Merge lp:~dmitriis/charms/trusty/neutron-contrail/trunk into lp:~sdn-charmers/charms/trusty/neutron-contrail/trunk

[Dmitrii Shcherbakov]

[Dmitrii Shcherbakov (dmitriis)]

Note: easyrsa charm should be used for PKI https://jujucharms.com/u/containers/easyrsa/

juju add-relation contrail-control easyrsa
juju add-relation neutron-contrail easyrsa

[lp:~dmitriis/charms/trusty/neutron-contrail/trunk]

67. By Dmitrii Shcherbakov on 2017-03-26

enable TLS for XMPP communication as of contrail 3

TLS is enabled unconditionally for contail 3.0 and above deployments to
make sure communication is secure by default.

Certificates are generated automatically from a PKI charm (e.g. easyrsa
with a subject alternative name field containing an IP address on a
control network which is used by both contrail-control and
neutron-contrail to communicate with each other.

As of Juju 2.x network spaces can be used if an underlying cloud
supports them. In order to facilitate that support one should bind
control-node endpoint to a specific network space. Otherwise, old
mechanisms such as unit private address are going to be used to retrieve
an ip address to be included into a certificate.

Control node address fetching mechanism has changed as well: instead of
just doing a relation-get for a private IP address of a control-node
unit a different value is taken from the relation data called
control_node_ip (available due to modifications on the contrail-control
side) - it is either an address in the network space which control-node
endpoint is bound to or a fall-back address (unit private address).

Unmerged revisions

67. By Dmitrii Shcherbakov on 2017-03-26

enable TLS for XMPP communication as of contrail 3

TLS is enabled unconditionally for contail 3.0 and above deployments to
make sure communication is secure by default.

Certificates are generated automatically from a PKI charm (e.g. easyrsa
with a subject alternative name field containing an IP address on a
control network which is used by both contrail-control and
neutron-contrail to communicate with each other.

As of Juju 2.x network spaces can be used if an underlying cloud
supports them. In order to facilitate that support one should bind
control-node endpoint to a specific network space. Otherwise, old
mechanisms such as unit private address are going to be used to retrieve
an ip address to be included into a certificate.

Control node address fetching mechanism has changed as well: instead of
just doing a relation-get for a private IP address of a control-node
unit a different value is taken from the relation data called
control_node_ip (available due to modifications on the contrail-control
side) - it is either an address in the network space which control-node
endpoint is bound to or a fall-back address (unit private address).

66. By Dmitrii Shcherbakov on 2017-03-20

hooks,utils: pep8 refactoring

=== modified file 'hooks/neutron_contrail_hooks.py'
--- hooks/neutron_contrail_hooks.py	2017-03-10 12:57:45 +0000
+++ hooks/neutron_contrail_hooks.py	2017-03-26 17:44:17 +0000
@@ -18,7 +18,8 @@
     log,
     relation_get,
     relation_ids,
-    relation_set
+    relation_set,
+    local_unit,
 )
 
 from charmhelpers.core.host import (
@@ -37,6 +38,7 @@
     CONTRAIL_VERSION,
     OPENSTACK_VERSION,
     configure_vrouter,
+    control_network_ip,
     disable_vrouter_vgw,
     dpkg_version,
     drop_caches,
@@ -57,23 +59,25 @@
     write_nodemgr_config,
     write_vnc_api_config,
     write_vrouter_config,
-    write_vrouter_vgw_interfaces
+    write_vrouter_vgw_interfaces,
+    write_xmpp_tls_files,
 )
 
-PACKAGES = [ "contrail-vrouter-dkms", "contrail-vrouter-agent",
-             "contrail-utils", "python-jinja2", "python-netifaces",
-             "python-netaddr", "contrail-nodemgr" ]
-
-PACKAGES_LBAAS = [ "python-barbicanclient", "haproxy" ]
-
-PACKAGES_VROUTER = [ "contrail-nova-driver" ]
-
-PACKAGES_VROUTER_3_2 = [ "contrail-nova-vif", "contrail-vrouter-init",
-                         "contrail-vrouter-common" ]
+PACKAGES = ["contrail-vrouter-dkms", "contrail-vrouter-agent",
+            "contrail-utils", "python-jinja2", "python-netifaces",
+            "python-netaddr", "contrail-nodemgr"]
+
+PACKAGES_LBAAS = ["python-barbicanclient", "haproxy"]
+
+PACKAGES_VROUTER = ["contrail-nova-driver"]
+
+PACKAGES_VROUTER_3_2 = ["contrail-nova-vif", "contrail-vrouter-init",
+                        "contrail-vrouter-common"]
 
 hooks = Hooks()
 config = config()
 
+
 def check_local_metadata():
     if not is_leader():
         return
@@ -95,11 +99,13 @@
         unprovision_local_metadata()
         leader_set({"local-metadata-provisioned": ""})
 
+
 def check_vrouter():
     # check relation dependencies
     if config_get("contrail-api-ready") \
        and config_get("control-node-ready") \
-       and config_get("identity-admin-ready"):
+       and config_get("identity-admin-ready") \
+       and config_get("tls-certificates-ready"):
         if not config_get("vrouter-provisioned"):
             provision_vrouter()
             config["vrouter-provisioned"] = True
@@ -107,33 +113,36 @@
         unprovision_vrouter()
         config["vrouter-provisioned"] = False
 
+
 @hooks.hook("config-changed")
 def config_changed():
     configure_local_metadata()
     configure_virtual_gateways()
     write_config()
     if not units("contrail-discovery") and not units("control-node"):
-        config["control-node-ready"] = True if config.get("discovery-server-ip") \
-                                            else False
+        config["control-node-ready"] = True \
+            if config.get("discovery-server-ip") else False
     if not units("contrail-api"):
         config["contrail-api-ready"] = True if config.get("contrail-api-ip") \
-                                            else False
+            else False
     check_vrouter()
     check_local_metadata()
 
+
 def config_get(key):
     try:
         return config[key]
     except KeyError:
         return None
 
+
 def configure_local_metadata():
     if config["local-metadata-server"]:
         if "local-metadata-secret" not in config:
             # generate secret
             secret = str(uuid.uuid4())
             config["local-metadata-secret"] = secret
-            settings = { "metadata-shared-secret": secret }
+            settings = {"metadata-shared-secret": secret}
             # inform relations
             for rid in relation_ids("neutron-plugin"):
                 relation_set(relation_id=rid, relation_settings=settings)
@@ -141,42 +150,47 @@
         if "local-metadata-secret" in config:
             # remove secret
             del config["local-metadata-secret"]
-            settings = { "metadata-shared-secret": None }
+            settings = {"metadata-shared-secret": None}
             # inform relations
             for rid in relation_ids("neutron-plugin"):
                 relation_set(relation_id=rid, relation_settings=settings)
 
+
 def configure_virtual_gateways():
     gateways = config.get("virtual-gateways")
     previous_gateways = config_get("virtual-gateways-prev")
     if gateways != previous_gateways:
         # create/destroy virtual gateway interfaces according to new value
-        interfaces = { gateway["interface"]: set(gateway["subnets"])
-                       for gateway in yaml.safe_load(gateways) } \
-                     if gateways else {}
-        previous_interfaces = { gateway["interface"]: set(gateway["subnets"])
-                                for gateway in yaml.safe_load(previous_gateways) } \
-                              if previous_gateways else {}
-        ifaces = [ interface for interface, subnets in previous_interfaces.iteritems()
-                   if interface not in interfaces
-                   or subnets != interfaces[interface] ]
+        interfaces = {gateway["interface"]: set(gateway["subnets"])
+                      for gateway in yaml.safe_load(gateways)} \
+            if gateways else {}
+        previous_interfaces = {gateway["interface"]: set(gateway["subnets"])
+                               for gateway
+                               in yaml.safe_load(previous_gateways)} \
+            if previous_gateways else {}
+        ifaces = [interface for interface, subnets
+                  in previous_interfaces.iteritems()
+                  if interface not in interfaces
+                  or subnets != interfaces[interface]]
         if ifaces:
             ifdown(ifaces)
 
-        write_vrouter_vgw_interfaces()
-
-        ifaces = [ interface for interface, subnets in interfaces.iteritems()
-                   if interface not in previous_interfaces
-                   or subnets != previous_interfaces[interface] ]
-        if ifaces:
-            ifup(ifaces)
-
-        if interfaces:
-            enable_vrouter_vgw()
-        else:
-            disable_vrouter_vgw()
-
-        config["virtual-gateways-prev"] = gateways
+            write_vrouter_vgw_interfaces()
+
+            ifaces = [interface for interface, subnets
+                      in interfaces.iteritems()
+                      if interface not in previous_interfaces
+                      or subnets != previous_interfaces[interface]]
+            if ifaces:
+                ifup(ifaces)
+
+            if interfaces:
+                enable_vrouter_vgw()
+            else:
+                disable_vrouter_vgw()
+
+            config["virtual-gateways-prev"] = gateways
+
 
 @hooks.hook("contrail-api-relation-departed")
 @hooks.hook("contrail-api-relation-broken")
@@ -187,6 +201,7 @@
         check_local_metadata()
     write_vnc_api_config()
 
+
 @hooks.hook("contrail-api-relation-changed")
 def contrail_api_changed():
     if not relation_get("port"):
@@ -197,6 +212,7 @@
     check_vrouter()
     check_local_metadata()
 
+
 @hooks.hook("contrail-discovery-relation-changed")
 def contrail_discovery_changed():
     if not relation_get("port"):
@@ -207,6 +223,7 @@
     check_vrouter()
     check_local_metadata()
 
+
 @hooks.hook("contrail-discovery-relation-departed")
 @hooks.hook("contrail-discovery-relation-broken")
 def contrail_discovery_departed():
@@ -218,12 +235,18 @@
         check_local_metadata()
     contrail_discovery_relation()
 
-@restart_on_change({"/etc/contrail/contrail-vrouter-agent.conf": ["contrail-vrouter-agent"],
-                    "/etc/contrail/contrail-vrouter-nodemgr.conf": ["contrail-vrouter-nodemgr"]})
+
+@restart_on_change(
+    {
+        "/etc/contrail/contrail-vrouter-agent.conf":
+        ["contrail-vrouter-agent"],
+        "/etc/contrail/contrail-vrouter-nodemgr.conf":
+        ["contrail-vrouter-nodemgr"]})
 def contrail_discovery_relation():
     write_vrouter_config()
     write_nodemgr_config()
 
+
 @hooks.hook("control-node-relation-departed")
 @hooks.hook("control-node-relation-broken")
 def control_node_departed():
@@ -235,6 +258,7 @@
         check_local_metadata()
     control_node_relation()
 
+
 @hooks.hook("control-node-relation-changed")
 def control_node_changed():
     control_node_relation()
@@ -242,10 +266,13 @@
     check_vrouter()
     check_local_metadata()
 
-@restart_on_change({"/etc/contrail/contrail-vrouter-agent.conf": ["contrail-vrouter-agent"]})
+
+@restart_on_change(
+    {"/etc/contrail/contrail-vrouter-agent.conf": ["contrail-vrouter-agent"]})
 def control_node_relation():
     write_vrouter_config()
 
+
 @hooks.hook("identity-admin-relation-changed")
 def identity_admin_changed():
     if not relation_get("service_hostname"):
@@ -258,6 +285,7 @@
     check_vrouter()
     check_local_metadata()
 
+
 @hooks.hook("identity-admin-relation-departed")
 @hooks.hook("identity-admin-relation-broken")
 def identity_admin_departed():
@@ -269,11 +297,12 @@
     if version_compare(CONTRAIL_VERSION, "3.0.2.0-34") >= 0:
         write_barbican_auth_config()
 
+
 @hooks.hook()
 def install():
     configure_sources(True, "install-sources", "install-keys")
     apt_upgrade(fatal=True, dist=True)
-    fix_vrouter_scripts() # bug in 2.0+20141015.1 packages
+    fix_vrouter_scripts()  # bug in 2.0+20141015.1 packages
     apt_install(PACKAGES, fatal=True)
     utils.CONTRAIL_VERSION = dpkg_version("contrail-vrouter-agent")
     if version_compare(utils.CONTRAIL_VERSION, "3.2") >= 0:
@@ -293,13 +322,15 @@
     try:
         modprobe("vrouter")
     except CalledProcessError:
-        log("vrouter kernel module failed to load, clearing pagecache and retrying")
+        log("vrouter kernel module failed to load,"
+            " clearing pagecache and retrying")
         drop_caches()
         modprobe("vrouter")
     modprobe("vrouter", True, True)
     configure_vrouter()
     service_restart("nova-compute")
 
+
 @hooks.hook("neutron-metadata-relation-changed")
 def neutron_metadata_changed():
     if not relation_get("shared-secret"):
@@ -307,43 +338,96 @@
         return
     neutron_metadata_relation()
 
+
 @hooks.hook("neutron-metadata-relation-departed")
 @hooks.hook("neutron-metadata-relation-broken")
-@restart_on_change({"/etc/contrail/contrail-vrouter-agent.conf": ["contrail-vrouter-agent"]})
+@restart_on_change(
+    {"/etc/contrail/contrail-vrouter-agent.conf": ["contrail-vrouter-agent"]})
 def neutron_metadata_relation():
     write_vrouter_config()
 
+
 @hooks.hook("neutron-plugin-relation-joined")
 def neutron_plugin_joined():
     # create plugin config
     section = []
     if version_compare(OPENSTACK_VERSION, "1:2015.1~") < 0:
         if version_compare(OPENSTACK_VERSION, "1:2014.2") >= 0:
-            section.append(("network_api_class", "nova_contrail_vif.contrailvif.ContrailNetworkAPI"))
+            section.append(("network_api_class",
+                            "nova_contrail_vif.contrailvif"
+                            ".ContrailNetworkAPI"))
         else:
-            section.append(("libvirt_vif_driver", "nova_contrail_vif.contrailvif.VRouterVIFDriver"))
-    section.append(("firewall_driver", "nova.virt.firewall.NoopFirewallDriver"))
+            section.append(("libvirt_vif_driver",
+                            "nova_contrail_vif.contrailvif.VRouterVIFDriver"))
+    section.append(
+        ("firewall_driver",
+         "nova.virt.firewall.NoopFirewallDriver"))
     conf = {
-      "nova-compute": {
-        "/etc/nova/nova.conf": {
-          "sections": {
-            "DEFAULT": section
-          }
+        "nova-compute": {
+            "/etc/nova/nova.conf": {
+                "sections": {
+                    "DEFAULT": section
+                }
+            }
         }
-      }
     }
     relation_set(subordinate_configuration=json.dumps(conf))
 
     if config["local-metadata-server"]:
-        settings = { "metadata-shared-secret": config["local-metadata-secret"] }
+        settings = {"metadata-shared-secret": config["local-metadata-secret"]}
         relation_set(relation_settings=settings)
 
+
[e-mail]('tls-certificates-relation-joined')
+def tls_certificates_relation_joined():
+    # a hostname could also be provided as a SAN
+    # (Subject Alternative Name) but having this one
+    # has certain implications
+    # https://tools.ietf.org/html/rfc2818#section-3.1
+    # "If a subjectAltName extension of type dNSName
+    # is present, that MUST be used as the identity"
+    # Therefore it is not used here as we don't need
+    # a DNS infrastructure dependency
+    ip_san = control_network_ip()
+    settings = {
+        'sans': json.dumps([ip_san, '127.0.0.1']),
+        'common_name': ip_san,
+        'certificate_name': local_unit().replace('/', '_')
+    }
+    relation_set(relation_settings=settings)
+
+
[e-mail]('tls-certificates-relation-changed')
+def tls_certificates_relation_changed():
+    # check that the -provides side have set the data we need
+    # and render the affected files
+    unitname = local_unit().replace('/', '_')
+    cert = '{0}.server.cert'.format(unitname)
+    key = '{0}.server.key'.format(unitname)
+    certv = relation_get(cert)
+    keyv = relation_get(key)
+    ca = relation_get('ca')
+
+    if certv and keyv and ca:
+        write_xmpp_tls_files(certv, keyv, ca)
+        config["tls-certificates-ready"] = True
+    else:
+        log('tls-certificates relation data is not fully available')
+        config["tls-certificates-ready"] = False
+
+
[e-mail]('tls-certificates-relation-departed')
+def tls_certificates_relation_departed():
+        config["tls-certificates-ready"] = False
+
+
 def main():
     try:
         hooks.execute(sys.argv)
     except UnregisteredHookError as e:
         log("Unknown hook {} - skipping.".format(e))
 
+
 @hooks.hook("upgrade-charm")
 def upgrade_charm():
     write_vrouter_config()
@@ -351,12 +435,18 @@
     write_nodemgr_config()
     service_restart("supervisor-vrouter")
 
-@restart_on_change({"/etc/contrail/contrail-vrouter-agent.conf": ["contrail-vrouter-agent"],
-                    "/etc/contrail/contrail-vrouter-nodemgr.conf": ["contrail-vrouter-nodemgr"]})
+
+@restart_on_change(
+    {
+        "/etc/contrail/contrail-vrouter-agent.conf":
+        ["contrail-vrouter-agent"],
+        "/etc/contrail/contrail-vrouter-nodemgr.conf":
+        ["contrail-vrouter-nodemgr"]})
 def write_config():
     write_vrouter_config()
     write_vnc_api_config()
     write_nodemgr_config()
 
+
 if __name__ == "__main__":
     main()

=== modified file 'hooks/neutron_contrail_utils.py'
--- hooks/neutron_contrail_utils.py	2017-03-10 12:57:45 +0000
+++ hooks/neutron_contrail_utils.py	2017-03-26 17:44:17 +0000
@@ -24,7 +24,9 @@
     relation_get,
     relation_ids,
     relation_type,
-    remote_unit
+    remote_unit,
+    unit_private_ip,
+    network_get_primary_address,
 )
 
 from charmhelpers.core.host import service_restart, service_start
@@ -33,17 +35,21 @@
 
 apt_pkg.init()
 
+
 def dpkg_version(pkg):
     try:
-        return check_output(["dpkg-query", "-f", "${Version}\\n", "-W", pkg]).rstrip()
+        return check_output(
+            ["dpkg-query", "-f", "${Version}\\n", "-W", pkg]).rstrip()
     except CalledProcessError:
         return None
 
+
 CONTRAIL_VERSION = dpkg_version("contrail-vrouter-agent")
 OPENSTACK_VERSION = dpkg_version("nova-compute")
 
 config = config()
 
+
 def retry(f=None, timeout=10, delay=2):
     """Retry decorator.
 
@@ -67,6 +73,7 @@
     """
     if not f:
         return functools.partial(retry, timeout=timeout, delay=delay)
+
     @functools.wraps(f)
     def func(*args, **kwargs):
         start = time()
@@ -87,6 +94,7 @@
                 raise error
     return func
 
+
 def configure_vrouter():
     # run external script to configure vrouter
     args = ["./create-vrouter.sh"]
@@ -97,37 +105,43 @@
         args.append(iface)
     check_call(args, cwd="scripts")
 
+
 def contrail_api_ctx():
     ip = config.get("contrail-api-ip")
     if ip:
         port = config.get("contrail-api-port")
-        return { "api_server": ip,
-                 "api_port": port if port is not None else 8082 }
+        return {"api_server": ip,
+                "api_port": port if port is not None else 8082}
 
-    ctxs = [ { "api_server": gethostbyname(relation_get("private-address", unit, rid)),
-               "api_port": port }
-             for rid in relation_ids("contrail-api")
-             for unit, port in
-             ((unit, relation_get("port", unit, rid)) for unit in related_units(rid))
-             if port ]
+    ctxs = [{"api_server": gethostbyname(relation_get("private-address",
+                                                      unit, rid)),
+             "api_port": port}
+            for rid in relation_ids("contrail-api")
+            for unit, port in
+            ((unit, relation_get("port", unit, rid))
+             for unit in related_units(rid))
+            if port]
     return ctxs[0] if ctxs else {}
 
+
 def contrail_discovery_ctx():
     ip = config.get("discovery-server-ip")
     if ip:
-        return { "discovery_server": ip,
-                 "discovery_port": 5998 }
+        return {"discovery_server": ip,
+                "discovery_port": 5998}
 
-    ctxs = [ { "discovery_server": vip if vip \
-                 else gethostbyname(relation_get("private-address", unit, rid)),
-               "discovery_port": port }
-             for rid in relation_ids("contrail-discovery")
-             for unit, port, vip in
-             ((unit, relation_get("port", unit, rid), relation_get("vip", unit, rid))
-              for unit in related_units(rid))
-             if port ]
+    ctxs = [{"discovery_server": vip if vip
+             else gethostbyname(relation_get("private-address", unit, rid)),
+             "discovery_port": port}
+            for rid in relation_ids("contrail-discovery")
+            for unit, port, vip in
+            ((unit, relation_get("port", unit, rid),
+              relation_get("vip", unit, rid))
+             for unit in related_units(rid))
+            if port]
     return ctxs[0] if ctxs else {}
 
+
 @retry(timeout=300)
 def contrail_provision_linklocal(api_ip, api_port, service_name, service_ip,
                                  service_port, fabric_ip, fabric_port, op,
@@ -144,6 +158,7 @@
                 "--admin_user", user,
                 "--admin_password", password])
 
+
 @retry(timeout=300)
 def contrail_provision_vrouter(hostname, ip, api_ip, api_port, op,
                                user, password, tenant):
@@ -157,10 +172,13 @@
                 "--admin_password", password,
                 "--admin_tenant_name", tenant])
 
+
 def control_node_ctx():
-    return { "control_nodes": [ gethostbyname(relation_get("private-address", unit, rid))
-                                for rid in relation_ids("control-node")
-                                for unit in related_units(rid) ] }
+    return {"control_nodes": [gethostbyname(relation_get("control_node_ip",
+                                                         unit, rid))
+                              for rid in relation_ids("control-node")
+                              for unit in related_units(rid)]}
+
 
 def disable_vrouter_vgw():
     if os.path.exists("/etc/sysctl.d/60-vrouter-vgw.conf"):
@@ -168,6 +186,7 @@
         os.remove("/etc/sysctl.d/60-vrouter-vgw.conf")
         check_call(["sysctl", "-qw", "net.ipv4.ip_forward=0"])
 
+
 def drop_caches():
     """Clears OS pagecache"""
     log("Clearing pagecache")
@@ -175,25 +194,29 @@
     with open("/proc/sys/vm/drop_caches", "w") as f:
         f.write("3\n")
 
+
 def enable_vrouter_vgw():
     if not os.path.exists("/etc/sysctl.d/60-vrouter-vgw.conf"):
         # set sysctl options
         shutil.copy("files/60-vrouter-vgw.conf", "/etc/sysctl.d")
         service_start("procps")
 
+
 def fix_kexec_tools():
     if version_compare(CONTRAIL_VERSION, "3.2") >= 0:
         # remove crashkernel grub entry
         check_call(["sed", "-i", "-e",
-                    "s/^GRUB_CMDLINE_LINUX_DEFAULT=/#GRUB_CMDLINE_LINUX_DEFAULT=/",
+                    "s/^GRUB_CMDLINE_LINUX_DEFAULT=/"
+                    "#GRUB_CMDLINE_LINUX_DEFAULT=/",
                     "/etc/default/grub.d/kexec-tools.cfg"])
         check_call(["update-grub2"])
 
+
 def fix_nodemgr():
     # add files missing from contrail-nodemgr package
     dest = "/etc/contrail/supervisord_vrouter_files/" \
-           + ("contrail-vrouter-nodemgr.ini" \
-              if version_compare(CONTRAIL_VERSION, "3.1") >= 0 \
+           + ("contrail-vrouter-nodemgr.ini"
+              if version_compare(CONTRAIL_VERSION, "3.1") >= 0
               else "contrail-nodemgr-vrouter.ini")
     shutil.copy("files/contrail-nodemgr-vrouter.ini", dest)
     pw = pwd.getpwnam("contrail")
@@ -208,14 +231,16 @@
           if version_compare(CONTRAIL_VERSION, "3.1") >= 0 \
           else "files/contrail-vrouter-nodemgr"
     shutil.copy(src, "/etc/init.d/contrail-vrouter-nodemgr")
-    os.chmod("/etc/init.d/contrail-vrouter-nodemgr", 0755)
+    os.chmod("/etc/init.d/contrail-vrouter-nodemgr", 0o755)
 
     service_restart("supervisor-vrouter")
 
+
 def fix_permissions():
-    os.chmod("/etc/contrail", 0755)
+    os.chmod("/etc/contrail", 0o755)
     os.chown("/etc/contrail", 0, 0)
 
+
 def fix_vrouter_scripts():
     # certain files need to be present for packages
     if not os.path.exists("/opt/contrail/bin"):
@@ -224,30 +249,36 @@
         os.symlink("/bin/true", "/opt/contrail/bin/vrouter-post-start.sh")
         os.symlink("/bin/true", "/opt/contrail/bin/vrouter-pre-stop.sh")
 
+
 def identity_admin_ctx():
-    ctxs = [ { "auth_host": gethostbyname(hostname),
-               "auth_port": relation_get("service_port", unit, rid),
-               "auth_protocol": relation_get("service_protocol", unit, rid),
-               "admin_user": relation_get("service_username", unit, rid),
-               "admin_password": relation_get("service_password", unit, rid),
-               "admin_tenant_name": relation_get("service_tenant_name", unit, rid),
-               "auth_region": relation_get("service_region", unit, rid) }
-             for rid in relation_ids("identity-admin")
-             for unit, hostname in
-             ((unit, relation_get("service_hostname", unit, rid)) for unit in related_units(rid))
-             if hostname ]
+    ctxs = [{"auth_host": gethostbyname(hostname),
+             "auth_port": relation_get("service_port", unit, rid),
+             "auth_protocol": relation_get("service_protocol", unit, rid),
+             "admin_user": relation_get("service_username", unit, rid),
+             "admin_password": relation_get("service_password", unit, rid),
+             "admin_tenant_name": relation_get("service_tenant_name",
+                                               unit, rid),
+             "auth_region": relation_get("service_region", unit, rid)}
+            for rid in relation_ids("identity-admin")
+            for unit, hostname in
+            ((unit, relation_get("service_hostname", unit, rid))
+             for unit in related_units(rid))
+            if hostname]
     return ctxs[0] if ctxs else {}
 
+
 def ifdown(interfaces=None):
     """ifdown an interface or all interfaces"""
     log("Taking down {}".format(interfaces if interfaces else "interfaces"))
     check_call(["ifdown"] + interfaces if interfaces else ["-a"])
 
+
 def ifup(interfaces=None):
     """ifup an interface or all interfaces"""
     log("Bringing up {}".format(interfaces if interfaces else "interfaces"))
     check_call(["ifup"] + interfaces if interfaces else ["-a"])
 
+
 def lsmod(module):
     """Check if a kernel module is loaded"""
     with open("/proc/modules", "r") as modules:
@@ -256,6 +287,7 @@
                 return True
     return False
 
+
 def modprobe(module, auto_load=False, dkms_autoinstall=False):
     """Load a kernel module.
 
@@ -287,19 +319,23 @@
             log("DKMS auto installing for kernel {}".format(kernel))
             check_call(["dkms", "autoinstall", "-k", kernel])
 
+
 def network_ctx():
     iface = config.get("control-interface")
-    return { "control_network_ip": netifaces.ifaddresses(iface)[netifaces.AF_INET][0]["addr"] }
+    return {"control_network_ip": netifaces.ifaddresses(
+        iface)[netifaces.AF_INET][0]["addr"]}
+
 
 def neutron_metadata_ctx():
     if "local-metadata-secret" in config:
-        return { "metadata_secret": config["local-metadata-secret"] }
+        return {"metadata_secret": config["local-metadata-secret"]}
 
-    ctxs = [ { "metadata_secret": relation_get("shared-secret", unit, rid) }
-             for rid in relation_ids("neutron-metadata")
-             for unit in related_units(rid) ]
+    ctxs = [{"metadata_secret": relation_get("shared-secret", unit, rid)}
+            for rid in relation_ids("neutron-metadata")
+            for unit in related_units(rid)]
     return ctxs[0] if ctxs else {}
 
+
 def provision_local_metadata():
     api_port = None
     api_ip = config.get("contrail-api-ip")
@@ -308,22 +344,25 @@
         if api_port is None:
             api_port = 8082
     else:
-        api_ip, api_port = [ (gethostbyname(relation_get("private-address", unit, rid)),
-                              port)
-                             for rid in relation_ids("contrail-api")
-                             for unit, port in
-                             ((unit, relation_get("port", unit, rid)) for unit in related_units(rid))
-                             if port ][0]
-    user, password = [ (relation_get("service_username", unit, rid),
-                        relation_get("service_password", unit, rid))
-                       for rid in relation_ids("identity-admin")
-                       for unit in related_units(rid)
-                       if relation_get("service_hostname", unit, rid) ][0]
+        api_ip, api_port = [(gethostbyname(relation_get("private-address",
+                                                        unit, rid)),
+                             port)
+                            for rid in relation_ids("contrail-api")
+                            for unit, port in
+                            ((unit, relation_get("port", unit, rid))
+                             for unit in related_units(rid))
+                            if port][0]
+    user, password = [(relation_get("service_username", unit, rid),
+                       relation_get("service_password", unit, rid))
+                      for rid in relation_ids("identity-admin")
+                      for unit in related_units(rid)
+                      if relation_get("service_hostname", unit, rid)][0]
     log("Provisioning local metadata service 127.0.0.1:8775")
     contrail_provision_linklocal(api_ip, api_port, "metadata",
                                  "169.254.169.254", 80, "127.0.0.1", 8775,
                                  "add", user, password)
 
+
 def provision_vrouter():
     hostname = gethostname()
     ip = netifaces.ifaddresses("vhost0")[netifaces.AF_INET][0]["addr"]
@@ -334,26 +373,30 @@
         if api_port is None:
             api_port = 8082
     else:
-        api_ip, api_port = [ (gethostbyname(relation_get("private-address", unit, rid)),
-                              port)
-                             for rid in relation_ids("contrail-api")
-                             for unit, port in
-                             ((unit, relation_get("port", unit, rid)) for unit in related_units(rid))
-                             if port ][0]
-    user, password, tenant = [ (relation_get("service_username", unit, rid),
-                                relation_get("service_password", unit, rid),
-                                relation_get("service_tenant_name", unit, rid))
-                               for rid in relation_ids("identity-admin")
-                               for unit in related_units(rid)
-                               if relation_get("service_hostname", unit, rid) ][0]
+        api_ip, api_port = [(gethostbyname(relation_get("private-address",
+                                                        unit, rid)), port)
+                            for rid in relation_ids("contrail-api")
+                            for unit, port in
+                            ((unit, relation_get("port", unit, rid))
+                             for unit in related_units(rid))
+                            if port][0]
+    user, password, tenant = [(relation_get("service_username", unit, rid),
+                               relation_get("service_password", unit, rid),
+                               relation_get("service_tenant_name", unit, rid))
+                              for rid in relation_ids("identity-admin")
+                              for unit in related_units(rid)
+                              if relation_get("service_hostname",
+                                              unit, rid)][0]
     log("Provisioning vrouter {}".format(ip))
     contrail_provision_vrouter(hostname, ip, api_ip, api_port, "add",
                                user, password, tenant)
 
+
 def units(relation):
     """Return a list of units for the specified relation"""
-    return [ unit for rid in relation_ids(relation)
-                  for unit in related_units(rid) ]
+    return [unit for rid in relation_ids(relation)
+            for unit in related_units(rid)]
+
 
 def unprovision_local_metadata():
     relation = relation_type()
@@ -369,20 +412,21 @@
         api_ip = gethostbyname(relation_get("private-address"))
         api_port = relation_get("port")
     else:
-        api_ip, api_port = [ (gethostbyname(relation_get("private-address", unit, rid)),
-                              relation_get("port", unit, rid))
-                             for rid in relation_ids("contrail-api")
-                             for unit in related_units(rid) ][0]
+        api_ip, api_port = [(gethostbyname(relation_get("private-address",
+                                                        unit, rid)),
+                             relation_get("port", unit, rid))
+                            for rid in relation_ids("contrail-api")
+                            for unit in related_units(rid)][0]
     user = None
     password = None
     if relation == "identity-admin":
         user = relation_get("service_username")
         password = relation_get("service_password")
     else:
-        user, password = [ (relation_get("service_username", unit, rid),
-                            relation_get("service_password", unit, rid))
-                           for rid in relation_ids("identity-admin")
-                           for unit in related_units(rid) ][0]
+        user, password = [(relation_get("service_username", unit, rid),
+                           relation_get("service_password", unit, rid))
+                          for rid in relation_ids("identity-admin")
+                          for unit in related_units(rid)][0]
     log("Unprovisioning local metadata service 127.0.0.1:8775")
     try:
         contrail_provision_linklocal(api_ip, api_port, "metadata",
@@ -391,6 +435,7 @@
     except CalledProcessError:
         pass
 
+
 def unprovision_vrouter():
     relation = relation_type()
     if relation and not remote_unit():
@@ -407,10 +452,11 @@
         api_ip = gethostbyname(relation_get("private-address"))
         api_port = relation_get("port")
     else:
-        api_ip, api_port = [ (gethostbyname(relation_get("private-address", unit, rid)),
-                              relation_get("port", unit, rid))
-                             for rid in relation_ids("contrail-api")
-                             for unit in related_units(rid) ][0]
+        api_ip, api_port = [(gethostbyname(relation_get("private-address",
+                                                        unit, rid)),
+                             relation_get("port", unit, rid))
+                            for rid in relation_ids("contrail-api")
+                            for unit in related_units(rid)][0]
     user = None
     password = None
     tenant = None
@@ -419,11 +465,12 @@
         password = relation_get("service_password")
         tenant = relation_get("service_tenant_name")
     else:
-        user, password, tenant = [ (relation_get("service_username", unit, rid),
-                                    relation_get("service_password", unit, rid),
-                                    relation_get("service_tenant_name", unit, rid))
-                                   for rid in relation_ids("identity-admin")
-                                   for unit in related_units(rid) ][0]
+        user, password, tenant = [(relation_get("service_username", unit, rid),
+                                   relation_get("service_password", unit, rid),
+                                   relation_get("service_tenant_name",
+                                                unit, rid))
+                                  for rid in relation_ids("identity-admin")
+                                  for unit in related_units(rid)][0]
     log("Unprovisioning vrouter {}".format(ip))
     try:
         contrail_provision_vrouter(hostname, ip, api_ip, api_port, "del",
@@ -431,6 +478,7 @@
     except CalledProcessError:
         pass
 
+
 def vhost_gateway():
     # determine vhost gateway
     gateway = config.get("vhost-gateway")
@@ -442,6 +490,7 @@
         gateway = None
     return gateway
 
+
 def vhost_ip(iface):
     # return a vhost formatted address and mask - x.x.x.x/xx
     addr = netifaces.ifaddresses(iface)[netifaces.AF_INET][0]
@@ -449,14 +498,17 @@
     cidr = netaddr.IPNetwork(ip + "/" + addr["netmask"]).prefixlen
     return ip + "/" + str(cidr)
 
+
 def vhost_phys():
     # run external script to determine physical interface of vhost0
     return check_output(["scripts/vhost-phys.sh"]).rstrip()
 
+
 def vrouter_ctx():
-    return { "vhost_ip": vhost_ip("vhost0"),
-             "vhost_gateway": vhost_gateway(),
-             "vhost_physical": vhost_phys() }
+    return {"vhost_ip": vhost_ip("vhost0"),
+            "vhost_gateway": vhost_gateway(),
+            "vhost_physical": vhost_phys()}
+
 
 def vrouter_vgw_ctx():
     ctx = {}
@@ -467,23 +519,27 @@
         ctx["vgws"] = vgws
     return ctx
 
+
 def write_barbican_auth_config():
     ctx = identity_admin_ctx()
     render("contrail-lbaas-auth.conf",
            "/etc/contrail/contrail-lbaas-auth.conf", ctx, "root", "contrail",
-           0440)
+           0o440)
+
 
 def write_nodemgr_config():
     ctx = contrail_discovery_ctx()
     render("contrail-vrouter-nodemgr.conf",
            "/etc/contrail/contrail-vrouter-nodemgr.conf", ctx)
 
+
 def write_vnc_api_config():
     ctx = {}
     ctx.update(contrail_api_ctx())
     ctx.update(identity_admin_ctx())
     render("vnc_api_lib.ini", "/etc/contrail/vnc_api_lib.ini", ctx)
 
+
 def write_vrouter_config():
     ctx = {}
     ctx.update(control_node_ctx())
@@ -492,9 +548,58 @@
     ctx.update(network_ctx())
     ctx.update(vrouter_ctx())
     ctx.update(vrouter_vgw_ctx())
+
+    # a tls-certificates guard here is for the upgrade scenario
+    tls_implemented = version_compare(CONTRAIL_VERSION, "3.0") >= 0 and\
+        config.get("tls-certificates-ready")
+    ctx.update({'tls_implemented': tls_implemented})
     render("contrail-vrouter-agent.conf",
-           "/etc/contrail/contrail-vrouter-agent.conf", ctx, perms=0440)
+           "/etc/contrail/contrail-vrouter-agent.conf", ctx, perms=0o440)
+
 
 def write_vrouter_vgw_interfaces():
     ctx = vrouter_vgw_ctx()
     render("vrouter-vgw.cfg", "/etc/network/interfaces.d/vrouter-vgw.cfg", ctx)
+
+
+def control_network_ip():
+    '''
+    With Juju 2.x, uses an endpoint (relation)
+    network space binding if unspecified will use a "unit private address"
+    which is far less explicit if you look at the Juju implementation.
+    If you use Juju 2.x and above - bind the control-node endpoint to a network
+    space to get a proper address in this function.
+
+    If network-get throws an exception (juju 1.x or spaces are not supported)
+    will try to fall back to a private-address as returned by Juju.
+    '''
+    try:
+        address = network_get_primary_address('control-node')
+    except NotImplementedError:
+        log('Network spaces are not implemented - falling back to'
+            ' getting a private address')
+        address = unit_private_ip()
+    return address
+
+
+def write_xmpp_tls_files(serv_cert, priv_key, ca):
+    prefix = '/etc/contrail/ssl'
+    certs = os.path.join(prefix, 'certs')
+    private = os.path.join(prefix, 'private')
+
+    entry = pwd.getpwnam('contrail')
+    for p in [prefix, certs, private]:
+        if not os.path.exists(p):
+            os.makedirs(p, 0o750)
+            os.chown(p, entry.pw_uid, entry.pw_gid)
+
+    fcontent = {
+        os.path.join(certs, 'server.pem'): serv_cert,
+        os.path.join(private, 'server-privkey.pem'): priv_key,
+        os.path.join(certs, 'ca-cert.pem'): ca,
+    }
+
+    for filepath, content in fcontent.iteritems():
+        with open(filepath, 'w+') as f:
+            f.truncate(0)
+            f.write(content)

=== added symlink 'hooks/tls-certificates-relation-changed'
=== target is u'neutron_contrail_hooks.py'
=== added symlink 'hooks/tls-certificates-relation-departed'
=== target is u'neutron_contrail_hooks.py'
=== added symlink 'hooks/tls-certificates-relation-joined'
=== target is u'neutron_contrail_hooks.py'
=== modified file 'metadata.yaml'
--- metadata.yaml	2015-10-13 11:03:57 +0000
+++ metadata.yaml	2017-03-26 17:44:17 +0000
@@ -37,3 +37,5 @@
     interface: keystone-admin
   neutron-metadata:
     interface: neutron-metadata
+  tls-certificates:
+    interface: tls-certificates

=== modified file 'templates/contrail-vrouter-agent.conf'
--- templates/contrail-vrouter-agent.conf	2016-02-05 00:31:01 +0000
+++ templates/contrail-vrouter-agent.conf	2017-03-26 17:44:17 +0000
@@ -3,6 +3,15 @@
 # Configuration file maintained by Juju. Local changes may be overwritten.
 ###############################################################################
 
+
+{% if tls_implemented -%}
+[DEFAULT]
+xmpp_auth_enable=true
+xmpp_server_cert=/etc/contrail/ssl/certs/server.pem
+xmpp_server_key=/etc/contrail/ssl/private/server-privkey.pem
+xmpp_ca_cert=/etc/contrail/ssl/certs/ca-cert.pem
+{% endif -%}
+
 {%- if control_nodes %}
 
 [CONTROL-NODE]