Merge lp:~julian-edwards/gwacl/licence-readme-etc into lp:gwacl

[Julian Edwards]

Clean up of licence info and add a lot more info to HACKING and README.

[Jeroen T. Vermeulen (jtv)]

Oh, this is very nice. Just the overview people will need.

A few odds and ends:

37 +Role instances are virtual machine resources. Many instances may exist in a
38 +deployment (and hence hosted service) but if there is more than one they are
39 +intended to be running the same load balanced application via the service;
40 +they must all share the same DNS entry and open endpoints.

Calling them virtual machine "resources" seems confusingly vague. Isn't a role instance essentially a virtual machine?

Also, is it really true that multiple VMs are meant to run the same application in a load-balanced configuration? My understanding was that you might just as well have different components of the same application (e.g. database, application process, httpd) running on different VMs in the same service. The wording here seems to rule that out.

Might it be more accurate to say that a hosted service exposes one application on the internet, and it may comprise multiple virtual machines for load-balancing and/or different components of the application?

Also, I wouldn't say they "must" all share the same DNS entry — they all share the same DNS entry and the same IP address, and there's no way around it. As for endpoints, they can of course have their own port mappings on that same IP address (and possibly load-balanced shared endpoints, but I never read the documentation for that part).

42 +For this reason, if you want several separate resources, you must create a
43 +separate service, deployment and role instance for each.

"Resources" again is very vague. If there are resources I want to share and ones I don't want to share, this sentence leaves me completely in the dark about what to do.

48 +Each service can only see as much of each other service as any public observer
49 +does. It's possible to place them in a private network so they are
50 +effectively on a share LAN segment with no firewall.

I think these two sentences would fit together more clearly with a "However." The second sentence is a way to escape the limitations laid out by the first, so there's a clear contrast. It's not a case where the second sentence follows naturally on the first.

52 +In Azure this is called a "virtual network". The virtual network must be
53 +defined before any services are created, and then supplied at service creation
54 +time. The virtual network can be assigned any valid networking range which
55 +becomes private to all the virtual instances defined to use it.

The "before any services are created" is a bit ambiguous, to the extent that "any services" here means "any services that will use the virtual network." How about "You can define a virtual network, and supply it when you create a service. This will attach the service to the virtual network for the service's entire lifetime." Some people dislike addressing the reader directly, but it beats having most of the text in passive voice.

Another thing that may puzzle the unschooled reader is "any valid network range which becomes private to all the virtual instances defined to use it." (Where "virtual instances" should probably be "virtual machines"). It reads as if something happens t...

review: Approve

[lp:~julian-edwards/gwacl/licence-readme-etc]

212. By Julian Edwards on 2013-08-01

tweaks as per review

[Julian Edwards (julian-edwards)]

Ok I've tweaked things. Not always exactly as you want because you like dangling prepositions and they are generally considered bad form :)

Thanks for the review!

=== modified file 'HACKING.txt'
--- HACKING.txt	2013-07-19 14:44:21 +0000
+++ HACKING.txt	2013-08-01 07:52:29 +0000
@@ -20,8 +20,108 @@
 .. _Bazaar: http://bazaar.canonical.com/
 
 
-API philosophy
---------------
+Overview of Azure
+-----------------
+
+Computing services
+^^^^^^^^^^^^^^^^^^
+
+Azure was originally designed as SaaS for Microsoft Windows and later amended
+to allow individual virtual machines to run up with Linux distributions.
+Some remnants of this SaaS architecture remain today, and understanding them
+is crucial to understanding how GWACL works when spinning up virtual
+instances.
+
+There are three main components to any virtual instance:
+
+ * A hosted service
+ * A deployment
+ * A role instance
+
+Hosted services are the "top level" of a virtual resource.  Each one
+contains up to two deployments, and has its own DNS entry and firewall
+settings (known as "endpoints" in Azure).  The name of the service forms the
+DNS entry as "<name>.cloudapp.net".
+
+Deployments are Azure's abstraction of whether something is running on its
+staging or production environment.  They are only exposed in the API and not
+the web management UI.  Deployments contain one or more role instances.
+
+Role instances are virtual machines.  Many instances may exist in a deployment
+(and hence hosted service) but if there is more than one they are intended to
+be running components from the same application and they will all share the
+same DNS entry and open endpoints.  Thus, a hosted service exposes a single
+application on the internet and may be composed of multiple role instances
+for load balancing and differing components.
+
+For this reason, if you want several separate applications, you must create a
+separate service, deployment and role instance for each.
+
+Networking across hosted services
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+Each service can only see as much of each other service as any public observer
+does, however it's possible to place them in a private network so they are
+effectively on a share LAN segment with no firewall.
+
+In Azure this is called a "virtual network".  The virtual network must be
+defined before any services that use it are created, and then associated at
+service creation time.  The virtual network can be assigned any valid
+networking range which is then private to all the virtual instances defined to
+use it.
+
+Storage services
+^^^^^^^^^^^^^^^^
+
+Azure supports data storage which is accessed separately to role instances
+and hosted services.  This is organised into several components:
+
+ * A storage account
+ * Containers within an account
+ * Blobs inside containers
+
+A storage account can be created via the web management UI or API.  Its name
+forms the DNS entry for that storage as "<name>.blob.core.windows.net".
+
+A container forms the next, and only, level of indirection under the account.
+You cannot have a container under a container.  Containers control the
+default privacy of files therein.
+
+Blobs are the actual files in the storage.  They can be of two main types:
+
+ * Block blobs
+ * Page blobs
+
+Block blobs are used for sequential access and are optimised for streaming.
+Page blobs are used for random access and allow access to ranges of bytes in a
+blob.
+
+The full URL to a file in a storage account looks like:
+
+    https://<accountname>.blob.core.windows.net/<containername>/<blobname>
+
+
+RESTful API access
+------------------
+
+There are two API endpoints for Azure, the management API and the storage API.
+Each also uses its own authentication method:
+
+ * x509 certificates for the management API
+ * HMAC signed request for the storage API
+
+The GWACL code hides most of this complexity from you, it just requires the
+cerificate data for the management API access, and the storage key for storage
+API access.
+
+The storage key can be fetched either from the management UI, or management
+API call.
+
+Generating x509 certificates is explained in the :doc:`README <README>`
+
+
+GWACL's API philosophy
+----------------------
 
 API functions in the library should take a single struct parameter, which
 itself contains one or more parameters.  Existing functions that do not follow
 
=== added file 'LICENSE'
--- LICENSE	1970-01-01 00:00:00 +0000
+++ LICENSE	2013-08-01 07:52:29 +0000
@@ -0,0 +1,16 @@
+GWACL - Go API for talking to Windows Azure.
+
+Copyright 2012-2013, Canonical Ltd.
+
+Except where explicitly noted, all files herein are part of GWACL.
+
+GWACL is free software: you can redistribute it and/or modify it under the
+terms of the GNU Lesser General Public License as published by the Free
+Software Foundation, either version 3 of the License, or (at your option) any
+later version.
+
+This program is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A
+PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
+
+See COPYING for the full terms of the GNU Lesser General Public License.
 
=== modified file 'README'
--- README	2013-07-22 14:14:42 +0000
+++ README	2013-08-01 07:52:29 +0000
@@ -3,11 +3,8 @@
 ===========================================
 
 
-(Work In Progress)
-
-
-Generate an x509 key to talk to Azure
--------------------------------------
+How to generate an x509 key to talk to Azure
+--------------------------------------------
 
 Azure requires that API clients use an x509 certificate to authenticate to the
 management API. Create the certificate with::
@@ -27,20 +24,31 @@
 You can now upload ``azure.cer`` to Azure as a management certificate.
 
 
-Licensing
----------
-
-Except where explicitly noted, all files herein are part of GWACL.
-
-GWACL is free software: you can redistribute it and/or modify it under
-the terms of the GNU Lesser General Public License as published by the
-Free Software Foundation, either version 3 of the License, or (at your
-option) any later version.
-
-GWACL is distributed in the hope that it will be useful, but WITHOUT ANY
-WARRANTY; without even the implied warranty of MERCHANTABILITY or
-FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public
-License for more details.
-
-You should have received a copy of the GNU Lesser General Public License
-along with GWACL. If not, see <http://www.gnu.org/licenses/>.
+Using the key in GWACL
+----------------------
+
+GWACL requires the key in the .pem file, so make sure you keep that file
+around.  The .cer file can be deleted as you won't need it again, and it's easy
+to regenerate if you want to re-upload it.
+
+
+Example programs
+----------------
+
+Storage
+^^^^^^^
+
+The storage example is a stand-alone tool which allows the user to manipulate
+a storage account::
+
+    go run example/storage/run.go --help
+
+Management
+^^^^^^^^^^
+
+The management example is a piece of code that starts up a new role instance,
+optionally pauses so you can play with it, and then shuts everything down
+again.  It is intended to be useful for testing the library itself, but also 
+serves as an example of how to use the GWACL API::
+
+    go run example/management/run.go -cert <your pem file> -subscriptionid <your Azure subscription ID> [-wait]