The token flush and token rotate crontabs are re-written when the
leader unit changes inline with Juju leadership management.

Align contexts used to generate crontabs with Juju leadership
status, rather than corosync/pacemaker.

Correct use of OpenStackCompareReleases to ensure that releases
between ocata and queens don't automatically enable fernet
token behaviour.

Change-Id: I6db8d006ceac7b61e69f547682c5a49d876cfec6
Closes-Bug: 1816807

Masakari for instance HA needs to be added to the keystone service
catalog for functionality of the upcoming masakari charms

Change-Id: Ic48767df7dc0408679c7dd9a6d7547b744778894

This patch add a new key/value parameter to
the middleware relation to notify subordinate middleware
charm with actual keystone release version

Change-Id: Ie53355946e895cefe813c9e539fc904949f9df0c
Closes-Bug: #1808597

Using the new version of the sync tool which removes the charmhelpers
directory before syncing, run charm helpers sync to find any unexpected
missing dependencies.

Change-Id: I3ba0142a09966c3cf61bec547668db6d357a916e

The pre-install operations may fail, yet that failure is not
elevated to the user. This masks the failure and makes early
package install issues difficult to troubleshoot.

If the basic pre-install script fails, the charm should not
proceed to later hooks as the requirements may not be met.

Hashbangs for bash should specify -e (errexit) on all of the
pre-install bash scripts.

Change-Id: Ib97cbea15c746ac93a6cf6056da2e8d6eb28af3c
Closes-bug: #1815243
Partial-bug: #1815231

Remove trusty-icehouse test combo from gate, leaving trusty-mitaka
if/where it exists.

Change-Id: If68e9c5a6ddbc12176f22e9d777e5c8c76faf7c5

All other occurances of "backend/back-end/back end" are of the form
"backend"; this is the only instance of "back end".  While the meaning
is clear regardless of this change, suggesting this change for
consistency.

Change-Id: I133413d66e9373f851cbc6c33ee65341be909594

Change-Id: I88636002d5038c6a5b4f87635a15393f8f1d8910

Change-Id: If0f46ae1777404de87d333cec084535c53804d92

Change-Id: If60057b137f1eea7059dff87c089e6ebd098ea9c

Change-Id: I0af42ea9642f3bd9181d729d73219753621e29be
Closes-Bug: #1810910

This patch creates a new middleware context to retrieve data
from subordinate charm and update the kesytone configuration file.
It also allows integration with keystone-middleware interface:
https://github.com/openstack-charmers/interface-keystone-middleware
This patch uses the subordinate configuration approach
to retrieve data from the subordinate charm.

Every changes required for paste.ini file will be handled by
the subordinate charm. The latter should deal with keystone upgrades.

Closes-Bug: #1808597

Change-Id: I4897011fbc791abc97e34e75826579820e80a4f1

Change-Id: Id77f0e887afb781ca8602eb41888e607f25bb6e8

Use the generate_ha_relation_data helper from charmhelpers to
generate the data to send down the relation to the hacluster
charm.

This results in a few changes in behaviour:

1) The charm will no longer specify a nic name to bind the vip. This
   is because Pacemaker VIP resources are able to automatically
   detect and configure correct iface and netmask parameters based
   on local configuration of the unit.
2) The original iface named VIP resource will be stopped and deleted
   prior to the creation of the new short hash named VIP resource.

Change-Id: I906e96ad8cbcf2ca2d1cdbfd091070c21427214c

Change-Id: I6a9f00fbffa681b5da654c0f349d569f4c3da03c
Signed-off-by: Sahid Orentino Ferdjaoui <sahid.ferdjaoui@canonical.com>

In icehouse database/idle_timeout has been deprecated in favor to
database/connection_recycle_time. This commit reflects the change in
our templates.

Change-Id: I6814a9d61d24c713e7a5182bf9683a393cda06bb
Closes-Bug: 1805592
Signed-off-by: Sahid Orentino Ferdjaoui <sahid.ferdjaoui@canonical.com>

Due to a change to PY3, the charmhelpers directory is not in the
CHARMDIR rather than in CHARMDIR/hooks.  This broke the
copy_nrpe_checks() function in c-h.  c-h has been updated, to look in
both CHARMDIR and CHARMDIR/hooks for the charmhelpers directory, and
this patchset includes the new function definition.

Change-Id: Ifc0baabee4e06b79015e02b95634bce879ae84af
Closes-Bug: #1796830

On charm upgrade the charm may switch to py3 packages. If so, ensure
the old py2 packages are purged after any new packages have been
installed.  If packages where removed during the upgrade, then
restart all services to pickup any py2->py3 switches.

Change-Id: I8a17f679e85448680ab0b1f5ae362ef7a65b035c
Closes-Bug: 1803451

Change-Id: I5f6f7c7f0acb1b7951730c02a55e4971f00d5c9d
Closes-Bug: #1508575

Currently the keystone zaza tests deploy multiple instances of keystone,
however, without hacluster.

The recent LP Bug #1801754 would have been caught if the tests ran a
true HA environment with hacluster.

This change adds hacluster and a VIP for keystone.

Change-Id: I7ebd7cd5c1961329080c9ddd7d7e574f925872ae

It looks like os.execl does not support an empty second argument
under py3. This change fixes the call for py3.

Change-Id: Iffcd2c68b03013384ad3f1d2b5e8805b84b3972a
Closes-Bug: 1802274

Change-Id: Id432e8ba08baaa50976f4d1d8d105a4d38f110ae

Change-Id: Ieb4af8c1d48c009232905506c102f5e0df67c24f

When checking goal state, only look for one unit to be available
when examining container scoped relations as a principle unit only
ever has a relation with a single unit of a given subordinate
application.

Change-Id: I02f34358060c98c0702d3d7b58d52427c2a0445a
Closes-Bug: #1801754

When keystone recieves certificates down the certificates relation
it needs to update the identity endpoint to https.

Change-Id: I9a423096b77a73f78a6cc9e3d250bdea2fb861b6