Merge lp:~springfield-team/charms/precise/nova-cloud-controller/trunk into lp:~openstack-charmers-archive/charms/precise/nova-cloud-controller/trunk

[Shiv Prasad Rao]

This merge proposal is prepared to enable N1KV plugin to install with charm logic for nova-cloud-controller.
Similar to ovs and nvp, n1kv (Nexus 1000V) is another layer 2 virtual switch provided by Cisco Nexus 1000V engineering team, which is a host side VM switching fabric building block we call it VEM (Virtual Ethernet Switch). 1+ VEM work in tandem with a VSM (Virtual Switch Module) to form a virtual chassis in a data center.
Please also refer to the VEM/VSM charm and Cisco Nexus1000V related document for its detail.

config.yaml
- added n1kv as a possible value for quantum-plugin
- added n1kv-vsm-username, n1kv-vsm-password, n1kv-vsm-ip to communicate with its supervisor module with (VSM)

hooks/charmhelpers/contrib/openstack/context.py
- Added n1kv related dictionary for context look-up

hooks/charmhelpers/contrib/openstack/neutron.py
- Added n1kv related plugin logic data formation

hooks/nova_cc_hooks.py
- Added copy logic to copy Cisco n1kv template to /root

templates/havana/cisco_plugins.ini
- New file for Cisco Plugin related parameters

templates/havana/neutron.conf
- Added customized system parameters for N1KV plugin to run with

templates/havana/cisco_plugin.ini
- Adding support for PostgreSQL for cisco_plugin.ini

[Marco Ceppi (marcoceppi)]

Leaving for openstack-charmers, thanks!

review: Abstain

[ChingWei Chang (cwchang)]

We have merged with latest Icehouse content which went to charm store first

[Csaba TOTH (tsabi)]

On line 320 the mysql is hardcoded. As this charm should support PostgreSQL too i think this is wrongly coded.

review: Needs Fixing

[Shiv Prasad Rao (shivrao)]

Made change to add support for postgresql

Thanks for the review.

[James Page (james-page)]

OK _ so I'd like to review the entire springfield charm set from an overall implementation perspective as well but with regards this merge proposal specifically:

1) /root/openrc and associated config.yaml changes

I really don't like this; the nova-cloud-controller gets related to keystone, which give it a username and password so providing it with one external seems just plain wrong;

I *think* this is used by the vxlan-gateway charm to upload its image to glance - but I think we need to review this approach to getting images into glance; this may be better addressed using a helper installed by package (maybe in the vxgw package from the springfield PPA) that gets run from outside the charms, rather than trying todo this from within the charms themselves.

2) Scope of impact on nova-cloud-controller

I think that the change we really need here is the configuration files and support for the nv1k plugin, as for NVP/NSX.

3) charmhelpers first

the changes in hooks/charmhelpers/contrib/ need to be proposed against lp:charm-helpers before landing changes into nova-cloud-controller charm.

review: Needs Fixing

[lp:~springfield-team/charms/precise/nova-cloud-controller/trunk]

79. By Shiv Prasad Rao on 2014-06-02

Adding configurable option for n1kv_restrict_policy_profiles

80. By Shiv Prasad Rao on 2014-06-25

n1kv-config-flags parameter added to add key=value configs to cisco_plugins.ini

81. By Shiv Prasad Rao on 2014-06-30

Changes for supporting secuirty groups with N1KV

82. By Shiv Prasad Rao on 2014-07-03

creating seperate n1kv_user_config_flags context variable for n1kv

83. By Shiv Prasad Rao on 2014-07-19

security group api change for n1kv

84. By Shiv Prasad Rao on 2014-07-23

Security Groups support for N1kv

85. By Dulanjalie Ganegedara on 2014-08-01

adding charmhelper support to use --keyserver option for public PPA

[Shiv Prasad Rao (shivrao)]

Please ignore this merge request. I have submitted a new one here:
https://code.launchpad.net/~springfield-team/charms/trusty/nova-cloud-controller/next/+merge/235182

I can delete this if this causes confusion. (I have kept it for context)

Unmerged revisions

85. By Dulanjalie Ganegedara on 2014-08-01

adding charmhelper support to use --keyserver option for public PPA

84. By Shiv Prasad Rao on 2014-07-23

Security Groups support for N1kv

83. By Shiv Prasad Rao on 2014-07-19

security group api change for n1kv

82. By Shiv Prasad Rao on 2014-07-03

creating seperate n1kv_user_config_flags context variable for n1kv

81. By Shiv Prasad Rao on 2014-06-30

Changes for supporting secuirty groups with N1KV

80. By Shiv Prasad Rao on 2014-06-25

n1kv-config-flags parameter added to add key=value configs to cisco_plugins.ini

79. By Shiv Prasad Rao on 2014-06-02

Adding configurable option for n1kv_restrict_policy_profiles

78. By Shiv Prasad Rao on 2014-05-02

Adding support for PostgreSQL for cisco_plugin.ini

77. By Shiv Prasad Rao on 2014-05-02

Cisco N1KV changes

76. By Shiv Prasad Rao on 2014-05-02

[niedbalski] fixup unit tests for key management
[niedbalski] Force use of http for key imports

=== modified file 'config.yaml'
--- config.yaml	2014-07-29 15:05:01 +0000
+++ config.yaml	2014-08-01 21:20:18 +0000
@@ -69,9 +69,14 @@
       Quantum plugin to use for network management; supports
       .
         ovs - OpenvSwitch Plugin
+<<<<<<< TREE
         nvp|nsx - Nicira Network Virtualization Platform/
                   VMware NSX Network Virtualization Platform
                   (renamed for Icehouse)
+=======
+        nvp - Nicira Network Virtualization Platform
+        n1kv - Cisco Nexus1000v Network Virtualization Platform
+>>>>>>> MERGE-SOURCE
       .
       This configuration only has context when used with
       network-manager Quantum|Neutron.
@@ -163,6 +168,7 @@
   nvp-l3-uuid:
     type: string
     description: |
+<<<<<<< TREE
       This is uuid of the default NVP/NSX L3 Gateway Service.
   # end of NVP/NSX configuration
   service-guard:
@@ -184,3 +190,38 @@
         * shared-db or (pgsql-nova-db, pgsql-neutron-db)
         * amqp
         * identity-service
+=======
+      This is uuid of the default NVP L3 Gateway Service.
+  # end of NVP configuration
+  n1kv-vsm-username:
+    type: string
+    default: admin
+    description: Username to connect to Cisco Nexus1000v VSM
+  n1kv-vsm-password:
+    type: string
+    default: abc123
+    description: Password to connect to Cisco Nexus1000v VSM
+  n1kv-vsm-ip:
+    default: 10.10.10.10
+    description: IP address to connect to Cisco Nexus1000v VSM
+  n1kv-restrict-policy-profiles:
+    type: boolean
+    default: false
+    description: |
+      All tenants will be able to access all policy profiles if disblaed. 
+      If enabled, tenants can access only those policy profiles which are 
+      explicitly assigned to them by admin.
+  n1kv-config-flags:
+    default: None
+    type: string
+    description: Comma separated list of key=value config flags to be set in cisco_plugins.ini
+  keystone-usrname:
+      type: string
+      default: admin
+      description: Username to connect to keystone
+  keystone-password:
+      type: string
+      default: openstack
+      description: Password to connect to keystone
+
+>>>>>>> MERGE-SOURCE
 
=== modified file 'hooks/charmhelpers/contrib/openstack/context.py'
--- hooks/charmhelpers/contrib/openstack/context.py	2014-05-19 11:38:09 +0000
+++ hooks/charmhelpers/contrib/openstack/context.py	2014-08-01 21:20:18 +0000
@@ -541,6 +541,29 @@
 
         return nvp_ctxt
 
+    def n1kv_ctxt(self):
+        driver = neutron_plugin_attribute(self.plugin, 'driver',
+                                          self.network_manager)
+        n1kv_config = neutron_plugin_attribute(self.plugin, 'config',
+                                               self.network_manager)
+        n1kv_user_config_flags = config('n1kv-config-flags')
+        n1kv_ctxt = {
+            'core_plugin': driver,
+            'neutron_plugin': 'n1kv',
+            'neutron_security_groups': self.neutron_security_groups,
+            'local_ip': unit_private_ip(),
+            'config': n1kv_config,
+            'vsm_ip': config('n1kv-vsm-ip'),
+            'vsm_username': config('n1kv-vsm-username'),
+            'vsm_password': config('n1kv-vsm-password'),
+            'restrict_policy_profiles': config('n1kv-restrict-policy-profiles'),
+        }
+        if n1kv_user_config_flags:
+            flags = config_flags_parser(n1kv_user_config_flags)
+            n1kv_ctxt['n1kv_user_config_flags'] = flags
+        
+        return n1kv_ctxt
+
     def neutron_ctxt(self):
         if https():
             proto = 'https'
@@ -572,6 +595,8 @@
             ctxt.update(self.ovs_ctxt())
         elif self.plugin in ['nvp', 'nsx']:
             ctxt.update(self.nvp_ctxt())
+        elif self.plugin == 'n1kv':
+            ctxt.update(self.n1kv_ctxt())
 
         alchemy_flags = config('neutron-alchemy-flags')
         if alchemy_flags:
 
=== modified file 'hooks/charmhelpers/contrib/openstack/neutron.py'
--- hooks/charmhelpers/contrib/openstack/neutron.py	2014-05-19 11:38:09 +0000
+++ hooks/charmhelpers/contrib/openstack/neutron.py	2014-08-01 21:20:18 +0000
@@ -73,6 +73,20 @@
             'server_packages': ['quantum-server',
                                 'quantum-plugin-nicira'],
             'server_services': ['quantum-server']
+        },
+        'n1kv': {
+            'config': '/etc/quantum/plugins/cisco/cisco_plugins.ini',
+            'driver': 'quantum.plugins.cisco.network_plugin.PluginV2',
+            'contexts': [
+                context.SharedDBContext(user=config('neutron-database-user'),
+                                        database=config('neutron-database'),
+                                        relation_prefix='neutron',
+                                        ssl_dir=QUANTUM_CONF_DIR)],
+            'services': ['quantum-plugin-cisco'],
+            'packages': [['quantum-plugin-cisco']],
+            'server_packages': ['quantum-server',
+                                'quantum-plugin-cisco'],
+            'server_services': ['quantum-server']
         }
     }
 
@@ -114,6 +128,7 @@
             'server_packages': ['neutron-server',
                                 'neutron-plugin-nicira'],
             'server_services': ['neutron-server']
+<<<<<<< TREE
         },
         'nsx': {
             'config': '/etc/neutron/plugins/vmware/nsx.ini',
@@ -128,6 +143,22 @@
             'server_packages': ['neutron-server',
                                 'neutron-plugin-vmware'],
             'server_services': ['neutron-server']
+=======
+        },
+        'n1kv': {
+            'config': '/etc/neutron/plugins/cisco/cisco_plugins.ini',
+            'driver': 'neutron.plugins.cisco.network_plugin.PluginV2',
+            'contexts': [
+                context.SharedDBContext(user=config('neutron-database-user'),
+                                        database=config('neutron-database'),
+                                        relation_prefix='neutron',
+                                        ssl_dir=QUANTUM_CONF_DIR)],
+            'services': ['neutron-plugin-cisco'],
+            'packages': [['neutron-plugin-cisco']],
+            'server_packages': ['neutron-server',
+                                'neutron-plugin-cisco'],
+            'server_services': ['neutron-server']
+>>>>>>> MERGE-SOURCE
         }
     }
     if release >= 'icehouse':
 
=== modified file 'hooks/charmhelpers/contrib/openstack/utils.py'
--- hooks/charmhelpers/contrib/openstack/utils.py	2014-05-19 11:38:09 +0000
+++ hooks/charmhelpers/contrib/openstack/utils.py	2014-08-01 21:20:18 +0000
@@ -228,8 +228,8 @@
         with open('/etc/apt/sources.list.d/juju_deb.list', 'w') as f:
             f.write(DISTRO_PROPOSED % ubuntu_rel)
     elif rel[:4] == "ppa:":
-        src = rel
-        subprocess.check_call(["add-apt-repository", "-y", src])
+        src = rel.split(' ')
+        subprocess.check_call(["add-apt-repository", "-y" ] + src)
     elif rel[:3] == "deb":
         l = len(rel.split('|'))
         if l == 2:
 
=== modified file 'hooks/nova_cc_context.py'
--- hooks/nova_cc_context.py	2014-06-17 10:01:21 +0000
+++ hooks/nova_cc_context.py	2014-08-01 21:20:18 +0000
@@ -193,6 +193,12 @@
         ctxt['region'] = config('region')
         return ctxt
 
+class OpenrcContext(context.IdentityServiceContext):
+    def __call__(self):
+        ctxt = {}
+        ctxt['os_username'] = config('keystone-usrname')
+        ctxt['os_password'] = config('keystone-password')
+        return ctxt
 
 class NovaPostgresqlDBContext(context.PostgresqlDBContext):
     interfaces = ['pgsql-nova-db']
 
=== modified file 'hooks/nova_cc_hooks.py'
--- hooks/nova_cc_hooks.py	2014-07-29 15:05:01 +0000
+++ hooks/nova_cc_hooks.py	2014-08-01 21:20:18 +0000
@@ -4,6 +4,7 @@
 import shutil
 import sys
 import uuid
+import subprocess
 
 from subprocess import check_call
 from urlparse import urlparse
@@ -84,6 +85,11 @@
 @hooks.hook()
 def install():
     execd_preinstall()
+    plugin = config('quantum-plugin')
+    if (plugin == 'n1kv'):
+        command = "cp templates/havana/openrc /root/"
+        process = subprocess.Popen(command.split(), stdout=subprocess.PIPE)
+        process.communicate()[0]
     configure_installation_source(config('openstack-origin'))
     apt_update()
     apt_install(determine_packages(), fatal=True)
@@ -108,7 +114,8 @@
     save_script_rc()
     configure_https()
     CONFIGS.write_all()
-
+    [compute_joined(rid=rid, remote_restart=True)
+         for rid in relation_ids('cloud-compute')]
 
 @hooks.hook('amqp-relation-joined')
 def amqp_joined(relation_id=None):
 
=== modified file 'hooks/nova_cc_utils.py'
--- hooks/nova_cc_utils.py	2014-07-29 15:05:01 +0000
+++ hooks/nova_cc_utils.py	2014-08-01 21:20:18 +0000
@@ -90,6 +90,7 @@
 HAPROXY_CONF = '/etc/haproxy/haproxy.cfg'
 APACHE_CONF = '/etc/apache2/sites-available/openstack_https_frontend'
 APACHE_24_CONF = '/etc/apache2/sites-available/openstack_https_frontend.conf'
+OPENRC = '/root/openrc'
 NEUTRON_DEFAULT = '/etc/default/neutron-server'
 QUANTUM_DEFAULT = '/etc/default/quantum-server'
 
@@ -169,6 +170,10 @@
         'contexts': [nova_cc_context.ApacheSSLContext()],
         'services': ['apache2'],
     }),
+    (OPENRC, {
+        'contexts': [nova_cc_context.OpenrcContext(), context.IdentityServiceContext()],
+        'services': [],
+    }),
 ])
 
 CA_CERT_PATH = '/usr/local/share/ca-certificates/keystone_juju_ca_cert.crt'
 
=== added file 'templates/havana/cisco_plugins.ini'
--- templates/havana/cisco_plugins.ini	1970-01-01 00:00:00 +0000
+++ templates/havana/cisco_plugins.ini	2014-08-01 21:20:18 +0000
@@ -0,0 +1,157 @@
+[cisco_plugins]
+ 
+# (StrOpt) Period-separated module path to the plugin class to use for
+# the Cisco Nexus switches.
+#
+# nexus_plugin = neutron.plugins.cisco.nexus.cisco_nexus_plugin_v2.NexusPlugin
+ 
+# (StrOpt) Period-separated module path to the plugin class to use for
+# the virtual switches on compute nodes.
+#
+# vswitch_plugin = neutron.plugins.openvswitch.ovs_neutron_plugin.OVSNeutronPluginV2
+ 
+ 
+[cisco]
+ 
+# (StrOpt) A short prefix to prepend to the VLAN number when creating a
+# VLAN interface. For example, if an interface is being created for
+# VLAN 2001 it will be named 'q-2001' using the default prefix.
+#
+# vlan_name_prefix = q-
+# Example: vlan_name_prefix = vnet-
+ 
+# (StrOpt) A short prefix to prepend to the VLAN number when creating a
+# provider VLAN interface. For example, if an interface is being created
+# for provider VLAN 3003 it will be named 'p-3003' using the default prefix.
+#
+# provider_vlan_name_prefix = p-
+# Example: provider_vlan_name_prefix = PV-
+ 
+# (BoolOpt) A flag indicating whether Openstack networking should manage the
+# creation and removal of VLAN interfaces for provider networks on the Nexus
+# switches. If the flag is set to False then Openstack will not create or
+# remove VLAN interfaces for provider networks, and the administrator needs
+# to manage these interfaces manually or by external orchestration.
+#
+# provider_vlan_auto_create = True
+ 
+# (BoolOpt) A flag indicating whether Openstack networking should manage
+# the adding and removing of provider VLANs from trunk ports on the Nexus
+# switches. If the flag is set to False then Openstack will not add or
+# remove provider VLANs from trunk ports, and the administrator needs to
+# manage these operations manually or by external orchestration.
+#
+# provider_vlan_auto_trunk = True
+ 
+# (StrOpt) Period-separated module path to the model class to use for
+# the Cisco neutron plugin.
+#
+# model_class = neutron.plugins.cisco.models.virt_phy_sw_v2.VirtualPhysicalSwitchModelV2
+ 
+# (StrOpt) Period-separated module path to the driver class to use for
+# the Cisco Nexus switches.
+#
+# If no value is configured, a fake driver will be used.
+# nexus_driver = neutron.plugins.cisco.test.nexus.fake_nexus_driver.CiscoNEXUSFakeDriver
+# With real hardware, use the CiscoNEXUSDriver class:
+# nexus_driver = neutron.plugins.cisco.nexus.cisco_nexus_network_driver_v2.CiscoNEXUSDriver
+ 
+# (BoolOpt) A flag to enable round robin scheduling of routers for SVI.
+# svi_round_robin = False
+ 
+ 
+# Cisco Nexus Switch configurations.
+# Each switch to be managed by Openstack Neutron must be configured here.
+#
+# Cisco Nexus Switch Format.
+# [NEXUS_SWITCH:<IP address of switch>]
+# <hostname>=<port>                 (1)
+# ssh_port=<ssh port>               (2)
+# username=<credential username>    (3)
+# password=<credential password>    (4)
+#
+# (1) For each host connected to a port on the switch, specify the hostname
+#     and the Nexus physical port (interface) it is connected to.
+# (2) The TCP port for connecting via SSH to manage the switch. This is
+#     port number 22 unless the switch has been configured otherwise.
+# (3) The username for logging into the switch to manage it.
+# (4) The password for logging into the switch to manage it.
+#
+# Example:
+# [NEXUS_SWITCH:1.1.1.1]
+# compute1=1/1
+# compute2=1/2
+# ssh_port=22
+# username=admin
+# password=mySecretPassword
+ 
+#
+# N1KV Format.
+# [N1KV:<IP address of VSM>]
+# username=<credential username>
+# password=<credential password>
+#
+# Example:
+# [N1KV:2.2.2.2]
+# username=admin
+# password=mySecretPassword
+ 
+[cisco_n1k]
+ 
+# (StrOpt) Specify the name of the integration bridge to which the VIFs are
+# attached.
+#
+integration_bridge = br-int
+ 
+# (StrOpt) Name of the policy profile to be associated with a port when no
+# policy profile is specified during port creates.
+#
+default_policy_profile = default-pp
+# Example: default_policy_profile = service_profile
+ 
+# (StrOpt) Name of the policy profile to be associated with a port owned by
+# network node (dhcp, router).
+#
+network_node_policy_profile = default-pp
+# Example: network_node_policy_profile = dhcp_pp
+ 
+# (StrOpt) Name of the network profile to be associated with a network when no
+# network profile is specified during network creates. Admin should pre-create
+# a network profile with this name.
+#
+# default_network_profile =
+# Example: default_network_profile = network_pool
+ 
+# (StrOpt) Time in seconds for which the plugin polls the VSM for updates in
+# policy profiles.
+#
+#poll_duration = 10
+# Example: poll_duration = 180
+
+restrict_policy_profiles = {{ restrict_policy_profiles }}
+# Example: restrict_policy_profiles = False 
+
+{% if n1kv_user_config_flags -%}
+{% for key, value in n1kv_user_config_flags.iteritems() -%}
+{{ key }} = {{ value }}
+{% endfor -%}
+{% endif -%}
+
+{% include "parts/section-database" %}
+ 
+[CISCO_PLUGINS]
+vswitch_plugin = neutron.plugins.cisco.n1kv.n1kv_neutron_plugin.N1kvNeutronPluginV2
+ 
+[N1KV:{{ vsm_ip }}]
+password = {{ vsm_password }}
+username = {{ vsm_username }}
+
+[securitygroup]
+{% if neutron_security_groups -%}
+#Firewall driver for realizing neutron security group function.
+#firewall_driver = neutron.agent.firewall.NoopFirewallDriver
+firewall_driver = neutron.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver
+enable_security_group = True
+{% else -%}
+firewall_driver = neutron.agent.firewall.NoopFirewallDriver
+{% endif -%}
 
=== modified file 'templates/havana/neutron.conf'
--- templates/havana/neutron.conf	2014-04-16 08:25:14 +0000
+++ templates/havana/neutron.conf	2014-08-01 21:20:18 +0000
@@ -27,6 +27,12 @@
 
 {% include "parts/rabbitmq" %}
 
+{% if neutron_plugin and neutron_plugin == 'n1kv' -%}
+rpc_backend = neutron.openstack.common.rpc.impl_kombu
+api_extensions_path = /usr/share/pyshared/neutron/plugins/cisco/extensions
+network_auto_schedule = False
+{% endif %}
+
 [quotas]
 quota_driver = neutron.db.quota_db.DbQuotaDriver
 {% if neutron_security_groups -%}
 
=== added file 'templates/havana/openrc'
--- templates/havana/openrc	1970-01-01 00:00:00 +0000
+++ templates/havana/openrc	2014-08-01 21:20:18 +0000
@@ -0,0 +1,15 @@
+#!/bin/sh
+#This is an example of openrc
+# READ:http://docs.openstack.org/user-guide/content/cli_openrc.html
+export OS_NO_CACHE=true
+export OS_TENANT_NAME=admin
+export OS_USERNAME={{ os_username }}
+export OS_PASSWORD={{ os_password }}
+export OS_AUTH_URL=http://{{ service_host }}:{{ service_port }}/v2.0/  
+export OS_AUTH_STRATEGY=keystone
+export OS_REGION_NAME=RegionOne
+export CINDER_ENDPOINT_TYPE=publicURL
+export GLANCE_ENDPOINT_TYPE=publicURL
+export KEYSTONE_ENDPOINT_TYPE=publicURL
+export NOVA_ENDPOINT_TYPE=publicURL
+export QUANTUM_ENDPOINT_TYPE=publicURL
 
=== added file 'templates/icehouse/cisco_plugins.ini'
--- templates/icehouse/cisco_plugins.ini	1970-01-01 00:00:00 +0000
+++ templates/icehouse/cisco_plugins.ini	2014-08-01 21:20:18 +0000
@@ -0,0 +1,179 @@
+[cisco_plugins]
+ 
+# (StrOpt) Period-separated module path to the plugin class to use for
+# the Cisco Nexus switches.
+#
+# nexus_plugin = neutron.plugins.cisco.nexus.cisco_nexus_plugin_v2.NexusPlugin
+ 
+# (StrOpt) Period-separated module path to the plugin class to use for
+# the virtual switches on compute nodes.
+#
+# vswitch_plugin = neutron.plugins.openvswitch.ovs_neutron_plugin.OVSNeutronPluginV2
+ 
+ 
+[cisco]
+ 
+# (StrOpt) A short prefix to prepend to the VLAN number when creating a
+# VLAN interface. For example, if an interface is being created for
+# VLAN 2001 it will be named 'q-2001' using the default prefix.
+#
+# vlan_name_prefix = q-
+# Example: vlan_name_prefix = vnet-
+ 
+# (StrOpt) A short prefix to prepend to the VLAN number when creating a
+# provider VLAN interface. For example, if an interface is being created
+# for provider VLAN 3003 it will be named 'p-3003' using the default prefix.
+#
+# provider_vlan_name_prefix = p-
+# Example: provider_vlan_name_prefix = PV-
+ 
+# (BoolOpt) A flag indicating whether Openstack networking should manage the
+# creation and removal of VLAN interfaces for provider networks on the Nexus
+# switches. If the flag is set to False then Openstack will not create or
+# remove VLAN interfaces for provider networks, and the administrator needs
+# to manage these interfaces manually or by external orchestration.
+#
+# provider_vlan_auto_create = True
+ 
+# (BoolOpt) A flag indicating whether Openstack networking should manage
+# the adding and removing of provider VLANs from trunk ports on the Nexus
+# switches. If the flag is set to False then Openstack will not add or
+# remove provider VLANs from trunk ports, and the administrator needs to
+# manage these operations manually or by external orchestration.
+#
+# provider_vlan_auto_trunk = True
+ 
+# (StrOpt) Period-separated module path to the model class to use for
+# the Cisco neutron plugin.
+#
+# model_class = neutron.plugins.cisco.models.virt_phy_sw_v2.VirtualPhysicalSwitchModelV2
+ 
+# (StrOpt) Period-separated module path to the driver class to use for
+# the Cisco Nexus switches.
+#
+# If no value is configured, a fake driver will be used.
+# nexus_driver = neutron.plugins.cisco.test.nexus.fake_nexus_driver.CiscoNEXUSFakeDriver
+# With real hardware, use the CiscoNEXUSDriver class:
+# nexus_driver = neutron.plugins.cisco.nexus.cisco_nexus_network_driver_v2.CiscoNEXUSDriver
+ 
+# (BoolOpt) A flag to enable round robin scheduling of routers for SVI.
+# svi_round_robin = False
+ 
+ 
+# Cisco Nexus Switch configurations.
+# Each switch to be managed by Openstack Neutron must be configured here.
+#
+# Cisco Nexus Switch Format.
+# [NEXUS_SWITCH:<IP address of switch>]
+# <hostname>=<port>                 (1)
+# ssh_port=<ssh port>               (2)
+# username=<credential username>    (3)
+# password=<credential password>    (4)
+#
+# (1) For each host connected to a port on the switch, specify the hostname
+#     and the Nexus physical port (interface) it is connected to.
+# (2) The TCP port for connecting via SSH to manage the switch. This is
+#     port number 22 unless the switch has been configured otherwise.
+# (3) The username for logging into the switch to manage it.
+# (4) The password for logging into the switch to manage it.
+#
+# Example:
+# [NEXUS_SWITCH:1.1.1.1]
+# compute1=1/1
+# compute2=1/2
+# ssh_port=22
+# username=admin
+# password=mySecretPassword
+ 
+#
+# N1KV Format.
+# [N1KV:<IP address of VSM>]
+# username=<credential username>
+# password=<credential password>
+#
+# Example:
+# [N1KV:2.2.2.2]
+# username=admin
+# password=mySecretPassword
+ 
+[cisco_n1k]
+ 
+# (StrOpt) Specify the name of the integration bridge to which the VIFs are
+# attached.
+#
+integration_bridge = br-int
+ 
+# (StrOpt) Name of the policy profile to be associated with a port when no
+# policy profile is specified during port creates.
+#
+default_policy_profile = default-pp
+# Example: default_policy_profile = service_profile
+ 
+# (StrOpt) Name of the policy profile to be associated with a port owned by
+# network node (dhcp, router).
+#
+network_node_policy_profile = default-pp
+# Example: network_node_policy_profile = dhcp_pp
+ 
+# (StrOpt) Name of the network profile to be associated with a network when no
+# network profile is specified during network creates. Admin should pre-create
+# a network profile with this name.
+#
+# default_network_profile =
+# Example: default_network_profile = network_pool
+ 
+# (StrOpt) Time in seconds for which the plugin polls the VSM for updates in
+# policy profiles.
+#
+#poll_duration = 10
+# Example: poll_duration = 180
+
+# (BoolOpt) Specify whether tenants are restricted from accessing all the
+# policy profiles.
+# Default value: False, indicating all tenants can access all policy profiles.
+#
+# restrict_policy_profiles =
+# Example: restrict_policy_profiles = False
+
+# (IntOpt) Number of threads to use to make HTTP requests to the VSM.
+#
+# http_pool_size = 4
+
+# (IntOpt) Time in seconds for which the plugin waits for the VSM to respond.
+#
+# http_timeout = 30
+http_timeout = 120
+
+
+# (BoolOpt) Specify whether plugin should attempt to synchronize with the VSM
+# when neutron is started.
+# Default value: False, indicating no full sync will be performed.
+#
+# enable_sync_on_start = False
+
+restrict_policy_profiles = {{ restrict_policy_profiles }}
+
+{% if n1kv_user_config_flags -%}
+{% for key, value in n1kv_user_config_flags.iteritems() -%}
+{{ key }} = {{ value }}
+{% endfor -%}
+{% endif -%}
+
+{% include "parts/section-database" %}
+ 
+[CISCO_PLUGINS]
+vswitch_plugin = neutron.plugins.cisco.n1kv.n1kv_neutron_plugin.N1kvNeutronPluginV2
+ 
+[N1KV:{{ vsm_ip }}]
+password = {{ vsm_password }}
+username = {{ vsm_username }}
+
+[securitygroup]
+{% if neutron_security_groups -%}
+#Firewall driver for realizing neutron security group function.
+#firewall_driver = neutron.agent.firewall.NoopFirewallDriver
+firewall_driver = neutron.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver
+enable_security_group = True
+{% else -%}
+firewall_driver = neutron.agent.firewall.NoopFirewallDriver
+{% endif -%}
 
=== modified file 'templates/icehouse/neutron.conf'
--- templates/icehouse/neutron.conf	2014-06-17 10:01:21 +0000
+++ templates/icehouse/neutron.conf	2014-08-01 21:20:18 +0000
@@ -29,6 +29,12 @@
 
 {% include "parts/rabbitmq" %}
 
+{% if neutron_plugin and neutron_plugin == 'n1kv' -%}
+rpc_backend = neutron.openstack.common.rpc.impl_kombu
+api_extensions_path = /usr/share/pyshared/neutron/plugins/cisco/extensions
+network_auto_schedule = False
+{% endif %}
+
 notify_nova_on_port_status_changes = True
 notify_nova_on_port_data_changes = True
 nova_url = {{ nova_url }}
 
=== modified file 'templates/icehouse/nova.conf'
--- templates/icehouse/nova.conf	2014-04-12 21:25:19 +0000
+++ templates/icehouse/nova.conf	2014-08-01 21:20:18 +0000
@@ -58,6 +58,15 @@
 {% endif -%}
 {% endif -%}
 
+{% if neutron_plugin and neutron_plugin == 'n1kv' -%}
+libvirt_user_virtio_for_bridges =  True
+security_group_api = {{ network_manager }}
+nova_firewall_driver = nova.virt.firewall.NoopFirewallDriver
+{% if external_network -%}
+default_floating_pool = {{ external_network }}
+{% endif -%}
+{% endif -%}
+
 {% if network_manager_config -%}
 {% for key, value in network_manager_config.iteritems() -%}
 {{ key }} = {{ value }}