Merge ~raharper/cloud-init:snapuser-create into cloud-init:master

[Ryan Harper]

Add support for snap create-user on Ubuntu Core images

Ubuntu Core images use the `snap create-user` to add users to a Ubuntu
Core system. Add support for creating snap users by added a key to
the users dictionary:

users:
  - name: bob
    snapuser: <email address hidden>

Or via the 'snappy' dictionary:

snappy:
  email: <email address hidden>

These methods will contact the Ubuntu SSO infrastructure to request
user information (including public ssh keys if present) for creating
the user.

Users may also create a snap user without contacting the SSO by
providing a 'system-user' assertion by importing them into snapd.

snappy:
  email: <email address hidden>
  known: true
  assertions:
  - |
    <assertion text here>

Additionally, Ubuntu Core systems have a read-only /etc/passwd such that
the normal useradd/groupadd commands do not function without an additional
flag, '--extrausers', which redirects the pwd to /var/lib/extrausers.

Move the system_is_snappy() check from cc_snappy module to util for
re-use and then update the Distro class to append '--extrausers' if
the system is Ubuntu Core.

90577ef... by Ryan Harper on 2016-09-16

Update snapuser example

[Scott Moser (smoser)]

Is this still needed or desired ?

ba627b5... by Ryan Harper on 2016-10-06

Merge remote-tracking branch 'origin/master' into snapuser-create

e5a6164... by Ryan Harper on 2016-10-06

config/cc_snap_config: Add snap config module for early config of snapd

During init, we want to import snap assertions which can be used to
create a snap 'system-user'.

9fb5a34... by Ryan Harper on 2016-10-07

Fix cc_snap_config: run later and encode assertions

snapd requires cloud-init stage to complete, so we cannot
run snap_config during init stage, instead we can run
early during config stage.

When writing out assertions, the default write mode is 'w+b'
and thus the input needs to be bytes[], so encode with utf-8.

a9b54d0... by Ryan Harper on 2016-10-07

Merge remote-tracking branch 'origin/master' into snapuser-create

76774db... by Ryan Harper on 2016-10-12

snappy: try harder to import system-user assertion

b543c0f... by Ryan Harper on 2016-10-12

unittest: add test for when snappy system-user assertion is provided

3db49a7... by Ryan Harper on 2016-10-13

config/cc_snap_config: Add some config checking and unittests

- Make sure we only run on system_is_snappy == True
- Handle some expected scenarios for various levels of config input.
- Handle the case where the device is already managed
- Add unittests to cover snap_config module.

[Jon Grimm (jgrimm)]

Quick look just because I wanted to know more about the impl.

[Ryan Harper (raharper)]

Thanks for looking at the code!

a55ae1f... by Ryan Harper on 2016-10-14

debian: add explicit dependencies for required binaries

[Jon Grimm (jgrimm)]

Thanks, it was enlightening and easy to read.

1b96428... by Ryan Harper on 2016-10-14

Merge branch 'fix-lp1619423' into snapuser-create

[Scott Moser (smoser)]

over all, looks good.
you dont have to clean up the handle, but if you see easy way to do that that'd be nice.

is the snappy path now valid on non-snappy system ? (ubuntu server with 'snap' support).

lastly, please just review your commit message and make sure its up to date with all changes (it may well be, just think you made some changes since you wrote it).

[Ryan Harper (raharper)]

On Wed, Oct 19, 2016 at 8:04 AM, Scott Moser <email address hidden> wrote:

> over all, looks good.
> you dont have to clean up the handle, but if you see easy way to do that
> that'd be nice.
>
> is the snappy path now valid on non-snappy system ? (ubuntu server with
> 'snap' support).
>

It is, and util.is_system_snappy() I think passes where it works; I'll
confirm.

>
>
> lastly, please just review your commit message and make sure its up to
> date with all changes (it may well be, just think you made some changes
> since you wrote it).
>

ACK, it needs updating to account for the snappy: namespace changes.

>
>
> Diff comments:
>
> > diff --git a/cloudinit/config/cc_snap_config.py
> b/cloudinit/config/cc_snap_config.py
> > new file mode 100644
> > index 0000000..667b9c6
> > --- /dev/null
> > +++ b/cloudinit/config/cc_snap_config.py
> > @@ -0,0 +1,177 @@
> > +# vi: ts=4 expandtab
> > +#
> > +# Copyright (C) 2016 Canonical Ltd.
> > +#
> > +# Author: Ryan Harper <email address hidden>
> > +#
> > +# This program is free software: you can redistribute it and/or
> modify
> > +# it under the terms of the GNU General Public License version 3, as
> > +# published by the Free Software Foundation.
> > +#
> > +# This program is distributed in the hope that it will be useful,
> > +# but WITHOUT ANY WARRANTY; without even the implied warranty of
> > +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
> > +# GNU General Public License for more details.
> > +#
> > +# You should have received a copy of the GNU General Public License
> > +# along with this program. If not, see <
> http://www.gnu.org/licenses/>.
> > +
> > +"""
> > +Snappy
> > +------
> > +**Summary:** snap_config modules allows configuration of snapd.
> > +
> > +This module uses the same ``snappy`` namespace for configuration but
> > +acts only only a subset of the configuration.
> > +
> > +If ``assertions`` is set and the user has included a list of assertions
> > +then cloud-init will collect the assertions into a single assertion file
> > +and invoke ``snap ack <path to file with assertions>`` which will
> attempt
> > +to load the provided assertions into the snapd assertion database.
> > +
> > +If ``email`` is set, this value is used to create an authorized user for
> > +contacting and installing snaps from the Ubuntu Store. This is done by
> > +calling ``snap create-user`` command.
> > +
> > +If ``known`` is set to True, then it is expected the user also included
> > +an assertion of type ``system-user``. When ``snap create-user`` is
> called
> > +cloud-init will append '--known' flag which instructs snapd to look for
> > +a system-user assertion with the details. If ``known`` is not set, then
> > +``snap create-user`` will contact the Ubuntu SSO for validating and
> importing
> > +a system-user for the instance.
> > +
> > +.. note::
> > + If the system is already managed, then cloud-init will not attempt
> to
> > + create a system-user.
> > +
> > +**Internal name:** ``cc_snap_config``
> > +
> > +**Module frequency:** per instance
> > +
> > +**Supported distros:** ubuntu
> > +
> > +**Config keys**::
> > +
> > + #cloud-confi...

[Ryan Harper (raharper)]

On Wed, Oct 19, 2016 at 8:52 AM, Ryan Harper <email address hidden>
wrote:

>
>
> On Wed, Oct 19, 2016 at 8:04 AM, Scott Moser <email address hidden> wrote:
>
>> over all, looks good.
>> you dont have to clean up the handle, but if you see easy way to do that
>> that'd be nice.
>>
>> is the snappy path now valid on non-snappy system ? (ubuntu server with
>> 'snap' support).
>>
>
> It is, and util.is_system_snappy() I think passes where it works; I'll
> confirm.
>

is_system_snappy is looking for 'all-snap' style images; so snaps on
classic don't
respond. We'd need to design something for validating that it works on
snaps on classic
setups.

One key difference is that all-snap systems have non-writable /etc ; where
as snapd on classic doesn't. If we added classic systems to the
is_system_snappy check, then users would get added
to /var/lib/extrausers instead of /etc; I think that's non-optimal and
introduces changes to existing
behavior.

Ryan

53d8cb4... by Ryan Harper on 2016-10-19

cc_snap_config: move snapuser creation out of handle and other cleanups

- Dropped distros = ['ubuntu']; snapd runs on other distros as well
- Dropped set_snappy_cmd; we require 'snap' for function
- Default assertions parameter to None to prevent object init
- Moved snapuser creation into method out of handle into add_snap_user
- Added unittests for new add_snap_user method

[Scott Moser (smoser)]

over all, looks good.
you dont have to clean up the handle, but if you see easy way to do that that'd be nice.

is the snappy path now valid on non-snappy system ? (ubuntu server with 'snap' support).

lastly, please just review your commit message and make sure its up to date with all changes (it may well be, just think you made some changes since you wrote it).

a353f18... by Ryan Harper on 2016-10-20

Revert "Merge branch 'fix-lp1619423' into snapuser-create"

This reverts commit 1b964281b506a7c5ba156730fd22d69091be957f, reversing
changes made to 3db49a7a586cab7df957ca0fca979b01431e49b3.

[Scott Moser (smoser)]

I merged this.
Had to fix flake8 tox and made one code change. basically in add_snap_user i returned if there was no 'email' and then un-indented the rest of that block.

diff --git a/cloudinit/config/cc_snap_config.py b/cloudinit/config/cc_snap_config.py
 new file mode 100644
index 0000000..ffb0768
--- /dev/null
+++ b/cloudinit/config/cc_snap_config.py
@@ -0,0 +1,183 @@
+# vi: ts=4 expandtab
+#
+#    Copyright (C) 2016 Canonical Ltd.
+#
+#    Author: Ryan Harper <[e-mail]>
+#
+#    This program is free software: you can redistribute it and/or modify
+#    it under the terms of the GNU General Public License version 3, as
+#    published by the Free Software Foundation.
+#
+#    This program is distributed in the hope that it will be useful,
+#    but WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#    GNU General Public License for more details.
+#
+#    You should have received a copy of the GNU General Public License
+#    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+"""
+Snappy
+------
+**Summary:** snap_config modules allows configuration of snapd.
+
+This module uses the same ``snappy`` namespace for configuration but
+acts only only a subset of the configuration.
+
+If ``assertions`` is set and the user has included a list of assertions
+then cloud-init will collect the assertions into a single assertion file
+and invoke ``snap ack <path to file with assertions>`` which will attempt
+to load the provided assertions into the snapd assertion database.
+
+If ``email`` is set, this value is used to create an authorized user for
+contacting and installing snaps from the Ubuntu Store.  This is done by
+calling ``snap create-user`` command.
+
+If ``known`` is set to True, then it is expected the user also included
+an assertion of type ``system-user``.  When ``snap create-user`` is called
+cloud-init will append '--known' flag which instructs snapd to look for
+a system-user assertion with the details.  If ``known`` is not set, then
+``snap create-user`` will contact the Ubuntu SSO for validating and importing
+a system-user for the instance.
+
+.. note::
+    If the system is already managed, then cloud-init will not attempt to
+    create a system-user.
+
+**Internal name:** ``cc_snap_config``
+
+**Module frequency:** per instance
+
+**Supported distros:** any with 'snapd' available
+
+**Config keys**::
+
+    #cloud-config
+    snappy:
+        assertions:
+        - |
+        <assertion 1>
+        - |
+        <assertion 2>
+        email: [e-mail]
+        known: true
+
+"""
+
+from cloudinit import log as logging
+from cloudinit.settings import PER_INSTANCE
+from cloudinit import util
+
+LOG = logging.getLogger(__name__)
+
+frequency = PER_INSTANCE
+SNAPPY_CMD = "snap"
+ASSERTIONS_FILE = "/var/lib/cloud/instance/snapd.assertions"
+
+
+"""
+snappy:
+  assertions:
+  - |
+  <snap assertion 1>
+  - |
+  <snap assertion 2>
+  email: [e-mail]
+  known: true
+"""
+
+
+def add_assertions(assertions=None):
+    """ Import list of assertions by concatenating each
+        assertion into a string separated by a '\n'.
+        Write this string to a instance file and
+        then invoke `snap ack /path/to/file`
+        and check for errors.
+
+        If snap exits 0, then all assertions are imported.
+    """
+    if not assertions:
+        assertions = []
+
+    if not isinstance(assertions, list):
+        raise ValueError('assertion parameter was not a list: %s', assertions)
+
+    snap_cmd = [SNAPPY_CMD, 'ack']
+    combined = "\n".join(assertions)
+    if len(combined) == 0:
+        raise ValueError("Assertion list is empty")
+
+    for asrt in assertions:
+        LOG.debug('Acking: %s', asrt.split('\n')[0:2])
+
+    util.write_file(ASSERTIONS_FILE, combined.encode('utf-8'))
+    util.subp(snap_cmd + [ASSERTIONS_FILE], capture=True)
+
+
+def add_snap_user(cfg=None):
+    """ Add a snap system-user if provided with email value
+        under snappy config.
+         - Check that system is not already managed.
+         - Check that if using a system-user assertion, that it's
+           imported into snapd.
+
+        Returns a dictionary to be passed to Distro.create_user
+    """
+
+    if not cfg:
+        cfg = {}
+
+    if not isinstance(cfg, dict):
+        raise ValueError('configuration parameter was not a dict: %s', cfg)
+
+    snapuser = cfg.get('email', None)
+    if snapuser:
+        usercfg = {
+            'snapuser': snapuser,
+            'known': cfg.get('known', False),
+        }
+
+        # query if we're already registered
+        out, _ = util.subp([SNAPPY_CMD, 'managed'], capture=True)
+        if out.strip() == "true":
+            LOG.warning('This device is already managed. '
+                        'Skipping system-user creation')
+            return
+
+        if usercfg.get('known'):
+            # Check that we imported a system-user assertion
+            out, _ = util.subp([SNAPPY_CMD, 'known', 'system-user'],
+                               capture=True)
+            if len(out) == 0:
+                LOG.error('Missing "system-user" assertion. '
+                          'Check "snappy" user-data assertions.')
+                return
+
+        return usercfg
+
+
+def handle(name, cfg, cloud, log, args):
+    cfgin = cfg.get('snappy')
+    if not cfgin:
+        LOG.debug('No snappy config provided, skipping')
+        return
+
+    if not(util.system_is_snappy()):
+        LOG.debug("%s: system not snappy", name)
+        return
+
+    assertions = cfgin.get('assertions', [])
+    if len(assertions) > 0:
+        LOG.debug('Importing user-provided snap assertions')
+        add_assertions(assertions)
+
+    # Create a snap user if requested.
+    # Snap systems contact the store with a user's email
+    # and extract information needed to create a local user.
+    # A user may provide a 'system-user' assertion which includes
+    # the required information. Using such an assertion to create
+    # a local user requires specifying 'known: true' in the supplied
+    # user-data.
+    usercfg = add_snap_user(cfg=cfgin)
+    if usercfg:
+        cloud.distro.create_user(usercfg.get('snapuser'), **usercfg)
diff --git a/cloudinit/config/cc_snappy.py b/cloudinit/config/cc_snappy.py
index 36db9e6..e03ec48 100644
--- a/cloudinit/config/cc_snappy.py
+++ b/cloudinit/config/cc_snappy.py
@@ -257,24 +257,14 @@ def disable_enable_ssh(enabled):
         util.write_file(not_to_be_run, "cloud-init\n")
 
 
-def system_is_snappy():
-    # channel.ini is configparser loadable.
-    # snappy will move to using /etc/system-image/config.d/*.ini
-    # this is certainly not a perfect test, but good enough for now.
-    content = util.load_file("/etc/system-image/channel.ini", quiet=True)
-    if 'ubuntu-core' in content.lower():
-        return True
-    if os.path.isdir("/etc/system-image/config.d/"):
-        return True
-    return False
-
-
 def set_snappy_command():
     global SNAPPY_CMD
     if util.which("snappy-go"):
         SNAPPY_CMD = "snappy-go"
-    else:
+    elif util.which("snappy"):
         SNAPPY_CMD = "snappy"
+    else:
+        SNAPPY_CMD = "snap"
     LOG.debug("snappy command is '%s'", SNAPPY_CMD)
 
 
@@ -289,7 +279,7 @@ def handle(name, cfg, cloud, log, args):
         LOG.debug("%s: System is not snappy. disabling", name)
         return
 
-    if sys_snappy.lower() == "auto" and not(system_is_snappy()):
+    if sys_snappy.lower() == "auto" and not(util.system_is_snappy()):
         LOG.debug("%s: 'auto' mode, and system not snappy", name)
         return
 
diff --git a/cloudinit/distros/__init__.py b/cloudinit/distros/__init__.py
index 78adf5f..4a72643 100755
--- a/cloudinit/distros/__init__.py
+++ b/cloudinit/distros/__init__.py
@@ -367,6 +367,9 @@ class Distro(object):
 
         adduser_cmd = ['useradd', name]
         log_adduser_cmd = ['useradd', name]
+        if util.system_is_snappy():
+            adduser_cmd.append('--extrausers')
+            log_adduser_cmd.append('--extrausers')
 
         # Since we are creating users, we want to carefully validate the
         # inputs. If something goes wrong, we can end up with a system
@@ -445,6 +448,32 @@ class Distro(object):
             util.logexc(LOG, "Failed to create user %s", name)
             raise e
 
+    def add_snap_user(self, name, **kwargs):
+        """
+        Add a snappy user to the system using snappy tools
+        """
+
+        snapuser = kwargs.get('snapuser')
+        known = kwargs.get('known', False)
+        adduser_cmd = ["snap", "create-user", "--sudoer", "--json"]
+        if known:
+            adduser_cmd.append("--known")
+        adduser_cmd.append(snapuser)
+
+        # Run the command
+        LOG.debug("Adding snap user %s", name)
+        try:
+            (out, err) = util.subp(adduser_cmd, logstring=adduser_cmd,
+                                   capture=True)
+            LOG.debug("snap create-user returned: %s:%s", out, err)
+            jobj = util.load_json(out)
+            username = jobj.get('username', None)
+        except Exception as e:
+            util.logexc(LOG, "Failed to create snap user %s", name)
+            raise e
+
+        return username
+
     def create_user(self, name, **kwargs):
         """
         Creates users for the system using the GNU passwd tools. This
@@ -452,6 +481,10 @@ class Distro(object):
         distros where useradd is not desirable or not available.
         """
 
+        # Add a snap user, if requested
+        if 'snapuser' in kwargs:
+            return self.add_snap_user(name, **kwargs)
+
         # Add the user
         self.add_user(name, **kwargs)
 
@@ -602,6 +635,8 @@ class Distro(object):
 
     def create_group(self, name, members=None):
         group_add_cmd = ['groupadd', name]
+        if util.system_is_snappy():
+            group_add_cmd.append('--extrausers')
         if not members:
             members = []
 
diff --git a/cloudinit/util.py b/cloudinit/util.py
index eb3e589..3a698df 100644
--- a/cloudinit/util.py
+++ b/cloudinit/util.py
@@ -2377,3 +2377,15 @@ def get_installed_packages(target=None):
             pkgs_inst.add(re.sub(":.*", "", pkg))
 
     return pkgs_inst
+
+
+def system_is_snappy():
+    # channel.ini is configparser loadable.
+    # snappy will move to using /etc/system-image/config.d/*.ini
+    # this is certainly not a perfect test, but good enough for now.
+    content = load_file("/etc/system-image/channel.ini", quiet=True)
+    if 'ubuntu-core' in content.lower():
+        return True
+    if os.path.isdir("/etc/system-image/config.d/"):
+        return True
+    return False
diff --git a/config/cloud.cfg b/config/cloud.cfg
index d608dc8..1b93e7f 100644
--- a/config/cloud.cfg
+++ b/config/cloud.cfg
@@ -45,6 +45,7 @@ cloud_config_modules:
 # Emit the cloud config ready event
 # this can be used by upstart jobs for 'start on cloud-config'.
  - emit_upstart
+ - snap_config
  - ssh-import-id
  - locale
  - set-passwords
diff --git a/doc/examples/cloud-config-user-groups.txt b/doc/examples/cloud-config-user-groups.txt
index 0e8ed24..d0082f3 100644
--- a/doc/examples/cloud-config-user-groups.txt
+++ b/doc/examples/cloud-config-user-groups.txt
@@ -30,6 +30,7 @@ users:
     gecos: Magic Cloud App Daemon User
     inactive: true
     system: true
+  - snapuser: [e-mail]
 
 # Valid Values:
 #   name: The user's login name
@@ -80,6 +81,13 @@ users:
 #               cloud-init does not parse/check the syntax of the sudo
 #               directive.
 #   system: Create the user as a system user. This means no home directory.
+#   snapuser: Create a Snappy (Ubuntu-Core) user via the snap create-user
+#             command available on Ubuntu systems.  If the user has an account
+#             on the Ubuntu SSO, specifying the email will allow snap to 
+#             request a username and any public ssh keys and will import
+#             these into the system with username specifed by SSO account.
+#             If 'username' is not set in SSO, then username will be the
+#             shortname before the email domain.
 #
 
 # Default user creation:
diff --git a/tests/unittests/test_distros/test_user_data_normalize.py b/tests/unittests/test_distros/test_user_data_normalize.py
index b24888f..33bf922 100755
--- a/tests/unittests/test_distros/test_user_data_normalize.py
+++ b/tests/unittests/test_distros/test_user_data_normalize.py
@@ -4,6 +4,7 @@ from cloudinit import helpers
 from cloudinit import settings
 
 from ..helpers import TestCase
+import mock
 
 
 bcfg = {
@@ -296,3 +297,67 @@ class TestUGNormalize(TestCase):
         self.assertIn('bob', users)
         self.assertEqual({'default': False}, users['joe'])
         self.assertEqual({'default': False}, users['bob'])
+
+    @mock.patch('cloudinit.util.subp')
+    def test_create_snap_user(self, mock_subp):
+        mock_subp.side_effect = [('{"username": "joe", "ssh-key-count": 1}\n',
+                                  '')]
+        distro = self._make_distro('ubuntu')
+        ug_cfg = {
+            'users': [
+                {'name': 'joe', 'snapuser': '[e-mail]'},
+            ],
+        }
+        (users, _groups) = self._norm(ug_cfg, distro)
+        for (user, config) in users.items():
+            print('user=%s config=%s' % (user, config))
+            username = distro.create_user(user, **config)
+
+        snapcmd = ['snap', 'create-user', '--sudoer', '--json', '[e-mail]']
+        mock_subp.assert_called_with(snapcmd, capture=True, logstring=snapcmd)
+        self.assertEqual(username, 'joe')
+
+    @mock.patch('cloudinit.util.subp')
+    def test_create_snap_user_known(self, mock_subp):
+        mock_subp.side_effect = [('{"username": "joe", "ssh-key-count": 1}\n',
+                                  '')]
+        distro = self._make_distro('ubuntu')
+        ug_cfg = {
+            'users': [
+                {'name': 'joe', 'snapuser': '[e-mail]', 'known': True},
+            ],
+        }
+        (users, _groups) = self._norm(ug_cfg, distro)
+        for (user, config) in users.items():
+            print('user=%s config=%s' % (user, config))
+            username = distro.create_user(user, **config)
+
+        snapcmd = ['snap', 'create-user', '--sudoer', '--json', '--known',
+                   '[e-mail]']
+        mock_subp.assert_called_with(snapcmd, capture=True, logstring=snapcmd)
+        self.assertEqual(username, 'joe')
+
+    @mock.patch('cloudinit.util.system_is_snappy')
+    @mock.patch('cloudinit.util.is_group')
+    @mock.patch('cloudinit.util.subp')
+    def test_add_user_on_snappy_system(self, mock_subp, mock_isgrp,
+                                       mock_snappy):
+        mock_isgrp.return_value = False
+        mock_subp.return_value = True
+        mock_snappy.return_value = True
+        distro = self._make_distro('ubuntu')
+        ug_cfg = {
+            'users': [
+                {'name': 'joe', 'groups': 'users', 'create_groups': True},
+            ],
+        }
+        (users, _groups) = self._norm(ug_cfg, distro)
+        for (user, config) in users.items():
+            print('user=%s config=%s' % (user, config))
+            distro.add_user(user, **config)
+
+        groupcmd = ['groupadd', 'users', '--extrausers']
+        addcmd = ['useradd', 'joe', '--extrausers', '--groups', 'users', '-m']
+
+        mock_subp.assert_any_call(groupcmd)
+        mock_subp.assert_any_call(addcmd, logstring=addcmd)
diff --git a/tests/unittests/test_handler/test_handler_snappy.py b/tests/unittests/test_handler/test_handler_snappy.py
index 57dce1b..e320dd8 100644
--- a/tests/unittests/test_handler/test_handler_snappy.py
+++ b/tests/unittests/test_handler/test_handler_snappy.py
@@ -1,14 +1,22 @@
 from cloudinit.config.cc_snappy import (
     makeop, get_package_ops, render_snap_op)
-from cloudinit import util
+from cloudinit.config.cc_snap_config import (
+    add_assertions, add_snap_user, ASSERTIONS_FILE)
+from cloudinit import (distros, helpers, cloud, util)
+from cloudinit.config.cc_snap_config import handle as snap_handle
+from cloudinit.sources import DataSourceNone
+from ..helpers import FilesystemMockingTestCase, mock
 
 from .. import helpers as t_help
 
+import logging
 import os
 import shutil
 import tempfile
+import textwrap
 import yaml
 
+LOG = logging.getLogger(__name__)
 ALLOWED = (dict, list, int, str)
 
 
@@ -287,6 +295,289 @@ class TestInstallPackages(t_help.TestCase):
         self.assertEqual(yaml.safe_load(mydata), data_found)
 
 
+class TestSnapConfig(FilesystemMockingTestCase):
+
+    SYSTEM_USER_ASSERTION = textwrap.dedent("""
+    type: system-user
+    authority-id: LqvZQdfyfGlYvtep4W6Oj6pFXP9t1Ksp
+    brand-id: LqvZQdfyfGlYvtep4W6Oj6pFXP9t1Ksp
+    email: [e-mail]
+    password: $6$E5YiAuMIPAwX58jG$miomhVNui/vf7f/3ctB/f0RWSKFxG0YXzrJ9rtJ1ikvzt
+    series:
+      - 16
+    since: 2016-09-10T16:34:00+03:00
+    until: 2017-11-10T16:34:00+03:00
+    username: baz
+    sign-key-sha3-384: RuVvnp4n52GilycjfbbTCI3_L8Y6QlIE75wxMc0KzGV3AUQqVd9GuXoj
+
+    AcLBXAQAAQoABgUCV/UU1wAKCRBKnlMoJQLkZVeLD/9/+hIeVywtzsDA3oxl+P+u9D13y9s6svP
+    Jd6Wnf4FTw6sq1GjBE4ZA7lrwSaRCUJ9Vcsvf2q9OGPY7mOb2TBxaDe0PbUMjrSrqllSSQwhpNI
+    zG+NxkkKuxsUmLzFa+k9m6cyojNbw5LFhQZBQCGlr3JYqC0tIREq/UsZxj+90TUC87lDJwkU8GF
+    s4CR+rejZj4itIcDcVxCSnJH6hv6j2JrJskJmvObqTnoOlcab+JXdamXqbldSP3UIhWoyVjqzkj
+    +to7mXgx+cCUA9+ngNCcfUG+1huGGTWXPCYkZ78HvErcRlIdeo4d3xwtz1cl/w3vYnq9og1XwsP
+    Yfetr3boig2qs1Y+j/LpsfYBYncgWjeDfAB9ZZaqQz/oc8n87tIPZDJHrusTlBfop8CqcM4xsKS
+    d+wnEY8e/F24mdSOYmS1vQCIDiRU3MKb6x138Ud6oHXFlRBbBJqMMctPqWDunWzb5QJ7YR0I39q
+    BrnEqv5NE0G7w6HOJ1LSPG5Hae3P4T2ea+ATgkb03RPr3KnXnzXg4TtBbW1nytdlgoNc/BafE1H
+    f3NThcq9gwX4xWZ2PAWnqVPYdDMyCtzW3Ck+o6sIzx+dh4gDLPHIi/6TPe/pUuMop9CBpWwez7V
+    v1z+1+URx6Xlq3Jq18y5pZ6fY3IDJ6km2nQPMzcm4Q==""")
+
+    ACCOUNT_ASSERTION = textwrap.dedent("""
+    type: account-key
+    authority-id: canonical
+    revision: 2
+    public-key-sha3-384: BWDEoaqyr25nF5SNCvEv2v7QnM9QsfCc0PBMYD_i2NGSQ32EF2d4D0
+    account-id: canonical
+    name: store
+    since: 2016-04-01T00:00:00.0Z
+    body-length: 717
+    sign-key-sha3-384: -CvQKAwRQ5h3Ffn10FILJoEZUXOv6km9FwA80-Rcj-f-6jadQ89VRswH
+
+    AcbBTQRWhcGAARAA0KKYYQWuHOrsFVi4p4l7ZzSvX7kLgJFFeFgOkzdWKBTHEnsMKjl5mefFe9j
+    qe8NlmJdfY7BenP7XeBtwKp700H/t9lLrZbpTNAPHXYxEWFJp5bPqIcJYBZ+29oLVLN1Tc5X482
+    vCiDqL8+pPYqBrK2fNlyPlNNSum9wI70rDDL4r6FVvr+osTnGejibdV8JphWX+lrSQDnRSdM8KJ
+    UM43vTgLGTi9W54oRhsA2OFexRfRksTrnqGoonCjqX5wO3OFSaMDzMsO2MJ/hPfLgDqw53qjzuK
+    Iec9OL3k5basvu2cj5u9tKwVFDsCKK2GbKUsWWpx2KTpOifmhmiAbzkTHbH9KaoMS7p0kJwhTQG
+    o9aJ9VMTWHJc/NCBx7eu451u6d46sBPCXS/OMUh2766fQmoRtO1OwCTxsRKG2kkjbMn54UdFULl
+    VfzvyghMNRKIezsEkmM8wueTqGUGZWa6CEZqZKwhe/PROxOPYzqtDH18XZknbU1n5lNb7vNfem9
+    2ai+3+JyFnW9UhfvpVF7gzAgdyCqNli4C6BIN43uwoS8HkykocZS/+Gv52aUQ/NZ8BKOHLw+7an
+    Q0o8W9ltSLZbEMxFIPSN0stiZlkXAp6DLyvh1Y4wXSynDjUondTpej2fSvSlCz/W5v5V7qA4nIc
+    vUvV7RjVzv17ut0AEQEAAQ==
+
+    AcLDXAQAAQoABgUCV83k9QAKCRDUpVvql9g3IBT8IACKZ7XpiBZ3W4lqbPssY6On81WmxQLtvsM
+    WTp6zZpl/wWOSt2vMNUk9pvcmrNq1jG9CuhDfWFLGXEjcrrmVkN3YuCOajMSPFCGrxsIBLSRt/b
+    nrKykdLAAzMfG8rP1d82bjFFiIieE+urQ0Kcv09Jtdvavq3JT1Tek5mFyyfhHNlQEKOzWqmRWiL
+    3c3VOZUs1ZD8TSlnuq/x+5T0X0YtOyGjSlVxk7UybbyMNd6MZfNaMpIG4x+mxD3KHFtBAC7O6kL
+    eX3i6j5nCY5UABfA3DZEAkWP4zlmdBEOvZ9t293NaDdOpzsUHRkoi0Zez/9BHQ/kwx/uNc2WqrY
+    inCmu16JGNeXqsyinnLl7Ghn2RwhvDMlLxF6RTx8xdx1yk6p3PBTwhZMUvuZGjUtN/AG8BmVJQ1
+    rsGSRkkSywvnhVJRB2sudnrMBmNS2goJbzSbmJnOlBrd2WsV0T9SgNMWZBiov3LvU4o2SmAb6b+
+    rYwh8H5QHcuuYJuxDjFhPswIp6Wes5T6hUicf3SWtObcDS4HSkVS4ImBjjX9YgCuFy7QdnooOWE
+    aPvkRw3XCVeYq0K6w9GRsk1YFErD4XmXXZjDYY650MX9v42Sz5MmphHV8jdIY5ssbadwFSe2rCQ
+    6UX08zy7RsIb19hTndE6ncvSNDChUR9eEnCm73eYaWTWTnq1cxdVP/s52r8uss++OYOkPWqh5nO
+    haRn7INjH/yZX4qXjNXlTjo0PnHH0q08vNKDwLhxS+D9du+70FeacXFyLIbcWllSbJ7DmbumGpF
+    yYbtj3FDDPzachFQdIG3lSt+cSUGeyfSs6wVtc3cIPka/2Urx7RprfmoWSI6+a5NcLdj0u2z8O9
+    HxeIgxDpg/3gT8ZIuFKePMcLDM19Fh/p0ysCsX+84B9chNWtsMSmIaE57V+959MVtsLu7SLb9gi
+    skrju0pQCwsu2wHMLTNd1f3PTHmrr49hxetTus07HSQUApMtAGKzQilF5zqFjbyaTd4xgQbd+PK
+    CjFyzQTDOcUhXpuUGt/IzlqiFfsCsmbj2K4KdSNYMlqIgZ3Azu8KvZLIhsyN7v5vNIZSPfEbjde
+    ClU9r0VRiJmtYBUjcSghD9LWn+yRLwOxhfQVjm0cBwIt5R/yPF/qC76yIVuWUtM5Y2/zJR1J8OF
+    qWchvlImHtvDzS9FQeLyzJAOjvZ2CnWp2gILgUz0WQdOk1Dq8ax7KS9BQ42zxw9EZAEPw3PEFqR
+    IQsRTONp+iVS8YxSmoYZjDlCgRMWUmawez/Fv5b9Fb/XkO5Eq4e+KfrpUujXItaipb+tV8h5v3t
+    oG3Ie3WOHrVjCLXIdYslpL1O4nadqR6Xv58pHj6k""")
+
+    test_assertions = [ACCOUNT_ASSERTION, SYSTEM_USER_ASSERTION]
+
+    def setUp(self):
+        super(TestSnapConfig, self).setUp()
+        self.subp = util.subp
+        self.new_root = tempfile.mkdtemp()
+        self.addCleanup(shutil.rmtree, self.new_root)
+
+    def _get_cloud(self, distro, metadata=None):
+        self.patchUtils(self.new_root)
+        paths = helpers.Paths({})
+        cls = distros.fetch(distro)
+        mydist = cls(distro, {}, paths)
+        myds = DataSourceNone.DataSourceNone({}, mydist, paths)
+        if metadata:
+            myds.metadata.update(metadata)
+        return cloud.Cloud(myds, paths, {}, mydist, None)
+
+    @mock.patch('cloudinit.util.write_file')
+    @mock.patch('cloudinit.util.subp')
+    def test_snap_config_add_assertions(self, msubp, mwrite):
+        add_assertions(self.test_assertions)
+
+        combined = "\n".join(self.test_assertions)
+        mwrite.assert_any_call(ASSERTIONS_FILE, combined.encode('utf-8'))
+        msubp.assert_called_with(['snap', 'ack', ASSERTIONS_FILE],
+                                 capture=True)
+
+    def test_snap_config_add_assertions_empty(self):
+        self.assertRaises(ValueError, add_assertions, [])
+
+    def test_add_assertions_nonlist(self):
+        self.assertRaises(ValueError, add_assertions, {})
+
+    @mock.patch('cloudinit.util.write_file')
+    @mock.patch('cloudinit.util.subp')
+    def test_snap_config_add_assertions_ack_fails(self, msubp, mwrite):
+        msubp.side_effect = [util.ProcessExecutionError("Invalid assertion")]
+        self.assertRaises(util.ProcessExecutionError, add_assertions,
+                          self.test_assertions)
+
+    @mock.patch('cloudinit.config.cc_snap_config.add_assertions')
+    @mock.patch('cloudinit.config.cc_snap_config.util')
+    def test_snap_config_handle_no_config(self, mock_util, mock_add):
+        cfg = {}
+        cc = self._get_cloud('ubuntu')
+        cc.distro = mock.MagicMock()
+        cc.distro.name = 'ubuntu'
+        mock_util.which.return_value = None
+        snap_handle('snap_config', cfg, cc, LOG, None)
+        mock_add.assert_not_called()
+
+    def test_snap_config_add_snap_user_no_config(self):
+        usercfg = add_snap_user(cfg=None)
+        self.assertEqual(usercfg, None)
+
+    def test_snap_config_add_snap_user_not_dict(self):
+        cfg = ['foobar']
+        self.assertRaises(ValueError, add_snap_user, cfg)
+
+    def test_snap_config_add_snap_user_no_email(self):
+        cfg = {'assertions': [], 'known': True}
+        usercfg = add_snap_user(cfg=cfg)
+        self.assertEqual(usercfg, None)
+
+    @mock.patch('cloudinit.config.cc_snap_config.util')
+    def test_snap_config_add_snap_user_email_only(self, mock_util):
+        email = '[e-mail]'
+        cfg = {'email': email}
+        mock_util.which.return_value = None
+        mock_util.system_is_snappy.return_value = True
+        mock_util.subp.side_effect = [
+            ("false\n", ""),  # snap managed
+        ]
+
+        usercfg = add_snap_user(cfg=cfg)
+
+        self.assertEqual(usercfg, {'snapuser': email, 'known': False})
+
+    @mock.patch('cloudinit.config.cc_snap_config.util')
+    def test_snap_config_add_snap_user_email_known(self, mock_util):
+        email = '[e-mail]'
+        known = True
+        cfg = {'email': email, 'known': known}
+        mock_util.which.return_value = None
+        mock_util.system_is_snappy.return_value = True
+        mock_util.subp.side_effect = [
+            ("false\n", ""),  # snap managed
+            (self.SYSTEM_USER_ASSERTION, ""),  # snap known system-user
+        ]
+
+        usercfg = add_snap_user(cfg=cfg)
+
+        self.assertEqual(usercfg, {'snapuser': email, 'known': known})
+
+    @mock.patch('cloudinit.config.cc_snap_config.add_assertions')
+    @mock.patch('cloudinit.config.cc_snap_config.util')
+    def test_snap_config_handle_system_not_snappy(self, mock_util, mock_add):
+        cfg = {'snappy': {'assertions': self.test_assertions}}
+        cc = self._get_cloud('ubuntu')
+        cc.distro = mock.MagicMock()
+        cc.distro.name = 'ubuntu'
+        mock_util.which.return_value = None
+        mock_util.system_is_snappy.return_value = False
+
+        snap_handle('snap_config', cfg, cc, LOG, None)
+
+        mock_add.assert_not_called()
+
+    @mock.patch('cloudinit.config.cc_snap_config.add_assertions')
+    @mock.patch('cloudinit.config.cc_snap_config.util')
+    def test_snap_config_handle_snapuser(self, mock_util, mock_add):
+        email = '[e-mail]'
+        cfg = {
+            'snappy': {
+                'assertions': self.test_assertions,
+                'email': email,
+            }
+        }
+        cc = self._get_cloud('ubuntu')
+        cc.distro = mock.MagicMock()
+        cc.distro.name = 'ubuntu'
+        mock_util.which.return_value = None
+        mock_util.system_is_snappy.return_value = True
+        mock_util.subp.side_effect = [
+            ("false\n", ""),  # snap managed
+        ]
+
+        snap_handle('snap_config', cfg, cc, LOG, None)
+
+        mock_add.assert_called_with(self.test_assertions)
+        usercfg = {'snapuser': email, 'known': False}
+        cc.distro.create_user.assert_called_with(email, **usercfg)
+
+    @mock.patch('cloudinit.config.cc_snap_config.add_assertions')
+    @mock.patch('cloudinit.config.cc_snap_config.util')
+    def test_snap_config_handle_snapuser_known(self, mock_util, mock_add):
+        email = '[e-mail]'
+        cfg = {
+            'snappy': {
+                'assertions': self.test_assertions,
+                'email': email,
+                'known': True,
+            }
+        }
+        cc = self._get_cloud('ubuntu')
+        cc.distro = mock.MagicMock()
+        cc.distro.name = 'ubuntu'
+        mock_util.which.return_value = None
+        mock_util.system_is_snappy.return_value = True
+        mock_util.subp.side_effect = [
+            ("false\n", ""),  # snap managed
+            (self.SYSTEM_USER_ASSERTION, ""),  # snap known system-user
+        ]
+
+        snap_handle('snap_config', cfg, cc, LOG, None)
+
+        mock_add.assert_called_with(self.test_assertions)
+        usercfg = {'snapuser': email, 'known': True}
+        cc.distro.create_user.assert_called_with(email, **usercfg)
+
+    @mock.patch('cloudinit.config.cc_snap_config.add_assertions')
+    @mock.patch('cloudinit.config.cc_snap_config.util')
+    def test_snap_config_handle_snapuser_known_managed(self, mock_util,
+                                                       mock_add):
+        email = '[e-mail]'
+        cfg = {
+            'snappy': {
+                'assertions': self.test_assertions,
+                'email': email,
+                'known': True,
+            }
+        }
+        cc = self._get_cloud('ubuntu')
+        cc.distro = mock.MagicMock()
+        cc.distro.name = 'ubuntu'
+        mock_util.which.return_value = None
+        mock_util.system_is_snappy.return_value = True
+        mock_util.subp.side_effect = [
+            ("true\n", ""),  # snap managed
+        ]
+
+        snap_handle('snap_config', cfg, cc, LOG, None)
+
+        mock_add.assert_called_with(self.test_assertions)
+        cc.distro.create_user.assert_not_called()
+
+    @mock.patch('cloudinit.config.cc_snap_config.add_assertions')
+    @mock.patch('cloudinit.config.cc_snap_config.util')
+    def test_snap_config_handle_snapuser_known_no_assertion(self, mock_util,
+                                                            mock_add):
+        email = '[e-mail]'
+        cfg = {
+            'snappy': {
+                'assertions': [self.ACCOUNT_ASSERTION],
+                'email': email,
+                'known': True,
+            }
+        }
+        cc = self._get_cloud('ubuntu')
+        cc.distro = mock.MagicMock()
+        cc.distro.name = 'ubuntu'
+        mock_util.which.return_value = None
+        mock_util.system_is_snappy.return_value = True
+        mock_util.subp.side_effect = [
+            ("true\n", ""),  # snap managed
+            ("", ""),        # snap known system-user
+        ]
+
+        snap_handle('snap_config', cfg, cc, LOG, None)
+
+        mock_add.assert_called_with([self.ACCOUNT_ASSERTION])
+        cc.distro.create_user.assert_not_called()
+
+
 def makeop_tmpd(tmpd, op, name, config=None, path=None, cfgfile=None):
     if cfgfile:
         cfgfile = os.path.sep.join([tmpd, cfgfile])