Merge lp:~ajkavanagh/charm-helpers/support-maintenance-mode into lp:charm-helpers

[Alex Kavanagh]

Support pause/resume functionality for OpenStack charms. Pause and resume are baked into set_os_workload_status() and also perform additional checks using service_running() and port listening checks.

Also includes a @pausable_restart_on_change decorator which can be used in-place of @restart_on_change which gates the restart of services if the unit is supposed to be paused.

[Liam Young (gnuoy)]

It looks good to me, I like the rejig. A minor nitpick but could you expand some of the list comprehensions, I find them hard to parse tbh. I've pointed them out in line.

review: Needs Fixing

[Alex Kavanagh (ajkavanagh)]

Thanks for looking through it; I know it's a big patch. I'll simplify the list comprehensions, and I've commented inline/responses.

[lp:~ajkavanagh/charm-helpers/support-maintenance-mode]

542. By Alex Kavanagh on 2016-03-07

Simplify the list comprehensions around message generation as per gnuoy's
suggestions. They were a little unreadable.

[Liam Young (gnuoy)]

Looks good to me, thanks for the mp!

review: Approve

=== modified file 'charmhelpers/contrib/openstack/utils.py'
--- charmhelpers/contrib/openstack/utils.py	2016-02-17 16:29:13 +0000
+++ charmhelpers/contrib/openstack/utils.py	2016-03-07 16:45:36 +0000
@@ -24,6 +24,7 @@
 import sys
 import re
 import itertools
+import functools
 
 import six
 import tempfile
@@ -69,7 +70,15 @@
     pip_install,
 )
 
-from charmhelpers.core.host import lsb_release, mounts, umount, service_running
+from charmhelpers.core.host import (
+    lsb_release,
+    mounts,
+    umount,
+    service_running,
+    service_pause,
+    service_resume,
+    restart_on_change_helper,
+)
 from charmhelpers.fetch import apt_install, apt_cache, install_remote
 from charmhelpers.contrib.storage.linux.utils import is_block_device, zap_disk
 from charmhelpers.contrib.storage.linux.loopback import ensure_loopback_device
@@ -862,66 +871,155 @@
     return wrap
 
 
-def set_os_workload_status(configs, required_interfaces, charm_func=None, services=None, ports=None):
-    """
-    Set workload status based on complete contexts.
-    status-set missing or incomplete contexts
-    and juju-log details of missing required data.
-    charm_func is a charm specific function to run checking
-    for charm specific requirements such as a VIP setting.
-
-    This function also checks for whether the services defined are ACTUALLY
-    running and that the ports they advertise are open and being listened to.
-
-    @param services - OPTIONAL: a [{'service': <string>, 'ports': [<int>]]
-                      The ports are optional.
-                      If services is a [<string>] then ports are ignored.
-    @param ports - OPTIONAL: an [<int>] representing ports that shoudl be
-                   open.
-    @returns None
-    """
-    incomplete_rel_data = incomplete_relation_data(configs, required_interfaces)
-    state = 'active'
-    missing_relations = []
-    incomplete_relations = []
+def set_os_workload_status(configs, required_interfaces, charm_func=None,
+                           services=None, ports=None):
+    """Set the state of the workload status for the charm.
+
+    This calls _determine_os_workload_status() to get the new state, message
+    and sets the status using status_set()
+
+    @param configs: a templating.OSConfigRenderer() object
+    @param required_interfaces: {generic: [specific, specific2, ...]}
+    @param charm_func: a callable function that returns state, message. The
+                       signature is charm_func(configs) -> (state, message)
+    @param services: list of strings OR dictionary specifying services/ports
+    @param ports: OPTIONAL list of port numbers.
+    @returns state, message: the new workload status, user message
+    """
+    state, message = _determine_os_workload_status(
+        configs, required_interfaces, charm_func, services, ports)
+    status_set(state, message)
+
+
+def _determine_os_workload_status(
+        configs, required_interfaces, charm_func=None,
+        services=None, ports=None):
+    """Determine the state of the workload status for the charm.
+
+    This function returns the new workload status for the charm based
+    on the state of the interfaces, the paused state and whether the
+    services are actually running and any specified ports are open.
+
+    This checks:
+
+     1. if the unit should be paused, that it is actually paused.  If so the
+        state is 'maintenance' + message, else 'broken'.
+     2. that the interfaces/relations are complete.  If they are not then
+        it sets the state to either 'broken' or 'waiting' and an appropriate
+        message.
+     3. If all the relation data is set, then it checks that the actual
+        services really are running.  If not it sets the state to 'broken'.
+
+    If everything is okay then the state returns 'active'.
+
+    @param configs: a templating.OSConfigRenderer() object
+    @param required_interfaces: {generic: [specific, specific2, ...]}
+    @param charm_func: a callable function that returns state, message. The
+                       signature is charm_func(configs) -> (state, message)
+    @param services: list of strings OR dictionary specifying services/ports
+    @param ports: OPTIONAL list of port numbers.
+    @returns state, message: the new workload status, user message
+    """
+    state, message = _ows_check_if_paused(services, ports)
+
+    if state is None:
+        state, message = _ows_check_generic_interfaces(
+            configs, required_interfaces)
+
+    if state != 'maintenance' and charm_func:
+        # _ows_check_charm_func() may modify the state, message
+        state, message = _ows_check_charm_func(
+            state, message, lambda: charm_func(configs))
+
+    if state is None:
+        state, message = _ows_check_services_running(services, ports)
+
+    if state is None:
+        state = 'active'
+        message = "Unit is ready"
+        juju_log(message, 'INFO')
+
+    return state, message
+
+
+def _ows_check_if_paused(services=None, ports=None):
+    """Check if the unit is supposed to be paused, and if so check that the
+    services/ports (if passed) are actually stopped/not being listened to.
+
+    if the unit isn't supposed to be paused, just return None, None
+
+    @param services: OPTIONAL services spec or list of service names.
+    @param ports: OPTIONAL list of port numbers.
+    @returns state, message or None, None
+    """
+    if is_unit_paused_set():
+        state, message = check_actually_paused(services=services,
+                                               ports=ports)
+        if state is None:
+            # we're paused okay, so set maintenance and return
+            state = "maintenance"
+            message = "Paused. Use 'resume' action to resume normal service."
+        return state, message
+    return None, None
+
+
+def _ows_check_generic_interfaces(configs, required_interfaces):
+    """Check the complete contexts to determine the workload status.
+
+     - Checks for missing or incomplete contexts
+     - juju log details of missing required data.
+     - determines the correct workload status
+     - creates an appropriate message for status_set(...)
+
+    if there are no problems then the function returns None, None
+
+    @param configs: a templating.OSConfigRenderer() object
+    @params required_interfaces: {generic_interface: [specific_interface], }
+    @returns state, message or None, None
+    """
+    incomplete_rel_data = incomplete_relation_data(configs,
+                                                   required_interfaces)
+    state = None
     message = None
-    charm_state = None
-    charm_message = None
+    missing_relations = set()
+    incomplete_relations = set()
 
-    for generic_interface in incomplete_rel_data.keys():
+    for generic_interface, relations_states in incomplete_rel_data.items():
         related_interface = None
         missing_data = {}
         # Related or not?
-        for interface in incomplete_rel_data[generic_interface]:
-            if incomplete_rel_data[generic_interface][interface].get('related'):
+        for interface, relation_state in relations_states.items():
+            if relation_state.get('related'):
                 related_interface = interface
-                missing_data = incomplete_rel_data[generic_interface][interface].get('missing_data')
-        # No relation ID for the generic_interface
+                missing_data = relation_state.get('missing_data')
+                break
+        # No relation ID for the generic_interface?
         if not related_interface:
             juju_log("{} relation is missing and must be related for "
                      "functionality. ".format(generic_interface), 'WARN')
             state = 'blocked'
-            if generic_interface not in missing_relations:
-                missing_relations.append(generic_interface)
+            missing_relations.add(generic_interface)
         else:
-            # Relation ID exists but no related unit
+            # Relation ID eists but no related unit
             if not missing_data:
-                # Edge case relation ID exists but departing
-                if ('departed' in hook_name() or 'broken' in hook_name()) \
-                        and related_interface in hook_name():
+                # Edge case - relation ID exists but departings
+                _hook_name = hook_name()
+                if (('departed' in _hook_name or 'broken' in _hook_name) and
+                        related_interface in _hook_name):
                     state = 'blocked'
-                    if generic_interface not in missing_relations:
-                        missing_relations.append(generic_interface)
+                    missing_relations.add(generic_interface)
                     juju_log("{} relation's interface, {}, "
                              "relationship is departed or broken "
                              "and is required for functionality."
-                             "".format(generic_interface, related_interface), "WARN")
+                             "".format(generic_interface, related_interface),
+                             "WARN")
                 # Normal case relation ID exists but no related unit
                 # (joining)
                 else:
                     juju_log("{} relations's interface, {}, is related but has "
                              "no units in the relation."
-                             "".format(generic_interface, related_interface), "INFO")
+                             "".format(generic_interface, related_interface),
+                             "INFO")
             # Related unit exists and data missing on the relation
             else:
                 juju_log("{} relation's interface, {}, is related awaiting "
@@ -930,9 +1028,8 @@
                                    ", ".join(missing_data)), "INFO")
             if state != 'blocked':
                 state = 'waiting'
-            if generic_interface not in incomplete_relations \
-                    and generic_interface not in missing_relations:
-                incomplete_relations.append(generic_interface)
+            if generic_interface not in missing_relations:
+                incomplete_relations.add(generic_interface)
 
     if missing_relations:
         message = "Missing relations: {}".format(", ".join(missing_relations))
@@ -945,9 +1042,22 @@
                   "".format(", ".join(incomplete_relations))
         state = 'waiting'
 
-    # Run charm specific checks
-    if charm_func:
-        charm_state, charm_message = charm_func(configs)
+    return state, message
+
+
+def _ows_check_charm_func(state, message, charm_func_with_configs):
+    """Run a custom check function for the charm to see if it wants to
+    change the state.  This is only run if not in 'maintenance' and
+    tests to see if the new state is more important that the previous
+    one determined by the interfaces/relations check.
+
+    @param state: the previously determined state so far.
+    @param message: the user orientated message so far.
+    @param charm_func: a callable function that returns state, message
+    @returns state, message strings.
+    """
+    if charm_func_with_configs:
+        charm_state, charm_message = charm_func_with_configs()
         if charm_state != 'active' and charm_state != 'unknown':
             state = workload_state_compare(state, charm_state)
             if message:
@@ -956,72 +1066,151 @@
                 message = "{}, {}".format(message, charm_message)
             else:
                 message = charm_message
-
-    # If the charm thinks the unit is active, check that the actual services
-    # really are active.
-    if services is not None and state == 'active':
-        # if we're passed the dict() then just grab the values as a list.
-        if isinstance(services, dict):
-            services = services.values()
-        # either extract the list of services from the dictionary, or if
-        # it is a simple string, use that. i.e. works with mixed lists.
-        _s = []
-        for s in services:
-            if isinstance(s, dict) and 'service' in s:
-                _s.append(s['service'])
-            if isinstance(s, str):
-                _s.append(s)
-        services_running = [service_running(s) for s in _s]
-        if not all(services_running):
-            not_running = [s for s, running in zip(_s, services_running)
-                           if not running]
-            message = ("Services not running that should be: {}"
-                       .format(", ".join(not_running)))
+    return state, message
+
+
+def _ows_check_services_running(services, ports):
+    """Check that the services that should be running are actually running
+    and that any ports specified are being listened to.
+
+    @param services: list of strings OR dictionary specifying services/ports
+    @param ports: list of ports
+    @returns state, message: strings or None, None
+    """
+    messages = []
+    state = None
+    if services is not None:
+        services = _extract_services_list_helper(services)
+        services_running, running = _check_running_services(services)
+        if not all(running):
+            messages.append(
+                "Services not running that should be: {}"
+                .format(", ".join(_filter_tuples(services_running, False))))
             state = 'blocked'
         # also verify that the ports that should be open are open
         # NB, that ServiceManager objects only OPTIONALLY have ports
-        port_map = OrderedDict([(s['service'], s['ports'])
-                                for s in services if 'ports' in s])
-        if state == 'active' and port_map:
-            all_ports = list(itertools.chain(*port_map.values()))
-            ports_open = [port_has_listener('0.0.0.0', p)
-                          for p in all_ports]
-            if not all(ports_open):
-                not_opened = [p for p, opened in zip(all_ports, ports_open)
-                              if not opened]
-                map_not_open = OrderedDict()
-                for service, ports in port_map.items():
-                    closed_ports = set(ports).intersection(not_opened)
-                    if closed_ports:
-                        map_not_open[service] = closed_ports
-                # find which service has missing ports. They are in service
-                # order which makes it a bit easier.
-                message = (
-                    "Services with ports not open that should be: {}"
-                    .format(
-                        ", ".join([
-                            "{}: [{}]".format(
-                                service,
-                                ", ".join([str(v) for v in ports]))
-                            for service, ports in map_not_open.items()])))
-                state = 'blocked'
+        map_not_open, ports_open = (
+            _check_listening_on_services_ports(services))
+        if not all(ports_open):
+            # find which service has missing ports. They are in service
+            # order which makes it a bit easier.
+            message_parts = {service: ", ".join([str(v) for v in open_ports])
+                             for service, open_ports in map_not_open.items()}
+            message = ", ".join(
+                ["{}: [{}]".format(s, sp) for s, sp in message_parts.items()])
+            messages.append(
+                "Services with ports not open that should be: {}"
+                .format(message))
+            state = 'blocked'
 
-    if ports is not None and state == 'active':
+    if ports is not None:
         # and we can also check ports which we don't know the service for
-        ports_open = [port_has_listener('0.0.0.0', p) for p in ports]
-        if not all(ports_open):
-            message = (
+        ports_open, ports_open_bools = _check_listening_on_ports_list(ports)
+        if not all(ports_open_bools):
+            messages.append(
                 "Ports which should be open, but are not: {}"
-                .format(", ".join([str(p) for p, v in zip(ports, ports_open)
+                .format(", ".join([str(p) for p, v in ports_open
                                    if not v])))
             state = 'blocked'
 
-    # Set to active if all requirements have been met
-    if state == 'active':
-        message = "Unit is ready"
-        juju_log(message, "INFO")
-
-    status_set(state, message)
+    if state is not None:
+        message = "; ".join(messages)
+        return state, message
+
+    return None, None
+
+
+def _extract_services_list_helper(services):
+    """Extract a OrderedDict of {service: [ports]} of the supplied services
+    for use by the other functions.
+
+    The services object can either be:
+      - None : no services were passed (an empty dict is returned)
+      - a list of strings
+      - A dictionary (optionally OrderedDict) {service_name: {'service': ..}}
+      - An array of [{'service': service_name, ...}, ...]
+
+    @param services: see above
+    @returns OrderedDict(service: [ports], ...)
+    """
+    if services is None:
+        return {}
+    if isinstance(services, dict):
+        services = services.values()
+    # either extract the list of services from the dictionary, or if
+    # it is a simple string, use that. i.e. works with mixed lists.
+    _s = OrderedDict()
+    for s in services:
+        if isinstance(s, dict) and 'service' in s:
+            _s[s['service']] = s.get('ports', [])
+        if isinstance(s, str):
+            _s[s] = []
+    return _s
+
+
+def _check_running_services(services):
+    """Check that the services dict provided is actually running and provide
+    a list of (service, boolean) tuples for each service.
+
+    Returns both a zipped list of (service, boolean) and a list of booleans
+    in the same order as the services.
+
+    @param services: OrderedDict of strings: [ports], one for each service to
+                     check.
+    @returns [(service, boolean), ...], : results for checks
+             [boolean]                  : just the result of the service checks
+    """
+    services_running = [service_running(s) for s in services]
+    return list(zip(services, services_running)), services_running
+
+
+def _check_listening_on_services_ports(services, test=False):
+    """Check that the unit is actually listening (has the port open) on the
+    ports that the service specifies are open. If test is True then the
+    function returns the services with ports that are open rather than
+    closed.
+
+    Returns an OrderedDict of service: ports and a list of booleans
+
+    @param services: OrderedDict(service: [port, ...], ...)
+    @param test: default=False, if False, test for closed, otherwise open.
+    @returns OrderedDict(service: [port-not-open, ...]...), [boolean]
+    """
+    test = not(not(test))  # ensure test is True or False
+    all_ports = list(itertools.chain(*services.values()))
+    ports_states = [port_has_listener('0.0.0.0', p) for p in all_ports]
+    map_ports = OrderedDict()
+    matched_ports = [p for p, opened in zip(all_ports, ports_states)
+                     if opened == test]  # essentially opened xor test
+    for service, ports in services.items():
+        set_ports = set(ports).intersection(matched_ports)
+        if set_ports:
+            map_ports[service] = set_ports
+    return map_ports, ports_states
+
+
+def _check_listening_on_ports_list(ports):
+    """Check that the ports list given are being listened to
+
+    Returns a list of ports being listened to and a list of the
+    booleans.
+
+    @param ports: LIST or port numbers.
+    @returns [(port_num, boolean), ...], [boolean]
+    """
+    ports_open = [port_has_listener('0.0.0.0', p) for p in ports]
+    return zip(ports, ports_open), ports_open
+
+
+def _filter_tuples(services_states, state):
+    """Return a simple list from a list of tuples according to the condition
+
+    @param services_states: LIST of (string, boolean): service and running
+           state.
+    @param state: Boolean to match the tuple against.
+    @returns [LIST of strings] that matched the tuple RHS.
+    """
+    return [s for s, b in services_states if b == state]
 
 
 def workload_state_compare(current_workload_state, workload_state):
@@ -1046,8 +1235,7 @@
 
 
 def incomplete_relation_data(configs, required_interfaces):
-    """
-    Check complete contexts against required_interfaces
+    """Check complete contexts against required_interfaces
     Return dictionary of incomplete relation data.
 
     configs is an OSConfigRenderer object with configs registered
@@ -1072,19 +1260,13 @@
               'shared-db': {'related': True}}}
     """
     complete_ctxts = configs.complete_contexts()
-    incomplete_relations = []
-    for svc_type in required_interfaces.keys():
-        # Avoid duplicates
-        found_ctxt = False
-        for interface in required_interfaces[svc_type]:
-            if interface in complete_ctxts:
-                found_ctxt = True
-        if not found_ctxt:
-            incomplete_relations.append(svc_type)
-    incomplete_context_data = {}
-    for i in incomplete_relations:
-        incomplete_context_data[i] = configs.get_incomplete_context_data(required_interfaces[i])
-    return incomplete_context_data
+    incomplete_relations = [
+        svc_type
+        for svc_type, interfaces in required_interfaces.items()
+        if not set(interfaces).intersection(complete_ctxts)]
+    return {
+        i: configs.get_incomplete_context_data(required_interfaces[i])
+        for i in incomplete_relations}
 
 
 def do_action_openstack_upgrade(package, upgrade_callback, configs):
@@ -1145,3 +1327,242 @@
             relation_set(relation_id=rid,
                          relation_settings=trigger,
                          )
+
+
+def check_actually_paused(services=None, ports=None):
+    """Check that services listed in the services object and and ports
+    are actually closed (not listened to), to verify that the unit is
+    properly paused.
+
+    @param services: See _extract_services_list_helper
+    @returns status, : string for status (None if okay)
+             message : string for problem for status_set
+    """
+    state = None
+    message = None
+    messages = []
+    if services is not None:
+        services = _extract_services_list_helper(services)
+        services_running, services_states = _check_running_services(services)
+        if any(services_states):
+            # there shouldn't be any running so this is a problem
+            messages.append("these services running: {}"
+                            .format(", ".join(
+                                _filter_tuples(services_running, True))))
+            state = "blocked"
+        ports_open, ports_open_bools = (
+            _check_listening_on_services_ports(services, True))
+        if any(ports_open_bools):
+            message_parts = {service: ", ".join([str(v) for v in open_ports])
+                             for service, open_ports in ports_open.items()}
+            message = ", ".join(
+                ["{}: [{}]".format(s, sp) for s, sp in message_parts.items()])
+            messages.append(
+                "these service:ports are open: {}".format(message))
+            state = 'blocked'
+    if ports is not None:
+        ports_open, bools = _check_listening_on_ports_list(ports)
+        if any(bools):
+            messages.append(
+                "these ports which should be closed, but are open: {}"
+                .format(", ".join([str(p) for p, v in ports_open if v])))
+            state = 'blocked'
+    if messages:
+        message = ("Services should be paused but {}"
+                   .format(", ".join(messages)))
+    return state, message
+
+
+def set_unit_paused():
+    """Set the unit to a paused state in the local kv() store.
+    This does NOT actually pause the unit
+    """
+    with unitdata.HookData()() as kv:
+        kv.set('unit-paused', True)
+
+
+def clear_unit_paused():
+    """Clear the unit from a paused state in the local kv() store
+    This does NOT actually restart any services - it only clears the
+    local state.
+    """
+    with unitdata.HookData()() as kv:
+        kv.set('unit-paused', False)
+
+
+def is_unit_paused_set():
+    """Return the state of the kv().get('unit-paused').
+    This does NOT verify that the unit really is paused.
+
+    To help with units that don't have HookData() (testing)
+    if it excepts, return False
+    """
+    try:
+        with unitdata.HookData()() as kv:
+            # transform something truth-y into a Boolean.
+            return not(not(kv.get('unit-paused')))
+    except:
+        return False
+
+
+def pause_unit(assess_status_func, services=None, ports=None,
+               charm_func=None):
+    """Pause a unit by stopping the services and setting 'unit-paused'
+    in the local kv() store.
+
+    Also checks that the services have stopped and ports are no longer
+    being listened to.
+
+    An optional charm_func() can be called that can either raise an
+    Exception or return non None, None to indicate that the unit
+    didn't pause cleanly.
+
+    The signature for charm_func is:
+    charm_func() -> message: string
+
+    charm_func() is executed after any services are stopped, if supplied.
+
+    The services object can either be:
+      - None : no services were passed (an empty dict is returned)
+      - a list of strings
+      - A dictionary (optionally OrderedDict) {service_name: {'service': ..}}
+      - An array of [{'service': service_name, ...}, ...]
+
+    @param assess_status_func: (f() -> message: string | None) or None
+    @param services: OPTIONAL see above
+    @param ports: OPTIONAL list of port
+    @param charm_func: function to run for custom charm pausing.
+    @returns None
+    @raises Exception(message) on an error for action_fail().
+    """
+    services = _extract_services_list_helper(services)
+    messages = []
+    if services:
+        for service in services.keys():
+            stopped = service_pause(service)
+            if not stopped:
+                messages.append("{} didn't stop cleanly.".format(service))
+    if charm_func:
+        try:
+            message = charm_func()
+            if message:
+                messages.append(message)
+        except Exception as e:
+            message.append(str(e))
+    set_unit_paused()
+    if assess_status_func:
+        message = assess_status_func()
+        if message:
+            messages.append(message)
+    if messages:
+        raise Exception("Couldn't pause: {}".format("; ".join(messages)))
+
+
+def resume_unit(assess_status_func, services=None, ports=None,
+                charm_func=None):
+    """Resume a unit by starting the services and clearning 'unit-paused'
+    in the local kv() store.
+
+    Also checks that the services have started and ports are being listened to.
+
+    An optional charm_func() can be called that can either raise an
+    Exception or return non None to indicate that the unit
+    didn't resume cleanly.
+
+    The signature for charm_func is:
+    charm_func() -> message: string
+
+    charm_func() is executed after any services are started, if supplied.
+
+    The services object can either be:
+      - None : no services were passed (an empty dict is returned)
+      - a list of strings
+      - A dictionary (optionally OrderedDict) {service_name: {'service': ..}}
+      - An array of [{'service': service_name, ...}, ...]
+
+    @param assess_status_func: (f() -> message: string | None) or None
+    @param services: OPTIONAL see above
+    @param ports: OPTIONAL list of port
+    @param charm_func: function to run for custom charm resuming.
+    @returns None
+    @raises Exception(message) on an error for action_fail().
+    """
+    services = _extract_services_list_helper(services)
+    messages = []
+    if services:
+        for service in services.keys():
+            started = service_resume(service)
+            if not started:
+                messages.append("{} didn't start cleanly.".format(service))
+    if charm_func:
+        try:
+            message = charm_func()
+            if message:
+                messages.append(message)
+        except Exception as e:
+            message.append(str(e))
+    clear_unit_paused()
+    if assess_status_func:
+        message = assess_status_func()
+        if message:
+            messages.append(message)
+    if messages:
+        raise Exception("Couldn't resume: {}".format("; ".join(messages)))
+
+
+def make_assess_status_func(*args, **kwargs):
+    """Creates an assess_status_func() suitable for handing to pause_unit()
+    and resume_unit().
+
+    This uses the _determine_os_workload_status(...) function to determine
+    what the workload_status should be for the unit.  If the unit is
+    not in maintenance or active states, then the message is returned to
+    the caller.  This is so an action that doesn't result in either a
+    complete pause or complete resume can signal failure with an action_fail()
+    """
+    def _assess_status_func():
+        state, message = _determine_os_workload_status(*args, **kwargs)
+        status_set(state, message)
+        if state not in ['maintenance', 'active']:
+            return message
+        return None
+
+    return _assess_status_func
+
+
+def pausable_restart_on_change(restart_map, stopstart=False):
+    """A restart_on_change decorator that checks to see if the unit is
+    paused. If it is paused then the decorated function doesn't fire.
+
+    This is provided as a helper, as the @restart_on_change(...) decorator
+    is in core.host, yet the openstack specific helpers are in this file
+    (contrib.openstack.utils).  Thus, this needs to be an optional feature
+    for openstack charms (or charms that wish to use the openstack
+    pause/resume type features).
+
+    It is used as follows:
+
+        from contrib.openstack.utils import (
+            pausable_restart_on_change as restart_on_change)
+
+        @restart_on_change(restart_map, stopstart=<boolean>)
+        def some_hook(...):
+            pass
+
+    see core.utils.restart_on_change() for more details.
+
+    @param f: the function to decorate
+    @param restart_map: the restart map {conf_file: [services]}
+    @param stopstart: DEFAULT false; whether to stop, start or just restart
+    @returns decorator to use a restart_on_change with pausability
+    """
+    def wrap(f):
+        @functools.wraps(f)
+        def wrapped_f(*args, **kwargs):
+            if is_unit_paused_set():
+                return f(*args, **kwargs)
+            # otherwise, normal restart_on_change functionality
+            return restart_on_change_helper(
+                (lambda: f(*args, **kwargs)), restart_map, stopstart)
+        return wrapped_f
+    return wrap

=== modified file 'charmhelpers/core/host.py'
--- charmhelpers/core/host.py	2016-01-19 21:53:13 +0000
+++ charmhelpers/core/host.py	2016-03-07 16:45:36 +0000
@@ -30,6 +30,8 @@
 import string
 import subprocess
 import hashlib
+import functools
+import itertools
 from contextlib import contextmanager
 from collections import OrderedDict
 
@@ -428,27 +430,47 @@
     restarted if any file matching the pattern got changed, created
     or removed. Standard wildcards are supported, see documentation
     for the 'glob' module for more information.
+
+    @param restart_map: {path_file_name: [service_name, ...]
+    @param stopstart: DEFAULT false; whether to stop, start OR restart
+    @returns result from decorated function
     """
     def wrap(f):
+        @functools.wraps(f)
         def wrapped_f(*args, **kwargs):
-            checksums = {path: path_hash(path) for path in restart_map}
-            f(*args, **kwargs)
-            restarts = []
-            for path in restart_map:
-                if path_hash(path) != checksums[path]:
-                    restarts += restart_map[path]
-            services_list = list(OrderedDict.fromkeys(restarts))
-            if not stopstart:
-                for service_name in services_list:
-                    service('restart', service_name)
-            else:
-                for action in ['stop', 'start']:
-                    for service_name in services_list:
-                        service(action, service_name)
+            return restart_on_change_helper(
+                (lambda: f(*args, **kwargs)), restart_map, stopstart)
         return wrapped_f
     return wrap
 
 
+def restart_on_change_helper(lambda_f, restart_map, stopstart=False):
+    """Helper function to perform the restart_on_change function.
+
+    This is provided for decorators to restart services if files described
+    in the restart_map have changed after an invocation of lambda_f().
+
+    @param lambda_f: function to call.
+    @param restart_map: {file: [service, ...]}
+    @param stopstart: whether to stop, start or restart a service
+    @returns result of lambda_f()
+    """
+    checksums = {path: path_hash(path) for path in restart_map}
+    r = lambda_f()
+    # create a list of lists of the services to restart
+    restarts = [restart_map[path]
+                for path in restart_map
+                if path_hash(path) != checksums[path]]
+    # create a flat list of ordered services without duplicates from lists
+    services_list = list(OrderedDict.fromkeys(itertools.chain(*restarts)))
+    if services_list:
+        actions = ('stop', 'start') if stopstart else ('restart',)
+        for action in actions:
+            for service_name in services_list:
+                service(action, service_name)
+    return r
+
+
 def lsb_release():
     """Return /etc/lsb-release in a dict"""
     d = {}

=== modified file 'tests/contrib/openstack/test_openstack_utils.py'
--- tests/contrib/openstack/test_openstack_utils.py	2016-02-17 16:29:13 +0000
+++ tests/contrib/openstack/test_openstack_utils.py	2016-03-07 16:45:36 +0000
@@ -919,7 +919,10 @@
 
     @patch.object(openstack, 'juju_log')
     @patch('charmhelpers.contrib.openstack.utils.status_set')
-    def test_set_os_workload_status_complete(self, status_set, log):
+    @patch('charmhelpers.contrib.openstack.utils.is_unit_paused_set',
+           return_value=False)
+    def test_set_os_workload_status_complete(
+            self, is_unit_paused_set, status_set, log):
         configs = MagicMock()
         configs.complete_contexts.return_value = ['shared-db',
                                                   'amqp',
@@ -936,9 +939,11 @@
     @patch('charmhelpers.contrib.openstack.utils.incomplete_relation_data',
            return_value={'identity': {'identity-service': {'related': True}}})
     @patch('charmhelpers.contrib.openstack.utils.status_set')
-    def test_set_os_workload_status_related_incomplete(self, status_set,
-                                                       incomplete_relation_data,
-                                                       log):
+    @patch('charmhelpers.contrib.openstack.utils.is_unit_paused_set',
+           return_value=False)
+    def test_set_os_workload_status_related_incomplete(
+            self, is_unit_paused_set, status_set,
+            incomplete_relation_data, log):
         configs = MagicMock()
         configs.complete_contexts.return_value = ['shared-db', 'amqp']
         required_interfaces = {
@@ -954,8 +959,11 @@
     @patch('charmhelpers.contrib.openstack.utils.incomplete_relation_data',
            return_value={'identity': {'identity-service': {'related': False}}})
     @patch('charmhelpers.contrib.openstack.utils.status_set')
-    def test_set_os_workload_status_absent(self, status_set,
-                                           incomplete_relation_data, log):
+    @patch('charmhelpers.contrib.openstack.utils.is_unit_paused_set',
+           return_value=False)
+    def test_set_os_workload_status_absent(
+            self, is_unit_paused_set, status_set,
+            incomplete_relation_data, log):
         configs = MagicMock()
         configs.complete_contexts.return_value = ['shared-db', 'amqp']
         required_interfaces = {
@@ -973,9 +981,11 @@
     @patch('charmhelpers.contrib.openstack.utils.incomplete_relation_data',
            return_value={'identity': {'identity-service': {'related': True}}})
     @patch('charmhelpers.contrib.openstack.utils.status_set')
-    def test_set_os_workload_status_related_broken(self, status_set,
-                                                   incomplete_relation_data,
-                                                   hook_name, log):
+    @patch('charmhelpers.contrib.openstack.utils.is_unit_paused_set',
+           return_value=False)
+    def test_set_os_workload_status_related_broken(
+            self, is_unit_paused_set, status_set,
+            incomplete_relation_data, hook_name, log):
         configs = MagicMock()
         configs.complete_contexts.return_value = ['shared-db', 'amqp']
         required_interfaces = {
@@ -1000,8 +1010,11 @@
                          {'shared-db': {'related': False}}
                          })
     @patch('charmhelpers.contrib.openstack.utils.status_set')
-    def test_set_os_workload_status_mixed(self, status_set, incomplete_relation_data,
-                                          log):
+    @patch('charmhelpers.contrib.openstack.utils.is_unit_paused_set',
+           return_value=False)
+    def test_set_os_workload_status_mixed(
+            self, is_unit_paused_set, status_set,
+            incomplete_relation_data, log):
         configs = MagicMock()
         configs.complete_contexts.return_value = ['shared-db', 'amqp']
         required_interfaces = {
@@ -1025,16 +1038,14 @@
     @patch('charmhelpers.contrib.openstack.utils.port_has_listener')
     @patch.object(openstack, 'juju_log')
     @patch('charmhelpers.contrib.openstack.utils.status_set')
+    @patch('charmhelpers.contrib.openstack.utils.is_unit_paused_set',
+           return_value=False)
     def test_set_os_workload_status_complete_with_services_list(
-            self, status_set, log, port_has_listener, service_running):
+            self, is_unit_paused_set, status_set, log,
+            port_has_listener, service_running):
         configs = MagicMock()
-        configs.complete_contexts.return_value = ['shared-db',
-                                                  'amqp',
-                                                  'identity-service']
-        required_interfaces = {
-            'database': ['shared-db', 'pgsql-db'],
-            'message': ['amqp', 'zeromq-configuration'],
-            'identity': ['identity-service']}
+        configs.complete_contexts.return_value = []
+        required_interfaces = {}
 
         services = ['database', 'identity']
         # Assume that the service and ports are open.
@@ -1049,16 +1060,14 @@
     @patch('charmhelpers.contrib.openstack.utils.port_has_listener')
     @patch.object(openstack, 'juju_log')
     @patch('charmhelpers.contrib.openstack.utils.status_set')
+    @patch('charmhelpers.contrib.openstack.utils.is_unit_paused_set',
+           return_value=False)
     def test_set_os_workload_status_complete_services_list_not_running(
-            self, status_set, log, port_has_listener, service_running):
+            self, is_unit_paused_set, status_set, log,
+            port_has_listener, service_running):
         configs = MagicMock()
-        configs.complete_contexts.return_value = ['shared-db',
-                                                  'amqp',
-                                                  'identity-service']
-        required_interfaces = {
-            'database': ['shared-db', 'pgsql-db'],
-            'message': ['amqp', 'zeromq-configuration'],
-            'identity': ['identity-service']}
+        configs.complete_contexts.return_value = []
+        required_interfaces = {}
 
         services = ['database', 'identity']
         port_has_listener.return_value = True
@@ -1075,16 +1084,14 @@
     @patch('charmhelpers.contrib.openstack.utils.port_has_listener')
     @patch.object(openstack, 'juju_log')
     @patch('charmhelpers.contrib.openstack.utils.status_set')
+    @patch('charmhelpers.contrib.openstack.utils.is_unit_paused_set',
+           return_value=False)
     def test_set_os_workload_status_complete_with_services(
-            self, status_set, log, port_has_listener, service_running):
+            self, is_unit_paused_set, status_set, log,
+            port_has_listener, service_running):
         configs = MagicMock()
-        configs.complete_contexts.return_value = ['shared-db',
-                                                  'amqp',
-                                                  'identity-service']
-        required_interfaces = {
-            'database': ['shared-db', 'pgsql-db'],
-            'message': ['amqp', 'zeromq-configuration'],
-            'identity': ['identity-service']}
+        configs.complete_contexts.return_value = []
+        required_interfaces = {}
 
         services = [
             {'service': 'database', 'ports': [10, 20]},
@@ -1102,16 +1109,14 @@
     @patch('charmhelpers.contrib.openstack.utils.port_has_listener')
     @patch.object(openstack, 'juju_log')
     @patch('charmhelpers.contrib.openstack.utils.status_set')
+    @patch('charmhelpers.contrib.openstack.utils.is_unit_paused_set',
+           return_value=False)
     def test_set_os_workload_status_complete_service_not_running(
-            self, status_set, log, port_has_listener, service_running):
+            self, is_unit_paused_set, status_set, log,
+            port_has_listener, service_running):
         configs = MagicMock()
-        configs.complete_contexts.return_value = ['shared-db',
-                                                  'amqp',
-                                                  'identity-service']
-        required_interfaces = {
-            'database': ['shared-db', 'pgsql-db'],
-            'message': ['amqp', 'zeromq-configuration'],
-            'identity': ['identity-service']}
+        configs.complete_contexts.return_value = []
+        required_interfaces = {}
 
         services = [
             {'service': 'database', 'ports': [10, 20]},
@@ -1131,16 +1136,14 @@
     @patch('charmhelpers.contrib.openstack.utils.port_has_listener')
     @patch.object(openstack, 'juju_log')
     @patch('charmhelpers.contrib.openstack.utils.status_set')
+    @patch('charmhelpers.contrib.openstack.utils.is_unit_paused_set',
+           return_value=False)
     def test_set_os_workload_status_complete_port_not_open(
-            self, status_set, log, port_has_listener, service_running):
+            self, is_unit_paused_set, status_set, log,
+            port_has_listener, service_running):
         configs = MagicMock()
-        configs.complete_contexts.return_value = ['shared-db',
-                                                  'amqp',
-                                                  'identity-service']
-        required_interfaces = {
-            'database': ['shared-db', 'pgsql-db'],
-            'message': ['amqp', 'zeromq-configuration'],
-            'identity': ['identity-service']}
+        configs.complete_contexts.return_value = []
+        required_interfaces = {}
 
         services = [
             {'service': 'database', 'ports': [10, 20]},
@@ -1160,16 +1163,13 @@
     @patch('charmhelpers.contrib.openstack.utils.port_has_listener')
     @patch.object(openstack, 'juju_log')
     @patch('charmhelpers.contrib.openstack.utils.status_set')
+    @patch('charmhelpers.contrib.openstack.utils.is_unit_paused_set',
+           return_value=False)
     def test_set_os_workload_status_complete_ports_not_open(
-            self, status_set, log, port_has_listener):
+            self, is_unit_paused_set, status_set, log, port_has_listener):
         configs = MagicMock()
-        configs.complete_contexts.return_value = ['shared-db',
-                                                  'amqp',
-                                                  'identity-service']
-        required_interfaces = {
-            'database': ['shared-db', 'pgsql-db'],
-            'message': ['amqp', 'zeromq-configuration'],
-            'identity': ['identity-service']}
+        configs.complete_contexts.return_value = []
+        required_interfaces = {}
 
         ports = [50, 60, 70]
         port_has_listener.side_effect = [True, False, True]
@@ -1181,6 +1181,422 @@
             'Ports which should be open, but are not: 60')
 
     @patch.object(openstack, 'juju_log')
+    @patch('charmhelpers.contrib.openstack.utils.status_set')
+    @patch('charmhelpers.contrib.openstack.utils.is_unit_paused_set',
+           return_value=True)
+    def test_set_os_workload_status_paused_simple(
+            self, is_unit_paused_set, status_set, log):
+        configs = MagicMock()
+        configs.complete_contexts.return_value = []
+        required_interfaces = {}
+
+        openstack.set_os_workload_status(configs, required_interfaces)
+        status_set.assert_called_with(
+            'maintenance',
+            "Paused. Use 'resume' action to resume normal service.")
+
+    @patch('charmhelpers.contrib.openstack.utils.service_running')
+    @patch('charmhelpers.contrib.openstack.utils.port_has_listener')
+    @patch.object(openstack, 'juju_log')
+    @patch('charmhelpers.contrib.openstack.utils.status_set')
+    @patch('charmhelpers.contrib.openstack.utils.is_unit_paused_set',
+           return_value=True)
+    def test_set_os_workload_status_paused_services_check(
+            self, is_unit_paused_set, status_set, log,
+            port_has_listener, service_running):
+        configs = MagicMock()
+        configs.complete_contexts.return_value = []
+        required_interfaces = {}
+
+        services = [
+            {'service': 'database', 'ports': [10, 20]},
+            {'service': 'identity', 'ports': [30]},
+        ]
+        port_has_listener.return_value = False
+        service_running.side_effect = [False, False]
+
+        openstack.set_os_workload_status(
+            configs, required_interfaces, services=services)
+        status_set.assert_called_with(
+            'maintenance',
+            "Paused. Use 'resume' action to resume normal service.")
+
+    @patch('charmhelpers.contrib.openstack.utils.service_running')
+    @patch('charmhelpers.contrib.openstack.utils.port_has_listener')
+    @patch.object(openstack, 'juju_log')
+    @patch('charmhelpers.contrib.openstack.utils.status_set')
+    @patch('charmhelpers.contrib.openstack.utils.is_unit_paused_set',
+           return_value=True)
+    def test_set_os_workload_status_paused_services_fail(
+            self, is_unit_paused_set, status_set, log,
+            port_has_listener, service_running):
+        configs = MagicMock()
+        configs.complete_contexts.return_value = []
+        required_interfaces = {}
+
+        services = [
+            {'service': 'database', 'ports': [10, 20]},
+            {'service': 'identity', 'ports': [30]},
+        ]
+        port_has_listener.return_value = False
+        # Fail the identity service
+        service_running.side_effect = [False, True]
+
+        openstack.set_os_workload_status(
+            configs, required_interfaces, services=services)
+        status_set.assert_called_with(
+            'blocked',
+            "Services should be paused but these services running: identity")
+
+    @patch('charmhelpers.contrib.openstack.utils.service_running')
+    @patch('charmhelpers.contrib.openstack.utils.port_has_listener')
+    @patch.object(openstack, 'juju_log')
+    @patch('charmhelpers.contrib.openstack.utils.status_set')
+    @patch('charmhelpers.contrib.openstack.utils.is_unit_paused_set',
+           return_value=True)
+    def test_set_os_workload_status_paused_services_ports_fail(
+            self, is_unit_paused_set, status_set, log,
+            port_has_listener, service_running):
+        configs = MagicMock()
+        configs.complete_contexts.return_value = []
+        required_interfaces = {}
+
+        services = [
+            {'service': 'database', 'ports': [10, 20]},
+            {'service': 'identity', 'ports': [30]},
+        ]
+        # make the service 20 port be still listening.
+        port_has_listener.side_effect = [False, True, False]
+        service_running.return_value = False
+
+        openstack.set_os_workload_status(
+            configs, required_interfaces, services=services)
+        status_set.assert_called_with(
+            'blocked',
+            "Services should be paused but these service:ports are open:"
+            " database: [20]")
+
+    @patch('charmhelpers.contrib.openstack.utils.port_has_listener')
+    @patch.object(openstack, 'juju_log')
+    @patch('charmhelpers.contrib.openstack.utils.status_set')
+    @patch('charmhelpers.contrib.openstack.utils.is_unit_paused_set',
+           return_value=True)
+    def test_set_os_workload_status_paused_ports_check(
+            self, is_unit_paused_set, status_set, log,
+            port_has_listener):
+        configs = MagicMock()
+        configs.complete_contexts.return_value = []
+        required_interfaces = {}
+
+        ports = [50, 60, 70]
+        port_has_listener.side_effect = [False, False, False]
+
+        openstack.set_os_workload_status(
+            configs, required_interfaces, ports=ports)
+        status_set.assert_called_with(
+            'maintenance',
+            "Paused. Use 'resume' action to resume normal service.")
+
+    @patch('charmhelpers.contrib.openstack.utils.port_has_listener')
+    @patch.object(openstack, 'juju_log')
+    @patch('charmhelpers.contrib.openstack.utils.status_set')
+    @patch('charmhelpers.contrib.openstack.utils.is_unit_paused_set',
+           return_value=True)
+    def test_set_os_workload_status_paused_ports_fail(
+            self, is_unit_paused_set, status_set, log,
+            port_has_listener):
+        configs = MagicMock()
+        configs.complete_contexts.return_value = []
+        required_interfaces = {}
+
+        # fail port 70 to make it seem to be running
+        ports = [50, 60, 70]
+        port_has_listener.side_effect = [False, False, True]
+
+        openstack.set_os_workload_status(
+            configs, required_interfaces, ports=ports)
+        status_set.assert_called_with(
+            'blocked',
+            "Services should be paused but "
+            "these ports which should be closed, but are open: 70")
+
+    @patch('charmhelpers.contrib.openstack.utils.service_running')
+    @patch('charmhelpers.contrib.openstack.utils.port_has_listener')
+    def test_check_actually_paused_simple_services(
+            self, port_has_listener, service_running):
+        services = ['database', 'identity']
+        port_has_listener.return_value = False
+        service_running.return_value = False
+
+        state, message = openstack.check_actually_paused(
+            services)
+        self.assertEquals(state, None)
+        self.assertEquals(message, None)
+
+    @patch('charmhelpers.contrib.openstack.utils.service_running')
+    @patch('charmhelpers.contrib.openstack.utils.port_has_listener')
+    def test_check_actually_paused_simple_services_fail(
+            self, port_has_listener, service_running):
+        services = ['database', 'identity']
+        port_has_listener.return_value = False
+        service_running.side_effect = [False, True]
+
+        state, message = openstack.check_actually_paused(
+            services)
+        self.assertEquals(state, 'blocked')
+        self.assertEquals(
+            message,
+            "Services should be paused but these services running: identity")
+
+    @patch('charmhelpers.contrib.openstack.utils.service_running')
+    @patch('charmhelpers.contrib.openstack.utils.port_has_listener')
+    def test_check_actually_paused_services_dict(
+            self, port_has_listener, service_running):
+        services = [
+            {'service': 'database', 'ports': [10, 20]},
+            {'service': 'identity', 'ports': [30]},
+        ]
+        # Assume that the service and ports are open.
+        port_has_listener.return_value = False
+        service_running.return_value = False
+
+        state, message = openstack.check_actually_paused(
+            services)
+        self.assertEquals(state, None)
+        self.assertEquals(message, None)
+
+    @patch('charmhelpers.contrib.openstack.utils.service_running')
+    @patch('charmhelpers.contrib.openstack.utils.port_has_listener')
+    def test_check_actually_paused_services_dict_fail(
+            self, port_has_listener, service_running):
+        services = [
+            {'service': 'database', 'ports': [10, 20]},
+            {'service': 'identity', 'ports': [30]},
+        ]
+        # Assume that the service and ports are open.
+        port_has_listener.return_value = False
+        service_running.side_effect = [False, True]
+
+        state, message = openstack.check_actually_paused(
+            services)
+        self.assertEquals(state, 'blocked')
+        self.assertEquals(
+            message,
+            "Services should be paused but these services running: identity")
+
+    @patch('charmhelpers.contrib.openstack.utils.service_running')
+    @patch('charmhelpers.contrib.openstack.utils.port_has_listener')
+    def test_check_actually_paused_services_dict_ports_fail(
+            self, port_has_listener, service_running):
+        services = [
+            {'service': 'database', 'ports': [10, 20]},
+            {'service': 'identity', 'ports': [30]},
+        ]
+        # Assume that the service and ports are open.
+        port_has_listener.side_effect = [False, True, False]
+        service_running.return_value = False
+
+        state, message = openstack.check_actually_paused(
+            services)
+        self.assertEquals(state, 'blocked')
+        self.assertEquals(message,
+                          'Services should be paused but these service:ports'
+                          ' are open: database: [20]')
+
+    @patch('charmhelpers.contrib.openstack.utils.service_running')
+    @patch('charmhelpers.contrib.openstack.utils.port_has_listener')
+    def test_check_actually_paused_ports_okay(
+            self, port_has_listener, service_running):
+        port_has_listener.side_effect = [False, False, False]
+        service_running.return_value = False
+        ports = [50, 60, 70]
+
+        state, message = openstack.check_actually_paused(
+            ports=ports)
+        self.assertEquals(state, None)
+        self.assertEquals(state, None)
+
+    @patch('charmhelpers.contrib.openstack.utils.service_running')
+    @patch('charmhelpers.contrib.openstack.utils.port_has_listener')
+    def test_check_actually_paused_ports_fail(
+            self, port_has_listener, service_running):
+        port_has_listener.side_effect = [False, True, False]
+        service_running.return_value = False
+        ports = [50, 60, 70]
+
+        state, message = openstack.check_actually_paused(
+            ports=ports)
+        self.assertEquals(state, 'blocked')
+        self.assertEquals(message,
+                          'Services should be paused but these ports '
+                          'which should be closed, but are open: 60')
+
+    @patch('charmhelpers.contrib.openstack.utils.service_pause')
+    @patch('charmhelpers.contrib.openstack.utils.set_unit_paused')
+    def test_pause_unit_okay(self, set_unit_paused, service_pause):
+        services = ['service1', 'service2']
+        service_pause.side_effect = [True, True]
+        openstack.pause_unit(None, services=services)
+        set_unit_paused.assert_called_once_with()
+        self.assertEquals(service_pause.call_count, 2)
+
+    @patch('charmhelpers.contrib.openstack.utils.service_pause')
+    @patch('charmhelpers.contrib.openstack.utils.set_unit_paused')
+    def test_pause_unit_service_fails(self, set_unit_paused, service_pause):
+        services = ['service1', 'service2']
+        service_pause.side_effect = [True, True]
+        openstack.pause_unit(None, services=services)
+        set_unit_paused.assert_called_once_with()
+        self.assertEquals(service_pause.call_count, 2)
+        # Fail the 2nd service
+        service_pause.side_effect = [True, False]
+        try:
+            openstack.pause_unit(None, services=services)
+            raise Exception("pause_unit should have raised Exception")
+        except Exception as e:
+            self.assertEquals(e.args[0],
+                              "Couldn't pause: service2 didn't stop cleanly.")
+
+    @patch('charmhelpers.contrib.openstack.utils.service_pause')
+    @patch('charmhelpers.contrib.openstack.utils.set_unit_paused')
+    def test_pausee_unit_service_charm_func(
+            self, set_unit_paused, service_pause):
+        services = ['service1', 'service2']
+        service_pause.return_value = True
+        charm_func = MagicMock()
+        charm_func.return_value = None
+        openstack.pause_unit(None, services=services, charm_func=charm_func)
+        charm_func.assert_called_once_with()
+        # fail the charm_func
+        charm_func.return_value = "Custom charm failed"
+        try:
+            openstack.pause_unit(
+                None, services=services, charm_func=charm_func)
+            raise Exception("pause_unit should have raised Exception")
+        except Exception as e:
+            self.assertEquals(e.args[0],
+                              "Couldn't pause: Custom charm failed")
+
+    @patch('charmhelpers.contrib.openstack.utils.service_pause')
+    @patch('charmhelpers.contrib.openstack.utils.set_unit_paused')
+    def test_pause_unit_assess_status_func(
+            self, set_unit_paused, service_pause):
+        services = ['service1', 'service2']
+        service_pause.return_value = True
+        assess_status_func = MagicMock()
+        assess_status_func.return_value = None
+        openstack.pause_unit(assess_status_func, services=services)
+        assess_status_func.assert_called_once_with()
+        # fail the assess_status_func
+        assess_status_func.return_value = "assess_status_func failed"
+        try:
+            openstack.pause_unit(assess_status_func, services=services)
+            raise Exception("pause_unit should have raised Exception")
+        except Exception as e:
+            self.assertEquals(e.args[0],
+                              "Couldn't pause: assess_status_func failed")
+
+    @patch('charmhelpers.contrib.openstack.utils.service_resume')
+    @patch('charmhelpers.contrib.openstack.utils.clear_unit_paused')
+    def test_resume_unit_okay(self, clear_unit_paused, service_resume):
+        services = ['service1', 'service2']
+        service_resume.side_effect = [True, True]
+        openstack.resume_unit(None, services=services)
+        clear_unit_paused.assert_called_once_with()
+        self.assertEquals(service_resume.call_count, 2)
+
+    @patch('charmhelpers.contrib.openstack.utils.service_resume')
+    @patch('charmhelpers.contrib.openstack.utils.clear_unit_paused')
+    def test_resume_unit_service_fails(self, clear_unit_paused, service_resume):
+        services = ['service1', 'service2']
+        service_resume.side_effect = [True, True]
+        openstack.resume_unit(None, services=services)
+        clear_unit_paused.assert_called_once_with()
+        self.assertEquals(service_resume.call_count, 2)
+        # Fail the 2nd service
+        service_resume.side_effect = [True, False]
+        try:
+            openstack.resume_unit(None, services=services)
+            raise Exception("resume_unit should have raised Exception")
+        except Exception as e:
+            self.assertEquals(e.args[0],
+                              "Couldn't resume: service2 didn't start cleanly.")
+
+    @patch('charmhelpers.contrib.openstack.utils.service_resume')
+    @patch('charmhelpers.contrib.openstack.utils.clear_unit_paused')
+    def test_resume_unit_service_charm_func(
+            self, clear_unit_paused, service_resume):
+        services = ['service1', 'service2']
+        service_resume.return_value = True
+        charm_func = MagicMock()
+        charm_func.return_value = None
+        openstack.resume_unit(None, services=services, charm_func=charm_func)
+        charm_func.assert_called_once_with()
+        # fail the charm_func
+        charm_func.return_value = "Custom charm failed"
+        try:
+            openstack.resume_unit(
+                None, services=services, charm_func=charm_func)
+            raise Exception("resume_unit should have raised Exception")
+        except Exception as e:
+            self.assertEquals(e.args[0],
+                              "Couldn't resume: Custom charm failed")
+
+    @patch('charmhelpers.contrib.openstack.utils.service_resume')
+    @patch('charmhelpers.contrib.openstack.utils.clear_unit_paused')
+    def test_resume_unit_assess_status_func(
+            self, clear_unit_paused, service_resume):
+        services = ['service1', 'service2']
+        service_resume.return_value = True
+        assess_status_func = MagicMock()
+        assess_status_func.return_value = None
+        openstack.resume_unit(assess_status_func, services=services)
+        assess_status_func.assert_called_once_with()
+        # fail the assess_status_func
+        assess_status_func.return_value = "assess_status_func failed"
+        try:
+            openstack.resume_unit(assess_status_func, services=services)
+            raise Exception("resume_unit should have raised Exception")
+        except Exception as e:
+            self.assertEquals(e.args[0],
+                              "Couldn't resume: assess_status_func failed")
+
+    @patch('charmhelpers.contrib.openstack.utils.status_set')
+    @patch('charmhelpers.contrib.openstack.utils.'
+           '_determine_os_workload_status')
+    def test_make_assess_status_func(self, _determine_os_workload_status,
+                                     status_set):
+        _determine_os_workload_status.return_value = ('active', 'fine')
+        f = openstack.make_assess_status_func('one', 'two', three='three')
+        r = f()
+        self.assertEquals(r, None)
+        _determine_os_workload_status.assert_called_once_with(
+            'one', 'two', three='three')
+        status_set.assert_called_once_with('active', 'fine')
+        # return something other than 'active' or 'maintenance'
+        _determine_os_workload_status.return_value = ('broken', 'damaged')
+        r = f()
+        self.assertEquals(r, 'damaged')
+
+    @patch.object(openstack, 'restart_on_change_helper')
+    @patch.object(openstack, 'is_unit_paused_set')
+    def test_pausable_restart_on_change(
+            self, is_unit_paused_set, restart_on_change_helper):
+        @openstack.pausable_restart_on_change({})
+        def test_func():
+            pass
+
+        # test with pause: restart_on_change_helper should not be called.
+        is_unit_paused_set.return_value = True
+        test_func()
+        self.assertEquals(restart_on_change_helper.call_count, 0)
+
+        # test without pause: restart_on_change_helper should be called.
+        is_unit_paused_set.return_value = False
+        test_func()
+        self.assertEquals(restart_on_change_helper.call_count, 1)
+
+    @patch.object(openstack, 'juju_log')
     @patch.object(openstack, 'action_set')
     @patch.object(openstack, 'action_fail')
     @patch.object(openstack, 'openstack_upgrade_available')