Change-Id: Ibf8a509de4ce49700aa0207b9401dff43e4cb8fd

Add support for keystone to request and receive certificates from
the ls-certificates relation.

Change-Id: I6222e5eb9c8a0a5f079ecc2e5e5c97abc1c39515

Retry keystone_wait_for_propagation() on exception.

Closes-Bug: #1668954
Change-Id: I5e5689dbd5cd974b11e017b6d0f06575cabcceb2

There was a mid-air collision with charm helpers syncs. The critical
piece is the removal of a second stats socket line from the haproxy
templates which breaks on trusty.

All other amulet tests that include keystone will fail on trusty until
this is landed.

Change-Id: Ide3b7cbda238b9a7b93f0625c21d43335bc10e81

Change bionic test from dev to gate for 18.05.

Change-Id: I1cea7c9773a06eafa84ec6e4303cfc49219823a7

Change-Id: I936d8ea071ca4d72f525094ff2ae7bae52f73ee2

This tightens up the security on the SSL keys stored in
/etc/apache2/ssl/<service> to be no longer world readable.

Change-Id: I0951deff4ec95b1fc7f4389dc083c8957f8db6f0
Closes-Bug: #1761305

The comparison of bytes vs string of the CA certificate produces a
false negative. This leads to rewriting certificates and affecting
connectivity to services.

Read in the certificate as bytes as well for a bytes vs bytes
comparison.

Closes-Bug: #1762431

Change-Id: Ic226149cc124ac5b84ab30d95a590f08489c67f2

Openstack PKI token support was dropped in the Pike release.
The following update ensures that PKI token validation is
only run if the release is supported when the sync leader
broadcasts any service credentials to its peers.

In this case; if the release is <= pike. then we can sync
token certs and ensure the pki permissions are valid.
Otherwise this action will be skipped.

Closes-Bug: 1759403
Change-Id: I3d8ba6d3cac3a3505a3722a5082c3a6933a9ef67

Change-Id: I28e9aa3687e24cacb70a2a54f1306f6be86f4c74

For Queens keystone v2 has been dropped. V3 is the only valid API
version. The charm has already made this change. This change is to
bring the amulet test up to match by creating a separate class.

Charm-helpers sync

Enlarging the amulet timeout value.

Change-Id: I822624bdf45bfb060dd75ba3b10e71984bc10e48

Notable issues resolved:

openstack_upgrade_available() broken for swift
https://bugs.launchpad.net/charm-swift-proxy/+bug/1743847

haproxy context doesn't consider bindings
https://bugs.launchpad.net/charm-helpers/+bug/1735421

regression in haproxy check
https://bugs.launchpad.net/charm-helpers/+bug/1743287

Change-Id: Ia65aadc4b024802826d81953dec1183f3785a0eb

Drop support for deployment from Git repositories, as deprecated
in the 17.02 charm release.  This feature is unmaintained and has
no known users.

Change-Id: Ic054e29ef55d8890a3130af16b48f105efcf8f6a

The default HAProxy timeout values are fairly strict. On a busy cloud
it is common to exceed one or more of these timeouts. The only
indication that HAProxy has exceeded a timeout and dropped the
connection is errors such as "BadStatusLine" or "EOF." These can be
very difficult to diagnose when intermittent.

This charm-helpers sync pulls in the change to update the default
timeout values to more real world settings. These values have been
extensively tested in ServerStack. Configured values will not be
overridden.

Partial Bug: #1736171

Change-Id: I973962a5c1538b0d9afbebea8cebf50d938ecfb5

Change-Id: Ic6469d4af7edd755c22d4e31b87d9a36937d3134

Make default func27-smoke xenial-pike
Charm-helpers sync

Change-Id: I289d38e4170d204fbf9b0281b28be28c9e847e65

This change ensures that any password expiry has been removed from
the user that runs unison to synchronize data. The fix is entirely
in charm-helpers so this patch is a simple sync.

Change-Id: I75d6ac0e9be19a87efe16a1095b1afd44f41dc17
Closes-Bug: #1686085

Install and configure memcached on the keystone units and configure
keystone to use the cache. This should speed up token access for
existing tokens.

Change-Id: I26af0a97660e5bbe293a32e6b9e3d209338f905a
Closes-Bug: #1722541

Install OpenStack using snaps. By setting openstack-origin to
snap:track/channel or snap:track the charm will use snaps to
install rather than debs. If channel is left off it defaults to
stable. For example: snap:ocata/edge will install the edge version of
Ocata and snap:pike will install the stable version of Pike.

Charm helpers sync for snap related helpers.

Change-Id: I6e3540e4ffe081540404f91061e5c9b7039b3eac

Change-Id: I60eabd566d204c784229ae109a2566dbc501d6a2

Change-Id: I9bd7bf8f07690e89e1f6f9acaafa7ed1a1458526

Enable dual stack IPv4 and IPv6 VIPs on the same interface.
HAProxy always listens on both IPv4 and IPv6 allowing connectivity
on either protocol.

Update edge cases for is_ssl_cert_master for Bug #1709356.

Update amulet tests for keystoneauth1 tests.

charm-helpers sync for HAProxy template changes.

Closes-Bug: #1709356

Change-Id: I401071fcdd66252f389475d45e8136fc68c474f1

Resync charmhelpers for pike version support.

Add pike tests but leave disabled until all charms support pike.

Add support for volumev3 service type for Cinder.

Skip execution of PKI setup for >= pike as its been dropped from
keystone.

Change-Id: I9a4e452cc7b1b90126d1885c37f5a64b8241479d

Resync charm-helpers to pickup the latest code for calculation
of worker process configuration, creating better default
worker configuration when deploying in LXD containers.

Switch the skew between public and admin processes to favour
public 0.75/0.25 as the public API endpoints of a service will
typically get a larger number of hits.

Fixup unit test for minor behavioural change in charm-helpers.

Change-Id: I4ab1d28f907ce29d5602b48ba7a438fc3690277c
Closes-Bug: 1665270
Closes-Bug: 1686049

- Add Zesty as a supported series to metadata.yaml.
- Turn on Xenial-Ocata Amulet test definitions.
- Sync charm helpers to get Juju 2.x amulet compatibility.
- Keeping Zesty-Ocata Amulet test definitions turned off until the
  metadata.yaml changes propagate to the charm store.

Change-Id: If89406dabee66cfcf395bbb214457bdd1e576aad

Check if VIP or dns-ha is set to determine if the unit expects to be
in HA. This is less racey that just checking for the ha relation.
Wait until clustered to run the client relation hooks.

This fixes bugs where client charms receive the private-address
rather than the VIP on initial client relations.

Charmhelper sync.

Change-Id: I48b15113360ef892e38235ec4518173ec78ad143
Partial-bug: #1661392

The WSGI template and context code has been moved to charm-helpers.
This change updates the charm to use the common code from charm-helpers.

Change-Id: I6a3efdb0811c8d50c657f6f8b923b076e3de6716

Change-Id: I02341e896a925d4337aff5ccfcdfc26397ee98a0

- Sync charm helpers if applicable.

- Fix test executable hashbags for virtualenv prep.

- Add Yakkety-Newton Amulet test definitions.

- Prep Xenial-Ocata Amulet test definitions (not yet enabled).

- Prep Zesty-Ocata Amulet test definitions (not yet enabled).

- Add Zesty charm series metadata.

- Remove Precise charm series metadata if present.

- Remove Precise Amulet test definitions if present.

Change-Id: Ia81b03da3f2d4c5a36a147c152123b490843c0f6

- Remove Precise-Icehouse Amulet test definitions if they exist.

- Add Xenial-Newton Amulet test definitions.

- Add Yakkety-Newton Amulet test definitions.

- Use the percona-cluster charm in tests instead of the mysql charm.

Change-Id: Ia4c324b6fedec1dc607062a89eea7595d43c0060

Get each charm up to date with lp:charm-helpers for release testing.

Change-Id: I1ac07a964adadc53e1ae1359ffb3d59171fb72d0

Juju 2.0 provides support for display of the version of
an application deployed by a charm in juju status.

Insert the os_application_version_set function into the
existing assess_status function - this gets called after
all hook executions, and periodically after that, so any
changes in package versions due to normal system updates
will also be reflected in the status output.

This review also includes a resync of charm-helpers to
pickup hookenv and contrib.openstack support for this
feature.

Change-Id: I5734e87d39e62c1fb791b0b79ff216e30a784d1f

Sync charmhelpers to pick up bug fixes for 1607 release

Change-Id: I1a795c3bfbbd88f5214d5145492ad7889899c830

When using charmhelpers.contrib.network.ip apt install was quietly
failing. Install python dependencies in the early install hook
(before install.real).

Charm-helpers sync to bring in apt_install with fatal=True

Change-Id: I04f1456e4ae940bf04176ccb9421c9ee150fc781
Partial-Bug: 1601972

To begin release testing get each charm up to date with lp:charm-helpers

Change-Id: I4d870a68a8ed1967aac1603ac61c98ea010e3227

The keystone charm runs the keystone API under apache2 for liberty
and above. This patch enables the keystone API to run under apache2
when deployed from source for liberty and above.

Change-Id: I5eccf38aad9668248f4f94523d61f7bd40ed5c30

Change the worker-multiplier to a floating point config option type
instead of integer. This allows users to specify workers to be less
than the number of CPUs, which is useful in deployments with multiple
services deployed into containers on top of bare metal.

The fix is to simply change the config option type and to sync in
the necessary update from lp:charm-helpers.

Partial-Bug: #1602444

Change-Id: I534165aa2fc45a28f6b3f3bb2f708789daf5ba8c
Signed-off-by: Billy Olsen <billy.olsen@gmail.com>

The charm-helpers project have re-licensed to Apache 2.0
inline with the agreed licensing approach to intefaces,
layers and charms generally.

Resync helpers to bring charmhelpers inline with charm
codebase.

Change-Id: Icedfb79814e186290a3120d953c9077e4e4504fe

Change-Id: I0d9b4ef5a57643bf98bba74f81b602f1f97a6ef1

Implement DNS high availability. Pass the correct information to
hacluster to register a DNS entry with MAAS 2.0 or greater rather
than using a virtual IP.

Charm-helpers sync to bring in DNS HA helpers

Change-Id: I62bb49fbaebdd3c787f96f4b6ad107f8e3e368a7