Merge ~ec0/juju-lint:modular into juju-lint:master

[James Hebden]

This is a large merge with the following goals
 * Move to snap-only distribution and usage
 * Support remote-auditing live clouds via SSH (Fabric2)
 * Support multiple cloud types (OpenStack, Kubernetes)
 * Support auditing configuration in addition to the current support for auditing placement
 * Add support for XDG-compliant configuration file locations
 * Merge in additional configuration checks from ua-reviewkit and add support for regex and basic value tests such as greater-than-or-equal to, isset and equality for testing values against a baseline lint rules file
 * Move to pytest for testing and add coverage reporting to eventually get good test coverage
 * Move to setuptools_scm (and have the snap track this) to ensure consistent versioning following PEP440

All requirements have also been updated and a Pipfile and python-version file for using with Pipenv and pyenv have been added. setup.py has been adjusted to provide an entry-point instead of the previous symlink, and setuptools can be used to install an entrypoint binary, which the snap has been tested with successfully.

This is a large merge with the following goals
 * Move to snap-only distribution and usage
 * Support remote-auditing live clouds via SSH (Fabric2)
 * Support multiple cloud types (OpenStack, Kubernetes)
 * Support auditing configuration in addition to the current support for auditing placement
 * Add support for XDG-compliant configuration file locations
 * Merge in additional configuration checks from ua-reviewkit and add support for regex and basic value tests such as greater-than-or-equal to, isset and equality for testing values against a baseline lint rules file
 * Move to pytest for testing and add coverage reporting to eventually get good test coverage
 * Move to setuptools_scm (and have the snap track this) to ensure consistent versioning following PEP440

All requirements have also been updated and a Pipfile and python-version file for using with Pipenv and pyenv have been added. setup.py has been adjusted to provide an entry-point instead of the previous symlink, and setuptools can be used to install an entrypoint binary, which the snap has been tested with successfully.

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

This merge proposal is being monitored by mergebot. Change the status to Approved to merge.

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

Unable to determine commit message from repository - please click "Set commit message" and enter the commit message manually.

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

Change successfully merged at revision 020be3e78f7964d1ce6934e82c690c0e1d4462dd

diff --git a/.gitignore b/.gitignore
index 60a29ef..1f49ca6 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,6 +4,17 @@
 .tox/
 juju_lint.egg-info/
 dist/
+tests/report/
+
+# python artefacts
+__pycache__
+*.pyc
+.eggs
+*.egg-info
+
+# test artefacts
+tests/report
+.coverage
 
 # debuild cruft
 debian/files
@@ -14,3 +25,6 @@ parts/
 prime/
 snap/.snapcraft/
 stage/
+
+# runtime
+output/
diff --git a/.python-version b/.python-version
new file mode 100644
index 0000000..a08ffae
--- /dev/null
+++ b/.python-version
@@ -0,0 +1 @@
+3.8.2
diff --git a/3rdparty/attrs-18.1.0.tar.gz b/3rdparty/attrs-18.1.0.tar.gz
deleted file mode 100644
index 0d7c713..0000000
Binary files a/3rdparty/attrs-18.1.0.tar.gz and /dev/null differ
diff --git a/3rdparty/flake8-3.5.0.tar.gz b/3rdparty/flake8-3.5.0.tar.gz
deleted file mode 100644
index 78e01fd..0000000
Binary files a/3rdparty/flake8-3.5.0.tar.gz and /dev/null differ
diff --git a/3rdparty/pycodestyle-2.3.1.tar.gz b/3rdparty/pycodestyle-2.3.1.tar.gz
deleted file mode 100644
index 76de222..0000000
Binary files a/3rdparty/pycodestyle-2.3.1.tar.gz and /dev/null differ
diff --git a/3rdparty/pyflakes-2.0.0.tar.gz b/3rdparty/pyflakes-2.0.0.tar.gz
deleted file mode 100644
index 95d6d3e..0000000
Binary files a/3rdparty/pyflakes-2.0.0.tar.gz and /dev/null differ
diff --git a/MANIFEST.in b/MANIFEST.in
deleted file mode 100644
index 3bb71b3..0000000
--- a/MANIFEST.in
+++ /dev/null
@@ -1,2 +0,0 @@
-# Additional files to include in any distutils source packages.
-include debian/changelog  # required by setup.py
diff --git a/Pipfile b/Pipfile
new file mode 100644
index 0000000..d2acf80
--- /dev/null
+++ b/Pipfile
@@ -0,0 +1,17 @@
+[[source]]
+url = "https://pypi.python.org/simple"
+verify_ssl = true
+name = "pypi"
+
+[packages]
+attrs = ">=18.1.0"
+colorlog = ">=4.1.0"
+confuse = ">=1.1.0"
+fabric2 = ">=2.5.0"
+setuptools = ">=46.1.3"
+PyYAML = ">=5.3.1"
+
+[dev-packages]
+
+[requires]
+python_version = "3.6"
diff --git a/Pipfile.lock b/Pipfile.lock
new file mode 100644
index 0000000..c43f7b6
--- /dev/null
+++ b/Pipfile.lock
@@ -0,0 +1,199 @@
+{
+    "_meta": {
+        "hash": {
+            "sha256": "e1534fcda4a023c68f70df4e53b34a9bafcd9ec48c4f8d93e20dda25b3c43cd4"
+        },
+        "pipfile-spec": 6,
+        "requires": {
+            "python_version": "3.6"
+        },
+        "sources": [
+            {
+                "name": "pypi",
+                "url": "https://pypi.python.org/simple",
+                "verify_ssl": true
+            }
+        ]
+    },
+    "default": {
+        "attrs": {
+            "hashes": [
+                "sha256:08a96c641c3a74e44eb59afb61a24f2cb9f4d7188748e76ba4bb5edfa3cb7d1c",
+                "sha256:f7b7ce16570fe9965acd6d30101a28f62fb4a7f9e926b3bbc9b61f8b04247e72"
+            ],
+            "index": "pypi",
+            "version": "==19.3.0"
+        },
+        "bcrypt": {
+            "hashes": [
+                "sha256:0258f143f3de96b7c14f762c770f5fc56ccd72f8a1857a451c1cd9a655d9ac89",
+                "sha256:0b0069c752ec14172c5f78208f1863d7ad6755a6fae6fe76ec2c80d13be41e42",
+                "sha256:19a4b72a6ae5bb467fea018b825f0a7d917789bcfe893e53f15c92805d187294",
+                "sha256:5432dd7b34107ae8ed6c10a71b4397f1c853bd39a4d6ffa7e35f40584cffd161",
+                "sha256:6305557019906466fc42dbc53b46da004e72fd7a551c044a827e572c82191752",
+                "sha256:69361315039878c0680be456640f8705d76cb4a3a3fe1e057e0f261b74be4b31",
+                "sha256:6fe49a60b25b584e2f4ef175b29d3a83ba63b3a4df1b4c0605b826668d1b6be5",
+                "sha256:74a015102e877d0ccd02cdeaa18b32aa7273746914a6c5d0456dd442cb65b99c",
+                "sha256:763669a367869786bb4c8fcf731f4175775a5b43f070f50f46f0b59da45375d0",
+                "sha256:8b10acde4e1919d6015e1df86d4c217d3b5b01bb7744c36113ea43d529e1c3de",
+                "sha256:9fe92406c857409b70a38729dbdf6578caf9228de0aef5bc44f859ffe971a39e",
+                "sha256:a190f2a5dbbdbff4b74e3103cef44344bc30e61255beb27310e2aec407766052",
+                "sha256:a595c12c618119255c90deb4b046e1ca3bcfad64667c43d1166f2b04bc72db09",
+                "sha256:c9457fa5c121e94a58d6505cadca8bed1c64444b83b3204928a866ca2e599105",
+                "sha256:cb93f6b2ab0f6853550b74e051d297c27a638719753eb9ff66d1e4072be67133",
+                "sha256:ce4e4f0deb51d38b1611a27f330426154f2980e66582dc5f438aad38b5f24fc1",
+                "sha256:d7bdc26475679dd073ba0ed2766445bb5b20ca4793ca0db32b399dccc6bc84b7",
+                "sha256:ff032765bb8716d9387fd5376d987a937254b0619eff0972779515b5c98820bc"
+            ],
+            "version": "==3.1.7"
+        },
+        "cffi": {
+            "hashes": [
+                "sha256:001bf3242a1bb04d985d63e138230802c6c8d4db3668fb545fb5005ddf5bb5ff",
+                "sha256:00789914be39dffba161cfc5be31b55775de5ba2235fe49aa28c148236c4e06b",
+                "sha256:028a579fc9aed3af38f4892bdcc7390508adabc30c6af4a6e4f611b0c680e6ac",
+                "sha256:14491a910663bf9f13ddf2bc8f60562d6bc5315c1f09c704937ef17293fb85b0",
+                "sha256:1cae98a7054b5c9391eb3249b86e0e99ab1e02bb0cc0575da191aedadbdf4384",
+                "sha256:2089ed025da3919d2e75a4d963d008330c96751127dd6f73c8dc0c65041b4c26",
+                "sha256:2d384f4a127a15ba701207f7639d94106693b6cd64173d6c8988e2c25f3ac2b6",
+                "sha256:337d448e5a725bba2d8293c48d9353fc68d0e9e4088d62a9571def317797522b",
+                "sha256:399aed636c7d3749bbed55bc907c3288cb43c65c4389964ad5ff849b6370603e",
+                "sha256:3b911c2dbd4f423b4c4fcca138cadde747abdb20d196c4a48708b8a2d32b16dd",
+                "sha256:3d311bcc4a41408cf5854f06ef2c5cab88f9fded37a3b95936c9879c1640d4c2",
+                "sha256:62ae9af2d069ea2698bf536dcfe1e4eed9090211dbaafeeedf5cb6c41b352f66",
+                "sha256:66e41db66b47d0d8672d8ed2708ba91b2f2524ece3dee48b5dfb36be8c2f21dc",
+                "sha256:675686925a9fb403edba0114db74e741d8181683dcf216be697d208857e04ca8",
+                "sha256:7e63cbcf2429a8dbfe48dcc2322d5f2220b77b2e17b7ba023d6166d84655da55",
+                "sha256:8a6c688fefb4e1cd56feb6c511984a6c4f7ec7d2a1ff31a10254f3c817054ae4",
+                "sha256:8c0ffc886aea5df6a1762d0019e9cb05f825d0eec1f520c51be9d198701daee5",
+                "sha256:95cd16d3dee553f882540c1ffe331d085c9e629499ceadfbda4d4fde635f4b7d",
+                "sha256:99f748a7e71ff382613b4e1acc0ac83bf7ad167fb3802e35e90d9763daba4d78",
+                "sha256:b8c78301cefcf5fd914aad35d3c04c2b21ce8629b5e4f4e45ae6812e461910fa",
+                "sha256:c420917b188a5582a56d8b93bdd8e0f6eca08c84ff623a4c16e809152cd35793",
+                "sha256:c43866529f2f06fe0edc6246eb4faa34f03fe88b64a0a9a942561c8e22f4b71f",
+                "sha256:cab50b8c2250b46fe738c77dbd25ce017d5e6fb35d3407606e7a4180656a5a6a",
+                "sha256:cef128cb4d5e0b3493f058f10ce32365972c554572ff821e175dbc6f8ff6924f",
+                "sha256:cf16e3cf6c0a5fdd9bc10c21687e19d29ad1fe863372b5543deaec1039581a30",
+                "sha256:e56c744aa6ff427a607763346e4170629caf7e48ead6921745986db3692f987f",
+                "sha256:e577934fc5f8779c554639376beeaa5657d54349096ef24abe8c74c5d9c117c3",
+                "sha256:f2b0fa0c01d8a0c7483afd9f31d7ecf2d71760ca24499c8697aeb5ca37dc090c"
+            ],
+            "version": "==1.14.0"
+        },
+        "colorlog": {
+            "hashes": [
+                "sha256:30aaef5ab2a1873dec5da38fd6ba568fa761c9fa10b40241027fa3edea47f3d2",
+                "sha256:732c191ebbe9a353ec160d043d02c64ddef9028de8caae4cfa8bd49b6afed53e"
+            ],
+            "index": "pypi",
+            "version": "==4.1.0"
+        },
+        "confuse": {
+            "hashes": [
+                "sha256:adc1979ea6f4c0dd3d6fe06020c189843a649082ab8f6fb54db16f4ac5e5e1da"
+            ],
+            "index": "pypi",
+            "version": "==1.1.0"
+        },
+        "cryptography": {
+            "hashes": [
+                "sha256:091d31c42f444c6f519485ed528d8b451d1a0c7bf30e8ca583a0cac44b8a0df6",
+                "sha256:18452582a3c85b96014b45686af264563e3e5d99d226589f057ace56196ec78b",
+                "sha256:1dfa985f62b137909496e7fc182dac687206d8d089dd03eaeb28ae16eec8e7d5",
+                "sha256:1e4014639d3d73fbc5ceff206049c5a9a849cefd106a49fa7aaaa25cc0ce35cf",
+                "sha256:22e91636a51170df0ae4dcbd250d318fd28c9f491c4e50b625a49964b24fe46e",
+                "sha256:3b3eba865ea2754738616f87292b7f29448aec342a7c720956f8083d252bf28b",
+                "sha256:651448cd2e3a6bc2bb76c3663785133c40d5e1a8c1a9c5429e4354201c6024ae",
+                "sha256:726086c17f94747cedbee6efa77e99ae170caebeb1116353c6cf0ab67ea6829b",
+                "sha256:844a76bc04472e5135b909da6aed84360f522ff5dfa47f93e3dd2a0b84a89fa0",
+                "sha256:88c881dd5a147e08d1bdcf2315c04972381d026cdb803325c03fe2b4a8ed858b",
+                "sha256:96c080ae7118c10fcbe6229ab43eb8b090fccd31a09ef55f83f690d1ef619a1d",
+                "sha256:a0c30272fb4ddda5f5ffc1089d7405b7a71b0b0f51993cb4e5dbb4590b2fc229",
+                "sha256:bb1f0281887d89617b4c68e8db9a2c42b9efebf2702a3c5bf70599421a8623e3",
+                "sha256:c447cf087cf2dbddc1add6987bbe2f767ed5317adb2d08af940db517dd704365",
+                "sha256:c4fd17d92e9d55b84707f4fd09992081ba872d1a0c610c109c18e062e06a2e55",
+                "sha256:d0d5aeaedd29be304848f1c5059074a740fa9f6f26b84c5b63e8b29e73dfc270",
+                "sha256:daf54a4b07d67ad437ff239c8a4080cfd1cc7213df57d33c97de7b4738048d5e",
+                "sha256:e993468c859d084d5579e2ebee101de8f5a27ce8e2159959b6673b418fd8c785",
+                "sha256:f118a95c7480f5be0df8afeb9a11bd199aa20afab7a96bcf20409b411a3a85f0"
+            ],
+            "version": "==2.9.2"
+        },
+        "fabric2": {
+            "hashes": [
+                "sha256:29edd7848420df589a49743394a0ae6874ccb6a9fe6413c0076d42cc290dcad6",
+                "sha256:8838d9641fd4e95bfc2568aa16fc683a600de860ac52a1dc9675a4db3c6cef7c"
+            ],
+            "index": "pypi",
+            "version": "==2.5.0"
+        },
+        "invoke": {
+            "hashes": [
+                "sha256:87b3ef9d72a1667e104f89b159eaf8a514dbf2f3576885b2bbdefe74c3fb2132",
+                "sha256:93e12876d88130c8e0d7fd6618dd5387d6b36da55ad541481dfa5e001656f134",
+                "sha256:de3f23bfe669e3db1085789fd859eb8ca8e0c5d9c20811e2407fa042e8a5e15d"
+            ],
+            "version": "==1.4.1"
+        },
+        "paramiko": {
+            "hashes": [
+                "sha256:920492895db8013f6cc0179293147f830b8c7b21fdfc839b6bad760c27459d9f",
+                "sha256:9c980875fa4d2cb751604664e9a2d0f69096643f5be4db1b99599fe114a97b2f"
+            ],
+            "version": "==2.7.1"
+        },
+        "pycparser": {
+            "hashes": [
+                "sha256:2d475327684562c3a96cc71adf7dc8c4f0565175cf86b6d7a404ff4c771f15f0",
+                "sha256:7582ad22678f0fcd81102833f60ef8d0e57288b6b5fb00323d101be910e35705"
+            ],
+            "version": "==2.20"
+        },
+        "pynacl": {
+            "hashes": [
+                "sha256:06cbb4d9b2c4bd3c8dc0d267416aaed79906e7b33f114ddbf0911969794b1cc4",
+                "sha256:11335f09060af52c97137d4ac54285bcb7df0cef29014a1a4efe64ac065434c4",
+                "sha256:2fe0fc5a2480361dcaf4e6e7cea00e078fcda07ba45f811b167e3f99e8cff574",
+                "sha256:30f9b96db44e09b3304f9ea95079b1b7316b2b4f3744fe3aaecccd95d547063d",
+                "sha256:511d269ee845037b95c9781aa702f90ccc36036f95d0f31373a6a79bd8242e25",
+                "sha256:537a7ccbea22905a0ab36ea58577b39d1fa9b1884869d173b5cf111f006f689f",
+                "sha256:54e9a2c849c742006516ad56a88f5c74bf2ce92c9f67435187c3c5953b346505",
+                "sha256:757250ddb3bff1eecd7e41e65f7f833a8405fede0194319f87899690624f2122",
+                "sha256:7757ae33dae81c300487591c68790dfb5145c7d03324000433d9a2c141f82af7",
+                "sha256:7c6092102219f59ff29788860ccb021e80fffd953920c4a8653889c029b2d420",
+                "sha256:8122ba5f2a2169ca5da936b2e5a511740ffb73979381b4229d9188f6dcb22f1f",
+                "sha256:9c4a7ea4fb81536c1b1f5cc44d54a296f96ae78c1ebd2311bd0b60be45a48d96",
+                "sha256:cd401ccbc2a249a47a3a1724c2918fcd04be1f7b54eb2a5a71ff915db0ac51c6",
+                "sha256:d452a6746f0a7e11121e64625109bc4468fc3100452817001dbe018bb8b08514",
+                "sha256:ea6841bc3a76fa4942ce00f3bda7d436fda21e2d91602b9e21b7ca9ecab8f3ff",
+                "sha256:f8851ab9041756003119368c1e6cd0b9c631f46d686b3904b18c0139f4419f80"
+            ],
+            "version": "==1.4.0"
+        },
+        "pyyaml": {
+            "hashes": [
+                "sha256:06a0d7ba600ce0b2d2fe2e78453a470b5a6e000a985dd4a4e54e436cc36b0e97",
+                "sha256:240097ff019d7c70a4922b6869d8a86407758333f02203e0fc6ff79c5dcede76",
+                "sha256:4f4b913ca1a7319b33cfb1369e91e50354d6f07a135f3b901aca02aa95940bd2",
+                "sha256:69f00dca373f240f842b2931fb2c7e14ddbacd1397d57157a9b005a6a9942648",
+                "sha256:73f099454b799e05e5ab51423c7bcf361c58d3206fa7b0d555426b1f4d9a3eaf",
+                "sha256:74809a57b329d6cc0fdccee6318f44b9b8649961fa73144a98735b0aaf029f1f",
+                "sha256:7739fc0fa8205b3ee8808aea45e968bc90082c10aef6ea95e855e10abf4a37b2",
+                "sha256:95f71d2af0ff4227885f7a6605c37fd53d3a106fcab511b8860ecca9fcf400ee",
+                "sha256:b8eac752c5e14d3eca0e6dd9199cd627518cb5ec06add0de9d32baeee6fe645d",
+                "sha256:cc8955cfbfc7a115fa81d85284ee61147059a753344bc51098f3ccd69b0d7e0c",
+                "sha256:d13155f591e6fcc1ec3b30685d50bf0711574e2c0dfffd7644babf8b5102ca1a"
+            ],
+            "index": "pypi",
+            "version": "==5.3.1"
+        },
+        "six": {
+            "hashes": [
+                "sha256:30639c035cdb23534cd4aa2dd52c3bf48f06e5f4a941509c8bafd8ce11080259",
+                "sha256:8b74bedcbbbaca38ff6d7491d76f2b06b3592611af620f8426e82dddb04a5ced"
+            ],
+            "version": "==1.15.0"
+        }
+    },
+    "develop": {}
+}
diff --git a/README.md b/README.md
index 534395d..00d737d 100644
--- a/README.md
+++ b/README.md
@@ -1,21 +1,42 @@
 = Juju Lint =
 
-/!\ This is alpha software and backwards incompatible changes are expected.
-
 == Introduction ==
 
-This is intended to be run against a yaml dump of Juju status, which can be
-generated as follows:
+This is intended to be run against a yaml dump of Juju status, a YAML dump of 
+a juju bundle or a remote cloud or clouds via SSH.
+
+To generate a status if you just want to audit placement:
 
     juju status --format yaml > status.yaml
 
+For auditing configuration, you would want:
+
+    juju export-bundle > bundle.yaml
+
 Then run `juju-lint` (using a rules file of `lint-rules.yaml`):
 
-    ./juju-lint status.yaml
+    juju-lint -f status.yaml (or bundle.yaml)
+
+You can also enable additional checks for specific cloud types by specifying
+the cloud type with `-t` as such:
+
+    juju-lint -f bundle.yaml -t openstack
+
+For remote or mass audits, you can remote audit clouds via SSH.
+To do this, you will need to add the clouds to your config file in:
+
+    ~/.config/juju-lint/config.yaml
+
+See the example config file in the `jujulint` directory of this repo.
+This tool will use your existing SSH keys, SSH agent, and SSH config.
+If you are running from the snap, you will need to connect the `ssh-keys`
+interface in order to grant access to your SSH configuation.
 
 To use a different rules file:
 
-    ./juju-lint -c my-rules.yaml status.yaml
+    juju-lint -c my-rules.yaml
+
+For all other options, consult `juju-lint --help`
 
 == Rules File ==
 
@@ -27,10 +48,12 @@ Supported top-level options for your rules file:
  2. `known charms` - all primary charms should be in this list.
  3. `operations [mandatory|optional|subordinate]`
  4. `openstack [mandatory|optional|subordinate]`
+ 5. `config` - application configuration auditing
+ 5. `[openstack|kubernetes] config` - config auditing for specific cloud types.
 
 == License ==
 
-Copyright 2018 Canonical Limited.
+Copyright 2020 Canonical Limited.
 License granted by Canonical Limited.
 
 This program is free software: you can redistribute it and/or modify
diff --git a/contrib/canonical-openstack-rules.yaml b/contrib/canonical-rules.yaml
similarity index 75%
rename from contrib/canonical-openstack-rules.yaml
rename to contrib/canonical-rules.yaml
index 1dc8830..3a3f666 100644
--- a/contrib/canonical-openstack-rules.yaml
+++ b/contrib/canonical-rules.yaml
@@ -1,3 +1,49 @@
+kubernetes config:
+ kubernetes-master:
+  authorization-mode:
+   eq: "RBAC,Node"
+ canal:
+  cidr:
+   isset: false
+
+openstack config:
+ neutron-api:
+  path-mtu:
+   eq: 9000
+  global-physnet-mtu:
+   eq: 9000
+ nova-compute:
+  live-migration-permit-auto-converge:
+   eq: true
+  live-migration-permit-post-copy:
+   eq: true
+  cpu-model:
+   isset: true
+ percona-cluster:
+  innodb-buffer-pool-size:
+   gte: 6G
+  max-connections:
+   gte: 2000
+ mysql-innodb-cluster:
+  innodb-buffer-pool-size:
+   gte: 6G
+  max-connections:
+   gte: 2000
+ rabbitmq-server:
+  cluster-partition-handling:
+   eq: "pause_minority"
+ keystone:
+  token-expiration:
+   gte: 86400
+
+config:
+ hacluster:
+  cluster_count:
+   gte: 3
+ ntp:
+  auto_peers:
+   eq: true
+
 subordinates:
  telegraf:
   where: all except prometheus  # and prometheus-ceph-exporter and prometheus-openstack-exporter
diff --git a/debian/changelog b/debian/changelog
deleted file mode 100644
index c45b19e..0000000
--- a/debian/changelog
+++ /dev/null
@@ -1,11 +0,0 @@
-juju-lint (1.0.0.dev2) xenial; urgency=medium
-
-  * Add canonical-openstack-rules.yaml in contrib directory.
-
- -- Tom Haddon <[e-mail]>  Thu, 02 Aug 2018 18:08:27 +0100
-
-juju-lint (1.0.0.dev1) xenial; urgency=medium
-
-  * Initial release.
-
- -- Stuart Bishop (Work) <[e-mail]>  Tue, 24 Jul 2018 17:36:40 +0700
diff --git a/debian/compat b/debian/compat
deleted file mode 100644
index 7f8f011..0000000
--- a/debian/compat
+++ /dev/null
@@ -1 +0,0 @@
-7
diff --git a/debian/control b/debian/control
deleted file mode 100644
index a434417..0000000
--- a/debian/control
+++ /dev/null
@@ -1,19 +0,0 @@
-Source: juju-lint
-Section: admin
-Priority: extra
-Maintainer: Juju Linters <[e-mail]>
-Build-Depends:
- debhelper,
- python3-all,
- python3-setuptools
-Standards-Version: 3.9.3
-X-Python-Version: >= 3.4
-
-Package: juju-lint
-Architecture: all
-Depends:
- ${python3:Depends},
- ${misc:Depends},
- python3-yaml,
- python3-attr (>= 18.1)
-Description: Linter for Juju models to compare deployments with configurable policy
diff --git a/debian/copyright b/debian/copyright
deleted file mode 100644
index 4270311..0000000
--- a/debian/copyright
+++ /dev/null
@@ -1,25 +0,0 @@
-Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
-Upstream-Name: juju-lint
-Source: https://code.launchpad.net/juju-lint
-
-Files: *
-Copyright: 2018 Canonical Limited <[e-mail]>
-License: GPL-3
- Copyright 2018 Canonical Limited.
- License granted by Canonical Limited.
- .
- This program is free software: you can redistribute it and/or modify
- it under the terms of the GNU General Public License version 3, as
- published by the Free Software Foundation.
- .
- This program is distributed in the hope that it will be useful, but
- WITHOUT ANY WARRANTY; without even the implied warranties of
- MERCHANTABILITY, SATISFACTORY QUALITY, or FITNESS FOR A PARTICULAR
- PURPOSE.  See the GNU General Public License for more details.
- .
- You should have received a copy of the GNU General Public License
- along with this program. If not, see <http://www.gnu.org/licenses/>.
- .
- On Debian systems, the full text of the GNU General Public
- License version 3 can be found in the file
- `/usr/share/common-licenses/GPL-3'.
diff --git a/debian/install b/debian/install
deleted file mode 100644
index 2def499..0000000
--- a/debian/install
+++ /dev/null
@@ -1 +0,0 @@
-contrib/* usr/share/juju-lint/contrib
diff --git a/debian/rules b/debian/rules
deleted file mode 100755
index 43797a6..0000000
--- a/debian/rules
+++ /dev/null
@@ -1,15 +0,0 @@
-#!/usr/bin/make -f
-# -*- makefile -*-
-# Sample debian/rules that uses debhelper.
-# This file was originally written by Joey Hess and Craig Small.
-# As a special exception, when this file is copied by dh-make into a
-# dh-make output file, you may use that output file without restriction.
-# This special exception was added by Craig Small in version 0.37 of dh-make.
-
-# Uncomment this to turn on verbose mode.
-#export DH_VERBOSE=1
-
-export PYBUILD_NAME=juju_lint
-
-%:
-	dh $@ --with=python3 --without-python2 --buildsystem=pybuild
diff --git a/example-lint-rules.yaml b/example-lint-rules.yaml
index 70776d4..e0c6830 100644
--- a/example-lint-rules.yaml
+++ b/example-lint-rules.yaml
@@ -1,5 +1,39 @@
+---
+config:
+  example-charm:
+    example-setting:
+      eq: true
+
 subordinates:
   telegraf:
     where: all
   landscape-client:
     where: all
+  ntp:
+    where: all
+
+# the below "example" cloud depicts an application running on apache2
+# which relies on mysql and rabbitmq, and should have ntp deployed
+# across all notes. etcd may also be deployed on some machines.
+example mandatory: &example-mandatory-charms
+  - apache2
+
+example mandatory deps: &example-mandatory-deps
+  - rabbitmq-server
+  - mysql
+
+example mandatory subordinates: &example-mandatory-subs
+  - ntp
+
+example optional charms: &example-optional-charms
+  - etcd
+
+example charms: &openstack-charms
+  - *example-mandatory-charms
+  - *example-mandatory-deps
+  - *example-mandatory-subs
+  - *example-optional-charms
+
+known charms:
+  - ubuntu
+  - *example-charms
diff --git a/juju-lint b/juju-lint
index 6759e60..3df527a 120000
--- a/juju-lint
+++ b/juju-lint
@@ -1 +1 @@
-jujulint.py
\ No newline at end of file
+jujulint/cli.py
\ No newline at end of file
diff --git a/jujulint.py b/jujulint.py
deleted file mode 100755
index 47806f3..0000000
--- a/jujulint.py
+++ /dev/null
@@ -1,457 +0,0 @@
-#!/usr/bin/env python3
-
-# This file is part of juju-lint, a tool for validating that Juju
-# deloyments meet configurable site policies.
-#
-# Copyright 2018-2019 Canonical Limited.
-# License granted by Canonical Limited.
-#
-# This program is free software: you can redistribute it and/or modify
-# it under the terms of the GNU General Public License version 3, as
-# published by the Free Software Foundation.
-#
-# This program is distributed in the hope that it will be useful, but
-# WITHOUT ANY WARRANTY; without even the implied warranties of
-# MERCHANTABILITY, SATISFACTORY QUALITY, or FITNESS FOR A PARTICULAR
-# PURPOSE.  See the GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program. If not, see <http://www.gnu.org/licenses/>.
-
-import collections
-import logging
-import optparse
-import pprint
-import re
-import sys
-
-import yaml
-
-from attr import attrs, attrib
-import attr
-
-# TODO:
-#  - tests
-#  - non-OK statuses?
-#  - missing relations for mandatory subordinates
-#  - info mode, e.g. num of machines, version (e.g. look at ceph), architecture
-
-
-class InvalidCharmNameError(Exception):
-    pass
-
-
-@attrs
-class ModelInfo(object):
-    # Info obtained from juju status data
-    charms = attrib(default=attr.Factory(set))
-    app_to_charm = attrib(default=attr.Factory(dict))
-    subs_on_machines = attrib(default=attr.Factory(dict))
-    apps_on_machines = attrib(default=attr.Factory(dict))
-    machines_to_az = attrib(default=attr.Factory(dict))
-
-    # Output of our linting
-    missing_subs = attrib(default=attr.Factory(dict))
-    extraneous_subs = attrib(default=attr.Factory(dict))
-    duelling_subs = attrib(default=attr.Factory(dict))
-    az_unbalanced_apps = attrib(default=attr.Factory(dict))
-
-
-def fubar(msg, exit_code=1):
-    sys.stderr.write("E: %s\n" % (msg))
-    sys.exit(exit_code)
-
-
-def setup_logging(loglevel, logfile):
-    logFormatter = logging.Formatter(
-        fmt="%(asctime)s [%(levelname)s] %(message)s",
-        datefmt="%Y-%m-%d %H:%M:%S")
-    rootLogger = logging.getLogger()
-    rootLogger.setLevel(loglevel)
-
-    consoleHandler = logging.StreamHandler()
-    consoleHandler.setFormatter(logFormatter)
-    rootLogger.addHandler(consoleHandler)
-
-    if logfile:
-        try:
-            fileLogger = logging.getLogger('file')
-            # If we send output to the file logger specifically, don't propagate it
-            # to the root logger as well to avoid duplicate output. So if we want
-            # to only send logging output to the file, you would do this:
-            #  logging.getLogger('file').info("message for logfile only")
-            # rather than this:
-            #  logging.info("message for console and logfile")
-            fileLogger.propagate = False
-
-            fileHandler = logging.FileHandler(logfile)
-            fileHandler.setFormatter(logFormatter)
-            rootLogger.addHandler(fileHandler)
-            fileLogger.addHandler(fileHandler)
-        except IOError:
-            logging.error("Unable to write to logfile: {}".format(logfile))
-
-
-def flatten_list(l):
-    t = []
-    for i in l:
-        if not isinstance(i, list):
-            t.append(i)
-        else:
-            t.extend(flatten_list(i))
-    return t
-
-
-def read_rules(options):
-    with open(options.config, 'r') as yaml_file:
-        lint_rules = yaml.safe_load(yaml_file)
-    if options.override:
-        for override in options.override.split("#"):
-            (name, where) = override.split(":")
-            logging.info("Overriding %s with %s" % (name, where))
-            lint_rules["subordinates"][name] = dict(where=where)
-    lint_rules["known charms"] = flatten_list(lint_rules["known charms"])
-    logging.debug("Lint Rules: {}".format(pprint.pformat(lint_rules)))
-    return lint_rules
-
-
-def process_subordinates(app_d, app_name, model):
-    # If this is a subordinate we have nothing else to do ATM
-    if "units" not in app_d:
-        return
-    for unit in app_d["units"]:
-        # juju_status = app_d["units"][unit]["juju-status"]
-        # workload_status = app_d["units"][unit]["workload-status"]
-        if "subordinates" in app_d["units"][unit]:
-            subordinates = app_d["units"][unit]["subordinates"].keys()
-            subordinates = [i.split("/")[0] for i in subordinates]
-        else:
-            subordinates = []
-        logging.debug("%s: %s" % (unit, subordinates))
-        machine = app_d["units"][unit]["machine"]
-        model.subs_on_machines.setdefault(machine, set())
-        for sub in subordinates:
-            if sub in model.subs_on_machines[machine]:
-                model.duelling_subs.setdefault(sub, set())
-                model.duelling_subs[sub].add(machine)
-        model.subs_on_machines[machine] = (set(subordinates) |
-                                           model.subs_on_machines[machine])
-        model.apps_on_machines.setdefault(machine, set())
-        model.apps_on_machines[machine].add(app_name)
-
-    return
-
-
-def is_container(machine):
-    if "/" in machine:
-        return True
-    else:
-        return False
-
-
-def check_subs(model, lint_rules):
-    all_or_nothing = set()
-    for machine in model.subs_on_machines:
-        for sub in model.subs_on_machines[machine]:
-            all_or_nothing.add(sub)
-
-    for required_sub in lint_rules["subordinates"]:
-        model.missing_subs.setdefault(required_sub, set())
-        model.extraneous_subs.setdefault(required_sub, set())
-        logging.debug("Checking for sub %s" % (required_sub))
-        where = lint_rules["subordinates"][required_sub]["where"]
-        for machine in model.subs_on_machines:
-            logging.debug("Checking on %s" % (machine))
-            present_subs = model.subs_on_machines[machine]
-            apps = model.apps_on_machines[machine]
-            if where.startswith("on "):  # only on specific apps
-                logging.debug("requirement is = form...")
-                required_on = where[3:]
-                if required_on not in apps:
-                    logging.debug("... NOT matched")
-                    continue
-                logging.debug("... matched")
-            # TODO this needs to be not just one app, but a list
-            elif where.startswith("all except "):  # not next to this app
-                logging.debug("requirement is != form...")
-                not_on = where[11:]
-                if not_on in apps:
-                    logging.debug("... matched, not wanted on this host")
-                    continue
-            elif where == "host only":
-                logging.debug("requirement is 'host only' form....")
-                if is_container(machine):
-                    logging.debug("... and we are a container, checking")
-                    # XXX check alternate names?
-                    if required_sub in present_subs:
-                        logging.debug("... found extraneous sub")
-                        for app in model.apps_on_machines[machine]:
-                            model.extraneous_subs[required_sub].add(app)
-                    continue
-                logging.debug("... and we are a host, will fallthrough")
-            elif (where == "all or nothing" and
-                  required_sub not in all_or_nothing):
-                logging.debug("requirement is 'all or nothing' and was 'nothing'.")
-                continue
-            # At this point we know we require the subordinate - we might just
-            # need to change the name we expect to see it as
-            elif where == "container aware":
-                logging.debug("requirement is 'container aware'.")
-                if is_container(machine):
-                    suffixes = lint_rules["subordinates"][required_sub]["container-suffixes"]
-                else:
-                    suffixes = lint_rules["subordinates"][required_sub]["host-suffixes"]
-                logging.debug("-> suffixes == %s" % (suffixes))
-                found = False
-                for suffix in suffixes:
-                    looking_for = "%s-%s" % (required_sub, suffix)
-                    logging.debug("-> Looking for %s" % (looking_for))
-                    if looking_for in present_subs:
-                        logging.debug("-> FOUND!!!")
-                        found = True
-                if not found:
-                    for sub in present_subs:
-                        if model.app_to_charm[sub] == required_sub:
-                            logging.debug("!!: winner winner chicken dinner %s" % (sub))
-                            found = True
-                if not found:
-                    logging.debug("-> NOT FOUND")
-                    for app in model.apps_on_machines[machine]:
-                        model.missing_subs[required_sub].add(app)
-                logging.debug("-> continue-ing back out...")
-                continue
-            elif where not in ["all", "all or nothing"]:
-                fubar("invalid requirement '%s' on %s" % (where, required_sub))
-            logging.debug("requirement is 'all' OR we fell through.")
-            if required_sub not in present_subs:
-                for sub in present_subs:
-                    if model.app_to_charm[sub] == required_sub:
-                        logging.debug("!!!: winner winner chicken dinner %s" % (sub))
-                        continue
-                logging.debug("not found.")
-                for app in model.apps_on_machines[machine]:
-                    model.missing_subs[required_sub].add(app)
-
-    for sub in list(model.missing_subs.keys()):
-        if not model.missing_subs[sub]:
-            del model.missing_subs[sub]
-    for sub in list(model.extraneous_subs.keys()):
-        if not model.extraneous_subs[sub]:
-            del model.extraneous_subs[sub]
-
-
-def check_charms(model, lint_rules):
-    # Check we recognise the charms which are there
-    for charm in model.charms:
-        if charm not in lint_rules["known charms"]:
-            logging.error("charm '%s' not recognised" % (charm))
-    # Then look for charms we require
-    for charm in lint_rules["operations mandatory"]:
-        if charm not in model.charms:
-            logging.error("ops charm '%s' not found" % (charm))
-    for charm in lint_rules["openstack mandatory"]:
-        if charm not in model.charms:
-            logging.error("OpenStack charm '%s' not found" % (charm))
-
-
-def results(model):
-    if model.missing_subs:
-        logging.info("The following subordinates couldn't be found:")
-        for sub in model.missing_subs:
-            logging.error(" -> %s [%s]" % (sub, ", ".join(sorted(model.missing_subs[sub]))))
-    if model.extraneous_subs:
-        logging.info("following subordinates where found unexpectedly:")
-        for sub in model.extraneous_subs:
-            logging.error(" -> %s [%s]" % (sub, ", ".join(sorted(model.extraneous_subs[sub]))))
-    if model.duelling_subs:
-        logging.info("following subordinates where found on machines more than once:")
-        for sub in model.duelling_subs:
-            logging.error(" -> %s [%s]" % (sub, ", ".join(sorted(model.duelling_subs[sub]))))
-    if model.az_unbalanced_apps:
-        logging.error("The following apps are unbalanced across AZs: ")
-        for app in model.az_unbalanced_apps:
-            (num_units, az_counter) = model.az_unbalanced_apps[app]
-            az_map = ", ".join(["%s: %s" % (az, az_counter[az]) for az in az_counter])
-            logging.error(" -> %s: %s units, deployed as: %s" % (app, num_units, az_map))
-
-
-def map_charms(applications, model):
-    for app in applications:
-        charm = applications[app]["charm"]
-        match = re.match(r'^(?:\w+:)?(?:~[\w-]+/)?(?:\w+/)?([a-zA-Z0-9-]+?)(?:-\d+)?$', charm)
-        if not match:
-            raise InvalidCharmNameError("charm name '{}' is invalid".format(charm))
-        charm = match.group(1)
-        model.charms.add(charm)
-        model.app_to_charm[app] = charm
-
-
-def map_machines_to_az(machines, model):
-    for machine in machines:
-        if "hardware" not in machines[machine]:
-            logging.error("I: Machine %s has no hardware info; skipping." % (machine))
-            continue
-
-        hardware = machines[machine]["hardware"]
-        found_az = False
-        for entry in hardware.split():
-            if entry.startswith("availability-zone="):
-                found_az = True
-                az = entry.split("=")[1]
-                model.machines_to_az[machine] = az
-                break
-        if not found_az:
-            logging.error("I: Machine %s has no availability-zone info in hardware field; skipping." % (machine))
-
-
-def check_status(what, status, expected):
-    if isinstance(expected, str):
-        expected = [expected]
-    if status.get("current") not in expected:
-        logging.error("%s has status '%s' (since: %s, message: %s); {We expected: %s}"
-                      % (what, status.get("current"), status.get("since"),
-                         status.get("message"), expected))
-
-
-def check_status_pair(name, status_type, data_d):
-    if status_type in ["machine", "container"]:
-        primary = "machine-status"
-        primary_expected = "running"
-        juju_expected = "started"
-    elif status_type in ["unit", "subordinate"]:
-        primary = "workload-status"
-        primary_expected = ["active", "unknown"]
-        juju_expected = "idle"
-    elif status_type in ["application"]:
-        primary = "application-status"
-        primary_expected = ["active", "unknown"]
-        juju_expected = None
-
-    check_status("%s %s" % (status_type.title(), name), data_d[primary],
-                 expected=primary_expected)
-    if juju_expected:
-        check_status("Juju on %s %s" % (status_type, name),
-                     data_d["juju-status"],
-                     expected=juju_expected)
-
-
-def check_statuses(juju_status, applications):
-    for machine_name in juju_status["machines"]:
-        check_status_pair(machine_name, "machine", juju_status["machines"][machine_name])
-        for container_name in juju_status["machines"][machine_name].get("container", []):
-            check_status_pair(container_name, "container",
-                              juju_status["machines"][machine_name][container_name])
-
-    for app_name in juju_status[applications]:
-        check_status_pair(app_name, "application",
-                          juju_status[applications][app_name])
-        for unit_name in juju_status[applications][app_name].get("units", []):
-            check_status_pair(unit_name, "unit",
-                              juju_status[applications][app_name]["units"][unit_name])
-            # This is noisy and only covers a very theoretical corner case
-            # where a misbehaving or malicious leader unit sets the
-            # application-status to OK despite one or more units being in error
-            # state.
-            #
-            # We could revisit this later by splitting it into two passes and
-            # only warning about individual subordinate units if the
-            # application-status for the subordinate claims to be OK.
-            #
-            # for subordinate_name in juju_status[applications][app_name]["units"][unit_name].get("subordinates", []):
-            #     check_status_pair(subordinate_name, "subordinate",
-            #                       juju_status[applications][app_name]["units"][unit_name]["subordinates"][subordinate_name])
-
-
-def check_azs(applications, model):
-    # Figure out how many AZs we have
-    azs = set()
-    for machine in model.machines_to_az:
-        azs.add(model.machines_to_az[machine])
-    num_azs = len(azs)
-    if num_azs != 3:
-        logging.error("E: Found %s AZs (not 3); and I don't currently know how to lint that." % (num_azs))
-        return
-
-    for app_name in applications:
-        az_counter = collections.Counter()
-        for az in azs:
-            az_counter[az] = 0
-        num_units = len(applications[app_name].get("units", []))
-        if num_units <= 1:
-            continue
-        min_per_az = num_units // num_azs
-        for unit in applications[app_name]["units"]:
-            machine = applications[app_name]["units"][unit]["machine"]
-            machine = machine.split("/")[0]
-            if machine not in model.machines_to_az:
-                logging.error("E: [%s] Can't find machine %s in machine to AZ mapping data" % (app_name, machine))
-                continue
-            az_counter[model.machines_to_az[machine]] += 1
-        for az in az_counter:
-            num_this_az = az_counter[az]
-            if num_this_az < min_per_az:
-                model.az_unbalanced_apps[app_name] = [num_units, az_counter]
-
-
-def lint(filename, lint_rules):
-    model = ModelInfo()
-
-    with open(filename, 'r') as infile:
-        j = yaml.safe_load(infile.read())
-
-    # Handle Juju 2 vs Juju 1
-    applications = "applications"
-    if applications not in j:
-        applications = "services"
-
-    # Build a list of deployed charms and mapping of charms <-> applications
-    map_charms(j[applications], model)
-
-    # Then map out subordinates to applications
-    for app in j[applications]:
-        process_subordinates(j[applications][app], app, model)
-
-    map_machines_to_az(j["machines"], model)
-    check_azs(j[applications], model)
-
-    check_subs(model, lint_rules)
-    check_charms(model, lint_rules)
-
-    if j.get('machines'):
-        check_statuses(j, applications)
-    else:
-        logging.info("Not checking status, this is a bundle")
-
-    results(model)
-
-
-def init():
-    """Initalization, including parsing of options."""
-
-    usage = """usage: %prog [OPTIONS]
-    Sanity check a Juju model"""
-    parser = optparse.OptionParser(usage)
-    parser.add_option("-c", "--config", default="lint-rules.yaml",
-                      help="File to read lint rules from. Defaults to `lint-rules.yaml`")
-    parser.add_option("-o", "--override-subordinate",
-                      dest="override",
-                      help="override lint-rules.yaml, e.g. -o canonical-livepatch:all")
-    parser.add_option("--loglevel", "-l", default='INFO',
-                      help="Log level. Defaults to INFO")
-    parser.add_option("--logfile", "-L", default=None,
-                      help="File to log to in addition to stdout")
-    (options, args) = parser.parse_args()
-
-    return (options, args)
-
-
-def main():
-    (options, args) = init()
-    setup_logging(options.loglevel, options.logfile)
-    lint_rules = read_rules(options)
-    for filename in args:
-        lint(filename, lint_rules)
-
-
-if __name__ == "__main__":
-    main()
diff --git a/jujulint/__init__.py b/jujulint/__init__.py
new file mode 100644
index 0000000..3bb8cbc
--- /dev/null
+++ b/jujulint/__init__.py
@@ -0,0 +1 @@
+"""Import this library to fetch and lint the configuration and status of Juju environments."""
diff --git a/jujulint/cli.py b/jujulint/cli.py
new file mode 100755
index 0000000..a75a7c3
--- /dev/null
+++ b/jujulint/cli.py
@@ -0,0 +1,136 @@
+#!/usr/bin/env python3
+# This file is part of juju-lint, a tool for validating that Juju
+# deloyments meet configurable site policies.
+#
+# Copyright 2018-2020 Canonical Limited.
+# License granted by Canonical Limited.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 3, as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranties of
+# MERCHANTABILITY, SATISFACTORY QUALITY, or FITNESS FOR A PARTICULAR
+# PURPOSE.  See the GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+"""Main entrypoint for the juju-lint CLI."""
+from jujulint.config import Config
+from jujulint.lint import Linter
+from jujulint.logging import Logger
+from jujulint.openstack import OpenStack
+import pkg_resources
+import yaml
+
+
+class Cli:
+    """Core class of the CLI for juju-lint."""
+
+    clouds = {}
+
+    def __init__(self):
+        """Create new CLI and configure runtime environment."""
+        self.config = Config()
+        self.logger = Logger(self.config["logging"]["loglevel"].get())
+        self.version = pkg_resources.require("jujulint")[0].version
+        self.lint_rules = "{}/{}".format(
+            self.config.config_dir(), self.config["rules"]["file"].get()
+        )
+
+    def startup_message(self):
+        """Print startup message to log."""
+        self.logger.info(
+            (
+                "juju-lint version {} starting...\n"
+                "\t* Config directory: {}\n"
+                "\t* Log level: {}\n"
+            ).format(
+                self.version,
+                self.config.config_dir(),
+                self.config["logging"]["loglevel"].get(),
+            )
+        )
+
+    def audit_file(self, filename, cloud_type=None):
+        """Directly audit a YAML file."""
+        self.logger.debug("Starting audit of file {}".format(filename))
+        linter = Linter(filename, self.lint_rules, cloud_type=cloud_type,)
+        linter.read_rules()
+        self.logger.info("[{}] Linting manual file...".format(filename))
+        linter.lint_yaml_file(filename)
+
+    def audit_all(self):
+        """Iterate over clouds and run audit."""
+        self.logger.debug("Starting audit")
+        for cloud_name in self.config["clouds"].get():
+            self.audit(cloud_name)
+        # serialise state
+        if self.clouds:
+            self.write_yaml(self.clouds, "all-data.yaml")
+
+    def audit(self, cloud_name):
+        """Run the main audit process process each cloud."""
+        # load clouds and loop through each defined cloud
+        if cloud_name not in self.clouds.keys():
+            self.clouds[cloud_name] = {}
+        cloud = self.config["clouds"][cloud_name].get()
+        access_method = "local"
+        ssh_host = None
+        sudo_user = None
+        if "access" in cloud:
+            access_method = cloud["access"]
+        if "sudo" in cloud:
+            sudo_user = cloud["sudo"]
+        if "host" in cloud:
+            ssh_host = cloud["host"]
+        self.logger.debug(cloud)
+        # load correct handler (OpenStack)
+        if cloud["type"] == "openstack":
+            cloud_instance = OpenStack(
+                cloud_name,
+                access_method=access_method,
+                ssh_host=ssh_host,
+                sudo_user=sudo_user,
+                lint_rules=self.lint_rules,
+            )
+        # refresh information
+        result = cloud_instance.refresh()
+        if result:
+            self.clouds[cloud_name] = cloud_instance.cloud_state
+            self.logger.debug(
+                "Cloud state for {} after refresh: {}".format(
+                    cloud_name, cloud_instance.cloud_state
+                )
+            )
+            self.write_yaml(
+                cloud_instance.cloud_state, "{}-state.yaml".format(cloud_name)
+            )
+            # run audit checks
+            cloud_instance.audit()
+        else:
+            self.logger.error("[{}] Failed getting cloud state".format(cloud_name))
+
+    def write_yaml(self, data, file_name):
+        """Write collected information to YAML."""
+        if "dump" in self.config["output"]:
+            if self.config["output"]["dump"]:
+                folder_name = self.config["output"]["folder"].get()
+                file_handle = open("{}/{}".format(folder_name, file_name), "w")
+                yaml.dump(data, file_handle)
+
+
+def main():
+    """Program entry point."""
+    cli = Cli()
+    cli.startup_message()
+    if "manual-file" in cli.config:
+        manual_file = cli.config["manual-file"].get()
+        if "manual-type" in cli.config:
+            manual_type = cli.config["manual-type"].get()
+            cli.audit_file(manual_file, cloud_type=manual_type)
+        else:
+            cli.audit_file(manual_file)
+    else:
+        cli.audit_all()
diff --git a/jujulint/cloud.py b/jujulint/cloud.py
new file mode 100644
index 0000000..b3cde24
--- /dev/null
+++ b/jujulint/cloud.py
@@ -0,0 +1,376 @@
+#!/usr/bin/env python3
+# This file is part of juju-lint, a tool for validating that Juju
+# deloyments meet configurable site policies.
+#
+# Copyright 2018-2020 Canonical Limited.
+# License granted by Canonical Limited.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 3, as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranties of
+# MERCHANTABILITY, SATISFACTORY QUALITY, or FITNESS FOR A PARTICULAR
+# PURPOSE.  See the GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+"""Cloud access module.
+
+Runs locally or uses Fabric to parse a cloud's Juju bundle and provide SSH access to the units
+
+Attributes:
+     access_method (string, optional): Set the access method (local/ssh). Defaults to local.
+     ssh_host (string, optional): Configuration to pass to Cloud module for accessing the cloud via SSH
+     sudo_user (string, optional): User to switch to via sudo when accessing the cloud, passed to the Cloud module
+
+Todo:
+    * SSH to remote host honouring SSH config
+    * Sudo to desired user
+    * Get bundle from remote host
+    * Parse bundle into dict
+    * Add function to run command on a unit, via fabric and jump host if configured
+
+"""
+from fabric2 import Connection, Config
+from paramiko.ssh_exception import SSHException
+from jujulint.logging import Logger
+from jujulint.lint import Linter
+from subprocess import check_output
+import socket
+import yaml
+
+
+class Cloud:
+    """Cloud helper class."""
+
+    def __init__(
+        self,
+        name,
+        lint_rules=None,
+        access_method="local",
+        ssh_host=None,
+        sudo_user=None,
+        lint_overrides=None,
+        cloud_type=None,
+    ):
+        """Instantiate Cloud configuration and state."""
+        # instance variables
+        self.cloud_state = {}
+        self.access_method = "local"
+        self.ssh_host = ""
+        self.sudo_user = ""
+        self.hostname = ""
+        self.name = ""
+        self.fabric_config = {}
+        self.lint_rules = lint_rules
+        self.lint_overrides = lint_overrides
+        self.cloud_type = cloud_type
+
+        # process variables
+        self.logger = Logger()
+        self.logger.debug("Configuring {} cloud.".format(access_method))
+        if sudo_user:
+            self.sudo_user = sudo_user
+            self.fabric_config = {"sudo": {"user": sudo_user}}
+        if access_method == "ssh":
+            if ssh_host:
+                self.logger.debug("SSH host: {}".format(ssh_host))
+                self.hostname = ssh_host
+                self.connection = Connection(
+                    ssh_host, config=Config(overrides=self.fabric_config)
+                )
+                self.access_method = "ssh"
+        elif access_method == "local":
+            self.hostname = socket.getfqdn()
+        self.name = name
+
+    def run_command(self, command):
+        """Run a command via fabric on the local or remote host."""
+        if self.access_method == "local":
+            self.logger.debug("Running local command: {}".format(command))
+            args = command.split(" ")
+            return check_output(args)
+        elif self.access_method == "ssh":
+            if self.sudo_user:
+                self.logger.debug(
+                    "Running SSH command {} on {} as {}...".format(
+                        command, self.hostname, self.sudo_user
+                    )
+                )
+                try:
+                    result = self.connection.sudo(command, hide=True, warn=True)
+                except SSHException as e:
+                    self.logger.error(
+                        "[{}] SSH command {} failed: {}".format(self.name, command, e)
+                    )
+                    return None
+                return result.stdout
+            else:
+                self.logger.debug(
+                    "Running SSH command {} on {}...".format(command, self.hostname)
+                )
+                try:
+                    result = self.connection.run(command, hide=True, warn=True)
+                except SSHException as e:
+                    self.logger.error(
+                        "[{}] SSH command {} failed: {}".format(self.name, command, e)
+                    )
+                    return None
+                return result.stdout
+
+    def run_unit_command(self, target, command):
+        """Run a command on a Juju unit and return the output."""
+
+    def parse_yaml(self, yaml_string):
+        """Parse YAML using PyYAML."""
+        data = yaml.safe_load_all(yaml_string)
+        return list(data)
+
+    def get_juju_controllers(self):
+        """Get a list of Juju controllers."""
+        controller_output = self.run_command("juju controllers --format yaml")
+        if controller_output:
+            controllers = self.parse_yaml(controller_output)
+
+            if len(controllers) > 0:
+                self.logger.debug("Juju controller list: {}".format(controllers[0]))
+                if "controllers" in controllers[0]:
+                    for controller in controllers[0]["controllers"].keys():
+                        self.logger.info(
+                            "[{}] Found Juju controller: {}".format(
+                                self.name, controller
+                            )
+                        )
+                        if controller not in self.cloud_state.keys():
+                            self.cloud_state[controller] = {}
+                        self.cloud_state[controller]["config"] = controllers[0][
+                            "controllers"
+                        ][controller]
+            return True
+        self.logger.error("[{}] Could not get controller list".format(self.name))
+        return False
+
+    def get_juju_models(self):
+        """Get a list of Juju models."""
+        result = self.get_juju_controllers()
+        if result:
+            for controller in self.cloud_state.keys():
+                self.logger.info(
+                    "[{}] Getting models for controller: {}".format(
+                        self.name, controller
+                    )
+                )
+                models_data = self.run_command(
+                    "juju models -c {} --format yaml".format(controller)
+                )
+                self.logger.debug("Getting models from: {}".format(models_data))
+                models = self.parse_yaml(models_data)
+                if len(models) > 0:
+                    if "models" in models[0]:
+                        for model in models[0]["models"]:
+                            model_name = model["short-name"]
+                            self.logger.info(
+                                "[{}] Processing model {} for controller: {}".format(
+                                    self.name, model_name, controller
+                                )
+                            )
+                            self.logger.debug(
+                                "Processing model {} for controller {}: {}".format(
+                                    model_name, controller, model
+                                )
+                            )
+                            if "models" not in self.cloud_state[controller].keys():
+                                self.cloud_state[controller]["models"] = {}
+                            if (
+                                model_name
+                                not in self.cloud_state[controller]["models"].keys()
+                            ):
+                                self.cloud_state[controller]["models"][model_name] = {}
+                            self.cloud_state[controller]["models"][model_name][
+                                "config"
+                            ] = model
+            return True
+        self.logger.error("[{}] Could not get model list".format(self.name))
+        return False
+
+    def get_juju_status(self, controller, model):
+        """Get a view of juju status for a given model."""
+        status_data = self.run_command(
+            "juju status -m {}:{} --format yaml".format(controller, model)
+        )
+        status = self.parse_yaml(status_data)
+        self.logger.info(
+            "[{}] Processing Juju status for model {} on controller {}".format(
+                self.name, model, controller
+            )
+        )
+        if len(status) > 0:
+            if "model" in status[0].keys():
+                self.cloud_state[controller]["models"][model]["version"] = status[0][
+                    "model"
+                ]["version"]
+            if "machines" in status[0].keys():
+                for machine in status[0]["machines"].keys():
+                    machine_data = status[0]["machines"][machine]
+                    self.logger.debug(
+                        "Parsing status for machine {} in model {}: {}".format(
+                            machine, model, machine_data
+                        )
+                    )
+                    if "display-name" in machine_data:
+                        machine_name = machine_data["display-name"]
+                    else:
+                        machine_name = machine
+                    if "machines" not in self.cloud_state[controller]["models"][model]:
+                        self.cloud_state[controller]["models"][model]["machines"] = {}
+                    if (
+                        "machine_name"
+                        not in self.cloud_state[controller]["models"][model][
+                            "machines"
+                        ].keys()
+                    ):
+                        self.cloud_state[controller]["models"][model]["machines"][
+                            machine_name
+                        ] = {}
+                    self.cloud_state[controller]["models"][model]["machines"][
+                        machine_name
+                    ].update(machine_data)
+                    self.cloud_state[controller]["models"][model]["machines"][
+                        machine_name
+                    ]["machine_id"] = machine
+            if "applications" in status[0].keys():
+                for application in status[0]["applications"].keys():
+                    application_data = status[0]["applications"][application]
+                    self.logger.debug(
+                        "Parsing status for application {} in model {}: {}".format(
+                            application, model, application_data
+                        )
+                    )
+                    if (
+                        "applications"
+                        not in self.cloud_state[controller]["models"][model]
+                    ):
+                        self.cloud_state[controller]["models"][model][
+                            "applications"
+                        ] = {}
+                    if (
+                        application
+                        not in self.cloud_state[controller]["models"][model][
+                            "applications"
+                        ].keys()
+                    ):
+                        self.cloud_state[controller]["models"][model]["applications"][
+                            application
+                        ] = {}
+                    self.cloud_state[controller]["models"][model]["applications"][
+                        application
+                    ].update(application_data)
+
+    def get_juju_bundle(self, controller, model):
+        """Get an export of the juju bundle for the provided model."""
+        bundle_data = self.run_command(
+            "juju export-bundle -m {}:{}".format(controller, model)
+        )
+        bundles = self.parse_yaml(bundle_data)
+        self.logger.info(
+            "[{}] Processing Juju bundle export for model {} on controller {}".format(
+                self.name, model, controller
+            )
+        )
+        self.logger.debug(
+            "Juju bundle for model {} on controller {}: {}".format(
+                model, controller, bundles
+            )
+        )
+        if len(bundles) > 0:
+            combined = {}
+            for bundle in bundles:
+                combined.update(bundle)
+            if "applications" in combined:
+                for application in combined["applications"].keys():
+                    self.logger.debug(
+                        "Parsing configuration for application {} in model {}: {}".format(
+                            application, model, combined
+                        )
+                    )
+                    application_config = combined["applications"][application]
+                    if (
+                        "applications"
+                        not in self.cloud_state[controller]["models"][model]
+                    ):
+                        self.cloud_state[controller]["models"][model][
+                            "applications"
+                        ] = {}
+                    if (
+                        application
+                        not in self.cloud_state[controller]["models"][model][
+                            "applications"
+                        ].keys()
+                    ):
+                        self.cloud_state[controller]["models"][model]["applications"][
+                            application
+                        ] = {}
+                    self.cloud_state[controller]["models"][model]["applications"][
+                        application
+                    ].update(application_config)
+
+    def get_juju_state(self):
+        """Update our view of Juju-managed application state."""
+        self.logger.info(
+            "[{}] Getting Juju state for {}".format(self.name, self.hostname)
+        )
+        result = self.get_juju_models()
+        if result:
+            self.logger.debug(
+                "Cloud state for {} after gathering models:\n{}".format(
+                    self.name, yaml.dump(self.cloud_state)
+                )
+            )
+            for controller in self.cloud_state.keys():
+                for model in self.cloud_state[controller]["models"].keys():
+                    self.get_juju_status(controller, model)
+                    self.get_juju_bundle(controller, model)
+            self.logger.debug(
+                "Cloud state for {} after gathering apps:\n{}".format(
+                    self.name, yaml.dump(self.cloud_state)
+                )
+            )
+            return True
+        return False
+
+    def refresh(self):
+        """Refresh all information about the Juju cloud."""
+        self.logger.info(
+            "[{}] Refreshing cloud information for {}".format(self.name, self.hostname)
+        )
+        self.logger.debug("Running cloud-agnostic cloud refresh steps." "")
+        state = self.get_juju_state()
+        return state
+
+    def audit(self):
+        """Run cloud-type agnostic audit steps."""
+        self.logger.info(
+            "[{}] Auditing information for {}".format(self.name, self.hostname)
+        )
+        # run lint rules
+        self.logger.debug("Running cloud-agnostic Juju audits.")
+        if self.lint_rules:
+            for controller in self.cloud_state.keys():
+                for model in self.cloud_state[controller]["models"].keys():
+                    linter = Linter(
+                        self.name,
+                        self.lint_rules,
+                        overrides=self.lint_overrides,
+                        cloud_type=self.cloud_type,
+                        controller_name=controller,
+                        model_name=model,
+                    )
+                    linter.read_rules()
+                    self.logger.info(
+                        "[{}] Linting model information for {}, controller {}, model {}...".format(
+                            self.name, self.hostname, controller, model
+                        )
+                    )
+                    linter.do_lint(self.cloud_state[controller]["models"][model])
diff --git a/jujulint/config.py b/jujulint/config.py
new file mode 100644
index 0000000..b4d1e1c
--- /dev/null
+++ b/jujulint/config.py
@@ -0,0 +1,101 @@
+#!/usr/bin/env python3
+# This file is part of juju-lint, a tool for validating that Juju
+# deloyments meet configurable site policies.
+#
+# Copyright 2018-2020 Canonical Limited.
+# License granted by Canonical Limited.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 3, as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranties of
+# MERCHANTABILITY, SATISFACTORY QUALITY, or FITNESS FOR A PARTICULAR
+# PURPOSE.  See the GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+"""Config handling routines."""
+
+from confuse import Configuration
+from argparse import ArgumentParser
+
+
+class Config(Configuration):
+    """Helper class for holding parsed config, extending confuse's BaseConfiguraion class."""
+
+    def __init__(self):
+        """Wrap the initialisation of confuse's Configuration object providing defaults for our application."""
+        super().__init__("juju-lint", __name__)
+
+        parser = ArgumentParser(description="Sanity check one or more Juju models")
+        parser.add_argument(
+            "-l",
+            "--log-level",
+            type=str,
+            default="info",
+            nargs="?",
+            help="The default log level, valid options are info, warn, error or debug",
+            dest="logging.loglevel",
+        )
+        parser.add_argument(
+            "-d",
+            "--output-dir",
+            type=str,
+            default="output",
+            nargs="?",
+            help="The folder to use when saving gathered cloud data and lint reports.",
+            dest="output.folder",
+        )
+        parser.add_argument(
+            "--dump-state",
+            type=str,
+            help=(
+                "Optionally, dump cloud state as YAML into --output-dir."
+                "Use with caution, as dumps will contain sensitve data."
+            ),
+            dest="output.dump",
+        )
+        parser.add_argument(
+            "-c",
+            "--config",
+            default="lint-rules.yaml",
+            help="File to read lint rules from. Defaults to `lint-rules.yaml`",
+            dest="rules.file",
+        )
+        parser.add_argument(
+            "manual-file",
+            metavar="manual-file",
+            nargs='?',
+            type=str,
+            default=None,
+            help=(
+                "File to read state from. Supports bundles and status output in YAML format."
+                "Setting this disables collection of data from remote or local clouds configured via config.yaml."
+            ),
+        )
+        parser.add_argument(
+            "-t",
+            "--cloud-type",
+            help=(
+                "Sets the cloud type when specifying a YAML file to audit with -f or --cloud-file."
+            ),
+            dest="manual-type",
+        )
+        parser.add_argument(
+            "-o",
+            "--override-subordinate",
+            dest="override.subordinate",
+            help="override lint-rules.yaml, e.g. -o canonical-livepatch:all",
+        )
+        parser.add_argument(
+            "--logfile",
+            "-L",
+            default=None,
+            help="File to log to in addition to stdout",
+            dest="logging.file",
+        )
+
+        args = parser.parse_args()
+        self.set_args(args, dots=True)
diff --git a/jujulint/config_default.yaml b/jujulint/config_default.yaml
new file mode 100644
index 0000000..19cbe91
--- /dev/null
+++ b/jujulint/config_default.yaml
@@ -0,0 +1,34 @@
+---
+clouds:
+  # an example local Juju-deployed OpenStack
+  cloud1:
+    type: openstack
+    access: local
+
+  # an example remote Juju-deployed OpenStack
+  cloud2:
+    type: openstack
+    access: ssh
+    host: '[e-mail]'
+
+  # an exported bundle
+  yamlfile:
+    type: openstack
+    access: dump
+    file: 'export.yaml'
+
+  # an example remote Juju-deployed OpenStack where
+  # Juju controllers are registered under user 'juju-user
+  # in this example cloud, so we sudo to that user
+  cloud3:
+    type: openstack
+    access: ssh
+    host: '[e-mail]'
+    sudo: 'juju-user'
+
+logging:
+  level: INFO
+  file: jujulint.log
+
+rules:
+  file: lint-rules.yaml
diff --git a/jujulint/k8s.py b/jujulint/k8s.py
new file mode 100644
index 0000000..53b8c30
--- /dev/null
+++ b/jujulint/k8s.py
@@ -0,0 +1,65 @@
+#!/usr/bin/env python3
+# This file is part of juju-lint, a tool for validating that Juju
+# deloyments meet configurable site policies.
+#
+# Copyright 2018-2020 Canonical Limited.
+# License granted by Canonical Limited.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 3, as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranties of
+# MERCHANTABILITY, SATISFACTORY QUALITY, or FITNESS FOR A PARTICULAR
+# PURPOSE.  See the GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+"""Kubernetes checks module.
+
+This module provides checks for Kubernetes clouds.
+
+Attributes:
+     access (string): Set the access method (local/ssh)
+     ssh_host (string, optional): Configuration to pass to Cloud module for accessing the cloud via SSH
+     ssh_jump (string, optional): Jump/Bastion configuration to pass to Cloud module for access the cloud via SSH
+     sudo_user (string, optional): User to switch to via sudo when accessing the cloud, passed to the Cloud module
+
+Todo:
+    * Add processing of kubectl information
+    * Pass cloud type back to lint module
+    * Add rules for k8s
+    * Check OpenStack integrator charm configuration
+    * Check distribution of k8s workloads to workers
+
+"""
+
+from jujulint.cloud import Cloud
+
+
+class OpenStack(Cloud):
+    """Helper class for interacting with Nagios via the livestatus socket."""
+
+    def __init__(self, *args, **kwargs):
+        """Initialise class-local variables and configuration and pass to super."""
+        super(OpenStack, self).__init__(*args, **kwargs)
+
+    def get_neutron_ports(self):
+        """Get a list of neutron ports."""
+
+    def get_neutron_routers(self):
+        """Get a list of neutron routers."""
+
+    def get_neutron_networks(self):
+        """Get a list of neutron networks."""
+
+    def refresh(self):
+        """Refresh cloud information."""
+        return super(OpenStack, self).refresh()
+
+    def audit(self):
+        """Audit OpenStack cloud and run base Cloud audits."""
+        # add specific OpenStack checks here
+        self.logger.debug("Running OpenStack-specific audit steps.")
+        super(OpenStack, self).audit()
diff --git a/jujulint/lint.py b/jujulint/lint.py
new file mode 100755
index 0000000..92e56d6
--- /dev/null
+++ b/jujulint/lint.py
@@ -0,0 +1,882 @@
+#!/usr/bin/env python3
+
+# This file is part of juju-lint, a tool for validating that Juju
+# deloyments meet configurable site policies.
+#
+# Copyright 2018-2020 Canonical Limited.
+# License granted by Canonical Limited.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 3, as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranties of
+# MERCHANTABILITY, SATISFACTORY QUALITY, or FITNESS FOR A PARTICULAR
+# PURPOSE.  See the GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+"""Lint operations and rule processing engine."""
+import collections
+import pprint
+import re
+
+import yaml
+
+from attr import attrs, attrib
+import attr
+
+from jujulint.util import flatten_list, is_container
+from jujulint.logging import Logger
+
+# TODO:
+#  - tests
+#  - missing relations for mandatory subordinates
+#  - info mode, e.g. num of machines, version (e.g. look at ceph), architecture
+
+
+class InvalidCharmNameError(Exception):
+    """Represents an invalid charm name being processed."""
+
+    pass
+
+
+@attrs
+class ModelInfo(object):
+    """Represent information obtained from juju status data."""
+
+    charms = attrib(default=attr.Factory(set))
+    app_to_charm = attrib(default=attr.Factory(dict))
+    subs_on_machines = attrib(default=attr.Factory(dict))
+    apps_on_machines = attrib(default=attr.Factory(dict))
+    machines_to_az = attrib(default=attr.Factory(dict))
+
+    # Output of our linting
+    missing_subs = attrib(default=attr.Factory(dict))
+    extraneous_subs = attrib(default=attr.Factory(dict))
+    duelling_subs = attrib(default=attr.Factory(dict))
+    az_unbalanced_apps = attrib(default=attr.Factory(dict))
+
+
+class Linter:
+    """Linter for a Juju model, instantiate a new class for each model."""
+
+    def __init__(
+        self,
+        name,
+        filename,
+        controller_name="manual",
+        model_name="manual",
+        overrides=None,
+        cloud_type=None,
+    ):
+        """Instantiate linter."""
+        self.logger = Logger()
+        self.lint_rules = {}
+        self.model = ModelInfo()
+        self.filename = filename
+        self.overrides = overrides
+        self.cloud_name = name
+        self.cloud_type = cloud_type
+        self.controller_name = controller_name
+        self.model_name = model_name
+
+    def read_rules(self):
+        """Read and parse rules from YAML, optionally processing provided overrides."""
+        with open(self.filename, "r") as yaml_file:
+            self.lint_rules = yaml.safe_load(yaml_file)
+        if self.overrides:
+            for override in self.overrides.split("#"):
+                (name, where) = override.split(":")
+                self.logger.info(
+                    "[{}] [{}/{}] Overriding {} with {}".format(
+                        self.cloud_name,
+                        self.controller_name,
+                        self.model_name,
+                        name,
+                        where,
+                    )
+                )
+                self.lint_rules["subordinates"][name] = dict(where=where)
+        self.lint_rules["known charms"] = flatten_list(self.lint_rules["known charms"])
+        self.logger.debug(
+            "[{}] [{}/{}] Lint Rules: {}".format(
+                self.cloud_name,
+                self.controller_name,
+                self.model_name,
+                pprint.pformat(self.lint_rules),
+            )
+        )
+
+    def process_subordinates(self, app_d, app_name):
+        """Iterate over subordinates and run subordinate checks."""
+        # If this is a subordinate we have nothing else to do ATM
+        if "units" not in app_d:
+            return
+        for unit in app_d["units"]:
+            # juju_status = app_d["units"][unit]["juju-status"]
+            # workload_status = app_d["units"][unit]["workload-status"]
+            if "subordinates" in app_d["units"][unit]:
+                subordinates = app_d["units"][unit]["subordinates"].keys()
+                subordinates = [i.split("/")[0] for i in subordinates]
+            else:
+                subordinates = []
+            self.logger.debug(
+                "[{}] [{}/{}] {}: {}".format(
+                    self.cloud_name,
+                    self.controller_name,
+                    self.model_name,
+                    unit,
+                    subordinates,
+                )
+            )
+            machine = app_d["units"][unit]["machine"]
+            self.model.subs_on_machines.setdefault(machine, set())
+            for sub in subordinates:
+                if sub in self.model.subs_on_machines[machine]:
+                    self.model.duelling_subs.setdefault(sub, set())
+                    self.model.duelling_subs[sub].add(machine)
+            self.model.subs_on_machines[machine] = (
+                set(subordinates) | self.model.subs_on_machines[machine]
+            )
+            self.model.apps_on_machines.setdefault(machine, set())
+            self.model.apps_on_machines[machine].add(app_name)
+
+        return
+
+    def atoi(val):
+        """Deal with complex number representations as strings, returning a number."""
+        if type(val) != str:
+            return val
+
+        if type(val[-1]) != str:
+            return val
+
+        try:
+            _int = int(val[0:-1])
+        except Exception:
+            return val
+
+        quotient = 1024
+        if val[-1].lower() == val[-1]:
+            quotient = 1000
+
+        conv = {"g": quotient ** 3, "m": quotient ** 2, "k": quotient}
+
+        return _int * conv[val[-1].lower()]
+
+    def gte(self, name, check_value, rule, config):
+        """Check if value is greater than or equal to the check value."""
+        if rule in config:
+            current = self.atoi(config[rule])
+            expected = self.atoi(check_value)
+            if current >= expected:
+                self.logger.info(
+                    "[{}] [{}/{}] (PASS) Application {} has config for {} which is >= {}: {}.".format(
+                        self.cloud_name,
+                        self.controller_name,
+                        self.model_name,
+                        name,
+                        rule,
+                        check_value,
+                        config[rule],
+                    )
+                )
+                return True
+            self.logger.error(
+                "[{}] [{}/{}] (FAIL) Application {} has config for {} which is less than {}: {}.".format(
+                    self.cloud_name,
+                    self.controller_name,
+                    self.model_name,
+                    name,
+                    rule,
+                    check_value,
+                    config[rule],
+                )
+            )
+            return False
+        self.logger.warn(
+            "[{}] [{}/{}] When checking if application {} has no config for {}, can't determine if >= than {}.".format(
+                self.cloud_name,
+                self.controller_name,
+                self.model_name,
+                name,
+                rule,
+                check_value,
+            )
+        )
+        return False
+
+    def isset(self, name, check_value, rule, config):
+        """Check if value is set per rule constraints."""
+        if rule in config:
+            if check_value is True:
+                self.logger.info(
+                    "[{}] [{}/{}] (PASS) Application {} correctly has manual config for {}: {}.".format(
+                        self.cloud_name,
+                        self.controller_name,
+                        self.model_name,
+                        name,
+                        rule,
+                        config[rule],
+                    )
+                )
+                return True
+            self.logger.error(
+                "[{}] [{}/{}] (FAIL) Application {} has manual config for {}: {}.".format(
+                    self.cloud_name,
+                    self.controller_name,
+                    self.model_name,
+                    name,
+                    rule,
+                    config[rule],
+                )
+            )
+            return False
+        if check_value is False:
+            self.logger.info(
+                "[{}] [{}/{}] (PASS) Application {} is correctly using default config for {}.".format(
+                    self.cloud_name, self.controller_name, self.model_name, name, rule,
+                )
+            )
+            return True
+        self.logger.error(
+            "[{}] [{}/{}] (FAIL) Application {} has no manual config for {}.".format(
+                self.cloud_name, self.controller_name, self.model_name, name, rule,
+            )
+        )
+        return False
+
+    def eq(self, name, check_value, rule, config):
+        """Check if value is matches the provided value or regex, autodetecting regex."""
+        if rule in config:
+            match = False
+            try:
+                match = re.match(re.compile(str(check_value)), str(config[rule]))
+            except re.error:
+                match = check_value == config[rule]
+            if match:
+                self.logger.info(
+                    "[{}] [{}/{}] Application {} has correct setting for {}: Expected {}, got {}.".format(
+                        self.cloud_name,
+                        self.controller_name,
+                        self.model_name,
+                        name,
+                        rule,
+                        check_value,
+                        config[rule],
+                    )
+                )
+                return True
+            self.logger.error(
+                "[{}] [{}/{}] Application {} has incorrect setting for {}: Expected {}, got {}.".format(
+                    self.cloud_name,
+                    self.controller_name,
+                    self.model_name,
+                    name,
+                    rule,
+                    check_value,
+                    config[rule],
+                )
+            )
+
+    def check_config(self, name, config, rules):
+        """Check application against provided rules."""
+        rules = dict(rules)
+        for rule in rules:
+            self.logger.debug(
+                "[{}] [{}/{}] Checking {} for configuration {}".format(
+                    self.cloud_name, self.controller_name, self.model_name, name, rule
+                )
+            )
+            for check_op, check_value in rules[rule].items():
+                if check_op == "isset":
+                    self.isset(name, check_value, rule, config)
+                elif check_op == "eq":
+                    self.eq(name, check_value, rule, config)
+                elif check_op == "gte":
+                    self.eq(name, check_value, rule, config)
+                else:
+                    self.logger.warn(
+                        "[{}] [{}/{}] Application {} has unknown check operation for {}: {}.".format(
+                            self.cloud_name,
+                            self.controller_name,
+                            self.model_name,
+                            name,
+                            rule,
+                            check_op,
+                        )
+                    )
+
+    def check_configuration(self, applications):
+        """Check applicaton configs in the model."""
+        for application in applications.keys():
+            # look for config rules for this application
+            lint_rules = []
+            if "charm-name" in applications[application]:
+                charm_name = applications[application]["charm-name"]
+                if "config" in self.lint_rules:
+                    if charm_name in self.lint_rules["config"]:
+                        lint_rules = self.lint_rules["config"][charm_name].items()
+
+                if self.cloud_type == "openstack":
+                    # process openstack config rules
+                    if "openstack config" in self.lint_rules:
+                        if charm_name in self.lint_rules["openstack config"]:
+                            lint_rules.extend(
+                                self.lint_rules["openstack config"][charm_name].items()
+                            )
+
+                if lint_rules:
+                    if "options" in applications[application]:
+                        self.check_config(
+                            application,
+                            applications[application]["options"],
+                            lint_rules,
+                        )
+
+    def check_subs(self):
+        """Check the subordinates in the model."""
+        all_or_nothing = set()
+        for machine in self.model.subs_on_machines:
+            for sub in self.model.subs_on_machines[machine]:
+                all_or_nothing.add(sub)
+
+        for required_sub in self.lint_rules["subordinates"]:
+            self.model.missing_subs.setdefault(required_sub, set())
+            self.model.extraneous_subs.setdefault(required_sub, set())
+            self.logger.debug(
+                "[{}] [{}/{}] Checking for sub {}".format(
+                    self.cloud_name, self.controller_name, self.model_name, required_sub
+                )
+            )
+            where = self.lint_rules["subordinates"][required_sub]["where"]
+            for machine in self.model.subs_on_machines:
+                self.logger.debug(
+                    "[{}] [{}/{}] Checking on {}".format(
+                        self.cloud_name, self.controller_name, self.model_name, machine
+                    )
+                )
+                present_subs = self.model.subs_on_machines[machine]
+                apps = self.model.apps_on_machines[machine]
+                if where.startswith("on "):  # only on specific apps
+                    required_on = where[3:]
+                    self.logger.debug(
+                        "[{}] [{}/{}] Requirement {} is = from...".format(
+                            self.cloud_name,
+                            self.controller_name,
+                            self.model_name,
+                            required_on,
+                        )
+                    )
+                    if required_on not in apps:
+                        self.logger.debug(
+                            "[{}] [{}/{}] ... NOT matched".format(
+                                self.cloud_name, self.controller_name, self.model_name
+                            )
+                        )
+                        continue
+                    self.logger.debug("[{}] [{}/{}] ... matched")
+                # TODO this needs to be not just one app, but a list
+                elif where.startswith("all except "):  # not next to this app
+                    self.logger.debug(
+                        "[{}] [{}/{}] requirement is != form...".format(
+                            self.cloud_name, self.controller_name, self.model_name
+                        )
+                    )
+                    not_on = where[11:]
+                    if not_on in apps:
+                        self.logger.debug(
+                            "[{}] [{}/{}] ... matched, not wanted on this host".format(
+                                self.cloud_name, self.controller_name, self.model_name
+                            )
+                        )
+                        continue
+                elif where == "host only":
+                    self.logger.debug(
+                        "[{}] [{}/{}] requirement is 'host only' form....".format(
+                            self.cloud_name, self.controller_name, self.model_name
+                        )
+                    )
+                    if is_container(machine):
+                        self.logger.debug(
+                            "[{}] [{}/{}] ... and we are a container, checking".format(
+                                self.cloud_name, self.controller_name, self.model_name
+                            )
+                        )
+                        # XXX check alternate names?
+                        if required_sub in present_subs:
+                            self.logger.debug(
+                                "[{}] [{}/{}] ... found extraneous sub".format(
+                                    self.cloud_name,
+                                    self.controller_name,
+                                    self.model_name,
+                                )
+                            )
+                            for app in self.model.apps_on_machines[machine]:
+                                self.model.extraneous_subs[required_sub].add(app)
+                        continue
+                    self.logger.debug(
+                        "[{}] [{}/{}] ... and we are a host, will fallthrough".format(
+                            self.cloud_name, self.controller_name, self.model_name,
+                        )
+                    )
+                elif where == "all or nothing" and required_sub not in all_or_nothing:
+                    self.logger.debug(
+                        "[{}] [{}/{}] requirement is 'all or nothing' and was 'nothing'.".format(
+                            self.cloud_name, self.controller_name, self.model_name,
+                        )
+                    )
+                    continue
+                # At this point we know we require the subordinate - we might just
+                # need to change the name we expect to see it as
+                elif where == "container aware":
+                    self.logger.debug(
+                        "[{}] [{}/{}] requirement is 'container aware'.".format(
+                            self.cloud_name, self.controller_name, self.model_name,
+                        )
+                    )
+                    if is_container(machine):
+                        suffixes = self.lint_rules["subordinates"][required_sub][
+                            "container-suffixes"
+                        ]
+                    else:
+                        suffixes = self.lint_rules["subordinates"][required_sub][
+                            "host-suffixes"
+                        ]
+                    self.logger.debug(
+                        "[{}] [{}/{}] -> suffixes == {}".format(
+                            self.cloud_name,
+                            self.controller_name,
+                            self.model_name,
+                            suffixes,
+                        )
+                    )
+                    found = False
+                    for suffix in suffixes:
+                        looking_for = "{}-{}".format(required_sub, suffix)
+                        self.logger.debug(
+                            "[{}] [{}/{}] -> Looking for {}".format(
+                                self.cloud_name,
+                                self.controller_name,
+                                self.model_name,
+                                looking_for,
+                            )
+                        )
+                        if looking_for in present_subs:
+                            self.logger.debug("-> FOUND!!!")
+                            self.cloud_name,
+                            self.controller_name,
+                            self.model_name,
+                            found = True
+                    if not found:
+                        for sub in present_subs:
+                            if self.model.app_to_charm[sub] == required_sub:
+                                self.logger.debug(
+                                    "[{}] [{}/{}] Winner winner, chicken dinner! 🍗 {}".format(
+                                        self.cloud_name,
+                                        self.controller_name,
+                                        self.model_name,
+                                        sub,
+                                    )
+                                )
+                                found = True
+                    if not found:
+                        self.logger.debug(
+                            "[{}] [{}/{}] -> NOT FOUND".format(
+                                self.cloud_name, self.controller_name, self.model_name,
+                            )
+                        )
+                        for app in self.model.apps_on_machines[machine]:
+                            self.model.missing_subs[required_sub].add(app)
+                    self.logger.debug(
+                        "[{}] [{}/{}] -> continue-ing back out...".format(
+                            self.cloud_name, self.controller_name, self.model_name,
+                        )
+                    )
+                    continue
+                elif where not in ["all", "all or nothing"]:
+                    self.logger.fubar(
+                        "[{}] [{}/{}] Invalid requirement '{}' on {}".format(
+                            self.cloud_name,
+                            self.controller_name,
+                            self.model_name,
+                            where,
+                            required_sub,
+                        )
+                    )
+                self.logger.debug(
+                    "[{}] [{}/{}] requirement is 'all' OR we fell through.".format(
+                        self.cloud_name, self.controller_name, self.model_name,
+                    )
+                )
+                if required_sub not in present_subs:
+                    for sub in present_subs:
+                        if self.model.app_to_charm[sub] == required_sub:
+                            self.logger.debug(
+                                "Winner winner, chicken dinner! 🍗 {}".format(sub)
+                            )
+                            self.cloud_name,
+                            self.controller_name,
+                            self.model_name,
+                            continue
+                    self.logger.debug(
+                        "[{}] [{}/{}] not found.".format(
+                            self.cloud_name, self.controller_name, self.model_name,
+                        )
+                    )
+                    for app in self.model.apps_on_machines[machine]:
+                        self.model.missing_subs[required_sub].add(app)
+
+        for sub in list(self.model.missing_subs.keys()):
+            if not self.model.missing_subs[sub]:
+                del self.model.missing_subs[sub]
+        for sub in list(self.model.extraneous_subs.keys()):
+            if not self.model.extraneous_subs[sub]:
+                del self.model.extraneous_subs[sub]
+
+    def check_charms(self):
+        """Check we recognise the charms which are in the model."""
+        for charm in self.model.charms:
+            if charm not in self.lint_rules["known charms"]:
+                self.logger.error(
+                    "[{}] Charm '{}' in model {} on controller {} not recognised".format(
+                        self.cloud_name, charm, self.model_name, self.controller_name
+                    )
+                )
+        # Then look for charms we require
+        for charm in self.lint_rules["operations mandatory"]:
+            if charm not in self.model.charms:
+                self.logger.error(
+                    "[{}] Ops charm '{}' in model {} on controller {} not found".format(
+                        self.cloud_name, charm, self.model_name, self.controller_name
+                    )
+                )
+        if self.cloud_type == "openstack":
+            for charm in self.lint_rules["openstack mandatory"]:
+                if charm not in self.model.charms:
+                    self.logger.error(
+                        "[{}] OpenStack charm '{}' in model {} on controller {} not found".format(
+                            self.cloud_name,
+                            charm,
+                            self.model_name,
+                            self.controller_name,
+                        )
+                    )
+        elif self.cloud_type == "kubernetes":
+            for charm in self.lint_rules["kubernetes mandatory"]:
+                if charm not in self.model.charms:
+                    self.logger.error(
+                        "[{}] [{}/{}] Kubernetes charm '{}' not found".format(
+                            self.cloud_name,
+                            self.controller_name,
+                            self.model_name,
+                            charm,
+                        )
+                    )
+
+    def results(self):
+        """Provide results of the linting process."""
+        if self.model.missing_subs:
+            self.logger.error("The following subordinates couldn't be found:")
+            for sub in self.model.missing_subs:
+                self.logger.error(
+                    "[{}] [{}/{}] -> {} [{}]".format(
+                        self.cloud_name,
+                        self.controller_name,
+                        self.model_name,
+                        sub,
+                        ", ".join(sorted(self.model.missing_subs[sub])),
+                    )
+                )
+        if self.model.extraneous_subs:
+            self.logger.error("following subordinates where found unexpectedly:")
+            for sub in self.model.extraneous_subs:
+                self.logger.error(
+                    "[{}] [{}/{}] -> {} [{}]".format(
+                        self.cloud_name,
+                        self.controller_name,
+                        self.model_name,
+                        sub,
+                        ", ".join(sorted(self.model.extraneous_subs[sub])),
+                    )
+                )
+        if self.model.duelling_subs:
+            self.logger.error(
+                "[{}] [{}/{}] following subordinates where found on machines more than once:".format(
+                    self.cloud_name, self.controller_name, self.model_name,
+                )
+            )
+            for sub in self.model.duelling_subs:
+                self.logger.error(
+                    "[{}] [{}/{}] -> {} [{}]".format(
+                        self.cloud_name,
+                        self.controller_name,
+                        self.model_name,
+                        sub,
+                        ", ".join(sorted(self.model.duelling_subs[sub])),
+                    )
+                )
+        if self.model.az_unbalanced_apps:
+            self.logger.error("The following apps are unbalanced across AZs: ")
+            for app in self.model.az_unbalanced_apps:
+                (num_units, az_counter) = self.model.az_unbalanced_apps[app]
+                az_map = ", ".join(
+                    ["{}: {}".format(az, az_counter[az]) for az in az_counter]
+                )
+                self.logger.error(
+                    "[{}] [{}/{}] -> {}: {} units, deployed as: {}".format(
+                        self.cloud_name,
+                        self.controller_name,
+                        self.model_name,
+                        app,
+                        num_units,
+                        az_map,
+                    )
+                )
+
+    def map_charms(self, applications):
+        """Process applications in the model, validating and normalising the names."""
+        for app in applications:
+            if "charm" in applications[app]:
+                charm = applications[app]["charm"]
+                match = re.match(
+                    r"^(?:\w+:)?(?:~[\w-]+/)?(?:\w+/)?([a-zA-Z0-9-]+?)(?:-\d+)?$", charm
+                )
+                if not match:
+                    raise InvalidCharmNameError(
+                        "charm name '{}' is invalid".format(charm)
+                    )
+                charm = match.group(1)
+                self.model.charms.add(charm)
+                self.model.app_to_charm[app] = charm
+            else:
+                self.logger.error(
+                    "[{}] [{}/{}] Could not detect which charm is used for application {}".format(
+                        self.cloud_name, self.controller_name, self.model_name, app
+                    )
+                )
+
+    def map_machines_to_az(self, machines):
+        """Map machines in the model to their availability zone."""
+        for machine in machines:
+            if "hardware" not in machines[machine]:
+                self.logger.warn(
+                    "[{}] [{}/{}] Machine {} has no hardware info; skipping.".format(
+                        self.cloud_name, self.controller_name, self.model_name, machine
+                    )
+                )
+                continue
+
+            hardware = machines[machine]["hardware"]
+            found_az = False
+            for entry in hardware.split():
+                if entry.startswith("availability-zone="):
+                    found_az = True
+                    az = entry.split("=")[1]
+                    self.model.machines_to_az[machine] = az
+                    break
+            if not found_az:
+                self.logger.warn(
+                    "[{}] [{}/{}] Machine {} has no availability-zone info in hardware field; skipping.".format(
+                        self.cloud_name, self.controller_name, self.model_name, machine
+                    )
+                )
+
+    def check_status(self, what, status, expected):
+        """Lint the status of a unit."""
+        if isinstance(expected, str):
+            expected = [expected]
+        if status.get("current") not in expected:
+            self.logger.error(
+                "[{}] [{}/{}] {} has status '{}' (since: {}, message: {}); (We expected: {})".format(
+                    self.cloud_name,
+                    self.controller_name,
+                    self.model_name,
+                    what,
+                    status.get("current"),
+                    status.get("since"),
+                    status.get("message"),
+                    expected,
+                )
+            )
+
+    def check_status_pair(self, name, status_type, data_d):
+        """Cross reference satus of paired constructs, like machines and units."""
+        if status_type in ["machine", "container"]:
+            primary = "machine-status"
+            primary_expected = "running"
+            juju_expected = "started"
+        elif status_type in ["unit", "subordinate"]:
+            primary = "workload-status"
+            primary_expected = ["active", "unknown"]
+            juju_expected = "idle"
+        elif status_type in ["application"]:
+            primary = "application-status"
+            primary_expected = ["active", "unknown"]
+            juju_expected = None
+
+        if primary in data_d:
+            self.check_status(
+                "{} {}".format(status_type.title(), name),
+                data_d[primary],
+                expected=primary_expected,
+            )
+            if juju_expected:
+                if "juju-status" in data_d:
+                    self.check_status(
+                        "Juju on {} {}".format(status_type, name),
+                        data_d["juju-status"],
+                        expected=juju_expected,
+                    )
+                else:
+                    self.logger.warn(
+                        "[{}] [{}/{}] Could not determine Juju status for {}.".format(
+                            self.cloud_name, self.controller_name, self.model_name, name
+                        )
+                    )
+        else:
+            self.logger.warn(
+                "[{}] [{}/{}] Could not determine appropriate status key for {}.".format(
+                    self.cloud_name, self.controller_name, self.model_name, name,
+                )
+            )
+
+    def check_statuses(self, juju_status, applications):
+        """Check all statuses in juju status output."""
+        for machine_name in juju_status["machines"]:
+            self.check_status_pair(
+                machine_name, "machine", juju_status["machines"][machine_name]
+            )
+            for container_name in juju_status["machines"][machine_name].get(
+                "container", []
+            ):
+                self.check_status_pair(
+                    container_name,
+                    "container",
+                    juju_status["machines"][machine_name][container_name],
+                )
+
+        for app_name in juju_status[applications]:
+            self.check_status_pair(
+                app_name, "application", juju_status[applications][app_name]
+            )
+            for unit_name in juju_status[applications][app_name].get("units", []):
+                self.check_status_pair(
+                    unit_name,
+                    "unit",
+                    juju_status[applications][app_name]["units"][unit_name],
+                )
+
+    # This is noisy and only covers a very theoretical corner case
+    # where a misbehaving or malicious leader unit sets the
+    # application-status to OK despite one or more units being in error
+    # state.
+    #
+    # We could revisit this later by splitting it into two passes and
+    # only warning about individual subordinate units if the
+    # application-status for the subordinate claims to be OK.
+    #
+    # for subordinate_name in juju_status[applications][app_name]["units"][unit_name].get("subordinates", []):
+    #     check_status_pair(subordinate_name, "subordinate",
+    #                       juju_status[applications][app_name]["units"][unit_name]["subordinates"][subordinate_name])
+
+    def check_azs(self, applications):
+        """Lint AZ distribution."""
+        azs = set()
+        for machine in self.model.machines_to_az:
+            azs.add(self.model.machines_to_az[machine])
+        num_azs = len(azs)
+        if num_azs != 3:
+            self.logger.error(
+                "[{}] [{}/{}] Found {} AZs (not 3); and I don't currently know how to lint that.".format(
+                    self.cloud_name, self.controller_name, self.model_name, num_azs
+                )
+            )
+            return
+
+        for app_name in applications:
+            az_counter = collections.Counter()
+            for az in azs:
+                az_counter[az] = 0
+            num_units = len(applications[app_name].get("units", []))
+            if num_units <= 1:
+                continue
+            min_per_az = num_units // num_azs
+            for unit in applications[app_name]["units"]:
+                machine = applications[app_name]["units"][unit]["machine"]
+                machine = machine.split("/")[0]
+                if machine not in self.model.machines_to_az:
+                    self.logger.error(
+                        "[{}] [{}/{}] {}: Can't find machine {} in machine to AZ mapping data".format(
+                            self.cloud_name,
+                            self.controller_name,
+                            self.model_name,
+                            app_name,
+                            machine,
+                        )
+                    )
+                    continue
+                az_counter[self.model.machines_to_az[machine]] += 1
+            for az in az_counter:
+                num_this_az = az_counter[az]
+                if num_this_az < min_per_az:
+                    self.model.az_unbalanced_apps[app_name] = [num_units, az_counter]
+
+    def lint_yaml_string(self, yaml):
+        """Lint provided YAML string."""
+        parsed_yaml = yaml.safe_load(yaml)
+        return self.do_lint(parsed_yaml)
+
+    def lint_yaml_file(self, filename):
+        """Load and lint provided YAML file."""
+        if filename:
+            with open(filename, "r") as infile:
+                parsed_yaml = yaml.safe_load(infile.read())
+                if parsed_yaml:
+                    return self.do_lint(parsed_yaml)
+        self.logger.fubar("Failed to parse YAML from file {}".format(filename))
+
+    def do_lint(self, parsed_yaml):
+        """Lint parsed YAML."""
+        # Handle Juju 2 vs Juju 1
+        applications = "applications"
+        if applications not in parsed_yaml:
+            applications = "services"
+
+        if applications in parsed_yaml:
+
+            # Build a list of deployed charms and mapping of charms <-> applications
+            self.map_charms(parsed_yaml[applications])
+
+            # Check configuration
+            self.check_configuration(parsed_yaml[applications])
+
+            # Then map out subordinates to applications
+            for app in parsed_yaml[applications]:
+                self.process_subordinates(parsed_yaml[applications][app], app)
+
+            self.check_subs()
+            self.check_charms()
+
+            if parsed_yaml.get("machines"):
+                self.map_machines_to_az(parsed_yaml["machines"])
+                self.check_azs(parsed_yaml[applications])
+                self.check_statuses(parsed_yaml, applications)
+            else:
+                self.logger.warn(
+                    (
+                        "[{}] [{}/{}] No machine status present in model."
+                        "possibly a bundle without status, skipping AZ checks"
+                    ).format(
+                        self.cloud_name, self.model_name, self.controller_name,
+                    )
+                )
+
+            self.results()
+        self.logger.warn(
+            "[{}] [{}/{}] Model contains no applications, skipping.".format(
+                self.cloud_name, self.controller_name, self.model_name,
+            )
+        )
diff --git a/jujulint/logging.py b/jujulint/logging.py
new file mode 100644
index 0000000..00dd200
--- /dev/null
+++ b/jujulint/logging.py
@@ -0,0 +1,106 @@
+#!/usr/bin/env python3
+# This file is part of juju-lint, a tool for validating that Juju
+# deloyments meet configurable site policies.
+#
+# Copyright 2018-2020 Canonical Limited.
+# License granted by Canonical Limited.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 3, as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranties of
+# MERCHANTABILITY, SATISFACTORY QUALITY, or FITNESS FOR A PARTICULAR
+# PURPOSE.  See the GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+"""Logging helper functions."""
+import colorlog
+import logging
+import sys
+
+
+class Logger:
+    """Helper class for logging."""
+
+    def __init__(self, level=None, logfile=None):
+        """Set up logging instance and set log level."""
+        self.logger = colorlog.getLogger()
+        self.set_level(level)
+        if not len(self.logger.handlers):
+            format_string = "%(log_color)s%(asctime)s [%(levelname)s] %(message)s"
+            date_format = "%Y-%m-%d %H:%M:%S"
+            colour_formatter = colorlog.ColoredFormatter(
+                format_string,
+                datefmt=date_format,
+                log_colors={
+                    "DEBUG": "cyan",
+                    "INFO": "green",
+                    "WARNING": "yellow",
+                    "ERROR": "red",
+                    "CRITICAL": "red,bg_white",
+                },
+            )
+            console = colorlog.StreamHandler()
+            console.setFormatter(colour_formatter)
+            self.logger.addHandler(console)
+            if logfile:
+                try:
+                    file_logger = colorlog.getLogger("file")
+                    plain_formatter = logging.Formatter(
+                        format_string, datefmt=date_format
+                    )
+                    # If we send output to the file logger specifically, don't propagate it
+                    # to the root logger as well to avoid duplicate output. So if we want
+                    # to only send logging output to the file, you would do this:
+                    #  logging.getLogger('file').info("message for logfile only")
+                    # rather than this:
+                    #  logging.info("message for console and logfile")
+                    file_logger.propagate = False
+
+                    file_handler = logging.FileHandler(logfile)
+                    file_handler.setFormatter(plain_formatter)
+                    self.logger.addHandler(file_handler)
+                    file_logger.addHandler(file_handler)
+                except IOError:
+                    logging.error("Unable to write to logfile: {}".format(logfile))
+
+    def fubar(self, msg, exit_code=1):
+        """Exit and print to stderr because everything is FUBAR."""
+        sys.stderr.write("E: %s\n" % (msg))
+        sys.exit(exit_code)
+
+    def set_level(self, level="info"):
+        """Set the level to the provided level."""
+        if level:
+            level = level.lower()
+        else:
+            return False
+
+        if level == "debug":
+            logging.basicConfig(level=logging.DEBUG)
+        elif level == "warn":
+            self.logger.setLevel(logging.WARN)
+        elif level == "error":
+            self.logger.setLevel(logging.ERROR)
+        else:
+            self.logger.setLevel(logging.INFO)
+        return True
+
+    def debug(self, message):
+        """Log a message with debug loglevel."""
+        self.logger.debug(message)
+
+    def warn(self, message):
+        """Log a message with warn loglevel."""
+        self.logger.warn(message)
+
+    def info(self, message):
+        """Log a message with info loglevel."""
+        self.logger.info(message)
+
+    def error(self, message):
+        """Log a message with warn loglevel."""
+        self.logger.error(message)
diff --git a/jujulint/openstack.py b/jujulint/openstack.py
new file mode 100644
index 0000000..398721e
--- /dev/null
+++ b/jujulint/openstack.py
@@ -0,0 +1,71 @@
+#!/usr/bin/env python3
+# This file is part of juju-lint, a tool for validating that Juju
+# deloyments meet configurable site policies.
+#
+# Copyright 2018-2020 Canonical Limited.
+# License granted by Canonical Limited.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 3, as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranties of
+# MERCHANTABILITY, SATISFACTORY QUALITY, or FITNESS FOR A PARTICULAR
+# PURPOSE.  See the GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+"""OpenStack checks module.
+
+This module provides checks for OpenStack clouds.
+
+Attributes:
+     access (string): Set the access method (local/ssh)
+     ssh_host (string, optional): Configuration to pass to Cloud module for accessing the cloud via SSH
+     ssh_jump (string, optional): Jump/Bastion configuration to pass to Cloud module for access the cloud via SSH
+     sudo_user (string, optional): User to switch to via sudo when accessing the cloud, passed to the Cloud module
+
+Todo:
+    * Check neutron configuration
+      * Check MTU configuration on neutron-api and OVS charms
+      * Check neutron units interface config for MTU settings
+      * Check namespaces and MTUs within namespaces
+      * Check OpenStack network definitions for MTU mismatches
+    * Check OVS configuration
+    * Check nova configuration for live migration settings
+    * Check Ceph for sensible priorities and placement
+
+"""
+
+from jujulint.cloud import Cloud
+
+
+class OpenStack(Cloud):
+    """Helper class for interacting with Nagios via the livestatus socket."""
+
+    def __init__(self, *args, **kwargs):
+        """Initialise class-local variables and configuration and pass to super."""
+        super(OpenStack, self).__init__(*args, **kwargs)
+        self.cloud_type = "openstack"
+
+    def get_neutron_ports(self):
+        """Get a list of neutron ports."""
+
+    def get_neutron_routers(self):
+        """Get a list of neutron routers."""
+
+    def get_neutron_networks(self):
+        """Get a list of neutron networks."""
+
+    def refresh(self):
+        """Refresh cloud information."""
+        return super(OpenStack, self).refresh()
+
+    def audit(self):
+        """Audit OpenStack cloud and run base Cloud audits."""
+        # add specific OpenStack checks here
+        self.logger.info(
+            "[{}] Running OpenStack-specific audit steps.".format(self.name)
+        )
+        super(OpenStack, self).audit()
diff --git a/jujulint/util.py b/jujulint/util.py
new file mode 100644
index 0000000..c646b28
--- /dev/null
+++ b/jujulint/util.py
@@ -0,0 +1,38 @@
+#! /usr/bin/env python3
+# This file is part of juju-lint, a tool for validating that Juju
+# deloyments meet configurable site policies.
+#
+# Copyright 2018-2020 Canonical Limited.
+# License granted by Canonical Limited.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 3, as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranties of
+# MERCHANTABILITY, SATISFACTORY QUALITY, or FITNESS FOR A PARTICULAR
+# PURPOSE.  See the GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+"""Utility library for all helpful functions this project uses."""
+
+
+def flatten_list(lumpy_list):
+    """Flatten a list potentially containing other lists."""
+    flat_list = []
+    for item in lumpy_list:
+        if not isinstance(item, list):
+            flat_list.append(item)
+        else:
+            flat_list.extend(flatten_list(item))
+    return flat_list
+
+
+def is_container(machine):
+    """Check if a provided machine is a container."""
+    if "/" in machine:
+        return True
+    else:
+        return False
diff --git a/requirements.txt b/requirements.txt
new file mode 100644
index 0000000..9527545
--- /dev/null
+++ b/requirements.txt
@@ -0,0 +1,6 @@
+attrs>=18.1.0
+colorlog>=4.1.0
+confuse>=1.1.0
+fabric2>=2.5.0
+setuptools>=46.1.3
+PyYAML>=5.3.1
diff --git a/setup.py b/setup.py
index c82caa1..4190e7a 100644
--- a/setup.py
+++ b/setup.py
@@ -15,6 +15,7 @@
 #
 # You should have received a copy of the GNU General Public License
 # along with this program. If not, see <http://www.gnu.org/licenses/>.
+"""Setuptools packaging metadata for juju-lint."""
 
 import re
 import setuptools
@@ -25,26 +26,26 @@ warnings.simplefilter("ignore", UserWarning)  # Older pips complain about newer 
 with open("README.md", "r") as fh:
     long_description = fh.read()
 
-with open("debian/changelog", "r") as fh:
-    version = re.search(r'\((.*)\)', fh.readline()).group(1)
-
 setuptools.setup(
-    name="juju-lint",
-    version=version,
+    name="jujulint",
+    use_scm_version={
+            "local_scheme": "node-and-date",
+    },
     author="Canonical",
     author_email="[e-mail]",
     description="Linter for Juju models to compare deployments with configurable policy",
     long_description=long_description,
     long_description_content_type="text/markdown",
     url="https://launchpad.net/juju-lint",
-    classifiers=(
+    classifiers=[
         "Programming Language :: Python :: 3",
         "License :: OSI Approved :: GNU General Public License v3 (GPLv3)",
         "Development Status :: 2 - Beta",
         "Environment :: Plugins",
-        "Intended Audience :: System Administrators"),
-    python_requires='>=3.4',
+        "Intended Audience :: System Administrators",
+    ],
+    python_requires=">=3.4",
     py_modules=["jujulint"],
-    entry_points={
-        'console_scripts': [
-            'juju-lint=jujulint:main']})
+    entry_points={"console_scripts": ["juju-lint=jujulint.cli:main"]},
+    setup_requires=["setuptools_scm"],
+)
diff --git a/snap/snapcraft.yaml b/snap/snapcraft.yaml
index ddf7ea5..b8bd6da 100644
--- a/snap/snapcraft.yaml
+++ b/snap/snapcraft.yaml
@@ -1,30 +1,34 @@
+---
 name: juju-lint
-version: auto
+base: core18
 summary: Linter for Juju models to compare deployments with configurable policy
-description: Linter for Juju models to compare deployments with configurable policy
+adopt-info: juju-lint
+description: |
+    Linter for remote or local Juju models.
+    Compares remote deployments with configurable policy rules.
+    Linting can also be performed on a YAML file representing cloud state.
 grade: stable
 confinement: classic
-version-script: |
-  echo `head -1 debian/changelog | sed -rn 's/.*\((.*)\).*/\1/p'`-`git describe --dirty --always --tags | sed -r 's/v(.*)/\1/g'`
 apps:
   juju-lint:
-    command: usr/bin/python3 $SNAP/bin/juju-lint
+    command: juju-lint
     environment:
       PATH: "/snap/juju-lint/current/bin:/snap/juju-lint/current/usr/bin:/bin:/usr/bin:"
+      PYTHONPATH: $SNAP/usr/lib/python3.6/site-packages:$SNAP/usr/lib/python3.6/dist-packages:$PYTHONPATH
 parts:
   juju-lint:
     plugin: python
     python-version: python3
-    python-packages:
-      - 3rdparty/attrs-18.1.0.tar.gz
-    build-packages:
-      - python3-setuptools
-    stage-packages:
-      - libc6
-      - python3-yaml
+    requirements:
+      - requirements.txt
     source: .
-    source-type: git
+    override-build: |
+        snapcraftctl build
+        echo "Version: $(python3 setup.py --version)"
+        snapcraftctl set-version "$(python3 setup.py --version)"
   juju-lint-contrib:
+    after:
+      - juju-lint
     plugin: dump
     source: .
     prime:
diff --git a/tests/conftest.py b/tests/conftest.py
new file mode 100644
index 0000000..c95eb69
--- /dev/null
+++ b/tests/conftest.py
@@ -0,0 +1,60 @@
+#! /usr/bin/env python
+# -*- coding: utf-8 -*-
+# vim:fenc=utf-8
+#
+# Copyright © 2020 James Hebden <[e-mail]>
+#
+# Distributed under terms of the GPL license.
+
+"""Test fixtures for juju-lint tool."""
+
+import mock
+import os
+import pytest
+import sys
+
+# bring in top level library to path
+test_path = os.path.dirname(os.path.abspath(__file__))
+sys.path.insert(0, test_path + "/../")
+
+
[e-mail]
+def mocked_pkg_resources(monkeypatch):
+    """Mock the pkg_resources library."""
+    import pkg_resources
+
+    monkeypatch.setattr(pkg_resources, "require", mock.Mock())
+
+
[e-mail]
+def cli():
+    """Provide a test instance of the CLI class."""
+    from jujulint.cli import Cli
+
+    cli = Cli()
+
+    return cli
+
+
[e-mail]
+def utils():
+    """Provide a test instance of the CLI class."""
+    from jujulint import util
+
+    return util
+
+
[e-mail]
+def parser(monkeypatch):
+    """Mock the configuration parser."""
+    monkeypatch.setattr('jujulint.config.ArgumentParser', mock.Mock())
+
+
[e-mail]
+def lint(parser):
+    """Provide test fixture for the linter class."""
+    from jujulint.lint import Linter
+
+    linter = Linter('mockcloud', 'mockrules.yaml')
+
+    return linter
diff --git a/tests/requirements.txt b/tests/requirements.txt
index 71f6c69..c20bbcd 100644
--- a/tests/requirements.txt
+++ b/tests/requirements.txt
@@ -1,3 +1,12 @@
 # Module requirements
-pyyaml
-attrs
+flake8
+flake8-colors
+flake8-docstrings
+flake8-html
+mock
+pep8-naming
+pycodestyle
+pyflakes
+pytest
+pytest-cov
+pytest-html
diff --git a/tests/test_cli.py b/tests/test_cli.py
new file mode 100644
index 0000000..c5a9e95
--- /dev/null
+++ b/tests/test_cli.py
@@ -0,0 +1,14 @@
+#!/usr/bin/python3
+"""Test the CLI."""
+
+from jujulint.cli import Cli
+
+
+def test_pytest():
+    """Test that pytest itself works."""
+    assert True
+
+
+def test_cli_fixture(cli):
+    """Test if the CLI fixture works."""
+    assert isinstance(cli, Cli)
diff --git a/tests/test_jujulint.py b/tests/test_jujulint.py
index acf5cdc..ba2dbf7 100644
--- a/tests/test_jujulint.py
+++ b/tests/test_jujulint.py
@@ -1,33 +1,36 @@
 #!/usr/bin/python3
+"""Tests for jujulint."""
 
-import unittest
-
+import pytest
 import jujulint
 
 
-class TestJujuLint(unittest.TestCase):
+def test_flatten_list(utils):
+    """Test the utils flatten_list function."""
+    unflattened_list = [1, [2, 3]]
+    flattened_list = [1, 2, 3]
+    assert flattened_list == utils.flatten_list(unflattened_list)
 
-    def test_flatten_list(self):
-        unflattened_list = [1, [2, 3]]
-        flattened_list = [1, 2, 3]
-        self.assertEqual(flattened_list, jujulint.flatten_list(unflattened_list))
+    unflattened_list = [1, [2, [3, 4]]]
+    flattened_list = [1, 2, 3, 4]
+    assert flattened_list == utils.flatten_list(unflattened_list)
 
-        unflattened_list = [1, [2, [3, 4]]]
-        flattened_list = [1, 2, 3, 4]
-        self.assertEqual(flattened_list, jujulint.flatten_list(unflattened_list))
 
-    def test_map_charms(self):
-        model = jujulint.ModelInfo()
-        applications = {'test-app-1': {'charm': "cs:~USER/SERIES/TEST-CHARM12-123"},
-                        'test-app-2': {'charm': "cs:~USER/TEST-CHARM12-123"},
-                        'test-app-3': {'charm': "cs:TEST-CHARM12-123"},
-                        'test-app-4': {'charm': "local:SERIES/TEST-CHARM12"},
-                        'test-app-5': {'charm': "local:TEST-CHARM12"},
-                        'test-app-6': {'charm': "cs:~TEST-CHARMERS/TEST-CHARM12-123"},
-                        }
-        jujulint.map_charms(applications, model)
-        for charm in model.charms:
-            self.assertEqual("TEST-CHARM12", charm)
-        applications = {'test-app1': {'charm': "cs:invalid-charm$"}, }
-        with self.assertRaises(jujulint.InvalidCharmNameError):
-            jujulint.map_charms(applications, model)
+def test_map_charms(lint):
+    """Test the charm name validation code."""
+    applications = {
+        "test-app-1": {"charm": "cs:~USER/SERIES/TEST-CHARM12-123"},
+        "test-app-2": {"charm": "cs:~USER/TEST-CHARM12-123"},
+        "test-app-3": {"charm": "cs:TEST-CHARM12-123"},
+        "test-app-4": {"charm": "local:SERIES/TEST-CHARM12"},
+        "test-app-5": {"charm": "local:TEST-CHARM12"},
+        "test-app-6": {"charm": "cs:~TEST-CHARMERS/TEST-CHARM12-123"},
+    }
+    lint.map_charms(applications)
+    for charm in lint.model.charms:
+        assert "TEST-CHARM12" == charm
+    applications = {
+        "test-app1": {"charm": "cs:invalid-charm$"},
+    }
+    with pytest.raises(jujulint.lint.InvalidCharmNameError):
+        lint.map_charms(applications)
diff --git a/tox.ini b/tox.ini
index a3cb544..cf22f0f 100644
--- a/tox.ini
+++ b/tox.ini
@@ -1,22 +1,45 @@
 [flake8]
+exclude =
+    .git,
+    __pycache__,
+    .tox,
+max-line-length = 120
+max-complexity = 10
 ignore = C901
-max_line_length = 120
-max_complexity = 10
-hang_closing = yes
 
 [tox]
-envlist = py3-{lint,test}
-skipsdist = true
+skipsdist=True
+envlist = lintverbose, unit
+skip_missing_interpreters = True
 
 [testenv]
-install_command=
-    pip install --no-cache-dir --no-deps --find-links {toxinidir}/3rdparty --upgrade {opts} {packages}
+basepython = python3
 deps =
-    lint: flake8 == 3.5.0
-    lint: pyflakes == 2.0.0
-    lint: pycodestyle == 2.3.1
-    test: -r{toxinidir}/tests/requirements.txt
+    -r{toxinidir}/tests/requirements.txt
+    -r{toxinidir}/requirements.txt
 commands =
     lint: flake8 {toxinidir}
     test: python3 -m unittest discover tests
 
+[testenv:unit]
+commands = pytest -v \
+	    --cov=jujulint \
+	    --cov-report=term \
+	    --cov-report=annotate:tests/report/coverage-annotated \
+	    --cov-report=html:tests/report/coverage-html \
+	    --html=tests/report/index.html \
+	    --junitxml=tests/report/junit.xml
+setenv = PYTHONPATH={toxinidir}/lib
+
+[testenv:lint]
+commands = flake8 jujulint --format=html --htmldir=tests/report/lint/ --tee
+
+[testenv:lintverbose]
+commands = flake8 jujulint
+
+[testenv:lintjunit]
+commands = flake8 jujulint --format junit-xml --output-file=report/lint/junit.xml
+
+[pytest]
+filterwarnings = 
+    ignore::DeprecationWarning