Merge lp:~allenap/gwacl/remove-role-endpoints into lp:gwacl

[Gavin Panella]

New method RemoveRoleEndpoints.

[Raphaël Badin (rvb)]

Looks good… but please have a look at [2].

[0]

The method is called 'RemoveRoleEndpoints' but the parameter type is called 'RemoveRoleEndpointRequest', I think it should be 'RemoveRoleEndpoint*s*Request'

[1]

As always, I'd like to see this method exercised in the real world (i.e. in the example script).

[2]

21 + InputEndpoints []InputEndpoint
22 +}
…
40 + if reflect.DeepEqual(endpoint, existingEndpoint) {

This is clearly okay for the provider but I wonder if it would not be more straightforward, instead of passing whole endpoints objects, to pass just a list of the ports (the external ports) corresponding to the endpoints to be removed… because the code we have here imposes to create InputEndpoints structures where only the "natural key" (i.e. the external port) could be sufficient to identify the endpoints to be deleted. What do you think?

review: Approve

[Julian Edwards (julian-edwards)]

On Friday 19 Jul 2013 13:52:26 Raphaël Badin wrote:
> This is clearly okay for the provider but I wonder if it would not be more
> straightforward, instead of passing whole endpoints objects, to pass just a
> list of the ports (the external ports) corresponding to the endpoints to be
> removed… because the code we have here imposes to create InputEndpoints
> structures where only the "natural key" (i.e. the external port) could be
> sufficient to identify the endpoints to be deleted. What do you think?

We talked the other day of wrapping add/remove-role-endpoints with another
func that does just take simple port numbers.

I am still not sure what Azure considers to be the primary key for an
endpoint, the documentation is not clear enough.

[lp:~allenap/gwacl/remove-role-endpoints]

195. By Gavin Panella on 2013-07-22

Fix typo.

[Gavin Panella (allenap)]

> Looks good… but please have a look at [2].
>
> [0]
>
> The method is called 'RemoveRoleEndpoints' but the parameter type is called
> 'RemoveRoleEndpointRequest', I think it should be
> 'RemoveRoleEndpoint*s*Request'

Good spot, fixed.

>
> [1]
>
> As always, I'd like to see this method exercised in the real world (i.e. in
> the example script).

Good point! I'll do that before I land.

>
> [2]
>
> 21      +    InputEndpoints []InputEndpoint
> 22      +}
> …
> 40      +                        if reflect.DeepEqual(endpoint,
> existingEndpoint) {
>
> This is clearly okay for the provider but I wonder if it would not be more
> straightforward, instead of passing whole endpoints objects, to pass just a
> list of the ports (the external ports) corresponding to the endpoints to be
> removed… because the code we have here imposes to create InputEndpoints
> structures where only the "natural key" (i.e. the external port) could be
> sufficient to identify the endpoints to be deleted.  What do you think?

My thinking goes something like this:

- Always ignore LoadBalancerProbe for the purposes of comparison.

- If LoadBalancedEndpointSetName is defined, then LocalPort, Port,
  Protocol and VIP should be used for comparison.

- If LoadBalancedEndpointSetName is *not* defined, then Port, Protocol
  and VIP should be used for comparison.

- This leaves Name. I'm not sure what purpose this serves, other than
  as a pretty name for the UI. If so, it's irrelevant for the purposes
  of comparison.

It may be worth having a FilterRoleEndpoints function, which behaves
like RemoveRoleEndpoints, but accepts a func(*InputEndpoint) bool
function which can either mutate the endpoint or remove it (by
returning false). I think this might better support the desired
behaviour in juju-core, and make us more flexible to change.

What do you think?

[Gavin Panella (allenap)]

> - If LoadBalancedEndpointSetName is defined, then LocalPort, Port,
> Protocol and VIP should be used for comparison.

... in *addition* to LoadBalancedEndpointSetName.

[lp:~allenap/gwacl/remove-role-endpoints]

196. By Gavin Panella on 2013-07-22

Switch to consts for LinuxProvisioningConfiguration and NetworkConfiguration.

197. By Gavin Panella on 2013-07-22

Break out comparison of InputEndpoints into a separate function.

198. By Gavin Panella on 2013-07-22

Comment on RemoveRoleEndpoint.

199. By Gavin Panella on 2013-07-22

Redefine RemoveRoleEndpoints in terms of new method FilterRoleEndpoints.

200. By Gavin Panella on 2013-07-22

Reorder.

201. By Gavin Panella on 2013-07-22

Document the filter function.

202. By Gavin Panella on 2013-07-22

Don't make the role filtering function public yet.

203. By Gavin Panella on 2013-07-22

Simplify filter definition.

204. By Gavin Panella on 2013-07-22

Explain why filterRoleEndpoints() is private.

205. By Gavin Panella on 2013-07-22

Fix typo.

206. By Gavin Panella on 2013-07-22

Add use of {Add,Remove}RoleEndpoints to the management example.

207. By Gavin Panella on 2013-07-22

Fix typo.

[Gavin Panella (allenap)]

All done, please take another look! Thanks.

[Julian Edwards (julian-edwards)]

Approved, but please fix [1].

[0]
+// CompareInputEndpoints attempts to compare two InputEndpoint objects in a
+// way that's congruent with how Windows's Azure considers them. The name is
+// ignored, as is LoadBalancerProbe. The other fields are used for comparison,
+// except when LoadBalancedEndpointSetName is set, in which case LocalPort is
+// ignored.

>blink< !

I had not grokked any of that (but could be Lyme brain) from the docs. It's madness.

[1]

+ panic("wtf") // Safe to remove in Go 1.1

Should be OK to remove now, we are all supposed to be using Go 1.1 (add https://launchpad.net/~james-page/+archive/golang-backports) as it's the only supported version of Go.

[2]

+// Returns true to keep the endpoint defined in the role's configuration,
+// false to remove it. It is also welcome to mutate endpoints; they are passed
+// by reference.

By pointer, strictly speaking.

Very nice readable tests for the new comparison func, BTW!

review: Approve

[lp:~allenap/gwacl/remove-role-endpoints]

208. By Gavin Panella on 2013-07-23

Improve doc for CompareInputEndpoints.

[Raphaël Badin (rvb)]

> > [2]
> >
> My thinking goes something like this:
>
> - Always ignore LoadBalancerProbe for the purposes of comparison.
>
> - If LoadBalancedEndpointSetName is defined, then LocalPort, Port,
>  Protocol and VIP should be used for comparison.
>
> - If LoadBalancedEndpointSetName is *not* defined, then Port, Protocol
>  and VIP should be used for comparison.

Why omitting LocalPort in this case? I must say I'm a bit confused about what LoadBalancedEndpointSetName means… even after reading the doc :).
>
> - This leaves Name. I'm not sure what purpose this serves, other than
>  as a pretty name for the UI. If so, it's irrelevant for the purposes
>  of comparison.
>
> It may be worth having a FilterRoleEndpoints function, which behaves
> like RemoveRoleEndpoints, but accepts a func(*InputEndpoint) bool
> function which can either mutate the endpoint or remove it (by
> returning false). I think this might better support the desired
> behaviour in juju-core, and make us more flexible to change.

Seems a bit overkill *if* we can figure out what the "natural key" of an endpoint is…

[Raphaël Badin (rvb)]

> Seems a bit overkill *if* we can figure out what the "natural key" of an
> endpoint is…

I think (name), (protocol, local port) and (protocol, port) are natural keys for an endpoint.

[Gavin Panella (allenap)]

On 23 July 2013 16:53, Raphaël Badin <email address hidden> wrote:
> I think (name), (protocol, local port) and (protocol, port) are
> natural keys for an endpoint.

So a comparison would go something like, in order:

- If Name matches, they're the same,

- If Protocol and LocalPort match, they're the same,

- If Protocol and Port match, they're the same,

- Otherwise they're not the same.

What about LoadBalancedEndpointSetName?

  Specifies a name for a set of load-balanced endpoints. Specifying
  this element for a given endpoint adds it to the set.

That sounds like if it's set to a non-empty string then the natural
key would be (set-name, protocol, port, local-port).

This opens up more questions:

- For a load-balanced endpoint set, does the public port have to be
  the same for all endpoints therein?

- What happens if a load-balanced set uses the same port as a
  non-load-balanced endpoint? I assume they conflict. So, when
  comparing endpoints we have to consider if they're the same
  definition, or in conflict.

Also, I've seen some example XML for InputEndpoint that includes a Vip
tag (VIP in the GWACL structs). This ist shown in the docs for
GetRole, but not UpdateRole. I guess we can ignore this as Azure only
supports one VIP per deployment at present.

I'm still working on this branch... I think I'm going to land as soon
as I can with a whopping FIXME in CompareInputEndpoints, and then do
some experimentation to figure all the above out, at least that of it
which is relevant to us.

[Gavin Panella (allenap)]

> [0]
...
> I had not grokked any of that (but could be Lyme brain) from the docs.  It's
> madness.

Ha :) I've tried to improve the comment here. However, as you've
probably seen, the approach is still being discussed, so don't pay too
much attention to this yet.

>
> [1]
>
> +    panic("wtf") // Safe to remove in Go 1.1
>
> Should be OK to remove now, we are all supposed to be using Go 1.1 (add
> https://launchpad.net/~james-page/+archive/golang-backports) as it's the only
> supported version of Go.

Done.

We can also upgrade the code underlying fork/http and fork/tls now;
it's based on 1.0.2 right now, for compatibility. Rapheël has already
tried this and it works fine, iirc, we just need to get round to doing
it.

>
> [2]
>
> +// Returns true to keep the endpoint defined in the role's configuration,
> +// false to remove it. It is also welcome to mutate endpoints; they are
> passed
> +// by reference.
>
> By pointer, strictly speaking.

Is this a distinction that only makes a difference to a former C++
programmer, or is there a tangible difference in meaning?

>
> Very nice readable tests for the new comparison func, BTW!

Ta :) Very nice review :)

[Gavin Panella (allenap)]

> > It may be worth having a FilterRoleEndpoints function, which behaves
> > like RemoveRoleEndpoints, but accepts a func(*InputEndpoint) bool
> > function which can either mutate the endpoint or remove it (by
> > returning false). I think this might better support the desired
> > behaviour in juju-core, and make us more flexible to change.
>
> Seems a bit overkill *if* we can figure out what the "natural key" of an
> endpoint is…

I did it, and it was a good move, imo. The filterRoleEndpoints
function is not public, and is only called by RemoveRoleEndpoints, but
splitting up the function has made testing and reasoning easier.
Don't dismiss divide and conquer :)

[lp:~allenap/gwacl/remove-role-endpoints]

209. By Gavin Panella on 2013-07-23

Merge trunk.

210. By Gavin Panella on 2013-07-23

Remove Go 1.0 compatibility hack.

[Julian Edwards (julian-edwards)]

On 24/07/13 07:58, Gavin Panella wrote:
> We can also upgrade the code underlying fork/http and fork/tls now;
> it's based on 1.0.2 right now, for compatibility. Rapheël has already
> tried this and it works fine, iirc, we just need to get round to doing
> it.

Wicked. JFDI. :)

> Is this a distinction that only makes a difference to a former C++
> programmer, or is there a tangible difference in meaning?

Ah, ummm, maybe :)

Pointers are definitely different beasts to references in my head, but
Go blurs the distinction by eschewing the -> operator in favour of a .
for struct property access regardless of it being a pointer.

Does Go talk about references anywhere? I thought it just mentioned
pointer types.

>> Very nice readable tests for the new comparison func, BTW!
>
> Ta :) Very nice review :)

We're going to need to get a room at this rate.

[Raphaël Badin (rvb)]

> On 23 July 2013 16:53, Raphaël Badin <email address hidden> wrote:
> > I think (name), (protocol, local port) and (protocol, port) are
> > natural keys for an endpoint.
>
> So a comparison would go something like, in order:
>
> - If Name matches, they're the same,

Why not stop here? The name is a mandatory (well, I think) identifier.

> I'm still working on this branch... I think I'm going to land as soon
> as I can with a whopping FIXME in CompareInputEndpoints, and then do
> some experimentation to figure all the above out, at least that of it
> which is relevant to us.

Yeah, we need this ASAP to do the work on the provider so it seems like a good idea to land this sooner rather than later.

[Raphaël Badin (rvb)]

> On 23 July 2013 16:53, Raphaël Badin <email address hidden> wrote:
> > I think (name), (protocol, local port) and (protocol, port) are
> > natural keys for an endpoint.
>
> So a comparison would go something like, in order:
>
> - If Name matches, they're the same,
>
> - If Protocol and LocalPort match, they're the same,
>
> - If Protocol and Port match, they're the same,
>
> - Otherwise they're not the same.

On second thought that's probably a good solution. At first I thought we could only give it a list of names. That would be indeed much simpler but your solution is more flexible and will allow a user to remove endpoints based on the {port, protocol} and that's probably the best option.

> What about LoadBalancedEndpointSetName?
>
> Specifies a name for a set of load-balanced endpoints. Specifying
> this element for a given endpoint adds it to the set.
>
> That sounds like if it's set to a non-empty string then the natural
> key would be (set-name, protocol, port, local-port).
>
> This opens up more questions:
>
> - For a load-balanced endpoint set, does the public port have to be
> the same for all endpoints therein?

AFAIUI this is meant to be used to load-balance things between machine and so I don't think it adds any meaning when it comes to deciding what the natural keys are… but this is all surmise of course because the documentation is — once again — not very clear.

[lp:~allenap/gwacl/remove-role-endpoints]

211. By Gavin Panella on 2013-07-25

Change content type to application/xml.

212. By Gavin Panella on 2013-07-25

Improve logging experience for requests.

213. By Gavin Panella on 2013-07-25

Replace all fmt.Print* calls in the management example with log calls.

214. By Gavin Panella on 2013-07-25

Logging tweaks.

215. By Gavin Panella on 2013-07-25

Fix formatting.

216. By Gavin Panella on 2013-07-25

Fix the example endpoint so that it can be created.

217. By Gavin Panella on 2013-07-25

Couple of FIXMEs.

218. By Gavin Panella on 2013-07-25

UpdateRole needs to block until complete.

[Gavin Panella (allenap)]

This _seems_ to work now. I'm landing it, and will fix the comparison algorithm separately.

=== modified file 'example/management/run.go'
--- example/management/run.go	2013-07-18 08:19:43 +0000
+++ example/management/run.go	2013-07-25 21:52:25 +0000
@@ -13,6 +13,7 @@
     "flag"
     "fmt"
     "launchpad.net/gwacl"
+    . "launchpad.net/gwacl/logging"
     "math/rand"
     "os"
     "time"
@@ -20,13 +21,11 @@
 
 var certFile string
 var subscriptionID string
-var verbose bool
 var pause bool
 
 func getParams() error {
     flag.StringVar(&certFile, "cert", "", "Name of your management certificate file (in PEM format).")
     flag.StringVar(&subscriptionID, "subscriptionid", "", "Your Azure subscription ID.")
-    flag.BoolVar(&verbose, "verbose", false, "Print debugging output")
     flag.BoolVar(&pause, "pause", false, "Wait for user input after the VM is brought up (useful for further testing)")
 
     flag.Parse()
@@ -70,12 +69,11 @@
 
     err := getParams()
     if err != nil {
-        fmt.Println(err)
+        Info(err)
         os.Exit(1)
     }
 
     api, err := gwacl.NewManagementAPI(subscriptionID, certFile)
-    gwacl.SetVerbose(verbose)
     checkError(err)
 
     // Exercise the API.
@@ -83,7 +81,7 @@
     // Exercise hosted services API.
     ExerciseHostedServicesAPI(api)
 
-    fmt.Println("All done.")
+    Info("All done.")
 }
 
 func ExerciseHostedServicesAPI(api *gwacl.ManagementAPI) {
@@ -92,23 +90,23 @@
     release := "13.04"
 
     affinityGroupName := gwacl.MakeRandomHostname("affinitygroup")
-    fmt.Println("Creating an affinity group...")
+    Info("Creating an affinity group...")
     cag := gwacl.NewCreateAffinityGroup(affinityGroupName, "affinity-label", "affinity-description", location)
     err = api.CreateAffinityGroup(&gwacl.CreateAffinityGroupRequest{
         CreateAffinityGroup: cag})
     checkError(err)
-    fmt.Printf("Created affinity group %s\n", affinityGroupName)
+    Infof("Created affinity group %s\n", affinityGroupName)
 
     defer func() {
-        fmt.Printf("Deleting affinity group %s\n", affinityGroupName)
+        Infof("Deleting affinity group %s\n", affinityGroupName)
         err := api.DeleteAffinityGroup(&gwacl.DeleteAffinityGroupRequest{
             Name: affinityGroupName})
         checkError(err)
-        fmt.Printf("Done deleting affinity group %s\n", affinityGroupName)
+        Infof("Done deleting affinity group %s\n", affinityGroupName)
     }()
 
     virtualNetworkName := gwacl.MakeRandomVirtualNetworkName("virtual-net-")
-    fmt.Printf("Creating virtual network %s...\n", virtualNetworkName)
+    Infof("Creating virtual network %s...\n", virtualNetworkName)
     virtualNetwork := gwacl.VirtualNetworkSite{
         Name:          virtualNetworkName,
         AffinityGroup: affinityGroupName,
@@ -118,69 +116,70 @@
     }
     err = api.AddVirtualNetworkSite(&virtualNetwork)
     checkError(err)
-    fmt.Println("Done creating virtual network")
+    Info("Done creating virtual network")
 
     defer func() {
-        fmt.Printf("Deleting virtual network %s...\n", virtualNetworkName)
+        Infof("Deleting virtual network %s...\n", virtualNetworkName)
         err := api.RemoveVirtualNetworkSite(virtualNetworkName)
         checkError(err)
-        fmt.Printf("Done deleting virtual network %s\n", virtualNetworkName)
+        Infof("Done deleting virtual network %s\n", virtualNetworkName)
     }()
 
     networkConfig, err := api.GetNetworkConfiguration()
     checkError(err)
     if networkConfig == nil {
-        fmt.Println("No network configuration is set")
+        Info("No network configuration is set")
     } else {
         xml, err := networkConfig.Serialize()
         checkError(err)
-        fmt.Println(xml)
+        Info(xml)
     }
 
-    fmt.Printf("Getting OS Image for release '%s' and location '%s'...\n", release, location)
+    Infof("Getting OS Image for release '%s' and location '%s'...\n", release, location)
     images, err := api.ListOSImages()
     checkError(err)
     preciseImage, err := images.GetLatestUbuntuImage(release, location)
     checkError(err)
     sourceImageName := preciseImage.Name
-    fmt.Printf("Got image named '%s'\n", sourceImageName)
-    fmt.Println("Done getting OS Image\n")
+    Infof("Got image named '%s'\n", sourceImageName)
+    Info("Done getting OS Image\n")
 
     hostServiceName := gwacl.MakeRandomHostedServiceName("gwacl")
-    fmt.Printf("Creating a hosted service: '%s'...\n", hostServiceName)
+    Infof("Creating a hosted service: '%s'...\n", hostServiceName)
     createHostedService := gwacl.NewCreateHostedServiceWithLocation(hostServiceName, "testLabel", location)
     err = api.AddHostedService(createHostedService)
     checkError(err)
-    fmt.Println("Done creating a hosted service\n")
+    Info("Done creating a hosted service\n")
 
     defer func() {
-        fmt.Println("Destroying hosted service...")
+        Info("Destroying hosted service...")
+        // FIXME: Check error
         api.DestroyHostedService(&gwacl.DestroyHostedServiceRequest{
             ServiceName: hostServiceName})
-        fmt.Println("Done destroying hosted service\n")
+        Info("Done destroying hosted service\n")
     }()
 
-    fmt.Println("Listing hosted services...")
+    Info("Listing hosted services...")
     hostedServices, err := api.ListHostedServices()
     checkError(err)
-    fmt.Printf("Got %d hosted service(s)\n", len(hostedServices))
+    Infof("Got %d hosted service(s)\n", len(hostedServices))
     if len(hostedServices) > 0 {
         hostedService := hostedServices[0]
         detailedHostedService, err := api.GetHostedServiceProperties(hostedService.ServiceName, true)
         checkError(err)
-        fmt.Printf("Hosted service '%s' contains %d deployments\n", hostedService.ServiceName, len(detailedHostedService.Deployments))
+        Infof("Hosted service '%s' contains %d deployments\n", hostedService.ServiceName, len(detailedHostedService.Deployments))
         // Do the same again with ListAllDeployments.
         deployments, err := api.ListAllDeployments(&gwacl.ListAllDeploymentsRequest{ServiceName: hostedService.ServiceName})
         checkError(err)
         if len(deployments) != len(detailedHostedService.Deployments) {
-            fmt.Printf(
+            Infof(
                 "Mismatch in reported deployments: %d != %d",
                 len(deployments), len(detailedHostedService.Deployments))
         }
     }
-    fmt.Println("Done listing hosted services\n")
+    Info("Done listing hosted services\n")
 
-    fmt.Println("Adding VM deployment...")
+    Info("Adding VM deployment...")
     hostname := gwacl.MakeRandomHostname("gwaclhost")
     // Random passwords are no use to man nor beast here if you want to
     // test with your instance, so we'll use a fixed one.  It's not really a
@@ -194,16 +193,17 @@
 
     storageAccount := makeRandomIdentifier("gwacl", 24)
     storageLabel := makeRandomIdentifier("gwacl", 64)
-    fmt.Printf("Requesting storage account with name '%s' and label '%s'...\n", storageAccount, storageLabel)
+    Infof("Requesting storage account with name '%s' and label '%s'...\n", storageAccount, storageLabel)
     cssi := gwacl.NewCreateStorageServiceInputWithLocation(storageAccount, storageLabel, location, "false")
     err = api.AddStorageAccount(cssi)
     checkError(err)
-    fmt.Println("Done requesting storage account\n")
+    Info("Done requesting storage account\n")
 
     defer func() {
-        fmt.Printf("Deleting storage account %s...\n", storageAccount)
+        Infof("Deleting storage account %s...\n", storageAccount)
+        // FIXME: Check error
         api.DeleteStorageAccount(storageAccount)
-        fmt.Println("Done deleting storage account\n")
+        Info("Done deleting storage account\n")
     }()
 
     mediaLink := gwacl.CreateVirtualHardDiskMediaLink(storageAccount, fmt.Sprintf("vhds/%s.vhd", vhdName))
@@ -216,36 +216,67 @@
     deployment := gwacl.NewDeploymentForCreateVMDeployment(machineName, "Staging", machineName, []gwacl.Role{*role}, "")
     err = api.AddDeployment(deployment, hostServiceName)
     checkError(err)
-    fmt.Println("Done adding VM deployment\n")
+    Info("Done adding VM deployment\n")
 
-    fmt.Println("Starting VM...")
+    Info("Starting VM...")
     err = api.StartRole(&gwacl.StartRoleRequest{hostServiceName, deployment.Name, role.RoleName})
     checkError(err)
-    fmt.Println("Done starting VM\n")
+    Info("Done starting VM\n")
 
-    fmt.Println("Listing VM...")
+    Info("Listing VM...")
     instances, err := api.ListInstances(&gwacl.ListInstancesRequest{hostServiceName})
     checkError(err)
-    fmt.Printf("Got %d instance(s)\n", len(instances))
-    fmt.Println("Done listing VM\n")
+    Infof("Got %d instance(s)\n", len(instances))
+    Info("Done listing VM\n")
 
-    fmt.Println("Getting deployment info...")
+    Info("Getting deployment info...")
     request := &gwacl.GetDeploymentRequest{ServiceName: hostServiceName, DeploymentName: machineName}
     deploy, err := api.GetDeployment(request)
     checkError(err)
     fqdn, err := deploy.GetFQDN()
     checkError(err)
-    fmt.Println("Got deployment info\n")
-
-    fmt.Println("host:", fqdn)
-    fmt.Println("username:", username)
-    fmt.Println("password:", password)
-    fmt.Println("")
+    Info("Got deployment info\n")
+
+    Info("host:", fqdn)
+    Info("username:", username)
+    Info("password:", password)
+    Info("")
+
+    Info("Adding role input endpoint...")
+    endpoint := gwacl.InputEndpoint{
+        Name:      gwacl.MakeRandomHostname("endpoint-"),
+        Port:      1080,
+        LocalPort: 80,
+        Protocol:  "TCP",
+    }
+    err = api.AddRoleEndpoints(&gwacl.AddRoleEndpointsRequest{
+        ServiceName:    hostServiceName,
+        DeploymentName: deployment.Name,
+        RoleName:       role.RoleName,
+        InputEndpoints: []gwacl.InputEndpoint{endpoint},
+    })
+    checkError(err)
+    Info("Added role input endpoint\n")
+
+    defer func() {
+        Info("Removing role input endpoint...")
+        // FIXME: Something above - AddRoleEndpoints seems a prime suspect -
+        // causes Azure to do something asynchronously, which we must wait for
+        // before attempting this call, or it will blow up with a 409.
+        err := api.RemoveRoleEndpoints(&gwacl.RemoveRoleEndpointsRequest{
+            ServiceName:    hostServiceName,
+            DeploymentName: deployment.Name,
+            RoleName:       role.RoleName,
+            InputEndpoints: []gwacl.InputEndpoint{endpoint},
+        })
+        checkError(err)
+        Info("Removed role input endpoint\n")
+    }()
 
     if pause {
         var wait string
-        fmt.Println("Pausing so you can play with the newly-created VM")
-        fmt.Println("To clear up, type something and press enter to continue")
+        Info("Pausing so you can play with the newly-created VM")
+        Info("To clear up, type something and press enter to continue")
         fmt.Scan(&wait)
     }
 }

=== modified file 'management.go'
--- management.go	2013-07-18 09:52:59 +0000
+++ management.go	2013-07-25 21:52:25 +0000
@@ -255,7 +255,7 @@
     return nil
 }
 
-type AddRoleEndpointRequest struct {
+type AddRoleEndpointsRequest struct {
     ServiceName    string
     DeploymentName string
     RoleName       string
@@ -265,7 +265,7 @@
 // AddRoleEndpoints appends the supplied endpoints to the existing endpoints
 // for the named service/deployment/role name.  Note that the Azure API
 // leaves this open to a race condition between fetching and updating the role.
-func (api *ManagementAPI) AddRoleEndpoints(request *AddRoleEndpointRequest) error {
+func (api *ManagementAPI) AddRoleEndpoints(request *AddRoleEndpointsRequest) error {
     var err error
     vmRole, err := api.GetRole(&GetRoleRequest{
         ServiceName:    request.ServiceName,
@@ -278,7 +278,7 @@
 
     for i, configSet := range vmRole.ConfigurationSets {
         // TODO: Is NetworkConfiguration always present?
-        if configSet.ConfigurationSetType == "NetworkConfiguration" {
+        if configSet.ConfigurationSetType == CONFIG_SET_NETWORK {
             endpointsP := vmRole.ConfigurationSets[i].InputEndpoints
             if endpointsP == nil {
                 // No endpoints set at all, initialise it to be empty.
@@ -306,3 +306,98 @@
     }
     return nil
 }
+
+// CompareInputEndpoints attempts to compare two InputEndpoint objects in a
+// way that's congruent with how Windows's Azure considers them. The name is
+// always ignored, as is LoadBalancerProbe. When LoadBalancedEndpointSetName
+// is set (not the empty string), all the fields - LocalPort, Port, Protocol,
+// VIP and LoadBalancedEndpointSetName - are used for the comparison. When
+// LoadBalancedEndpointSetName is the empty string, all except LocalPort -
+// effectively Port, Protocol and VIP - are used for comparison.
+func CompareInputEndpoints(a, b *InputEndpoint) bool {
+    if a.LoadBalancedEndpointSetName == "" {
+        return a.Port == b.Port && a.Protocol == b.Protocol && a.VIP == b.VIP
+    } else {
+        return (a.LoadBalancedEndpointSetName == b.LoadBalancedEndpointSetName &&
+            a.LocalPort == b.LocalPort && a.Port == b.Port &&
+            a.Protocol == b.Protocol && a.VIP == b.VIP)
+    }
+}
+
+type RemoveRoleEndpointsRequest struct {
+    ServiceName    string
+    DeploymentName string
+    RoleName       string
+    InputEndpoints []InputEndpoint
+}
+
+// RemoveRoleEndpoints attempts to remove the given endpoints from the
+// specified role. It uses `CompareInputEndpoints` to determine when there's a
+// match between the given endpoint and one already configured.
+func (api *ManagementAPI) RemoveRoleEndpoints(request *RemoveRoleEndpointsRequest) error {
+    filterRequest := filterRoleEndpointsRequest{
+        ServiceName:    request.ServiceName,
+        DeploymentName: request.DeploymentName,
+        RoleName:       request.RoleName,
+        Filter: func(a *InputEndpoint) bool {
+            for _, b := range request.InputEndpoints {
+                if CompareInputEndpoints(a, &b) {
+                    return false
+                }
+            }
+            return true
+        },
+    }
+    return api.filterRoleEndpoints(&filterRequest)
+}
+
+// Returns true to keep the endpoint defined in the role's configuration,
+// false to remove it. It is also welcome to mutate endpoints; they are passed
+// by reference.
+type inputEndpointFilter func(*InputEndpoint) bool
+
+type filterRoleEndpointsRequest struct {
+    ServiceName    string
+    DeploymentName string
+    RoleName       string
+    Filter         inputEndpointFilter
+}
+
+// filterRoleEndpoints is a general role endpoint filtering function. It is
+// private because it is only a support function for RemoveRoleEndpoints, and
+// is not tested directly.
+func (api *ManagementAPI) filterRoleEndpoints(request *filterRoleEndpointsRequest) error {
+    role, err := api.GetRole(&GetRoleRequest{
+        ServiceName:    request.ServiceName,
+        DeploymentName: request.DeploymentName,
+        RoleName:       request.RoleName,
+    })
+    if err != nil {
+        return err
+    }
+    for index, configSet := range role.ConfigurationSets {
+        if configSet.ConfigurationSetType == CONFIG_SET_NETWORK {
+            if configSet.InputEndpoints != nil {
+                endpoints := []InputEndpoint{}
+                for _, existingEndpoint := range *configSet.InputEndpoints {
+                    if request.Filter(&existingEndpoint) {
+                        endpoints = append(endpoints, existingEndpoint)
+                    }
+                }
+                if len(endpoints) == 0 {
+                    configSet.InputEndpoints = nil
+                } else {
+                    configSet.InputEndpoints = &endpoints
+                }
+            }
+        }
+        // Update the role; implicit copying is a nuisance.
+        role.ConfigurationSets[index] = configSet
+    }
+    return api.UpdateRole(&UpdateRoleRequest{
+        ServiceName:      request.ServiceName,
+        DeploymentName:   request.DeploymentName,
+        RoleName:         request.RoleName,
+        PersistentVMRole: role,
+    })
+}

=== modified file 'management_base.go'
--- management_base.go	2013-07-25 05:32:02 +0000
+++ management_base.go	2013-07-25 21:52:25 +0000
@@ -452,11 +452,11 @@
     if err != nil {
         return err
     }
-    _, err = api.session.put(url, "2012-03-01", []byte(role), "application/octet-stream")
+    response, err := api.session.put(url, "2012-03-01", []byte(role), "application/xml")
     if err != nil {
         return err
     }
-    return nil
+    return api.blockUntilCompleted(response)
 }
 
 type CreateAffinityGroupRequest struct {

=== modified file 'management_base_test.go'
--- management_base_test.go	2013-07-25 05:32:02 +0000
+++ management_base_test.go	2013-07-25 21:52:25 +0000
@@ -1018,6 +1018,7 @@
         serviceName + "/deployments/" + deploymentName + "/roles/" + roleName)
     checkRequest(
         c, httpRequest, expectedURL, "2012-03-01", []byte(expectedXML), "PUT")
+    c.Assert(httpRequest.ContentType, Equals, "application/xml")
 }
 
 func (suite *managementBaseAPISuite) TestUpdateRole(c *C) {
@@ -1044,6 +1045,46 @@
         request.DeploymentName, request.RoleName, expectedXML)
 }
 
+func (suite *managementBaseAPISuite) TestUpdateRoleBlocksUntilComplete(c *C) {
+    api := makeAPI(c)
+    api.PollerInterval = time.Nanosecond
+    request := &UpdateRoleRequest{
+        ServiceName:    "serviceName",
+        DeploymentName: "deploymentName",
+        RoleName:       "roleName",
+        PersistentVMRole: &PersistentVMRole{
+            RoleName: "newRoleNamePerhaps",
+        },
+    }
+    responses := []DispatcherResponse{
+        // First response is 202 with an X-MS-Request-ID header.
+        {makeX509ResponseWithOperationHeader("foobar"), nil},
+        // Second response is XML to say that the request above has completed.
+        {
+            &x509Response{
+                Body:       []byte(fmt.Sprintf(operationXMLTemplate, "Succeeded")),
+                StatusCode: http.StatusOK,
+            },
+            nil,
+        },
+    }
+    recordedRequests := []*X509Request{}
+    rigRecordingPreparedResponseDispatcher(&recordedRequests, responses)
+
+    err := api.UpdateRole(request)
+    c.Assert(err, IsNil)
+
+    c.Assert(recordedRequests, HasLen, 2)
+    expectedXML, err := request.PersistentVMRole.Serialize()
+    c.Assert(err, IsNil)
+    assertUpdateRoleRequest(
+        c, api, recordedRequests[0], request.ServiceName,
+        request.DeploymentName, request.RoleName, expectedXML)
+    // Second request is to get status of operation "foobar".
+    c.Check(recordedRequests[1].Method, Equals, "GET")
+    c.Check(recordedRequests[1].URL, Matches, ".*/operations/foobar")
+}
+
 func (suite *managementBaseAPISuite) TestCreateAffinityGroup(c *C) {
     api := makeAPI(c)
     cag := NewCreateAffinityGroup(

=== modified file 'management_test.go'
--- management_test.go	2013-07-18 07:04:50 +0000
+++ management_test.go	2013-07-25 21:52:25 +0000
@@ -853,7 +853,7 @@
     existingRole := &PersistentVMRole{
         ConfigurationSets: []ConfigurationSet{
             {
-                ConfigurationSetType: "NetworkConfiguration",
+                ConfigurationSetType: CONFIG_SET_NETWORK,
             },
         },
     }
@@ -873,7 +873,7 @@
         },
     }
 
-    request := &AddRoleEndpointRequest{
+    request := &AddRoleEndpointsRequest{
         ServiceName:    "foo",
         DeploymentName: "foo",
         RoleName:       "foo",
@@ -900,7 +900,7 @@
     existingRole := &PersistentVMRole{
         ConfigurationSets: []ConfigurationSet{
             {
-                ConfigurationSetType: "NetworkConfiguration",
+                ConfigurationSetType: CONFIG_SET_NETWORK,
                 InputEndpoints: &[]InputEndpoint{
                     {
                         LocalPort: 123,
@@ -927,7 +927,7 @@
         },
     }
 
-    request := &AddRoleEndpointRequest{
+    request := &AddRoleEndpointsRequest{
         ServiceName:    "foo",
         DeploymentName: "foo",
         RoleName:       "foo",
@@ -960,7 +960,7 @@
     rigRecordingPreparedResponseDispatcher(&record, responses)
     api := makeAPI(c)
 
-    request := &AddRoleEndpointRequest{
+    request := &AddRoleEndpointsRequest{
         ServiceName:    "foo",
         DeploymentName: "foo",
         RoleName:       "foo"}
@@ -979,7 +979,7 @@
     existingRole := &PersistentVMRole{
         ConfigurationSets: []ConfigurationSet{
             {
-                ConfigurationSetType: "NetworkConfiguration",
+                ConfigurationSetType: CONFIG_SET_NETWORK,
             },
         },
     }
@@ -999,7 +999,7 @@
         },
     }
 
-    request := &AddRoleEndpointRequest{
+    request := &AddRoleEndpointsRequest{
         ServiceName:    "foo",
         DeploymentName: "foo",
         RoleName:       "foo",
@@ -1010,3 +1010,303 @@
     c.Check(err, ErrorMatches, "PUT request failed [(]500: Internal Server Error[)]")
     c.Check(record, HasLen, 2)
 }
+
+type suiteRemoveRoleEndpoints struct{}
+
+var _ = Suite(&suiteRemoveRoleEndpoints{})
+
+func (suite *suiteRemoveRoleEndpoints) TestWhenNoPreexistingEndpoints(c *C) {
+    var err error
+    existingRole := &PersistentVMRole{
+        ConfigurationSets: []ConfigurationSet{
+            {
+                ConfigurationSetType: CONFIG_SET_NETWORK,
+            },
+        },
+    }
+    responses := makeOKXMLResponse(c, existingRole)
+    responses = append(responses, DispatcherResponse{
+        // Accept upload of new endpoints
+        response: &x509Response{StatusCode: http.StatusOK},
+    })
+    record := []*X509Request{}
+    rigRecordingPreparedResponseDispatcher(&record, responses)
+    api := makeAPI(c)
+    endpoints := []InputEndpoint{
+        {
+            LocalPort: 999,
+            Name:      "test999",
+            Port:      1999,
+        },
+    }
+
+    request := &RemoveRoleEndpointsRequest{
+        ServiceName:    "service-name",
+        DeploymentName: "deployment-name",
+        RoleName:       "role-name",
+        InputEndpoints: endpoints,
+    }
+    err = api.RemoveRoleEndpoints(request)
+
+    c.Assert(err, IsNil)
+    c.Check(record, HasLen, 2)
+    // Check GetRole was performed.
+    assertGetRoleRequest(
+        c, api, record[0], request.ServiceName, request.DeploymentName,
+        request.RoleName)
+    // Check UpdateRole was performed.
+    expectedXML, err := existingRole.Serialize()
+    c.Assert(err, IsNil)
+    assertUpdateRoleRequest(
+        c, api, record[1], request.ServiceName, request.DeploymentName,
+        request.RoleName, expectedXML)
+}
+
+func (suite *suiteRemoveRoleEndpoints) TestWhenEndpointIsDefined(c *C) {
+    var err error
+    existingRole := &PersistentVMRole{
+        ConfigurationSets: []ConfigurationSet{
+            {
+                ConfigurationSetType: CONFIG_SET_NETWORK,
+                InputEndpoints: &[]InputEndpoint{
+                    {
+                        LocalPort: 123,
+                        Name:      "test123",
+                        Port:      1123,
+                    },
+                    {
+                        LocalPort: 456,
+                        Name:      "test456",
+                        Port:      4456,
+                    },
+                },
+            },
+        },
+    }
+    responses := makeOKXMLResponse(c, existingRole)
+    responses = append(responses, DispatcherResponse{
+        // Accept upload of new endpoints
+        response: &x509Response{StatusCode: http.StatusOK},
+    })
+    record := []*X509Request{}
+    rigRecordingPreparedResponseDispatcher(&record, responses)
+    api := makeAPI(c)
+
+    request := &RemoveRoleEndpointsRequest{
+        ServiceName:    "service-name",
+        DeploymentName: "deployment-name",
+        RoleName:       "role-name",
+        // Remove the first of the existing endppints.
+        InputEndpoints: (*existingRole.ConfigurationSets[0].InputEndpoints)[:1],
+    }
+    err = api.RemoveRoleEndpoints(request)
+
+    c.Assert(err, IsNil)
+    c.Check(record, HasLen, 2)
+    // Check GetRole was performed.
+    assertGetRoleRequest(
+        c, api, record[0], request.ServiceName, request.DeploymentName,
+        request.RoleName)
+    // Check UpdateRole was performed.
+    expected := &PersistentVMRole{
+        ConfigurationSets: []ConfigurationSet{
+            {
+                ConfigurationSetType: CONFIG_SET_NETWORK,
+                InputEndpoints: &[]InputEndpoint{
+                    (*existingRole.ConfigurationSets[0].InputEndpoints)[1],
+                },
+            },
+        },
+    }
+    expectedXML, err := expected.Serialize()
+    c.Assert(err, IsNil)
+    assertUpdateRoleRequest(
+        c, api, record[1], request.ServiceName, request.DeploymentName,
+        request.RoleName, expectedXML)
+}
+
+func (suite *suiteRemoveRoleEndpoints) TestWhenAllEndpointsAreRemoved(c *C) {
+    var err error
+    existingRole := &PersistentVMRole{
+        ConfigurationSets: []ConfigurationSet{
+            {
+                ConfigurationSetType: CONFIG_SET_NETWORK,
+                InputEndpoints: &[]InputEndpoint{
+                    {
+                        LocalPort: 123,
+                        Name:      "test123",
+                        Port:      1123,
+                    },
+                },
+            },
+        },
+    }
+    responses := makeOKXMLResponse(c, existingRole)
+    responses = append(responses, DispatcherResponse{
+        // Accept upload of new endpoints
+        response: &x509Response{StatusCode: http.StatusOK},
+    })
+    record := []*X509Request{}
+    rigRecordingPreparedResponseDispatcher(&record, responses)
+    api := makeAPI(c)
+
+    request := &RemoveRoleEndpointsRequest{
+        ServiceName:    "service-name",
+        DeploymentName: "deployment-name",
+        RoleName:       "role-name",
+        // Remove the first of the existing endppints.
+        InputEndpoints: *existingRole.ConfigurationSets[0].InputEndpoints,
+    }
+    err = api.RemoveRoleEndpoints(request)
+
+    c.Assert(err, IsNil)
+    c.Check(record, HasLen, 2)
+    // Check GetRole was performed.
+    assertGetRoleRequest(
+        c, api, record[0], request.ServiceName, request.DeploymentName,
+        request.RoleName)
+    // Check UpdateRole was performed.
+    expected := &PersistentVMRole{
+        ConfigurationSets: []ConfigurationSet{
+            {
+                ConfigurationSetType: CONFIG_SET_NETWORK,
+                // InputEndpoints is nil, not the empty slice.
+                InputEndpoints: nil,
+            },
+        },
+    }
+    expectedXML, err := expected.Serialize()
+    c.Assert(err, IsNil)
+    assertUpdateRoleRequest(
+        c, api, record[1], request.ServiceName, request.DeploymentName,
+        request.RoleName, expectedXML)
+}
+
+func (suite *suiteRemoveRoleEndpoints) TestWhenGetRoleFails(c *C) {
+    responses := []DispatcherResponse{
+        // No role found.
+        {response: &x509Response{StatusCode: http.StatusNotFound}},
+    }
+    record := []*X509Request{}
+    rigRecordingPreparedResponseDispatcher(&record, responses)
+    api := makeAPI(c)
+
+    request := &RemoveRoleEndpointsRequest{
+        ServiceName:    "service-name",
+        DeploymentName: "deployment-name",
+        RoleName:       "role-name",
+    }
+    err := api.RemoveRoleEndpoints(request)
+
+    c.Assert(err, NotNil)
+    c.Check(err, ErrorMatches, "GET request failed [(]404: Not Found[)]")
+    c.Check(record, HasLen, 1)
+    assertGetRoleRequest(
+        c, api, record[0], request.ServiceName, request.DeploymentName,
+        request.RoleName)
+}
+
+func (suite *suiteRemoveRoleEndpoints) TestWhenUpdateFails(c *C) {
+    var err error
+    existingRole := &PersistentVMRole{
+        ConfigurationSets: []ConfigurationSet{
+            {ConfigurationSetType: CONFIG_SET_NETWORK},
+        },
+    }
+    responses := makeOKXMLResponse(c, existingRole)
+    responses = append(responses, DispatcherResponse{
+        // Cannot accept upload of new role endpoint
+        response: &x509Response{StatusCode: http.StatusInternalServerError},
+    })
+    record := []*X509Request{}
+    rigRecordingPreparedResponseDispatcher(&record, responses)
+    api := makeAPI(c)
+
+    request := &RemoveRoleEndpointsRequest{
+        ServiceName:    "service-name",
+        DeploymentName: "deployment-name",
+        RoleName:       "role-name",
+    }
+    err = api.RemoveRoleEndpoints(request)
+
+    c.Assert(err, NotNil)
+    c.Check(err, ErrorMatches, "PUT request failed [(]500: Internal Server Error[)]")
+    c.Check(record, HasLen, 2)
+}
+
+type suiteCompareInputEndpoints struct{}
+
+var _ = Suite(&suiteCompareInputEndpoints{})
+
+func (suite *suiteCompareInputEndpoints) TestEqualWhenEmpty(c *C) {
+    a := &InputEndpoint{}
+    b := &InputEndpoint{}
+    c.Assert(CompareInputEndpoints(a, b), Equals, true)
+}
+
+func (suite *suiteCompareInputEndpoints) TestEquality(c *C) {
+    checkComparison := func(a, b InputEndpoint, expected bool) {
+        c.Check(CompareInputEndpoints(&a, &b), Equals, expected)
+    }
+    // Name has no influence on comparison.
+    checkComparison(
+        InputEndpoint{Name: "foo"},
+        InputEndpoint{Name: "bar"},
+        true)
+    // LoadBalancerProbe has no influence on comparison.
+    checkComparison(
+        InputEndpoint{
+            LoadBalancerProbe: &LoadBalancerProbe{Path: "foo"},
+        },
+        InputEndpoint{
+            LoadBalancerProbe: &LoadBalancerProbe{Path: "bar"},
+        },
+        true,
+    )
+    // Port influences comparisons.
+    checkComparison(
+        InputEndpoint{Port: 1234},
+        InputEndpoint{Port: 1234},
+        true)
+    checkComparison(
+        InputEndpoint{Port: 1234},
+        InputEndpoint{Port: 5678},
+        false)
+    // Protocol influences comparisons.
+    checkComparison(
+        InputEndpoint{Protocol: "TCP"},
+        InputEndpoint{Protocol: "TCP"},
+        true)
+    checkComparison(
+        InputEndpoint{Protocol: "TCP"},
+        InputEndpoint{Protocol: "UDP"},
+        false)
+    // VIP influences comparisons.
+    checkComparison(
+        InputEndpoint{VIP: "1.2.3.4"},
+        InputEndpoint{VIP: "1.2.3.4"},
+        true)
+    checkComparison(
+        InputEndpoint{VIP: "1.2.3.4"},
+        InputEndpoint{VIP: "5.6.7.8"},
+        false)
+    // LoadBalancedEndpointSetName influences comparisons.
+    checkComparison(
+        InputEndpoint{LoadBalancedEndpointSetName: "foo"},
+        InputEndpoint{LoadBalancedEndpointSetName: "foo"},
+        true)
+    checkComparison(
+        InputEndpoint{LoadBalancedEndpointSetName: "foo"},
+        InputEndpoint{LoadBalancedEndpointSetName: "bar"},
+        false)
+    // LocalPort influences comparisons only when LoadBalancedEndpointSetName
+    // is not the empty string.
+    checkComparison(
+        InputEndpoint{LocalPort: 1234},
+        InputEndpoint{LocalPort: 5678},
+        true)
+    checkComparison(
+        InputEndpoint{LoadBalancedEndpointSetName: "foo", LocalPort: 1234},
+        InputEndpoint{LoadBalancedEndpointSetName: "foo", LocalPort: 5678},
+        false)
+}

=== modified file 'x509dispatcher.go'
--- x509dispatcher.go	2013-07-22 13:41:49 +0000
+++ x509dispatcher.go	2013-07-25 21:52:25 +0000
@@ -15,13 +15,6 @@
     ContentType string
 }
 
-// Print debugging output.
-var verbose = false
-
-func SetVerbose(newVerbose bool) {
-    verbose = newVerbose
-}
-
 // newX509RequestGET initializes an X509Request for a GET.  You may still need
 // to set further values.
 func newX509RequestGET(url, apiVersion string) *X509Request {
@@ -68,24 +61,20 @@
 type x509Response struct {
     StatusCode int
     // TODO: What exactly do we get back?  How will we know its encoding?
-    Body      []byte
-    RawHeader []byte
-    Header    http.Header
+    Body   []byte
+    Header http.Header
 }
 
 func newX509Response() *x509Response {
     return &x509Response{
-        Body:      make([]byte, 0),
-        RawHeader: make([]byte, 0),
+        Body: make([]byte, 0),
     }
 }
 
 func performX509Request(session *x509Session, request *X509Request) (*x509Response, error) {
-    if verbose {
-        Debug("Performing request")
-        Debug("Request url: " + request.URL)
-        Debug("Request method: " + request.Method)
-        Debugf("Request body: %s\n", request.Payload)
+    Debugf("Request: %s %s", request.Method, request.URL)
+    if len(request.Payload) > 0 {
+        Debugf("Request body:\n%s", request.Payload)
     }
 
     bodyReader := ioutil.NopCloser(bytes.NewReader(request.Payload))
@@ -107,11 +96,16 @@
         return nil, err
     }
     response.Header = httpResponse.Header
-    if verbose {
-        Debug("Got response")
-        Debugf("Response status: %d\n", response.StatusCode)
-        Debugf("Response headers: %s\n", response.RawHeader)
-        Debugf("Response body: %s\n", response.Body)
-    }
+
+    Debugf("Response: %d %s", response.StatusCode, http.StatusText(response.StatusCode))
+    if response.Header != nil {
+        buf := bytes.Buffer{}
+        response.Header.Write(&buf)
+        Debugf("Response headers:\n%s", buf.String())
+    }
+    if len(response.Body) > 0 {
+        Debugf("Response body:\n%s", response.Body)
+    }
+
     return response, nil
 }

=== modified file 'xmlobjects.go'
--- xmlobjects.go	2013-07-25 04:15:52 +0000
+++ xmlobjects.go	2013-07-25 21:52:25 +0000
@@ -39,6 +39,11 @@
 // ConfigurationSet bits
 //
 
+const (
+    CONFIG_SET_LINUX_PROVISIONING = "LinuxProvisioningConfiguration"
+    CONFIG_SET_NETWORK            = "NetworkConfiguration"
+)
+
 // A ConfigurationSet object can be different things depending on its 'type'.
 // The types we currently support are:
 // - LinuxProvisioningConfigurationSet: configuration of a Linux VM
@@ -80,7 +85,7 @@
     Hostname, Username, Password, CustomData string,
     DisableSSHPasswordAuthentication string) *ConfigurationSet {
     return &ConfigurationSet{
-        ConfigurationSetType:             "LinuxProvisioningConfiguration",
+        ConfigurationSetType:             CONFIG_SET_LINUX_PROVISIONING,
         Hostname:                         Hostname,
         Username:                         Username,
         Password:                         Password,
@@ -93,7 +98,7 @@
 func NewNetworkConfigurationSet(
     inputEndpoints []InputEndpoint, subnetNames []string) *ConfigurationSet {
     return &ConfigurationSet{
-        ConfigurationSetType: "NetworkConfiguration",
+        ConfigurationSetType: CONFIG_SET_NETWORK,
         InputEndpoints:       &inputEndpoints,
         SubnetNames:          &subnetNames,
     }

=== modified file 'xmlobjects_test.go'
--- xmlobjects_test.go	2013-07-25 04:15:52 +0000
+++ xmlobjects_test.go	2013-07-25 21:52:25 +0000
@@ -249,7 +249,7 @@
         RoleType:  "PersistentVMRole",
         ConfigurationSets: []ConfigurationSet{
             {
-                ConfigurationSetType: "NetworkConfiguration",
+                ConfigurationSetType: CONFIG_SET_NETWORK,
                 InputEndpoints: &[]InputEndpoint{
                     {
                         LoadBalancedEndpointSetName: "name-of-load-balanced-endpoint-set",
@@ -318,7 +318,7 @@
         RoleType:  "PersistentVMRole",
         ConfigurationSets: []ConfigurationSet{
             {
-                ConfigurationSetType: "NetworkConfiguration",
+                ConfigurationSetType: CONFIG_SET_NETWORK,
                 InputEndpoints: &[]InputEndpoint{
                     {
                         LoadBalancedEndpointSetName: "name-of-load-balanced-endpoint-set",
@@ -935,7 +935,7 @@
                 RoleType: "PersistentVMRole",
                 ConfigurationSets: []ConfigurationSet{
                     {
-                        ConfigurationSetType: "NetworkConfiguration",
+                        ConfigurationSetType: CONFIG_SET_NETWORK,
                         InputEndpoints: &[]InputEndpoint{
                             {
                                 Name:      "test-name",
@@ -1345,7 +1345,7 @@
     c.Check(inputEndpoint.Protocol, Equals, protocol)
     c.Check(inputEndpoint.LoadBalancedEndpointSetName, Equals, bName)
     c.Check(inputEndpoint.LocalPort, Equals, localPort)
-    c.Check(config.ConfigurationSetType, Equals, "NetworkConfiguration")
+    c.Check(config.ConfigurationSetType, Equals, CONFIG_SET_NETWORK)
     c.Check(*config.SubnetNames, DeepEquals, []string{"subnet-1", "subnet-2"})
 }