Merge "Promote libffi-dev as a general dependency"
diff --git a/README.md b/README.md
index 7185e9d..7eacebd 100644
--- a/README.md
+++ b/README.md
@@ -143,6 +143,8 @@
 Each service that can be run under HTTPD + mod_wsgi also has an override
 toggle available that can be set in your ``local.conf``.
 
+Keystone is run under HTTPD + mod_wsgi by default.
+
 Example (Keystone):
 
     KEYSTONE_USE_MOD_WSGI="True"
diff --git a/docs/source/faq.html b/docs/source/faq.html
index 4867eb4..bfac1dc 100644
--- a/docs/source/faq.html
+++ b/docs/source/faq.html
@@ -18,7 +18,7 @@
       body { padding-top: 60px; }
       dd { padding: 10px; }
     </style>
-    
+
     <!-- Le javascripts -->
     <script src="assets/js/jquery-1.7.1.min.js" type="text/javascript" charset="utf-8"></script>
     <script src="assets/js/bootstrap.js" type="text/javascript" charset="utf-8"></script>
@@ -42,7 +42,7 @@
     </div>
 
     <div class="container" id="home">
-      
+
       <section id="faq" class="span12">
 
         <div class='row pull-left'>
@@ -68,16 +68,16 @@
 
             <dt>Q: Why a shell script, why not chef/puppet/...</dt>
             <dd>A: The script is meant to be read by humans (as well as ran by computers); it is the primary documentation after all.  Using a recipe system requires everyone to agree and understand chef or puppet.</dd>
-    
+
             <dt>Q: Why not use Crowbar?</dt>
             <dd>A: DevStack is optimized for documentation &amp; developers.  As some of us use <a href="https://github.com/dellcloudedge/crowbar">Crowbar</a> for production deployments, we hope developers documenting how they setup systems for new features supports projects like Crowbar.</dd>
-    
+
             <dt>Q: I'd like to help!</dt>
-            <dd>A: That isn't a question, but please do!  The source for DevStack is <a href="http://github.com/openstack-dev/devstack">github</a> and bug reports go to <a href="http://bugs.launchpad.net/devstack/">LaunchPad</a>.  Contributions follow the usual process as described in the <a href="http://wiki.openstack.org/HowToContribute">OpenStack wiki</a> even though DevStack is not an official OpenStack project.  This site is housed in the CloudBuilder's <a href="http://github.com/cloudbuilders/devstack">github</a> in the gh-pages branch.</dd>
-    
+            <dd>A: That isn't a question, but please do!  The source for DevStack is <a href="http://github.com/openstack-dev/devstack">github</a> and bug reports go to <a href="http://bugs.launchpad.net/devstack/">LaunchPad</a>.  Contributions follow the usual process as described in the <a href="http://wiki.openstack.org/HowToContribute">OpenStack wiki</a>. DevStack is not a core project but a gating project and therefore an official OpenStack project. This site is housed in the CloudBuilder's <a href="http://github.com/cloudbuilders/devstack">github</a> in the gh-pages branch.</dd>
+
             <dt>Q: Why not use packages?</dt>
             <dd>A: Unlike packages, DevStack leaves your cloud ready to develop - checkouts of the code and services running in screen. However, many people are doing the hard work of packaging and recipes for production deployments.  We hope this script serves as a way to communicate configuration changes between developers and packagers.</dd>
-    
+
             <dt>Q: Why isn't $MY_FAVORITE_DISTRO supported?</dt>
             <dd>A: DevStack is meant for developers and those who want to see how OpenStack really works.  DevStack is known to run on the distro/release combinations listed in <code>README.md</code>.  DevStack is only supported on releases other than those documented in <code>README.md</code> on a best-effort basis.</dd>
 
@@ -96,7 +96,7 @@
           <dl class='pull-left'>
             <dt>Q: Can DevStack handle a multi-node installation?</dt>
             <dd>A: Indirectly, yes.  You run DevStack on each node with the appropriate configuration in <code>local.conf</code>.  The primary considerations are turning off the services not required on the secondary nodes, making sure the passwords match and setting the various API URLs to the right place.</dd>
-    
+
             <dt>Q: How can I document the environment that DevStack is using?</dt>
             <dd>A: DevStack includes a script (<code>tools/info.sh</code>) that gathers the versions of the relevant installed apt packages, pip packages and git repos.  This is a good way to verify what Python modules are installed.</dd>
 
diff --git a/extras.d/README.md b/extras.d/README.md
index 1dd17da..7c2e4fe 100644
--- a/extras.d/README.md
+++ b/extras.d/README.md
@@ -22,9 +22,24 @@
     stack: called by stack.sh.  There are four possible values for
         the second arg to distinguish the phase stack.sh is in:
 
-        arg 2:  install | post-config | extra | post-extra
+        arg 2:  pre-install | install | post-config | extra
 
     unstack: called by unstack.sh
 
     clean: called by clean.sh.  Remember, clean.sh also calls unstack.sh
         so that work need not be repeated.
+
+The `stack` phase sub-phases are called from `stack.sh` in the following places:
+
+    pre-install - After all system prerequisites have been installed but before any
+        DevStack-specific services are installed (including database and rpc).
+
+    install - After all OpenStack services have been installed and configured
+        but before any OpenStack services have been started.  Changes to OpenStack
+        service configurations should be done here.
+
+    post-config - After OpenStack services have been initialized but still before
+        they have been started. (This is probably mis-named, think of it as post-init.)
+
+    extra - After everything is started.
+
diff --git a/files/apache-keystone.template b/files/apache-keystone.template
index 919452a..805e7b8 100644
--- a/files/apache-keystone.template
+++ b/files/apache-keystone.template
@@ -20,3 +20,7 @@
     LogLevel debug
     CustomLog /var/log/%APACHE_NAME%/access.log combined
 </VirtualHost>
+
+# Workaround for missing path on RHEL6, see
+#  https://bugzilla.redhat.com/show_bug.cgi?id=1121019
+WSGISocketPrefix /var/run/%APACHE_NAME%
diff --git a/files/apts/general b/files/apts/general
index 4cd9303..d65cab3 100644
--- a/files/apts/general
+++ b/files/apts/general
@@ -20,6 +20,7 @@
 tar
 python-cmd2 # dist:precise
 python-dev
+python-mock # testonly
 python2.7
 bc
 libyaml-dev
diff --git a/functions-common b/functions-common
index 44225ab..9093952 100644
--- a/functions-common
+++ b/functions-common
@@ -435,7 +435,9 @@
         else
             DISTRO="sle${os_RELEASE}sp${os_UPDATE}"
         fi
-    elif [[ "$os_VENDOR" =~ (Red Hat) || "$os_VENDOR" =~ (CentOS) ]]; then
+    elif [[ "$os_VENDOR" =~ (Red Hat) || \
+        "$os_VENDOR" =~ (CentOS) || \
+        "$os_VENDOR" =~ (OracleServer) ]]; then
         # Drop the . release as we assume it's compatible
         DISTRO="rhel${os_RELEASE::1}"
     elif [[ "$os_VENDOR" =~ (XenServer) ]]; then
@@ -463,7 +465,8 @@
         GetOSVersion
     fi
 
-    [ "$os_VENDOR" = "Fedora" ] || [ "$os_VENDOR" = "Red Hat" ] || [ "$os_VENDOR" = "CentOS" ]
+    [ "$os_VENDOR" = "Fedora" ] || [ "$os_VENDOR" = "Red Hat" ] || \
+        [ "$os_VENDOR" = "CentOS" ] || [ "$os_VENDOR" = "OracleServer" ]
 }
 
 
diff --git a/lib/apache b/lib/apache
index c0d32df..f4f82a1 100644
--- a/lib/apache
+++ b/lib/apache
@@ -150,7 +150,12 @@
 
 # restart_apache_server
 function restart_apache_server {
-    restart_service $APACHE_NAME
+    # Apache can be slow to stop, doing an explicit stop, sleep, start helps
+    # to mitigate issues where apache will claim a port it's listening on is
+    # still in use and fail to start.
+    stop_service $APACHE_NAME
+    sleep 3
+    start_service $APACHE_NAME
 }
 
 # Restore xtrace
diff --git a/lib/cinder b/lib/cinder
index 03d2f54..3965687 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -28,6 +28,7 @@
 # set up default driver
 CINDER_DRIVER=${CINDER_DRIVER:-default}
 CINDER_PLUGINS=$TOP_DIR/lib/cinder_plugins
+CINDER_BACKENDS=$TOP_DIR/lib/cinder_backends
 
 # grab plugin config if specified via cinder_driver
 if [[ -r $CINDER_PLUGINS/$CINDER_DRIVER ]]; then
@@ -57,9 +58,24 @@
     CINDER_BIN_DIR=$(get_python_exec_prefix)
 fi
 
+
+# Maintain this here for backward-compatibility with the old configuration
+# DEPRECATED: Use CINDER_ENABLED_BACKENDS instead
 # Support for multi lvm backend configuration (default is no support)
 CINDER_MULTI_LVM_BACKEND=$(trueorfalse False $CINDER_MULTI_LVM_BACKEND)
 
+# Default backends
+# The backend format is type:name where type is one of the supported backend
+# types (lvm, nfs, etc) and name is the identifier used in the Cinder
+# configuration and for the volume type name.  Multiple backends are
+# comma-separated.
+if [[ $CINDER_MULTI_LVM_BACKEND == "False" ]]; then
+    CINDER_ENABLED_BACKENDS=${CINDER_ENABLED_BACKENDS:-lvm:lvmdriver-1}
+else
+    CINDER_ENABLED_BACKENDS=${CINDER_ENABLED_BACKENDS:-lvm:lvmdriver-1,lvm:lvmdriver-2}
+fi
+
+
 # Should cinder perform secure deletion of volumes?
 # Defaults to true, can be set to False to avoid this bug when testing:
 # https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1023755
@@ -73,22 +89,22 @@
 # https://bugs.launchpad.net/cinder/+bug/1180976
 CINDER_PERIODIC_INTERVAL=${CINDER_PERIODIC_INTERVAL:-60}
 
-# Name of the lvm volume groups to use/create for iscsi volumes
-VOLUME_GROUP=${VOLUME_GROUP:-stack-volumes}
-VOLUME_BACKING_FILE=${VOLUME_BACKING_FILE:-$DATA_DIR/${VOLUME_GROUP}-backing-file}
-VOLUME_BACKING_DEVICE=${VOLUME_BACKING_DEVICE:-}
-
-# VOLUME_GROUP2 is used only if CINDER_MULTI_LVM_BACKEND = True
-VOLUME_GROUP2=${VOLUME_GROUP2:-stack-volumes2}
-VOLUME_BACKING_FILE2=${VOLUME_BACKING_FILE2:-$DATA_DIR/${VOLUME_GROUP2}-backing-file}
-VOLUME_BACKING_DEVICE2=${VOLUME_BACKING_DEVICE2:-}
-
-VOLUME_NAME_PREFIX=${VOLUME_NAME_PREFIX:-volume-}
-
 # Tell Tempest this project is present
 TEMPEST_SERVICES+=,cinder
 
 
+# Source the enabled backends
+if is_service_enabled c-vol && [[ -n "$CINDER_ENABLED_BACKENDS" ]]; then
+    for be in ${CINDER_ENABLED_BACKENDS//,/ }; do
+        BE_TYPE=${be%%:*}
+        BE_NAME=${be##*:}
+        if [[ -r $CINDER_BACKENDS/${BE_TYPE} ]]; then
+            source $CINDER_BACKENDS/${BE_TYPE}
+        fi
+    done
+fi
+
+
 # Functions
 # ---------
 
@@ -99,41 +115,6 @@
     return 1
 }
 
-# _clean_lvm_lv removes all cinder LVM volumes
-#
-# Usage: _clean_lvm_lv $VOLUME_GROUP $VOLUME_NAME_PREFIX
-function _clean_lvm_lv {
-    local vg=$1
-    local lv_prefix=$2
-
-    # Clean out existing volumes
-    for lv in `sudo lvs --noheadings -o lv_name $vg`; do
-        # lv_prefix prefixes the LVs we want
-        if [[ "${lv#$lv_prefix}" != "$lv" ]]; then
-            sudo lvremove -f $vg/$lv
-        fi
-    done
-}
-
-# _clean_lvm_backing_file() removes the backing file of the
-# volume group used by cinder
-#
-# Usage: _clean_lvm_backing_file() $VOLUME_GROUP
-function _clean_lvm_backing_file {
-    local vg=$1
-
-    # if there is no logical volume left, it's safe to attempt a cleanup
-    # of the backing file
-    if [ -z "`sudo lvs --noheadings -o lv_name $vg`" ]; then
-        # if the backing physical device is a loop device, it was probably setup by devstack
-        if [[ -n "$VG_DEV" ]] && [[ -e "$VG_DEV" ]]; then
-            VG_DEV=$(sudo losetup -j $DATA_DIR/${vg}-backing-file | awk -F':' '/backing-file/ { print $1}')
-            sudo losetup -d $VG_DEV
-            rm -f $DATA_DIR/${vg}-backing-file
-        fi
-    fi
-}
-
 # cleanup_cinder() - Remove residual data files, anything left over from previous
 # runs that a clean run would need to clean up
 function cleanup_cinder {
@@ -160,23 +141,20 @@
         done
     fi
 
-    if is_service_enabled cinder; then
-        sudo rm -rf $CINDER_STATE_PATH/volumes/*
-    fi
-
     if is_ubuntu; then
         stop_service tgt
     else
         stop_service tgtd
     fi
 
-    # Campsite rule: leave behind a volume group at least as clean as we found it
-    _clean_lvm_lv $VOLUME_GROUP $VOLUME_NAME_PREFIX
-    _clean_lvm_backing_file $VOLUME_GROUP
-
-    if [ "$CINDER_MULTI_LVM_BACKEND" = "True" ]; then
-        _clean_lvm_lv $VOLUME_GROUP2 $VOLUME_NAME_PREFIX
-        _clean_lvm_backing_file $VOLUME_GROUP2
+    if is_service_enabled c-vol && [[ -n "$CINDER_ENABLED_BACKENDS" ]]; then
+        for be in ${CINDER_ENABLED_BACKENDS//,/ }; do
+            BE_TYPE=${be%%:*}
+            BE_NAME=${be##*:}
+            if type cleanup_cinder_backend_${BE_TYPE} >/dev/null 2>&1; then
+                cleanup_cinder_backend_${BE_TYPE} ${BE_NAME}
+            fi
+        done
     fi
 }
 
@@ -243,23 +221,7 @@
     iniset $CINDER_CONF DEFAULT auth_strategy keystone
     iniset $CINDER_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
     iniset $CINDER_CONF DEFAULT verbose True
-    if [ "$CINDER_MULTI_LVM_BACKEND" = "True" ]; then
-        iniset $CINDER_CONF DEFAULT enabled_backends lvmdriver-1,lvmdriver-2
-        iniset $CINDER_CONF lvmdriver-1 volume_group $VOLUME_GROUP
-        iniset $CINDER_CONF lvmdriver-1 volume_driver cinder.volume.drivers.lvm.LVMISCSIDriver
-        iniset $CINDER_CONF lvmdriver-1 volume_backend_name LVM_iSCSI
-        iniset $CINDER_CONF lvmdriver-2 volume_group $VOLUME_GROUP2
-        iniset $CINDER_CONF lvmdriver-2 volume_driver cinder.volume.drivers.lvm.LVMISCSIDriver
-        iniset $CINDER_CONF lvmdriver-2 volume_backend_name LVM_iSCSI_2
-        # NOTE(mriedem): Work around Cinder "wishlist" bug 1255593
-        if [[ "$CINDER_SECURE_DELETE" == "False" ]]; then
-            iniset $CINDER_CONF lvmdriver-1 volume_clear none
-            iniset $CINDER_CONF lvmdriver-2 volume_clear none
-        fi
-    else
-        iniset $CINDER_CONF DEFAULT volume_group $VOLUME_GROUP
-        iniset $CINDER_CONF DEFAULT volume_name_template ${VOLUME_NAME_PREFIX}%s
-    fi
+
     iniset $CINDER_CONF DEFAULT my_ip "$CINDER_SERVICE_HOST"
     iniset $CINDER_CONF DEFAULT iscsi_helper tgtadm
     iniset $CINDER_CONF DEFAULT sql_connection `database_connection_url cinder`
@@ -274,6 +236,26 @@
     # supported.
     iniset $CINDER_CONF DEFAULT enable_v1_api true
 
+    if is_service_enabled c-vol && [[ -n "$CINDER_ENABLED_BACKENDS" ]]; then
+        enabled_backends=""
+        default_type=""
+        for be in ${CINDER_ENABLED_BACKENDS//,/ }; do
+            BE_TYPE=${be%%:*}
+            BE_NAME=${be##*:}
+            if type configure_cinder_backend_${BE_TYPE} >/dev/null 2>&1; then
+                configure_cinder_backend_${BE_TYPE} ${BE_NAME}
+            fi
+            if [[ -z "$default_type" ]]; then
+                default_type=$BE_TYPE
+            fi
+            enabled_backends+=$BE_NAME,
+        done
+        iniset $CINDER_CONF DEFAULT enabled_backends ${enabled_backends%,*}
+        if [[ -n "$default_type" ]]; then
+            iniset $CINDER_CONF DEFAULT default_volume_type ${default_type}
+        fi
+    fi
+
     if is_service_enabled swift; then
         iniset $CINDER_CONF DEFAULT backup_swift_url "http://$SERVICE_HOST:8080/v1/AUTH_"
     fi
@@ -371,53 +353,6 @@
     rm -f $CINDER_AUTH_CACHE_DIR/*
 }
 
-function create_cinder_volume_group {
-    # According to the ``CINDER_MULTI_LVM_BACKEND`` value, configure one or two default volumes
-    # group called ``stack-volumes`` (and ``stack-volumes2``) for the volume
-    # service if it (they) does (do) not yet exist. If you don't wish to use a
-    # file backed volume group, create your own volume group called ``stack-volumes``
-    # and ``stack-volumes2`` before invoking ``stack.sh``.
-    #
-    # The two backing files are ``VOLUME_BACKING_FILE_SIZE`` in size, and they are stored in
-    # the ``DATA_DIR``.
-
-    if ! sudo vgs $VOLUME_GROUP; then
-        if [ -z "$VOLUME_BACKING_DEVICE" ]; then
-            # Only create if the file doesn't already exists
-            [[ -f $VOLUME_BACKING_FILE ]] || truncate -s $VOLUME_BACKING_FILE_SIZE $VOLUME_BACKING_FILE
-            DEV=`sudo losetup -f --show $VOLUME_BACKING_FILE`
-
-            # Only create if the loopback device doesn't contain $VOLUME_GROUP
-            if ! sudo vgs $VOLUME_GROUP; then
-                sudo vgcreate $VOLUME_GROUP $DEV
-            fi
-        else
-            sudo vgcreate $VOLUME_GROUP $VOLUME_BACKING_DEVICE
-        fi
-    fi
-    if [ "$CINDER_MULTI_LVM_BACKEND" = "True" ]; then
-        #set up the second volume if CINDER_MULTI_LVM_BACKEND is enabled
-
-        if ! sudo vgs $VOLUME_GROUP2; then
-            if [ -z "$VOLUME_BACKING_DEVICE2" ]; then
-                # Only create if the file doesn't already exists
-                [[ -f $VOLUME_BACKING_FILE2 ]] || truncate -s $VOLUME_BACKING_FILE_SIZE $VOLUME_BACKING_FILE2
-
-                DEV=`sudo losetup -f --show $VOLUME_BACKING_FILE2`
-
-                # Only create if the loopback device doesn't contain $VOLUME_GROUP
-                if ! sudo vgs $VOLUME_GROUP2; then
-                    sudo vgcreate $VOLUME_GROUP2 $DEV
-                fi
-            else
-                sudo vgcreate $VOLUME_GROUP2 $VOLUME_BACKING_DEVICE2
-            fi
-        fi
-    fi
-
-    mkdir -p $CINDER_STATE_PATH/volumes
-}
-
 # init_cinder() - Initialize database and volume group
 function init_cinder {
     # Force nova volumes off
@@ -431,26 +366,17 @@
         $CINDER_BIN_DIR/cinder-manage db sync
     fi
 
-    if is_service_enabled c-vol; then
-
-        create_cinder_volume_group
-
-        if sudo vgs $VOLUME_GROUP; then
-            if is_fedora || is_suse; then
-                # service is not started by default
-                start_service tgtd
+    if is_service_enabled c-vol && [[ -n "$CINDER_ENABLED_BACKENDS" ]]; then
+        for be in ${CINDER_ENABLED_BACKENDS//,/ }; do
+            BE_TYPE=${be%%:*}
+            BE_NAME=${be##*:}
+            if type init_cinder_backend_${BE_TYPE} >/dev/null 2>&1; then
+                init_cinder_backend_${BE_TYPE} ${BE_NAME}
             fi
-
-            # Remove iscsi targets
-            sudo tgtadm --op show --mode target | grep $VOLUME_NAME_PREFIX | grep Target | cut -f3 -d ' ' | sudo xargs -n1 tgt-admin --delete || true
-            # Start with a clean volume group
-            _clean_lvm_lv $VOLUME_GROUP $VOLUME_NAME_PREFIX
-            if [ "$CINDER_MULTI_LVM_BACKEND" = "True" ]; then
-                _clean_lvm_lv $VOLUME_GROUP2 $VOLUME_NAME_PREFIX
-            fi
-        fi
+        done
     fi
 
+    mkdir -p $CINDER_STATE_PATH/volumes
     create_cinder_cache_dir
 }
 
@@ -502,6 +428,11 @@
     fi
 
     screen_it c-api "cd $CINDER_DIR && $CINDER_BIN_DIR/cinder-api --config-file $CINDER_CONF"
+    echo "Waiting for Cinder API to start..."
+    if ! wait_for_service $SERVICE_TIMEOUT $CINDER_SERVICE_PROTOCOL://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT; then
+        die $LINENO "c-api did not start"
+    fi
+
     screen_it c-sch "cd $CINDER_DIR && $CINDER_BIN_DIR/cinder-scheduler --config-file $CINDER_CONF"
     screen_it c-bak "cd $CINDER_DIR && $CINDER_BIN_DIR/cinder-backup --config-file $CINDER_CONF"
     screen_it c-vol "cd $CINDER_DIR && $CINDER_BIN_DIR/cinder-volume --config-file $CINDER_CONF"
@@ -532,6 +463,30 @@
     fi
 }
 
+# create_volume_types() - Create Cinder's configured volume types
+function create_volume_types {
+    # Create volume types
+    if is_service_enabled c-api && [[ -n "$CINDER_ENABLED_BACKENDS" ]]; then
+        for be in ${CINDER_ENABLED_BACKENDS//,/ }; do
+            BE_TYPE=${be%%:*}
+            BE_NAME=${be##*:}
+            if type configure_cinder_backend_${BE_TYPE} >/dev/null 2>&1; then
+                # openstack volume type create --property volume_backend_name="${BE_TYPE}" ${BE_NAME}
+                cinder type-create ${BE_NAME} && \
+                    cinder type-key ${BE_NAME} set volume_backend_name="${BE_NAME}"
+            fi
+        done
+    fi
+}
+
+# Compatibility for Grenade
+
+function create_cinder_volume_group {
+    # During a transition period Grenade needs to have this function defined
+    # It is effectively a no-op in the Grenade 'target' use case
+    :
+}
+
 
 # Restore xtrace
 $XTRACE
diff --git a/lib/cinder_backends/lvm b/lib/cinder_backends/lvm
new file mode 100644
index 0000000..324c323
--- /dev/null
+++ b/lib/cinder_backends/lvm
@@ -0,0 +1,179 @@
+# lib/cinder_backends/lvm
+# Configure the LVM backend
+
+# Enable with:
+#
+#   CINDER_ENABLED_BACKENDS+=,lvm:lvmname
+
+# Dependencies:
+#
+# - ``functions`` file
+# - ``cinder`` configurations
+
+# CINDER_CONF
+# DATA_DIR
+
+# clean_cinder_backend_lvm - called from clean_cinder()
+# configure_cinder_backend_lvm - called from configure_cinder()
+# init_cinder_backend_lvm - called from init_cinder()
+
+
+# Save trace setting
+MY_XTRACE=$(set +o | grep xtrace)
+set +o xtrace
+
+
+# Defaults
+# --------
+
+# Name of the lvm volume groups to use/create for iscsi volumes
+# This monkey-motion is for compatibility with icehouse-generation Grenade
+# If ``VOLUME_GROUP`` is set, use it, otherwise we'll build a VG name based
+# on ``VOLUME_GROUP_NAME`` that includes the backend name
+# Grenade doesn't use ``VOLUME_GROUP2`` so it is left out
+VOLUME_GROUP_NAME=${VOLUME_GROUP:-${VOLUME_GROUP_NAME:-stack-volumes}}
+
+# TODO: resurrect backing device...need to know how to set values
+#VOLUME_BACKING_DEVICE=${VOLUME_BACKING_DEVICE:-}
+
+VOLUME_NAME_PREFIX=${VOLUME_NAME_PREFIX:-volume-}
+
+
+# Entry Points
+# ------------
+
+# Compatibility for getting a volume group name from either ``VOLUME_GROUP``
+# or from ``VOLUME_GROUP_NAME`` plus the backend name
+function get_volume_group_name {
+    local be_name=$1
+
+    # Again with the icehouse-generation compatibility
+    local volume_group_name=$VOLUME_GROUP_NAME
+    if [[ -z $VOLUME_GROUP ]]; then
+        volume_group_name+="-$be_name"
+    fi
+    echo $volume_group_name
+}
+
+function cleanup_cinder_backend_lvm {
+    local be_name=$1
+
+    # Again with the icehouse-generation compatibility
+    local volume_group_name=$(get_volume_group_name $be_name)
+
+    # Campsite rule: leave behind a volume group at least as clean as we found it
+    _clean_lvm_lv ${volume_group_name} $VOLUME_NAME_PREFIX
+    _clean_lvm_backing_file ${volume_group_name} $DATA_DIR/${volume_group_name}-backing-file
+}
+
+# configure_cinder_backend_lvm - Set config files, create data dirs, etc
+# configure_cinder_backend_lvm $name
+function configure_cinder_backend_lvm {
+    local be_name=$1
+
+    # Again with the icehouse-generation compatibility
+    local volume_group_name=$(get_volume_group_name $be_name)
+
+    iniset $CINDER_CONF $be_name volume_backend_name $be_name
+    iniset $CINDER_CONF $be_name volume_driver "cinder.volume.drivers.lvm.LVMISCSIDriver"
+    iniset $CINDER_CONF $be_name volume_group $volume_group_name
+
+    if [[ "$CINDER_SECURE_DELETE" == "False" ]]; then
+        iniset $CINDER_CONF $be_name volume_clear none
+    fi
+}
+
+
+function init_cinder_backend_lvm {
+    local be_name=$1
+
+    # Again with the icehouse-generation compatibility
+    local volume_group_name=$(get_volume_group_name $be_name)
+
+    # Start with a clean volume group
+    _create_cinder_volume_group ${volume_group_name} $DATA_DIR/${volume_group_name}-backing-file
+
+    if is_fedora || is_suse; then
+        # service is not started by default
+        start_service tgtd
+    fi
+
+    # Remove iscsi targets
+    sudo tgtadm --op show --mode target | grep $VOLUME_NAME_PREFIX | grep Target | cut -f3 -d ' ' | sudo xargs -n1 tgt-admin --delete || true
+    _clean_lvm_lv ${volume_group_name} $VOLUME_NAME_PREFIX
+}
+
+
+# _clean_lvm_lv removes all cinder LVM volumes
+#
+# Usage: _clean_lvm_lv volume-group-name $VOLUME_NAME_PREFIX
+function _clean_lvm_lv {
+    local vg=$1
+    local lv_prefix=$2
+
+    # Clean out existing volumes
+    for lv in $(sudo lvs --noheadings -o lv_name $vg 2>/dev/null); do
+        # lv_prefix prefixes the LVs we want
+        if [[ "${lv#$lv_prefix}" != "$lv" ]]; then
+            sudo lvremove -f $vg/$lv
+        fi
+    done
+}
+
+# _clean_lvm_backing_file() removes the backing file of the
+# volume group used by cinder
+#
+# Usage: _clean_lvm_backing_file() volume-group-name backing-file-name
+function _clean_lvm_backing_file {
+    local vg=$1
+    local backing_file=$2
+
+    # if there is no logical volume left, it's safe to attempt a cleanup
+    # of the backing file
+    if [[ -z "$(sudo lvs --noheadings -o lv_name $vg 2>/dev/null)" ]]; then
+        # if the backing physical device is a loop device, it was probably setup by devstack
+        VG_DEV=$(sudo losetup -j $backing_file | awk -F':' '/backing-file/ { print $1}')
+        if [[ -n "$VG_DEV" ]] && [[ -e "$VG_DEV" ]]; then
+            sudo losetup -d $VG_DEV
+            rm -f $backing_file
+        fi
+    fi
+}
+
+# _create_cinder_volume_group volume-group-name backing-file-name
+function _create_cinder_volume_group {
+    # According to the ``CINDER_MULTI_LVM_BACKEND`` value, configure one or two default volumes
+    # group called ``stack-volumes`` (and ``stack-volumes2``) for the volume
+    # service if it (they) does (do) not yet exist. If you don't wish to use a
+    # file backed volume group, create your own volume group called ``stack-volumes``
+    # and ``stack-volumes2`` before invoking ``stack.sh``.
+    #
+    # The two backing files are ``VOLUME_BACKING_FILE_SIZE`` in size, and they are stored in
+    # the ``DATA_DIR``.
+
+    local vg_name=$1
+    local backing_file=$2
+
+    if ! sudo vgs $vg_name; then
+        # TODO: fix device handling
+        if [ -z "$VOLUME_BACKING_DEVICE" ]; then
+            # Only create if the file doesn't already exists
+            [[ -f $backing_file ]] || truncate -s $VOLUME_BACKING_FILE_SIZE $backing_file
+            DEV=`sudo losetup -f --show $backing_file`
+
+            # Only create if the loopback device doesn't contain $VOLUME_GROUP
+            if ! sudo vgs $vg_name; then
+                sudo vgcreate $vg_name $DEV
+            fi
+        else
+            sudo vgcreate $vg_name $VOLUME_BACKING_DEVICE
+        fi
+    fi
+}
+
+
+# Restore xtrace
+$MY_XTRACE
+
+# mode: shell-script
+# End:
diff --git a/lib/cinder_backends/nfs b/lib/cinder_backends/nfs
new file mode 100644
index 0000000..7648788
--- /dev/null
+++ b/lib/cinder_backends/nfs
@@ -0,0 +1,43 @@
+# lib/cinder_backends/nfs
+# Configure the nfs backend
+
+# Enable with:
+#
+#   CINDER_ENABLED_BACKENDS+=,nfs:<volume-type-name>
+
+# Dependencies:
+#
+# - ``functions`` file
+# - ``cinder`` configurations
+
+# CINDER_CONF
+# CINDER_CONF_DIR
+# CINDER_NFS_SERVERPATH - contents of nfs shares config file
+
+# configure_cinder_backend_nfs - Configure Cinder for NFS backends
+
+# Save trace setting
+NFS_XTRACE=$(set +o | grep xtrace)
+set +o xtrace
+
+
+# Entry Points
+# ------------
+
+# configure_cinder_backend_nfs - Set config files, create data dirs, etc
+function configure_cinder_backend_nfs {
+    local be_name=$1
+    iniset $CINDER_CONF $be_name volume_backend_name $be_name
+    iniset $CINDER_CONF $be_name volume_driver "cinder.volume.drivers.nfs.NfsDriver"
+    iniset $CINDER_CONF $be_name nfs_shares_config "$CINDER_CONF_DIR/nfs-shares-$be_name.conf"
+
+    echo "$CINDER_NFS_SERVERPATH" | tee "$CINDER_CONF_DIR/nfs-shares-$be_name.conf"
+}
+
+
+# Restore xtrace
+$NFS_XTRACE
+
+# Local variables:
+# mode: shell-script
+# End:
diff --git a/lib/databases/postgresql b/lib/databases/postgresql
index b39984c..6e85d6e 100644
--- a/lib/databases/postgresql
+++ b/lib/databases/postgresql
@@ -10,6 +10,9 @@
 set +o xtrace
 
 
+MAX_DB_CONNECTIONS=${MAX_DB_CONNECTIONS:-200}
+
+
 register_database postgresql
 
 
@@ -64,6 +67,8 @@
     fi
     # Listen on all addresses
     sudo sed -i "/listen_addresses/s/.*/listen_addresses = '*'/" $PG_CONF
+    # Set max_connections
+    sudo sed -i "/max_connections/s/.*/max_connections = $MAX_DB_CONNECTIONS/" $PG_CONF
     # Do password auth from all IPv4 clients
     sudo sed -i "/^host/s/all\s\+127.0.0.1\/32\s\+ident/$DATABASE_USER\t0.0.0.0\/0\tpassword/" $PG_HBA
     # Do password auth for all IPv6 clients
diff --git a/lib/ironic b/lib/ironic
index c24780f..ef136bc 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -53,12 +53,7 @@
 IRONIC_VM_SSH_ADDRESS=${IRONIC_VM_SSH_ADDRESS:-$HOST_IP}
 IRONIC_VM_COUNT=${IRONIC_VM_COUNT:-1}
 IRONIC_VM_SPECS_CPU=${IRONIC_VM_SPECS_CPU:-1}
-# NOTE(adam_g): Kernels 3.12 and newer user tmpfs by default for initramfs.
-#               DIB produced ramdisks tend to be ~250MB but tmpfs will only allow
-#               use of 50% of available memory before ENOSPC.  Set minimum 1GB
-#               for nodes to avoid (LP: #1311987) and ensure consistency across
-#               older and newer kernels.
-IRONIC_VM_SPECS_RAM=${IRONIC_VM_SPECS_RAM:-1024}
+IRONIC_VM_SPECS_RAM=${IRONIC_VM_SPECS_RAM:-512}
 IRONIC_VM_SPECS_DISK=${IRONIC_VM_SPECS_DISK:-10}
 IRONIC_VM_EPHEMERAL_DISK=${IRONIC_VM_EPHEMERAL_DISK:-0}
 IRONIC_VM_EMULATOR=${IRONIC_VM_EMULATOR:-/usr/bin/qemu-system-x86_64}
diff --git a/lib/keystone b/lib/keystone
index ec124cb..4e94bad 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -47,7 +47,7 @@
 KEYSTONE_EXTENSIONS=${KEYSTONE_EXTENSIONS:-}
 
 # Toggle for deploying Keystone under HTTPD + mod_wsgi
-KEYSTONE_USE_MOD_WSGI=${KEYSTONE_USE_MOD_WSGI:-False}
+KEYSTONE_USE_MOD_WSGI=${KEYSTONE_USE_MOD_WSGI:-${ENABLE_HTTPD_MOD_WSGI_SERVICES}}
 
 # Select the backend for Keystone's service catalog
 KEYSTONE_CATALOG_BACKEND=${KEYSTONE_CATALOG_BACKEND:-sql}
@@ -193,6 +193,12 @@
         iniset $KEYSTONE_CONF assignment driver "keystone.assignment.backends.$KEYSTONE_ASSIGNMENT_BACKEND.Assignment"
     fi
 
+    # Configure rabbitmq credentials
+    if is_service_enabled rabbit; then
+        iniset $KEYSTONE_CONF DEFAULT rabbit_password $RABBIT_PASSWORD
+        iniset $KEYSTONE_CONF DEFAULT rabbit_host $RABBIT_HOST
+    fi
+
     # Set the URL advertised in the ``versions`` structure returned by the '/' route
     iniset $KEYSTONE_CONF DEFAULT public_endpoint "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:%(public_port)s/"
     iniset $KEYSTONE_CONF DEFAULT admin_endpoint "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:%(admin_port)s/"
diff --git a/lib/neutron b/lib/neutron
index 6039872..8b883b1 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -203,6 +203,13 @@
 # Example: ``LB_PHYSICAL_INTERFACE=eth1``
 LB_PHYSICAL_INTERFACE=${LB_PHYSICAL_INTERFACE:-}
 
+# When Neutron tunnels are enabled it is needed to specify the
+# IP address of the end point in the local server. This IP is set
+# by default to the same IP address that the HOST IP.
+# This variable can be used to specify a different end point IP address
+# Example: ``TUNNEL_ENDPOINT_IP=1.1.1.1``
+TUNNEL_ENDPOINT_IP=${TUNNEL_ENDPOINT_IP:-$HOST_IP}
+
 # With the openvswitch plugin, set to True in ``localrc`` to enable
 # provider GRE tunnels when ``ENABLE_TENANT_TUNNELS`` is False.
 #
@@ -296,6 +303,9 @@
     if is_service_enabled q-meta; then
         _configure_neutron_metadata_agent
     fi
+    if is_service_enabled ceilometer; then
+        _configure_neutron_ceilometer_notifications
+    fi
 
     _configure_neutron_debug_command
 }
@@ -722,6 +732,10 @@
 
 }
 
+function _configure_neutron_ceilometer_notifications {
+    iniset $NEUTRON_CONF DEFAULT notification_driver neutron.openstack.common.notifier.rpc_notifier
+}
+
 function _configure_neutron_lbaas {
     neutron_agent_lbaas_configure_common
     neutron_agent_lbaas_configure_agent
diff --git a/lib/neutron_plugins/ml2 b/lib/neutron_plugins/ml2
index 9966373..8e131bb 100644
--- a/lib/neutron_plugins/ml2
+++ b/lib/neutron_plugins/ml2
@@ -99,7 +99,7 @@
     fi
 
     # Since we enable the tunnel TypeDrivers, also enable a local_ip
-    iniset /$Q_PLUGIN_CONF_FILE ovs local_ip $HOST_IP
+    iniset /$Q_PLUGIN_CONF_FILE ovs local_ip $TUNNEL_ENDPOINT_IP
 
     populate_ml2_config /$Q_PLUGIN_CONF_FILE ml2 mechanism_drivers=$Q_ML2_PLUGIN_MECHANISM_DRIVERS
 
diff --git a/lib/neutron_plugins/ofagent_agent b/lib/neutron_plugins/ofagent_agent
index b8321f3..66283ad 100644
--- a/lib/neutron_plugins/ofagent_agent
+++ b/lib/neutron_plugins/ofagent_agent
@@ -54,7 +54,7 @@
             die $LINENO "You are running OVS version $OVS_VERSION. OVS 1.4+ is required for tunneling between multiple hosts."
         fi
         iniset /$Q_PLUGIN_CONF_FILE ovs enable_tunneling True
-        iniset /$Q_PLUGIN_CONF_FILE ovs local_ip $HOST_IP
+        iniset /$Q_PLUGIN_CONF_FILE ovs local_ip $TUNNEL_ENDPOINT_IP
     fi
 
     # Setup physical network bridge mappings.  Override
diff --git a/lib/neutron_plugins/openvswitch_agent b/lib/neutron_plugins/openvswitch_agent
index fbc013f..5adb0c5 100644
--- a/lib/neutron_plugins/openvswitch_agent
+++ b/lib/neutron_plugins/openvswitch_agent
@@ -48,7 +48,7 @@
             die $LINENO "You are running OVS version $OVS_VERSION. OVS 1.4+ is required for tunneling between multiple hosts."
         fi
         iniset /$Q_PLUGIN_CONF_FILE ovs enable_tunneling True
-        iniset /$Q_PLUGIN_CONF_FILE ovs local_ip $HOST_IP
+        iniset /$Q_PLUGIN_CONF_FILE ovs local_ip $TUNNEL_ENDPOINT_IP
     fi
 
     # Setup physical network bridge mappings.  Override
diff --git a/lib/swift b/lib/swift
index b01dd95..2b161c3 100644
--- a/lib/swift
+++ b/lib/swift
@@ -339,12 +339,12 @@
     iniset ${SWIFT_CONFIG_PROXY_SERVER} app:proxy-server node_timeout 120
     iniset ${SWIFT_CONFIG_PROXY_SERVER} app:proxy-server conn_timeout 20
 
-    # Skipped due to bug 1294789
-    ## Configure Ceilometer
-    #if is_service_enabled ceilometer; then
-    #    iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:ceilometer use "egg:ceilometer#swift"
-    #    SWIFT_EXTRAS_MIDDLEWARE_LAST="${SWIFT_EXTRAS_MIDDLEWARE_LAST} ceilometer"
-    #fi
+    # Configure Ceilometer
+    if is_service_enabled ceilometer; then
+        iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:ceilometer "set log_level" "WARN"
+        iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:ceilometer use "egg:ceilometer#swift"
+        SWIFT_EXTRAS_MIDDLEWARE_LAST="${SWIFT_EXTRAS_MIDDLEWARE_LAST} ceilometer"
+    fi
 
     # Restrict the length of auth tokens in the swift proxy-server logs.
     iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:proxy-logging reveal_sensitive_prefix ${SWIFT_LOG_TOKEN_LENGTH}
diff --git a/lib/tls b/lib/tls
index 02906b7..a84bb76 100644
--- a/lib/tls
+++ b/lib/tls
@@ -18,6 +18,9 @@
 # - configure_proxy
 # - start_tls_proxy
 
+# - stop_tls_proxy
+# - cleanup_CA
+
 # - make_root_CA
 # - make_int_CA
 # - make_cert ca-dir cert-name "common-name" ["alt-name" ...]
@@ -372,6 +375,22 @@
 }
 
 
+# Cleanup Functions
+# ===============
+
+
+# Stops all stud processes. This should be done only after all services
+# using tls configuration are down.
+function stop_tls_proxy {
+    killall stud
+}
+
+
+# Remove CA along with configuration, as well as the local server certificate
+function cleanup_CA {
+    rm -rf "$DATA_DIR/CA" "$DEVSTACK_CERT"
+}
+
 # Tell emacs to use shell-script-mode
 ## Local variables:
 ## mode: shell-script
diff --git a/stack.sh b/stack.sh
index f3d8d44..94b90d1 100755
--- a/stack.sh
+++ b/stack.sh
@@ -530,6 +530,12 @@
     echo $@ >&3
 }
 
+if [[ is_fedora && $DISTRO =~ (rhel) ]]; then
+    # poor old python2.6 doesn't have argparse by default, which
+    # outfilter.py uses
+    is_package_installed python-argparse || install_package python-argparse
+fi
+
 # Set up logging for ``stack.sh``
 # Set ``LOGFILE`` to turn on logging
 # Append '.xxxxxxxx' to the given name to maintain history
@@ -668,6 +674,18 @@
 # Do the ugly hacks for borken packages and distros
 $TOP_DIR/tools/fixup_stuff.sh
 
+
+# Extras Pre-install
+# ------------------
+
+# Phase: pre-install
+if [[ -d $TOP_DIR/extras.d ]]; then
+    for i in $TOP_DIR/extras.d/*.sh; do
+        [[ -r $i ]] && source $i stack pre-install
+    done
+fi
+
+
 install_rpc_backend
 
 if is_service_enabled $DATABASE_BACKENDS; then
@@ -1233,6 +1251,7 @@
 if is_service_enabled cinder; then
     echo_summary "Starting Cinder"
     start_cinder
+    create_volume_types
 fi
 if is_service_enabled ceilometer; then
     echo_summary "Starting Ceilometer"
@@ -1489,6 +1508,19 @@
     done
 fi
 
+# TODO(dtroyer): Remove CINDER_MULTI_LVM_BACKEND after stable/juno branch is cut
+if [[ "$CINDER_MULTI_LVM_BACKEND" = "True" ]]; then
+    echo ""
+    echo_summary "WARNING: CINDER_MULTI_LVM_BACKEND is used"
+    echo "You are using CINDER_MULTI_LVM_BACKEND to configure Cinder's multiple LVM backends"
+    echo "Please convert that configuration in local.conf to use CINDER_ENABLED_BACKENDS."
+    echo "CINDER_ENABLED_BACKENDS will be removed early in the 'K' development cycle"
+    echo "
+[[local|localrc]]
+CINDER_ENABLED_BACKENDS=lvm:lvmdriver-1,lvm:lvmdriver-2
+"
+fi
+
 # Indicate how long this took to run (bash maintained variable ``SECONDS``)
 echo_summary "stack.sh completed in $SECONDS seconds."
 
diff --git a/stackrc b/stackrc
index 6af3db7..a05fc18 100644
--- a/stackrc
+++ b/stackrc
@@ -363,7 +363,8 @@
         IMAGE_URLS=${IMAGE_URLS:-"http://partnerweb.vmware.com/programs/vmdkimage/cirros-0.3.2-i386-disk.vmdk"};;
     xenserver)
         DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-0.3.0-x86_64-disk}
-        IMAGE_URLS=${IMAGE_URLS:-"https://github.com/downloads/citrix-openstack/warehouse/cirros-0.3.0-x86_64-disk.vhd.tgz"};;
+        IMAGE_URLS=${IMAGE_URLS:-"https://github.com/downloads/citrix-openstack/warehouse/cirros-0.3.0-x86_64-disk.vhd.tgz"}
+        IMAGE_URLS+=",http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-x86_64-uec.tar.gz";;
     *) # Default to Cirros with kernel, ramdisk and disk image
         DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-${CIRROS_VERSION}-x86_64-uec}
         IMAGE_URLS=${IMAGE_URLS:-"http://download.cirros-cloud.net/${CIRROS_VERSION}/cirros-${CIRROS_VERSION}-x86_64-uec.tar.gz"};;
@@ -407,8 +408,7 @@
 # 10Gb default volume backing file size
 VOLUME_BACKING_FILE_SIZE=${VOLUME_BACKING_FILE_SIZE:-10250M}
 
-# Name of the LVM volume group to use/create for iscsi volumes
-VOLUME_GROUP=${VOLUME_GROUP:-stack-volumes}
+# Prefixes for volume and instance names
 VOLUME_NAME_PREFIX=${VOLUME_NAME_PREFIX:-volume-}
 INSTANCE_NAME_PREFIX=${INSTANCE_NAME_PREFIX:-instance-}
 
diff --git a/tools/xen/install_os_domU.sh b/tools/xen/install_os_domU.sh
index 44e8dc1..12e861e 100755
--- a/tools/xen/install_os_domU.sh
+++ b/tools/xen/install_os_domU.sh
@@ -207,6 +207,8 @@
             -e "s,\(d-i mirror/http/hostname string\).*,\1 $UBUNTU_INST_HTTP_HOSTNAME,g" \
             -e "s,\(d-i mirror/http/directory string\).*,\1 $UBUNTU_INST_HTTP_DIRECTORY,g" \
             -e "s,\(d-i mirror/http/proxy string\).*,\1 $UBUNTU_INST_HTTP_PROXY,g" \
+            -e "s,\(d-i passwd/root-password password\).*,\1 $GUEST_PASSWORD,g" \
+            -e "s,\(d-i passwd/root-password-again password\).*,\1 $GUEST_PASSWORD,g" \
             -i "${HTTP_SERVER_LOCATION}/devstackubuntupreseed.cfg"
     fi
 
@@ -382,10 +384,16 @@
     while ! ssh_no_check -q stack@$OS_VM_MANAGEMENT_ADDRESS "service devstack status | grep -q running"; do
         sleep 10
     done
-    echo -n "devstack is running"
+    echo -n "devstack service is running, waiting for stack.sh to start logging..."
+
+    while ! ssh_no_check -q stack@$OS_VM_MANAGEMENT_ADDRESS "test -e /tmp/devstack/log/stack.log"; do
+        sleep 10
+    done
     set -x
 
-    # Watch devstack's output
+    # Watch devstack's output (which doesn't start until stack.sh is running,
+    # but wait for run.sh (which starts stack.sh) to exit as that is what
+    # hopefully writes the succeded cookie.
     pid=`ssh_no_check -q stack@$OS_VM_MANAGEMENT_ADDRESS pgrep run.sh`
     ssh_no_check -q stack@$OS_VM_MANAGEMENT_ADDRESS "tail --pid $pid -n +1 -f /tmp/devstack/log/stack.log"
 
diff --git a/unstack.sh b/unstack.sh
index a5e7b87..fe5fc77 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -122,9 +122,10 @@
     stop_horizon
 fi
 
-# Kill TLS proxies
+# Kill TLS proxies and cleanup certificates
 if is_service_enabled tls-proxy; then
-    killall stud
+    stop_tls_proxy
+    cleanup_CA
 fi
 
 SCSI_PERSIST_DIR=$CINDER_STATE_PATH/volumes/*