Merge lp:~axwalk/juju-core/azure-provider-roleisinstance into lp:~go-bot/juju-core/trunk

[Andrew Wilkins]

provider/azure: enable load-balancing/availability

This change is required to enable Availability Set
support for Azure. The existing implementation was
fundamentally incompatible with Availability Sets,
so the implementation has been significantly altered,
while maintaining backwards compatibility.

In the old implementation, instances are associated
one-to-one with Cloud Services. In the new
implementation, instances are associated with Roles
within a Cloud Service; there may be multiple Roles
within a single Cloud Service.

If a service is exposed, then its ports will be load-
balanced across each instance within the cloud service
which opens that port. We currently open ports 22 for
all instances, and the Mongo and API server ports for
state server instances. State server instances are
allocated to a single Cloud Service.

There are a number of incidental improvements, e.g.
using an updated version of DeleteHostedService which
destroys associated disks/blobs server side.

All instances are now allocated to an Availability Set
called "juju", which is scoped to the Cloud Service.
We do not currently group units into Cloud Services
automatically, however the ground work is laid to do
this. A follow-up will implement this work.

When we enable grouping, the same time we will have to
make changes to how we connect to machines via SSH,
either by proxying through an arbitrary machine in the
Cloud Service, or by not load balancing port 22 and
connecting to the machine's auto-allocated public port.

https://codereview.appspot.com/73910043/

provider/azure: enable load-balancing/availability

This change is required to enable Availability Set
support for Azure. The existing implementation was
fundamentally incompatible with Availability Sets,
so the implementation has been significantly altered,
while maintaining backwards compatibility.

In the old implementation, instances are associated
one-to-one with Cloud Services. In the new
implementation, instances are associated with Roles
within a Cloud Service; there may be multiple Roles
within a single Cloud Service.

If a service is exposed, then its ports will be load-
balanced across each instance within the cloud service
which opens that port. We currently open ports 22 for
all instances, and the Mongo and API server ports for
state server instances. State server instances are
allocated to a single Cloud Service.

There are a number of incidental improvements, e.g.
using an updated version of DeleteHostedService which
destroys associated disks/blobs server side.

All instances are now allocated to an Availability Set
called "juju", which is scoped to the Cloud Service.
We do not currently group units into Cloud Services
automatically, however the ground work is laid to do
this. A follow-up will implement this work.

When we enable grouping, the same time we will have to
make changes to how we connect to machines via SSH,
either by proxying through an arbitrary machine in the
Cloud Service, or by not load balancing port 22 and
connecting to the machine's auto-allocated public port.

https://codereview.appspot.com/73910043/

[Andrew Wilkins (axwalk)]

Reviewers: mp+210353_code.launchpad.net,

Message:
Please take a look.

Description:
provider/azure: enable load-balancing/availability

This change is required to enable Availability Set
support for Azure. The existing implementation was
fundamentally incompatible with Availability Sets,
so the implementation has been significantly altered,
while maintaining backwards compatibility.

In the old implementation, instances are associated
one-to-one with Cloud Services. In the new
implementation, instances are associated with Roles
within a Cloud Service; there may be multiple Roles
within a single Cloud Service.

If a service is exposed, then its ports will be load-
balanced across each instance within the cloud service
which opens that port. We currently open ports 22 for
all instances, and the Mongo and API server ports for
state server instances. State server instances are
allocated to a single Cloud Service.

There are a number of incidental improvements, e.g.
using an updated version of DeleteHostedService which
destroys associated disks/blobs server side.

All instances are now allocated to an Availability Set
called "juju", which is scoped to the Cloud Service.
We do not currently group units into Cloud Services
automatically, however the ground work is laid to do
this. A follow-up will implement this work.

When we enable grouping, the same time we will have to
make changes to how we connect to machines via SSH,
either by proxying through an arbitrary machine in the
Cloud Service, or by not load balancing port 22 and
connecting to the machine's auto-allocated public port.

https://code.launchpad.net/~axwalk/juju-core/azure-provider-roleisinstance/+merge/210353

(do not edit description out of merge proposal)

Please review this at https://codereview.appspot.com/73910043/

Affected files (+1090, -888 lines):
   A [revision details]
   M dependencies.tsv
   M provider/azure/environ.go
   M provider/azure/environ_test.go
   M provider/azure/instance.go
   M provider/azure/instance_test.go

[Tim Penhey (thumper)]

Lots of changes here, comments below.

I'm hoping that CI for Azure would help catch any actual problems here
as it is a bit beyond a simple review :-)

https://codereview.appspot.com/73910043/diff/20001/provider/azure/environ.go
File provider/azure/environ.go (right):

https://codereview.appspot.com/73910043/diff/20001/provider/azure/environ.go#newcode232
provider/azure/environ.go:232: if err, ok := err.(*gwacl.AzureError); ok
{
oh... didn't know you could do that...

reassigning to err I mean...

https://codereview.appspot.com/73910043/diff/20001/provider/azure/environ.go#newcode443
provider/azure/environ.go:443: func (env *azureEnviron) createRole(azure
*gwacl.ManagementAPI, role *gwacl.Role, label string) (resultInst
instance.Instance, resultErr error) {
it isn't entirely clear why 'createRole' returns an instance

https://codereview.appspot.com/73910043/diff/20001/provider/azure/environ.go#newcode589
provider/azure/environ.go:589: case
deploymentNameV2(hostedService.ServiceName):
perhaps a blank before this line? wrapping lines makes it harder to pick
out.

https://codereview.appspot.com/73910043/diff/20001/provider/azure/environ.go#newcode636
provider/azure/environ.go:636: // don't load balance SSH and provie a
way of getting the
s/provie/provide/

https://codereview.appspot.com/73910043/diff/20001/provider/azure/environ.go#newcode732
provider/azure/environ.go:732: } else if len(service.Deployments) != 1 {
why skip services where we have more than one deployment?

https://codereview.appspot.com/73910043/diff/20001/provider/azure/environ_test.go
File provider/azure/environ_test.go (right):

https://codereview.appspot.com/73910043/diff/20001/provider/azure/environ_test.go#newcode978
provider/azure/environ_test.go:978: c.Check(inst1, gc.FitsTypeOf,
&azureInstance{})
Hmm... didn't know about this checker, but perhaps you should make that
one an Assert not a Check, because if it fails, the next line will
panic.

https://codereview.appspot.com/73910043/diff/20001/provider/azure/instance.go
File provider/azure/instance.go (right):

https://codereview.appspot.com/73910043/diff/20001/provider/azure/instance.go#newcode95
provider/azure/instance.go:95:
azInstance.environ.getVirtualNetworkName(),
Which parts of the *azureInstance are being protected by the mutex?

https://codereview.appspot.com/73910043/diff/20001/provider/azure/instance_test.go
File provider/azure/instance_test.go (right):

https://codereview.appspot.com/73910043/diff/20001/provider/azure/instance_test.go#newcode18
provider/azure/instance_test.go:18: type instanceSuite struct {
Normally at least want to include the testbase.LoggingSuite to capture
the logging.

https://codereview.appspot.com/73910043/

[Andrew Wilkins (axwalk)]

Please take a look.

https://codereview.appspot.com/73910043/diff/20001/provider/azure/environ.go
File provider/azure/environ.go (right):

https://codereview.appspot.com/73910043/diff/20001/provider/azure/environ.go#newcode443
provider/azure/environ.go:443: func (env *azureEnviron) createRole(azure
*gwacl.ManagementAPI, role *gwacl.Role, label string) (resultInst
instance.Instance, resultErr error) {
On 2014/03/13 04:15:05, thumper wrote:
> it isn't entirely clear why 'createRole' returns an instance

Renamed to instance. Instance and role are equivalent, but I'll keep it
to Juju terminology.

https://codereview.appspot.com/73910043/diff/20001/provider/azure/environ.go#newcode589
provider/azure/environ.go:589: case
deploymentNameV2(hostedService.ServiceName):
On 2014/03/13 04:15:05, thumper wrote:
> perhaps a blank before this line? wrapping lines makes it harder to
pick out.

Done.

https://codereview.appspot.com/73910043/diff/20001/provider/azure/environ.go#newcode636
provider/azure/environ.go:636: // don't load balance SSH and provie a
way of getting the
On 2014/03/13 04:15:05, thumper wrote:
> s/provie/provide/

Done.

https://codereview.appspot.com/73910043/diff/20001/provider/azure/environ.go#newcode732
provider/azure/environ.go:732: } else if len(service.Deployments) != 1 {
On 2014/03/13 04:15:05, thumper wrote:
> why skip services where we have more than one deployment?

Because if there's more than one, that means someone's been mucking
about with the objects. Juju only creates one deployment per Cloud
Service. You can have up to two (Prod & Dev), but we only do Production.

https://codereview.appspot.com/73910043/diff/20001/provider/azure/environ_test.go
File provider/azure/environ_test.go (right):

https://codereview.appspot.com/73910043/diff/20001/provider/azure/environ_test.go#newcode978
provider/azure/environ_test.go:978: c.Check(inst1, gc.FitsTypeOf,
&azureInstance{})
On 2014/03/13 04:15:05, thumper wrote:
> Hmm... didn't know about this checker, but perhaps you should make
that one an
> Assert not a Check, because if it fails, the next line will panic.

Done.

https://codereview.appspot.com/73910043/diff/20001/provider/azure/instance.go
File provider/azure/instance.go (right):

https://codereview.appspot.com/73910043/diff/20001/provider/azure/instance.go#newcode95
provider/azure/instance.go:95:
azInstance.environ.getVirtualNetworkName(),
On 2014/03/13 04:15:05, thumper wrote:
> Which parts of the *azureInstance are being protected by the mutex?

Only roleInstance (I've been told the convention is to put those fields
that are guarded below the mutex). All others are immutable and
thread-safe.

https://codereview.appspot.com/73910043/diff/20001/provider/azure/instance_test.go
File provider/azure/instance_test.go (right):

https://codereview.appspot.com/73910043/diff/20001/provider/azure/instance_test.go#newcode18
provider/azure/instance_test.go:18: type instanceSuite struct {
On 2014/03/13 04:15:05, thumper wrote:
> Normally at least want to include the testbase.LoggingSuite to capture
the
> logging.

Done.

https://codereview.appspot.com/73910043/

[William Reade (fwereade)]

pre-comment for discussion

https://codereview.appspot.com/73910043/diff/40001/provider/azure/environ.go
File provider/azure/environ.go (right):

https://codereview.appspot.com/73910043/diff/40001/provider/azure/environ.go#newcode554
provider/azure/environ.go:554: if machineConfig.StateServer {
oooh, this is going to break sometime. HA state server nodes will not
necessarily be started with this field set. How much will we depend upon
this? If it's just cosmetic it's maybe not such a big deal, but really I
think it's up to juju itself to supply a sensible label to be applied if
possible.

https://codereview.appspot.com/73910043/diff/40001/provider/azure/environ.go#newcode566
provider/azure/environ.go:566: role := env.newRole(instanceType, vhd,
userData, machineConfig.StateServer)
heh, this is the same problem, but more significant. We'll have to start
distinguishing between StateServer and BootstrapMachine or something in
MachineConfig -- StateServer wouldn't affect cloudinit (because the MA
will turn itself into a stateserver when it connects) but can be handled
in this case, while Bootstrap will be the thing that controls the
special...

wait. This is more complicated than I thought. Would you ping me when
you're back from supper please?

https://codereview.appspot.com/73910043/

[Roger Peppe (rogpeppe)]

LGTM with some thoughts and suggestions below.

https://codereview.appspot.com/73910043/diff/40001/provider/azure/environ.go
File provider/azure/environ.go (right):

https://codereview.appspot.com/73910043/diff/40001/provider/azure/environ.go#newcode407
provider/azure/environ.go:407: labelBase64 :=
base64.StdEncoding.EncodeToString([]byte(label))
Shouldn't gwacl be doing this decoding, given that it's doing the
encoding itself? (it seems a bit odd that base-64 encoding is required -
the azure docs distinctly show a non-base64-encoded example)

https://codereview.appspot.com/73910043/diff/40001/provider/azure/environ.go#newcode443
provider/azure/environ.go:443: // createInstance creates all of the
necessary Azure entities in order
// createInstance creates all of the Azure entities
// necessary for a new instance. ...

?

https://codereview.appspot.com/73910043/diff/40001/provider/azure/environ.go#newcode554
provider/azure/environ.go:554: if machineConfig.StateServer {
On 2014/03/19 09:54:08, fwereade wrote:
> oooh, this is going to break sometime. HA state server nodes will not
> necessarily be started with this field set. How much will we depend
upon this?
> If it's just cosmetic it's maybe not such a big deal, but really I
think it's up
> to juju itself to supply a sensible label to be applied if possible.

I believe that it's not possible to assign a machine to an availability
set after it's been started, so unless this field *is* set at instance
start time, there's nothing we can do.

Perhaps it *might* make sense to add a "group" (or something similarly
named) field in MachineConfig. Then all the logic for deciding which
machines are grouped together can be outside of the provider logic (the
providers can remain blissfully ignorant of juju services); different
providers might decide for themselves how to interpret the group
(ignoring it would be acceptable).

https://codereview.appspot.com/73910043/diff/40001/provider/azure/instance.go
File provider/azure/instance.go (right):

https://codereview.appspot.com/73910043/diff/40001/provider/azure/instance.go#newcode29
provider/azure/instance.go:29: mu sync.RWMutex
is an RWMutex really worth it here? i'd just use a mutex - it's smaller,
and space is a more likely problem than time in this case, i'd say.

https://codereview.appspot.com/73910043/diff/40001/provider/azure/instance.go#newcode93
provider/azure/instance.go:93: ip,
could we name the fields here please?

https://codereview.appspot.com/73910043/diff/40001/provider/azure/instance.go#newcode96
provider/azure/instance.go:96: instance.NetworkCloudLocal})
trivial formatting: i think we usually put the } on a new line, so that
all the fields look the same.

https://codereview.appspot.com/73910043/diff/40001/provider/azure/instance.go#newcode98
provider/azure/instance.go:98: } else {
s/} else {/}/

(save a level of indentation)

https://codereview.appspot.com/73910043/

[Andrew Wilkins (axwalk)]

https://codereview.appspot.com/73910043/diff/40001/provider/azure/environ.go
File provider/azure/environ.go (right):

https://codereview.appspot.com/73910043/diff/40001/provider/azure/environ.go#newcode554
provider/azure/environ.go:554: if machineConfig.StateServer {
On 2014/03/19 09:54:08, fwereade wrote:
> oooh, this is going to break sometime. HA state server nodes will not
> necessarily be started with this field set. How much will we depend
upon this?
> If it's just cosmetic it's maybe not such a big deal, but really I
think it's up
> to juju itself to supply a sensible label to be applied if possible.

Based on discussion on IRC, I will change this to use
DistributionInstances from the other CL. DistributionInstances will
return state server instances if the machine being provisioned is a
state server, otherwise it will return common service instances.

The whole label thing will just disappear, since the cloud service can
be extracted from the instance ID.

https://codereview.appspot.com/73910043/

[William Reade (fwereade)]

WIP for DistributionInstances

[Andrew Wilkins (axwalk)]

Oops, never did mail this.

https://codereview.appspot.com/73910043/diff/40001/provider/azure/environ.go
File provider/azure/environ.go (right):

https://codereview.appspot.com/73910043/diff/40001/provider/azure/environ.go#newcode407
provider/azure/environ.go:407: labelBase64 :=
base64.StdEncoding.EncodeToString([]byte(label))
On 2014/03/19 11:44:35, rog wrote:
> Shouldn't gwacl be doing this decoding, given that it's doing the
encoding
> itself? (it seems a bit odd that base-64 encoding is required - the
azure docs
> distinctly show a non-base64-encoded example)

I agree, the base64 encoding/decoding is a bit clumsy and leaky. I don't
think we'll be using the labels much longer, though.

https://codereview.appspot.com/73910043/diff/40001/provider/azure/environ.go#newcode443
provider/azure/environ.go:443: // createInstance creates all of the
necessary Azure entities in order
On 2014/03/19 11:44:35, rog wrote:
> // createInstance creates all of the Azure entities
> // necessary for a new instance. ...

> ?

Done.

https://codereview.appspot.com/73910043/diff/40001/provider/azure/instance.go
File provider/azure/instance.go (right):

https://codereview.appspot.com/73910043/diff/40001/provider/azure/instance.go#newcode29
provider/azure/instance.go:29: mu sync.RWMutex
On 2014/03/19 11:44:35, rog wrote:
> is an RWMutex really worth it here? i'd just use a mutex - it's
smaller, and
> space is a more likely problem than time in this case, i'd say.

Done.

https://codereview.appspot.com/73910043/diff/40001/provider/azure/instance.go#newcode93
provider/azure/instance.go:93: ip,
On 2014/03/19 11:44:35, rog wrote:
> could we name the fields here please?

Done.

https://codereview.appspot.com/73910043/diff/40001/provider/azure/instance.go#newcode96
provider/azure/instance.go:96: instance.NetworkCloudLocal})
On 2014/03/19 11:44:35, rog wrote:
> trivial formatting: i think we usually put the } on a new line, so
that all the
> fields look the same.

Yeah, this is existing code, I usually do that too. I've reformatted it.

https://codereview.appspot.com/73910043/diff/40001/provider/azure/instance.go#newcode98
provider/azure/instance.go:98: } else {
On 2014/03/19 11:44:35, rog wrote:
> s/} else {/}/

> (save a level of indentation)

Done.

https://codereview.appspot.com/73910043/

[Andrew Wilkins (axwalk)]

Please take a look.

https://codereview.appspot.com/73910043/

[William Reade (fwereade)]

Thanks, this is great. LGTM.

https://codereview.appspot.com/73910043/diff/60001/provider/azure/instance.go
File provider/azure/instance.go (right):

https://codereview.appspot.com/73910043/diff/60001/provider/azure/instance.go#newcode56
provider/azure/instance.go:56: // TODO(axw) map instance status to
something more useful?
It's considered ok for status to use the provider's vocabulary.

https://codereview.appspot.com/73910043/diff/60001/provider/azure/instance.go#newcode188
provider/azure/instance.go:188: // concern.
This bothers me a bit, but it feels more like an azure problem than our
problem.

https://codereview.appspot.com/73910043/

[Andrew Wilkins (axwalk)]

Please take a look.

https://codereview.appspot.com/73910043/diff/60001/provider/azure/instance.go
File provider/azure/instance.go (right):

https://codereview.appspot.com/73910043/diff/60001/provider/azure/instance.go#newcode56
provider/azure/instance.go:56: // TODO(axw) map instance status to
something more useful?
On 2014/04/03 07:31:15, fwereade wrote:
> It's considered ok for status to use the provider's vocabulary.

Removed.

https://codereview.appspot.com/73910043/

[Go Bot (go-bot)]

The attempt to merge lp:~axwalk/juju-core/azure-provider-roleisinstance into lp:juju-core failed. Below is the output from the failed tests.

"/home/tarmac/trees/src/launchpad.net/gwacl" now at tarmac-20140312041035-ac7gw7kcqjx7db63
ok launchpad.net/juju-core 0.014s
ok launchpad.net/juju-core/agent 1.177s
ok launchpad.net/juju-core/agent/mongo 0.507s
ok launchpad.net/juju-core/agent/tools 0.194s
ok launchpad.net/juju-core/bzr 4.868s
ok launchpad.net/juju-core/cert 2.236s
ok launchpad.net/juju-core/charm 0.378s
? launchpad.net/juju-core/charm/hooks [no test files]
? launchpad.net/juju-core/charm/testing [no test files]
ok launchpad.net/juju-core/cloudinit 0.028s
ok launchpad.net/juju-core/cloudinit/sshinit 0.876s
ok launchpad.net/juju-core/cmd 0.168s
ok launchpad.net/juju-core/cmd/charm-admin 0.750s
? launchpad.net/juju-core/cmd/charmd [no test files]
? launchpad.net/juju-core/cmd/charmload [no test files]
ok launchpad.net/juju-core/cmd/envcmd 0.173s
ok launchpad.net/juju-core/cmd/juju 211.216s
ok launchpad.net/juju-core/cmd/jujud 68.049s
ok launchpad.net/juju-core/cmd/plugins/juju-metadata 8.855s
? launchpad.net/juju-core/cmd/plugins/juju-restore [no test files]
ok launchpad.net/juju-core/cmd/plugins/local 0.218s
? launchpad.net/juju-core/cmd/plugins/local/juju-local [no test files]
ok launchpad.net/juju-core/constraints 0.022s
ok launchpad.net/juju-core/container 0.042s
ok launchpad.net/juju-core/container/factory 0.035s
ok launchpad.net/juju-core/container/kvm 0.200s
ok launchpad.net/juju-core/container/kvm/mock 0.038s
? launchpad.net/juju-core/container/kvm/testing [no test files]
ok launchpad.net/juju-core/container/lxc 4.282s
? launchpad.net/juju-core/container/lxc/mock [no test files]
? launchpad.net/juju-core/container/lxc/testing [no test files]
? launchpad.net/juju-core/container/testing [no test files]
ok launchpad.net/juju-core/downloader 5.257s
ok launchpad.net/juju-core/environs 2.523s
ok launchpad.net/juju-core/environs/bootstrap 10.527s
ok launchpad.net/juju-core/environs/cloudinit 0.517s
ok launchpad.net/juju-core/environs/config 1.844s
ok launchpad.net/juju-core/environs/configstore 0.041s
ok launchpad.net/juju-core/environs/filestorage 0.031s
ok launchpad.net/juju-core/environs/httpstorage 0.601s
ok launchpad.net/juju-core/environs/imagemetadata 0.445s
? launchpad.net/juju-core/environs/imagemetadata/testing [no test files]
ok launchpad.net/juju-core/environs/instances 0.037s
ok launchpad.net/juju-core/environs/jujutest 0.173s
ok launchpad.net/juju-core/environs/manual 8.851s
ok launchpad.net/juju-core/environs/simplestreams 0.280s
? launchpad.net/juju-core/environs/simplestreams/testing [no test files]
ok launchpad.net/juju-core/environs/sshstorage 0.769s
ok launchpad.net/juju-core/environs/storage 0.766s
ok launchpad.net/juju-core/environs/sync 43.665s
ok launchpad.net/juju-core/environs/testing 0.141s
ok launchpad.net/juju-core/environs/tools 4.729s
? launchpad.net/juju-core/environs/tools/testing [no test files]
ok launchpad.net/juju-core/errors 0.011s
ok launchpad.net/juju-core/instance 0.019s
? ...

=== modified file 'dependencies.tsv'
--- dependencies.tsv	2014-04-02 11:35:49 +0000
+++ dependencies.tsv	2014-04-03 07:35:44 +0000
@@ -16,6 +16,6 @@
 launchpad.net/gomaasapi	bzr	[e-mail]-20140401145548-bcmsw2gic5e576ns	48
 launchpad.net/goose	bzr	tarmac-20140124165235-h9rloooc531udms5	116
 launchpad.net/goyaml	bzr	[e-mail]-20131114120802-abe042syx64z2m7s	50
-launchpad.net/gwacl	bzr	tarmac-20140205045433-81h182mhz24fzp5e	231
+launchpad.net/gwacl	bzr	tarmac-20140312041035-ac7gw7kcqjx7db63	234
 launchpad.net/lpad	bzr	[e-mail]-20120626194701-536yx0g9jdq2ik3h	64
 launchpad.net/tomb	bzr	[e-mail]-20130531003818-70ikdgklbxopn8x4	17

=== modified file 'provider/azure/environ.go'
--- provider/azure/environ.go	2014-04-03 03:37:45 +0000
+++ provider/azure/environ.go	2014-04-03 07:35:44 +0000
@@ -4,8 +4,11 @@
 package azure
 
 import (
+	"encoding/base64"
 	"fmt"
 	"net/http"
+	"regexp"
+	"strings"
 	"sync"
 	"time"
 
@@ -23,16 +26,12 @@
 	"launchpad.net/juju-core/provider/common"
 	"launchpad.net/juju-core/state"
 	"launchpad.net/juju-core/state/api"
+	"launchpad.net/juju-core/state/api/params"
 	"launchpad.net/juju-core/utils"
-	"launchpad.net/juju-core/utils/parallel"
+	"launchpad.net/juju-core/utils/set"
 )
 
 const (
-	// In our initial implementation, each instance gets its own hosted
-	// service, deployment and role in Azure.  The role always gets this
-	// hostname (instance==service).
-	roleHostname = "default"
-
 	// deploymentSlot says in which slot to deploy instances.  Azure
 	// supports 'Production' or 'Staging'.
 	// This provider always deploys to Production.  Think twice about
@@ -48,6 +47,10 @@
 	// environement, in CIDR notation. This is the network used for
 	// machine-to-machine communication.
 	networkDefinition = "10.0.0.0/8"
+
+	// stateServerLabel is the label applied to the cloud service created
+	// for state servers.
+	stateServerLabel = "juju-state-server"
 )
 
 type azureEnviron struct {
@@ -210,14 +213,40 @@
 	return azure.AddVirtualNetworkSite(&virtualNetwork)
 }
 
+// deleteVnetAttempt is an AttemptyStrategy for use
+// when attempting delete a virtual network. This is
+// necessary as Azure apparently does not release all
+// references to the vnet even when all cloud services
+// are deleted.
+var deleteVnetAttempt = utils.AttemptStrategy{
+	Total: 30 * time.Second,
+	Delay: 1 * time.Second,
+}
+
+var networkInUse = regexp.MustCompile(".*The virtual network .* is currently in use.*")
+
 func (env *azureEnviron) deleteVirtualNetwork() error {
 	azure, err := env.getManagementAPI()
 	if err != nil {
 		return err
 	}
 	defer env.releaseManagementAPI(azure)
-	vnetName := env.getVirtualNetworkName()
-	return azure.RemoveVirtualNetworkSite(vnetName)
+	for a := deleteVnetAttempt.Start(); a.Next(); {
+		vnetName := env.getVirtualNetworkName()
+		err = azure.RemoveVirtualNetworkSite(vnetName)
+		if err == nil {
+			return nil
+		}
+		if err, ok := err.(*gwacl.AzureError); ok {
+			if err.StatusCode() == 400 && networkInUse.MatchString(err.Message) {
+				// Retry on "virtual network XYZ is currently in use".
+				continue
+			}
+		}
+		// Any other error should be returned.
+		break
+	}
+	return err
 }
 
 // getContainerName returns the name of the private storage account container
@@ -294,7 +323,7 @@
 // name it chooses (based on the given prefix), but recognizes that the name
 // may not be available.  If the name is not available, it does not treat that
 // as an error but just returns nil.
-func attemptCreateService(azure *gwacl.ManagementAPI, prefix string, affinityGroupName string, location string) (*gwacl.CreateHostedService, error) {
+func attemptCreateService(azure *gwacl.ManagementAPI, prefix, affinityGroupName, label string) (*gwacl.CreateHostedService, error) {
 	var err error
 	name := gwacl.MakeRandomHostedServiceName(prefix)
 	err = azure.CheckHostedServiceNameAvailability(name)
@@ -302,7 +331,10 @@
 		// The calling function should retry.
 		return nil, nil
 	}
-	req := gwacl.NewCreateHostedServiceWithLocation(name, name, location)
+	if label == "" {
+		label = name
+	}
+	req := gwacl.NewCreateHostedServiceWithLocation(name, label, "")
 	req.AffinityGroup = affinityGroupName
 	err = azure.AddHostedService(req)
 	if err != nil {
@@ -313,19 +345,19 @@
 
 // newHostedService creates a hosted service.  It will make up a unique name,
 // starting with the given prefix.
-func newHostedService(azure *gwacl.ManagementAPI, prefix string, affinityGroupName string, location string) (*gwacl.CreateHostedService, error) {
+func newHostedService(azure *gwacl.ManagementAPI, prefix, affinityGroupName, label string) (*gwacl.HostedService, error) {
 	var err error
-	var svc *gwacl.CreateHostedService
-	for tries := 10; tries > 0 && err == nil && svc == nil; tries-- {
-		svc, err = attemptCreateService(azure, prefix, affinityGroupName, location)
+	var createdService *gwacl.CreateHostedService
+	for tries := 10; tries > 0 && err == nil && createdService == nil; tries-- {
+		createdService, err = attemptCreateService(azure, prefix, affinityGroupName, label)
 	}
 	if err != nil {
 		return nil, fmt.Errorf("could not create hosted service: %v", err)
 	}
-	if svc == nil {
+	if createdService == nil {
 		return nil, fmt.Errorf("could not come up with a unique hosted service name - is your randomizer initialized?")
 	}
-	return svc, nil
+	return azure.GetHostedServiceProperties(createdService.ServiceName, true)
 }
 
 // SupportedArchitectures is specified on the EnvironCapability interface.
@@ -385,6 +417,90 @@
 	return spec.InstanceType.Id, spec.Image.Id, nil
 }
 
+// createInstance creates all of the Azure entities necessary for a
+// new instance. This includes Cloud Service, Deployment and Role.
+//
+// If serviceName is non-empty, then createInstance will assign to
+// the Cloud Service with that name. Otherwise, a new Cloud Service
+// will be created.
+func (env *azureEnviron) createInstance(azure *gwacl.ManagementAPI, role *gwacl.Role, serviceName string, stateServer bool) (resultInst instance.Instance, resultErr error) {
+	var inst instance.Instance
+	defer func() {
+		if inst != nil && resultErr != nil {
+			if err := env.StopInstances([]instance.Instance{inst}); err != nil {
+				// Failure upon failure. Log it, but return the original error.
+				logger.Errorf("error releasing failed instance: %v", err)
+			}
+		}
+	}()
+	var err error
+	var service *gwacl.HostedService
+	if serviceName != "" {
+		service, err = azure.GetHostedServiceProperties(serviceName, true)
+	} else {
+		// If we're creating a cloud service for state servers,
+		// we will want to open additional ports. We need to
+		// record this against the cloud service, so we use a
+		// special label for the purpose.
+		var label string
+		if stateServer {
+			label = stateServerLabel
+		}
+		service, err = newHostedService(azure, env.getEnvPrefix(), env.getAffinityGroupName(), label)
+	}
+	if err != nil {
+		return nil, err
+	}
+	if len(service.Deployments) == 0 {
+		// This is a newly created cloud service, so we
+		// should destroy it if anything below fails.
+		defer func() {
+			if resultErr != nil {
+				azure.DeleteHostedService(service.ServiceName)
+				// Destroying the hosted service destroys the instance,
+				// so ensure StopInstances isn't called.
+				inst = nil
+			}
+		}()
+		// Create an initial deployment.
+		deployment := gwacl.NewDeploymentForCreateVMDeployment(
+			deploymentNameV2(service.ServiceName),
+			deploymentSlot,
+			deploymentNameV2(service.ServiceName),
+			[]gwacl.Role{*role},
+			env.getVirtualNetworkName(),
+		)
+		if err := azure.AddDeployment(deployment, service.ServiceName); err != nil {
+			return nil, err
+		}
+		service.Deployments = append(service.Deployments, *deployment)
+	} else {
+		// Update the deployment.
+		deployment := &service.Deployments[0]
+		if err := azure.AddRole(&gwacl.AddRoleRequest{
+			ServiceName:      service.ServiceName,
+			DeploymentName:   deployment.Name,
+			PersistentVMRole: (*gwacl.PersistentVMRole)(role),
+		}); err != nil {
+			return nil, err
+		}
+		deployment.RoleList = append(deployment.RoleList, *role)
+	}
+	return env.getInstance(service, role.RoleName)
+}
+
+// deploymentNameV1 returns the deployment name used
+// in the original implementation of the Azure provider.
+func deploymentNameV1(serviceName string) string {
+	return serviceName
+}
+
+// deploymentNameV2 returns the deployment name used
+// in the current implementation of the Azure provider.
+func deploymentNameV2(serviceName string) string {
+	return serviceName + "-v2"
+}
+
 // StartInstance is specified in the InstanceBroker interface.
 func (env *azureEnviron) StartInstance(args environs.StartInstanceParams) (_ instance.Instance, _ *instance.HardwareCharacteristics, err error) {
 
@@ -417,24 +533,7 @@
 	}
 	defer env.releaseManagementAPI(azure)
 
-	snap := env.getSnapshot()
-	location := snap.ecfg.location()
-	service, err := newHostedService(azure.ManagementAPI, env.getEnvPrefix(), env.getAffinityGroupName(), location)
-	if err != nil {
-		return nil, nil, err
-	}
-	serviceName := service.ServiceName
-
-	// If we fail after this point, clean up the hosted service.
-	defer func() {
-		if err != nil {
-			azure.DestroyHostedService(
-				&gwacl.DestroyHostedServiceRequest{
-					ServiceName: serviceName,
-				})
-		}
-	}()
-
+	location := env.getSnapshot().ecfg.location()
 	instanceType, sourceImageName, err := env.selectInstanceTypeAndImage(&instances.InstanceConstraint{
 		Region:      location,
 		Series:      args.Tools.OneSeries(),
@@ -445,42 +544,38 @@
 		return nil, nil, err
 	}
 
-	// virtualNetworkName is the virtual network to which all the
-	// deployments in this environment belong.
-	virtualNetworkName := env.getVirtualNetworkName()
+	// We use the cloud service label as a way to group instances with
+	// the same affinity, so that machines can be be allocated to the
+	// same availability set.
+	var cloudServiceName string
+	// TODO(axw) replace "false &&" with mode check once
+	// availability-sets-enabled change is landed.
+	if false && args.DistributionGroup != nil {
+		instanceIds, err := args.DistributionGroup()
+		if err != nil {
+			return nil, nil, err
+		}
+		for _, id := range instanceIds {
+			cloudServiceName, _ = env.splitInstanceId(id)
+			if cloudServiceName != "" {
+				break
+			}
+		}
+		logger.Debugf("using existing cloud service: %q", cloudServiceName)
+	}
 
-	// 1. Create an OS Disk.
 	vhd := env.newOSDisk(sourceImageName)
-
-	// 2. Create a Role for a Linux machine.
-	role := env.newRole(instanceType, vhd, userData, roleHostname)
-
-	// 3. Create the Deployment object.
-	deployment := env.newDeployment(role, serviceName, serviceName, virtualNetworkName)
-
-	err = azure.AddDeployment(deployment, serviceName)
-	if err != nil {
-		return nil, nil, err
-	}
-
-	var inst instance.Instance
-
-	// From here on, remember to shut down the instance before returning
-	// any error.
-	defer func() {
-		if err != nil && inst != nil {
-			err2 := env.StopInstances([]instance.Instance{inst})
-			if err2 != nil {
-				// Failure upon failure.  Log it, but return
-				// the original error.
-				logger.Errorf("error releasing failed instance: %v", err)
-			}
+	// If we're creating machine-0, we'll want to expose port 22.
+	// All other machines get an auto-generated public port for SSH.
+	stateServer := false
+	for _, job := range args.MachineConfig.Jobs {
+		if job == params.JobManageEnviron {
+			stateServer = true
+			break
 		}
-	}()
-
-	// Assign the returned instance to 'inst' so that the deferred method
-	// above can perform its check.
-	inst, err = env.getInstance(serviceName)
+	}
+	role := env.newRole(instanceType, vhd, userData, stateServer)
+	inst, err := env.createInstance(azure.ManagementAPI, role, cloudServiceName, stateServer)
 	if err != nil {
 		return nil, nil, err
 	}
@@ -490,17 +585,52 @@
 
 // getInstance returns an up-to-date version of the instance with the given
 // name.
-func (env *azureEnviron) getInstance(instanceName string) (instance.Instance, error) {
-	context, err := env.getManagementAPI()
-	if err != nil {
-		return nil, err
-	}
-	defer env.releaseManagementAPI(context)
-	service, err := context.GetHostedServiceProperties(instanceName, false)
-	if err != nil {
-		return nil, fmt.Errorf("could not get instance %q: %v", instanceName, err)
-	}
-	instance := &azureInstance{service.HostedServiceDescriptor, env}
+func (env *azureEnviron) getInstance(hostedService *gwacl.HostedService, roleName string) (instance.Instance, error) {
+	if n := len(hostedService.Deployments); n != 1 {
+		return nil, fmt.Errorf("expected one deployment for %q, got %d", hostedService.ServiceName, n)
+	}
+	deployment := &hostedService.Deployments[0]
+
+	var maskStateServerPorts bool
+	var instanceId instance.Id
+	switch deployment.Name {
+	case deploymentNameV1(hostedService.ServiceName):
+		// Old style instance.
+		instanceId = instance.Id(hostedService.ServiceName)
+		if n := len(deployment.RoleList); n != 1 {
+			return nil, fmt.Errorf("expected one role for %q, got %d", deployment.Name, n)
+		}
+		roleName = deployment.RoleList[0].RoleName
+		// In the old implementation of the Azure provider,
+		// all machines opened the state and API server ports.
+		maskStateServerPorts = true
+
+	case deploymentNameV2(hostedService.ServiceName):
+		instanceId = instance.Id(fmt.Sprintf("%s-%s", hostedService.ServiceName, roleName))
+		// Newly created state server machines are put into
+		// the cloud service with the stateServerLabel label.
+		if decoded, err := base64.StdEncoding.DecodeString(hostedService.Label); err == nil {
+			maskStateServerPorts = string(decoded) == stateServerLabel
+		}
+	}
+
+	var roleInstance *gwacl.RoleInstance
+	for _, role := range deployment.RoleInstanceList {
+		if role.RoleName == roleName {
+			roleInstance = &role
+			break
+		}
+	}
+
+	instance := &azureInstance{
+		environ:              env,
+		hostedService:        &hostedService.HostedServiceDescriptor,
+		instanceId:           instanceId,
+		deploymentName:       deployment.Name,
+		roleName:             roleName,
+		roleInstance:         roleInstance,
+		maskStateServerPorts: maskStateServerPorts,
+	}
 	return instance, nil
 }
 
@@ -519,29 +649,40 @@
 
 // getInitialEndpoints returns a slice of the endpoints every instance should have open
 // (ssh port, etc).
-func (env *azureEnviron) getInitialEndpoints() []gwacl.InputEndpoint {
+func (env *azureEnviron) getInitialEndpoints(stateServer bool) []gwacl.InputEndpoint {
+	// TODO(axw) either proxy ssh traffic through one of the
+	// randomly chosen VMs to the internal address, or otherwise
+	// don't load balance SSH and provide a way of getting the
+	// local port.
 	cfg := env.Config()
-	return []gwacl.InputEndpoint{
-		{
-			LocalPort: 22,
-			Name:      "sshport",
-			Port:      22,
-			Protocol:  "tcp",
-		},
-		// TODO: Ought to have this only for state servers.
-		{
+	endpoints := []gwacl.InputEndpoint{{
+		LocalPort: 22,
+		Name:      "sshport",
+		Port:      22,
+		Protocol:  "tcp",
+	}}
+	if stateServer {
+		endpoints = append(endpoints, []gwacl.InputEndpoint{{
 			LocalPort: cfg.StatePort(),
+			Port:      cfg.StatePort(),
+			Protocol:  "tcp",
 			Name:      "stateport",
-			Port:      cfg.StatePort(),
-			Protocol:  "tcp",
-		},
-		// TODO: Ought to have this only for API servers.
-		{
+		}, {
 			LocalPort: cfg.APIPort(),
+			Port:      cfg.APIPort(),
+			Protocol:  "tcp",
 			Name:      "apiport",
-			Port:      cfg.APIPort(),
-			Protocol:  "tcp",
-		}}
+		}}...)
+	}
+	for i, endpoint := range endpoints {
+		endpoint.LoadBalancedEndpointSetName = endpoint.Name
+		endpoint.LoadBalancerProbe = &gwacl.LoadBalancerProbe{
+			Port:     endpoint.Port,
+			Protocol: "TCP",
+		}
+		endpoints[i] = endpoint
+	}
+	return endpoints
 }
 
 // newRole creates a gwacl.Role object (an Azure Virtual Machine) which uses
@@ -550,101 +691,204 @@
 // The VM will have:
 // - an 'ubuntu' user defined with an unguessable (randomly generated) password
 // - its ssh port (TCP 22) open
+// (if a state server)
 // - its state port (TCP mongoDB) port open
 // - its API port (TCP) open
 //
 // roleSize is the name of one of Azure's machine types, e.g. ExtraSmall,
 // Large, A6 etc.
-func (env *azureEnviron) newRole(roleSize string, vhd *gwacl.OSVirtualHardDisk, userData string, roleHostname string) *gwacl.Role {
+func (env *azureEnviron) newRole(roleSize string, vhd *gwacl.OSVirtualHardDisk, userData string, stateServer bool) *gwacl.Role {
+	roleName := gwacl.MakeRandomRoleName("juju")
 	// Create a Linux Configuration with the username and the password
 	// empty and disable SSH with password authentication.
-	hostname := roleHostname
+	hostname := roleName
 	username := "ubuntu"
 	password := gwacl.MakeRandomPassword()
 	linuxConfigurationSet := gwacl.NewLinuxProvisioningConfigurationSet(hostname, username, password, userData, "true")
-	// Generate a Network Configuration with the initially required ports
-	// open.
-	networkConfigurationSet := gwacl.NewNetworkConfigurationSet(env.getInitialEndpoints(), nil)
-	roleName := gwacl.MakeRandomRoleName("juju")
-	// The ordering of these configuration sets is significant for the tests.
-	return gwacl.NewRole(
-		roleSize, roleName,
+	// Generate a Network Configuration with the initially required ports open.
+	networkConfigurationSet := gwacl.NewNetworkConfigurationSet(env.getInitialEndpoints(stateServer), nil)
+	role := gwacl.NewRole(
+		roleSize, roleName, vhd,
 		[]gwacl.ConfigurationSet{*linuxConfigurationSet, *networkConfigurationSet},
-		[]gwacl.OSVirtualHardDisk{*vhd})
-}
-
-// newDeployment creates and returns a gwacl Deployment object.
-func (env *azureEnviron) newDeployment(role *gwacl.Role, deploymentName string, deploymentLabel string, virtualNetworkName string) *gwacl.Deployment {
-	// Use the service name as the label for the deployment.
-	return gwacl.NewDeploymentForCreateVMDeployment(deploymentName, deploymentSlot, deploymentLabel, []gwacl.Role{*role}, virtualNetworkName)
-}
-
-// Spawn this many goroutines to issue requests for destroying services.
-// TODO: this is currently set to 1 because of a problem in Azure:
-// removing Services in the same affinity group concurrently causes a conflict.
-// This conflict is wrongly reported by Azure as a BadRequest (400).
-// This has been reported to Windows Azure.
-var maxConcurrentDeletes = 1
+	)
+	role.AvailabilitySetName = "juju"
+	return role
+}
 
 // StartInstance is specified in the InstanceBroker interface.
 func (env *azureEnviron) StopInstances(instances []instance.Instance) error {
-	// Each Juju instance is an Azure Service (instance==service), destroy
-	// all the Azure services.
-	// Acquire management API object.
 	context, err := env.getManagementAPI()
 	if err != nil {
 		return err
 	}
 	defer env.releaseManagementAPI(context)
 
-	// Destroy all the services in parallel.
-	run := parallel.NewRun(maxConcurrentDeletes)
+	// Map services to role names we want to delete.
+	serviceInstances := make(map[string]map[string]bool)
 	for _, instance := range instances {
-		serviceName := string(instance.Id())
-		run.Do(func() error {
-			request := &gwacl.DestroyHostedServiceRequest{ServiceName: serviceName}
-			return context.DestroyHostedService(request)
-		})
-	}
-	return run.Wait()
+		instance, ok := instance.(*azureInstance)
+		if !ok {
+			continue
+		}
+		serviceName := instance.hostedService.ServiceName
+		deleteRoleNames, ok := serviceInstances[serviceName]
+		if !ok {
+			deleteRoleNames = make(map[string]bool)
+			serviceInstances[serviceName] = deleteRoleNames
+		}
+		deleteRoleNames[instance.roleName] = true
+	}
+
+	// Load the properties of each service, so we know whether to
+	// delete the entire service.
+	//
+	// Note: concurrent operations on Affinity Groups have been
+	// found to cause conflict responses, so we do everything serially.
+	for serviceName, deleteRoleNames := range serviceInstances {
+		service, err := context.GetHostedServiceProperties(serviceName, true)
+		if err != nil {
+			return err
+		} else if len(service.Deployments) != 1 {
+			continue
+		}
+		// Filter the instances that have no corresponding role.
+		var roleNames set.Strings
+		for _, role := range service.Deployments[0].RoleList {
+			roleNames.Add(role.RoleName)
+		}
+		for roleName := range deleteRoleNames {
+			if !roleNames.Contains(roleName) {
+				delete(deleteRoleNames, roleName)
+			}
+		}
+		// If we're deleting all the roles, we need to delete the
+		// entire cloud service or we'll get an error.
+		if len(deleteRoleNames) == roleNames.Size() {
+			if err := context.DeleteHostedService(serviceName); err != nil {
+				return err
+			}
+		} else {
+			for roleName := range deleteRoleNames {
+				if err := context.DeleteRole(&gwacl.DeleteRoleRequest{
+					ServiceName:    serviceName,
+					DeploymentName: service.Deployments[0].Name,
+					RoleName:       roleName,
+					DeleteMedia:    true,
+				}); err != nil {
+					return err
+				}
+			}
+		}
+	}
+	return nil
+}
+
+// destroyAllServices destroys all Cloud Services and deployments contained.
+// This is needed to clean up broken environments, in which there are cloud
+// services with no deployments.
+func (env *azureEnviron) destroyAllServices() error {
+	context, err := env.getManagementAPI()
+	if err != nil {
+		return err
+	}
+	defer env.releaseManagementAPI(context)
+
+	request := &gwacl.ListPrefixedHostedServicesRequest{ServiceNamePrefix: env.getEnvPrefix()}
+	services, err := context.ListPrefixedHostedServices(request)
+	if err != nil {
+		return err
+	}
+	for _, service := range services {
+		if err := context.DeleteHostedService(service.ServiceName); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// splitInstanceId splits the specified instance.Id into its
+// cloud-service and role parts. Both values will be empty
+// if the instance-id is non-matching, and role will be empty
+// for legacy instance-ids.
+func (env *azureEnviron) splitInstanceId(id instance.Id) (service, role string) {
+	prefix := env.getEnvPrefix()
+	if !strings.HasPrefix(string(id), prefix) {
+		return "", ""
+	}
+	fields := strings.Split(string(id)[len(prefix):], "-")
+	service = prefix + fields[0]
+	if len(fields) > 1 {
+		role = fields[1]
+	}
+	return service, role
 }
 
 // Instances is specified in the Environ interface.
 func (env *azureEnviron) Instances(ids []instance.Id) ([]instance.Instance, error) {
-	// The instance list is built using the list of all the relevant
-	// Azure Services (instance==service).
-	// Acquire management API object.
 	context, err := env.getManagementAPI()
 	if err != nil {
 		return nil, err
 	}
 	defer env.releaseManagementAPI(context)
 
-	// Prepare gwacl request object.
-	serviceNames := make([]string, len(ids))
+	type instanceId struct {
+		serviceName, roleName string
+	}
+
+	instancesIds := make([]instanceId, len(ids))
+	var serviceNames set.Strings
 	for i, id := range ids {
-		serviceNames[i] = string(id)
+		serviceName, roleName := env.splitInstanceId(id)
+		if serviceName == "" {
+			continue
+		}
+		instancesIds[i] = instanceId{
+			serviceName: serviceName,
+			roleName:    roleName,
+		}
+		serviceNames.Add(serviceName)
 	}
-	request := &gwacl.ListSpecificHostedServicesRequest{ServiceNames: serviceNames}
 
-	// Issue 'ListSpecificHostedServices' request with gwacl.
-	services, err := context.ListSpecificHostedServices(request)
+	// Map service names to gwacl.HostedServices.
+	services, err := context.ListSpecificHostedServices(&gwacl.ListSpecificHostedServicesRequest{
+		ServiceNames: serviceNames.Values(),
+	})
 	if err != nil {
 		return nil, err
 	}
-
-	// If no instances were found, return ErrNoInstances.
 	if len(services) == 0 {
 		return nil, environs.ErrNoInstances
 	}
-
-	instances := convertToInstances(services, env)
-
-	// Check if we got a partial result.
-	if len(ids) != len(instances) {
-		return instances, environs.ErrPartialInstances
-	}
-	return instances, nil
+	hostedServices := make(map[string]*gwacl.HostedService)
+	for _, s := range services {
+		hostedService, err := context.GetHostedServiceProperties(s.ServiceName, true)
+		if err != nil {
+			return nil, err
+		}
+		hostedServices[s.ServiceName] = hostedService
+	}
+
+	err = nil
+	instances := make([]instance.Instance, len(ids))
+	for i, id := range instancesIds {
+		if id.serviceName == "" {
+			// Previously determined to be an invalid instance ID.
+			continue
+		}
+		hostedService := hostedServices[id.serviceName]
+		instance, err := env.getInstance(hostedService, id.roleName)
+		if err == nil {
+			instances[i] = instance
+		} else {
+			logger.Debugf("failed to get instance for role %q in service %q: %v", id.roleName, hostedService.ServiceName, err)
+		}
+	}
+	for _, instance := range instances {
+		if instance == nil {
+			err = environs.ErrPartialInstances
+		}
+	}
+	return instances, err
 }
 
 // AllInstances is specified in the InstanceBroker interface.
@@ -659,11 +903,29 @@
 	defer env.releaseManagementAPI(context)
 
 	request := &gwacl.ListPrefixedHostedServicesRequest{ServiceNamePrefix: env.getEnvPrefix()}
-	services, err := context.ListPrefixedHostedServices(request)
+	serviceDescriptors, err := context.ListPrefixedHostedServices(request)
 	if err != nil {
 		return nil, err
 	}
-	return convertToInstances(services, env), nil
+
+	var instances []instance.Instance
+	for _, sd := range serviceDescriptors {
+		hostedService, err := context.GetHostedServiceProperties(sd.ServiceName, true)
+		if err != nil {
+			return nil, err
+		} else if len(hostedService.Deployments) != 1 {
+			continue
+		}
+		deployment := &hostedService.Deployments[0]
+		for _, role := range deployment.RoleList {
+			instance, err := env.getInstance(hostedService, role.RoleName)
+			if err != nil {
+				return nil, err
+			}
+			instances = append(instances, instance)
+		}
+	}
+	return instances, nil
 }
 
 // getEnvPrefix returns the prefix used to name the objects specific to this
@@ -672,16 +934,6 @@
 	return fmt.Sprintf("juju-%s-", env.Name())
 }
 
-// convertToInstances converts a slice of gwacl.HostedServiceDescriptor objects
-// into a slice of instance.Instance objects.
-func convertToInstances(services []gwacl.HostedServiceDescriptor, env *azureEnviron) []instance.Instance {
-	instances := make([]instance.Instance, len(services))
-	for i, service := range services {
-		instances[i] = &azureInstance{service, env}
-	}
-	return instances
-}
-
 // Storage is specified in the Environ interface.
 func (env *azureEnviron) Storage() storage.Storage {
 	return env.getSnapshot().storage
@@ -692,22 +944,15 @@
 	logger.Debugf("destroying environment %q", env.name)
 
 	// Stop all instances.
-	insts, err := env.AllInstances()
-	if err != nil {
-		return fmt.Errorf("cannot get instances: %v", err)
-	}
-	err = env.StopInstances(insts)
-	if err != nil {
-		return fmt.Errorf("cannot stop instances: %v", err)
+	if err := env.destroyAllServices(); err != nil {
+		return fmt.Errorf("cannot destroy instances: %v", err)
 	}
 
 	// Delete vnet and affinity group.
-	err = env.deleteVirtualNetwork()
-	if err != nil {
+	if err := env.deleteVirtualNetwork(); err != nil {
 		return fmt.Errorf("cannot delete the environment's virtual network: %v", err)
 	}
-	err = env.deleteAffinityGroup()
-	if err != nil {
+	if err := env.deleteAffinityGroup(); err != nil {
 		return fmt.Errorf("cannot delete the environment's affinity group: %v", err)
 	}
 
@@ -716,8 +961,7 @@
 	// half way through the Destroy() method, the storage won't be cleaned
 	// up and thus an attempt to re-boostrap the environment will lead to
 	// a "error: environment is already bootstrapped" error.
-	err = env.Storage().RemoveAll()
-	if err != nil {
+	if err := env.Storage().RemoveAll(); err != nil {
 		return fmt.Errorf("cannot clean up storage: %v", err)
 	}
 	return nil

=== modified file 'provider/azure/environ_test.go'
--- provider/azure/environ_test.go	2014-03-28 13:27:45 +0000
+++ provider/azure/environ_test.go	2014-04-03 07:35:44 +0000
@@ -144,7 +144,7 @@
 	// The real test is that this does not panic.
 }
 
-func getAzureServiceListResponse(c *gc.C, services []gwacl.HostedServiceDescriptor) []gwacl.DispatcherResponse {
+func getAzureServiceListResponse(c *gc.C, services ...gwacl.HostedServiceDescriptor) []gwacl.DispatcherResponse {
 	list := gwacl.HostedServiceDescriptorList{HostedServices: services}
 	listXML, err := list.Serialize()
 	c.Assert(err, gc.IsNil)
@@ -156,22 +156,34 @@
 	return responses
 }
 
-// getAzureServiceResponses returns the slice of responses
-// (gwacl.DispatcherResponse) which correspond to the API requests used to
-// get the properties of a Service.
-func getAzureServiceResponses(c *gc.C, service gwacl.HostedService) []gwacl.DispatcherResponse {
+// getAzureServiceResponses returns a gwacl.DispatcherResponse corresponding
+// to the API request used to get the properties of a Service.
+func getAzureServiceResponse(c *gc.C, service gwacl.HostedService) gwacl.DispatcherResponse {
 	serviceXML, err := service.Serialize()
 	c.Assert(err, gc.IsNil)
-	responses := []gwacl.DispatcherResponse{gwacl.NewDispatcherResponse(
-		[]byte(serviceXML),
-		http.StatusOK,
-		nil,
-	)}
-	return responses
+	return gwacl.NewDispatcherResponse([]byte(serviceXML), http.StatusOK, nil)
 }
 
 func patchWithServiceListResponse(c *gc.C, services []gwacl.HostedServiceDescriptor) *[]*gwacl.X509Request {
-	responses := getAzureServiceListResponse(c, services)
+	responses := getAzureServiceListResponse(c, services...)
+	return gwacl.PatchManagementAPIResponses(responses)
+}
+
+func patchInstancesResponses(c *gc.C, prefix string, services ...*gwacl.HostedService) *[]*gwacl.X509Request {
+	descriptors := make([]gwacl.HostedServiceDescriptor, len(services))
+	for i, service := range services {
+		descriptors[i] = service.HostedServiceDescriptor
+	}
+	responses := getAzureServiceListResponse(c, descriptors...)
+	for _, service := range services {
+		if !strings.HasPrefix(service.ServiceName, prefix) {
+			continue
+		}
+		serviceXML, err := service.Serialize()
+		c.Assert(err, gc.IsNil)
+		serviceGetResponse := gwacl.NewDispatcherResponse([]byte(serviceXML), http.StatusOK, nil)
+		responses = append(responses, serviceGetResponse)
+	}
 	return gwacl.PatchManagementAPIResponses(responses)
 }
 
@@ -201,25 +213,34 @@
 func (suite *environSuite) TestAllInstances(c *gc.C) {
 	env := makeEnviron(c)
 	prefix := env.getEnvPrefix()
-	services := []gwacl.HostedServiceDescriptor{{ServiceName: "deployment-in-another-env"}, {ServiceName: prefix + "deployment-1"}, {ServiceName: prefix + "deployment-2"}}
-	requests := patchWithServiceListResponse(c, services)
+	service1 := makeLegacyDeployment(env, prefix+"service1")
+	service2 := makeDeployment(env, prefix+"service2")
+	service3 := makeDeployment(env, "not"+prefix+"service3")
+
+	requests := patchInstancesResponses(c, prefix, service1, service2, service3)
 	instances, err := env.AllInstances()
 	c.Assert(err, gc.IsNil)
-	c.Check(len(instances), gc.Equals, 2)
-	c.Check(instances[0].Id(), gc.Equals, instance.Id(prefix+"deployment-1"))
-	c.Check(instances[1].Id(), gc.Equals, instance.Id(prefix+"deployment-2"))
-	c.Check(len(*requests), gc.Equals, 1)
+	c.Check(len(instances), gc.Equals, 3)
+	c.Check(instances[0].Id(), gc.Equals, instance.Id(prefix+"service1"))
+	service2Role1Name := service2.Deployments[0].RoleList[0].RoleName
+	service2Role2Name := service2.Deployments[0].RoleList[1].RoleName
+	c.Check(instances[1].Id(), gc.Equals, instance.Id(prefix+"service2-"+service2Role1Name))
+	c.Check(instances[2].Id(), gc.Equals, instance.Id(prefix+"service2-"+service2Role2Name))
+	c.Check(len(*requests), gc.Equals, 3)
 }
 
 func (suite *environSuite) TestInstancesReturnsFilteredList(c *gc.C) {
-	services := []gwacl.HostedServiceDescriptor{{ServiceName: "deployment-1"}, {ServiceName: "deployment-2"}}
-	requests := patchWithServiceListResponse(c, services)
 	env := makeEnviron(c)
-	instances, err := env.Instances([]instance.Id{"deployment-1"})
+	prefix := env.getEnvPrefix()
+	service := makeDeployment(env, prefix+"service")
+	requests := patchInstancesResponses(c, prefix, service)
+	role1Name := service.Deployments[0].RoleList[0].RoleName
+	instId := instance.Id(prefix + "service-" + role1Name)
+	instances, err := env.Instances([]instance.Id{instId})
 	c.Assert(err, gc.IsNil)
 	c.Check(len(instances), gc.Equals, 1)
-	c.Check(instances[0].Id(), gc.Equals, instance.Id("deployment-1"))
-	c.Check(len(*requests), gc.Equals, 1)
+	c.Check(instances[0].Id(), gc.Equals, instId)
+	c.Check(len(*requests), gc.Equals, 2)
 }
 
 func (suite *environSuite) TestInstancesReturnsErrNoInstancesIfNoInstancesRequested(c *gc.C) {
@@ -241,14 +262,22 @@
 }
 
 func (suite *environSuite) TestInstancesReturnsPartialInstancesIfSomeInstancesAreNotFound(c *gc.C) {
-	services := []gwacl.HostedServiceDescriptor{{ServiceName: "deployment-1"}, {ServiceName: "deployment-2"}}
-	requests := patchWithServiceListResponse(c, services)
 	env := makeEnviron(c)
-	instances, err := env.Instances([]instance.Id{"deployment-1", "unknown-deployment"})
+	prefix := env.getEnvPrefix()
+	service := makeDeployment(env, prefix+"service")
+
+	role1Name := service.Deployments[0].RoleList[0].RoleName
+	role2Name := service.Deployments[0].RoleList[1].RoleName
+	inst1Id := instance.Id(prefix + "service-" + role1Name)
+	inst2Id := instance.Id(prefix + "service-" + role2Name)
+	patchInstancesResponses(c, prefix, service)
+
+	instances, err := env.Instances([]instance.Id{inst1Id, "unknown", inst2Id})
 	c.Assert(err, gc.Equals, environs.ErrPartialInstances)
-	c.Check(len(instances), gc.Equals, 1)
-	c.Check(instances[0].Id(), gc.Equals, instance.Id("deployment-1"))
-	c.Check(len(*requests), gc.Equals, 1)
+	c.Check(len(instances), gc.Equals, 3)
+	c.Check(instances[0].Id(), gc.Equals, inst1Id)
+	c.Check(instances[1], gc.IsNil)
+	c.Check(instances[2].Id(), gc.Equals, inst2Id)
 }
 
 func (*environSuite) TestStorage(c *gc.C) {
@@ -470,22 +499,23 @@
 }
 
 func (s *environSuite) TestStateInfo(c *gc.C) {
-	instanceID := "my-instance"
-	patchWithServiceListResponse(c, []gwacl.HostedServiceDescriptor{{
-		ServiceName: instanceID,
-	}})
 	env := makeEnviron(c)
 	s.setDummyStorage(c, env)
+	prefix := env.getEnvPrefix()
+
+	service := makeDeployment(env, prefix+"myservice")
+	instId := instance.Id(service.ServiceName + "-" + service.Deployments[0].RoleList[0].RoleName)
+	patchInstancesResponses(c, prefix, service)
 	err := bootstrap.SaveState(
 		env.Storage(),
-		&bootstrap.BootstrapState{StateInstances: []instance.Id{instance.Id(instanceID)}})
+		&bootstrap.BootstrapState{StateInstances: []instance.Id{instId}},
+	)
 	c.Assert(err, gc.IsNil)
 
 	stateInfo, apiInfo, err := env.StateInfo()
 	c.Assert(err, gc.IsNil)
-
 	config := env.Config()
-	dnsName := "my-instance." + AZURE_DOMAIN_NAME
+	dnsName := prefix + "myservice." + AZURE_DOMAIN_NAME
 	stateServerAddr := fmt.Sprintf("%s:%d", dnsName, config.StatePort())
 	apiServerAddr := fmt.Sprintf("%s:%d", dnsName, config.APIPort())
 	c.Check(stateInfo.Addrs, gc.DeepEquals, []string{stateServerAddr})
@@ -502,6 +532,14 @@
 	return &body
 }
 
+// getHostedServicePropertiesServiceName extracts the service name parameter
+// from the GetHostedServiceProperties request URL.
+func getHostedServicePropertiesServiceName(c *gc.C, request *gwacl.X509Request) string {
+	url, err := url.Parse(request.URL)
+	c.Assert(err, gc.IsNil)
+	return path.Base(url.Path)
+}
+
 // makeNonAvailabilityResponse simulates a reply to the
 // CheckHostedServiceNameAvailability call saying that a name is not available.
 func makeNonAvailabilityResponse(c *gc.C) []byte {
@@ -524,7 +562,7 @@
 func (*environSuite) TestAttemptCreateServiceCreatesService(c *gc.C) {
 	prefix := "myservice"
 	affinityGroup := "affinity-group"
-	location := "location"
+
 	responses := []gwacl.DispatcherResponse{
 		gwacl.NewDispatcherResponse(makeAvailabilityResponse(c), http.StatusOK, nil),
 		gwacl.NewDispatcherResponse(nil, http.StatusOK, nil),
@@ -533,7 +571,7 @@
 	azure, err := gwacl.NewManagementAPI("subscription", "", "West US")
 	c.Assert(err, gc.IsNil)
 
-	service, err := attemptCreateService(azure, prefix, affinityGroup, location)
+	service, err := attemptCreateService(azure, prefix, affinityGroup, "")
 	c.Assert(err, gc.IsNil)
 
 	c.Assert(*requests, gc.HasLen, 2)
@@ -541,11 +579,8 @@
 	c.Check(body.ServiceName, gc.Equals, service.ServiceName)
 	c.Check(body.AffinityGroup, gc.Equals, affinityGroup)
 	c.Check(service.ServiceName, gc.Matches, prefix+".*")
-	c.Check(service.Location, gc.Equals, location)
-
-	label, err := base64.StdEncoding.DecodeString(service.Label)
-	c.Assert(err, gc.IsNil)
-	c.Check(string(label), gc.Equals, service.ServiceName)
+	// We specify AffinityGroup, so Location should be empty.
+	c.Check(service.Location, gc.Equals, "")
 }
 
 func (*environSuite) TestAttemptCreateServiceReturnsNilIfNameNotUnique(c *gc.C) {
@@ -556,7 +591,7 @@
 	azure, err := gwacl.NewManagementAPI("subscription", "", "West US")
 	c.Assert(err, gc.IsNil)
 
-	service, err := attemptCreateService(azure, "service", "affinity-group", "location")
+	service, err := attemptCreateService(azure, "service", "affinity-group", "")
 	c.Check(err, gc.IsNil)
 	c.Check(service, gc.IsNil)
 }
@@ -570,7 +605,7 @@
 	azure, err := gwacl.NewManagementAPI("subscription", "", "West US")
 	c.Assert(err, gc.IsNil)
 
-	_, err = attemptCreateService(azure, "service", "affinity-group", "location")
+	_, err = attemptCreateService(azure, "service", "affinity-group", "")
 	c.Assert(err, gc.NotNil)
 	c.Check(err, gc.ErrorMatches, ".*Not Found.*")
 }
@@ -578,24 +613,30 @@
 func (*environSuite) TestNewHostedServiceCreatesService(c *gc.C) {
 	prefix := "myservice"
 	affinityGroup := "affinity-group"
-	location := "location"
 	responses := []gwacl.DispatcherResponse{
 		gwacl.NewDispatcherResponse(makeAvailabilityResponse(c), http.StatusOK, nil),
 		gwacl.NewDispatcherResponse(nil, http.StatusOK, nil),
+		getAzureServiceResponse(c, gwacl.HostedService{
+			HostedServiceDescriptor: gwacl.HostedServiceDescriptor{
+				ServiceName: "anything",
+			},
+		}),
 	}
 	requests := gwacl.PatchManagementAPIResponses(responses)
 	azure, err := gwacl.NewManagementAPI("subscription", "", "West US")
 	c.Assert(err, gc.IsNil)
 
-	service, err := newHostedService(azure, prefix, affinityGroup, location)
+	service, err := newHostedService(azure, prefix, affinityGroup, "")
 	c.Assert(err, gc.IsNil)
 
-	c.Assert(*requests, gc.HasLen, 2)
+	c.Assert(*requests, gc.HasLen, 3)
 	body := parseCreateServiceRequest(c, (*requests)[1])
-	c.Check(body.ServiceName, gc.Equals, service.ServiceName)
+	requestedServiceName := getHostedServicePropertiesServiceName(c, (*requests)[2])
+	c.Check(body.ServiceName, gc.Matches, prefix+".*")
+	c.Check(body.ServiceName, gc.Equals, requestedServiceName)
 	c.Check(body.AffinityGroup, gc.Equals, affinityGroup)
-	c.Check(service.ServiceName, gc.Matches, prefix+".*")
-	c.Check(service.Location, gc.Equals, location)
+	c.Check(service.ServiceName, gc.Equals, "anything")
+	c.Check(service.Location, gc.Equals, "")
 }
 
 func (*environSuite) TestNewHostedServiceRetriesIfNotUnique(c *gc.C) {
@@ -606,17 +647,22 @@
 	responses := []gwacl.DispatcherResponse{
 		gwacl.NewDispatcherResponse(errorBody, http.StatusOK, nil),
 		gwacl.NewDispatcherResponse(errorBody, http.StatusOK, nil),
-		gwacl.NewDispatcherResponse(okBody, http.StatusOK, nil),
-		gwacl.NewDispatcherResponse(nil, http.StatusOK, nil),
+		gwacl.NewDispatcherResponse(okBody, http.StatusOK, nil), // name is unique
+		gwacl.NewDispatcherResponse(nil, http.StatusOK, nil),    // create service
+		getAzureServiceResponse(c, gwacl.HostedService{
+			HostedServiceDescriptor: gwacl.HostedServiceDescriptor{
+				ServiceName: "anything",
+			},
+		}),
 	}
 	requests := gwacl.PatchManagementAPIResponses(responses)
 	azure, err := gwacl.NewManagementAPI("subscription", "", "West US")
 	c.Assert(err, gc.IsNil)
 
-	service, err := newHostedService(azure, "service", "affinity-group", "location")
+	service, err := newHostedService(azure, "service", "affinity-group", "")
 	c.Check(err, gc.IsNil)
 
-	c.Assert(*requests, gc.HasLen, 4)
+	c.Assert(*requests, gc.HasLen, 5)
 	// How many names have been attempted, and how often?
 	// There is a minute chance that this tries the same name twice, and
 	// then this test will fail.  If that happens, try seeding the
@@ -637,11 +683,8 @@
 	c.Check(attemptedNames, gc.HasLen, 3)
 
 	// Once newHostedService succeeds, we get a hosted service with the
-	// last requested name.
-	c.Check(
-		service.ServiceName,
-		gc.Equals,
-		parseCreateServiceRequest(c, (*requests)[3]).ServiceName)
+	// name returned from GetHostedServiceProperties.
+	c.Check(service.ServiceName, gc.Equals, "anything")
 }
 
 func (*environSuite) TestNewHostedServiceFailsIfUnableToFindUniqueName(c *gc.C) {
@@ -654,128 +697,142 @@
 	azure, err := gwacl.NewManagementAPI("subscription", "", "West US")
 	c.Assert(err, gc.IsNil)
 
-	_, err = newHostedService(azure, "service", "affinity-group", "location")
+	_, err = newHostedService(azure, "service", "affinity-group", "")
 	c.Assert(err, gc.NotNil)
 	c.Check(err, gc.ErrorMatches, "could not come up with a unique hosted service name.*")
 }
 
-// buildDestroyAzureServiceResponses returns a slice containing the responses that a fake Azure server
-// can use to simulate the deletion of the given list of services.
-func buildDestroyAzureServiceResponses(c *gc.C, services []*gwacl.HostedService) []gwacl.DispatcherResponse {
-	responses := []gwacl.DispatcherResponse{}
-	for _, service := range services {
-		// When destroying a hosted service, gwacl first issues a Get request
-		// to fetch the properties of the services.  Then it destroys all the
-		// deployments found in this service (none in this case, we make sure
-		// the service does not contain deployments to keep the testing simple)
-		// And it finally deletes the service itself.
-		if len(service.Deployments) != 0 {
-			panic("buildDestroyAzureServiceResponses does not support services with deployments!")
-		}
+func buildGetServicePropertiesResponses(c *gc.C, services ...*gwacl.HostedService) []gwacl.DispatcherResponse {
+	responses := make([]gwacl.DispatcherResponse, len(services))
+	for i, service := range services {
 		serviceXML, err := service.Serialize()
 		c.Assert(err, gc.IsNil)
-		serviceGetResponse := gwacl.NewDispatcherResponse(
-			[]byte(serviceXML),
-			http.StatusOK,
-			nil,
-		)
-		responses = append(responses, serviceGetResponse)
-		serviceDeleteResponse := gwacl.NewDispatcherResponse(
-			nil,
-			http.StatusOK,
-			nil,
-		)
-		responses = append(responses, serviceDeleteResponse)
-	}
-	return responses
-}
-
-func makeAzureService(name string) (*gwacl.HostedService, *gwacl.HostedServiceDescriptor) {
-	service1Desc := &gwacl.HostedServiceDescriptor{ServiceName: name}
-	service1 := &gwacl.HostedService{HostedServiceDescriptor: *service1Desc}
-	return service1, service1Desc
-}
-
-func (s *environSuite) setServiceDeletionConcurrency(nbGoroutines int) {
-	s.PatchValue(&maxConcurrentDeletes, nbGoroutines)
+		responses[i] = gwacl.NewDispatcherResponse([]byte(serviceXML), http.StatusOK, nil)
+	}
+	return responses
+}
+
+func buildStatusOKResponses(c *gc.C, n int) []gwacl.DispatcherResponse {
+	responses := make([]gwacl.DispatcherResponse, n)
+	for i := range responses {
+		responses[i] = gwacl.NewDispatcherResponse(nil, http.StatusOK, nil)
+	}
+	return responses
+}
+
+func makeAzureService(name string) *gwacl.HostedService {
+	return &gwacl.HostedService{
+		HostedServiceDescriptor: gwacl.HostedServiceDescriptor{ServiceName: name},
+	}
+}
+
+func makeRole(env *azureEnviron) *gwacl.Role {
+	size := "Large"
+	vhd := env.newOSDisk("source-image-name")
+	userData := "example-user-data"
+	return env.newRole(size, vhd, userData, false)
+}
+
+func makeLegacyDeployment(env *azureEnviron, serviceName string) *gwacl.HostedService {
+	service := makeAzureService(serviceName)
+	service.Deployments = []gwacl.Deployment{{
+		Name:     serviceName,
+		RoleList: []gwacl.Role{*makeRole(env)},
+	}}
+	return service
+}
+
+func makeDeployment(env *azureEnviron, serviceName string) *gwacl.HostedService {
+	service := makeAzureService(serviceName)
+	service.Deployments = []gwacl.Deployment{{
+		Name:     serviceName + "-v2",
+		RoleList: []gwacl.Role{*makeRole(env), *makeRole(env)},
+	}}
+	return service
 }
 
 func (s *environSuite) TestStopInstancesDestroysMachines(c *gc.C) {
-	s.setServiceDeletionConcurrency(3)
+	env := makeEnviron(c)
 	service1Name := "service1"
-	service1, service1Desc := makeAzureService(service1Name)
+	service1 := makeLegacyDeployment(env, service1Name)
 	service2Name := "service2"
-	service2, service2Desc := makeAzureService(service2Name)
-	services := []*gwacl.HostedService{service1, service2}
-	responses := buildDestroyAzureServiceResponses(c, services)
+	service2 := makeDeployment(env, service2Name)
+
+	inst1, err := env.getInstance(service1, "")
+	c.Assert(err, gc.IsNil)
+	role2Name := service2.Deployments[0].RoleList[0].RoleName
+	inst2, err := env.getInstance(service2, role2Name)
+	c.Assert(err, gc.IsNil)
+	role3Name := service2.Deployments[0].RoleList[1].RoleName
+	inst3, err := env.getInstance(service2, role3Name)
+	c.Assert(err, gc.IsNil)
+
+	responses := buildGetServicePropertiesResponses(c, service1)
+	responses = append(responses, buildStatusOKResponses(c, 1)...) // DeleteHostedService
+	responses = append(responses, buildGetServicePropertiesResponses(c, service2)...)
+	responses = append(responses, buildStatusOKResponses(c, 1)...) // DeleteHostedService
 	requests := gwacl.PatchManagementAPIResponses(responses)
-	env := makeEnviron(c)
-	instances := convertToInstances(
-		[]gwacl.HostedServiceDescriptor{*service1Desc, *service2Desc},
-		env)
-
-	err := env.StopInstances(instances)
+	err = env.StopInstances([]instance.Instance{inst1, inst2, inst3})
 	c.Check(err, gc.IsNil)
 
-	// It takes 2 API calls to delete each service:
-	// - one GET request to fetch the service's properties;
-	// - one DELETE request to delete the service.
-	c.Check(len(*requests), gc.Equals, len(services)*2)
-	assertOneRequestMatches(c, *requests, "GET", ".*"+service1Name+".*")
+	// One GET and DELETE per service
+	// (GetHostedServiceProperties and DeleteHostedService).
+	c.Check(len(*requests), gc.Equals, len(responses))
+	assertOneRequestMatches(c, *requests, "GET", ".*"+service1Name+".")
+	assertOneRequestMatches(c, *requests, "GET", ".*"+service2Name+".*")
 	assertOneRequestMatches(c, *requests, "DELETE", ".*"+service1Name+".*")
-	assertOneRequestMatches(c, *requests, "GET", ".*"+service2Name+".")
 	assertOneRequestMatches(c, *requests, "DELETE", ".*"+service2Name+".*")
 }
 
+func (s *environSuite) TestStopInstancesServiceSubset(c *gc.C) {
+	env := makeEnviron(c)
+	service := makeDeployment(env, "service")
+
+	role1Name := service.Deployments[0].RoleList[0].RoleName
+	inst1, err := env.getInstance(service, role1Name)
+	c.Assert(err, gc.IsNil)
+
+	responses := buildGetServicePropertiesResponses(c, service)
+	responses = append(responses, buildStatusOKResponses(c, 1)...) // DeleteRole
+	requests := gwacl.PatchManagementAPIResponses(responses)
+	err = env.StopInstances([]instance.Instance{inst1})
+	c.Check(err, gc.IsNil)
+
+	// One GET for the service, and one DELETE for the role.
+	// The service isn't deleted because it has two roles,
+	// and only one is being deleted.
+	c.Check(len(*requests), gc.Equals, len(responses))
+	assertOneRequestMatches(c, *requests, "GET", ".*"+service.ServiceName+".")
+	assertOneRequestMatches(c, *requests, "DELETE", ".*"+role1Name+".*")
+}
+
 func (s *environSuite) TestStopInstancesWhenStoppingMachinesFails(c *gc.C) {
-	s.setServiceDeletionConcurrency(3)
-	responses := []gwacl.DispatcherResponse{
-		gwacl.NewDispatcherResponse(nil, http.StatusConflict, nil),
-	}
-	service1Name := "service1"
-	_, service1Desc := makeAzureService(service1Name)
-	service2Name := "service2"
-	service2, service2Desc := makeAzureService(service2Name)
-	services := []*gwacl.HostedService{service2}
-	destroyResponses := buildDestroyAzureServiceResponses(c, services)
-	responses = append(responses, destroyResponses...)
+	env := makeEnviron(c)
+	service1 := makeDeployment(env, "service1")
+	service2 := makeDeployment(env, "service2")
+	service1Role1Name := service1.Deployments[0].RoleList[0].RoleName
+	inst1, err := env.getInstance(service1, service1Role1Name)
+	c.Assert(err, gc.IsNil)
+	service2Role1Name := service2.Deployments[0].RoleList[0].RoleName
+	inst2, err := env.getInstance(service2, service2Role1Name)
+	c.Assert(err, gc.IsNil)
+
+	responses := buildGetServicePropertiesResponses(c, service1, service2)
+	// Failed to delete one of the services.
+	responses = append(responses, gwacl.NewDispatcherResponse(nil, http.StatusConflict, nil))
 	requests := gwacl.PatchManagementAPIResponses(responses)
-	env := makeEnviron(c)
-	instances := convertToInstances(
-		[]gwacl.HostedServiceDescriptor{*service1Desc, *service2Desc}, env)
 
-	err := env.StopInstances(instances)
+	instances := []instance.Instance{inst1, inst2}
+	err = env.StopInstances(instances)
 	c.Check(err, gc.ErrorMatches, ".*Conflict.*")
 
-	c.Check(len(*requests), gc.Equals, 3)
-	assertOneRequestMatches(c, *requests, "GET", ".*"+service1Name+".")
-	assertOneRequestMatches(c, *requests, "GET", ".*"+service2Name+".")
-	// Only one of the services was deleted.
-	assertOneRequestMatches(c, *requests, "DELETE", ".*")
-}
-
-func (s *environSuite) TestStopInstancesWithLimitedConcurrency(c *gc.C) {
-	s.setServiceDeletionConcurrency(3)
-	services := []*gwacl.HostedService{}
-	serviceDescs := []gwacl.HostedServiceDescriptor{}
-	for i := 0; i < 10; i++ {
-		serviceName := fmt.Sprintf("service%d", i)
-		service, serviceDesc := makeAzureService(serviceName)
-		services = append(services, service)
-		serviceDescs = append(serviceDescs, *serviceDesc)
-	}
-	responses := buildDestroyAzureServiceResponses(c, services)
-	requests := gwacl.PatchManagementAPIResponses(responses)
-	env := makeEnviron(c)
-	instances := convertToInstances(serviceDescs, env)
-
-	err := env.StopInstances(instances)
-	c.Check(err, gc.IsNil)
-	c.Check(len(*requests), gc.Equals, len(services)*2)
+	c.Check(len(*requests), gc.Equals, len(responses))
+	assertOneRequestMatches(c, *requests, "GET", ".*"+service1.ServiceName+".*")
+	assertOneRequestMatches(c, *requests, "GET", ".*"+service2.ServiceName+".*")
+	assertOneRequestMatches(c, *requests, "DELETE", ".*("+service1.ServiceName+"|"+service2.ServiceName+").")
 }
 
 func (s *environSuite) TestStopInstancesWithZeroInstance(c *gc.C) {
-	s.setServiceDeletionConcurrency(3)
 	env := makeEnviron(c)
 	instances := []instance.Instance{}
 
@@ -832,8 +889,7 @@
 		env.Storage(),
 		&bootstrap.BootstrapState{StateInstances: []instance.Id{instance.Id("test-id")}})
 	c.Assert(err, gc.IsNil)
-	services := []gwacl.HostedServiceDescriptor{}
-	responses := getAzureServiceListResponse(c, services)
+	responses := getAzureServiceListResponse(c)
 	cleanupResponses := getVnetAndAffinityGroupCleanupResponses(c)
 	responses = append(responses, cleanupResponses...)
 	gwacl.PatchManagementAPIResponses(responses)
@@ -849,8 +905,7 @@
 func (s *environSuite) TestDestroyDeletesVirtualNetworkAndAffinityGroup(c *gc.C) {
 	env := makeEnviron(c)
 	s.setDummyStorage(c, env)
-	services := []gwacl.HostedServiceDescriptor{}
-	responses := getAzureServiceListResponse(c, services)
+	responses := getAzureServiceListResponse(c)
 	// Prepare a configuration with a single virtual network.
 	existingConfig := &gwacl.NetworkConfiguration{
 		XMLNS: gwacl.XMLNS_NC,
@@ -914,52 +969,98 @@
 }
 
 func (s *environSuite) TestDestroyStopsAllInstances(c *gc.C) {
-	s.setServiceDeletionConcurrency(3)
 	env := makeEnviron(c)
 	s.setDummyStorage(c, env)
+	prefix := env.getEnvPrefix()
+	service1 := makeDeployment(env, prefix+"service1")
+	service2 := makeDeployment(env, prefix+"service2")
 
-	// Simulate 2 instances corresponding to two Azure services.
-	prefix := env.getEnvPrefix()
-	service1Name := prefix + "service1"
-	service1, service1Desc := makeAzureService(service1Name)
-	services := []*gwacl.HostedService{service1}
 	// The call to AllInstances() will return only one service (service1).
-	listInstancesResponses := getAzureServiceListResponse(c, []gwacl.HostedServiceDescriptor{*service1Desc})
-	destroyResponses := buildDestroyAzureServiceResponses(c, services)
-	responses := append(listInstancesResponses, destroyResponses...)
-	cleanupResponses := getVnetAndAffinityGroupCleanupResponses(c)
-	responses = append(responses, cleanupResponses...)
+	responses := getAzureServiceListResponse(c, service1.HostedServiceDescriptor, service2.HostedServiceDescriptor)
+	responses = append(responses, buildStatusOKResponses(c, 2)...) // DeleteHostedService
+	responses = append(responses, getVnetAndAffinityGroupCleanupResponses(c)...)
 	requests := gwacl.PatchManagementAPIResponses(responses)
 
 	err := env.Destroy()
 	c.Check(err, gc.IsNil)
 
 	// One request to get the list of all the environment's instances.
-	// Then two requests per destroyed machine (one to fetch the
-	// service's information, one to delete it) and two requests to delete
-	// the Virtual Network and the Affinity Group.
-	c.Check((*requests), gc.HasLen, 1+len(services)*2+2)
+	// One delete request per destroyed service, and two additional
+	// requests to delete the Virtual Network and the Affinity Group.
+	c.Check((*requests), gc.HasLen, 5)
 	c.Check((*requests)[0].Method, gc.Equals, "GET")
-	assertOneRequestMatches(c, *requests, "GET", ".*"+service1Name+".*")
-	assertOneRequestMatches(c, *requests, "DELETE", ".*"+service1Name+".*")
-}
-
-func (*environSuite) TestGetInstance(c *gc.C) {
-	env := makeEnviron(c)
-	prefix := env.getEnvPrefix()
-	serviceName := prefix + "instance-name"
-	serviceDesc := gwacl.HostedServiceDescriptor{ServiceName: serviceName}
-	service := gwacl.HostedService{HostedServiceDescriptor: serviceDesc}
-	responses := getAzureServiceResponses(c, service)
-	gwacl.PatchManagementAPIResponses(responses)
-
-	instance, err := env.getInstance("serviceName")
-	c.Check(err, gc.IsNil)
-
-	c.Check(string(instance.Id()), gc.Equals, serviceName)
-	c.Check(instance, gc.FitsTypeOf, &azureInstance{})
-	azInstance := instance.(*azureInstance)
-	c.Check(azInstance.environ, gc.Equals, env)
+	assertOneRequestMatches(c, *requests, "DELETE", ".*"+service1.ServiceName+".*")
+	assertOneRequestMatches(c, *requests, "DELETE", ".*"+service2.ServiceName+".*")
+}
+
+func (s *environSuite) TestGetInstance(c *gc.C) {
+	env := makeEnviron(c)
+	service1 := makeLegacyDeployment(env, "service1")
+	service2 := makeDeployment(env, "service1")
+
+	// azureEnviron.Instances will call getInstance with roleName==""
+	// for legacy instances. This will cause getInstance to get the
+	// one and only role (or error if there is more than one).
+	inst1, err := env.getInstance(service1, "")
+	c.Assert(err, gc.IsNil)
+	c.Check(inst1.Id(), gc.Equals, instance.Id("service1"))
+	c.Assert(inst1, gc.FitsTypeOf, &azureInstance{})
+	c.Check(inst1.(*azureInstance).environ, gc.Equals, env)
+	c.Check(inst1.(*azureInstance).roleName, gc.Equals, service1.Deployments[0].RoleList[0].RoleName)
+	service1.Deployments[0].RoleList = service2.Deployments[0].RoleList
+	inst1, err = env.getInstance(service1, "")
+	c.Check(err, gc.ErrorMatches, `expected one role for "service1", got 2`)
+
+	inst2, err := env.getInstance(service2, service2.Deployments[0].RoleList[0].RoleName)
+	c.Assert(err, gc.IsNil)
+	c.Check(inst2.Id(), gc.Equals, instance.Id("service1-"+service2.Deployments[0].RoleList[0].RoleName))
+}
+
+func (s *environSuite) TestInitialPorts(c *gc.C) {
+	env := makeEnviron(c)
+	service1 := makeLegacyDeployment(env, "service1")
+	service2 := makeDeployment(env, "service2")
+	service3 := makeDeployment(env, "service3")
+	service3.Label = base64.StdEncoding.EncodeToString([]byte(stateServerLabel))
+
+	role1 := &service1.Deployments[0].RoleList[0]
+	inst1, err := env.getInstance(service1, role1.RoleName)
+	c.Assert(err, gc.IsNil)
+	c.Assert(inst1.(*azureInstance).maskStateServerPorts, jc.IsTrue)
+	role2 := &service2.Deployments[0].RoleList[0]
+	inst2, err := env.getInstance(service2, role2.RoleName)
+	c.Assert(err, gc.IsNil)
+	role3 := &service3.Deployments[0].RoleList[0]
+	inst3, err := env.getInstance(service3, role3.RoleName)
+	c.Assert(err, gc.IsNil)
+
+	// Only role2 should report opened state server ports via the Ports method.
+	dummyRole := *role1
+	configSetNetwork(&dummyRole).InputEndpoints = &[]gwacl.InputEndpoint{{
+		LocalPort: env.Config().StatePort(),
+		Protocol:  "tcp",
+		Name:      "stateserver",
+		Port:      env.Config().StatePort(),
+	}, {
+		LocalPort: env.Config().APIPort(),
+		Protocol:  "tcp",
+		Name:      "apiserver",
+		Port:      env.Config().APIPort(),
+	}}
+	reportsStateServerPorts := func(inst instance.Instance) bool {
+		responses := preparePortChangeConversation(c, &dummyRole)
+		gwacl.PatchManagementAPIResponses(responses)
+		ports, err := inst.Ports("")
+		c.Assert(err, gc.IsNil)
+		portmap := make(map[int]bool)
+		for _, port := range ports {
+			portmap[port.Number] = true
+		}
+		return portmap[env.Config().StatePort()] && portmap[env.Config().APIPort()]
+	}
+	c.Check(inst1, gc.Not(jc.Satisfies), reportsStateServerPorts)
+	c.Check(inst2, jc.Satisfies, reportsStateServerPorts)
+	c.Check(inst3, gc.Not(jc.Satisfies), reportsStateServerPorts)
 }
 
 func (*environSuite) TestNewOSVirtualDisk(c *gc.C) {
@@ -989,25 +1090,32 @@
 	return mapping
 }
 
-func (*environSuite) TestNewRole(c *gc.C) {
+func (s *environSuite) TestNewRole(c *gc.C) {
+	s.testNewRole(c, false)
+}
+
+func (s *environSuite) TestNewRoleStateServer(c *gc.C) {
+	s.testNewRole(c, true)
+}
+
+func (*environSuite) testNewRole(c *gc.C, stateServer bool) {
 	env := makeEnviron(c)
 	size := "Large"
 	vhd := env.newOSDisk("source-image-name")
 	userData := "example-user-data"
-	hostname := "hostname"
 
-	role := env.newRole(size, vhd, userData, hostname)
+	role := env.newRole(size, vhd, userData, stateServer)
 
 	configs := role.ConfigurationSets
 	linuxConfig := configs[0]
 	networkConfig := configs[1]
 	c.Check(linuxConfig.CustomData, gc.Equals, userData)
-	c.Check(linuxConfig.Hostname, gc.Equals, hostname)
+	c.Check(linuxConfig.Hostname, gc.Equals, role.RoleName)
 	c.Check(linuxConfig.Username, gc.Not(gc.Equals), "")
 	c.Check(linuxConfig.Password, gc.Not(gc.Equals), "")
 	c.Check(linuxConfig.DisableSSHPasswordAuthentication, gc.Equals, "true")
 	c.Check(role.RoleSize, gc.Equals, size)
-	c.Check(role.OSVirtualHardDisk[0], gc.Equals, *vhd)
+	c.Check(role.OSVirtualHardDisk, gc.DeepEquals, vhd)
 
 	endpoints := mapInputEndpointsByPort(c, *networkConfig.InputEndpoints)
 
@@ -1017,35 +1125,19 @@
 	c.Check(sshEndpoint.LocalPort, gc.Equals, 22)
 	c.Check(sshEndpoint.Protocol, gc.Equals, "tcp")
 
-	// There's also an endpoint for the state (mongodb) port.
-	// TODO: Ought to have this only for state servers.
-	stateEndpoint, ok := endpoints[env.Config().StatePort()]
-	c.Assert(ok, gc.Equals, true)
-	c.Check(stateEndpoint.LocalPort, gc.Equals, env.Config().StatePort())
-	c.Check(stateEndpoint.Protocol, gc.Equals, "tcp")
-
-	// And one for the API port.
-	// TODO: Ought to have this only for API servers.
-	apiEndpoint, ok := endpoints[env.Config().APIPort()]
-	c.Assert(ok, gc.Equals, true)
-	c.Check(apiEndpoint.LocalPort, gc.Equals, env.Config().APIPort())
-	c.Check(apiEndpoint.Protocol, gc.Equals, "tcp")
-}
-
-func (*environSuite) TestNewDeployment(c *gc.C) {
-	env := makeEnviron(c)
-	deploymentName := "deployment-name"
-	deploymentLabel := "deployment-label"
-	virtualNetworkName := "virtual-network-name"
-	vhd := env.newOSDisk("source-image-name")
-	role := env.newRole("Small", vhd, "user-data", "hostname")
-
-	deployment := env.newDeployment(role, deploymentName, deploymentLabel, virtualNetworkName)
-
-	base64Label := base64.StdEncoding.EncodeToString([]byte(deploymentLabel))
-	c.Check(deployment.Label, gc.Equals, base64Label)
-	c.Check(deployment.Name, gc.Equals, deploymentName)
-	c.Check(deployment.RoleList, gc.HasLen, 1)
+	if stateServer {
+		// There's also an endpoint for the state (mongodb) port.
+		stateEndpoint, ok := endpoints[env.Config().StatePort()]
+		c.Assert(ok, gc.Equals, true)
+		c.Check(stateEndpoint.LocalPort, gc.Equals, env.Config().StatePort())
+		c.Check(stateEndpoint.Protocol, gc.Equals, "tcp")
+
+		// And one for the API port.
+		apiEndpoint, ok := endpoints[env.Config().APIPort()]
+		c.Assert(ok, gc.Equals, true)
+		c.Check(apiEndpoint.LocalPort, gc.Equals, env.Config().APIPort())
+		c.Check(apiEndpoint.Protocol, gc.Equals, "tcp")
+	}
 }
 
 func (*environSuite) TestProviderReturnsAzureEnvironProvider(c *gc.C) {
@@ -1235,18 +1327,6 @@
 	c.Assert(image, gc.Equals, "image-id")
 }
 
-func (*environSuite) TestConvertToInstances(c *gc.C) {
-	services := []gwacl.HostedServiceDescriptor{
-		{ServiceName: "foo"}, {ServiceName: "bar"},
-	}
-	env := makeEnviron(c)
-	instances := convertToInstances(services, env)
-	c.Check(instances, gc.DeepEquals, []instance.Instance{
-		&azureInstance{services[0], env},
-		&azureInstance{services[1], env},
-	})
-}
-
 func (*environSuite) TestExtractStorageKeyPicksPrimaryKeyIfSet(c *gc.C) {
 	keys := gwacl.StorageAccountKeys{
 		Primary:   "mainkey",

=== modified file 'provider/azure/instance.go'
--- provider/azure/instance.go	2014-01-20 17:18:13 +0000
+++ provider/azure/instance.go	2014-04-03 07:35:44 +0000
@@ -6,18 +6,28 @@
 import (
 	"fmt"
 	"strings"
+	"sync"
 
 	"launchpad.net/gwacl"
 
+	"launchpad.net/juju-core/errors"
 	"launchpad.net/juju-core/instance"
 	"launchpad.net/juju-core/provider/common"
 	"launchpad.net/juju-core/worker/firewaller"
 )
 
+const AZURE_DOMAIN_NAME = "cloudapp.net"
+
 type azureInstance struct {
-	// An instance contains an Azure Service (instance==service).
-	gwacl.HostedServiceDescriptor
-	environ *azureEnviron
+	environ              *azureEnviron
+	hostedService        *gwacl.HostedServiceDescriptor
+	instanceId           instance.Id
+	deploymentName       string
+	roleName             string
+	maskStateServerPorts bool
+
+	mu           sync.Mutex
+	roleInstance *gwacl.RoleInstance
 }
 
 // azureInstance implements Instance.
@@ -25,38 +35,71 @@
 
 // Id is specified in the Instance interface.
 func (azInstance *azureInstance) Id() instance.Id {
-	return instance.Id(azInstance.ServiceName)
+	return azInstance.instanceId
+}
+
+// supportsLoadBalancing returns true iff the instance is
+// not a legacy instance where endpoints may have been
+// created without load balancing set names associated.
+func (azInstance *azureInstance) supportsLoadBalancing() bool {
+	v1Name := deploymentNameV1(azInstance.hostedService.ServiceName)
+	return azInstance.deploymentName != v1Name
 }
 
 // Status is specified in the Instance interface.
 func (azInstance *azureInstance) Status() string {
-	return azInstance.HostedServiceDescriptor.Status
+	azInstance.mu.Lock()
+	defer azInstance.mu.Unlock()
+	if azInstance.roleInstance == nil {
+		return ""
+	}
+	return azInstance.roleInstance.InstanceStatus
 }
 
-var AZURE_DOMAIN_NAME = "cloudapp.net"
+func (azInstance *azureInstance) serviceName() string {
+	return azInstance.hostedService.ServiceName
+}
 
 // Refresh is specified in the Instance interface.
 func (azInstance *azureInstance) Refresh() error {
-	// TODO(axw) 2013-12-16 #1261324
-	// Cache Addresses/netInfo, refresh here.
-	return nil
+	return azInstance.apiCall(false, func(c *azureManagementContext) error {
+		d, err := c.GetDeployment(&gwacl.GetDeploymentRequest{
+			ServiceName:    azInstance.serviceName(),
+			DeploymentName: azInstance.deploymentName,
+		})
+		if err != nil {
+			return err
+		}
+		// Look for the role instance.
+		for _, role := range d.RoleInstanceList {
+			if role.RoleName == azInstance.roleName {
+				azInstance.mu.Lock()
+				azInstance.roleInstance = &role
+				azInstance.mu.Unlock()
+				return nil
+			}
+		}
+		return errors.NotFoundf("role instance %q", azInstance.roleName)
+	})
 }
 
 // Addresses is specified in the Instance interface.
 func (azInstance *azureInstance) Addresses() ([]instance.Address, error) {
-	addrs := []instance.Address{}
-	ip, netname, err := azInstance.netInfo()
-	if err != nil {
-		return nil, err
-	}
-	if ip != "" {
-		addrs = append(addrs, instance.Address{
-			ip,
-			instance.Ipv4Address,
-			netname,
-			instance.NetworkCloudLocal})
-	}
-
+	var addrs []instance.Address
+	for i := 0; i < 2; i++ {
+		if ip := azInstance.ipAddress(); ip != "" {
+			addrs = append(addrs, instance.Address{
+				Value:        ip,
+				Type:         instance.Ipv4Address,
+				NetworkName:  azInstance.environ.getVirtualNetworkName(),
+				NetworkScope: instance.NetworkCloudLocal,
+			})
+			break
+		}
+		if err := azInstance.Refresh(); err != nil {
+			return nil, err
+		}
+	}
 	name, err := azInstance.DNSName()
 	if err != nil {
 		return nil, err
@@ -66,32 +109,14 @@
 	return addrs, nil
 }
 
-func (azInstance *azureInstance) netInfo() (ip, netname string, err error) {
-	err = azInstance.apiCall(false, func(c *azureManagementContext) error {
-		d, err := c.GetDeployment(&gwacl.GetDeploymentRequest{
-			ServiceName:    azInstance.ServiceName,
-			DeploymentName: azInstance.ServiceName,
-		})
-		if err != nil {
-			return err
-		}
-		switch len(d.RoleInstanceList) {
-		case 0:
-			// nothing to do, this can happen if the instances aren't finished deploying
-			return nil
-		case 1:
-			// success
-			ip = d.RoleInstanceList[0].IPAddress
-			netname = d.VirtualNetworkName
-			return nil
-		default:
-			return fmt.Errorf("Too many instances, expected one, got %d", len(d.RoleInstanceList))
-		}
-	})
-	if err != nil {
-		return "", "", err
+func (azInstance *azureInstance) ipAddress() string {
+	azInstance.mu.Lock()
+	defer azInstance.mu.Unlock()
+	if azInstance.roleInstance == nil {
+		// RoleInstance hasn't finished deploying.
+		return ""
 	}
-	return ip, netname, nil
+	return azInstance.roleInstance.IPAddress
 }
 
 // DNSName is specified in the Instance interface.
@@ -101,7 +126,7 @@
 	// (For Staging deployments it's all much weirder: they get random
 	// names assigned, which somehow don't seem to resolve from the
 	// outside.)
-	name := fmt.Sprintf("%s.%s", azInstance.ServiceName, AZURE_DOMAIN_NAME)
+	name := fmt.Sprintf("%s.%s", azInstance.serviceName(), AZURE_DOMAIN_NAME)
 	return name, nil
 }
 
@@ -121,13 +146,11 @@
 // the environment
 func (azInstance *azureInstance) apiCall(lock bool, f func(*azureManagementContext) error) error {
 	env := azInstance.environ
-
 	context, err := env.getManagementAPI()
 	if err != nil {
 		return err
 	}
 	defer env.releaseManagementAPI(context)
-
 	if lock {
 		env.Lock()
 		defer env.Unlock()
@@ -139,37 +162,40 @@
 // responsible for locking and unlocking the environ and releasing the
 // management context.
 func (azInstance *azureInstance) openEndpoints(context *azureManagementContext, ports []instance.Port) error {
-	deployments, err := context.ListAllDeployments(&gwacl.ListAllDeploymentsRequest{
-		ServiceName: azInstance.ServiceName,
-	})
-	if err != nil {
-		return err
-	}
-
-	for _, deployment := range deployments {
-		for _, role := range deployment.RoleList {
-			request := &gwacl.AddRoleEndpointsRequest{
-				ServiceName:    azInstance.ServiceName,
-				DeploymentName: deployment.Name,
-				RoleName:       role.RoleName,
-			}
-			for _, port := range ports {
-				request.InputEndpoints = append(
-					request.InputEndpoints, gwacl.InputEndpoint{
-						LocalPort: port.Number,
-						Name:      fmt.Sprintf("%s%d", port.Protocol, port.Number),
-						Port:      port.Number,
-						Protocol:  port.Protocol,
-					})
-			}
-			err := context.AddRoleEndpoints(request)
-			if err != nil {
-				return err
-			}
-		}
-	}
-
-	return nil
+	request := &gwacl.AddRoleEndpointsRequest{
+		ServiceName:    azInstance.serviceName(),
+		DeploymentName: azInstance.deploymentName,
+		RoleName:       azInstance.roleName,
+	}
+	for _, port := range ports {
+		name := fmt.Sprintf("%s%d", port.Protocol, port.Number)
+		endpoint := gwacl.InputEndpoint{
+			LocalPort: port.Number,
+			Name:      name,
+			Port:      port.Number,
+			Protocol:  port.Protocol,
+		}
+		if azInstance.supportsLoadBalancing() {
+			probePort := port.Number
+			if strings.ToUpper(endpoint.Protocol) == "UDP" {
+				// Load balancing needs a TCP port to probe, or an HTTP
+				// server port & path to query. For UDP, we just use the
+				// machine's SSH agent port to test machine liveness.
+				//
+				// It probably doesn't make sense to load balance most UDP
+				// protocols transparently, but that's an application level
+				// concern.
+				probePort = 22
+			}
+			endpoint.LoadBalancedEndpointSetName = name
+			endpoint.LoadBalancerProbe = &gwacl.LoadBalancerProbe{
+				Port:     probePort,
+				Protocol: "TCP",
+			}
+		}
+		request.InputEndpoints = append(request.InputEndpoints, endpoint)
+	}
+	return context.AddRoleEndpoints(request)
 }
 
 // ClosePorts is specified in the Instance interface.
@@ -183,40 +209,25 @@
 // responsible for locking and unlocking the environ and releasing the
 // management context.
 func (azInstance *azureInstance) closeEndpoints(context *azureManagementContext, ports []instance.Port) error {
-	deployments, err := context.ListAllDeployments(&gwacl.ListAllDeploymentsRequest{
-		ServiceName: azInstance.ServiceName,
-	})
-	if err != nil {
-		return err
-	}
-
-	for _, deployment := range deployments {
-		for _, role := range deployment.RoleList {
-			request := &gwacl.RemoveRoleEndpointsRequest{
-				ServiceName:    azInstance.ServiceName,
-				DeploymentName: deployment.Name,
-				RoleName:       role.RoleName,
-			}
-			for _, port := range ports {
-				request.InputEndpoints = append(
-					request.InputEndpoints, gwacl.InputEndpoint{
-						LocalPort: port.Number,
-						Name:      fmt.Sprintf("%s%d", port.Protocol, port.Number),
-						Port:      port.Number,
-						Protocol:  port.Protocol,
-					})
-			}
-			err := context.RemoveRoleEndpoints(request)
-			if err != nil {
-				return err
-			}
-		}
-	}
-
-	return nil
+	request := &gwacl.RemoveRoleEndpointsRequest{
+		ServiceName:    azInstance.serviceName(),
+		DeploymentName: azInstance.deploymentName,
+		RoleName:       azInstance.roleName,
+	}
+	for _, port := range ports {
+		name := fmt.Sprintf("%s%d", port.Protocol, port.Number)
+		request.InputEndpoints = append(request.InputEndpoints, gwacl.InputEndpoint{
+			LocalPort:                   port.Number,
+			Name:                        name,
+			Port:                        port.Number,
+			Protocol:                    port.Protocol,
+			LoadBalancedEndpointSetName: name,
+		})
+	}
+	return context.RemoveRoleEndpoints(request)
 }
 
-// convertAndFilterEndpoints converts a slice of gwacl.InputEndpoint into a slice of instance.Port.
+// convertEndpointsToPorts converts a slice of gwacl.InputEndpoint into a slice of instance.Port.
 func convertEndpointsToPorts(endpoints []gwacl.InputEndpoint) []instance.Port {
 	ports := []instance.Port{}
 	for _, endpoint := range endpoints {
@@ -230,10 +241,11 @@
 
 // convertAndFilterEndpoints converts a slice of gwacl.InputEndpoint into a slice of instance.Port
 // and filters out the initial endpoints that every instance should have opened (ssh port, etc.).
-func convertAndFilterEndpoints(endpoints []gwacl.InputEndpoint, env *azureEnviron) []instance.Port {
+func convertAndFilterEndpoints(endpoints []gwacl.InputEndpoint, env *azureEnviron, stateServer bool) []instance.Port {
 	return firewaller.Diff(
 		convertEndpointsToPorts(endpoints),
-		convertEndpointsToPorts(env.getInitialEndpoints()))
+		convertEndpointsToPorts(env.getInitialEndpoints(stateServer)),
+	)
 }
 
 // Ports is specified in the Instance interface.
@@ -254,39 +266,14 @@
 // responsible for locking and unlocking the environ and releasing the
 // management context.
 func (azInstance *azureInstance) listPorts(context *azureManagementContext) ([]instance.Port, error) {
-	deployments, err := context.ListAllDeployments(&gwacl.ListAllDeploymentsRequest{
-		ServiceName: azInstance.ServiceName,
+	endpoints, err := context.ListRoleEndpoints(&gwacl.ListRoleEndpointsRequest{
+		ServiceName:    azInstance.serviceName(),
+		DeploymentName: azInstance.deploymentName,
+		RoleName:       azInstance.roleName,
 	})
 	if err != nil {
 		return nil, err
 	}
-
-	env := azInstance.environ
-	switch {
-	// Only zero or one deployment is a valid state (instance==service).
-	case len(deployments) > 1:
-		return nil, fmt.Errorf("more than one Azure deployment inside the service named %q", azInstance.ServiceName)
-	case len(deployments) == 1:
-		deployment := deployments[0]
-		switch {
-		// Only zero or one role is a valid state (instance==service).
-		case len(deployment.RoleList) > 1:
-			return nil, fmt.Errorf("more than one Azure role inside the deployment named %q", deployment.Name)
-		case len(deployment.RoleList) == 1:
-			role := deployment.RoleList[0]
-
-			endpoints, err := context.ListRoleEndpoints(&gwacl.ListRoleEndpointsRequest{
-				ServiceName:    azInstance.ServiceName,
-				DeploymentName: deployment.Name,
-				RoleName:       role.RoleName,
-			})
-			if err != nil {
-				return nil, err
-			}
-			ports := convertAndFilterEndpoints(endpoints, env)
-			return ports, nil
-		}
-		return nil, nil
-	}
-	return nil, nil
+	ports := convertAndFilterEndpoints(endpoints, azInstance.environ, azInstance.maskStateServerPorts)
+	return ports, nil
 }

=== modified file 'provider/azure/instance_test.go'
--- provider/azure/instance_test.go	2014-03-13 07:54:56 +0000
+++ provider/azure/instance_test.go	2014-04-03 07:35:44 +0000
@@ -13,12 +13,42 @@
 	"launchpad.net/gwacl"
 
 	"launchpad.net/juju-core/instance"
+	"launchpad.net/juju-core/testing/testbase"
 )
 
-type instanceSuite struct{}
+type instanceSuite struct {
+	testbase.LoggingSuite
+	env        *azureEnviron
+	service    *gwacl.HostedService
+	deployment *gwacl.Deployment
+	role       *gwacl.Role
+	instance   *azureInstance
+}
 
 var _ = gc.Suite(&instanceSuite{})
 
+func (s *instanceSuite) SetUpTest(c *gc.C) {
+	s.env = makeEnviron(c)
+	s.service = makeDeployment(s.env, "service-name")
+	s.deployment = &s.service.Deployments[0]
+	s.deployment.Name = "deployment-one"
+	s.role = &s.deployment.RoleList[0]
+	s.role.RoleName = "role-one"
+	inst, err := s.env.getInstance(s.service, s.role.RoleName)
+	c.Assert(err, gc.IsNil)
+	c.Assert(inst, gc.FitsTypeOf, &azureInstance{})
+	s.instance = inst.(*azureInstance)
+}
+
+func configSetNetwork(role *gwacl.Role) *gwacl.ConfigurationSet {
+	for i, configSet := range role.ConfigurationSets {
+		if configSet.ConfigurationSetType == gwacl.CONFIG_SET_NETWORK {
+			return &role.ConfigurationSets[i]
+		}
+	}
+	return nil
+}
+
 // makeHostedServiceDescriptor creates a HostedServiceDescriptor with the
 // given service name.
 func makeHostedServiceDescriptor(name string) *gwacl.HostedServiceDescriptor {
@@ -27,66 +57,50 @@
 }
 
 func (*instanceSuite) TestId(c *gc.C) {
-	serviceName := "test-name"
-	testService := makeHostedServiceDescriptor(serviceName)
-	azInstance := azureInstance{*testService, nil}
-	c.Check(azInstance.Id(), gc.Equals, instance.Id(serviceName))
+	azInstance := azureInstance{instanceId: "whatever"}
+	c.Check(azInstance.Id(), gc.Equals, instance.Id("whatever"))
 }
 
 func (*instanceSuite) TestStatus(c *gc.C) {
-	serviceName := "test-name"
-	testService := makeHostedServiceDescriptor(serviceName)
-	testService.Status = "something"
-	azInstance := azureInstance{*testService, nil}
-	c.Check(azInstance.Status(), gc.Equals, testService.Status)
+	var inst azureInstance
+	c.Check(inst.Status(), gc.Equals, "")
+	inst.roleInstance = &gwacl.RoleInstance{InstanceStatus: "anyoldthing"}
+	c.Check(inst.Status(), gc.Equals, "anyoldthing")
 }
 
 func (*instanceSuite) TestDNSName(c *gc.C) {
-	// An instance's DNS name is computed from its hosted-service name.
-	host := "hostname"
-	testService := makeHostedServiceDescriptor(host)
-	azInstance := azureInstance{*testService, nil}
+	testService := makeHostedServiceDescriptor("cloud-service-name")
+	azInstance := azureInstance{hostedService: testService}
 	dnsName, err := azInstance.DNSName()
 	c.Assert(err, gc.IsNil)
-	c.Check(dnsName, gc.Equals, host+"."+AZURE_DOMAIN_NAME)
+	c.Check(dnsName, gc.Equals, "cloud-service-name.cloudapp.net")
 }
 
 func (*instanceSuite) TestWaitDNSName(c *gc.C) {
 	// An Azure instance gets its DNS name immediately, so there's no
 	// waiting involved.
-	host := "hostname"
-	testService := makeHostedServiceDescriptor(host)
-	azInstance := azureInstance{*testService, nil}
+	testService := makeHostedServiceDescriptor("cloud-service-name")
+	azInstance := azureInstance{hostedService: testService}
 	dnsName, err := azInstance.WaitDNSName()
 	c.Assert(err, gc.IsNil)
-	c.Check(dnsName, gc.Equals, host+"."+AZURE_DOMAIN_NAME)
-}
-
-func makeRole(name string, endpoints ...gwacl.InputEndpoint) gwacl.Role {
-	return gwacl.Role{
-		RoleName: name,
-		ConfigurationSets: []gwacl.ConfigurationSet{
-			{
-				ConfigurationSetType: gwacl.CONFIG_SET_NETWORK,
-				InputEndpoints:       &endpoints,
-			},
-		},
-	}
-}
-
-func makeDeployment(name string, roles ...gwacl.Role) gwacl.Deployment {
-	return gwacl.Deployment{
-		Name:     name,
-		RoleList: roles,
-	}
+	c.Check(dnsName, gc.Equals, "cloud-service-name.cloudapp.net")
 }
 
 func makeInputEndpoint(port int, protocol string) gwacl.InputEndpoint {
+	name := fmt.Sprintf("%s%d", protocol, port)
+	probe := &gwacl.LoadBalancerProbe{Port: port, Protocol: "TCP"}
+	if protocol == "udp" {
+		// We just use port 22 (SSH) for the
+		// probe when a UDP port is exposed.
+		probe.Port = 22
+	}
 	return gwacl.InputEndpoint{
 		LocalPort: port,
-		Name:      fmt.Sprintf("%s%d", protocol, port),
-		Port:      port,
-		Protocol:  protocol,
+		Name:      name,
+		LoadBalancedEndpointSetName: name,
+		LoadBalancerProbe:           probe,
+		Port:                        port,
+		Protocol:                    protocol,
 	}
 }
 
@@ -104,36 +118,18 @@
 	}
 }
 
-func preparePortChangeConversation(
-	c *gc.C, service *gwacl.HostedServiceDescriptor,
-	deployments ...gwacl.Deployment) []gwacl.DispatcherResponse {
-	// Construct the series of responses to expected requests.
-	responses := []gwacl.DispatcherResponse{
-		// First, GetHostedServiceProperties
-		gwacl.NewDispatcherResponse(
-			serialize(c, &gwacl.HostedService{
-				Deployments:             deployments,
-				HostedServiceDescriptor: *service,
-				XMLNS: gwacl.XMLNS,
-			}),
-			http.StatusOK, nil),
-	}
-	for _, deployment := range deployments {
-		for _, role := range deployment.RoleList {
-			// GetRole returns a PersistentVMRole.
-			persistentRole := &gwacl.PersistentVMRole{
-				XMLNS:             gwacl.XMLNS,
-				RoleName:          role.RoleName,
-				ConfigurationSets: role.ConfigurationSets,
-			}
-			responses = append(responses, gwacl.NewDispatcherResponse(
-				serialize(c, persistentRole), http.StatusOK, nil))
-			// UpdateRole expects a 200 response, that's all.
-			responses = append(responses,
-				gwacl.NewDispatcherResponse(nil, http.StatusOK, nil))
-		}
-	}
-	return responses
+func preparePortChangeConversation(c *gc.C, role *gwacl.Role) []gwacl.DispatcherResponse {
+	persistentRole := &gwacl.PersistentVMRole{
+		XMLNS:             gwacl.XMLNS,
+		RoleName:          role.RoleName,
+		ConfigurationSets: role.ConfigurationSets,
+	}
+	return []gwacl.DispatcherResponse{
+		// GetRole returns a PersistentVMRole.
+		gwacl.NewDispatcherResponse(serialize(c, persistentRole), http.StatusOK, nil),
+		// UpdateRole expects a 200 response, that's all.
+		gwacl.NewDispatcherResponse(nil, http.StatusOK, nil),
+	}
 }
 
 // point is 1-indexed; it represents which request should fail.
@@ -155,20 +151,16 @@
 	}
 }
 
-func (*instanceSuite) TestAddresses(c *gc.C) {
-	name := "service-name"
-	vnn := "Virt Net Name"
-	service := makeHostedServiceDescriptor(name)
-	responses := prepareDeploymentInfoResponse(c,
-		gwacl.Deployment{
-			RoleInstanceList: []gwacl.RoleInstance{
-				gwacl.RoleInstance{IPAddress: "1.2.3.4"},
-			},
-			VirtualNetworkName: vnn,
-		})
-
+func (s *instanceSuite) TestAddresses(c *gc.C) {
+	vnn := s.env.getVirtualNetworkName()
+	responses := prepareDeploymentInfoResponse(c, gwacl.Deployment{
+		RoleInstanceList: []gwacl.RoleInstance{{
+			RoleName:  s.role.RoleName,
+			IPAddress: "1.2.3.4",
+		}},
+		VirtualNetworkName: vnn,
+	})
 	gwacl.PatchManagementAPIResponses(responses)
-	inst := azureInstance{*service, makeEnviron(c)}
 
 	expected := []instance.Address{
 		instance.Address{
@@ -178,217 +170,153 @@
 			instance.NetworkCloudLocal,
 		},
 		instance.Address{
-			name + "." + AZURE_DOMAIN_NAME,
+			s.service.ServiceName + "." + AZURE_DOMAIN_NAME,
 			instance.HostName,
 			"",
 			instance.NetworkPublic,
 		},
 	}
 
-	addrs, err := inst.Addresses()
+	addrs, err := s.instance.Addresses()
 	c.Check(err, gc.IsNil)
-
 	c.Check(addrs, jc.SameContents, expected)
 }
 
-func (*instanceSuite) TestOpenPorts(c *gc.C) {
-	service := makeHostedServiceDescriptor("service-name")
-	responses := preparePortChangeConversation(c, service,
-		makeDeployment("deployment-one",
-			makeRole("role-one"), makeRole("role-two")),
-		makeDeployment("deployment-two",
-			makeRole("role-three")))
+func (s *instanceSuite) TestOpenPorts(c *gc.C) {
+	// Close the default ports.
+	configSetNetwork((*gwacl.Role)(s.role)).InputEndpoints = nil
+
+	responses := preparePortChangeConversation(c, s.role)
 	record := gwacl.PatchManagementAPIResponses(responses)
-	azInstance := azureInstance{*service, makeEnviron(c)}
-
-	err := azInstance.OpenPorts("machine-id", []instance.Port{
+	err := s.instance.OpenPorts("machine-id", []instance.Port{
 		{"tcp", 79}, {"tcp", 587}, {"udp", 9},
 	})
-
 	c.Assert(err, gc.IsNil)
+
 	assertPortChangeConversation(c, *record, []expectedRequest{
-		{"GET", ".*/services/hostedservices/service-name[?].*"},   // GetHostedServiceProperties
-		{"GET", ".*/deployments/deployment-one/roles/role-one"},   // GetRole
-		{"PUT", ".*/deployments/deployment-one/roles/role-one"},   // UpdateRole
-		{"GET", ".*/deployments/deployment-one/roles/role-two"},   // GetRole
-		{"PUT", ".*/deployments/deployment-one/roles/role-two"},   // UpdateRole
-		{"GET", ".*/deployments/deployment-two/roles/role-three"}, // GetRole
-		{"PUT", ".*/deployments/deployment-two/roles/role-three"}, // UpdateRole
+		{"GET", ".*/deployments/deployment-one/roles/role-one"}, // GetRole
+		{"PUT", ".*/deployments/deployment-one/roles/role-one"}, // UpdateRole
 	})
 
 	// A representative UpdateRole payload includes configuration for the
 	// ports requested.
 	role := &gwacl.PersistentVMRole{}
-	err = role.Deserialize((*record)[2].Payload)
+	err = role.Deserialize((*record)[1].Payload)
 	c.Assert(err, gc.IsNil)
 	c.Check(
-		*(role.ConfigurationSets[0].InputEndpoints),
-		gc.DeepEquals, []gwacl.InputEndpoint{
+		*configSetNetwork((*gwacl.Role)(role)).InputEndpoints,
+		gc.DeepEquals,
+		[]gwacl.InputEndpoint{
 			makeInputEndpoint(79, "tcp"),
 			makeInputEndpoint(587, "tcp"),
 			makeInputEndpoint(9, "udp"),
+		},
+	)
+}
+
+func (s *instanceSuite) TestOpenPortsFailsWhenUnableToGetRole(c *gc.C) {
+	responses := preparePortChangeConversation(c, s.role)
+	failPortChangeConversationAt(1, responses) // 1st request, GetRole
+	record := gwacl.PatchManagementAPIResponses(responses)
+	err := s.instance.OpenPorts("machine-id", []instance.Port{
+		{"tcp", 79}, {"tcp", 587}, {"udp", 9},
+	})
+	c.Check(err, gc.ErrorMatches, "GET request failed [(]500: Internal Server Error[)]")
+	c.Check(*record, gc.HasLen, 1)
+}
+
+func (s *instanceSuite) TestOpenPortsFailsWhenUnableToUpdateRole(c *gc.C) {
+	responses := preparePortChangeConversation(c, s.role)
+	failPortChangeConversationAt(2, responses) // 2nd request, UpdateRole
+	record := gwacl.PatchManagementAPIResponses(responses)
+	err := s.instance.OpenPorts("machine-id", []instance.Port{
+		{"tcp", 79}, {"tcp", 587}, {"udp", 9},
+	})
+	c.Check(err, gc.ErrorMatches, "PUT request failed [(]500: Internal Server Error[)]")
+	c.Check(*record, gc.HasLen, 2)
+}
+
+func (s *instanceSuite) TestClosePorts(c *gc.C) {
+	type test struct {
+		inputPorts  []instance.Port
+		removePorts []instance.Port
+		outputPorts []instance.Port
+	}
+
+	tests := []test{{
+		inputPorts:  []instance.Port{{"tcp", 1}, {"tcp", 2}, {"udp", 3}},
+		removePorts: nil,
+		outputPorts: []instance.Port{{"tcp", 1}, {"tcp", 2}, {"udp", 3}},
+	}, {
+		inputPorts:  []instance.Port{{"tcp", 1}},
+		removePorts: []instance.Port{{"udp", 1}},
+		outputPorts: []instance.Port{{"tcp", 1}},
+	}, {
+		inputPorts:  []instance.Port{{"tcp", 1}, {"tcp", 2}, {"udp", 3}},
+		removePorts: []instance.Port{{"tcp", 1}, {"tcp", 2}, {"udp", 3}},
+		outputPorts: []instance.Port{},
+	}, {
+		inputPorts:  []instance.Port{{"tcp", 1}, {"tcp", 2}, {"udp", 3}},
+		removePorts: []instance.Port{{"tcp", 99}},
+		outputPorts: []instance.Port{{"tcp", 1}, {"tcp", 2}, {"udp", 3}},
+	}}
+
+	for i, test := range tests {
+		c.Logf("test %d: %#v", i, test)
+
+		inputEndpoints := make([]gwacl.InputEndpoint, len(test.inputPorts))
+		for i, port := range test.inputPorts {
+			inputEndpoints[i] = makeInputEndpoint(port.Number, port.Protocol)
+		}
+		configSetNetwork(s.role).InputEndpoints = &inputEndpoints
+		responses := preparePortChangeConversation(c, s.role)
+		record := gwacl.PatchManagementAPIResponses(responses)
+
+		err := s.instance.ClosePorts("machine-id", test.removePorts)
+		c.Assert(err, gc.IsNil)
+		assertPortChangeConversation(c, *record, []expectedRequest{
+			{"GET", ".*/deployments/deployment-one/roles/role-one"}, // GetRole
+			{"PUT", ".*/deployments/deployment-one/roles/role-one"}, // UpdateRole
 		})
-}
-
-func (*instanceSuite) TestOpenPortsFailsWhenUnableToGetServiceProperties(c *gc.C) {
-	service := makeHostedServiceDescriptor("service-name")
-	responses := []gwacl.DispatcherResponse{
-		// GetHostedServiceProperties breaks.
-		gwacl.NewDispatcherResponse(nil, http.StatusInternalServerError, nil),
-	}
-	record := gwacl.PatchManagementAPIResponses(responses)
-	azInstance := azureInstance{*service, makeEnviron(c)}
-
-	err := azInstance.OpenPorts("machine-id", []instance.Port{
-		{"tcp", 79}, {"tcp", 587}, {"udp", 9},
-	})
-
-	c.Check(err, gc.ErrorMatches, "GET request failed [(]500: Internal Server Error[)]")
-	c.Check(*record, gc.HasLen, 1)
-}
-
-func (*instanceSuite) TestOpenPortsFailsWhenUnableToGetRole(c *gc.C) {
-	service := makeHostedServiceDescriptor("service-name")
-	responses := preparePortChangeConversation(c, service,
-		makeDeployment("deployment-one", makeRole("role-one")))
-	failPortChangeConversationAt(2, responses) // 2nd request, GetRole
-	record := gwacl.PatchManagementAPIResponses(responses)
-	azInstance := azureInstance{*service, makeEnviron(c)}
-
-	err := azInstance.OpenPorts("machine-id", []instance.Port{
-		{"tcp", 79}, {"tcp", 587}, {"udp", 9},
-	})
-
-	c.Check(err, gc.ErrorMatches, "GET request failed [(]500: Internal Server Error[)]")
-	c.Check(*record, gc.HasLen, 2)
-}
-
-func (*instanceSuite) TestOpenPortsFailsWhenUnableToUpdateRole(c *gc.C) {
-	service := makeHostedServiceDescriptor("service-name")
-	responses := preparePortChangeConversation(c, service,
-		makeDeployment("deployment-one", makeRole("role-one")))
-	failPortChangeConversationAt(3, responses) // 3rd request, UpdateRole
-	record := gwacl.PatchManagementAPIResponses(responses)
-	azInstance := azureInstance{*service, makeEnviron(c)}
-
-	err := azInstance.OpenPorts("machine-id", []instance.Port{
-		{"tcp", 79}, {"tcp", 587}, {"udp", 9},
-	})
-
-	c.Check(err, gc.ErrorMatches, "PUT request failed [(]500: Internal Server Error[)]")
-	c.Check(*record, gc.HasLen, 3)
-}
-
-func (*instanceSuite) TestClosePorts(c *gc.C) {
-	service := makeHostedServiceDescriptor("service-name")
-	responses := preparePortChangeConversation(c, service,
-		makeDeployment("deployment-one",
-			makeRole("role-one",
-				makeInputEndpoint(587, "tcp"),
-			),
-			makeRole("role-two",
-				makeInputEndpoint(79, "tcp"),
-				makeInputEndpoint(9, "udp"),
-			)),
-		makeDeployment("deployment-two",
-			makeRole("role-three",
-				makeInputEndpoint(9, "tcp"),
-				makeInputEndpoint(9, "udp"),
-			)))
-	record := gwacl.PatchManagementAPIResponses(responses)
-	azInstance := azureInstance{*service, makeEnviron(c)}
-
-	err := azInstance.ClosePorts("machine-id",
-		[]instance.Port{{"tcp", 587}, {"udp", 9}})
-
-	c.Assert(err, gc.IsNil)
-	assertPortChangeConversation(c, *record, []expectedRequest{
-		{"GET", ".*/services/hostedservices/service-name[?].*"},   // GetHostedServiceProperties
-		{"GET", ".*/deployments/deployment-one/roles/role-one"},   // GetRole
-		{"PUT", ".*/deployments/deployment-one/roles/role-one"},   // UpdateRole
-		{"GET", ".*/deployments/deployment-one/roles/role-two"},   // GetRole
-		{"PUT", ".*/deployments/deployment-one/roles/role-two"},   // UpdateRole
-		{"GET", ".*/deployments/deployment-two/roles/role-three"}, // GetRole
-		{"PUT", ".*/deployments/deployment-two/roles/role-three"}, // UpdateRole
-	})
-
-	// The first UpdateRole removes all endpoints from the role's
-	// configuration.
-	roleOne := &gwacl.PersistentVMRole{}
-	err = roleOne.Deserialize((*record)[2].Payload)
-	c.Assert(err, gc.IsNil)
-	c.Check(roleOne.ConfigurationSets[0].InputEndpoints, gc.IsNil)
-
-	// The second UpdateRole removes all but 79/TCP.
-	roleTwo := &gwacl.PersistentVMRole{}
-	err = roleTwo.Deserialize((*record)[4].Payload)
-	c.Assert(err, gc.IsNil)
-	c.Check(
-		roleTwo.ConfigurationSets[0].InputEndpoints,
-		gc.DeepEquals,
-		&[]gwacl.InputEndpoint{makeInputEndpoint(79, "tcp")})
-
-	// The third UpdateRole removes all but 9/TCP.
-	roleThree := &gwacl.PersistentVMRole{}
-	err = roleThree.Deserialize((*record)[6].Payload)
-	c.Assert(err, gc.IsNil)
-	c.Check(
-		roleThree.ConfigurationSets[0].InputEndpoints,
-		gc.DeepEquals,
-		&[]gwacl.InputEndpoint{makeInputEndpoint(9, "tcp")})
-}
-
-func (*instanceSuite) TestClosePortsFailsWhenUnableToGetServiceProperties(c *gc.C) {
-	service := makeHostedServiceDescriptor("service-name")
-	responses := []gwacl.DispatcherResponse{
-		// GetHostedServiceProperties breaks.
-		gwacl.NewDispatcherResponse(nil, http.StatusInternalServerError, nil),
-	}
-	record := gwacl.PatchManagementAPIResponses(responses)
-	azInstance := azureInstance{*service, makeEnviron(c)}
-
-	err := azInstance.ClosePorts("machine-id", []instance.Port{
-		{"tcp", 79}, {"tcp", 587}, {"udp", 9},
-	})
-
-	c.Check(err, gc.ErrorMatches, "GET request failed [(]500: Internal Server Error[)]")
-	c.Check(*record, gc.HasLen, 1)
-}
-
-func (*instanceSuite) TestClosePortsFailsWhenUnableToGetRole(c *gc.C) {
-	service := makeHostedServiceDescriptor("service-name")
-	responses := preparePortChangeConversation(c, service,
-		makeDeployment("deployment-one", makeRole("role-one")))
-	failPortChangeConversationAt(2, responses) // 2nd request, GetRole
-	record := gwacl.PatchManagementAPIResponses(responses)
-	azInstance := azureInstance{*service, makeEnviron(c)}
-
-	err := azInstance.ClosePorts("machine-id", []instance.Port{
-		{"tcp", 79}, {"tcp", 587}, {"udp", 9},
-	})
-
-	c.Check(err, gc.ErrorMatches, "GET request failed [(]500: Internal Server Error[)]")
-	c.Check(*record, gc.HasLen, 2)
-}
-
-func (*instanceSuite) TestClosePortsFailsWhenUnableToUpdateRole(c *gc.C) {
-	service := makeHostedServiceDescriptor("service-name")
-	responses := preparePortChangeConversation(c, service,
-		makeDeployment("deployment-one", makeRole("role-one")))
-	failPortChangeConversationAt(3, responses) // 3rd request, UpdateRole
-	record := gwacl.PatchManagementAPIResponses(responses)
-	azInstance := azureInstance{*service, makeEnviron(c)}
-
-	err := azInstance.ClosePorts("machine-id", []instance.Port{
-		{"tcp", 79}, {"tcp", 587}, {"udp", 9},
-	})
-
-	c.Check(err, gc.ErrorMatches, "PUT request failed [(]500: Internal Server Error[)]")
-	c.Check(*record, gc.HasLen, 3)
-}
-
-func (*instanceSuite) TestConvertAndFilterEndpoints(c *gc.C) {
-	env := makeEnviron(c)
+
+		// The first UpdateRole removes all endpoints from the role's
+		// configuration.
+		roleOne := &gwacl.PersistentVMRole{}
+		err = roleOne.Deserialize((*record)[1].Payload)
+		c.Assert(err, gc.IsNil)
+		endpoints := configSetNetwork((*gwacl.Role)(roleOne)).InputEndpoints
+		if len(test.outputPorts) == 0 {
+			c.Check(endpoints, gc.IsNil)
+		} else {
+			c.Check(endpoints, gc.NotNil)
+			c.Check(convertAndFilterEndpoints(*endpoints, s.env, false), gc.DeepEquals, test.outputPorts)
+		}
+	}
+}
+
+func (s *instanceSuite) TestClosePortsFailsWhenUnableToGetRole(c *gc.C) {
+	responses := preparePortChangeConversation(c, s.role)
+	failPortChangeConversationAt(1, responses) // 1st request, GetRole
+	record := gwacl.PatchManagementAPIResponses(responses)
+	err := s.instance.ClosePorts("machine-id", []instance.Port{
+		{"tcp", 79}, {"tcp", 587}, {"udp", 9},
+	})
+	c.Check(err, gc.ErrorMatches, "GET request failed [(]500: Internal Server Error[)]")
+	c.Check(*record, gc.HasLen, 1)
+}
+
+func (s *instanceSuite) TestClosePortsFailsWhenUnableToUpdateRole(c *gc.C) {
+	responses := preparePortChangeConversation(c, s.role)
+	failPortChangeConversationAt(2, responses) // 2nd request, UpdateRole
+	record := gwacl.PatchManagementAPIResponses(responses)
+	err := s.instance.ClosePorts("machine-id", []instance.Port{
+		{"tcp", 79}, {"tcp", 587}, {"udp", 9},
+	})
+	c.Check(err, gc.ErrorMatches, "PUT request failed [(]500: Internal Server Error[)]")
+	c.Check(*record, gc.HasLen, 2)
+}
+
+func (s *instanceSuite) TestConvertAndFilterEndpoints(c *gc.C) {
 	endpoints := []gwacl.InputEndpoint{
 		{
 			LocalPort: 123,
@@ -402,7 +330,7 @@
 			Name:      "test456",
 			Port:      44,
 		}}
-	endpoints = append(endpoints, env.getInitialEndpoints()...)
+	endpoints = append(endpoints, s.env.getInitialEndpoints(true)...)
 	expectedPorts := []instance.Port{
 		{
 			Number:   1123,
@@ -412,99 +340,66 @@
 			Number:   44,
 			Protocol: "tcp",
 		}}
-	c.Check(convertAndFilterEndpoints(endpoints, env), gc.DeepEquals, expectedPorts)
+	c.Check(convertAndFilterEndpoints(endpoints, s.env, true), gc.DeepEquals, expectedPorts)
 }
 
-func (*instanceSuite) TestConvertAndFilterEndpointsEmptySlice(c *gc.C) {
-	env := makeEnviron(c)
-	ports := convertAndFilterEndpoints([]gwacl.InputEndpoint{}, env)
+func (s *instanceSuite) TestConvertAndFilterEndpointsEmptySlice(c *gc.C) {
+	ports := convertAndFilterEndpoints([]gwacl.InputEndpoint{}, s.env, true)
 	c.Check(ports, gc.HasLen, 0)
 }
 
-func (*instanceSuite) TestPorts(c *gc.C) {
-	service := makeHostedServiceDescriptor("service-name")
-	endpoints := []gwacl.InputEndpoint{
-		{
-			LocalPort: 223,
-			Protocol:  "udp",
-			Name:      "test223",
-			Port:      2123,
-		},
-		{
-			LocalPort: 123,
-			Protocol:  "udp",
-			Name:      "test123",
-			Port:      1123,
-		},
-		{
-			LocalPort: 456,
-			Protocol:  "tcp",
-			Name:      "test456",
-			Port:      4456,
-		}}
-
-	responses := preparePortChangeConversation(c, service,
-		makeDeployment("deployment-one",
-			makeRole("role-one", endpoints...)))
+func (s *instanceSuite) TestPorts(c *gc.C) {
+	s.testPorts(c, false)
+	s.testPorts(c, true)
+}
+
+func (s *instanceSuite) testPorts(c *gc.C, maskStateServerPorts bool) {
+	// Update the role's endpoints by hand.
+	configSetNetwork(s.role).InputEndpoints = &[]gwacl.InputEndpoint{{
+		LocalPort: 223,
+		Protocol:  "udp",
+		Name:      "test223",
+		Port:      2123,
+	}, {
+		LocalPort: 123,
+		Protocol:  "udp",
+		Name:      "test123",
+		Port:      1123,
+	}, {
+		LocalPort: 456,
+		Protocol:  "tcp",
+		Name:      "test456",
+		Port:      4456,
+	}, {
+		LocalPort: s.env.Config().StatePort(),
+		Protocol:  "tcp",
+		Name:      "stateserver",
+		Port:      s.env.Config().StatePort(),
+	}, {
+		LocalPort: s.env.Config().APIPort(),
+		Protocol:  "tcp",
+		Name:      "apiserver",
+		Port:      s.env.Config().APIPort(),
+	}}
+
+	responses := preparePortChangeConversation(c, s.role)
 	record := gwacl.PatchManagementAPIResponses(responses)
-	azInstance := azureInstance{*service, makeEnviron(c)}
-
-	ports, err := azInstance.Ports("machine-id")
-
+	s.instance.maskStateServerPorts = maskStateServerPorts
+	ports, err := s.instance.Ports("machine-id")
 	c.Assert(err, gc.IsNil)
 	assertPortChangeConversation(c, *record, []expectedRequest{
-		{"GET", ".*/services/hostedservices/service-name[?].*"}, // GetHostedServiceProperties
 		{"GET", ".*/deployments/deployment-one/roles/role-one"}, // GetRole
 	})
 
-	c.Check(
-		ports,
-		gc.DeepEquals,
-		// The result is sorted using instance.SortPorts() (i.e. first by protocol,
-		// then by number).
-		[]instance.Port{
-			{Number: 4456, Protocol: "tcp"},
-			{Number: 1123, Protocol: "udp"},
-			{Number: 2123, Protocol: "udp"},
-		})
-}
-
-func (*instanceSuite) TestPortsErrorsIfMoreThanOneRole(c *gc.C) {
-	service := makeHostedServiceDescriptor("service-name")
-	responses := preparePortChangeConversation(c, service,
-		makeDeployment("deployment-one",
-			makeRole("role-one"), makeRole("role-two")))
-	gwacl.PatchManagementAPIResponses(responses)
-	azInstance := azureInstance{*service, makeEnviron(c)}
-
-	_, err := azInstance.Ports("machine-id")
-
-	c.Check(err, gc.ErrorMatches, ".*more than one Azure role inside the deployment.*")
-}
-
-func (*instanceSuite) TestPortsErrorsIfMoreThanOneDeployment(c *gc.C) {
-	service := makeHostedServiceDescriptor("service-name")
-	responses := preparePortChangeConversation(c, service,
-		makeDeployment("deployment-one",
-			makeRole("role-one")),
-		makeDeployment("deployment-two",
-			makeRole("role-two")))
-	gwacl.PatchManagementAPIResponses(responses)
-	azInstance := azureInstance{*service, makeEnviron(c)}
-
-	_, err := azInstance.Ports("machine-id")
-
-	c.Check(err, gc.ErrorMatches, ".*more than one Azure deployment inside the service.*")
-}
-
-func (*instanceSuite) TestPortsReturnsEmptySliceIfNoDeployment(c *gc.C) {
-	service := makeHostedServiceDescriptor("service-name")
-	responses := preparePortChangeConversation(c, service)
-	gwacl.PatchManagementAPIResponses(responses)
-	azInstance := azureInstance{*service, makeEnviron(c)}
-
-	ports, err := azInstance.Ports("machine-id")
-
-	c.Assert(err, gc.IsNil)
-	c.Check(ports, gc.HasLen, 0)
+	expected := []instance.Port{
+		{Number: 4456, Protocol: "tcp"},
+		{Number: 1123, Protocol: "udp"},
+		{Number: 2123, Protocol: "udp"},
+	}
+	if !maskStateServerPorts {
+		expected = append(expected, instance.Port{Number: s.env.Config().StatePort(), Protocol: "tcp"})
+		expected = append(expected, instance.Port{Number: s.env.Config().APIPort(), Protocol: "tcp"})
+		instance.SortPorts(expected)
+	}
+	c.Check(ports, gc.DeepEquals, expected)
 }