Merge lp:~axwalk/juju-core/wire-up-prechecker-take2 into lp:~go-bot/juju-core/trunk

[Andrew Wilkins]

Wire up prechecker

We introduce the concept of a policy
into state: state.State is given a
state.Policy interface when opened,
which is consulted during certain
operations to validate or modify
behaviour.

The Policy interface contains only
one method, Prechecker, which is called
to obtain a Prechecker. The Prechecker,
if non-nil, is used to ensure that an
instance with the specified parameters
can potentially be instantiated.

There is currently only one implementation
of Prechecker, and that is the manual
provider's Environ. The manual provider
thus prevents add-machine without ssh-
placement.

https://codereview.appspot.com/61520045/

Wire up prechecker

We introduce the concept of a policy
into state: state.State is given a
state.Policy interface when opened,
which is consulted during certain
operations to validate or modify
behaviour.

The Policy interface contains only
one method, Prechecker, which is called
to obtain a Prechecker. The Prechecker,
if non-nil, is used to ensure that an
instance with the specified parameters
can potentially be instantiated.

There is currently only one implementation
of Prechecker, and that is the manual
provider's Environ. The manual provider
thus prevents add-machine without ssh-
placement.

This CL supersedes https://codereview.appspot.com/14032043/
The primary differences are:
 - up-to-date with latest codebase
 - introduction of Policy, and removal of
   raciness/lack of environ config updates
 - policy is not set on State in juju.NewConn
   methods; prechecking simply will not occur for
   old environments
 - Environ does not embed Prechecker, and there
   is no new EnvironBase struct; this may be
   proposed as a follow-up
 - there is no container prechecking, as otherwise
   we have no lightweight means of deploying charms
   that do not require addressability

https://codereview.appspot.com/61520045/

[Andrew Wilkins (axwalk)]

Reviewers: mp+205700_code.launchpad.net,

Message:
Please take a look.

Description:
Wire up prechecker

This change is to set a Prechecker on
the State object used by the apiserver
in cmd/jujud. The Environ itself is a
Prechecker, and that is what is assigned
to the State object.

State now calls the prechecker when
deciding to create instance/container
machine entries in state. The prechecker
calls are elided for machines with
instance IDs (i.e. "injected" machines).

All Environs, apart from MAAS, disallow
containers. The null provider disallows
everything (unless done "manually").

This CL supersedes https://codereview.appspot.com/14032043/
The primary differences are:
  - up-to-date with latest codebase
  - prechecker is not set on State in juju.NewConn
    methods; prechecking simply will not occur for
    old environments
  - Environ does not embed Prechecker, and there
    is no new EnvironBase struct; this will be
    proposed as a follow-up

The old CL stalled because previously an environment
config would be invalid at first startup of jujud,
because it would lack secrets. This has changed
with synchronous bootstrap and is no longer an issue.

https://code.launchpad.net/~axwalk/juju-core/wire-up-prechecker-take2/+merge/205700

(do not edit description out of merge proposal)

Please review this at https://codereview.appspot.com/61520045/

Affected files (+251, -34 lines):
   A [revision details]
   M cmd/jujud/agent.go
   M cmd/jujud/machine.go
   M environs/interface.go
   M environs/jujutest/livetests.go
   M provider/azure/environ.go
   M provider/ec2/ec2.go
   M provider/ec2/local_test.go
   M provider/local/environ.go
   M provider/local/environ_test.go
   M provider/manual/environ.go
   M provider/openstack/local_test.go
   M provider/openstack/provider.go
   M state/addmachine.go
   A state/prechecker_test.go
   M state/state.go

[William Reade (fwereade)]

On 2014/02/11 06:26:20, axw wrote:
> Please take a look.

Couple of preliminary comments: I'm not actually sure it's correct to
disable containers anywhere, because they still have value as proxy
charms: kapil in particular doesn't want to waste an instance on an ELB
charm, and hulk-smash is a pretty weak alternative.

There's definitely value in prechecking environ instances though.

https://codereview.appspot.com/61520045/

[Andrew Wilkins (axwalk)]

On 2014/02/14 09:28:53, fwereade wrote:
> On 2014/02/11 06:26:20, axw wrote:
> > Please take a look.

> Couple of preliminary comments: I'm not actually sure it's correct to
disable
> containers anywhere, because they still have value as proxy charms:
kapil in
> particular doesn't want to waste an instance on an ELB charm, and
hulk-smash is
> a pretty weak alternative.

Agreed that hulk smash is a crappy alternative, and I know the use case
is there; I was hoping to address it when the time came (this is all
server side).

It doesn't seem ideal to allow containers for everyone, letting users
shoot themselves, to enable ELB, proxies, whatever. It'd be nice to have
something inside the charm that indicates what it requires (or doesn't
require?) so that we know to let those special cases through. OTOH, are
users likely to "add-machine lxc" if they don't know what they're doing?

In any case, there's work to be done. I can change it to allow
containers to begin with.

> There's definitely value in prechecking environ instances though.

https://codereview.appspot.com/61520045/

[William Reade (fwereade)]

On 2014/02/14 09:39:44, axw wrote:
> It doesn't seem ideal to allow containers for everyone, letting users
shoot
> themselves, to enable ELB, proxies, whatever. It'd be nice to have
something
> inside the charm that indicates what it requires (or doesn't require?)
so that
> we know to let those special cases through. OTOH, are users likely to
> "add-machine lxc" if they don't know what they're doing?

Yeah, I think a charm flag (i-dont-need-an-address? ;p) is probably the
best approach. Once we have one of those we can do it all internally,
and expose a cmdline flag for add-machine, for those users who really do
know what they're doing.

> In any case, there's work to be done. I can change it to allow
containers to
> begin with.

Ideal, thanks.

> > There's definitely value in prechecking environ instances though.

https://codereview.appspot.com/61520045/

[William Reade (fwereade)]

possible approach question, please discuss with waigani:

the issue with setting a prechecker, even if it's watched, is raciness.
I was willing to handwave it a bit before, but now we have waigani's use
case which requires that we get *less* racy wrt environ config... how
about setting not a prechecker, but something like a getter: eg
`func(map[string]interface{}) (Prechecker, error)`? This is irrelevant
for your purposes really [0] but critically important for waigani's --
and the only difference is in the type that needs to be returned
(whether it has SetConfig or Precheck). That'd need a bit of finesse but
it'd let you use basically the same implementation for basically the
same task -- *and* mean that you don't need to do the watching followup
(at the cost of an extra db hits when prechecking -- worth it, I think).

*and* we wouldn't need to mess around with locks in state :).

[0] you *could* use it to assert that the environ hasn't changed since
you checked validity of the upcoming op, but the value of that is
somewhat limited I think

https://codereview.appspot.com/61520045/

[Andrew Wilkins (axwalk)]

On 2014/02/17 10:00:17, fwereade wrote:
> possible approach question, please discuss with waigani:

> the issue with setting a prechecker, even if it's watched, is
raciness. I was
> willing to handwave it a bit before, but now we have waigani's use
case which
> requires that we get *less* racy wrt environ config... how about
setting not a
> prechecker, but something like a getter: eg
`func(map[string]interface{})
> (Prechecker, error)`? This is irrelevant for your purposes really [0]
but
> critically important for waigani's -- and the only difference is in
the type
> that needs to be returned (whether it has SetConfig or Precheck).
That'd need a
> bit of finesse but it'd let you use basically the same implementation
for
> basically the same task -- *and* mean that you don't need to do the
watching
> followup (at the cost of an extra db hits when prechecking -- worth
it, I
> think).

I might just create one getter type that can do Precheck or Validate,
but otherwise I like this alternative. I'll look into implementing this,
and discuss with waigani in our standup tomorrow.

> *and* we wouldn't need to mess around with locks in state :).

> [0] you *could* use it to assert that the environ hasn't changed since
you
> checked validity of the upcoming op, but the value of that is somewhat
limited I
> think

Yeah, I don't think we need to go that far.

https://codereview.appspot.com/61520045/

[Andrew Wilkins (axwalk)]

Please take a look.

https://codereview.appspot.com/61520045/

[William Reade (fwereade)]

Looking very nice, basically just quibbles. And I'm not quite clear
about the distinction between a nil policy and a PolicyBase{} -- what
exactly governs which you use in a given situation?

https://codereview.appspot.com/61520045/diff/20001/cmd/jujud/bootstrap_test.go
File cmd/jujud/bootstrap_test.go (right):

https://codereview.appspot.com/61520045/diff/20001/cmd/jujud/bootstrap_test.go#newcode121
cmd/jujud/bootstrap_test.go:121: }, state.DefaultDialOpts(),
state.Policy(nil))
I'm wondering whether it might be good to have a package that implements
environStatePolicy, and includes a state.Open wrapper that always passes
the environ policy in. I'm not sure I can see a use case for alternative
policies at the moment, and if one does show up I think it'll be pretty
easy to add.

As it is I feel it's a bit icky having the nil policies everywhere -- I
think we probably want all our states to work the same in-test and out.
Open to counterarguments though.

https://codereview.appspot.com/61520045/diff/20001/cmd/jujud/statepolicy.go
File cmd/jujud/statepolicy.go (right):

https://codereview.appspot.com/61520045/diff/20001/cmd/jujud/statepolicy.go#newcode25
cmd/jujud/statepolicy.go:25: return p, nil
I don't really like the nil-return-without-error. Can we have a specific
sort of NotImplemented error that we handle explicitly in
precheckInstance, please?

https://codereview.appspot.com/61520045/diff/20001/juju/conn.go
File juju/conn.go (right):

https://codereview.appspot.com/61520045/diff/20001/juju/conn.go#newcode57
juju/conn.go:57: policy := state.PolicyBase{}
This bit doesn't have to use the mooted wrapper, ofc.

*but* I don't quite understand what the benefit is of having a null
policy here. What breaks down if we use a real one?

https://codereview.appspot.com/61520045/diff/20001/state/policy.go
File state/policy.go (right):

https://codereview.appspot.com/61520045/diff/20001/state/policy.go#newcode17
state/policy.go:17: // for any of the interfaces, but should only return
I think you a word.

https://codereview.appspot.com/61520045/diff/20001/state/policy.go#newcode43
state/policy.go:43: return nil, nil
yeah, `nil, nil` scares me. Please change it :).

https://codereview.appspot.com/61520045/

[Andrew Wilkins (axwalk)]

Please take a look.

https://codereview.appspot.com/61520045/diff/20001/cmd/jujud/bootstrap_test.go
File cmd/jujud/bootstrap_test.go (right):

https://codereview.appspot.com/61520045/diff/20001/cmd/jujud/bootstrap_test.go#newcode121
cmd/jujud/bootstrap_test.go:121: }, state.DefaultDialOpts(),
state.Policy(nil))
On 2014/02/18 15:30:18, fwereade wrote:
> I'm wondering whether it might be good to have a package that
implements
> environStatePolicy, and includes a state.Open wrapper that always
passes the
> environ policy in. I'm not sure I can see a use case for alternative
policies at
> the moment, and if one does show up I think it'll be pretty easy to
add.

In any case, juju-core/agent can't use it directly. The policy
implementation requires environs, which depends on agent (which seems a
bit unfortunate.)

I'll just move the policy implementation into environs. The wrappers
aren't really all that useful since they can't be used by both
production and testing code.

> As it is I feel it's a bit icky having the nil policies everywhere --
I think we
> probably want all our states to work the same in-test and out. Open to
> counterarguments though.

No problems. I'd prefer to keep the ones in juju-core/state
self-contained though.

https://codereview.appspot.com/61520045/diff/20001/cmd/jujud/statepolicy.go
File cmd/jujud/statepolicy.go (right):

https://codereview.appspot.com/61520045/diff/20001/cmd/jujud/statepolicy.go#newcode25
cmd/jujud/statepolicy.go:25: return p, nil
On 2014/02/18 15:30:18, fwereade wrote:
> I don't really like the nil-return-without-error. Can we have a
specific sort of
> NotImplemented error that we handle explicitly in precheckInstance,
please?

Done.

https://codereview.appspot.com/61520045/diff/20001/juju/conn.go
File juju/conn.go (right):

https://codereview.appspot.com/61520045/diff/20001/juju/conn.go#newcode57
juju/conn.go:57: policy := state.PolicyBase{}
On 2014/02/18 15:30:18, fwereade wrote:
> This bit doesn't have to use the mooted wrapper, ofc.

> *but* I don't quite understand what the benefit is of having a null
policy here.
> What breaks down if we use a real one?

Nothing actually, this is basically a holdover from when Environ had to
be updated.

I'll move the policy implementation to its own package as suggested and
update this.

https://codereview.appspot.com/61520045/diff/20001/state/policy.go
File state/policy.go (right):

https://codereview.appspot.com/61520045/diff/20001/state/policy.go#newcode17
state/policy.go:17: // for any of the interfaces, but should only return
On 2014/02/18 15:30:18, fwereade wrote:
> I think you a word.

Done.

https://codereview.appspot.com/61520045/diff/20001/state/policy.go#newcode43
state/policy.go:43: return nil, nil
On 2014/02/18 15:30:18, fwereade wrote:
> yeah, `nil, nil` scares me. Please change it :).

Done. Must return an error that satisfies errors.IsNotImplementedError.

https://codereview.appspot.com/61520045/

[William Reade (fwereade)]

LGTM, thanks

https://codereview.appspot.com/61520045/diff/20001/cmd/jujud/bootstrap_test.go
File cmd/jujud/bootstrap_test.go (right):

https://codereview.appspot.com/61520045/diff/20001/cmd/jujud/bootstrap_test.go#newcode121
cmd/jujud/bootstrap_test.go:121: }, state.DefaultDialOpts(),
state.Policy(nil))
On 2014/02/19 07:08:45, axw wrote:
> In any case, juju-core/agent can't use it directly. The policy
implementation
> requires environs, which depends on agent (which seems a bit
unfortunate.)

Grar. Navigate the twisty passages as you must, then. Cheers.

> No problems. I'd prefer to keep the ones in juju-core/state
self-contained
> though.

SGTM

https://codereview.appspot.com/61520045/diff/40001/state/policy.go
File state/policy.go (right):

https://codereview.appspot.com/61520045/diff/40001/state/policy.go#newcode58
state/policy.go:58: logger.Debugf("policy returned nil prechecker,
ignoring")
I think this is really bad behaviour on the policy's part; probably bad
enough to justify erroring out of the AddMachine, because the
implementation is crazy enough that all bets should be considered to be
off.

https://codereview.appspot.com/61520045/

[Andrew Wilkins (axwalk)]

Please take a look.

https://codereview.appspot.com/61520045/diff/40001/state/policy.go
File state/policy.go (right):

https://codereview.appspot.com/61520045/diff/40001/state/policy.go#newcode58
state/policy.go:58: logger.Debugf("policy returned nil prechecker,
ignoring")
On 2014/02/19 13:01:39, fwereade wrote:
> I think this is really bad behaviour on the policy's part; probably
bad enough
> to justify erroring out of the AddMachine, because the implementation
is crazy
> enough that all bets should be considered to be off.

Done.

https://codereview.appspot.com/61520045/

=== modified file 'agent/agent.go'
--- agent/agent.go	2014-02-05 08:01:22 +0000
+++ agent/agent.go	2014-02-20 08:24:11 +0000
@@ -75,7 +75,7 @@
 
 	// OpenState tries to open a direct connection to the state database using
 	// the given Conf.
-	OpenState() (*state.State, error)
+	OpenState(policy state.Policy) (*state.State, error)
 
 	// Write writes the agent configuration.
 	Write() error
@@ -429,7 +429,7 @@
 	return st, password, nil
 }
 
-func (c *configInternal) OpenState() (*state.State, error) {
+func (c *configInternal) OpenState(policy state.Policy) (*state.State, error) {
 	info := state.Info{
 		Addrs:    c.stateDetails.addresses,
 		Password: c.stateDetails.password,
@@ -437,7 +437,7 @@
 		Tag:      c.tag,
 	}
 	if info.Password != "" {
-		st, err := state.Open(&info, state.DefaultDialOpts())
+		st, err := state.Open(&info, state.DefaultDialOpts(), policy)
 		if err == nil {
 			return st, nil
 		}
@@ -448,5 +448,5 @@
 		}
 	}
 	info.Password = c.oldPassword
-	return state.Open(&info, state.DefaultDialOpts())
+	return state.Open(&info, state.DefaultDialOpts(), policy)
 }
 
=== modified file 'agent/bootstrap.go'
--- agent/bootstrap.go	2014-02-05 08:01:22 +0000
+++ agent/bootstrap.go	2014-02-20 08:24:11 +0000
@@ -29,7 +29,7 @@
 // InitializeState returns the newly initialized state and bootstrap
 // machine. If it fails, the state may well be irredeemably compromised.
 type StateInitializer interface {
-	InitializeState(envCfg *config.Config, machineCfg BootstrapMachineConfig, timeout state.DialOpts) (*state.State, *state.Machine, error)
+	InitializeState(envCfg *config.Config, machineCfg BootstrapMachineConfig, timeout state.DialOpts, policy state.Policy) (*state.State, *state.Machine, error)
 }
 
 // MarshalBootstrapJobs may be used to marshal a set of
@@ -67,7 +67,7 @@
 
 const bootstrapMachineId = "0"
 
-func (c *configInternal) InitializeState(envCfg *config.Config, machineCfg BootstrapMachineConfig, timeout state.DialOpts) (*state.State, *state.Machine, error) {
+func (c *configInternal) InitializeState(envCfg *config.Config, machineCfg BootstrapMachineConfig, timeout state.DialOpts, policy state.Policy) (*state.State, *state.Machine, error) {
 	if c.Tag() != names.MachineTag(bootstrapMachineId) {
 		return nil, nil, fmt.Errorf("InitializeState not called with bootstrap machine's configuration")
 	}
@@ -76,7 +76,7 @@
 		CACert: c.caCert,
 	}
 	logger.Debugf("initializing address %v", info.Addrs)
-	st, err := state.Initialize(&info, envCfg, timeout)
+	st, err := state.Initialize(&info, envCfg, timeout, policy)
 	if err != nil {
 		return nil, nil, fmt.Errorf("failed to initialize state: %v", err)
 	}
 
=== modified file 'agent/bootstrap_test.go'
--- agent/bootstrap_test.go	2014-02-05 08:01:22 +0000
+++ agent/bootstrap_test.go	2014-02-20 08:24:11 +0000
@@ -8,6 +8,7 @@
 
 	"launchpad.net/juju-core/agent"
 	"launchpad.net/juju-core/constraints"
+	"launchpad.net/juju-core/environs"
 	"launchpad.net/juju-core/environs/config"
 	"launchpad.net/juju-core/instance"
 	"launchpad.net/juju-core/state"
@@ -71,7 +72,7 @@
 	envCfg, err := config.New(config.NoDefaults, envAttrs)
 	c.Assert(err, gc.IsNil)
 
-	st, m, err := cfg.InitializeState(envCfg, mcfg, state.DialOpts{})
+	st, m, err := cfg.InitializeState(envCfg, mcfg, state.DialOpts{}, environs.NewStatePolicy())
 	c.Assert(err, gc.IsNil)
 	defer st.Close()
 
@@ -106,7 +107,7 @@
 	c.Assert(newCfg.Tag(), gc.Equals, "machine-0")
 	c.Assert(agent.Password(newCfg), gc.Not(gc.Equals), pwHash)
 	c.Assert(agent.Password(newCfg), gc.Not(gc.Equals), testing.DefaultMongoPassword)
-	st1, err := cfg.OpenState()
+	st1, err := cfg.OpenState(environs.NewStatePolicy())
 	c.Assert(err, gc.IsNil)
 	defer st1.Close()
 }
@@ -136,13 +137,13 @@
 	envCfg, err := config.New(config.NoDefaults, envAttrs)
 	c.Assert(err, gc.IsNil)
 
-	st, _, err := cfg.InitializeState(envCfg, mcfg, state.DialOpts{})
+	st, _, err := cfg.InitializeState(envCfg, mcfg, state.DialOpts{}, environs.NewStatePolicy())
 	c.Assert(err, gc.IsNil)
 	err = st.SetAdminMongoPassword("")
 	c.Check(err, gc.IsNil)
 	st.Close()
 
-	st, _, err = cfg.InitializeState(envCfg, mcfg, state.DialOpts{})
+	st, _, err = cfg.InitializeState(envCfg, mcfg, state.DialOpts{}, environs.NewStatePolicy())
 	if err == nil {
 		st.Close()
 	}
@@ -156,7 +157,7 @@
 		Tag:      "",
 		Password: password,
 	}
-	st, err := state.Open(info, state.DialOpts{})
+	st, err := state.Open(info, state.DialOpts{}, environs.NewStatePolicy())
 	c.Assert(err, gc.IsNil)
 	defer st.Close()
 	_, err = st.Machine("0")
 
=== modified file 'cmd/jujud/agent.go'
--- cmd/jujud/agent.go	2014-01-28 14:31:58 +0000
+++ cmd/jujud/agent.go	2014-02-20 08:24:11 +0000
@@ -12,6 +12,7 @@
 
 	"launchpad.net/juju-core/agent"
 	"launchpad.net/juju-core/cmd"
+	"launchpad.net/juju-core/environs"
 	"launchpad.net/juju-core/errors"
 	"launchpad.net/juju-core/state"
 	"launchpad.net/juju-core/state/api"
@@ -146,7 +147,7 @@
 }
 
 func openState(agentConfig agent.Config, a Agent) (*state.State, AgentState, error) {
-	st, err := agentConfig.OpenState()
+	st, err := agentConfig.OpenState(environs.NewStatePolicy())
 	if err != nil {
 		return nil, nil, err
 	}
 
=== modified file 'cmd/jujud/agent_test.go'
--- cmd/jujud/agent_test.go	2014-02-19 02:25:30 +0000
+++ cmd/jujud/agent_test.go	2014-02-20 08:24:11 +0000
@@ -13,6 +13,7 @@
 	"launchpad.net/juju-core/agent"
 	agenttools "launchpad.net/juju-core/agent/tools"
 	"launchpad.net/juju-core/cmd"
+	"launchpad.net/juju-core/environs"
 	envtesting "launchpad.net/juju-core/environs/testing"
 	envtools "launchpad.net/juju-core/environs/tools"
 	"launchpad.net/juju-core/juju/testing"
@@ -323,7 +324,7 @@
 func (s *agentSuite) assertCanOpenState(c *gc.C, tag, dataDir string) {
 	config, err := agent.ReadConf(dataDir, tag)
 	c.Assert(err, gc.IsNil)
-	st, err := config.OpenState()
+	st, err := config.OpenState(environs.NewStatePolicy())
 	c.Assert(err, gc.IsNil)
 	st.Close()
 }
@@ -331,7 +332,7 @@
 func (s *agentSuite) assertCannotOpenState(c *gc.C, tag, dataDir string) {
 	config, err := agent.ReadConf(dataDir, tag)
 	c.Assert(err, gc.IsNil)
-	_, err = config.OpenState()
+	_, err = config.OpenState(environs.NewStatePolicy())
 	expectErr := fmt.Sprintf("cannot log in to juju database as %q: unauthorized mongo access: auth fails", tag)
 	c.Assert(err, gc.ErrorMatches, expectErr)
 }
 
=== modified file 'cmd/jujud/bootstrap.go'
--- cmd/jujud/bootstrap.go	2014-02-05 08:01:22 +0000
+++ cmd/jujud/bootstrap.go	2014-02-20 08:24:11 +0000
@@ -15,6 +15,7 @@
 	"launchpad.net/juju-core/agent"
 	"launchpad.net/juju-core/cmd"
 	"launchpad.net/juju-core/constraints"
+	"launchpad.net/juju-core/environs"
 	"launchpad.net/juju-core/environs/bootstrap"
 	"launchpad.net/juju-core/environs/cloudinit"
 	"launchpad.net/juju-core/environs/config"
@@ -96,7 +97,7 @@
 		Jobs:            jobs,
 		InstanceId:      bsState.StateInstances[0],
 		Characteristics: characteristics,
-	}, state.DefaultDialOpts())
+	}, state.DefaultDialOpts(), environs.NewStatePolicy())
 	if err != nil {
 		return err
 	}
 
=== modified file 'cmd/jujud/bootstrap_test.go'
--- cmd/jujud/bootstrap_test.go	2014-02-05 08:01:22 +0000
+++ cmd/jujud/bootstrap_test.go	2014-02-20 08:24:11 +0000
@@ -13,6 +13,7 @@
 
 	"launchpad.net/juju-core/agent"
 	"launchpad.net/juju-core/constraints"
+	"launchpad.net/juju-core/environs"
 	"launchpad.net/juju-core/environs/bootstrap"
 	"launchpad.net/juju-core/environs/jujutest"
 	"launchpad.net/juju-core/errors"
@@ -118,7 +119,7 @@
 		Addrs:    []string{testing.MgoServer.Addr()},
 		CACert:   []byte(testing.CACert),
 		Password: testPasswordHash(),
-	}, state.DefaultDialOpts())
+	}, state.DefaultDialOpts(), environs.NewStatePolicy())
 	c.Assert(err, gc.IsNil)
 	defer st.Close()
 	machines, err := st.AllMachines()
@@ -145,7 +146,7 @@
 		Addrs:    []string{testing.MgoServer.Addr()},
 		CACert:   []byte(testing.CACert),
 		Password: testPasswordHash(),
-	}, state.DefaultDialOpts())
+	}, state.DefaultDialOpts(), environs.NewStatePolicy())
 	c.Assert(err, gc.IsNil)
 	defer st.Close()
 	cons, err := st.EnvironConstraints()
@@ -174,7 +175,7 @@
 		Addrs:    []string{testing.MgoServer.Addr()},
 		CACert:   []byte(testing.CACert),
 		Password: testPasswordHash(),
-	}, state.DefaultDialOpts())
+	}, state.DefaultDialOpts(), environs.NewStatePolicy())
 	c.Assert(err, gc.IsNil)
 	defer st.Close()
 	m, err := st.Machine("0")
@@ -199,7 +200,7 @@
 		Addrs:    []string{testing.MgoServer.Addr()},
 		CACert:   []byte(testing.CACert),
 		Password: testPasswordHash(),
-	}, state.DefaultDialOpts())
+	}, state.DefaultDialOpts(), environs.NewStatePolicy())
 	c.Assert(err, gc.IsNil)
 	defer st.Close()
 	m, err := st.Machine("0")
@@ -208,7 +209,7 @@
 }
 
 func testOpenState(c *gc.C, info *state.Info, expectErrType error) {
-	st, err := state.Open(info, state.DefaultDialOpts())
+	st, err := state.Open(info, state.DefaultDialOpts(), environs.NewStatePolicy())
 	if st != nil {
 		st.Close()
 	}
@@ -236,7 +237,7 @@
 
 	// Check we can log in to mongo as admin.
 	info.Tag, info.Password = "", testPasswordHash()
-	st, err := state.Open(info, state.DefaultDialOpts())
+	st, err := state.Open(info, state.DefaultDialOpts(), environs.NewStatePolicy())
 	c.Assert(err, gc.IsNil)
 	// Reset password so the tests can continue to use the same server.
 	defer st.Close()
@@ -254,7 +255,7 @@
 	machineConf1, err := agent.ReadConf(machineConf.DataDir(), "machine-0")
 	c.Assert(err, gc.IsNil)
 
-	st, err = machineConf1.OpenState()
+	st, err = machineConf1.OpenState(environs.NewStatePolicy())
 	c.Assert(err, gc.IsNil)
 	defer st.Close()
 }
 
=== modified file 'cmd/plugins/juju-restore/restore.go'
--- cmd/plugins/juju-restore/restore.go	2014-02-13 02:46:58 +0000
+++ cmd/plugins/juju-restore/restore.go	2014-02-20 08:24:11 +0000
@@ -187,7 +187,7 @@
 		CACert:   caCert,
 		Tag:      creds.Tag,
 		Password: creds.Password,
-	}, state.DefaultDialOpts())
+	}, state.DefaultDialOpts(), environs.NewStatePolicy())
 	if err != nil {
 		return fmt.Errorf("cannot open state: %v", err)
 	}
 
=== modified file 'environs/errors.go'
--- environs/errors.go	2013-09-27 08:14:36 +0000
+++ environs/errors.go	2014-02-20 08:24:11 +0000
@@ -12,27 +12,3 @@
 	ErrNoInstances      = errors.New("no instances found")
 	ErrPartialInstances = errors.New("only some instances were found")
 )
-
-// containersUnsupportedError indicates that the environment does not support
-// creation of containers.
-type containersUnsupportedError struct {
-	msg string
-}
-
-func (e *containersUnsupportedError) Error() string {
-	return e.msg
-}
-
-// IsContainersUnsupportedError reports whether the error
-// was created by NewContainersUnsupportedError.
-func IsContainersUnsupportedError(err error) bool {
-	_, ok := err.(*containersUnsupportedError)
-	return ok
-}
-
-// NewContainersUnsupportedError returns a new error
-// which satisfies IsContainersUnsupported and reports
-// the given message.
-func NewContainersUnsupported(msg string) error {
-	return &containersUnsupportedError{msg: msg}
-}
 
=== modified file 'environs/interface.go'
--- environs/interface.go	2014-02-13 03:16:09 +0000
+++ environs/interface.go	2014-02-20 08:24:11 +0000
@@ -71,28 +71,6 @@
 	Config() *config.Config
 }
 
-// Prechecker is an optional interface that an Environ may implement,
-// in order to support pre-flight checking of instance/container creation.
-//
-// Prechecker's methods are best effort, and not guaranteed to eliminate
-// all invalid parameters. If a precheck method returns nil, it is not
-// guaranteed that the constraints are valid; if a non-nil error is
-// returned, then the constraints are definitely invalid.
-type Prechecker interface {
-	// PrecheckInstance performs a preflight check on the specified
-	// series and constraints, ensuring that they are possibly valid for
-	// creating an instance in this environment.
-	PrecheckInstance(series string, cons constraints.Value) error
-
-	// PrecheckContainer performs a preflight check on the container type,
-	// ensuring that the environment is possibly capable of creating a
-	// container of the specified type and series.
-	//
-	// The container type must be a valid ContainerType as specified
-	// in the instance package, and != instance.NONE.
-	PrecheckContainer(series string, kind instance.ContainerType) error
-}
-
 // An Environ represents a juju environment as specified
 // in the environments.yaml file.
 //
@@ -180,6 +158,10 @@
 
 	// Provider returns the EnvironProvider that created this Environ.
 	Provider() EnvironProvider
+
+	// TODO(axw) 2014-02-11 #pending-review
+	//     Embed state.Prechecker, and introduce an EnvironBase
+	//     that embeds a no-op prechecker implementation.
 }
 
 // BootstrapContext is an interface that is passed to
 
=== modified file 'environs/jujutest/livetests.go'
--- environs/jujutest/livetests.go	2014-02-13 02:46:58 +0000
+++ environs/jujutest/livetests.go	2014-02-20 08:24:11 +0000
@@ -159,22 +159,12 @@
 func (t *LiveTests) TestPrechecker(c *gc.C) {
 	// Providers may implement Prechecker. If they do, then they should
 	// return nil for empty constraints (excluding the null provider).
-	prechecker, ok := t.Env.(environs.Prechecker)
+	prechecker, ok := t.Env.(state.Prechecker)
 	if !ok {
 		return
 	}
-
-	const series = "precise"
-	var cons constraints.Value
-	c.Check(prechecker.PrecheckInstance(series, cons), gc.IsNil)
-
-	err := prechecker.PrecheckContainer(series, instance.LXC)
-	// If err is nil, that is fine, some providers support containers.
-	if err != nil {
-		// But for ones that don't, they should have a standard error format.
-		c.Check(err, gc.ErrorMatches, ".*provider does not support .*containers")
-		c.Check(err, jc.Satisfies, environs.IsContainersUnsupportedError)
-	}
+	err := prechecker.PrecheckInstance("precise", constraints.Value{})
+	c.Assert(err, gc.IsNil)
 }
 
 // TestStartStop is similar to Tests.TestStartStop except
 
=== added file 'environs/statepolicy.go'
--- environs/statepolicy.go	1970-01-01 00:00:00 +0000
+++ environs/statepolicy.go	2014-02-20 08:24:11 +0000
@@ -0,0 +1,34 @@
+// Copyright 2014 Canonical Ltd.
+// Licensed under the AGPLv3, see LICENCE file for details.
+
+package environs
+
+import (
+	"launchpad.net/juju-core/environs/config"
+	"launchpad.net/juju-core/errors"
+	"launchpad.net/juju-core/state"
+)
+
+// environStatePolicy implements state.Policy in
+// terms of environs.Environ and related types.
+type environStatePolicy struct{}
+
+var _ state.Policy = environStatePolicy{}
+
+// NewStatePolicy returns a state.Policy that is
+// implemented in terms of Environ and related
+// types.
+func NewStatePolicy() state.Policy {
+	return environStatePolicy{}
+}
+
+func (environStatePolicy) Prechecker(cfg *config.Config) (state.Prechecker, error) {
+	env, err := New(cfg)
+	if err != nil {
+		return nil, err
+	}
+	if p, ok := env.(state.Prechecker); ok {
+		return p, nil
+	}
+	return nil, errors.NewNotImplementedError("Prechecker")
+}
 
=== modified file 'juju/conn.go'
--- juju/conn.go	2014-01-28 17:07:55 +0000
+++ juju/conn.go	2014-02-20 08:24:11 +0000
@@ -54,7 +54,7 @@
 
 	info.Password = password
 	opts := state.DefaultDialOpts()
-	st, err := state.Open(info, opts)
+	st, err := state.Open(info, opts, environs.NewStatePolicy())
 	if errors.IsUnauthorizedError(err) {
 		log.Noticef("juju: authorization error while connecting to state server; retrying")
 		// We can't connect with the administrator password,;
@@ -66,7 +66,7 @@
 		// connecting to mongo before the state has been
 		// initialized and the initial password set.
 		for a := redialStrategy.Start(); a.Next(); {
-			st, err = state.Open(info, opts)
+			st, err = state.Open(info, opts, environs.NewStatePolicy())
 			if !errors.IsUnauthorizedError(err) {
 				break
 			}
 
=== modified file 'juju/conn_test.go'
--- juju/conn_test.go	2014-02-13 02:46:58 +0000
+++ juju/conn_test.go	2014-02-20 08:24:11 +0000
@@ -140,7 +140,7 @@
 	info, _, err := env.StateInfo()
 	c.Assert(err, gc.IsNil)
 	info.Password = utils.UserPasswordHash("side-effect secret", utils.CompatSalt)
-	st, err := state.Open(info, state.DefaultDialOpts())
+	st, err := state.Open(info, state.DefaultDialOpts(), environs.NewStatePolicy())
 	c.Assert(err, gc.IsNil)
 	defer assertClose(c, st)
 
@@ -230,7 +230,7 @@
 	info, _, err := env.StateInfo()
 	c.Assert(err, gc.IsNil)
 	info.Password = utils.UserPasswordHash("nutkin", utils.CompatSalt)
-	st, err := state.Open(info, state.DefaultDialOpts())
+	st, err := state.Open(info, state.DefaultDialOpts(), environs.NewStatePolicy())
 	c.Assert(err, gc.IsNil)
 	assertClose(c, st)
 
@@ -242,7 +242,7 @@
 	// Check that the password has now been changed to the original
 	// admin password.
 	info.Password = "nutkin"
-	st1, err := state.Open(info, state.DefaultDialOpts())
+	st1, err := state.Open(info, state.DefaultDialOpts(), environs.NewStatePolicy())
 	c.Assert(err, gc.IsNil)
 	assertClose(c, st1)
 
 
=== modified file 'provider/azure/environ.go'
--- provider/azure/environ.go	2014-01-29 06:45:16 +0000
+++ provider/azure/environ.go	2014-02-20 08:24:11 +0000
@@ -123,18 +123,6 @@
 	return key, nil
 }
 
-// PrecheckInstance is specified in the environs.Prechecker interface.
-func (*azureEnviron) PrecheckInstance(series string, cons constraints.Value) error {
-	return nil
-}
-
-// PrecheckContainer is specified in the environs.Prechecker interface.
-func (*azureEnviron) PrecheckContainer(series string, kind instance.ContainerType) error {
-	// This check can either go away or be relaxed when the azure
-	// provider manages container addressibility.
-	return environs.NewContainersUnsupported("azure provider does not support containers")
-}
-
 // Name is specified in the Environ interface.
 func (env *azureEnviron) Name() string {
 	return env.name
 
=== modified file 'provider/azure/environ_test.go'
--- provider/azure/environ_test.go	2014-01-29 06:45:16 +0000
+++ provider/azure/environ_test.go	2014-02-20 08:24:11 +0000
@@ -93,15 +93,6 @@
 	c.Check(env.Name(), gc.Equals, env.name)
 }
 
-func (*environSuite) TestPrecheck(c *gc.C) {
-	env := azureEnviron{name: "foo"}
-	var cons constraints.Value
-	err := env.PrecheckInstance("saucy", cons)
-	c.Check(err, gc.IsNil)
-	err = env.PrecheckContainer("saucy", instance.LXC)
-	c.Check(err, gc.ErrorMatches, "azure provider does not support containers")
-}
-
 func (*environSuite) TestConfigReturnsConfig(c *gc.C) {
 	cfg := new(config.Config)
 	ecfg := azureEnvironConfig{Config: cfg}
 
=== modified file 'provider/dummy/environs.go'
--- provider/dummy/environs.go	2014-02-20 04:59:31 +0000
+++ provider/dummy/environs.go	2014-02-20 08:24:11 +0000
@@ -146,8 +146,9 @@
 // environProvider represents the dummy provider.  There is only ever one
 // instance of this type (providerInstance)
 type environProvider struct {
-	mu  sync.Mutex
-	ops chan<- Operation
+	mu          sync.Mutex
+	ops         chan<- Operation
+	statePolicy state.Policy
 	// We have one state for each environment name
 	state      map[int]*environState
 	maxStateId int
@@ -164,6 +165,7 @@
 	id           int
 	name         string
 	ops          chan<- Operation
+	statePolicy  state.Policy
 	mu           sync.Mutex
 	maxId        int // maximum instance id allocated so far.
 	insts        map[instance.Id]*dummyInstance
@@ -225,6 +227,7 @@
 	if testing.MgoServer.Addr() != "" {
 		testing.MgoServer.Reset()
 	}
+	providerInstance.statePolicy = environs.NewStatePolicy()
 }
 
 func (state *environState) destroy() {
@@ -262,10 +265,11 @@
 // newState creates the state for a new environment with the
 // given name and starts an http server listening for
 // storage requests.
-func newState(name string, ops chan<- Operation) *environState {
+func newState(name string, ops chan<- Operation, policy state.Policy) *environState {
 	s := &environState{
 		name:        name,
 		ops:         ops,
+		statePolicy: policy,
 		insts:       make(map[instance.Id]*dummyInstance),
 		globalPorts: make(map[instance.Port]bool),
 	}
@@ -287,6 +291,15 @@
 	go http.Serve(l, mux)
 }
 
+// SetStatePolicy sets the state.Policy to use when a
+// state server is initialised by dummy.
+func SetStatePolicy(policy state.Policy) {
+	p := &providerInstance
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	p.statePolicy = policy
+}
+
 // Listen closes the previously registered listener (if any).
 // Subsequent operations on any dummy environment can be received on c
 // (if not nil).
@@ -450,7 +463,7 @@
 			panic(fmt.Errorf("cannot share a state between two dummy environs; old %q; new %q", old.name, name))
 		}
 	}
-	state := newState(name, p.ops)
+	state := newState(name, p.ops, p.statePolicy)
 	p.maxStateId++
 	state.id = p.maxStateId
 	p.state[state.id] = state
@@ -574,7 +587,7 @@
 		// so that we can call it here.
 
 		info := stateInfo()
-		st, err := state.Initialize(info, cfg, state.DefaultDialOpts())
+		st, err := state.Initialize(info, cfg, state.DefaultDialOpts(), estate.statePolicy)
 		if err != nil {
 			panic(err)
 		}
 
=== modified file 'provider/ec2/ec2.go'
--- provider/ec2/ec2.go	2014-02-13 02:46:58 +0000
+++ provider/ec2/ec2.go	2014-02-20 08:24:11 +0000
@@ -306,18 +306,6 @@
 	return s3
 }
 
-// PrecheckInstance is specified in the environs.Prechecker interface.
-func (e *environ) PrecheckInstance(series string, cons constraints.Value) error {
-	return nil
-}
-
-// PrecheckContainer is specified in the environs.Prechecker interface.
-func (e *environ) PrecheckContainer(series string, kind instance.ContainerType) error {
-	// This check can either go away or be relaxed when the ec2
-	// provider manages container addressibility.
-	return environs.NewContainersUnsupported("ec2 provider does not support containers")
-}
-
 func (e *environ) Name() string {
 	return e.name
 }
 
=== modified file 'provider/ec2/local_test.go'
--- provider/ec2/local_test.go	2014-02-13 02:46:58 +0000
+++ provider/ec2/local_test.go	2014-02-20 08:24:11 +0000
@@ -229,17 +229,6 @@
 	t.srv.stopServer(c)
 }
 
-func (t *localServerSuite) TestPrecheck(c *gc.C) {
-	env := t.Prepare(c)
-	prechecker, ok := env.(environs.Prechecker)
-	c.Assert(ok, jc.IsTrue)
-	var cons constraints.Value
-	err := prechecker.PrecheckInstance("precise", cons)
-	c.Check(err, gc.IsNil)
-	err = prechecker.PrecheckContainer("precise", instance.LXC)
-	c.Check(err, gc.ErrorMatches, "ec2 provider does not support containers")
-}
-
 func (t *localServerSuite) TestBootstrapInstanceUserDataAndState(c *gc.C) {
 	env := t.Prepare(c)
 	envtesting.UploadFakeTools(c, env.Storage())
 
=== modified file 'provider/local/environ.go'
--- provider/local/environ.go	2014-02-18 01:29:47 +0000
+++ provider/local/environ.go	2014-02-20 08:24:11 +0000
@@ -82,18 +82,6 @@
 	return fmt.Sprintf("/etc/rsyslog.d/25-juju-%s.conf", env.config.namespace())
 }
 
-// PrecheckInstance is specified in the environs.Prechecker interface.
-func (*localEnviron) PrecheckInstance(series string, cons constraints.Value) error {
-	return nil
-}
-
-// PrecheckContainer is specified in the environs.Prechecker interface.
-func (*localEnviron) PrecheckContainer(series string, kind instance.ContainerType) error {
-	// This check can either go away or be relaxed when the local
-	// provider can do nested containers.
-	return environs.NewContainersUnsupported("local provider does not support nested containers")
-}
-
 func ensureNotRoot() error {
 	if checkIfRoot() {
 		return fmt.Errorf("bootstrapping a local environment must not be done as root")
 
=== modified file 'provider/local/environ_test.go'
--- provider/local/environ_test.go	2014-02-18 17:29:25 +0000
+++ provider/local/environ_test.go	2014-02-20 08:24:11 +0000
@@ -20,7 +20,6 @@
 	"launchpad.net/juju-core/environs/jujutest"
 	envtesting "launchpad.net/juju-core/environs/testing"
 	"launchpad.net/juju-core/environs/tools"
-	"launchpad.net/juju-core/instance"
 	"launchpad.net/juju-core/provider/local"
 	"launchpad.net/juju-core/state"
 	coretesting "launchpad.net/juju-core/testing"
@@ -76,21 +75,6 @@
 	c.Assert(strings.Contains(url, "/tools"), jc.IsTrue)
 }
 
-func (s *environSuite) TestPrecheck(c *gc.C) {
-	testConfig := minimalConfig(c)
-	environ, err := local.Provider.Open(testConfig)
-	c.Assert(err, gc.IsNil)
-	var cons constraints.Value
-	prechecker, ok := environ.(environs.Prechecker)
-	c.Assert(ok, jc.IsTrue)
-
-	err = prechecker.PrecheckInstance("precise", cons)
-	c.Check(err, gc.IsNil)
-
-	err = prechecker.PrecheckContainer("precise", instance.LXC)
-	c.Check(err, gc.ErrorMatches, "local provider does not support nested containers")
-}
-
 type localJujuTestSuite struct {
 	baseProviderSuite
 	jujutest.Tests
 
=== modified file 'provider/manual/environ.go'
--- provider/manual/environ.go	2014-02-13 03:16:09 +0000
+++ provider/manual/environ.go	2014-02-20 08:24:11 +0000
@@ -231,6 +231,10 @@
 	return err
 }
 
+func (*manualEnviron) PrecheckInstance(series string, cons constraints.Value) error {
+	return errors.New(`use "juju add-machine ssh:[user@]<host>" to provision machines`)
+}
+
 func (e *manualEnviron) OpenPorts(ports []instance.Port) error {
 	return nil
 }
 
=== modified file 'provider/openstack/local_test.go'
--- provider/openstack/local_test.go	2014-02-18 01:29:47 +0000
+++ provider/openstack/local_test.go	2014-02-20 08:24:11 +0000
@@ -252,17 +252,6 @@
 	s.LoggingSuite.TearDownTest(c)
 }
 
-func (s *localServerSuite) TestPrecheck(c *gc.C) {
-	var cons constraints.Value
-	env := s.Prepare(c)
-	prechecker, ok := env.(environs.Prechecker)
-	c.Assert(ok, jc.IsTrue)
-	err := prechecker.PrecheckInstance("precise", cons)
-	c.Check(err, gc.IsNil)
-	err = prechecker.PrecheckContainer("precise", instance.LXC)
-	c.Check(err, gc.ErrorMatches, "openstack provider does not support containers")
-}
-
 // If the bootstrap node is configured to require a public IP address,
 // bootstrapping fails if an address cannot be allocated.
 func (s *localServerSuite) TestBootstrapFailsWhenPublicIPError(c *gc.C) {
 
=== modified file 'provider/openstack/provider.go'
--- provider/openstack/provider.go	2014-02-13 02:46:58 +0000
+++ provider/openstack/provider.go	2014-02-20 08:24:11 +0000
@@ -483,18 +483,6 @@
 	return nova
 }
 
-// PrecheckInstance is specified in the environs.Prechecker interface.
-func (*environ) PrecheckInstance(series string, cons constraints.Value) error {
-	return nil
-}
-
-// PrecheckContainer is specified in the environs.Prechecker interface.
-func (*environ) PrecheckContainer(series string, kind instance.ContainerType) error {
-	// This check can either go away or be relaxed when the openstack
-	// provider manages container addressibility.
-	return environs.NewContainersUnsupported("openstack provider does not support containers")
-}
-
 func (e *environ) Name() string {
 	return e.name
 }
 
=== modified file 'state/addmachine.go'
--- state/addmachine.go	2014-01-25 11:45:42 +0000
+++ state/addmachine.go	2014-02-20 08:24:11 +0000
@@ -218,6 +218,11 @@
 	if err != nil {
 		return nil, nil, err
 	}
+	if template.InstanceId == "" {
+		if err := st.precheckInstance(template.Series, template.Constraints); err != nil {
+			return nil, nil, err
+		}
+	}
 	seq, err := st.sequence("machine")
 	if err != nil {
 		return nil, nil, err
@@ -331,6 +336,15 @@
 	if err != nil {
 		return nil, nil, err
 	}
+	if containerType == "" {
+		return nil, nil, fmt.Errorf("no container type specified")
+	}
+	if parentTemplate.InstanceId == "" {
+		if err := st.precheckInstance(parentTemplate.Series, parentTemplate.Constraints); err != nil {
+			return nil, nil, err
+		}
+	}
+
 	parentDoc := machineDocForTemplate(parentTemplate, strconv.Itoa(seq))
 	newId, err := st.newContainerId(parentDoc.Id, containerType)
 	if err != nil {
 
=== modified file 'state/api/agent/machine_test.go'
--- state/api/agent/machine_test.go	2013-11-05 10:25:28 +0000
+++ state/api/agent/machine_test.go	2014-02-20 08:24:11 +0000
@@ -9,6 +9,7 @@
 
 	gc "launchpad.net/gocheck"
 
+	"launchpad.net/juju-core/environs"
 	"launchpad.net/juju-core/errors"
 	"launchpad.net/juju-core/juju/testing"
 	"launchpad.net/juju-core/state"
@@ -83,7 +84,7 @@
 }
 
 func tryOpenState(info *state.Info) error {
-	st, err := state.Open(info, state.DialOpts{})
+	st, err := state.Open(info, state.DialOpts{}, environs.NewStatePolicy())
 	if err == nil {
 		st.Close()
 	}
 
=== modified file 'state/apiserver/client/api_test.go'
--- state/apiserver/client/api_test.go	2014-01-23 20:30:35 +0000
+++ state/apiserver/client/api_test.go	2014-02-20 08:24:11 +0000
@@ -11,6 +11,7 @@
 	gc "launchpad.net/gocheck"
 
 	"launchpad.net/juju-core/constraints"
+	"launchpad.net/juju-core/environs"
 	"launchpad.net/juju-core/environs/config"
 	"launchpad.net/juju-core/errors"
 	"launchpad.net/juju-core/instance"
@@ -111,7 +112,7 @@
 	stateInfo.Password = password
 	st, err := state.Open(stateInfo, state.DialOpts{
 		Timeout: 25 * time.Millisecond,
-	})
+	}, environs.NewStatePolicy())
 	if err == nil {
 		st.Close()
 	}
 
=== modified file 'state/compat_test.go'
--- state/compat_test.go	2014-01-09 10:37:28 +0000
+++ state/compat_test.go	2014-02-20 08:24:11 +0000
@@ -36,7 +36,7 @@
 func (s *compatSuite) SetUpTest(c *gc.C) {
 	s.LoggingSuite.SetUpTest(c)
 	s.MgoSuite.SetUpTest(c)
-	s.state = TestingInitialize(c, nil)
+	s.state = TestingInitialize(c, nil, Policy(nil))
 	env, err := s.state.Environment()
 	c.Assert(err, gc.IsNil)
 	s.env = env
 
=== modified file 'state/conn_test.go'
--- state/conn_test.go	2013-12-03 14:05:19 +0000
+++ state/conn_test.go	2014-02-20 08:24:11 +0000
@@ -9,6 +9,8 @@
 	"labix.org/v2/mgo"
 	gc "launchpad.net/gocheck"
 
+	"launchpad.net/juju-core/environs/config"
+	"launchpad.net/juju-core/errors"
 	"launchpad.net/juju-core/state"
 	"launchpad.net/juju-core/testing"
 	"launchpad.net/juju-core/testing/testbase"
@@ -32,6 +34,7 @@
 	units        *mgo.Collection
 	stateServers *mgo.Collection
 	State        *state.State
+	policy       mockPolicy
 }
 
 func (cs *ConnSuite) SetUpSuite(c *gc.C) {
@@ -47,7 +50,8 @@
 func (cs *ConnSuite) SetUpTest(c *gc.C) {
 	cs.LoggingSuite.SetUpTest(c)
 	cs.MgoSuite.SetUpTest(c)
-	cs.State = state.TestingInitialize(c, nil)
+	cs.policy = mockPolicy{}
+	cs.State = state.TestingInitialize(c, nil, &cs.policy)
 	cs.annotations = cs.MgoSuite.Session.DB("juju").C("annotations")
 	cs.charms = cs.MgoSuite.Session.DB("juju").C("charms")
 	cs.machines = cs.MgoSuite.Session.DB("juju").C("machines")
@@ -88,3 +92,14 @@
 func (s *ConnSuite) AddMetaCharm(c *gc.C, name, metaYaml string, revsion int) *state.Charm {
 	return state.AddCustomCharm(c, s.State, name, "metadata.yaml", metaYaml, "quantal", revsion)
 }
+
+type mockPolicy struct {
+	getPrechecker func(*config.Config) (state.Prechecker, error)
+}
+
+func (p *mockPolicy) Prechecker(cfg *config.Config) (state.Prechecker, error) {
+	if p.getPrechecker != nil {
+		return p.getPrechecker(cfg)
+	}
+	return nil, errors.NewNotImplementedError("Prechecker")
+}
 
=== modified file 'state/environ_test.go'
--- state/environ_test.go	2014-02-03 09:44:12 +0000
+++ state/environ_test.go	2014-02-20 08:24:11 +0000
@@ -40,7 +40,7 @@
 	s.State.Close()
 	s.MgoSuite.TearDownTest(c)
 	s.MgoSuite.SetUpTest(c)
-	s.State = state.TestingInitialize(c, nil)
+	s.State = state.TestingInitialize(c, nil, state.Policy(nil))
 	env, err := s.State.Environment()
 	c.Assert(err, gc.IsNil)
 	uuidB := env.UUID()
 
=== modified file 'state/export_test.go'
--- state/export_test.go	2014-02-17 12:57:06 +0000
+++ state/export_test.go	2014-02-20 08:24:11 +0000
@@ -94,14 +94,22 @@
 	})
 }
 
+// SetPolicy updates the State's policy field to the
+// given Policy, and returns the old value.
+func SetPolicy(st *State, p Policy) Policy {
+	old := st.policy
+	st.policy = p
+	return old
+}
+
 // TestingInitialize initializes the state and returns it. If state was not
 // already initialized, and cfg is nil, the minimal default environment
 // configuration will be used.
-func TestingInitialize(c *gc.C, cfg *config.Config) *State {
+func TestingInitialize(c *gc.C, cfg *config.Config, policy Policy) *State {
 	if cfg == nil {
 		cfg = testing.EnvironConfig(c)
 	}
-	st, err := Initialize(TestingStateInfo(), cfg, TestingDialOpts())
+	st, err := Initialize(TestingStateInfo(), cfg, TestingDialOpts(), policy)
 	c.Assert(err, gc.IsNil)
 	return st
 }
 
=== modified file 'state/initialize_test.go'
--- state/initialize_test.go	2013-12-11 09:14:12 +0000
+++ state/initialize_test.go	2014-02-20 08:24:11 +0000
@@ -37,7 +37,7 @@
 	s.LoggingSuite.SetUpTest(c)
 	s.MgoSuite.SetUpTest(c)
 	var err error
-	s.State, err = state.Open(state.TestingStateInfo(), state.TestingDialOpts())
+	s.State, err = state.Open(state.TestingStateInfo(), state.TestingDialOpts(), state.Policy(nil))
 	c.Assert(err, gc.IsNil)
 }
 
@@ -59,7 +59,7 @@
 
 	cfg := testing.EnvironConfig(c)
 	initial := cfg.AllAttrs()
-	st, err := state.Initialize(state.TestingStateInfo(), cfg, state.TestingDialOpts())
+	st, err := state.Initialize(state.TestingStateInfo(), cfg, state.TestingDialOpts(), state.Policy(nil))
 	c.Assert(err, gc.IsNil)
 	c.Assert(st, gc.NotNil)
 	err = st.Close()
@@ -85,7 +85,7 @@
 func (s *InitializeSuite) TestDoubleInitializeConfig(c *gc.C) {
 	cfg := testing.EnvironConfig(c)
 	initial := cfg.AllAttrs()
-	st := state.TestingInitialize(c, cfg)
+	st := state.TestingInitialize(c, cfg, state.Policy(nil))
 	st.Close()
 
 	// A second initialize returns an open *State, but ignores its params.
@@ -93,7 +93,7 @@
 	// for originally...
 	cfg, err := cfg.Apply(map[string]interface{}{"authorized-keys": "something-else"})
 	c.Assert(err, gc.IsNil)
-	st, err = state.Initialize(state.TestingStateInfo(), cfg, state.TestingDialOpts())
+	st, err = state.Initialize(state.TestingStateInfo(), cfg, state.TestingDialOpts(), state.Policy(nil))
 	c.Assert(err, gc.IsNil)
 	c.Assert(st, gc.NotNil)
 	st.Close()
@@ -108,11 +108,11 @@
 	good := testing.EnvironConfig(c)
 	bad, err := good.Apply(map[string]interface{}{"admin-secret": "foo"})
 
-	_, err = state.Initialize(state.TestingStateInfo(), bad, state.TestingDialOpts())
+	_, err = state.Initialize(state.TestingStateInfo(), bad, state.TestingDialOpts(), state.Policy(nil))
 	c.Assert(err, gc.ErrorMatches, "admin-secret should never be written to the state")
 
 	// admin-secret blocks SetEnvironConfig.
-	st := state.TestingInitialize(c, good)
+	st := state.TestingInitialize(c, good, state.Policy(nil))
 	st.Close()
 	err = s.State.SetEnvironConfig(bad, good)
 	c.Assert(err, gc.ErrorMatches, "admin-secret should never be written to the state")
@@ -131,11 +131,11 @@
 	bad, err := config.New(config.NoDefaults, attrs)
 	c.Assert(err, gc.IsNil)
 
-	_, err = state.Initialize(state.TestingStateInfo(), bad, state.TestingDialOpts())
+	_, err = state.Initialize(state.TestingStateInfo(), bad, state.TestingDialOpts(), state.Policy(nil))
 	c.Assert(err, gc.ErrorMatches, "agent-version must always be set in state")
 
 	// Bad agent-version blocks SetEnvironConfig.
-	st := state.TestingInitialize(c, good)
+	st := state.TestingInitialize(c, good, state.Policy(nil))
 	st.Close()
 	err = s.State.SetEnvironConfig(bad, good)
 	c.Assert(err, gc.ErrorMatches, "agent-version must always be set in state")
 
=== modified file 'state/megawatcher_internal_test.go'
--- state/megawatcher_internal_test.go	2014-01-24 13:28:02 +0000
+++ state/megawatcher_internal_test.go	2014-02-20 08:24:11 +0000
@@ -47,7 +47,7 @@
 func (s *storeManagerStateSuite) SetUpTest(c *gc.C) {
 	s.LoggingSuite.SetUpTest(c)
 	s.MgoSuite.SetUpTest(c)
-	s.State = TestingInitialize(c, nil)
+	s.State = TestingInitialize(c, nil, Policy(nil))
 	s.State.AddUser("admin", "pass")
 }
 
 
=== modified file 'state/open.go'
--- state/open.go	2014-02-07 18:38:02 +0000
+++ state/open.go	2014-02-20 08:24:11 +0000
@@ -69,8 +69,13 @@
 // Open connects to the server described by the given
 // info, waits for it to be initialized, and returns a new State
 // representing the environment connected to.
-// It returns unauthorizedError if access is unauthorized.
-func Open(info *Info, opts DialOpts) (*State, error) {
+//
+// A policy may be provided, which will be used to validate and
+// modify behaviour of certain operations in state. A nil policy
+// may be provided.
+//
+// Open returns unauthorizedError if access is unauthorized.
+func Open(info *Info, opts DialOpts, policy Policy) (*State, error) {
 	logger.Infof("opening state; mongo addresses: %q; entity %q", info.Addrs, info.Tag)
 	if len(info.Addrs) == 0 {
 		return nil, stderrors.New("no mongo addresses")
@@ -110,7 +115,7 @@
 		return nil, err
 	}
 	logger.Infof("connection established")
-	st, err := newState(session, info)
+	st, err := newState(session, info, policy)
 	if err != nil {
 		session.Close()
 		return nil, err
@@ -122,8 +127,8 @@
 // Initialize sets up an initial empty state and returns it.
 // This needs to be performed only once for a given environment.
 // It returns unauthorizedError if access is unauthorized.
-func Initialize(info *Info, cfg *config.Config, opts DialOpts) (rst *State, err error) {
-	st, err := Open(info, opts)
+func Initialize(info *Info, cfg *config.Config, opts DialOpts, policy Policy) (rst *State, err error) {
+	st, err := Open(info, opts, policy)
 	if err != nil {
 		return nil, err
 	}
@@ -217,7 +222,7 @@
 	return false
 }
 
-func newState(session *mgo.Session, info *Info) (*State, error) {
+func newState(session *mgo.Session, info *Info, policy Policy) (*State, error) {
 	db := session.DB("juju")
 	pdb := session.DB("presence")
 	if info.Tag != "" {
@@ -235,6 +240,7 @@
 	}
 	st := &State{
 		info:           info,
+		policy:         policy,
 		db:             db,
 		environments:   db.C("environments"),
 		charms:         db.C("charms"),
 
=== added file 'state/policy.go'
--- state/policy.go	1970-01-01 00:00:00 +0000
+++ state/policy.go	2014-02-20 08:24:11 +0000
@@ -0,0 +1,63 @@
+// Copyright 2014 Canonical Ltd.
+// Licensed under the AGPLv3, see LICENCE file for details.
+
+package state
+
+import (
+	"fmt"
+
+	"launchpad.net/juju-core/constraints"
+	"launchpad.net/juju-core/environs/config"
+	"launchpad.net/juju-core/errors"
+)
+
+// Policy is an interface provided to State that may
+// be consulted by State to validate or modify the
+// behaviour of certain operations.
+//
+// If a Policy implementation does not implement one
+// of the methods, it must return an error that
+// satisfies errors.IsNotImplemented, and will thus
+// be ignored. Any other error will cause an error
+// in the use of the policy.
+type Policy interface {
+	// Prechecker takes a *config.Config and returns
+	// a (possibly nil) Prechecker or an error.
+	Prechecker(*config.Config) (Prechecker, error)
+}
+
+// Prechecker is a policy interface that is provided to State
+// to perform pre-flight checking of instance creation.
+type Prechecker interface {
+	// PrecheckInstance performs a preflight check on the specified
+	// series and constraints, ensuring that they are possibly valid for
+	// creating an instance in this environment.
+	//
+	// PrecheckInstance is best effort, and not guaranteed to eliminate
+	// all invalid parameters. If PrecheckInstance returns nil, it is not
+	// guaranteed that the constraints are valid; if a non-nil error is
+	// returned, then the constraints are definitely invalid.
+	PrecheckInstance(series string, cons constraints.Value) error
+}
+
+// precheckInstance calls the state's assigned policy, if non-nil, to obtain
+// a Prechecker, and calls PrecheckInstance if a non-nil Prechecker is returned.
+func (st *State) precheckInstance(series string, cons constraints.Value) error {
+	if st.policy == nil {
+		return nil
+	}
+	cfg, err := st.EnvironConfig()
+	if err != nil {
+		return err
+	}
+	prechecker, err := st.policy.Prechecker(cfg)
+	if errors.IsNotImplementedError(err) {
+		return nil
+	} else if err != nil {
+		return err
+	}
+	if prechecker == nil {
+		return fmt.Errorf("policy returned nil prechecker without an error")
+	}
+	return prechecker.PrecheckInstance(series, cons)
+}
 
=== added file 'state/prechecker_test.go'
--- state/prechecker_test.go	1970-01-01 00:00:00 +0000
+++ state/prechecker_test.go	2014-02-20 08:24:11 +0000
@@ -0,0 +1,132 @@
+// Copyright 2014 Canonical Ltd.
+// Licensed under the AGPLv3, see LICENCE file for details.
+
+package state_test
+
+import (
+	"fmt"
+
+	gc "launchpad.net/gocheck"
+
+	"launchpad.net/juju-core/constraints"
+	"launchpad.net/juju-core/environs/config"
+	"launchpad.net/juju-core/errors"
+	"launchpad.net/juju-core/instance"
+	"launchpad.net/juju-core/state"
+)
+
+type PrecheckerSuite struct {
+	ConnSuite
+	prechecker mockPrechecker
+}
+
+var _ = gc.Suite(&PrecheckerSuite{})
+
+type mockPrechecker struct {
+	precheckInstanceError       error
+	precheckInstanceSeries      string
+	precheckInstanceConstraints constraints.Value
+}
+
+func (p *mockPrechecker) PrecheckInstance(series string, cons constraints.Value) error {
+	p.precheckInstanceSeries = series
+	p.precheckInstanceConstraints = cons
+	return p.precheckInstanceError
+}
+
+func (s *PrecheckerSuite) SetUpTest(c *gc.C) {
+	s.ConnSuite.SetUpTest(c)
+	s.prechecker = mockPrechecker{}
+	s.policy.getPrechecker = func(*config.Config) (state.Prechecker, error) {
+		return &s.prechecker, nil
+	}
+}
+
+func (s *PrecheckerSuite) TestPrecheckInstance(c *gc.C) {
+	// PrecheckInstance should be called with the specified
+	// series, and the specified constraints merged with the
+	// environment constraints, when attempting to create an
+	// instance.
+	envCons := constraints.MustParse("mem=4G")
+	template, err := s.addOneMachine(c, envCons)
+	c.Assert(err, gc.IsNil)
+	c.Assert(s.prechecker.precheckInstanceSeries, gc.Equals, template.Series)
+	cons := template.Constraints.WithFallbacks(envCons)
+	c.Assert(s.prechecker.precheckInstanceConstraints, gc.DeepEquals, cons)
+}
+
+func (s *PrecheckerSuite) TestPrecheckErrors(c *gc.C) {
+	// Ensure that AddOneMachine fails when PrecheckInstance returns an error.
+	s.prechecker.precheckInstanceError = fmt.Errorf("no instance for you")
+	_, err := s.addOneMachine(c, constraints.Value{})
+	c.Assert(err, gc.ErrorMatches, ".*no instance for you")
+
+	// If the policy's Prechecker method fails, that will be returned first.
+	s.policy.getPrechecker = func(*config.Config) (state.Prechecker, error) {
+		return nil, fmt.Errorf("no prechecker for you")
+	}
+	_, err = s.addOneMachine(c, constraints.Value{})
+	c.Assert(err, gc.ErrorMatches, ".*no prechecker for you")
+}
+
+func (s *PrecheckerSuite) TestPrecheckPrecheckerUnimplemented(c *gc.C) {
+	var precheckerErr error
+	s.policy.getPrechecker = func(*config.Config) (state.Prechecker, error) {
+		return nil, precheckerErr
+	}
+	_, err := s.addOneMachine(c, constraints.Value{})
+	c.Assert(err, gc.ErrorMatches, "cannot add a new machine: policy returned nil prechecker without an error")
+	precheckerErr = errors.NewNotImplementedError("Prechecker")
+	_, err = s.addOneMachine(c, constraints.Value{})
+	c.Assert(err, gc.IsNil)
+}
+
+func (s *PrecheckerSuite) TestPrecheckNoPolicy(c *gc.C) {
+	s.policy.getPrechecker = func(*config.Config) (state.Prechecker, error) {
+		c.Errorf("should not have been invoked")
+		return nil, nil
+	}
+	state.SetPolicy(s.State, nil)
+	_, err := s.addOneMachine(c, constraints.Value{})
+	c.Assert(err, gc.IsNil)
+}
+
+func (s *PrecheckerSuite) addOneMachine(c *gc.C, envCons constraints.Value) (state.MachineTemplate, error) {
+	err := s.State.SetEnvironConstraints(envCons)
+	c.Assert(err, gc.IsNil)
+	oneJob := []state.MachineJob{state.JobHostUnits}
+	extraCons := constraints.MustParse("cpu-cores=4")
+	template := state.MachineTemplate{
+		Series:      "precise",
+		Constraints: extraCons,
+		Jobs:        oneJob,
+	}
+	_, err = s.State.AddOneMachine(template)
+	return template, err
+}
+
+func (s *PrecheckerSuite) TestPrecheckInstanceInjectMachine(c *gc.C) {
+	template := state.MachineTemplate{
+		InstanceId: instance.Id("bootstrap"),
+		Series:     "precise",
+		Nonce:      state.BootstrapNonce,
+		Jobs:       []state.MachineJob{state.JobManageEnviron},
+	}
+	_, err := s.State.AddOneMachine(template)
+	c.Assert(err, gc.IsNil)
+	// PrecheckInstance should not have been called, as we've
+	// injected a machine with an existing instance.
+	c.Assert(s.prechecker.precheckInstanceSeries, gc.Equals, "")
+}
+
+func (s *PrecheckerSuite) TestPrecheckContainerNewMachine(c *gc.C) {
+	// Attempting to add a container to a new machine should cause
+	// PrecheckInstance to be called.
+	template := state.MachineTemplate{
+		Series: "precise",
+		Jobs:   []state.MachineJob{state.JobHostUnits},
+	}
+	_, err := s.State.AddMachineInsideNewMachine(template, template, instance.LXC)
+	c.Assert(err, gc.IsNil)
+	c.Assert(s.prechecker.precheckInstanceSeries, gc.Equals, template.Series)
+}
 
=== modified file 'state/settings_test.go'
--- state/settings_test.go	2014-02-07 16:32:23 +0000
+++ state/settings_test.go	2014-02-20 08:24:11 +0000
@@ -53,7 +53,7 @@
 	s.LoggingSuite.SetUpTest(c)
 	s.MgoSuite.SetUpTest(c)
 	// TODO(dfc) this logic is duplicated with the metawatcher_test.
-	state, err := Open(TestingStateInfo(), TestingDialOpts())
+	state, err := Open(TestingStateInfo(), TestingDialOpts(), Policy(nil))
 	c.Assert(err, gc.IsNil)
 
 	s.state = state
 
=== modified file 'state/state.go'
--- state/state.go	2014-02-05 17:46:02 +0000
+++ state/state.go	2014-02-20 08:24:11 +0000
@@ -44,6 +44,7 @@
 // managed by juju.
 type State struct {
 	info             *Info
+	policy           Policy
 	db               *mgo.Database
 	environments     *mgo.Collection
 	charms           *mgo.Collection
 
=== modified file 'state/state_test.go'
--- state/state_test.go	2014-02-14 11:39:37 +0000
+++ state/state_test.go	2014-02-20 08:24:11 +0000
@@ -54,7 +54,7 @@
 func (s *StateSuite) TestDialAgain(c *gc.C) {
 	// Ensure idempotent operations on Dial are working fine.
 	for i := 0; i < 2; i++ {
-		st, err := state.Open(state.TestingStateInfo(), state.TestingDialOpts())
+		st, err := state.Open(state.TestingStateInfo(), state.TestingDialOpts(), state.Policy(nil))
 		c.Assert(err, gc.IsNil)
 		c.Assert(st.Close(), gc.IsNil)
 	}
@@ -1854,7 +1854,7 @@
 }
 
 func tryOpenState(info *state.Info) error {
-	st, err := state.Open(info, state.TestingDialOpts())
+	st, err := state.Open(info, state.TestingDialOpts(), state.Policy(nil))
 	if err == nil {
 		st.Close()
 	}
@@ -1881,7 +1881,7 @@
 	info.Addrs = []string{"0.1.2.3:1234"}
 	st, err := state.Open(info, state.DialOpts{
 		Timeout: 1 * time.Millisecond,
-	})
+	}, state.Policy(nil))
 	if err == nil {
 		st.Close()
 	}
@@ -1897,7 +1897,7 @@
 	t0 := time.Now()
 	st, err := state.Open(info, state.DialOpts{
 		Timeout: 1 * time.Millisecond,
-	})
+	}, state.Policy(nil))
 	if err == nil {
 		st.Close()
 	}
@@ -1993,7 +1993,7 @@
 
 func testSetMongoPassword(c *gc.C, getEntity func(st *state.State) (entity, error)) {
 	info := state.TestingStateInfo()
-	st, err := state.Open(info, state.TestingDialOpts())
+	st, err := state.Open(info, state.TestingDialOpts(), state.Policy(nil))
 	c.Assert(err, gc.IsNil)
 	defer st.Close()
 	// Turn on fully-authenticated mode.
@@ -2014,7 +2014,7 @@
 
 	// Check that we can log in with the correct password.
 	info.Password = "foo"
-	st1, err := state.Open(info, state.TestingDialOpts())
+	st1, err := state.Open(info, state.TestingDialOpts(), state.Policy(nil))
 	c.Assert(err, gc.IsNil)
 	defer st1.Close()
 
@@ -2634,7 +2634,7 @@
 // interact with the closed state, causing it to return an
 // unexpected error (often "Closed explictly").
 func testWatcherDiesWhenStateCloses(c *gc.C, startWatcher func(c *gc.C, st *state.State) waiter) {
-	st, err := state.Open(state.TestingStateInfo(), state.TestingDialOpts())
+	st, err := state.Open(state.TestingStateInfo(), state.TestingDialOpts(), state.Policy(nil))
 	c.Assert(err, gc.IsNil)
 	watcher := startWatcher(c, st)
 	err = st.Close()
@@ -2676,7 +2676,7 @@
 	c.Assert(err, gc.NotNil)
 	c.Assert(info, gc.IsNil)
 
-	st, err := state.Open(state.TestingStateInfo(), state.TestingDialOpts())
+	st, err := state.Open(state.TestingStateInfo(), state.TestingDialOpts(), state.Policy(nil))
 	c.Assert(err, gc.IsNil)
 	defer st.Close()
 
@@ -2695,7 +2695,7 @@
 	c.Assert(err, gc.IsNil)
 	c.Assert(info, jc.DeepEquals, &state.StateServerInfo{})
 
-	st, err := state.Open(state.TestingStateInfo(), state.TestingDialOpts())
+	st, err := state.Open(state.TestingStateInfo(), state.TestingDialOpts(), state.Policy(nil))
 	c.Assert(err, gc.IsNil)
 	defer st.Close()
 
@@ -2726,7 +2726,7 @@
 	c.Assert(info.MachineIds, gc.HasLen, 0)
 	c.Assert(info.VotingMachineIds, gc.HasLen, 0)
 
-	st, err := state.Open(state.TestingStateInfo(), state.TestingDialOpts())
+	st, err := state.Open(state.TestingStateInfo(), state.TestingDialOpts(), state.Policy(nil))
 	c.Assert(err, gc.IsNil)
 	defer st.Close()
 
 
=== modified file 'state/unit_test.go'
--- state/unit_test.go	2014-01-15 06:52:56 +0000
+++ state/unit_test.go	2014-02-20 08:24:11 +0000
@@ -633,7 +633,7 @@
 	c.Assert(err, gc.IsNil)
 
 	info := state.TestingStateInfo()
-	st, err := state.Open(info, state.TestingDialOpts())
+	st, err := state.Open(info, state.TestingDialOpts(), state.Policy(nil))
 	c.Assert(err, gc.IsNil)
 	defer st.Close()
 	// Turn on fully-authenticated mode.
@@ -663,7 +663,7 @@
 	// Connect as the machine entity.
 	info.Tag = m.Tag()
 	info.Password = "foo"
-	st1, err := state.Open(info, state.TestingDialOpts())
+	st1, err := state.Open(info, state.TestingDialOpts(), state.Policy(nil))
 	c.Assert(err, gc.IsNil)
 	defer st1.Close()
 
@@ -678,7 +678,7 @@
 	// that entity, change the password for a new unit.
 	info.Tag = unit.Tag()
 	info.Password = "bar"
-	st2, err := state.Open(info, state.TestingDialOpts())
+	st2, err := state.Open(info, state.TestingDialOpts(), state.Policy(nil))
 	c.Assert(err, gc.IsNil)
 	defer st2.Close()
 
 
=== modified file 'worker/provisioner/provisioner_test.go'
--- worker/provisioner/provisioner_test.go	2014-01-28 12:29:38 +0000
+++ worker/provisioner/provisioner_test.go	2014-02-20 08:24:11 +0000
@@ -57,6 +57,12 @@
 }
 
 func (s *CommonProvisionerSuite) SetUpTest(c *gc.C) {
+	// Disable the default state policy, because the
+	// provisioner needs to be able to test pathological
+	// scenarios where a machine exists in state with
+	// invalid environment config.
+	dummy.SetStatePolicy(nil)
+
 	s.JujuConnSuite.SetUpTest(c)
 	// Create the operations channel with more than enough space
 	// for those tests that don't listen on it.