Merge "Add mechanism to automatically load additional projects"
diff --git a/.gitignore b/.gitignore
index 5e770c8..f9e2644 100644
--- a/.gitignore
+++ b/.gitignore
@@ -11,3 +11,4 @@
 stack-screenrc
 *.pem
 accrc
+.stackenv
diff --git a/HACKING.rst b/HACKING.rst
index c4641fa..6ad8c7e 100644
--- a/HACKING.rst
+++ b/HACKING.rst
@@ -88,6 +88,30 @@
 ``configure_swift()``.
 
 
+stackrc
+-------
+
+``stackrc`` is the global configuration file for DevStack.  It is responsible for
+calling ``localrc`` if it exists so configuration can be overridden by the user.
+
+The criteria for what belongs in ``stackrc`` can be vaguely summarized as
+follows:
+
+* All project respositories and branches (for historical reasons)
+* Global configuration that may be referenced in ``localrc``, i.e. ``DEST``, ``DATA_DIR``
+* Global service configuration like ``ENABLED_SERVICES``
+* Variables used by multiple services that do not have a clear owner, i.e.
+  ``VOLUME_BACKING_FILE_SIZE`` (nova-volumes and cinder) or ``PUBLIC_NETWORK_NAME``
+  (nova-network and quantum)
+* Variables that can not be cleanly declared in a project file due to
+  dependency ordering, i.e. the order of sourcing the project files can
+  not be changed for other reasons but the earlier file needs to dereference a
+  variable set in the later file.  This should be rare.
+
+Also, variable declarations in ``stackrc`` do NOT allow overriding (the form
+``FOO=${FOO:-baz}``); if they did then they can already be changed in ``localrc``
+and can stay in the project file.
+
 Documentation
 -------------
 
diff --git a/exercises/volumes.sh b/exercises/volumes.sh
index 48a976e..5c5e0e4 100755
--- a/exercises/volumes.sh
+++ b/exercises/volumes.sh
@@ -192,7 +192,7 @@
 # Delete volume
 start_time=`date +%s`
 cinder delete $VOL_ID || die "Failure deleting volume $VOL_NAME"
-if ! timeout $ACTIVE_TIMEOUT sh -c "while ! cinder list | grep $VOL_NAME; do sleep 1; done"; then
+if ! timeout $ACTIVE_TIMEOUT sh -c "while cinder list | grep $VOL_NAME; do sleep 1; done"; then
     echo "Volume $VOL_NAME not deleted"
     exit 1
 fi
diff --git a/files/apts/general b/files/apts/general
index 12a92e0..0264066 100644
--- a/files/apts/general
+++ b/files/apts/general
@@ -6,7 +6,7 @@
 unzip
 wget
 psmisc
-git-core
+git
 lsof # useful when debugging
 openssh-server
 vim-nox
diff --git a/functions b/functions
index e1795ae..80e1796 100644
--- a/functions
+++ b/functions
@@ -459,7 +459,7 @@
     local file=$1
     local section=$2
     local option=$3
-    sed -i -e "/^\[ *$section *\]/,/^\[.*\]/ s|^\($option[ \t]*=.*$\)|#\1|" $file
+    sed -i -e "/^\[$section\]/,/^\[.*\]/ s|^\($option[ \t]*=.*$\)|#\1|" "$file"
 }
 
 # Uncomment an option in an INI file
@@ -468,7 +468,7 @@
     local file=$1
     local section=$2
     local option=$3
-    sed -i -e "/^\[ *$section *\]/,/^\[.*\]/ s|[^ \t]*#[ \t]*\($option[ \t]*=.*$\)|\1|" $file
+    sed -i -e "/^\[$section\]/,/^\[.*\]/ s|[^ \t]*#[ \t]*\($option[ \t]*=.*$\)|\1|" "$file"
 }
 
 
@@ -479,10 +479,20 @@
     local section=$2
     local option=$3
     local line
-    line=$(sed -ne "/^\[ *$section *\]/,/^\[.*\]/ { /^$option[ \t]*=/ p; }" $file)
+    line=$(sed -ne "/^\[$section\]/,/^\[.*\]/ { /^$option[ \t]*=/ p; }" "$file")
     echo ${line#*=}
 }
 
+# Determinate is the given option present in the INI file
+# ini_has_option config-file section option
+function ini_has_option() {
+    local file=$1
+    local section=$2
+    local option=$3
+    local line
+    line=$(sed -ne "/^\[$section\]/,/^\[.*\]/ { /^$option[ \t]*=/ p; }" "$file")
+    [ -n "$line" ]
+}
 
 # Set an option in an INI file
 # iniset config-file section option value
@@ -491,18 +501,18 @@
     local section=$2
     local option=$3
     local value=$4
-    if ! grep -q "^\[ *$section *\]" $file; then
+    if ! grep -q "^\[$section\]" "$file"; then
         # Add section at the end
-        echo -e "\n[$section]" >>$file
+        echo -e "\n[$section]" >>"$file"
     fi
-    if [[ -z "$(iniget $file $section $option)" ]]; then
+    if ! ini_has_option "$file" "$section" "$option"; then
         # Add it
-        sed -i -e "/^\[ *$section *\]/ a\\
+        sed -i -e "/^\[$section\]/ a\\
 $option = $value
-" $file
+" "$file"
     else
         # Replace it
-        sed -i -e "/^\[ *$section *\]/,/^\[.*\]/ s|^\($option[ \t]*=[ \t]*\).*$|\1$value|" $file
+        sed -i -e "/^\[$section\]/,/^\[.*\]/ s|^\($option[ \t]*=[ \t]*\).*$|\1$value|" "$file"
     fi
 }
 
diff --git a/lib/ceilometer b/lib/ceilometer
index 76ab254..749e785 100644
--- a/lib/ceilometer
+++ b/lib/ceilometer
@@ -29,9 +29,11 @@
 
 # Set up default directories
 CEILOMETER_DIR=$DEST/ceilometer
+CEILOMETERCLIENT_DIR=$DEST/python-ceilometerclient
 CEILOMETER_CONF_DIR=/etc/ceilometer
 CEILOMETER_CONF=$CEILOMETER_CONF_DIR/ceilometer.conf
 CEILOMETER_API_LOG_DIR=/var/log/ceilometer-api
+CEILOMETER_AUTH_CACHE_DIR=${CEILOMETER_AUTH_CACHE_DIR:-/var/cache/ceilometer}
 
 # Support potential entry-points console scripts
 if [ -d $CEILOMETER_DIR/bin ] ; then
@@ -46,6 +48,11 @@
     mongo ceilometer --eval "db.dropDatabase();"
 }
 
+# configure_ceilometerclient() - Set config files, create data dirs, etc
+function configure_ceilometerclient() {
+    setup_develop $CEILOMETERCLIENT_DIR
+}
+
 # configure_ceilometer() - Set config files, create data dirs, etc
 function configure_ceilometer() {
     setup_develop $CEILOMETER_DIR
@@ -78,15 +85,29 @@
     iniset $CEILOMETER_CONF keystone_authtoken admin_user ceilometer
     iniset $CEILOMETER_CONF keystone_authtoken admin_password $SERVICE_PASSWORD
     iniset $CEILOMETER_CONF keystone_authtoken admin_tenant_name $SERVICE_TENANT_NAME
+    iniset $CEILOMETER_CONF keystone_authtoken signing_dir $CEILOMETER_AUTH_CACHE_DIR
 
     cleanup_ceilometer
 }
 
+# init_ceilometer() - Initialize etc.
+function init_ceilometer() {
+    # Create cache dir
+    sudo mkdir -p $CEILOMETER_AUTH_CACHE_DIR
+    sudo chown `whoami` $CEILOMETER_AUTH_CACHE_DIR
+    rm -f $CEILOMETER_AUTH_CACHE_DIR/*
+}
+
 # install_ceilometer() - Collect source and prepare
 function install_ceilometer() {
     git_clone $CEILOMETER_REPO $CEILOMETER_DIR $CEILOMETER_BRANCH
 }
 
+# install_ceilometerclient() - Collect source and prepare
+function install_ceilometerclient() {
+    git_clone $CEILOMETERCLIENT_REPO $CEILOMETERCLIENT_DIR $CEILOMETERCLIENT_BRANCH
+}
+
 # start_ceilometer() - Start running processes, including screen
 function start_ceilometer() {
     screen_it ceilometer-acompute "cd $CEILOMETER_DIR && sg libvirtd \"$CEILOMETER_BIN_DIR/ceilometer-agent-compute --config-file $CEILOMETER_CONF\""
diff --git a/lib/cinder b/lib/cinder
index 8949cfc..4aaea5d 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -184,6 +184,7 @@
 
     if [[ "$CINDER_SECURE_DELETE" == "False" ]]; then
         iniset $CINDER_CONF DEFAULT secure_delete False
+        iniset $CINDER_CONF DEFAULT volume_clear none
     fi
 
     if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ]; then
diff --git a/lib/nova b/lib/nova
index 21157dc..781cc09 100644
--- a/lib/nova
+++ b/lib/nova
@@ -354,73 +354,73 @@
     # (Re)create ``nova.conf``
     rm -f $NOVA_CONF
     add_nova_opt "[DEFAULT]"
-    add_nova_opt "verbose=True"
-    add_nova_opt "auth_strategy=keystone"
-    add_nova_opt "allow_resize_to_same_host=True"
-    add_nova_opt "api_paste_config=$NOVA_API_PASTE_INI"
-    add_nova_opt "rootwrap_config=$NOVA_CONF_DIR/rootwrap.conf"
-    add_nova_opt "compute_scheduler_driver=$SCHEDULER"
-    add_nova_opt "dhcpbridge_flagfile=$NOVA_CONF"
-    add_nova_opt "force_dhcp_release=True"
-    add_nova_opt "fixed_range=$FIXED_RANGE"
-    add_nova_opt "default_floating_pool=$PUBLIC_NETWORK_NAME"
-    add_nova_opt "s3_host=$SERVICE_HOST"
-    add_nova_opt "s3_port=$S3_SERVICE_PORT"
-    add_nova_opt "osapi_compute_extension=nova.api.openstack.compute.contrib.standard_extensions"
-    add_nova_opt "my_ip=$HOST_IP"
+    iniset $NOVA_CONF DEFAULT verbose "True"
+    iniset $NOVA_CONF DEFAULT auth_strategy "keystone"
+    iniset $NOVA_CONF DEFAULT allow_resize_to_same_host "True"
+    iniset $NOVA_CONF DEFAULT api_paste_config "$NOVA_API_PASTE_INI"
+    iniset $NOVA_CONF DEFAULT rootwrap_config "$NOVA_CONF_DIR/rootwrap.conf"
+    iniset $NOVA_CONF DEFAULT compute_scheduler_driver "$SCHEDULER"
+    iniset $NOVA_CONF DEFAULT dhcpbridge_flagfile "$NOVA_CONF"
+    iniset $NOVA_CONF DEFAULT force_dhcp_release "True"
+    iniset $NOVA_CONF DEFAULT fixed_range "$FIXED_RANGE"
+    iniset $NOVA_CONF DEFAULT default_floating_pool "$PUBLIC_NETWORK_NAME"
+    iniset $NOVA_CONF DEFAULT s3_host "$SERVICE_HOST"
+    iniset $NOVA_CONF DEFAULT s3_port "$S3_SERVICE_PORT"
+    iniset $NOVA_CONF DEFAULT osapi_compute_extension "nova.api.openstack.compute.contrib.standard_extensions"
+    iniset $NOVA_CONF DEFAULT my_ip "$HOST_IP"
     local dburl
     database_connection_url dburl nova
-    add_nova_opt "sql_connection=$dburl"
+    iniset $NOVA_CONF DEFAULT sql_connection "$dburl"
     if is_baremetal; then
         database_connection_url dburl nova_bm
-        add_nova_opt "baremetal_sql_connection=$dburl"
+        iniset $NOVA_CONF baremetal sql_connection $dburl
     fi
-    add_nova_opt "libvirt_type=$LIBVIRT_TYPE"
-    add_nova_opt "libvirt_cpu_mode=none"
-    add_nova_opt "instance_name_template=${INSTANCE_NAME_PREFIX}%08x"
+    iniset $NOVA_CONF DEFAULT libvirt_type "$LIBVIRT_TYPE"
+    iniset $NOVA_CONF DEFAULT libvirt_cpu_mode "none"
+    iniset $NOVA_CONF DEFAULT instance_name_template "${INSTANCE_NAME_PREFIX}%08x"
 
     if is_service_enabled n-api; then
-        add_nova_opt "enabled_apis=$NOVA_ENABLED_APIS"
+        iniset $NOVA_CONF DEFAULT enabled_apis "$NOVA_ENABLED_APIS"
         if is_service_enabled tls-proxy; then
             # Set the service port for a proxy to take the original
-            add_nova_opt "osapi_compute_listen_port=$NOVA_SERVICE_PORT_INT"
+            iniset $NOVA_CONF DEFAULT osapi_compute_listen_port "$NOVA_SERVICE_PORT_INT"
         fi
     fi
     if is_service_enabled cinder; then
-        add_nova_opt "volume_api_class=nova.volume.cinder.API"
+        iniset $NOVA_CONF DEFAULT volume_api_class "nova.volume.cinder.API"
     fi
     if [ -n "$NOVA_STATE_PATH" ]; then
-        add_nova_opt "state_path=$NOVA_STATE_PATH"
-        add_nova_opt "lock_path=$NOVA_STATE_PATH"
+        iniset $NOVA_CONF DEFAULT state_path "$NOVA_STATE_PATH"
+        iniset $NOVA_CONF DEFAULT lock_path "$NOVA_STATE_PATH"
     fi
     if [ -n "$NOVA_INSTANCES_PATH" ]; then
-        add_nova_opt "instances_path=$NOVA_INSTANCES_PATH"
+        iniset $NOVA_CONF DEFAULT instances_path "$NOVA_INSTANCES_PATH"
     fi
     if [ "$MULTI_HOST" != "False" ]; then
-        add_nova_opt "multi_host=True"
-        add_nova_opt "send_arp_for_ha=True"
+        iniset $NOVA_CONF DEFAULT multi_host "True"
+        iniset $NOVA_CONF DEFAULT send_arp_for_ha "True"
     fi
     if [ "$SYSLOG" != "False" ]; then
-        add_nova_opt "use_syslog=True"
+        iniset $NOVA_CONF DEFAULT use_syslog "True"
     fi
     if [ "$API_RATE_LIMIT" != "True" ]; then
-        add_nova_opt "api_rate_limit=False"
+        iniset $NOVA_CONF DEFAULT api_rate_limit "False"
     fi
     if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ]; then
         # Add color to logging output
-        add_nova_opt "logging_context_format_string=%(asctime)s.%(msecs)d %(color)s%(levelname)s %(name)s [%(request_id)s %(user_name)s %(project_name)s%(color)s] %(instance)s%(color)s%(message)s"
-        add_nova_opt "logging_default_format_string=%(asctime)s.%(msecs)d %(color)s%(levelname)s %(name)s [-%(color)s] %(instance)s%(color)s%(message)s"
-        add_nova_opt "logging_debug_format_suffix=from (pid=%(process)d) %(funcName)s %(pathname)s:%(lineno)d"
-        add_nova_opt "logging_exception_prefix=%(color)s%(asctime)s.%(msecs)d TRACE %(name)s %(instance)s"
+        iniset $NOVA_CONF DEFAULT logging_context_format_string "%(asctime)s.%(msecs)d %(color)s%(levelname)s %(name)s [%(request_id)s %(user_name)s %(project_name)s%(color)s] %(instance)s%(color)s%(message)s"
+        iniset $NOVA_CONF DEFAULT logging_default_format_string "%(asctime)s.%(msecs)d %(color)s%(levelname)s %(name)s [-%(color)s] %(instance)s%(color)s%(message)s"
+        iniset $NOVA_CONF DEFAULT logging_debug_format_suffix "from (pid=%(process)d) %(funcName)s %(pathname)s:%(lineno)d"
+        iniset $NOVA_CONF DEFAULT logging_exception_prefix "%(color)s%(asctime)s.%(msecs)d TRACE %(name)s %(instance)s"
     else
         # Show user_name and project_name instead of user_id and project_id
-        add_nova_opt "logging_context_format_string=%(asctime)s.%(msecs) %(levelname)s %(name)s [%(request_id)s %(user_name)s %(project_name)s] %(instance)s%(message)s"
+        iniset $NOVA_CONF DEFAULT logging_context_format_string "%(asctime)s.%(msecs)d %(levelname)s %(name)s [%(request_id)s %(user_name)s %(project_name)s] %(instance)s%(message)s"
     fi
     if is_service_enabled ceilometer; then
-        add_nova_opt "instance_usage_audit=True"
-        add_nova_opt "instance_usage_audit_period=hour"
-        add_nova_opt "notification_driver=nova.openstack.common.notifier.rpc_notifier"
-        add_nova_opt "notification_driver=ceilometer.compute.nova_notifier"
+        iniset $NOVA_CONF DEFAULT instance_usage_audit "True"
+        iniset $NOVA_CONF DEFAULT instance_usage_audit_period "hour"
+        iniset $NOVA_CONF DEFAULT notification_driver "nova.openstack.common.notifier.rpc_notifier"
+        iniset $NOVA_CONF DEFAULT notification_driver "ceilometer.compute.nova_notifier"
     fi
 
 
@@ -433,17 +433,17 @@
     # For Example: ``EXTRA_OPTS=(foo=true bar=2)``
     for I in "${EXTRA_OPTS[@]}"; do
         # Attempt to convert flags to options
-        add_nova_opt ${I//--}
+        iniset $NOVA_CONF DEFAULT ${I//=/ }
     done
 }
 
 function create_nova_conf_nova_network() {
-    add_nova_opt "network_manager=nova.network.manager.$NET_MAN"
-    add_nova_opt "public_interface=$PUBLIC_INTERFACE"
-    add_nova_opt "vlan_interface=$VLAN_INTERFACE"
-    add_nova_opt "flat_network_bridge=$FLAT_NETWORK_BRIDGE"
+    iniset $NOVA_CONF DEFAULT network_manager "nova.network.manager.$NET_MAN"
+    iniset $NOVA_CONF DEFAULT public_interface "$PUBLIC_INTERFACE"
+    iniset $NOVA_CONF DEFAULT vlan_interface "$VLAN_INTERFACE"
+    iniset $NOVA_CONF DEFAULT flat_network_bridge "$FLAT_NETWORK_BRIDGE"
     if [ -n "$FLAT_INTERFACE" ]; then
-        add_nova_opt "flat_interface=$FLAT_INTERFACE"
+        iniset $NOVA_CONF DEFAULT flat_interface "$FLAT_INTERFACE"
     fi
 }
 
diff --git a/lib/quantum b/lib/quantum
index ea0e311..f74eead 100644
--- a/lib/quantum
+++ b/lib/quantum
@@ -200,13 +200,13 @@
 }
 
 function create_nova_conf_quantum() {
-    add_nova_opt "network_api_class=nova.network.quantumv2.api.API"
-    add_nova_opt "quantum_admin_username=$Q_ADMIN_USERNAME"
-    add_nova_opt "quantum_admin_password=$SERVICE_PASSWORD"
-    add_nova_opt "quantum_admin_auth_url=$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_AUTH_PORT/v2.0"
-    add_nova_opt "quantum_auth_strategy=$Q_AUTH_STRATEGY"
-    add_nova_opt "quantum_admin_tenant_name=$SERVICE_TENANT_NAME"
-    add_nova_opt "quantum_url=http://$Q_HOST:$Q_PORT"
+    iniset $NOVA_CONF DEFAULT network_api_class "nova.network.quantumv2.api.API"
+    iniset $NOVA_CONF DEFAULT quantum_admin_username "$Q_ADMIN_USERNAME"
+    iniset $NOVA_CONF DEFAULT quantum_admin_password "$SERVICE_PASSWORD"
+    iniset $NOVA_CONF DEFAULT quantum_admin_auth_url "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_AUTH_PORT/v2.0"
+    iniset $NOVA_CONF DEFAULT quantum_auth_strategy "$Q_AUTH_STRATEGY"
+    iniset $NOVA_CONF DEFAULT quantum_admin_tenant_name "$SERVICE_TENANT_NAME"
+    iniset $NOVA_CONF DEFAULT quantum_url "http://$Q_HOST:$Q_PORT"
 
     if [[ "$Q_PLUGIN" = "openvswitch" ]]; then
         NOVA_VIF_DRIVER=${NOVA_VIF_DRIVER:-"nova.virt.libvirt.vif.LibvirtHybridOVSBridgeDriver"}
@@ -214,14 +214,14 @@
         NOVA_VIF_DRIVER=${NOVA_VIF_DRIVER:-"nova.virt.libvirt.vif.QuantumLinuxBridgeVIFDriver"}
     elif [[ "$Q_PLUGIN" = "ryu" ]]; then
         NOVA_VIF_DRIVER=${NOVA_VIF_DRIVER:-"quantum.plugins.ryu.nova.vif.LibvirtOpenVswitchOFPRyuDriver"}
-        add_nova_opt "libvirt_ovs_integration_bridge=$OVS_BRIDGE"
-        add_nova_opt "linuxnet_ovs_ryu_api_host=$RYU_API_HOST:$RYU_API_PORT"
-        add_nova_opt "libvirt_ovs_ryu_api_host=$RYU_API_HOST:$RYU_API_PORT"
+        iniset $NOVA_CONF DEFAULT libvirt_ovs_integration_bridge "$OVS_BRIDGE"
+        iniset $NOVA_CONF DEFAULT linuxnet_ovs_ryu_api_host "$RYU_API_HOST:$RYU_API_PORT"
+        iniset $NOVA_CONF DEFAULT libvirt_ovs_ryu_api_host "$RYU_API_HOST:$RYU_API_PORT"
     fi
-    add_nova_opt "libvirt_vif_driver=$NOVA_VIF_DRIVER"
-    add_nova_opt "linuxnet_interface_driver=$LINUXNET_VIF_DRIVER"
+    iniset $NOVA_CONF DEFAULT libvirt_vif_driver "$NOVA_VIF_DRIVER"
+    iniset $NOVA_CONF DEFAULT linuxnet_interface_driver "$LINUXNET_VIF_DRIVER"
     if is_service_enabled q-meta; then
-        add_nova_opt "service_quantum_metadata_proxy=True"
+        iniset $NOVA_CONF DEFAULT service_quantum_metadata_proxy "True"
     fi
 }
 
diff --git a/lib/swift b/lib/swift
index 8934264..b418eda 100644
--- a/lib/swift
+++ b/lib/swift
@@ -39,7 +39,8 @@
 SWIFT_CONFIG_DIR=${SWIFT_CONFIG_DIR:-/etc/swift}
 
 # DevStack will create a loop-back disk formatted as XFS to store the
-# swift data. Set ``SWIFT_LOOPBACK_DISK_SIZE`` to the disk size in bytes.
+# swift data. Set ``SWIFT_LOOPBACK_DISK_SIZE`` to the disk size in
+# kilobytes.
 # Default is 1 gigabyte.
 SWIFT_LOOPBACK_DISK_SIZE=${SWIFT_LOOPBACK_DISK_SIZE:-1000000}
 
@@ -99,7 +100,7 @@
     # changing the permissions so we can run it as our user.
 
     USER_GROUP=$(id -g)
-    sudo mkdir -p ${SWIFT_DATA_DIR}/drives
+    sudo mkdir -p ${SWIFT_DATA_DIR}/{drives,cache}
     sudo chown -R $USER:${USER_GROUP} ${SWIFT_DATA_DIR}
 
     # Create a loopback disk and format it to XFS.
@@ -273,16 +274,22 @@
         swift_node_config=${SWIFT_CONFIG_DIR}/object-server/${node_number}.conf
         cp ${SWIFT_DIR}/etc/object-server.conf-sample ${swift_node_config}
         generate_swift_config ${swift_node_config} ${node_number} $[OBJECT_PORT_BASE + 10 * (node_number - 1)]
+        iniset ${swift_node_config} filter:recon recon_cache_path  ${SWIFT_DATA_DIR}/cache
+        # Using a sed and not iniset/iniuncomment because we want to a global
+        # modification and make sure it works for new sections.
+        sed -i -e "s,#[ ]*recon_cache_path .*,recon_cache_path = ${SWIFT_DATA_DIR}/cache," ${swift_node_config}
 
         swift_node_config=${SWIFT_CONFIG_DIR}/container-server/${node_number}.conf
         cp ${SWIFT_DIR}/etc/container-server.conf-sample ${swift_node_config}
         generate_swift_config ${swift_node_config} ${node_number} $[CONTAINER_PORT_BASE + 10 * (node_number - 1)]
         iniuncomment ${swift_node_config} app:container-server allow_versions
         iniset ${swift_node_config} app:container-server allow_versions  "true"
+        sed -i -e "s,#[ ]*recon_cache_path .*,recon_cache_path = ${SWIFT_DATA_DIR}/cache," ${swift_node_config}
 
         swift_node_config=${SWIFT_CONFIG_DIR}/account-server/${node_number}.conf
         cp ${SWIFT_DIR}/etc/account-server.conf-sample ${swift_node_config}
         generate_swift_config ${swift_node_config} ${node_number} $[ACCOUNT_PORT_BASE + 10 * (node_number - 1)]
+        sed -i -e "s,#[ ]*recon_cache_path .*,recon_cache_path = ${SWIFT_DATA_DIR}/cache," ${swift_node_config}
     done
 
     swift_log_dir=${SWIFT_DATA_DIR}/logs
diff --git a/lib/tempest b/lib/tempest
index b408b11..fa637c1 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -134,12 +134,14 @@
     flavor_lines=`nova flavor-list`
     IFS=$'\r\n'
     flavors=""
-    for line in $flavor_lines; do
-        if [ -z $DEFAULT_INSTANCE_TYPE ]; then
-            flavors="$flavors `echo $line | grep -v "^\(|\s*ID\|+--\)" | cut -d' ' -f2`"
-        else
-            flavors="$flavors `echo $line | grep -v "^\(|\s*ID\|+--\)" | grep "$DEFAULT_INSTANCE_TYPE" | cut -d' ' -f2`"
+    if [[ -n "$DEFAULT_INSTANCE_TYPE" ]]; then
+        for line in $flavor_lines; do
+            f=$(echo $line | awk "/ $DEFAULT_INSTANCE_TYPE / { print \$2 }")
+            flavors="$flavors $f"
+        done
     fi
+    for line in $flavor_lines; do
+        flavors="$flavors `echo $line | grep -v "^\(|\s*ID\|+--\)" | cut -d' ' -f2`"
     done
 
     IFS=" "
diff --git a/lib/tls b/lib/tls
index 1e2a899..202edef 100644
--- a/lib/tls
+++ b/lib/tls
@@ -189,7 +189,7 @@
 " >$ca_dir/signing.conf
 }
 
-# Create root and intermediate CAs and an initial server cert
+# Create root and intermediate CAs
 # init_CA
 function init_CA {
     # Ensure CAs are built
@@ -198,7 +198,11 @@
 
     # Create the CA bundle
     cat $ROOT_CA_DIR/cacert.pem $INT_CA_DIR/cacert.pem >>$INT_CA_DIR/ca-chain.pem
+}
 
+# Create an initial server cert
+# init_cert
+function init_cert {
     if [[ ! -r $DEVSTACK_CERT ]]; then
         if [[ -n "$TLS_IP" ]]; then
             # Lie to let incomplete match routines work
diff --git a/stack.sh b/stack.sh
index 5330099..c564137 100755
--- a/stack.sh
+++ b/stack.sh
@@ -772,6 +772,7 @@
     install_cinder
 fi
 if is_service_enabled ceilometer; then
+    install_ceilometerclient
     install_ceilometer
 fi
 
@@ -834,6 +835,7 @@
 if is_service_enabled tls-proxy; then
     configure_CA
     init_CA
+    init_cert
     # Add name to /etc/hosts
     # don't be naive and add to existing line!
 fi
@@ -1055,9 +1057,9 @@
     # These settings don't hurt anything if n-xvnc and n-novnc are disabled
     if is_service_enabled n-cpu; then
         NOVNCPROXY_URL=${NOVNCPROXY_URL:-"http://$SERVICE_HOST:6080/vnc_auto.html"}
-        add_nova_opt "novncproxy_base_url=$NOVNCPROXY_URL"
+        iniset $NOVA_CONF DEFAULT novncproxy_base_url "$NOVNCPROXY_URL"
         XVPVNCPROXY_URL=${XVPVNCPROXY_URL:-"http://$SERVICE_HOST:6081/console"}
-        add_nova_opt "xvpvncproxy_base_url=$XVPVNCPROXY_URL"
+        iniset $NOVA_CONF DEFAULT xvpvncproxy_base_url "$XVPVNCPROXY_URL"
     fi
     if [ "$VIRT_DRIVER" = 'xenserver' ]; then
         VNCSERVER_PROXYCLIENT_ADDRESS=${VNCSERVER_PROXYCLIENT_ADDRESS=169.254.0.1}
@@ -1067,18 +1069,18 @@
     # Address on which instance vncservers will listen on compute hosts.
     # For multi-host, this should be the management ip of the compute host.
     VNCSERVER_LISTEN=${VNCSERVER_LISTEN=127.0.0.1}
-    add_nova_opt "vncserver_listen=$VNCSERVER_LISTEN"
-    add_nova_opt "vncserver_proxyclient_address=$VNCSERVER_PROXYCLIENT_ADDRESS"
-    add_nova_opt "ec2_dmz_host=$EC2_DMZ_HOST"
+    iniset $NOVA_CONF DEFAULT vncserver_listen "$VNCSERVER_LISTEN"
+    iniset $NOVA_CONF DEFAULT vncserver_proxyclient_address "$VNCSERVER_PROXYCLIENT_ADDRESS"
+    iniset $NOVA_CONF DEFAULT ec2_dmz_host "$EC2_DMZ_HOST"
     if is_service_enabled zeromq; then
-        add_nova_opt "rpc_backend=nova.openstack.common.rpc.impl_zmq"
+        iniset $NOVA_CONF DEFAULT rpc_backend "nova.openstack.common.rpc.impl_zmq"
     elif is_service_enabled qpid; then
-        add_nova_opt "rpc_backend=nova.rpc.impl_qpid"
+        iniset $NOVA_CONF DEFAULT rpc_backend "nova.rpc.impl_qpid"
     elif [ -n "$RABBIT_HOST" ] &&  [ -n "$RABBIT_PASSWORD" ]; then
-        add_nova_opt "rabbit_host=$RABBIT_HOST"
-        add_nova_opt "rabbit_password=$RABBIT_PASSWORD"
+        iniset $NOVA_CONF DEFAULT rabbit_host "$RABBIT_HOST"
+        iniset $NOVA_CONF DEFAULT rabbit_password "$RABBIT_PASSWORD"
     fi
-    add_nova_opt "glance_api_servers=$GLANCE_HOSTPORT"
+    iniset $NOVA_CONF DEFAULT glance_api_servers "$GLANCE_HOSTPORT"
 
 
     # XenServer
@@ -1087,16 +1089,16 @@
     if [ "$VIRT_DRIVER" = 'xenserver' ]; then
         echo_summary "Using XenServer virtualization driver"
         read_password XENAPI_PASSWORD "ENTER A PASSWORD TO USE FOR XEN."
-        add_nova_opt "compute_driver=xenapi.XenAPIDriver"
+        iniset $NOVA_CONF DEFAULT compute_driver "xenapi.XenAPIDriver"
         XENAPI_CONNECTION_URL=${XENAPI_CONNECTION_URL:-"http://169.254.0.1"}
         XENAPI_USER=${XENAPI_USER:-"root"}
-        add_nova_opt "xenapi_connection_url=$XENAPI_CONNECTION_URL"
-        add_nova_opt "xenapi_connection_username=$XENAPI_USER"
-        add_nova_opt "xenapi_connection_password=$XENAPI_PASSWORD"
-        add_nova_opt "flat_injected=False"
+        iniset $NOVA_CONF DEFAULT xenapi_connection_url "$XENAPI_CONNECTION_URL"
+        iniset $NOVA_CONF DEFAULT xenapi_connection_username "$XENAPI_USER"
+        iniset $NOVA_CONF DEFAULT xenapi_connection_password "$XENAPI_PASSWORD"
+        iniset $NOVA_CONF DEFAULT flat_injected "False"
         # Need to avoid crash due to new firewall support
         XEN_FIREWALL_DRIVER=${XEN_FIREWALL_DRIVER:-"nova.virt.firewall.IptablesFirewallDriver"}
-        add_nova_opt "firewall_driver=$XEN_FIREWALL_DRIVER"
+        iniset $NOVA_CONF DEFAULT firewall_driver "$XEN_FIREWALL_DRIVER"
 
     # OpenVZ
     # ------
@@ -1105,34 +1107,40 @@
         echo_summary "Using OpenVZ virtualization driver"
         # TODO(deva): OpenVZ driver does not yet work if compute_driver is set here.
         #             Replace connection_type when this is fixed.
-        #             add_nova_opt "compute_driver=openvz.connection.OpenVzConnection"
-        add_nova_opt "connection_type=openvz"
+        #             iniset $NOVA_CONF DEFAULT compute_driver "openvz.connection.OpenVzConnection"
+        iniset $NOVA_CONF DEFAULT connection_type "openvz"
         LIBVIRT_FIREWALL_DRIVER=${LIBVIRT_FIREWALL_DRIVER:-"nova.virt.libvirt.firewall.IptablesFirewallDriver"}
-        add_nova_opt "firewall_driver=$LIBVIRT_FIREWALL_DRIVER"
+        iniset $NOVA_CONF DEFAULT firewall_driver "$LIBVIRT_FIREWALL_DRIVER"
 
     # Bare Metal
     # ----------
 
     elif [ "$VIRT_DRIVER" = 'baremetal' ]; then
         echo_summary "Using BareMetal driver"
-        add_nova_opt "compute_driver=nova.virt.baremetal.driver.BareMetalDriver"
         LIBVIRT_FIREWALL_DRIVER=${LIBVIRT_FIREWALL_DRIVER:-"nova.virt.firewall.NoopFirewallDriver"}
-        add_nova_opt "firewall_driver=$LIBVIRT_FIREWALL_DRIVER"
-        add_nova_opt "baremetal_driver=$BM_DRIVER"
-        add_nova_opt "baremetal_tftp_root=/tftpboot"
-        add_nova_opt "baremetal_instance_type_extra_specs=cpu_arch:$BM_CPU_ARCH"
-        add_nova_opt "baremetal_power_manager=$BM_POWER_MANAGER"
-        add_nova_opt "scheduler_host_manager=nova.scheduler.baremetal_host_manager.BaremetalHostManager"
-        add_nova_opt "scheduler_default_filters=AllHostsFilter"
+        iniset $NOVA_CONF DEFAULT compute_driver nova.virt.baremetal.driver.BareMetalDriver
+        iniset $NOVA_CONF DEFAULT firewall_driver $LIBVIRT_FIREWALL_DRIVER
+        iniset $NOVA_CONF DEFAULT scheduler_host_manager nova.scheduler.baremetal_host_manager.BaremetalHostManager
+        iniset $NOVA_CONF DEFAULT scheduler_default_filters AllHostsFilter
+        iniset $NOVA_CONF baremetal driver $BM_DRIVER
+        iniset $NOVA_CONF baremetal instance_type_extra_specs cpu_arch:$BM_CPU_ARCH
+        iniset $NOVA_CONF baremetal power_manager $BM_POWER_MANAGER
+        iniset $NOVA_CONF baremetal tftp_root /tftpboot
+
+        # Define extra baremetal nova conf flags by defining the array ``EXTRA_BAREMETAL_OPTS``.
+        for I in "${EXTRA_BAREMETAL_OPTS[@]}"; do
+           # Attempt to convert flags to options
+           iniset $NOVA_CONF baremetal ${I//=/ }
+        done
 
     # Default
     # -------
 
     else
         echo_summary "Using libvirt virtualization driver"
-        add_nova_opt "compute_driver=libvirt.LibvirtDriver"
+        iniset $NOVA_CONF DEFAULT compute_driver "libvirt.LibvirtDriver"
         LIBVIRT_FIREWALL_DRIVER=${LIBVIRT_FIREWALL_DRIVER:-"nova.virt.libvirt.firewall.IptablesFirewallDriver"}
-        add_nova_opt "firewall_driver=$LIBVIRT_FIREWALL_DRIVER"
+        iniset $NOVA_CONF DEFAULT firewall_driver "$LIBVIRT_FIREWALL_DRIVER"
     fi
 fi
 
@@ -1170,9 +1178,9 @@
     CREDS=$(keystone ec2-credentials-create --user_id $NOVA_USER_ID --tenant_id $NOVA_TENANT_ID)
     ACCESS_KEY=$(echo "$CREDS" | awk '/ access / { print $4 }')
     SECRET_KEY=$(echo "$CREDS" | awk '/ secret / { print $4 }')
-    add_nova_opt "s3_access_key=$ACCESS_KEY"
-    add_nova_opt "s3_secret_key=$SECRET_KEY"
-    add_nova_opt "s3_affix_tenant=True"
+    iniset $NOVA_CONF DEFAULT s3_access_key "$ACCESS_KEY"
+    iniset $NOVA_CONF DEFAULT s3_secret_key "$SECRET_KEY"
+    iniset $NOVA_CONF DEFAULT s3_affix_tenant "True"
 fi
 
 screen_it zeromq "cd $NOVA_DIR && $NOVA_BIN_DIR/nova-rpc-zmq-receiver"
@@ -1214,7 +1222,9 @@
 if is_service_enabled ceilometer; then
     echo_summary "Configuring Ceilometer"
     configure_ceilometer
+    configure_ceilometerclient
     echo_summary "Starting Ceilometer"
+    init_ceilometer
     start_ceilometer
 fi
 
diff --git a/stackrc b/stackrc
index 0e84db8..4e03a2f 100644
--- a/stackrc
+++ b/stackrc
@@ -33,6 +33,10 @@
 CEILOMETER_REPO=${GIT_BASE}/openstack/ceilometer.git
 CEILOMETER_BRANCH=master
 
+# ceilometer client library
+CEILOMETERCLIENT_REPO=${GIT_BASE}/openstack/python-ceilometerclient
+CEILOMETERCLIENT_BRANCH=master
+
 # volume service
 CINDER_REPO=${GIT_BASE}/openstack/cinder
 CINDER_BRANCH=master
diff --git a/tests/functions.sh b/tests/functions.sh
index be48729..4fe6443 100755
--- a/tests/functions.sh
+++ b/tests/functions.sh
@@ -57,6 +57,9 @@
 
 [ ccc ]
 spaces  =  yes
+
+[ddd]
+empty =
 EOF
 
 # Test with spaces
@@ -79,13 +82,22 @@
 
 # Test with spaces in section header
 
-VAL=$(iniget test.ini ccc spaces)
+VAL=$(iniget test.ini " ccc " spaces)
 if [[ "$VAL" == "yes" ]]; then
     echo "OK: $VAL"
 else
     echo "iniget failed: $VAL"
 fi
 
+iniset test.ini "b b" opt_ion 42
+
+VAL=$(iniget test.ini "b b" opt_ion)
+if [[ "$VAL" == "42" ]]; then
+    echo "OK: $VAL"
+else
+    echo "iniget failed: $VAL"
+fi
+
 # Test without spaces, end of file
 
 VAL=$(iniget test.ini bbb handlers)
@@ -104,6 +116,29 @@
     echo "iniget failed: $VAL"
 fi
 
+# test empty option
+if ini_has_option test.ini ddd empty; then
+   echo "OK: ddd.empty present"
+else
+   echo "ini_has_option failed: ddd.empty not found"
+fi
+
+# test non-empty option
+if ini_has_option test.ini bbb handlers; then
+   echo "OK: bbb.handlers present"
+else
+   echo "ini_has_option failed: bbb.handlers not found"
+fi
+
+# test changing empty option
+iniset test.ini ddd empty "42"
+
+VAL=$(iniget test.ini ddd empty)
+if [[ "$VAL" == "42" ]]; then
+    echo "OK: $VAL"
+else
+    echo "iniget failed: $VAL"
+fi
 
 # Test section not exist
 
@@ -132,6 +167,12 @@
     echo "iniget failed: $VAL"
 fi
 
+if ! ini_has_option test.ini aaa debug; then
+    echo "OK aaa.debug not present"
+else
+    echo "ini_has_option failed: aaa.debug"
+fi
+
 iniset test.ini aaa debug "999"
 
 VAL=$(iniget test.ini aaa debug)
diff --git a/tools/create_userrc.sh b/tools/create_userrc.sh
index e39c157..55cb8fa 100755
--- a/tools/create_userrc.sh
+++ b/tools/create_userrc.sh
@@ -173,10 +173,10 @@
     fi
     cat >"$rcfile" <<EOF
 # you can source this file
-export EC2_ACCESS_KEY=$ec2_access_key
-export EC2_SECRET_KEY=$ec2_secret_key
-export EC2_URL=$EC2_URL
-export S3_URL=$S3_URL
+export EC2_ACCESS_KEY="$ec2_access_key"
+export EC2_SECRET_KEY="$ec2_secret_key"
+export EC2_URL="$EC2_URL"
+export S3_URL="$S3_URL"
 # OpenStack USER ID = $user_id
 export OS_USERNAME="$user_name"
 # Openstack Tenant ID = $tenant_id
@@ -210,7 +210,7 @@
     if [ -n "$role_id" ]; then
         echo $role_id
     else
-        keystone tenant-create --name "$role_name" |awk '/\|[[:space:]]*id[[:space:]]*\|.*\|/ {print $4}'
+        keystone role-create --name "$role_name" |awk '/\|[[:space:]]*id[[:space:]]*\|.*\|/ {print $4}'
     fi
 }
 
diff --git a/tools/make_cert.sh b/tools/make_cert.sh
new file mode 100755
index 0000000..cb93e57
--- /dev/null
+++ b/tools/make_cert.sh
@@ -0,0 +1,55 @@
+#!/bin/bash
+
+# **make_cert.sh**
+
+# Create a CA hierarchy (if necessary) and server certificate
+#
+# This mimics the CA structure that DevStack sets up when ``tls_proxy`` is enabled
+# but in the curent directory unless ``DATA_DIR`` is set
+
+ENABLE_TLS=True
+DATA_DIR=${DATA_DIR:-`pwd`/ca-data}
+
+ROOT_CA_DIR=$DATA_DIR/root
+INT_CA_DIR=$DATA_DIR/int
+
+# Import common functions
+source $TOP_DIR/functions
+
+# Import TLS functions
+source lib/tls
+
+function usage {
+    echo "$0 - Create CA and/or certs"
+    echo ""
+    echo "Usage: $0 commonName [orgUnit]"
+    exit 1
+}
+
+CN=$1
+if [ -z "$CN" ]]; then
+    usage
+fi
+ORG_UNIT_NAME=${2:-$ORG_UNIT_NAME}
+
+# Useful on OS/X
+if [[ `uname -s` == 'Darwin' && -d /usr/local/Cellar/openssl ]]; then
+    # set up for brew-installed modern OpenSSL
+    OPENSSL_CONF=/usr/local/etc/openssl/openssl.cnf
+    OPENSSL=/usr/local/Cellar/openssl/*/bin/openssl
+fi
+
+DEVSTACK_CERT_NAME=$CN
+DEVSTACK_HOSTNAME=$CN
+DEVSTACK_CERT=$DATA_DIR/$DEVSTACK_CERT_NAME.pem
+
+# Make sure the CA is set up
+configure_CA
+init_CA
+
+# Create the server cert
+make_cert $INT_CA_DIR $DEVSTACK_CERT_NAME $DEVSTACK_HOSTNAME
+
+# Create a cert bundle
+cat $INT_CA_DIR/private/$DEVSTACK_CERT_NAME.key $INT_CA_DIR/$DEVSTACK_CERT_NAME.crt $INT_CA_DIR/cacert.pem >$DEVSTACK_CERT
+