Update Master SHAs - 17 Jan 2016

This patch does the following:
- updates the Master SHAs for new development work.
- includes updates to policy, paste and rootwrap files as required
- moves the Aodh repository to openstack_services as it now has
  implemented a stable branch
- Updated the keystone-wsgi file as it was still running the code from
  liberty
- add 2 package requirements to keystone which must be present for the
  new wsgi file.
- updates tempest.conf.j2 to replace ssh_auth_method with auth_method,
  and change auth_method to 'keypair' (configured is no longer an
  a valid option)

Change-Id: I933c24c03518865d9d40519dafb2ba46769a5453
Signed-off-by: Kevin Carter <kevin.carter@rackspace.com>

files/rootwrap.d/compute.filters

@@ -203,7 +203,6 @@ multipath: CommandFilter, multipath, root
 # multipathd show status
 multipathd: CommandFilter, multipathd, root
 systool: CommandFilter, systool, root
-sginfo: CommandFilter, sginfo, root
 vgc-cluster: CommandFilter, vgc-cluster, root
 # os_brick/initiator/connector.py
 drv_cfg: CommandFilter, /opt/emc/scaleio/sdc/bin/drv_cfg, root, /opt/emc/scaleio/sdc/bin/drv_cfg, --query_guid

templates/api-paste.ini.j2

@@ -6,7 +6,7 @@ use = egg:Paste#urlmap
 /: meta
 
 [pipeline:meta]
-pipeline = metaapp
+pipeline = cors metaapp
 
 [app:metaapp]
 paste.app_factory = nova.api.metadata.handler:MetadataRequestHandler.factory
@@ -23,7 +23,6 @@ use = call:nova.api.openstack.urlmap:urlmap_factory
 # this causes issues with your clients you can rollback to the
 # *frozen* v2 api by commenting out the above stanza and using the
 # following instead::
-# /v1.1: openstack_compute_api_legacy_v2
 # /v2: openstack_compute_api_legacy_v2
 # if rolling back to v2 fixes your issue please file a critical bug
 # at - https://bugs.launchpad.net/nova/+bugs
@@ -33,26 +32,25 @@ use = call:nova.api.openstack.urlmap:urlmap_factory
 # API). It also provides new features via API microversions which are
 # opt into for clients. Unaware clients will receive the same frozen
 # v2 API feature set, but with some relaxed validation
-/v1.1: openstack_compute_api_v21_legacy_v2_compatible
 /v2: openstack_compute_api_v21_legacy_v2_compatible
 /v2.1: openstack_compute_api_v21
 
 # NOTE: this is deprecated in favor of openstack_compute_api_v21_legacy_v2_compatible
 [composite:openstack_compute_api_legacy_v2]
 use = call:nova.api.auth:pipeline_factory
-noauth2 = compute_req_id faultwrap sizelimit noauth2 legacy_ratelimit osapi_compute_app_legacy_v2
+noauth2 = cors compute_req_id faultwrap sizelimit noauth2 legacy_ratelimit osapi_compute_app_legacy_v2
-keystone = compute_req_id faultwrap sizelimit authtoken keystonecontext legacy_ratelimit osapi_compute_app_legacy_v2
+keystone = cors compute_req_id faultwrap sizelimit authtoken keystonecontext legacy_ratelimit osapi_compute_app_legacy_v2
-keystone_nolimit = compute_req_id faultwrap sizelimit authtoken keystonecontext osapi_compute_app_legacy_v2
+keystone_nolimit = cors compute_req_id faultwrap sizelimit authtoken keystonecontext osapi_compute_app_legacy_v2
 
 [composite:openstack_compute_api_v21]
 use = call:nova.api.auth:pipeline_factory_v21
-noauth2 = compute_req_id faultwrap sizelimit noauth2 osapi_compute_app_v21
+noauth2 = cors compute_req_id faultwrap sizelimit noauth2 osapi_compute_app_v21
-keystone = compute_req_id faultwrap sizelimit authtoken keystonecontext osapi_compute_app_v21
+keystone = cors compute_req_id faultwrap sizelimit authtoken keystonecontext osapi_compute_app_v21
 
 [composite:openstack_compute_api_v21_legacy_v2_compatible]
 use = call:nova.api.auth:pipeline_factory_v21
-noauth2 = compute_req_id faultwrap sizelimit noauth2 legacy_v2_compatible osapi_compute_app_v21
+noauth2 = cors compute_req_id faultwrap sizelimit noauth2 legacy_v2_compatible osapi_compute_app_v21
-keystone = compute_req_id faultwrap sizelimit authtoken keystonecontext legacy_v2_compatible osapi_compute_app_v21
+keystone = cors compute_req_id faultwrap sizelimit authtoken keystonecontext legacy_v2_compatible osapi_compute_app_v21
 
 [filter:request_id]
 paste.filter_factory = oslo_middleware:RequestId.factory
@@ -91,6 +89,10 @@ paste.app_factory = nova.api.openstack.compute.versions:Versions.factory
 # Shared #
 ##########
 
+[filter:cors]
+paste.filter_factory = oslo_middleware.cors:filter_factory
+oslo_config_project = nova
+
 [filter:keystonecontext]
 paste.filter_factory = nova.api.auth:NovaKeystoneContext.factory
 

templates/policy.json.j2

@@ -22,16 +22,14 @@
     "compute:update_instance_metadata": "",
     "compute:delete_instance_metadata": "",
 
-    "compute:get_instance_faults": "",
     "compute:get_diagnostics": "",
     "compute:get_instance_diagnostics": "",
 
     "compute:start": "rule:admin_or_owner",
     "compute:stop": "rule:admin_or_owner",
 
-    "compute:get_lock": "",
+    "compute:lock": "rule:admin_or_owner",
-    "compute:lock": "",
+    "compute:unlock": "rule:admin_or_owner",
-    "compute:unlock": "",
     "compute:unlock_override": "rule:admin_api",
 
     "compute:get_vnc_console": "",
@@ -85,9 +83,6 @@
     "compute:security_groups:add_to_instance": "",
     "compute:security_groups:remove_from_instance": "",
 
-    "compute:delete": "",
-    "compute:soft_delete": "",
-    "compute:force_delete": "",
     "compute:restore": "",
 
     "compute:volume_snapshot_create": "",
@@ -334,6 +329,7 @@
     "os_compute_api:os-extended-availability-zone": "",
     "os_compute_api:os-extended-availability-zone:discoverable": "",
     "os_compute_api:extensions": "",
+    "os_compute_api:extensions:discoverable": "",
     "os_compute_api:extension_info:discoverable": "",
     "os_compute_api:os-extended-volumes": "",
     "os_compute_api:os-extended-volumes:discoverable": "",
@@ -345,6 +341,7 @@
     "os_compute_api:os-flavor-access:add_tenant_access": "rule:admin_api",
     "os_compute_api:os-flavor-rxtx": "",
     "os_compute_api:os-flavor-rxtx:discoverable": "",
+    "os_compute_api:flavors": "",
     "os_compute_api:flavors:discoverable": "",
     "os_compute_api:os-flavor-extra-specs:discoverable": "",
     "os_compute_api:os-flavor-extra-specs:index": "",

templates/rootwrap.conf.j2

@@ -7,10 +7,10 @@
 filters_path=/etc/nova/rootwrap.d,/usr/share/nova/rootwrap
 
 # List of directories to search executables in, in case filters do not
-# explicitely specify a full path (separated by ',')
+# explicitly specify a full path (separated by ',')
 # If not specified, defaults to system PATH environment variable.
 # These directories MUST all be only writeable by root !
-exec_dirs=/sbin,/usr/sbin,/bin,/usr/bin,{{ nova_bin }}
+exec_dirs={{ nova_bin }},/sbin,/usr/sbin,/bin,/usr/bin
 
 # Enable logging to syslog
 # Default value is False