Major changes:

 * decoupling the hooks/manager.py file from the charm.  It is now a
   script that is called from hooks/keystone_utils.py as it has to use
   the same Python version/libraries as the installed keystone payload
   software.  keystone_utils.py and manager.py communicate via a Unix
   Domain Socket using json, encoded to base64.
 * As Python3 requires absolute imports, the charmhelpers symlink has
   been removed from hooks, and the hooks and charmhelpers symlinks have
   been removed from the actions directory.  Instead, the path is
   adjusted so that the modules can be found.

Change-Id: I18996e15d2d08b1dacf0533132eae880cbb9aa32

Add a tactical change which is already merged into charm-helpers.

This needs to go into all charms to solve the chicken:egg issue
where cosmic is untestable until this change exists.

Reference:

https://github.com/juju/charm-helpers/commit/4835c6c167c429527ef0a0291d17cf559c9cf880

Change-Id: If4c1f27b7e5da8dbd8352aed629e9b483f67d8c1

Implement the series-upgrade feature allowing to move between Ubuntu
series.

Change-Id: I77aebf205cb88ae4da4cdbb33b9336b21c31ee32

This is a mechanically generated patch to complete step 1 of moving
the zuul job settings out of project-config and into each project
repository.

Because there will be a separate patch on each branch, the branch
specifiers for branch-specific jobs have been removed.

Because this patch is generated by a script, there may be some
cosmetic changes to the layout of the YAML file(s) as the contents are
normalized.

See the python3-first goal document for details:
https://governance.openstack.org/tc/goals/stein/python3-first.html

Change-Id: I713550369a1db2de13a582ff3a547fc234eb1c47
Story: #2002586
Task: #24317

Change-Id: Ibc631327bf636b66c6a66c8bd21dcffb37c342a9

This adds some details to the README for the new Fernet support and
how to configure it.

Change-Id: Ib90179583dc024c5a74fd2812240f8cf6955c1d9

Change-Id: I4429687492dbac75dcbf9310d2144f8f6dcf9c79

The test/code was using localtime; this changes it to UTC so that DST
changes don't affect rotations.

Change-Id: I1c8247c08103833a842c422e19b5cd121515c054

Give machine deployed for database unit more RAM.

Make sure machine used for database unit is deployed first.

Change-Id: I3a2f09396629fda52f9b72284d90756da9cc2536

Change-Id: Id55bf63cb34b6ccad876ddd47734b959c63ed742

Closes-Bug: #1787719
Change-Id: I0557803e90d8ec52271f01e5e7276d2db8338ce2

This patchset adds more Fernet token implementation:

1. Adds a cron job to rotate / sync keys to other units.
2. Adds additional tests around gating on config.
3. Adds rotation / syncing with more robust key handling.

Change-Id: Ied021ad83c241f241dbb5f9acdede9045e43a8a3

Remove configuration options which no longer have effect
(the supporting code has been removed).

Update and fix formatting of `README.md`.

Remove templates for no longer supported OpenStack releases.

Change-Id: Ibbda87738d98f6ad97da212ad1b56be88b33e9a3

The configuration options for plugin entry points is
superflous and leads to Internal Server errors on Rocky.

Remove them from configuration and have Keystone use its
defaults.

Change-Id: I460aec084478f2ead8c16a11c0731bc110197368
Closes-Bug: #1784295

There are no relation-level concerns for these values.

Any pre-existing deployments with recent charms (as in released
2015 or later) will have already migrated the peer storage to
leader storage, so this change can build on that work directly.

Ref: https://github.com/juju/charm-helpers/blame/master/charmhelpers/contrib/peerstorage/__init__.py

Change-Id: I85d1746bdf3e9d3e1ff514e6dd2b4c565dee4dfc
Closes-Bug: #1783943

There are no relation-level concerns for this flag.

Any pre-existing deployments with recent charms (as in released
2015 or later) will have already migrated the peer storage to
leader storage, so this change can build on that work directly.

Ref: https://github.com/juju/charm-helpers/blame/master/charmhelpers/contrib/peerstorage/__init__.py

Change-Id: Ia7362d257428b102c452d0e91bcf9b3378a1e6e9
Closes-bug: #1783747

The `keystone-common` package no longer exist and using it for
OpenStack release comparison will not produce expected results.

Change-Id: I263c408679759971265d721cdd66ae9ea7d481d8

Starting OpenStack Rocky the currently used `uuid` token format
is no longer supported and we need to change to use `fernet` tokens.

This change provides basic functionalty to initialize fernet token
repository and distribute keys to non-leader units.

A configuration option is also added allowing change of token format
in a controlled manner prior to upgrading to OpenStack Rocky.

Further work is required to implement key rotation, actions etc. and
these topics will be addressed in separate commits.

The commit also fixes a instance of missing release check for writing
of `policy.json`, and a few places where writing of `policy.json`
previously was omitted.

Change-Id: I1d0ff22a5f091b02f5700412745572c246103e9e

Purge references to upstream removed sections and token
features.

policy.json now at level with:
openstack/keystone@0022adb6ae44a8d0a471d22dcd1bf2b95ee88490

Change-Id: I0e1163d1c16c7987409dff23ce6cdcc35df302ab

The functionality was removed from charm in commit
17b24e7f

Template references was left behind and this commit addresses
that.

Change-Id: I55362faec21f32cccdcb82f810680b70fe2fb53b

Run on database initialization and after config changed.

Change-Id: Id4f1bb7f7931b214b37d097988c013b053a85d22

Commit 855c954c revealed a bug
that occurrs some times when having multpile Keystone units.

Change-Id: I7bfce6db6b0dba855af32aef4c3f496f03a5a34b
Related-Bug: #1637453

Change-Id: Id4c8e57ce407870c6c358d60952878de98ff5fec

Ensure that EOL releases are removed from metadata
and tests, and that the current dev release is enabled
in metadata.  Dev release tests are enabled separately
because of chickens and eggs.

Change-Id: I7fc1db909aa2059f039a09b694c1058322883f4a

On every call to update_all_identity_relation_units()
apache was reconfigured and all configuration files written.

This was used for the legacy management of self signed
certificates which now has been removed.

Change-Id: I7480575bc06287f6898ce469b420fd63206015e2

Change-Id: I46c7f5d459ae4d3e66777639c4a7f92b94e73f9b

Ensure that oslo.middleware parses any proxy information
forwarded from haproxy/apache with regards to protocol;
this ensures that https connections are correctly detected.

Includes charm helper sync to bring in oslo middleware
template.

Change-Id: I2ce75a4a2033d8d3c07bd9f7ce6e4f5f6d9488cf
Closes-Bug: 1758675

Python 3.6 is installed by default in Ubuntu 18.04 LTS.
Therefore, according to Transition Plan [1],
it'll be handy to have py36 testenv.

For more details, please check Python2 Deprecation Timeline [2]
and Python3-first Goal - Completion Criteria [3].

[1] https://wiki.ubuntu.com/Python/Python36Transition
[2] https://governance.openstack.org/tc/resolutions/20180529-python2-deprecation-timeline.html
[3] https://review.openstack.org/#/c/575933/8/goals/stein/python3-first.rst@42

Change-Id: I41eb6ecb09b3862fc5d5d5530623d594085acf0a

Change-Id: Ibf8a509de4ce49700aa0207b9401dff43e4cb8fd