Merge lp:~openstack-charmers/charms/precise/mysql/ssl-everywhere into lp:charms/mysql

[Kapil Thangavelu]

SSL Support for MySQL

Adds a few additional configuration options for SSL.

'ssl' is the primary one, it can be 'off', 'on', or 'only'.

If its off, no changes. If its 'on' then ssl support is
enabled and ssl_ca cert is sent to clients along the relation.

If its only, then all clients must connect using ssl.

The server cert/key and ca cert can be provided via config. If
they are not, the service will act as its own ca, and also
in only mode will also generate client certs and pass them
along the relation (the client use of those certs is not
required atm).

https://codereview.appspot.com/68120043/

[Kapil Thangavelu (hazmat)]

Reviewers: mp+207904_code.launchpad.net,

Message:
Please take a look.

Description:
SSL Support for MySQL

Adds a few additional configuration options for SSL.

'ssl' is the primary one, it can be 'off', 'on', or 'only'.

If its off, no changes. If its 'on' then ssl support is
enabled and ssl_ca cert is sent to clients along the relation.

If its only, then all clients must connect using ssl.

The server cert/key and ca cert can be provided via config. If
they are not, the service will act as its own ca, and also
in only mode will also generate client certs and pass them
along the relation (the client use of those certs is not
required atm).

https://code.launchpad.net/~hazmat/charms/precise/mysql/ssl-everywhere/+merge/207904

(do not edit description out of merge proposal)

Please review this at https://codereview.appspot.com/68120043/

Affected files (+483, -135 lines):
   A [revision details]
   M config.yaml
   M hooks/common.py
   M hooks/config-changed
   M hooks/db-relation-joined
   M hooks/shared_db_relations.py
   M hooks/slave-relation-changed
   A hooks/sslca.py
   M revision

[Marco Ceppi (marcoceppi)]

I have some concerns about the way this affects the mysql interface
below. Overall, this is a great change and will bring security to
communication within a deployed environment, I'm open to discussion
about the points below - I simply want to make sure the charm stays as
compatible as possible as it grows.

https://codereview.appspot.com/68120043/diff/1/config.yaml
File config.yaml (right):

https://codereview.appspot.com/68120043/diff/1/config.yaml#newcode38
config.yaml:38: ssl_key:
I don't like that these are _'d while the majority of the configuration
options for MySQL are hypenated (with the exception of vip_iface, and
vip_cidr which I would have rejected had I maintained the charm at the
time). If there isn't a hard requirement for these to be _ then I'd
prefer if they followed the convention of the majority of the charm's
config.

https://codereview.appspot.com/68120043/diff/1/hooks/db-relation-joined
File hooks/db-relation-joined (right):

https://codereview.appspot.com/68120043/diff/1/hooks/db-relation-joined#newcode91
hooks/db-relation-joined:91: cmd.append("%s=%s" % (k, v))
With this, you're now overloading the mysql interface to the point
where, if a user deploys the MySQL charm, configures it for SSL, then
joins to a charm that doesn't know how to speak to MySQL on SSL with on
and off, no change (I assume), with ssl=only that charm just won't work.

Given the nature of this change, it seem more apt that this should be
implemented as a new interface, maybe mysql-ssl - so when you connect on
that interface and no ssl cert/ca/key are provided MySQL generates one,
otherwise uses the values provided by the configuration. In doing so
services can expose their compat with MySQL over SSL without having
cases that charms will break if MySQL is configured in a manner that's
too restrictive.

https://codereview.appspot.com/68120043/

[Kapil Thangavelu (hazmat)]

i disagree, i think that makes for a lousy experience to make a separate
interface, instead of adding ssl to one place now you have to reconfigure
your entire infrastructure to add it later (breaking and readding
relations, etc). Imagine trying to upgrade a production system to take
advantage of ssl.. instead of ugprade charm and config ssl, you now have to
break your entire production system. Its only the config ssl only that
forces the client to ssl. the ssl_ key names are chosen for consistency
with ssl support through the charm ecosystem, there are several others
already using these keys.

-k

On Thu, Feb 27, 2014 at 9:24 AM, Marco Ceppi <email address hidden> wrote:

> I have some concerns about the way this affects the mysql interface
> below. Overall, this is a great change and will bring security to
> communication within a deployed environment, I'm open to discussion
> about the points below - I simply want to make sure the charm stays as
> compatible as possible as it grows.
>
>
> https://codereview.appspot.com/68120043/diff/1/config.yaml
> File config.yaml (right):
>
> https://codereview.appspot.com/68120043/diff/1/config.yaml#newcode38
> config.yaml:38: ssl_key:
> I don't like that these are _'d while the majority of the configuration
> options for MySQL are hypenated (with the exception of vip_iface, and
> vip_cidr which I would have rejected had I maintained the charm at the
> time). If there isn't a hard requirement for these to be _ then I'd
> prefer if they followed the convention of the majority of the charm's
> config.
>
> https://codereview.appspot.com/68120043/diff/1/hooks/db-relation-joined
> File hooks/db-relation-joined (right):
>
>
> https://codereview.appspot.com/68120043/diff/1/hooks/db-relation-joined#newcode91
> hooks/db-relation-joined:91: cmd.append("%s=%s" % (k, v))
> With this, you're now overloading the mysql interface to the point
> where, if a user deploys the MySQL charm, configures it for SSL, then
> joins to a charm that doesn't know how to speak to MySQL on SSL with on
> and off, no change (I assume), with ssl=only that charm just won't work.
>
> Given the nature of this change, it seem more apt that this should be
> implemented as a new interface, maybe mysql-ssl - so when you connect on
> that interface and no ssl cert/ca/key are provided MySQL generates one,
> otherwise uses the values provided by the configuration. In doing so
> services can expose their compat with MySQL over SSL without having
> cases that charms will break if MySQL is configured in a manner that's
> too restrictive.
>
> https://codereview.appspot.com/68120043/
>
> --
>
> https://code.launchpad.net/~hazmat/charms/precise/mysql/ssl-everywhere/+merge/207904
> You are the owner of lp:~hazmat/charms/precise/mysql/ssl-everywhere.
>

[Kapil Thangavelu (hazmat)]

plus with that logic, your talking about 3 extra interfaces to mirror the
three client interfaces we have now on mysql. that seems silly.

On Thu, Feb 27, 2014 at 9:30 AM, Kapil Thangavelu <
<email address hidden>> wrote:

> i disagree, i think that makes for a lousy experience to make a separate
> interface, instead of adding ssl to one place now you have to reconfigure
> your entire infrastructure to add it later (breaking and readding
> relations, etc). Imagine trying to upgrade a production system to take
> advantage of ssl.. instead of ugprade charm and config ssl, you now have to
> break your entire production system. Its only the config ssl only that
> forces the client to ssl. the ssl_ key names are chosen for consistency
> with ssl support through the charm ecosystem, there are several others
> already using these keys.
>
> -k
>
>
>
> On Thu, Feb 27, 2014 at 9:24 AM, Marco Ceppi <email address hidden> wrote:
>
>> I have some concerns about the way this affects the mysql interface
>> below. Overall, this is a great change and will bring security to
>> communication within a deployed environment, I'm open to discussion
>> about the points below - I simply want to make sure the charm stays as
>> compatible as possible as it grows.
>>
>>
>> https://codereview.appspot.com/68120043/diff/1/config.yaml
>> File config.yaml (right):
>>
>> https://codereview.appspot.com/68120043/diff/1/config.yaml#newcode38
>> config.yaml:38: ssl_key:
>> I don't like that these are _'d while the majority of the configuration
>> options for MySQL are hypenated (with the exception of vip_iface, and
>> vip_cidr which I would have rejected had I maintained the charm at the
>> time). If there isn't a hard requirement for these to be _ then I'd
>> prefer if they followed the convention of the majority of the charm's
>> config.
>>
>> https://codereview.appspot.com/68120043/diff/1/hooks/db-relation-joined
>> File hooks/db-relation-joined (right):
>>
>>
>> https://codereview.appspot.com/68120043/diff/1/hooks/db-relation-joined#newcode91
>> hooks/db-relation-joined:91<https://codereview.appspot.com/68120043/diff/1/hooks/db-relation-joined#newcode91hooks/db-relation-joined:91>:
>> cmd.append("%s=%s" % (k, v))
>> With this, you're now overloading the mysql interface to the point
>> where, if a user deploys the MySQL charm, configures it for SSL, then
>> joins to a charm that doesn't know how to speak to MySQL on SSL with on
>> and off, no change (I assume), with ssl=only that charm just won't work.
>>
>> Given the nature of this change, it seem more apt that this should be
>> implemented as a new interface, maybe mysql-ssl - so when you connect on
>> that interface and no ssl cert/ca/key are provided MySQL generates one,
>> otherwise uses the values provided by the configuration. In doing so
>> services can expose their compat with MySQL over SSL without having
>> cases that charms will break if MySQL is configured in a manner that's
>> too restrictive.
>>
>> https://codereview.appspot.com/68120043/
>>
>> --
>>
>> https://code.launchpad.net/~hazmat/charms/precise/mysql/ssl-everywhere/+merge/207904
>> You are the owner of lp:~hazmat/charms/precise/mysql/ssl-everywhere....

[Kapil Thangavelu (hazmat)]

fwiw, i'm refactoring up this branch a bit to use charm-helpers and to cleanly re-configure existing relations when the setting changes at runtime. the core feature functionality is the same though, so the interface extension discussion remains.

[Marco Ceppi (marcoceppi)]

LGTM! Thanks!

review: Approve

[Marco Ceppi (marcoceppi)]

There's some merge conflicts against trunk. Could you please resolve these, I tried my best but am uncertain about a few portions.

review: Needs Resubmitting

Unmerged revisions

135. By Kapil Thangavelu on 2014-03-05

use the normalized request instead of the unit data

134. By Kapil Thangavelu on 2014-03-04

on multi-request shared db relations, redo grants for all requests if needed

133. By Kapil Thangavelu on 2014-03-03

skip relation reconfig if relation has no units

132. By Kapil Thangavelu on 2014-03-01

fix errant python code in mysql charm

131. By Kapil Thangavelu on 2014-03-01

update configure_source with pocket split

130. By Kapil Thangavelu on 2014-03-01

add cloud-archive pockets for havana and icehouse

129. By Kapil Thangavelu on 2014-03-01

merge ceph client from cloud archive support

128. By Kapil Thangavelu on 2014-03-01

don't process queued relations

127. By Kapil Thangavelu on 2014-03-01

only reconfigure client ssl if on master

126. By Kapil Thangavelu on 2014-03-01

handle no user when revoking grant

=== added file 'Makefile'
--- Makefile	1970-01-01 00:00:00 +0000
+++ Makefile	2014-03-05 02:21:45 +0000
@@ -0,0 +1,10 @@
+#!/usr/bin/make
+PYTHON := /usr/bin/env python
+
+lint:
+	@flake8 --exclude hooks/charmhelpers hooks
+	@flake8 --exclude hooks/charmhelpers unit_tests
+	@charm proof
+
+sync:
+	@charm-helper-sync -c charm-helpers.yaml

=== added file 'charm-helpers.yaml'
--- charm-helpers.yaml	1970-01-01 00:00:00 +0000
+++ charm-helpers.yaml	2014-03-05 02:21:45 +0000
@@ -0,0 +1,5 @@
+branch: lp:~openstack-charmers/charm-helpers/ssl-everywhere
+destination: hooks/charmhelpers
+include:
+    - core
+    - contrib.ssl
\ No newline at end of file

=== modified file 'config.yaml'
--- config.yaml	2014-02-04 21:48:28 +0000
+++ config.yaml	2014-03-05 02:21:45 +0000
@@ -31,6 +31,24 @@
         default: 'MIXED'
         type: string
         description: If binlogging is enabled, this is the format that will be used. Ignored when tuning-level == fast.
+    ssl:
+        default: 'off'
+        type: string
+        description: Enable SSL connections on mysql, valid values are 'off', 'on', and 'only'
+    ssl_key:
+        type: string
+        description: Private unencrypted key base64 encoded PEM format
+        default: ""
+    ssl_cert:
+        type: string
+        description: X.509 certificate in base64 encoded PEM format
+        default: ""
+    ssl_ca:
+        type: string
+        description: |
+          Certificate authority cert that signed cert. Optional if the ssl_cert is signed by a ca
+          recognized by the os. Base64 encoded value.
+        default: ""
     vip:
         type: string
         default: ''
@@ -72,9 +90,26 @@
         default: 2
         type: int
         description: |
-            This value dictates the number of replicas ceph must make of any
-            object it stores within the mysql rbd pool. Of course, this only
-            applies if using Ceph as a backend store. Note that once the mysql
-            rbd pool has been created, changing this value will not have any
-            effect (although it can be changed in ceph by manually configuring
-            your ceph cluster).
+          This value dictates the number of replicas ceph must make of any
+          object it stores within the mysql rbd pool. Of course, this only
+          applies if using Ceph as a backend store. Note that once the mysql
+          rbd pool has been created, changing this value will not have any
+          effect (although it can be changed in ceph by manually configuring
+          your ceph cluster).
+    openstack-origin:
+        default: distro
+        type: string
+        description: |
+          Repository from which to install ceph.  May be one of the following:
+          distro (default), ppa:somecustom/ppa, a deb url sources entry,
+          or a supported Cloud Archive release pocket.
+
+          Supported Cloud Archive sources include: cloud:precise-folsom,
+          cloud:precise-folsom/updates, cloud:precise-folsom/staging,
+          cloud:precise-folsom/proposed.
+
+          Note that updating this setting to a source that is known to
+          provide a later version of OpenStack will trigger a software
+          upgrade.
+
+          Also note that this setting is used only when adding relation to CEPH.

=== added directory 'hooks/charmhelpers'
=== added file 'hooks/charmhelpers/__init__.py'
=== added directory 'hooks/charmhelpers/contrib'
=== added file 'hooks/charmhelpers/contrib/__init__.py'
=== added directory 'hooks/charmhelpers/contrib/ssl'
=== added file 'hooks/charmhelpers/contrib/ssl/__init__.py'
--- hooks/charmhelpers/contrib/ssl/__init__.py	1970-01-01 00:00:00 +0000
+++ hooks/charmhelpers/contrib/ssl/__init__.py	2014-03-05 02:21:45 +0000
@@ -0,0 +1,78 @@
+import subprocess
+from charmhelpers.core import hookenv
+
+
+def generate_selfsigned(keyfile, certfile, keysize="1024", config=None, subject=None, cn=None):
+    """Generate selfsigned SSL keypair
+
+    You must provide one of the 3 optional arguments:
+    config, subject or cn
+    If more than one is provided the leftmost will be used
+
+    Arguments:
+    keyfile -- (required) full path to the keyfile to be created
+    certfile -- (required) full path to the certfile to be created
+    keysize -- (optional) SSL key length
+    config -- (optional) openssl configuration file
+    subject -- (optional) dictionary with SSL subject variables
+    cn -- (optional) cerfificate common name
+
+    Required keys in subject dict:
+    cn -- Common name (eq. FQDN)
+
+    Optional keys in subject dict
+    country -- Country Name (2 letter code)
+    state -- State or Province Name (full name)
+    locality -- Locality Name (eg, city)
+    organization -- Organization Name (eg, company)
+    organizational_unit -- Organizational Unit Name (eg, section)
+    email -- Email Address
+    """
+
+    cmd = []
+    if config:
+        cmd = ["/usr/bin/openssl", "req", "-new", "-newkey",
+               "rsa:{}".format(keysize), "-days", "365", "-nodes", "-x509",
+               "-keyout", keyfile,
+               "-out", certfile, "-config", config]
+    elif subject:
+        ssl_subject = ""
+        if "country" in subject:
+            ssl_subject = ssl_subject + "/C={}".format(subject["country"])
+        if "state" in subject:
+            ssl_subject = ssl_subject + "/ST={}".format(subject["state"])
+        if "locality" in subject:
+            ssl_subject = ssl_subject + "/L={}".format(subject["locality"])
+        if "organization" in subject:
+            ssl_subject = ssl_subject + "/O={}".format(subject["organization"])
+        if "organizational_unit" in subject:
+            ssl_subject = ssl_subject + "/OU={}".format(subject["organizational_unit"])
+        if "cn" in subject:
+            ssl_subject = ssl_subject + "/CN={}".format(subject["cn"])
+        else:
+            hookenv.log("When using \"subject\" argument you must "
+                        "provide \"cn\" field at very least")
+            return False
+        if "email" in subject:
+            ssl_subject = ssl_subject + "/emailAddress={}".format(subject["email"])
+
+        cmd = ["/usr/bin/openssl", "req", "-new", "-newkey",
+               "rsa:{}".format(keysize), "-days", "365", "-nodes", "-x509",
+               "-keyout", keyfile,
+               "-out", certfile, "-subj", ssl_subject]
+    elif cn:
+        cmd = ["/usr/bin/openssl", "req", "-new", "-newkey",
+               "rsa:{}".format(keysize), "-days", "365", "-nodes", "-x509",
+               "-keyout", keyfile,
+               "-out", certfile, "-subj", "/CN={}".format(cn)]
+
+    if not cmd:
+        hookenv.log("No config, subject or cn provided,"
+                    "unable to generate self signed SSL certificates")
+        return False
+    try:
+        subprocess.check_call(cmd)
+        return True
+    except Exception as e:
+        print "Execution of openssl command failed:\n{}".format(e)
+        return False

=== added file 'hooks/charmhelpers/contrib/ssl/service.py'
--- hooks/charmhelpers/contrib/ssl/service.py	1970-01-01 00:00:00 +0000
+++ hooks/charmhelpers/contrib/ssl/service.py	2014-03-05 02:21:45 +0000
@@ -0,0 +1,267 @@
+import logging
+import os
+from os.path import join as path_join
+from os.path import exists
+import subprocess
+
+
+log = logging.getLogger("service_ca")
+
+logging.basicConfig(level=logging.DEBUG)
+
+STD_CERT = "standard"
+
+# Mysql server is fairly picky about cert creation
+# and types, spec its creation separately for now.
+MYSQL_CERT = "mysql"
+
+
+class ServiceCA(object):
+
+    default_expiry = str(365 * 2)
+    default_ca_expiry = str(365 * 6)
+
+    def __init__(self, name, ca_dir, cert_type=STD_CERT):
+        self.name = name
+        self.ca_dir = ca_dir
+        self.cert_type = cert_type
+
+    ###############
+    # Hook Helper API
+    @staticmethod
+    def get_ca(type=STD_CERT):
+        service_name = os.environ['JUJU_UNIT_NAME'].split('/')[0]
+        ca_path = os.path.join(os.environ['CHARM_DIR'], 'ca')
+        ca = ServiceCA(service_name, ca_path, type)
+        ca.init()
+        return ca
+
+    @classmethod
+    def get_service_cert(cls, type=STD_CERT):
+        service_name = os.environ['JUJU_UNIT_NAME'].split('/')[0]
+        ca = cls.get_ca()
+        crt, key = ca.get_or_create_cert(service_name)
+        return crt, key, ca.get_ca_bundle()
+
+    ###############
+
+    def init(self):
+        log.debug("initializing service ca")
+        if not exists(self.ca_dir):
+            self._init_ca_dir(self.ca_dir)
+            self._init_ca()
+
+    @property
+    def ca_key(self):
+        return path_join(self.ca_dir, 'private', 'cacert.key')
+
+    @property
+    def ca_cert(self):
+        return path_join(self.ca_dir, 'cacert.pem')
+
+    @property
+    def ca_conf(self):
+        return path_join(self.ca_dir, 'ca.cnf')
+
+    @property
+    def signing_conf(self):
+        return path_join(self.ca_dir, 'signing.cnf')
+
+    def _init_ca_dir(self, ca_dir):
+        os.mkdir(ca_dir)
+        for i in ['certs', 'crl', 'newcerts', 'private']:
+            sd = path_join(ca_dir, i)
+            if not exists(sd):
+                os.mkdir(sd)
+
+        if not exists(path_join(ca_dir, 'serial')):
+            with open(path_join(ca_dir, 'serial'), 'wb') as fh:
+                fh.write('02\n')
+
+        if not exists(path_join(ca_dir, 'index.txt')):
+            with open(path_join(ca_dir, 'index.txt'), 'wb') as fh:
+                fh.write('')
+
+    def _init_ca(self):
+        """Generate the root ca's cert and key.
+        """
+        if not exists(path_join(self.ca_dir, 'ca.cnf')):
+            with open(path_join(self.ca_dir, 'ca.cnf'), 'wb') as fh:
+                fh.write(
+                    CA_CONF_TEMPLATE % (self.get_conf_variables()))
+
+        if not exists(path_join(self.ca_dir, 'signing.cnf')):
+            with open(path_join(self.ca_dir, 'signing.cnf'), 'wb') as fh:
+                fh.write(
+                    SIGNING_CONF_TEMPLATE % (self.get_conf_variables()))
+
+        if exists(self.ca_cert) or exists(self.ca_key):
+            raise RuntimeError("Initialized called when CA already exists")
+        cmd = ['openssl', 'req', '-config', self.ca_conf,
+               '-x509', '-nodes', '-newkey', 'rsa',
+               '-days', self.default_ca_expiry,
+               '-keyout', self.ca_key, '-out', self.ca_cert,
+               '-outform', 'PEM']
+        output = subprocess.check_output(cmd, stderr=subprocess.STDOUT)
+        log.debug("CA Init:\n %s", output)
+
+    def get_conf_variables(self):
+        return dict(
+            org_name="juju",
+            org_unit_name="%s service" % self.name,
+            common_name=self.name,
+            ca_dir=self.ca_dir)
+
+    def get_or_create_cert(self, common_name):
+        if common_name in self:
+            return self.get_certificate(common_name)
+        return self.create_certificate(common_name)
+
+    def create_certificate(self, common_name):
+        if common_name in self:
+            return self.get_certificate(common_name)
+        key_p = path_join(self.ca_dir, "certs", "%s.key" % common_name)
+        crt_p = path_join(self.ca_dir, "certs", "%s.crt" % common_name)
+        csr_p = path_join(self.ca_dir, "certs", "%s.csr" % common_name)
+        self._create_certificate(common_name, key_p, csr_p, crt_p)
+        return self.get_certificate(common_name)
+
+    def get_certificate(self, common_name):
+        if not common_name in self:
+            raise ValueError("No certificate for %s" % common_name)
+        key_p = path_join(self.ca_dir, "certs", "%s.key" % common_name)
+        crt_p = path_join(self.ca_dir, "certs", "%s.crt" % common_name)
+        with open(crt_p) as fh:
+            crt = fh.read()
+        with open(key_p) as fh:
+            key = fh.read()
+        return crt, key
+
+    def __contains__(self, common_name):
+        crt_p = path_join(self.ca_dir, "certs", "%s.crt" % common_name)
+        return exists(crt_p)
+
+    def _create_certificate(self, common_name, key_p, csr_p, crt_p):
+        template_vars = self.get_conf_variables()
+        template_vars['common_name'] = common_name
+        subj = '/O=%(org_name)s/OU=%(org_unit_name)s/CN=%(common_name)s' % (
+            template_vars)
+
+        log.debug("CA Create Cert %s", common_name)
+        cmd = ['openssl', 'req', '-sha1', '-newkey', 'rsa:2048',
+               '-nodes', '-days', self.default_expiry,
+               '-keyout', key_p, '-out', csr_p, '-subj', subj]
+        subprocess.check_call(cmd)
+        cmd = ['openssl', 'rsa', '-in', key_p, '-out', key_p]
+        subprocess.check_call(cmd)
+
+        log.debug("CA Sign Cert %s", common_name)
+        if self.cert_type == MYSQL_CERT:
+            cmd = ['openssl', 'x509', '-req',
+                   '-in', csr_p, '-days', self.default_expiry,
+                   '-CA', self.ca_cert, '-CAkey', self.ca_key,
+                   '-set_serial', '01', '-out', crt_p]
+        else:
+            cmd = ['openssl', 'ca', '-config', self.signing_conf,
+                   '-extensions', 'req_extensions',
+                   '-days', self.default_expiry, '-notext',
+                   '-in', csr_p, '-out', crt_p, '-subj', subj, '-batch']
+        log.debug("running %s", " ".join(cmd))
+        subprocess.check_call(cmd)
+
+    def get_ca_bundle(self):
+        with open(self.ca_cert) as fh:
+            return fh.read()
+
+
+CA_CONF_TEMPLATE = """
+[ ca ]
+default_ca = CA_default
+
+[ CA_default ]
+dir                     = %(ca_dir)s
+policy                  = policy_match
+database                = $dir/index.txt
+serial                  = $dir/serial
+certs                   = $dir/certs
+crl_dir                 = $dir/crl
+new_certs_dir           = $dir/newcerts
+certificate             = $dir/cacert.pem
+private_key             = $dir/private/cacert.key
+RANDFILE                = $dir/private/.rand
+default_md              = default
+
+[ req ]
+default_bits            = 1024
+default_md              = sha1
+
+prompt                  = no
+distinguished_name      = ca_distinguished_name
+
+x509_extensions         = ca_extensions
+
+[ ca_distinguished_name ]
+organizationName        = %(org_name)s
+organizationalUnitName  = %(org_unit_name)s Certificate Authority
+
+
+[ policy_match ]
+countryName             = optional
+stateOrProvinceName     = optional
+organizationName        = match
+organizationalUnitName  = optional
+commonName              = supplied
+
+[ ca_extensions ]
+basicConstraints        = critical,CA:true
+subjectKeyIdentifier    = hash
+authorityKeyIdentifier  = keyid:always, issuer
+keyUsage                = cRLSign, keyCertSign
+"""
+
+
+SIGNING_CONF_TEMPLATE = """
+[ ca ]
+default_ca = CA_default
+
+[ CA_default ]
+dir                     = %(ca_dir)s
+policy                  = policy_match
+database                = $dir/index.txt
+serial                  = $dir/serial
+certs                   = $dir/certs
+crl_dir                 = $dir/crl
+new_certs_dir           = $dir/newcerts
+certificate             = $dir/cacert.pem
+private_key             = $dir/private/cacert.key
+RANDFILE                = $dir/private/.rand
+default_md              = default
+
+[ req ]
+default_bits            = 1024
+default_md              = sha1
+
+prompt                  = no
+distinguished_name      = req_distinguished_name
+
+x509_extensions         = req_extensions
+
+[ req_distinguished_name ]
+organizationName        = %(org_name)s
+organizationalUnitName  = %(org_unit_name)s machine resources
+commonName              = %(common_name)s
+
+[ policy_match ]
+countryName             = optional
+stateOrProvinceName     = optional
+organizationName        = match
+organizationalUnitName  = optional
+commonName              = supplied
+
+[ req_extensions ]
+basicConstraints        = CA:false
+subjectKeyIdentifier    = hash
+authorityKeyIdentifier  = keyid:always, issuer
+keyUsage                = digitalSignature, keyEncipherment, keyAgreement
+extendedKeyUsage        = serverAuth, clientAuth
+"""

=== added directory 'hooks/charmhelpers/core'
=== added file 'hooks/charmhelpers/core/__init__.py'
=== added file 'hooks/charmhelpers/core/hookenv.py'
--- hooks/charmhelpers/core/hookenv.py	1970-01-01 00:00:00 +0000
+++ hooks/charmhelpers/core/hookenv.py	2014-03-05 02:21:45 +0000
@@ -0,0 +1,401 @@
+"Interactions with the Juju environment"
+# Copyright 2013 Canonical Ltd.
+#
+# Authors:
+#  Charm Helpers Developers <[e-mail]>
+
+import os
+import json
+import yaml
+import subprocess
+import sys
+import UserDict
+from subprocess import CalledProcessError
+
+CRITICAL = "CRITICAL"
+ERROR = "ERROR"
+WARNING = "WARNING"
+INFO = "INFO"
+DEBUG = "DEBUG"
+MARKER = object()
+
+cache = {}
+
+
+def cached(func):
+    """Cache return values for multiple executions of func + args
+
+    For example:
+
+        @cached
+        def unit_get(attribute):
+            pass
+
+        unit_get('test')
+
+    will cache the result of unit_get + 'test' for future calls.
+    """
+    def wrapper(*args, **kwargs):
+        global cache
+        key = str((func, args, kwargs))
+        try:
+            return cache[key]
+        except KeyError:
+            res = func(*args, **kwargs)
+            cache[key] = res
+            return res
+    return wrapper
+
+
+def flush(key):
+    """Flushes any entries from function cache where the
+    key is found in the function+args """
+    flush_list = []
+    for item in cache:
+        if key in item:
+            flush_list.append(item)
+    for item in flush_list:
+        del cache[item]
+
+
+def log(message, level=None):
+    """Write a message to the juju log"""
+    command = ['juju-log']
+    if level:
+        command += ['-l', level]
+    command += [message]
+    subprocess.call(command)
+
+
+class Serializable(UserDict.IterableUserDict):
+    """Wrapper, an object that can be serialized to yaml or json"""
+
+    def __init__(self, obj):
+        # wrap the object
+        UserDict.IterableUserDict.__init__(self)
+        self.data = obj
+
+    def __getattr__(self, attr):
+        # See if this object has attribute.
+        if attr in ("json", "yaml", "data"):
+            return self.__dict__[attr]
+        # Check for attribute in wrapped object.
+        got = getattr(self.data, attr, MARKER)
+        if got is not MARKER:
+            return got
+        # Proxy to the wrapped object via dict interface.
+        try:
+            return self.data[attr]
+        except KeyError:
+            raise AttributeError(attr)
+
+    def __getstate__(self):
+        # Pickle as a standard dictionary.
+        return self.data
+
+    def __setstate__(self, state):
+        # Unpickle into our wrapper.
+        self.data = state
+
+    def json(self):
+        """Serialize the object to json"""
+        return json.dumps(self.data)
+
+    def yaml(self):
+        """Serialize the object to yaml"""
+        return yaml.dump(self.data)
+
+
+def execution_environment():
+    """A convenient bundling of the current execution context"""
+    context = {}
+    context['conf'] = config()
+    if relation_id():
+        context['reltype'] = relation_type()
+        context['relid'] = relation_id()
+        context['rel'] = relation_get()
+    context['unit'] = local_unit()
+    context['rels'] = relations()
+    context['env'] = os.environ
+    return context
+
+
+def in_relation_hook():
+    """Determine whether we're running in a relation hook"""
+    return 'JUJU_RELATION' in os.environ
+
+
+def relation_type():
+    """The scope for the current relation hook"""
+    return os.environ.get('JUJU_RELATION', None)
+
+
+def relation_id():
+    """The relation ID for the current relation hook"""
+    return os.environ.get('JUJU_RELATION_ID', None)
+
+
+def local_unit():
+    """Local unit ID"""
+    return os.environ['JUJU_UNIT_NAME']
+
+
+def remote_unit():
+    """The remote unit for the current relation hook"""
+    return os.environ['JUJU_REMOTE_UNIT']
+
+
+def service_name():
+    """The name service group this unit belongs to"""
+    return local_unit().split('/')[0]
+
+
+def hook_name():
+    """The name of the currently executing hook"""
+    return os.path.basename(sys.argv[0])
+
+
+@cached
+def config(scope=None):
+    """Juju charm configuration"""
+    config_cmd_line = ['config-get']
+    if scope is not None:
+        config_cmd_line.append(scope)
+    config_cmd_line.append('--format=json')
+    try:
+        return json.loads(subprocess.check_output(config_cmd_line))
+    except ValueError:
+        return None
+
+
+@cached
+def relation_get(attribute=None, unit=None, rid=None):
+    """Get relation information"""
+    _args = ['relation-get', '--format=json']
+    if rid:
+        _args.append('-r')
+        _args.append(rid)
+    _args.append(attribute or '-')
+    if unit:
+        _args.append(unit)
+    try:
+        return json.loads(subprocess.check_output(_args))
+    except ValueError:
+        return None
+    except CalledProcessError, e:
+        if e.returncode == 2:
+            return None
+        raise
+
+
+def relation_set(relation_id=None, relation_settings={}, **kwargs):
+    """Set relation information for the current unit"""
+    relation_cmd_line = ['relation-set']
+    if relation_id is not None:
+        relation_cmd_line.extend(('-r', relation_id))
+    for k, v in (relation_settings.items() + kwargs.items()):
+        if v is None:
+            relation_cmd_line.append('{}='.format(k))
+        else:
+            relation_cmd_line.append('{}={}'.format(k, v))
+    subprocess.check_call(relation_cmd_line)
+    # Flush cache of any relation-gets for local unit
+    flush(local_unit())
+
+
+@cached
+def relation_ids(reltype=None):
+    """A list of relation_ids"""
+    reltype = reltype or relation_type()
+    relid_cmd_line = ['relation-ids', '--format=json']
+    if reltype is not None:
+        relid_cmd_line.append(reltype)
+        return json.loads(subprocess.check_output(relid_cmd_line)) or []
+    return []
+
+
+@cached
+def related_units(relid=None):
+    """A list of related units"""
+    relid = relid or relation_id()
+    units_cmd_line = ['relation-list', '--format=json']
+    if relid is not None:
+        units_cmd_line.extend(('-r', relid))
+    return json.loads(subprocess.check_output(units_cmd_line)) or []
+
+
+@cached
+def relation_for_unit(unit=None, rid=None):
+    """Get the json represenation of a unit's relation"""
+    unit = unit or remote_unit()
+    relation = relation_get(unit=unit, rid=rid)
+    for key in relation:
+        if key.endswith('-list'):
+            relation[key] = relation[key].split()
+    relation['__unit__'] = unit
+    return relation
+
+
+@cached
+def relations_for_id(relid=None):
+    """Get relations of a specific relation ID"""
+    relation_data = []
+    relid = relid or relation_ids()
+    for unit in related_units(relid):
+        unit_data = relation_for_unit(unit, relid)
+        unit_data['__relid__'] = relid
+        relation_data.append(unit_data)
+    return relation_data
+
+
+@cached
+def relations_of_type(reltype=None):
+    """Get relations of a specific type"""
+    relation_data = []
+    reltype = reltype or relation_type()
+    for relid in relation_ids(reltype):
+        for relation in relations_for_id(relid):
+            relation['__relid__'] = relid
+            relation_data.append(relation)
+    return relation_data
+
+
+@cached
+def relation_types():
+    """Get a list of relation types supported by this charm"""
+    charmdir = os.environ.get('CHARM_DIR', '')
+    mdf = open(os.path.join(charmdir, 'metadata.yaml'))
+    md = yaml.safe_load(mdf)
+    rel_types = []
+    for key in ('provides', 'requires', 'peers'):
+        section = md.get(key)
+        if section:
+            rel_types.extend(section.keys())
+    mdf.close()
+    return rel_types
+
+
+@cached
+def relations():
+    """Get a nested dictionary of relation data for all related units"""
+    rels = {}
+    for reltype in relation_types():
+        relids = {}
+        for relid in relation_ids(reltype):
+            units = {local_unit(): relation_get(unit=local_unit(), rid=relid)}
+            for unit in related_units(relid):
+                reldata = relation_get(unit=unit, rid=relid)
+                units[unit] = reldata
+            relids[relid] = units
+        rels[reltype] = relids
+    return rels
+
+
+@cached
+def is_relation_made(relation, keys='private-address'):
+    '''
+    Determine whether a relation is established by checking for
+    presence of key(s).  If a list of keys is provided, they
+    must all be present for the relation to be identified as made
+    '''
+    if isinstance(keys, str):
+        keys = [keys]
+    for r_id in relation_ids(relation):
+        for unit in related_units(r_id):
+            context = {}
+            for k in keys:
+                context[k] = relation_get(k, rid=r_id,
+                                          unit=unit)
+            if None not in context.values():
+                return True
+    return False
+
+
+def open_port(port, protocol="TCP"):
+    """Open a service network port"""
+    _args = ['open-port']
+    _args.append('{}/{}'.format(port, protocol))
+    subprocess.check_call(_args)
+
+
+def close_port(port, protocol="TCP"):
+    """Close a service network port"""
+    _args = ['close-port']
+    _args.append('{}/{}'.format(port, protocol))
+    subprocess.check_call(_args)
+
+
+@cached
+def unit_get(attribute):
+    """Get the unit ID for the remote unit"""
+    _args = ['unit-get', '--format=json', attribute]
+    try:
+        return json.loads(subprocess.check_output(_args))
+    except ValueError:
+        return None
+
+
+def unit_private_ip():
+    """Get this unit's private IP address"""
+    return unit_get('private-address')
+
+
+class UnregisteredHookError(Exception):
+    """Raised when an undefined hook is called"""
+    pass
+
+
+class Hooks(object):
+    """A convenient handler for hook functions.
+
+    Example:
+        hooks = Hooks()
+
+        # register a hook, taking its name from the function name
+        @hooks.hook()
+        def install():
+            ...
+
+        # register a hook, providing a custom hook name
+        @hooks.hook("config-changed")
+        def config_changed():
+            ...
+
+        if __name__ == "__main__":
+            # execute a hook based on the name the program is called by
+            hooks.execute(sys.argv)
+    """
+
+    def __init__(self):
+        super(Hooks, self).__init__()
+        self._hooks = {}
+
+    def register(self, name, function):
+        """Register a hook"""
+        self._hooks[name] = function
+
+    def execute(self, args):
+        """Execute a registered hook based on args[0]"""
+        hook_name = os.path.basename(args[0])
+        if hook_name in self._hooks:
+            self._hooks[hook_name]()
+        else:
+            raise UnregisteredHookError(hook_name)
+
+    def hook(self, *hook_names):
+        """Decorator, registering them as hooks"""
+        def wrapper(decorated):
+            for hook_name in hook_names:
+                self.register(hook_name, decorated)
+            else:
+                self.register(decorated.__name__, decorated)
+                if '_' in decorated.__name__:
+                    self.register(
+                        decorated.__name__.replace('_', '-'), decorated)
+            return decorated
+        return wrapper
+
+
+def charm_dir():
+    """Return the root directory of the current charm"""
+    return os.environ.get('CHARM_DIR')

=== added file 'hooks/charmhelpers/core/host.py'
--- hooks/charmhelpers/core/host.py	1970-01-01 00:00:00 +0000
+++ hooks/charmhelpers/core/host.py	2014-03-05 02:21:45 +0000
@@ -0,0 +1,297 @@
+"""Tools for working with the host system"""
+# Copyright 2012 Canonical Ltd.
+#
+# Authors:
+#  Nick Moffitt <[e-mail]>
+#  Matthew Wedgwood <[e-mail]>
+
+import os
+import pwd
+import grp
+import random
+import string
+import subprocess
+import hashlib
+
+from collections import OrderedDict
+
+from hookenv import log
+
+
+def service_start(service_name):
+    """Start a system service"""
+    return service('start', service_name)
+
+
+def service_stop(service_name):
+    """Stop a system service"""
+    return service('stop', service_name)
+
+
+def service_restart(service_name):
+    """Restart a system service"""
+    return service('restart', service_name)
+
+
+def service_reload(service_name, restart_on_failure=False):
+    """Reload a system service, optionally falling back to restart if reload fails"""
+    service_result = service('reload', service_name)
+    if not service_result and restart_on_failure:
+        service_result = service('restart', service_name)
+    return service_result
+
+
+def service(action, service_name):
+    """Control a system service"""
+    cmd = ['service', service_name, action]
+    return subprocess.call(cmd) == 0
+
+
+def service_running(service):
+    """Determine whether a system service is running"""
+    try:
+        output = subprocess.check_output(['service', service, 'status'])
+    except subprocess.CalledProcessError:
+        return False
+    else:
+        if ("start/running" in output or "is running" in output):
+            return True
+        else:
+            return False
+
+
+def adduser(username, password=None, shell='/bin/bash', system_user=False):
+    """Add a user to the system"""
+    try:
+        user_info = pwd.getpwnam(username)
+        log('user {0} already exists!'.format(username))
+    except KeyError:
+        log('creating user {0}'.format(username))
+        cmd = ['useradd']
+        if system_user or password is None:
+            cmd.append('--system')
+        else:
+            cmd.extend([
+                '--create-home',
+                '--shell', shell,
+                '--password', password,
+            ])
+        cmd.append(username)
+        subprocess.check_call(cmd)
+        user_info = pwd.getpwnam(username)
+    return user_info
+
+
+def add_user_to_group(username, group):
+    """Add a user to a group"""
+    cmd = [
+        'gpasswd', '-a',
+        username,
+        group
+    ]
+    log("Adding user {} to group {}".format(username, group))
+    subprocess.check_call(cmd)
+
+
+def rsync(from_path, to_path, flags='-r', options=None):
+    """Replicate the contents of a path"""
+    options = options or ['--delete', '--executability']
+    cmd = ['/usr/bin/rsync', flags]
+    cmd.extend(options)
+    cmd.append(from_path)
+    cmd.append(to_path)
+    log(" ".join(cmd))
+    return subprocess.check_output(cmd).strip()
+
+
+def symlink(source, destination):
+    """Create a symbolic link"""
+    log("Symlinking {} as {}".format(source, destination))
+    cmd = [
+        'ln',
+        '-sf',
+        source,
+        destination,
+    ]
+    subprocess.check_call(cmd)
+
+
+def mkdir(path, owner='root', group='root', perms=0555, force=False):
+    """Create a directory"""
+    log("Making dir {} {}:{} {:o}".format(path, owner, group,
+                                          perms))
+    uid = pwd.getpwnam(owner).pw_uid
+    gid = grp.getgrnam(group).gr_gid
+    realpath = os.path.abspath(path)
+    if os.path.exists(realpath):
+        if force and not os.path.isdir(realpath):
+            log("Removing non-directory file {} prior to mkdir()".format(path))
+            os.unlink(realpath)
+    else:
+        os.makedirs(realpath, perms)
+    os.chown(realpath, uid, gid)
+
+
+def write_file(path, content, owner='root', group='root', perms=0444):
+    """Create or overwrite a file with the contents of a string"""
+    log("Writing file {} {}:{} {:o}".format(path, owner, group, perms))
+    uid = pwd.getpwnam(owner).pw_uid
+    gid = grp.getgrnam(group).gr_gid
+    with open(path, 'w') as target:
+        os.fchown(target.fileno(), uid, gid)
+        os.fchmod(target.fileno(), perms)
+        target.write(content)
+
+
+def mount(device, mountpoint, options=None, persist=False):
+    """Mount a filesystem at a particular mountpoint"""
+    cmd_args = ['mount']
+    if options is not None:
+        cmd_args.extend(['-o', options])
+    cmd_args.extend([device, mountpoint])
+    try:
+        subprocess.check_output(cmd_args)
+    except subprocess.CalledProcessError, e:
+        log('Error mounting {} at {}\n{}'.format(device, mountpoint, e.output))
+        return False
+    if persist:
+        # TODO: update fstab
+        pass
+    return True
+
+
+def umount(mountpoint, persist=False):
+    """Unmount a filesystem"""
+    cmd_args = ['umount', mountpoint]
+    try:
+        subprocess.check_output(cmd_args)
+    except subprocess.CalledProcessError, e:
+        log('Error unmounting {}\n{}'.format(mountpoint, e.output))
+        return False
+    if persist:
+        # TODO: update fstab
+        pass
+    return True
+
+
+def mounts():
+    """Get a list of all mounted volumes as [[mountpoint,device],[...]]"""
+    with open('/proc/mounts') as f:
+        # [['/mount/point','/dev/path'],[...]]
+        system_mounts = [m[1::-1] for m in [l.strip().split()
+                                            for l in f.readlines()]]
+    return system_mounts
+
+
+def file_hash(path):
+    """Generate a md5 hash of the contents of 'path' or None if not found """
+    if os.path.exists(path):
+        h = hashlib.md5()
+        with open(path, 'r') as source:
+            h.update(source.read())  # IGNORE:E1101 - it does have update
+        return h.hexdigest()
+    else:
+        return None
+
+
+def restart_on_change(restart_map, stopstart=False):
+    """Restart services based on configuration files changing
+
+    This function is used a decorator, for example
+
+        @restart_on_change({
+            '/etc/ceph/ceph.conf': [ 'cinder-api', 'cinder-volume' ]
+            })
+        def ceph_client_changed():
+            ...
+
+    In this example, the cinder-api and cinder-volume services
+    would be restarted if /etc/ceph/ceph.conf is changed by the
+    ceph_client_changed function.
+    """
+    def wrap(f):
+        def wrapped_f(*args):
+            checksums = {}
+            for path in restart_map:
+                checksums[path] = file_hash(path)
+            f(*args)
+            restarts = []
+            for path in restart_map:
+                if checksums[path] != file_hash(path):
+                    restarts += restart_map[path]
+            services_list = list(OrderedDict.fromkeys(restarts))
+            if not stopstart:
+                for service_name in services_list:
+                    service('restart', service_name)
+            else:
+                for action in ['stop', 'start']:
+                    for service_name in services_list:
+                        service(action, service_name)
+        return wrapped_f
+    return wrap
+
+
+def lsb_release():
+    """Return /etc/lsb-release in a dict"""
+    d = {}
+    with open('/etc/lsb-release', 'r') as lsb:
+        for l in lsb:
+            k, v = l.split('=')
+            d[k.strip()] = v.strip()
+    return d
+
+
+def pwgen(length=None):
+    """Generate a random pasword."""
+    if length is None:
+        length = random.choice(range(35, 45))
+    alphanumeric_chars = [
+        l for l in (string.letters + string.digits)
+        if l not in 'l0QD1vAEIOUaeiou']
+    random_chars = [
+        random.choice(alphanumeric_chars) for _ in range(length)]
+    return(''.join(random_chars))
+
+
+def list_nics(nic_type):
+    '''Return a list of nics of given type(s)'''
+    if isinstance(nic_type, basestring):
+        int_types = [nic_type]
+    else:
+        int_types = nic_type
+    interfaces = []
+    for int_type in int_types:
+        cmd = ['ip', 'addr', 'show', 'label', int_type + '*']
+        ip_output = subprocess.check_output(cmd).split('\n')
+        ip_output = (line for line in ip_output if line)
+        for line in ip_output:
+            if line.split()[1].startswith(int_type):
+                interfaces.append(line.split()[1].replace(":", ""))
+    return interfaces
+
+
+def set_nic_mtu(nic, mtu):
+    '''Set MTU on a network interface'''
+    cmd = ['ip', 'link', 'set', nic, 'mtu', mtu]
+    subprocess.check_call(cmd)
+
+
+def get_nic_mtu(nic):
+    cmd = ['ip', 'addr', 'show', nic]
+    ip_output = subprocess.check_output(cmd).split('\n')
+    mtu = ""
+    for line in ip_output:
+        words = line.split()
+        if 'mtu' in words:
+            mtu = words[words.index("mtu") + 1]
+    return mtu
+
+
+def get_nic_hwaddr(nic):
+    cmd = ['ip', '-o', '-0', 'addr', 'show', nic]
+    ip_output = subprocess.check_output(cmd)
+    hwaddr = ""
+    words = ip_output.split()
+    if 'link/ether' in words:
+        hwaddr = words[words.index('link/ether') + 1]
+    return hwaddr

=== modified file 'hooks/common.py'
--- hooks/common.py	2013-02-12 17:54:29 +0000
+++ hooks/common.py	2014-03-05 02:21:45 +0000
@@ -1,15 +1,228 @@
 # vim: syntax=python
 
+import contextlib
+import base64
+import itertools
+# import json
 import os
-import sys
 import MySQLdb
+import _mysql
+import socket
 import subprocess
-import uuid
+import sys
+
+from charmhelpers.core.hookenv import (
+    config, relation_get, relation_set, relation_ids, related_units,
+    unit_get, log)
+
+from charmhelpers.contrib.ssl.service import ServiceCA, MYSQL_CERT
+
 
 def get_service_user_file(service):
     return '/var/lib/mysql/%s.service_user2' % service
 
 
+def get_service_ca():
+    service_name = os.environ['JUJU_UNIT_NAME'].split('/')[0]
+    ca_path = os.path.join(os.environ['CHARM_DIR'], 'ca')
+    ca = ServiceCA(service_name, ca_path, MYSQL_CERT)
+    ca.init()
+    return ca
+
+
+def is_ext_ssl_ca():
+    ssl_key = configs.get('ssl_key')
+    ssl_cert = configs.get('ssl_cert')
+    return all((ssl_key, ssl_cert))
+
+
+def _convert_from_base64(v):
+    # Play nice when user hands pem encoded value for cert/key/ca
+    # as they are base64 compliant strings.
+    if not v:
+        return v
+    if v.startswith('-----BEGIN'):
+        return v
+    try:
+        return base64.b64decode(v)
+    except TypeError:
+        return v
+
+
+def configure_service_ssl(configs):
+    if not configs.get('ssl', 'off').strip() in ('on', 'only'):
+        configs['ssl_cert_marker'] = configs['ssl_ca_marker'] = "#"
+        if not slave:
+            reconfigure_client_ssl(False)
+        return
+
+    service_name = os.environ.get('JUJU_UNIT_NAME').split('/')[0]
+    ssl_cert, ssl_key, ssl_ca = (
+        configs.get('ssl_cert'), configs.get('ssl_key'), configs.get('ssl_ca'))
+
+    if any((ssl_cert, ssl_key, ssl_ca)):
+        if not all((ssl_cert, ssl_key)):
+            log("ERROR",
+                "SSL Key and cert are both required if either specified")
+            sys.exit(1)
+        ssl_cert = _convert_from_base64(ssl_cert)
+        ssl_key = _convert_from_base64(ssl_key)
+        if ssl_ca:
+            ssl_ca = _convert_from_base64(ssl_ca)
+    else:
+        ca = get_service_ca()
+        ssl_cert, ssl_key = ca.create_certificate(service_name)
+        ssl_ca = ca.get_ca_bundle()
+
+    # Config variables for template
+    configs['ssl_cert_marker'] = ''
+
+    if ssl_ca:  # In case a user providers cert but no ca cause its official.
+        configs['ssl_ca_marker'] = ''
+        with open('/etc/mysql/cacert.pem', 'w') as fh:
+            fh.write(ssl_ca)
+    with open('/etc/mysql/server-cert.pem', 'w') as fh:
+        fh.write(ssl_cert)
+    with open('/etc/mysql/server-key.pem', 'w') as fh:
+        fh.write(ssl_key)
+
+    if not slave:
+        ssl_only = configs.get('ssl', 'off') == 'only'
+        reconfigure_client_ssl(True, ssl_only)
+
+
+def normalize_db_requests(data):
+    single_request = set(('username', 'database', 'hostname'))
+    if single_request.issubset(data):
+        return [data]
+
+    requests = {}
+    for k, v in data.items():
+        prefix = k.split('_')[0]
+        x = '_'.join(k.split('_')[1:])
+        req = requests.setdefault(prefix, {})
+        req[x] = v
+        req['prefix'] = prefix
+    return requests.values()
+
+
+def reconfigure_client_ssl(ssl_enabled, ssl_only=False):
+    log("Checking on reconfiguration for ssl clients")
+    for rel_type, rid in itertools.chain(
+            itertools.izip(
+                itertools.repeat('db'), relation_ids('db')),
+            itertools.izip(
+                itertools.repeat('db-admin'), relation_ids('db-admin')),
+            itertools.izip(
+                itertools.repeat('shared-db'), relation_ids('shared-db'))):
+
+        rdata = relation_get(rid=rid, unit=os.environ['JUJU_UNIT_NAME'])
+
+        # If the relation is already configured for the current settings
+        # move on to next.
+        if (('ssl_ca' in rdata and ssl_enabled) or
+                (not 'ssl_ca' in rdata and not ssl_enabled)):
+            continue
+
+        log("Reconfiguring relation:%s for ssl:%s" % (rid, ssl_enabled))
+
+        # Update relation data with correct ssl info based on current config.
+        if ('ssl_ca' in rdata and not ssl_enabled):
+            # Blank any existing ssl config values.
+            relation_set(relation_id=rid, ssl_ca="", ssl_cert="", ssl_key="")
+        elif is_ext_ssl_ca():
+            relation_set(relation_id=rid, ssl_ca=configs.get('ssl_ca', ''))
+        else:
+            # Setup ssl
+            units = related_units(rid)
+            if not units:
+                # Relation hasn't been initialized yet, skip
+                continue
+            ssl_data = configure_client_ssl(remote_unit=units[0])
+            relation_set(relation_id=rid, **ssl_data)
+
+        # Update grants based on relation type if we're switching to/from only.
+        if rel_type == "shared-db":
+            # Update grant for related units
+            for u in related_units(rid):
+                u_rdata = relation_get(rid=rid, unit=u)
+
+                # Check if we haven't processed this the relation and
+                # its queued for the future.
+                if not rdata.get('db_host'):
+                    continue
+
+                for req in normalize_db_requests(u_rdata):
+                    if not all((req.get('username'),
+                                req.get('database'), req.get('hostname'))):
+                        # Relation not complete
+                        continue
+
+                    remote_ip = get_remote_ip(req.get('hostname'))
+                    requires_ssl = requires_ssl_access(
+                        req['username'], remote_ip)
+
+                    # Do nothing if we have the right grant for our config
+                    if ssl_only and requires_ssl:
+                        continue
+                    elif not ssl_only and not requires_ssl:
+                        continue
+
+                    # Else remove and re-grant
+                    password = rdata.get('password')
+                    if 'prefix' in req:
+                        password = rdata['%s_password' % req['prefix']]
+
+                    revoke_grant(
+                        req['database'], req['username'], remote_ip)
+                    create_grant(
+                        req['database'], req['username'], remote_ip, password)
+
+        elif rel_type in ("db", "db-admin"):
+            units = related_units(rid)
+            svc = units[0].split("/", 1)[0]
+            svc_user, svc_password = get_service_user(svc)
+            requires_ssl = requires_ssl_access(svc_user)
+
+            if rel_type == "db-admin":
+                svc = "*"
+            # Do nothing if we have the right grant for our config
+            if ssl_only and requires_ssl:
+                continue
+            elif not ssl_only and not requires_ssl:
+                continue
+            privileges = "all privileges"
+            if slave:
+                privileges = "select"
+            revoke_grant(svc, svc_user)
+            create_grant(svc, svc_user, svc_password, privileges=privileges)
+
+
+def configure_client_ssl(remote_unit=None):
+    if configs.get('ssl', '') not in ('only', 'on'):
+        return dict()
+
+    if is_ext_ssl_ca():
+        if configs.get('ssl_ca'):
+            return dict(ssl_ca=configs['ssl_ca'])
+        return
+
+    # self-managed-client-certs
+    if remote_unit is None:
+        remote_unit = change_unit
+
+    ca = get_service_ca()
+    ca_bundle = ca.get_ca_bundle()
+
+    service_cert, service_key = ca.get_or_create_cert(
+        remote_unit.split('/', 1)[0])
+
+    return dict(
+        ssl_ca=base64.b64encode(ca_bundle),
+        ssl_key=base64.b64encode(service_key),
+        ssl_cert=base64.b64encode(service_cert))
+
+
 def get_service_user(service):
     if service == '':
         return (None, None)
@@ -17,11 +230,13 @@
     if os.path.exists(sfile):
         with open(sfile, 'r') as f:
             return (f.readline().strip(), f.readline().strip())
-    (suser, service_password) = subprocess.check_output(['pwgen', '-N 2', '15']).strip().split("\n")
+    (suser, service_password) = subprocess.check_output(
+        ['pwgen', '-N 2', '15']).strip().split("\n")
     with open(sfile, 'w') as f:
         f.write("%s\n" % suser)
         f.write("%s\n" % service_password)
         f.flush()
+        os.chmod(f.name, 0600)
     return (suser, service_password)
 
 
@@ -45,16 +260,20 @@
     with open(database_name_file, 'r') as dbname:
         database_name = dbname.readline().strip()
 else:
-    print 'No established database and no REMOTE_UNIT.'
+    log('No established database and no REMOTE_UNIT.')
+
 # A user per service unit so we can deny access quickly
 user, service_password = get_service_user(database_name)
 connection = None
-lastrun_path = '/var/lib/juju/%s.%s.lastrun' % (database_name,user)
+lastrun_path = '/var/lib/juju/%s.%s.lastrun' % (database_name, user)
 slave_configured_path = '/var/lib/juju.slave.configured.for.%s' % database_name
 slave_configured = os.path.exists(slave_configured_path)
 slave = os.path.exists('/var/lib/juju/i.am.a.slave')
 broken_path = '/var/lib/juju/%s.mysql.broken' % database_name
 broken = os.path.exists(broken_path)
+local_hostname = unit_get('private-address')
+configs = config()
+
 
 def get_db_cursor():
     # Connect to mysql
@@ -73,47 +292,112 @@
     return db_name in databases
 
 
-def create_database(db_name):
-    cursor = get_db_cursor()
-    try:
-        cursor.execute("CREATE DATABASE {}".format(db_name))
-    finally:
-        cursor.close()
+def get_remote_ip(hostname):
+    if hostname != local_hostname:
+        remote_ip = socket.gethostbyname(hostname)
+    else:
+        remote_ip = '127.0.0.1'
+    return remote_ip
+
+
+def create_database(db_name, character_set="utf8"):
+    with contextlib.closing(get_db_cursor()) as cursor:
+        stmt = "create database {}"
+        if character_set:
+            stmt += " character set %s" % character_set
+        stmt = stmt.format(db_name)
+        log("Running SQL %s" % stmt)
+        cursor.execute(stmt)
 
 
 def grant_exists(db_name, db_user, remote_ip):
     cursor = get_db_cursor()
     try:
-        cursor.execute("SHOW GRANTS for '{}'@'{}'".format(db_user,
-                                                          remote_ip))
+        stmt = "SHOW GRANTS for '{}'@'{}'".format(db_user, remote_ip)
+        print "Running SQL", stmt
+        cursor.execute(stmt)
         grants = [i[0] for i in cursor.fetchall()]
     except MySQLdb.OperationalError:
-        print "No grants found"
-        return False
-    finally:
-        cursor.close()
-    return "GRANT ALL PRIVILEGES ON `{}`".format(db_name) in grants
-
-
-def create_grant(db_name, db_user,
-                 remote_ip, password):
-    cursor = get_db_cursor()
-    try:
-        cursor.execute("GRANT ALL PRIVILEGES ON {}.* TO '{}'@'{}' "\
-                       "IDENTIFIED BY '{}'".format(db_name,
-                                                   db_user,
-                                                   remote_ip,
-                                                   password))
-    finally:
-        cursor.close()
-
-
-def cleanup_grant(db_user,
-                  remote_ip):
-    cursor = get_db_cursor()
-    try:
-        cursor.execute("DROP FROM mysql.user WHERE user='{}' "\
-                       "AND HOST='{}'".format(db_user,
-                                              remote_ip))
-    finally:
-        cursor.close()
+        log("No grants found")
+        return False
+    finally:
+        cursor.close()
+    found = "GRANT ALL PRIVILEGES ON `{}`".format(db_name) in grants
+    log('grants found %s %s' % (found, grants))
+    return found
+
+
+def requires_ssl_access(db_user, remote_ip=None):
+    with contextlib.closing(get_db_cursor()) as cursor:
+        stmt = "select User, ssl_type from mysql.user where User='%s'" % (
+            db_user)
+        if remote_ip:
+            stmt + " Host='%s'" % remote_ip
+        log("Running SQL %s" % stmt)
+        rows = cursor.execute(stmt)
+        if not rows:
+            log("ssl grant check -> no grants found for %s" % db_user)
+            return False
+        if rows > 1:
+            log("ssl grant check -> multiple grants found for %s and %s" % (
+                db_user, remote_ip))
+        result = cursor.fetchall()[0]
+        if result[1] == "ANY":
+            log("ssl grant check -> user %s requires ssl" % db_user)
+            return True
+        log("ssl grant check -> user %s does not need ssl" % db_user)
+        return False
+
+
+def create_grant(db_name, db_user, password, remote_ip=None,
+                 privileges="all privileges"):
+    params = [db_name, db_user, password]
+    grant = "GRANT %s ON {}.* TO '{}'" % privileges
+
+    if remote_ip:
+        grant += " @'{}'"
+        params.append(remote_ip)
+
+    if password:
+        grant += " IDENTIFIED BY '{}'"
+
+    # http://dev.mysql.com/doc/refman/5.5/en/grant.html
+    if configs.get('ssl') == 'only' and password:
+        grant += ' REQUIRE SSL'
+
+    with contextlib.closing(get_db_cursor()) as cursor:
+        output_params = list(params)
+        output_params[-1] = "xxx"
+        log("Running SQL %s" % (grant.format(*output_params)))
+        cursor.execute(grant.format(*params))
+
+
+def revoke_grant(db_name, user, remote_ip=None, privileges="privileges"):
+    with contextlib.closing(get_db_cursor()) as cursor:
+        # Unclear how to reset the ssl attribute on a user without
+        # dropping them. minor mitigation, mysql won't drop existing
+        # connections for the user existing sessions are closed.
+        stmt = "revoke all %s on %s.* from '%s'" % (
+            privileges, db_name, user)
+        if remote_ip:
+            stmt += "@'%s'" % remote_ip
+        log("Running SQL %s" % stmt)
+        try:
+            cursor.execute(stmt)
+        except _mysql.OperationalError, e:
+            # http://dev.mysql.com/doc/refman/5.5/en/error-messages-server.html
+            # Catch MySQL no such grant error.
+            if not e.args[0] == 1141:
+                raise
+
+        stmt = "drop user '%s'" % user
+        if remote_ip:
+            stmt += "@'%s'" % remote_ip
+        log("Running SQL %s" % stmt)
+
+        try:
+            cursor.execute(stmt)
+        except _mysql.OperationalError, e:
+            # Catch mysql cannot drop user (no such user)
+            if not e.args[0] in (1396, 1449):
+                raise

=== modified file 'hooks/config-changed'
--- hooks/config-changed	2014-02-15 21:37:45 +0000
+++ hooks/config-changed	2014-03-05 02:21:45 +0000
@@ -1,5 +1,6 @@
 #!/usr/bin/python
 
+from base64 import b64decode
 from subprocess import check_output,check_call, CalledProcessError, Popen, PIPE
 import tempfile
 import json
@@ -10,6 +11,8 @@
 import platform
 from string import upper
 
+from common import configure_service_ssl, configs
+
 num_re = re.compile('^[0-9]+$')
 
 # There should be a library for this
@@ -48,7 +51,6 @@
 if IS_32BIT_SYSTEM:
     check_call(['juju-log','-l','INFO','32bit system restrictions in play'])
 
-configs=json.loads(check_output(['config-get','--format=json']))
 
 def get_memtotal():
     with open('/proc/meminfo') as meminfo_file:
@@ -153,6 +155,10 @@
 else:
     configs['max-connections'] = 'max_connections = %s' % configs['max-connections']
 
+
+configure_service_ssl(configs)
+
+
 template="""
 ######################################
 #
@@ -171,7 +177,7 @@
 # You can copy this to one of:
 # - "/etc/mysql/my.cnf" to set global options,
 # - "~/.my.cnf" to set user-specific options.
-# 
+#
 # One can use all long options that the program supports.
 # Run program with --help to get a list of available options and with
 # --print-defaults to see which it would actually understand and use.
@@ -181,7 +187,7 @@
 
 # This will be passed to all mysql clients
 # It has been reported that passwords should be enclosed with ticks/quotes
-# escpecially if they contain "#" chars...
+# escpecially if they contain '#' chars...
 # Remember to edit /etc/mysql/debian.cnf when changing the socket location.
 [client]
 port		= 3306
@@ -277,9 +283,9 @@
 #
 # For generating SSL certificates I recommend the OpenSSL GUI "tinyca".
 #
-# ssl-ca=/etc/mysql/cacert.pem
-# ssl-cert=/etc/mysql/server-cert.pem
-# ssl-key=/etc/mysql/server-key.pem
+%(ssl_ca_marker)s ssl-ca=/etc/mysql/cacert.pem
+%(ssl_cert_marker)s ssl-cert=/etc/mysql/server-cert.pem
+%(ssl_cert_marker)s ssl-key=/etc/mysql/server-key.pem
 
 
 
@@ -326,7 +332,7 @@
 
 need_restart = False
 for target,content in targets.iteritems():
-    tdir = os.path.dirname(target) 
+    tdir = os.path.dirname(target)
     if len(content) == 0 and os.path.exists(target):
         os.unlink(target)
         need_restart = True

=== modified file 'hooks/db-relation-joined'
--- hooks/db-relation-joined	2012-11-02 06:41:12 +0000
+++ hooks/db-relation-joined	2014-03-05 02:21:45 +0000
@@ -1,22 +1,37 @@
 #!/usr/bin/env python
 
-from common import *
-
-import urllib
-import subprocess
+from common import (
+    configure_client_ssl,
+    create_database,
+    create_grant,
+    database_exists,
+    get_db_cursor,
+    revoke_grant)
+
+# Module import initialized variables (TODO: Remove?)
+from common import (
+    broken,
+    broken_path,
+    database_name,
+    database_name_file,
+    service_password,
+    slave,
+    user)
+
+from charmhelpers.core.hookenv import relation_set, unit_get
+
+import contextlib
 import os
 import sys
-import string
-import random
-import pickle
+import subprocess
 
-cursor = get_db_cursor()
 
 admin = os.path.basename(sys.argv[0]) == 'db-admin-relation-joined'
 
 def runsql(sql):
-	print "[%s]" % sql
-	cursor.execute(sql)
+    with contextlib.closing(get_db_cursor()) as cursor:
+        print "[%s]" % sql
+        cursor.execute(sql)
 
 runsql(
     "grant replication client on *.* to `%s` identified by '%s'"  % (
@@ -25,63 +40,46 @@
 
 if slave and not admin:
     try:
-        runsql(
-            "revoke all on `%s`.* from `%s`"  % (
-            database_name,   
-            user))
+        revoke_grant(database_name, user, privileges="")
     except:
         print "revoke failed, ignoring error"
-    runsql(
-        "grant select on `%s`.* to `%s`"  % (
-        database_name,   
-        user))
+    create_grant(database_name, user, None, privileges="select")
 else:
     if admin:
-        runsql(
-            "grant all privileges on *.* to `%s` identified by '%s'" % (
-            user,
-            service_password))
+        create_grant("*", user, service_password)
     else:
-        runsql(
-            "grant all on `%s`.* to `%s` identified by '%s'" % (
-            database_name,
-            user,
-            service_password))
+        create_grant(database_name, user, service_password)
 
-hostname = subprocess.check_output(['unit-get','private-address']).strip()
+hostname = unit_get('private-address')
 
 print str(["relation-set",
- "database=%s" % database_name,
- "user=%s" % user,
- "password=%s" % service_password,
- 'host=%s' % hostname,
- 'slave=%s' % slave])
+           "database=%s" % database_name,
+           "user=%s" % user,
+           'host=%s' % hostname,
+           'slave=%s' % slave])
 
 # Create new database or touch slave.configured file
 if slave:
     open(slave_configured_path,'w').close()
 elif not broken and not admin:
-  # Find existing databases
-  cursor.execute("show databases")
-  databases = [i[0] for i in cursor.fetchall()]
-  if database_name in databases:
+  if database_exists(database_name):
       print "database exists already"
   else:
       if not broken and not admin:
-          runsql("create database `%s` character set utf8" % database_name)
+          create_database(database_name)
           with open(database_name_file, 'w') as dbname:
               dbname.write(database_name)
 
 if broken:
     os.unlink(broken_path)
 
-cursor.close()
-
 # Store new values in relation settings.
-subprocess.call(
-    ["relation-set",
-     "database=%s" % database_name,
-     "user=%s" % user,
-     "password=%s" % service_password,
-     'host=%s' % hostname,
-     'slave=%s' % slave,])
+rdata = dict(
+    database=database_name,
+    host=hostname,
+    user=user,
+    password=service_password,
+    slave=slave)
+rdata.update(configure_client_ssl())
+relation_set(**rdata)
+

=== modified file 'hooks/ha_relations.py'
--- hooks/ha_relations.py	2014-02-13 18:51:20 +0000
+++ hooks/ha_relations.py	2014-03-05 02:21:45 +0000
@@ -92,6 +92,7 @@
 
 def ceph_joined():
     utils.juju_log('INFO', 'Start Ceph Relation Joined')
+    utils.configure_source()
     ceph.install()
     utils.juju_log('INFO', 'Finish Ceph Relation Joined')
 

=== modified file 'hooks/lib/ceph_utils.py'
--- hooks/lib/ceph_utils.py	2014-02-13 21:34:18 +0000
+++ hooks/lib/ceph_utils.py	2014-03-05 02:21:45 +0000
@@ -165,8 +165,10 @@
     hosts = []
     for r_id in utils.relation_ids('ceph'):
         for unit in utils.relation_list(r_id):
-            hosts.append(utils.relation_get('private-address',
-                                            unit=unit, rid=r_id))
+            ceph_public_addr = utils.relation_get(
+                'ceph_public_addr', unit=unit, rid=r_id) or \
+                utils.relation_get('private-address', unit=unit, rid=r_id)
+            hosts.append(ceph_public_addr)
     return hosts
 
 

=== modified file 'hooks/lib/utils.py'
--- hooks/lib/utils.py	2013-03-18 10:47:05 +0000
+++ hooks/lib/utils.py	2014-03-05 02:21:45 +0000
@@ -55,13 +55,13 @@
 
 def render_template(template_name, context, template_dir=TEMPLATES_DIR):
     templates = jinja2.Environment(
-                    loader=jinja2.FileSystemLoader(template_dir)
-                    )
+        loader=jinja2.FileSystemLoader(template_dir))
     template = templates.get_template(template_name)
     return template.render(context)
 
 CLOUD_ARCHIVE = \
-""" # Ubuntu Cloud Archive
+"""
+# Ubuntu Cloud Archive
 deb http://ubuntu-cloud.archive.canonical.com/ubuntu {} main
 """
 
@@ -71,7 +71,13 @@
     'folsom/proposed': 'precise-proposed/folsom',
     'grizzly': 'precise-updates/grizzly',
     'grizzly/updates': 'precise-updates/grizzly',
-    'grizzly/proposed': 'precise-proposed/grizzly'
+    'grizzly/proposed': 'precise-proposed/grizzly',
+    'havana': 'precise-updates/havana',
+    'havana/updates': 'precise-updates/havana',
+    'havana/proposed': 'precise-proposed/havana',
+    'icehouse': 'precise-updates/icehouse',
+    'icehouse/updates': 'precise-updates/icehouse',
+    'icehouse/proposed': 'precise-proposed/icehouse',
     }
 
 
@@ -86,8 +92,11 @@
             ]
         subprocess.check_call(cmd)
     if source.startswith('cloud:'):
+        # CA values should be formatted as cloud:ubuntu-openstack/pocket, eg:
+        #   cloud:precise-folsom/updates or cloud:precise-folsom/proposed
         install('ubuntu-cloud-keyring')
         pocket = source.split(':')[1]
+        pocket = pocket.split('-')[1]
         with open('/etc/apt/sources.list.d/cloud-archive.list', 'w') as apt:
             apt.write(CLOUD_ARCHIVE.format(CLOUD_ARCHIVE_POCKETS[pocket]))
     if source.startswith('deb'):

=== modified file 'hooks/shared_db_relations.py'
--- hooks/shared_db_relations.py	2013-07-10 16:32:52 +0000
+++ hooks/shared_db_relations.py	2014-03-05 02:21:45 +0000
@@ -11,15 +11,21 @@
 from common import (
     database_exists,
     create_database,
+    configure_client_ssl,
     grant_exists,
-    create_grant
-    )
-import subprocess
+    create_grant,
+    configs,
+    change_unit,
+    get_service_ca,
+    get_remote_ip)
+
+import functools
 import json
-import socket
-import os
 import lib.utils as utils
 import lib.cluster_utils as cluster
+import os
+import subprocess
+
 
 LEADER_RES = 'res_mysql_vip'
 
@@ -29,44 +35,34 @@
 
 
 def relation_get():
-    return json.loads(subprocess.check_output(
-                        ['relation-get',
-                         '--format',
-                         'json']
-                        )
-                      )
+    return json.loads(
+        subprocess.check_output(['relation-get', '--format', 'json']))
+
+
+local_hostname = utils.unit_get('private-address')
+
+
+def configure_db(hostname, database, username):
+    passwd_file = "/var/lib/mysql/mysql-{}.passwd".format(username)
+    remote_ip = get_remote_ip(hostname)
+
+    if not os.path.exists(passwd_file):
+        password = pwgen()
+        with open(passwd_file, 'w') as pfile:
+            pfile.write(password)
+            os.chmod(pfile.name, 0600)
+    else:
+        with open(passwd_file) as pfile:
+            password = pfile.read().strip()
+
+    if not database_exists(database):
+        create_database(database, None)
+    if not grant_exists(database, username, remote_ip):
+        create_grant(database, username, remote_ip, password)
+    return password
 
 
 def shared_db_changed():
-
-    def configure_db(hostname,
-                     database,
-                     username):
-        passwd_file = "/var/lib/mysql/mysql-{}.passwd"\
-                        .format(username)
-        if hostname != local_hostname:
-            remote_ip = socket.gethostbyname(hostname)
-        else:
-            remote_ip = '127.0.0.1'
-
-        if not os.path.exists(passwd_file):
-            password = pwgen()
-            with open(passwd_file, 'w') as pfile:
-                pfile.write(password)
-        else:
-            with open(passwd_file) as pfile:
-                password = pfile.read().strip()
-
-        if not database_exists(database):
-            create_database(database)
-        if not grant_exists(database,
-                            username,
-                            remote_ip):
-            create_grant(database,
-                         username,
-                         remote_ip, password)
-        return password
-
     if not cluster.eligible_leader(LEADER_RES):
         utils.juju_log('INFO',
                        'MySQL service is peered, bailing shared-db relation'
@@ -74,64 +70,62 @@
         return
 
     settings = relation_get()
-    local_hostname = utils.unit_get('private-address')
-    singleset = set([
-        'database',
-        'username',
-        'hostname'
-        ])
+    singleset = set(['database', 'username', 'hostname'])
+
+    if configs.get('ssl', '').strip() in ('on', 'only'):
+        client_ssl = configure_client_ssl()
+        relation_set = functools.partial(utils.relation_set, **client_ssl)
+    else:
+        relation_set = utils.relation_set
 
     if singleset.issubset(settings):
         # Process a single database configuration
-        password = configure_db(settings['hostname'],
-                                settings['database'],
-                                settings['username'])
+        password = configure_db(
+            settings['hostname'], settings['database'], settings['username'])
         if not cluster.is_clustered():
-            utils.relation_set(db_host=local_hostname,
-                               password=password)
+            relation_set(db_host=local_hostname, password=password)
         else:
-            utils.relation_set(db_host=utils.config_get("vip"),
-                               password=password)
+            relation_set(db_host=utils.config_get("vip"), password=password)
+        return
 
+    # Process multiple database setup requests.
+    # from incoming relation data:
+    #  nova_database=xxx nova_username=xxx nova_hostname=xxx
+    #  quantum_database=xxx quantum_username=xxx quantum_hostname=xxx
+    # create
+    #{
+    #   "nova": {
+    #        "username": xxx,
+    #        "database": xxx,
+    #        "hostname": xxx
+    #    },
+    #    "quantum": {
+    #        "username": xxx,
+    #        "database": xxx,
+    #        "hostname": xxx
+    #    }
+    #}
+    #
+    databases = {}
+    for k, v in settings.iteritems():
+        db = k.split('_')[0]
+        x = '_'.join(k.split('_')[1:])
+        if db not in databases:
+            databases[db] = {}
+        databases[db][x] = v
+    return_data = {}
+    for db in databases:
+        if singleset.issubset(databases[db]):
+            return_data['_'.join([db, 'password'])] = \
+                configure_db(databases[db]['hostname'],
+                             databases[db]['database'],
+                             databases[db]['username'])
+    if len(return_data) > 0:
+        relation_set(**return_data)
+    if not cluster.is_clustered():
+        relation_set(db_host=local_hostname)
     else:
-        # Process multiple database setup requests.
-        # from incoming relation data:
-        #  nova_database=xxx nova_username=xxx nova_hostname=xxx
-        #  quantum_database=xxx quantum_username=xxx quantum_hostname=xxx
-        # create
-        #{
-        #   "nova": {
-        #        "username": xxx,
-        #        "database": xxx,
-        #        "hostname": xxx
-        #    },
-        #    "quantum": {
-        #        "username": xxx,
-        #        "database": xxx,
-        #        "hostname": xxx
-        #    }
-        #}
-        #
-        databases = {}
-        for k, v in settings.iteritems():
-            db = k.split('_')[0]
-            x = '_'.join(k.split('_')[1:])
-            if db not in databases:
-                databases[db] = {}
-            databases[db][x] = v
-        return_data = {}
-        for db in databases:
-            if singleset.issubset(databases[db]):
-                return_data['_'.join([db, 'password'])] = \
-                    configure_db(databases[db]['hostname'],
-                                 databases[db]['database'],
-                                 databases[db]['username'])
-        if len(return_data) > 0:
-            utils.relation_set(**return_data)
-        if not cluster.is_clustered():
-            utils.relation_set(db_host=local_hostname)
-        else:
-            utils.relation_set(db_host=utils.config_get("vip"))
+        relation_set(db_host=utils.config_get("vip"))
 
 hooks = {
     "shared-db-relation-changed": shared_db_changed

=== modified file 'hooks/slave-relation-changed'
--- hooks/slave-relation-changed	2013-02-12 17:54:29 +0000
+++ hooks/slave-relation-changed	2014-03-05 02:21:45 +0000
@@ -87,3 +87,4 @@
 mysql $ROOTARGS -e "START SLAVE"
 mysql $ROOTARGS -e "SHOW SLAVE STATUS"
 touch /var/lib/juju/i.am.a.slave
+

=== modified file 'revision'
--- revision	2014-02-13 18:51:20 +0000
+++ revision	2014-03-05 02:21:45 +0000
@@ -1,1 +1,2 @@
-311
+321
+