Merge lp:~stub/charms/trusty/cassandra/noppa into lp:charms/trusty/cassandra

[Stuart Bishop]

Move the hardcoded PPA into configuration, so it may be overridden.

Ideally, I'll get the python-cassandra package into Xenial and we can drop this altogether.

[lp:~stub/charms/trusty/cassandra/noppa]

433. By Stuart Bishop on 2015-11-20

link bug

[Review Queue (review-queue)]

This item has failed automated testing! Results available here http://juju-ci.vapour.ws:8080/job/charm-bundle-test-lxc/1483/

review: Needs Fixing (automated testing)

[Review Queue (review-queue)]

This item has failed automated testing! Results available here http://juju-ci.vapour.ws:8080/job/charm-bundle-test-aws/1467/

review: Needs Fixing (automated testing)

[Review Queue (review-queue)]

This item has failed automated testing! Results available here http://juju-ci.vapour.ws:8080/job/charm-bundle-test-lxc/1574/

review: Needs Fixing (automated testing)

[Review Queue (review-queue)]

This item has failed automated testing! Results available here http://juju-ci.vapour.ws:8080/job/charm-bundle-test-aws/1557/

review: Needs Fixing (automated testing)

[Review Queue (review-queue)]

This item has failed automated testing! Results available here http://juju-ci.vapour.ws:8080/job/charm-bundle-test-lxc/1614/

review: Needs Fixing (automated testing)

[Review Queue (review-queue)]

This item has failed automated testing! Results available here http://juju-ci.vapour.ws:8080/job/charm-bundle-test-aws/1597/

review: Needs Fixing (automated testing)

[lp:~stub/charms/trusty/cassandra/noppa]

434. By Stuart Bishop on 2015-12-02

Include required ppa: in Cassandra 2.0 deployment test

[Review Queue (review-queue)]

This item has failed automated testing! Results available here http://juju-ci.vapour.ws:8080/job/charm-bundle-test-lxc/1639/

review: Needs Fixing (automated testing)

[Review Queue (review-queue)]

This item has failed automated testing! Results available here http://juju-ci.vapour.ws:8080/job/charm-bundle-test-aws/1621/

review: Needs Fixing (automated testing)

[lp:~stub/charms/trusty/cassandra/noppa]

435. By Stuart Bishop on 2015-12-03

Fix Cassandra 2.0 tests betterer

[Review Queue (review-queue)]

This item has failed automated testing! Results available here http://juju-ci.vapour.ws:8080/job/charm-bundle-test-lxc/1651/

review: Needs Fixing (automated testing)

[Review Queue (review-queue)]

This item has failed automated testing! Results available here http://juju-ci.vapour.ws:8080/job/charm-bundle-test-aws/1633/

review: Needs Fixing (automated testing)

[Review Queue (review-queue)]

The results (PASS) are in and available here: http://juju-ci.vapour.ws:8080/job/charm-bundle-test-aws/1647/

review: Approve (automated testing)

[Review Queue (review-queue)]

This item has failed automated testing! Results available here http://juju-ci.vapour.ws:8080/job/charm-bundle-test-lxc/1667/

review: Needs Fixing (automated testing)

[lp:~stub/charms/trusty/cassandra/noppa]

436. By Stuart Bishop on 2015-12-08

Merge ensure-thrift

437. By Stuart Bishop on 2015-12-08

Merge ensure-thrift for Cassandra 2.2

[Review Queue (review-queue)]

This item has failed automated testing! Results available here http://juju-ci.vapour.ws:8080/job/charm-bundle-test-lxc/1717/

review: Needs Fixing (automated testing)

[Review Queue (review-queue)]

This item has failed automated testing! Results available here http://juju-ci.vapour.ws:8080/job/charm-bundle-test-aws/1695/

review: Needs Fixing (automated testing)

[Review Queue (review-queue)]

This item has failed automated testing! Results available here http://juju-ci.vapour.ws:8080/job/charm-bundle-test-lxc/1718/

review: Needs Fixing (automated testing)

[Review Queue (review-queue)]

This item has failed automated testing! Results available here http://juju-ci.vapour.ws:8080/job/charm-bundle-test-aws/1696/

review: Needs Fixing (automated testing)

[Cory Johns (johnsca)]

Stuart,

This contains quite a bit more than the PPA change, and the auth tests time out for me. Can you give more information on what the other changes are for, and any recommendations for getting through the tests in less than 6 hours?

review: Needs Information

[Stuart Bishop (stub)]

Yeah, this branch grew a bit (the changes landing here were needed for a customer site, and some other dependencies may have crept in). I was trying to keep the changes in discrete branches but failed :-(

I've already rolled everything up into the misnamed ensure-thrift branch, so will kill this one.

Tests run a lot faster than 6 hours locally. I do see them running in about 7 hours on some providers though. This is almost all provisioning and deployment time:

DEBUG:runner:Sat Dec 19 14:14:04 UTC 2015
DEBUG:runner:Dec 19 14:30:32 test_basics_client_admin_relation (tests.test_integration.Test1UnitDeployment) ... ok

[...]

DEBUG:runner:Sat Dec 19 15:09:07 UTC 2015
DEBUG:runner:Dec 19 15:44:40 test_basics_client_admin_relation (tests.test_integration.Test3UnitDeployment) ... ok

The above times are from an AWS run at http://juju-ci.vapour.ws:8080/job/charm-bundle-test-aws/1864/console . The time between the initial timestamp and the first tells us it took 16 minutes to deploy a single unit service and 35 minutes to deploy a 3 unit service. This is about 5 times longer than on my laptop.

I'm not sure what can be done to improve this, beyond getting better clouds. Amulet doesn't let me provision all the necessary machines upfront (~25?), as juju-deployer won't use them afaict.

Unmerged revisions

=== modified file 'Makefile'
--- Makefile	2015-08-19 09:57:40 +0000
+++ Makefile	2015-12-08 10:27:18 +0000
@@ -21,9 +21,16 @@
 	@echo 'Usage: make [ lint | unittest | test | clean | sync ]'
 	env
 
-# Only trusty supported, but wily expected soon.
+# Only trusty supported, but xenial expected soon.
 SERIES := $(shell juju get-environment default-series)
 
+
+# /!\ Ensure that errors early in pipes cause failures, rather than
+# overridden by the last stage of the pipe. cf. 'test.py | ts'
+SHELL := /bin/bash
+export SHELLOPTS:=errexit:pipefail
+
+
 # Calculate the CHARM_DIR (the directory this Makefile is in)
 THIS_MAKEFILE_PATH:=$(word $(words $(MAKEFILE_LIST)),$(MAKEFILE_LIST))
 CHARM_DIR:=$(shell cd $(dir $(THIS_MAKEFILE_PATH));pwd)
@@ -70,18 +77,31 @@
 	AMULET_TIMEOUT=5400 \
 	$(NOSETESTS) tests.test_integration:Test1UnitDeployment 2>&1 | ts
 	
-20test: unittest Test21Deployment
+20test: unittest Test20Deployment
 Test20Deployment: deps
 	date
 	AMULET_TIMEOUT=5400 \
 	$(NOSETESTS) tests.test_integration:Test20Deployment 2>&1 | ts
-	
+
+22test: unittest Test22Deployment
+Test22Deployment: deps
+	date
+	AMULET_TIMEOUT=5400 \
+	$(NOSETESTS) tests.test_integration:Test22Deployment 2>&1 | ts
+		
 3test: unittest Test3UnitDeployment
 Test3UnitDeployment: deps
 	date
 	AMULET_TIMEOUT=7200 \
 	$(NOSETESTS) tests.test_integration:Test3UnitDeployment 2>&1 | ts
 
+authtest: unittest TestAllowAllAuthenticatorDeployment
+TestAllowAllAuthenticatorDeployment: deps
+	date
+	AMULET_TIMEOUT=7200 \
+	$(NOSETESTS) \
+	tests.test_integration:TestAllowAllAuthenticatorDeployment 2>&1 | ts
+
 # Place a copy of the Oracle Java SE 7 Server Runtime tarball in ./lib
 # to run these tests.
 jretest: unittest

=== modified file 'README.md'
--- README.md	2015-10-20 09:41:37 +0000
+++ README.md	2015-12-08 10:27:18 +0000
@@ -13,7 +13,7 @@
 
 # Editions
 
-This charm supports Apache Cassandra 2.0, Apache Cassandra 2.1, and
+This charm supports Apache Cassandra 2.0, 2.1 & 2.2, and
 Datastax Enterprise 4.8. The default is Apache Cassandra 2.1.
 
 To use Apache Cassandra 2.0, specify the Apache Cassandra 2.0 archive source

=== modified file 'config.yaml'
--- config.yaml	2015-06-23 11:32:12 +0000
+++ config.yaml	2015-12-08 10:27:18 +0000
@@ -35,6 +35,7 @@
             If you are using Datastax Enterprise, you will need to
             override one defaults with your own username and password.
         default: |
+            - ppa:stub/cassandra  # Required for python3-cassandra package
             - deb http://www.apache.org/dist/cassandra/debian 21x main
         #   - deb http://debian.datastax.com/community stable main
         #   DSE requires you to register and add your username/password here.
@@ -45,6 +46,7 @@
             charm-helpers standard listing of package install source
             signing keys, corresponding to install_sources.
         default: |
+            - null  # ppa:stub/cassandra signing key added automatically.
             - null  # Apache package signing key added automatically.
             # - null  # DataStack package signing key added automatically.
     http_proxy:
@@ -242,7 +244,14 @@
         default: 7001
         description: >
             Cluster secure communication port. TODO: Unused. configure SSL.
-
+    authenticator:
+        type: string
+        default: PasswordAuthenticator
+        description: >
+            Authentication backend. Only PasswordAuthenticator and
+            AllowAllAuthenticator are supported. You should only
+            use AllowAllAuthenticator for legacy applications that
+            cannot provide authentication credentials.
     authorizer:
         type: string
         default: AllowAllAuthorizer

=== modified file 'hooks/actions.py'
--- hooks/actions.py	2015-10-22 04:50:10 +0000
+++ hooks/actions.py	2015-12-08 10:27:18 +0000
@@ -59,6 +59,7 @@
     'num_tokens',
     'max_heap_size',
     'heap_newsize',
+    'authenticator',
     'authorizer',
     'compaction_throughput_mb_per_sec',
     'stream_throughput_outbound_megabits_per_sec',
@@ -115,6 +116,21 @@
     return wrapper
 
 
+def authentication(func):
+    '''Decorated function is skipped if authentication is disabled.'''
+    @wraps(func)
+    def wrapper(*args, **kw):
+        auth = hookenv.config()['authenticator']
+        if auth == 'PasswordAuthenticator':
+            return func(*args, **kw)
+        elif auth == 'AllowAllAuthenticator':
+            hookenv.log('Skipped. Authentication disabled.', DEBUG)
+            return None
+        helpers.status_set('blocked', 'Unknown authenticator {}'.format(auth))
+        raise SystemExit(0)
+    return wrapper
+
+
 @action
 def set_proxy():
     config = hookenv.config()
@@ -231,6 +247,34 @@
 
 
 @action
+def reset_limits():
+    '''Set /etc/security/limits.d correctly for Ubuntu, so the
+    startup scripts don't emit a spurious warning.
+
+    Per Cassandra documentation, Ubuntu needs some extra
+    twiddling in /etc/security/limits.d. I have no idea why
+    the packages don't do this, since they are already
+    setting limits for the cassandra user correctly. The real
+    bug is that the limits of the user running the startup script
+    are being checked, rather than the limits of the user that will
+    actually run the process.
+    '''
+    contents = dedent('''\
+                      # Maintained by Juju
+                      root - memlock unlimited
+                      root - nofile 100000
+                      root - nproc 32768
+                      root - as unlimited
+                      ubuntu - memlock unlimited
+                      ubuntu - nofile 100000
+                      ubuntu - nproc 32768
+                      ubuntu - as unlimited
+                      ''')
+    host.write_file('/etc/security/limits.d/cassandra-charm.conf',
+                    contents.encode('US-ASCII'))
+
+
+@action
 def install_cassandra_packages():
     helpers.install_packages(helpers.get_cassandra_packages())
     if helpers.get_jre() != 'oracle':
@@ -404,6 +448,7 @@
 
 @leader_only
 @action
+@authentication
 @coordinator.require('repair', needs_reset_auth_keyspace_replication)
 def reset_auth_keyspace_replication():
     # Cassandra requires you to manually set the replication factor of
@@ -454,8 +499,8 @@
 
     # If our IP address has changed, we need to restart.
     if config.changed('unit_private_ip'):
-        hookenv.log('waiting',
-                    'IP address changed. Waiting for restart permission.')
+        helpers.status_set('waiting', 'IP address changed. '
+                           'Waiting for restart permission.')
         return True
 
     # If the directory paths have changed, we need to migrate data
@@ -546,6 +591,7 @@
 
 @leader_only
 @action
+@authentication
 def create_unit_superusers():
     # The leader creates and updates accounts for nodes, using the
     # encrypted password they provide in relations.PeerRelation. We
@@ -674,7 +720,7 @@
 @action
 def emit_cluster_info():
     helpers.emit_describe_cluster()
-    helpers.emit_auth_keyspace_status()
+    helpers.emit_status()
     helpers.emit_netstats()
 
 
@@ -824,6 +870,7 @@
 
 @leader_only
 @action
+@authentication
 def reset_default_password():
     if hookenv.leader_get('default_admin_password_changed'):
         hookenv.log('Default admin password already changed')
@@ -883,6 +930,7 @@
 
 
 @action
+@authentication
 def request_unit_superuser():
     relid = helpers.peer_relid()
     if relid is None:

=== modified file 'hooks/definitions.py'
--- hooks/definitions.py	2015-09-04 11:56:16 +0000
+++ hooks/definitions.py	2015-12-08 10:27:18 +0000
@@ -44,6 +44,7 @@
                          actions.configure_sources,
                          actions.swapoff,
                          actions.reset_sysctl,
+                         actions.reset_limits,
                          actions.install_oracle_jre,
                          actions.install_cassandra_packages,
                          actions.emit_java_version,
@@ -108,7 +109,10 @@
 
         if helpers.is_cassandra_running():
             hookenv.log('Cassandra is running')
-            if hookenv.local_unit() in helpers.get_unit_superusers():
+            auth = hookenv.config()['authenticator']
+            if auth == 'AllowAllAuthenticator':
+                return True
+            elif hookenv.local_unit() in helpers.get_unit_superusers():
                 hookenv.log('Credentials created')
                 return True
             else:

=== modified file 'hooks/helpers.py'
--- hooks/helpers.py	2015-09-11 05:07:47 +0000
+++ hooks/helpers.py	2015-12-08 10:27:18 +0000
@@ -16,6 +16,7 @@
 import configparser
 from contextlib import contextmanager
 from datetime import timedelta
+from distutils.version import LooseVersion
 import errno
 from functools import wraps
 import io
@@ -303,10 +304,20 @@
 
 def get_cassandra_version():
     if get_cassandra_edition() == 'dse':
-        return '2.1' if get_package_version('dse-full') else None
+        dse_ver = get_package_version('dse-full')
+        if not dse_ver:
+            return None
+        elif LooseVersion(dse_ver) >= LooseVersion('4.7'):
+            return '2.1'
+        else:
+            return '2.0'
     return get_package_version('cassandra')
 
 
+def has_cassandra_version(minimum_ver):
+    return LooseVersion(get_cassandra_version()) >= LooseVersion(minimum_ver)
+
+
 def get_cassandra_config_dir():
     if get_cassandra_edition() == 'dse':
         return '/etc/dse/cassandra'
@@ -459,8 +470,12 @@
     if username is None or password is None:
         username, password = superuser_credentials()
 
-    auth_provider = cassandra.auth.PlainTextAuthProvider(username=username,
-                                                         password=password)
+    auth = hookenv.config()['authenticator']
+    if auth == 'AllowAllAuthenticator':
+        auth_provider = None
+    else:
+        auth_provider = cassandra.auth.PlainTextAuthProvider(username=username,
+                                                             password=password)
 
     # Although we specify a reconnection_policy, it does not apply to
     # the initial connection so we retry in a loop.
@@ -519,17 +534,29 @@
 @logged
 def ensure_user(session, username, encrypted_password, superuser=False):
     '''Create the DB user if it doesn't already exist & reset the password.'''
+    auth = hookenv.config()['authenticator']
+    if auth == 'AllowAllAuthenticator':
+        return  # No authentication means we cannot create users
+
     if superuser:
         hookenv.log('Creating SUPERUSER {}'.format(username))
     else:
         hookenv.log('Creating user {}'.format(username))
-    query(session,
-          'INSERT INTO system_auth.users (name, super) VALUES (%s, %s)',
-          ConsistencyLevel.ALL, (username, superuser))
-    query(session,
-          'INSERT INTO system_auth.credentials (username, salted_hash) '
-          'VALUES (%s, %s)',
-          ConsistencyLevel.ALL, (username, encrypted_password))
+    if has_cassandra_version('2.2'):
+        query(session,
+              'INSERT INTO system_auth.roles '
+              '(role, can_login, is_superuser, salted_hash) '
+              'VALUES (%s, TRUE, %s, %s)',
+              ConsistencyLevel.ALL,
+              (username, superuser, encrypted_password))
+    else:
+        query(session,
+              'INSERT INTO system_auth.users (name, super) VALUES (%s, %s)',
+              ConsistencyLevel.ALL, (username, superuser))
+        query(session,
+              'INSERT INTO system_auth.credentials (username, salted_hash) '
+              'VALUES (%s, %s)',
+              ConsistencyLevel.ALL, (username, encrypted_password))
 
 
 @logged
@@ -683,7 +710,7 @@
     # Using the same name is preferred to match the actual Cassandra
     # documentation.
     simple_config_keys = ['cluster_name', 'num_tokens',
-                          'partitioner', 'authorizer',
+                          'partitioner', 'authorizer', 'authenticator',
                           'compaction_throughput_mb_per_sec',
                           'stream_throughput_outbound_megabits_per_sec',
                           'tombstone_warn_threshold',
@@ -704,16 +731,16 @@
     dirs = get_all_database_directories()
     cassandra_yaml.update(dirs)
 
-    # The charm only supports password authentication. In the future we
-    # may also support AllowAllAuthenticator. I'm not sure if others
-    # such as Kerboros can be supported or are useful.
-    cassandra_yaml['authenticator'] = 'PasswordAuthenticator'
-
     # GossipingPropertyFileSnitch is the only snitch recommended for
     # production. It we allow others, we need to consider how to deal
     # with the system_auth keyspace replication settings.
     cassandra_yaml['endpoint_snitch'] = 'GossipingPropertyFileSnitch'
 
+    # Per Bug #1523546 and CASSANDRA-9319, Thrift is disabled by default in
+    # Cassandra 2.2. Ensure it is enabled if rpc_port is non-zero.
+    if int(config['rpc_port']) > 0:
+        cassandra_yaml['start_rpc'] = True
+
     cassandra_yaml.update(overrides)
 
     write_cassandra_yaml(cassandra_yaml)
@@ -745,7 +772,7 @@
             # is not running.
             os.kill(pid, 0)
 
-            if subprocess.call(["nodetool", "status", "system_auth"],
+            if subprocess.call(["nodetool", "status"],
                                stdout=subprocess.DEVNULL,
                                stderr=subprocess.DEVNULL) == 0:
                 hookenv.log(
@@ -870,9 +897,9 @@
 
 
 @logged
-def emit_auth_keyspace_status():
-    '''Run 'nodetool status system_auth' for the logs.'''
-    nodetool('status', 'system_auth')  # Implicit emit
+def emit_status():
+    '''Run 'nodetool status' for the logs.'''
+    nodetool('status')  # Implicit emit
 
 
 @logged
@@ -883,7 +910,7 @@
 
 def emit_cluster_info():
     emit_describe_cluster()
-    emit_auth_keyspace_status()
+    emit_status()
     emit_netstats()
 
 

=== modified file 'hooks/hooks.py'
--- hooks/hooks.py	2015-06-18 15:47:26 +0000
+++ hooks/hooks.py	2015-12-08 10:27:18 +0000
@@ -24,8 +24,7 @@
         import cassandra  # NOQA: flake8
     except ImportError:
         packages = ['python3-bcrypt', 'python3-cassandra']
-        fetch.add_source('ppa:stub/cassandra')
-        fetch.apt_update(fatal=True)
+        fetch.configure_sources(update=True)
         fetch.apt_install(packages, fatal=True)
         import bcrypt     # NOQA: flake8
         import cassandra  # NOQA: flake8

=== modified file 'tests/test_actions.py'
--- tests/test_actions.py	2015-09-10 07:22:22 +0000
+++ tests/test_actions.py	2015-12-08 10:27:18 +0000
@@ -833,7 +833,7 @@
         self.assertIn(expected, contents)
 
     @patch('helpers.emit_netstats')
-    @patch('helpers.emit_auth_keyspace_status')
+    @patch('helpers.emit_status')
     @patch('helpers.emit_describe_cluster')
     def test_emit_cluster_info(self, emit_desc, emit_status, emit_netstats):
         actions.emit_cluster_info('')

=== modified file 'tests/test_helpers.py'
--- tests/test_helpers.py	2015-09-04 11:12:27 +0000
+++ tests/test_helpers.py	2015-12-08 10:27:18 +0000
@@ -731,8 +731,10 @@
                           sentinel.consistency, sentinel.args)
         self.assertEqual(session.execute.call_count, 4)
 
+    @patch('helpers.get_cassandra_version')
     @patch('helpers.query')
-    def test_ensure_user(self, query):
+    def test_ensure_user(self, query, ver):
+        ver.return_value = '2.1'
         helpers.ensure_user(sentinel.session,
                             sentinel.username, sentinel.pwhash,
                             superuser=sentinel.supflag)
@@ -746,6 +748,21 @@
                  ConsistencyLevel.ALL,
                  (sentinel.username, sentinel.pwhash))])
 
+    @patch('helpers.get_cassandra_version')
+    @patch('helpers.query')
+    def test_ensure_user_22(self, query, ver):
+        ver.return_value = '2.2'
+        helpers.ensure_user(sentinel.session,
+                            sentinel.username, sentinel.pwhash,
+                            superuser=sentinel.supflag)
+        query.assert_called_once_with(sentinel.session,
+                                      'INSERT INTO system_auth.roles (role, '
+                                      'can_login, is_superuser, salted_hash) '
+                                      'VALUES (%s, TRUE, %s, %s)',
+                                      ConsistencyLevel.ALL,
+                                      (sentinel.username, sentinel.supflag,
+                                       sentinel.pwhash))
+
     @patch('helpers.ensure_user')
     @patch('helpers.encrypt_password')
     @patch('helpers.nodetool')
@@ -890,7 +907,7 @@
         is_running.return_value = True
         backoff.return_value = repeat(True)
         check_output.side_effect = iter(['ONE Error: stuff', 'TWO OK'])
-        self.assertEqual(helpers.nodetool('status', 'system_auth'), 'TWO OK')
+        self.assertEqual(helpers.nodetool('status'), 'TWO OK')
 
         # The output was emitted.
         helpers.emit.assert_called_once_with('TWO OK')
@@ -908,7 +925,7 @@
             subprocess.CalledProcessError([], 1, 'fail 4'),
             subprocess.CalledProcessError([], 1, 'fail 5'),
             'OK'])
-        self.assertEqual(helpers.nodetool('status', 'system_auth'), 'OK')
+        self.assertEqual(helpers.nodetool('status'), 'OK')
 
         # Later fails and final output was emitted.
         helpers.emit.assert_has_calls([call('fail 5'), call('OK')])
@@ -992,6 +1009,79 @@
                 stream_throughput_outbound_megabits_per_sec: 200
                 tombstone_warn_threshold: 1000
                 tombstone_failure_threshold: 100000
+                start_rpc: true
+                ''')
+            self.maxDiff = None
+            self.assertEqual(yaml.safe_load(new_config),
+                             yaml.safe_load(expected_config))
+
+            # Confirm we can use an explicit cluster_name too.
+            write_file.reset_mock()
+            hookenv.config()['cluster_name'] = 'fubar'
+            helpers.configure_cassandra_yaml()
+            new_config = write_file.call_args[0][1]
+            self.assertEqual(yaml.safe_load(new_config)['cluster_name'],
+                             'fubar')
+
+    @patch('helpers.get_cassandra_version')
+    @patch('helpers.get_cassandra_yaml_file')
+    @patch('helpers.get_seed_ips')
+    @patch('charmhelpers.core.host.write_file')
+    def test_configure_cassandra_yaml_22(self, write_file, seed_ips, yaml_file,
+                                         get_cassandra_version):
+        get_cassandra_version.return_value = '2.0'
+        hookenv.config().update(dict(num_tokens=128,
+                                     cluster_name='test_cluster_name',
+                                     partitioner='test_partitioner'))
+
+        seed_ips.return_value = ['10.20.0.1', '10.20.0.2', '10.20.0.3']
+
+        existing_config = '''
+            seed_provider:
+                - class_name: blah.SimpleSeedProvider
+                  parameters:
+                      - seeds: 127.0.0.1  # Comma separated list.
+            start_rpc: false  # Defaults to False starting 2.2
+            '''
+
+        with tempfile.TemporaryDirectory() as tmpdir:
+            yaml_config = os.path.join(tmpdir, 'c.yaml')
+            yaml_file.return_value = yaml_config
+            with open(yaml_config, 'w', encoding='UTF-8') as f:
+                f.write(existing_config)
+
+            helpers.configure_cassandra_yaml()
+
+            self.assertEqual(write_file.call_count, 2)
+            new_config = write_file.call_args[0][1]
+
+            expected_config = dedent('''\
+                start_rpc: true
+                cluster_name: test_cluster_name
+                authenticator: PasswordAuthenticator
+                num_tokens: 128
+                partitioner: test_partitioner
+                listen_address: 10.20.0.1
+                rpc_address: 0.0.0.0
+                rpc_port: 9160
+                native_transport_port: 9042
+                storage_port: 7000
+                ssl_storage_port: 7001
+                authorizer: AllowAllAuthorizer
+                seed_provider:
+                    - class_name: blah.SimpleSeedProvider
+                      parameters:
+                        # No whitespace in seeds is important.
+                        - seeds: '10.20.0.1,10.20.0.2,10.20.0.3'
+                endpoint_snitch: GossipingPropertyFileSnitch
+                data_file_directories:
+                    - /var/lib/cassandra/data
+                commitlog_directory: /var/lib/cassandra/commitlog
+                saved_caches_directory: /var/lib/cassandra/saved_caches
+                compaction_throughput_mb_per_sec: 16
+                stream_throughput_outbound_megabits_per_sec: 200
+                tombstone_warn_threshold: 1000
+                tombstone_failure_threshold: 100000
                 ''')
             self.maxDiff = None
             self.assertEqual(yaml.safe_load(new_config),
@@ -1044,6 +1134,7 @@
                 listen_address: 10.20.0.1
                 rpc_address: 0.0.0.0
                 broadcast_rpc_address: 10.30.0.1
+                start_rpc: true
                 rpc_port: 9160
                 native_transport_port: 9042
                 storage_port: 7000
@@ -1261,9 +1352,9 @@
         nodetool.assert_called_once_with('describecluster')
 
     @patch('helpers.nodetool')
-    def test_emit_auth_keyspace_status(self, nodetool):
-        helpers.emit_auth_keyspace_status()
-        nodetool.assert_called_once_with('status', 'system_auth')
+    def test_emit_status(self, nodetool):
+        helpers.emit_status()
+        nodetool.assert_called_once_with('status')
 
     @patch('helpers.nodetool')
     def test_emit_netstats(self, nodetool):

=== modified file 'tests/test_integration.py'
--- tests/test_integration.py	2015-08-19 09:57:40 +0000
+++ tests/test_integration.py	2015-12-08 10:27:18 +0000
@@ -187,7 +187,7 @@
 
     def get_client_relinfo(self, relname):
         # We only need one unit, even if rf > 1
-        s = self.deployment.sentry['cassandra/0']
+        s = self.deployment.sentry['cassandra'][0]
         relinfo = s.relation(relname, 'client:{}'.format(relname))
         return relinfo
 
@@ -287,11 +287,11 @@
         # and data migrated. Instead, keep checking until our condition
         # is met, or a timeout reached.
         timeout = time.time() + 300
-        for unit_num in range(0, self.rf):
-            unit = 'cassandra/{}'.format(unit_num)
+        for s in self.deployment.sentry['cassandra']:
+            unit = s.info['unit_name']
+            unit_num = s.info['unit']
             with self.subTest(unit=unit):
                 while True:
-                    s = self.deployment.sentry[unit]
                     # Attempting to diagnose Amulet failures. I suspect
                     # SSH host keys again, per Bug #802117
                     try:
@@ -314,7 +314,6 @@
                         found = set(contents['directories'])
                         self.assertIn(keyspace, found)
                         self.assertIn('system', found)
-                        self.assertIn('system_auth', found)
                         break
                     except Exception:
                         if time.time() > timeout:
@@ -354,7 +353,8 @@
                 self.assertIsInstance(fail, AuthenticationFailed)
 
     def test_cqlsh(self):
-        subprocess.check_output(['juju', 'ssh', 'cassandra/0',
+        unit = self.deployment.sentry['cassandra'][0].info['unit_name']
+        subprocess.check_output(['juju', 'ssh', unit,
                                  'sudo -H cqlsh -e exit'],
                                 stderr=subprocess.STDOUT)
 
@@ -544,6 +544,28 @@
         super(TestDSEDeployment, cls).setUpClass()
 
 
+class TestAllowAllAuthenticatorDeployment(Test3UnitDeployment):
+    test_config = dict(authenticator='AllowAllAuthenticator')
+
+    def cluster(self, username=None, password=None, hosts=None, port=9042):
+        '''A cluster using invalid credentials.'''
+        return super(TestAllowAllAuthenticatorDeployment,
+                     self).cluster(username='wat', password='eva')
+
+    def client_session(self, relname):
+        '''A session using invalid credentials.'''
+        relinfo = self.get_client_relinfo(relname)
+        self.assertIn('host', relinfo.keys())
+        cluster = self.cluster('random', 'nonsense',
+                               [relinfo['host']],
+                               int(relinfo['native_transport_port']))
+        session = cluster.connect()
+        self.addCleanup(session.shutdown)
+        return session
+
+    test_default_superuser_account_closed = None
+
+
 class Test20Deployment(Test1UnitDeployment):
     """Tests run on a single node Apache Cassandra 2.0 cluster.
     """
@@ -551,8 +573,21 @@
     test_config = dict(
         edition='community',
         install_sources=yaml.safe_dump([
+            'ppa:stub/cassandra',
             'deb http://www.apache.org/dist/cassandra/debian 20x main']),
-        install_keys=yaml.safe_dump([None]))
+        install_keys=yaml.safe_dump([None, None]))
+
+
+class Test22Deployment(Test1UnitDeployment):
+    """Tests run on a single node Apache Cassandra 2.2 cluster.
+    """
+    rf = 1
+    test_config = dict(
+        edition='community',
+        install_sources=yaml.safe_dump([
+            'ppa:stub/cassandra',
+            'deb http://www.apache.org/dist/cassandra/debian 22x main']),
+        install_keys=yaml.safe_dump([None, None]))
 
 
 # Bug #1417097 means we need to monkey patch Amulet for now.

=== modified file 'tests/tests.yaml'
--- tests/tests.yaml	2015-06-29 10:09:24 +0000
+++ tests/tests.yaml	2015-12-08 10:27:18 +0000
@@ -10,3 +10,5 @@
     - Test1UnitDeployment
     - Test3UnitDeployment
     - Test20Deployment
+    - Test22Deployment
+    - TestAllowAllAuthenticatorDeployment