def get_cert(self, project_id, cert_ref, resource_ref, **kwargs):
        """Retrieves the specified cert.

        :param project_id: Project ID for the owner of the certificate
        :param cert_ref: the UUID of the cert to retrieve
        :param resource_ref: Full HATEOAS reference to the consuming resource

        :returns: neutron_lbaas.common.cert_manager.cert_manager.Cert
                 representation of the certificate data
        :raises CertificateStorageException: if certificate retrieval fails
        """
        LOG.info(_LI(
            "Loading certificate {0} from the local filesystem."
        ).format(cert_ref))

        filename_base = os.path.join(CONF.certificates.storage_path, cert_ref)

        filename_certificate = "{0}.crt".format(filename_base)
        filename_private_key = "{0}.key".format(filename_base)
        filename_intermediates = "{0}.int".format(filename_base)
        filename_pkp = "{0}.pass".format(filename_base)

        cert_data = dict()

        try:
            with open(filename_certificate, 'r') as cert_file:
                cert_data['certificate'] = cert_file.read()
        except IOError:
            LOG.error(_LE(
                "Failed to read certificate for {0}."
            ).format(cert_ref))
            raise exceptions.CertificateStorageException(
                msg="Certificate could not be read."
            )
        try:
            with open(filename_private_key, 'r') as key_file:
                cert_data['private_key'] = key_file.read()
        except IOError:
            LOG.error(_LE(
                "Failed to read private key for {0}."
            ).format(cert_ref))
            raise exceptions.CertificateStorageException(
                msg="Private Key could not be read."
            )

        try:
            with open(filename_intermediates, 'r') as int_file:
                cert_data['intermediates'] = int_file.read()
        except IOError:
            pass

        try:
            with open(filename_pkp, 'r') as pass_file:
                cert_data['private_key_passphrase'] = pass_file.read()
        except IOError:
            pass

        return Cert(**cert_data)

    def _check_and_update_entity_status_in_db(self, track_loadbalancer,
                                              db_entity,
                                              entity_status, entity_manager):

        if not db_entity.provisioning_status.startswith("PENDING_"):
            # no operation is attempted on this entity
            return
        if entity_status:
            if entity_status[PROV].startswith("PENDING_"):
                # an entity is not finished provisioning. Continue to track
                track_loadbalancer['track'] = True
                return

            if entity_status[PROV] == constants.ERROR:
                # Marked for failed completion
                try:
                    entity_manager.failed_completion(
                        self.admin_ctx, db_entity)
                except Exception:
                    LOG.error(_LE("error with failed completion"))
                return

        if db_entity.provisioning_status == constants.PENDING_DELETE:
            # entity is under deletion
            # if entity is missing in lb status tree it should to be
            # deleted
            if entity_status:
                msg = ('Invalid status set for delete of %s in statuses',
                       db_entity.id)
                LOG.error(msg)
                return
            try:
                entity_manager.successful_completion(
                    self.admin_ctx, db_entity, delete=True)
            except Exception:
                LOG.error(_LE("error with successful completion"))
            return

        if entity_status[PROV] != constants.ACTIVE:
            msg = ('Invalid prov status for %s, should be ACTIVE '
                   "for CREATE and UPDATE",
                   db_entity.id)
            LOG.error(msg)
            return
        try:
            entity_manager.successful_completion(
                self.admin_ctx, db_entity)
        except Exception:
            LOG.error(_LE("error with successful completion"))

        return

    def _call(self, action, resource, data, headers, binary=False):
        if resource.startswith('http'):
            uri = resource
        else:
            uri = self.base_uri + resource
        if binary:
            body = data
        else:
            body = jsonutils.dumps(data)

        debug_data = 'binary' if binary else body
        debug_data = debug_data if debug_data else 'EMPTY'
        if not headers:
            headers = {'Authorization': 'Basic %s' % self.auth}
        else:
            headers['Authorization'] = 'Basic %s' % self.auth
        conn = None
        if self.ssl:
            conn = http_client.HTTPSConnection(
                self.server, self.port, timeout=self.timeout)
            if conn is None:
                LOG.error(_LE('vdirectRESTClient: Could not establish HTTPS '
                          'connection'))
                return 0, None, None, None
        else:
            conn = http_client.HTTPConnection(
                self.server, self.port, timeout=self.timeout)
            if conn is None:
                LOG.error(_LE('vdirectRESTClient: Could not establish HTTP '
                          'connection'))
                return 0, None, None, None

        try:
            conn.request(action, uri, body, headers)
            response = conn.getresponse()
            respstr = response.read()
            respdata = respstr
            try:
                respdata = jsonutils.loads(respstr)
            except ValueError:
                # response was not JSON, ignore the exception
                pass
            ret = (response.status, response.reason, respstr, respdata)
        except Exception as e:
            log_dict = {'action': action, 'e': e}
            LOG.error(_LE('vdirectRESTClient: %(action)s failure, %(e)r'),
                      log_dict)
            ret = -1, None, None, None
        conn.close()
        return ret

def get_session():
    """Initializes a Keystone session.

    :returns: a Keystone Session object
    :raises Exception: if the session cannot be established
    """
    global _SESSION
    if not _SESSION:

        auth_url = cfg.CONF.service_auth.auth_url
        kwargs = {'auth_url': auth_url,
                  'username': cfg.CONF.service_auth.admin_user,
                  'password': cfg.CONF.service_auth.admin_password}

        if cfg.CONF.service_auth.auth_version == '2':
            client = v2_client
            kwargs['tenant_name'] = cfg.CONF.service_auth.admin_tenant_name
        elif cfg.CONF.service_auth.auth_version == '3':
            client = v3_client
            kwargs['project_name'] = cfg.CONF.service_auth.admin_tenant_name
            kwargs['user_domain_name'] = (cfg.CONF.service_auth.
                                          admin_user_domain)
            kwargs['project_domain_name'] = (cfg.CONF.service_auth.
                                             admin_project_domain)
        else:
            raise Exception('Unknown keystone version!')

        try:
            kc = client.Password(**kwargs)
            _SESSION = session.Session(auth=kc)
        except Exception:
            with excutils.save_and_reraise_exception():
                LOG.exception(_LE("Error creating Keystone session."))

    return _SESSION

    def get_cert(self, project_id, cert_ref, resource_ref,
                 check_only=False, service_name='lbaas'):
        """Retrieves the specified cert and registers as a consumer.

        :param cert_ref: the UUID of the cert to retrieve
        :param resource_ref: Full HATEOAS reference to the consuming resource
        :param check_only: Read Certificate data without registering
        :param service_name: Friendly name for the consuming service

        :returns: octavia.certificates.common.Cert representation of the
                 certificate data
        :raises Exception: if certificate retrieval fails
        """
        connection = self.auth.get_barbican_client(project_id)

        LOG.info(_LI(
            "Loading certificate container {0} from Barbican."
        ).format(cert_ref))
        try:
            if check_only:
                cert_container = connection.containers.get(
                    container_ref=cert_ref
                )
            else:
                cert_container = connection.containers.register_consumer(
                    container_ref=cert_ref,
                    name=service_name,
                    url=resource_ref
                )
            return Cert(cert_container)
        except Exception:
            with excutils.save_and_reraise_exception():
                LOG.exception(_LE("Error getting {0}").format(cert_ref))

 def _handle_failed_driver_call(self, operation, obj, driver):
     obj_type = obj.__class__.__name__.lower()
     LOG.exception(_LE('%(operation)s %(obj)s %(id)s failed on device '
                       'driver %(driver)s'),
                   {'operation': operation.capitalize(), 'obj': obj_type,
                    'id': obj.id, 'driver': driver})
     self._update_statuses(obj, error=True)

    def delete_cert(cert_ref, lb_id, service_name='lbaas', **kwargs):
        """Deregister as a consumer for the specified cert.

        :param cert_ref: the UUID of the cert to retrieve
        :param service_name: Friendly name for the consuming service
        :param lb_id: Loadbalancer id for building resource consumer URL

        :raises Exception: if deregistration fails
        """
        connection = BarbicanKeystoneAuth.get_barbican_client()

        LOG.info(_LI(
            "Deregistering as a consumer of {0} in Barbican."
        ).format(cert_ref))
        try:
            connection.containers.remove_consumer(
                container_ref=cert_ref,
                name=service_name,
                url=CertManager._get_service_url(lb_id)
            )
        except Exception:
            with excutils.save_and_reraise_exception():
                LOG.exception(_LE(
                    "Error deregistering as a consumer of {0}"
                ).format(cert_ref))

    def _reload_loadbalancer(self, loadbalancer_id):
        try:
            loadbalancer_dict = self.plugin_rpc.get_loadbalancer(loadbalancer_id)
            loadbalancer = data_models.LoadBalancer.from_dict(loadbalancer_dict)
            driver_name = loadbalancer.provider.device_driver
            if driver_name not in self.device_drivers:
                LOG.error(_LE("No device driver on agent: %s."), driver_name)
                self.plugin_rpc.update_status("loadbalancer", loadbalancer_id, constants.ERROR)
                return

            self.device_drivers[driver_name].deploy_instance(loadbalancer)
            self.instance_mapping[loadbalancer_id] = driver_name
            self.plugin_rpc.loadbalancer_deployed(loadbalancer_id)
        except Exception:
            LOG.exception(_LE("Unable to deploy instance for " "loadbalancer: %s"), loadbalancer_id)
            self.needs_resync = True

    def delete_cert(self, project_id, cert_ref, resource_ref, **kwargs):
        """Deletes the specified cert.

        :param project_id: Project ID for the owner of the certificate
        :param cert_ref: the UUID of the cert to delete
        :param resource_ref: Full HATEOAS reference to the consuming resource

        :raises CertificateStorageException: if certificate deletion fails
        """
        LOG.info(_LI(
            "Deleting certificate {0} from the local filesystem."
        ).format(cert_ref))

        filename_base = os.path.join(CONF.certificates.storage_path, cert_ref)

        filename_certificate = "{0}.crt".format(filename_base)
        filename_private_key = "{0}.key".format(filename_base)
        filename_intermediates = "{0}.int".format(filename_base)
        filename_pkp = "{0}.pass".format(filename_base)

        try:
            os.remove(filename_certificate)
            os.remove(filename_private_key)
            os.remove(filename_intermediates)
            os.remove(filename_pkp)
        except IOError as ioe:
            LOG.error(_LE(
                "Failed to delete certificate {0}."
            ).format(cert_ref))
            raise exceptions.CertificateStorageException(message=ioe.message)

 def _get_driver_for_provider(self, provider):
     try:
         return self.drivers[provider]
     except KeyError:
         # raise if not associated (should never be reached)
         raise n_exc.Invalid(_LE("Error retrieving driver for provider "
                                 "%s") % provider)

    def _actually_delete_cert(cert_ref):
        """Deletes the specified cert. Very dangerous. Do not recommend.

        :param cert_ref: the UUID of the cert to delete
        :raises Exception: if certificate deletion fails
        """
        connection = BarbicanKeystoneAuth.get_barbican_client()

        LOG.info(_LI(
            "Recursively deleting certificate container {0} from Barbican."
        ).format(cert_ref))
        try:
            certificate_container = connection.containers.get(cert_ref)
            certificate_container.certificate.delete()
            if certificate_container.intermediates:
                certificate_container.intermediates.delete()
            if certificate_container.private_key_passphrase:
                certificate_container.private_key_passphrase.delete()
            certificate_container.private_key.delete()
            certificate_container.delete()
        except Exception:
            with excutils.save_and_reraise_exception():
                LOG.exception(_LE(
                    "Error recursively deleting certificate container {0}"
                ).format(cert_ref))

 def __init__(self, cert_container):
     if not isinstance(cert_container,
                       barbican_client.containers.CertificateContainer):
         raise TypeError(_LE(
             "Retrieved Barbican Container is not of the correct type "
             "(certificate)."))
     self._cert_container = cert_container

    def get_cert(cert_ref, service_name='lbaas',
                 lb_id=None,
                 check_only=False, **kwargs):
        """Retrieves the specified cert and registers as a consumer.

        :param cert_ref: the UUID of the cert to retrieve
        :param service_name: Friendly name for the consuming service
        :param lb_id: Loadbalancer id for building resource consumer URL
        :param check_only: Read Certificate data without registering

        :returns: octavia.certificates.common.Cert representation of the
                 certificate data
        :raises Exception: if certificate retrieval fails
        """
        connection = BarbicanKeystoneAuth.get_barbican_client()

        LOG.info(_LI(
            "Loading certificate container {0} from Barbican."
        ).format(cert_ref))
        try:
            if check_only:
                cert_container = connection.containers.get(
                    container_ref=cert_ref
                )
            else:
                cert_container = connection.containers.register_consumer(
                    container_ref=cert_ref,
                    name=service_name,
                    url=CertManager._get_service_url(lb_id)
                )
            return Cert(cert_container)
        except Exception:
            with excutils.save_and_reraise_exception():
                LOG.exception(_LE("Error getting {0}").format(cert_ref))

    def _remove_workflow(self, ids, context, post_remove_function):

        wf_name = ids['pool']
        LOG.debug('Remove the workflow %s' % wf_name)
        resource = '/api/workflow/%s' % (wf_name)
        rest_return = self.rest_client.call('DELETE', resource, None, None)
        response = _rest_wrapper(rest_return, [204, 202, 404])
        if rest_return[RESP_STATUS] == 404:
            if post_remove_function:
                try:
                    post_remove_function(True)
                    LOG.debug('Post-remove workflow function %r completed',
                              post_remove_function)
                except Exception:
                    with excutils.save_and_reraise_exception():
                        LOG.exception(_LE('Post-remove workflow function '
                                          '%r failed'), post_remove_function)
            self.plugin._delete_db_vip(context, ids['vip'])
        else:
            oper = OperationAttributes(
                response['uri'],
                ids,
                lb_db.Vip,
                ids['vip'],
                delete=True,
                post_op_function=post_remove_function)
            LOG.debug('Pushing operation %s to the queue', oper)

            self._start_completion_handling_thread()
            self.queue.put_nowait(oper)

def get_host_names(certificate):
    """Extract the host names from the Pem encoded X509 certificate

    :param certificate: A PEM encoded certificate
    :returns: A dictionary containing the following keys:
    ['cn', 'dns_names']
    where 'cn' is the CN from the SubjectName of the certificate, and
    'dns_names' is a list of dNSNames (possibly empty) from
    the SubjectAltNames of the certificate.
    """
    try:
        certificate = certificate.encode('ascii')

        cert = _get_x509_from_pem_bytes(certificate)
        cn = cert.subject.get_attributes_for_oid(x509.OID_COMMON_NAME)[0]
        host_names = {
            'cn': cn.value.lower(),
            'dns_names': []
        }
        try:
            ext = cert.extensions.get_extension_for_oid(
                x509.OID_SUBJECT_ALTERNATIVE_NAME
            )
            host_names['dns_names'] = ext.value.get_values_for_type(
                x509.DNSName)
        except x509.ExtensionNotFound:
            LOG.debug("%s extension not found",
                      x509.OID_SUBJECT_ALTERNATIVE_NAME)

        return host_names
    except Exception:
        LOG.exception(_LE("Unreadable certificate."))
        raise exceptions.UnreadableCert

    def __init__(self, plugin):
        super(HaproxyNSDriver, self).__init__(plugin)
        self.conf = cfg.CONF
        self.state_path = os.path.join(
            self.conf.haproxy.loadbalancer_state_path, STATE_PATH_V2_APPEND)
        if not self.conf.haproxy.interface_driver:
            self.conf.haproxy.interface_driver = DEFAULT_INTERFACE_DRIVER
        try:
            vif_driver_class = n_utils.load_class_by_alias_or_classname(
                'neutron.interface_drivers',
                self.conf.haproxy.interface_driver)

        except ImportError:
            with excutils.save_and_reraise_exception():
                msg = (_LE('Error importing interface driver: %s')
                       % self.conf.haproxy.interface_driver)
                LOG.exception(msg)
        self.vif_driver = vif_driver_class(self.conf)

        # instantiate managers here
        self.load_balancer = LoadBalancerManager(self)
        self.listener = ListenerManager(self)
        self.pool = PoolManager(self)
        self.member = MemberManager(self)
        self.health_monitor = HealthMonitorManager(self)

        self.admin_ctx = ncontext.get_admin_context()
        self.deployed_loadbalancer_ids = set()
        self._deploy_existing_instances()

        SimpleHaproxyStatsService(self).start()

    def run(self):
        while not self.stoprequest.isSet():
            try:
                oper = self.queue.get(timeout=1)

                # Get the current queue size (N) and set the counter with it.
                # Handle N operations with no intermission.
                # Once N operations handles, get the size again and repeat.
                if self.opers_to_handle_before_rest <= 0:
                    self.opers_to_handle_before_rest = self.queue.qsize() + 1

                LOG.debug('Operation consumed from the queue: ' +
                          str(oper))
                # check the status - if oper is done: update the db ,
                # else push the oper again to the queue
                if not self.handle_operation_completion(oper):
                    LOG.debug('Operation %s is not completed yet..' % oper)
                    # Not completed - push to the queue again
                    self.queue.put_nowait(oper)

                self.queue.task_done()
                self.opers_to_handle_before_rest -= 1

                # Take one second rest before start handling
                # new operations or operations handled before
                if self.opers_to_handle_before_rest <= 0:
                    time.sleep(1)

            except Queue.Empty:
                continue
            except Exception:
                LOG.error(_LE(
                    "Exception was thrown inside OperationCompletionHandler"))

 def _handle_failed_driver_call(self, operation, obj, driver):
     obj_type = obj.__class__.__name__.lower()
     LOG.exception(
         _LE("%(operation)s %(obj)s %(id)s failed on device " "driver %(driver)s"),
         {"operation": operation.capitalize(), "obj": obj_type, "id": obj.id, "driver": driver},
     )
     self._update_statuses(obj, error=True)

 def _get_driver_for_pool(self, context, pool_id):
     pool = self.get_pool(context, pool_id)
     try:
         return self.drivers[pool['provider']]
     except KeyError:
         raise n_exc.Invalid(_LE("Error retrieving provider for pool %s") %
                             pool_id)

 def _report_state(self):
     try:
         instance_count = len(self.instance_mapping)
         self.agent_state["configurations"]["instances"] = instance_count
         self.state_rpc.report_state(self.context, self.agent_state)
         self.agent_state.pop("start_flag", None)
     except Exception:
         LOG.exception(_LE("Failed reporting state!"))