Move heat_keystoneclient to clients package

This moves the heat_keystoneclient wrapper to
heat.engine.clients package.

Change-Id: I39636abb946a7608014145d9edca5297d9f929d0
Related-Bug: #1554533

9 files changed, 174 insertions, 152 deletions

diff --git a/heat/engine/clients/os/keystone.py b/heat/engine/clients/os/keystone/__init__.py
index 7302e27e4..52b160a22 100644
--- a/heat/engine/clients/os/keystone.py
+++ b/heat/engine/clients/os/keystone/__init__.py
@@ -14,11 +14,8 @@
 from keystoneclient import exceptions
 
 from heat.common import exception
-from heat.common import heat_keystoneclient as hkc
 from heat.engine.clients import client_plugin
-from heat.engine import constraints
-
-CLIENT_NAME = 'keystone'
+from heat.engine.clients.os.keystone import heat_keystoneclient as hkc
 
 
 class KeystoneClientPlugin(client_plugin.ClientPlugin):
@@ -132,63 +129,3 @@ class KeystoneClientPlugin(client_plugin.ClientPlugin):
         except exceptions.NotFound:
             raise exception.EntityNotFound(entity='KeystoneRegion',
                                            name=region)
-
-
-class KeystoneBaseConstraint(constraints.BaseCustomConstraint):
-
-    resource_client_name = CLIENT_NAME
-    entity = None
-
-    def validate_with_client(self, client, resource_id):
-        # when user specify empty value in template, do not get the
-        # responding resource from backend, otherwise an error will happen
-        if resource_id == '':
-            raise exception.EntityNotFound(entity=self.entity,
-                                           name=resource_id)
-
-        super(KeystoneBaseConstraint, self).validate_with_client(client,
-                                                                 resource_id)
-
-
-class KeystoneRoleConstraint(KeystoneBaseConstraint):
-
-    resource_getter_name = 'get_role_id'
-    entity = 'KeystoneRole'
-
-
-class KeystoneDomainConstraint(KeystoneBaseConstraint):
-
-    resource_getter_name = 'get_domain_id'
-    entity = 'KeystoneDomain'
-
-
-class KeystoneProjectConstraint(KeystoneBaseConstraint):
-
-    resource_getter_name = 'get_project_id'
-    entity = 'KeystoneProject'
-
-
-class KeystoneGroupConstraint(KeystoneBaseConstraint):
-
-    resource_getter_name = 'get_group_id'
-    entity = 'KeystoneGroup'
-
-
-class KeystoneServiceConstraint(KeystoneBaseConstraint):
-
-    expected_exceptions = (exception.EntityNotFound,
-                           exception.KeystoneServiceNameConflict,)
-    resource_getter_name = 'get_service_id'
-    entity = 'KeystoneService'
-
-
-class KeystoneUserConstraint(KeystoneBaseConstraint):
-
-    resource_getter_name = 'get_user_id'
-    entity = 'KeystoneUser'
-
-
-class KeystoneRegionConstraint(KeystoneBaseConstraint):
-
-    resource_getter_name = 'get_region_id'
-    entity = 'KeystoneRegion'
diff --git a/heat/common/heat_keystoneclient.py b/heat/engine/clients/os/keystone/heat_keystoneclient.py
index 92cdc2f2e..311a7eb67 100644
--- a/heat/common/heat_keystoneclient.py
+++ b/heat/engine/clients/os/keystone/heat_keystoneclient.py
@@ -33,11 +33,12 @@ from heat.common.i18n import _
 from heat.common.i18n import _LE
 from heat.common.i18n import _LW
 
-LOG = logging.getLogger('heat.common.keystoneclient')
+LOG = logging.getLogger('heat.engine.clients.keystoneclient')
 
 AccessKey = collections.namedtuple('AccessKey', ['id', 'access', 'secret'])
 
-_default_keystone_backend = "heat.common.heat_keystoneclient.KeystoneClientV3"
+_default_keystone_backend = (
+    'heat.engine.clients.os.keystone.heat_keystoneclient.KsClientWrapper')
 
 keystone_opts = [
     cfg.StrOpt('keystone_backend',
@@ -47,7 +48,7 @@ keystone_opts = [
 cfg.CONF.register_opts(keystone_opts)
 
 
-class KeystoneClientV3(object):
+class KsClientWrapper(object):
     """Wrap keystone client so we can encapsulate logic used in resources.
 
     Note this is intended to be initialized from a resource on a per-session
@@ -558,7 +559,7 @@ class KeystoneClient(object):
 
     def __new__(cls, context):
         if cfg.CONF.keystone_backend == _default_keystone_backend:
-            return KeystoneClientV3(context)
+            return KsClientWrapper(context)
         else:
             return importutils.import_object(
                 cfg.CONF.keystone_backend,
diff --git a/heat/engine/clients/os/keystone/keystone_constraints.py b/heat/engine/clients/os/keystone/keystone_constraints.py
new file mode 100644
index 000000000..ca0271a94
--- /dev/null
+++ b/heat/engine/clients/os/keystone/keystone_constraints.py
@@ -0,0 +1,77 @@
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+from heat.common import exception
+from heat.engine import constraints
+
+CLIENT_NAME = 'keystone'
+
+
+class KeystoneBaseConstraint(constraints.BaseCustomConstraint):
+
+    resource_client_name = CLIENT_NAME
+    entity = None
+
+    def validate_with_client(self, client, resource_id):
+        # when user specify empty value in template, do not get the
+        # responding resource from backend, otherwise an error will happen
+        if resource_id == '':
+            raise exception.EntityNotFound(entity=self.entity,
+                                           name=resource_id)
+
+        super(KeystoneBaseConstraint, self).validate_with_client(client,
+                                                                 resource_id)
+
+
+class KeystoneRoleConstraint(KeystoneBaseConstraint):
+
+    resource_getter_name = 'get_role_id'
+    entity = 'KeystoneRole'
+
+
+class KeystoneDomainConstraint(KeystoneBaseConstraint):
+
+    resource_getter_name = 'get_domain_id'
+    entity = 'KeystoneDomain'
+
+
+class KeystoneProjectConstraint(KeystoneBaseConstraint):
+
+    resource_getter_name = 'get_project_id'
+    entity = 'KeystoneProject'
+
+
+class KeystoneGroupConstraint(KeystoneBaseConstraint):
+
+    resource_getter_name = 'get_group_id'
+    entity = 'KeystoneGroup'
+
+
+class KeystoneServiceConstraint(KeystoneBaseConstraint):
+
+    expected_exceptions = (exception.EntityNotFound,
+                           exception.KeystoneServiceNameConflict,)
+    resource_getter_name = 'get_service_id'
+    entity = 'KeystoneService'
+
+
+class KeystoneUserConstraint(KeystoneBaseConstraint):
+
+    resource_getter_name = 'get_user_id'
+    entity = 'KeystoneUser'
+
+
+class KeystoneRegionConstraint(KeystoneBaseConstraint):
+
+    resource_getter_name = 'get_region_id'
+    entity = 'KeystoneRegion'
diff --git a/heat/tests/clients/test_heat_client.py b/heat/tests/clients/test_heat_client.py
index 3e9cef344..7a9b415cc 100644
--- a/heat/tests/clients/test_heat_client.py
+++ b/heat/tests/clients/test_heat_client.py
@@ -29,7 +29,7 @@ import six
 
 from heat.common import config
 from heat.common import exception
-from heat.common import heat_keystoneclient
+from heat.engine.clients.os.keystone import heat_keystoneclient
 from heat.tests import common
 from heat.tests import utils
 
diff --git a/heat/tests/clients/test_keystone_client.py b/heat/tests/clients/test_keystone_client.py
index 1a9886bd8..e6983d402 100644
--- a/heat/tests/clients/test_keystone_client.py
+++ b/heat/tests/clients/test_keystone_client.py
@@ -11,25 +11,26 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
+from keystoneclient import exceptions as keystone_exceptions
 import mock
 import six
 
-from keystoneclient import exceptions as keystone_exceptions
-
 from heat.common import exception
-from heat.engine.clients.os import keystone as client
+from heat.engine.clients.os import keystone
+from heat.engine.clients.os.keystone import keystone_constraints as ks_constr
 from heat.tests import common
 
 
 class KeystoneRoleConstraintTest(common.HeatTestCase):
 
     def test_expected_exceptions(self):
-        self.assertEqual((exception.EntityNotFound,),
-                         client.KeystoneRoleConstraint.expected_exceptions,
-                         "KeystoneRoleConstraint expected exceptions error")
+        self.assertEqual(
+            (exception.EntityNotFound,),
+            ks_constr.KeystoneRoleConstraint.expected_exceptions,
+            "KeystoneRoleConstraint expected exceptions error")
 
     def test_constraint(self):
-        constraint = client.KeystoneRoleConstraint()
+        constraint = ks_constr.KeystoneRoleConstraint()
         client_mock = mock.MagicMock()
         client_plugin_mock = mock.MagicMock()
         client_plugin_mock.get_role_id.return_value = None
@@ -47,12 +48,13 @@ class KeystoneRoleConstraintTest(common.HeatTestCase):
 class KeystoneProjectConstraintTest(common.HeatTestCase):
 
     def test_expected_exceptions(self):
-        self.assertEqual((exception.EntityNotFound,),
-                         client.KeystoneProjectConstraint.expected_exceptions,
-                         "KeystoneProjectConstraint expected exceptions error")
+        self.assertEqual(
+            (exception.EntityNotFound,),
+            ks_constr.KeystoneProjectConstraint.expected_exceptions,
+            "KeystoneProjectConstraint expected exceptions error")
 
     def test_constraint(self):
-        constraint = client.KeystoneProjectConstraint()
+        constraint = ks_constr.KeystoneProjectConstraint()
         client_mock = mock.MagicMock()
         client_plugin_mock = mock.MagicMock()
         client_plugin_mock.get_project_id.return_value = None
@@ -70,12 +72,13 @@ class KeystoneProjectConstraintTest(common.HeatTestCase):
 class KeystoneGroupConstraintTest(common.HeatTestCase):
 
     def test_expected_exceptions(self):
-        self.assertEqual((exception.EntityNotFound,),
-                         client.KeystoneGroupConstraint.expected_exceptions,
-                         "KeystoneGroupConstraint expected exceptions error")
+        self.assertEqual(
+            (exception.EntityNotFound,),
+            ks_constr.KeystoneGroupConstraint.expected_exceptions,
+            "KeystoneGroupConstraint expected exceptions error")
 
     def test_constraint(self):
-        constraint = client.KeystoneGroupConstraint()
+        constraint = ks_constr.KeystoneGroupConstraint()
         client_mock = mock.MagicMock()
         client_plugin_mock = mock.MagicMock()
         client_plugin_mock.get_group_id.return_value = None
@@ -93,12 +96,13 @@ class KeystoneGroupConstraintTest(common.HeatTestCase):
 class KeystoneDomainConstraintTest(common.HeatTestCase):
 
     def test_expected_exceptions(self):
-        self.assertEqual((exception.EntityNotFound,),
-                         client.KeystoneDomainConstraint.expected_exceptions,
-                         "KeystoneDomainConstraint expected exceptions error")
+        self.assertEqual(
+            (exception.EntityNotFound,),
+            ks_constr.KeystoneDomainConstraint.expected_exceptions,
+            "KeystoneDomainConstraint expected exceptions error")
 
     def test_constraint(self):
-        constraint = client.KeystoneDomainConstraint()
+        constraint = ks_constr.KeystoneDomainConstraint()
         client_mock = mock.MagicMock()
         client_plugin_mock = mock.MagicMock()
         client_plugin_mock.get_domain_id.return_value = None
@@ -118,13 +122,13 @@ class KeystoneServiceConstraintTest(common.HeatTestCase):
     sample_uuid = '477e8273-60a7-4c41-b683-fdb0bc7cd151'
 
     def test_expected_exceptions(self):
-        self.assertEqual((exception.EntityNotFound,
-                          exception.KeystoneServiceNameConflict,),
-                         client.KeystoneServiceConstraint.expected_exceptions,
-                         "KeystoneServiceConstraint expected exceptions error")
+        self.assertEqual(
+            (exception.EntityNotFound, exception.KeystoneServiceNameConflict,),
+            ks_constr.KeystoneServiceConstraint.expected_exceptions,
+            "KeystoneServiceConstraint expected exceptions error")
 
     def test_constraint(self):
-        constraint = client.KeystoneServiceConstraint()
+        constraint = ks_constr.KeystoneServiceConstraint()
         client_mock = mock.MagicMock()
         client_plugin_mock = mock.MagicMock()
         client_plugin_mock.get_service_id.return_value = self.sample_uuid
@@ -143,12 +147,13 @@ class KeystoneServiceConstraintTest(common.HeatTestCase):
 class KeystoneUserConstraintTest(common.HeatTestCase):
 
     def test_expected_exceptions(self):
-        self.assertEqual((exception.EntityNotFound,),
-                         client.KeystoneUserConstraint.expected_exceptions,
-                         "KeystoneUserConstraint expected exceptions error")
+        self.assertEqual(
+            (exception.EntityNotFound,),
+            ks_constr.KeystoneUserConstraint.expected_exceptions,
+            "KeystoneUserConstraint expected exceptions error")
 
     def test_constraint(self):
-        constraint = client.KeystoneUserConstraint()
+        constraint = ks_constr.KeystoneUserConstraint()
         client_mock = mock.MagicMock()
         client_plugin_mock = mock.MagicMock()
         client_plugin_mock.get_user_id.return_value = None
@@ -167,12 +172,13 @@ class KeystoneRegionConstraintTest(common.HeatTestCase):
     sample_uuid = '477e8273-60a7-4c41-b683-fdb0bc7cd151'
 
     def test_expected_exceptions(self):
-        self.assertEqual((exception.EntityNotFound,),
-                         client.KeystoneRegionConstraint.expected_exceptions,
-                         "KeystoneRegionConstraint expected exceptions error")
+        self.assertEqual(
+            (exception.EntityNotFound,),
+            ks_constr.KeystoneRegionConstraint.expected_exceptions,
+            "KeystoneRegionConstraint expected exceptions error")
 
     def test_constraint(self):
-        constraint = client.KeystoneRegionConstraint()
+        constraint = ks_constr.KeystoneRegionConstraint()
         client_mock = mock.MagicMock()
         client_plugin_mock = mock.MagicMock()
         client_plugin_mock.get_region_id.return_value = self.sample_uuid
@@ -203,14 +209,14 @@ class KeystoneClientPluginServiceTest(common.HeatTestCase):
         super(KeystoneClientPluginServiceTest, self).setUp()
         self._client = mock.MagicMock()
 
-    @mock.patch.object(client.KeystoneClientPlugin, 'client')
+    @mock.patch.object(keystone.KeystoneClientPlugin, 'client')
     def test_get_service_id(self, client_keystone):
 
         self._client.client.services.get.return_value = (self
                                                          ._get_mock_service())
 
         client_keystone.return_value = self._client
-        client_plugin = client.KeystoneClientPlugin(
+        client_plugin = keystone.KeystoneClientPlugin(
             context=mock.MagicMock()
         )
 
@@ -219,7 +225,7 @@ class KeystoneClientPluginServiceTest(common.HeatTestCase):
         self._client.client.services.get.assert_called_once_with(
             self.sample_uuid)
 
-    @mock.patch.object(client.KeystoneClientPlugin, 'client')
+    @mock.patch.object(keystone.KeystoneClientPlugin, 'client')
     def test_get_service_id_with_name(self, client_keystone):
         self._client.client.services.get.side_effect = (keystone_exceptions
                                                         .NotFound)
@@ -228,7 +234,7 @@ class KeystoneClientPluginServiceTest(common.HeatTestCase):
         ]
 
         client_keystone.return_value = self._client
-        client_plugin = client.KeystoneClientPlugin(
+        client_plugin = keystone.KeystoneClientPlugin(
             context=mock.MagicMock()
         )
 
@@ -240,7 +246,7 @@ class KeystoneClientPluginServiceTest(common.HeatTestCase):
         self._client.client.services.list.assert_called_once_with(
             name=self.sample_name)
 
-    @mock.patch.object(client.KeystoneClientPlugin, 'client')
+    @mock.patch.object(keystone.KeystoneClientPlugin, 'client')
     def test_get_service_id_with_name_conflict(self, client_keystone):
         self._client.client.services.get.side_effect = (keystone_exceptions
                                                         .NotFound)
@@ -250,7 +256,7 @@ class KeystoneClientPluginServiceTest(common.HeatTestCase):
         ]
 
         client_keystone.return_value = self._client
-        client_plugin = client.KeystoneClientPlugin(
+        client_plugin = keystone.KeystoneClientPlugin(
             context=mock.MagicMock()
         )
 
@@ -267,7 +273,7 @@ class KeystoneClientPluginServiceTest(common.HeatTestCase):
         self._client.client.services.list.assert_called_once_with(
             name=self.sample_name)
 
-    @mock.patch.object(client.KeystoneClientPlugin, 'client')
+    @mock.patch.object(keystone.KeystoneClientPlugin, 'client')
     def test_get_service_id_not_found(self, client_keystone):
         self._client.client.services.get.side_effect = (keystone_exceptions
                                                         .NotFound)
@@ -275,7 +281,7 @@ class KeystoneClientPluginServiceTest(common.HeatTestCase):
         ]
 
         client_keystone.return_value = self._client
-        client_plugin = client.KeystoneClientPlugin(
+        client_plugin = keystone.KeystoneClientPlugin(
             context=mock.MagicMock()
         )
 
@@ -307,13 +313,13 @@ class KeystoneClientPluginRoleTest(common.HeatTestCase):
         super(KeystoneClientPluginRoleTest, self).setUp()
         self._client = mock.MagicMock()
 
-    @mock.patch.object(client.KeystoneClientPlugin, 'client')
+    @mock.patch.object(keystone.KeystoneClientPlugin, 'client')
     def test_get_role_id(self, client_keystone):
         self._client.client.roles.get.return_value = (self
                                                       ._get_mock_role())
 
         client_keystone.return_value = self._client
-        client_plugin = client.KeystoneClientPlugin(
+        client_plugin = keystone.KeystoneClientPlugin(
             context=mock.MagicMock()
         )
 
@@ -322,7 +328,7 @@ class KeystoneClientPluginRoleTest(common.HeatTestCase):
         self._client.client.roles.get.assert_called_once_with(
             self.sample_uuid)
 
-    @mock.patch.object(client.KeystoneClientPlugin, 'client')
+    @mock.patch.object(keystone.KeystoneClientPlugin, 'client')
     def test_get_role_id_with_name(self, client_keystone):
         self._client.client.roles.get.side_effect = (keystone_exceptions
                                                      .NotFound)
@@ -331,7 +337,7 @@ class KeystoneClientPluginRoleTest(common.HeatTestCase):
         ]
 
         client_keystone.return_value = self._client
-        client_plugin = client.KeystoneClientPlugin(
+        client_plugin = keystone.KeystoneClientPlugin(
             context=mock.MagicMock()
         )
 
@@ -343,7 +349,7 @@ class KeystoneClientPluginRoleTest(common.HeatTestCase):
         self._client.client.roles.list.assert_called_once_with(
             name=self.sample_name)
 
-    @mock.patch.object(client.KeystoneClientPlugin, 'client')
+    @mock.patch.object(keystone.KeystoneClientPlugin, 'client')
     def test_get_role_id_not_found(self, client_keystone):
         self._client.client.roles.get.side_effect = (keystone_exceptions
                                                      .NotFound)
@@ -351,7 +357,7 @@ class KeystoneClientPluginRoleTest(common.HeatTestCase):
         ]
 
         client_keystone.return_value = self._client
-        client_plugin = client.KeystoneClientPlugin(
+        client_plugin = keystone.KeystoneClientPlugin(
             context=mock.MagicMock()
         )
 
@@ -383,13 +389,13 @@ class KeystoneClientPluginProjectTest(common.HeatTestCase):
         super(KeystoneClientPluginProjectTest, self).setUp()
         self._client = mock.MagicMock()
 
-    @mock.patch.object(client.KeystoneClientPlugin, 'client')
+    @mock.patch.object(keystone.KeystoneClientPlugin, 'client')
     def test_get_project_id(self, client_keystone):
         self._client.client.projects.get.return_value = (self
                                                          ._get_mock_project())
 
         client_keystone.return_value = self._client
-        client_plugin = client.KeystoneClientPlugin(
+        client_plugin = keystone.KeystoneClientPlugin(
             context=mock.MagicMock()
         )
 
@@ -398,7 +404,7 @@ class KeystoneClientPluginProjectTest(common.HeatTestCase):
         self._client.client.projects.get.assert_called_once_with(
             self.sample_uuid)
 
-    @mock.patch.object(client.KeystoneClientPlugin, 'client')
+    @mock.patch.object(keystone.KeystoneClientPlugin, 'client')
     def test_get_project_id_with_name(self, client_keystone):
         self._client.client.projects.get.side_effect = (keystone_exceptions
                                                         .NotFound)
@@ -407,7 +413,7 @@ class KeystoneClientPluginProjectTest(common.HeatTestCase):
         ]
 
         client_keystone.return_value = self._client
-        client_plugin = client.KeystoneClientPlugin(
+        client_plugin = keystone.KeystoneClientPlugin(
             context=mock.MagicMock()
         )
 
@@ -419,7 +425,7 @@ class KeystoneClientPluginProjectTest(common.HeatTestCase):
         self._client.client.projects.list.assert_called_once_with(
             name=self.sample_name)
 
-    @mock.patch.object(client.KeystoneClientPlugin, 'client')
+    @mock.patch.object(keystone.KeystoneClientPlugin, 'client')
     def test_get_project_id_not_found(self, client_keystone):
         self._client.client.projects.get.side_effect = (keystone_exceptions
                                                         .NotFound)
@@ -427,7 +433,7 @@ class KeystoneClientPluginProjectTest(common.HeatTestCase):
         ]
 
         client_keystone.return_value = self._client
-        client_plugin = client.KeystoneClientPlugin(
+        client_plugin = keystone.KeystoneClientPlugin(
             context=mock.MagicMock()
         )
 
@@ -459,13 +465,13 @@ class KeystoneClientPluginDomainTest(common.HeatTestCase):
         super(KeystoneClientPluginDomainTest, self).setUp()
         self._client = mock.MagicMock()
 
-    @mock.patch.object(client.KeystoneClientPlugin, 'client')
+    @mock.patch.object(keystone.KeystoneClientPlugin, 'client')
     def test_get_domain_id(self, client_keystone):
         self._client.client.domains.get.return_value = (self
                                                         ._get_mock_domain())
 
         client_keystone.return_value = self._client
-        client_plugin = client.KeystoneClientPlugin(
+        client_plugin = keystone.KeystoneClientPlugin(
             context=mock.MagicMock()
         )
 
@@ -474,7 +480,7 @@ class KeystoneClientPluginDomainTest(common.HeatTestCase):
         self._client.client.domains.get.assert_called_once_with(
             self.sample_uuid)
 
-    @mock.patch.object(client.KeystoneClientPlugin, 'client')
+    @mock.patch.object(keystone.KeystoneClientPlugin, 'client')
     def test_get_domain_id_with_name(self, client_keystone):
         self._client.client.domains.get.side_effect = (keystone_exceptions
                                                        .NotFound)
@@ -483,7 +489,7 @@ class KeystoneClientPluginDomainTest(common.HeatTestCase):
         ]
 
         client_keystone.return_value = self._client
-        client_plugin = client.KeystoneClientPlugin(
+        client_plugin = keystone.KeystoneClientPlugin(
             context=mock.MagicMock()
         )
 
@@ -495,7 +501,7 @@ class KeystoneClientPluginDomainTest(common.HeatTestCase):
         self._client.client.domains.list.assert_called_once_with(
             name=self.sample_name)
 
-    @mock.patch.object(client.KeystoneClientPlugin, 'client')
+    @mock.patch.object(keystone.KeystoneClientPlugin, 'client')
     def test_get_domain_id_not_found(self, client_keystone):
         self._client.client.domains.get.side_effect = (keystone_exceptions
                                                        .NotFound)
@@ -503,7 +509,7 @@ class KeystoneClientPluginDomainTest(common.HeatTestCase):
         ]
 
         client_keystone.return_value = self._client
-        client_plugin = client.KeystoneClientPlugin(
+        client_plugin = keystone.KeystoneClientPlugin(
             context=mock.MagicMock()
         )
 
@@ -535,13 +541,13 @@ class KeystoneClientPluginGroupTest(common.HeatTestCase):
         super(KeystoneClientPluginGroupTest, self).setUp()
         self._client = mock.MagicMock()
 
-    @mock.patch.object(client.KeystoneClientPlugin, 'client')
+    @mock.patch.object(keystone.KeystoneClientPlugin, 'client')
     def test_get_group_id(self, client_keystone):
         self._client.client.groups.get.return_value = (self
                                                        ._get_mock_group())
 
         client_keystone.return_value = self._client
-        client_plugin = client.KeystoneClientPlugin(
+        client_plugin = keystone.KeystoneClientPlugin(
             context=mock.MagicMock()
         )
 
@@ -550,7 +556,7 @@ class KeystoneClientPluginGroupTest(common.HeatTestCase):
         self._client.client.groups.get.assert_called_once_with(
             self.sample_uuid)
 
-    @mock.patch.object(client.KeystoneClientPlugin, 'client')
+    @mock.patch.object(keystone.KeystoneClientPlugin, 'client')
     def test_get_group_id_with_name(self, client_keystone):
         self._client.client.groups.get.side_effect = (keystone_exceptions
                                                       .NotFound)
@@ -559,7 +565,7 @@ class KeystoneClientPluginGroupTest(common.HeatTestCase):
         ]
 
         client_keystone.return_value = self._client
-        client_plugin = client.KeystoneClientPlugin(
+        client_plugin = keystone.KeystoneClientPlugin(
             context=mock.MagicMock()
         )
 
@@ -571,7 +577,7 @@ class KeystoneClientPluginGroupTest(common.HeatTestCase):
         self._client.client.groups.list.assert_called_once_with(
             name=self.sample_name)
 
-    @mock.patch.object(client.KeystoneClientPlugin, 'client')
+    @mock.patch.object(keystone.KeystoneClientPlugin, 'client')
     def test_get_group_id_not_found(self, client_keystone):
         self._client.client.groups.get.side_effect = (keystone_exceptions
                                                       .NotFound)
@@ -579,7 +585,7 @@ class KeystoneClientPluginGroupTest(common.HeatTestCase):
         ]
 
         client_keystone.return_value = self._client
-        client_plugin = client.KeystoneClientPlugin(
+        client_plugin = keystone.KeystoneClientPlugin(
             context=mock.MagicMock()
         )
 
@@ -611,12 +617,12 @@ class KeystoneClientPluginUserTest(common.HeatTestCase):
         super(KeystoneClientPluginUserTest, self).setUp()
         self._client = mock.MagicMock()
 
-    @mock.patch.object(client.KeystoneClientPlugin, 'client')
+    @mock.patch.object(keystone.KeystoneClientPlugin, 'client')
     def test_get_user_id(self, client_keystone):
         self._client.client.users.get.return_value = self._get_mock_user()
 
         client_keystone.return_value = self._client
-        client_plugin = client.KeystoneClientPlugin(
+        client_plugin = keystone.KeystoneClientPlugin(
             context=mock.MagicMock()
         )
 
@@ -625,7 +631,7 @@ class KeystoneClientPluginUserTest(common.HeatTestCase):
         self._client.client.users.get.assert_called_once_with(
             self.sample_uuid)
 
-    @mock.patch.object(client.KeystoneClientPlugin, 'client')
+    @mock.patch.object(keystone.KeystoneClientPlugin, 'client')
     def test_get_user_id_with_name(self, client_keystone):
         self._client.client.users.get.side_effect = (keystone_exceptions
                                                      .NotFound)
@@ -634,7 +640,7 @@ class KeystoneClientPluginUserTest(common.HeatTestCase):
         ]
 
         client_keystone.return_value = self._client
-        client_plugin = client.KeystoneClientPlugin(
+        client_plugin = keystone.KeystoneClientPlugin(
             context=mock.MagicMock()
         )
 
@@ -646,14 +652,14 @@ class KeystoneClientPluginUserTest(common.HeatTestCase):
         self._client.client.users.list.assert_called_once_with(
             name=self.sample_name)
 
-    @mock.patch.object(client.KeystoneClientPlugin, 'client')
+    @mock.patch.object(keystone.KeystoneClientPlugin, 'client')
     def test_get_user_id_not_found(self, client_keystone):
         self._client.client.users.get.side_effect = (keystone_exceptions
                                                      .NotFound)
         self._client.client.users.list.return_value = []
 
         client_keystone.return_value = self._client
-        client_plugin = client.KeystoneClientPlugin(
+        client_plugin = keystone.KeystoneClientPlugin(
             context=mock.MagicMock()
         )
 
@@ -685,12 +691,12 @@ class KeystoneClientPluginRegionTest(common.HeatTestCase):
         super(KeystoneClientPluginRegionTest, self).setUp()
         self._client = mock.MagicMock()
 
-    @mock.patch.object(client.KeystoneClientPlugin, 'client')
+    @mock.patch.object(keystone.KeystoneClientPlugin, 'client')
     def test_get_region_id(self, client_keystone):
         self._client.client.regions.get.return_value = self._get_mock_region()
 
         client_keystone.return_value = self._client
-        client_plugin = client.KeystoneClientPlugin(
+        client_plugin = keystone.KeystoneClientPlugin(
             context=mock.MagicMock()
         )
 
@@ -699,12 +705,12 @@ class KeystoneClientPluginRegionTest(common.HeatTestCase):
         self._client.client.regions.get.assert_called_once_with(
             self.sample_uuid)
 
-    @mock.patch.object(client.KeystoneClientPlugin, 'client')
+    @mock.patch.object(keystone.KeystoneClientPlugin, 'client')
     def test_get_region_id_not_found(self, client_keystone):
         self._client.client.regions.get.side_effect = (keystone_exceptions
                                                        .NotFound)
         client_keystone.return_value = self._client
-        client_plugin = client.KeystoneClientPlugin(
+        client_plugin = keystone.KeystoneClientPlugin(
             context=mock.MagicMock()
         )
 
diff --git a/heat/tests/common.py b/heat/tests/common.py
index 92b8d3ae9..0cb353c73 100644
--- a/heat/tests/common.py
+++ b/heat/tests/common.py
@@ -29,6 +29,7 @@ from heat.engine.clients.os import barbican
 from heat.engine.clients.os import cinder
 from heat.engine.clients.os import glance
 from heat.engine.clients.os import keystone
+from heat.engine.clients.os.keystone import keystone_constraints as ks_constr
 from heat.engine.clients.os.neutron import neutron_constraints as neutron
 from heat.engine.clients.os import nova
 from heat.engine.clients.os import sahara
@@ -41,7 +42,6 @@ from heat.tests import fakes
 from heat.tests import generic_resource as generic_rsrc
 from heat.tests import utils
 
-
 TEST_DEFAULT_LOGLEVELS = {'migrate': logging.WARN,
                           'sqlalchemy': logging.WARN,
                           'heat.engine.environment': logging.ERROR}
@@ -292,7 +292,7 @@ class HeatTestCase(testscenarios.WithScenarios,
         validate.return_value = True
 
     def stub_KeystoneProjectConstraint(self):
-        validate = self.patchobject(keystone.KeystoneProjectConstraint,
+        validate = self.patchobject(ks_constr.KeystoneProjectConstraint,
                                     'validate')
         validate.return_value = True
 
diff --git a/heat/tests/test_auth_password.py b/heat/tests/test_auth_password.py
index b931dfdb7..02a57abbb 100644
--- a/heat/tests/test_auth_password.py
+++ b/heat/tests/test_auth_password.py
@@ -26,7 +26,8 @@ from heat.common import auth_password
 from heat.tests import common
 
 
-cfg.CONF.import_opt('keystone_backend', 'heat.common.heat_keystoneclient')
+cfg.CONF.import_opt('keystone_backend',
+                    'heat.engine.clients.os.keystone.heat_keystoneclient')
 
 
 EXPECTED_ENV_RESPONSE = {
diff --git a/heat/tests/test_stack.py b/heat/tests/test_stack.py
index de54dcb17..9abcc3d6a 100644
--- a/heat/tests/test_stack.py
+++ b/heat/tests/test_stack.py
@@ -14,12 +14,12 @@
 import collections
 import copy
 import datetime
-import eventlet
-import fixtures
 import json
 import logging
 import time
 
+import eventlet
+import fixtures
 import mock
 import mox
 from oslo_config import cfg
diff --git a/heat/tests/test_stack_delete.py b/heat/tests/test_stack_delete.py
index 944e4e06b..03feaadc7 100644
--- a/heat/tests/test_stack_delete.py
+++ b/heat/tests/test_stack_delete.py
@@ -12,18 +12,18 @@
 #    under the License.
 
 import copy
-import fixtures
-from oslo_log import log as logging
 import time
 
-from keystoneclient import exceptions as kc_exceptions
+import fixtures
+from keystoneauth1 import exceptions as kc_exceptions
 import mock
+from oslo_log import log as logging
 
 from heat.common import exception
-from heat.common import heat_keystoneclient as hkc
 from heat.common import template_format
 from heat.common import timeutils
 from heat.engine.clients.os import keystone
+from heat.engine.clients.os.keystone import heat_keystoneclient as hkc
 from heat.engine import scheduler
 from heat.engine import stack
 from heat.engine import template