db0e18702c7177f7750571cba3697509 Mon Sep 17 00:00:00 2001
From: Abhishek Kekane <akekane@redhat.com>
Date: Wed, 22 Nov 2023 06:21:55 +0000
Subject: [PATCH 2196/2409] Allow devstack to set cache driver for glance

Added new devstack variable `GLANCE_CACHE_DRIVER` default
to `sqlite` to set the cache driver for glance service.

Related blueprint centralized-cache-db

Change-Id: I76d064590356e2d65bfc6a3f57d1bdaeeb83a74a
---
 lib/glance | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/glance b/lib/glance
index 796ebdb68d..4ff9a34ca8 100644
--- a/lib/glance
+++ b/lib/glance
@@ -75,6 +75,7 @@ GLANCE_MULTIPLE_FILE_STORES=${GLANCE_MULTIPLE_FILE_STORES:-fast}
 GLANCE_DEFAULT_BACKEND=${GLANCE_DEFAULT_BACKEND:-fast}
 
 GLANCE_CACHE_DIR=${GLANCE_CACHE_DIR:=$DATA_DIR/glance/cache}
+GLANCE_CACHE_DRIVER=${GLANCE_CACHE_DRIVER:-sqlite}
 
 # Full Glance functionality requires running in standalone mode. If we are
 # not in uwsgi mode, then we are standalone, otherwise allow separate control.
@@ -329,6 +330,7 @@ function configure_glance {
     iniset $GLANCE_API_CONF database connection $dburl
     iniset $GLANCE_API_CONF DEFAULT use_syslog $SYSLOG
     iniset $GLANCE_API_CONF DEFAULT image_cache_dir $GLANCE_CACHE_DIR/
+    iniset $GLANCE_API_CONF DEFAULT image_cache_driver $GLANCE_CACHE_DRIVER
     iniset $GLANCE_API_CONF oslo_concurrency lock_path $GLANCE_LOCK_DIR
     iniset $GLANCE_API_CONF paste_deploy flavor keystone+cachemanagement
     configure_keystone_authtoken_middleware $GLANCE_API_CONF glance
@@ -392,6 +394,7 @@ function configure_glance {
     iniset $GLANCE_CACHE_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
     iniset $GLANCE_CACHE_CONF DEFAULT use_syslog $SYSLOG
     iniset $GLANCE_CACHE_CONF DEFAULT image_cache_dir $GLANCE_CACHE_DIR/
+    iniset $GLANCE_CACHE_CONF DEFAULT image_cache_driver $GLANCE_CACHE_DRIVER
     iniset $GLANCE_CACHE_CONF DEFAULT auth_url $KEYSTONE_SERVICE_URI
     iniset $GLANCE_CACHE_CONF DEFAULT admin_tenant_name $SERVICE_PROJECT_NAME
     iniset $GLANCE_CACHE_CONF DEFAULT admin_user glance

From 2e14add0fdbc749f40caf075e42221d85ff2f27e Mon Sep 17 00:00:00 2001
From: Eric Harney <eharney@redhat.com>
Date: Wed, 29 Nov 2023 09:22:10 -0500
Subject: [PATCH 2197/2409] Add cinder-manage to /usr/local/bin/

This is useful in a dev environment.

Change-Id: I247eb4aea23a906d0e667ec6c5ac79f932bdca24
---
 stack.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/stack.sh b/stack.sh
index 530fda48aa..4d649f6cec 100755
--- a/stack.sh
+++ b/stack.sh
@@ -821,6 +821,7 @@ fixup_all
 
 if [[ "$GLOBAL_VENV" == "True" ]] ; then
     # TODO(frickler): find a better solution for this
+    sudo ln -sf /opt/stack/data/venv/bin/cinder-manage /usr/local/bin
     sudo ln -sf /opt/stack/data/venv/bin/cinder-rtstool /usr/local/bin
     sudo ln -sf /opt/stack/data/venv/bin/glance /usr/local/bin
     sudo ln -sf /opt/stack/data/venv/bin/nova-manage /usr/local/bin

From d126330efebb98b7fe8ce74d8da333e13782576d Mon Sep 17 00:00:00 2001
From: Stephen Finucane <sfinucan@redhat.com>
Date: Wed, 6 Dec 2023 09:58:18 +0000
Subject: [PATCH 2198/2409] lib/apache: Rename variable

This is a little more meaningful, IMO.

Change-Id: Ib9d3fdc54b1cdbd822c2a4eca0a3310ca3f6324c
Signed-off-by: Stephen Finucane <sfinucan@redhat.com>
---
 lib/apache | 84 +++++++++++++++++++++++++++---------------------------
 1 file changed, 42 insertions(+), 42 deletions(-)

diff --git a/lib/apache b/lib/apache
index cf7215bef2..9017e0a38a 100644
--- a/lib/apache
+++ b/lib/apache
@@ -238,7 +238,7 @@ function restart_apache_server {
 }
 
 function write_uwsgi_config {
-    local file=$1
+    local conf=$1
     local wsgi=$2
     local url=$3
     local http=$4
@@ -258,38 +258,38 @@ function write_uwsgi_config {
     local socket="$socket_dir/${name}.socket"
 
     # always cleanup given that we are using iniset here
-    rm -rf $file
-    iniset "$file" uwsgi wsgi-file "$wsgi"
-    iniset "$file" uwsgi processes $API_WORKERS
+    rm -rf $conf
+    iniset "$conf" uwsgi wsgi-file "$wsgi"
+    iniset "$conf" uwsgi processes $API_WORKERS
     # This is running standalone
-    iniset "$file" uwsgi master true
+    iniset "$conf" uwsgi master true
     # Set die-on-term & exit-on-reload so that uwsgi shuts down
-    iniset "$file" uwsgi die-on-term true
-    iniset "$file" uwsgi exit-on-reload false
+    iniset "$conf" uwsgi die-on-term true
+    iniset "$conf" uwsgi exit-on-reload false
     # Set worker-reload-mercy so that worker will not exit till the time
     # configured after graceful shutdown
-    iniset "$file" uwsgi worker-reload-mercy $WORKER_TIMEOUT
-    iniset "$file" uwsgi enable-threads true
-    iniset "$file" uwsgi plugins http,python3
+    iniset "$conf" uwsgi worker-reload-mercy $WORKER_TIMEOUT
+    iniset "$conf" uwsgi enable-threads true
+    iniset "$conf" uwsgi plugins http,python3
     # uwsgi recommends this to prevent thundering herd on accept.
-    iniset "$file" uwsgi thunder-lock true
+    iniset "$conf" uwsgi thunder-lock true
     # Set hook to trigger graceful shutdown on SIGTERM
-    iniset "$file" uwsgi hook-master-start "unix_signal:15 gracefully_kill_them_all"
+    iniset "$conf" uwsgi hook-master-start "unix_signal:15 gracefully_kill_them_all"
     # Override the default size for headers from the 4k default.
-    iniset "$file" uwsgi buffer-size 65535
+    iniset "$conf" uwsgi buffer-size 65535
     # Make sure the client doesn't try to re-use the connection.
-    iniset "$file" uwsgi add-header "Connection: close"
+    iniset "$conf" uwsgi add-header "Connection: close"
     # This ensures that file descriptors aren't shared between processes.
-    iniset "$file" uwsgi lazy-apps true
+    iniset "$conf" uwsgi lazy-apps true
 
     # If we said bind directly to http, then do that and don't start the apache proxy
     if [[ -n "$http" ]]; then
-        iniset "$file" uwsgi http $http
+        iniset "$conf" uwsgi http $http
     else
         local apache_conf=""
         apache_conf=$(apache_site_config_for $name)
-        iniset "$file" uwsgi socket "$socket"
-        iniset "$file" uwsgi chmod-socket 666
+        iniset "$conf" uwsgi socket "$socket"
+        iniset "$conf" uwsgi chmod-socket 666
         echo "ProxyPass \"${url}\" \"unix:${socket}|uwsgi://uwsgi-uds-${name}\" retry=0 acquire=1 " | sudo tee -a $apache_conf
         enable_apache_site $name
         restart_apache_server
@@ -303,7 +303,7 @@ function write_uwsgi_config {
 # but that involves having apache buffer the request before sending it to
 # uwsgi.
 function write_local_uwsgi_http_config {
-    local file=$1
+    local conf=$1
     local wsgi=$2
     local url=$3
     name=$(basename $wsgi)
@@ -312,38 +312,38 @@ function write_local_uwsgi_http_config {
     # a private view of it on some platforms.
 
     # always cleanup given that we are using iniset here
-    rm -rf $file
-    iniset "$file" uwsgi wsgi-file "$wsgi"
+    rm -rf $conf
+    iniset "$conf" uwsgi wsgi-file "$wsgi"
     port=$(get_random_port)
-    iniset "$file" uwsgi http-socket "$APACHE_LOCAL_HOST:$port"
-    iniset "$file" uwsgi processes $API_WORKERS
+    iniset "$conf" uwsgi http-socket "$APACHE_LOCAL_HOST:$port"
+    iniset "$conf" uwsgi processes $API_WORKERS
     # This is running standalone
-    iniset "$file" uwsgi master true
+    iniset "$conf" uwsgi master true
     # Set die-on-term & exit-on-reload so that uwsgi shuts down
-    iniset "$file" uwsgi die-on-term true
-    iniset "$file" uwsgi exit-on-reload false
-    iniset "$file" uwsgi enable-threads true
-    iniset "$file" uwsgi plugins http,python3
+    iniset "$conf" uwsgi die-on-term true
+    iniset "$conf" uwsgi exit-on-reload false
+    iniset "$conf" uwsgi enable-threads true
+    iniset "$conf" uwsgi plugins http,python3
     # uwsgi recommends this to prevent thundering herd on accept.
-    iniset "$file" uwsgi thunder-lock true
+    iniset "$conf" uwsgi thunder-lock true
     # Set hook to trigger graceful shutdown on SIGTERM
-    iniset "$file" uwsgi hook-master-start "unix_signal:15 gracefully_kill_them_all"
+    iniset "$conf" uwsgi hook-master-start "unix_signal:15 gracefully_kill_them_all"
     # Set worker-reload-mercy so that worker will not exit till the time
     # configured after graceful shutdown
-    iniset "$file" uwsgi worker-reload-mercy $WORKER_TIMEOUT
+    iniset "$conf" uwsgi worker-reload-mercy $WORKER_TIMEOUT
     # Override the default size for headers from the 4k default.
-    iniset "$file" uwsgi buffer-size 65535
+    iniset "$conf" uwsgi buffer-size 65535
     # Make sure the client doesn't try to re-use the connection.
-    iniset "$file" uwsgi add-header "Connection: close"
+    iniset "$conf" uwsgi add-header "Connection: close"
     # This ensures that file descriptors aren't shared between processes.
-    iniset "$file" uwsgi lazy-apps true
-    iniset "$file" uwsgi chmod-socket 666
-    iniset "$file" uwsgi http-raw-body true
-    iniset "$file" uwsgi http-chunked-input true
-    iniset "$file" uwsgi http-auto-chunked true
-    iniset "$file" uwsgi http-keepalive false
+    iniset "$conf" uwsgi lazy-apps true
+    iniset "$conf" uwsgi chmod-socket 666
+    iniset "$conf" uwsgi http-raw-body true
+    iniset "$conf" uwsgi http-chunked-input true
+    iniset "$conf" uwsgi http-auto-chunked true
+    iniset "$conf" uwsgi http-keepalive false
     # Increase socket timeout for slow chunked uploads
-    iniset "$file" uwsgi socket-timeout 30
+    iniset "$conf" uwsgi socket-timeout 30
 
     enable_apache_mod proxy
     enable_apache_mod proxy_http
@@ -376,12 +376,12 @@ function write_local_proxy_http_config {
 }
 
 function remove_uwsgi_config {
-    local file=$1
+    local conf=$1
     local wsgi=$2
     local name=""
     name=$(basename $wsgi)
 
-    rm -rf $file
+    rm -rf $conf
     disable_apache_site $name
 }
 

From 6b0f055b4ed407f8a190f768d0e654235ac015dd Mon Sep 17 00:00:00 2001
From: Yadnesh Kulkarni <yadnesh_kulkarni@proton.me>
Date: Thu, 23 Nov 2023 11:59:49 +0530
Subject: [PATCH 2199/2409] Make multiple attempts to download image

Downloading an image can fail due to network issues, so let's
retry 5 times before giving up. We have seen issues in CI due
to network issues as described below and in the Related-Bug:-

Often times fetching Fedora image in FIPS jobs fails due to
"GnuTLS: One of the involved algorithms has insufficient security level."

This occurs when request to pull image is redirected to a mirror that's
incompatible with FIPS enabled system.

Making multiple attempts to download images could provide better chance of
pulling images from different mirrors and avoid failure of the job.
This will also save a few rechecks.

Related-Bug: #2045725
Change-Id: I7163aea4d121cb27620e4f2a083a543abfc286bf
---
 functions | 21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/functions b/functions
index 7ada0feba7..01e1d259ad 100644
--- a/functions
+++ b/functions
@@ -133,17 +133,28 @@ function upload_image {
 
     local image image_fname image_name
 
+    local max_attempts=5
+
     # Create a directory for the downloaded image tarballs.
     mkdir -p $FILES/images
     image_fname=`basename "$image_url"`
     if [[ $image_url != file* ]]; then
         # Downloads the image (uec ami+akistyle), then extracts it.
         if [[ ! -f $FILES/$image_fname || "$(stat -c "%s" $FILES/$image_fname)" = "0" ]]; then
-            wget --progress=dot:giga -c $image_url -O $FILES/$image_fname
-            if [[ $? -ne 0 ]]; then
-                echo "Not found: $image_url"
-                return
-            fi
+            for attempt in `seq $max_attempts`; do
+                local rc=0
+                wget --progress=dot:giga -c $image_url -O $FILES/$image_fname || rc=$?
+                if [[ $rc -ne 0 ]]; then
+                    if [[ "$attempt" -eq "$max_attempts" ]]; then
+                        echo "Not found: $image_url"
+                        return
+                    fi
+                    echo "Download failed, retrying in $attempt second, attempt: $attempt"
+                    sleep $attempt
+                else
+                    break
+                fi
+            done
         fi
         image="$FILES/${image_fname}"
     else

From 5e98509eaad724bb68d1a457bd690a387c51a114 Mon Sep 17 00:00:00 2001
From: Rajat Dhasmana <rajatdhasmana@gmail.com>
Date: Tue, 12 Dec 2023 12:40:58 +0000
Subject: [PATCH 2200/2409] Increase timeout for reimage operation

Looking at the recent failures in the tempest-integrated-compute
job, the reimage operation seems to be taking longer than our
expected time of 60 seconds (which was increased because of a similar
failure in the past, default is 20 seconds).
The main culprit for this failure is the image conversion from qcow2
to raw which is taking ~159 seconds.

Dec 05 13:29:59.709129 np0035951188 cinder-volume[77000]: DEBUG oslo_concurrency.processutils [req-5113eccb-05ba-486a-8130-a58898c8ad35 req-0edf972a-109a-465f-a771-ceb87ecbda3e tempest-ServerActionsV293TestJSON-1780705112 None] CMD "sudo cinder-rootwrap /etc/cinder/rootwrap.conf qemu-img convert -O raw -t none -f qcow2 /opt/stack/data/cinder/conversion/image_download_dbe01f18-1c90-4536-a09a-b49f0811c7a0_copod3cm /dev/mapper/stack--volumes--lvmdriver--1-volume--073a98e8--3c89--4734--9ae5--59af25f8914a" returned: 0 in 159.272s {{(pid=77000) execute /opt/stack/data/venv/lib/python3.10/site-packages/oslo_concurrency/processutils.py:422}}

The recent run took ~165 seconds on the cinder side but it failed
early since the nova operation timed out in 60 seconds hence
deleting the volume.
To be on the safer side, 180 seconds seems to be a sane time for
the operation to complete which this patch configures.

Closes-Bug: 2046252
Change-Id: I8a9628216038f6d363cab5dd8177274c9cfc17c2
---
 lib/nova | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index b04f94beef..17c90dfe26 100644
--- a/lib/nova
+++ b/lib/nova
@@ -1054,7 +1054,7 @@ function start_nova_compute {
 
     # Set rebuild timeout longer for BFV instances because we likely have
     # slower disk than expected. Default is 20s/GB
-    iniset $NOVA_CPU_CONF DEFAULT reimage_timeout_per_gb 60
+    iniset $NOVA_CPU_CONF DEFAULT reimage_timeout_per_gb 180
 
     # Configure the OVSDB connection for os-vif
     if [ -n "$OVSDB_SERVER_LOCAL_HOST" ]; then

From 6fc0e74aa7369ed1503e2d0f12d7543d4835212e Mon Sep 17 00:00:00 2001
From: Fabian Wiesel <fabian.wiesel@sap.com>
Date: Tue, 19 Dec 2023 11:24:02 +0100
Subject: [PATCH 2201/2409] Fix spelling of `ADITIONAL_VENV_PACKAGES`

This preserved `ADITIONAL_VENV_PACKAGES` as an input for backwards
compatiblity, but takes `ADDITIONAL_VENV_PACKAGES` with priority.

Fixes spelling in comment.

Related-Bug: #2046936
Change-Id: I84151d8f71b12da134e8fb9dbf3ae30f2a171fe2
---
 stackrc | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/stackrc b/stackrc
index 464e935839..6cbadf9915 100644
--- a/stackrc
+++ b/stackrc
@@ -207,8 +207,9 @@ fi
 USE_VENV=$(trueorfalse False USE_VENV)
 
 # Add packages that need to be installed into a venv but are not in any
-# requirmenets files here, in a comma-separated list
-ADDITIONAL_VENV_PACKAGES=${ADITIONAL_VENV_PACKAGES:-""}
+# requirements files here, in a comma-separated list.
+# Currently only used when USE_VENV is true (individual project venvs)
+ADDITIONAL_VENV_PACKAGES=${ADDITIONAL_VENV_PACKAGES:-""}}
 
 # This can be used to turn database query logging on and off
 # (currently only implemented for MySQL backend)

From 7699ce2d5c465f86f2aace7af6b150dceb0e6e1c Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Mon, 25 Dec 2023 03:14:20 +0000
Subject: [PATCH 2202/2409] Updated from generate-devstack-plugins-list

Change-Id: Ie5cbd87269a10d6abdf1d24f7e6224d9aac3bf5d
---
 doc/source/plugin-registry.rst | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index b2e733337a..f70041162b 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -85,6 +85,7 @@ openstack/octavia-dashboard              `https://opendev.org/openstack/octavia-
 openstack/octavia-tempest-plugin         `https://opendev.org/openstack/octavia-tempest-plugin <https://opendev.org/openstack/octavia-tempest-plugin>`__
 openstack/openstacksdk                   `https://opendev.org/openstack/openstacksdk <https://opendev.org/openstack/openstacksdk>`__
 openstack/osprofiler                     `https://opendev.org/openstack/osprofiler <https://opendev.org/openstack/osprofiler>`__
+openstack/ovn-bgp-agent                  `https://opendev.org/openstack/ovn-bgp-agent <https://opendev.org/openstack/ovn-bgp-agent>`__
 openstack/ovn-octavia-provider           `https://opendev.org/openstack/ovn-octavia-provider <https://opendev.org/openstack/ovn-octavia-provider>`__
 openstack/rally-openstack                `https://opendev.org/openstack/rally-openstack <https://opendev.org/openstack/rally-openstack>`__
 openstack/sahara                         `https://opendev.org/openstack/sahara <https://opendev.org/openstack/sahara>`__
@@ -185,6 +186,7 @@ x/trio2o                                 `https://opendev.org/x/trio2o <https://
 x/valet                                  `https://opendev.org/x/valet <https://opendev.org/x/valet>`__
 x/vmware-nsx                             `https://opendev.org/x/vmware-nsx <https://opendev.org/x/vmware-nsx>`__
 x/vmware-vspc                            `https://opendev.org/x/vmware-vspc <https://opendev.org/x/vmware-vspc>`__
+x/whitebox-neutron-tempest-plugin        `https://opendev.org/x/whitebox-neutron-tempest-plugin <https://opendev.org/x/whitebox-neutron-tempest-plugin>`__
 ======================================== ===
 
 

From a2da805f8107703e5f6738399ce5f5e358190fdc Mon Sep 17 00:00:00 2001
From: Fabian Wiesel <fabian.wiesel@sap.com>
Date: Mon, 8 Jan 2024 10:18:28 +0100
Subject: [PATCH 2203/2409] Fixup of 'Fix spelling of
 `ADITIONAL_VENV_PACKAGES`'

Introduced a dangling } in the environment variable.
This removes it.

Change-Id: If9413dc1751399e5b9c9a0094772394252e5a81c
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 6cbadf9915..59ba9074f2 100644
--- a/stackrc
+++ b/stackrc
@@ -209,7 +209,7 @@ USE_VENV=$(trueorfalse False USE_VENV)
 # Add packages that need to be installed into a venv but are not in any
 # requirements files here, in a comma-separated list.
 # Currently only used when USE_VENV is true (individual project venvs)
-ADDITIONAL_VENV_PACKAGES=${ADDITIONAL_VENV_PACKAGES:-""}}
+ADDITIONAL_VENV_PACKAGES=${ADDITIONAL_VENV_PACKAGES:-""}
 
 # This can be used to turn database query logging on and off
 # (currently only implemented for MySQL backend)

From 6091df25a39c9b17883d86ccb091bf2b9c39aa15 Mon Sep 17 00:00:00 2001
From: Rodolfo Alonso Hernandez <ralonsoh@redhat.com>
Date: Wed, 20 Dec 2023 23:06:18 +0000
Subject: [PATCH 2204/2409] [OVN] Add support for the Neutron OVN agent service

The Neutron OVN agent is a service that could run in any node. The
functionality will depend on the extensions configured. This new
agent is meant to be the replacement for the Neutron OVN metadata
agent once the "metadata" extension is implemented in this service
[1].

[1]https://review.opendev.org/c/openstack/neutron/+/898238

Related-Bug: #2017871
Change-Id: I8f82f0047e89aac122a67f59db84f03e1a6bf519
---
 lib/neutron_plugins/ovn_agent | 62 ++++++++++++++++++++++++++++-------
 1 file changed, 50 insertions(+), 12 deletions(-)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index c51b708130..e646258651 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -91,9 +91,14 @@ OVN_GENEVE_OVERHEAD=${OVN_GENEVE_OVERHEAD:-38}
 # http://www.openvswitch.org/support/dist-docs/ovs-appctl.8.txt
 OVN_DBS_LOG_LEVEL=${OVN_DBS_LOG_LEVEL:-info}
 
+# OVN metadata agent configuration
 OVN_META_CONF=$NEUTRON_CONF_DIR/neutron_ovn_metadata_agent.ini
 OVN_META_DATA_HOST=${OVN_META_DATA_HOST:-$(ipv6_unquote $SERVICE_HOST)}
 
+# OVN agent configuration
+OVN_AGENT_CONF=$NEUTRON_CONF_DIR/plugins/ml2/ovn_agent.ini
+OVN_AGENT_EXTENSIONS=${OVN_AGENT_EXTENSIONS:-}
+
 # If True (default) the node will be considered a gateway node.
 ENABLE_CHASSIS_AS_GW=$(trueorfalse True ENABLE_CHASSIS_AS_GW)
 OVN_L3_CREATE_PUBLIC_NETWORK=$(trueorfalse True OVN_L3_CREATE_PUBLIC_NETWORK)
@@ -132,6 +137,7 @@ OVN_RUNDIR=$OVS_PREFIX/var/run/ovn
 
 NEUTRON_OVN_BIN_DIR=$(get_python_exec_prefix)
 NEUTRON_OVN_METADATA_BINARY="neutron-ovn-metadata-agent"
+NEUTRON_OVN_AGENT_BINARY="neutron-ovn-agent"
 
 STACK_GROUP="$( id --group --name "$STACK_USER" )"
 
@@ -487,6 +493,8 @@ function configure_ovn_plugin {
 
         if is_service_enabled q-ovn-metadata-agent neutron-ovn-metadata-agent; then
             populate_ml2_config /$Q_PLUGIN_CONF_FILE ovn ovn_metadata_enabled=True
+        elif is_service_enabled q-ovn-agent neutron-ovn-agent && [[ "$OVN_AGENT_EXTENSIONS" =~ 'metadata' ]]; then
+            populate_ml2_config /$Q_PLUGIN_CONF_FILE ovn ovn_metadata_enabled=True
         else
             populate_ml2_config /$Q_PLUGIN_CONF_FILE ovn ovn_metadata_enabled=False
         fi
@@ -508,6 +516,8 @@ function configure_ovn_plugin {
     if is_service_enabled n-api-meta ; then
         if is_service_enabled q-ovn-metadata-agent neutron-ovn-metadata-agent; then
             iniset $NOVA_CONF neutron service_metadata_proxy True
+        elif is_service_enabled q-ovn-agent neutron-ovn-agent && [[ "$OVN_AGENT_EXTENSIONS" =~ 'metadata' ]]; then
+            iniset $NOVA_CONF neutron service_metadata_proxy True
         fi
     fi
 }
@@ -539,29 +549,42 @@ function configure_ovn {
     fi
 
     # Metadata
-    if is_service_enabled q-ovn-metadata-agent neutron-ovn-metadata-agent && is_service_enabled ovn-controller; then
+    local sample_file=""
+    local config_file=""
+    if is_service_enabled q-ovn-agent neutron-ovn-agent && [[ "$OVN_AGENT_EXTENSIONS" =~ 'metadata' ]] && is_service_enabled ovn-controller; then
+        sample_file=$NEUTRON_DIR/etc/neutron/plugins/ml2/ovn_agent.ini.sample
+        config_file=$OVN_AGENT_CONF
+    elif is_service_enabled q-ovn-metadata-agent neutron-ovn-metadata-agent && is_service_enabled ovn-controller; then
+        sample_file=$NEUTRON_DIR/etc/neutron_ovn_metadata_agent.ini.sample
+        config_file=$OVN_META_CONF
+    fi
+    if [ -n ${config_file} ]; then
         sudo install -d -o $STACK_USER $NEUTRON_CONF_DIR
 
         mkdir -p $NEUTRON_DIR/etc/neutron/plugins/ml2
         (cd $NEUTRON_DIR && exec ./tools/generate_config_file_samples.sh)
 
-        cp $NEUTRON_DIR/etc/neutron_ovn_metadata_agent.ini.sample $OVN_META_CONF
-        configure_root_helper_options $OVN_META_CONF
+        cp $sample_file $config_file
+        configure_root_helper_options $config_file
 
-        iniset $OVN_META_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-        iniset $OVN_META_CONF DEFAULT nova_metadata_host $OVN_META_DATA_HOST
-        iniset $OVN_META_CONF DEFAULT metadata_workers $API_WORKERS
-        iniset $OVN_META_CONF DEFAULT state_path $DATA_DIR/neutron
-        iniset $OVN_META_CONF ovs ovsdb_connection tcp:$OVSDB_SERVER_LOCAL_HOST:6640
-        iniset $OVN_META_CONF ovn ovn_sb_connection $OVN_SB_REMOTE
+        iniset $config_file DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
+        iniset $config_file DEFAULT nova_metadata_host $OVN_META_DATA_HOST
+        iniset $config_file DEFAULT metadata_workers $API_WORKERS
+        iniset $config_file DEFAULT state_path $DATA_DIR/neutron
+        iniset $config_file ovs ovsdb_connection tcp:$OVSDB_SERVER_LOCAL_HOST:6640
+        iniset $config_file ovn ovn_sb_connection $OVN_SB_REMOTE
         if is_service_enabled tls-proxy; then
-            iniset $OVN_META_CONF ovn \
+            iniset $config_file ovn \
                 ovn_sb_ca_cert $INT_CA_DIR/ca-chain.pem
-            iniset $OVN_META_CONF ovn \
+            iniset $config_file ovn \
                 ovn_sb_certificate $INT_CA_DIR/$DEVSTACK_CERT_NAME.crt
-            iniset $OVN_META_CONF ovn \
+            iniset $config_file ovn \
                 ovn_sb_private_key $INT_CA_DIR/private/$DEVSTACK_CERT_NAME.key
         fi
+        if [[ $config_file == $OVN_AGENT_CONF ]]; then
+            iniset $config_file agent extensions $OVN_AGENT_EXTENSIONS
+            iniset $config_file ovn ovn_nb_connection $OVN_NB_REMOTE
+        fi
     fi
 }
 
@@ -684,6 +707,9 @@ function _start_ovn_services {
     if is_service_enabled q-ovn-metadata-agent neutron-ovn-metadata-agent ; then
         _start_process "devstack@q-ovn-metadata-agent.service"
     fi
+    if is_service_enabled q-ovn-agent neutron-ovn-agent ; then
+        _start_process "devstack@q-ovn-agent.service"
+    fi
 }
 
 # start_ovn() - Start running processes, including screen
@@ -750,6 +776,12 @@ function start_ovn {
         setup_logging $OVN_META_CONF
     fi
 
+    if is_service_enabled q-ovn-agent neutron-ovn-agent; then
+        run_process q-ovn-agent "$NEUTRON_OVN_BIN_DIR/$NEUTRON_OVN_AGENT_BINARY --config-file $OVN_AGENT_CONF"
+        # Format logging
+        setup_logging $OVN_AGENT_CONF
+    fi
+
     _start_ovn_services
 }
 
@@ -774,6 +806,12 @@ function stop_ovn {
         sudo pkill -9 -f "[h]aproxy" || :
         _stop_process "devstack@q-ovn-metadata-agent.service"
     fi
+    if is_service_enabled q-ovn-agent neutron-ovn-agent; then
+        # pkill takes care not to kill itself, but it may kill its parent
+        # sudo unless we use the "ps | grep [f]oo" trick
+        sudo pkill -9 -f "[h]aproxy" || :
+        _stop_process "devstack@q-ovn-agent.service"
+    fi
     if is_service_enabled ovn-controller-vtep ; then
         _stop_process "$OVN_CONTROLLER_VTEP_SERVICE"
     fi

From 224fe1b09adb3adcdd02d680a46eeed5b271f7e4 Mon Sep 17 00:00:00 2001
From: Sean Mooney <work@seanmooney.info>
Date: Mon, 7 Aug 2023 19:30:31 +0000
Subject: [PATCH 2205/2409] add support for zswap and ksmtuned

This change add a new lib/host-mem file and moves the existing
ksm support to a new configure_ksm function.
Additional support for ksmtuned is added with a new flag
"ENABLE_KSMTUNED" which defaults to true.

This change also adds support for zswap. zswap is disabled
by default. When enabled on ubuntu lz4 will
be used as the default compressor and z3fold as the zpool.
On non debian distros the compressor and zpool are not set.
The default values should result in very low overhead although
the zstd compressor may provide better overall performance in ci
or with slow io due to the higher compression ratio.

Additionally memory and network sysctl tunings are optionally applied
to defer writes, prefer swapping and optimise tcp connection
startup and keepalive. The sysctl tunings are disabled by default
The base devstack job has been modifed to enable zram and sysctl
tuning.

Both ksm and zswap are wrapped by a tune_host function
which is now called very early in devstack to ensure
they are configured before any memory/network intensive
operations are executed.

The ci jobs do not enable this functionality by default.
To use this functionaltiy define

        ENABLE_SYSCTL_MEM_TUNING: true
        ENABLE_SYSCTL_NET_TUNING: true
        ENABLE_ZSWAP: true

in the devstack_localrc section of the job vars.

Change-Id: Ia5202d5a9903492a4c18b50ea8d12bd91cc9f135
---
 functions-common | 21 +++++++++++
 lib/host         | 98 ++++++++++++++++++++++++++++++++++++++++++++++++
 stack.sh         | 22 +++--------
 stackrc          |  9 -----
 4 files changed, 125 insertions(+), 25 deletions(-)
 create mode 100644 lib/host

diff --git a/functions-common b/functions-common
index c57c4cc054..5238dff30a 100644
--- a/functions-common
+++ b/functions-common
@@ -236,6 +236,27 @@ function trueorfalse {
     $xtrace
 }
 
+# bool_to_int <True|False>
+#
+# Convert True|False to int 1 or 0
+# This function can be used to convert the output of trueorfalse
+# to an int follow c conventions where false is 0 and 1 it true.
+function bool_to_int {
+    local xtrace
+    xtrace=$(set +o | grep xtrace)
+    set +o xtrace
+    if [ -z $1 ]; then
+        die $LINENO "Bool value required"
+    fi
+    if [[ $1 == "True" ]] ; then
+        echo '1'
+    else
+        echo '0'
+    fi
+    $xtrace
+}
+
+
 function isset {
     [[ -v "$1" ]]
 }
diff --git a/lib/host b/lib/host
new file mode 100644
index 0000000000..95c5b9bbcb
--- /dev/null
+++ b/lib/host
@@ -0,0 +1,98 @@
+#!/bin/bash
+
+# Kernel Samepage Merging (KSM)
+# -----------------------------
+
+# Processes that mark their memory as mergeable can share identical memory
+# pages if KSM is enabled. This is particularly useful for nova + libvirt
+# backends but any other setup that marks its memory as mergeable can take
+# advantage. The drawback is there is higher cpu load; however, we tend to
+# be memory bound not cpu bound so enable KSM by default but allow people
+# to opt out if the CPU time is more important to them.
+ENABLE_KSM=$(trueorfalse True ENABLE_KSM)
+ENABLE_KSMTUNED=$(trueorfalse True ENABLE_KSMTUNED)
+function configure_ksm {
+    if [[ $ENABLE_KSMTUNED == "True" ]] ; then
+        install_package "ksmtuned"
+    fi
+    if [[ -f /sys/kernel/mm/ksm/run ]] ; then
+        echo $(bool_to_int ENABLE_KSM) | sudo tee /sys/kernel/mm/ksm/run
+    fi
+}
+
+# Compressed swap (ZSWAP)
+#------------------------
+
+# as noted in the kernel docs https://docs.kernel.org/admin-guide/mm/zswap.html
+# Zswap is a lightweight compressed cache for swap pages.
+# It takes pages that are in the process of being swapped out and attempts
+# to compress them into a dynamically allocated RAM-based memory pool.
+# zswap basically trades CPU cycles for potentially reduced swap I/O.
+# This trade-off can also result in a significant performance improvement
+# if reads from the compressed cache are faster than reads from a swap device.
+
+ENABLE_ZSWAP=$(trueorfalse False ENABLE_ZSWAP)
+# lz4 is very fast although it does not have the best compression
+# zstd has much better compression but more latency
+ZSWAP_COMPRESSOR=${ZSWAP_COMPRESSOR:="lz4"}
+ZSWAP_ZPOOL=${ZSWAP_ZPOOL:="z3fold"}
+function configure_zswap {
+    if [[ $ENABLE_KSMTUNED == "True" ]] ; then
+        # Centos 9 stream seems to only support enabling but not run time
+        # tuning so dont try to choose better default on centos
+        if is_ubuntu; then
+            echo ${ZSWAP_COMPRESSOR} | sudo tee /sys/module/zswap/parameters/compressor
+            echo ${ZSWAP_ZPOOL} | sudo tee /sys/module/zswap/parameters/zpool
+        fi
+        echo 1 | sudo tee /sys/module/zswap/parameters/enabled
+        # print curent zswap kernel config
+        sudo grep -R . /sys/module/zswap/parameters || /bin/true
+    fi
+}
+
+ENABLE_SYSCTL_MEM_TUNING=$(trueorfalse False ENABLE_SYSCTL_MEM_TUNING)
+function configure_sysctl_mem_parmaters {
+    if [[ $ENABLE_SYSCTL_MEM_TUNING == "True" ]] ; then
+        # defer write when memory is available
+        sudo sysctl -w vm.dirty_ratio=60
+        sudo sysctl -w vm.dirty_background_ratio=10
+        sudo sysctl -w vm.vfs_cache_pressure=50
+        # assume swap is compressed so on new kernels
+        # give it equal priority as page cache which is
+        # uncompressed. on kernels < 5.8 the max is 100
+        # not 200 so it will strongly prefer swapping.
+        sudo sysctl -w vm.swappiness=100
+        sudo grep -R . /proc/sys/vm/  || /bin/true
+    fi
+}
+
+function configure_host_mem {
+    configure_zswap
+    configure_ksm
+    configure_sysctl_mem_parmaters
+}
+
+ENABLE_SYSCTL_NET_TUNING=$(trueorfalse False ENABLE_SYSCTL_NET_TUNING)
+function configure_sysctl_net_parmaters {
+    if [[ $ENABLE_SYSCTL_NET_TUNING == "True" ]] ; then
+        # detect dead TCP connections after 120 seconds
+        sudo sysctl -w net.ipv4.tcp_keepalive_time=60
+        sudo sysctl -w net.ipv4.tcp_keepalive_intvl=10
+        sudo sysctl -w net.ipv4.tcp_keepalive_probes=6
+        # reudce network latency for new connections
+        sudo sysctl -w net.ipv4.tcp_fastopen=3
+        # print tcp options
+        sudo grep -R . /proc/sys/net/ipv4/tcp* || /bin/true
+        # disable qos by default
+        sudo sysctl -w net.core.default_qdisc=pfifo_fast
+    fi
+}
+
+function configure_host_net {
+    configure_sysctl_net_parmaters
+}
+
+function tune_host {
+    configure_host_mem
+    configure_host_net
+}
\ No newline at end of file
diff --git a/stack.sh b/stack.sh
index dce15ac01c..a816efda22 100755
--- a/stack.sh
+++ b/stack.sh
@@ -611,6 +611,12 @@ rm -f $SSL_BUNDLE_FILE
 source $TOP_DIR/lib/database
 source $TOP_DIR/lib/rpc_backend
 
+# load host tuning functions and defaults
+source $TOP_DIR/lib/host
+# tune host memory early to ensure zswap/ksm are configured before
+# doing memory intensive operation like cloning repos or unpacking packages.
+tune_host
+
 # Configure Projects
 # ==================
 
@@ -1079,22 +1085,6 @@ fi
 # Save configuration values
 save_stackenv $LINENO
 
-# Kernel Samepage Merging (KSM)
-# -----------------------------
-
-# Processes that mark their memory as mergeable can share identical memory
-# pages if KSM is enabled. This is particularly useful for nova + libvirt
-# backends but any other setup that marks its memory as mergeable can take
-# advantage. The drawback is there is higher cpu load; however, we tend to
-# be memory bound not cpu bound so enable KSM by default but allow people
-# to opt out if the CPU time is more important to them.
-
-if [[ $ENABLE_KSM == "True" ]] ; then
-    if [[ -f /sys/kernel/mm/ksm/run ]] ; then
-        sudo sh -c "echo 1 > /sys/kernel/mm/ksm/run"
-    fi
-fi
-
 
 # Start Services
 # ==============
diff --git a/stackrc b/stackrc
index 59ba9074f2..097913a4e9 100644
--- a/stackrc
+++ b/stackrc
@@ -121,15 +121,6 @@ else
     SYSTEMCTL="sudo systemctl"
 fi
 
-
-# Whether or not to enable Kernel Samepage Merging (KSM) if available.
-# This allows programs that mark their memory as mergeable to share
-# memory pages if they are identical. This is particularly useful with
-# libvirt backends. This reduces memory usage at the cost of CPU overhead
-# to scan memory. We default to enabling it because we tend to be more
-# memory constrained than CPU bound.
-ENABLE_KSM=$(trueorfalse True ENABLE_KSM)
-
 # Passwords generated by interactive devstack runs
 if [[ -r $RC_DIR/.localrc.password ]]; then
     source $RC_DIR/.localrc.password

From 5c1736b78256f5da86a91c4489f43f8ba1bce224 Mon Sep 17 00:00:00 2001
From: Sean Mooney <work@seanmooney.info>
Date: Wed, 24 Jan 2024 10:53:12 +0000
Subject: [PATCH 2206/2409] fix zswap enable flag

zswap should only be enabled if ENABLE_ZSWAP is true.
The if condition was checking ENABLE_KSMTUNED.
That is now fixed.

Change-Id: I76ba139de69fb1710bcb96cc9f638260463e2032
---
 lib/host | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/host b/lib/host
index 95c5b9bbcb..2fa22e24ea 100644
--- a/lib/host
+++ b/lib/host
@@ -37,7 +37,7 @@ ENABLE_ZSWAP=$(trueorfalse False ENABLE_ZSWAP)
 ZSWAP_COMPRESSOR=${ZSWAP_COMPRESSOR:="lz4"}
 ZSWAP_ZPOOL=${ZSWAP_ZPOOL:="z3fold"}
 function configure_zswap {
-    if [[ $ENABLE_KSMTUNED == "True" ]] ; then
+    if [[ $ENABLE_ZSWAP == "True" ]] ; then
         # Centos 9 stream seems to only support enabling but not run time
         # tuning so dont try to choose better default on centos
         if is_ubuntu; then

From b485549efc9851bfb2cabd1fce40cf39c403c24e Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Sat, 27 Jan 2024 18:58:11 +0900
Subject: [PATCH 2207/2409] Uncap bashate

The bashate tool has been very stable for a while and we rarely expect
changes which may break existing scripts.

This removes the current capping to avoid updating the upper limit when
when a new release is created in bashate.

Change-Id: Iae94811aebf58b491d6b2b2773db88ac50fdd737
---
 tox.ini | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tox.ini b/tox.ini
index ec764abc87..26cd68c031 100644
--- a/tox.ini
+++ b/tox.ini
@@ -12,7 +12,7 @@ basepython = python3
 # against devstack, just set BASHATE_INSTALL_PATH=/path/... to your
 # modified bashate tree
 deps =
-   {env:BASHATE_INSTALL_PATH:bashate==2.0.0}
+   {env:BASHATE_INSTALL_PATH:bashate}
 allowlist_externals = bash
 commands = bash -c "find {toxinidir}             \
          -not \( -type d -name .?\* -prune \)    \

From d251d12d71ebca758e8584204a0ba14d3c6bab6c Mon Sep 17 00:00:00 2001
From: Abhishek Kekane <akekane@redhat.com>
Date: Mon, 29 Jan 2024 18:20:06 +0000
Subject: [PATCH 2208/2409] Make `centralized_db` driver as default cache
 driver

Making newly introduced `centralized_db` driver as default cache
driver for glance so that it can be tested in available CI jobs.

New cache driver `centralized_db` needs `worker_self_reference_url`
in glance-api.conf file otherwise glance api service will fail to
start.

Related blueprint centralized-cache-db
Depends-On: https://review.opendev.org/c/openstack/glance/+/899871

Change-Id: I75267988b1c80ac9daa5843ce8462bbac49ffe27
---
 lib/glance | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/glance b/lib/glance
index 4ff9a34ca8..e4bfc8f5a3 100644
--- a/lib/glance
+++ b/lib/glance
@@ -75,7 +75,7 @@ GLANCE_MULTIPLE_FILE_STORES=${GLANCE_MULTIPLE_FILE_STORES:-fast}
 GLANCE_DEFAULT_BACKEND=${GLANCE_DEFAULT_BACKEND:-fast}
 
 GLANCE_CACHE_DIR=${GLANCE_CACHE_DIR:=$DATA_DIR/glance/cache}
-GLANCE_CACHE_DRIVER=${GLANCE_CACHE_DRIVER:-sqlite}
+GLANCE_CACHE_DRIVER=${GLANCE_CACHE_DRIVER:-centralized_db}
 
 # Full Glance functionality requires running in standalone mode. If we are
 # not in uwsgi mode, then we are standalone, otherwise allow separate control.
@@ -432,6 +432,7 @@ function configure_glance {
         iniset $GLANCE_API_CONF DEFAULT bind_host $GLANCE_SERVICE_LISTEN_ADDRESS
         iniset $GLANCE_API_CONF DEFAULT bind_port $GLANCE_SERVICE_PORT_INT
         iniset $GLANCE_API_CONF DEFAULT workers "$API_WORKERS"
+        iniset $GLANCE_API_CONF DEFAULT worker_self_reference_url $GLANCE_URL
     fi
 
     if [[ "$GLANCE_ENFORCE_SCOPE" == True || "$ENFORCE_SCOPE" == True ]] ; then

From 4ddd456dd3e71bcdf9a02a12dd5914b82ec48e91 Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Fri, 9 Feb 2024 14:11:44 +0100
Subject: [PATCH 2209/2409] Add support for the pyproject.toml file in setup
 with constraints

In the _setup_package_with_constraints_edit name of the package was
always discovered from the setup.cfg file. But as some projects
implements PEP-621 (see [1] for the SQLAlchemy for example) it is not
enough now.
This patch adds parsing pyproject.toml file also if name is not found in
the setup.cfg file.

[1] https://github.com/sqlalchemy/sqlalchemy/commit/a8dbf8763a8fa2ca53cc01033f06681a421bf60b

Closes-Bug: #2052509
Change-Id: Iee9262079d09a8bd22cd05a8f17950a41a0d1f9d
---
 inc/python | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/inc/python b/inc/python
index cc6e01fede..43b06eb520 100644
--- a/inc/python
+++ b/inc/python
@@ -405,6 +405,9 @@ function _setup_package_with_constraints_edit {
         # source we are about to do.
         local name
         name=$(awk '/^name.*=/ {print $3}' $project_dir/setup.cfg)
+        if [ -z $name ]; then
+            name=$(awk '/^name =/ {gsub(/"/, "", $3); print $3}' $project_dir/pyproject.toml)
+        fi
         $REQUIREMENTS_DIR/.venv/bin/edit-constraints \
             $REQUIREMENTS_DIR/upper-constraints.txt -- $name
     fi

From 402b7e89b60035b39b40e8886dee82487c54de97 Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Fri, 23 Feb 2024 11:46:03 +0100
Subject: [PATCH 2210/2409] Drop nodesets with ubuntu-xenial

The ubuntu-xenial labels are going to disappear from opendev as that
image is EOL and will we deleted. Clean up our zuul config.

Update some example reference as well.

Change-Id: Id04110f7c871caa1739ff2b62e9796be4fb9aa00
---
 .zuul.yaml       | 80 ------------------------------------------------
 functions-common |  4 +--
 2 files changed, 2 insertions(+), 82 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 47466cb3eb..13b4633e13 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -1,13 +1,3 @@
-- nodeset:
-    name: openstack-single-node
-    nodes:
-      - name: controller
-        label: ubuntu-xenial
-    groups:
-      - name: tempest
-        nodes:
-          - controller
-
 - nodeset:
     name: openstack-single-node-jammy
     nodes:
@@ -38,16 +28,6 @@
         nodes:
           - controller
 
-- nodeset:
-    name: openstack-single-node-xenial
-    nodes:
-      - name: controller
-        label: ubuntu-xenial
-    groups:
-      - name: tempest
-        nodes:
-          - controller
-
 - nodeset:
     name: devstack-single-node-centos-7
     nodes:
@@ -118,36 +98,6 @@
         nodes:
           - controller
 
-- nodeset:
-    name: openstack-two-node
-    nodes:
-      - name: controller
-        label: ubuntu-xenial
-      - name: compute1
-        label: ubuntu-xenial
-    groups:
-      # Node where tests are executed and test results collected
-      - name: tempest
-        nodes:
-          - controller
-      # Nodes running the compute service
-      - name: compute
-        nodes:
-          - controller
-          - compute1
-      # Nodes that are not the controller
-      - name: subnode
-        nodes:
-          - compute1
-      # Switch node for multinode networking setup
-      - name: switch
-        nodes:
-          - controller
-      # Peer nodes for multinode networking setup
-      - name: peers
-        nodes:
-          - compute1
-
 - nodeset:
     name: openstack-two-node-centos-9-stream
     nodes:
@@ -268,36 +218,6 @@
         nodes:
           - compute1
 
-- nodeset:
-    name: openstack-two-node-xenial
-    nodes:
-      - name: controller
-        label: ubuntu-xenial
-      - name: compute1
-        label: ubuntu-xenial
-    groups:
-      # Node where tests are executed and test results collected
-      - name: tempest
-        nodes:
-          - controller
-      # Nodes running the compute service
-      - name: compute
-        nodes:
-          - controller
-          - compute1
-      # Nodes that are not the controller
-      - name: subnode
-        nodes:
-          - compute1
-      # Switch node for multinode networking setup
-      - name: switch
-        nodes:
-          - controller
-      # Peer nodes for multinode networking setup
-      - name: peers
-        nodes:
-          - compute1
-
 - nodeset:
     name: openstack-three-node-focal
     nodes:
diff --git a/functions-common b/functions-common
index 5238dff30a..8ea6df7c1d 100644
--- a/functions-common
+++ b/functions-common
@@ -401,9 +401,9 @@ function warn {
 # such as "install_package" further abstract things in better ways.
 #
 # ``os_VENDOR`` - vendor name: ``Ubuntu``, ``Fedora``, etc
-# ``os_RELEASE`` - major release: ``16.04`` (Ubuntu), ``23`` (Fedora)
+# ``os_RELEASE`` - major release: ``22.04`` (Ubuntu), ``23`` (Fedora)
 # ``os_PACKAGE`` - package type: ``deb`` or ``rpm``
-# ``os_CODENAME`` - vendor's codename for release: ``xenial``
+# ``os_CODENAME`` - vendor's codename for release: ``jammy``
 
 declare -g os_VENDOR os_RELEASE os_PACKAGE os_CODENAME
 

From 50c791c0ae3bd75335c89312a5595f0ad2864945 Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Thu, 29 Feb 2024 17:02:55 +0900
Subject: [PATCH 2211/2409] Drop unused environments for TripleO and heat
 agents

TripleO was already retired. These environments are not actually used
by heat jobs.

Change-Id: I63b7413a1575a620f9d2cbd56e93be78816639e0
---
 stackrc | 22 ----------------------
 1 file changed, 22 deletions(-)

diff --git a/stackrc b/stackrc
index 464e935839..966e5ed69d 100644
--- a/stackrc
+++ b/stackrc
@@ -588,28 +588,6 @@ GITREPO["os-ken"]=${OS_KEN_REPO:-${GIT_BASE}/openstack/os-ken.git}
 GITBRANCH["os-ken"]=${OS_KEN_BRANCH:-$TARGET_BRANCH}
 GITDIR["os-ken"]=$DEST/os-ken
 
-##################
-#
-#  TripleO / Heat Agent Components
-#
-##################
-
-# run-parts script required by os-refresh-config
-DIB_UTILS_REPO=${DIB_UTILS_REPO:-${GIT_BASE}/openstack/dib-utils.git}
-DIB_UTILS_BRANCH=${DIB_UTILS_BRANCH:-$BRANCHLESS_TARGET_BRANCH}
-
-# os-apply-config configuration template tool
-OAC_REPO=${OAC_REPO:-${GIT_BASE}/openstack/os-apply-config.git}
-OAC_BRANCH=${OAC_BRANCH:-$TRAILING_TARGET_BRANCH}
-
-# os-collect-config configuration agent
-OCC_REPO=${OCC_REPO:-${GIT_BASE}/openstack/os-collect-config.git}
-OCC_BRANCH=${OCC_BRANCH:-$TRAILING_TARGET_BRANCH}
-
-# os-refresh-config configuration run-parts tool
-ORC_REPO=${ORC_REPO:-${GIT_BASE}/openstack/os-refresh-config.git}
-ORC_BRANCH=${ORC_BRANCH:-$TRAILING_TARGET_BRANCH}
-
 
 #################
 #

From af57c0b778bb13a9b5ffd784fc456a21614e67b1 Mon Sep 17 00:00:00 2001
From: Jeremy Stanley <fungi@yuggoth.org>
Date: Mon, 4 Mar 2024 18:24:24 +0000
Subject: [PATCH 2212/2409] Drop the devstack-single-node-centos-7 nodeset

OpenDev is preparing to remove centos-7 nodes on March 15[*]. This
change drops one nodeset definition which is the last remaining
reference on DevStack's master branch.

[*] https://lists.openstack.org/archives/list/openstack-discuss@lists.openstack.org/message/A2YIY5L7MVYSQMTVZU3L3OM7GLVVZPLK/

Change-Id: Icd487e1012263a9b0bc13b529d31ff2025108adf
---
 .zuul.yaml | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 13b4633e13..8bc082364c 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -28,16 +28,6 @@
         nodes:
           - controller
 
-- nodeset:
-    name: devstack-single-node-centos-7
-    nodes:
-      - name: controller
-        label: centos-7
-    groups:
-      - name: tempest
-        nodes:
-          - controller
-
 - nodeset:
     name: devstack-single-node-centos-9-stream
     nodes:

From 1fe7707cf04852d024b64f695e40568696851b15 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Tue, 5 Mar 2024 08:30:19 -0800
Subject: [PATCH 2213/2409] Ignore 500 status code in generate plugin script

Due to various reasons, this script may encounter the
500 status code from some repo (x/fuel-plugin-onos in current case[1])
If that happen then it return failure status code to the
propose-updates job and fail that job

- https://zuul.openstack.org/builds?job_name=propose-updates&project=openstack%2Fdevstack&skip=0

It is better not to raise the 500 error in this script and just ignore those
repo to process further to detect the plugin.

[1] https://zuul.openstack.org/build/dba0aa41d145472397916dfcd13948de/log/job-output.txt#2442

Change-Id: Ibca0a2aac404161340e8fc00170018eecf5c8326
---
 tools/generate-devstack-plugins-list.py | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/tools/generate-devstack-plugins-list.py b/tools/generate-devstack-plugins-list.py
index 1cacd06bf8..bc28515a26 100644
--- a/tools/generate-devstack-plugins-list.py
+++ b/tools/generate-devstack-plugins-list.py
@@ -73,8 +73,11 @@ def has_devstack_plugin(session, proj):
 s = requests.Session()
 # sometimes gitea gives us a 500 error; retry sanely
 #  https://stackoverflow.com/a/35636367
+# We need to disable raise_on_status because if any repo endup with 500 then
+# propose-updates job which run this script will fail.
 retries = Retry(total=3, backoff_factor=1,
-                status_forcelist=[ 500 ])
+                status_forcelist=[ 500 ],
+                raise_on_status=False)
 s.mount('https://', HTTPAdapter(max_retries=retries))
 
 found_plugins = filter(functools.partial(has_devstack_plugin, s), projects)

From 5e837d1f0d9078c58bc634474a1adf311bc2b491 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Wed, 6 Mar 2024 03:13:36 +0000
Subject: [PATCH 2214/2409] Updated from generate-devstack-plugins-list

Change-Id: Ic99b518ddf1045893991accaa089f44d0d4f4b0d
---
 doc/source/plugin-registry.rst | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index f70041162b..2d2a92c4a9 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -28,8 +28,6 @@ openstack/aodh                           `https://opendev.org/openstack/aodh <ht
 openstack/barbican                       `https://opendev.org/openstack/barbican <https://opendev.org/openstack/barbican>`__
 openstack/blazar                         `https://opendev.org/openstack/blazar <https://opendev.org/openstack/blazar>`__
 openstack/ceilometer                     `https://opendev.org/openstack/ceilometer <https://opendev.org/openstack/ceilometer>`__
-openstack/ceilometer-powervm             `https://opendev.org/openstack/ceilometer-powervm <https://opendev.org/openstack/ceilometer-powervm>`__
-openstack/cinderlib                      `https://opendev.org/openstack/cinderlib <https://opendev.org/openstack/cinderlib>`__
 openstack/cloudkitty                     `https://opendev.org/openstack/cloudkitty <https://opendev.org/openstack/cloudkitty>`__
 openstack/cyborg                         `https://opendev.org/openstack/cyborg <https://opendev.org/openstack/cyborg>`__
 openstack/designate                      `https://opendev.org/openstack/designate <https://opendev.org/openstack/designate>`__
@@ -69,7 +67,6 @@ openstack/networking-bagpipe             `https://opendev.org/openstack/networki
 openstack/networking-baremetal           `https://opendev.org/openstack/networking-baremetal <https://opendev.org/openstack/networking-baremetal>`__
 openstack/networking-bgpvpn              `https://opendev.org/openstack/networking-bgpvpn <https://opendev.org/openstack/networking-bgpvpn>`__
 openstack/networking-generic-switch      `https://opendev.org/openstack/networking-generic-switch <https://opendev.org/openstack/networking-generic-switch>`__
-openstack/networking-powervm             `https://opendev.org/openstack/networking-powervm <https://opendev.org/openstack/networking-powervm>`__
 openstack/networking-sfc                 `https://opendev.org/openstack/networking-sfc <https://opendev.org/openstack/networking-sfc>`__
 openstack/neutron                        `https://opendev.org/openstack/neutron <https://opendev.org/openstack/neutron>`__
 openstack/neutron-dynamic-routing        `https://opendev.org/openstack/neutron-dynamic-routing <https://opendev.org/openstack/neutron-dynamic-routing>`__
@@ -79,7 +76,6 @@ openstack/neutron-tempest-plugin         `https://opendev.org/openstack/neutron-
 openstack/neutron-vpnaas                 `https://opendev.org/openstack/neutron-vpnaas <https://opendev.org/openstack/neutron-vpnaas>`__
 openstack/neutron-vpnaas-dashboard       `https://opendev.org/openstack/neutron-vpnaas-dashboard <https://opendev.org/openstack/neutron-vpnaas-dashboard>`__
 openstack/nova                           `https://opendev.org/openstack/nova <https://opendev.org/openstack/nova>`__
-openstack/nova-powervm                   `https://opendev.org/openstack/nova-powervm <https://opendev.org/openstack/nova-powervm>`__
 openstack/octavia                        `https://opendev.org/openstack/octavia <https://opendev.org/openstack/octavia>`__
 openstack/octavia-dashboard              `https://opendev.org/openstack/octavia-dashboard <https://opendev.org/openstack/octavia-dashboard>`__
 openstack/octavia-tempest-plugin         `https://opendev.org/openstack/octavia-tempest-plugin <https://opendev.org/openstack/octavia-tempest-plugin>`__

From 5f5255bc011ef885f254c659009662870499de5a Mon Sep 17 00:00:00 2001
From: huicoffee <784657156@qq.com>
Date: Fri, 15 Mar 2024 17:15:33 +0800
Subject: [PATCH 2215/2409] Remove Glance uWSGI config in clean.sh

Updated clean.sh to remove Glance's Apache uWSGI config files in
APACHE_CONF_DIR, including /etc/apache2/sites-enabled/ on Ubuntu.

Test Plan:
- Run clean.sh.
- Confirm Glance uWSGI configs are removed from APACHE_CONF_DIR.

Closes-Bug: #2057999

Change-Id: I44475b8e084c4b20d7b7cb7f28574f797dbda7a2
---
 lib/glance | 1 +
 lib/host   | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/glance b/lib/glance
index e4bfc8f5a3..8ee842625f 100644
--- a/lib/glance
+++ b/lib/glance
@@ -168,6 +168,7 @@ function cleanup_glance {
         # Cleanup reserved stores directories
         sudo rm -rf $GLANCE_STAGING_DIR $GLANCE_TASKS_DIR
     fi
+    remove_uwsgi_config "$GLANCE_UWSGI_CONF" "$GLANCE_UWSGI"
 }
 
 # Set multiple cinder store related config options for each of the cinder store
diff --git a/lib/host b/lib/host
index 2fa22e24ea..a812c39612 100644
--- a/lib/host
+++ b/lib/host
@@ -95,4 +95,4 @@ function configure_host_net {
 function tune_host {
     configure_host_mem
     configure_host_net
-}
\ No newline at end of file
+}

From e1b7cc0ef8db3f7363cd478effa8f7292b61b9bf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Douglas=20Mendiz=C3=A1bal?= <dmendiza@redhat.com>
Date: Mon, 25 Mar 2024 12:09:04 -0400
Subject: [PATCH 2216/2409] Do not configure system-scope admin for keystone

This patch removes a couple of tempest.conf settings that are being
overwrriten when Keystone is set to enforce scope.

These settings are already being set by the keystone devstack plugin [1]
and do not need to be overwritten here.

Keystone is changing the default admin credentials to be project-admin
instead of system-admin to address some failing tests in services that
require project-scoped admin for their admin APIs. [2]  These overrides
are preventing that change from taking effect.

[1] https://opendev.org/openstack/keystone/src/branch/stable/2024.1/devstack/lib/scope.sh#L24-L25
[2] https://review.opendev.org/c/openstack/keystone/+/913999

Change-Id: I48edbcbaa993f2d1f35160c415986d21a15a4999
---
 lib/tempest | 2 --
 1 file changed, 2 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 7b5fde170e..6bd203e6f4 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -702,8 +702,6 @@ function configure_tempest {
     # test can be run with scoped token.
     if [[ "$KEYSTONE_ENFORCE_SCOPE" == True || "$ENFORCE_SCOPE" == True ]] ; then
         iniset $TEMPEST_CONFIG enforce_scope keystone true
-        iniset $TEMPEST_CONFIG auth admin_system 'all'
-        iniset $TEMPEST_CONFIG auth admin_project_name ''
     fi
 
     if [[ "$NOVA_ENFORCE_SCOPE" == True || "$ENFORCE_SCOPE" == True ]] ; then

From 99a96288eb14e66723d85e6ca24ff51babac7ec8 Mon Sep 17 00:00:00 2001
From: Martin Kopec <mkopec@redhat.com>
Date: Thu, 28 Mar 2024 23:38:19 +0100
Subject: [PATCH 2217/2409] Update DEVSTACK_SERIES to 2024.2

stable/2024.1 branch has been created now and
current master is for 2024.2.

Change-Id: I4af9e87318ef9cbfede7df7c23872a1a7e38c820
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 4e49b461d4..de81f01f38 100644
--- a/stackrc
+++ b/stackrc
@@ -257,7 +257,7 @@ REQUIREMENTS_DIR=${REQUIREMENTS_DIR:-$DEST/requirements}
 # Setting the variable to 'ALL' will activate the download for all
 # libraries.
 
-DEVSTACK_SERIES="2024.1"
+DEVSTACK_SERIES="2024.2"
 
 ##############
 #

From c336b873421c954921ee26c22bd9bfe65b330d0c Mon Sep 17 00:00:00 2001
From: Jaromir Wysoglad <jwysogla@redhat.com>
Date: Wed, 27 Mar 2024 11:36:26 +0100
Subject: [PATCH 2218/2409] Fix neutron empty string check

The variable should be in quotes for the check to work

Testing the behavior in bash:
current behavior:
$ config_file=""
$ if [ -n ${config_file} ]; then echo a; fi
a

$ config_file="abc"
$ if [ -n ${config_file} ]; then echo a; fi
a

behavior with quotes:
$ config_file=""
$ if [ -n "$config_file" ]; then echo a; fi

$ config_file="abc"
$ if [ -n "$config_file" ]; then echo a; fi
a

Change-Id: Iba956d9d4f43b925848174a632aabe58999be74b
---
 lib/neutron_plugins/ovn_agent | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index e646258651..699bd54f4e 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -558,7 +558,7 @@ function configure_ovn {
         sample_file=$NEUTRON_DIR/etc/neutron_ovn_metadata_agent.ini.sample
         config_file=$OVN_META_CONF
     fi
-    if [ -n ${config_file} ]; then
+    if [ -n "$config_file" ]; then
         sudo install -d -o $STACK_USER $NEUTRON_CONF_DIR
 
         mkdir -p $NEUTRON_DIR/etc/neutron/plugins/ml2

From b6613b1e71fb6a0efb63ec9346bd2e67131657e0 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <sfinucan@redhat.com>
Date: Wed, 6 Dec 2023 10:22:30 +0000
Subject: [PATCH 2219/2409] lib/apache: Use module paths instead of WSGI
 scripts

pbr's 'wsgi_scripts' entrypoint functionality is not long for this world
so we need to start working towards an alternative. We could start
packaging our own WSGI scripts in DevStack but using module paths seems
like a better option, particularly when it's supported by other WSGI
servers like gunicorn.

Currently only nova is migrated. We should switch additional projects as
they migrate and eventually remove the support for WSGI scripts
entirely.

Change-Id: I057dc635c01e54740ee04dfe7b39ef83db5dc180
Signed-off-by: Stephen Finucane <sfinucan@redhat.com>
Depends-on: https://review.opendev.org/c/openstack/nova/+/902687/
---
 lib/apache | 33 ++++++++++++++++++++++++++++-----
 lib/nova   |  8 ++++----
 2 files changed, 32 insertions(+), 9 deletions(-)

diff --git a/lib/apache b/lib/apache
index 9017e0a38a..a314b76fb7 100644
--- a/lib/apache
+++ b/lib/apache
@@ -237,13 +237,17 @@ function restart_apache_server {
     restart_service $APACHE_NAME
 }
 
+# write_uwsgi_config() - Create a new uWSGI config file
 function write_uwsgi_config {
     local conf=$1
     local wsgi=$2
     local url=$3
     local http=$4
-    local name=""
-    name=$(basename $wsgi)
+    local name=$5
+
+    if [ -z "$name" ]; then
+        name=$(basename $wsgi)
+    fi
 
     # create a home for the sockets; note don't use /tmp -- apache has
     # a private view of it on some platforms.
@@ -259,7 +263,15 @@ function write_uwsgi_config {
 
     # always cleanup given that we are using iniset here
     rm -rf $conf
-    iniset "$conf" uwsgi wsgi-file "$wsgi"
+    # Set either the module path or wsgi script path depending on what we've
+    # been given. Note that the regex isn't exhaustive - neither Python modules
+    # nor Python variables can start with a number - but it's "good enough"
+    if [[ "$wsgi" =~ ^[a-zA-Z0-9_.]+:[a-zA-Z0-9_]+$ ]]; then
+        iniset "$conf" uwsgi module "$wsgi"
+    else
+        deprecated 'Configuring uWSGI with a WSGI file is deprecated, use module paths instead'
+        iniset "$conf" uwsgi wsgi-file "$wsgi"
+    fi
     iniset "$conf" uwsgi processes $API_WORKERS
     # This is running standalone
     iniset "$conf" uwsgi master true
@@ -306,14 +318,25 @@ function write_local_uwsgi_http_config {
     local conf=$1
     local wsgi=$2
     local url=$3
-    name=$(basename $wsgi)
+    local name=$4
+
+    if [ -z "$name" ]; then
+        name=$(basename $wsgi)
+    fi
 
     # create a home for the sockets; note don't use /tmp -- apache has
     # a private view of it on some platforms.
 
     # always cleanup given that we are using iniset here
     rm -rf $conf
-    iniset "$conf" uwsgi wsgi-file "$wsgi"
+    # Set either the module path or wsgi script path depending on what we've
+    # been given
+    if [[ "$wsgi" =~ ^[a-zA-Z0-9_.]+:[a-zA-Z0-9_]+$ ]]; then
+        iniset "$conf" uwsgi module "$wsgi"
+    else
+        deprecated 'Configuring uWSGI with a WSGI file is deprecated, use module paths instead'
+        iniset "$conf" uwsgi wsgi-file "$wsgi"
+    fi
     port=$(get_random_port)
     iniset "$conf" uwsgi http-socket "$APACHE_LOCAL_HOST:$port"
     iniset "$conf" uwsgi processes $API_WORKERS
diff --git a/lib/nova b/lib/nova
index 17c90dfe26..a261fac8f6 100644
--- a/lib/nova
+++ b/lib/nova
@@ -53,8 +53,8 @@ NOVA_COND_CONF=$NOVA_CONF_DIR/nova.conf
 NOVA_CPU_CONF=$NOVA_CONF_DIR/nova-cpu.conf
 NOVA_FAKE_CONF=$NOVA_CONF_DIR/nova-fake.conf
 NOVA_API_DB=${NOVA_API_DB:-nova_api}
-NOVA_UWSGI=$NOVA_BIN_DIR/nova-api-wsgi
-NOVA_METADATA_UWSGI=$NOVA_BIN_DIR/nova-metadata-wsgi
+NOVA_UWSGI=nova.wsgi.osapi_compute:application
+NOVA_METADATA_UWSGI=nova.wsgi.metadata:application
 NOVA_UWSGI_CONF=$NOVA_CONF_DIR/nova-api-uwsgi.ini
 NOVA_METADATA_UWSGI_CONF=$NOVA_CONF_DIR/nova-metadata-uwsgi.ini
 
@@ -549,11 +549,11 @@ function create_nova_conf {
     iniset $NOVA_CONF upgrade_levels compute "auto"
 
     if is_service_enabled n-api; then
-        write_uwsgi_config "$NOVA_UWSGI_CONF" "$NOVA_UWSGI" "/compute"
+        write_uwsgi_config "$NOVA_UWSGI_CONF" "$NOVA_UWSGI" "/compute" "" "nova-api"
     fi
 
     if is_service_enabled n-api-meta; then
-        write_uwsgi_config "$NOVA_METADATA_UWSGI_CONF" "$NOVA_METADATA_UWSGI" "" "$SERVICE_LISTEN_ADDRESS:${METADATA_SERVICE_PORT}"
+        write_uwsgi_config "$NOVA_METADATA_UWSGI_CONF" "$NOVA_METADATA_UWSGI" "" "$SERVICE_LISTEN_ADDRESS:${METADATA_SERVICE_PORT}" "nova-metadata"
     fi
 
     if is_service_enabled ceilometer; then

From 9be4ceeaa10f6ed92291e77ec52794acfb67c147 Mon Sep 17 00:00:00 2001
From: Brian Haley <haleyb.dev@gmail.com>
Date: Tue, 23 Apr 2024 15:37:37 -0400
Subject: [PATCH 2220/2409] Fix datetime.utcnow() deprecation warning

Running stack.sh on a python 3.12 system generates this
warning from worlddump.py:

  DeprecationWarning: datetime.datetime.utcnow() is deprecated

Use datetime.now(timezone.utc) instead, which should be
backwards-compatible with older python versions.

TrivialFix

Change-Id: I11fe60f6b04842412045c6cb97f493f7fef66e1a
---
 tools/worlddump.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/worlddump.py b/tools/worlddump.py
index aadd33b634..edbfa268db 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -51,7 +51,7 @@ def get_options():
 
 
 def filename(dirname, name=""):
-    now = datetime.datetime.utcnow()
+    now = datetime.datetime.now(datetime.timezone.utc)
     fmt = "worlddump-%Y-%m-%d-%H%M%S"
     if name:
         fmt += "-" + name

From aee9b0ff9e68f9306d9a55bca5304366fb85e91b Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Thu, 9 May 2024 10:29:43 -0700
Subject: [PATCH 2221/2409] Make rocky 9 job non-voting

This job is currently failing with mirror or repo issues.

Change-Id: Ie0f862f933cd99cc9fe698d5a178b952e6e93ac4
---
 .zuul.yaml | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 8bc082364c..294dd48f4d 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -644,6 +644,11 @@
     description: Rocky Linux 9 Blue Onyx platform test
     nodeset: devstack-single-node-rockylinux-9
     timeout: 9000
+    # NOTE(danms): This has been failing lately with some repository metadata
+    # errors. We're marking this as non-voting until it appears to have
+    # stabilized:
+    # https://zuul.openstack.org/builds?job_name=devstack-platform-rocky-blue-onyx&skip=0
+    voting: false
     vars:
       configure_swap_size: 4096
 
@@ -887,7 +892,9 @@
         - devstack-ipv6
         - devstack-platform-debian-bookworm
         - devstack-platform-debian-bullseye
-        - devstack-platform-rocky-blue-onyx
+        # NOTE(danms): Disabled due to instability, see comment in the job
+        # definition above.
+        # - devstack-platform-rocky-blue-onyx
         - devstack-enforce-scope
         - devstack-multinode
         - devstack-unit-tests

From 769adbd69daf89f05c96d877519efc81a25fd3c1 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Wed, 8 May 2024 16:58:46 +0000
Subject: [PATCH 2222/2409] Upload images with --file instead of stdin

This is more likely how people will actually upload their images, but
it also prevents the "osc as a service" feature from working because
stdin isn't proxied (of course). So just convert our uses of "image
create" to use --file instead of stdin.

Change-Id: I7205eb0100ba7406650ed609cf517cba2c8d30aa
---
 functions | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/functions b/functions
index 01e1d259ad..f81e8f0a08 100644
--- a/functions
+++ b/functions
@@ -118,7 +118,7 @@ function _upload_image {
         useimport="--import"
     fi
 
-    openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name" --public --container-format "$container" --disk-format "$disk" $useimport $properties < "${image}"
+    openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name" --public --container-format "$container" --disk-format "$disk" $useimport $properties --file $(readlink -f "${image}")
 }
 
 # Retrieve an image from a URL and upload into Glance.
@@ -425,10 +425,10 @@ function upload_image {
         # kernel for use when uploading the root filesystem.
         local kernel_id="" ramdisk_id="";
         if [ -n "$kernel" ]; then
-            kernel_id=$(openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name-kernel" $(_image_properties_to_arg $img_property) --public --container-format aki --disk-format aki < "$kernel" -f value -c id)
+            kernel_id=$(openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name-kernel" $(_image_properties_to_arg $img_property) --public --container-format aki --disk-format aki --file $(readlink -f "$kernel") -f value -c id)
         fi
         if [ -n "$ramdisk" ]; then
-            ramdisk_id=$(openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name-ramdisk" $(_image_properties_to_arg $img_property) --public --container-format ari --disk-format ari < "$ramdisk" -f value -c id)
+            ramdisk_id=$(openstack --os-cloud=devstack-admin --os-region-name="$REGION_NAME" image create "$image_name-ramdisk" $(_image_properties_to_arg $img_property) --public --container-format ari --disk-format ari --file $(readlink -f "$ramdisk") -f value -c id)
         fi
         _upload_image "${image_name%.img}" ami ami "$image" ${kernel_id:+ kernel_id=$kernel_id} ${ramdisk_id:+ ramdisk_id=$ramdisk_id} $img_property
     fi

From c80b9f4fc16997631696100a8e468d907a177f7d Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Mon, 13 May 2024 11:04:45 +0200
Subject: [PATCH 2223/2409] Drop reno

devstack doesn't do releases, so there should be no release notes,
either. Drop the one that was accidentally created to avoid confusion.

Change-Id: I75a295e50c36925a0137a5458444fb48bd5d9f8a
---
 ...NotImplementedError-on-SQLAlchemy-2-21bb6dcdf3ce4225.yaml | 5 -----
 1 file changed, 5 deletions(-)
 delete mode 100644 releasenotes/notes/Fix-dbcounter-NotImplementedError-on-SQLAlchemy-2-21bb6dcdf3ce4225.yaml

diff --git a/releasenotes/notes/Fix-dbcounter-NotImplementedError-on-SQLAlchemy-2-21bb6dcdf3ce4225.yaml b/releasenotes/notes/Fix-dbcounter-NotImplementedError-on-SQLAlchemy-2-21bb6dcdf3ce4225.yaml
deleted file mode 100644
index f815e14ccb..0000000000
--- a/releasenotes/notes/Fix-dbcounter-NotImplementedError-on-SQLAlchemy-2-21bb6dcdf3ce4225.yaml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-fixes:
-  - |
-    Fixes a NotImplementedError when using the dbcounter SQLAlchemy plugin on
-    SQLAlchemy 2.x.

From d5182ce3fcf5caf8f7dca84217b2c3cb70993df7 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <sfinucan@redhat.com>
Date: Fri, 19 Apr 2024 12:27:14 +0100
Subject: [PATCH 2224/2409] lib/apache: Pass name, not path, to
 remove_uwsgi_config

We'd like to move from configuring uWSGI with '.wsgi' files to
configuring with module paths. Do this for all in-tree services and log
a deprecation warning for anyone still passing a path.

Note that since 'basepath foo' returns 'foo', this is effectively a
no-op for the services being converted here.

Change-Id: Ia1ad5ff160a9821ceab97ff1c24bc48cd4bf1d6f
Signed-off-by: Stephen Finucane <sfinucan@redhat.com>
---
 lib/apache    | 6 ++++++
 lib/cinder    | 2 +-
 lib/glance    | 2 +-
 lib/keystone  | 2 +-
 lib/neutron   | 2 +-
 lib/nova      | 4 ++--
 lib/placement | 2 +-
 7 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/lib/apache b/lib/apache
index a314b76fb7..48438da6a1 100644
--- a/lib/apache
+++ b/lib/apache
@@ -402,8 +402,14 @@ function remove_uwsgi_config {
     local conf=$1
     local wsgi=$2
     local name=""
+    # TODO(stephenfin): Remove this call when everyone is using module path
+    # configuration instead of file path configuration
     name=$(basename $wsgi)
 
+    if [[ "$wsgi" = /* ]]; then
+        deprecated "Passing a wsgi script to remove_uwsgi_config is deprecated, pass an application name instead"
+    fi
+
     rm -rf $conf
     disable_apache_site $name
 }
diff --git a/lib/cinder b/lib/cinder
index f7824eb6f4..ae898e9522 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -275,7 +275,7 @@ function cleanup_cinder {
     fi
 
     stop_process "c-api"
-    remove_uwsgi_config "$CINDER_UWSGI_CONF" "$CINDER_UWSGI"
+    remove_uwsgi_config "$CINDER_UWSGI_CONF" "cinder-wsgi"
 }
 
 # configure_cinder() - Set config files, create data dirs, etc
diff --git a/lib/glance b/lib/glance
index 8ee842625f..274687112e 100644
--- a/lib/glance
+++ b/lib/glance
@@ -168,7 +168,7 @@ function cleanup_glance {
         # Cleanup reserved stores directories
         sudo rm -rf $GLANCE_STAGING_DIR $GLANCE_TASKS_DIR
     fi
-    remove_uwsgi_config "$GLANCE_UWSGI_CONF" "$GLANCE_UWSGI"
+    remove_uwsgi_config "$GLANCE_UWSGI_CONF" "glance-wsgi-api"
 }
 
 # Set multiple cinder store related config options for each of the cinder store
diff --git a/lib/keystone b/lib/keystone
index 6cb4aac46a..7d6b05fd41 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -150,7 +150,7 @@ function cleanup_keystone {
         sudo rm -f $(apache_site_config_for keystone)
     else
         stop_process "keystone"
-        remove_uwsgi_config "$KEYSTONE_PUBLIC_UWSGI_CONF" "$KEYSTONE_PUBLIC_UWSGI"
+        remove_uwsgi_config "$KEYSTONE_PUBLIC_UWSGI_CONF" "keystone-wsgi-public"
         sudo rm -f $(apache_site_config_for keystone-wsgi-public)
     fi
 }
diff --git a/lib/neutron b/lib/neutron
index bc77f161d7..ed854fdd66 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -823,7 +823,7 @@ function cleanup_neutron {
     if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
         stop_process neutron-api
         stop_process neutron-rpc-server
-        remove_uwsgi_config "$NEUTRON_UWSGI_CONF" "$NEUTRON_BIN_DIR/neutron-api"
+        remove_uwsgi_config "$NEUTRON_UWSGI_CONF" "neutron-api"
         sudo rm -f $(apache_site_config_for neutron-api)
     fi
 
diff --git a/lib/nova b/lib/nova
index a261fac8f6..ee3f29eebf 100644
--- a/lib/nova
+++ b/lib/nova
@@ -248,8 +248,8 @@ function cleanup_nova {
 
     stop_process "n-api"
     stop_process "n-api-meta"
-    remove_uwsgi_config "$NOVA_UWSGI_CONF" "$NOVA_UWSGI"
-    remove_uwsgi_config "$NOVA_METADATA_UWSGI_CONF" "$NOVA_METADATA_UWSGI"
+    remove_uwsgi_config "$NOVA_UWSGI_CONF" "nova-api"
+    remove_uwsgi_config "$NOVA_METADATA_UWSGI_CONF" "nova-metadata"
 
     if [[ "$NOVA_BACKEND" == "LVM" ]]; then
         clean_lvm_volume_group $DEFAULT_VOLUME_GROUP_NAME
diff --git a/lib/placement b/lib/placement
index c6bf99f868..63fdfb6c1a 100644
--- a/lib/placement
+++ b/lib/placement
@@ -68,7 +68,7 @@ function is_placement_enabled {
 # runs that a clean run would need to clean up
 function cleanup_placement {
     sudo rm -f $(apache_site_config_for placement-api)
-    remove_uwsgi_config "$PLACEMENT_UWSGI_CONF" "$PLACEMENT_UWSGI"
+    remove_uwsgi_config "$PLACEMENT_UWSGI_CONF" "placement-api"
 }
 
 # _config_placement_apache_wsgi() - Set WSGI config files

From a6f3901a4bf81f3fe9f6132629bc552e179dd8c9 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <sfinucan@redhat.com>
Date: Wed, 6 Dec 2023 17:20:37 +0000
Subject: [PATCH 2225/2409] lib/apache: Reshuffle lines

Make it a little more obvious what the difference between the two helper
functions is.

Change-Id: I07ec34ecfcd2b7925485145c4b4bf68eda385a32
Signed-off-by: Stephen Finucane <sfinucan@redhat.com>
---
 lib/apache | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/apache b/lib/apache
index 48438da6a1..1420f76ff2 100644
--- a/lib/apache
+++ b/lib/apache
@@ -345,15 +345,15 @@ function write_local_uwsgi_http_config {
     # Set die-on-term & exit-on-reload so that uwsgi shuts down
     iniset "$conf" uwsgi die-on-term true
     iniset "$conf" uwsgi exit-on-reload false
+    # Set worker-reload-mercy so that worker will not exit till the time
+    # configured after graceful shutdown
+    iniset "$conf" uwsgi worker-reload-mercy $WORKER_TIMEOUT
     iniset "$conf" uwsgi enable-threads true
     iniset "$conf" uwsgi plugins http,python3
     # uwsgi recommends this to prevent thundering herd on accept.
     iniset "$conf" uwsgi thunder-lock true
     # Set hook to trigger graceful shutdown on SIGTERM
     iniset "$conf" uwsgi hook-master-start "unix_signal:15 gracefully_kill_them_all"
-    # Set worker-reload-mercy so that worker will not exit till the time
-    # configured after graceful shutdown
-    iniset "$conf" uwsgi worker-reload-mercy $WORKER_TIMEOUT
     # Override the default size for headers from the 4k default.
     iniset "$conf" uwsgi buffer-size 65535
     # Make sure the client doesn't try to re-use the connection.

From 9a97326c3f3b04728cf4484df37ce7260f6367af Mon Sep 17 00:00:00 2001
From: Ben Nemec <bnemec@redhat.com>
Date: Mon, 12 Aug 2019 20:10:49 +0000
Subject: [PATCH 2226/2409] Use OSCaaS to speed up devstack runs

OpenStackClient has a significant amount of startup overhead, which
adds a non-trivial amount of time to each devstack run because it makes
a lot of OSC calls. This change uses the OSC service from [0] to run
a persistent process that handles openstack calls. This removes most
of the startup overhead and in my local testing removes about three
minutes per devstack run.

Currently this is implemented as an opt-in feature. There are likely a
lot of edge cases in projects that use a devstack plugin so turning it
on universally is going to require boiling the ocean. I think getting
this in and enabled for some of the major projects should give us a lot
of the benefit without the enormous effort of making it 100% compatible
across all of OpenStack.

Depends-On: https://review.opendev.org/c/openstack/nova/+/918689
Depends-On: https://review.opendev.org/c/openstack/ironic/+/918690
Change-Id: I28e6159944746abe2d320369249b87f1c4b9e24e
0: http://lists.openstack.org/pipermail/openstack-dev/2016-April/092546.html
---
 files/openstack-cli-server/openstack          | 119 ++++++++++++++++++
 .../openstack-cli-server/openstack-cli-server | 118 +++++++++++++++++
 functions-common                              |   5 +
 stack.sh                                      |   3 +
 unstack.sh                                    |   4 +
 5 files changed, 249 insertions(+)
 create mode 100755 files/openstack-cli-server/openstack
 create mode 100755 files/openstack-cli-server/openstack-cli-server

diff --git a/files/openstack-cli-server/openstack b/files/openstack-cli-server/openstack
new file mode 100755
index 0000000000..ef05f1b841
--- /dev/null
+++ b/files/openstack-cli-server/openstack
@@ -0,0 +1,119 @@
+#!/usr/bin/env python3
+# Copyright 2016 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+import socket
+import sys
+import os
+import os.path
+import json
+
+server_address = "/tmp/openstack.sock"
+
+sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+
+try:
+    sock.connect(server_address)
+except socket.error as msg:
+    print(msg, file=sys.stderr)
+    sys.exit(1)
+
+
+def send(sock, doc):
+    jdoc = json.dumps(doc)
+    sock.send(b'%d\n' % len(jdoc))
+    sock.sendall(jdoc.encode('utf-8'))
+
+def recv(sock):
+    length_str = b''
+
+    char = sock.recv(1)
+    if len(char) == 0:
+        print("Unexpected end of file", file=sys.stderr)
+        sys.exit(1)
+
+    while char != b'\n':
+        length_str += char
+        char = sock.recv(1)
+        if len(char) == 0:
+            print("Unexpected end of file", file=sys.stderr)
+            sys.exit(1)
+
+    total = int(length_str)
+
+    # use a memoryview to receive the data chunk by chunk efficiently
+    jdoc = memoryview(bytearray(total))
+    next_offset = 0
+    while total - next_offset > 0:
+        recv_size = sock.recv_into(jdoc[next_offset:], total - next_offset)
+        next_offset += recv_size
+    try:
+        doc = json.loads(jdoc.tobytes())
+    except (TypeError, ValueError) as e:
+        raise Exception('Data received was not in JSON format')
+    return doc
+
+try:
+    env = {}
+    passenv = ["CINDER_VERSION",
+               "OS_AUTH_URL",
+               "OS_IDENTITY_API_VERSION",
+               "OS_NO_CACHE",
+               "OS_PASSWORD",
+               "OS_PROJECT_NAME",
+               "OS_REGION_NAME",
+               "OS_TENANT_NAME",
+               "OS_USERNAME",
+               "OS_VOLUME_API_VERSION",
+               "OS_CLOUD"]
+    for name in passenv:
+        if name in os.environ:
+            env[name] = os.environ[name]
+
+    cmd = {
+        "app": os.path.basename(sys.argv[0]),
+        "env": env,
+        "argv": sys.argv[1:]
+    }
+    try:
+        image_idx = sys.argv.index('image')
+        create_idx = sys.argv.index('create')
+        missing_file = image_idx < create_idx and \
+                not any(x.startswith('--file') for x in sys.argv)
+    except ValueError:
+        missing_file = False
+
+    if missing_file:
+        # This means we were called with an image create command, but were
+        # not provided a --file option. That likely means we're being passed
+        # the image data to stdin, which won't work because we do not proxy
+        # stdin to the server. So, we just reject the operation and ask the
+        # caller to provide the file with --file instead.
+        # We've already connected to the server, we need to send it some dummy
+        # data so it doesn't wait forever.
+        send(sock, {})
+        print('Image create without --file is not allowed in server mode',
+              file=sys.stderr)
+        sys.exit(1)
+    else:
+        send(sock, cmd)
+
+    doc = recv(sock)
+    if doc["stdout"] != b'':
+        print(doc["stdout"], end='')
+    if doc["stderr"] != b'':
+        print(doc["stderr"], file=sys.stderr)
+    sys.exit(doc["status"])
+finally:
+    sock.close()
diff --git a/files/openstack-cli-server/openstack-cli-server b/files/openstack-cli-server/openstack-cli-server
new file mode 100755
index 0000000000..f3d2747e52
--- /dev/null
+++ b/files/openstack-cli-server/openstack-cli-server
@@ -0,0 +1,118 @@
+#!/usr/bin/env python3
+# Copyright 2016 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+import socket
+import sys
+import os
+import json
+
+from openstackclient import shell as osc_shell
+from io import StringIO
+
+server_address = "/tmp/openstack.sock"
+
+try:
+    os.unlink(server_address)
+except OSError:
+    if os.path.exists(server_address):
+        raise
+
+sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+print('starting up on %s' % server_address, file=sys.stderr)
+sock.bind(server_address)
+
+# Listen for incoming connections
+sock.listen(1)
+
+def send(sock, doc):
+    jdoc = json.dumps(doc)
+    sock.send(b'%d\n' % len(jdoc))
+    sock.sendall(jdoc.encode('utf-8'))
+
+def recv(sock):
+    length_str = b''
+    char = sock.recv(1)
+    while char != b'\n':
+        length_str += char
+        char = sock.recv(1)
+
+    total = int(length_str)
+
+    # use a memoryview to receive the data chunk by chunk efficiently
+    jdoc = memoryview(bytearray(total))
+    next_offset = 0
+    while total - next_offset > 0:
+        recv_size = sock.recv_into(jdoc[next_offset:], total - next_offset)
+        next_offset += recv_size
+    try:
+        doc = json.loads(jdoc.tobytes())
+    except (TypeError, ValueError) as e:
+        raise Exception('Data received was not in JSON format')
+    return doc
+
+while True:
+    csock, client_address = sock.accept()
+    try:
+        doc = recv(csock)
+
+        print("%s %s" % (doc["app"], doc["argv"]), file=sys.stderr)
+        oldenv = {}
+        for name in doc["env"].keys():
+            oldenv[name] = os.environ.get(name, None)
+            os.environ[name] = doc["env"][name]
+
+        try:
+            old_stdout = sys.stdout
+            old_stderr = sys.stderr
+            my_stdout = sys.stdout = StringIO()
+            my_stderr = sys.stderr = StringIO()
+
+            class Exit(BaseException):
+                def __init__(self, status):
+                    self.status = status
+
+            def noexit(stat):
+                raise Exit(stat)
+
+            sys.exit = noexit
+
+            if doc["app"] == "openstack":
+                sh = osc_shell.OpenStackShell()
+                ret = sh.run(doc["argv"])
+            else:
+                print("Unknown application %s" % doc["app"], file=sys.stderr)
+                ret = 1
+        except Exit as e:
+            ret = e.status
+        finally:
+            sys.stdout = old_stdout
+            sys.stderr = old_stderr
+
+            for name in oldenv.keys():
+                if oldenv[name] is None:
+                    del os.environ[name]
+                else:
+                    os.environ[name] = oldenv[name]
+
+        send(csock, {
+            "stdout": my_stdout.getvalue(),
+            "stderr": my_stderr.getvalue(),
+            "status": ret,
+        })
+
+    except BaseException as e:
+        print(e, file=sys.stderr)
+    finally:
+        csock.close()
diff --git a/functions-common b/functions-common
index 8ea6df7c1d..84d281b21e 100644
--- a/functions-common
+++ b/functions-common
@@ -2438,6 +2438,11 @@ function time_stop {
     _TIME_TOTAL[$name]=$(($total + $elapsed_time))
 }
 
+function install_openstack_cli_server {
+    export PATH=$TOP_DIR/files/openstack-cli-server:$PATH
+    run_process openstack-cli-server "$PYTHON $TOP_DIR/files/openstack-cli-server/openstack-cli-server"
+}
+
 function oscwrap {
     local xtrace
     xtrace=$(set +o | grep xtrace)
diff --git a/stack.sh b/stack.sh
index c6652e5c6a..0c36e1034e 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1022,6 +1022,9 @@ if use_library_from_git "python-openstackclient"; then
     setup_dev_lib "python-openstackclient"
 else
     pip_install_gr python-openstackclient
+    if is_service_enabled openstack-cli-server; then
+        install_openstack_cli_server
+    fi
 fi
 
 # Installs alias for osc so that we can collect timing for all
diff --git a/unstack.sh b/unstack.sh
index 33b069b6a3..1b2d8dd62a 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -168,6 +168,10 @@ if is_service_enabled etcd3; then
     cleanup_etcd3
 fi
 
+if is_service_enabled openstack-cli-server; then
+    stop_service devstack@openstack-cli-server
+fi
+
 stop_dstat
 
 # NOTE: Cinder automatically installs the lvm2 package, independently of the

From 6971ccc49ad97216d97be46c70c241c5473aff92 Mon Sep 17 00:00:00 2001
From: MinhNLH2 <minh.nlh.work@gmail.com>
Date: Wed, 1 May 2024 21:29:15 +0700
Subject: [PATCH 2227/2409] Display backup dashboard on Horizon when c-bak is
 enabled

Currently, when enabling c-bak service, the backup tab will not
be shown on Horizon by default. This patch tells Horizon to
display backup dashboard when c-bak is enabled.

Closes-Bug: 2064496
Change-Id: I06295706e985bac58de2878c6d24c51f3267c205
Signed-off-by: MinhNLH2 <minh.nlh.work@gmail.com>
---
 lib/horizon | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/horizon b/lib/horizon
index 6f753f546f..7c0d443aa6 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -109,6 +109,10 @@ function configure_horizon {
         _horizon_config_set $local_settings "" OPENSTACK_KEYSTONE_MULTIDOMAIN_SUPPORT "True"
     fi
 
+    if is_service_enabled c-bak; then
+        _horizon_config_set $local_settings OPENSTACK_CINDER_FEATURES enable_backup "True"
+    fi
+
     # Create an empty directory that apache uses as docroot
     sudo mkdir -p $HORIZON_DIR/.blackhole
 

From fadf63e4a962e4922cdf529c17231fbb49f91e89 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Thu, 16 May 2024 02:37:02 +0000
Subject: [PATCH 2228/2409] Updated from generate-devstack-plugins-list

Change-Id: Ifa6db2e765f5f15a1d7421eef061377e55b58ec7
---
 doc/source/plugin-registry.rst | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 2d2a92c4a9..21cf52c736 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -37,7 +37,6 @@ openstack/devstack-plugin-container      `https://opendev.org/openstack/devstack
 openstack/devstack-plugin-kafka          `https://opendev.org/openstack/devstack-plugin-kafka <https://opendev.org/openstack/devstack-plugin-kafka>`__
 openstack/devstack-plugin-nfs            `https://opendev.org/openstack/devstack-plugin-nfs <https://opendev.org/openstack/devstack-plugin-nfs>`__
 openstack/devstack-plugin-open-cas       `https://opendev.org/openstack/devstack-plugin-open-cas <https://opendev.org/openstack/devstack-plugin-open-cas>`__
-openstack/ec2-api                        `https://opendev.org/openstack/ec2-api <https://opendev.org/openstack/ec2-api>`__
 openstack/freezer                        `https://opendev.org/openstack/freezer <https://opendev.org/openstack/freezer>`__
 openstack/freezer-api                    `https://opendev.org/openstack/freezer-api <https://opendev.org/openstack/freezer-api>`__
 openstack/freezer-tempest-plugin         `https://opendev.org/openstack/freezer-tempest-plugin <https://opendev.org/openstack/freezer-tempest-plugin>`__
@@ -62,7 +61,6 @@ openstack/mistral                        `https://opendev.org/openstack/mistral
 openstack/monasca-api                    `https://opendev.org/openstack/monasca-api <https://opendev.org/openstack/monasca-api>`__
 openstack/monasca-events-api             `https://opendev.org/openstack/monasca-events-api <https://opendev.org/openstack/monasca-events-api>`__
 openstack/monasca-tempest-plugin         `https://opendev.org/openstack/monasca-tempest-plugin <https://opendev.org/openstack/monasca-tempest-plugin>`__
-openstack/murano                         `https://opendev.org/openstack/murano <https://opendev.org/openstack/murano>`__
 openstack/networking-bagpipe             `https://opendev.org/openstack/networking-bagpipe <https://opendev.org/openstack/networking-bagpipe>`__
 openstack/networking-baremetal           `https://opendev.org/openstack/networking-baremetal <https://opendev.org/openstack/networking-baremetal>`__
 openstack/networking-bgpvpn              `https://opendev.org/openstack/networking-bgpvpn <https://opendev.org/openstack/networking-bgpvpn>`__
@@ -84,12 +82,8 @@ openstack/osprofiler                     `https://opendev.org/openstack/osprofil
 openstack/ovn-bgp-agent                  `https://opendev.org/openstack/ovn-bgp-agent <https://opendev.org/openstack/ovn-bgp-agent>`__
 openstack/ovn-octavia-provider           `https://opendev.org/openstack/ovn-octavia-provider <https://opendev.org/openstack/ovn-octavia-provider>`__
 openstack/rally-openstack                `https://opendev.org/openstack/rally-openstack <https://opendev.org/openstack/rally-openstack>`__
-openstack/sahara                         `https://opendev.org/openstack/sahara <https://opendev.org/openstack/sahara>`__
-openstack/sahara-dashboard               `https://opendev.org/openstack/sahara-dashboard <https://opendev.org/openstack/sahara-dashboard>`__
-openstack/senlin                         `https://opendev.org/openstack/senlin <https://opendev.org/openstack/senlin>`__
 openstack/shade                          `https://opendev.org/openstack/shade <https://opendev.org/openstack/shade>`__
 openstack/skyline-apiserver              `https://opendev.org/openstack/skyline-apiserver <https://opendev.org/openstack/skyline-apiserver>`__
-openstack/solum                          `https://opendev.org/openstack/solum <https://opendev.org/openstack/solum>`__
 openstack/storlets                       `https://opendev.org/openstack/storlets <https://opendev.org/openstack/storlets>`__
 openstack/tacker                         `https://opendev.org/openstack/tacker <https://opendev.org/openstack/tacker>`__
 openstack/tap-as-a-service               `https://opendev.org/openstack/tap-as-a-service <https://opendev.org/openstack/tap-as-a-service>`__

From 608489cd59b0d0f6f82937abb6a317489ac4d7a4 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <sfinucan@redhat.com>
Date: Tue, 28 May 2024 13:27:14 +0100
Subject: [PATCH 2229/2409] openrc: Stop setting OS_TENANT_NAME
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

All clients - OSC included - use keystoneauth under the hood which
hasn't required this in a very long time. Stop setting it and remove the
warning.

We also remove references to 'NOVA_*' variables that haven't been a
thing since well before *I* started working on OpenStack 😅

Change-Id: I882081040215d8e32932ec5d03be34e467e4fbc2
Signed-off-by: Stephen Finucane <sfinucan@redhat.com>
---
 openrc | 13 +------------
 1 file changed, 1 insertion(+), 12 deletions(-)

diff --git a/openrc b/openrc
index 6d488bb0ba..b72bedbea4 100644
--- a/openrc
+++ b/openrc
@@ -7,9 +7,6 @@
 #   Set OS_USERNAME to override the default user name 'demo'
 #   Set ADMIN_PASSWORD to set the password for 'admin' and 'demo'
 
-# NOTE: support for the old NOVA_* novaclient environment variables has
-# been removed.
-
 if [[ -n "$1" ]]; then
     OS_USERNAME=$1
 fi
@@ -36,22 +33,14 @@ fi
 source $RC_DIR/lib/tls
 
 # The OpenStack ecosystem has standardized the term **project** as the
-# entity that owns resources.  In some places **tenant** remains
-# referenced, but in all cases this just means **project**.  We will
-# warn if we need to turn on legacy **tenant** support to have a
-# working environment.
+# entity that owns resources.
 export OS_PROJECT_NAME=${OS_PROJECT_NAME:-demo}
 
-echo "WARNING: setting legacy OS_TENANT_NAME to support cli tools."
-export OS_TENANT_NAME=$OS_PROJECT_NAME
-
 # In addition to the owning entity (project), nova stores the entity performing
 # the action as the **user**.
 export OS_USERNAME=${OS_USERNAME:-demo}
 
 # With Keystone you pass the keystone password instead of an api key.
-# Recent versions of novaclient use OS_PASSWORD instead of NOVA_API_KEYs
-# or NOVA_PASSWORD.
 export OS_PASSWORD=${ADMIN_PASSWORD:-secret}
 
 # Region

From 9fff87fbc7c972d18b9bf59847b61b0bbd8e4dd9 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <sfinucan@redhat.com>
Date: Tue, 28 May 2024 13:33:32 +0100
Subject: [PATCH 2230/2409] openrc: Group auth-related options together

Change-Id: I98f283b33c2350cc4388463571013896086b31fa
Signed-off-by: Stephen Finucane <sfinucan@redhat.com>
---
 openrc | 14 ++------------
 1 file changed, 2 insertions(+), 12 deletions(-)

diff --git a/openrc b/openrc
index b72bedbea4..e20a5a56b9 100644
--- a/openrc
+++ b/openrc
@@ -32,18 +32,11 @@ fi
 # Get some necessary configuration
 source $RC_DIR/lib/tls
 
-# The OpenStack ecosystem has standardized the term **project** as the
-# entity that owns resources.
+# Minimal configuration
+export OS_AUTH_TYPE=password
 export OS_PROJECT_NAME=${OS_PROJECT_NAME:-demo}
-
-# In addition to the owning entity (project), nova stores the entity performing
-# the action as the **user**.
 export OS_USERNAME=${OS_USERNAME:-demo}
-
-# With Keystone you pass the keystone password instead of an api key.
 export OS_PASSWORD=${ADMIN_PASSWORD:-secret}
-
-# Region
 export OS_REGION_NAME=${REGION_NAME:-RegionOne}
 
 # Set the host API endpoint. This will default to HOST_IP if SERVICE_IP_VERSION
@@ -65,9 +58,6 @@ fi
 # Identity API version
 export OS_IDENTITY_API_VERSION=3
 
-# Ask keystoneauth1 to use keystone
-export OS_AUTH_TYPE=password
-
 # Authenticating against an OpenStack cloud using Keystone returns a **Token**
 # and **Service Catalog**.  The catalog contains the endpoints for all services
 # the user/project has access to - including nova, glance, keystone, swift, ...

From 5412dbfe7b797149f1f68100de8003b1876398fe Mon Sep 17 00:00:00 2001
From: Stephen Finucane <sfinucan@redhat.com>
Date: Tue, 28 May 2024 13:35:28 +0100
Subject: [PATCH 2231/2409] stackrc: Remove USE_PYTHON3

This is no longer necessary and any users of this should be updated to
remove references.

Change-Id: Ice5083d8897376fd2ed6bd509419526e15baaf12
Signed-off-by: Stephen Finucane <sfinucan@redhat.com>
---
 stackrc | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/stackrc b/stackrc
index de81f01f38..b37959712b 100644
--- a/stackrc
+++ b/stackrc
@@ -126,10 +126,6 @@ if [[ -r $RC_DIR/.localrc.password ]]; then
     source $RC_DIR/.localrc.password
 fi
 
-# Control whether Python 3 should be used at all.
-# TODO(frickler): Drop this when all consumers are fixed
-export USE_PYTHON3=True
-
 # Adding the specific version of Python 3 to this variable will install
 # the app using that version of the interpreter instead of just 3.
 _DEFAULT_PYTHON3_VERSION="$(_get_python_version python3)"

From b500d80c7641583039188baf62c215676e3d81db Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Fri, 14 Jun 2024 12:58:58 +0200
Subject: [PATCH 2232/2409] Fix deployment of the neutron with uwsgi

After patch [1] deploying neutron with uwsgi was not working correctly
due to the fact that there was different paths for the applications
set in the api-paste.ini file. Instead of default ones like:

/: neutronversions_composite
/healthcheck: healthcheck
/v2.0: neutronapi_v2_0

it was changing it to something like:

/networking/: neutronversions_composite
/networking/healthcheck: healthcheck
/networking/v2.0: neutronapi_v2_0

where 'networking' can be configured to something else.
This patch fixes deployment of neutron with uwsgi by not changing its
api-paste.ini file when NEUTRON_DEPLOY_MOD_WSGI=True.

[1] https://review.opendev.org/c/openstack/devstack/+/849145

Closes-bug: #2069418
Change-Id: I12b860d4d98442e2b5ac0c9fd854f1226633b518
---
 lib/neutron | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron b/lib/neutron
index 808043cebe..021ffeb11e 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -1002,7 +1002,7 @@ function _configure_neutron_service {
     Q_API_PASTE_FILE=$NEUTRON_CONF_DIR/api-paste.ini
     cp $NEUTRON_DIR/etc/api-paste.ini $Q_API_PASTE_FILE
 
-    if [[ -n "$NEUTRON_ENDPOINT_SERVICE_NAME" ]]; then
+    if [[ "$NEUTRON_DEPLOY_MOD_WSGI" == "False" && -n "$NEUTRON_ENDPOINT_SERVICE_NAME" ]]; then
         _replace_api_paste_composite
     fi
 

From 4d69238383c45c862d588cfe1e0234e6a13a1220 Mon Sep 17 00:00:00 2001
From: yatinkarel <ykarel@redhat.com>
Date: Fri, 21 Jun 2024 18:27:32 +0530
Subject: [PATCH 2233/2409] Fix rdo_release for unmaintained branches

Only branches with stable/ as prefix were considered
but now we have branches even with different
prefix like unmaintained/, fix it to consider
such cases by using a generic filter instead of
assuming branch name starts with stable.

Change-Id: I967de13094ff6df46737a22d4e1758f9900dfbc9
---
 stack.sh | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/stack.sh b/stack.sh
index 0c36e1034e..740682920c 100755
--- a/stack.sh
+++ b/stack.sh
@@ -307,8 +307,8 @@ function _install_rdo {
             # rdo-release.el8.rpm points to latest RDO release, use that for master
             sudo dnf -y install https://rdoproject.org/repos/rdo-release.el8.rpm
         else
-            # For stable branches use corresponding release rpm
-            rdo_release=$(echo $TARGET_BRANCH | sed "s|stable/||g")
+            # For stable/unmaintained branches use corresponding release rpm
+            rdo_release=${TARGET_BRANCH#*/}
             sudo dnf -y install https://rdoproject.org/repos/openstack-${rdo_release}/rdo-release-${rdo_release}.el8.rpm
         fi
     elif [[ $DISTRO == "rhel9" ]]; then
@@ -316,8 +316,8 @@ function _install_rdo {
             # rdo-release.el9.rpm points to latest RDO release, use that for master
             sudo dnf -y install https://rdoproject.org/repos/rdo-release.el9.rpm
         else
-            # For stable branches use corresponding release rpm
-            rdo_release=$(echo $TARGET_BRANCH | sed "s|stable/||g")
+            # For stable/unmaintained branches use corresponding release rpm
+            rdo_release=${TARGET_BRANCH#*/}
             sudo dnf -y install https://rdoproject.org/repos/openstack-${rdo_release}/rdo-release-${rdo_release}.el9.rpm
         fi
     fi

From 56368c271d5915af76e8e5d2b0bd873d09ba3a49 Mon Sep 17 00:00:00 2001
From: Rodolfo Alonso Hernandez <ralonsoh@redhat.com>
Date: Mon, 17 Jun 2024 15:10:40 +0000
Subject: [PATCH 2234/2409] [Neutron] Add a new Neutron service:
 neutron-periodic-workers

This new service is spawned when using Neutron WSGI module. This new
service executes the plugin workers inside a wrapper executor class
called ``AllServicesNeutronWorker``. The workers are executed as
threads inside the process.

Depends-On: https://review.opendev.org/c/openstack/neutron/+/922110
Related-Bug: #2069581

Change-Id: I6b76b7bcee1365c80f76231e0311406831f8ce41
---
 lib/neutron | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/neutron b/lib/neutron
index 8b65980e90..e0b5d5d68c 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -634,7 +634,9 @@ function start_neutron_service_and_check {
         run_process neutron-api "$(which uwsgi) --procname-prefix neutron-api --ini $NEUTRON_UWSGI_CONF"
         neutron_url=$Q_PROTOCOL://$Q_HOST/
         enable_service neutron-rpc-server
+        enable_service neutron-periodic-workers
         run_process neutron-rpc-server "$NEUTRON_BIN_DIR/neutron-rpc-server $cfg_file_options"
+        run_process neutron-periodic-workers "$NEUTRON_BIN_DIR/neutron-periodic-workers $cfg_file_options"
     else
         run_process q-svc "$NEUTRON_BIN_DIR/neutron-server $cfg_file_options"
         neutron_url=$service_protocol://$Q_HOST:$service_port/
@@ -706,6 +708,7 @@ function stop_other {
 
     if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
         stop_process neutron-rpc-server
+        stop_process neutron-periodic-workers
         stop_process neutron-api
     else
         stop_process q-svc
@@ -823,6 +826,7 @@ function cleanup_neutron {
     if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
         stop_process neutron-api
         stop_process neutron-rpc-server
+        stop_process neutron-periodic-workers
         remove_uwsgi_config "$NEUTRON_UWSGI_CONF" "neutron-api"
         sudo rm -f $(apache_site_config_for neutron-api)
     fi

From 41d253a6f94c1646f2bd28ac373d6aaf8bfa6089 Mon Sep 17 00:00:00 2001
From: Sean Mooney <work@seanmooney.info>
Date: Thu, 20 Jun 2024 19:03:37 +0100
Subject: [PATCH 2235/2409] add ubuntu noble (24.04) support

This change installs setuptools in the requirements
and global venv to ensure that distutils is present

This change also adds new single and two node
nodeset for noble and a devstack platform job as nonvoting.

Change-Id: Ie1f8ebc5db75d6913239c529ee923395a764e19c
---
 .zuul.yaml | 52 ++++++++++++++++++++++++++++++++++++++++++++++++++++
 inc/python |  2 +-
 lib/infra  |  2 +-
 stack.sh   |  2 +-
 4 files changed, 55 insertions(+), 3 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 294dd48f4d..50a34ae0b3 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -8,6 +8,16 @@
         nodes:
           - controller
 
+- nodeset:
+    name: openstack-single-node-noble
+    nodes:
+      - name: controller
+        label: ubuntu-noble
+    groups:
+      - name: tempest
+        nodes:
+          - controller
+
 - nodeset:
     name: openstack-single-node-focal
     nodes:
@@ -148,6 +158,36 @@
         nodes:
           - compute1
 
+- nodeset:
+    name: openstack-two-node-noble
+    nodes:
+      - name: controller
+        label: ubuntu-noble
+      - name: compute1
+        label: ubuntu-noble
+    groups:
+      # Node where tests are executed and test results collected
+      - name: tempest
+        nodes:
+          - controller
+      # Nodes running the compute service
+      - name: compute
+        nodes:
+          - controller
+          - compute1
+      # Nodes that are not the controller
+      - name: subnode
+        nodes:
+          - compute1
+      # Switch node for multinode networking setup
+      - name: switch
+        nodes:
+          - controller
+      # Peer nodes for multinode networking setup
+      - name: peers
+        nodes:
+          - compute1
+
 - nodeset:
     name: openstack-two-node-focal
     nodes:
@@ -652,6 +692,17 @@
     vars:
       configure_swap_size: 4096
 
+
+- job:
+    name: devstack-platform-ubuntu-noble
+    parent: tempest-full-py3
+    description: Ubuntu 24.04 LTS (noble) platform test
+    nodeset: openstack-single-node-noble
+    timeout: 9000
+    voting: false
+    vars:
+      configure_swap_size: 8192
+
 - job:
     name: devstack-platform-ubuntu-jammy-ovn-source
     parent: devstack-platform-ubuntu-jammy
@@ -849,6 +900,7 @@
         - devstack-platform-rocky-blue-onyx
         - devstack-platform-ubuntu-jammy-ovn-source
         - devstack-platform-ubuntu-jammy-ovs
+        - devstack-platform-ubuntu-noble
         - devstack-platform-openEuler-22.03-ovn-source
         - devstack-platform-openEuler-22.03-ovs
         - devstack-multinode
diff --git a/inc/python b/inc/python
index 43b06eb520..2339afdd6d 100644
--- a/inc/python
+++ b/inc/python
@@ -41,7 +41,7 @@ function setup_devstack_virtualenv {
         # This package is currently installed via the distro and not
         # available on pypi.
         python$PYTHON3_VERSION -m venv --system-site-packages $DEVSTACK_VENV
-        pip_install -U pip
+        pip_install -U pip setuptools
     fi
     if [[ ":$PATH:" != *":$DEVSTACK_VENV/bin:"* ]] ; then
         export PATH="$DEVSTACK_VENV/bin:$PATH"
diff --git a/lib/infra b/lib/infra
index b983f2b739..2aad00354a 100644
--- a/lib/infra
+++ b/lib/infra
@@ -31,7 +31,7 @@ function install_infra {
     local PIP_VIRTUAL_ENV="$REQUIREMENTS_DIR/.venv"
     [ ! -d $PIP_VIRTUAL_ENV ] && ${VIRTUALENV_CMD} $PIP_VIRTUAL_ENV
     # We don't care about testing git pbr in the requirements venv.
-    PIP_VIRTUAL_ENV=$PIP_VIRTUAL_ENV pip_install -U pbr
+    PIP_VIRTUAL_ENV=$PIP_VIRTUAL_ENV pip_install -U pbr setuptools
     PIP_VIRTUAL_ENV=$PIP_VIRTUAL_ENV pip_install $REQUIREMENTS_DIR
 
     # Unset the PIP_VIRTUAL_ENV so that PBR does not end up trapped
diff --git a/stack.sh b/stack.sh
index 0c36e1034e..6ae324bb0c 100755
--- a/stack.sh
+++ b/stack.sh
@@ -230,7 +230,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-SUPPORTED_DISTROS="bookworm|bullseye|jammy|rhel8|rhel9|openEuler-22.03"
+SUPPORTED_DISTROS="bookworm|bullseye|jammy|noble|rhel8|rhel9|openEuler-22.03"
 
 if [[ ! ${DISTRO} =~ $SUPPORTED_DISTROS ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"

From db305d2a4bb36c3d3a4ef4a108069cd77bca540e Mon Sep 17 00:00:00 2001
From: Sean Mooney <work@seanmooney.info>
Date: Mon, 24 Jun 2024 15:27:58 +0100
Subject: [PATCH 2236/2409] enable openstack-cli-server and other perfromace
 tunings

This commit enabeles a number of performance optimizations
to tune the host vms memory and io by leveraging zswap
and other kernel parmaters to minimize the effect of io
latency and memory pressure.

The openstack-cli-server has been enabled in the nova ci
for several months now and has proven to speed up devstack
signifcantly, while this change does not enable it by
default in devstack it does enable it by default in the ci
jobs.

simiarly the zswap and other tuning remain disabled by default
in devstack but are enabled by default in the devstack job.

This change limits the qemu tb_cache_size to 128MB form 1G,
this requires libvirt 8.0.0 or newer. as bullseye and
openeuler-22.03 do not meet that requirement they have been
removed. libvirt 8.0.0 will be the new min version supported
in nova in the 2025.1 release so the decions was made
to drop supprot for older release now instead of doing it
at the start of the 2025.1 cycle. debain coverage is still
provided by the newer bookworm relase. openeuler-22.03 has
been superseded by the openeuler-24.03 lts release.
openeuler-24.03 is not currnetly aviable in ci but supprot
could be readded if desired however that is out os scope of
this change.

Change-Id: Ib45ca08c7e3e833b14f7e6ec496ad2d2f7073f99
---
 .zuul.yaml | 148 +++++++++++++++++++++++------------------------------
 stack.sh   |   2 +-
 2 files changed, 64 insertions(+), 86 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 50a34ae0b3..06d76d0093 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -68,6 +68,9 @@
         nodes:
           - controller
 
+# Note(sean-k-mooney): this is still used by horizon for
+# horizon-integration-tests, horizon-integration-pytest and
+# horizon-ui-pytest, remove when horizon is updated.
 - nodeset:
     name: devstack-single-node-debian-bullseye
     nodes:
@@ -88,16 +91,6 @@
         nodes:
           - controller
 
-- nodeset:
-    name: devstack-single-node-openeuler-22.03
-    nodes:
-      - name: controller
-        label: openEuler-22-03-LTS
-    groups:
-      - name: tempest
-        nodes:
-          - controller
-
 - nodeset:
     name: openstack-two-node-centos-9-stream
     nodes:
@@ -463,6 +456,7 @@
         file_tracker: true
         mysql: true
         rabbit: true
+        openstack-cli-server: true
     group-vars:
       subnode:
         devstack_services:
@@ -470,6 +464,7 @@
           dstat: false
           memory_tracker: true
           file_tracker: true
+          openstack-cli-server: true
         devstack_localrc:
           # Multinode specific settings
           HOST_IP: "{{ hostvars[inventory_hostname]['nodepool']['private_ipv4'] }}"
@@ -517,7 +512,14 @@
       - opendev.org/openstack/swift
     timeout: 7200
     vars:
-      configure_swap_size: 4096
+      # based on observation of the integrated gate
+      # tempest-integrated-compute was only using ~1.7GB of swap
+      # when zswap and the host turning are enabled that increase
+      # slightly to ~2GB. we are setting the swap size to 8GB to
+      # be safe and account for more complex scenarios.
+      # we should revisit this value after some time to see if we
+      # can reduce it.
+      configure_swap_size: 8192
       devstack_localrc:
         # Common OpenStack services settings
         SWIFT_REPLICAS: 1
@@ -526,11 +528,33 @@
         DEBUG_LIBVIRT_COREDUMPS: true
         NOVA_VNC_ENABLED: true
         OVN_DBS_LOG_LEVEL: dbg
+        # tune the host to optimize memory usage and hide io latency
+        # these setting will configure the kernel to treat the host page
+        # cache and swap with equal priority, and prefer deferring writes
+        # changing the default swappiness, dirty_ratio and
+        # the vfs_cache_pressure
+        ENABLE_SYSCTL_MEM_TUNING: true
+        # the net tuning optimizes ipv4 tcp fast open and config the default
+        # qdisk policy to pfifo_fast which effectively disable all qos.
+        # this minimizes the cpu load of the host network stack
+        ENABLE_SYSCTL_NET_TUNING: true
+        # zswap allows the kernel to compress pages in memory before swapping
+        # them to disk. this can reduce the amount of swap used and improve
+        # performance. effectively this trades a small amount of cpu for an
+        # increase in swap performance by reducing the amount of data
+        # written to disk. the overall speedup is proportional to the
+        # compression ratio and the speed of the swap device.
+        ENABLE_ZSWAP: true
       devstack_local_conf:
         post-config:
           $NEUTRON_CONF:
             DEFAULT:
               global_physnet_mtu: '{{ external_bridge_mtu }}'
+          $NOVA_CPU_CONF:
+            libvirt:
+              # Use lower TB cache than default(1GiB), only applicable with
+              # libvirt>=8.0.0
+              tb_cache_size: 128
       devstack_services:
         # Core services enabled for this branch.
         # This list replaces the test-matrix.
@@ -618,6 +642,30 @@
           Q_HOST: "{{ hostvars['controller']['nodepool']['private_ipv4'] }}"
           NOVA_VNC_ENABLED: true
           ENABLE_CHASSIS_AS_GW: false
+          # tune the host to optimize memory usage and hide io latency
+          # these setting will configure the kernel to treat the host page
+          # cache and swap with equal priority, and prefer deferring writes
+          # changing the default swappiness, dirty_ratio and
+          # the vfs_cache_pressure
+          ENABLE_SYSCTL_MEM_TUNING: true
+          # the net tuning optimizes ipv4 tcp fast open and config the default
+          # qdisk policy to pfifo_fast which effectively disable all qos.
+          # this minimizes the cpu load of the host network stack
+          ENABLE_SYSCTL_NET_TUNING: true
+          # zswap allows the kernel to compress pages in memory before swapping
+          # them to disk. this can reduce the amount of swap used and improve
+          # performance. effectivly this trades a small amount of cpu for an
+          # increase in swap performance by reducing the amount of data
+          # written to disk. the overall speedup is porportional to the
+          # compression ratio and the speed of the swap device.
+          ENABLE_ZSWAP: true
+        devstack_local_conf:
+          post-config:
+            $NOVA_CPU_CONF:
+              libvirt:
+                # Use lower TB cache than default(1GiB), only applicable with
+                # libvirt>=8.0.0
+                tb_cache_size: 128
 
 - job:
     name: devstack-ipv6
@@ -669,15 +717,6 @@
     vars:
       configure_swap_size: 4096
 
-- job:
-    name: devstack-platform-debian-bullseye
-    parent: tempest-full-py3
-    description: Debian Bullseye platform test
-    nodeset: devstack-single-node-debian-bullseye
-    timeout: 9000
-    vars:
-      configure_swap_size: 4096
-
 - job:
     name: devstack-platform-rocky-blue-onyx
     parent: tempest-full-py3
@@ -754,62 +793,6 @@
           # Enable Neutron ML2/OVS services
           q-agt: true
 
-- job:
-    name: devstack-platform-openEuler-22.03-ovn-source
-    parent: tempest-full-py3
-    description: openEuler 22.03 LTS platform test (OVN)
-    nodeset: devstack-single-node-openeuler-22.03
-    voting: false
-    timeout: 9000
-    vars:
-      configure_swap_size: 4096
-      devstack_localrc:
-        # NOTE(wxy):  OVN package is not supported by openEuler yet. Build it
-        # from source instead.
-        OVN_BUILD_FROM_SOURCE: True
-        OVN_BRANCH: "v21.06.0"
-        OVS_BRANCH: "a4b04276ab5934d087669ff2d191a23931335c87"
-        OVS_SYSCONFDIR: "/usr/local/etc/openvswitch"
-
-- job:
-    name: devstack-platform-openEuler-22.03-ovs
-    parent: tempest-full-py3
-    description: openEuler 22.03 LTS platform test (OVS)
-    nodeset: devstack-single-node-openeuler-22.03
-    voting: false
-    timeout: 9000
-    vars:
-      configure_swap_size: 8192
-      devstack_localrc:
-        Q_AGENT: openvswitch
-        Q_ML2_PLUGIN_MECHANISM_DRIVERS: openvswitch
-        Q_ML2_TENANT_NETWORK_TYPE: vxlan
-      devstack_services:
-        # Disable OVN services
-        ovn-northd: false
-        ovn-controller: false
-        ovs-vswitchd: false
-        ovsdb-server: false
-        # Disable Neutron ML2/OVN services
-        q-ovn-metadata-agent: false
-        # Enable Neutron ML2/OVS services
-        q-agt: true
-        q-dhcp: true
-        q-l3: true
-        q-meta: true
-        q-metering: true
-    group-vars:
-      subnode:
-        devstack_services:
-          # Disable OVN services
-          ovn-controller: false
-          ovs-vswitchd: false
-          ovsdb-server: false
-          # Disable Neutron ML2/OVN services
-          q-ovn-metadata-agent: false
-          # Enable Neutron ML2/OVS services
-          q-agt: true
-
 - job:
     name: devstack-no-tls-proxy
     parent: tempest-full-py3
@@ -896,13 +879,10 @@
         - devstack-enforce-scope
         - devstack-platform-centos-9-stream
         - devstack-platform-debian-bookworm
-        - devstack-platform-debian-bullseye
         - devstack-platform-rocky-blue-onyx
         - devstack-platform-ubuntu-jammy-ovn-source
         - devstack-platform-ubuntu-jammy-ovs
         - devstack-platform-ubuntu-noble
-        - devstack-platform-openEuler-22.03-ovn-source
-        - devstack-platform-openEuler-22.03-ovs
         - devstack-multinode
         - devstack-unit-tests
         - openstack-tox-bashate
@@ -943,7 +923,6 @@
         - devstack
         - devstack-ipv6
         - devstack-platform-debian-bookworm
-        - devstack-platform-debian-bullseye
         # NOTE(danms): Disabled due to instability, see comment in the job
         # definition above.
         # - devstack-platform-rocky-blue-onyx
@@ -978,7 +957,9 @@
     # pruned.
     #
     # * nova-next: maintained by nova for unreleased/undefaulted
-    #    things
+    #    things, this job is not experimental but often is used to test
+    #    things that are not yet production ready or to test what will be
+    #    the new default after a deprecation period has ended.
     # * neutron-fullstack-with-uwsgi: maintained by neutron for fullstack test
     #    when neutron-api is served by uwsgi, it's in exprimental for testing.
     #    the next cycle we can remove this  job if things turn out to be
@@ -988,7 +969,7 @@
     #    stable engouh with uwsgi.
     # * neutron-ovn-tempest-with-uwsgi: maintained by neutron for tempest test.
     #    Next cycle we can remove this if everything run out stable enough.
-    # * nova-multi-cell: maintained by nova and currently non-voting in the
+    # * nova-multi-cell: maintained by nova and now is voting in the
     #    check queue for nova changes but relies on devstack configuration
 
     experimental:
@@ -1026,9 +1007,6 @@
       jobs:
         - devstack-platform-centos-9-stream
         - devstack-platform-debian-bookworm
-        - devstack-platform-debian-bullseye
         - devstack-platform-rocky-blue-onyx
         - devstack-platform-ubuntu-jammy-ovn-source
         - devstack-platform-ubuntu-jammy-ovs
-        - devstack-platform-openEuler-22.03-ovn-source
-        - devstack-platform-openEuler-22.03-ovs
diff --git a/stack.sh b/stack.sh
index 77548105a7..ab3f01cdbd 100755
--- a/stack.sh
+++ b/stack.sh
@@ -230,7 +230,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-SUPPORTED_DISTROS="bookworm|bullseye|jammy|noble|rhel8|rhel9|openEuler-22.03"
+SUPPORTED_DISTROS="bookworm|jammy|noble|rhel9"
 
 if [[ ! ${DISTRO} =~ $SUPPORTED_DISTROS ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"

From e825ba07a1b88ab0570053f92123aa451e4b2ec8 Mon Sep 17 00:00:00 2001
From: Dmitry Tantsur <dtantsur@protonmail.com>
Date: Wed, 26 Jun 2024 18:10:43 +0200
Subject: [PATCH 2237/2409] Create parent directory in merge_config_file

The code accounts for the config file not existing but it does not
account for the parent directory missing. This is currently breaking any
Ironic jobs that disable Nova.

Change-Id: Ia5fcfe6c63f5cc40b11f7e1f3be244d7897f26f6
---
 inc/meta-config | 1 +
 1 file changed, 1 insertion(+)

diff --git a/inc/meta-config b/inc/meta-config
index be73b60800..b9d9649e4b 100644
--- a/inc/meta-config
+++ b/inc/meta-config
@@ -90,6 +90,7 @@ function merge_config_file {
     local real_configfile
     real_configfile=$(eval echo $configfile)
     if [ ! -f $real_configfile ]; then
+        mkdir -p $(dirname $real_configfile) || die $LINENO "could not create the directory of $real_configfile ($configfile)"
         touch $real_configfile || die $LINENO "could not create config file $real_configfile ($configfile)"
     fi
 

From c707dd3fc2d601db5169508ed39e24dde89e9631 Mon Sep 17 00:00:00 2001
From: yatinkarel <ykarel@redhat.com>
Date: Wed, 26 Apr 2023 14:59:25 +0000
Subject: [PATCH 2238/2409] [nova] Add flag to set libvirt tb_cache_size

A config option is being added in nova with [1]
in order to allow configuring lower tb-cache size
for qemu guest VMs.

This patch adds a flag in devstack so jobs can
utilize it to set required tb-cache size.

[1] https://review.opendev.org/c/openstack/nova/+/868419

Co-Authored-By: Sean Mooney <work@seanmooney.info>
Related: blueprint libvirt-tb-cache-size
Change-Id: Ifde737eb5d87dfe860445097d1f2b0ce16b0de05
---
 .zuul.yaml | 18 ++++++------------
 lib/nova   |  6 ++++++
 2 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 06d76d0093..3e6c42e68f 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -544,17 +544,15 @@
         # increase in swap performance by reducing the amount of data
         # written to disk. the overall speedup is proportional to the
         # compression ratio and the speed of the swap device.
+        # NOTE: this option is ignored when not using nova with the libvirt
+        # virt driver.
+        NOVA_LIBVIRT_TB_CACHE_SIZE: 128
         ENABLE_ZSWAP: true
       devstack_local_conf:
         post-config:
           $NEUTRON_CONF:
             DEFAULT:
               global_physnet_mtu: '{{ external_bridge_mtu }}'
-          $NOVA_CPU_CONF:
-            libvirt:
-              # Use lower TB cache than default(1GiB), only applicable with
-              # libvirt>=8.0.0
-              tb_cache_size: 128
       devstack_services:
         # Core services enabled for this branch.
         # This list replaces the test-matrix.
@@ -659,13 +657,9 @@
           # written to disk. the overall speedup is porportional to the
           # compression ratio and the speed of the swap device.
           ENABLE_ZSWAP: true
-        devstack_local_conf:
-          post-config:
-            $NOVA_CPU_CONF:
-              libvirt:
-                # Use lower TB cache than default(1GiB), only applicable with
-                # libvirt>=8.0.0
-                tb_cache_size: 128
+          # NOTE: this option is ignored when not using nova with the libvirt
+          # virt driver.
+          NOVA_LIBVIRT_TB_CACHE_SIZE: 128
 
 - job:
     name: devstack-ipv6
diff --git a/lib/nova b/lib/nova
index ee3f29eebf..7c6ffb2239 100644
--- a/lib/nova
+++ b/lib/nova
@@ -173,6 +173,9 @@ NOVA_SHUTDOWN_TIMEOUT=${NOVA_SHUTDOWN_TIMEOUT:-0}
 # Whether to use Keystone unified limits instead of legacy quota limits.
 NOVA_USE_UNIFIED_LIMITS=$(trueorfalse False NOVA_USE_UNIFIED_LIMITS)
 
+# TB Cache Size in MiB for qemu guests
+NOVA_LIBVIRT_TB_CACHE_SIZE=${NOVA_LIBVIRT_TB_CACHE_SIZE:-0}
+
 # Functions
 # ---------
 
@@ -1071,6 +1074,9 @@ function start_nova_compute {
     fi
 
     if [[ "$VIRT_DRIVER" = 'libvirt' ]]; then
+        if [ ${NOVA_LIBVIRT_TB_CACHE_SIZE} -gt 0 ]; then
+            iniset $NOVA_CPU_CONF libvirt tb_cache_size ${NOVA_LIBVIRT_TB_CACHE_SIZE}
+        fi
         # The group **$LIBVIRT_GROUP** is added to the current user in this script.
         # ``sg`` is used in run_process to execute nova-compute as a member of the
         # **$LIBVIRT_GROUP** group.

From 3a0c0b9ff4bb3568efc471e1bf98fc273e8bc767 Mon Sep 17 00:00:00 2001
From: Rodolfo Alonso Hernandez <ralonsoh@redhat.com>
Date: Mon, 24 Jun 2024 11:09:34 +0000
Subject: [PATCH 2239/2409] [Neutron] Add a new Neutron service:
 neutron-ovn-maintenance-worker

This new service is spawned when using Neutron WSGI module. This new
service executes the OVN maintenance task that syncs the Neutron
database and the OVN database.

Depends-On: https://review.opendev.org/c/openstack/neutron/+/922074
Related-Bug: #1912359

Change-Id: I495459cd9e35e2e76ba7fc9611a589e1685814f5
---
 lib/neutron | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/lib/neutron b/lib/neutron
index e0b5d5d68c..a8cc953b0e 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -369,6 +369,24 @@ function _determine_config_l3 {
     echo "$opts"
 }
 
+function _enable_ovn_maintenance {
+    if [[ $Q_AGENT == "ovn" ]]; then
+        enable_service neutron-ovn-maintenance-worker
+    fi
+}
+
+function _run_ovn_maintenance {
+    if [[ $Q_AGENT == "ovn" ]]; then
+        run_process neutron-ovn-maintenance-worker "$NEUTRON_BIN_DIR/neutron-ovn-maintenance-worker $cfg_file_options"
+    fi
+}
+
+function _stop_ovn_maintenance {
+    if [[ $Q_AGENT == "ovn" ]]; then
+        stop_process neutron-ovn-maintenance-worker
+    fi
+}
+
 # For services and agents that require it, dynamically construct a list of
 # --config-file arguments that are passed to the binary.
 function determine_config_files {
@@ -635,8 +653,10 @@ function start_neutron_service_and_check {
         neutron_url=$Q_PROTOCOL://$Q_HOST/
         enable_service neutron-rpc-server
         enable_service neutron-periodic-workers
+        _enable_ovn_maintenance
         run_process neutron-rpc-server "$NEUTRON_BIN_DIR/neutron-rpc-server $cfg_file_options"
         run_process neutron-periodic-workers "$NEUTRON_BIN_DIR/neutron-periodic-workers $cfg_file_options"
+        _run_ovn_maintenance
     else
         run_process q-svc "$NEUTRON_BIN_DIR/neutron-server $cfg_file_options"
         neutron_url=$service_protocol://$Q_HOST:$service_port/
@@ -710,6 +730,7 @@ function stop_other {
         stop_process neutron-rpc-server
         stop_process neutron-periodic-workers
         stop_process neutron-api
+        _stop_ovn_maintenance
     else
         stop_process q-svc
     fi
@@ -827,6 +848,7 @@ function cleanup_neutron {
         stop_process neutron-api
         stop_process neutron-rpc-server
         stop_process neutron-periodic-workers
+        _stop_ovn_maintenance
         remove_uwsgi_config "$NEUTRON_UWSGI_CONF" "neutron-api"
         sudo rm -f $(apache_site_config_for neutron-api)
     fi

From eb0ac1d217fe8a545f2e697d09fbb650efecb9ef Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Mon, 8 Jul 2024 18:02:25 +0200
Subject: [PATCH 2240/2409] Drop remainders of identity API v2.0 references

keystone has dropped the v2.0 API in queens, time to drop all special
casing for it.

Change-Id: If628c4627f7c8b8c2ee9bca16ea6db693cf8526a
---
 files/openstack-cli-server/openstack |  1 -
 lib/tempest                          | 15 +--------------
 openrc                               | 17 ++---------------
 stackrc                              |  4 ----
 4 files changed, 3 insertions(+), 34 deletions(-)

diff --git a/files/openstack-cli-server/openstack b/files/openstack-cli-server/openstack
index ef05f1b841..47fbfc5e17 100755
--- a/files/openstack-cli-server/openstack
+++ b/files/openstack-cli-server/openstack
@@ -68,7 +68,6 @@ try:
     env = {}
     passenv = ["CINDER_VERSION",
                "OS_AUTH_URL",
-               "OS_IDENTITY_API_VERSION",
                "OS_NO_CACHE",
                "OS_PASSWORD",
                "OS_PROJECT_NAME",
diff --git a/lib/tempest b/lib/tempest
index 6bd203e6f4..7beaf21292 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -18,7 +18,7 @@
 #   - ``PUBLIC_NETWORK_NAME``
 #   - ``VIRT_DRIVER``
 #   - ``LIBVIRT_TYPE``
-#   - ``KEYSTONE_SERVICE_URI``, ``KEYSTONE_SERVICE_URI_V3`` from lib/keystone
+#   - ``KEYSTONE_SERVICE_URI_V3`` from lib/keystone
 #
 # Optional Dependencies:
 #
@@ -381,7 +381,6 @@ function configure_tempest {
     iniset $TEMPEST_CONFIG volume build_timeout $BUILD_TIMEOUT
 
     # Identity
-    iniset $TEMPEST_CONFIG identity uri "$KEYSTONE_SERVICE_URI/v2.0/"
     iniset $TEMPEST_CONFIG identity uri_v3 "$KEYSTONE_SERVICE_URI_V3"
     iniset $TEMPEST_CONFIG identity user_lockout_failure_attempts $KEYSTONE_LOCKOUT_FAILURE_ATTEMPTS
     iniset $TEMPEST_CONFIG identity user_lockout_duration $KEYSTONE_LOCKOUT_DURATION
@@ -392,19 +391,7 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG auth admin_project_name $admin_project_name
         iniset $TEMPEST_CONFIG auth admin_domain_name $admin_domain_name
     fi
-    if [ "$ENABLE_IDENTITY_V2" == "True" ]; then
-        # Run Identity API v2 tests ONLY if needed
-        iniset $TEMPEST_CONFIG identity-feature-enabled api_v2 True
-    else
-        # Skip Identity API v2 tests by default
-        iniset $TEMPEST_CONFIG identity-feature-enabled api_v2 False
-    fi
     iniset $TEMPEST_CONFIG identity auth_version ${TEMPEST_AUTH_VERSION:-v3}
-    if [[ "$TEMPEST_AUTH_VERSION" != "v2" ]]; then
-        # we're going to disable v2 admin unless we're using v2 by default.
-        iniset $TEMPEST_CONFIG identity-feature-enabled api_v2_admin False
-    fi
-
     if is_service_enabled tls-proxy; then
         iniset $TEMPEST_CONFIG identity ca_certificates_file $SSL_BUNDLE_FILE
     fi
diff --git a/openrc b/openrc
index e20a5a56b9..5ec7634638 100644
--- a/openrc
+++ b/openrc
@@ -55,27 +55,14 @@ else
     GLANCE_HOST=${GLANCE_HOST:-$HOST_IP}
 fi
 
-# Identity API version
-export OS_IDENTITY_API_VERSION=3
-
-# Authenticating against an OpenStack cloud using Keystone returns a **Token**
-# and **Service Catalog**.  The catalog contains the endpoints for all services
-# the user/project has access to - including nova, glance, keystone, swift, ...
-# We currently recommend using the version 3 *identity api*.
-#
-
 # If you don't have a working .stackenv, this is the backup position
 KEYSTONE_BACKUP=$SERVICE_PROTOCOL://$SERVICE_HOST:5000
 KEYSTONE_SERVICE_URI=${KEYSTONE_SERVICE_URI:-$KEYSTONE_BACKUP}
 
 export OS_AUTH_URL=${OS_AUTH_URL:-$KEYSTONE_SERVICE_URI}
 
-# Currently, in order to use openstackclient with Identity API v3,
-# we need to set the domain which the user and project belong to.
-if [ "$OS_IDENTITY_API_VERSION" = "3" ]; then
-    export OS_USER_DOMAIN_ID=${OS_USER_DOMAIN_ID:-"default"}
-    export OS_PROJECT_DOMAIN_ID=${OS_PROJECT_DOMAIN_ID:-"default"}
-fi
+export OS_USER_DOMAIN_ID=${OS_USER_DOMAIN_ID:-"default"}
+export OS_PROJECT_DOMAIN_ID=${OS_PROJECT_DOMAIN_ID:-"default"}
 
 # Set OS_CACERT to a default CA certificate chain if it exists.
 if [[ ! -v OS_CACERT ]] ; then
diff --git a/stackrc b/stackrc
index b37959712b..0492c73d1f 100644
--- a/stackrc
+++ b/stackrc
@@ -162,10 +162,6 @@ else
     export PS4='+ $(short_source):   '
 fi
 
-# Configure Identity API version
-# TODO(frickler): Drop this when plugins no longer need it
-IDENTITY_API_VERSION=3
-
 # Global option for enforcing scope. If enabled, ENFORCE_SCOPE overrides
 # each services ${SERVICE}_ENFORCE_SCOPE variables
 ENFORCE_SCOPE=$(trueorfalse False ENFORCE_SCOPE)

From d714f7deaac8d56abe8b028385f5282d6c02d355 Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Tue, 9 Jul 2024 17:14:54 +0200
Subject: [PATCH 2241/2409] Add devstack-platform-ubuntu-noble to periodic

Seems the platform is stable, let's add it to the periodic-weekly tests
that we run.

Change-Id: I185443c0fdb9e1248542a16fd877dc6b8ffd7683
---
 .zuul.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 3e6c42e68f..af7e74b57b 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -725,7 +725,6 @@
     vars:
       configure_swap_size: 4096
 
-
 - job:
     name: devstack-platform-ubuntu-noble
     parent: tempest-full-py3
@@ -1004,3 +1003,4 @@
         - devstack-platform-rocky-blue-onyx
         - devstack-platform-ubuntu-jammy-ovn-source
         - devstack-platform-ubuntu-jammy-ovs
+        - devstack-platform-ubuntu-noble

From 696dbdf045cbf1c1525bb25c005ce767d1c9e9b8 Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Tue, 9 Jul 2024 16:36:37 +0200
Subject: [PATCH 2242/2409] Make nova only use the nova account

Each service should only be using that service's user account within its
configuration, in order to reduce the possible impact of credential
leaks. Start with nova, other services will follow.

Change-Id: I6b3fef5de05d5e0cc032b83a2ed834f1c997a048
---
 lib/neutron | 2 +-
 lib/nova    | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index a8cc953b0e..da21d46079 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -485,7 +485,7 @@ function create_nova_conf_neutron {
     local conf=${1:-$NOVA_CONF}
     iniset $conf neutron auth_type "password"
     iniset $conf neutron auth_url "$KEYSTONE_SERVICE_URI"
-    iniset $conf neutron username "$Q_ADMIN_USERNAME"
+    iniset $conf neutron username nova
     iniset $conf neutron password "$SERVICE_PASSWORD"
     iniset $conf neutron user_domain_name "$SERVICE_DOMAIN_NAME"
     iniset $conf neutron project_name "$SERVICE_PROJECT_NAME"
diff --git a/lib/nova b/lib/nova
index 7c6ffb2239..35c6893763 100644
--- a/lib/nova
+++ b/lib/nova
@@ -640,7 +640,7 @@ function configure_placement_nova_compute {
     local conf=${1:-$NOVA_CONF}
     iniset $conf placement auth_type "password"
     iniset $conf placement auth_url "$KEYSTONE_SERVICE_URI"
-    iniset $conf placement username placement
+    iniset $conf placement username nova
     iniset $conf placement password "$SERVICE_PASSWORD"
     iniset $conf placement user_domain_name "$SERVICE_DOMAIN_NAME"
     iniset $conf placement project_name "$SERVICE_TENANT_NAME"

From 6df53719180c8d587e058a26ed3bb19562e55745 Mon Sep 17 00:00:00 2001
From: Sean Mooney <work@seanmooney.info>
Date: Fri, 12 Jul 2024 20:08:58 +0100
Subject: [PATCH 2243/2409] bump guest ram to prevent kernel panics

one observation we had in down stream ci is
sometimes the cirros 0.6.2 image appared to
crash when using 128MB of ram.

upstream we have been dealing with semi random
kernel panics  which are losely corralated with
cinder volume usage.

Recently we optimisted the devstack jobs by using zswap
this has reduced memory pressure in the jobs.

This patch increase the ram allocated to a flavor
to see if we can afford that with the current conncurnace
level in an attempt to reduce kernel panics.

Two new parmaters are added to allow jobs or users
to set the desired ram size.
TEMPEST_FLAVOR_RAM=${TEMPEST_FLAVOR_RAM:-192}
TEMPEST_FLAVOR_ALT_RAM=${TEMPEST_FLAVOR_ALT_RAM:-256}

Change-Id: Ib6a2d5ab61a771d4f85bd2c2412052efadc77ac5
---
 lib/tempest | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 7beaf21292..a14ed1af72 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -102,6 +102,9 @@ TEMPEST_USE_TEST_ACCOUNTS=$(trueorfalse False TEMPEST_USE_TEST_ACCOUNTS)
 # it will run tempest with
 TEMPEST_CONCURRENCY=${TEMPEST_CONCURRENCY:-$(nproc)}
 
+TEMPEST_FLAVOR_RAM=${TEMPEST_FLAVOR_RAM:-192}
+TEMPEST_FLAVOR_ALT_RAM=${TEMPEST_FLAVOR_ALT_RAM:-256}
+
 # Functions
 # ---------
 
@@ -295,13 +298,15 @@ function configure_tempest {
             if [[ ! ( $available_flavors =~ 'm1.nano' ) ]]; then
                 # Determine the flavor disk size based on the image size.
                 disk=$(image_size_in_gib $image_uuid)
-                openstack --os-cloud devstack-admin flavor create --id 42 --ram 128 --disk $disk --vcpus 1 --property hw_rng:allowed=True m1.nano
+                ram=${TEMPEST_FLAVOR_RAM}
+                openstack --os-cloud devstack-admin flavor create --id 42 --ram ${ram} --disk $disk --vcpus 1 --property hw_rng:allowed=True m1.nano
             fi
             flavor_ref=42
             if [[ ! ( $available_flavors =~ 'm1.micro' ) ]]; then
                 # Determine the alt flavor disk size based on the alt image size.
                 disk=$(image_size_in_gib $image_uuid_alt)
-                openstack --os-cloud devstack-admin flavor create --id 84 --ram 192 --disk $disk --vcpus 1 --property hw_rng:allowed=True m1.micro
+                ram=${TEMPEST_FLAVOR_ALT_RAM}
+                openstack --os-cloud devstack-admin flavor create --id 84 --ram ${ram} --disk $disk --vcpus 1 --property hw_rng:allowed=True m1.micro
             fi
             flavor_ref_alt=84
         else

From aaaa03718bdc05df197708f9354e985936f96853 Mon Sep 17 00:00:00 2001
From: Rodolfo Alonso Hernandez <ralonsoh@redhat.com>
Date: Fri, 19 Jul 2024 08:09:25 +0000
Subject: [PATCH 2244/2409] [Neutron] Do not execute RPC workers if
 "rpc_workers=0"

When the Neutron WSGI module is used, an independent service called
"neutron-rpc-server" is configured and executed. However it will fail
if the number of RPC workers is configured to zero. In that case,
the configuration and execution of this service should be skipped.

If the service is explicitly disabled in the devstack configuration,
it won't be executed neither.

Closes-Bug: #2073572
Change-Id: Idd023a2a8f588152221f20a13ae24fbb7d1618a4
---
 lib/neutron | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index a8cc953b0e..474613926b 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -142,6 +142,7 @@ Q_META_DATA_IP=${Q_META_DATA_IP:-$(ipv6_unquote $SERVICE_HOST)}
 Q_ALLOW_OVERLAPPING_IP=${Q_ALLOW_OVERLAPPING_IP:-True}
 Q_NOTIFY_NOVA_PORT_STATUS_CHANGES=${Q_NOTIFY_NOVA_PORT_STATUS_CHANGES:-True}
 Q_NOTIFY_NOVA_PORT_DATA_CHANGES=${Q_NOTIFY_NOVA_PORT_DATA_CHANGES:-True}
+_Q_RUN_RPC_SERVER=True
 VIF_PLUGGING_IS_FATAL=${VIF_PLUGGING_IS_FATAL:-True}
 VIF_PLUGGING_TIMEOUT=${VIF_PLUGGING_TIMEOUT:-300}
 
@@ -464,6 +465,15 @@ function configure_neutron {
     # clouds, therefore running without a dedicated RPC worker
     # for state reports is more than adequate.
     iniset $NEUTRON_CONF DEFAULT rpc_state_report_workers 0
+    # The default value of "rpc_workers" is None (not defined). If
+    # "rpc_workers" is explicitly set to 0, the RPC workers process should not
+    # be executed. NOTE: this service is only executed when WSGI is enabled
+    # (NEUTRON_DEPLOY_MOD_WSGI=True) for the Neutron server.
+    local rpc_workers
+    rpc_workers=$(iniget_multiline /etc/neutron/neutron.conf DEFAULT rpc_workers)
+    if ! is_service_enabled neutron-rpc-server || [ "$rpc_workers" -eq "0" ]; then
+        _Q_RUN_RPC_SERVER=False
+    fi
 
     if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
         write_uwsgi_config "$NEUTRON_UWSGI_CONF" "$NEUTRON_BIN_DIR/neutron-api" "/networking"
@@ -651,10 +661,14 @@ function start_neutron_service_and_check {
         enable_service neutron-api
         run_process neutron-api "$(which uwsgi) --procname-prefix neutron-api --ini $NEUTRON_UWSGI_CONF"
         neutron_url=$Q_PROTOCOL://$Q_HOST/
-        enable_service neutron-rpc-server
+        if [[ "$_Q_RUN_RPC_SERVER" = True ]]; then
+            enable_service neutron-rpc-server
+        fi
         enable_service neutron-periodic-workers
         _enable_ovn_maintenance
-        run_process neutron-rpc-server "$NEUTRON_BIN_DIR/neutron-rpc-server $cfg_file_options"
+        if [[ "$_Q_RUN_RPC_SERVER" = True ]]; then
+            run_process neutron-rpc-server "$NEUTRON_BIN_DIR/neutron-rpc-server $cfg_file_options"
+        fi
         run_process neutron-periodic-workers "$NEUTRON_BIN_DIR/neutron-periodic-workers $cfg_file_options"
         _run_ovn_maintenance
     else

From 13888a31d2bac9aa46adf72a154be4aa4fbcd790 Mon Sep 17 00:00:00 2001
From: Rodolfo Alonso Hernandez <ralonsoh@redhat.com>
Date: Sat, 20 Jul 2024 15:50:30 +0000
Subject: [PATCH 2245/2409] [Neutron] neutron-rpc-server is not a configurable
 service

The "neutron-rpc-server" is not a configurable service that can be
enabled or disabled. This service is a dependant process of the
"neutron-api-server" service that is spawned when the Neutron API
uses the WSGI module. The execution of this child service will depend
on:
* The Neutron API service when running with the WSGI module. If
  the Neutron API uses the eventlet module, this service won't run
  (the RPC workers will be spawned by the eventlet server).
* The "rpc_workers" configuration variable. If this variable is
  explicitly set to "0", the server must not run.

Closes-Bug: #2073844
Related-Bug: #2073572
Change-Id: Ic019423ca033ded8609d82bb11841b975862ac14
---
 lib/neutron | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/neutron b/lib/neutron
index 474613926b..69bcb86d4d 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -471,7 +471,7 @@ function configure_neutron {
     # (NEUTRON_DEPLOY_MOD_WSGI=True) for the Neutron server.
     local rpc_workers
     rpc_workers=$(iniget_multiline /etc/neutron/neutron.conf DEFAULT rpc_workers)
-    if ! is_service_enabled neutron-rpc-server || [ "$rpc_workers" -eq "0" ]; then
+    if [ "$rpc_workers" == "0" ]; then
         _Q_RUN_RPC_SERVER=False
     fi
 

From 0cd876384a77d2144c3ebc51a0228433fdb7facb Mon Sep 17 00:00:00 2001
From: Stephen Finucane <sfinucan@redhat.com>
Date: Fri, 19 Apr 2024 12:12:16 +0100
Subject: [PATCH 2246/2409] lib/neutron: Migrate neutron to WSGI module path

Change-Id: Ie99ec3bf4198fa7cd7583d2dca648e1474f94aea
Signed-off-by: Stephen Finucane <sfinucan@redhat.com>
Depends-on: https://review.opendev.org/c/openstack/neutron/+/916407
---
 lib/neutron | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/neutron b/lib/neutron
index a8cc953b0e..6336795f2e 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -88,6 +88,7 @@ export NEUTRON_TEST_CONFIG_FILE=${NEUTRON_TEST_CONFIG_FILE:-"$NEUTRON_CONF_DIR/d
 # enough
 NEUTRON_DEPLOY_MOD_WSGI=$(trueorfalse False NEUTRON_DEPLOY_MOD_WSGI)
 
+NEUTRON_UWSGI=neutron.wsgi.api:application
 NEUTRON_UWSGI_CONF=$NEUTRON_CONF_DIR/neutron-api-uwsgi.ini
 
 # If NEUTRON_ENFORCE_SCOPE == True, it will set "enforce_scope"
@@ -466,7 +467,7 @@ function configure_neutron {
     iniset $NEUTRON_CONF DEFAULT rpc_state_report_workers 0
 
     if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
-        write_uwsgi_config "$NEUTRON_UWSGI_CONF" "$NEUTRON_BIN_DIR/neutron-api" "/networking"
+        write_uwsgi_config "$NEUTRON_UWSGI_CONF" "$NEUTRON_UWSGI" "/networking" "" "neutron-api"
     fi
 }
 

From 95697d84cb59dcbc53748ccdb472987cf61df1f4 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Tue, 23 Jul 2024 11:36:49 +0100
Subject: [PATCH 2247/2409] docs: Add a minimal Tempest guide

This can be fleshed out more in the future, including with information
about managing plugins, but this is a start.

Change-Id: I1094d093b704e37370e3e434ebf3697954e99da3
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
---
 doc/source/tempest.rst | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)
 create mode 100644 doc/source/tempest.rst

diff --git a/doc/source/tempest.rst b/doc/source/tempest.rst
new file mode 100644
index 0000000000..65dd5b16b2
--- /dev/null
+++ b/doc/source/tempest.rst
@@ -0,0 +1,25 @@
+=======
+Tempest
+=======
+
+`Tempest`_ is the OpenStack Integration test suite. It is installed by default
+and is used to provide integration testing for many of the OpenStack services.
+Just like DevStack itself, it is possible to extend Tempest with plugins. In
+fact, many Tempest plugin packages also include DevStack plugin to do things
+like pre-create required static resources.
+
+The `Tempest documentation <Tempest>`_ provides a thorough guide to using
+Tempest. However, if you simply wish to run the standard set of Tempest tests
+against an existing deployment, you can do the following:
+
+.. code-block:: shell
+
+    cd /opt/stack/tempest
+    /opt/stack/data/venv/bin/tempest run ...
+
+The above assumes you have installed DevStack in the default location
+(configured via the ``DEST`` configuration variable) and have enabled
+virtualenv-based installation in the standard location (configured via the
+``USE_VENV`` and ``VENV_DEST`` configuration variables, respectively).
+
+.. _Tempest: https://docs.openstack.org/tempest/latest/

From 6990b06cd321930f69907ba42ee744755f8029fe Mon Sep 17 00:00:00 2001
From: Riccardo Pittau <elfosardo@gmail.com>
Date: Wed, 24 Jul 2024 18:01:51 +0200
Subject: [PATCH 2248/2409] Install simplejson in devstack venv

Workaround to avoid failure due to missing osc dependency
removed in [1]

[1] https://review.opendev.org/c/openstack/python-openstackclient/+/920001

Change-Id: I3f7541e691717186b7c73f10ffabae6fc0c5c9f9
---
 inc/python | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/inc/python b/inc/python
index 2339afdd6d..1fd414773f 100644
--- a/inc/python
+++ b/inc/python
@@ -42,6 +42,9 @@ function setup_devstack_virtualenv {
         # available on pypi.
         python$PYTHON3_VERSION -m venv --system-site-packages $DEVSTACK_VENV
         pip_install -U pip setuptools
+        #NOTE(rpittau): workaround for simplejson removal in osc
+        #  https://review.opendev.org/c/openstack/python-openstackclient/+/920001
+        pip_install -U simplejson
     fi
     if [[ ":$PATH:" != *":$DEVSTACK_VENV/bin:"* ]] ; then
         export PATH="$DEVSTACK_VENV/bin:$PATH"

From 8784a3027fc3154aa2f6482d0127e45070e60b5a Mon Sep 17 00:00:00 2001
From: karolinku <kkula@redhat.com>
Date: Wed, 31 Jul 2024 12:34:00 +0200
Subject: [PATCH 2249/2409] Replacing usage of rdo-release rpm

with centos-release-openstack rpms follwing [1].

[1] https://issues.redhat.com/browse/RDO-311

Change-Id: I50951e077e73297d10b075677a440992d1e2fa91
---
 stack.sh | 19 +++++--------------
 1 file changed, 5 insertions(+), 14 deletions(-)

diff --git a/stack.sh b/stack.sh
index ab3f01cdbd..dcfd398c01 100755
--- a/stack.sh
+++ b/stack.sh
@@ -302,23 +302,14 @@ function _install_epel {
 }
 
 function _install_rdo {
-    if [[ $DISTRO == "rhel8" ]]; then
+    if [[ $DISTRO == "rhel9" ]]; then
+        rdo_release=${TARGET_BRANCH#*/}
         if [[ "$TARGET_BRANCH" == "master" ]]; then
-            # rdo-release.el8.rpm points to latest RDO release, use that for master
-            sudo dnf -y install https://rdoproject.org/repos/rdo-release.el8.rpm
+            # adding delorean-deps repo to provide current master rpms
+            sudo wget https://trunk.rdoproject.org/centos9-master/delorean-deps.repo -O /etc/yum.repos.d/delorean-deps.repo
         else
             # For stable/unmaintained branches use corresponding release rpm
-            rdo_release=${TARGET_BRANCH#*/}
-            sudo dnf -y install https://rdoproject.org/repos/openstack-${rdo_release}/rdo-release-${rdo_release}.el8.rpm
-        fi
-    elif [[ $DISTRO == "rhel9" ]]; then
-        if [[ "$TARGET_BRANCH" == "master" ]]; then
-            # rdo-release.el9.rpm points to latest RDO release, use that for master
-            sudo dnf -y install https://rdoproject.org/repos/rdo-release.el9.rpm
-        else
-            # For stable/unmaintained branches use corresponding release rpm
-            rdo_release=${TARGET_BRANCH#*/}
-            sudo dnf -y install https://rdoproject.org/repos/openstack-${rdo_release}/rdo-release-${rdo_release}.el9.rpm
+            sudo dnf -y install centos-release-openstack-${rdo_release}
         fi
     fi
     sudo dnf -y update

From 92b65a84cc8135316922a0f8b91420ed221f3269 Mon Sep 17 00:00:00 2001
From: elajkat <lajos.katona@est.tech>
Date: Mon, 5 Aug 2024 11:39:06 +0200
Subject: [PATCH 2250/2409] Handle_tags and branches for unmaintained also

Related-Bug: #2056276
Change-Id: Iaa34624d1d85cadf1b45bec780ef8d97dd054041
---
 roles/setup-devstack-source-dirs/tasks/main.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/roles/setup-devstack-source-dirs/tasks/main.yaml b/roles/setup-devstack-source-dirs/tasks/main.yaml
index 294c29cd29..cb7c6e3af8 100644
--- a/roles/setup-devstack-source-dirs/tasks/main.yaml
+++ b/roles/setup-devstack-source-dirs/tasks/main.yaml
@@ -43,9 +43,9 @@
       base_branch={{ devstack_sources_branch }}
       if git branch -a | grep "$base_branch" > /dev/null ; then
           git checkout $base_branch
-      elif [[ "$base_branch" == stable/* ]]; then
+      elif [[ "$base_branch" == stable/* ]] || [[ "$base_branch" == unmaintained/* ]]; then
           # Look for an eol tag for the stable branch.
-          eol_tag=${base_branch#stable/}-eol
+          eol_tag="${base_branch#*/}-eol"
           if git tag -l |grep $eol_tag >/dev/null; then
               git checkout $eol_tag
               git reset --hard $eol_tag

From 38dea33fe9a5e6bef39566295cc8d05fb1d88223 Mon Sep 17 00:00:00 2001
From: melanie witt <melwittt@gmail.com>
Date: Thu, 1 Aug 2024 23:41:43 +0000
Subject: [PATCH 2251/2409] oslo.log: Configure log color by $LOG_COLOR

Relatively recently oslo.log 6.1.0 was released and contains change
I7966d4f4977b267f620946de4a5509f53b043652 which added an option to
enable color in logs which defaults to False. This caused a change in
behavior for DevStack such that viewing logs with journalctl no longer
showed different colors for different log levels, which can make
debugging more difficult when developing with DevStack.

This adds olso.log color configuration based on the existing $LOG_COLOR
DevStack variable for log color which defaults to True for interactive
invocations.

Change-Id: If10aada573eb4360e81585d4fb7e5d97f15bc52b
---
 functions | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/functions b/functions
index f81e8f0a08..42d08d7c4a 100644
--- a/functions
+++ b/functions
@@ -694,6 +694,8 @@ function setup_colorized_logging {
     iniset $conf_file DEFAULT logging_default_format_string "%(asctime)s.%(msecs)03d %(color)s%(levelname)s %(name)s [-%(color)s] %(instance)s%(color)s%(message)s"
     iniset $conf_file DEFAULT logging_debug_format_suffix "from (pid=%(process)d) %(funcName)s %(pathname)s:%(lineno)d"
     iniset $conf_file DEFAULT logging_exception_prefix "%(color)s%(asctime)s.%(msecs)03d TRACE %(name)s %(instance)s"
+    # Enable or disable color for oslo.log
+    iniset $conf_file DEFAULT log_color $LOG_COLOR
 }
 
 function setup_systemd_logging {
@@ -715,6 +717,9 @@ function setup_systemd_logging {
     iniset $conf_file DEFAULT logging_context_format_string "%(color)s%(levelname)s %(name)s [%(global_request_id)s %(request_id)s %(project_name)s %(user_name)s%(color)s] %(instance)s%(color)s%(message)s"
     iniset $conf_file DEFAULT logging_default_format_string "%(color)s%(levelname)s %(name)s [-%(color)s] %(instance)s%(color)s%(message)s"
     iniset $conf_file DEFAULT logging_exception_prefix "ERROR %(name)s %(instance)s"
+
+    # Enable or disable color for oslo.log
+    iniset $conf_file DEFAULT log_color $LOG_COLOR
 }
 
 function setup_standard_logging_identity {

From 79a812a69e4015f6c911aa54989970e35bfc241f Mon Sep 17 00:00:00 2001
From: Rodolfo Alonso Hernandez <ralonsoh@redhat.com>
Date: Wed, 31 Jul 2024 14:41:33 +0000
Subject: [PATCH 2252/2409] Move the check of "rpc_workers" after the
 post-config phase

The configuration variable can be checked in the Neutron configuration
during the post-config phase when the configuration files and sections
are merged together.

Closes-Bug: #2075342
Change-Id: Ic42463e2f72488a1b14ce49e4e435cb4a2c0c855
---
 lib/neutron | 21 +++++++++------------
 1 file changed, 9 insertions(+), 12 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 2325188f94..bcef8a5042 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -143,7 +143,6 @@ Q_META_DATA_IP=${Q_META_DATA_IP:-$(ipv6_unquote $SERVICE_HOST)}
 Q_ALLOW_OVERLAPPING_IP=${Q_ALLOW_OVERLAPPING_IP:-True}
 Q_NOTIFY_NOVA_PORT_STATUS_CHANGES=${Q_NOTIFY_NOVA_PORT_STATUS_CHANGES:-True}
 Q_NOTIFY_NOVA_PORT_DATA_CHANGES=${Q_NOTIFY_NOVA_PORT_DATA_CHANGES:-True}
-_Q_RUN_RPC_SERVER=True
 VIF_PLUGGING_IS_FATAL=${VIF_PLUGGING_IS_FATAL:-True}
 VIF_PLUGGING_TIMEOUT=${VIF_PLUGGING_TIMEOUT:-300}
 
@@ -466,15 +465,6 @@ function configure_neutron {
     # clouds, therefore running without a dedicated RPC worker
     # for state reports is more than adequate.
     iniset $NEUTRON_CONF DEFAULT rpc_state_report_workers 0
-    # The default value of "rpc_workers" is None (not defined). If
-    # "rpc_workers" is explicitly set to 0, the RPC workers process should not
-    # be executed. NOTE: this service is only executed when WSGI is enabled
-    # (NEUTRON_DEPLOY_MOD_WSGI=True) for the Neutron server.
-    local rpc_workers
-    rpc_workers=$(iniget_multiline /etc/neutron/neutron.conf DEFAULT rpc_workers)
-    if [ "$rpc_workers" == "0" ]; then
-        _Q_RUN_RPC_SERVER=False
-    fi
 
     if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
         write_uwsgi_config "$NEUTRON_UWSGI_CONF" "$NEUTRON_UWSGI" "/networking" "" "neutron-api"
@@ -657,17 +647,24 @@ function start_neutron_service_and_check {
         service_port=$Q_PORT_INT
         service_protocol="http"
     fi
+
     # Start the Neutron service
     if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
+        # The default value of "rpc_workers" is None (not defined). If
+        # "rpc_workers" is explicitly set to 0, the RPC workers process
+        # should not be executed.
+        local rpc_workers
+        rpc_workers=$(iniget_multiline $NEUTRON_CONF DEFAULT rpc_workers)
+
         enable_service neutron-api
         run_process neutron-api "$(which uwsgi) --procname-prefix neutron-api --ini $NEUTRON_UWSGI_CONF"
         neutron_url=$Q_PROTOCOL://$Q_HOST/
-        if [[ "$_Q_RUN_RPC_SERVER" = True ]]; then
+        if [ "$rpc_workers" != "0" ]; then
             enable_service neutron-rpc-server
         fi
         enable_service neutron-periodic-workers
         _enable_ovn_maintenance
-        if [[ "$_Q_RUN_RPC_SERVER" = True ]]; then
+        if [ "$rpc_workers" != "0" ]; then
             run_process neutron-rpc-server "$NEUTRON_BIN_DIR/neutron-rpc-server $cfg_file_options"
         fi
         run_process neutron-periodic-workers "$NEUTRON_BIN_DIR/neutron-periodic-workers $cfg_file_options"

From 84ce1984b1f0639025af599b426019a4b140fcb4 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Wed, 31 Jul 2024 19:04:08 +0000
Subject: [PATCH 2253/2409] Add os-test-images support in lib/tempest

This generates the test images in os-test-images and also configures
tempest to know where it is (and if image conversion is enabled in
glance).

Change-Id: Ib74002828a77838ab95d2322e92bdab68caac37c
---
 .zuul.yaml  |  1 +
 lib/tempest | 17 +++++++++++++++++
 2 files changed, 18 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index af7e74b57b..59a577e522 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -510,6 +510,7 @@
       - opendev.org/openstack/nova
       - opendev.org/openstack/placement
       - opendev.org/openstack/swift
+      - opendev.org/openstack/os-test-images
     timeout: 7200
     vars:
       # based on observation of the integrated gate
diff --git a/lib/tempest b/lib/tempest
index a14ed1af72..24c8271132 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -105,6 +105,10 @@ TEMPEST_CONCURRENCY=${TEMPEST_CONCURRENCY:-$(nproc)}
 TEMPEST_FLAVOR_RAM=${TEMPEST_FLAVOR_RAM:-192}
 TEMPEST_FLAVOR_ALT_RAM=${TEMPEST_FLAVOR_ALT_RAM:-256}
 
+OSTESTIMAGES_REPO=${OSTESTIMAGES_REPO:-${GIT_BASE}/openstack/os-test-images.git}
+OSTESTIMAGES_BRANCH=${OSTESTIMAGES_BRANCH:-$BRANCHLESS_TARGET_BRANCH}
+OSTESTIMAGES_DIR=${DEST}/os-test-images
+
 # Functions
 # ---------
 
@@ -357,6 +361,19 @@ function configure_tempest {
         fi
     fi
 
+    if is_service_enabled glance; then
+        git_clone $OSTESTIMAGES_REPO $OSTESTIMAGES_DIR $OSTESTIMAGES_BRANCH
+        pushd $OSTESTIMAGES_DIR
+        tox -egenerate
+        popd
+        iniset $TEMPEST_CONFIG image images_manifest_file ${OSTESTIMAGES_DIR}/images/manifest.yaml
+        local image_conversion
+        image_conversion=$(iniget $GLANCE_IMAGE_IMPORT_CONF image_conversion output_format)
+        if [[ "$image_conversion" ]]; then
+            iniset $TEMPEST_CONFIG image-feature-enabled image_conversion True
+        fi
+    fi
+
     iniset $TEMPEST_CONFIG network project_network_cidr $FIXED_RANGE
 
     ssh_connect_method=${TEMPEST_SSH_CONNECT_METHOD:-$ssh_connect_method}

From 3b0d76c30bf63332f494e8aae18dc2f1feed28dd Mon Sep 17 00:00:00 2001
From: Eric Harney <eharney@redhat.com>
Date: Mon, 12 Aug 2024 17:01:12 +0000
Subject: [PATCH 2254/2409] Fix get_default_host_ip ipv6 address parsing

This is another occurrence of the issue fixed in bug
1786259 with change I30bf655f which occurs when there
are multiple IPv6 gateways present.

Before this change:
$ source openrc
+++++functions-common:get_default_host_ip:776  ip -f inet6 addr show 100
Device "100" does not exist.

This is because the ip route command returns:
default proto ra metric 100 expires 1497sec pref medium
	nexthop via fe80::4e16:fc01:298c:98ed dev ens3 weight 1
	nexthop via fe80::4e16:fc01:2983:88aa dev ens3 weight 1

Related-Bug: #1786259
Change-Id: I7729730df66a4dc7ee11df1d23b19b9c0794b575
---
 functions-common | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index 84d281b21e..e265256ccf 100644
--- a/functions-common
+++ b/functions-common
@@ -771,7 +771,7 @@ function get_default_host_ip {
     if [ -z "$host_ip" -o "$host_ip" == "dhcp" ]; then
         host_ip=""
         # Find the interface used for the default route
-        host_ip_iface=${host_ip_iface:-$(ip -f $af route | awk '/default/ {print $5}' | head -1)}
+        host_ip_iface=${host_ip_iface:-$(ip -f $af route list match default table all | grep via | awk '/default/ {print $5}' | head -1)}
         local host_ips
         host_ips=$(LC_ALL=C ip -f $af addr show ${host_ip_iface} | sed /temporary/d |awk /$af'/ {split($2,parts,"/");  print parts[1]}')
         local ip

From d6e3d06001e7c4bb092cf9dc77188627bd2b9358 Mon Sep 17 00:00:00 2001
From: Rajat Dhasmana <rajatdhasmana@gmail.com>
Date: Thu, 22 Feb 2024 00:11:15 +0530
Subject: [PATCH 2255/2409] Add config options for optimized upload volume

When glance is using cinder as a backend, we can use optimized
path for upload volume to image operation.
The config options image_upload_use_cinder_backend and
image_upload_use_internal_tenant are used to configure optimization
in the upload volume to image workflow where we create a cinder
volume in the internal service project and register the location
in glance.

Recently it was found that the glance location API workflow was
broken[1] for the upload volume case and it wasn't detected because we
are not testing it in our glance cinder job "cinder-for-glance-optimized".

This patch adds the config option to test the optimized path.

Note that the optimized upload functionality is only possible when glance
uses cinder as it's backend since it uses clone volume functionality to
clone the Image-Volume from the source volume.

[1] https://bugs.launchpad.net/glance/+bug/2054575

Change-Id: I521ed04696a5a545b2a2923cf8008bd64add7782
---
 lib/cinder | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/lib/cinder b/lib/cinder
index ae898e9522..f80542a35f 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -183,6 +183,12 @@ fi
 # Environment variables to configure the image-volume cache
 CINDER_IMG_CACHE_ENABLED=${CINDER_IMG_CACHE_ENABLED:-True}
 
+# Environment variables to configure the optimized volume upload
+CINDER_UPLOAD_OPTIMIZED=${CINDER_UPLOAD_OPTIMIZED:-False}
+
+# Environment variables to configure the internal tenant during optimized volume upload
+CINDER_UPLOAD_INTERNAL_TENANT=${CINDER_UPLOAD_INTERNAL_TENANT:-False}
+
 # For limits, if left unset, it will use cinder defaults of 0 for unlimited
 CINDER_IMG_CACHE_SIZE_GB=${CINDER_IMG_CACHE_SIZE_GB:-}
 CINDER_IMG_CACHE_SIZE_COUNT=${CINDER_IMG_CACHE_SIZE_COUNT:-}
@@ -192,6 +198,11 @@ CINDER_IMG_CACHE_SIZE_COUNT=${CINDER_IMG_CACHE_SIZE_COUNT:-}
 # enable the cache for all cinder backends.
 CINDER_CACHE_ENABLED_FOR_BACKENDS=${CINDER_CACHE_ENABLED_FOR_BACKENDS:-$CINDER_ENABLED_BACKENDS}
 
+# Configure which cinder backends will have optimized volume upload, this takes the same
+# form as the CINDER_ENABLED_BACKENDS config option. By default it will
+# enable the cache for all cinder backends.
+CINDER_UPLOAD_OPTIMIZED_BACKENDS=${CINDER_UPLOAD_OPTIMIZED_BACKENDS:-$CINDER_ENABLED_BACKENDS}
+
 # Flag to set the oslo_policy.enforce_scope. This is used to switch
 # the  Volume API policies to start checking the scope of token. by default,
 # this flag is False.
@@ -353,6 +364,14 @@ function configure_cinder {
             iniset $CINDER_CONF DEFAULT default_volume_type ${default_name}
         fi
         configure_cinder_image_volume_cache
+
+        # The upload optimization uses Cinder's clone volume functionality to
+        # clone the Image-Volume from source volume hence can only be
+        # performed when glance is using cinder as it's backend.
+        if [[ "$USE_CINDER_FOR_GLANCE" == "True" ]]; then
+            # Configure optimized volume upload
+            configure_cinder_volume_upload
+        fi
     fi
 
     if is_service_enabled c-bak && [[ -n "$CINDER_BACKUP_DRIVER" ]]; then
@@ -729,6 +748,18 @@ function configure_cinder_image_volume_cache {
     done
 }
 
+function configure_cinder_volume_upload {
+    # Expect UPLOAD_VOLUME_OPTIMIZED_FOR_BACKENDS to be a list of backends
+    # similar to CINDER_ENABLED_BACKENDS with NAME:TYPE where NAME will
+    # be the backend specific configuration stanza in cinder.conf.
+    local be be_name
+    for be in ${CINDER_UPLOAD_OPTIMIZED_BACKENDS//,/ }; do
+        be_name=${be##*:}
+
+        iniset $CINDER_CONF $be_name image_upload_use_cinder_backend $CINDER_UPLOAD_OPTIMIZED
+        iniset $CINDER_CONF $be_name image_upload_use_internal_tenant $CINDER_UPLOAD_INTERNAL_TENANT
+    done
+}
 
 # Restore xtrace
 $_XTRACE_CINDER

From 80c1605a1df9687c7d1d842b258a3d99ec2eda35 Mon Sep 17 00:00:00 2001
From: Rajat Dhasmana <rajatdhasmana@gmail.com>
Date: Wed, 28 Feb 2024 13:08:12 +0530
Subject: [PATCH 2256/2409] Configure cinder service token

Glance is implementing new location APIs, for which, cinder needs
to pass service token to register a location in glance.
This is required in the case when glance is using cinder as a backend
and cinder tries to upload a volume in the optimized path.

We are adding a new option, ``CINDER_USE_SERVICE_TOKEN`` that will
configure the service user section in cinder.conf. By default, it
is set to False.

Change-Id: I0045539f1e31a6d26c4f31935c5ddfaaa7607a48
---
 lib/cinder | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/lib/cinder b/lib/cinder
index f80542a35f..0adca4f4ec 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -88,6 +88,10 @@ CINDER_SERVICE_REPORT_INTERVAL=${CINDER_SERVICE_REPORT_INTERVAL:-120}
 # thin provisioning.
 CINDER_LVM_TYPE=${CINDER_LVM_TYPE:-auto}
 
+# ``CINDER_USE_SERVICE_TOKEN`` is a mode where service token is passed along with
+# user token while communicating to external REST APIs like Glance.
+CINDER_USE_SERVICE_TOKEN=$(trueorfalse True CINDER_USE_SERVICE_TOKEN)
+
 # Default backends
 # The backend format is type:name where type is one of the supported backend
 # types (lvm, nfs, etc) and name is the identifier used in the Cinder
@@ -445,6 +449,10 @@ function configure_cinder {
         iniset $CINDER_CONF oslo_policy enforce_scope false
         iniset $CINDER_CONF oslo_policy enforce_new_defaults false
     fi
+
+    if [ "$CINDER_USE_SERVICE_TOKEN" == "True" ]; then
+        init_cinder_service_user_conf
+    fi
 }
 
 # create_cinder_accounts() - Set up common required cinder accounts
@@ -761,6 +769,12 @@ function configure_cinder_volume_upload {
     done
 }
 
+function init_cinder_service_user_conf {
+    configure_keystone_authtoken_middleware $CINDER_CONF cinder service_user
+    iniset $CINDER_CONF service_user send_service_user_token True
+    iniset $CINDER_CONF service_user auth_strategy keystone
+}
+
 # Restore xtrace
 $_XTRACE_CINDER
 

From 1a336ef4aec1c908b139db3b67e766a437c2cbb9 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Mon, 12 Aug 2024 11:34:02 -0700
Subject: [PATCH 2257/2409] Trivial fixes from review of os-test-images

This fixes some trivial things from the review where this support was
added:

https://review.opendev.org/c/openstack/devstack/+/925425

Change-Id: I990a3816f425a1b4c8680ec43d698e32eea2238b
---
 lib/tempest | 6 +-----
 stackrc     | 3 +++
 2 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 24c8271132..310db2daa6 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -105,10 +105,6 @@ TEMPEST_CONCURRENCY=${TEMPEST_CONCURRENCY:-$(nproc)}
 TEMPEST_FLAVOR_RAM=${TEMPEST_FLAVOR_RAM:-192}
 TEMPEST_FLAVOR_ALT_RAM=${TEMPEST_FLAVOR_ALT_RAM:-256}
 
-OSTESTIMAGES_REPO=${OSTESTIMAGES_REPO:-${GIT_BASE}/openstack/os-test-images.git}
-OSTESTIMAGES_BRANCH=${OSTESTIMAGES_BRANCH:-$BRANCHLESS_TARGET_BRANCH}
-OSTESTIMAGES_DIR=${DEST}/os-test-images
-
 # Functions
 # ---------
 
@@ -369,7 +365,7 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG image images_manifest_file ${OSTESTIMAGES_DIR}/images/manifest.yaml
         local image_conversion
         image_conversion=$(iniget $GLANCE_IMAGE_IMPORT_CONF image_conversion output_format)
-        if [[ "$image_conversion" ]]; then
+        if [[ -n "$image_conversion" ]]; then
             iniset $TEMPEST_CONFIG image-feature-enabled image_conversion True
         fi
     fi
diff --git a/stackrc b/stackrc
index 0492c73d1f..0b3e1c61da 100644
--- a/stackrc
+++ b/stackrc
@@ -304,6 +304,9 @@ TEMPEST_REPO=${TEMPEST_REPO:-${GIT_BASE}/openstack/tempest.git}
 TEMPEST_BRANCH=${TEMPEST_BRANCH:-$BRANCHLESS_TARGET_BRANCH}
 TEMPEST_VENV_UPPER_CONSTRAINTS=${TEMPEST_VENV_UPPER_CONSTRAINTS:-master}
 
+OSTESTIMAGES_REPO=${OSTESTIMAGES_REPO:-${GIT_BASE}/openstack/os-test-images.git}
+OSTESTIMAGES_BRANCH=${OSTESTIMAGES_BRANCH:-$BRANCHLESS_TARGET_BRANCH}
+OSTESTIMAGES_DIR=${DEST}/os-test-images
 
 ##############
 #

From 9e1348f81b84e3bef93d6998606e09725c585b1a Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Tue, 20 Aug 2024 17:23:02 +0900
Subject: [PATCH 2258/2409] etcd: Replace deprecated --debug option

... to resolve the following warning.

[WARNING] Deprecated '--debug' flag is set to true (use
'--log-level=debug' instead

Change-Id: Idb412cea64dfc42e3d1223b77f134804eeb7bd60
---
 lib/etcd3 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/etcd3 b/lib/etcd3
index 4f3a7a4349..0d22de8c73 100644
--- a/lib/etcd3
+++ b/lib/etcd3
@@ -51,7 +51,7 @@ function start_etcd3 {
     fi
     cmd+=" --listen-client-urls http://$SERVICE_HOST:$ETCD_PORT"
     if [ "$ENABLE_DEBUG_LOG_LEVEL" == "True" ]; then
-        cmd+=" --debug"
+        cmd+=" --log-level=debug"
     fi
 
     local unitfile="$SYSTEMD_DIR/$ETCD_SYSTEMD_SERVICE"

From 5ed2b7c6b2e2a5da50c3db9cda9e9b8e4ae4402f Mon Sep 17 00:00:00 2001
From: Sean Mooney <work@seanmooney.info>
Date: Fri, 30 Aug 2024 14:15:40 +0100
Subject: [PATCH 2259/2409] make  devstack-platform-ubuntu-noble voting

devstack-platform-ubuntu-noble was added in
Ie1f8ebc5db75d6913239c529ee923395a764e19c
and has been runnning for a little over 2 months

in that time

https://zuul.openstack.org/builds?job_name=devstack-platform-ubuntu-noble

the job has been pretty stable so its time to make
this voting in advance of it becoming required in the
2025.1 release.

Change-Id: Iffd6ccf9603117d6720931e260afa2da13c26ec4
---
 .zuul.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 59a577e522..a1c251a398 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -732,7 +732,6 @@
     description: Ubuntu 24.04 LTS (noble) platform test
     nodeset: openstack-single-node-noble
     timeout: 9000
-    voting: false
     vars:
       configure_swap_size: 8192
 
@@ -917,6 +916,7 @@
         - devstack
         - devstack-ipv6
         - devstack-platform-debian-bookworm
+        - devstack-platform-ubuntu-noble
         # NOTE(danms): Disabled due to instability, see comment in the job
         # definition above.
         # - devstack-platform-rocky-blue-onyx

From 0ff627286297a3957143577412884dc50ff8a57a Mon Sep 17 00:00:00 2001
From: yatinkarel <ykarel@redhat.com>
Date: Mon, 2 Sep 2024 17:29:55 +0530
Subject: [PATCH 2260/2409] Run chown for egg-info only if the directory exists

9-stream jobs failing since [1] merged as these still use
GLOBAL_VENV=False.
egg-info directory is not created in project source
directory when pyproject.toml is used in the project.
pyproject.toml being added across projects[2] to support pip 23.1.

[1] https://review.opendev.org/c/openstack/nova/+/899753
[2] https://review.opendev.org/q/topic:%22pip-23.1-support%22

Change-Id: I53954a37461aee5dd7f487d6bd205caef4408392
---
 inc/python | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/inc/python b/inc/python
index 1fd414773f..2083b74dc1 100644
--- a/inc/python
+++ b/inc/python
@@ -474,7 +474,10 @@ function setup_package {
     pip_install $flags "$project_dir$extras"
     # ensure that further actions can do things like setup.py sdist
     if [[ "$flags" == "-e" && "$GLOBAL_VENV" == "False" ]]; then
-        safe_chown -R $STACK_USER $1/*.egg-info
+        # egg-info is not created when project have pyproject.toml
+        if [ -d $1/*.egg-info ]; then
+            safe_chown -R $STACK_USER $1/*.egg-info
+        fi
     fi
 }
 

From d7c3c0accc89e4e99915c24fa7c3bff2e90a715e Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Fri, 20 Sep 2024 10:56:04 +0100
Subject: [PATCH 2261/2409] lib/cinder: Remove 'volume3' endpoint

This was needed when 'block-storage' pointed to the v2 API. This is no
longer the case (and hasn't been for some time). This is unnecessary
duplication now.

Change-Id: I00cfb56d3e54d0162b1609f4bf58814e9000c103
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
Depends-on: https://review.opendev.org/c/openstack/tempest/+/930296
---
 lib/cinder | 12 ------------
 1 file changed, 12 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 0adca4f4ec..2f9955b1d3 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -483,23 +483,11 @@ function create_cinder_accounts {
                 "block-storage" \
                 "$REGION_NAME" \
                 "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v3/\$(project_id)s"
-
-            get_or_create_service "cinderv3" "volumev3" "Cinder Volume Service V3"
-            get_or_create_endpoint \
-                "volumev3" \
-                "$REGION_NAME" \
-                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v3/\$(project_id)s"
         else
             get_or_create_endpoint \
                 "block-storage" \
                 "$REGION_NAME" \
                 "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST/volume/v3/\$(project_id)s"
-
-            get_or_create_service "cinderv3" "volumev3" "Cinder Volume Service V3"
-            get_or_create_endpoint \
-                "volumev3" \
-                "$REGION_NAME" \
-                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST/volume/v3/\$(project_id)s"
         fi
 
         configure_cinder_internal_tenant

From 2d487d8c7b424a76eb484d09f09530e24b7207fb Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Fri, 20 Sep 2024 11:00:39 +0100
Subject: [PATCH 2262/2409] lib/cinder: Strip project_id from URL

This is optional. There's no need to include it.

Change-Id: I2e745865696dbb317f819ecb74f5b5df88a9ed76
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
---
 lib/cinder | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 2f9955b1d3..6da5d4579d 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -482,12 +482,12 @@ function create_cinder_accounts {
             get_or_create_endpoint \
                 "block-storage" \
                 "$REGION_NAME" \
-                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v3/\$(project_id)s"
+                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v3"
         else
             get_or_create_endpoint \
                 "block-storage" \
                 "$REGION_NAME" \
-                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST/volume/v3/\$(project_id)s"
+                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST/volume/v3"
         fi
 
         configure_cinder_internal_tenant

From 9b4439038144f380c1d1c8a8e87ad76cd26b72b5 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Fri, 20 Sep 2024 11:03:15 +0100
Subject: [PATCH 2263/2409] lib/cinder: Align endpoint creation code

Do this the same way we do it for Nova, to make for easier review.

Change-Id: I31877705894a21570f130723e0a27ff38f945eea
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
---
 lib/cinder | 21 ++++++++++-----------
 1 file changed, 10 insertions(+), 11 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 6da5d4579d..dc284920e0 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -476,20 +476,19 @@ function create_cinder_accounts {
 
         create_service_user "cinder" $extra_role
 
-        # block-storage is the official service type
-        get_or_create_service "cinder" "block-storage" "Cinder Volume Service"
-        if [ "$CINDER_USE_MOD_WSGI" == "False" ]; then
-            get_or_create_endpoint \
-                "block-storage" \
-                "$REGION_NAME" \
-                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v3"
+        local cinder_api_url
+        if [[ "$CINDER_USE_MOD_WSGI" == "False" ]]; then
+            cinder_api_url="$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT"
         else
-            get_or_create_endpoint \
-                "block-storage" \
-                "$REGION_NAME" \
-                "$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST/volume/v3"
+            cinder_api_url="$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST/volume"
         fi
 
+        # block-storage is the official service type
+        get_or_create_service "cinder" "block-storage" "Cinder Volume Service"
+        get_or_create_endpoint \
+            "block-storage" \
+            "$REGION_NAME" \
+            "$cinder_api_url/v3"
         configure_cinder_internal_tenant
     fi
 }

From 03bc214525c7d7f9dfb6cb855025b70053839a72 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Wed, 25 Sep 2024 12:03:40 -0700
Subject: [PATCH 2264/2409] Update DEVSTACK_SERIES to 2025.1

stable/2024.2 branch has been created now and
current master is for 2025.1.

Change-Id: If5c9de9ddfab1bff313c70cf2c40ce7fbe60473f
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 0b3e1c61da..ab1f8a6ffd 100644
--- a/stackrc
+++ b/stackrc
@@ -249,7 +249,7 @@ REQUIREMENTS_DIR=${REQUIREMENTS_DIR:-$DEST/requirements}
 # Setting the variable to 'ALL' will activate the download for all
 # libraries.
 
-DEVSTACK_SERIES="2024.2"
+DEVSTACK_SERIES="2025.1"
 
 ##############
 #

From fec589a1ce6b1dd29e27ed2d5aa088390a7dfa92 Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Thu, 26 Sep 2024 21:23:17 +0200
Subject: [PATCH 2265/2409] Bump cirros version to 0.6.3

This is the latest cirros release, featuring an updated kernel and some
fixes and added features, let's use it.

[0] https://github.com/cirros-dev/cirros/releases/tag/0.6.3

Change-Id: I2506fa713e0426789fa40a5f4f7fd4e963a158f0
---
 doc/source/guides/nova.rst | 2 +-
 stackrc                    | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/doc/source/guides/nova.rst b/doc/source/guides/nova.rst
index 705d427e68..6b8aabf8db 100644
--- a/doc/source/guides/nova.rst
+++ b/doc/source/guides/nova.rst
@@ -122,7 +122,7 @@ when creating the server, for example:
 .. code-block:: shell
 
   $ openstack --os-compute-api-version 2.37 server create --flavor cirros256 \
-      --image cirros-0.6.2-x86_64-disk --nic none --wait test-server
+      --image cirros-0.6.3-x86_64-disk --nic none --wait test-server
 
 .. note:: ``--os-compute-api-version`` greater than or equal to 2.37 is
           required to use ``--nic=none``.
diff --git a/stackrc b/stackrc
index 0b3e1c61da..b9f86d1ae6 100644
--- a/stackrc
+++ b/stackrc
@@ -656,7 +656,7 @@ esac
 
 #IMAGE_URLS="https://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img" # cirros full disk image
 
-CIRROS_VERSION=${CIRROS_VERSION:-"0.6.2"}
+CIRROS_VERSION=${CIRROS_VERSION:-"0.6.3"}
 CIRROS_ARCH=${CIRROS_ARCH:-$(uname -m)}
 
 # Set default image based on ``VIRT_DRIVER`` and ``LIBVIRT_TYPE``, either of
@@ -673,11 +673,11 @@ if [[ "$DOWNLOAD_DEFAULT_IMAGES" == "True" ]]; then
                 lxc) # the cirros root disk in the uec tarball is empty, so it will not work for lxc
                     DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-rootfs}
                     DEFAULT_IMAGE_FILE_NAME=${DEFAULT_IMAGE_FILE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-rootfs.img.gz}
-                    IMAGE_URLS+="https://download.cirros-cloud.net/${CIRROS_VERSION}/${DEFAULT_IMAGE_FILE_NAME}";;
+                    IMAGE_URLS+="https://github.com/cirros-dev/cirros/releases/download/${CIRROS_VERSION}/${DEFAULT_IMAGE_FILE_NAME}";;
                 *) # otherwise, use the qcow image
                     DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk}
                     DEFAULT_IMAGE_FILE_NAME=${DEFAULT_IMAGE_FILE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img}
-                    IMAGE_URLS+="https://download.cirros-cloud.net/${CIRROS_VERSION}/${DEFAULT_IMAGE_FILE_NAME}";;
+                    IMAGE_URLS+="https://github.com/cirros-dev/cirros/releases/download/${CIRROS_VERSION}/${DEFAULT_IMAGE_FILE_NAME}";;
                 esac
             ;;
         vsphere)
@@ -688,7 +688,7 @@ if [[ "$DOWNLOAD_DEFAULT_IMAGES" == "True" ]]; then
             # Use the same as the default for libvirt
             DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk}
             DEFAULT_IMAGE_FILE_NAME=${DEFAULT_IMAGE_FILE_NAME:-cirros-${CIRROS_VERSION}-${CIRROS_ARCH}-disk.img}
-            IMAGE_URLS+="http://download.cirros-cloud.net/${CIRROS_VERSION}/${DEFAULT_IMAGE_FILE_NAME}";;
+            IMAGE_URLS+="https://github.com/cirros-dev/cirros/releases/download/${CIRROS_VERSION}/${DEFAULT_IMAGE_FILE_NAME}";;
     esac
     DOWNLOAD_DEFAULT_IMAGES=False
 fi

From 6512f0140c9a312f9455bfe420462c64635fd622 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Mon, 26 Aug 2024 12:19:06 +0100
Subject: [PATCH 2266/2409] doc: drop sphinxcontrib-nwdiag,
 sphinxcontrib-blockdiag usage

sphinxcontrib-nwdiag does not appear to be maintained anymore [1] and
there have been no releases in nearly 5 years. Statically generate the
images and include them this way. We can revert this change if the
maintainership issue resolves itself.

sphinxcontrib-blockdiag has had activity more recently [2], but it's
still been nearly 3 years. More importantly, we don't actually use it so
there's no reason to keep it around.

[1] https://pypi.org/project/sphinxcontrib-nwdiag/#history
[1] https://pypi.org/project/sphinxcontrib-blockdiag/#history

Change-Id: Ic5244c792acd01f8aec5ff626e53303c1738aa69
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
---
 doc/requirements.txt                          |   4 --
 .../assets/images/neutron-network-1.png       | Bin 0 -> 10251 bytes
 .../assets/images/neutron-network-2.png       | Bin 0 -> 11243 bytes
 .../assets/images/neutron-network-3.png       | Bin 0 -> 13293 bytes
 doc/source/conf.py                            |  12 ++--
 doc/source/guides/neutron.rst                 |  60 ++----------------
 6 files changed, 12 insertions(+), 64 deletions(-)
 create mode 100644 doc/source/assets/images/neutron-network-1.png
 create mode 100644 doc/source/assets/images/neutron-network-2.png
 create mode 100644 doc/source/assets/images/neutron-network-3.png

diff --git a/doc/requirements.txt b/doc/requirements.txt
index ffce3ff74c..7980b93ed7 100644
--- a/doc/requirements.txt
+++ b/doc/requirements.txt
@@ -4,8 +4,4 @@ Pygments
 docutils
 sphinx>=2.0.0,!=2.1.0 # BSD
 openstackdocstheme>=2.2.1 # Apache-2.0
-nwdiag
-blockdiag
-sphinxcontrib-blockdiag
-sphinxcontrib-nwdiag
 zuul-sphinx>=0.2.0
diff --git a/doc/source/assets/images/neutron-network-1.png b/doc/source/assets/images/neutron-network-1.png
new file mode 100644
index 0000000000000000000000000000000000000000..7730ca93f175651c1ec860f37ea6be33310e73e1
GIT binary patch
literal 10251
zcmeHtc~Fyi*CmZ8pt5M&;sOMeMn9!N1wk|<hzrmd(6%EYMnqYR5<p}NTSQP)RzX2P
zNFz494H^)TB`i@9FdZREgb)HmWH*E@Y#}81Zo0oerfTN>W~rH}si~LBQw6DK`91e{
z?>YCJ%e|A1wrZ=ltX5D^P_wr?`ip|XckdMx6i=wEf^VX(nAa#M>}a<?didASCxTuF
zKM$8nUlzidkw=wcJiM^Z&VT%_+j=qm!Uqca_3JeRgEd$7e@@kZt!VU<(jQiL6#me!
z$!oEB?PG*qE#0tX%|?USYAy4Mc7@JAx0?7|`?AjL#RTQg6RGsjz6`A(zu;d#_wP=7
zkYFc`Qh4ylV`?h(!+p||8*X@Z5MEIs!ZCDIP2pywL5hN={=bg@2V>x`jL)jns8@T<
z{r_oy9t7huP_xHhH`uc(>iHvqxQrj|+XY_nH>-XkjjG*@+ZgZ8?ybLp&obvuUgMfO
zu*}vu9zc4fAb-w26_K;4ub*GHG+9X~Ph3zn9Jh=fJhl04HDl)m;j1){?GGj5*!A-d
zt!J)0!*`>OZraX$V1_w8dwqO;UTnQVN}W(QpfmK5yLrv#pB+j{-JT4;$uD)fe!{%6
z5T8{?;C>9kjq*lT?jBc-9?YpUVHEAfv48Y*G5$t1?yhXTV|T72T5|E;qnKcp=)QPM
z3ntr^+8l@*xow10h#u4v3`8~IIH;wLhMz+ZDW%5DJbqhE*#594-_3mi{(Q+4f6p^4
zy!V>x&ReB?Sex{mPc>ka72&g<^U!0rjmK|Vmo2=Tj;B%_?ms<Ccw)Hk=r23_b5#t&
zG1?`;9r$hAR2Le1kzZb8vHQQ}pN-Q@HL&lVE#DqiS9a6lB5!5*K!fk0xvqC@`Qv`&
zLvhM})_TM}+`|#?H>p1$rV*->_f9Z^&3ZG|PqeMy?bnOSWmG$H0}z!oa=%xb@2izn
z-mB=Y<;m_nx%eR5LQUpHpEK1W%SQ2K#uM>ur22Uu1z#sU;_i9LmCpjr3qR2LUu&Ek
zo?C1-Hvh=;a@eW=7Oy+r)6g;<)Dsvz9cgji=i&jYck!N!+r)bP`+GJlAIZdY2H`wh
zI%74n+*NztAg4B)+67<bc_-tuqI}Im<6WI1CxjF(qK3%}Y4_uK?5lZRROFLoIB8;*
zG9eCb<X&1u&kx3~HRsVJkNJuLcdxs=IK!gwhwW1hT+%xl<F|+nh~rABxH2cc!UwPN
zwEo}n%`mn7FJzK?2FdBxWu~y37}g*@t26FEc^Lb5eAaR+Z@HCOA0e8lhch+b7DqnN
zkENjB&gEHrubW_9b}iR^p^L-e#JQyJKX&SQ{L`~T#0ztIKCQaMaqVY~lxK~9tY8ey
zbe-^^J;P^3EKj${Bu!0C;&RS-;LEex&e;8Z$g|#yI;h#ow@2351sCzD6$I|oIH#Q4
zgZh?M<+rG_+&3xd3mFlL#xA`)aKSi(H5X<@DJtr!qYWPM+l@4Hcs_oV9mKW0RX|z@
zAuX6Jos^c)qjjf=|G1-NNSoPBn;|(BvND2jT0yvxAe{G+4VT?}>Mm&_%@yg6KIlK@
zm7^>4W9Msmk_nQi5h0x_WSL1CTU%6yB^;?p)@~wcmt}amuxK5`TxVh~o0w}M59Xwo
z__O-;!M)$Z7O7lL_Y69<0qc^^m<~l|pD@fokd~)qQ_CV@$@%l=Bm9X(Vrsz{yAthY
z=C?7v3n80E$T$!OmMB8%@#<V66pxJx&LurQKR+LCu{<+6I(lhe=J}+S0T;OG)15{7
z>21+UY&Va%rQ)(!DkUC*kjos|p{1qe7A9R5IU&R6$9I#Xmd2dwL#MwsmY0`nc$IU)
z<D0(zgTg;WB7CHv%K{{Yq@_YxfL7iKmYJxAEUwWai84r{K1#EULzZyLX-mblFlzBM
zNx+U0$dHzn#Hg^arLn++^*b2>oJvCFxfcbna~>!%LIcgxw6W4n*0Qy=HOWOqE{%mx
z)-TYN5fM`e+U)Npk^%7~O%}sqvApGHFv`vk6EFOZ-}MlA)hlKEoR-a%8Dz<yW#=6Y
z(->)KX(Jex2abK)h*9)(XL=glqw=g#5}Q9)jn69MQv(<4&`bH~B@3v70o3-i0{l#(
zU&H{q0N))Y%;weEv1ZAA3yZX=HMA*-rj5AOFG?7pH6Z&|BK;=AZfFWPV3oh~evnIg
zF%z}Sp-W*CC02S|B$EwKGS6{zLlS2OMXW+6bmY?PShAy|W3Ce{OFuzBw)x+5^-{(^
z`hViP-+N`mz;Y`yaPqnchJ4TebY*Ym31buZ*%;q6ef3q=uh{)t)HkW>2R0t7nB-1R
zPajjsqnAB*OdTXoTv|3_e8VN8b(6gZrbAI%5;rz-Ly@_+HM`4<wB+C9IL5orchRgf
zF@>yhh?|z=gOCIFa6!E97+zm2Nk#^zpXL0~A3?1o9ATLevDl%odek|ijkZG3av+LK
zZu2T<Ngu|HU43=%+>0{<1^D}@)I6vssA4ur!X{0kyxj3whBQ$&O*C0%bZrLdrgiLP
zn=nGMgEX^4#)(XnZKX|bmD!T?K2VJq9g)d0SK6GbjAF!S^4Le@C{K#$bh;=M+3-PF
zH$gQv!+d{d=v$c)`-oX`Qj&22Ypm(hr%%Udh=2>}Lv=gv&uPAI6(4<j`Nx#;^E8uv
z0&;~A61S-6IDamz?A!}O#!vwDym4|mW9XCoMM~J7IQB6}%qjEOImpTk*<AKfLx3YF
z>JS>c<vKQfD8Ot>E2NT_%NY{imAB;VcTnmloA;CX9Xs_azz^h8!ts336|-|a1B<fo
zQyYq-<|Q+Wi;GQZJDhSCOy6X{Nn+1-gE1593mcB%V3}mkww8fuAG0k#!NqGGDjIM9
zX+ddPot$MoWByD+d;qOr9)bHDI0&Ehw5X`8sOS{p!*v{c=(t{--9~tmI(P-xemYaO
z%#=CNb&~yc($~<0Ig`sKk$cWSjzk3p1`-1UXXR@Ld<?;5NWYp$zmmk%0g{-@llqb>
zCN3d$nMp}W7aR*&@!{Gs-n{sRmLy<IG&VL?9<@sJ72v@0)CNZDX$u<_KpAYhCze$4
zt%&66?Q(|Drx9=&kJTg2Dy3F=o%PkBP*}8~NFyO60F@$?zMFeW;RAQqp;rf2oHs6n
zY<cFEZY5e`)1=n}j$FA@y8H&Q{6?m2GrAOW>x|^nlaU=ec6hVKX6rN<MFg%-&3WBc
zukszd#byg>EjLLf@FR(9CHpbX@N$;A$tH!YF?nLhbCqM2AoH`JWFAZ)T@MJDS*EA$
zU^+TEkqJsO9s9B6M%Rw0U{&%2-uJLHw+dB#AF}Mqu*y~-3Rfs<iyrSiu^*uzDhXU8
zh7Gq8%ML1rJ_hx~g=N-AJ_bP#sChEyaEk#jL0gQcEhch&<_$0`Qe+2vxe>kGNMa$z
zS$8zMpYH5zjH-?ro_mU}?|%xV&#mNKdifX-NFv8MQe;$=bjS=N%Pww~<?uu~lWNLK
zgTxCOBSdx6TF4Y6t#CRU$>g^lm>)og&kWKF8{e2qEE9{37+GeRY^gYE&YM)26ufxD
z^!`^BGV}#8U5g<ZzT^23bDfB;G&SYXwT$QSO_vUmnNDsE5u(1SU?Ne}=VN|o%<22g
z=WPC`(#e2<yPU8Av$%MGKW}&@aej7;<s=861=A9UdnrJmiLr6tAv9Vx)fBJgb`XA<
z@i7mV-}J8p8==X>G?_Do726+m&n5kp<PC~J_Xr?HL?GWyvs@EoZ$u(d2EY^9cw>B;
zdu9z<&Cs4@#yRj<zHi==MH6`H3|$U<R#sM$z{M@FqnRV3u)CK?O8!+ua!X=l!dn&g
zo|wVIYn}dVOek~v`Gk0=x#F+BjLN5)F@?~b_3Nd2RcHFqe$C#GNh6#;Z8n+VbtK&r
zgNUm%Vz`qB7*Q@WqCLWcmX?-VlUvFmt_64-l|0?%iS0QA-*8~Peq@^&hT9+b=+hN5
zBQA>fgwuOzdC&5RGNWSW;*LS;bexMHT3QHc$%JHU0@wuL>aH#s7`D=(mHM69)E}lu
zkD-3GU+S<7jYM`!6;hqc^C<k(N&+kKda4nl+Z}xoi_M4UW);xq5C0@j@WR4EG75m7
z6L>K46SHokery5S+y8)~874}bQUFPlYCwnj+ac+|w@W>iJFb|8?GKNLnRb@c{5G(=
znXH3Akktmrxw$Ab3KexdA|hh%mP9Y^$X-MHnHr(3PQ;3k?J47FCQqK^7T~!-xOQGY
ziqrE`N&&u|nSMd%(LpF3@#eEYtD^&_A9>bjC+*B}Ec9-CW7#;w0c?gs=&yStRa|LL
zlliHPd%|+$>?(;`u0T(DTWv|4@LU!}M75KZ!?@FK>7F%RcQ2RM$F8o^jrQQx-}fS&
zv<Jl8BOG7i^i$Eh=7!|FV4RUgr7-lL5pzob_AUV=?MR~!0c;Ne!dt@nAp<yMi?a)+
zEawb7pGx67sk#6eiUJQ>Ii(ti?vWSo$@V1hm{SvkWr2VuSOhd`MA<qN`lF$R|7csL
zrf*=M`fKB<#}YwSQJK+S>@VIbOS%)T?b~DT0ZS?~Vi0NQfa*JA#VgJ&ZDwnhIuDEx
z8*~$oX8`Ez6d9$EXvNb!53%?FYPMu`-)2R6-e@~BSHg`VmhqjmHY=V!gMGD$^4e7U
zyF*ArPzY$ur5s4x>f_($RcCs=52==DqwP}%B?~-R3ocPs!1Z(aVIrA@JaB-kr9Eom
zo}p%YTiy1KdZE2fu0}Pn<8iTL3e9(UEHErejtsa&5`wGIqXClTSX=(uNdI;N`?te1
ze*Y-DzfG^oQe&!U8jzfFrg)6fOe+y6_dT%=_*iL^_D+iNQyRR%NU2g~%tK^4f^ZqN
zTVxGYh|tLS!vP<+J*b{X-3jS+(u)5$oU<=@kF?$wJ+<^fuU~yhxUcbupK@uq)K>YX
zO0?3yj{gfWxC=-&n`dz=#5t=#aKvu~n@??9<9YWzB5XzI0%*LC*{^?SH^bb~qC?+g
zpStLI*h#Pd0pB~N<n7LfQ=6k>Z7CG~w%Cu*h{6X{dQ>O<R|Dc_xx^xg6#(b20}cXN
ztK_NbuN5bqHnrC^jrQ;!4@a&A8m`!R-_s>spDEmBpSmkH#lXIOp7CO8r>a41YSv-h
zJMr=H3s9ZU30%3VK%}2zA=saG>*)R%?XiPOF^xfLnp~(`ET!<ZK;P-d28TkqVxl5G
zsv{37(v68;RtnzU-UwJXP}>j3UhcYo>5-?4ihh?eJ>M{8JR$z1_8pK3CIF>bCk)Gh
zI5=jQJ`niSR_vM3i1UYIaCU+iq&77Cbh+{>VGlt22EC{3YxCp-TZ|rOvsh1~5qOmX
z?}^2F0<-K1pA`?h{N65fu&8KPanUYrWh=mqxmWVkKU58n0R-;G$W7%@!#k7oQmna^
zW6gL=JSl@5*Jl*!uc*3KtbKc(xeA=;da9yswN-TNp`Tf^IknV;Y{Nz^5m|9looh#&
z#o*5ek*gaMO88V}t8`*!L6A&nKy#>GWAoxm0~6~^9_qi9Z9=Yoc@a0a!2kM6^s;qL
z8PBUnz*L^kww@VX`=I;Sa|+j@hEcMn2kr2DYE@;-&ZwygAh}a_1&2;hToe-p&UL<=
zKw)IIZOw(bplAsYe7-+da^G*pvMLhczv+YCcX~Ge-6OhE#_}XxjIma<j<r^_hZOrs
zcUAIz>$lshf-=@Io`3w_?l%mpg3r?pbG_&%e{cO*-vQlpT&jVM>Vz_#`-L7%yRBIy
z?>JsKus-kGtzuAX4&<)|Y6CR4GC5*~juySqh?-(H$Rv|8Awn{0i<W@uOa@g#HqKz+
zacm;D5<c!^XLBhusLS~!BnclKF)9dEBdFx5>3;?>1nMIg=xbgoo|KgW@txYh2c>V<
zt);3+SD#}9<FX0}kjL<KnNh~ylF6i#KX<@B^%+Pa92<7tg&m|1fAZ(&MWTFpL!(i@
zE@bbAFLAshxg&6yR!d9E2%tNN+7HlZZv@>@_8k1JSLpRhslA)Nb^ea;zN49iWEP{6
z<SY>J>YUp3^MJ6|S!T!BLGCIZGcE=T)0>yjqAxKT(&;>lua)K*4&td-z(4XnG{@0I
z-a3JH5<(`sqz~<bvWora`(azFA+bU!HD~j@w_16NT%J1?j$pBgU=A(q7%ML-`m>S%
zS<Py-p7=vHyW36lCyg|k7^)+Qe`Fkc66$8cduGImjFNa9%*jm#J&ull9_IqqgDKJ=
z+9QLi`L?u<`UDDyN^t|`+i>jVK@<w*3e^I)rtr%s{0psH7Azm4=T4*NWT;v5o+kfw
zH{GGuSgk`73_0gOr!0>Pm|C84^XHtYt?nVH@yhvd?6Fg^)1eWWaN`l;{>&3zN3@}&
zDp%An8<sjsq-gLyOD>zH=*K!g(1zBE?y(O#EHEpK%Z-YcHb2{*@)s73rAqB<Nc$+M
z2AOg4=J-q+eGu056uoB$zwz<B^2qpH`HU?ha&|#}KlcNpUe$WmEJW$)Iop>M^ZCQ(
zuHaCeT5lIzK(g^Yq5^1xMQ8f}146$yXW9a$;6bICyeg4-A9w&qkgb<L63*{06lA>S
zL%$5Yx~2^a@r;#aHPZ#q_BpbXUZJMHww!LxDAQaspiAzawgihnOaAO@+r!*chMLE8
zd`T-6>6AH#AUvs_2`FtIo8tS^AG!}A0pYv__Z#$}YpUk!Y&Grrk_2gOaWs;<+N9>K
z%{Etb!?s>%`N5%}x3gtIrlsI_4}@HAXi)l*uE`&4LNm6_7)P4;mnfyi1^&aSEsomz
zT4!89?^2jbQChFC?Y}&<n^yb1@ej)CH~w*}b20J9`Ip?j4v+BVs{M}R(;+&D`A4K@
zrAHbu_e+)*F>h)nZj@{#u?Ko)BYT4*y1czoN{=|N{8qI2GtT==mD-ocgz_3fh=jWE
zDrd?(^YGgh)T{JqOvbjVnArk{EU%l$<BF=`!>Fgh>>oR`AAdKq3Ggz7uYPxoYW(=s
zo5n4^hm?Atc@^Nif}L0Ts$2|cU6-GojPX_Z7Bt{CXX&@EEi%H5n;advJ;h%+M9sjz
zdO2BLVV$Dt|Jos<(5%OY|5(`D7nvlg>{(!53h%)ss7;;K=}G%TA>sj9^|gd6S{tC5
zZPnz3%1-7=7l(P5lY1jhj0-3CNrOJ!OS}&5w3s$|SzJ{W<ZOz)*<v7|8uyNARex2L
zP<Je4zYW4}@>|`?PoTw5UOQCaN0o3VYw_I4i-j_C^;1~|7<Lc`IwGLO)WBNp<rl4b
zRccPlT&Hnvvi-JoT=NK{jnvvCQt!azSL1=Y33kJ-TYj1?6@1jfBt~z0u;l6b>RK~Q
znpk}}X5~!L@9%1<--K=<%i?qCb@(Ul1&akdS<q$P(CMW;zETl~X1;gvRskMbv1ouI
z!ZL?Yhps6(iCSFG$56VfGJJkA@ilg8))gBL@P@=x{FCBz+o~!VwdKN`X;)uvc0*iO
zs6rfgd6>A4w_ue@nc+lVd4z<jOGUD%oR^m-c^!)uR>5K+W$TXlmtFI`*{)h2ro6w%
zo|FjCJzw(_#6#W<^BsfXB(Vnlidhz@?n3?8gRvh088vOP4eYyeaeW<a-YIbtMb7$h
zQL$ID3SJygjJtAoV3@~jYeRuA^QSN($J0f}CUk#sL~n`kB2aWwUfiDM_-$Ws<)A3R
zJ(*|v;h}`nJ?+^+B|7%eN?*RTjtE(xw4b5<cVJlHxfsW?$pb2b1EzIU#Zd1LBf<f&
z(!sw1d^Tc~MY#=5MTCsF3?8bAcs~brd}UjZ(t*(8j;p_5JE{R#U{=7hN^hXw=!;Pf
z5PL`y8-uuf)I4>7_Tu`)J}IGc#26jNjSzr|Da|a2oHNf>E_H5LsFJ0uWxAn-uSyK%
zew8Gi!1a>2j#7;UyuMLBa`Cnzr7RM~n<qwD<g6v(kinL1IA%SuS5Wh9I^=G^KA=Xq
z5j9a(uOR;VcO-e@KGG-h*H3E;LubW$wbG~Gl?V=-?9b@wA6%~0#e}iftg53QczHu}
zQmC}ts?xWC>3TkWvZDanxm+@tL<EnT2}U{SEb3V!NAP*%t~C?lF%)2_lWq)Z67bk>
z`p*w2$51uiQfHO4I2kQnB*_VuK_TrEjX#qCjet!9ZI*W8@pvGhLkAC1<!C(}TDJ+l
z0mD-wZK0BM$CsF-7iwH?Ody4Nagktb5S1giR?#qq*IwA)mL1i5NJ-Q&lxd@ak!kqu
z*G&dzryC%&2nZW2;-aDpXR!OhK8JY#OpMeRTD8m4FE5uy^OL0@EE-Xpy>7w82y9D`
zegNHbOjjYOZA9X6;LCl8<Q7=R83{3^wfVMUpM-^+*nT_&*Iq}DOuX@^tC}s*uFUwo
zq`N@Vh8={<1}=JM9Q$z)L>pY#adkg%YCbfFR7zat<<7~ejkaA6$jfx{vYb%FUZ$y#
z#Y`cUw)6E>Fxueha=F_F2Jlkxx4KV`@9Wok7%8xE;@Q15-$wj9nBVU21?AZ-UH+}e
z?at^O4p_tBK>iy<`x~`QJYD`G{xR)^-)7xM8tCPzNkrJzd3q`G;D=RW;Z|^U|ATc<
z=^gWr0#gkvKkOcRm!yKZApF|RUb%n%adG<D$;(f&b!k>o4EF|Ru<r_D#J@=_MV#tY
zF57i~n_re8jMXX#*#vF1jpMGdy>e$eYW5?ywB=6xgOEnwr%;TZF6EIwb&3zzwKP1l
zsx0>8VkG1Ki>5kW`Pq|O-(KldsokIB$n-Afq{a0mMZOA3=^vTsxt<at{4!Uc_~W1y
zak@JQ$D&=lx_%)hR{3=L5D;j;rVmde;Oq~zO!48>2J~ihk$^_hPx5+D>Z%_*oLA+J
zz`Z<AP22jThEgiVg2JJVWug4*Ev#l{9&pB(KkL;b$xihPgtFe;(7-}_h1UcX1BIji
z?5IAe@H)D-RqgX-M6F;h*N@8jL}{*JyijxV4)?vZO4a{2bH7JgH%|NeQU{u_1CwD-
zvKvY)dULt^Vw4V?bY9v2H?=MN@PwOC9!c(D1Gf>i3{35AhJ404JPdK6CUDfdvX75Z
zOq+4ZrkZv)Z3ltgcn(=&^EPX}@A?k2bu?K)xavtxXYJ0Qme89Lutvf&GJCPnTNNLl
zzwvH#_;T9TTVcJ6&XH}|2{+h4CpRXpp`TeRj^C?YmD)QKukgQJCI5#aRQwVopO4O(
z``1(W>cQL6(X*=*>h4kax?$f}%RQt$sxWp1W%XN>i=yi5wpr8n&hE%(Cs!LN96HSo
zT4!^GWkz6`2~rL4Xubz^;lT#GFDEUdzW&#ekQGU`Uv1!@@}Eh<a0k8UBM<+XB)snD
zHl||W@Bg1k!nO<RVF7|k)7>Rca&jUc|J6^zWCXwictAh)BEsOcarJw;`+-A;!~x)&
z118AFSm3_HREEMm@7e359DaMnmrp<c6G`YbNlI2!)i(HVNJ3;Rk8G`2YKp}^f)8Li
zD2A=&E%iH66vj_*D~}<XpOY<hk7|D(t#mP?yAosJ$gmgJ+F8wd_1=f;92!wAF{%TQ
zGF_Q3cItkZx%w4pce9v~TNuJCC%cccbrvv{0t{^)r}GVyrV)_;UEiI^3+p3t2o9`S
zeG@_O$?}$WYuD>d6s7nudnij{%~HYjO7sY|#qao3!R7&i*KKD4D@kYk==eno?TgNo
z`xqlH_DcMrtBsc}(B49cbJI-0Xfvuo(%hSQSh435w*0N&B%y7i-=W6Zf4kxwDGd%J
z-cVHaw+&G}>0=(+@gY!n!}r|R#6<ms1;+Z_uhYAJ8TPt)$syzA5Q~d6-dM+Pn3%s@
z)k5{1uaR75l(0=>l<roy{xXa~)Z&kaWVE!Pg4v!}(+{<KWB!MHAc&fj8B?2({I}99
zJq`aAQ5D+Nx6V!>*o*J0ul(x6E{OFn*#&qu&1$x?=bn5!<YKcS4aBDM_dhShD5-bn
zAvvfs`mwt(tO63h-OTE-=b30F_09+s8fUbzMeZel-rOM@R7NkpL5rmeG#QgLn~#vp
z3P+e|YF%9fOmhlh#!BE06S%8(dms7)R=lQ7&Il3agx(+ky<s9K)d2VhE>zdAyFZvW
z9uI|~_dh2w)xU~FdTUJ=`xjD1L@=jng1H0Oll6~5gMmDN2@lK}+RX?Wo+N;ZIIn-W
zW)$GJ{xxr0Iv}602!XKPU9UO!q8Y>50O_rtLic{qBl8}$s;W8P9aqv?_Iyj?ak(;+
z&oF#I_Q|J#aBG<Vg3WSyV-33;x+eAZQuMXQRxqLk2idBm=;}i-aM1Q-EEZcya0UAC
zU6m^Cpq(9qkqt=aC_|D|Zt%mH3`S_VbLH>D9v=gQ;T?tI?zpXaXQ%@_*vyU~$u<zu
zJMVYM$0=d;y3SZE{67eoQCB;6K3wpwR(W0OlT|P_9I!A1k43|b7KV^s@YXQVvr!SC
znA*xvhfiKeF2GaWk-Bbw8$cMtG>&Eq^mqd60GauU%{HMw(EpxQLmv_$*UQjKkPlBt
z*1d<zpBj&mABuMjfH6f>$@}U4CD5M6e5&!%iW_C91U$*VEegFGQPBTecK<B}4C%FF
z2cn7E-KEU&5ybSk!VR8DRcrosf+ap>aD9gvrjx0CgdH@d`97|1*!DMW^;Ji%Ni-W8
z5>W7R@7=DjcY$-co%Xa__Co1yS5IMA+@1=;)=TbzS6e0sM<>_h^&F@l=s+=)d%IjU
z?Y?}hKX<Tq@x~4NN6Mu&gVa|_+2i8&Z`OLzAx*)Ww5cA$$F(<_Qt?%D(=kgcRSc#m
zGd=TD>bvf8wV$o1D^_2kXU2_qxG3D!wENfbe>w(>vhNoEbZlT2HGNiqANymDM=3TJ
GZ~Z%CB(@^}

literal 0
HcmV?d00001

diff --git a/doc/source/assets/images/neutron-network-2.png b/doc/source/assets/images/neutron-network-2.png
new file mode 100644
index 0000000000000000000000000000000000000000..919935119de1655ca6c7ffb4e943a5f517b57fb0
GIT binary patch
literal 11243
zcmeHtc~F!2wrx-poWOx2QHF?ggGXrwMNq^<u>rj;&^C>LGD!eY2q+R}NLo--z}T&V
z5+SYh0XraJkN^P^XohIh2sA=~7$TDlfiNZkLXx**pZls_)vLO7UcEowyLD2b%KH4i
z{HDFvUTf{|?zhg4TQ=_Ah(I8=oH_mVcL>B9KlnSVz8<c4uiKr2KpZGL^YzK^W1da(
z+QYx_^#3S{F-r<CdKlm)SzHYM#dF%9gr365iMKQvr+1p~4*ud4ah->a`kygdRQ^0M
ze*&YiM(n@Lt|#2;xw&pbd2aHSoYzGBe6t$&Ld?49;2=iLy#Ncs<*%1IwjJ*4`y#E#
zA06})Mf1e>+62|)=HQmBnYx5s{q!xn5Qw);sc01hvA}_-g80Iy9)Z}t1Lk^ngE@lO
zq>4nG@L#hTvByGXJ>tO=#9GAZv;V&Bzt4t5Z?y~7U(rPzN%-%xrhhF?O<v=4^jE&{
z<EL!Ru1Pw}rN?FlPKUiyC$fKu8Q(!njdBaEnC2bZpYm-utN2Q`ZOVfUhY(h~REE#=
zrx#b=eRV7$m!sfWIx**LPOhI#*<hag2wfYs%iB6ZXu?%572@qSf84O$&vutV$|r;0
z1osx+OfpPsmaZN$SU)?WZmwUKsw-kRV|LSb`R5y{<Z5ugo&93UH6c)E%$0-hv~&vP
zT1C+oHf^ilv8O)fy*RLcZa<D2<mT4aBf$4rIt@5JId_G~ZrA!kZQ4nSpAJdD^(Xu?
z;?_?WrERY_G^{^zT3S^c;!Z~$zw!!MKe)qB_fdhC57)}BXm<PzvC*jh2vS;`d*Dm1
z2SOJe^34(TApyIe-ZpRR+l|kO7BsHzU3bk-6&df6km$pudwOQ3W#CL!)OYwJ)J_mf
zIZYf<F}KAoMP-UL^xOpzV_n#NwZooc)AA(HvnR#Hed>Ta@p$00di*f;cwKr@U7wru
z&S9sA7oTXBuvC$nLC31}57Jle#Ae;7B4IydP45%jG&!_?eF^I9$)7%;g`*WNV-YAi
zD|f414leXlb{}KS$CJBM44)=$rcM9&f{w!+`U&6tvgZ?fk;b~Z`x=G$F1O7~MVyQ<
zyqid{9F7Y1*1lxj+=q5L$vne)8j=}^L;2Zl-lNC;w&aFX-#2{N$>ry|nUyv#>GXls
zgX<q;9`>8vIiU3@_26#053SX<U4X>$T((^-(kzL0sPFwX5hdGbkPu`ka5B6|?#kez
z;)7j(gagUz9FM5D;D-0s<~bB!;<xL3v@l=O@-WIfG?bYnO$^)k=u~=Ev%f_cH!3^O
zGjnX2K?(}_4H4x?Ed8cOOON<AAmUHV%RMO_Vl$q^1-6rjz+Q%PfMBsx7o5`F6*pz4
z-p5~U<F9@wbf*n$GI(v#!U<{cPsd5r-=?CSh>mB7r6IzP@l)_=gn5^lWCePf-h1JJ
zH|Rmi*7WM7&GtR+2*;UI+DRF|Ol57g6X(n%jImf%RWXEvPoKRDDj)8?diaA^I-j74
zTJciRH&khHuE6PJ=ij9y%)fOB!(4r^xH8i)BO91WjJC<iRX(wtfc7!XYV5x1)`R!9
zblNe!VSUNP{5^el>9|VN8Khh|BNzHc8i-jzYAbgdPIafw&{lt^t@4NGmb&BWOgRF4
zsSj-d%_!bTYtvJxRAJVn=kzkKM5on~k=O;^Op=7PI;crl>M}^dd`Li@j3Uq#GQvbw
z(uAUQp;qYAV}Gs))~IcNZY-85WLa}By4*1%^0xX-eUI{q&84-LdAYeAMrouz><o@v
zRxX$jGdI+nWoBxMuBxrI-C&S_mk!(ak-h(RhOo*etX|gE)^0E8nka|E3eGknS<oTZ
z?%%&}n%X#6n3tEA2ETJuSHl>t!f%T#f;7#Ey!qAesk4=Zab7geXhgNHb3xa`w6rv{
zS{TY0y*%>JjIcV##)#%eTQ%F?y+c1aYc$gqRGue_J3gLEE}7PUTDjVVk#!NO)3$Ch
z2*5~gU?lTqig`0Ww|kBtzDy8L(d3h~+?mNGmN<kZCgeVQR(s_5aaoM5zVG*Lhr_dt
zd`)%^Lku0vaVAL#UC80MBf9Tk);?&0e05kd5I>WriC+4MNgCYbyTq382@17>f&z-J
zo?ac5deuj(d4I~DCPY+|I<lsx1u1y3?>wx}F|Tv<?c29$jN%144x2kxSY|So*BN|}
z+;%^!b+n{dK*e!82p>?gPLzzi^*7GUA%BQb4ofalAnk&ga~a`YDO=?ei7173(x5gI
zg$-3+dp0w)#9Aq2tq>ju9-XNq?Q4zjbn71KvL-N|UOlHJ$iFgg(whBZU#4;>eUdLa
zUOd&jFxHMqlCLh4oSmJ0(jD?z(Y5~R6<_T`M14anJtTW*BXND;=Jr)~el_4_%GQ2}
z{{}yEoeYO8_-L2+O~sUYq@OSB{@Hh{J~mWpe3u!{X0x>|T5Q@E@R@;%NNsleLPA~P
zux4uG+iORjX{=B7R2+n3wrI(xQv2Y_efDq}N;bJB2Ikc6?Be1ZWq6sQi$YQGD)ioG
zH($#)`9+^SS>`HB`p&7ViBX&eDe+ZSYhGVylx2>y3q;gJz`>)_^skX-JJa$YxQYaf
zsl6t2oDQUTl8i%;NrYIfzo$HqeF~R<VnJ}5-t+g&94*^-Z<Mn7ma=+Tf?wq?W$>3U
zj9bE1Ds`tMah1RFioX&KN9B;$S!nvw=NWup1+6dk_29TIjAAS%=b~G88L3PexN|WH
z*CQh%J729OpLaX_Rcl0_nn&d(<~ehs-ZsA}ugaY!k>|cG;s^l8wq&-B2E&ehT3C)j
zQ&4SV3wfgvv9G;M3q^6>km!qMiB&RXgtC&d?rbm!U`cCO(mGS-PMC^Xa>HvXH8yul
z5T3L^R!n-66kL{!tGMWy2?3-HcdSoth%`t3A)H%M#6vv^Tb%8lo11IB+@4!E?oj6Q
zIIwyue_MG`{LSey6ONmkQ_Z=u2{?hxa3*eU<w+aM344VZV>ea(995BjPYLra>7e66
zvyEs18=8RO_3C{0)r#GbC#@hEyB&z4ZRbt1S_c!*nC!M7V~k<}qre14C!_>ma>Uc&
z1Sw(SW`G59bH1aaV;20;U~;cbS_8TCL2bgEwt`!ETwci(y_$(4iJxtO;OOk^EL83!
ziLI#Q#W6gsb7GR>;#SUBuMy9WkB_@~W-he7`qDqWkV-ud_``5KX3EG4gygYp_r<7<
zw7kzltnD>WaX2W83}78gl6)6wasEBtyO<+*!9~7?Ioo$x+DrER-jIMsLDW19>z^M9
z@s;*RmszKrMVS(2)d;f~Hj*3Gsdy1@`EeN%v@gaMJ@Z>2kOeegyV1k9<urm!py1(1
zidW%@f*Rh9{id+2gd@5>5XB1*A3iJ}9v&`_KO$%GV&1jLm$Z$Ijm>h8$BW-iOiUQ-
zsEAjN>MhuY!y=H_u8fFR4Ez;*`t^8)nV~P@u1AW?L4y=J*Rw9ef)43%CEKWdq1Unv
zzyPKms~r^U&5=<?<LZhbdVV1vBm*$7q_LLL_yBwDcIt{1M*DIqVJTISfAJ4~6Os&t
zN@nviY-BvJQudp@XJ#uPKwqd8gue)o@3KO)yu7S^N?p;0XDf2}fZ?J|%V{q>B+_Rh
zL)Uhg_H`FF4K9SYxJR$LD3@`a^@Pdo3i)v?R?qHb4NWSd7^I-9vZpJ2hBocdGxW2)
zlOZq-E!q|@`}3<0?b3BiGRu)rD;?PGE_a$w9f#%R<HNLmde)hNGjV7gjp(51abucB
z<FGon(_r^LkMULsNj681#&%}tzJd}77_&4qG*q{+u%PM7Ojy1J|1fhldN|fKvAD?P
z%f$q_l%<do+&K8D+?R~Dh1!Xo3++mXotwLk@<s87mQc?q6vEv6{QPpL)v<|!OEox~
zvaNRXIlmv4A^aoRgypHea#AjaAfJPCV#~&mo7XP@P$ov=NqcZoyf@iQW|=p;=5)I{
zQu76CLSpF8`~Kp1{;(YoH^@gi?$kN0LPoLFeh4oqm3<%N!@)D>p53;$#_w9NrPVA2
zQ>l}jgu2Q6X`e+yM+l0`jf2;|(`sfE0}Jw!u!Vcg`L+@&HAsdIGDykiJ7dj}i(T1f
zR*v~$*H?QL<dImWkIBwF@_jz3A5Lp&WMrf{#+HfHNbQ2u_fF{6>AKhViNfWtMf|zL
z&-P`=-j5>v@4cT{^4838@{R(Ja_UOS7!HWdwU*fw0ULQKu(`dpY}#I+oD5Vf6b7on
z!?~E%GM%H@%}7C5dy#xwih=YxvKz=wxk)P^GiEX>OOqE=kk;Tg8@DLXyU!XI+v)h+
zSbYm9<4IWU>gv)4@HZooNM?{00r4oBNh`XXklidoNKX+<UC@=wm(`zN;aa6xhzDom
z`hoM~^N!O{-A8ma%xbp%LcNmR+uTM4kW<`g0xak;W6n^R1^e#Vr<YDh+9s`tZ48ln
zV!d~eXJ+DTgBpM4K8kTm*4p5A&5TWPE->byg8^0mA%b+~+`?Tf)|3!bky0W45k9TO
z-OWv8co}ESsF>34Ub<T9p$q8S3E8yr?SXs#z&tJ|H~87?&M+kbCxP%OggUni;vkG)
zgtsmeuUtv!r{ikAI-o3{Hc+ZyPm+d=lZG&h>=}ob!s#XM7=b$sISD8I^nz+HVNH5+
zhrP!R>>p(&7e%C@1NUB_PG&2K!3E%TVJoFTg2XP#?{W8RXw<9yuhayTQ*)x5qOhiy
zn!j+^W-uq@W>fa?+&S?TqD)qNUtv1NZ|0mL6e6nDskA%~ZY;oeMs`KxDs${n<^avv
zqGRI{($7<T<Msu&%8W)RaDfWl46e=tI>q!)hIq*{GjN8bkYj|COEYoud_5J7WZb?Z
zN4PqSD3|MxB&7XQD9_&T;gV`p&!^%U4(>!;*Bp!wD6y;^jbD`>At1yQ#PA;PQj*8i
zO``zMoz^sgyz?RNjca+`X&E)9TDTPG`A$2nImVsMqAjTTu{M}%^q+qd;O^a}^TYhp
zD-3Q*t9Wj~)|bW+T!njP;2w<U+Ln_wd+pGbkDGg>m!mz6@opobQ^OT$!+gQ=+7e1S
zu|Y3V`crc%S`(o`*4glH<K+KSC&?q2Yh}B5W;W*5*6dWYT38SLm2VSb`vLtG)tJ?O
zdg8e2$K3`gMT##?QXT|)ej=}XKtv=P7wf3R>-pGi_LHb0ZLbSNjC2btgA}8bjv&vT
zg#Jq>LDJnpV6%$MY!OgVo{Yujj4khP@n9pR74Z$Hk@aEf=20#Ev_^9vi>+nP+}-{L
zB`wgCe$N6><S;Mt3xwn>vGhQLdhewwrDC((?F4LB7mzh+|H0KN<|E7c<2(GOzUI;$
z>NT2Lv&=BSCCniE{nMQkf6{ReWijW_2+3*Co5BxjAC)4}q_qr)KH%o>WnLq(`q=ay
z;^#?T4xNujzI*qM>5)0=590v24D{yMbLpix>&pfzRW4EWLE1MD`=w$JKD8yc1+ig4
zRUnr0ulQ@XGf9YJd+U35h16>_LQORT?sc_-I>~q^?KI<Kh`eonvrVtg7hVOi?9?@a
z<9^b~^F_eczz$x?F55(_)mh%|i#TRf|M6}}woz!P&h|2sLo)Re?3&HvoP-T##IKe6
zd$BWcW!oMVmG#kDb}^APjg>gTWt9_lN#kqk*lv#z@qaik*=~^CapTe{yXqLN{7OE3
zc_mbEbVsFcboX`19p!;8Bxe~9Qui=~GuF+WpSV_(YpYglo;(JTYpT-nu*<Q-)PFp`
z;!@3OEkbvv>w{Shdh$13D%W%z>SMMSU#NM^Gq;cFW)ze2|7Pu5xxDYK0BweFA#XF!
zP2m;`;<8B9(*i`j`oCnL1~V`?uI7U~|MXcs)t^^4*Qi``Q7+jarHz$+TlMq_qKcFH
z^JyRb6)!}ts>*s7uk_L_28)K5aG8M+e(ZbT=IUdt7i2rJUbnVR3jeXi;K^;(UJDTO
zPC#%#k0eAzi5nbIiHj~tv&pE{@)?3cs#tZztaQ4tK(T%UlBs<Rn17v*wo{iDsF_6l
zr!wHp3ucMaKt%^nQP>xQA*|A`duug=&~&~}BDD_?6f#t1V6{nW#4c=t-ld+KDpQ%@
zVKA<|vP$U~iS@|}tS+KnMeoiq0`2c#?WF;+Nu^!@!9gt+)Z(~Lz%Zi6$14<n0;M(9
zOxzybNjf3srvkwN&7d3tK)yNHG8+W1S!={oCAkYOQd`^ml}d~0qUinYt=UK{Oo*CB
zYlWiB^e|aj$_A}<$(sXgzErbhs!N^AUbEx^Iyjk-F#fRWRog_9X;HRqyE~Lrv_8oU
z#3gzci47umybP*4kR>Fx++t&p<z_!MRphZQn(?F~>vrQ{fUQ1-cE0drW}v6G%H_gt
z>ecLg5FnxJdvjM@SgWIE3TZ0(Ze?flH65&%QqDN+ZKnWj>ja{%v?9W^LV2W{#}|*T
zwLQNk-TNvwUA8!!0GZY!5Vb;90#^cpa#@*H7hX~6IFR4Iq`2uDcVzEfWbYNyj<IXn
zGNVG-Yk&1iH*A(7U^*0V1avbT9>Sxsxg3j@mN(k<LVy(i5MC$Mq*cjWV86jB$#BR!
zgYt#c<Eqfxne&fns~F8hjd1LtdjE8qVJMs?q<a8J1<;5fiMun1v8o5^@54|1qm4mM
ziZ1sJ^t8&bumaeC8-eDV*4&cBYWqCDn84yh%ghodz9A?&#%6b}*o$Ph3-OhE2;Ijw
zMwFJWFB-V8cKv6NIvd>x;sWY?VVGsn-&-Tjaqt5f3C+MyQGS|<?<(iOuh1K^(yEKX
za-{j>y*^{H@MYe!=;7^MZ5jV-WxvW^H`?vMPB}Kh2@bmrR<JL+B(#7$Yd%G3<o4g8
zw%_V)5$}-gxPfZ1R{e<BU>-#!|Gts8u;n%#2j)_5c7*Ldh%D5KuCVdbqmdr1KqIEo
zPx$dSael6hkFjRs)lcrk7QqbzEr(t2P4{pm3LV6(y1Myyal^vN)Dq#omZc|qM=cV+
zLa3c0&OOi&eImRZ+ftv~%WX4NLFga&-!x4Y_MJZcGvAwu<5n$8oZRbP5qRDt%H$FE
zI)yh$b5?8FK>gVJ<8|$0{)LkKpQ|UZ;WqMO(n3B>KxeDPP=RG=cx#{FWFUC>fN}Z{
zcoe(Owz4K^Kx*ScWdEj)wEbC-KQe%)h8>F;!2jN^zO!Do-LK@b&@fwQvu@eQp#&k!
zLL{q2blsHDae3#AiR=TfaW#teq|NbrQ#w8b223)DlWPyu3~oy$&yed3dc$nwc+`R^
zyP8A`ktQN?w*%;2;~>@&3#)!a{NHI9d6WuVpb=4K(%Mh2%jy-7qABdNqfEtDbW%+k
zb}d3O^D(Sv&G5o18Bu?!Z&}@AhT2IfbO^KJhfAl)1lDAtHGhmsVzthN-^(t%f1L|6
zWz7t)R<`5a4RMHinL3VpJ16O8$j!n02QjWlZ*8COjZZ6&%1xQY(;o4h1%48b{7$A3
z6^GM(vDJ=8$H_a!RO;VV)Y!(9Z7abgdW5DnilqVWU;jy$<J@n(_a+g#r2J;@`wMi6
zl<_7mb!j6``c&XV^uEMly+)Myf)AFc)|b4l7w?LT#`D;$>A9JZexVb4!jUl`60jzE
zqn96;)><i67q9Nnp}2A?wwV(hO;S3-R{O$g(KWQK@w0z_V_hAFbE6-Y(T^rZcT1VA
zb2Ib!x``tkCsY_k;WQJ^V>O7EYbQdgCSwrw1v}H4t0+!j4D%?Gh?x(|>b*e-F9|>V
zMp2;;t8kb#kywcl<_~*`=!Nf;PiHMuJE$AH=S#VSs^*$C^<8s^d}aS3u4BnkL(P$A
z!ADp?4%@W!HX%X%Jq+~xps!a`m_s7!F$DW19jHs-@il2963(N1$pp-?W73j+_uS5D
zfn^Tx!^!gxm&WRcZs~n~WU+&BZ+tzGt7Hn0Z#B}(Z^}X+kHz-Tr!P7xTZ&Z;kv7M1
zU?VVYEgPiRq;#|_iLsVzrY0r?dWfo96OnPx0zDssWex-6j>T5)EMidxVzs6^ooLs~
z>A3P&bxZ_N$7E+(Cm26qq?8p4UR=!88W_!8`KUs#^PFsHJWeJLi0Nz>{IeQeh1J-N
zEJ7+bK{y(5boD7MY1FDf4dK!vk&97fa{1EdT>w9h!|H|pN?jAcl4RbQGS*=2U-wR&
zbe=2qs=HF&NgfKwVpj_W_JqfyIduxX7iMJVf&#FRw4;yuB4RcseJb>Q%aqj3$h3Jo
zweYNU_Lb|4rmX@KLo`>u|GH1l3R5S@+cv{65Y*_7QIA&%ZzOlMy@_*u#v8gq_Mu!=
ze|{8$Q4E0<kbBn17+i!%D{{^sLFIGGE6xS%h2?|~nsuLDch?UuR$o~pSI)M9<;Gfh
z7tLJ2pci9jj~wq52tJX!3&>P(YVcqIfP)LQ&I*i8m}nNLd+<1wg7SRkXzfKsg-}?I
zlgx$V{o`xY6%6AhX4{THet`7oUOt|DS8DSPaORjQUr^wF2cUReCFpwl%2F>l8YnS=
zZf*<RS4BYVwm@qNYz}Z@XHtEmmqiV(qJKbLz}PMxosFqxq6<-PHyXT$GG%`bik(-a
zq<O;6{0UgD6HwhXQX7>`rZ7}V9M-Uh&DzqO*!0f3V0B=GdH+UE;r;k7R-^d!G=5AA
z8_K2QprVN^{)R0AvJ6l5`IkOPXAd|0)mgyIKaSp{(X2i7#zj8jB8Qr+rf<gKjNu$S
zK2sM4Hxdul-zO+#RBE=w3|a{c?>YXJZM{D0d)<Dx-gUza{Ut|s%u5oEZ?gbdO%7B1
z<Yt}TFV4FJ1Ru&R(Bfqni!nTQ(dEya$!~5Ok2Y#zR{wLP%c8DSS@8Kvmb<G~GdRug
zb<@TcPUp;)n;iQiXO<TC^(Aqpi+-YOiMI&NaXLA`zCN%h=duZ1%OAF$n|a+*L~xJ@
z_g;urq3>@k12Y7iek-Sk;kNyT7r5(cl)k=f{CWEi>{byzPyUw9O?v8_Uix;Sb|A_0
zjbo|0f*#HlNoTlYbpnflp%|RIu$0nz-vSCCSp5Fh-AL=)sD_u?Uwr)W?bJ^KLEJ^n
z?*!P;8-jxNTA??F@8f)O{#Py6B3`prKmAqB-&^8BsGV^8_io**{~Yz0?EO&7`vCg#
zSYm>PiUa-nIh;avV=ho@bJT$r56oXDUL4gH>0cuf$JeQBG`Fg|?kx2ltNnpoConAh
zXjDu));Ga=j2JeOJKkDcC9qAanc}90+!htY$LIg`O9<uL4%Gi3pdhOV^4`MSeM{6z
zo_IN^@}DJ@d_OU3VK6FpMTGC-NKL(dL8$Fd>F~ne7_XbSeWQy#5V`7&8gugH)Z}Vb
z4zH{fNj2gP{Sa!C44wCQ>w7f=Cxi!r!)`olyAhw&9<nHqS259wQpwv}8)r{@TQ^5!
z{aRNT%C8>~tryV^x7XNcR4!=IXwoB;T*TTKJK?ZV1m87D8l^ihfMqg;WVo0TcHzMX
zI?nP!Q%%fO4kwY61nt0EbX;Si-ezK@wq3AreyyCL<3(8eM{)JZFjlzuw$7vzn<c~!
zj2?-WG3b~Uo07t6=74NvyB~to;T`_qnszZwHl(BSuQk5^&)(xu&h!*TwVtbPU<thO
zLlKUfEVJi}Dij*aEBiqrBL+YyY9?;<GE8|OVvVG3g{rP0B#*B2`=%x(!g)sJ>pYK1
z#M(CLd?^(?pqZ(xuYU(3;9yHHbl|tzkpn#!CK3<oHaYzyi+aP!LafzzEGks<1Hk|u
zC3rI6`XR9_`u?fq)3*cygzl{9%X(sC0PfwTCxE|T>=aV(K_-Kn)r<tnn;pgoHmhc8
zG(Pw7eF{JJy}8|Wq^YUt01DW0{uO0g?=@xrMhx?q5Ia%D)M)y_$Jf)So_Oj#{nfU6
zYv+_bJI-IU9L#XmYaBNK<6~Lp?&X_0yp=|SbJpmV%L7I$%FD|&|DxEy_@Su<?sK|@
zP`X=>!%;c%QSc2>CH1Y*pQ(eOywm<7&jFUZmCY1*0f8HJBQsb5qko=d!QM3*-<CLx
zU4t5YS=qaSwL_y6y8Tl_LB1@KG|tCs5J97HRFT&n6m=fmT;3O2>t&h>LWC-?nQ=50
z%cPYvW9$MA(aP`e22agvP!Z6Mg1&ntjvSuuTz~A?h;l+Dhn%_|@iHuC9E>!EKE1hg
z<bPgG$-wE^Wd^EQ9B=y1tKZ17pCwmYM0~3uRz}{`A3aWUe)*|KHm4>e_Ni_DxSK3h
z=SjjjvQoadY9=CVW~F+Dio3{~@*TAB@vT|SF23=S!#SC2d19l~_8)UrV>|6)-V_8K
zec5?eOMh5Yv0QqWR*_u8Oed;%4Km1VarhEPCS#C0#Ox1?a<X-Ub%x1@pr+v;!qSsE
zS-(L(Z9mp45cs+1`nea^^m*YA)lB4<C%Ovw(F<5BUjnaf-pQI*IKY(sCXbooxKI9F
zcq&kJ^T+$eI{04ZT<Cp=4^gUvP7RSfb~r!ss242bE{zMXK1D}nkz3vJws0~MLX-X=
z=f5nrxlJAzz6P`Z#NJqHeQ4c=l2PifPug@k++5AvofIEF$%+~0c#E->{Aj6%bw*ey
zi?=w^7*oXIxUt9L9O@Cp*T}y<v96nTV#)ZUGFlwhyFf3)VM>#u4gdMCyl*x2U6<?%
zIWlU{PnkHM6W*`DPQC4`fh_~SLxiu{Ow8F}5Goga%)i?k4ogxd+^-ve6SkhBY$CNc
z{B_G+3%Wr{(l0OC%BDVsJ({AOVltJs0WtdeK1?WuiX4X5U82o!>VrS$-}Um9PJd2Q
z-6CLOHqiW4wy>AR^GNcynqVLh#4<1tD2j0~5GJ(Ed=e&<9SrDRfqDAkN;Z6hM+nBC
z&39nEwCzjvLH{bdPs$#2D&zqWfEJ`L{|n8)SN8=W;kLgk15@o+a#Zjsb*J1hJoJO8
z)K7o)g3X{UY2I2^M5Q)^Ar77rm!1JC5*NP}L(#Ou*u5v9fDeFhJ%&c3Q6#oDJocSi
zcP)?;_$44zDIyzy%2^K@4bV^RC99?aEV>qWd!TeO?0y#b5(%Xqi`MLA|579*CiG^d
zIsxJdrw9eXZl=0zB3IbLffmPZu-la_z=(+Xw@O71U1s35z(AUj<cxFo5_Ml)OPs#z
z7?)TFIFkIHCK-1${$E`K$*Gml&j#2d=y$Z~d?6`Jdu-KGwI6!28Cp5u6s+dK0BE3T
zynW3K)IVazZ!qr)LRhwR!GRrq^(rAs$DrfCat!{X>f8V&X~!Q){l+OJN4=wuLOZ|(
z`seq-0sxBj`Q4WCcEcTjQ2H@VpP{zBhw%VfnAbu7gYEb?`_kQjlJZYLgqexSBXZop
z9&9=-{3j)G1S6+$a8~J)Kyx!J#XlT%X?&$0Lz-Bb++hB3YlWxeRJHU{?eArwyRo6*
zFe<zD&^?aYl(!&kK{A><r83uLb5UBZbc=-`tYMKF|ES*|o8eqn;cyuR6rdGb!z_bi
zN~KDF_|T+;^7Fi4d)Lg-7ho6ZJiP;wPQHG*V{BFRwNA}X);z6&e=@A}QsK@s)>5?1
z;7b2Dq)#iqGyM6Aa@DHeK4p`I4oGtTU3VT5x1}Ur$GWbax6hic7E_l$cG5+>6GDBo
z)EkoMNF=Qw$x8m=+4dooQ0HAZCxbvK`ta*!QAMhLqq5$x{iU~;swudzCp9<P9=QOw
zIVE3T#nkV>)-qL*vmVQR;#rN!+cA#CwAAPhPL};rJr>`AdDa(SY&LMWZRlT0`hUNR
f`TxdSr!vLnS%)6&RKoxSe9qWAe_d?nck_P$>ZA$(

literal 0
HcmV?d00001

diff --git a/doc/source/assets/images/neutron-network-3.png b/doc/source/assets/images/neutron-network-3.png
new file mode 100644
index 0000000000000000000000000000000000000000..34f03ed5c9aa81863dda17be757d70daaa05735b
GIT binary patch
literal 13293
zcmeI3dpy*6|M$PxqPEa>poHv!y-Fk^r%~Fr`jynSNQ|k35-Ay{F=%ORskG~gGNH0d
z>ohrz;|y7(iAjUOU`QH_nZcMD=6JuSc7Koix*yl?ci)fuas74Qm&Z6fX1?E<&*^=5
zJ>PFPjvYO)dgZ2-2!gCWbnu(+5JY_uzK>`vhiB4a-XtQ3b>*RN_I@AzkUQL&_T?1b
zOcb5-(~HcPg}j{ZyI<V=f_qlSVWwFx$qs$XdG>Sf9sBS8Vsd)fNe8XZ7(cGMaremN
z#Fo>R+bFsUvtM_G?p0@8eb$`xXqoxqXsXWOz0viR>pC7xmGVko702DsGB$nkApL{~
zI&9#<Tn}60%ffBjcFzA^i1CUObYPs;WaY2eh#+^9Yxrs~I`M%fO(Zc{3&wj_SIrnf
zKKp!B1KH#HNgRS4{3%ffK~}7pRYSIzsG|_%%WwXD@xNE&AJ4|va#t-Oxg9|+umAV)
z`S0xG;Q1`m8JzCr^RQlS#&jFEoB;0%!WuQi*S(Cd)<j0Hdrx@(-rhO+SSZVjfi-e{
z@ks(Q>SmQhORC&B9k%v;*sK##fo5RIS8|(lkeTE}TGE?kQuL3KZ8?rq+aKa_xsP;^
zp>1lpnqMRz<A2eQ*>R`1u&{i!*v)iO0}&r=GK-NutfCyTBTzOjRPn&}n|D5N(n?v!
ztGGS)y@y8+){u~YgNygOtbs&*KAK*+?*g^<Al+u*^p5*P2B*A~)9~rih=&Hkb4}H5
z6x9i*b#@Jf4f<YSf9^()Hql0W35o8OhG#MI(hwp!&&wF8xtZurbo%u)CG?9)Jx`Vz
zV)4Z&-5_PiU1{naxE5X>@r&JCqkNoyq1=h)<>4_Ann2c@Mw+&%qcq)Xl$G#&xw)PJ
zH6+pm^I9`e^Jo+M(F$>9eaHhh6Jx}v`Ya0u6IgX>HS-wdj#Z#{M(^0Tb$H`W^+e5s
zd<)I-C%d?vBb1T-oJj^Y+i`9KVq~h8+c==TAYCOuA0$)tdH%-Y0LKN=H5cn59b}6B
zq{SfWr;7u|Z%*=BMB=rsPs?wo1_WgEeUf<YK{NZd{U4_(&h%lMPP4$bmRa{$aYv$*
z`$Ko8EZ`%3%|Aunn2id)-7E>-&D^UfznkE(=<@4^Y{ryD#=QV<`m(sa#>kt~4~|6g
zUbo0YeQo?%X2Y%JbrZW9`!y3ICYw`yqK7}tAisJKYrT^u*xGgyyZ!s4ZOanlt&?a+
z4J9*pt+BNgb40=eR!I9md<g3lHY>lQZG3JZxM~w@U!~s5l_{u8$Y^ljY|LwmPb&!G
zu&}Eh2+x1FpZSLL{0p!?0WmqmdcA<yd9_EmpTtETa*xtEQb14V{W_-WN*^9%<=)jn
zoWB^Yuy&)L^YB=2l8iMDsy?CT`a&^pshkh;BgZXyYCXPTMV@X=v$Ex`bd(yIBA556
zqv}mfjGocyblUqEzk30-=G5@x>skv}OR5HN$fTLsK>4=EKCyE$nXLcF?3ooN=UB4$
zcFGhzOTPx^?4!n=Y{7VM@UB6pfoiEC4_Aydb!sind{4J|T*_JOK42{G7ZqAJ#0>LC
zNeNOC#hK7)q`E~Q5OjpsZZ7dGDlaU2Qp!2+7Kcn)Zg-gZhHk^$)}2gQB2bpx2OlXZ
zLC)wa`NTRsPs(B{Ws#BI@oplv(SpIjmiZ9{7Co4CGj_!OPmzVBMB34il;@%^yByk1
zCP<kq1(B?j^OfIdjfrhZYZm!55lzWXP_UI0Ct8uH+T!L}k9DneU*FtH6JW*l1Ad!M
z)MzFu*31t4Zqd(<AzM(xcj>R{I*`{L;bfGH7Z6x7<6IP8QmdNz)yT-m&s-Oui^i`j
z81-K#E1QjF&AAQHb8kCBY;g@I&40wA*;Z|VJM>?r-MQ2CZC*DuFE3ATd~PwsW|Ny{
zQge)VMv=vgkA^WK*)~}f;5AtEq)ix$w#cM*huAvC%)M<*bHYm&4!B4r^Jw_Rv6S2d
z(ab=QySqE<!O?;+Si(GEtaC_~X`pvs<+gfr<z$*-(uKMIwT{U-7lE~lV1}lcp^Xgo
zDiS0G36cexQbx<2306{MREkXb@Zm!z{K8~+3an=9=^eX?90v@Xv#E&KorKOi^|=>r
zU2)!Y`~86f2WUA?G4o?SVU5COM}C9AIN{xa_;<!5@lr0|Id)+ZCY6_&)I8eo^-T}0
zy<q1?JCkUoyR6y@zrNWEZ)}{_9%N=_=3Z3z68saK;Fsl2@Em<9F22Fn;(&+8YDj5@
z$K#da1SKX#mmHUCVxN2$zeL3-(oB*iMHu;Xs_t`_I=);vM3WCi`QH+HQ6#<W`hKOQ
z{EelY65yQ^MfJ%DsNKA3d1@L(HrHBs^T|nY8A0Bjdi%>Z!)JAzo1d8*Z+FjC%_QB-
zJ^pfd_`GUQvCXKqlir`NMI?utf`SJ7e)ih#kkowoI78@7w=qe6{Vv9DbxO-pv=hqF
z(Gh2rOH0#BZH)$(RlgSHf6Gnl@ks09owPK}ANoa3G=_JEJP$qNLK6r}MJ}6e=jU~w
zx81DG9u9>Khhc*wPWv`*;M~r?)elHT%laaAK6r?N74&u#D7)w8<}Mh_>Jhd(Ncdph
zm6Oj-498Am(d~tWH^I10T4Wv&EXmH>5}dO-1Jm;9Q+bgcZ5?OJcAqlekXKmv()L|@
z{smVLk5;1WB~d2Azxp9Xw;Us_!bnLmIbQpZn^VhuH|#HywYbPylrpkNSwxW(DZOx?
zbHaD%oAYo=ih@H?gu%Itb26fYXh`Yl>FMme?#be>Z(`{-Wrc<PRgSBdCk5z9;5hpo
zF-_Nlvtc=ilBog=IE@+gc-(rQibdo#I21>Q=xvH^#0HMA&bP#~Wg^@joY)78Us_t~
zR(*%pI-Rn}Oo9XN>ERJU;$3gHls&hUQR|c6>AH%1C_*1TX)N9f%rB*7EM$lNL$F81
zAcHKzu&_$XoB?Gn;qL*pTdCo2$@`YE%c_MI*C>@0=G6UCUORPsd^{-4*d>0j>kkU}
zvw`Y?bKpR^E4nz%r*~WoS_*>Aae#YZw@0cL-^Gx565e(2c9v?nb|#gaw<-A-&Y~GH
z9v<+R02f{CS#-u=@c>5{`)ti@{auX8OjYxUL%A#s<jMz>_Vr^c9ntk2cI3I+%97O$
zsbiOSJ32Txz;~?uX6>K=Zwo^H3e3_=FGX*tSSchX$eG;Wy@KxZHqNR`9vtx-8doUY
zaHy7sP*RLyvO6zraHA|pwaV0TCzh{dXIsstRm<U^d2xg7Q$^LU1abG+G3)({ZJ*=w
zHNlM>Zerh_8pPHWF{?>WR!jH8$iYtzerkCS_Ted~?!4F7#+=+-_rQvQL(IOb^S@c*
zrw9WVe+bvRl^~8v5GUM#sBow;HFDPjHkfPyxP};mTYBKf;OhW=YGE#uBAZYu>ZD2u
zgQDQ7oaptIrSmopgd?Uj_oGLTrlqC1^Uo-i`NPU`bLu6fB|MjdikB_s9Y{06SFV}W
z8}2BN$zfQvdE6?y6g1_<jZyQsbp<EKS&Naoh}pn=Te5DJ=;c$lTV*$_`mnGAIqh|&
zUT$>r>AEiFXs(w>FW#KN5su1aaf8)=SDgw8-9=8vWFIX^+oz?RFK5ddS<=RY;hbWh
zc70B{c_!L8)=?lYMjOrV_s*c!l?s;PP=C95R%n(mZ>H=NuxT!9T^IQlOl6qjeHfXQ
z{nQ6yf)ATQ@J^5|&e3s$2@oV=t%pcb<s>)}<47}V^~FKUc_*T)mWLEik?6Zls^c4n
zFIo<1?Ai2cv_j7St7jX#fEgZKdsV>ugjwnqg!-`Pd6||Na_?|gSJz0^(E>B>PQo}?
z#!Rf(&U3~)%zW+A+jsBY<+Z07CoH_{NY_!VU9~l<sIGJzPFXwz1Rq+ii*lwSh!+2D
zNx;s9FreDYys)@&1LXu?*2R~>X|<x3-wp6iXUD)2;7~?sG;mP$mz86?M9MDJY$0%o
z&Y^O1BSQa!yYq>+mI-tB#>F^rQB1iD4rZ+Bp5wGM+nsm7IFe?yS(}#n<YeSyGWy!n
zDao{57~0^@X&vMO<h6bgkIM<&VLr!QnWdjWE;H|hv2$AsuGhn(H~W)QRcYK)`1!)Z
zd0}iesl<6db8xM|i8y%KM`w9bDO(Z1?3=G7ETQb}?G0~#OMmipANVf)@j7Od^z$!R
zo2B4XqBx5wy3?0xX=9iBtK?3@54|aE3V*S6haj%;q<Nbcmx5zF9#*EPqKjF2M=Ds-
zHfnhHkJ8{gt|?PiBX>lQH=mDIcx5KP^1AqpG)B7Qj^KA04BNPQGO+#q?isK~!e$~^
zHmq9m-O${>$A*W8OThAUz;npD&+Uxq>x!fK-}0yrj3cSLy@=OuD1s9OjwH><S@NjS
zA>_QJX_dZq3Net+f2Q1z+n(6{l{DAL*f=**ngG$2u5v@|?d_I7wv0vK45j8&)D<~m
zMpJKU*)n?dAPRfsH(gg4&j$aQAEt_`%XMA*x;!bT)(6>a%C52=O{y#PH^}i)MOUBh
zKnNF+W{jiYdAaL-^{m?JeC)`LO`d%sN|dE;7uefK3_F`&E!E-PsHcuyj<%HMb_SYp
zu}EpX5+d|z@)}+dcf)36^vs%B`v{_I0`9xX;2ruA)=D==M@ooSYfSA)^E+KMT03~T
z*NwVg-#lv%DS*nks!kCkF_5mp8}ByMPGNKF<~XA4Yp<8R%fFBnd8l(D+9}7)G@T7=
z<08p(kr>y>N!BysY9)6L6QzW(UzdX`u|sB`tyo-eHJIn<`)33U6#6X7|N7>o<#DkQ
z5ewn9zIO&i4<QrO_b;x;@*xy0!6~ScFS5DezYvce3=L|iM-;(I2xbryAdcF<L}@Q3
zkc#B209j}aOH5pe^joXtlFvVHpQ^gV^vQ~>?X=jU<5|?(P_KT8r0z~~%V8HqKIjNI
zzK$BXeNiY{mXno6cxO4B0E1zMQRF)HgGzKeal0n+?1*V&1-`i$!T`ho(pERpPB+r4
zckg3o30|R%GwSYM+yu~H2@2U#P-K--s_*h~Zf}-xCfjXyq?l9R2BM>i_?6adq3F<4
zz3byt5hi0|>1^43$ic+B;*rs@&t|8pN*+B#e@{11TU;Az&REgLl+xgI`w=x^Aow(6
zBszLwlzve!dB}ZxRc#eMG94vMbzNw45JCFWct`d6tI?L#m7Mu@e3}L_y7LF1SpVic
z|KC!tyRU8B`o&ugdO>C?)~`85xAB|Q*yDN=uamg2%dLWMa`^_hn8p_%5xg^&0@U`<
zRxHjoRaq|*e`o~!AU7Rt(IEK|srvqgu21)Axn%?h+wEPnmOdnP_3vbNj35!sgSZb#
zh*jIxw*G9#HLu=j>`{W?yEP(>zYn>oD!*T~ybR<(MnI9u%)N)JISAqmo_JgHs(2Tb
zMB>gxJC$%GpoBW>JhNw8BKY?<Aqzi&ezS4&UrsU0amI-Tgt2nSTFu)|Mv?L_OwXj4
z4XY#0CZiRHe>tP`FefM8mRb(UsfTw)Dqsf46ZG?pKtY<Q<z`=5Qx(74*;#%BUV~3E
z1PKCq*p2>2{=m!|HAM1!z4^fPN17BD$fL*q6e5r!6>}V_ExTk!YL8MtUVp0-@A8WM
zmqy(SUce5=7i%K&FI9_ls$_XlZ}2e&cErYwY=zT77VakM==h=;0R}UI$oGCAB#qY2
zj$JF_IE0vA+*EE(&(T1fO-D7*v_=S^D|F#C=1Sq<Rpb%-len74x~}0~QK4CFEOq2y
za+1UALmZD!5vOCN=cq}qJ8SIR1UCl6ggCOis#9v`LYX9|ig0@xKy4-OekR!ByRODk
zDl43AT&lW#FQ~MN#ckI>W_|#~M87_RPUaTH3Zj-85X5l1!(~n8HNR+0MAW$orSp7$
zqhMhDb{jomFQzxLB8K&Tt7E3KCDK%SznQ(a<`PDZHo7`2MUcpjRsS~td0Lc5<*Dyc
z{|iT-13|ZmpoTbafhE*)?U#K|&_)&>ChGK<B<DABapp*qq3S@k>JxNb?b2E2yn%h~
zNn0;9LZ;Sk(DAu-WxeauL7%m*uk$}FX2pq$ff-c_j&gR!vy*gCi*tNDAE#WbXUTak
zOU*j*vuoW!v5RMBW;!5SKiB97*(^NT@#Knyk}y1H7*gQFEEZ!t>ggS;KC3qD@pT+k
zMvg+E@KP>`0xlZ@Yrw5Jj~9$oFp#f+u7olV09%4&=4H9B_VOeFoUrU8rj{AhiLa^U
zAXUu!IKoGTg$)<7?gx1H+2E*|{G5jm<0{+RS@k@_zw^Y$*0qA@dIiaHt~*5Y@wsRR
z&^aK`0KZ(<4VHt3!T^+c{hPov`B=Mt(UY$|Lu*`AIksNvemx%iY<&u7@IqGqGTF@d
zT}oQ=k~<4xe?tHGIKMZr-pyc$0|weMHXFC|LBno)`=#>`s#HS!Pn~|NY~+5c9pO(}
zgm#It!>RNt<oin?b$~QgnFu04<xbaGaO$)PY6<R&0X9lpOBo&?kIKiF_5Pvn1$u@V
z^<9oj%>26~(AOUlNN*X|E|tQ!(m?FYz)m5FzeuxJiT#hJTx?El1)V$fk^1bV+r-dq
zh=E-3#swGU5=|+^qZDMUUfJ~EC08v1_q!m~cse>dDqw-PQ^SA$pmjPS$#z+>IP-@m
zOI&D9-M#6yD)WJ?^LG3A1w9_8u8X9hKsAa-aLP-$X{>vliN^kM>*qf*9C!Eya&<Sv
z*xs&DAGH-o?7^lWudL$L_d@Uc26)@1TJ^!aR8$Ux6LalFfo*?^=-psr{>vy9Ud$IQ
zEgDW8&Ei^|_oy-(DjoEQ*kIti*z2i-LSBCXs+Yd}r9&HRdUbG+0HlW=2r%v|JRq6~
zwFH(w3>3#HA@M3-O`we_{+(?e7dh3}gR|K&_t;AS46Dor`T|wrADqwcOS{=A4sHFN
z?^OyY^#{38W}7To1(2k1GK<h;k^3_F?FlQ+C4&6+I;3VhIK5yWXV;7Xtd@z5+lhAl
z7SF?7dpE9H&W7s=<pbpvz0cEEh(8>xu;-%v>2)-hUX5_AYc6dkxq`X+@IzF$3ZYQ0
zR7VmW*UZMG`{A%X`zED#tVaI!ZbUd2b~3kZCE^Q&4P_Wy)4-|G7E09-qeMJr*E$5L
zIq=WxOJ~;`_E+5A)*cA1mpPI^mt)vgOeQ8miRS@ccGUFh&*MH~;^XPkusUT?HRU{^
zh(}421MY5Lg_`Mh3wjpiJdXE1mM|=j8g@Z0CwvmO8?n3KUF&xEm4)G8G&1`5>W&|s
z>o2&((rxDM20qsbbwXxeuULF`fH0<TkWZ!bwZxwvS3}CpZQRz1oV9kZ0}o^oYHEj<
z?H^lwGB8UhF1<SN(vC5p$UoDFI}^^3U*xJKO1~Iw`O(f0DrY>x7WIF95e?$;BTH8;
zEW}0__Y<k5WRMU!ps$8R@BXCuVsMtJ-@1p_FCd8aA%4)TUC`@_+f9x3ghpp-{4k9~
z$p~F0;S$jiN^INJfpJoMc(y#uMe)+uNN--Cfk-}1^{4upt*cn3FDMq@W7hX$NV%yw
z%5vS9OgYPc2NxSU<e~NWB}x(V-Y({qTeT))^lM<IBVWEsfsME(ezI|?GZg9^`0MYe
zIYBrl$Tba<^OwG9be>GaFt9&YJ#LhWu?zD3*2wJpWZiP9woK>qQGQD))6tKlG$0?F
z`a%A_{qBk)5CbZ_-KNigSQ(woEh^lZq=Wc=o%}i^F2t5c<87NXqd%e7J~cG0|8+P}
zs^DE@OjS^3h7+k05pfgEgT>&S!e5$iL<^k|q`^M5_3RsLnu-vNH=e6F7dT65neiAC
znPTcY<9Ys7*_~WI2gm%(RjXH;AQane>`M~0S~g@Z#i$`s-4i!Jx&S6{KYI%lhM|A)
z*;}vyS8$Qa{9m$~`QwFVUXA;naoFoU!;ZetL@r%)JP<ecDL<f~pdfeq2T}}NAA4)A
zw^$LHTOhVx#IF((L{<ti<*5d8uoa?^5tv&j>QnEGl6fauR(>t^1s|^}xsp}L4){fd
z=ntl@>w4GoXB*_3pCu}1lT*mDuaKt4kT$hL`2$oEi0z4(98%*V+OK}jJf6t(si}oJ
zN=X$@4e3vBJ!|Dx;tAMS1<fkC%rT1x+$|c4wqN!N(LBnOf+)Dp8KR`lg~W5QOboj=
zlR7b(iizeswB${E;)9G@i~#nd)yagaRl&0zSxf%`gaw!CMo$(+7O?GWJR&T7l=6Hf
zc}jsH;n~=W-TYvuVTp{$RA7r%Vy~ZIV9Ox$Q86hC0|Nx9pHoQrN{E26`N_%232^QL
zP`q>%5(d6@Dq{ke)g|0~*h7&{six9`)5?F2)sS1XSH#SfFd9$R%&7YsFdH@nYdwxv
z390vjrMU<P=LfJ{@MlLHDi;#4@qv)YxcGR~)QCf2VIg3wnzn7!q}c9gW3s4<C{GQG
z7Z8+ma{J!Fo{jatlKX$tJcaQ}d7Nf>3c?h4Pa@DWW9^hbL7RgC&<2R`s%Og0X-tI_
zOBl}*&5<_sH!qWQVFM{7QX@}PFEVWt07&y2>z()+0D#YBzzg43>Ul!k#{lgF*32&I
zomP>-QU(W-!?Fum4LH5idMt*C<fRvRo~T$%Q!Y}5#k-^RNATid<ukt3T?=8W#qUJ-
z;2>6ot}C!R080?O_7my@KN8F!NCj*`azhLn#LgDo{uKRN#gX@J&+*mk!|j6V#S^IZ
ztKH)m#>=a{{*G2{puC}Y;i1<D0|Z42vjT(<uzRO3kpbk77swNclG8NT@DipA;-?cj
z%gv=wKS@=dW%-YdEtVNe%V2!^2QwvSGkX{Xp+CxizX0vU9WQFVyxYn016%E?_c^|<
zNK{xI75v<#CNUw?NMyJB)nRU|Q>Hx5V!DMAvI=rH7zi4J?Io}7iKtkDOd6njfQQGD
ziayHO1a`=;b)V7P74O^?tYL~$LR3mzhWY2Ce?mzIXo_KS`<}WUJ=i+b?-z+vf#Xae
zmjgTqur+Mn;4{h~`Ipd)fD3*dq9-Gw&fYV&xHpz{F7;ndjzmaPJzvxYH;A2cwz*2G
zypXzgbKrB_e7@n>jzW574q%*9cLxBbLD1FqbvTaYe6yypY?0jF)FSNj36q~@`ENl_
zr=q{Zcm)qOFd{<VShYE*s&_S)g18`FNS)a^Go$JX4{KH?J~UIz3N%%a+paQ0iM147
z@l3xkwpD*0-3C^_EVT88L8jZ$$i8^Oz3csE!gh<_Eh7)%(U&g%oNh4_W`S4Skn$vP
zntHQKkL|i6dp4XnpOqi%bGfj@^P#5IMal(W+<e?BC*SEb7|zTulDeEyVPGECj46vY
zrkRYUhpy`tv2$07b<S*11?_*hwEruvZD${Yzw7jh#gN!g8Uu}cE*UKiDs4eOb%9Zo
z9iHZV8!4&yY_|60K6#qt7$r<QN#dXRVcE6+*lWIh1%eFe{J+xzumW5fUPoPfzt-bR
zS#6)Pa<oi(q(&NE9D&kIh+Twv_pl{fMb1cK{rRjw*1pltOp=QU->g*WVj(Z{H?p?M
zDkOf8ha-;kuEa)%9iq8C9b>RF-{o=+H));@>f>NH`WNrh!fHM4C@)ql?%o)C<?g#@
zu<O6mgkOzn;3s5{|5v#zG)mFPU2y{A{0RJ%5hF8EXCZy0_rH?O<YD~X9xs=t@Qy^`
zy%mdl+?QFOme0OzO(nID&sCOkD!}A9Bh%V0P7X$A-yFv{KZdu>>GR5fYmIk-k}m!)
zlyr&VI$^Id9Q<j2Job~gM?`J0<u>9!71iU9#m@?fM#o^{X{w1!I`&H>V+#ul)*mxv
zRT<60!vpdwLZAT6Ysn)^_QH9?mk>d`kN7?QH2T>OMtzF=z~|ZE-c`B(hi-)a9|`;9
z&PLNUHHom&u_rM^t;Ic-Q)jp-z~{YzGC<YqY2j9WAVpg)j+z`F_g4+~B0d0iq`vYW
z<+pTMR6ficrCQLYt{yD9TC=Soduh70`R91m!2jH_={ju#s``)S)Yv(Ztz5MQAMdch
zIu|wC?|8FK^$DT)6^qEstG>Nuc41+39o17;@!p!or&H>xe&O$wRy2-;lZaHFi;Wxo
z{t<`Eq~Gb%r(EeHvNp@@Vt^owAgRmt)7~^{QakfT<Xry_PYk5g_-c)vu(Z%=YF_;l
zb0FU8@|LPd-K3fo){BT<O~~>KQblJ{w})mvwYokefl0#|k5i^&qF#LSX7x}d&lW9K
z6a~)~ZsPGApN;-TzVyglh}{zFgK0F}-BjuusarRxpenLM4WHTuF)f)qa$sp`Jxjy!
zE-ISzdp);3j4|ZF3=7K)?VY;T^=tTHe34~B0q@%;&6?+>%+rzf7qK2&9A6LYJjE!f
zx0}PQo1tHw6n-_t%HCj@xNV4i?Y*0E<>t-Oi@9nAmS$mBaVfqSuPWzoeBi8FwXbNy
zeCR1(KL!+q{FZnEZhOc`HJ=qfB=VVKD&OxI3K~WSx#)#fEG>CpBaRPW>6d(mVWv$)
zz8cl=9W7593Md-z6?43}(z-Ot9qFJ>SYPNguiW+~p|1%`@;V^@jclY1t8`b3|K{1@
z=^_`nZ_nqi;>-X1`~R@jEfHPFOxy4}P)}v|Ovz_|wZu6BP9T<T9J;Bp^-~{geJxOl
z%BZlbSNlKu2)MTYH;3fcl_Y%H^#zqFl2pe1%-X8WH2HOB@-CIX_)o`B)GtO5-V@7&
z5aUAq@vX_nsz`8E5vjJ9apuHd2Ql`ds)|cvw?k&hkDG1QbWt<{wlGc*1GX@8Sp;nH
zc8XrW&&keqws&#KEoN{4io+xN1>ZNG<HL#-AI3=Dh{eu#e4hH>!rr=qh5{87a8%Vd
zmZ~nF`JsnnqkkOs?#yA!B8h|k^kF>ryI)izZ|ot54kqhP1H^+;1^@x5_kJj!Kq(3$
zrU4Yup{)QcFHF^0kg=<?S%Hris|r(iowufS8(;kI_{B78p`wu3@`&8Su=wp1<^lM)
zV^I+oLGIit+j{eCuhC|jX?lmC^=!A{=Kl$07;dRZ)A=Q3QBRUf7IZm6zO>hu@t)bs
zy+-U3#O;DYl&Z!9Md>uv-E+}#w!lmvU2fIq-1dI9@8Rkb7)@9F??m)}RFeJH%wF@G
zmYCEJ5WzzNoS}IY_3i*%DE|Uq2d)E)&cvcqIyK&1lLX~ThuDfpR#MGv+hQB2OG1q>
z(sX_ax&%=7;YJ_^mD$UDqAE^HjRYP&j5EhE(-$+pD<U3g(u^&>VHFt`mYdc-J{8*-
z4{FXcW8&@N;$j4pGN9`42y(&;SzZ->DRGZvGPaA7FLwTsFlnJqZwxhb?GLfr{b$`Y
zM+Gl{Rl=U=`{Q3&W3~&iNKd9@@VDd-E;pzsEF5U+=G)%}L3*?Qcrg%)O2^%O*z7Rl
zEjj}@ej~66=O3B<PJ7z)F@|6M6WWnzIJ5HeY0m6ZOJUXFzx8@S<EZ3m$DqqguJJg$
zb%nk^I%DE2_;QtZcDC9crgQ7Dvpx5baw|p3t4|>Dt%h8q-grmty<g~jCbYNIwXA>g
zOi6X@Nu8f14(1<@SFrFNIOo@1T;q3tQIMADzbJ^8ih^jqz^5%ajKp$EP!`sVDeb$%
zE0VD}Y=BiCfpVeqp%T=>fTa+7w})}<1SVx4jIwYELhH1?zny_6JI2V;VTaM|oABJr
zP%(l$wx;BE(nx{!-wmkL-eFs*!Bo{#qDCHBJ6Gbc8OGwn_4&<&TJ8XnG5>e}TW2`i
zxqcs@h*1l^KaPsyY@aRG(QH40H?$FA@AojqbZ4)TndHfX;-!L-ecTo`>kpY0=}L!B
zALLg$O1;?&(;VdEBKASF`Sop;m)^`i*120{UYb8M4o>5aV>Hcv=kLcGKJ-hlR7c${
zBrC4)I5oyuWJQj|ftQj`q!f_vINEFC%05Am(f5C`(SM{2e{6NQtONREm)lwrpGj6?
zrTx94%-iV-&OZ5YzMuUnRb1MKNAK#}hn>|(-q+_xt|Lz>LdMgY_A?u%xERuEIlVwq
z-yzz(97KokH*&QxLoaZ4Oj{DZXNtPJ_5oSuC*8qpEl}kvmcn~g{;)x!GsT8##))=M
z+#&Q?o{H$dhq^9tQ>;avU48Cc-(%x8L%+2{Ug7P9e`*C@d8Q|@MsJ}uEchn6Zt@)q
z)pP34CdsesQ1yh6gl;*rF_y8UQAXtwH?gr4uSmX0Z|)#Y@LdV9sG8k*sFqwR74G{S
zU<*NU?FZ?vivF)YD5RFRdeGhcuWnri>T=rnFX}>yzeeZgU1j2j8Sx0R#X2bg2armt
zH7>4#HtH7=+a!uTvvK215})<(F)OEpH6$wMS}<86!ARhc-2lyvOiZn&Ozl=fCMh3_
zE~VqxGqO76$OvOUtxR4+6<zHmmpUrocP@)>xbVc5cS7qiupJgi!uvhODyjOF5bNJ*
z5j9e@QPx!&R8TJuOOe_Aj^hzfO2c-8toLh$qEYpD(Hu>&H=YF>`KP8BKB{F>&u?N;
z6BE*`d&G4_X@ocRHD_pEI{5*-IKNgFdw4v!b~@}oKgQW4IdI&+;z~j!W-rBVyTich
z*x3q$%0EKFuF~aU_2#EB)k?yTVona`a_`B~O?n{hNhi%s(WGy+9$#=7Ic&@6U8M-P
zCVV2b<Ku=I#6dCEI00=JGs19I+>x#{NuHKdBvOKtGlE3Ts^~(a(kmesdZ(r$9Ppp{
z`$8**zCX08RG6nSE2MV4Fk@6rS5fJ{^O`G7dY(HYO$7RNX(tW3+gzak0(!>+z%S^J
z7kSH>D0gDutaMcOxs(%qTobvhufhaCal-`OFUmteM)%otmh2-ZLbp2(n%9haq4kS<
zgJhDtHTm@)(NcSVHRad}9qiI!BypcLG`Cfl7lDX}*07fXr!d@HeM989w=5~lY%G44
zTY6{-RtIUyG2f6n2ijic452wORIDA<5z?V4OSRZgRrY0fRfdT}GS`kGs^by`L)3}z
z1(<SF_Lv%SS?9k;EQhN1vkPYlq3FMf3fKBetL3ZxzCWibV!&4_Cj>rPzW7#eggTO-
zlqZZ>{OpZAe6HGg(GAyK<a5||l=a^AyOdz-KPVP53hyP!U>O}EIh&T75Qxe(c86Zj
zfe_Jo=<QI|tpG^n09RtO+3CCzXc4<vSDJdUp}c2Y2l<sZy<=f+e^HkHIH+B$cLp2y
z0}3ht0Cs{@jZq)V{(cz~G0X(YrK`Sll)_U3KEHs6^(t$8UPS!@$`aM18}hoJp0_MM
z23<JNiDeG~8R9Gz5_bR)Nri=Hf$)n(-4+xVBoW04e7jG}BZsXb6%Z6cd0B8e1}^V@
z2(fSAyiFG5Eaw@`L|co9fCsPEp?k_J40*ss1JbyE=o6s+2SpI{$uuiZsQyEEiz_>M
z1oDB)jeePc8wj;D=2}!T4oPJ6uUh(8#SuO6gchu5n8R66)=?z5pX(9I?@6{C6~Btq
zi5K%zC9{^FivPFt!V6XX8SKkMoha*)Eg8)sL)+*_W?#5kTEyKp5a=CQux-GU8GOZ?
z`Z6+2g8g9*MWO^VQ;n|n3PPs3-e^O?i8sTA^)D=}OHi?h1C2riA-$<g&9gxhB5sv+
z2^xakD@#c3m5rgeqZ#2%?#&#}o?0F5Oq|#%g1<augs}`)Awm#4Qq_w?dLp|_l=2UJ
zR6I&8mv?rhk8%AmBGl)2hZwOH-F4}q@eP@5-O>JMjk1Y?;1+Wf(j-Ke_XGgo$E`l8
zj`BJV=uR9~V4d&TJ+?KUqlUx=7MNWI&>fbcvZ8;r<NfC$?!W7{|5yC$icD!sX!+%*
VukIJXKguA7_8<MG)b;ca{{zy}r~Uu{

literal 0
HcmV?d00001

diff --git a/doc/source/conf.py b/doc/source/conf.py
index 2e17da17f8..bb0357286a 100644
--- a/doc/source/conf.py
+++ b/doc/source/conf.py
@@ -23,14 +23,14 @@
 
 # Add any Sphinx extension module names here, as strings. They can be extensions
 # coming with Sphinx (named 'sphinx.ext.*') or your custom ones.
-extensions = [ 'sphinx.ext.autodoc',
-               'zuul_sphinx',
-               'openstackdocstheme',
-               'sphinxcontrib.blockdiag',
-               'sphinxcontrib.nwdiag' ]
+extensions = [
+    'sphinx.ext.autodoc',
+    'zuul_sphinx',
+    'openstackdocstheme',
+]
 
 # openstackdocstheme options
-openstackdocs_repo_name = 'openstack-dev/devstack'
+openstackdocs_repo_name = 'openstack/devstack'
 openstackdocs_pdf_link = True
 openstackdocs_bug_project = 'devstack'
 openstackdocs_bug_tag = ''
diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index 2c25a1c350..fb36b3ec5b 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -41,19 +41,8 @@ network and is on a shared subnet with other machines.  The
 `local.conf` exhibited here assumes that 1500 is a reasonable MTU to
 use on that network.
 
-.. nwdiag::
-
-        nwdiag {
-                inet [ shape = cloud ];
-                router;
-                inet -- router;
-
-                network hardware_network {
-                        address = "172.18.161.0/24"
-                        router [ address = "172.18.161.1" ];
-                        devstack-1 [ address = "172.18.161.6" ];
-                }
-        }
+.. image:: /assets/images/neutron-network-1.png
+   :alt: Network configuration for a single DevStack node
 
 
 DevStack Configuration
@@ -100,21 +89,8 @@ also want to do multinode testing and networking.
 Physical Network Setup
 ~~~~~~~~~~~~~~~~~~~~~~
 
-.. nwdiag::
-
-        nwdiag {
-                inet [ shape = cloud ];
-                router;
-                inet -- router;
-
-                network hardware_network {
-                        address = "172.18.161.0/24"
-                        router [ address = "172.18.161.1" ];
-                        devstack-1 [ address = "172.18.161.6" ];
-                        devstack-2 [ address = "172.18.161.7" ];
-                }
-        }
-
+.. image:: /assets/images/neutron-network-2.png
+   :alt: Network configuration for multiple DevStack nodes
 
 After DevStack installs and configures Neutron, traffic from guest VMs
 flows out of `devstack-2` (the compute node) and is encapsulated in a
@@ -222,8 +198,6 @@ connect OpenStack nodes (like `devstack-2`) together. This bridge is
 used so that project network traffic, using the VXLAN tunneling
 protocol, flows between each compute node where project instances run.
 
-
-
 DevStack Compute Configuration
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
@@ -268,30 +242,8 @@ to the neutron L3 service.
 Physical Network Setup
 ----------------------
 
-.. nwdiag::
-
-        nwdiag {
-                inet [ shape = cloud ];
-                router;
-                inet -- router;
-
-                network provider_net {
-                        address = "203.0.113.0/24"
-                        router [ address = "203.0.113.1" ];
-                        controller;
-                        compute1;
-                        compute2;
-                }
-
-                network control_plane {
-                        router [ address = "10.0.0.1" ]
-                        address = "10.0.0.0/24"
-                        controller [ address = "10.0.0.2" ]
-                        compute1 [ address = "10.0.0.3" ]
-                        compute2 [ address = "10.0.0.4" ]
-                }
-        }
-
+.. image:: /assets/images/neutron-network-3.png
+   :alt: Network configuration for provider networks
 
 On a compute node, the first interface, eth0 is used for the OpenStack
 management (API, message bus, etc) as well as for ssh for an

From 3362be9edabb7c882ae9948d210a18fadd25ebda Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Thu, 22 Aug 2024 16:24:21 +0100
Subject: [PATCH 2267/2409] docs: Add SSH guide

This is really easy win for people using DevStack for the first time.

Change-Id: I8de2d4d115d34e9d87dd461016b5b894d3f000e7
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
---
 doc/source/index.rst      |  2 ++
 doc/source/networking.rst | 40 ++++++++++++++++++++++++++++++++++++++-
 2 files changed, 41 insertions(+), 1 deletion(-)

diff --git a/doc/source/index.rst b/doc/source/index.rst
index a5a11e251b..70871ef876 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -133,6 +133,8 @@ there.
 You can ``source openrc`` in your shell, and then use the
 ``openstack`` command line tool to manage your devstack.
 
+You can :ref:`create a VM and SSH into it <ssh>`.
+
 You can ``cd /opt/stack/tempest`` and run tempest tests that have
 been configured to work with your devstack.
 
diff --git a/doc/source/networking.rst b/doc/source/networking.rst
index e65c7ef195..f7df4f2e46 100644
--- a/doc/source/networking.rst
+++ b/doc/source/networking.rst
@@ -68,7 +68,7 @@ Shared Guest Interface
 .. warning::
 
    This is not a recommended configuration. Because of interactions
-   between ovs and bridging, if you reboot your box with active
+   between OVS and bridging, if you reboot your box with active
    networking you may lose network connectivity to your system.
 
 If you need your guests accessible on the network, but only have 1
@@ -114,3 +114,41 @@ For IPv6, ``FIXED_RANGE_V6`` will default to the first /64 of the value of
 ``FIXED_RANGE_V6`` will just use the value of that directly.
 ``SUBNETPOOL_PREFIX_V6`` will just default to the value of
 ``IPV6_ADDRS_SAFE_TO_USE`` directly.
+
+.. _ssh:
+
+SSH access to instances
+=======================
+
+To validate connectivity, you can create an instance using the
+``$PRIVATE_NETWORK_NAME`` network (default: ``private``), create a floating IP
+using the ``$PUBLIC_NETWORK_NAME`` network (default: ``public``), and attach
+this floating IP to the instance:
+
+.. code-block:: shell
+
+    openstack keypair create --public-key ~/.ssh/id_rsa.pub test-keypair
+    openstack server create --network private --key-name test-keypair ... test-server
+    fip_id=$(openstack floating ip create public -f value -c id)
+    openstack server add floating ip test-server ${fip_id}
+
+Once done, ensure you have enabled SSH and ICMP (ping) access for the security
+group used for the instance. You can either create a custom security group and
+specify it when creating the instance or add it after creation, or you can
+modify the ``default`` security group created by default for each project.
+Let's do the latter:
+
+.. code-block:: shell
+
+    openstack security group rule create --proto icmp --dst-port 0 default
+    openstack security group rule create --proto tcp --dst-port 22 default
+
+Finally, SSH into the instance. If you used the Cirros instance uploaded by
+default, then you can run the following:
+
+.. code-block:: shell
+
+    openstack server ssh test-server -- -l cirros
+
+This will connect using the ``cirros`` user and the keypair you configured when
+creating the instance.

From 14f60b951aa03ded3779057c7fef28f6c3ee15cc Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Mon, 26 Aug 2024 11:56:31 +0100
Subject: [PATCH 2268/2409] docs: Expand SSH guide

Detail how one can SSH into guests running on a remote DevStack host.

Change-Id: I9f988b1193d67859b129f05d08b32a23e50aee49
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
---
 doc/source/networking.rst | 38 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)

diff --git a/doc/source/networking.rst b/doc/source/networking.rst
index f7df4f2e46..93332f07a5 100644
--- a/doc/source/networking.rst
+++ b/doc/source/networking.rst
@@ -152,3 +152,41 @@ default, then you can run the following:
 
 This will connect using the ``cirros`` user and the keypair you configured when
 creating the instance.
+
+Remote SSH access to instances
+==============================
+
+You can also SSH to created instances on your DevStack host from other hosts.
+This can be helpful if you are e.g. deploying DevStack in a VM on an existing
+cloud and wish to do development on your local machine. To do this, you will
+either need to configure the guest to be `locally accessible <Locally
+Accessible Guests>`__ or you will need to enable tunneling for the floating IP
+address range of the ``$PUBLIC_NETWORK_NAME`` network (default: ``public``)
+defined by ``$FLOATING_RANGE`` (default: ``172.24.4.0/24``). We're going to use
+a useful utility called `shuttle`__ here, but there are many other ways to
+accomplish this.
+
+First, ensure you have allowed SSH and HTTP(S) traffic to your DevStack host.
+Allowing HTTP(S) traffic is necessary so you can use the OpenStack APIs
+remotely. How you do this will depend on where your DevStack host is running.
+
+Once this is done, install ``sshuttle`` on your localhost:
+
+.. code-block:: bash
+
+    sudo apt-get install sshuttle || yum install sshuttle
+
+Finally, start ``sshuttle`` using the floating IP address range. Assuming you
+are using the default value for ``$FLOATING_RANGE``, you can do:
+
+.. code-block:: bash
+
+    sshuttle -r username@devstack-host 172.24.4.0/24
+
+(where ``username`` and ``devstack-host`` are the username and hostname of your
+DevStack host).
+
+You should now be able to create an instance and SSH into it, using the
+instructions provided :ref:`above <ssh>`.
+
+.. __: https://github.com/sshuttle/sshuttle

From 49933804c9d151ce4a220c188ba4301afa0bf98c Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Tue, 27 Aug 2024 12:08:23 +0100
Subject: [PATCH 2269/2409] docs: Expand SSH guide further

smooney noted that using your DevStack host as a jump host is yet
another reasonable option. Add this option also.

Change-Id: I24887c254e131a8979653a7d17e64a708acf294a
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
---
 doc/source/networking.rst | 76 +++++++++++++++++++++++++++++++--------
 1 file changed, 61 insertions(+), 15 deletions(-)

diff --git a/doc/source/networking.rst b/doc/source/networking.rst
index 93332f07a5..05b4f34164 100644
--- a/doc/source/networking.rst
+++ b/doc/source/networking.rst
@@ -158,26 +158,66 @@ Remote SSH access to instances
 
 You can also SSH to created instances on your DevStack host from other hosts.
 This can be helpful if you are e.g. deploying DevStack in a VM on an existing
-cloud and wish to do development on your local machine. To do this, you will
-either need to configure the guest to be `locally accessible <Locally
-Accessible Guests>`__ or you will need to enable tunneling for the floating IP
-address range of the ``$PUBLIC_NETWORK_NAME`` network (default: ``public``)
-defined by ``$FLOATING_RANGE`` (default: ``172.24.4.0/24``). We're going to use
-a useful utility called `shuttle`__ here, but there are many other ways to
-accomplish this.
+cloud and wish to do development on your local machine. There are a few ways to
+do this.
+
+.. rubric:: Configure instances to be locally accessible
+
+The most obvious way is to configure guests to be locally accessible, as
+described `above <Locally Accessible Guests>`__. This has the advantage of
+requiring no further effort on the client. However, it is more involved and
+requires either support from your cloud or some inadvisable workarounds.
+
+.. rubric:: Use your DevStack host as a jump host
+
+You can choose to use your DevStack host as a jump host. To SSH to a instance
+this way, pass the standard ``-J`` option to the ``openstack ssh`` / ``ssh``
+command. For example:
+
+.. code-block::
+
+    openstack server ssh test-server -- -l cirros -J username@devstack-host
+
+(where ``test-server`` is name of an existing instance, as described
+:ref:`previously <ssh>`, and ``username`` and ``devstack-host`` are the
+username and hostname of your DevStack host).
+
+This can also be configured via your ``~/.ssh/config`` file, making it rather
+effortless. However, it only allows SSH access. If you want to access e.g. a
+web application on the instance, you will need to configure an SSH tunnel and
+forward select ports using the ``-L`` option. For example, to forward HTTP
+traffic:
+
+.. code-block::
 
-First, ensure you have allowed SSH and HTTP(S) traffic to your DevStack host.
-Allowing HTTP(S) traffic is necessary so you can use the OpenStack APIs
-remotely. How you do this will depend on where your DevStack host is running.
+    openstack server ssh test-server -- -l cirros -L 8080:username@devstack-host:80
 
-Once this is done, install ``sshuttle`` on your localhost:
+(where ``test-server`` is name of an existing instance, as described
+:ref:`previously <ssh>`, and ``username`` and ``devstack-host`` are the
+username and hostname of your DevStack host).
+
+As you can imagine, this can quickly get out of hand, particularly for more
+complex guest applications with multiple ports.
+
+.. rubric:: Use a proxy or VPN tool
+
+You can use a proxy or VPN tool to enable tunneling for the floating IP
+address range of the ``$PUBLIC_NETWORK_NAME`` network (default: ``public``)
+defined by ``$FLOATING_RANGE`` (default: ``172.24.4.0/24``). There are many
+such tools available to do this. For example, we could use a useful utility
+called `shuttle`__. To enable tunneling using ``shuttle``, first ensure you
+have allowed SSH and HTTP(S) traffic to your DevStack host. Allowing HTTP(S)
+traffic is necessary so you can use the OpenStack APIs remotely. How you do
+this will depend on where your DevStack host is running. Once this is done,
+install ``sshuttle`` on your localhost:
 
 .. code-block:: bash
 
     sudo apt-get install sshuttle || yum install sshuttle
 
-Finally, start ``sshuttle`` using the floating IP address range. Assuming you
-are using the default value for ``$FLOATING_RANGE``, you can do:
+Finally, start ``sshuttle`` on your localhost using the floating IP address
+range. For example, assuming you are using the default value for
+``$FLOATING_RANGE``, you can do:
 
 .. code-block:: bash
 
@@ -186,7 +226,13 @@ are using the default value for ``$FLOATING_RANGE``, you can do:
 (where ``username`` and ``devstack-host`` are the username and hostname of your
 DevStack host).
 
-You should now be able to create an instance and SSH into it, using the
-instructions provided :ref:`above <ssh>`.
+You should now be able to create an instance and SSH into it:
+
+.. code-block:: bash
+
+    openstack server ssh test-server -- -l cirros
+
+(where ``test-server`` is name of an existing instance, as described
+:ref:`previously <ssh>`)
 
 .. __: https://github.com/sshuttle/sshuttle

From 6a8f65b476883d5cccffbcad8650894850033231 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Wed, 21 Aug 2024 15:57:32 +0100
Subject: [PATCH 2270/2409] lib/swift: Consistently quota variables

Change-Id: I6c3245a77cdc2849067568cfda5a838afda687e3
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
---
 lib/swift | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/lib/swift b/lib/swift
index 1ebf073318..3659624d5b 100644
--- a/lib/swift
+++ b/lib/swift
@@ -844,14 +844,14 @@ function stop_swift {
 
 function swift_configure_tempurls {
     # note we are using swift credentials!
-    openstack --os-cloud "" \
-        --os-region-name $REGION_NAME \
-        --os-auth-url $KEYSTONE_SERVICE_URI \
-        --os-username=swift \
-        --os-password=$SERVICE_PASSWORD \
-        --os-user-domain-name=$SERVICE_DOMAIN_NAME \
-        --os-project-name=$SERVICE_PROJECT_NAME \
-        --os-project-domain-name=$SERVICE_DOMAIN_NAME \
+    openstack --os-cloud="" \
+        --os-region-name="$REGION_NAME" \
+        --os-auth-url="$KEYSTONE_SERVICE_URI" \
+        --os-username="swift" \
+        --os-password="$SERVICE_PASSWORD" \
+        --os-user-domain-name="$SERVICE_DOMAIN_NAME" \
+        --os-project-name="$SERVICE_PROJECT_NAME" \
+        --os-project-domain-name="$SERVICE_DOMAIN_NAME" \
         object store account \
         set --property "Temp-URL-Key=$SWIFT_TEMPURL_KEY"
 }

From 31980e436b73db18297a295969069cf00bd43754 Mon Sep 17 00:00:00 2001
From: Jan Hartkopf <jhartkopf@inovex.de>
Date: Mon, 10 Oct 2022 10:40:38 +0200
Subject: [PATCH 2271/2409] Configure option backup_ceph_max_snapshots in
 Cinder backup

Sets the config option backup_ceph_max_snapshots for the Cinder
Ceph backup driver to the specified value.

Depends-On: https://review.opendev.org/c/openstack/cinder/+/810457
Signed-off-by: Jan Hartkopf <jhartkopf@inovex.de>
Change-Id: I9e12e395288db1fe59490b4075bb2d933ccd4d78
---
 lib/cinder_backups/ceph | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/cinder_backups/ceph b/lib/cinder_backups/ceph
index 4b180490d7..ea9b44fe8c 100644
--- a/lib/cinder_backups/ceph
+++ b/lib/cinder_backups/ceph
@@ -19,6 +19,7 @@ set +o xtrace
 # Defaults
 # --------
 
+CINDER_BAK_CEPH_MAX_SNAPSHOTS=${CINDER_BAK_CEPH_MAX_SNAPSHOTS:-0}
 CINDER_BAK_CEPH_POOL=${CINDER_BAK_CEPH_POOL:-backups}
 CINDER_BAK_CEPH_POOL_PG=${CINDER_BAK_CEPH_POOL_PG:-8}
 CINDER_BAK_CEPH_POOL_PGP=${CINDER_BAK_CEPH_POOL_PGP:-8}
@@ -38,6 +39,7 @@ function configure_cinder_backup_ceph {
 
     iniset $CINDER_CONF DEFAULT backup_driver "cinder.backup.drivers.ceph.CephBackupDriver"
     iniset $CINDER_CONF DEFAULT backup_ceph_conf "$CEPH_CONF_FILE"
+    iniset $CINDER_CONF DEFAULT backup_ceph_max_snapshots "$CINDER_BAK_CEPH_MAX_SNAPSHOTS"
     iniset $CINDER_CONF DEFAULT backup_ceph_pool "$CINDER_BAK_CEPH_POOL"
     iniset $CINDER_CONF DEFAULT backup_ceph_user "$CINDER_BAK_CEPH_USER"
     iniset $CINDER_CONF DEFAULT backup_ceph_stripe_unit 0

From f49d475bf2e186ef3d7800e2bb55c9c360e7ac95 Mon Sep 17 00:00:00 2001
From: Rodolfo Alonso Hernandez <ralonsoh@redhat.com>
Date: Wed, 2 Oct 2024 09:36:55 +0000
Subject: [PATCH 2272/2409] Catch and print the postgresql initdb error

The logs are stored, by default, in
/var/lib/pgsql/initdb_postgresql.log.

Related-Bug: #2083482
Change-Id: I2c83e896819b20cd7a1ee8d8ee33354fb047a6d9
---
 lib/databases/postgresql | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lib/databases/postgresql b/lib/databases/postgresql
index b21418b75e..2aa38ccf76 100644
--- a/lib/databases/postgresql
+++ b/lib/databases/postgresql
@@ -46,6 +46,10 @@ function recreate_database_postgresql {
     createdb -h $DATABASE_HOST -U$DATABASE_USER -l C -T template0 -E utf8 $db
 }
 
+function _exit_pg_init {
+    sudo cat /var/lib/pgsql/initdb_postgresql.log
+}
+
 function configure_database_postgresql {
     local pg_conf pg_dir pg_hba check_role version
     echo_summary "Configuring and starting PostgreSQL"
@@ -53,7 +57,9 @@ function configure_database_postgresql {
         pg_hba=/var/lib/pgsql/data/pg_hba.conf
         pg_conf=/var/lib/pgsql/data/postgresql.conf
         if ! sudo [ -e $pg_hba ]; then
+            trap _exit_pg_init EXIT
             sudo postgresql-setup initdb
+            trap - EXIT
         fi
     elif is_ubuntu; then
         version=`psql --version | cut -d ' ' -f3 | cut -d. -f1-2`

From 803a7d44c49f6adbfa878ee520756869df1ffe8a Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Tue, 1 Oct 2024 07:42:34 -0700
Subject: [PATCH 2273/2409] Add image format enforcement toggle

Related to blueprint glance-as-defender

Needed-By: https://review.opendev.org/c/openstack/tempest/+/931028
Change-Id: I8b22ed85eefde399f2e472780106dd39e51a5700
---
 lib/glance  | 4 ++++
 lib/tempest | 1 +
 2 files changed, 5 insertions(+)

diff --git a/lib/glance b/lib/glance
index 274687112e..2eb4954f4a 100644
--- a/lib/glance
+++ b/lib/glance
@@ -104,6 +104,9 @@ GLANCE_ENABLE_QUOTAS=$(trueorfalse True GLANCE_ENABLE_QUOTAS)
 # For more detail: https://docs.openstack.org/oslo.policy/latest/configuration/index.html#oslo_policy.enforce_scope
 GLANCE_ENFORCE_SCOPE=$(trueorfalse True GLANCE_ENFORCE_SCOPE)
 
+# Flag to disable image format inspection on upload
+GLANCE_ENFORCE_IMAGE_FORMAT=$(trueorfalse True GLANCE_ENFORCE_IMAGE_FORMAT)
+
 GLANCE_CONF_DIR=${GLANCE_CONF_DIR:-/etc/glance}
 GLANCE_METADEF_DIR=$GLANCE_CONF_DIR/metadefs
 GLANCE_API_CONF=$GLANCE_CONF_DIR/glance-api.conf
@@ -343,6 +346,7 @@ function configure_glance {
     # Only use these if you know what you are doing!  See OSSN-0065
     iniset $GLANCE_API_CONF DEFAULT show_image_direct_url $GLANCE_SHOW_DIRECT_URL
     iniset $GLANCE_API_CONF DEFAULT show_multiple_locations $GLANCE_SHOW_MULTIPLE_LOCATIONS
+    iniset $GLANCE_API_CONF image_format require_image_format_match $GLANCE_ENFORCE_IMAGE_FORMAT
 
     # Configure glance_store
     configure_glance_store $USE_CINDER_FOR_GLANCE $GLANCE_ENABLE_MULTIPLE_STORES
diff --git a/lib/tempest b/lib/tempest
index 310db2daa6..eeeef67a8b 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -368,6 +368,7 @@ function configure_tempest {
         if [[ -n "$image_conversion" ]]; then
             iniset $TEMPEST_CONFIG image-feature-enabled image_conversion True
         fi
+        iniset $TEMPEST_CONFIG image-feature-enabled image_format_enforcement $GLANCE_ENFORCE_IMAGE_FORMAT
     fi
 
     iniset $TEMPEST_CONFIG network project_network_cidr $FIXED_RANGE

From 9f9dccd608d5415e0de988a2aa0e74d049038e2a Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Mon, 7 Oct 2024 11:57:58 -0700
Subject: [PATCH 2274/2409] Switch devstack nodeset to Ubuntu 24.04 (Noble)

Ref: https://governance.openstack.org/tc/goals/selected/migrate-ci-jobs-to-ubuntu-noble.html
Change-Id: I7ac8f9443c386e56c4ca45a171e104f0b350bc7f
---
 .zuul.yaml | 36 ++++++++++++++++++------------------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index a1c251a398..6a6b686ac1 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -439,7 +439,7 @@
     description: |
       Minimal devstack base job, intended for use by jobs that need
       less than the normal minimum set of required-projects.
-    nodeset: openstack-single-node-jammy
+    nodeset: openstack-single-node-noble
     required-projects:
       - opendev.org/openstack/requirements
     vars:
@@ -686,7 +686,7 @@
 - job:
     name: devstack-multinode
     parent: devstack
-    nodeset: openstack-two-node-jammy
+    nodeset: openstack-two-node-noble
     description: |
       Simple multinode test to verify multinode functionality on devstack side.
       This is not meant to be used as a parent job.
@@ -727,18 +727,18 @@
       configure_swap_size: 4096
 
 - job:
-    name: devstack-platform-ubuntu-noble
+    name: devstack-platform-ubuntu-jammy
     parent: tempest-full-py3
-    description: Ubuntu 24.04 LTS (noble) platform test
-    nodeset: openstack-single-node-noble
+    description: Ubuntu 22.04 LTS (Jammy) platform test
+    nodeset: openstack-single-node-jammy
     timeout: 9000
     vars:
       configure_swap_size: 8192
 
 - job:
-    name: devstack-platform-ubuntu-jammy-ovn-source
-    parent: devstack-platform-ubuntu-jammy
-    description: Ubuntu 22.04 LTS (jammy) platform test (OVN from source)
+    name: devstack-platform-ubuntu-noble-ovn-source
+    parent: devstack-platform-ubuntu-noble
+    description: Ubuntu 24.04 LTS (noble) platform test (OVN from source)
     voting: false
     vars:
       devstack_localrc:
@@ -748,10 +748,10 @@
         OVS_SYSCONFDIR: "/usr/local/etc/openvswitch"
 
 - job:
-    name: devstack-platform-ubuntu-jammy-ovs
+    name: devstack-platform-ubuntu-noble-ovs
     parent: tempest-full-py3
-    description: Ubuntu 22.04 LTS (jammy) platform test (OVS)
-    nodeset: openstack-single-node-jammy
+    description: Ubuntu 24.04 LTS (noble) platform test (OVS)
+    nodeset: openstack-single-node-noble
     voting: false
     timeout: 9000
     vars:
@@ -853,7 +853,7 @@
 
 - job:
     name: devstack-unit-tests
-    nodeset: ubuntu-jammy
+    nodeset: ubuntu-noble
     description: |
       Runs unit tests on devstack project.
 
@@ -873,9 +873,9 @@
         - devstack-platform-centos-9-stream
         - devstack-platform-debian-bookworm
         - devstack-platform-rocky-blue-onyx
-        - devstack-platform-ubuntu-jammy-ovn-source
-        - devstack-platform-ubuntu-jammy-ovs
-        - devstack-platform-ubuntu-noble
+        - devstack-platform-ubuntu-noble-ovn-source
+        - devstack-platform-ubuntu-noble-ovs
+        - devstack-platform-ubuntu-jammy
         - devstack-multinode
         - devstack-unit-tests
         - openstack-tox-bashate
@@ -1002,6 +1002,6 @@
         - devstack-platform-centos-9-stream
         - devstack-platform-debian-bookworm
         - devstack-platform-rocky-blue-onyx
-        - devstack-platform-ubuntu-jammy-ovn-source
-        - devstack-platform-ubuntu-jammy-ovs
-        - devstack-platform-ubuntu-noble
+        - devstack-platform-ubuntu-noble-ovn-source
+        - devstack-platform-ubuntu-noble-ovs
+        - devstack-platform-ubuntu-jammy

From e8e3eb6dc9353a9df663bfdbb6448bb001ba6ee4 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Fri, 11 Oct 2024 15:20:17 +0100
Subject: [PATCH 2275/2409] doc: Update WSGI section

Change-Id: Iaefe12e7fdeddb0fb6fe272cd4df3ce46470cc28
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
---
 doc/source/configuration.rst | 28 +++++++++++-----------------
 stackrc                      |  2 +-
 2 files changed, 12 insertions(+), 18 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index a83b2de0df..f5f30c4d09 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -351,26 +351,21 @@ Example disabling RabbitMQ in ``local.conf``::
 
   disable_service rabbit
 
-
 Apache Frontend
 ---------------
 
-The Apache web server can be enabled for wsgi services that support
-being deployed under HTTPD + mod_wsgi. By default, services that
-recommend running under HTTPD + mod_wsgi are deployed under Apache. To
-use an alternative deployment strategy (e.g. eventlet) for services
-that support an alternative to HTTPD + mod_wsgi set
-``ENABLE_HTTPD_MOD_WSGI_SERVICES`` to ``False`` in your
-``local.conf``.
-
-Each service that can be run under HTTPD + mod_wsgi also has an
-override toggle available that can be set in your ``local.conf``.
-
-Keystone is run under Apache with ``mod_wsgi`` by default.
+The Apache web server is enabled for services that support via WSGI. Today this
+means HTTPD and uWSGI but historically this meant HTTPD + mod_wsgi. This
+historical legacy is captured by the naming of many variables, which include
+``MOD_WSGI`` rather than ``UWSGI``.
 
-Example (Keystone)::
-
-    KEYSTONE_USE_MOD_WSGI="True"
+Some services support alternative deployment strategies (e.g. eventlet). You
+can enable these ``ENABLE_HTTPD_MOD_WSGI_SERVICES`` to ``False`` in your
+``local.conf``.  In addition, each service that can be run under HTTPD +
+mod_wsgi also has an override toggle available that can be set in your
+``local.conf``. These are, however, slowly being removed as services have
+adopted standardized deployment mechanisms and more generally moved away from
+eventlet.
 
 Example (Nova)::
 
@@ -388,7 +383,6 @@ Example (Cinder)::
 
     CINDER_USE_MOD_WSGI="True"
 
-
 Libraries from Git
 ------------------
 
diff --git a/stackrc b/stackrc
index ab1f8a6ffd..33c18ce0a8 100644
--- a/stackrc
+++ b/stackrc
@@ -85,7 +85,7 @@ fi
 # Global toggle for enabling services under mod_wsgi. If this is set to
 # ``True`` all services that use HTTPD + mod_wsgi as the preferred method of
 # deployment, will be deployed under Apache. If this is set to ``False`` all
-# services will rely on the local toggle variable (e.g. ``KEYSTONE_USE_MOD_WSGI``)
+# services will rely on the local toggle variable.
 ENABLE_HTTPD_MOD_WSGI_SERVICES=True
 
 # Set the default Nova APIs to enable

From 851d82ccca40d61cbfd2319c38e0128bdaea247e Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Fri, 11 Oct 2024 15:37:57 +0100
Subject: [PATCH 2276/2409] stackrc: Die if attempting to use mod_wsgi

We do not want to support this anymore.

Change-Id: I8823e98809ed6b66c27dbcf21a00eea68ef403e8
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
---
 stackrc | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/stackrc b/stackrc
index 33c18ce0a8..c5a0fd4d2f 100644
--- a/stackrc
+++ b/stackrc
@@ -223,6 +223,9 @@ GIT_TIMEOUT=${GIT_TIMEOUT:-0}
 # proxy uwsgi in front of it, or "mod_wsgi", which runs in
 # apache. mod_wsgi is deprecated, don't use it.
 WSGI_MODE=${WSGI_MODE:-"uwsgi"}
+if [[ "$WSGI_MODE" != "uwsgi" ]]; then
+    die $LINENO "$WSGI_MODE is no longer a supported WSGI mode. Only uwsgi is valid."
+fi
 
 # Repositories
 # ------------

From dda40363e6a78b5f3f018a962e5dff14e2c12cd9 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Fri, 11 Oct 2024 15:20:01 +0100
Subject: [PATCH 2277/2409] lib/nova: Remove NOVA_USE_MOD_WSGI

We are in the process of migrating away from Eventlet. Nothing
is setting this to a non-default value, meaning there is no
reason to keep it around any more. Drop it.

Change-Id: I036851810360539335502481955769b2308e3dcc
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
---
 doc/source/configuration.rst |  4 ----
 lib/nova                     | 38 ++++--------------------------------
 2 files changed, 4 insertions(+), 38 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index f5f30c4d09..6b8a80563d 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -367,10 +367,6 @@ mod_wsgi also has an override toggle available that can be set in your
 adopted standardized deployment mechanisms and more generally moved away from
 eventlet.
 
-Example (Nova)::
-
-    NOVA_USE_MOD_WSGI="True"
-
 Example (Swift)::
 
     SWIFT_USE_MOD_WSGI="True"
diff --git a/lib/nova b/lib/nova
index 35c6893763..20e19da9a4 100644
--- a/lib/nova
+++ b/lib/nova
@@ -75,14 +75,6 @@ NOVA_CPU_CELL=${NOVA_CPU_CELL:-1}
 
 NOVA_API_PASTE_INI=${NOVA_API_PASTE_INI:-$NOVA_CONF_DIR/api-paste.ini}
 
-# Toggle for deploying Nova-API under a wsgi server. We default to
-# true to use UWSGI, but allow False so that fall back to the
-# eventlet server can happen for grenade runs.
-# NOTE(cdent): We can adjust to remove the eventlet-base api service
-# after pike, at which time we can stop using NOVA_USE_MOD_WSGI to
-# mean "use uwsgi" because we'll be always using uwsgi.
-NOVA_USE_MOD_WSGI=${NOVA_USE_MOD_WSGI:-True}
-
 # We do not need to report service status every 10s for devstack-like
 # deployments. In the gate this generates extra work for the services and the
 # database which are already taxed.
@@ -393,11 +385,7 @@ function create_nova_accounts {
         create_service_user "nova" "admin"
 
         local nova_api_url
-        if [[ "$NOVA_USE_MOD_WSGI" == "False" ]]; then
-            nova_api_url="$NOVA_SERVICE_PROTOCOL://$NOVA_SERVICE_HOST:$NOVA_SERVICE_PORT"
-        else
-            nova_api_url="$NOVA_SERVICE_PROTOCOL://$NOVA_SERVICE_HOST/compute"
-        fi
+        nova_api_url="$NOVA_SERVICE_PROTOCOL://$NOVA_SERVICE_HOST/compute"
 
         get_or_create_service "nova_legacy" "compute_legacy" "Nova Compute Service (Legacy 2.0)"
         get_or_create_endpoint \
@@ -513,11 +501,6 @@ function create_nova_conf {
             iniset $NOVA_CONF oslo_policy enforce_new_defaults False
             iniset $NOVA_CONF oslo_policy enforce_scope False
         fi
-        if is_service_enabled tls-proxy && [ "$NOVA_USE_MOD_WSGI" == "False" ]; then
-            # Set the service port for a proxy to take the original
-            iniset $NOVA_CONF DEFAULT osapi_compute_listen_port "$NOVA_SERVICE_PORT_INT"
-            iniset $NOVA_CONF DEFAULT osapi_compute_link_prefix $NOVA_SERVICE_PROTOCOL://$NOVA_SERVICE_HOST:$NOVA_SERVICE_PORT
-        fi
 
         configure_keystone_authtoken_middleware $NOVA_CONF nova
     fi
@@ -998,17 +981,8 @@ function start_nova_api {
     local old_path=$PATH
     export PATH=$NOVA_BIN_DIR:$PATH
 
-    if [ "$NOVA_USE_MOD_WSGI" == "False" ]; then
-        run_process n-api "$NOVA_BIN_DIR/nova-api"
-        nova_url=$service_protocol://$SERVICE_HOST:$service_port
-        # Start proxy if tsl enabled
-        if is_service_enabled tls-proxy; then
-            start_tls_proxy nova '*' $NOVA_SERVICE_PORT $NOVA_SERVICE_HOST $NOVA_SERVICE_PORT_INT
-        fi
-    else
-        run_process "n-api" "$(which uwsgi) --procname-prefix nova-api --ini $NOVA_UWSGI_CONF"
-        nova_url=$service_protocol://$SERVICE_HOST/compute/v2.1/
-    fi
+    run_process "n-api" "$(which uwsgi) --procname-prefix nova-api --ini $NOVA_UWSGI_CONF"
+    nova_url=$service_protocol://$SERVICE_HOST/compute/v2.1/
 
     echo "Waiting for nova-api to start..."
     if ! wait_for_service $SERVICE_TIMEOUT $nova_url; then
@@ -1114,11 +1088,7 @@ function start_nova_rest {
     local compute_cell_conf=$NOVA_CONF
 
     run_process n-sch "$NOVA_BIN_DIR/nova-scheduler --config-file $compute_cell_conf"
-    if [ "$NOVA_USE_MOD_WSGI" == "False" ]; then
-        run_process n-api-meta "$NOVA_BIN_DIR/nova-api-metadata --config-file $compute_cell_conf"
-    else
-        run_process n-api-meta "$(which uwsgi) --procname-prefix nova-api-meta --ini $NOVA_METADATA_UWSGI_CONF"
-    fi
+    run_process n-api-meta "$(which uwsgi) --procname-prefix nova-api-meta --ini $NOVA_METADATA_UWSGI_CONF"
 
     export PATH=$old_path
 }

From 7e8d5efdf2e0d1ff784e8aee2838e4bc7942856e Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Fri, 11 Oct 2024 15:34:18 +0100
Subject: [PATCH 2278/2409] lib/cinder: Remove CINDER_USE_MOD_WSGI

Like Nova, nothing is setting this to False nowadays so there's no
reason to persist with it.

Change-Id: I0e1550992dde81c601175ef04da771ce8ca1dd29
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
---
 doc/source/configuration.rst |  4 ----
 lib/cinder                   | 39 ++++++------------------------------
 2 files changed, 6 insertions(+), 37 deletions(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 6b8a80563d..9a1fd4e179 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -375,10 +375,6 @@ Example (Heat)::
 
     HEAT_USE_MOD_WSGI="True"
 
-Example (Cinder)::
-
-    CINDER_USE_MOD_WSGI="True"
-
 Libraries from Git
 ------------------
 
diff --git a/lib/cinder b/lib/cinder
index dc284920e0..259018e7ab 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -160,10 +160,6 @@ fi
 # Supported backup drivers are in lib/cinder_backups
 CINDER_BACKUP_DRIVER=${CINDER_BACKUP_DRIVER:-swift}
 
-# Toggle for deploying Cinder under a wsgi server. Legacy mod_wsgi
-# reference should be cleaned up to more accurately refer to uwsgi.
-CINDER_USE_MOD_WSGI=${CINDER_USE_MOD_WSGI:-True}
-
 # Source the enabled backends
 if is_service_enabled c-vol && [[ -n "$CINDER_ENABLED_BACKENDS" ]]; then
     for be in ${CINDER_ENABLED_BACKENDS//,/ }; do
@@ -393,14 +389,8 @@ function configure_cinder {
     if is_service_enabled tls-proxy; then
         if [[ "$ENABLED_SERVICES" =~ "c-api" ]]; then
             # Set the service port for a proxy to take the original
-            if [ "$CINDER_USE_MOD_WSGI" == "True" ]; then
-                iniset $CINDER_CONF DEFAULT osapi_volume_listen_port $CINDER_SERVICE_PORT_INT
-                iniset $CINDER_CONF oslo_middleware enable_proxy_headers_parsing True
-            else
-                iniset $CINDER_CONF DEFAULT osapi_volume_listen_port $CINDER_SERVICE_PORT_INT
-                iniset $CINDER_CONF DEFAULT public_endpoint $CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT
-                iniset $CINDER_CONF DEFAULT osapi_volume_base_URL $CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT
-            fi
+            iniset $CINDER_CONF DEFAULT osapi_volume_listen_port $CINDER_SERVICE_PORT_INT
+            iniset $CINDER_CONF oslo_middleware enable_proxy_headers_parsing True
         fi
     fi
 
@@ -411,7 +401,7 @@ function configure_cinder {
     iniset_rpc_backend cinder $CINDER_CONF
 
     # Format logging
-    setup_logging $CINDER_CONF $CINDER_USE_MOD_WSGI
+    setup_logging $CINDER_CONF
 
     if is_service_enabled c-api; then
         write_uwsgi_config "$CINDER_UWSGI_CONF" "$CINDER_UWSGI" "/volume"
@@ -477,11 +467,7 @@ function create_cinder_accounts {
         create_service_user "cinder" $extra_role
 
         local cinder_api_url
-        if [[ "$CINDER_USE_MOD_WSGI" == "False" ]]; then
-            cinder_api_url="$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT"
-        else
-            cinder_api_url="$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST/volume"
-        fi
+        cinder_api_url="$CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST/volume"
 
         # block-storage is the official service type
         get_or_create_service "cinder" "block-storage" "Cinder Volume Service"
@@ -609,10 +595,6 @@ function start_cinder {
     local service_port=$CINDER_SERVICE_PORT
     local service_protocol=$CINDER_SERVICE_PROTOCOL
     local cinder_url
-    if is_service_enabled tls-proxy && [ "$CINDER_USE_MOD_WSGI" == "False" ]; then
-        service_port=$CINDER_SERVICE_PORT_INT
-        service_protocol="http"
-    fi
     if [ "$CINDER_TARGET_HELPER" = "tgtadm" ]; then
         if is_service_enabled c-vol; then
             # Delete any old stack.conf
@@ -629,17 +611,8 @@ function start_cinder {
     fi
 
     if [[ "$ENABLED_SERVICES" =~ "c-api" ]]; then
-        if [ "$CINDER_USE_MOD_WSGI" == "False" ]; then
-            run_process c-api "$CINDER_BIN_DIR/cinder-api --config-file $CINDER_CONF"
-            cinder_url=$service_protocol://$SERVICE_HOST:$service_port
-            # Start proxy if tls enabled
-            if is_service_enabled tls-proxy; then
-                start_tls_proxy cinder '*' $CINDER_SERVICE_PORT $CINDER_SERVICE_HOST $CINDER_SERVICE_PORT_INT
-            fi
-        else
-            run_process "c-api" "$(which uwsgi) --procname-prefix cinder-api --ini $CINDER_UWSGI_CONF"
-            cinder_url=$service_protocol://$SERVICE_HOST/volume/v3
-        fi
+        run_process "c-api" "$(which uwsgi) --procname-prefix cinder-api --ini $CINDER_UWSGI_CONF"
+        cinder_url=$service_protocol://$SERVICE_HOST/volume/v3
     fi
 
     echo "Waiting for Cinder API to start..."

From e1465f1d73ad146c820d047932af1410dbc18675 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Fri, 11 Oct 2024 15:38:42 +0100
Subject: [PATCH 2279/2409] lib/placement: Remove support for deploying with
 mod_wsgi

Change-Id: If17deabc35d35dca1d94b0d15d258769f347b130
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
---
 files/apache-placement-api.template | 27 -----------------
 lib/placement                       | 47 ++---------------------------
 2 files changed, 3 insertions(+), 71 deletions(-)
 delete mode 100644 files/apache-placement-api.template

diff --git a/files/apache-placement-api.template b/files/apache-placement-api.template
deleted file mode 100644
index 011abb95fc..0000000000
--- a/files/apache-placement-api.template
+++ /dev/null
@@ -1,27 +0,0 @@
-# NOTE(sbauza): This virtualhost is only here because some directives can
-# only be set by a virtualhost or server context, so that's why the port is not bound.
-# TODO(sbauza): Find a better way to identify a free port that is not corresponding to an existing
-# vhost.
-<VirtualHost *:8780>
-    WSGIDaemonProcess placement-api processes=%APIWORKERS% threads=1 user=%USER% display-name=%{GROUP} %VIRTUALENV%
-    WSGIProcessGroup placement-api
-    WSGIScriptAlias / %PUBLICWSGI%
-    WSGIApplicationGroup %{GLOBAL}
-    WSGIPassAuthorization On
-    <IfVersion >= 2.4>
-      ErrorLogFormat "%M"
-    </IfVersion>
-    ErrorLog /var/log/%APACHE_NAME%/placement-api.log
-    %SSLENGINE%
-    %SSLCERTFILE%
-    %SSLKEYFILE%
-</VirtualHost>
-
-Alias /placement %PUBLICWSGI%
-<Location /placement>
-    SetHandler wsgi-script
-    Options +ExecCGI
-    WSGIProcessGroup placement-api
-    WSGIApplicationGroup %{GLOBAL}
-    WSGIPassAuthorization On
-</Location>
diff --git a/lib/placement b/lib/placement
index 63fdfb6c1a..6297ab24fe 100644
--- a/lib/placement
+++ b/lib/placement
@@ -71,32 +71,6 @@ function cleanup_placement {
     remove_uwsgi_config "$PLACEMENT_UWSGI_CONF" "placement-api"
 }
 
-# _config_placement_apache_wsgi() - Set WSGI config files
-function _config_placement_apache_wsgi {
-    local placement_api_apache_conf
-    local venv_path=""
-    local placement_bin_dir=""
-    placement_bin_dir=$(get_python_exec_prefix)
-    placement_api_apache_conf=$(apache_site_config_for placement-api)
-
-    if [[ ${USE_VENV} = True ]]; then
-        venv_path="python-path=${PROJECT_VENV["placement"]}/lib/$(python_version)/site-packages"
-        placement_bin_dir=${PROJECT_VENV["placement"]}/bin
-    fi
-
-    sudo cp $FILES/apache-placement-api.template $placement_api_apache_conf
-    sudo sed -e "
-        s|%APACHE_NAME%|$APACHE_NAME|g;
-        s|%PUBLICWSGI%|$placement_bin_dir/placement-api|g;
-        s|%SSLENGINE%|$placement_ssl|g;
-        s|%SSLCERTFILE%|$placement_certfile|g;
-        s|%SSLKEYFILE%|$placement_keyfile|g;
-        s|%USER%|$STACK_USER|g;
-        s|%VIRTUALENV%|$venv_path|g
-        s|%APIWORKERS%|$API_WORKERS|g
-    " -i $placement_api_apache_conf
-}
-
 # create_placement_conf() - Write config
 function create_placement_conf {
     rm -f $PLACEMENT_CONF
@@ -112,11 +86,7 @@ function configure_placement {
     sudo install -d -o $STACK_USER $PLACEMENT_CONF_DIR
     create_placement_conf
 
-    if [[ "$WSGI_MODE" == "uwsgi" ]]; then
-        write_uwsgi_config "$PLACEMENT_UWSGI_CONF" "$PLACEMENT_UWSGI" "/placement"
-    else
-        _config_placement_apache_wsgi
-    fi
+    write_uwsgi_config "$PLACEMENT_UWSGI_CONF" "$PLACEMENT_UWSGI" "/placement"
     if [[ "$PLACEMENT_ENFORCE_SCOPE" == "True" || "$ENFORCE_SCOPE" == "True" ]]; then
         iniset $PLACEMENT_CONF oslo_policy enforce_new_defaults True
         iniset $PLACEMENT_CONF oslo_policy enforce_scope True
@@ -147,7 +117,6 @@ function init_placement {
 
 # install_placement() - Collect source and prepare
 function install_placement {
-    install_apache_wsgi
     # Install the openstackclient placement client plugin for CLI
     pip_install_gr osc-placement
     git_clone $PLACEMENT_REPO $PLACEMENT_DIR $PLACEMENT_BRANCH
@@ -156,12 +125,7 @@ function install_placement {
 
 # start_placement_api() - Start the API processes ahead of other things
 function start_placement_api {
-    if [[ "$WSGI_MODE" == "uwsgi" ]]; then
-        run_process "placement-api" "$(which uwsgi) --procname-prefix placement --ini $PLACEMENT_UWSGI_CONF"
-    else
-        enable_apache_site placement-api
-        restart_apache_server
-    fi
+    run_process "placement-api" "$(which uwsgi) --procname-prefix placement --ini $PLACEMENT_UWSGI_CONF"
 
     echo "Waiting for placement-api to start..."
     if ! wait_for_service $SERVICE_TIMEOUT $PLACEMENT_SERVICE_PROTOCOL://$PLACEMENT_SERVICE_HOST/placement; then
@@ -175,12 +139,7 @@ function start_placement {
 
 # stop_placement() - Disable the api service and stop it.
 function stop_placement {
-    if [[ "$WSGI_MODE" == "uwsgi" ]]; then
-        stop_process "placement-api"
-    else
-        disable_apache_site placement-api
-        restart_apache_server
-    fi
+    stop_process "placement-api"
 }
 
 # Restore xtrace

From 169be464c2ac1c5fc16396e1c320465c4ce6a658 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Fri, 11 Oct 2024 15:42:10 +0100
Subject: [PATCH 2280/2409] lib/keystone: Remove support for deploying with
 mod_wsgi

Change-Id: I2409385a87ee7cc7869bba9711bf95ab5fe77dc7
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
---
 lib/keystone | 46 ++++++----------------------------------------
 1 file changed, 6 insertions(+), 40 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 7d6b05fd41..8f4f4b1366 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -51,15 +51,6 @@ KEYSTONE_CONF=$KEYSTONE_CONF_DIR/keystone.conf
 KEYSTONE_PUBLIC_UWSGI_CONF=$KEYSTONE_CONF_DIR/keystone-uwsgi-public.ini
 KEYSTONE_PUBLIC_UWSGI=$KEYSTONE_BIN_DIR/keystone-wsgi-public
 
-# KEYSTONE_DEPLOY defines how keystone is deployed, allowed values:
-# - mod_wsgi : Run keystone under Apache HTTPd mod_wsgi
-# - uwsgi : Run keystone under uwsgi
-if [[ "$WSGI_MODE" == "uwsgi" ]]; then
-    KEYSTONE_DEPLOY=uwsgi
-else
-    KEYSTONE_DEPLOY=mod_wsgi
-fi
-
 # Select the Identity backend driver
 KEYSTONE_IDENTITY_BACKEND=${KEYSTONE_IDENTITY_BACKEND:-sql}
 
@@ -144,15 +135,9 @@ function is_keystone_enabled {
 # cleanup_keystone() - Remove residual data files, anything left over from previous
 # runs that a clean run would need to clean up
 function cleanup_keystone {
-    if [ "$KEYSTONE_DEPLOY" == "mod_wsgi" ]; then
-        # These files will be created if we are running WSGI_MODE="mod_wsgi"
-        disable_apache_site keystone
-        sudo rm -f $(apache_site_config_for keystone)
-    else
-        stop_process "keystone"
-        remove_uwsgi_config "$KEYSTONE_PUBLIC_UWSGI_CONF" "keystone-wsgi-public"
-        sudo rm -f $(apache_site_config_for keystone-wsgi-public)
-    fi
+    stop_process "keystone"
+    remove_uwsgi_config "$KEYSTONE_PUBLIC_UWSGI_CONF" "keystone-wsgi-public"
+    sudo rm -f $(apache_site_config_for keystone-wsgi-public)
 }
 
 # _config_keystone_apache_wsgi() - Set WSGI config files of Keystone
@@ -241,12 +226,7 @@ function configure_keystone {
 
     iniset $KEYSTONE_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
 
-    if [ "$KEYSTONE_DEPLOY" == "mod_wsgi" ]; then
-        iniset $KEYSTONE_CONF DEFAULT logging_exception_prefix "%(asctime)s.%(msecs)03d %(process)d TRACE %(name)s %(instance)s"
-        _config_keystone_apache_wsgi
-    else # uwsgi
-        write_uwsgi_config "$KEYSTONE_PUBLIC_UWSGI_CONF" "$KEYSTONE_PUBLIC_UWSGI" "/identity"
-    fi
+    write_uwsgi_config "$KEYSTONE_PUBLIC_UWSGI_CONF" "$KEYSTONE_PUBLIC_UWSGI" "/identity"
 
     iniset $KEYSTONE_CONF DEFAULT max_token_size 16384
 
@@ -543,10 +523,6 @@ function install_keystone {
     if is_service_enabled ldap; then
         setup_develop $KEYSTONE_DIR ldap
     fi
-
-    if [ "$KEYSTONE_DEPLOY" == "mod_wsgi" ]; then
-        install_apache_wsgi
-    fi
 }
 
 # start_keystone() - Start running processes
@@ -559,12 +535,7 @@ function start_keystone {
         auth_protocol="http"
     fi
 
-    if [ "$KEYSTONE_DEPLOY" == "mod_wsgi" ]; then
-        enable_apache_site keystone
-        restart_apache_server
-    else # uwsgi
-        run_process keystone "$(which uwsgi) --procname-prefix keystone --ini $KEYSTONE_PUBLIC_UWSGI_CONF" ""
-    fi
+    run_process keystone "$(which uwsgi) --procname-prefix keystone --ini $KEYSTONE_PUBLIC_UWSGI_CONF" ""
 
     echo "Waiting for keystone to start..."
     # Check that the keystone service is running. Even if the tls tunnel
@@ -589,12 +560,7 @@ function start_keystone {
 
 # stop_keystone() - Stop running processes
 function stop_keystone {
-    if [ "$KEYSTONE_DEPLOY" == "mod_wsgi" ]; then
-        disable_apache_site keystone
-        restart_apache_server
-    else
-        stop_process keystone
-    fi
+    stop_process keystone
 }
 
 # bootstrap_keystone() - Initialize user, role and project

From 29545a5109df51f9e98b715b16968090a3928ab7 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Wed, 16 Oct 2024 02:50:33 +0000
Subject: [PATCH 2281/2409] Updated from generate-devstack-plugins-list

Change-Id: I374de22c7c916f9497c55bf404141776fd17f6c8
---
 doc/source/plugin-registry.rst | 2 --
 1 file changed, 2 deletions(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 21cf52c736..8b9d1f2b96 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -48,9 +48,7 @@ openstack/ironic-inspector               `https://opendev.org/openstack/ironic-i
 openstack/ironic-prometheus-exporter     `https://opendev.org/openstack/ironic-prometheus-exporter <https://opendev.org/openstack/ironic-prometheus-exporter>`__
 openstack/ironic-ui                      `https://opendev.org/openstack/ironic-ui <https://opendev.org/openstack/ironic-ui>`__
 openstack/keystone                       `https://opendev.org/openstack/keystone <https://opendev.org/openstack/keystone>`__
-openstack/kuryr-kubernetes               `https://opendev.org/openstack/kuryr-kubernetes <https://opendev.org/openstack/kuryr-kubernetes>`__
 openstack/kuryr-libnetwork               `https://opendev.org/openstack/kuryr-libnetwork <https://opendev.org/openstack/kuryr-libnetwork>`__
-openstack/kuryr-tempest-plugin           `https://opendev.org/openstack/kuryr-tempest-plugin <https://opendev.org/openstack/kuryr-tempest-plugin>`__
 openstack/magnum                         `https://opendev.org/openstack/magnum <https://opendev.org/openstack/magnum>`__
 openstack/magnum-ui                      `https://opendev.org/openstack/magnum-ui <https://opendev.org/openstack/magnum-ui>`__
 openstack/manila                         `https://opendev.org/openstack/manila <https://opendev.org/openstack/manila>`__

From 50b0b602279fc0eb8d2bb9cab1d235197df72ec6 Mon Sep 17 00:00:00 2001
From: Takashi Natsume <takanattie@gmail.com>
Date: Sun, 29 Sep 2024 21:28:47 +0900
Subject: [PATCH 2282/2409] Replace deprecated datetime.utcnow()

The datetime.utcnow() is deprecated in Python 3.12.
Replace datetime.utcnow() with
datetime.now(datetime.timezone.utc).replace(tzinfo=None).

Change-Id: I9bf6f69d9e174d490bb4f3eaef3b364ddf97a954
Signed-off-by: Takashi Natsume <takanattie@gmail.com>
---
 tools/outfilter.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tools/outfilter.py b/tools/outfilter.py
index e910f79ff2..55f9ee1487 100644
--- a/tools/outfilter.py
+++ b/tools/outfilter.py
@@ -76,7 +76,8 @@ def main():
         # with zuulv3 native jobs and ansible capture it may become
         # clearer what to do
         if HAS_DATE.search(line) is None:
-            now = datetime.datetime.utcnow()
+            now = datetime.datetime.now(datetime.timezone.utc).replace(
+                    tzinfo=None)
             ts_line = ("%s | %s" % (
                 now.strftime("%Y-%m-%d %H:%M:%S.%f")[:-3],
                 line))

From 2e04d0fa20d2f6ceaf537423dad6b00d289b531c Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Thu, 24 Oct 2024 00:54:28 +0900
Subject: [PATCH 2283/2409] Globally skip devstack job for pre-commit config
 update

pre-commit has been introduced to number of projects like oslo to run
lint checks such as hacking. The pre-commit config file does not affect
functionality, so devstack job is not needed when only the file is
updated.

Change-Id: I4294fe0c4df2c36c8575613b05a1f9c2eb745d18
---
 .zuul.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.zuul.yaml b/.zuul.yaml
index a1c251a398..b5477d1a8f 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -432,6 +432,8 @@
       - ^releasenotes/.*$
       # Translations
       - ^.*/locale/.*po$
+      # pre-commit config
+      - ^.pre-commit-config.yaml$
 
 - job:
     name: devstack-minimal

From 2fdb729e04e8227ac5bfe619df20c1854bf255bc Mon Sep 17 00:00:00 2001
From: Jay Faulkner <jay@jvf.cc>
Date: Tue, 12 Nov 2024 15:02:15 -0800
Subject: [PATCH 2284/2409] Use venv module for PROJECT_VENV building

Currently, if USE_VENV=True, PROJECT_VENVs are initialized using the
tools/build_venv.sh script; this script depends on the virtualenv
module, which is much less commonly available than the built-in venv
module which we already use many places.

This changes the build_venv.sh script to use `python -m venv` instead.

Needed-By: https://review.opendev.org/c/openstack/ironic/+/930776
Change-Id: I89fa2c0c4261e715064e77a766d98a34299532b3
---
 tools/build_venv.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/build_venv.sh b/tools/build_venv.sh
index cfa39a82e0..a439163b5d 100755
--- a/tools/build_venv.sh
+++ b/tools/build_venv.sh
@@ -38,7 +38,7 @@ if [[ -z "$TOP_DIR" ]]; then
 fi
 
 # Build new venv
-virtualenv $VENV_DEST
+python$PYTHON3_VERSION -m venv --system-site-packages $VENV_DEST
 
 # Install modern pip
 PIP_VIRTUAL_ENV=$VENV_DEST pip_install -U pip

From f41479f370e75c7ea7f17a62135f3af99b91c781 Mon Sep 17 00:00:00 2001
From: Joel Capitao <jcapitao@redhat.com>
Date: Mon, 30 Sep 2024 15:14:20 +0200
Subject: [PATCH 2285/2409] Pull RDO Trunk repos when CentOS Stream official
 RPM not available

The RDO project releases centos-release-openstack-* RPM a couple of
weeks after the OpenStack upstream project cut master branch.
In order to fill the gap in the meantime, we have to pull the repos
from RDO Trunk.

Change-Id: If95a687f2d7579779129eeb689cfa46b92450dc5
---
 stack.sh | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/stack.sh b/stack.sh
index dcfd398c01..bfa0573f21 100755
--- a/stack.sh
+++ b/stack.sh
@@ -308,8 +308,11 @@ function _install_rdo {
             # adding delorean-deps repo to provide current master rpms
             sudo wget https://trunk.rdoproject.org/centos9-master/delorean-deps.repo -O /etc/yum.repos.d/delorean-deps.repo
         else
-            # For stable/unmaintained branches use corresponding release rpm
-            sudo dnf -y install centos-release-openstack-${rdo_release}
+            if sudo dnf provides centos-release-openstack-${rdo_release} >/dev/null 2>&1; then
+                sudo dnf -y install centos-release-openstack-${rdo_release}
+            else
+                sudo wget https://trunk.rdoproject.org/centos9-${rdo_release}/delorean-deps.repo -O /etc/yum.repos.d/delorean-deps.repo
+            fi
         fi
     fi
     sudo dnf -y update

From c6c5e12f6b1b5f7dac3d9f942c5ab8135618112d Mon Sep 17 00:00:00 2001
From: Joel Capitao <jcapitao@redhat.com>
Date: Wed, 13 Nov 2024 10:33:28 +0100
Subject: [PATCH 2286/2409] Revert "Use SETUPTOOLS_USE_DISTUTILS=stdlib for
 global pip installs"

This partially reverts commit 18b4251bf4f689923a19bf7fbc50d5c2ea422b21.

Support for loading distutils from the standard library is now deprecated
since v70.3.0 [1]. It was needed initially to ease the transition and
can be removed now.

[1] https://setuptools.pypa.io/en/latest/history.html#v70-3-0

Change-Id: Ib929219ae81b802a4632963ef71a258edf4deee5
---
 inc/python | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/inc/python b/inc/python
index 2083b74dc1..c94e5a4952 100644
--- a/inc/python
+++ b/inc/python
@@ -199,13 +199,7 @@ function pip_install {
         echo "Using python $PYTHON3_VERSION to install $package_dir"
     else
         local cmd_pip="python$PYTHON3_VERSION -m pip"
-        # See
-        #  https://github.com/pypa/setuptools/issues/2232
-        #  http://lists.openstack.org/pipermail/openstack-discuss/2020-August/016905.html
-        # this makes setuptools >=50 use the platform distutils.
-        # We only want to do this on global pip installs, not if
-        # installing in a virtualenv
-        local sudo_pip="sudo -H LC_ALL=en_US.UTF-8 SETUPTOOLS_USE_DISTUTILS=stdlib "
+        local sudo_pip="sudo -H LC_ALL=en_US.UTF-8"
         echo "Using python $PYTHON3_VERSION to install $package_dir"
     fi
 

From b8cd9d11730206eb81c08b6d181503068b93c1d5 Mon Sep 17 00:00:00 2001
From: Abhishek Kekane <akekane@redhat.com>
Date: Thu, 7 Nov 2024 08:27:13 +0000
Subject: [PATCH 2287/2409] Support for s3 backend of glance

This commit introduces support for s3 backend for glance.
You can enabled it in your deployment by adding below options in
your local.conf file.

For single store support:
enable_service s3api s-proxy s-account s-container
disable_service tls-proxy
GLANCE_USE_S3 = True

For multistore support:
enable_service s3api s-proxy s-account s-container
disable_service tls-proxy
GLANCE_USE_S3 = True
GLANCE_ENABLE_MULTIPLE_STORES: True

NOTE: At the moment devstack does not support tls with s3, this
support will be added soon.

Needed-By: https://review.opendev.org/c/openstack/glance/+/934311
Change-Id: Ic7264dc7faccb5e68c8df3b929eaa6d04149c6a2
---
 lib/glance | 61 ++++++++++++++++++++++++++++++++++++++++++++++++++----
 1 file changed, 57 insertions(+), 4 deletions(-)

diff --git a/lib/glance b/lib/glance
index 2eb4954f4a..5c3643d008 100644
--- a/lib/glance
+++ b/lib/glance
@@ -41,6 +41,12 @@ else
     GLANCE_BIN_DIR=$(get_python_exec_prefix)
 fi
 
+#S3 for Glance
+GLANCE_USE_S3=$(trueorfalse False GLANCE_USE_S3)
+GLANCE_S3_DEFAULT_BACKEND=${GLANCE_S3_DEFAULT_BACKEND:-s3_fast}
+GLANCE_S3_BUCKET_ON_PUT=$(trueorfalse True GLANCE_S3_BUCKET_ON_PUT)
+GLANCE_S3_BUCKET_NAME=${GLANCE_S3_BUCKET_NAME:-images}
+
 # Cinder for Glance
 USE_CINDER_FOR_GLANCE=$(trueorfalse False USE_CINDER_FOR_GLANCE)
 # GLANCE_CINDER_DEFAULT_BACKEND should be one of the values
@@ -174,6 +180,34 @@ function cleanup_glance {
     remove_uwsgi_config "$GLANCE_UWSGI_CONF" "glance-wsgi-api"
 }
 
+# Set multiple s3 store related config options
+#
+function configure_multiple_s3_stores {
+    enabled_backends="${GLANCE_S3_DEFAULT_BACKEND}:s3"
+
+    iniset $GLANCE_API_CONF DEFAULT enabled_backends ${enabled_backends}
+    iniset $GLANCE_API_CONF glance_store default_backend $GLANCE_S3_DEFAULT_BACKEND
+}
+
+# Set common S3 store options to given config section
+#
+# Arguments:
+# config_section
+#
+function set_common_s3_store_params {
+    local config_section="$1"
+    openstack ec2 credential create
+    iniset $GLANCE_API_CONF $config_section s3_store_host "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$S3_SERVICE_PORT"
+    iniset $GLANCE_API_CONF $config_section s3_store_access_key "$(openstack ec2 credential list -c Access -f value)"
+    iniset $GLANCE_API_CONF $config_section s3_store_secret_key "$(openstack ec2 credential list -c Secret -f value)"
+    iniset $GLANCE_API_CONF $config_section s3_store_create_bucket_on_put $GLANCE_S3_BUCKET_ON_PUT
+    iniset $GLANCE_API_CONF $config_section s3_store_bucket $GLANCE_S3_BUCKET_NAME
+    iniset $GLANCE_API_CONF $config_section s3_store_bucket_url_format "path"
+    if is_service_enabled tls-proxy; then
+        iniset $GLANCE_API_CONF $config_section s3_store_cacert $SSL_BUNDLE_FILE
+    fi
+}
+
 # Set multiple cinder store related config options for each of the cinder store
 #
 function configure_multiple_cinder_stores {
@@ -258,7 +292,6 @@ function configure_glance_store {
     local be
 
     if [[ "$glance_enable_multiple_stores" == "False" ]]; then
-        # Configure traditional glance_store
         if [[ "$use_cinder_for_glance" == "True" ]]; then
             # set common glance_store parameters
             iniset $GLANCE_API_CONF glance_store stores "cinder,file,http"
@@ -281,7 +314,7 @@ function configure_glance_store {
         if [[ "$use_cinder_for_glance" == "True" ]]; then
             # Configure multiple cinder stores for glance
             configure_multiple_cinder_stores
-        else
+        elif ! is_service_enabled s-proxy && [[ "$GLANCE_USE_S3" == "False" ]]; then
             # Configure multiple file stores for glance
             configure_multiple_file_stores
         fi
@@ -360,8 +393,15 @@ function configure_glance {
 
     # No multiple stores for swift yet
     if [[ "$GLANCE_ENABLE_MULTIPLE_STORES" == "False" ]]; then
-        # Store the images in swift if enabled.
-        if is_service_enabled s-proxy; then
+        # Return if s3api is enabled for glance
+        if [[ "$GLANCE_USE_S3" == "True" ]]; then
+            if is_service_enabled s3api; then
+                # set common glance_store parameters
+                iniset $GLANCE_API_CONF glance_store stores "s3,file,http"
+                iniset $GLANCE_API_CONF glance_store default_store s3
+            fi
+        elif is_service_enabled s-proxy; then
+            # Store the images in swift if enabled.
             iniset $GLANCE_API_CONF glance_store default_store swift
             iniset $GLANCE_API_CONF glance_store swift_store_create_container_on_put True
 
@@ -379,6 +419,12 @@ function configure_glance {
             iniset $GLANCE_SWIFT_STORE_CONF ref1 auth_address $KEYSTONE_SERVICE_URI/v3
             iniset $GLANCE_SWIFT_STORE_CONF ref1 auth_version 3
         fi
+    else
+        if [[ "$GLANCE_USE_S3" == "True" ]]; then
+            if is_service_enabled s3api; then
+                configure_multiple_s3_stores
+            fi
+        fi
     fi
 
     # We need to tell glance what it's public endpoint is so that the version
@@ -484,6 +530,13 @@ function create_glance_accounts {
             configure_glance_quotas
         fi
 
+        if is_service_enabled s3api && [[ "$GLANCE_USE_S3" == "True" ]]; then
+            if [[ "$GLANCE_ENABLE_MULTIPLE_STORES" == "False" ]]; then
+                set_common_s3_store_params glance_store
+            else
+                set_common_s3_store_params $GLANCE_S3_DEFAULT_BACKEND
+            fi
+        fi
     fi
 }
 

From 3f1cd9b076b1338d42031e3801cb6316d169c51e Mon Sep 17 00:00:00 2001
From: Rodolfo Alonso Hernandez <ralonsoh@redhat.com>
Date: Tue, 19 Nov 2024 10:50:05 +0000
Subject: [PATCH 2288/2409] Remove the Neutron WSGI experimental jobs

Neutron is moving all the jobs to use the Neutron API WSGI module,
thus this module is no longer an experimental configuration.

Change-Id: Iaf708cd5e6ab414b262a0daecb3909ace2376f68
---
 .zuul.yaml | 12 ------------
 1 file changed, 12 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index b5477d1a8f..3632dc03e8 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -956,15 +956,6 @@
     #    things, this job is not experimental but often is used to test
     #    things that are not yet production ready or to test what will be
     #    the new default after a deprecation period has ended.
-    # * neutron-fullstack-with-uwsgi: maintained by neutron for fullstack test
-    #    when neutron-api is served by uwsgi, it's in exprimental for testing.
-    #    the next cycle we can remove this  job if things turn out to be
-    #    stable enough.
-    # * neutron-functional-with-uwsgi: maintained by neutron for functional
-    #    test. Next cycle we can remove this one if things turn out to be
-    #    stable engouh with uwsgi.
-    # * neutron-ovn-tempest-with-uwsgi: maintained by neutron for tempest test.
-    #    Next cycle we can remove this if everything run out stable enough.
     # * nova-multi-cell: maintained by nova and now is voting in the
     #    check queue for nova changes but relies on devstack configuration
 
@@ -972,9 +963,6 @@
       jobs:
         - nova-multi-cell
         - nova-next
-        - neutron-fullstack-with-uwsgi
-        - neutron-functional-with-uwsgi
-        - neutron-ovn-tempest-with-uwsgi
         - devstack-plugin-ceph-tempest-py3:
             irrelevant-files:
               - ^.*\.rst$

From df0bfe4d5c3519d5c4deb5033bec2217c90c9425 Mon Sep 17 00:00:00 2001
From: 0weng <oweng@osuosl.org>
Date: Tue, 12 Nov 2024 11:44:13 -0800
Subject: [PATCH 2289/2409] Doc: Fix variable name in logging config example

$LOGDIR --> $DEST

Change-Id: I461422f48525edf4ecb388b2f962edb03795db50
---
 doc/source/configuration.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 9a1fd4e179..3cfba716ca 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -323,7 +323,7 @@ a file, keep service logs and disable color in the stored files.
 
    [[local|localrc]]
    DEST=/opt/stack/
-   LOGFILE=$LOGDIR/stack.sh.log
+   LOGFILE=$DEST/stack.sh.log
    LOG_COLOR=False
 
 Database Backend

From c1eeb773a85b0485b6329e325ac1685d8e3b2dc4 Mon Sep 17 00:00:00 2001
From: Artem Goncharov <artem.goncharov@gmail.com>
Date: Thu, 10 Oct 2024 15:26:52 +0200
Subject: [PATCH 2290/2409] lib/keystone: Migrate Keystone to WSGI module path

Depends-on: https://review.opendev.org/c/openstack/keystone/+/932060
Change-Id: I10bea74fb0bce1888d324a61f23c25b8f7082e97
---
 lib/keystone | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 8f4f4b1366..76e2598ba3 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -49,7 +49,7 @@ fi
 KEYSTONE_CONF_DIR=${KEYSTONE_CONF_DIR:-/etc/keystone}
 KEYSTONE_CONF=$KEYSTONE_CONF_DIR/keystone.conf
 KEYSTONE_PUBLIC_UWSGI_CONF=$KEYSTONE_CONF_DIR/keystone-uwsgi-public.ini
-KEYSTONE_PUBLIC_UWSGI=$KEYSTONE_BIN_DIR/keystone-wsgi-public
+KEYSTONE_PUBLIC_UWSGI=keystone.wsgi.api:application
 
 # Select the Identity backend driver
 KEYSTONE_IDENTITY_BACKEND=${KEYSTONE_IDENTITY_BACKEND:-sql}
@@ -226,7 +226,7 @@ function configure_keystone {
 
     iniset $KEYSTONE_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
 
-    write_uwsgi_config "$KEYSTONE_PUBLIC_UWSGI_CONF" "$KEYSTONE_PUBLIC_UWSGI" "/identity"
+    write_uwsgi_config "$KEYSTONE_PUBLIC_UWSGI_CONF" "$KEYSTONE_PUBLIC_UWSGI" "/identity" "" "keystone-api"
 
     iniset $KEYSTONE_CONF DEFAULT max_token_size 16384
 

From 6578d6ad27f04bdbfd1c30a13a7fc7ae47c2fb49 Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Sat, 23 Nov 2024 21:44:17 +0900
Subject: [PATCH 2291/2409] Remove unused python-etcd3

python-etcd3 can't be used since etcd3 driver was removed from tooz in
tooz 5.0.0 [1].

[1] 6bc02cda5b452bbf4821621eafc031bd676f8a2f

Change-Id: I30b895b4473e2676085e27969a43b91be9b1e413
---
 lib/libraries | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/lib/libraries b/lib/libraries
index 9ea32304fc..fa418785dd 100755
--- a/lib/libraries
+++ b/lib/libraries
@@ -131,12 +131,7 @@ function install_libs {
     # python client libraries we might need from git can go here
     _install_lib_from_source "python-barbicanclient"
 
-
     # etcd (because tooz does not have a hard dependency on these)
-    #
-    # NOTE(sdague): this is currently a work around because tooz
-    # doesn't pull in etcd3.
-    pip_install etcd3
     pip_install etcd3gw
 }
 

From ef63c690f119e3d9a7890215ee8832da4f5fb4dc Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Sun, 24 Nov 2024 22:48:08 +0900
Subject: [PATCH 2292/2409] Drop redundant lib/oslo

It was kept for compatibility in renaming which was merged long ago[1],
and is no longer necessary.

[1] 3ed99c0b27122ff00e2d236086ab16b0cc1887c1

Depends-on: https://review.opendev.org/c/openstack/grenade/+/936095
Change-Id: I6a66359c19d0385beafb4c5e57b6ec3cd6d9cc54
---
 clean.sh      |  2 +-
 lib/libraries |  2 +-
 lib/oslo      | 11 -----------
 3 files changed, 2 insertions(+), 13 deletions(-)
 delete mode 100644 lib/oslo

diff --git a/clean.sh b/clean.sh
index 6a31cc624a..092f557a88 100755
--- a/clean.sh
+++ b/clean.sh
@@ -40,7 +40,7 @@ source $TOP_DIR/lib/rpc_backend
 
 source $TOP_DIR/lib/tls
 
-source $TOP_DIR/lib/oslo
+source $TOP_DIR/lib/libraries
 source $TOP_DIR/lib/lvm
 source $TOP_DIR/lib/horizon
 source $TOP_DIR/lib/keystone
diff --git a/lib/libraries b/lib/libraries
index 9ea32304fc..9d5d65532e 100755
--- a/lib/libraries
+++ b/lib/libraries
@@ -1,6 +1,6 @@
 #!/bin/bash
 #
-# lib/oslo
+# lib/libraries
 #
 # Functions to install libraries from git
 #
diff --git a/lib/oslo b/lib/oslo
deleted file mode 100644
index 3ae64c8210..0000000000
--- a/lib/oslo
+++ /dev/null
@@ -1,11 +0,0 @@
-#!/bin/bash
-#
-# lib/oslo
-#
-# Functions to install **Oslo** libraries from git
-#
-# We need this to handle the fact that projects would like to use
-# pre-released versions of oslo libraries.
-#
-# Included for compatibility with grenade, remove in Queens
-source $TOP_DIR/lib/libraries

From ec49b3e1672ef47d59509132e95f94d6be13abfe Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Wed, 27 Nov 2024 02:42:01 +0000
Subject: [PATCH 2293/2409] Updated from generate-devstack-plugins-list

Change-Id: I344c3492159d53c68002b78ac3c385c1beca0e61
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 8b9d1f2b96..2984a5c15f 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -31,6 +31,7 @@ openstack/ceilometer                     `https://opendev.org/openstack/ceilomet
 openstack/cloudkitty                     `https://opendev.org/openstack/cloudkitty <https://opendev.org/openstack/cloudkitty>`__
 openstack/cyborg                         `https://opendev.org/openstack/cyborg <https://opendev.org/openstack/cyborg>`__
 openstack/designate                      `https://opendev.org/openstack/designate <https://opendev.org/openstack/designate>`__
+openstack/designate-tempest-plugin       `https://opendev.org/openstack/designate-tempest-plugin <https://opendev.org/openstack/designate-tempest-plugin>`__
 openstack/devstack-plugin-amqp1          `https://opendev.org/openstack/devstack-plugin-amqp1 <https://opendev.org/openstack/devstack-plugin-amqp1>`__
 openstack/devstack-plugin-ceph           `https://opendev.org/openstack/devstack-plugin-ceph <https://opendev.org/openstack/devstack-plugin-ceph>`__
 openstack/devstack-plugin-container      `https://opendev.org/openstack/devstack-plugin-container <https://opendev.org/openstack/devstack-plugin-container>`__

From 451236381d4f6af0072b60fc65743b55ee33ab95 Mon Sep 17 00:00:00 2001
From: Rodolfo Alonso Hernandez <ralonsoh@redhat.com>
Date: Fri, 29 Nov 2024 07:39:37 +0000
Subject: [PATCH 2294/2409] Add start time (in seconds) to the WSGI
 configuration file

This new variable "start-time" is initialized when the WSGI
starts and is the timestamp in seconds.

Related-Bug: #2083570
Change-Id: I1b984b93d1352683097c1417b22d64341a68f72a
---
 lib/apache | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/apache b/lib/apache
index 1420f76ff2..1c034d3c7e 100644
--- a/lib/apache
+++ b/lib/apache
@@ -293,6 +293,8 @@ function write_uwsgi_config {
     iniset "$conf" uwsgi add-header "Connection: close"
     # This ensures that file descriptors aren't shared between processes.
     iniset "$conf" uwsgi lazy-apps true
+    # Starting time of the WSGi server
+    iniset "$conf" uwsgi start-time %t
 
     # If we said bind directly to http, then do that and don't start the apache proxy
     if [[ -n "$http" ]]; then
@@ -367,6 +369,8 @@ function write_local_uwsgi_http_config {
     iniset "$conf" uwsgi http-keepalive false
     # Increase socket timeout for slow chunked uploads
     iniset "$conf" uwsgi socket-timeout 30
+    # Starting time of the WSGi server
+    iniset "$conf" uwsgi start-time %t
 
     enable_apache_mod proxy
     enable_apache_mod proxy_http

From 97ea68ec4611391de2e245a1def655cbebc7649d Mon Sep 17 00:00:00 2001
From: yatinkarel <ykarel@redhat.com>
Date: Mon, 2 Dec 2024 17:46:42 +0530
Subject: [PATCH 2295/2409] Fix the db user for mariadb in ubuntu 24.04

It was fixed in past for ubuntu 22.04 with [1],
removing the check for jammy so it applies to
all ubuntu versions since jammy.
The checks now only refer debian distros so those
can be adjusted with new debian releases.

[1] https://review.opendev.org/c/openstack/devstack/+/866944

Related-Bug: #1999090
Closes-Bug: #2090835
Change-Id: Iff843c5c3f9c081aa1cec6c399a6ed8c05e06abe
---
 lib/databases/mysql | 17 ++++++-----------
 1 file changed, 6 insertions(+), 11 deletions(-)

diff --git a/lib/databases/mysql b/lib/databases/mysql
index e069e128e9..629014c1d8 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -104,10 +104,10 @@ function configure_database_mysql {
     # Set the root password - only works the first time. For Ubuntu, we already
     # did that with debconf before installing the package, but we still try,
     # because the package might have been installed already. We don't do this
-    # for Ubuntu 22.04 (jammy) because the authorization model change in
+    # for Ubuntu 22.04+ because the authorization model change in
     # version 10.4 of mariadb. See
     # https://mariadb.org/authentication-in-mariadb-10-4/
-    if ! (is_ubuntu && [[ "$DISTRO" == "jammy" ]] && [ "$MYSQL_SERVICE_NAME" == "mariadb" ]); then
+    if ! (is_ubuntu && [[ ! "$DISTRO" =~ bookworm|bullseye ]] && [ "$MYSQL_SERVICE_NAME" == "mariadb" ]); then
         sudo mysqladmin -u root password $DATABASE_PASSWORD || true
     fi
 
@@ -124,16 +124,11 @@ function configure_database_mysql {
     # we need to change auth plugin for root user
     # TODO(frickler): simplify this logic
     if is_ubuntu && [[ ! "$DISTRO" =~ bookworm|bullseye ]] && [ "$MYSQL_SERVICE_NAME" == "mariadb" ]; then
-        if [[ "$DISTRO" == "jammy" ]]; then
-            # For Ubuntu 22.04 (jammy) we follow the model outlined in
-            # https://mariadb.org/authentication-in-mariadb-10-4/
-            sudo mysql -e "ALTER USER $DATABASE_USER@localhost IDENTIFIED VIA mysql_native_password USING PASSWORD('$DATABASE_PASSWORD');"
-        else
-            sudo mysql $cmd_args -e "UPDATE mysql.user SET plugin='' WHERE user='$DATABASE_USER' AND host='localhost';"
-            sudo mysql $cmd_args -e "FLUSH PRIVILEGES;"
-        fi
+        # For Ubuntu 22.04+ we follow the model outlined in
+        # https://mariadb.org/authentication-in-mariadb-10-4/
+        sudo mysql -e "ALTER USER $DATABASE_USER@localhost IDENTIFIED VIA mysql_native_password USING PASSWORD('$DATABASE_PASSWORD');"
     fi
-    if ! (is_ubuntu && [[ "$DISTRO" == "jammy" ]] && [ "$MYSQL_SERVICE_NAME" == "mariadb" ]); then
+    if ! (is_ubuntu && [[ ! "$DISTRO" =~ bookworm|bullseye ]] && [ "$MYSQL_SERVICE_NAME" == "mariadb" ]); then
         # Create DB user if it does not already exist
         sudo mysql $cmd_args -e "CREATE USER IF NOT EXISTS '$DATABASE_USER'@'%' identified by '$DATABASE_PASSWORD';"
         # Update the DB to give user '$DATABASE_USER'@'%' full control of the all databases:

From 320c2bf42ae41d751c72d80a6c85b26f3f6951bd Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Tue, 3 Dec 2024 17:04:39 +0000
Subject: [PATCH 2296/2409] Install setuptools 'core' extra

Under as-yet-unidentified conditions, we can end up with a version of
packaging that is too old for the version of latest version of
setuptools. This is a known issue and expected behavior and per [1]
$subject is the preferred resolution.

[1] https://github.com/pypa/setuptools/issues/4483#issuecomment-2237219597

Change-Id: I9232f3fae1598297e83c4ea37339896f7dcbd44f
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
---
 inc/python | 4 ++--
 lib/infra  | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/inc/python b/inc/python
index c94e5a4952..857f1f2d06 100644
--- a/inc/python
+++ b/inc/python
@@ -40,8 +40,8 @@ function setup_devstack_virtualenv {
         # Using system site packages to enable nova to use libguestfs.
         # This package is currently installed via the distro and not
         # available on pypi.
-        python$PYTHON3_VERSION -m venv --system-site-packages $DEVSTACK_VENV
-        pip_install -U pip setuptools
+        $PYTHON -m venv --system-site-packages "${DEVSTACK_VENV}"
+        pip_install -U pip setuptools[core]
         #NOTE(rpittau): workaround for simplejson removal in osc
         #  https://review.opendev.org/c/openstack/python-openstackclient/+/920001
         pip_install -U simplejson
diff --git a/lib/infra b/lib/infra
index 2aad00354a..f4760c352c 100644
--- a/lib/infra
+++ b/lib/infra
@@ -31,7 +31,7 @@ function install_infra {
     local PIP_VIRTUAL_ENV="$REQUIREMENTS_DIR/.venv"
     [ ! -d $PIP_VIRTUAL_ENV ] && ${VIRTUALENV_CMD} $PIP_VIRTUAL_ENV
     # We don't care about testing git pbr in the requirements venv.
-    PIP_VIRTUAL_ENV=$PIP_VIRTUAL_ENV pip_install -U pbr setuptools
+    PIP_VIRTUAL_ENV=$PIP_VIRTUAL_ENV pip_install -U pbr setuptools[core]
     PIP_VIRTUAL_ENV=$PIP_VIRTUAL_ENV pip_install $REQUIREMENTS_DIR
 
     # Unset the PIP_VIRTUAL_ENV so that PBR does not end up trapped

From 9486709dc5e6f156dc5beb051f1861ea362ae10c Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Tue, 3 Dec 2024 17:07:57 +0000
Subject: [PATCH 2297/2409] Revert "Install simplejson in devstack venv"

This reverts commit 6990b06cd321930f69907ba42ee744755f8029fe. This
should no longer be necessary as packages are requiring simplejson.

Change-Id: I74b0f93457f91e7d53d54737d52f67075088faca
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
---
 inc/python | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/inc/python b/inc/python
index 857f1f2d06..bd58905e9e 100644
--- a/inc/python
+++ b/inc/python
@@ -42,9 +42,6 @@ function setup_devstack_virtualenv {
         # available on pypi.
         $PYTHON -m venv --system-site-packages "${DEVSTACK_VENV}"
         pip_install -U pip setuptools[core]
-        #NOTE(rpittau): workaround for simplejson removal in osc
-        #  https://review.opendev.org/c/openstack/python-openstackclient/+/920001
-        pip_install -U simplejson
     fi
     if [[ ":$PATH:" != *":$DEVSTACK_VENV/bin:"* ]] ; then
         export PATH="$DEVSTACK_VENV/bin:$PATH"

From 5bf9d13f2737ca9c8a15b7d250a48ef8be935a05 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Mon, 9 Dec 2024 14:03:44 +0000
Subject: [PATCH 2298/2409] lib/placement: Migrate placement to WSGI module
 path

Change-Id: If9e2cc9247d707a451ef394615e547515115f9e0
Signed-off-by: Stephen Finucane <sfinucan@redhat.com>
Depends-on: https://review.opendev.org/c/openstack/placement/+/919569
---
 lib/placement | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/placement b/lib/placement
index 6297ab24fe..03aaa0344b 100644
--- a/lib/placement
+++ b/lib/placement
@@ -37,7 +37,7 @@ if [[ ${USE_VENV} = True ]]; then
 else
     PLACEMENT_BIN_DIR=$(get_python_exec_prefix)
 fi
-PLACEMENT_UWSGI=$PLACEMENT_BIN_DIR/placement-api
+PLACEMENT_UWSGI=placement.wsgi.api:application
 PLACEMENT_UWSGI_CONF=$PLACEMENT_CONF_DIR/placement-uwsgi.ini
 
 if is_service_enabled tls-proxy; then
@@ -86,7 +86,7 @@ function configure_placement {
     sudo install -d -o $STACK_USER $PLACEMENT_CONF_DIR
     create_placement_conf
 
-    write_uwsgi_config "$PLACEMENT_UWSGI_CONF" "$PLACEMENT_UWSGI" "/placement"
+    write_uwsgi_config "$PLACEMENT_UWSGI_CONF" "$PLACEMENT_UWSGI" "/placement" "" "placement-api"
     if [[ "$PLACEMENT_ENFORCE_SCOPE" == "True" || "$ENFORCE_SCOPE" == "True" ]]; then
         iniset $PLACEMENT_CONF oslo_policy enforce_new_defaults True
         iniset $PLACEMENT_CONF oslo_policy enforce_scope True

From 05f7d302cfa2da73b2887afcde92ef65b1001194 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <sfinucan@redhat.com>
Date: Thu, 7 Dec 2023 10:48:10 +0000
Subject: [PATCH 2299/2409] lib/cinder: Migrate cinder to WSGI module path

Change-Id: I494dae51c65318299d4fe2ff5887c97ac2be3224
Signed-off-by: Stephen Finucane <sfinucan@redhat.com>
Depends-on: https://review.opendev.org/c/openstack/cinder/+/902876
---
 lib/cinder | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index 259018e7ab..b557d4b10b 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -62,7 +62,7 @@ CINDER_STATE_PATH=${CINDER_STATE_PATH:=$DATA_DIR/cinder}
 
 CINDER_CONF_DIR=/etc/cinder
 CINDER_CONF=$CINDER_CONF_DIR/cinder.conf
-CINDER_UWSGI=$CINDER_BIN_DIR/cinder-wsgi
+CINDER_UWSGI=cinder.wsgi.api:application
 CINDER_UWSGI_CONF=$CINDER_CONF_DIR/cinder-api-uwsgi.ini
 CINDER_API_PASTE_INI=$CINDER_CONF_DIR/api-paste.ini
 
@@ -404,7 +404,7 @@ function configure_cinder {
     setup_logging $CINDER_CONF
 
     if is_service_enabled c-api; then
-        write_uwsgi_config "$CINDER_UWSGI_CONF" "$CINDER_UWSGI" "/volume"
+        write_uwsgi_config "$CINDER_UWSGI_CONF" "$CINDER_UWSGI" "/volume" "" "cinder-api"
     fi
 
     if [[ -r $CINDER_PLUGINS/$CINDER_DRIVER ]]; then

From b8cbcff693f3f1ddfa9c60c7c826629987a2d23e Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Mon, 25 Mar 2024 20:00:10 +0900
Subject: [PATCH 2300/2409] Drop removed glance-cache.conf options

These were removed when glance-registry was removed[1].

[1] 30680961994b36ed12713c0f106b661535ce41c6

Change-Id: Iaa4a35fddcd4763e12e5140b71e4022421c476fc
---
 lib/glance | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/lib/glance b/lib/glance
index 5c3643d008..6d6b158e74 100644
--- a/lib/glance
+++ b/lib/glance
@@ -446,10 +446,6 @@ function configure_glance {
     iniset $GLANCE_CACHE_CONF DEFAULT use_syslog $SYSLOG
     iniset $GLANCE_CACHE_CONF DEFAULT image_cache_dir $GLANCE_CACHE_DIR/
     iniset $GLANCE_CACHE_CONF DEFAULT image_cache_driver $GLANCE_CACHE_DRIVER
-    iniset $GLANCE_CACHE_CONF DEFAULT auth_url $KEYSTONE_SERVICE_URI
-    iniset $GLANCE_CACHE_CONF DEFAULT admin_tenant_name $SERVICE_PROJECT_NAME
-    iniset $GLANCE_CACHE_CONF DEFAULT admin_user glance
-    iniset $GLANCE_CACHE_CONF DEFAULT admin_password $SERVICE_PASSWORD
 
     # Store specific confs
     iniset $GLANCE_CACHE_CONF glance_store filesystem_store_datadir $GLANCE_IMAGE_DIR/

From c9a4454450429491c34184d0ceb85eaba62cc525 Mon Sep 17 00:00:00 2001
From: Fernando Royo <froyo@redhat.com>
Date: Thu, 12 Dec 2024 11:01:36 +0100
Subject: [PATCH 2301/2409] Removing start_ovn_services call

The function _start_ovn is responsible for starting the
OVS/OVN services. However, its final action is a call
to _start_ovn_services, which restarts all OVS/OVN services
without any justified reason.

This patch removes that call to avoid unnecessarily
restarting all OVS/OVN services immediately after they
have been started.

Closes-Bug: #2091614
Change-Id: Ia791ecb734531fa933c570d687ac9224ed6b27e4
---
 lib/neutron_plugins/ovn_agent | 26 --------------------------
 1 file changed, 26 deletions(-)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index be3a9e78b2..b7633c8c17 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -704,30 +704,6 @@ function _start_ovs {
     fi
 }
 
-function _start_ovn_services {
-    _start_process "$OVSDB_SERVER_SERVICE"
-    _start_process "$OVS_VSWITCHD_SERVICE"
-
-    if is_service_enabled ovn-northd ; then
-        _start_process "$OVN_NORTHD_SERVICE"
-    fi
-    if is_service_enabled ovn-controller ; then
-        _start_process "$OVN_CONTROLLER_SERVICE"
-    fi
-    if is_service_enabled ovn-controller-vtep ; then
-        _start_process "$OVN_CONTROLLER_VTEP_SERVICE"
-    fi
-    if is_service_enabled ovs-vtep ; then
-        _start_process "devstack@ovs-vtep.service"
-    fi
-    if is_service_enabled q-ovn-metadata-agent neutron-ovn-metadata-agent ; then
-        _start_process "devstack@q-ovn-metadata-agent.service"
-    fi
-    if is_service_enabled q-ovn-agent neutron-ovn-agent ; then
-        _start_process "devstack@q-ovn-agent.service"
-    fi
-}
-
 # start_ovn() - Start running processes, including screen
 function start_ovn {
     echo "Starting OVN"
@@ -797,8 +773,6 @@ function start_ovn {
         # Format logging
         setup_logging $OVN_AGENT_CONF
     fi
-
-    _start_ovn_services
 }
 
 function _stop_ovs_dp {

From bf04bf517b839fa495384f636b7f8d4f05c6fa0e Mon Sep 17 00:00:00 2001
From: yatinkarel <ykarel@redhat.com>
Date: Fri, 27 Dec 2024 13:01:16 +0530
Subject: [PATCH 2302/2409] Switch to OVS/OVN LTS branches

As discussed in Epoxy PTG[1] switching jobs to run
with latest OVS/OVN LTS branches.
Ubuntu noble and CentOS 9-stream also including these
LTS versions.

[1] https://etherpad.opendev.org/p/oct2024-ptg-neutron

Change-Id: Iecb33628641cd33b6e46d09759e3180cc0bd55e9
---
 .zuul.yaml                     | 4 ++--
 lib/neutron_plugins/ovn_agent  | 2 +-
 lib/neutron_plugins/ovs_source | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 2fbfa0417c..74ce39cdfa 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -745,8 +745,8 @@
     vars:
       devstack_localrc:
         OVN_BUILD_FROM_SOURCE: True
-        OVN_BRANCH: "v21.06.0"
-        OVS_BRANCH: "a4b04276ab5934d087669ff2d191a23931335c87"
+        OVN_BRANCH: "branch-24.03"
+        OVS_BRANCH: "branch-3.3"
         OVS_SYSCONFDIR: "/usr/local/etc/openvswitch"
 
 - job:
diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index be3a9e78b2..ad5c1f3003 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -28,7 +28,7 @@ source ${TOP_DIR}/lib/neutron_plugins/ovs_source
 OVN_REPO=${OVN_REPO:-https://github.com/ovn-org/ovn.git}
 OVN_REPO_NAME=$(basename ${OVN_REPO} | cut -f1 -d'.')
 OVN_REPO_NAME=${OVN_REPO_NAME:-ovn}
-OVN_BRANCH=${OVN_BRANCH:-v20.06.1}
+OVN_BRANCH=${OVN_BRANCH:-branch-24.03}
 # The commit removing OVN bits from the OVS tree, it is the commit that is not
 # present in OVN tree and is used to distinguish if OVN is part of OVS or not.
 # https://github.com/openvswitch/ovs/commit/05bf1dbb98b0635a51f75e268ef8aed27601401d
diff --git a/lib/neutron_plugins/ovs_source b/lib/neutron_plugins/ovs_source
index 75e7d7cb36..6b6f531a01 100644
--- a/lib/neutron_plugins/ovs_source
+++ b/lib/neutron_plugins/ovs_source
@@ -20,7 +20,7 @@ Q_BUILD_OVS_FROM_GIT=$(trueorfalse False Q_BUILD_OVS_FROM_GIT)
 OVS_REPO=${OVS_REPO:-https://github.com/openvswitch/ovs.git}
 OVS_REPO_NAME=$(basename ${OVS_REPO} | cut -f1 -d'.')
 OVS_REPO_NAME=${OVS_REPO_NAME:-ovs}
-OVS_BRANCH=${OVS_BRANCH:-0047ca3a0290f1ef954f2c76b31477cf4b9755f5}
+OVS_BRANCH=${OVS_BRANCH:-branch-3.3}
 
 # Functions
 

From b609c80a36f7ac77c1eb7ec256e6808ab483440b Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Tue, 7 Jan 2025 10:51:03 +0900
Subject: [PATCH 2303/2409] doc: Use dnf instead of yum

The yum command has been replaced by the dnf command in recent releases
of Fedora-based distributions. Use the native command instead of
the alias kept for compatibility.

Change-Id: I0a1dfdaca91164eff2c25795f66976ec70356574
---
 doc/source/guides/multinode-lab.rst  | 2 +-
 doc/source/guides/single-machine.rst | 4 ++--
 doc/source/guides/single-vm.rst      | 4 ++--
 doc/source/networking.rst            | 2 +-
 doc/source/plugins.rst               | 2 +-
 5 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
index 658422b0af..4b50b2c4ae 100644
--- a/doc/source/guides/multinode-lab.rst
+++ b/doc/source/guides/multinode-lab.rst
@@ -24,7 +24,7 @@ Install a couple of packages to bootstrap configuration:
 
 ::
 
-    apt-get install -y git sudo || yum install -y git sudo
+    apt-get install -y git sudo || dnf install -y git sudo
 
 Network Configuration
 ---------------------
diff --git a/doc/source/guides/single-machine.rst b/doc/source/guides/single-machine.rst
index a4385b5b4b..263fbb9d6f 100644
--- a/doc/source/guides/single-machine.rst
+++ b/doc/source/guides/single-machine.rst
@@ -62,7 +62,7 @@ to have sudo privileges:
 
 .. code-block:: console
 
-    $ apt-get install sudo -y || yum install -y sudo
+    $ apt-get install sudo -y || dnf install -y sudo
     $ echo "stack ALL=(ALL) NOPASSWD: ALL" | sudo tee /etc/sudoers.d/stack
 
 .. note:: On some systems you may need to use ``sudo visudo``.
@@ -81,7 +81,7 @@ We'll grab the latest version of DevStack via https:
 
 .. code-block:: console
 
-    $ sudo apt-get install git -y || sudo yum install -y git
+    $ sudo apt-get install git -y || sudo dnf install -y git
     $ git clone https://opendev.org/openstack/devstack
     $ cd devstack
 
diff --git a/doc/source/guides/single-vm.rst b/doc/source/guides/single-vm.rst
index 7dac18b333..4272a4b180 100644
--- a/doc/source/guides/single-vm.rst
+++ b/doc/source/guides/single-vm.rst
@@ -56,8 +56,8 @@ passed as the user-data file when booting the VM.
     write_files:
       - content: |
             #!/bin/sh
-            DEBIAN_FRONTEND=noninteractive sudo apt-get -qqy update || sudo yum update -qy
-            DEBIAN_FRONTEND=noninteractive sudo apt-get install -qqy git || sudo yum install -qy git
+            DEBIAN_FRONTEND=noninteractive sudo apt-get -qqy update || sudo dnf update -qy
+            DEBIAN_FRONTEND=noninteractive sudo apt-get install -qqy git || sudo dnf install -qy git
             sudo chown stack:stack /home/stack
             cd /home/stack
             git clone https://opendev.org/openstack/devstack
diff --git a/doc/source/networking.rst b/doc/source/networking.rst
index 05b4f34164..10e1c3ff2c 100644
--- a/doc/source/networking.rst
+++ b/doc/source/networking.rst
@@ -213,7 +213,7 @@ install ``sshuttle`` on your localhost:
 
 .. code-block:: bash
 
-    sudo apt-get install sshuttle || yum install sshuttle
+    sudo apt-get install sshuttle || dnf install sshuttle
 
 Finally, start ``sshuttle`` on your localhost using the floating IP address
 range. For example, assuming you are using the default value for
diff --git a/doc/source/plugins.rst b/doc/source/plugins.rst
index dd75b5a22d..fe567e2277 100644
--- a/doc/source/plugins.rst
+++ b/doc/source/plugins.rst
@@ -232,7 +232,7 @@ an early phase of its execution.  These packages may be defined in a
 plugin as files that contain new-line separated lists of packages
 required by the plugin
 
-Supported packaging systems include apt and yum across multiple
+Supported packaging systems include apt and dnf across multiple
 distributions.  To enable a plugin to hook into this and install
 package dependencies, packages may be listed at the following
 locations in the top-level of the plugin repository:

From 9a1cdbc3c809f785ad01a3bbdfef8f552eafce30 Mon Sep 17 00:00:00 2001
From: Rajat Dhasmana <rajatdhasmana@gmail.com>
Date: Wed, 8 Jan 2025 18:43:40 +0530
Subject: [PATCH 2304/2409] Update glance image size limit

The image size limit for glance using the unified limits is
set to 1000MB (~1GB). This is pretty low given that a volume's
minimum size is 1GB and when uploaded to glance fills out the
whole limit.

The limit issue can also be seen by a recent tempest change[1]
where uploading two volumes failed[2] across various jobs due
to this limit.

We do have a config option in devstack
``GLANCE_LIMIT_IMAGE_SIZE_TOTAL`` but that will need to be
configured for various jobs and a 2GB seems to be a sensible
default which this patch configures.

[1] https://review.opendev.org/c/openstack/tempest/+/938592
[2] Jan 07 23:05:33 devstack-ceph cinder-volume[909965]: ERROR
oslo_messaging.rpc.server cinder.exception.ImageLimitExceeded:
HTTP 413 Request Entity Too Large: The request returned a 413
Request Entity Too Large. This generally means that rate limiting
or a quota threshold was breached.: The response body:: Project
dfe8648c188d46409349eac2c449c0b4 is over a limit for [Resource
image_size_total is over limit of 1000 due to current usage
1024 and delta 0]

Change-Id: I533b7444e5f71275ea3d5c18914e306b1dbbc5cb
---
 lib/glance | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/glance b/lib/glance
index 5c3643d008..9655cc4103 100644
--- a/lib/glance
+++ b/lib/glance
@@ -137,7 +137,7 @@ GLANCE_UWSGI=$GLANCE_BIN_DIR/glance-wsgi-api
 GLANCE_UWSGI_CONF=$GLANCE_CONF_DIR/glance-uwsgi.ini
 
 # Glance default limit for Devstack
-GLANCE_LIMIT_IMAGE_SIZE_TOTAL=${GLANCE_LIMIT_IMAGE_SIZE_TOTAL:-1000}
+GLANCE_LIMIT_IMAGE_SIZE_TOTAL=${GLANCE_LIMIT_IMAGE_SIZE_TOTAL:-2000}
 
 # If wsgi mode is uwsgi run glance under uwsgi, else default to eventlet
 # TODO(mtreinish): Remove the eventlet path here and in all the similar

From ad698f0b8c658fcdddb11d5edae1e77f08b5d0b5 Mon Sep 17 00:00:00 2001
From: Jakub Libosvar <libosvar@redhat.com>
Date: Wed, 8 Jan 2025 15:26:41 -0500
Subject: [PATCH 2305/2409] Introduce SERVICES_FOR_TEMPEST variable for localrc

This variable overrides the `ENABLED_SERVICES` global variable only for
the `configure_tempest()` function from `lib/tempest`. If the
`SERVICES_FOR_TEMPEST` variable is not defined then `ENABLED_SERVICES`
is used as it had used it before.

This is useful for cases where Tempest is executed from a remote node.

Change-Id: Ic62e48f2f1eb861ec64f51e03353868076cbcc04
---
 doc/source/guides/multinode-lab.rst | 42 +++++++++++++++++++++++++++++
 lib/tempest                         |  2 ++
 2 files changed, 44 insertions(+)

diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
index 658422b0af..e6b0b96eb4 100644
--- a/doc/source/guides/multinode-lab.rst
+++ b/doc/source/guides/multinode-lab.rst
@@ -210,6 +210,48 @@ only needs to be performed for subnodes.
 
 .. _Cells v2: https://docs.openstack.org/nova/latest/user/cells.html
 
+Configure Tempest Node to run the Tempest tests
+-----------------------------------------------
+
+If there is a need to execute Tempest tests against different Cluster
+Controller node then it can be done by re-using the ``local.conf`` file from
+the Cluster Controller node but with not enabled Controller services in
+``ENABLED_SERVICES`` variable. This variable needs to contain only ``tempest``
+as a configured service. Then variable ``SERVICES_FOR_TEMPEST`` must be
+configured to contain those services that were enabled on the Cluster
+Controller node in the ``ENABLED_SERVICES`` variable. For example the
+``local.conf`` file could look as follows:
+
+::
+
+    [[local|localrc]]
+    HOST_IP=192.168.42.12 # change this per compute node
+    FIXED_RANGE=10.4.128.0/20
+    FLOATING_RANGE=192.168.42.128/25
+    LOGFILE=/opt/stack/logs/stack.sh.log
+    ADMIN_PASSWORD=labstack
+    DATABASE_PASSWORD=supersecret
+    RABBIT_PASSWORD=supersecret
+    SERVICE_PASSWORD=supersecret
+    DATABASE_TYPE=mysql
+    SERVICE_HOST=192.168.42.11
+    MYSQL_HOST=$SERVICE_HOST
+    RABBIT_HOST=$SERVICE_HOST
+    GLANCE_HOSTPORT=$SERVICE_HOST:9292
+    NOVA_VNC_ENABLED=True
+    NOVNCPROXY_URL="http://$SERVICE_HOST:6080/vnc_lite.html"
+    VNCSERVER_LISTEN=$HOST_IP
+    VNCSERVER_PROXYCLIENT_ADDRESS=$VNCSERVER_LISTEN
+    ENABLED_SERVICES=tempest
+    SERVICES_FOR_TEMPEST=keystone,nova,neutron,glance
+
+Then just execute the devstack:
+
+::
+
+    ./stack.sh
+
+
 Cleaning Up After DevStack
 --------------------------
 
diff --git a/lib/tempest b/lib/tempest
index eeeef67a8b..b8f9915a87 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -197,6 +197,8 @@ function configure_tempest {
         pip_install_gr testrepository
     fi
 
+    local ENABLED_SERVICES=${SERVICES_FOR_TEMPEST:=$ENABLED_SERVICES}
+
     local image_lines
     local images
     local num_images

From a976168235bd79c9a8c960aa4889fe9ab03570c0 Mon Sep 17 00:00:00 2001
From: Fernando Royo <froyo@redhat.com>
Date: Wed, 4 Dec 2024 16:44:52 +0100
Subject: [PATCH 2306/2409] Refactor readiness and custom config for ovn-nortd

Initially, this patch ensured that the custom configuration
and readiness checks were applied after every restart of the
OVN North services. However, after removing the call that
triggered the restarting of the OVN/OVS services in [1],
this patch now serves as a refactor, separating the readiness
checks and custom configuration into a dedicated function.

[1] https://review.opendev.org/c/openstack/devstack/+/937606

Related-bug: #2091614
Related-bug: #2091019
Change-Id: Icba271292830204da94aa3353e93d52088d82eec
---
 lib/neutron_plugins/ovn_agent | 34 ++++++++++++++++++++--------------
 1 file changed, 20 insertions(+), 14 deletions(-)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index b7633c8c17..8c5d82d3f0 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -704,6 +704,25 @@ function _start_ovs {
     fi
 }
 
+function _wait_for_ovn_and_set_custom_config {
+    # Wait for the service to be ready
+    # Check for socket and db files for both OVN NB and SB
+    wait_for_sock_file $OVN_RUNDIR/ovnnb_db.sock
+    wait_for_sock_file $OVN_RUNDIR/ovnsb_db.sock
+    wait_for_db_file $OVN_DATADIR/ovnnb_db.db
+    wait_for_db_file $OVN_DATADIR/ovnsb_db.db
+
+    if is_service_enabled tls-proxy; then
+        sudo ovn-nbctl --db=unix:$OVN_RUNDIR/ovnnb_db.sock set-ssl $INT_CA_DIR/private/$DEVSTACK_CERT_NAME.key $INT_CA_DIR/$DEVSTACK_CERT_NAME.crt $INT_CA_DIR/ca-chain.pem
+        sudo ovn-sbctl --db=unix:$OVN_RUNDIR/ovnsb_db.sock set-ssl $INT_CA_DIR/private/$DEVSTACK_CERT_NAME.key $INT_CA_DIR/$DEVSTACK_CERT_NAME.crt $INT_CA_DIR/ca-chain.pem
+    fi
+
+    sudo ovn-nbctl --db=unix:$OVN_RUNDIR/ovnnb_db.sock set-connection p${OVN_PROTO}:6641:$SERVICE_LISTEN_ADDRESS -- set connection . inactivity_probe=60000
+    sudo ovn-sbctl --db=unix:$OVN_RUNDIR/ovnsb_db.sock set-connection p${OVN_PROTO}:6642:$SERVICE_LISTEN_ADDRESS -- set connection . inactivity_probe=60000
+    sudo ovs-appctl -t $OVN_RUNDIR/ovnnb_db.ctl vlog/set console:off syslog:$OVN_DBS_LOG_LEVEL file:$OVN_DBS_LOG_LEVEL
+    sudo ovs-appctl -t $OVN_RUNDIR/ovnsb_db.ctl vlog/set console:off syslog:$OVN_DBS_LOG_LEVEL file:$OVN_DBS_LOG_LEVEL
+}
+
 # start_ovn() - Start running processes, including screen
 function start_ovn {
     echo "Starting OVN"
@@ -725,21 +744,8 @@ function start_ovn {
             _start_process "$OVN_NORTHD_SERVICE"
         fi
 
-        # Wait for the service to be ready
-        # Check for socket and db files for both OVN NB and SB
-        wait_for_sock_file $OVN_RUNDIR/ovnnb_db.sock
-        wait_for_sock_file $OVN_RUNDIR/ovnsb_db.sock
-        wait_for_db_file $OVN_DATADIR/ovnnb_db.db
-        wait_for_db_file $OVN_DATADIR/ovnsb_db.db
+        _wait_for_ovn_and_set_custom_config
 
-        if is_service_enabled tls-proxy; then
-            sudo ovn-nbctl --db=unix:$OVN_RUNDIR/ovnnb_db.sock set-ssl $INT_CA_DIR/private/$DEVSTACK_CERT_NAME.key $INT_CA_DIR/$DEVSTACK_CERT_NAME.crt $INT_CA_DIR/ca-chain.pem
-            sudo ovn-sbctl --db=unix:$OVN_RUNDIR/ovnsb_db.sock set-ssl $INT_CA_DIR/private/$DEVSTACK_CERT_NAME.key $INT_CA_DIR/$DEVSTACK_CERT_NAME.crt $INT_CA_DIR/ca-chain.pem
-        fi
-        sudo ovn-nbctl --db=unix:$OVN_RUNDIR/ovnnb_db.sock set-connection p${OVN_PROTO}:6641:$SERVICE_LISTEN_ADDRESS -- set connection . inactivity_probe=60000
-        sudo ovn-sbctl --db=unix:$OVN_RUNDIR/ovnsb_db.sock set-connection p${OVN_PROTO}:6642:$SERVICE_LISTEN_ADDRESS -- set connection . inactivity_probe=60000
-        sudo ovs-appctl -t $OVN_RUNDIR/ovnnb_db.ctl vlog/set console:off syslog:$OVN_DBS_LOG_LEVEL file:$OVN_DBS_LOG_LEVEL
-        sudo ovs-appctl -t $OVN_RUNDIR/ovnsb_db.ctl vlog/set console:off syslog:$OVN_DBS_LOG_LEVEL file:$OVN_DBS_LOG_LEVEL
     fi
 
     if is_service_enabled ovn-controller ; then

From 7129f3a45e66060d19a250e31fd35156e45a8af8 Mon Sep 17 00:00:00 2001
From: Eric Harney <eharney@redhat.com>
Date: Fri, 10 Jan 2025 11:02:35 -0500
Subject: [PATCH 2307/2409] Quiet regex SyntaxWarning in mlock_report

Use a raw string to avoid SyntaxWarnings being
issued by this script.

Change-Id: I81557158013aa36fe27235c461486dfbc37c9f27
---
 tools/mlock_report.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/mlock_report.py b/tools/mlock_report.py
index 1b081bbe6f..8cbda15895 100644
--- a/tools/mlock_report.py
+++ b/tools/mlock_report.py
@@ -6,7 +6,7 @@
 
 
 LCK_SUMMARY_REGEX = re.compile(
-    "^VmLck:\s+(?P<locked>[\d]+)\s+kB", re.MULTILINE)
+    r"^VmLck:\s+(?P<locked>[\d]+)\s+kB", re.MULTILINE)
 
 
 def main():

From 497b4fdf97d8b4e5f1ea1130f4e145014bbb462c Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Fri, 18 Oct 2024 13:47:55 +0100
Subject: [PATCH 2308/2409] lib/glance: Migrate Glance to WSGI module path

We also remove an out-of-date note from the called method.

Change-Id: I7cc9fd6a568246342395388c31ae0a0918a2c79a
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
Depends-on: https://review.opendev.org/c/openstack/glance/+/932701
---
 lib/apache | 4 +---
 lib/glance | 7 +++----
 2 files changed, 4 insertions(+), 7 deletions(-)

diff --git a/lib/apache b/lib/apache
index 1c034d3c7e..fc174f3901 100644
--- a/lib/apache
+++ b/lib/apache
@@ -313,9 +313,7 @@ function write_uwsgi_config {
 # For services using chunked encoding, the only services known to use this
 # currently are Glance and Swift, we need to use an http proxy instead of
 # mod_proxy_uwsgi because the chunked encoding gets dropped. See:
-# https://github.com/unbit/uwsgi/issues/1540 You can workaround this on python2
-# but that involves having apache buffer the request before sending it to
-# uwsgi.
+# https://github.com/unbit/uwsgi/issues/1540.
 function write_local_uwsgi_http_config {
     local conf=$1
     local wsgi=$2
diff --git a/lib/glance b/lib/glance
index 9655cc4103..4e519102ec 100644
--- a/lib/glance
+++ b/lib/glance
@@ -133,7 +133,7 @@ GLANCE_SERVICE_PORT=${GLANCE_SERVICE_PORT:-9292}
 GLANCE_SERVICE_PORT_INT=${GLANCE_SERVICE_PORT_INT:-19292}
 GLANCE_HOSTPORT=${GLANCE_HOSTPORT:-$GLANCE_SERVICE_HOST:$GLANCE_SERVICE_PORT}
 GLANCE_SERVICE_PROTOCOL=${GLANCE_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
-GLANCE_UWSGI=$GLANCE_BIN_DIR/glance-wsgi-api
+GLANCE_UWSGI=glance.wsgi.api:application
 GLANCE_UWSGI_CONF=$GLANCE_CONF_DIR/glance-uwsgi.ini
 
 # Glance default limit for Devstack
@@ -472,12 +472,11 @@ function configure_glance {
     fi
 
     if [[ "$GLANCE_STANDALONE" == False ]]; then
-        write_local_uwsgi_http_config "$GLANCE_UWSGI_CONF" "$GLANCE_UWSGI" "/image"
+        write_local_uwsgi_http_config "$GLANCE_UWSGI_CONF" "$GLANCE_UWSGI" "/image" "glance-api"
         # Grab our uwsgi listen address and use that to fill out our
         # worker_self_reference_url config
         iniset $GLANCE_API_CONF DEFAULT worker_self_reference_url \
-               $(awk '-F= ' '/^http-socket/ { print "http://"$2}' \
-                    $GLANCE_UWSGI_CONF)
+               $(awk '-F= ' '/^http-socket/ { print "http://"$2}' $GLANCE_UWSGI_CONF)
     else
         write_local_proxy_http_config glance "http://$GLANCE_SERVICE_HOST:$GLANCE_SERVICE_PORT_INT" "/image"
         iniset $GLANCE_API_CONF DEFAULT bind_host $GLANCE_SERVICE_LISTEN_ADDRESS

From d84761e18676a04fc9d1b9e68dff9c573fdd3ba1 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Tue, 28 Jan 2025 02:20:15 +0000
Subject: [PATCH 2309/2409] Updated from generate-devstack-plugins-list

Change-Id: Ic2239e12306226943c645b7c439d5636f8c3df0e
---
 doc/source/plugin-registry.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 2984a5c15f..f7873c962d 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -38,6 +38,7 @@ openstack/devstack-plugin-container      `https://opendev.org/openstack/devstack
 openstack/devstack-plugin-kafka          `https://opendev.org/openstack/devstack-plugin-kafka <https://opendev.org/openstack/devstack-plugin-kafka>`__
 openstack/devstack-plugin-nfs            `https://opendev.org/openstack/devstack-plugin-nfs <https://opendev.org/openstack/devstack-plugin-nfs>`__
 openstack/devstack-plugin-open-cas       `https://opendev.org/openstack/devstack-plugin-open-cas <https://opendev.org/openstack/devstack-plugin-open-cas>`__
+openstack/devstack-plugin-prometheus     `https://opendev.org/openstack/devstack-plugin-prometheus <https://opendev.org/openstack/devstack-plugin-prometheus>`__
 openstack/freezer                        `https://opendev.org/openstack/freezer <https://opendev.org/openstack/freezer>`__
 openstack/freezer-api                    `https://opendev.org/openstack/freezer-api <https://opendev.org/openstack/freezer-api>`__
 openstack/freezer-tempest-plugin         `https://opendev.org/openstack/freezer-tempest-plugin <https://opendev.org/openstack/freezer-tempest-plugin>`__
@@ -169,7 +170,6 @@ x/rsd-virt-for-nova                      `https://opendev.org/x/rsd-virt-for-nov
 x/scalpels                               `https://opendev.org/x/scalpels <https://opendev.org/x/scalpels>`__
 x/slogging                               `https://opendev.org/x/slogging <https://opendev.org/x/slogging>`__
 x/stackube                               `https://opendev.org/x/stackube <https://opendev.org/x/stackube>`__
-x/tap-as-a-service-dashboard             `https://opendev.org/x/tap-as-a-service-dashboard <https://opendev.org/x/tap-as-a-service-dashboard>`__
 x/tatu                                   `https://opendev.org/x/tatu <https://opendev.org/x/tatu>`__
 x/trio2o                                 `https://opendev.org/x/trio2o <https://opendev.org/x/trio2o>`__
 x/valet                                  `https://opendev.org/x/valet <https://opendev.org/x/valet>`__

From a08a53de424e3ed8cad4cbaf566d0b08f8ad5199 Mon Sep 17 00:00:00 2001
From: Slawek Kaplonski <skaplons@redhat.com>
Date: Thu, 30 Jan 2025 12:43:30 +0100
Subject: [PATCH 2310/2409] Remove leftover from the usage of the removed
 lib/neutron module

In the patch [1] lib/neutron module was removed completely but it left
call to the non existing currently function 'start_neutron_api' when the
neutron-api service is enabled.
Devstack should start neutron in the same way in case when q-svc or
neutron-api service is enabled and this patch is removing that leftover
call to the 'start_neutron_api' function and make it behave the same way
for both service names.

Additionally this patch adds service "neutron-api" to be checked when
initial networks are going to be created. It is like that as just one of
the services "q-svc" or "neutron-api" is enough to create those initial
networks.

[1] https://review.opendev.org/c/openstack/devstack/+/865014

Related-bug: #2096912
Change-Id: I1287af6a31f60b4e522f0ce3ea525e3336ffd8ba
---
 stack.sh | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/stack.sh b/stack.sh
index bfa0573f21..b1c7df5d73 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1307,10 +1307,7 @@ if is_service_enabled ovn-controller ovn-controller-vtep; then
     start_ovn_services
 fi
 
-if is_service_enabled neutron-api; then
-    echo_summary "Starting Neutron"
-    start_neutron_api
-elif is_service_enabled q-svc; then
+if is_service_enabled q-svc neutron-api; then
     echo_summary "Starting Neutron"
     configure_neutron_after_post_config
     start_neutron_service_and_check
@@ -1327,7 +1324,7 @@ if is_service_enabled neutron; then
     start_neutron
 fi
 # Once neutron agents are started setup initial network elements
-if is_service_enabled q-svc && [[ "$NEUTRON_CREATE_INITIAL_NETWORKS" == "True" ]]; then
+if is_service_enabled q-svc neutron-api && [[ "$NEUTRON_CREATE_INITIAL_NETWORKS" == "True" ]]; then
     echo_summary "Creating initial neutron network elements"
     # Here's where plugins can wire up their own networks instead
     # of the code in lib/neutron_plugins/services/l3

From 12abc726e68b547258978c7fbe3630d133f72943 Mon Sep 17 00:00:00 2001
From: Brian Haley <haleyb.dev@gmail.com>
Date: Mon, 10 Feb 2025 13:48:37 -0500
Subject: [PATCH 2311/2409] Remove Neutron Linux Bridge agent code

Linux Bridge agent support was removed in the Neutron
master branch in [0], let's remove any code here now
as well since it will just fail.

[0] https://review.opendev.org/c/openstack/neutron/+/927216

Change-Id: Idffa6579000322acfeb860189fb83a317d56bb4e
---
 doc/source/guides/neutron.rst         |  40 +---------
 doc/source/overview.rst               |   2 +-
 lib/neutron                           |  19 +----
 lib/neutron_plugins/linuxbridge_agent | 104 --------------------------
 lib/neutron_plugins/ml2               |   3 -
 lib/neutron_plugins/services/l3       |  10 ---
 tools/worlddump.py                    |   1 -
 7 files changed, 3 insertions(+), 176 deletions(-)
 delete mode 100644 lib/neutron_plugins/linuxbridge_agent

diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index fb36b3ec5b..a7adeeff73 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -451,44 +451,6 @@ by default. If you want to remove all the extension drivers (even
 'port_security'), set ``Q_ML2_PLUGIN_EXT_DRIVERS`` to blank.
 
 
-Using Linux Bridge instead of Open vSwitch
-------------------------------------------
-
-The configuration for using the Linux Bridge ML2 driver is fairly
-straight forward. The Linux Bridge configuration for DevStack is similar
-to the :ref:`Open vSwitch based single interface <single-interface-ovs>`
-setup, with small modifications for the interface mappings.
-
-
-::
-
-    [[local|localrc]]
-    HOST_IP=172.18.161.6
-    SERVICE_HOST=172.18.161.6
-    MYSQL_HOST=172.18.161.6
-    RABBIT_HOST=172.18.161.6
-    GLANCE_HOSTPORT=172.18.161.6:9292
-    ADMIN_PASSWORD=secret
-    DATABASE_PASSWORD=secret
-    RABBIT_PASSWORD=secret
-    SERVICE_PASSWORD=secret
-
-    ## Neutron options
-    Q_USE_SECGROUP=True
-    FLOATING_RANGE="172.18.161.0/24"
-    IPV4_ADDRS_SAFE_TO_USE="10.0.0.0/24"
-    Q_FLOATING_ALLOCATION_POOL=start=172.18.161.250,end=172.18.161.254
-    PUBLIC_NETWORK_GATEWAY="172.18.161.1"
-    PUBLIC_INTERFACE=eth0
-
-    Q_USE_PROVIDERNET_FOR_PUBLIC=True
-
-    # Linuxbridge Settings
-    Q_AGENT=linuxbridge
-    LB_PHYSICAL_INTERFACE=eth0
-    PUBLIC_PHYSICAL_NETWORK=default
-    LB_INTERFACE_MAPPINGS=default:eth0
-
 Using MacVTap instead of Open vSwitch
 ------------------------------------------
 
@@ -556,7 +518,7 @@ the MacVTap mechanism driver:
 
     [[local|localrc]]
     ...
-    Q_ML2_PLUGIN_MECHANISM_DRIVERS=openvswitch,linuxbridge,macvtap
+    Q_ML2_PLUGIN_MECHANISM_DRIVERS=openvswitch,macvtap
     ...
 
 For the MacVTap compute node, use this local.conf:
diff --git a/doc/source/overview.rst b/doc/source/overview.rst
index 4384081769..81e58a341e 100644
--- a/doc/source/overview.rst
+++ b/doc/source/overview.rst
@@ -56,7 +56,7 @@ OpenStack Network
 -----------------
 
 -  Neutron: A basic configuration approximating the original FlatDHCP
-   mode using linuxbridge or OpenVSwitch.
+   mode using OpenVSwitch.
 
 Services
 --------
diff --git a/lib/neutron b/lib/neutron
index bcef8a5042..69ff212991 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -241,8 +241,7 @@ TENANT_VLAN_RANGE=${TENANT_VLAN_RANGE:-}
 # If using VLANs for tenant networks, or if using flat or VLAN
 # provider networks, set in ``localrc`` to the name of the physical
 # network, and also configure ``OVS_PHYSICAL_BRIDGE`` for the
-# openvswitch agent or ``LB_PHYSICAL_INTERFACE`` for the linuxbridge
-# agent, as described below.
+# openvswitch agent, as described below.
 #
 # Example: ``PHYSICAL_NETWORK=default``
 PHYSICAL_NETWORK=${PHYSICAL_NETWORK:-public}
@@ -257,18 +256,6 @@ PHYSICAL_NETWORK=${PHYSICAL_NETWORK:-public}
 # Example: ``OVS_PHYSICAL_BRIDGE=br-eth1``
 OVS_PHYSICAL_BRIDGE=${OVS_PHYSICAL_BRIDGE:-br-ex}
 
-# With the linuxbridge agent, if using VLANs for tenant networks,
-# or if using flat or VLAN provider networks, set in ``localrc`` to
-# the name of the network interface to use for the physical
-# network.
-#
-# Example: ``LB_PHYSICAL_INTERFACE=eth1``
-if [[ $Q_AGENT == "linuxbridge" && -z ${LB_PHYSICAL_INTERFACE} ]]; then
-    default_route_dev=$( (ip route; ip -6 route) | grep ^default | head -n 1 | awk '{print $5}')
-    die_if_not_set $LINENO default_route_dev "Failure retrieving default route device"
-    LB_PHYSICAL_INTERFACE=$default_route_dev
-fi
-
 # With the openvswitch plugin, set to True in ``localrc`` to enable
 # provider GRE tunnels when ``ENABLE_TENANT_TUNNELS`` is False.
 #
@@ -889,10 +876,6 @@ function cleanup_neutron {
         neutron_ovs_base_cleanup
     fi
 
-    if [[ $Q_AGENT == "linuxbridge" ]]; then
-        neutron_lb_cleanup
-    fi
-
     # delete all namespaces created by neutron
     for ns in $(sudo ip netns list | grep -o -E '(qdhcp|qrouter|fip|snat)-[0-9a-f-]*'); do
         sudo ip netns delete ${ns}
diff --git a/lib/neutron_plugins/linuxbridge_agent b/lib/neutron_plugins/linuxbridge_agent
deleted file mode 100644
index a392bd0baf..0000000000
--- a/lib/neutron_plugins/linuxbridge_agent
+++ /dev/null
@@ -1,104 +0,0 @@
-#!/bin/bash
-#
-# Neutron Linux Bridge L2 agent
-# -----------------------------
-
-# Save trace setting
-_XTRACE_NEUTRON_LB=$(set +o | grep xtrace)
-set +o xtrace
-
-function neutron_lb_cleanup {
-    sudo ip link delete $PUBLIC_BRIDGE
-
-    bridge_list=`ls /sys/class/net/*/bridge/bridge_id 2>/dev/null | cut -f5 -d/`
-    if [[ -z "$bridge_list" ]]; then
-        return
-    fi
-    if [[ "$Q_ML2_TENANT_NETWORK_TYPE" = "vxlan" ]]; then
-        for port in $(echo $bridge_list | grep -o -e [a-zA-Z\-]*tap[0-9a-f\-]* -e vxlan-[0-9a-f\-]*); do
-            sudo ip link delete $port
-        done
-    elif [[ "$Q_ML2_TENANT_NETWORK_TYPE" = "vlan" ]]; then
-        for port in $(echo $bridge_list | grep -o -e [a-zA-Z\-]*tap[0-9a-f\-]* -e ${LB_PHYSICAL_INTERFACE}\.[0-9a-f\-]*); do
-            sudo ip link delete $port
-        done
-    fi
-    for bridge in $(echo $bridge_list |grep -o -e brq[0-9a-f\-]*); do
-        sudo ip link delete $bridge
-    done
-}
-
-function is_neutron_ovs_base_plugin {
-    # linuxbridge doesn't use OVS
-    return 1
-}
-
-function neutron_plugin_create_nova_conf {
-    :
-}
-
-function neutron_plugin_install_agent_packages {
-    :
-}
-
-function neutron_plugin_configure_dhcp_agent {
-    local conf_file=$1
-    :
-}
-
-function neutron_plugin_configure_l3_agent {
-    local conf_file=$1
-    sudo ip link add $PUBLIC_BRIDGE type bridge
-    set_mtu $PUBLIC_BRIDGE $PUBLIC_BRIDGE_MTU
-}
-
-function neutron_plugin_configure_plugin_agent {
-    # Setup physical network interface mappings.  Override
-    # ``LB_VLAN_RANGES`` and ``LB_INTERFACE_MAPPINGS`` in ``localrc`` for more
-    # complex physical network configurations.
-    if [[ "$LB_INTERFACE_MAPPINGS" == "" ]] && [[ "$PHYSICAL_NETWORK" != "" ]] && [[ "$LB_PHYSICAL_INTERFACE" != "" ]]; then
-        LB_INTERFACE_MAPPINGS=$PHYSICAL_NETWORK:$LB_PHYSICAL_INTERFACE
-    fi
-    if [[ "$PUBLIC_BRIDGE" != "" ]] && [[ "$PUBLIC_PHYSICAL_NETWORK" != "" ]]; then
-        if is_service_enabled q-l3 || is_service_enabled neutron-l3; then
-            iniset /$Q_PLUGIN_CONF_FILE linux_bridge bridge_mappings "$PUBLIC_PHYSICAL_NETWORK:$PUBLIC_BRIDGE"
-        fi
-    fi
-    if [[ "$LB_INTERFACE_MAPPINGS" != "" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE linux_bridge physical_interface_mappings $LB_INTERFACE_MAPPINGS
-    fi
-    if [[ "$Q_USE_SECGROUP" == "True" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver neutron.agent.linux.iptables_firewall.IptablesFirewallDriver
-        if ! running_in_container; then
-            enable_kernel_bridge_firewall
-        fi
-    else
-        iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver neutron.agent.firewall.NoopFirewallDriver
-    fi
-    AGENT_BINARY="$NEUTRON_BIN_DIR/neutron-linuxbridge-agent"
-    iniset /$Q_PLUGIN_CONF_FILE agent tunnel_types $Q_TUNNEL_TYPES
-
-    # Configure vxlan tunneling
-    if [[ "$ENABLE_TENANT_TUNNELS" == "True" ]]; then
-        if [[ "$Q_ML2_TENANT_NETWORK_TYPE" == "vxlan" ]]; then
-            iniset /$Q_PLUGIN_CONF_FILE vxlan enable_vxlan "True"
-            iniset /$Q_PLUGIN_CONF_FILE vxlan local_ip $TUNNEL_ENDPOINT_IP
-        else
-            iniset /$Q_PLUGIN_CONF_FILE vxlan enable_vxlan "False"
-        fi
-    else
-        iniset /$Q_PLUGIN_CONF_FILE vxlan enable_vxlan "False"
-    fi
-}
-
-function neutron_plugin_setup_interface_driver {
-    local conf_file=$1
-    iniset $conf_file DEFAULT interface_driver linuxbridge
-}
-
-function neutron_plugin_check_adv_test_requirements {
-    is_service_enabled q-agt neutron-agent && is_service_enabled q-dhcp neutron-dhcp && return 0
-}
-
-# Restore xtrace
-$_XTRACE_NEUTRON_LB
diff --git a/lib/neutron_plugins/ml2 b/lib/neutron_plugins/ml2
index c2e78c65cc..687167bf79 100644
--- a/lib/neutron_plugins/ml2
+++ b/lib/neutron_plugins/ml2
@@ -114,9 +114,6 @@ function neutron_plugin_configure_service {
     populate_ml2_config /$Q_PLUGIN_CONF_FILE securitygroup enable_security_group=$Q_USE_SECGROUP
 
     populate_ml2_config /$Q_PLUGIN_CONF_FILE ml2 mechanism_drivers=$Q_ML2_PLUGIN_MECHANISM_DRIVERS
-    if [[ "$Q_ML2_PLUGIN_MECHANISM_DRIVERS" == *"linuxbridge"* ]]; then
-        iniset $NEUTRON_CONF experimental linuxbridge True
-    fi
     populate_ml2_config /$Q_PLUGIN_CONF_FILE ml2 overlay_ip_version=$TUNNEL_IP_VERSION
 
     if [[ -n "$Q_ML2_PLUGIN_TYPE_DRIVERS" ]]; then
diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index c6d4663114..bbedc57a44 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -334,16 +334,6 @@ function _neutron_configure_router_v4 {
         local ext_gw_interface="none"
         if is_neutron_ovs_base_plugin; then
             ext_gw_interface=$(_neutron_get_ext_gw_interface)
-        elif [[ "$Q_AGENT" = "linuxbridge" ]]; then
-            # Get the device the neutron router and network for $FIXED_RANGE
-            # will be using.
-            if [ "$Q_USE_PROVIDERNET_FOR_PUBLIC" = "True" ]; then
-                # in provider nets a bridge mapping uses the public bridge directly
-                ext_gw_interface=$PUBLIC_BRIDGE
-            else
-                # e.x. brq3592e767-da for NET_ID 3592e767-da66-4bcb-9bec-cdb03cd96102
-                ext_gw_interface=brq${EXT_NET_ID:0:11}
-            fi
         fi
         if [[ "$ext_gw_interface" != "none" ]]; then
             local cidr_len=${FLOATING_RANGE#*/}
diff --git a/tools/worlddump.py b/tools/worlddump.py
index edbfa268db..26ced3f653 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -31,7 +31,6 @@
     'nova-compute',
     'neutron-dhcp-agent',
     'neutron-l3-agent',
-    'neutron-linuxbridge-agent',
     'neutron-metadata-agent',
     'neutron-openvswitch-agent',
     'cinder-volume',

From 4a1d242a1a274e6d5d93c3d06055d313f4170a88 Mon Sep 17 00:00:00 2001
From: Sean Mooney <work@seanmooney.info>
Date: Wed, 5 Feb 2025 20:50:05 +0000
Subject: [PATCH 2312/2409] enable multinode supprot for spice and serial proxy

This change mirrors change Ie02734bb598d27560cf5d674c9e1d9b8dca3801f
which ensure that its posible to enable vnc for vms on compute nodes
without deploying the vnc proxy.

In this change two new flags are added NOVA_SPICE_ENABLED and
NOVA_SERIAL_ENABLED to enable configuration of the relevent console

create_nova_conf is also modifed to include the db url if the console
proxies are deployed on a host.

As spice supprot is nolonger avaible in qemu as packged by ubuntu 24.04
and centos 9 a devstack-two-node-debian-bookworm to allow testing with
spice in a multinode job.

Change-Id: Ie944e518122f2b0059f28acbf68fb7ad0a560ca4
---
 .zuul.yaml  | 30 ++++++++++++++++++++++++++++++
 lib/nova    |  9 ++++++---
 lib/tempest |  8 +++++++-
 3 files changed, 43 insertions(+), 4 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 74ce39cdfa..6cf79f5f03 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -311,6 +311,36 @@
           - compute1
           - compute2
 
+- nodeset:
+    name: devstack-two-node-debian-bookworm
+    nodes:
+      - name: controller
+        label: debian-bookworm
+      - name: compute1
+        label: debian-bookworm
+    groups:
+      # Node where tests are executed and test results collected
+      - name: tempest
+        nodes:
+          - controller
+      # Nodes running the compute service
+      - name: compute
+        nodes:
+          - controller
+          - compute1
+      # Nodes that are not the controller
+      - name: subnode
+        nodes:
+          - compute1
+      # Switch node for multinode networking setup
+      - name: switch
+        nodes:
+          - controller
+      # Peer nodes for multinode networking setup
+      - name: peers
+        nodes:
+          - compute1
+
 - job:
     name: devstack-base
     parent: openstack-multinode-fips
diff --git a/lib/nova b/lib/nova
index 95ed4d035c..810a3d9554 100644
--- a/lib/nova
+++ b/lib/nova
@@ -127,6 +127,9 @@ QEMU_CONF=/etc/libvirt/qemu.conf
 # ``NOVA_VNC_ENABLED`` can be used to forcibly enable VNC configuration.
 # In multi-node setups allows compute hosts to not run ``n-novnc``.
 NOVA_VNC_ENABLED=$(trueorfalse False NOVA_VNC_ENABLED)
+# same as ``NOVA_VNC_ENABLED`` but for Spice and serial console respectively.
+NOVA_SPICE_ENABLED=$(trueorfalse False NOVA_SPICE_ENABLED)
+NOVA_SERIAL_ENABLED=$(trueorfalse False NOVA_SERIAL_ENABLED)
 
 # Get hypervisor configuration
 # ----------------------------
@@ -464,7 +467,7 @@ function create_nova_conf {
     # only setup database connections and cache backend if there are services
     # that require them running on the host. The ensures that n-cpu doesn't
     # leak a need to use the db in a multinode scenario.
-    if is_service_enabled n-api n-cond n-sched; then
+    if is_service_enabled n-api n-cond n-sched n-spice n-novnc n-sproxy; then
         # If we're in multi-tier cells mode, we want our control services pointing
         # at cell0 instead of cell1 to ensure isolation. If not, we point everything
         # at the main database like normal.
@@ -716,7 +719,7 @@ function configure_console_compute {
         iniset $NOVA_CPU_CONF vnc enabled false
     fi
 
-    if is_service_enabled n-spice; then
+    if is_service_enabled n-spice || [ "$NOVA_SPICE_ENABLED" != False ]; then
         # Address on which instance spiceservers will listen on compute hosts.
         # For multi-host, this should be the management ip of the compute host.
         SPICESERVER_PROXYCLIENT_ADDRESS=${SPICESERVER_PROXYCLIENT_ADDRESS:-$default_proxyclient_addr}
@@ -726,7 +729,7 @@ function configure_console_compute {
         iniset $NOVA_CPU_CONF spice server_proxyclient_address "$SPICESERVER_PROXYCLIENT_ADDRESS"
     fi
 
-    if is_service_enabled n-sproxy; then
+    if is_service_enabled n-sproxy || [ "$NOVA_SERIAL_ENABLED" != False ]; then
         iniset $NOVA_CPU_CONF serial_console enabled True
         iniset $NOVA_CPU_CONF serial_console base_url "ws://$SERVICE_HOST:$((6082 + offset))/"
     fi
diff --git a/lib/tempest b/lib/tempest
index b8f9915a87..29b01f186f 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -514,9 +514,15 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG compute-feature-enabled volume_multiattach True
     fi
 
-    if is_service_enabled n-novnc; then
+    if is_service_enabled n-novnc || [ "$NOVA_VNC_ENABLED" != False ]; then
         iniset $TEMPEST_CONFIG compute-feature-enabled vnc_console True
     fi
+    if is_service_enabled n-spice || [ "$NOVA_SPICE_ENABLED" != False ]; then
+        iniset $TEMPEST_CONFIG compute-feature-enabled spice_console True
+    fi
+    if is_service_enabled n-sproxy || [ "$NOVA_SERIAL_ENABLED" != False ]; then
+        iniset $TEMPEST_CONFIG compute-feature-enabled serial_console True
+    fi
 
     # Network
     iniset $TEMPEST_CONFIG network project_networks_reachable false

From 754f1c66f53240e3ebda53fbb95bfdeee05b5796 Mon Sep 17 00:00:00 2001
From: Rodolfo Alonso Hernandez <ralonsoh@redhat.com>
Date: Thu, 13 Feb 2025 08:39:24 +0000
Subject: [PATCH 2313/2409] [eventlet-removal] Remove "logger" mechanism from
 ML2/OVN CI jobs

The "logger" mechanism is a testing class that is still calling
monkey_patch. This mechanism driver is not relevant nor neccessary
for the ML2/OVN CI jobs.

Change-Id: I539b202ca81f62f4ae26b5275fd6b245d2066fe7
---
 lib/neutron_plugins/ovn_agent | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index 01dc1edfdd..71b5e3350d 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -161,8 +161,10 @@ fi
 
 # Defaults Overwrite
 # ------------------
-
-Q_ML2_PLUGIN_MECHANISM_DRIVERS=${Q_ML2_PLUGIN_MECHANISM_DRIVERS:-ovn,logger}
+# NOTE(ralonsoh): during the eventlet removal, the "logger" mech
+# driver has been removed from this list. Re-add it once the removal
+# is finished or the mech driver does not call monkey_patch().
+Q_ML2_PLUGIN_MECHANISM_DRIVERS=${Q_ML2_PLUGIN_MECHANISM_DRIVERS:-ovn}
 Q_ML2_PLUGIN_TYPE_DRIVERS=${Q_ML2_PLUGIN_TYPE_DRIVERS:-local,flat,vlan,geneve}
 Q_ML2_TENANT_NETWORK_TYPE=${Q_ML2_TENANT_NETWORK_TYPE:-"geneve"}
 Q_ML2_PLUGIN_GENEVE_TYPE_OPTIONS=${Q_ML2_PLUGIN_GENEVE_TYPE_OPTIONS:-"vni_ranges=1:65536"}

From 1aac81ee881534276fd7d6540ed356a85d064a13 Mon Sep 17 00:00:00 2001
From: Vasyl Saienko <vsaienko@mirantis.com>
Date: Sat, 18 Jan 2025 08:40:51 +0000
Subject: [PATCH 2314/2409] Allow to enable atop

It may be required to troubleshoot performance related bugs during
tests exection, to have ability to inspect environment processes
and theirs status during test run this patch installs atop
by default if not explicitly disabled.

Related-Bug: #2095224

Change-Id: Iedbd61f3ce3cd2255ea5f2a7a93ba2f39ad28ff2
---
 .zuul.yaml |  1 +
 lib/atop   | 48 ++++++++++++++++++++++++++++++++++++++++++++++++
 stack.sh   |  7 +++++++
 unstack.sh |  5 +++++
 4 files changed, 61 insertions(+)
 create mode 100644 lib/atop

diff --git a/.zuul.yaml b/.zuul.yaml
index 74ce39cdfa..aec7113ab4 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -357,6 +357,7 @@
         '{{ devstack_conf_dir }}/.localrc.auto': logs
         '{{ devstack_conf_dir }}/.stackenv': logs
         '{{ devstack_log_dir }}/dstat-csv.log': logs
+        '{{ devstack_log_dir }}/atop': logs
         '{{ devstack_log_dir }}/devstacklog.txt': logs
         '{{ devstack_log_dir }}/devstacklog.txt.summary': logs
         '{{ devstack_log_dir }}/tcpdump.pcap': logs
diff --git a/lib/atop b/lib/atop
new file mode 100644
index 0000000000..e0b14cb039
--- /dev/null
+++ b/lib/atop
@@ -0,0 +1,48 @@
+#!/bin/bash
+#
+# lib/atop
+# Functions to start and stop atop
+
+# Dependencies:
+#
+# - ``functions`` file
+
+# ``stack.sh`` calls the entry points in this order:
+#
+# - configure_atop
+# - install_atop
+# - start_atop
+# - stop_atop
+
+# Save trace setting
+_XTRACE_ATOP=$(set +o | grep xtrace)
+set +o xtrace
+
+function configure_atop {
+        cat <<EOF | sudo tee /etc/default/atop >/dev/null
+# /etc/default/atop
+# see man atoprc for more possibilities to configure atop execution
+
+LOGOPTS="-R"
+LOGINTERVAL=${ATOP_LOGINTERVAL:-"30"}
+LOGGENERATIONS=${ATOP_LOGGENERATIONS:-"1"}
+LOGPATH=$LOGDIR/atop
+EOF
+}
+
+function install_atop {
+    install_package atop
+}
+
+# start_() - Start running processes
+function start_atop {
+    start_service atop
+}
+
+# stop_atop() stop atop process
+function stop_atop {
+    stop_service atop
+}
+
+# Restore xtrace
+$_XTRACE_ATOP
diff --git a/stack.sh b/stack.sh
index bfa0573f21..c2a4b5dc9a 100755
--- a/stack.sh
+++ b/stack.sh
@@ -641,6 +641,7 @@ source $TOP_DIR/lib/swift
 source $TOP_DIR/lib/neutron
 source $TOP_DIR/lib/ldap
 source $TOP_DIR/lib/dstat
+source $TOP_DIR/lib/atop
 source $TOP_DIR/lib/tcpdump
 source $TOP_DIR/lib/etcd3
 source $TOP_DIR/lib/os-vif
@@ -1093,6 +1094,12 @@ save_stackenv $LINENO
 # A better kind of sysstat, with the top process per time slice
 start_dstat
 
+if is_service_enabled atop; then
+    configure_atop
+    install_atop
+    start_atop
+fi
+
 # Run a background tcpdump for debugging
 # Note: must set TCPDUMP_ARGS with the enabled service
 if is_service_enabled tcpdump; then
diff --git a/unstack.sh b/unstack.sh
index 1b2d8dd62a..29c80718f8 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -73,6 +73,7 @@ source $TOP_DIR/lib/swift
 source $TOP_DIR/lib/neutron
 source $TOP_DIR/lib/ldap
 source $TOP_DIR/lib/dstat
+source $TOP_DIR/lib/atop
 source $TOP_DIR/lib/etcd3
 
 # Extras Source
@@ -174,6 +175,10 @@ fi
 
 stop_dstat
 
+if is_service_enabled atop; then
+    stop_atop
+fi
+
 # NOTE: Cinder automatically installs the lvm2 package, independently of the
 # enabled backends. So if Cinder is enabled, and installed successfully we are
 # sure lvm2 (lvremove, /etc/lvm/lvm.conf, etc.) is here.

From 4ed29f85911642fb5d01f919703697746be19d7c Mon Sep 17 00:00:00 2001
From: Christian Schwede <cschwede@redhat.com>
Date: Wed, 26 Feb 2025 11:40:10 +0100
Subject: [PATCH 2315/2409] Fix Swift rsync/replication configuration

Swift rsync and replication services are up and running, however they
fail to replicate any data if needed and if used with more than one
replica.

This patch removes a deprecated option setting[1] and replaces it with
the required setting to use the correct rsync module suffix.

Additionally it removes an outdated subdirectory suffix in the rsyncd
configuration that has been removed as well[2].

Closes-Bug: #2100272

[1] https://opendev.org/openstack/swift/commit/675145ef4a131d548cc1122689732b9b65e5def4
[2] https://opendev.org/openstack/devstack/commit/0e58d22897457831b9dbf02d66a2f29d43803597

Change-Id: I5283405d00883a4dd11b7c001b1bba3776e576b8
---
 files/swift/rsyncd.conf | 24 ++++++++++++------------
 lib/swift               |  4 ++--
 2 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/files/swift/rsyncd.conf b/files/swift/rsyncd.conf
index c49f716fa7..937d6c4b9a 100644
--- a/files/swift/rsyncd.conf
+++ b/files/swift/rsyncd.conf
@@ -6,74 +6,74 @@ address = 127.0.0.1
 
 [account6612]
 max connections = 25
-path = %SWIFT_DATA_DIR%/1/node/
+path = %SWIFT_DATA_DIR%/1/
 read only = false
 lock file = %SWIFT_DATA_DIR%/run/account6612.lock
 
 [account6622]
 max connections = 25
-path = %SWIFT_DATA_DIR%/2/node/
+path = %SWIFT_DATA_DIR%/2/
 read only = false
 lock file = %SWIFT_DATA_DIR%/run/account6622.lock
 
 [account6632]
 max connections = 25
-path = %SWIFT_DATA_DIR%/3/node/
+path = %SWIFT_DATA_DIR%/3/
 read only = false
 lock file = %SWIFT_DATA_DIR%/run/account6632.lock
 
 [account6642]
 max connections = 25
-path = %SWIFT_DATA_DIR%/4/node/
+path = %SWIFT_DATA_DIR%/4/
 read only = false
 lock file = %SWIFT_DATA_DIR%/run/account6642.lock
 
 
 [container6611]
 max connections = 25
-path = %SWIFT_DATA_DIR%/1/node/
+path = %SWIFT_DATA_DIR%/1/
 read only = false
 lock file = %SWIFT_DATA_DIR%/run/container6611.lock
 
 [container6621]
 max connections = 25
-path = %SWIFT_DATA_DIR%/2/node/
+path = %SWIFT_DATA_DIR%/2/
 read only = false
 lock file = %SWIFT_DATA_DIR%/run/container6621.lock
 
 [container6631]
 max connections = 25
-path = %SWIFT_DATA_DIR%/3/node/
+path = %SWIFT_DATA_DIR%/3/
 read only = false
 lock file = %SWIFT_DATA_DIR%/run/container6631.lock
 
 [container6641]
 max connections = 25
-path = %SWIFT_DATA_DIR%/4/node/
+path = %SWIFT_DATA_DIR%/4/
 read only = false
 lock file = %SWIFT_DATA_DIR%/run/container6641.lock
 
 
 [object6613]
 max connections = 25
-path = %SWIFT_DATA_DIR%/1/node/
+path = %SWIFT_DATA_DIR%/1/
 read only = false
 lock file = %SWIFT_DATA_DIR%/run/object6613.lock
 
 [object6623]
 max connections = 25
-path = %SWIFT_DATA_DIR%/2/node/
+path = %SWIFT_DATA_DIR%/2/
 read only = false
 lock file = %SWIFT_DATA_DIR%/run/object6623.lock
 
 [object6633]
 max connections = 25
-path = %SWIFT_DATA_DIR%/3/node/
+path = %SWIFT_DATA_DIR%/3/
 read only = false
 lock file = %SWIFT_DATA_DIR%/run/object6633.lock
 
 [object6643]
 max connections = 25
-path = %SWIFT_DATA_DIR%/4/node/
+path = %SWIFT_DATA_DIR%/4/
 read only = false
 lock file = %SWIFT_DATA_DIR%/run/object6643.lock
diff --git a/lib/swift b/lib/swift
index 3659624d5b..862927437d 100644
--- a/lib/swift
+++ b/lib/swift
@@ -318,8 +318,8 @@ function generate_swift_config_services {
     iniuncomment ${swift_node_config} DEFAULT mount_check
     iniset ${swift_node_config} DEFAULT mount_check false
 
-    iniuncomment ${swift_node_config} ${server_type}-replicator vm_test_mode
-    iniset ${swift_node_config} ${server_type}-replicator vm_test_mode yes
+    iniuncomment ${swift_node_config} ${server_type}-replicator rsync_module
+    iniset ${swift_node_config} ${server_type}-replicator rsync_module "{replication_ip}::${server_type}{replication_port}"
 
     # Using a sed and not iniset/iniuncomment because we want to a global
     # modification and make sure it works for new sections.

From e650b827904fe8835800a96332937bb1c8f4516e Mon Sep 17 00:00:00 2001
From: Rajat Dhasmana <rajatdhasmana@gmail.com>
Date: Wed, 26 Feb 2025 00:38:26 +0530
Subject: [PATCH 2316/2409] Tempest: Add support for extend attached encrypted
 volumes tests

We've LUKSv1 and LUKSv2 tests[1] in tempest that requires the
``extend_attached_encrypted_volume`` option to be True but
currently there is no way to set it in devstack.
This patch adds the parameter
``TEMPEST_EXTEND_ATTACHED_ENCRYPTED_VOLUME`` to enable the tests.

[1] https://github.com/openstack/tempest/blob/cb03598a65f47c51406fc86c9c1503fe42424848/tempest/api/volume/admin/test_encrypted_volumes_extend.py

Change-Id: Id3a3483629794ac38cb314812eeff84b677f35cd
---
 lib/tempest | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/tempest b/lib/tempest
index 29b01f186f..c9486f6310 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -586,6 +586,7 @@ function configure_tempest {
         TEMPEST_VOLUME_REVERT_TO_SNAPSHOT=${TEMPEST_VOLUME_REVERT_TO_SNAPSHOT:-True}
     fi
     iniset $TEMPEST_CONFIG volume-feature-enabled volume_revert $(trueorfalse False TEMPEST_VOLUME_REVERT_TO_SNAPSHOT)
+    iniset $TEMPEST_CONFIG volume-feature-enabled extend_attached_encrypted_volume ${TEMPEST_EXTEND_ATTACHED_ENCRYPTED_VOLUME:-False}
     if [[ "$CINDER_BACKUP_DRIVER" == *"swift"* ]]; then
         iniset $TEMPEST_CONFIG volume backup_driver swift
     fi

From 85576bbfd430a9f419fbd837dfa20a2ef687da94 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Wed, 26 Feb 2025 18:04:09 +0000
Subject: [PATCH 2317/2409] tools: Set user_domain_id in generated clouds.yaml
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

If you specify a username, you also need to specify a domain that the
user exists in. Failure to do so results in the following error:

  Expecting to find domain in user. The server could not comply with the
  request since it is either malformed or otherwise incorrect. The
  client is assumed to be in error. (HTTP 400)␏

This was mostly being masked for us in python-openstackclient by this
little helper in osc-lib [1], but we can't rely on that for openstacksdk
(and shouldn't really rely on it elsewhere either).

We also deprecate the '--os-identity-api-version' and
'--os-volume-api-version' options and will remove them shortly: both
services only have v3 APIs nowadays.

[1] https://github.com/openstack/osc-lib/blob/3.2.0/osc_lib/cli/client_config.py#L136-L147

Change-Id: I5537b0a7d58efb8a325ed61bad358f677f7a3cdf
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
---
 lib/keystone                |  2 +-
 tools/update_clouds_yaml.py | 29 ++++++++++++++++++++---------
 2 files changed, 21 insertions(+), 10 deletions(-)

diff --git a/lib/keystone b/lib/keystone
index 76e2598ba3..8371045026 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -592,7 +592,7 @@ function bootstrap_keystone {
 # create_ldap_domain() - Create domain file and initialize domain with a user
 function create_ldap_domain {
     # Creates domain Users
-    openstack --os-identity-api-version=3 domain create --description "LDAP domain" Users
+    openstack domain create --description "LDAP domain" Users
 
     # Create domain file inside etc/keystone/domains
     KEYSTONE_LDAP_DOMAIN_FILE=$KEYSTONE_CONF_DIR/domains/keystone.Users.conf
diff --git a/tools/update_clouds_yaml.py b/tools/update_clouds_yaml.py
index 74dcdb2a07..c0a54838cc 100755
--- a/tools/update_clouds_yaml.py
+++ b/tools/update_clouds_yaml.py
@@ -14,14 +14,14 @@
 
 # Update the clouds.yaml file.
 
-
 import argparse
 import os.path
+import sys
 
 import yaml
 
 
-class UpdateCloudsYaml(object):
+class UpdateCloudsYaml:
     def __init__(self, args):
         if args.file:
             self._clouds_path = args.file
@@ -32,6 +32,14 @@ def __init__(self, args):
             self._create_directory = True
         self._clouds = {}
 
+        if args.os_identity_api_version != '3':
+            print("ERROR: Only identity API v3 is supported")
+            sys.exit(1)
+
+        if args.os_volume_api_version != '3':
+            print("ERROR: Only block storage API v3 is supported")
+            sys.exit(1)
+
         self._cloud = args.os_cloud
         self._cloud_data = {
             'region_name': args.os_region_name,
@@ -40,20 +48,23 @@ def __init__(self, args):
             'auth': {
                 'auth_url': args.os_auth_url,
                 'username': args.os_username,
+                'user_domain_id': 'default',
                 'password': args.os_password,
             },
         }
+
         if args.os_project_name and args.os_system_scope:
             print(
-                "WARNING: os_project_name and os_system_scope were both"
-                " given. os_system_scope will take priority.")
-        if args.os_project_name and not args.os_system_scope:
+                "WARNING: os_project_name and os_system_scope were both "
+                "given. os_system_scope will take priority."
+            )
+
+        if args.os_system_scope:  # system-scoped
+            self._cloud_data['auth']['system_scope'] = args.os_system_scope
+        elif args.os_project_name:  # project-scoped
             self._cloud_data['auth']['project_name'] = args.os_project_name
-        if args.os_identity_api_version == '3' and not args.os_system_scope:
-            self._cloud_data['auth']['user_domain_id'] = 'default'
             self._cloud_data['auth']['project_domain_id'] = 'default'
-        if args.os_system_scope:
-            self._cloud_data['auth']['system_scope'] = args.os_system_scope
+
         if args.os_cacert:
             self._cloud_data['cacert'] = args.os_cacert
 

From 1c96b4ef5fbe5425d9c6e80b34bbb805a31a0808 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Wed, 26 Feb 2025 18:12:23 +0000
Subject: [PATCH 2318/2409] openrc: Stop setting OS_VOLUME_API_VERSION,
 CINDER_VERSION

We have not needed these in years.

Change-Id: I4d76a7d3a8513ce5a927d533b34fb609e5dacdfa
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
---
 openrc | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/openrc b/openrc
index 5ec7634638..e800abeb3d 100644
--- a/openrc
+++ b/openrc
@@ -72,8 +72,3 @@ if [[ ! -v OS_CACERT ]] ; then
         export OS_CACERT=$DEFAULT_OS_CACERT
     fi
 fi
-
-# Currently cinderclient needs you to specify the *volume api* version. This
-# needs to match the config of your catalog returned by Keystone.
-export CINDER_VERSION=${CINDER_VERSION:-3}
-export OS_VOLUME_API_VERSION=${OS_VOLUME_API_VERSION:-$CINDER_VERSION}

From ca15453625638d2660b7fd2fce261096f9f15dd0 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Thu, 27 Feb 2025 13:24:31 +0000
Subject: [PATCH 2319/2409] tools: Remove --os-identity-api-version,
 --os-volume-api-version opts

There is only one volume API and one identity API, and their collective
number is 3.

Change-Id: Ie269817c5bb0eddd8cfcf279a46cffe4a56377b2
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
Depends-on: https://review.opendev.org/c/openstack/openstacksdk/+/942898
---
 tools/update_clouds_yaml.py | 12 ------------
 1 file changed, 12 deletions(-)

diff --git a/tools/update_clouds_yaml.py b/tools/update_clouds_yaml.py
index c0a54838cc..87312d9469 100755
--- a/tools/update_clouds_yaml.py
+++ b/tools/update_clouds_yaml.py
@@ -32,19 +32,9 @@ def __init__(self, args):
             self._create_directory = True
         self._clouds = {}
 
-        if args.os_identity_api_version != '3':
-            print("ERROR: Only identity API v3 is supported")
-            sys.exit(1)
-
-        if args.os_volume_api_version != '3':
-            print("ERROR: Only block storage API v3 is supported")
-            sys.exit(1)
-
         self._cloud = args.os_cloud
         self._cloud_data = {
             'region_name': args.os_region_name,
-            'identity_api_version': args.os_identity_api_version,
-            'volume_api_version': args.os_volume_api_version,
             'auth': {
                 'auth_url': args.os_auth_url,
                 'username': args.os_username,
@@ -100,8 +90,6 @@ def main():
     parser.add_argument('--file')
     parser.add_argument('--os-cloud', required=True)
     parser.add_argument('--os-region-name', default='RegionOne')
-    parser.add_argument('--os-identity-api-version', default='3')
-    parser.add_argument('--os-volume-api-version', default='3')
     parser.add_argument('--os-cacert')
     parser.add_argument('--os-auth-url', required=True)
     parser.add_argument('--os-username', required=True)

From a0938e6dcf93d77530685391b7850d34ffa206fc Mon Sep 17 00:00:00 2001
From: Ivan Anfimov <lazekteam@gmail.com>
Date: Sat, 1 Mar 2025 20:46:26 +0000
Subject: [PATCH 2320/2409] Fix for CSS problems in Horizon

After installation DevStack icons are not displayed.

Change-Id: I1bedf97e4d2b7f13b4a0c5b98e29ac53cf502e96
Closes-Bug: #2093844
---
 files/apache-horizon.template | 1 +
 1 file changed, 1 insertion(+)

diff --git a/files/apache-horizon.template b/files/apache-horizon.template
index da7a7d26c3..98d02e168e 100644
--- a/files/apache-horizon.template
+++ b/files/apache-horizon.template
@@ -10,6 +10,7 @@
     DocumentRoot %HORIZON_DIR%/.blackhole/
     Alias %WEBROOT%/media %HORIZON_DIR%/openstack_dashboard/static
     Alias %WEBROOT%/static %HORIZON_DIR%/static
+    Alias /static %HORIZON_DIR%/static
 
     RedirectMatch "^/$" "%WEBROOT%/"
 

From 9f2f499ded039dc2545c4e8860204f013f460350 Mon Sep 17 00:00:00 2001
From: Vasyl Saienko <vsaienko@mirantis.com>
Date: Fri, 28 Feb 2025 07:47:11 +0000
Subject: [PATCH 2321/2409] Pre create logs directory for atop

The race may happen and atop can't start due to missing
logs directory. This patch pre-creates directory before
starting atop process.

Closes-Bug: #2100871

Change-Id: I89e3100dc86d60266913b5c5776db65e8882847c
---
 lib/atop | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/atop b/lib/atop
index e0b14cb039..25c8e9a83f 100644
--- a/lib/atop
+++ b/lib/atop
@@ -19,7 +19,8 @@ _XTRACE_ATOP=$(set +o | grep xtrace)
 set +o xtrace
 
 function configure_atop {
-        cat <<EOF | sudo tee /etc/default/atop >/dev/null
+    mkdir -p $LOGDIR/atop
+    cat <<EOF | sudo tee /etc/default/atop >/dev/null
 # /etc/default/atop
 # see man atoprc for more possibilities to configure atop execution
 

From ab9fb4eb8732b1cc5505b8c9e722a7310038efdf Mon Sep 17 00:00:00 2001
From: Brian Haley <haleyb.dev@gmail.com>
Date: Wed, 5 Mar 2025 09:34:25 -0500
Subject: [PATCH 2322/2409] Remove openstack network section from overview

This section is old and doesn't make much sense
anymore, let's remove it. Neutron is already mentioned
as a default service and has its own config guide.

TrivialFix

Change-Id: I2a2ed574f9eca7b87fb9bb6422568ed4fc55f057
---
 doc/source/overview.rst | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/doc/source/overview.rst b/doc/source/overview.rst
index 81e58a341e..c978e8d2cf 100644
--- a/doc/source/overview.rst
+++ b/doc/source/overview.rst
@@ -52,12 +52,6 @@ Web Server
 
 -  Apache
 
-OpenStack Network
------------------
-
--  Neutron: A basic configuration approximating the original FlatDHCP
-   mode using OpenVSwitch.
-
 Services
 --------
 

From 0572e59775c91494fb6009ac4be539fb892226c7 Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Sat, 15 Mar 2025 10:44:05 +0900
Subject: [PATCH 2323/2409] Skip functional tests for .gitreview update

... because the file does not affect any functionality.

Also apply the consistent irrelevant files to skip functional tests to
avoid unnecessary jobs.

Change-Id: Ibce79d6b7627c26aa69989ed17ae32d7c3b63d19
---
 .zuul.yaml | 72 +++++++++++++++---------------------------------------
 1 file changed, 20 insertions(+), 52 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 7d72ab101a..48dd55e2d2 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -455,7 +455,7 @@
     pre-run: playbooks/pre.yaml
     run: playbooks/devstack.yaml
     post-run: playbooks/post.yaml
-    irrelevant-files:
+    irrelevant-files: &common-irrelevant-files
       # Documentation related
       - ^.*\.rst$
       - ^api-ref/.*$
@@ -465,6 +465,8 @@
       - ^.*/locale/.*po$
       # pre-commit config
       - ^.pre-commit-config.yaml$
+      # gitreview config
+      - ^.gitreview$
 
 - job:
     name: devstack-minimal
@@ -915,35 +917,21 @@
         - ironic-tempest-bios-ipmi-direct-tinyipa
         - swift-dsvm-functional
         - grenade:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
+            irrelevant-files: *common-irrelevant-files
         - neutron-ovs-grenade-multinode:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
+            irrelevant-files: *common-irrelevant-files
         - neutron-ovn-tempest-ovs-release:
             voting: false
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
+            irrelevant-files: *common-irrelevant-files
         - tempest-multinode-full-py3:
             voting: false
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
+            irrelevant-files: *common-irrelevant-files
         - openstacksdk-functional-devstack:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
+            irrelevant-files: *common-irrelevant-files
         - tempest-ipv6-only:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
+            irrelevant-files: *common-irrelevant-files
         - nova-ceph-multistore:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
+            irrelevant-files: *common-irrelevant-files
     gate:
       jobs:
         - devstack
@@ -958,27 +946,17 @@
         - devstack-unit-tests
         - openstack-tox-bashate
         - neutron-ovs-grenade-multinode:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
+            irrelevant-files: *common-irrelevant-files
         - ironic-tempest-bios-ipmi-direct-tinyipa
         - swift-dsvm-functional
         - grenade:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
+            irrelevant-files: *common-irrelevant-files
         - openstacksdk-functional-devstack:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
+            irrelevant-files: *common-irrelevant-files
         - tempest-ipv6-only:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
+            irrelevant-files: *common-irrelevant-files
         - nova-ceph-multistore:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
+            irrelevant-files: *common-irrelevant-files
     # Please add a note on each job and conditions for the job not
     # being experimental any more, so we can keep this list somewhat
     # pruned.
@@ -995,25 +973,15 @@
         - nova-multi-cell
         - nova-next
         - devstack-plugin-ceph-tempest-py3:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
+            irrelevant-files: *common-irrelevant-files
         - neutron-ovs-tempest-dvr:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
+            irrelevant-files: *common-irrelevant-files
         - neutron-ovs-tempest-dvr-ha-multinode-full:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
+            irrelevant-files: *common-irrelevant-files
         - cinder-tempest-lvm-multibackend:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
+            irrelevant-files: *common-irrelevant-files
         - tempest-pg-full:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
+            irrelevant-files: *common-irrelevant-files
         - devstack-no-tls-proxy
     periodic:
       jobs:

From da40accd158ed55200de93a4191dbe334c82db22 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Fri, 21 Mar 2025 10:33:51 -0700
Subject: [PATCH 2324/2409] Update DEVSTACK_SERIES to 2025.2

stable/2025.1 branch has been created now and
current master is for 2025.2.

Change-Id: Iba81d280ebf1bd488bd590bdc4e31c49782c7099
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index c05d4e2d98..0319fc8a50 100644
--- a/stackrc
+++ b/stackrc
@@ -252,7 +252,7 @@ REQUIREMENTS_DIR=${REQUIREMENTS_DIR:-$DEST/requirements}
 # Setting the variable to 'ALL' will activate the download for all
 # libraries.
 
-DEVSTACK_SERIES="2025.1"
+DEVSTACK_SERIES="2025.2"
 
 ##############
 #

From b9be941b9b96478e6bfcceb1e75ae5c66d467f07 Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Wed, 26 Mar 2025 10:09:38 -0700
Subject: [PATCH 2325/2409] Reduce unnecessary apache restarts

Systemd limits the total number of restarts that a service can undergo
in a short period of time. On faster nodes all of our apache restarts
hit that limit and we eventually fail. Mitigate this by removing
unnecessary restarts.

Change-Id: I425bb9eec525d82372f05edc63e4fb931e5a4887
---
 lib/apache | 16 +++++++++++-----
 lib/tls    | 15 ++++++++++++---
 2 files changed, 23 insertions(+), 8 deletions(-)

diff --git a/lib/apache b/lib/apache
index fc174f3901..15b4297809 100644
--- a/lib/apache
+++ b/lib/apache
@@ -53,13 +53,16 @@ APACHE_LOG_DIR="/var/log/${APACHE_NAME}"
 # Enable apache mod and restart apache if it isn't already enabled.
 function enable_apache_mod {
     local mod=$1
+    local should_restart=$2
     # Apache installation, because we mark it NOPRIME
     if is_ubuntu; then
         # Skip mod_version as it is not a valid mod to enable
         # on debuntu, instead it is built in.
         if [[ "$mod" != "version" ]] && ! a2query -m $mod ; then
             sudo a2enmod $mod
-            restart_apache_server
+            if [[ "$should_restart" != "norestart" ]] ; then
+                restart_apache_server
+            fi
         fi
     elif is_fedora; then
         # pass
@@ -113,15 +116,18 @@ function install_apache_uwsgi {
     fi
 
     if is_ubuntu; then
-        # we've got to enable proxy and proxy_uwsgi for this to work
-        sudo a2enmod proxy
-        sudo a2enmod proxy_uwsgi
+        if ! a2query -m proxy || ! a2query -m proxy_uwsgi ; then
+            # we've got to enable proxy and proxy_uwsgi for this to work
+            sudo a2enmod proxy
+            sudo a2enmod proxy_uwsgi
+            restart_apache_server
+        fi
     elif is_fedora; then
         # redhat is missing a nice way to turn on/off modules
         echo "LoadModule proxy_uwsgi_module modules/mod_proxy_uwsgi.so" \
             | sudo tee /etc/httpd/conf.modules.d/02-proxy-uwsgi.conf
+        restart_apache_server
     fi
-    restart_apache_server
 }
 
 # install_apache_wsgi() - Install Apache server and wsgi module
diff --git a/lib/tls b/lib/tls
index 0a598e14f7..cff5c630a5 100644
--- a/lib/tls
+++ b/lib/tls
@@ -452,6 +452,7 @@ function enable_mod_ssl {
 # ===============
 
 function tune_apache_connections {
+    local should_restart=$1
     local tuning_file=$APACHE_SETTINGS_DIR/connection-tuning.conf
     if ! [ -f $tuning_file ] ; then
         sudo bash -c "cat > $tuning_file" << EOF
@@ -494,7 +495,12 @@ ThreadLimit          64
 MaxRequestsPerChild   0
 </IfModule>
 EOF
-        restart_apache_server
+        if [ "$should_restart" != "norestart" ] ; then
+            # Only restart the apache server if we know we really want to
+            # do so. Too many restarts in a short period of time is treated
+            # as an error by systemd.
+            restart_apache_server
+        fi
     fi
 }
 
@@ -509,7 +515,8 @@ function start_tls_proxy {
     # 8190 is the default apache size.
     local f_header_size=${6:-8190}
 
-    tune_apache_connections
+    # We don't restart apache here as we'll do it at the end of the function.
+    tune_apache_connections norestart
 
     local config_file
     config_file=$(apache_site_config_for $b_service)
@@ -558,7 +565,9 @@ $listen_string
 </VirtualHost>
 EOF
     for mod in headers ssl proxy proxy_http; do
-        enable_apache_mod $mod
+        # We don't need to restart here as we will restart once at the end
+        # of the function.
+        enable_apache_mod $mod norestart
     done
     enable_apache_site $b_service
     restart_apache_server

From cb177ba84bd90f70a02fbac8b60549e7323ec7d2 Mon Sep 17 00:00:00 2001
From: Ivan Anfimov <lazekteam@gmail.com>
Date: Sat, 1 Mar 2025 22:15:04 +0000
Subject: [PATCH 2326/2409] Fix for module proxy_uwsgi_module is already loaded

Rocky Linux 9.5 64 bit

httpd -t
[Sun Mar 02 01:10:49.272260 2025] [so:warn] [pid 201497:tid 201497] AH01574: module proxy_uwsgi_module is already loaded, skipping

Change-Id: Id6a88c2b7958789f7d4947d3259276f120f5f44e
---
 lib/apache | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/lib/apache b/lib/apache
index 15b4297809..744c0f10b6 100644
--- a/lib/apache
+++ b/lib/apache
@@ -122,11 +122,6 @@ function install_apache_uwsgi {
             sudo a2enmod proxy_uwsgi
             restart_apache_server
         fi
-    elif is_fedora; then
-        # redhat is missing a nice way to turn on/off modules
-        echo "LoadModule proxy_uwsgi_module modules/mod_proxy_uwsgi.so" \
-            | sudo tee /etc/httpd/conf.modules.d/02-proxy-uwsgi.conf
-        restart_apache_server
     fi
 }
 

From f41a16c11801f986a6e799e02b5340adf6b04fbb Mon Sep 17 00:00:00 2001
From: yatinkarel <ykarel@redhat.com>
Date: Wed, 9 Apr 2025 18:14:00 +0530
Subject: [PATCH 2327/2409] Fix python3 version for rpm distros

pythonX.Y version is virtually provided since long[1], and
pythonXY-devel no longer provided in latest CentOS and Fedora
releases.
So switching to use pythonX.Y-devel as that will also pull pythonX.Y
as a dependency.

Additionally install pythonX.Y-pip as for rpm distros it don't install
pip via source.

[1] https://src.fedoraproject.org/rpms/python3/c/75005c20f68f3b4ceb734e876b37009c8c3b99f3

Change-Id: I990586cce876533c67e3da4c97d9e5995c762340
---
 inc/python | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/inc/python b/inc/python
index bd58905e9e..cd90ac82c6 100644
--- a/inc/python
+++ b/inc/python
@@ -489,11 +489,7 @@ function install_python3 {
     if is_ubuntu; then
         apt_get install python${PYTHON3_VERSION} python${PYTHON3_VERSION}-dev
     elif is_fedora; then
-        if [ "$os_VENDOR" = "Fedora" ]; then
-            install_package python${PYTHON3_VERSION//.}
-        else
-            install_package python${PYTHON3_VERSION//.} python${PYTHON3_VERSION//.}-devel
-        fi
+        install_package python${PYTHON3_VERSION}-devel python${PYTHON3_VERSION}-pip
     fi
 }
 

From c4340a64ee35b2b8b5395461b6702ef765786465 Mon Sep 17 00:00:00 2001
From: Gorka Eguileor <geguileo@redhat.com>
Date: Fri, 8 Jul 2022 14:08:03 +0200
Subject: [PATCH 2328/2409] Add support for shared os_brick file lock path

There can be problems with some os-brick connectors if nova and cinder
run on the same host with different lock path locations, which we
currently do, or if Cinder and Glance with cinder store run on the same
host, and a recent os-brick change
(Ic52338278eb5bb3d90ce582fe6b23f37eb5568c4) allows for an os-brick
specific lock_path to facilitate these kind of deployment.

This patch adds the ``lock_path`` configuration option in the
``[os_brick]`` section of the nova, cinder, and glance config files.

If the os-brick, cinder, nova, or glance-store changes are not present
then the new config option is be ignored in the respective service, and
it will be used otherwise, so there's no need to make this patch
dependent on any other since we won't be worse off than we are now.

Change-Id: Ibe7da160460151734224863cddec5e0d549b4938
---
 lib/cinder | 16 ++++++++++++++++
 stack.sh   |  5 +++++
 2 files changed, 21 insertions(+)

diff --git a/lib/cinder b/lib/cinder
index b557d4b10b..2b565c9535 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -59,6 +59,7 @@ else
 fi
 
 CINDER_STATE_PATH=${CINDER_STATE_PATH:=$DATA_DIR/cinder}
+OS_BRICK_LOCK_PATH=${OS_BRICK_LOCK_PATH:=$DATA_DIR/os_brick}
 
 CINDER_CONF_DIR=/etc/cinder
 CINDER_CONF=$CINDER_CONF_DIR/cinder.conf
@@ -511,6 +512,21 @@ function init_cinder {
     mkdir -p $CINDER_STATE_PATH/volumes
 }
 
+
+function init_os_brick {
+    mkdir -p $OS_BRICK_LOCK_PATH
+    if is_service_enabled cinder; then
+        iniset $CINDER_CONF os_brick lock_path $OS_BRICK_LOCK_PATH
+    fi
+    if is_service_enabled nova; then
+        iniset $NOVA_CONF os_brick lock_path $OS_BRICK_LOCK_PATH
+    fi
+    if is_service_enabled glance; then
+        iniset $GLANCE_API_CONF os_brick lock_path $OS_BRICK_LOCK_PATH
+        iniset $GLANCE_CACHE_CONF os_brick lock_path $OS_BRICK_LOCK_PATH
+    fi
+}
+
 # install_cinder() - Collect source and prepare
 function install_cinder {
     git_clone $CINDER_REPO $CINDER_DIR $CINDER_BRANCH
diff --git a/stack.sh b/stack.sh
index 04b5f4ca6a..afca5250d5 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1005,6 +1005,11 @@ if is_service_enabled tls-proxy; then
     fix_system_ca_bundle_path
 fi
 
+if is_service_enabled cinder || [[ "$USE_CINDER_FOR_GLANCE" == "True" ]]; then
+    # os-brick setup required by glance, cinder, and nova
+    init_os_brick
+fi
+
 # Extras Install
 # --------------
 

From 3fe8873a15db27d2d8b7df4e708210ee3ca1465d Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Sat, 26 Apr 2025 02:19:56 +0000
Subject: [PATCH 2329/2409] Updated from generate-devstack-plugins-list

Change-Id: I7932dc96301cb2a52607007aa6935bbf6aa66397
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index f7873c962d..e84c946287 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -24,6 +24,7 @@ official OpenStack projects.
 ======================================== ===
 Plugin Name                              URL
 ======================================== ===
+openstack/aetos                          `https://opendev.org/openstack/aetos <https://opendev.org/openstack/aetos>`__
 openstack/aodh                           `https://opendev.org/openstack/aodh <https://opendev.org/openstack/aodh>`__
 openstack/barbican                       `https://opendev.org/openstack/barbican <https://opendev.org/openstack/barbican>`__
 openstack/blazar                         `https://opendev.org/openstack/blazar <https://opendev.org/openstack/blazar>`__

From ea23079321231c63e78e84cd58088663e92134a8 Mon Sep 17 00:00:00 2001
From: yatinkarel <ykarel@redhat.com>
Date: Wed, 30 Apr 2025 21:41:37 +0530
Subject: [PATCH 2330/2409] Fix cert detection with custom PYTHON3_VERSION

PYTHON3_VERSION was not considered for detecting
ca path with GLOBAL_VENV=False, this patch fixes it.

Related-Bug: #2109591
Change-Id: Ie597494a2a11293cbd20e6d0b23dcb31bf343957
---
 lib/tls | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tls b/lib/tls
index cff5c630a5..fa0a448d7d 100644
--- a/lib/tls
+++ b/lib/tls
@@ -367,7 +367,7 @@ function fix_system_ca_bundle_path {
         if [[ "$GLOBAL_VENV" == "True" ]] ; then
             capath=$($DEVSTACK_VENV/bin/python3 -c $'try:\n from requests import certs\n print (certs.where())\nexcept ImportError: pass')
         else
-            capath=$(python3 -c $'try:\n from requests import certs\n print (certs.where())\nexcept ImportError: pass')
+            capath=$(python$PYTHON3_VERSION -c $'try:\n from requests import certs\n print (certs.where())\nexcept ImportError: pass')
         fi
         if [[ ! $capath == "" && ! $capath =~ ^/etc/.* && ! -L $capath ]]; then
             if is_fedora; then

From 24870ec45a9486a31239218d74d0fd3fa3e5f118 Mon Sep 17 00:00:00 2001
From: yatinkarel <ykarel@redhat.com>
Date: Mon, 5 May 2025 14:13:06 +0530
Subject: [PATCH 2331/2409] Pass PYTHON env var to memory tracker

It was not honoring PYTHON3_VERSION when running
with GLOBAL_VENV=false, this patch fixes it.

Related-Bug: #2109591
Change-Id: Ib34c099b897e59fce24cab6e98dc31a505e4922e
---
 lib/dstat | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/dstat b/lib/dstat
index 870c901d2a..9bd0370847 100644
--- a/lib/dstat
+++ b/lib/dstat
@@ -33,7 +33,7 @@ function start_dstat {
     # To enable memory_tracker add:
     #    enable_service memory_tracker
     # to your localrc
-    run_process memory_tracker "$TOP_DIR/tools/memory_tracker.sh" "" "root"
+    run_process memory_tracker "$TOP_DIR/tools/memory_tracker.sh" "" "root" "PYTHON=python${PYTHON3_VERSION}"
 
     # TODO(jh): Fail when using the old service name otherwise consumers might
     # never notice that is has been removed.

From bf1ef3278c30572f5b958c5f1d2f59839e3d2b87 Mon Sep 17 00:00:00 2001
From: yatinkarel <ykarel@redhat.com>
Date: Mon, 5 May 2025 18:08:12 +0530
Subject: [PATCH 2332/2409] Honor PYTHON3_VERSION for mod_wsgi rpm installation

Different variants of mod_wsgi are provided like:-
python3-mod_wsgi.x86_64
python3.11-mod_wsgi.x86_64
python3.12-mod_wsgi.x86_64

Adjust script to also consider PYTHON3_VERSION var
to correctly install the package.

Related-Bug: #2109591
Change-Id: I6bbfd92ef727ef9b343cd5778bb78f43c13165ad
---
 lib/apache | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/apache b/lib/apache
index 744c0f10b6..5ab74b7087 100644
--- a/lib/apache
+++ b/lib/apache
@@ -137,7 +137,7 @@ function install_apache_wsgi {
         install_package libapache2-mod-wsgi-py3
     elif is_fedora; then
         sudo rm -f /etc/httpd/conf.d/000-*
-        install_package httpd python3-mod_wsgi
+        install_package httpd python${PYTHON3_VERSION}-mod_wsgi
         # rpm distros dont enable httpd by default so enable it to support reboots.
         sudo systemctl enable httpd
         # For consistency with Ubuntu, switch to the worker mpm, as

From 74837e0b30ea782b073eb6d23b0aa3060068a3a1 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Fri, 11 Oct 2024 16:15:47 +0100
Subject: [PATCH 2333/2409] lib/neutron: Deploy under uWSGI by default

Change-Id: I6256ca1725c56859947d957156d865949879b130
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
Depends-on: https://review.opendev.org/c/openstack/grenade/+/949166
---
 lib/neutron | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 69ff212991..78ff6cfb24 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -82,11 +82,9 @@ NEUTRON_CONF=$NEUTRON_CONF_DIR/neutron.conf
 export NEUTRON_TEST_CONFIG_FILE=${NEUTRON_TEST_CONFIG_FILE:-"$NEUTRON_CONF_DIR/debug.ini"}
 
 # NEUTRON_DEPLOY_MOD_WSGI defines how neutron is deployed, allowed values:
-# - False (default) : Run neutron under Eventlet
-# - True : Run neutron under uwsgi
-# TODO(annp): Switching to uwsgi in next cycle if things turn out to be stable
-# enough
-NEUTRON_DEPLOY_MOD_WSGI=$(trueorfalse False NEUTRON_DEPLOY_MOD_WSGI)
+# - False : Run neutron under Eventlet
+# - True (default) : Run neutron under uwsgi
+NEUTRON_DEPLOY_MOD_WSGI=$(trueorfalse True NEUTRON_DEPLOY_MOD_WSGI)
 
 NEUTRON_UWSGI=neutron.wsgi.api:application
 NEUTRON_UWSGI_CONF=$NEUTRON_CONF_DIR/neutron-api-uwsgi.ini

From d040e15961050f6e3fe538d8d65f13df554870f7 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Fri, 11 Oct 2024 16:18:19 +0100
Subject: [PATCH 2334/2409] lib/neutron: Remove NEUTRON_DEPLOY_MOD_WSGI

neutron no longer supports running under eventlet, so this option
is a no-op.

Change-Id: Ib2767c0e2bb5aad5d8173dc5653e44a42c2bd499
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
---
 lib/neutron | 111 +++++++++++++++-------------------------------------
 1 file changed, 32 insertions(+), 79 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index 78ff6cfb24..ea2d8e728a 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -62,11 +62,9 @@ if is_service_enabled tls-proxy; then
     Q_PROTOCOL="https"
 fi
 
-
 # Set up default directories
 GITDIR["python-neutronclient"]=$DEST/python-neutronclient
 
-
 NEUTRON_DIR=$DEST/neutron
 NEUTRON_FWAAS_DIR=$DEST/neutron-fwaas
 
@@ -81,11 +79,6 @@ NEUTRON_CONF_DIR=/etc/neutron
 NEUTRON_CONF=$NEUTRON_CONF_DIR/neutron.conf
 export NEUTRON_TEST_CONFIG_FILE=${NEUTRON_TEST_CONFIG_FILE:-"$NEUTRON_CONF_DIR/debug.ini"}
 
-# NEUTRON_DEPLOY_MOD_WSGI defines how neutron is deployed, allowed values:
-# - False : Run neutron under Eventlet
-# - True (default) : Run neutron under uwsgi
-NEUTRON_DEPLOY_MOD_WSGI=$(trueorfalse True NEUTRON_DEPLOY_MOD_WSGI)
-
 NEUTRON_UWSGI=neutron.wsgi.api:application
 NEUTRON_UWSGI_CONF=$NEUTRON_CONF_DIR/neutron-api-uwsgi.ini
 
@@ -153,7 +146,7 @@ _Q_PLUGIN_EXTRA_CONF_PATH=/etc/neutron
 
 # The name of the service in the endpoint URL
 NEUTRON_ENDPOINT_SERVICE_NAME=${NEUTRON_ENDPOINT_SERVICE_NAME-"networking"}
-if [[ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" && -z "$NEUTRON_ENDPOINT_SERVICE_NAME" ]]; then
+if [[ -z "$NEUTRON_ENDPOINT_SERVICE_NAME" ]]; then
     NEUTRON_ENDPOINT_SERVICE_NAME="networking"
 fi
 
@@ -451,9 +444,7 @@ function configure_neutron {
     # for state reports is more than adequate.
     iniset $NEUTRON_CONF DEFAULT rpc_state_report_workers 0
 
-    if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
-        write_uwsgi_config "$NEUTRON_UWSGI_CONF" "$NEUTRON_UWSGI" "/networking" "" "neutron-api"
-    fi
+    write_uwsgi_config "$NEUTRON_UWSGI_CONF" "$NEUTRON_UWSGI" "/networking" "" "neutron-api"
 }
 
 function configure_neutron_nova {
@@ -499,11 +490,7 @@ function create_nova_conf_neutron {
 # Migrated from keystone_data.sh
 function create_neutron_accounts {
     local neutron_url
-    if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
-        neutron_url=$Q_PROTOCOL://$SERVICE_HOST/
-    else
-        neutron_url=$Q_PROTOCOL://$SERVICE_HOST:$Q_PORT/
-    fi
+    neutron_url=$Q_PROTOCOL://$SERVICE_HOST/
     if [ ! -z "$NEUTRON_ENDPOINT_SERVICE_NAME" ]; then
         neutron_url=$neutron_url$NEUTRON_ENDPOINT_SERVICE_NAME
     fi
@@ -634,34 +621,25 @@ function start_neutron_service_and_check {
     fi
 
     # Start the Neutron service
-    if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
-        # The default value of "rpc_workers" is None (not defined). If
-        # "rpc_workers" is explicitly set to 0, the RPC workers process
-        # should not be executed.
-        local rpc_workers
-        rpc_workers=$(iniget_multiline $NEUTRON_CONF DEFAULT rpc_workers)
-
-        enable_service neutron-api
-        run_process neutron-api "$(which uwsgi) --procname-prefix neutron-api --ini $NEUTRON_UWSGI_CONF"
-        neutron_url=$Q_PROTOCOL://$Q_HOST/
-        if [ "$rpc_workers" != "0" ]; then
-            enable_service neutron-rpc-server
-        fi
-        enable_service neutron-periodic-workers
-        _enable_ovn_maintenance
-        if [ "$rpc_workers" != "0" ]; then
-            run_process neutron-rpc-server "$NEUTRON_BIN_DIR/neutron-rpc-server $cfg_file_options"
-        fi
-        run_process neutron-periodic-workers "$NEUTRON_BIN_DIR/neutron-periodic-workers $cfg_file_options"
-        _run_ovn_maintenance
-    else
-        run_process q-svc "$NEUTRON_BIN_DIR/neutron-server $cfg_file_options"
-        neutron_url=$service_protocol://$Q_HOST:$service_port/
-        # Start proxy if enabled
-        if is_service_enabled tls-proxy; then
-            start_tls_proxy neutron '*' $Q_PORT $Q_HOST $Q_PORT_INT
-        fi
-    fi
+    # The default value of "rpc_workers" is None (not defined). If
+    # "rpc_workers" is explicitly set to 0, the RPC workers process
+    # should not be executed.
+    local rpc_workers
+    rpc_workers=$(iniget_multiline $NEUTRON_CONF DEFAULT rpc_workers)
+
+    enable_service neutron-api
+    run_process neutron-api "$(which uwsgi) --procname-prefix neutron-api --ini $NEUTRON_UWSGI_CONF"
+    neutron_url=$Q_PROTOCOL://$Q_HOST/
+    if [ "$rpc_workers" != "0" ]; then
+        enable_service neutron-rpc-server
+    fi
+    enable_service neutron-periodic-workers
+    _enable_ovn_maintenance
+    if [ "$rpc_workers" != "0" ]; then
+        run_process neutron-rpc-server "$NEUTRON_BIN_DIR/neutron-rpc-server $cfg_file_options"
+    fi
+    run_process neutron-periodic-workers "$NEUTRON_BIN_DIR/neutron-periodic-workers $cfg_file_options"
+    _run_ovn_maintenance
     if [ ! -z "$NEUTRON_ENDPOINT_SERVICE_NAME" ]; then
         neutron_url=$neutron_url$NEUTRON_ENDPOINT_SERVICE_NAME
     fi
@@ -723,14 +701,10 @@ function stop_other {
         [ ! -z "$pid" ] && sudo kill -9 $pid
     fi
 
-    if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
-        stop_process neutron-rpc-server
-        stop_process neutron-periodic-workers
-        stop_process neutron-api
-        _stop_ovn_maintenance
-    else
-        stop_process q-svc
-    fi
+    stop_process neutron-rpc-server
+    stop_process neutron-periodic-workers
+    stop_process neutron-api
+    _stop_ovn_maintenance
 
     if is_service_enabled q-l3 neutron-l3; then
         sudo pkill -f "radvd -C $DATA_DIR/neutron/ra"
@@ -841,14 +815,12 @@ function _configure_public_network_connectivity {
 # cleanup_neutron() - Remove residual data files, anything left over from previous
 # runs that a clean run would need to clean up
 function cleanup_neutron {
-    if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
-        stop_process neutron-api
-        stop_process neutron-rpc-server
-        stop_process neutron-periodic-workers
-        _stop_ovn_maintenance
-        remove_uwsgi_config "$NEUTRON_UWSGI_CONF" "neutron-api"
-        sudo rm -f $(apache_site_config_for neutron-api)
-    fi
+    stop_process neutron-api
+    stop_process neutron-rpc-server
+    stop_process neutron-periodic-workers
+    _stop_ovn_maintenance
+    remove_uwsgi_config "$NEUTRON_UWSGI_CONF" "neutron-api"
+    sudo rm -f $(apache_site_config_for neutron-api)
 
     if [[ -n "$OVS_PHYSICAL_BRIDGE" ]]; then
         _move_neutron_addresses_route "$OVS_PHYSICAL_BRIDGE" "$PUBLIC_INTERFACE" False True "inet"
@@ -955,12 +927,6 @@ function _configure_neutron_common {
     # Format logging
     setup_logging $NEUTRON_CONF
 
-    if is_service_enabled tls-proxy && [ "$NEUTRON_DEPLOY_MOD_WSGI" == "False" ]; then
-        # Set the service port for a proxy to take the original
-        iniset $NEUTRON_CONF DEFAULT bind_port "$Q_PORT_INT"
-        iniset $NEUTRON_CONF oslo_middleware enable_proxy_headers_parsing True
-    fi
-
     _neutron_setup_rootwrap
 }
 
@@ -1026,25 +992,12 @@ function _configure_neutron_plugin_agent {
     neutron_plugin_configure_plugin_agent
 }
 
-function _replace_api_paste_composite {
-    local sep
-    sep=$(echo -ne "\x01")
-    # Replace it
-    $sudo sed -i -e "s/\/\: neutronversions_composite/\/"${NEUTRON_ENDPOINT_SERVICE_NAME}"\/\: neutronversions_composite/" "$Q_API_PASTE_FILE"
-    $sudo sed -i -e "s/\/healthcheck\: healthcheck/\/"${NEUTRON_ENDPOINT_SERVICE_NAME}"\/healthcheck\: healthcheck/" "$Q_API_PASTE_FILE"
-    $sudo sed -i -e "s/\/v2.0\: neutronapi_v2_0/\/"${NEUTRON_ENDPOINT_SERVICE_NAME}"\/v2.0\: neutronapi_v2_0/" "$Q_API_PASTE_FILE"
-}
-
 # _configure_neutron_service() - Set config files for neutron service
 # It is called when q-svc is enabled.
 function _configure_neutron_service {
     Q_API_PASTE_FILE=$NEUTRON_CONF_DIR/api-paste.ini
     cp $NEUTRON_DIR/etc/api-paste.ini $Q_API_PASTE_FILE
 
-    if [[ "$NEUTRON_DEPLOY_MOD_WSGI" == "False" && -n "$NEUTRON_ENDPOINT_SERVICE_NAME" ]]; then
-        _replace_api_paste_composite
-    fi
-
     # Update either configuration file with plugin
     iniset $NEUTRON_CONF DEFAULT core_plugin $Q_PLUGIN_CLASS
 

From 5cb2abf79ef103838ab0f922643f4a62ddf16cfb Mon Sep 17 00:00:00 2001
From: Mohammed Naser <mnaser@vexxhost.com>
Date: Tue, 25 Feb 2025 22:54:05 -0500
Subject: [PATCH 2335/2409] Switch ZSWAP_ZPOOL to zsmalloc

The z3fold compressed pages allocator is on it's way
out of the Linux kernel and running this on newer
systems will give you an error:

+ lib/host:configure_zswap:45              :   echo z3fold
z3fold
tee: /sys/module/zswap/parameters/zpool: No such file or directory

So, get ahead of things and move to the much faster
recommended by the kernel developers alternative.

[1]: https://lore.kernel.org/all/20240904233343.933462-1-yosryahmed@google.com/T/#u

Change-Id: I7c137114dd7585d3179a8d5dee818bb379bbcb1f
---
 lib/host | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/host b/lib/host
index a812c39612..58062eff6b 100644
--- a/lib/host
+++ b/lib/host
@@ -35,7 +35,7 @@ ENABLE_ZSWAP=$(trueorfalse False ENABLE_ZSWAP)
 # lz4 is very fast although it does not have the best compression
 # zstd has much better compression but more latency
 ZSWAP_COMPRESSOR=${ZSWAP_COMPRESSOR:="lz4"}
-ZSWAP_ZPOOL=${ZSWAP_ZPOOL:="z3fold"}
+ZSWAP_ZPOOL=${ZSWAP_ZPOOL:="zsmalloc"}
 function configure_zswap {
     if [[ $ENABLE_ZSWAP == "True" ]] ; then
         # Centos 9 stream seems to only support enabling but not run time

From cbae98949193085f0ef5cfc250d5e8cc7530de5f Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Mon, 12 May 2025 15:17:42 +0100
Subject: [PATCH 2336/2409] Remove libvirt apparmor workaround

This is triggering bug #2065685 [1] on Ubuntu 24.04 (Noble) if podman is
installed (since that brings in the broken paast and pasta packages).
Given the workaround is nearly 10 years old [2], it should not be
necessary anymore.

[1] https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2065685
[2] https://bugs.launchpad.net/networking-ovn/+bug/1466631

Change-Id: I525b1f30bca7093791f927ff647db7745d25df22
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
Related-bug: #2065685
Related-bug: #1466631
---
 lib/neutron_plugins/ovn_agent | 13 -------------
 1 file changed, 13 deletions(-)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index 71b5e3350d..e58cd4fb38 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -300,18 +300,6 @@ function create_public_bridge {
     _configure_public_network_connectivity
 }
 
-function _disable_libvirt_apparmor {
-    if ! sudo aa-status --enabled ; then
-        return 0
-    fi
-    # NOTE(arosen): This is used as a work around to allow newer versions
-    # of libvirt to work with ovs configured ports. See LP#1466631.
-    # requires the apparmor-utils
-    install_package apparmor-utils
-    # disables apparmor for libvirtd
-    sudo aa-complain /etc/apparmor.d/usr.sbin.libvirtd
-}
-
 
 # OVN compilation functions
 # -------------------------
@@ -614,7 +602,6 @@ function init_ovn {
     # in the ovn, ovn-nb, or ovs databases.  We're going to trash them and
     # create new ones on each devstack run.
 
-    _disable_libvirt_apparmor
     local mkdir_cmd="mkdir -p ${OVN_DATADIR}"
 
     if [[ "$OVN_BUILD_FROM_SOURCE" == "False" ]]; then

From f5b9596f24c03079c6ea2bcac29b1973bf5fe589 Mon Sep 17 00:00:00 2001
From: yatinkarel <ykarel@redhat.com>
Date: Fri, 2 May 2025 15:51:01 +0530
Subject: [PATCH 2337/2409] Temporary fixes rhel 9 distros

With [1] py39 constraints drop can't run fips jobs on
centos 9-stream or rocky9.
As a workaround can run with PYTHON3_VERSION: 3.11 in affected
jobs.
Until centos 10-stream support is ready[1] we also need
to install libvirt-python and uwsgi from source as uwsgi and
libvirt rpms are bundled with python3.

[1] https://review.opendev.org/c/openstack/requirements/+/948285
[2] https://review.opendev.org/c/openstack/devstack/+/937251

Depends-On: https://review.opendev.org/c/openstack/devstack/+/946763
Depends-On: https://review.opendev.org/c/openstack/devstack/+/948558
Depends-On: https://review.opendev.org/c/openstack/devstack/+/948786
Depends-On: https://review.opendev.org/c/openstack/devstack/+/948797
Related-Bug: #2109591
Change-Id: I80d4c65ba0728c3e4b18738c6b0d539409f19976
---
 .zuul.yaml                         | 7 +++++++
 lib/apache                         | 2 +-
 lib/nova_plugins/functions-libvirt | 8 +++++++-
 3 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 48dd55e2d2..9552fa3b47 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -735,6 +735,10 @@
     parent: tempest-full-py3
     description: CentOS 9 Stream platform test
     nodeset: devstack-single-node-centos-9-stream
+    vars:
+      devstack_localrc:
+        # TODO(ykarel) Remove this when moving to 10-stream
+        PYTHON3_VERSION: 3.11
     timeout: 9000
     voting: false
 
@@ -760,6 +764,9 @@
     voting: false
     vars:
       configure_swap_size: 4096
+      devstack_localrc:
+        # TODO(ykarel) Remove this when moving to rocky10
+        PYTHON3_VERSION: 3.11
 
 - job:
     name: devstack-platform-ubuntu-jammy
diff --git a/lib/apache b/lib/apache
index 744c0f10b6..b971ecf8cd 100644
--- a/lib/apache
+++ b/lib/apache
@@ -89,7 +89,7 @@ function install_apache_uwsgi {
     # didn't fix Python 3.10 compatibility before release.  Should be
     # fixed in uwsgi 4.9.0; can remove this when packages available
     # or we drop this release
-    elif is_fedora && ! is_openeuler && ! [[ $DISTRO =~ f36 ]]; then
+    elif is_fedora && ! is_openeuler && ! [[ $DISTRO =~ f36|rhel9 ]]; then
         # Note httpd comes with mod_proxy_uwsgi and it is loaded by
         # default; the mod_proxy_uwsgi package actually conflicts now.
         # See:
diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index ba2e98e304..35840539da 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -93,7 +93,13 @@ function install_libvirt {
         # as the base system version is too old.  We should have
         # pre-installed these
         install_package $qemu_package
-        install_package libvirt libvirt-devel python3-libvirt
+        install_package libvirt libvirt-devel
+
+        if [[ $DISTRO =~ rhel9 ]]; then
+            pip_install_gr libvirt-python
+        else
+            install_package python3-libvirt
+        fi
 
         if is_arch "aarch64"; then
             install_package edk2-aarch64

From 7fedf7f78764542a05429a22e980de4a1486faa1 Mon Sep 17 00:00:00 2001
From: Ivan Anfimov <lazekteam@gmail.com>
Date: Wed, 7 May 2025 18:17:40 +0000
Subject: [PATCH 2338/2409] Remove temporary fix for problems with CSS styles

Fixed by Horizon side:
https://review.opendev.org/c/openstack/horizon/+/949036

Change-Id: I8acb029b0562381cdbe28f0ee32f3aed07de5784
---
 files/apache-horizon.template | 1 -
 1 file changed, 1 deletion(-)

diff --git a/files/apache-horizon.template b/files/apache-horizon.template
index 98d02e168e..da7a7d26c3 100644
--- a/files/apache-horizon.template
+++ b/files/apache-horizon.template
@@ -10,7 +10,6 @@
     DocumentRoot %HORIZON_DIR%/.blackhole/
     Alias %WEBROOT%/media %HORIZON_DIR%/openstack_dashboard/static
     Alias %WEBROOT%/static %HORIZON_DIR%/static
-    Alias /static %HORIZON_DIR%/static
 
     RedirectMatch "^/$" "%WEBROOT%/"
 

From 46e14fb1f70e25aada290f6f5648800ec7a147b3 Mon Sep 17 00:00:00 2001
From: Jay Faulkner <jay@jvf.cc>
Date: Sun, 18 May 2025 16:59:13 -0700
Subject: [PATCH 2339/2409] Bubble up image download failures

Currently, we're still returning 0 out of the upload_image method
despite the download failing. This changes behavior such that if the
image download fails, it returns an exit code of 1 to the caller to be
handled (or fail early) accordingly.

Change-Id: I901dc065b51946f363145ae888cca602946ceeea
---
 functions | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/functions b/functions
index 42d08d7c4a..829fc86c55 100644
--- a/functions
+++ b/functions
@@ -147,7 +147,8 @@ function upload_image {
                 if [[ $rc -ne 0 ]]; then
                     if [[ "$attempt" -eq "$max_attempts" ]]; then
                         echo "Not found: $image_url"
-                        return
+                        # Signal failure to download to the caller, so they can fail early
+                        return 1
                     fi
                     echo "Download failed, retrying in $attempt second, attempt: $attempt"
                     sleep $attempt

From 5d41cb1f51cccdbecf375cf84f9893b29f8c3ffc Mon Sep 17 00:00:00 2001
From: Eric Harney <eharney@redhat.com>
Date: Tue, 20 May 2025 13:17:49 -0400
Subject: [PATCH 2340/2409] Silence SyntaxWarnings in outfilter.py

Use raw strings for these regexes.

Change-Id: If5d35fa527b464f34a0d2335e5c6b388be726a54
---
 tools/outfilter.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/outfilter.py b/tools/outfilter.py
index 55f9ee1487..c9907b072a 100644
--- a/tools/outfilter.py
+++ b/tools/outfilter.py
@@ -26,8 +26,8 @@
 import re
 import sys
 
-IGNORE_LINES = re.compile('(set \+o|xtrace)')
-HAS_DATE = re.compile('^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}.\d{3} \|')
+IGNORE_LINES = re.compile(r'(set \+o|xtrace)')
+HAS_DATE = re.compile(r'^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}.\d{3} \|')
 
 
 def get_options():

From 6ebe6f1b26b371b11ecd9cb6d0d154839ba6941e Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Thu, 22 May 2025 02:13:55 +0000
Subject: [PATCH 2341/2409] Updated from generate-devstack-plugins-list

Change-Id: I443a7715aa85e4ffe65994dc77f7091c7f441876
---
 doc/source/plugin-registry.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index e84c946287..f3f11cfe16 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -44,6 +44,7 @@ openstack/freezer                        `https://opendev.org/openstack/freezer
 openstack/freezer-api                    `https://opendev.org/openstack/freezer-api <https://opendev.org/openstack/freezer-api>`__
 openstack/freezer-tempest-plugin         `https://opendev.org/openstack/freezer-tempest-plugin <https://opendev.org/openstack/freezer-tempest-plugin>`__
 openstack/freezer-web-ui                 `https://opendev.org/openstack/freezer-web-ui <https://opendev.org/openstack/freezer-web-ui>`__
+openstack/grian-ui                       `https://opendev.org/openstack/grian-ui <https://opendev.org/openstack/grian-ui>`__
 openstack/heat                           `https://opendev.org/openstack/heat <https://opendev.org/openstack/heat>`__
 openstack/heat-dashboard                 `https://opendev.org/openstack/heat-dashboard <https://opendev.org/openstack/heat-dashboard>`__
 openstack/ironic                         `https://opendev.org/openstack/ironic <https://opendev.org/openstack/ironic>`__

From 0e8042deff33bffbab732f70a66ece162aa470f7 Mon Sep 17 00:00:00 2001
From: Balazs Gibizer <gibi@redhat.com>
Date: Tue, 29 Apr 2025 15:36:28 +0200
Subject: [PATCH 2342/2409] Add SYSTEMD_ENV_VARS dictionary

This will allow to pass env variables from zuul job definitions to
to systemd service files via the local conf.

The first use case of this is to pass
OS_NOVA_DISABLE_EVENTLET_PATCHING=true to nova services that already
supports running in native threading mode instead of with Eventlet.
During the Eventlet removal effort this will allow us to have separate
jobs testing the same service in different concurrency mode.

Change-Id: I675043e42006286bb7e1190ea9462fb8d8daa38c
---
 functions-common | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/functions-common b/functions-common
index e265256ccf..db2367cef6 100644
--- a/functions-common
+++ b/functions-common
@@ -43,6 +43,9 @@ declare -A -g GITREPO
 declare -A -g GITBRANCH
 declare -A -g GITDIR
 
+# Systemd service file environment variables per service
+declare -A -g SYSTEMD_ENV_VARS
+
 KILL_PATH="$(which kill)"
 
 # Save these variables to .stackenv
@@ -1642,6 +1645,9 @@ function _run_under_systemd {
         user=$STACK_USER
     fi
     local env_vars="$5"
+    if [[ -v SYSTEMD_ENV_VARS[$service] ]]; then
+        env_vars="${SYSTEMD_ENV_VARS[$service]} $env_vars"
+    fi
     if [[ "$command" =~ "uwsgi" ]] ; then
         if [[ "$GLOBAL_VENV" == "True" ]] ; then
             cmd="$cmd --venv $DEVSTACK_VENV"

From df3fa124689402831543a24fc036f55e9e0bab33 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Thu, 29 May 2025 02:49:43 +0000
Subject: [PATCH 2343/2409] Updated from generate-devstack-plugins-list

Change-Id: Ibebfa75ae6b233d6a913ffb3f8dced4290a8ab1b
---
 doc/source/plugin-registry.rst | 1 -
 1 file changed, 1 deletion(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index f3f11cfe16..9185263443 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -114,7 +114,6 @@ starlingx/nfv                            `https://opendev.org/starlingx/nfv <htt
 starlingx/update                         `https://opendev.org/starlingx/update <https://opendev.org/starlingx/update>`__
 vexxhost/openstack-operator              `https://opendev.org/vexxhost/openstack-operator <https://opendev.org/vexxhost/openstack-operator>`__
 x/almanach                               `https://opendev.org/x/almanach <https://opendev.org/x/almanach>`__
-x/apmec                                  `https://opendev.org/x/apmec <https://opendev.org/x/apmec>`__
 x/bilean                                 `https://opendev.org/x/bilean <https://opendev.org/x/bilean>`__
 x/broadview-collector                    `https://opendev.org/x/broadview-collector <https://opendev.org/x/broadview-collector>`__
 x/collectd-openstack-plugins             `https://opendev.org/x/collectd-openstack-plugins <https://opendev.org/x/collectd-openstack-plugins>`__

From d2e309f0481f2e8577737bc2e5d6761a70b93dca Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Tue, 17 Jun 2025 21:15:16 +0900
Subject: [PATCH 2344/2409] Bump etcd to 3.25.x

The etcd project maintains release branches for the current version
and pevious release[1]. Because 3.26.0 was already released, 3.24.x is
no longer supported.
Bump it to the latest bug fix release of 3.25.x .

Also, the binary for s390x has been restored upstream so add it back.

[1] https://etcd.io/docs/v3.6/op-guide/versioning/

Change-Id: I108466c65bd1ebd1e42c75dfbe9b2173d04ba122
---
 stackrc | 22 +++++++---------------
 1 file changed, 7 insertions(+), 15 deletions(-)

diff --git a/stackrc b/stackrc
index 0319fc8a50..817b445c7f 100644
--- a/stackrc
+++ b/stackrc
@@ -705,12 +705,11 @@ fi
 EXTRA_CACHE_URLS=""
 
 # etcd3 defaults
-ETCD_VERSION=${ETCD_VERSION:-v3.4.27}
-ETCD_SHA256_AMD64=${ETCD_SHA256_AMD64:-"a32d21e006252dbc3405b0645ba8468021ed41376974b573285927bf39b39eb9"}
-ETCD_SHA256_ARM64=${ETCD_SHA256_ARM64:-"ed7e257c225b9b9545fac22246b97f4074a4b5109676e92dbaebfb9315b69cc0"}
-ETCD_SHA256_PPC64=${ETCD_SHA256_PPC64:-"eb8825e0bc2cbaf9e55947f5ee373ebc9ca43b6a2ea5ced3b992c81855fff37e"}
-# etcd v3.2.x and later doesn't have anything for s390x
-ETCD_SHA256_S390X=${ETCD_SHA256_S390X:-""}
+ETCD_VERSION=${ETCD_VERSION:-v3.5.21}
+ETCD_SHA256_AMD64=${ETCD_SHA256_AMD64:-"adddda4b06718e68671ffabff2f8cee48488ba61ad82900e639d108f2148501c"}
+ETCD_SHA256_ARM64=${ETCD_SHA256_ARM64:-"95bf6918623a097c0385b96f139d90248614485e781ec9bee4768dbb6c79c53f"}
+ETCD_SHA256_PPC64=${ETCD_SHA256_PPC64:-"6fb6ecb3d1b331eb177dc610a8efad3aceb1f836d6aeb439ba0bfac5d5c2a38c"}
+ETCD_SHA256_S390X=${ETCD_SHA256_S390X:-"a211a83961ba8a7e94f7d6343ad769e699db21a715ba4f3b68cf31ea28f9c951"}
 # Make sure etcd3 downloads the correct architecture
 if is_arch "x86_64"; then
     ETCD_ARCH="amd64"
@@ -722,15 +721,8 @@ elif is_arch "ppc64le"; then
     ETCD_ARCH="ppc64le"
     ETCD_SHA256=${ETCD_SHA256:-$ETCD_SHA256_PPC64}
 elif is_arch "s390x"; then
-    # An etcd3 binary for s390x is not available on github like it is
-    # for other arches. Only continue if a custom download URL was
-    # provided.
-    if [[ -n "${ETCD_DOWNLOAD_URL}" ]]; then
-        ETCD_ARCH="s390x"
-        ETCD_SHA256=${ETCD_SHA256:-$ETCD_SHA256_S390X}
-    else
-        exit_distro_not_supported "etcd3. No custom ETCD_DOWNLOAD_URL provided."
-    fi
+    ETCD_ARCH="s390x"
+    ETCD_SHA256=${ETCD_SHA256:-$ETCD_SHA256_S390X}
 else
     exit_distro_not_supported "invalid hardware type - $ETCD_ARCH"
 fi

From 5822439d95b02a7033f6333cda1dfafdc342b852 Mon Sep 17 00:00:00 2001
From: Jay Faulkner <jay@jvf.cc>
Date: Wed, 18 Jun 2025 08:20:50 -0700
Subject: [PATCH 2345/2409] Update base OS recommendation to 24.04

This is what all of OpenStack tests on now, it's likely a better choice
for a default. Worth noting 22.04 doesn't work for latest-ironic (at
least).

Change-Id: Ibe4c1d4416dded4ac3280cb6ef423b0792b584ab
---
 doc/source/index.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/index.rst b/doc/source/index.rst
index 70871ef876..a07bb84922 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -40,7 +40,7 @@ Start with a clean and minimal install of a Linux system. DevStack
 attempts to support the two latest LTS releases of Ubuntu,
 Rocky Linux 9 and openEuler.
 
-If you do not have a preference, Ubuntu 22.04 (Jammy) is the
+If you do not have a preference, Ubuntu 24.04 (Noble) is the
 most tested, and will probably go the smoothest.
 
 Add Stack User (optional)

From 37c755e70721fa49d9c344158592761a75b124d3 Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Mon, 23 Jun 2025 22:32:56 +0900
Subject: [PATCH 2346/2409] Drop logic for Python < 3

Python 2 support was removed globally multiple cycles ago.

Change-Id: I503ef9be68e59c8983d245f1fbb689651eb564ff
---
 tools/outfilter.py | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/tools/outfilter.py b/tools/outfilter.py
index 55f9ee1487..df03a779b5 100644
--- a/tools/outfilter.py
+++ b/tools/outfilter.py
@@ -90,13 +90,10 @@ def main():
 
         if outfile:
             # We've opened outfile as a binary file to get the
-            # non-buffered behaviour.  on python3, sys.stdin was
+            # non-buffered behaviour. on python3, sys.stdin was
             # opened with the system encoding and made the line into
             # utf-8, so write the logfile out in utf-8 bytes.
-            if sys.version_info < (3,):
-                outfile.write(ts_line)
-            else:
-                outfile.write(ts_line.encode('utf-8'))
+            outfile.write(ts_line.encode('utf-8'))
             outfile.flush()
 
 

From a8aecbad4f7f4cd4b6ddc57b78844cede5325d4d Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Sat, 23 Nov 2024 21:50:13 +0900
Subject: [PATCH 2347/2409] Allow installing etcd3gw from source

... to enable forward testing in etcd3gw.

Change-Id: I249243fc913a82c28d096ef48aacecd07f2c2694
---
 lib/libraries                | 9 +++++++--
 stackrc                      | 4 ++++
 tests/test_libs_from_pypi.sh | 2 +-
 3 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/lib/libraries b/lib/libraries
index fa418785dd..c3248f11b2 100755
--- a/lib/libraries
+++ b/lib/libraries
@@ -27,6 +27,7 @@ GITDIR["castellan"]=$DEST/castellan
 GITDIR["cliff"]=$DEST/cliff
 GITDIR["cursive"]=$DEST/cursive
 GITDIR["debtcollector"]=$DEST/debtcollector
+GITDIR["etcd3gw"]=$DEST/etcd3gw
 GITDIR["futurist"]=$DEST/futurist
 GITDIR["openstacksdk"]=$DEST/openstacksdk
 GITDIR["os-client-config"]=$DEST/os-client-config
@@ -131,8 +132,12 @@ function install_libs {
     # python client libraries we might need from git can go here
     _install_lib_from_source "python-barbicanclient"
 
-    # etcd (because tooz does not have a hard dependency on these)
-    pip_install etcd3gw
+    if use_library_from_git etcd3gw ; then
+        _install_lib_from_source "etcd3gw"
+    else
+        # etcd (because tooz does not have a hard dependency on these)
+        pip_install etcd3gw
+    fi
 }
 
 # Restore xtrace
diff --git a/stackrc b/stackrc
index c05d4e2d98..ddd623fc06 100644
--- a/stackrc
+++ b/stackrc
@@ -395,6 +395,10 @@ GITBRANCH["futurist"]=${FUTURIST_BRANCH:-$TARGET_BRANCH}
 GITREPO["debtcollector"]=${DEBTCOLLECTOR_REPO:-${GIT_BASE}/openstack/debtcollector.git}
 GITBRANCH["debtcollector"]=${DEBTCOLLECTOR_BRANCH:-$TARGET_BRANCH}
 
+# etcd3gw library
+GITREPO["etcd3gw"]=${ETCD3GW_REPO:-${GIT_BASE}/openstack/etcd3gw.git}
+GITBRANCH["etcd3gw"]=${ETCD3GW_BRANCH:-$BRANCHLESS_TARGET_BRANCH}
+
 # helpful state machines
 GITREPO["automaton"]=${AUTOMATON_REPO:-${GIT_BASE}/openstack/automaton.git}
 GITBRANCH["automaton"]=${AUTOMATON_BRANCH:-$TARGET_BRANCH}
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index 839e3a1328..9552c93c4f 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -45,7 +45,7 @@ ALL_LIBS+=" oslo.cache oslo.reports osprofiler cursive"
 ALL_LIBS+=" keystoneauth ironic-lib neutron-lib oslo.privsep"
 ALL_LIBS+=" diskimage-builder os-vif python-brick-cinderclient-ext"
 ALL_LIBS+=" castellan python-barbicanclient ovsdbapp os-ken os-resource-classes"
-ALL_LIBS+=" oslo.limit"
+ALL_LIBS+=" oslo.limit etcd3gw"
 
 # Generate the above list with
 # echo ${!GITREPO[@]}

From 06633c6c3033cc92329e1849266f4f2ed33d2124 Mon Sep 17 00:00:00 2001
From: Artem Goncharov <artem.goncharov@gmail.com>
Date: Fri, 27 Jun 2025 15:05:51 +0200
Subject: [PATCH 2348/2409] Restart slapd after cleanup

A bug in openldap mdb (memory database) causes it to crash in an attempt
to delete nonexisting tree, which is exactly what we do in the cleanup.
After the coredump it does not start automatically (what maybe make
sense to change). The fix is merged in
https://bugs.openldap.org/show_bug.cgi?id=10336 but we do not have this
fix in Noble. For now try simply to restart the process.

Change-Id: Iae597aae345d12a2c82f66342ff40ac0a387eddf
Signed-off-by: Artem Goncharov <artem.goncharov@gmail.com>
---
 lib/ldap | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/lib/ldap b/lib/ldap
index b0195db258..66c2afc4d5 100644
--- a/lib/ldap
+++ b/lib/ldap
@@ -82,6 +82,14 @@ function init_ldap {
 
     # Remove data but not schemas
     clear_ldap_state
+    if is_ubuntu; then
+        # a bug in OpenLDAP 2.6.7+
+        # (https://bugs.openldap.org/show_bug.cgi?id=10336) causes slapd crash
+        # after deleting nonexisting tree. It is fixed upstream, but Ubuntu is
+        # still not having a fix in Noble. Try temporarily simly restarting the
+        # process.
+        sudo service $LDAP_SERVICE_NAME restart
+    fi
 
     # Add our top level ldap nodes
     if ldapsearch -x -w $LDAP_PASSWORD -D "$LDAP_MANAGER_DN" -H $LDAP_URL -b "$LDAP_BASE_DN" | grep -q "Success"; then

From 47aa8d1744dad23c4ace34a7edbff78360fb0079 Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Sat, 12 Jul 2025 00:25:42 +0900
Subject: [PATCH 2349/2409] Drop unused [service_user] auth_strategy

The option does not actually exist.

Change-Id: I659bba38ca038fa370a411ae43ca942b6390c779
Signed-off-by: Takashi Kajinami <kajinamit@oss.nttdata.com>
---
 lib/cinder | 1 -
 lib/nova   | 1 -
 2 files changed, 2 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index b557d4b10b..eb8a63dbfc 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -732,7 +732,6 @@ function configure_cinder_volume_upload {
 function init_cinder_service_user_conf {
     configure_keystone_authtoken_middleware $CINDER_CONF cinder service_user
     iniset $CINDER_CONF service_user send_service_user_token True
-    iniset $CINDER_CONF service_user auth_strategy keystone
 }
 
 # Restore xtrace
diff --git a/lib/nova b/lib/nova
index 810a3d9554..2357d87ee3 100644
--- a/lib/nova
+++ b/lib/nova
@@ -843,7 +843,6 @@ function init_nova_service_user_conf {
     iniset $NOVA_CONF service_user user_domain_name "$SERVICE_DOMAIN_NAME"
     iniset $NOVA_CONF service_user project_name "$SERVICE_PROJECT_NAME"
     iniset $NOVA_CONF service_user project_domain_name "$SERVICE_DOMAIN_NAME"
-    iniset $NOVA_CONF service_user auth_strategy keystone
 }
 
 function conductor_conf {

From e221349e56414e1cb89c75311bf659bd869e16a7 Mon Sep 17 00:00:00 2001
From: Grzegorz Grasza <xek@redhat.com>
Date: Mon, 14 Jul 2025 12:37:23 +0200
Subject: [PATCH 2350/2409] keystone: Set user_enabled_default for LDAP domain

When using the LDAP identity backend, stack.sh fails
during the create_keystone_accounts phase when trying
to verify the newly created demo user.

This is caused by a BadRequestException from the
Keystone API with the error, 'enabled' is a required
property. The error occurs because the default LDAP
user object created by the DevStack scripts does not
contain an attribute that Keystone can map to its
mandatory enabled property.

This change fixes the issue by adding
user_enabled_emulation = True to the domain-specific
LDAP configuration in the create_ldap_domain function.
This tells Keystone to assume a user is enabled if
the attribute is not explicitly defined in their LDAP
entry, which resolves the schema incompatibility and
allows the script to complete successfully.

Signed-off-by: Grzegorz Grasza <xek@redhat.com>
Change-Id: I15ddf0b88ee93615c318d4845a026ca1e25c3e69
---
 lib/keystone | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/keystone b/lib/keystone
index 8371045026..0311e24c67 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -608,6 +608,7 @@ function create_ldap_domain {
     iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap user_name_attribute "cn"
     iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap user_mail_attribute "mail"
     iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap user_id_attribute "uid"
+    iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap user_enabled_emulation "True"
     iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap user "cn=Manager,dc=openstack,dc=org"
     iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap url "ldap://localhost"
     iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap suffix $LDAP_BASE_DN

From 9c180f2f060bfed65bc1b24c16010466b48dc0da Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmaan@ghanshyammann.com>
Date: Fri, 4 Jul 2025 11:40:38 -0700
Subject: [PATCH 2351/2409] Configure 'manager' role in tempest

In this release, nova is implementing the manager role in policy[depends-on],
and Tempest added (depends-on) a new config option to decide if new
defaults are present in testing env. Setting the manager role availability
in Tempest so that test can use manager role user to perform the required
operation in nova.

Depends-On: https://review.opendev.org/c/openstack/nova/+/953063
Depends-On: https://review.opendev.org/c/openstack/tempest/+/953265

Change-Id: I69e32c7de5a63df1c21979f748b77e512068eeec
Signed-off-by: Ghanshyam Mann <gmaan@ghanshyammann.com>
---
 lib/tempest | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/tempest b/lib/tempest
index c9486f6310..286cb56d41 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -524,6 +524,10 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG compute-feature-enabled serial_console True
     fi
 
+    # NOTE(gmaan): Since 2025.2, 'manager' role is available in nova.
+    local nova_policy_roles="admin,manager,member,reader"
+    iniset $TEMPEST_CONFIG compute-feature-enabled nova_policy_roles $nova_policy_roles
+
     # Network
     iniset $TEMPEST_CONFIG network project_networks_reachable false
     iniset $TEMPEST_CONFIG network public_network_id "$public_network_id"

From 6180e73702cfef2011c32f315cde97128a4b7eec Mon Sep 17 00:00:00 2001
From: Rodolfo Alonso Hernandez <ralonsoh@redhat.com>
Date: Thu, 26 Jun 2025 07:56:44 +0000
Subject: [PATCH 2352/2409] Replace the OVN Metadata agent with the OVN agent

The OVN Metadata agent is replaced in any CI job with the OVN
agent. This is an incremental step on the deprecation of the
OVN Metadata agent.

Related-Bug: #2112313
Signed-off-by: Rodolfo Alonso Hernandez <ralonsoh@redhat.com>
Change-Id: I4e8d12762099c91d773c4f5e5699bc9fed43a9c9
---
 .zuul.yaml                    | 4 ++--
 lib/neutron_plugins/ovn_agent | 3 ++-
 stackrc                       | 2 +-
 3 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 9552fa3b47..9f9c69c925 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -620,7 +620,7 @@
         ovsdb-server: true
         # Neutron services
         q-svc: true
-        q-ovn-metadata-agent: true
+        q-ovn-agent: true
         # Swift services
         s-account: true
         s-container: true
@@ -657,7 +657,7 @@
           ovs-vswitchd: true
           ovsdb-server: true
           # Neutron services
-          q-ovn-metadata-agent: true
+          q-ovn-agent: true
           # Cinder services
           c-bak: true
           c-vol: true
diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index e58cd4fb38..b128fde2b6 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -96,8 +96,9 @@ OVN_META_CONF=$NEUTRON_CONF_DIR/neutron_ovn_metadata_agent.ini
 OVN_META_DATA_HOST=${OVN_META_DATA_HOST:-$(ipv6_unquote $SERVICE_HOST)}
 
 # OVN agent configuration
+# The OVN agent is configured, by default, with the "metadata" extension.
 OVN_AGENT_CONF=$NEUTRON_CONF_DIR/plugins/ml2/ovn_agent.ini
-OVN_AGENT_EXTENSIONS=${OVN_AGENT_EXTENSIONS:-}
+OVN_AGENT_EXTENSIONS=${OVN_AGENT_EXTENSIONS:-metadata}
 
 # If True (default) the node will be considered a gateway node.
 ENABLE_CHASSIS_AS_GW=$(trueorfalse True ENABLE_CHASSIS_AS_GW)
diff --git a/stackrc b/stackrc
index 0319fc8a50..325af580ad 100644
--- a/stackrc
+++ b/stackrc
@@ -75,7 +75,7 @@ if ! isset ENABLED_SERVICES ; then
     # OVN
     ENABLED_SERVICES+=,ovn-controller,ovn-northd,ovs-vswitchd,ovsdb-server
     # Neutron
-    ENABLED_SERVICES+=,q-svc,q-ovn-metadata-agent
+    ENABLED_SERVICES+=,q-svc,q-ovn-agent
     # Dashboard
     ENABLED_SERVICES+=,horizon
     # Additional services

From a8f98073b97a2485a7505ebe36dba9cad1e0a7e1 Mon Sep 17 00:00:00 2001
From: Rodolfo Alonso Hernandez <ralonsoh@redhat.com>
Date: Thu, 17 Jul 2025 10:20:27 +0000
Subject: [PATCH 2353/2409] Fix the nodeset "devstack-single-node-opensuse-15"

The label "opensuse-15" is no longer available since [1]. Since there
are pending references to this nodeset from older branches, use an
empty node list for it to fix the zuul config until all references
can be dropped.

[1]https://review.opendev.org/c/openstack/project-config/+/955214

Signed-off-by: Rodolfo Alonso Hernandez <ralonsoh@redhat.com>
Change-Id: I2f5105178482402aa108910d1bd1ec2f2c7c8933
---
 .zuul.yaml | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 9552fa3b47..693edffe6e 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -48,15 +48,10 @@
         nodes:
           - controller
 
+# TODO(frickler): drop this dummy nodeset once all references have been removed
 - nodeset:
     name: devstack-single-node-opensuse-15
-    nodes:
-      - name: controller
-        label: opensuse-15
-    groups:
-      - name: tempest
-        nodes:
-          - controller
+    nodes: []
 
 - nodeset:
     name: devstack-single-node-debian-bookworm

From bab34bbade0da8f6b7f3fd23628522ec24688807 Mon Sep 17 00:00:00 2001
From: Christian Schwede <cschwede@redhat.com>
Date: Mon, 21 Jul 2025 14:47:30 +0200
Subject: [PATCH 2354/2409] Add Swift storage policy to extend testing

Swift supports storage policies for a long time, making it possible to
store specific objects on different devices[1].

This patch adds a second storage policy to support testing API features
that rely on storage policies, eg. per-policy quotas[2]. There are no
additional Swift devices created and the existing ones are re-used to
keep the overhead to the minimum.

[1] https://docs.openstack.org/swift/latest/overview_policies.html
[2] https://github.com/openstack/swift/commit/cbba65ac

Signed-off-by: Christian Schwede <cschwede@redhat.com>
Change-Id: I6b1a35dbf1490b25e103f008eb058f406f0a24ea
---
 lib/swift | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/lib/swift b/lib/swift
index 862927437d..9532efb45c 100644
--- a/lib/swift
+++ b/lib/swift
@@ -477,6 +477,9 @@ function configure_swift {
     iniset ${SWIFT_CONF_DIR}/swift.conf swift-constraints max_header_size ${SWIFT_MAX_HEADER_SIZE}
     iniset ${SWIFT_CONF_DIR}/swift.conf swift-constraints max_file_size ${SWIFT_MAX_FILE_SIZE}
 
+    # Create an additional storage policy
+    iniset ${SWIFT_CONF_DIR}/swift.conf storage-policy:1 name silver
+
     local node_number
     for node_number in ${SWIFT_REPLICAS_SEQ}; do
         local swift_node_config=${SWIFT_CONF_DIR}/object-server/${node_number}.conf
@@ -713,6 +716,10 @@ function init_swift {
         $SWIFT_BIN_DIR/swift-ring-builder object.builder rebalance 42
         $SWIFT_BIN_DIR/swift-ring-builder container.builder rebalance 42
         $SWIFT_BIN_DIR/swift-ring-builder account.builder rebalance 42
+
+        # An additional storage policy requires an object ring as well.
+        # Re-using the previously created one to use the same devices.
+        cp object.ring.gz object-1.ring.gz
     } && popd >/dev/null
 }
 

From bfa9e547a901df5dd74926385010421157b6fca7 Mon Sep 17 00:00:00 2001
From: Ghanshyam Maan <gmaan@ghanshyammann.com>
Date: Sat, 26 Jul 2025 00:58:51 +0000
Subject: [PATCH 2355/2409] Avoid setting iso image in tempest config

Tempest use image_ref and image_ref_alt as their base
image to run test against and perform ssh etc. Most of
the iso image require ssh to be enabled explicitly so
avoid setting them as image_ref and image_ref_alt unless
it is explicitly requested.

One example that how setting iso image in tempest can fail
tests- https://review.opendev.org/c/openstack/tempest/+/954404

Needed-By: https://review.opendev.org/c/openstack/whitebox-tempest-plugin/+/955950

Change-Id: Ic385a702758d9d38880ec92cfdce2528766fc95d
Signed-off-by: Ghanshyam Maan <gmaan@ghanshyammann.com>
---
 lib/tempest | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index c9486f6310..cac2633324 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -105,6 +105,8 @@ TEMPEST_CONCURRENCY=${TEMPEST_CONCURRENCY:-$(nproc)}
 TEMPEST_FLAVOR_RAM=${TEMPEST_FLAVOR_RAM:-192}
 TEMPEST_FLAVOR_ALT_RAM=${TEMPEST_FLAVOR_ALT_RAM:-256}
 
+TEMPEST_USE_ISO_IMAGE=$(trueorfalse False TEMPEST_USE_ISO_IMAGE)
+
 # Functions
 # ---------
 
@@ -161,12 +163,20 @@ function get_active_images {
     # start with a fresh array in case we are called multiple times
     img_array=()
 
-    while read -r IMAGE_NAME IMAGE_UUID; do
+    # NOTE(gmaan): Most of the iso image require ssh to be enabled explicitly
+    # and if we set those iso images in image_ref and image_ref_alt that can
+    # cause test to fail because many tests using image_ref and image_ref_alt
+    # to boot server also perform ssh. We skip to set iso image in tempest
+    # unless it is requested via TEMPEST_USE_ISO_IMAGE.
+    while read -r IMAGE_NAME IMAGE_UUID DISK_FORMAT; do
+        if [[ "$DISK_FORMAT" == "iso"  ]] && [[ "$TEMPEST_USE_ISO_IMAGE" == False ]]; then
+            continue
+        fi
         if [ "$IMAGE_NAME" = "$DEFAULT_IMAGE_NAME" ]; then
             img_id="$IMAGE_UUID"
         fi
         img_array+=($IMAGE_UUID)
-    done < <(openstack --os-cloud devstack-admin image list --property status=active | awk -F'|' '!/^(+--)|ID|aki|ari/ { print $3,$2 }')
+    done < <(openstack --os-cloud devstack-admin image list --long --property status=active | awk -F'|' '!/^(+--)|ID|aki|ari/ { print $3,$2,$4 }')
 }
 
 function poll_glance_images {

From 5c338f47d57fe849215d6b9f5c1f4eb53c193ab1 Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Mon, 4 Aug 2025 23:31:17 +0900
Subject: [PATCH 2356/2409] Fix uninialized os_VENDOR

... to fix the wrong libvirt group name detected.

Closes-Bug: #2119496
Change-Id: I2988fcb5010f333eab5a88b83ff14aab1cb15ebd
Signed-off-by: Takashi Kajinami <kajinamit@oss.nttdata.com>
---
 stackrc | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/stackrc b/stackrc
index 0319fc8a50..44bc6b321d 100644
--- a/stackrc
+++ b/stackrc
@@ -615,6 +615,11 @@ case "$VIRT_DRIVER" in
         LIBVIRT_TYPE=${LIBVIRT_TYPE:-kvm}
         LIBVIRT_CPU_MODE=${LIBVIRT_CPU_MODE:-custom}
         LIBVIRT_CPU_MODEL=${LIBVIRT_CPU_MODEL:-Nehalem}
+
+        if [[ -z "$os_VENDOR" ]]; then
+            GetOSVersion
+        fi
+
         if [[ "$os_VENDOR" =~ (Debian|Ubuntu) ]]; then
             # The groups change with newer libvirt. Older Ubuntu used
             # 'libvirtd', but now uses libvirt like Debian. Do a quick check

From 90b0a6760ba95e8b2fa4a43dda1d0eeb56c00f2d Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Tue, 5 Aug 2025 12:55:21 +0900
Subject: [PATCH 2357/2409] Drop old libvirt group detection for Ubuntu/Debian

The "libvirtd" group was used in quite old Ubuntu such as Xenial, and
the "libvirt" group is used instead in recent versions.

Change-Id: I2df747d54d3cb395c245ecc2aa24dcbf395e7a46
Signed-off-by: Takashi Kajinami <kajinamit@oss.nttdata.com>
---
 stackrc | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/stackrc b/stackrc
index 44bc6b321d..811a285d19 100644
--- a/stackrc
+++ b/stackrc
@@ -621,11 +621,7 @@ case "$VIRT_DRIVER" in
         fi
 
         if [[ "$os_VENDOR" =~ (Debian|Ubuntu) ]]; then
-            # The groups change with newer libvirt. Older Ubuntu used
-            # 'libvirtd', but now uses libvirt like Debian. Do a quick check
-            # to see if libvirtd group already exists to handle grenade's case.
-            LIBVIRT_GROUP=$(cut -d ':' -f 1 /etc/group | grep 'libvirtd$' || true)
-            LIBVIRT_GROUP=${LIBVIRT_GROUP:-libvirt}
+            LIBVIRT_GROUP=libvirt
         else
             LIBVIRT_GROUP=libvirtd
         fi

From ec96b1a067684bf729f4dbd84dce9db02171b234 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Din=C3=A7er=20=C3=87elik?= <hello@dincercelik.com>
Date: Wed, 6 Aug 2025 12:27:15 +0300
Subject: [PATCH 2358/2409] Fix default settings for Ubuntu aarch64
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Closes-Bug: #2080957
Change-Id: I441897937253f8d44144fa7f5f4622f42bf74a5f
Signed-off-by: Dinçer Çelik <hello@dincercelik.com>
---
 lib/nova_plugins/functions-libvirt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index 35840539da..c0713f9953 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -71,7 +71,7 @@ function install_libvirt {
     if is_ubuntu; then
         install_package qemu-system libvirt-clients libvirt-daemon-system libvirt-dev python3-libvirt systemd-coredump
         if is_arch "aarch64"; then
-            install_package qemu-efi
+            install_package qemu-efi-aarch64
         fi
         #pip_install_gr <there-si-no-guestfs-in-pypi>
     elif is_fedora; then

From 4f065ca80e4589513ca639cb39d3899943698b41 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Tue, 13 May 2025 14:56:44 +0100
Subject: [PATCH 2359/2409] Replace use of fgrep

It is deprecated.

Change-Id: Iad071865361d51c148fc157d715bdf517ec5b94b
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
---
 stack.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stack.sh b/stack.sh
index 04b5f4ca6a..a06c7be9a7 100755
--- a/stack.sh
+++ b/stack.sh
@@ -356,7 +356,7 @@ async_init
 # Certain services such as rabbitmq require that the local hostname resolves
 # correctly.  Make sure it exists in /etc/hosts so that is always true.
 LOCAL_HOSTNAME=`hostname -s`
-if ! fgrep -qwe "$LOCAL_HOSTNAME" /etc/hosts; then
+if ! grep -Fqwe "$LOCAL_HOSTNAME" /etc/hosts; then
     sudo sed -i "s/\(^127.0.0.1.*\)/\1 $LOCAL_HOSTNAME/" /etc/hosts
 fi
 

From 67fa02fc5fd6a8786baff61695a578338462b3d3 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Wed, 6 Aug 2025 10:53:32 +0100
Subject: [PATCH 2360/2409] Remove requirement on system oslo.utils

This was only working because the noVNC package on Ubuntu pulls
in oslo.utils.

Change-Id: I3733df3e2667f16082b3ff57d39cf086d81fbe02
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
---
 tools/verify-ipv6-address.py          | 41 +++++++++++++++++++++++++++
 tools/verify-ipv6-only-deployments.sh | 24 ++++++----------
 2 files changed, 49 insertions(+), 16 deletions(-)
 create mode 100644 tools/verify-ipv6-address.py

diff --git a/tools/verify-ipv6-address.py b/tools/verify-ipv6-address.py
new file mode 100644
index 0000000000..dc18fa6d8a
--- /dev/null
+++ b/tools/verify-ipv6-address.py
@@ -0,0 +1,41 @@
+#!/usr/bin/env python3
+
+import argparse
+import ipaddress
+import sys
+
+def main():
+    parser = argparse.ArgumentParser(
+        description="Check if a given string is a valid IPv6 address.",
+        formatter_class=argparse.RawTextHelpFormatter,
+    )
+    parser.add_argument(
+        "address",
+        help=(
+            "The IPv6 address string to validate.\n"
+            "Examples:\n"
+            "  2001:0db8:85a3:0000:0000:8a2e:0370:7334\n"
+            "  2001:db8::1\n"
+            "  ::1\n"
+            "  fe80::1%eth0 (scope IDs are handled)"
+        ),
+    )
+    args = parser.parse_args()
+
+    try:
+        # try to create a IPv6Address: if we fail to parse or get an
+        # IPv4Address then die
+        ip_obj = ipaddress.ip_address(args.address.strip('[]'))
+        if isinstance(ip_obj, ipaddress.IPv6Address):
+            sys.exit(0)
+        else:
+            sys.exit(1)
+    except ValueError:
+        sys.exit(1)
+    except Exception as e:
+        print(f"An unexpected error occurred during validation: {e}", file=sys.stderr)
+        sys.exit(1)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tools/verify-ipv6-only-deployments.sh b/tools/verify-ipv6-only-deployments.sh
index 0f0cba8afe..a1acecbb3f 100755
--- a/tools/verify-ipv6-only-deployments.sh
+++ b/tools/verify-ipv6-only-deployments.sh
@@ -33,28 +33,23 @@ function verify_devstack_ipv6_setting {
         echo $TUNNEL_IP_VERSION "TUNNEL_IP_VERSION is not set to 6 so TUNNEL_ENDPOINT_IP cannot be an IPv6 address."
         exit 1
     fi
-    is_service_host_ipv6=$(python3 -c 'import oslo_utils.netutils as nutils; print(nutils.is_valid_ipv6("'$_service_host'"))')
-    if [[ "$is_service_host_ipv6" != "True" ]]; then
+    if ! python3 ${TOP_DIR}/tools/verify-ipv6-address.py "$_service_host"; then
         echo $SERVICE_HOST "SERVICE_HOST is not IPv6 which means devstack cannot deploy services on IPv6 addresses."
         exit 1
     fi
-    is_host_ipv6=$(python3 -c 'import oslo_utils.netutils as nutils; print(nutils.is_valid_ipv6("'$_host_ipv6'"))')
-    if [[ "$is_host_ipv6" != "True" ]]; then
+    if ! python3 ${TOP_DIR}/tools/verify-ipv6-address.py "$_host_ipv6"; then
         echo $HOST_IPV6 "HOST_IPV6 is not IPv6 which means devstack cannot deploy services on IPv6 addresses."
         exit 1
     fi
-    is_service_listen_address=$(python3 -c 'import oslo_utils.netutils as nutils; print(nutils.is_valid_ipv6("'$_service_listen_address'"))')
-    if [[ "$is_service_listen_address" != "True" ]]; then
+    if ! python3 ${TOP_DIR}/tools/verify-ipv6-address.py "$_service_listen_address"; then
         echo $SERVICE_LISTEN_ADDRESS "SERVICE_LISTEN_ADDRESS is not IPv6 which means devstack cannot deploy services on IPv6 addresses."
         exit 1
     fi
-    is_service_local_host=$(python3 -c 'import oslo_utils.netutils as nutils; print(nutils.is_valid_ipv6("'$_service_local_host'"))')
-    if [[ "$is_service_local_host" != "True" ]]; then
+    if ! python3 ${TOP_DIR}/tools/verify-ipv6-address.py "$_service_local_host"; then
         echo $SERVICE_LOCAL_HOST "SERVICE_LOCAL_HOST is not IPv6 which means devstack cannot deploy services on IPv6 addresses."
         exit 1
     fi
-    is_tunnel_endpoint_ip=$(python3 -c 'import oslo_utils.netutils as nutils; print(nutils.is_valid_ipv6("'$_tunnel_endpoint_ip'"))')
-    if [[ "$is_tunnel_endpoint_ip" != "True" ]]; then
+    if ! python3 ${TOP_DIR}/tools/verify-ipv6-address.py "$_tunnel_endpoint_ip"; then
         echo $TUNNEL_ENDPOINT_IP "TUNNEL_ENDPOINT_IP is not IPv6 which means devstack will not deploy with an IPv6 endpoint address."
         exit 1
     fi
@@ -63,8 +58,7 @@ function verify_devstack_ipv6_setting {
 }
 
 function sanity_check_system_ipv6_enabled {
-    system_ipv6_enabled=$(python3 -c 'import oslo_utils.netutils as nutils; print(nutils.is_ipv6_enabled())')
-    if [[ $system_ipv6_enabled != "True" ]]; then
+    if [ ! -f "/proc/sys/net/ipv6/conf/default/disable_ipv6" ] || [ "$(cat /proc/sys/net/ipv6/conf/default/disable_ipv6)" -ne "0" ]; then
         echo "IPv6 is disabled in system"
         exit 1
     fi
@@ -78,10 +72,8 @@ function verify_service_listen_address_is_ipv6 {
     for endpoint in ${endpoints}; do
         local endpoint_address=''
         endpoint_address=$(echo "$endpoint" | awk -F/ '{print $3}' | awk -F] '{print $1}')
-        endpoint_address=$(echo $endpoint_address | tr -d [])
-        local is_endpoint_ipv6=''
-        is_endpoint_ipv6=$(python3 -c 'import oslo_utils.netutils as nutils; print(nutils.is_valid_ipv6("'$endpoint_address'"))')
-        if [[ "$is_endpoint_ipv6" != "True" ]]; then
+        endpoint_address=$(echo $endpoint_address | tr -d '[]')
+        if ! python3 ${TOP_DIR}/tools/verify-ipv6-address.py "$endpoint_address"; then
             all_ipv6=False
             echo $endpoint ": This is not an IPv6 endpoint which means corresponding service is not listening on an IPv6 address."
             continue

From b6bf0b126b46042341cc3d47a92ad9b0d9b9a523 Mon Sep 17 00:00:00 2001
From: Sean Mooney <work@seanmooney.info>
Date: Tue, 5 Aug 2025 16:44:26 +0000
Subject: [PATCH 2361/2409] Use novnc from source by default

This change restores the default devstack behavior in the zuul jobs
by removing the override of NOVNC_FROM_PACKAGE from devstack-base.

When installed locally, devstack defaults to installing novnc from
git. As reported in bug #2109592, Ubuntu and possibly other distros
have a packaging bug where the python3-novnc package 1) exists and
2) depends on `oslo.config` and, as a result, `oslo.utils`. The
reason python3-novnc existing is a bug is that novnc has not had any
Python deliverable since the 0.6.0 release around 2016. So this
package is no longer used and is effectively empty since novnc fully
moved to using JavaScript.

For unrelated reasons, devstack creates the global venv with
--site-packages to install `libvirt-python`, which also means that
any other Python dependencies installed at the system level also
infect the devstack venv.

In the past, this was not a problem, but as of epoxy, Nova requires
a newer version of oslo than Ubuntu provides in the distro package.
This is where the python3-novnc package and its incorrect dependency
on oslo breaks CI.

This is not seen locally, as devstack uses novnc from git. This
change makes CI do that also.

Closes-Bug: #2109592

Change-Id: I8f018e1e57e3f54997d2cf55b1b3aa728e82899b
Signed-off-by: Sean Mooney <work@seanmooney.info>
---
 .zuul.yaml | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index b42c800068..eee450a6ad 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -352,6 +352,12 @@
       nodes (everything but the controller).
     required-projects:
       - opendev.org/openstack/devstack
+      # this is a workaround for a packaging bug in ubuntu
+      # remove when https://bugs.launchpad.net/nova/+bug/2109592
+      # is resolved and oslo.config is not a dep of the novnc deb
+      # via the defunct python3-novnc package.
+      - novnc/novnc
+
     roles:
       - zuul: opendev.org/openstack/openstack-zuul-jobs
     vars:
@@ -369,7 +375,6 @@
         LOG_COLOR: false
         VERBOSE: true
         VERBOSE_NO_TIMESTAMP: true
-        NOVNC_FROM_PACKAGE: true
         ERROR_ON_CLONE: true
         # Gate jobs can't deal with nested virt. Disable it by default.
         LIBVIRT_TYPE: '{{ devstack_libvirt_type | default("qemu") }}'
@@ -442,7 +447,6 @@
           LOG_COLOR: false
           VERBOSE: true
           VERBOSE_NO_TIMESTAMP: true
-          NOVNC_FROM_PACKAGE: true
           ERROR_ON_CLONE: true
           LIBVIRT_TYPE: qemu
         devstack_services:

From 3b3aab52646e7a7ed737716efbfbe7fbef170911 Mon Sep 17 00:00:00 2001
From: Joel Capitao <jcapitao@redhat.com>
Date: Fri, 8 Nov 2024 16:11:06 +0000
Subject: [PATCH 2362/2409] Support CentOS Stream 10

This patch includes changes required to run devstack
on CentOS Stream 10 which has been already published
in official repos by CentOS team [1]:

- Add RDO deps repository for CS10.
- remove xinetd package from installation for swift. Note that
  rsync-daemon is installed which should work fine.
- Use python3-distro to identify the distro
- Add devstack-single-node-centos-10-stream nodeset
- Add devstack-platform-centos-10-stream job to the check
  pipeline.

Closes https://issues.redhat.com/browse/RDO-379

[1] https://mirror.stream.centos.org/10-stream/

Change-Id: I33a6c5530482c28a24f2043cd4195e7bcd46427d
Signed-off-by: Cyril Roelandt <cyril@redhat.com>
Signed-off-by: Sean Mooney <work@seanmooney.info>
---
 .zuul.yaml           | 50 ++++++++++++++++++++++++++++++++++++++++++++
 files/rpms/general   |  8 ++++---
 files/rpms/n-cpu     |  2 +-
 files/rpms/nova      |  2 +-
 files/rpms/swift     |  2 +-
 functions-common     | 11 +++++-----
 stack.sh             | 14 +++++++++----
 tools/install_pip.sh |  2 +-
 8 files changed, 74 insertions(+), 17 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index eee450a6ad..3deab35e87 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -38,6 +38,16 @@
         nodes:
           - controller
 
+- nodeset:
+    name: devstack-single-node-centos-10-stream
+    nodes:
+      - name: controller
+        label: centos-10-stream-8GB
+    groups:
+      - name: tempest
+        nodes:
+          - controller
+
 - nodeset:
     name: devstack-single-node-centos-9-stream
     nodes:
@@ -86,6 +96,36 @@
         nodes:
           - controller
 
+- nodeset:
+    name: openstack-two-node-centos-10-stream
+    nodes:
+      - name: controller
+        label: centos-10-stream-8GB
+      - name: compute1
+        label: centos-10-stream-8GB
+    groups:
+      # Node where tests are executed and test results collected
+      - name: tempest
+        nodes:
+          - controller
+      # Nodes running the compute service
+      - name: compute
+        nodes:
+          - controller
+          - compute1
+      # Nodes that are not the controller
+      - name: subnode
+        nodes:
+          - compute1
+      # Switch node for multinode networking setup
+      - name: switch
+        nodes:
+          - controller
+      # Peer nodes for multinode networking setup
+      - name: peers
+        nodes:
+          - compute1
+
 - nodeset:
     name: openstack-two-node-centos-9-stream
     nodes:
@@ -729,6 +769,14 @@
 # we often have to rush things through devstack to stabilise the gate,
 # and these platforms don't have the round-the-clock support to avoid
 # becoming blockers in that situation.
+- job:
+    name: devstack-platform-centos-10-stream
+    parent: tempest-full-py3
+    description: CentOS 10 Stream platform test
+    nodeset: devstack-single-node-centos-10-stream
+    timeout: 9000
+    voting: false
+
 - job:
     name: devstack-platform-centos-9-stream
     parent: tempest-full-py3
@@ -911,6 +959,7 @@
         - devstack
         - devstack-ipv6
         - devstack-enforce-scope
+        - devstack-platform-centos-10-stream
         - devstack-platform-centos-9-stream
         - devstack-platform-debian-bookworm
         - devstack-platform-rocky-blue-onyx
@@ -994,6 +1043,7 @@
         - devstack-no-tls-proxy
     periodic-weekly:
       jobs:
+        - devstack-platform-centos-10-stream
         - devstack-platform-centos-9-stream
         - devstack-platform-debian-bookworm
         - devstack-platform-rocky-blue-onyx
diff --git a/files/rpms/general b/files/rpms/general
index 8a5755cc37..6f4572c708 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -10,9 +10,10 @@ glibc-langpack-en # dist:rhel9
 graphviz # needed only for docs
 httpd
 httpd-devel
-iptables-nft # dist:rhel9
+iptables-nft # dist:rhel9,rhel10
 iptables-services
-java-1.8.0-openjdk-headless
+java-1.8.0-openjdk-headless # not:rhel10
+java-21-openjdk-headless # dist:rhel10
 libffi-devel
 libjpeg-turbo-devel # Pillow 3.0.0
 libxml2-devel # lxml
@@ -23,7 +24,8 @@ net-tools
 openssh-server
 openssl
 openssl-devel # to rebuild pyOpenSSL if needed
-pcre-devel # for python-pcre
+pcre2-devel # dist:rhel10 for python-pcre2
+pcre-devel # not:rhel10 for python-pcre
 pkgconfig
 postgresql-devel  # psycopg2
 psmisc
diff --git a/files/rpms/n-cpu b/files/rpms/n-cpu
index 7ce5a72d6b..5683862ee0 100644
--- a/files/rpms/n-cpu
+++ b/files/rpms/n-cpu
@@ -1,6 +1,6 @@
 cryptsetup
 dosfstools
-genisoimage # not:rhel9
+genisoimage # not:rhel9,rhel10
 iscsi-initiator-utils
 libosinfo
 lvm2
diff --git a/files/rpms/nova b/files/rpms/nova
index e0f13b854a..3ed2943c1d 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -1,7 +1,7 @@
 conntrack-tools
 curl
 ebtables
-genisoimage # not:rhel9 required for config_drive
+genisoimage # not:rhel9,rhel10 required for config_drive
 iptables
 iputils
 kernel-modules # not:openEuler-22.03
diff --git a/files/rpms/swift b/files/rpms/swift
index 49a1833dc4..cf614335c1 100644
--- a/files/rpms/swift
+++ b/files/rpms/swift
@@ -4,4 +4,4 @@ memcached
 rsync-daemon
 sqlite
 xfsprogs
-xinetd # not:f36,rhel9
+xinetd # not:f36,rhel9,rhel10
diff --git a/functions-common b/functions-common
index db2367cef6..85ee294afa 100644
--- a/functions-common
+++ b/functions-common
@@ -423,7 +423,7 @@ function _ensure_lsb_release {
     elif [[ -x $(command -v zypper 2>/dev/null) ]]; then
         sudo zypper -n install lsb-release
     elif [[ -x $(command -v dnf 2>/dev/null) ]]; then
-        sudo dnf install -y redhat-lsb-core || sudo dnf install -y openeuler-lsb
+        sudo dnf install -y python3-distro || sudo dnf install -y openeuler-lsb
     else
         die $LINENO "Unable to find or auto-install lsb_release"
     fi
@@ -436,9 +436,9 @@ function _ensure_lsb_release {
 #  - os_VENDOR
 #  - os_PACKAGE
 function GetOSVersion {
-    # CentOS Stream 9 and RHEL 9 do not provide lsb_release
+    # CentOS Stream 9 or later and RHEL 9 or later do not provide lsb_release
     source /etc/os-release
-    if [[ "${ID}${VERSION}" == "centos9" ]] || [[ "${ID}${VERSION}" =~ "rhel9" ]]; then
+    if [[ "${ID}${VERSION}" =~ "centos" ]] || [[ "${ID}${VERSION}" =~ "rhel" ]]; then
         os_RELEASE=${VERSION_ID}
         os_CODENAME="n/a"
         os_VENDOR=$(echo $NAME | tr -d '[:space:]')
@@ -485,9 +485,8 @@ function GetDistro {
         "$os_VENDOR" =~ (OracleServer) || \
         "$os_VENDOR" =~ (Rocky) || \
         "$os_VENDOR" =~ (Virtuozzo) ]]; then
-        # Drop the . release as we assume it's compatible
-        # XXX re-evaluate when we get RHEL10
-        DISTRO="rhel${os_RELEASE::1}"
+        MAJOR_VERSION=$(echo $os_RELEASE | cut -d. -f1)
+        DISTRO="rhel${MAJOR_VERSION}"
     elif [[ "$os_VENDOR" =~ (openEuler) ]]; then
         DISTRO="openEuler-$os_RELEASE"
     else
diff --git a/stack.sh b/stack.sh
index 04b5f4ca6a..2e130aec58 100755
--- a/stack.sh
+++ b/stack.sh
@@ -230,7 +230,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-SUPPORTED_DISTROS="bookworm|jammy|noble|rhel9"
+SUPPORTED_DISTROS="bookworm|jammy|noble|rhel9|rhel10"
 
 if [[ ! ${DISTRO} =~ $SUPPORTED_DISTROS ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
@@ -302,16 +302,17 @@ function _install_epel {
 }
 
 function _install_rdo {
-    if [[ $DISTRO == "rhel9" ]]; then
+    if [[ $DISTRO =~ "rhel" ]]; then
+        VERSION=${DISTRO:4:2}
         rdo_release=${TARGET_BRANCH#*/}
         if [[ "$TARGET_BRANCH" == "master" ]]; then
             # adding delorean-deps repo to provide current master rpms
-            sudo wget https://trunk.rdoproject.org/centos9-master/delorean-deps.repo -O /etc/yum.repos.d/delorean-deps.repo
+            sudo wget https://trunk.rdoproject.org/centos${VERSION}-master/delorean-deps.repo -O /etc/yum.repos.d/delorean-deps.repo
         else
             if sudo dnf provides centos-release-openstack-${rdo_release} >/dev/null 2>&1; then
                 sudo dnf -y install centos-release-openstack-${rdo_release}
             else
-                sudo wget https://trunk.rdoproject.org/centos9-${rdo_release}/delorean-deps.repo -O /etc/yum.repos.d/delorean-deps.repo
+                sudo wget https://trunk.rdoproject.org/centos${VERSION}-${rdo_release}/delorean-deps.repo -O /etc/yum.repos.d/delorean-deps.repo
             fi
         fi
     fi
@@ -408,6 +409,11 @@ elif [[ $DISTRO == "rhel9" ]]; then
     if is_package_installed curl-minimal; then
         sudo dnf swap -y curl-minimal curl
     fi
+elif [[ $DISTRO == "rhel10" ]]; then
+    # for CentOS Stream 10 repository
+    sudo dnf config-manager --set-enabled crb
+    # rabbitmq and other packages are provided by RDO repositories.
+    _install_rdo
 elif [[ $DISTRO == "openEuler-22.03" ]]; then
     # There are some problem in openEuler. We should fix it first. Some required
     # package/action runs before fixup script. So we can't fix there.
diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index 91b180c06f..79f97c5f7a 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -127,7 +127,7 @@ if [[ -n $PYPI_ALTERNATIVE_URL ]]; then
     configure_pypi_alternative_url
 fi
 
-if is_fedora && [[ ${DISTRO} == f* || ${DISTRO} == rhel9 ]]; then
+if is_fedora && [[ ${DISTRO} == f* || ${DISTRO} == rhel* ]]; then
     # get-pip.py will not install over the python3-pip package in
     # Fedora 34 any more.
     #  https://bugzilla.redhat.com/show_bug.cgi?id=1988935

From 9c295d0da30b8e4d0809623e886dc9aaf6f52c25 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Thu, 7 Aug 2025 10:53:59 +0100
Subject: [PATCH 2363/2409] Remove dead checks for Python 3.6

Change-Id: I9fab7209955ebdfda0f309aa0160749bd0f962e6
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
---
 tools/install_pip.sh | 11 ++---------
 1 file changed, 2 insertions(+), 9 deletions(-)

diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index 79f97c5f7a..027693fc0a 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -38,7 +38,6 @@ FILES=$TOP_DIR/files
 # [1] https://opendev.org/openstack/project-config/src/branch/master/nodepool/elements/cache-devstack/source-repository-pip
 
 PIP_GET_PIP_URL=${PIP_GET_PIP_URL:-"https://bootstrap.pypa.io/get-pip.py"}
-PIP_GET_PIP36_URL=${PIP_GET_PIP36_URL:-"https://bootstrap.pypa.io/pip/3.6/get-pip.py"}
 
 GetDistro
 echo "Distro: $DISTRO"
@@ -57,14 +56,8 @@ function get_versions {
 
 
 function install_get_pip {
-    if [[ "$PYTHON3_VERSION" = "3.6" ]]; then
-        _pip_url=$PIP_GET_PIP36_URL
-        _local_pip="$FILES/$(basename $_pip_url)-py36"
-    else
-        _pip_url=$PIP_GET_PIP_URL
-        _local_pip="$FILES/$(basename $_pip_url)"
-    fi
-
+    _pip_url=$PIP_GET_PIP_URL
+    _local_pip="$FILES/$(basename $_pip_url)"
 
     # If get-pip.py isn't python, delete it. This was probably an
     # outage on the server.

From fdc41d76abf353b6a9b206bf92c6b9adb90b253a Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Thu, 7 Aug 2025 10:54:45 +0100
Subject: [PATCH 2364/2409] Remove dead checks for Fedora 36

It is EOL.

Change-Id: I609cfce8a98f9933380ddbc719ed22e6fcda4785
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
---
 files/rpms/swift | 1 -
 lib/apache       | 2 +-
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/files/rpms/swift b/files/rpms/swift
index cf614335c1..c3921a47d4 100644
--- a/files/rpms/swift
+++ b/files/rpms/swift
@@ -4,4 +4,3 @@ memcached
 rsync-daemon
 sqlite
 xfsprogs
-xinetd # not:f36,rhel9,rhel10
diff --git a/lib/apache b/lib/apache
index 449d2e70d4..c49da711e1 100644
--- a/lib/apache
+++ b/lib/apache
@@ -89,7 +89,7 @@ function install_apache_uwsgi {
     # didn't fix Python 3.10 compatibility before release.  Should be
     # fixed in uwsgi 4.9.0; can remove this when packages available
     # or we drop this release
-    elif is_fedora && ! is_openeuler && ! [[ $DISTRO =~ f36|rhel9 ]]; then
+    elif is_fedora && ! is_openeuler && ! [[ $DISTRO =~ rhel9 ]]; then
         # Note httpd comes with mod_proxy_uwsgi and it is loaded by
         # default; the mod_proxy_uwsgi package actually conflicts now.
         # See:

From 1a74605eb4c30e28a99edd2e824c2ce38d6315ad Mon Sep 17 00:00:00 2001
From: Douglas Mendizabal <dmendiza@redhat.com>
Date: Fri, 8 Aug 2025 10:44:41 -0400
Subject: [PATCH 2365/2409] Fix iniset to escape backslash characters
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This patch fixes an issue in iniset where backslash (\) characters are
removed from the config value.

This patch ensures that backslash characters (\) are escaped in addition
to the ampersand (&) character that was already being escaped.

Closes-Bug: #2120180
Signed-off-by: Douglas Mendizábal <dmendiza@redhat.com>
Change-Id: Ica53ed42269931d151daf815d2e2c10c1f9e29a8
---
 inc/ini-config           |  6 ++++--
 tests/test_ini_config.sh | 15 ++++++++++++++-
 2 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/inc/ini-config b/inc/ini-config
index f65e42d3a5..920d4775fa 100644
--- a/inc/ini-config
+++ b/inc/ini-config
@@ -189,8 +189,10 @@ function iniset {
     local option=$3
     local value=$4
 
-    # Escape the ampersand character (&)
-    value=$(echo $value | sed -e 's/&/\\&/g')
+    # Escape the ampersand (&) and backslash (\) characters for sed
+    # Order of substitution matters: we escape backslashes first before
+    # adding more backslashes to escape ampersands
+    value=$(echo $value | sed -e 's/\\/\\\\/g' -e 's/&/\\&/g')
 
     if [[ -z $section || -z $option ]]; then
         $xtrace
diff --git a/tests/test_ini_config.sh b/tests/test_ini_config.sh
index 6367cde441..fd3896d6ba 100755
--- a/tests/test_ini_config.sh
+++ b/tests/test_ini_config.sh
@@ -47,6 +47,9 @@ multi = foo2
 [fff]
 ampersand =
 
+[ggg]
+backslash =
+
 [key_with_spaces]
 rgw special key = something
 
@@ -88,7 +91,7 @@ fi
 
 # test iniget_sections
 VAL=$(iniget_sections "${TEST_INI}")
-assert_equal "$VAL" "default aaa bbb ccc ddd eee fff key_with_spaces \
+assert_equal "$VAL" "default aaa bbb ccc ddd eee fff ggg key_with_spaces \
 del_separate_options del_same_option del_missing_option \
 del_missing_option_multi del_no_options"
 
@@ -134,6 +137,16 @@ done
 VAL=$(iniget ${TEST_INI} fff ampersand)
 assert_equal "$VAL" "&y" "iniset ampersands in option"
 
+# Test with backslash in value
+iniset ${TEST_INI} ggg backslash 'foo\bar'
+VAL=$(iniget ${TEST_INI} ggg backslash)
+assert_equal "$VAL" 'foo\bar' "iniset backslash in value"
+
+# Test with both ampersand and backslash
+iniset ${TEST_INI} ggg backslash 'foo\bar&baz'
+VAL=$(iniget ${TEST_INI} ggg backslash)
+assert_equal "$VAL" 'foo\bar&baz' "iniset ampersand and backslash in value"
+
 # test empty option
 if ini_has_option ${SUDO_ARG} ${TEST_INI} ddd empty; then
     passed "ini_has_option: ddd.empty present"

From 34689f587966f9fd512a03c85762bd79dd4a4e9d Mon Sep 17 00:00:00 2001
From: Ghanshyam Maan <gmaan@ghanshyammann.com>
Date: Wed, 27 Aug 2025 02:40:21 +0000
Subject: [PATCH 2366/2409] Configure nova 'service' role in tempest

In this release, nova is implementing the service role in
policy[depends-on], and Tempest being branchless needs to
decide if service defaults are present in testing release/
env (Needed-By). Setting the service role availability in
Tempest so that from this release onward, tests can use
service role user to perform the required operation in nova.

Depends-On: https://review.opendev.org/c/openstack/nova/+/957578
Needed-By: https://review.opendev.org/c/openstack/tempest/+/892639

Change-Id: I463cb85f3fcb9f2fdd7aa4a0a5f2ae49782e3fc1
Signed-off-by: Ghanshyam Maan <gmaan@ghanshyammann.com>
---
 lib/tempest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tempest b/lib/tempest
index 53851209d2..1ebe9c5f1f 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -535,7 +535,7 @@ function configure_tempest {
     fi
 
     # NOTE(gmaan): Since 2025.2, 'manager' role is available in nova.
-    local nova_policy_roles="admin,manager,member,reader"
+    local nova_policy_roles="admin,manager,member,reader,service"
     iniset $TEMPEST_CONFIG compute-feature-enabled nova_policy_roles $nova_policy_roles
 
     # Network

From 2aae15c93f4383c0a38dff276700c762e56a7134 Mon Sep 17 00:00:00 2001
From: Tobias Urdin <tobias.urdin@binero.com>
Date: Tue, 6 May 2025 08:54:39 +0200
Subject: [PATCH 2367/2409] Use profile rbd for Ceph authx for cinder-backup

Use the RBD profile instead of setting explicit
permissions.

Change-Id: Idc2258e3b69df3df57894c17018a2a35043c8fa9
Signed-off-by: Tobias Urdin <tobias.urdin@binero.com>
---
 lib/cinder_backups/ceph | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/cinder_backups/ceph b/lib/cinder_backups/ceph
index 4b180490d7..c46b90c5b9 100644
--- a/lib/cinder_backups/ceph
+++ b/lib/cinder_backups/ceph
@@ -32,7 +32,7 @@ function configure_cinder_backup_ceph {
         if [[ "$REMOTE_CEPH" = "False" && "$CEPH_REPLICAS" -ne 1 ]]; then
             sudo ceph -c ${CEPH_CONF_FILE} osd pool set ${CINDER_BAK_CEPH_POOL} crush_ruleset ${RULE_ID}
         fi
-        sudo ceph -c ${CEPH_CONF_FILE} auth get-or-create client.${CINDER_BAK_CEPH_USER} mon "allow r" osd "allow class-read object_prefix rbd_children, allow rwx pool=${CINDER_BAK_CEPH_POOL}, allow rwx pool=${CINDER_CEPH_POOL}" | sudo tee ${CEPH_CONF_DIR}/ceph.client.${CINDER_BAK_CEPH_USER}.keyring
+        sudo ceph -c ${CEPH_CONF_FILE} auth get-or-create client.${CINDER_BAK_CEPH_USER} mon "profile rbd" osd "profile rbd pool=${CINDER_BAK_CEPH_POOL}, profile rbd pool=${CINDER_CEPH_POOL}" | sudo tee ${CEPH_CONF_DIR}/ceph.client.${CINDER_BAK_CEPH_USER}.keyring
         sudo chown $(whoami):$(whoami) ${CEPH_CONF_DIR}/ceph.client.${CINDER_BAK_CEPH_USER}.keyring
     fi
 

From 2d7ff93390ca3c0f47a8b37c5f4912de69ab5b2f Mon Sep 17 00:00:00 2001
From: Jan Jasek <jjasek@redhat.com>
Date: Mon, 1 Sep 2025 12:08:48 +0200
Subject: [PATCH 2368/2409] Remove debian-bullseye nodeset

Horizon no longer use debian-bullseye nodeset

Change-Id: I78094a9dd7e51641dfb9b1a851b46744184df702
Signed-off-by: Jan Jasek <jjasek@redhat.com>
---
 .zuul.yaml | 13 -------------
 1 file changed, 13 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 3deab35e87..7bfd3e33b6 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -73,19 +73,6 @@
         nodes:
           - controller
 
-# Note(sean-k-mooney): this is still used by horizon for
-# horizon-integration-tests, horizon-integration-pytest and
-# horizon-ui-pytest, remove when horizon is updated.
-- nodeset:
-    name: devstack-single-node-debian-bullseye
-    nodes:
-      - name: controller
-        label: debian-bullseye
-    groups:
-      - name: tempest
-        nodes:
-          - controller
-
 - nodeset:
     name: devstack-single-node-rockylinux-9
     nodes:

From f6d8dab0e885b8de8c0f44388d538da7d4f9b7ec Mon Sep 17 00:00:00 2001
From: Saikumar Pulluri <saikumar1016@gmail.com>
Date: Thu, 4 Sep 2025 08:48:42 -0400
Subject: [PATCH 2369/2409] Add service type to keystone authtoken middleware

Configuring devstack's configure_keystone_authtoken_middleware to set
service_type as an additional option.

Needed-By: https://review.opendev.org/c/openstack/barbican/+/958845
Needed-By: https://review.opendev.org/c/openstack/manila/+/955393

Change-Id: I140c8392465965d68f52489b5e5bf3e47ae979be
Signed-off-by: Saikumar Pulluri <saikumar1016@gmail.com>
---
 lib/keystone | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/keystone b/lib/keystone
index 0311e24c67..241909cb9d 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -432,6 +432,7 @@ function configure_keystone_authtoken_middleware {
     local conf_file=$1
     local admin_user=$2
     local section=${3:-keystone_authtoken}
+    local service_type=$4
 
     iniset $conf_file $section auth_type password
     iniset $conf_file $section interface public
@@ -444,6 +445,9 @@ function configure_keystone_authtoken_middleware {
 
     iniset $conf_file $section cafile $SSL_BUNDLE_FILE
     iniset $conf_file $section memcached_servers $MEMCACHE_SERVERS
+    if [[ -n "$service_type" ]]; then
+        iniset $conf_file $section service_type $service_type
+    fi
 }
 
 # configure_auth_token_middleware conf_file admin_user IGNORED [section]

From 2145b0a0031977ef2809a3eaa9abe6937e4777e6 Mon Sep 17 00:00:00 2001
From: Michal Nasiadka <mnasiadka@gmail.com>
Date: Wed, 10 Sep 2025 10:24:17 +0200
Subject: [PATCH 2370/2409] Add Rocky Linux Red Quartz singlenode job (10)

Change-Id: Iaad9eb034348d559809108d254601d51719ff3e0
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
---
 .zuul.yaml       | 21 +++++++++++++++++++++
 functions-common | 11 ++++-------
 2 files changed, 25 insertions(+), 7 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 3deab35e87..0a81dd82c2 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -96,6 +96,16 @@
         nodes:
           - controller
 
+- nodeset:
+    name: devstack-single-node-rockylinux-10
+    nodes:
+      - name: controller
+        label: rockylinux-10-8GB
+    groups:
+      - name: tempest
+        nodes:
+          - controller
+
 - nodeset:
     name: openstack-two-node-centos-10-stream
     nodes:
@@ -815,6 +825,16 @@
         # TODO(ykarel) Remove this when moving to rocky10
         PYTHON3_VERSION: 3.11
 
+- job:
+    name: devstack-platform-rocky-red-quartz
+    parent: tempest-full-py3
+    description: Rocky Linux Red Quartz platform test
+    nodeset: devstack-single-node-rockylinux-10
+    timeout: 9000
+    voting: false
+    vars:
+      configure_swap_size: 4096
+
 - job:
     name: devstack-platform-ubuntu-jammy
     parent: tempest-full-py3
@@ -963,6 +983,7 @@
         - devstack-platform-centos-9-stream
         - devstack-platform-debian-bookworm
         - devstack-platform-rocky-blue-onyx
+        - devstack-platform-rocky-red-quartz
         - devstack-platform-ubuntu-noble-ovn-source
         - devstack-platform-ubuntu-noble-ovs
         - devstack-platform-ubuntu-jammy
diff --git a/functions-common b/functions-common
index 85ee294afa..37c1862c28 100644
--- a/functions-common
+++ b/functions-common
@@ -438,13 +438,10 @@ function _ensure_lsb_release {
 function GetOSVersion {
     # CentOS Stream 9 or later and RHEL 9 or later do not provide lsb_release
     source /etc/os-release
-    if [[ "${ID}${VERSION}" =~ "centos" ]] || [[ "${ID}${VERSION}" =~ "rhel" ]]; then
+    if [[ "${ID}" =~ (centos|rocky|rhel) ]]; then
         os_RELEASE=${VERSION_ID}
-        os_CODENAME="n/a"
+        os_CODENAME=$(echo $VERSION | grep -oP '(?<=[(])[^)]*')
         os_VENDOR=$(echo $NAME | tr -d '[:space:]')
-    elif [[ "${ID}${VERSION}" =~ "rocky9" ]]; then
-        os_VENDOR="Rocky"
-        os_RELEASE=${VERSION_ID}
     else
         _ensure_lsb_release
 
@@ -483,7 +480,7 @@ function GetDistro {
         "$os_VENDOR" =~ (AlmaLinux) || \
         "$os_VENDOR" =~ (Scientific) || \
         "$os_VENDOR" =~ (OracleServer) || \
-        "$os_VENDOR" =~ (Rocky) || \
+        "$os_VENDOR" =~ (RockyLinux) || \
         "$os_VENDOR" =~ (Virtuozzo) ]]; then
         MAJOR_VERSION=$(echo $os_RELEASE | cut -d. -f1)
         DISTRO="rhel${MAJOR_VERSION}"
@@ -544,7 +541,7 @@ function is_fedora {
         [ "$os_VENDOR" = "RedHatEnterpriseServer" ] || \
         [ "$os_VENDOR" = "RedHatEnterprise" ] || \
         [ "$os_VENDOR" = "RedHatEnterpriseLinux" ] || \
-        [ "$os_VENDOR" = "Rocky" ] || \
+        [ "$os_VENDOR" = "RockyLinux" ] || \
         [ "$os_VENDOR" = "CentOS" ] || [ "$os_VENDOR" = "CentOSStream" ] || \
         [ "$os_VENDOR" = "AlmaLinux" ] || \
         [ "$os_VENDOR" = "OracleServer" ] || [ "$os_VENDOR" = "Virtuozzo" ]

From 1aa22aa6d4b8dac710b50b6aabd3ce9ce8280a98 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Tue, 6 May 2025 17:28:37 +0100
Subject: [PATCH 2371/2409] lib/glance: Remove support for deploying in
 standalone mode

Change-Id: Ia70accd3e04bf9bea7fa50c18541fc71cff75f5f
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
Depends-on: https://review.opendev.org/c/openstack/glance/+/933614
---
 lib/glance | 52 ++++++++++++----------------------------------------
 1 file changed, 12 insertions(+), 40 deletions(-)

diff --git a/lib/glance b/lib/glance
index b596b53271..4dade5142d 100644
--- a/lib/glance
+++ b/lib/glance
@@ -83,13 +83,6 @@ GLANCE_DEFAULT_BACKEND=${GLANCE_DEFAULT_BACKEND:-fast}
 GLANCE_CACHE_DIR=${GLANCE_CACHE_DIR:=$DATA_DIR/glance/cache}
 GLANCE_CACHE_DRIVER=${GLANCE_CACHE_DRIVER:-centralized_db}
 
-# Full Glance functionality requires running in standalone mode. If we are
-# not in uwsgi mode, then we are standalone, otherwise allow separate control.
-if [[ "$WSGI_MODE" != "uwsgi" ]]; then
-    GLANCE_STANDALONE=True
-fi
-GLANCE_STANDALONE=${GLANCE_STANDALONE:-False}
-
 # File path for each store specified in GLANCE_MULTIPLE_FILE_STORES, the store
 # identifier will be appended to this path at runtime. If GLANCE_MULTIPLE_FILE_STORES
 # has fast,cheap specified then filepath will be generated like $DATA_DIR/glance/fast
@@ -139,14 +132,7 @@ GLANCE_UWSGI_CONF=$GLANCE_CONF_DIR/glance-uwsgi.ini
 # Glance default limit for Devstack
 GLANCE_LIMIT_IMAGE_SIZE_TOTAL=${GLANCE_LIMIT_IMAGE_SIZE_TOTAL:-2000}
 
-# If wsgi mode is uwsgi run glance under uwsgi, else default to eventlet
-# TODO(mtreinish): Remove the eventlet path here and in all the similar
-# conditionals below after the Pike release
-if [[ "$WSGI_MODE" == "uwsgi" ]]; then
-    GLANCE_URL="$GLANCE_SERVICE_PROTOCOL://$GLANCE_SERVICE_HOST/image"
-else
-    GLANCE_URL="$GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT"
-fi
+GLANCE_URL="$GLANCE_SERVICE_PROTOCOL://$GLANCE_SERVICE_HOST/image"
 
 # Functions
 # ---------
@@ -451,12 +437,11 @@ function configure_glance {
     iniset $GLANCE_CACHE_CONF glance_store filesystem_store_datadir $GLANCE_IMAGE_DIR/
 
     # Set default configuration options for the glance-image-import
-    iniset $GLANCE_IMAGE_IMPORT_CONF image_import_opts image_import_plugins []
+    iniset $GLANCE_IMAGE_IMPORT_CONF image_import_opts image_import_plugins "[]"
     iniset $GLANCE_IMAGE_IMPORT_CONF inject_metadata_properties ignore_user_roles admin
     iniset $GLANCE_IMAGE_IMPORT_CONF inject_metadata_properties inject
 
     cp -p $GLANCE_DIR/etc/schema-image.json $GLANCE_SCHEMA_JSON
-
     cp -p $GLANCE_DIR/etc/metadefs/*.json $GLANCE_METADEF_DIR
 
     if is_service_enabled tls-proxy; then
@@ -467,19 +452,15 @@ function configure_glance {
         iniset $GLANCE_CACHE_CONF DEFAULT cinder_endpoint_template "https://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v3/%(project_id)s"
     fi
 
-    if [[ "$GLANCE_STANDALONE" == False ]]; then
-        write_local_uwsgi_http_config "$GLANCE_UWSGI_CONF" "$GLANCE_UWSGI" "/image" "glance-api"
-        # Grab our uwsgi listen address and use that to fill out our
-        # worker_self_reference_url config
-        iniset $GLANCE_API_CONF DEFAULT worker_self_reference_url \
-               $(awk '-F= ' '/^http-socket/ { print "http://"$2}' $GLANCE_UWSGI_CONF)
-    else
-        write_local_proxy_http_config glance "http://$GLANCE_SERVICE_HOST:$GLANCE_SERVICE_PORT_INT" "/image"
-        iniset $GLANCE_API_CONF DEFAULT bind_host $GLANCE_SERVICE_LISTEN_ADDRESS
-        iniset $GLANCE_API_CONF DEFAULT bind_port $GLANCE_SERVICE_PORT_INT
-        iniset $GLANCE_API_CONF DEFAULT workers "$API_WORKERS"
-        iniset $GLANCE_API_CONF DEFAULT worker_self_reference_url $GLANCE_URL
-    fi
+    write_local_uwsgi_http_config "$GLANCE_UWSGI_CONF" "$GLANCE_UWSGI" "/image" "glance-api"
+
+    # Grab our uwsgi listen address and use that to fill out our
+    # worker_self_reference_url config
+    iniset $GLANCE_API_CONF DEFAULT worker_self_reference_url $(awk '-F= ' '/^http-socket/ { print "http://"$2}' $GLANCE_UWSGI_CONF)
+
+    # Configure the Python binary used for "import" plugins. If unset, these
+    # will attempt the uwsgi binary instead.
+    iniset $GLANCE_API_CONF wsgi python_interpreter $PYTHON
 
     if [[ "$GLANCE_ENFORCE_SCOPE" == True || "$ENFORCE_SCOPE" == True ]] ; then
         iniset $GLANCE_API_CONF oslo_policy enforce_scope true
@@ -664,17 +645,8 @@ function start_glance_remote_clone {
 # start_glance() - Start running processes
 function start_glance {
     local service_protocol=$GLANCE_SERVICE_PROTOCOL
-    if is_service_enabled tls-proxy; then
-        if [[ "$WSGI_MODE" != "uwsgi" ]]; then
-            start_tls_proxy glance-service '*' $GLANCE_SERVICE_PORT $GLANCE_SERVICE_HOST $GLANCE_SERVICE_PORT_INT
-        fi
-    fi
 
-    if [[ "$GLANCE_STANDALONE" == False ]]; then
-        run_process g-api "$(which uwsgi) --procname-prefix glance-api --ini $GLANCE_UWSGI_CONF"
-    else
-        run_process g-api "$GLANCE_BIN_DIR/glance-api --config-dir=$GLANCE_CONF_DIR"
-    fi
+    run_process g-api "$(which uwsgi) --procname-prefix glance-api --ini $GLANCE_UWSGI_CONF"
 
     if is_service_enabled g-api-r; then
         echo "Starting the g-api-r clone service..."

From 2df0d7ab8230a0cc7ca1c5a90c254717c9ff2dc6 Mon Sep 17 00:00:00 2001
From: Ghanshyam Maan <gmaan@ghanshyammann.com>
Date: Thu, 28 Aug 2025 03:39:25 +0000
Subject: [PATCH 2372/2409] Configure glance user in cinder conf

Cinder talk to glance for new image location APIs which
are default to 'service' role[1]. That needs cinder to have
the glance service user configured. We need to assign admin
role also to service user so that it can access images from
glance.

Needed-By: https://review.opendev.org/c/openstack/glance/+/958715

[1] https://review.opendev.org/c/openstack/glance/+/958715

Change-Id: I52d118672c053b9d6890bc6289bf12dcf5d7dce3
Signed-off-by: Ghanshyam Maan <gmaan@ghanshyammann.com>
---
 lib/cinder | 3 +++
 lib/glance | 4 +++-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/lib/cinder b/lib/cinder
index eb8a63dbfc..aef6854062 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -419,6 +419,9 @@ function configure_cinder {
         iniset $CINDER_CONF DEFAULT glance_ca_certificates_file $SSL_BUNDLE_FILE
     fi
 
+    # Set glance credentials (used for location APIs)
+    configure_keystone_authtoken_middleware $CINDER_CONF glance glance
+
     # Set nova credentials (used for os-assisted-snapshots)
     configure_keystone_authtoken_middleware $CINDER_CONF nova nova
     iniset $CINDER_CONF nova region_name "$REGION_NAME"
diff --git a/lib/glance b/lib/glance
index b596b53271..31a9ae9745 100644
--- a/lib/glance
+++ b/lib/glance
@@ -503,7 +503,9 @@ function configure_glance {
 function create_glance_accounts {
     if is_service_enabled g-api; then
 
-        create_service_user "glance"
+        # When cinder talk to glance service APIs user needs service
+        # role for RBAC checks and admin role for cinder to access images.
+        create_service_user "glance" "admin"
 
         # required for swift access
         if is_service_enabled s-proxy; then

From f09da620cb5973f9a77233a700b06612462678e5 Mon Sep 17 00:00:00 2001
From: Yatin Karel <ykarel@redhat.com>
Date: Mon, 15 Sep 2025 17:16:50 +0530
Subject: [PATCH 2373/2409] Restore os_CODENAME for old rhel distros

With [1] fips based jobs which runs on 9-stream started
to fail as os_CODENAME not applicable on those. This
patch adds fallback as before.

Moving fips jobs to 10-stream/rocky requires some more work
due to [2]

[1] https://review.opendev.org/c/openstack/devstack/+/960342
[2] https://fedoraproject.org/wiki/Changes/RemoveFipsModeSetup

Change-Id: I6d7ba4f5698e9b4837b29662b0b7f883b3c5de35
Signed-off-by: Yatin Karel <ykarel@redhat.com>
---
 functions-common | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions-common b/functions-common
index 37c1862c28..0ae51e3df1 100644
--- a/functions-common
+++ b/functions-common
@@ -440,7 +440,7 @@ function GetOSVersion {
     source /etc/os-release
     if [[ "${ID}" =~ (centos|rocky|rhel) ]]; then
         os_RELEASE=${VERSION_ID}
-        os_CODENAME=$(echo $VERSION | grep -oP '(?<=[(])[^)]*')
+        os_CODENAME=$(echo $VERSION | grep -oP '(?<=[(])[^)]*' || echo 'n/a')
         os_VENDOR=$(echo $NAME | tr -d '[:space:]')
     else
         _ensure_lsb_release

From f72801c1081e9f63bb1a98a66950d65ee8cf6ecb Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Mon, 15 Sep 2025 12:54:09 +0100
Subject: [PATCH 2374/2409] lib/neutron: Prepare for move of api-paste,
 rootwrap conf

Change-Id: I70ba357f9af668fb7a7cb737d13fe24e572eb0ff
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
---
 lib/neutron | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/lib/neutron b/lib/neutron
index ea2d8e728a..dec15fb782 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -996,7 +996,13 @@ function _configure_neutron_plugin_agent {
 # It is called when q-svc is enabled.
 function _configure_neutron_service {
     Q_API_PASTE_FILE=$NEUTRON_CONF_DIR/api-paste.ini
-    cp $NEUTRON_DIR/etc/api-paste.ini $Q_API_PASTE_FILE
+    if test -r $NEUTRON_DIR/etc/neutron/api-paste.ini; then
+        cp $NEUTRON_DIR/etc/neutron/api-paste.ini $Q_API_PASTE_FILE
+    else
+        # TODO(stephenfin): Remove this branch once [1] merges
+        # [1] https://review.opendev.org/c/openstack/neutron/+/961130
+        cp $NEUTRON_DIR/etc/api-paste.ini $Q_API_PASTE_FILE
+    fi
 
     # Update either configuration file with plugin
     iniset $NEUTRON_CONF DEFAULT core_plugin $Q_PLUGIN_CLASS
@@ -1076,6 +1082,8 @@ function _neutron_setup_rootwrap {
     if test -r $NEUTRON_DIR/etc/neutron/rootwrap.conf; then
         sudo install -o root -g root -m 644 $NEUTRON_DIR/etc/neutron/rootwrap.conf $Q_RR_CONF_FILE
     else
+        # TODO(stephenfin): Remove this branch once [1] merges
+        # [1] https://review.opendev.org/c/openstack/neutron/+/961130
         sudo install -o root -g root -m 644 $NEUTRON_DIR/etc/rootwrap.conf $Q_RR_CONF_FILE
     fi
     sudo sed -e "s:^filters_path=.*$:filters_path=$Q_CONF_ROOTWRAP_D:" -i $Q_RR_CONF_FILE

From e4cb49c690677b437d817ad8c736edcb96b674e3 Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Sun, 21 Sep 2025 03:12:55 +0900
Subject: [PATCH 2375/2409] Remove option for apache < 2.4

apache 2.4 was released long time ago and is now available in recent
operating systems.

Change-Id: If367869e8490159f31c7d6c0207e182dd7ecb164
Signed-off-by: Takashi Kajinami <kajinamit@oss.nttdata.com>
---
 files/apache-cinder-api.template    | 12 ++----------
 files/apache-horizon.template       | 14 ++------------
 files/apache-nova-api.template      |  4 +---
 files/apache-nova-metadata.template |  4 +---
 4 files changed, 6 insertions(+), 28 deletions(-)

diff --git a/files/apache-cinder-api.template b/files/apache-cinder-api.template
index e1246f11b6..e401803abc 100644
--- a/files/apache-cinder-api.template
+++ b/files/apache-cinder-api.template
@@ -6,21 +6,13 @@ Listen %PUBLICPORT%
     WSGIScriptAlias / %CINDER_BIN_DIR%/cinder-wsgi
     WSGIApplicationGroup %{GLOBAL}
     WSGIPassAuthorization On
-    <IfVersion >= 2.4>
-      ErrorLogFormat "%{cu}t %M"
-    </IfVersion>
+    ErrorLogFormat "%{cu}t %M"
     ErrorLog /var/log/%APACHE_NAME%/c-api.log
     %SSLENGINE%
     %SSLCERTFILE%
     %SSLKEYFILE%
 
     <Directory %CINDER_BIN_DIR%>
-        <IfVersion >= 2.4>
-            Require all granted
-        </IfVersion>
-        <IfVersion < 2.4>
-            Order allow,deny
-            Allow from all
-        </IfVersion>
+        Require all granted
     </Directory>
 </VirtualHost>
diff --git a/files/apache-horizon.template b/files/apache-horizon.template
index da7a7d26c3..c6c55ecf27 100644
--- a/files/apache-horizon.template
+++ b/files/apache-horizon.template
@@ -21,19 +21,9 @@
     <Directory %HORIZON_DIR%/>
         Options Indexes FollowSymLinks MultiViews
         AllowOverride None
-        # Apache 2.4 uses mod_authz_host for access control now (instead of
-        #  "Allow")
-        <IfVersion < 2.4>
-            Order allow,deny
-            Allow from all
-        </IfVersion>
-        <IfVersion >= 2.4>
-            Require all granted
-        </IfVersion>
+        Require all granted
     </Directory>
-    <IfVersion >= 2.4>
-      ErrorLogFormat "%{cu}t %M"
-    </IfVersion>
+    ErrorLogFormat "%{cu}t %M"
     ErrorLog /var/log/%APACHE_NAME%/horizon_error.log
     LogLevel warn
     CustomLog /var/log/%APACHE_NAME%/horizon_access.log combined
diff --git a/files/apache-nova-api.template b/files/apache-nova-api.template
index bcf406edf3..66fcf73cf2 100644
--- a/files/apache-nova-api.template
+++ b/files/apache-nova-api.template
@@ -6,9 +6,7 @@ Listen %PUBLICPORT%
     WSGIScriptAlias / %PUBLICWSGI%
     WSGIApplicationGroup %{GLOBAL}
     WSGIPassAuthorization On
-    <IfVersion >= 2.4>
-      ErrorLogFormat "%M"
-    </IfVersion>
+    ErrorLogFormat "%M"
     ErrorLog /var/log/%APACHE_NAME%/nova-api.log
     %SSLENGINE%
     %SSLCERTFILE%
diff --git a/files/apache-nova-metadata.template b/files/apache-nova-metadata.template
index 6231c1ced8..64be03166e 100644
--- a/files/apache-nova-metadata.template
+++ b/files/apache-nova-metadata.template
@@ -6,9 +6,7 @@ Listen %PUBLICPORT%
     WSGIScriptAlias / %PUBLICWSGI%
     WSGIApplicationGroup %{GLOBAL}
     WSGIPassAuthorization On
-    <IfVersion >= 2.4>
-      ErrorLogFormat "%M"
-    </IfVersion>
+    ErrorLogFormat "%M"
     ErrorLog /var/log/%APACHE_NAME%/nova-metadata.log
     %SSLENGINE%
     %SSLCERTFILE%

From a3e37c86cab4ec43a4a6d1c1386abf12bc034db7 Mon Sep 17 00:00:00 2001
From: Ghanshyam Maan <gmaan@ghanshyammann.com>
Date: Mon, 22 Sep 2025 06:04:42 +0000
Subject: [PATCH 2376/2409] Update DEVSTACK_SERIES to 2026.1

stable/2025.2 branch has been created now and
current master is for 2026.1

Change-Id: Ibec78664417207ca7784c548ab15c1c6ef0e0663
Signed-off-by: Ghanshyam Maan <gmaan@ghanshyammann.com>
---
 stackrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stackrc b/stackrc
index 1e306cc685..93f8b1cd6d 100644
--- a/stackrc
+++ b/stackrc
@@ -252,7 +252,7 @@ REQUIREMENTS_DIR=${REQUIREMENTS_DIR:-$DEST/requirements}
 # Setting the variable to 'ALL' will activate the download for all
 # libraries.
 
-DEVSTACK_SERIES="2025.2"
+DEVSTACK_SERIES="2026.1"
 
 ##############
 #

From 093bc57518a72b63a59389df63491d476069fc5c Mon Sep 17 00:00:00 2001
From: Ghanshyam Maan <gmaan@ghanshyammann.com>
Date: Mon, 22 Sep 2025 06:56:25 +0000
Subject: [PATCH 2377/2409] Cap stable/2025.2 network, swift, volume
 api_extensions for tempest

This commit cap the network, volume and swift extensions on
Tempest's config option api_extensions.

In 2025.2, no new extension in neutron.

and no new extensions in swift and cinder.

Change-Id: I1f9a2f53fa1e513f58d7dd8706d57f2481ab3d47
Signed-off-by: Ghanshyam Maan <gmaan@ghanshyammann.com>
---
 lib/tempest | 61 ++++++++++++++++++++++++++++++++++++++++++++++++++---
 1 file changed, 58 insertions(+), 3 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 1ebe9c5f1f..892e7fd72a 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -805,7 +805,48 @@ function configure_tempest {
         DISABLE_NETWORK_API_EXTENSIONS+=", l3_agent_scheduler"
     fi
 
-    local network_api_extensions=${NETWORK_API_EXTENSIONS:-"all"}
+    DEFAULT_NET_EXT="address-scope,agent,allowed-address-pairs,auto-allocated-topology"
+    DEFAULT_NET_EXT+=",availability_zone,binding,default-subnetpools,dhcp_agent_scheduler"
+    DEFAULT_NET_EXT+=",dvr,ext-gw-mode,external-net,extra_dhcp_opt,extraroute,flavors"
+    DEFAULT_NET_EXT+=",l3-flavors,l3-ha,l3_agent_scheduler,multi-provider,net-mtu"
+    DEFAULT_NET_EXT+=",network-ip-availability,network_availability_zone,pagination"
+    DEFAULT_NET_EXT+=",port-security,project-id,provider,quotas,quota_details,rbac-policies"
+    DEFAULT_NET_EXT+=",revision-if-match,router,router_availability_zone,security-group,service-type,sorting"
+    DEFAULT_NET_EXT+=",standard-attr-description,standard-attr-revisions,standard-attr-tag,standard-attr-timestamp"
+    DEFAULT_NET_EXT+=",subnet-service-types,subnet_allocation,net-mtu-writable,ip-substring-filtering"
+    DEFAULT_NET_EXT+=",availability_zone_filter,filter-validation,empty-string-filtering,port-mac-address-regenerate"
+    DEFAULT_NET_EXT+=",port-security-groups-filtering,fip-port-details,binding-extended"
+    DEFAULT_NET_EXT+=",subnet_onboard,l3-port-ip-change-not-allowed,agent-resources-synced"
+    DEFAULT_NET_EXT+=",floatingip-pools,rbac-security-groups,subnetpool-prefix-ops,router-admin-state-down-before-update"
+    DEFAULT_NET_EXT+=",rbac-subnetpool,tag-ports-during-bulk-creation,stateful-security-group,address-group,extraroute-atomic"
+    DEFAULT_NET_EXT+=",port-numa-affinity-policy,rbac-address-scope,security-groups-remote-address-group,trunk,trunk-details"
+    DEFAULT_NET_EXT+=",rbac-address-group,port-device-profile"
+    DEFAULT_NET_EXT+=",multiple-external-gateways,qos-pps-minimum,l3-ext-ndp-proxy,rbac-bgpvpn"
+    DEFAULT_NET_EXT+=",qos-pps,ecmp_routes,bgp,floating-ip-port-forwarding-port-ranges"
+    # New in Yoga
+    DEFAULT_NET_EXT+=",security-groups-shared-filtering,security-groups-normalized-cidr,quota-check-limit"
+    DEFAULT_NET_EXT+=",port-resource-request-groups"
+    # New in Zed
+    DEFAULT_NET_EXT+=",port-mac-override,floating-ip-port-forwarding-detail,network-cascade-delete"
+    # New in 2023.1
+    DEFAULT_NET_EXT+=",port-hints,floating-ip-distributed"
+    # New in 2023.2
+    DEFAULT_NET_EXT+=",port-hint-ovs-tx-steering,enable-default-route-bfd"
+    DEFAULT_NET_EXT+=",enable-default-route-ecmp,standard-attr-fwaas-v2"
+    DEFAULT_NET_EXT+=",allowed-address-pairs-atomic,network_ha"
+    DEFAULT_NET_EXT+=",security-groups-rules-belongs-to-default-sg"
+    DEFAULT_NET_EXT+=",port-hardware-offload-type"
+    # New in 2024.1
+    DEFAULT_NET_EXT+=",vpn-aes-ccm-gcm,tap-mirror,subnet-external-network"
+    DEFAULT_NET_EXT+=",port-numa-affinity-policy-socket"
+    # New in 2024.2
+    DEFAULT_NET_EXT+=",tag-creation,quota-check-limit-default,port-trusted-vif"
+    DEFAULT_NET_EXT+=",uplink-status-propagation-updatable"
+    # New in 2025.1
+    DEFAULT_NET_EXT+=",qing,vpn-aes-ctr"
+    # New in 2025.2: None
+    local network_api_extensions=${NETWORK_API_EXTENSIONS:-$DEFAULT_NET_EXT}
+
     if [[ ! -z "$DISABLE_NETWORK_API_EXTENSIONS" ]]; then
         # Enabled extensions are either the ones explicitly specified or those available on the API endpoint
         network_api_extensions=${NETWORK_API_EXTENSIONS:-$(iniget $tmp_cfg_file network-feature-enabled api_extensions | tr -d " ")}
@@ -817,7 +858,10 @@ function configure_tempest {
     fi
     iniset $TEMPEST_CONFIG network-feature-enabled api_extensions $network_api_extensions
     # Swift API Extensions
-    local object_storage_api_extensions=${OBJECT_STORAGE_API_EXTENSIONS:-"all"}
+    DEFAULT_SWIFT_OPT="account_quotas,bulk_delete,bulk_upload,container_quotas"
+    DEFAULT_SWIFT_OPT+=",container_sync,crossdomain,formpost,ratelimit,slo"
+    DEFAULT_SWIFT_OPT+=",staticweb,tempauth,tempurl,versioned_writes"
+    local object_storage_api_extensions=${OBJECT_STORAGE_API_EXTENSIONS:-$DEFAULT_SWIFT_OPT}
     if [[ ! -z "$DISABLE_OBJECT_STORAGE_API_EXTENSIONS" ]]; then
         # Enabled extensions are either the ones explicitly specified or those available on the API endpoint
         object_storage_api_extensions=${OBJECT_STORAGE_API_EXTENSIONS:-$(iniget $tmp_cfg_file object-storage-feature-enabled discoverable_apis | tr -d " ")}
@@ -826,7 +870,18 @@ function configure_tempest {
     fi
     iniset $TEMPEST_CONFIG object-storage-feature-enabled discoverable_apis $object_storage_api_extensions
     # Cinder API Extensions
-    local volume_api_extensions=${VOLUME_API_EXTENSIONS:-"all"}
+    DEFAULT_VOL_EXT="OS-SCH-HNT,backups,capabilities,cgsnapshots,consistencygroups"
+    DEFAULT_VOL_EXT+=",encryption,os-admin-actions,os-availability-zone"
+    DEFAULT_VOL_EXT+=",os-extended-services,os-extended-snapshot-attributes"
+    DEFAULT_VOL_EXT+=",os-hosts,os-quota-class-sets,os-quota-sets"
+    DEFAULT_VOL_EXT+=",os-services,os-snapshot-actions,os-snapshot-manage"
+    DEFAULT_VOL_EXT+=",os-snapshot-unmanage,os-types-extra-specs,os-types-manage"
+    DEFAULT_VOL_EXT+=",os-used-limits,os-vol-host-attr,os-vol-image-meta"
+    DEFAULT_VOL_EXT+=",os-vol-mig-status-attr,os-vol-tenant-attr,os-volume-actions"
+    DEFAULT_VOL_EXT+=",os-volume-encryption-metadata,os-volume-manage"
+    DEFAULT_VOL_EXT+=",os-volume-transfer,os-volume-type-access"
+    DEFAULT_VOL_EXT+=",os-volume-unmanage,qos-specs,scheduler-stats"
+    local volume_api_extensions=${VOLUME_API_EXTENSIONS:-$DEFAULT_VOL_EXT}
     if [[ ! -z "$DISABLE_VOLUME_API_EXTENSIONS" ]]; then
         # Enabled extensions are either the ones explicitly specified or those available on the API endpoint
         volume_api_extensions=${VOLUME_API_EXTENSIONS:-$(iniget $tmp_cfg_file volume-feature-enabled api_extensions | tr -d " ")}

From a8fc640b674a744e887e641ca9addc85ac46e480 Mon Sep 17 00:00:00 2001
From: Fernando Ferraz <fernandoperches@gmail.com>
Date: Fri, 19 Sep 2025 12:10:50 -0300
Subject: [PATCH 2378/2409] Avoid timeout in capture-system-logs due to df
 command

The `df` command can stall indefinitely on stale NFS mounts,
causing the playbook to time out. This leads to the entire job
failing with POST_FAILURE status, discarding controller logs
and impacting troubleshooting.

This patch changes `capture-system-logs` to run `df` with a 60s
timeout to prevent hangs from stale NFS mounts. If 'df' times out,
the mount output may help debug which NFS share is unresponsive.

Change-Id: Ife3945802c93bd77d60b60e433ea09aade38a522
Signed-off-by: Fernando Ferraz <fernandoperches@gmail.com>
---
 .zuul.yaml                                | 1 +
 roles/capture-system-logs/tasks/main.yaml | 8 +++++++-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 3b0e5dbde0..d81da3d8f5 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -446,6 +446,7 @@
         /etc/sudoers.d: logs
         '{{ stage_dir }}/iptables.txt': logs
         '{{ stage_dir }}/df.txt': logs
+        '{{ stage_dir }}/mount.txt': logs
         '{{ stage_dir }}/pip2-freeze.txt': logs
         '{{ stage_dir }}/pip3-freeze.txt': logs
         '{{ stage_dir }}/dpkg-l.txt': logs
diff --git a/roles/capture-system-logs/tasks/main.yaml b/roles/capture-system-logs/tasks/main.yaml
index 77b5ec5098..4b5ec4836b 100644
--- a/roles/capture-system-logs/tasks/main.yaml
+++ b/roles/capture-system-logs/tasks/main.yaml
@@ -4,7 +4,13 @@
     executable: /bin/bash
     cmd: |
       sudo iptables-save > {{ stage_dir }}/iptables.txt
-      df -h > {{ stage_dir }}/df.txt
+
+      # NOTE(sfernand): Run 'df' with a 60s timeout to prevent hangs from
+      # stale NFS mounts.
+      timeout -s 9 60s df -h > {{ stage_dir }}/df.txt || true
+      # If 'df' times out, the mount output helps debug which NFS share
+      # is unresponsive.
+      mount > {{ stage_dir }}/mount.txt
 
       for py_ver in 2 3; do
           if [[ `which python${py_ver}` ]]; then

From f8b3c902bef911938e03d4fc4f13fc9851a843f5 Mon Sep 17 00:00:00 2001
From: Balazs Gibizer <gibi@redhat.com>
Date: Thu, 25 Sep 2025 19:39:26 +0200
Subject: [PATCH 2379/2409] [nova-fake-virt]Restore compute restartability

Since the stable-compute-uuid nova feature the compute nodes created via
  VIRT_DRIVER=fake
cannot be restarted as these computes are not writing the compute_id
file to disk at first startup. Therefore any subsequent restart will
fail as nova-compute will refuse to start due to the missing compute_id
file but having a service already in the DB.

After this patch fake-virt uses a variant of the fake virt driver that
actually writes compute_id file to disk. To allow multiple fake computes
running on the same machine each compute now has a separate state_path
created so each can store a separate compute_id file.

Signed-off-by: Balazs Gibizer <gibi@redhat.com>
Change-Id: I813cab3c89554d1e319b2b3e5c3affd8ec5d887e
---
 lib/nova                         | 9 +++++++++
 lib/nova_plugins/hypervisor-fake | 2 +-
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/lib/nova b/lib/nova
index 2357d87ee3..b289ec6d6d 100644
--- a/lib/nova
+++ b/lib/nova
@@ -1085,6 +1085,15 @@ function start_nova_compute {
             # gets its own configuration and own log file.
             local fake_conf="${NOVA_FAKE_CONF}-${i}"
             iniset $fake_conf DEFAULT host "${HOSTNAME}${i}"
+            # Ensure that each fake compute has its own state path so that it
+            # can have its own compute_id file
+            local state_path
+            state_path="$NOVA_STATE_PATH/${HOSTNAME}${i}"
+            COMPUTE_ID=$(uuidgen)
+            sudo mkdir -p "$state_path"
+            iniset $fake_conf DEFAULT state_path "$state_path"
+            # use the generated UUID as the stable compute node UUID
+            echo "$COMPUTE_ID" | sudo tee "$state_path/compute_id"
             run_process "n-cpu-${i}" "$NOVA_BIN_DIR/nova-compute --config-file $NOVA_CPU_CONF --config-file $fake_conf"
         done
     else
diff --git a/lib/nova_plugins/hypervisor-fake b/lib/nova_plugins/hypervisor-fake
index 87ee49fa4b..39cb45ca67 100644
--- a/lib/nova_plugins/hypervisor-fake
+++ b/lib/nova_plugins/hypervisor-fake
@@ -36,7 +36,7 @@ function cleanup_nova_hypervisor {
 
 # configure_nova_hypervisor - Set config files, create data dirs, etc
 function configure_nova_hypervisor {
-    iniset $NOVA_CONF DEFAULT compute_driver "fake.FakeDriver"
+    iniset $NOVA_CONF DEFAULT compute_driver "fake.FakeDriverWithoutFakeNodes"
     # Disable arbitrary limits
     iniset $NOVA_CONF quota driver nova.quota.NoopQuotaDriver
 }

From 581d0a1d607538ffea0f41548fae25b4c6529cff Mon Sep 17 00:00:00 2001
From: Yatin Karel <ykarel@redhat.com>
Date: Mon, 29 Sep 2025 17:03:48 +0530
Subject: [PATCH 2380/2409] [subnode setup] Fail the playbook when any node
 setup fails

Currently on the multinode jobs, job continue to run even
if devstack setup fails on any of the subnode and then fails later
when required conditions are not met.
This patch changes it to fail if any of the node setup fails using
any_errors_fatal: true.

Change-Id: I2acd8a1fe0802ee1880df2ef794f8e7d7478b67b
Signed-off-by: Yatin Karel <ykarel@redhat.com>
---
 roles/orchestrate-devstack/tasks/main.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/roles/orchestrate-devstack/tasks/main.yaml b/roles/orchestrate-devstack/tasks/main.yaml
index 2b8ae01a62..b8ee7e35a7 100644
--- a/roles/orchestrate-devstack/tasks/main.yaml
+++ b/roles/orchestrate-devstack/tasks/main.yaml
@@ -4,6 +4,7 @@
   when: inventory_hostname == 'controller'
 
 - name: Setup devstack on sub-nodes
+  any_errors_fatal: true
   block:
 
   - name: Distribute the build sshkey for the user "stack"

From b20eaa6e142f2716eb1b85ed8eabd5bd71515a02 Mon Sep 17 00:00:00 2001
From: Michal Nasiadka <mnasiadka@gmail.com>
Date: Fri, 3 Oct 2025 09:40:46 +0200
Subject: [PATCH 2381/2409] Add AlmaLinux 10 platform job

AlmaLinux 10 has been introduced in OpenDev to increase hardware
coverage - it supports x86-64-v2 (compared to v3 required by
CentOS Stream 10 and Rocky Linux 10)

Change-Id: I5c91f2166bfce51cadef9c22a22a6031223604c7
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
---
 .zuul.yaml       | 33 ++++++++++++++++++++++++++++-----
 functions-common |  2 +-
 2 files changed, 29 insertions(+), 6 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 3b0e5dbde0..927945d8f0 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -39,10 +39,10 @@
           - controller
 
 - nodeset:
-    name: devstack-single-node-centos-10-stream
+    name: devstack-single-node-almalinux-10
     nodes:
       - name: controller
-        label: centos-10-stream-8GB
+        label: almalinux-10-8GB
     groups:
       - name: tempest
         nodes:
@@ -58,10 +58,15 @@
         nodes:
           - controller
 
-# TODO(frickler): drop this dummy nodeset once all references have been removed
 - nodeset:
-    name: devstack-single-node-opensuse-15
-    nodes: []
+    name: devstack-single-node-centos-10-stream
+    nodes:
+      - name: controller
+        label: centos-10-stream-8GB
+    groups:
+      - name: tempest
+        nodes:
+          - controller
 
 - nodeset:
     name: devstack-single-node-debian-bookworm
@@ -73,6 +78,11 @@
         nodes:
           - controller
 
+# TODO(frickler): drop this dummy nodeset once all references have been removed
+- nodeset:
+    name: devstack-single-node-opensuse-15
+    nodes: []
+
 - nodeset:
     name: devstack-single-node-rockylinux-9
     nodes:
@@ -766,6 +776,16 @@
 # we often have to rush things through devstack to stabilise the gate,
 # and these platforms don't have the round-the-clock support to avoid
 # becoming blockers in that situation.
+- job:
+    name: devstack-platform-almalinux-purple-lion
+    parent: tempest-full-py3
+    description: AlmaLinux 10 platform test
+    nodeset: devstack-single-node-almalinux-10
+    timeout: 9000
+    voting: false
+    vars:
+      configure_swap_size: 4096
+
 - job:
     name: devstack-platform-centos-10-stream
     parent: tempest-full-py3
@@ -966,6 +986,7 @@
         - devstack
         - devstack-ipv6
         - devstack-enforce-scope
+        - devstack-platform-almalinux-purple-lion
         - devstack-platform-centos-10-stream
         - devstack-platform-centos-9-stream
         - devstack-platform-debian-bookworm
@@ -1051,10 +1072,12 @@
         - devstack-no-tls-proxy
     periodic-weekly:
       jobs:
+        - devstack-platform-almalinux-purple-lion
         - devstack-platform-centos-10-stream
         - devstack-platform-centos-9-stream
         - devstack-platform-debian-bookworm
         - devstack-platform-rocky-blue-onyx
+        - devstack-platform-rocky-red-quartz
         - devstack-platform-ubuntu-noble-ovn-source
         - devstack-platform-ubuntu-noble-ovs
         - devstack-platform-ubuntu-jammy
diff --git a/functions-common b/functions-common
index 0ae51e3df1..c2042c4fef 100644
--- a/functions-common
+++ b/functions-common
@@ -438,7 +438,7 @@ function _ensure_lsb_release {
 function GetOSVersion {
     # CentOS Stream 9 or later and RHEL 9 or later do not provide lsb_release
     source /etc/os-release
-    if [[ "${ID}" =~ (centos|rocky|rhel) ]]; then
+    if [[ "${ID}" =~ (almalinux|centos|rocky|rhel) ]]; then
         os_RELEASE=${VERSION_ID}
         os_CODENAME=$(echo $VERSION | grep -oP '(?<=[(])[^)]*' || echo 'n/a')
         os_VENDOR=$(echo $NAME | tr -d '[:space:]')

From fe4d1e605935c61286d9bea14c2e432a079363d6 Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Sat, 12 Jul 2025 00:36:21 +0900
Subject: [PATCH 2382/2409] Create dedicated function to manage only
 keystoneauth options

Using the common function to configure keystoneauth middleware leaves
some options not actually used for service-to-service communication.

Create a dedicated function, which configures only options loaded by
keystoneauth library, to drop unnecessary options.

Change-Id: Idafdd4a3925d09f155d8ec651786ccbcd6a5f2e4
Signed-off-by: Takashi Kajinami <kajinamit@oss.nttdata.com>
---
 lib/cinder   | 13 ++-----------
 lib/keystone | 28 +++++++++++++++++++---------
 lib/neutron  | 13 +++----------
 lib/nova     | 34 ++++------------------------------
 4 files changed, 28 insertions(+), 60 deletions(-)

diff --git a/lib/cinder b/lib/cinder
index aef6854062..aafd837c95 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -303,15 +303,6 @@ function configure_cinder {
 
     cp $CINDER_DIR/etc/cinder/api-paste.ini $CINDER_API_PASTE_INI
 
-    inicomment $CINDER_API_PASTE_INI filter:authtoken auth_host
-    inicomment $CINDER_API_PASTE_INI filter:authtoken auth_port
-    inicomment $CINDER_API_PASTE_INI filter:authtoken auth_protocol
-    inicomment $CINDER_API_PASTE_INI filter:authtoken cafile
-    inicomment $CINDER_API_PASTE_INI filter:authtoken admin_tenant_name
-    inicomment $CINDER_API_PASTE_INI filter:authtoken admin_user
-    inicomment $CINDER_API_PASTE_INI filter:authtoken admin_password
-    inicomment $CINDER_API_PASTE_INI filter:authtoken signing_dir
-
     configure_keystone_authtoken_middleware $CINDER_CONF cinder
 
     iniset $CINDER_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
@@ -423,7 +414,7 @@ function configure_cinder {
     configure_keystone_authtoken_middleware $CINDER_CONF glance glance
 
     # Set nova credentials (used for os-assisted-snapshots)
-    configure_keystone_authtoken_middleware $CINDER_CONF nova nova
+    configure_keystoneauth $CINDER_CONF nova nova
     iniset $CINDER_CONF nova region_name "$REGION_NAME"
     iniset $CINDER_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
 
@@ -733,8 +724,8 @@ function configure_cinder_volume_upload {
 }
 
 function init_cinder_service_user_conf {
-    configure_keystone_authtoken_middleware $CINDER_CONF cinder service_user
     iniset $CINDER_CONF service_user send_service_user_token True
+    configure_keystoneauth $CINDER_CONF cinder service_user
 }
 
 # Restore xtrace
diff --git a/lib/keystone b/lib/keystone
index 241909cb9d..4a2d7a9f6c 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -421,18 +421,13 @@ function create_service_user {
     fi
 }
 
-# Configure a service to use the auth token middleware.
-#
-# configure_keystone_authtoken_middleware conf_file admin_user IGNORED [section]
+# Configure options for keystoneauth
 #
-# section defaults to keystone_authtoken, which is where auth_token looks in
-# the .conf file. If the paste config file is used (api-paste.ini) then
-# provide the section name for the auth_token filter.
-function configure_keystone_authtoken_middleware {
+# configure_keystoneauth conf_file admin_user section
+function configure_keystoneauth {
     local conf_file=$1
     local admin_user=$2
-    local section=${3:-keystone_authtoken}
-    local service_type=$4
+    local section=$3
 
     iniset $conf_file $section auth_type password
     iniset $conf_file $section interface public
@@ -442,7 +437,22 @@ function configure_keystone_authtoken_middleware {
     iniset $conf_file $section user_domain_name "$SERVICE_DOMAIN_NAME"
     iniset $conf_file $section project_name $SERVICE_PROJECT_NAME
     iniset $conf_file $section project_domain_name "$SERVICE_DOMAIN_NAME"
+}
+
+# Configure a service to use the auth token middleware.
+#
+# configure_keystone_authtoken_middleware conf_file admin_user [section]
+#
+# section defaults to keystone_authtoken, which is where auth_token looks in
+# the .conf file. If the paste config file is used (api-paste.ini) then
+# provide the section name for the auth_token filter.
+function configure_keystone_authtoken_middleware {
+    local conf_file=$1
+    local admin_user=$2
+    local section=${3:-keystone_authtoken}
+    local service_type=$4
 
+    configure_keystoneauth $conf_file $admin_user $section
     iniset $conf_file $section cafile $SSL_BUNDLE_FILE
     iniset $conf_file $section memcached_servers $MEMCACHE_SERVERS
     if [[ -n "$service_type" ]]; then
diff --git a/lib/neutron b/lib/neutron
index ea2d8e728a..44cd249fa1 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -460,14 +460,7 @@ function configure_neutron_nova {
 
 function create_nova_conf_neutron {
     local conf=${1:-$NOVA_CONF}
-    iniset $conf neutron auth_type "password"
-    iniset $conf neutron auth_url "$KEYSTONE_SERVICE_URI"
-    iniset $conf neutron username nova
-    iniset $conf neutron password "$SERVICE_PASSWORD"
-    iniset $conf neutron user_domain_name "$SERVICE_DOMAIN_NAME"
-    iniset $conf neutron project_name "$SERVICE_PROJECT_NAME"
-    iniset $conf neutron project_domain_name "$SERVICE_DOMAIN_NAME"
-    iniset $conf neutron auth_strategy "$Q_AUTH_STRATEGY"
+    configure_keystoneauth $conf nova neutron
     iniset $conf neutron region_name "$REGION_NAME"
 
     # optionally set options in nova_conf
@@ -1011,10 +1004,10 @@ function _configure_neutron_service {
     iniset $NEUTRON_CONF DEFAULT notify_nova_on_port_status_changes $Q_NOTIFY_NOVA_PORT_STATUS_CHANGES
     iniset $NEUTRON_CONF DEFAULT notify_nova_on_port_data_changes $Q_NOTIFY_NOVA_PORT_DATA_CHANGES
 
-    configure_keystone_authtoken_middleware $NEUTRON_CONF nova nova
+    configure_keystoneauth $NEUTRON_CONF nova nova
 
     # Configuration for placement client
-    configure_keystone_authtoken_middleware $NEUTRON_CONF placement placement
+    configure_keystoneauth $NEUTRON_CONF placement placement
 
     # Configure plugin
     neutron_plugin_configure_service
diff --git a/lib/nova b/lib/nova
index 2357d87ee3..a7222cec81 100644
--- a/lib/nova
+++ b/lib/nova
@@ -628,32 +628,19 @@ function create_nova_conf {
 function configure_placement_nova_compute {
     # Use the provided config file path or default to $NOVA_CONF.
     local conf=${1:-$NOVA_CONF}
-    iniset $conf placement auth_type "password"
-    iniset $conf placement auth_url "$KEYSTONE_SERVICE_URI"
-    iniset $conf placement username nova
-    iniset $conf placement password "$SERVICE_PASSWORD"
-    iniset $conf placement user_domain_name "$SERVICE_DOMAIN_NAME"
-    iniset $conf placement project_name "$SERVICE_TENANT_NAME"
-    iniset $conf placement project_domain_name "$SERVICE_DOMAIN_NAME"
-    iniset $conf placement region_name "$REGION_NAME"
+    configure_keystoneauth $conf nova placement
 }
 
 # Configure access to cinder.
 function configure_cinder_access {
     iniset $NOVA_CONF cinder os_region_name "$REGION_NAME"
-    iniset $NOVA_CONF cinder auth_type "password"
-    iniset $NOVA_CONF cinder auth_url "$KEYSTONE_SERVICE_URI"
     # NOTE(mriedem): This looks a bit weird but we use the nova user here
     # since it has the admin role and the cinder user does not. This is
     # similar to using the nova user in init_nova_service_user_conf. We need
     # to use a user with the admin role for background tasks in nova to
     # be able to GET block-storage API resources owned by another project
     # since cinder has low-level "is_admin" checks in its DB API.
-    iniset $NOVA_CONF cinder username nova
-    iniset $NOVA_CONF cinder password "$SERVICE_PASSWORD"
-    iniset $NOVA_CONF cinder user_domain_name "$SERVICE_DOMAIN_NAME"
-    iniset $NOVA_CONF cinder project_name "$SERVICE_TENANT_NAME"
-    iniset $NOVA_CONF cinder project_domain_name "$SERVICE_DOMAIN_NAME"
+    configure_keystoneauth $conf nova cinder
     if is_service_enabled tls-proxy; then
         CINDER_SERVICE_HOST=${CINDER_SERVICE_HOST:-$SERVICE_HOST}
         CINDER_SERVICE_PORT=${CINDER_SERVICE_PORT:-8776}
@@ -663,14 +650,7 @@ function configure_cinder_access {
 
 # Configure access to manila.
 function configure_manila_access {
-    iniset $NOVA_CONF manila os_region_name "$REGION_NAME"
-    iniset $NOVA_CONF manila auth_type "password"
-    iniset $NOVA_CONF manila auth_url "$KEYSTONE_SERVICE_URI"
-    iniset $NOVA_CONF manila username nova
-    iniset $NOVA_CONF manila password "$SERVICE_PASSWORD"
-    iniset $NOVA_CONF manila user_domain_name "$SERVICE_DOMAIN_NAME"
-    iniset $NOVA_CONF manila project_name "$SERVICE_TENANT_NAME"
-    iniset $NOVA_CONF manila project_domain_name "$SERVICE_DOMAIN_NAME"
+    configure_keystoneauth $conf nova manila
 }
 
 function configure_console_compute {
@@ -836,13 +816,7 @@ function configure_nova_unified_limits {
 
 function init_nova_service_user_conf {
     iniset $NOVA_CONF service_user send_service_user_token True
-    iniset $NOVA_CONF service_user auth_type password
-    iniset $NOVA_CONF service_user auth_url "$KEYSTONE_SERVICE_URI"
-    iniset $NOVA_CONF service_user username nova
-    iniset $NOVA_CONF service_user password "$SERVICE_PASSWORD"
-    iniset $NOVA_CONF service_user user_domain_name "$SERVICE_DOMAIN_NAME"
-    iniset $NOVA_CONF service_user project_name "$SERVICE_PROJECT_NAME"
-    iniset $NOVA_CONF service_user project_domain_name "$SERVICE_DOMAIN_NAME"
+    configure_keystoneauth $NOVA_CONF nova service_user
 }
 
 function conductor_conf {

From 5a32609b04aa3df31a128c73cc052d41457db390 Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Tue, 15 Jul 2025 00:22:18 +0900
Subject: [PATCH 2383/2409] Add www_authenticate_uri

... to suppress the following warning from keystonemiddleware.

Configuring www_authenticate_uri to point to the public identity
endpoint is required; clients may not be able to authenticate against
an admin endpoint

Change-Id: I3f1a6b2c5d2e7d3dce6fd1ee6694f8146ae06437
Signed-off-by: Takashi Kajinami <kajinamit@oss.nttdata.com>
---
 lib/keystone | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/keystone b/lib/keystone
index 4a2d7a9f6c..7e7cd2526b 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -453,6 +453,7 @@ function configure_keystone_authtoken_middleware {
     local service_type=$4
 
     configure_keystoneauth $conf_file $admin_user $section
+    iniset $conf_file $section www_authenticate_uri $KEYSTONE_SERVICE_URI
     iniset $conf_file $section cafile $SSL_BUNDLE_FILE
     iniset $conf_file $section memcached_servers $MEMCACHE_SERVERS
     if [[ -n "$service_type" ]]; then

From 8060e12a7bddf16179098e611f7052291eafa1e3 Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Sun, 12 Oct 2025 13:41:57 +0900
Subject: [PATCH 2384/2409] Drop logic for CentOS (Stream) 8

Change-Id: I528652ced464fadd565e16e89a7e0ef826d42611
Signed-off-by: Takashi Kajinami <kajinamit@oss.nttdata.com>
---
 files/rpms/n-cpu              |  3 +--
 files/rpms/nova               |  3 +--
 lib/neutron_plugins/ovn_agent |  3 ---
 stack.sh                      | 31 +------------------------------
 tools/fixup_stuff.sh          | 13 -------------
 5 files changed, 3 insertions(+), 50 deletions(-)

diff --git a/files/rpms/n-cpu b/files/rpms/n-cpu
index 5683862ee0..3d50f3a062 100644
--- a/files/rpms/n-cpu
+++ b/files/rpms/n-cpu
@@ -1,10 +1,9 @@
 cryptsetup
 dosfstools
-genisoimage # not:rhel9,rhel10
 iscsi-initiator-utils
 libosinfo
 lvm2
 sg3_utils
 # Stuff for diablo volumes
 sysfsutils
-xorriso # not:rhel8
+xorriso
diff --git a/files/rpms/nova b/files/rpms/nova
index 3ed2943c1d..c323224279 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -1,7 +1,7 @@
 conntrack-tools
 curl
 ebtables
-genisoimage # not:rhel9,rhel10 required for config_drive
+genisoimage
 iptables
 iputils
 kernel-modules # not:openEuler-22.03
@@ -11,4 +11,3 @@ polkit
 rabbitmq-server # NOPRIME
 sqlite
 sudo
-xorriso # not:rhel8
diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index b128fde2b6..e346f4d1cd 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -407,9 +407,6 @@ function install_ovn {
         sudo mkdir -p $OVS_PREFIX/var/log/ovn
         sudo chown $(whoami) $OVS_PREFIX/var/log/ovn
     else
-        # Load fixup_ovn_centos
-        source ${TOP_DIR}/tools/fixup_stuff.sh
-        fixup_ovn_centos
         install_package $(get_packages openvswitch)
         install_package $(get_packages ovn)
     fi
diff --git a/stack.sh b/stack.sh
index c8be7fa216..67c7a74de9 100755
--- a/stack.sh
+++ b/stack.sh
@@ -366,36 +366,7 @@ fi
 # to speed things up
 SKIP_EPEL_INSTALL=$(trueorfalse False SKIP_EPEL_INSTALL)
 
-if [[ $DISTRO == "rhel8" ]]; then
-    # If we have /etc/ci/mirror_info.sh assume we're on a OpenStack CI
-    # node, where EPEL is installed (but disabled) and already
-    # pointing at our internal mirror
-    if [[ -f /etc/ci/mirror_info.sh ]]; then
-        SKIP_EPEL_INSTALL=True
-        sudo dnf config-manager --set-enabled epel
-    fi
-
-    # PowerTools repo provides libyaml-devel required by devstack itself and
-    # EPEL packages assume that the PowerTools repository is enable.
-    sudo dnf config-manager --set-enabled PowerTools
-
-    # CentOS 8.3 changed the repository name to lower case.
-    sudo dnf config-manager --set-enabled powertools
-
-    if [[ ${SKIP_EPEL_INSTALL} != True ]]; then
-        _install_epel
-    fi
-    # Along with EPEL, CentOS (and a-likes) require some packages only
-    # available in RDO repositories (e.g. OVS, or later versions of
-    # kvm) to run.
-    _install_rdo
-
-    # NOTE(cgoncalves): workaround RHBZ#1154272
-    # dnf fails for non-privileged users when expired_repos.json doesn't exist.
-    # RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1154272
-    # Patch: https://github.com/rpm-software-management/dnf/pull/1448
-    echo "[]" | sudo tee /var/cache/dnf/expired_repos.json
-elif [[ $DISTRO == "rhel9" ]]; then
+if [[ $DISTRO == "rhel9" ]]; then
     # for CentOS Stream 9 repository
     sudo dnf config-manager --set-enabled crb
     # for RHEL 9 repository
diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index faea44f1e0..fbac5ad2f1 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -89,19 +89,6 @@ EOF
     if is_package_installed python3-setuptools; then
         sudo dnf reinstall -y python3-setuptools
     fi
-    # Workaround CentOS 8-stream iputils and systemd Bug
-    # https://bugzilla.redhat.com/show_bug.cgi?id=2037807
-    if [[ $os_VENDOR == "CentOSStream" && $os_RELEASE -eq 8 ]]; then
-        sudo sysctl -w net.ipv4.ping_group_range='0 2147483647'
-    fi
-}
-
-function fixup_ovn_centos {
-    if [[ $os_VENDOR != "CentOS" ]]; then
-        return
-    fi
-    # OVN packages are part of this release for CentOS
-    yum_install centos-release-openstack-victoria
 }
 
 function fixup_ubuntu {

From 84652d3cb8022f20cbcfaef747306c95763b8039 Mon Sep 17 00:00:00 2001
From: Balazs Gibizer <gibi@redhat.com>
Date: Wed, 22 Jan 2025 17:00:59 +0100
Subject: [PATCH 2385/2409] Follow up for creating parent dir for config files

The commit Ia5fcfe6c63f5cc40b11f7e1f3be244d7897f26f6 wanted to enable
config file creation even if its parent dir not exists. But missed that
the caller of merge_config_file, merge_config_group already checks for
hte missing directory. So creating the missing dir in merge_config_file
is too late.

This patch moves the dir creation to the caller.

Change-Id: Ied0f321f31bf8888dce71cc18749f35dde303390
Signed-off-by: Balazs Gibizer <gibi@redhat.com>
---
 inc/meta-config           | 13 ++++++++-----
 tests/test_meta_config.sh | 24 +++++++++++++++++++-----
 2 files changed, 27 insertions(+), 10 deletions(-)

diff --git a/inc/meta-config b/inc/meta-config
index b9d9649e4b..1215bb8307 100644
--- a/inc/meta-config
+++ b/inc/meta-config
@@ -90,7 +90,6 @@ function merge_config_file {
     local real_configfile
     real_configfile=$(eval echo $configfile)
     if [ ! -f $real_configfile ]; then
-        mkdir -p $(dirname $real_configfile) || die $LINENO "could not create the directory of $real_configfile ($configfile)"
         touch $real_configfile || die $LINENO "could not create config file $real_configfile ($configfile)"
     fi
 
@@ -186,11 +185,15 @@ function merge_config_group {
                 break
             fi
             dir=$(dirname $realconfigfile)
-            if [[ -d $dir ]]; then
-                merge_config_file $localfile $group $configfile
-            else
-                die $LINENO "bogus config file specification $configfile ($configfile=$realconfigfile, $dir is not a directory)"
+
+            test -e $dir && ! test -d $dir && die $LINENO "bogus config file specification $configfile ($configfile=$realconfigfile, $dir exists but it is not a directory)"
+
+            if ! [[ -e $dir ]] ; then
+                sudo mkdir -p $dir || die $LINENO "could not create the directory of $real_configfile ($configfile)"
+                sudo chown ${STACK_USER} $dir
             fi
+
+            merge_config_file $localfile $group $configfile
         done
     done
 }
diff --git a/tests/test_meta_config.sh b/tests/test_meta_config.sh
index 087aaf468b..30479f245a 100755
--- a/tests/test_meta_config.sh
+++ b/tests/test_meta_config.sh
@@ -137,6 +137,9 @@ foo=bar
 [some]
 random=config
 
+[[test12|run_tests.sh/test.conf]]
+foo=bar
+
 [[test-multi-sections|test-multi-sections.conf]]
 [sec-1]
 cfg_item1 = abcd
@@ -389,13 +392,12 @@ EXPECT_VAL=0
 check_result "$VAL" "$EXPECT_VAL"
 set -e
 
-echo -n "merge_config_group test10 not directory: "
+echo -n "merge_config_group test10 create directory: "
 set +e
-# function is expected to fail and exit, running it
-# in a subprocess to let this script proceed
-(merge_config_group test.conf test10)
+STACK_USER=$(id -u -n)
+merge_config_group test.conf test10
 VAL=$?
-EXPECT_VAL=255
+EXPECT_VAL=0
 check_result "$VAL" "$EXPECT_VAL"
 set -e
 
@@ -414,9 +416,21 @@ random = config
 non = sense'
 check_result "$VAL" "$EXPECT_VAL"
 
+echo -n "merge_config_group test12 directory as file: "
+set +e
+# function is expected to fail and exit, running it
+# in a subprocess to let this script proceed
+(merge_config_group test.conf test12)
+VAL=$?
+EXPECT_VAL=255
+check_result "$VAL" "$EXPECT_VAL"
+set -e
+
 
 rm -f test.conf test1c.conf test2a.conf \
     test-space.conf test-equals.conf test-strip.conf \
     test-colon.conf test-env.conf test-multiline.conf \
     test-multi-sections.conf test-same.conf
 rm -rf test-etc
+rm -rf does-not-exist-dir
+

From eee708742af669833d6a85d4c7289accb49c18a2 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Fri, 31 Oct 2025 17:09:11 +0000
Subject: [PATCH 2386/2409] Remove use of pkg_resources

Change-Id: I5d0697f39bab0a5ff956c3cc41c26ffe601ef6b9
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
---
 inc/python           | 3 +--
 tools/fixup_stuff.sh | 2 +-
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/inc/python b/inc/python
index cd90ac82c6..3969c1fa82 100644
--- a/inc/python
+++ b/inc/python
@@ -273,8 +273,7 @@ function use_library_from_git {
 function lib_installed_from_git {
     local name=$1
     local safe_name
-    safe_name=$(python -c "from pkg_resources import safe_name; \
-        print(safe_name('${name}'))")
+    safe_name=$(python -c "from packaging import canonicalize_name; print(canonicalize_name('${name}'))")
     # Note "pip freeze" doesn't always work here, because it tries to
     # be smart about finding the remote of the git repo the package
     # was installed from.  This doesn't work with zuul which clones
diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index faea44f1e0..d8283b2591 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -84,7 +84,7 @@ EOF
     # python3-setuptools RPM are deleted, it breaks some tools such as semanage
     # (used in diskimage-builder) that use the -s flag of the python
     # interpreter, enforcing the use of the packages from /usr/lib.
-    # Importing setuptools/pkg_resources in a such environment fails.
+    # Importing setuptools in a such environment fails.
     # Enforce the package re-installation to fix those applications.
     if is_package_installed python3-setuptools; then
         sudo dnf reinstall -y python3-setuptools

From df74bcda897ad9fc4a2f2c1f7a17ee8a4689c217 Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Thu, 6 Nov 2025 13:53:00 +0900
Subject: [PATCH 2387/2409] Install OVMF package

OVMF package is required to enable UEFI boot support.

Change-Id: Ib1c3ab57740488a3ab8650ef033e1e6ec398f108
Signed-off-by: Takashi Kajinami <kajinamit@oss.nttdata.com>
---
 lib/nova_plugins/functions-libvirt | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index c0713f9953..7175931384 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -70,6 +70,7 @@ function install_libvirt {
 
     if is_ubuntu; then
         install_package qemu-system libvirt-clients libvirt-daemon-system libvirt-dev python3-libvirt systemd-coredump
+        install_package ovmf
         if is_arch "aarch64"; then
             install_package qemu-efi-aarch64
         fi
@@ -94,6 +95,7 @@ function install_libvirt {
         # pre-installed these
         install_package $qemu_package
         install_package libvirt libvirt-devel
+        install_package edk2-ovmf
 
         if [[ $DISTRO =~ rhel9 ]]; then
             pip_install_gr libvirt-python

From 1c86258e6b0ccf95e6119d3a6271afa38e05d0a3 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Thu, 2 Oct 2025 17:48:03 +0100
Subject: [PATCH 2388/2409] Enable response validation in Keystone

Unlike other projects, Keystone was previously enabling validation for
all responses. This is a bad idea (TM). Quoting from the Keystone docs
for the new '[api] response_validation' option added in [1]:

  'warn' is the current recommendation for production environments. If
  you find it necessary to enable the 'ignore' option, please report the
  issues you are seeing to the Keystone team so we can improve our
  schemas.

  'error' should not be used in a production environment. This is
  because schema validation happens *after* the response body has been
  generated, meaning any side effects will still happen and the call may
  be non-idempotent despite the user receiving a HTTP 500 error.

DevStack is not used for production environments and is instead the
test harness used for the bulk of our integration testing. We *do* want
failed response validation to result in an error, since it will
highlight bugs in our schemas. Thus, we should override the default
value for this option.

[1] https://review.opendev.org/c/openstack/keystone/+/962851

Change-Id: I9fc2c5dce9511165ad2c1ab18db5eb439d357d9b
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
Related-bug: #2126676
---
 lib/keystone | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/keystone b/lib/keystone
index 241909cb9d..840103b9f4 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -195,6 +195,10 @@ function configure_keystone {
     iniset $KEYSTONE_CONF cache backend $CACHE_BACKEND
     iniset $KEYSTONE_CONF cache memcache_servers $MEMCACHE_SERVERS
 
+    # Enable errors if response validation fails. We want this enabled in CI
+    # and development contexts to highlights bugs in our response schemas.
+    iniset $KEYSTONE_CONF api response_validation error
+
     iniset_rpc_backend keystone $KEYSTONE_CONF oslo_messaging_notifications
 
     local service_port=$KEYSTONE_SERVICE_PORT

From 3566a15b8eeebb0dfc36e47f87129b108d2980e1 Mon Sep 17 00:00:00 2001
From: Stephen Finucane <stephenfin@redhat.com>
Date: Thu, 2 Oct 2025 17:46:42 +0100
Subject: [PATCH 2389/2409] Enable response validation in Nova

Per inline description

Change-Id: I85c959461e4e96b69d252e06fc697a1c61488411
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
---
 lib/nova | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/nova b/lib/nova
index b289ec6d6d..460b4adc85 100644
--- a/lib/nova
+++ b/lib/nova
@@ -453,6 +453,10 @@ function create_nova_conf {
     iniset $NOVA_CONF DEFAULT metadata_listen "$NOVA_SERVICE_LISTEN_ADDRESS"
     iniset $NOVA_CONF DEFAULT shutdown_timeout $NOVA_SHUTDOWN_TIMEOUT
 
+    # Enable errors if response validation fails. We want this enabled in CI
+    # and development contexts to highlights bugs in our response schemas.
+    iniset $NOVA_CONF api response_validation error
+
     iniset $NOVA_CONF key_manager backend nova.keymgr.conf_key_mgr.ConfKeyManager
 
     iniset $NOVA_CONF DEFAULT report_interval $NOVA_SERVICE_REPORT_INTERVAL

From a041a7fc66453958ce1d34421330fd27393bbd65 Mon Sep 17 00:00:00 2001
From: Ghanshyam Maan <gmaan@ghanshyammann.com>
Date: Thu, 6 Nov 2025 18:39:36 +0000
Subject: [PATCH 2390/2409] Re-add the ironic job in gate

Ironic job ironic-tempest-bios-ipmi-direct-tinyipa
has been renamed to ironic-tempest-bios-ipmi-direct
- https://review.opendev.org/c/openstack/ironic/+/950192

Zuul did not give any error or warning when this jobs was
ignored to run and it went unnotice until I manually checked
the gate jobs.

Change-Id: I9b6bb94456ccfd17c2e38cdaa772aef372d169d0
Signed-off-by: Ghanshyam Maan <gmaan@ghanshyammann.com>
---
 .zuul.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 927945d8f0..a751c70a6a 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -998,7 +998,7 @@
         - devstack-multinode
         - devstack-unit-tests
         - openstack-tox-bashate
-        - ironic-tempest-bios-ipmi-direct-tinyipa
+        - ironic-tempest-bios-ipmi-direct
         - swift-dsvm-functional
         - grenade:
             irrelevant-files: *common-irrelevant-files
@@ -1031,7 +1031,7 @@
         - openstack-tox-bashate
         - neutron-ovs-grenade-multinode:
             irrelevant-files: *common-irrelevant-files
-        - ironic-tempest-bios-ipmi-direct-tinyipa
+        - ironic-tempest-bios-ipmi-direct
         - swift-dsvm-functional
         - grenade:
             irrelevant-files: *common-irrelevant-files

From f8ebb4939c46eed2f69bece7a7d9c8ff31b61353 Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Thu, 10 Jul 2025 21:15:21 +0200
Subject: [PATCH 2391/2409] Add support for trixie and platform job

Dropping libapache2-mod-proxy-uwsgi package for debuntu, which is no
longer needed for Jammy, Bookworm and beyond.

libpcre3-dev is removed form the set of packages pre installed
for debian systems.

This change adds both single and two node nodesets for trixie.

Signed-off-by: Dr. Jens Harbott <harbott@osism.tech>
Signed-off-by: Sean Mooney <work@seanmooney.info>
Change-Id: Ib056d2ad64b31657ea8ef9359fed78e589b01b88
---
 .zuul.yaml          | 51 +++++++++++++++++++++++++++++++++++++++++++++
 files/debs/general  |  2 --
 lib/apache          |  2 +-
 lib/databases/mysql | 14 +++++++++++--
 stack.sh            |  3 +--
 5 files changed, 65 insertions(+), 7 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 927945d8f0..357c085fe9 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -68,6 +68,16 @@
         nodes:
           - controller
 
+- nodeset:
+    name: devstack-single-node-debian-trixie
+    nodes:
+      - name: controller
+        label: debian-trixie-8GB
+    groups:
+      - name: tempest
+        nodes:
+          - controller
+
 - nodeset:
     name: devstack-single-node-debian-bookworm
     nodes:
@@ -383,6 +393,36 @@
         nodes:
           - compute1
 
+- nodeset:
+    name: devstack-two-node-debian-trixie
+    nodes:
+      - name: controller
+        label: debian-trixie-8GB
+      - name: compute1
+        label: debian-trixie-8GB
+    groups:
+      # Node where tests are executed and test results collected
+      - name: tempest
+        nodes:
+          - controller
+      # Nodes running the compute service
+      - name: compute
+        nodes:
+          - controller
+          - compute1
+      # Nodes that are not the controller
+      - name: subnode
+        nodes:
+          - compute1
+      # Switch node for multinode networking setup
+      - name: switch
+        nodes:
+          - controller
+      # Peer nodes for multinode networking setup
+      - name: peers
+        nodes:
+          - compute1
+
 - job:
     name: devstack-base
     parent: openstack-multinode-fips
@@ -806,6 +846,15 @@
     timeout: 9000
     voting: false
 
+- job:
+    name: devstack-platform-debian-trixie
+    parent: tempest-full-py3
+    description: Debian Trixie platform test
+    nodeset: devstack-single-node-debian-trixie
+    timeout: 9000
+    vars:
+      configure_swap_size: 4096
+
 - job:
     name: devstack-platform-debian-bookworm
     parent: tempest-full-py3
@@ -990,6 +1039,7 @@
         - devstack-platform-centos-10-stream
         - devstack-platform-centos-9-stream
         - devstack-platform-debian-bookworm
+        - devstack-platform-debian-trixie
         - devstack-platform-rocky-blue-onyx
         - devstack-platform-rocky-red-quartz
         - devstack-platform-ubuntu-noble-ovn-source
@@ -1021,6 +1071,7 @@
         - devstack
         - devstack-ipv6
         - devstack-platform-debian-bookworm
+        - devstack-platform-debian-trixie
         - devstack-platform-ubuntu-noble
         # NOTE(danms): Disabled due to instability, see comment in the job
         # definition above.
diff --git a/files/debs/general b/files/debs/general
index 364f3cc6e2..1e63e4f582 100644
--- a/files/debs/general
+++ b/files/debs/general
@@ -11,10 +11,8 @@ gettext  # used for compiling message catalogs
 git
 graphviz # needed for docs
 iputils-ping
-libapache2-mod-proxy-uwsgi
 libffi-dev # for pyOpenSSL
 libjpeg-dev # Pillow 3.0.0
-libpcre3-dev # for python-pcre
 libpq-dev  # psycopg2
 libssl-dev # for pyOpenSSL
 libsystemd-dev # for systemd-python
diff --git a/lib/apache b/lib/apache
index c49da711e1..b3379a7cde 100644
--- a/lib/apache
+++ b/lib/apache
@@ -82,7 +82,7 @@ function install_apache_uwsgi {
     fi
 
     if is_ubuntu; then
-        local pkg_list="uwsgi uwsgi-plugin-python3 libapache2-mod-proxy-uwsgi"
+        local pkg_list="uwsgi uwsgi-plugin-python3"
         install_package ${pkg_list}
     # NOTE(ianw) 2022-02-03 : Fedora 35 needs to skip this and fall
     # into the install-from-source because the upstream packages
diff --git a/lib/databases/mysql b/lib/databases/mysql
index 629014c1d8..a47580ca3d 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -20,7 +20,7 @@ if [[ -z "$MYSQL_SERVICE_NAME" ]]; then
     MYSQL_SERVICE_NAME=mysql
     if is_fedora && ! is_oraclelinux; then
         MYSQL_SERVICE_NAME=mariadb
-    elif [[ "$DISTRO" =~ bookworm|bullseye ]]; then
+    elif [[ "$DISTRO" =~ trixie|bookworm|bullseye ]]; then
         MYSQL_SERVICE_NAME=mariadb
     fi
 fi
@@ -107,7 +107,7 @@ function configure_database_mysql {
     # for Ubuntu 22.04+ because the authorization model change in
     # version 10.4 of mariadb. See
     # https://mariadb.org/authentication-in-mariadb-10-4/
-    if ! (is_ubuntu && [[ ! "$DISTRO" =~ bookworm|bullseye ]] && [ "$MYSQL_SERVICE_NAME" == "mariadb" ]); then
+    if ! (is_ubuntu && [[ ! "$DISTRO" =~ trixie|bookworm|bullseye ]] && [ "$MYSQL_SERVICE_NAME" == "mariadb" ]); then
         sudo mysqladmin -u root password $DATABASE_PASSWORD || true
     fi
 
@@ -119,6 +119,16 @@ function configure_database_mysql {
         local cmd_args="-uroot -p$DATABASE_PASSWORD -h$SERVICE_LOCAL_HOST "
     fi
 
+    # Workaround for mariadb > 11.6.2,
+    # see https://bugs.launchpad.net/nova/+bug/2116186/comments/3
+    min_db_ver="11.6.2"
+    db_version=$(sudo mysql ${cmd_args} -e "select version();" -sN | cut -d '-' -f 1)
+    max_db_ver=$(printf '%s\n' ${min_db_ver} ${db_version} | sort -V | tail -n 1)
+    if [[ "${min_db_ver}" != "${max_db_ver}" ]]; then
+        iniset -sudo $my_conf mysqld innodb_snapshot_isolation OFF
+        restart_service $MYSQL_SERVICE_NAME
+    fi
+
     # In mariadb e.g. on Ubuntu socket plugin is used for authentication
     # as root so it works only as sudo. To restore old "mysql like" behaviour,
     # we need to change auth plugin for root user
diff --git a/stack.sh b/stack.sh
index a7f6a5e903..5ef98eb7b7 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1,6 +1,5 @@
 #!/usr/bin/env bash
 
-
 # ``stack.sh`` is an opinionated OpenStack developer installation.  It
 # installs and configures various combinations of **Cinder**, **Glance**,
 # **Horizon**, **Keystone**, **Nova**, **Neutron**, and **Swift**
@@ -230,7 +229,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-SUPPORTED_DISTROS="bookworm|jammy|noble|rhel9|rhel10"
+SUPPORTED_DISTROS="trixie|bookworm|jammy|noble|rhel9|rhel10"
 
 if [[ ! ${DISTRO} =~ $SUPPORTED_DISTROS ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"

From 9a0db4f4999e2aa5923ed32452f1d2e41ae4ea55 Mon Sep 17 00:00:00 2001
From: Rodolfo Alonso Hernandez <ralonsoh@redhat.com>
Date: Wed, 16 Jul 2025 11:38:12 +0000
Subject: [PATCH 2392/2409] [Neutron] Add TARGET_ENABLE_OVN_AGENT variable to
 enable OVN agent

The new flag ``TARGET_ENABLE_OVN_AGENT`` will be disabled by default.
If enabled:
* The OVN agent will be enabled, regardless of not being configured.
* The OVN Metadata agent will be disabled, regardless of being
  configured.

This variable will be used, initially, in the grenade jobs. It will
be used to test the migration from the OVN Metadata agent to the
OVN agent.

This variable will be removed in 2026.2, along with the OVN Metadata
agent, that is set as deprecated and marked for removal.

Related-Bug: #2112313
Signed-off-by: Rodolfo Alonso Hernandez <ralonsoh@redhat.com>
Change-Id: I8f91e1cb8543da489f495b8cf5196e606a0f5eea
---
 lib/neutron_plugins/ovn_agent | 44 ++++++++++++++++++++++++++++-------
 1 file changed, 35 insertions(+), 9 deletions(-)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index b128fde2b6..0e87b473e9 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -99,6 +99,13 @@ OVN_META_DATA_HOST=${OVN_META_DATA_HOST:-$(ipv6_unquote $SERVICE_HOST)}
 # The OVN agent is configured, by default, with the "metadata" extension.
 OVN_AGENT_CONF=$NEUTRON_CONF_DIR/plugins/ml2/ovn_agent.ini
 OVN_AGENT_EXTENSIONS=${OVN_AGENT_EXTENSIONS:-metadata}
+# The variable TARGET_ENABLE_OVN_AGENT, if True, overrides the OVN Metadata
+# agent service (q-ovn-metadata-agent neutron-ovn-metadata-agent) and the OVN
+# agent service (q-ovn-agent neutron-ovn-agent) configuration, always disabling
+# the first one (OVN Metadata agent) and enabling the second (OVN agent).
+# This variable will be removed in 2026.2, along with the OVN Metadata agent
+# removal.
+TARGET_ENABLE_OVN_AGENT=$(trueorfalse False TARGET_ENABLE_OVN_AGENT)
 
 # If True (default) the node will be considered a gateway node.
 ENABLE_CHASSIS_AS_GW=$(trueorfalse True ENABLE_CHASSIS_AS_GW)
@@ -301,6 +308,21 @@ function create_public_bridge {
     _configure_public_network_connectivity
 }
 
+function is_ovn_metadata_agent_enabled {
+    if is_service_enabled q-ovn-metadata-agent neutron-ovn-metadata-agent && [[ "$TARGET_ENABLE_OVN_AGENT" == "False" ]]; then
+        return 0
+    fi
+    return 1
+}
+
+function is_ovn_agent_enabled {
+    if is_service_enabled q-ovn-agent neutron-ovn-agent || [[ "$TARGET_ENABLE_OVN_AGENT" == "True" ]]; then
+        enable_service q-ovn-agent
+        return 0
+    fi
+    return 1
+
+}
 
 # OVN compilation functions
 # -------------------------
@@ -498,9 +520,9 @@ function configure_ovn_plugin {
             inicomment /$Q_PLUGIN_CONF_FILE network_log local_output_log_base="$Q_LOG_DRIVER_LOG_BASE"
         fi
 
-        if is_service_enabled q-ovn-metadata-agent neutron-ovn-metadata-agent; then
+        if is_ovn_metadata_agent_enabled; then
             populate_ml2_config /$Q_PLUGIN_CONF_FILE ovn ovn_metadata_enabled=True
-        elif is_service_enabled q-ovn-agent neutron-ovn-agent && [[ "$OVN_AGENT_EXTENSIONS" =~ 'metadata' ]]; then
+        elif is_ovn_agent_enabled && [[ "$OVN_AGENT_EXTENSIONS" =~ 'metadata' ]]; then
             populate_ml2_config /$Q_PLUGIN_CONF_FILE ovn ovn_metadata_enabled=True
         else
             populate_ml2_config /$Q_PLUGIN_CONF_FILE ovn ovn_metadata_enabled=False
@@ -521,9 +543,9 @@ function configure_ovn_plugin {
     fi
 
     if is_service_enabled n-api-meta ; then
-        if is_service_enabled q-ovn-metadata-agent neutron-ovn-metadata-agent; then
+        if is_ovn_metadata_agent_enabled; then
             iniset $NOVA_CONF neutron service_metadata_proxy True
-        elif is_service_enabled q-ovn-agent neutron-ovn-agent && [[ "$OVN_AGENT_EXTENSIONS" =~ 'metadata' ]]; then
+        elif is_ovn_agent_enabled && [[ "$OVN_AGENT_EXTENSIONS" =~ 'metadata' ]]; then
             iniset $NOVA_CONF neutron service_metadata_proxy True
         fi
     fi
@@ -558,10 +580,10 @@ function configure_ovn {
     # Metadata
     local sample_file=""
     local config_file=""
-    if is_service_enabled q-ovn-agent neutron-ovn-agent && [[ "$OVN_AGENT_EXTENSIONS" =~ 'metadata' ]] && is_service_enabled ovn-controller; then
+    if is_ovn_agent_enabled && [[ "$OVN_AGENT_EXTENSIONS" =~ 'metadata' ]] && is_service_enabled ovn-controller; then
         sample_file=$NEUTRON_DIR/etc/neutron/plugins/ml2/ovn_agent.ini.sample
         config_file=$OVN_AGENT_CONF
-    elif is_service_enabled q-ovn-metadata-agent neutron-ovn-metadata-agent && is_service_enabled ovn-controller; then
+    elif is_ovn_metadata_agent_enabled && is_service_enabled ovn-controller; then
         sample_file=$NEUTRON_DIR/etc/neutron_ovn_metadata_agent.ini.sample
         config_file=$OVN_META_CONF
     fi
@@ -758,13 +780,13 @@ function start_ovn {
         fi
     fi
 
-    if is_service_enabled q-ovn-metadata-agent neutron-ovn-metadata-agent; then
+    if is_ovn_metadata_agent_enabled; then
         run_process q-ovn-metadata-agent "$NEUTRON_OVN_BIN_DIR/$NEUTRON_OVN_METADATA_BINARY --config-file $OVN_META_CONF"
         # Format logging
         setup_logging $OVN_META_CONF
     fi
 
-    if is_service_enabled q-ovn-agent neutron-ovn-agent; then
+    if is_ovn_agent_enabled; then
         run_process q-ovn-agent "$NEUTRON_OVN_BIN_DIR/$NEUTRON_OVN_AGENT_BINARY --config-file $OVN_AGENT_CONF"
         # Format logging
         setup_logging $OVN_AGENT_CONF
@@ -786,13 +808,17 @@ function _stop_process {
 }
 
 function stop_ovn {
+    # NOTE(ralonsoh): this check doesn't use "is_ovn_metadata_agent_enabled",
+    # instead it relies only in the configured services, disregarding the
+    # flag "TARGET_ENABLE_OVN_AGENT". It is needed to force the OVN Metadata
+    # agent stop in case the flag "TARGET_ENABLE_OVN_AGENT" is set.
     if is_service_enabled q-ovn-metadata-agent neutron-ovn-metadata-agent; then
         # pkill takes care not to kill itself, but it may kill its parent
         # sudo unless we use the "ps | grep [f]oo" trick
         sudo pkill -9 -f "[h]aproxy" || :
         _stop_process "devstack@q-ovn-metadata-agent.service"
     fi
-    if is_service_enabled q-ovn-agent neutron-ovn-agent; then
+    if is_ovn_agent_enabled; then
         # pkill takes care not to kill itself, but it may kill its parent
         # sudo unless we use the "ps | grep [f]oo" trick
         sudo pkill -9 -f "[h]aproxy" || :

From e8a11f5070fef8b9d757155b51da16481bac9aed Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Fri, 21 Nov 2025 21:01:50 +0100
Subject: [PATCH 2393/2409] Drop lib/oslo from unstack.sh

This was missed in [0].

[0] I6a66359c19d0385beafb4c5e57b6ec3cd6d9cc54

Signed-off-by: Dr. Jens Harbott <harbott@osism.tech>
Change-Id: Idaee45beb63b2badc72c4a70442c5b9aa7fb19fe
---
 unstack.sh | 1 -
 1 file changed, 1 deletion(-)

diff --git a/unstack.sh b/unstack.sh
index 29c80718f8..8e8996c63b 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -61,7 +61,6 @@ source $TOP_DIR/lib/tls
 
 # Source project function libraries
 source $TOP_DIR/lib/infra
-source $TOP_DIR/lib/oslo
 source $TOP_DIR/lib/lvm
 source $TOP_DIR/lib/horizon
 source $TOP_DIR/lib/keystone

From 5d602fef2a7f3ac153c907304a8f43b38c0c1a50 Mon Sep 17 00:00:00 2001
From: Ghanshyam <gmaan@ghanshyammann.com>
Date: Fri, 21 Nov 2025 20:40:07 +0000
Subject: [PATCH 2394/2409] Revert "Cap stable/2025.2 network, swift, volume
 api_extensions for tempest"

This reverts commit 093bc57518a72b63a59389df63491d476069fc5c.

Reason for revert:

This is done by mistake on master. It needs to be done on stable/2025.2 https://review.opendev.org/c/openstack/devstack/+/968073

Change-Id: I8bd7b732c181f3abb015a57b4445332614f8c6c9
Signed-off-by: Ghanshyam <gmaan@ghanshyammann.com>
---
 lib/tempest | 61 +++--------------------------------------------------
 1 file changed, 3 insertions(+), 58 deletions(-)

diff --git a/lib/tempest b/lib/tempest
index 892e7fd72a..1ebe9c5f1f 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -805,48 +805,7 @@ function configure_tempest {
         DISABLE_NETWORK_API_EXTENSIONS+=", l3_agent_scheduler"
     fi
 
-    DEFAULT_NET_EXT="address-scope,agent,allowed-address-pairs,auto-allocated-topology"
-    DEFAULT_NET_EXT+=",availability_zone,binding,default-subnetpools,dhcp_agent_scheduler"
-    DEFAULT_NET_EXT+=",dvr,ext-gw-mode,external-net,extra_dhcp_opt,extraroute,flavors"
-    DEFAULT_NET_EXT+=",l3-flavors,l3-ha,l3_agent_scheduler,multi-provider,net-mtu"
-    DEFAULT_NET_EXT+=",network-ip-availability,network_availability_zone,pagination"
-    DEFAULT_NET_EXT+=",port-security,project-id,provider,quotas,quota_details,rbac-policies"
-    DEFAULT_NET_EXT+=",revision-if-match,router,router_availability_zone,security-group,service-type,sorting"
-    DEFAULT_NET_EXT+=",standard-attr-description,standard-attr-revisions,standard-attr-tag,standard-attr-timestamp"
-    DEFAULT_NET_EXT+=",subnet-service-types,subnet_allocation,net-mtu-writable,ip-substring-filtering"
-    DEFAULT_NET_EXT+=",availability_zone_filter,filter-validation,empty-string-filtering,port-mac-address-regenerate"
-    DEFAULT_NET_EXT+=",port-security-groups-filtering,fip-port-details,binding-extended"
-    DEFAULT_NET_EXT+=",subnet_onboard,l3-port-ip-change-not-allowed,agent-resources-synced"
-    DEFAULT_NET_EXT+=",floatingip-pools,rbac-security-groups,subnetpool-prefix-ops,router-admin-state-down-before-update"
-    DEFAULT_NET_EXT+=",rbac-subnetpool,tag-ports-during-bulk-creation,stateful-security-group,address-group,extraroute-atomic"
-    DEFAULT_NET_EXT+=",port-numa-affinity-policy,rbac-address-scope,security-groups-remote-address-group,trunk,trunk-details"
-    DEFAULT_NET_EXT+=",rbac-address-group,port-device-profile"
-    DEFAULT_NET_EXT+=",multiple-external-gateways,qos-pps-minimum,l3-ext-ndp-proxy,rbac-bgpvpn"
-    DEFAULT_NET_EXT+=",qos-pps,ecmp_routes,bgp,floating-ip-port-forwarding-port-ranges"
-    # New in Yoga
-    DEFAULT_NET_EXT+=",security-groups-shared-filtering,security-groups-normalized-cidr,quota-check-limit"
-    DEFAULT_NET_EXT+=",port-resource-request-groups"
-    # New in Zed
-    DEFAULT_NET_EXT+=",port-mac-override,floating-ip-port-forwarding-detail,network-cascade-delete"
-    # New in 2023.1
-    DEFAULT_NET_EXT+=",port-hints,floating-ip-distributed"
-    # New in 2023.2
-    DEFAULT_NET_EXT+=",port-hint-ovs-tx-steering,enable-default-route-bfd"
-    DEFAULT_NET_EXT+=",enable-default-route-ecmp,standard-attr-fwaas-v2"
-    DEFAULT_NET_EXT+=",allowed-address-pairs-atomic,network_ha"
-    DEFAULT_NET_EXT+=",security-groups-rules-belongs-to-default-sg"
-    DEFAULT_NET_EXT+=",port-hardware-offload-type"
-    # New in 2024.1
-    DEFAULT_NET_EXT+=",vpn-aes-ccm-gcm,tap-mirror,subnet-external-network"
-    DEFAULT_NET_EXT+=",port-numa-affinity-policy-socket"
-    # New in 2024.2
-    DEFAULT_NET_EXT+=",tag-creation,quota-check-limit-default,port-trusted-vif"
-    DEFAULT_NET_EXT+=",uplink-status-propagation-updatable"
-    # New in 2025.1
-    DEFAULT_NET_EXT+=",qing,vpn-aes-ctr"
-    # New in 2025.2: None
-    local network_api_extensions=${NETWORK_API_EXTENSIONS:-$DEFAULT_NET_EXT}
-
+    local network_api_extensions=${NETWORK_API_EXTENSIONS:-"all"}
     if [[ ! -z "$DISABLE_NETWORK_API_EXTENSIONS" ]]; then
         # Enabled extensions are either the ones explicitly specified or those available on the API endpoint
         network_api_extensions=${NETWORK_API_EXTENSIONS:-$(iniget $tmp_cfg_file network-feature-enabled api_extensions | tr -d " ")}
@@ -858,10 +817,7 @@ function configure_tempest {
     fi
     iniset $TEMPEST_CONFIG network-feature-enabled api_extensions $network_api_extensions
     # Swift API Extensions
-    DEFAULT_SWIFT_OPT="account_quotas,bulk_delete,bulk_upload,container_quotas"
-    DEFAULT_SWIFT_OPT+=",container_sync,crossdomain,formpost,ratelimit,slo"
-    DEFAULT_SWIFT_OPT+=",staticweb,tempauth,tempurl,versioned_writes"
-    local object_storage_api_extensions=${OBJECT_STORAGE_API_EXTENSIONS:-$DEFAULT_SWIFT_OPT}
+    local object_storage_api_extensions=${OBJECT_STORAGE_API_EXTENSIONS:-"all"}
     if [[ ! -z "$DISABLE_OBJECT_STORAGE_API_EXTENSIONS" ]]; then
         # Enabled extensions are either the ones explicitly specified or those available on the API endpoint
         object_storage_api_extensions=${OBJECT_STORAGE_API_EXTENSIONS:-$(iniget $tmp_cfg_file object-storage-feature-enabled discoverable_apis | tr -d " ")}
@@ -870,18 +826,7 @@ function configure_tempest {
     fi
     iniset $TEMPEST_CONFIG object-storage-feature-enabled discoverable_apis $object_storage_api_extensions
     # Cinder API Extensions
-    DEFAULT_VOL_EXT="OS-SCH-HNT,backups,capabilities,cgsnapshots,consistencygroups"
-    DEFAULT_VOL_EXT+=",encryption,os-admin-actions,os-availability-zone"
-    DEFAULT_VOL_EXT+=",os-extended-services,os-extended-snapshot-attributes"
-    DEFAULT_VOL_EXT+=",os-hosts,os-quota-class-sets,os-quota-sets"
-    DEFAULT_VOL_EXT+=",os-services,os-snapshot-actions,os-snapshot-manage"
-    DEFAULT_VOL_EXT+=",os-snapshot-unmanage,os-types-extra-specs,os-types-manage"
-    DEFAULT_VOL_EXT+=",os-used-limits,os-vol-host-attr,os-vol-image-meta"
-    DEFAULT_VOL_EXT+=",os-vol-mig-status-attr,os-vol-tenant-attr,os-volume-actions"
-    DEFAULT_VOL_EXT+=",os-volume-encryption-metadata,os-volume-manage"
-    DEFAULT_VOL_EXT+=",os-volume-transfer,os-volume-type-access"
-    DEFAULT_VOL_EXT+=",os-volume-unmanage,qos-specs,scheduler-stats"
-    local volume_api_extensions=${VOLUME_API_EXTENSIONS:-$DEFAULT_VOL_EXT}
+    local volume_api_extensions=${VOLUME_API_EXTENSIONS:-"all"}
     if [[ ! -z "$DISABLE_VOLUME_API_EXTENSIONS" ]]; then
         # Enabled extensions are either the ones explicitly specified or those available on the API endpoint
         volume_api_extensions=${VOLUME_API_EXTENSIONS:-$(iniget $tmp_cfg_file volume-feature-enabled api_extensions | tr -d " ")}

From c2a5090c2f6ab70cf8d3026e9af26af84cca3a3a Mon Sep 17 00:00:00 2001
From: Sean Mooney <work@seanmooney.info>
Date: Mon, 24 Nov 2025 18:25:57 +0000
Subject: [PATCH 2395/2409] allow get_extra_files to retry on common errors

This change add 4 new varibles to devstack to allow controlling
the behvaior fo downloadign files via get_extra_files

EXTRA_FILES_RETRY=${EXTRA_FILES_RETRY:-3}
EXTRA_FILES_RETRY_ERRORS=${EXTRA_FILES_RETRY_ERRORS:-"500,503"}
EXTRA_FILES_DOWNLOAD_TIMEOUT=${EXTRA_FILES_DOWNLOAD_TIMEOUT:-2}
EXTRA_FILES_RETRY_TIMEOUT=${EXTRA_FILES_RETRY_TIMEOUT:-10}

get_extra_files checks if a file is precached and downlaods
it if not present

The new fucntionaltiy modifes the wget invocation to retry
up to 3 times if there are dns name issues, connection refused
or the server return a 500 or 503

This change will not retry on 403 or 429 error codes
which are often used to indicate rate limits.

The download timeout remains at 2 seconds but
can now be set if required. A 10 second over all retry
wait timeout is added matching wgets default.

finally the use of sed to strip the file:// prefix
if present is replace with usign bash parmater expansion
echo "${file_url#file://}"

Assisted-By: gemini pro 3
Change-Id: Iedbb8974dce34a3d1c89f2a2561df76e696afae6
Signed-off-by: Sean Mooney <work@seanmooney.info>
---
 functions | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/functions b/functions
index 829fc86c55..63c6318c2e 100644
--- a/functions
+++ b/functions
@@ -47,6 +47,10 @@ function short_source {
 # export it so child shells have access to the 'short_source' function also.
 export -f short_source
 
+EXTRA_FILES_RETRY=${EXTRA_FILES_RETRY:-3}
+EXTRA_FILES_RETRY_ERRORS=${EXTRA_FILES_RETRY_ERRORS:-"500,503"}
+EXTRA_FILES_DOWNLOAD_TIMEOUT=${EXTRA_FILES_DOWNLOAD_TIMEOUT:-2}
+EXTRA_FILES_RETRY_TIMEOUT=${EXTRA_FILES_RETRY_TIMEOUT:-10}
 # Download a file from a URL
 #
 # Will check cache (in $FILES) or download given URL.
@@ -55,17 +59,20 @@ export -f short_source
 #
 # Will echo the local path to the file as the output.  Will die on
 # failure to download.
-#
+
 # Files can be pre-cached for CI environments, see EXTRA_CACHE_URLS
 # and tools/image_list.sh
 function get_extra_file {
     local file_url=$1
-
-    file_name=$(basename "$file_url")
+    local retry_args="--retry-on-host-error --retry-on-http-error=${EXTRA_FILES_RETRY_ERRORS} "
+    retry_args+="-t ${EXTRA_FILES_DOWNLOAD_TIMEOUT} --waitretry=${EXTRA_FILES_RETRY_TIMEOUT} "
+    retry_args+="--tries=${EXTRA_FILES_RETRY} --retry-connrefused"
+    # Using Bash parameter expansion (##*/) instead of external 'basename'
+    local file_name="${file_url##*/}"
     if [[ $file_url != file* ]]; then
         # If the file isn't cache, download it
         if [[ ! -f $FILES/$file_name ]]; then
-            wget --progress=dot:giga -t 2 -c $file_url -O $FILES/$file_name
+            wget --progress=dot:giga  ${retry_args} -c $file_url -O $FILES/$file_name
             if [[ $? -ne 0 ]]; then
                 die "$file_url could not be downloaded"
             fi
@@ -74,7 +81,7 @@ function get_extra_file {
         return
     else
         # just strip the file:// bit and that's the path to the file
-        echo $file_url | sed 's/$file:\/\///g'
+        echo "${file_url#file://}"
     fi
 }
 

From fc31d8a37e59d6811b208b5dba6c312365abd2d8 Mon Sep 17 00:00:00 2001
From: Michal Nasiadka <mnasiadka@gmail.com>
Date: Tue, 9 Dec 2025 17:49:41 +0100
Subject: [PATCH 2396/2409] almalinux: Switch to build OVS from source

Since almalinux-10 label in OpenDev runs on both x86-64-v2 and v3,
and CentOS NFV SIG OVS packages are only build for v3, these jobs
have been only successful when spawned on v3 hardware.

In order to make the job passable on v2 hardware - we should be
building OVS from source.

Rename the jobs to reflect the change

Change-Id: I67b19c18b45af23cda7899f7c2edab21b8ed1ede
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
---
 .zuul.yaml | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 0aa2530d77..2227f185dd 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -818,7 +818,7 @@
 # and these platforms don't have the round-the-clock support to avoid
 # becoming blockers in that situation.
 - job:
-    name: devstack-platform-almalinux-purple-lion
+    name: devstack-platform-almalinux-purple-lion-ovn-source
     parent: tempest-full-py3
     description: AlmaLinux 10 platform test
     nodeset: devstack-single-node-almalinux-10
@@ -826,6 +826,11 @@
     voting: false
     vars:
       configure_swap_size: 4096
+      devstack_localrc:
+        OVN_BUILD_FROM_SOURCE: True
+        OVN_BRANCH: "branch-24.03"
+        OVS_BRANCH: "branch-3.3"
+        OVS_SYSCONFDIR: "/usr/local/etc/openvswitch"
 
 - job:
     name: devstack-platform-centos-10-stream
@@ -1036,7 +1041,7 @@
         - devstack
         - devstack-ipv6
         - devstack-enforce-scope
-        - devstack-platform-almalinux-purple-lion
+        - devstack-platform-almalinux-purple-lion-ovn-source
         - devstack-platform-centos-10-stream
         - devstack-platform-centos-9-stream
         - devstack-platform-debian-bookworm
@@ -1124,7 +1129,7 @@
         - devstack-no-tls-proxy
     periodic-weekly:
       jobs:
-        - devstack-platform-almalinux-purple-lion
+        - devstack-platform-almalinux-purple-lion-ovn-source
         - devstack-platform-centos-10-stream
         - devstack-platform-centos-9-stream
         - devstack-platform-debian-bookworm

From c11b16b44de613a15833e610ebf77d539e488856 Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Wed, 13 Aug 2025 01:02:34 +0900
Subject: [PATCH 2397/2409] Fix ownership of keyring file

The file should be owned by the user(STACK_USER) to run the process.
Note that STACK_USER may not match the current user in case stack.sh is
run by root.

Also we should not assume that the group name always matches the user
name.

Change-Id: Iec300311cab1b1a2fa124879aa3dc6a57a6a706b
Signed-off-by: Takashi Kajinami <kajinamit@oss.nttdata.com>
---
 lib/cinder_backups/ceph | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/cinder_backups/ceph b/lib/cinder_backups/ceph
index e60efbb632..e4d6b96407 100644
--- a/lib/cinder_backups/ceph
+++ b/lib/cinder_backups/ceph
@@ -34,7 +34,7 @@ function configure_cinder_backup_ceph {
             sudo ceph -c ${CEPH_CONF_FILE} osd pool set ${CINDER_BAK_CEPH_POOL} crush_ruleset ${RULE_ID}
         fi
         sudo ceph -c ${CEPH_CONF_FILE} auth get-or-create client.${CINDER_BAK_CEPH_USER} mon "profile rbd" osd "profile rbd pool=${CINDER_BAK_CEPH_POOL}, profile rbd pool=${CINDER_CEPH_POOL}" | sudo tee ${CEPH_CONF_DIR}/ceph.client.${CINDER_BAK_CEPH_USER}.keyring
-        sudo chown $(whoami):$(whoami) ${CEPH_CONF_DIR}/ceph.client.${CINDER_BAK_CEPH_USER}.keyring
+        sudo chown $STACK_USER ${CEPH_CONF_DIR}/ceph.client.${CINDER_BAK_CEPH_USER}.keyring
     fi
 
     iniset $CINDER_CONF DEFAULT backup_driver "cinder.backup.drivers.ceph.CephBackupDriver"

From 0b200dd617e4bec34d797e5ecb82382d8ffe21ea Mon Sep 17 00:00:00 2001
From: Rodolfo Alonso Hernandez <ralonsoh@redhat.com>
Date: Fri, 2 Jan 2026 09:39:25 +0100
Subject: [PATCH 2398/2409] lib/neutron: read api-paste and rootwrap from
 $NEUTRON_DIR/etc/neutron

Related patches:
* https://review.opendev.org/c/openstack/devstack/+/961224
* https://review.opendev.org/c/openstack/neutron/+/961130

Signed-off-by: Rodolfo Alonso Hernandez <ralonsoh@redhat.com>
Change-Id: I7cf4483d533f9536d2450088a97e95dfb4f22e3a
---
 lib/neutron | 16 ++--------------
 1 file changed, 2 insertions(+), 14 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index dec15fb782..532945f6d5 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -996,13 +996,7 @@ function _configure_neutron_plugin_agent {
 # It is called when q-svc is enabled.
 function _configure_neutron_service {
     Q_API_PASTE_FILE=$NEUTRON_CONF_DIR/api-paste.ini
-    if test -r $NEUTRON_DIR/etc/neutron/api-paste.ini; then
-        cp $NEUTRON_DIR/etc/neutron/api-paste.ini $Q_API_PASTE_FILE
-    else
-        # TODO(stephenfin): Remove this branch once [1] merges
-        # [1] https://review.opendev.org/c/openstack/neutron/+/961130
-        cp $NEUTRON_DIR/etc/api-paste.ini $Q_API_PASTE_FILE
-    fi
+    cp $NEUTRON_DIR/etc/neutron/api-paste.ini $Q_API_PASTE_FILE
 
     # Update either configuration file with plugin
     iniset $NEUTRON_CONF DEFAULT core_plugin $Q_PLUGIN_CLASS
@@ -1079,13 +1073,7 @@ function _neutron_setup_rootwrap {
 
     # Set up ``rootwrap.conf``, pointing to ``$NEUTRON_CONF_DIR/rootwrap.d``
     # location moved in newer versions, prefer new location
-    if test -r $NEUTRON_DIR/etc/neutron/rootwrap.conf; then
-        sudo install -o root -g root -m 644 $NEUTRON_DIR/etc/neutron/rootwrap.conf $Q_RR_CONF_FILE
-    else
-        # TODO(stephenfin): Remove this branch once [1] merges
-        # [1] https://review.opendev.org/c/openstack/neutron/+/961130
-        sudo install -o root -g root -m 644 $NEUTRON_DIR/etc/rootwrap.conf $Q_RR_CONF_FILE
-    fi
+    sudo install -o root -g root -m 644 $NEUTRON_DIR/etc/neutron/rootwrap.conf $Q_RR_CONF_FILE
     sudo sed -e "s:^filters_path=.*$:filters_path=$Q_CONF_ROOTWRAP_D:" -i $Q_RR_CONF_FILE
     # Rely on $PATH set by devstack to determine what is safe to execute
     # by rootwrap rather than use explicit whitelist of paths in

From 92a70ba9dda1669f7af00cacd6cc7f41b764f5da Mon Sep 17 00:00:00 2001
From: Gregory Thiemonge <gthiemon@redhat.com>
Date: Tue, 6 Jan 2026 08:52:41 +0100
Subject: [PATCH 2399/2409] Fix centos/rhel 9/10 dependencies

An error was introduced in [0], it added an incorrect dependency on
genisoimage for nova, and kept a valid dependency on xorriso in n-cpu.
It breaks centos 10 deployments, the expected behavior is to use xorriso
on modern rhel/centos.

[0] https://review.opendev.org/c/openstack/devstack/+/963799

Change-Id: I0057f934c453ded198f8b5e58f4924260a3d2508
Signed-off-by: Gregory Thiemonge <gthiemon@redhat.com>
---
 files/rpms/nova | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/files/rpms/nova b/files/rpms/nova
index c323224279..d0f843bb60 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -1,7 +1,6 @@
 conntrack-tools
 curl
 ebtables
-genisoimage
 iptables
 iputils
 kernel-modules # not:openEuler-22.03
@@ -11,3 +10,4 @@ polkit
 rabbitmq-server # NOPRIME
 sqlite
 sudo
+xorriso

From efb34cacc71d4c80a4a62655f271526981a61a48 Mon Sep 17 00:00:00 2001
From: Sean Mooney <work@seanmooney.info>
Date: Fri, 9 Jan 2026 19:02:39 +0000
Subject: [PATCH 2400/2409] Fix neutron service detection in unstack.sh

Neutron services (neutron-api, neutron-rpc-server, and
neutron-periodic-workers) were not being stopped during unstack
because they were not detected as enabled in ENABLED_SERVICES.

The root cause was that these services were dynamically enabled
during stack.sh execution via inline enable_service calls in
start_neutron_service_and_check(), but this logic was not
replicated in unstack.sh. When unstack.sh called stop_process
for these services, the is_service_enabled check failed because
the services were not in ENABLED_SERVICES.

This fix creates a shared enable_neutron_server_services()
function that encapsulates the service enabling logic, reading
neutron.conf to determine which services should be enabled
(including conditional RPC worker enablement based on the
rpc_workers configuration). This function is now called from
both the stack.sh path (in start_neutron_service_and_check)
and the unstack.sh path (after loading plugin settings).

This ensures both stack and unstack use identical logic to
determine enabled services, allowing stop_process to properly
detect and stop all neutron server services.

Generated-By: Cursor claude-sonnet-4.5
Change-Id: I6179f3a861401ff12178aaee8b82ba7bf71dd765
Signed-off-by: Sean Mooney <work@seanmooney.info>
---
 lib/neutron | 60 ++++++++++++++++++++++++++++++++++-------------------
 unstack.sh  |  6 ++++++
 2 files changed, 45 insertions(+), 21 deletions(-)

diff --git a/lib/neutron b/lib/neutron
index dec15fb782..dbdac5c7da 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -348,12 +348,6 @@ function _determine_config_l3 {
     echo "$opts"
 }
 
-function _enable_ovn_maintenance {
-    if [[ $Q_AGENT == "ovn" ]]; then
-        enable_service neutron-ovn-maintenance-worker
-    fi
-}
-
 function _run_ovn_maintenance {
     if [[ $Q_AGENT == "ovn" ]]; then
         run_process neutron-ovn-maintenance-worker "$NEUTRON_BIN_DIR/neutron-ovn-maintenance-worker $cfg_file_options"
@@ -606,6 +600,39 @@ function start_ovn_services {
     fi
 }
 
+# Enable neutron server services based on configuration
+# This function determines which neutron services should be enabled
+# and adds them to ENABLED_SERVICES. It reads the neutron configuration
+# to determine if RPC workers should be enabled.
+# This must be called after configure_neutron has created the config files.
+function enable_neutron_server_services {
+    local rpc_workers
+
+    # The default value of "rpc_workers" is None (not defined). If
+    # "rpc_workers" is explicitly set to 0, the RPC workers process
+    # should not be executed.
+    if [[ -f $NEUTRON_CONF ]]; then
+        rpc_workers=$(iniget_multiline $NEUTRON_CONF DEFAULT rpc_workers)
+    else
+        # If config doesn't exist yet, assume default behavior (enable rpc workers)
+        rpc_workers=""
+    fi
+
+    # Always enable these core services
+    enable_service neutron-api
+    enable_service neutron-periodic-workers
+
+    # Conditionally enable RPC server based on configuration
+    if [[ "$rpc_workers" != "0" ]]; then
+        enable_service neutron-rpc-server
+    fi
+
+    # Enable OVN maintenance worker if using OVN
+    if [[ $Q_AGENT == "ovn" ]]; then
+        enable_service neutron-ovn-maintenance-worker
+    fi
+}
+
 # Start running processes
 function start_neutron_service_and_check {
     local service_port=$Q_PORT
@@ -620,24 +647,15 @@ function start_neutron_service_and_check {
         service_protocol="http"
     fi
 
-    # Start the Neutron service
-    # The default value of "rpc_workers" is None (not defined). If
-    # "rpc_workers" is explicitly set to 0, the RPC workers process
-    # should not be executed.
-    local rpc_workers
-    rpc_workers=$(iniget_multiline $NEUTRON_CONF DEFAULT rpc_workers)
+    # Enable neutron server services based on configuration
+    enable_neutron_server_services
 
-    enable_service neutron-api
+    # Start the Neutron service processes
     run_process neutron-api "$(which uwsgi) --procname-prefix neutron-api --ini $NEUTRON_UWSGI_CONF"
     neutron_url=$Q_PROTOCOL://$Q_HOST/
-    if [ "$rpc_workers" != "0" ]; then
-        enable_service neutron-rpc-server
-    fi
-    enable_service neutron-periodic-workers
-    _enable_ovn_maintenance
-    if [ "$rpc_workers" != "0" ]; then
-        run_process neutron-rpc-server "$NEUTRON_BIN_DIR/neutron-rpc-server $cfg_file_options"
-    fi
+
+    # Start RPC server if enabled (run_process checks is_service_enabled internally)
+    run_process neutron-rpc-server "$NEUTRON_BIN_DIR/neutron-rpc-server $cfg_file_options"
     run_process neutron-periodic-workers "$NEUTRON_BIN_DIR/neutron-periodic-workers $cfg_file_options"
     _run_ovn_maintenance
     if [ ! -z "$NEUTRON_ENDPOINT_SERVICE_NAME" ]; then
diff --git a/unstack.sh b/unstack.sh
index 8e8996c63b..48626419da 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -87,6 +87,12 @@ fi
 
 load_plugin_settings
 
+# Enable neutron server services so they can be properly stopped
+# This replicates the service enabling logic from stack.sh
+if is_service_enabled neutron; then
+    enable_neutron_server_services
+fi
+
 set -o xtrace
 
 # Run extras

From 2df8cce816641d1b3ab720f04e1e38382987e526 Mon Sep 17 00:00:00 2001
From: Sean Mooney <work@seanmooney.info>
Date: Fri, 9 Jan 2026 19:22:10 +0000
Subject: [PATCH 2401/2409] Fix missing service stops in unstack.sh

Several services started by stack.sh were not properly stopped in
unstack.sh, which could leave processes running and prevent clean
restacking:

- tcpdump: lib/tcpdump was not sourced, so stop_tcpdump was unavailable.
  Added source and stop call when tcpdump service is enabled.

- s-container-sync: Swift's container-sync daemon was started via
  run_process but not explicitly stopped. Added stop_process call in
  stop_swift function.

- ldap: The stop_ldap function existed but was never called. Added
  stop call in UNSTACK_ALL section, consistent with mysql/rabbit
  handling.

These fixes ensure all services started by stack.sh are properly
stopped by unstack.sh, allowing clean restacking.

Generated-By: Cursor claude-opus-4.5
Change-Id: I8bcc6fe82264bb35a616dae39f4216ba6200b547
Signed-off-by: Sean Mooney <work@seanmooney.info>
---
 lib/swift  |  2 ++
 unstack.sh | 10 ++++++++++
 2 files changed, 12 insertions(+)

diff --git a/lib/swift b/lib/swift
index 862927437d..d4ff8cc196 100644
--- a/lib/swift
+++ b/lib/swift
@@ -838,6 +838,8 @@ function stop_swift {
     for type in proxy object container account; do
         stop_process s-${type}
     done
+    # Stop the container-sync daemon if it was started
+    stop_process s-container-sync
     # Blast out any stragglers
     pkill -f swift- || true
 }
diff --git a/unstack.sh b/unstack.sh
index 48626419da..1919ef8ad7 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -73,6 +73,7 @@ source $TOP_DIR/lib/neutron
 source $TOP_DIR/lib/ldap
 source $TOP_DIR/lib/dstat
 source $TOP_DIR/lib/atop
+source $TOP_DIR/lib/tcpdump
 source $TOP_DIR/lib/etcd3
 
 # Extras Source
@@ -162,6 +163,11 @@ if [[ -n "$UNSTACK_ALL" ]]; then
     if is_service_enabled rabbit; then
         stop_service rabbitmq-server
     fi
+
+    # Stop LDAP server
+    if is_service_enabled ldap; then
+        stop_ldap
+    fi
 fi
 
 if is_service_enabled neutron; then
@@ -178,6 +184,10 @@ if is_service_enabled openstack-cli-server; then
     stop_service devstack@openstack-cli-server
 fi
 
+if is_service_enabled tcpdump; then
+    stop_tcpdump
+fi
+
 stop_dstat
 
 if is_service_enabled atop; then

From 5e21304153df15db80287efd34f4cf73a04d4ced Mon Sep 17 00:00:00 2001
From: Sean Mooney <work@seanmooney.info>
Date: Fri, 9 Jan 2026 23:07:10 +0000
Subject: [PATCH 2402/2409] Refactor MySQL auth to support restacking

This change refactors the MySQL/MariaDB configuration to:

- Allow both unix_socket and mysql_native_password authentication
  using the MariaDB 'IDENTIFIED VIA ... OR ...' syntax. This enables
  restacking without needing to reset authentication in unstack.sh.

- Add use_mariadb_socket_auth helper variable to simplify the complex
  conditional logic (addresses TODO comment).

- Fix missing DATABASE_USER@'%' creation for modern Debian/Ubuntu
  with MariaDB socket auth.

- Fix inconsistent distro checks that were missing trixie.

- Remove dead Oracle Linux code since it's not in SUPPORTED_DISTROS.
  Oracle Linux is still handled as RHEL-like via is_fedora().

Generated-By: Cursor claude-opus-4.5
Change-Id: I4becbfe6325bcb29deef8e50e9a9f05678f47802
Signed-off-by: Sean Mooney <work@seanmooney.info>
---
 functions-common    | 11 ----------
 lib/databases/mysql | 52 ++++++++++++++++++++++-----------------------
 2 files changed, 25 insertions(+), 38 deletions(-)

diff --git a/functions-common b/functions-common
index c2042c4fef..39424e3352 100644
--- a/functions-common
+++ b/functions-common
@@ -517,17 +517,6 @@ function is_arch {
     [[ "$(uname -m)" == "$1" ]]
 }
 
-# Determine if current distribution is an Oracle distribution
-# is_oraclelinux
-function is_oraclelinux {
-    if [[ -z "$os_VENDOR" ]]; then
-        GetOSVersion
-    fi
-
-    [ "$os_VENDOR" = "OracleServer" ]
-}
-
-
 # Determine if current distribution is a Fedora-based distribution
 # (Fedora, RHEL, CentOS, Rocky, etc).
 # is_fedora
diff --git a/lib/databases/mysql b/lib/databases/mysql
index a47580ca3d..4def1842a7 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -18,7 +18,7 @@ register_database mysql
 
 if [[ -z "$MYSQL_SERVICE_NAME" ]]; then
     MYSQL_SERVICE_NAME=mysql
-    if is_fedora && ! is_oraclelinux; then
+    if is_fedora; then
         MYSQL_SERVICE_NAME=mariadb
     elif [[ "$DISTRO" =~ trixie|bookworm|bullseye ]]; then
         MYSQL_SERVICE_NAME=mariadb
@@ -44,15 +44,9 @@ function cleanup_database_mysql {
         apt_get purge -y mysql* mariadb*
         sudo rm -rf /var/lib/mysql
         sudo rm -rf /etc/mysql
-        return
-    elif is_oraclelinux; then
-        uninstall_package mysql-community-server
-        sudo rm -rf /var/lib/mysql
     elif is_fedora; then
         uninstall_package mariadb-server
         sudo rm -rf /var/lib/mysql
-    else
-        return
     fi
 }
 
@@ -68,8 +62,6 @@ function configure_database_mysql {
 
     if is_ubuntu; then
         my_conf=/etc/mysql/my.cnf
-    elif is_oraclelinux; then
-        my_conf=/etc/my.cnf
     elif is_fedora; then
         my_conf=/etc/my.cnf
         local cracklib_conf=/etc/my.cnf.d/cracklib_password_check.cnf
@@ -101,13 +93,20 @@ function configure_database_mysql {
         restart_service $MYSQL_SERVICE_NAME
     fi
 
+    # MariaDB 10.4+ on modern Debian/Ubuntu uses unix_socket auth by default
+    # See https://mariadb.org/authentication-in-mariadb-10-4/
+    local use_mariadb_socket_auth=False
+    if is_ubuntu && [ "$MYSQL_SERVICE_NAME" == "mariadb" ]; then
+        if [[ ! "$DISTRO" =~ bookworm|bullseye ]]; then
+            use_mariadb_socket_auth=True
+        fi
+    fi
+
     # Set the root password - only works the first time. For Ubuntu, we already
     # did that with debconf before installing the package, but we still try,
     # because the package might have been installed already. We don't do this
-    # for Ubuntu 22.04+ because the authorization model change in
-    # version 10.4 of mariadb. See
-    # https://mariadb.org/authentication-in-mariadb-10-4/
-    if ! (is_ubuntu && [[ ! "$DISTRO" =~ trixie|bookworm|bullseye ]] && [ "$MYSQL_SERVICE_NAME" == "mariadb" ]); then
+    # for MariaDB with socket auth because the root password is managed differently.
+    if [[ "$use_mariadb_socket_auth" != "True" ]]; then
         sudo mysqladmin -u root password $DATABASE_PASSWORD || true
     fi
 
@@ -129,19 +128,20 @@ function configure_database_mysql {
         restart_service $MYSQL_SERVICE_NAME
     fi
 
-    # In mariadb e.g. on Ubuntu socket plugin is used for authentication
-    # as root so it works only as sudo. To restore old "mysql like" behaviour,
-    # we need to change auth plugin for root user
-    # TODO(frickler): simplify this logic
-    if is_ubuntu && [[ ! "$DISTRO" =~ bookworm|bullseye ]] && [ "$MYSQL_SERVICE_NAME" == "mariadb" ]; then
-        # For Ubuntu 22.04+ we follow the model outlined in
-        # https://mariadb.org/authentication-in-mariadb-10-4/
-        sudo mysql -e "ALTER USER $DATABASE_USER@localhost IDENTIFIED VIA mysql_native_password USING PASSWORD('$DATABASE_PASSWORD');"
+    # Configure database user authentication
+    if [[ "$use_mariadb_socket_auth" == "True" ]]; then
+        # Allow both unix_socket (for sudo mysql) and password auth
+        # Using OR allows restacking without needing to reset auth in unstack
+        sudo mysql -e "ALTER USER $DATABASE_USER@localhost IDENTIFIED VIA unix_socket OR mysql_native_password USING PASSWORD('$DATABASE_PASSWORD');"
     fi
-    if ! (is_ubuntu && [[ ! "$DISTRO" =~ bookworm|bullseye ]] && [ "$MYSQL_SERVICE_NAME" == "mariadb" ]); then
-        # Create DB user if it does not already exist
+
+    # Create remote access user and grant privileges (needed for all distros)
+    if [[ "$use_mariadb_socket_auth" == "True" ]]; then
+        # Use sudo mysql since we have socket auth
+        sudo mysql -e "CREATE USER IF NOT EXISTS '$DATABASE_USER'@'%' identified by '$DATABASE_PASSWORD';"
+        sudo mysql -e "GRANT ALL PRIVILEGES ON *.* TO '$DATABASE_USER'@'%';"
+    else
         sudo mysql $cmd_args -e "CREATE USER IF NOT EXISTS '$DATABASE_USER'@'%' identified by '$DATABASE_PASSWORD';"
-        # Update the DB to give user '$DATABASE_USER'@'%' full control of the all databases:
         sudo mysql $cmd_args -e "GRANT ALL PRIVILEGES ON *.* TO '$DATABASE_USER'@'%';"
     fi
 
@@ -226,9 +226,7 @@ EOF
     fi
     # Install mysql-server
     if [[ "$INSTALL_DATABASE_SERVER_PACKAGES" == "True" ]]; then
-        if is_oraclelinux; then
-            install_package mysql-community-server
-        elif is_fedora; then
+        if is_fedora; then
             install_package mariadb-server mariadb-devel mariadb
             sudo systemctl enable $MYSQL_SERVICE_NAME
         elif is_ubuntu; then

From 20ed3c5f11295a02ff4d74f8cf95fab1414d9ba8 Mon Sep 17 00:00:00 2001
From: Sean Mooney <work@seanmooney.info>
Date: Fri, 9 Jan 2026 19:41:29 +0000
Subject: [PATCH 2403/2409] Improve OVS/OVN stop robustness for restacking

The stop_ovn function stops services but leaves behind runtime files
and stale configuration that can cause restacking failures. This change
improves robustness by:

- Making _stop_process check is-active in addition to is-enabled, so
  services are stopped even if they are running but not enabled.

- Clearing OVS external-ids before stopping to prevent stale config
  (ovn-remote, ovn-bridge, etc.) from persisting across restacks.

- Cleaning up runtime files (*.sock, *.pid, *.ctl) in both OVS_RUNDIR
  and OVN_RUNDIR after stopping services, as stale sockets can prevent
  ovsdb-server from binding on restart.

- Removing database lock files (.*.db.~lock~) which can block database
  access if services crash or stop uncleanly.

These changes allow stack.sh to run successfully after unstack.sh
without requiring a full clean.sh.

Generated-By: Cursor claude-opus-4.5
Change-Id: I8736f19a8892200948ee74854f99fd99eed5110b
Signed-off-by: Sean Mooney <work@seanmooney.info>
---
 lib/neutron_plugins/ovn_agent | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index 48e92a1782..5404cfdd0d 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -798,8 +798,11 @@ function _stop_ovs_dp {
 function _stop_process {
     local service=$1
     echo "Stopping process $service"
-    if $SYSTEMCTL is-enabled $service; then
+    # Stop if running, regardless of enabled state
+    if $SYSTEMCTL is-active $service; then
         $SYSTEMCTL stop $service
+    fi
+    if $SYSTEMCTL is-enabled $service; then
         $SYSTEMCTL disable $service
     fi
 }
@@ -834,10 +837,22 @@ function stop_ovn {
         _stop_process "devstack@ovs-vtep.service"
     fi
 
+    # Clear OVS external-ids before stopping to prevent stale config on restack
+    if sudo ovs-vsctl show &>/dev/null; then
+        sudo ovs-vsctl --if-exists clear open_vswitch . external-ids
+    fi
+
     _stop_process "$OVS_VSWITCHD_SERVICE"
     _stop_process "$OVSDB_SERVER_SERVICE"
 
     _stop_ovs_dp
+
+    # Clean up runtime files that can prevent restart
+    sudo rm -f $OVS_RUNDIR/*.sock $OVS_RUNDIR/*.pid $OVS_RUNDIR/*.ctl
+    sudo rm -f $OVN_RUNDIR/*.sock $OVN_RUNDIR/*.pid $OVN_RUNDIR/*.ctl
+    # Clean up database lock files
+    sudo rm -f $OVS_DATADIR/.*.db.~lock~
+    sudo rm -f $OVN_DATADIR/.*.db.~lock~
 }
 
 function _cleanup {

From 64dc60a11b2fba795a1f87a2a3a7e4d06c379074 Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Sat, 24 Jan 2026 21:35:42 +0900
Subject: [PATCH 2404/2409] Fix duplicated wget package

Trivial-Fix

Change-Id: I061c5dcdd88cb1514b9f4e449d8317e2e1f48b81
Signed-off-by: Takashi Kajinami <kajinamit@oss.nttdata.com>
---
 files/debs/general | 1 -
 1 file changed, 1 deletion(-)

diff --git a/files/debs/general b/files/debs/general
index 1e63e4f582..0cddcf05f4 100644
--- a/files/debs/general
+++ b/files/debs/general
@@ -33,5 +33,4 @@ tcpdump
 unzip
 uuid-runtime
 wget
-wget
 zlib1g-dev

From 01f574d501dbdcb6a00006c3fd43e62872af7882 Mon Sep 17 00:00:00 2001
From: Christian Schwede <cschwede@redhat.com>
Date: Fri, 30 Jan 2026 09:09:55 +0100
Subject: [PATCH 2405/2409] Fix S3 API authentication failures

This change is required as a follow up to [1] and [2]. Recent versions
of Keystone require auth tokens when accessing the /v3/s3tokens Keystone
endpoint.

[1] https://review.opendev.org/c/openstack/keystone/+/966069
[2] https://review.opendev.org/c/openstack/swift/+/966062

Closes-Bug: #2139405
Signed-off-by: Christian Schwede <cschwede@redhat.com>
Change-Id: I55f6e2c68ae7d76b94919ed47df0a2251287e67b
---
 lib/swift | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/lib/swift b/lib/swift
index d4ff8cc196..32aa6d74e1 100644
--- a/lib/swift
+++ b/lib/swift
@@ -434,6 +434,13 @@ function configure_swift {
             swift_pipeline+=" s3token"
             iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:s3token auth_uri ${KEYSTONE_SERVICE_URI_V3}
             iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:s3token delay_auth_decision true
+            iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:s3token secret_cache_duration 900
+            iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:s3token auth_url ${KEYSTONE_SERVICE_URI}
+            iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:s3token project_name 'service'
+            iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:s3token project_domain_name ${SERVICE_DOMAIN_NAME}
+            iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:s3token username 'swift'
+            iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:s3token user_domain_name ${SERVICE_DOMAIN_NAME}
+            iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:s3token password ${SERVICE_PASSWORD}
         fi
         swift_pipeline+=" keystoneauth"
     fi

From ea0fdd2c806cf93e48a698e68165306da45314a2 Mon Sep 17 00:00:00 2001
From: "Dr. Jens Harbott" <harbott@osism.tech>
Date: Mon, 16 Feb 2026 07:53:08 +0100
Subject: [PATCH 2406/2409] Drop platform job for Ubuntu Jammy

The job stopped working recently, the reason is unclear, but since Jammy
is no longer included as required platform, let's just stop testing it.

Signed-off-by: Dr. Jens Harbott <harbott@osism.tech>
Change-Id: I796eddac96313584f4aa5225a9b9803bb2ad19b5
---
 .zuul.yaml | 11 -----------
 stack.sh   |  2 +-
 2 files changed, 1 insertion(+), 12 deletions(-)

diff --git a/.zuul.yaml b/.zuul.yaml
index 2227f185dd..e1dec5b3fd 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -897,15 +897,6 @@
     vars:
       configure_swap_size: 4096
 
-- job:
-    name: devstack-platform-ubuntu-jammy
-    parent: tempest-full-py3
-    description: Ubuntu 22.04 LTS (Jammy) platform test
-    nodeset: openstack-single-node-jammy
-    timeout: 9000
-    vars:
-      configure_swap_size: 8192
-
 - job:
     name: devstack-platform-ubuntu-noble-ovn-source
     parent: devstack-platform-ubuntu-noble
@@ -1050,7 +1041,6 @@
         - devstack-platform-rocky-red-quartz
         - devstack-platform-ubuntu-noble-ovn-source
         - devstack-platform-ubuntu-noble-ovs
-        - devstack-platform-ubuntu-jammy
         - devstack-multinode
         - devstack-unit-tests
         - openstack-tox-bashate
@@ -1137,4 +1127,3 @@
         - devstack-platform-rocky-red-quartz
         - devstack-platform-ubuntu-noble-ovn-source
         - devstack-platform-ubuntu-noble-ovs
-        - devstack-platform-ubuntu-jammy
diff --git a/stack.sh b/stack.sh
index 965f58007d..c6d37611c9 100755
--- a/stack.sh
+++ b/stack.sh
@@ -229,7 +229,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-SUPPORTED_DISTROS="trixie|bookworm|jammy|noble|rhel9|rhel10"
+SUPPORTED_DISTROS="trixie|bookworm|noble|rhel9|rhel10"
 
 if [[ ! ${DISTRO} =~ $SUPPORTED_DISTROS ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"

From cc82266a57c97910ef26305f92ea51d358eb015c Mon Sep 17 00:00:00 2001
From: Abhishek Bongale <abhishekbongale@outlook.com>
Date: Thu, 5 Feb 2026 13:39:40 +0000
Subject: [PATCH 2407/2409] Add venv for plugin list generation

Isolate dependencies for generate-devstack-plugins-list.sh by
creating a dedicated Python virtual environment with required
packages. This ensures the script uses the correct version of
dependencies regardless of system Python configuration.

Closes-Bug: #2138869
Change-Id: I8a7e49b0b908aec7c95b7fbfb6c9a16375f267a6
Signed-off-by: Abhishek Bongale <abhishekbongale@outlook.com>
---
 tools/generate-devstack-plugins-list.sh | 13 ++++++++++++-
 tools/requirements.txt                  |  1 +
 2 files changed, 13 insertions(+), 1 deletion(-)
 create mode 100644 tools/requirements.txt

diff --git a/tools/generate-devstack-plugins-list.sh b/tools/generate-devstack-plugins-list.sh
index 3307943df9..45a926392e 100755
--- a/tools/generate-devstack-plugins-list.sh
+++ b/tools/generate-devstack-plugins-list.sh
@@ -38,6 +38,17 @@
 # current working directory, it will be prepended or appended to
 # the generated reStructuredText plugins table respectively.
 
+# Setup virtual environment
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+VENV_DIR="${SCRIPT_DIR}/.venv"
+
+if [[ ! -d "${VENV_DIR}" ]]; then
+    python3 -m venv "${VENV_DIR}"
+fi
+
+source "${VENV_DIR}/bin/activate"
+pip install -q -r "${SCRIPT_DIR}/requirements.txt"
+
 # Print the title underline for a RST table.  Argument is the length
 # of the first column, second column is assumed to be "URL"
 function title_underline {
@@ -54,7 +65,7 @@ if [[ -r data/devstack-plugins-registry.header ]]; then
     cat data/devstack-plugins-registry.header
 fi
 
-sorted_plugins=$(python3 tools/generate-devstack-plugins-list.py)
+sorted_plugins=$("${VENV_DIR}/bin/python3" tools/generate-devstack-plugins-list.py)
 
 # find the length of the name column & pad
 name_col_len=$(echo "${sorted_plugins}" | wc -L)
diff --git a/tools/requirements.txt b/tools/requirements.txt
new file mode 100644
index 0000000000..f2293605cf
--- /dev/null
+++ b/tools/requirements.txt
@@ -0,0 +1 @@
+requests

From e9cf8cf3ed9ef5fdaf57f7707880e45ce1fbe2c0 Mon Sep 17 00:00:00 2001
From: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date: Wed, 18 Feb 2026 03:03:08 +0000
Subject: [PATCH 2408/2409] Updated from generate-devstack-plugins-list

Change-Id: I440ae4bfbb97202f3b6ddca99d58fb3ff4604352
Signed-off-by: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Generated-By: openstack/project-config:playbooks/proposal/propose_update.sh
---
 doc/source/plugin-registry.rst | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 9185263443..560668f2a0 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -48,7 +48,6 @@ openstack/grian-ui                       `https://opendev.org/openstack/grian-ui
 openstack/heat                           `https://opendev.org/openstack/heat <https://opendev.org/openstack/heat>`__
 openstack/heat-dashboard                 `https://opendev.org/openstack/heat-dashboard <https://opendev.org/openstack/heat-dashboard>`__
 openstack/ironic                         `https://opendev.org/openstack/ironic <https://opendev.org/openstack/ironic>`__
-openstack/ironic-inspector               `https://opendev.org/openstack/ironic-inspector <https://opendev.org/openstack/ironic-inspector>`__
 openstack/ironic-prometheus-exporter     `https://opendev.org/openstack/ironic-prometheus-exporter <https://opendev.org/openstack/ironic-prometheus-exporter>`__
 openstack/ironic-ui                      `https://opendev.org/openstack/ironic-ui <https://opendev.org/openstack/ironic-ui>`__
 openstack/keystone                       `https://opendev.org/openstack/keystone <https://opendev.org/openstack/keystone>`__
@@ -60,9 +59,6 @@ openstack/manila-tempest-plugin          `https://opendev.org/openstack/manila-t
 openstack/manila-ui                      `https://opendev.org/openstack/manila-ui <https://opendev.org/openstack/manila-ui>`__
 openstack/masakari                       `https://opendev.org/openstack/masakari <https://opendev.org/openstack/masakari>`__
 openstack/mistral                        `https://opendev.org/openstack/mistral <https://opendev.org/openstack/mistral>`__
-openstack/monasca-api                    `https://opendev.org/openstack/monasca-api <https://opendev.org/openstack/monasca-api>`__
-openstack/monasca-events-api             `https://opendev.org/openstack/monasca-events-api <https://opendev.org/openstack/monasca-events-api>`__
-openstack/monasca-tempest-plugin         `https://opendev.org/openstack/monasca-tempest-plugin <https://opendev.org/openstack/monasca-tempest-plugin>`__
 openstack/networking-bagpipe             `https://opendev.org/openstack/networking-bagpipe <https://opendev.org/openstack/networking-bagpipe>`__
 openstack/networking-baremetal           `https://opendev.org/openstack/networking-baremetal <https://opendev.org/openstack/networking-baremetal>`__
 openstack/networking-bgpvpn              `https://opendev.org/openstack/networking-bgpvpn <https://opendev.org/openstack/networking-bgpvpn>`__
@@ -84,7 +80,6 @@ openstack/osprofiler                     `https://opendev.org/openstack/osprofil
 openstack/ovn-bgp-agent                  `https://opendev.org/openstack/ovn-bgp-agent <https://opendev.org/openstack/ovn-bgp-agent>`__
 openstack/ovn-octavia-provider           `https://opendev.org/openstack/ovn-octavia-provider <https://opendev.org/openstack/ovn-octavia-provider>`__
 openstack/rally-openstack                `https://opendev.org/openstack/rally-openstack <https://opendev.org/openstack/rally-openstack>`__
-openstack/shade                          `https://opendev.org/openstack/shade <https://opendev.org/openstack/shade>`__
 openstack/skyline-apiserver              `https://opendev.org/openstack/skyline-apiserver <https://opendev.org/openstack/skyline-apiserver>`__
 openstack/storlets                       `https://opendev.org/openstack/storlets <https://opendev.org/openstack/storlets>`__
 openstack/tacker                         `https://opendev.org/openstack/tacker <https://opendev.org/openstack/tacker>`__
@@ -114,6 +109,7 @@ starlingx/nfv                            `https://opendev.org/starlingx/nfv <htt
 starlingx/update                         `https://opendev.org/starlingx/update <https://opendev.org/starlingx/update>`__
 vexxhost/openstack-operator              `https://opendev.org/vexxhost/openstack-operator <https://opendev.org/vexxhost/openstack-operator>`__
 x/almanach                               `https://opendev.org/x/almanach <https://opendev.org/x/almanach>`__
+x/apmec                                  `https://opendev.org/x/apmec <https://opendev.org/x/apmec>`__
 x/bilean                                 `https://opendev.org/x/bilean <https://opendev.org/x/bilean>`__
 x/broadview-collector                    `https://opendev.org/x/broadview-collector <https://opendev.org/x/broadview-collector>`__
 x/collectd-openstack-plugins             `https://opendev.org/x/collectd-openstack-plugins <https://opendev.org/x/collectd-openstack-plugins>`__

From 55c045539dd2e47ee34154cadd9f9e280f90d042 Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Wed, 25 Feb 2026 23:40:08 +0900
Subject: [PATCH 2409/2409] Drop installation of tox

The comment indicates that tox is used to generate config files, but
it's actually not.

Change-Id: Iddd45e084641bb3711985484e988ed533965f4f4
Signed-off-by: Takashi Kajinami <kajinamit@oss.nttdata.com>
---
 lib/neutron_plugins/ovn_agent | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index 5404cfdd0d..8e3ca4ab89 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -401,9 +401,6 @@ function install_ovn {
     # Check the OVN configuration
     ovn_sanity_check
 
-    # Install tox, used to generate the config (see devstack/override-defaults)
-    pip_install tox
-
     sudo mkdir -p $OVS_RUNDIR
     sudo chown $(whoami) $OVS_RUNDIR