Merge lp:~james-page/charm-helpers/multiple-https-networks into lp:charm-helpers

[James Page]

This branch adds support for keystone signed certificates for multiple endpoints IP's for a single service.

It also retains backwards compatibility so that existing deploys don't break!

[lp:~james-page/charm-helpers/multiple-https-networks]

220. By James Page on 2014-09-24

Fixup backwards compat, tidy lint

221. By James Page on 2014-09-24

Support unset cn, add test case

[Liam Young (gnuoy)]

Approve

review: Approve

=== modified file 'charmhelpers/contrib/hahelpers/apache.py'
--- charmhelpers/contrib/hahelpers/apache.py	2014-02-26 21:48:09 +0000
+++ charmhelpers/contrib/hahelpers/apache.py	2014-09-24 12:45:35 +0000
@@ -20,20 +20,27 @@
 )
 
 
-def get_cert():
+def get_cert(cn=None):
+    # TODO: deal with multiple https endpoints via charm config
     cert = config_get('ssl_cert')
     key = config_get('ssl_key')
     if not (cert and key):
         log("Inspecting identity-service relations for SSL certificate.",
             level=INFO)
         cert = key = None
+        if cn:
+            ssl_cert_attr = 'ssl_cert_{}'.format(cn)
+            ssl_key_attr = 'ssl_key_{}'.format(cn)
+        else:
+            ssl_cert_attr = 'ssl_cert'
+            ssl_key_attr = 'ssl_key'
         for r_id in relation_ids('identity-service'):
             for unit in relation_list(r_id):
                 if not cert:
-                    cert = relation_get('ssl_cert',
+                    cert = relation_get(ssl_cert_attr,
                                         rid=r_id, unit=unit)
                 if not key:
-                    key = relation_get('ssl_key',
+                    key = relation_get(ssl_key_attr,
                                        rid=r_id, unit=unit)
     return (cert, key)
 
 
=== modified file 'charmhelpers/contrib/hahelpers/cluster.py'
--- charmhelpers/contrib/hahelpers/cluster.py	2014-08-07 10:25:37 +0000
+++ charmhelpers/contrib/hahelpers/cluster.py	2014-09-24 12:45:35 +0000
@@ -139,10 +139,9 @@
         return True
     for r_id in relation_ids('identity-service'):
         for unit in relation_list(r_id):
+            # TODO - needs fixing for new helper as ssl_cert/key suffixes with CN
             rel_state = [
                 relation_get('https_keystone', rid=r_id, unit=unit),
-                relation_get('ssl_cert', rid=r_id, unit=unit),
-                relation_get('ssl_key', rid=r_id, unit=unit),
                 relation_get('ca_cert', rid=r_id, unit=unit),
             ]
             # NOTE: works around (LP: #1203241)
 
=== modified file 'charmhelpers/contrib/openstack/context.py'
--- charmhelpers/contrib/openstack/context.py	2014-08-06 03:02:27 +0000
+++ charmhelpers/contrib/openstack/context.py	2014-09-24 12:45:35 +0000
@@ -8,7 +8,6 @@
     check_call
 )
 
-
 from charmhelpers.fetch import (
     apt_install,
     filter_installed_packages,
@@ -28,6 +27,11 @@
     INFO
 )
 
+from charmhelpers.core.host import (
+    mkdir,
+    write_file
+)
+
 from charmhelpers.contrib.hahelpers.cluster import (
     determine_apache_port,
     determine_api_port,
@@ -38,6 +42,7 @@
 from charmhelpers.contrib.hahelpers.apache import (
     get_cert,
     get_ca_cert,
+    install_ca_cert,
 )
 
 from charmhelpers.contrib.openstack.neutron import (
@@ -47,6 +52,7 @@
 from charmhelpers.contrib.network.ip import (
     get_address_in_network,
     get_ipv6_addr,
+    is_address_in_network
 )
 
 CA_CERT_PATH = '/usr/local/share/ca-certificates/keystone_juju_ca_cert.crt'
@@ -490,22 +496,36 @@
         cmd = ['a2enmod', 'ssl', 'proxy', 'proxy_http']
         check_call(cmd)
 
-    def configure_cert(self):
-        if not os.path.isdir('/etc/apache2/ssl'):
-            os.mkdir('/etc/apache2/ssl')
+    def configure_cert(self, cn=None):
         ssl_dir = os.path.join('/etc/apache2/ssl/', self.service_namespace)
-        if not os.path.isdir(ssl_dir):
-            os.mkdir(ssl_dir)
-        cert, key = get_cert()
-        with open(os.path.join(ssl_dir, 'cert'), 'w') as cert_out:
-            cert_out.write(b64decode(cert))
-        with open(os.path.join(ssl_dir, 'key'), 'w') as key_out:
-            key_out.write(b64decode(key))
+        mkdir(path=ssl_dir)
+        cert, key = get_cert(cn)
+        if cn:
+            cert_filename = 'cert_{}'.format(cn)
+            key_filename = 'key_{}'.format(cn)
+        else:
+            cert_filename = 'cert'
+            key_filename = 'key'
+        write_file(path=os.path.join(ssl_dir, cert_filename),
+                   content=b64decode(cert))
+        write_file(path=os.path.join(ssl_dir, key_filename),
+                   content=b64decode(key))
+
+    def configure_ca(self):
         ca_cert = get_ca_cert()
         if ca_cert:
-            with open(CA_CERT_PATH, 'w') as ca_out:
-                ca_out.write(b64decode(ca_cert))
-            check_call(['update-ca-certificates'])
+            install_ca_cert(b64decode(ca_cert))
+
+    def canonical_names(self):
+        '''Figure out which canonical names clients will access this service'''
+        cns = []
+        for r_id in relation_ids('identity-service'):
+            for unit in related_units(r_id):
+                rdata = relation_get(rid=r_id, unit=unit)
+                for k in rdata:
+                    if k.startswith('ssl_key_'):
+                        cns.append(k.lstrip('ssl_key_'))
+        return list(set(cns))
 
     def __call__(self):
         if isinstance(self.external_ports, basestring):
@@ -513,21 +533,47 @@
         if (not self.external_ports or not https()):
             return {}
 
-        self.configure_cert()
+        self.configure_ca()
         self.enable_modules()
 
         ctxt = {
             'namespace': self.service_namespace,
-            'private_address': unit_get('private-address'),
-            'endpoints': []
+            'endpoints': [],
+            'ext_ports': []
         }
-        if is_clustered():
-            ctxt['private_address'] = config('vip')
-        for api_port in self.external_ports:
-            ext_port = determine_apache_port(api_port)
-            int_port = determine_api_port(api_port)
-            portmap = (int(ext_port), int(int_port))
-            ctxt['endpoints'].append(portmap)
+
+        for cn in self.canonical_names():
+            self.configure_cert(cn)
+
+        addresses = []
+        vips = []
+        if config('vip'):
+            vips = config('vip').split()
+
+        for network_type in ['os-internal-network',
+                             'os-admin-network',
+                             'os-public-network']:
+            address = get_address_in_network(config(network_type),
+                                             unit_get('private-address'))
+            if len(vips) > 0 and is_clustered():
+                for vip in vips:
+                    if is_address_in_network(config(network_type),
+                                             vip):
+                        addresses.append((address, vip))
+                        break
+            elif is_clustered():
+                addresses.append((address, config('vip')))
+            else:
+                addresses.append((address, address))
+
+        for address, endpoint in set(addresses):
+            for api_port in self.external_ports:
+                ext_port = determine_apache_port(api_port)
+                int_port = determine_api_port(api_port)
+                portmap = (address, endpoint, int(ext_port), int(int_port))
+                ctxt['endpoints'].append(portmap)
+                ctxt['ext_ports'].append(int(ext_port))
+        ctxt['ext_ports'] = list(set(ctxt['ext_ports']))
         return ctxt
 
 
 
=== modified file 'charmhelpers/contrib/openstack/templates/openstack_https_frontend'
--- charmhelpers/contrib/openstack/templates/openstack_https_frontend	2013-07-19 23:31:35 +0000
+++ charmhelpers/contrib/openstack/templates/openstack_https_frontend	2014-09-24 12:45:35 +0000
@@ -1,16 +1,18 @@
 {% if endpoints -%}
-{% for ext, int in endpoints -%}
-Listen {{ ext }}
-NameVirtualHost *:{{ ext }}
-<VirtualHost *:{{ ext }}>
-    ServerName {{ private_address }}
+{% for ext_port in ext_ports -%}
+Listen {{ ext_port }}
+{% endfor -%}
+{% for address, endpoint, ext, int in endpoints -%}
+<VirtualHost {{ address }}:{{ ext }}>
+    ServerName {{ endpoint }}
     SSLEngine on
-    SSLCertificateFile /etc/apache2/ssl/{{ namespace }}/cert
-    SSLCertificateKeyFile /etc/apache2/ssl/{{ namespace }}/key
+    SSLCertificateFile /etc/apache2/ssl/{{ namespace }}/cert_{{ endpoint }}
+    SSLCertificateKeyFile /etc/apache2/ssl/{{ namespace }}/key_{{ endpoint }}
     ProxyPass / http://localhost:{{ int }}/
     ProxyPassReverse / http://localhost:{{ int }}/
     ProxyPreserveHost on
 </VirtualHost>
+{% endfor -%}
 <Proxy *>
     Order deny,allow
     Allow from all
@@ -19,5 +21,4 @@
     Order allow,deny
     Allow from all
 </Location>
-{% endfor -%}
 {% endif -%}
 
=== modified file 'tests/contrib/hahelpers/test_apache_utils.py'
--- tests/contrib/hahelpers/test_apache_utils.py	2014-04-22 15:42:41 +0000
+++ tests/contrib/hahelpers/test_apache_utils.py	2014-09-24 12:45:35 +0000
@@ -1,7 +1,7 @@
 from mock import patch
 
 from testtools import TestCase
-from tests.helpers import patch_open
+from tests.helpers import patch_open, FakeRelation
 
 import charmhelpers.contrib.hahelpers.apache as apache_utils
 
@@ -29,6 +29,24 @@
 -----END CERTIFICATE-----
 '''
 
+IDENTITY_NEW_STYLE_CERTS = {
+    'identity:0': {
+        'keystone/0': {
+            'ssl_cert_test-cn': 'keystone_provided_cert',
+            'ssl_key_test-cn': 'keystone_provided_key',
+        }
+    }
+}
+
+IDENTITY_OLD_STYLE_CERTS = {
+    'identity:0': {
+        'keystone/0': {
+            'ssl_cert': 'keystone_provided_cert',
+            'ssl_key': 'keystone_provided_key',
+        }
+    }
+}
+
 
 class ApacheUtilsTests(TestCase):
     def setUp(self):
@@ -54,7 +72,7 @@
             'some_ca_cert',  # config_get('ssl_cert')
             'some_ca_key',  # config_Get('ssl_key')
         ]
-        result = apache_utils.get_cert()
+        result = apache_utils.get_cert('test-cn')
         self.assertEquals(('some_ca_cert', 'some_ca_key'), result)
 
     def test_get_ca_cert_from_config(self):
@@ -63,12 +81,20 @@
 
     def test_get_cert_from_relation(self):
         self.config_get.return_value = None
-        self.relation_ids.return_value = 'identity-service:0'
-        self.relation_list.return_value = 'keystone/0'
-        self.relation_get.side_effect = [
-            'keystone_provided_cert',
-            'keystone_provided_key',
-        ]
+        rel = FakeRelation(IDENTITY_NEW_STYLE_CERTS)
+        self.relation_ids.side_effect = rel.relation_ids
+        self.relation_list.side_effect = rel.relation_units
+        self.relation_get.side_effect = rel.get
+        result = apache_utils.get_cert('test-cn')
+        self.assertEquals(('keystone_provided_cert', 'keystone_provided_key'),
+                          result)
+
+    def test_get_cert_from_relation_deprecated(self):
+        self.config_get.return_value = None
+        rel = FakeRelation(IDENTITY_OLD_STYLE_CERTS)
+        self.relation_ids.side_effect = rel.relation_ids
+        self.relation_list.side_effect = rel.relation_units
+        self.relation_get.side_effect = rel.get
         result = apache_utils.get_cert()
         self.assertEquals(('keystone_provided_cert', 'keystone_provided_key'),
                           result)
 
=== modified file 'tests/contrib/hahelpers/test_cluster_utils.py'
--- tests/contrib/hahelpers/test_cluster_utils.py	2014-08-07 10:25:37 +0000
+++ tests/contrib/hahelpers/test_cluster_utils.py	2014-09-24 12:45:35 +0000
@@ -117,7 +117,7 @@
     @patch.object(cluster_utils, 'peer_units')
     @patch.object(cluster_utils, 'is_clustered')
     def test_is_is_elected_leader_unclustered(self, is_clustered,
-                                            peer_units, oldest_peer):
+                                              peer_units, oldest_peer):
         '''It detects it is the eligible leader in non-clustered peer group'''
         is_clustered.return_value = False
         oldest_peer.return_value = True
@@ -127,7 +127,7 @@
     @patch.object(cluster_utils, 'peer_units')
     @patch.object(cluster_utils, 'is_clustered')
     def test_not_is_elected_leader_unclustered(self, is_clustered,
-                                             peer_units, oldest_peer):
+                                               peer_units, oldest_peer):
         '''It detects it is not the eligible leader in non-clustered group'''
         is_clustered.return_value = False
         oldest_peer.return_value = False
 
=== modified file 'tests/contrib/openstack/test_os_contexts.py'
--- tests/contrib/openstack/test_os_contexts.py	2014-08-04 07:47:26 +0000
+++ tests/contrib/openstack/test_os_contexts.py	2014-09-24 12:45:35 +0000
@@ -59,6 +59,8 @@
                 relation = self.relation_data[rid][unit]
             except KeyError:
                 return None
+            if attribute is None:
+                return relation
             if attribute in relation:
                 return relation[attribute]
             return None
@@ -228,6 +230,39 @@
     }
 }
 
+IDENTITY_RELATION_NO_CERT = {
+    'identity-service:0': {
+        'keystone/0': {
+            'private-address': 'keystone1',
+        },
+    }
+}
+
+IDENTITY_RELATION_SINGLE_CERT = {
+    'identity-service:0': {
+        'keystone/0': {
+            'private-address': 'keystone1',
+            'ssl_cert_cinderhost1': 'certa',
+            'ssl_key_cinderhost1': 'keya',
+        },
+    }
+}
+
+IDENTITY_RELATION_MULTIPLE_CERT = {
+    'identity-service:0': {
+        'keystone/0': {
+            'private-address': 'keystone1',
+            'ssl_cert_cinderhost1-int-network': 'certa',
+            'ssl_key_cinderhost1-int-network': 'keya',
+            'ssl_cert_cinderhost1-pub-network': 'certa',
+            'ssl_key_cinderhost1-pub-network': 'keya',
+            'ssl_cert_cinderhost1-adm-network': 'certa',
+            'ssl_key_cinderhost1-adm-network': 'keya',
+        },
+    }
+}
+
+
 SUB_CONFIG = """
 nova:
     /etc/nova/nova.conf:
@@ -294,12 +329,27 @@
     },
 }
 
+NONET_CONFIG = {
+    'vip': 'cinderhost1vip',
+    'os-internal-network': None,
+    'os-admin-network': None,
+    'os-public-network': None
+}
+
+FULLNET_CONFIG = {
+    'vip': '10.5.1.1 10.5.2.1 10.5.3.1',
+    'os-internal-network': "10.5.1.0/24",
+    'os-admin-network': "10.5.2.0/24",
+    'os-public-network': "10.5.3.0/24"
+}
+
 # Imported in contexts.py and needs patching in setUp()
 TO_PATCH = [
     'b64decode',
     'check_call',
     'get_cert',
     'get_ca_cert',
+    'install_ca_cert',
     'log',
     'config',
     'relation_get',
@@ -315,8 +365,11 @@
     'time',
     'https',
     'get_address_in_network',
+    'is_address_in_network',
     'local_unit',
-    'get_ipv6_addr'
+    'get_ipv6_addr',
+    'mkdir',
+    'write_file'
 ]
 
 
@@ -937,41 +990,100 @@
         self.https.return_value = False
         self.assertEquals({}, apache())
 
-    def _test_https_context(self, apache, is_clustered, peer_units):
+    def _test_https_context(self, apache, is_clustered, peer_units,
+                            network_config=NONET_CONFIG, multinet=False):
         self.https.return_value = True
+        vips = network_config['vip'].split()
+        if multinet:
+            self.get_address_in_network.side_effect = ['10.5.1.100',
+                                                       '10.5.2.100',
+                                                       '10.5.3.100']
+        else:
+            self.get_address_in_network.return_value = 'cinderhost1'
+
+        config = {}
+        config.update(network_config)
+        self.config.side_effect = lambda key: config[key]
+
+        self.unit_get.return_value = 'cinderhost1'
+        self.is_clustered.return_value = is_clustered
+
+        apache = context.ApacheSSLContext()
+        apache.configure_cert = MagicMock()
+        apache.enable_modules = MagicMock()
+        apache.configure_ca = MagicMock()
+        apache.canonical_names = MagicMock()
 
         if is_clustered:
+            apache.canonical_names.return_value = \
+                network_config['vip'].split()
             self.determine_api_port.return_value = 8756
             self.determine_apache_port.return_value = 8766
+            if len(vips) > 1:
+                self.is_address_in_network.side_effect = [
+                    True, False, True, False, False, True
+                ]
+            else:
+                self.is_address_in_network.return_value = True
         else:
+            apache.canonical_names.return_value = ['cinderhost1']
             self.determine_api_port.return_value = 8766
             self.determine_apache_port.return_value = 8776
 
-        config = {'vip': 'cinderhost1vip'}
-        self.config.side_effect = lambda key: config[key]
-        self.unit_get.return_value = 'cinderhost1'
-        self.is_clustered.return_value = is_clustered
-        apache = context.ApacheSSLContext()
-        apache.configure_cert = MagicMock
-        apache.enable_modules = MagicMock
         apache.external_ports = '8776'
         apache.service_namespace = 'cinder'
 
         if is_clustered:
-            ex = {
-                'private_address': 'cinderhost1vip',
-                'namespace': 'cinder',
-                'endpoints': [(8766, 8756)],
-            }
+            if len(vips) > 1:
+                ex = {
+                    'namespace': 'cinder',
+                    'endpoints': [('10.5.1.100', '10.5.1.1',
+                                   8766, 8756),
+                                  ('10.5.2.100', '10.5.2.1',
+                                   8766, 8756),
+                                  ('10.5.3.100', '10.5.3.1',
+                                   8766, 8756)],
+                    'ext_ports': [8766]
+                }
+            else:
+                ex = {
+                    'namespace': 'cinder',
+                    'endpoints': [('cinderhost1', 'cinderhost1vip',
+                                   8766, 8756)],
+                    'ext_ports': [8766]
+                }
         else:
-            ex = {
-                'private_address': 'cinderhost1',
-                'namespace': 'cinder',
-                'endpoints': [(8776, 8766)],
-            }
+            if multinet:
+                ex = {
+                    'namespace': 'cinder',
+                    'endpoints': [('10.5.3.100', '10.5.3.100',
+                                   8776, 8766),
+                                  ('10.5.2.100', '10.5.2.100',
+                                   8776, 8766),
+                                  ('10.5.1.100', '10.5.1.100',
+                                   8776, 8766)],
+                    'ext_ports': [8776]
+                }
+            else:
+                ex = {
+                    'namespace': 'cinder',
+                    'endpoints': [('cinderhost1', 'cinderhost1', 8776, 8766)],
+                    'ext_ports': [8776]
+                }
 
         self.assertEquals(ex, apache())
-        self.assertTrue(apache.configure_cert.called)
+        if is_clustered:
+            if len(vips) > 1:
+                apache.configure_cert.assert_has_calls([
+                    call('10.5.1.1'),
+                    call('10.5.2.1'),
+                    call('10.5.3.1')
+                ])
+            else:
+                apache.configure_cert.assert_called_with('cinderhost1vip')
+        else:
+            apache.configure_cert.assert_called_with('cinderhost1')
+        self.assertTrue(apache.configure_ca.called)
         self.assertTrue(apache.enable_modules.called)
 
     def test_https_context_no_peers_no_cluster(self):
@@ -979,6 +1091,16 @@
         apache = context.ApacheSSLContext()
         self._test_https_context(apache, is_clustered=False, peer_units=None)
 
+    def test_https_context_multinetwork(self):
+        apache = context.ApacheSSLContext()
+        self._test_https_context(apache, is_clustered=False, peer_units=None,
+                                 network_config=FULLNET_CONFIG, multinet=True)
+
+    def test_https_context_multinetwork_cluster(self):
+        apache = context.ApacheSSLContext()
+        self._test_https_context(apache, is_clustered=True, peer_units=None,
+                                 network_config=FULLNET_CONFIG, multinet=True)
+
     def test_https_context_wth_peers_no_cluster(self):
         '''Test apache2 https on a unclustered unit with peers'''
         apache = context.ApacheSSLContext()
@@ -996,31 +1118,58 @@
         ex_cmd = ['a2enmod', 'ssl', 'proxy', 'proxy_http']
         self.check_call.assert_called_with(ex_cmd)
 
-    @patch('__builtin__.open')
-    @patch('os.mkdir')
-    @patch('os.path.isdir')
-    def test_https_configure_cert(self, isdir, mkdir, _open):
-        '''Test apache2 properly installs certs and keys to disk'''
-        isdir.return_value = False
-        self.get_cert.return_value = ('SSL_CERT', 'SSL_KEY')
-        self.get_ca_cert.return_value = 'CA_CERT'
+    def test_https_configure_cert(self):
+        '''Test apache2 properly installs certs and keys to disk'''
+        self.get_cert.return_value = ('SSL_CERT', 'SSL_KEY')
+        self.b64decode.side_effect = ['SSL_CERT', 'SSL_KEY']
+        apache = context.ApacheSSLContext()
+        apache.service_namespace = 'cinder'
+        apache.configure_cert('test-cn')
+        # appropriate directories are created.
+        self.mkdir.assert_called_with(path='/etc/apache2/ssl/cinder')
+        # appropriate files are written.
+        files = [call(path='/etc/apache2/ssl/cinder/cert_test-cn',
+                      content='SSL_CERT'),
+                 call(path='/etc/apache2/ssl/cinder/key_test-cn',
+                      content='SSL_KEY')]
+        self.write_file.assert_has_calls(files)
+        # appropriate bits are b64decoded.
+        decode = [call('SSL_CERT'), call('SSL_KEY')]
+        self.assertEquals(decode, self.b64decode.call_args_list)
+
+    def test_https_configure_cert_deprecated(self):
+        '''Test apache2 properly installs certs and keys to disk'''
+        self.get_cert.return_value = ('SSL_CERT', 'SSL_KEY')
+        self.b64decode.side_effect = ['SSL_CERT', 'SSL_KEY']
         apache = context.ApacheSSLContext()
         apache.service_namespace = 'cinder'
         apache.configure_cert()
         # appropriate directories are created.
-        dirs = [call('/etc/apache2/ssl'), call('/etc/apache2/ssl/cinder')]
-        self.assertEquals(dirs, mkdir.call_args_list)
-        # appropriate files are opened for writing.
-        _ca = '/usr/local/share/ca-certificates/keystone_juju_ca_cert.crt'
-        files = [call('/etc/apache2/ssl/cinder/cert', 'w'),
-                 call('/etc/apache2/ssl/cinder/key', 'w'),
-                 call(_ca, 'w')]
-        for f in files:
-            self.assertIn(f, _open.call_args_list)
+        self.mkdir.assert_called_with(path='/etc/apache2/ssl/cinder')
+        # appropriate files are written.
+        files = [call(path='/etc/apache2/ssl/cinder/cert',
+                      content='SSL_CERT'),
+                 call(path='/etc/apache2/ssl/cinder/key',
+                      content='SSL_KEY')]
+        self.write_file.assert_has_calls(files)
         # appropriate bits are b64decoded.
-        decode = [call('SSL_CERT'), call('SSL_KEY'), call('CA_CERT')]
+        decode = [call('SSL_CERT'), call('SSL_KEY')]
         self.assertEquals(decode, self.b64decode.call_args_list)
 
+    def test_https_canonical_names(self):
+        rel = FakeRelation(IDENTITY_RELATION_SINGLE_CERT)
+        self.relation_ids.side_effect = rel.relation_ids
+        self.related_units.side_effect = rel.relation_units
+        self.relation_get.side_effect = rel.get
+        apache = context.ApacheSSLContext()
+        self.assertEquals(apache.canonical_names(), ['cinderhost1'])
+        rel.relation_data = IDENTITY_RELATION_MULTIPLE_CERT
+        self.assertEquals(apache.canonical_names(), ['cinderhost1-adm-network',
+                                                     'cinderhost1-int-network',
+                                                     'cinderhost1-pub-network'])
+        rel.relation_data = IDENTITY_RELATION_NO_CERT
+        self.assertEquals(apache.canonical_names(), [])
+
     def test_image_service_context_missing_data(self):
         '''Test image-service with missing relation and missing data'''
         image_service = context.ImageServiceContext()