Merge "Fix negated services with common prefix"
diff --git a/files/debs/general b/files/debs/general
index c27b77d..1460526 100644
--- a/files/debs/general
+++ b/files/debs/general
@@ -17,6 +17,7 @@
 tar
 python-dev
 python2.7
+python-gdbm # needed for testr
 bc
 libyaml-dev
 libffi-dev
diff --git a/functions-common b/functions-common
index e6af662..4d07c03 100644
--- a/functions-common
+++ b/functions-common
@@ -174,10 +174,7 @@
     local xtrace=$(set +o | grep xtrace)
     set +o xtrace
     local msg="[WARNING] ${BASH_SOURCE[2]}:$1 $2"
-    echo $msg 1>&2;
-    if [[ -n ${LOGDIR} ]]; then
-        echo $msg >> "${LOGDIR}/error.log"
-    fi
+    echo $msg
     $xtrace
     return $exitcode
 }
@@ -509,7 +506,7 @@
         fi
 
         count=$(($count + 1))
-        warn "timeout ${count} for git call: [git $@]"
+        warn $LINENO "timeout ${count} for git call: [git $@]"
         if [ $count -eq 3 ]; then
             die $LINENO "Maximum of 3 git retries reached"
         fi
@@ -1140,6 +1137,10 @@
 # the command.
 # _run_process service "command-line" [group]
 function _run_process {
+    # disable tracing through the exec redirects, it's just confusing in the logs.
+    xtrace=$(set +o | grep xtrace)
+    set +o xtrace
+
     local service=$1
     local command="$2"
     local group=$3
@@ -1163,6 +1164,9 @@
         export PYTHONUNBUFFERED=1
     fi
 
+    # reenable xtrace before we do *real* work
+    $xtrace
+
     # Run under ``setsid`` to force the process to become a session and group leader.
     # The pid saved can be used with pkill -g to get the entire process group.
     if [[ -n "$group" ]]; then
diff --git a/lib/ceilometer b/lib/ceilometer
index 3a4a4fb..9abdbfe 100644
--- a/lib/ceilometer
+++ b/lib/ceilometer
@@ -195,7 +195,7 @@
 
     # Install the policy file for the API server
     cp $CEILOMETER_DIR/etc/ceilometer/policy.json $CEILOMETER_CONF_DIR
-    iniset $CEILOMETER_CONF DEFAULT policy_file $CEILOMETER_CONF_DIR/policy.json
+    iniset $CEILOMETER_CONF oslo_policy policy_file $CEILOMETER_CONF_DIR/policy.json
 
     cp $CEILOMETER_DIR/etc/ceilometer/pipeline.yaml $CEILOMETER_CONF_DIR
     cp $CEILOMETER_DIR/etc/ceilometer/event_pipeline.yaml $CEILOMETER_CONF_DIR
diff --git a/lib/cinder b/lib/cinder
index 6439903..eb0e1d7 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -77,9 +77,20 @@
 
 
 # Should cinder perform secure deletion of volumes?
-# Defaults to true, can be set to False to avoid this bug when testing:
+# Defaults to zero. Can also be set to none or shred.
+# This was previously CINDER_SECURE_DELETE (True or False).
+# Equivalents using CINDER_VOLUME_CLEAR are zero and none, respectively.
+# Set to none to avoid this bug when testing:
 # https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1023755
-CINDER_SECURE_DELETE=$(trueorfalse True CINDER_SECURE_DELETE)
+if [[ -n $CINDER_SECURE_DELETE ]]; then
+    CINDER_SECURE_DELETE=$(trueorfalse True CINDER_SECURE_DELETE)
+    if [[ $CINDER_SECURE_DELETE == "False" ]]; then
+        CINDER_VOLUME_CLEAR_DEFAULT="none"
+    fi
+    DEPRECATED_TEXT="$DEPRECATED_TEXT\nConfigure secure Cinder volume deletion using CINDER_VOLUME_CLEAR instead of CINDER_SECURE_DELETE.\n"
+fi
+CINDER_VOLUME_CLEAR=${CINDER_VOLUME_CLEAR:-${CINDER_VOLUME_CLEAR_DEFAULT:-zero}}
+CINDER_VOLUME_CLEAR=$(echo ${CINDER_VOLUME_CLEAR} | tr '[:upper:]' '[:lower:]')
 
 # Cinder reports allocations back to the scheduler on periodic intervals
 # it turns out we can get an "out of space" issue when we run tests too
@@ -256,9 +267,8 @@
 
     iniset_rpc_backend cinder $CINDER_CONF
 
-    if [[ "$CINDER_SECURE_DELETE" == "False" ]]; then
-        iniset $CINDER_CONF DEFAULT secure_delete False
-        iniset $CINDER_CONF DEFAULT volume_clear none
+    if [[ "$CINDER_VOLUME_CLEAR" == "none" ]] || [[ "$CINDER_VOLUME_CLEAR" == "zero" ]] || [[ "$CINDER_VOLUME_CLEAR" == "shred" ]]; then
+        iniset $CINDER_CONF DEFAULT volume_clear $CINDER_VOLUME_CLEAR
     fi
 
     # Format logging
diff --git a/lib/cinder_backends/lvm b/lib/cinder_backends/lvm
index d369c0c..35ad209 100644
--- a/lib/cinder_backends/lvm
+++ b/lib/cinder_backends/lvm
@@ -39,6 +39,7 @@
 
     # Campsite rule: leave behind a volume group at least as clean as we found it
     clean_lvm_volume_group $VOLUME_GROUP_NAME-$be_name
+    clean_lvm_filter
 }
 
 # configure_cinder_backend_lvm - Set config files, create data dirs, etc
diff --git a/lib/glance b/lib/glance
index 5a96a61..f543e54 100644
--- a/lib/glance
+++ b/lib/glance
@@ -109,6 +109,7 @@
     local dburl=`database_connection_url glance`
     iniset $GLANCE_REGISTRY_CONF DEFAULT sql_connection $dburl
     iniset $GLANCE_REGISTRY_CONF DEFAULT use_syslog $SYSLOG
+    iniset $GLANCE_REGISTRY_CONF DEFAULT workers "$API_WORKERS"
     iniset $GLANCE_REGISTRY_CONF paste_deploy flavor keystone
     configure_auth_token_middleware $GLANCE_REGISTRY_CONF glance $GLANCE_AUTH_CACHE_DIR/registry
     if is_service_enabled qpid || [ -n "$RABBIT_HOST" ] && [ -n "$RABBIT_PASSWORD" ]; then
diff --git a/lib/ironic b/lib/ironic
index 4ac0100..4a37f0a 100644
--- a/lib/ironic
+++ b/lib/ironic
@@ -296,7 +296,7 @@
 # API specific configuration.
 function configure_ironic_api {
     iniset $IRONIC_CONF_FILE DEFAULT auth_strategy keystone
-    iniset $IRONIC_CONF_FILE DEFAULT policy_file $IRONIC_POLICY_JSON
+    iniset $IRONIC_CONF_FILE oslo_policy policy_file $IRONIC_POLICY_JSON
 
     # TODO(Yuki Nishiwaki): This is a temporary work-around until Ironic is fixed(bug#1422632).
     # These codes need to be changed to use the function of configure_auth_token_middleware
diff --git a/lib/lvm b/lib/lvm
index 54976a3..1fe2683 100644
--- a/lib/lvm
+++ b/lib/lvm
@@ -145,6 +145,13 @@
     fi
 }
 
+# clean_lvm_filter() Remove the filter rule set in set_lvm_filter()
+#
+# Usage: clean_lvm_filter()
+function clean_lvm_filter {
+    sudo sed -i "s/^.*# from devstack$//" /etc/lvm/lvm.conf
+}
+
 # set_lvm_filter() Gather all devices configured for LVM and
 # use them to build a global device filter
 # set_lvm_filter() Create a device filter
@@ -154,7 +161,7 @@
 #
 # Usage: set_lvm_filter()
 function set_lvm_filter {
-    local filter_suffix='"r|.*|" ]'
+    local filter_suffix='"r|.*|" ]  # from devstack'
     local filter_string="global_filter = [ "
     local pv
     local vg
@@ -167,6 +174,7 @@
     done
     filter_string=$filter_string$filter_suffix
 
+    clean_lvm_filter
     sudo sed -i "/# global_filter = \[*\]/a\    $global_filter$filter_string" /etc/lvm/lvm.conf
     echo_summary "set lvm.conf device global_filter to: $filter_string"
 }
diff --git a/lib/neutron-legacy b/lib/neutron-legacy
index 3072d0a..18b0942 100644
--- a/lib/neutron-legacy
+++ b/lib/neutron-legacy
@@ -62,7 +62,7 @@
 # -----------------------------
 
 # Subnet IP version
-IP_VERSION=${IP_VERSION:-4}
+IP_VERSION=${IP_VERSION:-"4+6"}
 # Validate IP_VERSION
 if [[ $IP_VERSION != "4" ]] && [[ $IP_VERSION != "6" ]] && [[ $IP_VERSION != "4+6" ]]; then
     die $LINENO "IP_VERSION must be either 4, 6, or 4+6"
@@ -1081,7 +1081,7 @@
 
     iniset $NEUTRON_CONF DEFAULT verbose True
     iniset $NEUTRON_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
-    iniset $NEUTRON_CONF DEFAULT policy_file $Q_POLICY_FILE
+    iniset $NEUTRON_CONF oslo_policy policy_file $Q_POLICY_FILE
     iniset $NEUTRON_CONF DEFAULT allow_overlapping_ips $Q_ALLOW_OVERLAPPING_IP
 
     iniset $NEUTRON_CONF DEFAULT auth_strategy $Q_AUTH_STRATEGY
@@ -1145,6 +1145,8 @@
         sudo install -o root -g root -m 644 $NEUTRON_DIR/etc/rootwrap.conf $Q_RR_CONF_FILE
     fi
     sudo sed -e "s:^filters_path=.*$:filters_path=$Q_CONF_ROOTWRAP_D:" -i $Q_RR_CONF_FILE
+    sudo sed -e 's:^exec_dirs=\(.*\)$:exec_dirs=\1,/usr/local/bin:' -i $Q_RR_CONF_FILE
+
     # Specify ``rootwrap.conf`` as first parameter to neutron-rootwrap
     ROOTWRAP_SUDOER_CMD="$NEUTRON_ROOTWRAP $Q_RR_CONF_FILE *"
     ROOTWRAP_DAEMON_SUDOER_CMD="$NEUTRON_ROOTWRAP-daemon $Q_RR_CONF_FILE"
diff --git a/lib/neutron_plugins/ml2 b/lib/neutron_plugins/ml2
index e3b2c4d..8853777 100644
--- a/lib/neutron_plugins/ml2
+++ b/lib/neutron_plugins/ml2
@@ -89,7 +89,7 @@
 
     # Allow for setup the flat type network
     if [[ -z "$Q_ML2_PLUGIN_FLAT_TYPE_OPTIONS" && -n "$PHYSICAL_NETWORK" ]]; then
-            Q_ML2_PLUGIN_FLAT_TYPE_OPTIONS="flat_networks=$Q_ML2_FLAT_PHYSNET_OPTIONS"
+            Q_ML2_PLUGIN_FLAT_TYPE_OPTIONS="flat_networks=$PHYSICAL_NETWORK"
     fi
     # REVISIT(rkukura): Setting firewall_driver here for
     # neutron.agent.securitygroups_rpc.is_firewall_enabled() which is
@@ -104,8 +104,10 @@
         iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver neutron.agent.firewall.NoopFirewallDriver
     fi
 
-    # Since we enable the tunnel TypeDrivers, also enable a local_ip
-    iniset /$Q_PLUGIN_CONF_FILE ovs local_ip $TUNNEL_ENDPOINT_IP
+    if [[ "$ENABLE_TENANT_TUNNELS" == "True" ]]; then
+        # Set local_ip if TENANT_TUNNELS are enabled.
+        iniset /$Q_PLUGIN_CONF_FILE ovs local_ip $TUNNEL_ENDPOINT_IP
+    fi
 
     populate_ml2_config /$Q_PLUGIN_CONF_FILE ml2 mechanism_drivers=$Q_ML2_PLUGIN_MECHANISM_DRIVERS
 
diff --git a/stack.sh b/stack.sh
index e5ee0dc..3925bb0 100755
--- a/stack.sh
+++ b/stack.sh
@@ -708,6 +708,12 @@
 # Pre-build some problematic wheels
 if [[ -n ${WHEELHOUSE:-} && ! -d ${WHEELHOUSE:-} ]]; then
     source $TOP_DIR/tools/build_wheels.sh
+
+    # Due to https://bugs.launchpad.net/swift/+bug/1451992 we have to import
+    # this package with root once so the CFFI bindings can be built. We have
+    # to therefore install it so we can import it.
+    pip_install xattr
+    sudo python -c "import xattr"
 fi
 
 
diff --git a/stackrc b/stackrc
index 0b93d32..2a49ea5 100644
--- a/stackrc
+++ b/stackrc
@@ -49,7 +49,7 @@
     # Keystone - nothing works without keystone
     ENABLED_SERVICES=key
     # Nova - services to support libvirt based openstack clouds
-    ENABLED_SERVICES+=,n-api,n-cpu,n-net,n-cond,n-sch,n-novnc,n-crt
+    ENABLED_SERVICES+=,n-api,n-cpu,n-net,n-cond,n-sch,n-novnc,n-crt,n-cauth
     # Glance services needed for Nova
     ENABLED_SERVICES+=,g-api,g-reg
     # Cinder
diff --git a/tests/test_functions.sh b/tests/test_functions.sh
index 4ebb000..1d82792 100755
--- a/tests/test_functions.sh
+++ b/tests/test_functions.sh
@@ -7,9 +7,6 @@
 # Import common functions
 source $TOP/functions
 
-# Import configuration
-source $TOP/openrc
-
 source $TOP/tests/unittest.sh
 
 echo "Testing die_if_not_set()"
diff --git a/unstack.sh b/unstack.sh
index 30981fd..ed7e617 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -192,3 +192,4 @@
 
 # BUG: maybe it doesn't exist? We should isolate this further down.
 clean_lvm_volume_group $DEFAULT_VOLUME_GROUP_NAME || /bin/true
+clean_lvm_filter