Merge lp:~james-page/charms/precise/keystone/aggressive-refactor into lp:~openstack-charmers/charms/precise/keystone/ha-support

[James Page]

Refactoring to use shared charm helpers where possible.

Service/Admin port now fixed with haproxy + api port pipelining configuration

=== modified symlink 'hooks/cluster-relation-changed'
=== target changed u'keystone-hooks' => u'keystone_hooks.py'
=== modified symlink 'hooks/cluster-relation-departed'
=== target changed u'keystone-hooks' => u'keystone_hooks.py'
=== modified symlink 'hooks/cluster-relation-joined'
=== target changed u'keystone-hooks' => u'keystone_hooks.py'
=== modified symlink 'hooks/config-changed'
=== target changed u'keystone-hooks' => u'keystone_hooks.py'
=== modified symlink 'hooks/ha-relation-changed'
=== target changed u'keystone-hooks' => u'keystone_hooks.py'
=== modified symlink 'hooks/ha-relation-joined'
=== target changed u'keystone-hooks' => u'keystone_hooks.py'
=== modified symlink 'hooks/identity-service-relation-changed'
=== target changed u'keystone-hooks' => u'keystone_hooks.py'
=== modified symlink 'hooks/identity-service-relation-joined'
=== target changed u'keystone-hooks' => u'keystone_hooks.py'
=== modified symlink 'hooks/install'
=== target changed u'keystone-hooks' => u'keystone_hooks.py'
=== renamed file 'hooks/keystone-hooks' => 'hooks/keystone_hooks.py'
--- hooks/keystone-hooks	2013-03-11 09:10:47 +0000
+++ hooks/keystone_hooks.py	2013-03-19 14:13:27 +0000
@@ -1,19 +1,51 @@
 #!/usr/bin/python
 
-import sys
 import time
 import urlparse
 
 from base64 import b64encode
 
-from utils import *
+from keystone_utils import (
+    config_get,
+    execute,
+    update_config_block,
+    set_admin_token,
+    ensure_initial_admin,
+    create_service_entry,
+    create_endpoint_template,
+    create_role,
+    get_admin_token,
+    get_service_password,
+    create_user,
+    grant_role,
+    get_ca,
+    synchronize_service_credentials,
+    do_openstack_upgrade,
+    configure_pki_tokens,
+    SSH_USER,
+    SSL_DIR,
+    CLUSTER_RES,
+    https
+    )
 
-from lib.openstack_common import *
+from lib.openstack_common import (
+    get_os_codename_install_source,
+    get_os_codename_package,
+    get_os_version_codename,
+    get_os_version_package,
+    save_script_rc
+    )
 import lib.unison as unison
+import lib.utils as utils
+import lib.cluster_utils as cluster
+import lib.haproxy_utils as haproxy
 
 config = config_get()
 
-packages = "keystone python-mysqldb pwgen haproxy python-jinja2 openssl unison"
+packages = [
+    "keystone", "python-mysqldb", "pwgen",
+    "haproxy", "python-jinja2", "openssl", "unison"
+    ]
 service = "keystone"
 
 # used to verify joined services are valid openstack components.
@@ -62,13 +94,14 @@
     }
 }
 
+
 def install_hook():
-    if config["openstack-origin"] != "distro":
-        configure_installation_source(config["openstack-origin"])
-    execute("apt-get update", die=True)
-    execute("apt-get -y install %s" % packages, die=True, echo=True)
-    update_config_block('DEFAULT', public_port=config["service-port"])
-    update_config_block('DEFAULT', admin_port=config["admin-port"])
+    utils.configure_source()
+    utils.install(*packages)
+    update_config_block('DEFAULT',
+                public_port=cluster.determine_api_port(config["service-port"]))
+    update_config_block('DEFAULT',
+                admin_port=cluster.determine_api_port(config["admin-port"]))
     set_admin_token(config['admin-token'])
 
     # set all backends to use sql+sqlite, if they are not already by default
@@ -83,9 +116,9 @@
     update_config_block('ec2',
                         driver='keystone.contrib.ec2.backends.sql.Ec2')
 
-    execute("service keystone stop", echo=True)
+    utils.stop('keystone')
     execute("keystone-manage db_sync")
-    execute("service keystone start", echo=True)
+    utils.start('keystone')
 
     # ensure /var/lib/keystone is g+wrx for peer relations that
     # may be syncing data there via SSH_USER.
@@ -96,17 +129,21 @@
 
 
 def db_joined():
-    relation_data = { "database": config["database"],
-                      "username": config["database-user"],
-                      "hostname": config["hostname"] }
-    relation_set(relation_data)
+    relation_data = {
+        "database": config["database"],
+        "username": config["database-user"],
+        "hostname": config["hostname"]
+        }
+    utils.relation_set(**relation_data)
+
 
 def db_changed():
-    relation_data = relation_get_dict()
+    relation_data = utils.relation_get_dict()
     if ('password' not in relation_data or
         'db_host' not in relation_data):
-        juju_log("db_host or password not set. Peer not ready, exit 0")
-        exit(0)
+        utils.juju_log('INFO',
+                       "db_host or password not set. Peer not ready, exit 0")
+        return
 
     update_config_block('sql', connection="mysql://%s:%s@%s/%s" %
                             (config["database-user"],
@@ -114,80 +151,71 @@
                              relation_data["db_host"],
                              config["database"]))
 
-    execute("service keystone stop", echo=True)
-
-    if not eligible_leader():
-        juju_log('Deferring DB initialization to service leader.')
-        execute("service keystone start")
-        return
-
-    execute("keystone-manage db_sync", echo=True)
-    execute("service keystone start")
+    utils.stop('keystone')
+    if cluster.eligible_leader(CLUSTER_RES):
+        utils.juju_log('INFO',
+                       'Cluster leader, performing db-sync')
+        execute("keystone-manage db_sync", echo=True)
+    utils.start('keystone')
     time.sleep(5)
-    ensure_initial_admin(config)
-
-    # If the backend database has been switched to something new and there
-    # are existing identity-service relations,, service entries need to be
-    # recreated in the new database.  Re-executing identity-service-changed
-    # will do this.
-    for id in relation_ids(relation_name='identity-service'):
-        for unit in relation_list(relation_id=id):
-            juju_log("Re-exec'ing identity-service-changed for: %s - %s" %
-                     (id, unit))
-            identity_changed(relation_id=id, remote_unit=unit)
+
+    if cluster.eligible_leader(CLUSTER_RES):
+        ensure_initial_admin(config)
+        # If the backend database has been switched to something new and there
+        # are existing identity-service relations,, service entries need to be
+        # recreated in the new database.  Re-executing identity-service-changed
+        # will do this.
+        for rid in utils.relation_ids('identity-service'):
+            for unit in utils.relation_list(rid=rid):
+                utils.juju_log('INFO',
+                               "Re-exec'ing identity-service-changed"
+                               " for: %s - %s" % (rid, unit))
+                identity_changed(relation_id=rid, remote_unit=unit)
+
 
 def ensure_valid_service(service):
     if service not in valid_services.keys():
-        juju_log("WARN: Invalid service requested: '%s'" % service)
-        realtion_set({ "admin_token": -1 })
+        utils.juju_log('WARNING',
+                       "Invalid service requested: '%s'" % service)
+        utils.relation_set(admin_token=-1)
         return
 
-def add_endpoint(region, service, public_url, admin_url, internal_url):
+
+def add_endpoint(region, service, publicurl, adminurl, internalurl):
     desc = valid_services[service]["desc"]
     service_type = valid_services[service]["type"]
     create_service_entry(service, service_type, desc)
     create_endpoint_template(region=region, service=service,
-                             public_url=public_url,
-                             admin_url=admin_url,
-                             internal_url=internal_url)
+                             publicurl=publicurl,
+                             adminurl=adminurl,
+                             internalurl=internalurl)
+
 
 def identity_joined():
     """ Do nothing until we get information about requested service """
     pass
 
+
 def identity_changed(relation_id=None, remote_unit=None):
     """ A service has advertised its API endpoints, create an entry in the
         service catalog.
         Optionally allow this hook to be re-fired for an existing
         relation+unit, for context see see db_changed().
     """
-    def ensure_valid_service(service):
-        if service not in valid_services.keys():
-            juju_log("WARN: Invalid service requested: '%s'" % service)
-            realtion_set({ "admin_token": -1 })
-            return
-
-    def add_endpoint(region, service, publicurl, adminurl, internalurl):
-        desc = valid_services[service]["desc"]
-        service_type = valid_services[service]["type"]
-        create_service_entry(service, service_type, desc)
-        create_endpoint_template(region=region, service=service,
-                                 publicurl=publicurl,
-                                 adminurl=adminurl,
-                                 internalurl=internalurl)
-
-    if not eligible_leader():
-        juju_log('Deferring identity_changed() to service leader.')
+    if not cluster.eligible_leader(CLUSTER_RES):
+        utils.juju_log('INFO',
+                       'Deferring identity_changed() to service leader.')
         return
 
-    settings = relation_get_dict(relation_id=relation_id,
-                                 remote_unit=remote_unit)
+    settings = utils.relation_get_dict(relation_id=relation_id,
+                                       remote_unit=remote_unit)
 
     # Allow the remote service to request creation of any additional roles.
     # Currently used by Swift.
     if 'requested_roles' in settings and settings['requested_roles'] != 'None':
         roles = settings['requested_roles'].split(',')
-        juju_log("Creating requested roles: %s" % roles)
+        utils.juju_log('INFO',
+                       "Creating requested roles: %s" % roles)
         for role in roles:
             create_role(role, user=config['admin-user'], tenant='admin')
 
@@ -196,25 +224,29 @@
                   'internal_url'])
     if single.issubset(settings):
         # other end of relation advertised only one endpoint
-        if 'None' in [v for k,v in settings.iteritems()]:
+        if 'None' in [v for k, v in settings.iteritems()]:
             # Some backend services advertise no endpoint but require a
             # hook execution to update auth strategy.
             relation_data = {}
             # Check if clustered and use vip + haproxy ports if so
-            if is_clustered():
+            if cluster.is_clustered():
                 relation_data["auth_host"] = config['vip']
-                relation_data["auth_port"] = SERVICE_PORTS['keystone_admin']
                 relation_data["service_host"] = config['vip']
-                relation_data["service_port"] = SERVICE_PORTS['keystone_service']
             else:
                 relation_data["auth_host"] = config['hostname']
-                relation_data["auth_port"] = config['admin-port']
                 relation_data["service_host"] = config['hostname']
-                relation_data["service_port"] = config['service-port']
-            relation_set(relation_data)
+            relation_data["auth_port"] = config['admin-port']
+            relation_data["service_port"] = config['service-port']
+            if config['https-service-endpoints'] in ['True', 'true']:
+                # Pass CA cert as client will need it to
+                # verify https connections
+                ca = get_ca(user=SSH_USER)
+                ca_bundle = ca.get_ca_bundle()
+                relation_data['https_keystone'] = 'True'
+                relation_data['ca_cert'] = b64encode(ca_bundle)
+            utils.relation_set(**relation_data)
             return
 
-
         ensure_valid_service(settings['service'])
 
         add_endpoint(region=settings['region'], service=settings['service'],
@@ -242,7 +274,7 @@
         #   }
         # }
         endpoints = {}
-        for k,v in settings.iteritems():
+        for k, v in settings.iteritems():
             ep = k.split('_')[0]
             x = '_'.join(k.split('_')[1:])
             if ep not in endpoints:
@@ -267,18 +299,20 @@
                     https_cn = https_cn.hostname
         service_username = '_'.join(services)
 
-    if 'None' in [v for k,v in settings.iteritems()]:
+    if 'None' in [v for k, v in settings.iteritems()]:
         return
 
     if not service_username:
         return
 
     token = get_admin_token()
-    juju_log("Creating service credentials for '%s'" % service_username)
+    utils.juju_log('INFO',
+                   "Creating service credentials for '%s'" % service_username)
 
     service_password = get_service_password(service_username)
     create_user(service_username, service_password, config['service-tenant'])
-    grant_role(service_username, config['admin-role'], config['service-tenant'])
+    grant_role(service_username, config['admin-role'],
+               config['service-tenant'])
 
     # As of https://review.openstack.org/#change,4675, all nodes hosting
     # an endpoint(s) needs a service username and password assigned to
@@ -305,27 +339,25 @@
         relation_data['rid'] = relation_id
 
     # Check if clustered and use vip + haproxy ports if so
-    if is_clustered():
+    if cluster.is_clustered():
         relation_data["auth_host"] = config['vip']
-        relation_data["auth_port"] = SERVICE_PORTS['keystone_admin']
         relation_data["service_host"] = config['vip']
-        relation_data["service_port"] = SERVICE_PORTS['keystone_service']
 
     # generate or get a new cert/key for service if set to manage certs.
     if config['https-service-endpoints'] in ['True', 'true']:
         ca = get_ca(user=SSH_USER)
-        service = os.getenv('JUJU_REMOTE_UNIT').split('/')[0]
         cert, key = ca.get_cert_and_key(common_name=https_cn)
-        ca_bundle= ca.get_ca_bundle()
+        ca_bundle = ca.get_ca_bundle()
         relation_data['ssl_cert'] = b64encode(cert)
         relation_data['ssl_key'] = b64encode(key)
         relation_data['ca_cert'] = b64encode(ca_bundle)
         relation_data['https_keystone'] = 'True'
         unison.sync_to_peers(peer_interface='cluster',
                              paths=[SSL_DIR], user=SSH_USER, verbose=True)
-    relation_set_2(**relation_data)
+    utils.relation_set(**relation_data)
     synchronize_service_credentials()
 
+
 def config_changed():
 
     # Determine whether or not we should do an upgrade, based on the
@@ -334,8 +366,10 @@
     installed = get_os_codename_package('keystone')
 
     if (available and
-        get_os_version_codename(available) > get_os_version_codename(installed)):
-        do_openstack_upgrade(config['openstack-origin'], packages)
+        get_os_version_codename(available) > \
+            get_os_version_codename(installed)):
+        # TODO: fixup this call to work like utils.install()
+        do_openstack_upgrade(config['openstack-origin'], ' '.join(packages))
 
     env_vars = {'OPENSTACK_SERVICE_KEYSTONE': 'keystone',
                 'OPENSTACK_PORT_ADMIN': config['admin-port'],
@@ -344,8 +378,10 @@
 
     set_admin_token(config['admin-token'])
 
-    if eligible_leader():
-        juju_log('Cluster leader - ensuring endpoint configuration is up to date')
+    if cluster.eligible_leader(CLUSTER_RES):
+        utils.juju_log('INFO',
+                       'Cluster leader - ensuring endpoint configuration'
+                       ' is up to date')
         ensure_initial_admin(config)
 
     update_config_block('logger_root', level=config['log-level'],
@@ -354,69 +390,86 @@
         # PKI introduced in Grizzly
         configure_pki_tokens(config)
 
-    execute("service keystone restart", echo=True)
-    cluster_changed()
+    utils.restart('keystone')
+
+    if cluster.eligible_leader(CLUSTER_RES):
+        utils.juju_log('INFO',
+                       'Firing identity_changed hook'
+                       ' for all related services.')
+        # HTTPS may have been set - so fire all identity relations
+        # again
+        for r_id in utils.relation_ids('identity-service'):
+            for unit in utils.relation_list(r_id):
+                identity_changed(relation_id=r_id,
+                                 remote_unit=unit)
 
 
 def upgrade_charm():
     cluster_changed()
-    if eligible_leader():
-        juju_log('Cluster leader - ensuring endpoint configuration is up to date')
+    if cluster.eligible_leader(CLUSTER_RES):
+        utils.juju_log('INFO',
+                       'Cluster leader - ensuring endpoint configuration'
+                       ' is up to date')
         ensure_initial_admin(config)
 
 
-SERVICE_PORTS = {
-    "keystone_admin": int(config['admin-port']) + 1,
-    "keystone_service": int(config['service-port']) + 1
-    }
-
 def cluster_joined():
     unison.ssh_authorized_peers(user=SSH_USER,
                                 group='keystone',
                                 peer_interface='cluster',
                                 ensure_user=True)
+    update_config_block('DEFAULT',
+        public_port=cluster.determine_api_port(config["service-port"]))
+    update_config_block('DEFAULT',
+        admin_port=cluster.determine_api_port(config["admin-port"]))
+    utils.restart('keystone')
+    service_ports = {
+        "keystone_admin": [
+            cluster.determine_haproxy_port(config['admin-port']),
+            cluster.determine_api_port(config["admin-port"])
+            ],
+        "keystone_service": [
+            cluster.determine_haproxy_port(config['service-port']),
+            cluster.determine_api_port(config["service-port"])
+            ]
+        }
+    haproxy.configure_haproxy(service_ports)
+
 
 def cluster_changed():
     unison.ssh_authorized_peers(user=SSH_USER,
-                                   group='keystone',
-                                   peer_interface='cluster',
-                                   ensure_user=True)
-    cluster_hosts = {}
-    cluster_hosts['self'] = config['hostname']
-    for r_id in relation_ids('cluster'):
-        for unit in relation_list(r_id):
-            # trigger identity-changed to reconfigure HTTPS
-            # as necessary.
-            identity_changed(relation_id=r_id, remote_unit=unit)
-            cluster_hosts[unit.replace('/','-')] = \
-                relation_get_dict(relation_id=r_id,
-                                  remote_unit=unit)['private-address']
-    configure_haproxy(cluster_hosts,
-                      SERVICE_PORTS)
-
+                                group='keystone',
+                                peer_interface='cluster',
+                                ensure_user=True)
     synchronize_service_credentials()
+    service_ports = {
+        "keystone_admin": [
+            cluster.determine_haproxy_port(config['admin-port']),
+            cluster.determine_api_port(config["admin-port"])
+            ],
+        "keystone_service": [
+            cluster.determine_haproxy_port(config['service-port']),
+            cluster.determine_api_port(config["service-port"])
+            ]
+        }
+    haproxy.configure_haproxy(service_ports)
 
-    for r_id in relation_ids('identity-service'):
-        for unit in relation_list(r_id):
-            # trigger identity-changed to reconfigure HTTPS as necessary
-            identity_changed(relation_id=r_id, remote_unit=unit)
 
 def ha_relation_changed():
-    relation_data = relation_get_dict()
+    relation_data = utils.relation_get_dict()
     if ('clustered' in relation_data and
-        is_leader()):
-        juju_log('Cluster configured, notifying other services and updating'
-                 'keystone endpoint configuration')
+        cluster.is_leader(CLUSTER_RES)):
+        utils.juju_log('INFO',
+                       'Cluster configured, notifying other services'
+                       ' and updating keystone endpoint configuration')
         # Update keystone endpoint to point at VIP
         ensure_initial_admin(config)
         # Tell all related services to start using
         # the VIP and haproxy ports instead
-        for r_id in relation_ids('identity-service'):
-            relation_set_2(rid=r_id,
-                           auth_host=config['vip'],
-                           service_host=config['vip'],
-                           service_port=SERVICE_PORTS['keystone_service'],
-                           auth_port=SERVICE_PORTS['keystone_admin'])
+        for r_id in utils.relation_ids('identity-service'):
+            utils.relation_set(rid=r_id,
+                               auth_host=config['vip'],
+                               service_host=config['vip'])
 
 
 def ha_relation_joined():
@@ -424,41 +477,33 @@
     # include multicast port and interface to bind to.
     corosync_bindiface = config['ha-bindiface']
     corosync_mcastport = config['ha-mcastport']
+    vip = config['vip']
+    vip_cidr = config['vip_cidr']
+    vip_iface = config['vip_iface']
 
     # Obtain resources
     resources = {
-            'res_ks_vip':'ocf:heartbeat:IPaddr2',
-            'res_ks_haproxy':'lsb:haproxy'
+        'res_ks_vip': 'ocf:heartbeat:IPaddr2',
+        'res_ks_haproxy': 'lsb:haproxy'
         }
-    # TODO: Obtain netmask and nic where to place VIP.
     resource_params = {
-            'res_ks_vip':'params ip="%s" cidr_netmask="%s" nic="%s"' % (config['vip'],
-                              config['vip_cidr'], config['vip_iface']),
-            'res_ks_haproxy':'op monitor interval="5s"'
+        'res_ks_vip': 'params ip="%s" cidr_netmask="%s" nic="%s"' % \
+                      (vip, vip_cidr, vip_iface),
+        'res_ks_haproxy': 'op monitor interval="5s"'
         }
     init_services = {
-            'res_ks_haproxy':'haproxy'
-        }
-    groups = {
-            'grp_ks_haproxy':'res_ks_vip res_ks_haproxy'
-        }
-    #clones = {
-    #        'cln_ks_haproxy':'res_ks_haproxy meta globally-unique="false" interleave="true"'
-    #    }
-
-    #orders = {
-    #        'ord_vip_before_haproxy':'inf: res_ks_vip res_ks_haproxy'
-    #    }
-    #colocations = {
-    #        'col_vip_on_haproxy':'inf: res_ks_haproxy res_ks_vip'
-    #    }
-
-    relation_set_2(init_services=init_services,
-                   corosync_bindiface=corosync_bindiface,
-                   corosync_mcastport=corosync_mcastport,
-                   resources=resources,
-                   resource_params=resource_params,
-                   groups=groups)
+        'res_ks_haproxy': 'haproxy'
+        }
+    clones = {
+        'cl_ks_haproxy': 'res_ks_haproxy'
+        }
+
+    utils.relation_set(init_services=init_services,
+                       corosync_bindiface=corosync_bindiface,
+                       corosync_mcastport=corosync_mcastport,
+                       resources=resources,
+                       resource_params=resource_params,
+                       clones=clones)
 
 
 hooks = {
@@ -476,9 +521,4 @@
     "upgrade-charm": upgrade_charm
 }
 
-# keystone-hooks gets called by symlink corresponding to the requested relation
-# hook.
-hook = os.path.basename(sys.argv[0])
-if hook not in hooks.keys():
-    error_out("Unsupported hook: %s" % hook)
-hooks[hook]()
+utils.do_hooks(hooks)

=== modified file 'hooks/keystone_ssl.py'
--- hooks/keystone_ssl.py	2013-02-20 23:30:25 +0000
+++ hooks/keystone_ssl.py	2013-03-19 14:13:27 +0000
@@ -1,17 +1,15 @@
 #!/usr/bin/python
 
-import base64
 import os
 import shutil
 import subprocess
 import tarfile
 import tempfile
-from utils import *
 
 CA_EXPIRY = '365'
 ORG_NAME = 'Ubuntu'
 ORG_UNIT = 'Ubuntu Cloud'
-CA_BUNDLE='/usr/local/share/ca-certificates/juju_ca_cert.crt'
+CA_BUNDLE = '/usr/local/share/ca-certificates/juju_ca_cert.crt'
 
 CA_CONFIG = """
 [ ca ]
@@ -58,7 +56,7 @@
 keyUsage                = cRLSign, keyCertSign
 """
 
-SIGNING_CONFIG="""
+SIGNING_CONFIG = """
 [ ca ]
 default_ca = CA_default
 
@@ -141,9 +139,9 @@
         else:
             print 'Found %s.' % f
     if init:
-        cmd = ['openssl', 'req', '-config', os.path.join(ca_dir, 'ca.cnf'), '-x509',
-               '-nodes', '-newkey', 'rsa', '-days', '21360', '-keyout', key,
-               '-out', crt, '-outform', 'PEM']
+        cmd = ['openssl', 'req', '-config', os.path.join(ca_dir, 'ca.cnf'),
+               '-x509', '-nodes', '-newkey', 'rsa', '-days', '21360',
+               '-keyout', key, '-out', crt, '-outform', 'PEM']
         subprocess.check_call(cmd)
     return crt, key
 
@@ -152,8 +150,9 @@
     print 'Creating new intermediate CSR.'
     key = os.path.join(ca_dir, 'private', 'cacert.key')
     csr = os.path.join(ca_dir, 'cacert.csr')
-    cmd = ['openssl', 'req', '-config', os.path.join(ca_dir, 'ca.cnf'), '-sha1',
-           '-newkey', 'rsa', '-nodes', '-keyout', key, '-out', csr, '-outform',
+    cmd = ['openssl', 'req', '-config', os.path.join(ca_dir, 'ca.cnf'),
+           '-sha1', '-newkey', 'rsa', '-nodes', '-keyout', key, '-out',
+           csr, '-outform',
            'PEM']
     subprocess.check_call(cmd)
     return csr, key
@@ -164,7 +163,8 @@
     crt = os.path.join(ca_dir, 'certs',
                         '%s.crt' % os.path.basename(csr).split('.')[0])
     subj = '/O=%s/OU=%s/CN=%s' % (ORG_NAME, ORG_UNIT, common_name)
-    cmd = ['openssl', 'ca', '-batch', '-config', os.path.join(ca_dir, 'ca.cnf'),
+    cmd = ['openssl', 'ca', '-batch', '-config',
+           os.path.join(ca_dir, 'ca.cnf'),
            '-extensions', 'ca_extensions', '-days', CA_EXPIRY, '-notext',
            '-in', csr, '-out', crt, '-subj', subj, '-batch']
     print ' '.join(cmd)
@@ -201,10 +201,11 @@
     cmd = ['openssl', 'req', '-sha1', '-newkey', 'rsa', '-nodes', '-keyout',
            key, '-out', csr, '-subj', subj]
     subprocess.check_call(cmd)
-    crt = sign_csr(ca_dir, csr, common_name)
+    crt = sign_int_csr(ca_dir, csr, common_name)
     print 'Signed new CSR, crt @ %s' % crt
     return
 
+
 def update_bundle(bundle_file, new_bundle):
     return
     if os.path.isfile(bundle_file):
@@ -219,10 +220,11 @@
         out.write(new_bundle)
     subprocess.check_call(['update-ca-certificates'])
 
+
 def tar_directory(path):
     cwd = os.getcwd()
-    parent=os.path.dirname(path)
-    directory=os.path.basename(path)
+    parent = os.path.dirname(path)
+    directory = os.path.basename(path)
     tmp = tempfile.TemporaryFile()
     os.chdir(parent)
     tarball = tarfile.TarFile(fileobj=tmp, mode='w')
@@ -234,6 +236,7 @@
     os.chdir(cwd)
     return out
 
+
 class JujuCA(object):
     def __init__(self, name, ca_dir, root_ca_dir, user, group):
         root_crt, root_key = init_root_ca(root_ca_dir,
@@ -265,8 +268,8 @@
         subj = '/O=%s/OU=%s/CN=%s' % (ORG_NAME, ORG_UNIT, common_name)
         csr = os.path.join(self.ca_dir, 'certs', '%s.csr' % service)
         key = os.path.join(self.ca_dir, 'certs', '%s.key' % service)
-        cmd = ['openssl', 'req', '-sha1', '-newkey', 'rsa', '-nodes', '-keyout',
-               key, '-out', csr, '-subj', subj]
+        cmd = ['openssl', 'req', '-sha1', '-newkey', 'rsa', '-nodes',
+               '-keyout', key, '-out', csr, '-subj', subj]
         subprocess.check_call(cmd)
         crt = self._sign_csr(csr, service, common_name)
         cmd = ['chown', '-R', '%s.%s' % (self.user, self.group), self.ca_dir]

=== renamed file 'hooks/utils.py' => 'hooks/keystone_utils.py'
--- hooks/utils.py	2013-03-08 21:33:22 +0000
+++ hooks/keystone_utils.py	2013-03-19 14:13:27 +0000
@@ -1,17 +1,23 @@
 #!/usr/bin/python
 import ConfigParser
-import subprocess
 import sys
 import json
+import time
+import subprocess
 import os
-import tarfile
-import tempfile
-import time
 
-from lib.openstack_common import *
+from lib.openstack_common import(
+    get_os_codename_install_source,
+    get_os_codename_package,
+    error_out,
+    configure_installation_source
+    )
 
 import keystone_ssl as ssl
 import lib.unison as unison
+import lib.utils as utils
+import lib.cluster_utils as cluster
+
 
 keystone_conf = "/etc/keystone/keystone.conf"
 stored_passwd = "/var/lib/keystone/keystone.passwd"
@@ -20,8 +26,9 @@
 
 SSL_DIR = '/var/lib/keystone/juju_ssl/'
 SSL_CA_NAME = 'Ubuntu Cloud'
+CLUSTER_RES = 'res_ks_vip'
+SSH_USER = 'juju_keystone'
 
-SSH_USER='juju_keystone'
 
 def execute(cmd, die=False, echo=False):
     """ Executes a command
@@ -35,8 +42,8 @@
                          stdout=subprocess.PIPE,
                          stdin=subprocess.PIPE,
                          stderr=subprocess.PIPE)
-    stdout=""
-    stderr=""
+    stdout = ""
+    stderr = ""
 
     def print_line(l):
         if echo:
@@ -59,7 +66,7 @@
 
 
 def config_get():
-    """ Obtain the units config via 'config-get' 
+    """ Obtain the units config via 'config-get'
     Returns a dict representing current config.
     private-address and IP of the unit is also tacked on for
     convienence
@@ -68,102 +75,38 @@
     config = json.loads(output)
     # make sure no config element is blank after config-get
     for c in config.keys():
-       if not config[c]:
+        if not config[c]:
             error_out("ERROR: Config option has no paramter: %s" % c)
     # tack on our private address and ip
-    hostname = execute("unit-get private-address")[0].strip()
-    config["hostname"] = execute("unit-get private-address")[0].strip()
+    config["hostname"] = utils.unit_get('private-address')
     return config
 
-def relation_ids(relation_name=None):
-    j = execute('relation-ids --format=json %s' % relation_name)[0]
-    return json.loads(j)
-
-def relation_list(relation_id=None):
-    cmd = 'relation-list --format=json'
-    if relation_id:
-        cmd += ' -r %s' % relation_id
-    j = execute(cmd)[0]
-    return json.loads(j)
-
-def relation_set(relation_data):
-    """ calls relation-set for all key=values in dict """
-    for k in relation_data:
-        execute("relation-set %s=%s" % (k, relation_data[k]), die=True)
-
-def relation_set_2(**kwargs):
-    cmd = [
-        'relation-set'
-        ]
-    args = []
-    for k, v in kwargs.items():
-        if k == 'rid':
-            cmd.append('-r')
-            cmd.append(v)
-        else:
-            args.append('{}={}'.format(k, v))
-    cmd += args
-    subprocess.check_call(cmd)
-
-
-def unit_get(attribute):
-    cmd = [
-        'unit-get',
-        attribute
-        ]
-    value = subprocess.check_output(cmd).strip()  # IGNORE:E1103
-    if value == "":
-        return None
-    else:
-        return value
-
-
-def relation_get(relation_data):
-    """ Obtain all current relation data
-    relation_data is a list of options to query from the relation
-    Returns a k,v dict of the results. 
-    Leave empty responses out of the results as they haven't yet been
-    set on the other end. 
-    Caller can then "len(results.keys()) == len(relation_data)" to find out if
-    all relation values have been set on the other side
-    """
-    results = {}
-    for r in relation_data:
-        result = execute("relation-get %s" % r, die=True)[0].strip('\n')
-        if result != "":
-           results[r] = result
-    return results
-
-def relation_get_dict(relation_id=None, remote_unit=None):
-    """Obtain all relation data as dict by way of JSON"""
-    cmd = 'relation-get --format=json'
-    if relation_id:
-        cmd += ' -r %s' % relation_id
-    if remote_unit:
-        remote_unit_orig = os.getenv('JUJU_REMOTE_UNIT', None)
-        os.environ['JUJU_REMOTE_UNIT'] = remote_unit
-    j = execute(cmd, die=True)[0]
-    if remote_unit and remote_unit_orig:
-        os.environ['JUJU_REMOTE_UNIT'] = remote_unit_orig
-    d = json.loads(j)
-    settings = {}
-    # convert unicode to strings
-    for k, v in d.iteritems():
-        settings[str(k)] = str(v)
-    return settings
+
[e-mail]
+def get_local_endpoint():
+    """ Returns the URL for the local end-point bypassing haproxy/ssl """
+    local_endpoint = 'http://localhost:{}/v2.0/'.format(
+        cluster.determine_api_port(utils.config_get('admin-port'))
+        )
+    return local_endpoint
+
 
 def set_admin_token(admin_token):
     """Set admin token according to deployment config or use a randomly
        generated token if none is specified (default).
     """
     if admin_token != 'None':
-        juju_log('Configuring Keystone to use a pre-configured admin token.')
+        utils.juju_log('INFO',
+                       'Configuring Keystone to use'
+                       ' a pre-configured admin token.')
         token = admin_token
     else:
-        juju_log('Configuring Keystone to use a random admin token.')
+        utils.juju_log('INFO',
+                       'Configuring Keystone to use a random admin token.')
         if os.path.isfile(stored_token):
-            msg = 'Loading a previously generated admin token from %s' % stored_token
-            juju_log(msg)
+            msg = 'Loading a previously generated' \
+                  ' admin token from %s' % stored_token
+            utils.juju_log('INFO', msg)
             f = open(stored_token, 'r')
             token = f.read().strip()
             f.close()
@@ -174,20 +117,22 @@
             out.close()
     update_config_block('DEFAULT', admin_token=token)
 
+
 def get_admin_token():
     """Temporary utility to grab the admin token as configured in
        keystone.conf
     """
-    f = open(keystone_conf, 'r+')
-    for l in open(keystone_conf, 'r+').readlines():
-        if l.split(' ')[0] == 'admin_token':
-            try:
-                return l.split('=')[1].strip()
-            except:
-                error_out('Could not parse admin_token line from %s' %
-                          keystone_conf)
+    with open(keystone_conf, 'r') as f:
+        for l in f.readlines():
+            if l.split(' ')[0] == 'admin_token':
+                try:
+                    return l.split('=')[1].strip()
+                except:
+                    error_out('Could not parse admin_token line from %s' %
+                              keystone_conf)
     error_out('Could not find admin_token line in %s' % keystone_conf)
 
+
 def update_config_block(section, **kwargs):
     """ Updates keystone.conf blocks given kwargs.
     Update a config setting in a specific setting of a config
@@ -209,32 +154,37 @@
     with open(conf_file, 'wb') as out:
         config.write(out)
 
+
 def create_service_entry(service_name, service_type, service_desc, owner=None):
     """ Add a new service entry to keystone if one does not already exist """
     import manager
-    manager = manager.KeystoneManager(endpoint='http://localhost:35357/v2.0/',
+    manager = manager.KeystoneManager(endpoint=get_local_endpoint(),
                                       token=get_admin_token())
     for service in [s._info for s in manager.api.services.list()]:
         if service['name'] == service_name:
-            juju_log("Service entry for '%s' already exists." % service_name)
+            utils.juju_log('INFO',
+                           "Service entry for '%s' already exists." % \
+                           service_name)
             return
     manager.api.services.create(name=service_name,
                                 service_type=service_type,
                                 description=service_desc)
-    juju_log("Created new service entry '%s'" % service_name)
+    utils.juju_log('INFO', "Created new service entry '%s'" % service_name)
+
 
 def create_endpoint_template(region, service,  publicurl, adminurl,
                              internalurl):
     """ Create a new endpoint template for service if one does not already
         exist matching name *and* region """
     import manager
-    manager = manager.KeystoneManager(endpoint='http://localhost:35357/v2.0/',
+    manager = manager.KeystoneManager(endpoint=get_local_endpoint(),
                                       token=get_admin_token())
     service_id = manager.resolve_service_id(service)
     for ep in [e._info for e in manager.api.endpoints.list()]:
         if ep['service_id'] == service_id and ep['region'] == region:
-            juju_log("Endpoint template already exists for '%s' in '%s'"
-                      % (service, region))
+            utils.juju_log('INFO',
+                           "Endpoint template already exists for '%s' in '%s'"
+                           % (service, region))
 
             up_to_date = True
             for k in ['publicurl', 'adminurl', 'internalurl']:
@@ -245,7 +195,9 @@
                 return
             else:
                 # delete endpoint and recreate if endpoint urls need updating.
-                juju_log("Updating endpoint template with new endpoint urls.")
+                utils.juju_log('INFO',
+                               "Updating endpoint template with"
+                               " new endpoint urls.")
                 manager.api.endpoints.delete(ep['id'])
 
     manager.api.endpoints.create(region=region,
@@ -253,26 +205,28 @@
                                  publicurl=publicurl,
                                  adminurl=adminurl,
                                  internalurl=internalurl)
-    juju_log("Created new endpoint template for '%s' in '%s'" %
-                (region, service))
+    utils.juju_log('INFO', "Created new endpoint template for '%s' in '%s'" %
+                   (region, service))
+
 
 def create_tenant(name):
     """ creates a tenant if it does not already exist """
     import manager
-    manager = manager.KeystoneManager(endpoint='http://localhost:35357/v2.0/',
+    manager = manager.KeystoneManager(endpoint=get_local_endpoint(),
                                       token=get_admin_token())
     tenants = [t._info for t in manager.api.tenants.list()]
     if not tenants or name not in [t['name'] for t in tenants]:
         manager.api.tenants.create(tenant_name=name,
                                    description='Created by Juju')
-        juju_log("Created new tenant: %s" % name)
+        utils.juju_log('INFO', "Created new tenant: %s" % name)
         return
-    juju_log("Tenant '%s' already exists." % name)
+    utils.juju_log('INFO', "Tenant '%s' already exists." % name)
+
 
 def create_user(name, password, tenant):
     """ creates a user if it doesn't already exist, as a member of tenant """
     import manager
-    manager = manager.KeystoneManager(endpoint='http://localhost:35357/v2.0/',
+    manager = manager.KeystoneManager(endpoint=get_local_endpoint(),
                                       token=get_admin_token())
     users = [u._info for u in manager.api.users.list()]
     if not users or name not in [u['name'] for u in users]:
@@ -283,21 +237,23 @@
                                  password=password,
                                  email='juju@localhost',
                                  tenant_id=tenant_id)
-        juju_log("Created new user '%s' tenant: %s" % (name, tenant_id))
+        utils.juju_log('INFO', "Created new user '%s' tenant: %s" % \
+                       (name, tenant_id))
         return
-    juju_log("A user named '%s' already exists" % name)
+    utils.juju_log('INFO', "A user named '%s' already exists" % name)
+
 
 def create_role(name, user=None, tenant=None):
     """ creates a role if it doesn't already exist. grants role to user """
     import manager
-    manager = manager.KeystoneManager(endpoint='http://localhost:35357/v2.0/',
+    manager = manager.KeystoneManager(endpoint=get_local_endpoint(),
                                       token=get_admin_token())
     roles = [r._info for r in manager.api.roles.list()]
     if not roles or name not in [r['name'] for r in roles]:
         manager.api.roles.create(name=name)
-        juju_log("Created new role '%s'" % name)
+        utils.juju_log('INFO', "Created new role '%s'" % name)
     else:
-        juju_log("A role named '%s' already exists" % name)
+        utils.juju_log('INFO', "A role named '%s' already exists" % name)
 
     if not user and not tenant:
         return
@@ -308,49 +264,55 @@
     tenant_id = manager.resolve_tenant_id(tenant)
 
     if None in [user_id, role_id, tenant_id]:
-        error_out("Could not resolve [user_id, role_id, tenant_id]" %
-                   [user_id, role_id, tenant_id])
+        error_out("Could not resolve [%s, %s, %s]" %
+                   (user_id, role_id, tenant_id))
 
     grant_role(user, name, tenant)
 
+
 def grant_role(user, role, tenant):
     """grant user+tenant a specific role"""
     import manager
-    manager = manager.KeystoneManager(endpoint='http://localhost:35357/v2.0/',
+    manager = manager.KeystoneManager(endpoint=get_local_endpoint(),
                                       token=get_admin_token())
-    juju_log("Granting user '%s' role '%s' on tenant '%s'" %\
-                (user, role, tenant))
+    utils.juju_log('INFO', "Granting user '%s' role '%s' on tenant '%s'" % \
+                   (user, role, tenant))
     user_id = manager.resolve_user_id(user)
     role_id = manager.resolve_role_id(role)
     tenant_id = manager.resolve_tenant_id(tenant)
 
-    cur_roles =  manager.api.roles.roles_for_user(user_id, tenant_id)
+    cur_roles = manager.api.roles.roles_for_user(user_id, tenant_id)
     if not cur_roles or role_id not in [r.id for r in cur_roles]:
         manager.api.roles.add_user_role(user=user_id,
                                         role=role_id,
                                         tenant=tenant_id)
-        juju_log("Granted user '%s' role '%s' on tenant '%s'" %\
-                    (user, role, tenant))
+        utils.juju_log('INFO', "Granted user '%s' role '%s' on tenant '%s'" % \
+                       (user, role, tenant))
     else:
-        juju_log("User '%s' already has role '%s' on tenant '%s'" %\
-                    (user, role, tenant))
+        utils.juju_log('INFO',
+                       "User '%s' already has role '%s' on tenant '%s'" % \
+                       (user, role, tenant))
+
 
 def generate_admin_token(config):
     """ generate and add an admin token """
     import manager
-    manager = manager.KeystoneManager(endpoint='http://localhost:35357/v2.0/',
+    manager = manager.KeystoneManager(endpoint=get_local_endpoint(),
                                       token='ADMIN')
     if config["admin-token"] == "None":
         import random
         token = random.randrange(1000000000000, 9999999999999)
     else:
         return config["admin-token"]
-    manager.api.add_token(token, config["admin-user"], "admin", config["token-expiry"])
-    juju_log("Generated and added new random admin token.")
+    manager.api.add_token(token, config["admin-user"],
+                          "admin", config["token-expiry"])
+    utils.juju_log('INFO', "Generated and added new random admin token.")
     return token
 
+
 def ensure_initial_admin(config):
-    """ Ensures the minimum admin stuff exists in whatever database we're using.
+    """ Ensures the minimum admin stuff exists in whatever database we're
+        using.
         This and the helper functions it calls are meant to be idempotent and
         run during install as well as during db-changed.  This will maintain
         the admin tenant, user, role, service entry and endpoint across every
@@ -365,10 +327,11 @@
     if config["admin-password"] != "None":
         passwd = config["admin-password"]
     elif os.path.isfile(stored_passwd):
-        juju_log("Loading stored passwd from %s" % stored_passwd)
+        utils.juju_log('INFO', "Loading stored passwd from %s" % stored_passwd)
         passwd = open(stored_passwd, 'r').readline().strip('\n')
     if passwd == "":
-        juju_log("Generating new passwd for user: %s" % config["admin-user"])
+        utils.juju_log('INFO', "Generating new passwd for user: %s" % \
+                       config["admin-user"])
         passwd = execute("pwgen -c 16 1", die=True)[0]
         open(stored_passwd, 'w+').writelines("%s\n" % passwd)
 
@@ -380,22 +343,19 @@
     create_role("KeystoneServiceAdmin", config["admin-user"], 'admin')
     create_service_entry("keystone", "identity", "Keystone Identity Service")
 
-    if is_clustered():
-        juju_log("Creating endpoint for clustered configuration")
-        for region in config['region'].split():
-            create_keystone_endpoint(service_host=config["vip"],
-                                     service_port=int(config["service-port"]) + 1,
-                                     auth_host=config["vip"],
-                                     auth_port=int(config["admin-port"]) + 1,
-                                     region=region)
+    if cluster.is_clustered():
+        utils.juju_log('INFO', "Creating endpoint for clustered configuration")
+        service_host = auth_host = config["vip"]
     else:
-        juju_log("Creating standard endpoint")
-        for region in config['region'].split():
-            create_keystone_endpoint(service_host=config["hostname"],
-                                     service_port=config["service-port"],
-                                     auth_host=config["hostname"],
-                                     auth_port=config["admin-port"],
-                                     region=region)
+        utils.juju_log('INFO', "Creating standard endpoint")
+        service_host = auth_host = config["hostname"]
+
+    for region in config['region'].split():
+        create_keystone_endpoint(service_host=service_host,
+                                 service_port=config["service-port"],
+                                 auth_host=auth_host,
+                                 auth_port=config["admin-port"],
+                                 region=region)
 
 
 def create_keystone_endpoint(service_host, service_port,
@@ -409,16 +369,18 @@
 
 def update_user_password(username, password):
     import manager
-    manager = manager.KeystoneManager(endpoint='http://localhost:35357/v2.0/',
+    manager = manager.KeystoneManager(endpoint=get_local_endpoint(),
                                       token=get_admin_token())
-    juju_log("Updating password for user '%s'" % username)
+    utils.juju_log('INFO', "Updating password for user '%s'" % username)
 
     user_id = manager.resolve_user_id(username)
     if user_id is None:
         error_out("Could not resolve user id for '%s'" % username)
 
     manager.api.users.update_password(user=user_id, password=password)
-    juju_log("Successfully updated password for user '%s'" % username)
+    utils.juju_log('INFO', "Successfully updated password for user '%s'" % \
+                   username)
+
 
 def load_stored_passwords(path=SERVICE_PASSWD_PATH):
     creds = {}
@@ -431,10 +393,12 @@
         creds[user] = passwd
     return creds
 
+
 def save_stored_passwords(path=SERVICE_PASSWD_PATH, **creds):
     with open(path, 'wb') as stored_passwd:
         [stored_passwd.write('%s:%s\n' % (u, p)) for u, p in creds.iteritems()]
 
+
 def get_service_password(service_username):
     creds = load_stored_passwords()
     if service_username in creds:
@@ -446,12 +410,13 @@
 
     return passwd
 
+
 def configure_pki_tokens(config):
     '''Configure PKI token signing, if enabled.'''
     if config['enable-pki'] not in ['True', 'true']:
         update_config_block('signing', token_format='UUID')
     else:
-        juju_log('TODO: PKI Support, setting to UUID for now.')
+        utils.juju_log('INFO', 'TODO: PKI Support, setting to UUID for now.')
         update_config_block('signing', token_format='UUID')
 
 
@@ -462,10 +427,12 @@
     old_vers = get_os_codename_package('keystone')
     new_vers = get_os_codename_install_source(install_src)
 
-    juju_log("Beginning Keystone upgrade: %s -> %s" % (old_vers, new_vers))
+    utils.juju_log('INFO',
+                   "Beginning Keystone upgrade: %s -> %s" % \
+                   (old_vers, new_vers))
 
     # Backup previous config.
-    juju_log("Backing up contents of /etc/keystone.")
+    utils.juju_log('INFO', "Backing up contents of /etc/keystone.")
     stamp = time.strftime('%Y%m%d%H%M')
     cmd = 'tar -pcf /var/lib/juju/keystone-backup-%s.tar /etc/keystone' % stamp
     execute(cmd, die=True, echo=True)
@@ -482,15 +449,17 @@
     set_admin_token(config['admin-token'])
 
     # set the sql connection string if a shared-db relation is found.
-    ids = relation_ids(relation_name='shared-db')
+    ids = utils.relation_ids('shared-db')
 
     if ids:
-        for id in ids:
-            for unit in relation_list(id):
-                juju_log('Configuring new keystone.conf for datbase access '\
-                         'on existing database relation to %s' % unit)
-                relation_data = relation_get_dict(relation_id=id,
-                                                  remote_unit=unit)
+        for rid in ids:
+            for unit in utils.relation_list(rid):
+                utils.juju_log('INFO',
+                               'Configuring new keystone.conf for '
+                               'database access on existing database'
+                               ' relation to %s' % unit)
+                relation_data = utils.relation_get_dict(relation_id=rid,
+                                                        remote_unit=unit)
 
                 update_config_block('sql', connection="mysql://%s:%s@%s/%s" %
                                         (config["database-user"],
@@ -498,66 +467,21 @@
                                          relation_data["private-address"],
                                          config["database"]))
 
-    execute('service keystone stop', echo=True)
-    if ((is_clustered() and is_leader()) or
-        not is_clustered()):
-        juju_log('Running database migrations for %s' % new_vers)
+    utils.stop('keystone')
+    if (cluster.eligible_leader(CLUSTER_RES)):
+        utils.juju_log('INFO',
+                       'Running database migrations for %s' % new_vers)
         execute('keystone-manage db_sync', echo=True, die=True)
     else:
-        juju_log('Not cluster leader; snoozing whilst leader upgrades DB')
+        utils.juju_log('INFO',
+                       'Not cluster leader; snoozing whilst'
+                       ' leader upgrades DB')
         time.sleep(10)
-    execute('service keystone start', echo=True)
+    utils.start('keystone')
     time.sleep(5)
-    juju_log('Completed Keystone upgrade: %s -> %s' % (old_vers, new_vers))
-
-
-def is_clustered():
-    for r_id in (relation_ids('ha') or []):
-        for unit in (relation_list(r_id) or []):
-            relation_data = \
-                relation_get_dict(relation_id=r_id,
-                                  remote_unit=unit)
-            if 'clustered' in relation_data:
-                return True
-    return False
-
-
-def is_leader():
-    status = execute('crm resource show res_ks_vip', echo=True)[0].strip()
-    hostname = execute('hostname', echo=True)[0].strip()
-    if hostname in status:
-        return True
-    else:
-        return False
-
-
-def peer_units():
-    peers = []
-    for r_id in (relation_ids('cluster') or []):
-        for unit in (relation_list(r_id) or []):
-            peers.append(unit)
-    return peers
-
-def oldest_peer(peers):
-    local_unit_no = os.getenv('JUJU_UNIT_NAME').split('/')[1]
-    for peer in peers:
-        remote_unit_no = peer.split('/')[1]
-        if remote_unit_no < local_unit_no:
-            return False
-    return True
-
-
-def eligible_leader():
-    if is_clustered():
-        if not is_leader():
-            juju_log('Deferring action to CRM leader.')
-            return False
-    else:
-        peers = peer_units()
-        if peers and not oldest_peer(peers):
-            juju_log('Deferring action to oldest service unit.')
-            return False
-    return True
+    utils.juju_log('INFO',
+                   'Completed Keystone upgrade: '
+                   '%s -> %s' % (old_vers, new_vers))
 
 
 def synchronize_service_credentials():
@@ -565,15 +489,17 @@
     Broadcast service credentials to peers or consume those that have been
     broadcasted by peer, depending on hook context.
     '''
-    if (not eligible_leader() or
+    if (not cluster.eligible_leader(CLUSTER_RES) or
         not os.path.isfile(SERVICE_PASSWD_PATH)):
         return
-    juju_log('Synchronizing service passwords to all peers.')
+    utils.juju_log('INFO', 'Synchronizing service passwords to all peers.')
     unison.sync_to_peers(peer_interface='cluster',
                          paths=[SERVICE_PASSWD_PATH], user=SSH_USER,
                          verbose=True)
 
 CA = []
+
+
 def get_ca(user='keystone', group='keystone'):
     """
     Initialize a new CA object if one hasn't already been loaded.
@@ -594,3 +520,11 @@
         execute('chmod -R g+rwx %s' % SSL_DIR)
         CA.append(ca)
     return CA[0]
+
+
+def https():
+    if (utils.config_get('https-service-endpoints') in ["yes", "true", "True"]
+        or cluster.https()):
+        return True
+    else:
+        return False

=== added file 'hooks/lib/apache_utils.py'
--- hooks/lib/apache_utils.py	1970-01-01 00:00:00 +0000
+++ hooks/lib/apache_utils.py	2013-03-19 14:13:27 +0000
@@ -0,0 +1,196 @@
+#
+# Copyright 2012 Canonical Ltd.
+#
+# This file is sourced from lp:openstack-charm-helpers
+#
+# Authors:
+#  James Page <[e-mail]>
+#  Adam Gandelman <[e-mail]>
+#
+
+from lib.utils import (
+    relation_ids,
+    relation_list,
+    relation_get,
+    render_template,
+    juju_log,
+    config_get,
+    install,
+    get_host_ip,
+    restart
+    )
+from lib.cluster_utils import https
+
+import os
+import subprocess
+from base64 import b64decode
+
+APACHE_SITE_DIR = "/etc/apache2/sites-available"
+SITE_TEMPLATE = "apache2_site.tmpl"
+RELOAD_CHECK = "To activate the new configuration"
+
+
+def get_cert():
+    cert = config_get('ssl_cert')
+    key = config_get('ssl_key')
+    if not (cert and key):
+        juju_log('INFO',
+                 "Inspecting identity-service relations for SSL certificate.")
+        cert = key = None
+        for r_id in relation_ids('identity-service'):
+            for unit in relation_list(r_id):
+                if not cert:
+                    cert = relation_get('ssl_cert',
+                                        rid=r_id, unit=unit)
+                if not key:
+                    key = relation_get('ssl_key',
+                                       rid=r_id, unit=unit)
+    return (cert, key)
+
+
+def get_ca_cert():
+    ca_cert = None
+    juju_log('INFO',
+             "Inspecting identity-service relations for CA SSL certificate.")
+    for r_id in relation_ids('identity-service'):
+        for unit in relation_list(r_id):
+            if not ca_cert:
+                ca_cert = relation_get('ca_cert',
+                                       rid=r_id, unit=unit)
+    return ca_cert
+
+
+def install_ca_cert(ca_cert):
+    if ca_cert:
+        with open('/usr/local/share/ca-certificates/keystone_juju_ca_cert.crt',
+                  'w') as crt:
+            crt.write(ca_cert)
+        subprocess.check_call(['update-ca-certificates', '--fresh'])
+
+
+def enable_https(port_maps, namespace, cert, key, ca_cert=None):
+    '''
+    For a given number of port mappings, configures apache2
+    HTTPs local reverse proxying using certficates and keys provided in
+    either configuration data (preferred) or relation data.  Assumes ports
+    are not in use (calling charm should ensure that).
+
+    port_maps: dict: external to internal port mappings
+    namespace: str: name of charm
+    '''
+    def _write_if_changed(path, new_content):
+        content = None
+        if os.path.exists(path):
+            with open(path, 'r') as f:
+                content = f.read().strip()
+        if content != new_content:
+            with open(path, 'w') as f:
+                f.write(new_content)
+            return True
+        else:
+            return False
+
+    juju_log('INFO', "Enabling HTTPS for port mappings: {}".format(port_maps))
+    http_restart = False
+
+    if cert:
+        cert = b64decode(cert)
+    if key:
+        key = b64decode(key)
+    if ca_cert:
+        ca_cert = b64decode(ca_cert)
+
+    if not cert and not key:
+        juju_log('ERROR',
+                 "Expected but could not find SSL certificate data, not "
+                 "configuring HTTPS!")
+        return False
+
+    install('apache2')
+    if RELOAD_CHECK in subprocess.check_output(['a2enmod', 'ssl',
+                                                'proxy', 'proxy_http']):
+        http_restart = True
+
+    ssl_dir = os.path.join('/etc/apache2/ssl', namespace)
+    if not os.path.exists(ssl_dir):
+        os.makedirs(ssl_dir)
+
+    if (_write_if_changed(os.path.join(ssl_dir, 'cert'), cert)):
+        http_restart = True
+    if (_write_if_changed(os.path.join(ssl_dir, 'key'), key)):
+        http_restart = True
+    os.chmod(os.path.join(ssl_dir, 'key'), 0600)
+
+    install_ca_cert(ca_cert)
+
+    sites_dir = '/etc/apache2/sites-available'
+    for ext_port, int_port in port_maps.items():
+        juju_log('INFO',
+                 'Creating apache2 reverse proxy vhost'
+                 ' for {}:{}'.format(ext_port,
+                                     int_port))
+        site = "{}_{}".format(namespace, ext_port)
+        site_path = os.path.join(sites_dir, site)
+        with open(site_path, 'w') as fsite:
+            context = {
+                "ext": ext_port,
+                "int": int_port,
+                "namespace": namespace,
+                "private_address": get_host_ip()
+                }
+            fsite.write(render_template(SITE_TEMPLATE,
+                                        context))
+
+        if RELOAD_CHECK in subprocess.check_output(['a2ensite', site]):
+            http_restart = True
+
+    if http_restart:
+        restart('apache2')
+
+    return True
+
+
+def disable_https(port_maps, namespace):
+    '''
+    Ensure HTTPS reverse proxying is disables for given port mappings
+
+    port_maps: dict: of ext -> int port mappings
+    namespace: str: name of chamr
+    '''
+    juju_log('INFO', 'Ensuring HTTPS disabled for {}'.format(port_maps))
+
+    if (not os.path.exists('/etc/apache2') or
+        not os.path.exists(os.path.join('/etc/apache2/ssl', namespace))):
+        return
+
+    http_restart = False
+    for ext_port in port_maps.keys():
+        if os.path.exists(os.path.join(APACHE_SITE_DIR,
+                                       "{}_{}".format(namespace,
+                                                      ext_port))):
+            juju_log('INFO',
+                     "Disabling HTTPS reverse proxy"
+                     " for {} {}.".format(namespace,
+                                          ext_port))
+            if (RELOAD_CHECK in
+                subprocess.check_output(['a2dissite',
+                                         '{}_{}'.format(namespace,
+                                                        ext_port)])):
+                http_restart = True
+
+    if http_restart:
+        restart(['apache2'])
+
+
+def setup_https(port_maps, namespace, cert, key, ca_cert=None):
+    '''
+    Ensures HTTPS is either enabled or disabled for given port
+    mapping.
+
+    port_maps: dict: of ext -> int port mappings
+    namespace: str: name of charm
+    '''
+    if not https:
+        disable_https(port_maps, namespace)
+    else:
+        enable_https(port_maps, namespace, cert, key, ca_cert)

=== added file 'hooks/lib/cluster_utils.py'
--- hooks/lib/cluster_utils.py	1970-01-01 00:00:00 +0000
+++ hooks/lib/cluster_utils.py	2013-03-19 14:13:27 +0000
@@ -0,0 +1,130 @@
+#
+# Copyright 2012 Canonical Ltd.
+#
+# This file is sourced from lp:openstack-charm-helpers
+#
+# Authors:
+#  James Page <[e-mail]>
+#  Adam Gandelman <[e-mail]>
+#
+
+from lib.utils import (
+    juju_log,
+    relation_ids,
+    relation_list,
+    relation_get,
+    get_unit_hostname,
+    config_get
+    )
+import subprocess
+import os
+
+
+def is_clustered():
+    for r_id in (relation_ids('ha') or []):
+        for unit in (relation_list(r_id) or []):
+            clustered = relation_get('clustered',
+                                     rid=r_id,
+                                     unit=unit)
+            if clustered:
+                return True
+    return False
+
+
+def is_leader(resource):
+    cmd = [
+        "crm", "resource",
+        "show", resource
+        ]
+    try:
+        status = subprocess.check_output(cmd)
+    except subprocess.CalledProcessError:
+        return False
+    else:
+        if get_unit_hostname() in status:
+            return True
+        else:
+            return False
+
+
+def peer_units():
+    peers = []
+    for r_id in (relation_ids('cluster') or []):
+        for unit in (relation_list(r_id) or []):
+            peers.append(unit)
+    return peers
+
+
+def oldest_peer(peers):
+    local_unit_no = int(os.getenv('JUJU_UNIT_NAME').split('/')[1])
+    for peer in peers:
+        remote_unit_no = int(peer.split('/')[1])
+        if remote_unit_no < local_unit_no:
+            return False
+    return True
+
+
+def eligible_leader(resource):
+    if is_clustered():
+        if not is_leader(resource):
+            juju_log('INFO', 'Deferring action to CRM leader.')
+            return False
+    else:
+        peers = peer_units()
+        if peers and not oldest_peer(peers):
+            juju_log('INFO', 'Deferring action to oldest service unit.')
+            return False
+    return True
+
+
+def https():
+    '''
+    Determines whether enough data has been provided in configuration
+    or relation data to configure HTTPS
+    .
+    returns: boolean
+    '''
+    if config_get('use-https') == "yes":
+        return True
+    if config_get('ssl_cert') and config_get('ssl_key'):
+        return True
+    for r_id in relation_ids('identity-service'):
+        for unit in relation_list(r_id):
+            if (relation_get('https_keystone', rid=r_id, unit=unit) and
+                relation_get('ssl_cert', rid=r_id, unit=unit) and
+                relation_get('ssl_key', rid=r_id, unit=unit) and
+                relation_get('ca_cert', rid=r_id, unit=unit)):
+                return True
+    return False
+
+
+def determine_api_port(public_port):
+    '''
+    Determine correct API server listening port based on
+    existence of HTTPS reverse proxy and/or haproxy.
+
+    public_port: int: standard public port for given service
+
+    returns: int: the correct listening port for the API service
+    '''
+    i = 0
+    if len(peer_units()) > 0 or is_clustered():
+        i += 1
+    if https():
+        i += 1
+    return public_port - (i * 10)
+
+
+def determine_haproxy_port(public_port):
+    '''
+    Description: Determine correct proxy listening port based on public IP +
+    existence of HTTPS reverse proxy.
+
+    public_port: int: standard public port for given service
+
+    returns: int: the correct listening port for the HAProxy service
+    '''
+    i = 0
+    if https():
+        i += 1
+    return public_port - (i * 10)

=== added file 'hooks/lib/haproxy_utils.py'
--- hooks/lib/haproxy_utils.py	1970-01-01 00:00:00 +0000
+++ hooks/lib/haproxy_utils.py	2013-03-19 14:13:27 +0000
@@ -0,0 +1,55 @@
+#
+# Copyright 2012 Canonical Ltd.
+#
+# This file is sourced from lp:openstack-charm-helpers
+#
+# Authors:
+#  James Page <[e-mail]>
+#  Adam Gandelman <[e-mail]>
+#
+
+from lib.utils import (
+    relation_ids,
+    relation_list,
+    relation_get,
+    unit_get,
+    reload,
+    render_template
+    )
+import os
+
+HAPROXY_CONF = '/etc/haproxy/haproxy.cfg'
+HAPROXY_DEFAULT = '/etc/default/haproxy'
+
+
+def configure_haproxy(service_ports):
+    '''
+    Configure HAProxy based on the current peers in the service
+    cluster using the provided port map:
+
+        "swift": [ 8080, 8070 ]
+
+    HAproxy will also be reloaded/started if required
+
+    service_ports: dict: dict of lists of [ frontend, backend ]
+    '''
+    cluster_hosts = {}
+    cluster_hosts[os.getenv('JUJU_UNIT_NAME').replace('/', '-')] = \
+        unit_get('private-address')
+    for r_id in relation_ids('cluster'):
+        for unit in relation_list(r_id):
+            cluster_hosts[unit.replace('/', '-')] = \
+                relation_get(attribute='private-address',
+                             rid=r_id,
+                             unit=unit)
+    context = {
+        'units': cluster_hosts,
+        'service_ports': service_ports
+        }
+    with open(HAPROXY_CONF, 'w') as f:
+        f.write(render_template(os.path.basename(HAPROXY_CONF),
+                                context))
+    with open(HAPROXY_DEFAULT, 'w') as f:
+        f.write('ENABLED=1')
+
+    reload('haproxy')

=== modified file 'hooks/lib/openstack_common.py'
--- hooks/lib/openstack_common.py	2013-03-08 11:50:40 +0000
+++ hooks/lib/openstack_common.py	2013-03-19 14:13:27 +0000
@@ -13,7 +13,7 @@
     'oneiric': 'diablo',
     'precise': 'essex',
     'quantal': 'folsom',
-    'raring' : 'grizzly',
+    'raring': 'grizzly',
 }
 
 
@@ -34,6 +34,7 @@
     '1.7.7': 'grizzly',
 }
 
+
 def juju_log(msg):
     subprocess.check_call(['juju-log', msg])
 
@@ -78,6 +79,7 @@
             if v in src:
                 return v
 
+
 def get_os_codename_version(vers):
     '''Determine OpenStack codename from version number.'''
     try:
@@ -136,6 +138,7 @@
     e = "Could not determine OpenStack version for package: %s" % pkg
     error_out(e)
 
+
 def configure_installation_source(rel):
     '''Configure apt installation source.'''
 
@@ -154,7 +157,7 @@
         subprocess.check_call(["add-apt-repository", "-y", src])
     elif rel[:3] == "deb":
         l = len(rel.split('|'))
-        if l ==  2:
+        if l == 2:
             src, key = rel.split('|')
             juju_log("Importing PPA key from keyserver for %s" % src)
             _import_key(key)
@@ -211,6 +214,7 @@
 HAPROXY_CONF = '/etc/haproxy/haproxy.cfg'
 HAPROXY_DEFAULT = '/etc/default/haproxy'
 
+
 def configure_haproxy(units, service_ports, template_dir=None):
     template_dir = template_dir or 'templates'
     import jinja2
@@ -229,6 +233,7 @@
     with open(HAPROXY_DEFAULT, 'w') as f:
         f.write('ENABLED=1')
 
+
 def save_script_rc(script_path="scripts/scriptrc", **env_vars):
     """
     Write an rc file in the charm-delivered directory containing
@@ -238,7 +243,7 @@
     service changes.
     """
     unit_name = os.getenv('JUJU_UNIT_NAME').replace('/', '-')
-    juju_rc_path="/var/lib/juju/units/%s/charm/%s" % (unit_name, script_path)
+    juju_rc_path = "/var/lib/juju/units/%s/charm/%s" % (unit_name, script_path)
     with open(juju_rc_path, 'wb') as rc_script:
         rc_script.write(
             "#!/bin/bash\n")

=== modified file 'hooks/lib/unison.py'
--- hooks/lib/unison.py	2013-02-13 05:57:44 +0000
+++ hooks/lib/unison.py	2013-03-19 14:13:27 +0000
@@ -40,12 +40,10 @@
 #       Either copy required functionality to this library or depend on
 #       something more generic.
 
-import json
 import os
 import sys
-import utils
+import lib.utils as utils
 import subprocess
-import shutil
 import grp
 import pwd
 
@@ -55,7 +53,8 @@
         user = pwd.getpwnam(user)
         return user.pw_dir
     except KeyError:
-        utils.juju_log('Could not get homedir for user %s: user exists?')
+        utils.juju_log('INFO',
+                       'Could not get homedir for user %s: user exists?')
         sys.exit(1)
 
 
@@ -67,27 +66,29 @@
 
     priv_key = os.path.join(ssh_dir, 'id_rsa')
     if not os.path.isfile(priv_key):
-        utils.juju_log('Generating new ssh key for user %s.' % user)
+        utils.juju_log('INFO', 'Generating new ssh key for user %s.' % user)
         cmd = ['ssh-keygen', '-q', '-N', '', '-t', 'rsa', '-b', '2048',
                '-f', priv_key]
         subprocess.check_call(cmd)
 
     pub_key = '%s.pub' % priv_key
     if not os.path.isfile(pub_key):
-        utils.juju_log('Generatring missing ssh public key @ %s.' % pub_key)
+        utils.juju_log('INFO', 'Generatring missing ssh public key @ %s.' % \
+                       pub_key)
         cmd = ['ssh-keygen', '-y', '-f', priv_key]
         p = subprocess.check_output(cmd).strip()
         with open(pub_key, 'wb') as out:
             out.write(p)
     subprocess.check_call(['chown', '-R', user, ssh_dir])
-    return open(priv_key, 'r').read().strip(), open(pub_key, 'r').read().strip()
+    return open(priv_key, 'r').read().strip(), \
+           open(pub_key, 'r').read().strip()
 
 
 def write_authorized_keys(user, keys):
     home_dir = get_homedir(user)
     ssh_dir = os.path.join(home_dir, '.ssh')
     auth_keys = os.path.join(ssh_dir, 'authorized_keys')
-    utils.juju_log('Syncing authorized_keys @ %s.' % auth_keys)
+    utils.juju_log('INFO', 'Syncing authorized_keys @ %s.' % auth_keys)
     with open(auth_keys, 'wb') as out:
         for k in keys:
             out.write('%s\n' % k)
@@ -96,13 +97,13 @@
 def write_known_hosts(user, hosts):
     home_dir = get_homedir(user)
     ssh_dir = os.path.join(home_dir, '.ssh')
-    known_hosts  = os.path.join(ssh_dir, 'known_hosts')
+    known_hosts = os.path.join(ssh_dir, 'known_hosts')
     khosts = []
     for host in hosts:
         cmd = ['ssh-keyscan', '-H', '-t', 'rsa', host]
         remote_key = subprocess.check_output(cmd).strip()
         khosts.append(remote_key)
-    utils.juju_log('Syncing known_hosts @ %s.' % known_hosts)
+    utils.juju_log('INFO', 'Syncing known_hosts @ %s.' % known_hosts)
     with open(known_hosts, 'wb') as out:
         for host in khosts:
             out.write('%s\n' % host)
@@ -113,7 +114,7 @@
     try:
         pwd.getpwnam(user)
     except KeyError:
-        utils.juju_log('Creating new user %s.%s.' % (user, group))
+        utils.juju_log('INFO', 'Creating new user %s.%s.' % (user, group))
         cmd = ['adduser', '--system', '--shell', '/bin/bash', user]
         if group:
             try:
@@ -134,7 +135,7 @@
     priv_key, pub_key = get_keypair(user)
     hook = os.path.basename(sys.argv[0])
     if hook == '%s-relation-joined' % peer_interface:
-        utils.relation_set_2(ssh_pub_key=pub_key)
+        utils.relation_set(ssh_pub_key=pub_key)
         print 'joined'
     elif hook == '%s-relation-changed' % peer_interface:
         hosts = []
@@ -147,34 +148,38 @@
                     keys.append(settings['ssh_pub_key'])
                     hosts.append(settings['private-address'])
                 else:
-                    utils.juju_log('ssh_authorized_peers(): ssh_pub_key '\
+                    utils.juju_log('INFO',
+                                   'ssh_authorized_peers(): ssh_pub_key '\
                                    'missing for unit %s, skipping.' % unit)
         write_authorized_keys(user, keys)
         write_known_hosts(user, hosts)
         authed_hosts = ':'.join(hosts)
-        utils.relation_set_2(ssh_authorized_hosts=authed_hosts)
+        utils.relation_set(ssh_authorized_hosts=authed_hosts)
 
 
 def _run_as_user(user):
     try:
         user = pwd.getpwnam(user)
     except KeyError:
-        utils.juju_log('Invalid user: %s' % user)
+        utils.juju_log('INFO', 'Invalid user: %s' % user)
         sys.exit(1)
     uid, gid = user.pw_uid, user.pw_gid
     os.environ['HOME'] = user.pw_dir
+
     def _inner():
         os.setgid(gid)
         os.setuid(uid)
     return _inner
 
+
 def run_as_user(user, cmd):
     return subprocess.check_output(cmd, preexec_fn=_run_as_user(user))
 
+
 def sync_to_peers(peer_interface, user, paths=[], verbose=False):
     base_cmd = ['unison', '-auto', '-batch=true', '-confirmbigdel=false',
-                '-fastcheck=true', '-group=false', '-owner=false', '-prefer=newer',
-                '-times=true']
+                '-fastcheck=true', '-group=false', '-owner=false',
+                '-prefer=newer', '-times=true']
     if not verbose:
         base_cmd.append('-silent')
 
@@ -206,10 +211,10 @@
         # removing trailing slash from directory paths, unison
         # doesn't like these.
         if path.endswith('/'):
-            path = path[:(len(path)-1)]
+            path = path[:(len(path) - 1)]
         for host in hosts:
             cmd = base_cmd + [path, 'ssh://%s@%s/%s' % (user, host, path)]
-            utils.juju_log('Syncing local path %s to %s@%s:%s' %\
+            utils.juju_log('INFO', 'Syncing local path %s to %s@%s:%s' %\
                             (path, user, host, path))
             print ' '.join(cmd)
             run_as_user(user, cmd)

=== added file 'hooks/lib/utils.py'
--- hooks/lib/utils.py	1970-01-01 00:00:00 +0000
+++ hooks/lib/utils.py	2013-03-19 14:13:27 +0000
@@ -0,0 +1,329 @@
+#
+# Copyright 2012 Canonical Ltd.
+#
+# This file is sourced from lp:openstack-charm-helpers
+#
+# Authors:
+#  James Page <[e-mail]>
+#  Paul Collins <[e-mail]>
+#  Adam Gandelman <[e-mail]>
+#
+
+import json
+import os
+import subprocess
+import socket
+import sys
+
+
+def do_hooks(hooks):
+    hook = os.path.basename(sys.argv[0])
+
+    try:
+        hook_func = hooks[hook]
+    except KeyError:
+        juju_log('INFO',
+                 "This charm doesn't know how to handle '{}'.".format(hook))
+    else:
+        hook_func()
+
+
+def install(*pkgs):
+    cmd = [
+        'apt-get',
+        '-y',
+        'install'
+          ]
+    for pkg in pkgs:
+        cmd.append(pkg)
+    subprocess.check_call(cmd)
+
+TEMPLATES_DIR = 'templates'
+
+try:
+    import jinja2
+except ImportError:
+    install('python-jinja2')
+    import jinja2
+
+try:
+    import dns.resolver
+except ImportError:
+    install('python-dnspython')
+    import dns.resolver
+
+
+def render_template(template_name, context, template_dir=TEMPLATES_DIR):
+    templates = jinja2.Environment(
+                    loader=jinja2.FileSystemLoader(template_dir)
+                    )
+    template = templates.get_template(template_name)
+    return template.render(context)
+
+CLOUD_ARCHIVE = \
+""" # Ubuntu Cloud Archive
+deb http://ubuntu-cloud.archive.canonical.com/ubuntu {} main
+"""
+
+CLOUD_ARCHIVE_POCKETS = {
+    'folsom': 'precise-updates/folsom',
+    'folsom/updates': 'precise-updates/folsom',
+    'folsom/proposed': 'precise-proposed/folsom',
+    'grizzly': 'precise-updates/grizzly',
+    'grizzly/updates': 'precise-updates/grizzly',
+    'grizzly/proposed': 'precise-proposed/grizzly'
+    }
+
+
+def configure_source():
+    source = str(config_get('openstack-origin'))
+    if not source:
+        return
+    if source.startswith('ppa:'):
+        cmd = [
+            'add-apt-repository',
+            source
+            ]
+        subprocess.check_call(cmd)
+    if source.startswith('cloud:'):
+        install('ubuntu-cloud-keyring')
+        pocket = source.split(':')[1]
+        with open('/etc/apt/sources.list.d/cloud-archive.list', 'w') as apt:
+            apt.write(CLOUD_ARCHIVE.format(CLOUD_ARCHIVE_POCKETS[pocket]))
+    if source.startswith('deb'):
+        l = len(source.split('|'))
+        if l == 2:
+            (apt_line, key) = source.split('|')
+            cmd = [
+                'apt-key',
+                'adv', '--keyserver keyserver.ubuntu.com',
+                '--recv-keys', key
+                ]
+            subprocess.check_call(cmd)
+        elif l == 1:
+            apt_line = source
+
+        with open('/etc/apt/sources.list.d/quantum.list', 'w') as apt:
+            apt.write(apt_line + "\n")
+    cmd = [
+        'apt-get',
+        'update'
+        ]
+    subprocess.check_call(cmd)
+
+# Protocols
+TCP = 'TCP'
+UDP = 'UDP'
+
+
+def expose(port, protocol='TCP'):
+    cmd = [
+        'open-port',
+        '{}/{}'.format(port, protocol)
+        ]
+    subprocess.check_call(cmd)
+
+
+def juju_log(severity, message):
+    cmd = [
+        'juju-log',
+        '--log-level', severity,
+        message
+        ]
+    subprocess.check_call(cmd)
+
+
+cache = {}
+
+
+def cached(func):
+    def wrapper(*args, **kwargs):
+        global cache
+        key = str((func, args, kwargs))
+        try:
+            return cache[key]
+        except KeyError:
+            res = func(*args, **kwargs)
+            cache[key] = res
+            return res
+    return wrapper
+
+
+@cached
+def relation_ids(relation):
+    cmd = [
+        'relation-ids',
+        relation
+        ]
+    result = str(subprocess.check_output(cmd)).split()
+    if result == "":
+        return None
+    else:
+        return result
+
+
+@cached
+def relation_list(rid):
+    cmd = [
+        'relation-list',
+        '-r', rid,
+        ]
+    result = str(subprocess.check_output(cmd)).split()
+    if result == "":
+        return None
+    else:
+        return result
+
+
+@cached
+def relation_get(attribute, unit=None, rid=None):
+    cmd = [
+        'relation-get',
+        ]
+    if rid:
+        cmd.append('-r')
+        cmd.append(rid)
+    cmd.append(attribute)
+    if unit:
+        cmd.append(unit)
+    value = subprocess.check_output(cmd).strip()  # IGNORE:E1103
+    if value == "":
+        return None
+    else:
+        return value
+
+
+@cached
+def relation_get_dict(relation_id=None, remote_unit=None):
+    """Obtain all relation data as dict by way of JSON"""
+    cmd = [
+        'relation-get', '--format=json'
+        ]
+    if relation_id:
+        cmd.append('-r')
+        cmd.append(relation_id)
+    if remote_unit:
+        remote_unit_orig = os.getenv('JUJU_REMOTE_UNIT', None)
+        os.environ['JUJU_REMOTE_UNIT'] = remote_unit
+    j = subprocess.check_output(cmd)
+    if remote_unit and remote_unit_orig:
+        os.environ['JUJU_REMOTE_UNIT'] = remote_unit_orig
+    d = json.loads(j)
+    settings = {}
+    # convert unicode to strings
+    for k, v in d.iteritems():
+        settings[str(k)] = str(v)
+    return settings
+
+
+def relation_set(**kwargs):
+    cmd = [
+        'relation-set'
+        ]
+    args = []
+    for k, v in kwargs.items():
+        if k == 'rid':
+            if v:
+                cmd.append('-r')
+                cmd.append(v)
+        else:
+            args.append('{}={}'.format(k, v))
+    cmd += args
+    subprocess.check_call(cmd)
+
+
+@cached
+def unit_get(attribute):
+    cmd = [
+        'unit-get',
+        attribute
+        ]
+    value = subprocess.check_output(cmd).strip()  # IGNORE:E1103
+    if value == "":
+        return None
+    else:
+        return value
+
+
+@cached
+def config_get(attribute):
+    cmd = [
+        'config-get',
+        '--format',
+        'json',
+        ]
+    out = subprocess.check_output(cmd).strip()  # IGNORE:E1103
+    cfg = json.loads(out)
+
+    try:
+        return cfg[attribute]
+    except KeyError:
+        return None
+
+
+@cached
+def get_unit_hostname():
+    return socket.gethostname()
+
+
+@cached
+def get_host_ip(hostname=unit_get('private-address')):
+    try:
+        # Test to see if already an IPv4 address
+        socket.inet_aton(hostname)
+        return hostname
+    except socket.error:
+        answers = dns.resolver.query(hostname, 'A')
+        if answers:
+            return answers[0].address
+    return None
+
+
+def _svc_control(service, action):
+    subprocess.check_call(['service', service, action])
+
+
+def restart(*services):
+    for service in services:
+        _svc_control(service, 'restart')
+
+
+def stop(*services):
+    for service in services:
+        _svc_control(service, 'stop')
+
+
+def start(*services):
+    for service in services:
+        _svc_control(service, 'start')
+
+
+def reload(*services):
+    for service in services:
+        try:
+            _svc_control(service, 'reload')
+        except subprocess.CalledProcessError:
+            # Reload failed - either service does not support reload
+            # or it was not running - restart will fixup most things
+            _svc_control(service, 'restart')
+
+
+def running(service):
+    try:
+        output = subprocess.check_output(['service', service, 'status'])
+    except subprocess.CalledProcessError:
+        return False
+    else:
+        if ("start/running" in output or
+            "is running" in output):
+            return True
+        else:
+            return False
+
+
+def is_relation_made(relation, key='private-address'):
+    for r_id in (relation_ids(relation) or []):
+        for unit in (relation_list(r_id) or []):
+            if relation_get(key, rid=r_id, unit=unit):
+                return True
+    return False

=== modified file 'hooks/manager.py'
--- hooks/manager.py	2012-02-29 01:18:17 +0000
+++ hooks/manager.py	2013-03-19 14:13:27 +0000
@@ -1,6 +1,7 @@
 #!/usr/bin/python
 from keystoneclient.v2_0 import client
 
+
 class KeystoneManager(object):
     def __init__(self, endpoint, token):
         self.api = client.Client(endpoint=endpoint, token=token)

=== modified symlink 'hooks/shared-db-relation-changed'
=== target changed u'keystone-hooks' => u'keystone_hooks.py'
=== modified symlink 'hooks/shared-db-relation-joined'
=== target changed u'keystone-hooks' => u'keystone_hooks.py'
=== modified symlink 'hooks/upgrade-charm'
=== target changed u'keystone-hooks' => u'keystone_hooks.py'
=== modified file 'templates/haproxy.cfg'
--- templates/haproxy.cfg	2013-02-15 15:56:14 +0000
+++ templates/haproxy.cfg	2013-03-19 14:13:27 +0000
@@ -1,7 +1,7 @@
 global
     log 127.0.0.1 local0
     log 127.0.0.1 local1 notice
-    maxconn 4096
+    maxconn 20000
     user haproxy
     group haproxy
     spread-checks 0
@@ -14,8 +14,8 @@
     retries 3
     timeout queue 1000
     timeout connect 1000
-    timeout client 10000
-    timeout server 10000
+    timeout client 30000
+    timeout server 30000
 
 listen stats :8888
     mode http
@@ -25,11 +25,11 @@
     stats uri /
     stats auth admin:password
 
-{% for service, port in service_ports.iteritems() -%}
-listen {{ service }} 0.0.0.0:{{ port }}
+{% for service, ports in service_ports.iteritems() -%}
+listen {{ service }} 0.0.0.0:{{ ports[0] }}
     balance roundrobin
     option tcplog
     {% for unit, address in units.iteritems() -%}
-    server {{ unit }} {{ address }}:{{ port - 1 }} check
+    server {{ unit }} {{ address }}:{{ ports[1] }} check
     {% endfor %}
 {% endfor %}