This is a combination of 2 commits to make check/gate jobs pass:

1. Add local bindep.txt

As it was announced [1] global bindep-fallback.txt was removed and now
projects need to have a local bindep.txt to be able to install binary
dependencies for testing.

[1] http://lists.openstack.org/pipermail/openstack-discuss/2019-June/007272.html

(cherry picked from commit 3f1a317d)
(cherry picked from commit 2aaccf0d)
(cherry picked from commit a6037ee5e4acda4e330d0b92df5fabc75540ec68)

2. fix BGPVPN OVO unit test

The 'routes' field should not exist. This bug
was silent until now, but came to the light
after neutron change I42cdf540129bd4470ec1a59345db9845a6198328 .

Note: test_db_obj is skipped from BGPVPNPortAssociationTest class as
suggested.

3. Anchor pyton2.7 for pep8

For python3 at least pylint 1.9 is suggested, so let's try to run pep8
with python2.7 on stable/queens.

Related-Change: I42cdf540129bd4470ec1a59345db9845a6198328

Change-Id: Id3363068e2882dae63b835c178bf4770297a85b7
(cherry picked from commit d9ea5cf9)

The release-notes-jobs template is setup already, remove
indvidual jobs - they are redundant.

This is a partial backport of I5fbf32b52ec6a5878761e23a5aee592e8c516bca,
it is needed to cleanup the Zuul jobs.

Change-Id: I4589871c7482c8c317c323d9e886169ab8018bd2
(cherry picked from commit dfe50a56c2c882254e332ce62220051725a970b1)

This is a job that runs only on master and it stayed in project-config.
It should not have been imported here as part of python3-first topic,
remove it again.

Change-Id: Id1ddf79100d83f665b62b1ef73ed8689a2afd3bb
(cherry picked from commit 21df6d54)

This commit was bulk generated and pushed by the OpenDev sysadmins
as a part of the Git hosting and code review systems migration
detailed in these mailing list posts:

http://lists.openstack.org/pipermail/openstack-discuss/2019-March/003603.html
http://lists.openstack.org/pipermail/openstack-discuss/2019-April/004920.html

Attempts have been made to correct repository namespaces and
hostnames based on simple pattern matching, but it's possible some
were updated incorrectly or missed entirely. Please reach out to us
via the contact information listed at https://opendev.org/ with any
questions you may have.

This is a mechanically generated change to replace openstack.org
git:// URLs with https:// equivalents.

This is in aid of a planned future move of the git hosting
infrastructure to a self-hosted instance of gitea (https://gitea.io),
which does not support the git wire protocol at this stage.

This update should result in no functional change.

For more information see the thread at

 http://lists.openstack.org/pipermail/openstack-discuss/2019-March/003825.html

Change-Id: Ic479628dd64f790ec9c66e906cd26451c5b73121

The releases repo added a validation for PyPI meta files.
The command line is "python3 setup.py check --restructuredtext --strict".
Violation is found in README.rst in networking-bagpipe and
it blocks the release process.

All references in README.rst need to work only with README file.

Change-Id: I647ed8a15cbe6ac60272d21db18602bf2d1eea41
(cherry picked from commit 2d2f61c8)

Needed to cleanly solve bug 1789878.

Change-Id: Ie09b4ddd7d593f85ba11603a63b43f2ecc64fe09

Change-Id: I5c6fd43b58ecf41d0a2a22ab5f3edd5b2e1f4e0e

Bug 1789878 describes why the current implementation of traffic
redirection for router fallback has been defeated by change
Ib6ced838a7ec6d5c459a8475318556001c31bdf which was brought in the neutron
ovs firewalling code.

This change moves the place where we put a higher priority
rule to override the NORMAL action to the ACCEPTED_EGRESS_TRAFFIC_NORMAL_TABLE,
which is added by I60d299275effd9ef35c8007773d3c9fcabfa50fa to
re-introduce a single table where NORMAL happens for egress traffic.

To allow this change to pass the lower-constraints requirement
check job is temporarily set to non-voting, because this job
does not seem to be able to take into account the fact that the
master branch needs neutron master.

Change-Id: I8923ca9583b3337556aaf98b4f25732ea6b7bb1c
Depends-On: https://review.openstack.org/600362
Closes-Bug: 1789878
(cherry-picked from 3867733d)

This is a mechanically generated patch to complete step 1 of moving
the zuul job settings out of project-config and into each project
repository.

Because there will be a separate patch on each branch, the branch
specifiers for branch-specific jobs have been removed.

Because this patch is generated by a script, there may be some
cosmetic changes to the layout of the YAML file(s) as the contents are
normalized.

See the python3-first goal document for details:
https://governance.openstack.org/tc/goals/stein/python3-first.html

Change-Id: Ia5d8804ea182b11f45c9458d343fade03bfd8363
Story: #2002586
Task: #24314

Modify compare_ecmp method to use default LOCAL_PREF as defined in exabgp if
not set in route.

Signed-off-by: Thomas Morin <thomas.morin@orange.com>
Submitted on behalf of a third-party: Orange

Change-Id: I144b01c5870f2b26f15dcd63eb90c2674bd1abc2
Depends-On: I1b9a8bca500eedbe2c42cb8acfc6f37f12a51a5f
Closes-Bug: 1758296
(cherry picked from commit 64f8dfac)

Backport to stable/queens is useful, in particular because
the bgp.conf template contains a bogus configuration suggestion
(gre_tunnel_options="options:layer3=true" instead of  gre_tunnel_options="packet_type=legacy_l3"). Harmless because
commented out, but misleading.

Change-Id: Ia7fc7874c33f8ad7e8eccf92082161274f60ef8c
(cherry picked from commit a1b99333)

build-openstack-sphinx-docs jobs fail on stable branches due to the new
pip version 10 introduces some previously Warning as Error: in case of
calling "pip install" without any package name, the command fails.
tox_install.sh is called during docs job without any package passed to pip.

Change-Id: Ic910eed43c3b56dadbdcf120f2f6f9c491ab7bc7

Update bagpipe driver entry point for networking-sfc

Signed-off-by: Thomas Morin <thomas.morin@orange.com>
Submitted on behalf of a third-party: Orange

Change-Id: I1cf3f43bbc146b5af978723062c05dc365b2301c
Closes-Bug: 1754399
(cherry picked from commit 611cd45e)

Route are always removed from self.readvertised even if it isn't the last route
for the corresponding tracked_entry.

Also refactor some code to dissociate default route readvertised for
'attract_traffic' from others readvertisement.

Signed-off-by: Thomas Morin <thomas.morin@orange.com>
Submitted on behalf of a third-party: Orange

Change-Id: Ic7f597e59a473a9fffd9459ac963ce300f79cf35
Closes-Bug: 1750859
(cherry picked from commit 4155e96b)

Modifying the device details dictionnary on handle_port or delete_port
callbacks is something that has, of course, side effects... :-/

Change-Id: I412c310af40c4053451a2b9b4f8fcd741a85939a
Closes-Bug: 1751302
(cherry picked from commit f2afcdd0)

Add a release note for I8cef6fc49b95b8a18fcb476da079fbc55fecd802.

Change-Id: I0e3db48975ba295730b5755563a6300da9acc521

When admin_state_up is set to False on a port, we need to
stop advertising the corresponding BGPVPN routes.

Change-Id: Idd17d5ef7edc7b1705c0ed25a7cefcd095a1f855
Closes-Bug: 1719597
(cherry picked from commit 6abcac99)

When re-advertising multiple prefixes with 'attract_traffic' from VRF to the
redirection VRF, the default route is only:
- Advertised when starting to readvertise the first prefix,
- Withdrawn when stopping to readvertise the last prefix.

Signed-off-by: Thomas Morin <thomas.morin@orange.com>
Submitted on behalf of a third-party: Orange

Change-Id: Ib7f74aecc8be85cf55b5dcd8eaaaa480be1ecbcb
Closes-Bug: 1749910
(cherry picked from commit 21b3fe26)

The redirect/fallback mecanism in place for BGPVPN with OVS
consists in (a) redirecting traffic to the gateway to br-mpls
(b) having a fallback if the traffic does not match any VPN route,
resulting in the traffic reaching a Neutron router if one is
connected to the network.

Before this change, the behavior was to:
- start ARP-spoofing the gateway MAC, using a special MAC X,
  as soon as a BGPVPN association exist, and keep doing it
  if a Neutron Router is connected to the network
- redirect all traffic to MAC X to br-mpls
- traffic not matching any VPN route in br-mpls is sent back
  to br-int, after rewriting its src mac to special MAC Y,
  and its destination MAC to the MAC address Z of the 'real'
  router implemented by Neutron L3agent

This behavior has drawbacks resulting from ARP spoofing the
gateway IP:
- some ARP voodoo need to be in place to block legitimate ARP
  from a real router (both responses and answers)
- when adding a BGPVPN association on a network on which
  a Neutron router is already connected, the real router MAC
  remains in hosts ARP cache for an undetermined amount of
  time, resulting in lack of BGPVPN connectivity until the
  gateway ARP entry expires

The new behavior introduced by this change consists in:
- only answering ARP requests for the gateway IP with IP MAC X
  when there is no Neutron router on the network
- (unchanged:) redirect all traffic to MAC X to br-mpls
- when a real router with MAC Z is connected, redirect to br-mpls
  all traffic to this MAC ; in the case where the gateway is
  plugged directly onto br-int (e.g. single node setup or DVR setup)
  this redirection also needs to be done in br-int which requires
  using the openvswitch firewall driver (that adds network vlan
  in an OVS register, the only way to correlate a packet with a
  network in br-int)
- (unchanged): traffic not matching any VPN route in br-mpls is
  sent back to br-int, after rewriting its src mac to special MAC Y,
  and its destination MAC to MAC Z
- ensure that fallback'd traffic that went through br-tun/br-mpls
  br-int/br-tun does not loop back into br-mpls again: the traffic
  with src MAC Y does not go from br-tun to br-mpls
- in bagpipe-bgp, disabling the ARP responder, because its answer
  would race with a legitimate answer

Closes-Bug: 1748234
Depends-On: I9d63ce7343f0eacc0bdc7eda568cc04586bdb4f8
Change-Id: I8cef6fc49b95b8a18fcb476da079fbc55fecd802
(cherry picked from commit a2894f22)

Correct bagpipe-l2 agent extension to only handle ports plugged on VXLAN
network type.

Signed-off-by: Thomas Morin <thomas.morin@orange.com>
Submitted on behalf of a third-party: Orange

Change-Id: I6ccc879f080a0614a3a0fec71fcd3d29bee423ad
Closes-Bug: 1748870
(cherry picked from commit 39ce1693)

This change delays VPN instance startup until after the vif_plugge
call to accomodate with a dataplane driver that needs the information
from a first vif_plugged call before a route can actually be processed
(such is the case with the recently added EVPN OVS driver).

Change-Id: I5e3dff8af48d38efa3053f891b710791dd3a9d87
Closes-Bug: 1748438

We need to copy bagpipe-bgp root helper configuration into neutron's config, so
that neutron OVS wrapper classes find the right configuration to execute commands.

This change also tunes down the verbosity of
'ovsdbapp.backend.ovs_idl.vlog'.

Closes-Bug: 1748446
Change-Id: I19bb7f24ce905f8e5619603ec2e7ba11a6c49ecb

The new stable upper-constraints file is only available
after the openstack/requirements repository is branched.
This will happen around the RC1 timeframe.

Recheck and merge this change once the requirements
repository has been branched.

The CI system will work with this patch before the requirements
repository is branched because zuul configues the job to run
with a local copy of the file and defaults to the master branch.
However, accepting the patch will break the test configuration
on developers' local systems, so please wait until after the
requirements repository is branched to merge the patch.

Change-Id: Ib84e51e32cb8408887169a0c293f0a20b5576a70

Change-Id: I6e2f7b49a645e8869277b0ccaf64d12218e9beae

This fixes issues not catched by earlier tests:
- TunnelManager is shared so "used by" handles need
  to include instance_id's
- need OF1.3 for mod_vlan_vid
- delete_port takes a port id, not a name
- gateway port methods can be empty

Change-Id: I7377aa0f7e6422ce8806153518832525fb0e70ff
Related-bug: 1719337

This change steals devstack/lib/neutron:_neutron_setup_rootwrap
to prepare a proper environment to let bagpipe-bgp use
oslo-rootwrap.

Change-Id: Ic783250c7944f722791927bcc03cac6c67e65be2