Merge "Remove redundant arping package from apts/nova"
diff --git a/files/rpms/general b/files/rpms/general
index fc3412b..764b602 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -1,14 +1,19 @@
 bridge-utils
 curl
+dbus
 euca2ools # only for testing client
+gcc # dist:rhel6 [2]
 git-core
 openssh-server
 openssl
+libxml2-devel # dist:rhel6 [2]
+libxslt-devel # dist:rhel6 [2]
 psmisc
 pylint
 python-netaddr
 python-pep8
 python-pip
+python-prettytable # dist:rhel6 [1]
 python-unittest2
 python-virtualenv
 screen
@@ -16,3 +21,12 @@
 tcpdump
 unzip
 wget
+
+# [1] : some of installed tools have unversioned dependencies on this,
+# but others have versioned (<=0.7).  So if a later version (0.7.1)
+# gets installed in response to an unversioned dependency, it breaks.
+# This pre-installs a compatible 0.6(ish) version from RHEL
+
+# [2] : RHEL6 rpm versions of python-lxml is old, and has to be
+# removed.  Several tools rely on it, so we install the dependencies
+# pip needs to build it here (see tools/install_prereqs.sh)
\ No newline at end of file
diff --git a/files/rpms/glance b/files/rpms/glance
index eff6c2c..097cf3f 100644
--- a/files/rpms/glance
+++ b/files/rpms/glance
@@ -1,9 +1,10 @@
+gcc
 libxml2-devel
 python-argparse
 python-devel
 python-eventlet
 python-greenlet
-python-paste-deploy
+python-paste-deploy #dist:f16,f17,f18
 python-routes
 python-sqlalchemy
 python-wsgiref
diff --git a/files/rpms/horizon b/files/rpms/horizon
index 12f75ba..151e7e2 100644
--- a/files/rpms/horizon
+++ b/files/rpms/horizon
@@ -17,8 +17,8 @@
 python-mox
 python-netaddr
 python-nose
-python-paste
-python-paste-deploy
+python-paste        #dist:f16,f17,f18
+python-paste-deploy #dist:f16,f17,f18
 python-pep8
 python-routes
 python-sphinx
diff --git a/files/rpms/keystone b/files/rpms/keystone
index 59868c7..078adf7 100644
--- a/files/rpms/keystone
+++ b/files/rpms/keystone
@@ -1,11 +1,13 @@
 python-greenlet
-python-lxml
-python-paste
-python-paste-deploy
-python-paste-script
+python-lxml         #dist:f16,f17,f18
+python-paste        #dist:f16,f17,f18
+python-paste-deploy #dist:f16,f17,f18
+python-paste-script #dist:f16,f17,f18
 python-routes
-python-setuptools
+python-setuptools   #dist:f16,f17,f18
 python-sqlalchemy
 python-sqlite2
 python-webob
 sqlite
+
+# Deps installed via pip for RHEL
\ No newline at end of file
diff --git a/files/rpms/nova b/files/rpms/nova
index 9d8891d..328e7d6 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -29,9 +29,11 @@
 python-migrate
 python-mox
 python-netaddr
-python-paramiko
-python-paste
-python-paste-deploy
+python-paramiko # dist:f16,f17,f18
+# ^ on RHEL, brings in python-crypto which conflicts with version from
+# pip we need
+python-paste        # dist:f16,f17,f18
+python-paste-deploy # dist:f16,f17,f18
 python-qpid
 python-routes
 python-sqlalchemy
diff --git a/files/rpms/quantum b/files/rpms/quantum
index 05398fc..450e39c 100644
--- a/files/rpms/quantum
+++ b/files/rpms/quantum
@@ -10,14 +10,16 @@
 python-iso8601
 python-kombu
 python-netaddr
-python-paste
-python-paste-deploy
+#rhel6 gets via pip
+python-paste        # dist:f16,f17,f18
+python-paste-deploy # dist:f16,f17,f18
 python-qpid
 python-routes
 python-sqlalchemy
 python-suds
 rabbitmq-server # NOPRIME
-qpid-cpp-server-daemon # NOPRIME
+qpid-cpp-server-daemon # NOPRIME dist:f16,f17,f18
+qpid-cpp-server        # NOPRIME dist:rhel6
 sqlite
 sudo
 vconfig
diff --git a/files/rpms/ryu b/files/rpms/ryu
index 4a4fc52..7cf3bd7 100644
--- a/files/rpms/ryu
+++ b/files/rpms/ryu
@@ -1,5 +1,5 @@
-python-setuptools
 python-gevent
 python-gflags
 python-netifaces
+python-setuptools #dist:f16,f17,f18
 python-sphinx
diff --git a/files/rpms/swift b/files/rpms/swift
index ce41ceb..1b36e34 100644
--- a/files/rpms/swift
+++ b/files/rpms/swift
@@ -8,8 +8,8 @@
 python-greenlet
 python-netifaces
 python-nose
-python-paste-deploy
-python-setuptools
+python-paste-deploy # dist:f16,f17,f18
+python-setuptools   # dist:f16,f17,f18
 python-simplejson
 python-webob
 pyxattr
diff --git a/lib/database b/lib/database
index e63d5e2..442ed56 100644
--- a/lib/database
+++ b/lib/database
@@ -38,7 +38,7 @@
 for db in $DATABASE_BACKENDS; do
     # Set the type for the rest of the backend to use
     if is_service_enabled $db; then
-        # Set this now for the rest of the database funtions
+        # Set this now for the rest of the database functions
         DATABASE_TYPE=$db
     fi
 done
@@ -110,13 +110,11 @@
     configure_database_$DATABASE_TYPE
 }
 
-# Generate an SQLAlchemy connection URL and store it in a variable
-#  $1 The variable name in which to store the connection URL
-#  $2 The name of the database
+# Generate an SQLAlchemy connection URL and output it using echo
+#  $1 The name of the database
 function database_connection_url {
-    local var=$1
-    local db=$2
-    database_connection_url_$DATABASE_TYPE $var $db
+    local db=$1
+    database_connection_url_$DATABASE_TYPE $db
 }
 
 
diff --git a/lib/heat b/lib/heat
index 32c0182..cd0a204 100644
--- a/lib/heat
+++ b/lib/heat
@@ -29,6 +29,7 @@
 # set up default directories
 HEAT_DIR=$DEST/heat
 HEATCLIENT_DIR=$DEST/python-heatclient
+HEAT_AUTH_CACHE_DIR=${HEAT_AUTH_CACHE_DIR:-/var/cache/heat}
 
 
 # Functions
@@ -37,8 +38,7 @@
 # cleanup_heat() - Remove residual data files, anything left over from previous
 # runs that a clean run would need to clean up
 function cleanup_heat() {
-    # This function intentionally left blank
-    :
+    sudo rm -rf $HEAT_AUTH_CACHE_DIR
 }
 
 # configure_heatclient() - Set config files, create data dirs, etc
@@ -64,6 +64,11 @@
     HEAT_API_CW_PORT=${HEAT_API_CW_PORT:-8003}
     HEAT_API_HOST=${HEAT_API_HOST:-$SERVICE_HOST}
     HEAT_API_PORT=${HEAT_API_PORT:-8004}
+    HEAT_API_PASTE_FILE=$HEAT_CONF_DIR/api-paste.ini
+    HEAT_POLICY_FILE=$HEAT_CONF_DIR/policy.json
+
+    cp $HEAT_DIR/etc/heat/api-paste.ini $HEAT_API_PASTE_FILE
+    cp $HEAT_DIR/etc/heat/policy.json $HEAT_POLICY_FILE
 
     # Cloudformation API
     HEAT_API_CFN_CONF=$HEAT_CONF_DIR/heat-api-cfn.conf
@@ -73,21 +78,19 @@
     iniset $HEAT_API_CFN_CONF DEFAULT use_syslog $SYSLOG
     iniset $HEAT_API_CFN_CONF DEFAULT bind_host $HEAT_API_CFN_HOST
     iniset $HEAT_API_CFN_CONF DEFAULT bind_port $HEAT_API_CFN_PORT
+    iniset $HEAT_API_CFN_CONF keystone_authtoken auth_host $KEYSTONE_AUTH_HOST
+    iniset $HEAT_API_CFN_CONF keystone_authtoken auth_port $KEYSTONE_AUTH_PORT
+    iniset $HEAT_API_CFN_CONF keystone_authtoken auth_protocol $KEYSTONE_AUTH_PROTOCOL
+    iniset $HEAT_API_CFN_CONF keystone_authtoken auth_uri $KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v2.0
+    iniset $HEAT_API_CFN_CONF keystone_authtoken admin_tenant_name $SERVICE_TENANT_NAME
+    iniset $HEAT_API_CFN_CONF keystone_authtoken admin_user heat
+    iniset $HEAT_API_CFN_CONF keystone_authtoken admin_password $SERVICE_PASSWORD
+    iniset $HEAT_API_CFN_CONF keystone_authtoken signing_dir $HEAT_AUTH_CACHE_DIR/api-cfn
+    iniset $HEAT_API_CFN_CONF ec2authtoken auth_uri $KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v2.0
+    iniset $HEAT_API_CFN_CONF ec2authtoken keystone_ec2_uri $KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v2.0/ec2tokens
 
     iniset_rpc_backend heat $HEAT_API_CFN_CONF DEFAULT
 
-    HEAT_API_CFN_PASTE_INI=$HEAT_CONF_DIR/heat-api-cfn-paste.ini
-    cp $HEAT_DIR/etc/heat/heat-api-cfn-paste.ini $HEAT_API_CFN_PASTE_INI
-    iniset $HEAT_API_CFN_PASTE_INI filter:authtoken auth_host $KEYSTONE_AUTH_HOST
-    iniset $HEAT_API_CFN_PASTE_INI filter:authtoken auth_port $KEYSTONE_AUTH_PORT
-    iniset $HEAT_API_CFN_PASTE_INI filter:authtoken auth_protocol $KEYSTONE_AUTH_PROTOCOL
-    iniset $HEAT_API_CFN_PASTE_INI filter:authtoken auth_uri $KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v2.0
-    iniset $HEAT_API_CFN_PASTE_INI filter:authtoken admin_tenant_name $SERVICE_TENANT_NAME
-    iniset $HEAT_API_CFN_PASTE_INI filter:authtoken admin_user heat
-    iniset $HEAT_API_CFN_PASTE_INI filter:authtoken admin_password $SERVICE_PASSWORD
-    iniset $HEAT_API_CFN_PASTE_INI filter:ec2authtoken auth_uri $KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v2.0
-    iniset $HEAT_API_CFN_PASTE_INI filter:ec2authtoken keystone_ec2_uri $KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v2.0/ec2tokens
-
     # OpenStack API
     HEAT_API_CONF=$HEAT_CONF_DIR/heat-api.conf
     cp $HEAT_DIR/etc/heat/heat-api.conf $HEAT_API_CONF
@@ -96,20 +99,19 @@
     iniset $HEAT_API_CONF DEFAULT use_syslog $SYSLOG
     iniset $HEAT_API_CONF DEFAULT bind_host $HEAT_API_HOST
     iniset $HEAT_API_CONF DEFAULT bind_port $HEAT_API_PORT
+    iniset $HEAT_API_CONF keystone_authtoken auth_host $KEYSTONE_AUTH_HOST
+    iniset $HEAT_API_CONF keystone_authtoken auth_port $KEYSTONE_AUTH_PORT
+    iniset $HEAT_API_CONF keystone_authtoken auth_protocol $KEYSTONE_AUTH_PROTOCOL
+    iniset $HEAT_API_CONF keystone_authtoken auth_uri $KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v2.0
+    iniset $HEAT_API_CONF keystone_authtoken admin_tenant_name $SERVICE_TENANT_NAME
+    iniset $HEAT_API_CONF keystone_authtoken admin_user heat
+    iniset $HEAT_API_CONF keystone_authtoken admin_password $SERVICE_PASSWORD
+    iniset $HEAT_API_CONF keystone_authtoken signing_dir $HEAT_AUTH_CACHE_DIR/api
+    iniset $HEAT_API_CONF ec2authtoken auth_uri $KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v2.0
+    iniset $HEAT_API_CONF ec2authtoken keystone_ec2_uri $KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v2.0/ec2tokens
 
     iniset_rpc_backend heat $HEAT_API_CONF DEFAULT
 
-    HEAT_API_PASTE_INI=$HEAT_CONF_DIR/heat-api-paste.ini
-    cp $HEAT_DIR/etc/heat/heat-api-paste.ini $HEAT_API_PASTE_INI
-    iniset $HEAT_API_PASTE_INI filter:authtoken auth_host $KEYSTONE_AUTH_HOST
-    iniset $HEAT_API_PASTE_INI filter:authtoken auth_port $KEYSTONE_AUTH_PORT
-    iniset $HEAT_API_PASTE_INI filter:authtoken auth_protocol $KEYSTONE_AUTH_PROTOCOL
-    iniset $HEAT_API_PASTE_INI filter:authtoken auth_uri $KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v2.0
-    iniset $HEAT_API_PASTE_INI filter:authtoken admin_tenant_name $SERVICE_TENANT_NAME
-    iniset $HEAT_API_PASTE_INI filter:authtoken admin_user heat
-    iniset $HEAT_API_PASTE_INI filter:authtoken admin_password $SERVICE_PASSWORD
-    iniset $HEAT_API_PASTE_INI filter:ec2authtoken auth_uri $KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v2.0
-    iniset $HEAT_API_PASTE_INI filter:ec2authtoken keystone_ec2_uri $KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v2.0/ec2tokens
 
     # engine
     HEAT_ENGINE_CONF=$HEAT_CONF_DIR/heat-engine.conf
@@ -135,20 +137,19 @@
     iniset $HEAT_API_CW_CONF DEFAULT use_syslog $SYSLOG
     iniset $HEAT_API_CW_CONF DEFAULT bind_host $HEAT_API_CW_HOST
     iniset $HEAT_API_CW_CONF DEFAULT bind_port $HEAT_API_CW_PORT
+    iniset $HEAT_API_CW_CONF keystone_authtoken auth_host $KEYSTONE_AUTH_HOST
+    iniset $HEAT_API_CW_CONF keystone_authtoken auth_port $KEYSTONE_AUTH_PORT
+    iniset $HEAT_API_CW_CONF keystone_authtoken auth_protocol $KEYSTONE_AUTH_PROTOCOL
+    iniset $HEAT_API_CW_CONF keystone_authtoken auth_uri $KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v2.0
+    iniset $HEAT_API_CW_CONF keystone_authtoken admin_tenant_name $SERVICE_TENANT_NAME
+    iniset $HEAT_API_CW_CONF keystone_authtoken admin_user heat
+    iniset $HEAT_API_CW_CONF keystone_authtoken admin_password $SERVICE_PASSWORD
+    iniset $HEAT_API_CW_CONF keystone_authtoken signing_dir $HEAT_AUTH_CACHE_DIR/api-cloudwatch
+    iniset $HEAT_API_CW_CONF ec2authtoken auth_uri $KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v2.0
+    iniset $HEAT_API_CW_CONF ec2authtoken keystone_ec2_uri $KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v2.0/ec2tokens
 
     iniset_rpc_backend heat $HEAT_API_CW_CONF DEFAULT
 
-    HEAT_API_CW_PASTE_INI=$HEAT_CONF_DIR/heat-api-cloudwatch-paste.ini
-    cp $HEAT_DIR/etc/heat/heat-api-cloudwatch-paste.ini $HEAT_API_CW_PASTE_INI
-    iniset $HEAT_API_CW_PASTE_INI filter:authtoken auth_host $KEYSTONE_AUTH_HOST
-    iniset $HEAT_API_CW_PASTE_INI filter:authtoken auth_port $KEYSTONE_AUTH_PORT
-    iniset $HEAT_API_CW_PASTE_INI filter:authtoken auth_protocol $KEYSTONE_AUTH_PROTOCOL
-    iniset $HEAT_API_CW_PASTE_INI filter:authtoken auth_uri $KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v2.0
-    iniset $HEAT_API_CW_PASTE_INI filter:authtoken admin_tenant_name $SERVICE_TENANT_NAME
-    iniset $HEAT_API_CW_PASTE_INI filter:authtoken admin_user heat
-    iniset $HEAT_API_CW_PASTE_INI filter:authtoken admin_password $SERVICE_PASSWORD
-    iniset $HEAT_API_CW_PASTE_INI filter:ec2authtoken auth_uri $KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v2.0
-    iniset $HEAT_API_CW_PASTE_INI filter:ec2authtoken keystone_ec2_uri $KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v2.0/ec2tokens
 }
 
 # init_heat() - Initialize database
@@ -159,6 +160,18 @@
 
     $HEAT_DIR/bin/heat-db-setup $os_PACKAGE -r $DATABASE_PASSWORD
     $HEAT_DIR/tools/nova_create_flavors.sh
+    create_heat_cache_dir
+}
+
+# create_heat_cache_dir() - Part of the init_heat() process
+function create_heat_cache_dir() {
+    # Create cache dirs
+    sudo mkdir -p $HEAT_AUTH_CACHE_DIR/api
+    sudo chown $STACK_USER $HEAT_AUTH_CACHE_DIR/api
+    sudo mkdir -p $HEAT_AUTH_CACHE_DIR/api-cfn
+    sudo chown $STACK_USER $HEAT_AUTH_CACHE_DIR/api-cfn
+    sudo mkdir -p $HEAT_AUTH_CACHE_DIR/api-cloudwatch
+    sudo chown $STACK_USER $HEAT_AUTH_CACHE_DIR/api-cloudwatch
 }
 
 # install_heatclient() - Collect source and prepare
diff --git a/lib/horizon b/lib/horizon
index 05bf6d3..3d8b3e6 100644
--- a/lib/horizon
+++ b/lib/horizon
@@ -61,16 +61,47 @@
     fi
 }
 
+# Basic install of upstream nodejs for platforms that want it
+function install_nodejs() {
+    if [[ $(which node) ]]; then
+        echo "You already appear to have nodejs, skipping install"
+        return
+    fi
+
+    # There are several node deployment scripts; one may be more
+    # appropriate at some future point, but for now direct download is
+    # the simplest way.  The version barely matters for lesscss which
+    # doesn't use anything fancy.
+    local ver=0.10.1
+    local nodejs=node-v${ver}-linux-x64
+    local tar=$nodejs.tar.gz
+    local nodejs_url=http://nodejs.org/dist/v${ver}/${tar}
+
+    curl -Ss ${nodejs_url} | tar -C ${DEST} -xz
+    if [ $? -ne 0 ]; then
+        echo "*** Download of nodejs failed"
+        return 1
+    fi
+
+    # /usr/bin so it gets found in the PATH available to horizon
+    sudo ln -s $DEST/$nodejs/bin/node /usr/bin/node
+}
+
 # Entry Points
 # ------------
 
 # cleanup_horizon() - Remove residual data files, anything left over from previous
 # runs that a clean run would need to clean up
 function cleanup_horizon() {
-    # kill instances (nova)
-    # delete image files (glance)
-    # This function intentionally left blank
-    :
+
+    if [[ is_fedora && $DISTRO =~ (rhel6) ]]; then
+    # if the /usr/bin/node link looks like it's pointing into $DEST,
+    # then we installed it via install_nodejs
+        if [[ $(readlink -f /usr/bin/node) =~ ($DEST) ]]; then
+            sudo rm /usr/bin/node
+        fi
+    fi
+
 }
 
 # configure_horizon() - Set config files, create data dirs, etc
@@ -159,6 +190,14 @@
         exit_distro_not_supported "apache installation"
     fi
 
+    if [[ is_fedora && $DISTRO =~ (rhel6) ]]; then
+        # RHEL6 currently has no native way to get nodejs, so we do a
+        # basic install here (see cleanup_horizon too).
+        # TODO: does nova have a better way that we can limit
+        # requirement of site-wide nodejs install?
+        install_nodejs
+    fi
+
     # NOTE(sdague) quantal changed the name of the node binary
     if is_ubuntu; then
         if [[ ! -e "/usr/bin/node" ]]; then
diff --git a/lib/nova b/lib/nova
index ea73bad..f28094e 100644
--- a/lib/nova
+++ b/lib/nova
@@ -296,10 +296,32 @@
 
 
 
-        if is_fedora; then
-            # Starting with fedora 18 enable stack-user to virsh -c qemu:///system
-            # by creating a policy-kit rule for stack-user
-            if [[ "$os_RELEASE" -ge "18" ]]; then
+        if is_fedora || is_suse; then
+            if is_fedora && [[ "$os_RELEASE" -le "17" ]]; then
+                sudo bash -c 'cat <<EOF >/etc/polkit-1/localauthority/50-local.d/50-libvirt-remote-access.pkla
+[libvirt Management Access]
+Identity=unix-group:libvirtd
+Action=org.libvirt.unix.manage
+ResultAny=yes
+ResultInactive=yes
+ResultActive=yes
+EOF'
+            elif is_suse && [[ $os_RELEASE = 12.2 || "$os_VENDOR" = "SUSE LINUX" ]]; then
+                # openSUSE < 12.3 or SLE
+                # Work around the fact that polkit-default-privs overrules pklas
+                # with 'unix-group:$group'.
+                sudo bash -c "cat <<EOF >/etc/polkit-1/localauthority/50-local.d/50-libvirt-remote-access.pkla
+[libvirt Management Access]
+Identity=unix-user:$USER
+Action=org.libvirt.unix.manage
+ResultAny=yes
+ResultInactive=yes
+ResultActive=yes
+EOF"
+            else
+                # Starting with fedora 18 and opensuse-12.3 enable stack-user to
+                # virsh -c qemu:///system by creating a policy-kit rule for
+                # stack-user using the new Javascript syntax
                 rules_dir=/etc/polkit-1/rules.d
                 sudo mkdir -p $rules_dir
                 sudo bash -c "cat <<EOF > $rules_dir/50-libvirt-$STACK_USER.rules
@@ -311,27 +333,7 @@
 });
 EOF"
                 unset rules_dir
-            else
-                sudo bash -c 'cat <<EOF >/etc/polkit-1/localauthority/50-local.d/50-libvirt-remote-access.pkla
-[libvirt Management Access]
-Identity=unix-group:libvirtd
-Action=org.libvirt.unix.manage
-ResultAny=yes
-ResultInactive=yes
-ResultActive=yes
-EOF'
             fi
-        elif is_suse; then
-            # Work around the fact that polkit-default-privs overrules pklas
-            # with 'unix-group:$group'.
-            sudo bash -c "cat <<EOF >/etc/polkit-1/localauthority/50-local.d/50-libvirt-remote-access.pkla
-[libvirt Management Access]
-Identity=unix-user:$USER
-Action=org.libvirt.unix.manage
-ResultAny=yes
-ResultInactive=yes
-ResultActive=yes
-EOF"
         fi
 
         # The user that nova runs as needs to be member of **libvirtd** group otherwise
diff --git a/lib/rpc_backend b/lib/rpc_backend
index 7d165a4..3c485e4 100644
--- a/lib/rpc_backend
+++ b/lib/rpc_backend
@@ -21,9 +21,22 @@
 # Functions
 # ---------
 
+
 # Make sure we only have one rpc backend enabled.
 # Also check the specified rpc backend is available on your platform.
 function check_rpc_backend() {
+    local rpc_needed=1
+    # We rely on the fact that filenames in lib/* match the service names
+    # that can be passed as arguments to is_service_enabled.
+    # We check for a call to iniset_rpc_backend in these files, meaning
+    # the service needs a backend.
+    rpc_candidates=$(grep -rl iniset_rpc_backend . | awk -F/ '{print $NF}')
+    for c in ${rpc_candidates}; do
+        if is_service_enabled $c; then
+            rpc_needed=0
+            break
+        fi
+    done
     local rpc_backend_cnt=0
     for svc in qpid zeromq rabbit; do
         is_service_enabled $svc &&
@@ -33,7 +46,7 @@
         echo "ERROR: only one rpc backend may be enabled,"
         echo "       set only one of 'rabbit', 'qpid', 'zeromq'"
         echo "       via ENABLED_SERVICES."
-    elif [ "$rpc_backend_cnt" == 0 ]; then
+    elif [ "$rpc_backend_cnt" == 0 ] && [ "$rpc_needed" == 0 ]; then
         echo "ERROR: at least one rpc backend must be enabled,"
         echo "       set one of 'rabbit', 'qpid', 'zeromq'"
         echo "       via ENABLED_SERVICES."
@@ -57,7 +70,11 @@
         fi
     elif is_service_enabled qpid; then
         if is_fedora; then
-            uninstall_package qpid-cpp-server-daemon
+            if [[ $DISTRO =~ (rhel6) ]]; then
+                uninstall_package qpid-cpp-server
+            else
+                uninstall_package qpid-cpp-server-daemon
+            fi
         elif is_ubuntu; then
             uninstall_package qpidd
         else
@@ -87,7 +104,16 @@
         rm -f "$tfile"
     elif is_service_enabled qpid; then
         if is_fedora; then
-            install_package qpid-cpp-server-daemon
+            if [[ $DISTRO =~ (rhel6) ]]; then
+                install_package qpid-cpp-server
+
+               # RHEL6 leaves "auth=yes" in /etc/qpidd.conf, it needs to
+               # be no or you get GSS authentication errors as it
+               # attempts to default to this.
+                sudo sed -i.bak 's/^auth=yes$/auth=no/' /etc/qpidd.conf
+            else
+                install_package qpid-cpp-server-daemon
+            fi
         elif is_ubuntu; then
             install_package qpidd
             sudo sed -i '/PLAIN/!s/mech_list: /mech_list: PLAIN /' /etc/sasl2/qpidd.conf
diff --git a/stack.sh b/stack.sh
index 1ac5c8b..d534b87 100755
--- a/stack.sh
+++ b/stack.sh
@@ -525,7 +525,6 @@
 # an error.  It is also useful for following along as the install occurs.
 set -o xtrace
 
-
 # Install Packages
 # ================
 
@@ -538,12 +537,6 @@
 
 install_rpc_backend
 
-# a place for distro-specific post-prereq workarounds
-if [[ -f $TOP_DIR/tools/${DISTRO}/post-prereq.sh ]]; then
-    echo_summary "Running ${DISTRO} extra prereq tasks"
-    source $TOP_DIR/tools/${DISTRO}/post-prereq.sh
-fi
-
 if is_service_enabled $DATABASE_BACKENDS; then
     install_database
 fi
@@ -552,6 +545,42 @@
     install_quantum_agent_packages
 fi
 
+#
+# System-specific preconfigure
+# ============================
+
+if [[ is_fedora && $DISTRO =~ (rhel6) ]]; then
+    # An old version (2.0.1) of python-crypto is probably installed on
+    # a fresh system, via the dependency chain
+    # cas->python-paramiko->python-crypto (related to anaconda).
+    # Unfortunately, "pip uninstall pycrypto" will remove the
+    # .egg-info file for this rpm-installed version, but leave most of
+    # the actual library files behind in /usr/lib64/python2.6/Crypto.
+    # When later "pip install pycrypto" happens, the built library
+    # will be installed over these existing files; the result is a
+    # useless mess of old, rpm-packaged files and pip-installed files.
+    # Unsurprisingly, the end result is it doesn't work.  Thus we have
+    # to get rid of it now so that any packages that pip-install
+    # pycrypto get a "clean slate".
+    # (note, we have to be careful about other RPM packages specified
+    # pulling in python-crypto as well.  That's why RHEL6 doesn't
+    # install python-paramiko packages for example...)
+    uninstall_package python-crypto
+
+    # A similar thing happens for python-lxml (a dependency of
+    # ipa-client, an auditing thing we don't care about).  We have the
+    # build-dependencies the lxml pip-install will need (gcc,
+    # libxml2-dev & libxslt-dev) in the "general" rpm lists
+    uninstall_package python-lxml
+
+    # If the dbus rpm was installed by the devstack rpm dependencies
+    # then you may hit a bug where the uuid isn't generated because
+    # the service was never started (PR#598200), causing issues for
+    # Nova stopping later on complaining that
+    # '/var/lib/dbus/machine-id' doesn't exist.
+    sudo service messagebus restart
+fi
+
 TRACK_DEPENDS=${TRACK_DEPENDS:-False}
 
 # Install python packages into a virtualenv so that we can track them
@@ -565,7 +594,6 @@
     $DEST/.venv/bin/pip freeze > $DEST/requires-pre-pip
 fi
 
-
 # Check Out and Install Source
 # ----------------------------
 
@@ -595,8 +623,10 @@
     install_swift
     configure_swift
 
+    # swift3 middleware to provide S3 emulation to Swift
     if is_service_enabled swift3; then
-        # swift3 middleware to provide S3 emulation to Swift
+        # replace the nova-objectstore port by the swift port
+        S3_SERVICE_PORT=8080
         git_clone $SWIFT3_REPO $SWIFT3_DIR $SWIFT3_BRANCH
         setup_develop $SWIFT3_DIR
     fi
@@ -649,6 +679,7 @@
 if is_service_enabled heat; then
     install_heat
     install_heatclient
+    cleanup_heat
     configure_heat
     configure_heatclient
 fi
@@ -954,6 +985,18 @@
         iniset $NOVA_CONF DEFAULT powervm_img_remote_path $POWERVM_IMG_REMOTE_PATH
         iniset $NOVA_CONF DEFAULT powervm_img_local_path $POWERVM_IMG_LOCAL_PATH
 
+    # vSphere API
+    # -------
+
+    elif [ "$VIRT_DRIVER" = 'vsphere' ]; then
+        echo_summary "Using VMware vCenter driver"
+        iniset $NOVA_CONF DEFAULT compute_driver "vmwareapi.VMwareVCDriver"
+        VMWAREAPI_USER=${VMWAREAPI_USER:-"root"}
+        iniset $NOVA_CONF DEFAULT vmwareapi_host_ip "$VMWAREAPI_IP"
+        iniset $NOVA_CONF DEFAULT vmwareapi_host_username "$VMWAREAPI_USER"
+        iniset $NOVA_CONF DEFAULT vmwareapi_host_password "$VMWAREAPI_PASSWORD"
+        iniset $NOVA_CONF DEFAULT vmwareapi_cluster_name "$VMWAREAPI_CLUSTER"
+
     # Default
     # -------
 
diff --git a/stackrc b/stackrc
index c55e8dc..f99eab1 100644
--- a/stackrc
+++ b/stackrc
@@ -199,6 +199,8 @@
                 IMAGE_URLS=${IMAGE_URLS:-"http://download.cirros-cloud.net/0.3.1/cirros-0.3.1-x86_64-uec.tar.gz"};;
         esac
         ;;
+    vsphere)
+        IMAGE_URLS="";;
     *) # otherwise, use the uec style image (with kernel, ramdisk, disk)
         DEFAULT_IMAGE_NAME=${DEFAULT_IMAGE_NAME:-cirros-0.3.1-x86_64-uec}
         IMAGE_URLS=${IMAGE_URLS:-"http://download.cirros-cloud.net/0.3.1/cirros-0.3.1-x86_64-uec.tar.gz"};;
diff --git a/tools/install_prereqs.sh b/tools/install_prereqs.sh
index 7c4386f..68f11ce 100755
--- a/tools/install_prereqs.sh
+++ b/tools/install_prereqs.sh
@@ -42,7 +42,8 @@
 LAST_RUN=$(head -1 $PREREQ_RERUN_MARKER 2>/dev/null || echo "0")
 DELTA=$(($NOW - $LAST_RUN))
 if [[ $DELTA -lt $PREREQ_RERUN_SECONDS && -z "$FORCE_PREREQ" ]]; then
-    echo "Re-run time has not expired ($(($PREREQ_RERUN_SECONDS - $DELTA)) seconds remaining); exiting..."
+    echo "Re-run time has not expired ($(($PREREQ_RERUN_SECONDS - $DELTA)) seconds remaining) "
+    echo "and FORCE_PREREQ not set; exiting..."
     return 0
 fi
 
diff --git a/tools/xen/README.md b/tools/xen/README.md
index 1cd45cf..3fadc78 100644
--- a/tools/xen/README.md
+++ b/tools/xen/README.md
@@ -57,8 +57,12 @@
     MULTI_HOST=1
     # Give extra time for boot
     ACTIVE_TIMEOUT=45
-    # Interface on which you would like to access services
-    HOST_IP_IFACE=ethX
+    # Host Interface, i.e. the interface on the nova vm you want to expose the
+    # services on. Usually eth2 (management network) or eth3 (public network) and
+    # not eth0 (private network with XenServer host) or eth1 (VM traffic network)
+    # This is also used as the interface for the Ubuntu install
+    # The default is eth3.
+    # HOST_IP_IFACE=eth3
     # First time Ubuntu network install params
     NETINSTALLIP="dhcp"
     NAMESERVERS=""